[gentoo-commits] proj/linux-patches:4.9 commit in: /

[Alice Ferrazzi]

commit:     941599b763657a0ff60ee868b581e6a63035a7f6
Author:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 15 16:02:15 2017 +0000
Commit:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Wed Feb 15 16:02:15 2017 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=941599b7

Linux patch 4.9.10

 0000_README             |    4 +
 1009_linux-4.9.10.patch | 2157 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 2161 insertions(+)

diff --git a/0000_README b/0000_README
index 450839f..9b2ecc5 100644
--- a/0000_README
+++ b/0000_README
@@ -79,6 +79,10 @@ Patch:  1008_linux-4.9.9.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.9
 
+Patch:  1009_linux-4.9.10.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.10
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1009_linux-4.9.10.patch b/1009_linux-4.9.10.patch
new file mode 100644
index 0000000..72028fa
--- /dev/null
+++ b/1009_linux-4.9.10.patch
@@ -0,0 +1,2157 @@
+diff --git a/Makefile b/Makefile
+index c0c41c9fac0c..d2fe757a979d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 9
++SUBLEVEL = 10
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/arc/kernel/unaligned.c b/arch/arc/kernel/unaligned.c
+index 91ebe382147f..5f69c3bd59bb 100644
+--- a/arch/arc/kernel/unaligned.c
++++ b/arch/arc/kernel/unaligned.c
+@@ -243,7 +243,7 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs,
+ 
+ 	/* clear any remanants of delay slot */
+ 	if (delay_mode(regs)) {
+-		regs->ret = regs->bta ~1U;
++		regs->ret = regs->bta & ~1U;
+ 		regs->status32 &= ~STATUS_DE_MASK;
+ 	} else {
+ 		regs->ret += state.instr_len;
+diff --git a/arch/arm/boot/dts/imx6dl.dtsi b/arch/arm/boot/dts/imx6dl.dtsi
+index 1ade1951e620..7aa120fbdc71 100644
+--- a/arch/arm/boot/dts/imx6dl.dtsi
++++ b/arch/arm/boot/dts/imx6dl.dtsi
+@@ -137,7 +137,7 @@
+ &gpio4 {
+ 	gpio-ranges = <&iomuxc  5 136 1>, <&iomuxc  6 145 1>, <&iomuxc  7 150 1>,
+ 		      <&iomuxc  8 146 1>, <&iomuxc  9 151 1>, <&iomuxc 10 147 1>,
+-		      <&iomuxc 11 151 1>, <&iomuxc 12 148 1>, <&iomuxc 13 153 1>,
++		      <&iomuxc 11 152 1>, <&iomuxc 12 148 1>, <&iomuxc 13 153 1>,
+ 		      <&iomuxc 14 149 1>, <&iomuxc 15 154 1>, <&iomuxc 16  39 7>,
+ 		      <&iomuxc 23  56 1>, <&iomuxc 24  61 7>, <&iomuxc 31  46 1>;
+ };
+diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
+index ce131ed5939d..ae738a6319f6 100644
+--- a/arch/arm/kernel/ptrace.c
++++ b/arch/arm/kernel/ptrace.c
+@@ -600,7 +600,7 @@ static int gpr_set(struct task_struct *target,
+ 		   const void *kbuf, const void __user *ubuf)
+ {
+ 	int ret;
+-	struct pt_regs newregs;
++	struct pt_regs newregs = *task_pt_regs(target);
+ 
+ 	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
+ 				 &newregs,
+diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
+index 3a2e678b8d30..0122ad1a6027 100644
+--- a/arch/arm/mm/fault.c
++++ b/arch/arm/mm/fault.c
+@@ -610,9 +610,9 @@ static int __init early_abort_handler(unsigned long addr, unsigned int fsr,
+ 
+ void __init early_abt_enable(void)
+ {
+-	fsr_info[22].fn = early_abort_handler;
++	fsr_info[FSR_FS_AEA].fn = early_abort_handler;
+ 	local_abt_enable();
+-	fsr_info[22].fn = do_bad;
++	fsr_info[FSR_FS_AEA].fn = do_bad;
+ }
+ 
+ #ifndef CONFIG_ARM_LPAE
+diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h
+index 67532f242271..afc1f84e763b 100644
+--- a/arch/arm/mm/fault.h
++++ b/arch/arm/mm/fault.h
+@@ -11,11 +11,15 @@
+ #define FSR_FS5_0		(0x3f)
+ 
+ #ifdef CONFIG_ARM_LPAE
++#define FSR_FS_AEA		17
++
+ static inline int fsr_fs(unsigned int fsr)
+ {
+ 	return fsr & FSR_FS5_0;
+ }
+ #else
++#define FSR_FS_AEA		22
++
+ static inline int fsr_fs(unsigned int fsr)
+ {
+ 	return (fsr & FSR_FS3_0) | (fsr & FSR_FS4) >> 6;
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index 9e1499f98def..13f5fad21066 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -641,9 +641,10 @@
+ #define   SRR1_ISI_N_OR_G	0x10000000 /* ISI: Access is no-exec or G */
+ #define   SRR1_ISI_PROT		0x08000000 /* ISI: Other protection fault */
+ #define   SRR1_WAKEMASK		0x00380000 /* reason for wakeup */
+-#define   SRR1_WAKEMASK_P8	0x003c0000 /* reason for wakeup on POWER8 */
++#define   SRR1_WAKEMASK_P8	0x003c0000 /* reason for wakeup on POWER8 and 9 */
+ #define   SRR1_WAKESYSERR	0x00300000 /* System error */
+ #define   SRR1_WAKEEE		0x00200000 /* External interrupt */
++#define   SRR1_WAKEHVI		0x00240000 /* Hypervisor Virtualization Interrupt (P9) */
+ #define   SRR1_WAKEMT		0x00280000 /* mtctrl */
+ #define	  SRR1_WAKEHMI		0x00280000 /* Hypervisor maintenance */
+ #define   SRR1_WAKEDEC		0x00180000 /* Decrementer interrupt */
+diff --git a/arch/powerpc/include/asm/xics.h b/arch/powerpc/include/asm/xics.h
+index f0b238516e9b..e0b9e576905a 100644
+--- a/arch/powerpc/include/asm/xics.h
++++ b/arch/powerpc/include/asm/xics.h
+@@ -44,6 +44,7 @@ static inline int icp_hv_init(void) { return -ENODEV; }
+ 
+ #ifdef CONFIG_PPC_POWERNV
+ extern int icp_opal_init(void);
++extern void icp_opal_flush_interrupt(void);
+ #else
+ static inline int icp_opal_init(void) { return -ENODEV; }
+ #endif
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index 3493cf4e0452..71697ff70879 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -50,9 +50,7 @@ static inline void _tlbiel_pid(unsigned long pid, unsigned long ric)
+ 	for (set = 0; set < POWER9_TLB_SETS_RADIX ; set++) {
+ 		__tlbiel_pid(pid, set, ric);
+ 	}
+-	if (cpu_has_feature(CPU_FTR_POWER9_DD1))
+-		asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
+-	return;
++	asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
+ }
+ 
+ static inline void _tlbie_pid(unsigned long pid, unsigned long ric)
+@@ -85,8 +83,6 @@ static inline void _tlbiel_va(unsigned long va, unsigned long pid,
+ 	asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
+ 		     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
+ 	asm volatile("ptesync": : :"memory");
+-	if (cpu_has_feature(CPU_FTR_POWER9_DD1))
+-		asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
+ }
+ 
+ static inline void _tlbie_va(unsigned long va, unsigned long pid,
+diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
+index c789258ae1e1..eec0e8d0454d 100644
+--- a/arch/powerpc/platforms/powernv/smp.c
++++ b/arch/powerpc/platforms/powernv/smp.c
+@@ -155,8 +155,10 @@ static void pnv_smp_cpu_kill_self(void)
+ 		wmask = SRR1_WAKEMASK_P8;
+ 
+ 	idle_states = pnv_get_supported_cpuidle_states();
++
+ 	/* We don't want to take decrementer interrupts while we are offline,
+-	 * so clear LPCR:PECE1. We keep PECE2 enabled.
++	 * so clear LPCR:PECE1. We keep PECE2 (and LPCR_PECE_HVEE on P9)
++	 * enabled as to let IPIs in.
+ 	 */
+ 	mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1);
+ 
+@@ -206,8 +208,12 @@ static void pnv_smp_cpu_kill_self(void)
+ 		 * contains 0.
+ 		 */
+ 		if (((srr1 & wmask) == SRR1_WAKEEE) ||
++		    ((srr1 & wmask) == SRR1_WAKEHVI) ||
+ 		    (local_paca->irq_happened & PACA_IRQ_EE)) {
+-			icp_native_flush_interrupt();
++			if (cpu_has_feature(CPU_FTR_ARCH_300))
++				icp_opal_flush_interrupt();
++			else
++				icp_native_flush_interrupt();
+ 		} else if ((srr1 & wmask) == SRR1_WAKEHDBELL) {
+ 			unsigned long msg = PPC_DBELL_TYPE(PPC_DBELL_SERVER);
+ 			asm volatile(PPC_MSGCLR(%0) : : "r" (msg));
+@@ -221,6 +227,8 @@ static void pnv_smp_cpu_kill_self(void)
+ 		if (srr1 && !generic_check_cpu_restart(cpu))
+ 			DBG("CPU%d Unexpected exit while offline !\n", cpu);
+ 	}
++
++	/* Re-enable decrementer interrupts */
+ 	mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) | LPCR_PECE1);
+ 	DBG("CPU%d coming online...\n", cpu);
+ }
+diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
+index 60c57657c772..c96c0cb95d87 100644
+--- a/arch/powerpc/sysdev/xics/icp-opal.c
++++ b/arch/powerpc/sysdev/xics/icp-opal.c
+@@ -132,6 +132,35 @@ static irqreturn_t icp_opal_ipi_action(int irq, void *dev_id)
+ 	return smp_ipi_demux();
+ }
+ 
++/*
++ * Called when an interrupt is received on an off-line CPU to
++ * clear the interrupt, so that the CPU can go back to nap mode.
