[gentoo-commits] proj/linux-patches:3.18 commit in: /

[Anthony G. Basile]

commit:     425d26faaf8ad9dcc54756902763a1388e5985d3
Author:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 28 22:20:55 2015 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Jan 28 22:20:55 2015 +0000
URL:        http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=425d26fa

Linux 3.18.4 patch

---
 0000_README             |    4 +
 1003_linux-3.18.4.patch | 7410 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 7414 insertions(+)

diff --git a/0000_README b/0000_README
index 0df447d..6e4c6e3 100644
--- a/0000_README
+++ b/0000_README
@@ -55,6 +55,10 @@ Patch:  1002_linux-3.18.3.patch
 From:   http://www.kernel.org
 Desc:   Linux 3.18.3
 
+Patch:  1003_linux-3.18.4.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.18.4
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1003_linux-3.18.4.patch b/1003_linux-3.18.4.patch
new file mode 100644
index 0000000..23e256c
--- /dev/null
+++ b/1003_linux-3.18.4.patch
@@ -0,0 +1,7410 @@
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index 479f33204a37..f4c71d4a9ba3 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -1270,6 +1270,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+ 	i8042.notimeout	[HW] Ignore timeout condition signalled by controller
+ 	i8042.reset	[HW] Reset the controller during init and cleanup
+ 	i8042.unlock	[HW] Unlock (ignore) the keylock
++	i8042.kbdreset  [HW] Reset device connected to KBD port
+ 
+ 	i810=		[HW,DRM]
+ 
+diff --git a/Makefile b/Makefile
+index 91cfe8d5ee06..4e9328491c1e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 18
+-SUBLEVEL = 3
++SUBLEVEL = 4
+ EXTRAVERSION =
+ NAME = Diseased Newt
+ 
+diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts
+index cfaedd9c61c9..1c169dc74ad1 100644
+--- a/arch/arc/boot/dts/nsimosci.dts
++++ b/arch/arc/boot/dts/nsimosci.dts
+@@ -20,7 +20,7 @@
+ 		/* this is for console on PGU */
+ 		/* bootargs = "console=tty0 consoleblank=0"; */
+ 		/* this is for console on serial */
+-		bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug";
++		bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug";
+ 	};
+ 
+ 	aliases {
+@@ -41,9 +41,9 @@
+ 			#interrupt-cells = <1>;
+ 		};
+ 
+-		uart0: serial@c0000000 {
++		uart0: serial@f0000000 {
+ 			compatible = "ns8250";
+-			reg = <0xc0000000 0x2000>;
++			reg = <0xf0000000 0x2000>;
+ 			interrupts = <11>;
+ 			clock-frequency = <3686400>;
+ 			baud = <115200>;
+@@ -52,21 +52,21 @@
+ 			no-loopback-test = <1>;
+ 		};
+ 
+-		pgu0: pgu@c9000000 {
++		pgu0: pgu@f9000000 {
+ 			compatible = "snps,arcpgufb";
+-			reg = <0xc9000000 0x400>;
++			reg = <0xf9000000 0x400>;
+ 		};
+ 
+-		ps2: ps2@c9001000 {
++		ps2: ps2@f9001000 {
+ 			compatible = "snps,arc_ps2";
+-			reg = <0xc9000400 0x14>;
++			reg = <0xf9000400 0x14>;
+ 			interrupts = <13>;
+ 			interrupt-names = "arc_ps2_irq";
+ 		};
+ 
+-		eth0: ethernet@c0003000 {
++		eth0: ethernet@f0003000 {
+ 			compatible = "snps,oscilan";
+-			reg = <0xc0003000 0x44>;
++			reg = <0xf0003000 0x44>;
+ 			interrupts = <7>, <8>;
+ 			interrupt-names = "rx", "tx";
+ 		};
+diff --git a/arch/arm/boot/dts/berlin2q-marvell-dmp.dts b/arch/arm/boot/dts/berlin2q-marvell-dmp.dts
+index ea1f99b8eed6..45ac1d04cf42 100644
+--- a/arch/arm/boot/dts/berlin2q-marvell-dmp.dts
++++ b/arch/arm/boot/dts/berlin2q-marvell-dmp.dts
+@@ -30,6 +30,8 @@
+ };
+ 
+ &sdhci2 {
++	broken-cd;
++	bus-width = <8>;
+ 	non-removable;
+ 	status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/berlin2q.dtsi b/arch/arm/boot/dts/berlin2q.dtsi
+index 891d56b03922..b805e19ed390 100644
+--- a/arch/arm/boot/dts/berlin2q.dtsi
++++ b/arch/arm/boot/dts/berlin2q.dtsi
+@@ -83,7 +83,8 @@
+ 			compatible = "mrvl,pxav3-mmc";
+ 			reg = <0xab1000 0x200>;
+ 			interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&chip CLKID_SDIO1XIN>;
++			clocks = <&chip CLKID_NFC_ECC>, <&chip CLKID_NFC>;
++			clock-names = "io", "core";
+ 			status = "disabled";
+ 		};
+ 
+@@ -314,36 +315,6 @@
+ 				interrupt-parent = <&gic>;
+ 				interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
+ 			};
+-
+-			gpio4: gpio@5000 {
+-				compatible = "snps,dw-apb-gpio";
+-				reg = <0x5000 0x400>;
+-				#address-cells = <1>;
+-				#size-cells = <0>;
+-
+-				porte: gpio-port@4 {
+-					compatible = "snps,dw-apb-gpio-port";
+-					gpio-controller;
+-					#gpio-cells = <2>;
+-					snps,nr-gpios = <32>;
+-					reg = <0>;
+-				};
+-			};
+-
+-			gpio5: gpio@c000 {
+-				compatible = "snps,dw-apb-gpio";
+-				reg = <0xc000 0x400>;
+-				#address-cells = <1>;
+-				#size-cells = <0>;
+-
+-				portf: gpio-port@5 {
+-					compatible = "snps,dw-apb-gpio-port";
+-					gpio-controller;
+-					#gpio-cells = <2>;
+-					snps,nr-gpios = <32>;
+-					reg = <0>;
+-				};
+-			};
+ 		};
+ 
+ 		chip: chip-control@ea0000 {
+@@ -372,6 +343,21 @@
+ 			ranges = <0 0xfc0000 0x10000>;
+ 			interrupt-parent = <&sic>;
+ 
++			sm_gpio1: gpio@5000 {
++				compatible = "snps,dw-apb-gpio";
++				reg = <0x5000 0x400>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				portf: gpio-port@5 {
++					compatible = "snps,dw-apb-gpio-port";
++					gpio-controller;
++					#gpio-cells = <2>;
++					snps,nr-gpios = <32>;
++					reg = <0>;
++				};
++			};
++
+ 			i2c2: i2c@7000 {
+ 				compatible = "snps,designware-i2c";
+ 				#address-cells = <1>;
+@@ -422,6 +408,21 @@
+ 				status = "disabled";
+ 			};
+ 
++			sm_gpio0: gpio@c000 {
++				compatible = "snps,dw-apb-gpio";
++				reg = <0xc000 0x400>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				porte: gpio-port@4 {
++					compatible = "snps,dw-apb-gpio-port";
++					gpio-controller;
++					#gpio-cells = <2>;
++					snps,nr-gpios = <32>;
++					reg = <0>;
++				};
++			};
++
+ 			sysctrl: pin-controller@d000 {
+ 				compatible = "marvell,berlin2q-system-ctrl";
+ 				reg = <0xd000 0x100>;
+diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
+index c6ce6258434f..1bd6c79f445e 100644
+--- a/arch/arm/boot/dts/dra7-evm.dts
++++ b/arch/arm/boot/dts/dra7-evm.dts
+@@ -399,23 +399,23 @@
+ 		};
+ 		partition@5 {
+ 			label = "QSPI.u-boot-spl-os";
+-			reg = <0x00140000 0x00010000>;
++			reg = <0x00140000 0x00080000>;
+ 		};
+ 		partition@6 {
+ 			label = "QSPI.u-boot-env";
+-			reg = <0x00150000 0x00010000>;
++			reg = <0x001c0000 0x00010000>;
+ 		};
+ 		partition@7 {
+ 			label = "QSPI.u-boot-env.backup1";
+-			reg = <0x00160000 0x0010000>;
++			reg = <0x001d0000 0x0010000>;
+ 		};
+ 		partition@8 {
+ 			label = "QSPI.kernel";
+-			reg = <0x00170000 0x0800000>;
++			reg = <0x001e0000 0x0800000>;
+ 		};
+ 		partition@9 {
+ 			label = "QSPI.file-system";
+-			reg = <0x00970000 0x01690000>;
++			reg = <0x009e0000 0x01620000>;
+ 		};
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
+index 58d3c3cf2923..d238676a9107 100644
+--- a/arch/arm/boot/dts/imx25.dtsi
++++ b/arch/arm/boot/dts/imx25.dtsi
+@@ -162,7 +162,7 @@
+ 				#size-cells = <0>;
+ 				compatible = "fsl,imx25-cspi", "fsl,imx35-cspi";
+ 				reg = <0x43fa4000 0x4000>;
+-				clocks = <&clks 62>, <&clks 62>;
++				clocks = <&clks 78>, <&clks 78>;
+ 				clock-names = "ipg", "per";
+ 				interrupts = <14>;
+ 				status = "disabled";
+diff --git a/arch/arm/boot/dts/imx51-babbage.dts b/arch/arm/boot/dts/imx51-babbage.dts
+index 56569cecaa78..649befeb2cf9 100644
+--- a/arch/arm/boot/dts/imx51-babbage.dts
++++ b/arch/arm/boot/dts/imx51-babbage.dts
+@@ -127,24 +127,12 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		reg_usbh1_vbus: regulator@0 {
+-			compatible = "regulator-fixed";
+-			pinctrl-names = "default";
+-			pinctrl-0 = <&pinctrl_usbh1reg>;
+-			reg = <0>;
+-			regulator-name = "usbh1_vbus";
+-			regulator-min-microvolt = <5000000>;
+-			regulator-max-microvolt = <5000000>;
+-			gpio = <&gpio2 5 GPIO_ACTIVE_HIGH>;
+-			enable-active-high;
+-		};
+-
+-		reg_usbotg_vbus: regulator@1 {
++		reg_hub_reset: regulator@0 {
+ 			compatible = "regulator-fixed";
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&pinctrl_usbotgreg>;
+-			reg = <1>;
+-			regulator-name = "usbotg_vbus";
++			reg = <0>;
++			regulator-name = "hub_reset";
+ 			regulator-min-microvolt = <5000000>;
+ 			regulator-max-microvolt = <5000000>;
+ 			gpio = <&gpio1 7 GPIO_ACTIVE_HIGH>;
+@@ -176,6 +164,7 @@
+ 			reg = <0>;
+ 			clocks = <&clks IMX5_CLK_DUMMY>;
+ 			clock-names = "main_clk";
++			reset-gpios = <&gpio2 5 GPIO_ACTIVE_LOW>;
+ 		};
+ 	};
+ };
+@@ -419,7 +408,7 @@
+ &usbh1 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&pinctrl_usbh1>;
+-	vbus-supply = <&reg_usbh1_vbus>;
++	vbus-supply = <&reg_hub_reset>;
+ 	fsl,usbphy = <&usbh1phy>;
+ 	phy_type = "ulpi";
+ 	status = "okay";
+@@ -429,7 +418,6 @@
+ 	dr_mode = "otg";
+ 	disable-over-current;
+ 	phy_type = "utmi_wide";
+-	vbus-supply = <&reg_usbotg_vbus>;
+ 	status = "okay";
+ };
+ 
+diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
+index b3f86670d2eb..a0e51bb68b2d 100644
+--- a/arch/arm/configs/omap2plus_defconfig
++++ b/arch/arm/configs/omap2plus_defconfig
+@@ -68,7 +68,7 @@ CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+ CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+ CONFIG_CPU_FREQ_GOV_USERSPACE=y
+ CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+-CONFIG_GENERIC_CPUFREQ_CPU0=y
++CONFIG_CPUFREQ_DT=y
+ # CONFIG_ARM_OMAP2PLUS_CPUFREQ is not set
+ CONFIG_CPU_IDLE=y
+ CONFIG_BINFMT_MISC=y
+diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
+index 4e79da7c5e30..2daef619d053 100644
+--- a/arch/arm/mach-imx/clk-imx6q.c
++++ b/arch/arm/mach-imx/clk-imx6q.c
+@@ -144,8 +144,8 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ 		post_div_table[1].div = 1;
+ 		post_div_table[2].div = 1;
+ 		video_div_table[1].div = 1;
+-		video_div_table[2].div = 1;
+-	};
++		video_div_table[3].div = 1;
++	}
+ 
+ 	clk[IMX6QDL_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 2, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+ 	clk[IMX6QDL_PLL2_BYPASS_SRC] = imx_clk_mux("pll2_bypass_src", base + 0x30, 14, 2, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+diff --git a/arch/arm/mach-imx/clk-imx6sx.c b/arch/arm/mach-imx/clk-imx6sx.c
+index 17354a11356f..5a3e5a159e70 100644
+--- a/arch/arm/mach-imx/clk-imx6sx.c
++++ b/arch/arm/mach-imx/clk-imx6sx.c
+@@ -558,6 +558,9 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node)
+ 	clk_set_parent(clks[IMX6SX_CLK_GPU_CORE_SEL], clks[IMX6SX_CLK_PLL3_PFD0]);
+ 	clk_set_parent(clks[IMX6SX_CLK_GPU_AXI_SEL], clks[IMX6SX_CLK_PLL3_PFD0]);
+ 
++	clk_set_parent(clks[IMX6SX_CLK_QSPI1_SEL], clks[IMX6SX_CLK_PLL2_BUS]);
++	clk_set_parent(clks[IMX6SX_CLK_QSPI2_SEL], clks[IMX6SX_CLK_PLL2_BUS]);
++
+ 	/* Set initial power mode */
+ 	imx6q_set_lpm(WAIT_CLOCKED);
+ }
+diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
+index 377eea849e7b..db57741c9c8a 100644
+--- a/arch/arm/mach-omap2/common.h
++++ b/arch/arm/mach-omap2/common.h
+@@ -249,6 +249,7 @@ extern void omap4_cpu_die(unsigned int cpu);
+ extern struct smp_operations omap4_smp_ops;
+ 
+ extern void omap5_secondary_startup(void);
++extern void omap5_secondary_hyp_startup(void);
+ #endif
+ 
+ #if defined(CONFIG_SMP) && defined(CONFIG_PM)
+diff --git a/arch/arm/mach-omap2/omap-headsmp.S b/arch/arm/mach-omap2/omap-headsmp.S
+index 4993d4bfe9b2..6d1dffca6c7b 100644
+--- a/arch/arm/mach-omap2/omap-headsmp.S
++++ b/arch/arm/mach-omap2/omap-headsmp.S
+@@ -22,6 +22,7 @@
+ 
+ /* Physical address needed since MMU not enabled yet on secondary core */
+ #define AUX_CORE_BOOT0_PA			0x48281800
++#define API_HYP_ENTRY				0x102
+ 
+ /*
+  * OMAP5 specific entry point for secondary CPU to jump from ROM
+@@ -41,6 +42,26 @@ wait:	ldr	r2, =AUX_CORE_BOOT0_PA	@ read from AuxCoreBoot0
+ 	b	secondary_startup
+ ENDPROC(omap5_secondary_startup)
+ /*
++ * Same as omap5_secondary_startup except we call into the ROM to
++ * enable HYP mode first.  This is called instead of
++ * omap5_secondary_startup if the primary CPU was put into HYP mode by
++ * the boot loader.
++ */
++ENTRY(omap5_secondary_hyp_startup)
++wait_2:	ldr	r2, =AUX_CORE_BOOT0_PA	@ read from AuxCoreBoot0
++	ldr	r0, [r2]
++	mov	r0, r0, lsr #5
++	mrc	p15, 0, r4, c0, c0, 5
++	and	r4, r4, #0x0f
++	cmp	r0, r4
++	bne	wait_2
++	ldr	r12, =API_HYP_ENTRY
++	adr	r0, hyp_boot
++	smc	#0
++hyp_boot:
++	b	secondary_startup
++ENDPROC(omap5_secondary_hyp_startup)
++/*
+  * OMAP4 specific entry point for secondary CPU to jump from ROM
+  * code.  This routine also provides a holding flag into which
+  * secondary core is held until we're ready for it to initialise.
+diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
+index 256e84ef0f67..5305ec7341ec 100644
+--- a/arch/arm/mach-omap2/omap-smp.c
++++ b/arch/arm/mach-omap2/omap-smp.c
+@@ -22,6 +22,7 @@
+ #include <linux/irqchip/arm-gic.h>
+ 
+ #include <asm/smp_scu.h>
++#include <asm/virt.h>
+ 
+ #include "omap-secure.h"
+ #include "omap-wakeupgen.h"
+@@ -227,8 +228,16 @@ static void __init omap4_smp_prepare_cpus(unsigned int max_cpus)
+ 	if (omap_secure_apis_support())
+ 		omap_auxcoreboot_addr(virt_to_phys(startup_addr));
+ 	else
+-		writel_relaxed(virt_to_phys(omap5_secondary_startup),
+-			       base + OMAP_AUX_CORE_BOOT_1);
++		/*
++		 * If the boot CPU is in HYP mode then start secondary
++		 * CPU in HYP mode as well.
++		 */
++		if ((__boot_cpu_mode & MODE_MASK) == HYP_MODE)
++			writel_relaxed(virt_to_phys(omap5_secondary_hyp_startup),
++				       base + OMAP_AUX_CORE_BOOT_1);
++		else
++			writel_relaxed(virt_to_phys(omap5_secondary_startup),
++				       base + OMAP_AUX_CORE_BOOT_1);
+ 
+ }
+ 
+diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
+index 4f61148ec168..fb0cb2b817a9 100644
+--- a/arch/arm/mach-omap2/timer.c
++++ b/arch/arm/mach-omap2/timer.c
+@@ -513,11 +513,11 @@ static void __init realtime_counter_init(void)
+ 	rate = clk_get_rate(sys_clk);
+ 	/* Numerator/denumerator values refer TRM Realtime Counter section */
+ 	switch (rate) {
+-	case 1200000:
++	case 12000000:
+ 		num = 64;
+ 		den = 125;
+ 		break;
+-	case 1300000:
++	case 13000000:
+ 		num = 768;
+ 		den = 1625;
+ 		break;
+@@ -529,11 +529,11 @@ static void __init realtime_counter_init(void)
+ 		num = 192;
+ 		den = 625;
+ 		break;
+-	case 2600000:
++	case 26000000:
+ 		num = 384;
+ 		den = 1625;
+ 		break;
+-	case 2700000:
++	case 27000000:
+ 		num = 256;
+ 		den = 1125;
+ 		break;
+diff --git a/arch/arm/mach-shmobile/setup-sh73a0.c b/arch/arm/mach-shmobile/setup-sh73a0.c
+index 328657d011d5..1ba4f6357843 100644
+--- a/arch/arm/mach-shmobile/setup-sh73a0.c
++++ b/arch/arm/mach-shmobile/setup-sh73a0.c
+@@ -598,6 +598,7 @@ static struct platform_device ipmmu_device = {
+ 
+ static struct renesas_intc_irqpin_config irqpin0_platform_data = {
+ 	.irq_base = irq_pin(0), /* IRQ0 -> IRQ7 */
++	.control_parent = true,
+ };
+ 
+ static struct resource irqpin0_resources[] = {
+@@ -659,6 +660,7 @@ static struct platform_device irqpin1_device = {
+ 
+ static struct renesas_intc_irqpin_config irqpin2_platform_data = {
+ 	.irq_base = irq_pin(16), /* IRQ16 -> IRQ23 */
++	.control_parent = true,
+ };
+ 
+ static struct resource irqpin2_resources[] = {
+@@ -689,6 +691,7 @@ static struct platform_device irqpin2_device = {
+ 
+ static struct renesas_intc_irqpin_config irqpin3_platform_data = {
+ 	.irq_base = irq_pin(24), /* IRQ24 -> IRQ31 */
++	.control_parent = true,
+ };
+ 
+ static struct resource irqpin3_resources[] = {
+diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
+index 494297c698ca..fff81f02251c 100644
+--- a/arch/arm64/mm/init.c
++++ b/arch/arm64/mm/init.c
+@@ -333,14 +333,8 @@ static int keep_initrd;
+ 
+ void free_initrd_mem(unsigned long start, unsigned long end)
+ {
+-	if (!keep_initrd) {
+-		if (start == initrd_start)
+-			start = round_down(start, PAGE_SIZE);
+-		if (end == initrd_end)
+-			end = round_up(end, PAGE_SIZE);
+-
++	if (!keep_initrd)
+ 		free_reserved_area((void *)start, (void *)end, 0, "initrd");
+-	}
+ }
+ 
+ static int __init keepinitrd_setup(char *__unused)
+diff --git a/arch/parisc/include/asm/ldcw.h b/arch/parisc/include/asm/ldcw.h
+index d2d11b7055ba..8121aa6db2ff 100644
+--- a/arch/parisc/include/asm/ldcw.h
++++ b/arch/parisc/include/asm/ldcw.h
+@@ -33,11 +33,18 @@
+ 
+ #endif /*!CONFIG_PA20*/
+ 
+-/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*.  */
++/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*.
++   We don't explicitly expose that "*a" may be written as reload
++   fails to find a register in class R1_REGS when "a" needs to be
++   reloaded when generating 64-bit PIC code.  Instead, we clobber
++   memory to indicate to the compiler that the assembly code reads
++   or writes to items other than those listed in the input and output
++   operands.  This may pessimize the code somewhat but __ldcw is
++   usually used within code blocks surrounded by memory barriors.  */
+ #define __ldcw(a) ({						\
+ 	unsigned __ret;						\
+-	__asm__ __volatile__(__LDCW " 0(%2),%0"			\
+-		: "=r" (__ret), "+m" (*(a)) : "r" (a));		\
++	__asm__ __volatile__(__LDCW " 0(%1),%0"			\
++		: "=r" (__ret) : "r" (a) : "memory");		\
+ 	__ret;							\
+ })
+ 
+diff --git a/arch/powerpc/platforms/powernv/opal-wrappers.S b/arch/powerpc/platforms/powernv/opal-wrappers.S
+index feb549aa3eea..b67ea67eb71b 100644
+--- a/arch/powerpc/platforms/powernv/opal-wrappers.S
++++ b/arch/powerpc/platforms/powernv/opal-wrappers.S
+@@ -40,7 +40,6 @@ BEGIN_FTR_SECTION;						\
+ 	b	1f;						\
+ END_FTR_SECTION(0, 1);						\
+ 	ld	r12,opal_tracepoint_refcount@toc(r2);		\
+-	std	r12,32(r1);					\
+ 	cmpdi	r12,0;						\
+ 	bne-	LABEL;						\
+ 1:
+diff --git a/arch/um/Kconfig.common b/arch/um/Kconfig.common
+index 87bc86821bc9..d195a87ca542 100644
+--- a/arch/um/Kconfig.common
++++ b/arch/um/Kconfig.common
+@@ -3,6 +3,7 @@ config UML
+ 	default y
+ 	select HAVE_ARCH_AUDITSYSCALL
+ 	select HAVE_UID16
++	select HAVE_FUTEX_CMPXCHG if FUTEX
+ 	select GENERIC_IRQ_SHOW
+ 	select GENERIC_CPU_DEVICES
+ 	select GENERIC_IO
+diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
+index 5b016e2498f3..3db07f30636f 100644
+--- a/arch/x86/boot/Makefile
++++ b/arch/x86/boot/Makefile
+@@ -51,6 +51,7 @@ targets += cpustr.h
+ $(obj)/cpustr.h: $(obj)/mkcpustr FORCE
+ 	$(call if_changed,cpustr)
+ endif
++clean-files += cpustr.h
+ 
+ # ---------------------------------------------------------------------------
+ 
+diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
+index e27b49d7c922..80091ae54c2b 100644
+--- a/arch/x86/kernel/cpu/Makefile
++++ b/arch/x86/kernel/cpu/Makefile
+@@ -66,3 +66,4 @@ targets += capflags.c
+ $(obj)/capflags.c: $(cpufeature) $(src)/mkcapflags.sh FORCE
+ 	$(call if_changed,mkcapflags)
+ endif
++clean-files += capflags.c
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index 67e6d19ef1be..93d2c04c6f8f 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -1018,6 +1018,15 @@ int setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
+ 	regs->flags &= ~X86_EFLAGS_IF;
+ 	trace_hardirqs_off();
+ 	regs->ip = (unsigned long)(jp->entry);
++
++	/*
++	 * jprobes use jprobe_return() which skips the normal return
++	 * path of the function, and this messes up the accounting of the
++	 * function graph tracer to get messed up.
++	 *
++	 * Pause function graph tracing while performing the jprobe function.
++	 */
++	pause_graph_tracing();
+ 	return 1;
+ }
+ NOKPROBE_SYMBOL(setjmp_pre_handler);
+@@ -1046,24 +1055,25 @@ int longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
+ 	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
+ 	u8 *addr = (u8 *) (regs->ip - 1);
+ 	struct jprobe *jp = container_of(p, struct jprobe, kp);
++	void *saved_sp = kcb->jprobe_saved_sp;
+ 
+ 	if ((addr > (u8 *) jprobe_return) &&
+ 	    (addr < (u8 *) jprobe_return_end)) {
+-		if (stack_addr(regs) != kcb->jprobe_saved_sp) {
++		if (stack_addr(regs) != saved_sp) {
+ 			struct pt_regs *saved_regs = &kcb->jprobe_saved_regs;
+ 			printk(KERN_ERR
+ 			       "current sp %p does not match saved sp %p\n",
+-			       stack_addr(regs), kcb->jprobe_saved_sp);
++			       stack_addr(regs), saved_sp);
+ 			printk(KERN_ERR "Saved registers for jprobe %p\n", jp);
+ 			show_regs(saved_regs);
+ 			printk(KERN_ERR "Current registers\n");
+ 			show_regs(regs);
+ 			BUG();
+ 		}
++		/* It's OK to start function graph tracing again */
++		unpause_graph_tracing();
+ 		*regs = kcb->jprobe_saved_regs;
+-		memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp),
+-		       kcb->jprobes_stack,
+-		       MIN_STACK_SIZE(kcb->jprobe_saved_sp));
++		memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp));
+ 		preempt_enable_no_resched();
+ 		return 1;
+ 	}
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 3e556c68351b..ed7039465f16 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2377,12 +2377,12 @@ static __init void nested_vmx_setup_ctls_msrs(void)
+ 	nested_vmx_secondary_ctls_low = 0;
+ 	nested_vmx_secondary_ctls_high &=
+ 		SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+-		SECONDARY_EXEC_UNRESTRICTED_GUEST |
+ 		SECONDARY_EXEC_WBINVD_EXITING;
+ 
+ 	if (enable_ept) {
+ 		/* nested EPT: emulate EPT also to L1 */
+-		nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT;
++		nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT |
++			SECONDARY_EXEC_UNRESTRICTED_GUEST;
+ 		nested_vmx_ept_caps = VMX_EPT_PAGE_WALK_4_BIT |
+ 			 VMX_EPTP_WB_BIT | VMX_EPT_2MB_PAGE_BIT |
+ 			 VMX_EPT_INVEPT_BIT;
+diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c
+index 531d4269e2e3..bd16d6c370ec 100644
+--- a/arch/x86/um/sys_call_table_32.c
++++ b/arch/x86/um/sys_call_table_32.c
+@@ -34,7 +34,7 @@ typedef asmlinkage void (*sys_call_ptr_t)(void);
+ 
+ extern asmlinkage void sys_ni_syscall(void);
+ 
+-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
++const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
+ 	/*
+ 	 * Smells like a compiler bug -- it doesn't work
+ 	 * when the & below is removed.
+diff --git a/arch/x86/um/sys_call_table_64.c b/arch/x86/um/sys_call_table_64.c
+index f2f0723070ca..95783087f0d3 100644
+--- a/arch/x86/um/sys_call_table_64.c
++++ b/arch/x86/um/sys_call_table_64.c
+@@ -46,7 +46,7 @@ typedef void (*sys_call_ptr_t)(void);
+ 
+ extern void sys_ni_syscall(void);
+ 
+-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
++const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
+ 	/*
+ 	 * Smells like a compiler bug -- it doesn't work
+ 	 * when the & below is removed.
+diff --git a/drivers/bus/omap_l3_noc.c b/drivers/bus/omap_l3_noc.c
+index 531ae591783b..17d86595951c 100644
+--- a/drivers/bus/omap_l3_noc.c
++++ b/drivers/bus/omap_l3_noc.c
+@@ -222,10 +222,14 @@ static irqreturn_t l3_interrupt_handler(int irq, void *_l3)
+ 			}
+ 
+ 			/* Error found so break the for loop */
+-			break;
++			return IRQ_HANDLED;
+ 		}
+ 	}
+-	return IRQ_HANDLED;
++
++	dev_err(l3->dev, "L3 %s IRQ not handled!!\n",
++		inttype ? "debug" : "application");
++
++	return IRQ_NONE;
+ }
+ 
+ static const struct of_device_id l3_noc_match[] = {
+@@ -296,11 +300,66 @@ static int omap_l3_probe(struct platform_device *pdev)
+ 	return ret;
+ }
+ 
++#ifdef	CONFIG_PM
++
++/**
++ * l3_resume_noirq() - resume function for l3_noc
++ * @dev:	pointer to l3_noc device structure
++ *
++ * We only have the resume handler only since we
++ * have already maintained the delta register
++ * configuration as part of configuring the system
++ */
++static int l3_resume_noirq(struct device *dev)
++{
++	struct omap_l3 *l3 = dev_get_drvdata(dev);
++	int i;
++	struct l3_flagmux_data *flag_mux;
++	void __iomem *base, *mask_regx = NULL;
++	u32 mask_val;
++
++	for (i = 0; i < l3->num_modules; i++) {
++		base = l3->l3_base[i];
++		flag_mux = l3->l3_flagmux[i];
++		if (!flag_mux->mask_app_bits && !flag_mux->mask_dbg_bits)
++			continue;
++
++		mask_regx = base + flag_mux->offset + L3_FLAGMUX_MASK0 +
++			   (L3_APPLICATION_ERROR << 3);
++		mask_val = readl_relaxed(mask_regx);
++		mask_val &= ~(flag_mux->mask_app_bits);
++
++		writel_relaxed(mask_val, mask_regx);
++		mask_regx = base + flag_mux->offset + L3_FLAGMUX_MASK0 +
++			   (L3_DEBUG_ERROR << 3);
++		mask_val = readl_relaxed(mask_regx);
++		mask_val &= ~(flag_mux->mask_dbg_bits);
++
++		writel_relaxed(mask_val, mask_regx);
++	}
++
++	/* Dummy read to force OCP barrier */
++	if (mask_regx)
++		(void)readl(mask_regx);
++
++	return 0;
++}
++
++static const struct dev_pm_ops l3_dev_pm_ops = {
++	.resume_noirq		= l3_resume_noirq,
++};
++
++#define L3_DEV_PM_OPS (&l3_dev_pm_ops)
++#else
++#define L3_DEV_PM_OPS NULL
++#endif
++
+ static struct platform_driver omap_l3_driver = {
+ 	.probe		= omap_l3_probe,
+ 	.driver		= {
+ 		.name		= "omap_l3_noc",
+ 		.owner		= THIS_MODULE,
++		.pm		= L3_DEV_PM_OPS,
+ 		.of_match_table = of_match_ptr(l3_noc_match),
+ 	},
+ };
+diff --git a/drivers/clk/at91/clk-slow.c b/drivers/clk/at91/clk-slow.c
+index 32f7c1b36204..2f13bd5246b5 100644
+--- a/drivers/clk/at91/clk-slow.c
++++ b/drivers/clk/at91/clk-slow.c
+@@ -70,6 +70,7 @@ struct clk_sam9x5_slow {
+ 
+ #define to_clk_sam9x5_slow(hw) container_of(hw, struct clk_sam9x5_slow, hw)
+ 
++static struct clk *slow_clk;
+ 
+ static int clk_slow_osc_prepare(struct clk_hw *hw)
+ {
+@@ -357,6 +358,8 @@ at91_clk_register_sam9x5_slow(void __iomem *sckcr,
+ 	clk = clk_register(NULL, &slowck->hw);
+ 	if (IS_ERR(clk))
+ 		kfree(slowck);
++	else
++		slow_clk = clk;
+ 
+ 	return clk;
+ }
+@@ -433,6 +436,8 @@ at91_clk_register_sam9260_slow(struct at91_pmc *pmc,
+ 	clk = clk_register(NULL, &slowck->hw);
+ 	if (IS_ERR(clk))
+ 		kfree(slowck);
++	else
++		slow_clk = clk;
+ 
+ 	return clk;
+ }
+@@ -465,3 +470,25 @@ void __init of_at91sam9260_clk_slow_setup(struct device_node *np,
+ 
+ 	of_clk_add_provider(np, of_clk_src_simple_get, clk);
+ }
++
++/*
++ * FIXME: All slow clk users are not properly claiming it (get + prepare +
++ * enable) before using it.
++ * If all users properly claiming this clock decide that they don't need it
++ * anymore (or are removed), it is disabled while faulty users are still
++ * requiring it, and the system hangs.
++ * Prevent this clock from being disabled until all users are properly
++ * requesting it.
++ * Once this is done we should remove this function and the slow_clk variable.
