diff --git a/Documentation/sphinx/rstFlatTable.py 
b/Documentation/sphinx/rstFlatTable.py
index 26db852e3c74..99163598f18b 100644
--- a/Documentation/sphinx/rstFlatTable.py
+++ b/Documentation/sphinx/rstFlatTable.py
@@ -151,6 +151,11 @@ class ListTableBuilder(object):
     def buildTableNode(self):
 
         colwidths    = self.directive.get_column_widths(self.max_cols)
+        if isinstance(colwidths, tuple):
+            # Since docutils 0.13, get_column_widths returns a (widths,
+            # colwidths) tuple, where widths is a string (i.e. 'auto').
+            # See https://sourceforge.net/p/docutils/patches/120/.
+            colwidths = colwidths[1]
         stub_columns = self.directive.options.get('stub-columns', 0)
         header_rows  = self.directive.options.get('header-rows', 0)
 
diff --git a/Documentation/virtual/kvm/api.txt 
b/Documentation/virtual/kvm/api.txt
index 739db9ab16b2..a7596e9fdf06 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -2039,6 +2039,7 @@ registers, find a list below:
   PPC   | KVM_REG_PPC_TM_VSCR           | 32
   PPC   | KVM_REG_PPC_TM_DSCR           | 64
   PPC   | KVM_REG_PPC_TM_TAR            | 64
+  PPC   | KVM_REG_PPC_TM_XER            | 64
         |                               |
   MIPS  | KVM_REG_MIPS_R0               | 64
           ...
diff --git a/Makefile b/Makefile
index 50f68648a79a..ace32d3bac4b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 8
-SUBLEVEL = 16
+SUBLEVEL = 17
 EXTRAVERSION =
 NAME = Psychotic Stoned Sheep
 
diff --git a/arch/arc/include/asm/cacheflush.h 
b/arch/arc/include/asm/cacheflush.h
index a093adbdb017..fc662f49c55a 100644
--- a/arch/arc/include/asm/cacheflush.h
+++ b/arch/arc/include/asm/cacheflush.h
@@ -85,6 +85,10 @@ void flush_anon_page(struct vm_area_struct *vma,
  */
 #define PG_dc_clean    PG_arch_1
 
+#define CACHE_COLORS_NUM       4
+#define CACHE_COLORS_MSK       (CACHE_COLORS_NUM - 1)
+#define CACHE_COLOR(addr)      (((unsigned long)(addr) >> (PAGE_SHIFT)) & 
CACHE_COLORS_MSK)
+
 /*
  * Simple wrapper over config option
  * Bootup code ensures that hardware matches kernel configuration
@@ -94,8 +98,6 @@ static inline int cache_is_vipt_aliasing(void)
        return IS_ENABLED(CONFIG_ARC_CACHE_VIPT_ALIASING);
 }
 
-#define CACHE_COLOR(addr)      (((unsigned long)(addr) >> (PAGE_SHIFT)) & 1)
-
 /*
  * checks if two addresses (after page aligning) index into same cache set
  */
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index 0b10efe3a6a7..ab1aaf2a28c8 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -967,11 +967,16 @@ void arc_cache_init(void)
                /* check for D-Cache aliasing on ARCompact: ARCv2 has PIPT */
                if (is_isa_arcompact()) {
                        int handled = 
IS_ENABLED(CONFIG_ARC_CACHE_VIPT_ALIASING);
-
-                       if (dc->alias && !handled)
-                               panic("Enable 
CONFIG_ARC_CACHE_VIPT_ALIASING\n");
-                       else if (!dc->alias && handled)
+                       int num_colors = dc->sz_k/dc->assoc/TO_KB(PAGE_SIZE);
+
+                       if (dc->alias) {
+                               if (!handled)
+                                       panic("Enable 
CONFIG_ARC_CACHE_VIPT_ALIASING\n");
+                               if (CACHE_COLORS_NUM != num_colors)
+                                       panic("CACHE_COLORS_NUM not optimized 
for config\n");
+                       } else if (!dc->alias && handled) {
                                panic("Disable 
CONFIG_ARC_CACHE_VIPT_ALIASING\n");
+                       }
                }
        }
 
diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi 
b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
index 5fda583351d7..906fb836d241 100644
--- a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
@@ -21,6 +21,10 @@
                reg = <0x0 0x80000000 0x1 0x0>;
        };
 
+       gpu@57000000 {
+               vdd-supply = <&vdd_gpu>;
+       };
+
        /* debug port */
        serial@70006000 {
                status = "okay";
@@ -291,4 +295,18 @@
                        clock-frequency = <32768>;
                };
        };
+
+       regulators {
+               vdd_gpu: regulator@100 {
+                       compatible = "pwm-regulator";
+                       reg = <100>;
+                       pwms = <&pwm 1 4880>;
+                       regulator-name = "VDD_GPU";
+                       regulator-min-microvolt = <710000>;
+                       regulator-max-microvolt = <1320000>;
+                       enable-gpios = <&pmic 6 GPIO_ACTIVE_HIGH>;
+                       regulator-ramp-delay = <80>;
+                       regulator-enable-ramp-delay = <1000>;
+               };
+       };
 };
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index 5a84b4562603..03498c8f0cf7 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -82,7 +82,13 @@ static void __hyp_text __activate_traps(struct kvm_vcpu 
*vcpu)
        write_sysreg(val, hcr_el2);
        /* Trap on AArch32 cp15 c15 accesses (EL1 or EL0) */
        write_sysreg(1 << 15, hstr_el2);
-       /* Make sure we trap PMU access from EL0 to EL2 */
+       /*
+        * Make sure we trap PMU access from EL0 to EL2. Also sanitize
+        * PMSELR_EL0 to make sure it never contains the cycle
+        * counter, which could make a PMXEVCNTR_EL0 access UNDEF at
+        * EL1 instead of being trapped to EL2.
+        */
+       write_sysreg(0, pmselr_el0);
        write_sysreg(ARMV8_PMU_USERENR_MASK, pmuserenr_el0);
        write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2);
        __activate_traps_arch()();
diff --git a/arch/powerpc/boot/ps3-head.S b/arch/powerpc/boot/ps3-head.S
index b6fcbaf5027b..3dc44b05fb97 100644
--- a/arch/powerpc/boot/ps3-head.S
+++ b/arch/powerpc/boot/ps3-head.S
@@ -57,11 +57,6 @@ __system_reset_overlay:
        bctr
 
 1:
-       /* Save the value at addr zero for a null pointer write check later. */
-
-       li      r4, 0
-       lwz     r3, 0(r4)
-
        /* Primary delays then goes to _zimage_start in wrapper. */
 
        or      31, 31, 31 /* db16cyc */
diff --git a/arch/powerpc/boot/ps3.c b/arch/powerpc/boot/ps3.c
index 4ec2d86d3c50..a05558a7e51a 100644
--- a/arch/powerpc/boot/ps3.c
+++ b/arch/powerpc/boot/ps3.c
@@ -119,13 +119,12 @@ void ps3_copy_vectors(void)
        flush_cache((void *)0x100, 512);
 }
 
-void platform_init(unsigned long null_check)
+void platform_init(void)
 {
        const u32 heapsize = 0x1000000 - (u32)_end; /* 16MiB */
        void *chosen;
        unsigned long ft_addr;
        u64 rm_size;
-       unsigned long val;
 
        console_ops.write = ps3_console_write;
        platform_ops.exit = ps3_exit;
@@ -153,11 +152,6 @@ void platform_init(unsigned long null_check)
 
        printf(" flat tree at 0x%lx\n\r", ft_addr);
 
-       val = *(unsigned long *)0;
-
-       if (val != null_check)
-               printf("null check failed: %lx != %lx\n\r", val, null_check);
-
        ((kernel_entry_t)0)(ft_addr, 0, NULL);
 
        ps3_exit();
diff --git a/arch/powerpc/include/asm/kvm_host.h 
b/arch/powerpc/include/asm/kvm_host.h
index ec35af34a3fb..f2c5dde507c7 100644
--- a/arch/powerpc/include/asm/kvm_host.h
+++ b/arch/powerpc/include/asm/kvm_host.h
@@ -555,6 +555,7 @@ struct kvm_vcpu_arch {
        u64 tfiar;
 
        u32 cr_tm;
+       u64 xer_tm;
        u64 lr_tm;
        u64 ctr_tm;
        u64 amr_tm;
diff --git a/arch/powerpc/include/uapi/asm/kvm.h 
b/arch/powerpc/include/uapi/asm/kvm.h
index c93cf35ce379..0fb1326c3ea2 100644
--- a/arch/powerpc/include/uapi/asm/kvm.h
+++ b/arch/powerpc/include/uapi/asm/kvm.h
@@ -596,6 +596,7 @@ struct kvm_get_htab_header {
 #define KVM_REG_PPC_TM_VSCR    (KVM_REG_PPC_TM | KVM_REG_SIZE_U32 | 0x67)
 #define KVM_REG_PPC_TM_DSCR    (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x68)
 #define KVM_REG_PPC_TM_TAR     (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x69)
+#define KVM_REG_PPC_TM_XER     (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x6a)
 
 /* PPC64 eXternal Interrupt Controller Specification */
 #define KVM_DEV_XICS_GRP_SOURCES       1       /* 64-bit source attributes */
diff --git a/arch/powerpc/kernel/asm-offsets.c 
b/arch/powerpc/kernel/asm-offsets.c
index b89d14c0352c..6ba221c76214 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -569,6 +569,7 @@ int main(void)
        DEFINE(VCPU_VRS_TM, offsetof(struct kvm_vcpu, arch.vr_tm.vr));
        DEFINE(VCPU_VRSAVE_TM, offsetof(struct kvm_vcpu, arch.vrsave_tm));
        DEFINE(VCPU_CR_TM, offsetof(struct kvm_vcpu, arch.cr_tm));
+       DEFINE(VCPU_XER_TM, offsetof(struct kvm_vcpu, arch.xer_tm));
        DEFINE(VCPU_LR_TM, offsetof(struct kvm_vcpu, arch.lr_tm));
        DEFINE(VCPU_CTR_TM, offsetof(struct kvm_vcpu, arch.ctr_tm));
        DEFINE(VCPU_AMR_TM, offsetof(struct kvm_vcpu, arch.amr_tm));
diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index f765b0434731..882578929fe7 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -201,9 +201,9 @@ booting_thread_hwid:
  */
 _GLOBAL(book3e_start_thread)
        LOAD_REG_IMMEDIATE(r5, MSR_KERNEL)
-       cmpi    0, r3, 0
+       cmpwi   r3, 0
        beq     10f
-       cmpi    0, r3, 1
+       cmpwi   r3, 1
        beq     11f
        /* If the thread id is invalid, just exit. */
        b       13f
@@ -228,9 +228,9 @@ _GLOBAL(book3e_start_thread)
  * r3 = the thread physical id
  */
 _GLOBAL(book3e_stop_thread)
-       cmpi    0, r3, 0
+       cmpwi   r3, 0
        beq     10f
-       cmpi    0, r3, 1
+       cmpwi   r3, 1
        beq     10f
        /* If the thread id is invalid, just exit. */
        b       13f
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 2fd5580c8f6e..4c8d344486e6 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -1235,6 +1235,9 @@ static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, 
u64 id,
        case KVM_REG_PPC_TM_CR:
                *val = get_reg_val(id, vcpu->arch.cr_tm);
                break;
+       case KVM_REG_PPC_TM_XER:
+               *val = get_reg_val(id, vcpu->arch.xer_tm);
+               break;
        case KVM_REG_PPC_TM_LR:
                *val = get_reg_val(id, vcpu->arch.lr_tm);
                break;
@@ -1442,6 +1445,9 @@ static int kvmppc_set_one_reg_hv(struct kvm_vcpu *vcpu, 
u64 id,
        case KVM_REG_PPC_TM_CR:
                vcpu->arch.cr_tm = set_reg_val(id, *val);
                break;
+       case KVM_REG_PPC_TM_XER:
+               vcpu->arch.xer_tm = set_reg_val(id, *val);
+               break;
        case KVM_REG_PPC_TM_LR:
                vcpu->arch.lr_tm = set_reg_val(id, *val);
                break;
diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c 
b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
index 99b4e9d5dd23..5420d060c6f6 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
@@ -653,6 +653,8 @@ long kvmppc_h_protect(struct kvm_vcpu *vcpu, unsigned long 
flags,
                                              HPTE_V_ABSENT);
                        do_tlbies(kvm, &rb, 1, global_invalidates(kvm, flags),
                                  true);
+                       /* Don't lose R/C bit updates done by hardware */
+                       r |= be64_to_cpu(hpte[1]) & (HPTE_R_R | HPTE_R_C);
                        hpte[1] = cpu_to_be64(r);
                }
        }
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S 
b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 975655573844..bf243a4caa63 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -2579,11 +2579,13 @@ kvmppc_save_tm:
        mfctr   r7
        mfspr   r8, SPRN_AMR
        mfspr   r10, SPRN_TAR
+       mfxer   r11
        std     r5, VCPU_LR_TM(r9)
        stw     r6, VCPU_CR_TM(r9)
        std     r7, VCPU_CTR_TM(r9)
        std     r8, VCPU_AMR_TM(r9)
        std     r10, VCPU_TAR_TM(r9)
+       std     r11, VCPU_XER_TM(r9)
 
        /* Restore r12 as trap number. */
        lwz     r12, VCPU_TRAP(r9)
@@ -2676,11 +2678,13 @@ kvmppc_restore_tm:
        ld      r7, VCPU_CTR_TM(r4)
        ld      r8, VCPU_AMR_TM(r4)
        ld      r9, VCPU_TAR_TM(r4)
+       ld      r10, VCPU_XER_TM(r4)
        mtlr    r5
        mtcr    r6
        mtctr   r7
        mtspr   SPRN_AMR, r8
        mtspr   SPRN_TAR, r9
+       mtxer   r10
 
        /*
         * Load up PPR and DSCR values but don't put them in the actual SPRs
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 7f7ba5f23f13..d027f2eb3559 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -445,7 +445,7 @@ static void __init setup_resources(void)
         * part of the System RAM resource.
         */
        if (crashk_res.end) {
-               memblock_add(crashk_res.start, resource_size(&crashk_res));
+               memblock_add_node(crashk_res.start, resource_size(&crashk_res), 
0);
                memblock_reserve(crashk_res.start, resource_size(&crashk_res));
                insert_resource(&iomem_resource, &crashk_res);
        }
diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index 0b56666e6039..b84a3496994c 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -852,8 +852,8 @@ ftrace_graph_call:
        jmp     ftrace_stub
 #endif
 
-.globl ftrace_stub
-ftrace_stub:
+/* This is weak to keep gas from relaxing the jumps */
+WEAK(ftrace_stub)
        ret
 END(ftrace_caller)
 
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 8c925ecaf534..7b0f1d932c87 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -364,7 +364,11 @@ int x86_add_exclusive(unsigned int what)
 {
        int i;
 
-       if (x86_pmu.lbr_pt_coexist)
+       /*
+        * When lbr_pt_coexist we allow PT to coexist with either LBR or BTS.
+        * LBR and BTS are still mutually exclusive.
+        */
+       if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt)
                return 0;
 
        if (!atomic_inc_not_zero(&x86_pmu.lbr_exclusive[what])) {
@@ -387,7 +391,7 @@ fail_unlock:
 
 void x86_del_exclusive(unsigned int what)
 {
-       if (x86_pmu.lbr_pt_coexist)
+       if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt)
                return;
 
        atomic_dec(&x86_pmu.lbr_exclusive[what]);
diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
index 3ca87b5a8677..834262aec88d 100644
--- a/arch/x86/events/intel/cstate.c
+++ b/arch/x86/events/intel/cstate.c
@@ -571,6 +571,9 @@ static int __init cstate_probe(const struct cstate_model 
*cm)
 
 static inline void cstate_cleanup(void)
 {
+       cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_ONLINE);
+       cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_STARTING);
+
        if (has_cstate_core)
                perf_pmu_unregister(&cstate_core_pmu);
 
