[gentoo-commits] linux-patches r2815 - genpatches-2.6/trunk/3.14

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2014-06-07 23:56:08 +0000 (Sat, 07 Jun 2014)
New Revision: 2815

Added:
   genpatches-2.6/trunk/3.14/1005_linux-3.14.6.patch
Removed:
   genpatches-2.6/trunk/3.14/1501-futex-add-another-early-deadlock-detection-check.patch
   genpatches-2.6/trunk/3.14/1502-futex-prevent-attaching-to-kernel-threads.patch
   genpatches-2.6/trunk/3.14/1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch
   genpatches-2.6/trunk/3.14/1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch
   genpatches-2.6/trunk/3.14/1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch
   genpatches-2.6/trunk/3.14/1506-futex-make-lookup_pi_state-more-robust.patch
Modified:
   genpatches-2.6/trunk/3.14/0000_README
Log:
Linux patch 3.14.6. Removal of redundant patches.

Modified: genpatches-2.6/trunk/3.14/0000_README
===================================================================
--- genpatches-2.6/trunk/3.14/0000_README	2014-06-06 20:06:46 UTC (rev 2814)
+++ genpatches-2.6/trunk/3.14/0000_README	2014-06-07 23:56:08 UTC (rev 2815)
@@ -62,34 +62,14 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.14.5
 
+Patch:  1005_linux-3.14.6.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.14.6
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
 
-Patch:  1501-futex-add-another-early-deadlock-detection-check.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=866293ee54227584ffcb4a42f69c1f365974ba7f
-Desc:   CVE-2014-3153
-
-Patch:  1502-futex-prevent-attaching-to-kernel-threads.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f0d71b3dcb8332f7971b5f2363632573e6d9486a
-Desc:   CVE-2014-3153
-
-Patch:  1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9c243a5a6de0be8e584c604d353412584b592f8
-Desc:   CVE-2014-3153
-
-Patch:  1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270
-Desc:   CVE-2014-3153
-
-Patch:  1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e
-Desc:   CVE-2014-3153
-
-Patch:  1506-futex-make-lookup_pi_state-more-robust.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339
-Desc:   CVE-2014-3153
-
 Patch:  1700_enable-thinkpad-micled.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=449248
 Desc:   Enable mic mute led in thinkpads

Added: genpatches-2.6/trunk/3.14/1005_linux-3.14.6.patch
===================================================================
--- genpatches-2.6/trunk/3.14/1005_linux-3.14.6.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.14/1005_linux-3.14.6.patch	2014-06-07 23:56:08 UTC (rev 2815)
@@ -0,0 +1,9578 @@
+diff --git a/Documentation/devicetree/bindings/dma/ti-edma.txt b/Documentation/devicetree/bindings/dma/ti-edma.txt
+index 9fbbdb783a72..68ff2137bae7 100644
+--- a/Documentation/devicetree/bindings/dma/ti-edma.txt
++++ b/Documentation/devicetree/bindings/dma/ti-edma.txt
+@@ -29,6 +29,6 @@ edma: edma@49000000 {
+ 	dma-channels = <64>;
+ 	ti,edma-regions = <4>;
+ 	ti,edma-slots = <256>;
+-	ti,edma-xbar-event-map = <1 12
+-				  2 13>;
++	ti,edma-xbar-event-map = /bits/ 16 <1 12
++					    2 13>;
+ };
+diff --git a/Documentation/i2c/busses/i2c-i801 b/Documentation/i2c/busses/i2c-i801
+index aaaf069306a3..adf5e33e8312 100644
+--- a/Documentation/i2c/busses/i2c-i801
++++ b/Documentation/i2c/busses/i2c-i801
+@@ -26,6 +26,7 @@ Supported adapters:
+   * Intel Wellsburg (PCH)
+   * Intel Coleto Creek (PCH)
+   * Intel Wildcat Point-LP (PCH)
++  * Intel BayTrail (SOC)
+    Datasheets: Publicly available at the Intel website
+ 
+ On Intel Patsburg and later chipsets, both the normal host SMBus controller
+diff --git a/Documentation/input/elantech.txt b/Documentation/input/elantech.txt
+index 5602eb71ad5d..e1ae127ed099 100644
+--- a/Documentation/input/elantech.txt
++++ b/Documentation/input/elantech.txt
+@@ -504,9 +504,12 @@ byte 5:
+ * reg_10
+ 
+    bit   7   6   5   4   3   2   1   0
+-         0   0   0   0   0   0   0   A
++         0   0   0   0   R   F   T   A
+ 
+          A: 1 = enable absolute tracking
++         T: 1 = enable two finger mode auto correct
++         F: 1 = disable ABS Position Filter
++         R: 1 = enable real hardware resolution
+ 
+ 6.2 Native absolute mode 6 byte packet format
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+diff --git a/Documentation/ja_JP/HOWTO b/Documentation/ja_JP/HOWTO
+index 0091a8215ac1..b61885c35ce1 100644
+--- a/Documentation/ja_JP/HOWTO
++++ b/Documentation/ja_JP/HOWTO
+@@ -315,7 +315,7 @@ Andrew Morton が Linux-kernel メーリングリストにカーネルリリー
+ もし、3.x.y カーネルが存在しない場合には、番号が一番大きい 3.x が
+ 最新の安定版カーネルです。
+ 
+-3.x.y は "stable" チーム <stable@××××××.org> でメンテされており、必
++3.x.y は "stable" チーム <stable@×××××××××××.org> でメンテされており、必
+ 要に応じてリリースされます。通常のリリース期間は 2週間毎ですが、差し迫っ
+ た問題がなければもう少し長くなることもあります。セキュリティ関連の問題
+ の場合はこれに対してだいたいの場合、すぐにリリースがされます。
+diff --git a/Documentation/ja_JP/stable_kernel_rules.txt b/Documentation/ja_JP/stable_kernel_rules.txt
+index 14265837c4ce..9dbda9b5d21e 100644
+--- a/Documentation/ja_JP/stable_kernel_rules.txt
++++ b/Documentation/ja_JP/stable_kernel_rules.txt
+@@ -50,16 +50,16 @@ linux-2.6.29/Documentation/stable_kernel_rules.txt
+ 
+ -stable ツリーにパッチを送付する手続き-
+ 
+- - 上記の規則に従っているかを確認した後に、stable@××××××.org にパッチ
++ - 上記の規則に従っているかを確認した後に、stable@×××××××××××.org にパッチ
+    を送る。
+  - 送信者はパッチがキューに受け付けられた際には ACK を、却下された場合
+    には NAK を受け取る。この反応は開発者たちのスケジュールによって、数
+    日かかる場合がある。
+  - もし受け取られたら、パッチは他の開発者たちと関連するサブシステムの
+    メンテナーによるレビューのために -stable キューに追加される。
+- - パッチに stable@××××××.org のアドレスが付加されているときには、それ
++ - パッチに stable@×××××××××××.org のアドレスが付加されているときには、それ
+    が Linus のツリーに入る時に自動的に stable チームに email される。
+- - セキュリティパッチはこのエイリアス (stable@××××××.org) に送られるべ
++ - セキュリティパッチはこのエイリアス (stable@×××××××××××.org) に送られるべ
+    きではなく、代わりに security@××××××.org のアドレスに送られる。
+ 
+ レビューサイクル-
+diff --git a/Documentation/zh_CN/HOWTO b/Documentation/zh_CN/HOWTO
+index 6c914aa87e71..54ea24ff63c7 100644
+--- a/Documentation/zh_CN/HOWTO
++++ b/Documentation/zh_CN/HOWTO
+@@ -237,7 +237,7 @@ kernel.org网站的pub/linux/kernel/v2.6/目录下找到它。它的开发遵循
+ 如果没有2.6.x.y版本内核存在，那么最新的2.6.x版本内核就相当于是当前的稳定
+ 版内核。
+ 
+-2.6.x.y版本由“稳定版”小组（邮件地址<stable@××××××.org>）维护，一般隔周发
++2.6.x.y版本由“稳定版”小组（邮件地址<stable@×××××××××××.org>）维护，一般隔周发
+ 布新版本。
+ 
+ 内核源码中的Documentation/stable_kernel_rules.txt文件具体描述了可被稳定
+diff --git a/Documentation/zh_CN/stable_kernel_rules.txt b/Documentation/zh_CN/stable_kernel_rules.txt
+index b5b9b0ab02fd..26ea5ed7cd9c 100644
+--- a/Documentation/zh_CN/stable_kernel_rules.txt
++++ b/Documentation/zh_CN/stable_kernel_rules.txt
+@@ -42,7 +42,7 @@ Documentation/stable_kernel_rules.txt 的中文翻译
+ 
+ 向稳定版代码树提交补丁的过程：
+ 
+-  - 在确认了补丁符合以上的规则后，将补丁发送到stable@××××××.org。
++  - 在确认了补丁符合以上的规则后，将补丁发送到stable@×××××××××××.org。
+   - 如果补丁被接受到队列里，发送者会收到一个ACK回复，如果没有被接受，收
+     到的是NAK回复。回复需要几天的时间，这取决于开发者的时间安排。
+   - 被接受的补丁会被加到稳定版本队列里，等待其他开发者的审查。
+diff --git a/Makefile b/Makefile
+index fa77b0bed2a2..0d499e6896cd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 14
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+ NAME = Remembering Coco
+ 
+diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi
+index 79087ccf64bc..ab01d0f98d1a 100644
+--- a/arch/arm/boot/dts/am33xx.dtsi
++++ b/arch/arm/boot/dts/am33xx.dtsi
+@@ -140,7 +140,7 @@
+ 			compatible = "ti,edma3";
+ 			ti,hwmods = "tpcc", "tptc0", "tptc1", "tptc2";
+ 			reg =	<0x49000000 0x10000>,
+-				<0x44e10f90 0x10>;
++				<0x44e10f90 0x40>;
+ 			interrupts = <12 13 14>;
+ 			#dma-cells = <1>;
+ 			dma-channels = <64>;
+diff --git a/arch/arm/boot/dts/armada-xp-db.dts b/arch/arm/boot/dts/armada-xp-db.dts
+index bcf6d79a57ec..8c2fe44e4dfe 100644
+--- a/arch/arm/boot/dts/armada-xp-db.dts
++++ b/arch/arm/boot/dts/armada-xp-db.dts
+@@ -40,7 +40,7 @@
+ 			/* Device Bus parameters are required */
+ 
+ 			/* Read parameters */
+-			devbus,bus-width    = <8>;
++			devbus,bus-width    = <16>;
+ 			devbus,turn-off-ps  = <60000>;
+ 			devbus,badr-skew-ps = <0>;
+ 			devbus,acc-first-ps = <124000>;
+diff --git a/arch/arm/boot/dts/armada-xp-gp.dts b/arch/arm/boot/dts/armada-xp-gp.dts
+index 274e2ad5f51c..df5c34284dbd 100644
+--- a/arch/arm/boot/dts/armada-xp-gp.dts
++++ b/arch/arm/boot/dts/armada-xp-gp.dts
+@@ -49,7 +49,7 @@
+ 			/* Device Bus parameters are required */
+ 
+ 			/* Read parameters */
+-			devbus,bus-width    = <8>;
++			devbus,bus-width    = <16>;
+ 			devbus,turn-off-ps  = <60000>;
+ 			devbus,badr-skew-ps = <0>;
+ 			devbus,acc-first-ps = <124000>;
+diff --git a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts
+index 99bcf76e6953..b33e10ea2ea0 100644
+--- a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts
++++ b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts
+@@ -37,7 +37,7 @@
+ 			/* Device Bus parameters are required */
+ 
+ 			/* Read parameters */
+-			devbus,bus-width    = <8>;
++			devbus,bus-width    = <16>;
+ 			devbus,turn-off-ps  = <60000>;
+ 			devbus,badr-skew-ps = <0>;
+ 			devbus,acc-first-ps = <124000>;
+diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
+index 4307e80b2d2e..dc72353de0b3 100644
+--- a/arch/arm/boot/dts/imx53.dtsi
++++ b/arch/arm/boot/dts/imx53.dtsi
+@@ -87,7 +87,7 @@
+ 		ipu: ipu@18000000 {
+ 			#crtc-cells = <1>;
+ 			compatible = "fsl,imx53-ipu";
+-			reg = <0x18000000 0x080000000>;
++			reg = <0x18000000 0x08000000>;
+ 			interrupts = <11 10>;
+ 			clocks = <&clks 59>, <&clks 110>, <&clks 61>;
+ 			clock-names = "bus", "di0", "di1";
+diff --git a/arch/arm/boot/dts/kirkwood-mv88f6281gtw-ge.dts b/arch/arm/boot/dts/kirkwood-mv88f6281gtw-ge.dts
+index dc86429756d7..4651672bda89 100644
+--- a/arch/arm/boot/dts/kirkwood-mv88f6281gtw-ge.dts
++++ b/arch/arm/boot/dts/kirkwood-mv88f6281gtw-ge.dts
+@@ -30,6 +30,16 @@
+ 		bootargs = "console=ttyS0,115200n8 earlyprintk";
+ 	};
+ 
++	mbus {
++		pcie-controller {
++			status = "okay";
++
++			pcie@1,0 {
++				status = "okay";
++			};
++		};
++        };
++
+ 	ocp@f1000000 {
+ 		pinctrl@10000 {
+ 			pmx_usb_led: pmx-usb-led {
+@@ -73,14 +83,6 @@
+ 		ehci@50000 {
+ 			status = "okay";
+ 		};
+-
+-		pcie-controller {
+-			status = "okay";
+-
+-			pcie@1,0 {
+-				status = "okay";
+-			};
+-		};
+ 	};
+ 
+ 	gpio-leds {
+diff --git a/arch/arm/boot/dts/kirkwood-nsa310-common.dtsi b/arch/arm/boot/dts/kirkwood-nsa310-common.dtsi
+index aa78c2d11fe7..e2cc85cc3b87 100644
+--- a/arch/arm/boot/dts/kirkwood-nsa310-common.dtsi
++++ b/arch/arm/boot/dts/kirkwood-nsa310-common.dtsi
+@@ -4,6 +4,16 @@
+ / {
+ 	model = "ZyXEL NSA310";
+ 
++	mbus {
++		pcie-controller {
++			status = "okay";
++
++			pcie@1,0 {
++				status = "okay";
++			};
++		};
++	};
++
+ 	ocp@f1000000 {
+ 		pinctrl: pinctrl@10000 {
+ 
+@@ -26,14 +36,6 @@
+ 			status = "okay";
+ 			nr-ports = <2>;
+ 		};
+-
+-		pcie-controller {
+-			status = "okay";
+-
+-			pcie@1,0 {
+-				status = "okay";
+-			};
+-		};
+ 	};
+ 
+ 	gpio_poweroff {
+diff --git a/arch/arm/boot/dts/ste-ccu8540.dts b/arch/arm/boot/dts/ste-ccu8540.dts
+index 7f3baf51a3a9..32dd55e5f4e6 100644
+--- a/arch/arm/boot/dts/ste-ccu8540.dts
++++ b/arch/arm/boot/dts/ste-ccu8540.dts
+@@ -18,6 +18,7 @@
+ 	compatible = "st-ericsson,ccu8540", "st-ericsson,u8540";
+ 
+ 	memory@0 {
++		device_type = "memory";
+ 		reg = <0x20000000 0x1f000000>, <0xc0000000 0x3f000000>;
+ 	};
+ 
+diff --git a/arch/arm/common/edma.c b/arch/arm/common/edma.c
+index 41bca32409fc..5339009b3c0c 100644
+--- a/arch/arm/common/edma.c
++++ b/arch/arm/common/edma.c
+@@ -1423,55 +1423,38 @@ EXPORT_SYMBOL(edma_clear_event);
+ 
+ #if IS_ENABLED(CONFIG_OF) && IS_ENABLED(CONFIG_DMADEVICES)
+ 
+-static int edma_of_read_u32_to_s16_array(const struct device_node *np,
+-					 const char *propname, s16 *out_values,
+-					 size_t sz)
++static int edma_xbar_event_map(struct device *dev, struct device_node *node,
++			       struct edma_soc_info *pdata, size_t sz)
+ {
+-	int ret;
+-
+-	ret = of_property_read_u16_array(np, propname, out_values, sz);
+-	if (ret)
+-		return ret;
+-
+-	/* Terminate it */
+-	*out_values++ = -1;
+-	*out_values++ = -1;
+-
+-	return 0;
+-}
+-
+-static int edma_xbar_event_map(struct device *dev,
+-			       struct device_node *node,
+-			       struct edma_soc_info *pdata, int len)
+-{
+-	int ret, i;
++	const char pname[] = "ti,edma-xbar-event-map";
+ 	struct resource res;
+ 	void __iomem *xbar;
+-	const s16 (*xbar_chans)[2];
++	s16 (*xbar_chans)[2];
++	size_t nelm = sz / sizeof(s16);
+ 	u32 shift, offset, mux;
++	int ret, i;
+ 
+-	xbar_chans = devm_kzalloc(dev,
+-				  len/sizeof(s16) + 2*sizeof(s16),
+-				  GFP_KERNEL);
++	xbar_chans = devm_kzalloc(dev, (nelm + 2) * sizeof(s16), GFP_KERNEL);
+ 	if (!xbar_chans)
+ 		return -ENOMEM;
+ 
+ 	ret = of_address_to_resource(node, 1, &res);
+ 	if (ret)
+-		return -EIO;
++		return -ENOMEM;
+ 
+ 	xbar = devm_ioremap(dev, res.start, resource_size(&res));
+ 	if (!xbar)
+ 		return -ENOMEM;
+ 
+-	ret = edma_of_read_u32_to_s16_array(node,
+-					    "ti,edma-xbar-event-map",
+-					    (s16 *)xbar_chans,
+-					    len/sizeof(u32));
++	ret = of_property_read_u16_array(node, pname, (u16 *)xbar_chans, nelm);
+ 	if (ret)
+ 		return -EIO;
+ 
+-	for (i = 0; xbar_chans[i][0] != -1; i++) {
++	/* Invalidate last entry for the other user of this mess */
++	nelm >>= 1;
++	xbar_chans[nelm][0] = xbar_chans[nelm][1] = -1;
++
++	for (i = 0; i < nelm; i++) {
+ 		shift = (xbar_chans[i][1] & 0x03) << 3;
+ 		offset = xbar_chans[i][1] & 0xfffffffc;
+ 		mux = readl(xbar + offset);
+@@ -1480,8 +1463,7 @@ static int edma_xbar_event_map(struct device *dev,
+ 		writel(mux, (xbar + offset));
+ 	}
+ 
+-	pdata->xbar_chans = xbar_chans;
+-
++	pdata->xbar_chans = (const s16 (*)[2]) xbar_chans;
+ 	return 0;
+ }
+ 
+diff --git a/arch/arm/kernel/crash_dump.c b/arch/arm/kernel/crash_dump.c
+index 90c50d4b43f7..5d1286d51154 100644
+--- a/arch/arm/kernel/crash_dump.c
++++ b/arch/arm/kernel/crash_dump.c
+@@ -39,7 +39,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
+ 	if (!csize)
+ 		return 0;
+ 
+-	vaddr = ioremap(pfn << PAGE_SHIFT, PAGE_SIZE);
++	vaddr = ioremap(__pfn_to_phys(pfn), PAGE_SIZE);
+ 	if (!vaddr)
+ 		return -ENOMEM;
+ 
+diff --git a/arch/arm/mach-mvebu/mvebu-soc-id.c b/arch/arm/mach-mvebu/mvebu-soc-id.c
+index f3b325f6cbd4..0e1547a186b0 100644
+--- a/arch/arm/mach-mvebu/mvebu-soc-id.c
++++ b/arch/arm/mach-mvebu/mvebu-soc-id.c
+@@ -107,7 +107,18 @@ static int __init mvebu_soc_id_init(void)
+ 	iounmap(pci_base);
+ 
+ res_ioremap:
+-	clk_disable_unprepare(clk);
++	/*
++	 * If the PCIe unit is actually enabled and we have PCI
++	 * support in the kernel, we intentionally do not release the
++	 * reference to the clock. We want to keep it running since
++	 * the bootloader does some PCIe link configuration that the
++	 * kernel is for now unable to do, and gating the clock would
++	 * make us loose this precious configuration.
++	 */
++	if (!of_device_is_available(child) || !IS_ENABLED(CONFIG_PCI_MVEBU)) {
++		clk_disable_unprepare(clk);
++		clk_put(clk);
++	}
+ 
+ clk_err:
+ 	of_node_put(child);
+diff --git a/arch/arm/mach-orion5x/common.h b/arch/arm/mach-orion5x/common.h
+index f565f9944af2..7548db2bfb8a 100644
+--- a/arch/arm/mach-orion5x/common.h
++++ b/arch/arm/mach-orion5x/common.h
+@@ -21,7 +21,7 @@ struct mv_sata_platform_data;
+ #define ORION_MBUS_DEVBUS_BOOT_ATTR   0x0f
+ #define ORION_MBUS_DEVBUS_TARGET(cs)  0x01
+ #define ORION_MBUS_DEVBUS_ATTR(cs)    (~(1 << cs))
+-#define ORION_MBUS_SRAM_TARGET        0x00
++#define ORION_MBUS_SRAM_TARGET        0x09
+ #define ORION_MBUS_SRAM_ATTR          0x00
+ 
+ /*
+diff --git a/arch/arm64/kernel/irq.c b/arch/arm64/kernel/irq.c
+index 473e5dbf8f39..0f08dfd69ebc 100644
+--- a/arch/arm64/kernel/irq.c
++++ b/arch/arm64/kernel/irq.c
+@@ -97,11 +97,15 @@ static bool migrate_one_irq(struct irq_desc *desc)
+ 	if (irqd_is_per_cpu(d) || !cpumask_test_cpu(smp_processor_id(), affinity))
+ 		return false;
+ 
+-	if (cpumask_any_and(affinity, cpu_online_mask) >= nr_cpu_ids) {
+-		affinity = cpu_online_mask;
++	if (cpumask_any_and(affinity, cpu_online_mask) >= nr_cpu_ids)
+ 		ret = true;
+-	}
+ 
++	/*
++	 * when using forced irq_set_affinity we must ensure that the cpu
++	 * being offlined is not present in the affinity mask, it may be
++	 * selected as the target CPU otherwise
++	 */
++	affinity = cpu_online_mask;
+ 	c = irq_data_get_irq_chip(d);
+ 	if (!c->irq_set_affinity)
+ 		pr_debug("IRQ%u: unable to set affinity\n", d->irq);
+diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
+index 5e9aec358306..31eb959e9aa8 100644
+--- a/arch/arm64/mm/hugetlbpage.c
++++ b/arch/arm64/mm/hugetlbpage.c
+@@ -51,7 +51,11 @@ int pmd_huge(pmd_t pmd)
+ 
+ int pud_huge(pud_t pud)
+ {
++#ifndef __PAGETABLE_PMD_FOLDED
+ 	return !(pud_val(pud) & PUD_TABLE_BIT);
++#else
++	return 0;
++#endif
+ }
+ 
+ int pmd_huge_support(void)
+diff --git a/arch/metag/include/asm/barrier.h b/arch/metag/include/asm/barrier.h
+index 5d6b4b407dda..2d6f0de77325 100644
+--- a/arch/metag/include/asm/barrier.h
++++ b/arch/metag/include/asm/barrier.h
+@@ -15,6 +15,7 @@ static inline void wr_fence(void)
+ 	volatile int *flushptr = (volatile int *) LINSYSEVENT_WR_FENCE;
+ 	barrier();
+ 	*flushptr = 0;
++	barrier();
+ }
+ 
+ #else /* CONFIG_METAG_META21 */
+@@ -35,6 +36,7 @@ static inline void wr_fence(void)
+ 	*flushptr = 0;
+ 	*flushptr = 0;
+ 	*flushptr = 0;
++	barrier();
+ }
+ 
+ #endif /* !CONFIG_METAG_META21 */
+@@ -68,6 +70,7 @@ static inline void fence(void)
+ 	volatile int *flushptr = (volatile int *) LINSYSEVENT_WR_ATOMIC_UNLOCK;
+ 	barrier();
+ 	*flushptr = 0;
++	barrier();
+ }
+ #define smp_mb()        fence()
+ #define smp_rmb()       fence()
+diff --git a/arch/metag/include/asm/processor.h b/arch/metag/include/asm/processor.h
+index f16477d1f571..3be8581af495 100644
+--- a/arch/metag/include/asm/processor.h
++++ b/arch/metag/include/asm/processor.h
+@@ -22,6 +22,8 @@
+ /* Add an extra page of padding at the top of the stack for the guard page. */
+ #define STACK_TOP	(TASK_SIZE - PAGE_SIZE)
+ #define STACK_TOP_MAX	STACK_TOP
++/* Maximum virtual space for stack */
++#define STACK_SIZE_MAX	(1 << 28)	/* 256 MB */
+ 
+ /* This decides where the kernel will search for a free chunk of vm
+  * space during mmap's.
+diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
+index c2bb4f896ce7..3aa5b46b2d40 100644
+--- a/arch/mips/cavium-octeon/octeon-irq.c
++++ b/arch/mips/cavium-octeon/octeon-irq.c
+@@ -635,7 +635,7 @@ static void octeon_irq_cpu_offline_ciu(struct irq_data *data)
+ 		cpumask_clear(&new_affinity);
+ 		cpumask_set_cpu(cpumask_first(cpu_online_mask), &new_affinity);
+ 	}
+-	__irq_set_affinity_locked(data, &new_affinity);
++	irq_set_affinity_locked(data, &new_affinity, false);
+ }
+ 
+ static int octeon_irq_ciu_set_affinity(struct irq_data *data,
+diff --git a/arch/mips/lantiq/dts/easy50712.dts b/arch/mips/lantiq/dts/easy50712.dts
+index fac1f5b178eb..143b8a37b5e4 100644
+--- a/arch/mips/lantiq/dts/easy50712.dts
++++ b/arch/mips/lantiq/dts/easy50712.dts
+@@ -8,6 +8,7 @@
+ 	};
+ 
+ 	memory@0 {
++		device_type = "memory";
+ 		reg = <0x0 0x2000000>;
+ 	};
+ 
+diff --git a/arch/mips/loongson/lemote-2f/clock.c b/arch/mips/loongson/lemote-2f/clock.c
+index aed32b88576c..7d8c9cce3009 100644
+--- a/arch/mips/loongson/lemote-2f/clock.c
++++ b/arch/mips/loongson/lemote-2f/clock.c
+@@ -91,6 +91,7 @@ EXPORT_SYMBOL(clk_put);
+ 
+ int clk_set_rate(struct clk *clk, unsigned long rate)
+ {
++	unsigned int rate_khz = rate / 1000;
+ 	int ret = 0;
+ 	int regval;
+ 	int i;
+@@ -111,10 +112,10 @@ int clk_set_rate(struct clk *clk, unsigned long rate)
+ 		if (loongson2_clockmod_table[i].frequency ==
+ 		    CPUFREQ_ENTRY_INVALID)
+ 			continue;
+-		if (rate == loongson2_clockmod_table[i].frequency)
++		if (rate_khz == loongson2_clockmod_table[i].frequency)
+ 			break;
+ 	}
+-	if (rate != loongson2_clockmod_table[i].frequency)
++	if (rate_khz != loongson2_clockmod_table[i].frequency)
+ 		return -ENOTSUPP;
+ 
+ 	clk->rate = rate;
+diff --git a/arch/mips/ralink/dts/mt7620a_eval.dts b/arch/mips/ralink/dts/mt7620a_eval.dts
+index 35eb874ab7f1..709f58132f5c 100644
+--- a/arch/mips/ralink/dts/mt7620a_eval.dts
++++ b/arch/mips/ralink/dts/mt7620a_eval.dts
+@@ -7,6 +7,7 @@
+ 	model = "Ralink MT7620A evaluation board";
+ 
+ 	memory@0 {
++		device_type = "memory";
+ 		reg = <0x0 0x2000000>;
+ 	};
+ 
+diff --git a/arch/mips/ralink/dts/rt2880_eval.dts b/arch/mips/ralink/dts/rt2880_eval.dts
+index 322d7002595b..0a685db093d4 100644
+--- a/arch/mips/ralink/dts/rt2880_eval.dts
++++ b/arch/mips/ralink/dts/rt2880_eval.dts
+@@ -7,6 +7,7 @@
+ 	model = "Ralink RT2880 evaluation board";
+ 
+ 	memory@0 {
++		device_type = "memory";
+ 		reg = <0x8000000 0x2000000>;
+ 	};
+ 
+diff --git a/arch/mips/ralink/dts/rt3052_eval.dts b/arch/mips/ralink/dts/rt3052_eval.dts
+index 0ac73ea28198..ec9e9a035541 100644
+--- a/arch/mips/ralink/dts/rt3052_eval.dts
++++ b/arch/mips/ralink/dts/rt3052_eval.dts
+@@ -7,6 +7,7 @@
+ 	model = "Ralink RT3052 evaluation board";
+ 
+ 	memory@0 {
++		device_type = "memory";
+ 		reg = <0x0 0x2000000>;
+ 	};
+ 
+diff --git a/arch/mips/ralink/dts/rt3883_eval.dts b/arch/mips/ralink/dts/rt3883_eval.dts
+index 2fa6b330bf4f..e8df21a5d10d 100644
+--- a/arch/mips/ralink/dts/rt3883_eval.dts
++++ b/arch/mips/ralink/dts/rt3883_eval.dts
+@@ -7,6 +7,7 @@
+ 	model = "Ralink RT3883 evaluation board";
+ 
+ 	memory@0 {
++		device_type = "memory";
+ 		reg = <0x0 0x2000000>;
+ 	};
+ 
+diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
+index bb2a8ec440e7..a8f4a70c0742 100644
+--- a/arch/parisc/Kconfig
++++ b/arch/parisc/Kconfig
+@@ -22,6 +22,7 @@ config PARISC
+ 	select GENERIC_SMP_IDLE_THREAD
+ 	select GENERIC_STRNCPY_FROM_USER
+ 	select SYSCTL_ARCH_UNALIGN_ALLOW
++	select SYSCTL_EXCEPTION_TRACE
+ 	select HAVE_MOD_ARCH_SPECIFIC
+ 	select VIRT_TO_BUS
+ 	select MODULES_USE_ELF_RELA
+diff --git a/arch/parisc/include/asm/processor.h b/arch/parisc/include/asm/processor.h
+index 198a86feb574..86522ef09d52 100644
+--- a/arch/parisc/include/asm/processor.h
++++ b/arch/parisc/include/asm/processor.h
+@@ -55,6 +55,8 @@
+ #define STACK_TOP	TASK_SIZE
+ #define STACK_TOP_MAX	DEFAULT_TASK_SIZE
+ 
++#define STACK_SIZE_MAX	(1 << 30)	/* 1 GB */
++
+ #endif
+ 
+ #ifndef __ASSEMBLY__
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index a63bb179f79a..838786011037 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -589,10 +589,13 @@ cas_nocontend:
+ # endif
+ /* ENABLE_LWS_DEBUG */
+ 
++	rsm	PSW_SM_I, %r0				/* Disable interrupts */
++	/* COW breaks can cause contention on UP systems */
+ 	LDCW	0(%sr2,%r20), %r28			/* Try to acquire the lock */
+ 	cmpb,<>,n	%r0, %r28, cas_action		/* Did we get it? */
+ cas_wouldblock:
+ 	ldo	2(%r0), %r28				/* 2nd case */
++	ssm	PSW_SM_I, %r0
+ 	b	lws_exit				/* Contended... */
+ 	ldo	-EAGAIN(%r0), %r21			/* Spin in userspace */
+ 
+@@ -619,15 +622,17 @@ cas_action:
+ 	stw	%r1, 4(%sr2,%r20)
+ #endif
+ 	/* The load and store could fail */
+-1:	ldw	0(%sr3,%r26), %r28
++1:	ldw,ma	0(%sr3,%r26), %r28
+ 	sub,<>	%r28, %r25, %r0
+-2:	stw	%r24, 0(%sr3,%r26)
++2:	stw,ma	%r24, 0(%sr3,%r26)
+ 	/* Free lock */
+-	stw	%r20, 0(%sr2,%r20)
++	stw,ma	%r20, 0(%sr2,%r20)
+ #if ENABLE_LWS_DEBUG
+ 	/* Clear thread register indicator */
+ 	stw	%r0, 4(%sr2,%r20)
+ #endif
++	/* Enable interrupts */
++	ssm	PSW_SM_I, %r0
+ 	/* Return to userspace, set no error */
+ 	b	lws_exit
+ 	copy	%r0, %r21
+@@ -639,6 +644,7 @@ cas_action:
+ #if ENABLE_LWS_DEBUG
+ 	stw	%r0, 4(%sr2,%r20)
+ #endif
++	ssm	PSW_SM_I, %r0
+ 	b	lws_exit
+ 	ldo	-EFAULT(%r0),%r21	/* set errno */
+ 	nop
+diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
+index 1cd1d0c83b6d..47ee620d15d2 100644
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -25,6 +25,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/console.h>
+ #include <linux/bug.h>
++#include <linux/ratelimit.h>
+ 
+ #include <asm/assembly.h>
+ #include <asm/uaccess.h>
+@@ -42,9 +43,6 @@
+ 
+ #include "../math-emu/math-emu.h"	/* for handle_fpe() */
+ 
+-#define PRINT_USER_FAULTS /* (turn this on if you want user faults to be */
+-			  /*  dumped to the console via printk)          */
+-
+ #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
+ DEFINE_SPINLOCK(pa_dbit_lock);
+ #endif
+@@ -160,6 +158,17 @@ void show_regs(struct pt_regs *regs)
+ 	}
+ }
+ 
++static DEFINE_RATELIMIT_STATE(_hppa_rs,
++	DEFAULT_RATELIMIT_INTERVAL, DEFAULT_RATELIMIT_BURST);
++
++#define parisc_printk_ratelimited(critical, regs, fmt, ...)	{	      \
++	if ((critical || show_unhandled_signals) && __ratelimit(&_hppa_rs)) { \
++		printk(fmt, ##__VA_ARGS__);				      \
++		show_regs(regs);					      \
++	}								      \
++}
++
++
+ static void do_show_stack(struct unwind_frame_info *info)
+ {
+ 	int i = 1;
+@@ -229,12 +238,10 @@ void die_if_kernel(char *str, struct pt_regs *regs, long err)
+ 		if (err == 0)
+ 			return; /* STFU */
+ 
+-		printk(KERN_CRIT "%s (pid %d): %s (code %ld) at " RFMT "\n",
++		parisc_printk_ratelimited(1, regs,
++			KERN_CRIT "%s (pid %d): %s (code %ld) at " RFMT "\n",
+ 			current->comm, task_pid_nr(current), str, err, regs->iaoq[0]);
+-#ifdef PRINT_USER_FAULTS
+-		/* XXX for debugging only */
+-		show_regs(regs);
+-#endif
++
+ 		return;
+ 	}
+ 
+@@ -321,14 +328,11 @@ static void handle_break(struct pt_regs *regs)
+ 			(tt == BUG_TRAP_TYPE_NONE) ? 9 : 0);
+ 	}
+ 
+-#ifdef PRINT_USER_FAULTS
+-	if (unlikely(iir != GDB_BREAK_INSN)) {
+-		printk(KERN_DEBUG "break %d,%d: pid=%d command='%s'\n",
++	if (unlikely(iir != GDB_BREAK_INSN))
++		parisc_printk_ratelimited(0, regs,
++			KERN_DEBUG "break %d,%d: pid=%d command='%s'\n",
+ 			iir & 31, (iir>>13) & ((1<<13)-1),
+ 			task_pid_nr(current), current->comm);
+-		show_regs(regs);
+-	}
+-#endif
+ 
+ 	/* send standard GDB signal */
+ 	handle_gdb_break(regs, TRAP_BRKPT);
+@@ -758,11 +762,9 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
+ 
+ 	default:
+ 		if (user_mode(regs)) {
+-#ifdef PRINT_USER_FAULTS
+-			printk(KERN_DEBUG "\nhandle_interruption() pid=%d command='%s'\n",
+-			    task_pid_nr(current), current->comm);
+-			show_regs(regs);
+-#endif
++			parisc_printk_ratelimited(0, regs, KERN_DEBUG
++				"handle_interruption() pid=%d command='%s'\n",
++				task_pid_nr(current), current->comm);
+ 			/* SIGBUS, for lack of a better one. */
+ 			si.si_signo = SIGBUS;
+ 			si.si_code = BUS_OBJERR;
+@@ -779,16 +781,10 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
+ 
+ 	if (user_mode(regs)) {
+ 	    if ((fault_space >> SPACEID_SHIFT) != (regs->sr[7] >> SPACEID_SHIFT)) {
+-#ifdef PRINT_USER_FAULTS
+-		if (fault_space == 0)
+-			printk(KERN_DEBUG "User Fault on Kernel Space ");
+-		else
+-			printk(KERN_DEBUG "User Fault (long pointer) (fault %d) ",
+-			       code);
+-		printk(KERN_CONT "pid=%d command='%s'\n",
+-		       task_pid_nr(current), current->comm);
+-		show_regs(regs);
+-#endif
++		parisc_printk_ratelimited(0, regs, KERN_DEBUG
++				"User fault %d on space 0x%08lx, pid=%d command='%s'\n",
++				code, fault_space,
++				task_pid_nr(current), current->comm);
+ 		si.si_signo = SIGSEGV;
+ 		si.si_errno = 0;
+ 		si.si_code = SEGV_MAPERR;
+diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
+index 9d08c71a967e..d72197f0ddb8 100644
+--- a/arch/parisc/mm/fault.c
++++ b/arch/parisc/mm/fault.c
+@@ -19,10 +19,6 @@
+ #include <asm/uaccess.h>
+ #include <asm/traps.h>
+ 
+-#define PRINT_USER_FAULTS /* (turn this on if you want user faults to be */
+-			 /*  dumped to the console via printk)          */
+-
+-
+ /* Various important other fields */
+ #define bit22set(x)		(x & 0x00000200)
+ #define bits23_25set(x)		(x & 0x000001c0)
+@@ -34,6 +30,8 @@
+ 
+ DEFINE_PER_CPU(struct exception_data, exception_data);
+ 
++int show_unhandled_signals = 1;
++
+ /*
+  * parisc_acctyp(unsigned int inst) --
+  *    Given a PA-RISC memory access instruction, determine if the
+@@ -173,6 +171,32 @@ int fixup_exception(struct pt_regs *regs)
+ 	return 0;
+ }
+ 
++/*
++ * Print out info about fatal segfaults, if the show_unhandled_signals
++ * sysctl is set:
++ */
++static inline void
++show_signal_msg(struct pt_regs *regs, unsigned long code,
++		unsigned long address, struct task_struct *tsk,
++		struct vm_area_struct *vma)
++{
++	if (!unhandled_signal(tsk, SIGSEGV))
++		return;
++
++	if (!printk_ratelimit())
++		return;
++
++	pr_warn("\n");
++	pr_warn("do_page_fault() command='%s' type=%lu address=0x%08lx",
++	    tsk->comm, code, address);
++	print_vma_addr(KERN_CONT " in ", regs->iaoq[0]);
++	if (vma)
++		pr_warn(" vm_start = 0x%08lx, vm_end = 0x%08lx\n",
++				vma->vm_start, vma->vm_end);
++
++	show_regs(regs);
++}
++
+ void do_page_fault(struct pt_regs *regs, unsigned long code,
+ 			      unsigned long address)
+ {
+@@ -270,16 +294,8 @@ bad_area:
+ 	if (user_mode(regs)) {
+ 		struct siginfo si;
+ 
+-#ifdef PRINT_USER_FAULTS
+-		printk(KERN_DEBUG "\n");
+-		printk(KERN_DEBUG "do_page_fault() pid=%d command='%s' type=%lu address=0x%08lx\n",
+-		    task_pid_nr(tsk), tsk->comm, code, address);
+-		if (vma) {
+-			printk(KERN_DEBUG "vm_start = 0x%08lx, vm_end = 0x%08lx\n",
+-					vma->vm_start, vma->vm_end);
+-		}
+-		show_regs(regs);
+-#endif
++		show_signal_msg(regs, code, address, tsk, vma);
++
+ 		switch (code) {
+ 		case 15:	/* Data TLB miss fault/Data page fault */
+ 			/* send SIGSEGV when outside of vma */
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index 0f4344e6fbca..8289e2b241a2 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -149,7 +149,9 @@ endif
+ 
+ CFLAGS-$(CONFIG_TUNE_CELL) += $(call cc-option,-mtune=cell)
+ 
+-KBUILD_CPPFLAGS	+= -Iarch/$(ARCH)
++asinstr := $(call as-instr,lis 9$(comma)foo@high,-DHAVE_AS_ATHIGH=1)
++
++KBUILD_CPPFLAGS	+= -Iarch/$(ARCH) $(asinstr)
+ KBUILD_AFLAGS	+= -Iarch/$(ARCH)
+ KBUILD_CFLAGS	+= -msoft-float -pipe -Iarch/$(ARCH) $(CFLAGS-y)
+ CPP		= $(CC) -E $(KBUILD_CFLAGS)
+diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h
+index 6586a40a46ce..cded7c1278ef 100644
+--- a/arch/powerpc/include/asm/ppc_asm.h
++++ b/arch/powerpc/include/asm/ppc_asm.h
+@@ -318,11 +318,16 @@ n:
+ 	addi	reg,reg,(name - 0b)@l;
+ 
+ #ifdef __powerpc64__
++#ifdef HAVE_AS_ATHIGH
++#define __AS_ATHIGH high
++#else
++#define __AS_ATHIGH h
++#endif
+ #define LOAD_REG_IMMEDIATE(reg,expr)		\
+ 	lis     reg,(expr)@highest;		\
+ 	ori     reg,reg,(expr)@higher;	\
+ 	rldicr  reg,reg,32,31;		\
+-	oris    reg,reg,(expr)@h;		\
++	oris    reg,reg,(expr)@__AS_ATHIGH;	\
+ 	ori     reg,reg,(expr)@l;
+ 
+ #define LOAD_REG_ADDR(reg,name)			\
+diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c
+index 59d229a2a3e0..879b3aacac32 100644
+--- a/arch/powerpc/kernel/machine_kexec_64.c
++++ b/arch/powerpc/kernel/machine_kexec_64.c
+@@ -237,7 +237,7 @@ static void wake_offline_cpus(void)
+ 		if (!cpu_online(cpu)) {
+ 			printk(KERN_INFO "kexec: Waking offline cpu %d.\n",
+ 			       cpu);
+-			cpu_up(cpu);
++			WARN_ON(cpu_up(cpu));
+ 		}
+ 	}
+ }
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index b3dab20acf34..57d4bada19bd 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -805,9 +805,6 @@ static void __init clocksource_init(void)
+ static int decrementer_set_next_event(unsigned long evt,
+ 				      struct clock_event_device *dev)
+ {
+-	/* Don't adjust the decrementer if some irq work is pending */
+-	if (test_irq_work_pending())
+-		return 0;
+ 	__get_cpu_var(decrementers_next_tb) = get_tb_or_rtc() + evt;
+ 	set_dec(evt);
+ 
+diff --git a/arch/powerpc/platforms/powernv/eeh-ioda.c b/arch/powerpc/platforms/powernv/eeh-ioda.c
+index 253fefe3d1a0..5b51079f3e3b 100644
+--- a/arch/powerpc/platforms/powernv/eeh-ioda.c
++++ b/arch/powerpc/platforms/powernv/eeh-ioda.c
+@@ -549,7 +549,8 @@ static int ioda_eeh_reset(struct eeh_pe *pe, int option)
+ 		ret = ioda_eeh_phb_reset(hose, option);
+ 	} else {
+ 		bus = eeh_pe_bus_get(pe);
+-		if (pci_is_root_bus(bus))
++		if (pci_is_root_bus(bus) ||
++		    pci_is_root_bus(bus->parent))
+ 			ret = ioda_eeh_root_reset(hose, option);
+ 		else
+ 			ret = ioda_eeh_bridge_reset(hose, bus->self, option);
+diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
+index cf3c0089bef2..23223cd63e54 100644
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -820,6 +820,9 @@ static int ctr_aes_crypt(struct blkcipher_desc *desc, long func,
+ 		else
+ 			memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE);
+ 		spin_unlock(&ctrblk_lock);
++	} else {
++		if (!nbytes)
++			memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE);
+ 	}
+ 	/*
+ 	 * final block may be < AES_BLOCK_SIZE, copy only nbytes
+diff --git a/arch/s390/crypto/des_s390.c b/arch/s390/crypto/des_s390.c
+index 0a5aac8a9412..7acb77f7ef1a 100644
+--- a/arch/s390/crypto/des_s390.c
++++ b/arch/s390/crypto/des_s390.c
+@@ -429,6 +429,9 @@ static int ctr_desall_crypt(struct blkcipher_desc *desc, long func,
+ 		else
+ 			memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE);
+ 		spin_unlock(&ctrblk_lock);
++	} else {
++		if (!nbytes)
++			memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE);
+ 	}
+ 	/* final block may be < DES_BLOCK_SIZE, copy only nbytes */
+ 	if (nbytes) {
+diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h
+index a8091216963b..68c05398bba9 100644
+--- a/arch/x86/include/asm/hugetlb.h
++++ b/arch/x86/include/asm/hugetlb.h
+@@ -52,6 +52,7 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+ static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
+ 					 unsigned long addr, pte_t *ptep)
+ {
++	ptep_clear_flush(vma, addr, ptep);
+ }
+ 
+ static inline int huge_pte_none(pte_t pte)
+diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
+index af1d14a9ebda..dcbbaa165bde 100644
+--- a/arch/x86/kernel/ldt.c
++++ b/arch/x86/kernel/ldt.c
+@@ -20,6 +20,8 @@
+ #include <asm/mmu_context.h>
+ #include <asm/syscalls.h>
+ 
++int sysctl_ldt16 = 0;
++
+ #ifdef CONFIG_SMP
+ static void flush_ldt(void *current_mm)
+ {
+@@ -234,7 +236,7 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+ 	 * IRET leaking the high bits of the kernel stack address.
+ 	 */
+ #ifdef CONFIG_X86_64
+-	if (!ldt_info.seg_32bit) {
++	if (!ldt_info.seg_32bit && !sysctl_ldt16) {
+ 		error = -EINVAL;
+ 		goto out_unlock;
+ 	}
+diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
+index d6bfb876cfb0..f1d633a43f8e 100644
+--- a/arch/x86/vdso/vdso32-setup.c
++++ b/arch/x86/vdso/vdso32-setup.c
+@@ -41,6 +41,7 @@ enum {
+ #ifdef CONFIG_X86_64
+ #define vdso_enabled			sysctl_vsyscall32
+ #define arch_setup_additional_pages	syscall32_setup_pages
++extern int sysctl_ldt16;
+ #endif
+ 
+ /*
+@@ -380,6 +381,13 @@ static struct ctl_table abi_table2[] = {
+ 		.mode		= 0644,
+ 		.proc_handler	= proc_dointvec
+ 	},
++	{
++		.procname	= "ldt16",
++		.data		= &sysctl_ldt16,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec
++	},
+ 	{}
+ };
+ 
+diff --git a/crypto/crypto_wq.c b/crypto/crypto_wq.c
+index adad92a44ba2..2f1b8d12952a 100644
+--- a/crypto/crypto_wq.c
++++ b/crypto/crypto_wq.c
+@@ -33,7 +33,7 @@ static void __exit crypto_wq_exit(void)
+ 	destroy_workqueue(kcrypto_wq);
+ }
+ 
+-module_init(crypto_wq_init);
++subsys_initcall(crypto_wq_init);
+ module_exit(crypto_wq_exit);
+ 
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
+index 4770de5707b9..561bf25ac9f9 100644
+--- a/drivers/acpi/Kconfig
++++ b/drivers/acpi/Kconfig
+@@ -56,6 +56,23 @@ config ACPI_PROCFS
+ 
+ 	  Say N to delete /proc/acpi/ files that have moved to /sys/
+ 
++config ACPI_PROCFS_POWER
++	bool "Deprecated power /proc/acpi directories"
++	depends on PROC_FS
++	help
++	  For backwards compatibility, this option allows
++          deprecated power /proc/acpi/ directories to exist, even when
++          they have been replaced by functions in /sys.
++          The deprecated directories (and their replacements) include:
++	  /proc/acpi/battery/* (/sys/class/power_supply/*)
++	  /proc/acpi/ac_adapter/* (sys/class/power_supply/*)
++	  This option has no effect on /proc/acpi/ directories
++	  and functions, which do not yet exist in /sys
++	  This option, together with the proc directories, will be
++	  deleted in 2.6.39.
