[gentoo-commits] linux-patches r2500 - genpatches-2.6/trunk/3.10

[Tom Wijsman (tomwij)]

Author: tomwij
Date: 2013-08-30 12:09:05 +0000 (Fri, 30 Aug 2013)
New Revision: 2500

Added:
   genpatches-2.6/trunk/3.10/1009_linux-3.10.10.patch
Modified:
   genpatches-2.6/trunk/3.10/0000_README
Log:
Linux patch 3.10.10.

Modified: genpatches-2.6/trunk/3.10/0000_README
===================================================================
--- genpatches-2.6/trunk/3.10/0000_README	2013-08-29 13:09:44 UTC (rev 2499)
+++ genpatches-2.6/trunk/3.10/0000_README	2013-08-30 12:09:05 UTC (rev 2500)
@@ -75,6 +75,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.10.9
 
+Patch:  1009_linux-3.10.10.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.10
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.10/1009_linux-3.10.10.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1009_linux-3.10.10.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10/1009_linux-3.10.10.patch	2013-08-30 12:09:05 UTC (rev 2500)
@@ -0,0 +1,2993 @@
+diff --git a/Makefile b/Makefile
+index 4b31d62..b119684 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 9
++SUBLEVEL = 10
+ EXTRAVERSION =
+ NAME = TOSSUG Baby Fish
+ 
+diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
+index 6179de7..2046a89 100644
+--- a/arch/arc/include/asm/ptrace.h
++++ b/arch/arc/include/asm/ptrace.h
+@@ -52,12 +52,14 @@ struct pt_regs {
+ 
+ 	/*to distinguish bet excp, syscall, irq */
+ 	union {
++		struct {
+ #ifdef CONFIG_CPU_BIG_ENDIAN
+ 		/* so that assembly code is same for LE/BE */
+ 		unsigned long orig_r8:16, event:16;
+ #else
+ 		unsigned long event:16, orig_r8:16;
+ #endif
++		};
+ 		long orig_r8_word;
+ 	};
+ };
+diff --git a/arch/arc/include/asm/syscall.h b/arch/arc/include/asm/syscall.h
+index 33ab304..29de098 100644
+--- a/arch/arc/include/asm/syscall.h
++++ b/arch/arc/include/asm/syscall.h
+@@ -18,7 +18,7 @@ static inline long
+ syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
+ {
+ 	if (user_mode(regs) && in_syscall(regs))
+-		return regs->orig_r8;
++		return regs->r8;
+ 	else
+ 		return -1;
+ }
+@@ -26,8 +26,7 @@ syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
+ static inline void
+ syscall_rollback(struct task_struct *task, struct pt_regs *regs)
+ {
+-	/* XXX: I can't fathom how pt_regs->r8 will be clobbered ? */
+-	regs->r8 = regs->orig_r8;
++	regs->r0 = regs->orig_r0;
+ }
+ 
+ static inline long
+diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
+index 0c6d664..6dbe359 100644
+--- a/arch/arc/kernel/entry.S
++++ b/arch/arc/kernel/entry.S
+@@ -498,7 +498,7 @@ tracesys_exit:
+ trap_with_param:
+ 
+ 	; stop_pc info by gdb needs this info
+-	stw orig_r8_IS_BRKPT, [sp, PT_orig_r8]
++	st  orig_r8_IS_BRKPT, [sp, PT_orig_r8]
+ 
+ 	mov r0, r12
+ 	lr  r1, [efa]
+@@ -723,7 +723,7 @@ not_exception:
+ 	; things to what they were, before returning from L2 context
+ 	;----------------------------------------------------------------
+ 
+-	ldw  r9, [sp, PT_orig_r8]      ; get orig_r8 to make sure it is
++	ld   r9, [sp, PT_orig_r8]      ; get orig_r8 to make sure it is
+ 	brne r9, orig_r8_IS_IRQ2, 149f ; infact a L2 ISR ret path
+ 
+ 	ld r9, [sp, PT_status32]       ; get statu32_l2 (saved in pt_regs)
+diff --git a/arch/arc/lib/strchr-700.S b/arch/arc/lib/strchr-700.S
+index 99c1047..9c548c7 100644
+--- a/arch/arc/lib/strchr-700.S
++++ b/arch/arc/lib/strchr-700.S
+@@ -39,9 +39,18 @@ ARC_ENTRY strchr
+ 	ld.a	r2,[r0,4]
+ 	sub	r12,r6,r7
+ 	bic	r12,r12,r6
++#ifdef __LITTLE_ENDIAN__
+ 	and	r7,r12,r4
+ 	breq	r7,0,.Loop ; For speed, we want this branch to be unaligned.
+ 	b	.Lfound_char ; Likewise this one.
++#else
++	and	r12,r12,r4
++	breq	r12,0,.Loop ; For speed, we want this branch to be unaligned.
++	lsr_s	r12,r12,7
++	bic 	r2,r7,r6
++	b.d	.Lfound_char_b
++	and_s	r2,r2,r12
++#endif
+ ; /* We require this code address to be unaligned for speed...  */
+ .Laligned:
+ 	ld_s	r2,[r0]
+@@ -95,6 +104,7 @@ ARC_ENTRY strchr
+ 	lsr	r7,r7,7
+ 
+ 	bic	r2,r7,r6
++.Lfound_char_b:
+ 	norm	r2,r2
+ 	sub_s	r0,r0,4
+ 	asr_s	r2,r2,3
+diff --git a/arch/arm/boot/dts/at91sam9n12ek.dts b/arch/arm/boot/dts/at91sam9n12ek.dts
+index d30e48b..28ba798 100644
+--- a/arch/arm/boot/dts/at91sam9n12ek.dts
++++ b/arch/arm/boot/dts/at91sam9n12ek.dts
+@@ -14,11 +14,11 @@
+ 	compatible = "atmel,at91sam9n12ek", "atmel,at91sam9n12", "atmel,at91sam9";
+ 
+ 	chosen {
+-		bootargs = "mem=128M console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=jffs2";
++		bootargs = "console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=jffs2";
+ 	};
+ 
+ 	memory {
+-		reg = <0x20000000 0x10000000>;
++		reg = <0x20000000 0x8000000>;
+ 	};
+ 
+ 	clocks {
+diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
+index 1145ac3..b5833d1f 100644
+--- a/arch/arm/boot/dts/at91sam9x5.dtsi
++++ b/arch/arm/boot/dts/at91sam9x5.dtsi
+@@ -643,7 +643,7 @@
+ 			};
+ 
+ 			rtc@fffffeb0 {
+-				compatible = "atmel,at91rm9200-rtc";
++				compatible = "atmel,at91sam9x5-rtc";
+ 				reg = <0xfffffeb0 0x40>;
+ 				interrupts = <1 4 7>;
+ 				status = "disabled";
+diff --git a/arch/arm/mach-davinci/board-dm355-leopard.c b/arch/arm/mach-davinci/board-dm355-leopard.c
+index dff4ddc..139e42d 100644
+--- a/arch/arm/mach-davinci/board-dm355-leopard.c
++++ b/arch/arm/mach-davinci/board-dm355-leopard.c
+@@ -75,6 +75,7 @@ static struct davinci_nand_pdata davinci_nand_data = {
+ 	.parts			= davinci_nand_partitions,
+ 	.nr_parts		= ARRAY_SIZE(davinci_nand_partitions),
+ 	.ecc_mode		= NAND_ECC_HW_SYNDROME,
++	.ecc_bits		= 4,
+ 	.bbt_options		= NAND_BBT_USE_FLASH,
+ };
+ 
+diff --git a/arch/arm/mach-davinci/board-dm644x-evm.c b/arch/arm/mach-davinci/board-dm644x-evm.c
+index a33686a..fa4bfaf 100644
+--- a/arch/arm/mach-davinci/board-dm644x-evm.c
++++ b/arch/arm/mach-davinci/board-dm644x-evm.c
+@@ -153,6 +153,7 @@ static struct davinci_nand_pdata davinci_evm_nandflash_data = {
+ 	.parts		= davinci_evm_nandflash_partition,
+ 	.nr_parts	= ARRAY_SIZE(davinci_evm_nandflash_partition),
+ 	.ecc_mode	= NAND_ECC_HW,
++	.ecc_bits	= 1,
+ 	.bbt_options	= NAND_BBT_USE_FLASH,
+ 	.timing		= &davinci_evm_nandflash_timing,
+ };
+diff --git a/arch/arm/mach-davinci/board-dm646x-evm.c b/arch/arm/mach-davinci/board-dm646x-evm.c
+index fbb8e5a..0c005e8 100644
+--- a/arch/arm/mach-davinci/board-dm646x-evm.c
++++ b/arch/arm/mach-davinci/board-dm646x-evm.c
+@@ -90,6 +90,7 @@ static struct davinci_nand_pdata davinci_nand_data = {
+ 	.parts			= davinci_nand_partitions,
+ 	.nr_parts		= ARRAY_SIZE(davinci_nand_partitions),
+ 	.ecc_mode		= NAND_ECC_HW,
++	.ecc_bits		= 1,
+ 	.options		= 0,
+ };
+ 
+diff --git a/arch/arm/mach-davinci/board-neuros-osd2.c b/arch/arm/mach-davinci/board-neuros-osd2.c
+index 2bc112a..808233b 100644
+--- a/arch/arm/mach-davinci/board-neuros-osd2.c
++++ b/arch/arm/mach-davinci/board-neuros-osd2.c
+@@ -88,6 +88,7 @@ static struct davinci_nand_pdata davinci_ntosd2_nandflash_data = {
+ 	.parts		= davinci_ntosd2_nandflash_partition,
+ 	.nr_parts	= ARRAY_SIZE(davinci_ntosd2_nandflash_partition),
+ 	.ecc_mode	= NAND_ECC_HW,
++	.ecc_bits	= 1,
+ 	.bbt_options	= NAND_BBT_USE_FLASH,
+ };
+ 
+diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
+index 2950082..08c9fe9 100644
+--- a/arch/arm/mm/Kconfig
++++ b/arch/arm/mm/Kconfig
+@@ -789,15 +789,18 @@ config KUSER_HELPERS
+ 	  the CPU type fitted to the system.  This permits binaries to be
+ 	  run on ARMv4 through to ARMv7 without modification.
+ 
++	  See Documentation/arm/kernel_user_helpers.txt for details.
++
+ 	  However, the fixed address nature of these helpers can be used
+ 	  by ROP (return orientated programming) authors when creating
+ 	  exploits.
+ 
+ 	  If all of the binaries and libraries which run on your platform
+ 	  are built specifically for your platform, and make no use of
+-	  these helpers, then you can turn this option off.  However,
+-	  when such an binary or library is run, it will receive a SIGILL
+-	  signal, which will terminate the program.
++	  these helpers, then you can turn this option off to hinder
++	  such exploits. However, in that case, if a binary or library
++	  relying on those helpers is run, it will receive a SIGILL signal,
++	  which will terminate the program.
+ 
+ 	  Say N here only if you are absolutely certain that you do not
+ 	  need these helpers; otherwise, the safe option is to say Y.
+diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
+index 9ba33c4..12e6ccb 100644
+--- a/arch/arm64/kernel/perf_event.c
++++ b/arch/arm64/kernel/perf_event.c
+@@ -107,7 +107,12 @@ armpmu_map_cache_event(const unsigned (*cache_map)
+ static int
+ armpmu_map_event(const unsigned (*event_map)[PERF_COUNT_HW_MAX], u64 config)
+ {
+-	int mapping = (*event_map)[config];
++	int mapping;
++
++	if (config >= PERF_COUNT_HW_MAX)
++		return -EINVAL;
++
++	mapping = (*event_map)[config];
+ 	return mapping == HW_OP_UNSUPPORTED ? -ENOENT : mapping;
+ }
+ 
+@@ -317,6 +322,9 @@ validate_event(struct pmu_hw_events *hw_events,
+ 	struct hw_perf_event fake_event = event->hw;
+ 	struct pmu *leader_pmu = event->group_leader->pmu;
+ 
++	if (is_software_event(event))
++		return 1;
++
+ 	if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)
+ 		return 1;
+ 
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index c1c7c68..698fb82 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -622,14 +622,25 @@ static int __vcpu_run(struct kvm_vcpu *vcpu)
+ 		kvm_s390_deliver_pending_interrupts(vcpu);
+ 
+ 	vcpu->arch.sie_block->icptcode = 0;
+-	preempt_disable();
+-	kvm_guest_enter();
+-	preempt_enable();
+ 	VCPU_EVENT(vcpu, 6, "entering sie flags %x",
+ 		   atomic_read(&vcpu->arch.sie_block->cpuflags));
+ 	trace_kvm_s390_sie_enter(vcpu,
+ 				 atomic_read(&vcpu->arch.sie_block->cpuflags));
++
++	/*
++	 * As PF_VCPU will be used in fault handler, between guest_enter
++	 * and guest_exit should be no uaccess.
++	 */
++	preempt_disable();
++	kvm_guest_enter();
++	preempt_enable();
+ 	rc = sie64a(vcpu->arch.sie_block, vcpu->run->s.regs.gprs);
++	kvm_guest_exit();
++
++	VCPU_EVENT(vcpu, 6, "exit sie icptcode %d",
++		   vcpu->arch.sie_block->icptcode);
++	trace_kvm_s390_sie_exit(vcpu, vcpu->arch.sie_block->icptcode);
++
+ 	if (rc) {
+ 		if (kvm_is_ucontrol(vcpu->kvm)) {
+ 			rc = SIE_INTERCEPT_UCONTROL;
+@@ -639,10 +650,6 @@ static int __vcpu_run(struct kvm_vcpu *vcpu)
+ 			rc = kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
+ 		}
+ 	}
+-	VCPU_EVENT(vcpu, 6, "exit sie icptcode %d",
+-		   vcpu->arch.sie_block->icptcode);
+-	trace_kvm_s390_sie_exit(vcpu, vcpu->arch.sie_block->icptcode);
+-	kvm_guest_exit();
+ 
+ 	memcpy(&vcpu->run->s.regs.gprs[14], &vcpu->arch.sie_block->gg14, 16);
+ 	return rc;
+diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h
+index 653668d..4a8cb8d 100644
+--- a/arch/x86/include/asm/bootparam_utils.h
++++ b/arch/x86/include/asm/bootparam_utils.h
+@@ -35,9 +35,9 @@ static void sanitize_boot_params(struct boot_params *boot_params)
+ 	 */
+ 	if (boot_params->sentinel) {
+ 		/* fields in boot_params are left uninitialized, clear them */
+-		memset(&boot_params->olpc_ofw_header, 0,
++		memset(&boot_params->ext_ramdisk_image, 0,
+ 		       (char *)&boot_params->efi_info -
+-			(char *)&boot_params->olpc_ofw_header);
++			(char *)&boot_params->ext_ramdisk_image);
+ 		memset(&boot_params->kbd_status, 0,
+ 		       (char *)&boot_params->hdr -
+ 		       (char *)&boot_params->kbd_status);
+diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
+index 48f8375..30277e2 100644
+--- a/arch/x86/kernel/sys_x86_64.c
++++ b/arch/x86/kernel/sys_x86_64.c
+@@ -101,7 +101,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
+ 				*begin = new_begin;
+ 		}
+ 	} else {
+-		*begin = mmap_legacy_base();
++		*begin = current->mm->mmap_legacy_base;
+ 		*end = TASK_SIZE;
+ 	}
+ }
+diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
+index c1af323..5c1ae28 100644
+--- a/arch/x86/mm/mmap.c
++++ b/arch/x86/mm/mmap.c
+@@ -98,7 +98,7 @@ static unsigned long mmap_base(void)
+  * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
+  * does, but not when emulating X86_32
+  */
+-unsigned long mmap_legacy_base(void)
++static unsigned long mmap_legacy_base(void)
+ {
+ 	if (mmap_is_ia32())
+ 		return TASK_UNMAPPED_BASE;
+@@ -112,12 +112,14 @@ unsigned long mmap_legacy_base(void)
+  */
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+ {
++	mm->mmap_legacy_base = mmap_legacy_base();
++	mm->mmap_base = mmap_base();
++
+ 	if (mmap_is_legacy()) {
+-		mm->mmap_base = mmap_legacy_base();
++		mm->mmap_base = mm->mmap_legacy_base;
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+-		mm->mmap_base = mmap_base();
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
+index 94eac5c..0a9fb7a 100644
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -313,6 +313,17 @@ static void xen_align_and_add_e820_region(u64 start, u64 size, int type)
+ 	e820_add_region(start, end - start, type);
+ }
+ 
++void xen_ignore_unusable(struct e820entry *list, size_t map_size)
++{
++	struct e820entry *entry;
++	unsigned int i;
++
++	for (i = 0, entry = list; i < map_size; i++, entry++) {
++		if (entry->type == E820_UNUSABLE)
++			entry->type = E820_RAM;
++	}
++}
++
+ /**
+  * machine_specific_memory_setup - Hook for machine specific memory setup.