@@ -583,16 +586,16 @@ static int __init cstate_init(void)
        int err;
 
        cpuhp_setup_state(CPUHP_AP_PERF_X86_CSTATE_STARTING,
-                         "AP_PERF_X86_CSTATE_STARTING", cstate_cpu_init,
-                         NULL);
+                         "perf/x86/cstate:starting", cstate_cpu_init, NULL);
        cpuhp_setup_state(CPUHP_AP_PERF_X86_CSTATE_ONLINE,
-                         "AP_PERF_X86_CSTATE_ONLINE", NULL, cstate_cpu_exit);
+                         "perf/x86/cstate:online", NULL, cstate_cpu_exit);
 
        if (has_cstate_core) {
                err = perf_pmu_register(&cstate_core_pmu, cstate_core_pmu.name, 
-1);
                if (err) {
                        has_cstate_core = false;
                        pr_info("Failed to register cstate core pmu\n");
+                       cstate_cleanup();
                        return err;
                }
        }
@@ -606,8 +609,7 @@ static int __init cstate_init(void)
                        return err;
                }
        }
-
-       return err;
+       return 0;
 }
 
 static int __init cstate_pmu_init(void)
@@ -632,8 +634,6 @@ module_init(cstate_pmu_init);
 
 static void __exit cstate_pmu_exit(void)
 {
-       cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_ONLINE);
-       cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_STARTING);
        cstate_cleanup();
 }
 module_exit(cstate_pmu_exit);
diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
index 181c238d4df9..4ab002d4c9fd 100644
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -601,7 +601,7 @@ struct x86_pmu {
        u64             lbr_sel_mask;              /* LBR_SELECT valid bits */
        const int       *lbr_sel_map;              /* lbr_select mappings */
        bool            lbr_double_abort;          /* duplicated lbr aborts */
-       bool            lbr_pt_coexist;            /* LBR may coexist with PT */
+       bool            lbr_pt_coexist;            /* (LBR|BTS) may coexist 
with PT */
 
        /*
         * Intel PT/LBR/BTS are exclusive
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 5cede40e2552..7a72db5350aa 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1336,10 +1336,10 @@ static inline bool nested_cpu_has_posted_intr(struct 
vmcs12 *vmcs12)
        return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR;
 }
 
-static inline bool is_exception(u32 intr_info)
+static inline bool is_nmi(u32 intr_info)
 {
        return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
-               == (INTR_TYPE_HARD_EXCEPTION | INTR_INFO_VALID_MASK);
+               == (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK);
 }
 
 static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
@@ -5467,7 +5467,7 @@ static int handle_exception(struct kvm_vcpu *vcpu)
        if (is_machine_check(intr_info))
                return handle_machine_check(vcpu);
 
-       if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR)
+       if (is_nmi(intr_info))
                return 1;  /* already handled by vmx_vcpu_run() */
 
        if (is_no_device(intr_info)) {
@@ -7974,7 +7974,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
 
        switch (exit_reason) {
        case EXIT_REASON_EXCEPTION_NMI:
-               if (!is_exception(intr_info))
+               if (is_nmi(intr_info))
                        return false;
                else if (is_page_fault(intr_info))
                        return enable_ept;
@@ -8572,8 +8572,7 @@ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
                kvm_machine_check();
 
        /* We need to handle NMIs before interrupts are enabled */
-       if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
-           (exit_intr_info & INTR_INFO_VALID_MASK)) {
+       if (is_nmi(exit_intr_info)) {
                kvm_before_handle_nmi(&vmx->vcpu);
                asm("int $2");
                kvm_after_handle_nmi(&vmx->vcpu);
diff --git a/block/bsg.c b/block/bsg.c
index d214e929ce18..b9a53615bdef 100644
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -655,6 +655,9 @@ bsg_write(struct file *file, const char __user *buf, size_t 
count, loff_t *ppos)
 
        dprintk("%s: write %Zd bytes\n", bd->name, count);
 
+       if (unlikely(segment_eq(get_fs(), KERNEL_DS)))
+               return -EINVAL;
+
        bsg_set_block(bd, file);
 
        bytes_written = 0;
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index a6b36fc53aec..02ded25c82e4 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -296,6 +296,26 @@ static const struct dmi_system_id video_detect_dmi_table[] 
= {
                DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V131"),
                },
        },
+       {
+        /* https://bugzilla.redhat.com/show_bug.cgi?id=1123661 */
+        .callback = video_detect_force_native,
+        .ident = "Dell XPS 17 L702X",
+        .matches = {
+               DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+               DMI_MATCH(DMI_PRODUCT_NAME, "Dell System XPS L702X"),
+               },
+       },
+       {
+       /* https://bugzilla.redhat.com/show_bug.cgi?id=1204476 */
+       /* 
https://bugs.launchpad.net/ubuntu/+source/linux-lts-trusty/+bug/1416940 */
+       .callback = video_detect_force_native,
+       .ident = "HP Pavilion dv6",
+       .matches = {
+               DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+               DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv6 Notebook PC"),
+               },
+       },
+
        { },
 };
 
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 22d1760a4278..a95e1e572697 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -955,13 +955,14 @@ static int _request_firmware_load(struct firmware_priv 
*fw_priv,
                timeout = MAX_JIFFY_OFFSET;
        }
 
-       retval = wait_for_completion_interruptible_timeout(&buf->completion,
+       timeout = wait_for_completion_interruptible_timeout(&buf->completion,
                        timeout);
-       if (retval == -ERESTARTSYS || !retval) {
+       if (timeout == -ERESTARTSYS || !timeout) {
+               retval = timeout;
                mutex_lock(&fw_lock);
                fw_load_abort(fw_priv);
                mutex_unlock(&fw_lock);
-       } else if (retval > 0) {
+       } else if (timeout > 0) {
                retval = 0;
        }
 
diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 0fc71cbaa440..3250694fd793 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -751,7 +751,9 @@ static void bcm2835_pll_divider_off(struct clk_hw *hw)
        cprman_write(cprman, data->cm_reg,
                     (cprman_read(cprman, data->cm_reg) &
                      ~data->load_mask) | data->hold_mask);
-       cprman_write(cprman, data->a2w_reg, A2W_PLL_CHANNEL_DISABLE);
+       cprman_write(cprman, data->a2w_reg,
+                    cprman_read(cprman, data->a2w_reg) |
+                    A2W_PLL_CHANNEL_DISABLE);
        spin_unlock(&cprman->regs_lock);
 }
 
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 15704aaf9e4e..a8eea8a69da3 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -984,7 +984,8 @@ static int gpio_chrdev_open(struct inode *inode, struct 
file *filp)
                return -ENODEV;
        get_device(&gdev->dev);
        filp->private_data = gdev;
-       return 0;
+
+       return nonseekable_open(inode, filp);
 }
 
 /**
@@ -1009,7 +1010,7 @@ static const struct file_operations gpio_fileops = {
        .release = gpio_chrdev_release,
        .open = gpio_chrdev_open,
        .owner = THIS_MODULE,
-       .llseek = noop_llseek,
+       .llseek = no_llseek,
        .unlocked_ioctl = gpio_ioctl,
 #ifdef CONFIG_COMPAT
        .compat_ioctl = gpio_ioctl_compat,
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c 
b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index b8184617ca25..8199232c2fbd 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -3798,8 +3798,12 @@ static int gfx_v8_0_init_save_restore_list(struct 
amdgpu_device *adev)
        temp = mmRLC_SRM_INDEX_CNTL_ADDR_0;
        data = mmRLC_SRM_INDEX_CNTL_DATA_0;
        for (i = 0; i < sizeof(unique_indices) / sizeof(int); i++) {
-               amdgpu_mm_wreg(adev, temp + i, unique_indices[i] & 0x3FFFF, 
false);
-               amdgpu_mm_wreg(adev, data + i, unique_indices[i] >> 20, false);
+               if (unique_indices[i] != 0) {
+                       amdgpu_mm_wreg(adev, temp + i,
+                                       unique_indices[i] & 0x3FFFF, false);
+                       amdgpu_mm_wreg(adev, data + i,
+                                       unique_indices[i] >> 20, false);
+               }
        }
        kfree(register_list_format);
 
@@ -5735,29 +5739,24 @@ static void 
gfx_v8_0_update_coarse_grain_clock_gating(struct amdgpu_device *adev
        adev->gfx.rlc.funcs->enter_safe_mode(adev);
 
        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGCG)) {
-               /* 1 enable cntx_empty_int_enable/cntx_busy_int_enable/
-                * Cmp_busy/GFX_Idle interrupts
-                */
-               gfx_v8_0_enable_gui_idle_interrupt(adev, true);
-
                temp1 = data1 = RREG32(mmRLC_CGTT_MGCG_OVERRIDE);
                data1 &= ~RLC_CGTT_MGCG_OVERRIDE__CGCG_MASK;
                if (temp1 != data1)
                        WREG32(mmRLC_CGTT_MGCG_OVERRIDE, data1);
 
-               /* 2 wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER 
idle */
+               /* : wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER 
idle */
                gfx_v8_0_wait_for_rlc_serdes(adev);
 
-               /* 3 - clear cgcg override */
+               /* 2 - clear cgcg override */
                gfx_v8_0_send_serdes_cmd(adev, BPM_REG_CGCG_OVERRIDE, 
CLE_BPM_SERDES_CMD);
 
                /* wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER idle 
*/
                gfx_v8_0_wait_for_rlc_serdes(adev);
 
-               /* 4 - write cmd to set CGLS */
+               /* 3 - write cmd to set CGLS */
                gfx_v8_0_send_serdes_cmd(adev, BPM_REG_CGLS_EN, 
SET_BPM_SERDES_CMD);
 
-               /* 5 - enable cgcg */
+               /* 4 - enable cgcg */
                data |= RLC_CGCG_CGLS_CTRL__CGCG_EN_MASK;
 
                if (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGLS) {
@@ -5775,6 +5774,11 @@ static void 
gfx_v8_0_update_coarse_grain_clock_gating(struct amdgpu_device *adev
 
                if (temp != data)
                        WREG32(mmRLC_CGCG_CGLS_CTRL, data);
+
+               /* 5 enable cntx_empty_int_enable/cntx_busy_int_enable/
+                * Cmp_busy/GFX_Idle interrupts
+                */
+               gfx_v8_0_enable_gui_idle_interrupt(adev, true);
        } else {
                /* disable cntx_empty_int_enable & GFX Idle interrupt */
                gfx_v8_0_enable_gui_idle_interrupt(adev, false);
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index 904beaa932d0..f75c6421db62 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -223,7 +223,8 @@ static int ast_get_dram_info(struct drm_device *dev)
        ast_write32(ast, 0x10000, 0xfc600309);
 
        do {
-               ;
+               if (pci_channel_offline(dev->pdev))
+                       return -EIO;
        } while (ast_read32(ast, 0x10000) != 0x01);
        data = ast_read32(ast, 0x10004);
 
@@ -428,7 +429,9 @@ int ast_driver_load(struct drm_device *dev, unsigned long 
flags)
        ast_detect_chip(dev, &need_post);
 
        if (ast->chip != AST1180) {
-               ast_get_dram_info(dev);
+               ret = ast_get_dram_info(dev);
+               if (ret)
+                       goto out_free;
                ast->vram_size = ast_get_vram_info(dev);
                DRM_INFO("dram %d %d %d %08x\n", ast->mclk, ast->dram_type, 
ast->dram_bus_width, ast->vram_size);
        }
diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
index 50eb944fb78a..8f3ca526bd1b 100644
--- a/drivers/gpu/drm/gma500/psb_drv.c
+++ b/drivers/gpu/drm/gma500/psb_drv.c
@@ -473,6 +473,9 @@ static const struct file_operations psb_gem_fops = {
        .open = drm_open,
        .release = drm_release,
        .unlocked_ioctl = psb_unlocked_ioctl,
+#ifdef CONFIG_COMPAT
+       .compat_ioctl = drm_compat_ioctl,
+#endif
        .mmap = drm_gem_mmap,
        .poll = drm_poll,
        .read = drm_read,
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c 
b/drivers/gpu/drm/i915/i915_gem_stolen.c
index 2bb69f3c5b84..b386b3162e29 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -55,10 +55,9 @@ int i915_gem_stolen_insert_node_in_range(struct 
drm_i915_private *dev_priv,
                return -ENODEV;
 
        /* See the comment at the drm_mm_init() call for more about this check.
-        * WaSkipStolenMemoryFirstPage:bdw,chv,kbl (incomplete)
+        * WaSkipStolenMemoryFirstPage:bdw+ (incomplete)
         */
-       if (start < 4096 && (IS_GEN8(dev_priv) ||
-                            IS_KBL_REVID(dev_priv, 0, KBL_REVID_A0)))
+       if (start < 4096 && INTEL_GEN(dev_priv) >= 8)
                start = 4096;
 
        mutex_lock(&dev_priv->mm.stolen_lock);
diff --git a/drivers/gpu/drm/i915/intel_display.c 
b/drivers/gpu/drm/i915/intel_display.c
index 35d385d70d8e..6bc93ba7e1dd 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -13494,8 +13494,9 @@ static int intel_modeset_checks(struct drm_atomic_state 
*state)
 
                DRM_DEBUG_KMS("New cdclk calculated to be atomic %u, actual 
%u\n",
                              intel_state->cdclk, intel_state->dev_cdclk);
-       } else
+       } else {
                to_intel_atomic_state(state)->cdclk = 
dev_priv->atomic_cdclk_freq;
+       }
 
        intel_modeset_clear_plls(state);
 
@@ -13596,8 +13597,9 @@ static int intel_atomic_check(struct drm_device *dev,
 
                if (ret)
                        return ret;
-       } else
-               intel_state->cdclk = dev_priv->cdclk_freq;
+       } else {
+               intel_state->cdclk = dev_priv->atomic_cdclk_freq;
+       }
 
        ret = drm_atomic_helper_check_planes(dev, state);
        if (ret)
@@ -15902,6 +15904,7 @@ void intel_modeset_init(struct drm_device *dev)
 
        intel_update_czclk(dev_priv);
        intel_update_cdclk(dev);
+       dev_priv->atomic_cdclk_freq = dev_priv->cdclk_freq;
 
        intel_shared_dpll_init(dev);
 
diff --git a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c 
b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
index cd154ce6b6c1..34601574fc6e 100644
--- a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
+++ b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
@@ -296,7 +296,8 @@ static void chv_exec_gpio(struct drm_i915_private *dev_priv,
        mutex_lock(&dev_priv->sb_lock);
        vlv_iosf_sb_write(dev_priv, port, cfg1, 0);
        vlv_iosf_sb_write(dev_priv, port, cfg0,
-                         CHV_GPIO_GPIOCFG_GPO | CHV_GPIO_GPIOTXSTATE(value));
+                         CHV_GPIO_GPIOEN | CHV_GPIO_GPIOCFG_GPO |
+                         CHV_GPIO_GPIOTXSTATE(value));
        mutex_unlock(&dev_priv->sb_lock);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c 
b/drivers/gpu/drm/i915/intel_runtime_pm.c
index 1c603bbe5784..07a7cc0d4ebb 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -1062,7 +1062,18 @@ static bool vlv_power_well_enabled(struct 
drm_i915_private *dev_priv,
 
 static void vlv_init_display_clock_gating(struct drm_i915_private *dev_priv)
 {
-       I915_WRITE(DSPCLK_GATE_D, VRHUNIT_CLOCK_GATE_DISABLE);
+       u32 val;
+
+       /*
+        * On driver load, a pipe may be active and driving a DSI display.
+        * Preserve DPOUNIT_CLOCK_GATE_DISABLE to avoid the pipe getting stuck
+        * (and never recovering) in this case. intel_dsi_post_disable() will
+        * clear it when we turn off the display.
+        */
+       val = I915_READ(DSPCLK_GATE_D);
+       val &= DPOUNIT_CLOCK_GATE_DISABLE;
+       val |= VRHUNIT_CLOCK_GATE_DISABLE;
+       I915_WRITE(DSPCLK_GATE_D, val);
 
        /*
         * Disable trickle feed and enable pnd deadline calculation
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c 
b/drivers/gpu/drm/nouveau/nouveau_bios.c
index a1570b109434..23ffe8571a99 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -333,6 +333,9 @@ get_fp_strap(struct drm_device *dev, struct nvbios *bios)
        if (bios->major_version < 5 && bios->data[0x48] & 0x4)
                return NVReadVgaCrtc5758(dev, 0, 0xf) & 0xf;
 
