Linux patch 3.17.43.17-7

2 files changed, 6676 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index c2e62ed1..50ca1478 100644
--- a/0000_README
+++ b/0000_README
@@ -55,6 +55,10 @@ Patch:  1002_linux-3.17.3.patch
 From:   http://www.kernel.org
 Desc:   Linux 3.17.3
 
+Patch:  1003_linux-3.17.4.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.17.4
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1003_linux-3.17.4.patch b/1003_linux-3.17.4.patch
new file mode 100644
index 00000000..5659b299
--- /dev/null
+++ b/1003_linux-3.17.4.patch
@@ -0,0 +1,6672 @@
+diff --git a/Documentation/devicetree/bindings/ata/sata_rcar.txt b/Documentation/devicetree/bindings/ata/sata_rcar.txt
+index 1e6111333fa8..7dd32d321a34 100644
+--- a/Documentation/devicetree/bindings/ata/sata_rcar.txt
++++ b/Documentation/devicetree/bindings/ata/sata_rcar.txt
+@@ -3,7 +3,8 @@
+ Required properties:
+ - compatible		: should contain one of the following:
+ 			  - "renesas,sata-r8a7779" for R-Car H1
+-			  - "renesas,sata-r8a7790" for R-Car H2
++			  - "renesas,sata-r8a7790-es1" for R-Car H2 ES1
++			  - "renesas,sata-r8a7790" for R-Car H2 other than ES1
+ 			  - "renesas,sata-r8a7791" for R-Car M2
+ - reg			: address and length of the SATA registers;
+ - interrupts		: must consist of one interrupt specifier.
+diff --git a/Makefile b/Makefile
+index 57a45b1ea2c7..b60b64d65416 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 17
+-SUBLEVEL = 3
++SUBLEVEL = 4
+ EXTRAVERSION =
+ NAME = Shuffling Zombie Juror
+ 
+diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
+index 413fd94b5301..68be9017593d 100644
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -397,8 +397,7 @@ dtb_check_done:
+ 		add	sp, sp, r6
+ #endif
+ 
+-		tst	r4, #1
+-		bleq	cache_clean_flush
++		bl	cache_clean_flush
+ 
+ 		adr	r0, BSYM(restart)
+ 		add	r0, r0, r6
+@@ -1047,6 +1046,8 @@ cache_clean_flush:
+ 		b	call_cache_fn
+ 
+ __armv4_mpu_cache_flush:
++		tst	r4, #1
++		movne	pc, lr
+ 		mov	r2, #1
+ 		mov	r3, #0
+ 		mcr	p15, 0, ip, c7, c6, 0	@ invalidate D cache
+@@ -1064,6 +1065,8 @@ __armv4_mpu_cache_flush:
+ 		mov	pc, lr
+ 		
+ __fa526_cache_flush:
++		tst	r4, #1
++		movne	pc, lr
+ 		mov	r1, #0
+ 		mcr	p15, 0, r1, c7, c14, 0	@ clean and invalidate D cache
+ 		mcr	p15, 0, r1, c7, c5, 0	@ flush I cache
+@@ -1072,13 +1075,16 @@ __fa526_cache_flush:
+ 
+ __armv6_mmu_cache_flush:
+ 		mov	r1, #0
+-		mcr	p15, 0, r1, c7, c14, 0	@ clean+invalidate D
++		tst	r4, #1
++		mcreq	p15, 0, r1, c7, c14, 0	@ clean+invalidate D
+ 		mcr	p15, 0, r1, c7, c5, 0	@ invalidate I+BTB
+-		mcr	p15, 0, r1, c7, c15, 0	@ clean+invalidate unified
++		mcreq	p15, 0, r1, c7, c15, 0	@ clean+invalidate unified
+ 		mcr	p15, 0, r1, c7, c10, 4	@ drain WB
+ 		mov	pc, lr
+ 
+ __armv7_mmu_cache_flush:
++		tst	r4, #1
++		bne	iflush
+ 		mrc	p15, 0, r10, c0, c1, 5	@ read ID_MMFR1
+ 		tst	r10, #0xf << 16		@ hierarchical cache (ARMv7)
+ 		mov	r10, #0
+@@ -1139,6 +1145,8 @@ iflush:
+ 		mov	pc, lr
+ 
+ __armv5tej_mmu_cache_flush:
++		tst	r4, #1
++		movne	pc, lr
+ 1:		mrc	p15, 0, r15, c7, c14, 3	@ test,clean,invalidate D cache
+ 		bne	1b
+ 		mcr	p15, 0, r0, c7, c5, 0	@ flush I cache
+@@ -1146,6 +1154,8 @@ __armv5tej_mmu_cache_flush:
+ 		mov	pc, lr
+ 
+ __armv4_mmu_cache_flush:
++		tst	r4, #1
++		movne	pc, lr
+ 		mov	r2, #64*1024		@ default: 32K dcache size (*2)
+ 		mov	r11, #32		@ default: 32 byte line size
+ 		mrc	p15, 0, r3, c0, c0, 1	@ read cache type
+@@ -1179,6 +1189,8 @@ no_cache_id:
+ 
+ __armv3_mmu_cache_flush:
+ __armv3_mpu_cache_flush:
++		tst	r4, #1
++		movne	pc, lr
+ 		mov	r1, #0
+ 		mcr	p15, 0, r1, c7, c0, 0	@ invalidate whole cache v3
+ 		mov	pc, lr
+diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
+index e2156a583de7..c4b968f0feb5 100644
+--- a/arch/arm/boot/dts/am335x-evm.dts
++++ b/arch/arm/boot/dts/am335x-evm.dts
+@@ -489,7 +489,7 @@
+ 			reg = <0x00060000 0x00020000>;
+ 		};
+ 		partition@4 {
+-			label = "NAND.u-boot-spl";
++			label = "NAND.u-boot-spl-os";
+ 			reg = <0x00080000 0x00040000>;
+ 		};
+ 		partition@5 {
+diff --git a/arch/arm/mach-mvebu/board-v7.c b/arch/arm/mach-mvebu/board-v7.c
+index 6478626e3ff6..d0d39f150fab 100644
+--- a/arch/arm/mach-mvebu/board-v7.c
++++ b/arch/arm/mach-mvebu/board-v7.c
+@@ -188,7 +188,7 @@ static void __init thermal_quirk(void)
+ 
+ static void __init mvebu_dt_init(void)
+ {
+-	if (of_machine_is_compatible("plathome,openblocks-ax3-4"))
++	if (of_machine_is_compatible("marvell,armadaxp"))
+ 		i2c_quirk();
+ 	if (of_machine_is_compatible("marvell,a375-db")) {
+ 		external_abort_quirk();
+diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
+index ae69809a9e47..7eb94e6fc376 100644
+--- a/arch/arm/mm/Kconfig
++++ b/arch/arm/mm/Kconfig
+@@ -798,6 +798,7 @@ config NEED_KUSER_HELPERS
+ 
+ config KUSER_HELPERS
+ 	bool "Enable kuser helpers in vector page" if !NEED_KUSER_HELPERS
++	depends on MMU
+ 	default y
+ 	help
+ 	  Warning: disabling this option may break user programs.
+diff --git a/arch/arm64/kernel/efi-entry.S b/arch/arm64/kernel/efi-entry.S
+index 619b1dd7bcde..d18a44940968 100644
+--- a/arch/arm64/kernel/efi-entry.S
++++ b/arch/arm64/kernel/efi-entry.S
+@@ -54,18 +54,17 @@ ENTRY(efi_stub_entry)
+ 	b.eq	efi_load_fail
+ 
+ 	/*
+-	 * efi_entry() will have relocated the kernel image if necessary
+-	 * and we return here with device tree address in x0 and the kernel
+-	 * entry point stored at *image_addr. Save those values in registers
+-	 * which are callee preserved.
++	 * efi_entry() will have copied the kernel image if necessary and we
++	 * return here with device tree address in x0 and the kernel entry
++	 * point stored at *image_addr. Save those values in registers which
++	 * are callee preserved.
+ 	 */
+ 	mov	x20, x0		// DTB address
+ 	ldr	x0, [sp, #16]	// relocated _text address
+ 	mov	x21, x0
+ 
+ 	/*
+-	 * Flush dcache covering current runtime addresses
+-	 * of kernel text/data. Then flush all of icache.
++	 * Calculate size of the kernel Image (same for original and copy).
+ 	 */
+ 	adrp	x1, _text
+ 	add	x1, x1, #:lo12:_text
+@@ -73,9 +72,24 @@ ENTRY(efi_stub_entry)
+ 	add	x2, x2, #:lo12:_edata
+ 	sub	x1, x2, x1
+ 
++	/*
++	 * Flush the copied Image to the PoC, and ensure it is not shadowed by
++	 * stale icache entries from before relocation.
++	 */
+ 	bl	__flush_dcache_area
+ 	ic	ialluis
+ 
++	/*
++	 * Ensure that the rest of this function (in the original Image) is
++	 * visible when the caches are disabled. The I-cache can't have stale
++	 * entries for the VA range of the current image, so no maintenance is
++	 * necessary.
++	 */
++	adr	x0, efi_stub_entry
++	adr	x1, efi_stub_entry_end
++	sub	x1, x1, x0
++	bl	__flush_dcache_area
++
+ 	/* Turn off Dcache and MMU */
+ 	mrs	x0, CurrentEL
+ 	cmp	x0, #CurrentEL_EL2
+@@ -105,4 +119,5 @@ efi_load_fail:
+ 	ldp	x29, x30, [sp], #32
+ 	ret
+ 
++efi_stub_entry_end:
+ ENDPROC(efi_stub_entry)
+diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c
+index 92f36835486b..565e26f23f31 100644
+--- a/arch/arm64/kernel/insn.c
++++ b/arch/arm64/kernel/insn.c
+@@ -156,9 +156,10 @@ static int __kprobes aarch64_insn_patch_text_cb(void *arg)
+ 		 * which ends with "dsb; isb" pair guaranteeing global
+ 		 * visibility.
+ 		 */
+-		atomic_set(&pp->cpu_count, -1);
++		/* Notify other processors with an additional increment. */
++		atomic_inc(&pp->cpu_count);
+ 	} else {
+-		while (atomic_read(&pp->cpu_count) != -1)
++		while (atomic_read(&pp->cpu_count) <= num_online_cpus())
+ 			cpu_relax();
+ 		isb();
+ 	}
+diff --git a/arch/arm64/lib/clear_user.S b/arch/arm64/lib/clear_user.S
+index 6e0ed93d51fe..c17967fdf5f6 100644
+--- a/arch/arm64/lib/clear_user.S
++++ b/arch/arm64/lib/clear_user.S
+@@ -46,7 +46,7 @@ USER(9f, strh	wzr, [x0], #2	)
+ 	sub	x1, x1, #2
+ 4:	adds	x1, x1, #1
+ 	b.mi	5f
+-	strb	wzr, [x0]
++USER(9f, strb	wzr, [x0]	)
+ 5:	mov	x0, #0
+ 	ret
+ ENDPROC(__clear_user)
+diff --git a/arch/parisc/include/uapi/asm/shmbuf.h b/arch/parisc/include/uapi/asm/shmbuf.h
+index 0a3eada1863b..f395cde7b593 100644
+--- a/arch/parisc/include/uapi/asm/shmbuf.h
++++ b/arch/parisc/include/uapi/asm/shmbuf.h
+@@ -36,23 +36,16 @@ struct shmid64_ds {
+ 	unsigned int		__unused2;
+ };
+ 
+-#ifdef CONFIG_64BIT
+-/* The 'unsigned int' (formerly 'unsigned long') data types below will
+- * ensure that a 32-bit app calling shmctl(*,IPC_INFO,*) will work on
+- * a wide kernel, but if some of these values are meant to contain pointers
+- * they may need to be 'long long' instead. -PB XXX FIXME
+- */
+-#endif
+ struct shminfo64 {
+-	unsigned int	shmmax;
+-	unsigned int	shmmin;
+-	unsigned int	shmmni;
+-	unsigned int	shmseg;
+-	unsigned int	shmall;
+-	unsigned int	__unused1;
+-	unsigned int	__unused2;
+-	unsigned int	__unused3;
+-	unsigned int	__unused4;
++	unsigned long	shmmax;
++	unsigned long	shmmin;
++	unsigned long	shmmni;
++	unsigned long	shmseg;
++	unsigned long	shmall;
++	unsigned long	__unused1;
++	unsigned long	__unused2;
++	unsigned long	__unused3;
++	unsigned long	__unused4;
+ };
+ 
+ #endif /* _PARISC_SHMBUF_H */
+diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
+index b563d9c8268b..d183a440b1b0 100644
+--- a/arch/parisc/kernel/syscall_table.S
++++ b/arch/parisc/kernel/syscall_table.S
+@@ -286,11 +286,11 @@
+ 	ENTRY_COMP(msgsnd)
+ 	ENTRY_COMP(msgrcv)
+ 	ENTRY_SAME(msgget)		/* 190 */
+-	ENTRY_SAME(msgctl)
+-	ENTRY_SAME(shmat)
++	ENTRY_COMP(msgctl)
++	ENTRY_COMP(shmat)
+ 	ENTRY_SAME(shmdt)
+ 	ENTRY_SAME(shmget)
+-	ENTRY_SAME(shmctl)		/* 195 */
++	ENTRY_COMP(shmctl)		/* 195 */
+ 	ENTRY_SAME(ni_syscall)		/* streams1 */
+ 	ENTRY_SAME(ni_syscall)		/* streams2 */
+ 	ENTRY_SAME(lstat64)
+@@ -323,7 +323,7 @@
+ 	ENTRY_SAME(epoll_ctl)		/* 225 */
+ 	ENTRY_SAME(epoll_wait)
+  	ENTRY_SAME(remap_file_pages)
+-	ENTRY_SAME(semtimedop)
++	ENTRY_COMP(semtimedop)
+ 	ENTRY_COMP(mq_open)
+ 	ENTRY_SAME(mq_unlink)		/* 230 */
+ 	ENTRY_COMP(mq_timedsend)
+diff --git a/arch/sparc/include/asm/atomic_32.h b/arch/sparc/include/asm/atomic_32.h
+index 7aed2be45b44..2701fb68a24f 100644
+--- a/arch/sparc/include/asm/atomic_32.h
++++ b/arch/sparc/include/asm/atomic_32.h
+@@ -22,7 +22,7 @@
+ 
+ int __atomic_add_return(int, atomic_t *);
+ int atomic_cmpxchg(atomic_t *, int, int);
+-#define atomic_xchg(v, new) (xchg(&((v)->counter), new))
++int atomic_xchg(atomic_t *, int);
+ int __atomic_add_unless(atomic_t *, int, int);
+ void atomic_set(atomic_t *, int);
+ 
+diff --git a/arch/sparc/include/asm/cmpxchg_32.h b/arch/sparc/include/asm/cmpxchg_32.h
+index 32c29a133f9d..d38b52dca216 100644
+--- a/arch/sparc/include/asm/cmpxchg_32.h
++++ b/arch/sparc/include/asm/cmpxchg_32.h
+@@ -11,22 +11,14 @@
+ #ifndef __ARCH_SPARC_CMPXCHG__
+ #define __ARCH_SPARC_CMPXCHG__
+ 
+-static inline unsigned long xchg_u32(__volatile__ unsigned long *m, unsigned long val)
+-{
+-	__asm__ __volatile__("swap [%2], %0"
+-			     : "=&r" (val)
+-			     : "0" (val), "r" (m)
+-			     : "memory");
+-	return val;
+-}
+-
++unsigned long __xchg_u32(volatile u32 *m, u32 new);
+ void __xchg_called_with_bad_pointer(void);
+ 
+ static inline unsigned long __xchg(unsigned long x, __volatile__ void * ptr, int size)
+ {
+ 	switch (size) {
+ 	case 4:
+-		return xchg_u32(ptr, x);
++		return __xchg_u32(ptr, x);
+ 	}
+ 	__xchg_called_with_bad_pointer();
+ 	return x;
+diff --git a/arch/sparc/include/asm/vio.h b/arch/sparc/include/asm/vio.h
+index e0f6c399f1d0..2986120acac5 100644
+--- a/arch/sparc/include/asm/vio.h
++++ b/arch/sparc/include/asm/vio.h
+@@ -118,12 +118,18 @@ struct vio_disk_attr_info {
+ 	u8			vdisk_type;
+ #define VD_DISK_TYPE_SLICE	0x01 /* Slice in block device	*/
+ #define VD_DISK_TYPE_DISK	0x02 /* Entire block device	*/
+-	u16			resv1;
++	u8			vdisk_mtype;		/* v1.1 */
++#define VD_MEDIA_TYPE_FIXED	0x01 /* Fixed device */
++#define VD_MEDIA_TYPE_CD	0x02 /* CD Device    */
++#define VD_MEDIA_TYPE_DVD	0x03 /* DVD Device   */
++	u8			resv1;
+ 	u32			vdisk_block_size;
+ 	u64			operations;
+-	u64			vdisk_size;
++	u64			vdisk_size;		/* v1.1 */
+ 	u64			max_xfer_size;
+-	u64			resv2[2];
++	u32			phys_block_size;	/* v1.2 */
++	u32			resv2;
++	u64			resv3[1];
+ };
+ 
+ struct vio_disk_desc {
+@@ -259,7 +265,7 @@ static inline u32 vio_dring_avail(struct vio_dring_state *dr,
+ 				  unsigned int ring_size)
+ {
+ 	return (dr->pending -
+-		((dr->prod - dr->cons) & (ring_size - 1)));
++		((dr->prod - dr->cons) & (ring_size - 1)) - 1);
+ }
+ 
+ #define VIO_MAX_TYPE_LEN	32
+diff --git a/arch/sparc/kernel/pci_schizo.c b/arch/sparc/kernel/pci_schizo.c
+index 8f76f23dac38..f9c6813c132d 100644
+--- a/arch/sparc/kernel/pci_schizo.c
++++ b/arch/sparc/kernel/pci_schizo.c
+@@ -581,7 +581,7 @@ static irqreturn_t schizo_pcierr_intr_other(struct pci_pbm_info *pbm)
+ {
+ 	unsigned long csr_reg, csr, csr_error_bits;
+ 	irqreturn_t ret = IRQ_NONE;
+-	u16 stat;
++	u32 stat;
+ 
+ 	csr_reg = pbm->pbm_regs + SCHIZO_PCI_CTRL;
+ 	csr = upa_readq(csr_reg);
+@@ -617,7 +617,7 @@ static irqreturn_t schizo_pcierr_intr_other(struct pci_pbm_info *pbm)
+ 			       pbm->name);
+ 		ret = IRQ_HANDLED;
+ 	}
+-	pci_read_config_word(pbm->pci_bus->self, PCI_STATUS, &stat);
++	pbm->pci_ops->read(pbm->pci_bus, 0, PCI_STATUS, 2, &stat);
+ 	if (stat & (PCI_STATUS_PARITY |
+ 		    PCI_STATUS_SIG_TARGET_ABORT |
+ 		    PCI_STATUS_REC_TARGET_ABORT |
+@@ -625,7 +625,7 @@ static irqreturn_t schizo_pcierr_intr_other(struct pci_pbm_info *pbm)
+ 		    PCI_STATUS_SIG_SYSTEM_ERROR)) {
+ 		printk("%s: PCI bus error, PCI_STATUS[%04x]\n",
+ 		       pbm->name, stat);
+-		pci_write_config_word(pbm->pci_bus->self, PCI_STATUS, 0xffff);
++		pbm->pci_ops->write(pbm->pci_bus, 0, PCI_STATUS, 2, 0xffff);
+ 		ret = IRQ_HANDLED;
+ 	}
+ 	return ret;
+diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
+index c9300bfaee5a..81954ee7c47c 100644
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -816,13 +816,17 @@ void arch_send_call_function_single_ipi(int cpu)
+ void __irq_entry smp_call_function_client(int irq, struct pt_regs *regs)
+ {
+ 	clear_softint(1 << irq);
++	irq_enter();
+ 	generic_smp_call_function_interrupt();
++	irq_exit();
+ }
+ 
+ void __irq_entry smp_call_function_single_client(int irq, struct pt_regs *regs)
+ {
+ 	clear_softint(1 << irq);
++	irq_enter();
+ 	generic_smp_call_function_single_interrupt();
++	irq_exit();
+ }
+ 
+ static void tsb_sync(void *info)
+diff --git a/arch/sparc/lib/atomic32.c b/arch/sparc/lib/atomic32.c
+index 1d32b54089aa..8f2f94d53434 100644
+--- a/arch/sparc/lib/atomic32.c
++++ b/arch/sparc/lib/atomic32.c
+@@ -40,6 +40,19 @@ int __atomic_add_return(int i, atomic_t *v)
+ }
+ EXPORT_SYMBOL(__atomic_add_return);
+ 
++int atomic_xchg(atomic_t *v, int new)
++{
++	int ret;
++	unsigned long flags;
++
++	spin_lock_irqsave(ATOMIC_HASH(v), flags);
++	ret = v->counter;
++	v->counter = new;
++	spin_unlock_irqrestore(ATOMIC_HASH(v), flags);
++	return ret;
++}
++EXPORT_SYMBOL(atomic_xchg);
++
+ int atomic_cmpxchg(atomic_t *v, int old, int new)
+ {
+ 	int ret;
+@@ -132,3 +145,17 @@ unsigned long __cmpxchg_u32(volatile u32 *ptr, u32 old, u32 new)
+ 	return (unsigned long)prev;
+ }
+ EXPORT_SYMBOL(__cmpxchg_u32);
++
++unsigned long __xchg_u32(volatile u32 *ptr, u32 new)
++{
++	unsigned long flags;
++	u32 prev;
++
++	spin_lock_irqsave(ATOMIC_HASH(ptr), flags);
++	prev = *ptr;
++	*ptr = new;
++	spin_unlock_irqrestore(ATOMIC_HASH(ptr), flags);
++
++	return (unsigned long)prev;
++}
++EXPORT_SYMBOL(__xchg_u32);
+diff --git a/arch/x86/.gitignore b/arch/x86/.gitignore
+index 7cab8c08e6d1..aff152c87cf4 100644
+--- a/arch/x86/.gitignore
++++ b/arch/x86/.gitignore
+@@ -1,4 +1,6 @@
+ boot/compressed/vmlinux
+ tools/test_get_len
+ tools/insn_sanity
++purgatory/kexec-purgatory.c
++purgatory/purgatory.ro
+ 
+diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
+index 0fcd9133790c..14fe7cba21d1 100644
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -75,8 +75,10 @@ suffix-$(CONFIG_KERNEL_XZ)	:= xz
+ suffix-$(CONFIG_KERNEL_LZO) 	:= lzo
+ suffix-$(CONFIG_KERNEL_LZ4) 	:= lz4
+ 
++RUN_SIZE = $(shell objdump -h vmlinux | \
++	     perl $(srctree)/arch/x86/tools/calc_run_size.pl)
+ quiet_cmd_mkpiggy = MKPIGGY $@
+-      cmd_mkpiggy = $(obj)/mkpiggy $< > $@ || ( rm -f $@ ; false )
++      cmd_mkpiggy = $(obj)/mkpiggy $< $(RUN_SIZE) > $@ || ( rm -f $@ ; false )
+ 
+ targets += piggy.S
+ $(obj)/piggy.S: $(obj)/vmlinux.bin.$(suffix-y) $(obj)/mkpiggy FORCE
+diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
+index cbed1407a5cd..1d7fbbcc196d 100644
+--- a/arch/x86/boot/compressed/head_32.S
++++ b/arch/x86/boot/compressed/head_32.S
+@@ -207,7 +207,8 @@ relocated:
+  * Do the decompression, and jump to the new kernel..
+  */
+ 				/* push arguments for decompress_kernel: */
+-	pushl	$z_output_len	/* decompressed length */
++	pushl	$z_run_size	/* size of kernel with .bss and .brk */
++	pushl	$z_output_len	/* decompressed length, end of relocs */
+ 	leal	z_extract_offset_negative(%ebx), %ebp
+ 	pushl	%ebp		/* output address */
+ 	pushl	$z_input_len	/* input_len */
+@@ -217,7 +218,7 @@ relocated:
+ 	pushl	%eax		/* heap area */
+ 	pushl	%esi		/* real mode pointer */
+ 	call	decompress_kernel /* returns kernel location in %eax */
+-	addl	$24, %esp
++	addl	$28, %esp
+ 
+ /*
+  * Jump to the decompressed kernel.
+diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
+index 2884e0c3e8a5..6b1766c6c082 100644
+--- a/arch/x86/boot/compressed/head_64.S
++++ b/arch/x86/boot/compressed/head_64.S
+@@ -402,13 +402,16 @@ relocated:
+  * Do the decompression, and jump to the new kernel..
+  */
+ 	pushq	%rsi			/* Save the real mode argument */
++	movq	$z_run_size, %r9	/* size of kernel with .bss and .brk */
++	pushq	%r9
+ 	movq	%rsi, %rdi		/* real mode address */
+ 	leaq	boot_heap(%rip), %rsi	/* malloc area for uncompression */
+ 	leaq	input_data(%rip), %rdx  /* input_data */
+ 	movl	$z_input_len, %ecx	/* input_len */
+ 	movq	%rbp, %r8		/* output target address */
+-	movq	$z_output_len, %r9	/* decompressed length */
++	movq	$z_output_len, %r9	/* decompressed length, end of relocs */
+ 	call	decompress_kernel	/* returns kernel location in %rax */
++	popq	%r9
+ 	popq	%rsi
+ 
+ /*
+diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
+index 57ab74df7eea..30dd59a9f0b4 100644
+--- a/arch/x86/boot/compressed/misc.c
++++ b/arch/x86/boot/compressed/misc.c
+@@ -358,7 +358,8 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
+ 				  unsigned char *input_data,
+ 				  unsigned long input_len,
+ 				  unsigned char *output,
+-				  unsigned long output_len)
++				  unsigned long output_len,
++				  unsigned long run_size)
+ {
+ 	real_mode = rmode;
+ 
+@@ -381,8 +382,14 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
+ 	free_mem_ptr     = heap;	/* Heap */
+ 	free_mem_end_ptr = heap + BOOT_HEAP_SIZE;
+ 
+-	output = choose_kernel_location(input_data, input_len,
+-					output, output_len);
++	/*
++	 * The memory hole needed for the kernel is the larger of either
++	 * the entire decompressed kernel plus relocation table, or the
++	 * entire decompressed kernel plus .bss and .brk sections.
++	 */
++	output = choose_kernel_location(input_data, input_len, output,
++					output_len > run_size ? output_len
++							      : run_size);
+ 
+ 	/* Validate memory location choices. */
+ 	if ((unsigned long)output & (MIN_KERNEL_ALIGN - 1))
+diff --git a/arch/x86/boot/compressed/mkpiggy.c b/arch/x86/boot/compressed/mkpiggy.c
+index b669ab65bf6c..d8222f213182 100644
+--- a/arch/x86/boot/compressed/mkpiggy.c
++++ b/arch/x86/boot/compressed/mkpiggy.c
+@@ -36,11 +36,13 @@ int main(int argc, char *argv[])
+ 	uint32_t olen;
+ 	long ilen;
+ 	unsigned long offs;
++	unsigned long run_size;
+ 	FILE *f = NULL;
+ 	int retval = 1;
+ 
+-	if (argc < 2) {
+-		fprintf(stderr, "Usage: %s compressed_file\n", argv[0]);
++	if (argc < 3) {
++		fprintf(stderr, "Usage: %s compressed_file run_size\n",
++				argv[0]);
+ 		goto bail;
+ 	}
+ 
+@@ -74,6 +76,7 @@ int main(int argc, char *argv[])
+ 	offs += olen >> 12;	/* Add 8 bytes for each 32K block */
+ 	offs += 64*1024 + 128;	/* Add 64K + 128 bytes slack */
+ 	offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
++	run_size = atoi(argv[2]);
+ 
+ 	printf(".section \".rodata..compressed\",\"a\",@progbits\n");
+ 	printf(".globl z_input_len\n");
+@@ -85,6 +88,8 @@ int main(int argc, char *argv[])
+ 	/* z_extract_offset_negative allows simplification of head_32.S */
+ 	printf(".globl z_extract_offset_negative\n");
+ 	printf("z_extract_offset_negative = -0x%lx\n", offs);
++	printf(".globl z_run_size\n");
++	printf("z_run_size = %lu\n", run_size);
+ 
+ 	printf(".globl input_data, input_data_end\n");
+ 	printf("input_data:\n");
+diff --git a/arch/x86/kernel/cpu/microcode/amd_early.c b/arch/x86/kernel/cpu/microcode/amd_early.c
+index 617a9e284245..b63773ba1646 100644
+--- a/arch/x86/kernel/cpu/microcode/amd_early.c
++++ b/arch/x86/kernel/cpu/microcode/amd_early.c
+@@ -108,12 +108,13 @@ static size_t compute_container_size(u8 *data, u32 total_size)
+  * load_microcode_amd() to save equivalent cpu table and microcode patches in
+  * kernel heap memory.
+  */
+-static void apply_ucode_in_initrd(void *ucode, size_t size)
++static void apply_ucode_in_initrd(void *ucode, size_t size, bool save_patch)
+ {
+ 	struct equiv_cpu_entry *eq;
+ 	size_t *cont_sz;
+ 	u32 *header;
+ 	u8  *data, **cont;
++	u8 (*patch)[PATCH_MAX_SIZE];
+ 	u16 eq_id = 0;
+ 	int offset, left;
+ 	u32 rev, eax, ebx, ecx, edx;
+@@ -123,10 +124,12 @@ static void apply_ucode_in_initrd(void *ucode, size_t size)
+ 	new_rev = (u32 *)__pa_nodebug(&ucode_new_rev);
+ 	cont_sz = (size_t *)__pa_nodebug(&container_size);
+ 	cont	= (u8 **)__pa_nodebug(&container);
++	patch	= (u8 (*)[PATCH_MAX_SIZE])__pa_nodebug(&amd_ucode_patch);
+ #else
+ 	new_rev = &ucode_new_rev;
+ 	cont_sz = &container_size;
+ 	cont	= &container;
++	patch	= &amd_ucode_patch;
+ #endif
+ 
+ 	data   = ucode;
+@@ -213,9 +216,9 @@ static void apply_ucode_in_initrd(void *ucode, size_t size)
+ 				rev = mc->hdr.patch_id;
+ 				*new_rev = rev;
+ 
+-				/* save ucode patch */
+-				memcpy(amd_ucode_patch, mc,
+-				       min_t(u32, header[1], PATCH_MAX_SIZE));
++				if (save_patch)
++					memcpy(patch, mc,
++					       min_t(u32, header[1], PATCH_MAX_SIZE));
+ 			}
+ 		}
+ 
+@@ -246,7 +249,7 @@ void __init load_ucode_amd_bsp(void)
+ 	*data = cp.data;
+ 	*size = cp.size;
+ 
+-	apply_ucode_in_initrd(cp.data, cp.size);
++	apply_ucode_in_initrd(cp.data, cp.size, true);
+ }
+ 
+ #ifdef CONFIG_X86_32
+@@ -263,7 +266,7 @@ void load_ucode_amd_ap(void)
+ 	size_t *usize;
+ 	void **ucode;
+ 
+-	mc = (struct microcode_amd *)__pa(amd_ucode_patch);
++	mc = (struct microcode_amd *)__pa_nodebug(amd_ucode_patch);
+ 	if (mc->hdr.patch_id && mc->hdr.processor_rev_id) {
+ 		__apply_microcode_amd(mc);
+ 		return;
+@@ -275,7 +278,7 @@ void load_ucode_amd_ap(void)
+ 	if (!*ucode || !*usize)
+ 		return;
+ 
+-	apply_ucode_in_initrd(*ucode, *usize);
++	apply_ucode_in_initrd(*ucode, *usize, false);
+ }
+ 
+ static void __init collect_cpu_sig_on_bsp(void *arg)
+@@ -339,7 +342,7 @@ void load_ucode_amd_ap(void)
+ 		 * AP has a different equivalence ID than BSP, looks like
+ 		 * mixed-steppings silicon so go through the ucode blob anew.
+ 		 */
+-		apply_ucode_in_initrd(ucode_cpio.data, ucode_cpio.size);
++		apply_ucode_in_initrd(ucode_cpio.data, ucode_cpio.size, false);
+ 	}
+ }
+ #endif
+@@ -347,7 +350,9 @@ void load_ucode_amd_ap(void)
+ int __init save_microcode_in_initrd_amd(void)
+ {
+ 	unsigned long cont;
++	int retval = 0;
+ 	enum ucode_state ret;
++	u8 *cont_va;
+ 	u32 eax;
+ 
+ 	if (!container)
+@@ -355,13 +360,15 @@ int __init save_microcode_in_initrd_amd(void)
+ 
+ #ifdef CONFIG_X86_32
+ 	get_bsp_sig();
+-	cont = (unsigned long)container;
++	cont	= (unsigned long)container;
++	cont_va = __va(container);
+ #else
+ 	/*
+ 	 * We need the physical address of the container for both bitness since
+ 	 * boot_params.hdr.ramdisk_image is a physical address.
+ 	 */
+-	cont = __pa(container);
++	cont    = __pa(container);
++	cont_va = container;
+ #endif
+ 
+ 	/*
+@@ -372,6 +379,8 @@ int __init save_microcode_in_initrd_amd(void)
+ 	if (relocated_ramdisk)
+ 		container = (u8 *)(__va(relocated_ramdisk) +
+ 			     (cont - boot_params.hdr.ramdisk_image));
++	else
++		container = cont_va;
+ 
+ 	if (ucode_new_rev)
+ 		pr_info("microcode: updated early to new patch_level=0x%08x\n",
+@@ -382,7 +391,7 @@ int __init save_microcode_in_initrd_amd(void)
+ 
+ 	ret = load_microcode_amd(eax, container, container_size);
+ 	if (ret != UCODE_OK)
+-		return -EINVAL;
++		retval = -EINVAL;
+ 
+ 	/*
+ 	 * This will be freed any msec now, stash patches for the current
+@@ -391,5 +400,5 @@ int __init save_microcode_in_initrd_amd(void)
+ 	container = NULL;
+ 	container_size = 0;
+ 
+-	return 0;
++	return retval;
+ }
+diff --git a/arch/x86/kernel/cpu/microcode/core_early.c b/arch/x86/kernel/cpu/microcode/core_early.c
+index 5f28a64e71ea..2c017f242a78 100644
+--- a/arch/x86/kernel/cpu/microcode/core_early.c
++++ b/arch/x86/kernel/cpu/microcode/core_early.c
+@@ -124,7 +124,7 @@ void __init load_ucode_bsp(void)
+ static bool check_loader_disabled_ap(void)
+ {
+ #ifdef CONFIG_X86_32
+-	return __pa_nodebug(dis_ucode_ldr);
++	return *((bool *)__pa_nodebug(&dis_ucode_ldr));
+ #else
+ 	return dis_ucode_ldr;
+ #endif
+diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
+index 678c0ada3b3c..b1a5dfa24789 100644
+--- a/arch/x86/kernel/ptrace.c
++++ b/arch/x86/kernel/ptrace.c
+@@ -1441,15 +1441,6 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
+ 	force_sig_info(SIGTRAP, &info, tsk);
+ }
+ 
+-
+-#ifdef CONFIG_X86_32
+-# define IS_IA32	1
+-#elif defined CONFIG_IA32_EMULATION
+-# define IS_IA32	is_compat_task()
+-#else
+-# define IS_IA32	0
+-#endif
+-
+ /*
+  * We must return the syscall number to actually look up in the table.