++ */
++static int __init of_at91_clk_slow_retain(void)
++{
++	if (!slow_clk)
++		return 0;
++
++	__clk_get(slow_clk);
++	clk_prepare_enable(slow_clk);
++
++	return 0;
++}
++arch_initcall(of_at91_clk_slow_retain);
+diff --git a/drivers/clk/berlin/bg2q.c b/drivers/clk/berlin/bg2q.c
+index 21784e4eb3f0..440ef81ab15c 100644
+--- a/drivers/clk/berlin/bg2q.c
++++ b/drivers/clk/berlin/bg2q.c
+@@ -285,7 +285,6 @@ static const struct berlin2_gate_data bg2q_gates[] __initconst = {
+ 	{ "pbridge",	"perif",	15, CLK_IGNORE_UNUSED },
+ 	{ "sdio",	"perif",	16, CLK_IGNORE_UNUSED },
+ 	{ "nfc",	"perif",	18 },
+-	{ "smemc",	"perif",	19 },
+ 	{ "pcie",	"perif",	22 },
+ };
+ 
+diff --git a/drivers/clk/clk-ppc-corenet.c b/drivers/clk/clk-ppc-corenet.c
+index 8e58edfeeb37..8b284be4efa4 100644
+--- a/drivers/clk/clk-ppc-corenet.c
++++ b/drivers/clk/clk-ppc-corenet.c
+@@ -291,7 +291,7 @@ static const struct of_device_id ppc_clk_ids[] __initconst = {
+ 	{}
+ };
+ 
+-static struct platform_driver ppc_corenet_clk_driver __initdata = {
++static struct platform_driver ppc_corenet_clk_driver = {
+ 	.driver = {
+ 		.name = "ppc_corenet_clock",
+ 		.owner = THIS_MODULE,
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 4896ae9e23da..26bed0889e97 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -240,7 +240,6 @@ static const struct file_operations clk_dump_fops = {
+ 	.release	= single_release,
+ };
+ 
+-/* caller must hold prepare_lock */
+ static int clk_debug_create_one(struct clk *clk, struct dentry *pdentry)
+ {
+ 	struct dentry *d;
+@@ -1944,7 +1943,6 @@ int __clk_init(struct device *dev, struct clk *clk)
+ 	else
+ 		clk->rate = 0;
+ 
+-	clk_debug_register(clk);
+ 	/*
+ 	 * walk the list of orphan clocks and reparent any that are children of
+ 	 * this clock
+@@ -1979,6 +1977,9 @@ int __clk_init(struct device *dev, struct clk *clk)
+ out:
+ 	clk_prepare_unlock();
+ 
++	if (!ret)
++		clk_debug_register(clk);
++
+ 	return ret;
+ }
+ 
+@@ -2273,14 +2274,17 @@ int __clk_get(struct clk *clk)
+ 
+ void __clk_put(struct clk *clk)
+ {
++	struct module *owner;
++
+ 	if (!clk || WARN_ON_ONCE(IS_ERR(clk)))
+ 		return;
+ 
+ 	clk_prepare_lock();
++	owner = clk->owner;
+ 	kref_put(&clk->ref, __clk_release);
+ 	clk_prepare_unlock();
+ 
+-	module_put(clk->owner);
++	module_put(owner);
+ }
+ 
+ /***        clk rate change notifiers        ***/
+diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
+index beed49c79126..8088b384ce6e 100644
+--- a/drivers/clk/rockchip/clk-rk3188.c
++++ b/drivers/clk/rockchip/clk-rk3188.c
+@@ -210,6 +210,17 @@ PNAME(mux_sclk_hsadc_p)		= { "hsadc_src", "hsadc_frac", "ext_hsadc" };
+ PNAME(mux_mac_p)		= { "gpll", "dpll" };
+ PNAME(mux_sclk_macref_p)	= { "mac_src", "ext_rmii" };
+ 
++static struct rockchip_pll_clock rk3066_pll_clks[] __initdata = {
++	[apll] = PLL(pll_rk3066, PLL_APLL, "apll", mux_pll_p, 0, RK2928_PLL_CON(0),
++		     RK2928_MODE_CON, 0, 5, rk3188_pll_rates),
++	[dpll] = PLL(pll_rk3066, PLL_DPLL, "dpll", mux_pll_p, 0, RK2928_PLL_CON(4),
++		     RK2928_MODE_CON, 4, 4, NULL),
++	[cpll] = PLL(pll_rk3066, PLL_CPLL, "cpll", mux_pll_p, 0, RK2928_PLL_CON(8),
++		     RK2928_MODE_CON, 8, 6, rk3188_pll_rates),
++	[gpll] = PLL(pll_rk3066, PLL_GPLL, "gpll", mux_pll_p, 0, RK2928_PLL_CON(12),
++		     RK2928_MODE_CON, 12, 7, rk3188_pll_rates),
++};
++
+ static struct rockchip_pll_clock rk3188_pll_clks[] __initdata = {
+ 	[apll] = PLL(pll_rk3066, PLL_APLL, "apll", mux_pll_p, 0, RK2928_PLL_CON(0),
+ 		     RK2928_MODE_CON, 0, 6, rk3188_pll_rates),
+@@ -742,8 +753,8 @@ static void __init rk3188_common_clk_init(struct device_node *np)
+ static void __init rk3066a_clk_init(struct device_node *np)
+ {
+ 	rk3188_common_clk_init(np);
+-	rockchip_clk_register_plls(rk3188_pll_clks,
+-				   ARRAY_SIZE(rk3188_pll_clks),
++	rockchip_clk_register_plls(rk3066_pll_clks,
++				   ARRAY_SIZE(rk3066_pll_clks),
+ 				   RK3066_GRF_SOC_STATUS);
+ 	rockchip_clk_register_branches(rk3066a_clk_branches,
+ 				  ARRAY_SIZE(rk3066a_clk_branches));
+diff --git a/drivers/clk/rockchip/clk-rk3288.c b/drivers/clk/rockchip/clk-rk3288.c
+index 23278291da44..6dbc64759a58 100644
+--- a/drivers/clk/rockchip/clk-rk3288.c
++++ b/drivers/clk/rockchip/clk-rk3288.c
+@@ -142,20 +142,20 @@ struct rockchip_pll_rate_table rk3288_pll_rates[] = {
+ 	}
+ 
+ static struct rockchip_cpuclk_rate_table rk3288_cpuclk_rates[] __initdata = {
+-	RK3288_CPUCLK_RATE(1800000000, 2, 4, 2, 4, 4),
+-	RK3288_CPUCLK_RATE(1704000000, 2, 4, 2, 4, 4),
+-	RK3288_CPUCLK_RATE(1608000000, 2, 4, 2, 4, 4),
+-	RK3288_CPUCLK_RATE(1512000000, 2, 4, 2, 4, 4),
+-	RK3288_CPUCLK_RATE(1416000000, 2, 4, 2, 4, 4),
+-	RK3288_CPUCLK_RATE(1200000000, 2, 4, 2, 4, 4),
+-	RK3288_CPUCLK_RATE(1008000000, 2, 4, 2, 4, 4),
+-	RK3288_CPUCLK_RATE( 816000000, 2, 4, 2, 4, 4),
+-	RK3288_CPUCLK_RATE( 696000000, 2, 4, 2, 4, 4),
+-	RK3288_CPUCLK_RATE( 600000000, 2, 4, 2, 4, 4),
+-	RK3288_CPUCLK_RATE( 408000000, 2, 4, 2, 4, 4),
+-	RK3288_CPUCLK_RATE( 312000000, 2, 4, 2, 4, 4),
+-	RK3288_CPUCLK_RATE( 216000000, 2, 4, 2, 4, 4),
+-	RK3288_CPUCLK_RATE( 126000000, 2, 4, 2, 4, 4),
++	RK3288_CPUCLK_RATE(1800000000, 1, 3, 1, 3, 3),
++	RK3288_CPUCLK_RATE(1704000000, 1, 3, 1, 3, 3),
++	RK3288_CPUCLK_RATE(1608000000, 1, 3, 1, 3, 3),
++	RK3288_CPUCLK_RATE(1512000000, 1, 3, 1, 3, 3),
++	RK3288_CPUCLK_RATE(1416000000, 1, 3, 1, 3, 3),
++	RK3288_CPUCLK_RATE(1200000000, 1, 3, 1, 3, 3),
++	RK3288_CPUCLK_RATE(1008000000, 1, 3, 1, 3, 3),
++	RK3288_CPUCLK_RATE( 816000000, 1, 3, 1, 3, 3),
++	RK3288_CPUCLK_RATE( 696000000, 1, 3, 1, 3, 3),
++	RK3288_CPUCLK_RATE( 600000000, 1, 3, 1, 3, 3),
++	RK3288_CPUCLK_RATE( 408000000, 1, 3, 1, 3, 3),
++	RK3288_CPUCLK_RATE( 312000000, 1, 3, 1, 3, 3),
++	RK3288_CPUCLK_RATE( 216000000, 1, 3, 1, 3, 3),
++	RK3288_CPUCLK_RATE( 126000000, 1, 3, 1, 3, 3),
+ };
+ 
+ static const struct rockchip_cpuclk_reg_data rk3288_cpuclk_data = {
+diff --git a/drivers/clk/samsung/clk-exynos-audss.c b/drivers/clk/samsung/clk-exynos-audss.c
+index 13eae14c2cc2..b50469faf70c 100644
+--- a/drivers/clk/samsung/clk-exynos-audss.c
++++ b/drivers/clk/samsung/clk-exynos-audss.c
+@@ -210,6 +210,10 @@ static int exynos_audss_clk_remove(struct platform_device *pdev)
+ {
+ 	int i;
+ 
++#ifdef CONFIG_PM_SLEEP
++	unregister_syscore_ops(&exynos_audss_clk_syscore_ops);
++#endif
++
+ 	of_clk_del_provider(pdev->dev.of_node);
+ 
+ 	for (i = 0; i < clk_data.clk_num; i++) {
+diff --git a/drivers/gpio/gpio-crystalcove.c b/drivers/gpio/gpio-crystalcove.c
+index bbfe7f508502..a7cf0c193ba8 100644
+--- a/drivers/gpio/gpio-crystalcove.c
++++ b/drivers/gpio/gpio-crystalcove.c
+@@ -272,7 +272,7 @@ static irqreturn_t crystalcove_gpio_irq_handler(int irq, void *data)
+ 	for (gpio = 0; gpio < CRYSTALCOVE_GPIO_NUM; gpio++) {
+ 		if (pending & BIT(gpio)) {
+ 			virq = irq_find_mapping(cg->chip.irqdomain, gpio);
+-			generic_handle_irq(virq);
++			handle_nested_irq(virq);
+ 		}
+ 	}
+ 
+diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
+index 604dbe60bdee..08261f2b3a82 100644
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -45,8 +45,14 @@ static int of_gpiochip_find_and_xlate(struct gpio_chip *gc, void *data)
+ 		return false;
+ 
+ 	ret = gc->of_xlate(gc, &gg_data->gpiospec, gg_data->flags);
+-	if (ret < 0)
+-		return false;
++	if (ret < 0) {
++		/* We've found the gpio chip, but the translation failed.
++		 * Return true to stop looking and return the translation
++		 * error via out_gpio
++		 */
++		gg_data->out_gpio = ERR_PTR(ret);
++		return true;
++	 }
+ 
+ 	gg_data->out_gpio = gpiochip_get_desc(gc, ret);
+ 	return true;
+diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
+index 5f2150b619a7..0d21396f961d 100644
+--- a/drivers/gpio/gpiolib-sysfs.c
++++ b/drivers/gpio/gpiolib-sysfs.c
+@@ -128,7 +128,7 @@ static ssize_t gpio_value_store(struct device *dev,
+ 	return status;
+ }
+ 
+-static const DEVICE_ATTR(value, 0644,
++static DEVICE_ATTR(value, 0644,
+ 		gpio_value_show, gpio_value_store);
+ 
+ static irqreturn_t gpio_sysfs_irq(int irq, void *priv)
+@@ -353,18 +353,15 @@ static ssize_t gpio_active_low_store(struct device *dev,
+ 	return status ? : size;
+ }
+ 
+-static const DEVICE_ATTR(active_low, 0644,
++static DEVICE_ATTR(active_low, 0644,
+ 		gpio_active_low_show, gpio_active_low_store);
+ 
+-static const struct attribute *gpio_attrs[] = {
++static struct attribute *gpio_attrs[] = {
+ 	&dev_attr_value.attr,
+ 	&dev_attr_active_low.attr,
+ 	NULL,
+ };
+-
+-static const struct attribute_group gpio_attr_group = {
+-	.attrs = (struct attribute **) gpio_attrs,
+-};
++ATTRIBUTE_GROUPS(gpio);
+ 
+ /*
+  * /sys/class/gpio/gpiochipN/
+@@ -400,16 +397,13 @@ static ssize_t chip_ngpio_show(struct device *dev,
+ }
+ static DEVICE_ATTR(ngpio, 0444, chip_ngpio_show, NULL);
+ 
+-static const struct attribute *gpiochip_attrs[] = {
++static struct attribute *gpiochip_attrs[] = {
+ 	&dev_attr_base.attr,
+ 	&dev_attr_label.attr,
+ 	&dev_attr_ngpio.attr,
+ 	NULL,
+ };
+-
+-static const struct attribute_group gpiochip_attr_group = {
+-	.attrs = (struct attribute **) gpiochip_attrs,
+-};
++ATTRIBUTE_GROUPS(gpiochip);
+ 
+ /*
+  * /sys/class/gpio/export ... write-only
+@@ -564,18 +558,15 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
+ 	if (desc->chip->names && desc->chip->names[offset])
+ 		ioname = desc->chip->names[offset];
+ 
+-	dev = device_create(&gpio_class, desc->chip->dev, MKDEV(0, 0),
+-			    desc, ioname ? ioname : "gpio%u",
+-			    desc_to_gpio(desc));
++	dev = device_create_with_groups(&gpio_class, desc->chip->dev,
++					MKDEV(0, 0), desc, gpio_groups,
++					ioname ? ioname : "gpio%u",
++					desc_to_gpio(desc));
+ 	if (IS_ERR(dev)) {
+ 		status = PTR_ERR(dev);
+ 		goto fail_unlock;
+ 	}
+ 
+-	status = sysfs_create_group(&dev->kobj, &gpio_attr_group);
+-	if (status)
+-		goto fail_unregister_device;
+-
+ 	if (direction_may_change) {
+ 		status = device_create_file(dev, &dev_attr_direction);
+ 		if (status)
+@@ -586,13 +577,15 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
+ 				       !test_bit(FLAG_IS_OUT, &desc->flags))) {
+ 		status = device_create_file(dev, &dev_attr_edge);
+ 		if (status)
+-			goto fail_unregister_device;
++			goto fail_remove_attr_direction;
+ 	}
+ 
+ 	set_bit(FLAG_EXPORT, &desc->flags);
+ 	mutex_unlock(&sysfs_lock);
+ 	return 0;
+ 
++fail_remove_attr_direction:
++	device_remove_file(dev, &dev_attr_direction);
+ fail_unregister_device:
+ 	device_unregister(dev);
+ fail_unlock:
+@@ -726,6 +719,8 @@ void gpiod_unexport(struct gpio_desc *desc)
+ 	mutex_unlock(&sysfs_lock);
+ 
+ 	if (dev) {
++		device_remove_file(dev, &dev_attr_edge);
++		device_remove_file(dev, &dev_attr_direction);
+ 		device_unregister(dev);
+ 		put_device(dev);
+ 	}
+@@ -750,13 +745,13 @@ int gpiochip_export(struct gpio_chip *chip)
+ 
+ 	/* use chip->base for the ID; it's already known to be unique */
+ 	mutex_lock(&sysfs_lock);
+-	dev = device_create(&gpio_class, chip->dev, MKDEV(0, 0), chip,
+-				"gpiochip%d", chip->base);
+-	if (!IS_ERR(dev)) {
+-		status = sysfs_create_group(&dev->kobj,
+-				&gpiochip_attr_group);
+-	} else
++	dev = device_create_with_groups(&gpio_class, chip->dev, MKDEV(0, 0),
++					chip, gpiochip_groups,
++					"gpiochip%d", chip->base);
++	if (IS_ERR(dev))
+ 		status = PTR_ERR(dev);
++	else
++		status = 0;
+ 	chip->exported = (status == 0);
+ 	mutex_unlock(&sysfs_lock);
+ 
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index e8e98ca25ec7..c81bda0ec2cf 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -268,6 +268,9 @@ int gpiochip_add(struct gpio_chip *chip)
+ 
+ 	spin_unlock_irqrestore(&gpio_lock, flags);
+ 
++	if (status)
++		goto fail;
++
+ #ifdef CONFIG_PINCTRL
+ 	INIT_LIST_HEAD(&chip->pin_ranges);
+ #endif
+@@ -275,12 +278,12 @@ int gpiochip_add(struct gpio_chip *chip)
+ 	of_gpiochip_add(chip);
+ 	acpi_gpiochip_add(chip);
+ 
+-	if (status)
+-		goto fail;
+-
+ 	status = gpiochip_export(chip);
+-	if (status)
++	if (status) {
++		acpi_gpiochip_remove(chip);
++		of_gpiochip_remove(chip);
+ 		goto fail;
++	}
+ 
+ 	pr_debug("%s: registered GPIOs %d to %d on device: %s\n", __func__,
+ 		chip->base, chip->base + chip->ngpio - 1,
+@@ -313,14 +316,13 @@ void gpiochip_remove(struct gpio_chip *chip)
+ 	unsigned long	flags;
+ 	unsigned	id;
+ 
+-	acpi_gpiochip_remove(chip);
+-
+-	spin_lock_irqsave(&gpio_lock, flags);
+-
+ 	gpiochip_irqchip_remove(chip);
++
++	acpi_gpiochip_remove(chip);
+ 	gpiochip_remove_pin_ranges(chip);
+ 	of_gpiochip_remove(chip);
+ 
++	spin_lock_irqsave(&gpio_lock, flags);
+ 	for (id = 0; id < chip->ngpio; id++) {
+ 		if (test_bit(FLAG_REQUESTED, &chip->desc[id].flags))
+ 			dev_crit(chip->dev, "REMOVING GPIOCHIP WITH GPIOS STILL REQUESTED\n");
+diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
+index 08e33b8b13a4..9f59c9027ebe 100644
+--- a/drivers/gpu/drm/drm_dp_helper.c
++++ b/drivers/gpu/drm/drm_dp_helper.c
+@@ -378,10 +378,11 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request,
+ 
+ 	/*
+ 	 * The specification doesn't give any recommendation on how often to
+-	 * retry native transactions, so retry 7 times like for I2C-over-AUX
+-	 * transactions.
++	 * retry native transactions. We used to retry 7 times like for
++	 * aux i2c transactions but real world devices this wasn't
++	 * sufficient, bump to 32 which makes Dell 4k monitors happier.
+ 	 */
+-	for (retry = 0; retry < 7; retry++) {
++	for (retry = 0; retry < 32; retry++) {
+ 
+ 		mutex_lock(&aux->hw_mutex);
+ 		err = aux->transfer(aux, &msg);
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 070f913d2dba..f50d884b81cf 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -839,6 +839,8 @@ static void drm_dp_put_mst_branch_device(struct drm_dp_mst_branch *mstb)
+ 
+ static void drm_dp_port_teardown_pdt(struct drm_dp_mst_port *port, int old_pdt)
+ {
++	struct drm_dp_mst_branch *mstb;
++
+ 	switch (old_pdt) {
+ 	case DP_PEER_DEVICE_DP_LEGACY_CONV:
+ 	case DP_PEER_DEVICE_SST_SINK:
+@@ -846,8 +848,9 @@ static void drm_dp_port_teardown_pdt(struct drm_dp_mst_port *port, int old_pdt)
+ 		drm_dp_mst_unregister_i2c_bus(&port->aux);
+ 		break;
+ 	case DP_PEER_DEVICE_MST_BRANCHING:
+-		drm_dp_put_mst_branch_device(port->mstb);
++		mstb = port->mstb;
+ 		port->mstb = NULL;
++		drm_dp_put_mst_branch_device(mstb);
+ 		break;
+ 	}
+ }
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 0c0c39bac23d..ef757f712a3d 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -347,9 +347,18 @@ bool drm_fb_helper_restore_fbdev_mode_unlocked(struct drm_fb_helper *fb_helper)
+ {
+ 	struct drm_device *dev = fb_helper->dev;
+ 	bool ret;
++	bool do_delayed = false;
++
+ 	drm_modeset_lock_all(dev);
+ 	ret = restore_fbdev_mode(fb_helper);
++
++	do_delayed = fb_helper->delayed_hotplug;
++	if (do_delayed)
++		fb_helper->delayed_hotplug = false;
+ 	drm_modeset_unlock_all(dev);
++
++	if (do_delayed)
++		drm_fb_helper_hotplug_event(fb_helper);
+ 	return ret;
+ }
+ EXPORT_SYMBOL(drm_fb_helper_restore_fbdev_mode_unlocked);
+@@ -888,10 +897,6 @@ int drm_fb_helper_set_par(struct fb_info *info)
+ 
+ 	drm_fb_helper_restore_fbdev_mode_unlocked(fb_helper);
+ 
+-	if (fb_helper->delayed_hotplug) {
+-		fb_helper->delayed_hotplug = false;
+-		drm_fb_helper_hotplug_event(fb_helper);
+-	}
+ 	return 0;
+ }
+ EXPORT_SYMBOL(drm_fb_helper_set_par);
+diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
+index 5ef03c216a27..c4edea907f8f 100644
+--- a/drivers/gpu/drm/drm_irq.c
++++ b/drivers/gpu/drm/drm_irq.c
+@@ -1029,7 +1029,8 @@ void drm_vblank_put(struct drm_device *dev, int crtc)
+ {
+ 	struct drm_vblank_crtc *vblank = &dev->vblank[crtc];
+ 
+-	BUG_ON(atomic_read(&vblank->refcount) == 0);
++	if (WARN_ON(atomic_read(&vblank->refcount) == 0))
++		return;
+ 
+ 	if (WARN_ON(crtc >= dev->num_crtcs))
+ 		return;
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index 2318b4c7a8f8..925697320949 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -692,11 +692,12 @@ static int __i915_drm_thaw(struct drm_device *dev, bool restore_gtt_mappings)
+ 			spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
+ 		}
+ 
+-		intel_dp_mst_resume(dev);
+ 		drm_modeset_lock_all(dev);
+ 		intel_modeset_setup_hw_state(dev, true);
+ 		drm_modeset_unlock_all(dev);
+ 
++		intel_dp_mst_resume(dev);
++
+ 		/*
+ 		 * ... but also need to make sure that hotplug processing
+ 		 * doesn't cause havoc. Like in the driver load code we don't
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 16a6f6d187a1..346aee828dc3 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -877,6 +877,7 @@ struct i915_suspend_saved_registers {
+ 	u32 savePIPEB_LINK_N1;
+ 	u32 saveMCHBAR_RENDER_STANDBY;
+ 	u32 savePCH_PORT_HOTPLUG;
++	u16 saveGCDGMBUS;
+ };
+ 
+ struct vlv_s0ix_state {
+@@ -1665,8 +1666,6 @@ struct drm_i915_private {
+ 	 */
+ 	struct workqueue_struct *dp_wq;
+ 
+-	uint32_t bios_vgacntr;
+-
+ 	/* Old dri1 support infrastructure, beware the dragons ya fools entering
+ 	 * here! */
+ 	struct i915_dri1_state dri1;
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 28f91df2604d..2de5f5f4ba45 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -4193,7 +4193,7 @@ i915_gem_pin_ioctl(struct drm_device *dev, void *data,
+ 	struct drm_i915_gem_object *obj;
+ 	int ret;
+ 
+-	if (INTEL_INFO(dev)->gen >= 6)
++	if (drm_core_check_feature(dev, DRIVER_MODESET))
+ 		return -ENODEV;
+ 
+ 	ret = i915_mutex_lock_interruptible(dev);
+@@ -4249,6 +4249,9 @@ i915_gem_unpin_ioctl(struct drm_device *dev, void *data,
+ 	struct drm_i915_gem_object *obj;
+ 	int ret;
+ 
++	if (drm_core_check_feature(dev, DRIVER_MODESET))
++		return -ENODEV;
++
+ 	ret = i915_mutex_lock_interruptible(dev);
+ 	if (ret)
+ 		return ret;
+diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
+index a5221d8f1580..c12f087d7a14 100644
+--- a/drivers/gpu/drm/i915/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/i915_gem_context.c
+@@ -468,7 +468,12 @@ mi_set_context(struct intel_engine_cs *ring,
+ 	       u32 hw_flags)
+ {
+ 	u32 flags = hw_flags | MI_MM_SPACE_GTT;
+-	int ret;
++	const int num_rings =
++		/* Use an extended w/a on ivb+ if signalling from other rings */
++		i915_semaphore_is_enabled(ring->dev) ?
++		hweight32(INTEL_INFO(ring->dev)->ring_mask) - 1 :
++		0;
++	int len, i, ret;
+ 
+ 	/* w/a: If Flush TLB Invalidation Mode is enabled, driver must do a TLB
+ 	 * invalidation prior to MI_SET_CONTEXT. On GEN6 we don't set the value
+@@ -485,15 +490,31 @@ mi_set_context(struct intel_engine_cs *ring,
+ 	if (!IS_HASWELL(ring->dev) && INTEL_INFO(ring->dev)->gen < 8)
+ 		flags |= (MI_SAVE_EXT_STATE_EN | MI_RESTORE_EXT_STATE_EN);
+ 
+-	ret = intel_ring_begin(ring, 6);
++
++	len = 4;
++	if (INTEL_INFO(ring->dev)->gen >= 7)
++		len += 2 + (num_rings ? 4*num_rings + 2 : 0);
++
++	ret = intel_ring_begin(ring, len);
+ 	if (ret)
+ 		return ret;
+ 
+ 	/* WaProgramMiArbOnOffAroundMiSetContext:ivb,vlv,hsw,bdw,chv */
+-	if (INTEL_INFO(ring->dev)->gen >= 7)
++	if (INTEL_INFO(ring->dev)->gen >= 7) {
+ 		intel_ring_emit(ring, MI_ARB_ON_OFF | MI_ARB_DISABLE);
+-	else
+-		intel_ring_emit(ring, MI_NOOP);
++		if (num_rings) {
++			struct intel_engine_cs *signaller;
++
++			intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(num_rings));
++			for_each_ring(signaller, to_i915(ring->dev), i) {
++				if (signaller == ring)
++					continue;
++
++				intel_ring_emit(ring, RING_PSMI_CTL(signaller->mmio_base));
++				intel_ring_emit(ring, _MASKED_BIT_ENABLE(GEN6_PSMI_SLEEP_MSG_DISABLE));
++			}
++		}
++	}
+ 
+ 	intel_ring_emit(ring, MI_NOOP);
+ 	intel_ring_emit(ring, MI_SET_CONTEXT);
+@@ -505,10 +526,21 @@ mi_set_context(struct intel_engine_cs *ring,
+ 	 */
+ 	intel_ring_emit(ring, MI_NOOP);
+ 
+-	if (INTEL_INFO(ring->dev)->gen >= 7)
++	if (INTEL_INFO(ring->dev)->gen >= 7) {
++		if (num_rings) {
++			struct intel_engine_cs *signaller;
++
++			intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(num_rings));
++			for_each_ring(signaller, to_i915(ring->dev), i) {
++				if (signaller == ring)
++					continue;
++
++				intel_ring_emit(ring, RING_PSMI_CTL(signaller->mmio_base));
++				intel_ring_emit(ring, _MASKED_BIT_DISABLE(GEN6_PSMI_SLEEP_MSG_DISABLE));
++			}
++		}
+ 		intel_ring_emit(ring, MI_ARB_ON_OFF | MI_ARB_ENABLE);
+-	else
+-		intel_ring_emit(ring, MI_NOOP);
++	}
+ 
+ 	intel_ring_advance(ring);
+ 
+diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
+index 85fda6b803e4..0ee76b25204c 100644
+--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
+@@ -137,7 +137,11 @@ static unsigned long i915_stolen_to_physical(struct drm_device *dev)
+ 		r = devm_request_mem_region(dev->dev, base + 1,
+ 					    dev_priv->gtt.stolen_size - 1,
+ 					    "Graphics Stolen Memory");
+-		if (r == NULL) {
++		/*
++		 * GEN3 firmware likes to smash pci bridges into the stolen
++		 * range. Apparently this works.
++		 */
++		if (r == NULL && !IS_GEN3(dev)) {
+ 			DRM_ERROR("conflict detected with stolen region: [0x%08x - 0x%08x]\n",
+ 				  base, base + (uint32_t)dev_priv->gtt.stolen_size);
+ 			base = 0;
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index f66392b6e287..9ba1177200b2 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -4022,8 +4022,6 @@ static bool i8xx_handle_vblank(struct drm_device *dev,
+ 	if ((iir & flip_pending) == 0)
+ 		goto check_page_flip;
+ 
+-	intel_prepare_page_flip(dev, plane);
+-
+ 	/* We detect FlipDone by looking for the change in PendingFlip from '1'
+ 	 * to '0' on the following vblank, i.e. IIR has the Pendingflip
+ 	 * asserted following the MI_DISPLAY_FLIP, but ISR is deasserted, hence
+@@ -4033,6 +4031,7 @@ static bool i8xx_handle_vblank(struct drm_device *dev,
+ 	if (I915_READ16(ISR) & flip_pending)
+ 		goto check_page_flip;
+ 
++	intel_prepare_page_flip(dev, plane);
+ 	intel_finish_page_flip(dev, pipe);
+ 	return true;
+ 
+@@ -4210,8 +4209,6 @@ static bool i915_handle_vblank(struct drm_device *dev,
+ 	if ((iir & flip_pending) == 0)
+ 		goto check_page_flip;
+ 
+-	intel_prepare_page_flip(dev, plane);
+-
+ 	/* We detect FlipDone by looking for the change in PendingFlip from '1'
+ 	 * to '0' on the following vblank, i.e. IIR has the Pendingflip
+ 	 * asserted following the MI_DISPLAY_FLIP, but ISR is deasserted, hence
+@@ -4221,6 +4218,7 @@ static bool i915_handle_vblank(struct drm_device *dev,
+ 	if (I915_READ(ISR) & flip_pending)
+ 		goto check_page_flip;
+ 
++	intel_prepare_page_flip(dev, plane);
+ 	intel_finish_page_flip(dev, pipe);
+ 	return true;
+ 
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index c01e5f31430e..3f1e54bfcddb 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -74,6 +74,7 @@
+ #define   I915_GC_RENDER_CLOCK_166_MHZ	(0 << 0)
+ #define   I915_GC_RENDER_CLOCK_200_MHZ	(1 << 0)
+ #define   I915_GC_RENDER_CLOCK_333_MHZ	(4 << 0)
++#define GCDGMBUS 0xcc
+ #define PCI_LBPC 0xf4 /* legacy/combination backlight modes, also called LBB */
+ 
+ 
+@@ -370,6 +371,7 @@
+ #define   PIPE_CONTROL_STORE_DATA_INDEX			(1<<21)
+ #define   PIPE_CONTROL_CS_STALL				(1<<20)
+ #define   PIPE_CONTROL_TLB_INVALIDATE			(1<<18)
++#define   PIPE_CONTROL_MEDIA_STATE_CLEAR		(1<<16)
+ #define   PIPE_CONTROL_QW_WRITE				(1<<14)
+ #define   PIPE_CONTROL_POST_SYNC_OP_MASK                (3<<14)
+ #define   PIPE_CONTROL_DEPTH_STALL			(1<<13)
+@@ -1071,6 +1073,7 @@ enum punit_power_well {
+ #define GEN6_VERSYNC	(RING_SYNC_1(VEBOX_RING_BASE))
+ #define GEN6_VEVSYNC	(RING_SYNC_2(VEBOX_RING_BASE))
+ #define GEN6_NOSYNC 0
++#define RING_PSMI_CTL(base)	((base)+0x50)
+ #define RING_MAX_IDLE(base)	((base)+0x54)
+ #define RING_HWS_PGA(base)	((base)+0x80)
+ #define RING_HWS_PGA_GEN6(base)	((base)+0x2080)
+@@ -1401,6 +1404,7 @@ enum punit_power_well {
+ #define   GEN6_BLITTER_FBC_NOTIFY			(1<<3)
+ 
+ #define GEN6_RC_SLEEP_PSMI_CONTROL	0x2050
++#define   GEN6_PSMI_SLEEP_MSG_DISABLE	(1 << 0)
+ #define   GEN8_RC_SEMA_IDLE_MSG_DISABLE	(1 << 12)
+ #define   GEN8_FF_DOP_CLOCK_GATE_DISABLE	(1<<10)
+ 
+diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
+index 043123c77a1f..e22b0e825de2 100644
+--- a/drivers/gpu/drm/i915/i915_suspend.c
++++ b/drivers/gpu/drm/i915/i915_suspend.c
+@@ -328,6 +328,10 @@ int i915_save_state(struct drm_device *dev)
+ 		}
+ 	}
+ 
++	if (IS_GEN4(dev))
++		pci_read_config_word(dev->pdev, GCDGMBUS,
++				     &dev_priv->regfile.saveGCDGMBUS);
++
+ 	/* Cache mode state */
+ 	if (INTEL_INFO(dev)->gen < 7)
+ 		dev_priv->regfile.saveCACHE_MODE_0 = I915_READ(CACHE_MODE_0);
+@@ -356,6 +360,10 @@ int i915_restore_state(struct drm_device *dev)
+ 	mutex_lock(&dev->struct_mutex);
+ 
+ 	i915_gem_restore_fences(dev);
++
++	if (IS_GEN4(dev))
++		pci_write_config_word(dev->pdev, GCDGMBUS,
++				      dev_priv->regfile.saveGCDGMBUS);
+ 	i915_restore_display(dev);
+ 
+ 	if (!drm_core_check_feature(dev, DRIVER_MODESET)) {
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 9cb5c95d5898..cadc3bcf1de2 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -12933,11 +12933,7 @@ static void i915_disable_vga(struct drm_device *dev)
+ 	vga_put(dev->pdev, VGA_RSRC_LEGACY_IO);
+ 	udelay(300);
+ 
+-	/*
+-	 * Fujitsu-Siemens Lifebook S6010 (830) has problems resuming
+-	 * from S3 without preserving (some of?) the other bits.
+-	 */
+-	I915_WRITE(vga_reg, dev_priv->bios_vgacntr | VGA_DISP_DISABLE);
++	I915_WRITE(vga_reg, VGA_DISP_DISABLE);
+ 	POSTING_READ(vga_reg);
+ }
+ 
+@@ -13026,8 +13022,6 @@ void intel_modeset_init(struct drm_device *dev)
+ 
+ 	intel_shared_dpll_init(dev);
+ 
+-	/* save the BIOS value before clobbering it */
+-	dev_priv->bios_vgacntr = I915_READ(i915_vgacntrl_reg(dev));
+ 	/* Just disable it once at startup */
+ 	i915_disable_vga(dev);
+ 	intel_setup_outputs(dev);
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index ad2fd605f76b..83c7ecf2608a 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -6520,29 +6520,6 @@ static void chv_pipe_power_well_disable(struct drm_i915_private *dev_priv,
+ 	chv_set_pipe_power_well(dev_priv, power_well, false);
+ }
+ 
+-static void check_power_well_state(struct drm_i915_private *dev_priv,
+-				   struct i915_power_well *power_well)
+-{
+-	bool enabled = power_well->ops->is_enabled(dev_priv, power_well);
+-
+-	if (power_well->always_on || !i915.disable_power_well) {
+-		if (!enabled)
+-			goto mismatch;
+-
+-		return;
+-	}
+-
+-	if (enabled != (power_well->count > 0))
+-		goto mismatch;
+-
+-	return;
+-
+-mismatch:
+-	WARN(1, "state mismatch for '%s' (always_on %d hw state %d use-count %d disable_power_well %d\n",
+-		  power_well->name, power_well->always_on, enabled,
+-		  power_well->count, i915.disable_power_well);
+-}
+-
+ void intel_display_power_get(struct drm_i915_private *dev_priv,
+ 			     enum intel_display_power_domain domain)
+ {
+@@ -6562,8 +6539,6 @@ void intel_display_power_get(struct drm_i915_private *dev_priv,
+ 			power_well->ops->enable(dev_priv, power_well);
+ 			power_well->hw_enabled = true;
+ 		}
+-
+-		check_power_well_state(dev_priv, power_well);
+ 	}
+ 
+ 	power_domains->domain_use_count[domain]++;
+@@ -6593,8 +6568,6 @@ void intel_display_power_put(struct drm_i915_private *dev_priv,
+ 			power_well->hw_enabled = false;
+ 			power_well->ops->disable(dev_priv, power_well);
+ 		}
+-
+-		check_power_well_state(dev_priv, power_well);
+ 	}
+ 
+ 	mutex_unlock(&power_domains->lock);
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index 0a80e419b589..ae17e77dc08d 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -362,12 +362,15 @@ gen7_render_ring_flush(struct intel_engine_cs *ring,
+ 		flags |= PIPE_CONTROL_VF_CACHE_INVALIDATE;
+ 		flags |= PIPE_CONTROL_CONST_CACHE_INVALIDATE;
+ 		flags |= PIPE_CONTROL_STATE_CACHE_INVALIDATE;
++		flags |= PIPE_CONTROL_MEDIA_STATE_CLEAR;
+ 		/*
+ 		 * TLB invalidate requires a post-sync write.
+ 		 */
+ 		flags |= PIPE_CONTROL_QW_WRITE;
+ 		flags |= PIPE_CONTROL_GLOBAL_GTT_IVB;
+ 
++		flags |= PIPE_CONTROL_STALL_AT_SCOREBOARD;
++
+ 		/* Workaround: we must issue a pipe_control with CS-stall bit
+ 		 * set before a pipe_control command that has the state cache
+ 		 * invalidate bit set. */
+diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
+index 918b76163965..b29091b21a76 100644
+--- a/drivers/gpu/drm/i915/intel_uncore.c
++++ b/drivers/gpu/drm/i915/intel_uncore.c
+@@ -43,8 +43,8 @@
+ static void
+ assert_device_not_suspended(struct drm_i915_private *dev_priv)
+ {
+-	WARN(HAS_RUNTIME_PM(dev_priv->dev) && dev_priv->pm.suspended,
+-	     "Device suspended\n");
++	WARN_ONCE(HAS_RUNTIME_PM(dev_priv->dev) && dev_priv->pm.suspended,
++		  "Device suspended\n");
+ }
+ 
+ static void __gen6_gt_wait_for_thread_c0(struct drm_i915_private *dev_priv)
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
+index a75c35ccf25c..165401c4045c 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
+@@ -24,13 +24,6 @@
+ 
+ #include "nv04.h"
+ 
+-static void
+-nv4c_mc_msi_rearm(struct nouveau_mc *pmc)
+-{
+-	struct nv04_mc_priv *priv = (void *)pmc;
+-	nv_wr08(priv, 0x088050, 0xff);
+-}
+-
+ struct nouveau_oclass *
+ nv4c_mc_oclass = &(struct nouveau_mc_oclass) {
+ 	.base.handle = NV_SUBDEV(MC, 0x4c),
+@@ -41,5 +34,4 @@ nv4c_mc_oclass = &(struct nouveau_mc_oclass) {
+ 		.fini = _nouveau_mc_fini,
+ 	},
+ 	.intr = nv04_mc_intr,
+-	.msi_rearm = nv4c_mc_msi_rearm,
+ }.base;
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 30d242b25078..dce0d3918fa7 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1851,10 +1851,9 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
+ 				return pll;
+ 		}
+ 		/* otherwise, pick one of the plls */
+-		if ((rdev->family == CHIP_KAVERI) ||
+-		    (rdev->family == CHIP_KABINI) ||
++		if ((rdev->family == CHIP_KABINI) ||
+ 		    (rdev->family == CHIP_MULLINS)) {
+-			/* KB/KV/ML has PPLL1 and PPLL2 */
++			/* KB/ML has PPLL1 and PPLL2 */
+ 			pll_in_use = radeon_get_pll_use_mask(crtc);
+ 			if (!(pll_in_use & (1 << ATOM_PPLL2)))
+ 				return ATOM_PPLL2;
+@@ -1863,7 +1862,7 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
+ 			DRM_ERROR("unable to allocate a PPLL\n");
+ 			return ATOM_PPLL_INVALID;
+ 		} else {
+-			/* CI has PPLL0, PPLL1, and PPLL2 */
++			/* CI/KV has PPLL0, PPLL1, and PPLL2 */
+ 			pll_in_use = radeon_get_pll_use_mask(crtc);
+ 			if (!(pll_in_use & (1 << ATOM_PPLL2)))
+ 				return ATOM_PPLL2;
+@@ -2154,6 +2153,7 @@ static void atombios_crtc_disable(struct drm_crtc *crtc)
+ 	case ATOM_PPLL0:
+ 		/* disable the ppll */
+ 		if ((rdev->family == CHIP_ARUBA) ||
++		    (rdev->family == CHIP_KAVERI) ||
+ 		    (rdev->family == CHIP_BONAIRE) ||
+ 		    (rdev->family == CHIP_HAWAII))
+ 			atombios_crtc_program_pll(crtc, radeon_crtc->crtc_id, radeon_crtc->pll_id,
+diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
+index 11ba9d21b89b..db42a670f995 100644
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -492,6 +492,10 @@ int radeon_dp_mode_valid_helper(struct drm_connector *connector,
+ 	struct radeon_connector_atom_dig *dig_connector;
+ 	int dp_clock;
+ 
++	if ((mode->clock > 340000) &&
++	    (!radeon_connector_is_dp12_capable(connector)))
++		return MODE_CLOCK_HIGH;
++
+ 	if (!radeon_connector->con_priv)
+ 		return MODE_CLOCK_HIGH;
+ 	dig_connector = radeon_connector->con_priv;
+diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
+index 11a55e9dad7f..c5699b593665 100644
+--- a/drivers/gpu/drm/radeon/ci_dpm.c
++++ b/drivers/gpu/drm/radeon/ci_dpm.c
+@@ -4729,7 +4729,7 @@ void ci_dpm_disable(struct radeon_device *rdev)
+ 	ci_enable_spread_spectrum(rdev, false);
+ 	ci_enable_auto_throttle_source(rdev, RADEON_DPM_AUTO_THROTTLE_SRC_THERMAL, false);
+ 	ci_stop_dpm(rdev);
+-	ci_enable_ds_master_switch(rdev, true);
++	ci_enable_ds_master_switch(rdev, false);
+ 	ci_enable_ulv(rdev, false);
+ 	ci_clear_vc(rdev);
+ 	ci_reset_to_default(rdev);
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 89c01fa6dd8e..9328fb3dcfce 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -6314,6 +6314,7 @@ static void cik_enable_mgcg(struct radeon_device *rdev, bool enable)
+ 		}
+ 
+ 		orig = data = RREG32(RLC_CGTT_MGCG_OVERRIDE);
++		data |= 0x00000001;
+ 		data &= 0xfffffffd;
+ 		if (orig != data)
+ 			WREG32(RLC_CGTT_MGCG_OVERRIDE, data);
+@@ -6345,7 +6346,7 @@ static void cik_enable_mgcg(struct radeon_device *rdev, bool enable)
+ 		}
+ 	} else {
+ 		orig = data = RREG32(RLC_CGTT_MGCG_OVERRIDE);
+-		data |= 0x00000002;
++		data |= 0x00000003;
+ 		if (orig != data)
+ 			WREG32(RLC_CGTT_MGCG_OVERRIDE, data);
+ 
+diff --git a/drivers/gpu/drm/radeon/dce3_1_afmt.c b/drivers/gpu/drm/radeon/dce3_1_afmt.c
+index 2fe8cfc966d9..bafdf92a5732 100644
+--- a/drivers/gpu/drm/radeon/dce3_1_afmt.c
++++ b/drivers/gpu/drm/radeon/dce3_1_afmt.c
+@@ -103,7 +103,7 @@ static void dce3_2_afmt_write_sad_regs(struct drm_encoder *encoder)
+ 	}
+ 
+ 	sad_count = drm_edid_to_sad(radeon_connector->edid, &sads);
+-	if (sad_count < 0) {
++	if (sad_count <= 0) {
+ 		DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
+ 		return;
+ 	}
+diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
+index 9b42001295ba..e3e9c10cfba9 100644
+--- a/drivers/gpu/drm/radeon/kv_dpm.c
++++ b/drivers/gpu/drm/radeon/kv_dpm.c
+@@ -2745,13 +2745,11 @@ int kv_dpm_init(struct radeon_device *rdev)
+ 	pi->enable_auto_thermal_throttling = true;
+ 	pi->disable_nb_ps3_in_battery = false;
+ 	if (radeon_bapm == -1) {
+-		/* There are stability issues reported on with
+-		 * bapm enabled on an asrock system.