++ */
++void icp_opal_flush_interrupt(void)
++{
++	unsigned int xirr;
++	unsigned int vec;
++
++	do {
++		xirr = icp_opal_get_xirr();
++		vec = xirr & 0x00ffffff;
++		if (vec == XICS_IRQ_SPURIOUS)
++			break;
++		if (vec == XICS_IPI) {
++			/* Clear pending IPI */
++			int cpu = smp_processor_id();
++			kvmppc_set_host_ipi(cpu, 0);
++			opal_int_set_mfrr(get_hard_smp_processor_id(cpu), 0xff);
++		} else {
++			pr_err("XICS: hw interrupt 0x%x to offline cpu, "
++			       "disabling\n", vec);
++			xics_mask_unknown_vec(vec);
++		}
++
++		/* EOI the interrupt */
++	} while (opal_int_eoi(xirr) > 0);
++}
++
+ #endif /* CONFIG_SMP */
+ 
+ static const struct icp_ops icp_opal_ops = {
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index 984a7bf17f6a..83db0eae9979 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -104,6 +104,7 @@ struct cpuinfo_x86 {
+ 	__u8			x86_phys_bits;
+ 	/* CPUID returned core id bits: */
+ 	__u8			x86_coreid_bits;
++	__u8			cu_id;
+ 	/* Max extended CPUID function supported: */
+ 	__u32			extended_cpuid_level;
+ 	/* Maximum supported CPUID level, -1=no CPUID: */
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index 7249f1500bcb..d1e25564b3c1 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -1876,7 +1876,6 @@ static struct irq_chip ioapic_chip __read_mostly = {
+ 	.irq_ack		= irq_chip_ack_parent,
+ 	.irq_eoi		= ioapic_ack_level,
+ 	.irq_set_affinity	= ioapic_set_affinity,
+-	.irq_retrigger		= irq_chip_retrigger_hierarchy,
+ 	.flags			= IRQCHIP_SKIP_SET_WAKE,
+ };
+ 
+@@ -1888,7 +1887,6 @@ static struct irq_chip ioapic_ir_chip __read_mostly = {
+ 	.irq_ack		= irq_chip_ack_parent,
+ 	.irq_eoi		= ioapic_ir_ack_level,
+ 	.irq_set_affinity	= ioapic_set_affinity,
+-	.irq_retrigger		= irq_chip_retrigger_hierarchy,
+ 	.flags			= IRQCHIP_SKIP_SET_WAKE,
+ };
+ 
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 1d3167269a67..2b4cf04239b6 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -309,8 +309,22 @@ static void amd_get_topology(struct cpuinfo_x86 *c)
+ 
+ 	/* get information required for multi-node processors */
+ 	if (boot_cpu_has(X86_FEATURE_TOPOEXT)) {
++		u32 eax, ebx, ecx, edx;
+ 
+-		node_id = cpuid_ecx(0x8000001e) & 7;
++		cpuid(0x8000001e, &eax, &ebx, &ecx, &edx);
++
++		node_id  = ecx & 0xff;
++		smp_num_siblings = ((ebx >> 8) & 0xff) + 1;
++
++		if (c->x86 == 0x15)
++			c->cu_id = ebx & 0xff;
++
++		if (c->x86 >= 0x17) {
++			c->cpu_core_id = ebx & 0xff;
++
++			if (smp_num_siblings > 1)
++				c->x86_max_cores /= smp_num_siblings;
++		}
+ 
+ 		/*
+ 		 * We may have multiple LLCs if L3 caches exist, so check if we
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 023c7bfa24df..4eece91ada37 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1015,6 +1015,7 @@ static void identify_cpu(struct cpuinfo_x86 *c)
+ 	c->x86_model_id[0] = '\0';  /* Unset */
+ 	c->x86_max_cores = 1;
+ 	c->x86_coreid_bits = 0;
++	c->cu_id = 0xff;
+ #ifdef CONFIG_X86_64
+ 	c->x86_clflush_size = 64;
+ 	c->x86_phys_bits = 36;
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index e9bbe02950ad..36171bcd91f8 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -423,9 +423,15 @@ static bool match_smt(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
+ 		int cpu1 = c->cpu_index, cpu2 = o->cpu_index;
+ 
+ 		if (c->phys_proc_id == o->phys_proc_id &&
+-		    per_cpu(cpu_llc_id, cpu1) == per_cpu(cpu_llc_id, cpu2) &&
+-		    c->cpu_core_id == o->cpu_core_id)
+-			return topology_sane(c, o, "smt");
++		    per_cpu(cpu_llc_id, cpu1) == per_cpu(cpu_llc_id, cpu2)) {
++			if (c->cpu_core_id == o->cpu_core_id)
++				return topology_sane(c, o, "smt");
++
++			if ((c->cu_id != 0xff) &&
++			    (o->cu_id != 0xff) &&
++			    (c->cu_id == o->cu_id))
++				return topology_sane(c, o, "smt");
++		}
+ 
+ 	} else if (c->phys_proc_id == o->phys_proc_id &&
+ 		   c->cpu_core_id == o->cpu_core_id) {
+diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
+index ea9c49adaa1f..8aa6bea1cd6c 100644
+--- a/arch/x86/mm/dump_pagetables.c
++++ b/arch/x86/mm/dump_pagetables.c
+@@ -15,6 +15,7 @@
+ #include <linux/debugfs.h>
+ #include <linux/mm.h>
+ #include <linux/init.h>
++#include <linux/sched.h>
+ #include <linux/seq_file.h>
+ 
+ #include <asm/pgtable.h>
+@@ -406,6 +407,7 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
+ 		} else
+ 			note_page(m, &st, __pgprot(0), 1);
+ 
++		cond_resched();
+ 		start++;
+ 	}
+ 
+diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
+index e9c0993b131d..e8817e2f0597 100644
+--- a/crypto/algif_aead.c
++++ b/crypto/algif_aead.c
+@@ -671,9 +671,9 @@ static int aead_recvmsg_sync(struct socket *sock, struct msghdr *msg, int flags)
+ unlock:
+ 	list_for_each_entry_safe(rsgl, tmp, &ctx->list, list) {
+ 		af_alg_free_sg(&rsgl->sgl);
++		list_del(&rsgl->list);
+ 		if (rsgl != &ctx->first_rsgl)
+ 			sock_kfree_s(sk, rsgl, sizeof(*rsgl));
+-		list_del(&rsgl->list);
+ 	}
+ 	INIT_LIST_HEAD(&ctx->list);
+ 	aead_wmem_wakeup(sk);
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 312c4b4dc363..6eb6733a7a5c 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2704,6 +2704,7 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
+ 	struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
+ 	struct device *dev = acpi_desc->dev;
+ 	struct acpi_nfit_flush_work flush;
++	int rc;
+ 
+ 	/* bounce the device lock to flush acpi_nfit_add / acpi_nfit_notify */
+ 	device_lock(dev);
+@@ -2716,7 +2717,10 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
+ 	INIT_WORK_ONSTACK(&flush.work, flush_probe);
+ 	COMPLETION_INITIALIZER_ONSTACK(flush.cmp);
+ 	queue_work(nfit_wq, &flush.work);
+-	return wait_for_completion_interruptible(&flush.cmp);
++
++	rc = wait_for_completion_interruptible(&flush.cmp);
++	cancel_work_sync(&flush.work);
++	return rc;
+ }
+ 
+ static int acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc,
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 4737520ec823..80fa656da5ab 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -820,6 +820,25 @@ static void intel_pstate_hwp_enable(struct cpudata *cpudata)
+ 	wrmsrl_on_cpu(cpudata->cpu, MSR_PM_ENABLE, 0x1);
+ }
+ 
++#define MSR_IA32_POWER_CTL_BIT_EE	19
++
++/* Disable energy efficiency optimization */
++static void intel_pstate_disable_ee(int cpu)
++{
++	u64 power_ctl;
++	int ret;
++
++	ret = rdmsrl_on_cpu(cpu, MSR_IA32_POWER_CTL, &power_ctl);
++	if (ret)
++		return;
++
++	if (!(power_ctl & BIT(MSR_IA32_POWER_CTL_BIT_EE))) {
++		pr_info("Disabling energy efficiency optimization\n");
++		power_ctl |= BIT(MSR_IA32_POWER_CTL_BIT_EE);
++		wrmsrl_on_cpu(cpu, MSR_IA32_POWER_CTL, power_ctl);
++	}
++}
++
+ static int atom_get_min_pstate(void)
+ {
+ 	u64 value;
+@@ -1420,6 +1439,11 @@ static const struct x86_cpu_id intel_pstate_cpu_oob_ids[] __initconst = {
+ 	{}
+ };
+ 
++static const struct x86_cpu_id intel_pstate_cpu_ee_disable_ids[] = {
++	ICPU(INTEL_FAM6_KABYLAKE_DESKTOP, core_params),
++	{}
++};
++
+ static int intel_pstate_init_cpu(unsigned int cpunum)
+ {
+ 	struct cpudata *cpu;
+@@ -1435,6 +1459,12 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
+ 	cpu->cpu = cpunum;
+ 
+ 	if (hwp_active) {
++		const struct x86_cpu_id *id;
++
++		id = x86_match_cpu(intel_pstate_cpu_ee_disable_ids);
++		if (id)
++			intel_pstate_disable_ee(cpunum);
++
+ 		intel_pstate_hwp_enable(cpu);
+ 		pid_params.sample_rate_ms = 50;
+ 		pid_params.sample_rate_ns = 50 * NSEC_PER_MSEC;
+diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
+index faf3cb3ddce2..a388bf2d67f4 100644
+--- a/drivers/crypto/ccp/ccp-dev-v5.c
++++ b/drivers/crypto/ccp/ccp-dev-v5.c
+@@ -955,7 +955,7 @@ static irqreturn_t ccp5_irq_handler(int irq, void *data)
+ static void ccp5_config(struct ccp_device *ccp)
+ {
+ 	/* Public side */
+-	iowrite32(0x00001249, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET);
++	iowrite32(0x0, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET);
+ }
+ 
+ static void ccp5other_config(struct ccp_device *ccp)
+diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
+index da5f4a678083..340aef14d616 100644
+--- a/drivers/crypto/ccp/ccp-dev.h
++++ b/drivers/crypto/ccp/ccp-dev.h
+@@ -238,6 +238,7 @@ struct ccp_dma_chan {
+ 	struct ccp_device *ccp;
+ 
+ 	spinlock_t lock;
++	struct list_head created;
+ 	struct list_head pending;
+ 	struct list_head active;
+ 	struct list_head complete;
+diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
+index 6553912804f7..e5d9278f4019 100644
+--- a/drivers/crypto/ccp/ccp-dmaengine.c
++++ b/drivers/crypto/ccp/ccp-dmaengine.c
+@@ -63,6 +63,7 @@ static void ccp_free_chan_resources(struct dma_chan *dma_chan)
+ 	ccp_free_desc_resources(chan->ccp, &chan->complete);
+ 	ccp_free_desc_resources(chan->ccp, &chan->active);
+ 	ccp_free_desc_resources(chan->ccp, &chan->pending);
++	ccp_free_desc_resources(chan->ccp, &chan->created);
+ 
+ 	spin_unlock_irqrestore(&chan->lock, flags);
+ }
+@@ -273,6 +274,7 @@ static dma_cookie_t ccp_tx_submit(struct dma_async_tx_descriptor *tx_desc)
+ 	spin_lock_irqsave(&chan->lock, flags);
+ 
+ 	cookie = dma_cookie_assign(tx_desc);
++	list_del(&desc->entry);
+ 	list_add_tail(&desc->entry, &chan->pending);
+ 
+ 	spin_unlock_irqrestore(&chan->lock, flags);
+@@ -426,7 +428,7 @@ static struct ccp_dma_desc *ccp_create_desc(struct dma_chan *dma_chan,
+ 
+ 	spin_lock_irqsave(&chan->lock, sflags);
+ 
+-	list_add_tail(&desc->entry, &chan->pending);
++	list_add_tail(&desc->entry, &chan->created);
+ 
+ 	spin_unlock_irqrestore(&chan->lock, sflags);
+ 
+@@ -610,6 +612,7 @@ static int ccp_terminate_all(struct dma_chan *dma_chan)
+ 	/*TODO: Purge the complete list? */
+ 	ccp_free_desc_resources(chan->ccp, &chan->active);
+ 	ccp_free_desc_resources(chan->ccp, &chan->pending);
++	ccp_free_desc_resources(chan->ccp, &chan->created);
+ 
+ 	spin_unlock_irqrestore(&chan->lock, flags);
+ 
+@@ -679,6 +682,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp)
+ 		chan->ccp = ccp;
+ 
+ 		spin_lock_init(&chan->lock);
++		INIT_LIST_HEAD(&chan->created);
+ 		INIT_LIST_HEAD(&chan->pending);
+ 		INIT_LIST_HEAD(&chan->active);
+ 		INIT_LIST_HEAD(&chan->complete);
+diff --git a/drivers/crypto/chelsio/chcr_core.c b/drivers/crypto/chelsio/chcr_core.c
+index fb5f9bbfa09c..6aece3f25b08 100644
+--- a/drivers/crypto/chelsio/chcr_core.c
++++ b/drivers/crypto/chelsio/chcr_core.c
+@@ -51,6 +51,7 @@ static struct cxgb4_uld_info chcr_uld_info = {
+ int assign_chcr_device(struct chcr_dev **dev)
+ {
+ 	struct uld_ctx *u_ctx;
++	int ret = -ENXIO;
+ 
+ 	/*
+ 	 * Which device to use if multiple devices are available TODO
+@@ -58,15 +59,14 @@ int assign_chcr_device(struct chcr_dev **dev)
+ 	 * must go to the same device to maintain the ordering.