+  * This can be -1L to skip running any syscall at all.
+@@ -1487,7 +1478,7 @@ long syscall_trace_enter(struct pt_regs *regs)
+ 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
+ 		trace_sys_enter(regs, regs->orig_ax);
+ 
+-	if (IS_IA32)
++	if (is_ia32_task())
+ 		audit_syscall_entry(AUDIT_ARCH_I386,
+ 				    regs->orig_ax,
+ 				    regs->bx, regs->cx,
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 77c77fe84f13..9254069f0d08 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -4272,6 +4272,7 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
+ 		fetch_register_operand(op);
+ 		break;
+ 	case OpCL:
++		op->type = OP_IMM;
+ 		op->bytes = 1;
+ 		op->val = reg_read(ctxt, VCPU_REGS_RCX) & 0xff;
+ 		break;
+@@ -4279,6 +4280,7 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
+ 		rc = decode_imm(ctxt, op, 1, true);
+ 		break;
+ 	case OpOne:
++		op->type = OP_IMM;
+ 		op->bytes = 1;
+ 		op->val = 1;
+ 		break;
+@@ -4337,21 +4339,27 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
+ 		ctxt->memop.bytes = ctxt->op_bytes + 2;
+ 		goto mem_common;
+ 	case OpES:
++		op->type = OP_IMM;
+ 		op->val = VCPU_SREG_ES;
+ 		break;
+ 	case OpCS:
++		op->type = OP_IMM;
+ 		op->val = VCPU_SREG_CS;
+ 		break;
+ 	case OpSS:
++		op->type = OP_IMM;
+ 		op->val = VCPU_SREG_SS;
+ 		break;
+ 	case OpDS:
++		op->type = OP_IMM;
+ 		op->val = VCPU_SREG_DS;
+ 		break;
+ 	case OpFS:
++		op->type = OP_IMM;
+ 		op->val = VCPU_SREG_FS;
+ 		break;
+ 	case OpGS:
++		op->type = OP_IMM;
+ 		op->val = VCPU_SREG_GS;
+ 		break;
+ 	case OpImplicit:
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 9d292e8372d6..d6aeccf116fa 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -5002,7 +5002,7 @@ static int handle_emulation_failure(struct kvm_vcpu *vcpu)
+ 
+ 	++vcpu->stat.insn_emulation_fail;
+ 	trace_kvm_emulate_insn_failed(vcpu);
+-	if (!is_guest_mode(vcpu)) {
++	if (!is_guest_mode(vcpu) && kvm_x86_ops->get_cpl(vcpu) == 0) {
+ 		vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+ 		vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
+ 		vcpu->run->internal.ndata = 0;
+diff --git a/arch/x86/tools/calc_run_size.pl b/arch/x86/tools/calc_run_size.pl
+new file mode 100644
+index 000000000000..0b0b124d3ece
+--- /dev/null
++++ b/arch/x86/tools/calc_run_size.pl
+@@ -0,0 +1,30 @@
++#!/usr/bin/perl
++#
++# Calculate the amount of space needed to run the kernel, including room for
++# the .bss and .brk sections.
++#
++# Usage:
++# objdump -h a.out | perl calc_run_size.pl
++use strict;
++
++my $mem_size = 0;
++my $file_offset = 0;
++
++my $sections=" *[0-9]+ \.(?:bss|brk) +";
++while (<>) {
++	if (/^$sections([0-9a-f]+) +(?:[0-9a-f]+ +){2}([0-9a-f]+)/) {
++		my $size = hex($1);
++		my $offset = hex($2);
++		$mem_size += $size;
++		if ($file_offset == 0) {
++			$file_offset = $offset;
++		} elsif ($file_offset != $offset) {
++			die ".bss and .brk lack common file offset\n";
++		}
++	}
++}
++
++if ($file_offset == 0) {
++	die "Never found .bss or .brk file offset\n";
++}
++printf("%d\n", $mem_size + $file_offset);
+diff --git a/arch/xtensa/include/uapi/asm/unistd.h b/arch/xtensa/include/uapi/asm/unistd.h
+index 8883fc877c5c..b1744a3474a6 100644
+--- a/arch/xtensa/include/uapi/asm/unistd.h
++++ b/arch/xtensa/include/uapi/asm/unistd.h
+@@ -384,7 +384,8 @@ __SYSCALL(174, sys_chroot, 1)
+ #define __NR_pivot_root 			175
+ __SYSCALL(175, sys_pivot_root, 2)
+ #define __NR_umount 				176
+-__SYSCALL(176, sys_umount, 2)
++__SYSCALL(176, sys_oldumount, 1)
++#define __ARCH_WANT_SYS_OLDUMOUNT
+ #define __NR_swapoff 				177
+ __SYSCALL(177, sys_swapoff, 1)
+ #define __NR_sync 				178
+diff --git a/block/ioprio.c b/block/ioprio.c
+index e50170ca7c33..31666c92b46a 100644
+--- a/block/ioprio.c
++++ b/block/ioprio.c
+@@ -157,14 +157,16 @@ out:
+ 
+ int ioprio_best(unsigned short aprio, unsigned short bprio)
+ {
+-	unsigned short aclass = IOPRIO_PRIO_CLASS(aprio);
+-	unsigned short bclass = IOPRIO_PRIO_CLASS(bprio);
++	unsigned short aclass;
++	unsigned short bclass;
+ 
+-	if (aclass == IOPRIO_CLASS_NONE)
+-		aclass = IOPRIO_CLASS_BE;
+-	if (bclass == IOPRIO_CLASS_NONE)
+-		bclass = IOPRIO_CLASS_BE;
++	if (!ioprio_valid(aprio))
++		aprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, IOPRIO_NORM);
++	if (!ioprio_valid(bprio))
++		bprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, IOPRIO_NORM);
+ 
++	aclass = IOPRIO_PRIO_CLASS(aprio);
++	bclass = IOPRIO_PRIO_CLASS(bprio);
+ 	if (aclass == bclass)
+ 		return min(aprio, bprio);
+ 	if (aclass > bclass)
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index a0cc0edafc78..597b15e7f6e5 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -60,6 +60,7 @@ enum board_ids {
+ 	/* board IDs by feature in alphabetical order */
+ 	board_ahci,
+ 	board_ahci_ign_iferr,
++	board_ahci_nomsi,
+ 	board_ahci_noncq,
+ 	board_ahci_nosntf,
+ 	board_ahci_yes_fbs,
+@@ -121,6 +122,13 @@ static const struct ata_port_info ahci_port_info[] = {
+ 		.udma_mask	= ATA_UDMA6,
+ 		.port_ops	= &ahci_ops,
+ 	},
++	[board_ahci_nomsi] = {
++		AHCI_HFLAGS	(AHCI_HFLAG_NO_MSI),
++		.flags		= AHCI_FLAG_COMMON,
++		.pio_mask	= ATA_PIO4,
++		.udma_mask	= ATA_UDMA6,
++		.port_ops	= &ahci_ops,
++	},
+ 	[board_ahci_noncq] = {
+ 		AHCI_HFLAGS	(AHCI_HFLAG_NO_NCQ),
+ 		.flags		= AHCI_FLAG_COMMON,
+@@ -313,6 +321,11 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	{ PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
++	{ PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */
++	{ PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H RAID */
++	{ PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */
++	{ PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */
++	{ PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */
+ 
+ 	/* JMicron 360/1/3/5/6, match class to avoid IDE function */
+ 	{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+@@ -475,10 +488,10 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	{ PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },	/* ASM1062 */
+ 
+ 	/*
+-	 * Samsung SSDs found on some macbooks.  NCQ times out.
+-	 * https://bugzilla.kernel.org/show_bug.cgi?id=60731
++	 * Samsung SSDs found on some macbooks.  NCQ times out if MSI is
++	 * enabled.  https://bugzilla.kernel.org/show_bug.cgi?id=60731
+ 	 */
+-	{ PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_noncq },
++	{ PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_nomsi },
+ 
+ 	/* Enmotus */
+ 	{ PCI_DEVICE(0x1c44, 0x8000), board_ahci },
+@@ -514,12 +527,9 @@ MODULE_PARM_DESC(marvell_enable, "Marvell SATA via AHCI (1 = enabled)");
+ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
+ 					 struct ahci_host_priv *hpriv)
+ {
+-	unsigned int force_port_map = 0;
+-	unsigned int mask_port_map = 0;
+-
+ 	if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) {
+ 		dev_info(&pdev->dev, "JMB361 has only one port\n");
+-		force_port_map = 1;
++		hpriv->force_port_map = 1;
+ 	}
+ 
+ 	/*
+@@ -529,9 +539,9 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
+ 	 */
+ 	if (hpriv->flags & AHCI_HFLAG_MV_PATA) {
+ 		if (pdev->device == 0x6121)
+-			mask_port_map = 0x3;
++			hpriv->mask_port_map = 0x3;
+ 		else
+-			mask_port_map = 0xf;
++			hpriv->mask_port_map = 0xf;
+ 		dev_info(&pdev->dev,
+ 			  "Disabling your PATA port. Use the boot option 'ahci.marvell_enable=0' to avoid this.\n");
+ 	}
+diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
+index 61eb6d77dac7..8732e42db3a9 100644
+--- a/drivers/ata/sata_rcar.c
++++ b/drivers/ata/sata_rcar.c
+@@ -146,6 +146,7 @@
+ enum sata_rcar_type {
+ 	RCAR_GEN1_SATA,
+ 	RCAR_GEN2_SATA,
++	RCAR_R8A7790_ES1_SATA,
+ };
+ 
+ struct sata_rcar_priv {
+@@ -763,6 +764,9 @@ static void sata_rcar_setup_port(struct ata_host *host)
+ 	ap->udma_mask	= ATA_UDMA6;
+ 	ap->flags	|= ATA_FLAG_SATA;
+ 
++	if (priv->type == RCAR_R8A7790_ES1_SATA)
++		ap->flags	|= ATA_FLAG_NO_DIPM;
++
+ 	ioaddr->cmd_addr = base + SDATA_REG;
+ 	ioaddr->ctl_addr = base + SSDEVCON_REG;
+ 	ioaddr->scr_addr = base + SCRSSTS_REG;
+@@ -792,6 +796,7 @@ static void sata_rcar_init_controller(struct ata_host *host)
+ 		sata_rcar_gen1_phy_init(priv);
+ 		break;
+ 	case RCAR_GEN2_SATA:
++	case RCAR_R8A7790_ES1_SATA:
+ 		sata_rcar_gen2_phy_init(priv);
+ 		break;
+ 	default:
+@@ -838,6 +843,10 @@ static struct of_device_id sata_rcar_match[] = {
+ 		.data = (void *)RCAR_GEN2_SATA
+ 	},
+ 	{
++		.compatible = "renesas,sata-r8a7790-es1",
++		.data = (void *)RCAR_R8A7790_ES1_SATA
++	},
++	{
+ 		.compatible = "renesas,sata-r8a7791",
+ 		.data = (void *)RCAR_GEN2_SATA
+ 	},
+@@ -849,6 +858,7 @@ static const struct platform_device_id sata_rcar_id_table[] = {
+ 	{ "sata_rcar", RCAR_GEN1_SATA }, /* Deprecated by "sata-r8a7779" */
+ 	{ "sata-r8a7779", RCAR_GEN1_SATA },
+ 	{ "sata-r8a7790", RCAR_GEN2_SATA },
++	{ "sata-r8a7790-es1", RCAR_R8A7790_ES1_SATA },
+ 	{ "sata-r8a7791", RCAR_GEN2_SATA },
+ 	{ },
+ };
+diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
+index 5814deb6963d..0ebadf93b6c5 100644
+--- a/drivers/block/sunvdc.c
++++ b/drivers/block/sunvdc.c
+@@ -9,6 +9,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/hdreg.h>
+ #include <linux/genhd.h>
++#include <linux/cdrom.h>
+ #include <linux/slab.h>
+ #include <linux/spinlock.h>
+ #include <linux/completion.h>
+@@ -22,8 +23,8 @@
+ 
+ #define DRV_MODULE_NAME		"sunvdc"
+ #define PFX DRV_MODULE_NAME	": "
+-#define DRV_MODULE_VERSION	"1.0"
+-#define DRV_MODULE_RELDATE	"June 25, 2007"
++#define DRV_MODULE_VERSION	"1.1"
++#define DRV_MODULE_RELDATE	"February 13, 2013"
+ 
+ static char version[] =
+ 	DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
+@@ -32,7 +33,7 @@ MODULE_DESCRIPTION("Sun LDOM virtual disk client driver");
+ MODULE_LICENSE("GPL");
+ MODULE_VERSION(DRV_MODULE_VERSION);
+ 
+-#define VDC_TX_RING_SIZE	256
++#define VDC_TX_RING_SIZE	512
+ 
+ #define WAITING_FOR_LINK_UP	0x01
+ #define WAITING_FOR_TX_SPACE	0x02
+@@ -65,11 +66,9 @@ struct vdc_port {
+ 	u64			operations;
+ 	u32			vdisk_size;
+ 	u8			vdisk_type;
++	u8			vdisk_mtype;
+ 
+ 	char			disk_name[32];
+-
+-	struct vio_disk_geom	geom;
+-	struct vio_disk_vtoc	label;
+ };
+ 
+ static inline struct vdc_port *to_vdc_port(struct vio_driver_state *vio)
+@@ -79,9 +78,16 @@ static inline struct vdc_port *to_vdc_port(struct vio_driver_state *vio)
+ 
+ /* Ordered from largest major to lowest */
+ static struct vio_version vdc_versions[] = {
++	{ .major = 1, .minor = 1 },
+ 	{ .major = 1, .minor = 0 },
+ };
+ 
++static inline int vdc_version_supported(struct vdc_port *port,
++					u16 major, u16 minor)
++{
++	return port->vio.ver.major == major && port->vio.ver.minor >= minor;
++}
++
+ #define VDCBLK_NAME	"vdisk"
+ static int vdc_major;
+ #define PARTITION_SHIFT	3
+@@ -94,18 +100,54 @@ static inline u32 vdc_tx_dring_avail(struct vio_dring_state *dr)
+ static int vdc_getgeo(struct block_device *bdev, struct hd_geometry *geo)
+ {
+ 	struct gendisk *disk = bdev->bd_disk;
+-	struct vdc_port *port = disk->private_data;
++	sector_t nsect = get_capacity(disk);
++	sector_t cylinders = nsect;
+ 
+-	geo->heads = (u8) port->geom.num_hd;
+-	geo->sectors = (u8) port->geom.num_sec;
+-	geo->cylinders = port->geom.num_cyl;
++	geo->heads = 0xff;
++	geo->sectors = 0x3f;
++	sector_div(cylinders, geo->heads * geo->sectors);
++	geo->cylinders = cylinders;
++	if ((sector_t)(geo->cylinders + 1) * geo->heads * geo->sectors < nsect)
++		geo->cylinders = 0xffff;
+ 
+ 	return 0;
+ }
+ 
++/* Add ioctl/CDROM_GET_CAPABILITY to support cdrom_id in udev
++ * when vdisk_mtype is VD_MEDIA_TYPE_CD or VD_MEDIA_TYPE_DVD.
++ * Needed to be able to install inside an ldom from an iso image.
++ */
++static int vdc_ioctl(struct block_device *bdev, fmode_t mode,
++		     unsigned command, unsigned long argument)
++{
++	int i;
++	struct gendisk *disk;
++
++	switch (command) {
++	case CDROMMULTISESSION:
++		pr_debug(PFX "Multisession CDs not supported\n");
++		for (i = 0; i < sizeof(struct cdrom_multisession); i++)
++			if (put_user(0, (char __user *)(argument + i)))
++				return -EFAULT;
++		return 0;
++
++	case CDROM_GET_CAPABILITY:
++		disk = bdev->bd_disk;
++
++		if (bdev->bd_disk && (disk->flags & GENHD_FL_CD))
++			return 0;
++		return -EINVAL;
++
++	default:
++		pr_debug(PFX "ioctl %08x not supported\n", command);
++		return -EINVAL;
++	}
++}
++
+ static const struct block_device_operations vdc_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.getgeo		= vdc_getgeo,
++	.ioctl		= vdc_ioctl,
+ };
+ 
+ static void vdc_finish(struct vio_driver_state *vio, int err, int waiting_for)
+@@ -165,9 +207,9 @@ static int vdc_handle_attr(struct vio_driver_state *vio, void *arg)
+ 	struct vio_disk_attr_info *pkt = arg;
+ 
+ 	viodbg(HS, "GOT ATTR stype[0x%x] ops[%llx] disk_size[%llu] disk_type[%x] "
+-	       "xfer_mode[0x%x] blksz[%u] max_xfer[%llu]\n",
++	       "mtype[0x%x] xfer_mode[0x%x] blksz[%u] max_xfer[%llu]\n",
+ 	       pkt->tag.stype, pkt->operations,
+-	       pkt->vdisk_size, pkt->vdisk_type,
++	       pkt->vdisk_size, pkt->vdisk_type, pkt->vdisk_mtype,
+ 	       pkt->xfer_mode, pkt->vdisk_block_size,
+ 	       pkt->max_xfer_size);
+ 
+@@ -192,8 +234,11 @@ static int vdc_handle_attr(struct vio_driver_state *vio, void *arg)
+ 		}
+ 
+ 		port->operations = pkt->operations;
+-		port->vdisk_size = pkt->vdisk_size;
+ 		port->vdisk_type = pkt->vdisk_type;
++		if (vdc_version_supported(port, 1, 1)) {
++			port->vdisk_size = pkt->vdisk_size;
++			port->vdisk_mtype = pkt->vdisk_mtype;
++		}
+ 		if (pkt->max_xfer_size < port->max_xfer_size)
+ 			port->max_xfer_size = pkt->max_xfer_size;
+ 		port->vdisk_block_size = pkt->vdisk_block_size;
+@@ -236,7 +281,9 @@ static void vdc_end_one(struct vdc_port *port, struct vio_dring_state *dr,
+ 
+ 	__blk_end_request(req, (desc->status ? -EIO : 0), desc->size);
+ 
+-	if (blk_queue_stopped(port->disk->queue))
++	/* restart blk queue when ring is half emptied */
++	if (blk_queue_stopped(port->disk->queue) &&
++	    vdc_tx_dring_avail(dr) * 100 / VDC_TX_RING_SIZE >= 50)
+ 		blk_start_queue(port->disk->queue);
+ }
+ 
+@@ -388,12 +435,6 @@ static int __send_request(struct request *req)
+ 	for (i = 0; i < nsg; i++)
+ 		len += sg[i].length;
+ 
+-	if (unlikely(vdc_tx_dring_avail(dr) < 1)) {
+-		blk_stop_queue(port->disk->queue);
+-		err = -ENOMEM;
+-		goto out;
+-	}
+-
+ 	desc = vio_dring_cur(dr);
+ 
+ 	err = ldc_map_sg(port->vio.lp, sg, nsg,
+@@ -433,21 +474,32 @@ static int __send_request(struct request *req)
+ 		port->req_id++;
+ 		dr->prod = (dr->prod + 1) & (VDC_TX_RING_SIZE - 1);
+ 	}
+-out:
+ 
+ 	return err;
+ }
+ 
+-static void do_vdc_request(struct request_queue *q)
++static void do_vdc_request(struct request_queue *rq)
+ {
+-	while (1) {
+-		struct request *req = blk_fetch_request(q);
++	struct request *req;
+ 
+-		if (!req)
+-			break;
++	while ((req = blk_peek_request(rq)) != NULL) {
++		struct vdc_port *port;
++		struct vio_dring_state *dr;
+ 
+-		if (__send_request(req) < 0)
+-			__blk_end_request_all(req, -EIO);
++		port = req->rq_disk->private_data;
++		dr = &port->vio.drings[VIO_DRIVER_TX_RING];
++		if (unlikely(vdc_tx_dring_avail(dr) < 1))
++			goto wait;
++
++		blk_start_request(req);
++
++		if (__send_request(req) < 0) {
++			blk_requeue_request(rq, req);
++wait:
++			/* Avoid pointless unplugs. */
++			blk_stop_queue(rq);
++			break;
++		}
+ 	}
+ }
+ 
+@@ -656,25 +708,27 @@ static int probe_disk(struct vdc_port *port)
+ 	if (comp.err)
+ 		return comp.err;
+ 
+-	err = generic_request(port, VD_OP_GET_VTOC,
+-			      &port->label, sizeof(port->label));
+-	if (err < 0) {
+-		printk(KERN_ERR PFX "VD_OP_GET_VTOC returns error %d\n", err);
+-		return err;
+-	}
+-
+-	err = generic_request(port, VD_OP_GET_DISKGEOM,
+-			      &port->geom, sizeof(port->geom));
+-	if (err < 0) {
+-		printk(KERN_ERR PFX "VD_OP_GET_DISKGEOM returns "
+-		       "error %d\n", err);
+-		return err;
++	if (vdc_version_supported(port, 1, 1)) {
++		/* vdisk_size should be set during the handshake, if it wasn't
++		 * then the underlying disk is reserved by another system
++		 */
++		if (port->vdisk_size == -1)
++			return -ENODEV;
++	} else {
++		struct vio_disk_geom geom;
++
++		err = generic_request(port, VD_OP_GET_DISKGEOM,
++				      &geom, sizeof(geom));
++		if (err < 0) {
++			printk(KERN_ERR PFX "VD_OP_GET_DISKGEOM returns "
++			       "error %d\n", err);
++			return err;
++		}
++		port->vdisk_size = ((u64)geom.num_cyl *
++				    (u64)geom.num_hd *
++				    (u64)geom.num_sec);
+ 	}
+ 
+-	port->vdisk_size = ((u64)port->geom.num_cyl *
+-			    (u64)port->geom.num_hd *
+-			    (u64)port->geom.num_sec);
+-
+ 	q = blk_init_queue(do_vdc_request, &port->vio.lock);
+ 	if (!q) {
+ 		printk(KERN_ERR PFX "%s: Could not allocate queue.\n",
+@@ -691,6 +745,10 @@ static int probe_disk(struct vdc_port *port)
+ 
+ 	port->disk = g;
+ 
++	/* Each segment in a request is up to an aligned page in size. */
++	blk_queue_segment_boundary(q, PAGE_SIZE - 1);
++	blk_queue_max_segment_size(q, PAGE_SIZE);
++
+ 	blk_queue_max_segments(q, port->ring_cookies);
+ 	blk_queue_max_hw_sectors(q, port->max_xfer_size);
+ 	g->major = vdc_major;
+@@ -704,9 +762,32 @@ static int probe_disk(struct vdc_port *port)
+ 
+ 	set_capacity(g, port->vdisk_size);
+ 
+-	printk(KERN_INFO PFX "%s: %u sectors (%u MB)\n",
++	if (vdc_version_supported(port, 1, 1)) {
++		switch (port->vdisk_mtype) {
++		case VD_MEDIA_TYPE_CD:
++			pr_info(PFX "Virtual CDROM %s\n", port->disk_name);
++			g->flags |= GENHD_FL_CD;
++			g->flags |= GENHD_FL_REMOVABLE;
++			set_disk_ro(g, 1);
++			break;
++
++		case VD_MEDIA_TYPE_DVD:
++			pr_info(PFX "Virtual DVD %s\n", port->disk_name);
++			g->flags |= GENHD_FL_CD;
++			g->flags |= GENHD_FL_REMOVABLE;
++			set_disk_ro(g, 1);
++			break;
++
++		case VD_MEDIA_TYPE_FIXED:
++			pr_info(PFX "Virtual Hard disk %s\n", port->disk_name);
++			break;
++		}
++	}
++
++	pr_info(PFX "%s: %u sectors (%u MB) protocol %d.%d\n",
+ 	       g->disk_name,
+-	       port->vdisk_size, (port->vdisk_size >> (20 - 9)));
++	       port->vdisk_size, (port->vdisk_size >> (20 - 9)),
++	       port->vio.ver.major, port->vio.ver.minor);
+ 
+ 	add_disk(g);
+ 
+@@ -765,6 +846,7 @@ static int vdc_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
+ 	else
+ 		snprintf(port->disk_name, sizeof(port->disk_name),
+ 			 VDCBLK_NAME "%c", 'a' + ((int)vdev->dev_no % 26));
++	port->vdisk_size = -1;
+ 
+ 	err = vio_driver_init(&port->vio, vdev, VDEV_DISK,
+ 			      vdc_versions, ARRAY_SIZE(vdc_versions),
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index d00831c3d731..cc1b58b82a48 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -476,7 +476,8 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
+ 	}
+ 
+ 	if (page_zero_filled(uncmem)) {
+-		kunmap_atomic(user_mem);
++		if (user_mem)
++			kunmap_atomic(user_mem);
+ 		/* Free memory associated with this sector now. */
+ 		bit_spin_lock(ZRAM_ACCESS, &meta->table[index].value);
+ 		zram_free_page(zram, index);
+diff --git a/drivers/char/hw_random/pseries-rng.c b/drivers/char/hw_random/pseries-rng.c
+index ab7ffdec0ec3..f38f2c13e79c 100644
+--- a/drivers/char/hw_random/pseries-rng.c
++++ b/drivers/char/hw_random/pseries-rng.c
+@@ -25,18 +25,21 @@
+ #include <asm/vio.h>
+ 
+ 
+-static int pseries_rng_data_read(struct hwrng *rng, u32 *data)
++static int pseries_rng_read(struct hwrng *rng, void *data, size_t max, bool wait)
+ {
++	u64 buffer[PLPAR_HCALL_BUFSIZE];
++	size_t size = max < 8 ? max : 8;
+ 	int rc;
+ 
+-	rc = plpar_hcall(H_RANDOM, (unsigned long *)data);
++	rc = plpar_hcall(H_RANDOM, (unsigned long *)buffer);
+ 	if (rc != H_SUCCESS) {
+ 		pr_err_ratelimited("H_RANDOM call failed %d\n", rc);
+ 		return -EIO;
+ 	}
++	memcpy(data, buffer, size);
+ 
+ 	/* The hypervisor interface returns 64 bits */
+-	return 8;
++	return size;
+ }
+ 
+ /**
+@@ -55,7 +58,7 @@ static unsigned long pseries_rng_get_desired_dma(struct vio_dev *vdev)
+ 
+ static struct hwrng pseries_rng = {
+ 	.name		= KBUILD_MODNAME,
+-	.data_read	= pseries_rng_data_read,
++	.read		= pseries_rng_read,
+ };
+ 
+ static int __init pseries_rng_probe(struct vio_dev *dev,
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index c05821e8de41..07c827637b17 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1022,7 +1022,8 @@ static struct cpufreq_policy *cpufreq_policy_restore(unsigned int cpu)
+ 
+ 	read_unlock_irqrestore(&cpufreq_driver_lock, flags);
+ 
+-	policy->governor = NULL;
++	if (policy)
++		policy->governor = NULL;
+ 
+ 	return policy;
+ }
+diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
+index e9cc753d5095..f347ab7eea95 100644
+--- a/drivers/crypto/caam/caamhash.c
++++ b/drivers/crypto/caam/caamhash.c
+@@ -836,8 +836,9 @@ static int ahash_update_ctx(struct ahash_request *req)
+ 					   edesc->sec4_sg + sec4_sg_src_index,
+ 					   chained);
+ 			if (*next_buflen) {
+-				sg_copy_part(next_buf, req->src, to_hash -
+-					     *buflen, req->nbytes);
++				scatterwalk_map_and_copy(next_buf, req->src,
++							 to_hash - *buflen,
++							 *next_buflen, 0);
+ 				state->current_buf = !state->current_buf;
+ 			}
+ 		} else {
+@@ -878,7 +879,8 @@ static int ahash_update_ctx(struct ahash_request *req)
+ 			kfree(edesc);
+ 		}
+ 	} else if (*next_buflen) {
+-		sg_copy(buf + *buflen, req->src, req->nbytes);
++		scatterwalk_map_and_copy(buf + *buflen, req->src, 0,
++					 req->nbytes, 0);
+ 		*buflen = *next_buflen;
+ 		*next_buflen = last_buflen;
+ 	}
+@@ -1262,8 +1264,9 @@ static int ahash_update_no_ctx(struct ahash_request *req)
+ 		src_map_to_sec4_sg(jrdev, req->src, src_nents,
+ 				   edesc->sec4_sg + 1, chained);
+ 		if (*next_buflen) {
+-			sg_copy_part(next_buf, req->src, to_hash - *buflen,
+-				    req->nbytes);
++			scatterwalk_map_and_copy(next_buf, req->src,
++						 to_hash - *buflen,
++						 *next_buflen, 0);
+ 			state->current_buf = !state->current_buf;
+ 		}
+ 
+@@ -1304,7 +1307,8 @@ static int ahash_update_no_ctx(struct ahash_request *req)
+ 			kfree(edesc);
+ 		}
+ 	} else if (*next_buflen) {
+-		sg_copy(buf + *buflen, req->src, req->nbytes);
++		scatterwalk_map_and_copy(buf + *buflen, req->src, 0,
++					 req->nbytes, 0);
+ 		*buflen = *next_buflen;
+ 		*next_buflen = 0;
+ 	}
+@@ -1476,7 +1480,8 @@ static int ahash_update_first(struct ahash_request *req)
+ 		}
+ 
+ 		if (*next_buflen)
+-			sg_copy_part(next_buf, req->src, to_hash, req->nbytes);
++			scatterwalk_map_and_copy(next_buf, req->src, to_hash,
++						 *next_buflen, 0);
+ 
+ 		sh_len = desc_len(sh_desc);
+ 		desc = edesc->hw_desc;
+@@ -1511,7 +1516,8 @@ static int ahash_update_first(struct ahash_request *req)
+ 		state->update = ahash_update_no_ctx;
+ 		state->finup = ahash_finup_no_ctx;
+ 		state->final = ahash_final_no_ctx;
+-		sg_copy(next_buf, req->src, req->nbytes);
++		scatterwalk_map_and_copy(next_buf, req->src, 0,
++					 req->nbytes, 0);
+ 	}
+ #ifdef DEBUG
+ 	print_hex_dump(KERN_ERR, "next buf@"__stringify(__LINE__)": ",
+diff --git a/drivers/crypto/caam/key_gen.c b/drivers/crypto/caam/key_gen.c
+index 871703c49d2c..e1eaf4ff9762 100644
+--- a/drivers/crypto/caam/key_gen.c
++++ b/drivers/crypto/caam/key_gen.c
+@@ -48,23 +48,29 @@ int gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
+ 	u32 *desc;
+ 	struct split_key_result result;
+ 	dma_addr_t dma_addr_in, dma_addr_out;
+-	int ret = 0;
++	int ret = -ENOMEM;
+ 
+ 	desc = kmalloc(CAAM_CMD_SZ * 6 + CAAM_PTR_SZ * 2, GFP_KERNEL | GFP_DMA);
+ 	if (!desc) {
+ 		dev_err(jrdev, "unable to allocate key input memory\n");
+-		return -ENOMEM;
++		return ret;
+ 	}
+ 
+-	init_job_desc(desc, 0);
+-
+ 	dma_addr_in = dma_map_single(jrdev, (void *)key_in, keylen,
+ 				     DMA_TO_DEVICE);
+ 	if (dma_mapping_error(jrdev, dma_addr_in)) {
+ 		dev_err(jrdev, "unable to map key input memory\n");
+-		kfree(desc);
+-		return -ENOMEM;
++		goto out_free;
+ 	}
++
++	dma_addr_out = dma_map_single(jrdev, key_out, split_key_pad_len,
++				      DMA_FROM_DEVICE);
++	if (dma_mapping_error(jrdev, dma_addr_out)) {
++		dev_err(jrdev, "unable to map key output memory\n");
++		goto out_unmap_in;
++	}
++
++	init_job_desc(desc, 0);
+ 	append_key(desc, dma_addr_in, keylen, CLASS_2 | KEY_DEST_CLASS_REG);
+ 
+ 	/* Sets MDHA up into an HMAC-INIT */
+@@ -81,13 +87,6 @@ int gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
+ 	 * FIFO_STORE with the explicit split-key content store
+ 	 * (0x26 output type)
+ 	 */
+-	dma_addr_out = dma_map_single(jrdev, key_out, split_key_pad_len,
+-				      DMA_FROM_DEVICE);
+-	if (dma_mapping_error(jrdev, dma_addr_out)) {
+-		dev_err(jrdev, "unable to map key output memory\n");
+-		kfree(desc);
+-		return -ENOMEM;
+-	}
+ 	append_fifo_store(desc, dma_addr_out, split_key_len,
+ 			  LDST_CLASS_2_CCB | FIFOST_TYPE_SPLIT_KEK);
+ 
+@@ -115,10 +114,10 @@ int gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
+ 
+ 	dma_unmap_single(jrdev, dma_addr_out, split_key_pad_len,
+ 			 DMA_FROM_DEVICE);
++out_unmap_in:
+ 	dma_unmap_single(jrdev, dma_addr_in, keylen, DMA_TO_DEVICE);
+-
++out_free:
+ 	kfree(desc);
+-
+ 	return ret;
+ }
+ EXPORT_SYMBOL(gen_split_key);
+diff --git a/drivers/crypto/caam/sg_sw_sec4.h b/drivers/crypto/caam/sg_sw_sec4.h
+index b12ff85f4241..ce28a563effc 100644
+--- a/drivers/crypto/caam/sg_sw_sec4.h
++++ b/drivers/crypto/caam/sg_sw_sec4.h
+@@ -116,57 +116,3 @@ static int dma_unmap_sg_chained(struct device *dev, struct scatterlist *sg,
+ 	}
+ 	return nents;
+ }
+-
+-/* Map SG page in kernel virtual address space and copy */
+-static inline void sg_map_copy(u8 *dest, struct scatterlist *sg,
+-			       int len, int offset)
+-{
+-	u8 *mapped_addr;
+-
+-	/*
+-	 * Page here can be user-space pinned using get_user_pages
+-	 * Same must be kmapped before use and kunmapped subsequently
+-	 */
+-	mapped_addr = kmap_atomic(sg_page(sg));
+-	memcpy(dest, mapped_addr + offset, len);
+-	kunmap_atomic(mapped_addr);
+-}
+-
+-/* Copy from len bytes of sg to dest, starting from beginning */
+-static inline void sg_copy(u8 *dest, struct scatterlist *sg, unsigned int len)
+-{
+-	struct scatterlist *current_sg = sg;
+-	int cpy_index = 0, next_cpy_index = current_sg->length;
+-
+-	while (next_cpy_index < len) {
+-		sg_map_copy(dest + cpy_index, current_sg, current_sg->length,
+-			    current_sg->offset);
+-		current_sg = scatterwalk_sg_next(current_sg);
+-		cpy_index = next_cpy_index;
+-		next_cpy_index += current_sg->length;
+-	}
+-	if (cpy_index < len)
+-		sg_map_copy(dest + cpy_index, current_sg, len-cpy_index,
+-			    current_sg->offset);
+-}
+-
+-/* Copy sg data, from to_skip to end, to dest */
+-static inline void sg_copy_part(u8 *dest, struct scatterlist *sg,
+-				      int to_skip, unsigned int end)
+-{
+-	struct scatterlist *current_sg = sg;
+-	int sg_index, cpy_index, offset;
+-
+-	sg_index = current_sg->length;
+-	while (sg_index <= to_skip) {
+-		current_sg = scatterwalk_sg_next(current_sg);
+-		sg_index += current_sg->length;
+-	}
+-	cpy_index = sg_index - to_skip;
+-	offset = current_sg->offset + current_sg->length - cpy_index;
+-	sg_map_copy(dest, current_sg, cpy_index, offset);
+-	if (end - sg_index) {