+-		 */
+-		if (rdev->pdev->subsystem_vendor == 0x1849)
+-			pi->bapm_enable = false;
+-		else
++		/* only enable bapm on KB, ML by default */
++		if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
+ 			pi->bapm_enable = true;
++		else
++			pi->bapm_enable = false;
+ 	} else if (radeon_bapm == 0) {
+ 		pi->bapm_enable = false;
+ 	} else {
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index 8624979afb65..d2510cfd3fea 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -196,7 +196,7 @@ static void radeon_evict_flags(struct ttm_buffer_object *bo,
+ 	rbo = container_of(bo, struct radeon_bo, tbo);
+ 	switch (bo->mem.mem_type) {
+ 	case TTM_PL_VRAM:
+-		if (rbo->rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ready == false)
++		if (rbo->rdev->ring[radeon_copy_ring_index(rbo->rdev)].ready == false)
+ 			radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU);
+ 		else
+ 			radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT);
+diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+index 09874d695188..025c429050c0 100644
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+@@ -297,11 +297,12 @@ static void ttm_pool_update_free_locked(struct ttm_page_pool *pool,
+  *
+  * @pool: to free the pages from
+  * @free_all: If set to true will free all pages in pool
+- * @gfp: GFP flags.
++ * @use_static: Safe to use static buffer
+  **/
+ static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free,
+-			      gfp_t gfp)
++			      bool use_static)
+ {
++	static struct page *static_buf[NUM_PAGES_TO_ALLOC];
+ 	unsigned long irq_flags;
+ 	struct page *p;
+ 	struct page **pages_to_free;
+@@ -311,7 +312,11 @@ static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free,
+ 	if (NUM_PAGES_TO_ALLOC < nr_free)
+ 		npages_to_free = NUM_PAGES_TO_ALLOC;
+ 
+-	pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp);
++	if (use_static)
++		pages_to_free = static_buf;
++	else
++		pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
++					GFP_KERNEL);
+ 	if (!pages_to_free) {
+ 		pr_err("Failed to allocate memory for pool free operation\n");
+ 		return 0;
+@@ -374,7 +379,8 @@ restart:
+ 	if (freed_pages)
+ 		ttm_pages_put(pages_to_free, freed_pages);
+ out:
+-	kfree(pages_to_free);
++	if (pages_to_free != static_buf)
++		kfree(pages_to_free);
+ 	return nr_free;
+ }
+ 
+@@ -383,8 +389,6 @@ out:
+  *
+  * XXX: (dchinner) Deadlock warning!
+  *
+- * We need to pass sc->gfp_mask to ttm_page_pool_free().
+- *
+  * This code is crying out for a shrinker per pool....
+  */
+ static unsigned long
+@@ -407,8 +411,8 @@ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ 		if (shrink_pages == 0)
+ 			break;
+ 		pool = &_manager->pools[(i + pool_offset)%NUM_POOLS];
+-		shrink_pages = ttm_page_pool_free(pool, nr_free,
+-						  sc->gfp_mask);
++		/* OK to use static buffer since global mutex is held. */
++		shrink_pages = ttm_page_pool_free(pool, nr_free, true);
+ 		freed += nr_free - shrink_pages;
+ 	}
+ 	mutex_unlock(&lock);
+@@ -710,7 +714,7 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags,
+ 	}
+ 	spin_unlock_irqrestore(&pool->lock, irq_flags);
+ 	if (npages)
+-		ttm_page_pool_free(pool, npages, GFP_KERNEL);
++		ttm_page_pool_free(pool, npages, false);
+ }
+ 
+ /*
+@@ -849,9 +853,9 @@ void ttm_page_alloc_fini(void)
+ 	pr_info("Finalizing pool allocator\n");
+ 	ttm_pool_mm_shrink_fini(_manager);
+ 
++	/* OK to use static buffer since global mutex is no longer used. */
+ 	for (i = 0; i < NUM_POOLS; ++i)
+-		ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES,
+-				   GFP_KERNEL);
++		ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES, true);
+ 
+ 	kobject_put(&_manager->kobj);
+ 	_manager = NULL;
+diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+index c96db433f8af..01e1d27eb078 100644
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+@@ -411,11 +411,12 @@ static void ttm_dma_page_put(struct dma_pool *pool, struct dma_page *d_page)
+  *
+  * @pool: to free the pages from
+  * @nr_free: If set to true will free all pages in pool
+- * @gfp: GFP flags.
++ * @use_static: Safe to use static buffer
+  **/
+ static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free,
+-				       gfp_t gfp)
++				       bool use_static)
+ {
++	static struct page *static_buf[NUM_PAGES_TO_ALLOC];
+ 	unsigned long irq_flags;
+ 	struct dma_page *dma_p, *tmp;
+ 	struct page **pages_to_free;
+@@ -432,7 +433,11 @@ static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free,
+ 			 npages_to_free, nr_free);
+ 	}
+ #endif
+-	pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp);
++	if (use_static)
++		pages_to_free = static_buf;
++	else
++		pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
++					GFP_KERNEL);
+ 
+ 	if (!pages_to_free) {
+ 		pr_err("%s: Failed to allocate memory for pool free operation\n",
+@@ -502,7 +507,8 @@ restart:
+ 	if (freed_pages)
+ 		ttm_dma_pages_put(pool, &d_pages, pages_to_free, freed_pages);
+ out:
+-	kfree(pages_to_free);
++	if (pages_to_free != static_buf)
++		kfree(pages_to_free);
+ 	return nr_free;
+ }
+ 
+@@ -531,7 +537,8 @@ static void ttm_dma_free_pool(struct device *dev, enum pool_type type)
+ 		if (pool->type != type)
+ 			continue;
+ 		/* Takes a spinlock.. */
+-		ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, GFP_KERNEL);
++		/* OK to use static buffer since global mutex is held. */
++		ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, true);
+ 		WARN_ON(((pool->npages_in_use + pool->npages_free) != 0));
+ 		/* This code path is called after _all_ references to the
+ 		 * struct device has been dropped - so nobody should be
+@@ -986,7 +993,7 @@ void ttm_dma_unpopulate(struct ttm_dma_tt *ttm_dma, struct device *dev)
+ 
+ 	/* shrink pool if necessary (only on !is_cached pools)*/
+ 	if (npages)
+-		ttm_dma_page_pool_free(pool, npages, GFP_KERNEL);
++		ttm_dma_page_pool_free(pool, npages, false);
+ 	ttm->state = tt_unpopulated;
+ }
+ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
+@@ -996,8 +1003,6 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
+  *
+  * XXX: (dchinner) Deadlock warning!
+  *
+- * We need to pass sc->gfp_mask to ttm_dma_page_pool_free().
+- *
+  * I'm getting sadder as I hear more pathetical whimpers about needing per-pool
+  * shrinkers
+  */
+@@ -1030,8 +1035,8 @@ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ 		if (++idx < pool_offset)
+ 			continue;
+ 		nr_free = shrink_pages;
+-		shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free,
+-						      sc->gfp_mask);
++		/* OK to use static buffer since global mutex is held. */
++		shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free, true);
+ 		freed += nr_free - shrink_pages;
+ 
+ 		pr_debug("%s: (%s:%d) Asked to shrink %d, have %d more to go\n",
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index 25f3c250fd98..daeca571b42f 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -1063,8 +1063,12 @@ static long vmw_generic_ioctl(struct file *filp, unsigned int cmd,
+ 
+ 	vmaster = vmw_master_check(dev, file_priv, flags);
+ 	if (unlikely(IS_ERR(vmaster))) {
+-		DRM_INFO("IOCTL ERROR %d\n", nr);
+-		return PTR_ERR(vmaster);
++		ret = PTR_ERR(vmaster);
++
++		if (ret != -ERESTARTSYS)
++			DRM_INFO("IOCTL ERROR Command %d, Error %ld.\n",
++				 nr, ret);
++		return ret;
+ 	}
+ 
+ 	ret = ioctl_func(filp, cmd, arg);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+index 197164fd7803..b7594cb758af 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+@@ -545,35 +545,19 @@ void vmw_fence_obj_flush(struct vmw_fence_obj *fence)
+ 
+ static void vmw_fence_destroy(struct vmw_fence_obj *fence)
+ {
+-	struct vmw_fence_manager *fman = fman_from_fence(fence);
+-
+ 	fence_free(&fence->base);
+-
+-	/*
+-	 * Free kernel space accounting.
+-	 */
+-	ttm_mem_global_free(vmw_mem_glob(fman->dev_priv),
+-			    fman->fence_size);
+ }
+ 
+ int vmw_fence_create(struct vmw_fence_manager *fman,
+ 		     uint32_t seqno,
+ 		     struct vmw_fence_obj **p_fence)
+ {
+-	struct ttm_mem_global *mem_glob = vmw_mem_glob(fman->dev_priv);
+ 	struct vmw_fence_obj *fence;
+ 	int ret;
+ 
+-	ret = ttm_mem_global_alloc(mem_glob, fman->fence_size,
+-				   false, false);
+-	if (unlikely(ret != 0))
+-		return ret;
+-
+ 	fence = kzalloc(sizeof(*fence), GFP_KERNEL);
+-	if (unlikely(fence == NULL)) {
+-		ret = -ENOMEM;
+-		goto out_no_object;
+-	}
++	if (unlikely(fence == NULL))
++		return -ENOMEM;
+ 
+ 	ret = vmw_fence_obj_init(fman, fence, seqno,
+ 				 vmw_fence_destroy);
+@@ -585,8 +569,6 @@ int vmw_fence_create(struct vmw_fence_manager *fman,
+ 
+ out_err_init:
+ 	kfree(fence);
+-out_no_object:
+-	ttm_mem_global_free(mem_glob, fman->fence_size);
+ 	return ret;
+ }
+ 
+@@ -1105,6 +1087,8 @@ static int vmw_event_fence_action_create(struct drm_file *file_priv,
+ 	if (ret != 0)
+ 		goto out_no_queue;
+ 
++	return 0;
++
+ out_no_queue:
+ 	event->base.destroy(&event->base);
+ out_no_event:
+@@ -1180,17 +1164,10 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
+ 
+ 	BUG_ON(fence == NULL);
+ 
+-	if (arg->flags & DRM_VMW_FE_FLAG_REQ_TIME)
+-		ret = vmw_event_fence_action_create(file_priv, fence,
+-						    arg->flags,
+-						    arg->user_data,
+-						    true);
+-	else
+-		ret = vmw_event_fence_action_create(file_priv, fence,
+-						    arg->flags,
+-						    arg->user_data,
+-						    true);
+-
++	ret = vmw_event_fence_action_create(file_priv, fence,
++					    arg->flags,
++					    arg->user_data,
++					    true);
+ 	if (unlikely(ret != 0)) {
+ 		if (ret != -ERESTARTSYS)
+ 			DRM_ERROR("Failed to attach event to fence.\n");
+diff --git a/drivers/iio/adc/ad799x.c b/drivers/iio/adc/ad799x.c
+index e37412da15f5..b99de00e57b8 100644
+--- a/drivers/iio/adc/ad799x.c
++++ b/drivers/iio/adc/ad799x.c
+@@ -143,9 +143,15 @@ static int ad799x_write_config(struct ad799x_state *st, u16 val)
+ 	case ad7998:
+ 		return i2c_smbus_write_word_swapped(st->client, AD7998_CONF_REG,
+ 			val);
+-	default:
++	case ad7992:
++	case ad7993:
++	case ad7994:
+ 		return i2c_smbus_write_byte_data(st->client, AD7998_CONF_REG,
+ 			val);
++	default:
++		/* Will be written when doing a conversion */
++		st->config = val;
++		return 0;
+ 	}
+ }
+ 
+@@ -155,8 +161,13 @@ static int ad799x_read_config(struct ad799x_state *st)
+ 	case ad7997:
+ 	case ad7998:
+ 		return i2c_smbus_read_word_swapped(st->client, AD7998_CONF_REG);
+-	default:
++	case ad7992:
++	case ad7993:
++	case ad7994:
+ 		return i2c_smbus_read_byte_data(st->client, AD7998_CONF_REG);
++	default:
++		/* No readback support */
++		return st->config;
+ 	}
+ }
+ 
+diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
+index cd4174ca9a76..f14c3849e568 100644
+--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
++++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
+@@ -432,6 +432,7 @@ struct fast_reg_descriptor {
+  * @cma_id:              rdma_cm connection maneger handle
+  * @qp:                  Connection Queue-pair
+  * @post_recv_buf_count: post receive counter
++ * @sig_count:           send work request signal count
+  * @rx_wr:               receive work request for batch posts
+  * @device:              reference to iser device
+  * @comp:                iser completion context
+@@ -452,6 +453,7 @@ struct ib_conn {
+ 	struct rdma_cm_id           *cma_id;
+ 	struct ib_qp	            *qp;
+ 	int                          post_recv_buf_count;
++	u8                           sig_count;
+ 	struct ib_recv_wr	     rx_wr[ISER_MIN_POSTED_RX];
+ 	struct iser_device          *device;
+ 	struct iser_comp	    *comp;
+diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
+index 5a489ea63732..3821633f1065 100644
+--- a/drivers/infiniband/ulp/iser/iser_initiator.c
++++ b/drivers/infiniband/ulp/iser/iser_initiator.c
+@@ -369,7 +369,7 @@ static int iser_post_rx_bufs(struct iscsi_conn *conn, struct iscsi_hdr *req)
+ 	return 0;
+ }
+ 
+-static inline bool iser_signal_comp(int sig_count)
++static inline bool iser_signal_comp(u8 sig_count)
+ {
+ 	return ((sig_count % ISER_SIGNAL_CMD_COUNT) == 0);
+ }
+@@ -388,7 +388,7 @@ int iser_send_command(struct iscsi_conn *conn,
+ 	struct iscsi_scsi_req *hdr = (struct iscsi_scsi_req *)task->hdr;
+ 	struct scsi_cmnd *sc  =  task->sc;
+ 	struct iser_tx_desc *tx_desc = &iser_task->desc;
+-	static unsigned sig_count;
++	u8 sig_count = ++iser_conn->ib_conn.sig_count;
+ 
+ 	edtl = ntohl(hdr->data_length);
+ 
+@@ -435,7 +435,7 @@ int iser_send_command(struct iscsi_conn *conn,
+ 	iser_task->status = ISER_TASK_STATUS_STARTED;
+ 
+ 	err = iser_post_send(&iser_conn->ib_conn, tx_desc,
+-			     iser_signal_comp(++sig_count));
++			     iser_signal_comp(sig_count));
+ 	if (!err)
+ 		return 0;
+ 
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index 10641b7816f4..a6daabc70425 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -41,6 +41,7 @@ static DEFINE_MUTEX(device_list_mutex);
+ static LIST_HEAD(device_list);
+ static struct workqueue_struct *isert_rx_wq;
+ static struct workqueue_struct *isert_comp_wq;
++static struct workqueue_struct *isert_release_wq;
+ 
+ static void
+ isert_unmap_cmd(struct isert_cmd *isert_cmd, struct isert_conn *isert_conn);
+@@ -54,6 +55,19 @@ isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	       struct isert_rdma_wr *wr);
+ static int
+ isert_put_response(struct iscsi_conn *conn, struct iscsi_cmd *cmd);
++static int
++isert_rdma_post_recvl(struct isert_conn *isert_conn);
++static int
++isert_rdma_accept(struct isert_conn *isert_conn);
++struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);
++
++static inline bool
++isert_prot_cmd(struct isert_conn *conn, struct se_cmd *cmd)
++{
++	return (conn->pi_support &&
++		cmd->prot_op != TARGET_PROT_NORMAL);
++}
++
+ 
+ static void
+ isert_qp_event_callback(struct ib_event *e, void *context)
+@@ -90,8 +104,7 @@ isert_query_device(struct ib_device *ib_dev, struct ib_device_attr *devattr)
+ }
+ 
+ static int
+-isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id,
+-		    u8 protection)
++isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id)
+ {
+ 	struct isert_device *device = isert_conn->conn_device;
+ 	struct ib_qp_init_attr attr;
+@@ -126,7 +139,7 @@ isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id,
+ 	attr.cap.max_recv_sge = 1;
+ 	attr.sq_sig_type = IB_SIGNAL_REQ_WR;
+ 	attr.qp_type = IB_QPT_RC;
+-	if (protection)
++	if (device->pi_capable)
+ 		attr.create_flags |= IB_QP_CREATE_SIGNATURE_EN;
+ 
+ 	pr_debug("isert_conn_setup_qp cma_id->device: %p\n",
+@@ -137,12 +150,18 @@ isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id,
+ 	ret = rdma_create_qp(cma_id, isert_conn->conn_pd, &attr);
+ 	if (ret) {
+ 		pr_err("rdma_create_qp failed for cma_id %d\n", ret);
+-		return ret;
++		goto err;
+ 	}
+ 	isert_conn->conn_qp = cma_id->qp;
+ 	pr_debug("rdma_create_qp() returned success >>>>>>>>>>>>>>>>>>>>>>>>>.\n");
+ 
+ 	return 0;
++err:
++	mutex_lock(&device_list_mutex);
++	device->cq_active_qps[min_index]--;
++	mutex_unlock(&device_list_mutex);
++
++	return ret;
+ }
+ 
+ static void
+@@ -430,8 +449,68 @@ isert_conn_free_fastreg_pool(struct isert_conn *isert_conn)
+ }
+ 
+ static int
++isert_create_pi_ctx(struct fast_reg_descriptor *desc,
++		    struct ib_device *device,
++		    struct ib_pd *pd)
++{
++	struct ib_mr_init_attr mr_init_attr;
++	struct pi_context *pi_ctx;
++	int ret;
++
++	pi_ctx = kzalloc(sizeof(*desc->pi_ctx), GFP_KERNEL);
++	if (!pi_ctx) {
++		pr_err("Failed to allocate pi context\n");
++		return -ENOMEM;
++	}
++
++	pi_ctx->prot_frpl = ib_alloc_fast_reg_page_list(device,
++					    ISCSI_ISER_SG_TABLESIZE);
++	if (IS_ERR(pi_ctx->prot_frpl)) {
++		pr_err("Failed to allocate prot frpl err=%ld\n",
++			  PTR_ERR(pi_ctx->prot_frpl));
++		ret = PTR_ERR(pi_ctx->prot_frpl);
++		goto err_pi_ctx;
++	}
++
++	pi_ctx->prot_mr = ib_alloc_fast_reg_mr(pd, ISCSI_ISER_SG_TABLESIZE);
++	if (IS_ERR(pi_ctx->prot_mr)) {
++		pr_err("Failed to allocate prot frmr err=%ld\n",
++			  PTR_ERR(pi_ctx->prot_mr));
++		ret = PTR_ERR(pi_ctx->prot_mr);
++		goto err_prot_frpl;
++	}
++	desc->ind |= ISERT_PROT_KEY_VALID;
++
++	memset(&mr_init_attr, 0, sizeof(mr_init_attr));
++	mr_init_attr.max_reg_descriptors = 2;
++	mr_init_attr.flags |= IB_MR_SIGNATURE_EN;
++	pi_ctx->sig_mr = ib_create_mr(pd, &mr_init_attr);
++	if (IS_ERR(pi_ctx->sig_mr)) {
++		pr_err("Failed to allocate signature enabled mr err=%ld\n",
++			  PTR_ERR(pi_ctx->sig_mr));
++		ret = PTR_ERR(pi_ctx->sig_mr);
++		goto err_prot_mr;
++	}
++
++	desc->pi_ctx = pi_ctx;
++	desc->ind |= ISERT_SIG_KEY_VALID;
++	desc->ind &= ~ISERT_PROTECTED;
++
++	return 0;
++
++err_prot_mr:
++	ib_dereg_mr(desc->pi_ctx->prot_mr);
++err_prot_frpl:
++	ib_free_fast_reg_page_list(desc->pi_ctx->prot_frpl);
++err_pi_ctx:
++	kfree(desc->pi_ctx);
++
++	return ret;
++}
++
++static int
+ isert_create_fr_desc(struct ib_device *ib_device, struct ib_pd *pd,
+-		     struct fast_reg_descriptor *fr_desc, u8 protection)
++		     struct fast_reg_descriptor *fr_desc)
+ {
+ 	int ret;
+ 
+@@ -450,62 +529,12 @@ isert_create_fr_desc(struct ib_device *ib_device, struct ib_pd *pd,
+ 		ret = PTR_ERR(fr_desc->data_mr);
+ 		goto err_data_frpl;
+ 	}
+-	pr_debug("Create fr_desc %p page_list %p\n",
+-		 fr_desc, fr_desc->data_frpl->page_list);
+ 	fr_desc->ind |= ISERT_DATA_KEY_VALID;
+ 
+-	if (protection) {
+-		struct ib_mr_init_attr mr_init_attr = {0};
+-		struct pi_context *pi_ctx;
+-
+-		fr_desc->pi_ctx = kzalloc(sizeof(*fr_desc->pi_ctx), GFP_KERNEL);
+-		if (!fr_desc->pi_ctx) {
+-			pr_err("Failed to allocate pi context\n");
+-			ret = -ENOMEM;
+-			goto err_data_mr;
+-		}
+-		pi_ctx = fr_desc->pi_ctx;
+-
+-		pi_ctx->prot_frpl = ib_alloc_fast_reg_page_list(ib_device,
+-						    ISCSI_ISER_SG_TABLESIZE);
+-		if (IS_ERR(pi_ctx->prot_frpl)) {
+-			pr_err("Failed to allocate prot frpl err=%ld\n",
+-			       PTR_ERR(pi_ctx->prot_frpl));
+-			ret = PTR_ERR(pi_ctx->prot_frpl);
+-			goto err_pi_ctx;
+-		}
+-
+-		pi_ctx->prot_mr = ib_alloc_fast_reg_mr(pd, ISCSI_ISER_SG_TABLESIZE);
+-		if (IS_ERR(pi_ctx->prot_mr)) {
+-			pr_err("Failed to allocate prot frmr err=%ld\n",
+-			       PTR_ERR(pi_ctx->prot_mr));
+-			ret = PTR_ERR(pi_ctx->prot_mr);
+-			goto err_prot_frpl;
+-		}
+-		fr_desc->ind |= ISERT_PROT_KEY_VALID;
+-
+-		mr_init_attr.max_reg_descriptors = 2;
+-		mr_init_attr.flags |= IB_MR_SIGNATURE_EN;
+-		pi_ctx->sig_mr = ib_create_mr(pd, &mr_init_attr);
+-		if (IS_ERR(pi_ctx->sig_mr)) {
+-			pr_err("Failed to allocate signature enabled mr err=%ld\n",
+-			       PTR_ERR(pi_ctx->sig_mr));
+-			ret = PTR_ERR(pi_ctx->sig_mr);
+-			goto err_prot_mr;
+-		}
+-		fr_desc->ind |= ISERT_SIG_KEY_VALID;
+-	}
+-	fr_desc->ind &= ~ISERT_PROTECTED;
++	pr_debug("Created fr_desc %p\n", fr_desc);
+ 
+ 	return 0;
+-err_prot_mr:
+-	ib_dereg_mr(fr_desc->pi_ctx->prot_mr);
+-err_prot_frpl:
+-	ib_free_fast_reg_page_list(fr_desc->pi_ctx->prot_frpl);
+-err_pi_ctx:
+-	kfree(fr_desc->pi_ctx);
+-err_data_mr:
+-	ib_dereg_mr(fr_desc->data_mr);
++
+ err_data_frpl:
+ 	ib_free_fast_reg_page_list(fr_desc->data_frpl);
+ 
+@@ -513,7 +542,7 @@ err_data_frpl:
+ }
+ 
+ static int
+-isert_conn_create_fastreg_pool(struct isert_conn *isert_conn, u8 pi_support)
++isert_conn_create_fastreg_pool(struct isert_conn *isert_conn)
+ {
+ 	struct fast_reg_descriptor *fr_desc;
+ 	struct isert_device *device = isert_conn->conn_device;
+@@ -537,8 +566,7 @@ isert_conn_create_fastreg_pool(struct isert_conn *isert_conn, u8 pi_support)
+ 		}
+ 
+ 		ret = isert_create_fr_desc(device->ib_device,
+-					   isert_conn->conn_pd, fr_desc,
+-					   pi_support);
++					   isert_conn->conn_pd, fr_desc);
+ 		if (ret) {
+ 			pr_err("Failed to create fastreg descriptor err=%d\n",
+ 			       ret);
+@@ -563,13 +591,12 @@ err:
+ static int
+ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ {
+-	struct iscsi_np *np = cma_id->context;
+-	struct isert_np *isert_np = np->np_context;
++	struct isert_np *isert_np = cma_id->context;
++	struct iscsi_np *np = isert_np->np;
+ 	struct isert_conn *isert_conn;
+ 	struct isert_device *device;
+ 	struct ib_device *ib_dev = cma_id->device;
+ 	int ret = 0;
+-	u8 pi_support;
+ 
+ 	spin_lock_bh(&np->np_thread_lock);
+ 	if (!np->enabled) {
+@@ -590,6 +617,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ 	isert_conn->state = ISER_CONN_INIT;
+ 	INIT_LIST_HEAD(&isert_conn->conn_accept_node);
+ 	init_completion(&isert_conn->conn_login_comp);
++	init_completion(&isert_conn->login_req_comp);
+ 	init_completion(&isert_conn->conn_wait);
+ 	init_completion(&isert_conn->conn_wait_comp_err);
+ 	kref_init(&isert_conn->conn_kref);
+@@ -597,7 +625,6 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ 	spin_lock_init(&isert_conn->conn_lock);
+ 	INIT_LIST_HEAD(&isert_conn->conn_fr_pool);
+ 
+-	cma_id->context = isert_conn;
+ 	isert_conn->conn_cm_id = cma_id;
+ 
+ 	isert_conn->login_buf = kzalloc(ISCSI_DEF_MAX_RECV_SEG_LEN +
+@@ -669,15 +696,15 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ 		goto out_mr;
+ 	}
+ 
+-	pi_support = np->tpg_np->tpg->tpg_attrib.t10_pi;
+-	if (pi_support && !device->pi_capable) {
+-		pr_err("Protection information requested but not supported, "
+-		       "rejecting connect request\n");
+-		ret = rdma_reject(cma_id, NULL, 0);
+-		goto out_mr;
+-	}
++	ret = isert_conn_setup_qp(isert_conn, cma_id);
++	if (ret)
++		goto out_conn_dev;
+ 
+-	ret = isert_conn_setup_qp(isert_conn, cma_id, pi_support);
++	ret = isert_rdma_post_recvl(isert_conn);
++	if (ret)
++		goto out_conn_dev;
++
++	ret = isert_rdma_accept(isert_conn);
+ 	if (ret)
+ 		goto out_conn_dev;
+ 
+@@ -705,6 +732,7 @@ out_login_buf:
+ 	kfree(isert_conn->login_buf);
+ out:
+ 	kfree(isert_conn);
++	rdma_reject(cma_id, NULL, 0);
+ 	return ret;
+ }
+ 
+@@ -720,18 +748,20 @@ isert_connect_release(struct isert_conn *isert_conn)
+ 	if (device && device->use_fastreg)
+ 		isert_conn_free_fastreg_pool(isert_conn);
+ 
++	isert_free_rx_descriptors(isert_conn);
++	rdma_destroy_id(isert_conn->conn_cm_id);
++
+ 	if (isert_conn->conn_qp) {
+ 		cq_index = ((struct isert_cq_desc *)
+ 			isert_conn->conn_qp->recv_cq->cq_context)->cq_index;
+ 		pr_debug("isert_connect_release: cq_index: %d\n", cq_index);
++		mutex_lock(&device_list_mutex);
+ 		isert_conn->conn_device->cq_active_qps[cq_index]--;
++		mutex_unlock(&device_list_mutex);
+ 
+-		rdma_destroy_qp(isert_conn->conn_cm_id);
++		ib_destroy_qp(isert_conn->conn_qp);
+ 	}
+ 
+-	isert_free_rx_descriptors(isert_conn);
+-	rdma_destroy_id(isert_conn->conn_cm_id);
+-
+ 	ib_dereg_mr(isert_conn->conn_mr);
+ 	ib_dealloc_pd(isert_conn->conn_pd);
+ 
+@@ -754,9 +784,19 @@ isert_connect_release(struct isert_conn *isert_conn)
+ static void
+ isert_connected_handler(struct rdma_cm_id *cma_id)
+ {
+-	struct isert_conn *isert_conn = cma_id->context;
++	struct isert_conn *isert_conn = cma_id->qp->qp_context;
++
++	pr_info("conn %p\n", isert_conn);
+ 
+-	kref_get(&isert_conn->conn_kref);
++	if (!kref_get_unless_zero(&isert_conn->conn_kref)) {
++		pr_warn("conn %p connect_release is running\n", isert_conn);
++		return;
++	}
++
++	mutex_lock(&isert_conn->conn_mutex);
++	if (isert_conn->state != ISER_CONN_FULL_FEATURE)
++		isert_conn->state = ISER_CONN_UP;
++	mutex_unlock(&isert_conn->conn_mutex);
+ }
+ 
+ static void
+@@ -777,65 +817,108 @@ isert_put_conn(struct isert_conn *isert_conn)
+ 	kref_put(&isert_conn->conn_kref, isert_release_conn_kref);
+ }
+ 
++/**
++ * isert_conn_terminate() - Initiate connection termination
++ * @isert_conn: isert connection struct
++ *
++ * Notes:
++ * In case the connection state is FULL_FEATURE, move state
++ * to TEMINATING and start teardown sequence (rdma_disconnect).
++ * In case the connection state is UP, complete flush as well.
++ *
++ * This routine must be called with conn_mutex held. Thus it is
++ * safe to call multiple times.
++ */
+ static void
+-isert_disconnect_work(struct work_struct *work)
++isert_conn_terminate(struct isert_conn *isert_conn)
+ {
+-	struct isert_conn *isert_conn = container_of(work,
+-				struct isert_conn, conn_logout_work);
++	int err;
+ 
+-	pr_debug("isert_disconnect_work(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
+-	mutex_lock(&isert_conn->conn_mutex);
+-	if (isert_conn->state == ISER_CONN_UP)
++	switch (isert_conn->state) {
++	case ISER_CONN_TERMINATING:
++		break;
++	case ISER_CONN_UP:
++		/*
++		 * No flush completions will occur as we didn't
++		 * get to ISER_CONN_FULL_FEATURE yet, complete
++		 * to allow teardown progress.
++		 */
++		complete(&isert_conn->conn_wait_comp_err);
++	case ISER_CONN_FULL_FEATURE: /* FALLTHRU */
++		pr_info("Terminating conn %p state %d\n",
++			   isert_conn, isert_conn->state);
+ 		isert_conn->state = ISER_CONN_TERMINATING;
+-
+-	if (isert_conn->post_recv_buf_count == 0 &&
+-	    atomic_read(&isert_conn->post_send_buf_count) == 0) {
+-		mutex_unlock(&isert_conn->conn_mutex);
+-		goto wake_up;
+-	}
+-	if (!isert_conn->conn_cm_id) {
+-		mutex_unlock(&isert_conn->conn_mutex);
+-		isert_put_conn(isert_conn);
+-		return;
++		err = rdma_disconnect(isert_conn->conn_cm_id);
++		if (err)
++			pr_warn("Failed rdma_disconnect isert_conn %p\n",
++				   isert_conn);
++		break;
++	default:
++		pr_warn("conn %p teminating in state %d\n",
++			   isert_conn, isert_conn->state);
+ 	}
++}
+ 
+-	if (isert_conn->disconnect) {
+-		/* Send DREQ/DREP towards our initiator */
+-		rdma_disconnect(isert_conn->conn_cm_id);
+-	}
++static int
++isert_np_cma_handler(struct isert_np *isert_np,
++		     enum rdma_cm_event_type event)
++{
++	pr_debug("isert np %p, handling event %d\n", isert_np, event);
+ 
+-	mutex_unlock(&isert_conn->conn_mutex);
++	switch (event) {
++	case RDMA_CM_EVENT_DEVICE_REMOVAL:
++		isert_np->np_cm_id = NULL;
++		break;
++	case RDMA_CM_EVENT_ADDR_CHANGE:
++		isert_np->np_cm_id = isert_setup_id(isert_np);
++		if (IS_ERR(isert_np->np_cm_id)) {
++			pr_err("isert np %p setup id failed: %ld\n",
++				 isert_np, PTR_ERR(isert_np->np_cm_id));
++			isert_np->np_cm_id = NULL;
++		}
++		break;
++	default:
++		pr_err("isert np %p Unexpected event %d\n",
++			  isert_np, event);
++	}
+ 
+-wake_up:
+-	complete(&isert_conn->conn_wait);
++	return -1;
+ }
+ 
+ static int
+-isert_disconnected_handler(struct rdma_cm_id *cma_id, bool disconnect)
++isert_disconnected_handler(struct rdma_cm_id *cma_id,
++			   enum rdma_cm_event_type event)
+ {
++	struct isert_np *isert_np = cma_id->context;
+ 	struct isert_conn *isert_conn;
+ 
+-	if (!cma_id->qp) {
+-		struct isert_np *isert_np = cma_id->context;
++	if (isert_np->np_cm_id == cma_id)
++		return isert_np_cma_handler(cma_id->context, event);
+ 
+-		isert_np->np_cm_id = NULL;
+-		return -1;
+-	}
++	isert_conn = cma_id->qp->qp_context;
+ 
+-	isert_conn = (struct isert_conn *)cma_id->context;
++	mutex_lock(&isert_conn->conn_mutex);
++	isert_conn_terminate(isert_conn);
++	mutex_unlock(&isert_conn->conn_mutex);
+ 
+-	isert_conn->disconnect = disconnect;
+-	INIT_WORK(&isert_conn->conn_logout_work, isert_disconnect_work);
+-	schedule_work(&isert_conn->conn_logout_work);
++	pr_info("conn %p completing conn_wait\n", isert_conn);
++	complete(&isert_conn->conn_wait);
+ 
+ 	return 0;
+ }
+ 
++static void
++isert_connect_error(struct rdma_cm_id *cma_id)
++{
++	struct isert_conn *isert_conn = cma_id->qp->qp_context;
++
++	isert_put_conn(isert_conn);
++}
++
+ static int
+ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ {
+ 	int ret = 0;
+-	bool disconnect = false;
+ 
+ 	pr_debug("isert_cma_handler: event %d status %d conn %p id %p\n",
+ 		 event->event, event->status, cma_id->context, cma_id);
+@@ -853,11 +936,14 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+ 	case RDMA_CM_EVENT_ADDR_CHANGE:    /* FALLTHRU */
+ 	case RDMA_CM_EVENT_DISCONNECTED:   /* FALLTHRU */
+ 	case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */
+-		disconnect = true;
+ 	case RDMA_CM_EVENT_TIMEWAIT_EXIT:  /* FALLTHRU */
+-		ret = isert_disconnected_handler(cma_id, disconnect);
++		ret = isert_disconnected_handler(cma_id, event->event);
+ 		break;
++	case RDMA_CM_EVENT_REJECTED:       /* FALLTHRU */
++	case RDMA_CM_EVENT_UNREACHABLE:    /* FALLTHRU */
+ 	case RDMA_CM_EVENT_CONNECT_ERROR:
++		isert_connect_error(cma_id);
++		break;
+ 	default:
+ 		pr_err("Unhandled RDMA CMA event: %d\n", event->event);
+ 		break;
+@@ -991,7 +1077,7 @@ isert_init_send_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
+ 	 * bit for every ISERT_COMP_BATCH_COUNT number of ib_post_send() calls.