+ 	 */
+ 	mutex_lock(&dev_mutex); /* TODO ? */
+-	u_ctx = list_first_entry(&uld_ctx_list, struct uld_ctx, entry);
+-	if (!u_ctx) {
+-		mutex_unlock(&dev_mutex);
+-		return -ENXIO;
++	list_for_each_entry(u_ctx, &uld_ctx_list, entry)
++		if (u_ctx && u_ctx->dev) {
++			*dev = u_ctx->dev;
++			ret = 0;
++			break;
+ 	}
+-
+-	*dev = u_ctx->dev;
+ 	mutex_unlock(&dev_mutex);
+-	return 0;
++	return ret;
+ }
+ 
+ static int chcr_dev_add(struct uld_ctx *u_ctx)
+@@ -203,10 +203,8 @@ static int chcr_uld_state_change(void *handle, enum cxgb4_state state)
+ 
+ static int __init chcr_crypto_init(void)
+ {
+-	if (cxgb4_register_uld(CXGB4_ULD_CRYPTO, &chcr_uld_info)) {
++	if (cxgb4_register_uld(CXGB4_ULD_CRYPTO, &chcr_uld_info))
+ 		pr_err("ULD register fail: No chcr crypto support in cxgb4");
+-		return -1;
+-	}
+ 
+ 	return 0;
+ }
+diff --git a/drivers/crypto/qat/qat_c62x/adf_drv.c b/drivers/crypto/qat/qat_c62x/adf_drv.c
+index bc5cbc193aae..5b2d78a5b5aa 100644
+--- a/drivers/crypto/qat/qat_c62x/adf_drv.c
++++ b/drivers/crypto/qat/qat_c62x/adf_drv.c
+@@ -233,7 +233,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 			      &hw_data->accel_capabilities_mask);
+ 
+ 	/* Find and map all the device's BARS */
+-	i = 0;
++	i = (hw_data->fuses & ADF_DEVICE_FUSECTL_MASK) ? 1 : 0;
+ 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+ 	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+ 			 ADF_PCI_MAX_BARS * 2) {
+diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h
+index e8822536530b..33f0a6251e38 100644
+--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
++++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
+@@ -69,6 +69,7 @@
+ #define ADF_ERRSOU5 (0x3A000 + 0xD8)
+ #define ADF_DEVICE_FUSECTL_OFFSET 0x40
+ #define ADF_DEVICE_LEGFUSE_OFFSET 0x4C
++#define ADF_DEVICE_FUSECTL_MASK 0x80000000
+ #define ADF_PCI_MAX_BARS 3
+ #define ADF_DEVICE_NAME_LENGTH 32
+ #define ADF_ETR_MAX_RINGS_PER_BANK 16
+diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
+index 1e480f140663..8c4fd255a601 100644
+--- a/drivers/crypto/qat/qat_common/qat_hal.c
++++ b/drivers/crypto/qat/qat_common/qat_hal.c
+@@ -456,7 +456,7 @@ static int qat_hal_init_esram(struct icp_qat_fw_loader_handle *handle)
+ 	unsigned int csr_val;
+ 	int times = 30;
+ 
+-	if (handle->pci_dev->device == ADF_C3XXX_PCI_DEVICE_ID)
++	if (handle->pci_dev->device != ADF_DH895XCC_PCI_DEVICE_ID)
+ 		return 0;
+ 
+ 	csr_val = ADF_CSR_RD(csr_addr, 0);
+@@ -716,7 +716,7 @@ int qat_hal_init(struct adf_accel_dev *accel_dev)
+ 		(void __iomem *)((uintptr_t)handle->hal_cap_ae_xfer_csr_addr_v +
+ 				 LOCAL_TO_XFER_REG_OFFSET);
+ 	handle->pci_dev = pci_info->pci_dev;
+-	if (handle->pci_dev->device != ADF_C3XXX_PCI_DEVICE_ID) {
++	if (handle->pci_dev->device == ADF_DH895XCC_PCI_DEVICE_ID) {
+ 		sram_bar =
+ 			&pci_info->pci_bars[hw_data->get_sram_bar_id(hw_data)];
+ 		handle->hal_sram_addr_v = sram_bar->virt_addr;
+diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
+index e6862a744210..4e19bde4bbff 100644
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -1759,16 +1759,16 @@ int drm_mode_atomic_ioctl(struct drm_device *dev,
+ 
+ 	if (ret && arg->flags & DRM_MODE_PAGE_FLIP_EVENT) {
+ 		/*
+-		 * TEST_ONLY and PAGE_FLIP_EVENT are mutually exclusive,
+-		 * if they weren't, this code should be called on success
+-		 * for TEST_ONLY too.
++		 * Free the allocated event. drm_atomic_helper_setup_commit
++		 * can allocate an event too, so only free it if it's ours
++		 * to prevent a double free in drm_atomic_state_clear.
+ 		 */
+-
+ 		for_each_crtc_in_state(state, crtc, crtc_state, i) {
+-			if (!crtc_state->event)
+-				continue;
+-
+-			drm_event_cancel_free(dev, &crtc_state->event->base);
++			struct drm_pending_vblank_event *event = crtc_state->event;
++			if (event && (event->base.fence || event->base.file_priv)) {
++				drm_event_cancel_free(dev, &event->base);
++				crtc_state->event = NULL;
++			}
+ 		}
+ 	}
+ 
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index a218c2e395e7..0c400f852a76 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -1215,14 +1215,14 @@ validate_exec_list(struct drm_device *dev,
+ 			if (exec[i].offset !=
+ 			    gen8_canonical_addr(exec[i].offset & PAGE_MASK))
+ 				return -EINVAL;
+-
+-			/* From drm_mm perspective address space is continuous,
+-			 * so from this point we're always using non-canonical
+-			 * form internally.
+-			 */
+-			exec[i].offset = gen8_noncanonical_addr(exec[i].offset);
+ 		}
+ 
++		/* From drm_mm perspective address space is continuous,
++		 * so from this point we're always using non-canonical
++		 * form internally.
++		 */
++		exec[i].offset = gen8_noncanonical_addr(exec[i].offset);
++
+ 		if (exec[i].alignment && !is_power_of_2(exec[i].alignment))
+ 			return -EINVAL;
+ 
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 8079e5b380cb..b9be8a6141d8 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4280,10 +4280,10 @@ static void page_flip_completed(struct intel_crtc *intel_crtc)
+ 	drm_crtc_vblank_put(&intel_crtc->base);
+ 
+ 	wake_up_all(&dev_priv->pending_flip_queue);
+-	queue_work(dev_priv->wq, &work->unpin_work);
+-
+ 	trace_i915_flip_complete(intel_crtc->plane,
+ 				 work->pending_flip_obj);
++
++	queue_work(dev_priv->wq, &work->unpin_work);
+ }
+ 
+ static int intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc)
+diff --git a/drivers/gpu/drm/i915/intel_dpll_mgr.c b/drivers/gpu/drm/i915/intel_dpll_mgr.c
+index 1c59ca50c430..cae27c55dd99 100644
+--- a/drivers/gpu/drm/i915/intel_dpll_mgr.c
++++ b/drivers/gpu/drm/i915/intel_dpll_mgr.c
+@@ -1723,7 +1723,8 @@ bxt_get_dpll(struct intel_crtc *crtc,
+ 		return NULL;
+ 
+ 	if ((encoder->type == INTEL_OUTPUT_DP ||
+-	     encoder->type == INTEL_OUTPUT_EDP) &&
++	     encoder->type == INTEL_OUTPUT_EDP ||
++	     encoder->type == INTEL_OUTPUT_DP_MST) &&
+ 	    !bxt_ddi_dp_set_dpll_hw_state(clock, &dpll_hw_state))
+ 		return NULL;
+ 
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 16f91c8490fe..5fb4c6d9209b 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -39,7 +39,7 @@
+  * vmbus_setevent- Trigger an event notification on the specified
+  * channel.
+  */
+-static void vmbus_setevent(struct vmbus_channel *channel)
++void vmbus_setevent(struct vmbus_channel *channel)
+ {
+ 	struct hv_monitor_page *monitorpage;
+ 
+@@ -65,6 +65,7 @@ static void vmbus_setevent(struct vmbus_channel *channel)
+ 		vmbus_set_event(channel);
+ 	}
+ }
++EXPORT_SYMBOL_GPL(vmbus_setevent);
+ 
+ /*
+  * vmbus_open - Open the specified channel.
+@@ -635,8 +636,6 @@ int vmbus_sendpacket_ctl(struct vmbus_channel *channel, void *buffer,
+ 	u32 packetlen_aligned = ALIGN(packetlen, sizeof(u64));
+ 	struct kvec bufferlist[3];
+ 	u64 aligned_data = 0;
+-	int ret;
+-	bool signal = false;
+ 	bool lock = channel->acquire_ring_lock;
+ 	int num_vecs = ((bufferlen != 0) ? 3 : 1);
+ 
+@@ -656,33 +655,9 @@ int vmbus_sendpacket_ctl(struct vmbus_channel *channel, void *buffer,
+ 	bufferlist[2].iov_base = &aligned_data;
+ 	bufferlist[2].iov_len = (packetlen_aligned - packetlen);
+ 
+-	ret = hv_ringbuffer_write(&channel->outbound, bufferlist, num_vecs,
+-				  &signal, lock, channel->signal_policy);
+-
+-	/*
+-	 * Signalling the host is conditional on many factors:
+-	 * 1. The ring state changed from being empty to non-empty.
+-	 *    This is tracked by the variable "signal".
+-	 * 2. The variable kick_q tracks if more data will be placed
+-	 *    on the ring. We will not signal if more data is
+-	 *    to be placed.