++
++	  Say N to delete power /proc/acpi/ directories that have moved to /sys/
++
+ config ACPI_EC_DEBUGFS
+ 	tristate "EC read/write access through /sys/kernel/debug/ec"
+ 	default n
+diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
+index 0331f91d56e6..bce34afadcd0 100644
+--- a/drivers/acpi/Makefile
++++ b/drivers/acpi/Makefile
+@@ -47,6 +47,7 @@ acpi-y				+= sysfs.o
+ acpi-$(CONFIG_X86)		+= acpi_cmos_rtc.o
+ acpi-$(CONFIG_DEBUG_FS)		+= debugfs.o
+ acpi-$(CONFIG_ACPI_NUMA)	+= numa.o
++acpi-$(CONFIG_ACPI_PROCFS_POWER) += cm_sbs.o
+ ifdef CONFIG_ACPI_VIDEO
+ acpi-y				+= video_detect.o
+ endif
+diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
+index 6f190bc2b8b7..7c1f8452918a 100644
+--- a/drivers/acpi/ac.c
++++ b/drivers/acpi/ac.c
+@@ -51,11 +51,39 @@ MODULE_AUTHOR("Paul Diefenbaugh");
+ MODULE_DESCRIPTION("ACPI AC Adapter Driver");
+ MODULE_LICENSE("GPL");
+ 
++static int acpi_ac_add(struct acpi_device *device);
++static int acpi_ac_remove(struct acpi_device *device);
++static void acpi_ac_notify(struct acpi_device *device, u32 event);
++
++static const struct acpi_device_id ac_device_ids[] = {
++	{"ACPI0003", 0},
++	{"", 0},
++};
++MODULE_DEVICE_TABLE(acpi, ac_device_ids);
++
++#ifdef CONFIG_PM_SLEEP
++static int acpi_ac_resume(struct device *dev);
++#endif
++static SIMPLE_DEV_PM_OPS(acpi_ac_pm, NULL, acpi_ac_resume);
++
+ static int ac_sleep_before_get_state_ms;
+ 
++static struct acpi_driver acpi_ac_driver = {
++	.name = "ac",
++	.class = ACPI_AC_CLASS,
++	.ids = ac_device_ids,
++	.flags = ACPI_DRIVER_ALL_NOTIFY_EVENTS,
++	.ops = {
++		.add = acpi_ac_add,
++		.remove = acpi_ac_remove,
++		.notify = acpi_ac_notify,
++		},
++	.drv.pm = &acpi_ac_pm,
++};
++
+ struct acpi_ac {
+ 	struct power_supply charger;
+-	struct platform_device *pdev;
++	struct acpi_device * device;
+ 	unsigned long long state;
+ };
+ 
+@@ -67,10 +95,12 @@ struct acpi_ac {
+ 
+ static int acpi_ac_get_state(struct acpi_ac *ac)
+ {
+-	acpi_status status;
+-	acpi_handle handle = ACPI_HANDLE(&ac->pdev->dev);
++	acpi_status status = AE_OK;
++
++	if (!ac)
++		return -EINVAL;
+ 
+-	status = acpi_evaluate_integer(handle, "_PSR", NULL,
++	status = acpi_evaluate_integer(ac->device->handle, "_PSR", NULL,
+ 				       &ac->state);
+ 	if (ACPI_FAILURE(status)) {
+ 		ACPI_EXCEPTION((AE_INFO, status,
+@@ -115,10 +145,9 @@ static enum power_supply_property ac_props[] = {
+                                    Driver Model
+    -------------------------------------------------------------------------- */
+ 
+-static void acpi_ac_notify_handler(acpi_handle handle, u32 event, void *data)
++static void acpi_ac_notify(struct acpi_device *device, u32 event)
+ {
+-	struct acpi_ac *ac = data;
+-	struct acpi_device *adev;
++	struct acpi_ac *ac = acpi_driver_data(device);
+ 
+ 	if (!ac)
+ 		return;
+@@ -141,11 +170,10 @@ static void acpi_ac_notify_handler(acpi_handle handle, u32 event, void *data)
+ 			msleep(ac_sleep_before_get_state_ms);
+ 
+ 		acpi_ac_get_state(ac);
+-		adev = ACPI_COMPANION(&ac->pdev->dev);
+-		acpi_bus_generate_netlink_event(adev->pnp.device_class,
+-						dev_name(&ac->pdev->dev),
+-						event, (u32) ac->state);
+-		acpi_notifier_call_chain(adev, event, (u32) ac->state);
++		acpi_bus_generate_netlink_event(device->pnp.device_class,
++						  dev_name(&device->dev), event,
++						  (u32) ac->state);
++		acpi_notifier_call_chain(device, event, (u32) ac->state);
+ 		kobject_uevent(&ac->charger.dev->kobj, KOBJ_CHANGE);
+ 	}
+ 
+@@ -170,49 +198,39 @@ static struct dmi_system_id ac_dmi_table[] = {
+ 	{},
+ };
+ 
+-static int acpi_ac_probe(struct platform_device *pdev)
++static int acpi_ac_add(struct acpi_device *device)
+ {
+ 	int result = 0;
+ 	struct acpi_ac *ac = NULL;
+-	struct acpi_device *adev;
+ 
+-	if (!pdev)
+-		return -EINVAL;
+ 
+-	adev = ACPI_COMPANION(&pdev->dev);
+-	if (!adev)
+-		return -ENODEV;
++	if (!device)
++		return -EINVAL;
+ 
+ 	ac = kzalloc(sizeof(struct acpi_ac), GFP_KERNEL);
+ 	if (!ac)
+ 		return -ENOMEM;
+ 
+-	strcpy(acpi_device_name(adev), ACPI_AC_DEVICE_NAME);
+-	strcpy(acpi_device_class(adev), ACPI_AC_CLASS);
+-	ac->pdev = pdev;
+-	platform_set_drvdata(pdev, ac);
++	ac->device = device;
++	strcpy(acpi_device_name(device), ACPI_AC_DEVICE_NAME);
++	strcpy(acpi_device_class(device), ACPI_AC_CLASS);
++	device->driver_data = ac;
+ 
+ 	result = acpi_ac_get_state(ac);
+ 	if (result)
+ 		goto end;
+ 
+-	ac->charger.name = acpi_device_bid(adev);
++	ac->charger.name = acpi_device_bid(device);
+ 	ac->charger.type = POWER_SUPPLY_TYPE_MAINS;
+ 	ac->charger.properties = ac_props;
+ 	ac->charger.num_properties = ARRAY_SIZE(ac_props);
+ 	ac->charger.get_property = get_ac_property;
+-	result = power_supply_register(&pdev->dev, &ac->charger);
++	result = power_supply_register(&ac->device->dev, &ac->charger);
+ 	if (result)
+ 		goto end;
+ 
+-	result = acpi_install_notify_handler(ACPI_HANDLE(&pdev->dev),
+-			ACPI_ALL_NOTIFY, acpi_ac_notify_handler, ac);
+-	if (result) {
+-		power_supply_unregister(&ac->charger);
+-		goto end;
+-	}
+ 	printk(KERN_INFO PREFIX "%s [%s] (%s)\n",
+-	       acpi_device_name(adev), acpi_device_bid(adev),
++	       acpi_device_name(device), acpi_device_bid(device),
+ 	       ac->state ? "on-line" : "off-line");
+ 
+ end:
+@@ -232,7 +250,7 @@ static int acpi_ac_resume(struct device *dev)
+ 	if (!dev)
+ 		return -EINVAL;
+ 
+-	ac = platform_get_drvdata(to_platform_device(dev));
++	ac = acpi_driver_data(to_acpi_device(dev));
+ 	if (!ac)
+ 		return -EINVAL;
+ 
+@@ -246,19 +264,17 @@ static int acpi_ac_resume(struct device *dev)
+ #else
+ #define acpi_ac_resume NULL
+ #endif
+-static SIMPLE_DEV_PM_OPS(acpi_ac_pm_ops, NULL, acpi_ac_resume);
+ 
+-static int acpi_ac_remove(struct platform_device *pdev)
++static int acpi_ac_remove(struct acpi_device *device)
+ {
+-	struct acpi_ac *ac;
++	struct acpi_ac *ac = NULL;
++
+ 
+-	if (!pdev)
++	if (!device || !acpi_driver_data(device))
+ 		return -EINVAL;
+ 
+-	acpi_remove_notify_handler(ACPI_HANDLE(&pdev->dev),
+-			ACPI_ALL_NOTIFY, acpi_ac_notify_handler);
++	ac = acpi_driver_data(device);
+ 
+-	ac = platform_get_drvdata(pdev);
+ 	if (ac->charger.dev)
+ 		power_supply_unregister(&ac->charger);
+ 
+@@ -267,23 +283,6 @@ static int acpi_ac_remove(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
+-static const struct acpi_device_id acpi_ac_match[] = {
+-	{ "ACPI0003", 0 },
+-	{ }
+-};
+-MODULE_DEVICE_TABLE(acpi, acpi_ac_match);
+-
+-static struct platform_driver acpi_ac_driver = {
+-	.probe          = acpi_ac_probe,
+-	.remove         = acpi_ac_remove,
+-	.driver         = {
+-		.name   = "acpi-ac",
+-		.owner  = THIS_MODULE,
+-		.pm     = &acpi_ac_pm_ops,
+-		.acpi_match_table = ACPI_PTR(acpi_ac_match),
+-	},
+-};
+-
+ static int __init acpi_ac_init(void)
+ {
+ 	int result;
+@@ -291,7 +290,7 @@ static int __init acpi_ac_init(void)
+ 	if (acpi_disabled)
+ 		return -ENODEV;
+ 
+-	result = platform_driver_register(&acpi_ac_driver);
++	result = acpi_bus_register_driver(&acpi_ac_driver);
+ 	if (result < 0)
+ 		return -ENODEV;
+ 
+@@ -300,7 +299,7 @@ static int __init acpi_ac_init(void)
+ 
+ static void __exit acpi_ac_exit(void)
+ {
+-	platform_driver_unregister(&acpi_ac_driver);
++	acpi_bus_unregister_driver(&acpi_ac_driver);
+ }
+ module_init(acpi_ac_init);
+ module_exit(acpi_ac_exit);
+diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
+index dbfe49e5fd63..1d4950388fa1 100644
+--- a/drivers/acpi/acpi_platform.c
++++ b/drivers/acpi/acpi_platform.c
+@@ -29,7 +29,6 @@ ACPI_MODULE_NAME("platform");
+ static const struct acpi_device_id acpi_platform_device_ids[] = {
+ 
+ 	{ "PNP0D40" },
+-	{ "ACPI0003" },
+ 	{ "VPC2004" },
+ 	{ "BCM4752" },
+ 
+diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
+index b06f5f55ada9..52c81c49cc7d 100644
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -405,7 +405,6 @@ static int acpi_processor_add(struct acpi_device *device,
+ 		goto err;
+ 
+ 	pr->dev = dev;
+-	dev->offline = pr->flags.need_hotplug_init;
+ 
+ 	/* Trigger the processor driver's .probe() if present. */
+ 	if (device_attach(dev) >= 0)
+diff --git a/drivers/acpi/acpica/acglobal.h b/drivers/acpi/acpica/acglobal.h
+index 4ed1aa384df2..514f34033f96 100644
+--- a/drivers/acpi/acpica/acglobal.h
++++ b/drivers/acpi/acpica/acglobal.h
+@@ -132,9 +132,9 @@ u8 ACPI_INIT_GLOBAL(acpi_gbl_do_not_use_xsdt, FALSE);
+  * address. Although ACPICA adheres to the ACPI specification which
+  * requires the use of the corresponding 64-bit address if it is non-zero,
+  * some machines have been found to have a corrupted non-zero 64-bit
+- * address. Default is FALSE, do not favor the 32-bit addresses.
++ * address. Default is TRUE, favor the 32-bit addresses.
+  */
+-u8 ACPI_INIT_GLOBAL(acpi_gbl_use32_bit_fadt_addresses, FALSE);
++u8 ACPI_INIT_GLOBAL(acpi_gbl_use32_bit_fadt_addresses, TRUE);
+ 
+ /*
+  * Optionally truncate I/O addresses to 16 bits. Provides compatibility
+diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
+index 6412d3c301cb..1bc879ec83d4 100644
+--- a/drivers/acpi/acpica/tbutils.c
++++ b/drivers/acpi/acpica/tbutils.c
+@@ -461,6 +461,7 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
+ 	u32 table_count;
+ 	struct acpi_table_header *table;
+ 	acpi_physical_address address;
++	acpi_physical_address rsdt_address;
+ 	u32 length;
+ 	u8 *table_entry;
+ 	acpi_status status;
+@@ -488,11 +489,14 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
+ 		 * as per the ACPI specification.
+ 		 */
+ 		address = (acpi_physical_address) rsdp->xsdt_physical_address;
++		rsdt_address =
++		    (acpi_physical_address) rsdp->rsdt_physical_address;
+ 		table_entry_size = ACPI_XSDT_ENTRY_SIZE;
+ 	} else {
+ 		/* Root table is an RSDT (32-bit physical addresses) */
+ 
+ 		address = (acpi_physical_address) rsdp->rsdt_physical_address;
++		rsdt_address = address;
+ 		table_entry_size = ACPI_RSDT_ENTRY_SIZE;
+ 	}
+ 
+@@ -515,8 +519,7 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
+ 
+ 			/* Fall back to the RSDT */
+ 
+-			address =
+-			    (acpi_physical_address) rsdp->rsdt_physical_address;
++			address = rsdt_address;
+ 			table_entry_size = ACPI_RSDT_ENTRY_SIZE;
+ 		}
+ 	}
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index 797a6938d051..efa71d66e8b0 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -36,6 +36,12 @@
+ #include <linux/suspend.h>
+ #include <asm/unaligned.h>
+ 
++#ifdef CONFIG_ACPI_PROCFS_POWER
++#include <linux/proc_fs.h>
++#include <linux/seq_file.h>
++#include <asm/uaccess.h>
++#endif
++
+ #include <linux/acpi.h>
+ #include <linux/power_supply.h>
+ 
+@@ -66,6 +72,19 @@ static unsigned int cache_time = 1000;
+ module_param(cache_time, uint, 0644);
+ MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
+ 
++#ifdef CONFIG_ACPI_PROCFS_POWER
++extern struct proc_dir_entry *acpi_lock_battery_dir(void);
++extern void *acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir);
++
++enum acpi_battery_files {
++	info_tag = 0,
++	state_tag,
++	alarm_tag,
++	ACPI_BATTERY_NUMFILES,
++};
++
++#endif
++
+ static const struct acpi_device_id battery_device_ids[] = {
+ 	{"PNP0C0A", 0},
+ 	{"", 0},
+@@ -301,6 +320,14 @@ static enum power_supply_property energy_battery_props[] = {
+ 	POWER_SUPPLY_PROP_SERIAL_NUMBER,
+ };
+ 
++#ifdef CONFIG_ACPI_PROCFS_POWER
++inline char *acpi_battery_units(struct acpi_battery *battery)
++{
++	return (battery->power_unit == ACPI_BATTERY_POWER_UNIT_MA) ?
++		"mA" : "mW";
++}
++#endif
++
+ /* --------------------------------------------------------------------------
+                                Battery Management
+    -------------------------------------------------------------------------- */
+@@ -719,6 +746,279 @@ static void acpi_battery_refresh(struct acpi_battery *battery)
+ }
+ 
+ /* --------------------------------------------------------------------------
++                              FS Interface (/proc)
++   -------------------------------------------------------------------------- */
++
++#ifdef CONFIG_ACPI_PROCFS_POWER
++static struct proc_dir_entry *acpi_battery_dir;
++
++static int acpi_battery_print_info(struct seq_file *seq, int result)
++{
++	struct acpi_battery *battery = seq->private;
++
++	if (result)
++		goto end;
++
++	seq_printf(seq, "present:                 %s\n",
++		   acpi_battery_present(battery) ? "yes" : "no");
++	if (!acpi_battery_present(battery))
++		goto end;
++	if (battery->design_capacity == ACPI_BATTERY_VALUE_UNKNOWN)
++		seq_printf(seq, "design capacity:         unknown\n");
++	else
++		seq_printf(seq, "design capacity:         %d %sh\n",
++			   battery->design_capacity,
++			   acpi_battery_units(battery));
++
++	if (battery->full_charge_capacity == ACPI_BATTERY_VALUE_UNKNOWN)
++		seq_printf(seq, "last full capacity:      unknown\n");
++	else
++		seq_printf(seq, "last full capacity:      %d %sh\n",
++			   battery->full_charge_capacity,
++			   acpi_battery_units(battery));
++
++	seq_printf(seq, "battery technology:      %srechargeable\n",
++		   (!battery->technology)?"non-":"");
++
++	if (battery->design_voltage == ACPI_BATTERY_VALUE_UNKNOWN)
++		seq_printf(seq, "design voltage:          unknown\n");
++	else
++		seq_printf(seq, "design voltage:          %d mV\n",
++			   battery->design_voltage);
++	seq_printf(seq, "design capacity warning: %d %sh\n",
++		   battery->design_capacity_warning,
++		   acpi_battery_units(battery));
++	seq_printf(seq, "design capacity low:     %d %sh\n",
++		   battery->design_capacity_low,
++		   acpi_battery_units(battery));
++	seq_printf(seq, "cycle count:		  %i\n", battery->cycle_count);
++	seq_printf(seq, "capacity granularity 1:  %d %sh\n",
++		   battery->capacity_granularity_1,
++		   acpi_battery_units(battery));
++	seq_printf(seq, "capacity granularity 2:  %d %sh\n",
++		   battery->capacity_granularity_2,
++		   acpi_battery_units(battery));
++	seq_printf(seq, "model number:            %s\n", battery->model_number);
++	seq_printf(seq, "serial number:           %s\n", battery->serial_number);
++	seq_printf(seq, "battery type:            %s\n", battery->type);
++	seq_printf(seq, "OEM info:                %s\n", battery->oem_info);
++      end:
++	if (result)
++		seq_printf(seq, "ERROR: Unable to read battery info\n");
++	return result;
++}
++
++static int acpi_battery_print_state(struct seq_file *seq, int result)
++{
++	struct acpi_battery *battery = seq->private;
++
++	if (result)
++		goto end;
++
++	seq_printf(seq, "present:                 %s\n",
++		   acpi_battery_present(battery) ? "yes" : "no");
++	if (!acpi_battery_present(battery))
++		goto end;
++
++	seq_printf(seq, "capacity state:          %s\n",
++			(battery->state & 0x04) ? "critical" : "ok");
++	if ((battery->state & 0x01) && (battery->state & 0x02))
++		seq_printf(seq,
++			   "charging state:          charging/discharging\n");
++	else if (battery->state & 0x01)
++		seq_printf(seq, "charging state:          discharging\n");
++	else if (battery->state & 0x02)
++		seq_printf(seq, "charging state:          charging\n");
++	else
++		seq_printf(seq, "charging state:          charged\n");
++
++	if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN)
++		seq_printf(seq, "present rate:            unknown\n");
++	else
++		seq_printf(seq, "present rate:            %d %s\n",
++			   battery->rate_now, acpi_battery_units(battery));
++
++	if (battery->capacity_now == ACPI_BATTERY_VALUE_UNKNOWN)
++		seq_printf(seq, "remaining capacity:      unknown\n");
++	else
++		seq_printf(seq, "remaining capacity:      %d %sh\n",
++			   battery->capacity_now, acpi_battery_units(battery));
++	if (battery->voltage_now == ACPI_BATTERY_VALUE_UNKNOWN)
++		seq_printf(seq, "present voltage:         unknown\n");
++	else
++		seq_printf(seq, "present voltage:         %d mV\n",
++			   battery->voltage_now);
++      end:
++	if (result)
++		seq_printf(seq, "ERROR: Unable to read battery state\n");
++
++	return result;
++}
++
++static int acpi_battery_print_alarm(struct seq_file *seq, int result)
++{
++	struct acpi_battery *battery = seq->private;
++
++	if (result)
++		goto end;
++
++	if (!acpi_battery_present(battery)) {
++		seq_printf(seq, "present:                 no\n");
++		goto end;
++	}
++	seq_printf(seq, "alarm:                   ");
++	if (!battery->alarm)
++		seq_printf(seq, "unsupported\n");
++	else
++		seq_printf(seq, "%u %sh\n", battery->alarm,
++				acpi_battery_units(battery));
++      end:
++	if (result)
++		seq_printf(seq, "ERROR: Unable to read battery alarm\n");
++	return result;
++}
++
++static ssize_t acpi_battery_write_alarm(struct file *file,
++					const char __user * buffer,
++					size_t count, loff_t * ppos)
++{
++	int result = 0;
++	char alarm_string[12] = { '\0' };
++	struct seq_file *m = file->private_data;
++	struct acpi_battery *battery = m->private;
++
++	if (!battery || (count > sizeof(alarm_string) - 1))
++		return -EINVAL;
++	if (!acpi_battery_present(battery)) {
++		result = -ENODEV;
++		goto end;
++	}
++	if (copy_from_user(alarm_string, buffer, count)) {
++		result = -EFAULT;
++		goto end;
++	}
++	alarm_string[count] = '\0';
++	battery->alarm = simple_strtol(alarm_string, NULL, 0);
++	result = acpi_battery_set_alarm(battery);
++      end:
++	if (!result)
++		return count;
++	return result;
++}
++
++typedef int(*print_func)(struct seq_file *seq, int result);
++
++static print_func acpi_print_funcs[ACPI_BATTERY_NUMFILES] = {
++	acpi_battery_print_info,
++	acpi_battery_print_state,
++	acpi_battery_print_alarm,
++};
++
++static int acpi_battery_read(int fid, struct seq_file *seq)
++{
++	struct acpi_battery *battery = seq->private;
++	int result = acpi_battery_update(battery);
++	return acpi_print_funcs[fid](seq, result);
++}
++
++#define DECLARE_FILE_FUNCTIONS(_name) \
++static int acpi_battery_read_##_name(struct seq_file *seq, void *offset) \
++{ \
++	return acpi_battery_read(_name##_tag, seq); \
++} \
++static int acpi_battery_##_name##_open_fs(struct inode *inode, struct file *file) \
++{ \
++	return single_open(file, acpi_battery_read_##_name, PDE_DATA(inode)); \
++}
++
++DECLARE_FILE_FUNCTIONS(info);
++DECLARE_FILE_FUNCTIONS(state);
++DECLARE_FILE_FUNCTIONS(alarm);
++
++#undef DECLARE_FILE_FUNCTIONS
++
++#define FILE_DESCRIPTION_RO(_name) \
++	{ \
++	.name = __stringify(_name), \
++	.mode = S_IRUGO, \
++	.ops = { \
++		.open = acpi_battery_##_name##_open_fs, \
++		.read = seq_read, \
++		.llseek = seq_lseek, \
++		.release = single_release, \
++		.owner = THIS_MODULE, \
++		}, \
++	}
++
++#define FILE_DESCRIPTION_RW(_name) \
++	{ \
++	.name = __stringify(_name), \
++	.mode = S_IFREG | S_IRUGO | S_IWUSR, \
++	.ops = { \
++		.open = acpi_battery_##_name##_open_fs, \
++		.read = seq_read, \
++		.llseek = seq_lseek, \
++		.write = acpi_battery_write_##_name, \
++		.release = single_release, \
++		.owner = THIS_MODULE, \
++		}, \
++	}
++
++static const struct battery_file {
++	struct file_operations ops;
++	umode_t mode;
++	const char *name;
++} acpi_battery_file[] = {
++	FILE_DESCRIPTION_RO(info),
++	FILE_DESCRIPTION_RO(state),
++	FILE_DESCRIPTION_RW(alarm),
++};
++
++#undef FILE_DESCRIPTION_RO
++#undef FILE_DESCRIPTION_RW
++
++static int acpi_battery_add_fs(struct acpi_device *device)
++{
++	struct proc_dir_entry *entry = NULL;
++	int i;
++
++	printk(KERN_WARNING PREFIX "Deprecated procfs I/F for battery is loaded,"
++			" please retry with CONFIG_ACPI_PROCFS_POWER cleared\n");
++	if (!acpi_device_dir(device)) {
++		acpi_device_dir(device) = proc_mkdir(acpi_device_bid(device),
++						     acpi_battery_dir);
++		if (!acpi_device_dir(device))
++			return -ENODEV;
++	}
++
++	for (i = 0; i < ACPI_BATTERY_NUMFILES; ++i) {
++		entry = proc_create_data(acpi_battery_file[i].name,
++					 acpi_battery_file[i].mode,
++					 acpi_device_dir(device),
++					 &acpi_battery_file[i].ops,
++					 acpi_driver_data(device));
++		if (!entry)
++			return -ENODEV;
++	}
++	return 0;
++}
++
++static void acpi_battery_remove_fs(struct acpi_device *device)
++{
++	int i;
++	if (!acpi_device_dir(device))
++		return;
++	for (i = 0; i < ACPI_BATTERY_NUMFILES; ++i)
++		remove_proc_entry(acpi_battery_file[i].name,
++				  acpi_device_dir(device));
++
++	remove_proc_entry(acpi_device_bid(device), acpi_battery_dir);
++	acpi_device_dir(device) = NULL;
++}
++
++#endif
++
++/* --------------------------------------------------------------------------
+                                  Driver Interface
+    -------------------------------------------------------------------------- */
+ 
+@@ -791,6 +1091,15 @@ static int acpi_battery_add(struct acpi_device *device)
+ 	result = acpi_battery_update(battery);
+ 	if (result)
+ 		goto fail;
++#ifdef CONFIG_ACPI_PROCFS_POWER
++	result = acpi_battery_add_fs(device);
++#endif
++	if (result) {
++#ifdef CONFIG_ACPI_PROCFS_POWER
++		acpi_battery_remove_fs(device);
++#endif
++		goto fail;
++	}
+ 
+ 	printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n",
+ 		ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device),
+@@ -817,6 +1126,9 @@ static int acpi_battery_remove(struct acpi_device *device)
+ 		return -EINVAL;
+ 	battery = acpi_driver_data(device);
+ 	unregister_pm_notifier(&battery->pm_nb);
++#ifdef CONFIG_ACPI_PROCFS_POWER
++	acpi_battery_remove_fs(device);
++#endif
+ 	sysfs_remove_battery(battery);
+ 	mutex_destroy(&battery->lock);
+ 	mutex_destroy(&battery->sysfs_lock);
+@@ -867,7 +1179,19 @@ static void __init acpi_battery_init_async(void *unused, async_cookie_t cookie)
+ 
+ 	if (dmi_check_system(bat_dmi_table))
+ 		battery_bix_broken_package = 1;
+-	acpi_bus_register_driver(&acpi_battery_driver);
++
++#ifdef CONFIG_ACPI_PROCFS_POWER
++	acpi_battery_dir = acpi_lock_battery_dir();
++	if (!acpi_battery_dir)
++		return;
++#endif
++	if (acpi_bus_register_driver(&acpi_battery_driver) < 0) {
++#ifdef CONFIG_ACPI_PROCFS_POWER
++		acpi_unlock_battery_dir(acpi_battery_dir);
++#endif
++		return;
++	}
++	return;
+ }
+ 
+ static int __init acpi_battery_init(void)
+@@ -879,6 +1203,9 @@ static int __init acpi_battery_init(void)
+ static void __exit acpi_battery_exit(void)
+ {
+ 	acpi_bus_unregister_driver(&acpi_battery_driver);
++#ifdef CONFIG_ACPI_PROCFS_POWER
++	acpi_unlock_battery_dir(acpi_battery_dir);
++#endif
+ }
+ 
+ module_init(acpi_battery_init);
+diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
+index afec4526c48a..3d8413d02a97 100644
+--- a/drivers/acpi/blacklist.c
++++ b/drivers/acpi/blacklist.c
+@@ -314,6 +314,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
+ 		     DMI_MATCH(DMI_PRODUCT_VERSION, "2349D15"),
+ 		},
+ 	},
++	{
++	.callback = dmi_disable_osi_win8,
++	.ident = "Dell Inspiron 7737",
++	.matches = {
++		    DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++		    DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7737"),
++		},
++	},
+ 
+ 	/*
+ 	 * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
+@@ -374,6 +382,19 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
+ 		     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T500"),
+ 		},
+ 	},
++	/*
++	 * Without this this EEEpc exports a non working WMI interface, with
++	 * this it exports a working "good old" eeepc_laptop interface, fixing
++	 * both brightness control, and rfkill not working.
++	 */
++	{
++	.callback = dmi_enable_osi_linux,
++	.ident = "Asus EEE PC 1015PX",
++	.matches = {
++		     DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."),
++		     DMI_MATCH(DMI_PRODUCT_NAME, "1015PX"),
++		},
++	},
+ 	{}
+ };
+ 
+diff --git a/drivers/acpi/cm_sbs.c b/drivers/acpi/cm_sbs.c
+new file mode 100644
+index 000000000000..6c9ee68e46fb
+--- /dev/null
++++ b/drivers/acpi/cm_sbs.c
+@@ -0,0 +1,105 @@
++/*
++ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
++ *
++ *  This program is free software; you can redistribute it and/or modify
++ *  it under the terms of the GNU General Public License as published by
++ *  the Free Software Foundation; either version 2 of the License, or (at
++ *  your option) any later version.
++ *
++ *  This program is distributed in the hope that it will be useful, but
++ *  WITHOUT ANY WARRANTY; without even the implied warranty of
++ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ *  General Public License for more details.
++ *
++ *  You should have received a copy of the GNU General Public License along
++ *  with this program; if not, write to the Free Software Foundation, Inc.,
++ *  59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
++ *
++ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/acpi.h>
++#include <linux/types.h>
++#include <linux/proc_fs.h>
++#include <linux/seq_file.h>
++#include <acpi/acpi_bus.h>
++#include <acpi/acpi_drivers.h>
++
++#define PREFIX "ACPI: "
++
++ACPI_MODULE_NAME("cm_sbs");
++#define ACPI_AC_CLASS		"ac_adapter"
++#define ACPI_BATTERY_CLASS	"battery"
++#define _COMPONENT		ACPI_SBS_COMPONENT
++static struct proc_dir_entry *acpi_ac_dir;
++static struct proc_dir_entry *acpi_battery_dir;
++
++static DEFINE_MUTEX(cm_sbs_mutex);
++
++static int lock_ac_dir_cnt;
++static int lock_battery_dir_cnt;
++
++struct proc_dir_entry *acpi_lock_ac_dir(void)
++{
++	mutex_lock(&cm_sbs_mutex);
++	if (!acpi_ac_dir)
++		acpi_ac_dir = proc_mkdir(ACPI_AC_CLASS, acpi_root_dir);
++	if (acpi_ac_dir) {
++		lock_ac_dir_cnt++;
++	} else {
++		printk(KERN_ERR PREFIX
++				  "Cannot create %s\n", ACPI_AC_CLASS);
++	}
++	mutex_unlock(&cm_sbs_mutex);
++	return acpi_ac_dir;
++}
++EXPORT_SYMBOL(acpi_lock_ac_dir);
++
++void acpi_unlock_ac_dir(struct proc_dir_entry *acpi_ac_dir_param)
++{
++	mutex_lock(&cm_sbs_mutex);
++	if (acpi_ac_dir_param)
++		lock_ac_dir_cnt--;
++	if (lock_ac_dir_cnt == 0 && acpi_ac_dir_param && acpi_ac_dir) {
++		remove_proc_entry(ACPI_AC_CLASS, acpi_root_dir);
++		acpi_ac_dir = NULL;
++	}
++	mutex_unlock(&cm_sbs_mutex);
++}
++EXPORT_SYMBOL(acpi_unlock_ac_dir);
++
++struct proc_dir_entry *acpi_lock_battery_dir(void)
++{
++	mutex_lock(&cm_sbs_mutex);
++	if (!acpi_battery_dir) {
++		acpi_battery_dir =
++		    proc_mkdir(ACPI_BATTERY_CLASS, acpi_root_dir);
++	}
++	if (acpi_battery_dir) {
++		lock_battery_dir_cnt++;
++	} else {
++		printk(KERN_ERR PREFIX
++				  "Cannot create %s\n", ACPI_BATTERY_CLASS);
++	}
++	mutex_unlock(&cm_sbs_mutex);
++	return acpi_battery_dir;
++}
++EXPORT_SYMBOL(acpi_lock_battery_dir);
++
++void acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir_param)
++{
++	mutex_lock(&cm_sbs_mutex);
++	if (acpi_battery_dir_param)
++		lock_battery_dir_cnt--;
++	if (lock_battery_dir_cnt == 0 && acpi_battery_dir_param
++	    && acpi_battery_dir) {
++		remove_proc_entry(ACPI_BATTERY_CLASS, acpi_root_dir);
++		acpi_battery_dir = NULL;
++	}
++	mutex_unlock(&cm_sbs_mutex);
++	return;
++}
++EXPORT_SYMBOL(acpi_unlock_battery_dir);
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index d7d32c28829b..ad11ba4a412d 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -206,13 +206,13 @@ unlock:
+ 	spin_unlock_irqrestore(&ec->lock, flags);
+ }
+ 
+-static int acpi_ec_sync_query(struct acpi_ec *ec);
++static int acpi_ec_sync_query(struct acpi_ec *ec, u8 *data);
+ 
+ static int ec_check_sci_sync(struct acpi_ec *ec, u8 state)
+ {
+ 	if (state & ACPI_EC_FLAG_SCI) {
+ 		if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
+-			return acpi_ec_sync_query(ec);
++			return acpi_ec_sync_query(ec, NULL);
+ 	}
+ 	return 0;
+ }
+@@ -443,10 +443,8 @@ acpi_handle ec_get_handle(void)
+ 
+ EXPORT_SYMBOL(ec_get_handle);
+ 
+-static int acpi_ec_query_unlocked(struct acpi_ec *ec, u8 *data);
+-
+ /*
+- * Clears stale _Q events that might have accumulated in the EC.
++ * Process _Q events that might have accumulated in the EC.
+  * Run with locked ec mutex.
+  */
+ static void acpi_ec_clear(struct acpi_ec *ec)
+@@ -455,7 +453,7 @@ static void acpi_ec_clear(struct acpi_ec *ec)
+ 	u8 value = 0;
+ 
+ 	for (i = 0; i < ACPI_EC_CLEAR_MAX; i++) {
+-		status = acpi_ec_query_unlocked(ec, &value);
++		status = acpi_ec_sync_query(ec, &value);
+ 		if (status || !value)
+ 			break;
+ 	}
+@@ -582,13 +580,18 @@ static void acpi_ec_run(void *cxt)
+ 	kfree(handler);
+ }
+ 
+-static int acpi_ec_sync_query(struct acpi_ec *ec)
++static int acpi_ec_sync_query(struct acpi_ec *ec, u8 *data)
+ {
+ 	u8 value = 0;
+ 	int status;
+ 	struct acpi_ec_query_handler *handler, *copy;
+-	if ((status = acpi_ec_query_unlocked(ec, &value)))
++
++	status = acpi_ec_query_unlocked(ec, &value);
++	if (data)
++		*data = value;
++	if (status)
+ 		return status;
++
+ 	list_for_each_entry(handler, &ec->list, node) {
+ 		if (value == handler->query_bit) {
+ 			/* have custom handler for this bit */
+@@ -612,7 +615,7 @@ static void acpi_ec_gpe_query(void *ec_cxt)
+ 	if (!ec)
+ 		return;
+ 	mutex_lock(&ec->mutex);
+-	acpi_ec_sync_query(ec);
++	acpi_ec_sync_query(ec, NULL);
+ 	mutex_unlock(&ec->mutex);
+ }
+ 
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index b6ba88ed31ae..bb0b90461a6b 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -459,10 +459,10 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
+ 	},
+ 	{
+ 	 .callback = video_set_use_native_backlight,
+-	 .ident = "ThinkPad T430s",
++	 .ident = "ThinkPad T430 and T430s",
+ 	 .matches = {
+ 		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T430s"),
++		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T430"),
+ 		},
+ 	},
+ 	{
+@@ -474,7 +474,7 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
+ 		},
+ 	},
+ 	{
+-	.callback = video_set_use_native_backlight,
++	 .callback = video_set_use_native_backlight,
+ 	.ident = "ThinkPad X1 Carbon",
+ 	.matches = {
+ 		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+@@ -494,7 +494,7 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
+ 	 .ident = "Dell Inspiron 7520",
+ 	 .matches = {
+ 		DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+-		DMI_MATCH(DMI_PRODUCT_VERSION, "Inspiron 7520"),
++		DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7520"),
+ 		},
+ 	},
+ 	{
+@@ -507,6 +507,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
+ 	},
+ 	{
+ 	 .callback = video_set_use_native_backlight,
++	 .ident = "Acer Aspire 5742G",
++	 .matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++		DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5742G"),
++		},
++	},
++	{
++	 .callback = video_set_use_native_backlight,
+ 	 .ident = "Acer Aspire V5-431",
+ 	 .matches = {
+ 		DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 0a79c540169c..bb26636f10c8 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -6329,6 +6329,8 @@ int ata_host_activate(struct ata_host *host, int irq,
+ static void ata_port_detach(struct ata_port *ap)
+ {
+ 	unsigned long flags;
++	struct ata_link *link;
++	struct ata_device *dev;
+ 
+ 	if (!ap->ops->error_handler)
+ 		goto skip_eh;
+@@ -6348,6 +6350,13 @@ static void ata_port_detach(struct ata_port *ap)
+ 	cancel_delayed_work_sync(&ap->hotplug_task);
+ 
+  skip_eh:
++	/* clean up zpodd on port removal */
++	ata_for_each_link(link, ap, HOST_FIRST) {
++		ata_for_each_dev(dev, link, ALL) {
++			if (zpodd_dev_enabled(dev))
++				zpodd_exit(dev);
++		}
++	}
+ 	if (ap->pmp_link) {
+ 		int i;
+ 		for (i = 0; i < SATA_PMP_MAX_PORTS; i++)
+diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c
+index d63ee8f41a4f..e3a49df958a3 100644
+--- a/drivers/ata/pata_at91.c
++++ b/drivers/ata/pata_at91.c
+@@ -408,12 +408,13 @@ static int pata_at91_probe(struct platform_device *pdev)
+ 
+ 	host->private_data = info;
+ 
+-	return ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
+-			gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
+-			irq_flags, &pata_at91_sht);
++	ret = ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
++				gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
++				irq_flags, &pata_at91_sht);
++	if (ret)
++		goto err_put;
+ 
+-	if (!ret)
+-		return 0;
++	return 0;
+ 
+ err_put:
+ 	clk_put(info->mck);
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 06051767393f..8a8d611f2021 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -52,6 +52,7 @@ static DEFINE_MUTEX(deferred_probe_mutex);
+ static LIST_HEAD(deferred_probe_pending_list);
+ static LIST_HEAD(deferred_probe_active_list);
+ static struct workqueue_struct *deferred_wq;
++static atomic_t deferred_trigger_count = ATOMIC_INIT(0);
+ 
+ /**
+  * deferred_probe_work_func() - Retry probing devices in the active list.
+@@ -135,6 +136,17 @@ static bool driver_deferred_probe_enable = false;
+  * This functions moves all devices from the pending list to the active
+  * list and schedules the deferred probe workqueue to process them.  It
+  * should be called anytime a driver is successfully bound to a device.
++ *
++ * Note, there is a race condition in multi-threaded probe. In the case where
++ * more than one device is probing at the same time, it is possible for one
++ * probe to complete successfully while another is about to defer. If the second
++ * depends on the first, then it will get put on the pending list after the
++ * trigger event has already occured and will be stuck there.
++ *
++ * The atomic 'deferred_trigger_count' is used to determine if a successful
++ * trigger has occurred in the midst of probing a driver. If the trigger count
++ * changes in the midst of a probe, then deferred processing should be triggered
++ * again.
+  */
+ static void driver_deferred_probe_trigger(void)
+ {
+@@ -147,6 +159,7 @@ static void driver_deferred_probe_trigger(void)
+ 	 * into the active list so they can be retried by the workqueue
+ 	 */
+ 	mutex_lock(&deferred_probe_mutex);
++	atomic_inc(&deferred_trigger_count);
+ 	list_splice_tail_init(&deferred_probe_pending_list,
+ 			      &deferred_probe_active_list);
+ 	mutex_unlock(&deferred_probe_mutex);
+@@ -265,6 +278,7 @@ static DECLARE_WAIT_QUEUE_HEAD(probe_waitqueue);
+ static int really_probe(struct device *dev, struct device_driver *drv)
+ {
+ 	int ret = 0;
++	int local_trigger_count = atomic_read(&deferred_trigger_count);
+ 
+ 	atomic_inc(&probe_count);
+ 	pr_debug("bus: '%s': %s: probing driver %s with device %s\n",
+@@ -310,6 +324,9 @@ probe_failed:
+ 		/* Driver requested deferred probing */
+ 		dev_info(dev, "Driver %s requests probe deferral\n", drv->name);
+ 		driver_deferred_probe_add(dev);
++		/* Did a trigger occur while probing? Need to re-trigger if yes */
++		if (local_trigger_count != atomic_read(&deferred_trigger_count))
++			driver_deferred_probe_trigger();
+ 	} else if (ret != -ENODEV && ret != -ENXIO) {
+ 		/* driver matched but the probe failed */
+ 		printk(KERN_WARNING
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index bc78848dd59a..3c51eb0bd659 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -13,6 +13,7 @@
+ #include <linux/string.h>
+ #include <linux/platform_device.h>
+ #include <linux/of_device.h>
++#include <linux/of_irq.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
+ #include <linux/dma-mapping.h>
+@@ -87,7 +88,11 @@ int platform_get_irq(struct platform_device *dev, unsigned int num)
+ 		return -ENXIO;
+ 	return dev->archdata.irqs[num];
+ #else
+-	struct resource *r = platform_get_resource(dev, IORESOURCE_IRQ, num);
++	struct resource *r;
++	if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node)
++		return of_irq_get(dev->dev.of_node, num);
++
++	r = platform_get_resource(dev, IORESOURCE_IRQ, num);
+ 
+ 	return r ? r->start : -ENXIO;
+ #endif
+diff --git a/drivers/base/topology.c b/drivers/base/topology.c
+index 94ffee378f10..37a5661ca5f9 100644
+--- a/drivers/base/topology.c
++++ b/drivers/base/topology.c
+@@ -40,8 +40,7 @@
+ static ssize_t show_##name(struct device *dev,			\
+ 		struct device_attribute *attr, char *buf)	\
+ {								\
+-	unsigned int cpu = dev->id;				\
+-	return sprintf(buf, "%d\n", topology_##name(cpu));	\
++	return sprintf(buf, "%d\n", topology_##name(dev->id));	\
+ }
+ 
+ #if defined(topology_thread_cpumask) || defined(topology_core_cpumask) || \
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 106d1d8e16ad..b11949c5b029 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -82,6 +82,7 @@ static const struct usb_device_id ath3k_table[] = {
+ 	{ USB_DEVICE(0x04CA, 0x3004) },
+ 	{ USB_DEVICE(0x04CA, 0x3005) },
+ 	{ USB_DEVICE(0x04CA, 0x3006) },
++	{ USB_DEVICE(0x04CA, 0x3007) },
+ 	{ USB_DEVICE(0x04CA, 0x3008) },
+ 	{ USB_DEVICE(0x04CA, 0x300b) },
+ 	{ USB_DEVICE(0x13d3, 0x3362) },
+@@ -127,6 +128,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ 	{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index baeaaed299e4..1c7b5040d921 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -149,6 +149,7 @@ static const struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+@@ -1478,10 +1479,8 @@ static int btusb_probe(struct usb_interface *intf,
+ 	if (id->driver_info & BTUSB_BCM92035)
+ 		hdev->setup = btusb_setup_bcm92035;
+ 
+-	if (id->driver_info & BTUSB_INTEL) {
+-		usb_enable_autosuspend(data->udev);
++	if (id->driver_info & BTUSB_INTEL)
+ 		hdev->setup = btusb_setup_intel;
+-	}
+ 
+ 	/* Interface numbers are hardcoded in the specification */
+ 	data->isoc = usb_ifnum_to_if(data->udev, 1);
+diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c
+index 725c46162bbd..372ae72cce34 100644
+--- a/drivers/bus/mvebu-mbus.c
++++ b/drivers/bus/mvebu-mbus.c
+@@ -222,12 +222,6 @@ static int mvebu_mbus_window_conflicts(struct mvebu_mbus_state *mbus,
+ 		 */
+ 		if ((u64)base < wend && end > wbase)
+ 			return 0;
+-
+-		/*
+-		 * Check if target/attribute conflicts
+-		 */
+-		if (target == wtarget && attr == wattr)
+-			return 0;
+ 	}
+ 
+ 	return 1;
+diff --git a/drivers/char/ipmi/ipmi_kcs_sm.c b/drivers/char/ipmi/ipmi_kcs_sm.c
+index 6a4bdc18955a..8c25f596808a 100644
+--- a/drivers/char/ipmi/ipmi_kcs_sm.c
++++ b/drivers/char/ipmi/ipmi_kcs_sm.c
+@@ -251,8 +251,9 @@ static inline int check_obf(struct si_sm_data *kcs, unsigned char status,
+ 	if (!GET_STATUS_OBF(status)) {
+ 		kcs->obf_timeout -= time;
+ 		if (kcs->obf_timeout < 0) {
+-		    start_error_recovery(kcs, "OBF not ready in time");
+-		    return 1;
++			kcs->obf_timeout = OBF_RETRY_TIMEOUT;
++			start_error_recovery(kcs, "OBF not ready in time");
++			return 1;
+ 		}
+ 		return 0;
+ 	}
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index 03f41896d090..8b4fa2c4e661 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -249,6 +249,9 @@ struct smi_info {
+ 	/* The timer for this si. */
+ 	struct timer_list   si_timer;
+ 
++	/* This flag is set, if the timer is running (timer_pending() isn't enough) */
++	bool		    timer_running;
++
+ 	/* The time (in jiffies) the last timeout occurred at. */
+ 	unsigned long       last_timeout_jiffies;
+ 
+@@ -435,6 +438,13 @@ static void start_clear_flags(struct smi_info *smi_info)
+ 	smi_info->si_state = SI_CLEARING_FLAGS;
+ }
+ 
++static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
++{
++	smi_info->last_timeout_jiffies = jiffies;
++	mod_timer(&smi_info->si_timer, new_val);
++	smi_info->timer_running = true;
++}
++
+ /*
+  * When we have a situtaion where we run out of memory and cannot
+  * allocate messages, we just leave them in the BMC and run the system
+@@ -447,8 +457,7 @@ static inline void disable_si_irq(struct smi_info *smi_info)
+ 		start_disable_irq(smi_info);
+ 		smi_info->interrupt_disabled = 1;
+ 		if (!atomic_read(&smi_info->stop_operation))
+-			mod_timer(&smi_info->si_timer,
+-				  jiffies + SI_TIMEOUT_JIFFIES);
++			smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
+ 	}
+ }
+ 
+@@ -908,15 +917,7 @@ static void sender(void                *send_info,
+ 		list_add_tail(&msg->link, &smi_info->xmit_msgs);
+ 
+ 	if (smi_info->si_state == SI_NORMAL && smi_info->curr_msg == NULL) {
+-		/*
+-		 * last_timeout_jiffies is updated here to avoid
+-		 * smi_timeout() handler passing very large time_diff
+-		 * value to smi_event_handler() that causes
+-		 * the send command to abort.
+-		 */
+-		smi_info->last_timeout_jiffies = jiffies;
+-
+-		mod_timer(&smi_info->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
++		smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
+ 
+ 		if (smi_info->thread)
+ 			wake_up_process(smi_info->thread);
+@@ -1005,6 +1006,17 @@ static int ipmi_thread(void *data)
+ 
+ 		spin_lock_irqsave(&(smi_info->si_lock), flags);
+ 		smi_result = smi_event_handler(smi_info, 0);
++
++		/*
++		 * If the driver is doing something, there is a possible
++		 * race with the timer.  If the timer handler see idle,
++		 * and the thread here sees something else, the timer
++		 * handler won't restart the timer even though it is
++		 * required.  So start it here if necessary.
++		 */
++		if (smi_result != SI_SM_IDLE && !smi_info->timer_running)
++			smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
++
+ 		spin_unlock_irqrestore(&(smi_info->si_lock), flags);
+ 		busy_wait = ipmi_thread_busy_wait(smi_result, smi_info,
+ 						  &busy_until);
+@@ -1074,10 +1086,6 @@ static void smi_timeout(unsigned long data)
+ 		     * SI_USEC_PER_JIFFY);
+ 	smi_result = smi_event_handler(smi_info, time_diff);
+ 
+-	spin_unlock_irqrestore(&(smi_info->si_lock), flags);
+-
+-	smi_info->last_timeout_jiffies = jiffies_now;
+-
+ 	if ((smi_info->irq) && (!smi_info->interrupt_disabled)) {
+ 		/* Running with interrupts, only do long timeouts. */
+ 		timeout = jiffies + SI_TIMEOUT_JIFFIES;
+@@ -1099,7 +1107,10 @@ static void smi_timeout(unsigned long data)
+ 
+  do_mod_timer:
+ 	if (smi_result != SI_SM_IDLE)
+-		mod_timer(&(smi_info->si_timer), timeout);
++		smi_mod_timer(smi_info, timeout);
++	else
++		smi_info->timer_running = false;
++	spin_unlock_irqrestore(&(smi_info->si_lock), flags);
+ }
+ 
+ static irqreturn_t si_irq_handler(int irq, void *data)
+@@ -1147,8 +1158,7 @@ static int smi_start_processing(void       *send_info,
+ 
+ 	/* Set up the timer that drives the interface. */
+ 	setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
+-	new_smi->last_timeout_jiffies = jiffies;
+-	mod_timer(&new_smi->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
++	smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
+ 
+ 	/*
+ 	 * Check if the user forcefully enabled the daemon.
+diff --git a/drivers/char/tpm/tpm_ppi.c b/drivers/char/tpm/tpm_ppi.c
+index b3ea223585bd..61dcc8011ec7 100644
+--- a/drivers/char/tpm/tpm_ppi.c
++++ b/drivers/char/tpm/tpm_ppi.c
+@@ -328,13 +328,11 @@ int tpm_add_ppi(struct kobject *parent)
+ 	/* Cache TPM ACPI handle and version string */
+ 	acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, ACPI_UINT32_MAX,
+ 			    ppi_callback, NULL, NULL, &tpm_ppi_handle);
+-	if (tpm_ppi_handle == NULL)
+-		return -ENODEV;
+-
+-	return sysfs_create_group(parent, &ppi_attr_grp);
++	return tpm_ppi_handle ? sysfs_create_group(parent, &ppi_attr_grp) : 0;
+ }
+ 
+ void tpm_remove_ppi(struct kobject *parent)
+ {
+-	sysfs_remove_group(parent, &ppi_attr_grp);
++	if (tpm_ppi_handle)
++		sysfs_remove_group(parent, &ppi_attr_grp);
+ }
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index c42e608af6bb..b94a311e5ab6 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -1977,9 +1977,28 @@ struct clk *__clk_register(struct device *dev, struct clk_hw *hw)
+ }
+ EXPORT_SYMBOL_GPL(__clk_register);
+ 
+-static int _clk_register(struct device *dev, struct clk_hw *hw, struct clk *clk)
++/**
++ * clk_register - allocate a new clock, register it and return an opaque cookie
++ * @dev: device that is registering this clock
++ * @hw: link to hardware-specific clock data
++ *
++ * clk_register is the primary interface for populating the clock tree with new
++ * clock nodes.  It returns a pointer to the newly allocated struct clk which
++ * cannot be dereferenced by driver code but may be used in conjuction with the
++ * rest of the clock API.  In the event of an error clk_register will return an
++ * error code; drivers must test for an error code after calling clk_register.
++ */
++struct clk *clk_register(struct device *dev, struct clk_hw *hw)
+ {
+ 	int i, ret;
++	struct clk *clk;
++
++	clk = kzalloc(sizeof(*clk), GFP_KERNEL);
++	if (!clk) {
++		pr_err("%s: could not allocate clk\n", __func__);
++		ret = -ENOMEM;
++		goto fail_out;
++	}
+ 
+ 	clk->name = kstrdup(hw->init->name, GFP_KERNEL);
+ 	if (!clk->name) {
+@@ -2019,7 +2038,7 @@ static int _clk_register(struct device *dev, struct clk_hw *hw, struct clk *clk)
+ 
+ 	ret = __clk_init(dev, clk);
+ 	if (!ret)
+-		return 0;
++		return clk;
+ 
+ fail_parent_names_copy:
+ 	while (--i >= 0)
+@@ -2028,36 +2047,6 @@ fail_parent_names_copy:
+ fail_parent_names:
+ 	kfree(clk->name);
+ fail_name:
+-	return ret;
+-}
+-
+-/**
+- * clk_register - allocate a new clock, register it and return an opaque cookie
+- * @dev: device that is registering this clock
+- * @hw: link to hardware-specific clock data
+- *
+- * clk_register is the primary interface for populating the clock tree with new
+- * clock nodes.  It returns a pointer to the newly allocated struct clk which
+- * cannot be dereferenced by driver code but may be used in conjuction with the
+- * rest of the clock API.  In the event of an error clk_register will return an
+- * error code; drivers must test for an error code after calling clk_register.
