Linux patch 4.1.184.1-23

2 files changed, 11811 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 8b9fa0f1..ed66531a 100644
--- a/0000_README
+++ b/0000_README
@@ -111,6 +111,10 @@ Patch:  1016_linux-4.1.17.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.1.17
 
+Patch:  1017_linux-4.1.18.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.1.18
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1017_linux-4.1.18.patch b/1017_linux-4.1.18.patch
new file mode 100644
index 00000000..ef682b72
--- /dev/null
+++ b/1017_linux-4.1.18.patch
@@ -0,0 +1,11807 @@
+diff --git a/Makefile b/Makefile
+index d398dd440bc9..001375cfd815 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 1
+-SUBLEVEL = 17
++SUBLEVEL = 18
+ EXTRAVERSION =
+ NAME = Series 4800
+ 
+diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
+index 0c12ffb155a2..f775d7161ffb 100644
+--- a/arch/arm/Kconfig.debug
++++ b/arch/arm/Kconfig.debug
+@@ -161,10 +161,9 @@ choice
+ 		  mobile SoCs in the Kona family of chips (e.g. bcm28155,
+ 		  bcm11351, etc...)
+ 
+-	config DEBUG_BCM63XX
++	config DEBUG_BCM63XX_UART
+ 		bool "Kernel low-level debugging on BCM63XX UART"
+ 		depends on ARCH_BCM_63XX
+-		select DEBUG_UART_BCM63XX
+ 
+ 	config DEBUG_BERLIN_UART
+ 		bool "Marvell Berlin SoC Debug UART"
+@@ -1304,7 +1303,7 @@ config DEBUG_LL_INCLUDE
+ 	default "debug/vf.S" if DEBUG_VF_UART
+ 	default "debug/vt8500.S" if DEBUG_VT8500_UART0
+ 	default "debug/zynq.S" if DEBUG_ZYNQ_UART0 || DEBUG_ZYNQ_UART1
+-	default "debug/bcm63xx.S" if DEBUG_UART_BCM63XX
++	default "debug/bcm63xx.S" if DEBUG_BCM63XX_UART
+ 	default "debug/digicolor.S" if DEBUG_DIGICOLOR_UA0
+ 	default "mach/debug-macro.S"
+ 
+@@ -1320,10 +1319,6 @@ config DEBUG_UART_8250
+ 		ARCH_IOP33X || ARCH_IXP4XX || \
+ 		ARCH_LPC32XX || ARCH_MV78XX0 || ARCH_ORION5X || ARCH_RPC
+ 
+-# Compatibility options for BCM63xx
+-config DEBUG_UART_BCM63XX
+-	def_bool ARCH_BCM_63XX
+-
+ config DEBUG_UART_PHYS
+ 	hex "Physical base address of debug UART"
+ 	default 0x00100a00 if DEBUG_NETX_UART
+@@ -1415,7 +1410,7 @@ config DEBUG_UART_PHYS
+ 	default 0xfffb0000 if DEBUG_OMAP1UART1 || DEBUG_OMAP7XXUART1
+ 	default 0xfffb0800 if DEBUG_OMAP1UART2 || DEBUG_OMAP7XXUART2
+ 	default 0xfffb9800 if DEBUG_OMAP1UART3 || DEBUG_OMAP7XXUART3
+-	default 0xfffe8600 if DEBUG_UART_BCM63XX
++	default 0xfffe8600 if DEBUG_BCM63XX_UART
+ 	default 0xfffff700 if ARCH_IOP33X
+ 	depends on ARCH_EP93XX || \
+ 	        DEBUG_LL_UART_8250 || DEBUG_LL_UART_PL01X || \
+@@ -1427,7 +1422,7 @@ config DEBUG_UART_PHYS
+ 		DEBUG_RCAR_GEN2_SCIF0 || DEBUG_RCAR_GEN2_SCIF2 || \
+ 		DEBUG_RMOBILE_SCIFA0 || DEBUG_RMOBILE_SCIFA1 || \
+ 		DEBUG_RMOBILE_SCIFA4 || DEBUG_S3C24XX_UART || \
+-		DEBUG_UART_BCM63XX || DEBUG_ASM9260_UART || \
++		DEBUG_BCM63XX_UART || DEBUG_ASM9260_UART || \
+ 		DEBUG_SIRFSOC_UART || DEBUG_DIGICOLOR_UA0
+ 
+ config DEBUG_UART_VIRT
+@@ -1466,7 +1461,7 @@ config DEBUG_UART_VIRT
+ 	default 0xfb009000 if DEBUG_REALVIEW_STD_PORT
+ 	default 0xfb10c000 if DEBUG_REALVIEW_PB1176_PORT
+ 	default 0xfc40ab00 if DEBUG_BRCMSTB_UART
+-	default 0xfcfe8600 if DEBUG_UART_BCM63XX
++	default 0xfcfe8600 if DEBUG_BCM63XX_UART
+ 	default 0xfd000000 if ARCH_SPEAR3XX || ARCH_SPEAR6XX
+ 	default 0xfd000000 if ARCH_SPEAR13XX
+ 	default 0xfd012000 if ARCH_MV78XX0
+@@ -1516,7 +1511,7 @@ config DEBUG_UART_VIRT
+ 		DEBUG_UART_8250 || DEBUG_UART_PL01X || DEBUG_MESON_UARTAO || \
+ 		DEBUG_NETX_UART || \
+ 		DEBUG_QCOM_UARTDM || DEBUG_S3C24XX_UART || \
+-		DEBUG_UART_BCM63XX || DEBUG_ASM9260_UART || \
++		DEBUG_BCM63XX_UART || DEBUG_ASM9260_UART || \
+ 		DEBUG_SIRFSOC_UART || DEBUG_DIGICOLOR_UA0
+ 
+ config DEBUG_UART_8250_SHIFT
+diff --git a/arch/arm/boot/dts/armada-388-gp.dts b/arch/arm/boot/dts/armada-388-gp.dts
+index 78514ab0b47a..757ac079e7f2 100644
+--- a/arch/arm/boot/dts/armada-388-gp.dts
++++ b/arch/arm/boot/dts/armada-388-gp.dts
+@@ -288,16 +288,6 @@
+ 		gpio = <&expander0 4 GPIO_ACTIVE_HIGH>;
+ 	};
+ 
+-	reg_usb2_1_vbus: v5-vbus1 {
+-		compatible = "regulator-fixed";
+-		regulator-name = "v5.0-vbus1";
+-		regulator-min-microvolt = <5000000>;
+-		regulator-max-microvolt = <5000000>;
+-		enable-active-high;
+-		regulator-always-on;
+-		gpio = <&expander0 4 GPIO_ACTIVE_HIGH>;
+-	};
+-
+ 	reg_sata0: pwr-sata0 {
+ 		compatible = "regulator-fixed";
+ 		regulator-name = "pwr_en_sata0";
+diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+index c740e1a2a3a5..4f29968076ce 100644
+--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+@@ -98,7 +98,7 @@
+ 
+ 				phy0: ethernet-phy@1 {
+ 					interrupt-parent = <&pioE>;
+-					interrupts = <1 IRQ_TYPE_EDGE_FALLING>;
++					interrupts = <1 IRQ_TYPE_LEVEL_LOW>;
+ 					reg = <1>;
+ 				};
+ 			};
+diff --git a/arch/arm/boot/dts/at91-sama5d4ek.dts b/arch/arm/boot/dts/at91-sama5d4ek.dts
+index 45e7761b7a29..d4d24a081404 100644
+--- a/arch/arm/boot/dts/at91-sama5d4ek.dts
++++ b/arch/arm/boot/dts/at91-sama5d4ek.dts
+@@ -141,8 +141,15 @@
+ 			};
+ 
+ 			macb0: ethernet@f8020000 {
++				pinctrl-0 = <&pinctrl_macb0_rmii &pinctrl_macb0_phy_irq>;
+ 				phy-mode = "rmii";
+ 				status = "okay";
++
++				ethernet-phy@1 {
++					reg = <0x1>;
++					interrupt-parent = <&pioE>;
++					interrupts = <1 IRQ_TYPE_LEVEL_LOW>;
++				};
+ 			};
+ 
+ 			mmc1: mmc@fc000000 {
+@@ -174,6 +181,10 @@
+ 
+ 			pinctrl@fc06a000 {
+ 				board {
++					pinctrl_macb0_phy_irq: macb0_phy_irq {
++						atmel,pins =
++							<AT91_PIOE 1 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
++					};
+ 					pinctrl_mmc0_cd: mmc0_cd {
+ 						atmel,pins =
+ 							<AT91_PIOE 5 AT91_PERIPH_GPIO AT91_PINCTRL_PULL_UP_DEGLITCH>;
+diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
+index 9cf0ab62db7d..cf11660f35a1 100644
+--- a/arch/arm/boot/dts/sama5d4.dtsi
++++ b/arch/arm/boot/dts/sama5d4.dtsi
+@@ -1219,7 +1219,7 @@
+ 			dbgu: serial@fc069000 {
+ 				compatible = "atmel,at91sam9260-dbgu", "atmel,at91sam9260-usart";
+ 				reg = <0xfc069000 0x200>;
+-				interrupts = <2 IRQ_TYPE_LEVEL_HIGH 7>;
++				interrupts = <45 IRQ_TYPE_LEVEL_HIGH 7>;
+ 				pinctrl-names = "default";
+ 				pinctrl-0 = <&pinctrl_dbgu>;
+ 				clocks = <&dbgu_clk>;
+diff --git a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
+index f182f6538e90..89ed9b45d533 100644
+--- a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
++++ b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
+@@ -122,22 +122,14 @@
+ 			};
+ 			mmcsd_default_mode: mmcsd_default {
+ 				mmcsd_default_cfg1 {
+-					/* MCCLK */
+-					pins = "GPIO8_B10";
+-					ste,output = <0>;
+-				};
+-				mmcsd_default_cfg2 {
+-					/* MCCMDDIR, MCDAT0DIR, MCDAT31DIR, MCDATDIR2 */
+-					pins = "GPIO10_C11", "GPIO15_A12",
+-					"GPIO16_C13", "GPIO23_D15";
+-					ste,output = <1>;
+-				};
+-				mmcsd_default_cfg3 {
+-					/* MCCMD, MCDAT3-0, MCMSFBCLK */
+-					pins = "GPIO9_A10", "GPIO11_B11",
+-					"GPIO12_A11", "GPIO13_C12",
+-					"GPIO14_B12", "GPIO24_C15";
+-					ste,input = <1>;
++					/*
++					 * MCCLK, MCCMDDIR, MCDAT0DIR, MCDAT31DIR, MCDATDIR2
++					 * MCCMD, MCDAT3-0, MCMSFBCLK
++					 */
++					pins = "GPIO8_B10", "GPIO9_A10", "GPIO10_C11", "GPIO11_B11",
++					       "GPIO12_A11", "GPIO13_C12", "GPIO14_B12", "GPIO15_A12",
++					       "GPIO16_C13", "GPIO23_D15", "GPIO24_C15";
++					ste,output = <2>;
+ 				};
+ 			};
+ 		};
+@@ -802,10 +794,21 @@
+ 			clock-names = "mclk", "apb_pclk";
+ 			interrupt-parent = <&vica>;
+ 			interrupts = <22>;
+-			max-frequency = <48000000>;
++			max-frequency = <400000>;
+ 			bus-width = <4>;
+ 			cap-mmc-highspeed;
+ 			cap-sd-highspeed;
++			full-pwr-cycle;
++			/*
++			 * The STw4811 circuit used with the Nomadik strictly
++			 * requires that all of these signal direction pins be
++			 * routed and used for its 4-bit levelshifter.
++			 */
++			st,sig-dir-dat0;
++			st,sig-dir-dat2;
++			st,sig-dir-dat31;
++			st,sig-dir-cmd;
++			st,sig-pin-fbclk;
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&mmcsd_default_mux>, <&mmcsd_default_mode>;
+ 			vmmc-supply = <&vmmc_regulator>;
+diff --git a/arch/arm/mach-omap2/sleep34xx.S b/arch/arm/mach-omap2/sleep34xx.S
+index eafd120b53f1..8e2a7acb823b 100644
+--- a/arch/arm/mach-omap2/sleep34xx.S
++++ b/arch/arm/mach-omap2/sleep34xx.S
+@@ -86,13 +86,18 @@ ENTRY(enable_omap3630_toggle_l2_on_restore)
+ 	stmfd	sp!, {lr}	@ save registers on stack
+ 	/* Setup so that we will disable and enable l2 */
+ 	mov	r1, #0x1
+-	adrl	r2, l2dis_3630	@ may be too distant for plain adr
+-	str	r1, [r2]
++	adrl	r3, l2dis_3630_offset	@ may be too distant for plain adr
++	ldr	r2, [r3]		@ value for offset
++	str	r1, [r2, r3]		@ write to l2dis_3630
+ 	ldmfd	sp!, {pc}	@ restore regs and return
+ ENDPROC(enable_omap3630_toggle_l2_on_restore)
+ 
+-	.text
+-/* Function to call rom code to save secure ram context */
++/*
++ * Function to call rom code to save secure ram context. This gets
++ * relocated to SRAM, so it can be all in .data section. Otherwise
++ * we need to initialize api_params separately.
++ */
++	.data
+ 	.align	3
+ ENTRY(save_secure_ram_context)
+ 	stmfd	sp!, {r4 - r11, lr}	@ save registers on stack
+@@ -126,6 +131,8 @@ ENDPROC(save_secure_ram_context)
+ ENTRY(save_secure_ram_context_sz)
+ 	.word	. - save_secure_ram_context
+ 
++	.text
++
+ /*
+  * ======================
+  * == Idle entry point ==
+@@ -289,12 +296,6 @@ wait_sdrc_ready:
+ 	bic	r5, r5, #0x40
+ 	str	r5, [r4]
+ 
+-/*
+- * PC-relative stores lead to undefined behaviour in Thumb-2: use a r7 as a
+- * base instead.
+- * Be careful not to clobber r7 when maintaing this code.
+- */
+-
+ is_dll_in_lock_mode:
+ 	/* Is dll in lock mode? */
+ 	ldr	r4, sdrc_dlla_ctrl
+@@ -302,11 +303,7 @@ is_dll_in_lock_mode:
+ 	tst	r5, #0x4
+ 	bne	exit_nonoff_modes	@ Return if locked
+ 	/* wait till dll locks */
+-	adr	r7, kick_counter
+ wait_dll_lock_timed:
+-	ldr	r4, wait_dll_lock_counter
+-	add	r4, r4, #1
+-	str	r4, [r7, #wait_dll_lock_counter - kick_counter]
+ 	ldr	r4, sdrc_dlla_status
+ 	/* Wait 20uS for lock */
+ 	mov	r6, #8
+@@ -330,9 +327,6 @@ kick_dll:
+ 	orr	r6, r6, #(1<<3)		@ enable dll
+ 	str	r6, [r4]
+ 	dsb
+-	ldr	r4, kick_counter
+-	add	r4, r4, #1
+-	str	r4, [r7]		@ kick_counter
+ 	b	wait_dll_lock_timed
+ 
+ exit_nonoff_modes:
+@@ -360,15 +354,6 @@ sdrc_dlla_status:
+ 	.word	SDRC_DLLA_STATUS_V
+ sdrc_dlla_ctrl:
+ 	.word	SDRC_DLLA_CTRL_V
+-	/*
+-	 * When exporting to userspace while the counters are in SRAM,
+-	 * these 2 words need to be at the end to facilitate retrival!
+-	 */
+-kick_counter:
+-	.word	0
+-wait_dll_lock_counter:
+-	.word	0
+-
+ ENTRY(omap3_do_wfi_sz)
+ 	.word	. - omap3_do_wfi
+ 
+@@ -437,7 +422,9 @@ ENTRY(omap3_restore)
+ 	cmp	r2, #0x0	@ Check if target power state was OFF or RET
+ 	bne	logic_l1_restore
+ 
+-	ldr	r0, l2dis_3630
++	adr	r1, l2dis_3630_offset	@ address for offset
++	ldr	r0, [r1]		@ value for offset
++	ldr	r0, [r1, r0]		@ value at l2dis_3630
+ 	cmp	r0, #0x1	@ should we disable L2 on 3630?
+ 	bne	skipl2dis
+ 	mrc	p15, 0, r0, c1, c0, 1
+@@ -506,7 +493,9 @@ l2_inv_gp:
+ 	mov	r12, #0x2
+ 	smc	#0			@ Call SMI monitor (smieq)
+ logic_l1_restore:
+-	ldr	r1, l2dis_3630
++	adr	r0, l2dis_3630_offset	@ adress for offset
++	ldr	r1, [r0]		@ value for offset
++	ldr	r1, [r0, r1]		@ value at l2dis_3630
+ 	cmp	r1, #0x1		@ Test if L2 re-enable needed on 3630
+ 	bne	skipl2reen
+ 	mrc	p15, 0, r1, c1, c0, 1
+@@ -535,6 +524,10 @@ control_stat:
+ 	.word	CONTROL_STAT
+ control_mem_rta:
+ 	.word	CONTROL_MEM_RTA_CTRL
++l2dis_3630_offset:
++	.long	l2dis_3630 - .
++
++	.data
+ l2dis_3630:
+ 	.word	0
+ 
+diff --git a/arch/arm/mach-omap2/sleep44xx.S b/arch/arm/mach-omap2/sleep44xx.S
+index ad1bb9431e94..5373a3281779 100644
+--- a/arch/arm/mach-omap2/sleep44xx.S
++++ b/arch/arm/mach-omap2/sleep44xx.S
+@@ -29,12 +29,6 @@
+ 	dsb
+ .endm
+ 
+-ppa_zero_params:
+-	.word		0x0
+-
+-ppa_por_params:
+-	.word		1, 0
+-
+ #ifdef CONFIG_ARCH_OMAP4
+ 
+ /*
+@@ -266,7 +260,9 @@ ENTRY(omap4_cpu_resume)
+ 	beq	skip_ns_smp_enable
+ ppa_actrl_retry:
+ 	mov     r0, #OMAP4_PPA_CPU_ACTRL_SMP_INDEX
+-	adr	r3, ppa_zero_params		@ Pointer to parameters
++	adr	r1, ppa_zero_params_offset
++	ldr	r3, [r1]
++	add	r3, r3, r1			@ Pointer to ppa_zero_params
+ 	mov	r1, #0x0			@ Process ID
+ 	mov	r2, #0x4			@ Flag
+ 	mov	r6, #0xff
+@@ -303,7 +299,9 @@ skip_ns_smp_enable:
+ 	ldr     r0, =OMAP4_PPA_L2_POR_INDEX
+ 	ldr     r1, =OMAP44XX_SAR_RAM_BASE
+ 	ldr     r4, [r1, #L2X0_PREFETCH_CTRL_OFFSET]
+-	adr     r3, ppa_por_params
++	adr     r1, ppa_por_params_offset
++	ldr	r3, [r1]
++	add	r3, r3, r1			@ Pointer to ppa_por_params
+ 	str     r4, [r3, #0x04]
+ 	mov	r1, #0x0			@ Process ID
+ 	mov	r2, #0x4			@ Flag
+@@ -328,6 +326,8 @@ skip_l2en:
+ #endif
+ 
+ 	b	cpu_resume			@ Jump to generic resume
++ppa_por_params_offset:
++	.long	ppa_por_params - .
+ ENDPROC(omap4_cpu_resume)
+ #endif	/* CONFIG_ARCH_OMAP4 */
+ 
+@@ -382,4 +382,13 @@ ENTRY(omap_do_wfi)
+ 	nop
+ 
+ 	ldmfd	sp!, {pc}
++ppa_zero_params_offset:
++	.long	ppa_zero_params - .
+ ENDPROC(omap_do_wfi)
++
++	.data
++ppa_zero_params:
++	.word		0
++
++ppa_por_params:
++	.word		1, 0
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index 36aa31ff2c06..cc7435c9676e 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -566,9 +566,14 @@ CPU_LE(	movk	x0, #0x30d0, lsl #16	)	// Clear EE and E0E on LE systems
+ #endif
+ 
+ 	/* EL2 debug */
++	mrs	x0, id_aa64dfr0_el1		// Check ID_AA64DFR0_EL1 PMUVer
++	sbfx	x0, x0, #8, #4
++	cmp	x0, #1
++	b.lt	4f				// Skip if no PMU present
+ 	mrs	x0, pmcr_el0			// Disable debug access traps
+ 	ubfx	x0, x0, #11, #5			// to EL2 and allow access to
+ 	msr	mdcr_el2, x0			// all PMU counters from EL1
++4:
+ 
+ 	/* Stage-2 translation */
+ 	msr	vttbr_el2, xzr
+diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
+index 7778453762d8..b67b01cb5109 100644
+--- a/arch/arm64/kernel/perf_event.c
++++ b/arch/arm64/kernel/perf_event.c
+@@ -1242,9 +1242,6 @@ static void armv8pmu_reset(void *info)
+ 
+ 	/* Initialize & Reset PMNC: C and P bits. */
+ 	armv8pmu_pmcr_write(ARMV8_PMCR_P | ARMV8_PMCR_C);
+-
+-	/* Disable access from userspace. */
+-	asm volatile("msr pmuserenr_el0, %0" :: "r" (0));
+ }
+ 
+ static int armv8_pmuv3_map_event(struct perf_event *event)
+diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
+index e47ed1c5dce1..545710f854f8 100644
+--- a/arch/arm64/mm/pageattr.c
++++ b/arch/arm64/mm/pageattr.c
+@@ -57,6 +57,9 @@ static int change_memory_common(unsigned long addr, int numpages,
+ 	if (end < MODULES_VADDR || end >= MODULES_END)
+ 		return -EINVAL;
+ 
++	if (!numpages)
++		return 0;
++
+ 	data.set_mask = set_mask;
+ 	data.clear_mask = clear_mask;
+ 
+diff --git a/arch/arm64/mm/proc-macros.S b/arch/arm64/mm/proc-macros.S
+index 4c4d93c4bf65..d69dffffaa89 100644
+--- a/arch/arm64/mm/proc-macros.S
++++ b/arch/arm64/mm/proc-macros.S
+@@ -62,3 +62,15 @@
+ 	bfi	\valreg, \tmpreg, #TCR_T0SZ_OFFSET, #TCR_TxSZ_WIDTH
+ #endif
+ 	.endm
++
++/*
++ * reset_pmuserenr_el0 - reset PMUSERENR_EL0 if PMUv3 present
++ */
++	.macro	reset_pmuserenr_el0, tmpreg
++	mrs	\tmpreg, id_aa64dfr0_el1	// Check ID_AA64DFR0_EL1 PMUVer
++	sbfx	\tmpreg, \tmpreg, #8, #4
++	cmp	\tmpreg, #1			// Skip if no PMU present
++	b.lt	9000f
++	msr	pmuserenr_el0, xzr		// Disable PMU access from EL0
++9000:
++	.endm
+diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
+index cdd754e19b9b..d253908a988d 100644
+--- a/arch/arm64/mm/proc.S
++++ b/arch/arm64/mm/proc.S
+@@ -165,6 +165,7 @@ ENTRY(cpu_do_resume)
+ 	 */
+ 	ubfx	x11, x11, #1, #1
+ 	msr	oslar_el1, x11
++	reset_pmuserenr_el0 x0			// Disable PMU access from EL0
+ 	mov	x0, x12
+ 	dsb	nsh		// Make sure local tlb invalidation completed
+ 	isb
+@@ -202,7 +203,9 @@ ENTRY(__cpu_setup)
+ 
+ 	mov	x0, #3 << 20
+ 	msr	cpacr_el1, x0			// Enable FP/ASIMD
+-	msr	mdscr_el1, xzr			// Reset mdscr_el1
++	mov	x0, #1 << 12			// Reset mdscr_el1 and disable
++	msr	mdscr_el1, x0			// access to the DCC from EL0
++	reset_pmuserenr_el0 x0			// Disable PMU access from EL0
+ 	/*
+ 	 * Memory region attributes for LPAE:
+ 	 *
+diff --git a/arch/m32r/kernel/setup.c b/arch/m32r/kernel/setup.c
+index 0392112a5d70..a5ecef7188ba 100644
+--- a/arch/m32r/kernel/setup.c
++++ b/arch/m32r/kernel/setup.c
+@@ -81,7 +81,10 @@ static struct resource code_resource = {
+ };
+ 
+ unsigned long memory_start;
++EXPORT_SYMBOL(memory_start);
++
+ unsigned long memory_end;
++EXPORT_SYMBOL(memory_end);
+ 
+ void __init setup_arch(char **);
+ int get_cpuinfo(char *);
+diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
+index 70f6e7f073b0..7fe24aef7fdc 100644
+--- a/arch/mips/include/asm/pgtable.h
++++ b/arch/mips/include/asm/pgtable.h
+@@ -353,7 +353,7 @@ static inline pte_t pte_mkdirty(pte_t pte)
+ static inline pte_t pte_mkyoung(pte_t pte)
+ {
+ 	pte_val(pte) |= _PAGE_ACCESSED;
+-#ifdef CONFIG_CPU_MIPSR2
++#if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6)
+ 	if (!(pte_val(pte) & _PAGE_NO_READ))
+ 		pte_val(pte) |= _PAGE_SILENT_READ;
+ 	else
+@@ -558,7 +558,7 @@ static inline pmd_t pmd_mkyoung(pmd_t pmd)
+ {
+ 	pmd_val(pmd) |= _PAGE_ACCESSED;
+ 
+-#ifdef CONFIG_CPU_MIPSR2
++#if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6)
+ 	if (!(pmd_val(pmd) & _PAGE_NO_READ))
+ 		pmd_val(pmd) |= _PAGE_SILENT_READ;
+ 	else
+diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
+index 97c87027c17f..90b0e8316790 100644
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -242,7 +242,7 @@ static void output_pgtable_bits_defines(void)
+ 	pr_define("_PAGE_HUGE_SHIFT %d\n", _PAGE_HUGE_SHIFT);
+ 	pr_define("_PAGE_SPLITTING_SHIFT %d\n", _PAGE_SPLITTING_SHIFT);
+ #endif
+-#ifdef CONFIG_CPU_MIPSR2
++#if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6)
+ 	if (cpu_has_rixi) {
+ #ifdef _PAGE_NO_EXEC_SHIFT
+ 		pr_define("_PAGE_NO_EXEC_SHIFT %d\n", _PAGE_NO_EXEC_SHIFT);
+diff --git a/arch/parisc/include/uapi/asm/siginfo.h b/arch/parisc/include/uapi/asm/siginfo.h
+index d7034728f377..1c75565d984b 100644
+--- a/arch/parisc/include/uapi/asm/siginfo.h
++++ b/arch/parisc/include/uapi/asm/siginfo.h
+@@ -1,6 +1,10 @@
+ #ifndef _PARISC_SIGINFO_H
+ #define _PARISC_SIGINFO_H
+ 
++#if defined(__LP64__)
++#define __ARCH_SI_PREAMBLE_SIZE   (4 * sizeof(int))
++#endif
++
+ #include <asm-generic/siginfo.h>
+ 
+ #undef NSIGTRAP
+diff --git a/arch/powerpc/kernel/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c
+index 35f0b62259bb..22f6d954ef89 100644
+--- a/arch/powerpc/kernel/eeh_pe.c
++++ b/arch/powerpc/kernel/eeh_pe.c
+@@ -861,32 +861,29 @@ void eeh_pe_restore_bars(struct eeh_pe *pe)
+ const char *eeh_pe_loc_get(struct eeh_pe *pe)
+ {
+ 	struct pci_bus *bus = eeh_pe_bus_get(pe);
+-	struct device_node *dn = pci_bus_to_OF_node(bus);
++	struct device_node *dn;
+ 	const char *loc = NULL;
+ 
+-	if (!dn)
+-		goto out;
++	while (bus) {
++		dn = pci_bus_to_OF_node(bus);
++		if (!dn) {
++			bus = bus->parent;
++			continue;
++		}
+ 
+-	/* PHB PE or root PE ? */
+-	if (pci_is_root_bus(bus)) {
+-		loc = of_get_property(dn, "ibm,loc-code", NULL);
+-		if (!loc)
++		if (pci_is_root_bus(bus))
+ 			loc = of_get_property(dn, "ibm,io-base-loc-code", NULL);
++		else
++			loc = of_get_property(dn, "ibm,slot-location-code",
++					      NULL);
++
+ 		if (loc)
+-			goto out;
++			return loc;
+ 
+-		/* Check the root port */
+-		dn = dn->child;
+-		if (!dn)
+-			goto out;
++		bus = bus->parent;
+ 	}
+ 
+-	loc = of_get_property(dn, "ibm,loc-code", NULL);
+-	if (!loc)
+-		loc = of_get_property(dn, "ibm,slot-location-code", NULL);
+-
+-out:
+-	return loc ? loc : "N/A";
++	return "N/A";
+ }
+ 
+ /**
+diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+index ffd98b2bfa16..f8338e6d3dd7 100644
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -2047,7 +2047,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
+ 
+ 	/* Emulate H_SET_DABR/X on P8 for the sake of compat mode guests */
+ 2:	rlwimi	r5, r4, 5, DAWRX_DR | DAWRX_DW
+-	rlwimi	r5, r4, 1, DAWRX_WT
++	rlwimi	r5, r4, 2, DAWRX_WT
+ 	clrrdi	r4, r4, 3
+ 	std	r4, VCPU_DAWR(r3)
+ 	std	r5, VCPU_DAWRX(r3)
+diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
+index ac3ddf115f3d..c8fe9ab10792 100644
+--- a/arch/powerpc/kvm/powerpc.c
++++ b/arch/powerpc/kvm/powerpc.c
+@@ -915,21 +915,17 @@ int kvm_vcpu_ioctl_get_one_reg(struct kvm_vcpu *vcpu, struct kvm_one_reg *reg)
+ 				r = -ENXIO;
+ 				break;
+ 			}
+-			vcpu->arch.vr.vr[reg->id - KVM_REG_PPC_VR0] = val.vval;
++			val.vval = vcpu->arch.vr.vr[reg->id - KVM_REG_PPC_VR0];
+ 			break;
+ 		case KVM_REG_PPC_VSCR:
+ 			if (!cpu_has_feature(CPU_FTR_ALTIVEC)) {
+ 				r = -ENXIO;
+ 				break;
+ 			}
+-			vcpu->arch.vr.vscr.u[3] = set_reg_val(reg->id, val);
++			val = get_reg_val(reg->id, vcpu->arch.vr.vscr.u[3]);
+ 			break;
+ 		case KVM_REG_PPC_VRSAVE:
+-			if (!cpu_has_feature(CPU_FTR_ALTIVEC)) {
+-				r = -ENXIO;
+-				break;
+-			}
+-			vcpu->arch.vrsave = set_reg_val(reg->id, val);
++			val = get_reg_val(reg->id, vcpu->arch.vrsave);
+ 			break;
+ #endif /* CONFIG_ALTIVEC */
+ 		default:
+@@ -970,17 +966,21 @@ int kvm_vcpu_ioctl_set_one_reg(struct kvm_vcpu *vcpu, struct kvm_one_reg *reg)
+ 				r = -ENXIO;
+ 				break;
+ 			}
+-			val.vval = vcpu->arch.vr.vr[reg->id - KVM_REG_PPC_VR0];
++			vcpu->arch.vr.vr[reg->id - KVM_REG_PPC_VR0] = val.vval;
+ 			break;
+ 		case KVM_REG_PPC_VSCR:
+ 			if (!cpu_has_feature(CPU_FTR_ALTIVEC)) {
+ 				r = -ENXIO;
+ 				break;
+ 			}
+-			val = get_reg_val(reg->id, vcpu->arch.vr.vscr.u[3]);
++			vcpu->arch.vr.vscr.u[3] = set_reg_val(reg->id, val);
+ 			break;
+ 		case KVM_REG_PPC_VRSAVE:
+-			val = get_reg_val(reg->id, vcpu->arch.vrsave);
++			if (!cpu_has_feature(CPU_FTR_ALTIVEC)) {
++				r = -ENXIO;
++				break;
++			}
++			vcpu->arch.vrsave = set_reg_val(reg->id, val);
+ 			break;
+ #endif /* CONFIG_ALTIVEC */
+ 		default:
+diff --git a/arch/s390/mm/extable.c b/arch/s390/mm/extable.c
+index 4d1ee88864e8..18c8b819b0aa 100644
+--- a/arch/s390/mm/extable.c
++++ b/arch/s390/mm/extable.c
+@@ -52,12 +52,16 @@ void sort_extable(struct exception_table_entry *start,
+ 	int i;
+ 
+ 	/* Normalize entries to being relative to the start of the section */
+-	for (p = start, i = 0; p < finish; p++, i += 8)
++	for (p = start, i = 0; p < finish; p++, i += 8) {
+ 		p->insn += i;
++		p->fixup += i + 4;
++	}
+ 	sort(start, finish - start, sizeof(*start), cmp_ex, NULL);
+ 	/* Denormalize all entries */
+-	for (p = start, i = 0; p < finish; p++, i += 8)
++	for (p = start, i = 0; p < finish; p++, i += 8) {
+ 		p->insn -= i;
++		p->fixup -= i + 4;
++	}
+ }
+ 
+ #ifdef CONFIG_MODULES
+diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
+index 30e7ddb27a3a..c690c8e16a96 100644
+--- a/arch/sparc/kernel/sys_sparc_64.c
++++ b/arch/sparc/kernel/sys_sparc_64.c
+@@ -413,7 +413,7 @@ out:
+ 
+ SYSCALL_DEFINE1(sparc64_personality, unsigned long, personality)
+ {
+-	int ret;
++	long ret;
+ 
+ 	if (personality(current->personality) == PER_LINUX32 &&
+ 	    personality(personality) == PER_LINUX)
+diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c
+index 47f1ff056a54..22a358ef1b0c 100644
+--- a/arch/um/os-Linux/start_up.c
++++ b/arch/um/os-Linux/start_up.c
+@@ -94,6 +94,8 @@ static int start_ptraced_child(void)
+ {
+ 	int pid, n, status;
+ 
++	fflush(stdout);
++
+ 	pid = fork();
+ 	if (pid == 0)
+ 		ptrace_child();
+diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
+index 78f0c8cbe316..74fcdf3f1534 100644
+--- a/arch/x86/include/asm/pgtable_types.h
++++ b/arch/x86/include/asm/pgtable_types.h
+@@ -337,20 +337,18 @@ static inline enum page_cache_mode pgprot2cachemode(pgprot_t pgprot)
+ }
+ static inline pgprot_t pgprot_4k_2_large(pgprot_t pgprot)
+ {
++	pgprotval_t val = pgprot_val(pgprot);
+ 	pgprot_t new;
+-	unsigned long val;
+ 
+-	val = pgprot_val(pgprot);
+ 	pgprot_val(new) = (val & ~(_PAGE_PAT | _PAGE_PAT_LARGE)) |
+ 		((val & _PAGE_PAT) << (_PAGE_BIT_PAT_LARGE - _PAGE_BIT_PAT));
+ 	return new;
+ }
+ static inline pgprot_t pgprot_large_2_4k(pgprot_t pgprot)
+ {
++	pgprotval_t val = pgprot_val(pgprot);
+ 	pgprot_t new;
+-	unsigned long val;
+ 
+-	val = pgprot_val(pgprot);
+ 	pgprot_val(new) = (val & ~(_PAGE_PAT | _PAGE_PAT_LARGE)) |
+ 			  ((val & _PAGE_PAT_LARGE) >>
+ 			   (_PAGE_BIT_PAT_LARGE - _PAGE_BIT_PAT));
+diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
+index 89af288ec674..2dd9b3ad3bb5 100644
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -33,7 +33,7 @@ struct cpa_data {
+ 	pgd_t		*pgd;
+ 	pgprot_t	mask_set;
+ 	pgprot_t	mask_clr;
+-	int		numpages;
++	unsigned long	numpages;
+ 	int		flags;
+ 	unsigned long	pfn;
+ 	unsigned	force_split : 1;
+@@ -1324,7 +1324,7 @@ static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias)
+ 		 * CPA operation. Either a large page has been
+ 		 * preserved or a single page update happened.
+ 		 */
+-		BUG_ON(cpa->numpages > numpages);
++		BUG_ON(cpa->numpages > numpages || !cpa->numpages);
+ 		numpages -= cpa->numpages;
+ 		if (cpa->flags & (CPA_PAGES_ARRAY | CPA_ARRAY))
+ 			cpa->curpage++;
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index f22cc56fd1b3..9641b74b53ef 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -76,6 +76,8 @@ int af_alg_register_type(const struct af_alg_type *type)
+ 		goto unlock;
+ 
+ 	type->ops->owner = THIS_MODULE;
++	if (type->ops_nokey)
++		type->ops_nokey->owner = THIS_MODULE;
+ 	node->type = type;
+ 	list_add(&node->list, &alg_types);
+ 	err = 0;
+@@ -125,6 +127,26 @@ int af_alg_release(struct socket *sock)
+ }
+ EXPORT_SYMBOL_GPL(af_alg_release);
+ 
++void af_alg_release_parent(struct sock *sk)
++{
++	struct alg_sock *ask = alg_sk(sk);
++	unsigned int nokey = ask->nokey_refcnt;
++	bool last = nokey && !ask->refcnt;
++
++	sk = ask->parent;
++	ask = alg_sk(sk);
++
++	lock_sock(sk);
++	ask->nokey_refcnt -= nokey;
++	if (!last)
++		last = !--ask->refcnt;
++	release_sock(sk);
++
++	if (last)
++		sock_put(sk);
++}
++EXPORT_SYMBOL_GPL(af_alg_release_parent);
++
+ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ {
+ 	struct sock *sk = sock->sk;
+@@ -132,6 +154,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ 	struct sockaddr_alg *sa = (void *)uaddr;
+ 	const struct af_alg_type *type;
+ 	void *private;
++	int err;
+ 
+ 	if (sock->state == SS_CONNECTED)
+ 		return -EINVAL;
+@@ -157,16 +180,22 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ 		return PTR_ERR(private);
+ 	}
+ 
++	err = -EBUSY;
+ 	lock_sock(sk);
++	if (ask->refcnt | ask->nokey_refcnt)
++		goto unlock;
+ 
+ 	swap(ask->type, type);
+ 	swap(ask->private, private);
+ 
++	err = 0;
++
++unlock:
+ 	release_sock(sk);
+ 
+ 	alg_do_release(type, private);
+ 
+-	return 0;
++	return err;
+ }
+ 
+ static int alg_setkey(struct sock *sk, char __user *ukey,
+@@ -199,11 +228,15 @@ static int alg_setsockopt(struct socket *sock, int level, int optname,
+ 	struct sock *sk = sock->sk;
+ 	struct alg_sock *ask = alg_sk(sk);
+ 	const struct af_alg_type *type;
+-	int err = -ENOPROTOOPT;
++	int err = -EBUSY;
+ 
+ 	lock_sock(sk);
++	if (ask->refcnt)
++		goto unlock;
++
+ 	type = ask->type;
+ 
++	err = -ENOPROTOOPT;
+ 	if (level != SOL_ALG || !type)
+ 		goto unlock;
+ 
+@@ -235,6 +268,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
+ 	struct alg_sock *ask = alg_sk(sk);
+ 	const struct af_alg_type *type;
+ 	struct sock *sk2;
++	unsigned int nokey;
+ 	int err;
+ 
+ 	lock_sock(sk);
+@@ -254,20 +288,29 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
+ 	security_sk_clone(sk, sk2);
+ 
+ 	err = type->accept(ask->private, sk2);
+-	if (err) {
+-		sk_free(sk2);
++
++	nokey = err == -ENOKEY;
++	if (nokey && type->accept_nokey)
++		err = type->accept_nokey(ask->private, sk2);
++
++	if (err)
+ 		goto unlock;
+-	}
+ 
+ 	sk2->sk_family = PF_ALG;
+ 
+-	sock_hold(sk);
++	if (nokey || !ask->refcnt++)
++		sock_hold(sk);
++	ask->nokey_refcnt += nokey;
+ 	alg_sk(sk2)->parent = sk;
+ 	alg_sk(sk2)->type = type;
++	alg_sk(sk2)->nokey_refcnt = nokey;
+ 
+ 	newsock->ops = type->ops;
+ 	newsock->state = SS_CONNECTED;
+ 
++	if (nokey)
++		newsock->ops = type->ops_nokey;
++
+ 	err = 0;
+ 
+ unlock:
+diff --git a/crypto/ahash.c b/crypto/ahash.c
+index 9c1dc8d6106a..d19b52324cf5 100644
+--- a/crypto/ahash.c
++++ b/crypto/ahash.c
+@@ -451,6 +451,7 @@ static int crypto_ahash_init_tfm(struct crypto_tfm *tfm)
+ 	struct ahash_alg *alg = crypto_ahash_alg(hash);
+ 
+ 	hash->setkey = ahash_nosetkey;
++	hash->has_setkey = false;
+ 	hash->export = ahash_no_export;
+ 	hash->import = ahash_no_import;
+ 
+@@ -463,8 +464,10 @@ static int crypto_ahash_init_tfm(struct crypto_tfm *tfm)
+ 	hash->finup = alg->finup ?: ahash_def_finup;
+ 	hash->digest = alg->digest;
+ 
+-	if (alg->setkey)
++	if (alg->setkey) {
+ 		hash->setkey = alg->setkey;
++		hash->has_setkey = true;
++	}
+ 	if (alg->export)
+ 		hash->export = alg->export;
+ 	if (alg->import)
+diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
+index 1396ad0787fc..d7a3435280d8 100644
+--- a/crypto/algif_hash.c
++++ b/crypto/algif_hash.c
+@@ -34,6 +34,11 @@ struct hash_ctx {
+ 	struct ahash_request req;
+ };
+ 
++struct algif_hash_tfm {
++	struct crypto_ahash *hash;
++	bool has_key;
++};
++
+ static int hash_sendmsg(struct socket *sock, struct msghdr *msg,
+ 			size_t ignored)
+ {
+@@ -49,7 +54,8 @@ static int hash_sendmsg(struct socket *sock, struct msghdr *msg,
+ 
+ 	lock_sock(sk);
+ 	if (!ctx->more) {
+-		err = crypto_ahash_init(&ctx->req);
++		err = af_alg_wait_for_completion(crypto_ahash_init(&ctx->req),
++						&ctx->completion);
+ 		if (err)
+ 			goto unlock;
+ 	}
+@@ -120,6 +126,7 @@ static ssize_t hash_sendpage(struct socket *sock, struct page *page,
+ 	} else {
+ 		if (!ctx->more) {
+ 			err = crypto_ahash_init(&ctx->req);
++			err = af_alg_wait_for_completion(err, &ctx->completion);
+ 			if (err)
+ 				goto unlock;
+ 		}
+@@ -227,19 +234,151 @@ static struct proto_ops algif_hash_ops = {
+ 	.accept		=	hash_accept,
+ };
+ 
++static int hash_check_key(struct socket *sock)
++{
++	int err = 0;
++	struct sock *psk;
++	struct alg_sock *pask;
++	struct algif_hash_tfm *tfm;
++	struct sock *sk = sock->sk;
++	struct alg_sock *ask = alg_sk(sk);
++
++	lock_sock(sk);
++	if (ask->refcnt)
++		goto unlock_child;
++
++	psk = ask->parent;
++	pask = alg_sk(ask->parent);
++	tfm = pask->private;
++
++	err = -ENOKEY;
++	lock_sock_nested(psk, SINGLE_DEPTH_NESTING);
++	if (!tfm->has_key)
++		goto unlock;
++
++	if (!pask->refcnt++)
++		sock_hold(psk);
++
++	ask->refcnt = 1;
++	sock_put(psk);
++
++	err = 0;
++
++unlock:
++	release_sock(psk);
++unlock_child:
++	release_sock(sk);
++
++	return err;
++}
++
++static int hash_sendmsg_nokey(struct socket *sock, struct msghdr *msg,
++			      size_t size)
++{
++	int err;
++
++	err = hash_check_key(sock);
++	if (err)
++		return err;
++
++	return hash_sendmsg(sock, msg, size);
++}
++
++static ssize_t hash_sendpage_nokey(struct socket *sock, struct page *page,
++				   int offset, size_t size, int flags)
++{
++	int err;
++
++	err = hash_check_key(sock);
++	if (err)
++		return err;
++
++	return hash_sendpage(sock, page, offset, size, flags);
++}
++
++static int hash_recvmsg_nokey(struct socket *sock, struct msghdr *msg,
++			      size_t ignored, int flags)
++{
++	int err;
++
++	err = hash_check_key(sock);
++	if (err)
++		return err;
++
++	return hash_recvmsg(sock, msg, ignored, flags);
++}
++
++static int hash_accept_nokey(struct socket *sock, struct socket *newsock,
++			     int flags)
++{
++	int err;
++
++	err = hash_check_key(sock);
++	if (err)
++		return err;
++
++	return hash_accept(sock, newsock, flags);
++}
++
++static struct proto_ops algif_hash_ops_nokey = {
++	.family		=	PF_ALG,
++
++	.connect	=	sock_no_connect,
++	.socketpair	=	sock_no_socketpair,
++	.getname	=	sock_no_getname,
++	.ioctl		=	sock_no_ioctl,
++	.listen		=	sock_no_listen,
++	.shutdown	=	sock_no_shutdown,
++	.getsockopt	=	sock_no_getsockopt,
++	.mmap		=	sock_no_mmap,
++	.bind		=	sock_no_bind,
++	.setsockopt	=	sock_no_setsockopt,
++	.poll		=	sock_no_poll,
++
++	.release	=	af_alg_release,
++	.sendmsg	=	hash_sendmsg_nokey,
++	.sendpage	=	hash_sendpage_nokey,
++	.recvmsg	=	hash_recvmsg_nokey,
++	.accept		=	hash_accept_nokey,
++};
++
+ static void *hash_bind(const char *name, u32 type, u32 mask)
+ {
+-	return crypto_alloc_ahash(name, type, mask);
++	struct algif_hash_tfm *tfm;
++	struct crypto_ahash *hash;
++
++	tfm = kzalloc(sizeof(*tfm), GFP_KERNEL);
++	if (!tfm)
++		return ERR_PTR(-ENOMEM);
++
++	hash = crypto_alloc_ahash(name, type, mask);
++	if (IS_ERR(hash)) {
++		kfree(tfm);
++		return ERR_CAST(hash);
++	}
++
++	tfm->hash = hash;
++
++	return tfm;
+ }
+ 
+ static void hash_release(void *private)
+ {
+-	crypto_free_ahash(private);
++	struct algif_hash_tfm *tfm = private;
++
++	crypto_free_ahash(tfm->hash);
++	kfree(tfm);
+ }
+ 
+ static int hash_setkey(void *private, const u8 *key, unsigned int keylen)
+ {
+-	return crypto_ahash_setkey(private, key, keylen);
++	struct algif_hash_tfm *tfm = private;
++	int err;
++
++	err = crypto_ahash_setkey(tfm->hash, key, keylen);
++	tfm->has_key = !err;
++
++	return err;
+ }
+ 
+ static void hash_sock_destruct(struct sock *sk)
+@@ -253,12 +392,14 @@ static void hash_sock_destruct(struct sock *sk)
+ 	af_alg_release_parent(sk);
+ }
+ 
+-static int hash_accept_parent(void *private, struct sock *sk)
++static int hash_accept_parent_nokey(void *private, struct sock *sk)
+ {
+ 	struct hash_ctx *ctx;
+ 	struct alg_sock *ask = alg_sk(sk);
+-	unsigned len = sizeof(*ctx) + crypto_ahash_reqsize(private);
+-	unsigned ds = crypto_ahash_digestsize(private);
++	struct algif_hash_tfm *tfm = private;
++	struct crypto_ahash *hash = tfm->hash;
++	unsigned len = sizeof(*ctx) + crypto_ahash_reqsize(hash);
++	unsigned ds = crypto_ahash_digestsize(hash);
+ 
+ 	ctx = sock_kmalloc(sk, len, GFP_KERNEL);
+ 	if (!ctx)
+@@ -278,7 +419,7 @@ static int hash_accept_parent(void *private, struct sock *sk)
+ 
+ 	ask->private = ctx;
+ 
+-	ahash_request_set_tfm(&ctx->req, private);
++	ahash_request_set_tfm(&ctx->req, hash);
+ 	ahash_request_set_callback(&ctx->req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+ 				   af_alg_complete, &ctx->completion);
+ 
+@@ -287,12 +428,24 @@ static int hash_accept_parent(void *private, struct sock *sk)
+ 	return 0;
+ }
+ 
++static int hash_accept_parent(void *private, struct sock *sk)
++{
++	struct algif_hash_tfm *tfm = private;
++
++	if (!tfm->has_key && crypto_ahash_has_setkey(tfm->hash))
++		return -ENOKEY;
++
++	return hash_accept_parent_nokey(private, sk);
++}
++
+ static const struct af_alg_type algif_type_hash = {
+ 	.bind		=	hash_bind,
+ 	.release	=	hash_release,
+ 	.setkey		=	hash_setkey,
+ 	.accept		=	hash_accept_parent,
++	.accept_nokey	=	hash_accept_parent_nokey,
+ 	.ops		=	&algif_hash_ops,
++	.ops_nokey	=	&algif_hash_ops_nokey,
+ 	.name		=	"hash",
+ 	.owner		=	THIS_MODULE
+ };
+diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
+index 945075292bc9..5bc42f9b23f0 100644
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -387,7 +387,8 @@ static int skcipher_sendmsg(struct socket *sock, struct msghdr *msg,
+ 
+ 		sgl = list_entry(ctx->tsgl.prev, struct skcipher_sg_list, list);
+ 		sg = sgl->sg;
+-		sg_unmark_end(sg + sgl->cur);
++		if (sgl->cur)
++			sg_unmark_end(sg + sgl->cur - 1);
+ 		do {
+ 			i = sgl->cur;
+ 			plen = min_t(int, len, PAGE_SIZE);
+diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
+index 24f17e6c5904..4c850ac474e2 100644
+--- a/crypto/asymmetric_keys/x509_public_key.c
++++ b/crypto/asymmetric_keys/x509_public_key.c
+@@ -307,10 +307,6 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
+ 		srlen = cert->raw_serial_size;
+ 		q = cert->raw_serial;
+ 	}
+-	if (srlen > 1 && *q == 0) {
+-		srlen--;
+-		q++;
+-	}
+ 
+ 	ret = -ENOMEM;
+ 	desc = kmalloc(sulen + 2 + srlen * 2 + 1, GFP_KERNEL);
+diff --git a/crypto/crc32c_generic.c b/crypto/crc32c_generic.c
+index 06f1b60f02b2..4c0a0e271876 100644
+--- a/crypto/crc32c_generic.c
++++ b/crypto/crc32c_generic.c
+@@ -172,4 +172,3 @@ MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations wrapper for lib/crc32c");
+ MODULE_LICENSE("GPL");
+ MODULE_ALIAS_CRYPTO("crc32c");
+ MODULE_ALIAS_CRYPTO("crc32c-generic");
+-MODULE_SOFTDEP("pre: crc32c");
+diff --git a/crypto/shash.c b/crypto/shash.c
+index 47c713954bf3..03fbcd4a82c4 100644
+--- a/crypto/shash.c
++++ b/crypto/shash.c
+@@ -354,9 +354,10 @@ int crypto_init_shash_ops_async(struct crypto_tfm *tfm)
+ 	crt->final = shash_async_final;
+ 	crt->finup = shash_async_finup;
+ 	crt->digest = shash_async_digest;
++	crt->setkey = shash_async_setkey;
++
++	crt->has_setkey = alg->setkey != shash_no_setkey;
+ 
+-	if (alg->setkey)
+-		crt->setkey = shash_async_setkey;
+ 	if (alg->export)
+ 		crt->export = shash_async_export;
+ 	if (alg->import)
+diff --git a/drivers/block/zram/zcomp.c b/drivers/block/zram/zcomp.c
+index 54d946a9eee6..6fbb10ca73b1 100644
+--- a/drivers/block/zram/zcomp.c
++++ b/drivers/block/zram/zcomp.c
+@@ -76,7 +76,7 @@ static void zcomp_strm_free(struct zcomp *comp, struct zcomp_strm *zstrm)
+  */
+ static struct zcomp_strm *zcomp_strm_alloc(struct zcomp *comp)
+ {
+-	struct zcomp_strm *zstrm = kmalloc(sizeof(*zstrm), GFP_KERNEL);
++	struct zcomp_strm *zstrm = kmalloc(sizeof(*zstrm), GFP_NOIO);
+ 	if (!zstrm)
+ 		return NULL;
+ 
+@@ -85,7 +85,7 @@ static struct zcomp_strm *zcomp_strm_alloc(struct zcomp *comp)
+ 	 * allocate 2 pages. 1 for compressed data, plus 1 extra for the
+ 	 * case when compressed size is larger than the original one
+ 	 */
+-	zstrm->buffer = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 1);
++	zstrm->buffer = (void *)__get_free_pages(GFP_NOIO | __GFP_ZERO, 1);
+ 	if (!zstrm->private || !zstrm->buffer) {
+ 		zcomp_strm_free(comp, zstrm);
+ 		zstrm = NULL;
+diff --git a/drivers/block/zram/zcomp_lz4.c b/drivers/block/zram/zcomp_lz4.c
+index f2afb7e988c3..dd6083124276 100644
+--- a/drivers/block/zram/zcomp_lz4.c
++++ b/drivers/block/zram/zcomp_lz4.c
+@@ -10,17 +10,36 @@
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/lz4.h>
++#include <linux/vmalloc.h>
++#include <linux/mm.h>
+ 
+ #include "zcomp_lz4.h"
+ 
+ static void *zcomp_lz4_create(void)
+ {
+-	return kzalloc(LZ4_MEM_COMPRESS, GFP_KERNEL);
++	void *ret;
++
++	/*
++	 * This function can be called in swapout/fs write path
++	 * so we can't use GFP_FS|IO. And it assumes we already
++	 * have at least one stream in zram initialization so we
++	 * don't do best effort to allocate more stream in here.
++	 * A default stream will work well without further multiple
++	 * streams. That's why we use NORETRY | NOWARN.
++	 */
++	ret = kzalloc(LZ4_MEM_COMPRESS, GFP_NOIO | __GFP_NORETRY |
++					__GFP_NOWARN);
++	if (!ret)
++		ret = __vmalloc(LZ4_MEM_COMPRESS,
++				GFP_NOIO | __GFP_NORETRY | __GFP_NOWARN |
++				__GFP_ZERO | __GFP_HIGHMEM,
++				PAGE_KERNEL);
++	return ret;
+ }
+ 
+ static void zcomp_lz4_destroy(void *private)
+ {
+-	kfree(private);
++	kvfree(private);
+ }
+ 
+ static int zcomp_lz4_compress(const unsigned char *src, unsigned char *dst,
+diff --git a/drivers/block/zram/zcomp_lzo.c b/drivers/block/zram/zcomp_lzo.c
+index da1bc47d588e..edc549920fa0 100644
+--- a/drivers/block/zram/zcomp_lzo.c
++++ b/drivers/block/zram/zcomp_lzo.c
+@@ -10,17 +10,36 @@
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/lzo.h>
++#include <linux/vmalloc.h>
++#include <linux/mm.h>
+ 
+ #include "zcomp_lzo.h"
+ 
+ static void *lzo_create(void)
+ {
+-	return kzalloc(LZO1X_MEM_COMPRESS, GFP_KERNEL);
++	void *ret;
++
++	/*
++	 * This function can be called in swapout/fs write path
++	 * so we can't use GFP_FS|IO. And it assumes we already
++	 * have at least one stream in zram initialization so we
++	 * don't do best effort to allocate more stream in here.
++	 * A default stream will work well without further multiple
++	 * streams. That's why we use NORETRY | NOWARN.
++	 */
++	ret = kzalloc(LZO1X_MEM_COMPRESS, GFP_NOIO | __GFP_NORETRY |
++					__GFP_NOWARN);
++	if (!ret)
++		ret = __vmalloc(LZO1X_MEM_COMPRESS,
++				GFP_NOIO | __GFP_NORETRY | __GFP_NOWARN |
++				__GFP_ZERO | __GFP_HIGHMEM,
++				PAGE_KERNEL);
++	return ret;
+ }
+ 
+ static void lzo_destroy(void *private)
+ {
+-	kfree(private);
++	kvfree(private);
+ }
+ 
+ static int lzo_compress(const unsigned char *src, unsigned char *dst,
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 7bf87d9bfd7d..fdba79c3877c 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -144,6 +144,10 @@ static const struct usb_device_id btusb_table[] = {
+ 	{ USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
+ 	  .driver_info = BTUSB_BCM_PATCHRAM },
+ 
++	/* Toshiba Corp - Broadcom based */
++	{ USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
++	  .driver_info = BTUSB_BCM_PATCHRAM },
++
+ 	/* Intel Bluetooth USB Bootloader (RAM module) */
+ 	{ USB_DEVICE(0x8087, 0x0a5a),
+ 	  .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
+diff --git a/drivers/clocksource/vt8500_timer.c b/drivers/clocksource/vt8500_timer.c
+index 1098ed3b9b89..dc45ddb36117 100644
+--- a/drivers/clocksource/vt8500_timer.c
++++ b/drivers/clocksource/vt8500_timer.c
+@@ -50,6 +50,8 @@
+ 
+ #define msecs_to_loops(t) (loops_per_jiffy / 1000 * HZ * t)
+ 
++#define MIN_OSCR_DELTA		16
++
+ static void __iomem *regbase;
+ 
+ static cycle_t vt8500_timer_read(struct clocksource *cs)
+@@ -80,7 +82,7 @@ static int vt8500_timer_set_next_event(unsigned long cycles,
+ 		cpu_relax();
+ 	writel((unsigned long)alarm, regbase + TIMER_MATCH_VAL);
+ 
+-	if ((signed)(alarm - clocksource.read(&clocksource)) <= 16)
++	if ((signed)(alarm - clocksource.read(&clocksource)) <= MIN_OSCR_DELTA)
+ 		return -ETIME;
+ 
+ 	writel(1, regbase + TIMER_IER_VAL);
+@@ -160,7 +162,7 @@ static void __init vt8500_timer_init(struct device_node *np)
+ 		pr_err("%s: setup_irq failed for %s\n", __func__,
+ 							clockevent.name);
+ 	clockevents_config_and_register(&clockevent, VT8500_TIMER_HZ,
+-					4, 0xf0000000);
++					MIN_OSCR_DELTA * 2, 0xf0000000);
+ }
+ 
+ CLOCKSOURCE_OF_DECLARE(vt8500, "via,vt8500-timer", vt8500_timer_init);
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index c89a7abb523f..8d8c35623f2a 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -1230,6 +1230,7 @@ static int at_xdmac_device_terminate_all(struct dma_chan *chan)
+ 	list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node)
+ 		at_xdmac_remove_xfer(atchan, desc);
+ 
++	clear_bit(AT_XDMAC_CHAN_IS_PAUSED, &atchan->status);
+ 	clear_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status);
+ 	spin_unlock_irqrestore(&atchan->lock, flags);
+ 
+@@ -1362,6 +1363,8 @@ static int atmel_xdmac_resume(struct device *dev)
+ 		atchan = to_at_xdmac_chan(chan);
+ 		at_xdmac_chan_write(atchan, AT_XDMAC_CC, atchan->save_cc);
+ 		if (at_xdmac_chan_is_cyclic(atchan)) {
++			if (at_xdmac_chan_is_paused(atchan))
++				at_xdmac_device_resume(chan);
+ 			at_xdmac_chan_write(atchan, AT_XDMAC_CNDA, atchan->save_cnda);
+ 			at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, atchan->save_cndc);
+ 			at_xdmac_chan_write(atchan, AT_XDMAC_CIE, atchan->save_cim);
+diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
+index 9e504d3b0d4f..303d937d63c7 100644
+--- a/drivers/dma/dw/core.c
++++ b/drivers/dma/dw/core.c
+@@ -156,6 +156,7 @@ static void dwc_initialize(struct dw_dma_chan *dwc)
+ 
+ 	/* Enable interrupts */
+ 	channel_set_bit(dw, MASK.XFER, dwc->mask);
++	channel_set_bit(dw, MASK.BLOCK, dwc->mask);
+ 	channel_set_bit(dw, MASK.ERROR, dwc->mask);
+ 
+ 	dwc->initialized = true;
+@@ -536,16 +537,17 @@ EXPORT_SYMBOL(dw_dma_get_dst_addr);
+ 
+ /* Called with dwc->lock held and all DMAC interrupts disabled */
+ static void dwc_handle_cyclic(struct dw_dma *dw, struct dw_dma_chan *dwc,
+-		u32 status_err, u32 status_xfer)
++		u32 status_block, u32 status_err, u32 status_xfer)
+ {
+ 	unsigned long flags;
+ 
+-	if (dwc->mask) {
++	if (status_block & dwc->mask) {
+ 		void (*callback)(void *param);
+ 		void *callback_param;
+ 
+ 		dev_vdbg(chan2dev(&dwc->chan), "new cyclic period llp 0x%08x\n",
+ 				channel_readl(dwc, LLP));
++		dma_writel(dw, CLEAR.BLOCK, dwc->mask);
+ 
+ 		callback = dwc->cdesc->period_callback;
+ 		callback_param = dwc->cdesc->period_callback_param;
+@@ -577,6 +579,7 @@ static void dwc_handle_cyclic(struct dw_dma *dw, struct dw_dma_chan *dwc,
+ 		channel_writel(dwc, CTL_LO, 0);
+ 		channel_writel(dwc, CTL_HI, 0);
+ 
++		dma_writel(dw, CLEAR.BLOCK, dwc->mask);
+ 		dma_writel(dw, CLEAR.ERROR, dwc->mask);
+ 		dma_writel(dw, CLEAR.XFER, dwc->mask);
+ 
+@@ -593,10 +596,12 @@ static void dw_dma_tasklet(unsigned long data)
+ {
+ 	struct dw_dma *dw = (struct dw_dma *)data;
+ 	struct dw_dma_chan *dwc;
++	u32 status_block;
+ 	u32 status_xfer;
+ 	u32 status_err;
+ 	int i;
+ 
++	status_block = dma_readl(dw, RAW.BLOCK);
+ 	status_xfer = dma_readl(dw, RAW.XFER);
+ 	status_err = dma_readl(dw, RAW.ERROR);
+ 
+@@ -605,7 +610,8 @@ static void dw_dma_tasklet(unsigned long data)
+ 	for (i = 0; i < dw->dma.chancnt; i++) {
+ 		dwc = &dw->chan[i];
+ 		if (test_bit(DW_DMA_IS_CYCLIC, &dwc->flags))
+-			dwc_handle_cyclic(dw, dwc, status_err, status_xfer);
++			dwc_handle_cyclic(dw, dwc, status_block, status_err,
++					status_xfer);
+ 		else if (status_err & (1 << i))
+ 			dwc_handle_error(dw, dwc);
+ 		else if (status_xfer & (1 << i))
+@@ -616,6 +622,7 @@ static void dw_dma_tasklet(unsigned long data)
+ 	 * Re-enable interrupts.
