Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.4/0140-4.4.41-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.4/0140-4.4.41-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2876 - (show annotations) (download)
    Mon Mar 27 13:49:17 2017 UTC (7 years, 1 month ago) by niro
    File size: 75374 byte(s) 
    linux-4.4.41
    1 diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
    2 index 092ee9fbaf2b..df8ab4fc240a 100644
    3 --- a/Documentation/virtual/kvm/api.txt
    4 +++ b/Documentation/virtual/kvm/api.txt
    5 @@ -1991,6 +1991,7 @@ registers, find a list below:
    6 PPC | KVM_REG_PPC_TM_VSCR | 32
    7 PPC | KVM_REG_PPC_TM_DSCR | 64
    8 PPC | KVM_REG_PPC_TM_TAR | 64
    9 + PPC | KVM_REG_PPC_TM_XER | 64
    10 | |
    11 MIPS | KVM_REG_MIPS_R0 | 64
    12 ...
    13 diff --git a/Makefile b/Makefile
    14 index 5b5937780408..855e71066174 100644
    15 --- a/Makefile
    16 +++ b/Makefile
    17 @@ -1,6 +1,6 @@
    18 VERSION = 4
    19 PATCHLEVEL = 4
    20 -SUBLEVEL = 40
    21 +SUBLEVEL = 41
    22 EXTRAVERSION =
    23 NAME = Blurry Fish Butt
    24
    25 diff --git a/arch/arc/include/asm/cacheflush.h b/arch/arc/include/asm/cacheflush.h
    26 index fbe3587c4f36..56aeb5efe604 100644
    27 --- a/arch/arc/include/asm/cacheflush.h
    28 +++ b/arch/arc/include/asm/cacheflush.h
    29 @@ -85,6 +85,10 @@ void flush_anon_page(struct vm_area_struct *vma,
    30 */
    31 #define PG_dc_clean PG_arch_1
    32
    33 +#define CACHE_COLORS_NUM 4
    34 +#define CACHE_COLORS_MSK (CACHE_COLORS_NUM - 1)
    35 +#define CACHE_COLOR(addr) (((unsigned long)(addr) >> (PAGE_SHIFT)) & CACHE_COLORS_MSK)
    36 +
    37 /*
    38 * Simple wrapper over config option
    39 * Bootup code ensures that hardware matches kernel configuration
    40 @@ -94,8 +98,6 @@ static inline int cache_is_vipt_aliasing(void)
    41 return IS_ENABLED(CONFIG_ARC_CACHE_VIPT_ALIASING);
    42 }
    43
    44 -#define CACHE_COLOR(addr) (((unsigned long)(addr) >> (PAGE_SHIFT)) & 1)
    45 -
    46 /*
    47 * checks if two addresses (after page aligning) index into same cache set
    48 */
    49 diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
    50 index aaf1e2d1d900..d81b6d7e11e7 100644
    51 --- a/arch/arc/mm/cache.c
    52 +++ b/arch/arc/mm/cache.c
    53 @@ -960,11 +960,16 @@ void arc_cache_init(void)
    54 /* check for D-Cache aliasing on ARCompact: ARCv2 has PIPT */
    55 if (is_isa_arcompact()) {
    56 int handled = IS_ENABLED(CONFIG_ARC_CACHE_VIPT_ALIASING);
    57 -
    58 - if (dc->alias && !handled)
    59 - panic("Enable CONFIG_ARC_CACHE_VIPT_ALIASING\n");
    60 - else if (!dc->alias && handled)
    61 + int num_colors = dc->sz_k/dc->assoc/TO_KB(PAGE_SIZE);
    62 +
    63 + if (dc->alias) {
    64 + if (!handled)
    65 + panic("Enable CONFIG_ARC_CACHE_VIPT_ALIASING\n");
    66 + if (CACHE_COLORS_NUM != num_colors)
    67 + panic("CACHE_COLORS_NUM not optimized for config\n");
    68 + } else if (!dc->alias && handled) {
    69 panic("Disable CONFIG_ARC_CACHE_VIPT_ALIASING\n");
    70 + }
    71 }
    72 }
    73
    74 diff --git a/arch/powerpc/boot/ps3-head.S b/arch/powerpc/boot/ps3-head.S
    75 index b6fcbaf5027b..3dc44b05fb97 100644
    76 --- a/arch/powerpc/boot/ps3-head.S
    77 +++ b/arch/powerpc/boot/ps3-head.S
    78 @@ -57,11 +57,6 @@ __system_reset_overlay:
    79 bctr
    80
    81 1:
    82 - /* Save the value at addr zero for a null pointer write check later. */
    83 -
    84 - li r4, 0
    85 - lwz r3, 0(r4)
    86 -
    87 /* Primary delays then goes to _zimage_start in wrapper. */
    88
    89 or 31, 31, 31 /* db16cyc */
    90 diff --git a/arch/powerpc/boot/ps3.c b/arch/powerpc/boot/ps3.c
    91 index 4ec2d86d3c50..a05558a7e51a 100644
    92 --- a/arch/powerpc/boot/ps3.c
    93 +++ b/arch/powerpc/boot/ps3.c
    94 @@ -119,13 +119,12 @@ void ps3_copy_vectors(void)
    95 flush_cache((void *)0x100, 512);
    96 }
    97
    98 -void platform_init(unsigned long null_check)
    99 +void platform_init(void)
    100 {
    101 const u32 heapsize = 0x1000000 - (u32)_end; /* 16MiB */
    102 void *chosen;
    103 unsigned long ft_addr;
    104 u64 rm_size;
    105 - unsigned long val;
    106
    107 console_ops.write = ps3_console_write;
    108 platform_ops.exit = ps3_exit;
    109 @@ -153,11 +152,6 @@ void platform_init(unsigned long null_check)
    110
    111 printf(" flat tree at 0x%lx\n\r", ft_addr);
    112
    113 - val = *(unsigned long *)0;
    114 -
    115 - if (val != null_check)
    116 - printf("null check failed: %lx != %lx\n\r", val, null_check);
    117 -
    118 ((kernel_entry_t)0)(ft_addr, 0, NULL);
    119
    120 ps3_exit();
    121 diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
    122 index cfa758c6b4f6..a92d95aee42d 100644
    123 --- a/arch/powerpc/include/asm/kvm_host.h
    124 +++ b/arch/powerpc/include/asm/kvm_host.h
    125 @@ -545,6 +545,7 @@ struct kvm_vcpu_arch {
    126 u64 tfiar;
    127
    128 u32 cr_tm;
    129 + u64 xer_tm;
    130 u64 lr_tm;
    131 u64 ctr_tm;
    132 u64 amr_tm;
    133 diff --git a/arch/powerpc/include/uapi/asm/kvm.h b/arch/powerpc/include/uapi/asm/kvm.h
    134 index ab4d4732c492..720b71a636c8 100644
    135 --- a/arch/powerpc/include/uapi/asm/kvm.h
    136 +++ b/arch/powerpc/include/uapi/asm/kvm.h
    137 @@ -587,6 +587,7 @@ struct kvm_get_htab_header {
    138 #define KVM_REG_PPC_TM_VSCR (KVM_REG_PPC_TM | KVM_REG_SIZE_U32 | 0x67)
    139 #define KVM_REG_PPC_TM_DSCR (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x68)
    140 #define KVM_REG_PPC_TM_TAR (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x69)
    141 +#define KVM_REG_PPC_TM_XER (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x6a)
    142
    143 /* PPC64 eXternal Interrupt Controller Specification */
    144 #define KVM_DEV_XICS_GRP_SOURCES 1 /* 64-bit source attributes */
    145 diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
    146 index 221d584d089f..40da69163d51 100644
    147 --- a/arch/powerpc/kernel/asm-offsets.c
    148 +++ b/arch/powerpc/kernel/asm-offsets.c
    149 @@ -584,6 +584,7 @@ int main(void)
    150 DEFINE(VCPU_VRS_TM, offsetof(struct kvm_vcpu, arch.vr_tm.vr));
    151 DEFINE(VCPU_VRSAVE_TM, offsetof(struct kvm_vcpu, arch.vrsave_tm));
    152 DEFINE(VCPU_CR_TM, offsetof(struct kvm_vcpu, arch.cr_tm));
    153 + DEFINE(VCPU_XER_TM, offsetof(struct kvm_vcpu, arch.xer_tm));
    154 DEFINE(VCPU_LR_TM, offsetof(struct kvm_vcpu, arch.lr_tm));
    155 DEFINE(VCPU_CTR_TM, offsetof(struct kvm_vcpu, arch.ctr_tm));
    156 DEFINE(VCPU_AMR_TM, offsetof(struct kvm_vcpu, arch.amr_tm));
    157 diff --git a/arch/powerpc/kernel/idle_power7.S b/arch/powerpc/kernel/idle_power7.S
    158 index 112ccf497562..73f638789a38 100644
    159 --- a/arch/powerpc/kernel/idle_power7.S
    160 +++ b/arch/powerpc/kernel/idle_power7.S
    161 @@ -44,7 +44,7 @@
    162 std r0,0(r1); \
    163 ptesync; \
    164 ld r0,0(r1); \
    165 -1: cmp cr0,r0,r0; \
    166 +1: cmpd cr0,r0,r0; \
    167 bne 1b; \
    168 IDLE_INST; \
    169 b .
