[gentoo-commits] linux-patches r2265 - genpatches-2.6/trunk/3.7

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2013-01-28 23:19:34 +0000 (Mon, 28 Jan 2013)
New Revision: 2265

Added:
   genpatches-2.6/trunk/3.7/1004_linux-3.7.5.patch
Modified:
   genpatches-2.6/trunk/3.7/0000_README
Log:
Linux patch 3.7.5

Modified: genpatches-2.6/trunk/3.7/0000_README
===================================================================
--- genpatches-2.6/trunk/3.7/0000_README	2013-01-26 00:22:40 UTC (rev 2264)
+++ genpatches-2.6/trunk/3.7/0000_README	2013-01-28 23:19:34 UTC (rev 2265)
@@ -55,6 +55,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.7.4
 
+Patch:  1004_linux-3.7.5.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.7.5
+
 Patch:  2400_kcopy-patch-for-infiniband-driver.patch
 From:   Alexey Shvetsov <alexxy@g.o>
 Desc:   Zero copy for infiniband psm userspace driver

Added: genpatches-2.6/trunk/3.7/1004_linux-3.7.5.patch
===================================================================
--- genpatches-2.6/trunk/3.7/1004_linux-3.7.5.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.7/1004_linux-3.7.5.patch	2013-01-28 23:19:34 UTC (rev 2265)
@@ -0,0 +1,2006 @@
+diff --git a/Makefile b/Makefile
+index f9196bc..ecf87b1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 7
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+ NAME = Terrified Chipmunk
+ 
+@@ -169,7 +169,7 @@ SUBARCH := $(shell uname -m | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ \
+ 				  -e s/arm.*/arm/ -e s/sa110/arm/ \
+ 				  -e s/s390x/s390/ -e s/parisc64/parisc/ \
+ 				  -e s/ppc.*/powerpc/ -e s/mips.*/mips/ \
+-				  -e s/sh[234].*/sh/ )
++				  -e s/sh[234].*/sh/ -e s/aarch64.*/arm64/ )
+ 
+ # Cross compiling and selecting different set of gcc/bin-utils
+ # ---------------------------------------------------------------------------
+diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
+index 07fea29..fe32c0e 100644
+--- a/arch/arm64/include/asm/elf.h
++++ b/arch/arm64/include/asm/elf.h
+@@ -26,7 +26,10 @@
+ 
+ typedef unsigned long elf_greg_t;
+ 
+-#define ELF_NGREG (sizeof (struct pt_regs) / sizeof(elf_greg_t))
++#define ELF_NGREG (sizeof(struct user_pt_regs) / sizeof(elf_greg_t))
++#define ELF_CORE_COPY_REGS(dest, regs)	\
++	*(struct user_pt_regs *)&(dest) = (regs)->user_regs;
++
+ typedef elf_greg_t elf_gregset_t[ELF_NGREG];
+ typedef struct user_fpsimd_state elf_fpregset_t;
+ 
+diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
+index 4a3374e..d18b2b8 100644
+--- a/arch/x86/kernel/cpu/perf_event.c
++++ b/arch/x86/kernel/cpu/perf_event.c
+@@ -340,9 +340,6 @@ int x86_setup_perfctr(struct perf_event *event)
+ 		/* BTS is currently only allowed for user-mode. */
+ 		if (!attr->exclude_kernel)
+ 			return -EOPNOTSUPP;
+-
+-		if (!attr->exclude_guest)
+-			return -EOPNOTSUPP;
+ 	}
+ 
+ 	hwc->config |= config;
+@@ -385,9 +382,6 @@ int x86_pmu_hw_config(struct perf_event *event)
+ 	if (event->attr.precise_ip) {
+ 		int precise = 0;
+ 
+-		if (!event->attr.exclude_guest)
+-			return -EOPNOTSUPP;
+-
+ 		/* Support for constant skid */
+ 		if (x86_pmu.pebs_active && !x86_pmu.pebs_broken) {
+ 			precise++;
+diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
+index cd3b243..9b4d51d 100644
+--- a/arch/x86/kernel/step.c
++++ b/arch/x86/kernel/step.c
+@@ -165,10 +165,11 @@ void set_task_blockstep(struct task_struct *task, bool on)
+ 	 * Ensure irq/preemption can't change debugctl in between.
+ 	 * Note also that both TIF_BLOCKSTEP and debugctl should
+ 	 * be changed atomically wrt preemption.
+-	 * FIXME: this means that set/clear TIF_BLOCKSTEP is simply
+-	 * wrong if task != current, SIGKILL can wakeup the stopped
+-	 * tracee and set/clear can play with the running task, this
+-	 * can confuse the next __switch_to_xtra().
++	 *
++	 * NOTE: this means that set/clear TIF_BLOCKSTEP is only safe if
++	 * task is current or it can't be running, otherwise we can race
++	 * with __switch_to_xtra(). We rely on ptrace_freeze_traced() but
++	 * PTRACE_KILL is not safe.
+ 	 */
+ 	local_irq_disable();
+ 	debugctl = get_debugctlmsr();
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index e8086c7..53dc256 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1009,6 +1009,9 @@ static int acpi_processor_setup_cpuidle_cx(struct acpi_processor *pr)
+ 		return -EINVAL;
+ 	}
+ 
++	if (!dev)
++		return -EINVAL;
++
+ 	dev->cpu = pr->id;
+ 
+ 	if (max_cstate == 0)
+@@ -1200,6 +1203,7 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
+ 		}
+ 
+ 		/* Populate Updated C-state information */
++		acpi_processor_get_power_info(pr);
+ 		acpi_processor_setup_cpuidle_states(pr);
+ 
+ 		/* Enable all cpuidle devices */
+diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
+index 836bfe0..53e7ac9 100644
+--- a/drivers/acpi/processor_perflib.c
++++ b/drivers/acpi/processor_perflib.c
+@@ -340,6 +340,13 @@ static void amd_fixup_frequency(struct acpi_processor_px *px, int i)
+ 	if ((boot_cpu_data.x86 == 0x10 && boot_cpu_data.x86_model < 10)
+ 	    || boot_cpu_data.x86 == 0x11) {
+ 		rdmsr(MSR_AMD_PSTATE_DEF_BASE + index, lo, hi);
++		/*
++		 * MSR C001_0064+:
++		 * Bit 63: PstateEn. Read-write. If set, the P-state is valid.
++		 */
++		if (!(hi & BIT(31)))
++			return;
++
+ 		fid = lo & 0x3f;
+ 		did = (lo >> 6) & 7;
+ 		if (boot_cpu_data.x86 == 0x10)
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 7862d17..4979127 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -53,6 +53,7 @@
+ 
+ enum {
+ 	AHCI_PCI_BAR_STA2X11	= 0,
++	AHCI_PCI_BAR_ENMOTUS	= 2,
+ 	AHCI_PCI_BAR_STANDARD	= 5,
+ };
+ 
+@@ -410,6 +411,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	{ PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci },	/* ASM1061 */
+ 	{ PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },	/* ASM1062 */
+ 
++	/* Enmotus */
++	{ PCI_DEVICE(0x1c44, 0x8000), board_ahci },
++
+ 	/* Generic, PCI class code for AHCI */
+ 	{ PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+ 	  PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci },
+@@ -1098,9 +1102,11 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 		dev_info(&pdev->dev,
+ 			 "PDC42819 can only drive SATA devices with this driver\n");
+ 
+-	/* The Connext uses non-standard BAR */
++	/* Both Connext and Enmotus devices use non-standard BARs */
+ 	if (pdev->vendor == PCI_VENDOR_ID_STMICRO && pdev->device == 0xCC06)
+ 		ahci_pci_bar = AHCI_PCI_BAR_STA2X11;
++	else if (pdev->vendor == 0x1c44 && pdev->device == 0x8000)
++		ahci_pci_bar = AHCI_PCI_BAR_ENMOTUS;
+ 
+ 	/* acquire resources */
+ 	rc = pcim_enable_device(pdev);
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index 4201e53..1d40fe8 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -1951,13 +1951,13 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep)
+ 	/* Use the nominal value 10 ms if the read MDAT is zero,
+ 	 * the nominal value of DETO is 20 ms.
+ 	 */
+-	if (dev->sata_settings[ATA_LOG_DEVSLP_VALID] &
++	if (dev->devslp_timing[ATA_LOG_DEVSLP_VALID] &
+ 	    ATA_LOG_DEVSLP_VALID_MASK) {
+-		mdat = dev->sata_settings[ATA_LOG_DEVSLP_MDAT] &
++		mdat = dev->devslp_timing[ATA_LOG_DEVSLP_MDAT] &
+ 		       ATA_LOG_DEVSLP_MDAT_MASK;
+ 		if (!mdat)
+ 			mdat = 10;
+-		deto = dev->sata_settings[ATA_LOG_DEVSLP_DETO];
++		deto = dev->devslp_timing[ATA_LOG_DEVSLP_DETO];
+ 		if (!deto)
+ 			deto = 20;
+ 	} else {
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 586362e..c8ac4fe 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2324,24 +2324,28 @@ int ata_dev_configure(struct ata_device *dev)
+ 			}
+ 		}
+ 
+-		/* check and mark DevSlp capability */
+-		if (ata_id_has_devslp(dev->id))
+-			dev->flags |= ATA_DFLAG_DEVSLP;
+-
+-		/* Obtain SATA Settings page from Identify Device Data Log,
+-		 * which contains DevSlp timing variables etc.
+-		 * Exclude old devices with ata_id_has_ncq()
++		/* Check and mark DevSlp capability. Get DevSlp timing variables
++		 * from SATA Settings page of Identify Device Data Log.