+ 	 */
+ 	channel_set_bit(dw, MASK.XFER, dw->all_chan_mask);
++	channel_set_bit(dw, MASK.BLOCK, dw->all_chan_mask);
+ 	channel_set_bit(dw, MASK.ERROR, dw->all_chan_mask);
+ }
+ 
+@@ -635,6 +642,7 @@ static irqreturn_t dw_dma_interrupt(int irq, void *dev_id)
+ 	 * softirq handler.
+ 	 */
+ 	channel_clear_bit(dw, MASK.XFER, dw->all_chan_mask);
++	channel_clear_bit(dw, MASK.BLOCK, dw->all_chan_mask);
+ 	channel_clear_bit(dw, MASK.ERROR, dw->all_chan_mask);
+ 
+ 	status = dma_readl(dw, STATUS_INT);
+@@ -645,6 +653,7 @@ static irqreturn_t dw_dma_interrupt(int irq, void *dev_id)
+ 
+ 		/* Try to recover */
+ 		channel_clear_bit(dw, MASK.XFER, (1 << 8) - 1);
++		channel_clear_bit(dw, MASK.BLOCK, (1 << 8) - 1);
+ 		channel_clear_bit(dw, MASK.SRC_TRAN, (1 << 8) - 1);
+ 		channel_clear_bit(dw, MASK.DST_TRAN, (1 << 8) - 1);
+ 		channel_clear_bit(dw, MASK.ERROR, (1 << 8) - 1);
+@@ -1111,6 +1120,7 @@ static void dw_dma_off(struct dw_dma *dw)
+ 	dma_writel(dw, CFG, 0);
+ 
+ 	channel_clear_bit(dw, MASK.XFER, dw->all_chan_mask);
++	channel_clear_bit(dw, MASK.BLOCK, dw->all_chan_mask);
+ 	channel_clear_bit(dw, MASK.SRC_TRAN, dw->all_chan_mask);
+ 	channel_clear_bit(dw, MASK.DST_TRAN, dw->all_chan_mask);
+ 	channel_clear_bit(dw, MASK.ERROR, dw->all_chan_mask);
+@@ -1216,6 +1226,7 @@ static void dwc_free_chan_resources(struct dma_chan *chan)
+ 
+ 	/* Disable interrupts */
+ 	channel_clear_bit(dw, MASK.XFER, dwc->mask);
++	channel_clear_bit(dw, MASK.BLOCK, dwc->mask);
+ 	channel_clear_bit(dw, MASK.ERROR, dwc->mask);
+ 
+ 	spin_unlock_irqrestore(&dwc->lock, flags);
+@@ -1245,7 +1256,6 @@ static void dwc_free_chan_resources(struct dma_chan *chan)
+ int dw_dma_cyclic_start(struct dma_chan *chan)
+ {
+ 	struct dw_dma_chan	*dwc = to_dw_dma_chan(chan);
+-	struct dw_dma		*dw = to_dw_dma(dwc->chan.device);
+ 	unsigned long		flags;
+ 
+ 	if (!test_bit(DW_DMA_IS_CYCLIC, &dwc->flags)) {
+@@ -1254,27 +1264,7 @@ int dw_dma_cyclic_start(struct dma_chan *chan)
+ 	}
+ 
+ 	spin_lock_irqsave(&dwc->lock, flags);
+-
+-	/* Assert channel is idle */
+-	if (dma_readl(dw, CH_EN) & dwc->mask) {
+-		dev_err(chan2dev(&dwc->chan),
+-			"%s: BUG: Attempted to start non-idle channel\n",
+-			__func__);
+-		dwc_dump_chan_regs(dwc);
+-		spin_unlock_irqrestore(&dwc->lock, flags);
+-		return -EBUSY;
+-	}
+-
+-	dma_writel(dw, CLEAR.ERROR, dwc->mask);
+-	dma_writel(dw, CLEAR.XFER, dwc->mask);
+-
+-	/* Setup DMAC channel registers */
+-	channel_writel(dwc, LLP, dwc->cdesc->desc[0]->txd.phys);
+-	channel_writel(dwc, CTL_LO, DWC_CTLL_LLP_D_EN | DWC_CTLL_LLP_S_EN);
+-	channel_writel(dwc, CTL_HI, 0);
+-
+-	channel_set_bit(dw, CH_EN, dwc->mask);
+-
++	dwc_dostart(dwc, dwc->cdesc->desc[0]);
+ 	spin_unlock_irqrestore(&dwc->lock, flags);
+ 
+ 	return 0;
+@@ -1479,6 +1469,7 @@ void dw_dma_cyclic_free(struct dma_chan *chan)
+ 
+ 	dwc_chan_disable(dw, dwc);
+ 
++	dma_writel(dw, CLEAR.BLOCK, dwc->mask);
+ 	dma_writel(dw, CLEAR.ERROR, dwc->mask);
+ 	dma_writel(dw, CLEAR.XFER, dwc->mask);
+ 
+@@ -1569,9 +1560,6 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
+ 	/* Force dma off, just in case */
+ 	dw_dma_off(dw);
+ 
+-	/* Disable BLOCK interrupts as well */
+-	channel_clear_bit(dw, MASK.BLOCK, dw->all_chan_mask);
+-
+ 	/* Create a pool of consistent memory blocks for hardware descriptors */
+ 	dw->desc_pool = dmam_pool_create("dw_dmac_desc_pool", chip->dev,
+ 					 sizeof(struct dw_desc), 4, 0);
+diff --git a/drivers/edac/edac_device.c b/drivers/edac/edac_device.c
+index 592af5f0cf39..53587377e672 100644
+--- a/drivers/edac/edac_device.c
++++ b/drivers/edac/edac_device.c
+@@ -435,16 +435,13 @@ void edac_device_workq_setup(struct edac_device_ctl_info *edac_dev,
+  */
+ void edac_device_workq_teardown(struct edac_device_ctl_info *edac_dev)
+ {
+-	int status;
+-
+ 	if (!edac_dev->edac_check)
+ 		return;
+ 
+-	status = cancel_delayed_work(&edac_dev->work);
+-	if (status == 0) {
+-		/* workq instance might be running, wait for it */
+-		flush_workqueue(edac_workqueue);
+-	}
++	edac_dev->op_state = OP_OFFLINE;
++
++	cancel_delayed_work_sync(&edac_dev->work);
++	flush_workqueue(edac_workqueue);
+ }
+ 
+ /*
+diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
+index af3be1914dbb..63ceb2d98565 100644
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -581,18 +581,10 @@ static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec,
+  */
+ static void edac_mc_workq_teardown(struct mem_ctl_info *mci)
+ {
+-	int status;
+-
+-	if (mci->op_state != OP_RUNNING_POLL)
+-		return;
+-
+-	status = cancel_delayed_work(&mci->work);
+-	if (status == 0) {
+-		edac_dbg(0, "not canceled, flush the queue\n");
++	mci->op_state = OP_OFFLINE;
+ 
+-		/* workq instance might be running, wait for it */
+-		flush_workqueue(edac_workqueue);
+-	}
++	cancel_delayed_work_sync(&mci->work);
++	flush_workqueue(edac_workqueue);
+ }
+ 
+ /*
+diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
+index 112d63ad1154..67dc90365389 100644
+--- a/drivers/edac/edac_mc_sysfs.c
++++ b/drivers/edac/edac_mc_sysfs.c
+@@ -977,21 +977,26 @@ nomem:
+ int edac_create_sysfs_mci_device(struct mem_ctl_info *mci,
+ 				 const struct attribute_group **groups)
+ {
++	char *name;
+ 	int i, err;
+ 
+ 	/*
+ 	 * The memory controller needs its own bus, in order to avoid
+ 	 * namespace conflicts at /sys/bus/edac.
+ 	 */
+-	mci->bus->name = kasprintf(GFP_KERNEL, "mc%d", mci->mc_idx);
+-	if (!mci->bus->name)
++	name = kasprintf(GFP_KERNEL, "mc%d", mci->mc_idx);
++	if (!name)
+ 		return -ENOMEM;
+ 
++	mci->bus->name = name;
++
+ 	edac_dbg(0, "creating bus %s\n", mci->bus->name);
+ 
+ 	err = bus_register(mci->bus);
+-	if (err < 0)
+-		goto fail_free_name;
++	if (err < 0) {
++		kfree(name);
++		return err;
++	}
+ 
+ 	/* get the /sys/devices/system/edac subsys reference */
+ 	mci->dev.type = &mci_attr_type;
+@@ -1060,8 +1065,8 @@ fail_unregister_dimm:
+ 	device_unregister(&mci->dev);
+ fail_unregister_bus:
+ 	bus_unregister(mci->bus);
+-fail_free_name:
+-	kfree(mci->bus->name);
++	kfree(name);
++
+ 	return err;
+ }
+ 
+@@ -1092,10 +1097,12 @@ void edac_remove_sysfs_mci_device(struct mem_ctl_info *mci)
+ 
+ void edac_unregister_sysfs(struct mem_ctl_info *mci)
+ {
++	const char *name = mci->bus->name;
++
+ 	edac_dbg(1, "Unregistering device %s\n", dev_name(&mci->dev));
+ 	device_unregister(&mci->dev);
+ 	bus_unregister(mci->bus);
+-	kfree(mci->bus->name);
++	kfree(name);
+ }
+ 
+ static void mc_attr_release(struct device *dev)
+diff --git a/drivers/edac/edac_pci.c b/drivers/edac/edac_pci.c
+index 2cf44b4db80c..b4b38603b804 100644
+--- a/drivers/edac/edac_pci.c
++++ b/drivers/edac/edac_pci.c
+@@ -274,13 +274,12 @@ static void edac_pci_workq_setup(struct edac_pci_ctl_info *pci,
+  */
+ static void edac_pci_workq_teardown(struct edac_pci_ctl_info *pci)
+ {
+-	int status;
+-
+ 	edac_dbg(0, "\n");
+ 
+-	status = cancel_delayed_work(&pci->work);
+-	if (status == 0)
+-		flush_workqueue(edac_workqueue);
++	pci->op_state = OP_OFFLINE;
++
++	cancel_delayed_work_sync(&pci->work);
++	flush_workqueue(edac_workqueue);
+ }
+ 
+ /*
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 109e776345d3..0ec9ad50ba7c 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -861,28 +861,33 @@ static void drm_dp_destroy_port(struct kref *kref)
+ {
+ 	struct drm_dp_mst_port *port = container_of(kref, struct drm_dp_mst_port, kref);
+ 	struct drm_dp_mst_topology_mgr *mgr = port->mgr;
++
+ 	if (!port->input) {
+ 		port->vcpi.num_slots = 0;
+ 
+ 		kfree(port->cached_edid);
+ 
+-		/* we can't destroy the connector here, as
+-		   we might be holding the mode_config.mutex
+-		   from an EDID retrieval */
++		/*
++		 * The only time we don't have a connector
++		 * on an output port is if the connector init
++		 * fails.
++		 */
+ 		if (port->connector) {
++			/* we can't destroy the connector here, as
++			 * we might be holding the mode_config.mutex
++			 * from an EDID retrieval */
++
+ 			mutex_lock(&mgr->destroy_connector_lock);
+-			list_add(&port->connector->destroy_list, &mgr->destroy_connector_list);
++			list_add(&port->next, &mgr->destroy_connector_list);
+ 			mutex_unlock(&mgr->destroy_connector_lock);
+ 			schedule_work(&mgr->destroy_connector_work);
++			return;
+ 		}
++		/* no need to clean up vcpi
++		 * as if we have no connector we never setup a vcpi */
+ 		drm_dp_port_teardown_pdt(port, port->pdt);
+-
+-		if (!port->input && port->vcpi.vcpi > 0)
+-			drm_dp_mst_put_payload_id(mgr, port->vcpi.vcpi);
+ 	}
+ 	kfree(port);
+-
+-	(*mgr->cbs->hotplug)(mgr);
+ }
+ 
+ static void drm_dp_put_port(struct drm_dp_mst_port *port)
+@@ -968,17 +973,17 @@ static struct drm_dp_mst_port *drm_dp_get_port(struct drm_dp_mst_branch *mstb, u
+ static u8 drm_dp_calculate_rad(struct drm_dp_mst_port *port,
+ 				 u8 *rad)
+ {
+-	int lct = port->parent->lct;
++	int parent_lct = port->parent->lct;
+ 	int shift = 4;
+-	int idx = lct / 2;
+-	if (lct > 1) {
+-		memcpy(rad, port->parent->rad, idx);
+-		shift = (lct % 2) ? 4 : 0;
++	int idx = (parent_lct - 1) / 2;
++	if (parent_lct > 1) {
++		memcpy(rad, port->parent->rad, idx + 1);
++		shift = (parent_lct % 2) ? 4 : 0;
+ 	} else
+ 		rad[0] = 0;
+ 
+ 	rad[idx] |= port->port_num << shift;
+-	return lct + 1;
++	return parent_lct + 1;
+ }
+ 
+ /*
+@@ -1034,7 +1039,7 @@ static void build_mst_prop_path(struct drm_dp_mst_port *port,
+ 	snprintf(proppath, proppath_size, "mst:%d", mstb->mgr->conn_base_id);
+ 	for (i = 0; i < (mstb->lct - 1); i++) {
+ 		int shift = (i % 2) ? 0 : 4;
+-		int port_num = mstb->rad[i / 2] >> shift;
++		int port_num = (mstb->rad[i / 2] >> shift) & 0xf;
+ 		snprintf(temp, sizeof(temp), "-%d", port_num);
+ 		strlcat(proppath, temp, proppath_size);
+ 	}
+@@ -1112,12 +1117,21 @@ static void drm_dp_add_port(struct drm_dp_mst_branch *mstb,
+ 		char proppath[255];
+ 		build_mst_prop_path(port, mstb, proppath, sizeof(proppath));
+ 		port->connector = (*mstb->mgr->cbs->add_connector)(mstb->mgr, port, proppath);
+-
++		if (!port->connector) {
++			/* remove it from the port list */
++			mutex_lock(&mstb->mgr->lock);
++			list_del(&port->next);
++			mutex_unlock(&mstb->mgr->lock);
++			/* drop port list reference */
++			drm_dp_put_port(port);
++			goto out;
++		}
+ 		if (port->port_num >= 8) {
+ 			port->cached_edid = drm_get_edid(port->connector, &port->aux.ddc);
+ 		}
+ 	}
+ 
++out:
+ 	/* put reference to this port */
+ 	drm_dp_put_port(port);
+ }
+@@ -1175,7 +1189,7 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
+ 
+ 	for (i = 0; i < lct - 1; i++) {
+ 		int shift = (i % 2) ? 0 : 4;
+-		int port_num = rad[i / 2] >> shift;
++		int port_num = (rad[i / 2] >> shift) & 0xf;
+ 
+ 		list_for_each_entry(port, &mstb->ports, next) {
+ 			if (port->port_num == port_num) {
+@@ -1195,6 +1209,50 @@ out:
+ 	return mstb;
+ }
+ 
++static struct drm_dp_mst_branch *get_mst_branch_device_by_guid_helper(
++	struct drm_dp_mst_branch *mstb,
++	uint8_t *guid)
++{
++	struct drm_dp_mst_branch *found_mstb;
++	struct drm_dp_mst_port *port;
++
++	list_for_each_entry(port, &mstb->ports, next) {
++		if (!port->mstb)
++			continue;
++
++		if (port->guid_valid && memcmp(port->guid, guid, 16) == 0)
++			return port->mstb;
++
++		found_mstb = get_mst_branch_device_by_guid_helper(port->mstb, guid);
++
++		if (found_mstb)
++			return found_mstb;
++	}
++
++	return NULL;
++}
++
++static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device_by_guid(
++	struct drm_dp_mst_topology_mgr *mgr,
++	uint8_t *guid)
++{
++	struct drm_dp_mst_branch *mstb;
++
++	/* find the port by iterating down */
++	mutex_lock(&mgr->lock);
++
++	if (mgr->guid_valid && memcmp(mgr->guid, guid, 16) == 0)
++		mstb = mgr->mst_primary;
++	else
++		mstb = get_mst_branch_device_by_guid_helper(mgr->mst_primary, guid);
++
++	if (mstb)
++		kref_get(&mstb->kref);
++
++	mutex_unlock(&mgr->lock);
++	return mstb;
++}
++
+ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *mgr,
+ 					       struct drm_dp_mst_branch *mstb)
+ {
+@@ -1306,6 +1364,7 @@ static int set_hdr_from_dst_qlock(struct drm_dp_sideband_msg_hdr *hdr,
+ 				  struct drm_dp_sideband_msg_tx *txmsg)
+ {
+ 	struct drm_dp_mst_branch *mstb = txmsg->dst;
++	u8 req_type;
+ 
+ 	/* both msg slots are full */
+ 	if (txmsg->seqno == -1) {
+@@ -1322,7 +1381,13 @@ static int set_hdr_from_dst_qlock(struct drm_dp_sideband_msg_hdr *hdr,
+ 			txmsg->seqno = 1;
+ 		mstb->tx_slots[txmsg->seqno] = txmsg;
+ 	}
+-	hdr->broadcast = 0;
++
++	req_type = txmsg->msg[0] & 0x7f;
++	if (req_type == DP_CONNECTION_STATUS_NOTIFY ||
++		req_type == DP_RESOURCE_STATUS_NOTIFY)
++		hdr->broadcast = 1;
++	else
++		hdr->broadcast = 0;
+ 	hdr->path_msg = txmsg->path_msg;
+ 	hdr->lct = mstb->lct;
+ 	hdr->lcr = mstb->lct - 1;
+@@ -1424,26 +1489,18 @@ static void process_single_down_tx_qlock(struct drm_dp_mst_topology_mgr *mgr)
+ }
+ 
+ /* called holding qlock */
+-static void process_single_up_tx_qlock(struct drm_dp_mst_topology_mgr *mgr)
++static void process_single_up_tx_qlock(struct drm_dp_mst_topology_mgr *mgr,
++				       struct drm_dp_sideband_msg_tx *txmsg)
+ {
+-	struct drm_dp_sideband_msg_tx *txmsg;
+ 	int ret;
+ 
+ 	/* construct a chunk from the first msg in the tx_msg queue */
+-	if (list_empty(&mgr->tx_msg_upq)) {
+-		mgr->tx_up_in_progress = false;
+-		return;
+-	}
+-
+-	txmsg = list_first_entry(&mgr->tx_msg_upq, struct drm_dp_sideband_msg_tx, next);
+ 	ret = process_single_tx_qlock(mgr, txmsg, true);
+-	if (ret == 1) {
+-		/* up txmsgs aren't put in slots - so free after we send it */
+-		list_del(&txmsg->next);
+-		kfree(txmsg);
+-	} else if (ret)
++
++	if (ret != 1)
+ 		DRM_DEBUG_KMS("failed to send msg in q %d\n", ret);
+-	mgr->tx_up_in_progress = true;
++
++	txmsg->dst->tx_slots[txmsg->seqno] = NULL;
+ }
+ 
+ static void drm_dp_queue_down_tx(struct drm_dp_mst_topology_mgr *mgr,
+@@ -1828,11 +1885,12 @@ static int drm_dp_send_up_ack_reply(struct drm_dp_mst_topology_mgr *mgr,
+ 	drm_dp_encode_up_ack_reply(txmsg, req_type);
+ 
+ 	mutex_lock(&mgr->qlock);
+-	list_add_tail(&txmsg->next, &mgr->tx_msg_upq);
+-	if (!mgr->tx_up_in_progress) {
+-		process_single_up_tx_qlock(mgr);
+-	}
++
++	process_single_up_tx_qlock(mgr, txmsg);
++
+ 	mutex_unlock(&mgr->qlock);
++
++	kfree(txmsg);
+ 	return 0;
+ }
+ 
+@@ -2129,28 +2187,50 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr)
+ 
+ 	if (mgr->up_req_recv.have_eomt) {
+ 		struct drm_dp_sideband_msg_req_body msg;
+-		struct drm_dp_mst_branch *mstb;
++		struct drm_dp_mst_branch *mstb = NULL;
+ 		bool seqno;
+-		mstb = drm_dp_get_mst_branch_device(mgr,
+-						    mgr->up_req_recv.initial_hdr.lct,
+-						    mgr->up_req_recv.initial_hdr.rad);
+-		if (!mstb) {
+-			DRM_DEBUG_KMS("Got MST reply from unknown device %d\n", mgr->up_req_recv.initial_hdr.lct);
+-			memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx));
+-			return 0;
++
++		if (!mgr->up_req_recv.initial_hdr.broadcast) {
++			mstb = drm_dp_get_mst_branch_device(mgr,
++							    mgr->up_req_recv.initial_hdr.lct,
++							    mgr->up_req_recv.initial_hdr.rad);
++			if (!mstb) {
++				DRM_DEBUG_KMS("Got MST reply from unknown device %d\n", mgr->up_req_recv.initial_hdr.lct);
++				memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx));
++				return 0;
++			}
+ 		}
+ 
+ 		seqno = mgr->up_req_recv.initial_hdr.seqno;
+ 		drm_dp_sideband_parse_req(&mgr->up_req_recv, &msg);
+ 
+ 		if (msg.req_type == DP_CONNECTION_STATUS_NOTIFY) {
+-			drm_dp_send_up_ack_reply(mgr, mstb, msg.req_type, seqno, false);
++			drm_dp_send_up_ack_reply(mgr, mgr->mst_primary, msg.req_type, seqno, false);
++
++			if (!mstb)
++				mstb = drm_dp_get_mst_branch_device_by_guid(mgr, msg.u.conn_stat.guid);
++
++			if (!mstb) {
++				DRM_DEBUG_KMS("Got MST reply from unknown device %d\n", mgr->up_req_recv.initial_hdr.lct);
++				memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx));
++				return 0;
++			}
++
+ 			drm_dp_update_port(mstb, &msg.u.conn_stat);
+ 			DRM_DEBUG_KMS("Got CSN: pn: %d ldps:%d ddps: %d mcs: %d ip: %d pdt: %d\n", msg.u.conn_stat.port_number, msg.u.conn_stat.legacy_device_plug_status, msg.u.conn_stat.displayport_device_plug_status, msg.u.conn_stat.message_capability_status, msg.u.conn_stat.input_port, msg.u.conn_stat.peer_device_type);
+ 			(*mgr->cbs->hotplug)(mgr);
+ 
+ 		} else if (msg.req_type == DP_RESOURCE_STATUS_NOTIFY) {
+-			drm_dp_send_up_ack_reply(mgr, mstb, msg.req_type, seqno, false);
++			drm_dp_send_up_ack_reply(mgr, mgr->mst_primary, msg.req_type, seqno, false);
++			if (!mstb)
++				mstb = drm_dp_get_mst_branch_device_by_guid(mgr, msg.u.resource_stat.guid);
++
++			if (!mstb) {
++				DRM_DEBUG_KMS("Got MST reply from unknown device %d\n", mgr->up_req_recv.initial_hdr.lct);
++				memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx));
++				return 0;
++			}
++
+ 			DRM_DEBUG_KMS("Got RSN: pn: %d avail_pbn %d\n", msg.u.resource_stat.port_number, msg.u.resource_stat.available_pbn);
+ 		}
+ 
+@@ -2330,6 +2410,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp
+ 		DRM_DEBUG_KMS("payload: vcpi %d already allocated for pbn %d - requested pbn %d\n", port->vcpi.vcpi, port->vcpi.pbn, pbn);
+ 		if (pbn == port->vcpi.pbn) {
+ 			*slots = port->vcpi.num_slots;
++			drm_dp_put_port(port);
+ 			return true;
+ 		}
+ 	}
+@@ -2489,32 +2570,31 @@ EXPORT_SYMBOL(drm_dp_check_act_status);
+  */
+ int drm_dp_calc_pbn_mode(int clock, int bpp)
+ {
+-	fixed20_12 pix_bw;
+-	fixed20_12 fbpp;
+-	fixed20_12 result;
+-	fixed20_12 margin, tmp;
+-	u32 res;
+-
+-	pix_bw.full = dfixed_const(clock);
+-	fbpp.full = dfixed_const(bpp);
+-	tmp.full = dfixed_const(8);
+-	fbpp.full = dfixed_div(fbpp, tmp);
+-
+-	result.full = dfixed_mul(pix_bw, fbpp);
+-	margin.full = dfixed_const(54);
+-	tmp.full = dfixed_const(64);
+-	margin.full = dfixed_div(margin, tmp);
+-	result.full = dfixed_div(result, margin);
+-
+-	margin.full = dfixed_const(1006);
+-	tmp.full = dfixed_const(1000);
+-	margin.full = dfixed_div(margin, tmp);
+-	result.full = dfixed_mul(result, margin);
+-
+-	result.full = dfixed_div(result, tmp);
+-	result.full = dfixed_ceil(result);
+-	res = dfixed_trunc(result);
+-	return res;
++	u64 kbps;
++	s64 peak_kbps;
++	u32 numerator;
++	u32 denominator;
++
++	kbps = clock * bpp;
++
++	/*
++	 * margin 5300ppm + 300ppm ~ 0.6% as per spec, factor is 1.006
++	 * The unit of 54/64Mbytes/sec is an arbitrary unit chosen based on
++	 * common multiplier to render an integer PBN for all link rate/lane
++	 * counts combinations
++	 * calculate
++	 * peak_kbps *= (1006/1000)
++	 * peak_kbps *= (64/54)
++	 * peak_kbps *= 8    convert to bytes
++	 */
++
++	numerator = 64 * 1006;
++	denominator = 54 * 8 * 1000 * 1000;
++
++	kbps *= numerator;
++	peak_kbps = drm_fixp_from_fraction(kbps, denominator);
++
++	return drm_fixp2int_ceil(peak_kbps);
+ }
+ EXPORT_SYMBOL(drm_dp_calc_pbn_mode);
+ 
+@@ -2522,11 +2602,23 @@ static int test_calc_pbn_mode(void)
+ {
+ 	int ret;
+ 	ret = drm_dp_calc_pbn_mode(154000, 30);
+-	if (ret != 689)
++	if (ret != 689) {
++		DRM_ERROR("PBN calculation test failed - clock %d, bpp %d, expected PBN %d, actual PBN %d.\n",
++				154000, 30, 689, ret);
+ 		return -EINVAL;
++	}
+ 	ret = drm_dp_calc_pbn_mode(234000, 30);
+-	if (ret != 1047)
++	if (ret != 1047) {
++		DRM_ERROR("PBN calculation test failed - clock %d, bpp %d, expected PBN %d, actual PBN %d.\n",
++				234000, 30, 1047, ret);
+ 		return -EINVAL;
++	}
++	ret = drm_dp_calc_pbn_mode(297000, 24);
++	if (ret != 1063) {
++		DRM_ERROR("PBN calculation test failed - clock %d, bpp %d, expected PBN %d, actual PBN %d.\n",
++				297000, 24, 1063, ret);
++		return -EINVAL;
++	}
+ 	return 0;
+ }
+ 
+@@ -2660,8 +2752,8 @@ static void drm_dp_tx_work(struct work_struct *work)
+ static void drm_dp_destroy_connector_work(struct work_struct *work)
+ {
+ 	struct drm_dp_mst_topology_mgr *mgr = container_of(work, struct drm_dp_mst_topology_mgr, destroy_connector_work);
+-	struct drm_connector *connector;
+-
++	struct drm_dp_mst_port *port;
++	bool send_hotplug = false;
+ 	/*
+ 	 * Not a regular list traverse as we have to drop the destroy
+ 	 * connector lock before destroying the connector, to avoid AB->BA
+@@ -2669,16 +2761,25 @@ static void drm_dp_destroy_connector_work(struct work_struct *work)
+ 	 */
+ 	for (;;) {
+ 		mutex_lock(&mgr->destroy_connector_lock);
+-		connector = list_first_entry_or_null(&mgr->destroy_connector_list, struct drm_connector, destroy_list);
+-		if (!connector) {
++		port = list_first_entry_or_null(&mgr->destroy_connector_list, struct drm_dp_mst_port, next);
++		if (!port) {
+ 			mutex_unlock(&mgr->destroy_connector_lock);
+ 			break;
+ 		}
+-		list_del(&connector->destroy_list);
++		list_del(&port->next);
+ 		mutex_unlock(&mgr->destroy_connector_lock);
+ 
+-		mgr->cbs->destroy_connector(mgr, connector);
++		mgr->cbs->destroy_connector(mgr, port->connector);
++
++		drm_dp_port_teardown_pdt(port, port->pdt);
++
++		if (!port->input && port->vcpi.vcpi > 0)
++			drm_dp_mst_put_payload_id(mgr, port->vcpi.vcpi);
++		kfree(port);
++		send_hotplug = true;
+ 	}
++	if (send_hotplug)
++		(*mgr->cbs->hotplug)(mgr);
+ }
+ 
+ /**
+@@ -2701,7 +2802,6 @@ int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr,
+ 	mutex_init(&mgr->qlock);
+ 	mutex_init(&mgr->payload_lock);
+ 	mutex_init(&mgr->destroy_connector_lock);
+-	INIT_LIST_HEAD(&mgr->tx_msg_upq);
+ 	INIT_LIST_HEAD(&mgr->tx_msg_downq);
+ 	INIT_LIST_HEAD(&mgr->destroy_connector_list);
+ 	INIT_WORK(&mgr->work, drm_dp_mst_link_probe_work);
+diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
+index 63503879a676..0d75e75b1da3 100644
+--- a/drivers/gpu/drm/drm_probe_helper.c
++++ b/drivers/gpu/drm/drm_probe_helper.c
+@@ -195,7 +195,8 @@ static int drm_helper_probe_single_connector_modes_merge_bits(struct drm_connect
+ 		mode_flags |= DRM_MODE_FLAG_3D_MASK;
+ 
+ 	list_for_each_entry(mode, &connector->modes, head) {
+-		mode->status = drm_mode_validate_basic(mode);
++		if (mode->status == MODE_OK)
++			mode->status = drm_mode_validate_basic(mode);
+ 
+ 		if (mode->status == MODE_OK)
+ 			mode->status = drm_mode_validate_size(mode, maxX, maxY);
+diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
+index f3e84c44d009..4decf518d106 100644
+--- a/drivers/gpu/drm/i915/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/i915_gem_context.c
+@@ -317,6 +317,10 @@ void i915_gem_context_reset(struct drm_device *dev)
+ 			i915_gem_context_unreference(lctx);
+ 			ring->last_context = NULL;
+ 		}
++
++		/* Force the GPU state to be reinitialised on enabling */
++		if (ring->default_context)
++			ring->default_context->legacy_hw_ctx.initialized = false;
+ 	}
+ }
+ 
+@@ -704,7 +708,7 @@ static int do_switch(struct intel_engine_cs *ring,
+ 			goto unpin_out;
+ 	}
+ 
+-	if (!to->legacy_hw_ctx.initialized) {
++	if (!to->legacy_hw_ctx.initialized || i915_gem_context_is_default(to)) {
+ 		hw_flags |= MI_RESTORE_INHIBIT;
+ 		/* NB: If we inhibit the restore, the context is not allowed to
+ 		 * die because future work may end up depending on valid address
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 7b27a114b030..b103773df2a3 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -10391,11 +10391,21 @@ connected_sink_compute_bpp(struct intel_connector *connector,
+ 		pipe_config->pipe_bpp = connector->base.display_info.bpc*3;
+ 	}
+ 
+-	/* Clamp bpp to 8 on screens without EDID 1.4 */
+-	if (connector->base.display_info.bpc == 0 && bpp > 24) {
+-		DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of 24\n",
+-			      bpp);
+-		pipe_config->pipe_bpp = 24;
++	/* Clamp bpp to default limit on screens without EDID 1.4 */
++	if (connector->base.display_info.bpc == 0) {
++		int type = connector->base.connector_type;
++		int clamp_bpp = 24;
++
++		/* Fall back to 18 bpp when DP sink capability is unknown. */
++		if (type == DRM_MODE_CONNECTOR_DisplayPort ||
++		    type == DRM_MODE_CONNECTOR_eDP)
++			clamp_bpp = 18;
++
++		if (bpp > clamp_bpp) {
++			DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of %d\n",
++				      bpp, clamp_bpp);
++			pipe_config->pipe_bpp = clamp_bpp;
++		}
+ 	}
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
+index 5cb47482d29f..88c557551b89 100644
+--- a/drivers/gpu/drm/i915/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/intel_dp_mst.c
+@@ -439,9 +439,9 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo
+ 
+ 	drm_mode_connector_set_path_property(connector, pathprop);
+ 	drm_reinit_primary_mode_group(dev);
+-	mutex_lock(&dev->mode_config.mutex);
++	drm_modeset_lock_all(dev);
+ 	intel_connector_add_to_fbdev(intel_connector);
+-	mutex_unlock(&dev->mode_config.mutex);
++	drm_modeset_unlock_all(dev);
+ 	drm_connector_register(&intel_connector->base);
+ 	return connector;
+ }
+@@ -452,16 +452,16 @@ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ 	struct intel_connector *intel_connector = to_intel_connector(connector);
+ 	struct drm_device *dev = connector->dev;
+ 	/* need to nuke the connector */
+-	mutex_lock(&dev->mode_config.mutex);
++	drm_modeset_lock_all(dev);
+ 	intel_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+-	mutex_unlock(&dev->mode_config.mutex);
++	drm_modeset_unlock_all(dev);
+ 
+ 	intel_connector->unregister(intel_connector);
+ 
+-	mutex_lock(&dev->mode_config.mutex);
++	drm_modeset_lock_all(dev);
+ 	intel_connector_remove_from_fbdev(intel_connector);
+ 	drm_connector_cleanup(connector);
+-	mutex_unlock(&dev->mode_config.mutex);
++	drm_modeset_unlock_all(dev);
+ 
+ 	drm_reinit_primary_mode_group(dev);
+ 
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
+index 3162040bc314..05490ef5a2aa 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -969,10 +969,13 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
+ 
+ 		NV_DEBUG(drm, "%splugged %s\n", plugged ? "" : "un", name);
+ 
++		mutex_lock(&drm->dev->mode_config.mutex);
+ 		if (plugged)
+ 			drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
+ 		else
+ 			drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
++		mutex_unlock(&drm->dev->mode_config.mutex);
++
+ 		drm_helper_hpd_irq_event(connector->dev);
+ 	}
+ 
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index 5be50ef2b30e..bb292143997e 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -2310,8 +2310,7 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
+ 	encoder_mode = atombios_get_encoder_mode(encoder);
+ 	if (connector && (radeon_audio != 0) &&
+ 	    ((encoder_mode == ATOM_ENCODER_MODE_HDMI) ||
+-	     (ENCODER_MODE_IS_DP(encoder_mode) &&
+-	      drm_detect_monitor_audio(radeon_connector_edid(connector)))))
++	     ENCODER_MODE_IS_DP(encoder_mode)))
+ 		radeon_audio_mode_set(encoder, adjusted_mode);
+ }
+ 
+diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
+index 44480c1b9738..848b1ffd5cc4 100644
+--- a/drivers/gpu/drm/radeon/dce6_afmt.c
++++ b/drivers/gpu/drm/radeon/dce6_afmt.c
+@@ -282,6 +282,14 @@ void dce6_dp_audio_set_dto(struct radeon_device *rdev,
+ 	 * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
+ 	 */
+ 	if (ASIC_IS_DCE8(rdev)) {
++		unsigned int div = (RREG32(DENTIST_DISPCLK_CNTL) &
++			DENTIST_DPREFCLK_WDIVIDER_MASK) >>
++			DENTIST_DPREFCLK_WDIVIDER_SHIFT;
++		div = radeon_audio_decode_dfs_div(div);
++
++		if (div)
++			clock = clock * 100 / div;
++
+ 		WREG32(DCE8_DCCG_AUDIO_DTO1_PHASE, 24000);
+ 		WREG32(DCE8_DCCG_AUDIO_DTO1_MODULE, clock);
+ 	} else {
+diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
+index 9953356fe263..3cf04a2f44bb 100644
+--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
++++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
+@@ -289,6 +289,16 @@ void dce4_dp_audio_set_dto(struct radeon_device *rdev,
+ 	 * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
+ 	 * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
+ 	 */
++	if (ASIC_IS_DCE41(rdev)) {
++		unsigned int div = (RREG32(DCE41_DENTIST_DISPCLK_CNTL) &
++			DENTIST_DPREFCLK_WDIVIDER_MASK) >>
++			DENTIST_DPREFCLK_WDIVIDER_SHIFT;
++		div = radeon_audio_decode_dfs_div(div);
++
++		if (div)
++			clock = 100 * clock / div;
++	}
++
+ 	WREG32(DCCG_AUDIO_DTO1_PHASE, 24000);
+ 	WREG32(DCCG_AUDIO_DTO1_MODULE, clock);
+ }
+diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
+index 4aa5f755572b..13b6029d65cc 100644
+--- a/drivers/gpu/drm/radeon/evergreend.h
++++ b/drivers/gpu/drm/radeon/evergreend.h
+@@ -511,6 +511,11 @@
+ #define DCCG_AUDIO_DTO1_CNTL              0x05cc
+ #       define DCCG_AUDIO_DTO1_USE_512FBR_DTO (1 << 3)
+ 
++#define DCE41_DENTIST_DISPCLK_CNTL			0x049c
++#       define DENTIST_DPREFCLK_WDIVIDER(x)		(((x) & 0x7f) << 24)
++#       define DENTIST_DPREFCLK_WDIVIDER_MASK		(0x7f << 24)
++#       define DENTIST_DPREFCLK_WDIVIDER_SHIFT		24
++
+ /* DCE 4.0 AFMT */
+ #define HDMI_CONTROL                         0x7030
+ #       define HDMI_KEEPOUT_MODE             (1 << 0)
+diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
+index 91c3f60f8bac..4bca29c5abfa 100644
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -268,6 +268,7 @@ struct radeon_clock {
+ 	uint32_t current_dispclk;
+ 	uint32_t dp_extclk;
+ 	uint32_t max_pixel_clock;
++	uint32_t vco_freq;
+ };
+ 
+ /*
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index 8f285244c839..de9a2ffcf5f7 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -437,7 +437,9 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
+ 	}
+ 
+ 	/* Fujitsu D3003-S2 board lists DVI-I as DVI-D and VGA */
+-	if (((dev->pdev->device == 0x9802) || (dev->pdev->device == 0x9806)) &&
++	if (((dev->pdev->device == 0x9802) ||
++	     (dev->pdev->device == 0x9805) ||
++	     (dev->pdev->device == 0x9806)) &&
+ 	    (dev->pdev->subsystem_vendor == 0x1734) &&
+ 	    (dev->pdev->subsystem_device == 0x11bd)) {
+ 		if (*connector_type == DRM_MODE_CONNECTOR_VGA) {
+@@ -448,14 +450,6 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
+ 		}
+ 	}
+ 
+-	/* Fujitsu D3003-S2 board lists DVI-I as DVI-I and VGA */
+-	if ((dev->pdev->device == 0x9805) &&
+-	    (dev->pdev->subsystem_vendor == 0x1734) &&
+-	    (dev->pdev->subsystem_device == 0x11bd)) {
+-		if (*connector_type == DRM_MODE_CONNECTOR_VGA)
+-			return false;
+-	}
+-
+ 	return true;
+ }
+ 
+@@ -1112,6 +1106,31 @@ union firmware_info {
+ 	ATOM_FIRMWARE_INFO_V2_2 info_22;
+ };
+ 
++union igp_info {
++	struct _ATOM_INTEGRATED_SYSTEM_INFO info;
++	struct _ATOM_INTEGRATED_SYSTEM_INFO_V2 info_2;
++	struct _ATOM_INTEGRATED_SYSTEM_INFO_V6 info_6;
++	struct _ATOM_INTEGRATED_SYSTEM_INFO_V1_7 info_7;
++	struct _ATOM_INTEGRATED_SYSTEM_INFO_V1_8 info_8;
++};
++
++static void radeon_atombios_get_dentist_vco_freq(struct radeon_device *rdev)
++{
++	struct radeon_mode_info *mode_info = &rdev->mode_info;
++	int index = GetIndexIntoMasterTable(DATA, IntegratedSystemInfo);
++	union igp_info *igp_info;
++	u8 frev, crev;
++	u16 data_offset;
++
++	if (atom_parse_data_header(mode_info->atom_context, index, NULL,
++			&frev, &crev, &data_offset)) {
++		igp_info = (union igp_info *)(mode_info->atom_context->bios +
++			data_offset);
++		rdev->clock.vco_freq =
++			le32_to_cpu(igp_info->info_6.ulDentistVCOFreq);
++	}
++}
++
+ bool radeon_atom_get_clock_info(struct drm_device *dev)
+ {
+ 	struct radeon_device *rdev = dev->dev_private;
+@@ -1263,20 +1282,25 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
+ 		rdev->mode_info.firmware_flags =
+ 			le16_to_cpu(firmware_info->info.usFirmwareCapability.susAccess);
+ 
++		if (ASIC_IS_DCE8(rdev))
++			rdev->clock.vco_freq =
++				le32_to_cpu(firmware_info->info_22.ulGPUPLL_OutputFreq);
++		else if (ASIC_IS_DCE5(rdev))
++			rdev->clock.vco_freq = rdev->clock.current_dispclk;
++		else if (ASIC_IS_DCE41(rdev))
++			radeon_atombios_get_dentist_vco_freq(rdev);
++		else
++			rdev->clock.vco_freq = rdev->clock.current_dispclk;
++
++		if (rdev->clock.vco_freq == 0)
++			rdev->clock.vco_freq = 360000;	/* 3.6 GHz */
++
+ 		return true;
+ 	}
+ 
+ 	return false;
+ }
+ 
+-union igp_info {
+-	struct _ATOM_INTEGRATED_SYSTEM_INFO info;
+-	struct _ATOM_INTEGRATED_SYSTEM_INFO_V2 info_2;
+-	struct _ATOM_INTEGRATED_SYSTEM_INFO_V6 info_6;
+-	struct _ATOM_INTEGRATED_SYSTEM_INFO_V1_7 info_7;
+-	struct _ATOM_INTEGRATED_SYSTEM_INFO_V1_8 info_8;
+-};
+-
+ bool radeon_atombios_sideport_present(struct radeon_device *rdev)
+ {
+ 	struct radeon_mode_info *mode_info = &rdev->mode_info;
+diff --git a/drivers/gpu/drm/radeon/radeon_audio.c b/drivers/gpu/drm/radeon/radeon_audio.c
+index d77dd1430d58..b214663b370d 100644
+--- a/drivers/gpu/drm/radeon/radeon_audio.c
++++ b/drivers/gpu/drm/radeon/radeon_audio.c
+@@ -698,26 +698,37 @@ static void radeon_audio_hdmi_mode_set(struct drm_encoder *encoder,
+ {
+ 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+ 	struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
++	struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+ 
+ 	if (!dig || !dig->afmt)
+ 		return;
+ 
+-	radeon_audio_set_mute(encoder, true);
++	if (!connector)
++		return;
++
++	if (drm_detect_monitor_audio(radeon_connector_edid(connector))) {
++		radeon_audio_set_mute(encoder, true);
+ 
+-	radeon_audio_write_speaker_allocation(encoder);
+-	radeon_audio_write_sad_regs(encoder);
+-	radeon_audio_write_latency_fields(encoder, mode);
+-	radeon_audio_set_dto(encoder, mode->clock);
+-	radeon_audio_set_vbi_packet(encoder);
+-	radeon_hdmi_set_color_depth(encoder);
+-	radeon_audio_update_acr(encoder, mode->clock);
+-	radeon_audio_set_audio_packet(encoder);
+-	radeon_audio_select_pin(encoder);
++		radeon_audio_write_speaker_allocation(encoder);
++		radeon_audio_write_sad_regs(encoder);
++		radeon_audio_write_latency_fields(encoder, mode);
++		radeon_audio_set_dto(encoder, mode->clock);
++		radeon_audio_set_vbi_packet(encoder);
++		radeon_hdmi_set_color_depth(encoder);
++		radeon_audio_update_acr(encoder, mode->clock);
++		radeon_audio_set_audio_packet(encoder);
++		radeon_audio_select_pin(encoder);
+ 
+-	if (radeon_audio_set_avi_packet(encoder, mode) < 0)
+-		return;
++		if (radeon_audio_set_avi_packet(encoder, mode) < 0)
++			return;
+ 
+-	radeon_audio_set_mute(encoder, false);
++		radeon_audio_set_mute(encoder, false);
++	} else {
++		radeon_hdmi_set_color_depth(encoder);
++
++		if (radeon_audio_set_avi_packet(encoder, mode) < 0)
++			return;
++	}
+ }
+ 
+ static void radeon_audio_dp_mode_set(struct drm_encoder *encoder,
+@@ -728,28 +739,24 @@ static void radeon_audio_dp_mode_set(struct drm_encoder *encoder,
+ 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+ 	struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+ 	struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+-	struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+-	struct radeon_connector_atom_dig *dig_connector =
+-		radeon_connector->con_priv;
+ 
+-	if (!connector)
++	if (!dig || !dig->afmt)
+ 		return;
+ 
+-	if (!dig || !dig->afmt)
++	if (!connector)
+ 		return;
+ 
+-	radeon_audio_write_speaker_allocation(encoder);
+-	radeon_audio_write_sad_regs(encoder);
+-	radeon_audio_write_latency_fields(encoder, mode);
+-	if (rdev->clock.dp_extclk || ASIC_IS_DCE5(rdev))
+-		radeon_audio_set_dto(encoder, rdev->clock.default_dispclk * 10);
+-	else
+-		radeon_audio_set_dto(encoder, dig_connector->dp_clock);
+-	radeon_audio_set_audio_packet(encoder);
+-	radeon_audio_select_pin(encoder);
++	if (drm_detect_monitor_audio(radeon_connector_edid(connector))) {
++		radeon_audio_write_speaker_allocation(encoder);
++		radeon_audio_write_sad_regs(encoder);
++		radeon_audio_write_latency_fields(encoder, mode);
++		radeon_audio_set_dto(encoder, rdev->clock.vco_freq * 10);
++		radeon_audio_set_audio_packet(encoder);
++		radeon_audio_select_pin(encoder);
+ 
+-	if (radeon_audio_set_avi_packet(encoder, mode) < 0)
+-		return;
++		if (radeon_audio_set_avi_packet(encoder, mode) < 0)
++			return;
++	}
+ }
+ 
+ void radeon_audio_mode_set(struct drm_encoder *encoder,
+@@ -768,3 +775,15 @@ void radeon_audio_dpms(struct drm_encoder *encoder, int mode)
+ 	if (radeon_encoder->audio && radeon_encoder->audio->dpms)
+ 		radeon_encoder->audio->dpms(encoder, mode == DRM_MODE_DPMS_ON);
+ }
++
++unsigned int radeon_audio_decode_dfs_div(unsigned int div)
++{
++	if (div >= 8 && div < 64)
++		return (div - 8) * 25 + 200;
++	else if (div >= 64 && div < 96)
++		return (div - 64) * 50 + 1600;
++	else if (div >= 96 && div < 128)
++		return (div - 96) * 100 + 3200;
++	else
++		return 0;
++}
+diff --git a/drivers/gpu/drm/radeon/radeon_audio.h b/drivers/gpu/drm/radeon/radeon_audio.h
+index 059cc3012062..5c70cceaa4a6 100644
+--- a/drivers/gpu/drm/radeon/radeon_audio.h
++++ b/drivers/gpu/drm/radeon/radeon_audio.h
+@@ -79,5 +79,6 @@ void radeon_audio_fini(struct radeon_device *rdev);
+ void radeon_audio_mode_set(struct drm_encoder *encoder,
+ 	struct drm_display_mode *mode);
+ void radeon_audio_dpms(struct drm_encoder *encoder, int mode);
++unsigned int radeon_audio_decode_dfs_div(unsigned int div);
+ 
+ #endif
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index 604c44d88e7a..ccab94ed9d94 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -1734,6 +1734,7 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
+ 	}
+ 
+ 	drm_kms_helper_poll_enable(dev);
++	drm_helper_hpd_irq_event(dev);
+ 
+ 	/* set the power state here in case we are a PX system or headless */
+ 	if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled)
+diff --git a/drivers/gpu/drm/radeon/radeon_dp_mst.c b/drivers/gpu/drm/radeon/radeon_dp_mst.c
+index 42986130cc63..c9ff4cf4c4e7 100644
+--- a/drivers/gpu/drm/radeon/radeon_dp_mst.c
++++ b/drivers/gpu/drm/radeon/radeon_dp_mst.c
+@@ -287,9 +287,9 @@ static struct drm_connector *radeon_dp_add_mst_connector(struct drm_dp_mst_topol
+ 	drm_mode_connector_set_path_property(connector, pathprop);
+ 	drm_reinit_primary_mode_group(dev);
+ 
+-	mutex_lock(&dev->mode_config.mutex);
++	drm_modeset_lock_all(dev);
+ 	radeon_fb_add_connector(rdev, connector);
+-	mutex_unlock(&dev->mode_config.mutex);
++	drm_modeset_unlock_all(dev);
+ 
+ 	drm_connector_register(connector);
+ 	return connector;
+@@ -304,12 +304,12 @@ static void radeon_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ 
+ 	drm_connector_unregister(connector);
+ 	/* need to nuke the connector */
+-	mutex_lock(&dev->mode_config.mutex);
++	drm_modeset_lock_all(dev);
+ 	/* dpms off */
+ 	radeon_fb_remove_connector(rdev, connector);
+ 
+ 	drm_connector_cleanup(connector);
+-	mutex_unlock(&dev->mode_config.mutex);
++	drm_modeset_unlock_all(dev);
+ 	drm_reinit_primary_mode_group(dev);
+ 
+ 
+diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
+index 676362769b8d..741065bd14b3 100644
+--- a/drivers/gpu/drm/radeon/radeon_object.c
++++ b/drivers/gpu/drm/radeon/radeon_object.c
+@@ -33,6 +33,7 @@
+ #include <linux/slab.h>
+ #include <drm/drmP.h>
+ #include <drm/radeon_drm.h>
++#include <drm/drm_cache.h>
+ #include "radeon.h"
+ #include "radeon_trace.h"
+ 
+@@ -225,7 +226,7 @@ int radeon_bo_create(struct radeon_device *rdev,
+ 	/* XXX: Write-combined CPU mappings of GTT seem broken on 32-bit
+ 	 * See https://bugs.freedesktop.org/show_bug.cgi?id=84627
+ 	 */
+-	bo->flags &= ~RADEON_GEM_GTT_WC;
++	bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
+ #elif defined(CONFIG_X86) && !defined(CONFIG_X86_PAT)
+ 	/* Don't try to enable write-combining when it can't work, or things
+ 	 * may be slow
+@@ -237,7 +238,13 @@ int radeon_bo_create(struct radeon_device *rdev,
+ 
+ 	DRM_INFO_ONCE("Please enable CONFIG_MTRR and CONFIG_X86_PAT for "
+ 		      "better performance thanks to write-combining\n");
+-	bo->flags &= ~RADEON_GEM_GTT_WC;
++	bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
++#else
++	/* For architectures that don't support WC memory,
++	 * mask out the WC flag from the BO
++	 */
++	if (!drm_arch_can_wc_memory())
++		bo->flags &= ~RADEON_GEM_GTT_WC;
+ #endif
+ 
+ 	radeon_ttm_placement_from_domain(bo, domain);
+diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
+index 9c3377ca17b7..8ec4e4591756 100644
+--- a/drivers/gpu/drm/radeon/radeon_vm.c
++++ b/drivers/gpu/drm/radeon/radeon_vm.c
+@@ -456,15 +456,15 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
+ 
+ 	if (soffset) {
+ 		/* make sure object fit at this offset */
+-		eoffset = soffset + size;
++		eoffset = soffset + size - 1;
+ 		if (soffset >= eoffset) {
+ 			r = -EINVAL;
+ 			goto error_unreserve;
+ 		}
+ 
+ 		last_pfn = eoffset / RADEON_GPU_PAGE_SIZE;
+-		if (last_pfn > rdev->vm_manager.max_pfn) {
+-			dev_err(rdev->dev, "va above limit (0x%08X > 0x%08X)\n",
++		if (last_pfn >= rdev->vm_manager.max_pfn) {
++			dev_err(rdev->dev, "va above limit (0x%08X >= 0x%08X)\n",
+ 				last_pfn, rdev->vm_manager.max_pfn);
+ 			r = -EINVAL;
+ 			goto error_unreserve;
+@@ -479,7 +479,7 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
+ 	eoffset /= RADEON_GPU_PAGE_SIZE;
+ 	if (soffset || eoffset) {
+ 		struct interval_tree_node *it;
+-		it = interval_tree_iter_first(&vm->va, soffset, eoffset - 1);
++		it = interval_tree_iter_first(&vm->va, soffset, eoffset);
+ 		if (it && it != &bo_va->it) {
+ 			struct radeon_bo_va *tmp;
+ 			tmp = container_of(it, struct radeon_bo_va, it);
+@@ -522,7 +522,7 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
+ 
+ 	if (soffset || eoffset) {
+ 		bo_va->it.start = soffset;
+-		bo_va->it.last = eoffset - 1;
++		bo_va->it.last = eoffset;
+ 		interval_tree_insert(&bo_va->it, &vm->va);
+ 	}
+ 
+@@ -891,7 +891,7 @@ static void radeon_vm_fence_pts(struct radeon_vm *vm,
+ 	unsigned i;
+ 
+ 	start >>= radeon_vm_block_size;
+-	end >>= radeon_vm_block_size;
++	end = (end - 1) >> radeon_vm_block_size;
+ 
+ 	for (i = start; i <= end; ++i)
+ 		radeon_bo_fence(vm->page_tables[i].bo, fence, true);
+diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
+index 3afac3013983..c126f6bfbed1 100644
+--- a/drivers/gpu/drm/radeon/sid.h
++++ b/drivers/gpu/drm/radeon/sid.h
+@@ -915,6 +915,11 @@
+ #define DCCG_AUDIO_DTO1_PHASE                           0x05c0
+ #define DCCG_AUDIO_DTO1_MODULE                          0x05c4
+ 
++#define DENTIST_DISPCLK_CNTL				0x0490
++#	define DENTIST_DPREFCLK_WDIVIDER(x)		(((x) & 0x7f) << 24)
++#	define DENTIST_DPREFCLK_WDIVIDER_MASK		(0x7f << 24)
++#	define DENTIST_DPREFCLK_WDIVIDER_SHIFT		24
++
+ #define AFMT_AUDIO_SRC_CONTROL                          0x713c
+ #define		AFMT_AUDIO_SRC_SELECT(x)		(((x) & 7) << 0)
+ /* AFMT_AUDIO_SRC_SELECT
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index 15a8d7746fd2..2aa0e927d490 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -25,6 +25,7 @@
+  *
+  **************************************************************************/
+ #include <linux/module.h>
++#include <linux/console.h>
+ 
+ #include <drm/drmP.h>
+ #include "vmwgfx_drv.h"
+@@ -1447,6 +1448,12 @@ static int vmw_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ static int __init vmwgfx_init(void)
+ {
+ 	int ret;
++
++#ifdef CONFIG_VGA_CONSOLE
++	if (vgacon_text_force())
++		return -EINVAL;
++#endif
++
+ 	ret = drm_pci_init(&driver, &vmw_pci_driver);
+ 	if (ret)
+ 		DRM_ERROR("Failed initializing DRM.\n");
+diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c
+index 894531d315b8..046144fc5aff 100644
+--- a/drivers/hwtracing/coresight/coresight.c
++++ b/drivers/hwtracing/coresight/coresight.c
+@@ -543,7 +543,7 @@ static int coresight_name_match(struct device *dev, void *data)
+ 	to_match = data;
+ 	i_csdev = to_coresight_device(dev);
+ 
+-	if (!strcmp(to_match, dev_name(&i_csdev->dev)))
++	if (to_match && !strcmp(to_match, dev_name(&i_csdev->dev)))
+ 		return 1;
+ 
+ 	return 0;
+diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
+index 4fa88ba2963e..131994382b22 100644
+--- a/drivers/infiniband/hw/qib/qib_qp.c
++++ b/drivers/infiniband/hw/qib/qib_qp.c
+@@ -100,9 +100,10 @@ static u32 credit_table[31] = {
+ 	32768                   /* 1E */
+ };
+ 
+-static void get_map_page(struct qib_qpn_table *qpt, struct qpn_map *map)
++static void get_map_page(struct qib_qpn_table *qpt, struct qpn_map *map,
++			 gfp_t gfp)
+ {
+-	unsigned long page = get_zeroed_page(GFP_KERNEL);
++	unsigned long page = get_zeroed_page(gfp);
+ 
+ 	/*
+ 	 * Free the page if someone raced with us installing it.