+-	 *
+-	 * Based on the channel signal state, we will decide
+-	 * which signaling policy will be applied.
+-	 *
+-	 * If we cannot write to the ring-buffer; signal the host
+-	 * even if we may not have written anything. This is a rare
+-	 * enough condition that it should not matter.
+-	 * NOTE: in this case, the hvsock channel is an exception, because
+-	 * it looks the host side's hvsock implementation has a throttling
+-	 * mechanism which can hurt the performance otherwise.
+-	 */
+-
+-	if (((ret == 0) && kick_q && signal) ||
+-	    (ret && !is_hvsock_channel(channel)))
+-		vmbus_setevent(channel);
++	return hv_ringbuffer_write(channel, bufferlist, num_vecs,
++				   lock, kick_q);
+ 
+-	return ret;
+ }
+ EXPORT_SYMBOL(vmbus_sendpacket_ctl);
+ 
+@@ -723,7 +698,6 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
+ 				     u32 flags,
+ 				     bool kick_q)
+ {
+-	int ret;
+ 	int i;
+ 	struct vmbus_channel_packet_page_buffer desc;
+ 	u32 descsize;
+@@ -731,7 +705,6 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
+ 	u32 packetlen_aligned;
+ 	struct kvec bufferlist[3];
+ 	u64 aligned_data = 0;
+-	bool signal = false;
+ 	bool lock = channel->acquire_ring_lock;
+ 
+ 	if (pagecount > MAX_PAGE_BUFFER_COUNT)
+@@ -769,29 +742,8 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
+ 	bufferlist[2].iov_base = &aligned_data;
+ 	bufferlist[2].iov_len = (packetlen_aligned - packetlen);
+ 
+-	ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
+-				  &signal, lock, channel->signal_policy);
+-
+-	/*
+-	 * Signalling the host is conditional on many factors:
+-	 * 1. The ring state changed from being empty to non-empty.
+-	 *    This is tracked by the variable "signal".
+-	 * 2. The variable kick_q tracks if more data will be placed
+-	 *    on the ring. We will not signal if more data is
+-	 *    to be placed.
+-	 *
+-	 * Based on the channel signal state, we will decide
+-	 * which signaling policy will be applied.
+-	 *
+-	 * If we cannot write to the ring-buffer; signal the host
+-	 * even if we may not have written anything. This is a rare
+-	 * enough condition that it should not matter.
+-	 */
+-
+-	if (((ret == 0) && kick_q && signal) || (ret))
+-		vmbus_setevent(channel);
+-
+-	return ret;
++	return hv_ringbuffer_write(channel, bufferlist, 3,
++				   lock, kick_q);
+ }
+ EXPORT_SYMBOL_GPL(vmbus_sendpacket_pagebuffer_ctl);
+ 
+@@ -822,12 +774,10 @@ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel,
+ 			      u32 desc_size,
+ 			      void *buffer, u32 bufferlen, u64 requestid)
+ {
+-	int ret;
+ 	u32 packetlen;
+ 	u32 packetlen_aligned;
+ 	struct kvec bufferlist[3];
+ 	u64 aligned_data = 0;
+-	bool signal = false;
+ 	bool lock = channel->acquire_ring_lock;
+ 
+ 	packetlen = desc_size + bufferlen;
+@@ -848,13 +798,8 @@ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel,
+ 	bufferlist[2].iov_base = &aligned_data;
+ 	bufferlist[2].iov_len = (packetlen_aligned - packetlen);
+ 
+-	ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
+-				  &signal, lock, channel->signal_policy);
+-
+-	if (ret == 0 && signal)
+-		vmbus_setevent(channel);
+-
+-	return ret;
++	return hv_ringbuffer_write(channel, bufferlist, 3,
++				   lock, true);
+ }
+ EXPORT_SYMBOL_GPL(vmbus_sendpacket_mpb_desc);
+ 
+@@ -866,14 +811,12 @@ int vmbus_sendpacket_multipagebuffer(struct vmbus_channel *channel,
+ 				struct hv_multipage_buffer *multi_pagebuffer,
+ 				void *buffer, u32 bufferlen, u64 requestid)
+ {
+-	int ret;
+ 	struct vmbus_channel_packet_multipage_buffer desc;
+ 	u32 descsize;
+ 	u32 packetlen;
+ 	u32 packetlen_aligned;
+ 	struct kvec bufferlist[3];
+ 	u64 aligned_data = 0;
+-	bool signal = false;
+ 	bool lock = channel->acquire_ring_lock;
+ 	u32 pfncount = NUM_PAGES_SPANNED(multi_pagebuffer->offset,
+ 					 multi_pagebuffer->len);
+@@ -913,13 +856,8 @@ int vmbus_sendpacket_multipagebuffer(struct vmbus_channel *channel,
+ 	bufferlist[2].iov_base = &aligned_data;
+ 	bufferlist[2].iov_len = (packetlen_aligned - packetlen);
+ 
+-	ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
+-				  &signal, lock, channel->signal_policy);
+-
+-	if (ret == 0 && signal)
+-		vmbus_setevent(channel);
+-
+-	return ret;
++	return hv_ringbuffer_write(channel, bufferlist, 3,
++				   lock, true);
+ }
+ EXPORT_SYMBOL_GPL(vmbus_sendpacket_multipagebuffer);
+ 
+@@ -941,16 +879,9 @@ __vmbus_recvpacket(struct vmbus_channel *channel, void *buffer,
+ 		   u32 bufferlen, u32 *buffer_actual_len, u64 *requestid,
+ 		   bool raw)
+ {
+-	int ret;
+-	bool signal = false;
++	return hv_ringbuffer_read(channel, buffer, bufferlen,
++				  buffer_actual_len, requestid, raw);
+ 
+-	ret = hv_ringbuffer_read(&channel->inbound, buffer, bufferlen,
+-				 buffer_actual_len, requestid, &signal, raw);
+-
+-	if (signal)
+-		vmbus_setevent(channel);
+-
+-	return ret;
+ }
+ 
+ int vmbus_recvpacket(struct vmbus_channel *channel, void *buffer,
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 1bc1d4795243..caf341842464 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -449,8 +449,6 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
+ 	}
+ 
+ 	dev_type = hv_get_dev_type(newchannel);
+-	if (dev_type == HV_NIC)
+-		set_channel_signal_state(newchannel, HV_SIGNAL_POLICY_EXPLICIT);
+ 
+ 	init_vp_index(newchannel, dev_type);
+ 
+diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
+index a5b4442433c8..2b13f2a0a71e 100644
+--- a/drivers/hv/hyperv_vmbus.h
++++ b/drivers/hv/hyperv_vmbus.h
+@@ -527,14 +527,14 @@ int hv_ringbuffer_init(struct hv_ring_buffer_info *ring_info,
+ 
+ void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info);
+ 
+-int hv_ringbuffer_write(struct hv_ring_buffer_info *ring_info,
++int hv_ringbuffer_write(struct vmbus_channel *channel,
+ 		    struct kvec *kv_list,
+-		    u32 kv_count, bool *signal, bool lock,
+-		    enum hv_signal_policy policy);
++		    u32 kv_count, bool lock,
++		    bool kick_q);
+ 
+-int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
++int hv_ringbuffer_read(struct vmbus_channel *channel,
+ 		       void *buffer, u32 buflen, u32 *buffer_actual_len,
+-		       u64 *requestid, bool *signal, bool raw);
++		       u64 *requestid, bool raw);
+ 
+ void hv_ringbuffer_get_debuginfo(struct hv_ring_buffer_info *ring_info,
+ 			    struct hv_ring_buffer_debug_info *debug_info);
+diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
+index 08043da1a61c..308dbda700eb 100644
+--- a/drivers/hv/ring_buffer.c
++++ b/drivers/hv/ring_buffer.c
+@@ -66,21 +66,25 @@ u32 hv_end_read(struct hv_ring_buffer_info *rbi)
+  *	   once the ring buffer is empty, it will clear the
+  *	   interrupt_mask and re-check to see if new data has
+  *	   arrived.
++ *
++ * KYS: Oct. 30, 2016:
++ * It looks like Windows hosts have logic to deal with DOS attacks that
++ * can be triggered if it receives interrupts when it is not expecting
++ * the interrupt. The host expects interrupts only when the ring
++ * transitions from empty to non-empty (or full to non full on the guest
++ * to host ring).
++ * So, base the signaling decision solely on the ring state until the
++ * host logic is fixed.
+  */
+ 
+-static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi,
+-			      enum hv_signal_policy policy)
++static void hv_signal_on_write(u32 old_write, struct vmbus_channel *channel,
++			       bool kick_q)
+ {
++	struct hv_ring_buffer_info *rbi = &channel->outbound;
++
+ 	virt_mb();
+ 	if (READ_ONCE(rbi->ring_buffer->interrupt_mask))
+-		return false;
+-
+-	/*
+-	 * When the client wants to control signaling,
+-	 * we only honour the host interrupt mask.
+-	 */
+-	if (policy == HV_SIGNAL_POLICY_EXPLICIT)
+-		return true;
++		return;
+ 
+ 	/* check interrupt_mask before read_index */
+ 	virt_rmb();
+@@ -89,9 +93,9 @@ static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi,
+ 	 * ring transitions from being empty to non-empty.
+ 	 */
+ 	if (old_write == READ_ONCE(rbi->ring_buffer->read_index))
+-		return true;
++		vmbus_setevent(channel);
+ 
+-	return false;
++	return;
+ }
+ 
+ /* Get the next write location for the specified ring buffer. */
+@@ -280,9 +284,9 @@ void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info)
+ }
+ 
+ /* Write to the ring buffer. */
+-int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+-		    struct kvec *kv_list, u32 kv_count, bool *signal, bool lock,
+-		    enum hv_signal_policy policy)
++int hv_ringbuffer_write(struct vmbus_channel *channel,
++		    struct kvec *kv_list, u32 kv_count, bool lock,
++		    bool kick_q)
+ {
+ 	int i = 0;
+ 	u32 bytes_avail_towrite;
+@@ -292,6 +296,7 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+ 	u32 old_write;
+ 	u64 prev_indices = 0;
+ 	unsigned long flags = 0;
++	struct hv_ring_buffer_info *outring_info = &channel->outbound;
+ 
+ 	for (i = 0; i < kv_count; i++)
+ 		totalbytes_towrite += kv_list[i].iov_len;
+@@ -344,13 +349,13 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+ 	if (lock)
+ 		spin_unlock_irqrestore(&outring_info->ring_lock, flags);
+ 
+-	*signal = hv_need_to_signal(old_write, outring_info, policy);
++	hv_signal_on_write(old_write, channel, kick_q);
+ 	return 0;
+ }
+ 
+-int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
++int hv_ringbuffer_read(struct vmbus_channel *channel,
+ 		       void *buffer, u32 buflen, u32 *buffer_actual_len,
+-		       u64 *requestid, bool *signal, bool raw)
++		       u64 *requestid, bool raw)
+ {
+ 	u32 bytes_avail_toread;
+ 	u32 next_read_location = 0;
+@@ -359,6 +364,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
+ 	u32 offset;
+ 	u32 packetlen;
+ 	int ret = 0;
++	struct hv_ring_buffer_info *inring_info = &channel->inbound;
+ 
+ 	if (buflen <= 0)
+ 		return -EINVAL;
+@@ -377,6 +383,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
+ 		return ret;
+ 	}
+ 
++	init_cached_read_index(channel);
+ 	next_read_location = hv_get_next_read_location(inring_info);
+ 	next_read_location = hv_copyfrom_ringbuffer(inring_info, &desc,
+ 						    sizeof(desc),
+@@ -416,7 +423,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
+ 	/* Update the read index */
+ 	hv_set_next_read_location(inring_info, next_read_location);
+ 
+-	*signal = hv_need_to_signal_on_read(inring_info);
++	hv_signal_on_read(channel);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index 1869152f1d23..9b732c5f89e1 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -59,9 +59,11 @@ int mem_check_range(struct rxe_mem *mem, u64 iova, size_t length)
+ 
+ 	case RXE_MEM_TYPE_MR:
+ 	case RXE_MEM_TYPE_FMR:
+-		return ((iova < mem->iova) ||
+-			((iova + length) > (mem->iova + mem->length))) ?
