Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMike Pagano <mpagano@gentoo.org>2015-05-17 15:54:56 +0000
committerMike Pagano <mpagano@gentoo.org>2015-05-17 15:54:56 +0000
commit58e7c3a053a0e6b0a9836db809f579db10b9f883 (patch)
tree79f45a40a145518d5c6df6eb671cc5feb0c326e5
parentLinux patch 4.0.3 (diff)
downloadlinux-patches-58e7c3a053a0e6b0a9836db809f579db10b9f883.tar.gz
linux-patches-58e7c3a053a0e6b0a9836db809f579db10b9f883.tar.bz2
linux-patches-58e7c3a053a0e6b0a9836db809f579db10b9f883.zip
Linux patch 4.0.44.0-6
Diffstat
-rw-r--r--0000_README4
-rw-r--r--1003_linux-4.0.4.patch2713
2 files changed, 2717 insertions, 0 deletions
diff --git a/0000_README b/0000_README
index b11f028f..3bcb0f89 100644
--- a/0000_README
+++ b/0000_README
@@ -55,6 +55,10 @@ Patch: 1002_linux-4.0.3.patch
From: http://www.kernel.org
Desc: Linux 4.0.3
+Patch: 1003_linux-4.0.4.patch
+From: http://www.kernel.org
+Desc: Linux 4.0.4
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1003_linux-4.0.4.patch b/1003_linux-4.0.4.patch
new file mode 100644
index 00000000..e5c793a4
--- /dev/null
+++ b/1003_linux-4.0.4.patch
@@ -0,0 +1,2713 @@
+diff --git a/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt b/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt
+index a4873e5e3e36..e30e184f50c7 100644
+--- a/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt
++++ b/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt
+@@ -38,7 +38,7 @@ dma_apbx: dma-apbx@80024000 {
+ 80 81 68 69
+ 70 71 72 73
+ 74 75 76 77>;
+- interrupt-names = "auart4-rx", "aurat4-tx", "spdif-tx", "empty",
++ interrupt-names = "auart4-rx", "auart4-tx", "spdif-tx", "empty",
+ "saif0", "saif1", "i2c0", "i2c1",
+ "auart0-rx", "auart0-tx", "auart1-rx", "auart1-tx",
+ "auart2-rx", "auart2-tx", "auart3-rx", "auart3-tx";
+diff --git a/Makefile b/Makefile
+index dc9f43a019d6..3d16bcc87585 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 0
+-SUBLEVEL = 3
++SUBLEVEL = 4
+ EXTRAVERSION =
+ NAME = Hurr durr I'ma sheep
+
+diff --git a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts
+index 0c76d9f05fd0..f4838ebd918b 100644
+--- a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts
++++ b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts
+@@ -105,6 +105,10 @@
+ };
+
+ internal-regs {
++ rtc@10300 {
++ /* No crystal connected to the internal RTC */
++ status = "disabled";
++ };
+ serial@12000 {
+ status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/imx23-olinuxino.dts b/arch/arm/boot/dts/imx23-olinuxino.dts
+index 7e6eef2488e8..82045398bf1f 100644
+--- a/arch/arm/boot/dts/imx23-olinuxino.dts
++++ b/arch/arm/boot/dts/imx23-olinuxino.dts
+@@ -12,6 +12,7 @@
+ */
+
+ /dts-v1/;
++#include <dt-bindings/gpio/gpio.h>
+ #include "imx23.dtsi"
+
+ / {
+@@ -93,6 +94,7 @@
+
+ ahb@80080000 {
+ usb0: usb@80080000 {
++ dr_mode = "host";
+ vbus-supply = <&reg_usb0_vbus>;
+ status = "okay";
+ };
+@@ -122,7 +124,7 @@
+
+ user {
+ label = "green";
+- gpios = <&gpio2 1 1>;
++ gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
+index e4d3aecc4ed2..677f81d9dcd5 100644
+--- a/arch/arm/boot/dts/imx25.dtsi
++++ b/arch/arm/boot/dts/imx25.dtsi
+@@ -428,6 +428,7 @@
+
+ pwm4: pwm@53fc8000 {
+ compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
++ #pwm-cells = <2>;
+ reg = <0x53fc8000 0x4000>;
+ clocks = <&clks 108>, <&clks 52>;
+ clock-names = "ipg", "per";
+diff --git a/arch/arm/boot/dts/imx28.dtsi b/arch/arm/boot/dts/imx28.dtsi
+index 47f68ac868d4..5ed245a3f9ac 100644
+--- a/arch/arm/boot/dts/imx28.dtsi
++++ b/arch/arm/boot/dts/imx28.dtsi
+@@ -900,7 +900,7 @@
+ 80 81 68 69
+ 70 71 72 73
+ 74 75 76 77>;
+- interrupt-names = "auart4-rx", "aurat4-tx", "spdif-tx", "empty",
++ interrupt-names = "auart4-rx", "auart4-tx", "spdif-tx", "empty",
+ "saif0", "saif1", "i2c0", "i2c1",
+ "auart0-rx", "auart0-tx", "auart1-rx", "auart1-tx",
+ "auart2-rx", "auart2-tx", "auart3-rx", "auart3-tx";
+diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+index 19cc269a08d4..1ce6133b67f5 100644
+--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+@@ -31,6 +31,7 @@
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
+ gpio = <&gpio4 15 0>;
++ enable-active-high;
+ };
+
+ reg_usb_h1_vbus: regulator@1 {
+@@ -40,6 +41,7 @@
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
+ gpio = <&gpio1 0 0>;
++ enable-active-high;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
+index db80f9d376fa..9c8bdf2c93a1 100644
+--- a/arch/arm/boot/dts/omap3-n900.dts
++++ b/arch/arm/boot/dts/omap3-n900.dts
+@@ -484,6 +484,8 @@
+ DRVDD-supply = <&vmmc2>;
+ IOVDD-supply = <&vio>;
+ DVDD-supply = <&vio>;
++
++ ai3x-micbias-vg = <1>;
+ };
+
+ tlv320aic3x_aux: tlv320aic3x@19 {
+@@ -495,6 +497,8 @@
+ DRVDD-supply = <&vmmc2>;
+ IOVDD-supply = <&vio>;
+ DVDD-supply = <&vio>;
++
++ ai3x-micbias-vg = <2>;
+ };
+
+ tsl2563: tsl2563@29 {
+diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+index bfd3f1c734b8..2201cd5da3bb 100644
+--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+@@ -1017,23 +1017,6 @@
+ status = "disabled";
+ };
+
+- vmmci: regulator-gpio {
+- compatible = "regulator-gpio";
+-
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <2900000>;
+- regulator-name = "mmci-reg";
+- regulator-type = "voltage";
+-
+- startup-delay-us = <100>;
+- enable-active-high;
+-
+- states = <1800000 0x1
+- 2900000 0x0>;
+-
+- status = "disabled";
+- };
+-
+ mcde@a0350000 {
+ compatible = "stericsson,mcde";
+ reg = <0xa0350000 0x1000>, /* MCDE */
+diff --git a/arch/arm/boot/dts/ste-href.dtsi b/arch/arm/boot/dts/ste-href.dtsi
+index bf8f0eddc2c0..744c1e3a744d 100644
+--- a/arch/arm/boot/dts/ste-href.dtsi
++++ b/arch/arm/boot/dts/ste-href.dtsi
+@@ -111,6 +111,21 @@
+ pinctrl-1 = <&i2c3_sleep_mode>;
+ };
+
++ vmmci: regulator-gpio {
++ compatible = "regulator-gpio";
++
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <2900000>;
++ regulator-name = "mmci-reg";
++ regulator-type = "voltage";
++