+@@ -121,7 +122,7 @@ static void get_map_page(struct qib_qpn_table *qpt, struct qpn_map *map)
+  * zero/one for QP type IB_QPT_SMI/IB_QPT_GSI.
+  */
+ static int alloc_qpn(struct qib_devdata *dd, struct qib_qpn_table *qpt,
+-		     enum ib_qp_type type, u8 port)
++		     enum ib_qp_type type, u8 port, gfp_t gfp)
+ {
+ 	u32 i, offset, max_scan, qpn;
+ 	struct qpn_map *map;
+@@ -151,7 +152,7 @@ static int alloc_qpn(struct qib_devdata *dd, struct qib_qpn_table *qpt,
+ 	max_scan = qpt->nmaps - !offset;
+ 	for (i = 0;;) {
+ 		if (unlikely(!map->page)) {
+-			get_map_page(qpt, map);
++			get_map_page(qpt, map, gfp);
+ 			if (unlikely(!map->page))
+ 				break;
+ 		}
+@@ -983,13 +984,21 @@ struct ib_qp *qib_create_qp(struct ib_pd *ibpd,
+ 	size_t sz;
+ 	size_t sg_list_sz;
+ 	struct ib_qp *ret;
++	gfp_t gfp;
++
+ 
+ 	if (init_attr->cap.max_send_sge > ib_qib_max_sges ||
+ 	    init_attr->cap.max_send_wr > ib_qib_max_qp_wrs ||
+-	    init_attr->create_flags) {
+-		ret = ERR_PTR(-EINVAL);
+-		goto bail;
+-	}
++	    init_attr->create_flags & ~(IB_QP_CREATE_USE_GFP_NOIO))
++		return ERR_PTR(-EINVAL);
++
++	/* GFP_NOIO is applicable in RC QPs only */
++	if (init_attr->create_flags & IB_QP_CREATE_USE_GFP_NOIO &&
++	    init_attr->qp_type != IB_QPT_RC)
++		return ERR_PTR(-EINVAL);
++
++	gfp = init_attr->create_flags & IB_QP_CREATE_USE_GFP_NOIO ?
++			GFP_NOIO : GFP_KERNEL;
+ 
+ 	/* Check receive queue parameters if no SRQ is specified. */
+ 	if (!init_attr->srq) {
+@@ -1021,7 +1030,8 @@ struct ib_qp *qib_create_qp(struct ib_pd *ibpd,
+ 		sz = sizeof(struct qib_sge) *
+ 			init_attr->cap.max_send_sge +
+ 			sizeof(struct qib_swqe);
+-		swq = vmalloc((init_attr->cap.max_send_wr + 1) * sz);
++		swq = __vmalloc((init_attr->cap.max_send_wr + 1) * sz,
++				gfp, PAGE_KERNEL);
+ 		if (swq == NULL) {
+ 			ret = ERR_PTR(-ENOMEM);
+ 			goto bail;
+@@ -1037,13 +1047,13 @@ struct ib_qp *qib_create_qp(struct ib_pd *ibpd,
+ 		} else if (init_attr->cap.max_recv_sge > 1)
+ 			sg_list_sz = sizeof(*qp->r_sg_list) *
+ 				(init_attr->cap.max_recv_sge - 1);
+-		qp = kzalloc(sz + sg_list_sz, GFP_KERNEL);
++		qp = kzalloc(sz + sg_list_sz, gfp);
+ 		if (!qp) {
+ 			ret = ERR_PTR(-ENOMEM);
+ 			goto bail_swq;
+ 		}
+ 		RCU_INIT_POINTER(qp->next, NULL);
+-		qp->s_hdr = kzalloc(sizeof(*qp->s_hdr), GFP_KERNEL);
++		qp->s_hdr = kzalloc(sizeof(*qp->s_hdr), gfp);
+ 		if (!qp->s_hdr) {
+ 			ret = ERR_PTR(-ENOMEM);
+ 			goto bail_qp;
+@@ -1058,8 +1068,16 @@ struct ib_qp *qib_create_qp(struct ib_pd *ibpd,
+ 			qp->r_rq.max_sge = init_attr->cap.max_recv_sge;
+ 			sz = (sizeof(struct ib_sge) * qp->r_rq.max_sge) +
+ 				sizeof(struct qib_rwqe);
+-			qp->r_rq.wq = vmalloc_user(sizeof(struct qib_rwq) +
+-						   qp->r_rq.size * sz);
++			if (gfp != GFP_NOIO)
++				qp->r_rq.wq = vmalloc_user(
++						sizeof(struct qib_rwq) +
++						qp->r_rq.size * sz);
++			else
++				qp->r_rq.wq = __vmalloc(
++						sizeof(struct qib_rwq) +
++						qp->r_rq.size * sz,
++						gfp, PAGE_KERNEL);
++
+ 			if (!qp->r_rq.wq) {
+ 				ret = ERR_PTR(-ENOMEM);
+ 				goto bail_qp;
+@@ -1090,7 +1108,7 @@ struct ib_qp *qib_create_qp(struct ib_pd *ibpd,
+ 		dev = to_idev(ibpd->device);
+ 		dd = dd_from_dev(dev);
+ 		err = alloc_qpn(dd, &dev->qpn_table, init_attr->qp_type,
+-				init_attr->port_num);
++				init_attr->port_num, gfp);
+ 		if (err < 0) {
+ 			ret = ERR_PTR(err);
+ 			vfree(qp->r_rq.wq);
+diff --git a/drivers/infiniband/hw/qib/qib_verbs_mcast.c b/drivers/infiniband/hw/qib/qib_verbs_mcast.c
+index f8ea069a3eaf..b2fb5286dbd9 100644
+--- a/drivers/infiniband/hw/qib/qib_verbs_mcast.c
++++ b/drivers/infiniband/hw/qib/qib_verbs_mcast.c
+@@ -286,15 +286,13 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+ 	struct qib_ibdev *dev = to_idev(ibqp->device);
+ 	struct qib_ibport *ibp = to_iport(ibqp->device, qp->port_num);
+ 	struct qib_mcast *mcast = NULL;
+-	struct qib_mcast_qp *p, *tmp;
++	struct qib_mcast_qp *p, *tmp, *delp = NULL;
+ 	struct rb_node *n;
+ 	int last = 0;
+ 	int ret;
+ 
+-	if (ibqp->qp_num <= 1 || qp->state == IB_QPS_RESET) {
+-		ret = -EINVAL;
+-		goto bail;
+-	}
++	if (ibqp->qp_num <= 1 || qp->state == IB_QPS_RESET)
++		return -EINVAL;
+ 
+ 	spin_lock_irq(&ibp->lock);
+ 
+@@ -303,8 +301,7 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+ 	while (1) {
+ 		if (n == NULL) {
+ 			spin_unlock_irq(&ibp->lock);
+-			ret = -EINVAL;
+-			goto bail;
++			return -EINVAL;
+ 		}
+ 
+ 		mcast = rb_entry(n, struct qib_mcast, rb_node);
+@@ -328,6 +325,7 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+ 		 */
+ 		list_del_rcu(&p->list);
+ 		mcast->n_attached--;
++		delp = p;
+ 
+ 		/* If this was the last attached QP, remove the GID too. */
+ 		if (list_empty(&mcast->qp_list)) {
+@@ -338,15 +336,16 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+ 	}
+ 
+ 	spin_unlock_irq(&ibp->lock);
++	/* QP not attached */
++	if (!delp)
++		return -EINVAL;
++	/*
++	 * Wait for any list walkers to finish before freeing the
++	 * list element.
++	 */
++	wait_event(mcast->wait, atomic_read(&mcast->refcount) <= 1);
++	qib_mcast_qp_free(delp);
+ 
+-	if (p) {
+-		/*
+-		 * Wait for any list walkers to finish before freeing the
+-		 * list element.
+-		 */
+-		wait_event(mcast->wait, atomic_read(&mcast->refcount) <= 1);
+-		qib_mcast_qp_free(p);
+-	}
+ 	if (last) {
+ 		atomic_dec(&mcast->refcount);
+ 		wait_event(mcast->wait, !atomic_read(&mcast->refcount));
+@@ -355,11 +354,7 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+ 		dev->n_mcast_grps_allocated--;
+ 		spin_unlock_irq(&dev->n_mcast_grps_lock);
+ 	}
+-
+-	ret = 0;
+-
+-bail:
+-	return ret;
++	return 0;
+ }
+ 
+ int qib_mcast_tree_empty(struct qib_ibport *ibp)
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index ce3d40004458..0f5b400706d7 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1214,7 +1214,7 @@ static int elantech_set_input_params(struct psmouse *psmouse)
+ 			input_set_abs_params(dev, ABS_TOOL_WIDTH, ETP_WMIN_V2,
+ 					     ETP_WMAX_V2, 0, 0);
+ 		}
+-		input_mt_init_slots(dev, 2, 0);
++		input_mt_init_slots(dev, 2, INPUT_MT_SEMI_MT);
+ 		input_set_abs_params(dev, ABS_MT_POSITION_X, x_min, x_max, 0, 0);
+ 		input_set_abs_params(dev, ABS_MT_POSITION_Y, y_min, y_max, 0, 0);
+ 		break;
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index c11556563ef0..68f5f4a0f1e7 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -258,6 +258,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ 		},
+ 	},
+ 	{
++		/* Fujitsu Lifebook U745 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U745"),
++		},
++	},
++	{
+ 		/* Fujitsu T70H */
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
+index e29d5d7fe220..937832cfa48e 100644
+--- a/drivers/iommu/io-pgtable-arm.c
++++ b/drivers/iommu/io-pgtable-arm.c
+@@ -341,17 +341,18 @@ static void __arm_lpae_free_pgtable(struct arm_lpae_io_pgtable *data, int lvl,
+ 	arm_lpae_iopte *start, *end;
+ 	unsigned long table_size;
+ 
+-	/* Only leaf entries at the last level */
+-	if (lvl == ARM_LPAE_MAX_LEVELS - 1)
+-		return;
+-
+ 	if (lvl == ARM_LPAE_START_LVL(data))
+ 		table_size = data->pgd_size;
+ 	else
+ 		table_size = 1UL << data->pg_shift;
+ 
+ 	start = ptep;
+-	end = (void *)ptep + table_size;
++
++	/* Only leaf entries at the last level */
++	if (lvl == ARM_LPAE_MAX_LEVELS - 1)
++		end = ptep;
++	else
++		end = (void *)ptep + table_size;
+ 
+ 	while (ptep != end) {
+ 		arm_lpae_iopte pte = *ptep++;
+diff --git a/drivers/irqchip/irq-atmel-aic-common.c b/drivers/irqchip/irq-atmel-aic-common.c
+index 63cd031b2c28..869d01dd4063 100644
+--- a/drivers/irqchip/irq-atmel-aic-common.c
++++ b/drivers/irqchip/irq-atmel-aic-common.c
+@@ -86,7 +86,7 @@ int aic_common_set_priority(int priority, unsigned *val)
+ 	    priority > AT91_AIC_IRQ_MAX_PRIORITY)
+ 		return -EINVAL;
+ 
+-	*val &= AT91_AIC_PRIOR;
++	*val &= ~AT91_AIC_PRIOR;
+ 	*val |= priority;
+ 
+ 	return 0;
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 00cde40db572..43829d9493f7 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -1741,6 +1741,7 @@ static void bch_btree_gc(struct cache_set *c)
+ 	do {
+ 		ret = btree_root(gc_root, c, &op, &writes, &stats);
+ 		closure_sync(&writes);
++		cond_resched();
+ 
+ 		if (ret && ret != -EAGAIN)
+ 			pr_warn("gc failed!");
+@@ -2162,8 +2163,10 @@ int bch_btree_insert_check_key(struct btree *b, struct btree_op *op,
+ 		rw_lock(true, b, b->level);
+ 
+ 		if (b->key.ptr[0] != btree_ptr ||
+-		    b->seq != seq + 1)
++                   b->seq != seq + 1) {
++                       op->lock = b->level;
+ 			goto out;
++               }
+ 	}
+ 
+ 	SET_KEY_PTRS(check_key, 1);
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 4dd2bb7167f0..42522c8f13c6 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -708,6 +708,8 @@ static void bcache_device_link(struct bcache_device *d, struct cache_set *c,
+ 	WARN(sysfs_create_link(&d->kobj, &c->kobj, "cache") ||
+ 	     sysfs_create_link(&c->kobj, &d->kobj, d->name),
+ 	     "Couldn't create device <-> cache set symlinks");
++
++	clear_bit(BCACHE_DEV_UNLINK_DONE, &d->flags);
+ }
+ 
+ static void bcache_device_detach(struct bcache_device *d)
+@@ -878,8 +880,11 @@ void bch_cached_dev_run(struct cached_dev *dc)
+ 	buf[SB_LABEL_SIZE] = '\0';
+ 	env[2] = kasprintf(GFP_KERNEL, "CACHED_LABEL=%s", buf);
+ 
+-	if (atomic_xchg(&dc->running, 1))
++	if (atomic_xchg(&dc->running, 1)) {
++		kfree(env[1]);
++		kfree(env[2]);
+ 		return;
++	}
+ 
+ 	if (!d->c &&
+ 	    BDEV_STATE(&dc->sb) != BDEV_STATE_NONE) {
+@@ -1967,6 +1972,8 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ 			else
+ 				err = "device busy";
+ 			mutex_unlock(&bch_register_lock);
++			if (attr == &ksysfs_register_quiet)
++				goto out;
+ 		}
+ 		goto err;
+ 	}
+@@ -2005,8 +2012,7 @@ out:
+ err_close:
+ 	blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+ err:
+-	if (attr != &ksysfs_register_quiet)
+-		pr_info("error opening %s: %s", path, err);
++	pr_info("error opening %s: %s", path, err);
+ 	ret = -EINVAL;
+ 	goto out;
+ }
+@@ -2100,8 +2106,10 @@ static int __init bcache_init(void)
+ 	closure_debug_init();
+ 
+ 	bcache_major = register_blkdev(0, "bcache");
+-	if (bcache_major < 0)
++	if (bcache_major < 0) {
++		unregister_reboot_notifier(&reboot);
+ 		return bcache_major;
++	}
+ 
+ 	if (!(bcache_wq = create_workqueue("bcache")) ||
+ 	    !(bcache_kobj = kobject_create_and_add("bcache", fs_kobj)) ||
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index f1986bcd1bf0..540256a0df4f 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -323,6 +323,10 @@ void bcache_dev_sectors_dirty_add(struct cache_set *c, unsigned inode,
+ 
+ static bool dirty_pred(struct keybuf *buf, struct bkey *k)
+ {
++	struct cached_dev *dc = container_of(buf, struct cached_dev, writeback_keys);
++
++	BUG_ON(KEY_INODE(k) != dc->disk.id);
++
+ 	return KEY_DIRTY(k);
+ }
+ 
+@@ -372,11 +376,24 @@ next:
+ 	}
+ }
+ 
++/*
++ * Returns true if we scanned the entire disk
++ */
+ static bool refill_dirty(struct cached_dev *dc)
+ {
+ 	struct keybuf *buf = &dc->writeback_keys;
++	struct bkey start = KEY(dc->disk.id, 0, 0);
+ 	struct bkey end = KEY(dc->disk.id, MAX_KEY_OFFSET, 0);
+-	bool searched_from_start = false;
++	struct bkey start_pos;
++
++	/*
++	 * make sure keybuf pos is inside the range for this disk - at bringup
++	 * we might not be attached yet so this disk's inode nr isn't
++	 * initialized then
++	 */
++	if (bkey_cmp(&buf->last_scanned, &start) < 0 ||
++	    bkey_cmp(&buf->last_scanned, &end) > 0)
++		buf->last_scanned = start;
+ 
+ 	if (dc->partial_stripes_expensive) {
+ 		refill_full_stripes(dc);
+@@ -384,14 +401,20 @@ static bool refill_dirty(struct cached_dev *dc)
+ 			return false;
+ 	}
+ 
+-	if (bkey_cmp(&buf->last_scanned, &end) >= 0) {
+-		buf->last_scanned = KEY(dc->disk.id, 0, 0);
+-		searched_from_start = true;
+-	}
+-
++	start_pos = buf->last_scanned;
+ 	bch_refill_keybuf(dc->disk.c, buf, &end, dirty_pred);
+ 
+-	return bkey_cmp(&buf->last_scanned, &end) >= 0 && searched_from_start;
++	if (bkey_cmp(&buf->last_scanned, &end) < 0)
++		return false;
++
++	/*
++	 * If we get to the end start scanning again from the beginning, and
++	 * only scan up to where we initially started scanning from:
++	 */
++	buf->last_scanned = start;
++	bch_refill_keybuf(dc->disk.c, buf, &start_pos, dirty_pred);
++
++	return bkey_cmp(&buf->last_scanned, &start_pos) >= 0;
+ }
+ 
+ static int bch_writeback_thread(void *arg)
+diff --git a/drivers/md/bcache/writeback.h b/drivers/md/bcache/writeback.h
+index 0a9dab187b79..073a042aed24 100644
+--- a/drivers/md/bcache/writeback.h
++++ b/drivers/md/bcache/writeback.h
+@@ -63,7 +63,8 @@ static inline bool should_writeback(struct cached_dev *dc, struct bio *bio,
+ 
+ static inline void bch_writeback_queue(struct cached_dev *dc)
+ {
+-	wake_up_process(dc->writeback_thread);
++	if (!IS_ERR_OR_NULL(dc->writeback_thread))
++		wake_up_process(dc->writeback_thread);
+ }
+ 
+ static inline void bch_writeback_add(struct cached_dev *dc)
+diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h
+index 0b2536247cf5..84e27708ad97 100644
+--- a/drivers/md/dm-exception-store.h
++++ b/drivers/md/dm-exception-store.h
+@@ -70,7 +70,7 @@ struct dm_exception_store_type {
+ 	 * Update the metadata with this exception.
+ 	 */
+ 	void (*commit_exception) (struct dm_exception_store *store,
+-				  struct dm_exception *e,
++				  struct dm_exception *e, int valid,
+ 				  void (*callback) (void *, int success),
+ 				  void *callback_context);
+ 
+diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
+index 808b8419bc48..9feb894e5565 100644
+--- a/drivers/md/dm-snap-persistent.c
++++ b/drivers/md/dm-snap-persistent.c
+@@ -694,7 +694,7 @@ static int persistent_prepare_exception(struct dm_exception_store *store,
+ }
+ 
+ static void persistent_commit_exception(struct dm_exception_store *store,
+-					struct dm_exception *e,
++					struct dm_exception *e, int valid,
+ 					void (*callback) (void *, int success),
+ 					void *callback_context)
+ {
+@@ -703,6 +703,9 @@ static void persistent_commit_exception(struct dm_exception_store *store,
+ 	struct core_exception ce;
+ 	struct commit_callback *cb;
+ 
++	if (!valid)
++		ps->valid = 0;
++
+ 	ce.old_chunk = e->old_chunk;
+ 	ce.new_chunk = e->new_chunk;
+ 	write_exception(ps, ps->current_committed++, &ce);
+diff --git a/drivers/md/dm-snap-transient.c b/drivers/md/dm-snap-transient.c
+index 1ce9a2586e41..31439d53cf7e 100644
+--- a/drivers/md/dm-snap-transient.c
++++ b/drivers/md/dm-snap-transient.c
+@@ -52,12 +52,12 @@ static int transient_prepare_exception(struct dm_exception_store *store,
+ }
+ 
+ static void transient_commit_exception(struct dm_exception_store *store,
+-				       struct dm_exception *e,
++				       struct dm_exception *e, int valid,
+ 				       void (*callback) (void *, int success),
+ 				       void *callback_context)
+ {
+ 	/* Just succeed */
+-	callback(callback_context, 1);
++	callback(callback_context, valid);
+ }
+ 
+ static void transient_usage(struct dm_exception_store *store,
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index f83a0f3fc365..11ec9d2a27df 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -1428,8 +1428,9 @@ static void __invalidate_snapshot(struct dm_snapshot *s, int err)
+ 	dm_table_event(s->ti->table);
+ }
+ 
+-static void pending_complete(struct dm_snap_pending_exception *pe, int success)
++static void pending_complete(void *context, int success)
+ {
++	struct dm_snap_pending_exception *pe = context;
+ 	struct dm_exception *e;
+ 	struct dm_snapshot *s = pe->snap;
+ 	struct bio *origin_bios = NULL;
+@@ -1500,24 +1501,13 @@ out:
+ 	free_pending_exception(pe);
+ }
+ 
+-static void commit_callback(void *context, int success)
+-{
+-	struct dm_snap_pending_exception *pe = context;
+-
+-	pending_complete(pe, success);
+-}
+-
+ static void complete_exception(struct dm_snap_pending_exception *pe)
+ {
+ 	struct dm_snapshot *s = pe->snap;
+ 
+-	if (unlikely(pe->copy_error))
+-		pending_complete(pe, 0);
+-
+-	else
+-		/* Update the metadata if we are persistent */
+-		s->store->type->commit_exception(s->store, &pe->e,
+-						 commit_callback, pe);
++	/* Update the metadata if we are persistent */
++	s->store->type->commit_exception(s->store, &pe->e, !pe->copy_error,
++					 pending_complete, pe);
+ }
+ 
+ /*
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 7073b22d4cb4..cb58bb318782 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -3210,8 +3210,8 @@ static void pool_postsuspend(struct dm_target *ti)
+ 	struct pool_c *pt = ti->private;
+ 	struct pool *pool = pt->pool;
+ 
+-	cancel_delayed_work(&pool->waker);
+-	cancel_delayed_work(&pool->no_space_timeout);
++	cancel_delayed_work_sync(&pool->waker);
++	cancel_delayed_work_sync(&pool->no_space_timeout);
+ 	flush_workqueue(pool->wq);
+ 	(void) commit(pool);
+ }
+diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
+index 882ca417f328..3ab874703d11 100644
+--- a/drivers/media/dvb-core/dvb_frontend.c
++++ b/drivers/media/dvb-core/dvb_frontend.c
+@@ -2333,9 +2333,9 @@ static int dvb_frontend_ioctl_legacy(struct file *file,
+ 		dev_dbg(fe->dvb->device, "%s: current delivery system on cache: %d, V3 type: %d\n",
+ 				 __func__, c->delivery_system, fe->ops.info.type);
+ 
+-		/* Force the CAN_INVERSION_AUTO bit on. If the frontend doesn't
+-		 * do it, it is done for it. */
+-		info->caps |= FE_CAN_INVERSION_AUTO;
++		/* Set CAN_INVERSION_AUTO bit on in other than oneshot mode */
++		if (!(fepriv->tune_mode_flags & FE_TUNE_MODE_ONESHOT))
++			info->caps |= FE_CAN_INVERSION_AUTO;
+ 		err = 0;
+ 		break;
+ 	}
+diff --git a/drivers/media/dvb-frontends/tda1004x.c b/drivers/media/dvb-frontends/tda1004x.c
+index a2631be7ffac..08e0f0dd8728 100644
+--- a/drivers/media/dvb-frontends/tda1004x.c
++++ b/drivers/media/dvb-frontends/tda1004x.c
+@@ -903,9 +903,18 @@ static int tda1004x_get_fe(struct dvb_frontend *fe)
+ {
+ 	struct dtv_frontend_properties *fe_params = &fe->dtv_property_cache;
+ 	struct tda1004x_state* state = fe->demodulator_priv;
++	int status;
+ 
+ 	dprintk("%s\n", __func__);
+ 
++	status = tda1004x_read_byte(state, TDA1004X_STATUS_CD);
++	if (status == -1)
++		return -EIO;
++
++	/* Only update the properties cache if device is locked */
++	if (!(status & 8))
++		return 0;
++
+ 	// inversion status
+ 	fe_params->inversion = INVERSION_OFF;
+ 	if (tda1004x_read_byte(state, TDA1004X_CONFC1) & 0x20)
+diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c
+index ac3cd74e824e..067db727e685 100644
+--- a/drivers/media/pci/saa7134/saa7134-alsa.c
++++ b/drivers/media/pci/saa7134/saa7134-alsa.c
+@@ -1218,6 +1218,8 @@ static int alsa_device_init(struct saa7134_dev *dev)
+ 
+ static int alsa_device_exit(struct saa7134_dev *dev)
+ {
++	if (!snd_saa7134_cards[dev->nr])
++		return 1;
+ 
+ 	snd_card_free(snd_saa7134_cards[dev->nr]);
+ 	snd_saa7134_cards[dev->nr] = NULL;
+@@ -1267,7 +1269,8 @@ static void saa7134_alsa_exit(void)
+ 	int idx;
+ 
+ 	for (idx = 0; idx < SNDRV_CARDS; idx++) {
+-		snd_card_free(snd_saa7134_cards[idx]);
++		if (snd_saa7134_cards[idx])
++			snd_card_free(snd_saa7134_cards[idx]);
+ 	}
+ 
+ 	saa7134_dmasound_init = NULL;
+diff --git a/drivers/media/rc/sunxi-cir.c b/drivers/media/rc/sunxi-cir.c
+index 7830aef3db45..40f77685cc4a 100644
+--- a/drivers/media/rc/sunxi-cir.c
++++ b/drivers/media/rc/sunxi-cir.c
+@@ -153,6 +153,8 @@ static int sunxi_ir_probe(struct platform_device *pdev)
+ 	if (!ir)
+ 		return -ENOMEM;
+ 
++	spin_lock_init(&ir->ir_lock);
++
+ 	if (of_device_is_compatible(dn, "allwinner,sun5i-a13-ir"))
+ 		ir->fifo_size = 64;
+ 	else
+diff --git a/drivers/media/usb/gspca/ov534.c b/drivers/media/usb/gspca/ov534.c
+index 146071b8e116..bfff1d1c70ab 100644
+--- a/drivers/media/usb/gspca/ov534.c
++++ b/drivers/media/usb/gspca/ov534.c
+@@ -1491,8 +1491,13 @@ static void sd_set_streamparm(struct gspca_dev *gspca_dev,
+ 	struct v4l2_fract *tpf = &cp->timeperframe;
+ 	struct sd *sd = (struct sd *) gspca_dev;
+ 
+-	/* Set requested framerate */
+-	sd->frame_rate = tpf->denominator / tpf->numerator;
++	if (tpf->numerator == 0 || tpf->denominator == 0)
++		/* Set default framerate */
++		sd->frame_rate = 30;
++	else
++		/* Set requested framerate */
++		sd->frame_rate = tpf->denominator / tpf->numerator;
++
+ 	if (gspca_dev->streaming)
+ 		set_frame_rate(gspca_dev);
+ 
+diff --git a/drivers/media/usb/gspca/topro.c b/drivers/media/usb/gspca/topro.c
+index c70ff406b07a..c028a5c2438e 100644
+--- a/drivers/media/usb/gspca/topro.c
++++ b/drivers/media/usb/gspca/topro.c
+@@ -4802,7 +4802,11 @@ static void sd_set_streamparm(struct gspca_dev *gspca_dev,
+ 	struct v4l2_fract *tpf = &cp->timeperframe;
+ 	int fr, i;
+ 
+-	sd->framerate = tpf->denominator / tpf->numerator;
++	if (tpf->numerator == 0 || tpf->denominator == 0)
++		sd->framerate = 30;
++	else
++		sd->framerate = tpf->denominator / tpf->numerator;
++
+ 	if (gspca_dev->streaming)
+ 		setframerate(gspca_dev, v4l2_ctrl_g_ctrl(gspca_dev->exposure));
+ 
+diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
+index cf9d644a8aff..472eaad6fb78 100644
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -2662,10 +2662,10 @@ unsigned int vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait)
+ 		return res | POLLERR;
+ 
+ 	/*
+-	 * For output streams you can write as long as there are fewer buffers
+-	 * queued than there are buffers available.
++	 * For output streams you can call write() as long as there are fewer
++	 * buffers queued than there are buffers available.
+ 	 */
+-	if (V4L2_TYPE_IS_OUTPUT(q->type) && q->queued_count < q->num_buffers)
++	if (V4L2_TYPE_IS_OUTPUT(q->type) && q->fileio && q->queued_count < q->num_buffers)
+ 		return res | POLLOUT | POLLWRNORM;
+ 
+ 	if (list_empty(&q->done_list))
+diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
+index 31a9ef256d06..ce3044883a42 100644
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -661,9 +661,25 @@ static int mmc_sd_init_uhs_card(struct mmc_card *card)
+ 	 * SDR104 mode SD-cards. Note that tuning is mandatory for SDR104.
+ 	 */
+ 	if (!mmc_host_is_spi(card->host) &&
+-	    (card->sd_bus_speed == UHS_SDR50_BUS_SPEED ||
+-	     card->sd_bus_speed == UHS_SDR104_BUS_SPEED))
++		(card->host->ios.timing == MMC_TIMING_UHS_SDR50 ||
++		 card->host->ios.timing == MMC_TIMING_UHS_DDR50 ||
++		 card->host->ios.timing == MMC_TIMING_UHS_SDR104)) {
+ 		err = mmc_execute_tuning(card);
++
++		/*
++		 * As SD Specifications Part1 Physical Layer Specification
++		 * Version 3.01 says, CMD19 tuning is available for unlocked
++		 * cards in transfer state of 1.8V signaling mode. The small
++		 * difference between v3.00 and 3.01 spec means that CMD19
++		 * tuning is also available for DDR50 mode.
++		 */
++		if (err && card->host->ios.timing == MMC_TIMING_UHS_DDR50) {
++			pr_warn("%s: ddr50 tuning failed\n",
++				mmc_hostname(card->host));
++			err = 0;
++		}
++	}
++
+ out:
+ 	kfree(status);
+ 
+diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
+index 5bc6c7dbbd60..941beb3b5fa2 100644
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -566,8 +566,8 @@ static int mmc_sdio_init_uhs_card(struct mmc_card *card)
+ 	 * SDR104 mode SD-cards. Note that tuning is mandatory for SDR104.
+ 	 */
+ 	if (!mmc_host_is_spi(card->host) &&
+-	    ((card->sw_caps.sd3_bus_mode & SD_MODE_UHS_SDR50) ||
+-	     (card->sw_caps.sd3_bus_mode & SD_MODE_UHS_SDR104)))
++	    ((card->host->ios.timing == MMC_TIMING_UHS_SDR50) ||
++	      (card->host->ios.timing == MMC_TIMING_UHS_SDR104)))
+ 		err = mmc_execute_tuning(card);
+ out:
+ 	return err;
+@@ -661,7 +661,7 @@ try_again:
+ 	 */
+ 	if (!powered_resume && (rocr & ocr & R4_18V_PRESENT)) {
+ 		err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180,
+-					ocr);
++					ocr_card);
+ 		if (err == -EAGAIN) {
+ 			sdio_reset(host);
+ 			mmc_go_idle(host);
+diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
+index fb266745f824..acece3299756 100644
+--- a/drivers/mmc/host/mmci.c
++++ b/drivers/mmc/host/mmci.c
+@@ -1886,7 +1886,7 @@ static struct amba_id mmci_ids[] = {
+ 	{
+ 		.id     = 0x00280180,
+ 		.mask   = 0x00ffffff,
+-		.data	= &variant_u300,
++		.data	= &variant_nomadik,
+ 	},
+ 	{
+ 		.id     = 0x00480180,
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index cbaf3df3ebd9..f47c4a8370be 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -555,9 +555,12 @@ static int sdhci_adma_table_pre(struct sdhci_host *host,
+ 
+ 		BUG_ON(len > 65536);
+ 
+-		/* tran, valid */
+-		sdhci_adma_write_desc(host, desc, addr, len, ADMA2_TRAN_VALID);
+-		desc += host->desc_sz;
++		if (len) {
++			/* tran, valid */
++			sdhci_adma_write_desc(host, desc, addr, len,
++					      ADMA2_TRAN_VALID);
++			desc += host->desc_sz;
++		}
+ 
+ 		/*
+ 		 * If this triggers then we have a calculation bug
+@@ -2790,7 +2793,7 @@ static int sdhci_runtime_pm_put(struct sdhci_host *host)
+ 
+ static void sdhci_runtime_pm_bus_on(struct sdhci_host *host)
+ {
+-	if (host->runtime_suspended || host->bus_on)
++	if (host->bus_on)
+ 		return;
+ 	host->bus_on = true;
+ 	pm_runtime_get_noresume(host->mmc->parent);
+@@ -2798,7 +2801,7 @@ static void sdhci_runtime_pm_bus_on(struct sdhci_host *host)
+ 
+ static void sdhci_runtime_pm_bus_off(struct sdhci_host *host)
+ {
+-	if (host->runtime_suspended || !host->bus_on)
++	if (!host->bus_on)
+ 		return;
+ 	host->bus_on = false;
+ 	pm_runtime_put_noidle(host->mmc->parent);
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+new file mode 100644
+index 000000000000..d60a467a983c
+--- /dev/null
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -0,0 +1,2717 @@
++/******************************************************************************
++ *
++ * This file is provided under a dual BSD/GPLv2 license.  When using or
++ * redistributing this file, you may do so under either license.
++ *
++ * GPL LICENSE SUMMARY
++ *
++ * Copyright(c) 2007 - 2015 Intel Corporation. All rights reserved.
++ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
++ * Copyright(c) 2016 Intel Deutschland GmbH
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of version 2 of the GNU General Public License as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
++ * USA
++ *
++ * The full GNU General Public License is included in this distribution
++ * in the file called COPYING.
++ *
++ * Contact Information:
++ *  Intel Linux Wireless <linuxwifi@intel.com>
++ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
++ *
++ * BSD LICENSE
++ *
++ * Copyright(c) 2005 - 2015 Intel Corporation. All rights reserved.
++ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
++ * Copyright(c) 2016 Intel Deutschland GmbH
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ *  * Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *  * Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *  * Neither the name Intel Corporation nor the names of its
++ *    contributors may be used to endorse or promote products derived
++ *    from this software without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
++ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
++ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
++ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
++ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
++ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ *****************************************************************************/
++#include <linux/pci.h>
++#include <linux/pci-aspm.h>
++#include <linux/interrupt.h>
++#include <linux/debugfs.h>
++#include <linux/sched.h>
++#include <linux/bitops.h>
++#include <linux/gfp.h>
++#include <linux/vmalloc.h>
++
++#include "iwl-drv.h"
++#include "iwl-trans.h"
++#include "iwl-csr.h"
++#include "iwl-prph.h"
++#include "iwl-scd.h"
++#include "iwl-agn-hw.h"
++#include "iwl-fw-error-dump.h"
++#include "internal.h"
++#include "iwl-fh.h"
++
++/* extended range in FW SRAM */
++#define IWL_FW_MEM_EXTENDED_START	0x40000
++#define IWL_FW_MEM_EXTENDED_END		0x57FFF
++
++static void iwl_pcie_free_fw_monitor(struct iwl_trans *trans)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++
++	if (!trans_pcie->fw_mon_page)
++		return;
++
++	dma_unmap_page(trans->dev, trans_pcie->fw_mon_phys,
++		       trans_pcie->fw_mon_size, DMA_FROM_DEVICE);
++	__free_pages(trans_pcie->fw_mon_page,
++		     get_order(trans_pcie->fw_mon_size));
++	trans_pcie->fw_mon_page = NULL;
++	trans_pcie->fw_mon_phys = 0;
++	trans_pcie->fw_mon_size = 0;
++}
++
++static void iwl_pcie_alloc_fw_monitor(struct iwl_trans *trans, u8 max_power)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	struct page *page = NULL;
++	dma_addr_t phys;
++	u32 size = 0;
++	u8 power;
++
++	if (!max_power) {
++		/* default max_power is maximum */
++		max_power = 26;
++	} else {
++		max_power += 11;
++	}
++
++	if (WARN(max_power > 26,
++		 "External buffer size for monitor is too big %d, check the FW TLV\n",
++		 max_power))
++		return;
++
++	if (trans_pcie->fw_mon_page) {
++		dma_sync_single_for_device(trans->dev, trans_pcie->fw_mon_phys,
++					   trans_pcie->fw_mon_size,
++					   DMA_FROM_DEVICE);
++		return;
++	}
++
++	phys = 0;
++	for (power = max_power; power >= 11; power--) {
++		int order;
++
++		size = BIT(power);
++		order = get_order(size);
++		page = alloc_pages(__GFP_COMP | __GFP_NOWARN | __GFP_ZERO,
++				   order);
++		if (!page)
++			continue;
++
++		phys = dma_map_page(trans->dev, page, 0, PAGE_SIZE << order,
++				    DMA_FROM_DEVICE);
++		if (dma_mapping_error(trans->dev, phys)) {
++			__free_pages(page, order);
++			page = NULL;
++			continue;
++		}
++		IWL_INFO(trans,
++			 "Allocated 0x%08x bytes (order %d) for firmware monitor.\n",
++			 size, order);
++		break;
++	}
++
++	if (WARN_ON_ONCE(!page))
++		return;
++
++	if (power != max_power)
++		IWL_ERR(trans,
++			"Sorry - debug buffer is only %luK while you requested %luK\n",
++			(unsigned long)BIT(power - 10),
++			(unsigned long)BIT(max_power - 10));
++
++	trans_pcie->fw_mon_page = page;
++	trans_pcie->fw_mon_phys = phys;
++	trans_pcie->fw_mon_size = size;
++}
++
++static u32 iwl_trans_pcie_read_shr(struct iwl_trans *trans, u32 reg)
++{
++	iwl_write32(trans, HEEP_CTRL_WRD_PCIEX_CTRL_REG,
++		    ((reg & 0x0000ffff) | (2 << 28)));
++	return iwl_read32(trans, HEEP_CTRL_WRD_PCIEX_DATA_REG);
++}
++
++static void iwl_trans_pcie_write_shr(struct iwl_trans *trans, u32 reg, u32 val)
++{
++	iwl_write32(trans, HEEP_CTRL_WRD_PCIEX_DATA_REG, val);
++	iwl_write32(trans, HEEP_CTRL_WRD_PCIEX_CTRL_REG,
++		    ((reg & 0x0000ffff) | (3 << 28)));
++}
++
++static void iwl_pcie_set_pwr(struct iwl_trans *trans, bool vaux)
++{
++	if (trans->cfg->apmg_not_supported)
++		return;
++
++	if (vaux && pci_pme_capable(to_pci_dev(trans->dev), PCI_D3cold))
++		iwl_set_bits_mask_prph(trans, APMG_PS_CTRL_REG,
++				       APMG_PS_CTRL_VAL_PWR_SRC_VAUX,
++				       ~APMG_PS_CTRL_MSK_PWR_SRC);
++	else
++		iwl_set_bits_mask_prph(trans, APMG_PS_CTRL_REG,
++				       APMG_PS_CTRL_VAL_PWR_SRC_VMAIN,
++				       ~APMG_PS_CTRL_MSK_PWR_SRC);
++}
++
++/* PCI registers */
++#define PCI_CFG_RETRY_TIMEOUT	0x041
++
++static void iwl_pcie_apm_config(struct iwl_trans *trans)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	u16 lctl;
++	u16 cap;
++
++	/*
++	 * HW bug W/A for instability in PCIe bus L0S->L1 transition.
++	 * Check if BIOS (or OS) enabled L1-ASPM on this device.
++	 * If so (likely), disable L0S, so device moves directly L0->L1;
++	 *    costs negligible amount of power savings.
++	 * If not (unlikely), enable L0S, so there is at least some
++	 *    power savings, even without L1.
++	 */
++	pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_LNKCTL, &lctl);
++	if (lctl & PCI_EXP_LNKCTL_ASPM_L1)
++		iwl_set_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
++	else
++		iwl_clear_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
++	trans->pm_support = !(lctl & PCI_EXP_LNKCTL_ASPM_L0S);
++
++	pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_DEVCTL2, &cap);
++	trans->ltr_enabled = cap & PCI_EXP_DEVCTL2_LTR_EN;
++	dev_info(trans->dev, "L1 %sabled - LTR %sabled\n",
++		 (lctl & PCI_EXP_LNKCTL_ASPM_L1) ? "En" : "Dis",
++		 trans->ltr_enabled ? "En" : "Dis");
++}
++
++/*
++ * Start up NIC's basic functionality after it has been reset
++ * (e.g. after platform boot, or shutdown via iwl_pcie_apm_stop())
++ * NOTE:  This does not load uCode nor start the embedded processor
++ */
++static int iwl_pcie_apm_init(struct iwl_trans *trans)
++{
++	int ret = 0;
++	IWL_DEBUG_INFO(trans, "Init card's basic functions\n");
++
++	/*
++	 * Use "set_bit" below rather than "write", to preserve any hardware
++	 * bits already set by default after reset.
++	 */
++
++	/* Disable L0S exit timer (platform NMI Work/Around) */
++	if (trans->cfg->device_family != IWL_DEVICE_FAMILY_8000)
++		iwl_set_bit(trans, CSR_GIO_CHICKEN_BITS,
++			    CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
++
++	/*
++	 * Disable L0s without affecting L1;
++	 *  don't wait for ICH L0s (ICH bug W/A)
++	 */
++	iwl_set_bit(trans, CSR_GIO_CHICKEN_BITS,
++		    CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
++
++	/* Set FH wait threshold to maximum (HW error during stress W/A) */
++	iwl_set_bit(trans, CSR_DBG_HPET_MEM_REG, CSR_DBG_HPET_MEM_REG_VAL);
++
++	/*
++	 * Enable HAP INTA (interrupt from management bus) to
++	 * wake device's PCI Express link L1a -> L0s
++	 */
++	iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
++		    CSR_HW_IF_CONFIG_REG_BIT_HAP_WAKE_L1A);
++
++	iwl_pcie_apm_config(trans);
++
++	/* Configure analog phase-lock-loop before activating to D0A */
++	if (trans->cfg->base_params->pll_cfg_val)
++		iwl_set_bit(trans, CSR_ANA_PLL_CFG,
++			    trans->cfg->base_params->pll_cfg_val);
++
++	/*
++	 * Set "initialization complete" bit to move adapter from
++	 * D0U* --> D0A* (powered-up active) state.
++	 */
++	iwl_set_bit(trans, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
++
++	/*
++	 * Wait for clock stabilization; once stabilized, access to
++	 * device-internal resources is supported, e.g. iwl_write_prph()
++	 * and accesses to uCode SRAM.
++	 */
++	ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
++			   CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
++			   CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
++	if (ret < 0) {
++		IWL_DEBUG_INFO(trans, "Failed to init the card\n");
++		goto out;
++	}
++
++	if (trans->cfg->host_interrupt_operation_mode) {
++		/*
++		 * This is a bit of an abuse - This is needed for 7260 / 3160
++		 * only check host_interrupt_operation_mode even if this is
++		 * not related to host_interrupt_operation_mode.
++		 *
++		 * Enable the oscillator to count wake up time for L1 exit. This
++		 * consumes slightly more power (100uA) - but allows to be sure
++		 * that we wake up from L1 on time.
++		 *
++		 * This looks weird: read twice the same register, discard the
++		 * value, set a bit, and yet again, read that same register
++		 * just to discard the value. But that's the way the hardware
++		 * seems to like it.
++		 */
++		iwl_read_prph(trans, OSC_CLK);
++		iwl_read_prph(trans, OSC_CLK);
++		iwl_set_bits_prph(trans, OSC_CLK, OSC_CLK_FORCE_CONTROL);
++		iwl_read_prph(trans, OSC_CLK);
++		iwl_read_prph(trans, OSC_CLK);
++	}
++
++	/*
++	 * Enable DMA clock and wait for it to stabilize.
++	 *
++	 * Write to "CLK_EN_REG"; "1" bits enable clocks, while "0"
++	 * bits do not disable clocks.  This preserves any hardware
++	 * bits already set by default in "CLK_CTRL_REG" after reset.
++	 */
++	if (!trans->cfg->apmg_not_supported) {
++		iwl_write_prph(trans, APMG_CLK_EN_REG,
++			       APMG_CLK_VAL_DMA_CLK_RQT);
++		udelay(20);
++
++		/* Disable L1-Active */
++		iwl_set_bits_prph(trans, APMG_PCIDEV_STT_REG,
++				  APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
++
++		/* Clear the interrupt in APMG if the NIC is in RFKILL */
++		iwl_write_prph(trans, APMG_RTC_INT_STT_REG,
++			       APMG_RTC_INT_STT_RFKILL);
++	}
++
++	set_bit(STATUS_DEVICE_ENABLED, &trans->status);
++
++out:
++	return ret;
++}
++
++/*
++ * Enable LP XTAL to avoid HW bug where device may consume much power if
++ * FW is not loaded after device reset. LP XTAL is disabled by default
++ * after device HW reset. Do it only if XTAL is fed by internal source.
++ * Configure device's "persistence" mode to avoid resetting XTAL again when
++ * SHRD_HW_RST occurs in S3.
++ */
++static void iwl_pcie_apm_lp_xtal_enable(struct iwl_trans *trans)
++{
++	int ret;
++	u32 apmg_gp1_reg;
++	u32 apmg_xtal_cfg_reg;
++	u32 dl_cfg_reg;
++
++	/* Force XTAL ON */
++	__iwl_trans_pcie_set_bit(trans, CSR_GP_CNTRL,
++				 CSR_GP_CNTRL_REG_FLAG_XTAL_ON);
++
++	/* Reset entire device - do controller reset (results in SHRD_HW_RST) */
++	iwl_set_bit(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
++
++	udelay(10);
++
++	/*
++	 * Set "initialization complete" bit to move adapter from
++	 * D0U* --> D0A* (powered-up active) state.
++	 */
++	iwl_set_bit(trans, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
++
++	/*
++	 * Wait for clock stabilization; once stabilized, access to
++	 * device-internal resources is possible.
++	 */
++	ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
++			   CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
++			   CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
++			   25000);
++	if (WARN_ON(ret < 0)) {
++		IWL_ERR(trans, "Access time out - failed to enable LP XTAL\n");
++		/* Release XTAL ON request */
++		__iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
++					   CSR_GP_CNTRL_REG_FLAG_XTAL_ON);
++		return;
++	}
++
++	/*
++	 * Clear "disable persistence" to avoid LP XTAL resetting when
++	 * SHRD_HW_RST is applied in S3.
++	 */
++	iwl_clear_bits_prph(trans, APMG_PCIDEV_STT_REG,
++				    APMG_PCIDEV_STT_VAL_PERSIST_DIS);
++
++	/*
++	 * Force APMG XTAL to be active to prevent its disabling by HW
++	 * caused by APMG idle state.
++	 */
++	apmg_xtal_cfg_reg = iwl_trans_pcie_read_shr(trans,
++						    SHR_APMG_XTAL_CFG_REG);
++	iwl_trans_pcie_write_shr(trans, SHR_APMG_XTAL_CFG_REG,
++				 apmg_xtal_cfg_reg |
++				 SHR_APMG_XTAL_CFG_XTAL_ON_REQ);
++
++	/*
++	 * Reset entire device again - do controller reset (results in
++	 * SHRD_HW_RST). Turn MAC off before proceeding.
++	 */
++	iwl_set_bit(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
++
++	udelay(10);
++
++	/* Enable LP XTAL by indirect access through CSR */
++	apmg_gp1_reg = iwl_trans_pcie_read_shr(trans, SHR_APMG_GP1_REG);
++	iwl_trans_pcie_write_shr(trans, SHR_APMG_GP1_REG, apmg_gp1_reg |
++				 SHR_APMG_GP1_WF_XTAL_LP_EN |
++				 SHR_APMG_GP1_CHICKEN_BIT_SELECT);
++
++	/* Clear delay line clock power up */
++	dl_cfg_reg = iwl_trans_pcie_read_shr(trans, SHR_APMG_DL_CFG_REG);
++	iwl_trans_pcie_write_shr(trans, SHR_APMG_DL_CFG_REG, dl_cfg_reg &
++				 ~SHR_APMG_DL_CFG_DL_CLOCK_POWER_UP);
++
++	/*
++	 * Enable persistence mode to avoid LP XTAL resetting when
++	 * SHRD_HW_RST is applied in S3.
++	 */
++	iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
++		    CSR_HW_IF_CONFIG_REG_PERSIST_MODE);
++
++	/*
++	 * Clear "initialization complete" bit to move adapter from
++	 * D0A* (powered-up Active) --> D0U* (Uninitialized) state.
++	 */
++	iwl_clear_bit(trans, CSR_GP_CNTRL,
++		      CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
++
++	/* Activates XTAL resources monitor */
++	__iwl_trans_pcie_set_bit(trans, CSR_MONITOR_CFG_REG,
++				 CSR_MONITOR_XTAL_RESOURCES);
++
++	/* Release XTAL ON request */
++	__iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
++				   CSR_GP_CNTRL_REG_FLAG_XTAL_ON);
++	udelay(10);
++
++	/* Release APMG XTAL */
++	iwl_trans_pcie_write_shr(trans, SHR_APMG_XTAL_CFG_REG,
++				 apmg_xtal_cfg_reg &
++				 ~SHR_APMG_XTAL_CFG_XTAL_ON_REQ);
++}
++
++static int iwl_pcie_apm_stop_master(struct iwl_trans *trans)
++{
++	int ret = 0;
++
++	/* stop device's busmaster DMA activity */
++	iwl_set_bit(trans, CSR_RESET, CSR_RESET_REG_FLAG_STOP_MASTER);
++
++	ret = iwl_poll_bit(trans, CSR_RESET,
++			   CSR_RESET_REG_FLAG_MASTER_DISABLED,
++			   CSR_RESET_REG_FLAG_MASTER_DISABLED, 100);
++	if (ret < 0)
++		IWL_WARN(trans, "Master Disable Timed Out, 100 usec\n");
++
++	IWL_DEBUG_INFO(trans, "stop master\n");
++
++	return ret;
++}
++
++static void iwl_pcie_apm_stop(struct iwl_trans *trans, bool op_mode_leave)
++{
++	IWL_DEBUG_INFO(trans, "Stop card, put in low power state\n");
++
++	if (op_mode_leave) {
++		if (!test_bit(STATUS_DEVICE_ENABLED, &trans->status))
++			iwl_pcie_apm_init(trans);
++
++		/* inform ME that we are leaving */
++		if (trans->cfg->device_family == IWL_DEVICE_FAMILY_7000)
++			iwl_set_bits_prph(trans, APMG_PCIDEV_STT_REG,
++					  APMG_PCIDEV_STT_VAL_WAKE_ME);
++		else if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) {
++			iwl_set_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG,
++				    CSR_RESET_LINK_PWR_MGMT_DISABLED);
++			iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
++				    CSR_HW_IF_CONFIG_REG_PREPARE |
++				    CSR_HW_IF_CONFIG_REG_ENABLE_PME);
++			mdelay(1);
++			iwl_clear_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG,
++				      CSR_RESET_LINK_PWR_MGMT_DISABLED);
++		}
++		mdelay(5);
++	}
++
++	clear_bit(STATUS_DEVICE_ENABLED, &trans->status);
++
++	/* Stop device's DMA activity */
++	iwl_pcie_apm_stop_master(trans);
++
++	if (trans->cfg->lp_xtal_workaround) {
++		iwl_pcie_apm_lp_xtal_enable(trans);
++		return;
++	}
++
++	/* Reset the entire device */
++	iwl_set_bit(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
++
++	udelay(10);
++
++	/*
++	 * Clear "initialization complete" bit to move adapter from
++	 * D0A* (powered-up Active) --> D0U* (Uninitialized) state.
++	 */
++	iwl_clear_bit(trans, CSR_GP_CNTRL,
++		      CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
++}
++
++static int iwl_pcie_nic_init(struct iwl_trans *trans)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++
++	/* nic_init */
++	spin_lock(&trans_pcie->irq_lock);
++	iwl_pcie_apm_init(trans);
++
++	spin_unlock(&trans_pcie->irq_lock);
++
++	iwl_pcie_set_pwr(trans, false);
++
++	iwl_op_mode_nic_config(trans->op_mode);
++
++	/* Allocate the RX queue, or reset if it is already allocated */
++	iwl_pcie_rx_init(trans);
++
++	/* Allocate or reset and init all Tx and Command queues */
++	if (iwl_pcie_tx_init(trans))
++		return -ENOMEM;
++
++	if (trans->cfg->base_params->shadow_reg_enable) {
++		/* enable shadow regs in HW */
++		iwl_set_bit(trans, CSR_MAC_SHADOW_REG_CTRL, 0x800FFFFF);
++		IWL_DEBUG_INFO(trans, "Enabling shadow registers in device\n");
++	}
++
++	return 0;
++}
++
++#define HW_READY_TIMEOUT (50)
++
++/* Note: returns poll_bit return value, which is >= 0 if success */
++static int iwl_pcie_set_hw_ready(struct iwl_trans *trans)
++{
++	int ret;
++
++	iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
++		    CSR_HW_IF_CONFIG_REG_BIT_NIC_READY);
++
++	/* See if we got it */
++	ret = iwl_poll_bit(trans, CSR_HW_IF_CONFIG_REG,
++			   CSR_HW_IF_CONFIG_REG_BIT_NIC_READY,
++			   CSR_HW_IF_CONFIG_REG_BIT_NIC_READY,
++			   HW_READY_TIMEOUT);
++
++	if (ret >= 0)
++		iwl_set_bit(trans, CSR_MBOX_SET_REG, CSR_MBOX_SET_REG_OS_ALIVE);
++
++	IWL_DEBUG_INFO(trans, "hardware%s ready\n", ret < 0 ? " not" : "");
++	return ret;
++}
++
++/* Note: returns standard 0/-ERROR code */
++static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
++{
++	int ret;
++	int t = 0;
++	int iter;
++
++	IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n");
++
++	ret = iwl_pcie_set_hw_ready(trans);
++	/* If the card is ready, exit 0 */
++	if (ret >= 0)
++		return 0;
++
++	iwl_set_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG,
++		    CSR_RESET_LINK_PWR_MGMT_DISABLED);
++	msleep(1);
++
++	for (iter = 0; iter < 10; iter++) {
++		/* If HW is not ready, prepare the conditions to check again */
++		iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
++			    CSR_HW_IF_CONFIG_REG_PREPARE);
++
++		do {
++			ret = iwl_pcie_set_hw_ready(trans);
++			if (ret >= 0)
++				return 0;
++
++			usleep_range(200, 1000);
++			t += 200;
++		} while (t < 150000);
++		msleep(25);
++	}
++
++	IWL_ERR(trans, "Couldn't prepare the card\n");
++
++	return ret;
++}
++
++/*
++ * ucode
++ */
++static int iwl_pcie_load_firmware_chunk(struct iwl_trans *trans, u32 dst_addr,
++				   dma_addr_t phy_addr, u32 byte_cnt)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	int ret;
++
++	trans_pcie->ucode_write_complete = false;
++
++	iwl_write_direct32(trans,
++			   FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
++			   FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE);
++
++	iwl_write_direct32(trans,
++			   FH_SRVC_CHNL_SRAM_ADDR_REG(FH_SRVC_CHNL),
++			   dst_addr);
++
++	iwl_write_direct32(trans,
++			   FH_TFDIB_CTRL0_REG(FH_SRVC_CHNL),
++			   phy_addr & FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK);
++
++	iwl_write_direct32(trans,
++			   FH_TFDIB_CTRL1_REG(FH_SRVC_CHNL),
++			   (iwl_get_dma_hi_addr(phy_addr)
++				<< FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt);
++
++	iwl_write_direct32(trans,
++			   FH_TCSR_CHNL_TX_BUF_STS_REG(FH_SRVC_CHNL),
++			   1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM |
++			   1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX |
++			   FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID);
++
++	iwl_write_direct32(trans,
++			   FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
++			   FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE	|
++			   FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE	|
++			   FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
++
++	ret = wait_event_timeout(trans_pcie->ucode_write_waitq,
++				 trans_pcie->ucode_write_complete, 5 * HZ);
++	if (!ret) {
++		IWL_ERR(trans, "Failed to load firmware chunk!\n");
++		return -ETIMEDOUT;
++	}
++
++	return 0;
++}
++
++static int iwl_pcie_load_section(struct iwl_trans *trans, u8 section_num,
++			    const struct fw_desc *section)
++{
++	u8 *v_addr;
++	dma_addr_t p_addr;
++	u32 offset, chunk_sz = min_t(u32, FH_MEM_TB_MAX_LENGTH, section->len);
++	int ret = 0;
++
++	IWL_DEBUG_FW(trans, "[%d] uCode section being loaded...\n",
++		     section_num);
++
++	v_addr = dma_alloc_coherent(trans->dev, chunk_sz, &p_addr,
++				    GFP_KERNEL | __GFP_NOWARN);
++	if (!v_addr) {
++		IWL_DEBUG_INFO(trans, "Falling back to small chunks of DMA\n");
++		chunk_sz = PAGE_SIZE;
++		v_addr = dma_alloc_coherent(trans->dev, chunk_sz,
++					    &p_addr, GFP_KERNEL);
++		if (!v_addr)
++			return -ENOMEM;
++	}
++
++	for (offset = 0; offset < section->len; offset += chunk_sz) {
++		u32 copy_size, dst_addr;
++		bool extended_addr = false;
++
++		copy_size = min_t(u32, chunk_sz, section->len - offset);
++		dst_addr = section->offset + offset;
++
++		if (dst_addr >= IWL_FW_MEM_EXTENDED_START &&
++		    dst_addr <= IWL_FW_MEM_EXTENDED_END)
++			extended_addr = true;
++
++		if (extended_addr)
++			iwl_set_bits_prph(trans, LMPM_CHICK,
++					  LMPM_CHICK_EXTENDED_ADDR_SPACE);
++
++		memcpy(v_addr, (u8 *)section->data + offset, copy_size);
++		ret = iwl_pcie_load_firmware_chunk(trans, dst_addr, p_addr,
++						   copy_size);
++
++		if (extended_addr)
++			iwl_clear_bits_prph(trans, LMPM_CHICK,
++					    LMPM_CHICK_EXTENDED_ADDR_SPACE);
++
++		if (ret) {
++			IWL_ERR(trans,
++				"Could not load the [%d] uCode section\n",
++				section_num);
++			break;
++		}
++	}
++
++	dma_free_coherent(trans->dev, chunk_sz, v_addr, p_addr);
++	return ret;
++}
++
++/*
++ * Driver Takes the ownership on secure machine before FW load
++ * and prevent race with the BT load.
++ * W/A for ROM bug. (should be remove in the next Si step)
++ */
++static int iwl_pcie_rsa_race_bug_wa(struct iwl_trans *trans)
++{
++	u32 val, loop = 1000;
++
++	/*
++	 * Check the RSA semaphore is accessible.
++	 * If the HW isn't locked and the rsa semaphore isn't accessible,
++	 * we are in trouble.