+       if (drm->device.info.family >= NV_DEVICE_INFO_V0_MAXWELL)
+               return nvif_rd32(device, 0x001800) & 0x0000000f;
+       else
        if (drm->device.info.family >= NV_DEVICE_INFO_V0_TESLA)
                return (nvif_rd32(device, NV_PEXTDEV_BOOT_0) >> 24) & 0xf;
        else
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c 
b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 864323b19cf7..fad263b3c7f7 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -1209,6 +1209,7 @@ nouveau_bo_move_ntfy(struct ttm_buffer_object *bo, struct 
ttm_mem_reg *new_mem)
                               nvbo->page_shift != vma->vm->mmu->lpg_shift)) {
                        nvkm_vm_map(vma, new_mem->mm_node);
                } else {
+                       WARN_ON(ttm_bo_wait(bo, false, false));
                        nvkm_vm_unmap(vma);
                }
        }
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c 
b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
index 7218a067a6c5..e0d7f8472ac6 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
@@ -1851,7 +1851,7 @@ nvf1_chipset = {
        .fb = gk104_fb_new,
        .fuse = gf100_fuse_new,
        .gpio = gk104_gpio_new,
-       .i2c = gf119_i2c_new,
+       .i2c = gk104_i2c_new,
        .ibus = gk104_ibus_new,
        .iccsense = gf100_iccsense_new,
        .imem = nv50_instmem_new,
@@ -1965,7 +1965,7 @@ nv117_chipset = {
        .fb = gm107_fb_new,
        .fuse = gm107_fuse_new,
        .gpio = gk104_gpio_new,
-       .i2c = gf119_i2c_new,
+       .i2c = gk104_i2c_new,
        .ibus = gk104_ibus_new,
        .iccsense = gf100_iccsense_new,
        .imem = nv50_instmem_new,
@@ -1999,7 +1999,7 @@ nv118_chipset = {
        .fb = gm107_fb_new,
        .fuse = gm107_fuse_new,
        .gpio = gk104_gpio_new,
-       .i2c = gf119_i2c_new,
+       .i2c = gk104_i2c_new,
        .ibus = gk104_ibus_new,
        .iccsense = gf100_iccsense_new,
        .imem = nv50_instmem_new,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c 
b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c
index cbc67f262322..12d964260a29 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c
@@ -60,6 +60,7 @@ gf100_fifo_gpfifo_engine_fini(struct nvkm_fifo_chan *base,
        struct nvkm_gpuobj *inst = chan->base.inst;
        int ret = 0;
 
+       mutex_lock(&subdev->mutex);
        nvkm_wr32(device, 0x002634, chan->base.chid);
        if (nvkm_msec(device, 2000,
                if (nvkm_rd32(device, 0x002634) == chan->base.chid)
@@ -67,10 +68,12 @@ gf100_fifo_gpfifo_engine_fini(struct nvkm_fifo_chan *base,
        ) < 0) {
                nvkm_error(subdev, "channel %d [%s] kick timeout\n",
                           chan->base.chid, chan->base.object.client->name);
-               ret = -EBUSY;
-               if (suspend)
-                       return ret;
+               ret = -ETIMEDOUT;
        }
+       mutex_unlock(&subdev->mutex);
+
+       if (ret && suspend)
+               return ret;
 
        if (offset) {
                nvkm_kmap(inst);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c 
b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c
index ed4351032ed6..a2df4f3e7763 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c
@@ -40,7 +40,9 @@ gk104_fifo_gpfifo_kick(struct gk104_fifo_chan *chan)
        struct nvkm_subdev *subdev = &fifo->base.engine.subdev;
        struct nvkm_device *device = subdev->device;
        struct nvkm_client *client = chan->base.object.client;
+       int ret = 0;
 
+       mutex_lock(&subdev->mutex);
        nvkm_wr32(device, 0x002634, chan->base.chid);
        if (nvkm_msec(device, 2000,
                if (!(nvkm_rd32(device, 0x002634) & 0x00100000))
@@ -48,10 +50,10 @@ gk104_fifo_gpfifo_kick(struct gk104_fifo_chan *chan)
        ) < 0) {
                nvkm_error(subdev, "channel %d [%s] kick timeout\n",
                           chan->base.chid, client->name);
-               return -EBUSY;
+               ret = -ETIMEDOUT;
        }
-
-       return 0;
+       mutex_unlock(&subdev->mutex);
+       return ret;
 }
 
 static u32
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c 
b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
index 157919c788e6..6584d505460c 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
@@ -1756,6 +1756,50 @@ gf100_gr_ = {
 };
 
 int
+gf100_gr_ctor_fw_legacy(struct gf100_gr *gr, const char *fwname,
+                       struct gf100_gr_fuc *fuc, int ret)
+{
+       struct nvkm_subdev *subdev = &gr->base.engine.subdev;
+       struct nvkm_device *device = subdev->device;
+       const struct firmware *fw;
+       char f[32];
+
+       /* see if this firmware has a legacy path */
+       if (!strcmp(fwname, "fecs_inst"))
+               fwname = "fuc409c";
+       else if (!strcmp(fwname, "fecs_data"))
+               fwname = "fuc409d";
+       else if (!strcmp(fwname, "gpccs_inst"))
+               fwname = "fuc41ac";
+       else if (!strcmp(fwname, "gpccs_data"))
+               fwname = "fuc41ad";
+       else {
+               /* nope, let's just return the error we got */
+               nvkm_error(subdev, "failed to load %s\n", fwname);
+               return ret;
+       }
+
+       /* yes, try to load from the legacy path */
+       nvkm_debug(subdev, "%s: falling back to legacy path\n", fwname);
+
+       snprintf(f, sizeof(f), "nouveau/nv%02x_%s", device->chipset, fwname);
+       ret = request_firmware(&fw, f, device->dev);
+       if (ret) {
+               snprintf(f, sizeof(f), "nouveau/%s", fwname);
+               ret = request_firmware(&fw, f, device->dev);
+               if (ret) {
+                       nvkm_error(subdev, "failed to load %s\n", fwname);
+                       return ret;
+               }
+       }
+
+       fuc->size = fw->size;
+       fuc->data = kmemdup(fw->data, fuc->size, GFP_KERNEL);
+       release_firmware(fw);
+       return (fuc->data != NULL) ? 0 : -ENOMEM;
+}
+
+int
 gf100_gr_ctor_fw(struct gf100_gr *gr, const char *fwname,
                 struct gf100_gr_fuc *fuc)
 {
@@ -1765,10 +1809,8 @@ gf100_gr_ctor_fw(struct gf100_gr *gr, const char *fwname,
        int ret;
 
        ret = nvkm_firmware_get(device, fwname, &fw);
-       if (ret) {
-               nvkm_error(subdev, "failed to load %s\n", fwname);
-               return ret;
-       }
+       if (ret)
+               return gf100_gr_ctor_fw_legacy(gr, fwname, fuc, ret);
 
        fuc->size = fw->size;
        fuc->data = kmemdup(fw->data, fuc->size, GFP_KERNEL);
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h 
b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h
index 212800ecdce9..7d1d3c6b4b72 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h
@@ -12,6 +12,7 @@ struct nvbios_source {
        bool rw;
        bool ignore_checksum;
        bool no_pcir;
+       bool require_checksum;
 };
 
 int nvbios_extend(struct nvkm_bios *, u32 length);
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c 
b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
index b2557e87afdd..7deb81b6dbac 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
@@ -86,9 +86,12 @@ shadow_image(struct nvkm_bios *bios, int idx, u32 offset, 
struct shadow *mthd)
                    nvbios_checksum(&bios->data[image.base], image.size)) {
                        nvkm_debug(subdev, "%08x: checksum failed\n",
                                   image.base);
-                       if (mthd->func->rw)
+                       if (!mthd->func->require_checksum) {
+                               if (mthd->func->rw)
+                                       score += 1;
                                score += 1;
-                       score += 1;
+                       } else
+                               return 0;
                } else {
                        score += 3;
                }
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c 
b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c
index 8fecb5ff22a0..06572f8ce914 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c
@@ -99,6 +99,7 @@ nvbios_acpi_fast = {
        .init = acpi_init,
        .read = acpi_read_fast,
        .rw = false,
+       .require_checksum = true,
 };
 
 const struct nvbios_source
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c 
b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c
index 39c2a38e54f7..0c7ef250dcaf 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c
@@ -47,8 +47,10 @@ nvkm_ltc_tags_clear(struct nvkm_ltc *ltc, u32 first, u32 
count)
 
        BUG_ON((first > limit) || (limit >= ltc->num_tags));
 
+       mutex_lock(&ltc->subdev.mutex);
        ltc->func->cbc_clear(ltc, first, limit);
        ltc->func->cbc_wait(ltc);
+       mutex_unlock(&ltc->subdev.mutex);
 }
 
 int
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c 
b/drivers/gpu/drm/radeon/radeon_cursor.c
index 2a10e24b34b1..87a72476d313 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -90,6 +90,9 @@ static void radeon_show_cursor(struct drm_crtc *crtc)
        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
        struct radeon_device *rdev = crtc->dev->dev_private;
 
+       if (radeon_crtc->cursor_out_of_bounds)
+               return;
+
        if (ASIC_IS_DCE4(rdev)) {
                WREG32(EVERGREEN_CUR_SURFACE_ADDRESS_HIGH + 
radeon_crtc->crtc_offset,
                       upper_32_bits(radeon_crtc->cursor_addr));
@@ -148,16 +151,17 @@ static int radeon_cursor_move_locked(struct drm_crtc 
*crtc, int x, int y)
                x += crtc->x;
                y += crtc->y;
        }
-       DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
 
-       if (x < 0) {
+       if (x < 0)
                xorigin = min(-x, radeon_crtc->max_cursor_width - 1);
-               x = 0;
-       }
-       if (y < 0) {
+       if (y < 0)
                yorigin = min(-y, radeon_crtc->max_cursor_height - 1);
-               y = 0;
+
+       if (!ASIC_IS_AVIVO(rdev)) {
+               x += crtc->x;
+               y += crtc->y;
        }
+       DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
 
        /* fixed on DCE6 and newer */
        if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE6(rdev)) {
@@ -180,27 +184,31 @@ static int radeon_cursor_move_locked(struct drm_crtc 
*crtc, int x, int y)
                if (i > 1) {
                        int cursor_end, frame_end;
 
-                       cursor_end = x - xorigin + w;
+                       cursor_end = x + w;
                        frame_end = crtc->x + crtc->mode.crtc_hdisplay;
                        if (cursor_end >= frame_end) {
                                w = w - (cursor_end - frame_end);
                                if (!(frame_end & 0x7f))
                                        w--;
-                       } else {
-                               if (!(cursor_end & 0x7f))
-                                       w--;
+                       } else if (cursor_end <= 0) {
+                               goto out_of_bounds;
+                       } else if (!(cursor_end & 0x7f)) {
+                               w--;
                        }
                        if (w <= 0) {
-                               w = 1;
-                               cursor_end = x - xorigin + w;
-                               if (!(cursor_end & 0x7f)) {
-                                       x--;
-                                       WARN_ON_ONCE(x < 0);
-                               }
+                               goto out_of_bounds;
                        }
                }
        }
 
+       if (x <= (crtc->x - w) || y <= (crtc->y - radeon_crtc->cursor_height) ||
+           x >= (crtc->x + crtc->mode.crtc_hdisplay) ||
+           y >= (crtc->y + crtc->mode.crtc_vdisplay))
+               goto out_of_bounds;
+
+       x += xorigin;
+       y += yorigin;
+
        if (ASIC_IS_DCE4(rdev)) {
                WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset, (x << 
16) | y);
                WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, 
(xorigin << 16) | yorigin);
@@ -212,6 +220,9 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, 
int x, int y)
                WREG32(AVIVO_D1CUR_SIZE + radeon_crtc->crtc_offset,
                       ((w - 1) << 16) | (radeon_crtc->cursor_height - 1));
        } else {
+               x -= crtc->x;
+               y -= crtc->y;
+
                if (crtc->mode.flags & DRM_MODE_FLAG_DBLSCAN)
                        y *= 2;
 
@@ -232,6 +243,19 @@ static int radeon_cursor_move_locked(struct drm_crtc 
*crtc, int x, int y)
        radeon_crtc->cursor_x = x;
        radeon_crtc->cursor_y = y;
 
+       if (radeon_crtc->cursor_out_of_bounds) {
+               radeon_crtc->cursor_out_of_bounds = false;
+               if (radeon_crtc->cursor_bo)
+                       radeon_show_cursor(crtc);
+       }
+
+       return 0;
+
+ out_of_bounds:
+       if (!radeon_crtc->cursor_out_of_bounds) {
+               radeon_hide_cursor(crtc);
+               radeon_crtc->cursor_out_of_bounds = true;
+       }
        return 0;
 }
 
@@ -297,22 +321,23 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
                return ret;
        }
 
-       radeon_crtc->cursor_width = width;
-       radeon_crtc->cursor_height = height;
-
        radeon_lock_cursor(crtc, true);
 
-       if (hot_x != radeon_crtc->cursor_hot_x ||
+       if (width != radeon_crtc->cursor_width ||
+           height != radeon_crtc->cursor_height ||
+           hot_x != radeon_crtc->cursor_hot_x ||
            hot_y != radeon_crtc->cursor_hot_y) {
                int x, y;
 
                x = radeon_crtc->cursor_x + radeon_crtc->cursor_hot_x - hot_x;
                y = radeon_crtc->cursor_y + radeon_crtc->cursor_hot_y - hot_y;
 
-               radeon_cursor_move_locked(crtc, x, y);
-
+               radeon_crtc->cursor_width = width;
+               radeon_crtc->cursor_height = height;
                radeon_crtc->cursor_hot_x = hot_x;
                radeon_crtc->cursor_hot_y = hot_y;
+
+               radeon_cursor_move_locked(crtc, x, y);
        }
 
        radeon_show_cursor(crtc);
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h 
b/drivers/gpu/drm/radeon/radeon_mode.h
index bb75201a24ba..f1da484864a9 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -330,6 +330,7 @@ struct radeon_crtc {
        u16 lut_r[256], lut_g[256], lut_b[256];
        bool enabled;
        bool can_tile;
+       bool cursor_out_of_bounds;
        uint32_t crtc_offset;
        struct drm_gem_object *cursor_bo;
        uint64_t cursor_addr;
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 2523ca96c6c7..2297ec7954af 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -1722,6 +1722,7 @@ static int si_init_microcode(struct radeon_device *rdev)
                    (rdev->pdev->revision == 0x80) ||
                    (rdev->pdev->revision == 0x81) ||
                    (rdev->pdev->revision == 0x83) ||
+                   (rdev->pdev->revision == 0x87) ||
                    (rdev->pdev->device == 0x6604) ||
                    (rdev->pdev->device == 0x6605))
                        new_smc = true;
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index c49934527a87..8b5e697f2549 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -3026,6 +3026,7 @@ static void si_apply_state_adjust_rules(struct 
radeon_device *rdev,
                    (rdev->pdev->revision == 0x80) ||
                    (rdev->pdev->revision == 0x81) ||
                    (rdev->pdev->revision == 0x83) ||
+                   (rdev->pdev->revision == 0x87) ||
                    (rdev->pdev->device == 0x6604) ||
                    (rdev->pdev->device == 0x6605)) {
                        max_sclk = 75000;
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index b6c1211b4df7..04508526f1d5 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -348,6 +348,7 @@ void vmbus_free_channels(void)
 {
        struct vmbus_channel *channel, *tmp;
 
+       mutex_lock(&vmbus_connection.channel_mutex);
        list_for_each_entry_safe(channel, tmp, &vmbus_connection.chn_list,
                listentry) {
                /* hv_process_channel_removal() needs this */
@@ -355,6 +356,7 @@ void vmbus_free_channels(void)
 
                vmbus_device_unregister(channel->device_obj);
        }
+       mutex_unlock(&vmbus_connection.channel_mutex);
 }
 
 /*
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 51f81d64ca37..a6ea387b5b00 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -361,7 +361,7 @@ static int stm_char_open(struct inode *inode, struct file 
*file)
        struct stm_file *stmf;
        struct device *dev;
        unsigned int major = imajor(inode);
-       int err = -ENODEV;
+       int err = -ENOMEM;
 
        dev = class_find_device(&stm_class, NULL, &major, major_match);
        if (!dev)
@@ -369,8 +369,9 @@ static int stm_char_open(struct inode *inode, struct file 
*file)
 
        stmf = kzalloc(sizeof(*stmf), GFP_KERNEL);
        if (!stmf)
-               return -ENOMEM;
+               goto err_put_device;
 
+       err = -ENODEV;
        stm_output_init(&stmf->output);
        stmf->stm = to_stm_device(dev);
 