+ 	 */
+ 	mutex_lock(&isert_conn->conn_mutex);
+-	if (coalesce && isert_conn->state == ISER_CONN_UP &&
++	if (coalesce && isert_conn->state == ISER_CONN_FULL_FEATURE &&
+ 	    ++isert_conn->conn_comp_batch < ISERT_COMP_BATCH_COUNT) {
+ 		tx_desc->llnode_active = true;
+ 		llist_add(&tx_desc->comp_llnode, &isert_conn->conn_comp_llist);
+@@ -1072,11 +1158,7 @@ isert_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login,
+ 		if (login->login_complete) {
+ 			if (!conn->sess->sess_ops->SessionType &&
+ 			    isert_conn->conn_device->use_fastreg) {
+-				/* Normal Session and fastreg is used */
+-				u8 pi_support = login->np->tpg_np->tpg->tpg_attrib.t10_pi;
+-
+-				ret = isert_conn_create_fastreg_pool(isert_conn,
+-								     pi_support);
++				ret = isert_conn_create_fastreg_pool(isert_conn);
+ 				if (ret) {
+ 					pr_err("Conn: %p failed to create"
+ 					       " fastreg pool\n", isert_conn);
+@@ -1092,7 +1174,10 @@ isert_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login,
+ 			if (ret)
+ 				return ret;
+ 
+-			isert_conn->state = ISER_CONN_UP;
++			/* Now we are in FULL_FEATURE phase */
++			mutex_lock(&isert_conn->conn_mutex);
++			isert_conn->state = ISER_CONN_FULL_FEATURE;
++			mutex_unlock(&isert_conn->conn_mutex);
+ 			goto post_send;
+ 		}
+ 
+@@ -1109,18 +1194,17 @@ post_send:
+ }
+ 
+ static void
+-isert_rx_login_req(struct iser_rx_desc *rx_desc, int rx_buflen,
+-		   struct isert_conn *isert_conn)
++isert_rx_login_req(struct isert_conn *isert_conn)
+ {
++	struct iser_rx_desc *rx_desc = (void *)isert_conn->login_req_buf;
++	int rx_buflen = isert_conn->login_req_len;
+ 	struct iscsi_conn *conn = isert_conn->conn;
+ 	struct iscsi_login *login = conn->conn_login;
+ 	int size;
+ 
+-	if (!login) {
+-		pr_err("conn->conn_login is NULL\n");
+-		dump_stack();
+-		return;
+-	}
++	pr_info("conn %p\n", isert_conn);
++
++	WARN_ON_ONCE(!login);
+ 
+ 	if (login->first_request) {
+ 		struct iscsi_login_req *login_req =
+@@ -1483,11 +1567,20 @@ isert_rx_completion(struct iser_rx_desc *desc, struct isert_conn *isert_conn,
+ 		 hdr->opcode, hdr->itt, hdr->flags,
+ 		 (int)(xfer_len - ISER_HEADERS_LEN));
+ 
+-	if ((char *)desc == isert_conn->login_req_buf)
+-		isert_rx_login_req(desc, xfer_len - ISER_HEADERS_LEN,
+-				   isert_conn);
+-	else
++	if ((char *)desc == isert_conn->login_req_buf) {
++		isert_conn->login_req_len = xfer_len - ISER_HEADERS_LEN;
++		if (isert_conn->conn) {
++			struct iscsi_login *login = isert_conn->conn->conn_login;
++
++			if (login && !login->first_request)
++				isert_rx_login_req(isert_conn);
++		}
++		mutex_lock(&isert_conn->conn_mutex);
++		complete(&isert_conn->login_req_comp);
++		mutex_unlock(&isert_conn->conn_mutex);
++	} else {
+ 		isert_rx_do_work(desc, isert_conn);
++	}
+ 
+ 	ib_dma_sync_single_for_device(ib_dev, rx_dma, rx_buflen,
+ 				      DMA_FROM_DEVICE);
+@@ -2046,7 +2139,7 @@ isert_cq_rx_comp_err(struct isert_conn *isert_conn)
+ 		msleep(3000);
+ 
+ 	mutex_lock(&isert_conn->conn_mutex);
+-	isert_conn->state = ISER_CONN_DOWN;
++	isert_conn_terminate(isert_conn);
+ 	mutex_unlock(&isert_conn->conn_mutex);
+ 
+ 	iscsit_cause_connection_reinstatement(isert_conn->conn, 0);
+@@ -2231,8 +2324,16 @@ isert_get_sup_prot_ops(struct iscsi_conn *conn)
+ 	struct isert_conn *isert_conn = (struct isert_conn *)conn->context;
+ 	struct isert_device *device = isert_conn->conn_device;
+ 
+-	if (device->pi_capable)
+-		return TARGET_PROT_ALL;
++	if (conn->tpg->tpg_attrib.t10_pi) {
++		if (device->pi_capable) {
++			pr_info("conn %p PI offload enabled\n", isert_conn);
++			isert_conn->pi_support = true;
++			return TARGET_PROT_ALL;
++		}
++	}
++
++	pr_info("conn %p PI offload disabled\n", isert_conn);
++	isert_conn->pi_support = false;
+ 
+ 	return TARGET_PROT_NORMAL;
+ }
+@@ -2681,10 +2782,10 @@ isert_set_prot_checks(u8 prot_checks)
+ }
+ 
+ static int
+-isert_reg_sig_mr(struct isert_conn *isert_conn, struct se_cmd *se_cmd,
+-		 struct fast_reg_descriptor *fr_desc,
+-		 struct ib_sge *data_sge, struct ib_sge *prot_sge,
+-		 struct ib_sge *sig_sge)
++isert_reg_sig_mr(struct isert_conn *isert_conn,
++		 struct se_cmd *se_cmd,
++		 struct isert_rdma_wr *rdma_wr,
++		 struct fast_reg_descriptor *fr_desc)
+ {
+ 	struct ib_send_wr sig_wr, inv_wr;
+ 	struct ib_send_wr *bad_wr, *wr = NULL;
+@@ -2714,13 +2815,13 @@ isert_reg_sig_mr(struct isert_conn *isert_conn, struct se_cmd *se_cmd,
+ 	memset(&sig_wr, 0, sizeof(sig_wr));
+ 	sig_wr.opcode = IB_WR_REG_SIG_MR;
+ 	sig_wr.wr_id = ISER_FASTREG_LI_WRID;
+-	sig_wr.sg_list = data_sge;
++	sig_wr.sg_list = &rdma_wr->ib_sg[DATA];
+ 	sig_wr.num_sge = 1;
+ 	sig_wr.wr.sig_handover.access_flags = IB_ACCESS_LOCAL_WRITE;
+ 	sig_wr.wr.sig_handover.sig_attrs = &sig_attrs;
+ 	sig_wr.wr.sig_handover.sig_mr = pi_ctx->sig_mr;
+ 	if (se_cmd->t_prot_sg)
+-		sig_wr.wr.sig_handover.prot = prot_sge;
++		sig_wr.wr.sig_handover.prot = &rdma_wr->ib_sg[PROT];
+ 
+ 	if (!wr)
+ 		wr = &sig_wr;
+@@ -2734,34 +2835,93 @@ isert_reg_sig_mr(struct isert_conn *isert_conn, struct se_cmd *se_cmd,
+ 	}
+ 	fr_desc->ind &= ~ISERT_SIG_KEY_VALID;
+ 
+-	sig_sge->lkey = pi_ctx->sig_mr->lkey;
+-	sig_sge->addr = 0;
+-	sig_sge->length = se_cmd->data_length;
++	rdma_wr->ib_sg[SIG].lkey = pi_ctx->sig_mr->lkey;
++	rdma_wr->ib_sg[SIG].addr = 0;
++	rdma_wr->ib_sg[SIG].length = se_cmd->data_length;
+ 	if (se_cmd->prot_op != TARGET_PROT_DIN_STRIP &&
+ 	    se_cmd->prot_op != TARGET_PROT_DOUT_INSERT)
+ 		/*
+ 		 * We have protection guards on the wire
+ 		 * so we need to set a larget transfer
+ 		 */
+-		sig_sge->length += se_cmd->prot_length;
++		rdma_wr->ib_sg[SIG].length += se_cmd->prot_length;
+ 
+ 	pr_debug("sig_sge: addr: 0x%llx  length: %u lkey: %x\n",
+-		 sig_sge->addr, sig_sge->length,
+-		 sig_sge->lkey);
++		  rdma_wr->ib_sg[SIG].addr, rdma_wr->ib_sg[SIG].length,
++		  rdma_wr->ib_sg[SIG].lkey);
+ err:
+ 	return ret;
+ }
+ 
+ static int
++isert_handle_prot_cmd(struct isert_conn *isert_conn,
++		      struct isert_cmd *isert_cmd,
++		      struct isert_rdma_wr *wr)
++{
++	struct isert_device *device = isert_conn->conn_device;
++	struct se_cmd *se_cmd = &isert_cmd->iscsi_cmd->se_cmd;
++	int ret;
++
++	if (!wr->fr_desc->pi_ctx) {
++		ret = isert_create_pi_ctx(wr->fr_desc,
++					  device->ib_device,
++					  isert_conn->conn_pd);
++		if (ret) {
++			pr_err("conn %p failed to allocate pi_ctx\n",
++				  isert_conn);
++			return ret;
++		}
++	}
++
++	if (se_cmd->t_prot_sg) {
++		ret = isert_map_data_buf(isert_conn, isert_cmd,
++					 se_cmd->t_prot_sg,
++					 se_cmd->t_prot_nents,
++					 se_cmd->prot_length,
++					 0, wr->iser_ib_op, &wr->prot);
++		if (ret) {
++			pr_err("conn %p failed to map protection buffer\n",
++				  isert_conn);
++			return ret;
++		}
++
++		memset(&wr->ib_sg[PROT], 0, sizeof(wr->ib_sg[PROT]));
++		ret = isert_fast_reg_mr(isert_conn, wr->fr_desc, &wr->prot,
++					ISERT_PROT_KEY_VALID, &wr->ib_sg[PROT]);
++		if (ret) {
++			pr_err("conn %p failed to fast reg mr\n",
++				  isert_conn);
++			goto unmap_prot_cmd;
++		}
++	}
++
++	ret = isert_reg_sig_mr(isert_conn, se_cmd, wr, wr->fr_desc);
++	if (ret) {
++		pr_err("conn %p failed to fast reg mr\n",
++			  isert_conn);
++		goto unmap_prot_cmd;
++	}
++	wr->fr_desc->ind |= ISERT_PROTECTED;
++
++	return 0;
++
++unmap_prot_cmd:
++	if (se_cmd->t_prot_sg)
++		isert_unmap_data_buf(isert_conn, &wr->prot);
++
++	return ret;
++}
++
++static int
+ isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	       struct isert_rdma_wr *wr)
+ {
+ 	struct se_cmd *se_cmd = &cmd->se_cmd;
+ 	struct isert_cmd *isert_cmd = iscsit_priv_cmd(cmd);
+ 	struct isert_conn *isert_conn = conn->context;
+-	struct ib_sge data_sge;
+-	struct ib_send_wr *send_wr;
+ 	struct fast_reg_descriptor *fr_desc = NULL;
++	struct ib_send_wr *send_wr;
++	struct ib_sge *ib_sg;
+ 	u32 offset;
+ 	int ret = 0;
+ 	unsigned long flags;
+@@ -2775,8 +2935,7 @@ isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	if (ret)
+ 		return ret;
+ 
+-	if (wr->data.dma_nents != 1 ||
+-	    se_cmd->prot_op != TARGET_PROT_NORMAL) {
++	if (wr->data.dma_nents != 1 || isert_prot_cmd(isert_conn, se_cmd)) {
+ 		spin_lock_irqsave(&isert_conn->conn_lock, flags);
+ 		fr_desc = list_first_entry(&isert_conn->conn_fr_pool,
+ 					   struct fast_reg_descriptor, list);
+@@ -2786,38 +2945,21 @@ isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	}
+ 
+ 	ret = isert_fast_reg_mr(isert_conn, fr_desc, &wr->data,
+-				ISERT_DATA_KEY_VALID, &data_sge);
++				ISERT_DATA_KEY_VALID, &wr->ib_sg[DATA]);
+ 	if (ret)
+ 		goto unmap_cmd;
+ 
+-	if (se_cmd->prot_op != TARGET_PROT_NORMAL) {
+-		struct ib_sge prot_sge, sig_sge;
+-
+-		if (se_cmd->t_prot_sg) {
+-			ret = isert_map_data_buf(isert_conn, isert_cmd,
+-						 se_cmd->t_prot_sg,
+-						 se_cmd->t_prot_nents,
+-						 se_cmd->prot_length,
+-						 0, wr->iser_ib_op, &wr->prot);
+-			if (ret)
+-				goto unmap_cmd;
+-
+-			ret = isert_fast_reg_mr(isert_conn, fr_desc, &wr->prot,
+-						ISERT_PROT_KEY_VALID, &prot_sge);
+-			if (ret)
+-				goto unmap_prot_cmd;
+-		}
+-
+-		ret = isert_reg_sig_mr(isert_conn, se_cmd, fr_desc,
+-				       &data_sge, &prot_sge, &sig_sge);
++	if (isert_prot_cmd(isert_conn, se_cmd)) {
++		ret = isert_handle_prot_cmd(isert_conn, isert_cmd, wr);
+ 		if (ret)
+-			goto unmap_prot_cmd;
++			goto unmap_cmd;
+ 
+-		fr_desc->ind |= ISERT_PROTECTED;
+-		memcpy(&wr->s_ib_sge, &sig_sge, sizeof(sig_sge));
+-	} else
+-		memcpy(&wr->s_ib_sge, &data_sge, sizeof(data_sge));
++		ib_sg = &wr->ib_sg[SIG];
++	} else {
++		ib_sg = &wr->ib_sg[DATA];
++	}
+ 
++	memcpy(&wr->s_ib_sge, ib_sg, sizeof(*ib_sg));
+ 	wr->ib_sge = &wr->s_ib_sge;
+ 	wr->send_wr_num = 1;
+ 	memset(&wr->s_send_wr, 0, sizeof(*send_wr));
+@@ -2832,7 +2974,7 @@ isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 		send_wr->opcode = IB_WR_RDMA_WRITE;
+ 		send_wr->wr.rdma.remote_addr = isert_cmd->read_va;
+ 		send_wr->wr.rdma.rkey = isert_cmd->read_stag;
+-		send_wr->send_flags = se_cmd->prot_op == TARGET_PROT_NORMAL ?
++		send_wr->send_flags = !isert_prot_cmd(isert_conn, se_cmd) ?
+ 				      0 : IB_SEND_SIGNALED;
+ 	} else {
+ 		send_wr->opcode = IB_WR_RDMA_READ;
+@@ -2842,9 +2984,7 @@ isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	}
+ 
+ 	return 0;
+-unmap_prot_cmd:
+-	if (se_cmd->t_prot_sg)
+-		isert_unmap_data_buf(isert_conn, &wr->prot);
++
+ unmap_cmd:
+ 	if (fr_desc) {
+ 		spin_lock_irqsave(&isert_conn->conn_lock, flags);
+@@ -2876,7 +3016,7 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
+ 		return rc;
+ 	}
+ 
+-	if (se_cmd->prot_op == TARGET_PROT_NORMAL) {
++	if (!isert_prot_cmd(isert_conn, se_cmd)) {
+ 		/*
+ 		 * Build isert_conn->tx_desc for iSCSI response PDU and attach
+ 		 */
+@@ -2899,7 +3039,7 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
+ 		atomic_sub(wr->send_wr_num, &isert_conn->post_send_buf_count);
+ 	}
+ 
+-	if (se_cmd->prot_op == TARGET_PROT_NORMAL)
++	if (!isert_prot_cmd(isert_conn, se_cmd))
+ 		pr_debug("Cmd: %p posted RDMA_WRITE + Response for iSER Data "
+ 			 "READ\n", isert_cmd);
+ 	else
+@@ -3001,13 +3141,51 @@ isert_response_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state)
+ 	return ret;
+ }
+ 
++struct rdma_cm_id *
++isert_setup_id(struct isert_np *isert_np)
++{
++	struct iscsi_np *np = isert_np->np;
++	struct rdma_cm_id *id;
++	struct sockaddr *sa;
++	int ret;
++
++	sa = (struct sockaddr *)&np->np_sockaddr;
++	pr_debug("ksockaddr: %p, sa: %p\n", &np->np_sockaddr, sa);
++
++	id = rdma_create_id(isert_cma_handler, isert_np,
++			    RDMA_PS_TCP, IB_QPT_RC);
++	if (IS_ERR(id)) {
++		pr_err("rdma_create_id() failed: %ld\n", PTR_ERR(id));
++		ret = PTR_ERR(id);
++		goto out;
++	}
++	pr_debug("id %p context %p\n", id, id->context);
++
++	ret = rdma_bind_addr(id, sa);
++	if (ret) {
++		pr_err("rdma_bind_addr() failed: %d\n", ret);
++		goto out_id;
++	}
++
++	ret = rdma_listen(id, ISERT_RDMA_LISTEN_BACKLOG);
++	if (ret) {
++		pr_err("rdma_listen() failed: %d\n", ret);
++		goto out_id;
++	}
++
++	return id;
++out_id:
++	rdma_destroy_id(id);
++out:
++	return ERR_PTR(ret);
++}
++
+ static int
+ isert_setup_np(struct iscsi_np *np,
+ 	       struct __kernel_sockaddr_storage *ksockaddr)
+ {
+ 	struct isert_np *isert_np;
+ 	struct rdma_cm_id *isert_lid;
+-	struct sockaddr *sa;
+ 	int ret;
+ 
+ 	isert_np = kzalloc(sizeof(struct isert_np), GFP_KERNEL);
+@@ -3019,9 +3197,8 @@ isert_setup_np(struct iscsi_np *np,
+ 	mutex_init(&isert_np->np_accept_mutex);
+ 	INIT_LIST_HEAD(&isert_np->np_accept_list);
+ 	init_completion(&isert_np->np_login_comp);
++	isert_np->np = np;
+ 
+-	sa = (struct sockaddr *)ksockaddr;
+-	pr_debug("ksockaddr: %p, sa: %p\n", ksockaddr, sa);
+ 	/*
+ 	 * Setup the np->np_sockaddr from the passed sockaddr setup
+ 	 * in iscsi_target_configfs.c code..
+@@ -3029,37 +3206,20 @@ isert_setup_np(struct iscsi_np *np,
+ 	memcpy(&np->np_sockaddr, ksockaddr,
+ 	       sizeof(struct __kernel_sockaddr_storage));
+ 
+-	isert_lid = rdma_create_id(isert_cma_handler, np, RDMA_PS_TCP,
+-				IB_QPT_RC);
++	isert_lid = isert_setup_id(isert_np);
+ 	if (IS_ERR(isert_lid)) {
+-		pr_err("rdma_create_id() for isert_listen_handler failed: %ld\n",
+-		       PTR_ERR(isert_lid));
+ 		ret = PTR_ERR(isert_lid);
+ 		goto out;
+ 	}
+ 
+-	ret = rdma_bind_addr(isert_lid, sa);
+-	if (ret) {
+-		pr_err("rdma_bind_addr() for isert_lid failed: %d\n", ret);
+-		goto out_lid;
+-	}
+-
+-	ret = rdma_listen(isert_lid, ISERT_RDMA_LISTEN_BACKLOG);
+-	if (ret) {
+-		pr_err("rdma_listen() for isert_lid failed: %d\n", ret);
+-		goto out_lid;
+-	}
+-
+ 	isert_np->np_cm_id = isert_lid;
+ 	np->np_context = isert_np;
+-	pr_debug("Setup isert_lid->context: %p\n", isert_lid->context);
+ 
+ 	return 0;
+ 
+-out_lid:
+-	rdma_destroy_id(isert_lid);
+ out:
+ 	kfree(isert_np);
++
+ 	return ret;
+ }
+ 
+@@ -3094,7 +3254,15 @@ isert_get_login_rx(struct iscsi_conn *conn, struct iscsi_login *login)
+ 	struct isert_conn *isert_conn = (struct isert_conn *)conn->context;
+ 	int ret;
+ 
+-	pr_debug("isert_get_login_rx before conn_login_comp conn: %p\n", conn);
++	pr_info("before login_req comp conn: %p\n", isert_conn);
++	ret = wait_for_completion_interruptible(&isert_conn->login_req_comp);
++	if (ret) {
++		pr_err("isert_conn %p interrupted before got login req\n",
++			  isert_conn);
++		return ret;
++	}
++	reinit_completion(&isert_conn->login_req_comp);
++
+ 	/*
+ 	 * For login requests after the first PDU, isert_rx_login_req() will
+ 	 * kick schedule_delayed_work(&conn->login_work) as the packet is
+@@ -3104,11 +3272,15 @@ isert_get_login_rx(struct iscsi_conn *conn, struct iscsi_login *login)
+ 	if (!login->first_request)
+ 		return 0;
+ 
++	isert_rx_login_req(isert_conn);
++
++	pr_info("before conn_login_comp conn: %p\n", conn);
+ 	ret = wait_for_completion_interruptible(&isert_conn->conn_login_comp);
+ 	if (ret)
+ 		return ret;
+ 
+-	pr_debug("isert_get_login_rx processing login->req: %p\n", login->req);
++	pr_info("processing login->req: %p\n", login->req);
++
+ 	return 0;
+ }
+ 
+@@ -3186,17 +3358,10 @@ accept_wait:
+ 	isert_conn->conn = conn;
+ 	max_accept = 0;
+ 
+-	ret = isert_rdma_post_recvl(isert_conn);
+-	if (ret)
+-		return ret;
+-
+-	ret = isert_rdma_accept(isert_conn);
+-	if (ret)
+-		return ret;
+-
+ 	isert_set_conn_info(np, conn, isert_conn);
+ 
+-	pr_debug("Processing isert_accept_np: isert_conn: %p\n", isert_conn);
++	pr_debug("Processing isert_conn: %p\n", isert_conn);
++
+ 	return 0;
+ }
+ 
+@@ -3212,6 +3377,24 @@ isert_free_np(struct iscsi_np *np)
+ 	kfree(isert_np);
+ }
+ 
++static void isert_release_work(struct work_struct *work)
++{
++	struct isert_conn *isert_conn = container_of(work,
++						     struct isert_conn,
++						     release_work);
++
++	pr_info("Starting release conn %p\n", isert_conn);
++
++	wait_for_completion(&isert_conn->conn_wait);
++
++	mutex_lock(&isert_conn->conn_mutex);
++	isert_conn->state = ISER_CONN_DOWN;
++	mutex_unlock(&isert_conn->conn_mutex);
++
++	pr_info("Destroying conn %p\n", isert_conn);
++	isert_put_conn(isert_conn);
++}
++
+ static void isert_wait_conn(struct iscsi_conn *conn)
+ {
+ 	struct isert_conn *isert_conn = conn->context;
+@@ -3219,10 +3402,6 @@ static void isert_wait_conn(struct iscsi_conn *conn)
+ 	pr_debug("isert_wait_conn: Starting \n");
+ 
+ 	mutex_lock(&isert_conn->conn_mutex);
+-	if (isert_conn->conn_cm_id && !isert_conn->disconnect) {
+-		pr_debug("Calling rdma_disconnect from isert_wait_conn\n");
+-		rdma_disconnect(isert_conn->conn_cm_id);
+-	}
+ 	/*
+ 	 * Only wait for conn_wait_comp_err if the isert_conn made it
+ 	 * into full feature phase..
+@@ -3231,14 +3410,13 @@ static void isert_wait_conn(struct iscsi_conn *conn)
+ 		mutex_unlock(&isert_conn->conn_mutex);
+ 		return;
+ 	}
+-	if (isert_conn->state == ISER_CONN_UP)
+-		isert_conn->state = ISER_CONN_TERMINATING;
++	isert_conn_terminate(isert_conn);
+ 	mutex_unlock(&isert_conn->conn_mutex);
+ 
+ 	wait_for_completion(&isert_conn->conn_wait_comp_err);
+ 
+-	wait_for_completion(&isert_conn->conn_wait);
+-	isert_put_conn(isert_conn);
++	INIT_WORK(&isert_conn->release_work, isert_release_work);
++	queue_work(isert_release_wq, &isert_conn->release_work);
+ }
+ 
+ static void isert_free_conn(struct iscsi_conn *conn)
+@@ -3286,10 +3464,21 @@ static int __init isert_init(void)
+ 		goto destroy_rx_wq;
+ 	}
+ 
++	isert_release_wq = alloc_workqueue("isert_release_wq", WQ_UNBOUND,
++					WQ_UNBOUND_MAX_ACTIVE);
++	if (!isert_release_wq) {
++		pr_err("Unable to allocate isert_release_wq\n");
++		ret = -ENOMEM;
++		goto destroy_comp_wq;
++	}
++
+ 	iscsit_register_transport(&iser_target_transport);
+-	pr_debug("iSER_TARGET[0] - Loaded iser_target_transport\n");
++	pr_info("iSER_TARGET[0] - Loaded iser_target_transport\n");
++
+ 	return 0;
+ 
++destroy_comp_wq:
++	destroy_workqueue(isert_comp_wq);
+ destroy_rx_wq:
+ 	destroy_workqueue(isert_rx_wq);
+ 	return ret;
+@@ -3298,6 +3487,7 @@ destroy_rx_wq:
+ static void __exit isert_exit(void)
+ {
+ 	flush_scheduled_work();
++	destroy_workqueue(isert_release_wq);
+ 	destroy_workqueue(isert_comp_wq);
+ 	destroy_workqueue(isert_rx_wq);
+ 	iscsit_unregister_transport(&iser_target_transport);
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
+index 04f51f7bf614..141905f446dd 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.h
++++ b/drivers/infiniband/ulp/isert/ib_isert.h
+@@ -23,6 +23,7 @@ enum iser_ib_op_code {
+ enum iser_conn_state {
+ 	ISER_CONN_INIT,
+ 	ISER_CONN_UP,
++	ISER_CONN_FULL_FEATURE,
+ 	ISER_CONN_TERMINATING,
+ 	ISER_CONN_DOWN,
+ };
+@@ -81,6 +82,12 @@ struct isert_data_buf {
+ 	enum dma_data_direction dma_dir;
+ };
+ 
++enum {
++	DATA = 0,
++	PROT = 1,
++	SIG = 2,
++};
++
+ struct isert_rdma_wr {
+ 	struct list_head	wr_list;
+ 	struct isert_cmd	*isert_cmd;
+@@ -90,6 +97,7 @@ struct isert_rdma_wr {
+ 	int			send_wr_num;
+ 	struct ib_send_wr	*send_wr;
+ 	struct ib_send_wr	s_send_wr;
++	struct ib_sge		ib_sg[3];
+ 	struct isert_data_buf	data;
+ 	struct isert_data_buf	prot;
+ 	struct fast_reg_descriptor *fr_desc;
+@@ -120,11 +128,13 @@ struct isert_conn {
+ 	atomic_t		post_send_buf_count;
+ 	u32			responder_resources;
+ 	u32			initiator_depth;
++	bool			pi_support;
+ 	u32			max_sge;
+ 	char			*login_buf;
+ 	char			*login_req_buf;
+ 	char			*login_rsp_buf;
+ 	u64			login_req_dma;
++	int			login_req_len;
+ 	u64			login_rsp_dma;
+ 	unsigned int		conn_rx_desc_head;
+ 	struct iser_rx_desc	*conn_rx_descs;
+@@ -132,13 +142,13 @@ struct isert_conn {
+ 	struct iscsi_conn	*conn;
+ 	struct list_head	conn_accept_node;
+ 	struct completion	conn_login_comp;
++	struct completion	login_req_comp;
+ 	struct iser_tx_desc	conn_login_tx_desc;
+ 	struct rdma_cm_id	*conn_cm_id;
+ 	struct ib_pd		*conn_pd;
+ 	struct ib_mr		*conn_mr;
+ 	struct ib_qp		*conn_qp;
+ 	struct isert_device	*conn_device;
+-	struct work_struct	conn_logout_work;
+ 	struct mutex		conn_mutex;
+ 	struct completion	conn_wait;
+ 	struct completion	conn_wait_comp_err;
+@@ -147,10 +157,10 @@ struct isert_conn {
+ 	int			conn_fr_pool_size;
+ 	/* lock to protect fastreg pool */
+ 	spinlock_t		conn_lock;
++	struct work_struct	release_work;
+ #define ISERT_COMP_BATCH_COUNT	8
+ 	int			conn_comp_batch;
+ 	struct llist_head	conn_comp_llist;
+-	bool                    disconnect;
+ };
+ 
+ #define ISERT_MAX_CQ 64
+@@ -182,6 +192,7 @@ struct isert_device {
+ };
+ 
+ struct isert_np {
++	struct iscsi_np         *np;
+ 	struct semaphore	np_sem;
+ 	struct rdma_cm_id	*np_cm_id;
+ 	struct mutex		np_accept_mutex;
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index f2b978026407..77ecf6d32237 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1520,6 +1520,8 @@ static int elantech_set_properties(struct elantech_data *etd)
+ 		case 7:
+ 		case 8:
+ 		case 9:
++		case 10:
++		case 13:
+ 			etd->hw_version = 4;
+ 			break;
+ 		default:
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index faeeb1372462..1a858c86a72b 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -415,6 +415,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ 		},
+ 	},
+ 	{
++		/* Acer Aspire 7738 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"),
++		},
++	},
++	{
+ 		/* Gericom Bellagio */
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
+@@ -735,6 +742,35 @@ static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = {
+ 	{ }
+ };
+ 
++/*
++ * Some laptops need keyboard reset before probing for the trackpad to get
++ * it detected, initialised & finally work.
++ */
++static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
++	{
++		/* Gigabyte P35 v2 - Elantech touchpad */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"),
++		},
++	},
++		{
++		/* Aorus branded Gigabyte X3 Plus - Elantech touchpad */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "X3"),
++		},
++	},
++	{
++		/* Gigabyte P34 - Elantech touchpad */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
++		},
++	},
++	{ }
++};
++
+ #endif /* CONFIG_X86 */
+ 
+ #ifdef CONFIG_PNP
+@@ -1030,6 +1066,9 @@ static int __init i8042_platform_init(void)
+ 	if (dmi_check_system(i8042_dmi_dritek_table))
+ 		i8042_dritek = true;
+ 
++	if (dmi_check_system(i8042_dmi_kbdreset_table))
++		i8042_kbdreset = true;
++
+ 	/*
+ 	 * A20 was already enabled during early kernel init. But some buggy
+ 	 * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index f5a98af3b325..804d2e02010a 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -67,6 +67,10 @@ static bool i8042_notimeout;
+ module_param_named(notimeout, i8042_notimeout, bool, 0);
+ MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042");
+ 
++static bool i8042_kbdreset;
++module_param_named(kbdreset, i8042_kbdreset, bool, 0);
++MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port");
++
+ #ifdef CONFIG_X86
+ static bool i8042_dritek;
+ module_param_named(dritek, i8042_dritek, bool, 0);
+@@ -790,6 +794,16 @@ static int __init i8042_check_aux(void)
+ 		return -1;
+ 
+ /*
++ * Reset keyboard (needed on some laptops to successfully detect
++ * touchpad, e.g., some Gigabyte laptop models with Elantech
++ * touchpads).
++ */
++	if (i8042_kbdreset) {
++		pr_warn("Attempting to reset device connected to KBD port\n");
++		i8042_kbd_write(NULL, (unsigned char) 0xff);
++	}
++
++/*
+  * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and
+  * used it for a PCI card or somethig else.
+  */
+diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c
+index 64fde485dcaa..4c794f15a57f 100644
+--- a/drivers/leds/leds-netxbig.c
++++ b/drivers/leds/leds-netxbig.c
+@@ -330,18 +330,18 @@ create_netxbig_led(struct platform_device *pdev,
+ 	led_dat->sata = 0;
+ 	led_dat->cdev.brightness = LED_OFF;
+ 	led_dat->cdev.flags |= LED_CORE_SUSPENDRESUME;
+-	/*
+-	 * If available, expose the SATA activity blink capability through
+-	 * a "sata" sysfs attribute.
+-	 */
+-	if (led_dat->mode_val[NETXBIG_LED_SATA] != NETXBIG_LED_INVALID_MODE)
+-		led_dat->cdev.groups = netxbig_led_groups;
+ 	led_dat->mode_addr = template->mode_addr;
+ 	led_dat->mode_val = template->mode_val;
+ 	led_dat->bright_addr = template->bright_addr;
+ 	led_dat->bright_max = (1 << pdata->gpio_ext->num_data) - 1;
+ 	led_dat->timer = pdata->timer;
+ 	led_dat->num_timer = pdata->num_timer;
++	/*
++	 * If available, expose the SATA activity blink capability through
++	 * a "sata" sysfs attribute.
++	 */
++	if (led_dat->mode_val[NETXBIG_LED_SATA] != NETXBIG_LED_INVALID_MODE)
++		led_dat->cdev.groups = netxbig_led_groups;
+ 
+ 	return led_classdev_register(&pdev->dev, &led_dat->cdev);
+ }
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 58f3927fd7cc..62c51364cf9e 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -899,7 +899,7 @@ static void disable_write_same(struct mapped_device *md)
+ 
+ static void clone_endio(struct bio *bio, int error)
+ {
+-	int r = 0;
++	int r = error;
+ 	struct dm_target_io *tio = container_of(bio, struct dm_target_io, clone);
+ 	struct dm_io *io = tio->io;
+ 	struct mapped_device *md = tio->io->md;
+diff --git a/drivers/media/i2c/smiapp-pll.c b/drivers/media/i2c/smiapp-pll.c
+index 2335529b195c..ab5d9a3adebf 100644
+--- a/drivers/media/i2c/smiapp-pll.c
++++ b/drivers/media/i2c/smiapp-pll.c
+@@ -67,7 +67,7 @@ static void print_pll(struct device *dev, struct smiapp_pll *pll)
+ {
+ 	dev_dbg(dev, "pre_pll_clk_div\t%d\n",  pll->pre_pll_clk_div);
+ 	dev_dbg(dev, "pll_multiplier \t%d\n",  pll->pll_multiplier);
+-	if (pll->flags != SMIAPP_PLL_FLAG_NO_OP_CLOCKS) {
++	if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) {
+ 		dev_dbg(dev, "op_sys_clk_div \t%d\n", pll->op_sys_clk_div);
+ 		dev_dbg(dev, "op_pix_clk_div \t%d\n", pll->op_pix_clk_div);
+ 	}
+@@ -77,7 +77,7 @@ static void print_pll(struct device *dev, struct smiapp_pll *pll)
+ 	dev_dbg(dev, "ext_clk_freq_hz \t%d\n", pll->ext_clk_freq_hz);
+ 	dev_dbg(dev, "pll_ip_clk_freq_hz \t%d\n", pll->pll_ip_clk_freq_hz);
+ 	dev_dbg(dev, "pll_op_clk_freq_hz \t%d\n", pll->pll_op_clk_freq_hz);
+-	if (pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS) {
++	if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) {
+ 		dev_dbg(dev, "op_sys_clk_freq_hz \t%d\n",
+ 			pll->op_sys_clk_freq_hz);
+ 		dev_dbg(dev, "op_pix_clk_freq_hz \t%d\n",
+diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
+index b10aaeda2bb4..b49254e4ea0a 100644
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -2677,7 +2677,9 @@ static int smiapp_registered(struct v4l2_subdev *subdev)
+ 		pll->flags |= SMIAPP_PLL_FLAG_NO_OP_CLOCKS;
+ 	pll->scale_n = sensor->limits[SMIAPP_LIMIT_SCALER_N_MIN];
+ 
++	mutex_lock(&sensor->mutex);
+ 	rval = smiapp_update_mode(sensor);
++	mutex_unlock(&sensor->mutex);
+ 	if (rval) {
+ 		dev_err(&client->dev, "update mode failed\n");
+ 		goto out_nvm_release;
+diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c
+index 69c2dbd2d165..501d5ef682e5 100644
+--- a/drivers/media/platform/vivid/vivid-vid-out.c
++++ b/drivers/media/platform/vivid/vivid-vid-out.c
+@@ -612,7 +612,7 @@ int vivid_vid_out_g_selection(struct file *file, void *priv,
+ 		sel->r = dev->fmt_out_rect;
+ 		break;
+ 	case V4L2_SEL_TGT_CROP_BOUNDS:
+-		if (!dev->has_compose_out)
++		if (!dev->has_crop_out)
+ 			return -EINVAL;
+ 		sel->r = vivid_max_rect;
+ 		break;
+diff --git a/drivers/media/rc/img-ir/img-ir-hw.c b/drivers/media/rc/img-ir/img-ir-hw.c
+index ec49f94425fc..2fd47c9bf5d8 100644
+--- a/drivers/media/rc/img-ir/img-ir-hw.c
++++ b/drivers/media/rc/img-ir/img-ir-hw.c
+@@ -530,6 +530,22 @@ static void img_ir_set_decoder(struct img_ir_priv *priv,
+ 	u32 ir_status, irq_en;
+ 	spin_lock_irq(&priv->lock);
+ 
++	/*
++	 * First record that the protocol is being stopped so that the end timer
++	 * isn't restarted while we're trying to stop it.
++	 */
++	hw->stopping = true;
++
++	/*
++	 * Release the lock to stop the end timer, since the end timer handler
++	 * acquires the lock and we don't want to deadlock waiting for it.
++	 */
++	spin_unlock_irq(&priv->lock);
++	del_timer_sync(&hw->end_timer);
++	spin_lock_irq(&priv->lock);
++
++	hw->stopping = false;
++
+ 	/* switch off and disable interrupts */
+ 	img_ir_write(priv, IMG_IR_CONTROL, 0);
+ 	irq_en = img_ir_read(priv, IMG_IR_IRQ_ENABLE);
+@@ -541,12 +557,13 @@ static void img_ir_set_decoder(struct img_ir_priv *priv,
+ 	if (ir_status & (IMG_IR_RXDVAL | IMG_IR_RXDVALD2)) {
+ 		ir_status &= ~(IMG_IR_RXDVAL | IMG_IR_RXDVALD2);
+ 		img_ir_write(priv, IMG_IR_STATUS, ir_status);
+-		img_ir_read(priv, IMG_IR_DATA_LW);
+-		img_ir_read(priv, IMG_IR_DATA_UP);
+ 	}
+ 
+-	/* stop the end timer and switch back to normal mode */
+-	del_timer_sync(&hw->end_timer);
++	/* always read data to clear buffer if IR wakes the device */
++	img_ir_read(priv, IMG_IR_DATA_LW);
++	img_ir_read(priv, IMG_IR_DATA_UP);
++
++	/* switch back to normal mode */
+ 	hw->mode = IMG_IR_M_NORMAL;
+ 
+ 	/* clear the wakeup scancode filter */
+@@ -817,7 +834,8 @@ static void img_ir_handle_data(struct img_ir_priv *priv, u32 len, u64 raw)
+ 	}
+ 
+ 
+-	if (dec->repeat) {
++	/* we mustn't update the end timer while trying to stop it */
++	if (dec->repeat && !hw->stopping) {
+ 		unsigned long interval;
+ 
+ 		img_ir_begin_repeat(priv);
+diff --git a/drivers/media/rc/img-ir/img-ir-hw.h b/drivers/media/rc/img-ir/img-ir-hw.h
+index 8fcc16c32c5b..307ddcd1a99e 100644
+--- a/drivers/media/rc/img-ir/img-ir-hw.h
++++ b/drivers/media/rc/img-ir/img-ir-hw.h
+@@ -214,6 +214,8 @@ enum img_ir_mode {
+  * @flags:		IMG_IR_F_*.
+  * @filters:		HW filters (derived from scancode filters).
+  * @mode:		Current decode mode.
++ * @stopping:		Indicates that decoder is being taken down and timers
++ *			should not be restarted.
+  * @suspend_irqen:	Saved IRQ enable mask over suspend.
+  */
+ struct img_ir_priv_hw {
+@@ -229,6 +231,7 @@ struct img_ir_priv_hw {
+ 	struct img_ir_filter		filters[RC_FILTER_MAX];
+ 
+ 	enum img_ir_mode		mode;
++	bool				stopping;
+ 	u32				suspend_irqen;
+ };
+ 
+diff --git a/drivers/media/usb/au0828/au0828-cards.c b/drivers/media/usb/au0828/au0828-cards.c
+index 9eb77ac2153b..da87f1cc31a9 100644
+--- a/drivers/media/usb/au0828/au0828-cards.c
++++ b/drivers/media/usb/au0828/au0828-cards.c
+@@ -36,6 +36,11 @@ static void hvr950q_cs5340_audio(void *priv, int enable)
+ 		au0828_clear(dev, REG_000, 0x10);
+ }
+ 
++/*
++ * WARNING: There's a quirks table at sound/usb/quirks-table.h
++ * that should also be updated every time a new device with V4L2 support
++ * is added here.