++	 */
++	val = iwl_read_prph(trans, PREG_AUX_BUS_WPROT_0);
++	if (val & (BIT(1) | BIT(17))) {
++		IWL_INFO(trans,
++			 "can't access the RSA semaphore it is write protected\n");
++		return 0;
++	}
++
++	/* take ownership on the AUX IF */
++	iwl_write_prph(trans, WFPM_CTRL_REG, WFPM_AUX_CTL_AUX_IF_MAC_OWNER_MSK);
++	iwl_write_prph(trans, AUX_MISC_MASTER1_EN, AUX_MISC_MASTER1_EN_SBE_MSK);
++
++	do {
++		iwl_write_prph(trans, AUX_MISC_MASTER1_SMPHR_STATUS, 0x1);
++		val = iwl_read_prph(trans, AUX_MISC_MASTER1_SMPHR_STATUS);
++		if (val == 0x1) {
++			iwl_write_prph(trans, RSA_ENABLE, 0);
++			return 0;
++		}
++
++		udelay(10);
++		loop--;
++	} while (loop > 0);
++
++	IWL_ERR(trans, "Failed to take ownership on secure machine\n");
++	return -EIO;
++}
++
++static int iwl_pcie_load_cpu_sections_8000(struct iwl_trans *trans,
++					   const struct fw_img *image,
++					   int cpu,
++					   int *first_ucode_section)
++{
++	int shift_param;
++	int i, ret = 0, sec_num = 0x1;
++	u32 val, last_read_idx = 0;
++
++	if (cpu == 1) {
++		shift_param = 0;
++		*first_ucode_section = 0;
++	} else {
++		shift_param = 16;
++		(*first_ucode_section)++;
++	}
++
++	for (i = *first_ucode_section; i < IWL_UCODE_SECTION_MAX; i++) {
++		last_read_idx = i;
++
++		/*
++		 * CPU1_CPU2_SEPARATOR_SECTION delimiter - separate between
++		 * CPU1 to CPU2.
++		 * PAGING_SEPARATOR_SECTION delimiter - separate between
++		 * CPU2 non paged to CPU2 paging sec.
++		 */
++		if (!image->sec[i].data ||
++		    image->sec[i].offset == CPU1_CPU2_SEPARATOR_SECTION ||
++		    image->sec[i].offset == PAGING_SEPARATOR_SECTION) {
++			IWL_DEBUG_FW(trans,
++				     "Break since Data not valid or Empty section, sec = %d\n",
++				     i);
++			break;
++		}
++
++		ret = iwl_pcie_load_section(trans, i, &image->sec[i]);
++		if (ret)
++			return ret;
++
++		/* Notify the ucode of the loaded section number and status */
++		val = iwl_read_direct32(trans, FH_UCODE_LOAD_STATUS);
++		val = val | (sec_num << shift_param);
++		iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, val);
++		sec_num = (sec_num << 1) | 0x1;
++	}
++
++	*first_ucode_section = last_read_idx;
++
++	if (cpu == 1)
++		iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, 0xFFFF);
++	else
++		iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, 0xFFFFFFFF);
++
++	return 0;
++}
++
++static int iwl_pcie_load_cpu_sections(struct iwl_trans *trans,
++				      const struct fw_img *image,
++				      int cpu,
++				      int *first_ucode_section)
++{
++	int shift_param;
++	int i, ret = 0;
++	u32 last_read_idx = 0;
++
++	if (cpu == 1) {
++		shift_param = 0;
++		*first_ucode_section = 0;
++	} else {
++		shift_param = 16;
++		(*first_ucode_section)++;
++	}
++
++	for (i = *first_ucode_section; i < IWL_UCODE_SECTION_MAX; i++) {
++		last_read_idx = i;
++
++		/*
++		 * CPU1_CPU2_SEPARATOR_SECTION delimiter - separate between
++		 * CPU1 to CPU2.
++		 * PAGING_SEPARATOR_SECTION delimiter - separate between
++		 * CPU2 non paged to CPU2 paging sec.
++		 */
++		if (!image->sec[i].data ||
++		    image->sec[i].offset == CPU1_CPU2_SEPARATOR_SECTION ||
++		    image->sec[i].offset == PAGING_SEPARATOR_SECTION) {
++			IWL_DEBUG_FW(trans,
++				     "Break since Data not valid or Empty section, sec = %d\n",
++				     i);
++			break;
++		}
++
++		ret = iwl_pcie_load_section(trans, i, &image->sec[i]);
++		if (ret)
++			return ret;
++	}
++
++	if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
++		iwl_set_bits_prph(trans,
++				  CSR_UCODE_LOAD_STATUS_ADDR,
++				  (LMPM_CPU_UCODE_LOADING_COMPLETED |
++				   LMPM_CPU_HDRS_LOADING_COMPLETED |
++				   LMPM_CPU_UCODE_LOADING_STARTED) <<
++					shift_param);
++
++	*first_ucode_section = last_read_idx;
++
++	return 0;
++}
++
++static void iwl_pcie_apply_destination(struct iwl_trans *trans)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	const struct iwl_fw_dbg_dest_tlv *dest = trans->dbg_dest_tlv;
++	int i;
++
++	if (dest->version)
++		IWL_ERR(trans,
++			"DBG DEST version is %d - expect issues\n",
++			dest->version);
++
++	IWL_INFO(trans, "Applying debug destination %s\n",
++		 get_fw_dbg_mode_string(dest->monitor_mode));
++
++	if (dest->monitor_mode == EXTERNAL_MODE)
++		iwl_pcie_alloc_fw_monitor(trans, dest->size_power);
++	else
++		IWL_WARN(trans, "PCI should have external buffer debug\n");
++
++	for (i = 0; i < trans->dbg_dest_reg_num; i++) {
++		u32 addr = le32_to_cpu(dest->reg_ops[i].addr);
++		u32 val = le32_to_cpu(dest->reg_ops[i].val);
++
++		switch (dest->reg_ops[i].op) {
++		case CSR_ASSIGN:
++			iwl_write32(trans, addr, val);
++			break;
++		case CSR_SETBIT:
++			iwl_set_bit(trans, addr, BIT(val));
++			break;
++		case CSR_CLEARBIT:
++			iwl_clear_bit(trans, addr, BIT(val));
++			break;
++		case PRPH_ASSIGN:
++			iwl_write_prph(trans, addr, val);
++			break;
++		case PRPH_SETBIT:
++			iwl_set_bits_prph(trans, addr, BIT(val));
++			break;
++		case PRPH_CLEARBIT:
++			iwl_clear_bits_prph(trans, addr, BIT(val));
++			break;
++		case PRPH_BLOCKBIT:
++			if (iwl_read_prph(trans, addr) & BIT(val)) {
++				IWL_ERR(trans,
++					"BIT(%u) in address 0x%x is 1, stopping FW configuration\n",
++					val, addr);
++				goto monitor;
++			}
++			break;
++		default:
++			IWL_ERR(trans, "FW debug - unknown OP %d\n",
++				dest->reg_ops[i].op);
++			break;
++		}
++	}
++
++monitor:
++	if (dest->monitor_mode == EXTERNAL_MODE && trans_pcie->fw_mon_size) {
++		iwl_write_prph(trans, le32_to_cpu(dest->base_reg),
++			       trans_pcie->fw_mon_phys >> dest->base_shift);
++		if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
++			iwl_write_prph(trans, le32_to_cpu(dest->end_reg),
++				       (trans_pcie->fw_mon_phys +
++					trans_pcie->fw_mon_size - 256) >>
++						dest->end_shift);
++		else
++			iwl_write_prph(trans, le32_to_cpu(dest->end_reg),
++				       (trans_pcie->fw_mon_phys +
++					trans_pcie->fw_mon_size) >>
++						dest->end_shift);
++	}
++}
++
++static int iwl_pcie_load_given_ucode(struct iwl_trans *trans,
++				const struct fw_img *image)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	int ret = 0;
++	int first_ucode_section;
++
++	IWL_DEBUG_FW(trans, "working with %s CPU\n",
++		     image->is_dual_cpus ? "Dual" : "Single");
++
++	/* load to FW the binary non secured sections of CPU1 */
++	ret = iwl_pcie_load_cpu_sections(trans, image, 1, &first_ucode_section);
++	if (ret)
++		return ret;
++
++	if (image->is_dual_cpus) {
++		/* set CPU2 header address */
++		iwl_write_prph(trans,
++			       LMPM_SECURE_UCODE_LOAD_CPU2_HDR_ADDR,
++			       LMPM_SECURE_CPU2_HDR_MEM_SPACE);
++
++		/* load to FW the binary sections of CPU2 */
++		ret = iwl_pcie_load_cpu_sections(trans, image, 2,
++						 &first_ucode_section);
++		if (ret)
++			return ret;
++	}
++
++	/* supported for 7000 only for the moment */
++	if (iwlwifi_mod_params.fw_monitor &&
++	    trans->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
++		iwl_pcie_alloc_fw_monitor(trans, 0);
++
++		if (trans_pcie->fw_mon_size) {
++			iwl_write_prph(trans, MON_BUFF_BASE_ADDR,
++				       trans_pcie->fw_mon_phys >> 4);
++			iwl_write_prph(trans, MON_BUFF_END_ADDR,
++				       (trans_pcie->fw_mon_phys +
++					trans_pcie->fw_mon_size) >> 4);
++		}
++	} else if (trans->dbg_dest_tlv) {
++		iwl_pcie_apply_destination(trans);
++	}
++
++	/* release CPU reset */
++	iwl_write32(trans, CSR_RESET, 0);
++
++	return 0;
++}
++
++static int iwl_pcie_load_given_ucode_8000(struct iwl_trans *trans,
++					  const struct fw_img *image)
++{
++	int ret = 0;
++	int first_ucode_section;
++
++	IWL_DEBUG_FW(trans, "working with %s CPU\n",
++		     image->is_dual_cpus ? "Dual" : "Single");
++
++	if (trans->dbg_dest_tlv)
++		iwl_pcie_apply_destination(trans);
++
++	/* TODO: remove in the next Si step */
++	ret = iwl_pcie_rsa_race_bug_wa(trans);
++	if (ret)
++		return ret;
++
++	/* configure the ucode to be ready to get the secured image */
++	/* release CPU reset */
++	iwl_write_prph(trans, RELEASE_CPU_RESET, RELEASE_CPU_RESET_BIT);
++
++	/* load to FW the binary Secured sections of CPU1 */
++	ret = iwl_pcie_load_cpu_sections_8000(trans, image, 1,
++					      &first_ucode_section);
++	if (ret)
++		return ret;
++
++	/* load to FW the binary sections of CPU2 */
++	return iwl_pcie_load_cpu_sections_8000(trans, image, 2,
++					       &first_ucode_section);
++}
++
++static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
++				   const struct fw_img *fw, bool run_in_rfkill)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	bool hw_rfkill;
++	int ret;
++
++	mutex_lock(&trans_pcie->mutex);
++
++	/* Someone called stop_device, don't try to start_fw */
++	if (trans_pcie->is_down) {
++		IWL_WARN(trans,
++			 "Can't start_fw since the HW hasn't been started\n");
++		ret = EIO;
++		goto out;
++	}
++
++	/* This may fail if AMT took ownership of the device */
++	if (iwl_pcie_prepare_card_hw(trans)) {
++		IWL_WARN(trans, "Exit HW not ready\n");
++		ret = -EIO;
++		goto out;
++	}
++
++	iwl_enable_rfkill_int(trans);
++
++	/* If platform's RF_KILL switch is NOT set to KILL */
++	hw_rfkill = iwl_is_rfkill_set(trans);
++	if (hw_rfkill)
++		set_bit(STATUS_RFKILL, &trans->status);
++	else
++		clear_bit(STATUS_RFKILL, &trans->status);
++	iwl_trans_pcie_rf_kill(trans, hw_rfkill);
++	if (hw_rfkill && !run_in_rfkill) {
++		ret = -ERFKILL;
++		goto out;
++	}
++
++	iwl_write32(trans, CSR_INT, 0xFFFFFFFF);
++
++	ret = iwl_pcie_nic_init(trans);
++	if (ret) {
++		IWL_ERR(trans, "Unable to init nic\n");
++		goto out;
++	}
++
++	/* make sure rfkill handshake bits are cleared */
++	iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
++	iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR,
++		    CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
++
++	/* clear (again), then enable host interrupts */
++	iwl_write32(trans, CSR_INT, 0xFFFFFFFF);
++	iwl_enable_interrupts(trans);
++
++	/* really make sure rfkill handshake bits are cleared */
++	iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
++	iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
++
++	/* Load the given image to the HW */
++	if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
++		ret = iwl_pcie_load_given_ucode_8000(trans, fw);
++	else
++		ret = iwl_pcie_load_given_ucode(trans, fw);
++
++out:
++	mutex_unlock(&trans_pcie->mutex);
++	return ret;
++}
++
++static void iwl_trans_pcie_fw_alive(struct iwl_trans *trans, u32 scd_addr)
++{
++	iwl_pcie_reset_ict(trans);
++	iwl_pcie_tx_start(trans, scd_addr);
++}
++
++static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	bool hw_rfkill, was_hw_rfkill;
++
++	lockdep_assert_held(&trans_pcie->mutex);
++
++	if (trans_pcie->is_down)
++		return;
++
++	trans_pcie->is_down = true;
++
++	was_hw_rfkill = iwl_is_rfkill_set(trans);
++
++	/* tell the device to stop sending interrupts */
++	spin_lock(&trans_pcie->irq_lock);
++	iwl_disable_interrupts(trans);
++	spin_unlock(&trans_pcie->irq_lock);
++
++	/* device going down, Stop using ICT table */
++	iwl_pcie_disable_ict(trans);
++
++	/*
++	 * If a HW restart happens during firmware loading,
++	 * then the firmware loading might call this function
++	 * and later it might be called again due to the
++	 * restart. So don't process again if the device is
++	 * already dead.
++	 */
++	if (test_and_clear_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
++		IWL_DEBUG_INFO(trans, "DEVICE_ENABLED bit was set and is now cleared\n");
++		iwl_pcie_tx_stop(trans);
++		iwl_pcie_rx_stop(trans);
++
++		/* Power-down device's busmaster DMA clocks */
++		if (!trans->cfg->apmg_not_supported) {
++			iwl_write_prph(trans, APMG_CLK_DIS_REG,
++				       APMG_CLK_VAL_DMA_CLK_RQT);
++			udelay(5);
++		}
++	}
++
++	/* Make sure (redundant) we've released our request to stay awake */
++	iwl_clear_bit(trans, CSR_GP_CNTRL,
++		      CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
++
++	/* Stop the device, and put it in low power state */
++	iwl_pcie_apm_stop(trans, false);
++
++	/* stop and reset the on-board processor */
++	iwl_write32(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
++	udelay(20);
++
++	/*
++	 * Upon stop, the APM issues an interrupt if HW RF kill is set.
++	 * This is a bug in certain verions of the hardware.
++	 * Certain devices also keep sending HW RF kill interrupt all
++	 * the time, unless the interrupt is ACKed even if the interrupt
++	 * should be masked. Re-ACK all the interrupts here.
++	 */
++	spin_lock(&trans_pcie->irq_lock);
++	iwl_disable_interrupts(trans);
++	spin_unlock(&trans_pcie->irq_lock);
++
++
++	/* clear all status bits */
++	clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
++	clear_bit(STATUS_INT_ENABLED, &trans->status);
++	clear_bit(STATUS_TPOWER_PMI, &trans->status);
++	clear_bit(STATUS_RFKILL, &trans->status);
++
++	/*
++	 * Even if we stop the HW, we still want the RF kill
++	 * interrupt
++	 */
++	iwl_enable_rfkill_int(trans);
++
++	/*
++	 * Check again since the RF kill state may have changed while
++	 * all the interrupts were disabled, in this case we couldn't
++	 * receive the RF kill interrupt and update the state in the
++	 * op_mode.
++	 * Don't call the op_mode if the rkfill state hasn't changed.
++	 * This allows the op_mode to call stop_device from the rfkill
++	 * notification without endless recursion. Under very rare
++	 * circumstances, we might have a small recursion if the rfkill
++	 * state changed exactly now while we were called from stop_device.
++	 * This is very unlikely but can happen and is supported.
++	 */
++	hw_rfkill = iwl_is_rfkill_set(trans);
++	if (hw_rfkill)
++		set_bit(STATUS_RFKILL, &trans->status);
++	else
++		clear_bit(STATUS_RFKILL, &trans->status);
++	if (hw_rfkill != was_hw_rfkill)
++		iwl_trans_pcie_rf_kill(trans, hw_rfkill);
++
++	/* re-take ownership to prevent other users from stealing the deivce */
++	iwl_pcie_prepare_card_hw(trans);
++}
++
++static void iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++
++	mutex_lock(&trans_pcie->mutex);
++	_iwl_trans_pcie_stop_device(trans, low_power);
++	mutex_unlock(&trans_pcie->mutex);
++}
++
++void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state)
++{
++	struct iwl_trans_pcie __maybe_unused *trans_pcie =
++		IWL_TRANS_GET_PCIE_TRANS(trans);
++
++	lockdep_assert_held(&trans_pcie->mutex);
++
++	if (iwl_op_mode_hw_rf_kill(trans->op_mode, state))
++		_iwl_trans_pcie_stop_device(trans, true);
++}
++
++static void iwl_trans_pcie_d3_suspend(struct iwl_trans *trans, bool test)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++
++	if (trans->system_pm_mode == IWL_PLAT_PM_MODE_D0I3) {
++		/* Enable persistence mode to avoid reset */
++		iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
++			    CSR_HW_IF_CONFIG_REG_PERSIST_MODE);
++	}
++
++	iwl_disable_interrupts(trans);
++
++	/*
++	 * in testing mode, the host stays awake and the
++	 * hardware won't be reset (not even partially)
++	 */
++	if (test)
++		return;
++
++	iwl_pcie_disable_ict(trans);
++
++	synchronize_irq(trans_pcie->pci_dev->irq);
++
++	iwl_clear_bit(trans, CSR_GP_CNTRL,
++		      CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
++	iwl_clear_bit(trans, CSR_GP_CNTRL,
++		      CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
++
++	if (trans->system_pm_mode == IWL_PLAT_PM_MODE_D3) {
++		/*
++		 * reset TX queues -- some of their registers reset during S3
++		 * so if we don't reset everything here the D3 image would try
++		 * to execute some invalid memory upon resume
++		 */
++		iwl_trans_pcie_tx_reset(trans);
++	}
++
++	iwl_pcie_set_pwr(trans, true);
++}
++
++static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
++				    enum iwl_d3_status *status,
++				    bool test)
++{
++	u32 val;
++	int ret;
++
++	if (test) {
++		iwl_enable_interrupts(trans);
++		*status = IWL_D3_STATUS_ALIVE;
++		return 0;
++	}
++
++	/*
++	 * Also enables interrupts - none will happen as the device doesn't
++	 * know we're waking it up, only when the opmode actually tells it
++	 * after this call.
++	 */
++	iwl_pcie_reset_ict(trans);
++
++	iwl_set_bit(trans, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
++	iwl_set_bit(trans, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
++
++	if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
++		udelay(2);
++
++	ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
++			   CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
++			   CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
++			   25000);
++	if (ret < 0) {
++		IWL_ERR(trans, "Failed to resume the device (mac ready)\n");
++		return ret;
++	}
++
++	iwl_pcie_set_pwr(trans, false);
++
++	if (trans->system_pm_mode == IWL_PLAT_PM_MODE_D0I3) {
++		iwl_clear_bit(trans, CSR_GP_CNTRL,
++			      CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
++	} else {
++		iwl_trans_pcie_tx_reset(trans);
++
++		ret = iwl_pcie_rx_init(trans);
++		if (ret) {
++			IWL_ERR(trans,
++				"Failed to resume the device (RX reset)\n");
++			return ret;
++		}
++	}
++
++	val = iwl_read32(trans, CSR_RESET);
++	if (val & CSR_RESET_REG_FLAG_NEVO_RESET)
++		*status = IWL_D3_STATUS_RESET;
++	else
++		*status = IWL_D3_STATUS_ALIVE;
++
++	return 0;
++}
++
++static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	bool hw_rfkill;
++	int err;
++
++	lockdep_assert_held(&trans_pcie->mutex);
++
++	err = iwl_pcie_prepare_card_hw(trans);
++	if (err) {
++		IWL_ERR(trans, "Error while preparing HW: %d\n", err);
++		return err;
++	}
++
++	/* Reset the entire device */
++	iwl_write32(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
++
++	usleep_range(10, 15);
++
++	iwl_pcie_apm_init(trans);
++
++	/* From now on, the op_mode will be kept updated about RF kill state */
++	iwl_enable_rfkill_int(trans);
++
++	/* Set is_down to false here so that...*/
++	trans_pcie->is_down = false;
++
++	hw_rfkill = iwl_is_rfkill_set(trans);
++	if (hw_rfkill)
++		set_bit(STATUS_RFKILL, &trans->status);
++	else
++		clear_bit(STATUS_RFKILL, &trans->status);
++	/* ... rfkill can call stop_device and set it false if needed */
++	iwl_trans_pcie_rf_kill(trans, hw_rfkill);
++
++	return 0;
++}
++
++static int iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	int ret;
++
++	mutex_lock(&trans_pcie->mutex);
++	ret = _iwl_trans_pcie_start_hw(trans, low_power);
++	mutex_unlock(&trans_pcie->mutex);
++
++	return ret;
++}
++
++static void iwl_trans_pcie_op_mode_leave(struct iwl_trans *trans)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++
++	mutex_lock(&trans_pcie->mutex);
++
++	/* disable interrupts - don't enable HW RF kill interrupt */
++	spin_lock(&trans_pcie->irq_lock);
++	iwl_disable_interrupts(trans);
++	spin_unlock(&trans_pcie->irq_lock);
++
++	iwl_pcie_apm_stop(trans, true);
++
++	spin_lock(&trans_pcie->irq_lock);
++	iwl_disable_interrupts(trans);
++	spin_unlock(&trans_pcie->irq_lock);
++
++	iwl_pcie_disable_ict(trans);
++
++	mutex_unlock(&trans_pcie->mutex);
++
++	synchronize_irq(trans_pcie->pci_dev->irq);
++}
++
++static void iwl_trans_pcie_write8(struct iwl_trans *trans, u32 ofs, u8 val)
++{
++	writeb(val, IWL_TRANS_GET_PCIE_TRANS(trans)->hw_base + ofs);
++}
++
++static void iwl_trans_pcie_write32(struct iwl_trans *trans, u32 ofs, u32 val)
++{
++	writel(val, IWL_TRANS_GET_PCIE_TRANS(trans)->hw_base + ofs);
++}
++
++static u32 iwl_trans_pcie_read32(struct iwl_trans *trans, u32 ofs)
++{
++	return readl(IWL_TRANS_GET_PCIE_TRANS(trans)->hw_base + ofs);
++}
++
++static u32 iwl_trans_pcie_read_prph(struct iwl_trans *trans, u32 reg)
++{
++	iwl_trans_pcie_write32(trans, HBUS_TARG_PRPH_RADDR,
++			       ((reg & 0x000FFFFF) | (3 << 24)));
++	return iwl_trans_pcie_read32(trans, HBUS_TARG_PRPH_RDAT);
++}
++
++static void iwl_trans_pcie_write_prph(struct iwl_trans *trans, u32 addr,
++				      u32 val)
++{
++	iwl_trans_pcie_write32(trans, HBUS_TARG_PRPH_WADDR,
++			       ((addr & 0x000FFFFF) | (3 << 24)));
++	iwl_trans_pcie_write32(trans, HBUS_TARG_PRPH_WDAT, val);
++}
++
++static int iwl_pcie_dummy_napi_poll(struct napi_struct *napi, int budget)
++{
++	WARN_ON(1);
++	return 0;
++}
++
++static void iwl_trans_pcie_configure(struct iwl_trans *trans,
++				     const struct iwl_trans_config *trans_cfg)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++
++	trans_pcie->cmd_queue = trans_cfg->cmd_queue;
++	trans_pcie->cmd_fifo = trans_cfg->cmd_fifo;
++	trans_pcie->cmd_q_wdg_timeout = trans_cfg->cmd_q_wdg_timeout;
++	if (WARN_ON(trans_cfg->n_no_reclaim_cmds > MAX_NO_RECLAIM_CMDS))
++		trans_pcie->n_no_reclaim_cmds = 0;
++	else
++		trans_pcie->n_no_reclaim_cmds = trans_cfg->n_no_reclaim_cmds;
++	if (trans_pcie->n_no_reclaim_cmds)
++		memcpy(trans_pcie->no_reclaim_cmds, trans_cfg->no_reclaim_cmds,
++		       trans_pcie->n_no_reclaim_cmds * sizeof(u8));
++
++	trans_pcie->rx_buf_size = trans_cfg->rx_buf_size;
++	trans_pcie->rx_page_order =
++		iwl_trans_get_rb_size_order(trans_pcie->rx_buf_size);
++
++	trans_pcie->wide_cmd_header = trans_cfg->wide_cmd_header;
++	trans_pcie->bc_table_dword = trans_cfg->bc_table_dword;
++	trans_pcie->scd_set_active = trans_cfg->scd_set_active;
++	trans_pcie->sw_csum_tx = trans_cfg->sw_csum_tx;
++
++	trans->command_groups = trans_cfg->command_groups;
++	trans->command_groups_size = trans_cfg->command_groups_size;
++
++	/* init ref_count to 1 (should be cleared when ucode is loaded) */
++	trans_pcie->ref_count = 1;
++
++	/* Initialize NAPI here - it should be before registering to mac80211
++	 * in the opmode but after the HW struct is allocated.
++	 * As this function may be called again in some corner cases don't
++	 * do anything if NAPI was already initialized.
++	 */
++	if (!trans_pcie->napi.poll) {
++		init_dummy_netdev(&trans_pcie->napi_dev);
++		netif_napi_add(&trans_pcie->napi_dev, &trans_pcie->napi,
++			       iwl_pcie_dummy_napi_poll, 64);
++	}
++}
++
++void iwl_trans_pcie_free(struct iwl_trans *trans)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	int i;
++
++	synchronize_irq(trans_pcie->pci_dev->irq);
++
++	iwl_pcie_tx_free(trans);
++	iwl_pcie_rx_free(trans);
++
++	free_irq(trans_pcie->pci_dev->irq, trans);
++	iwl_pcie_free_ict(trans);
++
++	pci_disable_msi(trans_pcie->pci_dev);
++	iounmap(trans_pcie->hw_base);
++	pci_release_regions(trans_pcie->pci_dev);
++	pci_disable_device(trans_pcie->pci_dev);
++
++	if (trans_pcie->napi.poll)
++		netif_napi_del(&trans_pcie->napi);
++
++	iwl_pcie_free_fw_monitor(trans);
++
++	for_each_possible_cpu(i) {
++		struct iwl_tso_hdr_page *p =
++			per_cpu_ptr(trans_pcie->tso_hdr_page, i);
++
++		if (p->page)
++			__free_page(p->page);
++	}
++
++	free_percpu(trans_pcie->tso_hdr_page);
++	iwl_trans_free(trans);
++}
++
++static void iwl_trans_pcie_set_pmi(struct iwl_trans *trans, bool state)
++{
++	if (state)
++		set_bit(STATUS_TPOWER_PMI, &trans->status);
++	else
++		clear_bit(STATUS_TPOWER_PMI, &trans->status);
++}
++
++static bool iwl_trans_pcie_grab_nic_access(struct iwl_trans *trans,
++					   unsigned long *flags)
++{
++	int ret;
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++
++	spin_lock_irqsave(&trans_pcie->reg_lock, *flags);
++
++	if (trans_pcie->cmd_hold_nic_awake)
++		goto out;
++
++	/* this bit wakes up the NIC */
++	__iwl_trans_pcie_set_bit(trans, CSR_GP_CNTRL,
++				 CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
++	if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
++		udelay(2);
++
++	/*
++	 * These bits say the device is running, and should keep running for
++	 * at least a short while (at least as long as MAC_ACCESS_REQ stays 1),
++	 * but they do not indicate that embedded SRAM is restored yet;
++	 * 3945 and 4965 have volatile SRAM, and must save/restore contents
++	 * to/from host DRAM when sleeping/waking for power-saving.
++	 * Each direction takes approximately 1/4 millisecond; with this
++	 * overhead, it's a good idea to grab and hold MAC_ACCESS_REQUEST if a
++	 * series of register accesses are expected (e.g. reading Event Log),
++	 * to keep device from sleeping.
++	 *
++	 * CSR_UCODE_DRV_GP1 register bit MAC_SLEEP == 0 indicates that
++	 * SRAM is okay/restored.  We don't check that here because this call
++	 * is just for hardware register access; but GP1 MAC_SLEEP check is a
++	 * good idea before accessing 3945/4965 SRAM (e.g. reading Event Log).
++	 *
++	 * 5000 series and later (including 1000 series) have non-volatile SRAM,
++	 * and do not save/restore SRAM when power cycling.
++	 */
++	ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
++			   CSR_GP_CNTRL_REG_VAL_MAC_ACCESS_EN,
++			   (CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY |
++			    CSR_GP_CNTRL_REG_FLAG_GOING_TO_SLEEP), 15000);
++	if (unlikely(ret < 0)) {
++		iwl_write32(trans, CSR_RESET, CSR_RESET_REG_FLAG_FORCE_NMI);
++		WARN_ONCE(1,
++			  "Timeout waiting for hardware access (CSR_GP_CNTRL 0x%08x)\n",
++			  iwl_read32(trans, CSR_GP_CNTRL));
++		spin_unlock_irqrestore(&trans_pcie->reg_lock, *flags);
++		return false;
++	}
++
++out:
++	/*
++	 * Fool sparse by faking we release the lock - sparse will
++	 * track nic_access anyway.
++	 */
++	__release(&trans_pcie->reg_lock);
++	return true;
++}
++
++static void iwl_trans_pcie_release_nic_access(struct iwl_trans *trans,
++					      unsigned long *flags)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++
++	lockdep_assert_held(&trans_pcie->reg_lock);
++
++	/*
++	 * Fool sparse by faking we acquiring the lock - sparse will
++	 * track nic_access anyway.
++	 */
++	__acquire(&trans_pcie->reg_lock);
++
++	if (trans_pcie->cmd_hold_nic_awake)
++		goto out;
++
++	__iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
++				   CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
++	/*
++	 * Above we read the CSR_GP_CNTRL register, which will flush
++	 * any previous writes, but we need the write that clears the
++	 * MAC_ACCESS_REQ bit to be performed before any other writes
++	 * scheduled on different CPUs (after we drop reg_lock).
++	 */
++	mmiowb();
++out:
++	spin_unlock_irqrestore(&trans_pcie->reg_lock, *flags);
++}
++
++static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
++				   void *buf, int dwords)
++{
++	unsigned long flags;
++	int offs, ret = 0;
++	u32 *vals = buf;
++
++	if (iwl_trans_grab_nic_access(trans, &flags)) {
++		iwl_write32(trans, HBUS_TARG_MEM_RADDR, addr);
++		for (offs = 0; offs < dwords; offs++)
++			vals[offs] = iwl_read32(trans, HBUS_TARG_MEM_RDAT);
++		iwl_trans_release_nic_access(trans, &flags);
++	} else {
++		ret = -EBUSY;
++	}
++	return ret;
++}
++
++static int iwl_trans_pcie_write_mem(struct iwl_trans *trans, u32 addr,
++				    const void *buf, int dwords)
++{
++	unsigned long flags;
++	int offs, ret = 0;
++	const u32 *vals = buf;
++
++	if (iwl_trans_grab_nic_access(trans, &flags)) {
++		iwl_write32(trans, HBUS_TARG_MEM_WADDR, addr);
++		for (offs = 0; offs < dwords; offs++)
++			iwl_write32(trans, HBUS_TARG_MEM_WDAT,
++				    vals ? vals[offs] : 0);
++		iwl_trans_release_nic_access(trans, &flags);
++	} else {
++		ret = -EBUSY;
++	}
++	return ret;
++}
++
++static void iwl_trans_pcie_freeze_txq_timer(struct iwl_trans *trans,
++					    unsigned long txqs,
++					    bool freeze)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	int queue;
++
++	for_each_set_bit(queue, &txqs, BITS_PER_LONG) {
++		struct iwl_txq *txq = &trans_pcie->txq[queue];
++		unsigned long now;
++
++		spin_lock_bh(&txq->lock);
++
++		now = jiffies;
++
++		if (txq->frozen == freeze)
++			goto next_queue;
++
++		IWL_DEBUG_TX_QUEUES(trans, "%s TXQ %d\n",
++				    freeze ? "Freezing" : "Waking", queue);
++
++		txq->frozen = freeze;
++
++		if (txq->q.read_ptr == txq->q.write_ptr)
++			goto next_queue;
++
++		if (freeze) {
++			if (unlikely(time_after(now,
++						txq->stuck_timer.expires))) {
++				/*
++				 * The timer should have fired, maybe it is
++				 * spinning right now on the lock.
++				 */
++				goto next_queue;
++			}
++			/* remember how long until the timer fires */
++			txq->frozen_expiry_remainder =
++				txq->stuck_timer.expires - now;
++			del_timer(&txq->stuck_timer);
++			goto next_queue;
++		}
++
++		/*
++		 * Wake a non-empty queue -> arm timer with the
++		 * remainder before it froze
++		 */
++		mod_timer(&txq->stuck_timer,
++			  now + txq->frozen_expiry_remainder);
++
++next_queue:
++		spin_unlock_bh(&txq->lock);
++	}
++}
++
++static void iwl_trans_pcie_block_txq_ptrs(struct iwl_trans *trans, bool block)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	int i;
++
++	for (i = 0; i < trans->cfg->base_params->num_of_queues; i++) {
++		struct iwl_txq *txq = &trans_pcie->txq[i];
++
++		if (i == trans_pcie->cmd_queue)
++			continue;
++
++		spin_lock_bh(&txq->lock);
++
++		if (!block && !(WARN_ON_ONCE(!txq->block))) {
++			txq->block--;
++			if (!txq->block) {
++				iwl_write32(trans, HBUS_TARG_WRPTR,
++					    txq->q.write_ptr | (i << 8));
++			}
++		} else if (block) {
++			txq->block++;
++		}
++
++		spin_unlock_bh(&txq->lock);
++	}
++}
++
++#define IWL_FLUSH_WAIT_MS	2000
++
++static int iwl_trans_pcie_wait_txq_empty(struct iwl_trans *trans, u32 txq_bm)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	struct iwl_txq *txq;
++	struct iwl_queue *q;
++	int cnt;
++	unsigned long now = jiffies;
++	u32 scd_sram_addr;
++	u8 buf[16];
++	int ret = 0;
++
++	/* waiting for all the tx frames complete might take a while */
++	for (cnt = 0; cnt < trans->cfg->base_params->num_of_queues; cnt++) {
++		u8 wr_ptr;
++
++		if (cnt == trans_pcie->cmd_queue)
++			continue;
++		if (!test_bit(cnt, trans_pcie->queue_used))
++			continue;
++		if (!(BIT(cnt) & txq_bm))
++			continue;
++
++		IWL_DEBUG_TX_QUEUES(trans, "Emptying queue %d...\n", cnt);
++		txq = &trans_pcie->txq[cnt];
++		q = &txq->q;
++		wr_ptr = ACCESS_ONCE(q->write_ptr);
++
++		while (q->read_ptr != ACCESS_ONCE(q->write_ptr) &&
++		       !time_after(jiffies,
++				   now + msecs_to_jiffies(IWL_FLUSH_WAIT_MS))) {
++			u8 write_ptr = ACCESS_ONCE(q->write_ptr);
++
++			if (WARN_ONCE(wr_ptr != write_ptr,
++				      "WR pointer moved while flushing %d -> %d\n",
++				      wr_ptr, write_ptr))
++				return -ETIMEDOUT;
++			msleep(1);
++		}
++
++		if (q->read_ptr != q->write_ptr) {
++			IWL_ERR(trans,
++				"fail to flush all tx fifo queues Q %d\n", cnt);
++			ret = -ETIMEDOUT;
++			break;
++		}
++		IWL_DEBUG_TX_QUEUES(trans, "Queue %d is now empty.\n", cnt);
++	}
++
++	if (!ret)
++		return 0;
++
++	IWL_ERR(trans, "Current SW read_ptr %d write_ptr %d\n",
++		txq->q.read_ptr, txq->q.write_ptr);
++
++	scd_sram_addr = trans_pcie->scd_base_addr +
++			SCD_TX_STTS_QUEUE_OFFSET(txq->q.id);
++	iwl_trans_read_mem_bytes(trans, scd_sram_addr, buf, sizeof(buf));
++
++	iwl_print_hex_error(trans, buf, sizeof(buf));
++
++	for (cnt = 0; cnt < FH_TCSR_CHNL_NUM; cnt++)
++		IWL_ERR(trans, "FH TRBs(%d) = 0x%08x\n", cnt,
++			iwl_read_direct32(trans, FH_TX_TRB_REG(cnt)));
++
++	for (cnt = 0; cnt < trans->cfg->base_params->num_of_queues; cnt++) {
++		u32 status = iwl_read_prph(trans, SCD_QUEUE_STATUS_BITS(cnt));
++		u8 fifo = (status >> SCD_QUEUE_STTS_REG_POS_TXF) & 0x7;
++		bool active = !!(status & BIT(SCD_QUEUE_STTS_REG_POS_ACTIVE));
++		u32 tbl_dw =
++			iwl_trans_read_mem32(trans, trans_pcie->scd_base_addr +
++					     SCD_TRANS_TBL_OFFSET_QUEUE(cnt));
++
++		if (cnt & 0x1)
++			tbl_dw = (tbl_dw & 0xFFFF0000) >> 16;
++		else
++			tbl_dw = tbl_dw & 0x0000FFFF;
++
++		IWL_ERR(trans,
++			"Q %d is %sactive and mapped to fifo %d ra_tid 0x%04x [%d,%d]\n",
++			cnt, active ? "" : "in", fifo, tbl_dw,
++			iwl_read_prph(trans, SCD_QUEUE_RDPTR(cnt)) &
++				(TFD_QUEUE_SIZE_MAX - 1),
++			iwl_read_prph(trans, SCD_QUEUE_WRPTR(cnt)));
++	}
++
++	return ret;
++}
++
++static void iwl_trans_pcie_set_bits_mask(struct iwl_trans *trans, u32 reg,
++					 u32 mask, u32 value)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	unsigned long flags;
++
++	spin_lock_irqsave(&trans_pcie->reg_lock, flags);
++	__iwl_trans_pcie_set_bits_mask(trans, reg, mask, value);
++	spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
++}
++
++void iwl_trans_pcie_ref(struct iwl_trans *trans)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	unsigned long flags;
++
++	if (iwlwifi_mod_params.d0i3_disable)
++		return;
++
++	spin_lock_irqsave(&trans_pcie->ref_lock, flags);
++	IWL_DEBUG_RPM(trans, "ref_counter: %d\n", trans_pcie->ref_count);
++	trans_pcie->ref_count++;
++	spin_unlock_irqrestore(&trans_pcie->ref_lock, flags);
++}
++
++void iwl_trans_pcie_unref(struct iwl_trans *trans)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	unsigned long flags;
++
++	if (iwlwifi_mod_params.d0i3_disable)
++		return;
++
++	spin_lock_irqsave(&trans_pcie->ref_lock, flags);
++	IWL_DEBUG_RPM(trans, "ref_counter: %d\n", trans_pcie->ref_count);
++	if (WARN_ON_ONCE(trans_pcie->ref_count == 0)) {
++		spin_unlock_irqrestore(&trans_pcie->ref_lock, flags);
++		return;
++	}
++	trans_pcie->ref_count--;
++	spin_unlock_irqrestore(&trans_pcie->ref_lock, flags);
++}
++
++static const char *get_csr_string(int cmd)
++{
++#define IWL_CMD(x) case x: return #x
++	switch (cmd) {
++	IWL_CMD(CSR_HW_IF_CONFIG_REG);
++	IWL_CMD(CSR_INT_COALESCING);
++	IWL_CMD(CSR_INT);
++	IWL_CMD(CSR_INT_MASK);
++	IWL_CMD(CSR_FH_INT_STATUS);
++	IWL_CMD(CSR_GPIO_IN);
++	IWL_CMD(CSR_RESET);
++	IWL_CMD(CSR_GP_CNTRL);
++	IWL_CMD(CSR_HW_REV);
++	IWL_CMD(CSR_EEPROM_REG);
++	IWL_CMD(CSR_EEPROM_GP);
++	IWL_CMD(CSR_OTP_GP_REG);
++	IWL_CMD(CSR_GIO_REG);
++	IWL_CMD(CSR_GP_UCODE_REG);
++	IWL_CMD(CSR_GP_DRIVER_REG);
++	IWL_CMD(CSR_UCODE_DRV_GP1);
++	IWL_CMD(CSR_UCODE_DRV_GP2);
++	IWL_CMD(CSR_LED_REG);
++	IWL_CMD(CSR_DRAM_INT_TBL_REG);
++	IWL_CMD(CSR_GIO_CHICKEN_BITS);
++	IWL_CMD(CSR_ANA_PLL_CFG);
++	IWL_CMD(CSR_HW_REV_WA_REG);
++	IWL_CMD(CSR_MONITOR_STATUS_REG);
++	IWL_CMD(CSR_DBG_HPET_MEM_REG);
++	default:
++		return "UNKNOWN";
++	}
++#undef IWL_CMD
++}
++
++void iwl_pcie_dump_csr(struct iwl_trans *trans)
++{
++	int i;
++	static const u32 csr_tbl[] = {
++		CSR_HW_IF_CONFIG_REG,
++		CSR_INT_COALESCING,
++		CSR_INT,
++		CSR_INT_MASK,
++		CSR_FH_INT_STATUS,
++		CSR_GPIO_IN,
++		CSR_RESET,
++		CSR_GP_CNTRL,
++		CSR_HW_REV,
++		CSR_EEPROM_REG,
++		CSR_EEPROM_GP,
++		CSR_OTP_GP_REG,
++		CSR_GIO_REG,
++		CSR_GP_UCODE_REG,
++		CSR_GP_DRIVER_REG,
++		CSR_UCODE_DRV_GP1,
++		CSR_UCODE_DRV_GP2,
++		CSR_LED_REG,
++		CSR_DRAM_INT_TBL_REG,
++		CSR_GIO_CHICKEN_BITS,
++		CSR_ANA_PLL_CFG,
++		CSR_MONITOR_STATUS_REG,
++		CSR_HW_REV_WA_REG,
++		CSR_DBG_HPET_MEM_REG
++	};
++	IWL_ERR(trans, "CSR values:\n");
++	IWL_ERR(trans, "(2nd byte of CSR_INT_COALESCING is "
++		"CSR_INT_PERIODIC_REG)\n");
++	for (i = 0; i <  ARRAY_SIZE(csr_tbl); i++) {
++		IWL_ERR(trans, "  %25s: 0X%08x\n",
++			get_csr_string(csr_tbl[i]),
++			iwl_read32(trans, csr_tbl[i]));
++	}
++}
++
++#ifdef CONFIG_IWLWIFI_DEBUGFS
++/* create and remove of files */
++#define DEBUGFS_ADD_FILE(name, parent, mode) do {			\
++	if (!debugfs_create_file(#name, mode, parent, trans,		\
++				 &iwl_dbgfs_##name##_ops))		\
++		goto err;						\
++} while (0)
++
++/* file operation */
++#define DEBUGFS_READ_FILE_OPS(name)					\
++static const struct file_operations iwl_dbgfs_##name##_ops = {		\
++	.read = iwl_dbgfs_##name##_read,				\
++	.open = simple_open,						\
++	.llseek = generic_file_llseek,					\
++};
++
++#define DEBUGFS_WRITE_FILE_OPS(name)                                    \
++static const struct file_operations iwl_dbgfs_##name##_ops = {          \
++	.write = iwl_dbgfs_##name##_write,                              \
++	.open = simple_open,						\
++	.llseek = generic_file_llseek,					\
++};
++
++#define DEBUGFS_READ_WRITE_FILE_OPS(name)				\
++static const struct file_operations iwl_dbgfs_##name##_ops = {		\
++	.write = iwl_dbgfs_##name##_write,				\
++	.read = iwl_dbgfs_##name##_read,				\
++	.open = simple_open,						\
++	.llseek = generic_file_llseek,					\
++};
++
++static ssize_t iwl_dbgfs_tx_queue_read(struct file *file,
++				       char __user *user_buf,
++				       size_t count, loff_t *ppos)
++{
++	struct iwl_trans *trans = file->private_data;
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	struct iwl_txq *txq;
++	struct iwl_queue *q;
++	char *buf;
++	int pos = 0;
++	int cnt;
++	int ret;
++	size_t bufsz;
++
++	bufsz = sizeof(char) * 75 * trans->cfg->base_params->num_of_queues;
++
++	if (!trans_pcie->txq)
++		return -EAGAIN;
++
++	buf = kzalloc(bufsz, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	for (cnt = 0; cnt < trans->cfg->base_params->num_of_queues; cnt++) {
++		txq = &trans_pcie->txq[cnt];
++		q = &txq->q;
++		pos += scnprintf(buf + pos, bufsz - pos,
++				"hwq %.2d: read=%u write=%u use=%d stop=%d need_update=%d frozen=%d%s\n",
++				cnt, q->read_ptr, q->write_ptr,
++				!!test_bit(cnt, trans_pcie->queue_used),
++				 !!test_bit(cnt, trans_pcie->queue_stopped),
++				 txq->need_update, txq->frozen,
++				 (cnt == trans_pcie->cmd_queue ? " HCMD" : ""));
++	}
++	ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
++	kfree(buf);
++	return ret;
++}
++
++static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
++				       char __user *user_buf,
++				       size_t count, loff_t *ppos)
++{
++	struct iwl_trans *trans = file->private_data;
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	struct iwl_rxq *rxq = &trans_pcie->rxq;
++	char buf[256];
++	int pos = 0;
++	const size_t bufsz = sizeof(buf);
++
++	pos += scnprintf(buf + pos, bufsz - pos, "read: %u\n",
++						rxq->read);
++	pos += scnprintf(buf + pos, bufsz - pos, "write: %u\n",
++						rxq->write);
++	pos += scnprintf(buf + pos, bufsz - pos, "write_actual: %u\n",
++						rxq->write_actual);
++	pos += scnprintf(buf + pos, bufsz - pos, "need_update: %d\n",
++						rxq->need_update);
++	pos += scnprintf(buf + pos, bufsz - pos, "free_count: %u\n",
++						rxq->free_count);
++	if (rxq->rb_stts) {
++		pos += scnprintf(buf + pos, bufsz - pos, "closed_rb_num: %u\n",
++			 le16_to_cpu(rxq->rb_stts->closed_rb_num) &  0x0FFF);
++	} else {
++		pos += scnprintf(buf + pos, bufsz - pos,
++					"closed_rb_num: Not Allocated\n");
++	}
++	return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
++}
++
++static ssize_t iwl_dbgfs_interrupt_read(struct file *file,
++					char __user *user_buf,
++					size_t count, loff_t *ppos)
++{
++	struct iwl_trans *trans = file->private_data;
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	struct isr_statistics *isr_stats = &trans_pcie->isr_stats;
++
++	int pos = 0;
++	char *buf;
++	int bufsz = 24 * 64; /* 24 items * 64 char per item */
++	ssize_t ret;
++
++	buf = kzalloc(bufsz, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	pos += scnprintf(buf + pos, bufsz - pos,
++			"Interrupt Statistics Report:\n");
++
++	pos += scnprintf(buf + pos, bufsz - pos, "HW Error:\t\t\t %u\n",
++		isr_stats->hw);
++	pos += scnprintf(buf + pos, bufsz - pos, "SW Error:\t\t\t %u\n",
++		isr_stats->sw);
++	if (isr_stats->sw || isr_stats->hw) {
++		pos += scnprintf(buf + pos, bufsz - pos,
++			"\tLast Restarting Code:  0x%X\n",
++			isr_stats->err_code);
++	}
++#ifdef CONFIG_IWLWIFI_DEBUG
++	pos += scnprintf(buf + pos, bufsz - pos, "Frame transmitted:\t\t %u\n",
++		isr_stats->sch);
++	pos += scnprintf(buf + pos, bufsz - pos, "Alive interrupt:\t\t %u\n",
++		isr_stats->alive);
++#endif
++	pos += scnprintf(buf + pos, bufsz - pos,
++		"HW RF KILL switch toggled:\t %u\n", isr_stats->rfkill);
++
++	pos += scnprintf(buf + pos, bufsz - pos, "CT KILL:\t\t\t %u\n",
++		isr_stats->ctkill);
++
++	pos += scnprintf(buf + pos, bufsz - pos, "Wakeup Interrupt:\t\t %u\n",
++		isr_stats->wakeup);
++
++	pos += scnprintf(buf + pos, bufsz - pos,
++		"Rx command responses:\t\t %u\n", isr_stats->rx);
++
++	pos += scnprintf(buf + pos, bufsz - pos, "Tx/FH interrupt:\t\t %u\n",
++		isr_stats->tx);
++
++	pos += scnprintf(buf + pos, bufsz - pos, "Unexpected INTA:\t\t %u\n",
++		isr_stats->unhandled);
++
++	ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
++	kfree(buf);
++	return ret;
++}
++
++static ssize_t iwl_dbgfs_interrupt_write(struct file *file,
++					 const char __user *user_buf,
++					 size_t count, loff_t *ppos)
++{
++	struct iwl_trans *trans = file->private_data;
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	struct isr_statistics *isr_stats = &trans_pcie->isr_stats;
++
++	char buf[8];
++	int buf_size;
++	u32 reset_flag;
++
++	memset(buf, 0, sizeof(buf));
++	buf_size = min(count, sizeof(buf) -  1);
++	if (copy_from_user(buf, user_buf, buf_size))
++		return -EFAULT;
++	if (sscanf(buf, "%x", &reset_flag) != 1)
++		return -EFAULT;
++	if (reset_flag == 0)
++		memset(isr_stats, 0, sizeof(*isr_stats));
++
++	return count;
++}
++
++static ssize_t iwl_dbgfs_csr_write(struct file *file,
++				   const char __user *user_buf,
++				   size_t count, loff_t *ppos)
++{
++	struct iwl_trans *trans = file->private_data;
++	char buf[8];
++	int buf_size;
++	int csr;
++
++	memset(buf, 0, sizeof(buf));
++	buf_size = min(count, sizeof(buf) -  1);
++	if (copy_from_user(buf, user_buf, buf_size))
++		return -EFAULT;
++	if (sscanf(buf, "%d", &csr) != 1)
++		return -EFAULT;
++
++	iwl_pcie_dump_csr(trans);
++
++	return count;
++}
++
++static ssize_t iwl_dbgfs_fh_reg_read(struct file *file,
++				     char __user *user_buf,
++				     size_t count, loff_t *ppos)
++{
++	struct iwl_trans *trans = file->private_data;
++	char *buf = NULL;
++	ssize_t ret;
++
++	ret = iwl_dump_fh(trans, &buf);
++	if (ret < 0)
++		return ret;
++	if (!buf)
++		return -EINVAL;
++	ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
++	kfree(buf);
++	return ret;
++}
++
++DEBUGFS_READ_WRITE_FILE_OPS(interrupt);
++DEBUGFS_READ_FILE_OPS(fh_reg);
++DEBUGFS_READ_FILE_OPS(rx_queue);
++DEBUGFS_READ_FILE_OPS(tx_queue);
++DEBUGFS_WRITE_FILE_OPS(csr);
++
++/* Create the debugfs files and directories */
++int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans)
++{
++	struct dentry *dir = trans->dbgfs_dir;
++
++	DEBUGFS_ADD_FILE(rx_queue, dir, S_IRUSR);
++	DEBUGFS_ADD_FILE(tx_queue, dir, S_IRUSR);
++	DEBUGFS_ADD_FILE(interrupt, dir, S_IWUSR | S_IRUSR);
++	DEBUGFS_ADD_FILE(csr, dir, S_IWUSR);
++	DEBUGFS_ADD_FILE(fh_reg, dir, S_IRUSR);
++	return 0;
++
++err:
++	IWL_ERR(trans, "failed to create the trans debugfs entry\n");
++	return -ENOMEM;
++}
++#endif /*CONFIG_IWLWIFI_DEBUGFS */
++
++static u32 iwl_trans_pcie_get_cmdlen(struct iwl_tfd *tfd)
++{
++	u32 cmdlen = 0;
++	int i;
++
++	for (i = 0; i < IWL_NUM_OF_TBS; i++)
++		cmdlen += iwl_pcie_tfd_tb_get_len(tfd, i);
++
++	return cmdlen;
++}
++
++static u32 iwl_trans_pcie_dump_rbs(struct iwl_trans *trans,
++				   struct iwl_fw_error_dump_data **data,
++				   int allocated_rb_nums)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	int max_len = PAGE_SIZE << trans_pcie->rx_page_order;
++	struct iwl_rxq *rxq = &trans_pcie->rxq;
++	u32 i, r, j, rb_len = 0;
++
++	spin_lock(&rxq->lock);
++
++	r = le16_to_cpu(ACCESS_ONCE(rxq->rb_stts->closed_rb_num)) & 0x0FFF;
++
++	for (i = rxq->read, j = 0;
++	     i != r && j < allocated_rb_nums;
++	     i = (i + 1) & RX_QUEUE_MASK, j++) {
++		struct iwl_rx_mem_buffer *rxb = rxq->queue[i];
++		struct iwl_fw_error_dump_rb *rb;
++
++		dma_unmap_page(trans->dev, rxb->page_dma, max_len,
++			       DMA_FROM_DEVICE);
++
++		rb_len += sizeof(**data) + sizeof(*rb) + max_len;
++
++		(*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_RB);
++		(*data)->len = cpu_to_le32(sizeof(*rb) + max_len);
++		rb = (void *)(*data)->data;
++		rb->index = cpu_to_le32(i);
++		memcpy(rb->data, page_address(rxb->page), max_len);
++		/* remap the page for the free benefit */
++		rxb->page_dma = dma_map_page(trans->dev, rxb->page, 0,
++						     max_len,
++						     DMA_FROM_DEVICE);
++
++		*data = iwl_fw_error_next_data(*data);
++	}
++
++	spin_unlock(&rxq->lock);
++
++	return rb_len;
++}
++#define IWL_CSR_TO_DUMP (0x250)
++
++static u32 iwl_trans_pcie_dump_csr(struct iwl_trans *trans,
++				   struct iwl_fw_error_dump_data **data)
++{
++	u32 csr_len = sizeof(**data) + IWL_CSR_TO_DUMP;
++	__le32 *val;
++	int i;
++
++	(*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_CSR);
++	(*data)->len = cpu_to_le32(IWL_CSR_TO_DUMP);
++	val = (void *)(*data)->data;
++
++	for (i = 0; i < IWL_CSR_TO_DUMP; i += 4)
++		*val++ = cpu_to_le32(iwl_trans_pcie_read32(trans, i));
++
++	*data = iwl_fw_error_next_data(*data);
++
++	return csr_len;
++}
++
++static u32 iwl_trans_pcie_fh_regs_dump(struct iwl_trans *trans,
++				       struct iwl_fw_error_dump_data **data)
++{
++	u32 fh_regs_len = FH_MEM_UPPER_BOUND - FH_MEM_LOWER_BOUND;
++	unsigned long flags;
++	__le32 *val;
++	int i;
++
++	if (!iwl_trans_grab_nic_access(trans, &flags))
++		return 0;
++
++	(*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_FH_REGS);
++	(*data)->len = cpu_to_le32(fh_regs_len);
++	val = (void *)(*data)->data;
++
++	for (i = FH_MEM_LOWER_BOUND; i < FH_MEM_UPPER_BOUND; i += sizeof(u32))
++		*val++ = cpu_to_le32(iwl_trans_pcie_read32(trans, i));
++
++	iwl_trans_release_nic_access(trans, &flags);
++
++	*data = iwl_fw_error_next_data(*data);
++
++	return sizeof(**data) + fh_regs_len;
++}
++
++static u32
++iwl_trans_pci_dump_marbh_monitor(struct iwl_trans *trans,
++				 struct iwl_fw_error_dump_fw_mon *fw_mon_data,
++				 u32 monitor_len)
++{
++	u32 buf_size_in_dwords = (monitor_len >> 2);
++	u32 *buffer = (u32 *)fw_mon_data->data;
++	unsigned long flags;
++	u32 i;
++
++	if (!iwl_trans_grab_nic_access(trans, &flags))
++		return 0;
++
++	iwl_write_prph_no_grab(trans, MON_DMARB_RD_CTL_ADDR, 0x1);
++	for (i = 0; i < buf_size_in_dwords; i++)
++		buffer[i] = iwl_read_prph_no_grab(trans,
++				MON_DMARB_RD_DATA_ADDR);
++	iwl_write_prph_no_grab(trans, MON_DMARB_RD_CTL_ADDR, 0x0);
++
++	iwl_trans_release_nic_access(trans, &flags);
++
++	return monitor_len;
++}
++
++static u32
++iwl_trans_pcie_dump_monitor(struct iwl_trans *trans,
++			    struct iwl_fw_error_dump_data **data,
++			    u32 monitor_len)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	u32 len = 0;
++
++	if ((trans_pcie->fw_mon_page &&
++	     trans->cfg->device_family == IWL_DEVICE_FAMILY_7000) ||
++	    trans->dbg_dest_tlv) {
++		struct iwl_fw_error_dump_fw_mon *fw_mon_data;
++		u32 base, write_ptr, wrap_cnt;
++
++		/* If there was a dest TLV - use the values from there */
++		if (trans->dbg_dest_tlv) {
++			write_ptr =
++				le32_to_cpu(trans->dbg_dest_tlv->write_ptr_reg);
++			wrap_cnt = le32_to_cpu(trans->dbg_dest_tlv->wrap_count);
++			base = le32_to_cpu(trans->dbg_dest_tlv->base_reg);
++		} else {
++			base = MON_BUFF_BASE_ADDR;
++			write_ptr = MON_BUFF_WRPTR;
++			wrap_cnt = MON_BUFF_CYCLE_CNT;
++		}
++
++		(*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_FW_MONITOR);
++		fw_mon_data = (void *)(*data)->data;
++		fw_mon_data->fw_mon_wr_ptr =
++			cpu_to_le32(iwl_read_prph(trans, write_ptr));
++		fw_mon_data->fw_mon_cycle_cnt =
++			cpu_to_le32(iwl_read_prph(trans, wrap_cnt));
++		fw_mon_data->fw_mon_base_ptr =
++			cpu_to_le32(iwl_read_prph(trans, base));
++
++		len += sizeof(**data) + sizeof(*fw_mon_data);
++		if (trans_pcie->fw_mon_page) {
++			/*
++			 * The firmware is now asserted, it won't write anything
++			 * to the buffer. CPU can take ownership to fetch the
++			 * data. The buffer will be handed back to the device
++			 * before the firmware will be restarted.