@@ -382,9 +383,10 @@ static int stm_char_open(struct inode *inode, struct file 
*file)
        return nonseekable_open(inode, file);
 
 err_free:
+       kfree(stmf);
+err_put_device:
        /* matches class_find_device() above */
        put_device(dev);
-       kfree(stmf);
 
        return err;
 }
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 2d49228f28b2..85b2bfedd6be 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1746,7 +1746,7 @@ find_mad_agent(struct ib_mad_port_private *port_priv,
                        if (!class)
                                goto out;
                        if (convert_mgmt_class(mad_hdr->mgmt_class) >=
-                           IB_MGMT_MAX_METHODS)
+                           ARRAY_SIZE(class->method_table))
                                goto out;
                        method = class->method_table[convert_mgmt_class(
                                                        mad_hdr->mgmt_class)];
diff --git a/drivers/infiniband/core/multicast.c 
b/drivers/infiniband/core/multicast.c
index 51c79b2fb0b8..45523cf1b83b 100644
--- a/drivers/infiniband/core/multicast.c
+++ b/drivers/infiniband/core/multicast.c
@@ -518,8 +518,11 @@ static void join_handler(int status, struct 
ib_sa_mcmember_rec *rec,
                process_join_error(group, status);
        else {
                int mgids_changed, is_mgid0;
-               ib_find_pkey(group->port->dev->device, group->port->port_num,
-                            be16_to_cpu(rec->pkey), &pkey_index);
+
+               if (ib_find_pkey(group->port->dev->device,
+                                group->port->port_num, be16_to_cpu(rec->pkey),
+                                &pkey_index))
+                       pkey_index = MCAST_INVALID_PKEY_INDEX;
 
                spin_lock_irq(&group->port->lock);
                if (group->state == MCAST_BUSY &&
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c 
b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 6329c971c22f..4b892ca2b13a 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -2501,7 +2501,7 @@ static int i40iw_get_hw_stats(struct ib_device *ibdev,
                        return -ENOSYS;
        }
 
-       memcpy(&stats->value[0], &hw_stats, sizeof(*hw_stats));
+       memcpy(&stats->value[0], hw_stats, sizeof(*hw_stats));
 
        return stats->num_counters;
 }
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c 
b/drivers/infiniband/sw/rxe/rxe_qp.c
index f724a7ef9b67..979e445186cf 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -850,4 +850,5 @@ void rxe_qp_cleanup(void *arg)
        free_rd_atomic_resources(qp);
 
        kernel_sock_shutdown(qp->sk, SHUT_RDWR);
+       sock_release(qp->sk);
 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c 
b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 1909dd252c94..fddff403d5d2 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -575,8 +575,11 @@ void ipoib_mcast_join_task(struct work_struct *work)
        if (!test_bit(IPOIB_FLAG_OPER_UP, &priv->flags))
                return;
 
-       if (ib_query_port(priv->ca, priv->port, &port_attr) ||
-           port_attr.state != IB_PORT_ACTIVE) {
+       if (ib_query_port(priv->ca, priv->port, &port_attr)) {
+               ipoib_dbg(priv, "ib_query_port() failed\n");
+               return;
+       }
+       if (port_attr.state != IB_PORT_ACTIVE) {
                ipoib_dbg(priv, "port state is not ACTIVE (state = %d) 
suspending join task\n",
                          port_attr.state);
                return;
diff --git a/drivers/input/misc/drv260x.c b/drivers/input/misc/drv260x.c
index 2adfd86c869a..930424e55439 100644
--- a/drivers/input/misc/drv260x.c
+++ b/drivers/input/misc/drv260x.c
@@ -592,7 +592,6 @@ static int drv260x_probe(struct i2c_client *client,
        }
 
        haptics->input_dev->name = "drv260x:haptics";
-       haptics->input_dev->dev.parent = client->dev.parent;
        haptics->input_dev->close = drv260x_close;
        input_set_drvdata(haptics->input_dev, haptics);
        input_set_capability(haptics->input_dev, EV_FF, FF_RUMBLE);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index ee7fc3701700..a87549be8e53 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -7017,6 +7017,15 @@ static int raid5_run(struct mddev *mddev)
                        stripe = (stripe | (stripe-1)) + 1;
                mddev->queue->limits.discard_alignment = stripe;
                mddev->queue->limits.discard_granularity = stripe;
+
+               /*
+                * We use 16-bit counter of active stripes in bi_phys_segments
+                * (minus one for over-loaded initialization)
+                */
+               blk_queue_max_hw_sectors(mddev->queue, 0xfffe * STRIPE_SECTORS);
+               blk_queue_max_discard_sectors(mddev->queue,
+                                             0xfffe * STRIPE_SECTORS);
+
                /*
                 * unaligned part of discard request will be ignored, so can't
                 * guarantee discard_zeroes_data
diff --git a/drivers/media/dvb-frontends/mn88472.c 
b/drivers/media/dvb-frontends/mn88472.c
index 18fb2df1e2bd..72650116732c 100644
--- a/drivers/media/dvb-frontends/mn88472.c
+++ b/drivers/media/dvb-frontends/mn88472.c
@@ -488,18 +488,6 @@ static int mn88472_probe(struct i2c_client *client,
                goto err_kfree;
        }
 
-       /* Check demod answers with correct chip id */
-       ret = regmap_read(dev->regmap[0], 0xff, &utmp);
-       if (ret)
-               goto err_regmap_0_regmap_exit;
-
-       dev_dbg(&client->dev, "chip id=%02x\n", utmp);
-
-       if (utmp != 0x02) {
-               ret = -ENODEV;
-               goto err_regmap_0_regmap_exit;
-       }
-
        /*
         * Chip has three I2C addresses for different register banks. Used
         * addresses are 0x18, 0x1a and 0x1c. We register two dummy clients,
@@ -536,6 +524,18 @@ static int mn88472_probe(struct i2c_client *client,
        }
        i2c_set_clientdata(dev->client[2], dev);
 
+       /* Check demod answers with correct chip id */
+       ret = regmap_read(dev->regmap[2], 0xff, &utmp);
+       if (ret)
+               goto err_regmap_2_regmap_exit;
+
+       dev_dbg(&client->dev, "chip id=%02x\n", utmp);
+
+       if (utmp != 0x02) {
+               ret = -ENODEV;
+               goto err_regmap_2_regmap_exit;
+       }
+
        /* Sleep because chip is active by default */
        ret = regmap_write(dev->regmap[2], 0x05, 0x3e);
        if (ret)
diff --git a/drivers/media/dvb-frontends/mn88473.c 
b/drivers/media/dvb-frontends/mn88473.c
index 451974a1d7ed..2932bdc8fa94 100644
--- a/drivers/media/dvb-frontends/mn88473.c
+++ b/drivers/media/dvb-frontends/mn88473.c
@@ -485,18 +485,6 @@ static int mn88473_probe(struct i2c_client *client,
                goto err_kfree;
        }
 
-       /* Check demod answers with correct chip id */
-       ret = regmap_read(dev->regmap[0], 0xff, &uitmp);
-       if (ret)
-               goto err_regmap_0_regmap_exit;
-
-       dev_dbg(&client->dev, "chip id=%02x\n", uitmp);
-
-       if (uitmp != 0x03) {
-               ret = -ENODEV;
-               goto err_regmap_0_regmap_exit;
-       }
-
        /*
         * Chip has three I2C addresses for different register banks. Used
         * addresses are 0x18, 0x1a and 0x1c. We register two dummy clients,
@@ -533,6 +521,18 @@ static int mn88473_probe(struct i2c_client *client,
        }
        i2c_set_clientdata(dev->client[2], dev);
 
+       /* Check demod answers with correct chip id */
+       ret = regmap_read(dev->regmap[2], 0xff, &uitmp);
+       if (ret)
+               goto err_regmap_2_regmap_exit;
+
+       dev_dbg(&client->dev, "chip id=%02x\n", uitmp);
+
+       if (uitmp != 0x03) {
+               ret = -ENODEV;
+               goto err_regmap_2_regmap_exit;
+       }
+
        /* Sleep because chip is active by default */
        ret = regmap_write(dev->regmap[2], 0x05, 0x3e);
        if (ret)
diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
index 0b6d46c453bf..02a8f511443a 100644
--- a/drivers/media/i2c/tvp5150.c
+++ b/drivers/media/i2c/tvp5150.c
@@ -815,6 +815,7 @@ static int tvp5150_s_ctrl(struct v4l2_ctrl *ctrl)
                return 0;
        case V4L2_CID_HUE:
                tvp5150_write(sd, TVP5150_HUE_CTL, ctrl->val);
+               break;
        case V4L2_CID_TEST_PATTERN:
                decoder->enable = ctrl->val ? false : true;
                tvp5150_selmux(sd);
diff --git a/drivers/media/pci/solo6x10/solo6x10.h 
b/drivers/media/pci/solo6x10/solo6x10.h
index 5bd498735a66..3f8da5e8c430 100644
--- a/drivers/media/pci/solo6x10/solo6x10.h
+++ b/drivers/media/pci/solo6x10/solo6x10.h
@@ -284,7 +284,10 @@ static inline u32 solo_reg_read(struct solo_dev *solo_dev, 
int reg)
 static inline void solo_reg_write(struct solo_dev *solo_dev, int reg,
                                  u32 data)
 {
+       u16 val;
+
        writel(data, solo_dev->reg_base + reg);
+       pci_read_config_word(solo_dev->pdev, PCI_STATUS, &val);
 }
 
 static inline void solo_irq_on(struct solo_dev *dev, u32 mask)
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c 
b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index e3f104fafd0a..9e88c2f65333 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -1073,6 +1073,7 @@ static struct device *s5p_mfc_alloc_memdev(struct device 
*dev,
                                                         idx);
                if (ret == 0)
                        return child;
+               device_del(child);
        }
 
        put_device(child);
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 641c1a566687..75be3d5b2430 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -675,7 +675,7 @@ void mei_host_client_init(struct mei_device *dev)
 
        pm_runtime_mark_last_busy(dev->dev);
        dev_dbg(dev->dev, "rpm: autosuspend\n");
-       pm_runtime_autosuspend(dev->dev);
+       pm_request_autosuspend(dev->dev);
 }
 
 /**
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index 7ad15d678878..c8307e8b4c16 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -122,6 +122,8 @@
 #define MEI_DEV_ID_SPT_H      0xA13A  /* Sunrise Point H */
 #define MEI_DEV_ID_SPT_H_2    0xA13B  /* Sunrise Point H 2 */
 
+#define MEI_DEV_ID_LBG        0xA1BA  /* Lewisburg (SPT) */
+
 #define MEI_DEV_ID_BXT_M      0x1A9A  /* Broxton M */
 #define MEI_DEV_ID_APL_I      0x5A9A  /* Apollo Lake I */
 
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 5eb9b75ae9ec..69fca9b545df 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -87,6 +87,7 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)},
+       {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, mei_me_pch8_cfg)},
 
        {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 6eb8f0705c65..1f6205c959cd 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -2074,7 +2074,27 @@ static int sdhci_execute_tuning(struct mmc_host *mmc, 
u32 opcode)
                        ctrl &= ~SDHCI_CTRL_EXEC_TUNING;
                        sdhci_writew(host, ctrl, SDHCI_HOST_CONTROL2);
 
+                       sdhci_do_reset(host, SDHCI_RESET_CMD);
+                       sdhci_do_reset(host, SDHCI_RESET_DATA);
+
                        err = -EIO;
+
+                       if (cmd.opcode != MMC_SEND_TUNING_BLOCK_HS200)
+                               goto out;
+
+                       sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
+                       sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
+
+                       spin_unlock_irqrestore(&host->lock, flags);
+
+                       memset(&cmd, 0, sizeof(cmd));
+                       cmd.opcode = MMC_STOP_TRANSMISSION;
+                       cmd.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
+                       cmd.busy_timeout = 50;
+                       mmc_wait_for_cmd(mmc, &cmd, 0);
+
+                       spin_lock_irqsave(&host->lock, flags);
+
                        goto out;
                }
 
diff --git a/drivers/net/ethernet/marvell/mvpp2.c 
b/drivers/net/ethernet/marvell/mvpp2.c
index 60227a3452a4..5588c560ec61 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -770,6 +770,17 @@ struct mvpp2_rx_desc {
        u32 reserved8;
 };
 
+struct mvpp2_txq_pcpu_buf {
+       /* Transmitted SKB */
+       struct sk_buff *skb;
+
+       /* Physical address of transmitted buffer */
+       dma_addr_t phys;
+
+       /* Size transmitted */
+       size_t size;
+};
+
 /* Per-CPU Tx queue control */
 struct mvpp2_txq_pcpu {
        int cpu;
@@ -785,11 +796,8 @@ struct mvpp2_txq_pcpu {
        /* Number of Tx DMA descriptors reserved for each CPU */
        int reserved_num;
 
-       /* Array of transmitted skb */
-       struct sk_buff **tx_skb;
-
-       /* Array of transmitted buffers' physical addresses */
-       dma_addr_t *tx_buffs;
+       /* Infos about transmitted buffers */
+       struct mvpp2_txq_pcpu_buf *buffs;
 
        /* Index of last TX DMA descriptor that was inserted */
        int txq_put_index;
@@ -979,10 +987,11 @@ static void mvpp2_txq_inc_put(struct mvpp2_txq_pcpu 
*txq_pcpu,
                              struct sk_buff *skb,
                              struct mvpp2_tx_desc *tx_desc)
 {
-       txq_pcpu->tx_skb[txq_pcpu->txq_put_index] = skb;
-       if (skb)
-               txq_pcpu->tx_buffs[txq_pcpu->txq_put_index] =
-                                                        tx_desc->buf_phys_addr;
+       struct mvpp2_txq_pcpu_buf *tx_buf =
+               txq_pcpu->buffs + txq_pcpu->txq_put_index;
+       tx_buf->skb = skb;
+       tx_buf->size = tx_desc->data_size;
+       tx_buf->phys = tx_desc->buf_phys_addr;
        txq_pcpu->txq_put_index++;
        if (txq_pcpu->txq_put_index == txq_pcpu->size)
                txq_pcpu->txq_put_index = 0;
@@ -4401,17 +4410,16 @@ static void mvpp2_txq_bufs_free(struct mvpp2_port *port,
        int i;
 
        for (i = 0; i < num; i++) {
-               dma_addr_t buf_phys_addr =
-                                   txq_pcpu->tx_buffs[txq_pcpu->txq_get_index];
-               struct sk_buff *skb = txq_pcpu->tx_skb[txq_pcpu->txq_get_index];
+               struct mvpp2_txq_pcpu_buf *tx_buf =
+                       txq_pcpu->buffs + txq_pcpu->txq_get_index;
 
                mvpp2_txq_inc_get(txq_pcpu);
 
-               dma_unmap_single(port->dev->dev.parent, buf_phys_addr,
-                                skb_headlen(skb), DMA_TO_DEVICE);
-               if (!skb)
+               dma_unmap_single(port->dev->dev.parent, tx_buf->phys,
+                                tx_buf->size, DMA_TO_DEVICE);
+               if (!tx_buf->skb)
                        continue;
-               dev_kfree_skb_any(skb);
+               dev_kfree_skb_any(tx_buf->skb);
        }
 }
 
@@ -4651,15 +4659,10 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
        for_each_present_cpu(cpu) {
                txq_pcpu = per_cpu_ptr(txq->pcpu, cpu);
                txq_pcpu->size = txq->size;
-               txq_pcpu->tx_skb = kmalloc(txq_pcpu->size *
-                                          sizeof(*txq_pcpu->tx_skb),
-                                          GFP_KERNEL);
-               if (!txq_pcpu->tx_skb)
-                       goto error;
-
-               txq_pcpu->tx_buffs = kmalloc(txq_pcpu->size *
-                                            sizeof(dma_addr_t), GFP_KERNEL);
-               if (!txq_pcpu->tx_buffs)
+               txq_pcpu->buffs = kmalloc(txq_pcpu->size *
+                                         sizeof(struct mvpp2_txq_pcpu_buf),
+                                         GFP_KERNEL);
+               if (!txq_pcpu->buffs)
                        goto error;
 
                txq_pcpu->count = 0;
@@ -4673,8 +4676,7 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
 error:
        for_each_present_cpu(cpu) {
                txq_pcpu = per_cpu_ptr(txq->pcpu, cpu);
-               kfree(txq_pcpu->tx_skb);
-               kfree(txq_pcpu->tx_buffs);
+               kfree(txq_pcpu->buffs);
        }
 
        dma_free_coherent(port->dev->dev.parent,
@@ -4693,8 +4695,7 @@ static void mvpp2_txq_deinit(struct mvpp2_port *port,
 
        for_each_present_cpu(cpu) {
                txq_pcpu = per_cpu_ptr(txq->pcpu, cpu);
-               kfree(txq_pcpu->tx_skb);
-               kfree(txq_pcpu->tx_buffs);
+               kfree(txq_pcpu->buffs);
        }
 
        if (txq->descs)
diff --git a/drivers/net/wireless/ath/ath9k/hw.c 
b/drivers/net/wireless/ath/ath9k/hw.c
index 14b13f07cd1f..a35f78be8dec 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2792,7 +2792,7 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah, u32 gpio)
                WARN_ON(1);
        }
 