++ */
+ struct au0828_board au0828_boards[] = {
+ 	[AU0828_BOARD_UNKNOWN] = {
+ 		.name	= "Unknown board",
+diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
+index 3f4361e48a32..efa782ed6e2d 100644
+--- a/drivers/media/usb/dvb-usb/af9005.c
++++ b/drivers/media/usb/dvb-usb/af9005.c
+@@ -1081,9 +1081,12 @@ static int __init af9005_usb_module_init(void)
+ 		err("usb_register failed. (%d)", result);
+ 		return result;
+ 	}
++#if IS_MODULE(CONFIG_DVB_USB_AF9005) || defined(CONFIG_DVB_USB_AF9005_REMOTE)
++	/* FIXME: convert to todays kernel IR infrastructure */
+ 	rc_decode = symbol_request(af9005_rc_decode);
+ 	rc_keys = symbol_request(rc_map_af9005_table);
+ 	rc_keys_size = symbol_request(rc_map_af9005_table_size);
++#endif
+ 	if (rc_decode == NULL || rc_keys == NULL || rc_keys_size == NULL) {
+ 		err("af9005_rc_decode function not found, disabling remote");
+ 		af9005_properties.rc.legacy.rc_query = NULL;
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 7c8322d4fc63..3c07af96b30f 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -1623,12 +1623,12 @@ static void uvc_delete(struct uvc_device *dev)
+ {
+ 	struct list_head *p, *n;
+ 
+-	usb_put_intf(dev->intf);
+-	usb_put_dev(dev->udev);
+-
+ 	uvc_status_cleanup(dev);
+ 	uvc_ctrl_cleanup_device(dev);
+ 
++	usb_put_intf(dev->intf);
++	usb_put_dev(dev->udev);
++
+ 	if (dev->vdev.dev)
+ 		v4l2_device_unregister(&dev->vdev);
+ #ifdef CONFIG_MEDIA_CONTROLLER
+diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
+index cca472109135..51fd6b524371 100644
+--- a/drivers/misc/cxl/context.c
++++ b/drivers/misc/cxl/context.c
+@@ -34,7 +34,8 @@ struct cxl_context *cxl_context_alloc(void)
+ /*
+  * Initialises a CXL context.
+  */
+-int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master)
++int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master,
++		     struct address_space *mapping)
+ {
+ 	int i;
+ 
+@@ -42,6 +43,8 @@ int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master)
+ 	ctx->afu = afu;
+ 	ctx->master = master;
+ 	ctx->pid = NULL; /* Set in start work ioctl */
++	mutex_init(&ctx->mapping_lock);
++	ctx->mapping = mapping;
+ 
+ 	/*
+ 	 * Allocate the segment table before we put it in the IDR so that we
+@@ -82,12 +85,12 @@ int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master)
+ 	 * Allocating IDR! We better make sure everything's setup that
+ 	 * dereferences from it.
+ 	 */
++	mutex_lock(&afu->contexts_lock);
+ 	idr_preload(GFP_KERNEL);
+-	spin_lock(&afu->contexts_lock);
+ 	i = idr_alloc(&ctx->afu->contexts_idr, ctx, 0,
+ 		      ctx->afu->num_procs, GFP_NOWAIT);
+-	spin_unlock(&afu->contexts_lock);
+ 	idr_preload_end();
++	mutex_unlock(&afu->contexts_lock);
+ 	if (i < 0)
+ 		return i;
+ 
+@@ -147,6 +150,12 @@ static void __detach_context(struct cxl_context *ctx)
+ 	afu_release_irqs(ctx);
+ 	flush_work(&ctx->fault_work); /* Only needed for dedicated process */
+ 	wake_up_all(&ctx->wq);
++
++	/* Release Problem State Area mapping */
++	mutex_lock(&ctx->mapping_lock);
++	if (ctx->mapping)
++		unmap_mapping_range(ctx->mapping, 0, 0, 1);
++	mutex_unlock(&ctx->mapping_lock);
+ }
+ 
+ /*
+@@ -168,21 +177,22 @@ void cxl_context_detach_all(struct cxl_afu *afu)
+ 	struct cxl_context *ctx;
+ 	int tmp;
+ 
+-	rcu_read_lock();
+-	idr_for_each_entry(&afu->contexts_idr, ctx, tmp)
++	mutex_lock(&afu->contexts_lock);
++	idr_for_each_entry(&afu->contexts_idr, ctx, tmp) {
+ 		/*
+ 		 * Anything done in here needs to be setup before the IDR is
+ 		 * created and torn down after the IDR removed
+ 		 */
+ 		__detach_context(ctx);
+-	rcu_read_unlock();
++	}
++	mutex_unlock(&afu->contexts_lock);
+ }
+ 
+ void cxl_context_free(struct cxl_context *ctx)
+ {
+-	spin_lock(&ctx->afu->contexts_lock);
++	mutex_lock(&ctx->afu->contexts_lock);
+ 	idr_remove(&ctx->afu->contexts_idr, ctx->pe);
+-	spin_unlock(&ctx->afu->contexts_lock);
++	mutex_unlock(&ctx->afu->contexts_lock);
+ 	synchronize_rcu();
+ 
+ 	free_page((u64)ctx->sstp);
+diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h
+index 3d2b8677ec8a..6ee785da574e 100644
+--- a/drivers/misc/cxl/cxl.h
++++ b/drivers/misc/cxl/cxl.h
+@@ -349,7 +349,7 @@ struct cxl_afu {
+ 	struct device *chardev_s, *chardev_m, *chardev_d;
+ 	struct idr contexts_idr;
+ 	struct dentry *debugfs;
+-	spinlock_t contexts_lock;
++	struct mutex contexts_lock;
+ 	struct mutex spa_mutex;
+ 	spinlock_t afu_cntl_lock;
+ 
+@@ -390,6 +390,10 @@ struct cxl_context {
+ 	phys_addr_t psn_phys;
+ 	u64 psn_size;
+ 
++	/* Used to unmap any mmaps when force detaching */
++	struct address_space *mapping;
++	struct mutex mapping_lock;
++
+ 	spinlock_t sste_lock; /* Protects segment table entries */
+ 	struct cxl_sste *sstp;
+ 	u64 sstp0, sstp1;
+@@ -592,7 +596,8 @@ int cxl_alloc_sst(struct cxl_context *ctx);
+ void init_cxl_native(void);
+ 
+ struct cxl_context *cxl_context_alloc(void);
+-int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master);
++int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master,
++		     struct address_space *mapping);
+ void cxl_context_free(struct cxl_context *ctx);
+ int cxl_context_iomap(struct cxl_context *ctx, struct vm_area_struct *vma);
+ 
+diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
+index 378b099e7c0b..e9f2f10dbb37 100644
+--- a/drivers/misc/cxl/file.c
++++ b/drivers/misc/cxl/file.c
+@@ -77,7 +77,7 @@ static int __afu_open(struct inode *inode, struct file *file, bool master)
+ 		goto err_put_afu;
+ 	}
+ 
+-	if ((rc = cxl_context_init(ctx, afu, master)))
++	if ((rc = cxl_context_init(ctx, afu, master, inode->i_mapping)))
+ 		goto err_put_afu;
+ 
+ 	pr_devel("afu_open pe: %i\n", ctx->pe);
+@@ -113,6 +113,10 @@ static int afu_release(struct inode *inode, struct file *file)
+ 		 __func__, ctx->pe);
+ 	cxl_context_detach(ctx);
+ 
++	mutex_lock(&ctx->mapping_lock);
++	ctx->mapping = NULL;
++	mutex_unlock(&ctx->mapping_lock);
++
+ 	put_device(&ctx->afu->dev);
+ 
+ 	/*
+diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
+index d47532e8f4f1..1d9717b4d67a 100644
+--- a/drivers/misc/cxl/native.c
++++ b/drivers/misc/cxl/native.c
+@@ -277,6 +277,7 @@ static int do_process_element_cmd(struct cxl_context *ctx,
+ 				  u64 cmd, u64 pe_state)
+ {
+ 	u64 state;
++	unsigned long timeout = jiffies + (HZ * CXL_TIMEOUT);
+ 
+ 	WARN_ON(!ctx->afu->enabled);
+ 
+@@ -286,6 +287,10 @@ static int do_process_element_cmd(struct cxl_context *ctx,
+ 	smp_mb();
+ 	cxl_p1n_write(ctx->afu, CXL_PSL_LLCMD_An, cmd | ctx->pe);
+ 	while (1) {
++		if (time_after_eq(jiffies, timeout)) {
++			dev_warn(&ctx->afu->dev, "WARNING: Process Element Command timed out!\n");
++			return -EBUSY;
++		}
+ 		state = be64_to_cpup(ctx->afu->sw_command_status);
+ 		if (state == ~0ULL) {
+ 			pr_err("cxl: Error adding process element to AFU\n");
+@@ -610,13 +615,6 @@ static inline int detach_process_native_dedicated(struct cxl_context *ctx)
+ 	return 0;
+ }
+ 
+-/*
+- * TODO: handle case when this is called inside a rcu_read_lock() which may
+- * happen when we unbind the driver (ie. cxl_context_detach_all()) .  Terminate
+- * & remove use a mutex lock and schedule which will not good with lock held.
+- * May need to write do_process_element_cmd() that handles outstanding page
+- * faults synchronously.
+- */
+ static inline int detach_process_native_afu_directed(struct cxl_context *ctx)
+ {
+ 	if (!ctx->pe_inserted)
+diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
+index 10c98ab7f46e..0f2cc9f8b4db 100644
+--- a/drivers/misc/cxl/pci.c
++++ b/drivers/misc/cxl/pci.c
+@@ -502,7 +502,7 @@ static struct cxl_afu *cxl_alloc_afu(struct cxl *adapter, int slice)
+ 	afu->dev.release = cxl_release_afu;
+ 	afu->slice = slice;
+ 	idr_init(&afu->contexts_idr);
+-	spin_lock_init(&afu->contexts_lock);
++	mutex_init(&afu->contexts_lock);
+ 	spin_lock_init(&afu->afu_cntl_lock);
+ 	mutex_init(&afu->spa_mutex);
+ 
+diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c
+index ce7ec06d87d1..461bdbd5d483 100644
+--- a/drivers/misc/cxl/sysfs.c
++++ b/drivers/misc/cxl/sysfs.c
+@@ -121,7 +121,7 @@ static ssize_t reset_store_afu(struct device *device,
+ 	int rc;
+ 
+ 	/* Not safe to reset if it is currently in use */
+-	spin_lock(&afu->contexts_lock);
++	mutex_lock(&afu->contexts_lock);
+ 	if (!idr_is_empty(&afu->contexts_idr)) {
+ 		rc = -EBUSY;
+ 		goto err;
+@@ -132,7 +132,7 @@ static ssize_t reset_store_afu(struct device *device,
+ 
+ 	rc = count;
+ err:
+-	spin_unlock(&afu->contexts_lock);
++	mutex_unlock(&afu->contexts_lock);
+ 	return rc;
+ }
+ 
+@@ -247,7 +247,7 @@ static ssize_t mode_store(struct device *device, struct device_attribute *attr,
+ 	int rc = -EBUSY;
+ 
+ 	/* can't change this if we have a user */
+-	spin_lock(&afu->contexts_lock);
++	mutex_lock(&afu->contexts_lock);
+ 	if (!idr_is_empty(&afu->contexts_idr))
+ 		goto err;
+ 
+@@ -271,7 +271,7 @@ static ssize_t mode_store(struct device *device, struct device_attribute *attr,
+ 	afu->current_mode = 0;
+ 	afu->num_procs = 0;
+ 
+-	spin_unlock(&afu->contexts_lock);
++	mutex_unlock(&afu->contexts_lock);
+ 
+ 	if ((rc = _cxl_afu_deactivate_mode(afu, old_mode)))
+ 		return rc;
+@@ -280,7 +280,7 @@ static ssize_t mode_store(struct device *device, struct device_attribute *attr,
+ 
+ 	return count;
+ err:
+-	spin_unlock(&afu->contexts_lock);
++	mutex_unlock(&afu->contexts_lock);
+ 	return rc;
+ }
+ 
+diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
+index 4f2fd6fc1e23..432aec8dd3ce 100644
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -234,6 +234,18 @@ static int mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
+ 	struct mei_me_hw *hw = to_me_hw(dev);
+ 	u32 hcsr = mei_hcsr_read(hw);
+ 
++	/* H_RST may be found lit before reset is started,
++	 * for example if preceding reset flow hasn't completed.
++	 * In that case asserting H_RST will be ignored, therefore
++	 * we need to clean H_RST bit to start a successful reset sequence.
++	 */
++	if ((hcsr & H_RST) == H_RST) {
++		dev_warn(dev->dev, "H_RST is set = 0x%08X", hcsr);
++		hcsr &= ~H_RST;
++		mei_me_reg_write(hw, H_CSR, hcsr);
++		hcsr = mei_hcsr_read(hw);
++	}
++
+ 	hcsr |= H_RST | H_IG | H_IS;
+ 
+ 	if (intr_enable)
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 7625bd791fca..023c2010cd75 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1239,6 +1239,12 @@ static void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
+ 		spin_unlock_irq(&host->lock);
+ 		mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
+ 		spin_lock_irq(&host->lock);
++
++		if (mode != MMC_POWER_OFF)
++			sdhci_writeb(host, SDHCI_POWER_ON, SDHCI_POWER_CONTROL);
++		else
++			sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
++
+ 		return;
+ 	}
+ 
+diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
+index 541fb7a05625..cc7bfc0c0a71 100644
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -1246,6 +1246,9 @@ static int kvaser_usb_close(struct net_device *netdev)
+ 	if (err)
+ 		netdev_warn(netdev, "Cannot stop device, error %d\n", err);
+ 
++	/* reset tx contexts */
++	kvaser_usb_unlink_tx_urbs(priv);
++
+ 	priv->can.state = CAN_STATE_STOPPED;
+ 	close_candev(priv->netdev);
+ 
+@@ -1294,12 +1297,14 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+ 	if (!urb) {
+ 		netdev_err(netdev, "No memory left for URBs\n");
+ 		stats->tx_dropped++;
+-		goto nourbmem;
++		dev_kfree_skb(skb);
++		return NETDEV_TX_OK;
+ 	}
+ 
+ 	buf = kmalloc(sizeof(struct kvaser_msg), GFP_ATOMIC);
+ 	if (!buf) {
+ 		stats->tx_dropped++;
++		dev_kfree_skb(skb);
+ 		goto nobufmem;
+ 	}
+ 
+@@ -1334,6 +1339,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+ 		}
+ 	}
+ 
++	/* This should never happen; it implies a flow control bug */
+ 	if (!context) {
+ 		netdev_warn(netdev, "cannot find free context\n");
+ 		ret =  NETDEV_TX_BUSY;
+@@ -1364,9 +1370,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+ 	if (unlikely(err)) {
+ 		can_free_echo_skb(netdev, context->echo_index);
+ 
+-		skb = NULL; /* set to NULL to avoid double free in
+-			     * dev_kfree_skb(skb) */
+-
+ 		atomic_dec(&priv->active_tx_urbs);
+ 		usb_unanchor_urb(urb);
+ 
+@@ -1388,8 +1391,6 @@ releasebuf:
+ 	kfree(buf);
+ nobufmem:
+ 	usb_free_urb(urb);
+-nourbmem:
+-	dev_kfree_skb(skb);
+ 	return ret;
+ }
+ 
+@@ -1502,6 +1503,10 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
+ 	struct kvaser_usb_net_priv *priv;
+ 	int i, err;
+ 
++	err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel);
++	if (err)
++		return err;
++
+ 	netdev = alloc_candev(sizeof(*priv), MAX_TX_URBS);
+ 	if (!netdev) {
+ 		dev_err(&intf->dev, "Cannot alloc candev\n");
+@@ -1606,9 +1611,6 @@ static int kvaser_usb_probe(struct usb_interface *intf,
+ 
+ 	usb_set_intfdata(intf, dev);
+ 
+-	for (i = 0; i < MAX_NET_DEVICES; i++)
+-		kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, i);
+-
+ 	err = kvaser_usb_get_software_info(dev);
+ 	if (err) {
+ 		dev_err(&intf->dev,
+diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
+index e398eda07298..c8af3ce3ea38 100644
+--- a/drivers/net/ethernet/atheros/alx/main.c
++++ b/drivers/net/ethernet/atheros/alx/main.c
+@@ -184,15 +184,16 @@ static void alx_schedule_reset(struct alx_priv *alx)
+ 	schedule_work(&alx->reset_wk);
+ }
+ 
+-static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
++static int alx_clean_rx_irq(struct alx_priv *alx, int budget)
+ {
+ 	struct alx_rx_queue *rxq = &alx->rxq;
+ 	struct alx_rrd *rrd;
+ 	struct alx_buffer *rxb;
+ 	struct sk_buff *skb;
+ 	u16 length, rfd_cleaned = 0;
++	int work = 0;
+ 
+-	while (budget > 0) {
++	while (work < budget) {
+ 		rrd = &rxq->rrd[rxq->rrd_read_idx];
+ 		if (!(rrd->word3 & cpu_to_le32(1 << RRD_UPDATED_SHIFT)))
+ 			break;
+@@ -203,7 +204,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
+ 		    ALX_GET_FIELD(le32_to_cpu(rrd->word0),
+ 				  RRD_NOR) != 1) {
+ 			alx_schedule_reset(alx);
+-			return 0;
++			return work;
+ 		}
+ 
+ 		rxb = &rxq->bufs[rxq->read_idx];
+@@ -243,7 +244,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
+ 		}
+ 
+ 		napi_gro_receive(&alx->napi, skb);
+-		budget--;
++		work++;
+ 
+ next_pkt:
+ 		if (++rxq->read_idx == alx->rx_ringsz)
+@@ -258,21 +259,22 @@ next_pkt:
+ 	if (rfd_cleaned)
+ 		alx_refill_rx_ring(alx, GFP_ATOMIC);
+ 
+-	return budget > 0;
++	return work;
+ }
+ 
+ static int alx_poll(struct napi_struct *napi, int budget)
+ {
+ 	struct alx_priv *alx = container_of(napi, struct alx_priv, napi);
+ 	struct alx_hw *hw = &alx->hw;
+-	bool complete = true;
+ 	unsigned long flags;
++	bool tx_complete;
++	int work;
+ 
+-	complete = alx_clean_tx_irq(alx) &&
+-		   alx_clean_rx_irq(alx, budget);
++	tx_complete = alx_clean_tx_irq(alx);
++	work = alx_clean_rx_irq(alx, budget);
+ 
+-	if (!complete)
+-		return 1;
++	if (!tx_complete || work == budget)
++		return budget;
+ 
+ 	napi_complete(&alx->napi);
+ 
+@@ -284,7 +286,7 @@ static int alx_poll(struct napi_struct *napi, int budget)
+ 
+ 	alx_post_write(hw);
+ 
+-	return 0;
++	return work;
+ }
+ 
+ static irqreturn_t alx_intr_handle(struct alx_priv *alx, u32 intr)
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 77f8f836cbbe..5748542f6717 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -17789,23 +17789,6 @@ static int tg3_init_one(struct pci_dev *pdev,
+ 		goto err_out_apeunmap;
+ 	}
+ 
+-	/*
+-	 * Reset chip in case UNDI or EFI driver did not shutdown
+-	 * DMA self test will enable WDMAC and we'll see (spurious)
+-	 * pending DMA on the PCI bus at that point.
+-	 */
+-	if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
+-	    (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
+-		tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
+-		tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+-	}
+-
+-	err = tg3_test_dma(tp);
+-	if (err) {
+-		dev_err(&pdev->dev, "DMA engine test failed, aborting\n");
+-		goto err_out_apeunmap;
+-	}
+-
+ 	intmbx = MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW;
+ 	rcvmbx = MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW;
+ 	sndmbx = MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW;
+@@ -17850,6 +17833,23 @@ static int tg3_init_one(struct pci_dev *pdev,
+ 			sndmbx += 0xc;
+ 	}
+ 
++	/*
++	 * Reset chip in case UNDI or EFI driver did not shutdown
++	 * DMA self test will enable WDMAC and we'll see (spurious)
++	 * pending DMA on the PCI bus at that point.
++	 */
++	if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
++	    (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
++		tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
++		tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
++	}
++
++	err = tg3_test_dma(tp);
++	if (err) {
++		dev_err(&pdev->dev, "DMA engine test failed, aborting\n");
++		goto err_out_apeunmap;
++	}
++
+ 	tg3_init_coal(tp);
+ 
+ 	pci_set_drvdata(pdev, dev);
+diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
+index 73cf1653a4a3..167cd8ede397 100644
+--- a/drivers/net/ethernet/cisco/enic/enic_main.c
++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
+@@ -1059,10 +1059,14 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
+ 				     PKT_HASH_TYPE_L4 : PKT_HASH_TYPE_L3);
+ 		}
+ 
+-		if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc) {
+-			skb->csum = htons(checksum);
+-			skb->ip_summed = CHECKSUM_COMPLETE;
+-		}
++		/* Hardware does not provide whole packet checksum. It only
++		 * provides pseudo checksum. Since hw validates the packet
++		 * checksum but not provide us the checksum value. use
++		 * CHECSUM_UNNECESSARY.
++		 */
++		if ((netdev->features & NETIF_F_RXCSUM) && tcp_udp_csum_ok &&
++		    ipv4_csum_ok)
++			skb->ip_summed = CHECKSUM_UNNECESSARY;
+ 
+ 		if (vlan_stripped)
+ 			__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vlan_tci);
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index 597c463e384d..d2975fa7e549 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -4427,9 +4427,11 @@ static void be_del_vxlan_port(struct net_device *netdev, sa_family_t sa_family,
+ 		 be16_to_cpu(port));
+ }
+ 
+-static bool be_gso_check(struct sk_buff *skb, struct net_device *dev)
++static netdev_features_t be_features_check(struct sk_buff *skb,
++					   struct net_device *dev,
++					   netdev_features_t features)
+ {
+-	return vxlan_gso_check(skb);
++	return vxlan_features_check(skb, features);
+ }
+ #endif
+ 
+@@ -4460,7 +4462,7 @@ static const struct net_device_ops be_netdev_ops = {
+ #ifdef CONFIG_BE2NET_VXLAN
+ 	.ndo_add_vxlan_port	= be_add_vxlan_port,
+ 	.ndo_del_vxlan_port	= be_del_vxlan_port,
+-	.ndo_gso_check		= be_gso_check,
++	.ndo_features_check	= be_features_check,
+ #endif
+ };
+ 
+diff --git a/drivers/net/ethernet/intel/Kconfig b/drivers/net/ethernet/intel/Kconfig
+index 5b8300a32bf5..4d61ef50b465 100644
+--- a/drivers/net/ethernet/intel/Kconfig
++++ b/drivers/net/ethernet/intel/Kconfig
+@@ -281,6 +281,17 @@ config I40E_DCB
+ 
+ 	  If unsure, say N.
+ 
++config I40E_FCOE
++	bool "Fibre Channel over Ethernet (FCoE)"
++	default n
++	depends on I40E && DCB && FCOE
++	---help---
++	  Say Y here if you want to use Fibre Channel over Ethernet (FCoE)
++	  in the driver. This will create new netdev for exclusive FCoE
++	  use with XL710 FCoE offloads enabled.
++
++	  If unsure, say N.
++
+ config I40EVF
+ 	tristate "Intel(R) XL710 X710 Virtual Function Ethernet support"
+ 	depends on PCI_MSI
+diff --git a/drivers/net/ethernet/intel/i40e/Makefile b/drivers/net/ethernet/intel/i40e/Makefile
+index 4b94ddb29c24..c40581999121 100644
+--- a/drivers/net/ethernet/intel/i40e/Makefile
++++ b/drivers/net/ethernet/intel/i40e/Makefile
+@@ -44,4 +44,4 @@ i40e-objs := i40e_main.o \
+ 	i40e_virtchnl_pf.o
+ 
+ i40e-$(CONFIG_I40E_DCB) += i40e_dcb.o i40e_dcb_nl.o
+-i40e-$(CONFIG_FCOE:m=y) += i40e_fcoe.o
++i40e-$(CONFIG_I40E_FCOE) += i40e_fcoe.o
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_osdep.h b/drivers/net/ethernet/intel/i40e/i40e_osdep.h
+index 045b5c4b98b3..ad802dd0f67a 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_osdep.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_osdep.h
+@@ -78,7 +78,7 @@ do {                                                            \
+ } while (0)
+ 
+ typedef enum i40e_status_code i40e_status;
+-#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
++#ifdef CONFIG_I40E_FCOE
+ #define I40E_FCOE
+-#endif /* CONFIG_FCOE or CONFIG_FCOE_MODULE */
++#endif
+ #endif /* _I40E_OSDEP_H_ */
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 4d69e382b4e5..6bdaa313e7ea 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1569,8 +1569,15 @@ int mlx4_en_start_port(struct net_device *dev)
+ 			mlx4_en_free_affinity_hint(priv, i);
+ 			goto cq_err;
+ 		}
+-		for (j = 0; j < cq->size; j++)
+-			cq->buf[j].owner_sr_opcode = MLX4_CQE_OWNER_MASK;
++
++		for (j = 0; j < cq->size; j++) {
++			struct mlx4_cqe *cqe = NULL;
++
++			cqe = mlx4_en_get_cqe(cq->buf, j, priv->cqe_size) +
++			      priv->cqe_factor;
++			cqe->owner_sr_opcode = MLX4_CQE_OWNER_MASK;
++		}
++
+ 		err = mlx4_en_set_cq_moder(priv, cq);
+ 		if (err) {
+ 			en_err(priv, "Failed setting cq moderation parameters\n");
+@@ -2356,9 +2363,11 @@ static void mlx4_en_del_vxlan_port(struct  net_device *dev,
+ 	queue_work(priv->mdev->workqueue, &priv->vxlan_del_task);
+ }
+ 
+-static bool mlx4_en_gso_check(struct sk_buff *skb, struct net_device *dev)
++static netdev_features_t mlx4_en_features_check(struct sk_buff *skb,
++						struct net_device *dev,
++						netdev_features_t features)
+ {
+-	return vxlan_gso_check(skb);
++	return vxlan_features_check(skb, features);
+ }
+ #endif
+ 
+@@ -2391,7 +2400,7 @@ static const struct net_device_ops mlx4_netdev_ops = {
+ #ifdef CONFIG_MLX4_EN_VXLAN
+ 	.ndo_add_vxlan_port	= mlx4_en_add_vxlan_port,
+ 	.ndo_del_vxlan_port	= mlx4_en_del_vxlan_port,
+-	.ndo_gso_check		= mlx4_en_gso_check,
++	.ndo_features_check	= mlx4_en_features_check,
+ #endif
+ };
+ 
+@@ -2425,7 +2434,7 @@ static const struct net_device_ops mlx4_netdev_ops_master = {
+ #ifdef CONFIG_MLX4_EN_VXLAN
+ 	.ndo_add_vxlan_port	= mlx4_en_add_vxlan_port,
+ 	.ndo_del_vxlan_port	= mlx4_en_del_vxlan_port,
+-	.ndo_gso_check		= mlx4_en_gso_check,
++	.ndo_features_check	= mlx4_en_features_check,
+ #endif
+ };
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+index 454d9fea640e..11ff28b5fca3 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+@@ -954,7 +954,17 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
+ 		tx_desc->ctrl.owner_opcode = op_own;
+ 		if (send_doorbell) {
+ 			wmb();
+-			iowrite32(ring->doorbell_qpn,
++			/* Since there is no iowrite*_native() that writes the
++			 * value as is, without byteswapping - using the one
++			 * the doesn't do byteswapping in the relevant arch
++			 * endianness.
++			 */
++#if defined(__LITTLE_ENDIAN)
++			iowrite32(
++#else
++			iowrite32be(
++#endif
++				  ring->doorbell_qpn,
+ 				  ring->bf.uar->map + MLX4_SEND_DOORBELL);
+ 		} else {
+ 			ring->xmit_more++;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
+index 2e88a235e26b..5f1228794328 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
+@@ -1647,8 +1647,8 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
+ 	/* CX3 is capable of extending CQEs\EQEs to strides larger than 64B */
+ 	MLX4_GET(byte_field, outbox, INIT_HCA_EQE_CQE_STRIDE_OFFSET);
+ 	if (byte_field) {
+-		param->dev_cap_enabled |= MLX4_DEV_CAP_64B_EQE_ENABLED;
+-		param->dev_cap_enabled |= MLX4_DEV_CAP_64B_CQE_ENABLED;
++		param->dev_cap_enabled |= MLX4_DEV_CAP_EQE_STRIDE_ENABLED;
++		param->dev_cap_enabled |= MLX4_DEV_CAP_CQE_STRIDE_ENABLED;
+ 		param->cqe_size = 1 << ((byte_field &
+ 					 MLX4_CQE_SIZE_MASK_STRIDE) + 5);
+ 		param->eqe_size = 1 << (((byte_field &
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
+index 193a6adb5d04..b7cdef0aebd6 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
+@@ -590,6 +590,7 @@ EXPORT_SYMBOL_GPL(mlx4_mr_free);
+ void mlx4_mr_rereg_mem_cleanup(struct mlx4_dev *dev, struct mlx4_mr *mr)
+ {
+ 	mlx4_mtt_cleanup(dev, &mr->mtt);
++	mr->mtt.order = -1;
+ }
+ EXPORT_SYMBOL_GPL(mlx4_mr_rereg_mem_cleanup);
+ 
+@@ -599,14 +600,14 @@ int mlx4_mr_rereg_mem_write(struct mlx4_dev *dev, struct mlx4_mr *mr,
+ {
+ 	int err;
+ 
+-	mpt_entry->start       = cpu_to_be64(iova);
+-	mpt_entry->length      = cpu_to_be64(size);
+-	mpt_entry->entity_size = cpu_to_be32(page_shift);
+-
+ 	err = mlx4_mtt_init(dev, npages, page_shift, &mr->mtt);
+ 	if (err)
+ 		return err;
+ 
++	mpt_entry->start       = cpu_to_be64(mr->iova);
++	mpt_entry->length      = cpu_to_be64(mr->size);
++	mpt_entry->entity_size = cpu_to_be32(mr->mtt.page_shift);
++
+ 	mpt_entry->pd_flags &= cpu_to_be32(MLX4_MPT_PD_MASK |
+ 					   MLX4_MPT_PD_FLAG_EN_INV);
+ 	mpt_entry->flags    &= cpu_to_be32(MLX4_MPT_FLAG_FREE |
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+index a913b3ad2f89..477a5d33d79c 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+@@ -504,9 +504,11 @@ static void qlcnic_del_vxlan_port(struct net_device *netdev,
+ 	adapter->flags |= QLCNIC_DEL_VXLAN_PORT;
+ }
+ 
+-static bool qlcnic_gso_check(struct sk_buff *skb, struct net_device *dev)
++static netdev_features_t qlcnic_features_check(struct sk_buff *skb,
++					       struct net_device *dev,
++					       netdev_features_t features)
+ {
+-	return vxlan_gso_check(skb);
++	return vxlan_features_check(skb, features);
+ }
+ #endif
+ 
+@@ -531,7 +533,7 @@ static const struct net_device_ops qlcnic_netdev_ops = {
+ #ifdef CONFIG_QLCNIC_VXLAN
+ 	.ndo_add_vxlan_port	= qlcnic_add_vxlan_port,
+ 	.ndo_del_vxlan_port	= qlcnic_del_vxlan_port,
+-	.ndo_gso_check		= qlcnic_gso_check,
++	.ndo_features_check	= qlcnic_features_check,
+ #endif
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ 	.ndo_poll_controller = qlcnic_poll_controller,
+diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
+index c560f9aeb55d..64d1cef4cda1 100644
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -610,7 +610,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
+ 
+ 			/* Clear all mcast from ALE */
+ 			cpsw_ale_flush_multicast(ale, ALE_ALL_PORTS <<
+-						 priv->host_port);
++						 priv->host_port, -1);
+ 
+ 			/* Flood All Unicast Packets to Host port */
+ 			cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1);
+@@ -634,6 +634,12 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
+ static void cpsw_ndo_set_rx_mode(struct net_device *ndev)
+ {
+ 	struct cpsw_priv *priv = netdev_priv(ndev);
++	int vid;
++
++	if (priv->data.dual_emac)
++		vid = priv->slaves[priv->emac_port].port_vlan;
++	else
++		vid = priv->data.default_vlan;
+ 
+ 	if (ndev->flags & IFF_PROMISC) {
+ 		/* Enable promiscuous mode */
+@@ -649,7 +655,8 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev)
+ 	cpsw_ale_set_allmulti(priv->ale, priv->ndev->flags & IFF_ALLMULTI);
+ 
+ 	/* Clear all mcast from ALE */
+-	cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port);
++	cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port,
++				 vid);
+ 
+ 	if (!netdev_mc_empty(ndev)) {
+ 		struct netdev_hw_addr *ha;
+@@ -757,6 +764,14 @@ requeue:
+ static irqreturn_t cpsw_interrupt(int irq, void *dev_id)
+ {
+ 	struct cpsw_priv *priv = dev_id;
++	int value = irq - priv->irqs_table[0];
++
++	/* NOTICE: Ending IRQ here. The trick with the 'value' variable above
++	 * is to make sure we will always write the correct value to the EOI
++	 * register. Namely 0 for RX_THRESH Interrupt, 1 for RX Interrupt, 2
++	 * for TX Interrupt and 3 for MISC Interrupt.
++	 */
++	cpdma_ctlr_eoi(priv->dma, value);
+ 
+ 	cpsw_intr_disable(priv);
+ 	if (priv->irq_enabled == true) {
+@@ -786,8 +801,6 @@ static int cpsw_poll(struct napi_struct *napi, int budget)
+ 	int			num_tx, num_rx;
+ 
+ 	num_tx = cpdma_chan_process(priv->txch, 128);
+-	if (num_tx)
+-		cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
+ 
+ 	num_rx = cpdma_chan_process(priv->rxch, budget);
+ 	if (num_rx < budget) {
+@@ -795,7 +808,6 @@ static int cpsw_poll(struct napi_struct *napi, int budget)
+ 
+ 		napi_complete(napi);
+ 		cpsw_intr_enable(priv);
+-		cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
+ 		prim_cpsw = cpsw_get_slave_priv(priv, 0);
+ 		if (prim_cpsw->irq_enabled == false) {
+ 			prim_cpsw->irq_enabled = true;
+@@ -1310,8 +1322,6 @@ static int cpsw_ndo_open(struct net_device *ndev)
+ 	napi_enable(&priv->napi);
+ 	cpdma_ctlr_start(priv->dma);
+ 	cpsw_intr_enable(priv);
+-	cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
+-	cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
+ 
+ 	prim_cpsw = cpsw_get_slave_priv(priv, 0);
+ 	if (prim_cpsw->irq_enabled == false) {
+@@ -1578,9 +1588,6 @@ static void cpsw_ndo_tx_timeout(struct net_device *ndev)
+ 	cpdma_chan_start(priv->txch);
+ 	cpdma_ctlr_int_ctrl(priv->dma, true);
+ 	cpsw_intr_enable(priv);
+-	cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
+-	cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
+-
+ }
+ 
+ static int cpsw_ndo_set_mac_address(struct net_device *ndev, void *p)
+@@ -1620,9 +1627,6 @@ static void cpsw_ndo_poll_controller(struct net_device *ndev)
+ 	cpsw_interrupt(ndev->irq, priv);
+ 	cpdma_ctlr_int_ctrl(priv->dma, true);
+ 	cpsw_intr_enable(priv);
+-	cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
+-	cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
+-
+ }
+ #endif
+ 
+diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c
+index 097ebe7077ac..5246b3a18ff8 100644
+--- a/drivers/net/ethernet/ti/cpsw_ale.c
++++ b/drivers/net/ethernet/ti/cpsw_ale.c
+@@ -234,7 +234,7 @@ static void cpsw_ale_flush_mcast(struct cpsw_ale *ale, u32 *ale_entry,
+ 		cpsw_ale_set_entry_type(ale_entry, ALE_TYPE_FREE);
+ }
+ 
+-int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask)
++int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid)
+ {
+ 	u32 ale_entry[ALE_ENTRY_WORDS];
+ 	int ret, idx;
+@@ -245,6 +245,14 @@ int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask)
+ 		if (ret != ALE_TYPE_ADDR && ret != ALE_TYPE_VLAN_ADDR)
+ 			continue;
+ 
++		/* if vid passed is -1 then remove all multicast entry from
++		 * the table irrespective of vlan id, if a valid vlan id is
++		 * passed then remove only multicast added to that vlan id.
++		 * if vlan id doesn't match then move on to next entry.