+-			-EFAULT : 0;
++		if (iova < mem->iova ||
++		    length > mem->length ||
++		    iova > mem->iova + mem->length - length)
++			return -EFAULT;
++		return 0;
+ 
+ 	default:
+ 		return -EFAULT;
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index dd3d88adc003..ccf624763565 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -472,7 +472,7 @@ static enum resp_states check_rkey(struct rxe_qp *qp,
+ 				goto err2;
+ 			}
+ 
+-			resid = mtu;
++			qp->resp.resid = mtu;
+ 		} else {
+ 			if (pktlen != resid) {
+ 				state = RESPST_ERR_LENGTH;
+diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
+index 92595b98e7ed..022be0e22eba 100644
+--- a/drivers/input/misc/uinput.c
++++ b/drivers/input/misc/uinput.c
+@@ -263,13 +263,21 @@ static int uinput_create_device(struct uinput_device *udev)
+ 		return -EINVAL;
+ 	}
+ 
+-	if (test_bit(ABS_MT_SLOT, dev->absbit)) {
+-		nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
+-		error = input_mt_init_slots(dev, nslot, 0);
+-		if (error)
++	if (test_bit(EV_ABS, dev->evbit)) {
++		input_alloc_absinfo(dev);
++		if (!dev->absinfo) {
++			error = -EINVAL;
+ 			goto fail1;
+-	} else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+-		input_set_events_per_packet(dev, 60);
++		}
++
++		if (test_bit(ABS_MT_SLOT, dev->absbit)) {
++			nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
++			error = input_mt_init_slots(dev, nslot, 0);
++			if (error)
++				goto fail1;
++		} else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
++			input_set_events_per_packet(dev, 60);
++		}
+ 	}
+ 
+ 	if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) {
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 31a89c8832c0..2c965424d383 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -804,6 +804,10 @@ static void dm_old_request_fn(struct request_queue *q)
+ 		int srcu_idx;
+ 		struct dm_table *map = dm_get_live_table(md, &srcu_idx);
+ 
++		if (unlikely(!map)) {
++			dm_put_live_table(md, srcu_idx);
++			return;
++		}
+ 		ti = dm_table_find_target(map, pos);
+ 		dm_put_live_table(md, srcu_idx);
+ 	}
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+index 878950a42e6c..2cf8b1d82d6a 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+@@ -1007,9 +1007,7 @@
+ 
+ static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
+ {
+-	u8 __iomem *reg_addr = ACCESS_ONCE(base);
+-
+-	writel(value, reg_addr + reg);
++	writel(value, base + reg);
+ }
+ 
+ #define dsaf_write_dev(a, reg, value) \
+@@ -1017,9 +1015,7 @@ static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
+ 
+ static inline u32 dsaf_read_reg(u8 __iomem *base, u32 reg)
+ {
+-	u8 __iomem *reg_addr = ACCESS_ONCE(base);
+-
+-	return readl(reg_addr + reg);
++	return readl(base + reg);
+ }
+ 
+ static inline void dsaf_write_syscon(struct regmap *base, u32 reg, u32 value)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index 27ff401cec20..51c6a57ca873 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -991,6 +991,7 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
+ {
+ 	struct mlx5e_priv *priv = netdev_priv(dev);
+ 	int inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
++	bool hash_changed = false;
+ 	void *in;
+ 
+ 	if ((hfunc != ETH_RSS_HASH_NO_CHANGE) &&
+@@ -1012,14 +1013,21 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
+ 		mlx5e_redirect_rqt(priv, rqtn, MLX5E_INDIR_RQT_SIZE, 0);
+ 	}
+ 
+-	if (key)
++	if (hfunc != ETH_RSS_HASH_NO_CHANGE &&
++	    hfunc != priv->params.rss_hfunc) {
++		priv->params.rss_hfunc = hfunc;
++		hash_changed = true;
++	}
++
++	if (key) {
+ 		memcpy(priv->params.toeplitz_hash_key, key,
+ 		       sizeof(priv->params.toeplitz_hash_key));
++		hash_changed = hash_changed ||
++			       priv->params.rss_hfunc == ETH_RSS_HASH_TOP;
++	}
+ 
+-	if (hfunc != ETH_RSS_HASH_NO_CHANGE)
+-		priv->params.rss_hfunc = hfunc;
+-
+-	mlx5e_modify_tirs_hash(priv, in, inlen);
++	if (hash_changed)
++		mlx5e_modify_tirs_hash(priv, in, inlen);
+ 
+ 	mutex_unlock(&priv->state_lock);
+ 
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index 720b5fa9e625..c2ac39a940f7 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -1288,6 +1288,9 @@ void netvsc_channel_cb(void *context)
+ 	ndev = hv_get_drvdata(device);
+ 	buffer = get_per_channel_state(channel);
+ 
++	/* commit_rd_index() -> hv_signal_on_read() needs this. */
++	init_cached_read_index(channel);
++
+ 	do {
+ 		desc = get_next_pkt_raw(channel);
+ 		if (desc != NULL) {
+@@ -1340,6 +1343,9 @@ void netvsc_channel_cb(void *context)
+ 
+ 			bufferlen = bytes_recvd;
+ 		}
++
++		init_cached_read_index(channel);
++
+ 	} while (1);
+ 
+ 	if (bufferlen > NETVSC_PACKET_SIZE)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
+index 8b6e37ce3f66..20bfb373dcd6 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
+@@ -96,7 +96,7 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+ 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+ 	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+-	char *fw_name = "rtlwifi/rtl8192cfwU.bin";
++	char *fw_name;
+ 
+ 	rtl8192ce_bt_reg_init(hw);
+ 
+@@ -168,8 +168,13 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
+ 	}
+ 
+ 	/* request fw */
+-	if (IS_81XXC_VENDOR_UMC_B_CUT(rtlhal->version))
++	if (IS_VENDOR_UMC_A_CUT(rtlhal->version) &&
++	    !IS_92C_SERIAL(rtlhal->version))
++		fw_name = "rtlwifi/rtl8192cfwU.bin";
++	else if (IS_81XXC_VENDOR_UMC_B_CUT(rtlhal->version))
+ 		fw_name = "rtlwifi/rtl8192cfwU_B.bin";
++	else
++		fw_name = "rtlwifi/rtl8192cfw.bin";
+ 
+ 	rtlpriv->max_fw_size = 0x4000;
+ 	pr_info("Using firmware %s\n", fw_name);
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index bf2744e1e3db..0cdcb2169083 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1397,6 +1397,8 @@ static void xennet_disconnect_backend(struct netfront_info *info)
+ 	for (i = 0; i < num_queues && info->queues; ++i) {
+ 		struct netfront_queue *queue = &info->queues[i];
+ 
++		del_timer_sync(&queue->rx_refill_timer);
++
+ 		if (queue->tx_irq && (queue->tx_irq == queue->rx_irq))
+ 			unbind_from_irqhandler(queue->tx_irq, queue);
+ 		if (queue->tx_irq && (queue->tx_irq != queue->rx_irq)) {
+@@ -1751,7 +1753,6 @@ static void xennet_destroy_queues(struct netfront_info *info)
+ 
+ 		if (netif_running(info->netdev))
+ 			napi_disable(&queue->napi);
+-		del_timer_sync(&queue->rx_refill_timer);
+ 		netif_napi_del(&queue->napi);
+ 	}
+ 
+diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
+index 1480734c2d6e..aefca644219b 100644
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -962,8 +962,8 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
+ 	struct nvdimm_drvdata *ndd;
+ 	struct nd_label_id label_id;
+ 	u32 flags = 0, remainder;
++	int rc, i, id = -1;
+ 	u8 *uuid = NULL;
+-	int rc, i;
+ 
+ 	if (dev->driver || ndns->claim)
+ 		return -EBUSY;
+@@ -972,11 +972,13 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
+ 		struct nd_namespace_pmem *nspm = to_nd_namespace_pmem(dev);
+ 
+ 		uuid = nspm->uuid;
++		id = nspm->id;
+ 	} else if (is_namespace_blk(dev)) {
+ 		struct nd_namespace_blk *nsblk = to_nd_namespace_blk(dev);
+ 
+ 		uuid = nsblk->uuid;
+ 		flags = NSLABEL_FLAG_LOCAL;
++		id = nsblk->id;
+ 	}
+ 
+ 	/*
+@@ -1039,10 +1041,11 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
+ 
+ 	/*
+ 	 * Try to delete the namespace if we deleted all of its
+-	 * allocation, this is not the seed device for the region, and
+-	 * it is not actively claimed by a btt instance.
++	 * allocation, this is not the seed or 0th device for the
++	 * region, and it is not actively claimed by a btt, pfn, or dax
++	 * instance.
+ 	 */
+-	if (val == 0 && nd_region->ns_seed != dev && !ndns->claim)
++	if (val == 0 && id != 0 && nd_region->ns_seed != dev && !ndns->claim)
+ 		nd_device_unregister(dev, ND_ASYNC);
+ 
+ 	return rc;
+diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
+index a2ac9e641aa9..6c033c9a2f06 100644
+--- a/drivers/nvdimm/pfn_devs.c
++++ b/drivers/nvdimm/pfn_devs.c
+@@ -627,15 +627,12 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
+ 	size = resource_size(&nsio->res);
+ 	npfns = (size - start_pad - end_trunc - SZ_8K) / SZ_4K;
+ 	if (nd_pfn->mode == PFN_MODE_PMEM) {
+-		unsigned long memmap_size;
+-
+ 		/*
+ 		 * vmemmap_populate_hugepages() allocates the memmap array in
+ 		 * HPAGE_SIZE chunks.