    170 diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
    171 index a7352b59e6f9..3c3a367b6e59 100644
    172 --- a/arch/powerpc/kvm/book3s_hv.c
    173 +++ b/arch/powerpc/kvm/book3s_hv.c
    174 @@ -1186,6 +1186,9 @@ static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, u64 id,
    175 case KVM_REG_PPC_TM_CR:
    176 *val = get_reg_val(id, vcpu->arch.cr_tm);
    177 break;
    178 + case KVM_REG_PPC_TM_XER:
    179 + *val = get_reg_val(id, vcpu->arch.xer_tm);
    180 + break;
    181 case KVM_REG_PPC_TM_LR:
    182 *val = get_reg_val(id, vcpu->arch.lr_tm);
    183 break;
    184 @@ -1393,6 +1396,9 @@ static int kvmppc_set_one_reg_hv(struct kvm_vcpu *vcpu, u64 id,
    185 case KVM_REG_PPC_TM_CR:
    186 vcpu->arch.cr_tm = set_reg_val(id, *val);
    187 break;
    188 + case KVM_REG_PPC_TM_XER:
    189 + vcpu->arch.xer_tm = set_reg_val(id, *val);
    190 + break;
    191 case KVM_REG_PPC_TM_LR:
    192 vcpu->arch.lr_tm = set_reg_val(id, *val);
    193 break;
    194 diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
    195 index 91700518bbf3..d509ff5c87b0 100644
    196 --- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
    197 +++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
    198 @@ -653,6 +653,8 @@ long kvmppc_h_protect(struct kvm_vcpu *vcpu, unsigned long flags,
    199 HPTE_V_ABSENT);
    200 do_tlbies(kvm, &rb, 1, global_invalidates(kvm, flags),
    201 true);
    202 + /* Don't lose R/C bit updates done by hardware */
    203 + r |= be64_to_cpu(hpte[1]) & (HPTE_R_R | HPTE_R_C);
    204 hpte[1] = cpu_to_be64(r);
    205 }
    206 }
    207 diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
    208 index 974f73df00bb..1a743f87b37d 100644
    209 --- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
    210 +++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
    211 @@ -2514,11 +2514,13 @@ kvmppc_save_tm:
    212 mfctr r7
    213 mfspr r8, SPRN_AMR
    214 mfspr r10, SPRN_TAR
    215 + mfxer r11
    216 std r5, VCPU_LR_TM(r9)
    217 stw r6, VCPU_CR_TM(r9)
    218 std r7, VCPU_CTR_TM(r9)
    219 std r8, VCPU_AMR_TM(r9)
    220 std r10, VCPU_TAR_TM(r9)
    221 + std r11, VCPU_XER_TM(r9)
    222
    223 /* Restore r12 as trap number. */
    224 lwz r12, VCPU_TRAP(r9)
    225 @@ -2611,11 +2613,13 @@ kvmppc_restore_tm:
    226 ld r7, VCPU_CTR_TM(r4)
    227 ld r8, VCPU_AMR_TM(r4)
    228 ld r9, VCPU_TAR_TM(r4)
    229 + ld r10, VCPU_XER_TM(r4)
    230 mtlr r5
    231 mtcr r6
    232 mtctr r7
    233 mtspr SPRN_AMR, r8
    234 mtspr SPRN_TAR, r9
    235 + mtxer r10
    236
    237 /*
    238 * Load up PPR and DSCR values but don't put them in the actual SPRs
    239 diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
    240 index f3b6d54e0042..ae678ad128a9 100644
    241 --- a/arch/x86/entry/entry_32.S
    242 +++ b/arch/x86/entry/entry_32.S
    243 @@ -766,8 +766,8 @@ ftrace_graph_call:
    244 jmp ftrace_stub
    245 #endif
    246
    247 -.globl ftrace_stub
    248 -ftrace_stub:
    249 +/* This is weak to keep gas from relaxing the jumps */
    250 +WEAK(ftrace_stub)
    251 ret
    252 END(ftrace_caller)
    253
    254 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
    255 index 268df707b5ce..bb620df05d0d 100644
    256 --- a/arch/x86/kvm/vmx.c
    257 +++ b/arch/x86/kvm/vmx.c
    258 @@ -1247,10 +1247,10 @@ static inline bool nested_cpu_has_posted_intr(struct vmcs12 *vmcs12)
    259 return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR;
    260 }
    261
    262 -static inline bool is_exception(u32 intr_info)
    263 +static inline bool is_nmi(u32 intr_info)
    264 {
    265 return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
    266 - == (INTR_TYPE_HARD_EXCEPTION | INTR_INFO_VALID_MASK);
    267 + == (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK);
    268 }
    269
    270 static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
    271 @@ -5234,7 +5234,7 @@ static int handle_exception(struct kvm_vcpu *vcpu)
    272 if (is_machine_check(intr_info))
    273 return handle_machine_check(vcpu);
    274
    275 - if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR)
    276 + if (is_nmi(intr_info))
    277 return 1; /* already handled by vmx_vcpu_run() */
    278
    279 if (is_no_device(intr_info)) {
    280 @@ -7722,7 +7722,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
    281
    282 switch (exit_reason) {
    283 case EXIT_REASON_EXCEPTION_NMI:
    284 - if (!is_exception(intr_info))
    285 + if (is_nmi(intr_info))
    286 return false;
    287 else if (is_page_fault(intr_info))
    288 return enable_ept;
    289 @@ -8329,8 +8329,7 @@ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
    290 kvm_machine_check();
    291
    292 /* We need to handle NMIs before interrupts are enabled */
    293 - if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
    294 - (exit_intr_info & INTR_INFO_VALID_MASK)) {
    295 + if (is_nmi(exit_intr_info)) {
    296 kvm_before_handle_nmi(&vmx->vcpu);
    297 asm("int $2");
    298 kvm_after_handle_nmi(&vmx->vcpu);
    299 diff --git a/block/bsg.c b/block/bsg.c
    300 index d214e929ce18..b9a53615bdef 100644
    301 --- a/block/bsg.c
    302 +++ b/block/bsg.c
    303 @@ -655,6 +655,9 @@ bsg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
    304
    305 dprintk("%s: write %Zd bytes\n", bd->name, count);
    306
    307 + if (unlikely(segment_eq(get_fs(), KERNEL_DS)))
    308 + return -EINVAL;
    309 +
    310 bsg_set_block(bd, file);
    311
    312 bytes_written = 0;
    313 diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
    314 index 80e55cb0827b..b48ecbfc4498 100644
    315 --- a/drivers/acpi/video_detect.c
    316 +++ b/drivers/acpi/video_detect.c
    317 @@ -271,6 +271,26 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
    318 DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro12,1"),
    319 },
    320 },
    321 + {
    322 + /* https://bugzilla.redhat.com/show_bug.cgi?id=1123661 */
    323 + .callback = video_detect_force_native,
    324 + .ident = "Dell XPS 17 L702X",
    325 + .matches = {
    326 + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
    327 + DMI_MATCH(DMI_PRODUCT_NAME, "Dell System XPS L702X"),
    328 + },
    329 + },
    330 + {
    331 + /* https://bugzilla.redhat.com/show_bug.cgi?id=1204476 */
    332 + /* https://bugs.launchpad.net/ubuntu/+source/linux-lts-trusty/+bug/1416940 */
    333 + .callback = video_detect_force_native,
    334 + .ident = "HP Pavilion dv6",
    335 + .matches = {
    336 + DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
    337 + DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv6 Notebook PC"),
    338 + },
    339 + },
    340 +
    341 { },
    342 };
    343
    344 diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
    345 index 8524450e75bd..ccfd268148a8 100644
    346 --- a/drivers/base/firmware_class.c
    347 +++ b/drivers/base/firmware_class.c
    348 @@ -942,13 +942,14 @@ static int _request_firmware_load(struct firmware_priv *fw_priv,
    349 timeout = MAX_JIFFY_OFFSET;
    350 }
    351
    352 - retval = wait_for_completion_interruptible_timeout(&buf->completion,
    353 + timeout = wait_for_completion_interruptible_timeout(&buf->completion,
    354 timeout);
    355 - if (retval == -ERESTARTSYS || !retval) {
    356 + if (timeout == -ERESTARTSYS || !timeout) {
    357 + retval = timeout;
    358 mutex_lock(&fw_lock);
    359 fw_load_abort(fw_priv);
    360 mutex_unlock(&fw_lock);
    361 - } else if (retval > 0) {
    362 + } else if (timeout > 0) {
    363 retval = 0;
    364 }
    365
    366 diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
    367 index 6029313aa995..35ab89fe9d7b 100644
    368 --- a/drivers/clk/bcm/clk-bcm2835.c
    369 +++ b/drivers/clk/bcm/clk-bcm2835.c
    370 @@ -1082,7 +1082,9 @@ static void bcm2835_pll_divider_off(struct clk_hw *hw)
    371 cprman_write(cprman, data->cm_reg,
    372 (cprman_read(cprman, data->cm_reg) &
    373 ~data->load_mask) | data->hold_mask);
    374 - cprman_write(cprman, data->a2w_reg, A2W_PLL_CHANNEL_DISABLE);
    375 + cprman_write(cprman, data->a2w_reg,
    376 + cprman_read(cprman, data->a2w_reg) |
    377 + A2W_PLL_CHANNEL_DISABLE);
    378 spin_unlock(&cprman->regs_lock);
    379 }
    380
    381 diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
    382 index e0b4586a26fd..9b8f0b975ca6 100644
    383 --- a/drivers/gpu/drm/ast/ast_main.c
    384 +++ b/drivers/gpu/drm/ast/ast_main.c
    385 @@ -223,7 +223,8 @@ static int ast_get_dram_info(struct drm_device *dev)
    386 ast_write32(ast, 0x10000, 0xfc600309);
    387
    388 do {
    389 - ;
    390 + if (pci_channel_offline(dev->pdev))
    391 + return -EIO;
    392 } while (ast_read32(ast, 0x10000) != 0x01);
    393 data = ast_read32(ast, 0x10004);
    394
    395 @@ -429,7 +430,9 @@ int ast_driver_load(struct drm_device *dev, unsigned long flags)
    396 ast_detect_chip(dev, &need_post);
    397
    398 if (ast->chip != AST1180) {
    399 - ast_get_dram_info(dev);
    400 + ret = ast_get_dram_info(dev);
    401 + if (ret)
    402 + goto out_free;
    403 ast->vram_size = ast_get_vram_info(dev);
    404 DRM_INFO("dram %d %d %d %08x\n", ast->mclk, ast->dram_type, ast->dram_bus_width, ast->vram_size);
    405 }
    406 diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
    407 index 92e7e5795398..db98ab5cde3d 100644
    408 --- a/drivers/gpu/drm/gma500/psb_drv.c
    409 +++ b/drivers/gpu/drm/gma500/psb_drv.c
    410 @@ -484,6 +484,9 @@ static const struct file_operations psb_gem_fops = {
    411 .open = drm_open,
    412 .release = drm_release,
    413 .unlocked_ioctl = psb_unlocked_ioctl,
    414 +#ifdef CONFIG_COMPAT
    415 + .compat_ioctl = drm_compat_ioctl,
    416 +#endif
    417 .mmap = drm_gem_mmap,
    418 .poll = drm_poll,
    419 .read = drm_read,
    420 diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
    421 index 4dca65a63b92..af224fafa21f 100644
    422 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c
    423 +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
    424 @@ -333,6 +333,9 @@ get_fp_strap(struct drm_device *dev, struct nvbios *bios)
    425 if (bios->major_version < 5 && bios->data[0x48] & 0x4)
    426 return NVReadVgaCrtc5758(dev, 0, 0xf) & 0xf;
    427
    428 + if (drm->device.info.family >= NV_DEVICE_INFO_V0_MAXWELL)
    429 + return nvif_rd32(device, 0x001800) & 0x0000000f;
    430 + else
    431 if (drm->device.info.family >= NV_DEVICE_INFO_V0_TESLA)
    432 return (nvif_rd32(device, NV_PEXTDEV_BOOT_0) >> 24) & 0xf;
    433 else
    434 diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
    435 index bbc9824af6e0..ece9f4102c0e 100644
    436 --- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
    437 +++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
    438 @@ -1833,7 +1833,7 @@ nvf1_chipset = {
    439 .fb = gk104_fb_new,
    440 .fuse = gf100_fuse_new,
    441 .gpio = gk104_gpio_new,
    442 - .i2c = gf119_i2c_new,
    443 + .i2c = gk104_i2c_new,
    444 .ibus = gk104_ibus_new,
    445 .imem = nv50_instmem_new,
    446 .ltc = gk104_ltc_new,
    447 @@ -1941,7 +1941,7 @@ nv117_chipset = {
    448 .fb = gm107_fb_new,
    449 .fuse = gm107_fuse_new,
    450 .gpio = gk104_gpio_new,
    451 - .i2c = gf119_i2c_new,
    452 + .i2c = gk104_i2c_new,
    453 .ibus = gk104_ibus_new,
    454 .imem = nv50_instmem_new,
    455 .ltc = gm107_ltc_new,
    456 diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c
    457 index e7cbc139c1d4..89976ff4b305 100644
    458 --- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c
    459 +++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c
    460 @@ -59,6 +59,7 @@ gf100_fifo_gpfifo_engine_fini(struct nvkm_fifo_chan *base,
    461 struct nvkm_gpuobj *inst = chan->base.inst;
    462 int ret = 0;
    463
    464 + mutex_lock(&subdev->mutex);