+-		current_sg = scatterwalk_sg_next(current_sg);
+-		sg_copy(dest + cpy_index, current_sg, end - sg_index);
+-	}
+-}
+diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h
+index 9282381b03ce..fe7b3f06f6e6 100644
+--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
++++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
+@@ -198,8 +198,7 @@ struct adf_accel_dev {
+ 	struct dentry *debugfs_dir;
+ 	struct list_head list;
+ 	struct module *owner;
+-	uint8_t accel_id;
+-	uint8_t numa_node;
+ 	struct adf_accel_pci accel_pci_dev;
++	uint8_t accel_id;
+ } __packed;
+ #endif
+diff --git a/drivers/crypto/qat/qat_common/adf_transport.c b/drivers/crypto/qat/qat_common/adf_transport.c
+index 5f3fa45348b4..9dd2cb72a4e8 100644
+--- a/drivers/crypto/qat/qat_common/adf_transport.c
++++ b/drivers/crypto/qat/qat_common/adf_transport.c
+@@ -419,9 +419,10 @@ static int adf_init_bank(struct adf_accel_dev *accel_dev,
+ 		WRITE_CSR_RING_BASE(csr_addr, bank_num, i, 0);
+ 		ring = &bank->rings[i];
+ 		if (hw_data->tx_rings_mask & (1 << i)) {
+-			ring->inflights = kzalloc_node(sizeof(atomic_t),
+-						       GFP_KERNEL,
+-						       accel_dev->numa_node);
++			ring->inflights =
++				kzalloc_node(sizeof(atomic_t),
++					     GFP_KERNEL,
++					     dev_to_node(&GET_DEV(accel_dev)));
+ 			if (!ring->inflights)
+ 				goto err;
+ 		} else {
+@@ -469,13 +470,14 @@ int adf_init_etr_data(struct adf_accel_dev *accel_dev)
+ 	int i, ret;
+ 
+ 	etr_data = kzalloc_node(sizeof(*etr_data), GFP_KERNEL,
+-				accel_dev->numa_node);
++				dev_to_node(&GET_DEV(accel_dev)));
+ 	if (!etr_data)
+ 		return -ENOMEM;
+ 
+ 	num_banks = GET_MAX_BANKS(accel_dev);
+ 	size = num_banks * sizeof(struct adf_etr_bank_data);
+-	etr_data->banks = kzalloc_node(size, GFP_KERNEL, accel_dev->numa_node);
++	etr_data->banks = kzalloc_node(size, GFP_KERNEL,
++				       dev_to_node(&GET_DEV(accel_dev)));
+ 	if (!etr_data->banks) {
+ 		ret = -ENOMEM;
+ 		goto err_bank;
+diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
+index 59df48872955..f50db957b6b1 100644
+--- a/drivers/crypto/qat/qat_common/qat_algs.c
++++ b/drivers/crypto/qat/qat_common/qat_algs.c
+@@ -641,7 +641,8 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
+ 	if (unlikely(!n))
+ 		return -EINVAL;
+ 
+-	bufl = kmalloc_node(sz, GFP_ATOMIC, inst->accel_dev->numa_node);
++	bufl = kmalloc_node(sz, GFP_ATOMIC,
++			    dev_to_node(&GET_DEV(inst->accel_dev)));
+ 	if (unlikely(!bufl))
+ 		return -ENOMEM;
+ 
+@@ -650,6 +651,8 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
+ 		goto err;
+ 
+ 	for_each_sg(assoc, sg, assoc_n, i) {
++		if (!sg->length)
++			continue;
+ 		bufl->bufers[bufs].addr = dma_map_single(dev,
+ 							 sg_virt(sg),
+ 							 sg->length,
+@@ -685,7 +688,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
+ 		struct qat_alg_buf *bufers;
+ 
+ 		buflout = kmalloc_node(sz, GFP_ATOMIC,
+-				       inst->accel_dev->numa_node);
++				       dev_to_node(&GET_DEV(inst->accel_dev)));
+ 		if (unlikely(!buflout))
+ 			goto err;
+ 		bloutp = dma_map_single(dev, buflout, sz, DMA_TO_DEVICE);
+diff --git a/drivers/crypto/qat/qat_common/qat_crypto.c b/drivers/crypto/qat/qat_common/qat_crypto.c
+index 0d59bcb50de1..828f2a686aab 100644
+--- a/drivers/crypto/qat/qat_common/qat_crypto.c
++++ b/drivers/crypto/qat/qat_common/qat_crypto.c
+@@ -109,12 +109,14 @@ struct qat_crypto_instance *qat_crypto_get_instance_node(int node)
+ 
+ 	list_for_each(itr, adf_devmgr_get_head()) {
+ 		accel_dev = list_entry(itr, struct adf_accel_dev, list);
+-		if (accel_dev->numa_node == node && adf_dev_started(accel_dev))
++		if ((node == dev_to_node(&GET_DEV(accel_dev)) ||
++			dev_to_node(&GET_DEV(accel_dev)) < 0)
++				&& adf_dev_started(accel_dev))
+ 			break;
+ 		accel_dev = NULL;
+ 	}
+ 	if (!accel_dev) {
+-		pr_err("QAT: Could not find device on give node\n");
++		pr_err("QAT: Could not find device on node %d\n", node);
+ 		accel_dev = adf_devmgr_get_first();
+ 	}
+ 	if (!accel_dev || !adf_dev_started(accel_dev))
+@@ -164,7 +166,7 @@ static int qat_crypto_create_instances(struct adf_accel_dev *accel_dev)
+ 
+ 	for (i = 0; i < num_inst; i++) {
+ 		inst = kzalloc_node(sizeof(*inst), GFP_KERNEL,
+-				    accel_dev->numa_node);
++				    dev_to_node(&GET_DEV(accel_dev)));
+ 		if (!inst)
+ 			goto err;
+ 
+diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_admin.c b/drivers/crypto/qat/qat_dh895xcc/adf_admin.c
+index 978d6c56639d..53c491b59f07 100644
+--- a/drivers/crypto/qat/qat_dh895xcc/adf_admin.c
++++ b/drivers/crypto/qat/qat_dh895xcc/adf_admin.c
+@@ -108,7 +108,7 @@ int adf_init_admin_comms(struct adf_accel_dev *accel_dev)
+ 	uint64_t reg_val;
+ 
+ 	admin = kzalloc_node(sizeof(*accel_dev->admin), GFP_KERNEL,
+-			     accel_dev->numa_node);
++			     dev_to_node(&GET_DEV(accel_dev)));
+ 	if (!admin)
+ 		return -ENOMEM;
+ 	admin->virt_addr = dma_zalloc_coherent(&GET_DEV(accel_dev), PAGE_SIZE,
+diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
+index 0d0435a41be9..948f66be262b 100644
+--- a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
++++ b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
+@@ -119,21 +119,6 @@ static void adf_cleanup_accel(struct adf_accel_dev *accel_dev)
+ 	kfree(accel_dev);
+ }
+ 
+-static uint8_t adf_get_dev_node_id(struct pci_dev *pdev)
+-{
+-	unsigned int bus_per_cpu = 0;
+-	struct cpuinfo_x86 *c = &cpu_data(num_online_cpus() - 1);
+-
+-	if (!c->phys_proc_id)
+-		return 0;
+-
+-	bus_per_cpu = 256 / (c->phys_proc_id + 1);
+-
+-	if (bus_per_cpu != 0)
+-		return pdev->bus->number / bus_per_cpu;
+-	return 0;
+-}
+-
+ static int qat_dev_start(struct adf_accel_dev *accel_dev)
+ {
+ 	int cpus = num_online_cpus();
+@@ -235,7 +220,6 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	void __iomem *pmisc_bar_addr = NULL;
+ 	char name[ADF_DEVICE_NAME_LENGTH];
+ 	unsigned int i, bar_nr;
+-	uint8_t node;
+ 	int ret;
+ 
+ 	switch (ent->device) {
+@@ -246,12 +230,19 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 		return -ENODEV;
+ 	}
+ 
+-	node = adf_get_dev_node_id(pdev);
+-	accel_dev = kzalloc_node(sizeof(*accel_dev), GFP_KERNEL, node);
++	if (num_possible_nodes() > 1 && dev_to_node(&pdev->dev) < 0) {
++		/* If the accelerator is connected to a node with no memory
++		 * there is no point in using the accelerator since the remote
++		 * memory transaction will be very slow. */
++		dev_err(&pdev->dev, "Invalid NUMA configuration.\n");
++		return -EINVAL;
++	}
++
++	accel_dev = kzalloc_node(sizeof(*accel_dev), GFP_KERNEL,
++			         dev_to_node(&pdev->dev));
+ 	if (!accel_dev)
+ 		return -ENOMEM;
+ 
+-	accel_dev->numa_node = node;
+ 	INIT_LIST_HEAD(&accel_dev->crypto_list);
+ 
+ 	/* Add accel device to accel table.
+@@ -264,7 +255,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 
+ 	accel_dev->owner = THIS_MODULE;
+ 	/* Allocate and configure device configuration structure */
+-	hw_data = kzalloc_node(sizeof(*hw_data), GFP_KERNEL, node);
++	hw_data = kzalloc_node(sizeof(*hw_data), GFP_KERNEL,
++			       dev_to_node(&pdev->dev));
+ 	if (!hw_data) {
+ 		ret = -ENOMEM;
+ 		goto out_err;
+diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_isr.c b/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
+index d4172dedf775..38b80ee4e556 100644
+--- a/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
++++ b/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
+@@ -168,7 +168,7 @@ static int adf_isr_alloc_msix_entry_table(struct adf_accel_dev *accel_dev)
+ 	uint32_t msix_num_entries = hw_data->num_banks + 1;
+ 
+ 	entries = kzalloc_node(msix_num_entries * sizeof(*entries),
+-			       GFP_KERNEL, accel_dev->numa_node);
++			       GFP_KERNEL, dev_to_node(&GET_DEV(accel_dev)));
+ 	if (!entries)
+ 		return -ENOMEM;
+ 
+diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
+index 5d997a33907e..2a3973a7c441 100644
+--- a/drivers/firewire/core-cdev.c
++++ b/drivers/firewire/core-cdev.c
+@@ -1637,8 +1637,7 @@ static int dispatch_ioctl(struct client *client,
+ 	    _IOC_SIZE(cmd) > sizeof(buffer))
+ 		return -ENOTTY;
+ 
+-	if (_IOC_DIR(cmd) == _IOC_READ)
+-		memset(&buffer, 0, _IOC_SIZE(cmd));
++	memset(&buffer, 0, sizeof(buffer));
+ 
+ 	if (_IOC_DIR(cmd) & _IOC_WRITE)
+ 		if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))
+diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
+index e42925f76b4b..eff83f5c3407 100644
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
+@@ -1901,6 +1901,22 @@ static void bdw_setup_private_ppat(struct drm_i915_private *dev_priv)
+ 	      GEN8_PPAT(6, GEN8_PPAT_WB | GEN8_PPAT_LLCELLC | GEN8_PPAT_AGE(2)) |
+ 	      GEN8_PPAT(7, GEN8_PPAT_WB | GEN8_PPAT_LLCELLC | GEN8_PPAT_AGE(3));
+ 
++	if (!USES_PPGTT(dev_priv->dev))
++		/* Spec: "For GGTT, there is NO pat_sel[2:0] from the entry,
++		 * so RTL will always use the value corresponding to
++		 * pat_sel = 000".
++		 * So let's disable cache for GGTT to avoid screen corruptions.
++		 * MOCS still can be used though.
++		 * - System agent ggtt writes (i.e. cpu gtt mmaps) already work
++		 * before this patch, i.e. the same uncached + snooping access
++		 * like on gen6/7 seems to be in effect.
++		 * - So this just fixes blitter/render access. Again it looks
++		 * like it's not just uncached access, but uncached + snooping.
++		 * So we can still hold onto all our assumptions wrt cpu
++		 * clflushing on LLC machines.
++		 */
++		pat = GEN8_PPAT(0, GEN8_PPAT_UC);
++
+ 	/* XXX: spec defines this as 2 distinct registers. It's unclear if a 64b
+ 	 * write would work. */
+ 	I915_WRITE(GEN8_PRIVATE_PAT, pat);
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 9222e20e230c..4b3c09636990 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -3354,9 +3354,10 @@ intel_dp_get_dpcd(struct intel_dp *intel_dp)
+ 		}
+ 	}
+ 
+-	/* Training Pattern 3 support */
++	/* Training Pattern 3 support, both source and sink */
+ 	if (intel_dp->dpcd[DP_DPCD_REV] >= 0x12 &&
+-	    intel_dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED) {
++	    intel_dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED &&
++	    (IS_HASWELL(dev) || INTEL_INFO(dev)->gen >= 8)) {
+ 		intel_dp->use_tps3 = true;
+ 		DRM_DEBUG_KMS("Displayport TPS3 supported");
+ 	} else
+diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
+index cbe8a8de85de..0971fbf133d5 100644
+--- a/drivers/gpu/drm/i915/intel_panel.c
++++ b/drivers/gpu/drm/i915/intel_panel.c
+@@ -1074,12 +1074,25 @@ static u32 get_backlight_min_vbt(struct intel_connector *connector)
+ 	struct drm_device *dev = connector->base.dev;
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 	struct intel_panel *panel = &connector->panel;
++	int min;
+ 
+ 	WARN_ON(panel->backlight.max == 0);
+ 
++	/*
++	 * XXX: If the vbt value is 255, it makes min equal to max, which leads
++	 * to problems. There are such machines out there. Either our
++	 * interpretation is wrong or the vbt has bogus data. Or both. Safeguard
++	 * against this by letting the minimum be at most (arbitrarily chosen)
++	 * 25% of the max.
++	 */
++	min = clamp_t(int, dev_priv->vbt.backlight.min_brightness, 0, 64);
++	if (min != dev_priv->vbt.backlight.min_brightness) {
++		DRM_DEBUG_KMS("clamping VBT min backlight %d/255 to %d/255\n",
++			      dev_priv->vbt.backlight.min_brightness, min);
++	}
++
+ 	/* vbt value is a coefficient in range [0..255] */
+-	return scale(dev_priv->vbt.backlight.min_brightness, 0, 255,
+-		     0, panel->backlight.max);
++	return scale(min, 0, 255, 0, panel->backlight.max);
+ }
+ 
+ static int bdw_setup_backlight(struct intel_connector *connector)
+diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
+index 15da7ef344a4..ec1593a6a561 100644
+--- a/drivers/gpu/drm/radeon/atom.c
++++ b/drivers/gpu/drm/radeon/atom.c
+@@ -1217,7 +1217,7 @@ free:
+ 	return ret;
+ }
+ 
+-int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
++int atom_execute_table_scratch_unlocked(struct atom_context *ctx, int index, uint32_t * params)
+ {
+ 	int r;
+ 
+@@ -1238,6 +1238,15 @@ int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
+ 	return r;
+ }
+ 
++int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
++{
++	int r;
++	mutex_lock(&ctx->scratch_mutex);
++	r = atom_execute_table_scratch_unlocked(ctx, index, params);
++	mutex_unlock(&ctx->scratch_mutex);
++	return r;
++}
++
+ static int atom_iio_len[] = { 1, 2, 3, 3, 3, 3, 4, 4, 4, 3 };
+ 
+ static void atom_index_iio(struct atom_context *ctx, int base)
+diff --git a/drivers/gpu/drm/radeon/atom.h b/drivers/gpu/drm/radeon/atom.h
+index feba6b8d36b3..6d014ddb6b78 100644
+--- a/drivers/gpu/drm/radeon/atom.h
++++ b/drivers/gpu/drm/radeon/atom.h
+@@ -125,6 +125,7 @@ struct card_info {
+ struct atom_context {
+ 	struct card_info *card;
+ 	struct mutex mutex;
++	struct mutex scratch_mutex;
+ 	void *bios;
+ 	uint32_t cmd_table, data_table;
+ 	uint16_t *iio;
+@@ -145,6 +146,7 @@ extern int atom_debug;
+ 
+ struct atom_context *atom_parse(struct card_info *, void *);
+ int atom_execute_table(struct atom_context *, int, uint32_t *);
++int atom_execute_table_scratch_unlocked(struct atom_context *, int, uint32_t *);
+ int atom_asic_init(struct atom_context *);
+ void atom_destroy(struct atom_context *);
+ bool atom_parse_data_header(struct atom_context *ctx, int index, uint16_t *size,
+diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
+index ac14b67621d3..9074662d8f89 100644
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -100,6 +100,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
+ 	memset(&args, 0, sizeof(args));
+ 
+ 	mutex_lock(&chan->mutex);
++	mutex_lock(&rdev->mode_info.atom_context->scratch_mutex);
+ 
+ 	base = (unsigned char *)(rdev->mode_info.atom_context->scratch + 1);
+ 
+@@ -113,7 +114,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
+ 	if (ASIC_IS_DCE4(rdev))
+ 		args.v2.ucHPD_ID = chan->rec.hpd;
+ 
+-	atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
++	atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+ 
+ 	*ack = args.v1.ucReplyStatus;
+ 
+@@ -147,6 +148,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
+ 
+ 	r = recv_bytes;
+ done:
++	mutex_unlock(&rdev->mode_info.atom_context->scratch_mutex);
+ 	mutex_unlock(&chan->mutex);
+ 
+ 	return r;
+diff --git a/drivers/gpu/drm/radeon/atombios_i2c.c b/drivers/gpu/drm/radeon/atombios_i2c.c
+index 9c570fb15b8c..4157780585a0 100644
+--- a/drivers/gpu/drm/radeon/atombios_i2c.c
++++ b/drivers/gpu/drm/radeon/atombios_i2c.c
+@@ -48,6 +48,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
+ 	memset(&args, 0, sizeof(args));
+ 
+ 	mutex_lock(&chan->mutex);
++	mutex_lock(&rdev->mode_info.atom_context->scratch_mutex);
+ 
+ 	base = (unsigned char *)rdev->mode_info.atom_context->scratch;
+ 
+@@ -82,7 +83,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
+ 	args.ucSlaveAddr = slave_addr << 1;
+ 	args.ucLineNumber = chan->rec.i2c_id;
+ 
+-	atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
++	atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+ 
+ 	/* error */
+ 	if (args.ucStatus != HW_ASSISTED_I2C_STATUS_SUCCESS) {
+@@ -95,6 +96,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
+ 		radeon_atom_copy_swap(buf, base, num, false);
+ 
+ done:
++	mutex_unlock(&rdev->mode_info.atom_context->scratch_mutex);
+ 	mutex_unlock(&chan->mutex);
+ 
+ 	return r;
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 3d546c606b43..32d8cef2d230 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -4315,8 +4315,8 @@ static int cik_cp_gfx_start(struct radeon_device *rdev)
+ 	/* init the CE partitions.  CE only used for gfx on CIK */
+ 	radeon_ring_write(ring, PACKET3(PACKET3_SET_BASE, 2));
+ 	radeon_ring_write(ring, PACKET3_BASE_INDEX(CE_PARTITION_BASE));
+-	radeon_ring_write(ring, 0xc000);
+-	radeon_ring_write(ring, 0xc000);
++	radeon_ring_write(ring, 0x8000);
++	radeon_ring_write(ring, 0x8000);
+ 
+ 	/* setup clear context state */
+ 	radeon_ring_write(ring, PACKET3(PACKET3_PREAMBLE_CNTL, 0));
+@@ -9447,6 +9447,9 @@ void dce8_bandwidth_update(struct radeon_device *rdev)
+ 	u32 num_heads = 0, lb_size;
+ 	int i;
+ 
++	if (!rdev->mode_info.mode_config_initialized)
++		return;
++
+ 	radeon_update_display_priority(rdev);
+ 
+ 	for (i = 0; i < rdev->num_crtc; i++) {
+diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
+index e8eea36b52d1..dd0c4919ea0e 100644
+--- a/drivers/gpu/drm/radeon/cik_sdma.c
++++ b/drivers/gpu/drm/radeon/cik_sdma.c
+@@ -666,17 +666,20 @@ int cik_sdma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
+ {
+ 	struct radeon_ib ib;
+ 	unsigned i;
++	unsigned index;
+ 	int r;
+-	void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
+ 	u32 tmp = 0;
++	u64 gpu_addr;
+ 
+-	if (!ptr) {
+-		DRM_ERROR("invalid vram scratch pointer\n");
+-		return -EINVAL;
+-	}
++	if (ring->idx == R600_RING_TYPE_DMA_INDEX)
++		index = R600_WB_DMA_RING_TEST_OFFSET;
++	else
++		index = CAYMAN_WB_DMA1_RING_TEST_OFFSET;
++
++	gpu_addr = rdev->wb.gpu_addr + index;
+ 
+ 	tmp = 0xCAFEDEAD;
+-	writel(tmp, ptr);
++	rdev->wb.wb[index/4] = cpu_to_le32(tmp);
+ 
+ 	r = radeon_ib_get(rdev, ring->idx, &ib, NULL, 256);
+ 	if (r) {
+@@ -685,8 +688,8 @@ int cik_sdma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
+ 	}
+ 
+ 	ib.ptr[0] = SDMA_PACKET(SDMA_OPCODE_WRITE, SDMA_WRITE_SUB_OPCODE_LINEAR, 0);
+-	ib.ptr[1] = rdev->vram_scratch.gpu_addr & 0xfffffffc;
+-	ib.ptr[2] = upper_32_bits(rdev->vram_scratch.gpu_addr);
++	ib.ptr[1] = lower_32_bits(gpu_addr);
++	ib.ptr[2] = upper_32_bits(gpu_addr);
+ 	ib.ptr[3] = 1;
+ 	ib.ptr[4] = 0xDEADBEEF;
+ 	ib.length_dw = 5;
+@@ -703,7 +706,7 @@ int cik_sdma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
+ 		return r;
+ 	}
+ 	for (i = 0; i < rdev->usec_timeout; i++) {
+-		tmp = readl(ptr);
++		tmp = le32_to_cpu(rdev->wb.wb[index/4]);
+ 		if (tmp == 0xDEADBEEF)
+ 			break;
+ 		DRM_UDELAY(1);
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index e50807c29f69..5d18cfe60e1f 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -2346,6 +2346,9 @@ void evergreen_bandwidth_update(struct radeon_device *rdev)
+ 	u32 num_heads = 0, lb_size;
+ 	int i;
+ 
++	if (!rdev->mode_info.mode_config_initialized)
++		return;
++
+ 	radeon_update_display_priority(rdev);
+ 
+ 	for (i = 0; i < rdev->num_crtc; i++) {
+@@ -2553,6 +2556,7 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
+ 					WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
+ 					tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
+ 					WREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i], tmp);
++					WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
+ 				}
+ 			} else {
+ 				tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
+diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
+index b0098e792e62..6a5518f98296 100644
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -3204,6 +3204,9 @@ void r100_bandwidth_update(struct radeon_device *rdev)
+ 	uint32_t pixel_bytes1 = 0;
+ 	uint32_t pixel_bytes2 = 0;
+ 
++	if (!rdev->mode_info.mode_config_initialized)
++		return;
++
+ 	radeon_update_display_priority(rdev);
+ 
+ 	if (rdev->mode_info.crtcs[0]->base.enabled) {
+diff --git a/drivers/gpu/drm/radeon/r600_dma.c b/drivers/gpu/drm/radeon/r600_dma.c
+index 44379bfca61f..5ef501bc9dc6 100644
+--- a/drivers/gpu/drm/radeon/r600_dma.c
++++ b/drivers/gpu/drm/radeon/r600_dma.c
+@@ -338,17 +338,17 @@ int r600_dma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
+ {
+ 	struct radeon_ib ib;
+ 	unsigned i;
++	unsigned index;
+ 	int r;
+-	void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
+ 	u32 tmp = 0;
++	u64 gpu_addr;
+ 
+-	if (!ptr) {
+-		DRM_ERROR("invalid vram scratch pointer\n");
+-		return -EINVAL;
+-	}
++	if (ring->idx == R600_RING_TYPE_DMA_INDEX)
++		index = R600_WB_DMA_RING_TEST_OFFSET;
++	else
++		index = CAYMAN_WB_DMA1_RING_TEST_OFFSET;
+ 
+-	tmp = 0xCAFEDEAD;
+-	writel(tmp, ptr);
++	gpu_addr = rdev->wb.gpu_addr + index;
+ 
+ 	r = radeon_ib_get(rdev, ring->idx, &ib, NULL, 256);
+ 	if (r) {
+@@ -357,8 +357,8 @@ int r600_dma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
+ 	}
+ 
+ 	ib.ptr[0] = DMA_PACKET(DMA_PACKET_WRITE, 0, 0, 1);
+-	ib.ptr[1] = rdev->vram_scratch.gpu_addr & 0xfffffffc;
+-	ib.ptr[2] = upper_32_bits(rdev->vram_scratch.gpu_addr) & 0xff;
++	ib.ptr[1] = lower_32_bits(gpu_addr);
++	ib.ptr[2] = upper_32_bits(gpu_addr) & 0xff;
+ 	ib.ptr[3] = 0xDEADBEEF;
+ 	ib.length_dw = 4;
+ 
+@@ -374,7 +374,7 @@ int r600_dma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
+ 		return r;
+ 	}
+ 	for (i = 0; i < rdev->usec_timeout; i++) {
+-		tmp = readl(ptr);
++		tmp = le32_to_cpu(rdev->wb.wb[index/4]);
+ 		if (tmp == 0xDEADBEEF)
+ 			break;
+ 		DRM_UDELAY(1);
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index 6684fbf09929..5d4416fbf124 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -952,6 +952,7 @@ int radeon_atombios_init(struct radeon_device *rdev)
+ 	}
+ 
+ 	mutex_init(&rdev->mode_info.atom_context->mutex);
++	mutex_init(&rdev->mode_info.atom_context->scratch_mutex);
+ 	radeon_atom_initialize_bios_scratch_regs(rdev->ddev);
+ 	atom_allocate_fb_scratch(rdev->mode_info.atom_context);
+ 	return 0;
+diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
+index 5f6db4629aaa..9acb1c3c005b 100644
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -879,6 +879,9 @@ void rs600_bandwidth_update(struct radeon_device *rdev)
+ 	u32 d1mode_priority_a_cnt, d2mode_priority_a_cnt;
+ 	/* FIXME: implement full support */
+ 
++	if (!rdev->mode_info.mode_config_initialized)
++		return;
++
+ 	radeon_update_display_priority(rdev);
+ 
+ 	if (rdev->mode_info.crtcs[0]->base.enabled)
+diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
+index 3462b64369bf..0a2d36e81108 100644
+--- a/drivers/gpu/drm/radeon/rs690.c
++++ b/drivers/gpu/drm/radeon/rs690.c
+@@ -579,6 +579,9 @@ void rs690_bandwidth_update(struct radeon_device *rdev)
+ 	u32 d1mode_priority_a_cnt, d1mode_priority_b_cnt;
+ 	u32 d2mode_priority_a_cnt, d2mode_priority_b_cnt;
+ 
++	if (!rdev->mode_info.mode_config_initialized)
++		return;
++
+ 	radeon_update_display_priority(rdev);
+ 
+ 	if (rdev->mode_info.crtcs[0]->base.enabled)
+diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
+index 8a477bf1fdb3..c55d653aaf5f 100644
+--- a/drivers/gpu/drm/radeon/rv515.c
++++ b/drivers/gpu/drm/radeon/rv515.c
+@@ -1277,6 +1277,9 @@ void rv515_bandwidth_update(struct radeon_device *rdev)
+ 	struct drm_display_mode *mode0 = NULL;
+ 	struct drm_display_mode *mode1 = NULL;
+ 
++	if (!rdev->mode_info.mode_config_initialized)
++		return;
++
+ 	radeon_update_display_priority(rdev);
+ 
+ 	if (rdev->mode_info.crtcs[0]->base.enabled)
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 3a0b973e8a96..7f13a824a613 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -2384,6 +2384,9 @@ void dce6_bandwidth_update(struct radeon_device *rdev)
+ 	u32 num_heads = 0, lb_size;
+ 	int i;
+ 
++	if (!rdev->mode_info.mode_config_initialized)
++		return;
++
+ 	radeon_update_display_priority(rdev);
+ 
+ 	for (i = 0; i < rdev->num_crtc; i++) {
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index 0600c50e6215..5ba2a86aab6a 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -2518,6 +2518,8 @@ ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
+ 	attr.grh.sgid_index    = cmd.attr.grh.sgid_index;
+ 	attr.grh.hop_limit     = cmd.attr.grh.hop_limit;
+ 	attr.grh.traffic_class = cmd.attr.grh.traffic_class;
++	attr.vlan_id           = 0;
++	memset(&attr.dmac, 0, sizeof(attr.dmac));
+ 	memcpy(attr.grh.dgid.raw, cmd.attr.grh.dgid, 16);
+ 
+ 	ah = ib_create_ah(pd, &attr);
+diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
+index 2b0ae8cc8e51..d125a019383f 100644
+--- a/drivers/input/mouse/alps.c
++++ b/drivers/input/mouse/alps.c
+@@ -1156,7 +1156,13 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
+ {
+ 	struct alps_data *priv = psmouse->private;
+ 
+-	if ((psmouse->packet[0] & 0xc8) == 0x08) { /* PS/2 packet */
++	/*
++	 * Check if we are dealing with a bare PS/2 packet, presumably from
++	 * a device connected to the external PS/2 port. Because bare PS/2
++	 * protocol does not have enough constant bits to self-synchronize
++	 * properly we only do this if the device is fully synchronized.
++	 */
++	if (!psmouse->out_of_sync_cnt && (psmouse->packet[0] & 0xc8) == 0x08) {
+ 		if (psmouse->pktcnt == 3) {
+ 			alps_report_bare_ps2_packet(psmouse, psmouse->packet,
+ 						    true);
+@@ -1180,12 +1186,27 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
+ 	}
+ 
+ 	/* Bytes 2 - pktsize should have 0 in the highest bit */
+-	if ((priv->proto_version < ALPS_PROTO_V5) &&
++	if (priv->proto_version < ALPS_PROTO_V5 &&
+ 	    psmouse->pktcnt >= 2 && psmouse->pktcnt <= psmouse->pktsize &&
+ 	    (psmouse->packet[psmouse->pktcnt - 1] & 0x80)) {
+ 		psmouse_dbg(psmouse, "refusing packet[%i] = %x\n",
+ 			    psmouse->pktcnt - 1,
+ 			    psmouse->packet[psmouse->pktcnt - 1]);
++
++		if (priv->proto_version == ALPS_PROTO_V3 &&
++		    psmouse->pktcnt == psmouse->pktsize) {
++			/*
++			 * Some Dell boxes, such as Latitude E6440 or E7440
++			 * with closed lid, quite often smash last byte of
++			 * otherwise valid packet with 0xff. Given that the
++			 * next packet is very likely to be valid let's
++			 * report PSMOUSE_FULL_PACKET but not process data,
++			 * rather than reporting PSMOUSE_BAD_DATA and
++			 * filling the logs.
++			 */
++			return PSMOUSE_FULL_PACKET;
++		}
++
+ 		return PSMOUSE_BAD_DATA;
+ 	}
+ 
+@@ -2389,6 +2410,9 @@ int alps_init(struct psmouse *psmouse)
+ 	/* We are having trouble resyncing ALPS touchpads so disable it for now */
+ 	psmouse->resync_time = 0;
+ 
++	/* Allow 2 invalid packets without resetting device */
++	psmouse->resetafter = psmouse->pktsize * 2;
++
+ 	return 0;
+ 
+ init_fail:
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index b5b630c484c5..2e8f3ba7b2bd 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -135,8 +135,8 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
+ 		1232, 5710, 1156, 4696
+ 	},
+ 	{
+-		(const char * const []){"LEN0034", "LEN0036", "LEN2002",
+-					"LEN2004", NULL},
++		(const char * const []){"LEN0034", "LEN0036", "LEN0039",
++					"LEN2002", "LEN2004", NULL},
+ 		1024, 5112, 2024, 4832
+ 	},
+ 	{
+@@ -163,6 +163,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
+ 	"LEN0036", /* T440 */
+ 	"LEN0037",
+ 	"LEN0038",
++	"LEN0039", /* T440s */
+ 	"LEN0041",
+ 	"LEN0042", /* Yoga */
+ 	"LEN0045",
+diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
+index 9ea5b6041eb2..0be200b6dbf2 100644
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -1435,9 +1435,9 @@ static void drop_buffers(struct dm_bufio_client *c)
+ 
+ /*
+  * Test if the buffer is unused and too old, and commit it.
+- * At if noio is set, we must not do any I/O because we hold
+- * dm_bufio_clients_lock and we would risk deadlock if the I/O gets rerouted to
+- * different bufio client.
++ * And if GFP_NOFS is used, we must not do any I/O because we hold
++ * dm_bufio_clients_lock and we would risk deadlock if the I/O gets
++ * rerouted to different bufio client.