+ 		 */
+-		if (ata_id_has_ncq(dev->id)) {
++		if (ata_id_has_devslp(dev->id)) {
++			u8 sata_setting[ATA_SECT_SIZE];
++			int i, j;
++
++			dev->flags |= ATA_DFLAG_DEVSLP;
+ 			err_mask = ata_read_log_page(dev,
+ 						     ATA_LOG_SATA_ID_DEV_DATA,
+ 						     ATA_LOG_SATA_SETTINGS,
+-						     dev->sata_settings,
++						     sata_setting,
+ 						     1);
+ 			if (err_mask)
+ 				ata_dev_dbg(dev,
+ 					    "failed to get Identify Device Data, Emask 0x%x\n",
+ 					    err_mask);
++			else
++				for (i = 0; i < ATA_LOG_DEVSLP_SIZE; i++) {
++					j = ATA_LOG_DEVSLP_OFFSET + i;
++					dev->devslp_timing[i] = sata_setting[j];
++				}
+ 		}
+ 
+ 		dev->cdb_len = 16;
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index bf039b0..bcf4437 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2094,7 +2094,7 @@ static unsigned int ata_eh_speed_down(struct ata_device *dev,
+  */
+ static inline int ata_eh_worth_retry(struct ata_queued_cmd *qc)
+ {
+-	if (qc->flags & AC_ERR_MEDIA)
++	if (qc->err_mask & AC_ERR_MEDIA)
+ 		return 0;	/* don't retry media errors */
+ 	if (qc->flags & ATA_QCFLAG_IO)
+ 		return 1;	/* otherwise retry anything from fs stack */
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 0bdde8f..07a18e2 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -889,6 +889,7 @@ static void __devexit virtblk_remove(struct virtio_device *vdev)
+ {
+ 	struct virtio_blk *vblk = vdev->priv;
+ 	int index = vblk->index;
++	int refc;
+ 
+ 	/* Prevent config work handler from accessing the device. */
+ 	mutex_lock(&vblk->config_lock);
+@@ -903,11 +904,15 @@ static void __devexit virtblk_remove(struct virtio_device *vdev)
+ 
+ 	flush_work(&vblk->config_work);
+ 
++	refc = atomic_read(&disk_to_dev(vblk->disk)->kobj.kref.refcount);
+ 	put_disk(vblk->disk);
+ 	mempool_destroy(vblk->pool);
+ 	vdev->config->del_vqs(vdev);
+ 	kfree(vblk);
+-	ida_simple_remove(&vd_index_ida, index);
++
++	/* Only free device id if we don't have any users */
++	if (refc == 1)
++		ida_simple_remove(&vd_index_ida, index);
+ }
+ 
+ #ifdef CONFIG_PM
+diff --git a/drivers/cpufreq/Kconfig.x86 b/drivers/cpufreq/Kconfig.x86
+index 934854a..7227cd7 100644
+--- a/drivers/cpufreq/Kconfig.x86
++++ b/drivers/cpufreq/Kconfig.x86
+@@ -106,7 +106,7 @@ config X86_POWERNOW_K7_ACPI
+ config X86_POWERNOW_K8
+ 	tristate "AMD Opteron/Athlon64 PowerNow!"
+ 	select CPU_FREQ_TABLE
+-	depends on ACPI && ACPI_PROCESSOR
++	depends on ACPI && ACPI_PROCESSOR && X86_ACPI_CPUFREQ
+ 	help
+ 	  This adds the CPUFreq driver for K8/early Opteron/Athlon64 processors.
+ 	  Support for K10 and newer processors is now in acpi-cpufreq.
+diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
+index 0d048f6..7b0d49d 100644
+--- a/drivers/cpufreq/acpi-cpufreq.c
++++ b/drivers/cpufreq/acpi-cpufreq.c
+@@ -1030,4 +1030,11 @@ MODULE_PARM_DESC(acpi_pstate_strict,
+ late_initcall(acpi_cpufreq_init);
+ module_exit(acpi_cpufreq_exit);
+ 
++static const struct x86_cpu_id acpi_cpufreq_ids[] = {
++	X86_FEATURE_MATCH(X86_FEATURE_ACPI),
++	X86_FEATURE_MATCH(X86_FEATURE_HW_PSTATE),
++	{}
++};
++MODULE_DEVICE_TABLE(x86cpu, acpi_cpufreq_ids);
++
+ MODULE_ALIAS("acpi");
+diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
+index f7f1dc6..ed0e8b7 100644
+--- a/drivers/dma/ioat/dma_v3.c
++++ b/drivers/dma/ioat/dma_v3.c
+@@ -951,7 +951,7 @@ static int __devinit ioat_xor_val_self_test(struct ioatdma_device *device)
+ 			goto free_resources;
+ 		}
+ 	}
+-	dma_sync_single_for_device(dev, dest_dma, PAGE_SIZE, DMA_TO_DEVICE);
++	dma_sync_single_for_device(dev, dest_dma, PAGE_SIZE, DMA_FROM_DEVICE);
+ 
+ 	/* skip validate if the capability is not present */
+ 	if (!dma_has_cap(DMA_XOR_VAL, dma_chan->device->cap_mask))
+diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
+index 528c62d..3cf2ca8 100644
+--- a/drivers/dma/tegra20-apb-dma.c
++++ b/drivers/dma/tegra20-apb-dma.c
+@@ -266,6 +266,7 @@ static struct tegra_dma_desc *tegra_dma_desc_get(
+ 		if (async_tx_test_ack(&dma_desc->txd)) {
+ 			list_del(&dma_desc->node);
+ 			spin_unlock_irqrestore(&tdc->lock, flags);
++			dma_desc->txd.flags = 0;
+ 			return dma_desc;
+ 		}
+ 	}
+@@ -1050,7 +1051,9 @@ struct dma_async_tx_descriptor *tegra_dma_prep_dma_cyclic(
+ 					TEGRA_APBDMA_AHBSEQ_WRAP_SHIFT;
+ 	ahb_seq |= TEGRA_APBDMA_AHBSEQ_BUS_WIDTH_32;
+ 
+-	csr |= TEGRA_APBDMA_CSR_FLOW | TEGRA_APBDMA_CSR_IE_EOC;
++	csr |= TEGRA_APBDMA_CSR_FLOW;
++	if (flags & DMA_PREP_INTERRUPT)
++		csr |= TEGRA_APBDMA_CSR_IE_EOC;
+ 	csr |= tdc->dma_sconfig.slave_id << TEGRA_APBDMA_CSR_REQ_SEL_SHIFT;
+ 
+ 	apb_seq |= TEGRA_APBDMA_APBSEQ_WRAP_WORD_1;
+@@ -1095,7 +1098,8 @@ struct dma_async_tx_descriptor *tegra_dma_prep_dma_cyclic(
+ 		mem += len;
+ 	}
+ 	sg_req->last_sg = true;
+-	dma_desc->txd.flags = 0;
++	if (flags & DMA_CTRL_ACK)
++		dma_desc->txd.flags = DMA_CTRL_ACK;
+ 
+ 	/*
+ 	 * Make sure that mode should not be conflicting with currently
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index b298158..fd3ae62 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -16,6 +16,7 @@
+  */
+ static char dmi_empty_string[] = "        ";
+ 
++static u16 __initdata dmi_ver;
+ /*
+  * Catch too early calls to dmi_check_system():
+  */
+@@ -118,12 +119,12 @@ static int __init dmi_walk_early(void (*decode)(const struct dmi_header *,
+ 	return 0;
+ }
+ 
+-static int __init dmi_checksum(const u8 *buf)
++static int __init dmi_checksum(const u8 *buf, u8 len)
+ {
+ 	u8 sum = 0;
+ 	int a;
+ 
+-	for (a = 0; a < 15; a++)
++	for (a = 0; a < len; a++)
+ 		sum += buf[a];
+ 
+ 	return sum == 0;
+@@ -161,8 +162,10 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, int inde
+ 		return;
+ 
+ 	for (i = 0; i < 16 && (is_ff || is_00); i++) {
+-		if(d[i] != 0x00) is_ff = 0;
+-		if(d[i] != 0xFF) is_00 = 0;
++		if (d[i] != 0x00)
++			is_00 = 0;
++		if (d[i] != 0xFF)
++			is_ff = 0;
+ 	}
+ 
+ 	if (is_ff || is_00)
+@@ -172,7 +175,15 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, int inde
+ 	if (!s)
+ 		return;
+ 
+-	sprintf(s, "%pUB", d);
++	/*
++	 * As of version 2.6 of the SMBIOS specification, the first 3 fields of
++	 * the UUID are supposed to be little-endian encoded.  The specification
++	 * says that this is the defacto standard.
++	 */
++	if (dmi_ver >= 0x0206)
++		sprintf(s, "%pUL", d);
++	else
++		sprintf(s, "%pUB", d);
+ 
+         dmi_ident[slot] = s;
+ }
+@@ -404,29 +415,57 @@ static int __init dmi_present(const char __iomem *p)
+ 	u8 buf[15];
+ 
+ 	memcpy_fromio(buf, p, 15);
+-	if ((memcmp(buf, "_DMI_", 5) == 0) && dmi_checksum(buf)) {
++	if (dmi_checksum(buf, 15)) {
+ 		dmi_num = (buf[13] << 8) | buf[12];
+ 		dmi_len = (buf[7] << 8) | buf[6];
+ 		dmi_base = (buf[11] << 24) | (buf[10] << 16) |
+ 			(buf[9] << 8) | buf[8];
+ 
+-		/*
+-		 * DMI version 0.0 means that the real version is taken from
+-		 * the SMBIOS version, which we don't know at this point.
+-		 */
+-		if (buf[14] != 0)
+-			printk(KERN_INFO "DMI %d.%d present.\n",
+-			       buf[14] >> 4, buf[14] & 0xF);
+-		else
+-			printk(KERN_INFO "DMI present.\n");
+ 		if (dmi_walk_early(dmi_decode) == 0) {
++			if (dmi_ver)
++				pr_info("SMBIOS %d.%d present.\n",
++				       dmi_ver >> 8, dmi_ver & 0xFF);
++			else {
++				dmi_ver = (buf[14] & 0xF0) << 4 |
++					   (buf[14] & 0x0F);
++				pr_info("Legacy DMI %d.%d present.\n",
++				       dmi_ver >> 8, dmi_ver & 0xFF);
++			}
+ 			dmi_dump_ids();
+ 			return 0;
+ 		}
+ 	}
++	dmi_ver = 0;
+ 	return 1;
+ }
+ 
++static int __init smbios_present(const char __iomem *p)
++{
++	u8 buf[32];
++	int offset = 0;
++
++	memcpy_fromio(buf, p, 32);
++	if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) {
++		dmi_ver = (buf[6] << 8) + buf[7];
++
++		/* Some BIOS report weird SMBIOS version, fix that up */
++		switch (dmi_ver) {
++		case 0x021F:
++		case 0x0221:
++			pr_debug("SMBIOS version fixup(2.%d->2.%d)\n",
++			       dmi_ver & 0xFF, 3);
++			dmi_ver = 0x0203;
++			break;
++		case 0x0233:
++			pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6);
++			dmi_ver = 0x0206;
++			break;
++		}
++		offset = 16;
++	}
++	return dmi_present(buf + offset);
++}
++
+ void __init dmi_scan_machine(void)
+ {
+ 	char __iomem *p, *q;
+@@ -444,7 +483,7 @@ void __init dmi_scan_machine(void)
+ 		if (p == NULL)
+ 			goto error;
+ 
+-		rc = dmi_present(p + 0x10); /* offset of _DMI_ string */
++		rc = smbios_present(p);
+ 		dmi_iounmap(p, 32);
+ 		if (!rc) {
+ 			dmi_available = 1;
+@@ -462,7 +501,12 @@ void __init dmi_scan_machine(void)
+ 			goto error;
+ 
+ 		for (q = p; q < p + 0x10000; q += 16) {
+-			rc = dmi_present(q);
++			if (memcmp(q, "_SM_", 4) == 0 && q - p <= 0xFFE0)
++				rc = smbios_present(q);
++			else if (memcmp(q, "_DMI_", 5) == 0)
++				rc = dmi_present(q);
++			else
++				continue;
+ 			if (!rc) {
+ 				dmi_available = 1;
+ 				dmi_iounmap(p, 0x10000);
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index 3eea143..67036e9 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -548,6 +548,8 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
+ 	total = 0;
+ 	for (i = 0; i < count; i++) {
+ 		struct drm_i915_gem_relocation_entry __user *user_relocs;
++		u64 invalid_offset = (u64)-1;
++		int j;
+ 
+ 		user_relocs = (void __user *)(uintptr_t)exec[i].relocs_ptr;
+ 
+@@ -558,6 +560,25 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
+ 			goto err;
+ 		}
+ 
++		/* As we do not update the known relocation offsets after
++		 * relocating (due to the complexities in lock handling),
++		 * we need to mark them as invalid now so that we force the
++		 * relocation processing next time. Just in case the target
++		 * object is evicted and then rebound into its old
++		 * presumed_offset before the next execbuffer - if that
++		 * happened we would make the mistake of assuming that the
++		 * relocations were valid.
