commit: 203f855f3df02c2e1878212e32716806671716cd Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org> AuthorDate: Mon Jan 9 11:43:12 2017 +0000 Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org> CommitDate: Mon Jan 9 11:43:12 2017 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=203f855f
Linux patch 4.8.17 0000_README | 4 + 1016_linux-4.8.17.patch | 3229 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3233 insertions(+) diff --git a/0000_README b/0000_README index e7fac7c..f8302fa 100644 --- a/0000_README +++ b/0000_README @@ -107,6 +107,10 @@ Patch: 1015_linux-4.8.16.patch From: http://www.kernel.org Desc: Linux 4.8.16 +Patch: 1016_linux-4.8.17.patch +From: http://www.kernel.org +Desc: Linux 4.8.17 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1016_linux-4.8.17.patch b/1016_linux-4.8.17.patch new file mode 100644 index 0000000..7782469 --- /dev/null +++ b/1016_linux-4.8.17.patch @@ -0,0 +1,3229 @@ +diff --git a/Documentation/sphinx/rstFlatTable.py b/Documentation/sphinx/rstFlatTable.py +index 26db852e3c74..99163598f18b 100644 +--- a/Documentation/sphinx/rstFlatTable.py ++++ b/Documentation/sphinx/rstFlatTable.py +@@ -151,6 +151,11 @@ class ListTableBuilder(object): + def buildTableNode(self): + + colwidths = self.directive.get_column_widths(self.max_cols) ++ if isinstance(colwidths, tuple): ++ # Since docutils 0.13, get_column_widths returns a (widths, ++ # colwidths) tuple, where widths is a string (i.e. 'auto'). ++ # See https://sourceforge.net/p/docutils/patches/120/. ++ colwidths = colwidths[1] + stub_columns = self.directive.options.get('stub-columns', 0) + header_rows = self.directive.options.get('header-rows', 0) + +diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt +index 739db9ab16b2..a7596e9fdf06 100644 +--- a/Documentation/virtual/kvm/api.txt ++++ b/Documentation/virtual/kvm/api.txt +@@ -2039,6 +2039,7 @@ registers, find a list below: + PPC | KVM_REG_PPC_TM_VSCR | 32 + PPC | KVM_REG_PPC_TM_DSCR | 64 + PPC | KVM_REG_PPC_TM_TAR | 64 ++ PPC | KVM_REG_PPC_TM_XER | 64 + | | + MIPS | KVM_REG_MIPS_R0 | 64 + ... +diff --git a/Makefile b/Makefile +index 50f68648a79a..ace32d3bac4b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 8 +-SUBLEVEL = 16 ++SUBLEVEL = 17 + EXTRAVERSION = + NAME = Psychotic Stoned Sheep + +diff --git a/arch/arc/include/asm/cacheflush.h b/arch/arc/include/asm/cacheflush.h +index a093adbdb017..fc662f49c55a 100644 +--- a/arch/arc/include/asm/cacheflush.h ++++ b/arch/arc/include/asm/cacheflush.h +@@ -85,6 +85,10 @@ void flush_anon_page(struct vm_area_struct *vma, + */ + #define PG_dc_clean PG_arch_1 + ++#define CACHE_COLORS_NUM 4 ++#define CACHE_COLORS_MSK (CACHE_COLORS_NUM - 1) ++#define CACHE_COLOR(addr) (((unsigned long)(addr) >> (PAGE_SHIFT)) & CACHE_COLORS_MSK) ++ + /* + * Simple wrapper over config option + * Bootup code ensures that hardware matches kernel configuration +@@ -94,8 +98,6 @@ static inline int cache_is_vipt_aliasing(void) + return IS_ENABLED(CONFIG_ARC_CACHE_VIPT_ALIASING); + } + +-#define CACHE_COLOR(addr) (((unsigned long)(addr) >> (PAGE_SHIFT)) & 1) +- + /* + * checks if two addresses (after page aligning) index into same cache set + */ +diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c +index 0b10efe3a6a7..ab1aaf2a28c8 100644 +--- a/arch/arc/mm/cache.c ++++ b/arch/arc/mm/cache.c +@@ -967,11 +967,16 @@ void arc_cache_init(void) + /* check for D-Cache aliasing on ARCompact: ARCv2 has PIPT */ + if (is_isa_arcompact()) { + int handled = IS_ENABLED(CONFIG_ARC_CACHE_VIPT_ALIASING); +- +- if (dc->alias && !handled) +- panic("Enable CONFIG_ARC_CACHE_VIPT_ALIASING\n"); +- else if (!dc->alias && handled) ++ int num_colors = dc->sz_k/dc->assoc/TO_KB(PAGE_SIZE); ++ ++ if (dc->alias) { ++ if (!handled) ++ panic("Enable CONFIG_ARC_CACHE_VIPT_ALIASING\n"); ++ if (CACHE_COLORS_NUM != num_colors) ++ panic("CACHE_COLORS_NUM not optimized for config\n"); ++ } else if (!dc->alias && handled) { + panic("Disable CONFIG_ARC_CACHE_VIPT_ALIASING\n"); ++ } + } + } + +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi +index 5fda583351d7..906fb836d241 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi +@@ -21,6 +21,10 @@ + reg = <0x0 0x80000000 0x1 0x0>; + }; + ++ gpu@57000000 { ++ vdd-supply = <&vdd_gpu>; ++ }; ++ + /* debug port */ + serial@70006000 { + status = "okay"; +@@ -291,4 +295,18 @@ + clock-frequency = <32768>; + }; + }; ++ ++ regulators { ++ vdd_gpu: regulator@100 { ++ compatible = "pwm-regulator"; ++ reg = <100>; ++ pwms = <&pwm 1 4880>; ++ regulator-name = "VDD_GPU"; ++ regulator-min-microvolt = <710000>; ++ regulator-max-microvolt = <1320000>; ++ enable-gpios = <&pmic 6 GPIO_ACTIVE_HIGH>; ++ regulator-ramp-delay = <80>; ++ regulator-enable-ramp-delay = <1000>; ++ }; ++ }; + }; +diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c +index 5a84b4562603..03498c8f0cf7 100644 +--- a/arch/arm64/kvm/hyp/switch.c ++++ b/arch/arm64/kvm/hyp/switch.c +@@ -82,7 +82,13 @@ static void __hyp_text __activate_traps(struct kvm_vcpu *vcpu) + write_sysreg(val, hcr_el2); + /* Trap on AArch32 cp15 c15 accesses (EL1 or EL0) */ + write_sysreg(1 << 15, hstr_el2); +- /* Make sure we trap PMU access from EL0 to EL2 */ ++ /* ++ * Make sure we trap PMU access from EL0 to EL2. Also sanitize ++ * PMSELR_EL0 to make sure it never contains the cycle ++ * counter, which could make a PMXEVCNTR_EL0 access UNDEF at ++ * EL1 instead of being trapped to EL2. ++ */ ++ write_sysreg(0, pmselr_el0); + write_sysreg(ARMV8_PMU_USERENR_MASK, pmuserenr_el0); + write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2); + __activate_traps_arch()(); +diff --git a/arch/powerpc/boot/ps3-head.S b/arch/powerpc/boot/ps3-head.S +index b6fcbaf5027b..3dc44b05fb97 100644 +--- a/arch/powerpc/boot/ps3-head.S ++++ b/arch/powerpc/boot/ps3-head.S +@@ -57,11 +57,6 @@ __system_reset_overlay: + bctr + + 1: +- /* Save the value at addr zero for a null pointer write check later. */ +- +- li r4, 0 +- lwz r3, 0(r4) +- + /* Primary delays then goes to _zimage_start in wrapper. */ + + or 31, 31, 31 /* db16cyc */ +diff --git a/arch/powerpc/boot/ps3.c b/arch/powerpc/boot/ps3.c +index 4ec2d86d3c50..a05558a7e51a 100644 +--- a/arch/powerpc/boot/ps3.c ++++ b/arch/powerpc/boot/ps3.c +@@ -119,13 +119,12 @@ void ps3_copy_vectors(void) + flush_cache((void *)0x100, 512); + } + +-void platform_init(unsigned long null_check) ++void platform_init(void) + { + const u32 heapsize = 0x1000000 - (u32)_end; /* 16MiB */ + void *chosen; + unsigned long ft_addr; + u64 rm_size; +- unsigned long val; + + console_ops.write = ps3_console_write; + platform_ops.exit = ps3_exit; +@@ -153,11 +152,6 @@ void platform_init(unsigned long null_check) + + printf(" flat tree at 0x%lx\n\r", ft_addr); + +- val = *(unsigned long *)0; +- +- if (val != null_check) +- printf("null check failed: %lx != %lx\n\r", val, null_check); +- + ((kernel_entry_t)0)(ft_addr, 0, NULL); + + ps3_exit(); +diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h +index ec35af34a3fb..f2c5dde507c7 100644 +--- a/arch/powerpc/include/asm/kvm_host.h ++++ b/arch/powerpc/include/asm/kvm_host.h +@@ -555,6 +555,7 @@ struct kvm_vcpu_arch { + u64 tfiar; + + u32 cr_tm; ++ u64 xer_tm; + u64 lr_tm; + u64 ctr_tm; + u64 amr_tm; +diff --git a/arch/powerpc/include/uapi/asm/kvm.h b/arch/powerpc/include/uapi/asm/kvm.h +index c93cf35ce379..0fb1326c3ea2 100644 +--- a/arch/powerpc/include/uapi/asm/kvm.h ++++ b/arch/powerpc/include/uapi/asm/kvm.h +@@ -596,6 +596,7 @@ struct kvm_get_htab_header { + #define KVM_REG_PPC_TM_VSCR (KVM_REG_PPC_TM | KVM_REG_SIZE_U32 | 0x67) + #define KVM_REG_PPC_TM_DSCR (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x68) + #define KVM_REG_PPC_TM_TAR (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x69) ++#define KVM_REG_PPC_TM_XER (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x6a) + + /* PPC64 eXternal Interrupt Controller Specification */ + #define KVM_DEV_XICS_GRP_SOURCES 1 /* 64-bit source attributes */ +diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c +index b89d14c0352c..6ba221c76214 100644 +--- a/arch/powerpc/kernel/asm-offsets.c ++++ b/arch/powerpc/kernel/asm-offsets.c +@@ -569,6 +569,7 @@ int main(void) + DEFINE(VCPU_VRS_TM, offsetof(struct kvm_vcpu, arch.vr_tm.vr)); + DEFINE(VCPU_VRSAVE_TM, offsetof(struct kvm_vcpu, arch.vrsave_tm)); + DEFINE(VCPU_CR_TM, offsetof(struct kvm_vcpu, arch.cr_tm)); ++ DEFINE(VCPU_XER_TM, offsetof(struct kvm_vcpu, arch.xer_tm)); + DEFINE(VCPU_LR_TM, offsetof(struct kvm_vcpu, arch.lr_tm)); + DEFINE(VCPU_CTR_TM, offsetof(struct kvm_vcpu, arch.ctr_tm)); + DEFINE(VCPU_AMR_TM, offsetof(struct kvm_vcpu, arch.amr_tm)); +diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S +index f765b0434731..882578929fe7 100644 +--- a/arch/powerpc/kernel/head_64.S ++++ b/arch/powerpc/kernel/head_64.S +@@ -201,9 +201,9 @@ booting_thread_hwid: + */ + _GLOBAL(book3e_start_thread) + LOAD_REG_IMMEDIATE(r5, MSR_KERNEL) +- cmpi 0, r3, 0 ++ cmpwi r3, 0 + beq 10f +- cmpi 0, r3, 1 ++ cmpwi r3, 1 + beq 11f + /* If the thread id is invalid, just exit. */ + b 13f +@@ -228,9 +228,9 @@ _GLOBAL(book3e_start_thread) + * r3 = the thread physical id + */ + _GLOBAL(book3e_stop_thread) +- cmpi 0, r3, 0 ++ cmpwi r3, 0 + beq 10f +- cmpi 0, r3, 1 ++ cmpwi r3, 1 + beq 10f + /* If the thread id is invalid, just exit. */ + b 13f +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index 2fd5580c8f6e..4c8d344486e6 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -1235,6 +1235,9 @@ static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, u64 id, + case KVM_REG_PPC_TM_CR: + *val = get_reg_val(id, vcpu->arch.cr_tm); + break; ++ case KVM_REG_PPC_TM_XER: ++ *val = get_reg_val(id, vcpu->arch.xer_tm); ++ break; + case KVM_REG_PPC_TM_LR: + *val = get_reg_val(id, vcpu->arch.lr_tm); + break; +@@ -1442,6 +1445,9 @@ static int kvmppc_set_one_reg_hv(struct kvm_vcpu *vcpu, u64 id, + case KVM_REG_PPC_TM_CR: + vcpu->arch.cr_tm = set_reg_val(id, *val); + break; ++ case KVM_REG_PPC_TM_XER: ++ vcpu->arch.xer_tm = set_reg_val(id, *val); ++ break; + case KVM_REG_PPC_TM_LR: + vcpu->arch.lr_tm = set_reg_val(id, *val); + break; +diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c +index 99b4e9d5dd23..5420d060c6f6 100644 +--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c ++++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c +@@ -653,6 +653,8 @@ long kvmppc_h_protect(struct kvm_vcpu *vcpu, unsigned long flags, + HPTE_V_ABSENT); + do_tlbies(kvm, &rb, 1, global_invalidates(kvm, flags), + true); ++ /* Don't lose R/C bit updates done by hardware */ ++ r |= be64_to_cpu(hpte[1]) & (HPTE_R_R | HPTE_R_C); + hpte[1] = cpu_to_be64(r); + } + } +diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +index 975655573844..bf243a4caa63 100644 +--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S ++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +@@ -2579,11 +2579,13 @@ kvmppc_save_tm: + mfctr r7 + mfspr r8, SPRN_AMR + mfspr r10, SPRN_TAR ++ mfxer r11 + std r5, VCPU_LR_TM(r9) + stw r6, VCPU_CR_TM(r9) + std r7, VCPU_CTR_TM(r9) + std r8, VCPU_AMR_TM(r9) + std r10, VCPU_TAR_TM(r9) ++ std r11, VCPU_XER_TM(r9) + + /* Restore r12 as trap number. */ + lwz r12, VCPU_TRAP(r9) +@@ -2676,11 +2678,13 @@ kvmppc_restore_tm: + ld r7, VCPU_CTR_TM(r4) + ld r8, VCPU_AMR_TM(r4) + ld r9, VCPU_TAR_TM(r4) ++ ld r10, VCPU_XER_TM(r4) + mtlr r5 + mtcr r6 + mtctr r7 + mtspr SPRN_AMR, r8 + mtspr SPRN_TAR, r9 ++ mtxer r10 + + /* + * Load up PPR and DSCR values but don't put them in the actual SPRs +diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c +index 7f7ba5f23f13..d027f2eb3559 100644 +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -445,7 +445,7 @@ static void __init setup_resources(void) + * part of the System RAM resource. + */ + if (crashk_res.end) { +- memblock_add(crashk_res.start, resource_size(&crashk_res)); ++ memblock_add_node(crashk_res.start, resource_size(&crashk_res), 0); + memblock_reserve(crashk_res.start, resource_size(&crashk_res)); + insert_resource(&iomem_resource, &crashk_res); + } +diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S +index 0b56666e6039..b84a3496994c 100644 +--- a/arch/x86/entry/entry_32.S ++++ b/arch/x86/entry/entry_32.S +@@ -852,8 +852,8 @@ ftrace_graph_call: + jmp ftrace_stub + #endif + +-.globl ftrace_stub +-ftrace_stub: ++/* This is weak to keep gas from relaxing the jumps */ ++WEAK(ftrace_stub) + ret + END(ftrace_caller) + +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index 8c925ecaf534..7b0f1d932c87 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -364,7 +364,11 @@ int x86_add_exclusive(unsigned int what) + { + int i; + +- if (x86_pmu.lbr_pt_coexist) ++ /* ++ * When lbr_pt_coexist we allow PT to coexist with either LBR or BTS. ++ * LBR and BTS are still mutually exclusive. ++ */ ++ if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt) + return 0; + + if (!atomic_inc_not_zero(&x86_pmu.lbr_exclusive[what])) { +@@ -387,7 +391,7 @@ fail_unlock: + + void x86_del_exclusive(unsigned int what) + { +- if (x86_pmu.lbr_pt_coexist) ++ if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt) + return; + + atomic_dec(&x86_pmu.lbr_exclusive[what]); +diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c +index 3ca87b5a8677..834262aec88d 100644 +--- a/arch/x86/events/intel/cstate.c ++++ b/arch/x86/events/intel/cstate.c +@@ -571,6 +571,9 @@ static int __init cstate_probe(const struct cstate_model *cm) + + static inline void cstate_cleanup(void) + { ++ cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_ONLINE); ++ cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_STARTING); ++ + if (has_cstate_core) + perf_pmu_unregister(&cstate_core_pmu); + +@@ -583,16 +586,16 @@ static int __init cstate_init(void) + int err; + + cpuhp_setup_state(CPUHP_AP_PERF_X86_CSTATE_STARTING, +- "AP_PERF_X86_CSTATE_STARTING", cstate_cpu_init, +- NULL); ++ "perf/x86/cstate:starting", cstate_cpu_init, NULL); + cpuhp_setup_state(CPUHP_AP_PERF_X86_CSTATE_ONLINE, +- "AP_PERF_X86_CSTATE_ONLINE", NULL, cstate_cpu_exit); ++ "perf/x86/cstate:online", NULL, cstate_cpu_exit); + + if (has_cstate_core) { + err = perf_pmu_register(&cstate_core_pmu, cstate_core_pmu.name, -1); + if (err) { + has_cstate_core = false; + pr_info("Failed to register cstate core pmu\n"); ++ cstate_cleanup(); + return err; + } + } +@@ -606,8 +609,7 @@ static int __init cstate_init(void) + return err; + } + } +- +- return err; ++ return 0; + } + + static int __init cstate_pmu_init(void) +@@ -632,8 +634,6 @@ module_init(cstate_pmu_init); + + static void __exit cstate_pmu_exit(void) + { +- cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_ONLINE); +- cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_STARTING); + cstate_cleanup(); + } + module_exit(cstate_pmu_exit); +diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h +index 181c238d4df9..4ab002d4c9fd 100644 +--- a/arch/x86/events/perf_event.h ++++ b/arch/x86/events/perf_event.h +@@ -601,7 +601,7 @@ struct x86_pmu { + u64 lbr_sel_mask; /* LBR_SELECT valid bits */ + const int *lbr_sel_map; /* lbr_select mappings */ + bool lbr_double_abort; /* duplicated lbr aborts */ +- bool lbr_pt_coexist; /* LBR may coexist with PT */ ++ bool lbr_pt_coexist; /* (LBR|BTS) may coexist with PT */ + + /* + * Intel PT/LBR/BTS are exclusive +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 5cede40e2552..7a72db5350aa 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -1336,10 +1336,10 @@ static inline bool nested_cpu_has_posted_intr(struct vmcs12 *vmcs12) + return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR; + } + +-static inline bool is_exception(u32 intr_info) ++static inline bool is_nmi(u32 intr_info) + { + return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK)) +- == (INTR_TYPE_HARD_EXCEPTION | INTR_INFO_VALID_MASK); ++ == (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK); + } + + static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason, +@@ -5467,7 +5467,7 @@ static int handle_exception(struct kvm_vcpu *vcpu) + if (is_machine_check(intr_info)) + return handle_machine_check(vcpu); + +- if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR) ++ if (is_nmi(intr_info)) + return 1; /* already handled by vmx_vcpu_run() */ + + if (is_no_device(intr_info)) { +@@ -7974,7 +7974,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu) + + switch (exit_reason) { + case EXIT_REASON_EXCEPTION_NMI: +- if (!is_exception(intr_info)) ++ if (is_nmi(intr_info)) + return false; + else if (is_page_fault(intr_info)) + return enable_ept; +@@ -8572,8 +8572,7 @@ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx) + kvm_machine_check(); + + /* We need to handle NMIs before interrupts are enabled */ +- if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR && +- (exit_intr_info & INTR_INFO_VALID_MASK)) { ++ if (is_nmi(exit_intr_info)) { + kvm_before_handle_nmi(&vmx->vcpu); + asm("int $2"); + kvm_after_handle_nmi(&vmx->vcpu); +diff --git a/block/bsg.c b/block/bsg.c +index d214e929ce18..b9a53615bdef 100644 +--- a/block/bsg.c ++++ b/block/bsg.c +@@ -655,6 +655,9 @@ bsg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) + + dprintk("%s: write %Zd bytes\n", bd->name, count); + ++ if (unlikely(segment_eq(get_fs(), KERNEL_DS))) ++ return -EINVAL; ++ + bsg_set_block(bd, file); + + bytes_written = 0; +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index a6b36fc53aec..02ded25c82e4 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -296,6 +296,26 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V131"), + }, + }, ++ { ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1123661 */ ++ .callback = video_detect_force_native, ++ .ident = "Dell XPS 17 L702X", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell System XPS L702X"), ++ }, ++ }, ++ { ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1204476 */ ++ /* https://bugs.launchpad.net/ubuntu/+source/linux-lts-trusty/+bug/1416940 */ ++ .callback = video_detect_force_native, ++ .ident = "HP Pavilion dv6", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv6 Notebook PC"), ++ }, ++ }, ++ + { }, + }; + +diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c +index 22d1760a4278..a95e1e572697 100644 +--- a/drivers/base/firmware_class.c ++++ b/drivers/base/firmware_class.c +@@ -955,13 +955,14 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, + timeout = MAX_JIFFY_OFFSET; + } + +- retval = wait_for_completion_interruptible_timeout(&buf->completion, ++ timeout = wait_for_completion_interruptible_timeout(&buf->completion, + timeout); +- if (retval == -ERESTARTSYS || !retval) { ++ if (timeout == -ERESTARTSYS || !timeout) { ++ retval = timeout; + mutex_lock(&fw_lock); + fw_load_abort(fw_priv); + mutex_unlock(&fw_lock); +- } else if (retval > 0) { ++ } else if (timeout > 0) { + retval = 0; + } + +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index 0fc71cbaa440..3250694fd793 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -751,7 +751,9 @@ static void bcm2835_pll_divider_off(struct clk_hw *hw) + cprman_write(cprman, data->cm_reg, + (cprman_read(cprman, data->cm_reg) & + ~data->load_mask) | data->hold_mask); +- cprman_write(cprman, data->a2w_reg, A2W_PLL_CHANNEL_DISABLE); ++ cprman_write(cprman, data->a2w_reg, ++ cprman_read(cprman, data->a2w_reg) | ++ A2W_PLL_CHANNEL_DISABLE); + spin_unlock(&cprman->regs_lock); + } + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 15704aaf9e4e..a8eea8a69da3 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -984,7 +984,8 @@ static int gpio_chrdev_open(struct inode *inode, struct file *filp) + return -ENODEV; + get_device(&gdev->dev); + filp->private_data = gdev; +- return 0; ++ ++ return nonseekable_open(inode, filp); + } + + /** +@@ -1009,7 +1010,7 @@ static const struct file_operations gpio_fileops = { + .release = gpio_chrdev_release, + .open = gpio_chrdev_open, + .owner = THIS_MODULE, +- .llseek = noop_llseek, ++ .llseek = no_llseek, + .unlocked_ioctl = gpio_ioctl, + #ifdef CONFIG_COMPAT + .compat_ioctl = gpio_ioctl_compat, +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +index b8184617ca25..8199232c2fbd 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +@@ -3798,8 +3798,12 @@ static int gfx_v8_0_init_save_restore_list(struct amdgpu_device *adev) + temp = mmRLC_SRM_INDEX_CNTL_ADDR_0; + data = mmRLC_SRM_INDEX_CNTL_DATA_0; + for (i = 0; i < sizeof(unique_indices) / sizeof(int); i++) { +- amdgpu_mm_wreg(adev, temp + i, unique_indices[i] & 0x3FFFF, false); +- amdgpu_mm_wreg(adev, data + i, unique_indices[i] >> 20, false); ++ if (unique_indices[i] != 0) { ++ amdgpu_mm_wreg(adev, temp + i, ++ unique_indices[i] & 0x3FFFF, false); ++ amdgpu_mm_wreg(adev, data + i, ++ unique_indices[i] >> 20, false); ++ } + } + kfree(register_list_format); + +@@ -5735,29 +5739,24 @@ static void gfx_v8_0_update_coarse_grain_clock_gating(struct amdgpu_device *adev + adev->gfx.rlc.funcs->enter_safe_mode(adev); + + if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGCG)) { +- /* 1 enable cntx_empty_int_enable/cntx_busy_int_enable/ +- * Cmp_busy/GFX_Idle interrupts +- */ +- gfx_v8_0_enable_gui_idle_interrupt(adev, true); +- + temp1 = data1 = RREG32(mmRLC_CGTT_MGCG_OVERRIDE); + data1 &= ~RLC_CGTT_MGCG_OVERRIDE__CGCG_MASK; + if (temp1 != data1) + WREG32(mmRLC_CGTT_MGCG_OVERRIDE, data1); + +- /* 2 wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER idle */ ++ /* : wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER idle */ + gfx_v8_0_wait_for_rlc_serdes(adev); + +- /* 3 - clear cgcg override */ ++ /* 2 - clear cgcg override */ + gfx_v8_0_send_serdes_cmd(adev, BPM_REG_CGCG_OVERRIDE, CLE_BPM_SERDES_CMD); + + /* wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER idle */ + gfx_v8_0_wait_for_rlc_serdes(adev); + +- /* 4 - write cmd to set CGLS */ ++ /* 3 - write cmd to set CGLS */ + gfx_v8_0_send_serdes_cmd(adev, BPM_REG_CGLS_EN, SET_BPM_SERDES_CMD); + +- /* 5 - enable cgcg */ ++ /* 4 - enable cgcg */ + data |= RLC_CGCG_CGLS_CTRL__CGCG_EN_MASK; + + if (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGLS) { +@@ -5775,6 +5774,11 @@ static void gfx_v8_0_update_coarse_grain_clock_gating(struct amdgpu_device *adev + + if (temp != data) + WREG32(mmRLC_CGCG_CGLS_CTRL, data); ++ ++ /* 5 enable cntx_empty_int_enable/cntx_busy_int_enable/ ++ * Cmp_busy/GFX_Idle interrupts ++ */ ++ gfx_v8_0_enable_gui_idle_interrupt(adev, true); + } else { + /* disable cntx_empty_int_enable & GFX Idle interrupt */ + gfx_v8_0_enable_gui_idle_interrupt(adev, false); +diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c +index 904beaa932d0..f75c6421db62 100644 +--- a/drivers/gpu/drm/ast/ast_main.c ++++ b/drivers/gpu/drm/ast/ast_main.c +@@ -223,7 +223,8 @@ static int ast_get_dram_info(struct drm_device *dev) + ast_write32(ast, 0x10000, 0xfc600309); + + do { +- ; ++ if (pci_channel_offline(dev->pdev)) ++ return -EIO; + } while (ast_read32(ast, 0x10000) != 0x01); + data = ast_read32(ast, 0x10004); + +@@ -428,7 +429,9 @@ int ast_driver_load(struct drm_device *dev, unsigned long flags) + ast_detect_chip(dev, &need_post); + + if (ast->chip != AST1180) { +- ast_get_dram_info(dev); ++ ret = ast_get_dram_info(dev); ++ if (ret) ++ goto out_free; + ast->vram_size = ast_get_vram_info(dev); + DRM_INFO("dram %d %d %d %08x\n", ast->mclk, ast->dram_type, ast->dram_bus_width, ast->vram_size); + } +diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c +index 50eb944fb78a..8f3ca526bd1b 100644 +--- a/drivers/gpu/drm/gma500/psb_drv.c ++++ b/drivers/gpu/drm/gma500/psb_drv.c +@@ -473,6 +473,9 @@ static const struct file_operations psb_gem_fops = { + .open = drm_open, + .release = drm_release, + .unlocked_ioctl = psb_unlocked_ioctl, ++#ifdef CONFIG_COMPAT ++ .compat_ioctl = drm_compat_ioctl, ++#endif + .mmap = drm_gem_mmap, + .poll = drm_poll, + .read = drm_read, +diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c +index 2bb69f3c5b84..b386b3162e29 100644 +--- a/drivers/gpu/drm/i915/i915_gem_stolen.c ++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c +@@ -55,10 +55,9 @@ int i915_gem_stolen_insert_node_in_range(struct drm_i915_private *dev_priv, + return -ENODEV; + + /* See the comment at the drm_mm_init() call for more about this check. +- * WaSkipStolenMemoryFirstPage:bdw,chv,kbl (incomplete) ++ * WaSkipStolenMemoryFirstPage:bdw+ (incomplete) + */ +- if (start < 4096 && (IS_GEN8(dev_priv) || +- IS_KBL_REVID(dev_priv, 0, KBL_REVID_A0))) ++ if (start < 4096 && INTEL_GEN(dev_priv) >= 8) + start = 4096; + + mutex_lock(&dev_priv->mm.stolen_lock); +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 35d385d70d8e..6bc93ba7e1dd 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -13494,8 +13494,9 @@ static int intel_modeset_checks(struct drm_atomic_state *state) + + DRM_DEBUG_KMS("New cdclk calculated to be atomic %u, actual %u\n", + intel_state->cdclk, intel_state->dev_cdclk); +- } else ++ } else { + to_intel_atomic_state(state)->cdclk = dev_priv->atomic_cdclk_freq; ++ } + + intel_modeset_clear_plls(state); + +@@ -13596,8 +13597,9 @@ static int intel_atomic_check(struct drm_device *dev, + + if (ret) + return ret; +- } else +- intel_state->cdclk = dev_priv->cdclk_freq; ++ } else { ++ intel_state->cdclk = dev_priv->atomic_cdclk_freq; ++ } + + ret = drm_atomic_helper_check_planes(dev, state); + if (ret) +@@ -15902,6 +15904,7 @@ void intel_modeset_init(struct drm_device *dev) + + intel_update_czclk(dev_priv); + intel_update_cdclk(dev); ++ dev_priv->atomic_cdclk_freq = dev_priv->cdclk_freq; + + intel_shared_dpll_init(dev); + +diff --git a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c +index cd154ce6b6c1..34601574fc6e 100644 +--- a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c ++++ b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c +@@ -296,7 +296,8 @@ static void chv_exec_gpio(struct drm_i915_private *dev_priv, + mutex_lock(&dev_priv->sb_lock); + vlv_iosf_sb_write(dev_priv, port, cfg1, 0); + vlv_iosf_sb_write(dev_priv, port, cfg0, +- CHV_GPIO_GPIOCFG_GPO | CHV_GPIO_GPIOTXSTATE(value)); ++ CHV_GPIO_GPIOEN | CHV_GPIO_GPIOCFG_GPO | ++ CHV_GPIO_GPIOTXSTATE(value)); + mutex_unlock(&dev_priv->sb_lock); + } + +diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c +index 1c603bbe5784..07a7cc0d4ebb 100644 +--- a/drivers/gpu/drm/i915/intel_runtime_pm.c ++++ b/drivers/gpu/drm/i915/intel_runtime_pm.c +@@ -1062,7 +1062,18 @@ static bool vlv_power_well_enabled(struct drm_i915_private *dev_priv, + + static void vlv_init_display_clock_gating(struct drm_i915_private *dev_priv) + { +- I915_WRITE(DSPCLK_GATE_D, VRHUNIT_CLOCK_GATE_DISABLE); ++ u32 val; ++ ++ /* ++ * On driver load, a pipe may be active and driving a DSI display. ++ * Preserve DPOUNIT_CLOCK_GATE_DISABLE to avoid the pipe getting stuck ++ * (and never recovering) in this case. intel_dsi_post_disable() will ++ * clear it when we turn off the display. ++ */ ++ val = I915_READ(DSPCLK_GATE_D); ++ val &= DPOUNIT_CLOCK_GATE_DISABLE; ++ val |= VRHUNIT_CLOCK_GATE_DISABLE; ++ I915_WRITE(DSPCLK_GATE_D, val); + + /* + * Disable trickle feed and enable pnd deadline calculation +diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c +index a1570b109434..23ffe8571a99 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_bios.