+  */
+ static int __cleanup_old_buffer(struct dm_buffer *b, gfp_t gfp,
+ 				unsigned long max_jiffies)
+@@ -1445,7 +1445,7 @@ static int __cleanup_old_buffer(struct dm_buffer *b, gfp_t gfp,
+ 	if (jiffies - b->last_accessed < max_jiffies)
+ 		return 0;
+ 
+-	if (!(gfp & __GFP_IO)) {
++	if (!(gfp & __GFP_FS)) {
+ 		if (test_bit(B_READING, &b->state) ||
+ 		    test_bit(B_WRITING, &b->state) ||
+ 		    test_bit(B_DIRTY, &b->state))
+@@ -1487,7 +1487,7 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ 	unsigned long freed;
+ 
+ 	c = container_of(shrink, struct dm_bufio_client, shrinker);
+-	if (sc->gfp_mask & __GFP_IO)
++	if (sc->gfp_mask & __GFP_FS)
+ 		dm_bufio_lock(c);
+ 	else if (!dm_bufio_trylock(c))
+ 		return SHRINK_STOP;
+@@ -1504,7 +1504,7 @@ dm_bufio_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
+ 	unsigned long count;
+ 
+ 	c = container_of(shrink, struct dm_bufio_client, shrinker);
+-	if (sc->gfp_mask & __GFP_IO)
++	if (sc->gfp_mask & __GFP_FS)
+ 		dm_bufio_lock(c);
+ 	else if (!dm_bufio_trylock(c))
+ 		return 0;
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index 4880b69e2e9e..59715389b3cf 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -785,8 +785,7 @@ struct dm_raid_superblock {
+ 	__le32 layout;
+ 	__le32 stripe_sectors;
+ 
+-	__u8 pad[452];		/* Round struct to 512 bytes. */
+-				/* Always set to 0 when writing. */
++	/* Remainder of a logical block is zero-filled when writing (see super_sync()). */
+ } __packed;
+ 
+ static int read_disk_sb(struct md_rdev *rdev, int size)
+@@ -823,7 +822,7 @@ static void super_sync(struct mddev *mddev, struct md_rdev *rdev)
+ 		    test_bit(Faulty, &(rs->dev[i].rdev.flags)))
+ 			failed_devices |= (1ULL << i);
+ 
+-	memset(sb, 0, sizeof(*sb));
++	memset(sb + 1, 0, rdev->sb_size - sizeof(*sb));
+ 
+ 	sb->magic = cpu_to_le32(DM_RAID_MAGIC);
+ 	sb->features = cpu_to_le32(0);	/* No features yet */
+@@ -858,7 +857,11 @@ static int super_load(struct md_rdev *rdev, struct md_rdev *refdev)
+ 	uint64_t events_sb, events_refsb;
+ 
+ 	rdev->sb_start = 0;
+-	rdev->sb_size = sizeof(*sb);
++	rdev->sb_size = bdev_logical_block_size(rdev->meta_bdev);
++	if (rdev->sb_size < sizeof(*sb) || rdev->sb_size > PAGE_SIZE) {
++		DMERR("superblock size of a logical block is no longer valid");
++		return -EINVAL;
++	}
+ 
+ 	ret = read_disk_sb(rdev, rdev->sb_size);
+ 	if (ret)
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 4843801173fe..0f86d802b533 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -1936,6 +1936,14 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
+ 		return DM_MAPIO_SUBMITTED;
+ 	}
+ 
++	/*
++	 * We must hold the virtual cell before doing the lookup, otherwise
++	 * there's a race with discard.
++	 */
++	build_virtual_key(tc->td, block, &key);
++	if (dm_bio_detain(tc->pool->prison, &key, bio, &cell1, &cell_result))
++		return DM_MAPIO_SUBMITTED;
++
+ 	r = dm_thin_find_block(td, block, 0, &result);
+ 
+ 	/*
+@@ -1959,13 +1967,10 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
+ 			 * shared flag will be set in their case.
+ 			 */
+ 			thin_defer_bio(tc, bio);
++			cell_defer_no_holder_no_free(tc, &cell1);
+ 			return DM_MAPIO_SUBMITTED;
+ 		}
+ 
+-		build_virtual_key(tc->td, block, &key);
+-		if (dm_bio_detain(tc->pool->prison, &key, bio, &cell1, &cell_result))
+-			return DM_MAPIO_SUBMITTED;
+-
+ 		build_data_key(tc->td, result.block, &key);
+ 		if (dm_bio_detain(tc->pool->prison, &key, bio, &cell2, &cell_result)) {
+ 			cell_defer_no_holder_no_free(tc, &cell1);
+@@ -1986,6 +1991,7 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
+ 			 * of doing so.
+ 			 */
+ 			handle_unserviceable_bio(tc->pool, bio);
++			cell_defer_no_holder_no_free(tc, &cell1);
+ 			return DM_MAPIO_SUBMITTED;
+ 		}
+ 		/* fall through */
+@@ -1996,6 +2002,7 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
+ 		 * provide the hint to load the metadata into cache.
+ 		 */
+ 		thin_defer_bio(tc, bio);
++		cell_defer_no_holder_no_free(tc, &cell1);
+ 		return DM_MAPIO_SUBMITTED;
+ 
+ 	default:
+@@ -2005,6 +2012,7 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
+ 		 * pool is switched to fail-io mode.
+ 		 */
+ 		bio_io_error(bio);
++		cell_defer_no_holder_no_free(tc, &cell1);
+ 		return DM_MAPIO_SUBMITTED;
+ 	}
+ }
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 1294238610df..b7f603c2a7d4 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -5313,6 +5313,7 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)
+ 		printk("md: %s still in use.\n",mdname(mddev));
+ 		if (did_freeze) {
+ 			clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
++			set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
+ 			md_wakeup_thread(mddev->thread);
+ 		}
+ 		err = -EBUSY;
+@@ -5327,6 +5328,8 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)
+ 		mddev->ro = 1;
+ 		set_disk_ro(mddev->gendisk, 1);
+ 		clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
++		set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
++		md_wakeup_thread(mddev->thread);
+ 		sysfs_notify_dirent_safe(mddev->sysfs_state);
+ 		err = 0;
+ 	}
+@@ -5370,6 +5373,7 @@ static int do_md_stop(struct mddev * mddev, int mode,
+ 		mutex_unlock(&mddev->open_mutex);
+ 		if (did_freeze) {
+ 			clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
++			set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
+ 			md_wakeup_thread(mddev->thread);
+ 		}
+ 		return -EBUSY;
+diff --git a/drivers/md/persistent-data/dm-btree-internal.h b/drivers/md/persistent-data/dm-btree-internal.h
+index 37d367bb9aa8..bf2b80d5c470 100644
+--- a/drivers/md/persistent-data/dm-btree-internal.h
++++ b/drivers/md/persistent-data/dm-btree-internal.h
+@@ -42,6 +42,12 @@ struct btree_node {
+ } __packed;
+ 
+ 
++/*
++ * Locks a block using the btree node validator.
++ */
++int bn_read_lock(struct dm_btree_info *info, dm_block_t b,
++		 struct dm_block **result);
++
+ void inc_children(struct dm_transaction_manager *tm, struct btree_node *n,
+ 		  struct dm_btree_value_type *vt);
+ 
+diff --git a/drivers/md/persistent-data/dm-btree-spine.c b/drivers/md/persistent-data/dm-btree-spine.c
+index cf9fd676ae44..1b5e13ec7f96 100644
+--- a/drivers/md/persistent-data/dm-btree-spine.c
++++ b/drivers/md/persistent-data/dm-btree-spine.c
+@@ -92,7 +92,7 @@ struct dm_block_validator btree_node_validator = {
+ 
+ /*----------------------------------------------------------------*/
+ 
+-static int bn_read_lock(struct dm_btree_info *info, dm_block_t b,
++int bn_read_lock(struct dm_btree_info *info, dm_block_t b,
+ 		 struct dm_block **result)
+ {
+ 	return dm_tm_read_lock(info->tm, b, &btree_node_validator, result);
+diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
+index 416060c25709..200ac12a1d40 100644
+--- a/drivers/md/persistent-data/dm-btree.c
++++ b/drivers/md/persistent-data/dm-btree.c
+@@ -847,22 +847,26 @@ EXPORT_SYMBOL_GPL(dm_btree_find_lowest_key);
+  * FIXME: We shouldn't use a recursive algorithm when we have limited stack
+  * space.  Also this only works for single level trees.
+  */
+-static int walk_node(struct ro_spine *s, dm_block_t block,
++static int walk_node(struct dm_btree_info *info, dm_block_t block,
+ 		     int (*fn)(void *context, uint64_t *keys, void *leaf),
+ 		     void *context)
+ {
+ 	int r;
+ 	unsigned i, nr;
++	struct dm_block *node;
+ 	struct btree_node *n;
+ 	uint64_t keys;
+ 
+-	r = ro_step(s, block);
+-	n = ro_node(s);
++	r = bn_read_lock(info, block, &node);
++	if (r)
++		return r;
++
++	n = dm_block_data(node);
+ 
+ 	nr = le32_to_cpu(n->header.nr_entries);
+ 	for (i = 0; i < nr; i++) {
+ 		if (le32_to_cpu(n->header.flags) & INTERNAL_NODE) {
+-			r = walk_node(s, value64(n, i), fn, context);
++			r = walk_node(info, value64(n, i), fn, context);
+ 			if (r)
+ 				goto out;
+ 		} else {
+@@ -874,7 +878,7 @@ static int walk_node(struct ro_spine *s, dm_block_t block,
+ 	}
+ 
+ out:
+-	ro_pop(s);
++	dm_tm_unlock(info->tm, node);
+ 	return r;
+ }
+ 
+@@ -882,15 +886,7 @@ int dm_btree_walk(struct dm_btree_info *info, dm_block_t root,
+ 		  int (*fn)(void *context, uint64_t *keys, void *leaf),
+ 		  void *context)
+ {
+-	int r;
+-	struct ro_spine spine;
+-
+ 	BUG_ON(info->levels > 1);
+-
+-	init_ro_spine(&spine, info);
+-	r = walk_node(&spine, root, fn, context);
+-	exit_ro_spine(&spine);
+-
+-	return r;
++	return walk_node(info, root, fn, context);
+ }
+ EXPORT_SYMBOL_GPL(dm_btree_walk);
+diff --git a/drivers/media/usb/ttusb-dec/ttusbdecfe.c b/drivers/media/usb/ttusb-dec/ttusbdecfe.c
+index 5c45c9d0712d..9c29552aedec 100644
+--- a/drivers/media/usb/ttusb-dec/ttusbdecfe.c
++++ b/drivers/media/usb/ttusb-dec/ttusbdecfe.c
+@@ -156,6 +156,9 @@ static int ttusbdecfe_dvbs_diseqc_send_master_cmd(struct dvb_frontend* fe, struc
+ 		   0x00, 0x00, 0x00, 0x00,
+ 		   0x00, 0x00 };
+ 
++	if (cmd->msg_len > sizeof(b) - 4)
++		return -EINVAL;
++
+ 	memcpy(&b[4], cmd->msg, cmd->msg_len);
+ 
+ 	state->config->send_command(fe, 0x72,
+diff --git a/drivers/mfd/max77693.c b/drivers/mfd/max77693.c
+index 249c139ef04a..dabb0241813c 100644
+--- a/drivers/mfd/max77693.c
++++ b/drivers/mfd/max77693.c
+@@ -237,7 +237,7 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
+ 		goto err_irq_charger;
+ 	}
+ 
+-	ret = regmap_add_irq_chip(max77693->regmap, max77693->irq,
++	ret = regmap_add_irq_chip(max77693->regmap_muic, max77693->irq,
+ 				IRQF_ONESHOT | IRQF_SHARED |
+ 				IRQF_TRIGGER_FALLING, 0,
+ 				&max77693_muic_irq_chip,
+@@ -247,6 +247,17 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
+ 		goto err_irq_muic;
+ 	}
+ 
++	/* Unmask interrupts from all blocks in interrupt source register */
++	ret = regmap_update_bits(max77693->regmap,
++				MAX77693_PMIC_REG_INTSRC_MASK,
++				SRC_IRQ_ALL, (unsigned int)~SRC_IRQ_ALL);
++	if (ret < 0) {
++		dev_err(max77693->dev,
++			"Could not unmask interrupts in INTSRC: %d\n",
++			ret);
++		goto err_intsrc;
++	}
++
+ 	pm_runtime_set_active(max77693->dev);
+ 
+ 	ret = mfd_add_devices(max77693->dev, -1, max77693_devs,
+@@ -258,6 +269,7 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
+ 
+ err_mfd:
+ 	mfd_remove_devices(max77693->dev);
++err_intsrc:
+ 	regmap_del_irq_chip(max77693->irq, max77693->irq_data_muic);
+ err_irq_muic:
+ 	regmap_del_irq_chip(max77693->irq, max77693->irq_data_charger);
+diff --git a/drivers/mfd/twl4030-power.c b/drivers/mfd/twl4030-power.c
+index 4d3ff3771491..542f1a8247f5 100644
+--- a/drivers/mfd/twl4030-power.c
++++ b/drivers/mfd/twl4030-power.c
+@@ -44,6 +44,15 @@ static u8 twl4030_start_script_address = 0x2b;
+ #define PWR_DEVSLP		BIT(1)
+ #define PWR_DEVOFF		BIT(0)
+ 
++/* Register bits for CFG_P1_TRANSITION (also for P2 and P3) */
++#define STARTON_SWBUG		BIT(7)	/* Start on watchdog */
++#define STARTON_VBUS		BIT(5)	/* Start on VBUS */
++#define STARTON_VBAT		BIT(4)	/* Start on battery insert */
++#define STARTON_RTC		BIT(3)	/* Start on RTC */
++#define STARTON_USB		BIT(2)	/* Start on USB host */
++#define STARTON_CHG		BIT(1)	/* Start on charger */
++#define STARTON_PWON		BIT(0)	/* Start on PWRON button */
++
+ #define SEQ_OFFSYNC		(1 << 0)
+ 
+ #define PHY_TO_OFF_PM_MASTER(p)		(p - 0x36)
+@@ -606,6 +615,44 @@ twl4030_power_configure_resources(const struct twl4030_power_data *pdata)
+ 	return 0;
+ }
+ 
++static int twl4030_starton_mask_and_set(u8 bitmask, u8 bitvalues)
++{
++	u8 regs[3] = { TWL4030_PM_MASTER_CFG_P1_TRANSITION,
++		       TWL4030_PM_MASTER_CFG_P2_TRANSITION,
++		       TWL4030_PM_MASTER_CFG_P3_TRANSITION, };
++	u8 val;
++	int i, err;
++
++	err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER, TWL4030_PM_MASTER_KEY_CFG1,
++			       TWL4030_PM_MASTER_PROTECT_KEY);
++	if (err)
++		goto relock;
++	err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER,
++			       TWL4030_PM_MASTER_KEY_CFG2,
++			       TWL4030_PM_MASTER_PROTECT_KEY);
++	if (err)
++		goto relock;
++
++	for (i = 0; i < sizeof(regs); i++) {
++		err = twl_i2c_read_u8(TWL_MODULE_PM_MASTER,
++				      &val, regs[i]);
++		if (err)
++			break;
++		val = (~bitmask & val) | (bitmask & bitvalues);
++		err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER,
++				       val, regs[i]);
++		if (err)
++			break;
++	}
++
++	if (err)
++		pr_err("TWL4030 Register access failed: %i\n", err);
++
++relock:
++	return twl_i2c_write_u8(TWL_MODULE_PM_MASTER, 0,
++				TWL4030_PM_MASTER_PROTECT_KEY);
++}
++
+ /*
+  * In master mode, start the power off sequence.
+  * After a successful execution, TWL shuts down the power to the SoC
+@@ -615,6 +662,11 @@ void twl4030_power_off(void)
+ {
+ 	int err;
+ 
++	/* Disable start on charger or VBUS as it can break poweroff */
++	err = twl4030_starton_mask_and_set(STARTON_VBUS | STARTON_CHG, 0);
++	if (err)
++		pr_err("TWL4030 Unable to configure start-up\n");
++
+ 	err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER, PWR_DEVOFF,
+ 			       TWL4030_PM_MASTER_P1_SW_EVENTS);
+ 	if (err)
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 71068d7d930d..ce60b960cd6c 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -1384,6 +1384,9 @@ static void bcm_sysport_netif_start(struct net_device *dev)
+ 	/* Enable NAPI */
+ 	napi_enable(&priv->napi);
+ 
++	/* Enable RX interrupt and TX ring full interrupt */
++	intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL);
++
+ 	phy_start(priv->phydev);
+ 
+ 	/* Enable TX interrupts for the 32 TXQs */
+@@ -1486,9 +1489,6 @@ static int bcm_sysport_open(struct net_device *dev)
+ 	if (ret)
+ 		goto out_free_rx_ring;
+ 
+-	/* Enable RX interrupt and TX ring full interrupt */
+-	intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL);
+-
+ 	/* Turn on TDMA */
+ 	ret = tdma_enable_set(priv, 1);
+ 	if (ret)
+@@ -1845,6 +1845,8 @@ static int bcm_sysport_resume(struct device *d)
+ 	if (!netif_running(dev))
+ 		return 0;
+ 
++	umac_reset(priv);
++
+ 	/* We may have been suspended and never received a WOL event that
+ 	 * would turn off MPD detection, take care of that now
+ 	 */
+@@ -1872,9 +1874,6 @@ static int bcm_sysport_resume(struct device *d)
+ 
+ 	netif_device_attach(dev);
+ 
+-	/* Enable RX interrupt and TX ring full interrupt */
+-	intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL);
+-
+ 	/* RX pipe enable */
+ 	topctrl_writel(priv, 0, RX_FLUSH_CNTL);
+ 
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
+index 8edf0f5bd679..d4cc9b0c07f5 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
+@@ -80,7 +80,6 @@ void cxgb4_dcb_state_fsm(struct net_device *dev,
+ 			/* we're going to use Host DCB */
+ 			dcb->state = CXGB4_DCB_STATE_HOST;
+ 			dcb->supported = CXGB4_DCBX_HOST_SUPPORT;
+-			dcb->enabled = 1;
+ 			break;
+ 		}
+ 
+@@ -349,6 +348,12 @@ static u8 cxgb4_setstate(struct net_device *dev, u8 enabled)
+ {
+ 	struct port_info *pi = netdev2pinfo(dev);
+ 
++	/* If DCBx is host-managed, dcb is enabled by outside lldp agents */
++	if (pi->dcb.state == CXGB4_DCB_STATE_HOST) {
++		pi->dcb.enabled = enabled;
++		return 0;
++	}
++
+ 	/* Firmware doesn't provide any mechanism to control the DCB state.
+ 	 */
+ 	if (enabled != (pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED))
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+index fac3821cef87..9f5f3c313993 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -688,7 +688,11 @@ int cxgb4_dcb_enabled(const struct net_device *dev)
+ #ifdef CONFIG_CHELSIO_T4_DCB
+ 	struct port_info *pi = netdev_priv(dev);
+ 
+-	return pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED;
++	if (!pi->dcb.enabled)
++		return 0;
++
++	return ((pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED) ||
++		(pi->dcb.state == CXGB4_DCB_STATE_HOST));
+ #else
+ 	return 0;
+ #endif
+diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
+index b151a949f352..d44560d1d268 100644
+--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
++++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
+@@ -1047,7 +1047,6 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
+ 		int tx_index;
+ 		struct tx_desc *desc;
+ 		u32 cmd_sts;
+-		struct sk_buff *skb;
+ 
+ 		tx_index = txq->tx_used_desc;
+ 		desc = &txq->tx_desc_area[tx_index];
+@@ -1066,19 +1065,22 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
+ 		reclaimed++;
+ 		txq->tx_desc_count--;
+ 
+-		skb = NULL;
+-		if (cmd_sts & TX_LAST_DESC)
+-			skb = __skb_dequeue(&txq->tx_skb);
++		if (!IS_TSO_HEADER(txq, desc->buf_ptr))
++			dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
++					 desc->byte_cnt, DMA_TO_DEVICE);
++
++		if (cmd_sts & TX_ENABLE_INTERRUPT) {
++			struct sk_buff *skb = __skb_dequeue(&txq->tx_skb);
++
++			if (!WARN_ON(!skb))
++				dev_kfree_skb(skb);
++		}
+ 
+ 		if (cmd_sts & ERROR_SUMMARY) {
+ 			netdev_info(mp->dev, "tx error\n");
+ 			mp->dev->stats.tx_errors++;
+ 		}
+ 
+-		if (!IS_TSO_HEADER(txq, desc->buf_ptr))
+-			dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
+-					 desc->byte_cnt, DMA_TO_DEVICE);
+-		dev_kfree_skb(skb);
+ 	}
+ 
+ 	__netif_tx_unlock_bh(nq);
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index 5e13fa5524ae..a4400035681f 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -1342,6 +1342,42 @@ static void smsc911x_rx_multicast_update_workaround(struct smsc911x_data *pdata)
+ 	spin_unlock(&pdata->mac_lock);
+ }
+ 
++static int smsc911x_phy_general_power_up(struct smsc911x_data *pdata)
++{
++	int rc = 0;
++
++	if (!pdata->phy_dev)
++		return rc;
++
++	/* If the internal PHY is in General Power-Down mode, all, except the
++	 * management interface, is powered-down and stays in that condition as
++	 * long as Phy register bit 0.11 is HIGH.
++	 *
++	 * In that case, clear the bit 0.11, so the PHY powers up and we can
++	 * access to the phy registers.
++	 */
++	rc = phy_read(pdata->phy_dev, MII_BMCR);
++	if (rc < 0) {
++		SMSC_WARN(pdata, drv, "Failed reading PHY control reg");
++		return rc;
++	}
++
++	/* If the PHY general power-down bit is not set is not necessary to
++	 * disable the general power down-mode.
++	 */
++	if (rc & BMCR_PDOWN) {
++		rc = phy_write(pdata->phy_dev, MII_BMCR, rc & ~BMCR_PDOWN);
++		if (rc < 0) {
++			SMSC_WARN(pdata, drv, "Failed writing PHY control reg");
++			return rc;
++		}
++
++		usleep_range(1000, 1500);
++	}
++
++	return 0;
++}
++
+ static int smsc911x_phy_disable_energy_detect(struct smsc911x_data *pdata)
+ {
+ 	int rc = 0;
+@@ -1415,6 +1451,16 @@ static int smsc911x_soft_reset(struct smsc911x_data *pdata)
+ 	int ret;
+ 
+ 	/*
++	 * Make sure to power-up the PHY chip before doing a reset, otherwise
++	 * the reset fails.
++	 */
++	ret = smsc911x_phy_general_power_up(pdata);
++	if (ret) {
++		SMSC_WARN(pdata, drv, "Failed to power-up the PHY chip");
++		return ret;
++	}
++
++	/*
+ 	 * LAN9210/LAN9211/LAN9220/LAN9221 chips have an internal PHY that
+ 	 * are initialized in a Energy Detect Power-Down mode that prevents
+ 	 * the MAC chip to be software reseted. So we have to wakeup the PHY
+diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
+index f67539650c38..993779a77b34 100644
+--- a/drivers/net/ethernet/sun/sunvnet.c
++++ b/drivers/net/ethernet/sun/sunvnet.c
+@@ -693,7 +693,7 @@ static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	spin_lock_irqsave(&port->vio.lock, flags);
+ 
+ 	dr = &port->vio.drings[VIO_DRIVER_TX_RING];
+-	if (unlikely(vnet_tx_dring_avail(dr) < 2)) {
++	if (unlikely(vnet_tx_dring_avail(dr) < 1)) {
+ 		if (!netif_queue_stopped(dev)) {
+ 			netif_stop_queue(dev);
+ 
+@@ -749,7 +749,7 @@ static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	dev->stats.tx_bytes += skb->len;
+ 
+ 	dr->prod = (dr->prod + 1) & (VNET_TX_RING_SIZE - 1);
+-	if (unlikely(vnet_tx_dring_avail(dr) < 2)) {
++	if (unlikely(vnet_tx_dring_avail(dr) < 1)) {
+ 		netif_stop_queue(dev);
+ 		if (vnet_tx_dring_avail(dr) > VNET_TX_WAKEUP_THRESH(dr))
+ 			netif_wake_queue(dev);
+diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
+index ab92f67da035..4a4388b813ac 100644
+--- a/drivers/net/ethernet/ti/cpts.c
++++ b/drivers/net/ethernet/ti/cpts.c
+@@ -264,7 +264,7 @@ static int cpts_match(struct sk_buff *skb, unsigned int ptp_class,
+ 
+ 	switch (ptp_class & PTP_CLASS_PMASK) {
+ 	case PTP_CLASS_IPV4:
+-		offset += ETH_HLEN + IPV4_HLEN(data) + UDP_HLEN;
++		offset += ETH_HLEN + IPV4_HLEN(data + offset) + UDP_HLEN;
+ 		break;
+ 	case PTP_CLASS_IPV6:
+ 		offset += ETH_HLEN + IP6_HLEN + UDP_HLEN;
+diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
+index 9b5481c70b4c..07c942b6ae01 100644
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -629,6 +629,8 @@ static void macvtap_skb_to_vnet_hdr(const struct sk_buff *skb,
+ 	if (skb->ip_summed == CHECKSUM_PARTIAL) {
+ 		vnet_hdr->flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
+ 		vnet_hdr->csum_start = skb_checksum_start_offset(skb);
++		if (vlan_tx_tag_present(skb))
++			vnet_hdr->csum_start += VLAN_HLEN;
+ 		vnet_hdr->csum_offset = skb->csum_offset;
+ 	} else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
+ 		vnet_hdr->flags = VIRTIO_NET_HDR_F_DATA_VALID;
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index c301e4cb37ca..2fa0c3d50692 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -784,7 +784,7 @@ static int match(struct sk_buff *skb, unsigned int type, struct rxts *rxts)
+ 
+ 	switch (type & PTP_CLASS_PMASK) {
+ 	case PTP_CLASS_IPV4:
+-		offset += ETH_HLEN + IPV4_HLEN(data) + UDP_HLEN;
++		offset += ETH_HLEN + IPV4_HLEN(data + offset) + UDP_HLEN;
+ 		break;
+ 	case PTP_CLASS_IPV6:
+ 		offset += ETH_HLEN + IP6_HLEN + UDP_HLEN;
+@@ -927,7 +927,7 @@ static int is_sync(struct sk_buff *skb, int type)
+ 
+ 	switch (type & PTP_CLASS_PMASK) {
+ 	case PTP_CLASS_IPV4:
+-		offset += ETH_HLEN + IPV4_HLEN(data) + UDP_HLEN;
++		offset += ETH_HLEN + IPV4_HLEN(data + offset) + UDP_HLEN;
+ 		break;
+ 	case PTP_CLASS_IPV6:
+ 		offset += ETH_HLEN + IP6_HLEN + UDP_HLEN;
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index 90c639b0f18d..17ecdd60cf6c 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -755,23 +755,23 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 
+ 		err = get_filter(argp, &code);
+ 		if (err >= 0) {
++			struct bpf_prog *pass_filter = NULL;
+ 			struct sock_fprog_kern fprog = {
+ 				.len = err,
+ 				.filter = code,
+ 			};
+ 
+-			ppp_lock(ppp);
+-			if (ppp->pass_filter) {
+-				bpf_prog_destroy(ppp->pass_filter);
+-				ppp->pass_filter = NULL;
++			err = 0;
++			if (fprog.filter)
++				err = bpf_prog_create(&pass_filter, &fprog);
++			if (!err) {
++				ppp_lock(ppp);
++				if (ppp->pass_filter)
++					bpf_prog_destroy(ppp->pass_filter);
++				ppp->pass_filter = pass_filter;
++				ppp_unlock(ppp);
+ 			}
+-			if (fprog.filter != NULL)
+-				err = bpf_prog_create(&ppp->pass_filter,
+-						      &fprog);
+-			else
+-				err = 0;
+ 			kfree(code);
+-			ppp_unlock(ppp);
+ 		}
+ 		break;
+ 	}
+@@ -781,23 +781,23 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 
+ 		err = get_filter(argp, &code);
+ 		if (err >= 0) {
++			struct bpf_prog *active_filter = NULL;
+ 			struct sock_fprog_kern fprog = {
+ 				.len = err,
+ 				.filter = code,
+ 			};
+ 
+-			ppp_lock(ppp);
+-			if (ppp->active_filter) {
+-				bpf_prog_destroy(ppp->active_filter);
+-				ppp->active_filter = NULL;
++			err = 0;
++			if (fprog.filter)
++				err = bpf_prog_create(&active_filter, &fprog);
++			if (!err) {
++				ppp_lock(ppp);
++				if (ppp->active_filter)
++					bpf_prog_destroy(ppp->active_filter);
++				ppp->active_filter = active_filter;
++				ppp_unlock(ppp);
+ 			}
+-			if (fprog.filter != NULL)
+-				err = bpf_prog_create(&ppp->active_filter,
+-						      &fprog);
+-			else
+-				err = 0;
+ 			kfree(code);
+-			ppp_unlock(ppp);
+ 		}
+ 		break;
+ 	}
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 610d1662c500..d965e8a7a675 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1225,6 +1225,10 @@ static ssize_t tun_put_user(struct tun_struct *tun,
+ 	struct tun_pi pi = { 0, skb->protocol };
+ 	ssize_t total = 0;
+ 	int vlan_offset = 0, copied;
++	int vlan_hlen = 0;
++
++	if (vlan_tx_tag_present(skb))
++		vlan_hlen = VLAN_HLEN;
+ 
+ 	if (!(tun->flags & TUN_NO_PI)) {
+ 		if ((len -= sizeof(pi)) < 0)
+@@ -1276,7 +1280,8 @@ static ssize_t tun_put_user(struct tun_struct *tun,
+ 
+ 		if (skb->ip_summed == CHECKSUM_PARTIAL) {
+ 			gso.flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
+-			gso.csum_start = skb_checksum_start_offset(skb);
++			gso.csum_start = skb_checksum_start_offset(skb) +
++					 vlan_hlen;
+ 			gso.csum_offset = skb->csum_offset;
+ 		} else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
+ 			gso.flags = VIRTIO_NET_HDR_F_DATA_VALID;
+@@ -1289,10 +1294,9 @@ static ssize_t tun_put_user(struct tun_struct *tun,
+ 	}
+ 
+ 	copied = total;
+-	total += skb->len;
+-	if (!vlan_tx_tag_present(skb)) {
+-		len = min_t(int, skb->len, len);
+-	} else {
++	len = min_t(int, skb->len + vlan_hlen, len);
++	total += skb->len + vlan_hlen;
++	if (vlan_hlen) {
+ 		int copy, ret;
+ 		struct {
+ 			__be16 h_vlan_proto;
+@@ -1303,8 +1307,6 @@ static ssize_t tun_put_user(struct tun_struct *tun,
+ 		veth.h_vlan_TCI = htons(vlan_tx_tag_get(skb));
+ 
+ 		vlan_offset = offsetof(struct vlan_ethhdr, h_vlan_proto);
+-		len = min_t(int, skb->len + VLAN_HLEN, len);
+-		total += VLAN_HLEN;
+ 
+ 		copy = min_t(int, vlan_offset, len);
+ 		ret = skb_copy_datagram_const_iovec(skb, 0, iv, copied, copy);
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index b4831274b0ab..81a8a296a582 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -274,13 +274,15 @@ static inline struct vxlan_rdst *first_remote_rtnl(struct vxlan_fdb *fdb)
+ 	return list_first_entry(&fdb->remotes, struct vxlan_rdst, list);
+ }
+ 
+-/* Find VXLAN socket based on network namespace and UDP port */
+-static struct vxlan_sock *vxlan_find_sock(struct net *net, __be16 port)
++/* Find VXLAN socket based on network namespace, address family and UDP port */
++static struct vxlan_sock *vxlan_find_sock(struct net *net,
++					  sa_family_t family, __be16 port)
+ {
+ 	struct vxlan_sock *vs;
+ 
+ 	hlist_for_each_entry_rcu(vs, vs_head(net, port), hlist) {
+-		if (inet_sk(vs->sock->sk)->inet_sport == port)
++		if (inet_sk(vs->sock->sk)->inet_sport == port &&
++		    inet_sk(vs->sock->sk)->sk.sk_family == family)
+ 			return vs;
+ 	}
+ 	return NULL;
+@@ -299,11 +301,12 @@ static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs, u32 id)
+ }
+ 
+ /* Look up VNI in a per net namespace table */
+-static struct vxlan_dev *vxlan_find_vni(struct net *net, u32 id, __be16 port)
++static struct vxlan_dev *vxlan_find_vni(struct net *net, u32 id,
++					sa_family_t family, __be16 port)
+ {
+ 	struct vxlan_sock *vs;
+ 
+-	vs = vxlan_find_sock(net, port);
++	vs = vxlan_find_sock(net, family, port);
+ 	if (!vs)
+ 		return NULL;
+ 
+@@ -620,6 +623,8 @@ static int vxlan_gro_complete(struct sk_buff *skb, int nhoff)
+ 	int vxlan_len  = sizeof(struct vxlanhdr) + sizeof(struct ethhdr);
+ 	int err = -ENOSYS;
+ 
++	udp_tunnel_gro_complete(skb, nhoff);
++
+ 	eh = (struct ethhdr *)(skb->data + nhoff + sizeof(struct vxlanhdr));
+ 	type = eh->h_proto;
+ 
+@@ -1820,7 +1825,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+ 			struct vxlan_dev *dst_vxlan;
+ 
+ 			ip_rt_put(rt);
+-			dst_vxlan = vxlan_find_vni(vxlan->net, vni, dst_port);
++			dst_vxlan = vxlan_find_vni(vxlan->net, vni,
++						   dst->sa.sa_family, dst_port);
+ 			if (!dst_vxlan)
+ 				goto tx_error;
+ 			vxlan_encap_bypass(skb, vxlan, dst_vxlan);
+@@ -1874,7 +1880,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+ 			struct vxlan_dev *dst_vxlan;
+ 
+ 			dst_release(ndst);
+-			dst_vxlan = vxlan_find_vni(vxlan->net, vni, dst_port);
++			dst_vxlan = vxlan_find_vni(vxlan->net, vni,
++						   dst->sa.sa_family, dst_port);
+ 			if (!dst_vxlan)
+ 				goto tx_error;
+ 			vxlan_encap_bypass(skb, vxlan, dst_vxlan);
+@@ -2034,13 +2041,15 @@ static int vxlan_init(struct net_device *dev)
+ 	struct vxlan_dev *vxlan = netdev_priv(dev);
+ 	struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
+ 	struct vxlan_sock *vs;
++	bool ipv6 = vxlan->flags & VXLAN_F_IPV6;
+ 
+ 	dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+ 	if (!dev->tstats)
+ 		return -ENOMEM;
+ 
+ 	spin_lock(&vn->sock_lock);
+-	vs = vxlan_find_sock(vxlan->net, vxlan->dst_port);
++	vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET,
++			     vxlan->dst_port);
+ 	if (vs) {
+ 		/* If we have a socket with same port already, reuse it */
+ 		atomic_inc(&vs->refcnt);
+@@ -2439,6 +2448,7 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
+ {
+ 	struct vxlan_net *vn = net_generic(net, vxlan_net_id);
+ 	struct vxlan_sock *vs;
++	bool ipv6 = flags & VXLAN_F_IPV6;
+ 
+ 	vs = vxlan_socket_create(net, port, rcv, data, flags);
+ 	if (!IS_ERR(vs))
+@@ -2448,7 +2458,7 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
+ 		return vs;
+ 
+ 	spin_lock(&vn->sock_lock);
+-	vs = vxlan_find_sock(net, port);
++	vs = vxlan_find_sock(net, ipv6 ? AF_INET6 : AF_INET, port);
+ 	if (vs) {
+ 		if (vs->rcv == rcv)
+ 			atomic_inc(&vs->refcnt);
+@@ -2607,7 +2617,8 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
+ 	    nla_get_u8(data[IFLA_VXLAN_UDP_ZERO_CSUM6_RX]))
+ 		vxlan->flags |= VXLAN_F_UDP_ZERO_CSUM6_RX;
+ 
+-	if (vxlan_find_vni(net, vni, vxlan->dst_port)) {
++	if (vxlan_find_vni(net, vni, use_ipv6 ? AF_INET6 : AF_INET,
++			   vxlan->dst_port)) {
+ 		pr_info("duplicate VNI %u\n", vni);
+ 		return -EEXIST;
+ 	}
+diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
+index bf720a875e6b..c77e6bcc63d5 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
+@@ -282,7 +282,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
+ 
+ 	lockdep_assert_held(&mvm->mutex);
+ 
+-	if (WARN_ON_ONCE(mvm->init_ucode_complete))
++	if (WARN_ON_ONCE(mvm->init_ucode_complete || mvm->calibrating))
+ 		return 0;
+ 
+ 	iwl_init_notification_wait(&mvm->notif_wait,
+@@ -332,6 +332,8 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
+ 		goto out;
+ 	}
+ 
++	mvm->calibrating = true;
++
+ 	/* Send TX valid antennas before triggering calibrations */
+ 	ret = iwl_send_tx_ant_cfg(mvm, mvm->fw->valid_tx_ant);
+ 	if (ret)
+@@ -356,11 +358,17 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
+ 			MVM_UCODE_CALIB_TIMEOUT);
+ 	if (!ret)
+ 		mvm->init_ucode_complete = true;
++
++	if (ret && iwl_mvm_is_radio_killed(mvm)) {
++		IWL_DEBUG_RF_KILL(mvm, "RFKILL while calibrating.\n");
++		ret = 1;
++	}
+ 	goto out;
+ 
+ error:
+ 	iwl_remove_notification(&mvm->notif_wait, &calib_wait);
+ out:
++	mvm->calibrating = false;
+ 	if (iwlmvm_mod_params.init_dbg && !mvm->nvm_data) {
+ 		/* we want to debug INIT and we have no NVM - fake */
+ 		mvm->nvm_data = kzalloc(sizeof(struct iwl_nvm_data) +
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index cdc272d776e7..26de13bb78a8 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -778,6 +778,7 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
+ 	iwl_trans_stop_device(mvm->trans);
+ 
+ 	mvm->scan_status = IWL_MVM_SCAN_NONE;
++	mvm->calibrating = false;
+ 
+ 	/* just in case one was running */
+ 	ieee80211_remain_on_channel_expired(mvm->hw);
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
+index 2e73d3bd7757..c35f5557307e 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
++++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
+@@ -541,6 +541,7 @@ struct iwl_mvm {
+ 	enum iwl_ucode_type cur_ucode;
+ 	bool ucode_loaded;
+ 	bool init_ucode_complete;
++	bool calibrating;
+ 	u32 error_event_table;
+ 	u32 log_event_table;
+ 	u32 umac_error_event_table;
+diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
+index d31a1178ae35..f9471ee9e260 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
++++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
+@@ -745,6 +745,7 @@ void iwl_mvm_set_hw_ctkill_state(struct iwl_mvm *mvm, bool state)
+ static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
+ {
+ 	struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
++	bool calibrating = ACCESS_ONCE(mvm->calibrating);
+ 
+ 	if (state)
+ 		set_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status);
+@@ -753,7 +754,15 @@ static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
+ 
+ 	wiphy_rfkill_set_hw_state(mvm->hw->wiphy, iwl_mvm_is_radio_killed(mvm));
+ 
+-	return state && mvm->cur_ucode != IWL_UCODE_INIT;
++	/* iwl_run_init_mvm_ucode is waiting for results, abort it */
++	if (calibrating)
++		iwl_abort_notification_waits(&mvm->notif_wait);
++
++	/*
++	 * Stop the device if we run OPERATIONAL firmware or if we are in the
++	 * middle of the calibrations.