++		 */
++		if (vid != -1 && cpsw_ale_get_vlan_id(ale_entry) != vid)
++			continue;
++
+ 		if (cpsw_ale_get_mcast(ale_entry)) {
+ 			u8 addr[6];
+ 
+diff --git a/drivers/net/ethernet/ti/cpsw_ale.h b/drivers/net/ethernet/ti/cpsw_ale.h
+index c0d4127aa549..af1e7ecd87c6 100644
+--- a/drivers/net/ethernet/ti/cpsw_ale.h
++++ b/drivers/net/ethernet/ti/cpsw_ale.h
+@@ -92,7 +92,7 @@ void cpsw_ale_stop(struct cpsw_ale *ale);
+ 
+ int cpsw_ale_set_ageout(struct cpsw_ale *ale, int ageout);
+ int cpsw_ale_flush(struct cpsw_ale *ale, int port_mask);
+-int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask);
++int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid);
+ int cpsw_ale_add_ucast(struct cpsw_ale *ale, u8 *addr, int port,
+ 		       int flags, u16 vid);
+ int cpsw_ale_del_ucast(struct cpsw_ale *ale, u8 *addr, int port,
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 2368395d8ae5..9c505c4dbe04 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -629,6 +629,7 @@ static int team_change_mode(struct team *team, const char *kind)
+ static void team_notify_peers_work(struct work_struct *work)
+ {
+ 	struct team *team;
++	int val;
+ 
+ 	team = container_of(work, struct team, notify_peers.dw.work);
+ 
+@@ -636,9 +637,14 @@ static void team_notify_peers_work(struct work_struct *work)
+ 		schedule_delayed_work(&team->notify_peers.dw, 0);
+ 		return;
+ 	}
++	val = atomic_dec_if_positive(&team->notify_peers.count_pending);
++	if (val < 0) {
++		rtnl_unlock();
++		return;
++	}
+ 	call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, team->dev);
+ 	rtnl_unlock();
+-	if (!atomic_dec_and_test(&team->notify_peers.count_pending))
++	if (val)
+ 		schedule_delayed_work(&team->notify_peers.dw,
+ 				      msecs_to_jiffies(team->notify_peers.interval));
+ }
+@@ -669,6 +675,7 @@ static void team_notify_peers_fini(struct team *team)
+ static void team_mcast_rejoin_work(struct work_struct *work)
+ {
+ 	struct team *team;
++	int val;
+ 
+ 	team = container_of(work, struct team, mcast_rejoin.dw.work);
+ 
+@@ -676,9 +683,14 @@ static void team_mcast_rejoin_work(struct work_struct *work)
+ 		schedule_delayed_work(&team->mcast_rejoin.dw, 0);
+ 		return;
+ 	}
++	val = atomic_dec_if_positive(&team->mcast_rejoin.count_pending);
++	if (val < 0) {
++		rtnl_unlock();
++		return;
++	}
+ 	call_netdevice_notifiers(NETDEV_RESEND_IGMP, team->dev);
+ 	rtnl_unlock();
+-	if (!atomic_dec_and_test(&team->mcast_rejoin.count_pending))
++	if (val)
+ 		schedule_delayed_work(&team->mcast_rejoin.dw,
+ 				      msecs_to_jiffies(team->mcast_rejoin.interval));
+ }
+diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
+index 8021f6eec27f..41ae16435300 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
++++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
+@@ -665,7 +665,7 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)
+ 	if (num_of_ant(mvm->fw->valid_rx_ant) == 1)
+ 		return false;
+ 
+-	if (!mvm->cfg->rx_with_siso_diversity)
++	if (mvm->cfg->rx_with_siso_diversity)
+ 		return false;
+ 
+ 	ieee80211_iterate_active_interfaces_atomic(
+diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
+index 846a2e6e34d8..c70efb9a6e78 100644
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -666,7 +666,8 @@ tx_status_ok:
+ }
+ 
+ static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
+-				    u8 *entry, int rxring_idx, int desc_idx)
++				    struct sk_buff *new_skb, u8 *entry,
++				    int rxring_idx, int desc_idx)
+ {
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+ 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+@@ -674,11 +675,15 @@ static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
+ 	u8 tmp_one = 1;
+ 	struct sk_buff *skb;
+ 
++	if (likely(new_skb)) {
++		skb = new_skb;
++		goto remap;
++	}
+ 	skb = dev_alloc_skb(rtlpci->rxbuffersize);
+ 	if (!skb)
+ 		return 0;
+-	rtlpci->rx_ring[rxring_idx].rx_buf[desc_idx] = skb;
+ 
++remap:
+ 	/* just set skb->cb to mapping addr for pci_unmap_single use */
+ 	*((dma_addr_t *)skb->cb) =
+ 		pci_map_single(rtlpci->pdev, skb_tail_pointer(skb),
+@@ -686,6 +691,7 @@ static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
+ 	bufferaddress = *((dma_addr_t *)skb->cb);
+ 	if (pci_dma_mapping_error(rtlpci->pdev, bufferaddress))
+ 		return 0;
++	rtlpci->rx_ring[rxring_idx].rx_buf[desc_idx] = skb;
+ 	if (rtlpriv->use_new_trx_flow) {
+ 		rtlpriv->cfg->ops->set_desc(hw, (u8 *)entry, false,
+ 					    HW_DESC_RX_PREPARE,
+@@ -781,6 +787,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ 		/*rx pkt */
+ 		struct sk_buff *skb = rtlpci->rx_ring[rxring_idx].rx_buf[
+ 				      rtlpci->rx_ring[rxring_idx].idx];
++		struct sk_buff *new_skb;
+ 
+ 		if (rtlpriv->use_new_trx_flow) {
+ 			rx_remained_cnt =
+@@ -807,6 +814,13 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ 		pci_unmap_single(rtlpci->pdev, *((dma_addr_t *)skb->cb),
+ 				 rtlpci->rxbuffersize, PCI_DMA_FROMDEVICE);
+ 
++		/* get a new skb - if fail, old one will be reused */
++		new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
++		if (unlikely(!new_skb)) {
++			pr_err("Allocation of new skb failed in %s\n",
++			       __func__);
++			goto no_new;
++		}
+ 		if (rtlpriv->use_new_trx_flow) {
+ 			buffer_desc =
+ 			  &rtlpci->rx_ring[rxring_idx].buffer_desc
+@@ -911,14 +925,16 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ 			schedule_work(&rtlpriv->works.lps_change_work);
+ 		}
+ end:
++		skb = new_skb;
++no_new:
+ 		if (rtlpriv->use_new_trx_flow) {
+-			_rtl_pci_init_one_rxdesc(hw, (u8 *)buffer_desc,
++			_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc,
+ 						 rxring_idx,
+-					       rtlpci->rx_ring[rxring_idx].idx);
++						 rtlpci->rx_ring[rxring_idx].idx);
+ 		} else {
+-			_rtl_pci_init_one_rxdesc(hw, (u8 *)pdesc, rxring_idx,
++			_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc,
++						 rxring_idx,
+ 						 rtlpci->rx_ring[rxring_idx].idx);
+-
+ 			if (rtlpci->rx_ring[rxring_idx].idx ==
+ 			    rtlpci->rxringcount - 1)
+ 				rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc,
+@@ -1307,7 +1323,7 @@ static int _rtl_pci_init_rx_ring(struct ieee80211_hw *hw, int rxring_idx)
+ 		rtlpci->rx_ring[rxring_idx].idx = 0;
+ 		for (i = 0; i < rtlpci->rxringcount; i++) {
+ 			entry = &rtlpci->rx_ring[rxring_idx].buffer_desc[i];
+-			if (!_rtl_pci_init_one_rxdesc(hw, (u8 *)entry,
++			if (!_rtl_pci_init_one_rxdesc(hw, NULL, (u8 *)entry,
+ 						      rxring_idx, i))
+ 				return -ENOMEM;
+ 		}
+@@ -1332,7 +1348,7 @@ static int _rtl_pci_init_rx_ring(struct ieee80211_hw *hw, int rxring_idx)
+ 
+ 		for (i = 0; i < rtlpci->rxringcount; i++) {
+ 			entry = &rtlpci->rx_ring[rxring_idx].desc[i];
+-			if (!_rtl_pci_init_one_rxdesc(hw, (u8 *)entry,
++			if (!_rtl_pci_init_one_rxdesc(hw, NULL, (u8 *)entry,
+ 						      rxring_idx, i))
+ 				return -ENOMEM;
+ 		}
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+index d2ec5160bbf0..5c646d5f7bb8 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+@@ -955,6 +955,7 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
+ 	local_save_flags(flags);
+ 	local_irq_enable();
+ 
++	rtlhal->fw_ready = false;
+ 	rtlpriv->intf_ops->disable_aspm(hw);
+ 	rtstatus = _rtl92ce_init_mac(hw);
+ 	if (!rtstatus) {
+@@ -971,6 +972,7 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
+ 		goto exit;
+ 	}
+ 
++	rtlhal->fw_ready = true;
+ 	rtlhal->last_hmeboxnum = 0;
+ 	rtl92c_phy_mac_config(hw);
+ 	/* because last function modify RCR, so we update
+diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
+index 083ecc93fe5e..5f1fda44882b 100644
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -230,6 +230,8 @@ struct xenvif {
+ 	 */
+ 	bool disabled;
+ 	unsigned long status;
++	unsigned long drain_timeout;
++	unsigned long stall_timeout;
+ 
+ 	/* Queues */
+ 	struct xenvif_queue *queues;
+@@ -328,7 +330,7 @@ irqreturn_t xenvif_interrupt(int irq, void *dev_id);
+ extern bool separate_tx_rx_irq;
+ 
+ extern unsigned int rx_drain_timeout_msecs;
+-extern unsigned int rx_drain_timeout_jiffies;
++extern unsigned int rx_stall_timeout_msecs;
+ extern unsigned int xenvif_max_queues;
+ 
+ #ifdef CONFIG_DEBUG_FS
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index 895fe84011e7..d752d1c5c8bd 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -166,7 +166,7 @@ static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 		goto drop;
+ 
+ 	cb = XENVIF_RX_CB(skb);
+-	cb->expires = jiffies + rx_drain_timeout_jiffies;
++	cb->expires = jiffies + vif->drain_timeout;
+ 
+ 	xenvif_rx_queue_tail(queue, skb);
+ 	xenvif_kick_thread(queue);
+@@ -414,6 +414,8 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
+ 	vif->ip_csum = 1;
+ 	vif->dev = dev;
+ 	vif->disabled = false;
++	vif->drain_timeout = msecs_to_jiffies(rx_drain_timeout_msecs);
++	vif->stall_timeout = msecs_to_jiffies(rx_stall_timeout_msecs);
+ 
+ 	/* Start out with no queues. */
+ 	vif->queues = NULL;
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index 6563f0713fc0..c39aace4f642 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -60,14 +60,12 @@ module_param(separate_tx_rx_irq, bool, 0644);
+  */
+ unsigned int rx_drain_timeout_msecs = 10000;
+ module_param(rx_drain_timeout_msecs, uint, 0444);
+-unsigned int rx_drain_timeout_jiffies;
+ 
+ /* The length of time before the frontend is considered unresponsive
+  * because it isn't providing Rx slots.
+  */
+-static unsigned int rx_stall_timeout_msecs = 60000;
++unsigned int rx_stall_timeout_msecs = 60000;
+ module_param(rx_stall_timeout_msecs, uint, 0444);
+-static unsigned int rx_stall_timeout_jiffies;
+ 
+ unsigned int xenvif_max_queues;
+ module_param_named(max_queues, xenvif_max_queues, uint, 0644);
+@@ -2022,7 +2020,7 @@ static bool xenvif_rx_queue_stalled(struct xenvif_queue *queue)
+ 	return !queue->stalled
+ 		&& prod - cons < XEN_NETBK_RX_SLOTS_MAX
+ 		&& time_after(jiffies,
+-			      queue->last_rx_time + rx_stall_timeout_jiffies);
++			      queue->last_rx_time + queue->vif->stall_timeout);
+ }
+ 
+ static bool xenvif_rx_queue_ready(struct xenvif_queue *queue)
+@@ -2040,8 +2038,9 @@ static bool xenvif_have_rx_work(struct xenvif_queue *queue)
+ {
+ 	return (!skb_queue_empty(&queue->rx_queue)
+ 		&& xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX))
+-		|| xenvif_rx_queue_stalled(queue)
+-		|| xenvif_rx_queue_ready(queue)
++		|| (queue->vif->stall_timeout &&
++		    (xenvif_rx_queue_stalled(queue)
++		     || xenvif_rx_queue_ready(queue)))
+ 		|| kthread_should_stop()
+ 		|| queue->vif->disabled;
+ }
+@@ -2094,6 +2093,9 @@ int xenvif_kthread_guest_rx(void *data)
+ 	struct xenvif_queue *queue = data;
+ 	struct xenvif *vif = queue->vif;
+ 
++	if (!vif->stall_timeout)
++		xenvif_queue_carrier_on(queue);
++
+ 	for (;;) {
+ 		xenvif_wait_for_rx_work(queue);
+ 
+@@ -2120,10 +2122,12 @@ int xenvif_kthread_guest_rx(void *data)
+ 		 * while it's probably not responsive, drop the
+ 		 * carrier so packets are dropped earlier.
+ 		 */
+-		if (xenvif_rx_queue_stalled(queue))
+-			xenvif_queue_carrier_off(queue);
+-		else if (xenvif_rx_queue_ready(queue))
+-			xenvif_queue_carrier_on(queue);
++		if (vif->stall_timeout) {
++			if (xenvif_rx_queue_stalled(queue))
++				xenvif_queue_carrier_off(queue);
++			else if (xenvif_rx_queue_ready(queue))
++				xenvif_queue_carrier_on(queue);
++		}
+ 
+ 		/* Queued packets may have foreign pages from other
+ 		 * domains.  These cannot be queued indefinitely as
+@@ -2194,9 +2198,6 @@ static int __init netback_init(void)
+ 	if (rc)
+ 		goto failed_init;
+ 
+-	rx_drain_timeout_jiffies = msecs_to_jiffies(rx_drain_timeout_msecs);
+-	rx_stall_timeout_jiffies = msecs_to_jiffies(rx_stall_timeout_msecs);
+-
+ #ifdef CONFIG_DEBUG_FS
+ 	xen_netback_dbg_root = debugfs_create_dir("xen-netback", NULL);
+ 	if (IS_ERR_OR_NULL(xen_netback_dbg_root))
+diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
+index fab0d4b42f58..c047282c4ee0 100644
+--- a/drivers/net/xen-netback/xenbus.c
++++ b/drivers/net/xen-netback/xenbus.c
+@@ -736,6 +736,7 @@ static void connect(struct backend_info *be)
+ 		}
+ 
+ 		queue->remaining_credit = credit_bytes;
++		queue->credit_usec = credit_usec;
+ 
+ 		err = connect_rings(be, queue);
+ 		if (err) {
+@@ -886,9 +887,15 @@ static int read_xenbus_vif_flags(struct backend_info *be)
+ 		return -EOPNOTSUPP;
+ 
+ 	if (xenbus_scanf(XBT_NIL, dev->otherend,
+-			 "feature-rx-notify", "%d", &val) < 0 || val == 0) {
+-		xenbus_dev_fatal(dev, -EINVAL, "feature-rx-notify is mandatory");
+-		return -EINVAL;
++			 "feature-rx-notify", "%d", &val) < 0)
++		val = 0;
++	if (!val) {
++		/* - Reduce drain timeout to poll more frequently for
++		 *   Rx requests.
++		 * - Disable Rx stall detection.
++		 */
++		be->vif->drain_timeout = msecs_to_jiffies(30);
++		be->vif->stall_timeout = 0;
+ 	}
+ 
+ 	if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-sg",
+diff --git a/drivers/pinctrl/pinctrl-xway.c b/drivers/pinctrl/pinctrl-xway.c
+index 37040ab42890..fdff39ff5021 100644
+--- a/drivers/pinctrl/pinctrl-xway.c
++++ b/drivers/pinctrl/pinctrl-xway.c
+@@ -798,10 +798,8 @@ static int pinmux_xway_probe(struct platform_device *pdev)
+ 
+ 	/* load the gpio chip */
+ 	xway_chip.dev = &pdev->dev;
+-	of_gpiochip_add(&xway_chip);
+ 	ret = gpiochip_add(&xway_chip);
+ 	if (ret) {
+-		of_gpiochip_remove(&xway_chip);
+ 		dev_err(&pdev->dev, "Failed to register gpio chip\n");
+ 		return ret;
+ 	}
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index c1a6cd66af42..abdaed34c728 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -191,6 +191,15 @@ static const struct dmi_system_id asus_quirks[] = {
+ 	},
+ 	{
+ 		.callback = dmi_matched,
++		.ident = "ASUSTeK COMPUTER INC. X551CA",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "X551CA"),
++		},
++		.driver_data = &quirk_asus_wapf4,
++	},
++	{
++		.callback = dmi_matched,
+ 		.ident = "ASUSTeK COMPUTER INC. X55A",
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
+index 6bec745b6b92..10ce6cba4455 100644
+--- a/drivers/platform/x86/hp_accel.c
++++ b/drivers/platform/x86/hp_accel.c
+@@ -246,6 +246,7 @@ static const struct dmi_system_id lis3lv02d_dmi_ids[] = {
+ 	AXIS_DMI_MATCH("HPB64xx", "HP ProBook 64", xy_swap),
+ 	AXIS_DMI_MATCH("HPB64xx", "HP EliteBook 84", xy_swap),
+ 	AXIS_DMI_MATCH("HPB65xx", "HP ProBook 65", x_inverted),
++	AXIS_DMI_MATCH("HPZBook15", "HP ZBook 15", x_inverted),
+ 	{ NULL, }
+ /* Laptop models without axis info (yet):
+  * "NC6910" "HP Compaq 6910"
+diff --git a/drivers/reset/reset-sunxi.c b/drivers/reset/reset-sunxi.c
+index a94e7a7820b4..51272b5d7552 100644
+--- a/drivers/reset/reset-sunxi.c
++++ b/drivers/reset/reset-sunxi.c
+@@ -102,6 +102,8 @@ static int sunxi_reset_init(struct device_node *np)
+ 		goto err_alloc;
+ 	}
+ 
++	spin_lock_init(&data->lock);
++
+ 	data->rcdev.owner = THIS_MODULE;
+ 	data->rcdev.nr_resets = size * 32;
+ 	data->rcdev.ops = &sunxi_reset_ops;
+@@ -157,6 +159,8 @@ static int sunxi_reset_probe(struct platform_device *pdev)
+ 	if (IS_ERR(data->membase))
+ 		return PTR_ERR(data->membase);
+ 
++	spin_lock_init(&data->lock);
++
+ 	data->rcdev.owner = THIS_MODULE;
+ 	data->rcdev.nr_resets = resource_size(res) * 32;
+ 	data->rcdev.ops = &sunxi_reset_ops;
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_transport.c b/drivers/scsi/mpt2sas/mpt2sas_transport.c
+index 0d1d06488a28..e689bf20a3ea 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_transport.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_transport.c
+@@ -1006,12 +1006,9 @@ mpt2sas_transport_update_links(struct MPT2SAS_ADAPTER *ioc,
+ 		    &mpt2sas_phy->remote_identify);
+ 		_transport_add_phy_to_an_existing_port(ioc, sas_node,
+ 		    mpt2sas_phy, mpt2sas_phy->remote_identify.sas_address);
+-	} else {
++	} else
+ 		memset(&mpt2sas_phy->remote_identify, 0 , sizeof(struct
+ 		    sas_identify));
+-		_transport_del_phy_from_an_existing_port(ioc, sas_node,
+-		    mpt2sas_phy);
+-	}
+ 
+ 	if (mpt2sas_phy->phy)
+ 		mpt2sas_phy->phy->negotiated_linkrate =
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index d4bafaaebea9..3637ae6c0171 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -1003,12 +1003,9 @@ mpt3sas_transport_update_links(struct MPT3SAS_ADAPTER *ioc,
+ 		    &mpt3sas_phy->remote_identify);
+ 		_transport_add_phy_to_an_existing_port(ioc, sas_node,
+ 		    mpt3sas_phy, mpt3sas_phy->remote_identify.sas_address);
+-	} else {
++	} else
+ 		memset(&mpt3sas_phy->remote_identify, 0 , sizeof(struct
+ 		    sas_identify));
+-		_transport_del_phy_from_an_existing_port(ioc, sas_node,
+-		    mpt3sas_phy);
+-	}
+ 
+ 	if (mpt3sas_phy->phy)
+ 		mpt3sas_phy->phy->negotiated_linkrate =
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index c1d04d4d3c6c..262ab837a704 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -211,6 +211,7 @@ static struct {
+ 	{"Medion", "Flash XL  MMC/SD", "2.6D", BLIST_FORCELUN},
+ 	{"MegaRAID", "LD", NULL, BLIST_FORCELUN},
+ 	{"MICROP", "4110", NULL, BLIST_NOTQ},
++	{"MSFT", "Virtual HD", NULL, BLIST_NO_RSOC},
+ 	{"MYLEX", "DACARMRB", "*", BLIST_REPORTLUN2},
+ 	{"nCipher", "Fastness Crypto", NULL, BLIST_FORCELUN},
+ 	{"NAKAMICH", "MJ-4.8S", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index bc5ff6ff9c79..01a79473350a 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -1027,7 +1027,7 @@ retry:
+ 		}
+ 		/* signal not to enter either branch of the if () below */
+ 		timeleft = 0;
+-		rtn = NEEDS_RETRY;
++		rtn = FAILED;
+ 	} else {
+ 		timeleft = wait_for_completion_timeout(&done, timeout);
+ 		rtn = SUCCESS;
+@@ -1067,7 +1067,7 @@ retry:
+ 			rtn = FAILED;
+ 			break;
+ 		}
+-	} else if (!rtn) {
++	} else if (rtn != FAILED) {
+ 		scsi_abort_eh_cmnd(scmd);
+ 		rtn = FAILED;
+ 	}
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 50a6e1ac8d9c..17fb0518c9c1 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -1829,7 +1829,9 @@ static int scsi_mq_prep_fn(struct request *req)
+ 
+ 	if (scsi_host_get_prot(shost)) {
+ 		cmd->prot_sdb = (void *)sg +
+-			shost->sg_tablesize * sizeof(struct scatterlist);
++			min_t(unsigned int,
++			      shost->sg_tablesize, SCSI_MAX_SG_SEGMENTS) *
++			sizeof(struct scatterlist);
+ 		memset(cmd->prot_sdb, 0, sizeof(struct scsi_data_buffer));
+ 
+ 		cmd->prot_sdb->table.sgl =
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index 733e5f759518..90af465359d6 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -1688,13 +1688,12 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
+ 	if (ret == -EAGAIN) {
+ 		/* no more space */
+ 
+-		if (cmd_request->bounce_sgl_count) {
++		if (cmd_request->bounce_sgl_count)
+ 			destroy_bounce_buffer(cmd_request->bounce_sgl,
+ 					cmd_request->bounce_sgl_count);
+ 
+-			ret = SCSI_MLQUEUE_DEVICE_BUSY;
+-			goto queue_error;
+-		}
++		ret = SCSI_MLQUEUE_DEVICE_BUSY;
++		goto queue_error;
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index 480f2e0ecc11..18e2601527df 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -281,7 +281,6 @@ static int iscsi_login_zero_tsih_s1(
+ {
+ 	struct iscsi_session *sess = NULL;
+ 	struct iscsi_login_req *pdu = (struct iscsi_login_req *)buf;
+-	enum target_prot_op sup_pro_ops;
+ 	int ret;
+ 
+ 	sess = kzalloc(sizeof(struct iscsi_session), GFP_KERNEL);
+@@ -343,9 +342,8 @@ static int iscsi_login_zero_tsih_s1(
+ 		kfree(sess);
+ 		return -ENOMEM;
+ 	}
+-	sup_pro_ops = conn->conn_transport->iscsit_get_sup_prot_ops(conn);
+ 
+-	sess->se_sess = transport_init_session(sup_pro_ops);
++	sess->se_sess = transport_init_session(TARGET_PROT_NORMAL);
+ 	if (IS_ERR(sess->se_sess)) {
+ 		iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+ 				ISCSI_LOGIN_STATUS_NO_RESOURCES);
+@@ -1204,6 +1202,9 @@ old_sess_out:
+ 		conn->sock = NULL;
+ 	}
+ 
++	if (conn->conn_transport->iscsit_wait_conn)
++		conn->conn_transport->iscsit_wait_conn(conn);
++
+ 	if (conn->conn_transport->iscsit_free_conn)
+ 		conn->conn_transport->iscsit_free_conn(conn);
+ 
+@@ -1364,6 +1365,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ 	}
+ 	login->zero_tsih = zero_tsih;
+ 
++	conn->sess->se_sess->sup_prot_ops =
++		conn->conn_transport->iscsit_get_sup_prot_ops(conn);
++
+ 	tpg = conn->tpg;
+ 	if (!tpg) {
+ 		pr_err("Unable to locate struct iscsi_conn->tpg\n");
+diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
+index ce87ce9bdb9c..0b68c2ebce95 100644
+--- a/drivers/target/iscsi/iscsi_target_util.c
++++ b/drivers/target/iscsi/iscsi_target_util.c
+@@ -1358,15 +1358,15 @@ static int iscsit_do_tx_data(
+ 	struct iscsi_conn *conn,
+ 	struct iscsi_data_count *count)
+ {
+-	int data = count->data_length, total_tx = 0, tx_loop = 0, iov_len;
++	int ret, iov_len;
+ 	struct kvec *iov_p;
+ 	struct msghdr msg;
+ 
+ 	if (!conn || !conn->sock || !conn->conn_ops)
+ 		return -1;
+ 
+-	if (data <= 0) {
+-		pr_err("Data length is: %d\n", data);
++	if (count->data_length <= 0) {
++		pr_err("Data length is: %d\n", count->data_length);
+ 		return -1;
+ 	}
+ 
+@@ -1375,20 +1375,16 @@ static int iscsit_do_tx_data(
+ 	iov_p = count->iov;
+ 	iov_len = count->iov_count;
+ 
+-	while (total_tx < data) {
+-		tx_loop = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
+-					(data - total_tx));
+-		if (tx_loop <= 0) {
+-			pr_debug("tx_loop: %d total_tx %d\n",
+-				tx_loop, total_tx);
+-			return tx_loop;
+-		}
+-		total_tx += tx_loop;
+-		pr_debug("tx_loop: %d, total_tx: %d, data: %d\n",
+-					tx_loop, total_tx, data);
++	ret = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
++			     count->data_length);
++	if (ret != count->data_length) {
++		pr_err("Unexpected ret: %d send data %d\n",
++		       ret, count->data_length);
++		return -EPIPE;
+ 	}
++	pr_debug("ret: %d, sent data: %d\n", ret, count->data_length);
+ 
+-	return total_tx;
++	return ret;
+ }
+ 
+ int rx_data(
+diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
+index ab3ab27d49b7..0be83e788df2 100644
+--- a/drivers/target/loopback/tcm_loop.c
++++ b/drivers/target/loopback/tcm_loop.c
+@@ -190,7 +190,7 @@ static void tcm_loop_submission_work(struct work_struct *work)
+ 		set_host_byte(sc, DID_TRANSPORT_DISRUPTED);
+ 		goto out_done;
+ 	}
+-	tl_nexus = tl_hba->tl_nexus;
++	tl_nexus = tl_tpg->tl_nexus;
+ 	if (!tl_nexus) {
+ 		scmd_printk(KERN_ERR, sc, "TCM_Loop I_T Nexus"
+ 				" does not exist\n");
+@@ -270,16 +270,26 @@ static int tcm_loop_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *sc)
+  * to struct scsi_device
+  */
+ static int tcm_loop_issue_tmr(struct tcm_loop_tpg *tl_tpg,
+-			      struct tcm_loop_nexus *tl_nexus,
+ 			      int lun, int task, enum tcm_tmreq_table tmr)
+ {
+ 	struct se_cmd *se_cmd = NULL;
+ 	struct se_session *se_sess;
+ 	struct se_portal_group *se_tpg;
++	struct tcm_loop_nexus *tl_nexus;
+ 	struct tcm_loop_cmd *tl_cmd = NULL;
+ 	struct tcm_loop_tmr *tl_tmr = NULL;
+ 	int ret = TMR_FUNCTION_FAILED, rc;
+ 
++	/*
++	 * Locate the tl_nexus and se_sess pointers
++	 */
++	tl_nexus = tl_tpg->tl_nexus;
++	if (!tl_nexus) {
++		pr_err("Unable to perform device reset without"
++				" active I_T Nexus\n");
++		return ret;
++	}
++
+ 	tl_cmd = kmem_cache_zalloc(tcm_loop_cmd_cache, GFP_KERNEL);
+ 	if (!tl_cmd) {
+ 		pr_err("Unable to allocate memory for tl_cmd\n");
+@@ -295,7 +305,7 @@ static int tcm_loop_issue_tmr(struct tcm_loop_tpg *tl_tpg,
+ 
+ 	se_cmd = &tl_cmd->tl_se_cmd;
+ 	se_tpg = &tl_tpg->tl_se_tpg;
+-	se_sess = tl_nexus->se_sess;
++	se_sess = tl_tpg->tl_nexus->se_sess;
+ 	/*
+ 	 * Initialize struct se_cmd descriptor from target_core_mod infrastructure
+ 	 */
+@@ -340,7 +350,6 @@ release:
+ static int tcm_loop_abort_task(struct scsi_cmnd *sc)
+ {
+ 	struct tcm_loop_hba *tl_hba;
+-	struct tcm_loop_nexus *tl_nexus;
+ 	struct tcm_loop_tpg *tl_tpg;
+ 	int ret = FAILED;
+ 
+@@ -348,21 +357,8 @@ static int tcm_loop_abort_task(struct scsi_cmnd *sc)
+ 	 * Locate the tcm_loop_hba_t pointer
+ 	 */
+ 	tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host);
+-	/*
+-	 * Locate the tl_nexus and se_sess pointers
+-	 */
+-	tl_nexus = tl_hba->tl_nexus;
+-	if (!tl_nexus) {
+-		pr_err("Unable to perform device reset without"
+-				" active I_T Nexus\n");
+-		return FAILED;
+-	}
+-
+-	/*
+-	 * Locate the tl_tpg pointer from TargetID in sc->device->id
+-	 */
+ 	tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];
+-	ret = tcm_loop_issue_tmr(tl_tpg, tl_nexus, sc->device->lun,
++	ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun,
+ 				 sc->request->tag, TMR_ABORT_TASK);
+ 	return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED;
+ }
+@@ -374,7 +370,6 @@ static int tcm_loop_abort_task(struct scsi_cmnd *sc)
+ static int tcm_loop_device_reset(struct scsi_cmnd *sc)
+ {
+ 	struct tcm_loop_hba *tl_hba;
+-	struct tcm_loop_nexus *tl_nexus;
+ 	struct tcm_loop_tpg *tl_tpg;
+ 	int ret = FAILED;
+ 
+@@ -382,20 +377,9 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc)
+ 	 * Locate the tcm_loop_hba_t pointer
+ 	 */
+ 	tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host);
+-	/*
+-	 * Locate the tl_nexus and se_sess pointers
+-	 */
+-	tl_nexus = tl_hba->tl_nexus;
+-	if (!tl_nexus) {
+-		pr_err("Unable to perform device reset without"
+-				" active I_T Nexus\n");
+-		return FAILED;
+-	}
+-	/*
+-	 * Locate the tl_tpg pointer from TargetID in sc->device->id
+-	 */
+ 	tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];
+-	ret = tcm_loop_issue_tmr(tl_tpg, tl_nexus, sc->device->lun,
++
++	ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun,
+ 				 0, TMR_LUN_RESET);
+ 	return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED;
+ }
+@@ -1005,8 +989,8 @@ static int tcm_loop_make_nexus(
+ 	struct tcm_loop_nexus *tl_nexus;
+ 	int ret = -ENOMEM;
+ 
+-	if (tl_tpg->tl_hba->tl_nexus) {
+-		pr_debug("tl_tpg->tl_hba->tl_nexus already exists\n");
++	if (tl_tpg->tl_nexus) {
++		pr_debug("tl_tpg->tl_nexus already exists\n");
+ 		return -EEXIST;
+ 	}
+ 	se_tpg = &tl_tpg->tl_se_tpg;
+@@ -1041,7 +1025,7 @@ static int tcm_loop_make_nexus(
+ 	 */
+ 	__transport_register_session(se_tpg, tl_nexus->se_sess->se_node_acl,
+ 			tl_nexus->se_sess, tl_nexus);
+-	tl_tpg->tl_hba->tl_nexus = tl_nexus;
++	tl_tpg->tl_nexus = tl_nexus;
+ 	pr_debug("TCM_Loop_ConfigFS: Established I_T Nexus to emulated"
+ 		" %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tl_hba),
+ 		name);
+@@ -1057,12 +1041,8 @@ static int tcm_loop_drop_nexus(
+ {
+ 	struct se_session *se_sess;
+ 	struct tcm_loop_nexus *tl_nexus;
+-	struct tcm_loop_hba *tl_hba = tpg->tl_hba;
+ 
+-	if (!tl_hba)
+-		return -ENODEV;
+-
+-	tl_nexus = tl_hba->tl_nexus;
++	tl_nexus = tpg->tl_nexus;
+ 	if (!tl_nexus)
+ 		return -ENODEV;
+ 
+@@ -1078,13 +1058,13 @@ static int tcm_loop_drop_nexus(
+ 	}
+ 
+ 	pr_debug("TCM_Loop_ConfigFS: Removing I_T Nexus to emulated"
+-		" %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tl_hba),
++		" %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tpg->tl_hba),
+ 		tl_nexus->se_sess->se_node_acl->initiatorname);
+ 	/*
+ 	 * Release the SCSI I_T Nexus to the emulated SAS Target Port
+ 	 */
+ 	transport_deregister_session(tl_nexus->se_sess);
+-	tpg->tl_hba->tl_nexus = NULL;
++	tpg->tl_nexus = NULL;
+ 	kfree(tl_nexus);
+ 	return 0;
+ }
+@@ -1100,7 +1080,7 @@ static ssize_t tcm_loop_tpg_show_nexus(
+ 	struct tcm_loop_nexus *tl_nexus;
+ 	ssize_t ret;
+ 
+-	tl_nexus = tl_tpg->tl_hba->tl_nexus;
++	tl_nexus = tl_tpg->tl_nexus;
+ 	if (!tl_nexus)
+ 		return -ENODEV;
+ 
+diff --git a/drivers/target/loopback/tcm_loop.h b/drivers/target/loopback/tcm_loop.h
+index 54c59d0b6608..6ae49f272ba6 100644
+--- a/drivers/target/loopback/tcm_loop.h
++++ b/drivers/target/loopback/tcm_loop.h
+@@ -27,11 +27,6 @@ struct tcm_loop_tmr {
+ };
+ 
+ struct tcm_loop_nexus {
+-	int it_nexus_active;
+-	/*
+-	 * Pointer to Linux/SCSI HBA from linux/include/scsi_host.h
+-	 */
+-	struct scsi_host *sh;
+ 	/*
+ 	 * Pointer to TCM session for I_T Nexus
+ 	 */
+@@ -51,6 +46,7 @@ struct tcm_loop_tpg {
+ 	atomic_t tl_tpg_port_count;
+ 	struct se_portal_group tl_se_tpg;
+ 	struct tcm_loop_hba *tl_hba;
++	struct tcm_loop_nexus *tl_nexus;
+ };
+ 
+ struct tcm_loop_hba {
+@@ -59,7 +55,6 @@ struct tcm_loop_hba {
+ 	struct se_hba_s *se_hba;
+ 	struct se_lun *tl_hba_lun;
+ 	struct se_port *tl_hba_lun_sep;
+-	struct tcm_loop_nexus *tl_nexus;
+ 	struct device dev;
+ 	struct Scsi_Host *sh;
+ 	struct tcm_loop_tpg tl_hba_tpgs[TL_TPGS_PER_HBA];
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index c45f9e907e44..24fa5d1999af 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -1169,10 +1169,10 @@ int se_dev_set_optimal_sectors(struct se_device *dev, u32 optimal_sectors)
+ 				" changed for TCM/pSCSI\n", dev);
+ 		return -EINVAL;
+ 	}
+-	if (optimal_sectors > dev->dev_attrib.fabric_max_sectors) {
++	if (optimal_sectors > dev->dev_attrib.hw_max_sectors) {
+ 		pr_err("dev[%p]: Passed optimal_sectors %u cannot be"
+-			" greater than fabric_max_sectors: %u\n", dev,
+-			optimal_sectors, dev->dev_attrib.fabric_max_sectors);
++			" greater than hw_max_sectors: %u\n", dev,
++			optimal_sectors, dev->dev_attrib.hw_max_sectors);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -1572,7 +1572,6 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
+ 				DA_UNMAP_GRANULARITY_ALIGNMENT_DEFAULT;
+ 	dev->dev_attrib.max_write_same_len = DA_MAX_WRITE_SAME_LEN;
+ 	dev->dev_attrib.fabric_max_sectors = DA_FABRIC_MAX_SECTORS;
+-	dev->dev_attrib.optimal_sectors = DA_FABRIC_MAX_SECTORS;
+ 
+ 	xcopy_lun = &dev->xcopy_lun;
+ 	xcopy_lun->lun_se_dev = dev;
+@@ -1613,6 +1612,7 @@ int target_configure_device(struct se_device *dev)
+ 	dev->dev_attrib.hw_max_sectors =
+ 		se_dev_align_max_sectors(dev->dev_attrib.hw_max_sectors,
+ 					 dev->dev_attrib.hw_block_size);
++	dev->dev_attrib.optimal_sectors = dev->dev_attrib.hw_max_sectors;
+ 
+ 	dev->dev_index = scsi_get_new_index(SCSI_DEVICE_INDEX);
+ 	dev->creation_time = get_jiffies_64();
+diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
+index 72c83d98662b..f018b6a3ffbf 100644
+--- a/drivers/target/target_core_file.c
++++ b/drivers/target/target_core_file.c
+@@ -620,7 +620,16 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
+ 	struct fd_prot fd_prot;
+ 	sense_reason_t rc;
+ 	int ret = 0;
+-
++	/*
++	 * We are currently limited by the number of iovecs (2048) per
++	 * single vfs_[writev,readv] call.
++	 */
++	if (cmd->data_length > FD_MAX_BYTES) {
++		pr_err("FILEIO: Not able to process I/O of %u bytes due to"
++		       "FD_MAX_BYTES: %u iovec count limitiation\n",
++			cmd->data_length, FD_MAX_BYTES);
++		return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
++	}
+ 	/*
+ 	 * Call vectorized fileio functions to map struct scatterlist
+ 	 * physical memory addresses to struct iovec virtual memory.
+diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
+index 7e6b857c6b3f..be27773ab829 100644
+--- a/drivers/target/target_core_iblock.c
++++ b/drivers/target/target_core_iblock.c
+@@ -123,7 +123,7 @@ static int iblock_configure_device(struct se_device *dev)
+ 	q = bdev_get_queue(bd);
+ 
+ 	dev->dev_attrib.hw_block_size = bdev_logical_block_size(bd);
+-	dev->dev_attrib.hw_max_sectors = UINT_MAX;
++	dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q);
+ 	dev->dev_attrib.hw_queue_depth = q->nr_requests;
+ 
+ 	/*
+diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
+index ebe62afb957d..7a88af0e32d6 100644
+--- a/drivers/target/target_core_sbc.c
++++ b/drivers/target/target_core_sbc.c
+@@ -953,21 +953,6 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
+ 
+ 	if (cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) {
+ 		unsigned long long end_lba;
+-
+-		if (sectors > dev->dev_attrib.fabric_max_sectors) {
+-			printk_ratelimited(KERN_ERR "SCSI OP %02xh with too"
+-				" big sectors %u exceeds fabric_max_sectors:"
+-				" %u\n", cdb[0], sectors,
+-				dev->dev_attrib.fabric_max_sectors);
+-			return TCM_INVALID_CDB_FIELD;
+-		}
+-		if (sectors > dev->dev_attrib.hw_max_sectors) {
+-			printk_ratelimited(KERN_ERR "SCSI OP %02xh with too"
+-				" big sectors %u exceeds backend hw_max_sectors:"
+-				" %u\n", cdb[0], sectors,
+-				dev->dev_attrib.hw_max_sectors);
+-			return TCM_INVALID_CDB_FIELD;
+-		}
+ check_lba:
+ 		end_lba = dev->transport->get_blocks(dev) + 1;
+ 		if (cmd->t_task_lba + sectors > end_lba) {
+diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
+index bc286a67af7c..614005b6b08b 100644
+--- a/drivers/target/target_core_spc.c
++++ b/drivers/target/target_core_spc.c
+@@ -505,7 +505,6 @@ static sense_reason_t
+ spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf)
+ {
+ 	struct se_device *dev = cmd->se_dev;
+-	u32 max_sectors;
+ 	int have_tp = 0;
+ 	int opt, min;
+ 
+@@ -539,9 +538,7 @@ spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf)
+ 	/*
+ 	 * Set MAXIMUM TRANSFER LENGTH
+ 	 */
+-	max_sectors = min(dev->dev_attrib.fabric_max_sectors,
+-			  dev->dev_attrib.hw_max_sectors);
+-	put_unaligned_be32(max_sectors, &buf[8]);
++	put_unaligned_be32(dev->dev_attrib.hw_max_sectors, &buf[8]);
+ 
+ 	/*
+ 	 * Set OPTIMAL TRANSFER LENGTH
+diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c
+index 95cb7fc20e17..6cb78497076a 100644
+--- a/drivers/thermal/intel_powerclamp.c
++++ b/drivers/thermal/intel_powerclamp.c
+@@ -435,7 +435,6 @@ static int clamp_thread(void *arg)
+ 		 * allowed. thus jiffies are updated properly.
+ 		 */
+ 		preempt_disable();
+-		tick_nohz_idle_enter();
+ 		/* mwait until target jiffies is reached */
+ 		while (time_before(jiffies, target_jiffies)) {
+ 			unsigned long ecx = 1;
+@@ -451,7 +450,6 @@ static int clamp_thread(void *arg)
+ 			start_critical_timings();
+ 			atomic_inc(&idle_wakeup_counter);
+ 		}
+-		tick_nohz_idle_exit();
+ 		preempt_enable();
+ 	}
+ 	del_timer_sync(&wakeup_timer);
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index eaeb9a02c7fe..a28dee9d5017 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -2102,7 +2102,9 @@ uart_report_port(struct uart_driver *drv, struct uart_port *port)
+ 		break;
+ 	}
+ 
+-	dev_info(port->dev, "%s%d at %s (irq = %d, base_baud = %d) is a %s\n",
++	printk(KERN_INFO "%s%s%s%d at %s (irq = %d, base_baud = %d) is a %s\n",
++	       port->dev ? dev_name(port->dev) : "",
++	       port->dev ? ": " : "",
+ 	       drv->dev_name,
+ 	       drv->tty_driver->name_base + port->line,
+ 	       address, port->irq, port->uartclk / 16, uart_type(port));
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 546ea5431b8c..272e0928736e 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -882,8 +882,7 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting)
+ 
+ 				if (i == (request->num_mapped_sgs - 1) ||
+ 						sg_is_last(s)) {
+-					if (list_is_last(&req->list,
+-							&dep->request_list))
++					if (list_empty(&dep->request_list))
+ 						last_one = true;
+ 					chain = false;
+ 				}
+@@ -901,6 +900,9 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting)
+ 				if (last_one)
+ 					break;
+ 			}
++
++			if (last_one)
++				break;
+ 		} else {
+ 			dma = req->request.dma;
+ 			length = req->request.length;
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index c744e4975d74..08048613eed6 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -449,6 +449,7 @@ ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
+ 		data->name, len, (int) value);
+ free1:
+ 	mutex_unlock(&data->lock);
++	kfree (kbuf);
+ 	return value;
+ }
+ 
+diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
+index 1529926e20a0..840856ca3e66 100644
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -716,10 +716,10 @@ static int queue_dma(struct usba_udc *udc, struct usba_ep *ep,
+ 	req->using_dma = 1;
+ 	req->ctrl = USBA_BF(DMA_BUF_LEN, req->req.length)
+ 			| USBA_DMA_CH_EN | USBA_DMA_END_BUF_IE
+-			| USBA_DMA_END_TR_EN | USBA_DMA_END_TR_IE;
++			| USBA_DMA_END_BUF_EN;
+ 
+-	if (ep->is_in)
+-		req->ctrl |= USBA_DMA_END_BUF_EN;
++	if (!ep->is_in)
++		req->ctrl |= USBA_DMA_END_TR_EN | USBA_DMA_END_TR_IE;
+ 
+ 	/*
+ 	 * Add this request to the queue and submit for DMA if
+@@ -828,7 +828,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+ {
+ 	struct usba_ep *ep = to_usba_ep(_ep);
+ 	struct usba_udc *udc = ep->udc;
+-	struct usba_request *req = to_usba_req(_req);
++	struct usba_request *req;
+ 	unsigned long flags;
+ 	u32 status;
+ 
+@@ -837,6 +837,16 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+ 
+ 	spin_lock_irqsave(&udc->lock, flags);
+ 
++	list_for_each_entry(req, &ep->queue, queue) {
++		if (&req->req == _req)
++			break;
++	}
++
++	if (&req->req != _req) {
++		spin_unlock_irqrestore(&udc->lock, flags);
++		return -EINVAL;
++	}
++
+ 	if (req->using_dma) {
+ 		/*
+ 		 * If this request is currently being transferred,
+@@ -1572,7 +1582,6 @@ static void usba_ep_irq(struct usba_udc *udc, struct usba_ep *ep)
+ 	if ((epstatus & epctrl) & USBA_RX_BK_RDY) {
+ 		DBG(DBG_BUS, "%s: RX data ready\n", ep->ep.name);
+ 		receive_data(ep);
+-		usba_ep_writel(ep, CLR_STA, USBA_RX_BK_RDY);
+ 	}
+ }
+ 
+diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
+index e113fd73aeae..c399606f154e 100644
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -1581,6 +1581,10 @@ iso_stream_schedule (
+ 	else
+ 		next = (now + 2 + 7) & ~0x07;	/* full frame cache */
+ 
++	/* If needed, initialize last_iso_frame so that this URB will be seen */
++	if (ehci->isoc_count == 0)
++		ehci->last_iso_frame = now >> 3;
++
+ 	/*
+ 	 * Use ehci->last_iso_frame as the base.  There can't be any
+ 	 * TDs scheduled for earlier than that.
+@@ -1671,10 +1675,6 @@ iso_stream_schedule (
+ 	urb->start_frame = start & (mod - 1);
+ 	if (!stream->highspeed)
+ 		urb->start_frame >>= 3;
+-
+-	/* Make sure scan_isoc() sees these */
+-	if (ehci->isoc_count == 0)
+-		ehci->last_iso_frame = now >> 3;
+ 	return status;
+ 
+  fail:
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index 2f3acebb577a..f4e6b945136c 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -571,7 +571,8 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
+ {
+ 	void __iomem *base;
+ 	u32 control;
+-	u32 fminterval;
++	u32 fminterval = 0;
++	bool no_fminterval = false;
+ 	int cnt;
+ 
+ 	if (!mmio_resource_enabled(pdev, 0))
+@@ -581,6 +582,13 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
+ 	if (base == NULL)
+ 		return;
+ 
++	/*
++	 * ULi M5237 OHCI controller locks the whole system when accessing
++	 * the OHCI_FMINTERVAL offset.
++	 */
++	if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237)
++		no_fminterval = true;
++
+ 	control = readl(base + OHCI_CONTROL);
+ 
+ /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */
+@@ -619,7 +627,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
+ 	}
+ 
+ 	/* software reset of the controller, preserving HcFmInterval */
+-	fminterval = readl(base + OHCI_FMINTERVAL);
++	if (!no_fminterval)
++		fminterval = readl(base + OHCI_FMINTERVAL);
++
+ 	writel(OHCI_HCR, base + OHCI_CMDSTATUS);
+ 
+ 	/* reset requires max 10 us delay */
+@@ -628,7 +638,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
+ 			break;
+ 		udelay(1);
+ 	}
+-	writel(fminterval, base + OHCI_FMINTERVAL);
++
++	if (!no_fminterval)
++		writel(fminterval, base + OHCI_FMINTERVAL);
+ 
+ 	/* Now the controller is safely in SUSPEND and nothing can wake it up */
+ 	iounmap(base);
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 142b601f9563..7f76c8a12f89 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -82,6 +82,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 				"must be suspended extra slowly",
+ 				pdev->revision);
+ 		}
++		if (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK)
++			xhci->quirks |= XHCI_BROKEN_STREAMS;
+ 		/* Fresco Logic confirms: all revisions of this chip do not
+ 		 * support MSI, even though some of them claim to in their PCI
+ 		 * capabilities.
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 033b46c470bd..3bceabe109f7 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3803,6 +3803,15 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
+ 		return -EINVAL;
+ 	}
+ 
++	if (setup == SETUP_CONTEXT_ONLY) {
++		slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx);
++		if (GET_SLOT_STATE(le32_to_cpu(slot_ctx->dev_state)) ==
++		    SLOT_STATE_DEFAULT) {
++			xhci_dbg(xhci, "Slot already in default state\n");
++			return 0;
++		}
++	}
++
+ 	command = xhci_alloc_command(xhci, false, false, GFP_KERNEL);
+ 	if (!command)
+ 		return -ENOMEM;
+diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
+index 855793d701bb..4500610356f2 100644
+--- a/drivers/usb/musb/musb_host.c
++++ b/drivers/usb/musb/musb_host.c
+@@ -2663,7 +2663,6 @@ void musb_host_cleanup(struct musb *musb)
+ 	if (musb->port_mode == MUSB_PORT_MODE_GADGET)
+ 		return;
+ 	usb_remove_hcd(musb->hcd);
+-	musb->hcd = NULL;
+ }
+ 
+ void musb_host_free(struct musb *musb)
+diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
+index 8d7fc48b1f30..29fa1c3d0089 100644
+--- a/drivers/usb/serial/console.c
++++ b/drivers/usb/serial/console.c
+@@ -46,6 +46,8 @@ static struct console usbcons;
+  * ------------------------------------------------------------
+  */
+ 
++static const struct tty_operations usb_console_fake_tty_ops = {
++};
+ 
+ /*
+  * The parsing of the command line works exactly like the
+@@ -137,13 +139,17 @@ static int usb_console_setup(struct console *co, char *options)
+ 				goto reset_open_count;
+ 			}
+ 			kref_init(&tty->kref);
+-			tty_port_tty_set(&port->port, tty);
+ 			tty->driver = usb_serial_tty_driver;
+ 			tty->index = co->index;
++			init_ldsem(&tty->ldisc_sem);
++			INIT_LIST_HEAD(&tty->tty_files);
++			kref_get(&tty->driver->kref);
++			tty->ops = &usb_console_fake_tty_ops;
+ 			if (tty_init_termios(tty)) {
+ 				retval = -ENOMEM;
+-				goto free_tty;
++				goto put_tty;
+ 			}
++			tty_port_tty_set(&port->port, tty);
+ 		}
+ 
+ 		/* only call the device specific open if this
+@@ -161,7 +167,7 @@ static int usb_console_setup(struct console *co, char *options)
+ 			serial->type->set_termios(tty, port, &dummy);
+ 
+ 			tty_port_tty_set(&port->port, NULL);
+-			kfree(tty);
++			tty_kref_put(tty);
+ 		}
+ 		set_bit(ASYNCB_INITIALIZED, &port->port.flags);
+ 	}
+@@ -177,8 +183,8 @@ static int usb_console_setup(struct console *co, char *options)
+ 
+  fail:
+ 	tty_port_tty_set(&port->port, NULL);
+- free_tty:
+-	kfree(tty);
++ put_tty:
++	tty_kref_put(tty);
+  reset_open_count:
+ 	port->port.count = 0;
+ 	usb_autopm_put_interface(serial->interface);
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 6c4eb3cf5efd..f4c56fc1a9f6 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -120,10 +120,12 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
+ 	{ USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
+ 	{ USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
+-	{ USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */
++	{ USB_DEVICE(0x10C4, 0x8856) },	/* CEL EM357 ZigBee USB Stick - LR */
++	{ USB_DEVICE(0x10C4, 0x8857) },	/* CEL EM357 ZigBee USB Stick */
+ 	{ USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
+ 	{ USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+ 	{ USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
++	{ USB_DEVICE(0x10C4, 0x8977) },	/* CEL MeshWorks DevKit Device */
+ 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ 	{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ 	{ USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
+index 077c714f1285..e07b15ed5814 100644
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -410,6 +410,8 @@ static void	usa26_instat_callback(struct urb *urb)
+ 	}
+ 	port = serial->port[msg->port];
+ 	p_priv = usb_get_serial_port_data(port);
++	if (!p_priv)
++		goto resubmit;
+ 
+ 	/* Update handshaking pin state information */
+ 	old_dcd_state = p_priv->dcd_state;
+@@ -420,7 +422,7 @@ static void	usa26_instat_callback(struct urb *urb)
+ 
+ 	if (old_dcd_state != p_priv->dcd_state)
+ 		tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ 	/* Resubmit urb so we continue receiving */
+ 	err = usb_submit_urb(urb, GFP_ATOMIC);
+ 	if (err != 0)
+@@ -527,6 +529,8 @@ static void	usa28_instat_callback(struct urb *urb)
+ 	}
+ 	port = serial->port[msg->port];
+ 	p_priv = usb_get_serial_port_data(port);
++	if (!p_priv)
++		goto resubmit;
+ 
+ 	/* Update handshaking pin state information */
+ 	old_dcd_state = p_priv->dcd_state;
+@@ -537,7 +541,7 @@ static void	usa28_instat_callback(struct urb *urb)
+ 
+ 	if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
+ 		tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ 		/* Resubmit urb so we continue receiving */
+ 	err = usb_submit_urb(urb, GFP_ATOMIC);
+ 	if (err != 0)
+@@ -607,6 +611,8 @@ static void	usa49_instat_callback(struct urb *urb)
+ 	}
+ 	port = serial->port[msg->portNumber];
+ 	p_priv = usb_get_serial_port_data(port);
++	if (!p_priv)
++		goto resubmit;
+ 
+ 	/* Update handshaking pin state information */
+ 	old_dcd_state = p_priv->dcd_state;
+@@ -617,7 +623,7 @@ static void	usa49_instat_callback(struct urb *urb)
+ 
+ 	if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
+ 		tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ 	/* Resubmit urb so we continue receiving */
+ 	err = usb_submit_urb(urb, GFP_ATOMIC);
+ 	if (err != 0)
+@@ -855,6 +861,8 @@ static void	usa90_instat_callback(struct urb *urb)
+ 
+ 	port = serial->port[0];
+ 	p_priv = usb_get_serial_port_data(port);
++	if (!p_priv)
++		goto resubmit;
+ 
+ 	/* Update handshaking pin state information */
+ 	old_dcd_state = p_priv->dcd_state;
+@@ -865,7 +873,7 @@ static void	usa90_instat_callback(struct urb *urb)
+ 
+ 	if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
+ 		tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ 	/* Resubmit urb so we continue receiving */
+ 	err = usb_submit_urb(urb, GFP_ATOMIC);
+ 	if (err != 0)
+@@ -926,6 +934,8 @@ static void	usa67_instat_callback(struct urb *urb)
+ 
+ 	port = serial->port[msg->port];
+ 	p_priv = usb_get_serial_port_data(port);
++	if (!p_priv)
++		goto resubmit;
+ 
+ 	/* Update handshaking pin state information */
+ 	old_dcd_state = p_priv->dcd_state;
+@@ -934,7 +944,7 @@ static void	usa67_instat_callback(struct urb *urb)
+ 
+ 	if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
+ 		tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ 	/* Resubmit urb so we continue receiving */
+ 	err = usb_submit_urb(urb, GFP_ATOMIC);
+ 	if (err != 0)
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 7a4c21b4f676..efdcee15b520 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -234,6 +234,8 @@ static void option_instat_callback(struct urb *urb);
+ 
+ #define QUALCOMM_VENDOR_ID			0x05C6
+ 
++#define SIERRA_VENDOR_ID			0x1199
++
+ #define CMOTECH_VENDOR_ID			0x16d8
+ #define CMOTECH_PRODUCT_6001			0x6001
+ #define CMOTECH_PRODUCT_CMU_300			0x6002
+@@ -512,7 +514,7 @@ enum option_blacklist_reason {
+ 		OPTION_BLACKLIST_RESERVED_IF = 2
+ };
+ 
+-#define MAX_BL_NUM  8
++#define MAX_BL_NUM  11
+ struct option_blacklist_info {
+ 	/* bitfield of interface numbers for OPTION_BLACKLIST_SENDSETUP */
+ 	const unsigned long sendsetup;
+@@ -601,6 +603,11 @@ static const struct option_blacklist_info telit_le920_blacklist = {
+ 	.reserved = BIT(1) | BIT(5),
+ };
+ 
++static const struct option_blacklist_info sierra_mc73xx_blacklist = {
++	.sendsetup = BIT(0) | BIT(2),
++	.reserved = BIT(8) | BIT(10) | BIT(11),
++};
++
+ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
+ 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
+@@ -1098,6 +1105,8 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
++	{ USB_DEVICE_INTERFACE_CLASS(SIERRA_VENDOR_ID, 0x68c0, 0xff),
++	  .driver_info = (kernel_ulong_t)&sierra_mc73xx_blacklist }, /* MC73xx */
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index cb3e14780a7e..9c63897b3a56 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -142,7 +142,6 @@ static const struct usb_device_id id_table[] = {
+ 	{DEVICE_SWI(0x0f3d, 0x68a2)},	/* Sierra Wireless MC7700 */
+ 	{DEVICE_SWI(0x114f, 0x68a2)},	/* Sierra Wireless MC7750 */
+ 	{DEVICE_SWI(0x1199, 0x68a2)},	/* Sierra Wireless MC7710 */
+-	{DEVICE_SWI(0x1199, 0x68c0)},	/* Sierra Wireless MC73xx */
+ 	{DEVICE_SWI(0x1199, 0x901c)},	/* Sierra Wireless EM7700 */
+ 	{DEVICE_SWI(0x1199, 0x901f)},	/* Sierra Wireless EM7355 */
+ 	{DEVICE_SWI(0x1199, 0x9040)},	/* Sierra Wireless Modem */
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 18a283d6de1c..1f430bb02ca1 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -68,6 +68,20 @@ UNUSUAL_DEV(0x0bc2, 0xa003, 0x0000, 0x9999,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_NO_ATA_1X),
+ 
++/* Reported-by: Marcin Zajączkowski <mszpak@××.pl> */
++UNUSUAL_DEV(0x0bc2, 0xa013, 0x0000, 0x9999,
++		"Seagate",
++		"Backup Plus",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_NO_ATA_1X),
++
++/* Reported-by: Hans de Goede <hdegoede@××××××.com> */
++UNUSUAL_DEV(0x0bc2, 0xa0a4, 0x0000, 0x9999,
++		"Seagate",
++		"Backup Plus Desk",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_NO_ATA_1X),
++
+ /* https://bbs.archlinux.org/viewtopic.php?id=183190 */
+ UNUSUAL_DEV(0x0bc2, 0xab20, 0x0000, 0x9999,
+ 		"Seagate",
+@@ -82,6 +96,13 @@ UNUSUAL_DEV(0x0bc2, 0xab21, 0x0000, 0x9999,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_NO_ATA_1X),
+ 
++/* Reported-by: G. Richard Bellamy <rbellamy@×××××××××.com> */
++UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
++		"Seagate",
++		"BUP Fast HDD",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_NO_ATA_1X),
++
+ /* Reported-by: Claudio Bizzarri <claudio.bizzarri@×××××.com> */
+ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
+ 		"JMicron",
+@@ -104,6 +125,13 @@ UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_NO_ATA_1X),
+ 
++/* Reported-by: Takeo Nakayama <javhera@×××.com> */
++UNUSUAL_DEV(0x357d, 0x7788, 0x0000, 0x9999,
++		"JMicron",
++		"JMS566",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_NO_REPORT_OPCODES),
++
+ /* Reported-by: Hans de Goede <hdegoede@××××××.com> */
+ UNUSUAL_DEV(0x4971, 0x1012, 0x0000, 0x9999,
+ 		"Hitachi",
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 9558da3f06a0..2f8a0552d020 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -839,13 +839,11 @@ static const struct vfio_device_ops vfio_pci_ops = {
+ 
+ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ {
+-	u8 type;
+ 	struct vfio_pci_device *vdev;
+ 	struct iommu_group *group;
+ 	int ret;
+ 
+-	pci_read_config_byte(pdev, PCI_HEADER_TYPE, &type);
+-	if ((type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL)
++	if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL)
+ 		return -EINVAL;
+ 
+ 	group = iommu_group_get(&pdev->dev);
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index a17f11850669..cb84f69f76ad 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -909,6 +909,23 @@ vhost_scsi_map_iov_to_prot(struct tcm_vhost_cmd *cmd,
+ 	return 0;
+ }
+ 
++static int vhost_scsi_to_tcm_attr(int attr)
++{
++	switch (attr) {
++	case VIRTIO_SCSI_S_SIMPLE:
++		return MSG_SIMPLE_TAG;
++	case VIRTIO_SCSI_S_ORDERED:
++		return MSG_ORDERED_TAG;
++	case VIRTIO_SCSI_S_HEAD:
++		return MSG_HEAD_TAG;
++	case VIRTIO_SCSI_S_ACA:
++		return MSG_ACA_TAG;
++	default:
++		break;
++	}
++	return MSG_SIMPLE_TAG;
++}
++
+ static void tcm_vhost_submission_work(struct work_struct *work)
+ {
+ 	struct tcm_vhost_cmd *cmd =
+@@ -934,9 +951,10 @@ static void tcm_vhost_submission_work(struct work_struct *work)
+ 	rc = target_submit_cmd_map_sgls(se_cmd, tv_nexus->tvn_se_sess,
+ 			cmd->tvc_cdb, &cmd->tvc_sense_buf[0],
+ 			cmd->tvc_lun, cmd->tvc_exp_data_len,
+-			cmd->tvc_task_attr, cmd->tvc_data_direction,
+-			TARGET_SCF_ACK_KREF, sg_ptr, cmd->tvc_sgl_count,
+-			NULL, 0, sg_prot_ptr, cmd->tvc_prot_sgl_count);
++			vhost_scsi_to_tcm_attr(cmd->tvc_task_attr),
++			cmd->tvc_data_direction, TARGET_SCF_ACK_KREF,
++			sg_ptr, cmd->tvc_sgl_count, NULL, 0,
++			sg_prot_ptr, cmd->tvc_prot_sgl_count);
+ 	if (rc < 0) {
+ 		transport_send_check_condition_and_sense(se_cmd,
+ 				TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE, 0);
+diff --git a/drivers/video/fbdev/core/fb_defio.c b/drivers/video/fbdev/core/fb_defio.c
+index 900aa4ecd617..d6cab1fd9a47 100644
+--- a/drivers/video/fbdev/core/fb_defio.c
++++ b/drivers/video/fbdev/core/fb_defio.c
+@@ -83,9 +83,10 @@ int fb_deferred_io_fsync(struct file *file, loff_t start, loff_t end, int datasy
+ 	cancel_delayed_work_sync(&info->deferred_work);
+ 
+ 	/* Run it immediately */
+-	err = schedule_delayed_work(&info->deferred_work, 0);
++	schedule_delayed_work(&info->deferred_work, 0);
+ 	mutex_unlock(&inode->i_mutex);
+-	return err;
++
++	return 0;
+ }
+ EXPORT_SYMBOL_GPL(fb_deferred_io_fsync);
+ 
+diff --git a/drivers/video/logo/logo.c b/drivers/video/logo/logo.c
+index 940cd196eef5..10fbfd8ab963 100644
+--- a/drivers/video/logo/logo.c
++++ b/drivers/video/logo/logo.c
+@@ -21,6 +21,21 @@ static bool nologo;
+ module_param(nologo, bool, 0);
+ MODULE_PARM_DESC(nologo, "Disables startup logo");
+ 
++/*
++ * Logos are located in the initdata, and will be freed in kernel_init.
++ * Use late_init to mark the logos as freed to prevent any further use.
++ */
++
++static bool logos_freed;
++
++static int __init fb_logo_late_init(void)
++{
++	logos_freed = true;
++	return 0;
++}
++
++late_initcall(fb_logo_late_init);
++
+ /* logo's are marked __initdata. Use __init_refok to tell
+  * modpost that it is intended that this function uses data
+  * marked __initdata.
+@@ -29,7 +44,7 @@ const struct linux_logo * __init_refok fb_find_logo(int depth)
+ {
+ 	const struct linux_logo *logo = NULL;
+ 
+-	if (nologo)
++	if (nologo || logos_freed)
+ 		return NULL;
+ 
+ 	if (depth >= 1) {
+diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
+index d1bb7ecfd201..61024987f97b 100644
+--- a/fs/lockd/svc.c
++++ b/fs/lockd/svc.c
+@@ -138,10 +138,6 @@ lockd(void *vrqstp)
+ 
+ 	dprintk("NFS locking service started (ver " LOCKD_VERSION ").\n");
+ 
+-	if (!nlm_timeout)
+-		nlm_timeout = LOCKD_DFLT_TIMEO;
+-	nlmsvc_timeout = nlm_timeout * HZ;
+-
+ 	/*
+ 	 * The main request loop. We don't terminate until the last
+ 	 * NFS mount or NFS daemon has gone away.
+@@ -350,6 +346,10 @@ static struct svc_serv *lockd_create_svc(void)
+ 		printk(KERN_WARNING
+ 			"lockd_up: no pid, %d users??\n", nlmsvc_users);
+ 
++	if (!nlm_timeout)
++		nlm_timeout = LOCKD_DFLT_TIMEO;
++	nlmsvc_timeout = nlm_timeout * HZ;
++
+ 	serv = svc_create(&nlmsvc_program, LOCKD_BUFSIZE, NULL);
+ 	if (!serv) {
+ 		printk(KERN_WARNING "lockd_up: create service failed\n");
+diff --git a/fs/locks.c b/fs/locks.c
+index 735b8d3fa78c..59e2f905e4ff 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -1702,7 +1702,7 @@ static int generic_delete_lease(struct file *filp)
+ 			break;
+ 	}
+ 	trace_generic_delete_lease(inode, fl);
+-	if (fl)
++	if (fl && IS_LEASE(fl))
+ 		error = fl->fl_lmops->lm_change(before, F_UNLCK, &dispose);
+ 	spin_unlock(&inode->i_lock);
+ 	locks_dispose_list(&dispose);
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index ffdb28d86cf8..9588873d4c46 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -572,20 +572,14 @@ static bool nfs4_match_clientids(struct nfs_client *a, struct nfs_client *b)
+ }
+ 
+ /*
+- * Returns true if the server owners match
++ * Returns true if the server major ids match
+  */
+ static bool
+-nfs4_match_serverowners(struct nfs_client *a, struct nfs_client *b)
++nfs4_check_clientid_trunking(struct nfs_client *a, struct nfs_client *b)
+ {
+ 	struct nfs41_server_owner *o1 = a->cl_serverowner;
+ 	struct nfs41_server_owner *o2 = b->cl_serverowner;
+ 
+-	if (o1->minor_id != o2->minor_id) {
+-		dprintk("NFS: --> %s server owner minor IDs do not match\n",
+-			__func__);
+-		return false;
+-	}
+-
+ 	if (o1->major_id_sz != o2->major_id_sz)
+ 		goto out_major_mismatch;
+ 	if (memcmp(o1->major_id, o2->major_id, o1->major_id_sz) != 0)
+@@ -661,7 +655,12 @@ int nfs41_walk_client_list(struct nfs_client *new,
+ 		if (!nfs4_match_clientids(pos, new))
+ 			continue;
+ 
+-		if (!nfs4_match_serverowners(pos, new))
++		/*
++		 * Note that session trunking is just a special subcase of
++		 * client id trunking. In either case, we want to fall back
++		 * to using the existing nfs_client.
++		 */
++		if (!nfs4_check_clientid_trunking(pos, new))
+ 			continue;
+ 
+ 		atomic_inc(&pos->cl_count);
+diff --git a/fs/proc/stat.c b/fs/proc/stat.c
+index bf2d03f8fd3e..510413eb25b8 100644
+--- a/fs/proc/stat.c
++++ b/fs/proc/stat.c
+@@ -159,7 +159,7 @@ static int show_stat(struct seq_file *p, void *v)
+ 
+ 	/* sum again ? it could be updated? */
+ 	for_each_irq_nr(j)
+-		seq_put_decimal_ull(p, ' ', kstat_irqs(j));
++		seq_put_decimal_ull(p, ' ', kstat_irqs_usr(j));
+ 
+ 	seq_printf(p,
+ 		"\nctxt %llu\n"
+diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h
+index b9376cd5a187..25a822f6f000 100644
+--- a/include/linux/kernel_stat.h
++++ b/include/linux/kernel_stat.h
+@@ -68,6 +68,7 @@ static inline unsigned int kstat_softirqs_cpu(unsigned int irq, int cpu)
+  * Number of interrupts per specific IRQ source, since bootup
+  */
+ extern unsigned int kstat_irqs(unsigned int irq);
++extern unsigned int kstat_irqs_usr(unsigned int irq);
+ 
+ /*
+  * Number of interrupts per cpu, since bootup
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 74fd5d37f15a..22339b4b1c8c 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -998,12 +998,15 @@ typedef u16 (*select_queue_fallback_t)(struct net_device *dev,
+  *	Callback to use for xmit over the accelerated station. This
+  *	is used in place of ndo_start_xmit on accelerated net
+  *	devices.
+- * bool	(*ndo_gso_check) (struct sk_buff *skb,
+- *			  struct net_device *dev);
++ * netdev_features_t (*ndo_features_check) (struct sk_buff *skb,
++ *					    struct net_device *dev
++ *					    netdev_features_t features);
+  *	Called by core transmit path to determine if device is capable of
+- *	performing GSO on a packet. The device returns true if it is
+- *	able to GSO the packet, false otherwise. If the return value is
+- *	false the stack will do software GSO.
++ *	performing offload operations on a given packet. This is to give
++ *	the device an opportunity to implement any restrictions that cannot
++ *	be otherwise expressed by feature flags. The check is called with
++ *	the set of features that the stack has calculated and it returns
++ *	those the driver believes to be appropriate.
+  */
+ struct net_device_ops {
+ 	int			(*ndo_init)(struct net_device *dev);
+@@ -1153,8 +1156,9 @@ struct net_device_ops {
+ 							struct net_device *dev,
+ 							void *priv);
+ 	int			(*ndo_get_lock_subclass)(struct net_device *dev);
+-	bool			(*ndo_gso_check) (struct sk_buff *skb,
+-						  struct net_device *dev);
++	netdev_features_t	(*ndo_features_check) (struct sk_buff *skb,
++						       struct net_device *dev,
++						       netdev_features_t features);
+ };
+ 
+ /**
+@@ -3584,8 +3588,6 @@ static inline bool netif_needs_gso(struct net_device *dev, struct sk_buff *skb,
+ 				   netdev_features_t features)
+ {
+ 	return skb_is_gso(skb) && (!skb_gso_ok(skb, features) ||
+-		(dev->netdev_ops->ndo_gso_check &&
+-		 !dev->netdev_ops->ndo_gso_check(skb, dev)) ||
+ 		unlikely((skb->ip_summed != CHECKSUM_PARTIAL) &&
+ 			 (skb->ip_summed != CHECKSUM_UNNECESSARY)));
+ }
+diff --git a/include/net/vxlan.h b/include/net/vxlan.h
+index 57cccd0052e5..903461aa5644 100644
+--- a/include/net/vxlan.h
++++ b/include/net/vxlan.h
+@@ -1,6 +1,9 @@
+ #ifndef __NET_VXLAN_H
+ #define __NET_VXLAN_H 1
+ 
++#include <linux/ip.h>
++#include <linux/ipv6.h>
++#include <linux/if_vlan.h>
+ #include <linux/skbuff.h>
+ #include <linux/netdevice.h>
+ #include <linux/udp.h>
+@@ -51,16 +54,33 @@ int vxlan_xmit_skb(struct vxlan_sock *vs,
+ 		   __be32 src, __be32 dst, __u8 tos, __u8 ttl, __be16 df,
+ 		   __be16 src_port, __be16 dst_port, __be32 vni, bool xnet);
+ 
+-static inline bool vxlan_gso_check(struct sk_buff *skb)
++static inline netdev_features_t vxlan_features_check(struct sk_buff *skb,
++						     netdev_features_t features)
+ {
+-	if ((skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL) &&
++	u8 l4_hdr = 0;
++
++	if (!skb->encapsulation)
++		return features;
++
++	switch (vlan_get_protocol(skb)) {
++	case htons(ETH_P_IP):
++		l4_hdr = ip_hdr(skb)->protocol;
++		break;
++	case htons(ETH_P_IPV6):
++		l4_hdr = ipv6_hdr(skb)->nexthdr;
++		break;
++	default:
++		return features;;
++	}
++
++	if ((l4_hdr == IPPROTO_UDP) &&
+ 	    (skb->inner_protocol_type != ENCAP_TYPE_ETHER ||
+ 	     skb->inner_protocol != htons(ETH_P_TEB) ||
+ 	     (skb_inner_mac_header(skb) - skb_transport_header(skb) !=
+ 	      sizeof(struct udphdr) + sizeof(struct vxlanhdr))))
+-		return false;
++		return features & ~(NETIF_F_ALL_CSUM | NETIF_F_GSO_MASK);
+ 
+-	return true;
++	return features;
+ }
+ 
+ /* IP header + UDP + VXLAN + Ethernet header */
+diff --git a/include/uapi/linux/in6.h b/include/uapi/linux/in6.h
+index 74a2a1773494..79b12b004ade 100644
+--- a/include/uapi/linux/in6.h
++++ b/include/uapi/linux/in6.h
+@@ -149,7 +149,7 @@ struct in6_flowlabel_req {
+ /*
+  *	IPV6 socket options
+  */
+-
++#if __UAPI_DEF_IPV6_OPTIONS
+ #define IPV6_ADDRFORM		1
+ #define IPV6_2292PKTINFO	2
+ #define IPV6_2292HOPOPTS	3
+@@ -196,6 +196,7 @@ struct in6_flowlabel_req {
+ 
+ #define IPV6_IPSEC_POLICY	34
+ #define IPV6_XFRM_POLICY	35
++#endif
+ 
+ /*
+  * Multicast:
+diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
+index c140620dad92..e28807ad17fa 100644
+--- a/include/uapi/linux/libc-compat.h
++++ b/include/uapi/linux/libc-compat.h
+@@ -69,6 +69,7 @@
+ #define __UAPI_DEF_SOCKADDR_IN6		0
+ #define __UAPI_DEF_IPV6_MREQ		0
+ #define __UAPI_DEF_IPPROTO_V6		0
++#define __UAPI_DEF_IPV6_OPTIONS		0
+ 
+ #else
+ 
+@@ -82,6 +83,7 @@
+ #define __UAPI_DEF_SOCKADDR_IN6		1
+ #define __UAPI_DEF_IPV6_MREQ		1
+ #define __UAPI_DEF_IPPROTO_V6		1
++#define __UAPI_DEF_IPV6_OPTIONS		1
+ 
+ #endif /* _NETINET_IN_H */
+ 
+@@ -103,6 +105,7 @@
+ #define __UAPI_DEF_SOCKADDR_IN6		1
+ #define __UAPI_DEF_IPV6_MREQ		1
+ #define __UAPI_DEF_IPPROTO_V6		1
++#define __UAPI_DEF_IPV6_OPTIONS		1
+ 
+ /* Definitions for xattr.h */
+ #define __UAPI_DEF_XATTR		1
+diff --git a/include/uapi/linux/target_core_user.h b/include/uapi/linux/target_core_user.h
+index 7dcfbe6771b1..b483d1909d3e 100644
+--- a/include/uapi/linux/target_core_user.h
++++ b/include/uapi/linux/target_core_user.h
+@@ -6,10 +6,6 @@
+ #include <linux/types.h>
+ #include <linux/uio.h>
+ 
+-#ifndef __packed
+-#define __packed                        __attribute__((packed))
+-#endif
+-
+ #define TCMU_VERSION "1.0"
+ 
+ /*
+diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
+index 4332d766619d..df553b0af936 100644
+--- a/kernel/irq/internals.h
++++ b/kernel/irq/internals.h
+@@ -78,8 +78,12 @@ extern void unmask_threaded_irq(struct irq_desc *desc);
+ 
+ #ifdef CONFIG_SPARSE_IRQ
+ static inline void irq_mark_irq(unsigned int irq) { }
++extern void irq_lock_sparse(void);
++extern void irq_unlock_sparse(void);
+ #else
+ extern void irq_mark_irq(unsigned int irq);
++static inline void irq_lock_sparse(void) { }
++static inline void irq_unlock_sparse(void) { }
+ #endif
+ 
+ extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr);
+diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
+index a1782f88f0af..99793b9b6d23 100644
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -132,6 +132,16 @@ static void free_masks(struct irq_desc *desc)
+ static inline void free_masks(struct irq_desc *desc) { }
+ #endif
+ 
++void irq_lock_sparse(void)
++{
++	mutex_lock(&sparse_irq_lock);
++}
++
++void irq_unlock_sparse(void)
++{
++	mutex_unlock(&sparse_irq_lock);
++}
++
+ static struct irq_desc *alloc_desc(int irq, int node, struct module *owner)
+ {
+ 	struct irq_desc *desc;
+@@ -168,6 +178,12 @@ static void free_desc(unsigned int irq)
+ 
+ 	unregister_irq_proc(irq, desc);
+ 
++	/*
++	 * sparse_irq_lock protects also show_interrupts() and
++	 * kstat_irq_usr(). Once we deleted the descriptor from the
++	 * sparse tree we can free it. Access in proc will fail to
++	 * lookup the descriptor.