+- */
+-struct clk *clk_register(struct device *dev, struct clk_hw *hw)
+-{
+-	int ret;
+-	struct clk *clk;
+-
+-	clk = kzalloc(sizeof(*clk), GFP_KERNEL);
+-	if (!clk) {
+-		pr_err("%s: could not allocate clk\n", __func__);
+-		ret = -ENOMEM;
+-		goto fail_out;
+-	}
+-
+-	ret = _clk_register(dev, hw, clk);
+-	if (!ret)
+-		return clk;
+-
+ 	kfree(clk);
+ fail_out:
+ 	return ERR_PTR(ret);
+@@ -2144,9 +2133,10 @@ void clk_unregister(struct clk *clk)
+ 
+ 	if (!hlist_empty(&clk->children)) {
+ 		struct clk *child;
++		struct hlist_node *t;
+ 
+ 		/* Reparent all children to the orphan list. */
+-		hlist_for_each_entry(child, &clk->children, child_node)
++		hlist_for_each_entry_safe(child, t, &clk->children, child_node)
+ 			clk_set_parent(child, NULL);
+ 	}
+ 
+@@ -2166,7 +2156,7 @@ EXPORT_SYMBOL_GPL(clk_unregister);
+ 
+ static void devm_clk_release(struct device *dev, void *res)
+ {
+-	clk_unregister(res);
++	clk_unregister(*(struct clk **)res);
+ }
+ 
+ /**
+@@ -2181,18 +2171,18 @@ static void devm_clk_release(struct device *dev, void *res)
+ struct clk *devm_clk_register(struct device *dev, struct clk_hw *hw)
+ {
+ 	struct clk *clk;
+-	int ret;
++	struct clk **clkp;
+ 
+-	clk = devres_alloc(devm_clk_release, sizeof(*clk), GFP_KERNEL);
+-	if (!clk)
++	clkp = devres_alloc(devm_clk_release, sizeof(*clkp), GFP_KERNEL);
++	if (!clkp)
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	ret = _clk_register(dev, hw, clk);
+-	if (!ret) {
+-		devres_add(dev, clk);
++	clk = clk_register(dev, hw);
++	if (!IS_ERR(clk)) {
++		*clkp = clk;
++		devres_add(dev, clkp);
+ 	} else {
+-		devres_free(clk);
+-		clk = ERR_PTR(ret);
++		devres_free(clkp);
+ 	}
+ 
+ 	return clk;
+diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c
+index 0d20241e0770..e1769addf435 100644
+--- a/drivers/clk/tegra/clk-pll.c
++++ b/drivers/clk/tegra/clk-pll.c
+@@ -1718,7 +1718,7 @@ struct clk *tegra_clk_register_plle_tegra114(const char *name,
+ 					"pll_re_vco");
+ 	} else {
+ 		val_aux &= ~(PLLE_AUX_PLLRE_SEL | PLLE_AUX_PLLP_SEL);
+-		pll_writel(val, pll_params->aux_reg, pll);
++		pll_writel(val_aux, pll_params->aux_reg, pll);
+ 	}
+ 
+ 	clk = _tegra_clk_register_pll(pll, name, parent_name, flags,
+diff --git a/drivers/clk/versatile/clk-vexpress-osc.c b/drivers/clk/versatile/clk-vexpress-osc.c
+index 2dc8b41a339d..a535c7bf8574 100644
+--- a/drivers/clk/versatile/clk-vexpress-osc.c
++++ b/drivers/clk/versatile/clk-vexpress-osc.c
+@@ -102,7 +102,7 @@ void __init vexpress_osc_of_setup(struct device_node *node)
+ 
+ 	osc = kzalloc(sizeof(*osc), GFP_KERNEL);
+ 	if (!osc)
+-		goto error;
++		return;
+ 
+ 	osc->func = vexpress_config_func_get_by_node(node);
+ 	if (!osc->func) {
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index 48f76bc05da0..e252939b9ee1 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -418,8 +418,6 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
+ 	evt->set_mode = exynos4_tick_set_mode;
+ 	evt->features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
+ 	evt->rating = 450;
+-	clockevents_config_and_register(evt, clk_rate / (TICK_BASE_CNT + 1),
+-					0xf, 0x7fffffff);
+ 
+ 	exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
+ 
+@@ -432,9 +430,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
+ 				evt->irq);
+ 			return -EIO;
+ 		}
++		irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu));
+ 	} else {
+ 		enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
+ 	}
++	clockevents_config_and_register(evt, clk_rate / (TICK_BASE_CNT + 1),
++					0xf, 0x7fffffff);
+ 
+ 	return 0;
+ }
+@@ -452,7 +453,6 @@ static int exynos4_mct_cpu_notify(struct notifier_block *self,
+ 					   unsigned long action, void *hcpu)
+ {
+ 	struct mct_clock_event_device *mevt;
+-	unsigned int cpu;
+ 
+ 	/*
+ 	 * Grab cpu pointer in each case to avoid spurious
+@@ -463,12 +463,6 @@ static int exynos4_mct_cpu_notify(struct notifier_block *self,
+ 		mevt = this_cpu_ptr(&percpu_mct_tick);
+ 		exynos4_local_timer_setup(&mevt->evt);
+ 		break;
+-	case CPU_ONLINE:
+-		cpu = (unsigned long)hcpu;
+-		if (mct_int_type == MCT_INT_SPI)
+-			irq_set_affinity(mct_irqs[MCT_L0_IRQ + cpu],
+-						cpumask_of(cpu));
+-		break;
+ 	case CPU_DYING:
+ 		mevt = this_cpu_ptr(&percpu_mct_tick);
+ 		exynos4_local_timer_stop(&mevt->evt);
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 2cd36b9297f3..9ac378380677 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -37,6 +37,7 @@
+ #define BYT_RATIOS		0x66a
+ #define BYT_VIDS		0x66b
+ #define BYT_TURBO_RATIOS	0x66c
++#define BYT_TURBO_VIDS		0x66d
+ 
+ 
+ #define FRAC_BITS 6
+@@ -70,8 +71,9 @@ struct pstate_data {
+ };
+ 
+ struct vid_data {
+-	int32_t min;
+-	int32_t max;
++	int min;
++	int max;
++	int turbo;
+ 	int32_t ratio;
+ };
+ 
+@@ -360,14 +362,14 @@ static int byt_get_min_pstate(void)
+ {
+ 	u64 value;
+ 	rdmsrl(BYT_RATIOS, value);
+-	return (value >> 8) & 0xFF;
++	return (value >> 8) & 0x3F;
+ }
+ 
+ static int byt_get_max_pstate(void)
+ {
+ 	u64 value;
+ 	rdmsrl(BYT_RATIOS, value);
+-	return (value >> 16) & 0xFF;
++	return (value >> 16) & 0x3F;
+ }
+ 
+ static int byt_get_turbo_pstate(void)
+@@ -394,6 +396,9 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate)
+ 	vid_fp = clamp_t(int32_t, vid_fp, cpudata->vid.min, cpudata->vid.max);
+ 	vid = fp_toint(vid_fp);
+ 
++	if (pstate > cpudata->pstate.max_pstate)
++		vid = cpudata->vid.turbo;
++
+ 	val |= vid;
+ 
+ 	wrmsrl(MSR_IA32_PERF_CTL, val);
+@@ -403,13 +408,17 @@ static void byt_get_vid(struct cpudata *cpudata)
+ {
+ 	u64 value;
+ 
++
+ 	rdmsrl(BYT_VIDS, value);
+-	cpudata->vid.min = int_tofp((value >> 8) & 0x7f);
+-	cpudata->vid.max = int_tofp((value >> 16) & 0x7f);
++	cpudata->vid.min = int_tofp((value >> 8) & 0x3f);
++	cpudata->vid.max = int_tofp((value >> 16) & 0x3f);
+ 	cpudata->vid.ratio = div_fp(
+ 		cpudata->vid.max - cpudata->vid.min,
+ 		int_tofp(cpudata->pstate.max_pstate -
+ 			cpudata->pstate.min_pstate));
++
++	rdmsrl(BYT_TURBO_VIDS, value);
++	cpudata->vid.turbo = value & 0x7f;
+ }
+ 
+ 
+@@ -546,12 +555,7 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
+ 
+ 	if (pstate_funcs.get_vid)
+ 		pstate_funcs.get_vid(cpu);
+-
+-	/*
+-	 * goto max pstate so we don't slow up boot if we are built-in if we are
+-	 * a module we will take care of it during normal operation
+-	 */
+-	intel_pstate_set_pstate(cpu, cpu->pstate.max_pstate);
++	intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate);
+ }
+ 
+ static inline void intel_pstate_calc_busy(struct cpudata *cpu,
+@@ -697,11 +701,6 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
+ 	cpu = all_cpu_data[cpunum];
+ 
+ 	intel_pstate_get_cpu_pstates(cpu);
+-	if (!cpu->pstate.current_pstate) {
+-		all_cpu_data[cpunum] = NULL;
+-		kfree(cpu);
+-		return -ENODATA;
+-	}
+ 
+ 	cpu->cpu = cpunum;
+ 
+@@ -712,7 +711,6 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
+ 	cpu->timer.expires = jiffies + HZ/100;
+ 	intel_pstate_busy_pid_reset(cpu);
+ 	intel_pstate_sample(cpu);
+-	intel_pstate_set_pstate(cpu, cpu->pstate.max_pstate);
+ 
+ 	add_timer_on(&cpu->timer, cpunum);
+ 
+diff --git a/drivers/cpufreq/loongson2_cpufreq.c b/drivers/cpufreq/loongson2_cpufreq.c
+index 8dead6fb28e8..7231967f51b4 100644
+--- a/drivers/cpufreq/loongson2_cpufreq.c
++++ b/drivers/cpufreq/loongson2_cpufreq.c
+@@ -62,7 +62,7 @@ static int loongson2_cpufreq_target(struct cpufreq_policy *policy,
+ 	set_cpus_allowed_ptr(current, &cpus_allowed);
+ 
+ 	/* setting the cpu frequency */
+-	clk_set_rate(policy->clk, freq);
++	clk_set_rate(policy->clk, freq * 1000);
+ 
+ 	return 0;
+ }
+@@ -92,7 +92,7 @@ static int loongson2_cpufreq_cpu_init(struct cpufreq_policy *policy)
+ 	     i++)
+ 		loongson2_clockmod_table[i].frequency = (rate * i) / 8;
+ 
+-	ret = clk_set_rate(cpuclk, rate);
++	ret = clk_set_rate(cpuclk, rate * 1000);
+ 	if (ret) {
+ 		clk_put(cpuclk);
+ 		return ret;
+diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
+index 9f25f5296029..0eabd81e1a90 100644
+--- a/drivers/crypto/caam/error.c
++++ b/drivers/crypto/caam/error.c
+@@ -16,9 +16,13 @@
+ 	char *tmp;						\
+ 								\
+ 	tmp = kmalloc(sizeof(format) + max_alloc, GFP_ATOMIC);	\
+-	sprintf(tmp, format, param);				\
+-	strcat(str, tmp);					\
+-	kfree(tmp);						\
++	if (likely(tmp)) {					\
++		sprintf(tmp, format, param);			\
++		strcat(str, tmp);				\
++		kfree(tmp);					\
++	} else {						\
++		strcat(str, "kmalloc failure in SPRINTFCAT");	\
++	}							\
+ }
+ 
+ static void report_jump_idx(u32 status, char *outstr)
+diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
+index ed610b497518..a4068e2d2b5d 100644
+--- a/drivers/dma/dmaengine.c
++++ b/drivers/dma/dmaengine.c
+@@ -1014,6 +1014,7 @@ static void dmaengine_unmap(struct kref *kref)
+ 		dma_unmap_page(dev, unmap->addr[i], unmap->len,
+ 			       DMA_BIDIRECTIONAL);
+ 	}
++	cnt = unmap->map_cnt;
+ 	mempool_free(unmap, __get_unmap_pool(cnt)->pool);
+ }
+ 
+@@ -1079,6 +1080,7 @@ dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags)
+ 	memset(unmap, 0, sizeof(*unmap));
+ 	kref_init(&unmap->kref);
+ 	unmap->dev = dev;
++	unmap->map_cnt = nr;
+ 
+ 	return unmap;
+ }
+diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
+index 13ac3f240e79..01a200cd0189 100644
+--- a/drivers/dma/dw/core.c
++++ b/drivers/dma/dw/core.c
+@@ -1545,11 +1545,6 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
+ 	/* Disable BLOCK interrupts as well */
+ 	channel_clear_bit(dw, MASK.BLOCK, dw->all_chan_mask);
+ 
+-	err = devm_request_irq(chip->dev, chip->irq, dw_dma_interrupt,
+-			       IRQF_SHARED, "dw_dmac", dw);
+-	if (err)
+-		return err;
+-
+ 	/* Create a pool of consistent memory blocks for hardware descriptors */
+ 	dw->desc_pool = dmam_pool_create("dw_dmac_desc_pool", chip->dev,
+ 					 sizeof(struct dw_desc), 4, 0);
+@@ -1560,6 +1555,11 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
+ 
+ 	tasklet_init(&dw->tasklet, dw_dma_tasklet, (unsigned long)dw);
+ 
++	err = request_irq(chip->irq, dw_dma_interrupt, IRQF_SHARED,
++			  "dw_dmac", dw);
++	if (err)
++		return err;
++
+ 	INIT_LIST_HEAD(&dw->dma.channels);
+ 	for (i = 0; i < nr_channels; i++) {
+ 		struct dw_dma_chan	*dwc = &dw->chan[i];
+@@ -1664,6 +1664,7 @@ int dw_dma_remove(struct dw_dma_chip *chip)
+ 	dw_dma_off(dw);
+ 	dma_async_device_unregister(&dw->dma);
+ 
++	free_irq(chip->irq, dw);
+ 	tasklet_kill(&dw->tasklet);
+ 
+ 	list_for_each_entry_safe(dwc, _dwc, &dw->dma.channels,
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index 766b68ed505c..394cbc5c93e3 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -191,12 +191,10 @@ static void mv_set_mode(struct mv_xor_chan *chan,
+ 
+ static void mv_chan_activate(struct mv_xor_chan *chan)
+ {
+-	u32 activation;
+-
+ 	dev_dbg(mv_chan_to_devp(chan), " activate chan.\n");
+-	activation = readl_relaxed(XOR_ACTIVATION(chan));
+-	activation |= 0x1;
+-	writel_relaxed(activation, XOR_ACTIVATION(chan));
++
++	/* writel ensures all descriptors are flushed before activation */
++	writel(BIT(0), XOR_ACTIVATION(chan));
+ }
+ 
+ static char mv_chan_is_busy(struct mv_xor_chan *chan)
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index ec7bb0fc71bc..9debd6e74439 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -614,15 +614,20 @@ static void intel_resume_hotplug(struct drm_device *dev)
+ 	drm_helper_hpd_irq_event(dev);
+ }
+ 
++static int i915_drm_thaw_early(struct drm_device *dev)
++{
++	intel_uncore_early_sanitize(dev);
++	intel_uncore_sanitize(dev);
++	intel_power_domains_init_hw(dev);
++
++	return 0;
++}
++
+ static int __i915_drm_thaw(struct drm_device *dev, bool restore_gtt_mappings)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 	int error = 0;
+ 
+-	intel_uncore_early_sanitize(dev);
+-
+-	intel_uncore_sanitize(dev);
+-
+ 	if (drm_core_check_feature(dev, DRIVER_MODESET) &&
+ 	    restore_gtt_mappings) {
+ 		mutex_lock(&dev->struct_mutex);
+@@ -630,8 +635,6 @@ static int __i915_drm_thaw(struct drm_device *dev, bool restore_gtt_mappings)
+ 		mutex_unlock(&dev->struct_mutex);
+ 	}
+ 
+-	intel_power_domains_init_hw(dev);
+-
+ 	i915_restore_state(dev);
+ 	intel_opregion_setup(dev);
+ 
+@@ -700,19 +703,33 @@ static int i915_drm_thaw(struct drm_device *dev)
+ 	return __i915_drm_thaw(dev, true);
+ }
+ 
+-int i915_resume(struct drm_device *dev)
++static int i915_resume_early(struct drm_device *dev)
+ {
+-	struct drm_i915_private *dev_priv = dev->dev_private;
+-	int ret;
+-
+ 	if (dev->switch_power_state == DRM_SWITCH_POWER_OFF)
+ 		return 0;
+ 
++	/*
++	 * We have a resume ordering issue with the snd-hda driver also
++	 * requiring our device to be power up. Due to the lack of a
++	 * parent/child relationship we currently solve this with an early
++	 * resume hook.
++	 *
++	 * FIXME: This should be solved with a special hdmi sink device or
++	 * similar so that power domains can be employed.
++	 */
+ 	if (pci_enable_device(dev->pdev))
+ 		return -EIO;
+ 
+ 	pci_set_master(dev->pdev);
+ 
++	return i915_drm_thaw_early(dev);
++}
++
++int i915_resume(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++	int ret;
++
+ 	/*
+ 	 * Platforms with opregion should have sane BIOS, older ones (gen3 and
+ 	 * earlier) need to restore the GTT mappings since the BIOS might clear
+@@ -726,6 +743,14 @@ int i915_resume(struct drm_device *dev)
+ 	return 0;
+ }
+ 
++static int i915_resume_legacy(struct drm_device *dev)
++{
++	i915_resume_early(dev);
++	i915_resume(dev);
++
++	return 0;
++}
++
+ /**
+  * i915_reset - reset chip after a hang
+  * @dev: drm device to reset
+@@ -846,7 +871,6 @@ static int i915_pm_suspend(struct device *dev)
+ {
+ 	struct pci_dev *pdev = to_pci_dev(dev);
+ 	struct drm_device *drm_dev = pci_get_drvdata(pdev);
+-	int error;
+ 
+ 	if (!drm_dev || !drm_dev->dev_private) {
+ 		dev_err(dev, "DRM not initialized, aborting suspend.\n");
+@@ -856,9 +880,25 @@ static int i915_pm_suspend(struct device *dev)
+ 	if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
+ 		return 0;
+ 
+-	error = i915_drm_freeze(drm_dev);
+-	if (error)
+-		return error;
++	return i915_drm_freeze(drm_dev);
++}
++
++static int i915_pm_suspend_late(struct device *dev)
++{
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct drm_device *drm_dev = pci_get_drvdata(pdev);
++
++	/*
++	 * We have a suspedn ordering issue with the snd-hda driver also
++	 * requiring our device to be power up. Due to the lack of a
++	 * parent/child relationship we currently solve this with an late
++	 * suspend hook.
++	 *
++	 * FIXME: This should be solved with a special hdmi sink device or
++	 * similar so that power domains can be employed.
++	 */
++	if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
++		return 0;
+ 
+ 	pci_disable_device(pdev);
+ 	pci_set_power_state(pdev, PCI_D3hot);
+@@ -866,6 +906,14 @@ static int i915_pm_suspend(struct device *dev)
+ 	return 0;
+ }
+ 
++static int i915_pm_resume_early(struct device *dev)
++{
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct drm_device *drm_dev = pci_get_drvdata(pdev);
++
++	return i915_resume_early(drm_dev);
++}
++
+ static int i915_pm_resume(struct device *dev)
+ {
+ 	struct pci_dev *pdev = to_pci_dev(dev);
+@@ -887,6 +935,14 @@ static int i915_pm_freeze(struct device *dev)
+ 	return i915_drm_freeze(drm_dev);
+ }
+ 
++static int i915_pm_thaw_early(struct device *dev)
++{
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct drm_device *drm_dev = pci_get_drvdata(pdev);
++
++	return i915_drm_thaw_early(drm_dev);
++}
++
+ static int i915_pm_thaw(struct device *dev)
+ {
+ 	struct pci_dev *pdev = to_pci_dev(dev);
+@@ -948,10 +1004,14 @@ static int i915_runtime_resume(struct device *device)
+ 
+ static const struct dev_pm_ops i915_pm_ops = {
+ 	.suspend = i915_pm_suspend,
++	.suspend_late = i915_pm_suspend_late,
++	.resume_early = i915_pm_resume_early,
+ 	.resume = i915_pm_resume,
+ 	.freeze = i915_pm_freeze,
++	.thaw_early = i915_pm_thaw_early,
+ 	.thaw = i915_pm_thaw,
+ 	.poweroff = i915_pm_poweroff,
++	.restore_early = i915_pm_resume_early,
+ 	.restore = i915_pm_resume,
+ 	.runtime_suspend = i915_runtime_suspend,
+ 	.runtime_resume = i915_runtime_resume,
+@@ -994,7 +1054,7 @@ static struct drm_driver driver = {
+ 
+ 	/* Used in place of i915_pm_ops for non-DRIVER_MODESET */
+ 	.suspend = i915_suspend,
+-	.resume = i915_resume,
++	.resume = i915_resume_legacy,
+ 
+ 	.device_is_agp = i915_driver_device_is_agp,
+ 	.master_create = i915_master_create,
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 00c836154725..3ecb332e7cfa 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -3529,7 +3529,7 @@ int i915_gem_object_set_cache_level(struct drm_i915_gem_object *obj,
+ {
+ 	struct drm_device *dev = obj->base.dev;
+ 	drm_i915_private_t *dev_priv = dev->dev_private;
+-	struct i915_vma *vma;
++	struct i915_vma *vma, *next;
+ 	int ret;
+ 
+ 	if (obj->cache_level == cache_level)
+@@ -3540,7 +3540,7 @@ int i915_gem_object_set_cache_level(struct drm_i915_gem_object *obj,
+ 		return -EBUSY;
+ 	}
+ 
+-	list_for_each_entry(vma, &obj->vma_list, vma_link) {
++	list_for_each_entry_safe(vma, next, &obj->vma_list, vma_link) {
+ 		if (!i915_gem_valid_gtt_space(dev, &vma->node, cache_level)) {
+ 			ret = i915_vma_unbind(vma);
+ 			if (ret)
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index d554169ac592..40504504c9e2 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -1252,10 +1252,20 @@ static inline void intel_hpd_irq_handler(struct drm_device *dev,
+ 	spin_lock(&dev_priv->irq_lock);
+ 	for (i = 1; i < HPD_NUM_PINS; i++) {
+ 
+-		WARN_ONCE(hpd[i] & hotplug_trigger &&
+-			  dev_priv->hpd_stats[i].hpd_mark == HPD_DISABLED,
+-			  "Received HPD interrupt (0x%08x) on pin %d (0x%08x) although disabled\n",
+-			  hotplug_trigger, i, hpd[i]);
++		if (hpd[i] & hotplug_trigger &&
++		    dev_priv->hpd_stats[i].hpd_mark == HPD_DISABLED) {
++			/*
++			 * On GMCH platforms the interrupt mask bits only
++			 * prevent irq generation, not the setting of the
++			 * hotplug bits itself. So only WARN about unexpected
++			 * interrupts on saner platforms.
++			 */
++			WARN_ONCE(INTEL_INFO(dev)->gen >= 5 && !IS_VALLEYVIEW(dev),
++				  "Received HPD interrupt (0x%08x) on pin %d (0x%08x) although disabled\n",
++				  hotplug_trigger, i, hpd[i]);
++
++			continue;
++		}
+ 
+ 		if (!(hpd[i] & hotplug_trigger) ||
+ 		    dev_priv->hpd_stats[i].hpd_mark != HPD_ENABLED)
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 963639d9049b..9d4d837506d0 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -9354,11 +9354,22 @@ intel_pipe_config_compare(struct drm_device *dev,
+ 	PIPE_CONF_CHECK_I(pipe_src_w);
+ 	PIPE_CONF_CHECK_I(pipe_src_h);
+ 
+-	PIPE_CONF_CHECK_I(gmch_pfit.control);
+-	/* pfit ratios are autocomputed by the hw on gen4+ */
+-	if (INTEL_INFO(dev)->gen < 4)
+-		PIPE_CONF_CHECK_I(gmch_pfit.pgm_ratios);
+-	PIPE_CONF_CHECK_I(gmch_pfit.lvds_border_bits);
++	/*
++	 * FIXME: BIOS likes to set up a cloned config with lvds+external
++	 * screen. Since we don't yet re-compute the pipe config when moving
++	 * just the lvds port away to another pipe the sw tracking won't match.
++	 *
++	 * Proper atomic modesets with recomputed global state will fix this.
++	 * Until then just don't check gmch state for inherited modes.
++	 */
++	if (!PIPE_CONF_QUIRK(PIPE_CONFIG_QUIRK_INHERITED_MODE)) {
++		PIPE_CONF_CHECK_I(gmch_pfit.control);
++		/* pfit ratios are autocomputed by the hw on gen4+ */
++		if (INTEL_INFO(dev)->gen < 4)
++			PIPE_CONF_CHECK_I(gmch_pfit.pgm_ratios);
++		PIPE_CONF_CHECK_I(gmch_pfit.lvds_border_bits);
++	}
++
+ 	PIPE_CONF_CHECK_I(pch_pfit.enabled);
+ 	if (current_config->pch_pfit.enabled) {
+ 		PIPE_CONF_CHECK_I(pch_pfit.pos);
+@@ -10851,6 +10862,9 @@ static struct intel_quirk intel_quirks[] = {
+ 	/* Acer Aspire 4736Z */
+ 	{ 0x2a42, 0x1025, 0x0260, quirk_invert_brightness },
+ 
++	/* Acer Aspire 5336 */
++	{ 0x2a42, 0x1025, 0x048a, quirk_invert_brightness },
++
+ 	/* Dell XPS13 HD Sandy Bridge */
+ 	{ 0x0116, 0x1028, 0x052e, quirk_no_pcm_pwm_enable },
+ 	/* Dell XPS13 HD and XPS13 FHD Ivy Bridge */
+@@ -10978,15 +10992,6 @@ void intel_modeset_init(struct drm_device *dev)
+ 	intel_disable_fbc(dev);
+ }
+ 
+-static void
+-intel_connector_break_all_links(struct intel_connector *connector)
+-{
+-	connector->base.dpms = DRM_MODE_DPMS_OFF;
+-	connector->base.encoder = NULL;
+-	connector->encoder->connectors_active = false;
+-	connector->encoder->base.crtc = NULL;
+-}
+-
+ static void intel_enable_pipe_a(struct drm_device *dev)
+ {
+ 	struct intel_connector *connector;
+@@ -11068,8 +11073,17 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
+ 			if (connector->encoder->base.crtc != &crtc->base)
+ 				continue;
+ 
+-			intel_connector_break_all_links(connector);
++			connector->base.dpms = DRM_MODE_DPMS_OFF;
++			connector->base.encoder = NULL;
+ 		}
++		/* multiple connectors may have the same encoder:
++		 *  handle them and break crtc link separately */
++		list_for_each_entry(connector, &dev->mode_config.connector_list,
++				    base.head)
++			if (connector->encoder->base.crtc == &crtc->base) {
++				connector->encoder->base.crtc = NULL;
++				connector->encoder->connectors_active = false;
++			}
+ 
+ 		WARN_ON(crtc->active);
+ 		crtc->base.enabled = false;
+@@ -11140,6 +11154,8 @@ static void intel_sanitize_encoder(struct intel_encoder *encoder)
+ 				      drm_get_encoder_name(&encoder->base));
+ 			encoder->disable(encoder);
+ 		}
++		encoder->base.crtc = NULL;
++		encoder->connectors_active = false;
+ 
+ 		/* Inconsistent output/port/pipe state happens presumably due to
+ 		 * a bug in one of the get_hw_state functions. Or someplace else
+@@ -11150,8 +11166,8 @@ static void intel_sanitize_encoder(struct intel_encoder *encoder)
+ 				    base.head) {
+ 			if (connector->encoder != encoder)
+ 				continue;
+-
+-			intel_connector_break_all_links(connector);
++			connector->base.dpms = DRM_MODE_DPMS_OFF;
++			connector->base.encoder = NULL;
+ 		}
+ 	}
+ 	/* Enabled encoders without active connectors will be fixed in
+@@ -11193,6 +11209,8 @@ static void intel_modeset_readout_hw_state(struct drm_device *dev)
+ 			    base.head) {
+ 		memset(&crtc->config, 0, sizeof(crtc->config));
+ 
++		crtc->config.quirks |= PIPE_CONFIG_QUIRK_INHERITED_MODE;
++
+ 		crtc->active = dev_priv->display.get_pipe_config(crtc,
+ 								 &crtc->config);
+ 
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index fbfaaba5cc3b..00de120531ac 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -219,7 +219,8 @@ struct intel_crtc_config {
+ 	 * tracked with quirk flags so that fastboot and state checker can act
+ 	 * accordingly.
+ 	 */
+-#define PIPE_CONFIG_QUIRK_MODE_SYNC_FLAGS (1<<0) /* unreliable sync mode.flags */
++#define PIPE_CONFIG_QUIRK_MODE_SYNC_FLAGS	(1<<0) /* unreliable sync mode.flags */
++#define PIPE_CONFIG_QUIRK_INHERITED_MODE	(1<<1) /* mode inherited from firmware */
+ 	unsigned long quirks;
+ 
+ 	/* User requested mode, only valid as a starting point to
+diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
+index ee3181ebcc92..ca5d23d17d20 100644
+--- a/drivers/gpu/drm/i915/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/intel_hdmi.c
+@@ -841,11 +841,11 @@ static void intel_disable_hdmi(struct intel_encoder *encoder)
+ 	}
+ }
+ 
+-static int hdmi_portclock_limit(struct intel_hdmi *hdmi)
++static int hdmi_portclock_limit(struct intel_hdmi *hdmi, bool respect_dvi_limit)
+ {
+ 	struct drm_device *dev = intel_hdmi_to_dev(hdmi);
+ 
+-	if (!hdmi->has_hdmi_sink || IS_G4X(dev))
++	if ((respect_dvi_limit && !hdmi->has_hdmi_sink) || IS_G4X(dev))
+ 		return 165000;
+ 	else if (IS_HASWELL(dev) || INTEL_INFO(dev)->gen >= 8)
+ 		return 300000;
+@@ -857,7 +857,8 @@ static enum drm_mode_status
+ intel_hdmi_mode_valid(struct drm_connector *connector,
+ 		      struct drm_display_mode *mode)
+ {
+-	if (mode->clock > hdmi_portclock_limit(intel_attached_hdmi(connector)))
++	if (mode->clock > hdmi_portclock_limit(intel_attached_hdmi(connector),
++					       true))
+ 		return MODE_CLOCK_HIGH;
+ 	if (mode->clock < 20000)
+ 		return MODE_CLOCK_LOW;
+@@ -875,7 +876,7 @@ bool intel_hdmi_compute_config(struct intel_encoder *encoder,
+ 	struct drm_device *dev = encoder->base.dev;
+ 	struct drm_display_mode *adjusted_mode = &pipe_config->adjusted_mode;
+ 	int clock_12bpc = pipe_config->adjusted_mode.crtc_clock * 3 / 2;
+-	int portclock_limit = hdmi_portclock_limit(intel_hdmi);
++	int portclock_limit = hdmi_portclock_limit(intel_hdmi, false);
+ 	int desired_bpp;
+ 
+ 	if (intel_hdmi->color_range_auto) {
+diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
+index 9f1d7a9300e8..19a4f0535b63 100644
+--- a/drivers/gpu/drm/i915/intel_panel.c
++++ b/drivers/gpu/drm/i915/intel_panel.c
+@@ -501,6 +501,7 @@ void intel_panel_set_backlight(struct intel_connector *connector, u32 level,
+ 	enum pipe pipe = intel_get_pipe_from_connector(connector);
+ 	u32 freq;
+ 	unsigned long flags;
++	u64 n;
+ 
+ 	if (!panel->backlight.present || pipe == INVALID_PIPE)
+ 		return;
+@@ -511,10 +512,9 @@ void intel_panel_set_backlight(struct intel_connector *connector, u32 level,
+ 
+ 	/* scale to hardware max, but be careful to not overflow */
+ 	freq = panel->backlight.max;
+-	if (freq < max)
+-		level = level * freq / max;
+-	else
+-		level = freq / max * level;
++	n = (u64)level * freq;
++	do_div(n, max);
++	level = n;
+ 
+ 	panel->backlight.level = level;
+ 	if (panel->backlight.device)
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index e1fc35a72656..bd1b00344dac 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -1539,6 +1539,16 @@ static void i9xx_update_wm(struct drm_crtc *unused_crtc)
+ 
+ 	DRM_DEBUG_KMS("FIFO watermarks - A: %d, B: %d\n", planea_wm, planeb_wm);
+ 
++	if (IS_I915GM(dev) && enabled) {
++		struct intel_framebuffer *fb;
++
++		fb = to_intel_framebuffer(enabled->fb);
++
++		/* self-refresh seems busted with untiled */
++		if (fb->obj->tiling_mode == I915_TILING_NONE)
++			enabled = NULL;
++	}
++
+ 	/*
+ 	 * Overlay gets an aggressive default since video jitter is bad.
+ 	 */
+diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
+index 87df68f5f504..c8796316d242 100644
+--- a/drivers/gpu/drm/i915/intel_uncore.c
++++ b/drivers/gpu/drm/i915/intel_uncore.c
+@@ -177,6 +177,8 @@ static void vlv_force_wake_reset(struct drm_i915_private *dev_priv)
+ {
+ 	__raw_i915_write32(dev_priv, FORCEWAKE_VLV,
+ 			   _MASKED_BIT_DISABLE(0xffff));
++	__raw_i915_write32(dev_priv, FORCEWAKE_MEDIA_VLV,
++			   _MASKED_BIT_DISABLE(0xffff));
+ 	/* something from same cacheline, but !FORCEWAKE_VLV */
+ 	__raw_posting_read(dev_priv, FORCEWAKE_ACK_VLV);
+ }
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c b/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c
+index 95f6129eeede..29d4c417a5b3 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c
+@@ -54,8 +54,10 @@ nouveau_fan_update(struct nouveau_fan *fan, bool immediate, int target)
+ 
+ 	/* check that we're not already at the target duty cycle */
+ 	duty = fan->get(therm);
+-	if (duty == target)
+-		goto done;
++	if (duty == target) {
++		spin_unlock_irqrestore(&fan->lock, flags);
++		return 0;
++	}
+ 
+ 	/* smooth out the fanspeed increase/decrease */
+ 	if (!immediate && duty >= 0) {
+@@ -73,8 +75,15 @@ nouveau_fan_update(struct nouveau_fan *fan, bool immediate, int target)
+ 
+ 	nv_debug(therm, "FAN update: %d\n", duty);
+ 	ret = fan->set(therm, duty);
+-	if (ret)
+-		goto done;
++	if (ret) {
++		spin_unlock_irqrestore(&fan->lock, flags);
++		return ret;
++	}
++
++	/* fan speed updated, drop the fan lock before grabbing the
++	 * alarm-scheduling lock and risking a deadlock
++	 */
++	spin_unlock_irqrestore(&fan->lock, flags);
+ 
+ 	/* schedule next fan update, if not at target speed already */
+ 	if (list_empty(&fan->alarm.head) && target != duty) {
+@@ -92,8 +101,6 @@ nouveau_fan_update(struct nouveau_fan *fan, bool immediate, int target)
+ 		ptimer->alarm(ptimer, delay * 1000 * 1000, &fan->alarm);
+ 	}
+ 
+-done:
+-	spin_unlock_irqrestore(&fan->lock, flags);
+ 	return ret;
+ }
+ 
+diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
+index 83face3f608f..279206997e5c 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
++++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
+@@ -389,9 +389,6 @@ bool nouveau_acpi_rom_supported(struct pci_dev *pdev)
+ 	acpi_status status;
+ 	acpi_handle dhandle, rom_handle;
+ 
+-	if (!nouveau_dsm_priv.dsm_detected && !nouveau_dsm_priv.optimus_detected)
+-		return false;
+-
+ 	dhandle = ACPI_HANDLE(&pdev->dev);
+ 	if (!dhandle)
+ 		return false;
+diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
+index 24011596af43..5524a3705224 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_display.c
++++ b/drivers/gpu/drm/nouveau/nouveau_display.c
+@@ -762,9 +762,9 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
+ 	}
+ 
+ 	ret = nouveau_page_flip_emit(chan, old_bo, new_bo, s, &fence);
+-	mutex_unlock(&chan->cli->mutex);
+ 	if (ret)
+ 		goto fail_unreserve;
++	mutex_unlock(&chan->cli->mutex);
+ 
+ 	/* Update the crtc struct and cleanup */
+ 	crtc->fb = fb;
+diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
+index 8d49104ca6c2..9241e96f8502 100644
+--- a/drivers/gpu/drm/radeon/ci_dpm.c
++++ b/drivers/gpu/drm/radeon/ci_dpm.c
+@@ -21,8 +21,10 @@
+  *
+  */
+ 
++#include <linux/firmware.h>
+ #include "drmP.h"
+ #include "radeon.h"
++#include "radeon_ucode.h"
+ #include "cikd.h"
+ #include "r600_dpm.h"
+ #include "ci_dpm.h"
+@@ -5106,6 +5108,12 @@ int ci_dpm_init(struct radeon_device *rdev)
+ 	pi->mclk_dpm_key_disabled = 0;
+ 	pi->pcie_dpm_key_disabled = 0;
+ 
++	/* mclk dpm is unstable on some R7 260X cards with the old mc ucode */
++	if ((rdev->pdev->device == 0x6658) &&
++	    (rdev->mc_fw->size == (BONAIRE_MC_UCODE_SIZE * 4))) {
++		pi->mclk_dpm_key_disabled = 1;
++	}
++
+ 	pi->caps_sclk_ds = true;
+ 
+ 	pi->mclk_strobe_mode_threshold = 40000;
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 986f9e7364ca..270f68a6b724 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -38,6 +38,7 @@ MODULE_FIRMWARE("radeon/BONAIRE_me.bin");
+ MODULE_FIRMWARE("radeon/BONAIRE_ce.bin");
+ MODULE_FIRMWARE("radeon/BONAIRE_mec.bin");
+ MODULE_FIRMWARE("radeon/BONAIRE_mc.bin");
++MODULE_FIRMWARE("radeon/BONAIRE_mc2.bin");
+ MODULE_FIRMWARE("radeon/BONAIRE_rlc.bin");
+ MODULE_FIRMWARE("radeon/BONAIRE_sdma.bin");
+ MODULE_FIRMWARE("radeon/BONAIRE_smc.bin");
+@@ -46,6 +47,7 @@ MODULE_FIRMWARE("radeon/HAWAII_me.bin");
+ MODULE_FIRMWARE("radeon/HAWAII_ce.bin");
+ MODULE_FIRMWARE("radeon/HAWAII_mec.bin");
+ MODULE_FIRMWARE("radeon/HAWAII_mc.bin");
++MODULE_FIRMWARE("radeon/HAWAII_mc2.bin");
+ MODULE_FIRMWARE("radeon/HAWAII_rlc.bin");
+ MODULE_FIRMWARE("radeon/HAWAII_sdma.bin");
+ MODULE_FIRMWARE("radeon/HAWAII_smc.bin");
+@@ -1702,20 +1704,20 @@ int ci_mc_load_microcode(struct radeon_device *rdev)
+ 	const __be32 *fw_data;
+ 	u32 running, blackout = 0;
+ 	u32 *io_mc_regs;
+-	int i, ucode_size, regs_size;
++	int i, regs_size, ucode_size;
+ 
+ 	if (!rdev->mc_fw)
+ 		return -EINVAL;
+ 
++	ucode_size = rdev->mc_fw->size / 4;
++
+ 	switch (rdev->family) {
+ 	case CHIP_BONAIRE:
+ 		io_mc_regs = (u32 *)&bonaire_io_mc_regs;
+-		ucode_size = CIK_MC_UCODE_SIZE;
+ 		regs_size = BONAIRE_IO_MC_REGS_SIZE;
+ 		break;
+ 	case CHIP_HAWAII:
+ 		io_mc_regs = (u32 *)&hawaii_io_mc_regs;
+-		ucode_size = HAWAII_MC_UCODE_SIZE;
+ 		regs_size = HAWAII_IO_MC_REGS_SIZE;
+ 		break;
+ 	default:
+@@ -1782,7 +1784,7 @@ static int cik_init_microcode(struct radeon_device *rdev)
+ 	const char *chip_name;
+ 	size_t pfp_req_size, me_req_size, ce_req_size,
+ 		mec_req_size, rlc_req_size, mc_req_size = 0,
+-		sdma_req_size, smc_req_size = 0;
++		sdma_req_size, smc_req_size = 0, mc2_req_size = 0;
+ 	char fw_name[30];
+ 	int err;
+ 
+@@ -1796,7 +1798,8 @@ static int cik_init_microcode(struct radeon_device *rdev)
+ 		ce_req_size = CIK_CE_UCODE_SIZE * 4;
+ 		mec_req_size = CIK_MEC_UCODE_SIZE * 4;
+ 		rlc_req_size = BONAIRE_RLC_UCODE_SIZE * 4;
+-		mc_req_size = CIK_MC_UCODE_SIZE * 4;
++		mc_req_size = BONAIRE_MC_UCODE_SIZE * 4;
++		mc2_req_size = BONAIRE_MC2_UCODE_SIZE * 4;
+ 		sdma_req_size = CIK_SDMA_UCODE_SIZE * 4;
+ 		smc_req_size = ALIGN(BONAIRE_SMC_UCODE_SIZE, 4);
+ 		break;
+@@ -1808,6 +1811,7 @@ static int cik_init_microcode(struct radeon_device *rdev)
+ 		mec_req_size = CIK_MEC_UCODE_SIZE * 4;
+ 		rlc_req_size = BONAIRE_RLC_UCODE_SIZE * 4;
+ 		mc_req_size = HAWAII_MC_UCODE_SIZE * 4;
++		mc2_req_size = HAWAII_MC2_UCODE_SIZE * 4;
+ 		sdma_req_size = CIK_SDMA_UCODE_SIZE * 4;
+ 		smc_req_size = ALIGN(HAWAII_SMC_UCODE_SIZE, 4);
+ 		break;
+@@ -1903,16 +1907,22 @@ static int cik_init_microcode(struct radeon_device *rdev)
+ 
+ 	/* No SMC, MC ucode on APUs */
+ 	if (!(rdev->flags & RADEON_IS_IGP)) {
+-		snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", chip_name);
++		snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc2.bin", chip_name);
+ 		err = request_firmware(&rdev->mc_fw, fw_name, rdev->dev);
+-		if (err)
+-			goto out;
+-		if (rdev->mc_fw->size != mc_req_size) {
++		if (err) {
++			snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", chip_name);
++			err = request_firmware(&rdev->mc_fw, fw_name, rdev->dev);
++			if (err)
++				goto out;
++		}
++		if ((rdev->mc_fw->size != mc_req_size) &&
++		    (rdev->mc_fw->size != mc2_req_size)){
+ 			printk(KERN_ERR
+ 			       "cik_mc: Bogus length %zu in firmware \"%s\"\n",
+ 			       rdev->mc_fw->size, fw_name);
+ 			err = -EINVAL;
+ 		}
++		DRM_INFO("%s: %zu bytes\n", fw_name, rdev->mc_fw->size);
+ 
+ 		snprintf(fw_name, sizeof(fw_name), "radeon/%s_smc.bin", chip_name);
+ 		err = request_firmware(&rdev->smc_fw, fw_name, rdev->dev);
+@@ -6662,6 +6672,19 @@ static void cik_disable_interrupt_state(struct radeon_device *rdev)
+ 		WREG32(LB_INTERRUPT_MASK + EVERGREEN_CRTC4_REGISTER_OFFSET, 0);
+ 		WREG32(LB_INTERRUPT_MASK + EVERGREEN_CRTC5_REGISTER_OFFSET, 0);
+ 	}
++	/* pflip */
++	if (rdev->num_crtc >= 2) {
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
++	}
++	if (rdev->num_crtc >= 4) {
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET, 0);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET, 0);
++	}
++	if (rdev->num_crtc >= 6) {
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, 0);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, 0);
++	}
+ 
+ 	/* dac hotplug */
+ 	WREG32(DAC_AUTODETECT_INT_CONTROL, 0);
+@@ -7018,6 +7041,25 @@ int cik_irq_set(struct radeon_device *rdev)
+ 		WREG32(LB_INTERRUPT_MASK + EVERGREEN_CRTC5_REGISTER_OFFSET, crtc6);
+ 	}
+ 
++	if (rdev->num_crtc >= 2) {
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
++	}
++	if (rdev->num_crtc >= 4) {
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
++	}
++	if (rdev->num_crtc >= 6) {
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
++	}
++
+ 	WREG32(DC_HPD1_INT_CONTROL, hpd1);
+ 	WREG32(DC_HPD2_INT_CONTROL, hpd2);
+ 	WREG32(DC_HPD3_INT_CONTROL, hpd3);
+@@ -7054,6 +7096,29 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
+ 	rdev->irq.stat_regs.cik.disp_int_cont5 = RREG32(DISP_INTERRUPT_STATUS_CONTINUE5);
+ 	rdev->irq.stat_regs.cik.disp_int_cont6 = RREG32(DISP_INTERRUPT_STATUS_CONTINUE6);
+ 
++	rdev->irq.stat_regs.cik.d1grph_int = RREG32(GRPH_INT_STATUS +
++		EVERGREEN_CRTC0_REGISTER_OFFSET);
++	rdev->irq.stat_regs.cik.d2grph_int = RREG32(GRPH_INT_STATUS +
++		EVERGREEN_CRTC1_REGISTER_OFFSET);
++	if (rdev->num_crtc >= 4) {
++		rdev->irq.stat_regs.cik.d3grph_int = RREG32(GRPH_INT_STATUS +
++			EVERGREEN_CRTC2_REGISTER_OFFSET);
++		rdev->irq.stat_regs.cik.d4grph_int = RREG32(GRPH_INT_STATUS +
++			EVERGREEN_CRTC3_REGISTER_OFFSET);
++	}
++	if (rdev->num_crtc >= 6) {
++		rdev->irq.stat_regs.cik.d5grph_int = RREG32(GRPH_INT_STATUS +
++			EVERGREEN_CRTC4_REGISTER_OFFSET);
++		rdev->irq.stat_regs.cik.d6grph_int = RREG32(GRPH_INT_STATUS +
++			EVERGREEN_CRTC5_REGISTER_OFFSET);
++	}
++
++	if (rdev->irq.stat_regs.cik.d1grph_int & GRPH_PFLIP_INT_OCCURRED)
++		WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC0_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_CLEAR);
++	if (rdev->irq.stat_regs.cik.d2grph_int & GRPH_PFLIP_INT_OCCURRED)
++		WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC1_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_CLEAR);
+ 	if (rdev->irq.stat_regs.cik.disp_int & LB_D1_VBLANK_INTERRUPT)
+ 		WREG32(LB_VBLANK_STATUS + EVERGREEN_CRTC0_REGISTER_OFFSET, VBLANK_ACK);
+ 	if (rdev->irq.stat_regs.cik.disp_int & LB_D1_VLINE_INTERRUPT)
+@@ -7064,6 +7129,12 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
+ 		WREG32(LB_VLINE_STATUS + EVERGREEN_CRTC1_REGISTER_OFFSET, VLINE_ACK);
+ 
+ 	if (rdev->num_crtc >= 4) {
++		if (rdev->irq.stat_regs.cik.d3grph_int & GRPH_PFLIP_INT_OCCURRED)
++			WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC2_REGISTER_OFFSET,
++			       GRPH_PFLIP_INT_CLEAR);
++		if (rdev->irq.stat_regs.cik.d4grph_int & GRPH_PFLIP_INT_OCCURRED)
++			WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC3_REGISTER_OFFSET,
++			       GRPH_PFLIP_INT_CLEAR);
+ 		if (rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT)
+ 			WREG32(LB_VBLANK_STATUS + EVERGREEN_CRTC2_REGISTER_OFFSET, VBLANK_ACK);
+ 		if (rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VLINE_INTERRUPT)
+@@ -7075,6 +7146,12 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
+ 	}
+ 
+ 	if (rdev->num_crtc >= 6) {
++		if (rdev->irq.stat_regs.cik.d5grph_int & GRPH_PFLIP_INT_OCCURRED)
++			WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC4_REGISTER_OFFSET,
++			       GRPH_PFLIP_INT_CLEAR);
++		if (rdev->irq.stat_regs.cik.d6grph_int & GRPH_PFLIP_INT_OCCURRED)
++			WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC5_REGISTER_OFFSET,
++			       GRPH_PFLIP_INT_CLEAR);
+ 		if (rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT)
+ 			WREG32(LB_VBLANK_STATUS + EVERGREEN_CRTC4_REGISTER_OFFSET, VBLANK_ACK);
+ 		if (rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VLINE_INTERRUPT)
+@@ -7426,6 +7503,15 @@ restart_ih:
+ 				break;
+ 			}
+ 			break;
++		case 8: /* D1 page flip */
++		case 10: /* D2 page flip */
++		case 12: /* D3 page flip */
++		case 14: /* D4 page flip */
++		case 16: /* D5 page flip */
++		case 18: /* D6 page flip */
++			DRM_DEBUG("IH: D%d flip\n", ((src_id - 8) >> 1) + 1);
++			radeon_crtc_handle_flip(rdev, (src_id - 8) >> 1);
++			break;
+ 		case 42: /* HPD hotplug */
+ 			switch (src_data) {
+ 			case 0:
+diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
+index 94626ea90fa5..aac8f487e6df 100644
+--- a/drivers/gpu/drm/radeon/cik_sdma.c
++++ b/drivers/gpu/drm/radeon/cik_sdma.c
+@@ -599,7 +599,7 @@ int cik_sdma_ring_test(struct radeon_device *rdev,
+ 	tmp = 0xCAFEDEAD;
+ 	writel(tmp, ptr);
+ 
+-	r = radeon_ring_lock(rdev, ring, 4);
++	r = radeon_ring_lock(rdev, ring, 5);
+ 	if (r) {
+ 		DRM_ERROR("radeon: dma failed to lock ring %d (%d).\n", ring->idx, r);
+ 		return r;
+diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
+index 98bae9d7b74d..d1b2c71b192a 100644
+--- a/drivers/gpu/drm/radeon/cikd.h
++++ b/drivers/gpu/drm/radeon/cikd.h
+@@ -882,6 +882,15 @@
+ #       define DC_HPD6_RX_INTERRUPT                     (1 << 18)
+ #define DISP_INTERRUPT_STATUS_CONTINUE6                 0x6780
+ 
++/* 0x6858, 0x7458, 0x10058, 0x10c58, 0x11858, 0x12458 */
++#define GRPH_INT_STATUS                                 0x6858
++#       define GRPH_PFLIP_INT_OCCURRED                  (1 << 0)
++#       define GRPH_PFLIP_INT_CLEAR                     (1 << 8)
++/* 0x685c, 0x745c, 0x1005c, 0x10c5c, 0x1185c, 0x1245c */
++#define GRPH_INT_CONTROL                                0x685c
++#       define GRPH_PFLIP_INT_MASK                      (1 << 0)
++#       define GRPH_PFLIP_INT_TYPE                      (1 << 8)
++
+ #define	DAC_AUTODETECT_INT_CONTROL			0x67c8
+ 
+ #define DC_HPD1_INT_STATUS                              0x601c
+diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
+index 94e858751994..0a65dc7e93e7 100644
+--- a/drivers/gpu/drm/radeon/dce6_afmt.c
++++ b/drivers/gpu/drm/radeon/dce6_afmt.c
+@@ -309,11 +309,17 @@ int dce6_audio_init(struct radeon_device *rdev)
+ 
+ 	rdev->audio.enabled = true;
+ 
+-	if (ASIC_IS_DCE8(rdev))
++	if (ASIC_IS_DCE81(rdev)) /* KV: 4 streams, 7 endpoints */
++		rdev->audio.num_pins = 7;
++	else if (ASIC_IS_DCE83(rdev)) /* KB: 2 streams, 3 endpoints */
++		rdev->audio.num_pins = 3;
++	else if (ASIC_IS_DCE8(rdev)) /* BN/HW: 6 streams, 7 endpoints */
++		rdev->audio.num_pins = 7;
++	else if (ASIC_IS_DCE61(rdev)) /* TN: 4 streams, 6 endpoints */
+ 		rdev->audio.num_pins = 6;
+-	else if (ASIC_IS_DCE61(rdev))
+-		rdev->audio.num_pins = 4;
+-	else
++	else if (ASIC_IS_DCE64(rdev)) /* OL: 2 streams, 2 endpoints */
++		rdev->audio.num_pins = 2;
++	else /* SI: 6 streams, 6 endpoints */
+ 		rdev->audio.num_pins = 6;
+ 
+ 	for (i = 0; i < rdev->audio.num_pins; i++) {
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index 27b0ff16082e..971d9339ce80 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -4375,7 +4375,6 @@ int evergreen_irq_set(struct radeon_device *rdev)
+ 	u32 crtc1 = 0, crtc2 = 0, crtc3 = 0, crtc4 = 0, crtc5 = 0, crtc6 = 0;
+ 	u32 hpd1, hpd2, hpd3, hpd4, hpd5, hpd6;
+ 	u32 grbm_int_cntl = 0;
+-	u32 grph1 = 0, grph2 = 0, grph3 = 0, grph4 = 0, grph5 = 0, grph6 = 0;
+ 	u32 afmt1 = 0, afmt2 = 0, afmt3 = 0, afmt4 = 0, afmt5 = 0, afmt6 = 0;
+ 	u32 dma_cntl, dma_cntl1 = 0;
+ 	u32 thermal_int = 0;
+@@ -4558,15 +4557,21 @@ int evergreen_irq_set(struct radeon_device *rdev)
+ 		WREG32(INT_MASK + EVERGREEN_CRTC5_REGISTER_OFFSET, crtc6);
+ 	}
+ 
+-	WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET, grph1);
+-	WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET, grph2);
++	WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET,
++	       GRPH_PFLIP_INT_MASK);
++	WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET,
++	       GRPH_PFLIP_INT_MASK);
+ 	if (rdev->num_crtc >= 4) {
+-		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET, grph3);
+-		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET, grph4);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
+ 	}
+ 	if (rdev->num_crtc >= 6) {
+-		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, grph5);
+-		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, grph6);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
+ 	}
+ 
+ 	WREG32(DC_HPD1_INT_CONTROL, hpd1);
+@@ -4955,6 +4960,15 @@ restart_ih:
+ 				break;
+ 			}
+ 			break;
++		case 8: /* D1 page flip */
++		case 10: /* D2 page flip */
++		case 12: /* D3 page flip */
++		case 14: /* D4 page flip */
++		case 16: /* D5 page flip */
++		case 18: /* D6 page flip */
++			DRM_DEBUG("IH: D%d flip\n", ((src_id - 8) >> 1) + 1);
++			radeon_crtc_handle_flip(rdev, (src_id - 8) >> 1);
++			break;
+ 		case 42: /* HPD hotplug */
+ 			switch (src_data) {
+ 			case 0:
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index 647ef4079217..f28ab840cc23 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -3509,7 +3509,6 @@ int r600_irq_set(struct radeon_device *rdev)
+ 	u32 hpd1, hpd2, hpd3, hpd4 = 0, hpd5 = 0, hpd6 = 0;
+ 	u32 grbm_int_cntl = 0;
+ 	u32 hdmi0, hdmi1;
+-	u32 d1grph = 0, d2grph = 0;
+ 	u32 dma_cntl;
+ 	u32 thermal_int = 0;
+ 
+@@ -3618,8 +3617,8 @@ int r600_irq_set(struct radeon_device *rdev)
+ 	WREG32(CP_INT_CNTL, cp_int_cntl);
+ 	WREG32(DMA_CNTL, dma_cntl);
+ 	WREG32(DxMODE_INT_MASK, mode_int);
+-	WREG32(D1GRPH_INTERRUPT_CONTROL, d1grph);
+-	WREG32(D2GRPH_INTERRUPT_CONTROL, d2grph);
++	WREG32(D1GRPH_INTERRUPT_CONTROL, DxGRPH_PFLIP_INT_MASK);
++	WREG32(D2GRPH_INTERRUPT_CONTROL, DxGRPH_PFLIP_INT_MASK);
+ 	WREG32(GRBM_INT_CNTL, grbm_int_cntl);
+ 	if (ASIC_IS_DCE3(rdev)) {
+ 		WREG32(DC_HPD1_INT_CONTROL, hpd1);
+@@ -3922,6 +3921,14 @@ restart_ih:
+ 				break;
+ 			}
+ 			break;
++		case 9: /* D1 pflip */
++			DRM_DEBUG("IH: D1 flip\n");
++			radeon_crtc_handle_flip(rdev, 0);
++			break;
++		case 11: /* D2 pflip */
++			DRM_DEBUG("IH: D2 flip\n");
++			radeon_crtc_handle_flip(rdev, 1);
++			break;
+ 		case 19: /* HPD/DAC hotplug */
+ 			switch (src_data) {
+ 			case 0:
+diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
+index e4cc9b314ce9..813db8de52b7 100644
+--- a/drivers/gpu/drm/radeon/r600_dpm.c
++++ b/drivers/gpu/drm/radeon/r600_dpm.c
+@@ -158,16 +158,18 @@ u32 r600_dpm_get_vblank_time(struct radeon_device *rdev)
+ 	u32 line_time_us, vblank_lines;
+ 	u32 vblank_time_us = 0xffffffff; /* if the displays are off, vblank time is max */
+ 
+-	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+-		radeon_crtc = to_radeon_crtc(crtc);
+-		if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
+-			line_time_us = (radeon_crtc->hw_mode.crtc_htotal * 1000) /
+-				radeon_crtc->hw_mode.clock;
+-			vblank_lines = radeon_crtc->hw_mode.crtc_vblank_end -
+-				radeon_crtc->hw_mode.crtc_vdisplay +
+-				(radeon_crtc->v_border * 2);
+-			vblank_time_us = vblank_lines * line_time_us;
+-			break;
++	if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
++		list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
++			radeon_crtc = to_radeon_crtc(crtc);
++			if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
++				line_time_us = (radeon_crtc->hw_mode.crtc_htotal * 1000) /
++					radeon_crtc->hw_mode.clock;
++				vblank_lines = radeon_crtc->hw_mode.crtc_vblank_end -
++					radeon_crtc->hw_mode.crtc_vdisplay +
++					(radeon_crtc->v_border * 2);
++				vblank_time_us = vblank_lines * line_time_us;
++				break;
++			}
+ 		}
+ 	}
+ 
+@@ -181,14 +183,15 @@ u32 r600_dpm_get_vrefresh(struct radeon_device *rdev)
+ 	struct radeon_crtc *radeon_crtc;
+ 	u32 vrefresh = 0;
+ 
+-	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+-		radeon_crtc = to_radeon_crtc(crtc);
+-		if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
+-			vrefresh = radeon_crtc->hw_mode.vrefresh;
+-			break;
++	if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
++		list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
++			radeon_crtc = to_radeon_crtc(crtc);
++			if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
++				vrefresh = radeon_crtc->hw_mode.vrefresh;
++				break;
++			}
+ 		}
+ 	}
+-
+ 	return vrefresh;
+ }
+ 
+diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
+index e887d027b6d0..08e86f90c9a4 100644
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -733,6 +733,12 @@ struct cik_irq_stat_regs {
+ 	u32 disp_int_cont4;
+ 	u32 disp_int_cont5;
+ 	u32 disp_int_cont6;
++	u32 d1grph_int;
++	u32 d2grph_int;
++	u32 d3grph_int;
++	u32 d4grph_int;
++	u32 d5grph_int;
++	u32 d6grph_int;
+ };
+ 
+ union radeon_irq_stat_regs {
+@@ -742,7 +748,7 @@ union radeon_irq_stat_regs {
+ 	struct cik_irq_stat_regs cik;
+ };
+ 
+-#define RADEON_MAX_HPD_PINS 6
++#define RADEON_MAX_HPD_PINS 7
+ #define RADEON_MAX_CRTCS 6
+ #define RADEON_MAX_AFMT_BLOCKS 7
+ 
+@@ -2242,6 +2248,7 @@ struct radeon_device {
+ 	bool have_disp_power_ref;
+ };
+ 
++bool radeon_is_px(struct drm_device *dev);
+ int radeon_device_init(struct radeon_device *rdev,
+ 		       struct drm_device *ddev,
+ 		       struct pci_dev *pdev,
+@@ -2552,6 +2559,9 @@ void r100_pll_errata_after_index(struct radeon_device *rdev);
+ #define ASIC_IS_DCE64(rdev) ((rdev->family == CHIP_OLAND))
+ #define ASIC_IS_NODCE(rdev) ((rdev->family == CHIP_HAINAN))
+ #define ASIC_IS_DCE8(rdev) ((rdev->family >= CHIP_BONAIRE))
++#define ASIC_IS_DCE81(rdev) ((rdev->family == CHIP_KAVERI))
++#define ASIC_IS_DCE82(rdev) ((rdev->family == CHIP_BONAIRE))
++#define ASIC_IS_DCE83(rdev) ((rdev->family == CHIP_KABINI))
+ 
+ #define ASIC_IS_LOMBOK(rdev) ((rdev->ddev->pdev->device == 0x6849) || \
+ 			      (rdev->ddev->pdev->device == 0x6850) || \
+diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+index fa9a9c02751e..a9fb0d016d38 100644
+--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
++++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+@@ -59,7 +59,7 @@ struct atpx_mux {
+ 	u16 mux;
+ } __packed;
+ 
+-bool radeon_is_px(void) {
++bool radeon_has_atpx(void) {
+ 	return radeon_atpx_priv.atpx_detected;
+ }
+ 
+@@ -528,6 +528,13 @@ static bool radeon_atpx_detect(void)
+ 		has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
+ 	}
+ 
++	/* some newer PX laptops mark the dGPU as a non-VGA display device */
++	while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
++		vga_count++;
++
++		has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
++	}
++
+ 	if (has_atpx && vga_count == 2) {
+ 		acpi_get_name(radeon_atpx_priv.atpx.handle, ACPI_FULL_PATHNAME, &buffer);
+ 		printk(KERN_INFO "VGA switcheroo: detected switching method %s handle\n",
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index 044bc98fb459..7f370b309590 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -102,11 +102,14 @@ static const char radeon_family_name[][16] = {
+ 	"LAST",
+ };
+ 
+-#if defined(CONFIG_VGA_SWITCHEROO)
+-bool radeon_is_px(void);
+-#else
+-static inline bool radeon_is_px(void) { return false; }
+-#endif
++bool radeon_is_px(struct drm_device *dev)
++{
++	struct radeon_device *rdev = dev->dev_private;
++
++	if (rdev->flags & RADEON_IS_PX)
++		return true;
++	return false;
++}
+ 
+ /**
+  * radeon_program_register_sequence - program an array of registers.