++		 */
++		for (j = 0; j < exec[i].relocation_count; j++) {
++			if (copy_to_user(&user_relocs[j].presumed_offset,
++					 &invalid_offset,
++					 sizeof(invalid_offset))) {
++				ret = -EFAULT;
++				mutex_lock(&dev->struct_mutex);
++				goto err;
++			}
++		}
++
+ 		reloc_offset[i] = total;
+ 		total += exec[i].relocation_count;
+ 	}
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 09ae4b0..ecec134 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -514,6 +514,7 @@
+  * the enables for writing to the corresponding low bit.
+  */
+ #define _3D_CHICKEN	0x02084
++#define  _3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB	(1 << 10)
+ #define _3D_CHICKEN2	0x0208c
+ /* Disables pipelining of read flushes past the SF-WIZ interface.
+  * Required on all Ironlake steppings according to the B-Spec, but the
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index eaaff3c..e87fa47 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3412,6 +3412,10 @@ static void gen6_init_clock_gating(struct drm_device *dev)
+ 		   I915_READ(ILK_DISPLAY_CHICKEN2) |
+ 		   ILK_ELPIN_409_SELECT);
+ 
++	/* WaDisableHiZPlanesWhenMSAAEnabled */
++	I915_WRITE(_3D_CHICKEN,
++		   _MASKED_BIT_ENABLE(_3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB));
++
+ 	I915_WRITE(WM3_LP_ILK, 0);
+ 	I915_WRITE(WM2_LP_ILK, 0);
+ 	I915_WRITE(WM1_LP_ILK, 0);
+diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
+index 0670da7..a6fad94 100644
+--- a/drivers/i2c/busses/i2c-mxs.c
++++ b/drivers/i2c/busses/i2c-mxs.c
+@@ -127,7 +127,7 @@ struct mxs_i2c_dev {
+ 	struct device *dev;
+ 	void __iomem *regs;
+ 	struct completion cmd_complete;
+-	u32 cmd_err;
++	int cmd_err;
+ 	struct i2c_adapter adapter;
+ 	const struct mxs_i2c_speed_config *speed;
+ 
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index b0f6b4c..e0fbe77 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -460,8 +460,6 @@ static int intel_idle_probe(void)
+ 	else
+ 		on_each_cpu(__setup_broadcast_timer, (void *)true, 1);
+ 
+-	register_cpu_notifier(&cpu_hotplug_notifier);
+-
+ 	pr_debug(PREFIX "v" INTEL_IDLE_VERSION
+ 		" model 0x%X\n", boot_cpu_data.x86_model);
+ 
+@@ -624,6 +622,7 @@ static int __init intel_idle_init(void)
+ 			return retval;
+ 		}
+ 	}
++	register_cpu_notifier(&cpu_hotplug_notifier);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/media/usb/gspca/kinect.c b/drivers/media/usb/gspca/kinect.c
+index 40ad668..3773a8a7 100644
+--- a/drivers/media/usb/gspca/kinect.c
++++ b/drivers/media/usb/gspca/kinect.c
+@@ -381,6 +381,7 @@ static const struct sd_desc sd_desc = {
+ /* -- module initialisation -- */
+ static const struct usb_device_id device_table[] = {
+ 	{USB_DEVICE(0x045e, 0x02ae)},
++	{USB_DEVICE(0x045e, 0x02bf)},
+ 	{}
+ };
+ 
+diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
+index 04a8199..988da4d 100644
+--- a/drivers/misc/ti-st/st_kim.c
++++ b/drivers/misc/ti-st/st_kim.c
+@@ -468,6 +468,11 @@ long st_kim_start(void *kim_data)
+ 		if (pdata->chip_enable)
+ 			pdata->chip_enable(kim_gdata);
+ 
++		/* Configure BT nShutdown to HIGH state */
++		gpio_set_value(kim_gdata->nshutdown, GPIO_LOW);
++		mdelay(5);	/* FIXME: a proper toggle */
++		gpio_set_value(kim_gdata->nshutdown, GPIO_HIGH);
++		mdelay(100);
+ 		/* re-initialize the completion */
+ 		INIT_COMPLETION(kim_gdata->ldisc_installed);
+ 		/* send notification to UIM */
+@@ -509,7 +514,8 @@ long st_kim_start(void *kim_data)
+  *	(b) upon failure to either install ldisc or download firmware.
+  *	The function is responsible to (a) notify UIM about un-installation,
+  *	(b) flush UART if the ldisc was installed.
+- *	(c) invoke platform's chip disabling routine.
++ *	(c) reset BT_EN - pull down nshutdown at the end.
++ *	(d) invoke platform's chip disabling routine.
+  */
+ long st_kim_stop(void *kim_data)
+ {
+@@ -541,6 +547,13 @@ long st_kim_stop(void *kim_data)
+ 		err = -ETIMEDOUT;
+ 	}
+ 
++	/* By default configure BT nShutdown to LOW state */
++	gpio_set_value(kim_gdata->nshutdown, GPIO_LOW);
++	mdelay(1);
++	gpio_set_value(kim_gdata->nshutdown, GPIO_HIGH);
++	mdelay(1);
++	gpio_set_value(kim_gdata->nshutdown, GPIO_LOW);
++
+ 	/* platform specific disable */
+ 	if (pdata->chip_disable)
+ 		pdata->chip_disable(kim_gdata);
+@@ -732,6 +745,20 @@ static int kim_probe(struct platform_device *pdev)
+ 	/* refer to itself */
+ 	kim_gdata->core_data->kim_data = kim_gdata;
+ 
++	/* Claim the chip enable nShutdown gpio from the system */
++	kim_gdata->nshutdown = pdata->nshutdown_gpio;
++	status = gpio_request(kim_gdata->nshutdown, "kim");
++	if (unlikely(status)) {
++		pr_err(" gpio %ld request failed ", kim_gdata->nshutdown);
++		return status;
++	}
++
++	/* Configure nShutdown GPIO as output=0 */
++	status = gpio_direction_output(kim_gdata->nshutdown, 0);
++	if (unlikely(status)) {
++		pr_err(" unable to configure gpio %ld", kim_gdata->nshutdown);
++		return status;
++	}
+ 	/* get reference of pdev for request_firmware
+ 	 */
+ 	kim_gdata->kim_pdev = pdev;
+@@ -767,10 +794,18 @@ static int kim_probe(struct platform_device *pdev)
+ 
+ static int kim_remove(struct platform_device *pdev)
+ {
++	/* free the GPIOs requested */
++	struct ti_st_plat_data	*pdata = pdev->dev.platform_data;
+ 	struct kim_data_s	*kim_gdata;
+ 
+ 	kim_gdata = dev_get_drvdata(&pdev->dev);
+ 
++	/* Free the Bluetooth/FM/GPIO
++	 * nShutdown gpio from the system
++	 */
++	gpio_free(pdata->nshutdown_gpio);
++	pr_info("nshutdown GPIO Freed");
++
+ 	debugfs_remove_recursive(kim_debugfs_dir);
+ 	sysfs_remove_group(&pdev->dev.kobj, &uim_attr_grp);
+ 	pr_info("sysfs entries removed");
+diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
+index 26ffd3e..2c113de 100644
+--- a/drivers/pci/hotplug/pciehp.h
++++ b/drivers/pci/hotplug/pciehp.h
+@@ -44,7 +44,6 @@ extern bool pciehp_poll_mode;
+ extern int pciehp_poll_time;
+ extern bool pciehp_debug;
+ extern bool pciehp_force;
+-extern struct workqueue_struct *pciehp_wq;
+ 
+ #define dbg(format, arg...)						\
+ do {									\
+@@ -78,6 +77,7 @@ struct slot {
+ 	struct hotplug_slot *hotplug_slot;
+ 	struct delayed_work work;	/* work for button event */
+ 	struct mutex lock;
++	struct workqueue_struct *wq;
+ };
+ 
+ struct event_info {
+diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
+index 916bf4f..939bd1d 100644
+--- a/drivers/pci/hotplug/pciehp_core.c
++++ b/drivers/pci/hotplug/pciehp_core.c
+@@ -42,7 +42,6 @@ bool pciehp_debug;
+ bool pciehp_poll_mode;
+ int pciehp_poll_time;
+ bool pciehp_force;
+-struct workqueue_struct *pciehp_wq;
+ 
+ #define DRIVER_VERSION	"0.4"
+ #define DRIVER_AUTHOR	"Dan Zink <dan.zink@××××××.com>, Greg Kroah-Hartman <greg@×××××.com>, Dely Sy <dely.l.sy@×××××.com>"
+@@ -340,18 +339,13 @@ static int __init pcied_init(void)
+ {
+ 	int retval = 0;
+ 
+-	pciehp_wq = alloc_workqueue("pciehp", 0, 0);
+-	if (!pciehp_wq)
+-		return -ENOMEM;
+-
+ 	pciehp_firmware_init();
+ 	retval = pcie_port_service_register(&hpdriver_portdrv);
+  	dbg("pcie_port_service_register = %d\n", retval);
+   	info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
+- 	if (retval) {
+-		destroy_workqueue(pciehp_wq);
++	if (retval)
+ 		dbg("Failure to register service\n");
+-	}
++
+ 	return retval;
+ }
+ 
+@@ -359,7 +353,6 @@ static void __exit pcied_cleanup(void)
+ {
+ 	dbg("unload_pciehpd()\n");
+ 	pcie_port_service_unregister(&hpdriver_portdrv);
+-	destroy_workqueue(pciehp_wq);
+ 	info(DRIVER_DESC " version: " DRIVER_VERSION " unloaded\n");
+ }
+ 
+diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
+index 27f4429..38f0186 100644