+  **/
+@@ -353,6 +364,17 @@ char * __init xen_memory_setup(void)
+ 	}
+ 	BUG_ON(rc);
+ 
++	/*
++	 * Xen won't allow a 1:1 mapping to be created to UNUSABLE
++	 * regions, so if we're using the machine memory map leave the
++	 * region as RAM as it is in the pseudo-physical map.
++	 *
++	 * UNUSABLE regions in domUs are not handled and will need
++	 * a patch in the future.
++	 */
++	if (xen_initial_domain())
++		xen_ignore_unusable(map, memmap.nr_entries);
++
+ 	/* Make sure the Xen-supplied memory map is well-ordered. */
+ 	sanitize_e820_map(map, memmap.nr_entries, &memmap.nr_entries);
+ 
+diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
+index d99cae8..a1e58e1 100644
+--- a/arch/x86/xen/smp.c
++++ b/arch/x86/xen/smp.c
+@@ -667,8 +667,15 @@ static void __init xen_hvm_smp_prepare_cpus(unsigned int max_cpus)
+ static int __cpuinit xen_hvm_cpu_up(unsigned int cpu, struct task_struct *tidle)
+ {
+ 	int rc;
+-	rc = native_cpu_up(cpu, tidle);
+-	WARN_ON (xen_smp_intr_init(cpu));
++	/*
++	 * xen_smp_intr_init() needs to run before native_cpu_up()
++	 * so that IPI vectors are set up on the booting CPU before
++	 * it is marked online in native_cpu_up().
++	*/
++	rc = xen_smp_intr_init(cpu);
++	WARN_ON(rc);
++	if (!rc)
++		rc =  native_cpu_up(cpu, tidle);
+ 	return rc;
+ }
+ 
+diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
+index 40a84cc..2384120 100644
+--- a/drivers/acpi/glue.c
++++ b/drivers/acpi/glue.c
+@@ -78,32 +78,99 @@ static struct acpi_bus_type *acpi_get_bus_type(struct device *dev)
+ 	return ret;
+ }
+ 
+-static acpi_status do_acpi_find_child(acpi_handle handle, u32 lvl_not_used,
+-				      void *addr_p, void **ret_p)
++static acpi_status acpi_dev_present(acpi_handle handle, u32 lvl_not_used,
++				  void *not_used, void **ret_p)
+ {
+-	unsigned long long addr;
+-	acpi_status status;
++	struct acpi_device *adev = NULL;
+ 
+-	status = acpi_evaluate_integer(handle, METHOD_NAME__ADR, NULL, &addr);
+-	if (ACPI_SUCCESS(status) && addr == *((u64 *)addr_p)) {
++	acpi_bus_get_device(handle, &adev);
++	if (adev) {
+ 		*ret_p = handle;
+ 		return AE_CTRL_TERMINATE;
+ 	}
+ 	return AE_OK;
+ }
+ 
+-acpi_handle acpi_get_child(acpi_handle parent, u64 address)
++static bool acpi_extra_checks_passed(acpi_handle handle, bool is_bridge)
+ {
+-	void *ret = NULL;
++	unsigned long long sta;
++	acpi_status status;
+ 
+-	if (!parent)
+-		return NULL;
++	status = acpi_bus_get_status_handle(handle, &sta);
++	if (ACPI_FAILURE(status) || !(sta & ACPI_STA_DEVICE_ENABLED))
++		return false;
++
++	if (is_bridge) {
++		void *test = NULL;
++
++		/* Check if this object has at least one child device. */
++		acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, 1,
++				    acpi_dev_present, NULL, NULL, &test);
++		return !!test;
++	}
++	return true;
++}
++
++struct find_child_context {
++	u64 addr;
++	bool is_bridge;
++	acpi_handle ret;
++	bool ret_checked;
++};
++
++static acpi_status do_find_child(acpi_handle handle, u32 lvl_not_used,
++				 void *data, void **not_used)
++{
++	struct find_child_context *context = data;
++	unsigned long long addr;
++	acpi_status status;
+ 
+-	acpi_walk_namespace(ACPI_TYPE_DEVICE, parent, 1, NULL,
+-			    do_acpi_find_child, &address, &ret);
+-	return (acpi_handle)ret;
++	status = acpi_evaluate_integer(handle, METHOD_NAME__ADR, NULL, &addr);
++	if (ACPI_FAILURE(status) || addr != context->addr)
++		return AE_OK;
++
++	if (!context->ret) {
++		/* This is the first matching object.  Save its handle. */
++		context->ret = handle;
++		return AE_OK;
++	}
++	/*
++	 * There is more than one matching object with the same _ADR value.
++	 * That really is unexpected, so we are kind of beyond the scope of the
++	 * spec here.  We have to choose which one to return, though.
++	 *
++	 * First, check if the previously found object is good enough and return
++	 * its handle if so.  Second, check the same for the object that we've
++	 * just found.
++	 */
++	if (!context->ret_checked) {
++		if (acpi_extra_checks_passed(context->ret, context->is_bridge))
++			return AE_CTRL_TERMINATE;
++		else
++			context->ret_checked = true;
++	}
++	if (acpi_extra_checks_passed(handle, context->is_bridge)) {
++		context->ret = handle;
++		return AE_CTRL_TERMINATE;
++	}
++	return AE_OK;
++}
++
++acpi_handle acpi_find_child(acpi_handle parent, u64 addr, bool is_bridge)
++{
++	if (parent) {
++		struct find_child_context context = {
++			.addr = addr,
++			.is_bridge = is_bridge,
++		};
++
++		acpi_walk_namespace(ACPI_TYPE_DEVICE, parent, 1, do_find_child,
++				    NULL, &context, NULL);
++		return context.ret;
++	}
++	return NULL;
+ }
+-EXPORT_SYMBOL(acpi_get_child);
++EXPORT_SYMBOL_GPL(acpi_find_child);
+ 
+ static int acpi_bind_one(struct device *dev, acpi_handle handle)
+ {
+diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
+index 1c41722..20fd337 100644
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -289,24 +289,24 @@ static int sata_pmp_configure(struct ata_device *dev, int print_info)
+ 
+ 	/* Disable sending Early R_OK.
+ 	 * With "cached read" HDD testing and multiple ports busy on a SATA
+-	 * host controller, 3726 PMP will very rarely drop a deferred
++	 * host controller, 3x26 PMP will very rarely drop a deferred
+ 	 * R_OK that was intended for the host. Symptom will be all
+ 	 * 5 drives under test will timeout, get reset, and recover.
+ 	 */
+-	if (vendor == 0x1095 && devid == 0x3726) {
++	if (vendor == 0x1095 && (devid == 0x3726 || devid == 0x3826)) {
+ 		u32 reg;
+ 
+ 		err_mask = sata_pmp_read(&ap->link, PMP_GSCR_SII_POL, &reg);
+ 		if (err_mask) {
+ 			rc = -EIO;
+-			reason = "failed to read Sil3726 Private Register";
++			reason = "failed to read Sil3x26 Private Register";
+ 			goto fail;
+ 		}
+ 		reg &= ~0x1;
+ 		err_mask = sata_pmp_write(&ap->link, PMP_GSCR_SII_POL, reg);
+ 		if (err_mask) {
+ 			rc = -EIO;
+-			reason = "failed to write Sil3726 Private Register";
++			reason = "failed to write Sil3x26 Private Register";
+ 			goto fail;
+ 		}
+ 	}
+@@ -383,8 +383,8 @@ static void sata_pmp_quirks(struct ata_port *ap)
+ 	u16 devid = sata_pmp_gscr_devid(gscr);
+ 	struct ata_link *link;
+ 
+-	if (vendor == 0x1095 && devid == 0x3726) {
+-		/* sil3726 quirks */
++	if (vendor == 0x1095 && (devid == 0x3726 || devid == 0x3826)) {
++		/* sil3x26 quirks */
+ 		ata_for_each_link(link, ap, EDGE) {
+ 			/* link reports offline after LPM */
+ 			link->flags |= ATA_LFLAG_NO_LPM;
+diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
+index d40e403..8401061 100644
+--- a/drivers/ata/sata_fsl.c
++++ b/drivers/ata/sata_fsl.c
+@@ -293,6 +293,7 @@ static void fsl_sata_set_irq_coalescing(struct ata_host *host,
+ {
+ 	struct sata_fsl_host_priv *host_priv = host->private_data;
+ 	void __iomem *hcr_base = host_priv->hcr_base;
++	unsigned long flags;
+ 
+ 	if (count > ICC_MAX_INT_COUNT_THRESHOLD)
+ 		count = ICC_MAX_INT_COUNT_THRESHOLD;
+@@ -305,12 +306,12 @@ static void fsl_sata_set_irq_coalescing(struct ata_host *host,
+ 			(count > ICC_MIN_INT_COUNT_THRESHOLD))
+ 		ticks = ICC_SAFE_INT_TICKS;
+ 
+-	spin_lock(&host->lock);
++	spin_lock_irqsave(&host->lock, flags);
+ 	iowrite32((count << 24 | ticks), hcr_base + ICC);
+ 
+ 	intr_coalescing_count = count;
+ 	intr_coalescing_ticks = ticks;
+-	spin_unlock(&host->lock);
++	spin_unlock_irqrestore(&host->lock, flags);
+ 
+ 	DPRINTK("interrupt coalescing, count = 0x%x, ticks = %x\n",
+ 			intr_coalescing_count, intr_coalescing_ticks);
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 80b0a66..01f6c2c 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -617,6 +617,8 @@
+ 					will not assert AGPBUSY# and will only
+ 					be delivered when out of C3. */
+ #define   INSTPM_FORCE_ORDERING				(1<<7) /* GEN6+ */
++#define   INSTPM_TLB_INVALIDATE	(1<<9)
++#define   INSTPM_SYNC_FLUSH	(1<<5)
+ #define ACTHD	        0x020c8
+ #define FW_BLC		0x020d8
+ #define FW_BLC2		0x020dc
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index 1424f20..48fe23e 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -907,6 +907,18 @@ void intel_ring_setup_status_page(struct intel_ring_buffer *ring)
+ 
+ 	I915_WRITE(mmio, (u32)ring->status_page.gfx_addr);
+ 	POSTING_READ(mmio);
++
++	/* Flush the TLB for this page */
++	if (INTEL_INFO(dev)->gen >= 6) {
++		u32 reg = RING_INSTPM(ring->mmio_base);
++		I915_WRITE(reg,
++			   _MASKED_BIT_ENABLE(INSTPM_TLB_INVALIDATE |
++					      INSTPM_SYNC_FLUSH));
++		if (wait_for((I915_READ(reg) & INSTPM_SYNC_FLUSH) == 0,
++			     1000))
++			DRM_ERROR("%s: wait for SyncFlush to complete for TLB invalidation timed out\n",
++				  ring->name);
++	}
+ }
+ 
+ static int
+diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
+index bdd9d56..d4ff48c 100644
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -1764,7 +1764,7 @@ void r100_io_wreg(struct radeon_device *rdev, u32 reg, u32 v);
+ 		WREG32(reg, tmp_);				\
+ 	} while (0)
+ #define WREG32_AND(reg, and) WREG32_P(reg, 0, and)
+-#define WREG32_OR(reg, or) WREG32_P(reg, or, ~or)
++#define WREG32_OR(reg, or) WREG32_P(reg, or, ~(or))
+ #define WREG32_PLL_P(reg, val, mask)				\
+ 	do {							\
+ 		uint32_t tmp_ = RREG32_PLL(reg);		\
+diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
+index 97002a0..f3ccf6d 100644
+--- a/drivers/gpu/drm/radeon/radeon_uvd.c
++++ b/drivers/gpu/drm/radeon/radeon_uvd.c
+@@ -359,6 +359,14 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
+ 		return -EINVAL;
+ 	}
+ 
++	if (bo->tbo.sync_obj) {
++		r = radeon_fence_wait(bo->tbo.sync_obj, false);
++		if (r) {
++			DRM_ERROR("Failed waiting for UVD message (%d)!\n", r);
++			return r;
++		}
++	}
++
+ 	r = radeon_bo_kmap(bo, &ptr);
+ 	if (r)
+ 		return r;
+diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
+index bcc68ec..f5e92cf 100644
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -744,10 +744,10 @@ static void rv770_init_golden_registers(struct radeon_device *rdev)
+ 						 (const u32)ARRAY_SIZE(r7xx_golden_dyn_gpr_registers));
+ 		radeon_program_register_sequence(rdev,
+ 						 rv730_golden_registers,
+-						 (const u32)ARRAY_SIZE(rv770_golden_registers));
++						 (const u32)ARRAY_SIZE(rv730_golden_registers));
+ 		radeon_program_register_sequence(rdev,
+ 						 rv730_mgcg_init,
+-						 (const u32)ARRAY_SIZE(rv770_mgcg_init));
++						 (const u32)ARRAY_SIZE(rv730_mgcg_init));
+ 		break;
+ 	case CHIP_RV710:
+ 		radeon_program_register_sequence(rdev,
+@@ -758,18 +758,18 @@ static void rv770_init_golden_registers(struct radeon_device *rdev)
+ 						 (const u32)ARRAY_SIZE(r7xx_golden_dyn_gpr_registers));
+ 		radeon_program_register_sequence(rdev,
+ 						 rv710_golden_registers,
+-						 (const u32)ARRAY_SIZE(rv770_golden_registers));
++						 (const u32)ARRAY_SIZE(rv710_golden_registers));
+ 		radeon_program_register_sequence(rdev,
+ 						 rv710_mgcg_init,
+-						 (const u32)ARRAY_SIZE(rv770_mgcg_init));
++						 (const u32)ARRAY_SIZE(rv710_mgcg_init));
+ 		break;
+ 	case CHIP_RV740:
+ 		radeon_program_register_sequence(rdev,
+ 						 rv740_golden_registers,
+-						 (const u32)ARRAY_SIZE(rv770_golden_registers));
++						 (const u32)ARRAY_SIZE(rv740_golden_registers));
+ 		radeon_program_register_sequence(rdev,
+ 						 rv740_mgcg_init,
+-						 (const u32)ARRAY_SIZE(rv770_mgcg_init));
++						 (const u32)ARRAY_SIZE(rv740_mgcg_init));
+ 		break;
+ 	default:
+ 		break;
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 7b687a6..833c590 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -326,10 +326,25 @@ static void do_btree_write(struct btree *b)
+ 	i->csum		= btree_csum_set(b, i);
+ 
+ 	btree_bio_init(b);
+-	b->bio->bi_rw	= REQ_META|WRITE_SYNC;
++	b->bio->bi_rw	= REQ_META|WRITE_SYNC|REQ_FUA;
+ 	b->bio->bi_size	= set_blocks(i, b->c) * block_bytes(b->c);
+ 	bch_bio_map(b->bio, i);
+ 
++	/*
++	 * If we're appending to a leaf node, we don't technically need FUA -
++	 * this write just needs to be persisted before the next journal write,
++	 * which will be marked FLUSH|FUA.