+@@ -1082,7 +1085,7 @@ static void radeon_switcheroo_set_state(struct pci_dev *pdev, enum vga_switchero
+ {
+ 	struct drm_device *dev = pci_get_drvdata(pdev);
+ 
+-	if (radeon_is_px() && state == VGA_SWITCHEROO_OFF)
++	if (radeon_is_px(dev) && state == VGA_SWITCHEROO_OFF)
+ 		return;
+ 
+ 	if (state == VGA_SWITCHEROO_ON) {
+@@ -1303,9 +1306,7 @@ int radeon_device_init(struct radeon_device *rdev,
+ 	 * ignore it */
+ 	vga_client_register(rdev->pdev, rdev, NULL, radeon_vga_set_decode);
+ 
+-	if (radeon_runtime_pm == 1)
+-		runtime = true;
+-	if ((radeon_runtime_pm == -1) && radeon_is_px())
++	if (rdev->flags & RADEON_IS_PX)
+ 		runtime = true;
+ 	vga_switcheroo_register_client(rdev->pdev, &radeon_switcheroo_ops, runtime);
+ 	if (runtime)
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 6e6f82c53fef..df6d0079d0af 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -282,6 +282,10 @@ void radeon_crtc_handle_flip(struct radeon_device *rdev, int crtc_id)
+ 	u32 update_pending;
+ 	int vpos, hpos;
+ 
++	/* can happen during initialization */
++	if (radeon_crtc == NULL)
++		return;
++
+ 	spin_lock_irqsave(&rdev->ddev->event_lock, flags);
+ 	work = radeon_crtc->unpin_work;
+ 	if (work == NULL ||
+diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
+index f633c2782170..9c0056f0a68a 100644
+--- a/drivers/gpu/drm/radeon/radeon_drv.c
++++ b/drivers/gpu/drm/radeon/radeon_drv.c
+@@ -113,6 +113,7 @@ extern int radeon_get_crtc_scanoutpos(struct drm_device *dev, int crtc,
+ 				      unsigned int flags,
+ 				      int *vpos, int *hpos, ktime_t *stime,
+ 				      ktime_t *etime);
++extern bool radeon_is_px(struct drm_device *dev);
+ extern const struct drm_ioctl_desc radeon_ioctls_kms[];
+ extern int radeon_max_kms_ioctl;
+ int radeon_mmap(struct file *filp, struct vm_area_struct *vma);
+@@ -142,11 +143,9 @@ void radeon_debugfs_cleanup(struct drm_minor *minor);
+ #if defined(CONFIG_VGA_SWITCHEROO)
+ void radeon_register_atpx_handler(void);
+ void radeon_unregister_atpx_handler(void);
+-bool radeon_is_px(void);
+ #else
+ static inline void radeon_register_atpx_handler(void) {}
+ static inline void radeon_unregister_atpx_handler(void) {}
+-static inline bool radeon_is_px(void) { return false; }
+ #endif
+ 
+ int radeon_no_wb;
+@@ -403,12 +402,7 @@ static int radeon_pmops_runtime_suspend(struct device *dev)
+ 	struct drm_device *drm_dev = pci_get_drvdata(pdev);
+ 	int ret;
+ 
+-	if (radeon_runtime_pm == 0) {
+-		pm_runtime_forbid(dev);
+-		return -EBUSY;
+-	}
+-
+-	if (radeon_runtime_pm == -1 && !radeon_is_px()) {
++	if (!radeon_is_px(drm_dev)) {
+ 		pm_runtime_forbid(dev);
+ 		return -EBUSY;
+ 	}
+@@ -432,10 +426,7 @@ static int radeon_pmops_runtime_resume(struct device *dev)
+ 	struct drm_device *drm_dev = pci_get_drvdata(pdev);
+ 	int ret;
+ 
+-	if (radeon_runtime_pm == 0)
+-		return -EINVAL;
+-
+-	if (radeon_runtime_pm == -1 && !radeon_is_px())
++	if (!radeon_is_px(drm_dev))
+ 		return -EINVAL;
+ 
+ 	drm_dev->switch_power_state = DRM_SWITCH_POWER_CHANGING;
+@@ -460,14 +451,7 @@ static int radeon_pmops_runtime_idle(struct device *dev)
+ 	struct drm_device *drm_dev = pci_get_drvdata(pdev);
+ 	struct drm_crtc *crtc;
+ 
+-	if (radeon_runtime_pm == 0) {
+-		pm_runtime_forbid(dev);
+-		return -EBUSY;
+-	}
+-
+-	/* are we PX enabled? */
+-	if (radeon_runtime_pm == -1 && !radeon_is_px()) {
+-		DRM_DEBUG_DRIVER("failing to power off - not px\n");
++	if (!radeon_is_px(drm_dev)) {
+ 		pm_runtime_forbid(dev);
+ 		return -EBUSY;
+ 	}
+diff --git a/drivers/gpu/drm/radeon/radeon_family.h b/drivers/gpu/drm/radeon/radeon_family.h
+index 614ad549297f..9da5da4ffd17 100644
+--- a/drivers/gpu/drm/radeon/radeon_family.h
++++ b/drivers/gpu/drm/radeon/radeon_family.h
+@@ -115,6 +115,7 @@ enum radeon_chip_flags {
+ 	RADEON_NEW_MEMMAP = 0x00400000UL,
+ 	RADEON_IS_PCI = 0x00800000UL,
+ 	RADEON_IS_IGPGART = 0x01000000UL,
++	RADEON_IS_PX = 0x02000000UL,
+ };
+ 
+ #endif
+diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
+index 66ed3ea71440..ea34a31d3bc8 100644
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -35,9 +35,9 @@
+ #include <linux/pm_runtime.h>
+ 
+ #if defined(CONFIG_VGA_SWITCHEROO)
+-bool radeon_is_px(void);
++bool radeon_has_atpx(void);
+ #else
+-static inline bool radeon_is_px(void) { return false; }
++static inline bool radeon_has_atpx(void) { return false; }
+ #endif
+ 
+ /**
+@@ -107,6 +107,11 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
+ 		flags |= RADEON_IS_PCI;
+ 	}
+ 
++	if ((radeon_runtime_pm != 0) &&
++	    radeon_has_atpx() &&
++	    ((flags & RADEON_IS_IGP) == 0))
++		flags |= RADEON_IS_PX;
++
+ 	/* radeon_device_init should report only fatal error
+ 	 * like memory allocation failure or iomapping failure,
+ 	 * or memory manager initialization failure, it must
+@@ -137,8 +142,7 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
+ 				"Error during ACPI methods call\n");
+ 	}
+ 
+-	if ((radeon_runtime_pm == 1) ||
+-	    ((radeon_runtime_pm == -1) && radeon_is_px())) {
++	if (radeon_is_px(dev)) {
+ 		pm_runtime_use_autosuspend(dev->dev);
+ 		pm_runtime_set_autosuspend_delay(dev->dev, 5000);
+ 		pm_runtime_set_active(dev->dev);
+diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
+index 8e8153e471c2..a957024eae24 100644
+--- a/drivers/gpu/drm/radeon/radeon_pm.c
++++ b/drivers/gpu/drm/radeon/radeon_pm.c
+@@ -603,7 +603,6 @@ static const struct attribute_group *hwmon_groups[] = {
+ static int radeon_hwmon_init(struct radeon_device *rdev)
+ {
+ 	int err = 0;
+-	struct device *hwmon_dev;
+ 
+ 	switch (rdev->pm.int_thermal_type) {
+ 	case THERMAL_TYPE_RV6XX:
+@@ -616,11 +615,11 @@ static int radeon_hwmon_init(struct radeon_device *rdev)
+ 	case THERMAL_TYPE_KV:
+ 		if (rdev->asic->pm.get_temperature == NULL)
+ 			return err;
+-		hwmon_dev = hwmon_device_register_with_groups(rdev->dev,
+-							      "radeon", rdev,
+-							      hwmon_groups);
+-		if (IS_ERR(hwmon_dev)) {
+-			err = PTR_ERR(hwmon_dev);
++		rdev->pm.int_hwmon_dev = hwmon_device_register_with_groups(rdev->dev,
++									   "radeon", rdev,
++									   hwmon_groups);
++		if (IS_ERR(rdev->pm.int_hwmon_dev)) {
++			err = PTR_ERR(rdev->pm.int_hwmon_dev);
+ 			dev_err(rdev->dev,
+ 				"Unable to register hwmon device: %d\n", err);
+ 		}
+@@ -632,6 +631,12 @@ static int radeon_hwmon_init(struct radeon_device *rdev)
+ 	return err;
+ }
+ 
++static void radeon_hwmon_fini(struct radeon_device *rdev)
++{
++	if (rdev->pm.int_hwmon_dev)
++		hwmon_device_unregister(rdev->pm.int_hwmon_dev);
++}
++
+ static void radeon_dpm_thermal_work_handler(struct work_struct *work)
+ {
+ 	struct radeon_device *rdev =
+@@ -1235,6 +1240,7 @@ int radeon_pm_init(struct radeon_device *rdev)
+ 	case CHIP_RV670:
+ 	case CHIP_RS780:
+ 	case CHIP_RS880:
++	case CHIP_RV770:
+ 	case CHIP_BARTS:
+ 	case CHIP_TURKS:
+ 	case CHIP_CAICOS:
+@@ -1251,7 +1257,6 @@ int radeon_pm_init(struct radeon_device *rdev)
+ 		else
+ 			rdev->pm.pm_method = PM_METHOD_PROFILE;
+ 		break;
+-	case CHIP_RV770:
+ 	case CHIP_RV730:
+ 	case CHIP_RV710:
+ 	case CHIP_RV740:
+@@ -1331,6 +1336,8 @@ static void radeon_pm_fini_old(struct radeon_device *rdev)
+ 		device_remove_file(rdev->dev, &dev_attr_power_method);
+ 	}
+ 
++	radeon_hwmon_fini(rdev);
++
+ 	if (rdev->pm.power_state)
+ 		kfree(rdev->pm.power_state);
+ }
+@@ -1350,6 +1357,8 @@ static void radeon_pm_fini_dpm(struct radeon_device *rdev)
+ 	}
+ 	radeon_dpm_fini(rdev);
+ 
++	radeon_hwmon_fini(rdev);
++
+ 	if (rdev->pm.power_state)
+ 		kfree(rdev->pm.power_state);
+ }
+@@ -1375,12 +1384,14 @@ static void radeon_pm_compute_clocks_old(struct radeon_device *rdev)
+ 
+ 	rdev->pm.active_crtcs = 0;
+ 	rdev->pm.active_crtc_count = 0;
+-	list_for_each_entry(crtc,
+-		&ddev->mode_config.crtc_list, head) {
+-		radeon_crtc = to_radeon_crtc(crtc);
+-		if (radeon_crtc->enabled) {
+-			rdev->pm.active_crtcs |= (1 << radeon_crtc->crtc_id);
+-			rdev->pm.active_crtc_count++;
++	if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
++		list_for_each_entry(crtc,
++				    &ddev->mode_config.crtc_list, head) {
++			radeon_crtc = to_radeon_crtc(crtc);
++			if (radeon_crtc->enabled) {
++				rdev->pm.active_crtcs |= (1 << radeon_crtc->crtc_id);
++				rdev->pm.active_crtc_count++;
++			}
+ 		}
+ 	}
+ 
+@@ -1447,12 +1458,14 @@ static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev)
+ 	/* update active crtc counts */
+ 	rdev->pm.dpm.new_active_crtcs = 0;
+ 	rdev->pm.dpm.new_active_crtc_count = 0;
+-	list_for_each_entry(crtc,
+-		&ddev->mode_config.crtc_list, head) {
+-		radeon_crtc = to_radeon_crtc(crtc);
+-		if (crtc->enabled) {
+-			rdev->pm.dpm.new_active_crtcs |= (1 << radeon_crtc->crtc_id);
+-			rdev->pm.dpm.new_active_crtc_count++;
++	if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
++		list_for_each_entry(crtc,
++				    &ddev->mode_config.crtc_list, head) {
++			radeon_crtc = to_radeon_crtc(crtc);
++			if (crtc->enabled) {
++				rdev->pm.dpm.new_active_crtcs |= (1 << radeon_crtc->crtc_id);
++				rdev->pm.dpm.new_active_crtc_count++;
++			}
+ 		}
+ 	}
+ 
+diff --git a/drivers/gpu/drm/radeon/radeon_ucode.h b/drivers/gpu/drm/radeon/radeon_ucode.h
+index a77cd274dfc3..58d12938c0b8 100644
+--- a/drivers/gpu/drm/radeon/radeon_ucode.h
++++ b/drivers/gpu/drm/radeon/radeon_ucode.h
+@@ -57,9 +57,14 @@
+ #define BTC_MC_UCODE_SIZE            6024
+ #define CAYMAN_MC_UCODE_SIZE         6037
+ #define SI_MC_UCODE_SIZE             7769
++#define TAHITI_MC_UCODE_SIZE         7808
++#define PITCAIRN_MC_UCODE_SIZE       7775
++#define VERDE_MC_UCODE_SIZE          7875
+ #define OLAND_MC_UCODE_SIZE          7863
+-#define CIK_MC_UCODE_SIZE            7866
++#define BONAIRE_MC_UCODE_SIZE        7866
++#define BONAIRE_MC2_UCODE_SIZE       7948
+ #define HAWAII_MC_UCODE_SIZE         7933
++#define HAWAII_MC2_UCODE_SIZE        8091
+ 
+ /* SDMA */
+ #define CIK_SDMA_UCODE_SIZE          1050
+diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
+index 3e6804b2b2ef..414e07928693 100644
+--- a/drivers/gpu/drm/radeon/radeon_uvd.c
++++ b/drivers/gpu/drm/radeon/radeon_uvd.c
+@@ -465,6 +465,10 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
+ 	cmd = radeon_get_ib_value(p, p->idx) >> 1;
+ 
+ 	if (cmd < 0x4) {
++		if (end <= start) {
++			DRM_ERROR("invalid reloc offset %X!\n", offset);
++			return -EINVAL;
++		}
+ 		if ((end - start) < buf_sizes[cmd]) {
+ 			DRM_ERROR("buffer (%d) to small (%d / %d)!\n", cmd,
+ 				  (unsigned)(end - start), buf_sizes[cmd]);
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 9a124d0608b3..cb7508dc94f3 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -39,30 +39,35 @@ MODULE_FIRMWARE("radeon/TAHITI_pfp.bin");
+ MODULE_FIRMWARE("radeon/TAHITI_me.bin");
+ MODULE_FIRMWARE("radeon/TAHITI_ce.bin");
+ MODULE_FIRMWARE("radeon/TAHITI_mc.bin");
++MODULE_FIRMWARE("radeon/TAHITI_mc2.bin");
+ MODULE_FIRMWARE("radeon/TAHITI_rlc.bin");
+ MODULE_FIRMWARE("radeon/TAHITI_smc.bin");
+ MODULE_FIRMWARE("radeon/PITCAIRN_pfp.bin");
+ MODULE_FIRMWARE("radeon/PITCAIRN_me.bin");
+ MODULE_FIRMWARE("radeon/PITCAIRN_ce.bin");
+ MODULE_FIRMWARE("radeon/PITCAIRN_mc.bin");
++MODULE_FIRMWARE("radeon/PITCAIRN_mc2.bin");
+ MODULE_FIRMWARE("radeon/PITCAIRN_rlc.bin");
+ MODULE_FIRMWARE("radeon/PITCAIRN_smc.bin");
+ MODULE_FIRMWARE("radeon/VERDE_pfp.bin");
+ MODULE_FIRMWARE("radeon/VERDE_me.bin");
+ MODULE_FIRMWARE("radeon/VERDE_ce.bin");
+ MODULE_FIRMWARE("radeon/VERDE_mc.bin");
++MODULE_FIRMWARE("radeon/VERDE_mc2.bin");
+ MODULE_FIRMWARE("radeon/VERDE_rlc.bin");
+ MODULE_FIRMWARE("radeon/VERDE_smc.bin");
+ MODULE_FIRMWARE("radeon/OLAND_pfp.bin");
+ MODULE_FIRMWARE("radeon/OLAND_me.bin");
+ MODULE_FIRMWARE("radeon/OLAND_ce.bin");
+ MODULE_FIRMWARE("radeon/OLAND_mc.bin");
++MODULE_FIRMWARE("radeon/OLAND_mc2.bin");
+ MODULE_FIRMWARE("radeon/OLAND_rlc.bin");
+ MODULE_FIRMWARE("radeon/OLAND_smc.bin");
+ MODULE_FIRMWARE("radeon/HAINAN_pfp.bin");
+ MODULE_FIRMWARE("radeon/HAINAN_me.bin");
+ MODULE_FIRMWARE("radeon/HAINAN_ce.bin");
+ MODULE_FIRMWARE("radeon/HAINAN_mc.bin");
++MODULE_FIRMWARE("radeon/HAINAN_mc2.bin");
+ MODULE_FIRMWARE("radeon/HAINAN_rlc.bin");
+ MODULE_FIRMWARE("radeon/HAINAN_smc.bin");
+ 
+@@ -1467,36 +1472,33 @@ int si_mc_load_microcode(struct radeon_device *rdev)
+ 	const __be32 *fw_data;
+ 	u32 running, blackout = 0;
+ 	u32 *io_mc_regs;
+-	int i, ucode_size, regs_size;
++	int i, regs_size, ucode_size;
+ 
+ 	if (!rdev->mc_fw)
+ 		return -EINVAL;
+ 
++	ucode_size = rdev->mc_fw->size / 4;
++
+ 	switch (rdev->family) {
+ 	case CHIP_TAHITI:
+ 		io_mc_regs = (u32 *)&tahiti_io_mc_regs;
+-		ucode_size = SI_MC_UCODE_SIZE;
+ 		regs_size = TAHITI_IO_MC_REGS_SIZE;
+ 		break;
+ 	case CHIP_PITCAIRN:
+ 		io_mc_regs = (u32 *)&pitcairn_io_mc_regs;
+-		ucode_size = SI_MC_UCODE_SIZE;
+ 		regs_size = TAHITI_IO_MC_REGS_SIZE;
+ 		break;
+ 	case CHIP_VERDE:
+ 	default:
+ 		io_mc_regs = (u32 *)&verde_io_mc_regs;
+-		ucode_size = SI_MC_UCODE_SIZE;
+ 		regs_size = TAHITI_IO_MC_REGS_SIZE;
+ 		break;
+ 	case CHIP_OLAND:
+ 		io_mc_regs = (u32 *)&oland_io_mc_regs;
+-		ucode_size = OLAND_MC_UCODE_SIZE;
+ 		regs_size = TAHITI_IO_MC_REGS_SIZE;
+ 		break;
+ 	case CHIP_HAINAN:
+ 		io_mc_regs = (u32 *)&hainan_io_mc_regs;
+-		ucode_size = OLAND_MC_UCODE_SIZE;
+ 		regs_size = TAHITI_IO_MC_REGS_SIZE;
+ 		break;
+ 	}
+@@ -1552,7 +1554,7 @@ static int si_init_microcode(struct radeon_device *rdev)
+ 	const char *chip_name;
+ 	const char *rlc_chip_name;
+ 	size_t pfp_req_size, me_req_size, ce_req_size, rlc_req_size, mc_req_size;
+-	size_t smc_req_size;
++	size_t smc_req_size, mc2_req_size;
+ 	char fw_name[30];
+ 	int err;
+ 
+@@ -1567,6 +1569,7 @@ static int si_init_microcode(struct radeon_device *rdev)
+ 		ce_req_size = SI_CE_UCODE_SIZE * 4;
+ 		rlc_req_size = SI_RLC_UCODE_SIZE * 4;
+ 		mc_req_size = SI_MC_UCODE_SIZE * 4;
++		mc2_req_size = TAHITI_MC_UCODE_SIZE * 4;
+ 		smc_req_size = ALIGN(TAHITI_SMC_UCODE_SIZE, 4);
+ 		break;
+ 	case CHIP_PITCAIRN:
+@@ -1577,6 +1580,7 @@ static int si_init_microcode(struct radeon_device *rdev)
+ 		ce_req_size = SI_CE_UCODE_SIZE * 4;
+ 		rlc_req_size = SI_RLC_UCODE_SIZE * 4;
+ 		mc_req_size = SI_MC_UCODE_SIZE * 4;
++		mc2_req_size = PITCAIRN_MC_UCODE_SIZE * 4;
+ 		smc_req_size = ALIGN(PITCAIRN_SMC_UCODE_SIZE, 4);
+ 		break;
+ 	case CHIP_VERDE:
+@@ -1587,6 +1591,7 @@ static int si_init_microcode(struct radeon_device *rdev)
+ 		ce_req_size = SI_CE_UCODE_SIZE * 4;
+ 		rlc_req_size = SI_RLC_UCODE_SIZE * 4;
+ 		mc_req_size = SI_MC_UCODE_SIZE * 4;
++		mc2_req_size = VERDE_MC_UCODE_SIZE * 4;
+ 		smc_req_size = ALIGN(VERDE_SMC_UCODE_SIZE, 4);
+ 		break;
+ 	case CHIP_OLAND:
+@@ -1596,7 +1601,7 @@ static int si_init_microcode(struct radeon_device *rdev)
+ 		me_req_size = SI_PM4_UCODE_SIZE * 4;
+ 		ce_req_size = SI_CE_UCODE_SIZE * 4;
+ 		rlc_req_size = SI_RLC_UCODE_SIZE * 4;
+-		mc_req_size = OLAND_MC_UCODE_SIZE * 4;
++		mc_req_size = mc2_req_size = OLAND_MC_UCODE_SIZE * 4;
+ 		smc_req_size = ALIGN(OLAND_SMC_UCODE_SIZE, 4);
+ 		break;
+ 	case CHIP_HAINAN:
+@@ -1606,7 +1611,7 @@ static int si_init_microcode(struct radeon_device *rdev)
+ 		me_req_size = SI_PM4_UCODE_SIZE * 4;
+ 		ce_req_size = SI_CE_UCODE_SIZE * 4;
+ 		rlc_req_size = SI_RLC_UCODE_SIZE * 4;
+-		mc_req_size = OLAND_MC_UCODE_SIZE * 4;
++		mc_req_size = mc2_req_size = OLAND_MC_UCODE_SIZE * 4;
+ 		smc_req_size = ALIGN(HAINAN_SMC_UCODE_SIZE, 4);
+ 		break;
+ 	default: BUG();
+@@ -1659,16 +1664,22 @@ static int si_init_microcode(struct radeon_device *rdev)
+ 		err = -EINVAL;
+ 	}
+ 
+-	snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", chip_name);
++	snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc2.bin", chip_name);
+ 	err = request_firmware(&rdev->mc_fw, fw_name, rdev->dev);
+-	if (err)
+-		goto out;
+-	if (rdev->mc_fw->size != mc_req_size) {
++	if (err) {
++		snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", chip_name);
++		err = request_firmware(&rdev->mc_fw, fw_name, rdev->dev);
++		if (err)
++			goto out;
++	}
++	if ((rdev->mc_fw->size != mc_req_size) &&
++	    (rdev->mc_fw->size != mc2_req_size)) {
+ 		printk(KERN_ERR
+ 		       "si_mc: Bogus length %zu in firmware \"%s\"\n",
+ 		       rdev->mc_fw->size, fw_name);
+ 		err = -EINVAL;
+ 	}
++	DRM_INFO("%s: %zu bytes\n", fw_name, rdev->mc_fw->size);
+ 
+ 	snprintf(fw_name, sizeof(fw_name), "radeon/%s_smc.bin", chip_name);
+ 	err = request_firmware(&rdev->smc_fw, fw_name, rdev->dev);
+@@ -5777,7 +5788,6 @@ int si_irq_set(struct radeon_device *rdev)
+ 	u32 crtc1 = 0, crtc2 = 0, crtc3 = 0, crtc4 = 0, crtc5 = 0, crtc6 = 0;
+ 	u32 hpd1 = 0, hpd2 = 0, hpd3 = 0, hpd4 = 0, hpd5 = 0, hpd6 = 0;
+ 	u32 grbm_int_cntl = 0;
+-	u32 grph1 = 0, grph2 = 0, grph3 = 0, grph4 = 0, grph5 = 0, grph6 = 0;
+ 	u32 dma_cntl, dma_cntl1;
+ 	u32 thermal_int = 0;
+ 
+@@ -5916,16 +5926,22 @@ int si_irq_set(struct radeon_device *rdev)
+ 	}
+ 
+ 	if (rdev->num_crtc >= 2) {
+-		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET, grph1);
+-		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET, grph2);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
+ 	}
+ 	if (rdev->num_crtc >= 4) {
+-		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET, grph3);
+-		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET, grph4);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
+ 	}
+ 	if (rdev->num_crtc >= 6) {
+-		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, grph5);
+-		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, grph6);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
++		WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET,
++		       GRPH_PFLIP_INT_MASK);
+ 	}
+ 
+ 	if (!ASIC_IS_NODCE(rdev)) {
+@@ -6289,6 +6305,15 @@ restart_ih:
+ 				break;
+ 			}
+ 			break;
++		case 8: /* D1 page flip */
++		case 10: /* D2 page flip */
++		case 12: /* D3 page flip */
++		case 14: /* D4 page flip */
++		case 16: /* D5 page flip */
++		case 18: /* D6 page flip */
++			DRM_DEBUG("IH: D%d flip\n", ((src_id - 8) >> 1) + 1);
++			radeon_crtc_handle_flip(rdev, (src_id - 8) >> 1);
++			break;
+ 		case 42: /* HPD hotplug */
+ 			switch (src_data) {
+ 			case 0:
+diff --git a/drivers/gpu/drm/radeon/uvd_v1_0.c b/drivers/gpu/drm/radeon/uvd_v1_0.c
+index d4a68af1a279..c310a0aeebb9 100644
+--- a/drivers/gpu/drm/radeon/uvd_v1_0.c
++++ b/drivers/gpu/drm/radeon/uvd_v1_0.c
+@@ -83,7 +83,10 @@ int uvd_v1_0_init(struct radeon_device *rdev)
+ 	int r;
+ 
+ 	/* raise clocks while booting up the VCPU */
+-	radeon_set_uvd_clocks(rdev, 53300, 40000);
++	if (rdev->family < CHIP_RV740)
++		radeon_set_uvd_clocks(rdev, 10000, 10000);
++	else
++		radeon_set_uvd_clocks(rdev, 53300, 40000);
+ 
+ 	r = uvd_v1_0_start(rdev);
+ 	if (r)
+@@ -407,7 +410,10 @@ int uvd_v1_0_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
+ 	struct radeon_fence *fence = NULL;
+ 	int r;
+ 
+-	r = radeon_set_uvd_clocks(rdev, 53300, 40000);
++	if (rdev->family < CHIP_RV740)
++		r = radeon_set_uvd_clocks(rdev, 10000, 10000);
++	else
++		r = radeon_set_uvd_clocks(rdev, 53300, 40000);
+ 	if (r) {
+ 		DRM_ERROR("radeon: failed to raise UVD clocks (%d).\n", r);
+ 		return r;
+diff --git a/drivers/gpu/host1x/hw/intr_hw.c b/drivers/gpu/host1x/hw/intr_hw.c
+index db9017adfe2b..498b37e39058 100644
+--- a/drivers/gpu/host1x/hw/intr_hw.c
++++ b/drivers/gpu/host1x/hw/intr_hw.c
+@@ -47,7 +47,7 @@ static irqreturn_t syncpt_thresh_isr(int irq, void *dev_id)
+ 	unsigned long reg;
+ 	int i, id;
+ 
+-	for (i = 0; i <= BIT_WORD(host->info->nb_pts); i++) {
++	for (i = 0; i < DIV_ROUND_UP(host->info->nb_pts, 32); i++) {
+ 		reg = host1x_sync_readl(host,
+ 			HOST1X_SYNC_SYNCPT_THRESH_CPU0_INT_STATUS(i));
+ 		for_each_set_bit(id, &reg, BITS_PER_LONG) {
+@@ -64,7 +64,7 @@ static void _host1x_intr_disable_all_syncpt_intrs(struct host1x *host)
+ {
+ 	u32 i;
+ 
+-	for (i = 0; i <= BIT_WORD(host->info->nb_pts); ++i) {
++	for (i = 0; i < DIV_ROUND_UP(host->info->nb_pts, 32); ++i) {
+ 		host1x_sync_writel(host, 0xffffffffu,
+ 			HOST1X_SYNC_SYNCPT_THRESH_INT_DISABLE(i));
+ 		host1x_sync_writel(host, 0xffffffffu,
+diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
+index bbb0b0d463f7..15993103c1a2 100644
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -369,12 +369,12 @@ static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
+ 		if (cpu_has_tjmax(c))
+ 			dev_warn(dev, "Unable to read TjMax from CPU %u\n", id);
+ 	} else {
+-		val = (eax >> 16) & 0x7f;
++		val = (eax >> 16) & 0xff;
+ 		/*
+ 		 * If the TjMax is not plausible, an assumption
+ 		 * will be used
+ 		 */
+-		if (val >= 85) {
++		if (val) {
+ 			dev_dbg(dev, "TjMax is %d degrees C\n", val);
+ 			return val * 1000;
+ 		}
+diff --git a/drivers/hwmon/emc1403.c b/drivers/hwmon/emc1403.c
+index 90ec1173b8a1..01723f04fe45 100644
+--- a/drivers/hwmon/emc1403.c
++++ b/drivers/hwmon/emc1403.c
+@@ -163,7 +163,7 @@ static ssize_t store_hyst(struct device *dev,
+ 	if (retval < 0)
+ 		goto fail;
+ 
+-	hyst = val - retval * 1000;
++	hyst = retval * 1000 - val;
+ 	hyst = DIV_ROUND_CLOSEST(hyst, 1000);
+ 	if (hyst < 0 || hyst > 255) {
+ 		retval = -ERANGE;
+@@ -330,7 +330,7 @@ static int emc1403_detect(struct i2c_client *client,
+ 	}
+ 
+ 	id = i2c_smbus_read_byte_data(client, THERMAL_REVISION_REG);
+-	if (id != 0x01)
++	if (id < 0x01 || id > 0x04)
+ 		return -ENODEV;
+ 
+ 	return 0;
+@@ -355,9 +355,9 @@ static int emc1403_probe(struct i2c_client *client,
+ 	if (id->driver_data)
+ 		data->groups[1] = &emc1404_group;
+ 
+-	hwmon_dev = hwmon_device_register_with_groups(&client->dev,
+-						      client->name, data,
+-						      data->groups);
++	hwmon_dev = devm_hwmon_device_register_with_groups(&client->dev,
++							   client->name, data,
++							   data->groups);
+ 	if (IS_ERR(hwmon_dev))
+ 		return PTR_ERR(hwmon_dev);
+ 
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index de17c5593d97..c5eec0290b37 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -110,6 +110,7 @@ config I2C_I801
+ 	    Wellsburg (PCH)
+ 	    Coleto Creek (PCH)
+ 	    Wildcat Point-LP (PCH)
++	    BayTrail (SOC)
+ 
+ 	  This driver can also be built as a module.  If so, the module
+ 	  will be called i2c-i801.
+diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
+index 14c4b30d4ccc..d95b93016b0d 100644
+--- a/drivers/i2c/busses/i2c-designware-core.c
++++ b/drivers/i2c/busses/i2c-designware-core.c
+@@ -417,6 +417,9 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
+ 	 */
+ 	dw_writel(dev, msgs[dev->msg_write_idx].addr | ic_tar, DW_IC_TAR);
+ 
++	/* enforce disabled interrupts (due to HW issues) */
++	i2c_dw_disable_int(dev);
++
+ 	/* Enable the adapter */
+ 	__i2c_dw_enable(dev, true);
+ 
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index 349c2d35e792..899f55937ca6 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -60,6 +60,7 @@
+   Wellsburg (PCH) MS    0x8d7f     32     hard     yes     yes     yes
+   Coleto Creek (PCH)    0x23b0     32     hard     yes     yes     yes
+   Wildcat Point-LP (PCH)   0x9ca2     32     hard     yes     yes     yes
++  BayTrail (SOC)        0x0f12     32     hard     yes     yes     yes
+ 
+   Features supported by this driver:
+   Software PEC                     no
+@@ -161,6 +162,7 @@
+ 				 STATUS_ERROR_FLAGS)
+ 
+ /* Older devices have their ID defined in <linux/pci_ids.h> */
++#define PCI_DEVICE_ID_INTEL_BAYTRAIL_SMBUS	0x0f12
+ #define PCI_DEVICE_ID_INTEL_COUGARPOINT_SMBUS	0x1c22
+ #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS	0x1d22
+ /* Patsburg also has three 'Integrated Device Function' SMBus controllers */
+@@ -822,6 +824,7 @@ static DEFINE_PCI_DEVICE_TABLE(i801_ids) = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_WELLSBURG_SMBUS_MS2) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_COLETOCREEK_SMBUS) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_SMBUS) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BAYTRAIL_SMBUS) },
+ 	{ 0, }
+ };
+ 
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 0282d4d42805..d3c5d6216575 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -561,6 +561,12 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
+ 
+ 	ret = -EINVAL;
+ 	for (i = 0; i < num; i++) {
++		/* This HW can't send STOP after address phase */
++		if (msgs[i].len == 0) {
++			ret = -EOPNOTSUPP;
++			break;
++		}
++
+ 		/*-------------- spin lock -----------------*/
+ 		spin_lock_irqsave(&priv->lock, flags);
+ 
+@@ -625,7 +631,8 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
+ 
+ static u32 rcar_i2c_func(struct i2c_adapter *adap)
+ {
+-	return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
++	/* This HW can't do SMBUS_QUICK and NOSTART */
++	return I2C_FUNC_I2C | (I2C_FUNC_SMBUS_EMUL & ~I2C_FUNC_SMBUS_QUICK);
+ }
+ 
+ static const struct i2c_algorithm rcar_i2c_algo = {
+diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
+index 684d21e71e4a..93ec37649346 100644
+--- a/drivers/i2c/busses/i2c-s3c2410.c
++++ b/drivers/i2c/busses/i2c-s3c2410.c
+@@ -1247,10 +1247,10 @@ static int s3c24xx_i2c_resume(struct device *dev)
+ 	struct platform_device *pdev = to_platform_device(dev);
+ 	struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
+ 
+-	i2c->suspended = 0;
+ 	clk_prepare_enable(i2c->clk);
+ 	s3c24xx_i2c_init(i2c);
+ 	clk_disable_unprepare(i2c->clk);
++	i2c->suspended = 0;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+index df7f1e1157ae..27a91768cc72 100644
+--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+@@ -661,6 +661,7 @@ static int inv_mpu_probe(struct i2c_client *client,
+ {
+ 	struct inv_mpu6050_state *st;
+ 	struct iio_dev *indio_dev;
++	struct inv_mpu6050_platform_data *pdata;
+ 	int result;
+ 
+ 	if (!i2c_check_functionality(client->adapter,
+@@ -673,8 +674,10 @@ static int inv_mpu_probe(struct i2c_client *client,
+ 
+ 	st = iio_priv(indio_dev);
+ 	st->client = client;
+-	st->plat_data = *(struct inv_mpu6050_platform_data
+-				*)dev_get_platdata(&client->dev);
++	pdata = (struct inv_mpu6050_platform_data
++			*)dev_get_platdata(&client->dev);
++	if (pdata)
++		st->plat_data = *pdata;
+ 	/* power is turned on inside check chip type*/
+ 	result = inv_check_and_setup_chip(st, id);
+ 	if (result)
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index f596b413a35b..51766b3bc678 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -28,6 +28,7 @@
+ #include <target/target_core_base.h>
+ #include <target/target_core_fabric.h>
+ #include <target/iscsi/iscsi_transport.h>
++#include <linux/semaphore.h>
+ 
+ #include "isert_proto.h"
+ #include "ib_isert.h"
+@@ -582,11 +583,11 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ 		goto out_conn_dev;
+ 
+ 	mutex_lock(&isert_np->np_accept_mutex);
+-	list_add_tail(&isert_np->np_accept_list, &isert_conn->conn_accept_node);
++	list_add_tail(&isert_conn->conn_accept_node, &isert_np->np_accept_list);
+ 	mutex_unlock(&isert_np->np_accept_mutex);
+ 
+-	pr_debug("isert_connect_request() waking up np_accept_wq: %p\n", np);
+-	wake_up(&isert_np->np_accept_wq);
++	pr_debug("isert_connect_request() up np_sem np: %p\n", np);
++	up(&isert_np->np_sem);
+ 	return 0;
+ 
+ out_conn_dev:
+@@ -2569,7 +2570,7 @@ isert_setup_np(struct iscsi_np *np,
+ 		pr_err("Unable to allocate struct isert_np\n");
+ 		return -ENOMEM;
+ 	}
+-	init_waitqueue_head(&isert_np->np_accept_wq);
++	sema_init(&isert_np->np_sem, 0);
+ 	mutex_init(&isert_np->np_accept_mutex);
+ 	INIT_LIST_HEAD(&isert_np->np_accept_list);
+ 	init_completion(&isert_np->np_login_comp);
+@@ -2618,18 +2619,6 @@ out:
+ }
+ 
+ static int
+-isert_check_accept_queue(struct isert_np *isert_np)
+-{
+-	int empty;
+-
+-	mutex_lock(&isert_np->np_accept_mutex);
+-	empty = list_empty(&isert_np->np_accept_list);
+-	mutex_unlock(&isert_np->np_accept_mutex);
+-
+-	return empty;
+-}
+-
+-static int
+ isert_rdma_accept(struct isert_conn *isert_conn)
+ {
+ 	struct rdma_cm_id *cm_id = isert_conn->conn_cm_id;
+@@ -2721,16 +2710,14 @@ isert_accept_np(struct iscsi_np *np, struct iscsi_conn *conn)
+ 	int max_accept = 0, ret;
+ 
+ accept_wait:
+-	ret = wait_event_interruptible(isert_np->np_accept_wq,
+-			!isert_check_accept_queue(isert_np) ||
+-			np->np_thread_state == ISCSI_NP_THREAD_RESET);
++	ret = down_interruptible(&isert_np->np_sem);
+ 	if (max_accept > 5)
+ 		return -ENODEV;
+ 
+ 	spin_lock_bh(&np->np_thread_lock);
+ 	if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
+ 		spin_unlock_bh(&np->np_thread_lock);
+-		pr_err("ISCSI_NP_THREAD_RESET for isert_accept_np\n");
++		pr_debug("ISCSI_NP_THREAD_RESET for isert_accept_np\n");
+ 		return -ENODEV;
+ 	}
+ 	spin_unlock_bh(&np->np_thread_lock);
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
+index f6ae7f5dd408..c3578f6091d2 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.h
++++ b/drivers/infiniband/ulp/isert/ib_isert.h
+@@ -158,7 +158,7 @@ struct isert_device {
+ };
+ 
+ struct isert_np {
+-	wait_queue_head_t	np_accept_wq;
++	struct semaphore	np_sem;
+ 	struct rdma_cm_id	*np_cm_id;
+ 	struct mutex		np_accept_mutex;
+ 	struct list_head	np_accept_list;
+diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
+index 2626773ff29b..2dd1d0dd4f7d 100644
+--- a/drivers/input/keyboard/atkbd.c
++++ b/drivers/input/keyboard/atkbd.c
+@@ -243,6 +243,12 @@ static void (*atkbd_platform_fixup)(struct atkbd *, const void *data);
+ static void *atkbd_platform_fixup_data;
+ static unsigned int (*atkbd_platform_scancode_fixup)(struct atkbd *, unsigned int);
+ 
++/*
++ * Certain keyboards to not like ATKBD_CMD_RESET_DIS and stop responding
++ * to many commands until full reset (ATKBD_CMD_RESET_BAT) is performed.
++ */
++static bool atkbd_skip_deactivate;
++
+ static ssize_t atkbd_attr_show_helper(struct device *dev, char *buf,
+ 				ssize_t (*handler)(struct atkbd *, char *));
+ static ssize_t atkbd_attr_set_helper(struct device *dev, const char *buf, size_t count,
+@@ -768,7 +774,8 @@ static int atkbd_probe(struct atkbd *atkbd)
+  * Make sure nothing is coming from the keyboard and disturbs our
+  * internal state.
+  */
+-	atkbd_deactivate(atkbd);
++	if (!atkbd_skip_deactivate)
++		atkbd_deactivate(atkbd);
+ 
+ 	return 0;
+ }
+@@ -1638,6 +1645,12 @@ static int __init atkbd_setup_scancode_fixup(const struct dmi_system_id *id)
+ 	return 1;
+ }
+ 
++static int __init atkbd_deactivate_fixup(const struct dmi_system_id *id)
++{
++	atkbd_skip_deactivate = true;
++	return 1;
++}
++
+ static const struct dmi_system_id atkbd_dmi_quirk_table[] __initconst = {
+ 	{
+ 		.matches = {
+@@ -1775,6 +1788,20 @@ static const struct dmi_system_id atkbd_dmi_quirk_table[] __initconst = {
+ 		.callback = atkbd_setup_scancode_fixup,
+ 		.driver_data = atkbd_oqo_01plus_scancode_fixup,
+ 	},
++	{
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "LW25-B7HV"),
++		},
++		.callback = atkbd_deactivate_fixup,
++	},
++	{
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "P1-J273B"),
++		},
++		.callback = atkbd_deactivate_fixup,
++	},
+ 	{ }
+ };
+ 
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index ef1cf52f8bb9..230cdcf8e6fe 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -11,6 +11,7 @@
+  */
+ 
+ #include <linux/delay.h>
++#include <linux/dmi.h>
+ #include <linux/slab.h>
+ #include <linux/module.h>
+ #include <linux/input.h>
+@@ -831,7 +832,11 @@ static int elantech_set_absolute_mode(struct psmouse *psmouse)
+ 		break;
+ 
+ 	case 3:
+-		etd->reg_10 = 0x0b;
++		if (etd->set_hw_resolution)
++			etd->reg_10 = 0x0b;
++		else
++			etd->reg_10 = 0x03;
++
+ 		if (elantech_write_reg(psmouse, 0x10, etd->reg_10))
+ 			rc = -1;
+ 
+@@ -1331,6 +1336,22 @@ static int elantech_reconnect(struct psmouse *psmouse)
+ }
+ 
+ /*
++ * Some hw_version 3 models go into error state when we try to set bit 3 of r10
++ */
++static const struct dmi_system_id no_hw_res_dmi_table[] = {
++#if defined(CONFIG_DMI) && defined(CONFIG_X86)
++	{
++		/* Gigabyte U2442 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "U2442"),
++		},
++	},
++#endif
++	{ }
++};
++
++/*
+  * determine hardware version and set some properties according to it.