+ 		 */
+-		memmap_size = ALIGN(64 * npfns, HPAGE_SIZE);
+-		offset = ALIGN(start + SZ_8K + memmap_size + dax_label_reserve,
+-				nd_pfn->align) - start;
++		offset = ALIGN(start + SZ_8K + 64 * npfns + dax_label_reserve,
++				max(nd_pfn->align, HPAGE_SIZE)) - start;
+ 	} else if (nd_pfn->mode == PFN_MODE_RAM)
+ 		offset = ALIGN(start + SZ_8K + dax_label_reserve,
+ 				nd_pfn->align) - start;
+diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
+index 75f820ca17b7..27ff38f839fc 100644
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -1583,7 +1583,7 @@ static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req)
+ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
+ {
+ 	struct zfcp_qdio *qdio = wka_port->adapter->qdio;
+-	struct zfcp_fsf_req *req = NULL;
++	struct zfcp_fsf_req *req;
+ 	int retval = -EIO;
+ 
+ 	spin_lock_irq(&qdio->req_q_lock);
+@@ -1612,7 +1612,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
+ 		zfcp_fsf_req_free(req);
+ out:
+ 	spin_unlock_irq(&qdio->req_q_lock);
+-	if (req && !IS_ERR(req))
++	if (!retval)
+ 		zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);
+ 	return retval;
+ }
+@@ -1638,7 +1638,7 @@ static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req)
+ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
+ {
+ 	struct zfcp_qdio *qdio = wka_port->adapter->qdio;
+-	struct zfcp_fsf_req *req = NULL;
++	struct zfcp_fsf_req *req;
+ 	int retval = -EIO;
+ 
+ 	spin_lock_irq(&qdio->req_q_lock);
+@@ -1667,7 +1667,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
+ 		zfcp_fsf_req_free(req);
+ out:
+ 	spin_unlock_irq(&qdio->req_q_lock);
+-	if (req && !IS_ERR(req))
++	if (!retval)
+ 		zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id);
+ 	return retval;
+ }
+diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
+index 341ea327ae79..792d3e7e35e2 100644
+--- a/drivers/scsi/aacraid/comminit.c
++++ b/drivers/scsi/aacraid/comminit.c
+@@ -50,9 +50,13 @@ struct aac_common aac_config = {
+ 
+ static inline int aac_is_msix_mode(struct aac_dev *dev)
+ {
+-	u32 status;
++	u32 status = 0;
+ 
+-	status = src_readl(dev, MUnit.OMR);
++	if (dev->pdev->device == PMC_DEVICE_S6 ||
++		dev->pdev->device == PMC_DEVICE_S7 ||
++		dev->pdev->device == PMC_DEVICE_S8) {
++		status = src_readl(dev, MUnit.OMR);
++	}
+ 	return (status & AAC_INT_MODE_MSIX);
+ }
+ 
+diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+index e3b911c895b4..91dfd58b175d 100644
+--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
++++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+@@ -3929,6 +3929,7 @@ static struct configfs_attribute *ibmvscsis_tpg_attrs[] = {
+ static const struct target_core_fabric_ops ibmvscsis_ops = {
+ 	.module				= THIS_MODULE,
+ 	.name				= "ibmvscsis",
++	.max_data_sg_nents		= MAX_TXU / PAGE_SIZE,
+ 	.get_fabric_name		= ibmvscsis_get_fabric_name,
+ 	.tpg_get_wwn			= ibmvscsis_get_fabric_wwn,
+ 	.tpg_get_tag			= ibmvscsis_get_tag,
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index f84a6087cebd..8a7941b8189f 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -51,6 +51,7 @@
+ #include <linux/workqueue.h>
+ #include <linux/delay.h>
+ #include <linux/pci.h>
++#include <linux/pci-aspm.h>
+ #include <linux/interrupt.h>
+ #include <linux/aer.h>
+ #include <linux/raid_class.h>
+@@ -8706,6 +8707,8 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 
+ 	switch (hba_mpi_version) {
+ 	case MPI2_VERSION:
++		pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S |
++			PCIE_LINK_STATE_L1 | PCIE_LINK_STATE_CLKPM);
+ 		/* Use mpt2sas driver host template for SAS 2.0 HBA's */
+ 		shost = scsi_host_alloc(&mpt2sas_driver_template,
+ 		  sizeof(struct MPT3SAS_ADAPTER));
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 078d797cb492..bea819e5336d 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1459,7 +1459,7 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
+ 				/* Don't abort commands in adapter during EEH
+ 				 * recovery as it's not accessible/responding.
+ 				 */
+-				if (!ha->flags.eeh_busy) {
++				if (GET_CMD_SP(sp) && !ha->flags.eeh_busy) {
+ 					/* Get a reference to the sp and drop the lock.
+ 					 * The reference ensures this sp->done() call
+ 					 * - and not the call in qla2xxx_eh_abort() -
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index 6b423485c5d6..ea9617c7b403 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -351,7 +351,15 @@ int core_enable_device_list_for_node(
+ 			kfree(new);
+ 			return -EINVAL;
+ 		}
+-		BUG_ON(orig->se_lun_acl != NULL);
++		if (orig->se_lun_acl != NULL) {
++			pr_warn_ratelimited("Detected existing explicit"
++				" se_lun_acl->se_lun_group reference for %s"
++				" mapped_lun: %llu, failing\n",
++				 nacl->initiatorname, mapped_lun);
++			mutex_unlock(&nacl->lun_entry_mutex);
++			kfree(new);
++			return -EINVAL;
++		}
+ 
+ 		rcu_assign_pointer(new->se_lun, lun);
+ 		rcu_assign_pointer(new->se_lun_acl, lun_acl);
+diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
+index 04f616b3ba0a..aabd6602da6c 100644
+--- a/drivers/target/target_core_sbc.c
++++ b/drivers/target/target_core_sbc.c
+@@ -450,6 +450,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
+ 					     int *post_ret)
+ {
+ 	struct se_device *dev = cmd->se_dev;
++	sense_reason_t ret = TCM_NO_SENSE;
+ 
+ 	/*
+ 	 * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through
+@@ -457,9 +458,12 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
+ 	 * sent to the backend driver.
+ 	 */
+ 	spin_lock_irq(&cmd->t_state_lock);
+-	if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) {
++	if (cmd->transport_state & CMD_T_SENT) {
+ 		cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
+ 		*post_ret = 1;
++
++		if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION)
++			ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+ 	}
+ 	spin_unlock_irq(&cmd->t_state_lock);
+ 
+@@ -469,7 +473,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
+ 	 */
+ 	up(&dev->caw_sem);
+ 
+-	return TCM_NO_SENSE;
++	return ret;
+ }
+ 
+ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success,
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 7dfefd66df93..767d1eb6e035 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -457,8 +457,20 @@ static void target_complete_nacl(struct kref *kref)
+ {
+ 	struct se_node_acl *nacl = container_of(kref,
+ 				struct se_node_acl, acl_kref);
++	struct se_portal_group *se_tpg = nacl->se_tpg;
+ 
+-	complete(&nacl->acl_free_comp);
++	if (!nacl->dynamic_stop) {
++		complete(&nacl->acl_free_comp);
++		return;
++	}
++
++	mutex_lock(&se_tpg->acl_node_mutex);
++	list_del(&nacl->acl_list);
++	mutex_unlock(&se_tpg->acl_node_mutex);
++
++	core_tpg_wait_for_nacl_pr_ref(nacl);
++	core_free_device_list_for_node(nacl, se_tpg);
++	kfree(nacl);
+ }
+ 
+ void target_put_nacl(struct se_node_acl *nacl)
+@@ -499,12 +511,39 @@ EXPORT_SYMBOL(transport_deregister_session_configfs);
+ void transport_free_session(struct se_session *se_sess)
+ {
+ 	struct se_node_acl *se_nacl = se_sess->se_node_acl;
++
+ 	/*
+ 	 * Drop the se_node_acl->nacl_kref obtained from within
+ 	 * core_tpg_get_initiator_node_acl().
+ 	 */
+ 	if (se_nacl) {
++		struct se_portal_group *se_tpg = se_nacl->se_tpg;
++		const struct target_core_fabric_ops *se_tfo = se_tpg->se_tpg_tfo;
++		unsigned long flags;
++
+ 		se_sess->se_node_acl = NULL;
++
++		/*
++		 * Also determine if we need to drop the extra ->cmd_kref if
++		 * it had been previously dynamically generated, and
++		 * the endpoint is not caching dynamic ACLs.
++		 */
++		mutex_lock(&se_tpg->acl_node_mutex);
++		if (se_nacl->dynamic_node_acl &&
++		    !se_tfo->tpg_check_demo_mode_cache(se_tpg)) {
++			spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags);
++			if (list_empty(&se_nacl->acl_sess_list))
++				se_nacl->dynamic_stop = true;
++			spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
++
++			if (se_nacl->dynamic_stop)
++				list_del(&se_nacl->acl_list);
++		}
++		mutex_unlock(&se_tpg->acl_node_mutex);
++
++		if (se_nacl->dynamic_stop)
++			target_put_nacl(se_nacl);
++
+ 		target_put_nacl(se_nacl);
+ 	}
+ 	if (se_sess->sess_cmd_map) {
+@@ -518,16 +557,12 @@ EXPORT_SYMBOL(transport_free_session);
+ void transport_deregister_session(struct se_session *se_sess)
+ {
+ 	struct se_portal_group *se_tpg = se_sess->se_tpg;
+-	const struct target_core_fabric_ops *se_tfo;
+-	struct se_node_acl *se_nacl;
+ 	unsigned long flags;
+-	bool drop_nacl = false;
+ 
+ 	if (!se_tpg) {
+ 		transport_free_session(se_sess);
+ 		return;
+ 	}
+-	se_tfo = se_tpg->se_tpg_tfo;
+ 
+ 	spin_lock_irqsave(&se_tpg->session_lock, flags);
+ 	list_del(&se_sess->sess_list);
+@@ -535,33 +570,15 @@ void transport_deregister_session(struct se_session *se_sess)
+ 	se_sess->fabric_sess_ptr = NULL;
+ 	spin_unlock_irqrestore(&se_tpg->session_lock, flags);
+ 
+-	/*
+-	 * Determine if we need to do extra work for this initiator node's
+-	 * struct se_node_acl if it had been previously dynamically generated.
+-	 */
+-	se_nacl = se_sess->se_node_acl;
+-
+-	mutex_lock(&se_tpg->acl_node_mutex);
+-	if (se_nacl && se_nacl->dynamic_node_acl) {
+-		if (!se_tfo->tpg_check_demo_mode_cache(se_tpg)) {
+-			list_del(&se_nacl->acl_list);
+-			drop_nacl = true;
+-		}
+-	}
+-	mutex_unlock(&se_tpg->acl_node_mutex);
+-
+-	if (drop_nacl) {
+-		core_tpg_wait_for_nacl_pr_ref(se_nacl);
+-		core_free_device_list_for_node(se_nacl, se_tpg);
+-		se_sess->se_node_acl = NULL;
+-		kfree(se_nacl);
+-	}
+ 	pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n",
+ 		se_tpg->se_tpg_tfo->get_fabric_name());
+ 	/*
+ 	 * If last kref is dropping now for an explicit NodeACL, awake sleeping
+ 	 * ->acl_free_comp caller to wakeup configfs se_node_acl->acl_group
+ 	 * removal context from within transport_free_session() code.
++	 *
++	 * For dynamic ACL, target_put_nacl() uses target_complete_nacl()
++	 * to release all remaining generate_node_acl=1 created ACL resources.