++	 *
++	 * Similarly if we're writing a new btree root - the pointer is going to
++	 * be in the next journal entry.
++	 *
++	 * But if we're writing a new btree node (that isn't a root) or
++	 * appending to a non leaf btree node, we need either FUA or a flush
++	 * when we write the parent with the new pointer. FUA is cheaper than a
++	 * flush, and writes appending to leaf nodes aren't blocking anything so
++	 * just make all btree node writes FUA to keep things sane.
++	 */
++
+ 	bkey_copy(&k.key, &b->key);
+ 	SET_PTR_OFFSET(&k.key, 0, PTR_OFFSET(&k.key, 0) + bset_offset(b, i));
+ 
+@@ -2142,6 +2157,9 @@ int bch_btree_insert(struct btree_op *op, struct cache_set *c)
+ void bch_btree_set_root(struct btree *b)
+ {
+ 	unsigned i;
++	struct closure cl;
++
++	closure_init_stack(&cl);
+ 
+ 	BUG_ON(!b->written);
+ 
+@@ -2155,8 +2173,9 @@ void bch_btree_set_root(struct btree *b)
+ 	b->c->root = b;
+ 	__bkey_put(b->c, &b->key);
+ 
+-	bch_journal_meta(b->c, NULL);
++	bch_journal_meta(b->c, &cl);
+ 	pr_debug("%s for %pf", pbtree(b), __builtin_return_address(0));
++	closure_sync(&cl);
+ }
+ 
+ /* Cache lookup */
+diff --git a/drivers/md/bcache/io.c b/drivers/md/bcache/io.c
+index 48efd4d..d285cd4 100644
+--- a/drivers/md/bcache/io.c
++++ b/drivers/md/bcache/io.c
+@@ -97,6 +97,8 @@ struct bio *bch_bio_split(struct bio *bio, int sectors,
+ 
+ 	if (bio->bi_rw & REQ_DISCARD) {
+ 		ret = bio_alloc_bioset(gfp, 1, bs);
++		if (!ret)
++			return NULL;
+ 		idx = 0;
+ 		goto out;
+ 	}
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 8a54d3b..b49abb2 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -622,7 +622,7 @@ static void journal_write_unlocked(struct closure *cl)
+ 		bio_reset(bio);
+ 		bio->bi_sector	= PTR_OFFSET(k, i);
+ 		bio->bi_bdev	= ca->bdev;
+-		bio->bi_rw	= REQ_WRITE|REQ_SYNC|REQ_META|REQ_FLUSH;
++		bio->bi_rw	= REQ_WRITE|REQ_SYNC|REQ_META|REQ_FLUSH|REQ_FUA;
+ 		bio->bi_size	= sectors << 9;
+ 
+ 		bio->bi_end_io	= journal_write_endio;
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index 2f36743..afb9a99 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -1053,9 +1053,20 @@ static void request_write(struct cached_dev *dc, struct search *s)
+ 		trace_bcache_writethrough(s->orig_bio);
+ 		closure_bio_submit(bio, cl, s->d);
+ 	} else {
+-		s->op.cache_bio = bio;
+ 		trace_bcache_writeback(s->orig_bio);
+ 		bch_writeback_add(dc, bio_sectors(bio));
++
++		if (s->op.flush_journal) {
++			/* Also need to send a flush to the backing device */
++			s->op.cache_bio = bio_clone_bioset(bio, GFP_NOIO,
++							   dc->disk.bio_split);
++
++			bio->bi_size = 0;
++			bio->bi_vcnt = 0;
++			closure_bio_submit(bio, cl, s->d);
++		} else {
++			s->op.cache_bio = bio;
++		}
+ 	}
+ out:
+ 	closure_call(&s->op.cl, bch_insert_data, NULL, cl);
+diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
+index 822170f..700fe55 100644
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -238,14 +238,18 @@ static int mei_me_hw_ready_wait(struct mei_device *dev)
+ 	if (mei_me_hw_is_ready(dev))
+ 		return 0;
+ 
++	dev->recvd_hw_ready = false;
+ 	mutex_unlock(&dev->device_lock);
+ 	err = wait_event_interruptible_timeout(dev->wait_hw_ready,
+-			dev->recvd_hw_ready, MEI_INTEROP_TIMEOUT);
++			dev->recvd_hw_ready,
++			mei_secs_to_jiffies(MEI_INTEROP_TIMEOUT));
+ 	mutex_lock(&dev->device_lock);
+ 	if (!err && !dev->recvd_hw_ready) {
++		if (!err)
++			err = -ETIMEDOUT;
+ 		dev_err(&dev->pdev->dev,
+-			"wait hw ready failed. status = 0x%x\n", err);
+-		return -ETIMEDOUT;
++			"wait hw ready failed. status = %d\n", err);
++		return err;
+ 	}
+ 
+ 	dev->recvd_hw_ready = false;
+@@ -482,7 +486,9 @@ irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id)
+ 	/* check if ME wants a reset */
+ 	if (!mei_hw_is_ready(dev) &&
+ 	    dev->dev_state != MEI_DEV_RESETTING &&
+-	    dev->dev_state != MEI_DEV_INITIALIZING) {
++	    dev->dev_state != MEI_DEV_INITIALIZING &&
++	    dev->dev_state != MEI_DEV_POWER_DOWN &&
++	    dev->dev_state != MEI_DEV_POWER_UP) {
+ 		dev_dbg(&dev->pdev->dev, "FW not ready.\n");
+ 		mei_reset(dev, 1);
+ 		mutex_unlock(&dev->device_lock);
+diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
+index f580d30..6eec689 100644
+--- a/drivers/misc/mei/init.c
++++ b/drivers/misc/mei/init.c
+@@ -143,7 +143,8 @@ void mei_reset(struct mei_device *dev, int interrupts_enabled)
+ 
+ 	dev->hbm_state = MEI_HBM_IDLE;
+ 
+-	if (dev->dev_state != MEI_DEV_INITIALIZING) {
++	if (dev->dev_state != MEI_DEV_INITIALIZING &&
++	    dev->dev_state != MEI_DEV_POWER_UP) {
+ 		if (dev->dev_state != MEI_DEV_DISABLED &&
+ 		    dev->dev_state != MEI_DEV_POWER_DOWN)
+ 			dev->dev_state = MEI_DEV_RESETTING;
+diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
+index ac07473..e509030 100644
+--- a/drivers/net/wireless/hostap/hostap_ioctl.c
++++ b/drivers/net/wireless/hostap/hostap_ioctl.c
+@@ -523,9 +523,9 @@ static int prism2_ioctl_giwaplist(struct net_device *dev,
+ 
+ 	data->length = prism2_ap_get_sta_qual(local, addr, qual, IW_MAX_AP, 1);
+ 
+-	memcpy(extra, &addr, sizeof(struct sockaddr) * data->length);
++	memcpy(extra, addr, sizeof(struct sockaddr) * data->length);
+ 	data->flags = 1; /* has quality information */
+-	memcpy(extra + sizeof(struct sockaddr) * data->length, &qual,
++	memcpy(extra + sizeof(struct sockaddr) * data->length, qual,
+ 	       sizeof(struct iw_quality) * data->length);
+ 
+ 	kfree(addr);
+diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+index cab23af..e04f3da 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+@@ -1059,7 +1059,10 @@ void iwl_chswitch_done(struct iwl_priv *priv, bool is_success)
+ 	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+ 		return;
+ 
+-	if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
++	if (!test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
++		return;
++
++	if (ctx->vif)
+ 		ieee80211_chswitch_done(ctx->vif, is_success);
+ }
+ 
+diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
+index 50263e8..dc94d44 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
+@@ -67,16 +67,16 @@
+ #include "iwl-agn-hw.h"
+ 
+ /* Highest firmware API version supported */
+-#define IWL7260_UCODE_API_MAX	6
+-#define IWL3160_UCODE_API_MAX	6
++#define IWL7260_UCODE_API_MAX	7
++#define IWL3160_UCODE_API_MAX	7
+ 
+ /* Oldest version we won't warn about */
+-#define IWL7260_UCODE_API_OK	6
+-#define IWL3160_UCODE_API_OK	6
++#define IWL7260_UCODE_API_OK	7
++#define IWL3160_UCODE_API_OK	7
+ 
+ /* Lowest firmware API version supported */
+-#define IWL7260_UCODE_API_MIN	6
+-#define IWL3160_UCODE_API_MIN	6
++#define IWL7260_UCODE_API_MIN	7
++#define IWL3160_UCODE_API_MIN	7
+ 
+ /* NVM versions */
+ #define IWL7260_NVM_VERSION		0x0a1d
+diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
+index 51e015d..6f8b2c1 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
++++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
+@@ -75,13 +75,15 @@ enum iwl_d3_wakeup_flags {
+  * struct iwl_d3_manager_config - D3 manager configuration command
+  * @min_sleep_time: minimum sleep time (in usec)
+  * @wakeup_flags: wakeup flags, see &enum iwl_d3_wakeup_flags
++ * @wakeup_host_timer: force wakeup after this many seconds
+  *
+  * The structure is used for the D3_CONFIG_CMD command.
+  */
+ struct iwl_d3_manager_config {
+ 	__le32 min_sleep_time;
+ 	__le32 wakeup_flags;
+-} __packed; /* D3_MANAGER_CONFIG_CMD_S_VER_3 */
++	__le32 wakeup_host_timer;
++} __packed; /* D3_MANAGER_CONFIG_CMD_S_VER_4 */
+ 
+ 
+ /* TODO: OFFLOADS_QUERY_API_S_VER_1 */
+diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
+index d68640e..98b1feb 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
++++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
+@@ -71,7 +71,13 @@
+ #define MAC_INDEX_MIN_DRIVER	0
+ #define NUM_MAC_INDEX_DRIVER	MAC_INDEX_AUX
+ 
+-#define AC_NUM	4 /* Number of access categories */
++enum iwl_ac {
++	AC_BK,
++	AC_BE,
++	AC_VI,
++	AC_VO,
++	AC_NUM,
++};
+ 
+ /**
+  * enum iwl_mac_protection_flags - MAC context flags
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+index b2cc3d9..d8e858c 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+@@ -193,14 +193,11 @@ static void iwl_mvm_mac_iface_iterator(void *_data, u8 *mac,
+ u32 iwl_mvm_mac_get_queues_mask(struct iwl_mvm *mvm,
+ 				struct ieee80211_vif *vif)
+ {
+-	u32 qmask, ac;
++	u32 qmask = 0, ac;
+ 
+ 	if (vif->type == NL80211_IFTYPE_P2P_DEVICE)
+ 		return BIT(IWL_MVM_OFFCHANNEL_QUEUE);
+ 
+-	qmask = (vif->cab_queue != IEEE80211_INVAL_HW_QUEUE) ?
+-		BIT(vif->cab_queue) : 0;
+-
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
+ 		if (vif->hw_queue[ac] != IEEE80211_INVAL_HW_QUEUE)
+ 			qmask |= BIT(vif->hw_queue[ac]);
+@@ -362,7 +359,7 @@ int iwl_mvm_mac_ctxt_init(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+ 		break;
+ 	case NL80211_IFTYPE_AP:
+ 		iwl_trans_ac_txq_enable(mvm->trans, vif->cab_queue,
+-					IWL_MVM_TX_FIFO_VO);
++					IWL_MVM_TX_FIFO_MCAST);
+ 		/* fall through */
+ 	default:
+ 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
+@@ -550,6 +547,10 @@ static void iwl_mvm_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
+ 		cmd->ac[i].fifos_mask = BIT(iwl_mvm_ac_to_tx_fifo[i]);
+ 	}
+ 
++	/* in AP mode, the MCAST FIFO takes the EDCA params from VO */
++	if (vif->type == NL80211_IFTYPE_AP)
++		cmd->ac[AC_VO].fifos_mask |= BIT(IWL_MVM_TX_FIFO_MCAST);
++
+ 	if (vif->bss_conf.qos)
+ 		cmd->qos_flags |= cpu_to_le32(MAC_QOS_FLG_UPDATE_EDCA);
+ 
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index b7e95b0..f7545e0 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -243,7 +243,11 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
+ 	if (ret)
+ 		return ret;
+ 
+-	return ieee80211_register_hw(mvm->hw);
++	ret = ieee80211_register_hw(mvm->hw);
++	if (ret)
++		iwl_mvm_leds_exit(mvm);
++
++	return ret;
+ }
+ 
+ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
+index 9f46b23..8086231 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
++++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
+@@ -88,6 +88,7 @@ enum iwl_mvm_tx_fifo {
+ 	IWL_MVM_TX_FIFO_BE,
+ 	IWL_MVM_TX_FIFO_VI,
+ 	IWL_MVM_TX_FIFO_VO,
++	IWL_MVM_TX_FIFO_MCAST = 5,
+ };
+ 
+ extern struct ieee80211_ops iwl_mvm_hw_ops;
+diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
+index 736b50b..68f0bbe 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
+@@ -226,9 +226,6 @@ int iwl_mvm_add_sta(struct iwl_mvm *mvm,
+ 		if (vif->hw_queue[i] != IEEE80211_INVAL_HW_QUEUE)
+ 			mvm_sta->tfd_queue_msk |= BIT(vif->hw_queue[i]);
+ 
+-	if (vif->cab_queue != IEEE80211_INVAL_HW_QUEUE)
+-		mvm_sta->tfd_queue_msk |= BIT(vif->cab_queue);
+-
+ 	/* for HW restart - need to reset the seq_number etc... */
+ 	memset(mvm_sta->tid_data, 0, sizeof(mvm_sta->tid_data));
+ 
+@@ -1296,17 +1293,11 @@ void iwl_mvm_sta_modify_ps_wake(struct iwl_mvm *mvm,
+ 	struct iwl_mvm_add_sta_cmd cmd = {
+ 		.add_modify = STA_MODE_MODIFY,
+ 		.sta_id = mvmsta->sta_id,
+-		.modify_mask = STA_MODIFY_SLEEPING_STA_TX_COUNT,
+-		.sleep_state_flags = cpu_to_le16(STA_SLEEP_STATE_AWAKE),
++		.station_flags_msk = cpu_to_le32(STA_FLG_PS),
+ 		.mac_id_n_color = cpu_to_le32(mvmsta->mac_id_n_color),
+ 	};
+ 	int ret;
+ 
+-	/*
+-	 * Same modify mask for sleep_tx_count and sleep_state_flags but this
+-	 * should be fine since if we set the STA as "awake", then
+-	 * sleep_tx_count is not relevant.