++ startup-delay-us = <100>;
++ enable-active-high;
++
++ states = <1800000 0x1
++ 2900000 0x0>;
++ };
++
+ // External Micro SD slot
+ sdi0_per1@80126000 {
+ arm,primecell-periphid = <0x10480180>;
+diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
+index 206826a855c0..1bc84ebdccaa 100644
+--- a/arch/arm/boot/dts/ste-snowball.dts
++++ b/arch/arm/boot/dts/ste-snowball.dts
+@@ -146,8 +146,21 @@
+ };
+
+ vmmci: regulator-gpio {
++ compatible = "regulator-gpio";
++
+ gpios = <&gpio7 4 0x4>;
+ enable-gpio = <&gpio6 25 0x4>;
++
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <2900000>;
++ regulator-name = "mmci-reg";
++ regulator-type = "voltage";
++
++ startup-delay-us = <100>;
++ enable-active-high;
++
++ states = <1800000 0x1
++ 2900000 0x0>;
+ };
+
+ // External Micro SD slot
+diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile
+index 902397dd1000..1c1cdfa566ac 100644
+--- a/arch/arm/kernel/Makefile
++++ b/arch/arm/kernel/Makefile
+@@ -86,7 +86,7 @@ obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
+
+ obj-$(CONFIG_ARM_VIRT_EXT) += hyp-stub.o
+ ifeq ($(CONFIG_ARM_PSCI),y)
+-obj-y += psci.o
++obj-y += psci.o psci-call.o
+ obj-$(CONFIG_SMP) += psci_smp.o
+ endif
+
+diff --git a/arch/arm/kernel/psci-call.S b/arch/arm/kernel/psci-call.S
+new file mode 100644
+index 000000000000..a78e9e1e206d
+--- /dev/null
++++ b/arch/arm/kernel/psci-call.S
+@@ -0,0 +1,31 @@
++/*
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * Copyright (C) 2015 ARM Limited
++ *
++ * Author: Mark Rutland <mark.rutland@arm.com>
++ */
++
++#include <linux/linkage.h>
++
++#include <asm/opcodes-sec.h>
++#include <asm/opcodes-virt.h>
++
++/* int __invoke_psci_fn_hvc(u32 function_id, u32 arg0, u32 arg1, u32 arg2) */
++ENTRY(__invoke_psci_fn_hvc)
++ __HVC(0)
++ bx lr
++ENDPROC(__invoke_psci_fn_hvc)
++
++/* int __invoke_psci_fn_smc(u32 function_id, u32 arg0, u32 arg1, u32 arg2) */
++ENTRY(__invoke_psci_fn_smc)
++ __SMC(0)
++ bx lr
++ENDPROC(__invoke_psci_fn_smc)
+diff --git a/arch/arm/kernel/psci.c b/arch/arm/kernel/psci.c
+index f73891b6b730..f90fdf4ce7c7 100644
+--- a/arch/arm/kernel/psci.c
++++ b/arch/arm/kernel/psci.c
+@@ -23,8 +23,6 @@
+
+ #include <asm/compiler.h>
+ #include <asm/errno.h>
+-#include <asm/opcodes-sec.h>
+-#include <asm/opcodes-virt.h>
+ #include <asm/psci.h>
+ #include <asm/system_misc.h>
+
+@@ -33,6 +31,9 @@ struct psci_operations psci_ops;
+ static int (*invoke_psci_fn)(u32, u32, u32, u32);
+ typedef int (*psci_initcall_t)(const struct device_node *);
+
++asmlinkage int __invoke_psci_fn_hvc(u32, u32, u32, u32);
++asmlinkage int __invoke_psci_fn_smc(u32, u32, u32, u32);
++
+ enum psci_function {
+ PSCI_FN_CPU_SUSPEND,
+ PSCI_FN_CPU_ON,
+@@ -71,40 +72,6 @@ static u32 psci_power_state_pack(struct psci_power_state state)
+ & PSCI_0_2_POWER_STATE_AFFL_MASK);
+ }
+
+-/*
+- * The following two functions are invoked via the invoke_psci_fn pointer
+- * and will not be inlined, allowing us to piggyback on the AAPCS.