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bios.c +@@ -333,6 +333,9 @@ get_fp_strap(struct drm_device *dev, struct nvbios *bios) + if (bios->major_version < 5 && bios->data[0x48] & 0x4) + return NVReadVgaCrtc5758(dev, 0, 0xf) & 0xf; + ++ if (drm->device.info.family >= NV_DEVICE_INFO_V0_MAXWELL) ++ return nvif_rd32(device, 0x001800) & 0x0000000f; ++ else + if (drm->device.info.family >= NV_DEVICE_INFO_V0_TESLA) + return (nvif_rd32(device, NV_PEXTDEV_BOOT_0) >> 24) & 0xf; + else +diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c +index 864323b19cf7..fad263b3c7f7 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_bo.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c +@@ -1209,6 +1209,7 @@ nouveau_bo_move_ntfy(struct ttm_buffer_object *bo, struct ttm_mem_reg *new_mem) + nvbo->page_shift != vma->vm->mmu->lpg_shift)) { + nvkm_vm_map(vma, new_mem->mm_node); + } else { ++ WARN_ON(ttm_bo_wait(bo, false, false)); + nvkm_vm_unmap(vma); + } + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c +index 7218a067a6c5..e0d7f8472ac6 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c +@@ -1851,7 +1851,7 @@ nvf1_chipset = { + .fb = gk104_fb_new, + .fuse = gf100_fuse_new, + .gpio = gk104_gpio_new, +- .i2c = gf119_i2c_new, ++ .i2c = gk104_i2c_new, + .ibus = gk104_ibus_new, + .iccsense = gf100_iccsense_new, + .imem = nv50_instmem_new, +@@ -1965,7 +1965,7 @@ nv117_chipset = { + .fb = gm107_fb_new, + .fuse = gm107_fuse_new, + .gpio = gk104_gpio_new, +- .i2c = gf119_i2c_new, ++ .i2c = gk104_i2c_new, + .ibus = gk104_ibus_new, + .iccsense = gf100_iccsense_new, + .imem = nv50_instmem_new, +@@ -1999,7 +1999,7 @@ nv118_chipset = { + .fb = gm107_fb_new, + .fuse = gm107_fuse_new, + .gpio = gk104_gpio_new, +- .i2c = gf119_i2c_new, ++ .i2c = gk104_i2c_new, + .ibus = gk104_ibus_new, + .iccsense = gf100_iccsense_new, + .imem = nv50_instmem_new, +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c +index cbc67f262322..12d964260a29 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c +@@ -60,6 +60,7 @@ gf100_fifo_gpfifo_engine_fini(struct nvkm_fifo_chan *base, + struct nvkm_gpuobj *inst = chan->base.inst; + int ret = 0; + ++ mutex_lock(&subdev->mutex); + nvkm_wr32(device, 0x002634, chan->base.chid); + if (nvkm_msec(device, 2000, + if (nvkm_rd32(device, 0x002634) == chan->base.chid) +@@ -67,10 +68,12 @@ gf100_fifo_gpfifo_engine_fini(struct nvkm_fifo_chan *base, + ) < 0) { + nvkm_error(subdev, "channel %d [%s] kick timeout\n", + chan->base.chid, chan->base.object.client->name); +- ret = -EBUSY; +- if (suspend) +- return ret; ++ ret = -ETIMEDOUT; + } ++ mutex_unlock(&subdev->mutex); ++ ++ if (ret && suspend) ++ return ret; + + if (offset) { + nvkm_kmap(inst); +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c +index ed4351032ed6..a2df4f3e7763 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c +@@ -40,7 +40,9 @@ gk104_fifo_gpfifo_kick(struct gk104_fifo_chan *chan) + struct nvkm_subdev *subdev = &fifo->base.engine.subdev; + struct nvkm_device *device = subdev->device; + struct nvkm_client *client = chan->base.object.client; ++ int ret = 0; + ++ mutex_lock(&subdev->mutex); + nvkm_wr32(device, 0x002634, chan->base.chid); + if (nvkm_msec(device, 2000, + if (!(nvkm_rd32(device, 0x002634) & 0x00100000)) +@@ -48,10 +50,10 @@ gk104_fifo_gpfifo_kick(struct gk104_fifo_chan *chan) + ) < 0) { + nvkm_error(subdev, "channel %d [%s] kick timeout\n", + chan->base.chid, client->name); +- return -EBUSY; ++ ret = -ETIMEDOUT; + } +- +- return 0; ++ mutex_unlock(&subdev->mutex); ++ return ret; + } + + static u32 +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +index 157919c788e6..6584d505460c 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +@@ -1756,6 +1756,50 @@ gf100_gr_ = { + }; + + int ++gf100_gr_ctor_fw_legacy(struct gf100_gr *gr, const char *fwname, ++ struct gf100_gr_fuc *fuc, int ret) ++{ ++ struct nvkm_subdev *subdev = &gr->base.engine.subdev; ++ struct nvkm_device *device = subdev->device; ++ const struct firmware *fw; ++ char f[32]; ++ ++ /* see if this firmware has a legacy path */ ++ if (!strcmp(fwname, "fecs_inst")) ++ fwname = "fuc409c"; ++ else if (!strcmp(fwname, "fecs_data")) ++ fwname = "fuc409d"; ++ else if (!strcmp(fwname, "gpccs_inst")) ++ fwname = "fuc41ac"; ++ else if (!strcmp(fwname, "gpccs_data")) ++ fwname = "fuc41ad"; ++ else { ++ /* nope, let's just return the error we got */ ++ nvkm_error(subdev, "failed to load %s\n", fwname); ++ return ret; ++ } ++ ++ /* yes, try to load from the legacy path */ ++ nvkm_debug(subdev, "%s: falling back to legacy path\n", fwname); ++ ++ snprintf(f, sizeof(f), "nouveau/nv%02x_%s", device->chipset, fwname); ++ ret = request_firmware(&fw, f, device->dev); ++ if (ret) { ++ snprintf(f, sizeof(f), "nouveau/%s", fwname); ++ ret = request_firmware(&fw, f, device->dev); ++ if (ret) { ++ nvkm_error(subdev, "failed to load %s\n", fwname); ++ return ret; ++ } ++ } ++ ++ fuc->size = fw->size; ++ fuc->data = kmemdup(fw->data, fuc->size, GFP_KERNEL); ++ release_firmware(fw); ++ return (fuc->data != NULL) ? 0 : -ENOMEM; ++} ++ ++int + gf100_gr_ctor_fw(struct gf100_gr *gr, const char *fwname, + struct gf100_gr_fuc *fuc) + { +@@ -1765,10 +1809,8 @@ gf100_gr_ctor_fw(struct gf100_gr *gr, const char *fwname, + int ret; + + ret = nvkm_firmware_get(device, fwname, &fw); +- if (ret) { +- nvkm_error(subdev, "failed to load %s\n", fwname); +- return ret; +- } ++ if (ret) ++ return gf100_gr_ctor_fw_legacy(gr, fwname, fuc, ret); + + fuc->size = fw->size; + fuc->data = kmemdup(fw->data, fuc->size, GFP_KERNEL); +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h +index 212800ecdce9..7d1d3c6b4b72 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h +@@ -12,6 +12,7 @@ struct nvbios_source { + bool rw; + bool ignore_checksum; + bool no_pcir; ++ bool require_checksum; + }; + + int nvbios_extend(struct nvkm_bios *, u32 length); +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c +index b2557e87afdd..7deb81b6dbac 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c +@@ -86,9 +86,12 @@ shadow_image(struct nvkm_bios *bios, int idx, u32 offset, struct shadow *mthd) + nvbios_checksum(&bios->data[image.base], image.size)) { + nvkm_debug(subdev, "%08x: checksum failed\n", + image.base); +- if (mthd->func->rw) ++ if (!mthd->func->require_checksum) { ++ if (mthd->func->rw) ++ score += 1; + score += 1; +- score += 1; ++ } else ++ return 0; + } else { + score += 3; + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c +index 8fecb5ff22a0..06572f8ce914 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c +@@ -99,6 +99,7 @@ nvbios_acpi_fast = { + .init = acpi_init, + .read = acpi_read_fast, + .rw = false, ++ .require_checksum = true, + }; + + const struct nvbios_source +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c +index 39c2a38e54f7..0c7ef250dcaf 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c +@@ -47,8 +47,10 @@ nvkm_ltc_tags_clear(struct nvkm_ltc *ltc, u32 first, u32 count) + + BUG_ON((first > limit) || (limit >= ltc->num_tags)); + ++ mutex_lock(<c->subdev.mutex); + ltc->func->cbc_clear(ltc, first, limit); + ltc->func->cbc_wait(ltc); ++ mutex_unlock(<c->subdev.mutex); + } + + int +diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c +index 2a10e24b34b1..87a72476d313 100644 +--- a/drivers/gpu/drm/radeon/radeon_cursor.c ++++ b/drivers/gpu/drm/radeon/radeon_cursor.c +@@ -90,6 +90,9 @@ static void radeon_show_cursor(struct drm_crtc *crtc) + struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc); + struct radeon_device *rdev = crtc->dev->dev_private; + ++ if (radeon_crtc->cursor_out_of_bounds) ++ return; ++ + if (ASIC_IS_DCE4(rdev)) { + WREG32(EVERGREEN_CUR_SURFACE_ADDRESS_HIGH + radeon_crtc->crtc_offset, + upper_32_bits(radeon_crtc->cursor_addr)); +@@ -148,16 +151,17 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y) + x += crtc->x; + y += crtc->y; + } +- DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y); + +- if (x < 0) { ++ if (x < 0) + xorigin = min(-x, radeon_crtc->max_cursor_width - 1); +- x = 0; +- } +- if (y < 0) { ++ if (y < 0) + yorigin = min(-y, radeon_crtc->max_cursor_height - 1); +- y = 0; ++ ++ if (!ASIC_IS_AVIVO(rdev)) { ++ x += crtc->x; ++ y += crtc->y; + } ++ DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y); + + /* fixed on DCE6 and newer */ + if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE6(rdev)) { +@@ -180,27 +184,31 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y) + if (i > 1) { + int cursor_end, frame_end; + +- cursor_end = x - xorigin + w; ++ cursor_end = x + w; + frame_end = crtc->x + crtc->mode.crtc_hdisplay; + if (cursor_end >= frame_end) { + w = w - (cursor_end - frame_end); + if (!(frame_end & 0x7f)) + w--; +- } else { +- if (!(cursor_end & 0x7f)) +- w--; ++ } else if (cursor_end <= 0) { ++ goto out_of_bounds; ++ } else if (!(cursor_end & 0x7f)) { ++ w--; + } + if (w <= 0) { +- w = 1; +- cursor_end = x - xorigin + w; +- if (!(cursor_end & 0x7f)) { +- x--; +- WARN_ON_ONCE(x < 0); +- } ++ goto out_of_bounds; + } + } + } + ++ if (x <= (crtc->x - w) || y <= (crtc->y - radeon_crtc->cursor_height) || ++ x >= (crtc->x + crtc->mode.crtc_hdisplay) || ++ y >= (crtc->y + crtc->mode.crtc_vdisplay)) ++ goto out_of_bounds; ++ ++ x += xorigin; ++ y += yorigin; ++ + if (ASIC_IS_DCE4(rdev)) { + WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset, (x << 16) | y); + WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin); +@@ -212,6 +220,9 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y) + WREG32(AVIVO_D1CUR_SIZE + radeon_crtc->crtc_offset, + ((w - 1) << 16) | (radeon_crtc->cursor_height - 1)); + } else { ++ x -= crtc->x; ++ y -= crtc->y; ++ + if (crtc->mode.flags & DRM_MODE_FLAG_DBLSCAN) + y *= 2; + +@@ -232,6 +243,19 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y) + radeon_crtc->cursor_x = x; + radeon_crtc->cursor_y = y; + ++ if (radeon_crtc->cursor_out_of_bounds) { ++ radeon_crtc->cursor_out_of_bounds = false; ++ if (radeon_crtc->cursor_bo) ++ radeon_show_cursor(crtc); ++ } ++ ++ return 0; ++ ++ out_of_bounds: ++ if (!radeon_crtc->cursor_out_of_bounds) { ++ radeon_hide_cursor(crtc); ++ radeon_crtc->cursor_out_of_bounds = true; ++ } + return 0; + } + +@@ -297,22 +321,23 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc, + return ret; + } + +- radeon_crtc->cursor_width = width; +- radeon_crtc->cursor_height = height; +- + radeon_lock_cursor(crtc, true); + +- if (hot_x != radeon_crtc->cursor_hot_x || ++ if (width != radeon_crtc->cursor_width || ++ height != radeon_crtc->cursor_height || ++ hot_x != radeon_crtc->cursor_hot_x || + hot_y != radeon_crtc->cursor_hot_y) { + int x, y; + + x = radeon_crtc->cursor_x + radeon_crtc->cursor_hot_x - hot_x; + y = radeon_crtc->cursor_y + radeon_crtc->cursor_hot_y - hot_y; + +- radeon_cursor_move_locked(crtc, x, y); +- ++ radeon_crtc->cursor_width = width; ++ radeon_crtc->cursor_height = height; + radeon_crtc->cursor_hot_x = hot_x; + radeon_crtc->cursor_hot_y = hot_y; ++ ++ radeon_cursor_move_locked(crtc, x, y); + } + + radeon_show_cursor(crtc); +diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h +index bb75201a24ba..f1da484864a9 100644 +--- a/drivers/gpu/drm/radeon/radeon_mode.h ++++ b/drivers/gpu/drm/radeon/radeon_mode.h +@@ -330,6 +330,7 @@ struct radeon_crtc { + u16 lut_r[256], lut_g[256], lut_b[256]; + bool enabled; + bool can_tile; ++ bool cursor_out_of_bounds; + uint32_t crtc_offset; + struct drm_gem_object *cursor_bo; + uint64_t cursor_addr; +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index 2523ca96c6c7..2297ec7954af 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -1722,6 +1722,7 @@ static int si_init_microcode(struct radeon_device *rdev) + (rdev->pdev->revision == 0x80) || + (rdev->pdev->revision == 0x81) || + (rdev->pdev->revision == 0x83) || ++ (rdev->pdev->revision == 0x87) || + (rdev->pdev->device == 0x6604) || + (rdev->pdev->device == 0x6605)) + new_smc = true; +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index c49934527a87..8b5e697f2549 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -3026,6 +3026,7 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + (rdev->pdev->revision == 0x80) || + (rdev->pdev->revision == 0x81) || + (rdev->pdev->revision == 0x83) || ++ (rdev->pdev->revision == 0x87) || + (rdev->pdev->device == 0x6604) || + (rdev->pdev->device == 0x6605)) { + max_sclk = 75000; +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index b6c1211b4df7..04508526f1d5 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -348,6 +348,7 @@ void vmbus_free_channels(void) + { + struct vmbus_channel *channel, *tmp; + ++ mutex_lock(&vmbus_connection.channel_mutex); + list_for_each_entry_safe(channel, tmp, &vmbus_connection.chn_list, + listentry) { + /* hv_process_channel_removal() needs this */ +@@ -355,6 +356,7 @@ void vmbus_free_channels(void) + + vmbus_device_unregister(channel->device_obj); + } ++ mutex_unlock(&vmbus_connection.channel_mutex); + } + + /* +diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c +index 51f81d64ca37..a6ea387b5b00 100644 +--- a/drivers/hwtracing/stm/core.c ++++ b/drivers/hwtracing/stm/core.c +@@ -361,7 +361,7 @@ static int stm_char_open(struct inode *inode, struct file *file) + struct stm_file *stmf; + struct device *dev; + unsigned int major = imajor(inode); +- int err = -ENODEV; ++ int err = -ENOMEM; + + dev = class_find_device(&stm_class, NULL, &major, major_match); + if (!dev) +@@ -369,8 +369,9 @@ static int stm_char_open(struct inode *inode, struct file *file) + + stmf = kzalloc(sizeof(*stmf), GFP_KERNEL); + if (!stmf) +- return -ENOMEM; ++ goto err_put_device; + ++ err = -ENODEV; + stm_output_init(&stmf->output); + stmf->stm = to_stm_device(dev); + +@@ -382,9 +383,10 @@ static int stm_char_open(struct inode *inode, struct file *file) + return nonseekable_open(inode, file); + + err_free: ++ kfree(stmf); ++err_put_device: + /* matches class_find_device() above */ + put_device(dev); +- kfree(stmf); + + return err; + } +diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c +index 2d49228f28b2..85b2bfedd6be 100644 +--- a/drivers/infiniband/core/mad.c ++++ b/drivers/infiniband/core/mad.c +@@ -1746,7 +1746,7 @@ find_mad_agent(struct ib_mad_port_private *port_priv, + if (!class) + goto out; + if (convert_mgmt_class(mad_hdr->mgmt_class) >= +- IB_MGMT_MAX_METHODS) ++ ARRAY_SIZE(class->method_table)) + goto out; + method = class->method_table[convert_mgmt_class( + mad_hdr->mgmt_class)]; +diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c +index 51c79b2fb0b8..45523cf1b83b 100644 +--- a/drivers/infiniband/core/multicast.c ++++ b/drivers/infiniband/core/multicast.c +@@ -518,8 +518,11 @@ static void join_handler(int status, struct ib_sa_mcmember_rec *rec, + process_join_error(group, status); + else { + int mgids_changed, is_mgid0; +- ib_find_pkey(group->port->dev->device, group->port->port_num, +- be16_to_cpu(rec->pkey), &pkey_index); ++ ++ if (ib_find_pkey(group->port->dev->device, ++ group->port->port_num, be16_to_cpu(rec->pkey), ++ &pkey_index)) ++ pkey_index = MCAST_INVALID_PKEY_INDEX; + + spin_lock_irq(&group->port->lock); + if (group->state == MCAST_BUSY && +diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +index 6329c971c22f..4b892ca2b13a 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +@@ -2501,7 +2501,7 @@ static int i40iw_get_hw_stats(struct ib_device *ibdev, + return -ENOSYS; + } + +- memcpy(&stats->value[0], &hw_stats, sizeof(*hw_stats)); ++ memcpy(&stats->value[0], hw_stats, sizeof(*hw_stats)); + + return stats->num_counters; + } +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index f724a7ef9b67..979e445186cf 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -850,4 +850,5 @@ void rxe_qp_cleanup(void *arg) + free_rd_atomic_resources(qp); + + kernel_sock_shutdown(qp->sk, SHUT_RDWR); ++ sock_release(qp->sk); + } +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +index 1909dd252c94..fddff403d5d2 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +@@ -575,8 +575,11 @@ void ipoib_mcast_join_task(struct work_struct *work) + if (!test_bit(IPOIB_FLAG_OPER_UP, &priv->flags)) + return; + +- if (ib_query_port(priv->ca, priv->port, &port_attr) || +- port_attr.state != IB_PORT_ACTIVE) { ++ if (ib_query_port(priv->ca, priv->port, &port_attr)) { ++ ipoib_dbg(priv, "ib_query_port() failed\n"); ++ return; ++ } ++ if (port_attr.state != IB_PORT_ACTIVE) { + ipoib_dbg(priv, "port state is not ACTIVE (state = %d) suspending join task\n", + port_attr.state); + return; +diff --git a/drivers/input/misc/drv260x.c b/drivers/input/misc/drv260x.c +index 2adfd86c869a..930424e55439 100644 +--- a/drivers/input/misc/drv260x.c ++++ b/drivers/input/misc/drv260x.c +@@ -592,7 +592,6 @@ static int drv260x_probe(struct i2c_client *client, + } + + haptics->input_dev->name = "drv260x:haptics"; +- haptics->input_dev->dev.parent = client->dev.parent; + haptics->input_dev->close = drv260x_close; + input_set_drvdata(haptics->input_dev, haptics); + input_set_capability(haptics->input_dev, EV_FF, FF_RUMBLE); +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index ee7fc3701700..a87549be8e53 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -7017,6 +7017,15 @@ static int raid5_run(struct mddev *mddev) + stripe = (stripe | (stripe-1)) + 1; + mddev->queue->limits.discard_alignment = stripe; + mddev->queue->limits.discard_granularity = stripe; ++ ++ /* ++ * We use 16-bit counter of active stripes in bi_phys_segments ++ * (minus one for over-loaded initialization) ++ */ ++ blk_queue_max_hw_sectors(mddev->queue, 0xfffe * STRIPE_SECTORS); ++ blk_queue_max_discard_sectors(mddev->queue, ++ 0xfffe * STRIPE_SECTORS); ++ + /* + * unaligned part of discard request will be ignored, so can't + * guarantee discard_zeroes_data +diff --git a/drivers/media/dvb-frontends/mn88472.c b/drivers/media/dvb-frontends/mn88472.c +index 18fb2df1e2bd..72650116732c 100644 +--- a/drivers/media/dvb-frontends/mn88472.c ++++ b/drivers/media/dvb-frontends/mn88472.c +@@ -488,18 +488,6 @@ static int mn88472_probe(struct i2c_client *client, + goto err_kfree; + } + +- /* Check demod answers with correct chip id */ +- ret = regmap_read(dev->regmap[0], 0xff, &utmp); +- if (ret) +- goto err_regmap_0_regmap_exit; +- +- dev_dbg(&client->dev, "chip id=%02x\n", utmp); +- +- if (utmp != 0x02) { +- ret = -ENODEV; +- goto err_regmap_0_regmap_exit; +- } +- + /* + * Chip has three I2C addresses for different register banks. Used + * addresses are 0x18, 0x1a and 0x1c. We register two dummy clients, +@@ -536,6 +524,18 @@ static int mn88472_probe(struct i2c_client *client, + } + i2c_set_clientdata(dev->client[2], dev); + ++ /* Check demod answers with correct chip id */ ++ ret = regmap_read(dev->regmap[2], 0xff, &utmp); ++ if (ret) ++ goto err_regmap_2_regmap_exit; ++ ++ dev_dbg(&client->dev, "chip id=%02x\n", utmp); ++ ++ if (utmp != 0x02) { ++ ret = -ENODEV; ++ goto err_regmap_2_regmap_exit; ++ } ++ + /* Sleep because chip is active by default */ + ret = regmap_write(dev->regmap[2], 0x05, 0x3e); + if (ret) +diff --git a/drivers/media/dvb-frontends/mn88473.c b/drivers/media/dvb-frontends/mn88473.c +index 451974a1d7ed..2932bdc8fa94 100644 +--- a/drivers/media/dvb-frontends/mn88473.c ++++ b/drivers/media/dvb-frontends/mn88473.c +@@ -485,18 +485,6 @@ static int mn88473_probe(struct i2c_client *client, + goto err_kfree; + } + +- /* Check demod answers with correct chip id */ +- ret = regmap_read(dev->regmap[0], 0xff, &uitmp); +- if (ret) +- goto err_regmap_0_regmap_exit; +- +- dev_dbg(&client->dev, "chip id=%02x\n", uitmp); +- +- if (uitmp != 0x03) { +- ret = -ENODEV; +- goto err_regmap_0_regmap_exit; +- } +- + /* + * Chip has three I2C addresses for different register banks. Used + * addresses are 0x18, 0x1a and 0x1c. We register two dummy clients, +@@ -533,6 +521,18 @@ static int mn88473_probe(struct i2c_client *client, + } + i2c_set_clientdata(dev->client[2], dev); + ++ /* Check demod answers with correct chip id */ ++ ret = regmap_read(dev->regmap[2], 0xff, &uitmp); ++ if (ret) ++ goto err_regmap_2_regmap_exit; ++ ++ dev_dbg(&client->dev, "chip id=%02x\n", uitmp); ++ ++ if (uitmp != 0x03) { ++ ret = -ENODEV; ++ goto err_regmap_2_regmap_exit; ++ } ++ + /* Sleep because chip is active by default */ + ret = regmap_write(dev->regmap[2], 0x05, 0x3e); + if (ret) +diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c +index 0b6d46c453bf..02a8f511443a 100644 +--- a/drivers/media/i2c/tvp5150.c ++++ b/drivers/media/i2c/tvp5150.c +@@ -815,6 +815,7 @@ static int tvp5150_s_ctrl(struct v4l2_ctrl *ctrl) + return 0; + case V4L2_CID_HUE: + tvp5150_write(sd, TVP5150_HUE_CTL, ctrl->val); ++ break; + case V4L2_CID_TEST_PATTERN: + decoder->enable = ctrl->val ? false : true; + tvp5150_selmux(sd); +diff --git a/drivers/media/pci/solo6x10/solo6x10.h b/drivers/media/pci/solo6x10/solo6x10.h +index 5bd498735a66..3f8da5e8c430 100644 +--- a/drivers/media/pci/solo6x10/solo6x10.h ++++ b/drivers/media/pci/solo6x10/solo6x10.h +@@ -284,7 +284,10 @@ static inline u32 solo_reg_read(struct solo_dev *solo_dev, int reg) + static inline void solo_reg_write(struct solo_dev *solo_dev, int reg, + u32 data) + { ++ u16 val; ++ + writel(data, solo_dev->reg_base + reg); ++ pci_read_config_word(solo_dev->pdev, PCI_STATUS, &val); + } + + static inline void solo_irq_on(struct solo_dev *dev, u32 mask) +diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c +index e3f104fafd0a..9e88c2f65333 100644 +--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c +@@ -1073,6 +1073,7 @@ static struct device *s5p_mfc_alloc_memdev(struct device *dev, + idx); + if (ret == 0) + return child; ++ device_del(child); + } + + put_device(child); +diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c +index 641c1a566687..75be3d5b2430 100644 +--- a/drivers/misc/mei/client.c ++++ b/drivers/misc/mei/client.c +@@ -675,7 +675,7 @@ void mei_host_client_init(struct mei_device *dev) + + pm_runtime_mark_last_busy(dev->dev); + dev_dbg(dev->dev, "rpm: autosuspend\n"); +- pm_runtime_autosuspend(dev->dev); ++ pm_request_autosuspend(dev->dev); + } + + /** +diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h +index 7ad15d678878..c8307e8b4c16 100644 +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -122,6 +122,8 @@ + #define MEI_DEV_ID_SPT_H 0xA13A /* Sunrise Point H */ + #define MEI_DEV_ID_SPT_H_2 0xA13B /* Sunrise Point H 2 */ + ++#define MEI_DEV_ID_LBG 0xA1BA /* Lewisburg (SPT) */ ++ + #define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */ + #define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */ + +diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c +index 5eb9b75ae9ec..69fca9b545df 100644 +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -87,6 +87,7 @@ static const struct pci_device_id mei_me_pci_tbl[] = { + {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, mei_me_pch8_cfg)}, + + {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)}, +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 6eb8f0705c65..1f6205c959cd 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -2074,7 +2074,27 @@ static int sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode) + ctrl &= ~SDHCI_CTRL_EXEC_TUNING; + sdhci_writew(host, ctrl, SDHCI_HOST_CONTROL2); + ++ sdhci_do_reset(host, SDHCI_RESET_CMD); ++ sdhci_do_reset(host, SDHCI_RESET_DATA); ++ + err = -EIO; ++ ++ if (cmd.opcode != MMC_SEND_TUNING_BLOCK_HS200) ++ goto out; ++ ++ sdhci_writel(host, host->ier, SDHCI_INT_ENABLE); ++ sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE); ++ ++ spin_unlock_irqrestore(&host->lock, flags); ++ ++ memset(&cmd, 0, sizeof(cmd)); ++ cmd.opcode = MMC_STOP_TRANSMISSION; ++ cmd.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC; ++ cmd.busy_timeout = 50; ++ mmc_wait_for_cmd(mmc, &cmd, 0); ++ ++ spin_lock_irqsave(&host->lock, flags); ++ + goto out; + } + +diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c +index 60227a3452a4..5588c560ec61 100644 +--- a/drivers/net/ethernet/marvell/mvpp2.c ++++ b/drivers/net/ethernet/marvell/mvpp2.c +@@ -770,6 +770,17 @@ struct mvpp2_rx_desc { + u32 reserved8; + }; + ++struct mvpp2_txq_pcpu_buf { ++ /* Transmitted SKB */ ++ struct sk_buff *skb; ++ ++ /* Physical address of transmitted buffer */ ++ dma_addr_t phys; ++ ++ /* Size transmitted */ ++ size_t size; ++}; ++ + /* Per-CPU Tx queue control */ + struct mvpp2_txq_pcpu { + int cpu; +@@ -785,11 +796,8 @@ struct mvpp2_txq_pcpu { + /* Number of Tx DMA descriptors reserved for each CPU */ + int reserved_num; + +- /* Array of transmitted skb */ +- struct sk_buff **tx_skb; +- +- /* Array of transmitted buffers' physical addresses */ +- dma_addr_t *tx_buffs; ++ /* Infos about transmitted buffers */ ++ struct mvpp2_txq_pcpu_buf *buffs; + + /* Index of last TX DMA descriptor that was inserted */ + int txq_put_index; +@@ -979,10 +987,11 @@ static void mvpp2_txq_inc_put(struct mvpp2_txq_pcpu *txq_pcpu, + struct sk_buff *skb, + struct mvpp2_tx_desc *tx_desc) + { +- txq_pcpu->tx_skb[txq_pcpu->txq_put_index] = skb; +- if (skb) +- txq_pcpu->tx_buffs[txq_pcpu->txq_put_index] = +- tx_desc->buf_phys_addr; ++ struct mvpp2_txq_pcpu_buf *tx_buf = ++ txq_pcpu->buffs + txq_pcpu->txq_put_index; ++ tx_buf->skb = skb; ++ tx_buf->size = tx_desc->data_size; ++ tx_buf->phys = tx_desc->buf_phys_addr; + txq_pcpu->txq_put_index++; + if (txq_pcpu->txq_put_index == txq_pcpu->size) + txq_pcpu->txq_put_index = 0; +@@ -4401,17 +4410,16 @@ static void mvpp2_txq_bufs_free(struct mvpp2_port *port, + int i; + + for (i = 0; i < num; i++) { +- dma_addr_t buf_phys_addr = +- txq_pcpu->tx_buffs[txq_pcpu->txq_get_index]; +- struct sk_buff *skb = txq_pcpu->tx_skb[txq_pcpu->txq_get_index]; ++ struct mvpp2_txq_pcpu_buf *tx_buf = ++ txq_pcpu->buffs + txq_pcpu->txq_get_index; + + mvpp2_txq_inc_get(txq_pcpu); + +- dma_unmap_single(port->dev->dev.parent, buf_phys_addr, +- skb_headlen(skb), DMA_TO_DEVICE); +- if (!skb) ++ dma_unmap_single(port->dev->dev.parent, tx_buf->phys, ++ tx_buf->size, DMA_TO_DEVICE); ++ if (!tx_buf->skb) + continue; +- dev_kfree_skb_any(skb); ++ dev_kfree_skb_any(tx_buf->skb); + } + } + +@@ -4651,15 +4659,10 @@ static int mvpp2_txq_init(struct mvpp2_port *port, + for_each_present_cpu(cpu) { + txq_pcpu = per_cpu_ptr(txq->pcpu, cpu); + txq_pcpu->size = txq->size; +- txq_pcpu->tx_skb = kmalloc(txq_pcpu->size * +- sizeof(*txq_pcpu->tx_skb), +- GFP_KERNEL); +- if (!txq_pcpu->tx_skb) +- goto error; +- +- txq_pcpu->tx_buffs = kmalloc(txq_pcpu->size * +- sizeof(dma_addr_t), GFP_KERNEL); +- if (!txq_pcpu->tx_buffs) ++ txq_pcpu->buffs = kmalloc(txq_pcpu->size * ++ sizeof(struct mvpp2_txq_pcpu_buf), ++ GFP_KERNEL); ++ if (!txq_pcpu->buffs) + goto error; + + txq_pcpu->count = 0; +@@ -4673,8 +4676,7 @@ static int mvpp2_txq_init(struct mvpp2_port *port, + error: + for_each_present_cpu(cpu) { + txq_pcpu = per_cpu_ptr(txq->pcpu, cpu); +- kfree(txq_pcpu->tx_skb); +- kfree(txq_pcpu->tx_buffs); ++ kfree(txq_pcpu->buffs); + } + + dma_free_coherent(port->dev->dev.parent, +@@ -4693,8 +4695,7 @@ static void mvpp2_txq_deinit(struct mvpp2_port *port, + + for_each_present_cpu(cpu) { + txq_pcpu = per_cpu_ptr(txq->pcpu, cpu); +- kfree(txq_pcpu->tx_skb); +- kfree(txq_pcpu->tx_buffs); ++ kfree(txq_pcpu->buffs); + } + + if (txq->descs) +diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c +index 14b13f07cd1f..a35f78be8dec 100644 +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -2792,7 +2792,7 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah, u32 gpio) + WARN_ON(1); + } + +- return val; ++ return !!val; + } + EXPORT_SYMBOL(ath9k_hw_gpio_get); + +diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c +index 0dd454acf22a..aff473dfa10d 100644 +--- a/drivers/net/wireless/ath/ath9k/pci.c ++++ b/drivers/net/wireless/ath/ath9k/pci.c +@@ -26,7 +26,6 @@ static const struct pci_device_id ath_pci_id_table[] = { + { PCI_VDEVICE(ATHEROS, 0x0023) }, /* PCI */ + { PCI_VDEVICE(ATHEROS, 0x0024) }, /* PCI-E */ + { PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI */ +- { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */ + + #ifdef CONFIG_ATH9K_PCOEM + /* Mini PCI AR9220 MB92 cards: Compex WLM200NX, Wistron DNMA-92 */ +@@ -37,7 +36,7 @@ static const struct pci_device_id ath_pci_id_table[] = { + .driver_data = ATH9K_PCI_LED_ACT_HI }, + #endif + +- { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */ ++ { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */ + + #ifdef CONFIG_ATH9K_PCOEM + { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS, +@@ -85,7 +84,11 @@ static const struct pci_device_id ath_pci_id_table[] = { + 0x10CF, /* Fujitsu */ + 0x1536), + .driver_data = ATH9K_PCI_D3_L1_WAR }, ++#endif + ++ { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */ ++ ++#ifdef CONFIG_ATH9K_PCOEM + /* AR9285 card for Asus */ + { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS, + 0x002B, +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index c6b246aa2419..4b7807902700 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -4401,6 +4401,13 @@ void rtl8xxxu_gen1_report_connect(struct rtl8xxxu_priv *priv, + void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv, + u8 macid, bool connect) + { ++#ifdef RTL8XXXU_GEN2_REPORT_CONNECT ++ /* ++ * Barry Day reports this causes issues with 8192eu and 8723bu ++ * devices reconnecting. The reason for this is unclear, but ++ * until it is better understood, leave the code in place but ++ * disabled, so it is not lost. ++ */ + struct h2c_cmd h2c; + + memset(&h2c, 0, sizeof(struct h2c_cmd)); +@@ -4412,6 +4419,7 @@ void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv, + h2c.media_status_rpt.parm &= ~BIT(0); + + rtl8xxxu_gen2_h2c_cmd(priv, &h2c, sizeof(h2c.media_status_rpt)); ++#endif + } + + void rtl8xxxu_gen1_init_aggregation(struct rtl8xxxu_priv *priv) +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index 264466f59c57..4ac928bf1f8e 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -1303,12 +1303,13 @@ EXPORT_SYMBOL_GPL(rtl_action_proc); + + static void setup_arp_tx(struct rtl_priv *rtlpriv, struct rtl_ps_ctl *ppsc) + { ++ struct ieee80211_hw *hw = rtlpriv->hw; ++ + rtlpriv->ra.is_special_data = true; + if (rtlpriv->cfg->ops->get_btc_status()) + rtlpriv->btcoexist.btc_ops->btc_special_packet_notify( + rtlpriv, 1); +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); ++ rtl_lps_leave(hw); + ppsc->last_delaylps_stamp_jiffies = jiffies; + } + +@@ -1381,8 +1382,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx, + + if (is_tx) { + rtlpriv->ra.is_special_data = true; +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); ++ rtl_lps_leave(hw); + ppsc->last_delaylps_stamp_jiffies = jiffies; + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c +index 41f77f8a309e..8f783efac960 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/core.c ++++ b/drivers/net/wireless/realtek/rtlwifi/core.c +@@ -1149,10 +1149,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + } else { + mstatus = RT_MEDIA_DISCONNECT; + +- if (mac->link_state == MAC80211_LINKED) { +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); +- } ++ if (mac->link_state == MAC80211_LINKED) ++ rtl_lps_leave(hw); + if (ppsc->p2p_ps_info.p2p_ps_mode > P2P_PS_NONE) + rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE); + mac->link_state = MAC80211_NOLINK; +@@ -1430,8 +1428,7 @@ static void rtl_op_sw_scan_start(struct ieee80211_hw *hw, + } + + if (mac->link_state == MAC80211_LINKED) { +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); ++ rtl_lps_leave(hw); + mac->link_state = MAC80211_LINKED_SCANNING; + } else { + rtl_ips_nic_on(hw); +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index d12586d4f845..e538e23baa9f 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -662,11 +662,9 @@ tx_status_ok: + } + + if (((rtlpriv->link_info.num_rx_inperiod + +- rtlpriv->link_info.num_tx_inperiod) > 8) || +- (rtlpriv->link_info.num_rx_inperiod > 2)) { +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); +- } ++ rtlpriv->link_info.num_tx_inperiod) > 8) || ++ (rtlpriv->link_info.num_rx_inperiod > 2)) ++ rtl_lps_leave(hw); + } + + static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw, +@@ -917,10 +915,8 @@ new_trx_end: + } + if (((rtlpriv->link_info.num_rx_inperiod + + rtlpriv->link_info.num_tx_inperiod) > 8) || +- (rtlpriv->link_info.num_rx_inperiod > 2)) { +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); +- } ++ (rtlpriv->link_info.num_rx_inperiod > 2)) ++ rtl_lps_leave(hw); + skb = new_skb; + no_new: + if (rtlpriv->use_new_trx_flow) { +diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c +index 9a64f9b703e5..424e262939c9 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/ps.c ++++ b/drivers/net/wireless/realtek/rtlwifi/ps.c +@@ -407,8 +407,8 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode) + } + } + +-/*Enter the leisure power save mode.*/ +-void rtl_lps_enter(struct ieee80211_hw *hw) ++/* Interrupt safe routine to enter the leisure power save mode.*/ ++static void rtl_lps_enter_core(struct ieee80211_hw *hw) + { + struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); + struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw)); +@@ -444,10 +444,9 @@ void rtl_lps_enter(struct ieee80211_hw *hw) + + spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag); + } +-EXPORT_SYMBOL(rtl_lps_enter); + +-/*Leave the leisure power save mode.*/ +-void rtl_lps_leave(struct ieee80211_hw *hw) ++/* Interrupt safe routine to leave the leisure power save mode.*/ ++static void rtl_lps_leave_core(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw)); +@@ -477,7 +476,6 @@ void rtl_lps_leave(struct ieee80211_hw *hw) + } + spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag); + } +-EXPORT_SYMBOL(rtl_lps_leave); + + /* For sw LPS*/ + void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len) +@@ -670,12 +668,34 @@ void rtl_lps_change_work_callback(struct work_struct *work) + struct rtl_priv *rtlpriv = rtl_priv(hw); + + if (rtlpriv->enter_ps) +- rtl_lps_enter(hw); ++ rtl_lps_enter_core(hw); + else +- rtl_lps_leave(hw); ++ rtl_lps_leave_core(hw); + } + EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback); + ++void rtl_lps_enter(struct ieee80211_hw *hw) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ ++ if (!in_interrupt()) ++ return rtl_lps_enter_core(hw); ++ rtlpriv->enter_ps = true; ++ schedule_work(&rtlpriv->works.lps_change_work); ++} ++EXPORT_SYMBOL_GPL(rtl_lps_enter); ++ ++void rtl_lps_leave(struct ieee80211_hw *hw) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ ++ if (!in_interrupt()) ++ return rtl_lps_leave_core(hw); ++ rtlpriv->enter_ps = false; ++ schedule_work(&rtlpriv->works.lps_change_work); ++} ++EXPORT_SYMBOL_GPL(rtl_lps_leave); ++ + void rtl_swlps_wq_callback(void *data) + { + struct rtl_works *rtlworks = container_of_dwork_rtl(data, +diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c +index cea8350fbc7e..a2ac9e641aa9 100644 +--- a/drivers/nvdimm/pfn_devs.c ++++ b/drivers/nvdimm/pfn_devs.c +@@ -108,7 +108,7 @@ static ssize_t align_show(struct device *dev, + { + struct nd_pfn *nd_pfn = to_nd_pfn_safe(dev); + +- return sprintf(buf, "%lx\n", nd_pfn->align); ++ return sprintf(buf, "%ld\n", nd_pfn->align); + } + + static ssize_t __align_store(struct nd_pfn *nd_pfn, const char *buf) +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index aab9d5115a5f..24db77ea5093 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -2064,6 +2064,10 @@ bool pci_dev_run_wake(struct pci_dev *dev) + if (!dev->pme_support) + return false; + ++ /* PME-capable in principle, but not from the intended sleep state */ ++ if (!pci_pme_capable(dev, pci_target_state(dev))) ++ return false; ++ + while (bus->parent) { + struct pci_dev *bridge = bus->self; + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index adecc1c555f0..c4ed3e53c0ea 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -137,6 +137,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + { + .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. X45U", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X45U"), ++ }, ++ .driver_data = &quirk_asus_wapf4, ++ }, ++ { ++ .callback = dmi_matched, + .ident = "ASUSTeK COMPUTER INC. X456UA", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +diff --git a/drivers/regulator/stw481x-vmmc.c b/drivers/regulator/stw481x-vmmc.c +index 7d2ae3e9e942..342f5da79975 100644 +--- a/drivers/regulator/stw481x-vmmc.c ++++ b/drivers/regulator/stw481x-vmmc.c +@@ -47,7 +47,8 @@ static struct regulator_desc vmmc_regulator = { + .volt_table = stw481x_vmmc_voltages, + .enable_time = 200, /* FIXME: look this up */ + .enable_reg = STW_CONF1, +- .enable_mask = STW_CONF1_PDN_VMMC, ++ .enable_mask = STW_CONF1_PDN_VMMC | STW_CONF1_MMC_LS_STATUS, ++ .enable_val = STW_CONF1_PDN_VMMC, + .vsel_reg = STW_CONF1, + .vsel_mask = STW_CONF1_VMMC_MASK, + }; +diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c +index e883063c7258..3167e8581994 100644 +--- a/drivers/s390/char/vmlogrdr.c ++++ b/drivers/s390/char/vmlogrdr.c +@@ -870,7 +870,7 @@ static int __init vmlogrdr_init(void) + goto cleanup; + + for (i=0; i < MAXMINOR; ++i ) { +- sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL); ++ sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL | GFP_DMA); + if (!sys_ser[i].buffer) { + rc = -ENOMEM; + break; +diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c +index 581001989937..d5bf36ec8a75 100644 +--- a/drivers/s390/scsi/zfcp_dbf.c ++++ b/drivers/s390/scsi/zfcp_dbf.c +@@ -289,11 +289,12 @@ void zfcp_dbf_rec_trig(char *tag, struct zfcp_adapter *adapter, + + + /** +- * zfcp_dbf_rec_run - trace event related to running recovery ++ * zfcp_dbf_rec_run_lvl - trace event related to running recovery ++ * @level: trace level to be used for event + * @tag: identifier for event + * @erp: erp_action running + */ +-void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp) ++void zfcp_dbf_rec_run_lvl(int level, char *tag, struct zfcp_erp_action *erp) + { + struct zfcp_dbf *dbf = erp->adapter->dbf; + struct zfcp_dbf_rec *rec = &dbf->rec_buf; +@@ -319,11 +320,21 @@ void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp) + else + rec->u.run.rec_count = atomic_read(&erp->adapter->erp_counter); + +- debug_event(dbf->rec, 1, rec, sizeof(*rec)); ++ debug_event(dbf->rec, level, rec, sizeof(*rec)); + spin_unlock_irqrestore(&dbf->rec_lock, flags); + } + + /** ++ * zfcp_dbf_rec_run - trace event related to running recovery ++ * @tag: identifier for event ++ * @erp: erp_action running ++ */ ++void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp) ++{ ++ zfcp_dbf_rec_run_lvl(1, tag, erp); ++} ++ ++/** + * zfcp_dbf_rec_run_wka - trace wka port event with info like running recovery + * @tag: identifier for event + * @wka_port: well known address port +diff --git a/drivers/s390/scsi/zfcp_dbf.h b/drivers/s390/scsi/zfcp_dbf.h +index 36d07584271d..db186d44cfaf 100644 +--- a/drivers/s390/scsi/zfcp_dbf.h ++++ b/drivers/s390/scsi/zfcp_dbf.h +@@ -2,7 +2,7 @@ + * zfcp device driver + * debug feature declarations + * +- * Copyright IBM Corp. 2008, 2015 ++ * Copyright IBM Corp. 2008, 2016 + */ + + #ifndef ZFCP_DBF_H +@@ -283,6 +283,30 @@ struct zfcp_dbf { + struct zfcp_dbf_scsi scsi_buf; + }; + ++/** ++ * zfcp_dbf_hba_fsf_resp_suppress - true if we should not trace by default ++ * @req: request that has been completed ++ * ++ * Returns true if FCP response with only benign residual under count. ++ */ ++static inline ++bool zfcp_dbf_hba_fsf_resp_suppress(struct zfcp_fsf_req *req) ++{ ++ struct fsf_qtcb *qtcb = req->qtcb; ++ u32 fsf_stat = qtcb->header.fsf_status; ++ struct fcp_resp *fcp_rsp; ++ u8 rsp_flags, fr_status; ++ ++ if (qtcb->prefix.qtcb_type != FSF_IO_COMMAND) ++ return false; /* not an FCP response */ ++ fcp_rsp = (struct fcp_resp *)&qtcb->bottom.io.fcp_rsp; ++ rsp_flags = fcp_rsp->fr_flags; ++ fr_status = fcp_rsp->fr_status; ++ return (fsf_stat == FSF_FCP_RSP_AVAILABLE) && ++ (rsp_flags == FCP_RESID_UNDER) && ++ (fr_status == SAM_STAT_GOOD); ++} ++ + static inline + void zfcp_dbf_hba_fsf_resp(char *tag, int level, struct zfcp_fsf_req *req) + { +@@ -304,7 +328,9 @@ void zfcp_dbf_hba_fsf_response(struct zfcp_fsf_req *req) + zfcp_dbf_hba_fsf_resp("fs_perr", 1, req); + + } else if (qtcb->header.fsf_status != FSF_GOOD) { +- zfcp_dbf_hba_fsf_resp("fs_ferr", 1, req); ++ zfcp_dbf_hba_fsf_resp("fs_ferr", ++ zfcp_dbf_hba_fsf_resp_suppress(req) ++ ? 