++	 */
++	return state && (mvm->cur_ucode != IWL_UCODE_INIT || calibrating);
+ }
+ 
+ static void iwl_mvm_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
+diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
+index d7231a82fe42..6c02467a37c8 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -913,7 +913,8 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
+ 	 * restart. So don't process again if the device is
+ 	 * already dead.
+ 	 */
+-	if (test_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
++	if (test_and_clear_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
++		IWL_DEBUG_INFO(trans, "DEVICE_ENABLED bit was set and is now cleared\n");
+ 		iwl_pcie_tx_stop(trans);
+ 		iwl_pcie_rx_stop(trans);
+ 
+@@ -943,7 +944,6 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
+ 	/* clear all status bits */
+ 	clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
+ 	clear_bit(STATUS_INT_ENABLED, &trans->status);
+-	clear_bit(STATUS_DEVICE_ENABLED, &trans->status);
+ 	clear_bit(STATUS_TPOWER_PMI, &trans->status);
+ 	clear_bit(STATUS_RFKILL, &trans->status);
+ 
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 1326f6121835..6b48c865dd7a 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -1987,7 +1987,7 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
+ 	if (err != 0) {
+ 		printk(KERN_DEBUG "mac80211_hwsim: device_bind_driver failed (%d)\n",
+ 		       err);
+-		goto failed_hw;
++		goto failed_bind;
+ 	}
+ 
+ 	skb_queue_head_init(&data->pending);
+@@ -2183,6 +2183,8 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
+ 	return idx;
+ 
+ failed_hw:
++	device_release_driver(data->dev);
++failed_bind:
+ 	device_unregister(data->dev);
+ failed_drvdata:
+ 	ieee80211_free_hw(hw);
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index 3a4951f46065..c1a6cd66af42 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -182,6 +182,15 @@ static const struct dmi_system_id asus_quirks[] = {
+ 	},
+ 	{
+ 		.callback = dmi_matched,
++		.ident = "ASUSTeK COMPUTER INC. X550VB",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "X550VB"),
++		},
++		.driver_data = &quirk_asus_wapf4,
++	},
++	{
++		.callback = dmi_matched,
+ 		.ident = "ASUSTeK COMPUTER INC. X55A",
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
+index 390e8e33d5e3..25721bf20092 100644
+--- a/drivers/platform/x86/dell-wmi.c
++++ b/drivers/platform/x86/dell-wmi.c
+@@ -163,18 +163,24 @@ static void dell_wmi_notify(u32 value, void *context)
+ 		const struct key_entry *key;
+ 		int reported_key;
+ 		u16 *buffer_entry = (u16 *)obj->buffer.pointer;
++		int buffer_size = obj->buffer.length/2;
+ 
+-		if (dell_new_hk_type && (buffer_entry[1] != 0x10)) {
++		if (buffer_size >= 2 && dell_new_hk_type && buffer_entry[1] != 0x10) {
+ 			pr_info("Received unknown WMI event (0x%x)\n",
+ 				buffer_entry[1]);
+ 			kfree(obj);
+ 			return;
+ 		}
+ 
+-		if (dell_new_hk_type || buffer_entry[1] == 0x0)
++		if (buffer_size >= 3 && (dell_new_hk_type || buffer_entry[1] == 0x0))
+ 			reported_key = (int)buffer_entry[2];
+-		else
++		else if (buffer_size >= 2)
+ 			reported_key = (int)buffer_entry[1] & 0xffff;
++		else {
++			pr_info("Received unknown WMI event\n");
++			kfree(obj);
++			return;
++		}
+ 
+ 		key = sparse_keymap_entry_from_scancode(dell_wmi_input_dev,
+ 							reported_key);
+diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
+index 02152de135b5..ed494f37c40f 100644
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -837,6 +837,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Yoga 2"),
+ 		},
+ 	},
++	{
++		.ident = "Lenovo Yoga 3 Pro 1370",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 3 Pro-1370"),
++		},
++	},
+ 	{}
+ };
+ 
+diff --git a/drivers/power/bq2415x_charger.c b/drivers/power/bq2415x_charger.c
+index e384844a1ae1..1f49986fc605 100644
+--- a/drivers/power/bq2415x_charger.c
++++ b/drivers/power/bq2415x_charger.c
+@@ -1579,8 +1579,15 @@ static int bq2415x_probe(struct i2c_client *client,
+ 	if (np) {
+ 		bq->notify_psy = power_supply_get_by_phandle(np, "ti,usb-charger-detection");
+ 
+-		if (!bq->notify_psy)
+-			return -EPROBE_DEFER;
++		if (IS_ERR(bq->notify_psy)) {
++			dev_info(&client->dev,
++				"no 'ti,usb-charger-detection' property (err=%ld)\n",
++				PTR_ERR(bq->notify_psy));
++			bq->notify_psy = NULL;
++		} else if (!bq->notify_psy) {
++			ret = -EPROBE_DEFER;
++			goto error_2;
++		}
+ 	}
+ 	else if (pdata->notify_device)
+ 		bq->notify_psy = power_supply_get_by_name(pdata->notify_device);
+@@ -1602,27 +1609,27 @@ static int bq2415x_probe(struct i2c_client *client,
+ 		ret = of_property_read_u32(np, "ti,current-limit",
+ 				&bq->init_data.current_limit);
+ 		if (ret)
+-			return ret;
++			goto error_2;
+ 		ret = of_property_read_u32(np, "ti,weak-battery-voltage",
+ 				&bq->init_data.weak_battery_voltage);
+ 		if (ret)
+-			return ret;
++			goto error_2;
+ 		ret = of_property_read_u32(np, "ti,battery-regulation-voltage",
+ 				&bq->init_data.battery_regulation_voltage);
+ 		if (ret)
+-			return ret;
++			goto error_2;
+ 		ret = of_property_read_u32(np, "ti,charge-current",
+ 				&bq->init_data.charge_current);
+ 		if (ret)
+-			return ret;
++			goto error_2;
+ 		ret = of_property_read_u32(np, "ti,termination-current",
+ 				&bq->init_data.termination_current);
+ 		if (ret)
+-			return ret;
++			goto error_2;
+ 		ret = of_property_read_u32(np, "ti,resistor-sense",
+ 				&bq->init_data.resistor_sense);
+ 		if (ret)
+-			return ret;
++			goto error_2;
+ 	} else {
+ 		memcpy(&bq->init_data, pdata, sizeof(bq->init_data));
+ 	}
+diff --git a/drivers/power/charger-manager.c b/drivers/power/charger-manager.c
+index ef1f4c928431..03bfac3655ef 100644
+--- a/drivers/power/charger-manager.c
++++ b/drivers/power/charger-manager.c
+@@ -97,6 +97,7 @@ static struct charger_global_desc *g_desc; /* init with setup_charger_manager */
+ static bool is_batt_present(struct charger_manager *cm)
+ {
+ 	union power_supply_propval val;
++	struct power_supply *psy;
+ 	bool present = false;
+ 	int i, ret;
+ 
+@@ -107,16 +108,27 @@ static bool is_batt_present(struct charger_manager *cm)
+ 	case CM_NO_BATTERY:
+ 		break;
+ 	case CM_FUEL_GAUGE:
+-		ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
++		psy = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
++		if (!psy)
++			break;
++
++		ret = psy->get_property(psy,
+ 				POWER_SUPPLY_PROP_PRESENT, &val);
+ 		if (ret == 0 && val.intval)
+ 			present = true;
+ 		break;
+ 	case CM_CHARGER_STAT:
+-		for (i = 0; cm->charger_stat[i]; i++) {
+-			ret = cm->charger_stat[i]->get_property(
+-					cm->charger_stat[i],
+-					POWER_SUPPLY_PROP_PRESENT, &val);
++		for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
++			psy = power_supply_get_by_name(
++					cm->desc->psy_charger_stat[i]);
++			if (!psy) {
++				dev_err(cm->dev, "Cannot find power supply \"%s\"\n",
++					cm->desc->psy_charger_stat[i]);
++				continue;
++			}
++
++			ret = psy->get_property(psy, POWER_SUPPLY_PROP_PRESENT,
++					&val);
+ 			if (ret == 0 && val.intval) {
+ 				present = true;
+ 				break;
+@@ -139,14 +151,20 @@ static bool is_batt_present(struct charger_manager *cm)
+ static bool is_ext_pwr_online(struct charger_manager *cm)
+ {
+ 	union power_supply_propval val;
++	struct power_supply *psy;
+ 	bool online = false;
+ 	int i, ret;
+ 
+ 	/* If at least one of them has one, it's yes. */
+-	for (i = 0; cm->charger_stat[i]; i++) {
+-		ret = cm->charger_stat[i]->get_property(
+-				cm->charger_stat[i],
+-				POWER_SUPPLY_PROP_ONLINE, &val);
++	for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
++		psy = power_supply_get_by_name(cm->desc->psy_charger_stat[i]);
++		if (!psy) {
++			dev_err(cm->dev, "Cannot find power supply \"%s\"\n",
++					cm->desc->psy_charger_stat[i]);
++			continue;
++		}
++
++		ret = psy->get_property(psy, POWER_SUPPLY_PROP_ONLINE, &val);
+ 		if (ret == 0 && val.intval) {
+ 			online = true;
+ 			break;
+@@ -167,12 +185,14 @@ static bool is_ext_pwr_online(struct charger_manager *cm)
+ static int get_batt_uV(struct charger_manager *cm, int *uV)
+ {
+ 	union power_supply_propval val;
++	struct power_supply *fuel_gauge;
+ 	int ret;
+ 
+-	if (!cm->fuel_gauge)
++	fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
++	if (!fuel_gauge)
+ 		return -ENODEV;
+ 
+-	ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
++	ret = fuel_gauge->get_property(fuel_gauge,
+ 				POWER_SUPPLY_PROP_VOLTAGE_NOW, &val);
+ 	if (ret)
+ 		return ret;
+@@ -189,6 +209,7 @@ static bool is_charging(struct charger_manager *cm)
+ {
+ 	int i, ret;
+ 	bool charging = false;
++	struct power_supply *psy;
+ 	union power_supply_propval val;
+ 
+ 	/* If there is no battery, it cannot be charged */
+@@ -196,17 +217,22 @@ static bool is_charging(struct charger_manager *cm)
+ 		return false;
+ 
+ 	/* If at least one of the charger is charging, return yes */
+-	for (i = 0; cm->charger_stat[i]; i++) {
++	for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
+ 		/* 1. The charger sholuld not be DISABLED */
+ 		if (cm->emergency_stop)
+ 			continue;
+ 		if (!cm->charger_enabled)
+ 			continue;
+ 
++		psy = power_supply_get_by_name(cm->desc->psy_charger_stat[i]);
++		if (!psy) {
++			dev_err(cm->dev, "Cannot find power supply \"%s\"\n",
++					cm->desc->psy_charger_stat[i]);
++			continue;
++		}
++
+ 		/* 2. The charger should be online (ext-power) */
+-		ret = cm->charger_stat[i]->get_property(
+-				cm->charger_stat[i],
+-				POWER_SUPPLY_PROP_ONLINE, &val);
++		ret = psy->get_property(psy, POWER_SUPPLY_PROP_ONLINE, &val);
+ 		if (ret) {
+ 			dev_warn(cm->dev, "Cannot read ONLINE value from %s\n",
+ 				 cm->desc->psy_charger_stat[i]);
+@@ -219,9 +245,7 @@ static bool is_charging(struct charger_manager *cm)
+ 		 * 3. The charger should not be FULL, DISCHARGING,
+ 		 * or NOT_CHARGING.
+ 		 */
+-		ret = cm->charger_stat[i]->get_property(
+-				cm->charger_stat[i],
+-				POWER_SUPPLY_PROP_STATUS, &val);
++		ret = psy->get_property(psy, POWER_SUPPLY_PROP_STATUS, &val);
+ 		if (ret) {
+ 			dev_warn(cm->dev, "Cannot read STATUS value from %s\n",
+ 				 cm->desc->psy_charger_stat[i]);
+@@ -248,6 +272,7 @@ static bool is_full_charged(struct charger_manager *cm)
+ {
+ 	struct charger_desc *desc = cm->desc;
+ 	union power_supply_propval val;
++	struct power_supply *fuel_gauge;
+ 	int ret = 0;
+ 	int uV;
+ 
+@@ -255,11 +280,15 @@ static bool is_full_charged(struct charger_manager *cm)
+ 	if (!is_batt_present(cm))
+ 		return false;
+ 
+-	if (cm->fuel_gauge && desc->fullbatt_full_capacity > 0) {
++	fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
++	if (!fuel_gauge)
++		return false;
++
++	if (desc->fullbatt_full_capacity > 0) {
+ 		val.intval = 0;
+ 
+ 		/* Not full if capacity of fuel gauge isn't full */
+-		ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
++		ret = fuel_gauge->get_property(fuel_gauge,
+ 				POWER_SUPPLY_PROP_CHARGE_FULL, &val);
+ 		if (!ret && val.intval > desc->fullbatt_full_capacity)
+ 			return true;
+@@ -273,10 +302,10 @@ static bool is_full_charged(struct charger_manager *cm)
+ 	}
+ 
+ 	/* Full, if the capacity is more than fullbatt_soc */
+-	if (cm->fuel_gauge && desc->fullbatt_soc > 0) {
++	if (desc->fullbatt_soc > 0) {
+ 		val.intval = 0;
+ 
+-		ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
++		ret = fuel_gauge->get_property(fuel_gauge,
+ 				POWER_SUPPLY_PROP_CAPACITY, &val);
+ 		if (!ret && val.intval >= desc->fullbatt_soc)
+ 			return true;
+@@ -551,6 +580,20 @@ static int check_charging_duration(struct charger_manager *cm)
+ 	return ret;
+ }
+ 
++static int cm_get_battery_temperature_by_psy(struct charger_manager *cm,
++					int *temp)
++{
++	struct power_supply *fuel_gauge;
++
++	fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
++	if (!fuel_gauge)
++		return -ENODEV;
++
++	return fuel_gauge->get_property(fuel_gauge,
++				POWER_SUPPLY_PROP_TEMP,
++				(union power_supply_propval *)temp);
++}
++
+ static int cm_get_battery_temperature(struct charger_manager *cm,
+ 					int *temp)
+ {
+@@ -560,15 +603,18 @@ static int cm_get_battery_temperature(struct charger_manager *cm,
+ 		return -ENODEV;
+ 
+ #ifdef CONFIG_THERMAL
+-	ret = thermal_zone_get_temp(cm->tzd_batt, (unsigned long *)temp);
+-	if (!ret)
+-		/* Calibrate temperature unit */
+-		*temp /= 100;
+-#else
+-	ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+-				POWER_SUPPLY_PROP_TEMP,
+-				(union power_supply_propval *)temp);
++	if (cm->tzd_batt) {
++		ret = thermal_zone_get_temp(cm->tzd_batt, (unsigned long *)temp);
++		if (!ret)
++			/* Calibrate temperature unit */
++			*temp /= 100;
++	} else
+ #endif
++	{
++		/* if-else continued from CONFIG_THERMAL */
++		ret = cm_get_battery_temperature_by_psy(cm, temp);
++	}
++
+ 	return ret;
+ }
+ 
+@@ -827,6 +873,7 @@ static int charger_get_property(struct power_supply *psy,
+ 	struct charger_manager *cm = container_of(psy,
+ 			struct charger_manager, charger_psy);
+ 	struct charger_desc *desc = cm->desc;
++	struct power_supply *fuel_gauge;
+ 	int ret = 0;
+ 	int uV;
+ 
+@@ -857,14 +904,20 @@ static int charger_get_property(struct power_supply *psy,
+ 		ret = get_batt_uV(cm, &val->intval);
+ 		break;
+ 	case POWER_SUPPLY_PROP_CURRENT_NOW:
+-		ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
++		fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
++		if (!fuel_gauge) {
++			ret = -ENODEV;
++			break;
++		}
++		ret = fuel_gauge->get_property(fuel_gauge,
+ 				POWER_SUPPLY_PROP_CURRENT_NOW, val);
+ 		break;
+ 	case POWER_SUPPLY_PROP_TEMP:
+ 	case POWER_SUPPLY_PROP_TEMP_AMBIENT:
+ 		return cm_get_battery_temperature(cm, &val->intval);
+ 	case POWER_SUPPLY_PROP_CAPACITY:
+-		if (!cm->fuel_gauge) {
++		fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
++		if (!fuel_gauge) {
+ 			ret = -ENODEV;
+ 			break;
+ 		}
+@@ -875,7 +928,7 @@ static int charger_get_property(struct power_supply *psy,
+ 			break;
+ 		}
+ 
+-		ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
++		ret = fuel_gauge->get_property(fuel_gauge,
+ 					POWER_SUPPLY_PROP_CAPACITY, val);
+ 		if (ret)
+ 			break;
+@@ -924,7 +977,14 @@ static int charger_get_property(struct power_supply *psy,
+ 		break;
+ 	case POWER_SUPPLY_PROP_CHARGE_NOW:
+ 		if (is_charging(cm)) {
+-			ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
++			fuel_gauge = power_supply_get_by_name(
++					cm->desc->psy_fuel_gauge);
++			if (!fuel_gauge) {
++				ret = -ENODEV;
++				break;
++			}
++
++			ret = fuel_gauge->get_property(fuel_gauge,
+ 						POWER_SUPPLY_PROP_CHARGE_NOW,
+ 						val);
+ 			if (ret) {
+@@ -1485,14 +1545,15 @@ err:
+ 	return ret;
+ }
+ 
+-static int cm_init_thermal_data(struct charger_manager *cm)
++static int cm_init_thermal_data(struct charger_manager *cm,
++		struct power_supply *fuel_gauge)
+ {
+ 	struct charger_desc *desc = cm->desc;
+ 	union power_supply_propval val;
+ 	int ret;
+ 
+ 	/* Verify whether fuel gauge provides battery temperature */
+-	ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
++	ret = fuel_gauge->get_property(fuel_gauge,
+ 					POWER_SUPPLY_PROP_TEMP, &val);
+ 
+ 	if (!ret) {
+@@ -1502,8 +1563,6 @@ static int cm_init_thermal_data(struct charger_manager *cm)
+ 		cm->desc->measure_battery_temp = true;
+ 	}
+ #ifdef CONFIG_THERMAL
+-	cm->tzd_batt = cm->fuel_gauge->tzd;
+-
+ 	if (ret && desc->thermal_zone) {
+ 		cm->tzd_batt =
+ 			thermal_zone_get_zone_by_name(desc->thermal_zone);
+@@ -1666,6 +1725,7 @@ static int charger_manager_probe(struct platform_device *pdev)
+ 	int ret = 0, i = 0;
+ 	int j = 0;
+ 	union power_supply_propval val;
++	struct power_supply *fuel_gauge;
+ 
+ 	if (g_desc && !rtc_dev && g_desc->rtc_name) {
+ 		rtc_dev = rtc_class_open(g_desc->rtc_name);
+@@ -1729,23 +1789,20 @@ static int charger_manager_probe(struct platform_device *pdev)
+ 	while (desc->psy_charger_stat[i])
+ 		i++;
+ 
+-	cm->charger_stat = devm_kzalloc(&pdev->dev,
+-				sizeof(struct power_supply *) * i, GFP_KERNEL);
+-	if (!cm->charger_stat)
+-		return -ENOMEM;
+-
++	/* Check if charger's supplies are present at probe */
+ 	for (i = 0; desc->psy_charger_stat[i]; i++) {
+-		cm->charger_stat[i] = power_supply_get_by_name(
+-					desc->psy_charger_stat[i]);
+-		if (!cm->charger_stat[i]) {
++		struct power_supply *psy;
++
++		psy = power_supply_get_by_name(desc->psy_charger_stat[i]);
++		if (!psy) {
+ 			dev_err(&pdev->dev, "Cannot find power supply \"%s\"\n",
+ 				desc->psy_charger_stat[i]);
+ 			return -ENODEV;
+ 		}
+ 	}
+ 
+-	cm->fuel_gauge = power_supply_get_by_name(desc->psy_fuel_gauge);
+-	if (!cm->fuel_gauge) {
++	fuel_gauge = power_supply_get_by_name(desc->psy_fuel_gauge);
++	if (!fuel_gauge) {
+ 		dev_err(&pdev->dev, "Cannot find power supply \"%s\"\n",
+ 			desc->psy_fuel_gauge);
+ 		return -ENODEV;
+@@ -1788,13 +1845,13 @@ static int charger_manager_probe(struct platform_device *pdev)
+ 	cm->charger_psy.num_properties = psy_default.num_properties;
+ 
+ 	/* Find which optional psy-properties are available */
+-	if (!cm->fuel_gauge->get_property(cm->fuel_gauge,
++	if (!fuel_gauge->get_property(fuel_gauge,
+ 					  POWER_SUPPLY_PROP_CHARGE_NOW, &val)) {
+ 		cm->charger_psy.properties[cm->charger_psy.num_properties] =
+ 				POWER_SUPPLY_PROP_CHARGE_NOW;
+ 		cm->charger_psy.num_properties++;
+ 	}
+-	if (!cm->fuel_gauge->get_property(cm->fuel_gauge,
++	if (!fuel_gauge->get_property(fuel_gauge,
+ 					  POWER_SUPPLY_PROP_CURRENT_NOW,
+ 					  &val)) {
+ 		cm->charger_psy.properties[cm->charger_psy.num_properties] =
+@@ -1802,7 +1859,7 @@ static int charger_manager_probe(struct platform_device *pdev)
+ 		cm->charger_psy.num_properties++;
+ 	}
+ 
+-	ret = cm_init_thermal_data(cm);
++	ret = cm_init_thermal_data(cm, fuel_gauge);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "Failed to initialize thermal data\n");
+ 		cm->desc->measure_battery_temp = false;
+@@ -2059,8 +2116,8 @@ static bool find_power_supply(struct charger_manager *cm,
+ 	int i;
+ 	bool found = false;
+ 
+-	for (i = 0; cm->charger_stat[i]; i++) {
+-		if (psy == cm->charger_stat[i]) {
++	for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
++		if (!strcmp(psy->name, cm->desc->psy_charger_stat[i])) {
+ 			found = true;
+ 			break;
+ 		}
+diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
+index d2c35920ff08..66c210e39d71 100644
+--- a/drivers/pwm/core.c
++++ b/drivers/pwm/core.c
+@@ -602,12 +602,9 @@ struct pwm_device *pwm_get(struct device *dev, const char *con_id)
+ 	struct pwm_device *pwm = ERR_PTR(-EPROBE_DEFER);
+ 	const char *dev_id = dev ? dev_name(dev) : NULL;
+ 	struct pwm_chip *chip = NULL;
+-	unsigned int index = 0;
+ 	unsigned int best = 0;
+-	struct pwm_lookup *p;
++	struct pwm_lookup *p, *chosen = NULL;
+ 	unsigned int match;
+-	unsigned int period;
+-	enum pwm_polarity polarity;
+ 
+ 	/* look up via DT first */
+ 	if (IS_ENABLED(CONFIG_OF) && dev && dev->of_node)
+@@ -653,10 +650,7 @@ struct pwm_device *pwm_get(struct device *dev, const char *con_id)
+ 		}
+ 
+ 		if (match > best) {
+-			chip = pwmchip_find_by_name(p->provider);
+-			index = p->index;
+-			period = p->period;
+-			polarity = p->polarity;
++			chosen = p;
+ 
+ 			if (match != 3)
+ 				best = match;
+@@ -665,17 +659,22 @@ struct pwm_device *pwm_get(struct device *dev, const char *con_id)
+ 		}
+ 	}
+ 
+-	mutex_unlock(&pwm_lookup_lock);
++	if (!chosen)
++		goto out;
+ 
+-	if (chip)
+-		pwm = pwm_request_from_chip(chip, index, con_id ?: dev_id);
+-	if (IS_ERR(pwm))
+-		return pwm;
++	chip = pwmchip_find_by_name(chosen->provider);
++	if (!chip)
++		goto out;
+ 
+-	pwm_set_period(pwm, period);
+-	pwm_set_polarity(pwm, polarity);
++	pwm = pwm_request_from_chip(chip, chosen->index, con_id ?: dev_id);
++	if (IS_ERR(pwm))
++		goto out;
+ 
++	pwm_set_period(pwm, chosen->period);
++	pwm_set_polarity(pwm, chosen->polarity);
+ 
++out:
++	mutex_unlock(&pwm_lookup_lock);
+ 	return pwm;
+ }
+ EXPORT_SYMBOL_GPL(pwm_get);
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index 5db8454474ee..817d654dbc82 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -1998,8 +1998,10 @@ static void scsi_restart_operations(struct Scsi_Host *shost)
+ 	 * is no point trying to lock the door of an off-line device.