++	 */
+ 	mutex_lock(&sparse_irq_lock);
+ 	delete_irq_desc(irq);
+ 	mutex_unlock(&sparse_irq_lock);
+@@ -574,6 +590,15 @@ void kstat_incr_irq_this_cpu(unsigned int irq)
+ 	kstat_incr_irqs_this_cpu(irq, irq_to_desc(irq));
+ }
+ 
++/**
++ * kstat_irqs_cpu - Get the statistics for an interrupt on a cpu
++ * @irq:	The interrupt number
++ * @cpu:	The cpu number
++ *
++ * Returns the sum of interrupt counts on @cpu since boot for
++ * @irq. The caller must ensure that the interrupt is not removed
++ * concurrently.
++ */
+ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
+ {
+ 	struct irq_desc *desc = irq_to_desc(irq);
+@@ -582,6 +607,14 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
+ 			*per_cpu_ptr(desc->kstat_irqs, cpu) : 0;
+ }
+ 
++/**
++ * kstat_irqs - Get the statistics for an interrupt
++ * @irq:	The interrupt number
++ *
++ * Returns the sum of interrupt counts on all cpus since boot for
++ * @irq. The caller must ensure that the interrupt is not removed
++ * concurrently.
++ */
+ unsigned int kstat_irqs(unsigned int irq)
+ {
+ 	struct irq_desc *desc = irq_to_desc(irq);
+@@ -594,3 +627,22 @@ unsigned int kstat_irqs(unsigned int irq)
+ 		sum += *per_cpu_ptr(desc->kstat_irqs, cpu);
+ 	return sum;
+ }
++
++/**
++ * kstat_irqs_usr - Get the statistics for an interrupt
++ * @irq:	The interrupt number
++ *
++ * Returns the sum of interrupt counts on all cpus since boot for
++ * @irq. Contrary to kstat_irqs() this can be called from any
++ * preemptible context. It's protected against concurrent removal of
++ * an interrupt descriptor when sparse irqs are enabled.
++ */
++unsigned int kstat_irqs_usr(unsigned int irq)
++{
++	int sum;
++
++	irq_lock_sparse();
++	sum = kstat_irqs(irq);
++	irq_unlock_sparse();
++	return sum;
++}
+diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
+index ac1ba2f11032..9dc9bfd8a678 100644
+--- a/kernel/irq/proc.c
++++ b/kernel/irq/proc.c
+@@ -15,6 +15,23 @@
+ 
+ #include "internals.h"
+ 
++/*
++ * Access rules:
++ *
++ * procfs protects read/write of /proc/irq/N/ files against a
++ * concurrent free of the interrupt descriptor. remove_proc_entry()
++ * immediately prevents new read/writes to happen and waits for
++ * already running read/write functions to complete.
++ *
++ * We remove the proc entries first and then delete the interrupt
++ * descriptor from the radix tree and free it. So it is guaranteed
++ * that irq_to_desc(N) is valid as long as the read/writes are
++ * permitted by procfs.
++ *
++ * The read from /proc/interrupts is a different problem because there
++ * is no protection. So the lookup and the access to irqdesc
++ * information must be protected by sparse_irq_lock.
++ */
+ static struct proc_dir_entry *root_irq_dir;
+ 
+ #ifdef CONFIG_SMP
+@@ -437,9 +454,10 @@ int show_interrupts(struct seq_file *p, void *v)
+ 		seq_putc(p, '\n');
+ 	}
+ 
++	irq_lock_sparse();
+ 	desc = irq_to_desc(i);
+ 	if (!desc)
+-		return 0;
++		goto outsparse;
+ 
+ 	raw_spin_lock_irqsave(&desc->lock, flags);
+ 	for_each_online_cpu(j)
+@@ -479,6 +497,8 @@ int show_interrupts(struct seq_file *p, void *v)
+ 	seq_putc(p, '\n');
+ out:
+ 	raw_spin_unlock_irqrestore(&desc->lock, flags);
++outsparse:
++	irq_unlock_sparse();
+ 	return 0;
+ }
+ #endif
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 7b5741fc4110..8c30ef7a2b70 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -847,7 +847,6 @@ void tick_nohz_idle_enter(void)
+ 
+ 	local_irq_enable();
+ }
+-EXPORT_SYMBOL_GPL(tick_nohz_idle_enter);
+ 
+ /**
+  * tick_nohz_irq_exit - update next tick event from interrupt exit
+@@ -974,7 +973,6 @@ void tick_nohz_idle_exit(void)
+ 
+ 	local_irq_enable();
+ }
+-EXPORT_SYMBOL_GPL(tick_nohz_idle_exit);
+ 
+ static int tick_nohz_reprogram(struct tick_sched *ts, ktime_t now)
+ {
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 31c90fec4158..124e2c702ead 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2308,12 +2308,14 @@ static void ftrace_run_update_code(int command)
+ }
+ 
+ static void ftrace_run_modify_code(struct ftrace_ops *ops, int command,
+-				   struct ftrace_hash *old_hash)
++				   struct ftrace_ops_hash *old_hash)
+ {
+ 	ops->flags |= FTRACE_OPS_FL_MODIFYING;
+-	ops->old_hash.filter_hash = old_hash;
++	ops->old_hash.filter_hash = old_hash->filter_hash;
++	ops->old_hash.notrace_hash = old_hash->notrace_hash;
+ 	ftrace_run_update_code(command);
+ 	ops->old_hash.filter_hash = NULL;
++	ops->old_hash.notrace_hash = NULL;
+ 	ops->flags &= ~FTRACE_OPS_FL_MODIFYING;
+ }
+ 
+@@ -3357,7 +3359,7 @@ static struct ftrace_ops trace_probe_ops __read_mostly =
+ 
+ static int ftrace_probe_registered;
+ 
+-static void __enable_ftrace_function_probe(struct ftrace_hash *old_hash)
++static void __enable_ftrace_function_probe(struct ftrace_ops_hash *old_hash)
+ {
+ 	int ret;
+ 	int i;
+@@ -3415,6 +3417,7 @@ int
+ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
+ 			      void *data)
+ {
++	struct ftrace_ops_hash old_hash_ops;
+ 	struct ftrace_func_probe *entry;
+ 	struct ftrace_hash **orig_hash = &trace_probe_ops.func_hash->filter_hash;
+ 	struct ftrace_hash *old_hash = *orig_hash;
+@@ -3436,6 +3439,10 @@ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
+ 
+ 	mutex_lock(&trace_probe_ops.func_hash->regex_lock);
+ 
++	old_hash_ops.filter_hash = old_hash;
++	/* Probes only have filters */
++	old_hash_ops.notrace_hash = NULL;
++
+ 	hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, old_hash);
+ 	if (!hash) {
+ 		count = -ENOMEM;
+@@ -3496,7 +3503,7 @@ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
+ 
+ 	ret = ftrace_hash_move(&trace_probe_ops, 1, orig_hash, hash);
+ 
+-	__enable_ftrace_function_probe(old_hash);
++	__enable_ftrace_function_probe(&old_hash_ops);
+ 
+ 	if (!ret)
+ 		free_ftrace_hash_rcu(old_hash);
+@@ -3784,10 +3791,34 @@ ftrace_match_addr(struct ftrace_hash *hash, unsigned long ip, int remove)
+ }
+ 
+ static void ftrace_ops_update_code(struct ftrace_ops *ops,
+-				   struct ftrace_hash *old_hash)
++				   struct ftrace_ops_hash *old_hash)
+ {
+-	if (ops->flags & FTRACE_OPS_FL_ENABLED && ftrace_enabled)
++	struct ftrace_ops *op;
++
++	if (!ftrace_enabled)
++		return;
++
++	if (ops->flags & FTRACE_OPS_FL_ENABLED) {
+ 		ftrace_run_modify_code(ops, FTRACE_UPDATE_CALLS, old_hash);
++		return;
++	}
++
++	/*
++	 * If this is the shared global_ops filter, then we need to
++	 * check if there is another ops that shares it, is enabled.
++	 * If so, we still need to run the modify code.
++	 */
++	if (ops->func_hash != &global_ops.local_hash)
++		return;
++
++	do_for_each_ftrace_op(op, ftrace_ops_list) {
++		if (op->func_hash == &global_ops.local_hash &&
++		    op->flags & FTRACE_OPS_FL_ENABLED) {
++			ftrace_run_modify_code(op, FTRACE_UPDATE_CALLS, old_hash);
++			/* Only need to do this once */
++			return;
++		}
++	} while_for_each_ftrace_op(op);
+ }
+ 
+ static int
+@@ -3795,6 +3826,7 @@ ftrace_set_hash(struct ftrace_ops *ops, unsigned char *buf, int len,
+ 		unsigned long ip, int remove, int reset, int enable)
+ {
+ 	struct ftrace_hash **orig_hash;
++	struct ftrace_ops_hash old_hash_ops;
+ 	struct ftrace_hash *old_hash;
+ 	struct ftrace_hash *hash;
+ 	int ret;
+@@ -3831,9 +3863,11 @@ ftrace_set_hash(struct ftrace_ops *ops, unsigned char *buf, int len,
+ 
+ 	mutex_lock(&ftrace_lock);
+ 	old_hash = *orig_hash;
++	old_hash_ops.filter_hash = ops->func_hash->filter_hash;
++	old_hash_ops.notrace_hash = ops->func_hash->notrace_hash;
+ 	ret = ftrace_hash_move(ops, enable, orig_hash, hash);
+ 	if (!ret) {
+-		ftrace_ops_update_code(ops, old_hash);
++		ftrace_ops_update_code(ops, &old_hash_ops);
+ 		free_ftrace_hash_rcu(old_hash);
+ 	}
+ 	mutex_unlock(&ftrace_lock);
+@@ -4042,6 +4076,7 @@ static void __init set_ftrace_early_filters(void)
+ int ftrace_regex_release(struct inode *inode, struct file *file)
+ {
+ 	struct seq_file *m = (struct seq_file *)file->private_data;
++	struct ftrace_ops_hash old_hash_ops;
+ 	struct ftrace_iterator *iter;
+ 	struct ftrace_hash **orig_hash;
+ 	struct ftrace_hash *old_hash;
+@@ -4075,10 +4110,12 @@ int ftrace_regex_release(struct inode *inode, struct file *file)
+ 
+ 		mutex_lock(&ftrace_lock);
+ 		old_hash = *orig_hash;
++		old_hash_ops.filter_hash = iter->ops->func_hash->filter_hash;
++		old_hash_ops.notrace_hash = iter->ops->func_hash->notrace_hash;
+ 		ret = ftrace_hash_move(iter->ops, filter_hash,
+ 				       orig_hash, iter->hash);
+ 		if (!ret) {
+-			ftrace_ops_update_code(iter->ops, old_hash);
++			ftrace_ops_update_code(iter->ops, &old_hash_ops);
+ 			free_ftrace_hash_rcu(old_hash);
+ 		}
+ 		mutex_unlock(&ftrace_lock);
+diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
+index 8290e0bef7ea..6dd0335ea61b 100644
+--- a/lib/decompress_bunzip2.c
++++ b/lib/decompress_bunzip2.c
+@@ -184,7 +184,7 @@ static int INIT get_next_block(struct bunzip_data *bd)
+ 	if (get_bits(bd, 1))
+ 		return RETVAL_OBSOLETE_INPUT;
+ 	origPtr = get_bits(bd, 24);
+-	if (origPtr > dbufSize)
++	if (origPtr >= dbufSize)
+ 		return RETVAL_DATA_ERROR;
+ 	/* mapping table: if some byte values are never used (encoding things
+ 	   like ascii text), the compression code removes the gaps to have fewer
+diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
+index fc1835c6bb40..00f9e144cc97 100644
+--- a/net/batman-adv/fragmentation.c
++++ b/net/batman-adv/fragmentation.c
+@@ -251,7 +251,7 @@ batadv_frag_merge_packets(struct hlist_head *chain, struct sk_buff *skb)
+ 	kfree(entry);
+ 
+ 	/* Make room for the rest of the fragments. */
+-	if (pskb_expand_head(skb_out, 0, size - skb->len, GFP_ATOMIC) < 0) {
++	if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
+ 		kfree_skb(skb_out);
+ 		skb_out = NULL;
+ 		goto free;
+@@ -434,7 +434,7 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
+ 	 * fragments larger than BATADV_FRAG_MAX_FRAG_SIZE
+ 	 */
+ 	mtu = min_t(unsigned, mtu, BATADV_FRAG_MAX_FRAG_SIZE);
+-	max_fragment_size = (mtu - header_size - ETH_HLEN);
++	max_fragment_size = mtu - header_size;
+ 	max_packet_size = max_fragment_size * BATADV_FRAG_MAX_FRAGMENTS;
+ 
+ 	/* Don't even try to fragment, if we need more than 16 fragments */
+diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
+index 90cff585b37d..e0bcf9e84273 100644
+--- a/net/batman-adv/gateway_client.c
++++ b/net/batman-adv/gateway_client.c
+@@ -810,7 +810,7 @@ bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
+ 		goto out;
+ 
+ 	gw_node = batadv_gw_node_get(bat_priv, orig_dst_node);
+-	if (!gw_node->bandwidth_down == 0)
++	if (!gw_node)
+ 		goto out;
+ 
+ 	switch (atomic_read(&bat_priv->gw_mode)) {
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 945bbd001359..84409688ff39 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1697,6 +1697,7 @@ int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
+ 
+ 	skb_scrub_packet(skb, true);
+ 	skb->protocol = eth_type_trans(skb, dev);
++	skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
+ 
+ 	return 0;
+ }
+@@ -2565,7 +2566,7 @@ static netdev_features_t harmonize_features(struct sk_buff *skb,
+ 
+ netdev_features_t netif_skb_features(struct sk_buff *skb)
+ {
+-	const struct net_device *dev = skb->dev;
++	struct net_device *dev = skb->dev;
+ 	netdev_features_t features = dev->features;
+ 	u16 gso_segs = skb_shinfo(skb)->gso_segs;
+ 	__be16 protocol = skb->protocol;
+@@ -2573,11 +2574,21 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
+ 	if (gso_segs > dev->gso_max_segs || gso_segs < dev->gso_min_segs)
+ 		features &= ~NETIF_F_GSO_MASK;
+ 
+-	if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD)) {
+-		struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
+-		protocol = veh->h_vlan_encapsulated_proto;
+-	} else if (!vlan_tx_tag_present(skb)) {
+-		return harmonize_features(skb, features);
++	/* If encapsulation offload request, verify we are testing
++	 * hardware encapsulation features instead of standard
++	 * features for the netdev
++	 */
++	if (skb->encapsulation)
++		features &= dev->hw_enc_features;
++
++	if (!vlan_tx_tag_present(skb)) {
++		if (unlikely(protocol == htons(ETH_P_8021Q) ||
++			     protocol == htons(ETH_P_8021AD))) {
++			struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
++			protocol = veh->h_vlan_encapsulated_proto;
++		} else {
++			goto finalize;
++		}
+ 	}
+ 
+ 	features = netdev_intersect_features(features,
+@@ -2594,6 +2605,11 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
+ 						     NETIF_F_HW_VLAN_CTAG_TX |
+ 						     NETIF_F_HW_VLAN_STAG_TX);
+ 
++finalize:
++	if (dev->netdev_ops->ndo_features_check)
++		features &= dev->netdev_ops->ndo_features_check(skb, dev,
++								features);
++
+ 	return harmonize_features(skb, features);
+ }
+ EXPORT_SYMBOL(netif_skb_features);
+@@ -2668,19 +2684,12 @@ static struct sk_buff *validate_xmit_skb(struct sk_buff *skb, struct net_device
+ 	if (unlikely(!skb))
+ 		goto out_null;
+ 
+-	/* If encapsulation offload request, verify we are testing
+-	 * hardware encapsulation features instead of standard
+-	 * features for the netdev
+-	 */
+-	if (skb->encapsulation)
+-		features &= dev->hw_enc_features;
+-
+ 	if (netif_needs_gso(dev, skb, features)) {
+ 		struct sk_buff *segs;
+ 
+ 		segs = skb_gso_segment(skb, features);
+ 		if (IS_ERR(segs)) {
+-			segs = NULL;
++			goto out_kfree_skb;
+ 		} else if (segs) {
+ 			consume_skb(skb);
+ 			skb = segs;
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 32e31c299631..d7543d0fd744 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4040,6 +4040,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
+ 	skb->ignore_df = 0;
+ 	skb_dst_drop(skb);
+ 	skb->mark = 0;
++	skb_init_secmark(skb);
+ 	secpath_reset(skb);
+ 	nf_reset(skb);
+ 	nf_reset_trace(skb);
+diff --git a/net/ipv4/geneve.c b/net/ipv4/geneve.c
+index dedb21e99914..2caa6ad965a6 100644
+--- a/net/ipv4/geneve.c
++++ b/net/ipv4/geneve.c
+@@ -165,6 +165,15 @@ static void geneve_notify_add_rx_port(struct geneve_sock *gs)
+ 	}
+ }
+ 
++static void geneve_notify_del_rx_port(struct geneve_sock *gs)
++{
++	struct sock *sk = gs->sock->sk;
++	sa_family_t sa_family = sk->sk_family;
++
++	if (sa_family == AF_INET)
++		udp_del_offload(&gs->udp_offloads);
++}
++
+ /* Callback from net/ipv4/udp.c to receive packets */
+ static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
+ {
+@@ -293,6 +302,7 @@ struct geneve_sock *geneve_sock_add(struct net *net, __be16 port,
+ 				    geneve_rcv_t *rcv, void *data,
+ 				    bool no_share, bool ipv6)
+ {
++	struct geneve_net *gn = net_generic(net, geneve_net_id);
+ 	struct geneve_sock *gs;
+ 
+ 	gs = geneve_socket_create(net, port, rcv, data, ipv6);
+@@ -302,15 +312,15 @@ struct geneve_sock *geneve_sock_add(struct net *net, __be16 port,
+ 	if (no_share)	/* Return error if sharing is not allowed. */
+ 		return ERR_PTR(-EINVAL);
+ 
++	spin_lock(&gn->sock_lock);
+ 	gs = geneve_find_sock(net, port);
+-	if (gs) {
+-		if (gs->rcv == rcv)
+-			atomic_inc(&gs->refcnt);
+-		else
++	if (gs && ((gs->rcv != rcv) ||
++		   !atomic_add_unless(&gs->refcnt, 1, 0)))
+ 			gs = ERR_PTR(-EBUSY);
+-	} else {
++	spin_unlock(&gn->sock_lock);
++
++	if (!gs)
+ 		gs = ERR_PTR(-EINVAL);
+-	}
+ 
+ 	return gs;
+ }
+@@ -318,9 +328,17 @@ EXPORT_SYMBOL_GPL(geneve_sock_add);
+ 
+ void geneve_sock_release(struct geneve_sock *gs)
+ {
++	struct net *net = sock_net(gs->sock->sk);
++	struct geneve_net *gn = net_generic(net, geneve_net_id);
++
+ 	if (!atomic_dec_and_test(&gs->refcnt))
+ 		return;
+ 
++	spin_lock(&gn->sock_lock);
++	hlist_del_rcu(&gs->hlist);
++	geneve_notify_del_rx_port(gs);
++	spin_unlock(&gn->sock_lock);
++
+ 	queue_work(geneve_wq, &gs->del_work);
+ }
+ EXPORT_SYMBOL_GPL(geneve_sock_release);
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 12055fdbe716..69aaf0a2c424 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -252,10 +252,6 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
+ 	struct ip_tunnel *tunnel = netdev_priv(dev);
+ 	const struct iphdr *tnl_params;
+ 
+-	skb = gre_handle_offloads(skb, !!(tunnel->parms.o_flags&TUNNEL_CSUM));
+-	if (IS_ERR(skb))
+-		goto out;
+-
+ 	if (dev->header_ops) {
+ 		/* Need space for new headers */
+ 		if (skb_cow_head(skb, dev->needed_headroom -
+@@ -268,6 +264,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
+ 		 * to gre header.
+ 		 */
+ 		skb_pull(skb, tunnel->hlen + sizeof(struct iphdr));
++		skb_reset_mac_header(skb);
+ 	} else {
+ 		if (skb_cow_head(skb, dev->needed_headroom))
+ 			goto free_skb;
+@@ -275,6 +272,10 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
+ 		tnl_params = &tunnel->parms.iph;
+ 	}
+ 
++	skb = gre_handle_offloads(skb, !!(tunnel->parms.o_flags&TUNNEL_CSUM));
++	if (IS_ERR(skb))
++		goto out;
++
+ 	__gre_xmit(skb, dev, tnl_params, skb->protocol);
+ 
+ 	return NETDEV_TX_OK;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index a3d453b94747..c2df40ba553f 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1984,7 +1984,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
+ 		if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
+ 			break;
+ 
+-		if (tso_segs == 1) {
++		if (tso_segs == 1 || !sk->sk_gso_max_segs) {
+ 			if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
+ 						     (tcp_skb_is_last(sk, skb) ?
+ 						      nonagle : TCP_NAGLE_PUSH))))
+@@ -2020,7 +2020,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
+ 		}
+ 
+ 		limit = mss_now;
+-		if (tso_segs > 1 && !tcp_urg_mode(tp))
++		if (tso_segs > 1 && sk->sk_gso_max_segs && !tcp_urg_mode(tp))
+ 			limit = tcp_mss_split_point(sk, skb, mss_now,
+ 						    min_t(unsigned int,
+ 							  cwnd_quota,
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index c277951d783b..c1136022d8d9 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1385,6 +1385,28 @@ ipv6_pktoptions:
+ 	return 0;
+ }
+ 
++static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
++			   const struct tcphdr *th)
++{
++	/* This is tricky: we move IP6CB at its correct location into
++	 * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
++	 * _decode_session6() uses IP6CB().
++	 * barrier() makes sure compiler won't play aliasing games.
++	 */
++	memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
++		sizeof(struct inet6_skb_parm));
++	barrier();
++
++	TCP_SKB_CB(skb)->seq = ntohl(th->seq);
++	TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
++				    skb->len - th->doff*4);
++	TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
++	TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
++	TCP_SKB_CB(skb)->tcp_tw_isn = 0;
++	TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
++	TCP_SKB_CB(skb)->sacked = 0;
++}
++
+ static int tcp_v6_rcv(struct sk_buff *skb)
+ {
+ 	const struct tcphdr *th;
+@@ -1416,24 +1438,9 @@ static int tcp_v6_rcv(struct sk_buff *skb)
+ 
+ 	th = tcp_hdr(skb);
+ 	hdr = ipv6_hdr(skb);
+-	/* This is tricky : We move IPCB at its correct location into TCP_SKB_CB()
+-	 * barrier() makes sure compiler wont play fool^Waliasing games.
+-	 */
+-	memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
+-		sizeof(struct inet6_skb_parm));
+-	barrier();
+-
+-	TCP_SKB_CB(skb)->seq = ntohl(th->seq);
+-	TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
+-				    skb->len - th->doff*4);
+-	TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
+-	TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
+-	TCP_SKB_CB(skb)->tcp_tw_isn = 0;
+-	TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
+-	TCP_SKB_CB(skb)->sacked = 0;
+ 
+ 	sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
+-				tcp_v6_iif(skb));
++				inet6_iif(skb));
+ 	if (!sk)
+ 		goto no_tcp_socket;
+ 
+@@ -1449,6 +1456,8 @@ process:
+ 	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
+ 		goto discard_and_relse;
+ 
++	tcp_v6_fill_cb(skb, hdr, th);
++
+ #ifdef CONFIG_TCP_MD5SIG
+ 	if (tcp_v6_inbound_md5_hash(sk, skb))
+ 		goto discard_and_relse;
+@@ -1480,6 +1489,8 @@ no_tcp_socket:
+ 	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
+ 		goto discard_it;
+ 
++	tcp_v6_fill_cb(skb, hdr, th);
++
+ 	if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
+ csum_error:
+ 		TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
+@@ -1503,6 +1514,8 @@ do_time_wait:
+ 		goto discard_it;
+ 	}
+ 
++	tcp_v6_fill_cb(skb, hdr, th);
++
+ 	if (skb->len < (th->doff<<2)) {
+ 		inet_twsk_put(inet_twsk(sk));
+ 		goto bad_packet;
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index b6bf8e8caec7..79c965a51ab2 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -526,14 +526,14 @@ out:
+ 	return err;
+ }
+ 
+-static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr)
++static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len)
+ {
+ #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1
+ 	struct page *p_start, *p_end;
+ 
+ 	/* First page is flushed through netlink_{get,set}_status */
+ 	p_start = pgvec_to_page(hdr + PAGE_SIZE);
+-	p_end   = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + hdr->nm_len - 1);
++	p_end   = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1);
+ 	while (p_start <= p_end) {
+ 		flush_dcache_page(p_start);
+ 		p_start++;
+@@ -551,9 +551,9 @@ static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr)
+ static void netlink_set_status(struct nl_mmap_hdr *hdr,
+ 			       enum nl_mmap_status status)
+ {
++	smp_mb();
+ 	hdr->nm_status = status;
+ 	flush_dcache_page(pgvec_to_page(hdr));
+-	smp_wmb();
+ }
+ 
+ static struct nl_mmap_hdr *
+@@ -715,24 +715,16 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
+ 	struct nl_mmap_hdr *hdr;
+ 	struct sk_buff *skb;
+ 	unsigned int maxlen;
+-	bool excl = true;
+ 	int err = 0, len = 0;
+ 
+-	/* Netlink messages are validated by the receiver before processing.
+-	 * In order to avoid userspace changing the contents of the message
+-	 * after validation, the socket and the ring may only be used by a
+-	 * single process, otherwise we fall back to copying.
+-	 */
+-	if (atomic_long_read(&sk->sk_socket->file->f_count) > 1 ||
+-	    atomic_read(&nlk->mapped) > 1)
+-		excl = false;
+-
+ 	mutex_lock(&nlk->pg_vec_lock);
+ 
+ 	ring   = &nlk->tx_ring;
+ 	maxlen = ring->frame_size - NL_MMAP_HDRLEN;
+ 
+ 	do {
++		unsigned int nm_len;
++
+ 		hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID);
+ 		if (hdr == NULL) {
+ 			if (!(msg->msg_flags & MSG_DONTWAIT) &&
+@@ -740,35 +732,23 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
+ 				schedule();
+ 			continue;
+ 		}
+-		if (hdr->nm_len > maxlen) {
++
++		nm_len = ACCESS_ONCE(hdr->nm_len);
++		if (nm_len > maxlen) {
+ 			err = -EINVAL;
+ 			goto out;
+ 		}
+ 
+-		netlink_frame_flush_dcache(hdr);
++		netlink_frame_flush_dcache(hdr, nm_len);
+ 
+-		if (likely(dst_portid == 0 && dst_group == 0 && excl)) {
+-			skb = alloc_skb_head(GFP_KERNEL);
+-			if (skb == NULL) {
+-				err = -ENOBUFS;
+-				goto out;
+-			}
+-			sock_hold(sk);
+-			netlink_ring_setup_skb(skb, sk, ring, hdr);
+-			NETLINK_CB(skb).flags |= NETLINK_SKB_TX;
+-			__skb_put(skb, hdr->nm_len);
+-			netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
+-			atomic_inc(&ring->pending);
+-		} else {
+-			skb = alloc_skb(hdr->nm_len, GFP_KERNEL);
+-			if (skb == NULL) {
+-				err = -ENOBUFS;
+-				goto out;
+-			}
+-			__skb_put(skb, hdr->nm_len);
+-			memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, hdr->nm_len);
+-			netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
++		skb = alloc_skb(nm_len, GFP_KERNEL);
++		if (skb == NULL) {
++			err = -ENOBUFS;
++			goto out;
+ 		}
++		__skb_put(skb, nm_len);
++		memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len);
++		netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
+ 
+ 		netlink_increment_head(ring);
+ 
+@@ -814,7 +794,7 @@ static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb)
+ 	hdr->nm_pid	= NETLINK_CB(skb).creds.pid;
+ 	hdr->nm_uid	= from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
+ 	hdr->nm_gid	= from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
+-	netlink_frame_flush_dcache(hdr);
++	netlink_frame_flush_dcache(hdr, hdr->nm_len);
+ 	netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
+ 
+ 	NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED;
+diff --git a/net/wireless/chan.c b/net/wireless/chan.c
+index 72d81e2154d5..92ae263ebbf3 100644
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -602,7 +602,7 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
+ {
+ 	struct ieee80211_sta_ht_cap *ht_cap;
+ 	struct ieee80211_sta_vht_cap *vht_cap;
+-	u32 width, control_freq;
++	u32 width, control_freq, cap;
+ 
+ 	if (WARN_ON(!cfg80211_chandef_valid(chandef)))
+ 		return false;
+@@ -642,7 +642,8 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
+ 			return false;
+ 		break;
+ 	case NL80211_CHAN_WIDTH_80P80:
+-		if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ))
++		cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
++		if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
+ 			return false;
+ 	case NL80211_CHAN_WIDTH_80:
+ 		if (!vht_cap->vht_supported)
+@@ -653,7 +654,9 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
+ 	case NL80211_CHAN_WIDTH_160:
+ 		if (!vht_cap->vht_supported)
+ 			return false;
+-		if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ))
++		cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
++		if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ &&
++		    cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
+ 			return false;
+ 		prohibited_flags |= IEEE80211_CHAN_NO_160MHZ;
+ 		width = 160;
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 5839c85075f1..ea558e07981f 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -5799,7 +5799,7 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
+ 		}
+ 
+ 		/* there was no other matchset, so the RSSI one is alone */
+-		if (i == 0)
++		if (i == 0 && n_match_sets)
+ 			request->match_sets[0].rssi_thold = default_match_rssi;
+ 
+ 		request->min_rssi_thold = INT_MAX;
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index b725a31a4751..6fd53ea30193 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -1760,7 +1760,7 @@ static enum reg_request_treatment
+ reg_process_hint_driver(struct wiphy *wiphy,
+ 			struct regulatory_request *driver_request)
+ {
+-	const struct ieee80211_regdomain *regd;
++	const struct ieee80211_regdomain *regd, *tmp;
+ 	enum reg_request_treatment treatment;
+ 
+ 	treatment = __reg_process_hint_driver(driver_request);
+@@ -1780,7 +1780,10 @@ reg_process_hint_driver(struct wiphy *wiphy,
+ 			reg_free_request(driver_request);
+ 			return REG_REQ_IGNORE;
+ 		}
++
++		tmp = get_wiphy_regdom(wiphy);
+ 		rcu_assign_pointer(wiphy->regd, regd);
++		rcu_free_regdom(tmp);
+ 	}
+ 
+ 
+@@ -1839,11 +1842,8 @@ __reg_process_hint_country_ie(struct wiphy *wiphy,
+ 			return REG_REQ_IGNORE;
+ 		return REG_REQ_ALREADY_SET;
+ 	}
+-	/*
+-	 * Two consecutive Country IE hints on the same wiphy.
+-	 * This should be picked up early by the driver/stack
+-	 */
+-	if (WARN_ON(regdom_changes(country_ie_request->alpha2)))
++
++	if (regdom_changes(country_ie_request->alpha2))
+ 		return REG_REQ_OK;
+ 	return REG_REQ_ALREADY_SET;
+ }
+diff --git a/scripts/Makefile.clean b/scripts/Makefile.clean
+index b1c668dc6815..a609552a86dc 100644
+--- a/scripts/Makefile.clean
++++ b/scripts/Makefile.clean
+@@ -45,19 +45,19 @@ __clean-files	:= $(extra-y) $(extra-m) $(extra-)       \
+ 
+ __clean-files   := $(filter-out $(no-clean-files), $(__clean-files))
+ 
+-# as clean-files is given relative to the current directory, this adds
+-# a $(obj) prefix, except for absolute paths
++# clean-files is given relative to the current directory, unless it
++# starts with $(objtree)/ (which means "./", so do not add "./" unless
++# you want to delete a file from the toplevel object directory).
+ 
+ __clean-files   := $(wildcard                                               \
+-                   $(addprefix $(obj)/, $(filter-out /%, $(__clean-files))) \
+-		   $(filter /%, $(__clean-files)))
++		   $(addprefix $(obj)/, $(filter-out $(objtree)/%, $(__clean-files))) \
++		   $(filter $(objtree)/%, $(__clean-files)))
+ 
+-# as clean-dirs is given relative to the current directory, this adds
+-# a $(obj) prefix, except for absolute paths
++# same as clean-files
+ 
+ __clean-dirs    := $(wildcard                                               \
+-                   $(addprefix $(obj)/, $(filter-out /%, $(clean-dirs)))    \
+-		   $(filter /%, $(clean-dirs)))
++		   $(addprefix $(obj)/, $(filter-out $(objtree)/%, $(clean-dirs)))    \
++		   $(filter $(objtree)/%, $(clean-dirs)))
+ 
+ # ==========================================================================
+ 
+diff --git a/scripts/coccinelle/misc/bugon.cocci b/scripts/coccinelle/misc/bugon.cocci
+index 556456ca761c..3b7eec24fb5a 100644
+--- a/scripts/coccinelle/misc/bugon.cocci
++++ b/scripts/coccinelle/misc/bugon.cocci
+@@ -8,7 +8,7 @@
+ // Confidence: High
+ // Copyright: (C) 2014 Himangi Saraogi.  GPLv2.
+ // Comments:
+-// Options: --no-includes, --include-headers
++// Options: --no-includes --include-headers
+ 
+ virtual patch
+ virtual context
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index c657752a420c..83bddbdb90e9 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2804,133 +2804,45 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ 	}
+ },
+ 
+-/* Hauppauge HVR-950Q and HVR-850 */
+-{
+-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x7200),
+-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+-		       USB_DEVICE_ID_MATCH_INT_CLASS |
+-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+-	.bInterfaceClass = USB_CLASS_AUDIO,
+-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+-		.vendor_name = "Hauppauge",
+-		.product_name = "HVR-950Q",
+-		.ifnum = QUIRK_ANY_INTERFACE,
+-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
+-	}
+-},
+-{
+-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x7210),
+-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+-		       USB_DEVICE_ID_MATCH_INT_CLASS |
+-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+-	.bInterfaceClass = USB_CLASS_AUDIO,
+-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+-		.vendor_name = "Hauppauge",
+-		.product_name = "HVR-950Q",
+-		.ifnum = QUIRK_ANY_INTERFACE,
+-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
+-	}
+-},
+-{
+-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x7217),
+-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+-		       USB_DEVICE_ID_MATCH_INT_CLASS |
+-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+-	.bInterfaceClass = USB_CLASS_AUDIO,
+-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+-		.vendor_name = "Hauppauge",
+-		.product_name = "HVR-950Q",
+-		.ifnum = QUIRK_ANY_INTERFACE,
+-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
+-	}
+-},
+-{
+-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x721b),
+-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+-		       USB_DEVICE_ID_MATCH_INT_CLASS |
+-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+-	.bInterfaceClass = USB_CLASS_AUDIO,
+-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+-		.vendor_name = "Hauppauge",
+-		.product_name = "HVR-950Q",
+-		.ifnum = QUIRK_ANY_INTERFACE,
+-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
+-	}
+-},
+-{
+-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x721e),
+-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+-		       USB_DEVICE_ID_MATCH_INT_CLASS |
+-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+-	.bInterfaceClass = USB_CLASS_AUDIO,
+-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+-		.vendor_name = "Hauppauge",
+-		.product_name = "HVR-950Q",
+-		.ifnum = QUIRK_ANY_INTERFACE,
+-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
+-	}
+-},
+-{
+-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x721f),
+-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+-		       USB_DEVICE_ID_MATCH_INT_CLASS |
+-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+-	.bInterfaceClass = USB_CLASS_AUDIO,
+-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+-		.vendor_name = "Hauppauge",
+-		.product_name = "HVR-950Q",
+-		.ifnum = QUIRK_ANY_INTERFACE,
+-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
+-	}
+-},
+-{
+-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x7240),
+-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+-		       USB_DEVICE_ID_MATCH_INT_CLASS |
+-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+-	.bInterfaceClass = USB_CLASS_AUDIO,
+-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+-		.vendor_name = "Hauppauge",
+-		.product_name = "HVR-850",
+-		.ifnum = QUIRK_ANY_INTERFACE,
+-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
+-	}
+-},
+-{
+-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x7280),
+-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+-		       USB_DEVICE_ID_MATCH_INT_CLASS |
+-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+-	.bInterfaceClass = USB_CLASS_AUDIO,
+-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+-		.vendor_name = "Hauppauge",
+-		.product_name = "HVR-950Q",
+-		.ifnum = QUIRK_ANY_INTERFACE,
+-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
+-	}
+-},
+-{
+-	USB_DEVICE_VENDOR_SPEC(0x0fd9, 0x0008),
+-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+-		       USB_DEVICE_ID_MATCH_INT_CLASS |
+-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+-	.bInterfaceClass = USB_CLASS_AUDIO,
+-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+-		.vendor_name = "Hauppauge",
+-		.product_name = "HVR-950Q",
+-		.ifnum = QUIRK_ANY_INTERFACE,
+-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
+-	}
+-},
++/*
++ * Auvitek au0828 devices with audio interface.
++ * This should be kept in sync with drivers/media/usb/au0828/au0828-cards.c
++ * Please notice that some drivers are DVB only, and don't need to be
++ * here. That's the case, for example, of DVICO_FUSIONHDTV7.
++ */
++
++#define AU0828_DEVICE(vid, pid, vname, pname) { \
++	USB_DEVICE_VENDOR_SPEC(vid, pid), \
++	.match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
++		       USB_DEVICE_ID_MATCH_INT_CLASS | \
++		       USB_DEVICE_ID_MATCH_INT_SUBCLASS, \
++	.bInterfaceClass = USB_CLASS_AUDIO, \
++	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, \
++	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { \
++		.vendor_name = vname, \
++		.product_name = pname, \
++		.ifnum = QUIRK_ANY_INTERFACE, \
++		.type = QUIRK_AUDIO_ALIGN_TRANSFER, \
++	} \
++}
++
++AU0828_DEVICE(0x2040, 0x7200, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7240, "Hauppauge", "HVR-850"),
++AU0828_DEVICE(0x2040, 0x7210, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7217, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x721b, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x721e, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x721f, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7280, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x0fd9, 0x0008, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7201, "Hauppauge", "HVR-950Q-MXL"),
++AU0828_DEVICE(0x2040, 0x7211, "Hauppauge", "HVR-950Q-MXL"),
++AU0828_DEVICE(0x2040, 0x7281, "Hauppauge", "HVR-950Q-MXL"),
++AU0828_DEVICE(0x05e1, 0x0480, "Hauppauge", "Woodbury"),
++AU0828_DEVICE(0x2040, 0x8200, "Hauppauge", "Woodbury"),
++AU0828_DEVICE(0x2040, 0x7260, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7213, "Hauppauge", "HVR-950Q"),
++AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ 
+ /* Digidesign Mbox */
+ {