    465 nvkm_wr32(device, 0x002634, chan->base.chid);
    466 if (nvkm_msec(device, 2000,
    467 if (nvkm_rd32(device, 0x002634) == chan->base.chid)
    468 @@ -66,10 +67,12 @@ gf100_fifo_gpfifo_engine_fini(struct nvkm_fifo_chan *base,
    469 ) < 0) {
    470 nvkm_error(subdev, "channel %d [%s] kick timeout\n",
    471 chan->base.chid, chan->base.object.client->name);
    472 - ret = -EBUSY;
    473 - if (suspend)
    474 - return ret;
    475 + ret = -ETIMEDOUT;
    476 }
    477 + mutex_unlock(&subdev->mutex);
    478 +
    479 + if (ret && suspend)
    480 + return ret;
    481
    482 if (offset) {
    483 nvkm_kmap(inst);
    484 diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c
    485 index 0b817540a9e4..aa1692e5669f 100644
    486 --- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c
    487 +++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c
    488 @@ -39,7 +39,9 @@ gk104_fifo_gpfifo_kick(struct gk104_fifo_chan *chan)
    489 struct nvkm_subdev *subdev = &fifo->base.engine.subdev;
    490 struct nvkm_device *device = subdev->device;
    491 struct nvkm_client *client = chan->base.object.client;
    492 + int ret = 0;
    493
    494 + mutex_lock(&subdev->mutex);
    495 nvkm_wr32(device, 0x002634, chan->base.chid);
    496 if (nvkm_msec(device, 2000,
    497 if (!(nvkm_rd32(device, 0x002634) & 0x00100000))
    498 @@ -47,10 +49,10 @@ gk104_fifo_gpfifo_kick(struct gk104_fifo_chan *chan)
    499 ) < 0) {
    500 nvkm_error(subdev, "channel %d [%s] kick timeout\n",
    501 chan->base.chid, client->name);
    502 - return -EBUSY;
    503 + ret = -ETIMEDOUT;
    504 }
    505 -
    506 - return 0;
    507 + mutex_unlock(&subdev->mutex);
    508 + return ret;
    509 }
    510
    511 static u32
    512 diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h
    513 index 212800ecdce9..7d1d3c6b4b72 100644
    514 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h
    515 +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h
    516 @@ -12,6 +12,7 @@ struct nvbios_source {
    517 bool rw;
    518 bool ignore_checksum;
    519 bool no_pcir;
    520 + bool require_checksum;
    521 };
    522
    523 int nvbios_extend(struct nvkm_bios *, u32 length);
    524 diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
    525 index b2557e87afdd..7deb81b6dbac 100644
    526 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
    527 +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
    528 @@ -86,9 +86,12 @@ shadow_image(struct nvkm_bios *bios, int idx, u32 offset, struct shadow *mthd)
    529 nvbios_checksum(&bios->data[image.base], image.size)) {
    530 nvkm_debug(subdev, "%08x: checksum failed\n",
    531 image.base);
    532 - if (mthd->func->rw)
    533 + if (!mthd->func->require_checksum) {
    534 + if (mthd->func->rw)
    535 + score += 1;
    536 score += 1;
    537 - score += 1;
    538 + } else
    539 + return 0;
    540 } else {
    541 score += 3;
    542 }
    543 diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c
    544 index 8fecb5ff22a0..06572f8ce914 100644
    545 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c
    546 +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c
    547 @@ -99,6 +99,7 @@ nvbios_acpi_fast = {
    548 .init = acpi_init,
    549 .read = acpi_read_fast,
    550 .rw = false,
    551 + .require_checksum = true,
    552 };
    553
    554 const struct nvbios_source
    555 diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c
    556 index 85b1464c0194..587c52f08d3f 100644
    557 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c
    558 +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c
    559 @@ -47,8 +47,10 @@ nvkm_ltc_tags_clear(struct nvkm_ltc *ltc, u32 first, u32 count)
    560
    561 BUG_ON((first > limit) || (limit >= ltc->num_tags));
    562
    563 + mutex_lock(&ltc->subdev.mutex);
    564 ltc->func->cbc_clear(ltc, first, limit);
    565 ltc->func->cbc_wait(ltc);
    566 + mutex_unlock(&ltc->subdev.mutex);
    567 }
    568
    569 int
    570 diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
    571 index afaf346bd50e..b5b9cb911111 100644
    572 --- a/drivers/gpu/drm/radeon/radeon_cursor.c
    573 +++ b/drivers/gpu/drm/radeon/radeon_cursor.c
    574 @@ -90,6 +90,9 @@ static void radeon_show_cursor(struct drm_crtc *crtc)
    575 struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
    576 struct radeon_device *rdev = crtc->dev->dev_private;
    577
    578 + if (radeon_crtc->cursor_out_of_bounds)
    579 + return;
    580 +
    581 if (ASIC_IS_DCE4(rdev)) {
    582 WREG32(EVERGREEN_CUR_SURFACE_ADDRESS_HIGH + radeon_crtc->crtc_offset,
    583 upper_32_bits(radeon_crtc->cursor_addr));
    584 @@ -148,16 +151,17 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
    585 x += crtc->x;
    586 y += crtc->y;
    587 }
    588 - DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
    589
    590 - if (x < 0) {
    591 + if (x < 0)
    592 xorigin = min(-x, radeon_crtc->max_cursor_width - 1);
    593 - x = 0;
    594 - }
    595 - if (y < 0) {
    596 + if (y < 0)
    597 yorigin = min(-y, radeon_crtc->max_cursor_height - 1);
    598 - y = 0;
    599 +
    600 + if (!ASIC_IS_AVIVO(rdev)) {
    601 + x += crtc->x;
    602 + y += crtc->y;
    603 }
    604 + DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
    605
    606 /* fixed on DCE6 and newer */
    607 if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE6(rdev)) {
    608 @@ -180,27 +184,31 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
    609 if (i > 1) {
    610 int cursor_end, frame_end;
    611
    612 - cursor_end = x - xorigin + w;
    613 + cursor_end = x + w;
    614 frame_end = crtc->x + crtc->mode.crtc_hdisplay;
    615 if (cursor_end >= frame_end) {
    616 w = w - (cursor_end - frame_end);
    617 if (!(frame_end & 0x7f))
    618 w--;
    619 - } else {
    620 - if (!(cursor_end & 0x7f))
    621 - w--;
    622 + } else if (cursor_end <= 0) {
    623 + goto out_of_bounds;
    624 + } else if (!(cursor_end & 0x7f)) {
    625 + w--;
    626 }
    627 if (w <= 0) {
    628 - w = 1;
    629 - cursor_end = x - xorigin + w;
    630 - if (!(cursor_end & 0x7f)) {
    631 - x--;
    632 - WARN_ON_ONCE(x < 0);
    633 - }
    634 + goto out_of_bounds;
    635 }
    636 }
    637 }
    638
    639 + if (x <= (crtc->x - w) || y <= (crtc->y - radeon_crtc->cursor_height) ||
    640 + x >= (crtc->x + crtc->mode.crtc_hdisplay) ||
    641 + y >= (crtc->y + crtc->mode.crtc_vdisplay))
    642 + goto out_of_bounds;
    643 +
    644 + x += xorigin;
    645 + y += yorigin;
    646 +
    647 if (ASIC_IS_DCE4(rdev)) {
    648 WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset, (x << 16) | y);
    649 WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin);
    650 @@ -212,6 +220,9 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
    651 WREG32(AVIVO_D1CUR_SIZE + radeon_crtc->crtc_offset,
    652 ((w - 1) << 16) | (radeon_crtc->cursor_height - 1));
    653 } else {
    654 + x -= crtc->x;
    655 + y -= crtc->y;
    656 +
    657 if (crtc->mode.flags & DRM_MODE_FLAG_DBLSCAN)
    658 y *= 2;
    659
    660 @@ -232,6 +243,19 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
    661 radeon_crtc->cursor_x = x;
    662 radeon_crtc->cursor_y = y;
    663
    664 + if (radeon_crtc->cursor_out_of_bounds) {
    665 + radeon_crtc->cursor_out_of_bounds = false;
    666 + if (radeon_crtc->cursor_bo)
    667 + radeon_show_cursor(crtc);
    668 + }
    669 +
    670 + return 0;
    671 +
    672 + out_of_bounds:
    673 + if (!radeon_crtc->cursor_out_of_bounds) {
    674 + radeon_hide_cursor(crtc);
    675 + radeon_crtc->cursor_out_of_bounds = true;
    676 + }
    677 return 0;
    678 }
    679
    680 @@ -297,22 +321,23 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
    681 return ret;
    682 }
    683
    684 - radeon_crtc->cursor_width = width;
    685 - radeon_crtc->cursor_height = height;
    686 -
    687 radeon_lock_cursor(crtc, true);
    688
    689 - if (hot_x != radeon_crtc->cursor_hot_x ||
    690 + if (width != radeon_crtc->cursor_width ||
    691 + height != radeon_crtc->cursor_height ||
    692 + hot_x != radeon_crtc->cursor_hot_x ||
    693 hot_y != radeon_crtc->cursor_hot_y) {
    694 int x, y;
    695
    696 x = radeon_crtc->cursor_x + radeon_crtc->cursor_hot_x - hot_x;
    697 y = radeon_crtc->cursor_y + radeon_crtc->cursor_hot_y - hot_y;
    698
    699 - radeon_cursor_move_locked(crtc, x, y);
    700 -
    701 + radeon_crtc->cursor_width = width;
    702 + radeon_crtc->cursor_height = height;
    703 radeon_crtc->cursor_hot_x = hot_x;
    704 radeon_crtc->cursor_hot_y = hot_y;
    705 +
    706 + radeon_cursor_move_locked(crtc, x, y);
    707 }
    708
    709 radeon_show_cursor(crtc);
    710 diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
    711 index 7a0666ac4e23..d8f8be608c19 100644
    712 --- a/drivers/gpu/drm/radeon/radeon_mode.h
    713 +++ b/drivers/gpu/drm/radeon/radeon_mode.h
    714 @@ -330,6 +330,7 @@ struct radeon_crtc {
    715 u16 lut_r[256], lut_g[256], lut_b[256];
    716 bool enabled;
    717 bool can_tile;
    718 + bool cursor_out_of_bounds;
    719 uint32_t crtc_offset;
    720 struct drm_gem_object *cursor_bo;
    721 uint64_t cursor_addr;
    722 diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
    723 index 10191b935937..eb2a2a49974f 100644
    724 --- a/drivers/gpu/drm/radeon/si_dpm.c
    725 +++ b/drivers/gpu/drm/radeon/si_dpm.c
    726 @@ -3026,6 +3026,7 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
    727 (rdev->pdev->revision == 0x80) ||
    728 (rdev->pdev->revision == 0x81) ||
    729 (rdev->pdev->revision == 0x83) ||
    730 + (rdev->pdev->revision == 0x87) ||
    731 (rdev->pdev->device == 0x6604) ||
    732 (rdev->pdev->device == 0x6605)) {
    733 max_sclk = 75000;
    734 diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
    735 index 2281de122038..8d84c563ba75 100644
    736 --- a/drivers/infiniband/core/mad.c
    737 +++ b/drivers/infiniband/core/mad.c
    738 @@ -1745,7 +1745,7 @@ find_mad_agent(struct ib_mad_port_private *port_priv,
    739 if (!class)
    740 goto out;
    741 if (convert_mgmt_class(mad_hdr->mgmt_class) >=
    742 - IB_MGMT_MAX_METHODS)
    743 + ARRAY_SIZE(class->method_table))
    744 goto out;
    745 method = class->method_table[convert_mgmt_class(
    746 mad_hdr->mgmt_class)];
    747 diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
    748 index 6aa648cb5381..2cd97977b988 100644
    749 --- a/drivers/infiniband/core/multicast.c
    750 +++ b/drivers/infiniband/core/multicast.c
    751 @@ -517,8 +517,11 @@ static void join_handler(int status, struct ib_sa_mcmember_rec *rec,
    752 process_join_error(group, status);
    753 else {
    754 int mgids_changed, is_mgid0;
    755 - ib_find_pkey(group->port->dev->device, group->port->port_num,
    756 - be16_to_cpu(rec->pkey), &pkey_index);
    757 +
    758 + if (ib_find_pkey(group->port->dev->device,
    759 + group->port->port_num, be16_to_cpu(rec->pkey),
    760 + &pkey_index))
    761 + pkey_index = MCAST_INVALID_PKEY_INDEX;
    762
    763 spin_lock_irq(&group->port->lock);
    764 if (group->state == MCAST_BUSY &&
    765 diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
    766 index 87799de90a1d..8ec99bdea76b 100644
    767 --- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
    768 +++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
    769 @@ -563,8 +563,11 @@ void ipoib_mcast_join_task(struct work_struct *work)
    770 if (!test_bit(IPOIB_FLAG_OPER_UP, &priv->flags))
    771 return;
    772
    773 - if (ib_query_port(priv->ca, priv->port, &port_attr) ||
    774 - port_attr.state != IB_PORT_ACTIVE) {
    775 + if (ib_query_port(priv->ca, priv->port, &port_attr)) {
    776 + ipoib_dbg(priv, "ib_query_port() failed\n");
    777 + return;