-       return val;
+       return !!val;
 }
 EXPORT_SYMBOL(ath9k_hw_gpio_get);
 
diff --git a/drivers/net/wireless/ath/ath9k/pci.c 
b/drivers/net/wireless/ath/ath9k/pci.c
index 0dd454acf22a..aff473dfa10d 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -26,7 +26,6 @@ static const struct pci_device_id ath_pci_id_table[] = {
        { PCI_VDEVICE(ATHEROS, 0x0023) }, /* PCI   */
        { PCI_VDEVICE(ATHEROS, 0x0024) }, /* PCI-E */
        { PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI   */
-       { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI   */
 
 #ifdef CONFIG_ATH9K_PCOEM
        /* Mini PCI AR9220 MB92 cards: Compex WLM200NX, Wistron DNMA-92 */
@@ -37,7 +36,7 @@ static const struct pci_device_id ath_pci_id_table[] = {
          .driver_data = ATH9K_PCI_LED_ACT_HI },
 #endif
 
-       { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
+       { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI   */
 
 #ifdef CONFIG_ATH9K_PCOEM
        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
@@ -85,7 +84,11 @@ static const struct pci_device_id ath_pci_id_table[] = {
                         0x10CF, /* Fujitsu */
                         0x1536),
          .driver_data = ATH9K_PCI_D3_L1_WAR },
+#endif
 
+       { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
+
+#ifdef CONFIG_ATH9K_PCOEM
        /* AR9285 card for Asus */
        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                         0x002B,
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c 
b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
index c6b246aa2419..4b7807902700 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
@@ -4401,6 +4401,13 @@ void rtl8xxxu_gen1_report_connect(struct rtl8xxxu_priv 
*priv,
 void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv,
                                  u8 macid, bool connect)
 {
+#ifdef RTL8XXXU_GEN2_REPORT_CONNECT
+       /*
+        * Barry Day reports this causes issues with 8192eu and 8723bu
+        * devices reconnecting. The reason for this is unclear, but
+        * until it is better understood, leave the code in place but
+        * disabled, so it is not lost.
+        */
        struct h2c_cmd h2c;
 
        memset(&h2c, 0, sizeof(struct h2c_cmd));
@@ -4412,6 +4419,7 @@ void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv 
*priv,
                h2c.media_status_rpt.parm &= ~BIT(0);
 
        rtl8xxxu_gen2_h2c_cmd(priv, &h2c, sizeof(h2c.media_status_rpt));
+#endif
 }
 
 void rtl8xxxu_gen1_init_aggregation(struct rtl8xxxu_priv *priv)
diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c 
b/drivers/net/wireless/realtek/rtlwifi/base.c
index 264466f59c57..4ac928bf1f8e 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.c
+++ b/drivers/net/wireless/realtek/rtlwifi/base.c
@@ -1303,12 +1303,13 @@ EXPORT_SYMBOL_GPL(rtl_action_proc);
 
 static void setup_arp_tx(struct rtl_priv *rtlpriv, struct rtl_ps_ctl *ppsc)
 {
+       struct ieee80211_hw *hw = rtlpriv->hw;
+
        rtlpriv->ra.is_special_data = true;
        if (rtlpriv->cfg->ops->get_btc_status())
                rtlpriv->btcoexist.btc_ops->btc_special_packet_notify(
                                        rtlpriv, 1);
-       rtlpriv->enter_ps = false;
-       schedule_work(&rtlpriv->works.lps_change_work);
+       rtl_lps_leave(hw);
        ppsc->last_delaylps_stamp_jiffies = jiffies;
 }
 
@@ -1381,8 +1382,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct 
sk_buff *skb, u8 is_tx,
 
                if (is_tx) {
                        rtlpriv->ra.is_special_data = true;
-                       rtlpriv->enter_ps = false;
-                       schedule_work(&rtlpriv->works.lps_change_work);
+                       rtl_lps_leave(hw);
                        ppsc->last_delaylps_stamp_jiffies = jiffies;
                }
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c 
b/drivers/net/wireless/realtek/rtlwifi/core.c
index 41f77f8a309e..8f783efac960 100644
--- a/drivers/net/wireless/realtek/rtlwifi/core.c
+++ b/drivers/net/wireless/realtek/rtlwifi/core.c
@@ -1149,10 +1149,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw 
*hw,
                } else {
                        mstatus = RT_MEDIA_DISCONNECT;
 
-                       if (mac->link_state == MAC80211_LINKED) {
-                               rtlpriv->enter_ps = false;
-                               schedule_work(&rtlpriv->works.lps_change_work);
-                       }
+                       if (mac->link_state == MAC80211_LINKED)
+                               rtl_lps_leave(hw);
                        if (ppsc->p2p_ps_info.p2p_ps_mode > P2P_PS_NONE)
                                rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE);
                        mac->link_state = MAC80211_NOLINK;
@@ -1430,8 +1428,7 @@ static void rtl_op_sw_scan_start(struct ieee80211_hw *hw,
        }
 
        if (mac->link_state == MAC80211_LINKED) {
-               rtlpriv->enter_ps = false;
-               schedule_work(&rtlpriv->works.lps_change_work);
+               rtl_lps_leave(hw);
                mac->link_state = MAC80211_LINKED_SCANNING;
        } else {
                rtl_ips_nic_on(hw);
diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c 
b/drivers/net/wireless/realtek/rtlwifi/pci.c
index d12586d4f845..e538e23baa9f 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -662,11 +662,9 @@ tx_status_ok:
        }
 
        if (((rtlpriv->link_info.num_rx_inperiod +
-               rtlpriv->link_info.num_tx_inperiod) > 8) ||
-               (rtlpriv->link_info.num_rx_inperiod > 2)) {
-               rtlpriv->enter_ps = false;
-               schedule_work(&rtlpriv->works.lps_change_work);
-       }
+             rtlpriv->link_info.num_tx_inperiod) > 8) ||
+             (rtlpriv->link_info.num_rx_inperiod > 2))
+               rtl_lps_leave(hw);
 }
 
 static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
@@ -917,10 +915,8 @@ new_trx_end:
                }
                if (((rtlpriv->link_info.num_rx_inperiod +
                      rtlpriv->link_info.num_tx_inperiod) > 8) ||
-                     (rtlpriv->link_info.num_rx_inperiod > 2)) {
-                       rtlpriv->enter_ps = false;
-                       schedule_work(&rtlpriv->works.lps_change_work);
-               }
+                     (rtlpriv->link_info.num_rx_inperiod > 2))
+                       rtl_lps_leave(hw);
                skb = new_skb;
 no_new:
                if (rtlpriv->use_new_trx_flow) {
diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c 
b/drivers/net/wireless/realtek/rtlwifi/ps.c
index 9a64f9b703e5..424e262939c9 100644
--- a/drivers/net/wireless/realtek/rtlwifi/ps.c
+++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
@@ -407,8 +407,8 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 
rt_psmode)
        }
 }
 
-/*Enter the leisure power save mode.*/
-void rtl_lps_enter(struct ieee80211_hw *hw)
+/* Interrupt safe routine to enter the leisure power save mode.*/
+static void rtl_lps_enter_core(struct ieee80211_hw *hw)
 {
        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
@@ -444,10 +444,9 @@ void rtl_lps_enter(struct ieee80211_hw *hw)
 
        spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
 }
-EXPORT_SYMBOL(rtl_lps_enter);
 
-/*Leave the leisure power save mode.*/
-void rtl_lps_leave(struct ieee80211_hw *hw)
+/* Interrupt safe routine to leave the leisure power save mode.*/
+static void rtl_lps_leave_core(struct ieee80211_hw *hw)
 {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
@@ -477,7 +476,6 @@ void rtl_lps_leave(struct ieee80211_hw *hw)
        }
        spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
 }
-EXPORT_SYMBOL(rtl_lps_leave);
 
 /* For sw LPS*/
 void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
@@ -670,12 +668,34 @@ void rtl_lps_change_work_callback(struct work_struct 
*work)
        struct rtl_priv *rtlpriv = rtl_priv(hw);
 
        if (rtlpriv->enter_ps)
-               rtl_lps_enter(hw);
+               rtl_lps_enter_core(hw);
        else
-               rtl_lps_leave(hw);
+               rtl_lps_leave_core(hw);
 }
 EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback);
 
+void rtl_lps_enter(struct ieee80211_hw *hw)
+{
+       struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+       if (!in_interrupt())
+               return rtl_lps_enter_core(hw);
+       rtlpriv->enter_ps = true;
+       schedule_work(&rtlpriv->works.lps_change_work);
+}
+EXPORT_SYMBOL_GPL(rtl_lps_enter);
+
+void rtl_lps_leave(struct ieee80211_hw *hw)
+{
+       struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+       if (!in_interrupt())
+               return rtl_lps_leave_core(hw);
+       rtlpriv->enter_ps = false;
+       schedule_work(&rtlpriv->works.lps_change_work);
+}
+EXPORT_SYMBOL_GPL(rtl_lps_leave);
+
 void rtl_swlps_wq_callback(void *data)
 {
        struct rtl_works *rtlworks = container_of_dwork_rtl(data,
diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
index cea8350fbc7e..a2ac9e641aa9 100644
--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -108,7 +108,7 @@ static ssize_t align_show(struct device *dev,
 {
        struct nd_pfn *nd_pfn = to_nd_pfn_safe(dev);
 
-       return sprintf(buf, "%lx\n", nd_pfn->align);
+       return sprintf(buf, "%ld\n", nd_pfn->align);
 }
 
 static ssize_t __align_store(struct nd_pfn *nd_pfn, const char *buf)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index aab9d5115a5f..24db77ea5093 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2064,6 +2064,10 @@ bool pci_dev_run_wake(struct pci_dev *dev)
        if (!dev->pme_support)
                return false;
 
+       /* PME-capable in principle, but not from the intended sleep state */
+       if (!pci_pme_capable(dev, pci_target_state(dev)))
+               return false;
+
        while (bus->parent) {
                struct pci_dev *bridge = bus->self;
 
diff --git a/drivers/platform/x86/asus-nb-wmi.c 
b/drivers/platform/x86/asus-nb-wmi.c
index adecc1c555f0..c4ed3e53c0ea 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -137,6 +137,15 @@ static const struct dmi_system_id asus_quirks[] = {
        },
        {
                .callback = dmi_matched,
+               .ident = "ASUSTeK COMPUTER INC. X45U",
+               .matches = {
+                       DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                       DMI_MATCH(DMI_PRODUCT_NAME, "X45U"),
+               },
+               .driver_data = &quirk_asus_wapf4,
+       },
+       {
+               .callback = dmi_matched,
                .ident = "ASUSTeK COMPUTER INC. X456UA",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
diff --git a/drivers/regulator/stw481x-vmmc.c b/drivers/regulator/stw481x-vmmc.c
index 7d2ae3e9e942..342f5da79975 100644
--- a/drivers/regulator/stw481x-vmmc.c
+++ b/drivers/regulator/stw481x-vmmc.c
@@ -47,7 +47,8 @@ static struct regulator_desc vmmc_regulator = {
        .volt_table = stw481x_vmmc_voltages,
        .enable_time = 200, /* FIXME: look this up */
        .enable_reg = STW_CONF1,
-       .enable_mask = STW_CONF1_PDN_VMMC,
+       .enable_mask = STW_CONF1_PDN_VMMC | STW_CONF1_MMC_LS_STATUS,
+       .enable_val = STW_CONF1_PDN_VMMC,
        .vsel_reg = STW_CONF1,
        .vsel_mask = STW_CONF1_VMMC_MASK,
 };
diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c
index e883063c7258..3167e8581994 100644
--- a/drivers/s390/char/vmlogrdr.c
+++ b/drivers/s390/char/vmlogrdr.c
@@ -870,7 +870,7 @@ static int __init vmlogrdr_init(void)
                goto cleanup;
 
        for (i=0; i < MAXMINOR; ++i ) {
-               sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL);
+               sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL | 
GFP_DMA);
                if (!sys_ser[i].buffer) {
                        rc = -ENOMEM;
                        break;
diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
index 581001989937..d5bf36ec8a75 100644
--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -289,11 +289,12 @@ void zfcp_dbf_rec_trig(char *tag, struct zfcp_adapter 
*adapter,
 
 
 /**
- * zfcp_dbf_rec_run - trace event related to running recovery
+ * zfcp_dbf_rec_run_lvl - trace event related to running recovery
+ * @level: trace level to be used for event
  * @tag: identifier for event
  * @erp: erp_action running
  */
-void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
+void zfcp_dbf_rec_run_lvl(int level, char *tag, struct zfcp_erp_action *erp)
 {
        struct zfcp_dbf *dbf = erp->adapter->dbf;
        struct zfcp_dbf_rec *rec = &dbf->rec_buf;
@@ -319,11 +320,21 @@ void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action 
*erp)
        else
                rec->u.run.rec_count = atomic_read(&erp->adapter->erp_counter);
 
-       debug_event(dbf->rec, 1, rec, sizeof(*rec));
+       debug_event(dbf->rec, level, rec, sizeof(*rec));
        spin_unlock_irqrestore(&dbf->rec_lock, flags);
 }
 
 /**
+ * zfcp_dbf_rec_run - trace event related to running recovery
+ * @tag: identifier for event
+ * @erp: erp_action running
+ */
+void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
+{
+       zfcp_dbf_rec_run_lvl(1, tag, erp);
+}
+
+/**
  * zfcp_dbf_rec_run_wka - trace wka port event with info like running recovery
  * @tag: identifier for event
  * @wka_port: well known address port
diff --git a/drivers/s390/scsi/zfcp_dbf.h b/drivers/s390/scsi/zfcp_dbf.h
index 36d07584271d..db186d44cfaf 100644
--- a/drivers/s390/scsi/zfcp_dbf.h
+++ b/drivers/s390/scsi/zfcp_dbf.h
@@ -2,7 +2,7 @@
  * zfcp device driver
  * debug feature declarations
  *
- * Copyright IBM Corp. 2008, 2015
+ * Copyright IBM Corp. 2008, 2016
  */
 
 #ifndef ZFCP_DBF_H
@@ -283,6 +283,30 @@ struct zfcp_dbf {
        struct zfcp_dbf_scsi            scsi_buf;
 };
 
+/**
+ * zfcp_dbf_hba_fsf_resp_suppress - true if we should not trace by default
+ * @req: request that has been completed
+ *
+ * Returns true if FCP response with only benign residual under count.
+ */
+static inline
+bool zfcp_dbf_hba_fsf_resp_suppress(struct zfcp_fsf_req *req)
+{
+       struct fsf_qtcb *qtcb = req->qtcb;
+       u32 fsf_stat = qtcb->header.fsf_status;
+       struct fcp_resp *fcp_rsp;
+       u8 rsp_flags, fr_status;
+
+       if (qtcb->prefix.qtcb_type != FSF_IO_COMMAND)
+               return false; /* not an FCP response */
+       fcp_rsp = (struct fcp_resp *)&qtcb->bottom.io.fcp_rsp;
+       rsp_flags = fcp_rsp->fr_flags;
+       fr_status = fcp_rsp->fr_status;
+       return (fsf_stat == FSF_FCP_RSP_AVAILABLE) &&
+               (rsp_flags == FCP_RESID_UNDER) &&
+               (fr_status == SAM_STAT_GOOD);
+}
+
 static inline
 void zfcp_dbf_hba_fsf_resp(char *tag, int level, struct zfcp_fsf_req *req)
 {
@@ -304,7 +328,9 @@ void zfcp_dbf_hba_fsf_response(struct zfcp_fsf_req *req)
                zfcp_dbf_hba_fsf_resp("fs_perr", 1, req);
 