+--- a/drivers/pci/hotplug/pciehp_ctrl.c
++++ b/drivers/pci/hotplug/pciehp_ctrl.c
+@@ -49,7 +49,7 @@ static int queue_interrupt_event(struct slot *p_slot, u32 event_type)
+ 	info->p_slot = p_slot;
+ 	INIT_WORK(&info->work, interrupt_event_handler);
+ 
+-	queue_work(pciehp_wq, &info->work);
++	queue_work(p_slot->wq, &info->work);
+ 
+ 	return 0;
+ }
+@@ -344,7 +344,7 @@ void pciehp_queue_pushbutton_work(struct work_struct *work)
+ 		kfree(info);
+ 		goto out;
+ 	}
+-	queue_work(pciehp_wq, &info->work);
++	queue_work(p_slot->wq, &info->work);
+  out:
+ 	mutex_unlock(&p_slot->lock);
+ }
+@@ -377,7 +377,7 @@ static void handle_button_press_event(struct slot *p_slot)
+ 		if (ATTN_LED(ctrl))
+ 			pciehp_set_attention_status(p_slot, 0);
+ 
+-		queue_delayed_work(pciehp_wq, &p_slot->work, 5*HZ);
++		queue_delayed_work(p_slot->wq, &p_slot->work, 5*HZ);
+ 		break;
+ 	case BLINKINGOFF_STATE:
+ 	case BLINKINGON_STATE:
+@@ -439,7 +439,7 @@ static void handle_surprise_event(struct slot *p_slot)
+ 	else
+ 		p_slot->state = POWERON_STATE;
+ 
+-	queue_work(pciehp_wq, &info->work);
++	queue_work(p_slot->wq, &info->work);
+ }
+ 
+ static void interrupt_event_handler(struct work_struct *work)
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index 13b2eaf..5127f3f 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -773,23 +773,32 @@ static void pcie_shutdown_notification(struct controller *ctrl)
+ static int pcie_init_slot(struct controller *ctrl)
+ {
+ 	struct slot *slot;
++	char name[32];
+ 
+ 	slot = kzalloc(sizeof(*slot), GFP_KERNEL);
+ 	if (!slot)
+ 		return -ENOMEM;
+ 
++	snprintf(name, sizeof(name), "pciehp-%u", PSN(ctrl));
++	slot->wq = alloc_workqueue(name, 0, 0);
++	if (!slot->wq)
++		goto abort;
++
+ 	slot->ctrl = ctrl;
+ 	mutex_init(&slot->lock);
+ 	INIT_DELAYED_WORK(&slot->work, pciehp_queue_pushbutton_work);
+ 	ctrl->slot = slot;
+ 	return 0;
++abort:
++	kfree(slot);
++	return -ENOMEM;
+ }
+ 
+ static void pcie_cleanup_slot(struct controller *ctrl)
+ {
+ 	struct slot *slot = ctrl->slot;
+ 	cancel_delayed_work(&slot->work);
+-	flush_workqueue(pciehp_wq);
++	destroy_workqueue(slot->wq);
+ 	kfree(slot);
+ }
+ 
+diff --git a/drivers/pci/hotplug/shpchp.h b/drivers/pci/hotplug/shpchp.h
+index ca64932..b849f995 100644
+--- a/drivers/pci/hotplug/shpchp.h
++++ b/drivers/pci/hotplug/shpchp.h
+@@ -46,8 +46,6 @@
+ extern bool shpchp_poll_mode;
+ extern int shpchp_poll_time;
+ extern bool shpchp_debug;
+-extern struct workqueue_struct *shpchp_wq;
+-extern struct workqueue_struct *shpchp_ordered_wq;
+ 
+ #define dbg(format, arg...)						\
+ do {									\
+@@ -91,6 +89,7 @@ struct slot {
+ 	struct list_head	slot_list;
+ 	struct delayed_work work;	/* work for button event */
+ 	struct mutex lock;
++	struct workqueue_struct *wq;
+ 	u8 hp_slot;
+ };
+ 
+diff --git a/drivers/pci/hotplug/shpchp_core.c b/drivers/pci/hotplug/shpchp_core.c
+index b6de307..ea15fdc 100644
+--- a/drivers/pci/hotplug/shpchp_core.c
++++ b/drivers/pci/hotplug/shpchp_core.c
+@@ -39,8 +39,6 @@
+ bool shpchp_debug;
+ bool shpchp_poll_mode;
+ int shpchp_poll_time;
+-struct workqueue_struct *shpchp_wq;
+-struct workqueue_struct *shpchp_ordered_wq;
+ 
+ #define DRIVER_VERSION	"0.4"
+ #define DRIVER_AUTHOR	"Dan Zink <dan.zink@××××××.com>, Greg Kroah-Hartman <greg@×××××.com>, Dely Sy <dely.l.sy@×××××.com>"
+@@ -129,6 +127,14 @@ static int init_slots(struct controller *ctrl)
+ 		slot->device = ctrl->slot_device_offset + i;
+ 		slot->hpc_ops = ctrl->hpc_ops;
+ 		slot->number = ctrl->first_slot + (ctrl->slot_num_inc * i);
++
++		snprintf(name, sizeof(name), "shpchp-%d", slot->number);
++		slot->wq = alloc_workqueue(name, 0, 0);
++		if (!slot->wq) {
++			retval = -ENOMEM;
++			goto error_info;
++		}
++
+ 		mutex_init(&slot->lock);
+ 		INIT_DELAYED_WORK(&slot->work, shpchp_queue_pushbutton_work);
+ 
+@@ -148,7 +154,7 @@ static int init_slots(struct controller *ctrl)
+ 		if (retval) {
+ 			ctrl_err(ctrl, "pci_hp_register failed with error %d\n",
+ 				 retval);
+-			goto error_info;
++			goto error_slotwq;
+ 		}
+ 
+ 		get_power_status(hotplug_slot, &info->power_status);
+@@ -160,6 +166,8 @@ static int init_slots(struct controller *ctrl)
+ 	}
+ 
+ 	return 0;
++error_slotwq:
++	destroy_workqueue(slot->wq);
+ error_info:
+ 	kfree(info);
+ error_hpslot:
+@@ -180,8 +188,7 @@ void cleanup_slots(struct controller *ctrl)
+ 		slot = list_entry(tmp, struct slot, slot_list);
+ 		list_del(&slot->slot_list);
+ 		cancel_delayed_work(&slot->work);
+-		flush_workqueue(shpchp_wq);
+-		flush_workqueue(shpchp_ordered_wq);
++		destroy_workqueue(slot->wq);
+ 		pci_hp_deregister(slot->hotplug_slot);
+ 	}
+ }
+@@ -364,25 +371,11 @@ static struct pci_driver shpc_driver = {
+ 
+ static int __init shpcd_init(void)
+ {
+-	int retval = 0;
+-
+-	shpchp_wq = alloc_ordered_workqueue("shpchp", 0);
+-	if (!shpchp_wq)
+-		return -ENOMEM;
+-
+-	shpchp_ordered_wq = alloc_ordered_workqueue("shpchp_ordered", 0);
+-	if (!shpchp_ordered_wq) {
+-		destroy_workqueue(shpchp_wq);
+-		return -ENOMEM;
+-	}
++	int retval;
+ 
+ 	retval = pci_register_driver(&shpc_driver);
+ 	dbg("%s: pci_register_driver = %d\n", __func__, retval);
+ 	info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
+-	if (retval) {
+-		destroy_workqueue(shpchp_ordered_wq);
+-		destroy_workqueue(shpchp_wq);
+-	}
+ 	return retval;
+ }
+ 
+@@ -390,8 +383,6 @@ static void __exit shpcd_cleanup(void)
+ {
+ 	dbg("unload_shpchpd()\n");
+ 	pci_unregister_driver(&shpc_driver);
+-	destroy_workqueue(shpchp_ordered_wq);
+-	destroy_workqueue(shpchp_wq);
+ 	info(DRIVER_DESC " version: " DRIVER_VERSION " unloaded\n");
+ }
+ 
+diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
+index f9b5a52..5849927 100644
+--- a/drivers/pci/hotplug/shpchp_ctrl.c
++++ b/drivers/pci/hotplug/shpchp_ctrl.c
+@@ -51,7 +51,7 @@ static int queue_interrupt_event(struct slot *p_slot, u32 event_type)
+ 	info->p_slot = p_slot;
+ 	INIT_WORK(&info->work, interrupt_event_handler);
+ 
+-	queue_work(shpchp_wq, &info->work);
++	queue_work(p_slot->wq, &info->work);
+ 
+ 	return 0;
+ }
+@@ -453,7 +453,7 @@ void shpchp_queue_pushbutton_work(struct work_struct *work)
+ 		kfree(info);
+ 		goto out;
+ 	}
+-	queue_work(shpchp_ordered_wq, &info->work);
++	queue_work(p_slot->wq, &info->work);
+  out:
+ 	mutex_unlock(&p_slot->lock);
+ }
+@@ -501,7 +501,7 @@ static void handle_button_press_event(struct slot *p_slot)
+ 		p_slot->hpc_ops->green_led_blink(p_slot);
+ 		p_slot->hpc_ops->set_attention_status(p_slot, 0);
+ 
+-		queue_delayed_work(shpchp_wq, &p_slot->work, 5*HZ);
++		queue_delayed_work(p_slot->wq, &p_slot->work, 5*HZ);
+ 		break;
+ 	case BLINKINGOFF_STATE:
+ 	case BLINKINGON_STATE:
+diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
+index af4e31c..43caf53 100644
+--- a/drivers/pci/pcie/aer/aerdrv_core.c
++++ b/drivers/pci/pcie/aer/aerdrv_core.c
+@@ -616,6 +616,7 @@ static void aer_recover_work_func(struct work_struct *work)
+ 			continue;
+ 		}
+ 		do_recovery(pdev, entry.severity);
++		pci_dev_put(pdev);
+ 	}
+ }
+ #endif
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 213753b..449f257 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -773,6 +773,9 @@ void pcie_clear_aspm(struct pci_bus *bus)
+ {
+ 	struct pci_dev *child;
+ 
++	if (aspm_force)
++		return;
++
+ 	/*
+ 	 * Clear any ASPM setup that the firmware has carried out on this bus
+ 	 */
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 352bc77..a45e12a 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -3116,10 +3116,6 @@ static int __init init_sd(void)
+ 	if (err)
+ 		goto err_out;
+ 