5 : 1, req); + + } else if ((req->fsf_command == FSF_QTCB_OPEN_PORT_WITH_DID) || + (req->fsf_command == FSF_QTCB_OPEN_LUN)) { +@@ -388,4 +414,15 @@ void zfcp_dbf_scsi_devreset(char *tag, struct scsi_cmnd *scmnd, u8 flag) + _zfcp_dbf_scsi(tmp_tag, 1, scmnd, NULL); + } + ++/** ++ * zfcp_dbf_scsi_nullcmnd() - trace NULLify of SCSI command in dev/tgt-reset. ++ * @scmnd: SCSI command that was NULLified. ++ * @fsf_req: request that owned @scmnd. ++ */ ++static inline void zfcp_dbf_scsi_nullcmnd(struct scsi_cmnd *scmnd, ++ struct zfcp_fsf_req *fsf_req) ++{ ++ _zfcp_dbf_scsi("scfc__1", 3, scmnd, fsf_req); ++} ++ + #endif /* ZFCP_DBF_H */ +diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c +index a59d678125bd..7ccfce559034 100644 +--- a/drivers/s390/scsi/zfcp_erp.c ++++ b/drivers/s390/scsi/zfcp_erp.c +@@ -3,7 +3,7 @@ + * + * Error Recovery Procedures (ERP). + * +- * Copyright IBM Corp. 2002, 2015 ++ * Copyright IBM Corp. 2002, 2016 + */ + + #define KMSG_COMPONENT "zfcp" +@@ -1204,6 +1204,62 @@ static void zfcp_erp_action_dequeue(struct zfcp_erp_action *erp_action) + } + } + ++/** ++ * zfcp_erp_try_rport_unblock - unblock rport if no more/new recovery ++ * @port: zfcp_port whose fc_rport we should try to unblock ++ */ ++static void zfcp_erp_try_rport_unblock(struct zfcp_port *port) ++{ ++ unsigned long flags; ++ struct zfcp_adapter *adapter = port->adapter; ++ int port_status; ++ struct Scsi_Host *shost = adapter->scsi_host; ++ struct scsi_device *sdev; ++ ++ write_lock_irqsave(&adapter->erp_lock, flags); ++ port_status = atomic_read(&port->status); ++ if ((port_status & ZFCP_STATUS_COMMON_UNBLOCKED) == 0 || ++ (port_status & (ZFCP_STATUS_COMMON_ERP_INUSE | ++ ZFCP_STATUS_COMMON_ERP_FAILED)) != 0) { ++ /* new ERP of severity >= port triggered elsewhere meanwhile or ++ * local link down (adapter erp_failed but not clear unblock) ++ */ ++ zfcp_dbf_rec_run_lvl(4, "ertru_p", &port->erp_action); ++ write_unlock_irqrestore(&adapter->erp_lock, flags); ++ return; ++ } ++ spin_lock(shost->host_lock); ++ __shost_for_each_device(sdev, shost) { ++ struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev); ++ int lun_status; ++ ++ if (zsdev->port != port) ++ continue; ++ /* LUN under port of interest */ ++ lun_status = atomic_read(&zsdev->status); ++ if ((lun_status & ZFCP_STATUS_COMMON_ERP_FAILED) != 0) ++ continue; /* unblock rport despite failed LUNs */ ++ /* LUN recovery not given up yet [maybe follow-up pending] */ ++ if ((lun_status & ZFCP_STATUS_COMMON_UNBLOCKED) == 0 || ++ (lun_status & ZFCP_STATUS_COMMON_ERP_INUSE) != 0) { ++ /* LUN blocked: ++ * not yet unblocked [LUN recovery pending] ++ * or meanwhile blocked [new LUN recovery triggered] ++ */ ++ zfcp_dbf_rec_run_lvl(4, "ertru_l", &zsdev->erp_action); ++ spin_unlock(shost->host_lock); ++ write_unlock_irqrestore(&adapter->erp_lock, flags); ++ return; ++ } ++ } ++ /* now port has no child or all children have completed recovery, ++ * and no ERP of severity >= port was meanwhile triggered elsewhere ++ */ ++ zfcp_scsi_schedule_rport_register(port); ++ spin_unlock(shost->host_lock); ++ write_unlock_irqrestore(&adapter->erp_lock, flags); ++} ++ + static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result) + { + struct zfcp_adapter *adapter = act->adapter; +@@ -1214,6 +1270,7 @@ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result) + case ZFCP_ERP_ACTION_REOPEN_LUN: + if (!(act->status & ZFCP_STATUS_ERP_NO_REF)) + scsi_device_put(sdev); ++ zfcp_erp_try_rport_unblock(port); + break; + + case ZFCP_ERP_ACTION_REOPEN_PORT: +@@ -1224,7 +1281,7 @@ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result) + */ + if (act->step != ZFCP_ERP_STEP_UNINITIALIZED) + if (result == ZFCP_ERP_SUCCEEDED) +- zfcp_scsi_schedule_rport_register(port); ++ zfcp_erp_try_rport_unblock(port); + /* fall through */ + case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED: + put_device(&port->dev); +diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h +index c8fed9fa1cca..21c8c689b02b 100644 +--- a/drivers/s390/scsi/zfcp_ext.h ++++ b/drivers/s390/scsi/zfcp_ext.h +@@ -3,7 +3,7 @@ + * + * External function declarations. + * +- * Copyright IBM Corp. 2002, 2015 ++ * Copyright IBM Corp. 2002, 2016 + */ + + #ifndef ZFCP_EXT_H +@@ -35,6 +35,8 @@ extern void zfcp_dbf_adapter_unregister(struct zfcp_adapter *); + extern void zfcp_dbf_rec_trig(char *, struct zfcp_adapter *, + struct zfcp_port *, struct scsi_device *, u8, u8); + extern void zfcp_dbf_rec_run(char *, struct zfcp_erp_action *); ++extern void zfcp_dbf_rec_run_lvl(int level, char *tag, ++ struct zfcp_erp_action *erp); + extern void zfcp_dbf_rec_run_wka(char *, struct zfcp_fc_wka_port *, u64); + extern void zfcp_dbf_hba_fsf_uss(char *, struct zfcp_fsf_req *); + extern void zfcp_dbf_hba_fsf_res(char *, int, struct zfcp_fsf_req *); +diff --git a/drivers/s390/scsi/zfcp_fsf.h b/drivers/s390/scsi/zfcp_fsf.h +index be1c04b334c5..ea3c76ac0de1 100644 +--- a/drivers/s390/scsi/zfcp_fsf.h ++++ b/drivers/s390/scsi/zfcp_fsf.h +@@ -3,7 +3,7 @@ + * + * Interface to the FSF support functions. + * +- * Copyright IBM Corp. 2002, 2015 ++ * Copyright IBM Corp. 2002, 2016 + */ + + #ifndef FSF_H +@@ -78,6 +78,7 @@ + #define FSF_APP_TAG_CHECK_FAILURE 0x00000082 + #define FSF_REF_TAG_CHECK_FAILURE 0x00000083 + #define FSF_ADAPTER_STATUS_AVAILABLE 0x000000AD ++#define FSF_FCP_RSP_AVAILABLE 0x000000AF + #define FSF_UNKNOWN_COMMAND 0x000000E2 + #define FSF_UNKNOWN_OP_SUBTYPE 0x000000E3 + #define FSF_INVALID_COMMAND_OPTION 0x000000E5 +diff --git a/drivers/s390/scsi/zfcp_reqlist.h b/drivers/s390/scsi/zfcp_reqlist.h +index 7c2c6194dfca..703fce59befe 100644 +--- a/drivers/s390/scsi/zfcp_reqlist.h ++++ b/drivers/s390/scsi/zfcp_reqlist.h +@@ -4,7 +4,7 @@ + * Data structure and helper functions for tracking pending FSF + * requests. + * +- * Copyright IBM Corp. 2009 ++ * Copyright IBM Corp. 2009, 2016 + */ + + #ifndef ZFCP_REQLIST_H +@@ -180,4 +180,32 @@ static inline void zfcp_reqlist_move(struct zfcp_reqlist *rl, + spin_unlock_irqrestore(&rl->lock, flags); + } + ++/** ++ * zfcp_reqlist_apply_for_all() - apply a function to every request. ++ * @rl: the requestlist that contains the target requests. ++ * @f: the function to apply to each request; the first parameter of the ++ * function will be the target-request; the second parameter is the same ++ * pointer as given with the argument @data. ++ * @data: freely chosen argument; passed through to @f as second parameter. ++ * ++ * Uses :c:macro:`list_for_each_entry` to iterate over the lists in the hash- ++ * table (not a 'safe' variant, so don't modify the list). ++ * ++ * Holds @rl->lock over the entire request-iteration. ++ */ ++static inline void ++zfcp_reqlist_apply_for_all(struct zfcp_reqlist *rl, ++ void (*f)(struct zfcp_fsf_req *, void *), void *data) ++{ ++ struct zfcp_fsf_req *req; ++ unsigned long flags; ++ unsigned int i; ++ ++ spin_lock_irqsave(&rl->lock, flags); ++ for (i = 0; i < ZFCP_REQ_LIST_BUCKETS; i++) ++ list_for_each_entry(req, &rl->buckets[i], list) ++ f(req, data); ++ spin_unlock_irqrestore(&rl->lock, flags); ++} ++ + #endif /* ZFCP_REQLIST_H */ +diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c +index 9069f98a1817..07ffdbb5107f 100644 +--- a/drivers/s390/scsi/zfcp_scsi.c ++++ b/drivers/s390/scsi/zfcp_scsi.c +@@ -3,7 +3,7 @@ + * + * Interface to Linux SCSI midlayer. + * +- * Copyright IBM Corp. 2002, 2015 ++ * Copyright IBM Corp. 2002, 2016 + */ + + #define KMSG_COMPONENT "zfcp" +@@ -88,9 +88,7 @@ int zfcp_scsi_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scpnt) + } + + if (unlikely(!(status & ZFCP_STATUS_COMMON_UNBLOCKED))) { +- /* This could be either +- * open LUN pending: this is temporary, will result in +- * open LUN or ERP_FAILED, so retry command ++ /* This could be + * call to rport_delete pending: mimic retry from + * fc_remote_port_chkready until rport is BLOCKED + */ +@@ -209,6 +207,57 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt) + return retval; + } + ++struct zfcp_scsi_req_filter { ++ u8 tmf_scope; ++ u32 lun_handle; ++ u32 port_handle; ++}; ++ ++static void zfcp_scsi_forget_cmnd(struct zfcp_fsf_req *old_req, void *data) ++{ ++ struct zfcp_scsi_req_filter *filter = ++ (struct zfcp_scsi_req_filter *)data; ++ ++ /* already aborted - prevent side-effects - or not a SCSI command */ ++ if (old_req->data == NULL || old_req->fsf_command != FSF_QTCB_FCP_CMND) ++ return; ++ ++ /* (tmf_scope == FCP_TMF_TGT_RESET || tmf_scope == FCP_TMF_LUN_RESET) */ ++ if (old_req->qtcb->header.port_handle != filter->port_handle) ++ return; ++ ++ if (filter->tmf_scope == FCP_TMF_LUN_RESET && ++ old_req->qtcb->header.lun_handle != filter->lun_handle) ++ return; ++ ++ zfcp_dbf_scsi_nullcmnd((struct scsi_cmnd *)old_req->data, old_req); ++ old_req->data = NULL; ++} ++ ++static void zfcp_scsi_forget_cmnds(struct zfcp_scsi_dev *zsdev, u8 tm_flags) ++{ ++ struct zfcp_adapter *adapter = zsdev->port->adapter; ++ struct zfcp_scsi_req_filter filter = { ++ .tmf_scope = FCP_TMF_TGT_RESET, ++ .port_handle = zsdev->port->handle, ++ }; ++ unsigned long flags; ++ ++ if (tm_flags == FCP_TMF_LUN_RESET) { ++ filter.tmf_scope = FCP_TMF_LUN_RESET; ++ filter.lun_handle = zsdev->lun_handle; ++ } ++ ++ /* ++ * abort_lock secures against other processings - in the abort-function ++ * and normal cmnd-handler - of (struct zfcp_fsf_req *)->data ++ */ ++ write_lock_irqsave(&adapter->abort_lock, flags); ++ zfcp_reqlist_apply_for_all(adapter->req_list, zfcp_scsi_forget_cmnd, ++ &filter); ++ write_unlock_irqrestore(&adapter->abort_lock, flags); ++} ++ + static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags) + { + struct zfcp_scsi_dev *zfcp_sdev = sdev_to_zfcp(scpnt->device); +@@ -241,8 +290,10 @@ static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags) + if (fsf_req->status & ZFCP_STATUS_FSFREQ_TMFUNCFAILED) { + zfcp_dbf_scsi_devreset("fail", scpnt, tm_flags); + retval = FAILED; +- } else ++ } else { + zfcp_dbf_scsi_devreset("okay", scpnt, tm_flags); ++ zfcp_scsi_forget_cmnds(zfcp_sdev, tm_flags); ++ } + + zfcp_fsf_req_free(fsf_req); + return retval; +diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c +index 79871f3519ff..d5b26fa541d3 100644 +--- a/drivers/scsi/aacraid/linit.c ++++ b/drivers/scsi/aacraid/linit.c +@@ -160,7 +160,6 @@ static const struct pci_device_id aac_pci_tbl[] = { + { 0x9005, 0x028b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 62 }, /* Adaptec PMC Series 6 (Tupelo) */ + { 0x9005, 0x028c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 63 }, /* Adaptec PMC Series 7 (Denali) */ + { 0x9005, 0x028d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 64 }, /* Adaptec PMC Series 8 */ +- { 0x9005, 0x028f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 65 }, /* Adaptec PMC Series 9 */ + { 0,} + }; + MODULE_DEVICE_TABLE(pci, aac_pci_tbl); +@@ -239,7 +238,6 @@ static struct aac_driver_ident aac_drivers[] = { + { aac_src_init, "aacraid", "ADAPTEC ", "RAID ", 2, AAC_QUIRK_SRC }, /* Adaptec PMC Series 6 (Tupelo) */ + { aac_srcv_init, "aacraid", "ADAPTEC ", "RAID ", 2, AAC_QUIRK_SRC }, /* Adaptec PMC Series 7 (Denali) */ + { aac_srcv_init, "aacraid", "ADAPTEC ", "RAID ", 2, AAC_QUIRK_SRC }, /* Adaptec PMC Series 8 */ +- { aac_srcv_init, "aacraid", "ADAPTEC ", "RAID ", 2, AAC_QUIRK_SRC } /* Adaptec PMC Series 9 */ + }; + + /** +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index 52d8bbf7feb5..bd04bd01d34a 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -2000,6 +2000,8 @@ megasas_build_syspd_fusion(struct megasas_instance *instance, + io_request->DevHandle = pd_sync->seq[pd_index].devHandle; + pRAID_Context->regLockFlags |= + (MR_RL_FLAGS_SEQ_NUM_ENABLE|MR_RL_FLAGS_GRANT_DESTINATION_CUDA); ++ pRAID_Context->Type = MPI2_TYPE_CUDA; ++ pRAID_Context->nseg = 0x1; + } else if (fusion->fast_path_io) { + pRAID_Context->VirtualDiskTgtId = cpu_to_le16(device_id); + pRAID_Context->configSeqNum = 0; +@@ -2035,12 +2037,10 @@ megasas_build_syspd_fusion(struct megasas_instance *instance, + pRAID_Context->timeoutValue = + cpu_to_le16((os_timeout_value > timeout_limit) ? + timeout_limit : os_timeout_value); +- if (fusion->adapter_type == INVADER_SERIES) { +- pRAID_Context->Type = MPI2_TYPE_CUDA; +- pRAID_Context->nseg = 0x1; ++ if (fusion->adapter_type == INVADER_SERIES) + io_request->IoFlags |= + cpu_to_le16(MPI25_SAS_DEVICE0_FLAGS_ENABLED_FAST_PATH); +- } ++ + cmd->request_desc->SCSIIO.RequestFlags = + (MPI2_REQ_DESCRIPT_FLAGS_FP_IO << + MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT); +@@ -2823,6 +2823,7 @@ int megasas_wait_for_outstanding_fusion(struct megasas_instance *instance, + dev_err(&instance->pdev->dev, "pending commands remain after waiting, " + "will reset adapter scsi%d.