+-	 */
+ 	ret = iwl_mvm_send_cmd_pdu(mvm, ADD_STA, CMD_ASYNC, sizeof(cmd), &cmd);
+ 	if (ret)
+ 		IWL_ERR(mvm, "Failed to send ADD_STA command (%d)\n", ret);
+diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
+index 48c1891..a2e6112e 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
+@@ -175,7 +175,7 @@ static void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm,
+ 	 * table is controlled by LINK_QUALITY commands
+ 	 */
+ 
+-	if (ieee80211_is_data(fc)) {
++	if (ieee80211_is_data(fc) && sta) {
+ 		tx_cmd->initial_rate_index = 0;
+ 		tx_cmd->tx_flags |= cpu_to_le32(TX_CMD_FLG_STA_RATE);
+ 		return;
+@@ -610,8 +610,8 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
+ 		    !(info->flags & IEEE80211_TX_STAT_ACK))
+ 			info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
+ 
+-		/* W/A FW bug: seq_ctl is wrong when the queue is flushed */
+-		if (status == TX_STATUS_FAIL_FIFO_FLUSHED) {
++		/* W/A FW bug: seq_ctl is wrong when the status isn't success */
++		if (status != TX_STATUS_SUCCESS) {
+ 			struct ieee80211_hdr *hdr = (void *)skb->data;
+ 			seq_ctl = le16_to_cpu(hdr->seq_ctrl);
+ 		}
+diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
+index 50ba0a4..aeb70e1 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -1481,16 +1481,16 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
+ 	spin_lock_init(&trans_pcie->reg_lock);
+ 	init_waitqueue_head(&trans_pcie->ucode_write_waitq);
+ 
+-	/* W/A - seems to solve weird behavior. We need to remove this if we
+-	 * don't want to stay in L1 all the time. This wastes a lot of power */
+-	pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
+-			       PCIE_LINK_STATE_CLKPM);
+-
+ 	if (pci_enable_device(pdev)) {
+ 		err = -ENODEV;
+ 		goto out_no_pci;
+ 	}
+ 
++	/* W/A - seems to solve weird behavior. We need to remove this if we
++	 * don't want to stay in L1 all the time. This wastes a lot of power */
++	pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
++			       PCIE_LINK_STATE_CLKPM);
++
+ 	pci_set_master(pdev);
+ 
+ 	err = pci_set_dma_mask(pdev, DMA_BIT_MASK(36));
+diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
+index 4941f20..b8ba1f9 100644
+--- a/drivers/net/wireless/zd1201.c
++++ b/drivers/net/wireless/zd1201.c
+@@ -98,10 +98,12 @@ static int zd1201_fw_upload(struct usb_device *dev, int apfw)
+ 		goto exit;
+ 
+ 	err = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), 0x4,
+-	    USB_DIR_IN | 0x40, 0,0, &ret, sizeof(ret), ZD1201_FW_TIMEOUT);
++	    USB_DIR_IN | 0x40, 0, 0, buf, sizeof(ret), ZD1201_FW_TIMEOUT);
+ 	if (err < 0)
+ 		goto exit;
+ 
++	memcpy(&ret, buf, sizeof(ret));
++
+ 	if (ret & 0x80) {
+ 		err = -EIO;
+ 		goto exit;
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index 808be06..1187737 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -392,6 +392,8 @@ static void __unflatten_device_tree(struct boot_param_header *blob,
+ 	mem = (unsigned long)
+ 		dt_alloc(size + 4, __alignof__(struct device_node));
+ 
++	memset((void *)mem, 0, size);
++
+ 	((__be32 *)mem)[size / 4] = cpu_to_be32(0xdeadbeef);
+ 
+ 	pr_debug("  unflattening %lx...\n", mem);
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index e4b1fb2..336b3f9 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -317,13 +317,20 @@ void acpi_pci_remove_bus(struct pci_bus *bus)
+ /* ACPI bus type */
+ static int acpi_pci_find_device(struct device *dev, acpi_handle *handle)
+ {
+-	struct pci_dev * pci_dev;
+-	u64	addr;
++	struct pci_dev *pci_dev = to_pci_dev(dev);
++	bool is_bridge;
++	u64 addr;
+ 
+-	pci_dev = to_pci_dev(dev);
++	/*
++	 * pci_is_bridge() is not suitable here, because pci_dev->subordinate
++	 * is set only after acpi_pci_find_device() has been called for the
++	 * given device.
++	 */
++	is_bridge = pci_dev->hdr_type == PCI_HEADER_TYPE_BRIDGE
++			|| pci_dev->hdr_type == PCI_HEADER_TYPE_CARDBUS;
+ 	/* Please ref to ACPI spec for the syntax of _ADR */
+ 	addr = (PCI_SLOT(pci_dev->devfn) << 16) | PCI_FUNC(pci_dev->devfn);
+-	*handle = acpi_get_child(DEVICE_ACPI_HANDLE(dev->parent), addr);
++	*handle = acpi_find_child(ACPI_HANDLE(dev->parent), addr, is_bridge);
+ 	if (!*handle)
+ 		return -ENODEV;
+ 	return 0;
+diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c
+index 0f9f859..f911952 100644
+--- a/drivers/platform/olpc/olpc-ec.c
++++ b/drivers/platform/olpc/olpc-ec.c
+@@ -330,7 +330,7 @@ static int __init olpc_ec_init_module(void)
+ 	return platform_driver_register(&olpc_ec_plat_driver);
+ }
+ 
+-module_init(olpc_ec_init_module);
++arch_initcall(olpc_ec_init_module);
+ 
+ MODULE_AUTHOR("Andres Salomon <dilinger@××××××.net>");
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
+index 4133ab6..8e8f353 100644
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -102,10 +102,13 @@ static void zfcp_erp_action_dismiss_port(struct zfcp_port *port)
+ 
+ 	if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_ERP_INUSE)
+ 		zfcp_erp_action_dismiss(&port->erp_action);
+-	else
+-		shost_for_each_device(sdev, port->adapter->scsi_host)
++	else {
++		spin_lock(port->adapter->scsi_host->host_lock);
++		__shost_for_each_device(sdev, port->adapter->scsi_host)
+ 			if (sdev_to_zfcp(sdev)->port == port)
+ 				zfcp_erp_action_dismiss_lun(sdev);
++		spin_unlock(port->adapter->scsi_host->host_lock);
++	}
+ }
+ 
+ static void zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *adapter)
+@@ -592,9 +595,11 @@ static void _zfcp_erp_lun_reopen_all(struct zfcp_port *port, int clear,
+ {
+ 	struct scsi_device *sdev;
+ 
+-	shost_for_each_device(sdev, port->adapter->scsi_host)
++	spin_lock(port->adapter->scsi_host->host_lock);
++	__shost_for_each_device(sdev, port->adapter->scsi_host)
+ 		if (sdev_to_zfcp(sdev)->port == port)
+ 			_zfcp_erp_lun_reopen(sdev, clear, id, 0);
++	spin_unlock(port->adapter->scsi_host->host_lock);
+ }
+ 
+ static void zfcp_erp_strategy_followup_failed(struct zfcp_erp_action *act)
+@@ -1435,8 +1440,10 @@ void zfcp_erp_set_adapter_status(struct zfcp_adapter *adapter, u32 mask)
+ 		atomic_set_mask(common_mask, &port->status);
+ 	read_unlock_irqrestore(&adapter->port_list_lock, flags);
+ 
+-	shost_for_each_device(sdev, adapter->scsi_host)
++	spin_lock_irqsave(adapter->scsi_host->host_lock, flags);
++	__shost_for_each_device(sdev, adapter->scsi_host)
+ 		atomic_set_mask(common_mask, &sdev_to_zfcp(sdev)->status);
++	spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags);
+ }
+ 
+ /**
+@@ -1470,11 +1477,13 @@ void zfcp_erp_clear_adapter_status(struct zfcp_adapter *adapter, u32 mask)
+ 	}
+ 	read_unlock_irqrestore(&adapter->port_list_lock, flags);
+ 
+-	shost_for_each_device(sdev, adapter->scsi_host) {
++	spin_lock_irqsave(adapter->scsi_host->host_lock, flags);
++	__shost_for_each_device(sdev, adapter->scsi_host) {
+ 		atomic_clear_mask(common_mask, &sdev_to_zfcp(sdev)->status);
+ 		if (clear_counter)
+ 			atomic_set(&sdev_to_zfcp(sdev)->erp_counter, 0);
+ 	}
++	spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags);
+ }
+ 
+ /**
+@@ -1488,16 +1497,19 @@ void zfcp_erp_set_port_status(struct zfcp_port *port, u32 mask)
+ {
+ 	struct scsi_device *sdev;
+ 	u32 common_mask = mask & ZFCP_COMMON_FLAGS;
++	unsigned long flags;
+ 
+ 	atomic_set_mask(mask, &port->status);
+ 
+ 	if (!common_mask)
+ 		return;
+ 
+-	shost_for_each_device(sdev, port->adapter->scsi_host)
++	spin_lock_irqsave(port->adapter->scsi_host->host_lock, flags);
++	__shost_for_each_device(sdev, port->adapter->scsi_host)
+ 		if (sdev_to_zfcp(sdev)->port == port)
+ 			atomic_set_mask(common_mask,
+ 					&sdev_to_zfcp(sdev)->status);
++	spin_unlock_irqrestore(port->adapter->scsi_host->host_lock, flags);
+ }
+ 
+ /**
+@@ -1512,6 +1524,7 @@ void zfcp_erp_clear_port_status(struct zfcp_port *port, u32 mask)
+ 	struct scsi_device *sdev;
+ 	u32 common_mask = mask & ZFCP_COMMON_FLAGS;
+ 	u32 clear_counter = mask & ZFCP_STATUS_COMMON_ERP_FAILED;
++	unsigned long flags;
+ 
+ 	atomic_clear_mask(mask, &port->status);
+ 
+@@ -1521,13 +1534,15 @@ void zfcp_erp_clear_port_status(struct zfcp_port *port, u32 mask)
+ 	if (clear_counter)
+ 		atomic_set(&port->erp_counter, 0);
+ 
+-	shost_for_each_device(sdev, port->adapter->scsi_host)
++	spin_lock_irqsave(port->adapter->scsi_host->host_lock, flags);
++	__shost_for_each_device(sdev, port->adapter->scsi_host)
+ 		if (sdev_to_zfcp(sdev)->port == port) {
+ 			atomic_clear_mask(common_mask,
+ 					  &sdev_to_zfcp(sdev)->status);
+ 			if (clear_counter)
+ 				atomic_set(&sdev_to_zfcp(sdev)->erp_counter, 0);
+ 		}
++	spin_unlock_irqrestore(port->adapter->scsi_host->host_lock, flags);
+ }
+ 
+ /**
+diff --git a/drivers/s390/scsi/zfcp_qdio.c b/drivers/s390/scsi/zfcp_qdio.c
+index 665e3cf..de0598e 100644
+--- a/drivers/s390/scsi/zfcp_qdio.c
++++ b/drivers/s390/scsi/zfcp_qdio.c
+@@ -224,11 +224,9 @@ int zfcp_qdio_sbals_from_sg(struct zfcp_qdio *qdio, struct zfcp_qdio_req *q_req,
+ 
+ static int zfcp_qdio_sbal_check(struct zfcp_qdio *qdio)
+ {
+-	spin_lock_irq(&qdio->req_q_lock);
+ 	if (atomic_read(&qdio->req_q_free) ||
+ 	    !(atomic_read(&qdio->adapter->status) & ZFCP_STATUS_ADAPTER_QDIOUP))
+ 		return 1;
+-	spin_unlock_irq(&qdio->req_q_lock);
+ 	return 0;
+ }
+ 
+@@ -246,9 +244,8 @@ int zfcp_qdio_sbal_get(struct zfcp_qdio *qdio)
+ {
+ 	long ret;
+ 
+-	spin_unlock_irq(&qdio->req_q_lock);
+-	ret = wait_event_interruptible_timeout(qdio->req_q_wq,
+-			       zfcp_qdio_sbal_check(qdio), 5 * HZ);
++	ret = wait_event_interruptible_lock_irq_timeout(qdio->req_q_wq,
++		       zfcp_qdio_sbal_check(qdio), qdio->req_q_lock, 5 * HZ);
+ 
+ 	if (!(atomic_read(&qdio->adapter->status) & ZFCP_STATUS_ADAPTER_QDIOUP))
+ 		return -EIO;
+@@ -262,7 +259,6 @@ int zfcp_qdio_sbal_get(struct zfcp_qdio *qdio)
+ 		zfcp_erp_adapter_reopen(qdio->adapter, 0, "qdsbg_1");
+ 	}
+ 
+-	spin_lock_irq(&qdio->req_q_lock);
+ 	return -EIO;
+ }
+ 
+diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
+index 86af29f..1348fa4 100644
+--- a/drivers/scsi/Kconfig
++++ b/drivers/scsi/Kconfig
+@@ -1353,7 +1353,6 @@ config SCSI_LPFC
+ 	tristate "Emulex LightPulse Fibre Channel Support"
+ 	depends on PCI && SCSI
+ 	select SCSI_FC_ATTRS
+-	select GENERIC_CSUM
+ 	select CRC_T10DIF
+ 	help
+           This lpfc driver supports the Emulex LightPulse
+diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
+index 06d190f..4a2b042 100644
+--- a/drivers/staging/comedi/drivers.c
++++ b/drivers/staging/comedi/drivers.c
+@@ -464,7 +464,7 @@ int comedi_device_attach(struct comedi_device *dev, struct comedi_devconfig *it)
+ 		ret = comedi_device_postconfig(dev);
+ 	if (ret < 0) {
+ 		comedi_device_detach(dev);
+-		module_put(dev->driver->module);
++		module_put(driv->module);
+ 	}
+ 	/* On success, the driver module count has been incremented. */
+ 	return ret;
+diff --git a/drivers/usb/phy/phy-fsl-usb.h b/drivers/usb/phy/phy-fsl-usb.h
+index ca26628..e1859b8 100644
+--- a/drivers/usb/phy/phy-fsl-usb.h
++++ b/drivers/usb/phy/phy-fsl-usb.h
+@@ -15,7 +15,7 @@
+  * 675 Mass Ave, Cambridge, MA 02139, USA.
+  */
+ 
+-#include "otg_fsm.h"
++#include "phy-fsm-usb.h"
+ #include <linux/usb/otg.h>
+ #include <linux/ioctl.h>
+ 
+diff --git a/drivers/usb/phy/phy-fsm-usb.c b/drivers/usb/phy/phy-fsm-usb.c
+index c520b35..7f45966 100644
+--- a/drivers/usb/phy/phy-fsm-usb.c
++++ b/drivers/usb/phy/phy-fsm-usb.c
+@@ -29,7 +29,7 @@
+ #include <linux/usb/gadget.h>
+ #include <linux/usb/otg.h>
+ 
+-#include "phy-otg-fsm.h"
++#include "phy-fsm-usb.h"
+ 
+ /* Change USB protocol when there is a protocol change */
+ static int otg_set_protocol(struct otg_fsm *fsm, int protocol)
+diff --git a/drivers/xen/events.c b/drivers/xen/events.c
+index 6a6bbe4..1faa130 100644
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -346,7 +346,7 @@ static void init_evtchn_cpu_bindings(void)
+ 
+ 	for_each_possible_cpu(i)
+ 		memset(per_cpu(cpu_evtchn_mask, i),
+-		       (i == 0) ? ~0 : 0, sizeof(*per_cpu(cpu_evtchn_mask, i)));
++		       (i == 0) ? ~0 : 0, NR_EVENT_CHANNELS/8);
+ }
+ 
+ static inline void clear_evtchn(int port)
+@@ -1492,8 +1492,10 @@ void rebind_evtchn_irq(int evtchn, int irq)
+ /* Rebind an evtchn so that it gets delivered to a specific cpu */
+ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
+ {
++	struct shared_info *s = HYPERVISOR_shared_info;
+ 	struct evtchn_bind_vcpu bind_vcpu;
+ 	int evtchn = evtchn_from_irq(irq);
++	int masked;
+ 
+ 	if (!VALID_EVTCHN(evtchn))
+ 		return -1;
+@@ -1510,6 +1512,12 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
+ 	bind_vcpu.vcpu = tcpu;
+ 
+ 	/*
++	 * Mask the event while changing the VCPU binding to prevent
++	 * it being delivered on an unexpected VCPU.