+ 	 */
+ 	shost_for_each_device(sdev, shost) {
+-		if (scsi_device_online(sdev) && sdev->locked)
++		if (scsi_device_online(sdev) && sdev->was_reset && sdev->locked) {
+ 			scsi_eh_lock_door(sdev);
++			sdev->was_reset = 0;
++		}
+ 	}
+ 
+ 	/*
+diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
+index 1a349f9a9685..5d4261ff5d23 100644
+--- a/fs/gfs2/dir.c
++++ b/fs/gfs2/dir.c
+@@ -2100,8 +2100,13 @@ int gfs2_diradd_alloc_required(struct inode *inode, const struct qstr *name,
+ 	}
+ 	if (IS_ERR(dent))
+ 		return PTR_ERR(dent);
+-	da->bh = bh;
+-	da->dent = dent;
++
++	if (da->save_loc) {
++		da->bh = bh;
++		da->dent = dent;
++	} else {
++		brelse(bh);
++	}
+ 	return 0;
+ }
+ 
+diff --git a/fs/gfs2/dir.h b/fs/gfs2/dir.h
+index 126c65dda028..e1b309c24dab 100644
+--- a/fs/gfs2/dir.h
++++ b/fs/gfs2/dir.h
+@@ -23,6 +23,7 @@ struct gfs2_diradd {
+ 	unsigned nr_blocks;
+ 	struct gfs2_dirent *dent;
+ 	struct buffer_head *bh;
++	int save_loc;
+ };
+ 
+ extern struct inode *gfs2_dir_search(struct inode *dir,
+diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
+index fc8ac2ee0667..7d2723ce067e 100644
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -600,7 +600,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
+ 	int error, free_vfs_inode = 0;
+ 	u32 aflags = 0;
+ 	unsigned blocks = 1;
+-	struct gfs2_diradd da = { .bh = NULL, };
++	struct gfs2_diradd da = { .bh = NULL, .save_loc = 1, };
+ 
+ 	if (!name->len || name->len > GFS2_FNAMESIZE)
+ 		return -ENAMETOOLONG;
+@@ -899,7 +899,7 @@ static int gfs2_link(struct dentry *old_dentry, struct inode *dir,
+ 	struct gfs2_inode *ip = GFS2_I(inode);
+ 	struct gfs2_holder ghs[2];
+ 	struct buffer_head *dibh;
+-	struct gfs2_diradd da = { .bh = NULL, };
++	struct gfs2_diradd da = { .bh = NULL, .save_loc = 1, };
+ 	int error;
+ 
+ 	if (S_ISDIR(inode->i_mode))
+@@ -1337,7 +1337,7 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
+ 	struct gfs2_rgrpd *nrgd;
+ 	unsigned int num_gh;
+ 	int dir_rename = 0;
+-	struct gfs2_diradd da = { .nr_blocks = 0, };
++	struct gfs2_diradd da = { .nr_blocks = 0, .save_loc = 0, };
+ 	unsigned int x;
+ 	int error;
+ 
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 5853f53db732..7f3f60641344 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -125,6 +125,8 @@ again:
+ 			continue;
+ 		if (!test_bit(NFS_DELEGATED_STATE, &state->flags))
+ 			continue;
++		if (!nfs4_valid_open_stateid(state))
++			continue;
+ 		if (!nfs4_stateid_match(&state->stateid, stateid))
+ 			continue;
+ 		get_nfs_open_context(ctx);
+@@ -193,7 +195,11 @@ static int nfs_do_return_delegation(struct inode *inode, struct nfs_delegation *
+ {
+ 	int res = 0;
+ 
+-	res = nfs4_proc_delegreturn(inode, delegation->cred, &delegation->stateid, issync);
++	if (!test_bit(NFS_DELEGATION_REVOKED, &delegation->flags))
++		res = nfs4_proc_delegreturn(inode,
++				delegation->cred,
++				&delegation->stateid,
++				issync);
+ 	nfs_free_delegation(delegation);
+ 	return res;
+ }
+@@ -380,11 +386,13 @@ static int nfs_end_delegation_return(struct inode *inode, struct nfs_delegation
+ {
+ 	struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;
+ 	struct nfs_inode *nfsi = NFS_I(inode);
+-	int err;
++	int err = 0;
+ 
+ 	if (delegation == NULL)
+ 		return 0;
+ 	do {
++		if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags))
++			break;
+ 		err = nfs_delegation_claim_opens(inode, &delegation->stateid);
+ 		if (!issync || err != -EAGAIN)
+ 			break;
+@@ -605,10 +613,23 @@ static void nfs_client_mark_return_unused_delegation_types(struct nfs_client *cl
+ 	rcu_read_unlock();
+ }
+ 
++static void nfs_revoke_delegation(struct inode *inode)
++{
++	struct nfs_delegation *delegation;
++	rcu_read_lock();
++	delegation = rcu_dereference(NFS_I(inode)->delegation);
++	if (delegation != NULL) {
++		set_bit(NFS_DELEGATION_REVOKED, &delegation->flags);
++		nfs_mark_return_delegation(NFS_SERVER(inode), delegation);
++	}
++	rcu_read_unlock();
++}
++
+ void nfs_remove_bad_delegation(struct inode *inode)
+ {
+ 	struct nfs_delegation *delegation;
+ 
++	nfs_revoke_delegation(inode);
+ 	delegation = nfs_inode_detach_delegation(inode);
+ 	if (delegation) {
+ 		nfs_inode_find_state_and_recover(inode, &delegation->stateid);
+diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
+index 5c1cce39297f..e3c20a3ccc93 100644
+--- a/fs/nfs/delegation.h
++++ b/fs/nfs/delegation.h
+@@ -31,6 +31,7 @@ enum {
+ 	NFS_DELEGATION_RETURN_IF_CLOSED,
+ 	NFS_DELEGATION_REFERENCED,
+ 	NFS_DELEGATION_RETURNING,
++	NFS_DELEGATION_REVOKED,
+ };
+ 
+ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res);
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index 65ef6e00deee..c6b5eddbcac0 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -270,6 +270,7 @@ static void nfs_direct_req_free(struct kref *kref)
+ {
+ 	struct nfs_direct_req *dreq = container_of(kref, struct nfs_direct_req, kref);
+ 
++	nfs_free_pnfs_ds_cinfo(&dreq->ds_cinfo);
+ 	if (dreq->l_ctx != NULL)
+ 		nfs_put_lock_context(dreq->l_ctx);
+ 	if (dreq->ctx != NULL)
+diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
+index f59713e091a8..eb777ed34568 100644
+--- a/fs/nfs/filelayout/filelayout.c
++++ b/fs/nfs/filelayout/filelayout.c
+@@ -145,9 +145,6 @@ static int filelayout_async_handle_error(struct rpc_task *task,
+ 	case -NFS4ERR_DELEG_REVOKED:
+ 	case -NFS4ERR_ADMIN_REVOKED:
+ 	case -NFS4ERR_BAD_STATEID:
+-		if (state == NULL)
+-			break;
+-		nfs_remove_bad_delegation(state->inode);
+ 	case -NFS4ERR_OPENMODE:
+ 		if (state == NULL)
+ 			break;
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index 577a36f0a510..0689aa522092 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -624,7 +624,7 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
+ {
+ 	struct inode *inode = dentry->d_inode;
+ 	int need_atime = NFS_I(inode)->cache_validity & NFS_INO_INVALID_ATIME;
+-	int err;
++	int err = 0;
+ 
+ 	trace_nfs_getattr_enter(inode);
+ 	/* Flush out writes to the server in order to update c/mtime.  */
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 0422d77b73c7..d3ebdae1d9b8 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -360,11 +360,6 @@ static int nfs4_handle_exception(struct nfs_server *server, int errorcode, struc
+ 		case -NFS4ERR_DELEG_REVOKED:
+ 		case -NFS4ERR_ADMIN_REVOKED:
+ 		case -NFS4ERR_BAD_STATEID:
+-			if (inode != NULL && nfs4_have_delegation(inode, FMODE_READ)) {
+-				nfs_remove_bad_delegation(inode);
+-				exception->retry = 1;
+-				break;
+-			}
+ 			if (state == NULL)
+ 				break;
+ 			ret = nfs4_schedule_stateid_recovery(server, state);
+@@ -1647,7 +1642,7 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct
+ 			nfs_inode_find_state_and_recover(state->inode,
+ 					stateid);
+ 			nfs4_schedule_stateid_recovery(server, state);
+-			return 0;
++			return -EAGAIN;
+ 		case -NFS4ERR_DELAY:
+ 		case -NFS4ERR_GRACE:
+ 			set_bit(NFS_DELEGATED_STATE, &state->flags);
+@@ -2102,46 +2097,60 @@ static int nfs4_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *sta
+ 	return ret;
+ }
+ 
++static void nfs_finish_clear_delegation_stateid(struct nfs4_state *state)
++{
++	nfs_remove_bad_delegation(state->inode);
++	write_seqlock(&state->seqlock);
++	nfs4_stateid_copy(&state->stateid, &state->open_stateid);
++	write_sequnlock(&state->seqlock);
++	clear_bit(NFS_DELEGATED_STATE, &state->flags);
++}
++
++static void nfs40_clear_delegation_stateid(struct nfs4_state *state)
++{
++	if (rcu_access_pointer(NFS_I(state->inode)->delegation) != NULL)
++		nfs_finish_clear_delegation_stateid(state);
++}
++
++static int nfs40_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *state)
++{
++	/* NFSv4.0 doesn't allow for delegation recovery on open expire */
++	nfs40_clear_delegation_stateid(state);
++	return nfs4_open_expired(sp, state);
++}
++
+ #if defined(CONFIG_NFS_V4_1)
+-static void nfs41_clear_delegation_stateid(struct nfs4_state *state)
++static void nfs41_check_delegation_stateid(struct nfs4_state *state)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	nfs4_stateid *stateid = &state->stateid;
++	nfs4_stateid stateid;
+ 	struct nfs_delegation *delegation;
+-	struct rpc_cred *cred = NULL;
+-	int status = -NFS4ERR_BAD_STATEID;
+-
+-	/* If a state reset has been done, test_stateid is unneeded */
+-	if (test_bit(NFS_DELEGATED_STATE, &state->flags) == 0)
+-		return;
++	struct rpc_cred *cred;
++	int status;
+ 
+ 	/* Get the delegation credential for use by test/free_stateid */
+ 	rcu_read_lock();
+ 	delegation = rcu_dereference(NFS_I(state->inode)->delegation);
+-	if (delegation != NULL &&
+-	    nfs4_stateid_match(&delegation->stateid, stateid)) {
+-		cred = get_rpccred(delegation->cred);
+-		rcu_read_unlock();
+-		status = nfs41_test_stateid(server, stateid, cred);
+-		trace_nfs4_test_delegation_stateid(state, NULL, status);
+-	} else
++	if (delegation == NULL) {
+ 		rcu_read_unlock();
++		return;
++	}
++
++	nfs4_stateid_copy(&stateid, &delegation->stateid);
++	cred = get_rpccred(delegation->cred);
++	rcu_read_unlock();
++	status = nfs41_test_stateid(server, &stateid, cred);
++	trace_nfs4_test_delegation_stateid(state, NULL, status);
+ 
+ 	if (status != NFS_OK) {
+ 		/* Free the stateid unless the server explicitly
+ 		 * informs us the stateid is unrecognized. */
+ 		if (status != -NFS4ERR_BAD_STATEID)
+-			nfs41_free_stateid(server, stateid, cred);
+-		nfs_remove_bad_delegation(state->inode);
+-
+-		write_seqlock(&state->seqlock);
+-		nfs4_stateid_copy(&state->stateid, &state->open_stateid);
+-		write_sequnlock(&state->seqlock);
+-		clear_bit(NFS_DELEGATED_STATE, &state->flags);
++			nfs41_free_stateid(server, &stateid, cred);
++		nfs_finish_clear_delegation_stateid(state);
+ 	}
+ 
+-	if (cred != NULL)
+-		put_rpccred(cred);
++	put_rpccred(cred);
+ }
+ 
+ /**
+@@ -2185,7 +2194,7 @@ static int nfs41_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *st
+ {
+ 	int status;
+ 
+-	nfs41_clear_delegation_stateid(state);
++	nfs41_check_delegation_stateid(state);
+ 	status = nfs41_check_open_stateid(state);
+ 	if (status != NFS_OK)
+ 		status = nfs4_open_expired(sp, state);
+@@ -4827,9 +4836,6 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
+ 		case -NFS4ERR_DELEG_REVOKED:
+ 		case -NFS4ERR_ADMIN_REVOKED:
+ 		case -NFS4ERR_BAD_STATEID:
+-			if (state == NULL)
+-				break;
+-			nfs_remove_bad_delegation(state->inode);
+ 		case -NFS4ERR_OPENMODE:
+ 			if (state == NULL)
+ 				break;
+@@ -8366,7 +8372,7 @@ static const struct nfs4_state_recovery_ops nfs41_reboot_recovery_ops = {
+ static const struct nfs4_state_recovery_ops nfs40_nograce_recovery_ops = {
+ 	.owner_flag_bit = NFS_OWNER_RECLAIM_NOGRACE,
+ 	.state_flag_bit	= NFS_STATE_RECLAIM_NOGRACE,
+-	.recover_open	= nfs4_open_expired,
++	.recover_open	= nfs40_open_expired,
+ 	.recover_lock	= nfs4_lock_expired,
+ 	.establish_clid = nfs4_init_clientid,
+ };
+diff --git a/include/dt-bindings/pinctrl/dra.h b/include/dt-bindings/pinctrl/dra.h
+index 3d33794e4f3e..7448edff4723 100644
+--- a/include/dt-bindings/pinctrl/dra.h
++++ b/include/dt-bindings/pinctrl/dra.h
+@@ -40,8 +40,8 @@
+ 
+ /* Active pin states */
+ #define PIN_OUTPUT		(0 | PULL_DIS)
+-#define PIN_OUTPUT_PULLUP	(PIN_OUTPUT | PULL_ENA | PULL_UP)
+-#define PIN_OUTPUT_PULLDOWN	(PIN_OUTPUT | PULL_ENA)
++#define PIN_OUTPUT_PULLUP	(PULL_UP)
++#define PIN_OUTPUT_PULLDOWN	(0)
+ #define PIN_INPUT		(INPUT_EN | PULL_DIS)
+ #define PIN_INPUT_SLEW		(INPUT_EN | SLEWCONTROL)
+ #define PIN_INPUT_PULLUP	(PULL_ENA | INPUT_EN | PULL_UP)
+diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
+index 4e2bd4c95b66..0995c2de8162 100644
+--- a/include/linux/bootmem.h
++++ b/include/linux/bootmem.h
+@@ -46,6 +46,7 @@ extern unsigned long init_bootmem_node(pg_data_t *pgdat,
+ extern unsigned long init_bootmem(unsigned long addr, unsigned long memend);
+ 
+ extern unsigned long free_all_bootmem(void);
++extern void reset_node_managed_pages(pg_data_t *pgdat);
+ extern void reset_all_zones_managed_pages(void);
+ 
+ extern void free_bootmem_node(pg_data_t *pgdat,
+diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h
+index 653f0e2b6ca9..abcafaa20b86 100644
+--- a/include/linux/clocksource.h
++++ b/include/linux/clocksource.h
+@@ -287,7 +287,7 @@ extern struct clocksource* clocksource_get_next(void);
+ extern void clocksource_change_rating(struct clocksource *cs, int rating);
+ extern void clocksource_suspend(void);
+ extern void clocksource_resume(void);
+-extern struct clocksource * __init __weak clocksource_default_clock(void);
++extern struct clocksource * __init clocksource_default_clock(void);
+ extern void clocksource_mark_unstable(struct clocksource *cs);
+ 
+ extern u64
+diff --git a/include/linux/crash_dump.h b/include/linux/crash_dump.h
+index 72ab536ad3de..3849fce7ecfe 100644
+--- a/include/linux/crash_dump.h
++++ b/include/linux/crash_dump.h
+@@ -14,14 +14,13 @@
+ extern unsigned long long elfcorehdr_addr;
+ extern unsigned long long elfcorehdr_size;
+ 
+-extern int __weak elfcorehdr_alloc(unsigned long long *addr,
+-				   unsigned long long *size);
+-extern void __weak elfcorehdr_free(unsigned long long addr);
+-extern ssize_t __weak elfcorehdr_read(char *buf, size_t count, u64 *ppos);
+-extern ssize_t __weak elfcorehdr_read_notes(char *buf, size_t count, u64 *ppos);
+-extern int __weak remap_oldmem_pfn_range(struct vm_area_struct *vma,
+-					 unsigned long from, unsigned long pfn,
+-					 unsigned long size, pgprot_t prot);
++extern int elfcorehdr_alloc(unsigned long long *addr, unsigned long long *size);
++extern void elfcorehdr_free(unsigned long long addr);
++extern ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos);
++extern ssize_t elfcorehdr_read_notes(char *buf, size_t count, u64 *ppos);
++extern int remap_oldmem_pfn_range(struct vm_area_struct *vma,
++				  unsigned long from, unsigned long pfn,
++				  unsigned long size, pgprot_t prot);
+ 
+ extern ssize_t copy_oldmem_page(unsigned long, char *, size_t,
+ 						unsigned long, int);
+diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h
+index 6b06d378f3df..e465bb15912d 100644
+--- a/include/linux/kgdb.h
++++ b/include/linux/kgdb.h
+@@ -283,7 +283,7 @@ struct kgdb_io {
+ 
+ extern struct kgdb_arch		arch_kgdb_ops;
+ 
+-extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
++extern unsigned long kgdb_arch_pc(int exception, struct pt_regs *regs);
+ 
+ #ifdef CONFIG_SERIAL_KGDB_NMI
+ extern int kgdb_register_nmi_console(void);
+diff --git a/include/linux/khugepaged.h b/include/linux/khugepaged.h
+index 6b394f0b5148..eeb307985715 100644
+--- a/include/linux/khugepaged.h
++++ b/include/linux/khugepaged.h
+@@ -6,7 +6,8 @@
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+ extern int __khugepaged_enter(struct mm_struct *mm);
+ extern void __khugepaged_exit(struct mm_struct *mm);
+-extern int khugepaged_enter_vma_merge(struct vm_area_struct *vma);
++extern int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
++				      unsigned long vm_flags);
+ 
+ #define khugepaged_enabled()					       \
+ 	(transparent_hugepage_flags &				       \
+@@ -35,13 +36,13 @@ static inline void khugepaged_exit(struct mm_struct *mm)
+ 		__khugepaged_exit(mm);
+ }
+ 
+-static inline int khugepaged_enter(struct vm_area_struct *vma)
++static inline int khugepaged_enter(struct vm_area_struct *vma,
++				   unsigned long vm_flags)
+ {
+ 	if (!test_bit(MMF_VM_HUGEPAGE, &vma->vm_mm->flags))
+ 		if ((khugepaged_always() ||
+-		     (khugepaged_req_madv() &&
+-		      vma->vm_flags & VM_HUGEPAGE)) &&
+-		    !(vma->vm_flags & VM_NOHUGEPAGE))
++		     (khugepaged_req_madv() && (vm_flags & VM_HUGEPAGE))) &&
++		    !(vm_flags & VM_NOHUGEPAGE))
+ 			if (__khugepaged_enter(vma->vm_mm))
+ 				return -ENOMEM;
+ 	return 0;
+@@ -54,11 +55,13 @@ static inline int khugepaged_fork(struct mm_struct *mm, struct mm_struct *oldmm)
+ static inline void khugepaged_exit(struct mm_struct *mm)
+ {
+ }
+-static inline int khugepaged_enter(struct vm_area_struct *vma)
++static inline int khugepaged_enter(struct vm_area_struct *vma,
++				   unsigned long vm_flags)
+ {
+ 	return 0;
+ }
+-static inline int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
++static inline int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
++					     unsigned long vm_flags)
+ {
+ 	return 0;
+ }
+diff --git a/include/linux/memory.h b/include/linux/memory.h
+index bb7384e3c3d8..8b8d8d12348e 100644
+--- a/include/linux/memory.h
++++ b/include/linux/memory.h
+@@ -35,7 +35,7 @@ struct memory_block {
+ };
+ 
+ int arch_get_memory_phys_device(unsigned long start_pfn);
+-unsigned long __weak memory_block_size_bytes(void);
++unsigned long memory_block_size_bytes(void);
+ 
+ /* These states are exposed to userspace as text strings in sysfs */
+ #define	MEM_ONLINE		(1<<0) /* exposed to userspace */
+diff --git a/include/linux/mfd/max77693-private.h b/include/linux/mfd/max77693-private.h
+index c466ff3e16b8..dc558cffd5db 100644
+--- a/include/linux/mfd/max77693-private.h
++++ b/include/linux/mfd/max77693-private.h
+@@ -262,6 +262,13 @@ enum max77693_irq_source {
+ 	MAX77693_IRQ_GROUP_NR,
+ };
+ 
++#define SRC_IRQ_CHARGER			BIT(0)
++#define SRC_IRQ_TOP			BIT(1)
++#define SRC_IRQ_FLASH			BIT(2)
++#define SRC_IRQ_MUIC			BIT(3)
++#define SRC_IRQ_ALL			(SRC_IRQ_CHARGER | SRC_IRQ_TOP \
++						| SRC_IRQ_FLASH | SRC_IRQ_MUIC)
++
+ #define LED_IRQ_FLED2_OPEN		BIT(0)
+ #define LED_IRQ_FLED2_SHORT		BIT(1)
+ #define LED_IRQ_FLED1_OPEN		BIT(2)
+diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
+index 318df7051850..b21bac467dbe 100644
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -431,6 +431,15 @@ struct zone {
+ 	 */
+ 	int			nr_migrate_reserve_block;
+ 
++#ifdef CONFIG_MEMORY_ISOLATION
++	/*
++	 * Number of isolated pageblock. It is used to solve incorrect
++	 * freepage counting problem due to racy retrieving migratetype
++	 * of pageblock. Protected by zone->lock.
++	 */
++	unsigned long		nr_isolate_pageblock;
++#endif
++
+ #ifdef CONFIG_MEMORY_HOTPLUG
+ 	/* see spanned/present_pages for more description */
+ 	seqlock_t		span_seqlock;
+diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
+index 0040629894df..cbec0ee54e10 100644
+--- a/include/linux/nfs_xdr.h
++++ b/include/linux/nfs_xdr.h
+@@ -1232,11 +1232,22 @@ struct nfs41_free_stateid_res {
+ 	unsigned int			status;
+ };
+ 
++static inline void
++nfs_free_pnfs_ds_cinfo(struct pnfs_ds_commit_info *cinfo)
++{
++	kfree(cinfo->buckets);
++}
++
+ #else
+ 
+ struct pnfs_ds_commit_info {
+ };
+ 
++static inline void
++nfs_free_pnfs_ds_cinfo(struct pnfs_ds_commit_info *cinfo)
++{
++}
++
+ #endif /* CONFIG_NFS_V4_1 */
+ 
+ struct nfs_page;
+diff --git a/include/linux/page-isolation.h b/include/linux/page-isolation.h
+index 3fff8e774067..2dc1e1697b45 100644
+--- a/include/linux/page-isolation.h
++++ b/include/linux/page-isolation.h
+@@ -2,6 +2,10 @@
+ #define __LINUX_PAGEISOLATION_H
+ 
+ #ifdef CONFIG_MEMORY_ISOLATION
++static inline bool has_isolate_pageblock(struct zone *zone)
++{
++	return zone->nr_isolate_pageblock;
++}
+ static inline bool is_migrate_isolate_page(struct page *page)
+ {
+ 	return get_pageblock_migratetype(page) == MIGRATE_ISOLATE;
+@@ -11,6 +15,10 @@ static inline bool is_migrate_isolate(int migratetype)
+ 	return migratetype == MIGRATE_ISOLATE;
+ }
+ #else
++static inline bool has_isolate_pageblock(struct zone *zone)
++{
++	return false;
++}
+ static inline bool is_migrate_isolate_page(struct page *page)
+ {
+ 	return false;
+diff --git a/include/linux/power/charger-manager.h b/include/linux/power/charger-manager.h
+index 07e7945a1ff2..e97fc656a058 100644
+--- a/include/linux/power/charger-manager.h
++++ b/include/linux/power/charger-manager.h
+@@ -253,9 +253,6 @@ struct charger_manager {
+ 	struct device *dev;
+ 	struct charger_desc *desc;
+ 
+-	struct power_supply *fuel_gauge;
+-	struct power_supply **charger_stat;
+-
+ #ifdef CONFIG_THERMAL
+ 	struct thermal_zone_device *tzd_batt;
+ #endif
+diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
+index 49a4d6f59108..e2c13cd863bd 100644
+--- a/include/linux/ring_buffer.h
++++ b/include/linux/ring_buffer.h
+@@ -97,7 +97,7 @@ __ring_buffer_alloc(unsigned long size, unsigned flags, struct lock_class_key *k
+ 	__ring_buffer_alloc((size), (flags), &__key);	\
+ })
+ 
+-int ring_buffer_wait(struct ring_buffer *buffer, int cpu);
++int ring_buffer_wait(struct ring_buffer *buffer, int cpu, bool full);
+ int ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu,
+ 			  struct file *filp, poll_table *poll_table);
+ 
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index 9fbd856e6713..856f01cb51dd 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -426,6 +426,11 @@ static inline void sctp_assoc_pending_pmtu(struct sock *sk, struct sctp_associat
+ 	asoc->pmtu_pending = 0;
+ }
+ 
++static inline bool sctp_chunk_pending(const struct sctp_chunk *chunk)
++{
++	return !list_empty(&chunk->list);
++}
++
+ /* Walk through a list of TLV parameters.  Don't trust the
+  * individual parameter lengths and instead depend on
+  * the chunk length to indicate when to stop.  Make sure
+diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
+index 7f4eeb340a54..72a31db47ded 100644
+--- a/include/net/sctp/sm.h
++++ b/include/net/sctp/sm.h
+@@ -248,9 +248,9 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *,
+ 					      int, __be16);
+ struct sctp_chunk *sctp_make_asconf_set_prim(struct sctp_association *asoc,
+ 					     union sctp_addr *addr);
+-int sctp_verify_asconf(const struct sctp_association *asoc,
+-		       struct sctp_paramhdr *param_hdr, void *chunk_end,
+-		       struct sctp_paramhdr **errp);
++bool sctp_verify_asconf(const struct sctp_association *asoc,
++			struct sctp_chunk *chunk, bool addr_param_needed,
++			struct sctp_paramhdr **errp);
+ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ 				       struct sctp_chunk *asconf);
+ int sctp_process_asconf_ack(struct sctp_association *asoc,
+diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h
+index ffd69cbded35..55003b84e2e1 100644
+--- a/include/net/udp_tunnel.h
++++ b/include/net/udp_tunnel.h
+@@ -26,6 +26,15 @@ struct udp_port_cfg {
+ 				use_udp6_rx_checksums:1;
+ };
+ 
++static inline void udp_tunnel_gro_complete(struct sk_buff *skb, int nhoff)
++{
++	struct udphdr *uh;
++
++	uh = (struct udphdr *)(skb->data + nhoff - sizeof(struct udphdr));
++	skb_shinfo(skb)->gso_type |= uh->check ?
++				SKB_GSO_UDP_TUNNEL_CSUM : SKB_GSO_UDP_TUNNEL;
++}
++
+ int udp_sock_create(struct net *net, struct udp_port_cfg *cfg,
+ 		    struct socket **sockp);
+ 
+diff --git a/include/uapi/linux/netfilter/xt_bpf.h b/include/uapi/linux/netfilter/xt_bpf.h
+index 1fad2c27ac32..5df03939f69f 100644
+--- a/include/uapi/linux/netfilter/xt_bpf.h
++++ b/include/uapi/linux/netfilter/xt_bpf.h
+@@ -8,6 +8,8 @@
+ 
+ struct bpf_prog;
+ 
++struct sk_filter;
++
+ struct xt_bpf_info {
+ 	__u16 bpf_program_num_elem;
+ 	struct sock_filter bpf_program[XT_BPF_MAX_NUM_INSTR];
+diff --git a/init/main.c b/init/main.c
+index bb1aed928f21..d0f4b5902c62 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -544,7 +544,7 @@ asmlinkage __visible void __init start_kernel(void)
+ 				  static_command_line, __start___param,
+ 				  __stop___param - __start___param,
+ 				  -1, -1, &unknown_bootoption);
+-	if (after_dashes)
++	if (!IS_ERR_OR_NULL(after_dashes))
+ 		parse_args("Setting init args", after_dashes, NULL, 0, -1, -1,
+ 			   set_init_arg);
+ 
+diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
+index c3f0326e98db..e8075b247497 100644
+--- a/ipc/ipc_sysctl.c
++++ b/ipc/ipc_sysctl.c
+@@ -123,7 +123,6 @@ static int proc_ipcauto_dointvec_minmax(struct ctl_table *table, int write,
+ 	void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+ 	struct ctl_table ipc_table;
+-	size_t lenp_bef = *lenp;
+ 	int oldval;
+ 	int rc;
+ 
+@@ -133,7 +132,7 @@ static int proc_ipcauto_dointvec_minmax(struct ctl_table *table, int write,
+ 
+ 	rc = proc_dointvec_minmax(&ipc_table, write, buffer, lenp, ppos);
+ 
+-	if (write && !rc && lenp_bef == *lenp) {
++	if (write && !rc) {
+ 		int newval = *((int *)(ipc_table.data));
+ 		/*
+ 		 * The file "auto_msgmni" has correctly been set.
+diff --git a/kernel/audit.c b/kernel/audit.c
+index ba2ff5a5c600..6726aa6f82be 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -724,7 +724,7 @@ static int audit_get_feature(struct sk_buff *skb)
+ 
+ 	seq = nlmsg_hdr(skb)->nlmsg_seq;
+ 
+-	audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &af, sizeof(af));
++	audit_send_reply(skb, seq, AUDIT_GET_FEATURE, 0, 0, &af, sizeof(af));
+ 
+ 	return 0;
+ }
+@@ -739,7 +739,7 @@ static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature
+ 
+ 	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_FEATURE_CHANGE);
+ 	audit_log_task_info(ab, current);
+-	audit_log_format(ab, "feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d",
++	audit_log_format(ab, " feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d",
+ 			 audit_feature_names[which], !!old_feature, !!new_feature,
+ 			 !!old_lock, !!new_lock, res);
+ 	audit_log_end(ab);
+diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
+index 135944a7b28a..a79db03990db 100644
+--- a/kernel/audit_tree.c
++++ b/kernel/audit_tree.c
+@@ -154,6 +154,7 @@ static struct audit_chunk *alloc_chunk(int count)
+ 		chunk->owners[i].index = i;
+ 	}
+ 	fsnotify_init_mark(&chunk->mark, audit_tree_destroy_watch);
++	chunk->mark.mask = FS_IN_IGNORED;
+ 	return chunk;
+ }
+ 
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 1b70cb6fbe3c..89a404a63ae5 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -1928,7 +1928,7 @@ static void rcu_report_qs_rsp(struct rcu_state *rsp, unsigned long flags)
+ {
+ 	WARN_ON_ONCE(!rcu_gp_in_progress(rsp));
+ 	raw_spin_unlock_irqrestore(&rcu_get_root(rsp)->lock, flags);
+-	wake_up(&rsp->gp_wq);  /* Memory barrier implied by wake_up() path. */
++	rcu_gp_kthread_wake(rsp);
+ }
+ 
+ /*
+@@ -2507,7 +2507,7 @@ static void force_quiescent_state(struct rcu_state *rsp)
+ 	}
+ 	ACCESS_ONCE(rsp->gp_flags) |= RCU_GP_FLAG_FQS;
+ 	raw_spin_unlock_irqrestore(&rnp_old->lock, flags);
+-	wake_up(&rsp->gp_wq);  /* Memory barrier implied by wake_up() path. */
++	rcu_gp_kthread_wake(rsp);
+ }
+ 
+ /*
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 2d75c94ae87d..a56e07c8d15b 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -538,16 +538,18 @@ static void rb_wake_up_waiters(struct irq_work *work)
+  * ring_buffer_wait - wait for input to the ring buffer
+  * @buffer: buffer to wait on
+  * @cpu: the cpu buffer to wait on
++ * @full: wait until a full page is available, if @cpu != RING_BUFFER_ALL_CPUS
+  *
+  * If @cpu == RING_BUFFER_ALL_CPUS then the task will wake up as soon
+  * as data is added to any of the @buffer's cpu buffers. Otherwise
+  * it will wait for data to be added to a specific cpu buffer.
+  */
+-int ring_buffer_wait(struct ring_buffer *buffer, int cpu)
++int ring_buffer_wait(struct ring_buffer *buffer, int cpu, bool full)
+ {
+-	struct ring_buffer_per_cpu *cpu_buffer;
++	struct ring_buffer_per_cpu *uninitialized_var(cpu_buffer);
+ 	DEFINE_WAIT(wait);
+ 	struct rb_irq_work *work;
++	int ret = 0;
+ 
+ 	/*
+ 	 * Depending on what the caller is waiting for, either any
+@@ -564,36 +566,61 @@ int ring_buffer_wait(struct ring_buffer *buffer, int cpu)
+ 	}
+ 
+ 
+-	prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE);
++	while (true) {
++		prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE);
+ 
+-	/*
+-	 * The events can happen in critical sections where
+-	 * checking a work queue can cause deadlocks.
+-	 * After adding a task to the queue, this flag is set
+-	 * only to notify events to try to wake up the queue
+-	 * using irq_work.
+-	 *
+-	 * We don't clear it even if the buffer is no longer
+-	 * empty. The flag only causes the next event to run
+-	 * irq_work to do the work queue wake up. The worse
+-	 * that can happen if we race with !trace_empty() is that
+-	 * an event will cause an irq_work to try to wake up
+-	 * an empty queue.
+-	 *
+-	 * There's no reason to protect this flag either, as
+-	 * the work queue and irq_work logic will do the necessary
+-	 * synchronization for the wake ups. The only thing
+-	 * that is necessary is that the wake up happens after
+-	 * a task has been queued. It's OK for spurious wake ups.
+-	 */
+-	work->waiters_pending = true;
++		/*
++		 * The events can happen in critical sections where
++		 * checking a work queue can cause deadlocks.
++		 * After adding a task to the queue, this flag is set
++		 * only to notify events to try to wake up the queue
++		 * using irq_work.
++		 *
++		 * We don't clear it even if the buffer is no longer
++		 * empty. The flag only causes the next event to run
++		 * irq_work to do the work queue wake up. The worse
++		 * that can happen if we race with !trace_empty() is that
++		 * an event will cause an irq_work to try to wake up
++		 * an empty queue.
++		 *
++		 * There's no reason to protect this flag either, as
++		 * the work queue and irq_work logic will do the necessary
++		 * synchronization for the wake ups. The only thing
++		 * that is necessary is that the wake up happens after
++		 * a task has been queued. It's OK for spurious wake ups.
++		 */
++		work->waiters_pending = true;
++
++		if (signal_pending(current)) {
++			ret = -EINTR;
++			break;
++		}
++
++		if (cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer))
++			break;
++
++		if (cpu != RING_BUFFER_ALL_CPUS &&
++		    !ring_buffer_empty_cpu(buffer, cpu)) {
++			unsigned long flags;
++			bool pagebusy;
++
++			if (!full)
++				break;
++
++			raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
++			pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page;
++			raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
++
++			if (!pagebusy)
++				break;
++		}
+ 
+-	if ((cpu == RING_BUFFER_ALL_CPUS && ring_buffer_empty(buffer)) ||
+-	    (cpu != RING_BUFFER_ALL_CPUS && ring_buffer_empty_cpu(buffer, cpu)))
+ 		schedule();
++	}
+ 
+ 	finish_wait(&work->waiters, &wait);
+-	return 0;
++
++	return ret;
+ }
+ 
+ /**
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 8a528392b1f4..15209335888d 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -1076,13 +1076,14 @@ update_max_tr_single(struct trace_array *tr, struct task_struct *tsk, int cpu)
+ }
+ #endif /* CONFIG_TRACER_MAX_TRACE */
+ 
+-static int wait_on_pipe(struct trace_iterator *iter)
++static int wait_on_pipe(struct trace_iterator *iter, bool full)
+ {
+ 	/* Iterators are static, they should be filled or empty */
+ 	if (trace_buffer_iter(iter, iter->cpu_file))
+ 		return 0;
+ 
+-	return ring_buffer_wait(iter->trace_buffer->buffer, iter->cpu_file);
++	return ring_buffer_wait(iter->trace_buffer->buffer, iter->cpu_file,
++				full);
+ }
+ 
+ #ifdef CONFIG_FTRACE_STARTUP_TEST
+@@ -4434,15 +4435,12 @@ static int tracing_wait_pipe(struct file *filp)
+ 
+ 		mutex_unlock(&iter->mutex);
+ 
+-		ret = wait_on_pipe(iter);
++		ret = wait_on_pipe(iter, false);
+ 
+ 		mutex_lock(&iter->mutex);
+ 
+ 		if (ret)
+ 			return ret;
+-
+-		if (signal_pending(current))
+-			return -EINTR;
+ 	}
+ 
+ 	return 1;
+@@ -5372,16 +5370,12 @@ tracing_buffers_read(struct file *filp, char __user *ubuf,
+ 				goto out_unlock;
+ 			}
+ 			mutex_unlock(&trace_types_lock);
+-			ret = wait_on_pipe(iter);
++			ret = wait_on_pipe(iter, false);
+ 			mutex_lock(&trace_types_lock);
+ 			if (ret) {
+ 				size = ret;
+ 				goto out_unlock;
+ 			}
+-			if (signal_pending(current)) {
+-				size = -EINTR;
+-				goto out_unlock;
+-			}
+ 			goto again;
+ 		}
+ 		size = 0;
+@@ -5587,14 +5581,11 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
+ 			goto out;
+ 		}
+ 		mutex_unlock(&trace_types_lock);
+-		ret = wait_on_pipe(iter);
++		ret = wait_on_pipe(iter, true);
+ 		mutex_lock(&trace_types_lock);
+ 		if (ret)
+ 			goto out;
+-		if (signal_pending(current)) {
+-			ret = -EINTR;
+-			goto out;
+-		}
++
+ 		goto again;
+ 	}
+ 
+diff --git a/mm/bootmem.c b/mm/bootmem.c
+index 90bd3507b413..6603a7c4b136 100644
+--- a/mm/bootmem.c
++++ b/mm/bootmem.c
+@@ -243,13 +243,10 @@ static unsigned long __init free_all_bootmem_core(bootmem_data_t *bdata)
+ 
+ static int reset_managed_pages_done __initdata;
+ 
+-static inline void __init reset_node_managed_pages(pg_data_t *pgdat)
++void reset_node_managed_pages(pg_data_t *pgdat)
+ {
+ 	struct zone *z;
+ 
+-	if (reset_managed_pages_done)
+-		return;
+-
+ 	for (z = pgdat->node_zones; z < pgdat->node_zones + MAX_NR_ZONES; z++)
+ 		z->managed_pages = 0;
+ }
+@@ -258,8 +255,12 @@ void __init reset_all_zones_managed_pages(void)
+ {
+ 	struct pglist_data *pgdat;
+ 
++	if (reset_managed_pages_done)
++		return;
++
+ 	for_each_online_pgdat(pgdat)
+ 		reset_node_managed_pages(pgdat);
++
+ 	reset_managed_pages_done = 1;
+ }
+ 
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 45c6d6738dfa..23e900255205 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -803,7 +803,7 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 		return VM_FAULT_FALLBACK;
+ 	if (unlikely(anon_vma_prepare(vma)))
+ 		return VM_FAULT_OOM;
+-	if (unlikely(khugepaged_enter(vma)))
++	if (unlikely(khugepaged_enter(vma, vma->vm_flags)))
+ 		return VM_FAULT_OOM;
+ 	if (!(flags & FAULT_FLAG_WRITE) &&
+ 			transparent_hugepage_use_zero_page()) {
+@@ -1970,7 +1970,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
+ 		 * register it here without waiting a page fault that
+ 		 * may not happen any time soon.