+-	err = scsi_register_driver(&sd_template.gendrv);
+-	if (err)
+-		goto err_out_class;
+-
+ 	sd_cdb_cache = kmem_cache_create("sd_ext_cdb", SD_EXT_CDB_SIZE,
+ 					 0, 0, NULL);
+ 	if (!sd_cdb_cache) {
+@@ -3133,8 +3129,15 @@ static int __init init_sd(void)
+ 		goto err_out_cache;
+ 	}
+ 
++	err = scsi_register_driver(&sd_template.gendrv);
++	if (err)
++		goto err_out_driver;
++
+ 	return 0;
+ 
++err_out_driver:
++	mempool_destroy(sd_cdb_pool);
++
+ err_out_cache:
+ 	kmem_cache_destroy(sd_cdb_cache);
+ 
+@@ -3157,10 +3160,10 @@ static void __exit exit_sd(void)
+ 
+ 	SCSI_LOG_HLQUEUE(3, printk("exit_sd: exiting sd driver\n"));
+ 
++	scsi_unregister_driver(&sd_template.gendrv);
+ 	mempool_destroy(sd_cdb_pool);
+ 	kmem_cache_destroy(sd_cdb_cache);
+ 
+-	scsi_unregister_driver(&sd_template.gendrv);
+ 	class_unregister(&sd_disk_class);
+ 
+ 	for (i = 0; i < SD_MAJORS; i++)
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 7b7dedd..57f0859 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1605,6 +1605,7 @@ static int __devinit dwc3_gadget_init_endpoints(struct dwc3 *dwc)
+ 
+ 		if (epnum == 0 || epnum == 1) {
+ 			dep->endpoint.maxpacket = 512;
++			dep->endpoint.maxburst = 1;
+ 			dep->endpoint.ops = &dwc3_gadget_ep0_ops;
+ 			if (!epnum)
+ 				dwc->gadget.ep0 = &dep->endpoint;
+diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
+index 64c4ec1..7c52ed4 100644
+--- a/drivers/usb/gadget/f_fs.c
++++ b/drivers/usb/gadget/f_fs.c
+@@ -1153,15 +1153,15 @@ static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
+ 					pr_err("%s: unmapped value: %lu\n", opts, value);
+ 					return -EINVAL;
+ 				}
+-			}
+-			else if (!memcmp(opts, "gid", 3))
++			} else if (!memcmp(opts, "gid", 3)) {
+ 				data->perms.gid = make_kgid(current_user_ns(), value);
+ 				if (!gid_valid(data->perms.gid)) {
+ 					pr_err("%s: unmapped value: %lu\n", opts, value);
+ 					return -EINVAL;
+ 				}
+-			else
++			} else {
+ 				goto invalid;
++			}
+ 			break;
+ 
+ 		default:
+diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
+index 4b9e9ab..4f64d24 100644
+--- a/drivers/usb/host/uhci-hcd.c
++++ b/drivers/usb/host/uhci-hcd.c
+@@ -447,6 +447,10 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd)
+ 		return IRQ_NONE;
+ 	uhci_writew(uhci, status, USBSTS);		/* Clear it */
+ 
++	spin_lock(&uhci->lock);
++	if (unlikely(!uhci->is_initialized))	/* not yet configured */
++		goto done;
++
+ 	if (status & ~(USBSTS_USBINT | USBSTS_ERROR | USBSTS_RD)) {
+ 		if (status & USBSTS_HSE)
+ 			dev_err(uhci_dev(uhci), "host system error, "
+@@ -455,7 +459,6 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd)
+ 			dev_err(uhci_dev(uhci), "host controller process "
+ 					"error, something bad happened!\n");
+ 		if (status & USBSTS_HCH) {
+-			spin_lock(&uhci->lock);
+ 			if (uhci->rh_state >= UHCI_RH_RUNNING) {
+ 				dev_err(uhci_dev(uhci),
+ 					"host controller halted, "
+@@ -473,15 +476,15 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd)
+ 				 * pending unlinks */
+ 				mod_timer(&hcd->rh_timer, jiffies);
+ 			}
+-			spin_unlock(&uhci->lock);
+ 		}
+ 	}
+ 
+-	if (status & USBSTS_RD)
++	if (status & USBSTS_RD) {
++		spin_unlock(&uhci->lock);
+ 		usb_hcd_poll_rh_status(hcd);
+-	else {
+-		spin_lock(&uhci->lock);
++	} else {
+ 		uhci_scan_schedule(uhci);
++ done:
+ 		spin_unlock(&uhci->lock);
+ 	}
+ 
+@@ -662,9 +665,9 @@ static int uhci_start(struct usb_hcd *hcd)
+ 	 */
+ 	mb();
+ 
++	spin_lock_irq(&uhci->lock);
+ 	configure_hc(uhci);
+ 	uhci->is_initialized = 1;
+-	spin_lock_irq(&uhci->lock);
+ 	start_rh(uhci);
+ 	spin_unlock_irq(&uhci->lock);
+ 	return 0;
+diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c
+index 3a6c2fd..3d37b5d 100644
+--- a/drivers/usb/musb/cppi_dma.c
++++ b/drivers/usb/musb/cppi_dma.c
+@@ -105,7 +105,7 @@ static void cppi_reset_tx(struct cppi_tx_stateram __iomem *tx, u32 ptr)
+ 	musb_writel(&tx->tx_complete, 0, ptr);
+ }
+ 
+-static void __init cppi_pool_init(struct cppi *cppi, struct cppi_channel *c)
++static void cppi_pool_init(struct cppi *cppi, struct cppi_channel *c)
+ {
+ 	int	j;
+ 
+@@ -150,7 +150,7 @@ static void cppi_pool_free(struct cppi_channel *c)
+ 	c->last_processed = NULL;
+ }
+ 
+-static int __init cppi_controller_start(struct dma_controller *c)
++static int cppi_controller_start(struct dma_controller *c)
+ {
+ 	struct cppi	*controller;
+ 	void __iomem	*tibase;
+diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c
+index 4362d9e..f72323e 100644
+--- a/drivers/vfio/pci/vfio_pci_rdwr.c
++++ b/drivers/vfio/pci/vfio_pci_rdwr.c
+@@ -240,17 +240,17 @@ ssize_t vfio_pci_mem_readwrite(struct vfio_pci_device *vdev, char __user *buf,
+ 			filled = 1;
+ 		} else {
+ 			/* Drop writes, fill reads with FF */
++			filled = min((size_t)(x_end - pos), count);
+ 			if (!iswrite) {
+ 				char val = 0xFF;
+ 				size_t i;
+ 
+-				for (i = 0; i < x_end - pos; i++) {
++				for (i = 0; i < filled; i++) {
+ 					if (put_user(val, buf + i))
+ 						goto out;
+ 				}
+ 			}
+ 
+-			filled = x_end - pos;
+ 		}
+ 
+ 		count -= filled;
+diff --git a/include/linux/ata.h b/include/linux/ata.h
+index 408da95..8f7a3d6 100644
+--- a/include/linux/ata.h
++++ b/include/linux/ata.h
+@@ -297,10 +297,12 @@ enum {
+ 	ATA_LOG_SATA_NCQ	= 0x10,
+ 	ATA_LOG_SATA_ID_DEV_DATA  = 0x30,
+ 	ATA_LOG_SATA_SETTINGS	  = 0x08,
+-	ATA_LOG_DEVSLP_MDAT	  = 0x30,
++	ATA_LOG_DEVSLP_OFFSET	  = 0x30,
++	ATA_LOG_DEVSLP_SIZE	  = 0x08,
++	ATA_LOG_DEVSLP_MDAT	  = 0x00,
+ 	ATA_LOG_DEVSLP_MDAT_MASK  = 0x1F,
+-	ATA_LOG_DEVSLP_DETO	  = 0x31,
+-	ATA_LOG_DEVSLP_VALID	  = 0x37,
++	ATA_LOG_DEVSLP_DETO	  = 0x01,
++	ATA_LOG_DEVSLP_VALID	  = 0x07,
+ 	ATA_LOG_DEVSLP_VALID_MASK = 0x80,
+ 
+ 	/* READ/WRITE LONG (obsolete) */
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index e931c9a..1e36c63 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -652,8 +652,8 @@ struct ata_device {
+ 		u32		gscr[SATA_PMP_GSCR_DWORDS]; /* PMP GSCR block */
+ 	};
+ 
+-	/* Identify Device Data Log (30h), SATA Settings (page 08h) */
+-	u8			sata_settings[ATA_SECT_SIZE];
++	/* DEVSLP Timing Variables from Identify Device Data Log */
++	u8			devslp_timing[ATA_LOG_DEVSLP_SIZE];
+ 
+ 	/* error history */
+ 	int			spdn_cnt;
+diff --git a/include/linux/module.h b/include/linux/module.h
+index 7760c6d..1375ee3 100644
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -199,11 +199,11 @@ struct module_use {
+ 	struct module *source, *target;
+ };
+ 
+-enum module_state
+-{
+-	MODULE_STATE_LIVE,
+-	MODULE_STATE_COMING,
+-	MODULE_STATE_GOING,
++enum module_state {
++	MODULE_STATE_LIVE,	/* Normal state. */
++	MODULE_STATE_COMING,	/* Full formed, running module_init. */
++	MODULE_STATE_GOING,	/* Going away. */
++	MODULE_STATE_UNFORMED,	/* Still setting it up. */
+ };
+ 
+ /**
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 0dd42a0..3e63925 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -2654,7 +2654,16 @@ static inline void thread_group_cputime_init(struct signal_struct *sig)
+ extern void recalc_sigpending_and_wake(struct task_struct *t);
+ extern void recalc_sigpending(void);
+ 
+-extern void signal_wake_up(struct task_struct *t, int resume_stopped);
++extern void signal_wake_up_state(struct task_struct *t, unsigned int state);
++
++static inline void signal_wake_up(struct task_struct *t, bool resume)
++{
++	signal_wake_up_state(t, resume ? TASK_WAKEKILL : 0);
++}
++static inline void ptrace_signal_wake_up(struct task_struct *t, bool resume)
++{
++	signal_wake_up_state(t, resume ? __TASK_TRACED : 0);
++}
+ 
+ /*
+  * Wrappers for p->thread_info->cpu access. No-op on UP.