        } else if (qtcb->header.fsf_status != FSF_GOOD) {
-               zfcp_dbf_hba_fsf_resp("fs_ferr", 1, req);
+               zfcp_dbf_hba_fsf_resp("fs_ferr",
+                                     zfcp_dbf_hba_fsf_resp_suppress(req)
+                                     ? 5 : 1, req);
 
        } else if ((req->fsf_command == FSF_QTCB_OPEN_PORT_WITH_DID) ||
                   (req->fsf_command == FSF_QTCB_OPEN_LUN)) {
@@ -388,4 +414,15 @@ void zfcp_dbf_scsi_devreset(char *tag, struct scsi_cmnd 
*scmnd, u8 flag)
        _zfcp_dbf_scsi(tmp_tag, 1, scmnd, NULL);
 }
 
+/**
+ * zfcp_dbf_scsi_nullcmnd() - trace NULLify of SCSI command in dev/tgt-reset.
+ * @scmnd: SCSI command that was NULLified.
+ * @fsf_req: request that owned @scmnd.
+ */
+static inline void zfcp_dbf_scsi_nullcmnd(struct scsi_cmnd *scmnd,
+                                         struct zfcp_fsf_req *fsf_req)
+{
+       _zfcp_dbf_scsi("scfc__1", 3, scmnd, fsf_req);
+}
+
 #endif /* ZFCP_DBF_H */
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index a59d678125bd..7ccfce559034 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -3,7 +3,7 @@
  *
  * Error Recovery Procedures (ERP).
  *
- * Copyright IBM Corp. 2002, 2015
+ * Copyright IBM Corp. 2002, 2016
  */
 
 #define KMSG_COMPONENT "zfcp"
@@ -1204,6 +1204,62 @@ static void zfcp_erp_action_dequeue(struct 
zfcp_erp_action *erp_action)
        }
 }
 
+/**
+ * zfcp_erp_try_rport_unblock - unblock rport if no more/new recovery
+ * @port: zfcp_port whose fc_rport we should try to unblock
+ */
+static void zfcp_erp_try_rport_unblock(struct zfcp_port *port)
+{
+       unsigned long flags;
+       struct zfcp_adapter *adapter = port->adapter;
+       int port_status;
+       struct Scsi_Host *shost = adapter->scsi_host;
+       struct scsi_device *sdev;
+
+       write_lock_irqsave(&adapter->erp_lock, flags);
+       port_status = atomic_read(&port->status);
+       if ((port_status & ZFCP_STATUS_COMMON_UNBLOCKED)    == 0 ||
+           (port_status & (ZFCP_STATUS_COMMON_ERP_INUSE |
+                           ZFCP_STATUS_COMMON_ERP_FAILED)) != 0) {
+               /* new ERP of severity >= port triggered elsewhere meanwhile or
+                * local link down (adapter erp_failed but not clear unblock)
+                */
+               zfcp_dbf_rec_run_lvl(4, "ertru_p", &port->erp_action);
+               write_unlock_irqrestore(&adapter->erp_lock, flags);
+               return;
+       }
+       spin_lock(shost->host_lock);
+       __shost_for_each_device(sdev, shost) {
+               struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev);
+               int lun_status;
+
+               if (zsdev->port != port)
+                       continue;
+               /* LUN under port of interest */
+               lun_status = atomic_read(&zsdev->status);
+               if ((lun_status & ZFCP_STATUS_COMMON_ERP_FAILED) != 0)
+                       continue; /* unblock rport despite failed LUNs */
+               /* LUN recovery not given up yet [maybe follow-up pending] */
+               if ((lun_status & ZFCP_STATUS_COMMON_UNBLOCKED) == 0 ||
+                   (lun_status & ZFCP_STATUS_COMMON_ERP_INUSE) != 0) {
+                       /* LUN blocked:
+                        * not yet unblocked [LUN recovery pending]
+                        * or meanwhile blocked [new LUN recovery triggered]
+                        */
+                       zfcp_dbf_rec_run_lvl(4, "ertru_l", &zsdev->erp_action);
+                       spin_unlock(shost->host_lock);
+                       write_unlock_irqrestore(&adapter->erp_lock, flags);
+                       return;
+               }
+       }
+       /* now port has no child or all children have completed recovery,
+        * and no ERP of severity >= port was meanwhile triggered elsewhere
+        */
+       zfcp_scsi_schedule_rport_register(port);
+       spin_unlock(shost->host_lock);
+       write_unlock_irqrestore(&adapter->erp_lock, flags);
+}
+
 static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
 {
        struct zfcp_adapter *adapter = act->adapter;
@@ -1214,6 +1270,7 @@ static void zfcp_erp_action_cleanup(struct 
zfcp_erp_action *act, int result)
        case ZFCP_ERP_ACTION_REOPEN_LUN:
                if (!(act->status & ZFCP_STATUS_ERP_NO_REF))
                        scsi_device_put(sdev);
+               zfcp_erp_try_rport_unblock(port);
                break;
 
        case ZFCP_ERP_ACTION_REOPEN_PORT:
@@ -1224,7 +1281,7 @@ static void zfcp_erp_action_cleanup(struct 
zfcp_erp_action *act, int result)
                 */
                if (act->step != ZFCP_ERP_STEP_UNINITIALIZED)
                        if (result == ZFCP_ERP_SUCCEEDED)
-                               zfcp_scsi_schedule_rport_register(port);
+                               zfcp_erp_try_rport_unblock(port);
                /* fall through */
        case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
                put_device(&port->dev);
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index c8fed9fa1cca..21c8c689b02b 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -3,7 +3,7 @@
  *
  * External function declarations.
  *
- * Copyright IBM Corp. 2002, 2015
+ * Copyright IBM Corp. 2002, 2016
  */
 
 #ifndef ZFCP_EXT_H
@@ -35,6 +35,8 @@ extern void zfcp_dbf_adapter_unregister(struct zfcp_adapter 
*);
 extern void zfcp_dbf_rec_trig(char *, struct zfcp_adapter *,
                              struct zfcp_port *, struct scsi_device *, u8, u8);
 extern void zfcp_dbf_rec_run(char *, struct zfcp_erp_action *);
+extern void zfcp_dbf_rec_run_lvl(int level, char *tag,
+                                struct zfcp_erp_action *erp);
 extern void zfcp_dbf_rec_run_wka(char *, struct zfcp_fc_wka_port *, u64);
 extern void zfcp_dbf_hba_fsf_uss(char *, struct zfcp_fsf_req *);
 extern void zfcp_dbf_hba_fsf_res(char *, int, struct zfcp_fsf_req *);
diff --git a/drivers/s390/scsi/zfcp_fsf.h b/drivers/s390/scsi/zfcp_fsf.h
index be1c04b334c5..ea3c76ac0de1 100644
--- a/drivers/s390/scsi/zfcp_fsf.h
+++ b/drivers/s390/scsi/zfcp_fsf.h
@@ -3,7 +3,7 @@
  *
  * Interface to the FSF support functions.
  *
- * Copyright IBM Corp. 2002, 2015
+ * Copyright IBM Corp. 2002, 2016
  */
 
 #ifndef FSF_H
@@ -78,6 +78,7 @@
 #define FSF_APP_TAG_CHECK_FAILURE              0x00000082
 #define FSF_REF_TAG_CHECK_FAILURE              0x00000083
 #define FSF_ADAPTER_STATUS_AVAILABLE           0x000000AD
+#define FSF_FCP_RSP_AVAILABLE                  0x000000AF
 #define FSF_UNKNOWN_COMMAND                    0x000000E2
 #define FSF_UNKNOWN_OP_SUBTYPE                  0x000000E3
 #define FSF_INVALID_COMMAND_OPTION              0x000000E5
diff --git a/drivers/s390/scsi/zfcp_reqlist.h b/drivers/s390/scsi/zfcp_reqlist.h
index 7c2c6194dfca..703fce59befe 100644
--- a/drivers/s390/scsi/zfcp_reqlist.h
+++ b/drivers/s390/scsi/zfcp_reqlist.h
@@ -4,7 +4,7 @@
  * Data structure and helper functions for tracking pending FSF
  * requests.
  *
- * Copyright IBM Corp. 2009
+ * Copyright IBM Corp. 2009, 2016
  */
 
 #ifndef ZFCP_REQLIST_H
@@ -180,4 +180,32 @@ static inline void zfcp_reqlist_move(struct zfcp_reqlist 
*rl,
        spin_unlock_irqrestore(&rl->lock, flags);
 }
 
+/**
+ * zfcp_reqlist_apply_for_all() - apply a function to every request.
+ * @rl: the requestlist that contains the target requests.
+ * @f: the function to apply to each request; the first parameter of the
+ *     function will be the target-request; the second parameter is the same
+ *     pointer as given with the argument @data.
+ * @data: freely chosen argument; passed through to @f as second parameter.
+ *
+ * Uses :c:macro:`list_for_each_entry` to iterate over the lists in the hash-
+ * table (not a 'safe' variant, so don't modify the list).
+ *
+ * Holds @rl->lock over the entire request-iteration.
+ */
+static inline void
+zfcp_reqlist_apply_for_all(struct zfcp_reqlist *rl,
+                          void (*f)(struct zfcp_fsf_req *, void *), void *data)
+{
+       struct zfcp_fsf_req *req;
+       unsigned long flags;
+       unsigned int i;
+
+       spin_lock_irqsave(&rl->lock, flags);
+       for (i = 0; i < ZFCP_REQ_LIST_BUCKETS; i++)
+               list_for_each_entry(req, &rl->buckets[i], list)
+                       f(req, data);
+       spin_unlock_irqrestore(&rl->lock, flags);
+}
+
 #endif /* ZFCP_REQLIST_H */
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 9069f98a1817..07ffdbb5107f 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -3,7 +3,7 @@
  *
  * Interface to Linux SCSI midlayer.
  *
- * Copyright IBM Corp. 2002, 2015
+ * Copyright IBM Corp. 2002, 2016
  */
 
 #define KMSG_COMPONENT "zfcp"
@@ -88,9 +88,7 @@ int zfcp_scsi_queuecommand(struct Scsi_Host *shost, struct 
scsi_cmnd *scpnt)
        }
 
        if (unlikely(!(status & ZFCP_STATUS_COMMON_UNBLOCKED))) {
-               /* This could be either
-                * open LUN pending: this is temporary, will result in
-                *      open LUN or ERP_FAILED, so retry command
+               /* This could be
                 * call to rport_delete pending: mimic retry from
                 *      fc_remote_port_chkready until rport is BLOCKED
                 */
@@ -209,6 +207,57 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd 
*scpnt)
        return retval;
 }
 
+struct zfcp_scsi_req_filter {
+       u8 tmf_scope;
+       u32 lun_handle;
+       u32 port_handle;
+};
+
+static void zfcp_scsi_forget_cmnd(struct zfcp_fsf_req *old_req, void *data)
+{
+       struct zfcp_scsi_req_filter *filter =
+               (struct zfcp_scsi_req_filter *)data;
+
+       /* already aborted - prevent side-effects - or not a SCSI command */
+       if (old_req->data == NULL || old_req->fsf_command != FSF_QTCB_FCP_CMND)
+               return;
+
+       /* (tmf_scope == FCP_TMF_TGT_RESET || tmf_scope == FCP_TMF_LUN_RESET) */
+       if (old_req->qtcb->header.port_handle != filter->port_handle)
+               return;
+
+       if (filter->tmf_scope == FCP_TMF_LUN_RESET &&
+           old_req->qtcb->header.lun_handle != filter->lun_handle)
+               return;
+
+       zfcp_dbf_scsi_nullcmnd((struct scsi_cmnd *)old_req->data, old_req);
+       old_req->data = NULL;
+}
+
+static void zfcp_scsi_forget_cmnds(struct zfcp_scsi_dev *zsdev, u8 tm_flags)
+{
+       struct zfcp_adapter *adapter = zsdev->port->adapter;
+       struct zfcp_scsi_req_filter filter = {
+               .tmf_scope = FCP_TMF_TGT_RESET,
+               .port_handle = zsdev->port->handle,
+       };
+       unsigned long flags;
+
+       if (tm_flags == FCP_TMF_LUN_RESET) {
+               filter.tmf_scope = FCP_TMF_LUN_RESET;
+               filter.lun_handle = zsdev->lun_handle;
+       }
+
+       /*
+        * abort_lock secures against other processings - in the abort-function
+        * and normal cmnd-handler - of (struct zfcp_fsf_req *)->data
+        */
+       write_lock_irqsave(&adapter->abort_lock, flags);
+       zfcp_reqlist_apply_for_all(adapter->req_list, zfcp_scsi_forget_cmnd,
+                                  &filter);
+       write_unlock_irqrestore(&adapter->abort_lock, flags);
+}
+
 static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags)
 {
        struct zfcp_scsi_dev *zfcp_sdev = sdev_to_zfcp(scpnt->device);
@@ -241,8 +290,10 @@ static int zfcp_task_mgmt_function(struct scsi_cmnd 
*scpnt, u8 tm_flags)
        if (fsf_req->status & ZFCP_STATUS_FSFREQ_TMFUNCFAILED) {
                zfcp_dbf_scsi_devreset("fail", scpnt, tm_flags);
                retval = FAILED;
-       } else
+       } else {
                zfcp_dbf_scsi_devreset("okay", scpnt, tm_flags);
+               zfcp_scsi_forget_cmnds(zfcp_sdev, tm_flags);
+       }
 
        zfcp_fsf_req_free(fsf_req);
        return retval;
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 79871f3519ff..d5b26fa541d3 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -160,7 +160,6 @@ static const struct pci_device_id aac_pci_tbl[] = {
        { 0x9005, 0x028b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 62 }, /* Adaptec PMC 
Series 6 (Tupelo) */
        { 0x9005, 0x028c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 63 }, /* Adaptec PMC 
Series 7 (Denali) */
        { 0x9005, 0x028d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 64 }, /* Adaptec PMC 
Series 8 */
-       { 0x9005, 0x028f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 65 }, /* Adaptec PMC 
Series 9 */
        { 0,}
 };
 MODULE_DEVICE_TABLE(pci, aac_pci_tbl);
@@ -239,7 +238,6 @@ static struct aac_driver_ident aac_drivers[] = {
        { aac_src_init, "aacraid", "ADAPTEC ", "RAID            ", 2, 
AAC_QUIRK_SRC }, /* Adaptec PMC Series 6 (Tupelo) */
        { aac_srcv_init, "aacraid", "ADAPTEC ", "RAID            ", 2, 
AAC_QUIRK_SRC }, /* Adaptec PMC Series 7 (Denali) */
        { aac_srcv_init, "aacraid", "ADAPTEC ", "RAID            ", 2, 
AAC_QUIRK_SRC }, /* Adaptec PMC Series 8 */
-       { aac_srcv_init, "aacraid", "ADAPTEC ", "RAID            ", 2, 
AAC_QUIRK_SRC } /* Adaptec PMC Series 9 */
 };
 
 /**
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c 
b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index 52d8bbf7feb5..bd04bd01d34a 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -2000,6 +2000,8 @@ megasas_build_syspd_fusion(struct megasas_instance 
*instance,
                io_request->DevHandle = pd_sync->seq[pd_index].devHandle;
                pRAID_Context->regLockFlags |=
                        
(MR_RL_FLAGS_SEQ_NUM_ENABLE|MR_RL_FLAGS_GRANT_DESTINATION_CUDA);
+               pRAID_Context->Type = MPI2_TYPE_CUDA;
+               pRAID_Context->nseg = 0x1;
        } else if (fusion->fast_path_io) {
                pRAID_Context->VirtualDiskTgtId = cpu_to_le16(device_id);
                pRAID_Context->configSeqNum = 0;
@@ -2035,12 +2037,10 @@ megasas_build_syspd_fusion(struct megasas_instance 
*instance,
                pRAID_Context->timeoutValue =
                        cpu_to_le16((os_timeout_value > timeout_limit) ?
                        timeout_limit : os_timeout_value);
-               if (fusion->adapter_type == INVADER_SERIES) {
-                       pRAID_Context->Type = MPI2_TYPE_CUDA;
-                       pRAID_Context->nseg = 0x1;
+               if (fusion->adapter_type == INVADER_SERIES)
                        io_request->IoFlags |=
                                
cpu_to_le16(MPI25_SAS_DEVICE0_FLAGS_ENABLED_FAST_PATH);
-               }
+
                cmd->request_desc->SCSIIO.RequestFlags =
                        (MPI2_REQ_DESCRIPT_FLAGS_FP_IO <<
                                MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
@@ -2823,6 +2823,7 @@ int megasas_wait_for_outstanding_fusion(struct 
megasas_instance *instance,
                dev_err(&instance->pdev->dev, "pending commands remain after 
waiting, "
                       "will reset adapter scsi%d.\n",
                       instance->host->host_no);
+               *convert = 1;
                retval = 1;
        }
 out:
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 07349270535d..82dfe07b1d47 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1204,10 +1204,6 @@ int scsi_sysfs_add_sdev(struct scsi_device *sdev)
        struct request_queue *rq = sdev->request_queue;
        struct scsi_target *starget = sdev->sdev_target;
 