+ 		 */
+-		if (unlikely(khugepaged_enter_vma_merge(vma)))
++		if (unlikely(khugepaged_enter_vma_merge(vma, *vm_flags)))
+ 			return -ENOMEM;
+ 		break;
+ 	case MADV_NOHUGEPAGE:
+@@ -2071,7 +2071,8 @@ int __khugepaged_enter(struct mm_struct *mm)
+ 	return 0;
+ }
+ 
+-int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
++int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
++			       unsigned long vm_flags)
+ {
+ 	unsigned long hstart, hend;
+ 	if (!vma->anon_vma)
+@@ -2083,11 +2084,11 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
+ 	if (vma->vm_ops)
+ 		/* khugepaged not yet working on file or special mappings */
+ 		return 0;
+-	VM_BUG_ON(vma->vm_flags & VM_NO_THP);
++	VM_BUG_ON(vm_flags & VM_NO_THP);
+ 	hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ 	hend = vma->vm_end & HPAGE_PMD_MASK;
+ 	if (hstart < hend)
+-		return khugepaged_enter(vma);
++		return khugepaged_enter(vma, vm_flags);
+ 	return 0;
+ }
+ 
+diff --git a/mm/internal.h b/mm/internal.h
+index a1b651b11c5f..5f2772f97013 100644
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -108,6 +108,31 @@ extern pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address);
+ /*
+  * in mm/page_alloc.c
+  */
++
++/*
++ * Locate the struct page for both the matching buddy in our
++ * pair (buddy1) and the combined O(n+1) page they form (page).
++ *
++ * 1) Any buddy B1 will have an order O twin B2 which satisfies
++ * the following equation:
++ *     B2 = B1 ^ (1 << O)
++ * For example, if the starting buddy (buddy2) is #8 its order
++ * 1 buddy is #10:
++ *     B2 = 8 ^ (1 << 1) = 8 ^ 2 = 10
++ *
++ * 2) Any buddy B will have an order O+1 parent P which
++ * satisfies the following equation:
++ *     P = B & ~(1 << O)
++ *
++ * Assumption: *_mem_map is contiguous at least up to MAX_ORDER
++ */
++static inline unsigned long
++__find_buddy_index(unsigned long page_idx, unsigned int order)
++{
++	return page_idx ^ (1 << order);
++}
++
++extern int __isolate_free_page(struct page *page, unsigned int order);
+ extern void __free_pages_bootmem(struct page *page, unsigned int order);
+ extern void prep_compound_page(struct page *page, unsigned long order);
+ #ifdef CONFIG_MEMORY_FAILURE
+diff --git a/mm/iov_iter.c b/mm/iov_iter.c
+index 9a09f2034fcc..141dcf796d28 100644
+--- a/mm/iov_iter.c
++++ b/mm/iov_iter.c
+@@ -699,9 +699,9 @@ size_t iov_iter_single_seg_count(const struct iov_iter *i)
+ 	if (i->nr_segs == 1)
+ 		return i->count;
+ 	else if (i->type & ITER_BVEC)
+-		return min(i->count, i->iov->iov_len - i->iov_offset);
+-	else
+ 		return min(i->count, i->bvec->bv_len - i->iov_offset);
++	else
++		return min(i->count, i->iov->iov_len - i->iov_offset);
+ }
+ EXPORT_SYMBOL(iov_iter_single_seg_count);
+ 
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 2ff8c2325e96..55f94669d7c6 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -31,6 +31,7 @@
+ #include <linux/stop_machine.h>
+ #include <linux/hugetlb.h>
+ #include <linux/memblock.h>
++#include <linux/bootmem.h>
+ 
+ #include <asm/tlbflush.h>
+ 
+@@ -1066,6 +1067,16 @@ out:
+ }
+ #endif /* CONFIG_MEMORY_HOTPLUG_SPARSE */
+ 
++static void reset_node_present_pages(pg_data_t *pgdat)
++{
++	struct zone *z;
++
++	for (z = pgdat->node_zones; z < pgdat->node_zones + MAX_NR_ZONES; z++)
++		z->present_pages = 0;
++
++	pgdat->node_present_pages = 0;
++}
++
+ /* we are OK calling __meminit stuff here - we have CONFIG_MEMORY_HOTPLUG */
+ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
+ {
+@@ -1096,6 +1107,21 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
+ 	build_all_zonelists(pgdat, NULL);
+ 	mutex_unlock(&zonelists_mutex);
+ 
++	/*
++	 * zone->managed_pages is set to an approximate value in
++	 * free_area_init_core(), which will cause
++	 * /sys/device/system/node/nodeX/meminfo has wrong data.
++	 * So reset it to 0 before any memory is onlined.
++	 */
++	reset_node_managed_pages(pgdat);
++
++	/*
++	 * When memory is hot-added, all the memory is in offline state. So
++	 * clear all zones' present_pages because they will be updated in
++	 * online_pages() and offline_pages().
++	 */
++	reset_node_present_pages(pgdat);
++
+ 	return pgdat;
+ }
+ 
+diff --git a/mm/mmap.c b/mm/mmap.c
+index c0a3637cdb64..ebc25fab1545 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1056,7 +1056,7 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+ 				end, prev->vm_pgoff, NULL);
+ 		if (err)
+ 			return NULL;
+-		khugepaged_enter_vma_merge(prev);
++		khugepaged_enter_vma_merge(prev, vm_flags);
+ 		return prev;
+ 	}
+ 
+@@ -1075,7 +1075,7 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+ 				next->vm_pgoff - pglen, NULL);
+ 		if (err)
+ 			return NULL;
+-		khugepaged_enter_vma_merge(area);
++		khugepaged_enter_vma_merge(area, vm_flags);
+ 		return area;
+ 	}
+ 
+@@ -2192,7 +2192,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+ 		}
+ 	}
+ 	vma_unlock_anon_vma(vma);
+-	khugepaged_enter_vma_merge(vma);
++	khugepaged_enter_vma_merge(vma, vma->vm_flags);
+ 	validate_mm(vma->vm_mm);
+ 	return error;
+ }
+@@ -2261,7 +2261,7 @@ int expand_downwards(struct vm_area_struct *vma,
+ 		}
+ 	}
+ 	vma_unlock_anon_vma(vma);
+-	khugepaged_enter_vma_merge(vma);
++	khugepaged_enter_vma_merge(vma, vma->vm_flags);
+ 	validate_mm(vma->vm_mm);
+ 	return error;
+ }
+diff --git a/mm/nobootmem.c b/mm/nobootmem.c
+index 7c7ab32ee503..90b50468333e 100644
+--- a/mm/nobootmem.c
++++ b/mm/nobootmem.c
+@@ -145,12 +145,10 @@ static unsigned long __init free_low_memory_core_early(void)
+ 
+ static int reset_managed_pages_done __initdata;
+ 
+-static inline void __init reset_node_managed_pages(pg_data_t *pgdat)
++void reset_node_managed_pages(pg_data_t *pgdat)
+ {
+ 	struct zone *z;
+ 
+-	if (reset_managed_pages_done)
+-		return;
+ 	for (z = pgdat->node_zones; z < pgdat->node_zones + MAX_NR_ZONES; z++)
+ 		z->managed_pages = 0;
+ }
+@@ -159,8 +157,12 @@ void __init reset_all_zones_managed_pages(void)
+ {
+ 	struct pglist_data *pgdat;
+ 
++	if (reset_managed_pages_done)
++		return;
++
+ 	for_each_online_pgdat(pgdat)
+ 		reset_node_managed_pages(pgdat);
++
+ 	reset_managed_pages_done = 1;
+ }
+ 
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 8c5029f22bbe..c5fe124d6cdb 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -468,29 +468,6 @@ static inline void rmv_page_order(struct page *page)
+ }
+ 
+ /*
+- * Locate the struct page for both the matching buddy in our
+- * pair (buddy1) and the combined O(n+1) page they form (page).
+- *
+- * 1) Any buddy B1 will have an order O twin B2 which satisfies
+- * the following equation:
+- *     B2 = B1 ^ (1 << O)
+- * For example, if the starting buddy (buddy2) is #8 its order
+- * 1 buddy is #10:
+- *     B2 = 8 ^ (1 << 1) = 8 ^ 2 = 10
+- *
+- * 2) Any buddy B will have an order O+1 parent P which
+- * satisfies the following equation:
+- *     P = B & ~(1 << O)
+- *
+- * Assumption: *_mem_map is contiguous at least up to MAX_ORDER
+- */
+-static inline unsigned long
+-__find_buddy_index(unsigned long page_idx, unsigned int order)
+-{
+-	return page_idx ^ (1 << order);
+-}
+-
+-/*
+  * This function checks whether a page is free && is the buddy
+  * we can do coalesce a page and its buddy if
+  * (a) the buddy is not in a hole &&
+@@ -570,6 +547,7 @@ static inline void __free_one_page(struct page *page,
+ 	unsigned long combined_idx;
+ 	unsigned long uninitialized_var(buddy_idx);
+ 	struct page *buddy;
++	int max_order = MAX_ORDER;
+ 
+ 	VM_BUG_ON(!zone_is_initialized(zone));
+ 
+@@ -578,13 +556,24 @@ static inline void __free_one_page(struct page *page,
+ 			return;
+ 
+ 	VM_BUG_ON(migratetype == -1);
++	if (is_migrate_isolate(migratetype)) {
++		/*
++		 * We restrict max order of merging to prevent merge
++		 * between freepages on isolate pageblock and normal
++		 * pageblock. Without this, pageblock isolation
++		 * could cause incorrect freepage accounting.
++		 */
++		max_order = min(MAX_ORDER, pageblock_order + 1);
++	} else {
++		__mod_zone_freepage_state(zone, 1 << order, migratetype);
++	}
+ 
+-	page_idx = pfn & ((1 << MAX_ORDER) - 1);
++	page_idx = pfn & ((1 << max_order) - 1);
+ 
+ 	VM_BUG_ON_PAGE(page_idx & ((1 << order) - 1), page);
+ 	VM_BUG_ON_PAGE(bad_range(zone, page), page);
+ 
+-	while (order < MAX_ORDER-1) {
++	while (order < max_order - 1) {
+ 		buddy_idx = __find_buddy_index(page_idx, order);
+ 		buddy = page + (buddy_idx - page_idx);
+ 		if (!page_is_buddy(page, buddy, order))
+@@ -716,14 +705,12 @@ static void free_pcppages_bulk(struct zone *zone, int count,
+ 			/* must delete as __free_one_page list manipulates */
+ 			list_del(&page->lru);
+ 			mt = get_freepage_migratetype(page);
++			if (unlikely(has_isolate_pageblock(zone)))
++				mt = get_pageblock_migratetype(page);
++
+ 			/* MIGRATE_MOVABLE list may include MIGRATE_RESERVEs */
+ 			__free_one_page(page, page_to_pfn(page), zone, 0, mt);
+ 			trace_mm_page_pcpu_drain(page, 0, mt);
+-			if (likely(!is_migrate_isolate_page(page))) {
+-				__mod_zone_page_state(zone, NR_FREE_PAGES, 1);
+-				if (is_migrate_cma(mt))
+-					__mod_zone_page_state(zone, NR_FREE_CMA_PAGES, 1);
+-			}
+ 		} while (--to_free && --batch_free && !list_empty(list));
+ 	}
+ 	spin_unlock(&zone->lock);
+@@ -740,9 +727,11 @@ static void free_one_page(struct zone *zone,
+ 	if (nr_scanned)
+ 		__mod_zone_page_state(zone, NR_PAGES_SCANNED, -nr_scanned);
+ 
++	if (unlikely(has_isolate_pageblock(zone) ||
++		is_migrate_isolate(migratetype))) {
++		migratetype = get_pfnblock_migratetype(page, pfn);
++	}
+ 	__free_one_page(page, pfn, zone, order, migratetype);
+-	if (unlikely(!is_migrate_isolate(migratetype)))
+-		__mod_zone_freepage_state(zone, 1 << order, migratetype);
+ 	spin_unlock(&zone->lock);
+ }
+ 
+@@ -1485,7 +1474,7 @@ void split_page(struct page *page, unsigned int order)
+ }
+ EXPORT_SYMBOL_GPL(split_page);
+ 
+-static int __isolate_free_page(struct page *page, unsigned int order)
++int __isolate_free_page(struct page *page, unsigned int order)
+ {
+ 	unsigned long watermark;
+ 	struct zone *zone;
+diff --git a/mm/page_isolation.c b/mm/page_isolation.c
+index d1473b2e9481..c8778f7e208e 100644
+--- a/mm/page_isolation.c
++++ b/mm/page_isolation.c
+@@ -60,6 +60,7 @@ out:
+ 		int migratetype = get_pageblock_migratetype(page);
+ 
+ 		set_pageblock_migratetype(page, MIGRATE_ISOLATE);
++		zone->nr_isolate_pageblock++;
+ 		nr_pages = move_freepages_block(zone, page, MIGRATE_ISOLATE);
+ 
+ 		__mod_zone_freepage_state(zone, -nr_pages, migratetype);
+@@ -75,16 +76,54 @@ void unset_migratetype_isolate(struct page *page, unsigned migratetype)
+ {
+ 	struct zone *zone;
+ 	unsigned long flags, nr_pages;
++	struct page *isolated_page = NULL;
++	unsigned int order;
++	unsigned long page_idx, buddy_idx;
++	struct page *buddy;
+ 
+ 	zone = page_zone(page);
+ 	spin_lock_irqsave(&zone->lock, flags);
+ 	if (get_pageblock_migratetype(page) != MIGRATE_ISOLATE)
+ 		goto out;
+-	nr_pages = move_freepages_block(zone, page, migratetype);
+-	__mod_zone_freepage_state(zone, nr_pages, migratetype);
++
++	/*
++	 * Because freepage with more than pageblock_order on isolated
++	 * pageblock is restricted to merge due to freepage counting problem,
++	 * it is possible that there is free buddy page.
++	 * move_freepages_block() doesn't care of merge so we need other
++	 * approach in order to merge them. Isolation and free will make
++	 * these pages to be merged.
++	 */
++	if (PageBuddy(page)) {
++		order = page_order(page);
++		if (order >= pageblock_order) {
++			page_idx = page_to_pfn(page) & ((1 << MAX_ORDER) - 1);
++			buddy_idx = __find_buddy_index(page_idx, order);
++			buddy = page + (buddy_idx - page_idx);
++
++			if (!is_migrate_isolate_page(buddy)) {
++				__isolate_free_page(page, order);
++				set_page_refcounted(page);
++				isolated_page = page;
++			}
++		}
++	}
++
++	/*
++	 * If we isolate freepage with more than pageblock_order, there
++	 * should be no freepage in the range, so we could avoid costly
++	 * pageblock scanning for freepage moving.
++	 */
++	if (!isolated_page) {
++		nr_pages = move_freepages_block(zone, page, migratetype);
++		__mod_zone_freepage_state(zone, nr_pages, migratetype);
++	}
+ 	set_pageblock_migratetype(page, migratetype);
++	zone->nr_isolate_pageblock--;
+ out:
+ 	spin_unlock_irqrestore(&zone->lock, flags);
++	if (isolated_page)
++		__free_pages(isolated_page, order);
+ }
+ 
+ static inline struct page *
+diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
+index ffeba8f9dda9..c0d666a993ec 100644
+--- a/net/ceph/crypto.c
++++ b/net/ceph/crypto.c
+@@ -90,11 +90,82 @@ static struct crypto_blkcipher *ceph_crypto_alloc_cipher(void)
+ 
+ static const u8 *aes_iv = (u8 *)CEPH_AES_IV;
+ 
++/*
++ * Should be used for buffers allocated with ceph_kvmalloc().
++ * Currently these are encrypt out-buffer (ceph_buffer) and decrypt
++ * in-buffer (msg front).
++ *
++ * Dispose of @sgt with teardown_sgtable().
++ *
++ * @prealloc_sg is to avoid memory allocation inside sg_alloc_table()
++ * in cases where a single sg is sufficient.  No attempt to reduce the
++ * number of sgs by squeezing physically contiguous pages together is
++ * made though, for simplicity.
++ */
++static int setup_sgtable(struct sg_table *sgt, struct scatterlist *prealloc_sg,
++			 const void *buf, unsigned int buf_len)
++{
++	struct scatterlist *sg;
++	const bool is_vmalloc = is_vmalloc_addr(buf);
++	unsigned int off = offset_in_page(buf);
++	unsigned int chunk_cnt = 1;
++	unsigned int chunk_len = PAGE_ALIGN(off + buf_len);
++	int i;
++	int ret;
++
++	if (buf_len == 0) {
++		memset(sgt, 0, sizeof(*sgt));
++		return -EINVAL;
++	}
++
++	if (is_vmalloc) {
++		chunk_cnt = chunk_len >> PAGE_SHIFT;
++		chunk_len = PAGE_SIZE;
++	}
++
++	if (chunk_cnt > 1) {
++		ret = sg_alloc_table(sgt, chunk_cnt, GFP_NOFS);
++		if (ret)
++			return ret;
++	} else {
++		WARN_ON(chunk_cnt != 1);
++		sg_init_table(prealloc_sg, 1);
++		sgt->sgl = prealloc_sg;
++		sgt->nents = sgt->orig_nents = 1;
++	}
++
++	for_each_sg(sgt->sgl, sg, sgt->orig_nents, i) {
++		struct page *page;
++		unsigned int len = min(chunk_len - off, buf_len);
++
++		if (is_vmalloc)
++			page = vmalloc_to_page(buf);
++		else
++			page = virt_to_page(buf);
++
++		sg_set_page(sg, page, len, off);
++
++		off = 0;
++		buf += len;
++		buf_len -= len;
++	}
++	WARN_ON(buf_len != 0);
++
++	return 0;
++}
++
++static void teardown_sgtable(struct sg_table *sgt)
++{
++	if (sgt->orig_nents > 1)
++		sg_free_table(sgt);
++}
++
+ static int ceph_aes_encrypt(const void *key, int key_len,
+ 			    void *dst, size_t *dst_len,
+ 			    const void *src, size_t src_len)
+ {
+-	struct scatterlist sg_in[2], sg_out[1];
++	struct scatterlist sg_in[2], prealloc_sg;
++	struct sg_table sg_out;
+ 	struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+ 	struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 };
+ 	int ret;
+@@ -110,16 +181,18 @@ static int ceph_aes_encrypt(const void *key, int key_len,
+ 
+ 	*dst_len = src_len + zero_padding;
+ 
+-	crypto_blkcipher_setkey((void *)tfm, key, key_len);
+ 	sg_init_table(sg_in, 2);
+ 	sg_set_buf(&sg_in[0], src, src_len);
+ 	sg_set_buf(&sg_in[1], pad, zero_padding);
+-	sg_init_table(sg_out, 1);
+-	sg_set_buf(sg_out, dst, *dst_len);
++	ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len);
++	if (ret)
++		goto out_tfm;
++
++	crypto_blkcipher_setkey((void *)tfm, key, key_len);
+ 	iv = crypto_blkcipher_crt(tfm)->iv;
+ 	ivsize = crypto_blkcipher_ivsize(tfm);
+-
+ 	memcpy(iv, aes_iv, ivsize);
++
+ 	/*
+ 	print_hex_dump(KERN_ERR, "enc key: ", DUMP_PREFIX_NONE, 16, 1,
+ 		       key, key_len, 1);
+@@ -128,16 +201,22 @@ static int ceph_aes_encrypt(const void *key, int key_len,
+ 	print_hex_dump(KERN_ERR, "enc pad: ", DUMP_PREFIX_NONE, 16, 1,
+ 			pad, zero_padding, 1);
+ 	*/
+-	ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in,
++	ret = crypto_blkcipher_encrypt(&desc, sg_out.sgl, sg_in,
+ 				     src_len + zero_padding);
+-	crypto_free_blkcipher(tfm);
+-	if (ret < 0)
++	if (ret < 0) {
+ 		pr_err("ceph_aes_crypt failed %d\n", ret);
++		goto out_sg;
++	}
+ 	/*
+ 	print_hex_dump(KERN_ERR, "enc out: ", DUMP_PREFIX_NONE, 16, 1,
+ 		       dst, *dst_len, 1);
+ 	*/
+-	return 0;
++
++out_sg:
++	teardown_sgtable(&sg_out);
++out_tfm:
++	crypto_free_blkcipher(tfm);
++	return ret;
+ }
+ 
+ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
+@@ -145,7 +224,8 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
+ 			     const void *src1, size_t src1_len,
+ 			     const void *src2, size_t src2_len)
+ {
+-	struct scatterlist sg_in[3], sg_out[1];
++	struct scatterlist sg_in[3], prealloc_sg;
++	struct sg_table sg_out;
+ 	struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+ 	struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 };
+ 	int ret;
+@@ -161,17 +241,19 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
+ 
+ 	*dst_len = src1_len + src2_len + zero_padding;
+ 
+-	crypto_blkcipher_setkey((void *)tfm, key, key_len);
+ 	sg_init_table(sg_in, 3);
+ 	sg_set_buf(&sg_in[0], src1, src1_len);
+ 	sg_set_buf(&sg_in[1], src2, src2_len);
+ 	sg_set_buf(&sg_in[2], pad, zero_padding);
+-	sg_init_table(sg_out, 1);
+-	sg_set_buf(sg_out, dst, *dst_len);
++	ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len);
++	if (ret)
++		goto out_tfm;
++
++	crypto_blkcipher_setkey((void *)tfm, key, key_len);
+ 	iv = crypto_blkcipher_crt(tfm)->iv;
+ 	ivsize = crypto_blkcipher_ivsize(tfm);
+-
+ 	memcpy(iv, aes_iv, ivsize);
++
+ 	/*
+ 	print_hex_dump(KERN_ERR, "enc  key: ", DUMP_PREFIX_NONE, 16, 1,
+ 		       key, key_len, 1);
+@@ -182,23 +264,30 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
+ 	print_hex_dump(KERN_ERR, "enc  pad: ", DUMP_PREFIX_NONE, 16, 1,
+ 			pad, zero_padding, 1);
+ 	*/
+-	ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in,
++	ret = crypto_blkcipher_encrypt(&desc, sg_out.sgl, sg_in,
+ 				     src1_len + src2_len + zero_padding);
+-	crypto_free_blkcipher(tfm);
+-	if (ret < 0)
++	if (ret < 0) {
+ 		pr_err("ceph_aes_crypt2 failed %d\n", ret);
++		goto out_sg;
++	}
+ 	/*
+ 	print_hex_dump(KERN_ERR, "enc  out: ", DUMP_PREFIX_NONE, 16, 1,
+ 		       dst, *dst_len, 1);
+ 	*/
+-	return 0;
++
++out_sg:
++	teardown_sgtable(&sg_out);
++out_tfm:
++	crypto_free_blkcipher(tfm);
++	return ret;
+ }
+ 
+ static int ceph_aes_decrypt(const void *key, int key_len,
+ 			    void *dst, size_t *dst_len,
+ 			    const void *src, size_t src_len)
+ {
+-	struct scatterlist sg_in[1], sg_out[2];
++	struct sg_table sg_in;
++	struct scatterlist sg_out[2], prealloc_sg;
+ 	struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+ 	struct blkcipher_desc desc = { .tfm = tfm };
+ 	char pad[16];
+@@ -210,16 +299,16 @@ static int ceph_aes_decrypt(const void *key, int key_len,
+ 	if (IS_ERR(tfm))
+ 		return PTR_ERR(tfm);
+ 
+-	crypto_blkcipher_setkey((void *)tfm, key, key_len);
+-	sg_init_table(sg_in, 1);
+ 	sg_init_table(sg_out, 2);
+-	sg_set_buf(sg_in, src, src_len);
+ 	sg_set_buf(&sg_out[0], dst, *dst_len);
+ 	sg_set_buf(&sg_out[1], pad, sizeof(pad));
++	ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len);
++	if (ret)
++		goto out_tfm;
+ 
++	crypto_blkcipher_setkey((void *)tfm, key, key_len);
+ 	iv = crypto_blkcipher_crt(tfm)->iv;
+ 	ivsize = crypto_blkcipher_ivsize(tfm);
+-
+ 	memcpy(iv, aes_iv, ivsize);
+ 
+ 	/*
+@@ -228,12 +317,10 @@ static int ceph_aes_decrypt(const void *key, int key_len,
+ 	print_hex_dump(KERN_ERR, "dec  in: ", DUMP_PREFIX_NONE, 16, 1,
+ 		       src, src_len, 1);
+ 	*/
+-
+-	ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len);
+-	crypto_free_blkcipher(tfm);
++	ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in.sgl, src_len);
+ 	if (ret < 0) {
+ 		pr_err("ceph_aes_decrypt failed %d\n", ret);
+-		return ret;
++		goto out_sg;
+ 	}
+ 
+ 	if (src_len <= *dst_len)
+@@ -251,7 +338,12 @@ static int ceph_aes_decrypt(const void *key, int key_len,
+ 	print_hex_dump(KERN_ERR, "dec out: ", DUMP_PREFIX_NONE, 16, 1,
+ 		       dst, *dst_len, 1);
+ 	*/
+-	return 0;
++
++out_sg:
++	teardown_sgtable(&sg_in);
++out_tfm:
++	crypto_free_blkcipher(tfm);
++	return ret;
+ }
+ 
+ static int ceph_aes_decrypt2(const void *key, int key_len,
+@@ -259,7 +351,8 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
+ 			     void *dst2, size_t *dst2_len,
+ 			     const void *src, size_t src_len)
+ {
+-	struct scatterlist sg_in[1], sg_out[3];
++	struct sg_table sg_in;
++	struct scatterlist sg_out[3], prealloc_sg;
+ 	struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+ 	struct blkcipher_desc desc = { .tfm = tfm };
+ 	char pad[16];
+@@ -271,17 +364,17 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
+ 	if (IS_ERR(tfm))
+ 		return PTR_ERR(tfm);
+ 
+-	sg_init_table(sg_in, 1);
+-	sg_set_buf(sg_in, src, src_len);
+ 	sg_init_table(sg_out, 3);
+ 	sg_set_buf(&sg_out[0], dst1, *dst1_len);
+ 	sg_set_buf(&sg_out[1], dst2, *dst2_len);
+ 	sg_set_buf(&sg_out[2], pad, sizeof(pad));
++	ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len);
++	if (ret)
++		goto out_tfm;
+ 
+ 	crypto_blkcipher_setkey((void *)tfm, key, key_len);
+ 	iv = crypto_blkcipher_crt(tfm)->iv;
+ 	ivsize = crypto_blkcipher_ivsize(tfm);
+-
+ 	memcpy(iv, aes_iv, ivsize);
+ 
+ 	/*
+@@ -290,12 +383,10 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
+ 	print_hex_dump(KERN_ERR, "dec   in: ", DUMP_PREFIX_NONE, 16, 1,
+ 		       src, src_len, 1);
+ 	*/
+-
+-	ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len);
+-	crypto_free_blkcipher(tfm);
++	ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in.sgl, src_len);
+ 	if (ret < 0) {
+ 		pr_err("ceph_aes_decrypt failed %d\n", ret);
+-		return ret;
++		goto out_sg;
+ 	}
+ 
+ 	if (src_len <= *dst1_len)
+@@ -325,7 +416,11 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
+ 		       dst2, *dst2_len, 1);
+ 	*/
+ 
+-	return 0;
++out_sg:
++	teardown_sgtable(&sg_in);
++out_tfm:
++	crypto_free_blkcipher(tfm);
++	return ret;
+ }
+ 
+ 
+diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
+index 9eb89f3f0ee4..19419b60cb37 100644
+--- a/net/ipv4/inet_fragment.c
++++ b/net/ipv4/inet_fragment.c
+@@ -146,7 +146,6 @@ evict_again:
+ 			atomic_inc(&fq->refcnt);
+ 			spin_unlock(&hb->chain_lock);
+ 			del_timer_sync(&fq->timer);
+-			WARN_ON(atomic_read(&fq->refcnt) != 1);
+ 			inet_frag_put(fq, f);
+ 			goto evict_again;
+ 		}
+@@ -285,7 +284,8 @@ static inline void fq_unlink(struct inet_frag_queue *fq, struct inet_frags *f)
+ 	struct inet_frag_bucket *hb;
+ 
+ 	hb = get_frag_bucket_locked(fq, f);
+-	hlist_del(&fq->list);
++	if (!(fq->flags & INET_FRAG_EVICTED))
++		hlist_del(&fq->list);
+ 	spin_unlock(&hb->chain_lock);
+ }
+ 
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index 5cb830c78990..2407e5db84ff 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -195,7 +195,7 @@ int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc,
+ 	for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
+ 		if (!CMSG_OK(msg, cmsg))
+ 			return -EINVAL;
+-#if defined(CONFIG_IPV6)
++#if IS_ENABLED(CONFIG_IPV6)
+ 		if (allow_ipv6 &&
+ 		    cmsg->cmsg_level == SOL_IPV6 &&
+ 		    cmsg->cmsg_type == IPV6_PKTINFO) {
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 97299d76c1b0..cacb493a133d 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -957,8 +957,6 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
+ 	else
+ 		dev->flags &= ~IFF_POINTOPOINT;
+ 
+-	dev->iflink = p->link;
+-
+ 	/* Precalculate GRE options length */
+ 	if (t->parms.o_flags&(GRE_CSUM|GRE_KEY|GRE_SEQ)) {
+ 		if (t->parms.o_flags&GRE_CSUM)
+@@ -1268,6 +1266,7 @@ static int ip6gre_tunnel_init(struct net_device *dev)
+ 		u64_stats_init(&ip6gre_tunnel_stats->syncp);
+ 	}
+ 
++	dev->iflink = tunnel->parms.link;
+ 
+ 	return 0;
+ }
+@@ -1477,6 +1476,8 @@ static int ip6gre_tap_init(struct net_device *dev)
+ 	if (!dev->tstats)
+ 		return -ENOMEM;
+ 
++	dev->iflink = tunnel->parms.link;
++
+ 	return 0;
+ }
+ 
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 69a84b464009..d2eeb3bf8fd8 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -272,9 +272,6 @@ static int ip6_tnl_create2(struct net_device *dev)
+ 	int err;
+ 
+ 	t = netdev_priv(dev);
+-	err = ip6_tnl_dev_init(dev);
+-	if (err < 0)
+-		goto out;
+ 
+ 	err = register_netdevice(dev);
+ 	if (err < 0)
+@@ -1462,6 +1459,7 @@ ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
+ 
+ 
+ static const struct net_device_ops ip6_tnl_netdev_ops = {
++	.ndo_init	= ip6_tnl_dev_init,
+ 	.ndo_uninit	= ip6_tnl_dev_uninit,
+ 	.ndo_start_xmit = ip6_tnl_xmit,
+ 	.ndo_do_ioctl	= ip6_tnl_ioctl,
+@@ -1546,16 +1544,10 @@ static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
+ 	struct ip6_tnl *t = netdev_priv(dev);
+ 	struct net *net = dev_net(dev);
+ 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
+-	int err = ip6_tnl_dev_init_gen(dev);
+-
+-	if (err)
+-		return err;
+ 
+ 	t->parms.proto = IPPROTO_IPV6;
+ 	dev_hold(dev);
+ 
+-	ip6_tnl_link_config(t);
+-
+ 	rcu_assign_pointer(ip6n->tnls_wc[0], t);
+ 	return 0;
+ }
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index 5833a2244467..99c9487f236a 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -172,10 +172,6 @@ static int vti6_tnl_create2(struct net_device *dev)
+ 	struct vti6_net *ip6n = net_generic(net, vti6_net_id);
+ 	int err;
+ 
+-	err = vti6_dev_init(dev);
+-	if (err < 0)
+-		goto out;
+-
+ 	err = register_netdevice(dev);
+ 	if (err < 0)
+ 		goto out;
+@@ -783,6 +779,7 @@ static int vti6_change_mtu(struct net_device *dev, int new_mtu)
+ }
+ 
+ static const struct net_device_ops vti6_netdev_ops = {
++	.ndo_init	= vti6_dev_init,
+ 	.ndo_uninit	= vti6_dev_uninit,
+ 	.ndo_start_xmit = vti6_tnl_xmit,
+ 	.ndo_do_ioctl	= vti6_ioctl,
+@@ -852,16 +849,10 @@ static int __net_init vti6_fb_tnl_dev_init(struct net_device *dev)
+ 	struct ip6_tnl *t = netdev_priv(dev);
+ 	struct net *net = dev_net(dev);
+ 	struct vti6_net *ip6n = net_generic(net, vti6_net_id);
+-	int err = vti6_dev_init_gen(dev);
+-
+-	if (err)
+-		return err;
+ 
+ 	t->parms.proto = IPPROTO_IPV6;
+ 	dev_hold(dev);
+ 
+-	vti6_link_config(t);
+-
+ 	rcu_assign_pointer(ip6n->tnls_wc[0], t);
+ 	return 0;
+ }
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 6163f851dc01..ca1c7c4ccc88 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -195,10 +195,8 @@ static int ipip6_tunnel_create(struct net_device *dev)
+ 	struct sit_net *sitn = net_generic(net, sit_net_id);
+ 	int err;
+ 
+-	err = ipip6_tunnel_init(dev);
+-	if (err < 0)
+-		goto out;
+-	ipip6_tunnel_clone_6rd(dev, sitn);
++	memcpy(dev->dev_addr, &t->parms.iph.saddr, 4);
++	memcpy(dev->broadcast, &t->parms.iph.daddr, 4);
+ 
+ 	if ((__force u16)t->parms.i_flags & SIT_ISATAP)
+ 		dev->priv_flags |= IFF_ISATAP;
+@@ -207,7 +205,8 @@ static int ipip6_tunnel_create(struct net_device *dev)
+ 	if (err < 0)
+ 		goto out;
+ 
+-	strcpy(t->parms.name, dev->name);
++	ipip6_tunnel_clone_6rd(dev, sitn);
++
+ 	dev->rtnl_link_ops = &sit_link_ops;
+ 
+ 	dev_hold(dev);
+@@ -1314,6 +1313,7 @@ static int ipip6_tunnel_change_mtu(struct net_device *dev, int new_mtu)
+ }
+ 
+ static const struct net_device_ops ipip6_netdev_ops = {
++	.ndo_init	= ipip6_tunnel_init,
+ 	.ndo_uninit	= ipip6_tunnel_uninit,
+ 	.ndo_start_xmit	= sit_tunnel_xmit,
+ 	.ndo_do_ioctl	= ipip6_tunnel_ioctl,
+@@ -1359,9 +1359,7 @@ static int ipip6_tunnel_init(struct net_device *dev)
+ 
+ 	tunnel->dev = dev;
+ 	tunnel->net = dev_net(dev);
+-
+-	memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
+-	memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
++	strcpy(tunnel->parms.name, dev->name);
+ 
+ 	ipip6_tunnel_bind_dev(dev);
+ 	dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+@@ -1386,7 +1384,6 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
+ 
+ 	tunnel->dev = dev;
+ 	tunnel->net = dev_net(dev);
+-	strcpy(tunnel->parms.name, dev->name);
+ 
+ 	iph->version		= 4;
+ 	iph->protocol		= IPPROTO_IPV6;
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index 9713dc54ea4b..af526e9cfc1a 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -804,7 +804,7 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+ 
+ 	memset(&params, 0, sizeof(params));
+ 	memset(&csa_ie, 0, sizeof(csa_ie));
+-	err = ieee80211_parse_ch_switch_ie(sdata, elems, beacon,
++	err = ieee80211_parse_ch_switch_ie(sdata, elems,
+ 					   ifibss->chandef.chan->band,
+ 					   sta_flags, ifibss->bssid, &csa_ie);
+ 	/* can't switch to destination channel, fail */
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index ef7a089ac546..5d102b5c6e81 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1639,7 +1639,6 @@ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
+  * ieee80211_parse_ch_switch_ie - parses channel switch IEs
+  * @sdata: the sdata of the interface which has received the frame
+  * @elems: parsed 802.11 elements received with the frame
+- * @beacon: indicates if the frame was a beacon or probe response
+  * @current_band: indicates the current band
+  * @sta_flags: contains information about own capabilities and restrictions
+  *	to decide which channel switch announcements can be accepted. Only the
+@@ -1653,7 +1652,7 @@ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
+  * Return: 0 on success, <0 on error and >0 if there is nothing to parse.