+diff --git a/init/do_mounts_initrd.c b/init/do_mounts_initrd.c
+index 5e4ded5..f9acf71 100644
+--- a/init/do_mounts_initrd.c
++++ b/init/do_mounts_initrd.c
+@@ -36,6 +36,10 @@ __setup("noinitrd", no_initrd);
+ static int init_linuxrc(struct subprocess_info *info, struct cred *new)
+ {
+ 	sys_unshare(CLONE_FS | CLONE_FILES);
++	/* stdin/stdout/stderr for /linuxrc */
++	sys_open("/dev/console", O_RDWR, 0);
++	sys_dup(0);
++	sys_dup(0);
+ 	/* move initrd over / and chdir/chroot in initrd root */
+ 	sys_chdir("/root");
+ 	sys_mount(".", "/", NULL, MS_MOVE, NULL);
+diff --git a/init/main.c b/init/main.c
+index e33e09d..cd147a9 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -800,7 +800,7 @@ static int run_init_process(const char *init_filename)
+ 	return kernel_execve(init_filename, argv_init, envp_init);
+ }
+ 
+-static void __init kernel_init_freeable(void);
++static noinline void __init kernel_init_freeable(void);
+ 
+ static int __ref kernel_init(void *unused)
+ {
+@@ -844,7 +844,7 @@ static int __ref kernel_init(void *unused)
+ 	      "See Linux Documentation/init.txt for guidance.");
+ }
+ 
+-static void __init kernel_init_freeable(void)
++static noinline void __init kernel_init_freeable(void)
+ {
+ 	/*
+ 	 * Wait until kthreadd is all set-up.
+diff --git a/kernel/async.c b/kernel/async.c
+index 9d31183..8f9f5cf 100644
+--- a/kernel/async.c
++++ b/kernel/async.c
+@@ -86,18 +86,27 @@ static atomic_t entry_count;
+  */
+ static async_cookie_t  __lowest_in_progress(struct async_domain *running)
+ {
++	async_cookie_t first_running = next_cookie;	/* infinity value */
++	async_cookie_t first_pending = next_cookie;	/* ditto */
+ 	struct async_entry *entry;
+ 
++	/*
++	 * Both running and pending lists are sorted but not disjoint.
++	 * Take the first cookies from both and return the min.
++	 */
+ 	if (!list_empty(&running->domain)) {
+ 		entry = list_first_entry(&running->domain, typeof(*entry), list);
+-		return entry->cookie;
++		first_running = entry->cookie;
+ 	}
+ 
+-	list_for_each_entry(entry, &async_pending, list)
+-		if (entry->running == running)
+-			return entry->cookie;
++	list_for_each_entry(entry, &async_pending, list) {
++		if (entry->running == running) {
++			first_pending = entry->cookie;
++			break;
++		}
++	}
+ 
+-	return next_cookie;	/* "infinity" value */
++	return min(first_running, first_pending);
+ }
+ 
+ static async_cookie_t  lowest_in_progress(struct async_domain *running)
+@@ -118,13 +127,17 @@ static void async_run_entry_fn(struct work_struct *work)
+ {
+ 	struct async_entry *entry =
+ 		container_of(work, struct async_entry, work);
++	struct async_entry *pos;
+ 	unsigned long flags;
+ 	ktime_t uninitialized_var(calltime), delta, rettime;
+ 	struct async_domain *running = entry->running;
+ 
+-	/* 1) move self to the running queue */
++	/* 1) move self to the running queue, make sure it stays sorted */
+ 	spin_lock_irqsave(&async_lock, flags);
+-	list_move_tail(&entry->list, &running->domain);
++	list_for_each_entry_reverse(pos, &running->domain, list)
++		if (entry->cookie < pos->cookie)
++			break;
++	list_move_tail(&entry->list, &pos->list);
+ 	spin_unlock_irqrestore(&async_lock, flags);
+ 
+ 	/* 2) run (and print duration) */
+diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
+index 4d5f8d5..8875254 100644
+--- a/kernel/debug/kdb/kdb_main.c
++++ b/kernel/debug/kdb/kdb_main.c
+@@ -1970,6 +1970,8 @@ static int kdb_lsmod(int argc, const char **argv)
+ 
+ 	kdb_printf("Module                  Size  modstruct     Used by\n");
+ 	list_for_each_entry(mod, kdb_modules, list) {
++		if (mod->state == MODULE_STATE_UNFORMED)
++			continue;
+ 
+ 		kdb_printf("%-20s%8u  0x%p ", mod->name,
+ 			   mod->core_size, (void *)mod);
+diff --git a/kernel/module.c b/kernel/module.c
+index 6e48c3a..3e544f4 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -185,6 +185,7 @@ struct load_info {
+    ongoing or failed initialization etc. */
+ static inline int strong_try_module_get(struct module *mod)
+ {
++	BUG_ON(mod && mod->state == MODULE_STATE_UNFORMED);
+ 	if (mod && mod->state == MODULE_STATE_COMING)
+ 		return -EBUSY;
+ 	if (try_module_get(mod))
+@@ -340,6 +341,9 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
+ #endif
+ 		};
+ 
++		if (mod->state == MODULE_STATE_UNFORMED)
++			continue;
++
+ 		if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
+ 			return true;
+ 	}
+@@ -450,16 +454,24 @@ const struct kernel_symbol *find_symbol(const char *name,
+ EXPORT_SYMBOL_GPL(find_symbol);
+ 
+ /* Search for module by name: must hold module_mutex. */
+-struct module *find_module(const char *name)
++static struct module *find_module_all(const char *name,
++				      bool even_unformed)
+ {
+ 	struct module *mod;
+ 
+ 	list_for_each_entry(mod, &modules, list) {
++		if (!even_unformed && mod->state == MODULE_STATE_UNFORMED)
++			continue;
+ 		if (strcmp(mod->name, name) == 0)
+ 			return mod;
+ 	}
+ 	return NULL;
+ }
++
++struct module *find_module(const char *name)
++{
++	return find_module_all(name, false);
++}
+ EXPORT_SYMBOL_GPL(find_module);
+ 
+ #ifdef CONFIG_SMP
+@@ -525,6 +537,8 @@ bool is_module_percpu_address(unsigned long addr)
+ 	preempt_disable();
+ 
+ 	list_for_each_entry_rcu(mod, &modules, list) {
++		if (mod->state == MODULE_STATE_UNFORMED)
++			continue;
+ 		if (!mod->percpu_size)
+ 			continue;
+ 		for_each_possible_cpu(cpu) {
+@@ -1048,6 +1062,8 @@ static ssize_t show_initstate(struct module_attribute *mattr,
+ 	case MODULE_STATE_GOING:
+ 		state = "going";
+ 		break;
++	default:
++		BUG();
+ 	}
+ 	return sprintf(buffer, "%s\n", state);
+ }
+@@ -1786,6 +1802,8 @@ void set_all_modules_text_rw(void)
+ 
+ 	mutex_lock(&module_mutex);
+ 	list_for_each_entry_rcu(mod, &modules, list) {
++		if (mod->state == MODULE_STATE_UNFORMED)
++			continue;
+ 		if ((mod->module_core) && (mod->core_text_size)) {
+ 			set_page_attributes(mod->module_core,
+ 						mod->module_core + mod->core_text_size,
+@@ -1807,6 +1825,8 @@ void set_all_modules_text_ro(void)
+ 
+ 	mutex_lock(&module_mutex);
+ 	list_for_each_entry_rcu(mod, &modules, list) {
++		if (mod->state == MODULE_STATE_UNFORMED)
++			continue;
+ 		if ((mod->module_core) && (mod->core_text_size)) {
+ 			set_page_attributes(mod->module_core,
+ 						mod->module_core + mod->core_text_size,
+@@ -2938,8 +2958,9 @@ static bool finished_loading(const char *name)
+ 	bool ret;
+ 
+ 	mutex_lock(&module_mutex);
+-	mod = find_module(name);
+-	ret = !mod || mod->state != MODULE_STATE_COMING;
++	mod = find_module_all(name, true);
++	ret = !mod || mod->state == MODULE_STATE_LIVE
++		|| mod->state == MODULE_STATE_GOING;
+ 	mutex_unlock(&module_mutex);
+ 
+ 	return ret;
+@@ -2970,6 +2991,32 @@ static struct module *load_module(void __user *umod,
+ 		goto free_copy;
+ 	}
+ 
++	/*
++	 * We try to place it in the list now to make sure it's unique
++	 * before we dedicate too many resources.  In particular,
++	 * temporary percpu memory exhaustion.
++	 */
++	mod->state = MODULE_STATE_UNFORMED;
++again:
++	mutex_lock(&module_mutex);
++	if ((old = find_module_all(mod->name, true)) != NULL) {
++		if (old->state == MODULE_STATE_COMING
++		    || old->state == MODULE_STATE_UNFORMED) {
++			/* Wait in case it fails to load. */
++			mutex_unlock(&module_mutex);
++			err = wait_event_interruptible(module_wq,
++					       finished_loading(mod->name));
++			if (err)
++				goto free_module;
++			goto again;
++		}
++		err = -EEXIST;
++		mutex_unlock(&module_mutex);
++		goto free_module;
++	}
++	list_add_rcu(&mod->list, &modules);
++	mutex_unlock(&module_mutex);
++
+ #ifdef CONFIG_MODULE_SIG
+ 	mod->sig_ok = info.sig_ok;
+ 	if (!mod->sig_ok)
+@@ -2979,7 +3026,7 @@ static struct module *load_module(void __user *umod,
+ 	/* Now module is in final location, initialize linked lists, etc. */
+ 	err = module_unload_init(mod);
+ 	if (err)
+-		goto free_module;
++		goto unlink_mod;
+ 
+ 	/* Now we've got everything in the final locations, we can
+ 	 * find optional sections. */
+@@ -3014,54 +3061,33 @@ static struct module *load_module(void __user *umod,
+ 		goto free_arch_cleanup;
+ 	}
+ 
+-	/* Mark state as coming so strong_try_module_get() ignores us. */
+-	mod->state = MODULE_STATE_COMING;
+-
+-	/* Now sew it into the lists so we can get lockdep and oops
+-	 * info during argument parsing.  No one should access us, since
+-	 * strong_try_module_get() will fail.
+-	 * lockdep/oops can run asynchronous, so use the RCU list insertion
+-	 * function to insert in a way safe to concurrent readers.
+-	 * The mutex protects against concurrent writers.