    778 + }
    779 + if (port_attr.state != IB_PORT_ACTIVE) {
    780 ipoib_dbg(priv, "port state is not ACTIVE (state = %d) suspending join task\n",
    781 port_attr.state);
    782 return;
    783 diff --git a/drivers/input/misc/drv260x.c b/drivers/input/misc/drv260x.c
    784 index 2adfd86c869a..930424e55439 100644
    785 --- a/drivers/input/misc/drv260x.c
    786 +++ b/drivers/input/misc/drv260x.c
    787 @@ -592,7 +592,6 @@ static int drv260x_probe(struct i2c_client *client,
    788 }
    789
    790 haptics->input_dev->name = "drv260x:haptics";
    791 - haptics->input_dev->dev.parent = client->dev.parent;
    792 haptics->input_dev->close = drv260x_close;
    793 input_set_drvdata(haptics->input_dev, haptics);
    794 input_set_capability(haptics->input_dev, EV_FF, FF_RUMBLE);
    795 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
    796 index 10ce885445f6..7af976934441 100644
    797 --- a/drivers/md/raid5.c
    798 +++ b/drivers/md/raid5.c
    799 @@ -6980,6 +6980,15 @@ static int run(struct mddev *mddev)
    800 stripe = (stripe | (stripe-1)) + 1;
    801 mddev->queue->limits.discard_alignment = stripe;
    802 mddev->queue->limits.discard_granularity = stripe;
    803 +
    804 + /*
    805 + * We use 16-bit counter of active stripes in bi_phys_segments
    806 + * (minus one for over-loaded initialization)
    807 + */
    808 + blk_queue_max_hw_sectors(mddev->queue, 0xfffe * STRIPE_SECTORS);
    809 + blk_queue_max_discard_sectors(mddev->queue,
    810 + 0xfffe * STRIPE_SECTORS);
    811 +
    812 /*
    813 * unaligned part of discard request will be ignored, so can't
    814 * guarantee discard_zeroes_data
    815 diff --git a/drivers/media/pci/solo6x10/solo6x10.h b/drivers/media/pci/solo6x10/solo6x10.h
    816 index 4ab6586c0467..f53e59e9c0ea 100644
    817 --- a/drivers/media/pci/solo6x10/solo6x10.h
    818 +++ b/drivers/media/pci/solo6x10/solo6x10.h
    819 @@ -286,7 +286,10 @@ static inline u32 solo_reg_read(struct solo_dev *solo_dev, int reg)
    820 static inline void solo_reg_write(struct solo_dev *solo_dev, int reg,
    821 u32 data)
    822 {
    823 + u16 val;
    824 +
    825 writel(data, solo_dev->reg_base + reg);
    826 + pci_read_config_word(solo_dev->pdev, PCI_STATUS, &val);
    827 }
    828
    829 static inline void solo_irq_on(struct solo_dev *dev, u32 mask)
    830 diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
    831 index 958af84884b5..2ff39fbc70d1 100644
    832 --- a/drivers/misc/mei/client.c
    833 +++ b/drivers/misc/mei/client.c
    834 @@ -698,7 +698,7 @@ void mei_host_client_init(struct work_struct *work)
    835
    836 pm_runtime_mark_last_busy(dev->dev);
    837 dev_dbg(dev->dev, "rpm: autosuspend\n");
    838 - pm_runtime_autosuspend(dev->dev);
    839 + pm_request_autosuspend(dev->dev);
    840 }
    841
    842 /**
    843 diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
    844 index 64a428984afe..7277dfd7338f 100644
    845 --- a/drivers/mmc/host/sdhci.c
    846 +++ b/drivers/mmc/host/sdhci.c
    847 @@ -2040,7 +2040,27 @@ static int sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode)
    848 ctrl &= ~SDHCI_CTRL_EXEC_TUNING;
    849 sdhci_writew(host, ctrl, SDHCI_HOST_CONTROL2);
    850
    851 + sdhci_do_reset(host, SDHCI_RESET_CMD);
    852 + sdhci_do_reset(host, SDHCI_RESET_DATA);
    853 +
    854 err = -EIO;
    855 +
    856 + if (cmd.opcode != MMC_SEND_TUNING_BLOCK_HS200)
    857 + goto out;
    858 +
    859 + sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
    860 + sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
    861 +
    862 + spin_unlock_irqrestore(&host->lock, flags);
    863 +
    864 + memset(&cmd, 0, sizeof(cmd));
    865 + cmd.opcode = MMC_STOP_TRANSMISSION;
    866 + cmd.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
    867 + cmd.busy_timeout = 50;
    868 + mmc_wait_for_cmd(mmc, &cmd, 0);
    869 +
    870 + spin_lock_irqsave(&host->lock, flags);
    871 +
    872 goto out;
    873 }
    874
    875 diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
    876 index a4beccf1fd46..25aba9886990 100644
    877 --- a/drivers/net/ethernet/marvell/mvpp2.c
    878 +++ b/drivers/net/ethernet/marvell/mvpp2.c
    879 @@ -772,6 +772,17 @@ struct mvpp2_rx_desc {
    880 u32 reserved8;
    881 };
    882
    883 +struct mvpp2_txq_pcpu_buf {
    884 + /* Transmitted SKB */
    885 + struct sk_buff *skb;
    886 +
    887 + /* Physical address of transmitted buffer */
    888 + dma_addr_t phys;
    889 +
    890 + /* Size transmitted */
    891 + size_t size;
    892 +};
    893 +
    894 /* Per-CPU Tx queue control */
    895 struct mvpp2_txq_pcpu {
    896 int cpu;
    897 @@ -787,11 +798,8 @@ struct mvpp2_txq_pcpu {
    898 /* Number of Tx DMA descriptors reserved for each CPU */
    899 int reserved_num;
    900
    901 - /* Array of transmitted skb */
    902 - struct sk_buff **tx_skb;
    903 -
    904 - /* Array of transmitted buffers' physical addresses */
    905 - dma_addr_t *tx_buffs;
    906 + /* Infos about transmitted buffers */
    907 + struct mvpp2_txq_pcpu_buf *buffs;
    908
    909 /* Index of last TX DMA descriptor that was inserted */
    910 int txq_put_index;
    911 @@ -981,10 +989,11 @@ static void mvpp2_txq_inc_put(struct mvpp2_txq_pcpu *txq_pcpu,
    912 struct sk_buff *skb,
    913 struct mvpp2_tx_desc *tx_desc)
    914 {
    915 - txq_pcpu->tx_skb[txq_pcpu->txq_put_index] = skb;
    916 - if (skb)
    917 - txq_pcpu->tx_buffs[txq_pcpu->txq_put_index] =
    918 - tx_desc->buf_phys_addr;
    919 + struct mvpp2_txq_pcpu_buf *tx_buf =
    920 + txq_pcpu->buffs + txq_pcpu->txq_put_index;
    921 + tx_buf->skb = skb;
    922 + tx_buf->size = tx_desc->data_size;
    923 + tx_buf->phys = tx_desc->buf_phys_addr;
    924 txq_pcpu->txq_put_index++;
    925 if (txq_pcpu->txq_put_index == txq_pcpu->size)
    926 txq_pcpu->txq_put_index = 0;
    927 @@ -4403,17 +4412,16 @@ static void mvpp2_txq_bufs_free(struct mvpp2_port *port,
    928 int i;
    929
    930 for (i = 0; i < num; i++) {
    931 - dma_addr_t buf_phys_addr =
    932 - txq_pcpu->tx_buffs[txq_pcpu->txq_get_index];
    933 - struct sk_buff *skb = txq_pcpu->tx_skb[txq_pcpu->txq_get_index];
    934 + struct mvpp2_txq_pcpu_buf *tx_buf =
    935 + txq_pcpu->buffs + txq_pcpu->txq_get_index;
    936
    937 mvpp2_txq_inc_get(txq_pcpu);
    938
    939 - dma_unmap_single(port->dev->dev.parent, buf_phys_addr,
    940 - skb_headlen(skb), DMA_TO_DEVICE);
    941 - if (!skb)
    942 + dma_unmap_single(port->dev->dev.parent, tx_buf->phys,
    943 + tx_buf->size, DMA_TO_DEVICE);
    944 + if (!tx_buf->skb)
    945 continue;
    946 - dev_kfree_skb_any(skb);
    947 + dev_kfree_skb_any(tx_buf->skb);
    948 }
    949 }
    950
    951 @@ -4664,15 +4672,10 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
    952 for_each_present_cpu(cpu) {
    953 txq_pcpu = per_cpu_ptr(txq->pcpu, cpu);
    954 txq_pcpu->size = txq->size;
    955 - txq_pcpu->tx_skb = kmalloc(txq_pcpu->size *
    956 - sizeof(*txq_pcpu->tx_skb),
    957 - GFP_KERNEL);
    958 - if (!txq_pcpu->tx_skb)
    959 - goto error;
    960 -
    961 - txq_pcpu->tx_buffs = kmalloc(txq_pcpu->size *
    962 - sizeof(dma_addr_t), GFP_KERNEL);
    963 - if (!txq_pcpu->tx_buffs)
    964 + txq_pcpu->buffs = kmalloc(txq_pcpu->size *
    965 + sizeof(struct mvpp2_txq_pcpu_buf),
    966 + GFP_KERNEL);
    967 + if (!txq_pcpu->buffs)
    968 goto error;
    969
    970 txq_pcpu->count = 0;
    971 @@ -4686,8 +4689,7 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
    972 error:
    973 for_each_present_cpu(cpu) {
    974 txq_pcpu = per_cpu_ptr(txq->pcpu, cpu);
    975 - kfree(txq_pcpu->tx_skb);
    976 - kfree(txq_pcpu->tx_buffs);
    977 + kfree(txq_pcpu->buffs);
    978 }
    979
    980 dma_free_coherent(port->dev->dev.parent,
    981 @@ -4706,8 +4708,7 @@ static void mvpp2_txq_deinit(struct mvpp2_port *port,
    982
    983 for_each_present_cpu(cpu) {
    984 txq_pcpu = per_cpu_ptr(txq->pcpu, cpu);
    985 - kfree(txq_pcpu->tx_skb);
    986 - kfree(txq_pcpu->tx_buffs);
    987 + kfree(txq_pcpu->buffs);
    988 }
    989
    990 if (txq->descs)
    991 diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
    992 index 7cdaf40c3057..ea7b8c25955f 100644
    993 --- a/drivers/net/wireless/ath/ath9k/pci.c
    994 +++ b/drivers/net/wireless/ath/ath9k/pci.c
    995 @@ -27,7 +27,6 @@ static const struct pci_device_id ath_pci_id_table[] = {
    996 { PCI_VDEVICE(ATHEROS, 0x0023) }, /* PCI */
    997 { PCI_VDEVICE(ATHEROS, 0x0024) }, /* PCI-E */
    998 { PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI */
    999 - { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */
    1000
    1001 #ifdef CONFIG_ATH9K_PCOEM
    1002 /* Mini PCI AR9220 MB92 cards: Compex WLM200NX, Wistron DNMA-92 */
    1003 @@ -38,7 +37,7 @@ static const struct pci_device_id ath_pci_id_table[] = {
    1004 .driver_data = ATH9K_PCI_LED_ACT_HI },
    1005 #endif
    1006
    1007 - { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
    1008 + { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */
    1009
    1010 #ifdef CONFIG_ATH9K_PCOEM
    1011 { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
    1012 @@ -86,7 +85,11 @@ static const struct pci_device_id ath_pci_id_table[] = {
    1013 0x10CF, /* Fujitsu */
    1014 0x1536),
    1015 .driver_data = ATH9K_PCI_D3_L1_WAR },
    1016 +#endif
    1017
    1018 + { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
    1019 +
    1020 +#ifdef CONFIG_ATH9K_PCOEM
    1021 /* AR9285 card for Asus */
    1022 { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
    1023 0x002B,
    1024 diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
    1025 index 7a40d8dffa36..aab752328c26 100644
    1026 --- a/drivers/net/wireless/realtek/rtlwifi/base.c
    1027 +++ b/drivers/net/wireless/realtek/rtlwifi/base.c
    1028 @@ -1303,12 +1303,13 @@ EXPORT_SYMBOL_GPL(rtl_action_proc);
    1029
    1030 static void setup_arp_tx(struct rtl_priv *rtlpriv, struct rtl_ps_ctl *ppsc)
    1031 {
    1032 + struct ieee80211_hw *hw = rtlpriv->hw;
    1033 +
    1034 rtlpriv->ra.is_special_data = true;
    1035 if (rtlpriv->cfg->ops->get_btc_status())
    1036 rtlpriv->btcoexist.btc_ops->btc_special_packet_notify(
    1037 rtlpriv, 1);
    1038 - rtlpriv->enter_ps = false;
    1039 - schedule_work(&rtlpriv->works.lps_change_work);
    1040 + rtl_lps_leave(hw);
    1041 ppsc->last_delaylps_stamp_jiffies = jiffies;
    1042 }
    1043
    1044 @@ -1381,8 +1382,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx,
    1045
    1046 if (is_tx) {
    1047 rtlpriv->ra.is_special_data = true;
    1048 - rtlpriv->enter_ps = false;
    1049 - schedule_work(&rtlpriv->works.lps_change_work);
    1050 + rtl_lps_leave(hw);
    1051 ppsc->last_delaylps_stamp_jiffies = jiffies;
    1052 }
    1053
    1054 diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c
    1055 index c925a4dff599..e36d8c456275 100644
    1056 --- a/drivers/net/wireless/realtek/rtlwifi/core.c
    1057 +++ b/drivers/net/wireless/realtek/rtlwifi/core.c
    1058 @@ -1153,10 +1153,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
    1059 } else {
    1060 mstatus = RT_MEDIA_DISCONNECT;
    1061
    1062 - if (mac->link_state == MAC80211_LINKED) {
    1063 - rtlpriv->enter_ps = false;
    1064 - schedule_work(&rtlpriv->works.lps_change_work);
    1065 - }
    1066 + if (mac->link_state == MAC80211_LINKED)
    1067 + rtl_lps_leave(hw);
    1068 if (ppsc->p2p_ps_info.p2p_ps_mode > P2P_PS_NONE)
    1069 rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE);
    1070 mac->link_state = MAC80211_NOLINK;
    1071 @@ -1432,8 +1430,7 @@ static void rtl_op_sw_scan_start(struct ieee80211_hw *hw,
    1072 }
    1073
    1074 if (mac->link_state == MAC80211_LINKED) {
    1075 - rtlpriv->enter_ps = false;