-       error = scsi_device_set_state(sdev, SDEV_RUNNING);
-       if (error)
-               return error;
-
        error = scsi_target_add(starget);
        if (error)
                return error;
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index ae7d9bdf409c..a1c29b0afb22 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -592,6 +592,9 @@ sg_write(struct file *filp, const char __user *buf, size_t 
count, loff_t * ppos)
        sg_io_hdr_t *hp;
        unsigned char cmnd[SG_MAX_CDB_SIZE];
 
+       if (unlikely(segment_eq(get_fs(), KERNEL_DS)))
+               return -EINVAL;
+
        if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
                return -ENXIO;
        SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
index 0f28c08fcb3c..77b551da5728 100644
--- a/drivers/ssb/pci.c
+++ b/drivers/ssb/pci.c
@@ -909,6 +909,7 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
                        if (err) {
                                ssb_warn("WARNING: Using fallback SPROM failed 
(err %d)\n",
                                         err);
+                               goto out_free;
                        } else {
                                ssb_dbg("Using SPROM revision %d provided by 
platform\n",
                                        sprom->revision);
diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c 
b/drivers/staging/comedi/drivers/ni_mio_common.c
index 0f97d7b611d7..1c967c30e4ce 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -1832,7 +1832,7 @@ static int ni_ai_insn_read(struct comedi_device *dev,
                           unsigned int *data)
 {
        struct ni_private *devpriv = dev->private;
-       unsigned int mask = (s->maxdata + 1) >> 1;
+       unsigned int mask = s->maxdata;
        int i, n;
        unsigned int signbits;
        unsigned int d;
@@ -1875,7 +1875,7 @@ static int ni_ai_insn_read(struct comedi_device *dev,
                                return -ETIME;
                        }
                        d += signbits;
-                       data[n] = d;
+                       data[n] = d & 0xffff;
                }
        } else if (devpriv->is_6143) {
                for (n = 0; n < insn->n; n++) {
@@ -1924,9 +1924,8 @@ static int ni_ai_insn_read(struct comedi_device *dev,
                                data[n] = dl;
                        } else {
                                d = ni_readw(dev, NI_E_AI_FIFO_DATA_REG);
-                               /* subtle: needs to be short addition */
                                d += signbits;
-                               data[n] = d;
+                               data[n] = d & 0xffff;
                        }
                }
        }
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c 
b/drivers/target/iscsi/iscsi_target_configfs.c
index 923c032f0b95..e980e2d0c2db 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -100,8 +100,10 @@ static ssize_t lio_target_np_driver_store(struct 
config_item *item,
 
                tpg_np_new = iscsit_tpg_add_network_portal(tpg,
                                        &np->np_sockaddr, tpg_np, type);
-               if (IS_ERR(tpg_np_new))
+               if (IS_ERR(tpg_np_new)) {
+                       rc = PTR_ERR(tpg_np_new);
                        goto out;
+               }
        } else {
                tpg_np_new = iscsit_tpg_locate_child_np(tpg_np, type);
                if (tpg_np_new) {
diff --git a/drivers/target/target_core_user.c 
b/drivers/target/target_core_user.c
index 62bf4fe5704a..b8a986c2c567 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -682,8 +682,6 @@ static int tcmu_check_expired_cmd(int id, void *p, void 
*data)
        target_complete_cmd(cmd->se_cmd, SAM_STAT_CHECK_CONDITION);
        cmd->se_cmd = NULL;
 
-       kmem_cache_free(tcmu_cmd_cache, cmd);
-
        return 0;
 }
 
diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
index c41c7742903a..2dcd4194d103 100644
--- a/drivers/thermal/thermal_hwmon.c
+++ b/drivers/thermal/thermal_hwmon.c
@@ -98,7 +98,7 @@ temp_crit_show(struct device *dev, struct device_attribute 
*attr, char *buf)
        int temperature;
        int ret;
 
-       ret = tz->ops->get_trip_temp(tz, 0, &temperature);
+       ret = tz->ops->get_crit_temp(tz, &temperature);
        if (ret)
                return ret;
 
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index f36e6df2fa90..e086ea4d2997 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -1240,7 +1240,7 @@ static int sc16is7xx_probe(struct device *dev,
 
        /* Setup interrupt */
        ret = devm_request_irq(dev, irq, sc16is7xx_irq,
-                              IRQF_ONESHOT | flags, dev_name(dev), s);
+                              flags, dev_name(dev), s);
        if (!ret)
                return 0;
 
diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index 0f8caae4267d..ece10e6b731b 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -982,7 +982,7 @@ static void kbd_led_trigger_activate(struct led_classdev 
*cdev)
        KBD_LED_TRIGGER((_led_bit) + 8, _name)
 
 static struct kbd_led_trigger kbd_led_triggers[] = {
-       KBD_LED_TRIGGER(VC_SCROLLOCK, "kbd-scrollock"),
+       KBD_LED_TRIGGER(VC_SCROLLOCK, "kbd-scrolllock"),
        KBD_LED_TRIGGER(VC_NUMLOCK,   "kbd-numlock"),
        KBD_LED_TRIGGER(VC_CAPSLOCK,  "kbd-capslock"),
        KBD_LED_TRIGGER(VC_KANALOCK,  "kbd-kanalock"),
diff --git a/fs/block_dev.c b/fs/block_dev.c
index b010242bab32..496d99b80fb0 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1885,6 +1885,7 @@ void iterate_bdevs(void (*func)(struct block_device *, 
void *), void *arg)
        spin_lock(&blockdev_superblock->s_inode_list_lock);
        list_for_each_entry(inode, &blockdev_superblock->s_inodes, i_sb_list) {
                struct address_space *mapping = inode->i_mapping;
+               struct block_device *bdev;
 
                spin_lock(&inode->i_lock);
                if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW) ||
@@ -1905,8 +1906,12 @@ void iterate_bdevs(void (*func)(struct block_device *, 
void *), void *arg)
                 */
                iput(old_inode);
                old_inode = inode;
+               bdev = I_BDEV(inode);
 
-               func(I_BDEV(inode), arg);
+               mutex_lock(&bdev->bd_mutex);
+               if (bdev->bd_openers)
+                       func(bdev, arg);
+               mutex_unlock(&bdev->bd_mutex);
 
                spin_lock(&blockdev_superblock->s_inode_list_lock);
        }
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index ca699ddc11c1..e6a0d22315e9 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -397,7 +397,7 @@ static int nfs_write_end(struct file *file, struct 
address_space *mapping,
         */
        if (!PageUptodate(page)) {
                unsigned pglen = nfs_page_length(page);
-               unsigned end = offset + len;
+               unsigned end = offset + copied;
 
                if (pglen == 0) {
                        zero_user_segments(page, 0, offset,
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c 
b/fs/nfs/flexfilelayout/flexfilelayout.c
index 51b51369704c..dcc21f9e4bd1 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -28,6 +28,9 @@
 
 static struct group_info       *ff_zero_group;
 
+static void ff_layout_read_record_layoutstats_done(struct rpc_task *task,
+               struct nfs_pgio_header *hdr);
+
 static struct pnfs_layout_hdr *
 ff_layout_alloc_layout_hdr(struct inode *inode, gfp_t gfp_flags)
 {
@@ -1293,6 +1296,7 @@ static int ff_layout_read_done_cb(struct rpc_task *task,
                                        hdr->pgio_mirror_idx + 1,
                                        &hdr->pgio_mirror_idx))
                        goto out_eagain;
+               ff_layout_read_record_layoutstats_done(task, hdr);
                pnfs_read_resend_pnfs(hdr);
                return task->tk_status;
        case -NFS4ERR_RESET_TO_MDS:
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 2c93a85eda51..eb8edb3d52e1 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -252,6 +252,14 @@ pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo)
        }
 }
 
+static void
+pnfs_clear_layoutreturn_info(struct pnfs_layout_hdr *lo)
+{
+       lo->plh_return_iomode = 0;
+       lo->plh_return_seq = 0;
+       clear_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags);
+}
+
 /*
  * Mark a pnfs_layout_hdr and all associated layout segments as invalid
  *
@@ -270,6 +278,7 @@ pnfs_mark_layout_stateid_invalid(struct pnfs_layout_hdr *lo,
        };
 
        set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
+       pnfs_clear_layoutreturn_info(lo);
        return pnfs_mark_matching_lsegs_invalid(lo, lseg_list, &range, 0);
 }
 
@@ -364,7 +373,9 @@ pnfs_layout_remove_lseg(struct pnfs_layout_hdr *lo,
        list_del_init(&lseg->pls_list);
        /* Matched by pnfs_get_layout_hdr in pnfs_layout_insert_lseg */
        atomic_dec(&lo->plh_refcount);
-       if (list_empty(&lo->plh_segs)) {
+       if (list_empty(&lo->plh_segs) &&
+           !test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) &&
+           !test_bit(NFS_LAYOUT_RETURN, &lo->plh_flags)) {
                if (atomic_read(&lo->plh_outstanding) == 0)
                        set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
                clear_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags);
@@ -769,14 +780,6 @@ pnfs_destroy_all_layouts(struct nfs_client *clp)
        pnfs_destroy_layouts_byclid(clp, false);
 }
 
-static void
-pnfs_clear_layoutreturn_info(struct pnfs_layout_hdr *lo)
-{
-       lo->plh_return_iomode = 0;
-       lo->plh_return_seq = 0;
-       clear_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags);
-}
-
 /* update lo->plh_stateid with new if is more recent */
 void
 pnfs_set_layout_stateid(struct pnfs_layout_hdr *lo, const nfs4_stateid *new,
@@ -897,6 +900,7 @@ static void pnfs_clear_layoutcommit(struct inode *inode,
 void pnfs_clear_layoutreturn_waitbit(struct pnfs_layout_hdr *lo)
 {
        clear_bit_unlock(NFS_LAYOUT_RETURN, &lo->plh_flags);
+       clear_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags);
        smp_mb__after_atomic();
        wake_up_bit(&lo->plh_flags, NFS_LAYOUT_RETURN);
        rpc_wake_up(&NFS_SERVER(lo->plh_inode)->roc_rpcwaitq);
@@ -910,8 +914,9 @@ pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo,
        /* Serialise LAYOUTGET/LAYOUTRETURN */
        if (atomic_read(&lo->plh_outstanding) != 0)
                return false;
-       if (test_and_set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
+       if (test_and_set_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags))
                return false;
+       set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags);
        pnfs_get_layout_hdr(lo);
        if (test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) {
                if (stateid != NULL) {
@@ -1903,6 +1908,8 @@ void pnfs_error_mark_layout_for_return(struct inode 
*inode,
 
        spin_lock(&inode->i_lock);
        pnfs_set_plh_return_info(lo, range.iomode, 0);
+       /* Block LAYOUTGET */
+       set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags);
        /*
         * mark all matching lsegs so that we are sure to have no live
         * segments at hand when sending layoutreturn. See pnfs_put_lseg()
@@ -2241,6 +2248,10 @@ void pnfs_read_resend_pnfs(struct nfs_pgio_header *hdr)
        struct nfs_pageio_descriptor pgio;
 
        if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags)) {
+               /* Prevent deadlocks with layoutreturn! */
+               pnfs_put_lseg(hdr->lseg);
+               hdr->lseg = NULL;
+
                nfs_pageio_init_read(&pgio, hdr->inode, false,
                                        hdr->completion_ops);
                hdr->task.tk_status = nfs_pageio_resend(&pgio, hdr);
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 31d99b2927b0..98dbb51fcca8 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -96,6 +96,7 @@ enum {
        NFS_LAYOUT_RW_FAILED,           /* get rw layout failed stop trying */
        NFS_LAYOUT_BULK_RECALL,         /* bulk recall affecting layout */
        NFS_LAYOUT_RETURN,              /* layoutreturn in progress */
+       NFS_LAYOUT_RETURN_LOCK,         /* Serialise layoutreturn */
        NFS_LAYOUT_RETURN_REQUESTED,    /* Return this layout ASAP */
        NFS_LAYOUT_INVALID_STID,        /* layout stateid id is invalid */
        NFS_LAYOUT_FIRST_LAYOUTGET,     /* Serialize first layoutget */
diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
index 741077deef3b..a3645249f7ec 100644
--- a/fs/notify/inode_mark.c
+++ b/fs/notify/inode_mark.c
@@ -150,12 +150,10 @@ int fsnotify_add_inode_mark(struct fsnotify_mark *mark,
  */
 void fsnotify_unmount_inodes(struct super_block *sb)
 {
-       struct inode *inode, *next_i, *need_iput = NULL;
+       struct inode *inode, *iput_inode = NULL;
 
        spin_lock(&sb->s_inode_list_lock);
-       list_for_each_entry_safe(inode, next_i, &sb->s_inodes, i_sb_list) {
-               struct inode *need_iput_tmp;
-
+       list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
                /*
                 * We cannot __iget() an inode in state I_FREEING,
                 * I_WILL_FREE, or I_NEW which is fine because by that point
@@ -178,49 +176,24 @@ void fsnotify_unmount_inodes(struct super_block *sb)
                        continue;
                }
 
-               need_iput_tmp = need_iput;
-               need_iput = NULL;
-
-               /* In case fsnotify_inode_delete() drops a reference. */
-               if (inode != need_iput_tmp)
-                       __iget(inode);
-               else
-                       need_iput_tmp = NULL;
+               __iget(inode);
                spin_unlock(&inode->i_lock);
-
-               /* In case the dropping of a reference would nuke next_i. */
-               while (&next_i->i_sb_list != &sb->s_inodes) {
-                       spin_lock(&next_i->i_lock);
-                       if (!(next_i->i_state & (I_FREEING | I_WILL_FREE)) &&
-                                               atomic_read(&next_i->i_count)) {
-                               __iget(next_i);
-                               need_iput = next_i;
-                               spin_unlock(&next_i->i_lock);
-                               break;
-                       }
-                       spin_unlock(&next_i->i_lock);
-                       next_i = list_next_entry(next_i, i_sb_list);
-               }
-
-               /*
-                * We can safely drop s_inode_list_lock here because either
-                * we actually hold references on both inode and next_i or
-                * end of list.  Also no new inodes will be added since the
-                * umount has begun.
-                */
                spin_unlock(&sb->s_inode_list_lock);
 
-               if (need_iput_tmp)
-                       iput(need_iput_tmp);
+               if (iput_inode)
+                       iput(iput_inode);
 
                /* for each watch, send FS_UNMOUNT and then remove it */
                fsnotify(inode, FS_UNMOUNT, inode, FSNOTIFY_EVENT_INODE, NULL, 
0);
 
                fsnotify_inode_delete(inode);
 
-               iput(inode);
+               iput_inode = inode;
 
                spin_lock(&sb->s_inode_list_lock);
        }
        spin_unlock(&sb->s_inode_list_lock);
+
+       if (iput_inode)
+               iput(iput_inode);
 }
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index beb7610d64e9..95b1b57b28a2 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4393,6 +4393,17 @@ void cfg80211_rx_assoc_resp(struct net_device *dev,
 void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss);
 