+-	 */
+-again:
+-	mutex_lock(&module_mutex);
+-	if ((old = find_module(mod->name)) != NULL) {
+-		if (old->state == MODULE_STATE_COMING) {
+-			/* Wait in case it fails to load. */
+-			mutex_unlock(&module_mutex);
+-			err = wait_event_interruptible(module_wq,
+-					       finished_loading(mod->name));
+-			if (err)
+-				goto free_arch_cleanup;
+-			goto again;
+-		}
+-		err = -EEXIST;
+-		goto unlock;
+-	}
+-
+-	/* This has to be done once we're sure module name is unique. */
+ 	dynamic_debug_setup(info.debug, info.num_debug);
+ 
+-	/* Find duplicate symbols */
++	mutex_lock(&module_mutex);
++	/* Find duplicate symbols (must be called under lock). */
+ 	err = verify_export_symbols(mod);
+ 	if (err < 0)
+-		goto ddebug;
++		goto ddebug_cleanup;
+ 
++	/* This relies on module_mutex for list integrity. */
+ 	module_bug_finalize(info.hdr, info.sechdrs, mod);
+-	list_add_rcu(&mod->list, &modules);
++
++	/* Mark state as coming so strong_try_module_get() ignores us,
++	 * but kallsyms etc. can see us. */
++	mod->state = MODULE_STATE_COMING;
++
+ 	mutex_unlock(&module_mutex);
+ 
+ 	/* Module is ready to execute: parsing args may do that. */
+ 	err = parse_args(mod->name, mod->args, mod->kp, mod->num_kp,
+ 			 -32768, 32767, &ddebug_dyndbg_module_param_cb);
+ 	if (err < 0)
+-		goto unlink;
++		goto bug_cleanup;
+ 
+ 	/* Link in to syfs. */
+ 	err = mod_sysfs_setup(mod, &info, mod->kp, mod->num_kp);
+ 	if (err < 0)
+-		goto unlink;
++		goto bug_cleanup;
+ 
+ 	/* Get rid of temporary copy. */
+ 	free_copy(&info);
+@@ -3070,16 +3096,13 @@ again:
+ 	trace_module_load(mod);
+ 	return mod;
+ 
+- unlink:
++ bug_cleanup:
++	/* module_bug_cleanup needs module_mutex protection */
+ 	mutex_lock(&module_mutex);
+-	/* Unlink carefully: kallsyms could be walking list. */
+-	list_del_rcu(&mod->list);
+ 	module_bug_cleanup(mod);
+-	wake_up_all(&module_wq);
+- ddebug:
+-	dynamic_debug_remove(info.debug);
+- unlock:
++ ddebug_cleanup:
+ 	mutex_unlock(&module_mutex);
++	dynamic_debug_remove(info.debug);
+ 	synchronize_sched();
+ 	kfree(mod->args);
+  free_arch_cleanup:
+@@ -3088,6 +3111,12 @@ again:
+ 	free_modinfo(mod);
+  free_unload:
+ 	module_unload_free(mod);
++ unlink_mod:
++	mutex_lock(&module_mutex);
++	/* Unlink carefully: kallsyms could be walking list. */
++	list_del_rcu(&mod->list);
++	wake_up_all(&module_wq);
++	mutex_unlock(&module_mutex);
+  free_module:
+ 	module_deallocate(mod, &info);
+  free_copy:
+@@ -3264,6 +3293,8 @@ const char *module_address_lookup(unsigned long addr,
+ 
+ 	preempt_disable();
+ 	list_for_each_entry_rcu(mod, &modules, list) {
++		if (mod->state == MODULE_STATE_UNFORMED)
++			continue;
+ 		if (within_module_init(addr, mod) ||
+ 		    within_module_core(addr, mod)) {
+ 			if (modname)
+@@ -3287,6 +3318,8 @@ int lookup_module_symbol_name(unsigned long addr, char *symname)
+ 
+ 	preempt_disable();
+ 	list_for_each_entry_rcu(mod, &modules, list) {
++		if (mod->state == MODULE_STATE_UNFORMED)
++			continue;
+ 		if (within_module_init(addr, mod) ||
+ 		    within_module_core(addr, mod)) {
+ 			const char *sym;
+@@ -3311,6 +3344,8 @@ int lookup_module_symbol_attrs(unsigned long addr, unsigned long *size,
+ 
+ 	preempt_disable();
+ 	list_for_each_entry_rcu(mod, &modules, list) {
++		if (mod->state == MODULE_STATE_UNFORMED)
++			continue;
+ 		if (within_module_init(addr, mod) ||
+ 		    within_module_core(addr, mod)) {
+ 			const char *sym;
+@@ -3338,6 +3373,8 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
+ 
+ 	preempt_disable();
+ 	list_for_each_entry_rcu(mod, &modules, list) {
++		if (mod->state == MODULE_STATE_UNFORMED)
++			continue;
+ 		if (symnum < mod->num_symtab) {
+ 			*value = mod->symtab[symnum].st_value;
+ 			*type = mod->symtab[symnum].st_info;
+@@ -3380,9 +3417,12 @@ unsigned long module_kallsyms_lookup_name(const char *name)
+ 			ret = mod_find_symname(mod, colon+1);
+ 		*colon = ':';
+ 	} else {
+-		list_for_each_entry_rcu(mod, &modules, list)
++		list_for_each_entry_rcu(mod, &modules, list) {
++			if (mod->state == MODULE_STATE_UNFORMED)
++				continue;
+ 			if ((ret = mod_find_symname(mod, name)) != 0)
+ 				break;
++		}
+ 	}
+ 	preempt_enable();
+ 	return ret;
+@@ -3397,6 +3437,8 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *,
+ 	int ret;
+ 
+ 	list_for_each_entry(mod, &modules, list) {
++		if (mod->state == MODULE_STATE_UNFORMED)
++			continue;
+ 		for (i = 0; i < mod->num_symtab; i++) {
+ 			ret = fn(data, mod->strtab + mod->symtab[i].st_name,
+ 				 mod, mod->symtab[i].st_value);
+@@ -3412,6 +3454,7 @@ static char *module_flags(struct module *mod, char *buf)
+ {
+ 	int bx = 0;
+ 
++	BUG_ON(mod->state == MODULE_STATE_UNFORMED);
+ 	if (mod->taints ||
+ 	    mod->state == MODULE_STATE_GOING ||
+ 	    mod->state == MODULE_STATE_COMING) {
+@@ -3453,6 +3496,10 @@ static int m_show(struct seq_file *m, void *p)
+ 	struct module *mod = list_entry(p, struct module, list);
+ 	char buf[8];
+ 
++	/* We always ignore unformed modules. */
++	if (mod->state == MODULE_STATE_UNFORMED)
++		return 0;
++
+ 	seq_printf(m, "%s %u",
+ 		   mod->name, mod->init_size + mod->core_size);
+ 	print_unload_info(m, mod);
+@@ -3513,6 +3560,8 @@ const struct exception_table_entry *search_module_extables(unsigned long addr)
+ 
+ 	preempt_disable();
+ 	list_for_each_entry_rcu(mod, &modules, list) {
++		if (mod->state == MODULE_STATE_UNFORMED)
++			continue;
+ 		if (mod->num_exentries == 0)
+ 			continue;
+ 
+@@ -3561,10 +3610,13 @@ struct module *__module_address(unsigned long addr)
+ 	if (addr < module_addr_min || addr > module_addr_max)
+ 		return NULL;
+ 
+-	list_for_each_entry_rcu(mod, &modules, list)
++	list_for_each_entry_rcu(mod, &modules, list) {
++		if (mod->state == MODULE_STATE_UNFORMED)
++			continue;
+ 		if (within_module_core(addr, mod)
+ 		    || within_module_init(addr, mod))
+ 			return mod;
++	}
+ 	return NULL;
+ }
+ EXPORT_SYMBOL_GPL(__module_address);
+@@ -3617,8 +3669,11 @@ void print_modules(void)
+ 	printk(KERN_DEFAULT "Modules linked in:");
+ 	/* Most callers should already have preempt disabled, but make sure */
+ 	preempt_disable();
+-	list_for_each_entry_rcu(mod, &modules, list)
++	list_for_each_entry_rcu(mod, &modules, list) {
++		if (mod->state == MODULE_STATE_UNFORMED)
++			continue;
+ 		printk(" %s%s", mod->name, module_flags(mod, buf));
++	}
+ 	preempt_enable();
+ 	if (last_unloaded_module[0])
+ 		printk(" [last unloaded: %s]", last_unloaded_module);
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index 1f5e55d..fbea91d 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -117,11 +117,45 @@ void __ptrace_unlink(struct task_struct *child)
+ 	 * TASK_KILLABLE sleeps.
+ 	 */
+ 	if (child->jobctl & JOBCTL_STOP_PENDING || task_is_traced(child))
+-		signal_wake_up(child, task_is_traced(child));
++		ptrace_signal_wake_up(child, true);
+ 
+ 	spin_unlock(&child->sighand->siglock);
+ }
+ 
++/* Ensure that nothing can wake it up, even SIGKILL */
++static bool ptrace_freeze_traced(struct task_struct *task)
++{
++	bool ret = false;
++
++	/* Lockless, nobody but us can set this flag */
++	if (task->jobctl & JOBCTL_LISTENING)
++		return ret;
++
++	spin_lock_irq(&task->sighand->siglock);
++	if (task_is_traced(task) && !__fatal_signal_pending(task)) {
++		task->state = __TASK_TRACED;
++		ret = true;
++	}
++	spin_unlock_irq(&task->sighand->siglock);
++
++	return ret;
++}
++
++static void ptrace_unfreeze_traced(struct task_struct *task)
++{
++	if (task->state != __TASK_TRACED)
++		return;
++
++	WARN_ON(!task->ptrace || task->parent != current);
++
++	spin_lock_irq(&task->sighand->siglock);
++	if (__fatal_signal_pending(task))
++		wake_up_state(task, __TASK_TRACED);
++	else
++		task->state = TASK_TRACED;
++	spin_unlock_irq(&task->sighand->siglock);
++}
++
+ /**
+  * ptrace_check_attach - check whether ptracee is ready for ptrace operation
+  * @child: ptracee to check for
+@@ -151,24 +185,29 @@ int ptrace_check_attach(struct task_struct *child, bool ignore_state)
+ 	 * be changed by us so it's not changing right after this.
+ 	 */
+ 	read_lock(&tasklist_lock);
+-	if ((child->ptrace & PT_PTRACED) && child->parent == current) {
++	if (child->ptrace && child->parent == current) {
++		WARN_ON(child->state == __TASK_TRACED);
+ 		/*
+ 		 * child->sighand can't be NULL, release_task()
+ 		 * does ptrace_unlink() before __exit_signal().