+ 	 */
+ 
+ 	transport_free_session(se_sess);
+@@ -3086,7 +3103,6 @@ static void target_tmr_work(struct work_struct *work)
+ 		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+ 		goto check_stop;
+ 	}
+-	cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
+ 	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+ 
+ 	cmd->se_tfo->queue_tm_rsp(cmd);
+@@ -3099,11 +3115,25 @@ int transport_generic_handle_tmr(
+ 	struct se_cmd *cmd)
+ {
+ 	unsigned long flags;
++	bool aborted = false;
+ 
+ 	spin_lock_irqsave(&cmd->t_state_lock, flags);
+-	cmd->transport_state |= CMD_T_ACTIVE;
++	if (cmd->transport_state & CMD_T_ABORTED) {
++		aborted = true;
++	} else {
++		cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
++		cmd->transport_state |= CMD_T_ACTIVE;
++	}
+ 	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+ 
++	if (aborted) {
++		pr_warn_ratelimited("handle_tmr caught CMD_T_ABORTED TMR %d"
++			"ref_tag: %llu tag: %llu\n", cmd->se_tmr_req->function,
++			cmd->se_tmr_req->ref_task_tag, cmd->tag);
++		transport_cmd_check_stop_to_fabric(cmd);
++		return 0;
++	}
++
+ 	INIT_WORK(&cmd->work, target_tmr_work);
+ 	queue_work(cmd->se_dev->tmr_wq, &cmd->work);
+ 	return 0;
+diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
+index 094a1440eacb..18848ba8d2ba 100644
+--- a/drivers/target/target_core_xcopy.c
++++ b/drivers/target/target_core_xcopy.c
+@@ -836,7 +836,7 @@ static void target_xcopy_do_work(struct work_struct *work)
+ 			" CHECK_CONDITION -> sending response\n", rc);
+ 		ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
+ 	}
+-	target_complete_cmd(ec_cmd, SAM_STAT_CHECK_CONDITION);
++	target_complete_cmd(ec_cmd, ec_cmd->scsi_status);
+ }
+ 
+ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 7acbd2cf6192..1782804f6c26 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -5648,6 +5648,10 @@ long btrfs_ioctl(struct file *file, unsigned int
+ #ifdef CONFIG_COMPAT
+ long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ {
++	/*
++	 * These all access 32-bit values anyway so no further
++	 * handling is necessary.
++	 */
+ 	switch (cmd) {
+ 	case FS_IOC32_GETFLAGS:
+ 		cmd = FS_IOC_GETFLAGS;
+@@ -5658,8 +5662,6 @@ long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 	case FS_IOC32_GETVERSION:
+ 		cmd = FS_IOC_GETVERSION;
+ 		break;
+-	default:
+-		return -ENOIOCTLCMD;
+ 	}
+ 
+ 	return btrfs_ioctl(file, cmd, (unsigned long) compat_ptr(arg));
+diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
+index da7fbf1cdd56..fa3b155ce7e1 100644
+--- a/include/linux/cpumask.h
++++ b/include/linux/cpumask.h
+@@ -560,7 +560,7 @@ static inline void cpumask_copy(struct cpumask *dstp,
+ static inline int cpumask_parse_user(const char __user *buf, int len,
+ 				     struct cpumask *dstp)
+ {
+-	return bitmap_parse_user(buf, len, cpumask_bits(dstp), nr_cpu_ids);
++	return bitmap_parse_user(buf, len, cpumask_bits(dstp), nr_cpumask_bits);
+ }
+ 
+ /**
+@@ -575,7 +575,7 @@ static inline int cpumask_parselist_user(const char __user *buf, int len,
+ 				     struct cpumask *dstp)
+ {
+ 	return bitmap_parselist_user(buf, len, cpumask_bits(dstp),
+-				     nr_cpu_ids);
++				     nr_cpumask_bits);
+ }
+ 
+ /**
+@@ -590,7 +590,7 @@ static inline int cpumask_parse(const char *buf, struct cpumask *dstp)
+ 	char *nl = strchr(buf, '\n');
+ 	unsigned int len = nl ? (unsigned int)(nl - buf) : strlen(buf);
+ 
+-	return bitmap_parse(buf, len, cpumask_bits(dstp), nr_cpu_ids);
++	return bitmap_parse(buf, len, cpumask_bits(dstp), nr_cpumask_bits);
+ }
+ 
+ /**
+@@ -602,7 +602,7 @@ static inline int cpumask_parse(const char *buf, struct cpumask *dstp)
+  */
+ static inline int cpulist_parse(const char *buf, struct cpumask *dstp)
+ {
+-	return bitmap_parselist(buf, cpumask_bits(dstp), nr_cpu_ids);
++	return bitmap_parselist(buf, cpumask_bits(dstp), nr_cpumask_bits);
+ }
+ 
+ /**
+diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
+index cd184bdca58f..c92a083bcf16 100644
+--- a/include/linux/hyperv.h
++++ b/include/linux/hyperv.h
+@@ -128,6 +128,7 @@ struct hv_ring_buffer_info {
+ 	u32 ring_data_startoffset;
+ 	u32 priv_write_index;
+ 	u32 priv_read_index;
++	u32 cached_read_index;
+ };
+ 
+ /*
+@@ -180,6 +181,19 @@ static inline u32 hv_get_bytes_to_write(struct hv_ring_buffer_info *rbi)
+ 	return write;
+ }
+ 
++static inline u32 hv_get_cached_bytes_to_write(
++	const struct hv_ring_buffer_info *rbi)
++{
++	u32 read_loc, write_loc, dsize, write;
++
++	dsize = rbi->ring_datasize;
++	read_loc = rbi->cached_read_index;
++	write_loc = rbi->ring_buffer->write_index;
++
++	write = write_loc >= read_loc ? dsize - (write_loc - read_loc) :
++		read_loc - write_loc;
++	return write;
++}
+ /*
+  * VMBUS version is 32 bit entity broken up into
+  * two 16 bit quantities: major_number. minor_number.
+@@ -1447,6 +1461,7 @@ void hv_event_tasklet_enable(struct vmbus_channel *channel);
+ 
+ void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid);
+ 
++void vmbus_setevent(struct vmbus_channel *channel);
+ /*
+  * Negotiated version with the Host.
+  */
+@@ -1479,10 +1494,11 @@ hv_get_ring_buffer(struct hv_ring_buffer_info *ring_info)
+  *    there is room for the producer to send the pending packet.
+  */
+ 
+-static inline  bool hv_need_to_signal_on_read(struct hv_ring_buffer_info *rbi)
++static inline  void hv_signal_on_read(struct vmbus_channel *channel)
+ {
+-	u32 cur_write_sz;
++	u32 cur_write_sz, cached_write_sz;
+ 	u32 pending_sz;
++	struct hv_ring_buffer_info *rbi = &channel->inbound;
+ 
+ 	/*
+ 	 * Issue a full memory barrier before making the signaling decision.
+@@ -1500,14 +1516,26 @@ static inline  bool hv_need_to_signal_on_read(struct hv_ring_buffer_info *rbi)
+ 	pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);
+ 	/* If the other end is not blocked on write don't bother. */
+ 	if (pending_sz == 0)
+-		return false;
++		return;
+ 
+ 	cur_write_sz = hv_get_bytes_to_write(rbi);
+ 
+-	if (cur_write_sz >= pending_sz)
+-		return true;
++	if (cur_write_sz < pending_sz)
++		return;
++
++	cached_write_sz = hv_get_cached_bytes_to_write(rbi);
++	if (cached_write_sz < pending_sz)
++		vmbus_setevent(channel);
++
++	return;
++}
++
++static inline void
++init_cached_read_index(struct vmbus_channel *channel)
++{
++	struct hv_ring_buffer_info *rbi = &channel->inbound;
+ 
+-	return false;
++	rbi->cached_read_index = rbi->ring_buffer->read_index;
+ }
+ 
+ /*
+@@ -1571,6 +1599,8 @@ static inline void put_pkt_raw(struct vmbus_channel *channel,
+  * This call commits the read index and potentially signals the host.
+  * Here is the pattern for using the "in-place" consumption APIs:
+  *
++ * init_cached_read_index();
++ *
+  * while (get_next_pkt_raw() {
+  *	process the packet "in-place";
+  *	put_pkt_raw();
+@@ -1589,8 +1619,7 @@ static inline void commit_rd_index(struct vmbus_channel *channel)
+ 	virt_rmb();
+ 	ring_info->ring_buffer->read_index = ring_info->priv_read_index;
+ 
+-	if (hv_need_to_signal_on_read(ring_info))
+-		vmbus_set_event(channel);
++	hv_signal_on_read(channel);
+ }
+ 
+ 
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index c2119008990a..48bc1ac1da43 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -538,6 +538,7 @@ struct se_node_acl {
+ 	char			initiatorname[TRANSPORT_IQN_LEN];
+ 	/* Used to signal demo mode created ACL, disabled by default */
+ 	bool			dynamic_node_acl;
++	bool			dynamic_stop;
+ 	u32			queue_depth;
+ 	u32			acl_index;
+ 	enum target_prot_type	saved_prot_type;
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index b1cfd7416db0..4b3323151a2f 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -3461,14 +3461,15 @@ struct perf_read_data {
+ 	int ret;
+ };
+ 
+-static int find_cpu_to_read(struct perf_event *event, int local_cpu)
++static int __perf_event_read_cpu(struct perf_event *event, int event_cpu)
+ {
+-	int event_cpu = event->oncpu;
+ 	u16 local_pkg, event_pkg;
+ 
+ 	if (event->group_caps & PERF_EV_CAP_READ_ACTIVE_PKG) {
+-		event_pkg =  topology_physical_package_id(event_cpu);
+-		local_pkg =  topology_physical_package_id(local_cpu);
++		int local_cpu = smp_processor_id();
++
++		event_pkg = topology_physical_package_id(event_cpu);
++		local_pkg = topology_physical_package_id(local_cpu);
+ 
+ 		if (event_pkg == local_pkg)
+ 			return local_cpu;
+@@ -3598,7 +3599,7 @@ u64 perf_event_read_local(struct perf_event *event)
+ 
+ static int perf_event_read(struct perf_event *event, bool group)
+ {
+-	int ret = 0, cpu_to_read, local_cpu;
++	int event_cpu, ret = 0;
+ 
+ 	/*
+ 	 * If event is enabled and currently active on a CPU, update the
+@@ -3611,21 +3612,25 @@ static int perf_event_read(struct perf_event *event, bool group)
+ 			.ret = 0,
+ 		};
+ 
+-		local_cpu = get_cpu();
+-		cpu_to_read = find_cpu_to_read(event, local_cpu);
+-		put_cpu();
++		event_cpu = READ_ONCE(event->oncpu);
++		if ((unsigned)event_cpu >= nr_cpu_ids)
++			return 0;
++
++		preempt_disable();
++		event_cpu = __perf_event_read_cpu(event, event_cpu);
+ 
+ 		/*
+ 		 * Purposely ignore the smp_call_function_single() return
+ 		 * value.
+ 		 *
+-		 * If event->oncpu isn't a valid CPU it means the event got
++		 * If event_cpu isn't a valid CPU it means the event got
+ 		 * scheduled out and that will have updated the event count.
+ 		 *
+ 		 * Therefore, either way, we'll have an up-to-date event count
+ 		 * after this.