+  */
+ static int elantech_set_properties(struct elantech_data *etd)
+@@ -1389,6 +1410,9 @@ static int elantech_set_properties(struct elantech_data *etd)
+ 	 */
+ 	etd->crc_enabled = ((etd->fw_version & 0x4000) == 0x4000);
+ 
++	/* Enable real hardware resolution on hw_version 3 ? */
++	etd->set_hw_resolution = !dmi_check_system(no_hw_res_dmi_table);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
+index 036a04abaef7..9e0e2a1f340d 100644
+--- a/drivers/input/mouse/elantech.h
++++ b/drivers/input/mouse/elantech.h
+@@ -130,6 +130,7 @@ struct elantech_data {
+ 	bool jumpy_cursor;
+ 	bool reports_pressure;
+ 	bool crc_enabled;
++	bool set_hw_resolution;
+ 	unsigned char hw_version;
+ 	unsigned int fw_version;
+ 	unsigned int single_finger_reports;
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 3c511c4adaca..c5ec703c727e 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -117,6 +117,81 @@ void synaptics_reset(struct psmouse *psmouse)
+ }
+ 
+ #ifdef CONFIG_MOUSE_PS2_SYNAPTICS
++struct min_max_quirk {
++	const char * const *pnp_ids;
++	int x_min, x_max, y_min, y_max;
++};
++
++static const struct min_max_quirk min_max_pnpid_table[] = {
++	{
++		(const char * const []){"LEN0033", NULL},
++		1024, 5052, 2258, 4832
++	},
++	{
++		(const char * const []){"LEN0035", "LEN0042", NULL},
++		1232, 5710, 1156, 4696
++	},
++	{
++		(const char * const []){"LEN0034", "LEN0036", "LEN2004", NULL},
++		1024, 5112, 2024, 4832
++	},
++	{
++		(const char * const []){"LEN2001", NULL},
++		1024, 5022, 2508, 4832
++	},
++	{ }
++};
++
++/* This list has been kindly provided by Synaptics. */
++static const char * const topbuttonpad_pnp_ids[] = {
++	"LEN0017",
++	"LEN0018",
++	"LEN0019",
++	"LEN0023",
++	"LEN002A",
++	"LEN002B",
++	"LEN002C",
++	"LEN002D",
++	"LEN002E",
++	"LEN0033", /* Helix */
++	"LEN0034", /* T431s, L440, L540, T540, W540, X1 Carbon 2nd */
++	"LEN0035", /* X240 */
++	"LEN0036", /* T440 */
++	"LEN0037",
++	"LEN0038",
++	"LEN0041",
++	"LEN0042", /* Yoga */
++	"LEN0045",
++	"LEN0046",
++	"LEN0047",
++	"LEN0048",
++	"LEN0049",
++	"LEN2000",
++	"LEN2001", /* Edge E431 */
++	"LEN2002",
++	"LEN2003",
++	"LEN2004", /* L440 */
++	"LEN2005",
++	"LEN2006",
++	"LEN2007",
++	"LEN2008",
++	"LEN2009",
++	"LEN200A",
++	"LEN200B",
++	NULL
++};
++
++static bool matches_pnp_id(struct psmouse *psmouse, const char * const ids[])
++{
++	int i;
++
++	if (!strncmp(psmouse->ps2dev.serio->firmware_id, "PNP:", 4))
++		for (i = 0; ids[i]; i++)
++			if (strstr(psmouse->ps2dev.serio->firmware_id, ids[i]))
++				return true;
++
++	return false;
++}
+ 
+ /*****************************************************************************
+  *	Synaptics communications functions
+@@ -266,20 +341,20 @@ static int synaptics_identify(struct psmouse *psmouse)
+  * Resolution is left zero if touchpad does not support the query
+  */
+ 
+-static const int *quirk_min_max;
+-
+ static int synaptics_resolution(struct psmouse *psmouse)
+ {
+ 	struct synaptics_data *priv = psmouse->private;
+ 	unsigned char resp[3];
++	int i;
+ 
+-	if (quirk_min_max) {
+-		priv->x_min = quirk_min_max[0];
+-		priv->x_max = quirk_min_max[1];
+-		priv->y_min = quirk_min_max[2];
+-		priv->y_max = quirk_min_max[3];
+-		return 0;
+-	}
++	for (i = 0; min_max_pnpid_table[i].pnp_ids; i++)
++		if (matches_pnp_id(psmouse, min_max_pnpid_table[i].pnp_ids)) {
++			priv->x_min = min_max_pnpid_table[i].x_min;
++			priv->x_max = min_max_pnpid_table[i].x_max;
++			priv->y_min = min_max_pnpid_table[i].y_min;
++			priv->y_max = min_max_pnpid_table[i].y_max;
++			return 0;
++		}
+ 
+ 	if (SYN_ID_MAJOR(priv->identity) < 4)
+ 		return 0;
+@@ -1255,8 +1330,10 @@ static void set_abs_position_params(struct input_dev *dev,
+ 	input_abs_set_res(dev, y_code, priv->y_res);
+ }
+ 
+-static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
++static void set_input_params(struct psmouse *psmouse,
++			     struct synaptics_data *priv)
+ {
++	struct input_dev *dev = psmouse->dev;
+ 	int i;
+ 
+ 	/* Things that apply to both modes */
+@@ -1325,6 +1402,8 @@ static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
+ 
+ 	if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
+ 		__set_bit(INPUT_PROP_BUTTONPAD, dev->propbit);
++		if (matches_pnp_id(psmouse, topbuttonpad_pnp_ids))
++			__set_bit(INPUT_PROP_TOPBUTTONPAD, dev->propbit);
+ 		/* Clickpads report only left button */
+ 		__clear_bit(BTN_RIGHT, dev->keybit);
+ 		__clear_bit(BTN_MIDDLE, dev->keybit);
+@@ -1496,104 +1575,10 @@ static const struct dmi_system_id olpc_dmi_table[] __initconst = {
+ 	{ }
+ };
+ 
+-static const struct dmi_system_id min_max_dmi_table[] __initconst = {
+-#if defined(CONFIG_DMI)
+-	{
+-		/* Lenovo ThinkPad Helix */
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix"),
+-		},
+-		.driver_data = (int []){1024, 5052, 2258, 4832},
+-	},
+-	{
+-		/* Lenovo ThinkPad X240 */
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X240"),
+-		},
+-		.driver_data = (int []){1232, 5710, 1156, 4696},
+-	},
+-	{
+-		/* Lenovo ThinkPad Edge E431 */
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Edge E431"),
+-		},
+-		.driver_data = (int []){1024, 5022, 2508, 4832},
+-	},
+-	{
+-		/* Lenovo ThinkPad T431s */
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T431"),
+-		},
+-		.driver_data = (int []){1024, 5112, 2024, 4832},
+-	},
+-	{
+-		/* Lenovo ThinkPad T440s */
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T440"),
+-		},
+-		.driver_data = (int []){1024, 5112, 2024, 4832},
+-	},
+-	{
+-		/* Lenovo ThinkPad L440 */
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L440"),
+-		},
+-		.driver_data = (int []){1024, 5112, 2024, 4832},
+-	},
+-	{
+-		/* Lenovo ThinkPad T540p */
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T540"),
+-		},
+-		.driver_data = (int []){1024, 5056, 2058, 4832},
+-	},
+-	{
+-		/* Lenovo ThinkPad L540 */
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L540"),
+-		},
+-		.driver_data = (int []){1024, 5112, 2024, 4832},
+-	},
+-	{
+-		/* Lenovo Yoga S1 */
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-			DMI_EXACT_MATCH(DMI_PRODUCT_VERSION,
+-					"ThinkPad S1 Yoga"),
+-		},
+-		.driver_data = (int []){1232, 5710, 1156, 4696},
+-	},
+-	{
+-		/* Lenovo ThinkPad X1 Carbon Haswell (3rd generation) */
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION,
+-					"ThinkPad X1 Carbon 2nd"),
+-		},
+-		.driver_data = (int []){1024, 5112, 2024, 4832},
+-	},
+-#endif
+-	{ }
+-};
+-
+ void __init synaptics_module_init(void)
+ {
+-	const struct dmi_system_id *min_max_dmi;
+-
+ 	impaired_toshiba_kbc = dmi_check_system(toshiba_dmi_table);
+ 	broken_olpc_ec = dmi_check_system(olpc_dmi_table);
+-
+-	min_max_dmi = dmi_first_match(min_max_dmi_table);
+-	if (min_max_dmi)
+-		quirk_min_max = min_max_dmi->driver_data;
+ }
+ 
+ static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode)
+@@ -1643,7 +1628,7 @@ static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode)
+ 		     priv->capabilities, priv->ext_cap, priv->ext_cap_0c,
+ 		     priv->board_id, priv->firmware_id);
+ 
+-	set_input_params(psmouse->dev, priv);
++	set_input_params(psmouse, priv);
+ 
+ 	/*
+ 	 * Encode touchpad model so that it can be used to set
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 0ec9abbe31fe..381b20d4c561 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -702,6 +702,17 @@ static int i8042_pnp_aux_irq;
+ static char i8042_pnp_kbd_name[32];
+ static char i8042_pnp_aux_name[32];
+ 
++static void i8042_pnp_id_to_string(struct pnp_id *id, char *dst, int dst_size)
++{
++	strlcpy(dst, "PNP:", dst_size);
++
++	while (id) {
++		strlcat(dst, " ", dst_size);
++		strlcat(dst, id->id, dst_size);
++		id = id->next;
++	}
++}
++
+ static int i8042_pnp_kbd_probe(struct pnp_dev *dev, const struct pnp_device_id *did)
+ {
+ 	if (pnp_port_valid(dev, 0) && pnp_port_len(dev, 0) == 1)
+@@ -718,6 +729,8 @@ static int i8042_pnp_kbd_probe(struct pnp_dev *dev, const struct pnp_device_id *
+ 		strlcat(i8042_pnp_kbd_name, ":", sizeof(i8042_pnp_kbd_name));
+ 		strlcat(i8042_pnp_kbd_name, pnp_dev_name(dev), sizeof(i8042_pnp_kbd_name));
+ 	}
++	i8042_pnp_id_to_string(dev->id, i8042_kbd_firmware_id,
++			       sizeof(i8042_kbd_firmware_id));
+ 
+ 	/* Keyboard ports are always supposed to be wakeup-enabled */
+ 	device_set_wakeup_enable(&dev->dev, true);
+@@ -742,6 +755,8 @@ static int i8042_pnp_aux_probe(struct pnp_dev *dev, const struct pnp_device_id *
+ 		strlcat(i8042_pnp_aux_name, ":", sizeof(i8042_pnp_aux_name));
+ 		strlcat(i8042_pnp_aux_name, pnp_dev_name(dev), sizeof(i8042_pnp_aux_name));
+ 	}
++	i8042_pnp_id_to_string(dev->id, i8042_aux_firmware_id,
++			       sizeof(i8042_aux_firmware_id));
+ 
+ 	i8042_pnp_aux_devices++;
+ 	return 0;
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index 020053fa5aaa..3807c3e971cc 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -87,6 +87,8 @@ MODULE_PARM_DESC(debug, "Turn i8042 debugging mode on and off");
+ #endif
+ 
+ static bool i8042_bypass_aux_irq_test;
++static char i8042_kbd_firmware_id[128];
++static char i8042_aux_firmware_id[128];
+ 
+ #include "i8042.h"
+ 
+@@ -1218,6 +1220,8 @@ static int __init i8042_create_kbd_port(void)
+ 	serio->dev.parent	= &i8042_platform_device->dev;
+ 	strlcpy(serio->name, "i8042 KBD port", sizeof(serio->name));
+ 	strlcpy(serio->phys, I8042_KBD_PHYS_DESC, sizeof(serio->phys));
++	strlcpy(serio->firmware_id, i8042_kbd_firmware_id,
++		sizeof(serio->firmware_id));
+ 
+ 	port->serio = serio;
+ 	port->irq = I8042_KBD_IRQ;
+@@ -1244,6 +1248,8 @@ static int __init i8042_create_aux_port(int idx)
+ 	if (idx < 0) {
+ 		strlcpy(serio->name, "i8042 AUX port", sizeof(serio->name));
+ 		strlcpy(serio->phys, I8042_AUX_PHYS_DESC, sizeof(serio->phys));
++		strlcpy(serio->firmware_id, i8042_aux_firmware_id,
++			sizeof(serio->firmware_id));
+ 		serio->close = i8042_port_close;
+ 	} else {
+ 		snprintf(serio->name, sizeof(serio->name), "i8042 AUX%d port", idx);
+diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
+index 8f4c4ab04bc2..b29134de983b 100644
+--- a/drivers/input/serio/serio.c
++++ b/drivers/input/serio/serio.c
+@@ -451,6 +451,13 @@ static ssize_t serio_set_bind_mode(struct device *dev, struct device_attribute *
+ 	return retval;
+ }
+ 
++static ssize_t firmware_id_show(struct device *dev, struct device_attribute *attr, char *buf)
++{
++	struct serio *serio = to_serio_port(dev);
++
++	return sprintf(buf, "%s\n", serio->firmware_id);
++}
++
+ static DEVICE_ATTR_RO(type);
+ static DEVICE_ATTR_RO(proto);
+ static DEVICE_ATTR_RO(id);
+@@ -473,12 +480,14 @@ static DEVICE_ATTR_RO(modalias);
+ static DEVICE_ATTR_WO(drvctl);
+ static DEVICE_ATTR(description, S_IRUGO, serio_show_description, NULL);
+ static DEVICE_ATTR(bind_mode, S_IWUSR | S_IRUGO, serio_show_bind_mode, serio_set_bind_mode);
++static DEVICE_ATTR_RO(firmware_id);
+ 
+ static struct attribute *serio_device_attrs[] = {
+ 	&dev_attr_modalias.attr,
+ 	&dev_attr_description.attr,
+ 	&dev_attr_drvctl.attr,
+ 	&dev_attr_bind_mode.attr,
++	&dev_attr_firmware_id.attr,
+ 	NULL
+ };
+ 
+@@ -921,9 +930,14 @@ static int serio_uevent(struct device *dev, struct kobj_uevent_env *env)
+ 	SERIO_ADD_UEVENT_VAR("SERIO_PROTO=%02x", serio->id.proto);
+ 	SERIO_ADD_UEVENT_VAR("SERIO_ID=%02x", serio->id.id);
+ 	SERIO_ADD_UEVENT_VAR("SERIO_EXTRA=%02x", serio->id.extra);
++
+ 	SERIO_ADD_UEVENT_VAR("MODALIAS=serio:ty%02Xpr%02Xid%02Xex%02X",
+ 				serio->id.type, serio->id.proto, serio->id.id, serio->id.extra);
+ 
++	if (serio->firmware_id[0])
++		SERIO_ADD_UEVENT_VAR("SERIO_FIRMWARE_ID=%s",
++				     serio->firmware_id);
++
+ 	return 0;
+ }
+ #undef SERIO_ADD_UEVENT_VAR
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index faf0da4bb3a2..71776ff5aedc 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -3999,7 +3999,7 @@ static struct irq_remap_table *get_irq_table(u16 devid, bool ioapic)
+ 	iommu_flush_dte(iommu, devid);
+ 	if (devid != alias) {
+ 		irq_lookup_table[alias] = table;
+-		set_dte_irq_entry(devid, table);
++		set_dte_irq_entry(alias, table);
+ 		iommu_flush_dte(iommu, alias);
+ 	}
+ 
+diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
+index 540956465ed2..939eb0d8fbf1 100644
+--- a/drivers/irqchip/irq-armada-370-xp.c
++++ b/drivers/irqchip/irq-armada-370-xp.c
+@@ -130,8 +130,7 @@ static int armada_370_xp_setup_msi_irq(struct msi_chip *chip,
+ 				       struct msi_desc *desc)
+ {
+ 	struct msi_msg msg;
+-	irq_hw_number_t hwirq;
+-	int virq;
++	int virq, hwirq;
+ 
+ 	hwirq = armada_370_xp_alloc_msi();
+ 	if (hwirq < 0)
+@@ -157,8 +156,19 @@ static void armada_370_xp_teardown_msi_irq(struct msi_chip *chip,
+ 					   unsigned int irq)
+ {
+ 	struct irq_data *d = irq_get_irq_data(irq);
++	unsigned long hwirq = d->hwirq;
++
+ 	irq_dispose_mapping(irq);
+-	armada_370_xp_free_msi(d->hwirq);
++	armada_370_xp_free_msi(hwirq);
++}
++
++static int armada_370_xp_check_msi_device(struct msi_chip *chip, struct pci_dev *dev,
++					  int nvec, int type)
++{
++	/* We support MSI, but not MSI-X */
++	if (type == PCI_CAP_ID_MSI)
++		return 0;
++	return -EINVAL;
+ }
+ 
+ static struct irq_chip armada_370_xp_msi_irq_chip = {
+@@ -199,6 +209,7 @@ static int armada_370_xp_msi_init(struct device_node *node,
+ 
+ 	msi_chip->setup_irq = armada_370_xp_setup_msi_irq;
+ 	msi_chip->teardown_irq = armada_370_xp_teardown_msi_irq;
++	msi_chip->check_device = armada_370_xp_check_msi_device;
+ 	msi_chip->of_node = node;
+ 
+ 	armada_370_xp_msi_domain =
+diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
+index 341c6016812d..ac2d41bd71a0 100644
+--- a/drivers/irqchip/irq-gic.c
++++ b/drivers/irqchip/irq-gic.c
+@@ -246,10 +246,14 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
+ 			    bool force)
+ {
+ 	void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + (gic_irq(d) & ~3);
+-	unsigned int shift = (gic_irq(d) % 4) * 8;
+-	unsigned int cpu = cpumask_any_and(mask_val, cpu_online_mask);
++	unsigned int cpu, shift = (gic_irq(d) % 4) * 8;
+ 	u32 val, mask, bit;
+ 
++	if (!force)
++		cpu = cpumask_any_and(mask_val, cpu_online_mask);
++	else
++		cpu = cpumask_first(mask_val);
++
+ 	if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
+ 		return -EINVAL;
+ 
+diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
+index 605047428b5a..a7b369fc3554 100644
+--- a/drivers/leds/leds-pwm.c
++++ b/drivers/leds/leds-pwm.c
+@@ -84,6 +84,15 @@ static inline size_t sizeof_pwm_leds_priv(int num_leds)
+ 		      (sizeof(struct led_pwm_data) * num_leds);
+ }
+ 
++static void led_pwm_cleanup(struct led_pwm_priv *priv)
++{
++	while (priv->num_leds--) {
++		led_classdev_unregister(&priv->leds[priv->num_leds].cdev);
++		if (priv->leds[priv->num_leds].can_sleep)
++			cancel_work_sync(&priv->leds[priv->num_leds].work);
++	}
++}
++
+ static int led_pwm_create_of(struct platform_device *pdev,
+ 			     struct led_pwm_priv *priv)
+ {
+@@ -131,8 +140,7 @@ static int led_pwm_create_of(struct platform_device *pdev,
+ 
+ 	return 0;
+ err:
+-	while (priv->num_leds--)
+-		led_classdev_unregister(&priv->leds[priv->num_leds].cdev);
++	led_pwm_cleanup(priv);
+ 
+ 	return ret;
+ }
+@@ -200,8 +208,8 @@ static int led_pwm_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ err:
+-	while (i--)
+-		led_classdev_unregister(&priv->leds[i].cdev);
++	priv->num_leds = i;
++	led_pwm_cleanup(priv);
+ 
+ 	return ret;
+ }
+@@ -209,13 +217,8 @@ err:
+ static int led_pwm_remove(struct platform_device *pdev)
+ {
+ 	struct led_pwm_priv *priv = platform_get_drvdata(pdev);
+-	int i;
+ 
+-	for (i = 0; i < priv->num_leds; i++) {
+-		led_classdev_unregister(&priv->leds[i].cdev);
+-		if (priv->leds[i].can_sleep)
+-			cancel_work_sync(&priv->leds[i].work);
+-	}
++	led_pwm_cleanup(priv);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
+index b82b58f0bb85..9306e0bcb564 100644
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -2506,6 +2506,7 @@ static int cache_map(struct dm_target *ti, struct bio *bio)
+ 
+ 		} else {
+ 			inc_hit_counter(cache, bio);
++			pb->all_io_entry = dm_deferred_entry_inc(cache->all_io_ds);
+ 
+ 			if (bio_data_dir(bio) == WRITE && writethrough_mode(&cache->features) &&
+ 			    !is_dirty(cache, lookup_result.cblock))
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 784695d22fde..53b213226c01 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -19,7 +19,6 @@
+ #include <linux/crypto.h>
+ #include <linux/workqueue.h>
+ #include <linux/backing-dev.h>
+-#include <linux/percpu.h>
+ #include <linux/atomic.h>
+ #include <linux/scatterlist.h>
+ #include <asm/page.h>
+@@ -43,6 +42,7 @@ struct convert_context {
+ 	struct bvec_iter iter_out;
+ 	sector_t cc_sector;
+ 	atomic_t cc_pending;
++	struct ablkcipher_request *req;
+ };
+ 
+ /*
+@@ -111,15 +111,7 @@ struct iv_tcw_private {
+ enum flags { DM_CRYPT_SUSPENDED, DM_CRYPT_KEY_VALID };
+ 
+ /*
+- * Duplicated per-CPU state for cipher.
+- */
+-struct crypt_cpu {
+-	struct ablkcipher_request *req;
+-};
+-
+-/*
+- * The fields in here must be read only after initialization,
+- * changing state should be in crypt_cpu.
++ * The fields in here must be read only after initialization.
+  */
+ struct crypt_config {
+ 	struct dm_dev *dev;
+@@ -150,12 +142,6 @@ struct crypt_config {
+ 	sector_t iv_offset;
+ 	unsigned int iv_size;
+ 
+-	/*
+-	 * Duplicated per cpu state. Access through
+-	 * per_cpu_ptr() only.
+-	 */
+-	struct crypt_cpu __percpu *cpu;
+-
+ 	/* ESSIV: struct crypto_cipher *essiv_tfm */
+ 	void *iv_private;
+ 	struct crypto_ablkcipher **tfms;
+@@ -192,11 +178,6 @@ static void clone_init(struct dm_crypt_io *, struct bio *);
+ static void kcryptd_queue_crypt(struct dm_crypt_io *io);
+ static u8 *iv_of_dmreq(struct crypt_config *cc, struct dm_crypt_request *dmreq);
+ 
+-static struct crypt_cpu *this_crypt_config(struct crypt_config *cc)
+-{
+-	return this_cpu_ptr(cc->cpu);
+-}
+-
+ /*
+  * Use this to access cipher attributes that are the same for each CPU.
+  */
+@@ -903,16 +884,15 @@ static void kcryptd_async_done(struct crypto_async_request *async_req,
+ static void crypt_alloc_req(struct crypt_config *cc,
+ 			    struct convert_context *ctx)
+ {
+-	struct crypt_cpu *this_cc = this_crypt_config(cc);
+ 	unsigned key_index = ctx->cc_sector & (cc->tfms_count - 1);
+ 
+-	if (!this_cc->req)
+-		this_cc->req = mempool_alloc(cc->req_pool, GFP_NOIO);
++	if (!ctx->req)
++		ctx->req = mempool_alloc(cc->req_pool, GFP_NOIO);
+ 
+-	ablkcipher_request_set_tfm(this_cc->req, cc->tfms[key_index]);
+-	ablkcipher_request_set_callback(this_cc->req,
++	ablkcipher_request_set_tfm(ctx->req, cc->tfms[key_index]);
++	ablkcipher_request_set_callback(ctx->req,
+ 	    CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
+-	    kcryptd_async_done, dmreq_of_req(cc, this_cc->req));
++	    kcryptd_async_done, dmreq_of_req(cc, ctx->req));
+ }
+ 
+ /*
+@@ -921,7 +901,6 @@ static void crypt_alloc_req(struct crypt_config *cc,
+ static int crypt_convert(struct crypt_config *cc,
+ 			 struct convert_context *ctx)
+ {
+-	struct crypt_cpu *this_cc = this_crypt_config(cc);
+ 	int r;
+ 
+ 	atomic_set(&ctx->cc_pending, 1);
+@@ -932,7 +911,7 @@ static int crypt_convert(struct crypt_config *cc,
+ 
+ 		atomic_inc(&ctx->cc_pending);
+ 
+-		r = crypt_convert_block(cc, ctx, this_cc->req);
++		r = crypt_convert_block(cc, ctx, ctx->req);
+ 
+ 		switch (r) {
+ 		/* async */
+@@ -941,7 +920,7 @@ static int crypt_convert(struct crypt_config *cc,
+ 			reinit_completion(&ctx->restart);
+ 			/* fall through*/
+ 		case -EINPROGRESS:
+-			this_cc->req = NULL;
++			ctx->req = NULL;
+ 			ctx->cc_sector++;
+ 			continue;
+ 
+@@ -1040,6 +1019,7 @@ static struct dm_crypt_io *crypt_io_alloc(struct crypt_config *cc,
+ 	io->sector = sector;
+ 	io->error = 0;
+ 	io->base_io = NULL;
++	io->ctx.req = NULL;
+ 	atomic_set(&io->io_pending, 0);
+ 
+ 	return io;
+@@ -1065,6 +1045,8 @@ static void crypt_dec_pending(struct dm_crypt_io *io)
+ 	if (!atomic_dec_and_test(&io->io_pending))
+ 		return;
+ 
++	if (io->ctx.req)
++		mempool_free(io->ctx.req, cc->req_pool);
+ 	mempool_free(io, cc->io_pool);
+ 
+ 	if (likely(!base_io))
+@@ -1492,8 +1474,6 @@ static int crypt_wipe_key(struct crypt_config *cc)
+ static void crypt_dtr(struct dm_target *ti)
+ {
+ 	struct crypt_config *cc = ti->private;
+-	struct crypt_cpu *cpu_cc;
+-	int cpu;
+ 
+ 	ti->private = NULL;
+ 
+@@ -1505,13 +1485,6 @@ static void crypt_dtr(struct dm_target *ti)
+ 	if (cc->crypt_queue)
+ 		destroy_workqueue(cc->crypt_queue);
+ 
+-	if (cc->cpu)
+-		for_each_possible_cpu(cpu) {
+-			cpu_cc = per_cpu_ptr(cc->cpu, cpu);
+-			if (cpu_cc->req)
+-				mempool_free(cpu_cc->req, cc->req_pool);
+-		}
+-
+ 	crypt_free_tfms(cc);
+ 
+ 	if (cc->bs)
+@@ -1530,9 +1503,6 @@ static void crypt_dtr(struct dm_target *ti)
+ 	if (cc->dev)
+ 		dm_put_device(ti, cc->dev);
+ 
+-	if (cc->cpu)
+-		free_percpu(cc->cpu);
+-
+ 	kzfree(cc->cipher);
+ 	kzfree(cc->cipher_string);
+ 
+@@ -1588,13 +1558,6 @@ static int crypt_ctr_cipher(struct dm_target *ti,
+ 	if (tmp)
+ 		DMWARN("Ignoring unexpected additional cipher options");
+ 
+-	cc->cpu = __alloc_percpu(sizeof(*(cc->cpu)),
+-				 __alignof__(struct crypt_cpu));
+-	if (!cc->cpu) {
+-		ti->error = "Cannot allocate per cpu state";
+-		goto bad_mem;
+-	}
+-
+ 	/*
+ 	 * For compatibility with the original dm-crypt mapping format, if
+ 	 * only the cipher name is supplied, use cbc-plain.
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 60cc50685c14..fa602b56b648 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -25,6 +25,7 @@
+ #define MAPPING_POOL_SIZE 1024
+ #define PRISON_CELLS 1024
+ #define COMMIT_PERIOD HZ
++#define NO_SPACE_TIMEOUT (HZ * 60)
+ 
+ DECLARE_DM_KCOPYD_THROTTLE_WITH_MODULE_PARM(snapshot_copy_throttle,
+ 		"A percentage of time allocated for copy on write");
+@@ -173,6 +174,7 @@ struct pool {
+ 	struct workqueue_struct *wq;
+ 	struct work_struct worker;
+ 	struct delayed_work waker;
++	struct delayed_work no_space_timeout;
+ 
+ 	unsigned long last_commit_jiffies;
+ 	unsigned ref_count;
+@@ -920,7 +922,7 @@ static int commit(struct pool *pool)
+ {
+ 	int r;
+ 
+-	if (get_pool_mode(pool) != PM_WRITE)
++	if (get_pool_mode(pool) >= PM_READ_ONLY)
+ 		return -EINVAL;
+ 
+ 	r = dm_pool_commit_metadata(pool->pmd);
+@@ -1449,6 +1451,20 @@ static void do_waker(struct work_struct *ws)
+ 	queue_delayed_work(pool->wq, &pool->waker, COMMIT_PERIOD);
+ }
+ 
++/*
++ * We're holding onto IO to allow userland time to react.  After the
++ * timeout either the pool will have been resized (and thus back in
++ * PM_WRITE mode), or we degrade to PM_READ_ONLY and start erroring IO.
++ */
++static void do_no_space_timeout(struct work_struct *ws)
++{
++	struct pool *pool = container_of(to_delayed_work(ws), struct pool,
++					 no_space_timeout);
++
++	if (get_pool_mode(pool) == PM_OUT_OF_DATA_SPACE && !pool->pf.error_if_no_space)
++		set_pool_mode(pool, PM_READ_ONLY);
++}
++
+ /*----------------------------------------------------------------*/
+ 
+ struct noflush_work {
+@@ -1574,6 +1590,9 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
+ 		pool->process_discard = process_discard;
+ 		pool->process_prepared_mapping = process_prepared_mapping;
+ 		pool->process_prepared_discard = process_prepared_discard_passdown;
++
++		if (!pool->pf.error_if_no_space)
++			queue_delayed_work(pool->wq, &pool->no_space_timeout, NO_SPACE_TIMEOUT);
+ 		break;
+ 
+ 	case PM_WRITE:
+@@ -1956,6 +1975,7 @@ static struct pool *pool_create(struct mapped_device *pool_md,
+ 
+ 	INIT_WORK(&pool->worker, do_worker);
+ 	INIT_DELAYED_WORK(&pool->waker, do_waker);
++	INIT_DELAYED_WORK(&pool->no_space_timeout, do_no_space_timeout);
+ 	spin_lock_init(&pool->lock);
+ 	bio_list_init(&pool->deferred_bios);
+ 	bio_list_init(&pool->deferred_flush_bios);
+@@ -2519,6 +2539,7 @@ static void pool_postsuspend(struct dm_target *ti)
+ 	struct pool *pool = pt->pool;
+ 
+ 	cancel_delayed_work(&pool->waker);
++	cancel_delayed_work(&pool->no_space_timeout);
+ 	flush_workqueue(pool->wq);
+ 	(void) commit(pool);
+ }
+diff --git a/drivers/md/dm-verity.c b/drivers/md/dm-verity.c
+index 796007a5e0e1..7a7bab8947ae 100644
+--- a/drivers/md/dm-verity.c
++++ b/drivers/md/dm-verity.c
+@@ -330,15 +330,17 @@ test_block_hash:
+ 				return r;
+ 			}
+ 		}
+-
+ 		todo = 1 << v->data_dev_block_bits;
+-		while (io->iter.bi_size) {
++		do {
+ 			u8 *page;
++			unsigned len;
+ 			struct bio_vec bv = bio_iter_iovec(bio, io->iter);
+ 
+ 			page = kmap_atomic(bv.bv_page);
+-			r = crypto_shash_update(desc, page + bv.bv_offset,
+-						bv.bv_len);
++			len = bv.bv_len;
++			if (likely(len >= todo))
++				len = todo;
++			r = crypto_shash_update(desc, page + bv.bv_offset, len);
+ 			kunmap_atomic(page);
+ 
+ 			if (r < 0) {
+@@ -346,8 +348,9 @@ test_block_hash:
+ 				return r;
+ 			}
+ 
+-			bio_advance_iter(bio, &io->iter, bv.bv_len);
+-		}
++			bio_advance_iter(bio, &io->iter, len);
++			todo -= len;
++		} while (todo);
+ 
+ 		if (!v->version) {
+ 			r = crypto_shash_update(desc, v->salt, v->salt_size);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 4ad5cc4e63e8..51c431c3a411 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -8530,7 +8530,8 @@ static int md_notify_reboot(struct notifier_block *this,
+ 		if (mddev_trylock(mddev)) {
+ 			if (mddev->pers)
+ 				__md_stop_writes(mddev);
+-			mddev->safemode = 2;
++			if (mddev->persistent)
++				mddev->safemode = 2;
+ 			mddev_unlock(mddev);
+ 		}
+ 		need_delay = 1;
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 33fc408e5eac..cb882aae9e20 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1172,6 +1172,13 @@ static void __make_request(struct mddev *mddev, struct bio *bio)
+ 	int max_sectors;
+ 	int sectors;
+ 
++	/*
++	 * Register the new request and wait if the reconstruction
++	 * thread has put up a bar for new requests.
++	 * Continue immediately if no resync is active currently.
++	 */
++	wait_barrier(conf);
++
+ 	sectors = bio_sectors(bio);
+ 	while (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
+ 	    bio->bi_iter.bi_sector < conf->reshape_progress &&
+@@ -1552,12 +1559,6 @@ static void make_request(struct mddev *mddev, struct bio *bio)
+ 
+ 	md_write_start(mddev, bio);
+ 
+-	/*
+-	 * Register the new request and wait if the reconstruction
+-	 * thread has put up a bar for new requests.
+-	 * Continue immediately if no resync is active currently.
+-	 */
+-	wait_barrier(conf);
+ 
+ 	do {
+ 
+diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c
+index e8a1ce204036..cdd7c1b7259b 100644
+--- a/drivers/media/i2c/ov7670.c
++++ b/drivers/media/i2c/ov7670.c
+@@ -1109,7 +1109,7 @@ static int ov7670_enum_framesizes(struct v4l2_subdev *sd,
+ 	 * windows that fall outside that.
+ 	 */
+ 	for (i = 0; i < n_win_sizes; i++) {
+-		struct ov7670_win_size *win = &info->devtype->win_sizes[index];
++		struct ov7670_win_size *win = &info->devtype->win_sizes[i];
+ 		if (info->min_width && win->width < info->min_width)
+ 			continue;
+ 		if (info->min_height && win->height < info->min_height)
+diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
+index d5a7a135f75d..703560fa5e73 100644
+--- a/drivers/media/media-device.c
++++ b/drivers/media/media-device.c
+@@ -93,6 +93,7 @@ static long media_device_enum_entities(struct media_device *mdev,
+ 	struct media_entity *ent;
+ 	struct media_entity_desc u_ent;
+ 
++	memset(&u_ent, 0, sizeof(u_ent));
+ 	if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id)))
+ 		return -EFAULT;
+ 
+diff --git a/drivers/media/tuners/fc2580.c b/drivers/media/tuners/fc2580.c
+index 3aecaf465094..f0c9c42867de 100644
+--- a/drivers/media/tuners/fc2580.c
++++ b/drivers/media/tuners/fc2580.c
+@@ -195,7 +195,7 @@ static int fc2580_set_params(struct dvb_frontend *fe)
+ 
+ 	f_ref = 2UL * priv->cfg->clock / r_val;
+ 	n_val = div_u64_rem(f_vco, f_ref, &k_val);
+-	k_val_reg = 1UL * k_val * (1 << 20) / f_ref;
++	k_val_reg = div_u64(1ULL * k_val * (1 << 20), f_ref);
+ 
+ 	ret = fc2580_wr_reg(priv, 0x18, r18_val | ((k_val_reg >> 16) & 0xff));
+ 	if (ret < 0)
+@@ -348,8 +348,8 @@ static int fc2580_set_params(struct dvb_frontend *fe)
+ 	if (ret < 0)
+ 		goto err;
+ 
+-	ret = fc2580_wr_reg(priv, 0x37, 1UL * priv->cfg->clock * \
+-			fc2580_if_filter_lut[i].mul / 1000000000);
++	ret = fc2580_wr_reg(priv, 0x37, div_u64(1ULL * priv->cfg->clock *
++			fc2580_if_filter_lut[i].mul, 1000000000));
+ 	if (ret < 0)
+ 		goto err;
+ 
+diff --git a/drivers/media/tuners/fc2580_priv.h b/drivers/media/tuners/fc2580_priv.h
+index be38a9e637e0..646c99452136 100644
+--- a/drivers/media/tuners/fc2580_priv.h
++++ b/drivers/media/tuners/fc2580_priv.h
+@@ -22,6 +22,7 @@
+ #define FC2580_PRIV_H
+ 
+ #include "fc2580.h"
++#include <linux/math64.h>
+ 
+ struct fc2580_reg_val {
+ 	u8 reg;
+diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+index b63a5e584aa0..fca336b65351 100644
+--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+@@ -178,6 +178,9 @@ struct v4l2_create_buffers32 {
+ 
+ static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
+ {
++	if (get_user(kp->type, &up->type))
++		return -EFAULT;
++
+ 	switch (kp->type) {
+ 	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
+ 	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+@@ -204,17 +207,16 @@ static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __us
+ 
+ static int get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
+ {
+-	if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)) ||
+-			get_user(kp->type, &up->type))
+-			return -EFAULT;
++	if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)))
++		return -EFAULT;
+ 	return __get_v4l2_format32(kp, up);
+ }
+ 
+ static int get_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_buffers32 __user *up)
+ {
+ 	if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_create_buffers32)) ||
+-	    copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format.fmt)))
+-			return -EFAULT;
++	    copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format)))
++		return -EFAULT;
+ 	return __get_v4l2_format32(&kp->format, &up->format);
+ }
+ 
+diff --git a/drivers/memory/mvebu-devbus.c b/drivers/memory/mvebu-devbus.c
+index 110c03627051..b59a17fb7c3e 100644
+--- a/drivers/memory/mvebu-devbus.c
++++ b/drivers/memory/mvebu-devbus.c
+@@ -108,8 +108,19 @@ static int devbus_set_timing_params(struct devbus *devbus,
+ 			node->full_name);
+ 		return err;
+ 	}
+-	/* Convert bit width to byte width */
+-	r.bus_width /= 8;
++
++	/*
++	 * The bus width is encoded into the register as 0 for 8 bits,
++	 * and 1 for 16 bits, so we do the necessary conversion here.
++	 */
++	if (r.bus_width == 8)
++		r.bus_width = 0;
++	else if (r.bus_width == 16)
++		r.bus_width = 1;
++	else {
++		dev_err(devbus->dev, "invalid bus width %d\n", r.bus_width);
++		return -EINVAL;
++	}
+ 
+ 	err = get_timing_param_ps(devbus, node, "devbus,badr-skew-ps",
+ 				 &r.badr_skew);
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 6d91933c4cdd..0af6e060e238 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -2976,11 +2976,21 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
+ 	u32 rctl, rfctl;
+ 	u32 pages = 0;
+ 
+-	/* Workaround Si errata on PCHx - configure jumbo frame flow */
+-	if ((hw->mac.type >= e1000_pch2lan) &&
+-	    (adapter->netdev->mtu > ETH_DATA_LEN) &&
+-	    e1000_lv_jumbo_workaround_ich8lan(hw, true))
+-		e_dbg("failed to enable jumbo frame workaround mode\n");
++	/* Workaround Si errata on PCHx - configure jumbo frame flow.
++	 * If jumbo frames not set, program related MAC/PHY registers
++	 * to h/w defaults
++	 */
++	if (hw->mac.type >= e1000_pch2lan) {
++		s32 ret_val;
++
++		if (adapter->netdev->mtu > ETH_DATA_LEN)
++			ret_val = e1000_lv_jumbo_workaround_ich8lan(hw, true);
++		else
++			ret_val = e1000_lv_jumbo_workaround_ich8lan(hw, false);
++
++		if (ret_val)
++			e_dbg("failed to enable|disable jumbo frame workaround mode\n");
++	}
+ 
+ 	/* Program MC offset vector base */
+ 	rctl = er32(RCTL);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index b9d1c1c8ca5a..178506a201d5 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -1776,7 +1776,7 @@ int i40e_vc_process_vf_msg(struct i40e_pf *pf, u16 vf_id, u32 v_opcode,
+ 			   u32 v_retval, u8 *msg, u16 msglen)
+ {
+ 	struct i40e_hw *hw = &pf->hw;
+-	int local_vf_id = vf_id - hw->func_caps.vf_base_id;
++	unsigned int local_vf_id = vf_id - hw->func_caps.vf_base_id;
+ 	struct i40e_vf *vf;
+ 	int ret;
+ 
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 46d31a49f5ea..d9c7eb279141 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -1014,6 +1014,12 @@ static void igb_reset_q_vector(struct igb_adapter *adapter, int v_idx)
+ {
+ 	struct igb_q_vector *q_vector = adapter->q_vector[v_idx];
+ 
++	/* Coming from igb_set_interrupt_capability, the vectors are not yet
++	 * allocated. So, q_vector is NULL so we should stop here.
++	 */
++	if (!q_vector)
++		return;
++
+ 	if (q_vector->tx.ring)
+ 		adapter->tx_ring[q_vector->tx.ring->queue_index] = NULL;
+ 
+@@ -1121,6 +1127,7 @@ static void igb_set_interrupt_capability(struct igb_adapter *adapter, bool msix)
+ 
+ 	/* If we can't do MSI-X, try MSI */
+ msi_only:
++	adapter->flags &= ~IGB_FLAG_HAS_MSIX;
+ #ifdef CONFIG_PCI_IOV
+ 	/* disable SR-IOV for non MSI-X configurations */
+ 	if (adapter->vf_data) {
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+index 925034b80e9c..93598cd7ee6a 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+@@ -426,6 +426,12 @@ static int brcms_ops_start(struct ieee80211_hw *hw)
+ 	bool blocked;
+ 	int err;
+ 
++	if (!wl->ucode.bcm43xx_bomminor) {
++		err = brcms_request_fw(wl, wl->wlc->hw->d11core);
++		if (err)
++			return -ENOENT;
++	}
++
+ 	ieee80211_wake_queues(hw);
+ 	spin_lock_bh(&wl->lock);
+ 	blocked = brcms_rfkill_set_hw_state(wl);
+@@ -433,14 +439,6 @@ static int brcms_ops_start(struct ieee80211_hw *hw)
+ 	if (!blocked)
+ 		wiphy_rfkill_stop_polling(wl->pub->ieee_hw->wiphy);
+ 
+-	if (!wl->ucode.bcm43xx_bomminor) {
+-		err = brcms_request_fw(wl, wl->wlc->hw->d11core);
+-		if (err) {
+-			brcms_remove(wl->wlc->hw->d11core);
+-			return -ENOENT;
+-		}
+-	}
+-
+ 	spin_lock_bh(&wl->lock);
+ 	/* avoid acknowledging frames before a non-monitor device is added */
+ 	wl->mute_tx = true;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
+index 2a59da2ff87a..e1d546665ae8 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
+@@ -67,8 +67,8 @@
+ #include "iwl-agn-hw.h"
+ 
+ /* Highest firmware API version supported */
+-#define IWL7260_UCODE_API_MAX	8
+-#define IWL3160_UCODE_API_MAX	8
++#define IWL7260_UCODE_API_MAX	9
++#define IWL3160_UCODE_API_MAX	9
+ 
+ /* Oldest version we won't warn about */
+ #define IWL7260_UCODE_API_OK	7
+@@ -223,3 +223,4 @@ const struct iwl_cfg iwl7265_n_cfg = {
+ 
+ MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+ MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
++MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+index 18a895a949d4..6b22681068a7 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
++++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+@@ -188,7 +188,7 @@ static const __le32 iwl_combined_lookup[BT_COEX_MAX_LUT][BT_COEX_LUT_SIZE] = {
+ 		cpu_to_le32(0xcc00aaaa),
+ 		cpu_to_le32(0x0000aaaa),
+ 		cpu_to_le32(0xc0004000),
+-		cpu_to_le32(0x00000000),
++		cpu_to_le32(0x00004000),
+ 		cpu_to_le32(0xf0005000),
+ 		cpu_to_le32(0xf0005000),
+ 	},
+@@ -211,16 +211,16 @@ static const __le32 iwl_combined_lookup[BT_COEX_MAX_LUT][BT_COEX_LUT_SIZE] = {
+ 		/* Tx Tx disabled */
+ 		cpu_to_le32(0xaaaaaaaa),
+ 		cpu_to_le32(0xaaaaaaaa),
+-		cpu_to_le32(0xaaaaaaaa),
++		cpu_to_le32(0xeeaaaaaa),
+ 		cpu_to_le32(0xaaaaaaaa),
+ 		cpu_to_le32(0xcc00ff28),
+ 		cpu_to_le32(0x0000aaaa),
+ 		cpu_to_le32(0xcc00aaaa),
+ 		cpu_to_le32(0x0000aaaa),
+-		cpu_to_le32(0xC0004000),
+-		cpu_to_le32(0xC0004000),
+-		cpu_to_le32(0xF0005000),
+-		cpu_to_le32(0xF0005000),
++		cpu_to_le32(0xc0004000),
++		cpu_to_le32(0xc0004000),
++		cpu_to_le32(0xf0005000),
++		cpu_to_le32(0xf0005000),
+ 	},
+ };
+ 
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index 9a856e5031f1..d06414ef15c5 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -606,7 +606,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
+ 	if (ret)
+ 		goto out_remove_mac;
+ 
+-	if (!mvm->bf_allowed_vif &&
++	if (!mvm->bf_allowed_vif && false &&
+ 	    vif->type == NL80211_IFTYPE_STATION && !vif->p2p &&
+ 	    mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BF_UPDATED){
+ 		mvm->bf_allowed_vif = mvmvif;
+@@ -796,7 +796,7 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
+ 	memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
+ 	len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
+ 
+-	ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_SYNC, len, cmd);
++	ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_ASYNC, len, cmd);
+ 	if (ret)
+ 		IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
+ }
+@@ -812,7 +812,7 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
+ 	if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
+ 		return;
+ 
+-	ieee80211_iterate_active_interfaces(
++	ieee80211_iterate_active_interfaces_atomic(
+ 		mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+ 		iwl_mvm_mc_iface_iterator, &iter_data);
+ }
+@@ -971,6 +971,7 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
+ 		 */
+ 		iwl_mvm_remove_time_event(mvm, mvmvif,
+ 					  &mvmvif->time_event_data);
++		iwl_mvm_sf_update(mvm, vif, false);
+ 	} else if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS |
+ 			      BSS_CHANGED_QOS)) {
+ 		ret = iwl_mvm_power_update_mode(mvm, vif);
+diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
+index 5bc871513505..03179d0b08c2 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
+@@ -59,7 +59,7 @@
+ /* max allowed rate miss before sync LQ cmd */
+ #define IWL_MISSED_RATE_MAX		15
+ #define RS_STAY_IN_COLUMN_TIMEOUT       (5*HZ)
+-
++#define RS_IDLE_TIMEOUT                 (5*HZ)
+ 
+ static u8 rs_ht_to_legacy[] = {
+ 	[IWL_RATE_MCS_0_INDEX] = IWL_RATE_6M_INDEX,
+@@ -142,7 +142,7 @@ enum rs_column_mode {
+ 	RS_MIMO2,
+ };
+ 
+-#define MAX_NEXT_COLUMNS 5
++#define MAX_NEXT_COLUMNS 7
+ #define MAX_COLUMN_CHECKS 3
+ 
+ typedef bool (*allow_column_func_t) (struct iwl_mvm *mvm,
+@@ -212,8 +212,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_LEGACY_ANT_B,
+ 			RS_COLUMN_SISO_ANT_A,
+ 			RS_COLUMN_SISO_ANT_B,
+-			RS_COLUMN_MIMO2,
+-			RS_COLUMN_MIMO2_SGI,
++			RS_COLUMN_INVALID,
++			RS_COLUMN_INVALID,
++			RS_COLUMN_INVALID,
++			RS_COLUMN_INVALID,
+ 		},
+ 	},
+ 	[RS_COLUMN_LEGACY_ANT_B] = {
+@@ -223,8 +225,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_LEGACY_ANT_A,
+ 			RS_COLUMN_SISO_ANT_A,
+ 			RS_COLUMN_SISO_ANT_B,
+-			RS_COLUMN_MIMO2,
+-			RS_COLUMN_MIMO2_SGI,
++			RS_COLUMN_INVALID,
++			RS_COLUMN_INVALID,
++			RS_COLUMN_INVALID,
++			RS_COLUMN_INVALID,
+ 		},
+ 	},
+ 	[RS_COLUMN_SISO_ANT_A] = {
+@@ -235,7 +239,9 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_MIMO2,
+ 			RS_COLUMN_SISO_ANT_A_SGI,
+ 			RS_COLUMN_SISO_ANT_B_SGI,
+-			RS_COLUMN_MIMO2_SGI,
++			RS_COLUMN_LEGACY_ANT_A,
++			RS_COLUMN_LEGACY_ANT_B,
++			RS_COLUMN_INVALID,
+ 		},
+ 		.checks = {
+ 			rs_siso_allow,
+@@ -249,7 +255,9 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_MIMO2,
+ 			RS_COLUMN_SISO_ANT_B_SGI,
+ 			RS_COLUMN_SISO_ANT_A_SGI,
+-			RS_COLUMN_MIMO2_SGI,
++			RS_COLUMN_LEGACY_ANT_A,
++			RS_COLUMN_LEGACY_ANT_B,
++			RS_COLUMN_INVALID,
+ 		},
+ 		.checks = {
+ 			rs_siso_allow,
+@@ -265,6 +273,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_SISO_ANT_A,
+ 			RS_COLUMN_SISO_ANT_B,
+ 			RS_COLUMN_MIMO2,
++			RS_COLUMN_LEGACY_ANT_A,
++			RS_COLUMN_LEGACY_ANT_B,
+ 		},
+ 		.checks = {
+ 			rs_siso_allow,
+@@ -281,6 +291,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_SISO_ANT_B,
+ 			RS_COLUMN_SISO_ANT_A,
+ 			RS_COLUMN_MIMO2,
++			RS_COLUMN_LEGACY_ANT_A,
++			RS_COLUMN_LEGACY_ANT_B,
+ 		},
+ 		.checks = {
+ 			rs_siso_allow,
+@@ -296,6 +308,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_SISO_ANT_A_SGI,
+ 			RS_COLUMN_SISO_ANT_B_SGI,
+ 			RS_COLUMN_MIMO2_SGI,
++			RS_COLUMN_LEGACY_ANT_A,
++			RS_COLUMN_LEGACY_ANT_B,
+ 		},
+ 		.checks = {
+ 			rs_mimo_allow,
+@@ -311,6 +325,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_SISO_ANT_A,
+ 			RS_COLUMN_SISO_ANT_B,
+ 			RS_COLUMN_MIMO2,
++			RS_COLUMN_LEGACY_ANT_A,
++			RS_COLUMN_LEGACY_ANT_B,
+ 		},
+ 		.checks = {
+ 			rs_mimo_allow,
+@@ -503,6 +519,16 @@ static void rs_rate_scale_clear_window(struct iwl_rate_scale_data *window)
+ 	window->average_tpt = IWL_INVALID_VALUE;
+ }
+ 
++static void rs_rate_scale_clear_tbl_windows(struct iwl_mvm *mvm,
++					    struct iwl_scale_tbl_info *tbl)
++{
++	int i;
++
++	IWL_DEBUG_RATE(mvm, "Clearing up window stats\n");
++	for (i = 0; i < IWL_RATE_COUNT; i++)
++		rs_rate_scale_clear_window(&tbl->win[i]);
++}
++
+ static inline u8 rs_is_valid_ant(u8 valid_antenna, u8 ant_type)
+ {
+ 	return (ant_type & valid_antenna) == ant_type;
+@@ -975,6 +1001,13 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
+ 		return;
+ 	}
+ 
++#ifdef CPTCFG_MAC80211_DEBUGFS
++	/* Disable last tx check if we are debugging with fixed rate */
++	if (lq_sta->dbg_fixed_rate) {
++		IWL_DEBUG_RATE(mvm, "Fixed rate. avoid rate scaling\n");
++		return;
++	}
++#endif
+ 	if (!ieee80211_is_data(hdr->frame_control) ||
+ 	    info->flags & IEEE80211_TX_CTL_NO_ACK)
+ 		return;
+@@ -1017,6 +1050,18 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
+ 			mac_index++;
+ 	}
+ 
++	if (time_after(jiffies,
++		       (unsigned long)(lq_sta->last_tx + RS_IDLE_TIMEOUT))) {
++		int tid;
++		IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n");
++		for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++)
++			ieee80211_stop_tx_ba_session(sta, tid);
++
++		iwl_mvm_rs_rate_init(mvm, sta, sband->band, false);
++		return;
++	}
++	lq_sta->last_tx = jiffies;
++
+ 	/* Here we actually compare this rate to the latest LQ command */
+ 	if ((mac_index < 0) ||
+ 	    (rate.sgi != !!(mac_flags & IEEE80211_TX_RC_SHORT_GI)) ||
+@@ -1362,7 +1407,6 @@ static u32 rs_bw_from_sta_bw(struct ieee80211_sta *sta)
+ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
+ {
+ 	struct iwl_scale_tbl_info *tbl;
+-	int i;
+ 	int active_tbl;
+ 	int flush_interval_passed = 0;
+ 	struct iwl_mvm *mvm;
+@@ -1423,9 +1467,7 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
+ 
+ 				IWL_DEBUG_RATE(mvm,
+ 					       "LQ: stay in table clear win\n");
+-				for (i = 0; i < IWL_RATE_COUNT; i++)
+-					rs_rate_scale_clear_window(
+-						&(tbl->win[i]));
++				rs_rate_scale_clear_tbl_windows(mvm, tbl);
+ 			}
+ 		}
+ 
+@@ -1433,9 +1475,7 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
+ 		 * bitmaps and stats in active table (this will become the new
+ 		 * "search" table). */
+ 		if (lq_sta->rs_state == RS_STATE_SEARCH_CYCLE_STARTED) {
+-			IWL_DEBUG_RATE(mvm, "Clearing up window stats\n");
+-			for (i = 0; i < IWL_RATE_COUNT; i++)
+-				rs_rate_scale_clear_window(&(tbl->win[i]));
++			rs_rate_scale_clear_tbl_windows(mvm, tbl);
+ 		}
+ 	}
+ }
+@@ -1628,85 +1668,76 @@ static enum rs_action rs_get_rate_action(struct iwl_mvm *mvm,
+ {
+ 	enum rs_action action = RS_ACTION_STAY;
+ 
+-	/* Too many failures, decrease rate */
+ 	if ((sr <= RS_SR_FORCE_DECREASE) || (current_tpt == 0)) {
+ 		IWL_DEBUG_RATE(mvm,
+-			       "decrease rate because of low SR\n");
+-		action = RS_ACTION_DOWNSCALE;
+-	/* No throughput measured yet for adjacent rates; try increase. */
+-	} else if ((low_tpt == IWL_INVALID_VALUE) &&
+-		   (high_tpt == IWL_INVALID_VALUE)) {
+-		if (high != IWL_RATE_INVALID && sr >= IWL_RATE_INCREASE_TH) {
+-			IWL_DEBUG_RATE(mvm,
+-				       "Good SR and no high rate measurement. "
+-				       "Increase rate\n");
+-			action = RS_ACTION_UPSCALE;
+-		} else if (low != IWL_RATE_INVALID) {
+-			IWL_DEBUG_RATE(mvm,
+-				       "Remain in current rate\n");
+-			action = RS_ACTION_STAY;
+-		}
++			       "Decrease rate because of low SR\n");
++		return RS_ACTION_DOWNSCALE;
+ 	}
+ 
+-	/* Both adjacent throughputs are measured, but neither one has better
+-	 * throughput; we're using the best rate, don't change it!