+ 		 */
+-		spin_lock_irq(&child->sighand->siglock);
+-		WARN_ON_ONCE(task_is_stopped(child));
+-		if (ignore_state || (task_is_traced(child) &&
+-				     !(child->jobctl & JOBCTL_LISTENING)))
++		if (ignore_state || ptrace_freeze_traced(child))
+ 			ret = 0;
+-		spin_unlock_irq(&child->sighand->siglock);
+ 	}
+ 	read_unlock(&tasklist_lock);
+ 
+-	if (!ret && !ignore_state)
+-		ret = wait_task_inactive(child, TASK_TRACED) ? 0 : -ESRCH;
++	if (!ret && !ignore_state) {
++		if (!wait_task_inactive(child, __TASK_TRACED)) {
++			/*
++			 * This can only happen if may_ptrace_stop() fails and
++			 * ptrace_stop() changes ->state back to TASK_RUNNING,
++			 * so we should not worry about leaking __TASK_TRACED.
++			 */
++			WARN_ON(child->state == __TASK_TRACED);
++			ret = -ESRCH;
++		}
++	}
+ 
+-	/* All systems go.. */
+ 	return ret;
+ }
+ 
+@@ -311,7 +350,7 @@ static int ptrace_attach(struct task_struct *task, long request,
+ 	 */
+ 	if (task_is_stopped(task) &&
+ 	    task_set_jobctl_pending(task, JOBCTL_TRAP_STOP | JOBCTL_TRAPPING))
+-		signal_wake_up(task, 1);
++		signal_wake_up_state(task, __TASK_STOPPED);
+ 
+ 	spin_unlock(&task->sighand->siglock);
+ 
+@@ -728,7 +767,7 @@ int ptrace_request(struct task_struct *child, long request,
+ 		 * tracee into STOP.
+ 		 */
+ 		if (likely(task_set_jobctl_pending(child, JOBCTL_TRAP_STOP)))
+-			signal_wake_up(child, child->jobctl & JOBCTL_LISTENING);
++			ptrace_signal_wake_up(child, child->jobctl & JOBCTL_LISTENING);
+ 
+ 		unlock_task_sighand(child, &flags);
+ 		ret = 0;
+@@ -754,7 +793,7 @@ int ptrace_request(struct task_struct *child, long request,
+ 			 * start of this trap and now.  Trigger re-trap.
+ 			 */
+ 			if (child->jobctl & JOBCTL_TRAP_NOTIFY)
+-				signal_wake_up(child, true);
++				ptrace_signal_wake_up(child, true);
+ 			ret = 0;
+ 		}
+ 		unlock_task_sighand(child, &flags);
+@@ -891,6 +930,8 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
+ 		goto out_put_task_struct;
+ 
+ 	ret = arch_ptrace(child, request, addr, data);
++	if (ret || request != PTRACE_DETACH)
++		ptrace_unfreeze_traced(child);
+ 
+  out_put_task_struct:
+ 	put_task_struct(child);
+@@ -1030,8 +1071,11 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
+ 
+ 	ret = ptrace_check_attach(child, request == PTRACE_KILL ||
+ 				  request == PTRACE_INTERRUPT);
+-	if (!ret)
++	if (!ret) {
+ 		ret = compat_arch_ptrace(child, request, addr, data);
++		if (ret || request != PTRACE_DETACH)
++			ptrace_unfreeze_traced(child);
++	}
+ 
+  out_put_task_struct:
+ 	put_task_struct(child);
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 2d8927f..c529d00 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1497,7 +1497,8 @@ out:
+  */
+ int wake_up_process(struct task_struct *p)
+ {
+-	return try_to_wake_up(p, TASK_ALL, 0);
++	WARN_ON(task_is_stopped_or_traced(p));
++	return try_to_wake_up(p, TASK_NORMAL, 0);
+ }
+ EXPORT_SYMBOL(wake_up_process);
+ 
+diff --git a/kernel/signal.c b/kernel/signal.c
+index e4d4014..57dde52 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -679,23 +679,17 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
+  * No need to set need_resched since signal event passing
+  * goes through ->blocked
+  */
+-void signal_wake_up(struct task_struct *t, int resume)
++void signal_wake_up_state(struct task_struct *t, unsigned int state)
+ {
+-	unsigned int mask;
+-
+ 	set_tsk_thread_flag(t, TIF_SIGPENDING);
+-
+ 	/*
+-	 * For SIGKILL, we want to wake it up in the stopped/traced/killable
++	 * TASK_WAKEKILL also means wake it up in the stopped/traced/killable
+ 	 * case. We don't check t->state here because there is a race with it
+ 	 * executing another processor and just now entering stopped state.
+ 	 * By using wake_up_state, we ensure the process will wake up and
+ 	 * handle its death signal.
+ 	 */
+-	mask = TASK_INTERRUPTIBLE;
+-	if (resume)
+-		mask |= TASK_WAKEKILL;
+-	if (!wake_up_state(t, mask))
++	if (!wake_up_state(t, state | TASK_INTERRUPTIBLE))
+ 		kick_process(t);
+ }
+ 
+@@ -843,7 +837,7 @@ static void ptrace_trap_notify(struct task_struct *t)
+ 	assert_spin_locked(&t->sighand->siglock);
+ 
+ 	task_set_jobctl_pending(t, JOBCTL_TRAP_NOTIFY);
+-	signal_wake_up(t, t->jobctl & JOBCTL_LISTENING);
++	ptrace_signal_wake_up(t, t->jobctl & JOBCTL_LISTENING);
+ }
+ 
+ /*
+@@ -1798,6 +1792,10 @@ static inline int may_ptrace_stop(void)
+ 	 * If SIGKILL was already sent before the caller unlocked
+ 	 * ->siglock we must see ->core_state != NULL. Otherwise it
+ 	 * is safe to enter schedule().
++	 *
++	 * This is almost outdated, a task with the pending SIGKILL can't
++	 * block in TASK_TRACED. But PTRACE_EVENT_EXIT can be reported
++	 * after SIGKILL was already dequeued.
+ 	 */
+ 	if (unlikely(current->mm->core_state) &&
+ 	    unlikely(current->mm == current->parent->mm))
+@@ -1923,6 +1921,7 @@ static void ptrace_stop(int exit_code, int why, int clear_code, siginfo_t *info)
+ 		if (gstop_done)
+ 			do_notify_parent_cldstop(current, false, why);
+ 
++		/* tasklist protects us from ptrace_freeze_traced() */
+ 		__set_current_state(TASK_RUNNING);
+ 		if (clear_code)
+ 			current->exit_code = 0;
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 51b7159..356bc2f 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -3998,7 +3998,7 @@ static int ftrace_module_notify(struct notifier_block *self,
+ 
+ struct notifier_block ftrace_module_nb = {
+ 	.notifier_call = ftrace_module_notify,
+-	.priority = 0,
++	.priority = INT_MAX,	/* Run before anything that can use kprobes */
+ };
+ 
+ extern unsigned long __start_mcount_loc[];
+diff --git a/lib/bug.c b/lib/bug.c
+index a28c141..d0cdf14 100644
+--- a/lib/bug.c
++++ b/lib/bug.c
+@@ -55,6 +55,7 @@ static inline unsigned long bug_addr(const struct bug_entry *bug)
+ }
+ 
+ #ifdef CONFIG_MODULES
++/* Updates are protected by module mutex */
+ static LIST_HEAD(module_bug_list);
+ 
+ static const struct bug_entry *module_find_bug(unsigned long bugaddr)
+diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
+index dfb2691..7dd538e 100644
+--- a/security/integrity/evm/evm_crypto.c
++++ b/security/integrity/evm/evm_crypto.c
+@@ -205,9 +205,9 @@ int evm_update_evmxattr(struct dentry *dentry, const char *xattr_name,
+ 		rc = __vfs_setxattr_noperm(dentry, XATTR_NAME_EVM,
+ 					   &xattr_data,
+ 					   sizeof(xattr_data), 0);
+-	}
+-	else if (rc == -ENODATA)
++	} else if (rc == -ENODATA && inode->i_op->removexattr) {
+ 		rc = inode->i_op->removexattr(dentry, XATTR_NAME_EVM);
++	}
+ 	return rc;
+ }
+ 
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 8799cf1..63a6801 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -4580,6 +4580,12 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = {
+ 	  .patch = patch_conexant_auto },
+ 	{ .id = 0x14f15111, .name = "CX20753/4",
+ 	  .patch = patch_conexant_auto },
++	{ .id = 0x14f15113, .name = "CX20755",
++	  .patch = patch_conexant_auto },
++	{ .id = 0x14f15114, .name = "CX20756",
++	  .patch = patch_conexant_auto },
++	{ .id = 0x14f15115, .name = "CX20757",
++	  .patch = patch_conexant_auto },
+ 	{} /* terminator */
+ };
+ 
+@@ -4603,6 +4609,9 @@ MODULE_ALIAS("snd-hda-codec-id:14f150b9");
+ MODULE_ALIAS("snd-hda-codec-id:14f1510f");
+ MODULE_ALIAS("snd-hda-codec-id:14f15110");
+ MODULE_ALIAS("snd-hda-codec-id:14f15111");
++MODULE_ALIAS("snd-hda-codec-id:14f15113");
++MODULE_ALIAS("snd-hda-codec-id:14f15114");
++MODULE_ALIAS("snd-hda-codec-id:14f15115");
+ 
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Conexant HD-audio codec");
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 4bbabdc..bbaf67c 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6211,6 +6211,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
+ 	SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_MIC2_MUTE_LED),
+ 	SND_PCI_QUIRK(0x103c, 0x1972, "HP Pavilion 17", ALC269_FIXUP_MIC1_MUTE_LED),
++	SND_PCI_QUIRK(0x103c, 0x1977, "HP Pavilion 14", ALC269_FIXUP_MIC1_MUTE_LED),
+ 	SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_DMIC),
+ 	SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_DMIC),
+ 	SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+diff --git a/tools/perf/Makefile b/tools/perf/Makefile
+index 0a619af..627849f 100644
+--- a/tools/perf/Makefile
++++ b/tools/perf/Makefile
+@@ -58,7 +58,7 @@ ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ \
+ 				  -e s/arm.*/arm/ -e s/sa110/arm/ \
+ 				  -e s/s390x/s390/ -e s/parisc64/parisc/ \
+ 				  -e s/ppc.*/powerpc/ -e s/mips.*/mips/ \
+-				  -e s/sh[234].*/sh/ )
++				  -e s/sh[234].*/sh/ -e s/aarch64.*/arm64/ )
+ NO_PERF_REGS := 1
+ 
+ CC = $(CROSS_COMPILE)gcc