++			 */
++			dma_sync_single_for_cpu(trans->dev,
++						trans_pcie->fw_mon_phys,
++						trans_pcie->fw_mon_size,
++						DMA_FROM_DEVICE);
++			memcpy(fw_mon_data->data,
++			       page_address(trans_pcie->fw_mon_page),
++			       trans_pcie->fw_mon_size);
++
++			monitor_len = trans_pcie->fw_mon_size;
++		} else if (trans->dbg_dest_tlv->monitor_mode == SMEM_MODE) {
++			/*
++			 * Update pointers to reflect actual values after
++			 * shifting
++			 */
++			base = iwl_read_prph(trans, base) <<
++			       trans->dbg_dest_tlv->base_shift;
++			iwl_trans_read_mem(trans, base, fw_mon_data->data,
++					   monitor_len / sizeof(u32));
++		} else if (trans->dbg_dest_tlv->monitor_mode == MARBH_MODE) {
++			monitor_len =
++				iwl_trans_pci_dump_marbh_monitor(trans,
++								 fw_mon_data,
++								 monitor_len);
++		} else {
++			/* Didn't match anything - output no monitor data */
++			monitor_len = 0;
++		}
++
++		len += monitor_len;
++		(*data)->len = cpu_to_le32(monitor_len + sizeof(*fw_mon_data));
++	}
++
++	return len;
++}
++
++static struct iwl_trans_dump_data
++*iwl_trans_pcie_dump_data(struct iwl_trans *trans,
++			  const struct iwl_fw_dbg_trigger_tlv *trigger)
++{
++	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	struct iwl_fw_error_dump_data *data;
++	struct iwl_txq *cmdq = &trans_pcie->txq[trans_pcie->cmd_queue];
++	struct iwl_fw_error_dump_txcmd *txcmd;
++	struct iwl_trans_dump_data *dump_data;
++	u32 len, num_rbs;
++	u32 monitor_len;
++	int i, ptr;
++	bool dump_rbs = test_bit(STATUS_FW_ERROR, &trans->status);
++
++	/* transport dump header */
++	len = sizeof(*dump_data);
++
++	/* host commands */
++	len += sizeof(*data) +
++		cmdq->q.n_window * (sizeof(*txcmd) + TFD_MAX_PAYLOAD_SIZE);
++
++	/* FW monitor */
++	if (trans_pcie->fw_mon_page) {
++		len += sizeof(*data) + sizeof(struct iwl_fw_error_dump_fw_mon) +
++		       trans_pcie->fw_mon_size;
++		monitor_len = trans_pcie->fw_mon_size;
++	} else if (trans->dbg_dest_tlv) {
++		u32 base, end;
++
++		base = le32_to_cpu(trans->dbg_dest_tlv->base_reg);
++		end = le32_to_cpu(trans->dbg_dest_tlv->end_reg);
++
++		base = iwl_read_prph(trans, base) <<
++		       trans->dbg_dest_tlv->base_shift;
++		end = iwl_read_prph(trans, end) <<
++		      trans->dbg_dest_tlv->end_shift;
++
++		/* Make "end" point to the actual end */
++		if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000 ||
++		    trans->dbg_dest_tlv->monitor_mode == MARBH_MODE)
++			end += (1 << trans->dbg_dest_tlv->end_shift);
++		monitor_len = end - base;
++		len += sizeof(*data) + sizeof(struct iwl_fw_error_dump_fw_mon) +
++		       monitor_len;
++	} else {
++		monitor_len = 0;
++	}
++
++	if (trigger && (trigger->mode & IWL_FW_DBG_TRIGGER_MONITOR_ONLY)) {
++		dump_data = vzalloc(len);
++		if (!dump_data)
++			return NULL;
++
++		data = (void *)dump_data->data;
++		len = iwl_trans_pcie_dump_monitor(trans, &data, monitor_len);
++		dump_data->len = len;
++
++		return dump_data;
++	}
++
++	/* CSR registers */
++	len += sizeof(*data) + IWL_CSR_TO_DUMP;
++
++	/* FH registers */
++	len += sizeof(*data) + (FH_MEM_UPPER_BOUND - FH_MEM_LOWER_BOUND);
++
++	if (dump_rbs) {
++		/* RBs */
++		num_rbs = le16_to_cpu(ACCESS_ONCE(
++				      trans_pcie->rxq.rb_stts->closed_rb_num))
++				      & 0x0FFF;
++		num_rbs = (num_rbs - trans_pcie->rxq.read) & RX_QUEUE_MASK;
++		len += num_rbs * (sizeof(*data) +
++				  sizeof(struct iwl_fw_error_dump_rb) +
++				  (PAGE_SIZE << trans_pcie->rx_page_order));
++	}
++
++	dump_data = vzalloc(len);
++	if (!dump_data)
++		return NULL;
++
++	len = 0;
++	data = (void *)dump_data->data;
++	data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_TXCMD);
++	txcmd = (void *)data->data;
++	spin_lock_bh(&cmdq->lock);
++	ptr = cmdq->q.write_ptr;
++	for (i = 0; i < cmdq->q.n_window; i++) {
++		u8 idx = get_cmd_index(&cmdq->q, ptr);
++		u32 caplen, cmdlen;
++
++		cmdlen = iwl_trans_pcie_get_cmdlen(&cmdq->tfds[ptr]);
++		caplen = min_t(u32, TFD_MAX_PAYLOAD_SIZE, cmdlen);
++
++		if (cmdlen) {
++			len += sizeof(*txcmd) + caplen;
++			txcmd->cmdlen = cpu_to_le32(cmdlen);
++			txcmd->caplen = cpu_to_le32(caplen);
++			memcpy(txcmd->data, cmdq->entries[idx].cmd, caplen);
++			txcmd = (void *)((u8 *)txcmd->data + caplen);
++		}
++
++		ptr = iwl_queue_dec_wrap(ptr);
++	}
++	spin_unlock_bh(&cmdq->lock);
++
++	data->len = cpu_to_le32(len);
++	len += sizeof(*data);
++	data = iwl_fw_error_next_data(data);
++
++	len += iwl_trans_pcie_dump_csr(trans, &data);
++	len += iwl_trans_pcie_fh_regs_dump(trans, &data);
++	if (dump_rbs)
++		len += iwl_trans_pcie_dump_rbs(trans, &data, num_rbs);
++
++	len += iwl_trans_pcie_dump_monitor(trans, &data, monitor_len);
++
++	dump_data->len = len;
++
++	return dump_data;
++}
++
++static const struct iwl_trans_ops trans_ops_pcie = {
++	.start_hw = iwl_trans_pcie_start_hw,
++	.op_mode_leave = iwl_trans_pcie_op_mode_leave,
++	.fw_alive = iwl_trans_pcie_fw_alive,
++	.start_fw = iwl_trans_pcie_start_fw,
++	.stop_device = iwl_trans_pcie_stop_device,
++
++	.d3_suspend = iwl_trans_pcie_d3_suspend,
++	.d3_resume = iwl_trans_pcie_d3_resume,
++
++	.send_cmd = iwl_trans_pcie_send_hcmd,
++
++	.tx = iwl_trans_pcie_tx,
++	.reclaim = iwl_trans_pcie_reclaim,
++
++	.txq_disable = iwl_trans_pcie_txq_disable,
++	.txq_enable = iwl_trans_pcie_txq_enable,
++
++	.wait_tx_queue_empty = iwl_trans_pcie_wait_txq_empty,
++	.freeze_txq_timer = iwl_trans_pcie_freeze_txq_timer,
++	.block_txq_ptrs = iwl_trans_pcie_block_txq_ptrs,
++
++	.write8 = iwl_trans_pcie_write8,
++	.write32 = iwl_trans_pcie_write32,
++	.read32 = iwl_trans_pcie_read32,
++	.read_prph = iwl_trans_pcie_read_prph,
++	.write_prph = iwl_trans_pcie_write_prph,
++	.read_mem = iwl_trans_pcie_read_mem,
++	.write_mem = iwl_trans_pcie_write_mem,
++	.configure = iwl_trans_pcie_configure,
++	.set_pmi = iwl_trans_pcie_set_pmi,
++	.grab_nic_access = iwl_trans_pcie_grab_nic_access,
++	.release_nic_access = iwl_trans_pcie_release_nic_access,
++	.set_bits_mask = iwl_trans_pcie_set_bits_mask,
++
++	.ref = iwl_trans_pcie_ref,
++	.unref = iwl_trans_pcie_unref,
++
++	.dump_data = iwl_trans_pcie_dump_data,
++};
++
++struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
++				       const struct pci_device_id *ent,
++				       const struct iwl_cfg *cfg)
++{
++	struct iwl_trans_pcie *trans_pcie;
++	struct iwl_trans *trans;
++	u16 pci_cmd;
++	int ret;
++
++	trans = iwl_trans_alloc(sizeof(struct iwl_trans_pcie),
++				&pdev->dev, cfg, &trans_ops_pcie, 0);
++	if (!trans)
++		return ERR_PTR(-ENOMEM);
++
++	trans->max_skb_frags = IWL_PCIE_MAX_FRAGS;
++
++	trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++
++	trans_pcie->trans = trans;
++	spin_lock_init(&trans_pcie->irq_lock);
++	spin_lock_init(&trans_pcie->reg_lock);
++	spin_lock_init(&trans_pcie->ref_lock);
++	mutex_init(&trans_pcie->mutex);
++	init_waitqueue_head(&trans_pcie->ucode_write_waitq);
++	trans_pcie->tso_hdr_page = alloc_percpu(struct iwl_tso_hdr_page);
++	if (!trans_pcie->tso_hdr_page) {
++		ret = -ENOMEM;
++		goto out_no_pci;
++	}
++
++	ret = pci_enable_device(pdev);
++	if (ret)
++		goto out_no_pci;
++
++	if (!cfg->base_params->pcie_l1_allowed) {
++		/*
++		 * W/A - seems to solve weird behavior. We need to remove this
++		 * if we don't want to stay in L1 all the time. This wastes a
++		 * lot of power.
++		 */
++		pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S |
++				       PCIE_LINK_STATE_L1 |
++				       PCIE_LINK_STATE_CLKPM);
++	}
++
++	pci_set_master(pdev);
++
++	ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(36));
++	if (!ret)
++		ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(36));
++	if (ret) {
++		ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
++		if (!ret)
++			ret = pci_set_consistent_dma_mask(pdev,
++							  DMA_BIT_MASK(32));
++		/* both attempts failed: */
++		if (ret) {
++			dev_err(&pdev->dev, "No suitable DMA available\n");
++			goto out_pci_disable_device;
++		}
++	}
++
++	ret = pci_request_regions(pdev, DRV_NAME);
++	if (ret) {
++		dev_err(&pdev->dev, "pci_request_regions failed\n");
++		goto out_pci_disable_device;
++	}
++
++	trans_pcie->hw_base = pci_ioremap_bar(pdev, 0);
++	if (!trans_pcie->hw_base) {
++		dev_err(&pdev->dev, "pci_ioremap_bar failed\n");
++		ret = -ENODEV;
++		goto out_pci_release_regions;
++	}
++
++	/* We disable the RETRY_TIMEOUT register (0x41) to keep
++	 * PCI Tx retries from interfering with C3 CPU state */
++	pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00);
++
++	trans->dev = &pdev->dev;
++	trans_pcie->pci_dev = pdev;
++	iwl_disable_interrupts(trans);
++
++	ret = pci_enable_msi(pdev);
++	if (ret) {
++		dev_err(&pdev->dev, "pci_enable_msi failed(0X%x)\n", ret);
++		/* enable rfkill interrupt: hw bug w/a */
++		pci_read_config_word(pdev, PCI_COMMAND, &pci_cmd);
++		if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
++			pci_cmd &= ~PCI_COMMAND_INTX_DISABLE;
++			pci_write_config_word(pdev, PCI_COMMAND, pci_cmd);
++		}
++	}
++
++	trans->hw_rev = iwl_read32(trans, CSR_HW_REV);
++	/*
++	 * In the 8000 HW family the format of the 4 bytes of CSR_HW_REV have
++	 * changed, and now the revision step also includes bit 0-1 (no more
++	 * "dash" value). To keep hw_rev backwards compatible - we'll store it
++	 * in the old format.
++	 */
++	if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) {
++		unsigned long flags;
++
++		trans->hw_rev = (trans->hw_rev & 0xfff0) |
++				(CSR_HW_REV_STEP(trans->hw_rev << 2) << 2);
++
++		ret = iwl_pcie_prepare_card_hw(trans);
++		if (ret) {
++			IWL_WARN(trans, "Exit HW not ready\n");
++			goto out_pci_disable_msi;
++		}
++
++		/*
++		 * in-order to recognize C step driver should read chip version
++		 * id located at the AUX bus MISC address space.
++		 */
++		iwl_set_bit(trans, CSR_GP_CNTRL,
++			    CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
++		udelay(2);
++
++		ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
++				   CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
++				   CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
++				   25000);
++		if (ret < 0) {
++			IWL_DEBUG_INFO(trans, "Failed to wake up the nic\n");
++			goto out_pci_disable_msi;
++		}
++
++		if (iwl_trans_grab_nic_access(trans, &flags)) {
++			u32 hw_step;
++
++			hw_step = iwl_read_prph_no_grab(trans, WFPM_CTRL_REG);
++			hw_step |= ENABLE_WFPM;
++			iwl_write_prph_no_grab(trans, WFPM_CTRL_REG, hw_step);
++			hw_step = iwl_read_prph_no_grab(trans, AUX_MISC_REG);
++			hw_step = (hw_step >> HW_STEP_LOCATION_BITS) & 0xF;
++			if (hw_step == 0x3)
++				trans->hw_rev = (trans->hw_rev & 0xFFFFFFF3) |
++						(SILICON_C_STEP << 2);
++			iwl_trans_release_nic_access(trans, &flags);
++		}
++	}
++
++	trans->hw_id = (pdev->device << 16) + pdev->subsystem_device;
++	snprintf(trans->hw_id_str, sizeof(trans->hw_id_str),
++		 "PCI ID: 0x%04X:0x%04X", pdev->device, pdev->subsystem_device);
++
++	/* Initialize the wait queue for commands */
++	init_waitqueue_head(&trans_pcie->wait_command_queue);
++
++	ret = iwl_pcie_alloc_ict(trans);
++	if (ret)
++		goto out_pci_disable_msi;
++
++	ret = request_threaded_irq(pdev->irq, iwl_pcie_isr,
++				   iwl_pcie_irq_handler,
++				   IRQF_SHARED, DRV_NAME, trans);
++	if (ret) {
++		IWL_ERR(trans, "Error allocating IRQ %d\n", pdev->irq);
++		goto out_free_ict;
++	}
++
++	trans_pcie->inta_mask = CSR_INI_SET_MASK;
++
++	return trans;
++
++out_free_ict:
++	iwl_pcie_free_ict(trans);
++out_pci_disable_msi:
++	pci_disable_msi(pdev);
++out_pci_release_regions:
++	pci_release_regions(pdev);
++out_pci_disable_device:
++	pci_disable_device(pdev);
++out_no_pci:
++	free_percpu(trans_pcie->tso_hdr_page);
++	iwl_trans_free(trans);
++	return ERR_PTR(ret);
++}
+diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
+index 88bf80a942b4..9faf69875fab 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
+@@ -382,6 +382,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ 	{IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_n_cfg)},
+ 	{IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x095A, 0x5C10, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x5412, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
+@@ -399,10 +400,10 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ 	{IWL_PCI_DEVICE(0x095A, 0x900A, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x9112, iwl7265_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x095B, 0x9210, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095B, 0x9200, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x095B, 0x9310, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x5020, iwl7265_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x502A, iwl7265_2n_cfg)},
+diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
+index 1de80a8e357a..840c47d8e2ce 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -7,6 +7,7 @@
+  *
+  * Copyright(c) 2007 - 2015 Intel Corporation. All rights reserved.
+  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
++ * Copyright(c) 2016 Intel Deutschland GmbH
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of version 2 of the GNU General Public License as
+@@ -33,6 +34,7 @@
+  *
+  * Copyright(c) 2005 - 2015 Intel Corporation. All rights reserved.
+  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
++ * Copyright(c) 2016 Intel Deutschland GmbH
+  * All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+@@ -881,9 +883,16 @@ static void iwl_pcie_apply_destination(struct iwl_trans *trans)
+ 	if (dest->monitor_mode == EXTERNAL_MODE && trans_pcie->fw_mon_size) {
+ 		iwl_write_prph(trans, le32_to_cpu(dest->base_reg),
+ 			       trans_pcie->fw_mon_phys >> dest->base_shift);
+-		iwl_write_prph(trans, le32_to_cpu(dest->end_reg),
+-			       (trans_pcie->fw_mon_phys +
+-				trans_pcie->fw_mon_size) >> dest->end_shift);
++		if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
++			iwl_write_prph(trans, le32_to_cpu(dest->end_reg),
++					(trans_pcie->fw_mon_phys +
++					trans_pcie->fw_mon_size - 256) >>
++						dest->end_shift);
++		else
++			iwl_write_prph(trans, le32_to_cpu(dest->end_reg),
++					(trans_pcie->fw_mon_phys +
++					trans_pcie->fw_mon_size) >>
++						dest->end_shift);
+ 	}
+ }
+ 
+diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
+index f46c9d7f6528..7f471bff435c 100644
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -801,7 +801,9 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ 								      hw_queue);
+ 			if (rx_remained_cnt == 0)
+ 				return;
+-
++			buffer_desc = &rtlpci->rx_ring[rxring_idx].buffer_desc[
++				rtlpci->rx_ring[rxring_idx].idx];
++			pdesc = (struct rtl_rx_desc *)skb->data;
+ 		} else {	/* rx descriptor */
+ 			pdesc = &rtlpci->rx_ring[rxring_idx].desc[
+ 				rtlpci->rx_ring[rxring_idx].idx];
+@@ -824,13 +826,6 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ 		new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
+ 		if (unlikely(!new_skb))
+ 			goto no_new;
+-		if (rtlpriv->use_new_trx_flow) {
+-			buffer_desc =
+-			  &rtlpci->rx_ring[rxring_idx].buffer_desc
+-				[rtlpci->rx_ring[rxring_idx].idx];
+-			/*means rx wifi info*/
+-			pdesc = (struct rtl_rx_desc *)skb->data;
+-		}
+ 		memset(&rx_status , 0 , sizeof(rx_status));
+ 		rtlpriv->cfg->ops->query_rx_desc(hw, &stats,
+ 						 &rx_status, (u8 *)pdesc, skb);
+diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
+index 11344121c55e..47e32cb0ec1a 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
+@@ -88,8 +88,6 @@ int rtl88e_init_sw_vars(struct ieee80211_hw *hw)
+ 	u8 tid;
+ 
+ 	rtl8188ee_bt_reg_init(hw);
+-	rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
+-
+ 	rtlpriv->dm.dm_initialgain_enable = 1;
+ 	rtlpriv->dm.dm_flag = 0;
+ 	rtlpriv->dm.disable_framebursting = 0;
+@@ -138,6 +136,11 @@ int rtl88e_init_sw_vars(struct ieee80211_hw *hw)
+ 	rtlpriv->psc.inactiveps = rtlpriv->cfg->mod_params->inactiveps;
+ 	rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps;
+ 	rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps;
++	rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
++	rtlpriv->cfg->mod_params->sw_crypto =
++		rtlpriv->cfg->mod_params->sw_crypto;
++	rtlpriv->cfg->mod_params->disable_watchdog =
++		rtlpriv->cfg->mod_params->disable_watchdog;
+ 	if (rtlpriv->cfg->mod_params->disable_watchdog)
+ 		pr_info("watchdog disabled\n");
+ 	if (!rtlpriv->psc.inactiveps)
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+index de6cb6c3a48c..4780bdc63b2b 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+@@ -139,6 +139,8 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
+ 	rtlpriv->psc.inactiveps = rtlpriv->cfg->mod_params->inactiveps;
+ 	rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps;
+ 	rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps;
++	rtlpriv->cfg->mod_params->sw_crypto =
++		rtlpriv->cfg->mod_params->sw_crypto;
+ 	if (!rtlpriv->psc.inactiveps)
+ 		pr_info("rtl8192ce: Power Save off (module option)\n");
+ 	if (!rtlpriv->psc.fwctrl_lps)
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index fd4a5353d216..7c6f7f0d18c6 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -65,6 +65,8 @@ static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
+ 	rtlpriv->dm.disable_framebursting = false;
+ 	rtlpriv->dm.thermalvalue = 0;
+ 	rtlpriv->dbg.global_debuglevel = rtlpriv->cfg->mod_params->debug;
++	rtlpriv->cfg->mod_params->sw_crypto =
++		rtlpriv->cfg->mod_params->sw_crypto;
+ 
+ 	/* for firmware buf */
+ 	rtlpriv->rtlhal.pfirmware = vzalloc(0x4000);
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+index b19d0398215f..c6e09a19de1a 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+@@ -376,8 +376,8 @@ module_param_named(swlps, rtl92de_mod_params.swctrl_lps, bool, 0444);
+ module_param_named(fwlps, rtl92de_mod_params.fwctrl_lps, bool, 0444);
+ MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
+ MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
+-MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
+-MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
++MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 1)\n");
++MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 0)\n");
+ MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
+ 
+ static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+index e1fd27c888bf..31baca41ac2f 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+@@ -187,6 +187,8 @@ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
+ 	rtlpriv->psc.inactiveps = rtlpriv->cfg->mod_params->inactiveps;
+ 	rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps;
+ 	rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps;
++	rtlpriv->cfg->mod_params->sw_crypto =
++		rtlpriv->cfg->mod_params->sw_crypto;
+ 	if (!rtlpriv->psc.inactiveps)
+ 		pr_info("Power Save off (module option)\n");
+ 	if (!rtlpriv->psc.fwctrl_lps)
+@@ -425,8 +427,8 @@ module_param_named(swlps, rtl92se_mod_params.swctrl_lps, bool, 0444);
+ module_param_named(fwlps, rtl92se_mod_params.fwctrl_lps, bool, 0444);
+ MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
+ MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
+-MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
+-MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
++MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 1)\n");
++MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 0)\n");
+ MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
+ 
+ static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
+diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
+index 2721cf89fb16..aac1ed3f7bb4 100644
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -531,6 +531,8 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw *hw,
+ 			ieee80211_rx(hw, skb);
+ 		else
+ 			dev_kfree_skb_any(skb);
++	} else {
++		dev_kfree_skb_any(skb);
+ 	}
+ }
+ 
+diff --git a/drivers/net/wireless/ti/wlcore/io.h b/drivers/net/wireless/ti/wlcore/io.h
+index 0305729d0986..10cf3747694d 100644
+--- a/drivers/net/wireless/ti/wlcore/io.h
++++ b/drivers/net/wireless/ti/wlcore/io.h
+@@ -207,19 +207,23 @@ static inline int __must_check wlcore_write_reg(struct wl1271 *wl, int reg,
+ 
+ static inline void wl1271_power_off(struct wl1271 *wl)
+ {
+-	int ret;
++	int ret = 0;
+ 
+ 	if (!test_bit(WL1271_FLAG_GPIO_POWER, &wl->flags))
+ 		return;
+ 
+-	ret = wl->if_ops->power(wl->dev, false);
++	if (wl->if_ops->power)
++		ret = wl->if_ops->power(wl->dev, false);
+ 	if (!ret)
+ 		clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+ }
+ 
+ static inline int wl1271_power_on(struct wl1271 *wl)
+ {
+-	int ret = wl->if_ops->power(wl->dev, true);
++	int ret = 0;
++
++	if (wl->if_ops->power)
++		ret = wl->if_ops->power(wl->dev, true);
+ 	if (ret == 0)
+ 		set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+ 
+diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
+index f1ac2839d97c..720e4e4b5a3c 100644
+--- a/drivers/net/wireless/ti/wlcore/spi.c
++++ b/drivers/net/wireless/ti/wlcore/spi.c
+@@ -73,7 +73,10 @@
+  */
+ #define SPI_AGGR_BUFFER_SIZE (4 * PAGE_SIZE)
+ 
+-#define WSPI_MAX_NUM_OF_CHUNKS (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE)
++/* Maximum number of SPI write chunks */
++#define WSPI_MAX_NUM_OF_CHUNKS \
++	((SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) + 1)
++
+ 
+ struct wl12xx_spi_glue {
+ 	struct device *dev;
+@@ -268,9 +271,10 @@ static int __must_check wl12xx_spi_raw_write(struct device *child, int addr,
+ 					     void *buf, size_t len, bool fixed)
+ {
+ 	struct wl12xx_spi_glue *glue = dev_get_drvdata(child->parent);
+-	struct spi_transfer t[2 * (WSPI_MAX_NUM_OF_CHUNKS + 1)];
++	/* SPI write buffers - 2 for each chunk */
++	struct spi_transfer t[2 * WSPI_MAX_NUM_OF_CHUNKS];
+ 	struct spi_message m;
+-	u32 commands[WSPI_MAX_NUM_OF_CHUNKS];
++	u32 commands[WSPI_MAX_NUM_OF_CHUNKS]; /* 1 command per chunk */
+ 	u32 *cmd;
+ 	u32 chunk_len;
+ 	int i;
+diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
+index d3346d23963b..89b3befc7155 100644
+--- a/drivers/pci/bus.c
++++ b/drivers/pci/bus.c
+@@ -140,6 +140,8 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
+ 	type_mask |= IORESOURCE_TYPE_BITS;
+ 
+ 	pci_bus_for_each_resource(bus, r, i) {
++		resource_size_t min_used = min;
++
+ 		if (!r)
+ 			continue;
+ 
+@@ -163,12 +165,12 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
+ 		 * overrides "min".
+ 		 */
+ 		if (avail.start)
+-			min = avail.start;
++			min_used = avail.start;
+ 
+ 		max = avail.end;
+ 
+ 		/* Ok, try it out.. */
+-		ret = allocate_resource(r, res, size, min, max,
++		ret = allocate_resource(r, res, size, min_used, max,
+ 					align, alignf, alignf_data);
+ 		if (ret == 0)
+ 			return 0;
+diff --git a/drivers/pci/host/pci-dra7xx.c b/drivers/pci/host/pci-dra7xx.c
+index 2d57e19a2cd4..b5ae685aec61 100644
+--- a/drivers/pci/host/pci-dra7xx.c
++++ b/drivers/pci/host/pci-dra7xx.c
+@@ -289,7 +289,8 @@ static int __init dra7xx_add_pcie_port(struct dra7xx_pcie *dra7xx,
+ 	}
+ 
+ 	ret = devm_request_irq(&pdev->dev, pp->irq,
+-			       dra7xx_pcie_msi_irq_handler, IRQF_SHARED,
++			       dra7xx_pcie_msi_irq_handler,
++			       IRQF_SHARED | IRQF_NO_THREAD,
+ 			       "dra7-pcie-msi",	pp);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "failed to request irq\n");
+diff --git a/drivers/pci/host/pci-exynos.c b/drivers/pci/host/pci-exynos.c
+index c139237e0e52..5b2b83cb67ad 100644
+--- a/drivers/pci/host/pci-exynos.c
++++ b/drivers/pci/host/pci-exynos.c
+@@ -527,7 +527,8 @@ static int __init exynos_add_pcie_port(struct pcie_port *pp,
+ 
+ 		ret = devm_request_irq(&pdev->dev, pp->msi_irq,
+ 					exynos_pcie_msi_irq_handler,
+-					IRQF_SHARED, "exynos-pcie", pp);
++					IRQF_SHARED | IRQF_NO_THREAD,
++					"exynos-pcie", pp);
+ 		if (ret) {
+ 			dev_err(&pdev->dev, "failed to request msi irq\n");
+ 			return ret;
+diff --git a/drivers/pci/host/pci-imx6.c b/drivers/pci/host/pci-imx6.c
+index fdb95367721e..ebcb0ac8512b 100644
+--- a/drivers/pci/host/pci-imx6.c
++++ b/drivers/pci/host/pci-imx6.c
+@@ -534,7 +534,8 @@ static int __init imx6_add_pcie_port(struct pcie_port *pp,
+ 
+ 		ret = devm_request_irq(&pdev->dev, pp->msi_irq,
+ 				       imx6_pcie_msi_handler,
+-				       IRQF_SHARED, "mx6-pcie-msi", pp);
++				       IRQF_SHARED | IRQF_NO_THREAD,
++				       "mx6-pcie-msi", pp);
+ 		if (ret) {
+ 			dev_err(&pdev->dev, "failed to request MSI irq\n");
+ 			return -ENODEV;
+diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c
+index 00e92720d7f7..d9789d6ba47d 100644
+--- a/drivers/pci/host/pci-tegra.c
++++ b/drivers/pci/host/pci-tegra.c
+@@ -1304,7 +1304,7 @@ static int tegra_pcie_enable_msi(struct tegra_pcie *pcie)
+ 
+ 	msi->irq = err;
+ 
+-	err = request_irq(msi->irq, tegra_pcie_msi_irq, 0,
++	err = request_irq(msi->irq, tegra_pcie_msi_irq, IRQF_NO_THREAD,
+ 			  tegra_msi_irq_chip.name, pcie);
+ 	if (err < 0) {
+ 		dev_err(&pdev->dev, "failed to request IRQ: %d\n", err);
+diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c
+index c086210f2ffd..56ce5640d91a 100644
+--- a/drivers/pci/host/pcie-rcar.c
++++ b/drivers/pci/host/pcie-rcar.c
+@@ -695,14 +695,16 @@ static int rcar_pcie_enable_msi(struct rcar_pcie *pcie)
+ 
+ 	/* Two irqs are for MSI, but they are also used for non-MSI irqs */
+ 	err = devm_request_irq(&pdev->dev, msi->irq1, rcar_pcie_msi_irq,
+-			       IRQF_SHARED, rcar_msi_irq_chip.name, pcie);
++			       IRQF_SHARED | IRQF_NO_THREAD,
++			       rcar_msi_irq_chip.name, pcie);
+ 	if (err < 0) {
+ 		dev_err(&pdev->dev, "failed to request IRQ: %d\n", err);
+ 		goto err;
+ 	}
+ 
+ 	err = devm_request_irq(&pdev->dev, msi->irq2, rcar_pcie_msi_irq,
+-			       IRQF_SHARED, rcar_msi_irq_chip.name, pcie);
++			       IRQF_SHARED | IRQF_NO_THREAD,
++			       rcar_msi_irq_chip.name, pcie);
+ 	if (err < 0) {
+ 		dev_err(&pdev->dev, "failed to request IRQ: %d\n", err);
+ 		goto err;
+diff --git a/drivers/pci/host/pcie-spear13xx.c b/drivers/pci/host/pcie-spear13xx.c
+index 020d78890719..4ea793eaa2bd 100644
+--- a/drivers/pci/host/pcie-spear13xx.c
++++ b/drivers/pci/host/pcie-spear13xx.c
+@@ -281,7 +281,8 @@ static int spear13xx_add_pcie_port(struct pcie_port *pp,
+ 		return -ENODEV;
+ 	}
+ 	ret = devm_request_irq(dev, pp->irq, spear13xx_pcie_irq_handler,
+-			       IRQF_SHARED, "spear1340-pcie", pp);
++			       IRQF_SHARED | IRQF_NO_THREAD,
++			       "spear1340-pcie", pp);
+ 	if (ret) {
+ 		dev_err(dev, "failed to request irq %d\n", pp->irq);
+ 		return ret;
+diff --git a/drivers/pci/host/pcie-xilinx.c b/drivers/pci/host/pcie-xilinx.c
+index f1a06a091ccb..577fe5b2f617 100644
+--- a/drivers/pci/host/pcie-xilinx.c
++++ b/drivers/pci/host/pcie-xilinx.c
+@@ -776,7 +776,8 @@ static int xilinx_pcie_parse_dt(struct xilinx_pcie_port *port)
+ 
+ 	port->irq = irq_of_parse_and_map(node, 0);
+ 	err = devm_request_irq(dev, port->irq, xilinx_pcie_intr_handler,
+-			       IRQF_SHARED, "xilinx-pcie", port);
++			       IRQF_SHARED | IRQF_NO_THREAD,
++			       "xilinx-pcie", port);
+ 	if (err) {
+ 		dev_err(dev, "unable to request irq %d\n", port->irq);
+ 		return err;
+diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
+index bcb90e4888dd..b60309ee80ed 100644
+--- a/drivers/pci/hotplug/acpiphp_glue.c
++++ b/drivers/pci/hotplug/acpiphp_glue.c
+@@ -954,8 +954,10 @@ int acpiphp_enable_slot(struct acpiphp_slot *slot)
+ {
+ 	pci_lock_rescan_remove();
+ 
+-	if (slot->flags & SLOT_IS_GOING_AWAY)
++	if (slot->flags & SLOT_IS_GOING_AWAY) {
++		pci_unlock_rescan_remove();
+ 		return -ENODEV;
++	}
+ 
+ 	/* configure all functions */
+ 	if (!(slot->flags & SLOT_ENABLED))
+diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
+index cd78f1166b33..9a92d13e3917 100644
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -845,6 +845,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
+ 		},
+ 	},
+ 	{
++		.ident = "Lenovo ideapad Y700-17ISK",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad Y700-17ISK"),
++		},
++	},
++	{
+ 		.ident = "Lenovo Yoga 2 11 / 13 / Pro",
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+@@ -865,6 +872,20 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 3 Pro-1370"),
+ 		},
+ 	},
++	{
++		.ident = "Lenovo Yoga 700",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 700"),
++		},
++	},
++	{
++		.ident = "Lenovo Yoga 900",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 900"),
++		},
++	},
+ 	{}
+ };
+ 
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index 9f77d23239a2..64ed88a67e6e 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -227,6 +227,7 @@ static struct {
+ 	{"Promise", "VTrak E610f", NULL, BLIST_SPARSELUN | BLIST_NO_RSOC},
+ 	{"Promise", "", NULL, BLIST_SPARSELUN},
+ 	{"QNAP", "iSCSI Storage", NULL, BLIST_MAX_1024},
++	{"SYNOLOGY", "iSCSI Storage", NULL, BLIST_MAX_1024},
+ 	{"QUANTUM", "XP34301", "1071", BLIST_NOTQ},
+ 	{"REGAL", "CDC-4X", NULL, BLIST_MAX5LUN | BLIST_SINGLELUN},
+ 	{"SanDisk", "ImageMate CF-SD1", NULL, BLIST_FORCELUN},
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 11ea52b2c36b..c66fd23b3c13 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -3141,8 +3141,8 @@ static int sd_suspend_common(struct device *dev, bool ignore_stop_errors)
+ 	struct scsi_disk *sdkp = dev_get_drvdata(dev);
+ 	int ret = 0;
+ 
+-	if (!sdkp)
+-		return 0;	/* this can happen */
++	if (!sdkp)	/* E.g.: runtime suspend following sd_remove() */
++		return 0;
+ 
+ 	if (sdkp->WCE && sdkp->media_present) {
+ 		sd_printk(KERN_NOTICE, sdkp, "Synchronizing SCSI cache\n");
+@@ -3181,6 +3181,9 @@ static int sd_resume(struct device *dev)
+ {
+ 	struct scsi_disk *sdkp = dev_get_drvdata(dev);
+ 
++	if (!sdkp)	/* E.g.: runtime resume at the start of sd_probe() */
++		return 0;
++
+ 	if (!sdkp->device->manage_start_stop)
+ 		return 0;
+ 
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index 9d7b7db75e4b..3bbf4853733c 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1255,7 +1255,7 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
+ 	}
+ 
+ 	sfp->mmap_called = 1;
+-	vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
++	vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
+ 	vma->vm_private_data = sfp;
+ 	vma->vm_ops = &sg_mmap_vm_ops;
+ 	return 0;
+diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
+index 8bd54a64efd6..64c867405ad4 100644
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -144,6 +144,9 @@ static int sr_runtime_suspend(struct device *dev)
+ {
+ 	struct scsi_cd *cd = dev_get_drvdata(dev);
+ 
++	if (!cd)	/* E.g.: runtime suspend following sr_remove() */
++		return 0;
++
+ 	if (cd->media_present)
+ 		return -EBUSY;
+ 	else
+@@ -985,6 +988,7 @@ static int sr_remove(struct device *dev)
+ 	scsi_autopm_get_device(cd->device);
+ 
+ 	del_gendisk(cd->disk);
++	dev_set_drvdata(dev, NULL);
+ 
+ 	mutex_lock(&sr_ref_mutex);
+ 	kref_put(&cd->kref, sr_kref_release);
+diff --git a/drivers/staging/speakup/selection.c b/drivers/staging/speakup/selection.c
+index a0315701c7d9..ed68b2cfe031 100644
+--- a/drivers/staging/speakup/selection.c
++++ b/drivers/staging/speakup/selection.c
+@@ -141,7 +141,9 @@ static void __speakup_paste_selection(struct work_struct *work)
+ 	struct tty_ldisc *ld;
+ 	DECLARE_WAITQUEUE(wait, current);
+ 
+-	ld = tty_ldisc_ref_wait(tty);
++	ld = tty_ldisc_ref(tty);
++	if (!ld)
++		goto tty_unref;
+ 	tty_buffer_lock_exclusive(&vc->port);
+ 
+ 	add_wait_queue(&vc->paste_wait, &wait);
+@@ -161,6 +163,7 @@ static void __speakup_paste_selection(struct work_struct *work)
+ 
+ 	tty_buffer_unlock_exclusive(&vc->port);
+ 	tty_ldisc_deref(ld);
++tty_unref:
+ 	tty_kref_put(tty);
+ }
+ 
+diff --git a/drivers/staging/speakup/serialio.c b/drivers/staging/speakup/serialio.c
+index 1d9d51bdf517..f41a7da1949d 100644
+--- a/drivers/staging/speakup/serialio.c
++++ b/drivers/staging/speakup/serialio.c
+@@ -6,6 +6,11 @@
+ #include "spk_priv.h"
+ #include "serialio.h"
+ 
++#include <linux/serial_core.h>
++/* WARNING:  Do not change this to <linux/serial.h> without testing that
++ * SERIAL_PORT_DFNS does get defined to the appropriate value. */
++#include <asm/serial.h>
++
+ #ifndef SERIAL_PORT_DFNS
+ #define SERIAL_PORT_DFNS
+ #endif
+@@ -23,9 +28,15 @@ const struct old_serial_port *spk_serial_init(int index)
+ 	int baud = 9600, quot = 0;
+ 	unsigned int cval = 0;
+ 	int cflag = CREAD | HUPCL | CLOCAL | B9600 | CS8;
+-	const struct old_serial_port *ser = rs_table + index;
++	const struct old_serial_port *ser;
+ 	int err;
+ 
++	if (index >= ARRAY_SIZE(rs_table)) {
++		pr_info("no port info for ttyS%d\n", index);
++		return NULL;
++	}
++	ser = rs_table + index;
++
+ 	/*	Divisor, bytesize and parity */
+ 	quot = ser->baud_base / baud;
+ 	cval = cflag & (CSIZE | CSTOPB);
+diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
+index 6f2fb546477e..5a8add721741 100644
+--- a/drivers/target/iscsi/iscsi_target_configfs.c
++++ b/drivers/target/iscsi/iscsi_target_configfs.c
+@@ -1907,7 +1907,8 @@ static void lio_tpg_release_fabric_acl(
+ }
+ 
+ /*
+- * Called with spin_lock_bh(struct se_portal_group->session_lock) held..
++ * Called with spin_lock_irq(struct se_portal_group->session_lock) held
++ * or not held.
+  *
+  * Also, this function calls iscsit_inc_session_usage_count() on the
+  * struct iscsi_session in question.
+@@ -1915,19 +1916,32 @@ static void lio_tpg_release_fabric_acl(
+ static int lio_tpg_shutdown_session(struct se_session *se_sess)
+ {
+ 	struct iscsi_session *sess = se_sess->fabric_sess_ptr;
++	struct se_portal_group *se_tpg = se_sess->se_tpg;
++	bool local_lock = false;
++
++	if (!spin_is_locked(&se_tpg->session_lock)) {
++		spin_lock_irq(&se_tpg->session_lock);
++		local_lock = true;
++	}
+ 
+ 	spin_lock(&sess->conn_lock);
+ 	if (atomic_read(&sess->session_fall_back_to_erl0) ||
+ 	    atomic_read(&sess->session_logout) ||
+ 	    (sess->time2retain_timer_flags & ISCSI_TF_EXPIRED)) {
+ 		spin_unlock(&sess->conn_lock);
++		if (local_lock)
++			spin_unlock_irq(&sess->conn_lock);
+ 		return 0;
+ 	}
+ 	atomic_set(&sess->session_reinstatement, 1);
+ 	spin_unlock(&sess->conn_lock);
+ 
+ 	iscsit_stop_time2retain_timer(sess);
++	spin_unlock_irq(&se_tpg->session_lock);
++
+ 	iscsit_stop_session(sess, 1, 1);
++	if (!local_lock)
++		spin_lock_irq(&se_tpg->session_lock);
+ 
+ 	return 1;
+ }
+diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c
+index 5a0f12d08e8b..ec4ea5940bf7 100644
+--- a/drivers/thermal/step_wise.c
++++ b/drivers/thermal/step_wise.c
+@@ -63,6 +63,19 @@ static unsigned long get_target_state(struct thermal_instance *instance,
+ 	next_target = instance->target;
+ 	dev_dbg(&cdev->device, "cur_state=%ld\n", cur_state);
+ 
++	if (!instance->initialized) {
++		if (throttle) {
++			next_target = (cur_state + 1) >= instance->upper ?
++					instance->upper :
++					((cur_state + 1) < instance->lower ?
++					instance->lower : (cur_state + 1));
++		} else {
++			next_target = THERMAL_NO_TARGET;
++		}
++
++		return next_target;
++	}
++
+ 	switch (trend) {
+ 	case THERMAL_TREND_RAISING:
+ 		if (throttle) {
+@@ -149,7 +162,7 @@ static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
+ 		dev_dbg(&instance->cdev->device, "old_target=%d, target=%d\n",
+ 					old_target, (int)instance->target);
+ 
+-		if (old_target == instance->target)
++		if (instance->initialized && old_target == instance->target)
+ 			continue;
+ 
+ 		/* Activate a passive thermal instance */
+@@ -161,7 +174,7 @@ static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
+ 			instance->target == THERMAL_NO_TARGET)
+ 			update_passive_instance(tz, trip_type, -1);
+ 
+-
++		instance->initialized = true;
+ 		instance->cdev->updated = false; /* cdev needs update */
+ 	}
+ 
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index 4108db7e10c1..a3282bfb343d 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -37,6 +37,7 @@
+ #include <linux/of.h>
+ #include <net/netlink.h>
+ #include <net/genetlink.h>
++#include <linux/suspend.h>
+ 
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/thermal.h>
+@@ -59,6 +60,8 @@ static LIST_HEAD(thermal_governor_list);
+ static DEFINE_MUTEX(thermal_list_lock);
+ static DEFINE_MUTEX(thermal_governor_lock);
+ 
++static atomic_t in_suspend;
++
+ static struct thermal_governor *def_governor;
+ 
+ static struct thermal_governor *__find_governor(const char *name)
+@@ -471,14 +474,31 @@ static void update_temperature(struct thermal_zone_device *tz)
+ 	mutex_unlock(&tz->lock);
+ 
+ 	trace_thermal_temperature(tz);
+-	dev_dbg(&tz->device, "last_temperature=%d, current_temperature=%d\n",
+-				tz->last_temperature, tz->temperature);
++	if (tz->last_temperature == THERMAL_TEMP_INVALID)
++		dev_dbg(&tz->device, "last_temperature N/A, current_temperature=%d\n",
++			tz->temperature);
++	else
++		dev_dbg(&tz->device, "last_temperature=%d, current_temperature=%d\n",
++			tz->last_temperature, tz->temperature);
++}
++
++static void thermal_zone_device_reset(struct thermal_zone_device *tz)
++{
++	struct thermal_instance *pos;
++
++	tz->temperature = THERMAL_TEMP_INVALID;
++	tz->passive = 0;
++	list_for_each_entry(pos, &tz->thermal_instances, tz_node)
++		pos->initialized = false;
+ }
+ 
+ void thermal_zone_device_update(struct thermal_zone_device *tz)
+ {
+ 	int count;
+ 
++	if (atomic_read(&in_suspend))
++		return;
++
+ 	if (!tz->ops->get_temp)
+ 		return;
+ 
+@@ -1016,6 +1036,7 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz,
+ 	if (!result) {
+ 		list_add_tail(&dev->tz_node, &tz->thermal_instances);
+ 		list_add_tail(&dev->cdev_node, &cdev->thermal_instances);
++		atomic_set(&tz->need_update, 1);
+ 	}
+ 	mutex_unlock(&cdev->lock);
+ 	mutex_unlock(&tz->lock);
+@@ -1122,6 +1143,7 @@ __thermal_cooling_device_register(struct device_node *np,
+ 				  const struct thermal_cooling_device_ops *ops)
+ {
+ 	struct thermal_cooling_device *cdev;
++	struct thermal_zone_device *pos = NULL;
+ 	int result;
+ 
+ 	if (type && strlen(type) >= THERMAL_NAME_LENGTH)
+@@ -1166,6 +1188,12 @@ __thermal_cooling_device_register(struct device_node *np,
+ 	/* Update binding information for 'this' new cdev */
+ 	bind_cdev(cdev);
+ 
++	mutex_lock(&thermal_list_lock);
++	list_for_each_entry(pos, &thermal_tz_list, node)
++		if (atomic_cmpxchg(&pos->need_update, 1, 0))
++			thermal_zone_device_update(pos);
++	mutex_unlock(&thermal_list_lock);
++
+ 	return cdev;
+ }
+ 
+@@ -1496,6 +1524,8 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
+ 	tz->trips = trips;
+ 	tz->passive_delay = passive_delay;
+ 	tz->polling_delay = polling_delay;
++	/* A new thermal zone needs to be updated anyway. */
++	atomic_set(&tz->need_update, 1);
+ 
+ 	dev_set_name(&tz->device, "thermal_zone%d", tz->id);
+ 	result = device_register(&tz->device);
+@@ -1576,7 +1606,10 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
+ 	if (!tz->ops->get_temp)
+ 		thermal_zone_device_set_polling(tz, 0);
+ 
+-	thermal_zone_device_update(tz);
++	thermal_zone_device_reset(tz);
++	/* Update the new thermal zone and mark it as already updated. */
++	if (atomic_cmpxchg(&tz->need_update, 1, 0))
++		thermal_zone_device_update(tz);
+ 
+ 	return tz;
+ 
+@@ -1810,6 +1843,36 @@ static void thermal_unregister_governors(void)
+ 	thermal_gov_user_space_unregister();
+ }
+ 
++static int thermal_pm_notify(struct notifier_block *nb,
++				unsigned long mode, void *_unused)
++{
++	struct thermal_zone_device *tz;
++
++	switch (mode) {
++	case PM_HIBERNATION_PREPARE:
++	case PM_RESTORE_PREPARE:
++	case PM_SUSPEND_PREPARE:
++		atomic_set(&in_suspend, 1);
++		break;
++	case PM_POST_HIBERNATION:
++	case PM_POST_RESTORE:
++	case PM_POST_SUSPEND:
++		atomic_set(&in_suspend, 0);
++		list_for_each_entry(tz, &thermal_tz_list, node) {
++			thermal_zone_device_reset(tz);
++			thermal_zone_device_update(tz);
++		}
++		break;
++	default:
++		break;
++	}
++	return 0;
++}
++
++static struct notifier_block thermal_pm_nb = {
++	.notifier_call = thermal_pm_notify,
++};
++
+ static int __init thermal_init(void)
+ {
+ 	int result;
+@@ -1830,6 +1893,11 @@ static int __init thermal_init(void)
+ 	if (result)
+ 		goto exit_netlink;
+ 
++	result = register_pm_notifier(&thermal_pm_nb);
++	if (result)
++		pr_warn("Thermal: Can not register suspend notifier, return %d\n",
++			result);
++
+ 	return 0;
+ 
+ exit_netlink:
+@@ -1849,6 +1917,7 @@ error:
+ 
+ static void __exit thermal_exit(void)
+ {
++	unregister_pm_notifier(&thermal_pm_nb);
+ 	of_thermal_destroy_zones();
+ 	genetlink_exit();
+ 	class_unregister(&thermal_class);
+diff --git a/drivers/thermal/thermal_core.h b/drivers/thermal/thermal_core.h
+index 8e391812e503..dce86ee8e9d7 100644
+--- a/drivers/thermal/thermal_core.h
++++ b/drivers/thermal/thermal_core.h
+@@ -41,6 +41,7 @@ struct thermal_instance {
+ 	struct thermal_zone_device *tz;
+ 	struct thermal_cooling_device *cdev;
+ 	int trip;
++	bool initialized;
+ 	unsigned long upper;	/* Highest cooling state for this trip point */
+ 	unsigned long lower;	/* Lowest cooling state for this trip point */
+ 	unsigned long target;	/* expected cooling state */
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index e5edf45e9d4c..33088c70ef3b 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -258,16 +258,13 @@ static void n_tty_check_throttle(struct tty_struct *tty)
+ 
+ static void n_tty_check_unthrottle(struct tty_struct *tty)
+ {
+-	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
+-	    tty->link->ldisc->ops->write_wakeup == n_tty_write_wakeup) {
++	if (tty->driver->type == TTY_DRIVER_TYPE_PTY) {
+ 		if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
+ 			return;
+ 		if (!tty->count)
+ 			return;
+ 		n_tty_kick_worker(tty);
+-		n_tty_write_wakeup(tty->link);
+-		if (waitqueue_active(&tty->link->write_wait))
+-			wake_up_interruptible_poll(&tty->link->write_wait, POLLOUT);
++		tty_wakeup(tty->link);
+ 		return;
+ 	}
+ 
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index eb8adc2e68c1..2fd163b75665 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1380,6 +1380,9 @@ ce4100_serial_setup(struct serial_private *priv,
+ #define PCI_DEVICE_ID_INTEL_BSW_UART1	0x228a
+ #define PCI_DEVICE_ID_INTEL_BSW_UART2	0x228c
+ 
++#define PCI_DEVICE_ID_INTEL_BDW_UART1	0x9ce3
++#define PCI_DEVICE_ID_INTEL_BDW_UART2	0x9ce4
++
+ #define BYT_PRV_CLK			0x800
+ #define BYT_PRV_CLK_EN			(1 << 0)
+ #define BYT_PRV_CLK_M_VAL_SHIFT		1
+@@ -1458,11 +1461,13 @@ byt_serial_setup(struct serial_private *priv,
+ 	switch (pdev->device) {
+ 	case PCI_DEVICE_ID_INTEL_BYT_UART1:
+ 	case PCI_DEVICE_ID_INTEL_BSW_UART1:
++	case PCI_DEVICE_ID_INTEL_BDW_UART1:
+ 		rx_param->src_id = 3;
+ 		tx_param->dst_id = 2;
+ 		break;
+ 	case PCI_DEVICE_ID_INTEL_BYT_UART2:
+ 	case PCI_DEVICE_ID_INTEL_BSW_UART2:
++	case PCI_DEVICE_ID_INTEL_BDW_UART2:
+ 		rx_param->src_id = 5;
+ 		tx_param->dst_id = 4;
+ 		break;
+@@ -2154,6 +2159,20 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
+ 		.subdevice	= PCI_ANY_ID,
+ 		.setup		= byt_serial_setup,
+ 	},
++	{
++		.vendor		= PCI_VENDOR_ID_INTEL,
++		.device		= PCI_DEVICE_ID_INTEL_BDW_UART1,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
++		.setup		= byt_serial_setup,
++	},
++	{
++		.vendor		= PCI_VENDOR_ID_INTEL,
++		.device		= PCI_DEVICE_ID_INTEL_BDW_UART2,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
++		.setup		= byt_serial_setup,
++	},
+ 	/*
+ 	 * ITE
+ 	 */
+@@ -5603,6 +5622,16 @@ static struct pci_device_id serial_pci_tbl[] = {
+ 		PCI_CLASS_COMMUNICATION_SERIAL << 8, 0xff0000,
+ 		pbn_byt },
+ 
++	/* Intel Broadwell */
++	{	PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BDW_UART1,
++		PCI_ANY_ID,  PCI_ANY_ID,
++		PCI_CLASS_COMMUNICATION_SERIAL << 8, 0xff0000,
++		pbn_byt },
++	{	PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BDW_UART2,
++		PCI_ANY_ID,  PCI_ANY_ID,
++		PCI_CLASS_COMMUNICATION_SERIAL << 8, 0xff0000,
++		pbn_byt },
++
+ 	/*
+ 	 * Intel Penwell
+ 	 */
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 5a5c1ab5a375..be96970646a9 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -2670,6 +2670,28 @@ static int tiocsetd(struct tty_struct *tty, int __user *p)
+ }
+ 
+ /**
++ *	tiocgetd	-	get line discipline
++ *	@tty: tty device
++ *	@p: pointer to user data
++ *
++ *	Retrieves the line discipline id directly from the ldisc.
++ *
++ *	Locking: waits for ldisc reference (in case the line discipline
++ *		is changing or the tty is being hungup)
++ */
++
++static int tiocgetd(struct tty_struct *tty, int __user *p)
++{
++	struct tty_ldisc *ld;
++	int ret;
++
++	ld = tty_ldisc_ref_wait(tty);
++	ret = put_user(ld->ops->num, p);
++	tty_ldisc_deref(ld);
++	return ret;
++}
++
++/**
+  *	send_break	-	performed time break
+  *	@tty: device to break on
+  *	@duration: timeout in mS
+@@ -2895,7 +2917,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 	case TIOCGSID:
+ 		return tiocgsid(tty, real_tty, p);
+ 	case TIOCGETD:
+-		return put_user(tty->ldisc->ops->num, (int __user *)p);
++		return tiocgetd(tty, p);
+ 	case TIOCSETD:
+ 		return tiocsetd(tty, p);
+ 	case TIOCVHANGUP:
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 0fe15aec7ed0..df3deb000a80 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -432,7 +432,8 @@ static void acm_read_bulk_callback(struct urb *urb)
+ 		set_bit(rb->index, &acm->read_urbs_free);
+ 		dev_dbg(&acm->data->dev, "%s - non-zero urb status: %d\n",
+ 							__func__, status);
+-		return;
++		if ((status != -ENOENT) || (urb->actual_length == 0))
++			return;
+ 	}
+ 
+ 	usb_mark_last_busy(acm->dev);
+@@ -1414,6 +1415,8 @@ made_compressed_probe:
+ 				usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress),
+ 				NULL, acm->writesize, acm_write_bulk, snd);
+ 		snd->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
++		if (quirks & SEND_ZERO_PACKET)
++			snd->urb->transfer_flags |= URB_ZERO_PACKET;
+ 		snd->instance = acm;
+ 	}
+ 
+@@ -1848,6 +1851,11 @@ static const struct usb_device_id acm_ids[] = {
+ 	},
+ #endif
+ 
++	/*Samsung phone in firmware update mode */
++	{ USB_DEVICE(0x04e8, 0x685d),
++	.driver_info = IGNORE_DEVICE,
++	},
++
+ 	/* Exclude Infineon Flash Loader utility */
+ 	{ USB_DEVICE(0x058b, 0x0041),
+ 	.driver_info = IGNORE_DEVICE,
+@@ -1871,6 +1879,10 @@ static const struct usb_device_id acm_ids[] = {
+ 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
+ 		USB_CDC_ACM_PROTO_AT_CDMA) },
+ 
++	{ USB_DEVICE(0x1519, 0x0452), /* Intel 7260 modem */
++	.driver_info = SEND_ZERO_PACKET,
++	},
++
+ 	{ }
+ };
+ 
+diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
+index b3b6c9db6fe5..ac830e0ae38b 100644
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -134,3 +134,4 @@ struct acm {
+ #define IGNORE_DEVICE			BIT(5)
+ #define QUIRK_CONTROL_LINE_STATE	BIT(6)
+ #define CLEAR_HALT_CONDITIONS		BIT(7)
++#define SEND_ZERO_PACKET		BIT(8)
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index ee11b301f3da..e56ad83b35a4 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5346,7 +5346,6 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
+ 	}
+ 
+ 	bos = udev->bos;
+-	udev->bos = NULL;
+ 
+ 	for (i = 0; i < SET_CONFIG_TRIES; ++i) {
+ 
+@@ -5439,8 +5438,11 @@ done:
+ 	usb_set_usb2_hardware_lpm(udev, 1);
+ 	usb_unlocked_enable_lpm(udev);
+ 	usb_enable_ltm(udev);
+-	usb_release_bos_descriptor(udev);
+-	udev->bos = bos;
++	/* release the new BOS descriptor allocated  by hub_port_init() */
++	if (udev->bos != bos) {
++		usb_release_bos_descriptor(udev);
++		udev->bos = bos;
++	}
+ 	return 0;
+ 
+ re_enumerate:
+diff --git a/drivers/usb/host/Makefile b/drivers/usb/host/Makefile
+index 65b0b6a58599..da03d8b258dd 100644
+--- a/drivers/usb/host/Makefile
++++ b/drivers/usb/host/Makefile
+@@ -26,9 +26,6 @@ obj-$(CONFIG_USB_WHCI_HCD)	+= whci/
+ 
+ obj-$(CONFIG_PCI)		+= pci-quirks.o
+ 
+-obj-$(CONFIG_USB_XHCI_PCI)	+= xhci-pci.o
+-obj-$(CONFIG_USB_XHCI_PLATFORM) += xhci-plat-hcd.o
+-
+ obj-$(CONFIG_USB_EHCI_HCD)	+= ehci-hcd.o
+ obj-$(CONFIG_USB_EHCI_PCI)	+= ehci-pci.o
+ obj-$(CONFIG_USB_EHCI_HCD_PLATFORM)	+= ehci-platform.o
+@@ -63,6 +60,8 @@ obj-$(CONFIG_USB_OHCI_HCD_PXA27X)	+= ohci-pxa27x.o
+ obj-$(CONFIG_USB_UHCI_HCD)	+= uhci-hcd.o
+ obj-$(CONFIG_USB_FHCI_HCD)	+= fhci.o
+ obj-$(CONFIG_USB_XHCI_HCD)	+= xhci-hcd.o
++obj-$(CONFIG_USB_XHCI_PCI)	+= xhci-pci.o
++obj-$(CONFIG_USB_XHCI_PLATFORM) += xhci-plat-hcd.o
+ obj-$(CONFIG_USB_SL811_HCD)	+= sl811-hcd.o
+ obj-$(CONFIG_USB_SL811_CS)	+= sl811_cs.o
+ obj-$(CONFIG_USB_U132_HCD)	+= u132-hcd.o
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 7e5c90eebb9c..3ff5fcc7c94b 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -23,10 +23,17 @@
+ #include <linux/pci.h>
+ #include <linux/slab.h>
+ #include <linux/module.h>
++#include <linux/acpi.h>
+ 
+ #include "xhci.h"
+ #include "xhci-trace.h"
+ 
++#define SSIC_PORT_NUM		2
++#define SSIC_PORT_CFG2		0x880c
++#define SSIC_PORT_CFG2_OFFSET	0x30
++#define PROG_DONE		(1 << 30)
++#define SSIC_PORT_UNUSED	(1 << 31)
++
+ /* Device for a quirk */
+ #define PCI_VENDOR_ID_FRESCO_LOGIC	0x1b73
+ #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK	0x1000
+@@ -40,6 +47,7 @@
+ #define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI		0x22b5
+ #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI		0xa12f
+ #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI	0x9d2f
++#define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI		0x0aa8
+ 
+ static const char hcd_name[] = "xhci_hcd";
+ 
+@@ -140,9 +148,14 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ 		(pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
+ 		 pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
+-		 pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)) {
++		 pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
++		 pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI)) {
+ 		xhci->quirks |= XHCI_PME_STUCK_QUIRK;
+ 	}
++	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
++		 pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI) {
++		xhci->quirks |= XHCI_SSIC_PORT_UNUSED;
++	}
+ 	if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
+ 			pdev->device == PCI_DEVICE_ID_EJ168) {
+ 		xhci->quirks |= XHCI_RESET_ON_RESUME;
+@@ -169,20 +182,18 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 				"QUIRK: Resetting on resume");
+ }
+ 
+-/*
+- * Make sure PME works on some Intel xHCI controllers by writing 1 to clear
+- * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4
+- */
+-static void xhci_pme_quirk(struct xhci_hcd *xhci)
++#ifdef CONFIG_ACPI
++static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev)
+ {
+-	u32 val;
+-	void __iomem *reg;
+-
+-	reg = (void __iomem *) xhci->cap_regs + 0x80a4;
+-	val = readl(reg);
+-	writel(val | BIT(28), reg);
+-	readl(reg);
++	static const u8 intel_dsm_uuid[] = {
++		0xb7, 0x0c, 0x34, 0xac,	0x01, 0xe9, 0xbf, 0x45,
++		0xb7, 0xe6, 0x2b, 0x34, 0xec, 0x93, 0x1e, 0x23,
++	};
++	acpi_evaluate_dsm(ACPI_HANDLE(&dev->dev), intel_dsm_uuid, 3, 1, NULL);
+ }
++#else
++	static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev) { }
++#endif /* CONFIG_ACPI */
+ 
+ /* called during probe() after chip reset completes */
+ static int xhci_pci_setup(struct usb_hcd *hcd)
+@@ -263,6 +274,9 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 			HCC_MAX_PSA(xhci->hcc_params) >= 4)
+ 		xhci->shared_hcd->can_do_streams = 1;
+ 
++	if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
++		xhci_pme_acpi_rtd3_enable(dev);
++
+ 	/* USB-2 and USB-3 roothubs initialized, allow runtime pm suspend */
+ 	pm_runtime_put_noidle(&dev->dev);
+ 
+@@ -296,10 +310,65 @@ static void xhci_pci_remove(struct pci_dev *dev)
+ }
+ 
+ #ifdef CONFIG_PM
++/*
++ * In some Intel xHCI controllers, in order to get D3 working,
++ * through a vendor specific SSIC CONFIG register at offset 0x883c,
++ * SSIC PORT need to be marked as "unused" before putting xHCI
++ * into D3. After D3 exit, the SSIC port need to be marked as "used".