+-	 */
+-	else if ((low_tpt != IWL_INVALID_VALUE) &&
+-		 (high_tpt != IWL_INVALID_VALUE) &&
+-		 (low_tpt < current_tpt) &&
+-		 (high_tpt < current_tpt)) {
++	if ((low_tpt == IWL_INVALID_VALUE) &&
++	    (high_tpt == IWL_INVALID_VALUE) &&
++	    (high != IWL_RATE_INVALID)) {
+ 		IWL_DEBUG_RATE(mvm,
+-			       "Both high and low are worse. "
+-			       "Maintain rate\n");
+-		action = RS_ACTION_STAY;
++			       "No data about high/low rates. Increase rate\n");
++		return RS_ACTION_UPSCALE;
+ 	}
+ 
+-	/* At least one adjacent rate's throughput is measured,
+-	 * and may have better performance.
+-	 */
+-	else {
+-		/* Higher adjacent rate's throughput is measured */
+-		if (high_tpt != IWL_INVALID_VALUE) {
+-			/* Higher rate has better throughput */
+-			if (high_tpt > current_tpt &&
+-			    sr >= IWL_RATE_INCREASE_TH) {
+-				IWL_DEBUG_RATE(mvm,
+-					       "Higher rate is better and good "
+-					       "SR. Increate rate\n");
+-				action = RS_ACTION_UPSCALE;
+-			} else {
+-				IWL_DEBUG_RATE(mvm,
+-					       "Higher rate isn't better OR "
+-					       "no good SR. Maintain rate\n");
+-				action = RS_ACTION_STAY;
+-			}
++	if ((high_tpt == IWL_INVALID_VALUE) &&
++	    (high != IWL_RATE_INVALID) &&
++	    (low_tpt != IWL_INVALID_VALUE) &&
++	    (low_tpt < current_tpt)) {
++		IWL_DEBUG_RATE(mvm,
++			       "No data about high rate and low rate is worse. Increase rate\n");
++		return RS_ACTION_UPSCALE;
++	}
+ 
+-		/* Lower adjacent rate's throughput is measured */
+-		} else if (low_tpt != IWL_INVALID_VALUE) {
+-			/* Lower rate has better throughput */
+-			if (low_tpt > current_tpt) {
+-				IWL_DEBUG_RATE(mvm,
+-					       "Lower rate is better. "
+-					       "Decrease rate\n");
+-				action = RS_ACTION_DOWNSCALE;
+-			} else if (sr >= IWL_RATE_INCREASE_TH) {
+-				IWL_DEBUG_RATE(mvm,
+-					       "Lower rate isn't better and "
+-					       "good SR. Increase rate\n");
+-				action = RS_ACTION_UPSCALE;
+-			}
+-		}
++	if ((high_tpt != IWL_INVALID_VALUE) &&
++	    (high_tpt > current_tpt)) {
++		IWL_DEBUG_RATE(mvm,
++			       "Higher rate is better. Increate rate\n");
++		return RS_ACTION_UPSCALE;
+ 	}
+ 
+-	/* Sanity check; asked for decrease, but success rate or throughput
+-	 * has been good at old rate.  Don't change it.
+-	 */
+-	if ((action == RS_ACTION_DOWNSCALE) && (low != IWL_RATE_INVALID) &&
+-	    ((sr > IWL_RATE_HIGH_TH) ||
+-	     (current_tpt > (100 * tbl->expected_tpt[low])))) {
++	if ((low_tpt != IWL_INVALID_VALUE) &&
++	    (high_tpt != IWL_INVALID_VALUE) &&
++	    (low_tpt < current_tpt) &&
++	    (high_tpt < current_tpt)) {
++		IWL_DEBUG_RATE(mvm,
++			       "Both high and low are worse. Maintain rate\n");
++		return RS_ACTION_STAY;
++	}
++
++	if ((low_tpt != IWL_INVALID_VALUE) &&
++	    (low_tpt > current_tpt)) {
+ 		IWL_DEBUG_RATE(mvm,
+-			       "Sanity check failed. Maintain rate\n");
+-		action = RS_ACTION_STAY;
++			       "Lower rate is better\n");
++		action = RS_ACTION_DOWNSCALE;
++		goto out;
++	}
++
++	if ((low_tpt == IWL_INVALID_VALUE) &&
++	    (low != IWL_RATE_INVALID)) {
++		IWL_DEBUG_RATE(mvm,
++			       "No data about lower rate\n");
++		action = RS_ACTION_DOWNSCALE;
++		goto out;
++	}
++
++	IWL_DEBUG_RATE(mvm, "Maintain rate\n");
++
++out:
++	if ((action == RS_ACTION_DOWNSCALE) && (low != IWL_RATE_INVALID)) {
++		if (sr >= RS_SR_NO_DECREASE) {
++			IWL_DEBUG_RATE(mvm,
++				       "SR is above NO DECREASE. Avoid downscale\n");
++			action = RS_ACTION_STAY;
++		} else if (current_tpt > (100 * tbl->expected_tpt[low])) {
++			IWL_DEBUG_RATE(mvm,
++				       "Current TPT is higher than max expected in low rate. Avoid downscale\n");
++			action = RS_ACTION_STAY;
++		} else {
++			IWL_DEBUG_RATE(mvm, "Decrease rate\n");
++		}
+ 	}
+ 
+ 	return action;
+@@ -1725,7 +1756,6 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
+ 	int low = IWL_RATE_INVALID;
+ 	int high = IWL_RATE_INVALID;
+ 	int index;
+-	int i;
+ 	struct iwl_rate_scale_data *window = NULL;
+ 	int current_tpt = IWL_INVALID_VALUE;
+ 	int low_tpt = IWL_INVALID_VALUE;
+@@ -1781,6 +1811,7 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
+ 			       "Aggregation changed: prev %d current %d. Update expected TPT table\n",
+ 			       prev_agg, lq_sta->is_agg);
+ 		rs_set_expected_tpt_table(lq_sta, tbl);
++		rs_rate_scale_clear_tbl_windows(mvm, tbl);
+ 	}
+ 
+ 	/* current tx rate */
+@@ -2010,8 +2041,7 @@ lq_update:
+ 		if (lq_sta->search_better_tbl) {
+ 			/* Access the "search" table, clear its history. */
+ 			tbl = &(lq_sta->lq_info[(1 - lq_sta->active_tbl)]);
+-			for (i = 0; i < IWL_RATE_COUNT; i++)
+-				rs_rate_scale_clear_window(&(tbl->win[i]));
++			rs_rate_scale_clear_tbl_windows(mvm, tbl);
+ 
+ 			/* Use new "search" start rate */
+ 			index = tbl->rate.index;
+@@ -2032,8 +2062,18 @@ lq_update:
+ 		 * stay with best antenna legacy modulation for a while
+ 		 * before next round of mode comparisons. */
+ 		tbl1 = &(lq_sta->lq_info[lq_sta->active_tbl]);
+-		if (is_legacy(&tbl1->rate) && !sta->ht_cap.ht_supported) {
++		if (is_legacy(&tbl1->rate)) {
+ 			IWL_DEBUG_RATE(mvm, "LQ: STAY in legacy table\n");
++
++			if (tid != IWL_MAX_TID_COUNT) {
++				tid_data = &sta_priv->tid_data[tid];
++				if (tid_data->state != IWL_AGG_OFF) {
++					IWL_DEBUG_RATE(mvm,
++						       "Stop aggregation on tid %d\n",
++						       tid);
++					ieee80211_stop_tx_ba_session(sta, tid);
++				}
++			}
+ 			rs_set_stay_in_table(mvm, 1, lq_sta);
+ 		} else {
+ 		/* If we're in an HT mode, and all 3 mode switch actions
+@@ -2265,10 +2305,10 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ 	lq_sta->lq.sta_id = sta_priv->sta_id;
+ 
+ 	for (j = 0; j < LQ_SIZE; j++)
+-		for (i = 0; i < IWL_RATE_COUNT; i++)
+-			rs_rate_scale_clear_window(&lq_sta->lq_info[j].win[i]);
++		rs_rate_scale_clear_tbl_windows(mvm, &lq_sta->lq_info[j]);
+ 
+ 	lq_sta->flush_timer = 0;
++	lq_sta->last_tx = jiffies;
+ 
+ 	IWL_DEBUG_RATE(mvm,
+ 		       "LQ: *** rate scale station global init for station %d ***\n",
+@@ -2469,6 +2509,7 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
+ 	if (is_siso(&rate)) {
+ 		num_rates = RS_SECONDARY_SISO_NUM_RATES;
+ 		num_retries = RS_SECONDARY_SISO_RETRIES;
++		lq_cmd->mimo_delim = index;
+ 	} else if (is_legacy(&rate)) {
+ 		num_rates = RS_SECONDARY_LEGACY_NUM_RATES;
+ 		num_retries = RS_LEGACY_RETRIES_PER_RATE;
+diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.h b/drivers/net/wireless/iwlwifi/mvm/rs.h
+index 7bc6404f6986..f23b68b8eeff 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
++++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
+@@ -156,6 +156,7 @@ enum {
+ #define IWL_RATE_HIGH_TH		10880	/*  85% */
+ #define IWL_RATE_INCREASE_TH		6400	/*  50% */
+ #define RS_SR_FORCE_DECREASE		1920	/*  15% */
++#define RS_SR_NO_DECREASE		10880	/*  85% */
+ 
+ #define LINK_QUAL_AGG_TIME_LIMIT_DEF	(4000) /* 4 milliseconds */
+ #define LINK_QUAL_AGG_TIME_LIMIT_MAX	(8000)
+@@ -310,6 +311,7 @@ struct iwl_lq_sta {
+ 	u32 visited_columns;    /* Bitmask marking which Tx columns were
+ 				 * explored during a search cycle
+ 				 */
++	u64 last_tx;
+ 	bool is_vht;
+ 	enum ieee80211_band band;
+ 
+diff --git a/drivers/net/wireless/iwlwifi/mvm/sf.c b/drivers/net/wireless/iwlwifi/mvm/sf.c
+index 8401627c0030..88809b2d1654 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/sf.c
++++ b/drivers/net/wireless/iwlwifi/mvm/sf.c
+@@ -274,7 +274,8 @@ int iwl_mvm_sf_update(struct iwl_mvm *mvm, struct ieee80211_vif *changed_vif,
+ 				return -EINVAL;
+ 			if (changed_vif->type != NL80211_IFTYPE_STATION) {
+ 				new_state = SF_UNINIT;
+-			} else if (changed_vif->bss_conf.assoc) {
++			} else if (changed_vif->bss_conf.assoc &&
++				   changed_vif->bss_conf.dtim_period) {
+ 				mvmvif = iwl_mvm_vif_from_mac80211(changed_vif);
+ 				sta_id = mvmvif->ap_sta_id;
+ 				new_state = SF_FULL_ON;
+diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
+index 3872ead75488..43e27a174430 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
+@@ -372,12 +372,14 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
+ 	{IWL_PCI_DEVICE(0x095A, 0x500A, iwl7265_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x095B, 0x5200, iwl7265_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x5002, iwl7265_n_cfg)},
++	{IWL_PCI_DEVICE(0x095A, 0x5102, iwl7265_n_cfg)},
+ 	{IWL_PCI_DEVICE(0x095B, 0x5202, iwl7265_n_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x9010, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x9012, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x9112, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x095A, 0x9200, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)},
+diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
+index f9507807b486..8d42fd9b0811 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -1563,6 +1563,10 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
+ 	 * PCI Tx retries from interfering with C3 CPU state */
+ 	pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00);
+ 
++	trans->dev = &pdev->dev;
++	trans_pcie->pci_dev = pdev;
++	iwl_disable_interrupts(trans);
++
+ 	err = pci_enable_msi(pdev);
+ 	if (err) {
+ 		dev_err(&pdev->dev, "pci_enable_msi failed(0X%x)\n", err);
+@@ -1574,8 +1578,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
+ 		}
+ 	}
+ 
+-	trans->dev = &pdev->dev;
+-	trans_pcie->pci_dev = pdev;
+ 	trans->hw_rev = iwl_read32(trans, CSR_HW_REV);
+ 	trans->hw_id = (pdev->device << 16) + pdev->subsystem_device;
+ 	snprintf(trans->hw_id_str, sizeof(trans->hw_id_str),
+@@ -1601,8 +1603,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
+ 		goto out_pci_disable_msi;
+ 	}
+ 
+-	trans_pcie->inta_mask = CSR_INI_SET_MASK;
+-
+ 	if (iwl_pcie_alloc_ict(trans))
+ 		goto out_free_cmd_pool;
+ 
+@@ -1614,6 +1614,8 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
+ 		goto out_free_ict;
+ 	}
+ 
++	trans_pcie->inta_mask = CSR_INI_SET_MASK;
++
+ 	return trans;
+ 
+ out_free_ict:
+diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
+index ddeb5a709aa3..a87ee9b6585a 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
+@@ -621,20 +621,18 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
+ 				      bss_conf->bssid);
+ 
+ 	/*
+-	 * Update the beacon. This is only required on USB devices. PCI
+-	 * devices fetch beacons periodically.
+-	 */
+-	if (changes & BSS_CHANGED_BEACON && rt2x00_is_usb(rt2x00dev))
+-		rt2x00queue_update_beacon(rt2x00dev, vif);
+-
+-	/*
+ 	 * Start/stop beaconing.
+ 	 */
+ 	if (changes & BSS_CHANGED_BEACON_ENABLED) {
+ 		if (!bss_conf->enable_beacon && intf->enable_beacon) {
+-			rt2x00queue_clear_beacon(rt2x00dev, vif);
+ 			rt2x00dev->intf_beaconing--;
+ 			intf->enable_beacon = false;
++			/*
++			 * Clear beacon in the H/W for this vif. This is needed
++			 * to disable beaconing on this particular interface
++			 * and keep it running on other interfaces.
++			 */
++			rt2x00queue_clear_beacon(rt2x00dev, vif);
+ 
+ 			if (rt2x00dev->intf_beaconing == 0) {
+ 				/*
+@@ -645,11 +643,15 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
+ 				rt2x00queue_stop_queue(rt2x00dev->bcn);
+ 				mutex_unlock(&intf->beacon_skb_mutex);
+ 			}
+-
+-
+ 		} else if (bss_conf->enable_beacon && !intf->enable_beacon) {
+ 			rt2x00dev->intf_beaconing++;
+ 			intf->enable_beacon = true;
++			/*
++			 * Upload beacon to the H/W. This is only required on
++			 * USB devices. PCI devices fetch beacons periodically.
++			 */
++			if (rt2x00_is_usb(rt2x00dev))
++				rt2x00queue_update_beacon(rt2x00dev, vif);
+ 
+ 			if (rt2x00dev->intf_beaconing == 1) {
+ 				/*
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+index cd17c642e746..472e592b32ec 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+@@ -1001,7 +1001,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
+ 	err = _rtl92cu_init_mac(hw);
+ 	if (err) {
+ 		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "init mac failed!\n");
+-		return err;
++		goto exit;
+ 	}
+ 	err = rtl92c_download_fw(hw);
+ 	if (err) {
+diff --git a/drivers/of/irq.c b/drivers/of/irq.c
+index 9bcf2cf19357..ca0189308d72 100644
+--- a/drivers/of/irq.c
++++ b/drivers/of/irq.c
+@@ -380,6 +380,32 @@ int of_irq_to_resource(struct device_node *dev, int index, struct resource *r)
+ EXPORT_SYMBOL_GPL(of_irq_to_resource);
+ 
+ /**
++ * of_irq_get - Decode a node's IRQ and return it as a Linux irq number
++ * @dev: pointer to device tree node
++ * @index: zero-based index of the irq
++ *
++ * Returns Linux irq number on success, or -EPROBE_DEFER if the irq domain
++ * is not yet created.
++ *
++ */
++int of_irq_get(struct device_node *dev, int index)
++{
++	int rc;
++	struct of_phandle_args oirq;
++	struct irq_domain *domain;
++
++	rc = of_irq_parse_one(dev, index, &oirq);
++	if (rc)
++		return rc;
++
++	domain = irq_find_host(oirq.np);
++	if (!domain)
++		return -EPROBE_DEFER;
++
++	return irq_create_of_mapping(&oirq);
++}
++
++/**
+  * of_irq_count - Count the number of IRQs a node uses
+  * @dev: pointer to device tree node
+  */
+diff --git a/drivers/of/platform.c b/drivers/of/platform.c
+index 404d1daebefa..bd47fbc53dc9 100644
+--- a/drivers/of/platform.c
++++ b/drivers/of/platform.c
+@@ -168,7 +168,9 @@ struct platform_device *of_device_alloc(struct device_node *np,
+ 			rc = of_address_to_resource(np, i, res);
+ 			WARN_ON(rc);
+ 		}
+-		WARN_ON(of_irq_to_resource_table(np, res, num_irq) != num_irq);
++		if (of_irq_to_resource_table(np, res, num_irq) != num_irq)
++			pr_debug("not all legacy IRQ resources mapped for %s\n",
++				 np->name);
+ 	}
+ 
+ 	dev->dev.of_node = of_node_get(np);
+diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
+index 05e352889868..483d9ad89705 100644
+--- a/drivers/pci/host/pci-mvebu.c
++++ b/drivers/pci/host/pci-mvebu.c
+@@ -291,6 +291,58 @@ static int mvebu_pcie_hw_wr_conf(struct mvebu_pcie_port *port,
+ 	return PCIBIOS_SUCCESSFUL;
+ }
+ 
++/*
++ * Remove windows, starting from the largest ones to the smallest
++ * ones.
++ */
++static void mvebu_pcie_del_windows(struct mvebu_pcie_port *port,
++				   phys_addr_t base, size_t size)
++{
++	while (size) {
++		size_t sz = 1 << (fls(size) - 1);
++
++		mvebu_mbus_del_window(base, sz);
++		base += sz;
++		size -= sz;
++	}
++}
++
++/*
++ * MBus windows can only have a power of two size, but PCI BARs do not
++ * have this constraint. Therefore, we have to split the PCI BAR into
++ * areas each having a power of two size. We start from the largest
++ * one (i.e highest order bit set in the size).
++ */
++static void mvebu_pcie_add_windows(struct mvebu_pcie_port *port,
++				   unsigned int target, unsigned int attribute,
++				   phys_addr_t base, size_t size,
++				   phys_addr_t remap)
++{
++	size_t size_mapped = 0;
++
++	while (size) {
++		size_t sz = 1 << (fls(size) - 1);
++		int ret;
++
++		ret = mvebu_mbus_add_window_remap_by_id(target, attribute, base,
++							sz, remap);
++		if (ret) {
++			dev_err(&port->pcie->pdev->dev,
++				"Could not create MBus window at 0x%x, size 0x%x: %d\n",
++				base, sz, ret);
++			mvebu_pcie_del_windows(port, base - size_mapped,
++					       size_mapped);
++			return;
++		}
++
++		size -= sz;
++		size_mapped += sz;
++		base += sz;
++		if (remap != MVEBU_MBUS_NO_REMAP)
++			remap += sz;
++	}
++}
++
+ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
+ {
+ 	phys_addr_t iobase;
+@@ -302,8 +354,8 @@ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
+ 
+ 		/* If a window was configured, remove it */
+ 		if (port->iowin_base) {
+-			mvebu_mbus_del_window(port->iowin_base,
+-					      port->iowin_size);
++			mvebu_pcie_del_windows(port, port->iowin_base,
++					       port->iowin_size);
+ 			port->iowin_base = 0;
+ 			port->iowin_size = 0;
+ 		}
+@@ -329,11 +381,11 @@ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
+ 	port->iowin_base = port->pcie->io.start + iobase;
+ 	port->iowin_size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) |
+ 			    (port->bridge.iolimitupper << 16)) -
+-			    iobase);
++			    iobase) + 1;
+ 
+-	mvebu_mbus_add_window_remap_by_id(port->io_target, port->io_attr,
+-					  port->iowin_base, port->iowin_size,
+-					  iobase);
++	mvebu_pcie_add_windows(port, port->io_target, port->io_attr,
++			       port->iowin_base, port->iowin_size,
++			       iobase);
+ }
+ 
+ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port)
+@@ -344,8 +396,8 @@ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port)
+ 
+ 		/* If a window was configured, remove it */
+ 		if (port->memwin_base) {
+-			mvebu_mbus_del_window(port->memwin_base,
+-					      port->memwin_size);
++			mvebu_pcie_del_windows(port, port->memwin_base,
++					       port->memwin_size);
+ 			port->memwin_base = 0;
+ 			port->memwin_size = 0;
+ 		}
+@@ -362,10 +414,11 @@ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port)
+ 	port->memwin_base  = ((port->bridge.membase & 0xFFF0) << 16);
+ 	port->memwin_size  =
+ 		(((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) -
+-		port->memwin_base;
++		port->memwin_base + 1;
+ 
+-	mvebu_mbus_add_window_by_id(port->mem_target, port->mem_attr,
+-				    port->memwin_base, port->memwin_size);
++	mvebu_pcie_add_windows(port, port->mem_target, port->mem_attr,
++			       port->memwin_base, port->memwin_size,
++			       MVEBU_MBUS_NO_REMAP);
+ }
+ 
+ /*
+@@ -721,14 +774,21 @@ static resource_size_t mvebu_pcie_align_resource(struct pci_dev *dev,
+ 
+ 	/*
+ 	 * On the PCI-to-PCI bridge side, the I/O windows must have at
+-	 * least a 64 KB size and be aligned on their size, and the
+-	 * memory windows must have at least a 1 MB size and be
+-	 * aligned on their size
++	 * least a 64 KB size and the memory windows must have at
++	 * least a 1 MB size. Moreover, MBus windows need to have a
++	 * base address aligned on their size, and their size must be
++	 * a power of two. This means that if the BAR doesn't have a
++	 * power of two size, several MBus windows will actually be
++	 * created. We need to ensure that the biggest MBus window
++	 * (which will be the first one) is aligned on its size, which
++	 * explains the rounddown_pow_of_two() being done here.
+ 	 */
+ 	if (res->flags & IORESOURCE_IO)
+-		return round_up(start, max_t(resource_size_t, SZ_64K, size));
++		return round_up(start, max_t(resource_size_t, SZ_64K,
++					     rounddown_pow_of_two(size)));
+ 	else if (res->flags & IORESOURCE_MEM)
+-		return round_up(start, max_t(resource_size_t, SZ_1M, size));
++		return round_up(start, max_t(resource_size_t, SZ_1M,
++					     rounddown_pow_of_two(size)));
+ 	else
+ 		return start;
+ }
+diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
+index 58499277903a..6efc2ec5e4db 100644
+--- a/drivers/pci/hotplug/shpchp_ctrl.c
++++ b/drivers/pci/hotplug/shpchp_ctrl.c
+@@ -282,8 +282,8 @@ static int board_added(struct slot *p_slot)
+ 		return WRONG_BUS_FREQUENCY;
+ 	}
+ 
+-	bsp = ctrl->pci_dev->bus->cur_bus_speed;
+-	msp = ctrl->pci_dev->bus->max_bus_speed;
++	bsp = ctrl->pci_dev->subordinate->cur_bus_speed;
++	msp = ctrl->pci_dev->subordinate->max_bus_speed;
+ 
+ 	/* Check if there are other slots or devices on the same bus */
+ 	if (!list_empty(&ctrl->pci_dev->subordinate->devices))
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index fdbc294821e6..33bb970980d2 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -3043,7 +3043,8 @@ int pci_wait_for_pending_transaction(struct pci_dev *dev)
+ 	if (!pci_is_pcie(dev))
+ 		return 1;
+ 
+-	return pci_wait_for_pending(dev, PCI_EXP_DEVSTA, PCI_EXP_DEVSTA_TRPND);
++	return pci_wait_for_pending(dev, pci_pcie_cap(dev) + PCI_EXP_DEVSTA,
++				    PCI_EXP_DEVSTA_TRPND);
+ }
+ EXPORT_SYMBOL(pci_wait_for_pending_transaction);
+ 
+@@ -3085,7 +3086,7 @@ static int pci_af_flr(struct pci_dev *dev, int probe)
+ 		return 0;
+ 
+ 	/* Wait for Transaction Pending bit clean */
+-	if (pci_wait_for_pending(dev, PCI_AF_STATUS, PCI_AF_STATUS_TP))
++	if (pci_wait_for_pending(dev, pos + PCI_AF_STATUS, PCI_AF_STATUS_TP))
+ 		goto clear;
+ 
+ 	dev_err(&dev->dev, "transaction is not cleared; "
+diff --git a/drivers/pnp/pnpacpi/core.c b/drivers/pnp/pnpacpi/core.c
+index 9f611cbbc294..c31aa07b3ba5 100644
+--- a/drivers/pnp/pnpacpi/core.c
++++ b/drivers/pnp/pnpacpi/core.c
+@@ -83,8 +83,7 @@ static int pnpacpi_set_resources(struct pnp_dev *dev)
+ {
+ 	struct acpi_device *acpi_dev;
+ 	acpi_handle handle;
+-	struct acpi_buffer buffer;
+-	int ret;
++	int ret = 0;
+ 
+ 	pnp_dbg(&dev->dev, "set resources\n");
+ 
+@@ -97,19 +96,26 @@ static int pnpacpi_set_resources(struct pnp_dev *dev)
+ 	if (WARN_ON_ONCE(acpi_dev != dev->data))
+ 		dev->data = acpi_dev;
+ 
+-	ret = pnpacpi_build_resource_template(dev, &buffer);
+-	if (ret)
+-		return ret;
+-	ret = pnpacpi_encode_resources(dev, &buffer);
+-	if (ret) {
++	if (acpi_has_method(handle, METHOD_NAME__SRS)) {
++		struct acpi_buffer buffer;
++
++		ret = pnpacpi_build_resource_template(dev, &buffer);
++		if (ret)
++			return ret;
++
++		ret = pnpacpi_encode_resources(dev, &buffer);
++		if (!ret) {
++			acpi_status status;
++
++			status = acpi_set_current_resources(handle, &buffer);
++			if (ACPI_FAILURE(status))
++				ret = -EIO;
++		}
+ 		kfree(buffer.pointer);
+-		return ret;
+ 	}
+-	if (ACPI_FAILURE(acpi_set_current_resources(handle, &buffer)))
+-		ret = -EINVAL;
+-	else if (acpi_bus_power_manageable(handle))
++	if (!ret && acpi_bus_power_manageable(handle))
+ 		ret = acpi_bus_set_power(handle, ACPI_STATE_D0);
+-	kfree(buffer.pointer);
++
+ 	return ret;
+ }
+ 
+@@ -117,7 +123,7 @@ static int pnpacpi_disable_resources(struct pnp_dev *dev)
+ {
+ 	struct acpi_device *acpi_dev;
+ 	acpi_handle handle;
+-	int ret;
++	acpi_status status;
+ 
+ 	dev_dbg(&dev->dev, "disable resources\n");
+ 
+@@ -128,13 +134,15 @@ static int pnpacpi_disable_resources(struct pnp_dev *dev)
+ 	}
+ 
+ 	/* acpi_unregister_gsi(pnp_irq(dev, 0)); */
+-	ret = 0;
+ 	if (acpi_bus_power_manageable(handle))
+ 		acpi_bus_set_power(handle, ACPI_STATE_D3_COLD);
+-		/* continue even if acpi_bus_set_power() fails */
+-	if (ACPI_FAILURE(acpi_evaluate_object(handle, "_DIS", NULL, NULL)))
+-		ret = -ENODEV;
+-	return ret;
++
++	/* continue even if acpi_bus_set_power() fails */
++	status = acpi_evaluate_object(handle, "_DIS", NULL, NULL);
++	if (ACPI_FAILURE(status) && status != AE_NOT_FOUND)
++		return -ENODEV;
++
++	return 0;
+ }
+ 
+ #ifdef CONFIG_ACPI_SLEEP
+diff --git a/drivers/rtc/rtc-hym8563.c b/drivers/rtc/rtc-hym8563.c
+index bd628a6f981d..e5f13c4310fe 100644
+--- a/drivers/rtc/rtc-hym8563.c
++++ b/drivers/rtc/rtc-hym8563.c
+@@ -569,6 +569,9 @@ static int hym8563_probe(struct i2c_client *client,
+ 	if (IS_ERR(hym8563->rtc))
+ 		return PTR_ERR(hym8563->rtc);
+ 
++	/* the hym8563 alarm only supports a minute accuracy */
++	hym8563->rtc->uie_unsupported = 1;
++
+ #ifdef CONFIG_COMMON_CLK
+ 	hym8563_clkout_register_clk(hym8563);
+ #endif
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index d0b28bba38be..fbf3b22efe5a 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1568,7 +1568,7 @@ EXPORT_SYMBOL_GPL(spi_busnum_to_master);
+  */
+ int spi_setup(struct spi_device *spi)
+ {
+-	unsigned	bad_bits;
++	unsigned	bad_bits, ugly_bits;
+ 	int		status = 0;
+ 
+ 	/* check mode to prevent that DUAL and QUAD set at the same time
+@@ -1588,6 +1588,15 @@ int spi_setup(struct spi_device *spi)
+ 	 * that aren't supported with their current master
+ 	 */
+ 	bad_bits = spi->mode & ~spi->master->mode_bits;
++	ugly_bits = bad_bits &
++		    (SPI_TX_DUAL | SPI_TX_QUAD | SPI_RX_DUAL | SPI_RX_QUAD);
++	if (ugly_bits) {
++		dev_warn(&spi->dev,
++			 "setup: ignoring unsupported mode bits %x\n",
++			 ugly_bits);
++		spi->mode &= ~ugly_bits;
++		bad_bits &= ~ugly_bits;
++	}
+ 	if (bad_bits) {
+ 		dev_err(&spi->dev, "setup: unsupported mode bits %x\n",
+ 			bad_bits);
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 7e5469a80fe3..86b92d95ac10 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1564,7 +1564,9 @@ int iscsit_process_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	 * Initiator is expecting a NopIN ping reply..
+ 	 */
+ 	if (hdr->itt != RESERVED_ITT) {
+-		BUG_ON(!cmd);
++		if (!cmd)
++			return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
++						(unsigned char *)hdr);
+ 
+ 		spin_lock_bh(&conn->cmd_lock);
+ 		list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index 65001e133670..26416c15d65c 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -798,10 +798,10 @@ int se_dev_set_emulate_write_cache(struct se_device *dev, int flag)
+ 		pr_err("emulate_write_cache not supported for pSCSI\n");
+ 		return -EINVAL;
+ 	}
+-	if (dev->transport->get_write_cache) {
+-		pr_warn("emulate_write_cache cannot be changed when underlying"
+-			" HW reports WriteCacheEnabled, ignoring request\n");
+-		return 0;
++	if (flag &&
++	    dev->transport->get_write_cache) {
++		pr_err("emulate_write_cache not supported for this device\n");
++		return -EINVAL;
+ 	}
+ 
+ 	dev->dev_attrib.emulate_write_cache = flag;
+@@ -936,6 +936,10 @@ int se_dev_set_pi_prot_type(struct se_device *dev, int flag)
+ 		return 0;
+ 	}
+ 	if (!dev->transport->init_prot || !dev->transport->free_prot) {
++		/* 0 is only allowed value for non-supporting backends */
++		if (flag == 0)
++			return 0;
++
+ 		pr_err("DIF protection not supported by backend: %s\n",
+ 		       dev->transport->name);
+ 		return -ENOSYS;
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 2956250b7225..98b48d400a3a 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1102,6 +1102,7 @@ void transport_init_se_cmd(
+ 	init_completion(&cmd->cmd_wait_comp);
+ 	init_completion(&cmd->task_stop_comp);
+ 	spin_lock_init(&cmd->t_state_lock);
++	kref_init(&cmd->cmd_kref);
+ 	cmd->transport_state = CMD_T_DEV_ACTIVE;
+ 
+ 	cmd->se_tfo = tfo;
+@@ -2292,7 +2293,6 @@ int target_get_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd,
+ 	unsigned long flags;
+ 	int ret = 0;
+ 
+-	kref_init(&se_cmd->cmd_kref);
+ 	/*
+ 	 * Add a second kref if the fabric caller is expecting to handle
+ 	 * fabric acknowledgement that requires two target_put_sess_cmd()
+diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
+index 8b2c1aaf81de..d22cdc77e9d4 100644
+--- a/drivers/target/tcm_fc/tfc_cmd.c
++++ b/drivers/target/tcm_fc/tfc_cmd.c
+@@ -90,18 +90,18 @@ static void ft_free_cmd(struct ft_cmd *cmd)
+ {
+ 	struct fc_frame *fp;
+ 	struct fc_lport *lport;
+-	struct se_session *se_sess;
++	struct ft_sess *sess;
+ 
+ 	if (!cmd)
+ 		return;
+-	se_sess = cmd->sess->se_sess;
++	sess = cmd->sess;
+ 	fp = cmd->req_frame;
+ 	lport = fr_dev(fp);
+ 	if (fr_seq(fp))
+ 		lport->tt.seq_release(fr_seq(fp));
+ 	fc_frame_free(fp);
+-	percpu_ida_free(&se_sess->sess_tag_pool, cmd->se_cmd.map_tag);
+-	ft_sess_put(cmd->sess);	/* undo get from lookup at recv */
++	percpu_ida_free(&sess->se_sess->sess_tag_pool, cmd->se_cmd.map_tag);
++	ft_sess_put(sess);	/* undo get from lookup at recv */
+ }
+ 
+ void ft_release_cmd(struct se_cmd *se_cmd)
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index 2798a23a0834..29a7f632b354 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -1520,7 +1520,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ 			status = serial8250_rx_chars(up, status);
+ 	}
+ 	serial8250_modem_status(up);
+-	if (status & UART_LSR_THRE)
++	if (!up->dma && (status & UART_LSR_THRE))
+ 		serial8250_tx_chars(up);
+ 
+ 	spin_unlock_irqrestore(&port->lock, flags);
+diff --git a/drivers/tty/serial/8250/8250_dma.c b/drivers/tty/serial/8250/8250_dma.c
+index 7046769608d4..ab9096dc3849 100644
+--- a/drivers/tty/serial/8250/8250_dma.c
++++ b/drivers/tty/serial/8250/8250_dma.c
+@@ -20,12 +20,15 @@ static void __dma_tx_complete(void *param)
+ 	struct uart_8250_port	*p = param;
+ 	struct uart_8250_dma	*dma = p->dma;
+ 	struct circ_buf		*xmit = &p->port.state->xmit;
+-
+-	dma->tx_running = 0;
++	unsigned long	flags;
+ 
+ 	dma_sync_single_for_cpu(dma->txchan->device->dev, dma->tx_addr,
+ 				UART_XMIT_SIZE, DMA_TO_DEVICE);
+ 
++	spin_lock_irqsave(&p->port.lock, flags);
++
++	dma->tx_running = 0;
++
+ 	xmit->tail += dma->tx_size;
+ 	xmit->tail &= UART_XMIT_SIZE - 1;
+ 	p->port.icount.tx += dma->tx_size;
+@@ -35,6 +38,8 @@ static void __dma_tx_complete(void *param)
+ 
+ 	if (!uart_circ_empty(xmit) && !uart_tx_stopped(&p->port))
+ 		serial8250_tx_dma(p);
++
++	spin_unlock_irqrestore(&p->port.lock, flags);
+ }
+ 
+ static void __dma_rx_complete(void *param)
+diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
+index cea8c20a1425..1926925a52a9 100644
+--- a/drivers/usb/gadget/at91_udc.c
++++ b/drivers/usb/gadget/at91_udc.c
+@@ -1709,16 +1709,6 @@ static int at91udc_probe(struct platform_device *pdev)
+ 		return -ENODEV;
+ 	}
+ 
+-	if (pdev->num_resources != 2) {
+-		DBG("invalid num_resources\n");
+-		return -ENODEV;
+-	}
+-	if ((pdev->resource[0].flags != IORESOURCE_MEM)
+-			|| (pdev->resource[1].flags != IORESOURCE_IRQ)) {
+-		DBG("invalid resource type\n");
+-		return -ENODEV;
+-	}
+-
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	if (!res)
+ 		return -ENXIO;
+diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
+index 6f2c8d3899d2..cf2734b532a7 100644
+--- a/drivers/usb/host/ehci-fsl.c
++++ b/drivers/usb/host/ehci-fsl.c
+@@ -248,7 +248,8 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
+ 		break;
+ 	}
+ 
+-	if (pdata->have_sysif_regs && pdata->controller_ver &&
++	if (pdata->have_sysif_regs &&
++	    pdata->controller_ver > FSL_USB_VER_1_6 &&
+ 	    (phy_mode == FSL_USB2_PHY_ULPI)) {
+ 		/* check PHY_CLK_VALID to get phy clk valid */
+ 		if (!(spin_event_timeout(in_be32(non_ehci + FSL_SOC_USB_CTRL) &
+diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
+index c81c8721cc5a..cd871b895013 100644
+--- a/drivers/usb/host/ohci-hub.c
++++ b/drivers/usb/host/ohci-hub.c
+@@ -90,6 +90,24 @@ __acquires(ohci->lock)
+ 	dl_done_list (ohci);
+ 	finish_unlinks (ohci, ohci_frame_no(ohci));
+ 
++	/*
++	 * Some controllers don't handle "global" suspend properly if
++	 * there are unsuspended ports.  For these controllers, put all
++	 * the enabled ports into suspend before suspending the root hub.
++	 */
++	if (ohci->flags & OHCI_QUIRK_GLOBAL_SUSPEND) {
++		__hc32 __iomem	*portstat = ohci->regs->roothub.portstatus;
++		int		i;
++		unsigned	temp;
++
++		for (i = 0; i < ohci->num_ports; (++i, ++portstat)) {
++			temp = ohci_readl(ohci, portstat);
++			if ((temp & (RH_PS_PES | RH_PS_PSS)) ==
++					RH_PS_PES)
++				ohci_writel(ohci, RH_PS_PSS, portstat);
++		}
++	}
++
+ 	/* maybe resume can wake root hub */
+ 	if (ohci_to_hcd(ohci)->self.root_hub->do_remote_wakeup || autostop) {
+ 		ohci->hc_control |= OHCI_CTRL_RWE;
+diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
+index 90879e9ccbec..bb1509675727 100644
+--- a/drivers/usb/host/ohci-pci.c
++++ b/drivers/usb/host/ohci-pci.c
+@@ -160,6 +160,7 @@ static int ohci_quirk_amd700(struct usb_hcd *hcd)
+ 		ohci_dbg(ohci, "enabled AMD prefetch quirk\n");
+ 	}
+ 
++	ohci->flags |= OHCI_QUIRK_GLOBAL_SUSPEND;
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/host/ohci.h b/drivers/usb/host/ohci.h
+index 9250cada13f0..4550ce05af7f 100644
+--- a/drivers/usb/host/ohci.h
++++ b/drivers/usb/host/ohci.h
+@@ -405,6 +405,8 @@ struct ohci_hcd {
+ #define	OHCI_QUIRK_HUB_POWER	0x100			/* distrust firmware power/oc setup */
+ #define	OHCI_QUIRK_AMD_PLL	0x200			/* AMD PLL quirk*/
+ #define	OHCI_QUIRK_AMD_PREFETCH	0x400			/* pre-fetch for ISO transfer */
++#define	OHCI_QUIRK_GLOBAL_SUSPEND	0x800		/* must suspend ports */
++
+ 	// there are also chip quirks/bugs in init logic
+ 
+ 	struct work_struct	nec_work;	/* Worker for NEC quirk */
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index 7ed681a714a5..6c0a542e8ec1 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -151,6 +151,21 @@ static const struct usb_device_id id_table[] = {
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 0)},	/* Netgear AirCard 340U Device Management */
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 2)},	/* Netgear AirCard 340U NMEA */
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 3)},	/* Netgear AirCard 340U Modem */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 0)},	/* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card Device Management */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 2)},	/* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card NMEA */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 3)},	/* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card Modem */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 0)},	/* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card Device Management */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 2)},	/* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card NMEA */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 3)},	/* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card Modem */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 0)},	/* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card Device Management */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 2)},	/* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card NMEA */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 3)},	/* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card Modem */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 0)},	/* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card Device Management */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 2)},	/* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card NMEA */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 3)},	/* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card Modem */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 0)},	/* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card Device Management */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 2)},	/* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card NMEA */
++	{USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 3)},	/* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card Modem */
+ 
+ 	{ }				/* Terminating entry */
+ };
+diff --git a/drivers/usb/storage/shuttle_usbat.c b/drivers/usb/storage/shuttle_usbat.c
+index 4ef2a80728f7..008d805c3d21 100644
+--- a/drivers/usb/storage/shuttle_usbat.c
++++ b/drivers/usb/storage/shuttle_usbat.c
+@@ -1851,7 +1851,7 @@ static int usbat_probe(struct usb_interface *intf,
+ 	us->transport_name = "Shuttle USBAT";
+ 	us->transport = usbat_flash_transport;
+ 	us->transport_reset = usb_stor_CB_reset;
+-	us->max_lun = 1;
++	us->max_lun = 0;
+ 
+ 	result = usb_stor_probe2(us);
+ 	return result;
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index adbeb255616a..042c83b01046 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -234,6 +234,20 @@ UNUSUAL_DEV(  0x0421, 0x0495, 0x0370, 0x0370,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_MAX_SECTORS_64 ),
+ 
++/* Reported by Daniele Forsi <dforsi@×××××.com> */
++UNUSUAL_DEV(  0x0421, 0x04b9, 0x0350, 0x0350,
++		"Nokia",
++		"5300",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_MAX_SECTORS_64 ),
++
++/* Patch submitted by Victor A. Santos <victoraur.santos@×××××.com> */
++UNUSUAL_DEV(  0x0421, 0x05af, 0x0742, 0x0742,
++		"Nokia",
++		"305",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_MAX_SECTORS_64),
++
+ /* Patch submitted by Mikhail Zolotaryov <lebon@×××××××××.ua> */
+ UNUSUAL_DEV(  0x0421, 0x06aa, 0x1110, 0x1110,
+ 		"Nokia",
+diff --git a/fs/affs/super.c b/fs/affs/super.c
+index d098731b82ff..9a5b19dc899d 100644
+--- a/fs/affs/super.c
++++ b/fs/affs/super.c
+@@ -336,8 +336,6 @@ static int affs_fill_super(struct super_block *sb, void *data, int silent)
+ 				&blocksize,&sbi->s_prefix,
+ 				sbi->s_volume, &mount_flags)) {
+ 		printk(KERN_ERR "AFFS: Error parsing options\n");
+-		kfree(sbi->s_prefix);
+-		kfree(sbi);
+ 		return -EINVAL;
+ 	}
+ 	/* N.B. after this point s_prefix must be released */
+diff --git a/fs/aio.c b/fs/aio.c
+index 12a3de0ee6da..04cd7686555d 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -1299,10 +1299,8 @@ rw_common:
+ 						&iovec, compat)
+ 			: aio_setup_single_vector(req, rw, buf, &nr_segs,
+ 						  iovec);
+-		if (ret)
+-			return ret;
+-
+-		ret = rw_verify_area(rw, file, &req->ki_pos, req->ki_nbytes);
++		if (!ret)
++			ret = rw_verify_area(rw, file, &req->ki_pos, req->ki_nbytes);
+ 		if (ret < 0) {
+ 			if (iovec != &inline_vec)
+ 				kfree(iovec);
+diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
+index 2caf36ac3e93..cc87c1abac97 100644
+--- a/fs/autofs4/root.c
++++ b/fs/autofs4/root.c
+@@ -179,7 +179,7 @@ static struct dentry *autofs4_lookup_active(struct dentry *dentry)
+ 		spin_lock(&active->d_lock);
+ 
+ 		/* Already gone? */
+-		if (!d_count(active))
++		if ((int) d_count(active) <= 0)
+ 			goto next;
+ 
+ 		qstr = &active->d_name;
+@@ -230,7 +230,7 @@ static struct dentry *autofs4_lookup_expiring(struct dentry *dentry)
+ 
+ 		spin_lock(&expiring->d_lock);
+ 
+-		/* Bad luck, we've already been dentry_iput */
++		/* We've already been dentry_iput or unlinked */
+ 		if (!expiring->d_inode)
+ 			goto next;
+ 
+diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
+index 45eda6d7a40c..5e0982aa7000 100644
+--- a/fs/ceph/dir.c
++++ b/fs/ceph/dir.c
+@@ -446,7 +446,6 @@ more:
+ 	if (atomic_read(&ci->i_release_count) == fi->dir_release_count) {
+ 		dout(" marking %p complete\n", inode);
+ 		__ceph_dir_set_complete(ci, fi->dir_release_count);
+-		ci->i_max_offset = ctx->pos;
+ 	}
+ 	spin_unlock(&ci->i_ceph_lock);
+ 
+@@ -932,14 +931,16 @@ static int ceph_rename(struct inode *old_dir, struct dentry *old_dentry,
+ 		 * to do it here.
+ 		 */
+ 
+-		/* d_move screws up d_subdirs order */
+-		ceph_dir_clear_complete(new_dir);
+-
+ 		d_move(old_dentry, new_dentry);
+ 
+ 		/* ensure target dentry is invalidated, despite
+ 		   rehashing bug in vfs_rename_dir */
+ 		ceph_invalidate_dentry_lease(new_dentry);
++
++		/* d_move screws up sibling dentries' offsets */
++		ceph_dir_clear_complete(old_dir);
++		ceph_dir_clear_complete(new_dir);
++
+ 	}
+ 	ceph_mdsc_put_request(req);
+ 	return err;
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 32d519d8a2e2..6471f9c83428 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -752,7 +752,6 @@ static int fill_inode(struct inode *inode,
+ 	    !__ceph_dir_is_complete(ci)) {
+ 		dout(" marking %p complete (empty)\n", inode);
+ 		__ceph_dir_set_complete(ci, atomic_read(&ci->i_release_count));
+-		ci->i_max_offset = 2;
+ 	}
+ no_change:
+ 	spin_unlock(&ci->i_ceph_lock);
+@@ -890,41 +889,6 @@ out_unlock:
+ }
+ 
+ /*
+- * Set dentry's directory position based on the current dir's max, and
+- * order it in d_subdirs, so that dcache_readdir behaves.
+- *
+- * Always called under directory's i_mutex.
+- */
+-static void ceph_set_dentry_offset(struct dentry *dn)
+-{
+-	struct dentry *dir = dn->d_parent;
+-	struct inode *inode = dir->d_inode;
+-	struct ceph_inode_info *ci;
+-	struct ceph_dentry_info *di;
+-
+-	BUG_ON(!inode);
+-
+-	ci = ceph_inode(inode);
+-	di = ceph_dentry(dn);
+-
+-	spin_lock(&ci->i_ceph_lock);
+-	if (!__ceph_dir_is_complete(ci)) {
+-		spin_unlock(&ci->i_ceph_lock);
+-		return;
+-	}
+-	di->offset = ceph_inode(inode)->i_max_offset++;
+-	spin_unlock(&ci->i_ceph_lock);
+-
+-	spin_lock(&dir->d_lock);
+-	spin_lock_nested(&dn->d_lock, DENTRY_D_LOCK_NESTED);
+-	list_move(&dn->d_u.d_child, &dir->d_subdirs);
+-	dout("set_dentry_offset %p %lld (%p %p)\n", dn, di->offset,
+-	     dn->d_u.d_child.prev, dn->d_u.d_child.next);
+-	spin_unlock(&dn->d_lock);
+-	spin_unlock(&dir->d_lock);
+-}
+-
+-/*
+  * splice a dentry to an inode.
+  * caller must hold directory i_mutex for this to be safe.
+  *
+@@ -933,7 +897,7 @@ static void ceph_set_dentry_offset(struct dentry *dn)
+  * the caller) if we fail.
+  */
+ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in,
+-				    bool *prehash, bool set_offset)
++				    bool *prehash)
+ {
+ 	struct dentry *realdn;
+ 
+@@ -965,8 +929,6 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in,
+ 	}
+ 	if ((!prehash || *prehash) && d_unhashed(dn))
+ 		d_rehash(dn);
+-	if (set_offset)
+-		ceph_set_dentry_offset(dn);
+ out:
+ 	return dn;
+ }
+@@ -987,7 +949,6 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
+ {
+ 	struct ceph_mds_reply_info_parsed *rinfo = &req->r_reply_info;
+ 	struct inode *in = NULL;
+-	struct ceph_mds_reply_inode *ininfo;
+ 	struct ceph_vino vino;
+ 	struct ceph_fs_client *fsc = ceph_sb_to_client(sb);
+ 	int err = 0;
+@@ -1112,6 +1073,9 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
+ 
+ 		/* rename? */
+ 		if (req->r_old_dentry && req->r_op == CEPH_MDS_OP_RENAME) {
++			struct inode *olddir = req->r_old_dentry_dir;
++			BUG_ON(!olddir);
++
+ 			dout(" src %p '%.*s' dst %p '%.*s'\n",
+ 			     req->r_old_dentry,
+ 			     req->r_old_dentry->d_name.len,
+@@ -1131,13 +1095,10 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
+ 			   rehashing bug in vfs_rename_dir */
+ 			ceph_invalidate_dentry_lease(dn);
+ 
+-			/*
+-			 * d_move() puts the renamed dentry at the end of
+-			 * d_subdirs.  We need to assign it an appropriate
+-			 * directory offset so we can behave when dir is
+-			 * complete.