++	 */
++	masked = sync_test_and_set_bit(evtchn, BM(s->evtchn_mask));
++
++	/*
+ 	 * If this fails, it usually just indicates that we're dealing with a
+ 	 * virq or IPI channel, which don't actually need to be rebound. Ignore
+ 	 * it, but don't do the xenlinux-level rebind in that case.
+@@ -1517,6 +1525,9 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
+ 	if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0)
+ 		bind_evtchn_to_cpu(evtchn, tcpu);
+ 
++	if (!masked)
++		unmask_evtchn(evtchn);
++
+ 	return 0;
+ }
+ 
+diff --git a/fs/bio.c b/fs/bio.c
+index 94bbc04..c5eae72 100644
+--- a/fs/bio.c
++++ b/fs/bio.c
+@@ -1045,12 +1045,22 @@ static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs,
+ int bio_uncopy_user(struct bio *bio)
+ {
+ 	struct bio_map_data *bmd = bio->bi_private;
+-	int ret = 0;
++	struct bio_vec *bvec;
++	int ret = 0, i;
+ 
+-	if (!bio_flagged(bio, BIO_NULL_MAPPED))
+-		ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs,
+-				     bmd->nr_sgvecs, bio_data_dir(bio) == READ,
+-				     0, bmd->is_our_pages);
++	if (!bio_flagged(bio, BIO_NULL_MAPPED)) {
++		/*
++		 * if we're in a workqueue, the request is orphaned, so
++		 * don't copy into a random user address space, just free.
++		 */
++		if (current->mm)
++			ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs,
++					     bmd->nr_sgvecs, bio_data_dir(bio) == READ,
++					     0, bmd->is_our_pages);
++		else if (bmd->is_our_pages)
++			bio_for_each_segment_all(bvec, bio, i)
++				__free_page(bvec->bv_page);
++	}
+ 	bio_free_map_data(bmd);
+ 	bio_put(bio);
+ 	return ret;
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 7b1ca9b..a45ba4f 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1429,7 +1429,7 @@ struct vfsmount *collect_mounts(struct path *path)
+ 			 CL_COPY_ALL | CL_PRIVATE);
+ 	namespace_unlock();
+ 	if (IS_ERR(tree))
+-		return NULL;
++		return ERR_CAST(tree);
+ 	return &tree->mnt;
+ }
+ 
+diff --git a/fs/nilfs2/segbuf.c b/fs/nilfs2/segbuf.c
+index dc9a913..2d8be51 100644
+--- a/fs/nilfs2/segbuf.c
++++ b/fs/nilfs2/segbuf.c
+@@ -345,8 +345,7 @@ static void nilfs_end_bio_write(struct bio *bio, int err)
+ 
+ 	if (err == -EOPNOTSUPP) {
+ 		set_bit(BIO_EOPNOTSUPP, &bio->bi_flags);
+-		bio_put(bio);
+-		/* to be detected by submit_seg_bio() */
++		/* to be detected by nilfs_segbuf_submit_bio() */
+ 	}
+ 
+ 	if (!uptodate)
+@@ -377,12 +376,12 @@ static int nilfs_segbuf_submit_bio(struct nilfs_segment_buffer *segbuf,
+ 	bio->bi_private = segbuf;
+ 	bio_get(bio);
+ 	submit_bio(mode, bio);
++	segbuf->sb_nbio++;
+ 	if (bio_flagged(bio, BIO_EOPNOTSUPP)) {
+ 		bio_put(bio);
+ 		err = -EOPNOTSUPP;
+ 		goto failed;
+ 	}
+-	segbuf->sb_nbio++;
+ 	bio_put(bio);
+ 
+ 	wi->bio = NULL;
+diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
+index c13c919..f45b2a78 100644
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -455,7 +455,11 @@ struct acpi_pci_root {
+ };
+ 
+ /* helper */
+-acpi_handle acpi_get_child(acpi_handle, u64);
++acpi_handle acpi_find_child(acpi_handle, u64, bool);
++static inline acpi_handle acpi_get_child(acpi_handle handle, u64 addr)
++{
++	return acpi_find_child(handle, addr, false);
++}
+ int acpi_is_root_bridge(acpi_handle);
+ struct acpi_pci_root *acpi_pci_find_root(acpi_handle handle);
+ #define DEVICE_ACPI_HANDLE(dev) ((acpi_handle)ACPI_HANDLE(dev))
+diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
+index 44cdc11..120d57a 100644
+--- a/include/linux/ftrace_event.h
++++ b/include/linux/ftrace_event.h
+@@ -334,7 +334,7 @@ extern int trace_define_field(struct ftrace_event_call *call, const char *type,
+ 			      const char *name, int offset, int size,
+ 			      int is_signed, int filter_type);
+ extern int trace_add_event_call(struct ftrace_event_call *call);
+-extern void trace_remove_event_call(struct ftrace_event_call *call);
++extern int trace_remove_event_call(struct ftrace_event_call *call);
+ 
+ #define is_signed_type(type)	(((type)(-1)) < (type)1)
+ 
+diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
+index ace9a5f..4a189ba 100644
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -333,6 +333,7 @@ struct mm_struct {
+ 	void (*unmap_area) (struct mm_struct *mm, unsigned long addr);
+ #endif
+ 	unsigned long mmap_base;		/* base of mmap area */
++	unsigned long mmap_legacy_base;         /* base of mmap area in bottom-up allocations */
+ 	unsigned long task_size;		/* size of task vm space */
+ 	unsigned long cached_hole_size; 	/* if non-zero, the largest hole below free_area_cache */
+ 	unsigned long free_area_cache;		/* first hole of size cached_hole_size or larger */
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 3aeb14b..178a8d9 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -314,7 +314,6 @@ struct nsproxy;
+ struct user_namespace;
+ 
+ #ifdef CONFIG_MMU
+-extern unsigned long mmap_legacy_base(void);
+ extern void arch_pick_mmap_layout(struct mm_struct *mm);
+ extern unsigned long
+ arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
+diff --git a/include/linux/wait.h b/include/linux/wait.h
+index 1133695..c8e5760 100644
+--- a/include/linux/wait.h
++++ b/include/linux/wait.h
+@@ -805,6 +805,63 @@ do {									\
+ 	__ret;								\
+ })
+ 
++#define __wait_event_interruptible_lock_irq_timeout(wq, condition,	\
++						    lock, ret)		\
++do {									\
++	DEFINE_WAIT(__wait);						\
++									\
++	for (;;) {							\
++		prepare_to_wait(&wq, &__wait, TASK_INTERRUPTIBLE);	\
++		if (condition)						\
++			break;						\
++		if (signal_pending(current)) {				\
++			ret = -ERESTARTSYS;				\
++			break;						\
++		}							\
++		spin_unlock_irq(&lock);					\
++		ret = schedule_timeout(ret);				\
++		spin_lock_irq(&lock);					\
++		if (!ret)						\
++			break;						\
++	}								\
++	finish_wait(&wq, &__wait);					\
++} while (0)
++
++/**
++ * wait_event_interruptible_lock_irq_timeout - sleep until a condition gets true or a timeout elapses.
++ *		The condition is checked under the lock. This is expected
++ *		to be called with the lock taken.
++ * @wq: the waitqueue to wait on
++ * @condition: a C expression for the event to wait for
++ * @lock: a locked spinlock_t, which will be released before schedule()
++ *	  and reacquired afterwards.
++ * @timeout: timeout, in jiffies
++ *
++ * The process is put to sleep (TASK_INTERRUPTIBLE) until the
++ * @condition evaluates to true or signal is received. The @condition is
++ * checked each time the waitqueue @wq is woken up.
++ *
++ * wake_up() has to be called after changing any variable that could
++ * change the result of the wait condition.
++ *
++ * This is supposed to be called while holding the lock. The lock is
++ * dropped before going to sleep and is reacquired afterwards.
++ *
++ * The function returns 0 if the @timeout elapsed, -ERESTARTSYS if it
++ * was interrupted by a signal, and the remaining jiffies otherwise
++ * if the condition evaluated to true before the timeout elapsed.
++ */
++#define wait_event_interruptible_lock_irq_timeout(wq, condition, lock,	\
++						  timeout)		\
++({									\
++	int __ret = timeout;						\
++									\
++	if (!(condition))						\
++		__wait_event_interruptible_lock_irq_timeout(		\
++					wq, condition, lock, __ret);	\
++	__ret;								\
++})
++
+ 
+ /*
+  * These are the old interfaces to sleep waiting for an event.
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 6c508ff..f23449d 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1416,12 +1416,22 @@ ftrace_hash_move(struct ftrace_ops *ops, int enable,
+  * the hashes are freed with call_rcu_sched().
+  */
+ static int
+-ftrace_ops_test(struct ftrace_ops *ops, unsigned long ip)
++ftrace_ops_test(struct ftrace_ops *ops, unsigned long ip, void *regs)
+ {
+ 	struct ftrace_hash *filter_hash;
+ 	struct ftrace_hash *notrace_hash;
+ 	int ret;
+ 
++#ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS
++	/*
++	 * There's a small race when adding ops that the ftrace handler
++	 * that wants regs, may be called without them. We can not
++	 * allow that handler to be called if regs is NULL.
++	 */
++	if (regs == NULL && (ops->flags & FTRACE_OPS_FL_SAVE_REGS))
++		return 0;
++#endif
++
+ 	filter_hash = rcu_dereference_raw_notrace(ops->filter_hash);
+ 	notrace_hash = rcu_dereference_raw_notrace(ops->notrace_hash);
+ 
+@@ -2134,12 +2144,57 @@ static cycle_t		ftrace_update_time;
+ static unsigned long	ftrace_update_cnt;
+ unsigned long		ftrace_update_tot_cnt;
+ 
+-static int ops_traces_mod(struct ftrace_ops *ops)
++static inline int ops_traces_mod(struct ftrace_ops *ops)
+ {
+-	struct ftrace_hash *hash;
++	/*
++	 * Filter_hash being empty will default to trace module.
++	 * But notrace hash requires a test of individual module functions.
++	 */
++	return ftrace_hash_empty(ops->filter_hash) &&
++		ftrace_hash_empty(ops->notrace_hash);
++}
++
++/*
++ * Check if the current ops references the record.
++ *
++ * If the ops traces all functions, then it was already accounted for.
++ * If the ops does not trace the current record function, skip it.
++ * If the ops ignores the function via notrace filter, skip it.
++ */
++static inline bool
++ops_references_rec(struct ftrace_ops *ops, struct dyn_ftrace *rec)
++{
++	/* If ops isn't enabled, ignore it */
++	if (!(ops->flags & FTRACE_OPS_FL_ENABLED))
++		return 0;
++
++	/* If ops traces all mods, we already accounted for it */
++	if (ops_traces_mod(ops))
++		return 0;
+ 
+-	hash = ops->filter_hash;
+-	return ftrace_hash_empty(hash);
++	/* The function must be in the filter */
++	if (!ftrace_hash_empty(ops->filter_hash) &&
++	    !ftrace_lookup_ip(ops->filter_hash, rec->ip))
++		return 0;
++
++	/* If in notrace hash, we ignore it too */
++	if (ftrace_lookup_ip(ops->notrace_hash, rec->ip))
++		return 0;
++
++	return 1;
++}
++
++static int referenced_filters(struct dyn_ftrace *rec)
++{
++	struct ftrace_ops *ops;
++	int cnt = 0;
++
++	for (ops = ftrace_ops_list; ops != &ftrace_list_end; ops = ops->next) {
++		if (ops_references_rec(ops, rec))
++		    cnt++;
++	}
++
++	return cnt;
+ }
+ 
+ static int ftrace_update_code(struct module *mod)
+@@ -2148,6 +2203,7 @@ static int ftrace_update_code(struct module *mod)
+ 	struct dyn_ftrace *p;
+ 	cycle_t start, stop;
+ 	unsigned long ref = 0;
++	bool test = false;
+ 	int i;
+ 
+ 	/*
+@@ -2161,9 +2217,12 @@ static int ftrace_update_code(struct module *mod)
+ 
+ 		for (ops = ftrace_ops_list;
+ 		     ops != &ftrace_list_end; ops = ops->next) {
+-			if (ops->flags & FTRACE_OPS_FL_ENABLED &&
+-			    ops_traces_mod(ops))
+-				ref++;
++			if (ops->flags & FTRACE_OPS_FL_ENABLED) {
++				if (ops_traces_mod(ops))
++					ref++;
++				else
++					test = true;
++			}
+ 		}
+ 	}
+ 
+@@ -2173,12 +2232,16 @@ static int ftrace_update_code(struct module *mod)
+ 	for (pg = ftrace_new_pgs; pg; pg = pg->next) {
+ 
+ 		for (i = 0; i < pg->index; i++) {
++			int cnt = ref;
++
+ 			/* If something went wrong, bail without enabling anything */
+ 			if (unlikely(ftrace_disabled))
+ 				return -1;
+ 
+ 			p = &pg->records[i];
+-			p->flags = ref;
++			if (test)
++				cnt += referenced_filters(p);
++			p->flags = cnt;
+ 
+ 			/*
+ 			 * Do the initial record conversion from mcount jump
+@@ -2198,7 +2261,7 @@ static int ftrace_update_code(struct module *mod)
+ 			 * conversion puts the module to the correct state, thus
+ 			 * passing the ftrace_make_call check.
+ 			 */
+-			if (ftrace_start_up && ref) {
++			if (ftrace_start_up && cnt) {
+ 				int failed = __ftrace_replace_code(p, 1);
+ 				if (failed)
+ 					ftrace_bug(failed, p->ip);
+@@ -4188,7 +4251,7 @@ static inline void ftrace_startup_enable(int command) { }
+ # define ftrace_shutdown_sysctl()	do { } while (0)
+ 
+ static inline int
+-ftrace_ops_test(struct ftrace_ops *ops, unsigned long ip)
++ftrace_ops_test(struct ftrace_ops *ops, unsigned long ip, void *regs)
+ {
+ 	return 1;
+ }
+@@ -4211,7 +4274,7 @@ ftrace_ops_control_func(unsigned long ip, unsigned long parent_ip,
+ 	do_for_each_ftrace_op(op, ftrace_control_list) {
+ 		if (!(op->flags & FTRACE_OPS_FL_STUB) &&
+ 		    !ftrace_function_local_disabled(op) &&
+-		    ftrace_ops_test(op, ip))
++		    ftrace_ops_test(op, ip, regs))
+ 			op->func(ip, parent_ip, op, regs);
+ 	} while_for_each_ftrace_op(op);
+ 	trace_recursion_clear(TRACE_CONTROL_BIT);
+@@ -4244,7 +4307,7 @@ __ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip,
+ 	 */
+ 	preempt_disable_notrace();
+ 	do_for_each_ftrace_op(op, ftrace_ops_list) {
+-		if (ftrace_ops_test(op, ip))
++		if (ftrace_ops_test(op, ip, regs))
+ 			op->func(ip, parent_ip, op, regs);
+ 	} while_for_each_ftrace_op(op);
+ 	preempt_enable_notrace();
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 06a5bce..0582a01 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2834,6 +2834,17 @@ static int s_show(struct seq_file *m, void *v)
+ 	return 0;
+ }
+ 
++/*
++ * Should be used after trace_array_get(), trace_types_lock
++ * ensures that i_cdev was already initialized.