+  */
+ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
+-				 struct ieee802_11_elems *elems, bool beacon,
++				 struct ieee802_11_elems *elems,
+ 				 enum ieee80211_band current_band,
+ 				 u32 sta_flags, u8 *bssid,
+ 				 struct ieee80211_csa_ie *csa_ie);
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index f75e5f132c5a..3538e5e47b0e 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -765,10 +765,12 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
+ 	int i, flushed;
+ 	struct ps_data *ps;
+ 	struct cfg80211_chan_def chandef;
++	bool cancel_scan;
+ 
+ 	clear_bit(SDATA_STATE_RUNNING, &sdata->state);
+ 
+-	if (rcu_access_pointer(local->scan_sdata) == sdata)
++	cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
++	if (cancel_scan)
+ 		ieee80211_scan_cancel(local);
+ 
+ 	/*
+@@ -990,6 +992,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
+ 
+ 	ieee80211_recalc_ps(local, -1);
+ 
++	if (cancel_scan)
++		flush_delayed_work(&local->scan_work);
++
+ 	if (local->open_count == 0) {
+ 		ieee80211_stop_device(local);
+ 
+diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
+index e9f99c1e3fad..0c8b2a77d312 100644
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -874,7 +874,7 @@ ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
+ 
+ 	memset(&params, 0, sizeof(params));
+ 	memset(&csa_ie, 0, sizeof(csa_ie));
+-	err = ieee80211_parse_ch_switch_ie(sdata, elems, beacon, band,
++	err = ieee80211_parse_ch_switch_ie(sdata, elems, band,
+ 					   sta_flags, sdata->vif.addr,
+ 					   &csa_ie);
+ 	if (err < 0)
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index b82a12a9f0f1..86d44db5da06 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1058,7 +1058,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+ 
+ 	current_band = cbss->channel->band;
+ 	memset(&csa_ie, 0, sizeof(csa_ie));
+-	res = ieee80211_parse_ch_switch_ie(sdata, elems, beacon, current_band,
++	res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
+ 					   ifmgd->flags,
+ 					   ifmgd->associated->bssid, &csa_ie);
+ 	if (res	< 0)
+@@ -1154,7 +1154,8 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+ 		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
+ 	else
+ 		mod_timer(&ifmgd->chswitch_timer,
+-			  TU_TO_EXP_TIME(csa_ie.count * cbss->beacon_interval));
++			  TU_TO_EXP_TIME((csa_ie.count - 1) *
++					 cbss->beacon_interval));
+ }
+ 
+ static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index bd2c9b22c945..7e77410ca799 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1667,11 +1667,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+ 	sc = le16_to_cpu(hdr->seq_ctrl);
+ 	frag = sc & IEEE80211_SCTL_FRAG;
+ 
+-	if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
+-		   is_multicast_ether_addr(hdr->addr1))) {
+-		/* not fragmented */
++	if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
++		goto out;
++
++	if (is_multicast_ether_addr(hdr->addr1)) {
++		rx->local->dot11MulticastReceivedFrameCount++;
+ 		goto out;
+ 	}
++
+ 	I802_DEBUG_INC(rx->local->rx_handlers_fragments);
+ 
+ 	if (skb_linearize(rx->skb))
+@@ -1764,10 +1767,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+  out:
+ 	if (rx->sta)
+ 		rx->sta->rx_packets++;
+-	if (is_multicast_ether_addr(hdr->addr1))
+-		rx->local->dot11MulticastReceivedFrameCount++;
+-	else
+-		ieee80211_led_rx(rx->local);
++	ieee80211_led_rx(rx->local);
+ 	return RX_CONTINUE;
+ }
+ 
+diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
+index 6ab009070084..efeba56c913b 100644
+--- a/net/mac80211/spectmgmt.c
++++ b/net/mac80211/spectmgmt.c
+@@ -22,7 +22,7 @@
+ #include "wme.h"
+ 
+ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
+-				 struct ieee802_11_elems *elems, bool beacon,
++				 struct ieee802_11_elems *elems,
+ 				 enum ieee80211_band current_band,
+ 				 u32 sta_flags, u8 *bssid,
+ 				 struct ieee80211_csa_ie *csa_ie)
+@@ -91,19 +91,13 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
+ 		return -EINVAL;
+ 	}
+ 
+-	if (!beacon && sec_chan_offs) {
++	if (sec_chan_offs) {
+ 		secondary_channel_offset = sec_chan_offs->sec_chan_offs;
+-	} else if (beacon && ht_oper) {
+-		secondary_channel_offset =
+-			ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
+ 	} else if (!(sta_flags & IEEE80211_STA_DISABLE_HT)) {
+-		/* If it's not a beacon, HT is enabled and the IE not present,
+-		 * it's 20 MHz, 802.11-2012 8.5.2.6:
+-		 *	This element [the Secondary Channel Offset Element] is
+-		 *	present when switching to a 40 MHz channel. It may be
+-		 *	present when switching to a 20 MHz channel (in which
+-		 *	case the secondary channel offset is set to SCN).
+-		 */
++		/* If the secondary channel offset IE is not present,
++		 * we can't know what's the post-CSA offset, so the
++		 * best we can do is use 20MHz.
++		*/
+ 		secondary_channel_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
+ 	}
+ 
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index ec8114fae50b..6582dce828b5 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -635,7 +635,7 @@ ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index)
+ 	struct ip_set *set;
+ 	struct ip_set_net *inst = ip_set_pernet(net);
+ 
+-	if (index > inst->ip_set_max)
++	if (index >= inst->ip_set_max)
+ 		return IPSET_INVALID_ID;
+ 
+ 	nfnl_lock(NFNL_SUBSYS_IPSET);
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index deeb95fb7028..c62c08e0998d 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1102,10 +1102,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
+ 			basechain->stats = stats;
+ 		} else {
+ 			stats = netdev_alloc_pcpu_stats(struct nft_stats);
+-			if (IS_ERR(stats)) {
++			if (stats == NULL) {
+ 				module_put(type->owner);
+ 				kfree(basechain);
+-				return PTR_ERR(stats);
++				return -ENOMEM;
+ 			}
+ 			rcu_assign_pointer(basechain->stats, stats);
+ 		}
+diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
+index a11c5ff2f720..32507355cc5d 100644
+--- a/net/netfilter/nfnetlink_log.c
++++ b/net/netfilter/nfnetlink_log.c
+@@ -43,7 +43,8 @@
+ #define NFULNL_NLBUFSIZ_DEFAULT	NLMSG_GOODSIZE
+ #define NFULNL_TIMEOUT_DEFAULT 	100	/* every second */
+ #define NFULNL_QTHRESH_DEFAULT 	100	/* 100 packets */
+-#define NFULNL_COPY_RANGE_MAX	0xFFFF	/* max packet size is limited by 16-bit struct nfattr nfa_len field */
++/* max packet size is limited by 16-bit struct nfattr nfa_len field */
++#define NFULNL_COPY_RANGE_MAX	(0xFFFF - NLA_HDRLEN)
+ 
+ #define PRINTR(x, args...)	do { if (net_ratelimit()) \
+ 				     printk(x, ## args); } while (0);
+@@ -252,6 +253,8 @@ nfulnl_set_mode(struct nfulnl_instance *inst, u_int8_t mode,
+ 
+ 	case NFULNL_COPY_PACKET:
+ 		inst->copy_mode = mode;
++		if (range == 0)
++			range = NFULNL_COPY_RANGE_MAX;
+ 		inst->copy_range = min_t(unsigned int,
+ 					 range, NFULNL_COPY_RANGE_MAX);
+ 		break;
+@@ -343,26 +346,25 @@ nfulnl_alloc_skb(struct net *net, u32 peer_portid, unsigned int inst_size,
+ 	return skb;
+ }
+ 
+-static int
++static void
+ __nfulnl_send(struct nfulnl_instance *inst)
+ {
+-	int status = -1;
+-
+ 	if (inst->qlen > 1) {
+ 		struct nlmsghdr *nlh = nlmsg_put(inst->skb, 0, 0,
+ 						 NLMSG_DONE,
+ 						 sizeof(struct nfgenmsg),
+ 						 0);
+-		if (!nlh)
++		if (WARN_ONCE(!nlh, "bad nlskb size: %u, tailroom %d\n",
++			      inst->skb->len, skb_tailroom(inst->skb))) {
++			kfree_skb(inst->skb);
+ 			goto out;
++		}
+ 	}
+-	status = nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid,
+-				   MSG_DONTWAIT);
+-
++	nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid,
++			  MSG_DONTWAIT);
++out:
+ 	inst->qlen = 0;
+ 	inst->skb = NULL;
+-out:
+-	return status;
+ }
+ 
+ static void
+@@ -649,7 +651,8 @@ nfulnl_log_packet(struct net *net,
+ 		+ nla_total_size(sizeof(u_int32_t))	/* gid */
+ 		+ nla_total_size(plen)			/* prefix */
+ 		+ nla_total_size(sizeof(struct nfulnl_msg_packet_hw))
+-		+ nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp));
++		+ nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp))
++		+ nla_total_size(sizeof(struct nfgenmsg));	/* NLMSG_DONE */
+ 
+ 	if (in && skb_mac_header_was_set(skb)) {
+ 		size +=   nla_total_size(skb->dev->hard_header_len)
+@@ -678,8 +681,7 @@ nfulnl_log_packet(struct net *net,
+ 		break;
+ 
+ 	case NFULNL_COPY_PACKET:
+-		if (inst->copy_range == 0
+-		    || inst->copy_range > skb->len)
++		if (inst->copy_range > skb->len)
+ 			data_len = skb->len;
+ 		else
+ 			data_len = inst->copy_range;
+@@ -692,8 +694,7 @@ nfulnl_log_packet(struct net *net,
+ 		goto unlock_and_release;
+ 	}
+ 
+-	if (inst->skb &&
+-	    size > skb_tailroom(inst->skb) - sizeof(struct nfgenmsg)) {
++	if (inst->skb && size > skb_tailroom(inst->skb)) {
+ 		/* either the queue len is too high or we don't have
+ 		 * enough room in the skb left. flush to userspace. */
+ 		__nfulnl_flush(inst);
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index 1840989092ed..5b5ab9ec1a90 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -696,7 +696,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
+ 	family = ctx->afi->family;
+ 
+ 	/* Re-use the existing target if it's already loaded. */
+-	list_for_each_entry(nft_target, &nft_match_list, head) {
++	list_for_each_entry(nft_target, &nft_target_list, head) {
+ 		struct xt_target *target = nft_target->ops.data;
+ 
+ 		if (strcmp(target->name, tg_name) == 0 &&
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index f1de72de273e..0007b8180397 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1440,7 +1440,7 @@ static void netlink_unbind(int group, long unsigned int groups,
+ 		return;
+ 
+ 	for (undo = 0; undo < group; undo++)
+-		if (test_bit(group, &groups))
++		if (test_bit(undo, &groups))
+ 			nlk->netlink_unbind(undo);
+ }
+ 
+@@ -1492,7 +1492,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
+ 			netlink_insert(sk, net, nladdr->nl_pid) :
+ 			netlink_autobind(sock);
+ 		if (err) {
+-			netlink_unbind(nlk->ngroups - 1, groups, nlk);
++			netlink_unbind(nlk->ngroups, groups, nlk);
+ 			return err;
+ 		}
+ 	}
+@@ -2509,6 +2509,7 @@ __netlink_kernel_create(struct net *net, int unit, struct module *module,
+ 		nl_table[unit].module = module;
+ 		if (cfg) {
+ 			nl_table[unit].bind = cfg->bind;
++			nl_table[unit].unbind = cfg->unbind;
+ 			nl_table[unit].flags = cfg->flags;
+ 			if (cfg->compare)
+ 				nl_table[unit].compare = cfg->compare;
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index a88b8524846e..f791edd64d6c 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1668,6 +1668,8 @@ struct sctp_chunk *sctp_assoc_lookup_asconf_ack(
+ 	 * ack chunk whose serial number matches that of the request.
+ 	 */
+ 	list_for_each_entry(ack, &asoc->asconf_ack_list, transmitted_list) {
++		if (sctp_chunk_pending(ack))
++			continue;
+ 		if (ack->subh.addip_hdr->serial == serial) {
+ 			sctp_chunk_hold(ack);
+ 			return ack;
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index 0e8529113dc5..fb7976aee61c 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -862,8 +862,6 @@ int sctp_auth_set_key(struct sctp_endpoint *ep,
+ 		list_add(&cur_key->key_list, sh_keys);
+ 
+ 	cur_key->key = key;
+-	sctp_auth_key_hold(key);
+-
+ 	return 0;
+ nomem:
+ 	if (!replace)
+diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
+index 4de12afa13d4..7e8a16c77039 100644
+--- a/net/sctp/inqueue.c
++++ b/net/sctp/inqueue.c
+@@ -140,18 +140,9 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
+ 		} else {
+ 			/* Nothing to do. Next chunk in the packet, please. */
+ 			ch = (sctp_chunkhdr_t *) chunk->chunk_end;
+-
+ 			/* Force chunk->skb->data to chunk->chunk_end.  */
+-			skb_pull(chunk->skb,
+-				 chunk->chunk_end - chunk->skb->data);
+-
+-			/* Verify that we have at least chunk headers
+-			 * worth of buffer left.
+-			 */
+-			if (skb_headlen(chunk->skb) < sizeof(sctp_chunkhdr_t)) {
+-				sctp_chunk_free(chunk);
+-				chunk = queue->in_progress = NULL;
+-			}
++			skb_pull(chunk->skb, chunk->chunk_end - chunk->skb->data);
++			/* We are guaranteed to pull a SCTP header. */
+ 		}
+ 	}
+ 
+@@ -187,24 +178,14 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
+ 	skb_pull(chunk->skb, sizeof(sctp_chunkhdr_t));
+ 	chunk->subh.v = NULL; /* Subheader is no longer valid.  */
+ 
+-	if (chunk->chunk_end < skb_tail_pointer(chunk->skb)) {
++	if (chunk->chunk_end + sizeof(sctp_chunkhdr_t) <
++	    skb_tail_pointer(chunk->skb)) {
+ 		/* This is not a singleton */
+ 		chunk->singleton = 0;
+ 	} else if (chunk->chunk_end > skb_tail_pointer(chunk->skb)) {
+-		/* RFC 2960, Section 6.10  Bundling
+-		 *
+-		 * Partial chunks MUST NOT be placed in an SCTP packet.
+-		 * If the receiver detects a partial chunk, it MUST drop
+-		 * the chunk.
+-		 *
+-		 * Since the end of the chunk is past the end of our buffer
+-		 * (which contains the whole packet, we can freely discard
+-		 * the whole packet.
+-		 */
+-		sctp_chunk_free(chunk);
+-		chunk = queue->in_progress = NULL;
+-
+-		return NULL;
++		/* Discard inside state machine. */
++		chunk->pdiscard = 1;
++		chunk->chunk_end = skb_tail_pointer(chunk->skb);
+ 	} else {
+ 		/* We are at the end of the packet, so mark the chunk
+ 		 * in case we need to send a SACK.
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index ae0e616a7ca5..9f32741abb1c 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -2609,6 +2609,9 @@ do_addr_param:
+ 		addr_param = param.v + sizeof(sctp_addip_param_t);
+ 
+ 		af = sctp_get_af_specific(param_type2af(param.p->type));
++		if (af == NULL)
++			break;
++
+ 		af->from_addr_param(&addr, addr_param,
+ 				    htons(asoc->peer.port), 0);
+ 
+@@ -3110,50 +3113,63 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
+ 	return SCTP_ERROR_NO_ERROR;
+ }
+ 
+-/* Verify the ASCONF packet before we process it.  */
+-int sctp_verify_asconf(const struct sctp_association *asoc,
+-		       struct sctp_paramhdr *param_hdr, void *chunk_end,
+-		       struct sctp_paramhdr **errp) {
+-	sctp_addip_param_t *asconf_param;
++/* Verify the ASCONF packet before we process it. */
++bool sctp_verify_asconf(const struct sctp_association *asoc,
++			struct sctp_chunk *chunk, bool addr_param_needed,
++			struct sctp_paramhdr **errp)
++{
++	sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) chunk->chunk_hdr;
+ 	union sctp_params param;
+-	int length, plen;
++	bool addr_param_seen = false;
+ 
+-	param.v = (sctp_paramhdr_t *) param_hdr;
+-	while (param.v <= chunk_end - sizeof(sctp_paramhdr_t)) {
+-		length = ntohs(param.p->length);
+-		*errp = param.p;
+-
+-		if (param.v > chunk_end - length ||
+-		    length < sizeof(sctp_paramhdr_t))
+-			return 0;
++	sctp_walk_params(param, addip, addip_hdr.params) {
++		size_t length = ntohs(param.p->length);
+ 
++		*errp = param.p;
+ 		switch (param.p->type) {
++		case SCTP_PARAM_ERR_CAUSE:
++			break;
++		case SCTP_PARAM_IPV4_ADDRESS:
++			if (length != sizeof(sctp_ipv4addr_param_t))
++				return false;
++			addr_param_seen = true;
++			break;
++		case SCTP_PARAM_IPV6_ADDRESS:
++			if (length != sizeof(sctp_ipv6addr_param_t))
++				return false;
++			addr_param_seen = true;
++			break;
+ 		case SCTP_PARAM_ADD_IP:
+ 		case SCTP_PARAM_DEL_IP:
+ 		case SCTP_PARAM_SET_PRIMARY:
+-			asconf_param = (sctp_addip_param_t *)param.v;
+-			plen = ntohs(asconf_param->param_hdr.length);
+-			if (plen < sizeof(sctp_addip_param_t) +
+-			    sizeof(sctp_paramhdr_t))
+-				return 0;
++			/* In ASCONF chunks, these need to be first. */
++			if (addr_param_needed && !addr_param_seen)
++				return false;
++			length = ntohs(param.addip->param_hdr.length);
++			if (length < sizeof(sctp_addip_param_t) +
++				     sizeof(sctp_paramhdr_t))
++				return false;
+ 			break;
+ 		case SCTP_PARAM_SUCCESS_REPORT:
+ 		case SCTP_PARAM_ADAPTATION_LAYER_IND:
+ 			if (length != sizeof(sctp_addip_param_t))
+-				return 0;
+-
++				return false;
+ 			break;
+ 		default:
+-			break;
++			/* This is unkown to us, reject! */
++			return false;
+ 		}
+-
+-		param.v += WORD_ROUND(length);
+ 	}
+ 
+-	if (param.v != chunk_end)
+-		return 0;
++	/* Remaining sanity checks. */
++	if (addr_param_needed && !addr_param_seen)
++		return false;
++	if (!addr_param_needed && addr_param_seen)
++		return false;
++	if (param.v != chunk->chunk_end)
++		return false;
+ 
+-	return 1;
++	return true;
+ }
+ 
+ /* Process an incoming ASCONF chunk with the next expected serial no. and
+@@ -3162,16 +3178,17 @@ int sctp_verify_asconf(const struct sctp_association *asoc,
+ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ 				       struct sctp_chunk *asconf)
+ {
++	sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) asconf->chunk_hdr;
++	bool all_param_pass = true;
++	union sctp_params param;
+ 	sctp_addiphdr_t		*hdr;
+ 	union sctp_addr_param	*addr_param;
+ 	sctp_addip_param_t	*asconf_param;
+ 	struct sctp_chunk	*asconf_ack;
+-
+ 	__be16	err_code;
+ 	int	length = 0;
+ 	int	chunk_len;
+ 	__u32	serial;
+-	int	all_param_pass = 1;
+ 
+ 	chunk_len = ntohs(asconf->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
+ 	hdr = (sctp_addiphdr_t *)asconf->skb->data;
+@@ -3199,9 +3216,14 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ 		goto done;
+ 
+ 	/* Process the TLVs contained within the ASCONF chunk. */
+-	while (chunk_len > 0) {
++	sctp_walk_params(param, addip, addip_hdr.params) {
++		/* Skip preceeding address parameters. */
++		if (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
++		    param.p->type == SCTP_PARAM_IPV6_ADDRESS)
++			continue;
++
+ 		err_code = sctp_process_asconf_param(asoc, asconf,
+-						     asconf_param);
++						     param.addip);
+ 		/* ADDIP 4.1 A7)
+ 		 * If an error response is received for a TLV parameter,
+ 		 * all TLVs with no response before the failed TLV are
+@@ -3209,28 +3231,20 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ 		 * the failed response are considered unsuccessful unless
+ 		 * a specific success indication is present for the parameter.
+ 		 */
+-		if (SCTP_ERROR_NO_ERROR != err_code)
+-			all_param_pass = 0;
+-
++		if (err_code != SCTP_ERROR_NO_ERROR)
++			all_param_pass = false;
+ 		if (!all_param_pass)
+-			sctp_add_asconf_response(asconf_ack,
+-						 asconf_param->crr_id, err_code,
+-						 asconf_param);
++			sctp_add_asconf_response(asconf_ack, param.addip->crr_id,
++						 err_code, param.addip);
+ 
+ 		/* ADDIP 4.3 D11) When an endpoint receiving an ASCONF to add
+ 		 * an IP address sends an 'Out of Resource' in its response, it
+ 		 * MUST also fail any subsequent add or delete requests bundled
+ 		 * in the ASCONF.
+ 		 */
+-		if (SCTP_ERROR_RSRC_LOW == err_code)
++		if (err_code == SCTP_ERROR_RSRC_LOW)
+ 			goto done;
+-
+-		/* Move to the next ASCONF param. */
+-		length = ntohs(asconf_param->param_hdr.length);
+-		asconf_param = (void *)asconf_param + length;
+-		chunk_len -= length;
+ 	}
+-
+ done:
+ 	asoc->peer.addip_serial++;
+ 
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index c8f606324134..3ee27b7704ff 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -170,6 +170,9 @@ sctp_chunk_length_valid(struct sctp_chunk *chunk,
+ {
+ 	__u16 chunk_length = ntohs(chunk->chunk_hdr->length);
+ 
++	/* Previously already marked? */
++	if (unlikely(chunk->pdiscard))
++		return 0;
+ 	if (unlikely(chunk_length < required_length))
+ 		return 0;
+ 
+@@ -3591,9 +3594,7 @@ sctp_disposition_t sctp_sf_do_asconf(struct net *net,
+ 	struct sctp_chunk	*asconf_ack = NULL;
+ 	struct sctp_paramhdr	*err_param = NULL;
+ 	sctp_addiphdr_t		*hdr;
+-	union sctp_addr_param	*addr_param;
+ 	__u32			serial;
+-	int			length;
+ 
+ 	if (!sctp_vtag_verify(chunk, asoc)) {
+ 		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
+@@ -3618,17 +3619,8 @@ sctp_disposition_t sctp_sf_do_asconf(struct net *net,
+ 	hdr = (sctp_addiphdr_t *)chunk->skb->data;
+ 	serial = ntohl(hdr->serial);
+ 
+-	addr_param = (union sctp_addr_param *)hdr->params;
+-	length = ntohs(addr_param->p.length);
+-	if (length < sizeof(sctp_paramhdr_t))
+-		return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
+-			   (void *)addr_param, commands);
+-
+ 	/* Verify the ASCONF chunk before processing it. */
+-	if (!sctp_verify_asconf(asoc,
+-			    (sctp_paramhdr_t *)((void *)addr_param + length),
+-			    (void *)chunk->chunk_end,
+-			    &err_param))
++	if (!sctp_verify_asconf(asoc, chunk, true, &err_param))
+ 		return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
+ 						  (void *)err_param, commands);
+ 
+@@ -3745,10 +3737,7 @@ sctp_disposition_t sctp_sf_do_asconf_ack(struct net *net,
+ 	rcvd_serial = ntohl(addip_hdr->serial);
+ 
+ 	/* Verify the ASCONF-ACK chunk before processing it. */
+-	if (!sctp_verify_asconf(asoc,
+-	    (sctp_paramhdr_t *)addip_hdr->params,
+-	    (void *)asconf_ack->chunk_end,
+-	    &err_param))
++	if (!sctp_verify_asconf(asoc, asconf_ack, false, &err_param))
+ 		return sctp_sf_violation_paramlen(net, ep, asoc, type, arg,
+ 			   (void *)err_param, commands);
+ 
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index afb292cd797d..53ed8d3f8897 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -1353,6 +1353,7 @@ gss_stringify_acceptor(struct rpc_cred *cred)
+ 	char *string = NULL;
+ 	struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
+ 	struct gss_cl_ctx *ctx;
++	unsigned int len;
+ 	struct xdr_netobj *acceptor;
+ 
+ 	rcu_read_lock();
+@@ -1360,15 +1361,39 @@ gss_stringify_acceptor(struct rpc_cred *cred)
+ 	if (!ctx)
+ 		goto out;
+ 
+-	acceptor = &ctx->gc_acceptor;
++	len = ctx->gc_acceptor.len;
++	rcu_read_unlock();
+ 
+ 	/* no point if there's no string */
+-	if (!acceptor->len)
+-		goto out;
+-
+-	string = kmalloc(acceptor->len + 1, GFP_KERNEL);
++	if (!len)
++		return NULL;
++realloc:
++	string = kmalloc(len + 1, GFP_KERNEL);
+ 	if (!string)
++		return NULL;
++
++	rcu_read_lock();
++	ctx = rcu_dereference(gss_cred->gc_ctx);
++
++	/* did the ctx disappear or was it replaced by one with no acceptor? */
++	if (!ctx || !ctx->gc_acceptor.len) {
++		kfree(string);
++		string = NULL;
+ 		goto out;
++	}
++
++	acceptor = &ctx->gc_acceptor;
++
++	/*
++	 * Did we find a new acceptor that's longer than the original? Allocate
++	 * a longer buffer and try again.
++	 */
++	if (len < acceptor->len) {
++		len = acceptor->len;
++		rcu_read_unlock();
++		kfree(string);
++		goto realloc;
++	}
+ 
+ 	memcpy(string, acceptor->data, acceptor->len);
+ 	string[acceptor->len] = '\0';
+diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
+index 4d08b398411f..cab1691b5ad6 100755
+--- a/scripts/checkpatch.pl
++++ b/scripts/checkpatch.pl
+@@ -2424,7 +2424,7 @@ sub process {
+ 				"please, no space before tabs\n" . $herevet) &&
+ 			    $fix) {
+ 				while ($fixed[$fixlinenr] =~
+-					   s/(^\+.*) {8,8}+\t/$1\t\t/) {}
++					   s/(^\+.*) {8,8}\t/$1\t\t/) {}
+ 				while ($fixed[$fixlinenr] =~
+ 					   s/(^\+.*) +\t/$1\t/) {}
+ 			}
+diff --git a/scripts/package/builddeb b/scripts/package/builddeb
+index 35d5a5877d04..7c0e6e46905d 100644
+--- a/scripts/package/builddeb
++++ b/scripts/package/builddeb
+@@ -152,18 +152,16 @@ if grep -q '^CONFIG_MODULES=y' $KCONFIG_CONFIG ; then
+ 		rmdir "$tmpdir/lib/modules/$version"
+ 	fi
+ 	if [ -n "$BUILD_DEBUG" ] ; then
+-		(
+-			cd $tmpdir
+-			for module in $(find lib/modules/ -name *.ko); do
+-				mkdir -p $(dirname $dbg_dir/usr/lib/debug/$module)
+-				# only keep debug symbols in the debug file
+-				$OBJCOPY --only-keep-debug $module $dbg_dir/usr/lib/debug/$module
+-				# strip original module from debug symbols
+-				$OBJCOPY --strip-debug $module
+-				# then add a link to those
+-				$OBJCOPY --add-gnu-debuglink=$dbg_dir/usr/lib/debug/$module $module
+-			done
+-		)
++		for module in $(find $tmpdir/lib/modules/ -name *.ko -printf '%P\n'); do
++			module=lib/modules/$module
++			mkdir -p $(dirname $dbg_dir/usr/lib/debug/$module)
++			# only keep debug symbols in the debug file
++			$OBJCOPY --only-keep-debug $tmpdir/$module $dbg_dir/usr/lib/debug/$module
++			# strip original module from debug symbols
++			$OBJCOPY --strip-debug $tmpdir/$module
++			# then add a link to those
++			$OBJCOPY --add-gnu-debuglink=$dbg_dir/usr/lib/debug/$module $tmpdir/$module
++		done
+ 	fi
+ fi
+ 
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index e26f860e5f2e..eff88a5f5d40 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -37,6 +37,8 @@ static int key_get_type_from_user(char *type,
+ 		return ret;
+ 	if (ret == 0 || ret >= len)
+ 		return -EINVAL;
++	if (type[0] == '.')
++		return -EPERM;
+ 	type[len - 1] = '\0';
+ 	return 0;
+ }
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 47ccb8f44adb..2fc3d13762c2 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -44,6 +44,7 @@ struct conexant_spec {
+ 	unsigned int num_eapds;
+ 	hda_nid_t eapds[4];
+ 	bool dynamic_eapd;
++	hda_nid_t mute_led_eapd;
+ 
+ 	unsigned int parse_flags; /* flag for snd_hda_parse_pin_defcfg() */
+ 
+@@ -164,6 +165,17 @@ static void cx_auto_vmaster_hook(void *private_data, int enabled)
+ 	cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, enabled);
+ }
+ 
++/* turn on/off EAPD according to Master switch (inversely!) for mute LED */
++static void cx_auto_vmaster_hook_mute_led(void *private_data, int enabled)
++{
++	struct hda_codec *codec = private_data;
++	struct conexant_spec *spec = codec->spec;
++
++	snd_hda_codec_write(codec, spec->mute_led_eapd, 0,
++			    AC_VERB_SET_EAPD_BTLENABLE,
++			    enabled ? 0x00 : 0x02);
++}
++
+ static int cx_auto_build_controls(struct hda_codec *codec)
+ {
+ 	int err;
+@@ -224,6 +236,7 @@ enum {
+ 	CXT_FIXUP_TOSHIBA_P105,
+ 	CXT_FIXUP_HP_530,
+ 	CXT_FIXUP_CAP_MIX_AMP_5047,
++	CXT_FIXUP_MUTE_LED_EAPD,
+ };
+ 
+ /* for hda_fixup_thinkpad_acpi() */
+@@ -557,6 +570,18 @@ static void cxt_fixup_olpc_xo(struct hda_codec *codec,
+ 	}
+ }
+ 
++static void cxt_fixup_mute_led_eapd(struct hda_codec *codec,
++				    const struct hda_fixup *fix, int action)
++{
++	struct conexant_spec *spec = codec->spec;
++
++	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++		spec->mute_led_eapd = 0x1b;
++		spec->dynamic_eapd = 1;
++		spec->gen.vmaster_mute.hook = cx_auto_vmaster_hook_mute_led;
++	}
++}
++
+ /*
+  * Fix max input level on mixer widget to 0dB
+  * (originally it has 0x2b steps with 0dB offset 0x14)
+@@ -705,6 +730,10 @@ static const struct hda_fixup cxt_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = cxt_fixup_cap_mix_amp_5047,
+ 	},
++	[CXT_FIXUP_MUTE_LED_EAPD] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = cxt_fixup_mute_led_eapd,
++	},
+ };
+ 
+ static const struct snd_pci_quirk cxt5045_fixups[] = {
+@@ -761,6 +790,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ 	SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
+ 	SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT_PINCFG_LENOVO_TP410),
+ 	SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT_PINCFG_LENOVO_TP410),
++	SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo IdeaPad Z560", CXT_FIXUP_MUTE_LED_EAPD),
+ 	SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
+ 	SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
+ 	SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
+@@ -779,6 +809,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = {
+ 	{ .id = CXT_PINCFG_LEMOTE_A1004, .name = "lemote-a1004" },
+ 	{ .id = CXT_PINCFG_LEMOTE_A1205, .name = "lemote-a1205" },
+ 	{ .id = CXT_FIXUP_OLPC_XO, .name = "olpc-xo" },
++	{ .id = CXT_FIXUP_MUTE_LED_EAPD, .name = "mute-led-eapd" },
+ 	{}
+ };
+ 
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index f119a41ed9a9..7c83bab69dee 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -885,6 +885,11 @@ static int snd_ftu_eff_switch_put(struct snd_kcontrol *kctl,
+ 	return changed;
+ }
+ 
++static void kctl_private_value_free(struct snd_kcontrol *kctl)
++{
++	kfree((void *)kctl->private_value);
++}
++
+ static int snd_ftu_create_effect_switch(struct usb_mixer_interface *mixer,
+ 	int validx, int bUnitID)
+ {
+@@ -919,6 +924,7 @@ static int snd_ftu_create_effect_switch(struct usb_mixer_interface *mixer,
+ 		return -ENOMEM;
+ 	}
+ 
++	kctl->private_free = kctl_private_value_free;
+ 	err = snd_ctl_add(mixer->chip->card, kctl);
+ 	if (err < 0)
+ 		return err;