 /**
+ * cfg80211_abandon_assoc - notify cfg80211 of abandoned association attempt
+ * @dev: network device
+ * @bss: The BSS entry with which association was abandoned.
+ *
+ * Call this whenever - for reasons reported through other API, like deauth RX,
+ * an association attempt was abandoned.
+ * This function may sleep. The caller must hold the corresponding wdev's 
mutex.
+ */
+void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss);
+
+/**
  * cfg80211_tx_mlme_mgmt - notification of transmitted deauth/disassoc frame
  * @dev: network device
  * @buf: 802.11 frame (header + body)
diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h
index 931a47ba4571..1beab5532035 100644
--- a/include/rdma/ib_addr.h
+++ b/include/rdma/ib_addr.h
@@ -205,10 +205,12 @@ static inline void iboe_addr_get_sgid(struct 
rdma_dev_addr *dev_addr,
 
        dev = dev_get_by_index(&init_net, dev_addr->bound_dev_if);
        if (dev) {
-               ip4 = (struct in_device *)dev->ip_ptr;
-               if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address)
+               ip4 = in_dev_get(dev);
+               if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address) {
                        ipv6_addr_set_v4mapped(ip4->ifa_list->ifa_address,
                                               (struct in6_addr *)gid);
+                       in_dev_put(ip4);
+               }
                dev_put(dev);
        }
 }
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 37dec7e3db43..46e312e9be38 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -299,10 +299,10 @@ u32 (*arch_gettimeoffset)(void) = 
default_arch_gettimeoffset;
 static inline u32 arch_gettimeoffset(void) { return 0; }
 #endif
 
-static inline s64 timekeeping_delta_to_ns(struct tk_read_base *tkr,
+static inline u64 timekeeping_delta_to_ns(struct tk_read_base *tkr,
                                          cycle_t delta)
 {
-       s64 nsec;
+       u64 nsec;
 
        nsec = delta * tkr->mult + tkr->xtime_nsec;
        nsec >>= tkr->shift;
diff --git a/kernel/trace/trace_functions_graph.c 
b/kernel/trace/trace_functions_graph.c
index 7363ccf79512..16047a818d2f 100644
--- a/kernel/trace/trace_functions_graph.c
+++ b/kernel/trace/trace_functions_graph.c
@@ -780,6 +780,10 @@ print_graph_entry_leaf(struct trace_iterator *iter,
 
                cpu_data = per_cpu_ptr(data->cpu_data, cpu);
 
+               /* If a graph tracer ignored set_graph_notrace */
+               if (call->depth < -1)
+                       call->depth += FTRACE_NOTRACE_DEPTH;
+
                /*
                 * Comments display at + 1 to depth. Since
                 * this is a leaf function, keep the comments
@@ -788,7 +792,8 @@ print_graph_entry_leaf(struct trace_iterator *iter,
                cpu_data->depth = call->depth - 1;
 
                /* No need to keep this function around for this depth */
-               if (call->depth < FTRACE_RETFUNC_DEPTH)
+               if (call->depth < FTRACE_RETFUNC_DEPTH &&
+                   !WARN_ON_ONCE(call->depth < 0))
                        cpu_data->enter_funcs[call->depth] = 0;
        }
 
@@ -818,11 +823,16 @@ print_graph_entry_nested(struct trace_iterator *iter,
                struct fgraph_cpu_data *cpu_data;
                int cpu = iter->cpu;
 
+               /* If a graph tracer ignored set_graph_notrace */
+               if (call->depth < -1)
+                       call->depth += FTRACE_NOTRACE_DEPTH;
+
                cpu_data = per_cpu_ptr(data->cpu_data, cpu);
                cpu_data->depth = call->depth;
 
                /* Save this function pointer to see if the exit matches */
-               if (call->depth < FTRACE_RETFUNC_DEPTH)
+               if (call->depth < FTRACE_RETFUNC_DEPTH &&
+                   !WARN_ON_ONCE(call->depth < 0))
                        cpu_data->enter_funcs[call->depth] = call->func;
        }
 
@@ -1052,7 +1062,8 @@ print_graph_return(struct ftrace_graph_ret *trace, struct 
trace_seq *s,
                 */
                cpu_data->depth = trace->depth - 1;
 
-               if (trace->depth < FTRACE_RETFUNC_DEPTH) {
+               if (trace->depth < FTRACE_RETFUNC_DEPTH &&
+                   !WARN_ON_ONCE(trace->depth < 0)) {
                        if (cpu_data->enter_funcs[trace->depth] != trace->func)
                                func_match = 0;
                        cpu_data->enter_funcs[trace->depth] = 0;
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index a5502898ea33..2efb335deada 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2027,6 +2027,19 @@ static int process_connect(struct ceph_connection *con)
 
        dout("process_connect on %p tag %d\n", con, (int)con->in_tag);
 
+       if (con->auth_reply_buf) {
+               /*
+                * Any connection that defines ->get_authorizer()
+                * should also define ->verify_authorizer_reply().
+                * See get_connect_authorizer().
+                */
+               ret = con->ops->verify_authorizer_reply(con, 0);
+               if (ret < 0) {
+                       con->error_msg = "bad authorize reply";
+                       return ret;
+               }
+       }
+
        switch (con->in_reply.tag) {
        case CEPH_MSGR_TAG_FEATURES:
                pr_err("%s%lld %s feature set mismatch,"
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 8d426f637f58..b2e3c320b648 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2506,7 +2506,7 @@ static void ieee80211_destroy_auth_data(struct 
ieee80211_sub_if_data *sdata,
 }
 
 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
-                                        bool assoc)
+                                        bool assoc, bool abandon)
 {
        struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
 
@@ -2529,6 +2529,9 @@ static void ieee80211_destroy_assoc_data(struct 
ieee80211_sub_if_data *sdata,
                mutex_lock(&sdata->local->mtx);
                ieee80211_vif_release_channel(sdata);
                mutex_unlock(&sdata->local->mtx);
+
+               if (abandon)
+                       cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
        }
 
        kfree(assoc_data);
@@ -2758,7 +2761,7 @@ static void ieee80211_rx_mgmt_deauth(struct 
ieee80211_sub_if_data *sdata,
                           bssid, reason_code,
                           ieee80211_get_reason_code_string(reason_code));
 
-               ieee80211_destroy_assoc_data(sdata, false);
+               ieee80211_destroy_assoc_data(sdata, false, true);
 
                cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
                return;
@@ -3163,14 +3166,14 @@ static void ieee80211_rx_mgmt_assoc_resp(struct 
ieee80211_sub_if_data *sdata,
        if (status_code != WLAN_STATUS_SUCCESS) {
                sdata_info(sdata, "%pM denied association (code=%d)\n",
                           mgmt->sa, status_code);
-               ieee80211_destroy_assoc_data(sdata, false);
+               ieee80211_destroy_assoc_data(sdata, false, false);
                event.u.mlme.status = MLME_DENIED;
                event.u.mlme.reason = status_code;
                drv_event_callback(sdata->local, sdata, &event);
        } else {
                if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
                        /* oops -- internal error -- send timeout for now */
-                       ieee80211_destroy_assoc_data(sdata, false);
+                       ieee80211_destroy_assoc_data(sdata, false, false);
                        cfg80211_assoc_timeout(sdata->dev, bss);
                        return;
                }
@@ -3183,7 +3186,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct 
ieee80211_sub_if_data *sdata,
                 * recalc after assoc_data is NULL but before associated
                 * is set can cause the interface to go idle
                 */
-               ieee80211_destroy_assoc_data(sdata, true);
+               ieee80211_destroy_assoc_data(sdata, true, false);
 
                /* get uapsd queues configuration */
                uapsd_queues = 0;
@@ -3882,7 +3885,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data 
*sdata)
                                .u.mlme.status = MLME_TIMEOUT,
                        };
 
-                       ieee80211_destroy_assoc_data(sdata, false);
+                       ieee80211_destroy_assoc_data(sdata, false, false);
                        cfg80211_assoc_timeout(sdata->dev, bss);
                        drv_event_callback(sdata->local, sdata, &event);
                }
@@ -4021,7 +4024,7 @@ void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data 
*sdata)
                                               WLAN_REASON_DEAUTH_LEAVING,
                                               false, frame_buf);
                if (ifmgd->assoc_data)
-                       ieee80211_destroy_assoc_data(sdata, false);
+                       ieee80211_destroy_assoc_data(sdata, false, true);
                if (ifmgd->auth_data)
                        ieee80211_destroy_auth_data(sdata, false);
                cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
@@ -4903,7 +4906,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data 
*sdata,
                                               IEEE80211_STYPE_DEAUTH,
                                               req->reason_code, tx,
                                               frame_buf);
-               ieee80211_destroy_assoc_data(sdata, false);
+               ieee80211_destroy_assoc_data(sdata, false, true);
                ieee80211_report_disconnect(sdata, frame_buf,
                                            sizeof(frame_buf), true,
                                            req->reason_code);
@@ -4978,7 +4981,7 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data 
*sdata)
        sdata_lock(sdata);
        if (ifmgd->assoc_data) {
                struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
-               ieee80211_destroy_assoc_data(sdata, false);
+               ieee80211_destroy_assoc_data(sdata, false, false);
                cfg80211_assoc_timeout(sdata->dev, bss);
        }
        if (ifmgd->auth_data)
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 976c7812bbd5..a0110c2f5ae4 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -541,9 +541,13 @@ gss_setup_upcall(struct gss_auth *gss_auth, struct 
rpc_cred *cred)
                return gss_new;
        gss_msg = gss_add_msg(gss_new);
        if (gss_msg == gss_new) {
-               int res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
+               int res;
+               atomic_inc(&gss_msg->count);
+               res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
                if (res) {
                        gss_unhash_msg(gss_new);
+                       atomic_dec(&gss_msg->count);
+                       gss_release_msg(gss_new);
                        gss_msg = ERR_PTR(res);
                }
        } else
@@ -836,6 +840,7 @@ gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
                        warn_gssd();
                gss_release_msg(gss_msg);
        }
+       gss_release_msg(gss_msg);
 }
 
 static void gss_pipe_dentry_destroy(struct dentry *dir,
diff --git a/net/vmw_vsock/virtio_transport_common.c 
b/net/vmw_vsock/virtio_transport_common.c
index a53b3a16b4f1..62c056ea403b 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -606,9 +606,9 @@ static int virtio_transport_reset_no_sock(struct 
virtio_vsock_pkt *pkt)
                return 0;
 
        pkt = virtio_transport_alloc_pkt(&info, 0,
-                                        le32_to_cpu(pkt->hdr.dst_cid),
+                                        le64_to_cpu(pkt->hdr.dst_cid),
                                         le32_to_cpu(pkt->hdr.dst_port),
-                                        le32_to_cpu(pkt->hdr.src_cid),
+                                        le64_to_cpu(pkt->hdr.src_cid),
                                         le32_to_cpu(pkt->hdr.src_port));
        if (!pkt)
                return -ENOMEM;
@@ -823,7 +823,7 @@ virtio_transport_send_response(struct vsock_sock *vsk,
        struct virtio_vsock_pkt_info info = {
                .op = VIRTIO_VSOCK_OP_RESPONSE,
                .type = VIRTIO_VSOCK_TYPE_STREAM,
-               .remote_cid = le32_to_cpu(pkt->hdr.src_cid),
+               .remote_cid = le64_to_cpu(pkt->hdr.src_cid),
                .remote_port = le32_to_cpu(pkt->hdr.src_port),
                .reply = true,
        };
@@ -863,9 +863,9 @@ virtio_transport_recv_listen(struct sock *sk, struct 
virtio_vsock_pkt *pkt)
        child->sk_state = SS_CONNECTED;
 
        vchild = vsock_sk(child);
-       vsock_addr_init(&vchild->local_addr, le32_to_cpu(pkt->hdr.dst_cid),
+       vsock_addr_init(&vchild->local_addr, le64_to_cpu(pkt->hdr.dst_cid),
                        le32_to_cpu(pkt->hdr.dst_port));
-       vsock_addr_init(&vchild->remote_addr, le32_to_cpu(pkt->hdr.src_cid),
+       vsock_addr_init(&vchild->remote_addr, le64_to_cpu(pkt->hdr.src_cid),
                        le32_to_cpu(pkt->hdr.src_port));
 
        vsock_insert_connected(vchild);
@@ -904,9 +904,9 @@ void virtio_transport_recv_pkt(struct virtio_vsock_pkt *pkt)
        struct sock *sk;
        bool space_available;
 
-       vsock_addr_init(&src, le32_to_cpu(pkt->hdr.src_cid),
+       vsock_addr_init(&src, le64_to_cpu(pkt->hdr.src_cid),
                        le32_to_cpu(pkt->hdr.src_port));
-       vsock_addr_init(&dst, le32_to_cpu(pkt->hdr.dst_cid),
+       vsock_addr_init(&dst, le64_to_cpu(pkt->hdr.dst_cid),
                        le32_to_cpu(pkt->hdr.dst_port));
 
        trace_virtio_transport_recv_pkt(src.svm_cid, src.svm_port,
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 66f2a1145d7c..b5cf21850be7 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -410,6 +410,7 @@ void cfg80211_sme_disassoc(struct wireless_dev *wdev);
 void cfg80211_sme_deauth(struct wireless_dev *wdev);
 void cfg80211_sme_auth_timeout(struct wireless_dev *wdev);
 void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev);
+void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev);
 
 /* internal helpers */
 bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher);
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index c284d883c349..2a62ef628f42 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -149,6 +149,18 @@ void cfg80211_assoc_timeout(struct net_device *dev, struct 
cfg80211_bss *bss)
 }
 EXPORT_SYMBOL(cfg80211_assoc_timeout);
 
+void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss)
+{
+       struct wireless_dev *wdev = dev->ieee80211_ptr;
+       struct wiphy *wiphy = wdev->wiphy;
+
+       cfg80211_sme_abandon_assoc(wdev);
+
+       cfg80211_unhold_bss(bss_from_pub(bss));
+       cfg80211_put_bss(wiphy, bss);
+}
+EXPORT_SYMBOL(cfg80211_abandon_assoc);
+
 void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
 {
        struct wireless_dev *wdev = dev->ieee80211_ptr;
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index add6824c44fd..95c713cdabf0 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -39,6 +39,7 @@ struct cfg80211_conn {
                CFG80211_CONN_ASSOCIATING,
                CFG80211_CONN_ASSOC_FAILED,
                CFG80211_CONN_DEAUTH,
+               CFG80211_CONN_ABANDON,
                CFG80211_CONN_CONNECTED,
        } state;
        u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
@@ -206,6 +207,8 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
                                     NULL, 0,
                                     WLAN_REASON_DEAUTH_LEAVING, false);
+               /* fall through */
+       case CFG80211_CONN_ABANDON:
                /* free directly, disconnected event already sent */
                cfg80211_sme_free(wdev);
                return 0;
@@ -423,6 +426,17 @@ void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
        schedule_work(&rdev->conn_work);
 }
 
+void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev)
+{
+       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
+
+       if (!wdev->conn)
+               return;
+
+       wdev->conn->state = CFG80211_CONN_ABANDON;
+       schedule_work(&rdev->conn_work);
+}
+
 static int cfg80211_sme_get_conn_ies(struct wireless_dev *wdev,
                                     const u8 *ies, size_t ies_len,
                                     const u8 **out_ies, size_t *out_ies_len)
diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c
index 8275f0e55106..4b2f44c20caf 100644
--- a/scripts/kconfig/nconf.gui.c
+++ b/scripts/kconfig/nconf.gui.c
@@ -364,12 +364,14 @@ int dialog_inputbox(WINDOW *main_window,
        WINDOW *prompt_win;
        WINDOW *form_win;
        PANEL *panel;
-       int i, x, y;
+       int i, x, y, lines, columns, win_lines, win_cols;
        int res = -1;
        int cursor_position = strlen(init);
        int cursor_form_win;
        char *result = *resultp;
 
+       getmaxyx(stdscr, lines, columns);
+
        if (strlen(init)+1 > *result_len) {
                *result_len = strlen(init)+1;
                *resultp = result = realloc(result, *result_len);
@@ -386,14 +388,19 @@ int dialog_inputbox(WINDOW *main_window,
        if (title)
                prompt_width = max(prompt_width, strlen(title));
 
+       win_lines = min(prompt_lines+6, lines-2);
+       win_cols = min(prompt_width+7, columns-2);
+       prompt_lines = max(win_lines-6, 0);
+       prompt_width = max(win_cols-7, 0);
+
        /* place dialog in middle of screen */
-       y = (getmaxy(stdscr)-(prompt_lines+4))/2;
-       x = (getmaxx(stdscr)-(prompt_width+4))/2;
+       y = (lines-win_lines)/2;
+       x = (columns-win_cols)/2;
 
        strncpy(result, init, *result_len);
 
        /* create the windows */
-       win = newwin(prompt_lines+6, prompt_width+7, y, x);
+       win = newwin(win_lines, win_cols, y, x);
        prompt_win = derwin(win, prompt_lines+1, prompt_width, 2, 2);
        form_win = derwin(win, 1, prompt_width, prompt_lines+3, 2);
        keypad(form_win, TRUE);

Reply via email to