+-			 */
+-			ceph_set_dentry_offset(req->r_old_dentry);
++			/* d_move screws up sibling dentries' offsets */
++			ceph_dir_clear_complete(dir);
++			ceph_dir_clear_complete(olddir);
++
+ 			dout("dn %p gets new offset %lld\n", req->r_old_dentry,
+ 			     ceph_dentry(req->r_old_dentry)->offset);
+ 
+@@ -1164,8 +1125,9 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
+ 
+ 		/* attach proper inode */
+ 		if (!dn->d_inode) {
++			ceph_dir_clear_complete(dir);
+ 			ihold(in);
+-			dn = splice_dentry(dn, in, &have_lease, true);
++			dn = splice_dentry(dn, in, &have_lease);
+ 			if (IS_ERR(dn)) {
+ 				err = PTR_ERR(dn);
+ 				goto done;
+@@ -1186,17 +1148,16 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
+ 		   (req->r_op == CEPH_MDS_OP_LOOKUPSNAP ||
+ 		    req->r_op == CEPH_MDS_OP_MKSNAP)) {
+ 		struct dentry *dn = req->r_dentry;
++		struct inode *dir = req->r_locked_dir;
+ 
+ 		/* fill out a snapdir LOOKUPSNAP dentry */
+ 		BUG_ON(!dn);
+-		BUG_ON(!req->r_locked_dir);
+-		BUG_ON(ceph_snap(req->r_locked_dir) != CEPH_SNAPDIR);
+-		ininfo = rinfo->targeti.in;
+-		vino.ino = le64_to_cpu(ininfo->ino);
+-		vino.snap = le64_to_cpu(ininfo->snapid);
++		BUG_ON(!dir);
++		BUG_ON(ceph_snap(dir) != CEPH_SNAPDIR);
+ 		dout(" linking snapped dir %p to dn %p\n", in, dn);
++		ceph_dir_clear_complete(dir);
+ 		ihold(in);
+-		dn = splice_dentry(dn, in, NULL, true);
++		dn = splice_dentry(dn, in, NULL);
+ 		if (IS_ERR(dn)) {
+ 			err = PTR_ERR(dn);
+ 			goto done;
+@@ -1358,7 +1319,7 @@ retry_lookup:
+ 		}
+ 
+ 		if (!dn->d_inode) {
+-			dn = splice_dentry(dn, in, NULL, false);
++			dn = splice_dentry(dn, in, NULL);
+ 			if (IS_ERR(dn)) {
+ 				err = PTR_ERR(dn);
+ 				dn = NULL;
+diff --git a/fs/ceph/super.h b/fs/ceph/super.h
+index d8801a95b685..df2caa84b94f 100644
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -266,7 +266,6 @@ struct ceph_inode_info {
+ 	struct timespec i_rctime;
+ 	u64 i_rbytes, i_rfiles, i_rsubdirs;
+ 	u64 i_files, i_subdirs;
+-	u64 i_max_offset;  /* largest readdir offset, set with complete dir */
+ 
+ 	struct rb_root i_fragtree;
+ 	struct mutex i_fragtree_mutex;
+diff --git a/fs/coredump.c b/fs/coredump.c
+index e3ad709a4232..0b2528fb640e 100644
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -73,10 +73,15 @@ static int expand_corename(struct core_name *cn, int size)
+ static int cn_vprintf(struct core_name *cn, const char *fmt, va_list arg)
+ {
+ 	int free, need;
++	va_list arg_copy;
+ 
+ again:
+ 	free = cn->size - cn->used;
+-	need = vsnprintf(cn->corename + cn->used, free, fmt, arg);
++
++	va_copy(arg_copy, arg);
++	need = vsnprintf(cn->corename + cn->used, free, fmt, arg_copy);
++	va_end(arg_copy);
++
+ 	if (need < free) {
+ 		cn->used += need;
+ 		return 0;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index ca02c13a84aa..7f3b4004c6c3 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1647,8 +1647,7 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode)
+ 	unsigned add_flags = d_flags_for_inode(inode);
+ 
+ 	spin_lock(&dentry->d_lock);
+-	dentry->d_flags &= ~DCACHE_ENTRY_TYPE;
+-	dentry->d_flags |= add_flags;
++	__d_set_type(dentry, add_flags);
+ 	if (inode)
+ 		hlist_add_head(&dentry->d_alias, &inode->i_dentry);
+ 	dentry->d_inode = inode;
+diff --git a/fs/exec.c b/fs/exec.c
+index 3d78fccdd723..31e46b1b358b 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -654,10 +654,10 @@ int setup_arg_pages(struct linux_binprm *bprm,
+ 	unsigned long rlim_stack;
+ 
+ #ifdef CONFIG_STACK_GROWSUP
+-	/* Limit stack size to 1GB */
++	/* Limit stack size */
+ 	stack_base = rlimit_max(RLIMIT_STACK);
+-	if (stack_base > (1 << 30))
+-		stack_base = 1 << 30;
++	if (stack_base > STACK_SIZE_MAX)
++		stack_base = STACK_SIZE_MAX;
+ 
+ 	/* Make sure we didn't let the argument array grow too large. */
+ 	if (vma->vm_end - vma->vm_start > stack_base)
+diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
+index dbf397bfdff2..d29640b49be3 100644
+--- a/fs/kernfs/file.c
++++ b/fs/kernfs/file.c
+@@ -476,6 +476,8 @@ static int kernfs_fop_mmap(struct file *file, struct vm_area_struct *vma)
+ 
+ 	ops = kernfs_ops(of->kn);
+ 	rc = ops->mmap(of, vma);
++	if (rc)
++		goto out_put;
+ 
+ 	/*
+ 	 * PowerPC's pci_mmap of legacy_mem uses shmem_zero_setup()
+diff --git a/fs/namei.c b/fs/namei.c
+index 4b491b431990..4a3c105cf703 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -1537,7 +1537,7 @@ static inline int walk_component(struct nameidata *nd, struct path *path,
+ 		inode = path->dentry->d_inode;
+ 	}
+ 	err = -ENOENT;
+-	if (!inode)
++	if (!inode || d_is_negative(path->dentry))
+ 		goto out_path_put;
+ 
+ 	if (should_follow_link(path->dentry, follow)) {
+@@ -2240,7 +2240,7 @@ mountpoint_last(struct nameidata *nd, struct path *path)
+ 	mutex_unlock(&dir->d_inode->i_mutex);
+ 
+ done:
+-	if (!dentry->d_inode) {
++	if (!dentry->d_inode || d_is_negative(dentry)) {
+ 		error = -ENOENT;
+ 		dput(dentry);
+ 		goto out;
+@@ -2982,7 +2982,7 @@ retry_lookup:
+ finish_lookup:
+ 	/* we _can_ be in RCU mode here */
+ 	error = -ENOENT;
+-	if (d_is_negative(path->dentry)) {
++	if (!inode || d_is_negative(path->dentry)) {
+ 		path_to_nameidata(path, nd);
+ 		goto out;
+ 	}
+diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
+index d190e33d0ec2..dea8c60954ba 100644
+--- a/fs/nfsd/nfs4acl.c
++++ b/fs/nfsd/nfs4acl.c
+@@ -402,8 +402,10 @@ sort_pacl(struct posix_acl *pacl)
+ 	 * by uid/gid. */
+ 	int i, j;
+ 
+-	if (pacl->a_count <= 4)
+-		return; /* no users or groups */
++	/* no users or groups */
++	if (!pacl || pacl->a_count <= 4)
++		return;
++
+ 	i = 1;
+ 	while (pacl->a_entries[i].e_tag == ACL_USER)
+ 		i++;
+@@ -530,13 +532,12 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
+ 
+ 	/*
+ 	 * ACLs with no ACEs are treated differently in the inheritable
+-	 * and effective cases: when there are no inheritable ACEs, we
+-	 * set a zero-length default posix acl:
++	 * and effective cases: when there are no inheritable ACEs,
++	 * calls ->set_acl with a NULL ACL structure.
+ 	 */
+-	if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT)) {
+-		pacl = posix_acl_alloc(0, GFP_KERNEL);
+-		return pacl ? pacl : ERR_PTR(-ENOMEM);
+-	}
++	if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT))
++		return NULL;
++
+ 	/*
+ 	 * When there are no effective ACEs, the following will end
+ 	 * up setting a 3-element effective posix ACL with all
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 7415eac36501..1693fd93fa58 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -1078,6 +1078,18 @@ static struct nfs4_client *alloc_client(struct xdr_netobj name)
+ 		return NULL;
+ 	}
+ 	clp->cl_name.len = name.len;
++	INIT_LIST_HEAD(&clp->cl_sessions);
++	idr_init(&clp->cl_stateids);
++	atomic_set(&clp->cl_refcount, 0);
++	clp->cl_cb_state = NFSD4_CB_UNKNOWN;
++	INIT_LIST_HEAD(&clp->cl_idhash);
++	INIT_LIST_HEAD(&clp->cl_openowners);
++	INIT_LIST_HEAD(&clp->cl_delegations);
++	INIT_LIST_HEAD(&clp->cl_lru);
++	INIT_LIST_HEAD(&clp->cl_callbacks);
++	INIT_LIST_HEAD(&clp->cl_revoked);
++	spin_lock_init(&clp->cl_lock);
++	rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
+ 	return clp;
+ }
+ 
+@@ -1095,6 +1107,7 @@ free_client(struct nfs4_client *clp)
+ 		WARN_ON_ONCE(atomic_read(&ses->se_ref));
+ 		free_session(ses);
+ 	}
++	rpc_destroy_wait_queue(&clp->cl_cb_waitq);
+ 	free_svc_cred(&clp->cl_cred);
+ 	kfree(clp->cl_name.data);
+ 	idr_destroy(&clp->cl_stateids);
+@@ -1347,7 +1360,6 @@ static struct nfs4_client *create_client(struct xdr_netobj name,
+ 	if (clp == NULL)
+ 		return NULL;
+ 
+-	INIT_LIST_HEAD(&clp->cl_sessions);
+ 	ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
+ 	if (ret) {
+ 		spin_lock(&nn->client_lock);
+@@ -1355,20 +1367,9 @@ static struct nfs4_client *create_client(struct xdr_netobj name,
+ 		spin_unlock(&nn->client_lock);
+ 		return NULL;
+ 	}
+-	idr_init(&clp->cl_stateids);
+-	atomic_set(&clp->cl_refcount, 0);
+-	clp->cl_cb_state = NFSD4_CB_UNKNOWN;
+-	INIT_LIST_HEAD(&clp->cl_idhash);
+-	INIT_LIST_HEAD(&clp->cl_openowners);
+-	INIT_LIST_HEAD(&clp->cl_delegations);
+-	INIT_LIST_HEAD(&clp->cl_lru);
+-	INIT_LIST_HEAD(&clp->cl_callbacks);
+-	INIT_LIST_HEAD(&clp->cl_revoked);
+-	spin_lock_init(&clp->cl_lock);
+ 	nfsd4_init_callback(&clp->cl_cb_null);
+ 	clp->cl_time = get_seconds();
+ 	clear_bit(0, &clp->cl_cb_slot_busy);
+-	rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
+ 	copy_verf(clp, verf);
+ 	rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
+ 	gen_confirm(clp);
+@@ -3713,9 +3714,16 @@ out:
+ static __be32
+ nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp)
+ {
+-	if (check_for_locks(stp->st_file, lockowner(stp->st_stateowner)))
++	struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
++
++	if (check_for_locks(stp->st_file, lo))
+ 		return nfserr_locks_held;
+-	release_lock_stateid(stp);
++	/*
++	 * Currently there's a 1-1 lock stateid<->lockowner
++	 * correspondance, and we have to delete the lockowner when we
++	 * delete the lock stateid:
++	 */
++	unhash_lockowner(lo);
+ 	return nfs_ok;
+ }
+ 
+@@ -4155,6 +4163,10 @@ static bool same_lockowner_ino(struct nfs4_lockowner *lo, struct inode *inode, c
+ 
+ 	if (!same_owner_str(&lo->lo_owner, owner, clid))
+ 		return false;
++	if (list_empty(&lo->lo_owner.so_stateids)) {
++		WARN_ON_ONCE(1);
++		return false;
++	}
+ 	lst = list_first_entry(&lo->lo_owner.so_stateids,
+ 			       struct nfs4_ol_stateid, st_perstateowner);
+ 	return lst->st_file->fi_inode == inode;
+diff --git a/fs/posix_acl.c b/fs/posix_acl.c
+index 9e363e41dacc..0855f772cd41 100644
+--- a/fs/posix_acl.c
++++ b/fs/posix_acl.c
+@@ -246,6 +246,12 @@ posix_acl_equiv_mode(const struct posix_acl *acl, umode_t *mode_p)
+ 	umode_t mode = 0;
+ 	int not_equiv = 0;
+ 
++	/*
++	 * A null ACL can always be presented as mode bits.
++	 */
++	if (!acl)
++		return 0;
++
+ 	FOREACH_ACL_ENTRY(pa, acl, pe) {
+ 		switch (pa->e_tag) {
+ 			case ACL_USER_OBJ:
+diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
+index 810cf6e613e5..5fd2bf18e27d 100644
+--- a/fs/sysfs/file.c
++++ b/fs/sysfs/file.c
+@@ -47,12 +47,13 @@ static int sysfs_kf_seq_show(struct seq_file *sf, void *v)
+ 	ssize_t count;
+ 	char *buf;
+ 
+-	/* acquire buffer and ensure that it's >= PAGE_SIZE */
++	/* acquire buffer and ensure that it's >= PAGE_SIZE and clear */
+ 	count = seq_get_buf(sf, &buf);
+ 	if (count < PAGE_SIZE) {
+ 		seq_commit(sf, -1);
+ 		return 0;
+ 	}
++	memset(buf, 0, PAGE_SIZE);
+ 
+ 	/*
+ 	 * Invoke show().  Control may reach here via seq file lseek even
+diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
+index c5c92d59e531..0a5f55272672 100644
+--- a/include/linux/dmaengine.h
++++ b/include/linux/dmaengine.h
+@@ -433,6 +433,7 @@ typedef bool (*dma_filter_fn)(struct dma_chan *chan, void *filter_param);
+ typedef void (*dma_async_tx_callback)(void *dma_async_param);
+ 
+ struct dmaengine_unmap_data {
++	u8 map_cnt;
+ 	u8 to_cnt;
+ 	u8 from_cnt;
+ 	u8 bidi_cnt;
+diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
+index f4233b195dab..2068dff8a2cc 100644
+--- a/include/linux/ftrace.h
++++ b/include/linux/ftrace.h
+@@ -524,6 +524,7 @@ static inline int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_a
+ extern int ftrace_arch_read_dyn_info(char *buf, int size);
+ 
+ extern int skip_trace(unsigned long ip);
++extern void ftrace_module_init(struct module *mod);
+ 
+ extern void ftrace_disable_daemon(void);
+ extern void ftrace_enable_daemon(void);
+@@ -533,6 +534,7 @@ static inline int ftrace_force_update(void) { return 0; }
+ static inline void ftrace_disable_daemon(void) { }
+ static inline void ftrace_enable_daemon(void) { }
+ static inline void ftrace_release_mod(struct module *mod) {}
++static inline void ftrace_module_init(struct module *mod) {}
+ static inline __init int register_ftrace_command(struct ftrace_func_command *cmd)
+ {
+ 	return -EINVAL;
+diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
+index a2678d35b5a2..203c43d3e1b8 100644
+--- a/include/linux/interrupt.h
++++ b/include/linux/interrupt.h
+@@ -202,7 +202,40 @@ static inline int check_wakeup_irqs(void) { return 0; }
+ 
+ extern cpumask_var_t irq_default_affinity;
+ 
+-extern int irq_set_affinity(unsigned int irq, const struct cpumask *cpumask);
++/* Internal implementation. Use the helpers below */
++extern int __irq_set_affinity(unsigned int irq, const struct cpumask *cpumask,
++			      bool force);
++
++/**
++ * irq_set_affinity - Set the irq affinity of a given irq
++ * @irq:	Interrupt to set affinity
++ * @mask:	cpumask
++ *
++ * Fails if cpumask does not contain an online CPU
++ */
++static inline int
++irq_set_affinity(unsigned int irq, const struct cpumask *cpumask)
++{
++	return __irq_set_affinity(irq, cpumask, false);
++}
++
++/**
++ * irq_force_affinity - Force the irq affinity of a given irq
++ * @irq:	Interrupt to set affinity
++ * @mask:	cpumask
++ *
++ * Same as irq_set_affinity, but without checking the mask against
++ * online cpus.
++ *
++ * Solely for low level cpu hotplug code, where we need to make per
++ * cpu interrupts affine before the cpu becomes online.
++ */
++static inline int
++irq_force_affinity(unsigned int irq, const struct cpumask *cpumask)
++{
++	return __irq_set_affinity(irq, cpumask, true);
++}
++
+ extern int irq_can_set_affinity(unsigned int irq);
+ extern int irq_select_affinity(unsigned int irq);
+ 
+@@ -238,6 +271,11 @@ static inline int irq_set_affinity(unsigned int irq, const struct cpumask *m)
+ 	return -EINVAL;
+ }
+ 
++static inline int irq_force_affinity(unsigned int irq, const struct cpumask *cpumask)
++{
++	return 0;
++}
++
+ static inline int irq_can_set_affinity(unsigned int irq)
+ {
+ 	return 0;
+diff --git a/include/linux/irq.h b/include/linux/irq.h
+index 7dc10036eff5..ef1ac9feff56 100644
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -385,7 +385,8 @@ extern void remove_percpu_irq(unsigned int irq, struct irqaction *act);
+ 
+ extern void irq_cpu_online(void);
+ extern void irq_cpu_offline(void);
+-extern int __irq_set_affinity_locked(struct irq_data *data,  const struct cpumask *cpumask);
++extern int irq_set_affinity_locked(struct irq_data *data,
++				   const struct cpumask *cpumask, bool force);
+ 
+ #if defined(CONFIG_SMP) && defined(CONFIG_GENERIC_PENDING_IRQ)
+ void irq_move_irq(struct irq_data *data);
+diff --git a/include/linux/of_irq.h b/include/linux/of_irq.h
+index 3f23b4472c31..6404253d810d 100644
+--- a/include/linux/of_irq.h
++++ b/include/linux/of_irq.h
+@@ -44,11 +44,16 @@ extern void of_irq_init(const struct of_device_id *matches);
+ 
+ #ifdef CONFIG_OF_IRQ
+ extern int of_irq_count(struct device_node *dev);
++extern int of_irq_get(struct device_node *dev, int index);
+ #else
+ static inline int of_irq_count(struct device_node *dev)
+ {
+ 	return 0;
+ }
++static inline int of_irq_get(struct device_node *dev, int index)
++{
++	return 0;
++}
+ #endif
+ 
+ #if defined(CONFIG_OF)
+diff --git a/include/linux/serio.h b/include/linux/serio.h
+index 36aac733840a..9f779c7a2da4 100644
+--- a/include/linux/serio.h
++++ b/include/linux/serio.h
+@@ -23,6 +23,7 @@ struct serio {
+ 
+ 	char name[32];
+ 	char phys[32];
++	char firmware_id[128];
+ 
+ 	bool manual_bind;
+ 
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index b1f84b05c67e..37123eb1f093 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -3637,6 +3637,18 @@ void cfg80211_sched_scan_results(struct wiphy *wiphy);
+ void cfg80211_sched_scan_stopped(struct wiphy *wiphy);
+ 
+ /**
++ * cfg80211_sched_scan_stopped_rtnl - notify that the scheduled scan has stopped
++ *
++ * @wiphy: the wiphy on which the scheduled scan stopped
++ *
++ * The driver can call this function to inform cfg80211 that the
++ * scheduled scan had to be stopped, for whatever reason.  The driver
++ * is then called back via the sched_scan_stop operation when done.
++ * This function should be called with rtnl locked.
++ */
++void cfg80211_sched_scan_stopped_rtnl(struct wiphy *wiphy);
++
++/**
+  * cfg80211_inform_bss_width_frame - inform cfg80211 of a received BSS frame
+  *
+  * @wiphy: the wiphy reporting the BSS
+diff --git a/include/trace/events/module.h b/include/trace/events/module.h
+index 161932737416..ca298c7157ae 100644
+--- a/include/trace/events/module.h
++++ b/include/trace/events/module.h
+@@ -78,7 +78,7 @@ DECLARE_EVENT_CLASS(module_refcnt,
+ 
+ 	TP_fast_assign(
+ 		__entry->ip	= ip;
+-		__entry->refcnt	= __this_cpu_read(mod->refptr->incs) + __this_cpu_read(mod->refptr->decs);
++		__entry->refcnt	= __this_cpu_read(mod->refptr->incs) - __this_cpu_read(mod->refptr->decs);
+ 		__assign_str(name, mod->name);
+ 	),
+ 
+diff --git a/include/uapi/drm/tegra_drm.h b/include/uapi/drm/tegra_drm.h
+index 5e1ab552cbed..c28de1afd684 100644
+--- a/include/uapi/drm/tegra_drm.h
++++ b/include/uapi/drm/tegra_drm.h
+@@ -114,7 +114,6 @@ struct drm_tegra_submit {
+ 	__u32 num_waitchks;
+ 	__u32 waitchk_mask;
+ 	__u32 timeout;
+-	__u32 pad;
+ 	__u64 syncpts;
+ 	__u64 cmdbufs;
+ 	__u64 relocs;
+diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
+index bd24470d24a2..f4849525519c 100644
+--- a/include/uapi/linux/input.h
++++ b/include/uapi/linux/input.h
+@@ -164,6 +164,7 @@ struct input_keymap_entry {
+ #define INPUT_PROP_DIRECT		0x01	/* direct input devices */
+ #define INPUT_PROP_BUTTONPAD		0x02	/* has button(s) under pad */
+ #define INPUT_PROP_SEMI_MT		0x03	/* touch rectangle only */
++#define INPUT_PROP_TOPBUTTONPAD		0x04	/* softbuttons at top of pad */
+ 
+ #define INPUT_PROP_MAX			0x1f
+ #define INPUT_PROP_CNT			(INPUT_PROP_MAX + 1)
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 6801b3751a95..e3087afb7429 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -729,6 +729,55 @@ void exit_pi_state_list(struct task_struct *curr)
+ 	raw_spin_unlock_irq(&curr->pi_lock);
+ }
+ 
++/*
++ * We need to check the following states:
++ *
++ *      Waiter | pi_state | pi->owner | uTID      | uODIED | ?
++ *
++ * [1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
++ * [2]  NULL   | ---      | ---       | >0        | 0/1    | Valid
++ *
++ * [3]  Found  | NULL     | --        | Any       | 0/1    | Invalid
++ *
++ * [4]  Found  | Found    | NULL      | 0         | 1      | Valid
++ * [5]  Found  | Found    | NULL      | >0        | 1      | Invalid
++ *
++ * [6]  Found  | Found    | task      | 0         | 1      | Valid
++ *
++ * [7]  Found  | Found    | NULL      | Any       | 0      | Invalid
++ *
++ * [8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
++ * [9]  Found  | Found    | task      | 0         | 0      | Invalid
++ * [10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid
++ *
++ * [1]	Indicates that the kernel can acquire the futex atomically. We
++ *	came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.
++ *
++ * [2]	Valid, if TID does not belong to a kernel thread. If no matching
++ *      thread is found then it indicates that the owner TID has died.
++ *
++ * [3]	Invalid. The waiter is queued on a non PI futex
++ *
++ * [4]	Valid state after exit_robust_list(), which sets the user space
++ *	value to FUTEX_WAITERS | FUTEX_OWNER_DIED.
++ *
++ * [5]	The user space value got manipulated between exit_robust_list()
++ *	and exit_pi_state_list()
++ *
++ * [6]	Valid state after exit_pi_state_list() which sets the new owner in
++ *	the pi_state but cannot access the user space value.
++ *
++ * [7]	pi_state->owner can only be NULL when the OWNER_DIED bit is set.
++ *
++ * [8]	Owner and user space value match
++ *
++ * [9]	There is no transient state which sets the user space TID to 0
++ *	except exit_robust_list(), but this is indicated by the
++ *	FUTEX_OWNER_DIED bit. See [4]
++ *
++ * [10] There is no transient state which leaves owner and user space
++ *	TID out of sync.
++ */
+ static int
+ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 		union futex_key *key, struct futex_pi_state **ps)
+@@ -741,12 +790,13 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 	plist_for_each_entry_safe(this, next, &hb->chain, list) {
+ 		if (match_futex(&this->key, key)) {
+ 			/*
+-			 * Another waiter already exists - bump up
+-			 * the refcount and return its pi_state:
++			 * Sanity check the waiter before increasing
++			 * the refcount and attaching to it.
+ 			 */
+ 			pi_state = this->pi_state;
+ 			/*
+-			 * Userspace might have messed up non-PI and PI futexes
++			 * Userspace might have messed up non-PI and
++			 * PI futexes [3]
+ 			 */
+ 			if (unlikely(!pi_state))
+ 				return -EINVAL;
+@@ -754,34 +804,70 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 			WARN_ON(!atomic_read(&pi_state->refcount));
+ 
+ 			/*
+-			 * When pi_state->owner is NULL then the owner died
+-			 * and another waiter is on the fly. pi_state->owner
+-			 * is fixed up by the task which acquires
+-			 * pi_state->rt_mutex.
+-			 *
+-			 * We do not check for pid == 0 which can happen when
+-			 * the owner died and robust_list_exit() cleared the
+-			 * TID.
++			 * Handle the owner died case:
+ 			 */
+-			if (pid && pi_state->owner) {
++			if (uval & FUTEX_OWNER_DIED) {
++				/*
++				 * exit_pi_state_list sets owner to NULL and
++				 * wakes the topmost waiter. The task which
++				 * acquires the pi_state->rt_mutex will fixup
++				 * owner.
++				 */
++				if (!pi_state->owner) {
++					/*
++					 * No pi state owner, but the user
++					 * space TID is not 0. Inconsistent
++					 * state. [5]
++					 */
++					if (pid)
++						return -EINVAL;
++					/*
++					 * Take a ref on the state and
++					 * return. [4]
++					 */
++					goto out_state;
++				}
++
+ 				/*
+-				 * Bail out if user space manipulated the
+-				 * futex value.
++				 * If TID is 0, then either the dying owner
++				 * has not yet executed exit_pi_state_list()
++				 * or some waiter acquired the rtmutex in the
++				 * pi state, but did not yet fixup the TID in
++				 * user space.
++				 *
++				 * Take a ref on the state and return. [6]
+ 				 */
+-				if (pid != task_pid_vnr(pi_state->owner))
++				if (!pid)
++					goto out_state;
++			} else {
++				/*
++				 * If the owner died bit is not set,
++				 * then the pi_state must have an
++				 * owner. [7]
++				 */
++				if (!pi_state->owner)
+ 					return -EINVAL;
+ 			}
+ 
++			/*
++			 * Bail out if user space manipulated the
++			 * futex value. If pi state exists then the
++			 * owner TID must be the same as the user
++			 * space TID. [9/10]
++			 */
++			if (pid != task_pid_vnr(pi_state->owner))
++				return -EINVAL;
++
++		out_state:
+ 			atomic_inc(&pi_state->refcount);
+ 			*ps = pi_state;
+-
+ 			return 0;
+ 		}
+ 	}
+ 
+ 	/*
+ 	 * We are the first waiter - try to look up the real owner and attach
+-	 * the new pi_state to it, but bail out when TID = 0
++	 * the new pi_state to it, but bail out when TID = 0 [1]
+ 	 */
+ 	if (!pid)
+ 		return -ESRCH;
+@@ -789,6 +875,11 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 	if (!p)
+ 		return -ESRCH;
+ 
++	if (!p->mm) {
++		put_task_struct(p);
++		return -EPERM;
++	}
++
+ 	/*
+ 	 * We need to look at the task state flags to figure out,
+ 	 * whether the task is exiting. To protect against the do_exit
+@@ -809,6 +900,9 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 		return ret;
+ 	}
+ 
++	/*
++	 * No existing pi state. First waiter. [2]
++	 */
+ 	pi_state = alloc_pi_state();
+ 
+ 	/*
+@@ -880,10 +974,18 @@ retry:
+ 		return -EDEADLK;
+ 
+ 	/*
+-	 * Surprise - we got the lock. Just return to userspace:
++	 * Surprise - we got the lock, but we do not trust user space at all.
+ 	 */
+-	if (unlikely(!curval))
+-		return 1;
++	if (unlikely(!curval)) {
++		/*
++		 * We verify whether there is kernel state for this
++		 * futex. If not, we can safely assume, that the 0 ->
++		 * TID transition is correct. If state exists, we do
++		 * not bother to fixup the user space state as it was
++		 * corrupted already.
++		 */
++		return futex_top_waiter(hb, key) ? -EINVAL : 1;
++	}
+ 
+ 	uval = curval;
+ 
+@@ -1014,6 +1116,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
+ 	struct task_struct *new_owner;
+ 	struct futex_pi_state *pi_state = this->pi_state;
+ 	u32 uninitialized_var(curval), newval;
++	int ret = 0;
+ 
+ 	if (!pi_state)
+ 		return -EINVAL;
+@@ -1037,23 +1140,19 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
+ 		new_owner = this->task;
+ 
+ 	/*
+-	 * We pass it to the next owner. (The WAITERS bit is always
+-	 * kept enabled while there is PI state around. We must also
+-	 * preserve the owner died bit.)
++	 * We pass it to the next owner. The WAITERS bit is always
++	 * kept enabled while there is PI state around. We cleanup the
++	 * owner died bit, because we are the owner.
+ 	 */
+-	if (!(uval & FUTEX_OWNER_DIED)) {
+-		int ret = 0;
++	newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
+ 
+-		newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
+-
+-		if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
+-			ret = -EFAULT;
+-		else if (curval != uval)
+-			ret = -EINVAL;
+-		if (ret) {
+-			raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
+-			return ret;
+-		}
++	if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
++		ret = -EFAULT;
++	else if (curval != uval)
++		ret = -EINVAL;
++	if (ret) {
++		raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
++		return ret;
+ 	}
+ 
+ 	raw_spin_lock_irq(&pi_state->owner->pi_lock);
+@@ -1333,7 +1432,7 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
+  *
+  * Return:
+  *  0 - failed to acquire the lock atomically;
+- *  1 - acquired the lock;
++ * >0 - acquired the lock, return value is vpid of the top_waiter
+  * <0 - error
+  */
+ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
+@@ -1344,7 +1443,7 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
+ {
+ 	struct futex_q *top_waiter = NULL;
+ 	u32 curval;
+-	int ret;
++	int ret, vpid;
+ 
+ 	if (get_futex_value_locked(&curval, pifutex))
+ 		return -EFAULT;
+@@ -1372,11 +1471,13 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
+ 	 * the contended case or if set_waiters is 1.  The pi_state is returned
+ 	 * in ps in contended cases.
+ 	 */
++	vpid = task_pid_vnr(top_waiter->task);
+ 	ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
+ 				   set_waiters);
+-	if (ret == 1)
++	if (ret == 1) {
+ 		requeue_pi_wake_futex(top_waiter, key2, hb2);
+-
++		return vpid;
++	}
+ 	return ret;
+ }
+ 
+@@ -1407,10 +1508,16 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
+ 	struct futex_pi_state *pi_state = NULL;
+ 	struct futex_hash_bucket *hb1, *hb2;
+ 	struct futex_q *this, *next;
+-	u32 curval2;
+ 
+ 	if (requeue_pi) {
+ 		/*
++		 * Requeue PI only works on two distinct uaddrs. This
++		 * check is only valid for private futexes. See below.
++		 */
++		if (uaddr1 == uaddr2)
++			return -EINVAL;
++
++		/*
+ 		 * requeue_pi requires a pi_state, try to allocate it now
+ 		 * without any locks in case it fails.
+ 		 */
+@@ -1448,6 +1555,15 @@ retry:
+ 	if (unlikely(ret != 0))
+ 		goto out_put_key1;
+ 
++	/*
++	 * The check above which compares uaddrs is not sufficient for
++	 * shared futexes. We need to compare the keys:
++	 */
++	if (requeue_pi && match_futex(&key1, &key2)) {
++		ret = -EINVAL;
++		goto out_put_keys;
++	}
++
+ 	hb1 = hash_futex(&key1);
+ 	hb2 = hash_futex(&key2);
+ 
+@@ -1495,16 +1611,25 @@ retry_private:
+ 		 * At this point the top_waiter has either taken uaddr2 or is
+ 		 * waiting on it.  If the former, then the pi_state will not
+ 		 * exist yet, look it up one more time to ensure we have a
+-		 * reference to it.
++		 * reference to it. If the lock was taken, ret contains the
++		 * vpid of the top waiter task.
+ 		 */
+-		if (ret == 1) {
++		if (ret > 0) {
+ 			WARN_ON(pi_state);
+ 			drop_count++;
+ 			task_count++;
+-			ret = get_futex_value_locked(&curval2, uaddr2);
+-			if (!ret)
+-				ret = lookup_pi_state(curval2, hb2, &key2,
+-						      &pi_state);
++			/*
++			 * If we acquired the lock, then the user
++			 * space value of uaddr2 should be vpid. It
++			 * cannot be changed by the top waiter as it
++			 * is blocked on hb2 lock if it tries to do
++			 * so. If something fiddled with it behind our
++			 * back the pi state lookup might unearth
++			 * it. So we rather use the known value than
++			 * rereading and handing potential crap to
++			 * lookup_pi_state.
++			 */
++			ret = lookup_pi_state(ret, hb2, &key2, &pi_state);
+ 		}
+ 
+ 		switch (ret) {
+@@ -2287,9 +2412,10 @@ retry:
+ 	/*
+ 	 * To avoid races, try to do the TID -> 0 atomic transition
+ 	 * again. If it succeeds then we can return without waking
+-	 * anyone else up:
++	 * anyone else up. We only try this if neither the waiters nor
++	 * the owner died bit are set.
+ 	 */
+-	if (!(uval & FUTEX_OWNER_DIED) &&
++	if (!(uval & ~FUTEX_TID_MASK) &&
+ 	    cmpxchg_futex_value_locked(&uval, uaddr, vpid, 0))
+ 		goto pi_faulted;
+ 	/*
+@@ -2319,11 +2445,9 @@ retry:
+ 	/*
+ 	 * No waiters - kernel unlocks the futex:
+ 	 */
+-	if (!(uval & FUTEX_OWNER_DIED)) {
+-		ret = unlock_futex_pi(uaddr, uval);
+-		if (ret == -EFAULT)
+-			goto pi_faulted;
+-	}
++	ret = unlock_futex_pi(uaddr, uval);
++	if (ret == -EFAULT)
++		goto pi_faulted;
+ 
+ out_unlock:
+ 	spin_unlock(&hb->lock);
+@@ -2485,6 +2609,15 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ 	if (ret)
+ 		goto out_key2;
+ 
++	/*
++	 * The check above which compares uaddrs is not sufficient for
++	 * shared futexes. We need to compare the keys:
++	 */
++	if (match_futex(&q.key, &key2)) {
++		ret = -EINVAL;
++		goto out_put_keys;
++	}
++
+ 	/* Queue the futex_q, drop the hb lock, wait for wakeup. */
+ 	futex_wait_queue_me(hb, &q, to);
+ 
+diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
+index 09094361dce5..04d03745fb98 100644
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -247,6 +247,11 @@ again:
+ 			goto again;
+ 		}
+ 		timer->base = new_base;
++	} else {
++		if (cpu != this_cpu && hrtimer_check_target(timer, new_base)) {
++			cpu = this_cpu;
++			goto again;
++		}
+ 	}
+ 	return new_base;
+ }
+@@ -582,6 +587,23 @@ hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base, int skip_equal)
+ 
+ 	cpu_base->expires_next.tv64 = expires_next.tv64;
+ 
++	/*
++	 * If a hang was detected in the last timer interrupt then we
++	 * leave the hang delay active in the hardware. We want the
++	 * system to make progress. That also prevents the following
++	 * scenario:
++	 * T1 expires 50ms from now
++	 * T2 expires 5s from now
++	 *
++	 * T1 is removed, so this code is called and would reprogram
++	 * the hardware to 5s from now. Any hrtimer_start after that
++	 * will not reprogram the hardware due to hang_detected being
++	 * set. So we'd effectivly block all timers until the T2 event
++	 * fires.
++	 */
++	if (cpu_base->hang_detected)
++		return;
++
+ 	if (cpu_base->expires_next.tv64 != KTIME_MAX)
+ 		tick_program_event(cpu_base->expires_next, 1);
+ }
+@@ -981,11 +1003,8 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
+ 	/* Remove an active timer from the queue: */
+ 	ret = remove_hrtimer(timer, base);
+ 
+-	/* Switch the timer base, if necessary: */
+-	new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
+-
+ 	if (mode & HRTIMER_MODE_REL) {
+-		tim = ktime_add_safe(tim, new_base->get_time());
++		tim = ktime_add_safe(tim, base->get_time());
+ 		/*
+ 		 * CONFIG_TIME_LOW_RES is a temporary way for architectures
+ 		 * to signal that they simply return xtime in
+@@ -1000,6 +1019,9 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
+ 
+ 	hrtimer_set_expires_range_ns(timer, tim, delta_ns);
+ 
++	/* Switch the timer base, if necessary: */
++	new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
++
+ 	timer_stats_hrtimer_set_start_info(timer);
+ 
+ 	leftmost = enqueue_hrtimer(timer, new_base);
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index d3bf660cb57f..66a1b46d5677 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -150,7 +150,7 @@ int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
+ 	struct irq_chip *chip = irq_data_get_irq_chip(data);
+ 	int ret;
+ 
+-	ret = chip->irq_set_affinity(data, mask, false);
++	ret = chip->irq_set_affinity(data, mask, force);
+ 	switch (ret) {
+ 	case IRQ_SET_MASK_OK:
+ 		cpumask_copy(data->affinity, mask);
+@@ -162,7 +162,8 @@ int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
+ 	return ret;
+ }
+ 
+-int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask)
++int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
++			    bool force)
+ {
+ 	struct irq_chip *chip = irq_data_get_irq_chip(data);
+ 	struct irq_desc *desc = irq_data_to_desc(data);
+@@ -172,7 +173,7 @@ int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask)
+ 		return -EINVAL;
+ 
+ 	if (irq_can_move_pcntxt(data)) {
+-		ret = irq_do_set_affinity(data, mask, false);
++		ret = irq_do_set_affinity(data, mask, force);
+ 	} else {
+ 		irqd_set_move_pending(data);
+ 		irq_copy_pending(desc, mask);
+@@ -187,13 +188,7 @@ int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask)
+ 	return ret;
+ }
+ 
+-/**
+- *	irq_set_affinity - Set the irq affinity of a given irq
+- *	@irq:		Interrupt to set affinity
+- *	@mask:		cpumask
+- *
+- */
+-int irq_set_affinity(unsigned int irq, const struct cpumask *mask)
++int __irq_set_affinity(unsigned int irq, const struct cpumask *mask, bool force)
+ {
+ 	struct irq_desc *desc = irq_to_desc(irq);
+ 	unsigned long flags;
+@@ -203,7 +198,7 @@ int irq_set_affinity(unsigned int irq, const struct cpumask *mask)
+ 		return -EINVAL;
+ 
+ 	raw_spin_lock_irqsave(&desc->lock, flags);
+-	ret =  __irq_set_affinity_locked(irq_desc_get_irq_data(desc), mask);
++	ret = irq_set_affinity_locked(irq_desc_get_irq_data(desc), mask, force);
+ 	raw_spin_unlock_irqrestore(&desc->lock, flags);
+ 	return ret;
+ }
+diff --git a/kernel/kexec.c b/kernel/kexec.c
+index 60bafbed06ab..18ff0b91d6d2 100644
+--- a/kernel/kexec.c
++++ b/kernel/kexec.c
+@@ -1682,6 +1682,14 @@ int kernel_kexec(void)
+ 		kexec_in_progress = true;
+ 		kernel_restart_prepare(NULL);
+ 		migrate_to_reboot_cpu();
++
++		/*
++		 * migrate_to_reboot_cpu() disables CPU hotplug assuming that
++		 * no further code needs to use CPU hotplug (which is true in
++		 * the reboot case). However, the kexec path depends on using
++		 * CPU hotplug again; so re-enable it here.
++		 */
++		cpu_hotplug_enable();
+ 		printk(KERN_EMERG "Starting new kernel\n");
+ 		machine_shutdown();
+ 	}
+diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
+index 2e960a2bab81..0339f515531a 100644
+--- a/kernel/locking/rtmutex.c
++++ b/kernel/locking/rtmutex.c
+@@ -331,9 +331,16 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
+ 	 * top_waiter can be NULL, when we are in the deboosting
+ 	 * mode!
+ 	 */
+-	if (top_waiter && (!task_has_pi_waiters(task) ||
+-			   top_waiter != task_top_pi_waiter(task)))
+-		goto out_unlock_pi;
++	if (top_waiter) {
++		if (!task_has_pi_waiters(task))
++			goto out_unlock_pi;
++		/*
++		 * If deadlock detection is off, we stop here if we
++		 * are not the top pi waiter of the task.
++		 */
++		if (!detect_deadlock && top_waiter != task_top_pi_waiter(task))
++			goto out_unlock_pi;
++	}
+ 
+ 	/*
+ 	 * When deadlock detection is off then we check, if further
+@@ -349,7 +356,12 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
+ 		goto retry;
+ 	}
+ 
+-	/* Deadlock detection */
++	/*
++	 * Deadlock detection. If the lock is the same as the original
++	 * lock which caused us to walk the lock chain or if the
++	 * current lock is owned by the task which initiated the chain
++	 * walk, we detected a deadlock.
++	 */
+ 	if (lock == orig_lock || rt_mutex_owner(lock) == top_task) {
+ 		debug_rt_mutex_deadlock(deadlock_detect, orig_waiter, lock);
+ 		raw_spin_unlock(&lock->wait_lock);
+@@ -515,6 +527,18 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
+ 	unsigned long flags;
+ 	int chain_walk = 0, res;
+ 
++	/*
++	 * Early deadlock detection. We really don't want the task to
++	 * enqueue on itself just to untangle the mess later. It's not
++	 * only an optimization. We drop the locks, so another waiter
++	 * can come in before the chain walk detects the deadlock. So
++	 * the other will detect the deadlock and return -EDEADLOCK,
++	 * which is wrong, as the other waiter is not in a deadlock
++	 * situation.
++	 */
++	if (detect_deadlock && owner == task)
++		return -EDEADLK;
++
+ 	raw_spin_lock_irqsave(&task->pi_lock, flags);
+ 	__rt_mutex_adjust_prio(task);
+ 	waiter->task = task;
+diff --git a/kernel/module.c b/kernel/module.c
+index d24fcf29cb64..6716a1fa618b 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -815,9 +815,6 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
+ 		return -EFAULT;
+ 	name[MODULE_NAME_LEN-1] = '\0';
+ 
+-	if (!(flags & O_NONBLOCK))
+-		pr_warn("waiting module removal not supported: please upgrade\n");
+-
+ 	if (mutex_lock_interruptible(&module_mutex) != 0)
+ 		return -EINTR;
+ 
+@@ -3265,6 +3262,9 @@ static int load_module(struct load_info *info, const char __user *uargs,
+ 
+ 	dynamic_debug_setup(info->debug, info->num_debug);
+ 
++	/* Ftrace init must be called in the MODULE_STATE_UNFORMED state */
++	ftrace_module_init(mod);
++
+ 	/* Finally it's fully formed, ready to start executing. */
+ 	err = complete_formation(mod, info);
+ 	if (err)
+diff --git a/kernel/timer.c b/kernel/timer.c
+index accfd241b9e5..38f0d40fca13 100644
+--- a/kernel/timer.c
++++ b/kernel/timer.c
+@@ -822,7 +822,7 @@ unsigned long apply_slack(struct timer_list *timer, unsigned long expires)
+ 
+ 	bit = find_last_bit(&mask, BITS_PER_LONG);
+ 
+-	mask = (1 << bit) - 1;
++	mask = (1UL << bit) - 1;
+ 
+ 	expires_limit = expires_limit & ~(mask);
+ 
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index cd7f76d1eb86..868633e61b43 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -4315,16 +4315,11 @@ static void ftrace_init_module(struct module *mod,
+ 	ftrace_process_locs(mod, start, end);
+ }
+ 
+-static int ftrace_module_notify_enter(struct notifier_block *self,
+-				      unsigned long val, void *data)
++void ftrace_module_init(struct module *mod)
+ {
+-	struct module *mod = data;
+-
+-	if (val == MODULE_STATE_COMING)
+-		ftrace_init_module(mod, mod->ftrace_callsites,
+-				   mod->ftrace_callsites +
+-				   mod->num_ftrace_callsites);
+-	return 0;
++	ftrace_init_module(mod, mod->ftrace_callsites,
++			   mod->ftrace_callsites +
++			   mod->num_ftrace_callsites);
+ }
+ 
+ static int ftrace_module_notify_exit(struct notifier_block *self,
+@@ -4338,11 +4333,6 @@ static int ftrace_module_notify_exit(struct notifier_block *self,
+ 	return 0;
+ }
+ #else
+-static int ftrace_module_notify_enter(struct notifier_block *self,
+-				      unsigned long val, void *data)
+-{
+-	return 0;
+-}
+ static int ftrace_module_notify_exit(struct notifier_block *self,
+ 				     unsigned long val, void *data)
+ {
+@@ -4350,11 +4340,6 @@ static int ftrace_module_notify_exit(struct notifier_block *self,
+ }
+ #endif /* CONFIG_MODULES */
+ 
+-struct notifier_block ftrace_module_enter_nb = {
+-	.notifier_call = ftrace_module_notify_enter,
+-	.priority = INT_MAX,	/* Run before anything that can use kprobes */
+-};
+-
+ struct notifier_block ftrace_module_exit_nb = {
+ 	.notifier_call = ftrace_module_notify_exit,
+ 	.priority = INT_MIN,	/* Run after anything that can remove kprobes */
+@@ -4391,10 +4376,6 @@ void __init ftrace_init(void)
+ 				  __start_mcount_loc,
+ 				  __stop_mcount_loc);
+ 
+-	ret = register_module_notifier(&ftrace_module_enter_nb);
+-	if (ret)
+-		pr_warning("Failed to register trace ftrace module enter notifier\n");
+-
+ 	ret = register_module_notifier(&ftrace_module_exit_nb);
+ 	if (ret)
+ 		pr_warning("Failed to register trace ftrace module exit notifier\n");
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 193e977a10ea..b6a394108e3b 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1909,6 +1909,12 @@ static void send_mayday(struct work_struct *work)
+ 
+ 	/* mayday mayday mayday */
+ 	if (list_empty(&pwq->mayday_node)) {
++		/*
++		 * If @pwq is for an unbound wq, its base ref may be put at
++		 * any time due to an attribute change.  Pin @pwq until the
++		 * rescuer is done with it.
++		 */
++		get_pwq(pwq);
+ 		list_add_tail(&pwq->mayday_node, &wq->maydays);
+ 		wake_up_process(wq->rescuer->task);
+ 	}
+@@ -2391,6 +2397,7 @@ static int rescuer_thread(void *__rescuer)
+ 	struct worker *rescuer = __rescuer;
+ 	struct workqueue_struct *wq = rescuer->rescue_wq;
+ 	struct list_head *scheduled = &rescuer->scheduled;
++	bool should_stop;
+ 
+ 	set_user_nice(current, RESCUER_NICE_LEVEL);
+ 
+@@ -2402,11 +2409,15 @@ static int rescuer_thread(void *__rescuer)
+ repeat:
+ 	set_current_state(TASK_INTERRUPTIBLE);
+ 
+-	if (kthread_should_stop()) {
+-		__set_current_state(TASK_RUNNING);
+-		rescuer->task->flags &= ~PF_WQ_WORKER;
+-		return 0;
+-	}
++	/*
++	 * By the time the rescuer is requested to stop, the workqueue
++	 * shouldn't have any work pending, but @wq->maydays may still have
++	 * pwq(s) queued.  This can happen by non-rescuer workers consuming
++	 * all the work items before the rescuer got to them.  Go through
++	 * @wq->maydays processing before acting on should_stop so that the
++	 * list is always empty on exit.
++	 */
++	should_stop = kthread_should_stop();
+ 
+ 	/* see whether any pwq is asking for help */
+ 	spin_lock_irq(&wq_mayday_lock);
+@@ -2438,6 +2449,12 @@ repeat:
+ 		process_scheduled_works(rescuer);
+ 
+ 		/*
++		 * Put the reference grabbed by send_mayday().  @pool won't
++		 * go away while we're holding its lock.
++		 */
++		put_pwq(pwq);
++
++		/*
+ 		 * Leave this pool.  If keep_working() is %true, notify a
+ 		 * regular worker; otherwise, we end up with 0 concurrency
+ 		 * and stalling the execution.
+@@ -2452,6 +2469,12 @@ repeat:
+ 
+ 	spin_unlock_irq(&wq_mayday_lock);
+ 
++	if (should_stop) {
++		__set_current_state(TASK_RUNNING);
++		rescuer->task->flags &= ~PF_WQ_WORKER;
++		return 0;
++	}
++
+ 	/* rescuers should never participate in concurrency management */
+ 	WARN_ON_ONCE(!(rescuer->flags & WORKER_NOT_RUNNING));
+ 	schedule();
+@@ -4093,7 +4116,8 @@ static void wq_update_unbound_numa(struct workqueue_struct *wq, int cpu,
+ 	if (!pwq) {
+ 		pr_warning("workqueue: allocation failed while updating NUMA affinity of \"%s\"\n",
+ 			   wq->name);
+-		goto out_unlock;
++		mutex_lock(&wq->mutex);
++		goto use_dfl_pwq;
+ 	}
+ 
+ 	/*
+diff --git a/mm/compaction.c b/mm/compaction.c
+index 918577595ea8..5f702ef0a65f 100644
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -666,16 +666,20 @@ static void isolate_freepages(struct zone *zone,
+ 				struct compact_control *cc)
+ {
+ 	struct page *page;
+-	unsigned long high_pfn, low_pfn, pfn, z_end_pfn, end_pfn;
++	unsigned long high_pfn, low_pfn, pfn, z_end_pfn;
+ 	int nr_freepages = cc->nr_freepages;
+ 	struct list_head *freelist = &cc->freepages;
+ 
+ 	/*
+ 	 * Initialise the free scanner. The starting point is where we last
+-	 * scanned from (or the end of the zone if starting). The low point
+-	 * is the end of the pageblock the migration scanner is using.
++	 * successfully isolated from, zone-cached value, or the end of the
++	 * zone when isolating for the first time. We need this aligned to
++	 * the pageblock boundary, because we do pfn -= pageblock_nr_pages
++	 * in the for loop.
++	 * The low boundary is the end of the pageblock the migration scanner
++	 * is using.
+ 	 */
+-	pfn = cc->free_pfn;
++	pfn = cc->free_pfn & ~(pageblock_nr_pages-1);
+ 	low_pfn = ALIGN(cc->migrate_pfn + 1, pageblock_nr_pages);
+ 
+ 	/*
+@@ -695,6 +699,7 @@ static void isolate_freepages(struct zone *zone,
+ 	for (; pfn >= low_pfn && cc->nr_migratepages > nr_freepages;
+ 					pfn -= pageblock_nr_pages) {
+ 		unsigned long isolated;
++		unsigned long end_pfn;
+ 
+ 		/*
+ 		 * This can iterate a massively long zone without finding any
+@@ -729,13 +734,10 @@ static void isolate_freepages(struct zone *zone,
+ 		isolated = 0;
+ 
+ 		/*
+-		 * As pfn may not start aligned, pfn+pageblock_nr_page
+-		 * may cross a MAX_ORDER_NR_PAGES boundary and miss
+-		 * a pfn_valid check. Ensure isolate_freepages_block()
+-		 * only scans within a pageblock
++		 * Take care when isolating in last pageblock of a zone which
++		 * ends in the middle of a pageblock.
+ 		 */
+-		end_pfn = ALIGN(pfn + 1, pageblock_nr_pages);
+-		end_pfn = min(end_pfn, z_end_pfn);
++		end_pfn = min(pfn + pageblock_nr_pages, z_end_pfn);
+ 		isolated = isolate_freepages_block(cc, pfn, end_pfn,
+ 						   freelist, false);
+ 		nr_freepages += isolated;
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 90002ea43638..66586bb44c62 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1085,15 +1085,16 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
+ 			return 0;
+ 		} else if (PageHuge(hpage)) {
+ 			/*
+-			 * Check "just unpoisoned", "filter hit", and
+-			 * "race with other subpage."