    1076 - schedule_work(&rtlpriv->works.lps_change_work);
    1077 + rtl_lps_leave(hw);
    1078 mac->link_state = MAC80211_LINKED_SCANNING;
    1079 } else {
    1080 rtl_ips_nic_on(hw);
    1081 diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
    1082 index 5b4048041147..a52230377e2c 100644
    1083 --- a/drivers/net/wireless/realtek/rtlwifi/pci.c
    1084 +++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
    1085 @@ -664,11 +664,9 @@ tx_status_ok:
    1086 }
    1087
    1088 if (((rtlpriv->link_info.num_rx_inperiod +
    1089 - rtlpriv->link_info.num_tx_inperiod) > 8) ||
    1090 - (rtlpriv->link_info.num_rx_inperiod > 2)) {
    1091 - rtlpriv->enter_ps = false;
    1092 - schedule_work(&rtlpriv->works.lps_change_work);
    1093 - }
    1094 + rtlpriv->link_info.num_tx_inperiod) > 8) ||
    1095 + (rtlpriv->link_info.num_rx_inperiod > 2))
    1096 + rtl_lps_leave(hw);
    1097 }
    1098
    1099 static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
    1100 @@ -919,10 +917,8 @@ new_trx_end:
    1101 }
    1102 if (((rtlpriv->link_info.num_rx_inperiod +
    1103 rtlpriv->link_info.num_tx_inperiod) > 8) ||
    1104 - (rtlpriv->link_info.num_rx_inperiod > 2)) {
    1105 - rtlpriv->enter_ps = false;
    1106 - schedule_work(&rtlpriv->works.lps_change_work);
    1107 - }
    1108 + (rtlpriv->link_info.num_rx_inperiod > 2))
    1109 + rtl_lps_leave(hw);
    1110 skb = new_skb;
    1111 no_new:
    1112 if (rtlpriv->use_new_trx_flow) {
    1113 diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
    1114 index b69321d45f04..626ff300352b 100644
    1115 --- a/drivers/net/wireless/realtek/rtlwifi/ps.c
    1116 +++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
    1117 @@ -414,8 +414,8 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode)
    1118 }
    1119 }
    1120
    1121 -/*Enter the leisure power save mode.*/
    1122 -void rtl_lps_enter(struct ieee80211_hw *hw)
    1123 +/* Interrupt safe routine to enter the leisure power save mode.*/
    1124 +static void rtl_lps_enter_core(struct ieee80211_hw *hw)
    1125 {
    1126 struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
    1127 struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
    1128 @@ -455,10 +455,9 @@ void rtl_lps_enter(struct ieee80211_hw *hw)
    1129
    1130 spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
    1131 }
    1132 -EXPORT_SYMBOL(rtl_lps_enter);
    1133
    1134 -/*Leave the leisure power save mode.*/
    1135 -void rtl_lps_leave(struct ieee80211_hw *hw)
    1136 +/* Interrupt safe routine to leave the leisure power save mode.*/
    1137 +static void rtl_lps_leave_core(struct ieee80211_hw *hw)
    1138 {
    1139 struct rtl_priv *rtlpriv = rtl_priv(hw);
    1140 struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
    1141 @@ -488,7 +487,6 @@ void rtl_lps_leave(struct ieee80211_hw *hw)
    1142 }
    1143 spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
    1144 }
    1145 -EXPORT_SYMBOL(rtl_lps_leave);
    1146
    1147 /* For sw LPS*/
    1148 void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
    1149 @@ -681,12 +679,34 @@ void rtl_lps_change_work_callback(struct work_struct *work)
    1150 struct rtl_priv *rtlpriv = rtl_priv(hw);
    1151
    1152 if (rtlpriv->enter_ps)
    1153 - rtl_lps_enter(hw);
    1154 + rtl_lps_enter_core(hw);
    1155 else
    1156 - rtl_lps_leave(hw);
    1157 + rtl_lps_leave_core(hw);
    1158 }
    1159 EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback);
    1160
    1161 +void rtl_lps_enter(struct ieee80211_hw *hw)
    1162 +{
    1163 + struct rtl_priv *rtlpriv = rtl_priv(hw);
    1164 +
    1165 + if (!in_interrupt())
    1166 + return rtl_lps_enter_core(hw);
    1167 + rtlpriv->enter_ps = true;
    1168 + schedule_work(&rtlpriv->works.lps_change_work);
    1169 +}
    1170 +EXPORT_SYMBOL_GPL(rtl_lps_enter);
    1171 +
    1172 +void rtl_lps_leave(struct ieee80211_hw *hw)
    1173 +{
    1174 + struct rtl_priv *rtlpriv = rtl_priv(hw);
    1175 +
    1176 + if (!in_interrupt())
    1177 + return rtl_lps_leave_core(hw);
    1178 + rtlpriv->enter_ps = false;
    1179 + schedule_work(&rtlpriv->works.lps_change_work);
    1180 +}
    1181 +EXPORT_SYMBOL_GPL(rtl_lps_leave);
    1182 +
    1183 void rtl_swlps_wq_callback(void *data)
    1184 {
    1185 struct rtl_works *rtlworks = container_of_dwork_rtl(data,
    1186 diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
    1187 index 42d8617352ae..e311a9bf2c90 100644
    1188 --- a/drivers/pci/pci.c
    1189 +++ b/drivers/pci/pci.c
    1190 @@ -2043,6 +2043,10 @@ bool pci_dev_run_wake(struct pci_dev *dev)
    1191 if (!dev->pme_support)
    1192 return false;
    1193
    1194 + /* PME-capable in principle, but not from the intended sleep state */
    1195 + if (!pci_pme_capable(dev, pci_target_state(dev)))
    1196 + return false;
    1197 +
    1198 while (bus->parent) {
    1199 struct pci_dev *bridge = bus->self;
    1200
    1201 diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
    1202 index 131fee2b093e..a3661cc44f86 100644
    1203 --- a/drivers/platform/x86/asus-nb-wmi.c
    1204 +++ b/drivers/platform/x86/asus-nb-wmi.c
    1205 @@ -128,6 +128,15 @@ static const struct dmi_system_id asus_quirks[] = {
    1206 },
    1207 {
    1208 .callback = dmi_matched,
    1209 + .ident = "ASUSTeK COMPUTER INC. X45U",
    1210 + .matches = {
    1211 + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
    1212 + DMI_MATCH(DMI_PRODUCT_NAME, "X45U"),
    1213 + },
    1214 + .driver_data = &quirk_asus_wapf4,
    1215 + },
    1216 + {
    1217 + .callback = dmi_matched,
    1218 .ident = "ASUSTeK COMPUTER INC. X456UA",
    1219 .matches = {
    1220 DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
    1221 diff --git a/drivers/regulator/stw481x-vmmc.c b/drivers/regulator/stw481x-vmmc.c
    1222 index 7d2ae3e9e942..342f5da79975 100644
    1223 --- a/drivers/regulator/stw481x-vmmc.c
    1224 +++ b/drivers/regulator/stw481x-vmmc.c
    1225 @@ -47,7 +47,8 @@ static struct regulator_desc vmmc_regulator = {
    1226 .volt_table = stw481x_vmmc_voltages,
    1227 .enable_time = 200, /* FIXME: look this up */
    1228 .enable_reg = STW_CONF1,
    1229 - .enable_mask = STW_CONF1_PDN_VMMC,
    1230 + .enable_mask = STW_CONF1_PDN_VMMC | STW_CONF1_MMC_LS_STATUS,
    1231 + .enable_val = STW_CONF1_PDN_VMMC,
    1232 .vsel_reg = STW_CONF1,
    1233 .vsel_mask = STW_CONF1_VMMC_MASK,
    1234 };
    1235 diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c
    1236 index 799c1524c779..4b8de3e70cf2 100644
    1237 --- a/drivers/s390/char/vmlogrdr.c
    1238 +++ b/drivers/s390/char/vmlogrdr.c
    1239 @@ -872,7 +872,7 @@ static int __init vmlogrdr_init(void)
    1240 goto cleanup;
    1241
    1242 for (i=0; i < MAXMINOR; ++i ) {
    1243 - sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL);
    1244 + sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
    1245 if (!sys_ser[i].buffer) {
    1246 rc = -ENOMEM;
    1247 break;
    1248 diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
    1249 index 581001989937..d5bf36ec8a75 100644
    1250 --- a/drivers/s390/scsi/zfcp_dbf.c
    1251 +++ b/drivers/s390/scsi/zfcp_dbf.c
    1252 @@ -289,11 +289,12 @@ void zfcp_dbf_rec_trig(char *tag, struct zfcp_adapter *adapter,
    1253
    1254
    1255 /**
    1256 - * zfcp_dbf_rec_run - trace event related to running recovery
    1257 + * zfcp_dbf_rec_run_lvl - trace event related to running recovery
    1258 + * @level: trace level to be used for event
    1259 * @tag: identifier for event
    1260 * @erp: erp_action running
    1261 */
    1262 -void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
    1263 +void zfcp_dbf_rec_run_lvl(int level, char *tag, struct zfcp_erp_action *erp)
    1264 {
    1265 struct zfcp_dbf *dbf = erp->adapter->dbf;
    1266 struct zfcp_dbf_rec *rec = &dbf->rec_buf;
    1267 @@ -319,11 +320,21 @@ void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
    1268 else
    1269 rec->u.run.rec_count = atomic_read(&erp->adapter->erp_counter);
    1270
    1271 - debug_event(dbf->rec, 1, rec, sizeof(*rec));
    1272 + debug_event(dbf->rec, level, rec, sizeof(*rec));
    1273 spin_unlock_irqrestore(&dbf->rec_lock, flags);
    1274 }
    1275
    1276 /**
    1277 + * zfcp_dbf_rec_run - trace event related to running recovery
    1278 + * @tag: identifier for event
    1279 + * @erp: erp_action running
    1280 + */
    1281 +void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
    1282 +{
    1283 + zfcp_dbf_rec_run_lvl(1, tag, erp);
    1284 +}
    1285 +
    1286 +/**
    1287 * zfcp_dbf_rec_run_wka - trace wka port event with info like running recovery
    1288 * @tag: identifier for event
    1289 * @wka_port: well known address port
    1290 diff --git a/drivers/s390/scsi/zfcp_dbf.h b/drivers/s390/scsi/zfcp_dbf.h
    1291 index 36d07584271d..db186d44cfaf 100644
    1292 --- a/drivers/s390/scsi/zfcp_dbf.h
    1293 +++ b/drivers/s390/scsi/zfcp_dbf.h
    1294 @@ -2,7 +2,7 @@
    1295 * zfcp device driver
    1296 * debug feature declarations
    1297 *
    1298 - * Copyright IBM Corp. 2008, 2015
    1299 + * Copyright IBM Corp. 2008, 2016
    1300 */
    1301
    1302 #ifndef ZFCP_DBF_H
    1303 @@ -283,6 +283,30 @@ struct zfcp_dbf {
    1304 struct zfcp_dbf_scsi scsi_buf;
    1305 };
    1306
    1307 +/**
    1308 + * zfcp_dbf_hba_fsf_resp_suppress - true if we should not trace by default
    1309 + * @req: request that has been completed
    1310 + *
    1311 + * Returns true if FCP response with only benign residual under count.
    1312 + */
    1313 +static inline
    1314 +bool zfcp_dbf_hba_fsf_resp_suppress(struct zfcp_fsf_req *req)
    1315 +{
    1316 + struct fsf_qtcb *qtcb = req->qtcb;
    1317 + u32 fsf_stat = qtcb->header.fsf_status;
    1318 + struct fcp_resp *fcp_rsp;
    1319 + u8 rsp_flags, fr_status;
    1320 +
    1321 + if (qtcb->prefix.qtcb_type != FSF_IO_COMMAND)
    1322 + return false; /* not an FCP response */
    1323 + fcp_rsp = (struct fcp_resp *)&qtcb->bottom.io.fcp_rsp;
    1324 + rsp_flags = fcp_rsp->fr_flags;
    1325 + fr_status = fcp_rsp->fr_status;
    1326 + return (fsf_stat == FSF_FCP_RSP_AVAILABLE) &&
    1327 + (rsp_flags == FCP_RESID_UNDER) &&
    1328 + (fr_status == SAM_STAT_GOOD);
    1329 +}
    1330 +
    1331 static inline
    1332 void zfcp_dbf_hba_fsf_resp(char *tag, int level, struct zfcp_fsf_req *req)
    1333 {
    1334 @@ -304,7 +328,9 @@ void zfcp_dbf_hba_fsf_response(struct zfcp_fsf_req *req)
    1335 zfcp_dbf_hba_fsf_resp("fs_perr", 1, req);
    1336
    1337 } else if (qtcb->header.fsf_status != FSF_GOOD) {
    1338 - zfcp_dbf_hba_fsf_resp("fs_ferr", 1, req);
    1339 + zfcp_dbf_hba_fsf_resp("fs_ferr",
    1340 + zfcp_dbf_hba_fsf_resp_suppress(req)
    1341 + ? 5 : 1, req);
    1342
    1343 } else if ((req->fsf_command == FSF_QTCB_OPEN_PORT_WITH_DID) ||
    1344 (req->fsf_command == FSF_QTCB_OPEN_LUN)) {
    1345 @@ -388,4 +414,15 @@ void zfcp_dbf_scsi_devreset(char *tag, struct scsi_cmnd *scmnd, u8 flag)
    1346 _zfcp_dbf_scsi(tmp_tag, 1, scmnd, NULL);
    1347 }
    1348
    1349 +/**
    1350 + * zfcp_dbf_scsi_nullcmnd() - trace NULLify of SCSI command in dev/tgt-reset.
    1351 + * @scmnd: SCSI command that was NULLified.
    1352 + * @fsf_req: request that owned @scmnd.
    1353 + */
    1354 +static inline void zfcp_dbf_scsi_nullcmnd(struct scsi_cmnd *scmnd,
    1355 + struct zfcp_fsf_req *fsf_req)
    1356 +{
    1357 + _zfcp_dbf_scsi("scfc__1", 3, scmnd, fsf_req);
    1358 +}
    1359 +
    1360 #endif /* ZFCP_DBF_H */
    1361 diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
    1362 index a59d678125bd..7ccfce559034 100644
    1363 --- a/drivers/s390/scsi/zfcp_erp.c
    1364 +++ b/drivers/s390/scsi/zfcp_erp.c
    1365 @@ -3,7 +3,7 @@
    1366 *
    1367 * Error Recovery Procedures (ERP).