++ */
++static inline int tracing_get_cpu(struct inode *inode)
++{
++	if (inode->i_cdev) /* See trace_create_cpu_file() */
++		return (long)inode->i_cdev - 1;
++	return RING_BUFFER_ALL_CPUS;
++}
++
+ static const struct seq_operations tracer_seq_ops = {
+ 	.start		= s_start,
+ 	.next		= s_next,
+@@ -2842,9 +2853,9 @@ static const struct seq_operations tracer_seq_ops = {
+ };
+ 
+ static struct trace_iterator *
+-__tracing_open(struct trace_array *tr, struct trace_cpu *tc,
+-	       struct inode *inode, struct file *file, bool snapshot)
++__tracing_open(struct inode *inode, struct file *file, bool snapshot)
+ {
++	struct trace_array *tr = inode->i_private;
+ 	struct trace_iterator *iter;
+ 	int cpu;
+ 
+@@ -2885,8 +2896,8 @@ __tracing_open(struct trace_array *tr, struct trace_cpu *tc,
+ 		iter->trace_buffer = &tr->trace_buffer;
+ 	iter->snapshot = snapshot;
+ 	iter->pos = -1;
++	iter->cpu_file = tracing_get_cpu(inode);
+ 	mutex_init(&iter->mutex);
+-	iter->cpu_file = tc->cpu;
+ 
+ 	/* Notify the tracer early; before we stop tracing. */
+ 	if (iter->trace && iter->trace->open)
+@@ -2962,44 +2973,22 @@ int tracing_open_generic_tr(struct inode *inode, struct file *filp)
+ 	filp->private_data = inode->i_private;
+ 
+ 	return 0;
+-
+-}
+-
+-int tracing_open_generic_tc(struct inode *inode, struct file *filp)
+-{
+-	struct trace_cpu *tc = inode->i_private;
+-	struct trace_array *tr = tc->tr;
+-
+-	if (tracing_disabled)
+-		return -ENODEV;
+-
+-	if (trace_array_get(tr) < 0)
+-		return -ENODEV;
+-
+-	filp->private_data = inode->i_private;
+-
+-	return 0;
+-
+ }
+ 
+ static int tracing_release(struct inode *inode, struct file *file)
+ {
++	struct trace_array *tr = inode->i_private;
+ 	struct seq_file *m = file->private_data;
+ 	struct trace_iterator *iter;
+-	struct trace_array *tr;
+ 	int cpu;
+ 
+-	/* Writes do not use seq_file, need to grab tr from inode */
+ 	if (!(file->f_mode & FMODE_READ)) {
+-		struct trace_cpu *tc = inode->i_private;
+-
+-		trace_array_put(tc->tr);
++		trace_array_put(tr);
+ 		return 0;
+ 	}
+ 
++	/* Writes do not use seq_file */
+ 	iter = m->private;
+-	tr = iter->tr;
+-
+ 	mutex_lock(&trace_types_lock);
+ 
+ 	for_each_tracing_cpu(cpu) {
+@@ -3035,15 +3024,6 @@ static int tracing_release_generic_tr(struct inode *inode, struct file *file)
+ 	return 0;
+ }
+ 
+-static int tracing_release_generic_tc(struct inode *inode, struct file *file)
+-{
+-	struct trace_cpu *tc = inode->i_private;
+-	struct trace_array *tr = tc->tr;
+-
+-	trace_array_put(tr);
+-	return 0;
+-}
+-
+ static int tracing_single_release_tr(struct inode *inode, struct file *file)
+ {
+ 	struct trace_array *tr = inode->i_private;
+@@ -3055,8 +3035,7 @@ static int tracing_single_release_tr(struct inode *inode, struct file *file)
+ 
+ static int tracing_open(struct inode *inode, struct file *file)
+ {
+-	struct trace_cpu *tc = inode->i_private;
+-	struct trace_array *tr = tc->tr;
++	struct trace_array *tr = inode->i_private;
+ 	struct trace_iterator *iter;
+ 	int ret = 0;
+ 
+@@ -3064,16 +3043,17 @@ static int tracing_open(struct inode *inode, struct file *file)
+ 		return -ENODEV;
+ 
+ 	/* If this file was open for write, then erase contents */
+-	if ((file->f_mode & FMODE_WRITE) &&
+-	    (file->f_flags & O_TRUNC)) {
+-		if (tc->cpu == RING_BUFFER_ALL_CPUS)
++	if ((file->f_mode & FMODE_WRITE) && (file->f_flags & O_TRUNC)) {
++		int cpu = tracing_get_cpu(inode);
++
++		if (cpu == RING_BUFFER_ALL_CPUS)
+ 			tracing_reset_online_cpus(&tr->trace_buffer);
+ 		else
+-			tracing_reset(&tr->trace_buffer, tc->cpu);
++			tracing_reset(&tr->trace_buffer, cpu);
+ 	}
+ 
+ 	if (file->f_mode & FMODE_READ) {
+-		iter = __tracing_open(tr, tc, inode, file, false);
++		iter = __tracing_open(inode, file, false);
+ 		if (IS_ERR(iter))
+ 			ret = PTR_ERR(iter);
+ 		else if (trace_flags & TRACE_ITER_LATENCY_FMT)
+@@ -3939,8 +3919,7 @@ tracing_max_lat_write(struct file *filp, const char __user *ubuf,
+ 
+ static int tracing_open_pipe(struct inode *inode, struct file *filp)
+ {
+-	struct trace_cpu *tc = inode->i_private;
+-	struct trace_array *tr = tc->tr;
++	struct trace_array *tr = inode->i_private;
+ 	struct trace_iterator *iter;
+ 	int ret = 0;
+ 
+@@ -3986,9 +3965,9 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp)
+ 	if (trace_clocks[tr->clock_id].in_ns)
+ 		iter->iter_flags |= TRACE_FILE_TIME_IN_NS;
+ 
+-	iter->cpu_file = tc->cpu;
+-	iter->tr = tc->tr;
+-	iter->trace_buffer = &tc->tr->trace_buffer;
++	iter->tr = tr;
++	iter->trace_buffer = &tr->trace_buffer;
++	iter->cpu_file = tracing_get_cpu(inode);
+ 	mutex_init(&iter->mutex);
+ 	filp->private_data = iter;
+ 
+@@ -4011,8 +3990,7 @@ fail:
+ static int tracing_release_pipe(struct inode *inode, struct file *file)
+ {
+ 	struct trace_iterator *iter = file->private_data;
+-	struct trace_cpu *tc = inode->i_private;
+-	struct trace_array *tr = tc->tr;
++	struct trace_array *tr = inode->i_private;
+ 
+ 	mutex_lock(&trace_types_lock);
+ 
+@@ -4366,15 +4344,16 @@ static ssize_t
+ tracing_entries_read(struct file *filp, char __user *ubuf,
+ 		     size_t cnt, loff_t *ppos)
+ {
+-	struct trace_cpu *tc = filp->private_data;
+-	struct trace_array *tr = tc->tr;
++	struct inode *inode = file_inode(filp);
++	struct trace_array *tr = inode->i_private;
++	int cpu = tracing_get_cpu(inode);
+ 	char buf[64];
+ 	int r = 0;
+ 	ssize_t ret;
+ 
+ 	mutex_lock(&trace_types_lock);
+ 
+-	if (tc->cpu == RING_BUFFER_ALL_CPUS) {
++	if (cpu == RING_BUFFER_ALL_CPUS) {
+ 		int cpu, buf_size_same;
+ 		unsigned long size;
+ 
+@@ -4401,7 +4380,7 @@ tracing_entries_read(struct file *filp, char __user *ubuf,
+ 		} else
+ 			r = sprintf(buf, "X\n");
+ 	} else
+-		r = sprintf(buf, "%lu\n", per_cpu_ptr(tr->trace_buffer.data, tc->cpu)->entries >> 10);
++		r = sprintf(buf, "%lu\n", per_cpu_ptr(tr->trace_buffer.data, cpu)->entries >> 10);
+ 
+ 	mutex_unlock(&trace_types_lock);
+ 
+@@ -4413,7 +4392,8 @@ static ssize_t
+ tracing_entries_write(struct file *filp, const char __user *ubuf,
+ 		      size_t cnt, loff_t *ppos)
+ {
+-	struct trace_cpu *tc = filp->private_data;
++	struct inode *inode = file_inode(filp);
++	struct trace_array *tr = inode->i_private;
+ 	unsigned long val;
+ 	int ret;
+ 
+@@ -4427,8 +4407,7 @@ tracing_entries_write(struct file *filp, const char __user *ubuf,
+ 
+ 	/* value is in KB */
+ 	val <<= 10;
+-
+-	ret = tracing_resize_ring_buffer(tc->tr, val, tc->cpu);
++	ret = tracing_resize_ring_buffer(tr, val, tracing_get_cpu(inode));
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -4689,8 +4668,7 @@ struct ftrace_buffer_info {
+ #ifdef CONFIG_TRACER_SNAPSHOT
+ static int tracing_snapshot_open(struct inode *inode, struct file *file)
+ {
+-	struct trace_cpu *tc = inode->i_private;
+-	struct trace_array *tr = tc->tr;
++	struct trace_array *tr = inode->i_private;
+ 	struct trace_iterator *iter;
+ 	struct seq_file *m;
+ 	int ret = 0;
+@@ -4699,7 +4677,7 @@ static int tracing_snapshot_open(struct inode *inode, struct file *file)
+ 		return -ENODEV;
+ 
+ 	if (file->f_mode & FMODE_READ) {
+-		iter = __tracing_open(tr, tc, inode, file, true);
++		iter = __tracing_open(inode, file, true);
+ 		if (IS_ERR(iter))
+ 			ret = PTR_ERR(iter);
+ 	} else {
+@@ -4716,8 +4694,8 @@ static int tracing_snapshot_open(struct inode *inode, struct file *file)
+ 		ret = 0;
+ 
+ 		iter->tr = tr;
+-		iter->trace_buffer = &tc->tr->max_buffer;
+-		iter->cpu_file = tc->cpu;
++		iter->trace_buffer = &tr->max_buffer;
++		iter->cpu_file = tracing_get_cpu(inode);
+ 		m->private = iter;
+ 		file->private_data = m;
+ 	}
+@@ -4876,11 +4854,11 @@ static const struct file_operations tracing_pipe_fops = {
+ };
+ 
+ static const struct file_operations tracing_entries_fops = {
+-	.open		= tracing_open_generic_tc,
++	.open		= tracing_open_generic_tr,
+ 	.read		= tracing_entries_read,
+ 	.write		= tracing_entries_write,
+ 	.llseek		= generic_file_llseek,
+-	.release	= tracing_release_generic_tc,
++	.release	= tracing_release_generic_tr,
+ };
+ 
+ static const struct file_operations tracing_total_entries_fops = {
+@@ -4932,8 +4910,7 @@ static const struct file_operations snapshot_raw_fops = {
+ 
+ static int tracing_buffers_open(struct inode *inode, struct file *filp)
+ {
+-	struct trace_cpu *tc = inode->i_private;
+-	struct trace_array *tr = tc->tr;
++	struct trace_array *tr = inode->i_private;
+ 	struct ftrace_buffer_info *info;
+ 	int ret;
+ 
+@@ -4952,7 +4929,7 @@ static int tracing_buffers_open(struct inode *inode, struct file *filp)
+ 	mutex_lock(&trace_types_lock);
+ 
+ 	info->iter.tr		= tr;
+-	info->iter.cpu_file	= tc->cpu;
++	info->iter.cpu_file	= tracing_get_cpu(inode);
+ 	info->iter.trace	= tr->current_trace;
+ 	info->iter.trace_buffer = &tr->trace_buffer;
+ 	info->spare		= NULL;
+@@ -5269,14 +5246,14 @@ static ssize_t
+ tracing_stats_read(struct file *filp, char __user *ubuf,
+ 		   size_t count, loff_t *ppos)
+ {
+-	struct trace_cpu *tc = filp->private_data;
+-	struct trace_array *tr = tc->tr;
++	struct inode *inode = file_inode(filp);
++	struct trace_array *tr = inode->i_private;
+ 	struct trace_buffer *trace_buf = &tr->trace_buffer;
++	int cpu = tracing_get_cpu(inode);
+ 	struct trace_seq *s;
+ 	unsigned long cnt;
+ 	unsigned long long t;
+ 	unsigned long usec_rem;
+-	int cpu = tc->cpu;
+ 
+ 	s = kmalloc(sizeof(*s), GFP_KERNEL);
+ 	if (!s)
+@@ -5329,10 +5306,10 @@ tracing_stats_read(struct file *filp, char __user *ubuf,
+ }
+ 
+ static const struct file_operations tracing_stats_fops = {
+-	.open		= tracing_open_generic_tc,
++	.open		= tracing_open_generic_tr,
+ 	.read		= tracing_stats_read,
+ 	.llseek		= generic_file_llseek,
+-	.release	= tracing_release_generic_tc,
++	.release	= tracing_release_generic_tr,
+ };
+ 
+ #ifdef CONFIG_DYNAMIC_FTRACE
+@@ -5521,10 +5498,20 @@ static struct dentry *tracing_dentry_percpu(struct trace_array *tr, int cpu)
+ 	return tr->percpu_dir;
+ }
+ 
++static struct dentry *
++trace_create_cpu_file(const char *name, umode_t mode, struct dentry *parent,
++		      void *data, long cpu, const struct file_operations *fops)
++{
++	struct dentry *ret = trace_create_file(name, mode, parent, data, fops);
++
++	if (ret) /* See tracing_get_cpu() */
++		ret->d_inode->i_cdev = (void *)(cpu + 1);
++	return ret;
++}
++
+ static void
+ tracing_init_debugfs_percpu(struct trace_array *tr, long cpu)
+ {
+-	struct trace_array_cpu *data = per_cpu_ptr(tr->trace_buffer.data, cpu);
+ 	struct dentry *d_percpu = tracing_dentry_percpu(tr, cpu);
+ 	struct dentry *d_cpu;
+ 	char cpu_dir[30]; /* 30 characters should be more than enough */
+@@ -5540,28 +5527,28 @@ tracing_init_debugfs_percpu(struct trace_array *tr, long cpu)
+ 	}
+ 
+ 	/* per cpu trace_pipe */
+-	trace_create_file("trace_pipe", 0444, d_cpu,
+-			(void *)&data->trace_cpu, &tracing_pipe_fops);
++	trace_create_cpu_file("trace_pipe", 0444, d_cpu,
++				tr, cpu, &tracing_pipe_fops);
+ 
+ 	/* per cpu trace */
+-	trace_create_file("trace", 0644, d_cpu,
+-			(void *)&data->trace_cpu, &tracing_fops);
++	trace_create_cpu_file("trace", 0644, d_cpu,
++				tr, cpu, &tracing_fops);
+ 
+-	trace_create_file("trace_pipe_raw", 0444, d_cpu,
+-			(void *)&data->trace_cpu, &tracing_buffers_fops);
++	trace_create_cpu_file("trace_pipe_raw", 0444, d_cpu,
++				tr, cpu, &tracing_buffers_fops);
+ 
+-	trace_create_file("stats", 0444, d_cpu,
+-			(void *)&data->trace_cpu, &tracing_stats_fops);
++	trace_create_cpu_file("stats", 0444, d_cpu,
++				tr, cpu, &tracing_stats_fops);
+ 
+-	trace_create_file("buffer_size_kb", 0444, d_cpu,
+-			(void *)&data->trace_cpu, &tracing_entries_fops);
++	trace_create_cpu_file("buffer_size_kb", 0444, d_cpu,
++				tr, cpu, &tracing_entries_fops);
+ 
+ #ifdef CONFIG_TRACER_SNAPSHOT
+-	trace_create_file("snapshot", 0644, d_cpu,
+-			  (void *)&data->trace_cpu, &snapshot_fops);
++	trace_create_cpu_file("snapshot", 0644, d_cpu,
++				tr, cpu, &snapshot_fops);
+ 
+-	trace_create_file("snapshot_raw", 0444, d_cpu,
+-			(void *)&data->trace_cpu, &snapshot_raw_fops);
++	trace_create_cpu_file("snapshot_raw", 0444, d_cpu,
++				tr, cpu, &snapshot_raw_fops);
+ #endif
+ }
+ 
+@@ -6124,13 +6111,13 @@ init_tracer_debugfs(struct trace_array *tr, struct dentry *d_tracer)
+ 			  tr, &tracing_iter_fops);
+ 
+ 	trace_create_file("trace", 0644, d_tracer,
+-			(void *)&tr->trace_cpu, &tracing_fops);
++			  tr, &tracing_fops);
+ 
+ 	trace_create_file("trace_pipe", 0444, d_tracer,
+-			(void *)&tr->trace_cpu, &tracing_pipe_fops);
++			  tr, &tracing_pipe_fops);
+ 
+ 	trace_create_file("buffer_size_kb", 0644, d_tracer,
+-			(void *)&tr->trace_cpu, &tracing_entries_fops);
++			  tr, &tracing_entries_fops);
+ 
+ 	trace_create_file("buffer_total_size_kb", 0444, d_tracer,
+ 			  tr, &tracing_total_entries_fops);
+@@ -6145,11 +6132,11 @@ init_tracer_debugfs(struct trace_array *tr, struct dentry *d_tracer)
+ 			  &trace_clock_fops);
+ 
+ 	trace_create_file("tracing_on", 0644, d_tracer,
+-			    tr, &rb_simple_fops);
++			  tr, &rb_simple_fops);
+ 
+ #ifdef CONFIG_TRACER_SNAPSHOT
+ 	trace_create_file("snapshot", 0644, d_tracer,
+-			  (void *)&tr->trace_cpu, &snapshot_fops);
++			  tr, &snapshot_fops);
+ #endif
+ 
+ 	for_each_tracing_cpu(cpu)
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 6953263..3d18aad 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -114,7 +114,7 @@ static int __trace_define_field(struct list_head *head, const char *type,
+ 
+ 	field = kmem_cache_alloc(field_cachep, GFP_TRACE);
+ 	if (!field)
+-		goto err;
++		return -ENOMEM;
+ 
+ 	field->name = name;
+ 	field->type = type;
+@@ -131,11 +131,6 @@ static int __trace_define_field(struct list_head *head, const char *type,
+ 	list_add(&field->link, head);
+ 
+ 	return 0;
+-
+-err:
+-	kmem_cache_free(field_cachep, field);
+-
+-	return -ENOMEM;
+ }
+ 
+ int trace_define_field(struct ftrace_event_call *call, const char *type,
+@@ -412,33 +407,42 @@ static void put_system(struct ftrace_subsystem_dir *dir)
+ 	mutex_unlock(&event_mutex);
+ }
+ 
+-/*
+- * Open and update trace_array ref count.