+ 		 */
+-		(void)smp_call_function_single(cpu_to_read, __perf_event_read, &data, 1);
++		(void)smp_call_function_single(event_cpu, __perf_event_read, &data, 1);
++		preempt_enable();
+ 		ret = data.ret;
+ 	} else if (event->state == PERF_EVENT_STATE_INACTIVE) {
+ 		struct perf_event_context *ctx = event->ctx;
+diff --git a/kernel/stacktrace.c b/kernel/stacktrace.c
+index b6e4c16377c7..9c15a9124e83 100644
+--- a/kernel/stacktrace.c
++++ b/kernel/stacktrace.c
+@@ -18,10 +18,8 @@ void print_stack_trace(struct stack_trace *trace, int spaces)
+ 	if (WARN_ON(!trace->entries))
+ 		return;
+ 
+-	for (i = 0; i < trace->nr_entries; i++) {
+-		printk("%*c", 1 + spaces, ' ');
+-		print_ip_sym(trace->entries[i]);
+-	}
++	for (i = 0; i < trace->nr_entries; i++)
++		printk("%*c%pS\n", 1 + spaces, ' ', (void *)trace->entries[i]);
+ }
+ EXPORT_SYMBOL_GPL(print_stack_trace);
+ 
+@@ -29,7 +27,6 @@ int snprint_stack_trace(char *buf, size_t size,
+ 			struct stack_trace *trace, int spaces)
+ {
+ 	int i;
+-	unsigned long ip;
+ 	int generated;
+ 	int total = 0;
+ 
+@@ -37,9 +34,8 @@ int snprint_stack_trace(char *buf, size_t size,
+ 		return 0;
+ 
+ 	for (i = 0; i < trace->nr_entries; i++) {
+-		ip = trace->entries[i];
+-		generated = snprintf(buf, size, "%*c[<%p>] %pS\n",
+-				1 + spaces, ' ', (void *) ip, (void *) ip);
++		generated = snprintf(buf, size, "%*c%pS\n", 1 + spaces, ' ',
++				     (void *)trace->entries[i]);
+ 
+ 		total += generated;
+ 
+diff --git a/mm/slub.c b/mm/slub.c
+index 2b3e740609e9..7aa0e97af928 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1419,6 +1419,10 @@ static int init_cache_random_seq(struct kmem_cache *s)
+ 	int err;
+ 	unsigned long i, count = oo_objects(s->oo);
+ 
++	/* Bailout if already initialised */
++	if (s->random_seq)
++		return 0;
++
+ 	err = cache_random_seq_create(s, count, GFP_KERNEL);
+ 	if (err) {
+ 		pr_err("SLUB: Unable to initialize free list for %s\n",
+diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
+index 42120d965263..50e1b7f78bd4 100644
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -339,7 +339,7 @@ int mesh_add_vendor_ies(struct ieee80211_sub_if_data *sdata,
+ 	/* fast-forward to vendor IEs */
+ 	offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0);
+ 
+-	if (offset) {
++	if (offset < ifmsh->ie_len) {
+ 		len = ifmsh->ie_len - offset;
+ 		data = ifmsh->ie + offset;
+ 		if (skb_tailroom(skb) < len)
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 1b3c18c2c1ec..cd7a419faa21 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -5874,6 +5874,7 @@ do {									    \
+ 			break;
+ 		}
+ 		cfg->ht_opmode = ht_opmode;
++		mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
+ 	}
+ 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
+ 				  1, 65535, mask,
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 09fd6108e421..c2da45ae5b2a 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -5858,7 +5858,7 @@ static int selinux_setprocattr(struct task_struct *p,
+ 		return error;
+ 
+ 	/* Obtain a SID for the context, if one was specified. */
+-	if (size && str[1] && str[1] != '\n') {
++	if (size && str[0] && str[0] != '\n') {
+ 		if (str[size-1] == '\n') {
+ 			str[size-1] = 0;
+ 			size--;
+diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
+index c850345c43b5..dfa5156f3585 100644
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -419,7 +419,6 @@ int snd_seq_pool_done(struct snd_seq_pool *pool)
+ {
+ 	unsigned long flags;
+ 	struct snd_seq_event_cell *ptr;
+-	int max_count = 5 * HZ;
+ 
+ 	if (snd_BUG_ON(!pool))
+ 		return -EINVAL;
+@@ -432,14 +431,8 @@ int snd_seq_pool_done(struct snd_seq_pool *pool)
+ 	if (waitqueue_active(&pool->output_sleep))
+ 		wake_up(&pool->output_sleep);
+ 
+-	while (atomic_read(&pool->counter) > 0) {
+-		if (max_count == 0) {
+-			pr_warn("ALSA: snd_seq_pool_done timeout: %d cells remain\n", atomic_read(&pool->counter));
+-			break;
+-		}
++	while (atomic_read(&pool->counter) > 0)
+ 		schedule_timeout_uninterruptible(1);
+-		max_count--;
+-	}
+ 	
+ 	/* release all resources */
+ 	spin_lock_irqsave(&pool->lock, flags);
+diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
+index 0bec02e89d51..450c5187eecb 100644
+--- a/sound/core/seq/seq_queue.c
++++ b/sound/core/seq/seq_queue.c
+@@ -181,6 +181,8 @@ void __exit snd_seq_queues_delete(void)
+ 	}
+ }
+ 
++static void queue_use(struct snd_seq_queue *queue, int client, int use);
++
+ /* allocate a new queue -
+  * return queue index value or negative value for error
+  */
+@@ -192,11 +194,11 @@ int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)
+ 	if (q == NULL)
+ 		return -ENOMEM;
+ 	q->info_flags = info_flags;
++	queue_use(q, client, 1);
+ 	if (queue_list_add(q) < 0) {
+ 		queue_delete(q);
+ 		return -ENOMEM;
+ 	}
+-	snd_seq_queue_use(q->queue, client, 1); /* use this queue */
+ 	return q->queue;
+ }
+ 
+@@ -502,19 +504,9 @@ int snd_seq_queue_timer_set_tempo(int queueid, int client,
+ 	return result;
+ }
+ 
+-
+-/* use or unuse this queue -
+- * if it is the first client, starts the timer.
+- * if it is not longer used by any clients, stop the timer.
+- */
+-int snd_seq_queue_use(int queueid, int client, int use)
++/* use or unuse this queue */
++static void queue_use(struct snd_seq_queue *queue, int client, int use)
+ {
+-	struct snd_seq_queue *queue;
+-
+-	queue = queueptr(queueid);
+-	if (queue == NULL)
+-		return -EINVAL;
+-	mutex_lock(&queue->timer_mutex);
+ 	if (use) {
+ 		if (!test_and_set_bit(client, queue->clients_bitmap))
+ 			queue->clients++;
+@@ -529,6 +521,21 @@ int snd_seq_queue_use(int queueid, int client, int use)
+ 	} else {
+ 		snd_seq_timer_close(queue);
+ 	}
++}
++
++/* use or unuse this queue -
++ * if it is the first client, starts the timer.
++ * if it is not longer used by any clients, stop the timer.
++ */
++int snd_seq_queue_use(int queueid, int client, int use)
++{
++	struct snd_seq_queue *queue;
++
++	queue = queueptr(queueid);
++	if (queue == NULL)
++		return -EINVAL;
++	mutex_lock(&queue->timer_mutex);
++	queue_use(queue, client, use);
+ 	mutex_unlock(&queue->timer_mutex);
+ 	queuefree(queue);
+ 	return 0;
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 56e5204ac9c1..4bf48336b0fc 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3638,6 +3638,7 @@ HDA_CODEC_ENTRY(0x10de0070, "GPU 70 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0071, "GPU 71 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0072, "GPU 72 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de007d, "GPU 7d HDMI/DP",	patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de0080, "GPU 80 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0082, "GPU 82 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0083, "GPU 83 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI",	patch_nvhdmi_2ch),
+diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
+index 90009c0b3a92..ab3c280a23d1 100644
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -754,8 +754,9 @@ int line6_probe(struct usb_interface *interface,
+ 		goto error;
+ 	}
+ 
++	line6_get_interval(line6);
++
+ 	if (properties->capabilities & LINE6_CAP_CONTROL) {
+-		line6_get_interval(line6);
+ 		ret = line6_init_cap_control(line6);
+ 		if (ret < 0)
+ 			goto error;
+diff --git a/tools/perf/builtin-diff.c b/tools/perf/builtin-diff.c
+index 9ff0db4e2d0c..933aeec46f4a 100644
+--- a/tools/perf/builtin-diff.c
++++ b/tools/perf/builtin-diff.c
+@@ -1199,7 +1199,7 @@ static int ui_init(void)
+ 		BUG_ON(1);
+ 	}
+ 
+-	perf_hpp__register_sort_field(fmt);
++	perf_hpp__prepend_sort_field(fmt);
+ 	return 0;
+ }
+ 
+diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
+index 37388397b5bc..18cfcdc90356 100644
+--- a/tools/perf/ui/hist.c
++++ b/tools/perf/ui/hist.c
+@@ -521,6 +521,12 @@ void perf_hpp_list__register_sort_field(struct perf_hpp_list *list,
+ 	list_add_tail(&format->sort_list, &list->sorts);
+ }
+ 
++void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list,
++				       struct perf_hpp_fmt *format)
++{
++	list_add(&format->sort_list, &list->sorts);
++}
++
+ void perf_hpp__column_unregister(struct perf_hpp_fmt *format)
+ {
+ 	list_del(&format->list);
+@@ -560,6 +566,10 @@ void perf_hpp__setup_output_field(struct perf_hpp_list *list)
+ 	perf_hpp_list__for_each_sort_list(list, fmt) {
+ 		struct perf_hpp_fmt *pos;
+ 
++		/* skip sort-only fields ("sort_compute" in perf diff) */
++		if (!fmt->entry && !fmt->color)
++			continue;
++
+ 		perf_hpp_list__for_each_format(list, pos) {
+ 			if (fmt_equal(fmt, pos))
+ 				goto next;
+diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
+index 9928fed8bc59..a440a04a29ff 100644
+--- a/tools/perf/util/hist.h
++++ b/tools/perf/util/hist.h
+@@ -282,6 +282,8 @@ void perf_hpp_list__column_register(struct perf_hpp_list *list,
+ 				    struct perf_hpp_fmt *format);
+ void perf_hpp_list__register_sort_field(struct perf_hpp_list *list,
+ 					struct perf_hpp_fmt *format);
++void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list,
++				       struct perf_hpp_fmt *format);
+ 
+ static inline void perf_hpp__column_register(struct perf_hpp_fmt *format)
+ {
+@@ -293,6 +295,11 @@ static inline void perf_hpp__register_sort_field(struct perf_hpp_fmt *format)
+ 	perf_hpp_list__register_sort_field(&perf_hpp_list, format);
+ }
+ 
++static inline void perf_hpp__prepend_sort_field(struct perf_hpp_fmt *format)
++{
++	perf_hpp_list__prepend_sort_field(&perf_hpp_list, format);
++}
++
+ #define perf_hpp_list__for_each_format(_list, format) \
+ 	list_for_each_entry(format, &(_list)->fields, list)
+