++			 * Check "filter hit" and "race with other subpage."
+ 			 */
+ 			lock_page(hpage);
+-			if (!PageHWPoison(hpage)
+-			    || (hwpoison_filter(p) && TestClearPageHWPoison(p))
+-			    || (p != hpage && TestSetPageHWPoison(hpage))) {
+-				atomic_long_sub(nr_pages, &num_poisoned_pages);
+-				return 0;
++			if (PageHWPoison(hpage)) {
++				if ((hwpoison_filter(p) && TestClearPageHWPoison(p))
++				    || (p != hpage && TestSetPageHWPoison(hpage))) {
++					atomic_long_sub(nr_pages, &num_poisoned_pages);
++					unlock_page(hpage);
++					return 0;
++				}
+ 			}
+ 			set_page_hwpoison_huge_page(hpage);
+ 			res = dequeue_hwpoisoned_huge_page(hpage);
+diff --git a/mm/memory.c b/mm/memory.c
+index 22dfa617bddb..49e930f9ed46 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1929,12 +1929,17 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
+ 		     unsigned long address, unsigned int fault_flags)
+ {
+ 	struct vm_area_struct *vma;
++	vm_flags_t vm_flags;
+ 	int ret;
+ 
+ 	vma = find_extend_vma(mm, address);
+ 	if (!vma || address < vma->vm_start)
+ 		return -EFAULT;
+ 
++	vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ;
++	if (!(vm_flags & vma->vm_flags))
++		return -EFAULT;
++
+ 	ret = handle_mm_fault(mm, vma, address, fault_flags);
+ 	if (ret & VM_FAULT_ERROR) {
+ 		if (ret & VM_FAULT_OOM)
+diff --git a/mm/mremap.c b/mm/mremap.c
+index 0843feb66f3d..05f1180e9f21 100644
+--- a/mm/mremap.c
++++ b/mm/mremap.c
+@@ -194,10 +194,17 @@ unsigned long move_page_tables(struct vm_area_struct *vma,
+ 			break;
+ 		if (pmd_trans_huge(*old_pmd)) {
+ 			int err = 0;
+-			if (extent == HPAGE_PMD_SIZE)
++			if (extent == HPAGE_PMD_SIZE) {
++				VM_BUG_ON(vma->vm_file || !vma->anon_vma);
++				/* See comment in move_ptes() */
++				if (need_rmap_locks)
++					anon_vma_lock_write(vma->anon_vma);
+ 				err = move_huge_pmd(vma, new_vma, old_addr,
+ 						    new_addr, old_end,
+ 						    old_pmd, new_pmd);
++				if (need_rmap_locks)
++					anon_vma_unlock_write(vma->anon_vma);
++			}
+ 			if (err > 0) {
+ 				need_flush = true;
+ 				continue;
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 7106cb1aca8e..8f6daa62206d 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -593,14 +593,14 @@ unsigned long bdi_dirty_limit(struct backing_dev_info *bdi, unsigned long dirty)
+  * (5) the closer to setpoint, the smaller |df/dx| (and the reverse)
+  *     => fast response on large errors; small oscillation near setpoint
+  */
+-static inline long long pos_ratio_polynom(unsigned long setpoint,
++static long long pos_ratio_polynom(unsigned long setpoint,
+ 					  unsigned long dirty,
+ 					  unsigned long limit)
+ {
+ 	long long pos_ratio;
+ 	long x;
+ 
+-	x = div_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
++	x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
+ 		    limit - setpoint + 1);
+ 	pos_ratio = x;
+ 	pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
+@@ -842,7 +842,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ 	x_intercept = bdi_setpoint + span;
+ 
+ 	if (bdi_dirty < x_intercept - span / 4) {
+-		pos_ratio = div_u64(pos_ratio * (x_intercept - bdi_dirty),
++		pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty),
+ 				    x_intercept - bdi_setpoint + 1);
+ 	} else
+ 		pos_ratio /= 4;
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 036cfe07050f..a2a54a85f691 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -612,7 +612,7 @@ static struct pcpu_chunk *pcpu_alloc_chunk(void)
+ 	chunk->map = pcpu_mem_zalloc(PCPU_DFL_MAP_ALLOC *
+ 						sizeof(chunk->map[0]));
+ 	if (!chunk->map) {
+-		kfree(chunk);
++		pcpu_mem_free(chunk, pcpu_chunk_struct_size);
+ 		return NULL;
+ 	}
+ 
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index a9c74b409681..30a4b096ff6e 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -1916,6 +1916,24 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc,
+ 	}
+ 
+ 	/*
++	 * Prevent the reclaimer from falling into the cache trap: as
++	 * cache pages start out inactive, every cache fault will tip
++	 * the scan balance towards the file LRU.  And as the file LRU
++	 * shrinks, so does the window for rotation from references.
++	 * This means we have a runaway feedback loop where a tiny
++	 * thrashing file LRU becomes infinitely more attractive than
++	 * anon pages.  Try to detect this based on file LRU size.
++	 */
++	if (global_reclaim(sc)) {
++		unsigned long free = zone_page_state(zone, NR_FREE_PAGES);
++
++		if (unlikely(file + free <= high_wmark_pages(zone))) {
++			scan_balance = SCAN_ANON;
++			goto out;
++		}
++	}
++
++	/*
+ 	 * There is enough inactive page cache, do not reclaim
+ 	 * anything from the anonymous working set right now.
+ 	 */
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index ba5366c320da..9a6bc9df5e81 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -752,14 +752,17 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
+ 	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
+ 		struct hci_cp_auth_requested cp;
+ 
+-		/* encrypt must be pending if auth is also pending */
+-		set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
+-
+ 		cp.handle = cpu_to_le16(conn->handle);
+ 		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
+ 			     sizeof(cp), &cp);
++
++		/* If we're already encrypted set the REAUTH_PEND flag,
++		 * otherwise set the ENCRYPT_PEND.
++		 */
+ 		if (conn->key_type != 0xff)
+ 			set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
++		else
++			set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
+ 	}
+ 
+ 	return 0;
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 60828cf02eb8..66ada7794ed0 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -3006,6 +3006,12 @@ static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
+ 	if (!conn)
+ 		goto unlock;
+ 
++	/* For BR/EDR the necessary steps are taken through the
++	 * auth_complete event.
++	 */
++	if (conn->type != LE_LINK)
++		goto unlock;
++
+ 	if (!ev->status)
+ 		conn->sec_level = conn->pending_sec_level;
+ 
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index 30efc5c18622..988721a629eb 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -557,7 +557,7 @@ static int ceph_tcp_sendmsg(struct socket *sock, struct kvec *iov,
+ 	return r;
+ }
+ 
+-static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
++static int __ceph_tcp_sendpage(struct socket *sock, struct page *page,
+ 		     int offset, size_t size, bool more)
+ {
+ 	int flags = MSG_DONTWAIT | MSG_NOSIGNAL | (more ? MSG_MORE : MSG_EOR);
+@@ -570,6 +570,24 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
+ 	return ret;
+ }
+ 
++static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
++		     int offset, size_t size, bool more)
++{
++	int ret;
++	struct kvec iov;
++
++	/* sendpage cannot properly handle pages with page_count == 0,
++	 * we need to fallback to sendmsg if that's the case */
++	if (page_count(page) >= 1)
++		return __ceph_tcp_sendpage(sock, page, offset, size, more);
++
++	iov.iov_base = kmap(page) + offset;
++	iov.iov_len = size;
++	ret = ceph_tcp_sendmsg(sock, &iov, 1, size, more);
++	kunmap(page);
++
++	return ret;
++}
+ 
+ /*
+  * Shutdown/close the socket for the given connection.
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 6bd498470138..b127902361f4 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -317,6 +317,7 @@ struct ieee80211_roc_work {
+ 
+ 	bool started, abort, hw_begun, notified;
+ 	bool to_be_freed;
++	bool on_channel;
+ 
+ 	unsigned long hw_start_time;
+ 
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 47059ac44e24..e6a84cb1a5e4 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -3511,18 +3511,24 @@ void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
+ 
+ 	sdata_lock(sdata);
+ 
+-	if (ifmgd->auth_data) {
++	if (ifmgd->auth_data || ifmgd->assoc_data) {
++		const u8 *bssid = ifmgd->auth_data ?
++				ifmgd->auth_data->bss->bssid :
++				ifmgd->assoc_data->bss->bssid;
++
+ 		/*
+-		 * If we are trying to authenticate while suspending, cfg80211
+-		 * won't know and won't actually abort those attempts, thus we
+-		 * need to do that ourselves.
++		 * If we are trying to authenticate / associate while suspending,
++		 * cfg80211 won't know and won't actually abort those attempts,
++		 * thus we need to do that ourselves.
+ 		 */
+-		ieee80211_send_deauth_disassoc(sdata,
+-					       ifmgd->auth_data->bss->bssid,
++		ieee80211_send_deauth_disassoc(sdata, bssid,
+ 					       IEEE80211_STYPE_DEAUTH,
+ 					       WLAN_REASON_DEAUTH_LEAVING,
+ 					       false, frame_buf);
+-		ieee80211_destroy_auth_data(sdata, false);
++		if (ifmgd->assoc_data)
++			ieee80211_destroy_assoc_data(sdata, false);
++		if (ifmgd->auth_data)
++			ieee80211_destroy_auth_data(sdata, false);
+ 		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+ 				      IEEE80211_DEAUTH_FRAME_LEN);
+ 	}
+diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
+index 6fb38558a5e6..7a17decd27f9 100644
+--- a/net/mac80211/offchannel.c
++++ b/net/mac80211/offchannel.c
+@@ -333,7 +333,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
+ 		container_of(work, struct ieee80211_roc_work, work.work);
+ 	struct ieee80211_sub_if_data *sdata = roc->sdata;
+ 	struct ieee80211_local *local = sdata->local;
+-	bool started;
++	bool started, on_channel;
+ 
+ 	mutex_lock(&local->mtx);
+ 
+@@ -354,14 +354,26 @@ void ieee80211_sw_roc_work(struct work_struct *work)
+ 	if (!roc->started) {
+ 		struct ieee80211_roc_work *dep;
+ 
+-		/* start this ROC */
+-		ieee80211_offchannel_stop_vifs(local);
++		WARN_ON(local->use_chanctx);
++
++		/* If actually operating on the desired channel (with at least
++		 * 20 MHz channel width) don't stop all the operations but still
++		 * treat it as though the ROC operation started properly, so
++		 * other ROC operations won't interfere with this one.
++		 */
++		roc->on_channel = roc->chan == local->_oper_chandef.chan &&
++				  local->_oper_chandef.width != NL80211_CHAN_WIDTH_5 &&
++				  local->_oper_chandef.width != NL80211_CHAN_WIDTH_10;
+ 
+-		/* switch channel etc */
++		/* start this ROC */
+ 		ieee80211_recalc_idle(local);
+ 
+-		local->tmp_channel = roc->chan;
+-		ieee80211_hw_config(local, 0);
++		if (!roc->on_channel) {
++			ieee80211_offchannel_stop_vifs(local);
++
++			local->tmp_channel = roc->chan;
++			ieee80211_hw_config(local, 0);
++		}
+ 
+ 		/* tell userspace or send frame */
+ 		ieee80211_handle_roc_started(roc);
+@@ -380,9 +392,10 @@ void ieee80211_sw_roc_work(struct work_struct *work)
+  finish:
+ 		list_del(&roc->list);
+ 		started = roc->started;
++		on_channel = roc->on_channel;
+ 		ieee80211_roc_notify_destroy(roc, !roc->abort);
+ 
+-		if (started) {
++		if (started && !on_channel) {
+ 			ieee80211_flush_queues(local, NULL);
+ 
+ 			local->tmp_channel = NULL;
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index b8700d417a9c..642762518213 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1754,7 +1754,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
+ 	mutex_unlock(&local->mtx);
+ 
+ 	if (sched_scan_stopped)
+-		cfg80211_sched_scan_stopped(local->hw.wiphy);
++		cfg80211_sched_scan_stopped_rtnl(local->hw.wiphy);
+ 
+ 	/*
+ 	 * If this is for hw restart things are still running.
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index f0541370e68e..338794ea44d1 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -1683,17 +1683,9 @@ static void reg_process_hint(struct regulatory_request *reg_request)
+ 	struct wiphy *wiphy = NULL;
+ 	enum reg_request_treatment treatment;
+ 
+-	if (WARN_ON(!reg_request->alpha2))
+-		return;
+-
+ 	if (reg_request->wiphy_idx != WIPHY_IDX_INVALID)
+ 		wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx);
+ 
+-	if (reg_request->initiator == NL80211_REGDOM_SET_BY_DRIVER && !wiphy) {
+-		kfree(reg_request);
+-		return;
+-	}
+-
+ 	switch (reg_request->initiator) {
+ 	case NL80211_REGDOM_SET_BY_CORE:
+ 		reg_process_hint_core(reg_request);
+@@ -1706,20 +1698,29 @@ static void reg_process_hint(struct regulatory_request *reg_request)
+ 		schedule_delayed_work(&reg_timeout, msecs_to_jiffies(3142));
+ 		return;
+ 	case NL80211_REGDOM_SET_BY_DRIVER:
++		if (!wiphy)
++			goto out_free;
+ 		treatment = reg_process_hint_driver(wiphy, reg_request);
+ 		break;
+ 	case NL80211_REGDOM_SET_BY_COUNTRY_IE:
++		if (!wiphy)
++			goto out_free;
+ 		treatment = reg_process_hint_country_ie(wiphy, reg_request);
+ 		break;
+ 	default:
+ 		WARN(1, "invalid initiator %d\n", reg_request->initiator);
+-		return;
++		goto out_free;
+ 	}
+ 
+ 	/* This is required so that the orig_* parameters are saved */
+ 	if (treatment == REG_REQ_ALREADY_SET && wiphy &&
+ 	    wiphy->regulatory_flags & REGULATORY_STRICT_REG)
+ 		wiphy_update_regulatory(wiphy, reg_request->initiator);
++
++	return;
++
++out_free:
++	kfree(reg_request);
+ }
+ 
+ /*
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index d1ed4aebbbb7..38d6dd553770 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -284,14 +284,22 @@ void cfg80211_sched_scan_results(struct wiphy *wiphy)
+ }
+ EXPORT_SYMBOL(cfg80211_sched_scan_results);
+ 
+-void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
++void cfg80211_sched_scan_stopped_rtnl(struct wiphy *wiphy)
+ {
+ 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+ 
++	ASSERT_RTNL();
++
+ 	trace_cfg80211_sched_scan_stopped(wiphy);
+ 
+-	rtnl_lock();
+ 	__cfg80211_stop_sched_scan(rdev, true);
++}
++EXPORT_SYMBOL(cfg80211_sched_scan_stopped_rtnl);
++
++void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
++{
++	rtnl_lock();
++	cfg80211_sched_scan_stopped_rtnl(wiphy);
+ 	rtnl_unlock();
+ }
+ EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
+diff --git a/net/wireless/sme.c b/net/wireless/sme.c
+index f04d4c32e96e..760722f9126b 100644
+--- a/net/wireless/sme.c
++++ b/net/wireless/sme.c
+@@ -235,7 +235,6 @@ void cfg80211_conn_work(struct work_struct *work)
+ 					NULL, 0, NULL, 0,
+ 					WLAN_STATUS_UNSPECIFIED_FAILURE,
+ 					false, NULL);
+-			cfg80211_sme_free(wdev);
+ 		}
+ 		wdev_unlock(wdev);
+ 	}
+@@ -649,6 +648,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
+ 			cfg80211_unhold_bss(bss_from_pub(bss));
+ 			cfg80211_put_bss(wdev->wiphy, bss);
+ 		}
++		cfg80211_sme_free(wdev);
+ 		return;
+ 	}
+ 
+diff --git a/security/device_cgroup.c b/security/device_cgroup.c
+index d3b6d2cd3a06..6e4e6eb732fe 100644
+--- a/security/device_cgroup.c
++++ b/security/device_cgroup.c
+@@ -308,57 +308,139 @@ static int devcgroup_seq_show(struct seq_file *m, void *v)
+ }
+ 
+ /**
+- * may_access - verifies if a new exception is part of what is allowed
+- *		by a dev cgroup based on the default policy +
+- *		exceptions. This is used to make sure a child cgroup
+- *		won't have more privileges than its parent or to
+- *		verify if a certain access is allowed.
+- * @dev_cgroup: dev cgroup to be tested against
+- * @refex: new exception
+- * @behavior: behavior of the exception
++ * match_exception	- iterates the exception list trying to match a rule
++ * 			  based on type, major, minor and access type. It is
++ * 			  considered a match if an exception is found that
++ * 			  will contain the entire range of provided parameters.
++ * @exceptions: list of exceptions
++ * @type: device type (DEV_BLOCK or DEV_CHAR)
++ * @major: device file major number, ~0 to match all
++ * @minor: device file minor number, ~0 to match all
++ * @access: permission mask (ACC_READ, ACC_WRITE, ACC_MKNOD)
++ *
++ * returns: true in case it matches an exception completely
+  */
+-static bool may_access(struct dev_cgroup *dev_cgroup,
+-		       struct dev_exception_item *refex,
+-		       enum devcg_behavior behavior)
++static bool match_exception(struct list_head *exceptions, short type,
++			    u32 major, u32 minor, short access)
+ {
+ 	struct dev_exception_item *ex;
+-	bool match = false;
+ 
+-	rcu_lockdep_assert(rcu_read_lock_held() ||
+-			   lockdep_is_held(&devcgroup_mutex),
+-			   "device_cgroup::may_access() called without proper synchronization");
++	list_for_each_entry_rcu(ex, exceptions, list) {
++		if ((type & DEV_BLOCK) && !(ex->type & DEV_BLOCK))
++			continue;
++		if ((type & DEV_CHAR) && !(ex->type & DEV_CHAR))
++			continue;
++		if (ex->major != ~0 && ex->major != major)
++			continue;
++		if (ex->minor != ~0 && ex->minor != minor)
++			continue;
++		/* provided access cannot have more than the exception rule */
++		if (access & (~ex->access))
++			continue;
++		return true;
++	}
++	return false;
++}
++
++/**
++ * match_exception_partial - iterates the exception list trying to match a rule
++ * 			     based on type, major, minor and access type. It is
++ * 			     considered a match if an exception's range is
++ * 			     found to contain *any* of the devices specified by
++ * 			     provided parameters. This is used to make sure no
++ * 			     extra access is being granted that is forbidden by
++ * 			     any of the exception list.
++ * @exceptions: list of exceptions
++ * @type: device type (DEV_BLOCK or DEV_CHAR)
++ * @major: device file major number, ~0 to match all
++ * @minor: device file minor number, ~0 to match all
++ * @access: permission mask (ACC_READ, ACC_WRITE, ACC_MKNOD)
++ *
++ * returns: true in case the provided range mat matches an exception completely
++ */
++static bool match_exception_partial(struct list_head *exceptions, short type,
++				    u32 major, u32 minor, short access)
++{
++	struct dev_exception_item *ex;
+ 
+-	list_for_each_entry_rcu(ex, &dev_cgroup->exceptions, list) {
+-		if ((refex->type & DEV_BLOCK) && !(ex->type & DEV_BLOCK))
++	list_for_each_entry_rcu(ex, exceptions, list) {
++		if ((type & DEV_BLOCK) && !(ex->type & DEV_BLOCK))
+ 			continue;
+-		if ((refex->type & DEV_CHAR) && !(ex->type & DEV_CHAR))
++		if ((type & DEV_CHAR) && !(ex->type & DEV_CHAR))
+ 			continue;
+-		if (ex->major != ~0 && ex->major != refex->major)
++		/*
++		 * We must be sure that both the exception and the provided
++		 * range aren't masking all devices
++		 */
++		if (ex->major != ~0 && major != ~0 && ex->major != major)
+ 			continue;
+-		if (ex->minor != ~0 && ex->minor != refex->minor)
++		if (ex->minor != ~0 && minor != ~0 && ex->minor != minor)
+ 			continue;
+-		if (refex->access & (~ex->access))
++		/*
++		 * In order to make sure the provided range isn't matching
++		 * an exception, all its access bits shouldn't match the
++		 * exception's access bits
++		 */
++		if (!(access & ex->access))
+ 			continue;
+-		match = true;
+-		break;
++		return true;
+ 	}
++	return false;
++}
++
++/**
++ * verify_new_ex - verifies if a new exception is part of what is allowed
++ *		   by a dev cgroup based on the default policy +
++ *		   exceptions. This is used to make sure a child cgroup
++ *		   won't have more privileges than its parent
++ * @dev_cgroup: dev cgroup to be tested against
++ * @refex: new exception
++ * @behavior: behavior of the exception's dev_cgroup
++ */
++static bool verify_new_ex(struct dev_cgroup *dev_cgroup,
++		          struct dev_exception_item *refex,
++		          enum devcg_behavior behavior)
++{
++	bool match = false;
++
++	rcu_lockdep_assert(rcu_read_lock_held() ||
++			   lockdep_is_held(&devcgroup_mutex),
++			   "device_cgroup:verify_new_ex called without proper synchronization");
+ 
+ 	if (dev_cgroup->behavior == DEVCG_DEFAULT_ALLOW) {
+ 		if (behavior == DEVCG_DEFAULT_ALLOW) {
+-			/* the exception will deny access to certain devices */
++			/*
++			 * new exception in the child doesn't matter, only
++			 * adding extra restrictions
++			 */
+ 			return true;
+ 		} else {
+-			/* the exception will allow access to certain devices */
++			/*
++			 * new exception in the child will add more devices
++			 * that can be acessed, so it can't match any of
++			 * parent's exceptions, even slightly
++			 */
++			match = match_exception_partial(&dev_cgroup->exceptions,
++							refex->type,
++							refex->major,
++							refex->minor,
++							refex->access);
++
+ 			if (match)
+-				/*
+-				 * a new exception allowing access shouldn't
+-				 * match an parent's exception
+-				 */
+ 				return false;
+ 			return true;
+ 		}
+ 	} else {
+-		/* only behavior == DEVCG_DEFAULT_DENY allowed here */
++		/*
++		 * Only behavior == DEVCG_DEFAULT_DENY allowed here, therefore
++		 * the new exception will add access to more devices and must
++		 * be contained completely in an parent's exception to be
++		 * allowed
++		 */
++		match = match_exception(&dev_cgroup->exceptions, refex->type,
++					refex->major, refex->minor,
++					refex->access);
++
+ 		if (match)
+ 			/* parent has an exception that matches the proposed */
+ 			return true;
+@@ -380,7 +462,38 @@ static int parent_has_perm(struct dev_cgroup *childcg,
+ 
+ 	if (!parent)
+ 		return 1;
+-	return may_access(parent, ex, childcg->behavior);
++	return verify_new_ex(parent, ex, childcg->behavior);
++}
++
++/**
++ * parent_allows_removal - verify if it's ok to remove an exception
++ * @childcg: child cgroup from where the exception will be removed
++ * @ex: exception being removed
++ *
++ * When removing an exception in cgroups with default ALLOW policy, it must
++ * be checked if removing it will give the child cgroup more access than the
++ * parent.
++ *
++ * Return: true if it's ok to remove exception, false otherwise
++ */
++static bool parent_allows_removal(struct dev_cgroup *childcg,
++				  struct dev_exception_item *ex)
++{
++	struct dev_cgroup *parent = css_to_devcgroup(css_parent(&childcg->css));
++
++	if (!parent)
++		return true;
++
++	/* It's always allowed to remove access to devices */
++	if (childcg->behavior == DEVCG_DEFAULT_DENY)
++		return true;
++
++	/*
++	 * Make sure you're not removing part or a whole exception existing in
++	 * the parent cgroup
++	 */
++	return !match_exception_partial(&parent->exceptions, ex->type,
++					ex->major, ex->minor, ex->access);
+ }
+ 
+ /**
+@@ -618,17 +731,21 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
+ 
+ 	switch (filetype) {
+ 	case DEVCG_ALLOW:
+-		if (!parent_has_perm(devcgroup, &ex))
+-			return -EPERM;
+ 		/*
+ 		 * If the default policy is to allow by default, try to remove
+ 		 * an matching exception instead. And be silent about it: we
+ 		 * don't want to break compatibility
+ 		 */
+ 		if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) {
++			/* Check if the parent allows removing it first */
++			if (!parent_allows_removal(devcgroup, &ex))
++				return -EPERM;
+ 			dev_exception_rm(devcgroup, &ex);
+-			return 0;
++			break;
+ 		}
++
++		if (!parent_has_perm(devcgroup, &ex))
++			return -EPERM;
+ 		rc = dev_exception_add(devcgroup, &ex);
+ 		break;
+ 	case DEVCG_DENY:
+@@ -708,18 +825,18 @@ static int __devcgroup_check_permission(short type, u32 major, u32 minor,
+ 				        short access)
+ {
+ 	struct dev_cgroup *dev_cgroup;
+-	struct dev_exception_item ex;
+-	int rc;
+-
+-	memset(&ex, 0, sizeof(ex));
+-	ex.type = type;
+-	ex.major = major;
+-	ex.minor = minor;
+-	ex.access = access;
++	bool rc;
+ 
+ 	rcu_read_lock();
+ 	dev_cgroup = task_devcgroup(current);
+-	rc = may_access(dev_cgroup, &ex, dev_cgroup->behavior);
++	if (dev_cgroup->behavior == DEVCG_DEFAULT_ALLOW)
++		/* Can't match any of the exceptions, even partially */
++		rc = !match_exception_partial(&dev_cgroup->exceptions,
++					      type, major, minor, access);
++	else
++		/* Need to match completely one exception to be allowed */
++		rc = match_exception(&dev_cgroup->exceptions, type, major,
++				     minor, access);
+ 	rcu_read_unlock();
+ 
+ 	if (!rc)
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index a8dec9e9e876..22f7883fcb9a 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -3988,6 +3988,9 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
+ 	/* Lynx Point */
+ 	{ PCI_DEVICE(0x8086, 0x8c20),
+ 	  .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
++	/* 9 Series */
++	{ PCI_DEVICE(0x8086, 0x8ca0),
++	  .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+ 	/* Wellsburg */
+ 	{ PCI_DEVICE(0x8086, 0x8d20),
+ 	  .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 5ef95034d041..ce5b339d9333 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1123,8 +1123,10 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
+ 					    AMP_OUT_UNMUTE);
+ 
+ 	eld = &per_pin->sink_eld;
+-	if (!eld->monitor_present)
++	if (!eld->monitor_present) {
++		hdmi_set_channel_count(codec, per_pin->cvt_nid, channels);
+ 		return;
++	}
+ 
+ 	if (!non_pcm && per_pin->chmap_set)
+ 		ca = hdmi_manual_channel_allocation(channels, per_pin->chmap);
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 97db3b45b411..799348e9cdd0 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -154,6 +154,7 @@ static struct reg_default wm8962_reg[] = {
+ 	{ 40, 0x0000 },   /* R40    - SPKOUTL volume */
+ 	{ 41, 0x0000 },   /* R41    - SPKOUTR volume */
+ 
++	{ 49, 0x0010 },   /* R49    - Class D Control 1 */
+ 	{ 51, 0x0003 },   /* R51    - Class D Control 2 */
+ 
+ 	{ 56, 0x0506 },   /* R56    - Clocking 4 */
+@@ -795,7 +796,6 @@ static bool wm8962_volatile_register(struct device *dev, unsigned int reg)
+ 	case WM8962_ALC2:
+ 	case WM8962_THERMAL_SHUTDOWN_STATUS:
+ 	case WM8962_ADDITIONAL_CONTROL_4:
+-	case WM8962_CLASS_D_CONTROL_1:
+ 	case WM8962_DC_SERVO_6:
+ 	case WM8962_INTERRUPT_STATUS_1:
+ 	case WM8962_INTERRUPT_STATUS_2:
+@@ -2922,13 +2922,22 @@ static int wm8962_set_fll(struct snd_soc_codec *codec, int fll_id, int source,
+ static int wm8962_mute(struct snd_soc_dai *dai, int mute)
+ {
+ 	struct snd_soc_codec *codec = dai->codec;
+-	int val;
++	int val, ret;
+ 
+ 	if (mute)
+-		val = WM8962_DAC_MUTE;
++		val = WM8962_DAC_MUTE | WM8962_DAC_MUTE_ALT;
+ 	else
+ 		val = 0;
+ 
++	/**
++	 * The DAC mute bit is mirrored in two registers, update both to keep
++	 * the register cache consistent.
++	 */
++	ret = snd_soc_update_bits(codec, WM8962_CLASS_D_CONTROL_1,
++				  WM8962_DAC_MUTE_ALT, val);
++	if (ret < 0)
++		return ret;
++
+ 	return snd_soc_update_bits(codec, WM8962_ADC_DAC_CONTROL_1,
+ 				   WM8962_DAC_MUTE, val);
+ }
+diff --git a/sound/soc/codecs/wm8962.h b/sound/soc/codecs/wm8962.h
+index a1a5d5294c19..910aafd09d21 100644
+--- a/sound/soc/codecs/wm8962.h
++++ b/sound/soc/codecs/wm8962.h
+@@ -1954,6 +1954,10 @@
+ #define WM8962_SPKOUTL_ENA_MASK                 0x0040  /* SPKOUTL_ENA */
+ #define WM8962_SPKOUTL_ENA_SHIFT                     6  /* SPKOUTL_ENA */
+ #define WM8962_SPKOUTL_ENA_WIDTH                     1  /* SPKOUTL_ENA */
++#define WM8962_DAC_MUTE_ALT                     0x0010  /* DAC_MUTE */
++#define WM8962_DAC_MUTE_ALT_MASK                0x0010  /* DAC_MUTE */
++#define WM8962_DAC_MUTE_ALT_SHIFT                    4  /* DAC_MUTE */
++#define WM8962_DAC_MUTE_ALT_WIDTH                    1  /* DAC_MUTE */
+ #define WM8962_SPKOUTL_PGA_MUTE                 0x0002  /* SPKOUTL_PGA_MUTE */
+ #define WM8962_SPKOUTL_PGA_MUTE_MASK            0x0002  /* SPKOUTL_PGA_MUTE */
+ #define WM8962_SPKOUTL_PGA_MUTE_SHIFT                1  /* SPKOUTL_PGA_MUTE */
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 910223782c5c..c1369c3ad643 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3649,8 +3649,11 @@ void snd_soc_dapm_connect_dai_link_widgets(struct snd_soc_card *card)
+ 		cpu_dai = rtd->cpu_dai;
+ 		codec_dai = rtd->codec_dai;
+ 
+-		/* dynamic FE links have no fixed DAI mapping */
+-		if (rtd->dai_link->dynamic)
++		/*
++		 * dynamic FE links have no fixed DAI mapping.
++		 * CODEC<->CODEC links have no direct connection.
++		 */
++		if (rtd->dai_link->dynamic || rtd->dai_link->params)
+ 			continue;
+ 
+ 		/* there is no point in connecting BE DAI links with dummies */
+diff --git a/sound/usb/card.h b/sound/usb/card.h
+index 9867ab866857..97acb906acc2 100644
+--- a/sound/usb/card.h
++++ b/sound/usb/card.h
+@@ -92,6 +92,7 @@ struct snd_usb_endpoint {
+ 	unsigned int curframesize;      /* current packet size in frames (for capture) */
+ 	unsigned int syncmaxsize;	/* sync endpoint packet size */
+ 	unsigned int fill_max:1;	/* fill max packet size always */
++	unsigned int udh01_fb_quirk:1;	/* corrupted feedback data */
+ 	unsigned int datainterval;      /* log_2 of data packet interval */
+ 	unsigned int syncinterval;	/* P for adaptive mode, 0 otherwise */
+ 	unsigned char silence_value;
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 83aabea259d7..814430fec6a2 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -469,6 +469,10 @@ struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip,
+ 			ep->syncinterval = 3;
+ 
+ 		ep->syncmaxsize = le16_to_cpu(get_endpoint(alts, 1)->wMaxPacketSize);
++
++		if (chip->usb_id == USB_ID(0x0644, 0x8038) /* TEAC UD-H01 */ &&
++		    ep->syncmaxsize == 4)
++			ep->udh01_fb_quirk = 1;
+ 	}
+ 
+ 	list_add_tail(&ep->list, &chip->ep_list);
+@@ -1099,7 +1103,16 @@ void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep,
+ 	if (f == 0)
+ 		return;
+ 
+-	if (unlikely(ep->freqshift == INT_MIN)) {
++	if (unlikely(sender->udh01_fb_quirk)) {
++		/*
++		 * The TEAC UD-H01 firmware sometimes changes the feedback value
++		 * by +/- 0x1.0000.
++		 */
++		if (f < ep->freqn - 0x8000)
++			f += 0x10000;
++		else if (f > ep->freqn + 0x8000)
++			f -= 0x10000;
++	} else if (unlikely(ep->freqshift == INT_MIN)) {
+ 		/*
+ 		 * The first time we see a feedback value, determine its format
+ 		 * by shifting it left or right until it matches the nominal

Deleted: genpatches-2.6/trunk/3.14/1501-futex-add-another-early-deadlock-detection-check.patch
===================================================================
--- genpatches-2.6/trunk/3.14/1501-futex-add-another-early-deadlock-detection-check.patch	2014-06-06 20:06:46 UTC (rev 2814)
+++ genpatches-2.6/trunk/3.14/1501-futex-add-another-early-deadlock-detection-check.patch	2014-06-07 23:56:08 UTC (rev 2815)
@@ -1,160 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Mon, 12 May 2014 20:45:34 +0000
-Subject: futex: Add another early deadlock detection check
-Git-commit: 866293ee54227584ffcb4a42f69c1f365974ba7f
-
-Dave Jones trinity syscall fuzzer exposed an issue in the deadlock
-detection code of rtmutex:
-  http://lkml.kernel.org/r/20140429151655.GA14277@××××××.com
-
-That underlying issue has been fixed with a patch to the rtmutex code,
-but the futex code must not call into rtmutex in that case because
-    - it can detect that issue early
-    - it avoids a different and more complex fixup for backing out
-
-If the user space variable got manipulated to 0x80000000 which means
-no lock holder, but the waiters bit set and an active pi_state in the
-kernel is found we can figure out the recursive locking issue by
-looking at the pi_state owner. If that is the current task, then we
-can safely return -EDEADLK.
-
-The check should have been added in commit 59fa62451 (futex: Handle
-futex_pi OWNER_DIED take over correctly) already, but I did not see
-the above issue caused by user space manipulation back then.
-
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: Dave Jones <davej@××××××.com>
-Cc: Linus Torvalds <torvalds@××××××××××××××××.org>
-Cc: Peter Zijlstra <peterz@×××××××××.org>
-Cc: Darren Hart <darren@××××××.com>
-Cc: Davidlohr Bueso <davidlohr@××.com>
-Cc: Steven Rostedt <rostedt@×××××××.org>
-Cc: Clark Williams <williams@××××××.com>
-Cc: Paul McKenney <paulmck@××××××××××××××.com>
-Cc: Lai Jiangshan <laijs@××××××××××.com>
-Cc: Roland McGrath <roland@×××××××××.com>
-Cc: Carlos ODonell <carlos@××××××.com>
-Cc: Jakub Jelinek <jakub@××××××.com>
-Cc: Michael Kerrisk <mtk.manpages@×××××.com>
-Cc: Sebastian Andrzej Siewior <bigeasy@××××××××××.de>
-Link: http://lkml.kernel.org/r/20140512201701.097349971@××××××××××.de
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: stable@×××××××××××.org
----
- kernel/futex.c | 47 ++++++++++++++++++++++++++++++++++-------------
- 1 file changed, 34 insertions(+), 13 deletions(-)
-
-Index: linux-3.12/kernel/futex.c
-===================================================================
---- linux-3.12.orig/kernel/futex.c
-+++ linux-3.12/kernel/futex.c
-@@ -596,7 +596,8 @@ void exit_pi_state_list(struct task_stru
- 
- static int
- lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
--		union futex_key *key, struct futex_pi_state **ps)
-+		union futex_key *key, struct futex_pi_state **ps,
-+		struct task_struct *task)
- {
- 	struct futex_pi_state *pi_state = NULL;
- 	struct futex_q *this, *next;
-@@ -640,6 +641,16 @@ lookup_pi_state(u32 uval, struct futex_h
- 					return -EINVAL;
- 			}
- 
-+			/*
-+			 * Protect against a corrupted uval. If uval
-+			 * is 0x80000000 then pid is 0 and the waiter
-+			 * bit is set. So the deadlock check in the
-+			 * calling code has failed and we did not fall
-+			 * into the check above due to !pid.
-+			 */
-+			if (task && pi_state->owner == task)
-+				return -EDEADLK;
-+
- 			atomic_inc(&pi_state->refcount);
- 			*ps = pi_state;
- 
-@@ -789,7 +800,7 @@ retry:
- 	 * We dont have the lock. Look up the PI state (or create it if
- 	 * we are the first waiter):
- 	 */
--	ret = lookup_pi_state(uval, hb, key, ps);
-+	ret = lookup_pi_state(uval, hb, key, ps, task);
- 
- 	if (unlikely(ret)) {
- 		switch (ret) {
-@@ -1199,7 +1210,7 @@ void requeue_pi_wake_futex(struct futex_
-  *
-  * Return:
-  *  0 - failed to acquire the lock atomically;
-- *  1 - acquired the lock;
-+ * >0 - acquired the lock, return value is vpid of the top_waiter
-  * <0 - error
-  */
- static int futex_proxy_trylock_atomic(u32 __user *pifutex,
-@@ -1210,7 +1221,7 @@ static int futex_proxy_trylock_atomic(u3
- {
- 	struct futex_q *top_waiter = NULL;
- 	u32 curval;
--	int ret;
-+	int ret, vpid;
- 
- 	if (get_futex_value_locked(&curval, pifutex))
- 		return -EFAULT;
-@@ -1238,11 +1249,13 @@ static int futex_proxy_trylock_atomic(u3
- 	 * the contended case or if set_waiters is 1.  The pi_state is returned
- 	 * in ps in contended cases.
- 	 */
-+	vpid = task_pid_vnr(top_waiter->task);
- 	ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
- 				   set_waiters);
--	if (ret == 1)
-+	if (ret == 1) {
- 		requeue_pi_wake_futex(top_waiter, key2, hb2);
--
-+		return vpid;
-+	}
- 	return ret;
- }
- 
-@@ -1274,7 +1287,6 @@ static int futex_requeue(u32 __user *uad
- 	struct futex_hash_bucket *hb1, *hb2;
- 	struct plist_head *head1;
- 	struct futex_q *this, *next;
--	u32 curval2;
- 
- 	if (requeue_pi) {
- 		/*
-@@ -1360,16 +1372,25 @@ retry_private:
- 		 * At this point the top_waiter has either taken uaddr2 or is
- 		 * waiting on it.  If the former, then the pi_state will not
- 		 * exist yet, look it up one more time to ensure we have a
--		 * reference to it.
-+		 * reference to it. If the lock was taken, ret contains the
-+		 * vpid of the top waiter task.
- 		 */
--		if (ret == 1) {
-+		if (ret > 0) {
- 			WARN_ON(pi_state);
- 			drop_count++;
- 			task_count++;
--			ret = get_futex_value_locked(&curval2, uaddr2);
--			if (!ret)
--				ret = lookup_pi_state(curval2, hb2, &key2,
--						      &pi_state);
-+			/*
-+			 * If we acquired the lock, then the user
-+			 * space value of uaddr2 should be vpid. It
-+			 * cannot be changed by the top waiter as it
-+			 * is blocked on hb2 lock if it tries to do
-+			 * so. If something fiddled with it behind our
-+			 * back the pi state lookup might unearth
-+			 * it. So we rather use the known value than
-+			 * rereading and handing potential crap to
-+			 * lookup_pi_state.
-+			 */
-+			ret = lookup_pi_state(ret, hb2, &key2, &pi_state, NULL);
- 		}
- 
- 		switch (ret) {

Deleted: genpatches-2.6/trunk/3.14/1502-futex-prevent-attaching-to-kernel-threads.patch
===================================================================
--- genpatches-2.6/trunk/3.14/1502-futex-prevent-attaching-to-kernel-threads.patch	2014-06-06 20:06:46 UTC (rev 2814)
+++ genpatches-2.6/trunk/3.14/1502-futex-prevent-attaching-to-kernel-threads.patch	2014-06-07 23:56:08 UTC (rev 2815)
@@ -1,52 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Mon, 12 May 2014 20:45:35 +0000
-Subject: futex: Prevent attaching to kernel threads
-Git-commit: f0d71b3dcb8332f7971b5f2363632573e6d9486a
-
-We happily allow userspace to declare a random kernel thread to be the
-owner of a user space PI futex.
-
-Found while analysing the fallout of Dave Jones syscall fuzzer.
-
-We also should validate the thread group for private futexes and find
-some fast way to validate whether the "alleged" owner has RW access on
-the file which backs the SHM, but that's a separate issue.
-
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: Dave Jones <davej@××××××.com>
-Cc: Linus Torvalds <torvalds@××××××××××××××××.org>
-Cc: Peter Zijlstra <peterz@×××××××××.org>
-Cc: Darren Hart <darren@××××××.com>
-Cc: Davidlohr Bueso <davidlohr@××.com>
-Cc: Steven Rostedt <rostedt@×××××××.org>
-Cc: Clark Williams <williams@××××××.com>
-Cc: Paul McKenney <paulmck@××××××××××××××.com>
-Cc: Lai Jiangshan <laijs@××××××××××.com>
-Cc: Roland McGrath <roland@×××××××××.com>
-Cc: Carlos ODonell <carlos@××××××.com>
-Cc: Jakub Jelinek <jakub@××××××.com>
-Cc: Michael Kerrisk <mtk.manpages@×××××.com>
-Cc: Sebastian Andrzej Siewior <bigeasy@××××××××××.de>
-Link: http://lkml.kernel.org/r/20140512201701.194824402@××××××××××.de
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: stable@×××××××××××.org
----
- kernel/futex.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-Index: linux-3.12/kernel/futex.c
-===================================================================
---- linux-3.12.orig/kernel/futex.c
-+++ linux-3.12/kernel/futex.c
-@@ -668,6 +668,11 @@ lookup_pi_state(u32 uval, struct futex_h
- 	if (!p)
- 		return -ESRCH;
- 
-+	if (!p->mm) {
-+		put_task_struct(p);
-+		return -EPERM;
-+	}
-+
- 	/*
- 	 * We need to look at the task state flags to figure out,
- 	 * whether the task is exiting. To protect against the do_exit

Deleted: genpatches-2.6/trunk/3.14/1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch
===================================================================
--- genpatches-2.6/trunk/3.14/1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch	2014-06-06 20:06:46 UTC (rev 2814)
+++ genpatches-2.6/trunk/3.14/1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch	2014-06-07 23:56:08 UTC (rev 2815)
@@ -1,81 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Tue, 3 Jun 2014 12:27:06 +0000
-Subject: futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr ==
- uaddr2 in futex_requeue(..., requeue_pi=1)
-Git-commit: e9c243a5a6de0be8e584c604d353412584b592f8
-
-If uaddr == uaddr2, then we have broken the rule of only requeueing from
-a non-pi futex to a pi futex with this call.  If we attempt this, then
-dangling pointers may be left for rt_waiter resulting in an exploitable
-condition.
-
-This change brings futex_requeue() in line with futex_wait_requeue_pi()
-which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
-uaddr == uaddr2 in futex_wait_requeue_pi()")
-
-[ tglx: Compare the resulting keys as well, as uaddrs might be
-  	different depending on the mapping ]
-
-Fixes CVE-2014-3153.
-
-Reported-by: Pinkie Pie
-Signed-off-by: Will Drewry <wad@××××××××.org>
-Signed-off-by: Kees Cook <keescook@××××××××.org>
-Cc: stable@×××××××××××.org
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Reviewed-by: Darren Hart <dvhart@×××××××××××.com>
-Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
----
- kernel/futex.c | 25 +++++++++++++++++++++++++
- 1 file changed, 25 insertions(+)
-
-Index: linux-3.12/kernel/futex.c
-===================================================================
---- linux-3.12.orig/kernel/futex.c
-+++ linux-3.12/kernel/futex.c
-@@ -1295,6 +1295,13 @@ static int futex_requeue(u32 __user *uad
- 
- 	if (requeue_pi) {
- 		/*
-+		 * Requeue PI only works on two distinct uaddrs. This
-+		 * check is only valid for private futexes. See below.
-+		 */
-+		if (uaddr1 == uaddr2)
-+			return -EINVAL;
-+
-+		/*
- 		 * requeue_pi requires a pi_state, try to allocate it now
- 		 * without any locks in case it fails.
- 		 */
-@@ -1332,6 +1339,15 @@ retry:
- 	if (unlikely(ret != 0))
- 		goto out_put_key1;
- 
-+	/*
-+	 * The check above which compares uaddrs is not sufficient for
-+	 * shared futexes. We need to compare the keys:
-+	 */
-+	if (requeue_pi && match_futex(&key1, &key2)) {
-+		ret = -EINVAL;
-+		goto out_put_keys;
-+	}
-+
- 	hb1 = hash_futex(&key1);
- 	hb2 = hash_futex(&key2);
- 
-@@ -2362,6 +2378,15 @@ static int futex_wait_requeue_pi(u32 __u
- 	if (ret)
- 		goto out_key2;
- 
-+	/*
-+	 * The check above which compares uaddrs is not sufficient for
-+	 * shared futexes. We need to compare the keys:
-+	 */
-+	if (match_futex(&q.key, &key2)) {
-+		ret = -EINVAL;
-+		goto out_put_keys;
-+	}
-+
- 	/* Queue the futex_q, drop the hb lock, wait for wakeup. */
- 	futex_wait_queue_me(hb, &q, to);
- 

Deleted: genpatches-2.6/trunk/3.14/1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch
===================================================================
--- genpatches-2.6/trunk/3.14/1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch	2014-06-06 20:06:46 UTC (rev 2814)
+++ genpatches-2.6/trunk/3.14/1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch	2014-06-07 23:56:08 UTC (rev 2815)
@@ -1,53 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Tue, 3 Jun 2014 12:27:06 +0000
-Subject: futex: Validate atomic acquisition in futex_lock_pi_atomic()
-Git-commit: b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270
-
-We need to protect the atomic acquisition in the kernel against rogue
-user space which sets the user space futex to 0, so the kernel side
-acquisition succeeds while there is existing state in the kernel
-associated to the real owner.
-
-Verify whether the futex has waiters associated with kernel state.  If
-it has, return -EINVAL.  The state is corrupted already, so no point in
-cleaning it up.  Subsequent calls will fail as well.  Not our problem.
-
-[ tglx: Use futex_top_waiter() and explain why we do not need to try
-  	restoring the already corrupted user space state. ]
-
-Signed-off-by: Darren Hart <dvhart@×××××××××××.com>
-Cc: Kees Cook <keescook@××××××××.org>
-Cc: Will Drewry <wad@××××××××.org>
-Cc: stable@×××××××××××.org
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
----
- kernel/futex.c | 14 +++++++++++---
- 1 file changed, 11 insertions(+), 3 deletions(-)
-
-Index: linux-3.12/kernel/futex.c
-===================================================================
---- linux-3.12.orig/kernel/futex.c
-+++ linux-3.12/kernel/futex.c
-@@ -764,10 +764,18 @@ retry:
- 		return -EDEADLK;
- 
- 	/*
--	 * Surprise - we got the lock. Just return to userspace:
-+	 * Surprise - we got the lock, but we do not trust user space at all.
- 	 */
--	if (unlikely(!curval))
--		return 1;
-+	if (unlikely(!curval)) {
-+		/*
-+		 * We verify whether there is kernel state for this
-+		 * futex. If not, we can safely assume, that the 0 ->
-+		 * TID transition is correct. If state exists, we do
-+		 * not bother to fixup the user space state as it was
-+		 * corrupted already.
-+		 */
-+		return futex_top_waiter(hb, key) ? -EINVAL : 1;
-+	}
- 
- 	uval = curval;
- 

Deleted: genpatches-2.6/trunk/3.14/1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch
===================================================================
--- genpatches-2.6/trunk/3.14/1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch	2014-06-06 20:06:46 UTC (rev 2814)
+++ genpatches-2.6/trunk/3.14/1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch	2014-06-07 23:56:08 UTC (rev 2815)
@@ -1,99 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Tue, 3 Jun 2014 12:27:07 +0000
-Subject: futex: Always cleanup owner tid in unlock_pi
-Git-commit: 13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e
-
-If the owner died bit is set at futex_unlock_pi, we currently do not
-cleanup the user space futex.  So the owner TID of the current owner
-(the unlocker) persists.  That's observable inconsistant state,
-especially when the ownership of the pi state got transferred.
-
-Clean it up unconditionally.
-
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: Kees Cook <keescook@××××××××.org>
-Cc: Will Drewry <wad@××××××××.org>
-Cc: Darren Hart <dvhart@×××××××××××.com>
-Cc: stable@×××××××××××.org
-Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
----
- kernel/futex.c | 40 ++++++++++++++++++----------------------
- 1 file changed, 18 insertions(+), 22 deletions(-)
-
-Index: linux-3.12/kernel/futex.c
-===================================================================
---- linux-3.12.orig/kernel/futex.c
-+++ linux-3.12/kernel/futex.c
-@@ -905,6 +905,7 @@ static int wake_futex_pi(u32 __user *uad
- 	struct task_struct *new_owner;
- 	struct futex_pi_state *pi_state = this->pi_state;
- 	u32 uninitialized_var(curval), newval;
-+	int ret = 0;
- 
- 	if (!pi_state)
- 		return -EINVAL;
-@@ -928,23 +929,19 @@ static int wake_futex_pi(u32 __user *uad
- 		new_owner = this->task;
- 
- 	/*
--	 * We pass it to the next owner. (The WAITERS bit is always
--	 * kept enabled while there is PI state around. We must also
--	 * preserve the owner died bit.)
--	 */
--	if (!(uval & FUTEX_OWNER_DIED)) {
--		int ret = 0;
--
--		newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
--
--		if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
--			ret = -EFAULT;
--		else if (curval != uval)
--			ret = -EINVAL;
--		if (ret) {
--			raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
--			return ret;
--		}
-+	 * We pass it to the next owner. The WAITERS bit is always
-+	 * kept enabled while there is PI state around. We cleanup the
-+	 * owner died bit, because we are the owner.
-+	 */
-+	newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
-+
-+	if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
-+		ret = -EFAULT;
-+	else if (curval != uval)
-+		ret = -EINVAL;
-+	if (ret) {
-+		raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
-+		return ret;
- 	}
- 
- 	raw_spin_lock_irq(&pi_state->owner->pi_lock);
-@@ -2189,9 +2186,10 @@ retry:
- 	/*
- 	 * To avoid races, try to do the TID -> 0 atomic transition
- 	 * again. If it succeeds then we can return without waking
--	 * anyone else up:
-+	 * anyone else up. We only try this if neither the waiters nor
-+	 * the owner died bit are set.
- 	 */
--	if (!(uval & FUTEX_OWNER_DIED) &&
-+	if (!(uval & ~FUTEX_TID_MASK) &&
- 	    cmpxchg_futex_value_locked(&uval, uaddr, vpid, 0))
- 		goto pi_faulted;
- 	/*
-@@ -2223,11 +2221,9 @@ retry:
- 	/*
- 	 * No waiters - kernel unlocks the futex:
- 	 */
--	if (!(uval & FUTEX_OWNER_DIED)) {
--		ret = unlock_futex_pi(uaddr, uval);
--		if (ret == -EFAULT)
--			goto pi_faulted;
--	}
-+	ret = unlock_futex_pi(uaddr, uval);
-+	if (ret == -EFAULT)
-+		goto pi_faulted;
- 
- out_unlock:
- 	spin_unlock(&hb->lock);

Deleted: genpatches-2.6/trunk/3.14/1506-futex-make-lookup_pi_state-more-robust.patch
===================================================================
(Binary files differ)