++ * Without this change, xHCI might not enter D3 state.
++ */
++static void xhci_ssic_port_unused_quirk(struct usb_hcd *hcd, bool suspend)
++{
++	struct xhci_hcd	*xhci = hcd_to_xhci(hcd);
++	u32 val;
++	void __iomem *reg;
++	int i;
++
++	for (i = 0; i < SSIC_PORT_NUM; i++) {
++		reg = (void __iomem *) xhci->cap_regs +
++				SSIC_PORT_CFG2 +
++				i * SSIC_PORT_CFG2_OFFSET;
++
++		/* Notify SSIC that SSIC profile programming is not done. */
++		val = readl(reg) & ~PROG_DONE;
++		writel(val, reg);
++
++		/* Mark SSIC port as unused(suspend) or used(resume) */
++		val = readl(reg);
++		if (suspend)
++			val |= SSIC_PORT_UNUSED;
++		else
++			val &= ~SSIC_PORT_UNUSED;
++		writel(val, reg);
++
++		/* Notify SSIC that SSIC profile programming is done */
++		val = readl(reg) | PROG_DONE;
++		writel(val, reg);
++		readl(reg);
++	}
++}
++
++/*
++ * Make sure PME works on some Intel xHCI controllers by writing 1 to clear
++ * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4
++ */
++static void xhci_pme_quirk(struct usb_hcd *hcd)
++{
++	struct xhci_hcd	*xhci = hcd_to_xhci(hcd);
++	void __iomem *reg;
++	u32 val;
++
++	reg = (void __iomem *) xhci->cap_regs + 0x80a4;
++	val = readl(reg);
++	writel(val | BIT(28), reg);
++	readl(reg);
++}
++
+ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
+ {
+ 	struct xhci_hcd	*xhci = hcd_to_xhci(hcd);
+ 	struct pci_dev		*pdev = to_pci_dev(hcd->self.controller);
++	int			ret;
+ 
+ 	/*
+ 	 * Systems with the TI redriver that loses port status change events
+@@ -309,9 +378,16 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
+ 		pdev->no_d3cold = true;
+ 
+ 	if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+-		xhci_pme_quirk(xhci);
++		xhci_pme_quirk(hcd);
++
++	if (xhci->quirks & XHCI_SSIC_PORT_UNUSED)
++		xhci_ssic_port_unused_quirk(hcd, true);
+ 
+-	return xhci_suspend(xhci, do_wakeup);
++	ret = xhci_suspend(xhci, do_wakeup);
++	if (ret && (xhci->quirks & XHCI_SSIC_PORT_UNUSED))
++		xhci_ssic_port_unused_quirk(hcd, false);
++
++	return ret;
+ }
+ 
+ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
+@@ -341,8 +417,11 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
+ 	if (pdev->vendor == PCI_VENDOR_ID_INTEL)
+ 		usb_enable_intel_xhci_ports(pdev);
+ 
++	if (xhci->quirks & XHCI_SSIC_PORT_UNUSED)
++		xhci_ssic_port_unused_quirk(hcd, false);
++
+ 	if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+-		xhci_pme_quirk(xhci);
++		xhci_pme_quirk(hcd);
+ 
+ 	retval = xhci_resume(xhci, hibernated);
+ 	return retval;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 41d7a05f8af4..e6d858a49d04 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3001,21 +3001,6 @@ int xhci_queue_intr_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ }
+ 
+ /*
+- * The TD size is the number of bytes remaining in the TD (including this TRB),
+- * right shifted by 10.
+- * It must fit in bits 21:17, so it can't be bigger than 31.
+- */
+-static u32 xhci_td_remainder(unsigned int remainder)
+-{
+-	u32 max = (1 << (21 - 17 + 1)) - 1;
+-
+-	if ((remainder >> 10) >= max)
+-		return max << 17;
+-	else
+-		return (remainder >> 10) << 17;
+-}
+-
+-/*
+  * For xHCI 1.0 host controllers, TD size is the number of max packet sized
+  * packets remaining in the TD (*not* including this TRB).
+  *
+@@ -3027,30 +3012,36 @@ static u32 xhci_td_remainder(unsigned int remainder)
+  *
+  * TD size = total_packet_count - packets_transferred
+  *
+- * It must fit in bits 21:17, so it can't be bigger than 31.
++ * For xHCI 0.96 and older, TD size field should be the remaining bytes
++ * including this TRB, right shifted by 10
++ *
++ * For all hosts it must fit in bits 21:17, so it can't be bigger than 31.
++ * This is taken care of in the TRB_TD_SIZE() macro
++ *
+  * The last TRB in a TD must have the TD size set to zero.
+  */
+-static u32 xhci_v1_0_td_remainder(int running_total, int trb_buff_len,
+-		unsigned int total_packet_count, struct urb *urb,
+-		unsigned int num_trbs_left)
++static u32 xhci_td_remainder(struct xhci_hcd *xhci, int transferred,
++			      int trb_buff_len, unsigned int td_total_len,
++			      struct urb *urb, unsigned int num_trbs_left)
+ {
+-	int packets_transferred;
++	u32 maxp, total_packet_count;
++
++	if (xhci->hci_version < 0x100)
++		return ((td_total_len - transferred) >> 10);
++
++	maxp = GET_MAX_PACKET(usb_endpoint_maxp(&urb->ep->desc));
++	total_packet_count = DIV_ROUND_UP(td_total_len, maxp);
+ 
+ 	/* One TRB with a zero-length data packet. */
+-	if (num_trbs_left == 0 || (running_total == 0 && trb_buff_len == 0))
++	if (num_trbs_left == 0 || (transferred == 0 && trb_buff_len == 0) ||
++	    trb_buff_len == td_total_len)
+ 		return 0;
+ 
+-	/* All the TRB queueing functions don't count the current TRB in
+-	 * running_total.
+-	 */
+-	packets_transferred = (running_total + trb_buff_len) /
+-		GET_MAX_PACKET(usb_endpoint_maxp(&urb->ep->desc));
+-
+-	if ((total_packet_count - packets_transferred) > 31)
+-		return 31 << 17;
+-	return (total_packet_count - packets_transferred) << 17;
++	/* Queueing functions don't count the current TRB into transferred */
++	return (total_packet_count - ((transferred + trb_buff_len) / maxp));
+ }
+ 
++
+ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ 		struct urb *urb, int slot_id, unsigned int ep_index)
+ {
+@@ -3172,17 +3163,12 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ 		}
+ 
+ 		/* Set the TRB length, TD size, and interrupter fields. */
+-		if (xhci->hci_version < 0x100) {
+-			remainder = xhci_td_remainder(
+-					urb->transfer_buffer_length -
+-					running_total);
+-		} else {
+-			remainder = xhci_v1_0_td_remainder(running_total,
+-					trb_buff_len, total_packet_count, urb,
+-					num_trbs - 1);
+-		}
++		remainder = xhci_td_remainder(xhci, running_total, trb_buff_len,
++					   urb->transfer_buffer_length,
++					   urb, num_trbs - 1);
++
+ 		length_field = TRB_LEN(trb_buff_len) |
+-			remainder |
++			TRB_TD_SIZE(remainder) |
+ 			TRB_INTR_TARGET(0);
+ 
+ 		if (num_trbs > 1)
+@@ -3345,17 +3331,12 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ 			field |= TRB_ISP;
+ 
+ 		/* Set the TRB length, TD size, and interrupter fields. */
+-		if (xhci->hci_version < 0x100) {
+-			remainder = xhci_td_remainder(
+-					urb->transfer_buffer_length -
+-					running_total);
+-		} else {
+-			remainder = xhci_v1_0_td_remainder(running_total,
+-					trb_buff_len, total_packet_count, urb,
+-					num_trbs - 1);
+-		}
++		remainder = xhci_td_remainder(xhci, running_total, trb_buff_len,
++					   urb->transfer_buffer_length,
++					   urb, num_trbs - 1);
++
+ 		length_field = TRB_LEN(trb_buff_len) |
+-			remainder |
++			TRB_TD_SIZE(remainder) |
+ 			TRB_INTR_TARGET(0);
+ 
+ 		if (num_trbs > 1)
+@@ -3393,7 +3374,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ 	struct usb_ctrlrequest *setup;
+ 	struct xhci_generic_trb *start_trb;
+ 	int start_cycle;
+-	u32 field, length_field;
++	u32 field, length_field, remainder;
+ 	struct urb_priv *urb_priv;
+ 	struct xhci_td *td;
+ 
+@@ -3466,9 +3447,15 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ 	else
+ 		field = TRB_TYPE(TRB_DATA);
+ 
++	remainder = xhci_td_remainder(xhci, 0,
++				   urb->transfer_buffer_length,
++				   urb->transfer_buffer_length,
++				   urb, 1);
++
+ 	length_field = TRB_LEN(urb->transfer_buffer_length) |
+-		xhci_td_remainder(urb->transfer_buffer_length) |
++		TRB_TD_SIZE(remainder) |
+ 		TRB_INTR_TARGET(0);
++
+ 	if (urb->transfer_buffer_length > 0) {
+ 		if (setup->bRequestType & USB_DIR_IN)
+ 			field |= TRB_DIR_IN;
+@@ -3691,17 +3678,12 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ 				trb_buff_len = td_remain_len;
+ 
+ 			/* Set the TRB length, TD size, & interrupter fields. */
+-			if (xhci->hci_version < 0x100) {
+-				remainder = xhci_td_remainder(
+-						td_len - running_total);
+-			} else {
+-				remainder = xhci_v1_0_td_remainder(
+-						running_total, trb_buff_len,
+-						total_packet_count, urb,
+-						(trbs_per_td - j - 1));
+-			}
++			remainder = xhci_td_remainder(xhci, running_total,
++						   trb_buff_len, td_len,
++						   urb, trbs_per_td - j - 1);
++
+ 			length_field = TRB_LEN(trb_buff_len) |
+-				remainder |
++				TRB_TD_SIZE(remainder) |
+ 				TRB_INTR_TARGET(0);
+ 
+ 			queue_trb(xhci, ep_ring, more_trbs_coming,
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index f6bb118e4501..910f7fac031f 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1559,7 +1559,9 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
+ 		xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
+ 				"HW died, freeing TD.");
+ 		urb_priv = urb->hcpriv;
+-		for (i = urb_priv->td_cnt; i < urb_priv->length; i++) {
++		for (i = urb_priv->td_cnt;
++		     i < urb_priv->length && xhci->devs[urb->dev->slot_id];
++		     i++) {
+ 			td = urb_priv->td[i];
+ 			if (!list_empty(&td->td_list))
+ 				list_del_init(&td->td_list);
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 0f26dd2697b6..f18cdf0ec795 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1130,6 +1130,8 @@ enum xhci_setup_dev {
+ /* Normal TRB fields */
+ /* transfer_len bitmasks - bits 0:16 */
+ #define	TRB_LEN(p)		((p) & 0x1ffff)
++/* TD Size, packets remaining in this TD, bits 21:17 (5 bits, so max 31) */
++#define TRB_TD_SIZE(p)          (min((p), (u32)31) << 17)
+ /* Interrupter Target - which MSI-X vector to target the completion event at */
+ #define TRB_INTR_TARGET(p)	(((p) & 0x3ff) << 22)
+ #define GET_INTR_TARGET(p)	(((p) >> 22) & 0x3ff)
+@@ -1568,6 +1570,7 @@ struct xhci_hcd {
+ /* For controllers with a broken beyond repair streams implementation */
+ #define XHCI_BROKEN_STREAMS	(1 << 19)
+ #define XHCI_PME_STUCK_QUIRK	(1 << 20)
++#define XHCI_SSIC_PORT_UNUSED	(1 << 22)
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
+ 	/* There are two roothubs to keep track of bus suspend info for */
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 59b2126b21a3..1dd9919081f8 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -98,6 +98,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */
+ 	{ USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */
+ 	{ USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
++	{ USB_DEVICE(0x10C4, 0x81D7) }, /* IAI Corp. RCB-CV-USB USB to RS485 Adaptor */
+ 	{ USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */
+ 	{ USB_DEVICE(0x10C4, 0x81E7) }, /* Aerocomm Radio */
+ 	{ USB_DEVICE(0x10C4, 0x81E8) }, /* Zephyr Bioharness */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index a5a0376bbd48..8c660ae401d8 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -824,6 +824,7 @@ static const struct usb_device_id id_table_combined[] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ 	{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
++	{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
+ 
+ 	/* Papouch devices based on FTDI chip */
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 2943b97b2a83..7850071c0ae1 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -615,6 +615,7 @@
+  */
+ #define RATOC_VENDOR_ID		0x0584
+ #define RATOC_PRODUCT_ID_USB60F	0xb020
++#define RATOC_PRODUCT_ID_SCU18	0xb03a
+ 
+ /*
+  * Infineon Technologies
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 4021846139c9..88540596973f 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -271,6 +271,8 @@ static void option_instat_callback(struct urb *urb);
+ #define TELIT_PRODUCT_CC864_SINGLE		0x1006
+ #define TELIT_PRODUCT_DE910_DUAL		0x1010
+ #define TELIT_PRODUCT_UE910_V2			0x1012
++#define TELIT_PRODUCT_LE922_USBCFG0		0x1042
++#define TELIT_PRODUCT_LE922_USBCFG3		0x1043
+ #define TELIT_PRODUCT_LE920			0x1200
+ #define TELIT_PRODUCT_LE910			0x1201
+ 
+@@ -623,6 +625,16 @@ static const struct option_blacklist_info sierra_mc73xx_blacklist = {
+ 	.reserved = BIT(8) | BIT(10) | BIT(11),
+ };
+ 
++static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = {
++	.sendsetup = BIT(2),
++	.reserved = BIT(0) | BIT(1) | BIT(3),
++};
++
++static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = {
++	.sendsetup = BIT(0),
++	.reserved = BIT(1) | BIT(2) | BIT(3),
++};
++
+ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
+ 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
+@@ -1172,6 +1184,10 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
++	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0),
++		.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
++	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3),
++		.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+ 		.driver_info = (kernel_ulong_t)&telit_le910_blacklist },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+@@ -1691,7 +1707,7 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
+ 	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8),
+ 		.driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+-	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) },
++	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) },
+ 	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX),
+ 		.driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ 	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, 
+diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
+index 60afb39eb73c..337a0be89fcf 100644
+--- a/drivers/usb/serial/visor.c
++++ b/drivers/usb/serial/visor.c
+@@ -544,6 +544,11 @@ static int treo_attach(struct usb_serial *serial)
+ 		(serial->num_interrupt_in == 0))
+ 		return 0;
+ 
++	if (serial->num_bulk_in < 2 || serial->num_interrupt_in < 2) {
++		dev_err(&serial->interface->dev, "missing endpoints\n");
++		return -ENODEV;
++	}
++
+ 	/*
+ 	* It appears that Treos and Kyoceras want to use the
+ 	* 1st bulk in endpoint to communicate with the 2nd bulk out endpoint,
+@@ -597,8 +602,10 @@ static int clie_5_attach(struct usb_serial *serial)
+ 	 */
+ 
+ 	/* some sanity check */
+-	if (serial->num_ports < 2)
+-		return -1;
++	if (serial->num_bulk_out < 2) {
++		dev_err(&serial->interface->dev, "missing bulk out endpoints\n");
++		return -ENODEV;
++	}
+ 
+ 	/* port 0 now uses the modified endpoint Address */
+ 	port = serial->port[0];
+diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
+index 82e80e034f25..89bac470f04e 100644
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -166,13 +166,13 @@ static void fill_balloon(struct virtio_balloon *vb, size_t num)
+ 	mutex_unlock(&vb->balloon_lock);
+ }
+ 
+-static void release_pages_by_pfn(const u32 pfns[], unsigned int num)
++static void release_pages_balloon(struct virtio_balloon *vb)
+ {
+ 	unsigned int i;
+ 
+ 	/* Find pfns pointing at start of each page, get pages and free them. */
+-	for (i = 0; i < num; i += VIRTIO_BALLOON_PAGES_PER_PAGE) {
+-		struct page *page = balloon_pfn_to_page(pfns[i]);
++	for (i = 0; i < vb->num_pfns; i += VIRTIO_BALLOON_PAGES_PER_PAGE) {
++		struct page *page = balloon_pfn_to_page(vb->pfns[i]);
+ 		adjust_managed_page_count(page, 1);
+ 		put_page(page); /* balloon reference */
+ 	}
+@@ -205,8 +205,8 @@ static unsigned leak_balloon(struct virtio_balloon *vb, size_t num)
+ 	 */
+ 	if (vb->num_pfns != 0)
+ 		tell_host(vb, vb->deflate_vq);
++	release_pages_balloon(vb);
+ 	mutex_unlock(&vb->balloon_lock);
+-	release_pages_by_pfn(vb->pfns, vb->num_pfns);
+ 	return num_freed_pages;
+ }
+ 
+diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
+index eba1b7ac7294..14f767e8e5c5 100644
+--- a/drivers/virtio/virtio_pci_common.c
++++ b/drivers/virtio/virtio_pci_common.c
+@@ -554,6 +554,7 @@ err_enable_device:
+ static void virtio_pci_remove(struct pci_dev *pci_dev)
+ {
+ 	struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev);
++	struct device *dev = get_device(&vp_dev->vdev.dev);
+ 
+ 	unregister_virtio_device(&vp_dev->vdev);
+ 
+@@ -564,6 +565,7 @@ static void virtio_pci_remove(struct pci_dev *pci_dev)
+ 
+ 	pci_release_regions(pci_dev);
+ 	pci_disable_device(pci_dev);
++	put_device(dev);
+ }
+ 
+ static struct pci_driver virtio_pci_driver = {
+diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
+index 0ef5cc13fae2..61205e3bbefa 100644
+--- a/fs/btrfs/btrfs_inode.h
++++ b/fs/btrfs/btrfs_inode.h
+@@ -192,6 +192,10 @@ struct btrfs_inode {
+ 	/* File creation time. */
+ 	struct timespec i_otime;
+ 
++	/* Hook into fs_info->delayed_iputs */
++	struct list_head delayed_iput;
++	long delayed_iput_count;
++
+ 	struct inode vfs_inode;
+ };
+ 
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 6f364e1d8d3d..699944a07491 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -1544,7 +1544,7 @@ struct btrfs_fs_info {
+ 
+ 	spinlock_t delayed_iput_lock;
+ 	struct list_head delayed_iputs;
+-	struct rw_semaphore delayed_iput_sem;
++	struct mutex cleaner_delayed_iput_mutex;
+ 
+ 	/* this protects tree_mod_seq_list */
+ 	spinlock_t tree_mod_seq_lock;
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 2ef9a4b72d06..99e8f60c7962 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -1772,8 +1772,11 @@ static int cleaner_kthread(void *arg)
+ 			goto sleep;
+ 		}
+ 
++		mutex_lock(&root->fs_info->cleaner_delayed_iput_mutex);
+ 		btrfs_run_delayed_iputs(root);
+ 		btrfs_delete_unused_bgs(root->fs_info);
++		mutex_unlock(&root->fs_info->cleaner_delayed_iput_mutex);
++
+ 		again = btrfs_clean_one_deleted_snapshot(root);
+ 		mutex_unlock(&root->fs_info->cleaner_mutex);
+ 
+@@ -2491,8 +2494,8 @@ int open_ctree(struct super_block *sb,
+ 	mutex_init(&fs_info->unused_bg_unpin_mutex);
+ 	mutex_init(&fs_info->reloc_mutex);
+ 	mutex_init(&fs_info->delalloc_root_mutex);
++	mutex_init(&fs_info->cleaner_delayed_iput_mutex);
+ 	seqlock_init(&fs_info->profiles_lock);
+-	init_rwsem(&fs_info->delayed_iput_sem);
+ 
+ 	init_completion(&fs_info->kobj_unregister);
+ 	INIT_LIST_HEAD(&fs_info->dirty_cowonly_roots);
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 0ec3acd14cbf..3c1938000a5d 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -3985,11 +3985,12 @@ commit_trans:
+ 				if (ret)
+ 					return ret;
+ 				/*
+-				 * make sure that all running delayed iput are
+-				 * done
++				 * The cleaner kthread might still be doing iput
++				 * operations. Wait for it to finish so that
++				 * more space is released.
+ 				 */
+-				down_write(&root->fs_info->delayed_iput_sem);
+-				up_write(&root->fs_info->delayed_iput_sem);
++				mutex_lock(&root->fs_info->cleaner_delayed_iput_mutex);
++				mutex_unlock(&root->fs_info->cleaner_delayed_iput_mutex);
+ 				goto again;
+ 			} else {
+ 				btrfs_end_transaction(trans, root);
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 5136c73b3dce..df4e0462976e 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -3080,56 +3080,46 @@ static int btrfs_readpage_end_io_hook(struct btrfs_io_bio *io_bio,
+ 				      start, (size_t)(end - start + 1));
+ }
+ 
+-struct delayed_iput {
+-	struct list_head list;
+-	struct inode *inode;
+-};
+-
+-/* JDM: If this is fs-wide, why can't we add a pointer to
+- * btrfs_inode instead and avoid the allocation? */
+ void btrfs_add_delayed_iput(struct inode *inode)
+ {
+ 	struct btrfs_fs_info *fs_info = BTRFS_I(inode)->root->fs_info;
+-	struct delayed_iput *delayed;
++	struct btrfs_inode *binode = BTRFS_I(inode);
+ 
+ 	if (atomic_add_unless(&inode->i_count, -1, 1))
+ 		return;
+ 
+-	delayed = kmalloc(sizeof(*delayed), GFP_NOFS | __GFP_NOFAIL);
+-	delayed->inode = inode;
+-
+ 	spin_lock(&fs_info->delayed_iput_lock);
+-	list_add_tail(&delayed->list, &fs_info->delayed_iputs);
++	if (binode->delayed_iput_count == 0) {
++		ASSERT(list_empty(&binode->delayed_iput));
++		list_add_tail(&binode->delayed_iput, &fs_info->delayed_iputs);
++	} else {
++		binode->delayed_iput_count++;
++	}
+ 	spin_unlock(&fs_info->delayed_iput_lock);
+ }
+ 
+ void btrfs_run_delayed_iputs(struct btrfs_root *root)
+ {
+-	LIST_HEAD(list);
+ 	struct btrfs_fs_info *fs_info = root->fs_info;
+-	struct delayed_iput *delayed;
+-	int empty;
+-
+-	spin_lock(&fs_info->delayed_iput_lock);
+-	empty = list_empty(&fs_info->delayed_iputs);
+-	spin_unlock(&fs_info->delayed_iput_lock);
+-	if (empty)
+-		return;
+-
+-	down_read(&fs_info->delayed_iput_sem);
+ 
+ 	spin_lock(&fs_info->delayed_iput_lock);
+-	list_splice_init(&fs_info->delayed_iputs, &list);
+-	spin_unlock(&fs_info->delayed_iput_lock);
+-
+-	while (!list_empty(&list)) {
+-		delayed = list_entry(list.next, struct delayed_iput, list);
+-		list_del(&delayed->list);
+-		iput(delayed->inode);
+-		kfree(delayed);
++	while (!list_empty(&fs_info->delayed_iputs)) {
++		struct btrfs_inode *inode;
++
++		inode = list_first_entry(&fs_info->delayed_iputs,
++				struct btrfs_inode, delayed_iput);
++		if (inode->delayed_iput_count) {
++			inode->delayed_iput_count--;
++			list_move_tail(&inode->delayed_iput,
++					&fs_info->delayed_iputs);
++		} else {
++			list_del_init(&inode->delayed_iput);
++		}
++		spin_unlock(&fs_info->delayed_iput_lock);
++		iput(&inode->vfs_inode);
++		spin_lock(&fs_info->delayed_iput_lock);
+ 	}
+-
+-	up_read(&root->fs_info->delayed_iput_sem);
++	spin_unlock(&fs_info->delayed_iput_lock);
+ }
+ 
+ /*
+@@ -8890,6 +8880,7 @@ struct inode *btrfs_alloc_inode(struct super_block *sb)
+ 	ei->dir_index = 0;
+ 	ei->last_unlink_trans = 0;
+ 	ei->last_log_commit = 0;
++	ei->delayed_iput_count = 0;
+ 
+ 	spin_lock_init(&ei->lock);
+ 	ei->outstanding_extents = 0;
+@@ -8914,6 +8905,7 @@ struct inode *btrfs_alloc_inode(struct super_block *sb)
+ 	mutex_init(&ei->delalloc_mutex);
+ 	btrfs_ordered_inode_tree_init(&ei->ordered_tree);
+ 	INIT_LIST_HEAD(&ei->delalloc_inodes);
++	INIT_LIST_HEAD(&ei->delayed_iput);
+ 	RB_CLEAR_NODE(&ei->rb_node);
+ 
+ 	return inode;
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 174f5e1e00ab..5113b7257b45 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -6322,6 +6322,14 @@ int btrfs_read_sys_array(struct btrfs_root *root)
+ 				goto out_short_read;
+ 
+ 			num_stripes = btrfs_chunk_num_stripes(sb, chunk);
++			if (!num_stripes) {
++				printk(KERN_ERR
++	    "BTRFS: invalid number of stripes %u in sys_array at offset %u\n",
++					num_stripes, cur_offset);
++				ret = -EIO;
++				break;
++			}
++
+ 			len = btrfs_chunk_item_size(num_stripes);
+ 			if (cur_offset + len > array_size)
+ 				goto out_short_read;
+diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
+index 7febcf2475c5..50b268483302 100644
+--- a/fs/cifs/cifs_debug.c
++++ b/fs/cifs/cifs_debug.c
+@@ -50,7 +50,7 @@ void cifs_vfs_err(const char *fmt, ...)
+ 	vaf.fmt = fmt;
+ 	vaf.va = &args;
+ 
+-	pr_err("CIFS VFS: %pV", &vaf);
++	pr_err_ratelimited("CIFS VFS: %pV", &vaf);
+ 
+ 	va_end(args);
+ }
+diff --git a/fs/cifs/cifs_debug.h b/fs/cifs/cifs_debug.h
+index f40fbaca1b2a..66cf0f9fff89 100644
+--- a/fs/cifs/cifs_debug.h
++++ b/fs/cifs/cifs_debug.h
+@@ -51,14 +51,13 @@ __printf(1, 2) void cifs_vfs_err(const char *fmt, ...);
+ /* information message: e.g., configuration, major event */
+ #define cifs_dbg(type, fmt, ...)					\
+ do {									\
+-	if (type == FYI) {						\
+-		if (cifsFYI & CIFS_INFO) {				\
+-			pr_debug("%s: " fmt, __FILE__, ##__VA_ARGS__);	\
+-		}							\
++	if (type == FYI && cifsFYI & CIFS_INFO) {			\
++		pr_debug_ratelimited("%s: "				\
++			    fmt, __FILE__, ##__VA_ARGS__);		\
+ 	} else if (type == VFS) {					\
+ 		cifs_vfs_err(fmt, ##__VA_ARGS__);			\
+ 	} else if (type == NOISY && type != 0) {			\
+-		pr_debug(fmt, ##__VA_ARGS__);				\
++		pr_debug_ratelimited(fmt, ##__VA_ARGS__);		\
+ 	}								\
+ } while (0)
+ 
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 8383d5ea4202..de626b939811 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -357,7 +357,6 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ 	server->session_key.response = NULL;
+ 	server->session_key.len = 0;
+ 	server->lstrp = jiffies;
+-	mutex_unlock(&server->srv_mutex);
+ 
+ 	/* mark submitted MIDs for retry and issue callback */
+ 	INIT_LIST_HEAD(&retry_list);
+@@ -370,6 +369,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ 		list_move(&mid_entry->qhead, &retry_list);
+ 	}
+ 	spin_unlock(&GlobalMid_Lock);
++	mutex_unlock(&server->srv_mutex);
+ 
+ 	cifs_dbg(FYI, "%s: issuing mid callbacks\n", __func__);
+ 	list_for_each_safe(tmp, tmp2, &retry_list) {
+diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
+index b1eede3678a9..3634c7adf7d2 100644
+--- a/fs/cifs/readdir.c
++++ b/fs/cifs/readdir.c
+@@ -847,6 +847,7 @@ int cifs_readdir(struct file *file, struct dir_context *ctx)
+ 		 * if buggy server returns . and .. late do we want to
+ 		 * check for that here?
+ 		 */
++		*tmp_buf = 0;
+ 		rc = cifs_filldir(current_entry, file, ctx,
+ 				  tmp_buf, max_len);
+ 		if (rc) {
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index 126f46b887cc..66106f6ed7b4 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -576,14 +576,16 @@ cifs_call_async(struct TCP_Server_Info *server, struct smb_rqst *rqst,
+ 	cifs_in_send_dec(server);
+ 	cifs_save_when_sent(mid);
+ 
+-	if (rc < 0)
++	if (rc < 0) {
+ 		server->sequence_number -= 2;
++		cifs_delete_mid(mid);
++	}
++
+ 	mutex_unlock(&server->srv_mutex);
+ 
+ 	if (rc == 0)
+ 		return 0;
+ 
+-	cifs_delete_mid(mid);
+ 	add_credits_and_wake_if(server, credits, optype);
+ 	return rc;
+ }
+diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
+index de2d6245e9fa..f895a85d9304 100644
+--- a/fs/hostfs/hostfs_kern.c
++++ b/fs/hostfs/hostfs_kern.c
+@@ -730,15 +730,13 @@ static int hostfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode,
+ 
+ 	init_special_inode(inode, mode, dev);
+ 	err = do_mknod(name, mode, MAJOR(dev), MINOR(dev));
+-	if (!err)
++	if (err)
+ 		goto out_free;
+ 
+ 	err = read_name(inode, name);
+ 	__putname(name);
+ 	if (err)
+ 		goto out_put;
+-	if (err)
+-		goto out_put;
+ 
+ 	d_instantiate(dentry, inode);
+ 	return 0;
+diff --git a/fs/locks.c b/fs/locks.c
+index d3d558ba4da7..8501eecb2af0 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -2154,7 +2154,6 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
+ 		goto out;
+ 	}
+ 
+-again:
+ 	error = flock_to_posix_lock(filp, file_lock, &flock);
+ 	if (error)
+ 		goto out;
+@@ -2196,19 +2195,22 @@ again:
+ 	 * Attempt to detect a close/fcntl race and recover by
+ 	 * releasing the lock that was just acquired.
+ 	 */
+-	/*
+-	 * we need that spin_lock here - it prevents reordering between
+-	 * update of i_flctx->flc_posix and check for it done in close().
+-	 * rcu_read_lock() wouldn't do.
+-	 */
+-	spin_lock(&current->files->file_lock);
+-	f = fcheck(fd);
+-	spin_unlock(&current->files->file_lock);
+-	if (!error && f != filp && flock.l_type != F_UNLCK) {
+-		flock.l_type = F_UNLCK;
+-		goto again;
++	if (!error && file_lock->fl_type != F_UNLCK) {
++		/*
++		 * We need that spin_lock here - it prevents reordering between
++		 * update of i_flctx->flc_posix and check for it done in
++		 * close(). rcu_read_lock() wouldn't do.
++		 */
++		spin_lock(&current->files->file_lock);
++		f = fcheck(fd);
++		spin_unlock(&current->files->file_lock);
++		if (f != filp) {
++			file_lock->fl_type = F_UNLCK;
++			error = do_lock_file_wait(filp, cmd, file_lock);
++			WARN_ON_ONCE(error);
++			error = -EBADF;
++		}
+ 	}
+-
+ out:
+ 	locks_free_lock(file_lock);
+ 	return error;
+@@ -2294,7 +2296,6 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
+ 		goto out;
+ 	}
+ 
+-again:
+ 	error = flock64_to_posix_lock(filp, file_lock, &flock);
+ 	if (error)
+ 		goto out;
+@@ -2336,14 +2337,22 @@ again:
+ 	 * Attempt to detect a close/fcntl race and recover by
+ 	 * releasing the lock that was just acquired.
+ 	 */
+-	spin_lock(&current->files->file_lock);
+-	f = fcheck(fd);
+-	spin_unlock(&current->files->file_lock);
+-	if (!error && f != filp && flock.l_type != F_UNLCK) {
+-		flock.l_type = F_UNLCK;
+-		goto again;
++	if (!error && file_lock->fl_type != F_UNLCK) {
++		/*
++		 * We need that spin_lock here - it prevents reordering between
++		 * update of i_flctx->flc_posix and check for it done in
++		 * close(). rcu_read_lock() wouldn't do.
++		 */
++		spin_lock(&current->files->file_lock);
++		f = fcheck(fd);
++		spin_unlock(&current->files->file_lock);
++		if (f != filp) {
++			file_lock->fl_type = F_UNLCK;
++			error = do_lock_file_wait(filp, cmd, file_lock);
++			WARN_ON_ONCE(error);
++			error = -EBADF;
++		}
+ 	}
+-
+ out:
+ 	locks_free_lock(file_lock);
+ 	return error;
+diff --git a/fs/nfs/client.c b/fs/nfs/client.c
+index 892aefff3630..fdd234206dff 100644
+--- a/fs/nfs/client.c
++++ b/fs/nfs/client.c
+@@ -775,7 +775,7 @@ static int nfs_init_server(struct nfs_server *server,
+ 	server->options = data->options;
+ 	server->caps |= NFS_CAP_HARDLINKS|NFS_CAP_SYMLINKS|NFS_CAP_FILEID|
+ 		NFS_CAP_MODE|NFS_CAP_NLINK|NFS_CAP_OWNER|NFS_CAP_OWNER_GROUP|
+-		NFS_CAP_ATIME|NFS_CAP_CTIME|NFS_CAP_MTIME|NFS_CAP_CHANGE_ATTR;
++		NFS_CAP_ATIME|NFS_CAP_CTIME|NFS_CAP_MTIME;
+ 
+ 	if (data->rsize)
+ 		server->rsize = nfs_block_size(data->rsize, NULL);
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
+index fecd9201dbad..c2abdc7db6c3 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -1484,11 +1484,9 @@ ff_layout_encode_layoutreturn(struct pnfs_layout_hdr *lo,
+ 	start = xdr_reserve_space(xdr, 4);
+ 	BUG_ON(!start);
+ 
+-	if (ff_layout_encode_ioerr(flo, xdr, args))
+-		goto out;
+-
++	ff_layout_encode_ioerr(flo, xdr, args);
+ 	ff_layout_encode_iostats(flo, xdr, args);
+-out:
++
+ 	*start = cpu_to_be32((xdr->p - start - 1) * 4);
+ 	dprintk("%s: Return\n", __func__);
+ }
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index 7f22b6c6fb50..723b8922d76b 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -442,7 +442,7 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr, st
+ 			nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
+ 		if (fattr->valid & NFS_ATTR_FATTR_CHANGE)
+ 			inode->i_version = fattr->change_attr;
+-		else if (nfs_server_capable(inode, NFS_CAP_CHANGE_ATTR))
++		else
+ 			nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
+ 		if (fattr->valid & NFS_ATTR_FATTR_SIZE)
+ 			inode->i_size = nfs_size_to_loff_t(fattr->size);
+@@ -1627,6 +1627,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ 	unsigned long invalid = 0;
+ 	unsigned long now = jiffies;
+ 	unsigned long save_cache_validity;
++	bool cache_revalidated = true;
+ 
+ 	dfprintk(VFS, "NFS: %s(%s/%lu fh_crc=0x%08x ct=%d info=0x%x)\n",
+ 			__func__, inode->i_sb->s_id, inode->i_ino,
+@@ -1688,22 +1689,28 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ 				nfs_force_lookup_revalidate(inode);
+ 			inode->i_version = fattr->change_attr;
+ 		}
+-	} else if (server->caps & NFS_CAP_CHANGE_ATTR)
++	} else {
+ 		nfsi->cache_validity |= save_cache_validity;
++		cache_revalidated = false;
++	}
+ 
+ 	if (fattr->valid & NFS_ATTR_FATTR_MTIME) {
+ 		memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
+-	} else if (server->caps & NFS_CAP_MTIME)
++	} else if (server->caps & NFS_CAP_MTIME) {
+ 		nfsi->cache_validity |= save_cache_validity &
+ 				(NFS_INO_INVALID_ATTR
+ 				| NFS_INO_REVAL_FORCED);
++		cache_revalidated = false;
++	}
+ 
+ 	if (fattr->valid & NFS_ATTR_FATTR_CTIME) {
+ 		memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
+-	} else if (server->caps & NFS_CAP_CTIME)
++	} else if (server->caps & NFS_CAP_CTIME) {
+ 		nfsi->cache_validity |= save_cache_validity &
+ 				(NFS_INO_INVALID_ATTR
+ 				| NFS_INO_REVAL_FORCED);
++		cache_revalidated = false;
++	}
+ 
+ 	/* Check if our cached file size is stale */
+ 	if (fattr->valid & NFS_ATTR_FATTR_SIZE) {
+@@ -1723,19 +1730,23 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ 					(long long)cur_isize,
+ 					(long long)new_isize);
+ 		}
+-	} else
++	} else {
+ 		nfsi->cache_validity |= save_cache_validity &
+ 				(NFS_INO_INVALID_ATTR
+ 				| NFS_INO_REVAL_PAGECACHE
+ 				| NFS_INO_REVAL_FORCED);
++		cache_revalidated = false;
++	}
+ 
+ 
+ 	if (fattr->valid & NFS_ATTR_FATTR_ATIME)
+ 		memcpy(&inode->i_atime, &fattr->atime, sizeof(inode->i_atime));
+-	else if (server->caps & NFS_CAP_ATIME)
++	else if (server->caps & NFS_CAP_ATIME) {
+ 		nfsi->cache_validity |= save_cache_validity &
+ 				(NFS_INO_INVALID_ATIME
+ 				| NFS_INO_REVAL_FORCED);
++		cache_revalidated = false;
++	}
+ 
+ 	if (fattr->valid & NFS_ATTR_FATTR_MODE) {
+ 		if ((inode->i_mode & S_IALLUGO) != (fattr->mode & S_IALLUGO)) {
+@@ -1744,36 +1755,42 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ 			inode->i_mode = newmode;
+ 			invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
+ 		}
+-	} else if (server->caps & NFS_CAP_MODE)
++	} else if (server->caps & NFS_CAP_MODE) {
+ 		nfsi->cache_validity |= save_cache_validity &
+ 				(NFS_INO_INVALID_ATTR
+ 				| NFS_INO_INVALID_ACCESS
+ 				| NFS_INO_INVALID_ACL
+ 				| NFS_INO_REVAL_FORCED);
++		cache_revalidated = false;
++	}
+ 
+ 	if (fattr->valid & NFS_ATTR_FATTR_OWNER) {
+ 		if (!uid_eq(inode->i_uid, fattr->uid)) {
+ 			invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
+ 			inode->i_uid = fattr->uid;
+ 		}
+-	} else if (server->caps & NFS_CAP_OWNER)
++	} else if (server->caps & NFS_CAP_OWNER) {
+ 		nfsi->cache_validity |= save_cache_validity &
+ 				(NFS_INO_INVALID_ATTR
+ 				| NFS_INO_INVALID_ACCESS
+ 				| NFS_INO_INVALID_ACL
+ 				| NFS_INO_REVAL_FORCED);
++		cache_revalidated = false;
++	}
+ 
+ 	if (fattr->valid & NFS_ATTR_FATTR_GROUP) {
+ 		if (!gid_eq(inode->i_gid, fattr->gid)) {
+ 			invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
+ 			inode->i_gid = fattr->gid;
+ 		}
+-	} else if (server->caps & NFS_CAP_OWNER_GROUP)
++	} else if (server->caps & NFS_CAP_OWNER_GROUP) {
+ 		nfsi->cache_validity |= save_cache_validity &
+ 				(NFS_INO_INVALID_ATTR
+ 				| NFS_INO_INVALID_ACCESS
+ 				| NFS_INO_INVALID_ACL
+ 				| NFS_INO_REVAL_FORCED);
++		cache_revalidated = false;
++	}
+ 
+ 	if (fattr->valid & NFS_ATTR_FATTR_NLINK) {
+ 		if (inode->i_nlink != fattr->nlink) {
+@@ -1782,19 +1799,22 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ 				invalid |= NFS_INO_INVALID_DATA;
+ 			set_nlink(inode, fattr->nlink);
+ 		}
+-	} else if (server->caps & NFS_CAP_NLINK)
++	} else if (server->caps & NFS_CAP_NLINK) {
+ 		nfsi->cache_validity |= save_cache_validity &
+ 				(NFS_INO_INVALID_ATTR
+ 				| NFS_INO_REVAL_FORCED);
++		cache_revalidated = false;
++	}
+ 
+ 	if (fattr->valid & NFS_ATTR_FATTR_SPACE_USED) {
+ 		/*
+ 		 * report the blocks in 512byte units
+ 		 */
+ 		inode->i_blocks = nfs_calc_block_size(fattr->du.nfs3.used);
+- 	}
+-	if (fattr->valid & NFS_ATTR_FATTR_BLOCKS_USED)
++	} else if (fattr->valid & NFS_ATTR_FATTR_BLOCKS_USED)
+ 		inode->i_blocks = fattr->du.nfs2.blocks;
++	else
++		cache_revalidated = false;
+ 
+ 	/* Update attrtimeo value if we're out of the unstable period */
+ 	if (invalid & NFS_INO_INVALID_ATTR) {
+@@ -1804,9 +1824,13 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ 		/* Set barrier to be more recent than all outstanding updates */
+ 		nfsi->attr_gencount = nfs_inc_attr_generation_counter();
+ 	} else {
+-		if (!time_in_range_open(now, nfsi->attrtimeo_timestamp, nfsi->attrtimeo_timestamp + nfsi->attrtimeo)) {
+-			if ((nfsi->attrtimeo <<= 1) > NFS_MAXATTRTIMEO(inode))
+-				nfsi->attrtimeo = NFS_MAXATTRTIMEO(inode);
++		if (cache_revalidated) {
++			if (!time_in_range_open(now, nfsi->attrtimeo_timestamp,
++				nfsi->attrtimeo_timestamp + nfsi->attrtimeo)) {
++				nfsi->attrtimeo <<= 1;
++				if (nfsi->attrtimeo > NFS_MAXATTRTIMEO(inode))
++					nfsi->attrtimeo = NFS_MAXATTRTIMEO(inode);
++			}
+ 			nfsi->attrtimeo_timestamp = now;
+ 		}
+ 		/* Set the barrier to be more recent than this fattr */
+@@ -1815,7 +1839,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ 	}
+ 
+ 	/* Don't declare attrcache up to date if there were no attrs! */
+-	if (fattr->valid != 0)
++	if (cache_revalidated)
+ 		invalid &= ~NFS_INO_INVALID_ATTR;
+ 
+ 	/* Don't invalidate the data if we were to blame */
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 8f393fcc313b..2c4f41c34366 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1284,6 +1284,7 @@ static void __update_open_stateid(struct nfs4_state *state, nfs4_stateid *open_s
+ 	 * Protect the call to nfs4_state_set_mode_locked and
+ 	 * serialise the stateid update
+ 	 */
++	spin_lock(&state->owner->so_lock);
+ 	write_seqlock(&state->seqlock);
+ 	if (deleg_stateid != NULL) {
+ 		nfs4_stateid_copy(&state->stateid, deleg_stateid);
+@@ -1292,7 +1293,6 @@ static void __update_open_stateid(struct nfs4_state *state, nfs4_stateid *open_s
+ 	if (open_stateid != NULL)
+ 		nfs_set_open_stateid_locked(state, open_stateid, fmode);
+ 	write_sequnlock(&state->seqlock);
+-	spin_lock(&state->owner->so_lock);
+ 	update_open_stateflags(state, fmode);
+ 	spin_unlock(&state->owner->so_lock);
+ }
+@@ -8512,7 +8512,6 @@ static const struct nfs4_minor_version_ops nfs_v4_0_minor_ops = {
+ 	.minor_version = 0,
+ 	.init_caps = NFS_CAP_READDIRPLUS
+ 		| NFS_CAP_ATOMIC_OPEN
+-		| NFS_CAP_CHANGE_ATTR
+ 		| NFS_CAP_POSIX_LOCK,
+ 	.init_client = nfs40_init_client,
+ 	.shutdown_client = nfs40_shutdown_client,
+@@ -8538,7 +8537,6 @@ static const struct nfs4_minor_version_ops nfs_v4_1_minor_ops = {
+ 	.minor_version = 1,
+ 	.init_caps = NFS_CAP_READDIRPLUS
+ 		| NFS_CAP_ATOMIC_OPEN
+-		| NFS_CAP_CHANGE_ATTR
+ 		| NFS_CAP_POSIX_LOCK
+ 		| NFS_CAP_STATEID_NFSV41
+ 		| NFS_CAP_ATOMIC_OPEN_V1,
+@@ -8561,7 +8559,6 @@ static const struct nfs4_minor_version_ops nfs_v4_2_minor_ops = {
+ 	.minor_version = 2,
+ 	.init_caps = NFS_CAP_READDIRPLUS
+ 		| NFS_CAP_ATOMIC_OPEN
+-		| NFS_CAP_CHANGE_ATTR
+ 		| NFS_CAP_POSIX_LOCK
+ 		| NFS_CAP_STATEID_NFSV41
+ 		| NFS_CAP_ATOMIC_OPEN_V1
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index 482cfd34472d..523e485a11b8 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -2518,6 +2518,11 @@ static int dlm_migrate_lockres(struct dlm_ctxt *dlm,
+ 	spin_lock(&dlm->master_lock);
+ 	ret = dlm_add_migration_mle(dlm, res, mle, &oldmle, name,
+ 				    namelen, target, dlm->node_num);
++	/* get an extra reference on the mle.
++	 * otherwise the assert_master from the new
++	 * master will destroy this.
++	 */
++	dlm_get_mle_inuse(mle);
+ 	spin_unlock(&dlm->master_lock);
+ 	spin_unlock(&dlm->spinlock);
+ 
+@@ -2553,6 +2558,7 @@ fail:
+ 		if (mle_added) {
+ 			dlm_mle_detach_hb_events(dlm, mle);
+ 			dlm_put_mle(mle);
++			dlm_put_mle_inuse(mle);
+ 		} else if (mle) {
+ 			kmem_cache_free(dlm_mle_cache, mle);
+ 			mle = NULL;
+@@ -2570,17 +2576,6 @@ fail:
+ 	 * ensure that all assert_master work is flushed. */
+ 	flush_workqueue(dlm->dlm_worker);
+ 
+-	/* get an extra reference on the mle.
+-	 * otherwise the assert_master from the new
+-	 * master will destroy this.
+-	 * also, make sure that all callers of dlm_get_mle
+-	 * take both dlm->spinlock and dlm->master_lock */
+-	spin_lock(&dlm->spinlock);
+-	spin_lock(&dlm->master_lock);
+-	dlm_get_mle_inuse(mle);
+-	spin_unlock(&dlm->master_lock);
+-	spin_unlock(&dlm->spinlock);
+-
+ 	/* notify new node and send all lock state */
+ 	/* call send_one_lockres with migration flag.
+ 	 * this serves as notice to the target node that a
+@@ -3309,6 +3304,15 @@ top:
+ 			    mle->new_master != dead_node)
+ 				continue;
+ 
++			if (mle->new_master == dead_node && mle->inuse) {
++				mlog(ML_NOTICE, "%s: target %u died during "
++						"migration from %u, the MLE is "
++						"still keep used, ignore it!\n",
++						dlm->name, dead_node,
++						mle->master);
++				continue;
++			}
++
+ 			/* If we have reached this point, this mle needs to be
+ 			 * removed from the list and freed. */
+ 			dlm_clean_migration_mle(dlm, mle);
+diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
+index 3d90ad7ff91f..f25ff5d3a2f9 100644
+--- a/fs/ocfs2/dlm/dlmrecovery.c
++++ b/fs/ocfs2/dlm/dlmrecovery.c
+@@ -2360,6 +2360,8 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
+ 						break;
+ 					}
+ 				}
++				dlm_lockres_clear_refmap_bit(dlm, res,
++						dead_node);
+ 				spin_unlock(&res->spinlock);
+ 				continue;
+ 			}
+diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
+index 23157e40dd74..3623ab6fa97f 100644
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -1390,6 +1390,7 @@ static int __ocfs2_cluster_lock(struct ocfs2_super *osb,
+ 	unsigned int gen;
+ 	int noqueue_attempted = 0;
+ 	int dlm_locked = 0;
++	int kick_dc = 0;
+ 
+ 	if (!(lockres->l_flags & OCFS2_LOCK_INITIALIZED)) {
+ 		mlog_errno(-EINVAL);
+@@ -1524,7 +1525,12 @@ update_holders:
+ unlock:
+ 	lockres_clear_flags(lockres, OCFS2_LOCK_UPCONVERT_FINISHING);
+ 
++	/* ocfs2_unblock_lock reques on seeing OCFS2_LOCK_UPCONVERT_FINISHING */
++	kick_dc = (lockres->l_flags & OCFS2_LOCK_BLOCKED);
++
+ 	spin_unlock_irqrestore(&lockres->l_lock, flags);
++	if (kick_dc)
++		ocfs2_wake_downconvert_thread(osb);
+ out:
+ 	/*
+ 	 * This is helping work around a lock inversion between the page lock
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 871fcb67be97..758012bfd5f0 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -22,9 +22,9 @@
+ 
+ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
+ {
+-	ssize_t list_size, size;
+-	char *buf, *name, *value;
+-	int error;
++	ssize_t list_size, size, value_size = 0;
++	char *buf, *name, *value = NULL;
++	int uninitialized_var(error);
+ 
+ 	if (!old->d_inode->i_op->getxattr ||
+ 	    !new->d_inode->i_op->getxattr)
+@@ -41,29 +41,40 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
+ 	if (!buf)
+ 		return -ENOMEM;
+ 
+-	error = -ENOMEM;
+-	value = kmalloc(XATTR_SIZE_MAX, GFP_KERNEL);
+-	if (!value)
+-		goto out;
+-
+ 	list_size = vfs_listxattr(old, buf, list_size);
+ 	if (list_size <= 0) {
+ 		error = list_size;
+-		goto out_free_value;
++		goto out;
+ 	}
+ 
+ 	for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
+-		size = vfs_getxattr(old, name, value, XATTR_SIZE_MAX);
+-		if (size <= 0) {
++retry:
++		size = vfs_getxattr(old, name, value, value_size);
++		if (size == -ERANGE)
++			size = vfs_getxattr(old, name, NULL, 0);
++
++		if (size < 0) {
+ 			error = size;
+-			goto out_free_value;
++			break;
++		}
++
++		if (size > value_size) {
++			void *new;
++
++			new = krealloc(value, size, GFP_KERNEL);
++			if (!new) {
++				error = -ENOMEM;
++				break;
++			}
++			value = new;
++			value_size = size;
++			goto retry;
+ 		}
++
+ 		error = vfs_setxattr(new, name, value, size, 0);
+ 		if (error)
+-			goto out_free_value;
++			break;
+ 	}
+-
+-out_free_value:
+ 	kfree(value);
+ out:
+ 	kfree(buf);
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index ba0db2638946..a1b069e5e363 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -45,6 +45,19 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr)
+ 	int err;
+ 	struct dentry *upperdentry;
+ 
++	/*
++	 * Check for permissions before trying to copy-up.  This is redundant
++	 * since it will be rechecked later by ->setattr() on upper dentry.  But
++	 * without this, copy-up can be triggered by just about anybody.
++	 *
++	 * We don't initialize inode->size, which just means that
++	 * inode_newsize_ok() will always check against MAX_LFS_FILESIZE and not
++	 * check for a swapfile (which this won't be anyway).
++	 */
++	err = inode_change_ok(dentry->d_inode, attr);
++	if (err)
++		return err;
++
+ 	err = ovl_want_write(dentry);
+ 	if (err)
+ 		goto out;
+diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
+index 70e9af551600..adcb1398c481 100644
+--- a/fs/overlayfs/readdir.c
++++ b/fs/overlayfs/readdir.c
+@@ -571,7 +571,8 @@ void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list)
+ 			       (int) PTR_ERR(dentry));
+ 			continue;
+ 		}
+-		ovl_cleanup(upper->d_inode, dentry);
++		if (dentry->d_inode)
++			ovl_cleanup(upper->d_inode, dentry);
+ 		dput(dentry);
+ 	}
+ 	mutex_unlock(&upper->d_inode->i_mutex);
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index d74af7f78fec..bd6d5c1e667d 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -9,6 +9,7 @@
+ 
+ #include <linux/fs.h>
+ #include <linux/namei.h>
++#include <linux/pagemap.h>
+ #include <linux/xattr.h>
+ #include <linux/security.h>
+ #include <linux/mount.h>
+@@ -847,6 +848,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+ 	}
+ 
+ 	sb->s_stack_depth = 0;
++	sb->s_maxbytes = MAX_LFS_FILESIZE;
+ 	if (ufs->config.upperdir) {
+ 		if (!ufs->config.workdir) {
+ 			pr_err("overlayfs: missing 'workdir'\n");
+@@ -986,6 +988,9 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+ 
+ 	root_dentry->d_fsdata = oe;
+ 
++	ovl_copyattr(ovl_dentry_real(root_dentry)->d_inode,
++		     root_dentry->d_inode);
++
+ 	sb->s_magic = OVERLAYFS_SUPER_MAGIC;
+ 	sb->s_op = &ovl_super_operations;
+ 	sb->s_root = root_dentry;
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index 6afac3d561ac..78a40ef0c463 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -2052,14 +2052,29 @@ void udf_write_aext(struct inode *inode, struct extent_position *epos,
+ 		epos->offset += adsize;
+ }
+ 
++/*
++ * Only 1 indirect extent in a row really makes sense but allow upto 16 in case
++ * someone does some weird stuff.
++ */
++#define UDF_MAX_INDIR_EXTS 16
++
+ int8_t udf_next_aext(struct inode *inode, struct extent_position *epos,
+ 		     struct kernel_lb_addr *eloc, uint32_t *elen, int inc)
+ {
+ 	int8_t etype;
++	unsigned int indirections = 0;
+ 
+ 	while ((etype = udf_current_aext(inode, epos, eloc, elen, inc)) ==
+ 	       (EXT_NEXT_EXTENT_ALLOCDECS >> 30)) {
+ 		int block;
++
++		if (++indirections > UDF_MAX_INDIR_EXTS) {
++			udf_err(inode->i_sb,
++				"too many indirect extents in inode %lu\n",
++				inode->i_ino);
++			return -1;
++		}
++
+ 		epos->block = *eloc;
+ 		epos->offset = sizeof(struct allocExtDesc);
+ 		brelse(epos->bh);
+diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
+index b84fee372734..2eafe2c4d239 100644
+--- a/fs/udf/unicode.c
++++ b/fs/udf/unicode.c
+@@ -133,11 +133,15 @@ int udf_CS0toUTF8(struct ustr *utf_o, const struct ustr *ocu_i)
+ 		if (c < 0x80U)
+ 			utf_o->u_name[utf_o->u_len++] = (uint8_t)c;
+ 		else if (c < 0x800U) {
++			if (utf_o->u_len > (UDF_NAME_LEN - 4))
++				break;
+ 			utf_o->u_name[utf_o->u_len++] =
+ 						(uint8_t)(0xc0 | (c >> 6));
+ 			utf_o->u_name[utf_o->u_len++] =
+ 						(uint8_t)(0x80 | (c & 0x3f));
+ 		} else {
++			if (utf_o->u_len > (UDF_NAME_LEN - 5))
++				break;
+ 			utf_o->u_name[utf_o->u_len++] =
+ 						(uint8_t)(0xe0 | (c >> 12));
+ 			utf_o->u_name[utf_o->u_len++] =
+@@ -178,17 +182,22 @@ int udf_CS0toUTF8(struct ustr *utf_o, const struct ustr *ocu_i)
+ static int udf_UTF8toCS0(dstring *ocu, struct ustr *utf, int length)
+ {
+ 	unsigned c, i, max_val, utf_char;
+-	int utf_cnt, u_len;
++	int utf_cnt, u_len, u_ch;
+ 
+ 	memset(ocu, 0, sizeof(dstring) * length);
+ 	ocu[0] = 8;
+ 	max_val = 0xffU;
++	u_ch = 1;
+ 
+ try_again:
+ 	u_len = 0U;
+ 	utf_char = 0U;
+ 	utf_cnt = 0U;
+ 	for (i = 0U; i < utf->u_len; i++) {
++		/* Name didn't fit? */
++		if (u_len + 1 + u_ch >= length)
++			return 0;
++
+ 		c = (uint8_t)utf->u_name[i];
+ 
+ 		/* Complete a multi-byte UTF-8 character */
+@@ -230,6 +239,7 @@ try_again:
+ 			if (max_val == 0xffU) {
+ 				max_val = 0xffffU;
+ 				ocu[0] = (uint8_t)0x10U;
++				u_ch = 2;
+ 				goto try_again;
+ 			}
+ 			goto error_out;
+@@ -282,7 +292,7 @@ static int udf_CS0toNLS(struct nls_table *nls, struct ustr *utf_o,
+ 			c = (c << 8) | ocu[i++];
+ 
+ 		len = nls->uni2char(c, &utf_o->u_name[utf_o->u_len],
+-				    UDF_NAME_LEN - utf_o->u_len);
++				    UDF_NAME_LEN - 2 - utf_o->u_len);
+ 		/* Valid character? */
+ 		if (len >= 0)
+ 			utf_o->u_len += len;
+@@ -300,15 +310,19 @@ static int udf_NLStoCS0(struct nls_table *nls, dstring *ocu, struct ustr *uni,
+ 	int len;
+ 	unsigned i, max_val;
+ 	uint16_t uni_char;
+-	int u_len;
++	int u_len, u_ch;
+ 
+ 	memset(ocu, 0, sizeof(dstring) * length);
+ 	ocu[0] = 8;
+ 	max_val = 0xffU;
++	u_ch = 1;
+ 
+ try_again:
+ 	u_len = 0U;
+ 	for (i = 0U; i < uni->u_len; i++) {
++		/* Name didn't fit? */
++		if (u_len + 1 + u_ch >= length)
++			return 0;
+ 		len = nls->char2uni(&uni->u_name[i], uni->u_len - i, &uni_char);
+ 		if (!len)
+ 			continue;
+@@ -321,6 +335,7 @@ try_again:
+ 		if (uni_char > max_val) {
+ 			max_val = 0xffffU;
+ 			ocu[0] = (uint8_t)0x10U;
++			u_ch = 2;
+ 			goto try_again;
+ 		}
+ 
+diff --git a/fs/xfs/libxfs/xfs_dquot_buf.c b/fs/xfs/libxfs/xfs_dquot_buf.c
+index 6fbf2d853a54..48aff071591d 100644
+--- a/fs/xfs/libxfs/xfs_dquot_buf.c
++++ b/fs/xfs/libxfs/xfs_dquot_buf.c
+@@ -54,7 +54,7 @@ xfs_dqcheck(
+ 	xfs_dqid_t	 id,
+ 	uint		 type,	  /* used only when IO_dorepair is true */
+ 	uint		 flags,
+-	char		 *str)
++	const char	 *str)
+ {
+ 	xfs_dqblk_t	 *d = (xfs_dqblk_t *)ddq;
+ 	int		errs = 0;
+@@ -207,7 +207,8 @@ xfs_dquot_buf_verify_crc(
+ STATIC bool
+ xfs_dquot_buf_verify(
+ 	struct xfs_mount	*mp,
+-	struct xfs_buf		*bp)
++	struct xfs_buf		*bp,
++	int			warn)
+ {
+ 	struct xfs_dqblk	*d = (struct xfs_dqblk *)bp->b_addr;
+ 	xfs_dqid_t		id = 0;
+@@ -240,8 +241,7 @@ xfs_dquot_buf_verify(
+ 		if (i == 0)
+ 			id = be32_to_cpu(ddq->d_id);
+ 
+-		error = xfs_dqcheck(mp, ddq, id + i, 0, XFS_QMOPT_DOWARN,
+-				       "xfs_dquot_buf_verify");
++		error = xfs_dqcheck(mp, ddq, id + i, 0, warn, __func__);
+ 		if (error)
+ 			return false;
+ 	}
+@@ -256,7 +256,7 @@ xfs_dquot_buf_read_verify(
+ 
+ 	if (!xfs_dquot_buf_verify_crc(mp, bp))
+ 		xfs_buf_ioerror(bp, -EFSBADCRC);
+-	else if (!xfs_dquot_buf_verify(mp, bp))
++	else if (!xfs_dquot_buf_verify(mp, bp, XFS_QMOPT_DOWARN))
+ 		xfs_buf_ioerror(bp, -EFSCORRUPTED);
+ 
+ 	if (bp->b_error)
+@@ -264,6 +264,25 @@ xfs_dquot_buf_read_verify(
+ }
+ 
+ /*
++ * readahead errors are silent and simply leave the buffer as !done so a real
++ * read will then be run with the xfs_dquot_buf_ops verifier. See
++ * xfs_inode_buf_verify() for why we use EIO and ~XBF_DONE here rather than
++ * reporting the failure.