    1368 *
    1369 - * Copyright IBM Corp. 2002, 2015
    1370 + * Copyright IBM Corp. 2002, 2016
    1371 */
    1372
    1373 #define KMSG_COMPONENT "zfcp"
    1374 @@ -1204,6 +1204,62 @@ static void zfcp_erp_action_dequeue(struct zfcp_erp_action *erp_action)
    1375 }
    1376 }
    1377
    1378 +/**
    1379 + * zfcp_erp_try_rport_unblock - unblock rport if no more/new recovery
    1380 + * @port: zfcp_port whose fc_rport we should try to unblock
    1381 + */
    1382 +static void zfcp_erp_try_rport_unblock(struct zfcp_port *port)
    1383 +{
    1384 + unsigned long flags;
    1385 + struct zfcp_adapter *adapter = port->adapter;
    1386 + int port_status;
    1387 + struct Scsi_Host *shost = adapter->scsi_host;
    1388 + struct scsi_device *sdev;
    1389 +
    1390 + write_lock_irqsave(&adapter->erp_lock, flags);
    1391 + port_status = atomic_read(&port->status);
    1392 + if ((port_status & ZFCP_STATUS_COMMON_UNBLOCKED) == 0 ||
    1393 + (port_status & (ZFCP_STATUS_COMMON_ERP_INUSE |
    1394 + ZFCP_STATUS_COMMON_ERP_FAILED)) != 0) {
    1395 + /* new ERP of severity >= port triggered elsewhere meanwhile or
    1396 + * local link down (adapter erp_failed but not clear unblock)
    1397 + */
    1398 + zfcp_dbf_rec_run_lvl(4, "ertru_p", &port->erp_action);
    1399 + write_unlock_irqrestore(&adapter->erp_lock, flags);
    1400 + return;
    1401 + }
    1402 + spin_lock(shost->host_lock);
    1403 + __shost_for_each_device(sdev, shost) {
    1404 + struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev);
    1405 + int lun_status;
    1406 +
    1407 + if (zsdev->port != port)
    1408 + continue;
    1409 + /* LUN under port of interest */
    1410 + lun_status = atomic_read(&zsdev->status);
    1411 + if ((lun_status & ZFCP_STATUS_COMMON_ERP_FAILED) != 0)
    1412 + continue; /* unblock rport despite failed LUNs */
    1413 + /* LUN recovery not given up yet [maybe follow-up pending] */
    1414 + if ((lun_status & ZFCP_STATUS_COMMON_UNBLOCKED) == 0 ||
    1415 + (lun_status & ZFCP_STATUS_COMMON_ERP_INUSE) != 0) {
    1416 + /* LUN blocked:
    1417 + * not yet unblocked [LUN recovery pending]
    1418 + * or meanwhile blocked [new LUN recovery triggered]
    1419 + */
    1420 + zfcp_dbf_rec_run_lvl(4, "ertru_l", &zsdev->erp_action);
    1421 + spin_unlock(shost->host_lock);
    1422 + write_unlock_irqrestore(&adapter->erp_lock, flags);
    1423 + return;
    1424 + }
    1425 + }
    1426 + /* now port has no child or all children have completed recovery,
    1427 + * and no ERP of severity >= port was meanwhile triggered elsewhere
    1428 + */
    1429 + zfcp_scsi_schedule_rport_register(port);
    1430 + spin_unlock(shost->host_lock);
    1431 + write_unlock_irqrestore(&adapter->erp_lock, flags);
    1432 +}
    1433 +
    1434 static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
    1435 {
    1436 struct zfcp_adapter *adapter = act->adapter;
    1437 @@ -1214,6 +1270,7 @@ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
    1438 case ZFCP_ERP_ACTION_REOPEN_LUN:
    1439 if (!(act->status & ZFCP_STATUS_ERP_NO_REF))
    1440 scsi_device_put(sdev);
    1441 + zfcp_erp_try_rport_unblock(port);
    1442 break;
    1443
    1444 case ZFCP_ERP_ACTION_REOPEN_PORT:
    1445 @@ -1224,7 +1281,7 @@ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
    1446 */
    1447 if (act->step != ZFCP_ERP_STEP_UNINITIALIZED)
    1448 if (result == ZFCP_ERP_SUCCEEDED)
    1449 - zfcp_scsi_schedule_rport_register(port);
    1450 + zfcp_erp_try_rport_unblock(port);
    1451 /* fall through */
    1452 case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
    1453 put_device(&port->dev);
    1454 diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
    1455 index c8fed9fa1cca..21c8c689b02b 100644
    1456 --- a/drivers/s390/scsi/zfcp_ext.h
    1457 +++ b/drivers/s390/scsi/zfcp_ext.h
    1458 @@ -3,7 +3,7 @@
    1459 *
    1460 * External function declarations.
    1461 *
    1462 - * Copyright IBM Corp. 2002, 2015
    1463 + * Copyright IBM Corp. 2002, 2016
    1464 */
    1465
    1466 #ifndef ZFCP_EXT_H
    1467 @@ -35,6 +35,8 @@ extern void zfcp_dbf_adapter_unregister(struct zfcp_adapter *);
    1468 extern void zfcp_dbf_rec_trig(char *, struct zfcp_adapter *,
    1469 struct zfcp_port *, struct scsi_device *, u8, u8);
    1470 extern void zfcp_dbf_rec_run(char *, struct zfcp_erp_action *);
    1471 +extern void zfcp_dbf_rec_run_lvl(int level, char *tag,
    1472 + struct zfcp_erp_action *erp);
    1473 extern void zfcp_dbf_rec_run_wka(char *, struct zfcp_fc_wka_port *, u64);
    1474 extern void zfcp_dbf_hba_fsf_uss(char *, struct zfcp_fsf_req *);
    1475 extern void zfcp_dbf_hba_fsf_res(char *, int, struct zfcp_fsf_req *);
    1476 diff --git a/drivers/s390/scsi/zfcp_fsf.h b/drivers/s390/scsi/zfcp_fsf.h
    1477 index be1c04b334c5..ea3c76ac0de1 100644
    1478 --- a/drivers/s390/scsi/zfcp_fsf.h
    1479 +++ b/drivers/s390/scsi/zfcp_fsf.h
    1480 @@ -3,7 +3,7 @@
    1481 *
    1482 * Interface to the FSF support functions.
    1483 *
    1484 - * Copyright IBM Corp. 2002, 2015
    1485 + * Copyright IBM Corp. 2002, 2016
    1486 */
    1487
    1488 #ifndef FSF_H
    1489 @@ -78,6 +78,7 @@
    1490 #define FSF_APP_TAG_CHECK_FAILURE 0x00000082
    1491 #define FSF_REF_TAG_CHECK_FAILURE 0x00000083
    1492 #define FSF_ADAPTER_STATUS_AVAILABLE 0x000000AD
    1493 +#define FSF_FCP_RSP_AVAILABLE 0x000000AF
    1494 #define FSF_UNKNOWN_COMMAND 0x000000E2
    1495 #define FSF_UNKNOWN_OP_SUBTYPE 0x000000E3
    1496 #define FSF_INVALID_COMMAND_OPTION 0x000000E5
    1497 diff --git a/drivers/s390/scsi/zfcp_reqlist.h b/drivers/s390/scsi/zfcp_reqlist.h
    1498 index 7c2c6194dfca..703fce59befe 100644
    1499 --- a/drivers/s390/scsi/zfcp_reqlist.h
    1500 +++ b/drivers/s390/scsi/zfcp_reqlist.h
    1501 @@ -4,7 +4,7 @@
    1502 * Data structure and helper functions for tracking pending FSF
    1503 * requests.
    1504 *
    1505 - * Copyright IBM Corp. 2009
    1506 + * Copyright IBM Corp. 2009, 2016
    1507 */
    1508
    1509 #ifndef ZFCP_REQLIST_H
    1510 @@ -180,4 +180,32 @@ static inline void zfcp_reqlist_move(struct zfcp_reqlist *rl,
    1511 spin_unlock_irqrestore(&rl->lock, flags);
    1512 }
    1513
    1514 +/**
    1515 + * zfcp_reqlist_apply_for_all() - apply a function to every request.
    1516 + * @rl: the requestlist that contains the target requests.
    1517 + * @f: the function to apply to each request; the first parameter of the
    1518 + * function will be the target-request; the second parameter is the same
    1519 + * pointer as given with the argument @data.
    1520 + * @data: freely chosen argument; passed through to @f as second parameter.
    1521 + *
    1522 + * Uses :c:macro:`list_for_each_entry` to iterate over the lists in the hash-
    1523 + * table (not a 'safe' variant, so don't modify the list).
    1524 + *
    1525 + * Holds @rl->lock over the entire request-iteration.
    1526 + */
    1527 +static inline void
    1528 +zfcp_reqlist_apply_for_all(struct zfcp_reqlist *rl,
    1529 + void (*f)(struct zfcp_fsf_req *, void *), void *data)
    1530 +{
    1531 + struct zfcp_fsf_req *req;
    1532 + unsigned long flags;
    1533 + unsigned int i;
    1534 +
    1535 + spin_lock_irqsave(&rl->lock, flags);
    1536 + for (i = 0; i < ZFCP_REQ_LIST_BUCKETS; i++)
    1537 + list_for_each_entry(req, &rl->buckets[i], list)
    1538 + f(req, data);
    1539 + spin_unlock_irqrestore(&rl->lock, flags);
    1540 +}
    1541 +
    1542 #endif /* ZFCP_REQLIST_H */
    1543 diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
    1544 index 9069f98a1817..07ffdbb5107f 100644
    1545 --- a/drivers/s390/scsi/zfcp_scsi.c
    1546 +++ b/drivers/s390/scsi/zfcp_scsi.c
    1547 @@ -3,7 +3,7 @@
    1548 *
    1549 * Interface to Linux SCSI midlayer.
    1550 *
    1551 - * Copyright IBM Corp. 2002, 2015
    1552 + * Copyright IBM Corp. 2002, 2016
    1553 */
    1554
    1555 #define KMSG_COMPONENT "zfcp"
    1556 @@ -88,9 +88,7 @@ int zfcp_scsi_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scpnt)
    1557 }
    1558
    1559 if (unlikely(!(status & ZFCP_STATUS_COMMON_UNBLOCKED))) {
    1560 - /* This could be either
    1561 - * open LUN pending: this is temporary, will result in
    1562 - * open LUN or ERP_FAILED, so retry command
    1563 + /* This could be
    1564 * call to rport_delete pending: mimic retry from
    1565 * fc_remote_port_chkready until rport is BLOCKED
    1566 */
    1567 @@ -209,6 +207,57 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
    1568 return retval;
    1569 }
    1570
    1571 +struct zfcp_scsi_req_filter {
    1572 + u8 tmf_scope;
    1573 + u32 lun_handle;
    1574 + u32 port_handle;
    1575 +};
    1576 +
    1577 +static void zfcp_scsi_forget_cmnd(struct zfcp_fsf_req *old_req, void *data)
    1578 +{
    1579 + struct zfcp_scsi_req_filter *filter =
    1580 + (struct zfcp_scsi_req_filter *)data;
    1581 +
    1582 + /* already aborted - prevent side-effects - or not a SCSI command */
    1583 + if (old_req->data == NULL || old_req->fsf_command != FSF_QTCB_FCP_CMND)
    1584 + return;
    1585 +
    1586 + /* (tmf_scope == FCP_TMF_TGT_RESET || tmf_scope == FCP_TMF_LUN_RESET) */
    1587 + if (old_req->qtcb->header.port_handle != filter->port_handle)
    1588 + return;
    1589 +
    1590 + if (filter->tmf_scope == FCP_TMF_LUN_RESET &&
    1591 + old_req->qtcb->header.lun_handle != filter->lun_handle)
    1592 + return;
    1593 +
    1594 + zfcp_dbf_scsi_nullcmnd((struct scsi_cmnd *)old_req->data, old_req);
    1595 + old_req->data = NULL;
    1596 +}
    1597 +
    1598 +static void zfcp_scsi_forget_cmnds(struct zfcp_scsi_dev *zsdev, u8 tm_flags)
    1599 +{
    1600 + struct zfcp_adapter *adapter = zsdev->port->adapter;
    1601 + struct zfcp_scsi_req_filter filter = {
    1602 + .tmf_scope = FCP_TMF_TGT_RESET,
    1603 + .port_handle = zsdev->port->handle,
    1604 + };
    1605 + unsigned long flags;
    1606 +
    1607 + if (tm_flags == FCP_TMF_LUN_RESET) {
    1608 + filter.tmf_scope = FCP_TMF_LUN_RESET;
    1609 + filter.lun_handle = zsdev->lun_handle;
    1610 + }
    1611 +
    1612 + /*
    1613 + * abort_lock secures against other processings - in the abort-function
    1614 + * and normal cmnd-handler - of (struct zfcp_fsf_req *)->data
    1615 + */
    1616 + write_lock_irqsave(&adapter->abort_lock, flags);
    1617 + zfcp_reqlist_apply_for_all(adapter->req_list, zfcp_scsi_forget_cmnd,
    1618 + &filter);
    1619 + write_unlock_irqrestore(&adapter->abort_lock, flags);
    1620 +}
    1621 +
    1622 static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags)
    1623 {
    1624 struct zfcp_scsi_dev *zfcp_sdev = sdev_to_zfcp(scpnt->device);
    1625 @@ -241,8 +290,10 @@ static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags)
    1626 if (fsf_req->status & ZFCP_STATUS_FSFREQ_TMFUNCFAILED) {
    1627 zfcp_dbf_scsi_devreset("fail", scpnt, tm_flags);
    1628 retval = FAILED;
    1629 - } else
    1630 + } else {
    1631 zfcp_dbf_scsi_devreset("okay", scpnt, tm_flags);
    1632 + zfcp_scsi_forget_cmnds(zfcp_sdev, tm_flags);
    1633 + }
    1634
    1635 zfcp_fsf_req_free(fsf_req);
    1636 return retval;
    1637 diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
    1638 index 021b994fdae8..96007633ad39 100644
    1639 --- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
    1640 +++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
    1641 @@ -1856,6 +1856,8 @@ megasas_build_syspd_fusion(struct megasas_instance *instance,
    1642 io_request->DevHandle = pd_sync->seq[pd_index].devHandle;
    1643 pRAID_Context->regLockFlags |=
    1644 (MR_RL_FLAGS_SEQ_NUM_ENABLE|MR_RL_FLAGS_GRANT_DESTINATION_CUDA);
    1645 + pRAID_Context->Type = MPI2_TYPE_CUDA;
    1646 + pRAID_Context->nseg = 0x1;
    1647 } else if (fusion->fast_path_io) {
    1648 pRAID_Context->VirtualDiskTgtId = cpu_to_le16(device_id);
    1649 pRAID_Context->configSeqNum = 0;
    1650 @@ -1891,12 +1893,10 @@ megasas_build_syspd_fusion(struct megasas_instance *instance,
    1651 pRAID_Context->timeoutValue =
    1652 cpu_to_le16((os_timeout_value > timeout_limit) ?