+- * Must have the current trace_array passed to it.
+- */
+-static int tracing_open_generic_file(struct inode *inode, struct file *filp)
++static void remove_subsystem(struct ftrace_subsystem_dir *dir)
+ {
+-	struct ftrace_event_file *file = inode->i_private;
+-	struct trace_array *tr = file->tr;
+-	int ret;
++	if (!dir)
++		return;
+ 
+-	if (trace_array_get(tr) < 0)
+-		return -ENODEV;
++	if (!--dir->nr_events) {
++		debugfs_remove_recursive(dir->entry);
++		list_del(&dir->list);
++		__put_system_dir(dir);
++	}
++}
+ 
+-	ret = tracing_open_generic(inode, filp);
+-	if (ret < 0)
+-		trace_array_put(tr);
+-	return ret;
++static void *event_file_data(struct file *filp)
++{
++	return ACCESS_ONCE(file_inode(filp)->i_private);
+ }
+ 
+-static int tracing_release_generic_file(struct inode *inode, struct file *filp)
++static void remove_event_file_dir(struct ftrace_event_file *file)
+ {
+-	struct ftrace_event_file *file = inode->i_private;
+-	struct trace_array *tr = file->tr;
++	struct dentry *dir = file->dir;
++	struct dentry *child;
+ 
+-	trace_array_put(tr);
++	if (dir) {
++		spin_lock(&dir->d_lock);	/* probably unneeded */
++		list_for_each_entry(child, &dir->d_subdirs, d_u.d_child) {
++			if (child->d_inode)	/* probably unneeded */
++				child->d_inode->i_private = NULL;
++		}
++		spin_unlock(&dir->d_lock);
+ 
+-	return 0;
++		debugfs_remove_recursive(dir);
++	}
++
++	list_del(&file->list);
++	remove_subsystem(file->system);
++	kmem_cache_free(file_cachep, file);
+ }
+ 
+ /*
+@@ -682,13 +686,23 @@ static ssize_t
+ event_enable_read(struct file *filp, char __user *ubuf, size_t cnt,
+ 		  loff_t *ppos)
+ {
+-	struct ftrace_event_file *file = filp->private_data;
++	struct ftrace_event_file *file;
++	unsigned long flags;
+ 	char *buf;
+ 
+-	if (file->flags & FTRACE_EVENT_FL_ENABLED) {
+-		if (file->flags & FTRACE_EVENT_FL_SOFT_DISABLED)
++	mutex_lock(&event_mutex);
++	file = event_file_data(filp);
++	if (likely(file))
++		flags = file->flags;
++	mutex_unlock(&event_mutex);
++
++	if (!file)
++		return -ENODEV;
++
++	if (flags & FTRACE_EVENT_FL_ENABLED) {
++		if (flags & FTRACE_EVENT_FL_SOFT_DISABLED)
+ 			buf = "0*\n";
+-		else if (file->flags & FTRACE_EVENT_FL_SOFT_MODE)
++		else if (flags & FTRACE_EVENT_FL_SOFT_MODE)
+ 			buf = "1*\n";
+ 		else
+ 			buf = "1\n";
+@@ -702,13 +716,10 @@ static ssize_t
+ event_enable_write(struct file *filp, const char __user *ubuf, size_t cnt,
+ 		   loff_t *ppos)
+ {
+-	struct ftrace_event_file *file = filp->private_data;
++	struct ftrace_event_file *file;
+ 	unsigned long val;
+ 	int ret;
+ 
+-	if (!file)
+-		return -EINVAL;
+-
+ 	ret = kstrtoul_from_user(ubuf, cnt, 10, &val);
+ 	if (ret)
+ 		return ret;
+@@ -720,8 +731,11 @@ event_enable_write(struct file *filp, const char __user *ubuf, size_t cnt,
+ 	switch (val) {
+ 	case 0:
+ 	case 1:
++		ret = -ENODEV;
+ 		mutex_lock(&event_mutex);
+-		ret = ftrace_event_enable_disable(file, val);
++		file = event_file_data(filp);
++		if (likely(file))
++			ret = ftrace_event_enable_disable(file, val);
+ 		mutex_unlock(&event_mutex);
+ 		break;
+ 
+@@ -828,7 +842,7 @@ enum {
+ 
+ static void *f_next(struct seq_file *m, void *v, loff_t *pos)
+ {
+-	struct ftrace_event_call *call = m->private;
++	struct ftrace_event_call *call = event_file_data(m->private);
+ 	struct ftrace_event_field *field;
+ 	struct list_head *common_head = &ftrace_common_fields;
+ 	struct list_head *head = trace_get_fields(call);
+@@ -872,6 +886,11 @@ static void *f_start(struct seq_file *m, loff_t *pos)
+ 	loff_t l = 0;
+ 	void *p;
+ 
++	/* ->stop() is called even if ->start() fails */
++	mutex_lock(&event_mutex);
++	if (!event_file_data(m->private))
++		return ERR_PTR(-ENODEV);
++
+ 	/* Start by showing the header */
+ 	if (!*pos)
+ 		return (void *)FORMAT_HEADER;
+@@ -886,7 +905,7 @@ static void *f_start(struct seq_file *m, loff_t *pos)
+ 
+ static int f_show(struct seq_file *m, void *v)
+ {
+-	struct ftrace_event_call *call = m->private;
++	struct ftrace_event_call *call = event_file_data(m->private);
+ 	struct ftrace_event_field *field;
+ 	const char *array_descriptor;
+ 
+@@ -937,6 +956,7 @@ static int f_show(struct seq_file *m, void *v)
+ 
+ static void f_stop(struct seq_file *m, void *p)
+ {
++	mutex_unlock(&event_mutex);
+ }
+ 
+ static const struct seq_operations trace_format_seq_ops = {
+@@ -948,7 +968,6 @@ static const struct seq_operations trace_format_seq_ops = {
+ 
+ static int trace_format_open(struct inode *inode, struct file *file)
+ {
+-	struct ftrace_event_call *call = inode->i_private;
+ 	struct seq_file *m;
+ 	int ret;
+ 
+@@ -957,7 +976,7 @@ static int trace_format_open(struct inode *inode, struct file *file)
+ 		return ret;
+ 
+ 	m = file->private_data;
+-	m->private = call;
++	m->private = file;
+ 
+ 	return 0;
+ }
+@@ -965,19 +984,22 @@ static int trace_format_open(struct inode *inode, struct file *file)
+ static ssize_t
+ event_id_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+ {
+-	struct ftrace_event_call *call = filp->private_data;
++	int id = (long)event_file_data(filp);
+ 	struct trace_seq *s;
+ 	int r;
+ 
+ 	if (*ppos)
+ 		return 0;
+ 
++	if (unlikely(!id))
++		return -ENODEV;
++
+ 	s = kmalloc(sizeof(*s), GFP_KERNEL);
+ 	if (!s)
+ 		return -ENOMEM;
+ 
+ 	trace_seq_init(s);
+-	trace_seq_printf(s, "%d\n", call->event.type);
++	trace_seq_printf(s, "%d\n", id);
+ 
+ 	r = simple_read_from_buffer(ubuf, cnt, ppos,
+ 				    s->buffer, s->len);
+@@ -989,21 +1011,28 @@ static ssize_t
+ event_filter_read(struct file *filp, char __user *ubuf, size_t cnt,
+ 		  loff_t *ppos)
+ {
+-	struct ftrace_event_call *call = filp->private_data;
++	struct ftrace_event_call *call;
+ 	struct trace_seq *s;
+-	int r;
++	int r = -ENODEV;
+ 
+ 	if (*ppos)
+ 		return 0;
+ 
+ 	s = kmalloc(sizeof(*s), GFP_KERNEL);
++
+ 	if (!s)
+ 		return -ENOMEM;
+ 
+ 	trace_seq_init(s);
+ 
+-	print_event_filter(call, s);
+-	r = simple_read_from_buffer(ubuf, cnt, ppos, s->buffer, s->len);
++	mutex_lock(&event_mutex);
++	call = event_file_data(filp);
++	if (call)
++		print_event_filter(call, s);
++	mutex_unlock(&event_mutex);
++
++	if (call)
++		r = simple_read_from_buffer(ubuf, cnt, ppos, s->buffer, s->len);
+ 
+ 	kfree(s);
+ 
+@@ -1014,9 +1043,9 @@ static ssize_t
+ event_filter_write(struct file *filp, const char __user *ubuf, size_t cnt,
+ 		   loff_t *ppos)
+ {
+-	struct ftrace_event_call *call = filp->private_data;
++	struct ftrace_event_call *call;
+ 	char *buf;
+-	int err;
++	int err = -ENODEV;
+ 
+ 	if (cnt >= PAGE_SIZE)
+ 		return -EINVAL;
+@@ -1031,7 +1060,12 @@ event_filter_write(struct file *filp, const char __user *ubuf, size_t cnt,
+ 	}
+ 	buf[cnt] = '\0';
+ 
+-	err = apply_event_filter(call, buf);
++	mutex_lock(&event_mutex);
++	call = event_file_data(filp);
++	if (call)
++		err = apply_event_filter(call, buf);
++	mutex_unlock(&event_mutex);
++
+ 	free_page((unsigned long) buf);
+ 	if (err < 0)
+ 		return err;
+@@ -1253,10 +1287,9 @@ static const struct file_operations ftrace_set_event_fops = {
+ };
+ 
+ static const struct file_operations ftrace_enable_fops = {
+-	.open = tracing_open_generic_file,
++	.open = tracing_open_generic,
+ 	.read = event_enable_read,
+ 	.write = event_enable_write,
+-	.release = tracing_release_generic_file,
+ 	.llseek = default_llseek,
+ };
+ 
+@@ -1268,7 +1301,6 @@ static const struct file_operations ftrace_event_format_fops = {
+ };
+ 
+ static const struct file_operations ftrace_event_id_fops = {
+-	.open = tracing_open_generic,
+ 	.read = event_id_read,
+ 	.llseek = default_llseek,
+ };
+@@ -1516,8 +1548,8 @@ event_create_dir(struct dentry *parent,
+ 
+ #ifdef CONFIG_PERF_EVENTS
+ 	if (call->event.type && call->class->reg)
+-		trace_create_file("id", 0444, file->dir, call,
+-		 		  id);
++		trace_create_file("id", 0444, file->dir,
++				  (void *)(long)call->event.type, id);
+ #endif
+ 
+ 	/*
+@@ -1542,33 +1574,16 @@ event_create_dir(struct dentry *parent,
+ 	return 0;
+ }
+ 
+-static void remove_subsystem(struct ftrace_subsystem_dir *dir)
+-{
+-	if (!dir)
+-		return;
+-
+-	if (!--dir->nr_events) {
+-		debugfs_remove_recursive(dir->entry);
+-		list_del(&dir->list);
+-		__put_system_dir(dir);
+-	}
+-}
+-
+ static void remove_event_from_tracers(struct ftrace_event_call *call)
+ {
+ 	struct ftrace_event_file *file;
+ 	struct trace_array *tr;
+ 
+ 	do_for_each_event_file_safe(tr, file) {
+-
+ 		if (file->event_call != call)
+ 			continue;
+ 
+-		list_del(&file->list);
+-		debugfs_remove_recursive(file->dir);
+-		remove_subsystem(file->system);
+-		kmem_cache_free(file_cachep, file);
+-
++		remove_event_file_dir(file);
+ 		/*
+ 		 * The do_for_each_event_file_safe() is
+ 		 * a double loop. After finding the call for this
+@@ -1720,16 +1735,47 @@ static void __trace_remove_event_call(struct ftrace_event_call *call)
+ 	destroy_preds(call);
+ }
+ 
++static int probe_remove_event_call(struct ftrace_event_call *call)
++{
++	struct trace_array *tr;
++	struct ftrace_event_file *file;
++
++#ifdef CONFIG_PERF_EVENTS
++	if (call->perf_refcount)
++		return -EBUSY;
++#endif
++	do_for_each_event_file(tr, file) {
++		if (file->event_call != call)
++			continue;
++		/*
++		 * We can't rely on ftrace_event_enable_disable(enable => 0)
++		 * we are going to do, FTRACE_EVENT_FL_SOFT_MODE can suppress
++		 * TRACE_REG_UNREGISTER.