++ */
++static void
++xfs_dquot_buf_readahead_verify(
++	struct xfs_buf	*bp)
++{
++	struct xfs_mount	*mp = bp->b_target->bt_mount;
++
++	if (!xfs_dquot_buf_verify_crc(mp, bp) ||
++	    !xfs_dquot_buf_verify(mp, bp, 0)) {
++		xfs_buf_ioerror(bp, -EIO);
++		bp->b_flags &= ~XBF_DONE;
++	}
++}
++
++/*
+  * we don't calculate the CRC here as that is done when the dquot is flushed to
+  * the buffer after the update is done. This ensures that the dquot in the
+  * buffer always has an up-to-date CRC value.
+@@ -274,7 +293,7 @@ xfs_dquot_buf_write_verify(
+ {
+ 	struct xfs_mount	*mp = bp->b_target->bt_mount;
+ 
+-	if (!xfs_dquot_buf_verify(mp, bp)) {
++	if (!xfs_dquot_buf_verify(mp, bp, XFS_QMOPT_DOWARN)) {
+ 		xfs_buf_ioerror(bp, -EFSCORRUPTED);
+ 		xfs_verifier_error(bp);
+ 		return;
+@@ -286,3 +305,7 @@ const struct xfs_buf_ops xfs_dquot_buf_ops = {
+ 	.verify_write = xfs_dquot_buf_write_verify,
+ };
+ 
++const struct xfs_buf_ops xfs_dquot_buf_ra_ops = {
++	.verify_read = xfs_dquot_buf_readahead_verify,
++	.verify_write = xfs_dquot_buf_write_verify,
++};
+diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
+index 002b6b3a1988..7da6d0b2c2ed 100644
+--- a/fs/xfs/libxfs/xfs_inode_buf.c
++++ b/fs/xfs/libxfs/xfs_inode_buf.c
+@@ -63,11 +63,14 @@ xfs_inobp_check(
+  * has not had the inode cores stamped into it. Hence for readahead, the buffer
+  * may be potentially invalid.
+  *
+- * If the readahead buffer is invalid, we don't want to mark it with an error,
+- * but we do want to clear the DONE status of the buffer so that a followup read
+- * will re-read it from disk. This will ensure that we don't get an unnecessary
+- * warnings during log recovery and we don't get unnecssary panics on debug
+- * kernels.
++ * If the readahead buffer is invalid, we need to mark it with an error and
++ * clear the DONE status of the buffer so that a followup read will re-read it
++ * from disk. We don't report the error otherwise to avoid warnings during log
++ * recovery and we don't get unnecssary panics on debug kernels. We use EIO here
++ * because all we want to do is say readahead failed; there is no-one to report
++ * the error to, so this will distinguish it from a non-ra verifier failure.
++ * Changes to this readahead error behavour also need to be reflected in
++ * xfs_dquot_buf_readahead_verify().
+  */
+ static void
+ xfs_inode_buf_verify(
+@@ -95,6 +98,7 @@ xfs_inode_buf_verify(
+ 						XFS_RANDOM_ITOBP_INOTOBP))) {
+ 			if (readahead) {
+ 				bp->b_flags &= ~XBF_DONE;
++				xfs_buf_ioerror(bp, -EIO);
+ 				return;
+ 			}
+ 
+diff --git a/fs/xfs/libxfs/xfs_quota_defs.h b/fs/xfs/libxfs/xfs_quota_defs.h
+index 1b0a08379759..f51078f1e92a 100644
+--- a/fs/xfs/libxfs/xfs_quota_defs.h
++++ b/fs/xfs/libxfs/xfs_quota_defs.h
+@@ -153,7 +153,7 @@ typedef __uint16_t	xfs_qwarncnt_t;
+ #define XFS_QMOPT_RESBLK_MASK	(XFS_QMOPT_RES_REGBLKS | XFS_QMOPT_RES_RTBLKS)
+ 
+ extern int xfs_dqcheck(struct xfs_mount *mp, xfs_disk_dquot_t *ddq,
+-		       xfs_dqid_t id, uint type, uint flags, char *str);
++		       xfs_dqid_t id, uint type, uint flags, const char *str);
+ extern int xfs_calc_dquots_per_chunk(unsigned int nbblks);
+ 
+ #endif	/* __XFS_QUOTA_H__ */
+diff --git a/fs/xfs/libxfs/xfs_shared.h b/fs/xfs/libxfs/xfs_shared.h
+index 8dda4b321343..a3472a38efd2 100644
+--- a/fs/xfs/libxfs/xfs_shared.h
++++ b/fs/xfs/libxfs/xfs_shared.h
+@@ -49,6 +49,7 @@ extern const struct xfs_buf_ops xfs_inobt_buf_ops;
+ extern const struct xfs_buf_ops xfs_inode_buf_ops;
+ extern const struct xfs_buf_ops xfs_inode_buf_ra_ops;
+ extern const struct xfs_buf_ops xfs_dquot_buf_ops;
++extern const struct xfs_buf_ops xfs_dquot_buf_ra_ops;
+ extern const struct xfs_buf_ops xfs_sb_buf_ops;
+ extern const struct xfs_buf_ops xfs_sb_quiet_buf_ops;
+ extern const struct xfs_buf_ops xfs_symlink_buf_ops;
+diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
+index 1790b00bea7a..7dd64bf98c56 100644
+--- a/fs/xfs/xfs_buf.c
++++ b/fs/xfs/xfs_buf.c
+@@ -605,6 +605,13 @@ found:
+ 		}
+ 	}
+ 
++	/*
++	 * Clear b_error if this is a lookup from a caller that doesn't expect
++	 * valid data to be found in the buffer.
++	 */
++	if (!(flags & XBF_READ))
++		xfs_buf_ioerror(bp, 0);
++
+ 	XFS_STATS_INC(xb_get);
+ 	trace_xfs_buf_get(bp, flags, _RET_IP_);
+ 	return bp;
+@@ -1522,6 +1529,16 @@ xfs_wait_buftarg(
+ 	LIST_HEAD(dispose);
+ 	int loop = 0;
+ 
++	/*
++	 * We need to flush the buffer workqueue to ensure that all IO
++	 * completion processing is 100% done. Just waiting on buffer locks is
++	 * not sufficient for async IO as the reference count held over IO is
++	 * not released until after the buffer lock is dropped. Hence we need to
++	 * ensure here that all reference counts have been dropped before we
++	 * start walking the LRU list.
++	 */
++	drain_workqueue(btp->bt_mount->m_buf_workqueue);
++
+ 	/* loop until there is nothing left on the lru list. */
+ 	while (list_lru_count(&btp->bt_lru)) {
+ 		list_lru_walk(&btp->bt_lru, xfs_buftarg_wait_rele,
+diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
+index a5d03396dda0..1114afdd5a6b 100644
+--- a/fs/xfs/xfs_log_recover.c
++++ b/fs/xfs/xfs_log_recover.c
+@@ -3154,6 +3154,7 @@ xlog_recover_dquot_ra_pass2(
+ 	struct xfs_disk_dquot	*recddq;
+ 	struct xfs_dq_logformat	*dq_f;
+ 	uint			type;
++	int			len;
+ 
+ 
+ 	if (mp->m_qflags == 0)
+@@ -3174,8 +3175,12 @@ xlog_recover_dquot_ra_pass2(
+ 	ASSERT(dq_f);
+ 	ASSERT(dq_f->qlf_len == 1);
+ 
+-	xfs_buf_readahead(mp->m_ddev_targp, dq_f->qlf_blkno,
+-			  XFS_FSB_TO_BB(mp, dq_f->qlf_len), NULL);
++	len = XFS_FSB_TO_BB(mp, dq_f->qlf_len);
++	if (xlog_peek_buffer_cancelled(log, dq_f->qlf_blkno, len, 0))
++		return;
++
++	xfs_buf_readahead(mp->m_ddev_targp, dq_f->qlf_blkno, len,
++			  &xfs_dquot_buf_ra_ops);
+ }
+ 
+ STATIC void
+diff --git a/include/crypto/hash.h b/include/crypto/hash.h
+index 98abda9ed3aa..bbc59bdd6395 100644
+--- a/include/crypto/hash.h
++++ b/include/crypto/hash.h
+@@ -199,6 +199,7 @@ struct crypto_ahash {
+ 		      unsigned int keylen);
+ 
+ 	unsigned int reqsize;
++	bool has_setkey;
+ 	struct crypto_tfm base;
+ };
+ 
+@@ -356,6 +357,11 @@ static inline void *ahash_request_ctx(struct ahash_request *req)
+ int crypto_ahash_setkey(struct crypto_ahash *tfm, const u8 *key,
+ 			unsigned int keylen);
+ 
++static inline bool crypto_ahash_has_setkey(struct crypto_ahash *tfm)
++{
++	return tfm->has_setkey;
++}
++
+ /**
+  * crypto_ahash_finup() - update and finalize message digest
+  * @req: reference to the ahash_request handle that holds all information
+diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
+index 018afb264ac2..a2bfd7843f18 100644
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -30,6 +30,9 @@ struct alg_sock {
+ 
+ 	struct sock *parent;
+ 
++	unsigned int refcnt;
++	unsigned int nokey_refcnt;
++
+ 	const struct af_alg_type *type;
+ 	void *private;
+ };
+@@ -50,9 +53,11 @@ struct af_alg_type {
+ 	void (*release)(void *private);
+ 	int (*setkey)(void *private, const u8 *key, unsigned int keylen);
+ 	int (*accept)(void *private, struct sock *sk);
++	int (*accept_nokey)(void *private, struct sock *sk);
+ 	int (*setauthsize)(void *private, unsigned int authsize);
+ 
+ 	struct proto_ops *ops;
++	struct proto_ops *ops_nokey;
+ 	struct module *owner;
+ 	char name[14];
+ };
+@@ -67,6 +72,7 @@ int af_alg_register_type(const struct af_alg_type *type);
+ int af_alg_unregister_type(const struct af_alg_type *type);
+ 
+ int af_alg_release(struct socket *sock);
++void af_alg_release_parent(struct sock *sk);
+ int af_alg_accept(struct sock *sk, struct socket *newsock);
+ 
+ int af_alg_make_sg(struct af_alg_sgl *sgl, struct iov_iter *iter, int len);
+@@ -83,11 +89,6 @@ static inline struct alg_sock *alg_sk(struct sock *sk)
+ 	return (struct alg_sock *)sk;
+ }
+ 
+-static inline void af_alg_release_parent(struct sock *sk)
+-{
+-	sock_put(alg_sk(sk)->parent);
+-}
+-
+ static inline void af_alg_init_completion(struct af_alg_completion *completion)
+ {
+ 	init_completion(&completion->completion);
+diff --git a/include/drm/drm_cache.h b/include/drm/drm_cache.h
+index 7bfb063029d8..461a0558bca4 100644
+--- a/include/drm/drm_cache.h
++++ b/include/drm/drm_cache.h
+@@ -35,4 +35,13 @@
+ 
+ void drm_clflush_pages(struct page *pages[], unsigned long num_pages);
+ 
++static inline bool drm_arch_can_wc_memory(void)
++{
++#if defined(CONFIG_PPC) && !defined(CONFIG_NOT_COHERENT_CACHE)
++	return false;
++#else
++	return true;
++#endif
++}
++
+ #endif
+diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
+index 54233583c6cb..ca71c03143d1 100644
+--- a/include/drm/drm_crtc.h
++++ b/include/drm/drm_crtc.h
+@@ -731,8 +731,6 @@ struct drm_connector {
+ 	uint8_t num_h_tile, num_v_tile;
+ 	uint8_t tile_h_loc, tile_v_loc;
+ 	uint16_t tile_h_size, tile_v_size;
+-
+-	struct list_head destroy_list;
+ };
+ 
+ /**
+diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h
+index a89f505c856b..c7f01d1aa562 100644
+--- a/include/drm/drm_dp_mst_helper.h
++++ b/include/drm/drm_dp_mst_helper.h
+@@ -449,9 +449,7 @@ struct drm_dp_mst_topology_mgr {
+ 	   the mstb tx_slots and txmsg->state once they are queued */
+ 	struct mutex qlock;
+ 	struct list_head tx_msg_downq;
+-	struct list_head tx_msg_upq;
+ 	bool tx_down_in_progress;
+-	bool tx_up_in_progress;
+ 
+ 	/* payload info + lock for it */
+ 	struct mutex payload_lock;
+diff --git a/include/drm/drm_fixed.h b/include/drm/drm_fixed.h
+index d639049a613d..553210c02ee0 100644
+--- a/include/drm/drm_fixed.h
++++ b/include/drm/drm_fixed.h
+@@ -73,18 +73,28 @@ static inline u32 dfixed_div(fixed20_12 A, fixed20_12 B)
+ #define DRM_FIXED_ONE		(1ULL << DRM_FIXED_POINT)
+ #define DRM_FIXED_DECIMAL_MASK	(DRM_FIXED_ONE - 1)
+ #define DRM_FIXED_DIGITS_MASK	(~DRM_FIXED_DECIMAL_MASK)
++#define DRM_FIXED_EPSILON	1LL
++#define DRM_FIXED_ALMOST_ONE	(DRM_FIXED_ONE - DRM_FIXED_EPSILON)
+ 
+ static inline s64 drm_int2fixp(int a)
+ {
+ 	return ((s64)a) << DRM_FIXED_POINT;
+ }
+ 
+-static inline int drm_fixp2int(int64_t a)
++static inline int drm_fixp2int(s64 a)
+ {
+ 	return ((s64)a) >> DRM_FIXED_POINT;
+ }
+ 
+-static inline unsigned drm_fixp_msbset(int64_t a)
++static inline int drm_fixp2int_ceil(s64 a)
++{
++	if (a > 0)
++		return drm_fixp2int(a + DRM_FIXED_ALMOST_ONE);
++	else
++		return drm_fixp2int(a - DRM_FIXED_ALMOST_ONE);
++}
++
++static inline unsigned drm_fixp_msbset(s64 a)
+ {
+ 	unsigned shift, sign = (a >> 63) & 1;
+ 
+@@ -136,6 +146,45 @@ static inline s64 drm_fixp_div(s64 a, s64 b)
+ 	return result;
+ }
+ 
++static inline s64 drm_fixp_from_fraction(s64 a, s64 b)
++{
++	s64 res;
++	bool a_neg = a < 0;
++	bool b_neg = b < 0;
++	u64 a_abs = a_neg ? -a : a;
++	u64 b_abs = b_neg ? -b : b;
++	u64 rem;
++
++	/* determine integer part */
++	u64 res_abs  = div64_u64_rem(a_abs, b_abs, &rem);
++
++	/* determine fractional part */
++	{
++		u32 i = DRM_FIXED_POINT;
++
++		do {
++			rem <<= 1;
++			res_abs <<= 1;
++			if (rem >= b_abs) {
++				res_abs |= 1;
++				rem -= b_abs;
++			}
++		} while (--i != 0);
++	}
++
++	/* round up LSB */
++	{
++		u64 summand = (rem << 1) >= b_abs;
++
++		res_abs += summand;
++	}
++
++	res = (s64) res_abs;
++	if (a_neg ^ b_neg)
++		res = -res;
++	return res;
++}
++
+ static inline s64 drm_fixp_exp(s64 x)
+ {
+ 	s64 tolerance = div64_s64(DRM_FIXED_ONE, 1000000);
+diff --git a/include/linux/ceph/messenger.h b/include/linux/ceph/messenger.h
+index e15499422fdc..e91c6f15f6e8 100644
+--- a/include/linux/ceph/messenger.h
++++ b/include/linux/ceph/messenger.h
+@@ -224,6 +224,7 @@ struct ceph_connection {
+ 	struct ceph_entity_addr actual_peer_addr;
+ 
+ 	/* message out temps */
++	struct ceph_msg_header out_hdr;
+ 	struct ceph_msg *out_msg;        /* sending message (== tail of
+ 					    out_sent) */
+ 	bool out_msg_done;
+@@ -233,7 +234,6 @@ struct ceph_connection {
+ 	int out_kvec_left;   /* kvec's left in out_kvec */
+ 	int out_skip;        /* skip this many bytes */
+ 	int out_kvec_bytes;  /* total bytes left */
+-	bool out_kvec_is_msg; /* kvec refers to out_msg */
+ 	int out_more;        /* there is more data after the kvecs */
+ 	__le64 out_temp_ack; /* for writing an ack */
+ 
+diff --git a/include/linux/console.h b/include/linux/console.h
+index 9f50fb413c11..901555a3886e 100644
+--- a/include/linux/console.h
++++ b/include/linux/console.h
+@@ -149,6 +149,7 @@ extern int console_trylock(void);
+ extern void console_unlock(void);
+ extern void console_conditional_schedule(void);
+ extern void console_unblank(void);
++extern void console_flush_on_panic(void);
+ extern struct tty_driver *console_device(int *);
+ extern void console_stop(struct console *);
+ extern void console_start(struct console *);
+diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
+index 5e1273d4de14..eda4a72a9b25 100644
+--- a/include/linux/nfs_fs_sb.h
++++ b/include/linux/nfs_fs_sb.h
+@@ -220,7 +220,7 @@ struct nfs_server {
+ #define NFS_CAP_SYMLINKS	(1U << 2)
+ #define NFS_CAP_ACLS		(1U << 3)
+ #define NFS_CAP_ATOMIC_OPEN	(1U << 4)
+-#define NFS_CAP_CHANGE_ATTR	(1U << 5)
++/* #define NFS_CAP_CHANGE_ATTR	(1U << 5) */
+ #define NFS_CAP_FILEID		(1U << 6)
+ #define NFS_CAP_MODE		(1U << 7)
+ #define NFS_CAP_NLINK		(1U << 8)
+diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
+index 33170dbd9db4..5d5174b59802 100644
+--- a/include/linux/radix-tree.h
++++ b/include/linux/radix-tree.h
+@@ -370,12 +370,28 @@ void **radix_tree_next_chunk(struct radix_tree_root *root,
+ 			     struct radix_tree_iter *iter, unsigned flags);
+ 
+ /**
++ * radix_tree_iter_retry - retry this chunk of the iteration
++ * @iter:	iterator state
++ *
++ * If we iterate over a tree protected only by the RCU lock, a race
++ * against deletion or creation may result in seeing a slot for which
++ * radix_tree_deref_retry() returns true.  If so, call this function
++ * and continue the iteration.
++ */
++static inline __must_check
++void **radix_tree_iter_retry(struct radix_tree_iter *iter)
++{
++	iter->next_index = iter->index;
++	return NULL;
++}
++
++/**
+  * radix_tree_chunk_size - get current chunk size
+  *
+  * @iter:	pointer to radix tree iterator
+  * Returns:	current chunk size
+  */
+-static __always_inline unsigned
++static __always_inline long
+ radix_tree_chunk_size(struct radix_tree_iter *iter)
+ {
+ 	return iter->next_index - iter->index;
+@@ -409,9 +425,9 @@ radix_tree_next_slot(void **slot, struct radix_tree_iter *iter, unsigned flags)
+ 			return slot + offset + 1;
+ 		}
+ 	} else {
+-		unsigned size = radix_tree_chunk_size(iter) - 1;
++		long size = radix_tree_chunk_size(iter);
+ 
+-		while (size--) {
++		while (--size > 0) {
+ 			slot++;
+ 			iter->index++;
+ 			if (likely(*slot))
+diff --git a/include/linux/rmap.h b/include/linux/rmap.h
+index c89c53a113a8..6f48ddc4b2b5 100644
+--- a/include/linux/rmap.h
++++ b/include/linux/rmap.h
+@@ -105,20 +105,6 @@ static inline void put_anon_vma(struct anon_vma *anon_vma)
+ 		__put_anon_vma(anon_vma);
+ }
+ 
+-static inline void vma_lock_anon_vma(struct vm_area_struct *vma)
+-{
+-	struct anon_vma *anon_vma = vma->anon_vma;
+-	if (anon_vma)
+-		down_write(&anon_vma->root->rwsem);
+-}
+-
+-static inline void vma_unlock_anon_vma(struct vm_area_struct *vma)
+-{
+-	struct anon_vma *anon_vma = vma->anon_vma;
+-	if (anon_vma)
+-		up_write(&anon_vma->root->rwsem);
+-}
+-
+ static inline void anon_vma_lock_write(struct anon_vma *anon_vma)
+ {
+ 	down_write(&anon_vma->root->rwsem);
+diff --git a/include/linux/thermal.h b/include/linux/thermal.h
+index 5eac316490ea..2e7d0f7a0ecc 100644
+--- a/include/linux/thermal.h
++++ b/include/linux/thermal.h
+@@ -40,6 +40,9 @@
+ /* No upper/lower limit requirement */
+ #define THERMAL_NO_LIMIT	((u32)~0)
+ 
++/* use value, which < 0K, to indicate an invalid/uninitialized temperature */
++#define THERMAL_TEMP_INVALID	-274000
++
+ /* Unit conversion macros */
+ #define KELVIN_TO_CELSIUS(t)	(long)(((long)t-2732 >= 0) ?	\
+ 				((long)t-2732+5)/10 : ((long)t-2732-5)/10)
+@@ -159,6 +162,7 @@ struct thermal_attr {
+  * @forced_passive:	If > 0, temperature at which to switch on all ACPI
+  *			processor cooling devices.  Currently only used by the
+  *			step-wise governor.
++ * @need_update:	if equals 1, thermal_zone_device_update needs to be invoked.
+  * @ops:	operations this &thermal_zone_device supports
+  * @tzp:	thermal zone parameters
+  * @governor:	pointer to the governor for this thermal zone
+@@ -185,6 +189,7 @@ struct thermal_zone_device {
+ 	int emul_temperature;
+ 	int passive;
+ 	unsigned int forced_passive;
++	atomic_t need_update;
+ 	struct thermal_zone_device_ops *ops;
+ 	const struct thermal_zone_params *tzp;
+ 	struct thermal_governor *governor;
+diff --git a/include/sound/rawmidi.h b/include/sound/rawmidi.h
+index f6cbef78db62..3b91ad5d5115 100644
+--- a/include/sound/rawmidi.h
++++ b/include/sound/rawmidi.h
+@@ -167,6 +167,10 @@ int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
+ int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count);
+ int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream,
+ 			 unsigned char *buffer, int count);
++int __snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
++			      unsigned char *buffer, int count);
++int __snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream,
++			       int count);
+ 
+ /* main midi functions */
+ 
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 2579e407ff67..f3043db6d36f 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -2632,6 +2632,11 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ 		if (q.pi_state && (q.pi_state->owner != current)) {
+ 			spin_lock(q.lock_ptr);
+ 			ret = fixup_pi_state_owner(uaddr2, &q, current);
++			/*
++			 * Drop the reference to the pi state which
++			 * the requeue_pi() code acquired for us.
++			 */
++			free_pi_state(q.pi_state);
+ 			spin_unlock(q.lock_ptr);
+ 		}
+ 	} else {
+diff --git a/kernel/panic.c b/kernel/panic.c
+index 8136ad76e5fd..a4f7820f5930 100644
+--- a/kernel/panic.c
++++ b/kernel/panic.c
+@@ -23,6 +23,7 @@
+ #include <linux/sysrq.h>
+ #include <linux/init.h>
+ #include <linux/nmi.h>
++#include <linux/console.h>
+ 
+ #define PANIC_TIMER_STEP 100
+ #define PANIC_BLINK_SPD 18
+@@ -146,6 +147,17 @@ void panic(const char *fmt, ...)
+ 
+ 	bust_spinlocks(0);
+ 
++	/*
++	 * We may have ended up stopping the CPU holding the lock (in
++	 * smp_send_stop()) while still having some valuable data in the console
++	 * buffer.  Try to acquire the lock then release it regardless of the
++	 * result.  The release will also print the buffers out.  Locks debug
++	 * should be disabled to avoid reporting bad unlock balance when
++	 * panic() is not being callled from OOPS.
++	 */
++	debug_locks_off();
++	console_flush_on_panic();
++
+ 	if (!panic_blink)
+ 		panic_blink = no_blink;
+ 
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index bff0169e1ad8..3c1aca0c3543 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -2173,13 +2173,24 @@ void console_unlock(void)
+ 	static u64 seen_seq;
+ 	unsigned long flags;
+ 	bool wake_klogd = false;
+-	bool retry;
++	bool do_cond_resched, retry;
+ 
+ 	if (console_suspended) {
+ 		up_console_sem();
+ 		return;
+ 	}
+ 
++	/*
++	 * Console drivers are called under logbuf_lock, so
++	 * @console_may_schedule should be cleared before; however, we may
++	 * end up dumping a lot of lines, for example, if called from
++	 * console registration path, and should invoke cond_resched()
++	 * between lines if allowable.  Not doing so can cause a very long
++	 * scheduling stall on a slow console leading to RCU stall and
++	 * softlockup warnings which exacerbate the issue with more
++	 * messages practically incapacitating the system.
++	 */
++	do_cond_resched = console_may_schedule;
+ 	console_may_schedule = 0;
+ 
+ 	/* flush buffered message fragment immediately to console */
+@@ -2241,6 +2252,9 @@ skip:
+ 		call_console_drivers(level, text, len);
+ 		start_critical_timings();
+ 		local_irq_restore(flags);
++
++		if (do_cond_resched)
++			cond_resched();
+ 	}
+ 	console_locked = 0;
+ 
+@@ -2308,6 +2322,25 @@ void console_unblank(void)
+ 	console_unlock();
+ }
+ 
++/**
++ * console_flush_on_panic - flush console content on panic
++ *
++ * Immediately output all pending messages no matter what.
++ */
++void console_flush_on_panic(void)
++{
++	/*
++	 * If someone else is holding the console lock, trylock will fail
++	 * and may_schedule may be set.  Ignore and proceed to unlock so
++	 * that messages are flushed out.  As this can be called from any
++	 * context and we don't want to get preempted while flushing,
++	 * ensure may_schedule is cleared.
++	 */
++	console_trylock();
++	console_may_schedule = 0;
++	console_unlock();
++}
++
+ /*
+  * Return the console tty driver structure and its associated index
+  */
+diff --git a/kernel/seccomp.c b/kernel/seccomp.c
+index 4f44028943e6..30c682adcdeb 100644
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -317,24 +317,24 @@ static inline void seccomp_sync_threads(void)
+ 		put_seccomp_filter(thread);
+ 		smp_store_release(&thread->seccomp.filter,
+ 				  caller->seccomp.filter);
++
++		/*
++		 * Don't let an unprivileged task work around
++		 * the no_new_privs restriction by creating
++		 * a thread that sets it up, enters seccomp,
++		 * then dies.
++		 */
++		if (task_no_new_privs(caller))
++			task_set_no_new_privs(thread);
++
+ 		/*
+ 		 * Opt the other thread into seccomp if needed.
+ 		 * As threads are considered to be trust-realm
+ 		 * equivalent (see ptrace_may_access), it is safe to
+ 		 * allow one thread to transition the other.
+ 		 */
+-		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) {
+-			/*
+-			 * Don't let an unprivileged task work around
+-			 * the no_new_privs restriction by creating
+-			 * a thread that sets it up, enters seccomp,
+-			 * then dies.
+-			 */
+-			if (task_no_new_privs(caller))
+-				task_set_no_new_privs(thread);
+-
++		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
+ 			seccomp_assign_mode(thread, SECCOMP_MODE_FILTER);
+-		}
+ 	}
+ }
+ 
+diff --git a/kernel/sys.c b/kernel/sys.c
+index a4e372b798a5..25ae8d2e65e2 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1854,11 +1854,13 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data
+ 		user_auxv[AT_VECTOR_SIZE - 1] = AT_NULL;
+ 	}
+ 
+-	if (prctl_map.exe_fd != (u32)-1)
++	if (prctl_map.exe_fd != (u32)-1) {
+ 		error = prctl_set_mm_exe_file(mm, prctl_map.exe_fd);
+-	down_read(&mm->mmap_sem);
+-	if (error)
+-		goto out;
++		if (error)
++			return error;
++	}
++
++	down_write(&mm->mmap_sem);
+ 
+ 	/*
+ 	 * We don't validate if these members are pointing to
+@@ -1895,10 +1897,8 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data
+ 	if (prctl_map.auxv_size)
+ 		memcpy(mm->saved_auxv, user_auxv, sizeof(user_auxv));
+ 
+-	error = 0;
+-out:
+-	up_read(&mm->mmap_sem);
+-	return error;
++	up_write(&mm->mmap_sem);
++	return 0;
+ }
+ #endif /* CONFIG_CHECKPOINT_RESTORE */
+ 
+@@ -1930,7 +1930,7 @@ static int prctl_set_mm(int opt, unsigned long addr,
+ 
+ 	error = -EINVAL;
+ 
+-	down_read(&mm->mmap_sem);
++	down_write(&mm->mmap_sem);
+ 	vma = find_vma(mm, addr);
+ 
+ 	switch (opt) {
+@@ -2033,7 +2033,7 @@ static int prctl_set_mm(int opt, unsigned long addr,
+ 
+ 	error = 0;
+ out:
+-	up_read(&mm->mmap_sem);
++	up_write(&mm->mmap_sem);
+ 	return error;
+ }
+ 
+diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
+index ce033c7aa2e8..9cff0ab82b63 100644
+--- a/kernel/time/posix-clock.c
++++ b/kernel/time/posix-clock.c
+@@ -69,10 +69,10 @@ static ssize_t posix_clock_read(struct file *fp, char __user *buf,
+ static unsigned int posix_clock_poll(struct file *fp, poll_table *wait)
+ {
+ 	struct posix_clock *clk = get_posix_clock(fp);
+-	int result = 0;
++	unsigned int result = 0;
+ 
+ 	if (!clk)
+-		return -ENODEV;
++		return POLLERR;
+ 
+ 	if (clk->ops.poll)
+ 		result = clk->ops.poll(clk, fp, wait);
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 414d9df94724..65dbf8aee751 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -316,8 +316,7 @@ static inline s64 timekeeping_get_ns(struct tk_read_base *tkr)
+ 
+ 	delta = timekeeping_get_delta(tkr);
+ 
+-	nsec = delta * tkr->mult + tkr->xtime_nsec;
+-	nsec >>= tkr->shift;
++	nsec = (delta * tkr->mult + tkr->xtime_nsec) >> tkr->shift;
+ 
+ 	/* If arch requires, add in get_arch_timeoffset() */
+ 	return nsec + arch_gettimeoffset();
+diff --git a/lib/dma-debug.c b/lib/dma-debug.c
+index dace71fe41f7..517a568f038d 100644
+--- a/lib/dma-debug.c
++++ b/lib/dma-debug.c
+@@ -1181,7 +1181,7 @@ static inline bool overlap(void *addr, unsigned long len, void *start, void *end
+ 
+ static void check_for_illegal_area(struct device *dev, void *addr, unsigned long len)
+ {
+-	if (overlap(addr, len, _text, _etext) ||
++	if (overlap(addr, len, _stext, _etext) ||
+ 	    overlap(addr, len, __start_rodata, __end_rodata))
+ 		err_printk(dev, NULL, "DMA-API: device driver maps memory from kernel text or rodata [addr=%p] [len=%lu]\n", addr, len);
+ }
+diff --git a/lib/dump_stack.c b/lib/dump_stack.c
+index 6745c6230db3..c30d07e99dba 100644
+--- a/lib/dump_stack.c
++++ b/lib/dump_stack.c
+@@ -25,6 +25,7 @@ static atomic_t dump_lock = ATOMIC_INIT(-1);
+ 
+ asmlinkage __visible void dump_stack(void)
+ {
++	unsigned long flags;
+ 	int was_locked;
+ 	int old;
+ 	int cpu;
+@@ -33,9 +34,8 @@ asmlinkage __visible void dump_stack(void)
+ 	 * Permit this cpu to perform nested stack dumps while serialising
+ 	 * against other CPUs
+ 	 */
+-	preempt_disable();
+-
+ retry:
++	local_irq_save(flags);
+ 	cpu = smp_processor_id();
+ 	old = atomic_cmpxchg(&dump_lock, -1, cpu);
+ 	if (old == -1) {
+@@ -43,6 +43,7 @@ retry:
+ 	} else if (old == cpu) {
+ 		was_locked = 1;
+ 	} else {
++		local_irq_restore(flags);
+ 		cpu_relax();
+ 		goto retry;
+ 	}
+@@ -52,7 +53,7 @@ retry:
+ 	if (!was_locked)
+ 		atomic_set(&dump_lock, -1);
+ 
+-	preempt_enable();
++	local_irq_restore(flags);
+ }
+ #else
+ asmlinkage __visible void dump_stack(void)
+diff --git a/lib/libcrc32c.c b/lib/libcrc32c.c
+index 6a08ce7d6adc..acf9da449f81 100644
+--- a/lib/libcrc32c.c
++++ b/lib/libcrc32c.c
+@@ -74,3 +74,4 @@ module_exit(libcrc32c_mod_fini);
+ MODULE_AUTHOR("Clay Haapala <chaapala@cisco.com>");
+ MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations");
+ MODULE_LICENSE("GPL");
++MODULE_SOFTDEP("pre: crc32c");
+diff --git a/lib/radix-tree.c b/lib/radix-tree.c
+index 3d2aa27b845b..8399002aa0f0 100644
+--- a/lib/radix-tree.c
++++ b/lib/radix-tree.c
+@@ -1014,9 +1014,13 @@ radix_tree_gang_lookup(struct radix_tree_root *root, void **results,
+ 		return 0;
+ 
+ 	radix_tree_for_each_slot(slot, root, &iter, first_index) {
+-		results[ret] = indirect_to_ptr(rcu_dereference_raw(*slot));
++		results[ret] = rcu_dereference_raw(*slot);
+ 		if (!results[ret])
+ 			continue;
++		if (radix_tree_is_indirect_ptr(results[ret])) {
++			slot = radix_tree_iter_retry(&iter);
++			continue;
++		}
+ 		if (++ret == max_items)
+ 			break;
+ 	}
+@@ -1093,9 +1097,13 @@ radix_tree_gang_lookup_tag(struct radix_tree_root *root, void **results,
+ 		return 0;
+ 
+ 	radix_tree_for_each_tagged(slot, root, &iter, first_index, tag) {
+-		results[ret] = indirect_to_ptr(rcu_dereference_raw(*slot));
++		results[ret] = rcu_dereference_raw(*slot);
+ 		if (!results[ret])
+ 			continue;
++		if (radix_tree_is_indirect_ptr(results[ret])) {
++			slot = radix_tree_iter_retry(&iter);
++			continue;
++		}
+ 		if (++ret == max_items)
+ 			break;
+ 	}
+diff --git a/lib/string_helpers.c b/lib/string_helpers.c
+index c98ae818eb4e..33e79b5eea77 100644
+--- a/lib/string_helpers.c
++++ b/lib/string_helpers.c
+@@ -43,46 +43,73 @@ void string_get_size(u64 size, u64 blk_size, const enum string_size_units units,
+ 		[STRING_UNITS_10] = 1000,
+ 		[STRING_UNITS_2] = 1024,
+ 	};
+-	int i, j;
+-	u32 remainder = 0, sf_cap, exp;
++	static const unsigned int rounding[] = { 500, 50, 5 };
++	int i = 0, j;
++	u32 remainder = 0, sf_cap;
+ 	char tmp[8];
+ 	const char *unit;
+ 
+ 	tmp[0] = '\0';
+-	i = 0;
+-	if (!size)
++
++	if (blk_size == 0)
++		size = 0;
++	if (size == 0)
+ 		goto out;
+ 
+-	while (blk_size >= divisor[units]) {
+-		remainder = do_div(blk_size, divisor[units]);
++	/* This is Napier's algorithm.  Reduce the original block size to
++	 *
++	 * coefficient * divisor[units]^i
++	 *
++	 * we do the reduction so both coefficients are just under 32 bits so
++	 * that multiplying them together won't overflow 64 bits and we keep
++	 * as much precision as possible in the numbers.
++	 *
++	 * Note: it's safe to throw away the remainders here because all the
++	 * precision is in the coefficients.
++	 */
++	while (blk_size >> 32) {
++		do_div(blk_size, divisor[units]);
+ 		i++;
+ 	}
+ 
+-	exp = divisor[units] / (u32)blk_size;
+-	if (size >= exp) {
+-		remainder = do_div(size, divisor[units]);
+-		remainder *= blk_size;
++	while (size >> 32) {
++		do_div(size, divisor[units]);
+ 		i++;
+-	} else {
+-		remainder *= size;
+ 	}
+ 
++	/* now perform the actual multiplication keeping i as the sum of the
++	 * two logarithms */
+ 	size *= blk_size;
+-	size += remainder / divisor[units];
+-	remainder %= divisor[units];
+ 
++	/* and logarithmically reduce it until it's just under the divisor */
+ 	while (size >= divisor[units]) {
+ 		remainder = do_div(size, divisor[units]);
+ 		i++;
+ 	}
+ 
++	/* work out in j how many digits of precision we need from the
++	 * remainder */
+ 	sf_cap = size;
+ 	for (j = 0; sf_cap*10 < 1000; j++)
+ 		sf_cap *= 10;
+ 
+-	if (j) {
++	if (units == STRING_UNITS_2) {
++		/* express the remainder as a decimal.  It's currently the
++		 * numerator of a fraction whose denominator is
++		 * divisor[units], which is 1 << 10 for STRING_UNITS_2 */
+ 		remainder *= 1000;
+-		remainder /= divisor[units];
++		remainder >>= 10;
++	}
++
++	/* add a 5 to the digit below what will be printed to ensure
++	 * an arithmetical round up and carry it through to size */
++	remainder += rounding[j];
++	if (remainder >= 1000) {
++		remainder -= 1000;
++		size += 1;
++	}
++
++	if (j) {
+ 		snprintf(tmp, sizeof(tmp), ".%03u", remainder);
+ 		tmp[j+1] = '\0';
+ 	}
+diff --git a/mm/balloon_compaction.c b/mm/balloon_compaction.c
+index fcad8322ef36..b640609bcd17 100644
+--- a/mm/balloon_compaction.c
++++ b/mm/balloon_compaction.c
+@@ -61,6 +61,7 @@ struct page *balloon_page_dequeue(struct balloon_dev_info *b_dev_info)
+ 	bool dequeued_page;
+ 
+ 	dequeued_page = false;
++	spin_lock_irqsave(&b_dev_info->pages_lock, flags);
+ 	list_for_each_entry_safe(page, tmp, &b_dev_info->pages, lru) {
+ 		/*
+ 		 * Block others from accessing the 'page' while we get around
+@@ -75,15 +76,14 @@ struct page *balloon_page_dequeue(struct balloon_dev_info *b_dev_info)
+ 				continue;
+ 			}
+ #endif
+-			spin_lock_irqsave(&b_dev_info->pages_lock, flags);
+ 			balloon_page_delete(page);
+ 			__count_vm_event(BALLOON_DEFLATE);
+-			spin_unlock_irqrestore(&b_dev_info->pages_lock, flags);
+ 			unlock_page(page);
+ 			dequeued_page = true;
+ 			break;
+ 		}
+ 	}
++	spin_unlock_irqrestore(&b_dev_info->pages_lock, flags);
+ 
+ 	if (!dequeued_page) {
+ 		/*
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 68dea90334cb..aac1c98a9bc7 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -3824,16 +3824,17 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg,
+ swap_buffers:
+ 	/* Swap primary and spare array */
+ 	thresholds->spare = thresholds->primary;
+-	/* If all events are unregistered, free the spare array */
+-	if (!new) {
+-		kfree(thresholds->spare);
+-		thresholds->spare = NULL;
+-	}
+ 
+ 	rcu_assign_pointer(thresholds->primary, new);
+ 
+ 	/* To be sure that nobody uses thresholds */
+ 	synchronize_rcu();
++
++	/* If all events are unregistered, free the spare array */
++	if (!new) {
++		kfree(thresholds->spare);
++		thresholds->spare = NULL;
++	}
+ unlock:
+ 	mutex_unlock(&memcg->thresholds_lock);
+ }
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 9f48145c884f..e26bc59d7dff 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1557,7 +1557,7 @@ static int get_any_page(struct page *page, unsigned long pfn, int flags)
+ 		 * Did it turn free?
+ 		 */
+ 		ret = __get_any_page(page, pfn, 0);
+-		if (!PageLRU(page)) {
++		if (ret == 1 && !PageLRU(page)) {
+ 			/* Drop page reference which is from __get_any_page() */
+ 			put_page(page);
+ 			pr_info("soft_offline: %#lx: unknown non LRU page type %lx\n",
+diff --git a/mm/mlock.c b/mm/mlock.c
+index 6fd2cf15e868..3d3ee6cad776 100644
+--- a/mm/mlock.c
++++ b/mm/mlock.c
+@@ -172,7 +172,7 @@ static void __munlock_isolation_failed(struct page *page)
+  */
+ unsigned int munlock_vma_page(struct page *page)
+ {
+-	unsigned int nr_pages;
++	int nr_pages;
+ 	struct zone *zone = page_zone(page);
+ 
+ 	/* For try_to_munlock() and to serialize with page migration */
+diff --git a/mm/mmap.c b/mm/mmap.c
+index bb50cacc3ea5..b639fa2721d8 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -440,12 +440,16 @@ static void validate_mm(struct mm_struct *mm)
+ 	struct vm_area_struct *vma = mm->mmap;
+ 
+ 	while (vma) {
++		struct anon_vma *anon_vma = vma->anon_vma;
+ 		struct anon_vma_chain *avc;
+ 
+-		vma_lock_anon_vma(vma);
+-		list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
+-			anon_vma_interval_tree_verify(avc);
+-		vma_unlock_anon_vma(vma);
++		if (anon_vma) {
++			anon_vma_lock_read(anon_vma);
++			list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
++				anon_vma_interval_tree_verify(avc);
++			anon_vma_unlock_read(anon_vma);
++		}
++
+ 		highest_address = vma->vm_end;
+ 		vma = vma->vm_next;
+ 		i++;
+@@ -2141,32 +2145,27 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+  */
+ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+ {
+-	int error;
++	int error = 0;
+ 
+ 	if (!(vma->vm_flags & VM_GROWSUP))
+ 		return -EFAULT;
+ 
+-	/*
+-	 * We must make sure the anon_vma is allocated
+-	 * so that the anon_vma locking is not a noop.
+-	 */
++	/* Guard against wrapping around to address 0. */
++	if (address < PAGE_ALIGN(address+4))
++		address = PAGE_ALIGN(address+4);
++	else
++		return -ENOMEM;
++
++	/* We must make sure the anon_vma is allocated. */
+ 	if (unlikely(anon_vma_prepare(vma)))
+ 		return -ENOMEM;
+-	vma_lock_anon_vma(vma);
+ 
+ 	/*
+ 	 * vma->vm_start/vm_end cannot change under us because the caller
+ 	 * is required to hold the mmap_sem in read mode.  We need the
+ 	 * anon_vma lock to serialize against concurrent expand_stacks.
+-	 * Also guard against wrapping around to address 0.
+ 	 */
+-	if (address < PAGE_ALIGN(address+4))
+-		address = PAGE_ALIGN(address+4);
+-	else {
+-		vma_unlock_anon_vma(vma);
+-		return -ENOMEM;
+-	}
+-	error = 0;
++	anon_vma_lock_write(vma->anon_vma);
+ 
+ 	/* Somebody else might have raced and expanded it already */
+ 	if (address > vma->vm_end) {
+@@ -2184,7 +2183,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+ 				 * updates, but we only hold a shared mmap_sem
+ 				 * lock here, so we need to protect against
+ 				 * concurrent vma expansions.
+-				 * vma_lock_anon_vma() doesn't help here, as
++				 * anon_vma_lock_write() doesn't help here, as
+ 				 * we don't guarantee that all growable vmas
+ 				 * in a mm share the same root anon vma.
+ 				 * So, we reuse mm->page_table_lock to guard
+@@ -2204,7 +2203,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+ 			}
+ 		}
+ 	}
+-	vma_unlock_anon_vma(vma);
++	anon_vma_unlock_write(vma->anon_vma);
+ 	khugepaged_enter_vma_merge(vma, vma->vm_flags);
+ 	validate_mm(vma->vm_mm);
+ 	return error;
+@@ -2219,25 +2218,21 @@ int expand_downwards(struct vm_area_struct *vma,
+ {
+ 	int error;
+ 
+-	/*
+-	 * We must make sure the anon_vma is allocated
+-	 * so that the anon_vma locking is not a noop.
+-	 */
+-	if (unlikely(anon_vma_prepare(vma)))
+-		return -ENOMEM;
+-
+ 	address &= PAGE_MASK;
+ 	error = security_mmap_addr(address);
+ 	if (error)
+ 		return error;
+ 
+-	vma_lock_anon_vma(vma);
++	/* We must make sure the anon_vma is allocated. */
++	if (unlikely(anon_vma_prepare(vma)))
++		return -ENOMEM;
+ 
+ 	/*
+ 	 * vma->vm_start/vm_end cannot change under us because the caller
+ 	 * is required to hold the mmap_sem in read mode.  We need the
+ 	 * anon_vma lock to serialize against concurrent expand_stacks.
+ 	 */
++	anon_vma_lock_write(vma->anon_vma);
+ 
+ 	/* Somebody else might have raced and expanded it already */
+ 	if (address < vma->vm_start) {
+@@ -2255,7 +2250,7 @@ int expand_downwards(struct vm_area_struct *vma,
+ 				 * updates, but we only hold a shared mmap_sem
+ 				 * lock here, so we need to protect against
+ 				 * concurrent vma expansions.
+-				 * vma_lock_anon_vma() doesn't help here, as
++				 * anon_vma_lock_write() doesn't help here, as
+ 				 * we don't guarantee that all growable vmas
+ 				 * in a mm share the same root anon vma.
+ 				 * So, we reuse mm->page_table_lock to guard
+@@ -2273,7 +2268,7 @@ int expand_downwards(struct vm_area_struct *vma,
+ 			}
+ 		}
+ 	}
+-	vma_unlock_anon_vma(vma);
++	anon_vma_unlock_write(vma->anon_vma);
+ 	khugepaged_enter_vma_merge(vma, vma->vm_flags);
+ 	validate_mm(vma->vm_mm);
+ 	return error;
+diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
+index a8b5e749e84e..fb1ec10ce449 100644
+--- a/mm/zsmalloc.c
++++ b/mm/zsmalloc.c
+@@ -306,7 +306,12 @@ static void free_handle(struct zs_pool *pool, unsigned long handle)
+ 
+ static void record_obj(unsigned long handle, unsigned long obj)
+ {
+-	*(unsigned long *)handle = obj;
++	/*
++	 * lsb of @obj represents handle lock while other bits
++	 * represent object value the handle is pointing so
++	 * updating shouldn't do store tearing.
++	 */
++	WRITE_ONCE(*(unsigned long *)handle, obj);
+ }
+ 
+ /* zpool driver */
+@@ -1641,6 +1646,13 @@ static int migrate_zspage(struct zs_pool *pool, struct size_class *class,
+ 		free_obj = obj_malloc(d_page, class, handle);
+ 		zs_object_copy(used_obj, free_obj, class);
+ 		index++;
++		/*
++		 * record_obj updates handle's value to free_obj and it will
++		 * invalidate lock bit(ie, HANDLE_PIN_BIT) of handle, which
++		 * breaks synchronization using pin_tag(e,g, zs_free) so
++		 * let's keep the lock bit.
++		 */
++		free_obj |= BIT(HANDLE_PIN_BIT);
+ 		record_obj(handle, free_obj);
+ 		unpin_tag(handle);
+ 		obj_free(pool, class, used_obj);
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index 967080a9f043..e51af69c61bf 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -675,6 +675,8 @@ static void reset_connection(struct ceph_connection *con)
+ 	}
+ 	con->in_seq = 0;
+ 	con->in_seq_acked = 0;
++
++	con->out_skip = 0;
+ }
+ 
+ /*
+@@ -774,6 +776,8 @@ static u32 get_global_seq(struct ceph_messenger *msgr, u32 gt)
+ 
+ static void con_out_kvec_reset(struct ceph_connection *con)
+ {
++	BUG_ON(con->out_skip);
++
+ 	con->out_kvec_left = 0;
+ 	con->out_kvec_bytes = 0;
+ 	con->out_kvec_cur = &con->out_kvec[0];
+@@ -782,9 +786,9 @@ static void con_out_kvec_reset(struct ceph_connection *con)
+ static void con_out_kvec_add(struct ceph_connection *con,
+ 				size_t size, void *data)
+ {
+-	int index;
++	int index = con->out_kvec_left;
+ 
+-	index = con->out_kvec_left;
++	BUG_ON(con->out_skip);
+ 	BUG_ON(index >= ARRAY_SIZE(con->out_kvec));
+ 
+ 	con->out_kvec[index].iov_len = size;
+@@ -793,6 +797,27 @@ static void con_out_kvec_add(struct ceph_connection *con,
+ 	con->out_kvec_bytes += size;
+ }
+ 
++/*
++ * Chop off a kvec from the end.  Return residual number of bytes for
++ * that kvec, i.e. how many bytes would have been written if the kvec
++ * hadn't been nuked.
++ */
++static int con_out_kvec_skip(struct ceph_connection *con)
++{
++	int off = con->out_kvec_cur - con->out_kvec;
++	int skip = 0;
++
++	if (con->out_kvec_bytes > 0) {
++		skip = con->out_kvec[off + con->out_kvec_left - 1].iov_len;
++		BUG_ON(con->out_kvec_bytes < skip);
++		BUG_ON(!con->out_kvec_left);
++		con->out_kvec_bytes -= skip;
++		con->out_kvec_left--;
++	}
++
++	return skip;
++}
++
+ #ifdef CONFIG_BLOCK
+ 
+ /*
+@@ -1200,7 +1225,6 @@ static void prepare_write_message_footer(struct ceph_connection *con)
+ 	m->footer.flags |= CEPH_MSG_FOOTER_COMPLETE;
+ 
+ 	dout("prepare_write_message_footer %p\n", con);
+-	con->out_kvec_is_msg = true;
+ 	con->out_kvec[v].iov_base = &m->footer;
+ 	if (con->peer_features & CEPH_FEATURE_MSG_AUTH) {
+ 		if (con->ops->sign_message)
+@@ -1228,7 +1252,6 @@ static void prepare_write_message(struct ceph_connection *con)
+ 	u32 crc;
+ 
+ 	con_out_kvec_reset(con);
+-	con->out_kvec_is_msg = true;
+ 	con->out_msg_done = false;
+ 
+ 	/* Sneak an ack in there first?  If we can get it into the same
+@@ -1268,18 +1291,19 @@ static void prepare_write_message(struct ceph_connection *con)
+ 
+ 	/* tag + hdr + front + middle */
+ 	con_out_kvec_add(con, sizeof (tag_msg), &tag_msg);
+-	con_out_kvec_add(con, sizeof (m->hdr), &m->hdr);
++	con_out_kvec_add(con, sizeof(con->out_hdr), &con->out_hdr);
+ 	con_out_kvec_add(con, m->front.iov_len, m->front.iov_base);
+ 
+ 	if (m->middle)
+ 		con_out_kvec_add(con, m->middle->vec.iov_len,
+ 			m->middle->vec.iov_base);
+ 
+-	/* fill in crc (except data pages), footer */
++	/* fill in hdr crc and finalize hdr */
+ 	crc = crc32c(0, &m->hdr, offsetof(struct ceph_msg_header, crc));
+ 	con->out_msg->hdr.crc = cpu_to_le32(crc);
+-	con->out_msg->footer.flags = 0;
++	memcpy(&con->out_hdr, &con->out_msg->hdr, sizeof(con->out_hdr));
+ 
++	/* fill in front and middle crc, footer */
+ 	crc = crc32c(0, m->front.iov_base, m->front.iov_len);
+ 	con->out_msg->footer.front_crc = cpu_to_le32(crc);
+ 	if (m->middle) {
+@@ -1291,6 +1315,7 @@ static void prepare_write_message(struct ceph_connection *con)
+ 	dout("%s front_crc %u middle_crc %u\n", __func__,
+ 	     le32_to_cpu(con->out_msg->footer.front_crc),
+ 	     le32_to_cpu(con->out_msg->footer.middle_crc));
++	con->out_msg->footer.flags = 0;
+ 
+ 	/* is there a data payload? */
+ 	con->out_msg->footer.data_crc = 0;
+@@ -1485,7 +1510,6 @@ static int write_partial_kvec(struct ceph_connection *con)
+ 		}
+ 	}
+ 	con->out_kvec_left = 0;
+-	con->out_kvec_is_msg = false;
+ 	ret = 1;
+ out:
+ 	dout("write_partial_kvec %p %d left in %d kvecs ret = %d\n", con,
+@@ -1577,6 +1601,7 @@ static int write_partial_skip(struct ceph_connection *con)
+ {
+ 	int ret;
+ 
++	dout("%s %p %d left\n", __func__, con, con->out_skip);
+ 	while (con->out_skip > 0) {
+ 		size_t size = min(con->out_skip, (int) PAGE_CACHE_SIZE);
+ 
+@@ -2493,13 +2518,13 @@ more:
+ 
+ more_kvec:
+ 	/* kvec data queued? */
+-	if (con->out_skip) {
+-		ret = write_partial_skip(con);
++	if (con->out_kvec_left) {
++		ret = write_partial_kvec(con);
+ 		if (ret <= 0)
+ 			goto out;
+ 	}
+-	if (con->out_kvec_left) {
+-		ret = write_partial_kvec(con);
++	if (con->out_skip) {
++		ret = write_partial_skip(con);
+ 		if (ret <= 0)
+ 			goto out;
+ 	}
+@@ -3026,16 +3051,31 @@ void ceph_msg_revoke(struct ceph_msg *msg)
+ 		ceph_msg_put(msg);
+ 	}
+ 	if (con->out_msg == msg) {
+-		dout("%s %p msg %p - was sending\n", __func__, con, msg);
+-		con->out_msg = NULL;
+-		if (con->out_kvec_is_msg) {
+-			con->out_skip = con->out_kvec_bytes;
+-			con->out_kvec_is_msg = false;
++		BUG_ON(con->out_skip);
++		/* footer */
++		if (con->out_msg_done) {
++			con->out_skip += con_out_kvec_skip(con);
++		} else {
++			BUG_ON(!msg->data_length);
++			if (con->peer_features & CEPH_FEATURE_MSG_AUTH)
++				con->out_skip += sizeof(msg->footer);
++			else
++				con->out_skip += sizeof(msg->old_footer);
+ 		}
++		/* data, middle, front */
++		if (msg->data_length)
++			con->out_skip += msg->cursor.total_resid;
++		if (msg->middle)
++			con->out_skip += con_out_kvec_skip(con);
++		con->out_skip += con_out_kvec_skip(con);
++
++		dout("%s %p msg %p - was sending, will write %d skip %d\n",
++		     __func__, con, msg, con->out_kvec_bytes, con->out_skip);
+ 		msg->hdr.seq = 0;
+-
++		con->out_msg = NULL;
+ 		ceph_msg_put(msg);
+ 	}
++
+ 	mutex_unlock(&con->mutex);
+ }
+ 
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index a9c9d961f039..41adfc898a18 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -1727,7 +1727,6 @@ void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
+ 		if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
+ 			continue;
+ 		sdata->u.ibss.last_scan_completed = jiffies;
+-		ieee80211_queue_work(&local->hw, &sdata->work);
+ 	}
+ 	mutex_unlock(&local->iflist_mtx);
+ }
+diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
+index 817098add1d6..afcc67a157fd 100644
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -1299,17 +1299,6 @@ out:
+ 	sdata_unlock(sdata);
+ }
+ 
+-void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
+-{
+-	struct ieee80211_sub_if_data *sdata;
+-
+-	rcu_read_lock();
+-	list_for_each_entry_rcu(sdata, &local->interfaces, list)
+-		if (ieee80211_vif_is_mesh(&sdata->vif) &&
+-		    ieee80211_sdata_running(sdata))
+-			ieee80211_queue_work(&local->hw, &sdata->work);
+-	rcu_read_unlock();
+-}
+ 
+ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
+ {
+diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
+index 50c8473cf9dc..472bdc73e950 100644
+--- a/net/mac80211/mesh.h
++++ b/net/mac80211/mesh.h
+@@ -358,14 +358,10 @@ static inline bool mesh_path_sel_is_hwmp(struct ieee80211_sub_if_data *sdata)
+ 	return sdata->u.mesh.mesh_pp_id == IEEE80211_PATH_PROTOCOL_HWMP;
+ }
+ 
+-void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local);
+-
+ void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata);
+ void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata);
+ void ieee80211s_stop(void);
+ #else
+-static inline void
+-ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local) {}
+ static inline bool mesh_path_sel_is_hwmp(struct ieee80211_sub_if_data *sdata)
+ { return false; }
+ static inline void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata)
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index a93906103f8b..844825829992 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -4002,8 +4002,6 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
+ 		if (!(flags & IEEE80211_HW_CONNECTION_MONITOR))
+ 			ieee80211_queue_work(&sdata->local->hw,
+ 					     &sdata->u.mgd.monitor_work);
+-		/* and do all the other regular work too */
+-		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+ 	}
+ }
+ 
+diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
+index 7bb6a9383f58..ee9351affa5b 100644
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -310,6 +310,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
+ 	bool was_scanning = local->scanning;
+ 	struct cfg80211_scan_request *scan_req;
+ 	struct ieee80211_sub_if_data *scan_sdata;
++	struct ieee80211_sub_if_data *sdata;
+ 
+ 	lockdep_assert_held(&local->mtx);
+ 
+@@ -369,7 +370,16 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
+ 
+ 	ieee80211_mlme_notify_scan_completed(local);
+ 	ieee80211_ibss_notify_scan_completed(local);
+-	ieee80211_mesh_notify_scan_completed(local);
++
++	/* Requeue all the work that might have been ignored while
++	 * the scan was in progress; if there was none this will
++	 * just be a no-op for the particular interface.