    1653 timeout_limit : os_timeout_value);
    1654 - if (fusion->adapter_type == INVADER_SERIES) {
    1655 - pRAID_Context->Type = MPI2_TYPE_CUDA;
    1656 - pRAID_Context->nseg = 0x1;
    1657 + if (fusion->adapter_type == INVADER_SERIES)
    1658 io_request->IoFlags |=
    1659 cpu_to_le16(MPI25_SAS_DEVICE0_FLAGS_ENABLED_FAST_PATH);
    1660 - }
    1661 +
    1662 cmd->request_desc->SCSIIO.RequestFlags =
    1663 (MPI2_REQ_DESCRIPT_FLAGS_HIGH_PRIORITY <<
    1664 MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
    1665 @@ -2648,6 +2648,7 @@ int megasas_wait_for_outstanding_fusion(struct megasas_instance *instance,
    1666 dev_err(&instance->pdev->dev, "pending commands remain after waiting, "
    1667 "will reset adapter scsi%d.\n",
    1668 instance->host->host_no);
    1669 + *convert = 1;
    1670 retval = 1;
    1671 }
    1672 out:
    1673 diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
    1674 index 7232d43e2207..4477e999ec70 100644
    1675 --- a/drivers/scsi/scsi_sysfs.c
    1676 +++ b/drivers/scsi/scsi_sysfs.c
    1677 @@ -1031,10 +1031,6 @@ int scsi_sysfs_add_sdev(struct scsi_device *sdev)
    1678 struct request_queue *rq = sdev->request_queue;
    1679 struct scsi_target *starget = sdev->sdev_target;
    1680
    1681 - error = scsi_device_set_state(sdev, SDEV_RUNNING);
    1682 - if (error)
    1683 - return error;
    1684 -
    1685 error = scsi_target_add(starget);
    1686 if (error)
    1687 return error;
    1688 diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
    1689 index ae7d9bdf409c..a1c29b0afb22 100644
    1690 --- a/drivers/scsi/sg.c
    1691 +++ b/drivers/scsi/sg.c
    1692 @@ -592,6 +592,9 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
    1693 sg_io_hdr_t *hp;
    1694 unsigned char cmnd[SG_MAX_CDB_SIZE];
    1695
    1696 + if (unlikely(segment_eq(get_fs(), KERNEL_DS)))
    1697 + return -EINVAL;
    1698 +
    1699 if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
    1700 return -ENXIO;
    1701 SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
    1702 diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
    1703 index 0f28c08fcb3c..77b551da5728 100644
    1704 --- a/drivers/ssb/pci.c
    1705 +++ b/drivers/ssb/pci.c
    1706 @@ -909,6 +909,7 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
    1707 if (err) {
    1708 ssb_warn("WARNING: Using fallback SPROM failed (err %d)\n",
    1709 err);
    1710 + goto out_free;
    1711 } else {
    1712 ssb_dbg("Using SPROM revision %d provided by platform\n",
    1713 sprom->revision);
    1714 diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
    1715 index 35ab4a9ef95d..c975f6e8be49 100644
    1716 --- a/drivers/staging/comedi/drivers/ni_mio_common.c
    1717 +++ b/drivers/staging/comedi/drivers/ni_mio_common.c
    1718 @@ -1929,7 +1929,7 @@ static int ni_ai_insn_read(struct comedi_device *dev,
    1719 unsigned int *data)
    1720 {
    1721 struct ni_private *devpriv = dev->private;
    1722 - unsigned int mask = (s->maxdata + 1) >> 1;
    1723 + unsigned int mask = s->maxdata;
    1724 int i, n;
    1725 unsigned signbits;
    1726 unsigned int d;
    1727 @@ -1972,7 +1972,7 @@ static int ni_ai_insn_read(struct comedi_device *dev,
    1728 return -ETIME;
    1729 }
    1730 d += signbits;
    1731 - data[n] = d;
    1732 + data[n] = d & 0xffff;
    1733 }
    1734 } else if (devpriv->is_6143) {
    1735 for (n = 0; n < insn->n; n++) {
    1736 @@ -2017,8 +2017,8 @@ static int ni_ai_insn_read(struct comedi_device *dev,
    1737 data[n] = dl;
    1738 } else {
    1739 d = ni_readw(dev, NI_E_AI_FIFO_DATA_REG);
    1740 - d += signbits; /* subtle: needs to be short addition */
    1741 - data[n] = d;
    1742 + d += signbits;
    1743 + data[n] = d & 0xffff;
    1744 }
    1745 }
    1746 }
    1747 diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
    1748 index 5e6d6cb348fc..a7d30e894cab 100644
    1749 --- a/drivers/target/target_core_user.c
    1750 +++ b/drivers/target/target_core_user.c
    1751 @@ -645,8 +645,6 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
    1752 target_complete_cmd(cmd->se_cmd, SAM_STAT_CHECK_CONDITION);
    1753 cmd->se_cmd = NULL;
    1754
    1755 - kmem_cache_free(tcmu_cmd_cache, cmd);
    1756 -
    1757 return 0;
    1758 }
    1759
    1760 diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
    1761 index 06fd2ed9ef9d..705b0cafedbb 100644
    1762 --- a/drivers/thermal/thermal_hwmon.c
    1763 +++ b/drivers/thermal/thermal_hwmon.c
    1764 @@ -98,7 +98,7 @@ temp_crit_show(struct device *dev, struct device_attribute *attr, char *buf)
    1765 int temperature;
    1766 int ret;
    1767
    1768 - ret = tz->ops->get_trip_temp(tz, 0, &temperature);
    1769 + ret = tz->ops->get_crit_temp(tz, &temperature);
    1770 if (ret)
    1771 return ret;
    1772
    1773 diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
    1774 index edb5305b9d4d..7d5ee8a13ac6 100644
    1775 --- a/drivers/tty/serial/sc16is7xx.c
    1776 +++ b/drivers/tty/serial/sc16is7xx.c
    1777 @@ -1230,7 +1230,7 @@ static int sc16is7xx_probe(struct device *dev,
    1778
    1779 /* Setup interrupt */
    1780 ret = devm_request_irq(dev, irq, sc16is7xx_irq,
    1781 - IRQF_ONESHOT | flags, dev_name(dev), s);
    1782 + flags, dev_name(dev), s);
    1783 if (!ret)
    1784 return 0;
    1785
    1786 diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
    1787 index 41987a55a538..988c564b61a8 100644
    1788 --- a/drivers/tty/vt/keyboard.c
    1789 +++ b/drivers/tty/vt/keyboard.c
    1790 @@ -982,7 +982,7 @@ static void kbd_led_trigger_activate(struct led_classdev *cdev)
    1791 KBD_LED_TRIGGER((_led_bit) + 8, _name)
    1792
    1793 static struct kbd_led_trigger kbd_led_triggers[] = {
    1794 - KBD_LED_TRIGGER(VC_SCROLLOCK, "kbd-scrollock"),
    1795 + KBD_LED_TRIGGER(VC_SCROLLOCK, "kbd-scrolllock"),
    1796 KBD_LED_TRIGGER(VC_NUMLOCK, "kbd-numlock"),
    1797 KBD_LED_TRIGGER(VC_CAPSLOCK, "kbd-capslock"),
    1798 KBD_LED_TRIGGER(VC_KANALOCK, "kbd-kanalock"),
    1799 diff --git a/fs/block_dev.c b/fs/block_dev.c
    1800 index f10dbac851a1..198aea66fe71 100644
    1801 --- a/fs/block_dev.c
    1802 +++ b/fs/block_dev.c
    1803 @@ -1806,6 +1806,7 @@ void iterate_bdevs(void (*func)(struct block_device *, void *), void *arg)
    1804 spin_lock(&blockdev_superblock->s_inode_list_lock);
    1805 list_for_each_entry(inode, &blockdev_superblock->s_inodes, i_sb_list) {
    1806 struct address_space *mapping = inode->i_mapping;
    1807 + struct block_device *bdev;
    1808
    1809 spin_lock(&inode->i_lock);
    1810 if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW) ||
    1811 @@ -1826,8 +1827,12 @@ void iterate_bdevs(void (*func)(struct block_device *, void *), void *arg)
    1812 */
    1813 iput(old_inode);
    1814 old_inode = inode;
    1815 + bdev = I_BDEV(inode);
    1816
    1817 - func(I_BDEV(inode), arg);
    1818 + mutex_lock(&bdev->bd_mutex);
    1819 + if (bdev->bd_openers)
    1820 + func(bdev, arg);
    1821 + mutex_unlock(&bdev->bd_mutex);
    1822
    1823 spin_lock(&blockdev_superblock->s_inode_list_lock);
    1824 }
    1825 diff --git a/fs/nfs/file.c b/fs/nfs/file.c
    1826 index 93e236429c5d..dc875cd0e11d 100644
    1827 --- a/fs/nfs/file.c
    1828 +++ b/fs/nfs/file.c
    1829 @@ -407,7 +407,7 @@ static int nfs_write_end(struct file *file, struct address_space *mapping,
    1830 */
    1831 if (!PageUptodate(page)) {
    1832 unsigned pglen = nfs_page_length(page);
    1833 - unsigned end = offset + len;
    1834 + unsigned end = offset + copied;
    1835
    1836 if (pglen == 0) {
    1837 zero_user_segments(page, 0, offset,
    1838 diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
    1839 index 2c7bdb81d30c..b5f3693fe5b6 100644
    1840 --- a/include/net/cfg80211.h
    1841 +++ b/include/net/cfg80211.h
    1842 @@ -4258,6 +4258,17 @@ void cfg80211_rx_assoc_resp(struct net_device *dev,
    1843 void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss);
    1844
    1845 /**
    1846 + * cfg80211_abandon_assoc - notify cfg80211 of abandoned association attempt
    1847 + * @dev: network device
    1848 + * @bss: The BSS entry with which association was abandoned.
    1849 + *
    1850 + * Call this whenever - for reasons reported through other API, like deauth RX,
    1851 + * an association attempt was abandoned.
    1852 + * This function may sleep. The caller must hold the corresponding wdev's mutex.