\n", + instance->host->host_no); ++ *convert = 1; + retval = 1; + } + out: +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 07349270535d..82dfe07b1d47 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -1204,10 +1204,6 @@ int scsi_sysfs_add_sdev(struct scsi_device *sdev) + struct request_queue *rq = sdev->request_queue; + struct scsi_target *starget = sdev->sdev_target; + +- error = scsi_device_set_state(sdev, SDEV_RUNNING); +- if (error) +- return error; +- + error = scsi_target_add(starget); + if (error) + return error; +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index ae7d9bdf409c..a1c29b0afb22 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -592,6 +592,9 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) + sg_io_hdr_t *hp; + unsigned char cmnd[SG_MAX_CDB_SIZE]; + ++ if (unlikely(segment_eq(get_fs(), KERNEL_DS))) ++ return -EINVAL; ++ + if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp))) + return -ENXIO; + SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp, +diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c +index 0f28c08fcb3c..77b551da5728 100644 +--- a/drivers/ssb/pci.c ++++ b/drivers/ssb/pci.c +@@ -909,6 +909,7 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus, + if (err) { + ssb_warn("WARNING: Using fallback SPROM failed (err %d)\n", + err); ++ goto out_free; + } else { + ssb_dbg("Using SPROM revision %d provided by platform\n", + sprom->revision); +diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c +index 0f97d7b611d7..1c967c30e4ce 100644 +--- a/drivers/staging/comedi/drivers/ni_mio_common.c ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c +@@ -1832,7 +1832,7 @@ static int ni_ai_insn_read(struct comedi_device *dev, + unsigned int *data) + { + struct ni_private *devpriv = dev->private; +- unsigned int mask = (s->maxdata + 1) >> 1; ++ unsigned int mask = s->maxdata; + int i, n; + unsigned int signbits; + unsigned int d; +@@ -1875,7 +1875,7 @@ static int ni_ai_insn_read(struct comedi_device *dev, + return -ETIME; + } + d += signbits; +- data[n] = d; ++ data[n] = d & 0xffff; + } + } else if (devpriv->is_6143) { + for (n = 0; n < insn->n; n++) { +@@ -1924,9 +1924,8 @@ static int ni_ai_insn_read(struct comedi_device *dev, + data[n] = dl; + } else { + d = ni_readw(dev, NI_E_AI_FIFO_DATA_REG); +- /* subtle: needs to be short addition */ + d += signbits; +- data[n] = d; ++ data[n] = d & 0xffff; + } + } + } +diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c +index 923c032f0b95..e980e2d0c2db 100644 +--- a/drivers/target/iscsi/iscsi_target_configfs.c ++++ b/drivers/target/iscsi/iscsi_target_configfs.c +@@ -100,8 +100,10 @@ static ssize_t lio_target_np_driver_store(struct config_item *item, + + tpg_np_new = iscsit_tpg_add_network_portal(tpg, + &np->np_sockaddr, tpg_np, type); +- if (IS_ERR(tpg_np_new)) ++ if (IS_ERR(tpg_np_new)) { ++ rc = PTR_ERR(tpg_np_new); + goto out; ++ } + } else { + tpg_np_new = iscsit_tpg_locate_child_np(tpg_np, type); + if (tpg_np_new) { +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c +index 62bf4fe5704a..b8a986c2c567 100644 +--- a/drivers/target/target_core_user.c ++++ b/drivers/target/target_core_user.c +@@ -682,8 +682,6 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data) + target_complete_cmd(cmd->se_cmd, SAM_STAT_CHECK_CONDITION); + cmd->se_cmd = NULL; + +- kmem_cache_free(tcmu_cmd_cache, cmd); +- + return 0; + } + +diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c +index c41c7742903a..2dcd4194d103 100644 +--- a/drivers/thermal/thermal_hwmon.c ++++ b/drivers/thermal/thermal_hwmon.c +@@ -98,7 +98,7 @@ temp_crit_show(struct device *dev, struct device_attribute *attr, char *buf) + int temperature; + int ret; + +- ret = tz->ops->get_trip_temp(tz, 0, &temperature); ++ ret = tz->ops->get_crit_temp(tz, &temperature); + if (ret) + return ret; + +diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c +index f36e6df2fa90..e086ea4d2997 100644 +--- a/drivers/tty/serial/sc16is7xx.c ++++ b/drivers/tty/serial/sc16is7xx.c +@@ -1240,7 +1240,7 @@ static int sc16is7xx_probe(struct device *dev, + + /* Setup interrupt */ + ret = devm_request_irq(dev, irq, sc16is7xx_irq, +- IRQF_ONESHOT | flags, dev_name(dev), s); ++ flags, dev_name(dev), s); + if (!ret) + return 0; + +diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c +index 0f8caae4267d..ece10e6b731b 100644 +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -982,7 +982,7 @@ static void kbd_led_trigger_activate(struct led_classdev *cdev) + KBD_LED_TRIGGER((_led_bit) + 8, _name) + + static struct kbd_led_trigger kbd_led_triggers[] = { +- KBD_LED_TRIGGER(VC_SCROLLOCK, "kbd-scrollock"), ++ KBD_LED_TRIGGER(VC_SCROLLOCK, "kbd-scrolllock"), + KBD_LED_TRIGGER(VC_NUMLOCK, "kbd-numlock"), + KBD_LED_TRIGGER(VC_CAPSLOCK, "kbd-capslock"), + KBD_LED_TRIGGER(VC_KANALOCK, "kbd-kanalock"), +diff --git a/fs/block_dev.c b/fs/block_dev.c +index b010242bab32..496d99b80fb0 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -1885,6 +1885,7 @@ void iterate_bdevs(void (*func)(struct block_device *, void *), void *arg) + spin_lock(&blockdev_superblock->s_inode_list_lock); + list_for_each_entry(inode, &blockdev_superblock->s_inodes, i_sb_list) { + struct address_space *mapping = inode->i_mapping; ++ struct block_device *bdev; + + spin_lock(&inode->i_lock); + if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW) || +@@ -1905,8 +1906,12 @@ void iterate_bdevs(void (*func)(struct block_device *, void *), void *arg) + */ + iput(old_inode); + old_inode = inode; ++ bdev = I_BDEV(inode); + +- func(I_BDEV(inode), arg); ++ mutex_lock(&bdev->bd_mutex); ++ if (bdev->bd_openers) ++ func(bdev, arg); ++ mutex_unlock(&bdev->bd_mutex); + + spin_lock(&blockdev_superblock->s_inode_list_lock); + } +diff --git a/fs/nfs/file.c b/fs/nfs/file.c +index ca699ddc11c1..e6a0d22315e9 100644 +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -397,7 +397,7 @@ static int nfs_write_end(struct file *file, struct address_space *mapping, + */ + if (!PageUptodate(page)) { + unsigned pglen = nfs_page_length(page); +- unsigned end = offset + len; ++ unsigned end = offset + copied; + + if (pglen == 0) { + zero_user_segments(page, 0, offset, +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c +index 51b51369704c..dcc21f9e4bd1 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -28,6 +28,9 @@ + + static struct group_info *ff_zero_group; + ++static void ff_layout_read_record_layoutstats_done(struct rpc_task *task, ++ struct nfs_pgio_header *hdr); ++ + static struct pnfs_layout_hdr * + ff_layout_alloc_layout_hdr(struct inode *inode, gfp_t gfp_flags) + { +@@ -1293,6 +1296,7 @@ static int ff_layout_read_done_cb(struct rpc_task *task, + hdr->pgio_mirror_idx + 1, + &hdr->pgio_mirror_idx)) + goto out_eagain; ++ ff_layout_read_record_layoutstats_done(task, hdr); + pnfs_read_resend_pnfs(hdr); + return task->tk_status; + case -NFS4ERR_RESET_TO_MDS: +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 2c93a85eda51..eb8edb3d52e1 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -252,6 +252,14 @@ pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo) + } + } + ++static void ++pnfs_clear_layoutreturn_info(struct pnfs_layout_hdr *lo) ++{ ++ lo->plh_return_iomode = 0; ++ lo->plh_return_seq = 0; ++ clear_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags); ++} ++ + /* + * Mark a pnfs_layout_hdr and all associated layout segments as invalid + * +@@ -270,6 +278,7 @@ pnfs_mark_layout_stateid_invalid(struct pnfs_layout_hdr *lo, + }; + + set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags); ++ pnfs_clear_layoutreturn_info(lo); + return pnfs_mark_matching_lsegs_invalid(lo, lseg_list, &range, 0); + } + +@@ -364,7 +373,9 @@ pnfs_layout_remove_lseg(struct pnfs_layout_hdr *lo, + list_del_init(&lseg->pls_list); + /* Matched by pnfs_get_layout_hdr in pnfs_layout_insert_lseg */ + atomic_dec(&lo->plh_refcount); +- if (list_empty(&lo->plh_segs)) { ++ if (list_empty(&lo->plh_segs) && ++ !test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) && ++ !test_bit(NFS_LAYOUT_RETURN, &lo->plh_flags)) { + if (atomic_read(&lo->plh_outstanding) == 0) + set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags); + clear_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags); +@@ -769,14 +780,6 @@ pnfs_destroy_all_layouts(struct nfs_client *clp) + pnfs_destroy_layouts_byclid(clp, false); + } + +-static void +-pnfs_clear_layoutreturn_info(struct pnfs_layout_hdr *lo) +-{ +- lo->plh_return_iomode = 0; +- lo->plh_return_seq = 0; +- clear_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags); +-} +- + /* update lo->plh_stateid with new if is more recent */ + void + pnfs_set_layout_stateid(struct pnfs_layout_hdr *lo, const nfs4_stateid *new, +@@ -897,6 +900,7 @@ static void pnfs_clear_layoutcommit(struct inode *inode, + void pnfs_clear_layoutreturn_waitbit(struct pnfs_layout_hdr *lo) + { + clear_bit_unlock(NFS_LAYOUT_RETURN, &lo->plh_flags); ++ clear_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags); + smp_mb__after_atomic(); + wake_up_bit(&lo->plh_flags, NFS_LAYOUT_RETURN); + rpc_wake_up(&NFS_SERVER(lo->plh_inode)->roc_rpcwaitq); +@@ -910,8 +914,9 @@ pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo, + /* Serialise LAYOUTGET/LAYOUTRETURN */ + if (atomic_read(&lo->plh_outstanding) != 0) + return false; +- if (test_and_set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags)) ++ if (test_and_set_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags)) + return false; ++ set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags); + pnfs_get_layout_hdr(lo); + if (test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) { + if (stateid != NULL) { +@@ -1903,6 +1908,8 @@ void pnfs_error_mark_layout_for_return(struct inode *inode, + + spin_lock(&inode->i_lock); + pnfs_set_plh_return_info(lo, range.iomode, 0); ++ /* Block LAYOUTGET */ ++ set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags); + /* + * mark all matching lsegs so that we are sure to have no live + * segments at hand when sending layoutreturn. See pnfs_put_lseg() +@@ -2241,6 +2248,10 @@ void pnfs_read_resend_pnfs(struct nfs_pgio_header *hdr) + struct nfs_pageio_descriptor pgio; + + if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags)) { ++ /* Prevent deadlocks with layoutreturn! */ ++ pnfs_put_lseg(hdr->lseg); ++ hdr->lseg = NULL; ++ + nfs_pageio_init_read(&pgio, hdr->inode, false, + hdr->completion_ops); + hdr->task.tk_status = nfs_pageio_resend(&pgio, hdr); +diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h +index 31d99b2927b0..98dbb51fcca8 100644 +--- a/fs/nfs/pnfs.h ++++ b/fs/nfs/pnfs.h +@@ -96,6 +96,7 @@ enum { + NFS_LAYOUT_RW_FAILED, /* get rw layout failed stop trying */ + NFS_LAYOUT_BULK_RECALL, /* bulk recall affecting layout */ + NFS_LAYOUT_RETURN, /* layoutreturn in progress */ ++ NFS_LAYOUT_RETURN_LOCK, /* Serialise layoutreturn */ + NFS_LAYOUT_RETURN_REQUESTED, /* Return this layout ASAP */ + NFS_LAYOUT_INVALID_STID, /* layout stateid id is invalid */ + NFS_LAYOUT_FIRST_LAYOUTGET, /* Serialize first layoutget */ +diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c +index 741077deef3b..a3645249f7ec 100644 +--- a/fs/notify/inode_mark.c ++++ b/fs/notify/inode_mark.c +@@ -150,12 +150,10 @@ int fsnotify_add_inode_mark(struct fsnotify_mark *mark, + */ + void fsnotify_unmount_inodes(struct super_block *sb) + { +- struct inode *inode, *next_i, *need_iput = NULL; ++ struct inode *inode, *iput_inode = NULL; + + spin_lock(&sb->s_inode_list_lock); +- list_for_each_entry_safe(inode, next_i, &sb->s_inodes, i_sb_list) { +- struct inode *need_iput_tmp; +- ++ list_for_each_entry(inode, &sb->s_inodes, i_sb_list) { + /* + * We cannot __iget() an inode in state I_FREEING, + * I_WILL_FREE, or I_NEW which is fine because by that point +@@ -178,49 +176,24 @@ void fsnotify_unmount_inodes(struct super_block *sb) + continue; + } + +- need_iput_tmp = need_iput; +- need_iput = NULL; +- +- /* In case fsnotify_inode_delete() drops a reference. */ +- if (inode != need_iput_tmp) +- __iget(inode); +- else +- need_iput_tmp = NULL; ++ __iget(inode); + spin_unlock(&inode->i_lock); +- +- /* In case the dropping of a reference would nuke next_i. */ +- while (&next_i->i_sb_list != &sb->s_inodes) { +- spin_lock(&next_i->i_lock); +- if (!(next_i->i_state & (I_FREEING | I_WILL_FREE)) && +- atomic_read(&next_i->i_count)) { +- __iget(next_i); +- need_iput = next_i; +- spin_unlock(&next_i->i_lock); +- break; +- } +- spin_unlock(&next_i->i_lock); +- next_i = list_next_entry(next_i, i_sb_list); +- } +- +- /* +- * We can safely drop s_inode_list_lock here because either +- * we actually hold references on both inode and next_i or +- * end of list. Also no new inodes will be added since the +- * umount has begun. +- */ + spin_unlock(&sb->s_inode_list_lock); + +- if (need_iput_tmp) +- iput(need_iput_tmp); ++ if (iput_inode) ++ iput(iput_inode); + + /* for each watch, send FS_UNMOUNT and then remove it */ + fsnotify(inode, FS_UNMOUNT, inode, FSNOTIFY_EVENT_INODE, NULL, 0); + + fsnotify_inode_delete(inode); + +- iput(inode); ++ iput_inode = inode; + + spin_lock(&sb->s_inode_list_lock); + } + spin_unlock(&sb->s_inode_list_lock); ++ ++ if (iput_inode) ++ iput(iput_inode); + } +diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h +index beb7610d64e9..95b1b57b28a2 100644 +--- a/include/net/cfg80211.h ++++ b/include/net/cfg80211.h +@@ -4393,6 +4393,17 @@ void cfg80211_rx_assoc_resp(struct net_device *dev, + void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss); + + /** ++ * cfg80211_abandon_assoc - notify cfg80211 of abandoned association attempt ++ * @dev: network device ++ * @bss: The BSS entry with which association was abandoned. ++ * ++ * Call this whenever - for reasons reported through other API, like deauth RX, ++ * an association attempt was abandoned. ++ * This function may sleep. The caller must hold the corresponding wdev's mutex. ++ */ ++void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss); ++ ++/** + * cfg80211_tx_mlme_mgmt - notification of transmitted deauth/disassoc frame + * @dev: network device + * @buf: 802.11 frame (header + body) +diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h +index 931a47ba4571..1beab5532035 100644 +--- a/include/rdma/ib_addr.h ++++ b/include/rdma/ib_addr.h +@@ -205,10 +205,12 @@ static inline void iboe_addr_get_sgid(struct rdma_dev_addr *dev_addr, + + dev = dev_get_by_index(&init_net, dev_addr->bound_dev_if); + if (dev) { +- ip4 = (struct in_device *)dev->ip_ptr; +- if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address) ++ ip4 = in_dev_get(dev); ++ if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address) { + ipv6_addr_set_v4mapped(ip4->ifa_list->ifa_address, + (struct in6_addr *)gid); ++ in_dev_put(ip4); ++ } + dev_put(dev); + } + } +diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c +index 37dec7e3db43..46e312e9be38 100644 +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -299,10 +299,10 @@ u32 (*arch_gettimeoffset)(void) = default_arch_gettimeoffset; + static inline u32 arch_gettimeoffset(void) { return 0; } + #endif + +-static inline s64 timekeeping_delta_to_ns(struct tk_read_base *tkr, ++static inline u64 timekeeping_delta_to_ns(struct tk_read_base *tkr, + cycle_t delta) + { +- s64 nsec; ++ u64 nsec; + + nsec = delta * tkr->mult + tkr->xtime_nsec; + nsec >>= tkr->shift; +diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c +index 7363ccf79512..16047a818d2f 100644 +--- a/kernel/trace/trace_functions_graph.c ++++ b/kernel/trace/trace_functions_graph.c +@@ -780,6 +780,10 @@ print_graph_entry_leaf(struct trace_iterator *iter, + + cpu_data = per_cpu_ptr(data->cpu_data, cpu); + ++ /* If a graph tracer ignored set_graph_notrace */ ++ if (call->depth < -1) ++ call->depth += FTRACE_NOTRACE_DEPTH; ++ + /* + * Comments display at + 1 to depth. Since + * this is a leaf function, keep the comments +@@ -788,7 +792,8 @@ print_graph_entry_leaf(struct trace_iterator *iter, + cpu_data->depth = call->depth - 1; + + /* No need to keep this function around for this depth */ +- if (call->depth < FTRACE_RETFUNC_DEPTH) ++ if (call->depth < FTRACE_RETFUNC_DEPTH && ++ !WARN_ON_ONCE(call->depth < 0)) + cpu_data->enter_funcs[call->depth] = 0; + } + +@@ -818,11 +823,16 @@ print_graph_entry_nested(struct trace_iterator *iter, + struct fgraph_cpu_data *cpu_data; + int cpu = iter->cpu; + ++ /* If a graph tracer ignored set_graph_notrace */ ++ if (call->depth < -1) ++ call->depth += FTRACE_NOTRACE_DEPTH; ++ + cpu_data = per_cpu_ptr(data->cpu_data, cpu); + cpu_data->depth = call->depth; + + /* Save this function pointer to see if the exit matches */ +- if (call->depth < FTRACE_RETFUNC_DEPTH) ++ if (call->depth < FTRACE_RETFUNC_DEPTH && ++ !WARN_ON_ONCE(call->depth < 0)) + cpu_data->enter_funcs[call->depth] = call->func; + } + +@@ -1052,7 +1062,8 @@ print_graph_return(struct ftrace_graph_ret *trace, struct trace_seq *s, + */ + cpu_data->depth = trace->depth - 1; + +- if (trace->depth < FTRACE_RETFUNC_DEPTH) { ++ if (trace->depth < FTRACE_RETFUNC_DEPTH && ++ !WARN_ON_ONCE(trace->depth < 0)) { + if (cpu_data->enter_funcs[trace->depth] != trace->func) + func_match = 0; + cpu_data->enter_funcs[trace->depth] = 0; +diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c +index a5502898ea33..2efb335deada 100644 +--- a/net/ceph/messenger.c ++++ b/net/ceph/messenger.c +@@ -2027,6 +2027,19 @@ static int process_connect(struct ceph_connection *con) + + dout("process_connect on %p tag %d\n", con, (int)con->in_tag); + ++ if (con->auth_reply_buf) { ++ /* ++ * Any connection that defines ->get_authorizer() ++ * should also define ->verify_authorizer_reply(). ++ * See get_connect_authorizer(). ++ */ ++ ret = con->ops->verify_authorizer_reply(con, 0); ++ if (ret < 0) { ++ con->error_msg = "bad authorize reply"; ++ return ret; ++ } ++ } ++ + switch (con->in_reply.tag) { + case CEPH_MSGR_TAG_FEATURES: + pr_err("%s%lld %s feature set mismatch," +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 8d426f637f58..b2e3c320b648 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -2506,7 +2506,7 @@ static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata, + } + + static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata, +- bool assoc) ++ bool assoc, bool abandon) + { + struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data; + +@@ -2529,6 +2529,9 @@ static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata, + mutex_lock(&sdata->local->mtx); + ieee80211_vif_release_channel(sdata); + mutex_unlock(&sdata->local->mtx); ++ ++ if (abandon) ++ cfg80211_abandon_assoc(sdata->dev, assoc_data->bss); + } + + kfree(assoc_data); +@@ -2758,7 +2761,7 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata, + bssid, reason_code, + ieee80211_get_reason_code_string(reason_code)); + +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, true); + + cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len); + return; +@@ -3163,14 +3166,14 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata, + if (status_code != WLAN_STATUS_SUCCESS) { + sdata_info(sdata, "%pM denied association (code=%d)\n", + mgmt->sa, status_code); +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, false); + event.u.mlme.status = MLME_DENIED; + event.u.mlme.reason = status_code; + drv_event_callback(sdata->local, sdata, &event); + } else { + if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) { + /* oops -- internal error -- send timeout for now */ +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, false); + cfg80211_assoc_timeout(sdata->dev, bss); + return; + } +@@ -3183,7 +3186,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata, + * recalc after assoc_data is NULL but before associated + * is set can cause the interface to go idle + */ +- ieee80211_destroy_assoc_data(sdata, true); ++ ieee80211_destroy_assoc_data(sdata, true, false); + + /* get uapsd queues configuration */ + uapsd_queues = 0; +@@ -3882,7 +3885,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata) + .u.mlme.status = MLME_TIMEOUT, + }; + +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, false); + cfg80211_assoc_timeout(sdata->dev, bss); + drv_event_callback(sdata->local, sdata, &event); + } +@@ -4021,7 +4024,7 @@ void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata) + WLAN_REASON_DEAUTH_LEAVING, + false, frame_buf); + if (ifmgd->assoc_data) +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, true); + if (ifmgd->auth_data) + ieee80211_destroy_auth_data(sdata, false); + cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf, +@@ -4903,7 +4906,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata, + IEEE80211_STYPE_DEAUTH, + req->reason_code, tx, + frame_buf); +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, true); + ieee80211_report_disconnect(sdata, frame_buf, + sizeof(frame_buf), true, + req->reason_code); +@@ -4978,7 +4981,7 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata) + sdata_lock(sdata); + if (ifmgd->assoc_data) { + struct cfg80211_bss *bss = ifmgd->assoc_data->bss; +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, false); + cfg80211_assoc_timeout(sdata->dev, bss); + } + if (ifmgd->auth_data) +diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c +index 976c7812bbd5..a0110c2f5ae4 100644 +--- a/net/sunrpc/auth_gss/auth_gss.c ++++ b/net/sunrpc/auth_gss/auth_gss.c +@@ -541,9 +541,13 @@ gss_setup_upcall(struct gss_auth *gss_auth, struct rpc_cred *cred) + return gss_new; + gss_msg = gss_add_msg(gss_new); + if (gss_msg == gss_new) { +- int res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg); ++ int res; ++ atomic_inc(&gss_msg->count); ++ res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg); + if (res) { + gss_unhash_msg(gss_new); ++ atomic_dec(&gss_msg->count); ++ gss_release_msg(gss_new); + gss_msg = ERR_PTR(res); + } + } else +@@ -836,6 +840,7 @@ gss_pipe_destroy_msg(struct rpc_pipe_msg *msg) + warn_gssd(); + gss_release_msg(gss_msg); + } ++ gss_release_msg(gss_msg); + } + + static void gss_pipe_dentry_destroy(struct dentry *dir, +diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c +index a53b3a16b4f1..62c056ea403b 100644 +--- a/net/vmw_vsock/virtio_transport_common.c ++++ b/net/vmw_vsock/virtio_transport_common.c +@@ -606,9 +606,9 @@ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt) + return 0; + + pkt = virtio_transport_alloc_pkt(&info, 0, +- le32_to_cpu(pkt->hdr.dst_cid), ++ le64_to_cpu(pkt->hdr.dst_cid), + le32_to_cpu(pkt->hdr.dst_port), +- le32_to_cpu(pkt->hdr.src_cid), ++ le64_to_cpu(pkt->hdr.src_cid), + le32_to_cpu(pkt->hdr.src_port)); + if (!pkt) + return -ENOMEM; +@@ -823,7 +823,7 @@ virtio_transport_send_response(struct vsock_sock *vsk, + struct virtio_vsock_pkt_info info = { + .op = VIRTIO_VSOCK_OP_RESPONSE, + .type = VIRTIO_VSOCK_TYPE_STREAM, +- .remote_cid = le32_to_cpu(pkt->hdr.src_cid), ++ .remote_cid = le64_to_cpu(pkt->hdr.src_cid), + .remote_port = le32_to_cpu(pkt->hdr.src_port), + .reply = true, + }; +@@ -863,9 +863,9 @@ virtio_transport_recv_listen(struct sock *sk, struct virtio_vsock_pkt *pkt) + child->sk_state = SS_CONNECTED; + + vchild = vsock_sk(child); +- vsock_addr_init(&vchild->local_addr, le32_to_cpu(pkt->hdr.dst_cid), ++ vsock_addr_init(&vchild->local_addr, le64_to_cpu(pkt->hdr.dst_cid), + le32_to_cpu(pkt->hdr.dst_port)); +- vsock_addr_init(&vchild->remote_addr, le32_to_cpu(pkt->hdr.src_cid), ++ vsock_addr_init(&vchild->remote_addr, le64_to_cpu(pkt->hdr.src_cid), + le32_to_cpu(pkt->hdr.src_port)); + + vsock_insert_connected(vchild); +@@ -904,9 +904,9 @@ void virtio_transport_recv_pkt(struct virtio_vsock_pkt *pkt) + struct sock *sk; + bool space_available; + +- vsock_addr_init(&src, le32_to_cpu(pkt->hdr.src_cid), ++ vsock_addr_init(&src, le64_to_cpu(pkt->hdr.src_cid), + le32_to_cpu(pkt->hdr.src_port)); +- vsock_addr_init(&dst, le32_to_cpu(pkt->hdr.dst_cid), ++ vsock_addr_init(&dst, le64_to_cpu(pkt->hdr.dst_cid), + le32_to_cpu(pkt->hdr.dst_port)); + + trace_virtio_transport_recv_pkt(src.svm_cid, src.svm_port, +diff --git a/net/wireless/core.h b/net/wireless/core.h +index 66f2a1145d7c..b5cf21850be7 100644 +--- a/net/wireless/core.h ++++ b/net/wireless/core.h +@@ -410,6 +410,7 @@ void cfg80211_sme_disassoc(struct wireless_dev *wdev); + void cfg80211_sme_deauth(struct wireless_dev *wdev); + void cfg80211_sme_auth_timeout(struct wireless_dev *wdev); + void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev); ++void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev); + + /* internal helpers */ + bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher); +diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c +index c284d883c349..2a62ef628f42 100644 +--- a/net/wireless/mlme.c ++++ b/net/wireless/mlme.c +@@ -149,6 +149,18 @@ void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss) + } + EXPORT_SYMBOL(cfg80211_assoc_timeout); + ++void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss) ++{ ++ struct wireless_dev *wdev = dev->ieee80211_ptr; ++ struct wiphy *wiphy = wdev->wiphy; ++ ++ cfg80211_sme_abandon_assoc(wdev); ++ ++ cfg80211_unhold_bss(bss_from_pub(bss)); ++ cfg80211_put_bss(wiphy, bss); ++} ++EXPORT_SYMBOL(cfg80211_abandon_assoc); ++ + void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len) + { + struct wireless_dev *wdev = dev->ieee80211_ptr; +diff --git a/net/wireless/sme.c b/net/wireless/sme.c +index add6824c44fd..95c713cdabf0 100644 +--- a/net/wireless/sme.c ++++ b/net/wireless/sme.c +@@ -39,6 +39,7 @@ struct cfg80211_conn { + CFG80211_CONN_ASSOCIATING, + CFG80211_CONN_ASSOC_FAILED, + CFG80211_CONN_DEAUTH, ++ CFG80211_CONN_ABANDON, + CFG80211_CONN_CONNECTED, + } state; + u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN]; +@@ -206,6 +207,8 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev) + cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid, + NULL, 0, + WLAN_REASON_DEAUTH_LEAVING, false); ++ /* fall through */ ++ case CFG80211_CONN_ABANDON: + /* free directly, disconnected event already sent */ + cfg80211_sme_free(wdev); + return 0; +@@ -423,6 +426,17 @@ void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev) + schedule_work(&rdev->conn_work); + } + ++void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev) ++{ ++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); ++ ++ if (!wdev->conn) ++ return; ++ ++ wdev->conn->state = CFG80211_CONN_ABANDON; ++ schedule_work(&rdev->conn_work); ++} ++ + static int cfg80211_sme_get_conn_ies(struct wireless_dev *wdev, + const u8 *ies, size_t ies_len, + const u8 **out_ies, size_t *out_ies_len) +diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c +index 8275f0e55106..4b2f44c20caf 100644 +--- a/scripts/kconfig/nconf.gui.c ++++ b/scripts/kconfig/nconf.gui.c +@@ -364,12 +364,14 @@ int dialog_inputbox(WINDOW *main_window, + WINDOW *prompt_win; + WINDOW *form_win; + PANEL *panel; +- int i, x, y; ++ int i, x, y, lines, columns, win_lines, win_cols; + int res = -1; + int cursor_position = strlen(init); + int cursor_form_win; + char *result = *resultp; + ++ getmaxyx(stdscr, lines, columns); ++ + if (strlen(init)+1 > *result_len) { + *result_len = strlen(init)+1; + *resultp = result = realloc(result, *result_len); +@@ -386,14 +388,19 @@ int dialog_inputbox(WINDOW *main_window, + if (title) + prompt_width = max(prompt_width, strlen(title)); + ++ win_lines = min(prompt_lines+6, lines-2); ++ win_cols = min(prompt_width+7, columns-2); ++ prompt_lines = max(win_lines-6, 0); ++ prompt_width = max(win_cols-7, 0); ++ + /* place dialog in middle of screen */ +- y = (getmaxy(stdscr)-(prompt_lines+4))/2; +- x = (getmaxx(stdscr)-(prompt_width+4))/2; ++ y = (lines-win_lines)/2; ++ x = (columns-win_cols)/2; + + strncpy(result, init, *result_len); + + /* create the windows */ +- win = newwin(prompt_lines+6, prompt_width+7, y, x); ++ win = newwin(win_lines, win_cols, y, x); + prompt_win = derwin(win, prompt_lines+1, prompt_width, 2, 2); + form_win = derwin(win, 1, prompt_width, prompt_lines+3, 2); + keypad(form_win, TRUE);