++	 */
++	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
++		if (ieee80211_sdata_running(sdata))
++			ieee80211_queue_work(&sdata->local->hw, &sdata->work);
++	}
++
+ 	if (was_scanning)
+ 		ieee80211_start_next_roc(local);
+ }
+diff --git a/net/rfkill/core.c b/net/rfkill/core.c
+index fa7cd792791c..a97bb7332607 100644
+--- a/net/rfkill/core.c
++++ b/net/rfkill/core.c
+@@ -1081,17 +1081,6 @@ static unsigned int rfkill_fop_poll(struct file *file, poll_table *wait)
+ 	return res;
+ }
+ 
+-static bool rfkill_readable(struct rfkill_data *data)
+-{
+-	bool r;
+-
+-	mutex_lock(&data->mtx);
+-	r = !list_empty(&data->events);
+-	mutex_unlock(&data->mtx);
+-
+-	return r;
+-}
+-
+ static ssize_t rfkill_fop_read(struct file *file, char __user *buf,
+ 			       size_t count, loff_t *pos)
+ {
+@@ -1108,8 +1097,11 @@ static ssize_t rfkill_fop_read(struct file *file, char __user *buf,
+ 			goto out;
+ 		}
+ 		mutex_unlock(&data->mtx);
++		/* since we re-check and it just compares pointers,
++		 * using !list_empty() without locking isn't a problem
++		 */
+ 		ret = wait_event_interruptible(data->read_wait,
+-					       rfkill_readable(data));
++					       !list_empty(&data->events));
+ 		mutex_lock(&data->mtx);
+ 
+ 		if (ret)
+diff --git a/scripts/bloat-o-meter b/scripts/bloat-o-meter
+index 23e78dcd12bf..38b64f487315 100755
+--- a/scripts/bloat-o-meter
++++ b/scripts/bloat-o-meter
+@@ -58,8 +58,8 @@ for name in common:
+ delta.sort()
+ delta.reverse()
+ 
+-print "add/remove: %s/%s grow/shrink: %s/%s up/down: %s/%s (%s)" % \
+-      (add, remove, grow, shrink, up, -down, up-down)
+-print "%-40s %7s %7s %+7s" % ("function", "old", "new", "delta")
++print("add/remove: %s/%s grow/shrink: %s/%s up/down: %s/%s (%s)" % \
++      (add, remove, grow, shrink, up, -down, up-down))
++print("%-40s %7s %7s %+7s" % ("function", "old", "new", "delta"))
+ for d, n in delta:
+-    if d: print "%-40s %7s %7s %+7d" % (n, old.get(n,"-"), new.get(n,"-"), d)
++    if d: print("%-40s %7s %7s %+7d" % (n, old.get(n,"-"), new.get(n,"-"), d))
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index b123c42e7dc8..b554d7f9e3be 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -44,6 +44,13 @@
+ #include <sound/compress_offload.h>
+ #include <sound/compress_driver.h>
+ 
++/* struct snd_compr_codec_caps overflows the ioctl bit size for some
++ * architectures, so we need to disable the relevant ioctls.
++ */
++#if _IOC_SIZEBITS < 14
++#define COMPR_CODEC_CAPS_OVERFLOW
++#endif
++
+ /* TODO:
+  * - add substream support for multiple devices in case of
+  *	SND_DYNAMIC_MINORS is not used
+@@ -438,6 +445,7 @@ out:
+ 	return retval;
+ }
+ 
++#ifndef COMPR_CODEC_CAPS_OVERFLOW
+ static int
+ snd_compr_get_codec_caps(struct snd_compr_stream *stream, unsigned long arg)
+ {
+@@ -461,6 +469,7 @@ out:
+ 	kfree(caps);
+ 	return retval;
+ }
++#endif /* !COMPR_CODEC_CAPS_OVERFLOW */
+ 
+ /* revisit this with snd_pcm_preallocate_xxx */
+ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
+@@ -799,9 +808,11 @@ static long snd_compr_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+ 	case _IOC_NR(SNDRV_COMPRESS_GET_CAPS):
+ 		retval = snd_compr_get_caps(stream, arg);
+ 		break;
++#ifndef COMPR_CODEC_CAPS_OVERFLOW
+ 	case _IOC_NR(SNDRV_COMPRESS_GET_CODEC_CAPS):
+ 		retval = snd_compr_get_codec_caps(stream, arg);
+ 		break;
++#endif
+ 	case _IOC_NR(SNDRV_COMPRESS_SET_PARAMS):
+ 		retval = snd_compr_set_params(stream, arg);
+ 		break;
+diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
+index 58550cc93f28..33e72c809e50 100644
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -834,7 +834,8 @@ static int choose_rate(struct snd_pcm_substream *substream,
+ 	return snd_pcm_hw_param_near(substream, params, SNDRV_PCM_HW_PARAM_RATE, best_rate, NULL);
+ }
+ 
+-static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream)
++static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream,
++				     bool trylock)
+ {
+ 	struct snd_pcm_runtime *runtime = substream->runtime;
+ 	struct snd_pcm_hw_params *params, *sparams;
+@@ -848,7 +849,10 @@ static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream)
+ 	struct snd_mask sformat_mask;
+ 	struct snd_mask mask;
+ 
+-	if (mutex_lock_interruptible(&runtime->oss.params_lock))
++	if (trylock) {
++		if (!(mutex_trylock(&runtime->oss.params_lock)))
++			return -EAGAIN;
++	} else if (mutex_lock_interruptible(&runtime->oss.params_lock))
+ 		return -EINTR;
+ 	sw_params = kmalloc(sizeof(*sw_params), GFP_KERNEL);
+ 	params = kmalloc(sizeof(*params), GFP_KERNEL);
+@@ -1092,7 +1096,7 @@ static int snd_pcm_oss_get_active_substream(struct snd_pcm_oss_file *pcm_oss_fil
+ 		if (asubstream == NULL)
+ 			asubstream = substream;
+ 		if (substream->runtime->oss.params) {
+-			err = snd_pcm_oss_change_params(substream);
++			err = snd_pcm_oss_change_params(substream, false);
+ 			if (err < 0)
+ 				return err;
+ 		}
+@@ -1132,7 +1136,7 @@ static int snd_pcm_oss_make_ready(struct snd_pcm_substream *substream)
+ 		return 0;
+ 	runtime = substream->runtime;
+ 	if (runtime->oss.params) {
+-		err = snd_pcm_oss_change_params(substream);
++		err = snd_pcm_oss_change_params(substream, false);
+ 		if (err < 0)
+ 			return err;
+ 	}
+@@ -2163,7 +2167,7 @@ static int snd_pcm_oss_get_space(struct snd_pcm_oss_file *pcm_oss_file, int stre
+ 	runtime = substream->runtime;
+ 
+ 	if (runtime->oss.params &&
+-	    (err = snd_pcm_oss_change_params(substream)) < 0)
++	    (err = snd_pcm_oss_change_params(substream, false)) < 0)
+ 		return err;
+ 
+ 	info.fragsize = runtime->oss.period_bytes;
+@@ -2800,7 +2804,12 @@ static int snd_pcm_oss_mmap(struct file *file, struct vm_area_struct *area)
+ 		return -EIO;
+ 	
+ 	if (runtime->oss.params) {
+-		if ((err = snd_pcm_oss_change_params(substream)) < 0)
++		/* use mutex_trylock() for params_lock for avoiding a deadlock
++		 * between mmap_sem and params_lock taken by
++		 * copy_from/to_user() in snd_pcm_oss_write/read()
++		 */
++		err = snd_pcm_oss_change_params(substream, true);
++		if (err < 0)
+ 			return err;
+ 	}
+ #ifdef CONFIG_SND_PCM_OSS_PLUGINS
+diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
+index a7759846fbaa..795437b10082 100644
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -942,31 +942,36 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream,
+ 	unsigned long flags;
+ 	long result = 0, count1;
+ 	struct snd_rawmidi_runtime *runtime = substream->runtime;
++	unsigned long appl_ptr;
+ 
++	spin_lock_irqsave(&runtime->lock, flags);
+ 	while (count > 0 && runtime->avail) {
+ 		count1 = runtime->buffer_size - runtime->appl_ptr;
+ 		if (count1 > count)
+ 			count1 = count;
+-		spin_lock_irqsave(&runtime->lock, flags);
+ 		if (count1 > (int)runtime->avail)
+ 			count1 = runtime->avail;
++
++		/* update runtime->appl_ptr before unlocking for userbuf */
++		appl_ptr = runtime->appl_ptr;
++		runtime->appl_ptr += count1;
++		runtime->appl_ptr %= runtime->buffer_size;
++		runtime->avail -= count1;
++
+ 		if (kernelbuf)
+-			memcpy(kernelbuf + result, runtime->buffer + runtime->appl_ptr, count1);
++			memcpy(kernelbuf + result, runtime->buffer + appl_ptr, count1);
+ 		if (userbuf) {
+ 			spin_unlock_irqrestore(&runtime->lock, flags);
+ 			if (copy_to_user(userbuf + result,
+-					 runtime->buffer + runtime->appl_ptr, count1)) {
++					 runtime->buffer + appl_ptr, count1)) {
+ 				return result > 0 ? result : -EFAULT;
+ 			}
+ 			spin_lock_irqsave(&runtime->lock, flags);
+ 		}
+-		runtime->appl_ptr += count1;
+-		runtime->appl_ptr %= runtime->buffer_size;
+-		runtime->avail -= count1;
+-		spin_unlock_irqrestore(&runtime->lock, flags);
+ 		result += count1;
+ 		count -= count1;
+ 	}
++	spin_unlock_irqrestore(&runtime->lock, flags);
+ 	return result;
+ }
+ 
+@@ -1055,23 +1060,16 @@ int snd_rawmidi_transmit_empty(struct snd_rawmidi_substream *substream)
+ EXPORT_SYMBOL(snd_rawmidi_transmit_empty);
+ 
+ /**
+- * snd_rawmidi_transmit_peek - copy data from the internal buffer
++ * __snd_rawmidi_transmit_peek - copy data from the internal buffer
+  * @substream: the rawmidi substream
+  * @buffer: the buffer pointer
+  * @count: data size to transfer
+  *
+- * Copies data from the internal output buffer to the given buffer.
+- *
+- * Call this in the interrupt handler when the midi output is ready,
+- * and call snd_rawmidi_transmit_ack() after the transmission is
+- * finished.
+- *
+- * Return: The size of copied data, or a negative error code on failure.
++ * This is a variant of snd_rawmidi_transmit_peek() without spinlock.
+  */
+-int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
++int __snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
+ 			      unsigned char *buffer, int count)
+ {
+-	unsigned long flags;
+ 	int result, count1;
+ 	struct snd_rawmidi_runtime *runtime = substream->runtime;
+ 
+@@ -1081,7 +1079,6 @@ int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
+ 		return -EINVAL;
+ 	}
+ 	result = 0;
+-	spin_lock_irqsave(&runtime->lock, flags);
+ 	if (runtime->avail >= runtime->buffer_size) {
+ 		/* warning: lowlevel layer MUST trigger down the hardware */
+ 		goto __skip;
+@@ -1106,25 +1103,47 @@ int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
+ 		}
+ 	}
+       __skip:
++	return result;
++}
++EXPORT_SYMBOL(__snd_rawmidi_transmit_peek);
++
++/**
++ * snd_rawmidi_transmit_peek - copy data from the internal buffer
++ * @substream: the rawmidi substream
++ * @buffer: the buffer pointer
++ * @count: data size to transfer
++ *
++ * Copies data from the internal output buffer to the given buffer.
++ *
++ * Call this in the interrupt handler when the midi output is ready,
++ * and call snd_rawmidi_transmit_ack() after the transmission is
++ * finished.
++ *
++ * Return: The size of copied data, or a negative error code on failure.
++ */
++int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
++			      unsigned char *buffer, int count)
++{
++	struct snd_rawmidi_runtime *runtime = substream->runtime;
++	int result;
++	unsigned long flags;
++
++	spin_lock_irqsave(&runtime->lock, flags);
++	result = __snd_rawmidi_transmit_peek(substream, buffer, count);
+ 	spin_unlock_irqrestore(&runtime->lock, flags);
+ 	return result;
+ }
+ EXPORT_SYMBOL(snd_rawmidi_transmit_peek);
+ 
+ /**
+- * snd_rawmidi_transmit_ack - acknowledge the transmission
++ * __snd_rawmidi_transmit_ack - acknowledge the transmission
+  * @substream: the rawmidi substream
+  * @count: the transferred count
+  *
+- * Advances the hardware pointer for the internal output buffer with
+- * the given size and updates the condition.
+- * Call after the transmission is finished.
+- *
+- * Return: The advanced size if successful, or a negative error code on failure.
++ * This is a variant of __snd_rawmidi_transmit_ack() without spinlock.
+  */
+-int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
++int __snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
+ {
+-	unsigned long flags;
+ 	struct snd_rawmidi_runtime *runtime = substream->runtime;
+ 
+ 	if (runtime->buffer == NULL) {
+@@ -1132,7 +1151,6 @@ int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
+ 			  "snd_rawmidi_transmit_ack: output is not active!!!\n");
+ 		return -EINVAL;
+ 	}
+-	spin_lock_irqsave(&runtime->lock, flags);
+ 	snd_BUG_ON(runtime->avail + count > runtime->buffer_size);
+ 	runtime->hw_ptr += count;
+ 	runtime->hw_ptr %= runtime->buffer_size;
+@@ -1142,9 +1160,32 @@ int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
+ 		if (runtime->drain || snd_rawmidi_ready(substream))
+ 			wake_up(&runtime->sleep);
+ 	}
+-	spin_unlock_irqrestore(&runtime->lock, flags);
+ 	return count;
+ }
++EXPORT_SYMBOL(__snd_rawmidi_transmit_ack);
++
++/**
++ * snd_rawmidi_transmit_ack - acknowledge the transmission
++ * @substream: the rawmidi substream
++ * @count: the transferred count
++ *
++ * Advances the hardware pointer for the internal output buffer with
++ * the given size and updates the condition.
++ * Call after the transmission is finished.
++ *
++ * Return: The advanced size if successful, or a negative error code on failure.
++ */
++int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
++{
++	struct snd_rawmidi_runtime *runtime = substream->runtime;
++	int result;
++	unsigned long flags;
++
++	spin_lock_irqsave(&runtime->lock, flags);
++	result = __snd_rawmidi_transmit_ack(substream, count);
++	spin_unlock_irqrestore(&runtime->lock, flags);
++	return result;
++}
+ EXPORT_SYMBOL(snd_rawmidi_transmit_ack);
+ 
+ /**
+@@ -1160,12 +1201,22 @@ EXPORT_SYMBOL(snd_rawmidi_transmit_ack);
+ int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream,
+ 			 unsigned char *buffer, int count)
+ {
++	struct snd_rawmidi_runtime *runtime = substream->runtime;
++	int result;
++	unsigned long flags;
++
++	spin_lock_irqsave(&runtime->lock, flags);
+ 	if (!substream->opened)
+-		return -EBADFD;
+-	count = snd_rawmidi_transmit_peek(substream, buffer, count);
+-	if (count < 0)
+-		return count;
+-	return snd_rawmidi_transmit_ack(substream, count);
++		result = -EBADFD;
++	else {
++		count = __snd_rawmidi_transmit_peek(substream, buffer, count);
++		if (count <= 0)
++			result = count;
++		else
++			result = __snd_rawmidi_transmit_ack(substream, count);
++	}
++	spin_unlock_irqrestore(&runtime->lock, flags);
++	return result;
+ }
+ EXPORT_SYMBOL(snd_rawmidi_transmit);
+ 
+@@ -1177,8 +1228,9 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
+ 	unsigned long flags;
+ 	long count1, result;
+ 	struct snd_rawmidi_runtime *runtime = substream->runtime;
++	unsigned long appl_ptr;
+ 
+-	if (snd_BUG_ON(!kernelbuf && !userbuf))
++	if (!kernelbuf && !userbuf)
+ 		return -EINVAL;
+ 	if (snd_BUG_ON(!runtime->buffer))
+ 		return -EINVAL;
+@@ -1197,12 +1249,19 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
+ 			count1 = count;
+ 		if (count1 > (long)runtime->avail)
+ 			count1 = runtime->avail;
++
++		/* update runtime->appl_ptr before unlocking for userbuf */
++		appl_ptr = runtime->appl_ptr;
++		runtime->appl_ptr += count1;
++		runtime->appl_ptr %= runtime->buffer_size;
++		runtime->avail -= count1;
++
+ 		if (kernelbuf)
+-			memcpy(runtime->buffer + runtime->appl_ptr,
++			memcpy(runtime->buffer + appl_ptr,
+ 			       kernelbuf + result, count1);
+ 		else if (userbuf) {
+ 			spin_unlock_irqrestore(&runtime->lock, flags);
+-			if (copy_from_user(runtime->buffer + runtime->appl_ptr,
++			if (copy_from_user(runtime->buffer + appl_ptr,
+ 					   userbuf + result, count1)) {
+ 				spin_lock_irqsave(&runtime->lock, flags);
+ 				result = result > 0 ? result : -EFAULT;
+@@ -1210,9 +1269,6 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
+ 			}
+ 			spin_lock_irqsave(&runtime->lock, flags);
+ 		}
+-		runtime->appl_ptr += count1;
+-		runtime->appl_ptr %= runtime->buffer_size;
+-		runtime->avail -= count1;
+ 		result += count1;
+ 		count -= count1;
+ 	}
+diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c
+index 2de3feff70d0..dad5b1123e46 100644
+--- a/sound/core/seq/oss/seq_oss_init.c
++++ b/sound/core/seq/oss/seq_oss_init.c
+@@ -202,7 +202,7 @@ snd_seq_oss_open(struct file *file, int level)
+ 
+ 	dp->index = i;
+ 	if (i >= SNDRV_SEQ_OSS_MAX_CLIENTS) {
+-		pr_err("ALSA: seq_oss: too many applications\n");
++		pr_debug("ALSA: seq_oss: too many applications\n");
+ 		rc = -ENOMEM;
+ 		goto _error;
+ 	}
+diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
+index 48e4fe1b68ab..f38cf91b4faf 100644
+--- a/sound/core/seq/oss/seq_oss_synth.c
++++ b/sound/core/seq/oss/seq_oss_synth.c
+@@ -308,7 +308,7 @@ snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp)
+ 	struct seq_oss_synth *rec;
+ 	struct seq_oss_synthinfo *info;
+ 
+-	if (snd_BUG_ON(dp->max_synthdev >= SNDRV_SEQ_OSS_MAX_SYNTH_DEVS))
++	if (snd_BUG_ON(dp->max_synthdev > SNDRV_SEQ_OSS_MAX_SYNTH_DEVS))
+ 		return;
+ 	for (i = 0; i < dp->max_synthdev; i++) {
+ 		info = &dp->synths[i];
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index bd4741442909..ce6703ecfcef 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -678,6 +678,9 @@ static int deliver_to_subscribers(struct snd_seq_client *client,
+ 	else
+ 		down_read(&grp->list_mutex);
+ 	list_for_each_entry(subs, &grp->list_head, src_list) {
++		/* both ports ready? */
++		if (atomic_read(&subs->ref_count) != 2)
++			continue;
+ 		event->dest = subs->info.dest;
+ 		if (subs->info.flags & SNDRV_SEQ_PORT_SUBS_TIMESTAMP)
+ 			/* convert time according to flag with subscription */
+diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
+index 55170a20ae72..921fb2bd8fad 100644
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -173,10 +173,6 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
+ }
+ 
+ /* */
+-enum group_type {
+-	SRC_LIST, DEST_LIST
+-};
+-
+ static int subscribe_port(struct snd_seq_client *client,
+ 			  struct snd_seq_client_port *port,
+ 			  struct snd_seq_port_subs_info *grp,
+@@ -203,6 +199,20 @@ static struct snd_seq_client_port *get_client_port(struct snd_seq_addr *addr,
+ 	return NULL;
+ }
+ 
++static void delete_and_unsubscribe_port(struct snd_seq_client *client,
++					struct snd_seq_client_port *port,
++					struct snd_seq_subscribers *subs,
++					bool is_src, bool ack);
++
++static inline struct snd_seq_subscribers *
++get_subscriber(struct list_head *p, bool is_src)
++{
++	if (is_src)
++		return list_entry(p, struct snd_seq_subscribers, src_list);
++	else
++		return list_entry(p, struct snd_seq_subscribers, dest_list);
++}
++
+ /*
+  * remove all subscribers on the list
+  * this is called from port_delete, for each src and dest list.
+@@ -210,7 +220,7 @@ static struct snd_seq_client_port *get_client_port(struct snd_seq_addr *addr,
+ static void clear_subscriber_list(struct snd_seq_client *client,
+ 				  struct snd_seq_client_port *port,
+ 				  struct snd_seq_port_subs_info *grp,
+-				  int grptype)
++				  int is_src)
+ {
+ 	struct list_head *p, *n;
+ 
+@@ -219,15 +229,13 @@ static void clear_subscriber_list(struct snd_seq_client *client,
+ 		struct snd_seq_client *c;
+ 		struct snd_seq_client_port *aport;
+ 
+-		if (grptype == SRC_LIST) {
+-			subs = list_entry(p, struct snd_seq_subscribers, src_list);
++		subs = get_subscriber(p, is_src);
++		if (is_src)
+ 			aport = get_client_port(&subs->info.dest, &c);
+-		} else {
+-			subs = list_entry(p, struct snd_seq_subscribers, dest_list);
++		else
+ 			aport = get_client_port(&subs->info.sender, &c);
+-		}
+-		list_del(p);
+-		unsubscribe_port(client, port, grp, &subs->info, 0);
++		delete_and_unsubscribe_port(client, port, subs, is_src, false);
++
+ 		if (!aport) {
+ 			/* looks like the connected port is being deleted.
+ 			 * we decrease the counter, and when both ports are deleted
+@@ -235,21 +243,14 @@ static void clear_subscriber_list(struct snd_seq_client *client,
+ 			 */
+ 			if (atomic_dec_and_test(&subs->ref_count))
+ 				kfree(subs);
+-		} else {
+-			/* ok we got the connected port */
+-			struct snd_seq_port_subs_info *agrp;
+-			agrp = (grptype == SRC_LIST) ? &aport->c_dest : &aport->c_src;
+-			down_write(&agrp->list_mutex);
+-			if (grptype == SRC_LIST)
+-				list_del(&subs->dest_list);
+-			else
+-				list_del(&subs->src_list);
+-			up_write(&agrp->list_mutex);
+-			unsubscribe_port(c, aport, agrp, &subs->info, 1);
+-			kfree(subs);
+-			snd_seq_port_unlock(aport);
+-			snd_seq_client_unlock(c);
++			continue;
+ 		}
++
++		/* ok we got the connected port */
++		delete_and_unsubscribe_port(c, aport, subs, !is_src, true);
++		kfree(subs);
++		snd_seq_port_unlock(aport);
++		snd_seq_client_unlock(c);
+ 	}
+ }
+ 
+@@ -262,8 +263,8 @@ static int port_delete(struct snd_seq_client *client,
+ 	snd_use_lock_sync(&port->use_lock); 
+ 
+ 	/* clear subscribers info */
+-	clear_subscriber_list(client, port, &port->c_src, SRC_LIST);
+-	clear_subscriber_list(client, port, &port->c_dest, DEST_LIST);
++	clear_subscriber_list(client, port, &port->c_src, true);
++	clear_subscriber_list(client, port, &port->c_dest, false);
+ 
+ 	if (port->private_free)
+ 		port->private_free(port->private_data);
+@@ -479,85 +480,120 @@ static int match_subs_info(struct snd_seq_port_subscribe *r,
+ 	return 0;
+ }
+ 
+-
+-/* connect two ports */
+-int snd_seq_port_connect(struct snd_seq_client *connector,
+-			 struct snd_seq_client *src_client,
+-			 struct snd_seq_client_port *src_port,
+-			 struct snd_seq_client *dest_client,
+-			 struct snd_seq_client_port *dest_port,
+-			 struct snd_seq_port_subscribe *info)
++static int check_and_subscribe_port(struct snd_seq_client *client,
++				    struct snd_seq_client_port *port,
++				    struct snd_seq_subscribers *subs,
++				    bool is_src, bool exclusive, bool ack)
+ {
+-	struct snd_seq_port_subs_info *src = &src_port->c_src;
+-	struct snd_seq_port_subs_info *dest = &dest_port->c_dest;
+-	struct snd_seq_subscribers *subs, *s;
+-	int err, src_called = 0;
+-	unsigned long flags;
+-	int exclusive;
++	struct snd_seq_port_subs_info *grp;
++	struct list_head *p;
++	struct snd_seq_subscribers *s;
++	int err;
+ 
+-	subs = kzalloc(sizeof(*subs), GFP_KERNEL);
+-	if (! subs)
+-		return -ENOMEM;
+-
+-	subs->info = *info;
+-	atomic_set(&subs->ref_count, 2);
+-
+-	down_write(&src->list_mutex);
+-	down_write_nested(&dest->list_mutex, SINGLE_DEPTH_NESTING);
+-
+-	exclusive = info->flags & SNDRV_SEQ_PORT_SUBS_EXCLUSIVE ? 1 : 0;
++	grp = is_src ? &port->c_src : &port->c_dest;
+ 	err = -EBUSY;
++	down_write(&grp->list_mutex);
+ 	if (exclusive) {
+-		if (! list_empty(&src->list_head) || ! list_empty(&dest->list_head))
++		if (!list_empty(&grp->list_head))
+ 			goto __error;
+ 	} else {
+-		if (src->exclusive || dest->exclusive)
++		if (grp->exclusive)
+ 			goto __error;
+ 		/* check whether already exists */
+-		list_for_each_entry(s, &src->list_head, src_list) {
+-			if (match_subs_info(info, &s->info))
+-				goto __error;
+-		}
+-		list_for_each_entry(s, &dest->list_head, dest_list) {
+-			if (match_subs_info(info, &s->info))
++		list_for_each(p, &grp->list_head) {
++			s = get_subscriber(p, is_src);
++			if (match_subs_info(&subs->info, &s->info))
+ 				goto __error;
+ 		}
+ 	}
+ 
+-	if ((err = subscribe_port(src_client, src_port, src, info,
+-				  connector->number != src_client->number)) < 0)
+-		goto __error;
+-	src_called = 1;
+-
+-	if ((err = subscribe_port(dest_client, dest_port, dest, info,
+-				  connector->number != dest_client->number)) < 0)
++	err = subscribe_port(client, port, grp, &subs->info, ack);
++	if (err < 0) {
++		grp->exclusive = 0;
+ 		goto __error;
++	}
+ 
+ 	/* add to list */
+-	write_lock_irqsave(&src->list_lock, flags);
+-	// write_lock(&dest->list_lock); // no other lock yet
+-	list_add_tail(&subs->src_list, &src->list_head);
+-	list_add_tail(&subs->dest_list, &dest->list_head);
+-	// write_unlock(&dest->list_lock); // no other lock yet
+-	write_unlock_irqrestore(&src->list_lock, flags);
++	write_lock_irq(&grp->list_lock);
++	if (is_src)
++		list_add_tail(&subs->src_list, &grp->list_head);
++	else
++		list_add_tail(&subs->dest_list, &grp->list_head);
++	grp->exclusive = exclusive;
++	atomic_inc(&subs->ref_count);
++	write_unlock_irq(&grp->list_lock);
++	err = 0;
++
++ __error:
++	up_write(&grp->list_mutex);
++	return err;
++}
+ 
+-	src->exclusive = dest->exclusive = exclusive;
++static void delete_and_unsubscribe_port(struct snd_seq_client *client,
++					struct snd_seq_client_port *port,
++					struct snd_seq_subscribers *subs,
++					bool is_src, bool ack)
++{
++	struct snd_seq_port_subs_info *grp;
++
++	grp = is_src ? &port->c_src : &port->c_dest;
++	down_write(&grp->list_mutex);
++	write_lock_irq(&grp->list_lock);
++	if (is_src)
++		list_del(&subs->src_list);
++	else
++		list_del(&subs->dest_list);
++	grp->exclusive = 0;
++	write_unlock_irq(&grp->list_lock);
++	up_write(&grp->list_mutex);
++
++	unsubscribe_port(client, port, grp, &subs->info, ack);
++}
++
++/* connect two ports */
++int snd_seq_port_connect(struct snd_seq_client *connector,
++			 struct snd_seq_client *src_client,
++			 struct snd_seq_client_port *src_port,
++			 struct snd_seq_client *dest_client,
++			 struct snd_seq_client_port *dest_port,
++			 struct snd_seq_port_subscribe *info)
++{
++	struct snd_seq_subscribers *subs;
++	bool exclusive;
++	int err;
++
++	subs = kzalloc(sizeof(*subs), GFP_KERNEL);
++	if (!subs)
++		return -ENOMEM;
++
++	subs->info = *info;
++	atomic_set(&subs->ref_count, 0);
++	INIT_LIST_HEAD(&subs->src_list);
++	INIT_LIST_HEAD(&subs->dest_list);
++
++	exclusive = !!(info->flags & SNDRV_SEQ_PORT_SUBS_EXCLUSIVE);
++
++	err = check_and_subscribe_port(src_client, src_port, subs, true,
++				       exclusive,
++				       connector->number != src_client->number);
++	if (err < 0)
++		goto error;
++	err = check_and_subscribe_port(dest_client, dest_port, subs, false,
++				       exclusive,
++				       connector->number != dest_client->number);
++	if (err < 0)
++		goto error_dest;
+ 
+-	up_write(&dest->list_mutex);
+-	up_write(&src->list_mutex);
+ 	return 0;
+ 
+- __error:
+-	if (src_called)
+-		unsubscribe_port(src_client, src_port, src, info,
+-				 connector->number != src_client->number);
++ error_dest:
++	delete_and_unsubscribe_port(src_client, src_port, subs, true,
++				    connector->number != src_client->number);
++ error:
+ 	kfree(subs);
+-	up_write(&dest->list_mutex);
+-	up_write(&src->list_mutex);
+ 	return err;
+ }
+ 
+-
+ /* remove the connection */
+ int snd_seq_port_disconnect(struct snd_seq_client *connector,
+ 			    struct snd_seq_client *src_client,
+@@ -567,37 +603,28 @@ int snd_seq_port_disconnect(struct snd_seq_client *connector,
+ 			    struct snd_seq_port_subscribe *info)
+ {
+ 	struct snd_seq_port_subs_info *src = &src_port->c_src;
+-	struct snd_seq_port_subs_info *dest = &dest_port->c_dest;
+ 	struct snd_seq_subscribers *subs;
+ 	int err = -ENOENT;
+-	unsigned long flags;
+ 
+ 	down_write(&src->list_mutex);
+-	down_write_nested(&dest->list_mutex, SINGLE_DEPTH_NESTING);
+-
+ 	/* look for the connection */
+ 	list_for_each_entry(subs, &src->list_head, src_list) {
+ 		if (match_subs_info(info, &subs->info)) {
+-			write_lock_irqsave(&src->list_lock, flags);
+-			// write_lock(&dest->list_lock);  // no lock yet
+-			list_del(&subs->src_list);
+-			list_del(&subs->dest_list);
+-			// write_unlock(&dest->list_lock);
+-			write_unlock_irqrestore(&src->list_lock, flags);
+-			src->exclusive = dest->exclusive = 0;
+-			unsubscribe_port(src_client, src_port, src, info,
+-					 connector->number != src_client->number);
+-			unsubscribe_port(dest_client, dest_port, dest, info,
+-					 connector->number != dest_client->number);
+-			kfree(subs);
++			atomic_dec(&subs->ref_count); /* mark as not ready */
+ 			err = 0;
+ 			break;
+ 		}
+ 	}
+-
+-	up_write(&dest->list_mutex);
+ 	up_write(&src->list_mutex);
+-	return err;
++	if (err < 0)
++		return err;
++
++	delete_and_unsubscribe_port(src_client, src_port, subs, true,
++				    connector->number != src_client->number);
++	delete_and_unsubscribe_port(dest_client, dest_port, subs, false,
++				    connector->number != dest_client->number);
++	kfree(subs);
++	return 0;
+ }
+ 
+ 
+diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
+index 186f1611103c..a2468f1101d1 100644
+--- a/sound/core/seq/seq_timer.c
++++ b/sound/core/seq/seq_timer.c
+@@ -90,6 +90,9 @@ void snd_seq_timer_delete(struct snd_seq_timer **tmr)
+ 
+ void snd_seq_timer_defaults(struct snd_seq_timer * tmr)
+ {
++	unsigned long flags;
++
++	spin_lock_irqsave(&tmr->lock, flags);
+ 	/* setup defaults */
+ 	tmr->ppq = 96;		/* 96 PPQ */
+ 	tmr->tempo = 500000;	/* 120 BPM */
+@@ -105,21 +108,25 @@ void snd_seq_timer_defaults(struct snd_seq_timer * tmr)
+ 	tmr->preferred_resolution = seq_default_timer_resolution;
+ 
+ 	tmr->skew = tmr->skew_base = SKEW_BASE;
++	spin_unlock_irqrestore(&tmr->lock, flags);
+ }
+ 
+-void snd_seq_timer_reset(struct snd_seq_timer * tmr)
++static void seq_timer_reset(struct snd_seq_timer *tmr)
+ {
+-	unsigned long flags;
+-
+-	spin_lock_irqsave(&tmr->lock, flags);
+-
+ 	/* reset time & songposition */
+ 	tmr->cur_time.tv_sec = 0;
+ 	tmr->cur_time.tv_nsec = 0;
+ 
+ 	tmr->tick.cur_tick = 0;
+ 	tmr->tick.fraction = 0;
++}
++
++void snd_seq_timer_reset(struct snd_seq_timer *tmr)
++{
++	unsigned long flags;
+ 
++	spin_lock_irqsave(&tmr->lock, flags);
++	seq_timer_reset(tmr);
+ 	spin_unlock_irqrestore(&tmr->lock, flags);
+ }
+ 
+@@ -138,8 +145,11 @@ static void snd_seq_timer_interrupt(struct snd_timer_instance *timeri,
+ 	tmr = q->timer;
+ 	if (tmr == NULL)
+ 		return;
+-	if (!tmr->running)
++	spin_lock_irqsave(&tmr->lock, flags);
++	if (!tmr->running) {
++		spin_unlock_irqrestore(&tmr->lock, flags);
+ 		return;
++	}
+ 
+ 	resolution *= ticks;
+ 	if (tmr->skew != tmr->skew_base) {
+@@ -148,8 +158,6 @@ static void snd_seq_timer_interrupt(struct snd_timer_instance *timeri,
+ 			(((resolution & 0xffff) * tmr->skew) >> 16);
+ 	}
+ 
+-	spin_lock_irqsave(&tmr->lock, flags);
+-
+ 	/* update timer */
+ 	snd_seq_inc_time_nsec(&tmr->cur_time, resolution);
+ 
+@@ -296,26 +304,30 @@ int snd_seq_timer_open(struct snd_seq_queue *q)
+ 	t->callback = snd_seq_timer_interrupt;
+ 	t->callback_data = q;
+ 	t->flags |= SNDRV_TIMER_IFLG_AUTO;
++	spin_lock_irq(&tmr->lock);
+ 	tmr->timeri = t;
++	spin_unlock_irq(&tmr->lock);
+ 	return 0;
+ }
+ 
+ int snd_seq_timer_close(struct snd_seq_queue *q)
+ {
+ 	struct snd_seq_timer *tmr;
++	struct snd_timer_instance *t;
+ 	
+ 	tmr = q->timer;
+ 	if (snd_BUG_ON(!tmr))
+ 		return -EINVAL;
+-	if (tmr->timeri) {
+-		snd_timer_stop(tmr->timeri);
+-		snd_timer_close(tmr->timeri);
+-		tmr->timeri = NULL;
+-	}
++	spin_lock_irq(&tmr->lock);
++	t = tmr->timeri;
++	tmr->timeri = NULL;
++	spin_unlock_irq(&tmr->lock);
++	if (t)
++		snd_timer_close(t);
+ 	return 0;
+ }
+ 
+-int snd_seq_timer_stop(struct snd_seq_timer * tmr)
++static int seq_timer_stop(struct snd_seq_timer *tmr)
+ {
+ 	if (! tmr->timeri)
+ 		return -EINVAL;
+@@ -326,6 +338,17 @@ int snd_seq_timer_stop(struct snd_seq_timer * tmr)
+ 	return 0;
+ }
+ 
++int snd_seq_timer_stop(struct snd_seq_timer *tmr)
++{
++	unsigned long flags;
++	int err;
++
++	spin_lock_irqsave(&tmr->lock, flags);
++	err = seq_timer_stop(tmr);
++	spin_unlock_irqrestore(&tmr->lock, flags);
++	return err;
++}
++
+ static int initialize_timer(struct snd_seq_timer *tmr)
+ {
+ 	struct snd_timer *t;
+@@ -358,13 +381,13 @@ static int initialize_timer(struct snd_seq_timer *tmr)
+ 	return 0;
+ }
+ 
+-int snd_seq_timer_start(struct snd_seq_timer * tmr)
++static int seq_timer_start(struct snd_seq_timer *tmr)
+ {
+ 	if (! tmr->timeri)
+ 		return -EINVAL;
+ 	if (tmr->running)
+-		snd_seq_timer_stop(tmr);
+-	snd_seq_timer_reset(tmr);
++		seq_timer_stop(tmr);
++	seq_timer_reset(tmr);
+ 	if (initialize_timer(tmr) < 0)
+ 		return -EINVAL;
+ 	snd_timer_start(tmr->timeri, tmr->ticks);
+@@ -373,14 +396,25 @@ int snd_seq_timer_start(struct snd_seq_timer * tmr)
+ 	return 0;
+ }
+ 
+-int snd_seq_timer_continue(struct snd_seq_timer * tmr)
++int snd_seq_timer_start(struct snd_seq_timer *tmr)
++{
++	unsigned long flags;
++	int err;
++
++	spin_lock_irqsave(&tmr->lock, flags);
++	err = seq_timer_start(tmr);
++	spin_unlock_irqrestore(&tmr->lock, flags);
++	return err;
++}
++
++static int seq_timer_continue(struct snd_seq_timer *tmr)
+ {
+ 	if (! tmr->timeri)
+ 		return -EINVAL;
+ 	if (tmr->running)
+ 		return -EBUSY;
+ 	if (! tmr->initialized) {
+-		snd_seq_timer_reset(tmr);
++		seq_timer_reset(tmr);
+ 		if (initialize_timer(tmr) < 0)
+ 			return -EINVAL;
+ 	}
+@@ -390,11 +424,24 @@ int snd_seq_timer_continue(struct snd_seq_timer * tmr)
+ 	return 0;
+ }
+ 
++int snd_seq_timer_continue(struct snd_seq_timer *tmr)
++{
++	unsigned long flags;
++	int err;
++
++	spin_lock_irqsave(&tmr->lock, flags);
++	err = seq_timer_continue(tmr);
++	spin_unlock_irqrestore(&tmr->lock, flags);
++	return err;
++}
++
+ /* return current 'real' time. use timeofday() to get better granularity. */
+ snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr)
+ {
+ 	snd_seq_real_time_t cur_time;
++	unsigned long flags;
+ 
++	spin_lock_irqsave(&tmr->lock, flags);
+ 	cur_time = tmr->cur_time;
+ 	if (tmr->running) { 
+ 		struct timeval tm;
+@@ -410,7 +457,7 @@ snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr)
+ 		}
+ 		snd_seq_sanity_real_time(&cur_time);
+ 	}
+-                
++	spin_unlock_irqrestore(&tmr->lock, flags);
+ 	return cur_time;	
+ }
+ 
+diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
+index 56e0f4cd3f82..81134e067184 100644
+--- a/sound/core/seq/seq_virmidi.c
++++ b/sound/core/seq/seq_virmidi.c
+@@ -155,21 +155,26 @@ static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream,
+ 	struct snd_virmidi *vmidi = substream->runtime->private_data;
+ 	int count, res;
+ 	unsigned char buf[32], *pbuf;
++	unsigned long flags;
+ 
+ 	if (up) {
+ 		vmidi->trigger = 1;
+ 		if (vmidi->seq_mode == SNDRV_VIRMIDI_SEQ_DISPATCH &&
+ 		    !(vmidi->rdev->flags & SNDRV_VIRMIDI_SUBSCRIBE)) {
+-			snd_rawmidi_transmit_ack(substream, substream->runtime->buffer_size - substream->runtime->avail);
+-			return;		/* ignored */
++			while (snd_rawmidi_transmit(substream, buf,
++						    sizeof(buf)) > 0) {
++				/* ignored */
++			}
++			return;
+ 		}
+ 		if (vmidi->event.type != SNDRV_SEQ_EVENT_NONE) {
+ 			if (snd_seq_kernel_client_dispatch(vmidi->client, &vmidi->event, in_atomic(), 0) < 0)
+ 				return;
+ 			vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
+ 		}
++		spin_lock_irqsave(&substream->runtime->lock, flags);
+ 		while (1) {
+-			count = snd_rawmidi_transmit_peek(substream, buf, sizeof(buf));
++			count = __snd_rawmidi_transmit_peek(substream, buf, sizeof(buf));
+ 			if (count <= 0)
+ 				break;
+ 			pbuf = buf;
+@@ -179,16 +184,18 @@ static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream,
+ 					snd_midi_event_reset_encode(vmidi->parser);
+ 					continue;
+ 				}
+-				snd_rawmidi_transmit_ack(substream, res);
++				__snd_rawmidi_transmit_ack(substream, res);
+ 				pbuf += res;
+ 				count -= res;
+ 				if (vmidi->event.type != SNDRV_SEQ_EVENT_NONE) {
+ 					if (snd_seq_kernel_client_dispatch(vmidi->client, &vmidi->event, in_atomic(), 0) < 0)
+-						return;
++						goto out;
+ 					vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
+ 				}
+ 			}
+ 		}
++	out:
++		spin_unlock_irqrestore(&substream->runtime->lock, flags);
+ 	} else {
+ 		vmidi->trigger = 0;
+ 	}
+@@ -254,9 +261,13 @@ static int snd_virmidi_output_open(struct snd_rawmidi_substream *substream)
+  */
+ static int snd_virmidi_input_close(struct snd_rawmidi_substream *substream)
+ {
++	struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
+ 	struct snd_virmidi *vmidi = substream->runtime->private_data;
+-	snd_midi_event_free(vmidi->parser);
++
++	write_lock_irq(&rdev->filelist_lock);
+ 	list_del(&vmidi->list);
++	write_unlock_irq(&rdev->filelist_lock);
++	snd_midi_event_free(vmidi->parser);
+ 	substream->runtime->private_data = NULL;
+ 	kfree(vmidi);
+ 	return 0;
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index a419878901c4..00e8c5f4de17 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -305,8 +305,7 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ 	return 0;
+ }
+ 
+-static int _snd_timer_stop(struct snd_timer_instance *timeri,
+-			   int keep_flag, int event);
++static int _snd_timer_stop(struct snd_timer_instance *timeri, int event);
+ 
+ /*
+  * close a timer instance
+@@ -348,7 +347,7 @@ int snd_timer_close(struct snd_timer_instance *timeri)
+ 		spin_unlock_irq(&timer->lock);
+ 		mutex_lock(&register_mutex);
+ 		list_del(&timeri->open_list);
+-		if (timer && list_empty(&timer->open_list_head) &&
++		if (list_empty(&timer->open_list_head) &&
+ 		    timer->hw.close)
+ 			timer->hw.close(timer);
+ 		/* remove slave links */
+@@ -452,6 +451,10 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri)
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&slave_active_lock, flags);
++	if (timeri->flags & SNDRV_TIMER_IFLG_RUNNING) {
++		spin_unlock_irqrestore(&slave_active_lock, flags);
++		return -EBUSY;
++	}
+ 	timeri->flags |= SNDRV_TIMER_IFLG_RUNNING;
+ 	if (timeri->master && timeri->timer) {
+ 		spin_lock(&timeri->timer->lock);
+@@ -476,7 +479,8 @@ int snd_timer_start(struct snd_timer_instance *timeri, unsigned int ticks)
+ 		return -EINVAL;
+ 	if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) {
+ 		result = snd_timer_start_slave(timeri);
+-		snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START);
++		if (result >= 0)
++			snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START);
+ 		return result;
+ 	}
+ 	timer = timeri->timer;
+@@ -485,16 +489,22 @@ int snd_timer_start(struct snd_timer_instance *timeri, unsigned int ticks)
+ 	if (timer->card && timer->card->shutdown)
+ 		return -ENODEV;
+ 	spin_lock_irqsave(&timer->lock, flags);
++	if (timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |
++			     SNDRV_TIMER_IFLG_START)) {
++		result = -EBUSY;
++		goto unlock;
++	}
+ 	timeri->ticks = timeri->cticks = ticks;
+ 	timeri->pticks = 0;
+ 	result = snd_timer_start1(timer, timeri, ticks);
++ unlock:
+ 	spin_unlock_irqrestore(&timer->lock, flags);
+-	snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START);
++	if (result >= 0)
++		snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START);
+ 	return result;
+ }
+ 
+-static int _snd_timer_stop(struct snd_timer_instance * timeri,
+-			   int keep_flag, int event)
++static int _snd_timer_stop(struct snd_timer_instance *timeri, int event)
+ {
+ 	struct snd_timer *timer;
+ 	unsigned long flags;
+@@ -503,19 +513,26 @@ static int _snd_timer_stop(struct snd_timer_instance * timeri,
+ 		return -ENXIO;
+ 
+ 	if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) {
+-		if (!keep_flag) {
+-			spin_lock_irqsave(&slave_active_lock, flags);
+-			timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
+-			list_del_init(&timeri->ack_list);
+-			list_del_init(&timeri->active_list);
++		spin_lock_irqsave(&slave_active_lock, flags);
++		if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) {
+ 			spin_unlock_irqrestore(&slave_active_lock, flags);
++			return -EBUSY;
+ 		}
++		timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
++		list_del_init(&timeri->ack_list);
++		list_del_init(&timeri->active_list);
++		spin_unlock_irqrestore(&slave_active_lock, flags);
+ 		goto __end;
+ 	}
+ 	timer = timeri->timer;
+ 	if (!timer)
+ 		return -EINVAL;
+ 	spin_lock_irqsave(&timer->lock, flags);
++	if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |
++			       SNDRV_TIMER_IFLG_START))) {
++		spin_unlock_irqrestore(&timer->lock, flags);
++		return -EBUSY;
++	}
+ 	list_del_init(&timeri->ack_list);
+ 	list_del_init(&timeri->active_list);
+ 	if (timer->card && timer->card->shutdown) {
+@@ -534,9 +551,7 @@ static int _snd_timer_stop(struct snd_timer_instance * timeri,
+ 			}
+ 		}
+ 	}
+-	if (!keep_flag)
+-		timeri->flags &=
+-			~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START);
++	timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START);
+ 	spin_unlock_irqrestore(&timer->lock, flags);
+       __end:
+ 	if (event != SNDRV_TIMER_EVENT_RESOLUTION)
+@@ -555,7 +570,7 @@ int snd_timer_stop(struct snd_timer_instance *timeri)
+ 	unsigned long flags;
+ 	int err;
+ 
+-	err = _snd_timer_stop(timeri, 0, SNDRV_TIMER_EVENT_STOP);
++	err = _snd_timer_stop(timeri, SNDRV_TIMER_EVENT_STOP);
+ 	if (err < 0)
+ 		return err;
+ 	timer = timeri->timer;
+@@ -587,10 +602,15 @@ int snd_timer_continue(struct snd_timer_instance *timeri)
+ 	if (timer->card && timer->card->shutdown)
+ 		return -ENODEV;
+ 	spin_lock_irqsave(&timer->lock, flags);
++	if (timeri->flags & SNDRV_TIMER_IFLG_RUNNING) {
++		result = -EBUSY;
++		goto unlock;
++	}
+ 	if (!timeri->cticks)
+ 		timeri->cticks = 1;
+ 	timeri->pticks = 0;
+ 	result = snd_timer_start1(timer, timeri, timer->sticks);
++ unlock:
+ 	spin_unlock_irqrestore(&timer->lock, flags);
+ 	snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_CONTINUE);
+ 	return result;
+@@ -601,7 +621,7 @@ int snd_timer_continue(struct snd_timer_instance *timeri)
+  */
+ int snd_timer_pause(struct snd_timer_instance * timeri)
+ {
+-	return _snd_timer_stop(timeri, 0, SNDRV_TIMER_EVENT_PAUSE);
++	return _snd_timer_stop(timeri, SNDRV_TIMER_EVENT_PAUSE);
+ }
+ 
+ /*
+@@ -724,8 +744,8 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ 			ti->cticks = ti->ticks;
+ 		} else {
+ 			ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
+-			if (--timer->running)
+-				list_del_init(&ti->active_list);
++			--timer->running;
++			list_del_init(&ti->active_list);
+ 		}
+ 		if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) ||
+ 		    (ti->flags & SNDRV_TIMER_IFLG_FAST))
+diff --git a/sound/drivers/dummy.c b/sound/drivers/dummy.c
+index d11baaf0f0b4..96592d5ba7bf 100644
+--- a/sound/drivers/dummy.c
++++ b/sound/drivers/dummy.c
+@@ -87,7 +87,7 @@ MODULE_PARM_DESC(pcm_substreams, "PCM substreams # (1-128) for dummy driver.");
+ module_param(fake_buffer, bool, 0444);
+ MODULE_PARM_DESC(fake_buffer, "Fake buffer allocations.");
+ #ifdef CONFIG_HIGH_RES_TIMERS
+-module_param(hrtimer, bool, 0644);
++module_param(hrtimer, bool, 0444);
+ MODULE_PARM_DESC(hrtimer, "Use hrtimer as the timer source.");
+ #endif
+ 
+diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c
+index 98e4fc8121a1..5e547cb199f0 100644
+--- a/sound/firewire/bebob/bebob_stream.c
++++ b/sound/firewire/bebob/bebob_stream.c
+@@ -47,14 +47,16 @@ static const unsigned int bridgeco_freq_table[] = {
+ 	[6] = 0x07,
+ };
+ 
+-static unsigned int
+-get_formation_index(unsigned int rate)
++static int
++get_formation_index(unsigned int rate, unsigned int *index)
+ {
+ 	unsigned int i;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(snd_bebob_rate_table); i++) {
+-		if (snd_bebob_rate_table[i] == rate)
+-			return i;
++		if (snd_bebob_rate_table[i] == rate) {
++			*index = i;
++			return 0;
++		}
+ 	}
+ 	return -EINVAL;
+ }
+@@ -367,7 +369,9 @@ make_both_connections(struct snd_bebob *bebob, unsigned int rate)
+ 		goto end;
+ 
+ 	/* confirm params for both streams */
+-	index = get_formation_index(rate);
++	err = get_formation_index(rate, &index);
++	if (err < 0)
++		goto end;
+ 	pcm_channels = bebob->tx_stream_formations[index].pcm;
+ 	midi_channels = bebob->tx_stream_formations[index].midi;
+ 	amdtp_stream_set_parameters(&bebob->tx_stream,
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index b791529bf31c..8f50a257a80d 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -614,6 +614,7 @@ enum {
+ 	CS4208_MAC_AUTO,
+ 	CS4208_MBA6,
+ 	CS4208_MBP11,
++	CS4208_MACMINI,
+ 	CS4208_GPIO0,
+ };
+ 
+@@ -621,6 +622,7 @@ static const struct hda_model_fixup cs4208_models[] = {
+ 	{ .id = CS4208_GPIO0, .name = "gpio0" },
+ 	{ .id = CS4208_MBA6, .name = "mba6" },
+ 	{ .id = CS4208_MBP11, .name = "mbp11" },
++	{ .id = CS4208_MACMINI, .name = "macmini" },
+ 	{}
+ };
+ 
+@@ -632,6 +634,7 @@ static const struct snd_pci_quirk cs4208_fixup_tbl[] = {
+ /* codec SSID matching */
+ static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x106b, 0x5e00, "MacBookPro 11,2", CS4208_MBP11),
++	SND_PCI_QUIRK(0x106b, 0x6c00, "MacMini 7,1", CS4208_MACMINI),
+ 	SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6),
+ 	SND_PCI_QUIRK(0x106b, 0x7200, "MacBookAir 6,2", CS4208_MBA6),
+ 	SND_PCI_QUIRK(0x106b, 0x7b00, "MacBookPro 12,1", CS4208_MBP11),
+@@ -666,6 +669,24 @@ static void cs4208_fixup_mac(struct hda_codec *codec,
+ 	snd_hda_apply_fixup(codec, action);
+ }
+ 
++/* MacMini 7,1 has the inverted jack detection */
++static void cs4208_fixup_macmini(struct hda_codec *codec,
++				 const struct hda_fixup *fix, int action)
++{
++	static const struct hda_pintbl pincfgs[] = {
++		{ 0x18, 0x00ab9150 }, /* mic (audio-in) jack: disable detect */
++		{ 0x21, 0x004be140 }, /* SPDIF: disable detect */
++		{ }
++	};
++
++	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++		/* HP pin (0x10) has an inverted detection */
++		codec->inv_jack_detect = 1;
++		/* disable the bogus Mic and SPDIF jack detections */
++		snd_hda_apply_pincfgs(codec, pincfgs);
++	}
++}
++
+ static int cs4208_spdif_sw_put(struct snd_kcontrol *kcontrol,
+ 			       struct snd_ctl_elem_value *ucontrol)
+ {
+@@ -709,6 +730,12 @@ static const struct hda_fixup cs4208_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = CS4208_GPIO0,
+ 	},
++	[CS4208_MACMINI] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = cs4208_fixup_macmini,
++		.chained = true,
++		.chain_id = CS4208_GPIO0,
++	},
+ 	[CS4208_GPIO0] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = cs4208_fixup_gpio0,
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index fb9a8a5787a6..37d8ababfc04 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1118,6 +1118,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ 	switch (chip->usb_id) {
+ 	case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema  */
+ 	case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */
++	case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */
+ 	case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
+ 	case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
+ 	case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
+@@ -1202,8 +1203,12 @@ void snd_usb_set_interface_quirk(struct usb_device *dev)
+ 	 * "Playback Design" products need a 50ms delay after setting the
+ 	 * USB interface.
+ 	 */
+-	if (le16_to_cpu(dev->descriptor.idVendor) == 0x23ba)
++	switch (le16_to_cpu(dev->descriptor.idVendor)) {
++	case 0x23ba: /* Playback Design */
++	case 0x0644: /* TEAC Corp. */
+ 		mdelay(50);
++		break;
++	}
+ }
+ 
+ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
+@@ -1218,6 +1223,14 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
+ 	    (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ 		mdelay(20);
+ 
++	/*
++	 * "TEAC Corp." products need a 20ms delay after each
++	 * class compliant request
++	 */
++	if ((le16_to_cpu(dev->descriptor.idVendor) == 0x0644) &&
++	    (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
++		mdelay(20);
++
+ 	/* Marantz/Denon devices with USB DAC functionality need a delay
+ 	 * after each class compliant request
+ 	 */
+@@ -1266,7 +1279,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ 	case USB_ID(0x20b1, 0x3008): /* iFi Audio micro/nano iDSD */
+ 	case USB_ID(0x20b1, 0x2008): /* Matrix Audio X-Sabre */
+ 	case USB_ID(0x20b1, 0x300a): /* Matrix Audio Mini-i Pro */
+-	case USB_ID(0x22d8, 0x0416): /* OPPO HA-1*/
++	case USB_ID(0x22d9, 0x0416): /* OPPO HA-1 */
+ 		if (fp->altsetting == 2)
+ 			return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ 		break;
+@@ -1275,6 +1288,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ 	case USB_ID(0x20b1, 0x2009): /* DIYINHK DSD DXD 384kHz USB to I2S/DSD */
+ 	case USB_ID(0x20b1, 0x2023): /* JLsounds I2SoverUSB */
+ 	case USB_ID(0x20b1, 0x3023): /* Aune X1S 32BIT/384 DSD DAC */
++	case USB_ID(0x2616, 0x0106): /* PS Audio NuWave DAC */
+ 		if (fp->altsetting == 3)
+ 			return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ 		break;
+diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
+index ed5461f065bd..f64a2d54d467 100644
+--- a/tools/lib/traceevent/event-parse.c
++++ b/tools/lib/traceevent/event-parse.c
+@@ -4841,13 +4841,12 @@ static void pretty_print(struct trace_seq *s, void *data, int size, struct event
+ 				    sizeof(long) != 8) {
+ 					char *p;
+ 
+-					ls = 2;
+ 					/* make %l into %ll */
+-					p = strchr(format, 'l');
+-					if (p)
++					if (ls == 1 && (p = strchr(format, 'l')))
+ 						memmove(p+1, p, strlen(p)+1);
+ 					else if (strcmp(format, "%p") == 0)
+ 						strcpy(format, "0x%llx");
++					ls = 2;
+ 				}
+ 				switch (ls) {
+ 				case -2:
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index 0c74012575ac..83054ef6c1a1 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -816,7 +816,7 @@ static struct machine *machines__find_for_cpumode(struct machines *machines,
+ 
+ 		machine = machines__find(machines, pid);
+ 		if (!machine)
+-			machine = machines__find(machines, DEFAULT_GUEST_KERNEL_ID);
++			machine = machines__findnew(machines, DEFAULT_GUEST_KERNEL_ID);
+ 		return machine;
+ 	}
+