    1853 + */
    1854 +void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss);
    1855 +
    1856 +/**
    1857 * cfg80211_tx_mlme_mgmt - notification of transmitted deauth/disassoc frame
    1858 * @dev: network device
    1859 * @buf: 802.11 frame (header + body)
    1860 diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h
    1861 index 11528591d0d7..a78ff97eb249 100644
    1862 --- a/include/rdma/ib_addr.h
    1863 +++ b/include/rdma/ib_addr.h
    1864 @@ -197,10 +197,12 @@ static inline void iboe_addr_get_sgid(struct rdma_dev_addr *dev_addr,
    1865
    1866 dev = dev_get_by_index(&init_net, dev_addr->bound_dev_if);
    1867 if (dev) {
    1868 - ip4 = (struct in_device *)dev->ip_ptr;
    1869 - if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address)
    1870 + ip4 = in_dev_get(dev);
    1871 + if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address) {
    1872 ipv6_addr_set_v4mapped(ip4->ifa_list->ifa_address,
    1873 (struct in6_addr *)gid);
    1874 + in_dev_put(ip4);
    1875 + }
    1876 dev_put(dev);
    1877 }
    1878 }
    1879 diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
    1880 index 445601c580d6..738012d68117 100644
    1881 --- a/kernel/time/timekeeping.c
    1882 +++ b/kernel/time/timekeeping.c
    1883 @@ -298,10 +298,10 @@ u32 (*arch_gettimeoffset)(void) = default_arch_gettimeoffset;
    1884 static inline u32 arch_gettimeoffset(void) { return 0; }
    1885 #endif
    1886
    1887 -static inline s64 timekeeping_delta_to_ns(struct tk_read_base *tkr,
    1888 +static inline u64 timekeeping_delta_to_ns(struct tk_read_base *tkr,
    1889 cycle_t delta)
    1890 {
    1891 - s64 nsec;
    1892 + u64 nsec;
    1893
    1894 nsec = delta * tkr->mult + tkr->xtime_nsec;
    1895 nsec >>= tkr->shift;
    1896 diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
    1897 index a663cbb84107..7fd6f5a26143 100644
    1898 --- a/kernel/trace/trace_functions_graph.c
    1899 +++ b/kernel/trace/trace_functions_graph.c
    1900 @@ -780,6 +780,10 @@ print_graph_entry_leaf(struct trace_iterator *iter,
    1901
    1902 cpu_data = per_cpu_ptr(data->cpu_data, cpu);
    1903
    1904 + /* If a graph tracer ignored set_graph_notrace */
    1905 + if (call->depth < -1)
    1906 + call->depth += FTRACE_NOTRACE_DEPTH;
    1907 +
    1908 /*
    1909 * Comments display at + 1 to depth. Since
    1910 * this is a leaf function, keep the comments
    1911 @@ -788,7 +792,8 @@ print_graph_entry_leaf(struct trace_iterator *iter,
    1912 cpu_data->depth = call->depth - 1;
    1913
    1914 /* No need to keep this function around for this depth */
    1915 - if (call->depth < FTRACE_RETFUNC_DEPTH)
    1916 + if (call->depth < FTRACE_RETFUNC_DEPTH &&
    1917 + !WARN_ON_ONCE(call->depth < 0))
    1918 cpu_data->enter_funcs[call->depth] = 0;
    1919 }
    1920
    1921 @@ -818,11 +823,16 @@ print_graph_entry_nested(struct trace_iterator *iter,
    1922 struct fgraph_cpu_data *cpu_data;
    1923 int cpu = iter->cpu;
    1924
    1925 + /* If a graph tracer ignored set_graph_notrace */
    1926 + if (call->depth < -1)
    1927 + call->depth += FTRACE_NOTRACE_DEPTH;
    1928 +
    1929 cpu_data = per_cpu_ptr(data->cpu_data, cpu);
    1930 cpu_data->depth = call->depth;
    1931
    1932 /* Save this function pointer to see if the exit matches */
    1933 - if (call->depth < FTRACE_RETFUNC_DEPTH)
    1934 + if (call->depth < FTRACE_RETFUNC_DEPTH &&
    1935 + !WARN_ON_ONCE(call->depth < 0))
    1936 cpu_data->enter_funcs[call->depth] = call->func;
    1937 }
    1938
    1939 @@ -1052,7 +1062,8 @@ print_graph_return(struct ftrace_graph_ret *trace, struct trace_seq *s,
    1940 */
    1941 cpu_data->depth = trace->depth - 1;
    1942
    1943 - if (trace->depth < FTRACE_RETFUNC_DEPTH) {
    1944 + if (trace->depth < FTRACE_RETFUNC_DEPTH &&
    1945 + !WARN_ON_ONCE(trace->depth < 0)) {
    1946 if (cpu_data->enter_funcs[trace->depth] != trace->func)
    1947 func_match = 0;
    1948 cpu_data->enter_funcs[trace->depth] = 0;
    1949 diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
    1950 index 63ae5dd24fc5..b8d927c56494 100644
    1951 --- a/net/ceph/messenger.c
    1952 +++ b/net/ceph/messenger.c
    1953 @@ -2042,6 +2042,19 @@ static int process_connect(struct ceph_connection *con)
    1954
    1955 dout("process_connect on %p tag %d\n", con, (int)con->in_tag);
    1956
    1957 + if (con->auth_reply_buf) {
    1958 + /*
    1959 + * Any connection that defines ->get_authorizer()
    1960 + * should also define ->verify_authorizer_reply().
    1961 + * See get_connect_authorizer().
    1962 + */
    1963 + ret = con->ops->verify_authorizer_reply(con, 0);
    1964 + if (ret < 0) {
    1965 + con->error_msg = "bad authorize reply";
    1966 + return ret;
    1967 + }
    1968 + }
    1969 +
    1970 switch (con->in_reply.tag) {
    1971 case CEPH_MSGR_TAG_FEATURES:
    1972 pr_err("%s%lld %s feature set mismatch,"
    1973 diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
    1974 index 83097c3832d1..23095d5e0199 100644
    1975 --- a/net/mac80211/mlme.c
    1976 +++ b/net/mac80211/mlme.c
    1977 @@ -2517,7 +2517,7 @@ static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
    1978 }
    1979
    1980 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
    1981 - bool assoc)
    1982 + bool assoc, bool abandon)
    1983 {
    1984 struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
    1985
    1986 @@ -2539,6 +2539,9 @@ static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
    1987 mutex_lock(&sdata->local->mtx);
    1988 ieee80211_vif_release_channel(sdata);
    1989 mutex_unlock(&sdata->local->mtx);
    1990 +
    1991 + if (abandon)
    1992 + cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
    1993 }
    1994
    1995 kfree(assoc_data);
    1996 @@ -2768,7 +2771,7 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
    1997 bssid, reason_code,
    1998 ieee80211_get_reason_code_string(reason_code));
    1999
    2000 - ieee80211_destroy_assoc_data(sdata, false);
    2001 + ieee80211_destroy_assoc_data(sdata, false, true);
    2002
    2003 cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
    2004 return;
    2005 @@ -3173,14 +3176,14 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
    2006 if (status_code != WLAN_STATUS_SUCCESS) {
    2007 sdata_info(sdata, "%pM denied association (code=%d)\n",
    2008 mgmt->sa, status_code);
    2009 - ieee80211_destroy_assoc_data(sdata, false);
    2010 + ieee80211_destroy_assoc_data(sdata, false, false);
    2011 event.u.mlme.status = MLME_DENIED;
    2012 event.u.mlme.reason = status_code;
    2013 drv_event_callback(sdata->local, sdata, &event);
    2014 } else {
    2015 if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
    2016 /* oops -- internal error -- send timeout for now */
    2017 - ieee80211_destroy_assoc_data(sdata, false);
    2018 + ieee80211_destroy_assoc_data(sdata, false, false);
    2019 cfg80211_assoc_timeout(sdata->dev, bss);
    2020 return;
    2021 }
    2022 @@ -3193,7 +3196,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
    2023 * recalc after assoc_data is NULL but before associated
    2024 * is set can cause the interface to go idle
    2025 */
    2026 - ieee80211_destroy_assoc_data(sdata, true);
    2027 + ieee80211_destroy_assoc_data(sdata, true, false);
    2028
    2029 /* get uapsd queues configuration */
    2030 uapsd_queues = 0;
    2031 @@ -3888,7 +3891,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
    2032 .u.mlme.status = MLME_TIMEOUT,
    2033 };
    2034
    2035 - ieee80211_destroy_assoc_data(sdata, false);
    2036 + ieee80211_destroy_assoc_data(sdata, false, false);
    2037 cfg80211_assoc_timeout(sdata->dev, bss);
    2038 drv_event_callback(sdata->local, sdata, &event);
    2039 }
    2040 @@ -4029,7 +4032,7 @@ void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
    2041 WLAN_REASON_DEAUTH_LEAVING,
    2042 false, frame_buf);
    2043 if (ifmgd->assoc_data)
    2044 - ieee80211_destroy_assoc_data(sdata, false);
    2045 + ieee80211_destroy_assoc_data(sdata, false, true);
    2046 if (ifmgd->auth_data)
    2047 ieee80211_destroy_auth_data(sdata, false);
    2048 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
    2049 @@ -4905,7 +4908,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
    2050 IEEE80211_STYPE_DEAUTH,
    2051 req->reason_code, tx,
    2052 frame_buf);
    2053 - ieee80211_destroy_assoc_data(sdata, false);
    2054 + ieee80211_destroy_assoc_data(sdata, false, true);
    2055 ieee80211_report_disconnect(sdata, frame_buf,
    2056 sizeof(frame_buf), true,
    2057 req->reason_code);
    2058 @@ -4980,7 +4983,7 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
    2059 sdata_lock(sdata);
    2060 if (ifmgd->assoc_data) {
    2061 struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
    2062 - ieee80211_destroy_assoc_data(sdata, false);
    2063 + ieee80211_destroy_assoc_data(sdata, false, false);
    2064 cfg80211_assoc_timeout(sdata->dev, bss);
    2065 }
    2066 if (ifmgd->auth_data)
    2067 diff --git a/net/wireless/core.h b/net/wireless/core.h
    2068 index 47a967fed8ff..47ea169aa0a3 100644
    2069 --- a/net/wireless/core.h
    2070 +++ b/net/wireless/core.h
    2071 @@ -398,6 +398,7 @@ void cfg80211_sme_disassoc(struct wireless_dev *wdev);
    2072 void cfg80211_sme_deauth(struct wireless_dev *wdev);
    2073 void cfg80211_sme_auth_timeout(struct wireless_dev *wdev);
    2074 void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev);
    2075 +void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev);
    2076
    2077 /* internal helpers */
    2078 bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher);
    2079 diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
    2080 index fb44fa3bf4ef..c0e02f72e931 100644
    2081 --- a/net/wireless/mlme.c
    2082 +++ b/net/wireless/mlme.c
    2083 @@ -149,6 +149,18 @@ void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss)
    2084 }
    2085 EXPORT_SYMBOL(cfg80211_assoc_timeout);
    2086
    2087 +void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss)
    2088 +{
    2089 + struct wireless_dev *wdev = dev->ieee80211_ptr;
    2090 + struct wiphy *wiphy = wdev->wiphy;
    2091 +
    2092 + cfg80211_sme_abandon_assoc(wdev);
    2093 +
    2094 + cfg80211_unhold_bss(bss_from_pub(bss));
    2095 + cfg80211_put_bss(wiphy, bss);
    2096 +}
    2097 +EXPORT_SYMBOL(cfg80211_abandon_assoc);
    2098 +
    2099 void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
    2100 {
    2101 struct wireless_dev *wdev = dev->ieee80211_ptr;
    2102 diff --git a/net/wireless/sme.c b/net/wireless/sme.c
    2103 index 8020b5b094d4..18b4a652cf41 100644
    2104 --- a/net/wireless/sme.c
    2105 +++ b/net/wireless/sme.c
    2106 @@ -39,6 +39,7 @@ struct cfg80211_conn {
    2107 CFG80211_CONN_ASSOCIATING,
    2108 CFG80211_CONN_ASSOC_FAILED,
    2109 CFG80211_CONN_DEAUTH,
    2110 + CFG80211_CONN_ABANDON,
    2111 CFG80211_CONN_CONNECTED,
    2112 } state;
    2113 u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
    2114 @@ -204,6 +205,8 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
    2115 cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
    2116 NULL, 0,
    2117 WLAN_REASON_DEAUTH_LEAVING, false);
    2118 + /* fall through */
    2119 + case CFG80211_CONN_ABANDON:
    2120 /* free directly, disconnected event already sent */
    2121 cfg80211_sme_free(wdev);
    2122 return 0;
    2123 @@ -423,6 +426,17 @@ void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
    2124 schedule_work(&rdev->conn_work);
    2125 }
    2126
    2127 +void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev)
    2128 +{
    2129 + struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
    2130 +
    2131 + if (!wdev->conn)
    2132 + return;
    2133 +
    2134 + wdev->conn->state = CFG80211_CONN_ABANDON;
    2135 + schedule_work(&rdev->conn_work);
    2136 +}
    2137 +
    2138 static int cfg80211_sme_get_conn_ies(struct wireless_dev *wdev,
    2139 const u8 *ies, size_t ies_len,
    2140 const u8 **out_ies, size_t *out_ies_len)
    2141 diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c
    2142 index 8275f0e55106..4b2f44c20caf 100644
    2143 --- a/scripts/kconfig/nconf.gui.c
    2144 +++ b/scripts/kconfig/nconf.gui.c
    2145 @@ -364,12 +364,14 @@ int dialog_inputbox(WINDOW *main_window,
    2146 WINDOW *prompt_win;
    2147 WINDOW *form_win;
    2148 PANEL *panel;
    2149 - int i, x, y;
    2150 + int i, x, y, lines, columns, win_lines, win_cols;
    2151 int res = -1;
    2152 int cursor_position = strlen(init);
    2153 int cursor_form_win;
    2154 char *result = *resultp;
    2155
    2156 + getmaxyx(stdscr, lines, columns);
    2157 +
    2158 if (strlen(init)+1 > *result_len) {
    2159 *result_len = strlen(init)+1;
    2160 *resultp = result = realloc(result, *result_len);
    2161 @@ -386,14 +388,19 @@ int dialog_inputbox(WINDOW *main_window,
    2162 if (title)
    2163 prompt_width = max(prompt_width, strlen(title));
    2164
    2165 + win_lines = min(prompt_lines+6, lines-2);
    2166 + win_cols = min(prompt_width+7, columns-2);
    2167 + prompt_lines = max(win_lines-6, 0);
    2168 + prompt_width = max(win_cols-7, 0);
    2169 +
    2170 /* place dialog in middle of screen */
    2171 - y = (getmaxy(stdscr)-(prompt_lines+4))/2;
    2172 - x = (getmaxx(stdscr)-(prompt_width+4))/2;
    2173 + y = (lines-win_lines)/2;
    2174 + x = (columns-win_cols)/2;
    2175
    2176 strncpy(result, init, *result_len);
    2177
    2178 /* create the windows */
    2179 - win = newwin(prompt_lines+6, prompt_width+7, y, x);
    2180 + win = newwin(win_lines, win_cols, y, x);
    2181 prompt_win = derwin(win, prompt_lines+1, prompt_width, 2, 2);
    2182 form_win = derwin(win, 1, prompt_width, prompt_lines+3, 2);
    2183 keypad(form_win, TRUE);