++		 */
++		if (file->flags & FTRACE_EVENT_FL_ENABLED)
++			return -EBUSY;
++		break;
++	} while_for_each_event_file();
++
++	__trace_remove_event_call(call);
++
++	return 0;
++}
++
+ /* Remove an event_call */
+-void trace_remove_event_call(struct ftrace_event_call *call)
++int trace_remove_event_call(struct ftrace_event_call *call)
+ {
++	int ret;
++
+ 	mutex_lock(&trace_types_lock);
+ 	mutex_lock(&event_mutex);
+ 	down_write(&trace_event_sem);
+-	__trace_remove_event_call(call);
++	ret = probe_remove_event_call(call);
+ 	up_write(&trace_event_sem);
+ 	mutex_unlock(&event_mutex);
+ 	mutex_unlock(&trace_types_lock);
++
++	return ret;
+ }
+ 
+ #define for_each_event(event, start, end)			\
+@@ -2301,12 +2347,8 @@ __trace_remove_event_dirs(struct trace_array *tr)
+ {
+ 	struct ftrace_event_file *file, *next;
+ 
+-	list_for_each_entry_safe(file, next, &tr->events, list) {
+-		list_del(&file->list);
+-		debugfs_remove_recursive(file->dir);
+-		remove_subsystem(file->system);
+-		kmem_cache_free(file_cachep, file);
+-	}
++	list_for_each_entry_safe(file, next, &tr->events, list)
++		remove_event_file_dir(file);
+ }
+ 
+ static void
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index e1b653f..0a1edc6 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -631,17 +631,15 @@ static void append_filter_err(struct filter_parse_state *ps,
+ 	free_page((unsigned long) buf);
+ }
+ 
++/* caller must hold event_mutex */
+ void print_event_filter(struct ftrace_event_call *call, struct trace_seq *s)
+ {
+-	struct event_filter *filter;
++	struct event_filter *filter = call->filter;
+ 
+-	mutex_lock(&event_mutex);
+-	filter = call->filter;
+ 	if (filter && filter->filter_string)
+ 		trace_seq_printf(s, "%s\n", filter->filter_string);
+ 	else
+ 		trace_seq_printf(s, "none\n");
+-	mutex_unlock(&event_mutex);
+ }
+ 
+ void print_subsystem_event_filter(struct event_subsystem *system,
+@@ -1835,23 +1833,22 @@ static int create_system_filter(struct event_subsystem *system,
+ 	return err;
+ }
+ 
++/* caller must hold event_mutex */
+ int apply_event_filter(struct ftrace_event_call *call, char *filter_string)
+ {
+ 	struct event_filter *filter;
+-	int err = 0;
+-
+-	mutex_lock(&event_mutex);
++	int err;
+ 
+ 	if (!strcmp(strstrip(filter_string), "0")) {
+ 		filter_disable(call);
+ 		filter = call->filter;
+ 		if (!filter)
+-			goto out_unlock;
++			return 0;
+ 		RCU_INIT_POINTER(call->filter, NULL);
+ 		/* Make sure the filter is not being used */
+ 		synchronize_sched();
+ 		__free_filter(filter);
+-		goto out_unlock;
++		return 0;
+ 	}
+ 
+ 	err = create_filter(call, filter_string, true, &filter);
+@@ -1878,8 +1875,6 @@ int apply_event_filter(struct ftrace_event_call *call, char *filter_string)
+ 			__free_filter(tmp);
+ 		}
+ 	}
+-out_unlock:
+-	mutex_unlock(&event_mutex);
+ 
+ 	return err;
+ }
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index 9f46e98..64abc8c 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -90,7 +90,7 @@ static __kprobes bool trace_probe_is_on_module(struct trace_probe *tp)
+ }
+ 
+ static int register_probe_event(struct trace_probe *tp);
+-static void unregister_probe_event(struct trace_probe *tp);
++static int unregister_probe_event(struct trace_probe *tp);
+ 
+ static DEFINE_MUTEX(probe_lock);
+ static LIST_HEAD(probe_list);
+@@ -281,6 +281,8 @@ trace_probe_file_index(struct trace_probe *tp, struct ftrace_event_file *file)
+ static int
+ disable_trace_probe(struct trace_probe *tp, struct ftrace_event_file *file)
+ {
++	struct ftrace_event_file **old = NULL;
++	int wait = 0;
+ 	int ret = 0;
+ 
+ 	mutex_lock(&probe_enable_lock);
+@@ -314,10 +316,7 @@ disable_trace_probe(struct trace_probe *tp, struct ftrace_event_file *file)
+ 		}
+ 
+ 		rcu_assign_pointer(tp->files, new);
+-
+-		/* Make sure the probe is done with old files */
+-		synchronize_sched();
+-		kfree(old);
++		wait = 1;
+ 	} else
+ 		tp->flags &= ~TP_FLAG_PROFILE;
+ 
+@@ -326,11 +325,25 @@ disable_trace_probe(struct trace_probe *tp, struct ftrace_event_file *file)
+ 			disable_kretprobe(&tp->rp);
+ 		else
+ 			disable_kprobe(&tp->rp.kp);
++		wait = 1;
+ 	}
+ 
+  out_unlock:
+ 	mutex_unlock(&probe_enable_lock);
+ 
++	if (wait) {
++		/*
++		 * Synchronize with kprobe_trace_func/kretprobe_trace_func
++		 * to ensure disabled (all running handlers are finished).
++		 * This is not only for kfree(), but also the caller,
++		 * trace_remove_event_call() supposes it for releasing
++		 * event_call related objects, which will be accessed in
++		 * the kprobe_trace_func/kretprobe_trace_func.
++		 */
++		synchronize_sched();
++		kfree(old);	/* Ignored if link == NULL */
++	}
++
+ 	return ret;
+ }
+ 
+@@ -398,9 +411,12 @@ static int unregister_trace_probe(struct trace_probe *tp)
+ 	if (trace_probe_is_enabled(tp))
+ 		return -EBUSY;
+ 
++	/* Will fail if probe is being used by ftrace or perf */
++	if (unregister_probe_event(tp))
++		return -EBUSY;
++
+ 	__unregister_trace_probe(tp);
+ 	list_del(&tp->list);
+-	unregister_probe_event(tp);
+ 
+ 	return 0;
+ }
+@@ -679,7 +695,9 @@ static int release_all_trace_probes(void)
+ 	/* TODO: Use batch unregistration */
+ 	while (!list_empty(&probe_list)) {
+ 		tp = list_entry(probe_list.next, struct trace_probe, list);
+-		unregister_trace_probe(tp);
++		ret = unregister_trace_probe(tp);
++		if (ret)
++			goto end;
+ 		free_trace_probe(tp);
+ 	}
+ 
+@@ -1312,11 +1330,15 @@ static int register_probe_event(struct trace_probe *tp)
+ 	return ret;
+ }
+ 
+-static void unregister_probe_event(struct trace_probe *tp)
++static int unregister_probe_event(struct trace_probe *tp)
+ {
++	int ret;
++
+ 	/* tp->event is unregistered in trace_remove_event_call() */
+-	trace_remove_event_call(&tp->call);
+-	kfree(tp->call.print_fmt);
++	ret = trace_remove_event_call(&tp->call);
++	if (!ret)
++		kfree(tp->call.print_fmt);
++	return ret;
+ }
+ 
+ /* Make a debugfs interface for controlling probe points */
+diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
+index d5d0cd3..6fd72b7 100644
+--- a/kernel/trace/trace_uprobe.c
++++ b/kernel/trace/trace_uprobe.c
+@@ -70,7 +70,7 @@ struct trace_uprobe {
+ 	(sizeof(struct probe_arg) * (n)))
+ 
+ static int register_uprobe_event(struct trace_uprobe *tu);
+-static void unregister_uprobe_event(struct trace_uprobe *tu);
++static int unregister_uprobe_event(struct trace_uprobe *tu);
+ 
+ static DEFINE_MUTEX(uprobe_lock);
+ static LIST_HEAD(uprobe_list);
+@@ -164,11 +164,17 @@ static struct trace_uprobe *find_probe_event(const char *event, const char *grou
+ }
+ 
+ /* Unregister a trace_uprobe and probe_event: call with locking uprobe_lock */
+-static void unregister_trace_uprobe(struct trace_uprobe *tu)
++static int unregister_trace_uprobe(struct trace_uprobe *tu)
+ {
++	int ret;
++
++	ret = unregister_uprobe_event(tu);
++	if (ret)
++		return ret;
++
+ 	list_del(&tu->list);
+-	unregister_uprobe_event(tu);
+ 	free_trace_uprobe(tu);
++	return 0;
+ }
+ 
+ /* Register a trace_uprobe and probe_event */
+@@ -181,9 +187,12 @@ static int register_trace_uprobe(struct trace_uprobe *tu)
+ 
+ 	/* register as an event */
+ 	old_tp = find_probe_event(tu->call.name, tu->call.class->system);
+-	if (old_tp)
++	if (old_tp) {
+ 		/* delete old event */
+-		unregister_trace_uprobe(old_tp);
++		ret = unregister_trace_uprobe(old_tp);
++		if (ret)
++			goto end;
++	}
+ 
+ 	ret = register_uprobe_event(tu);
+ 	if (ret) {
+@@ -256,6 +265,8 @@ static int create_trace_uprobe(int argc, char **argv)
+ 		group = UPROBE_EVENT_SYSTEM;
+ 
+ 	if (is_delete) {
++		int ret;
++
+ 		if (!event) {
+ 			pr_info("Delete command needs an event name.\n");
+ 			return -EINVAL;
+@@ -269,9 +280,9 @@ static int create_trace_uprobe(int argc, char **argv)
+ 			return -ENOENT;
+ 		}
+ 		/* delete an event */
+-		unregister_trace_uprobe(tu);
++		ret = unregister_trace_uprobe(tu);
+ 		mutex_unlock(&uprobe_lock);
+-		return 0;
++		return ret;
+ 	}
+ 
+ 	if (argc < 2) {
+@@ -408,16 +419,20 @@ fail_address_parse:
+ 	return ret;
+ }
+ 
+-static void cleanup_all_probes(void)
++static int cleanup_all_probes(void)
+ {
+ 	struct trace_uprobe *tu;
++	int ret = 0;
+ 
+ 	mutex_lock(&uprobe_lock);
+ 	while (!list_empty(&uprobe_list)) {
+ 		tu = list_entry(uprobe_list.next, struct trace_uprobe, list);
+-		unregister_trace_uprobe(tu);
++		ret = unregister_trace_uprobe(tu);
++		if (ret)
++			break;
+ 	}
+ 	mutex_unlock(&uprobe_lock);
++	return ret;
+ }
+ 
+ /* Probes listing interfaces */
+@@ -462,8 +477,13 @@ static const struct seq_operations probes_seq_op = {
+ 
+ static int probes_open(struct inode *inode, struct file *file)
+ {
+-	if ((file->f_mode & FMODE_WRITE) && (file->f_flags & O_TRUNC))
+-		cleanup_all_probes();
++	int ret;
++
++	if ((file->f_mode & FMODE_WRITE) && (file->f_flags & O_TRUNC)) {
++		ret = cleanup_all_probes();
++		if (ret)
++			return ret;
++	}
+ 
+ 	return seq_open(file, &probes_seq_op);
+ }
+@@ -970,12 +990,17 @@ static int register_uprobe_event(struct trace_uprobe *tu)
+ 	return ret;
+ }
+ 
+-static void unregister_uprobe_event(struct trace_uprobe *tu)
++static int unregister_uprobe_event(struct trace_uprobe *tu)
+ {
++	int ret;
++
+ 	/* tu->event is unregistered in trace_remove_event_call() */
+-	trace_remove_event_call(&tu->call);
++	ret = trace_remove_event_call(&tu->call);
++	if (ret)
++		return ret;
+ 	kfree(tu->call.print_fmt);
+ 	tu->call.print_fmt = NULL;
++	return 0;
+ }
+ 
+ /* Make a trace interface for controling probe points */
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 55a42f9..5b4328d 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -31,10 +31,12 @@
+ #include "led.h"
+ 
+ #define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
++#define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
+ #define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
+ #define IEEE80211_AUTH_MAX_TRIES	3
+ #define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
+ #define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
++#define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
+ #define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
+ #define IEEE80211_ASSOC_MAX_TRIES	3
+ 
+@@ -3470,10 +3472,13 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
+ 
+ 	if (tx_flags == 0) {
+ 		auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+-		ifmgd->auth_data->timeout_started = true;
++		auth_data->timeout_started = true;
+ 		run_again(ifmgd, auth_data->timeout);
+ 	} else {
+-		auth_data->timeout_started = false;
++		auth_data->timeout =
++			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
++		auth_data->timeout_started = true;
++		run_again(ifmgd, auth_data->timeout);
+ 	}
+ 
+ 	return 0;
+@@ -3510,7 +3515,11 @@ static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
+ 		assoc_data->timeout_started = true;
+ 		run_again(&sdata->u.mgd, assoc_data->timeout);
+ 	} else {
+-		assoc_data->timeout_started = false;
++		assoc_data->timeout =
++			round_jiffies_up(jiffies +
++					 IEEE80211_ASSOC_TIMEOUT_LONG);
++		assoc_data->timeout_started = true;
++		run_again(&sdata->u.mgd, assoc_data->timeout);
+ 	}
+ 
+ 	return 0;
+diff --git a/net/nfc/llcp.h b/net/nfc/llcp.h
+index ff8c434..f924dd2 100644
+--- a/net/nfc/llcp.h
++++ b/net/nfc/llcp.h
+@@ -19,6 +19,7 @@
+ 
+ enum llcp_state {
+ 	LLCP_CONNECTED = 1, /* wait_for_packet() wants that */
++	LLCP_CONNECTING,
+ 	LLCP_CLOSED,
+ 	LLCP_BOUND,
+ 	LLCP_LISTEN,
+diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
+index 380253e..7522c37 100644
+--- a/net/nfc/llcp_sock.c
++++ b/net/nfc/llcp_sock.c
+@@ -571,7 +571,7 @@ static unsigned int llcp_sock_poll(struct file *file, struct socket *sock,
+ 	if (sk->sk_shutdown == SHUTDOWN_MASK)
+ 		mask |= POLLHUP;
+ 
+-	if (sock_writeable(sk))
++	if (sock_writeable(sk) && sk->sk_state == LLCP_CONNECTED)
+ 		mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
+ 	else
+ 		set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
+@@ -722,14 +722,16 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
+ 	if (ret)
+ 		goto sock_unlink;
+ 
++	sk->sk_state = LLCP_CONNECTING;
++
+ 	ret = sock_wait_state(sk, LLCP_CONNECTED,
+ 			      sock_sndtimeo(sk, flags & O_NONBLOCK));
+-	if (ret)
++	if (ret && ret != -EINPROGRESS)
+ 		goto sock_unlink;
+ 
+ 	release_sock(sk);
+ 
+-	return 0;
++	return ret;
+ 
+ sock_unlink:
+ 	nfc_llcp_put_ssap(local, llcp_sock->ssap);