+- */
+-static noinline int __invoke_psci_fn_hvc(u32 function_id, u32 arg0, u32 arg1,
+- u32 arg2)
+-{
+- asm volatile(
+- __asmeq("%0", "r0")
+- __asmeq("%1", "r1")
+- __asmeq("%2", "r2")
+- __asmeq("%3", "r3")
+- __HVC(0)
+- : "+r" (function_id)
+- : "r" (arg0), "r" (arg1), "r" (arg2));
+-
+- return function_id;
+-}
+-
+-static noinline int __invoke_psci_fn_smc(u32 function_id, u32 arg0, u32 arg1,
+- u32 arg2)
+-{
+- asm volatile(
+- __asmeq("%0", "r0")
+- __asmeq("%1", "r1")
+- __asmeq("%2", "r2")
+- __asmeq("%3", "r3")
+- __SMC(0)
+- : "+r" (function_id)
+- : "r" (arg0), "r" (arg1), "r" (arg2));
+-
+- return function_id;
+-}
+-
+ static int psci_get_version(void)
+ {
+ int err;
+diff --git a/arch/arm/mach-omap2/prm-regbits-34xx.h b/arch/arm/mach-omap2/prm-regbits-34xx.h
+index cbefbd7cfdb5..661d753df584 100644
+--- a/arch/arm/mach-omap2/prm-regbits-34xx.h
++++ b/arch/arm/mach-omap2/prm-regbits-34xx.h
+@@ -112,6 +112,7 @@
+ #define OMAP3430_VC_CMD_ONLP_SHIFT 16
+ #define OMAP3430_VC_CMD_RET_SHIFT 8
+ #define OMAP3430_VC_CMD_OFF_SHIFT 0
++#define OMAP3430_SREN_MASK (1 << 4)
+ #define OMAP3430_HSEN_MASK (1 << 3)
+ #define OMAP3430_MCODE_MASK (0x7 << 0)
+ #define OMAP3430_VALID_MASK (1 << 24)
+diff --git a/arch/arm/mach-omap2/prm-regbits-44xx.h b/arch/arm/mach-omap2/prm-regbits-44xx.h
+index b1c7a33e00e7..e794828dee55 100644
+--- a/arch/arm/mach-omap2/prm-regbits-44xx.h
++++ b/arch/arm/mach-omap2/prm-regbits-44xx.h
+@@ -35,6 +35,7 @@
+ #define OMAP4430_GLOBAL_WARM_SW_RST_SHIFT 1
+ #define OMAP4430_GLOBAL_WUEN_MASK (1 << 16)
+ #define OMAP4430_HSMCODE_MASK (0x7 << 0)
++#define OMAP4430_SRMODEEN_MASK (1 << 4)
+ #define OMAP4430_HSMODEEN_MASK (1 << 3)
+ #define OMAP4430_HSSCLL_SHIFT 24
+ #define OMAP4430_ICEPICK_RST_SHIFT 9
+diff --git a/arch/arm/mach-omap2/vc.c b/arch/arm/mach-omap2/vc.c
+index be9ef834fa81..076fd20d7e5a 100644
+--- a/arch/arm/mach-omap2/vc.c
++++ b/arch/arm/mach-omap2/vc.c
+@@ -316,7 +316,8 @@ static void __init omap3_vc_init_pmic_signaling(struct voltagedomain *voltdm)
+ * idle. And we can also scale voltages to zero for off-idle.
+ * Note that no actual voltage scaling during off-idle will
+ * happen unless the board specific twl4030 PMIC scripts are
+- * loaded.
++ * loaded. See also omap_vc_i2c_init for comments regarding
++ * erratum i531.
+ */
+ val = voltdm->read(OMAP3_PRM_VOLTCTRL_OFFSET);
+ if (!(val & OMAP3430_PRM_VOLTCTRL_SEL_OFF)) {
+@@ -704,9 +705,16 @@ static void __init omap_vc_i2c_init(struct voltagedomain *voltdm)
+ return;
+ }
+
++ /*
++ * Note that for omap3 OMAP3430_SREN_MASK clears SREN to work around
++ * erratum i531 "Extra Power Consumed When Repeated Start Operation
++ * Mode Is Enabled on I2C Interface Dedicated for Smart Reflex (I2C4)".
++ * Otherwise I2C4 eventually leads into about 23mW extra power being
++ * consumed even during off idle using VMODE.
++ */
+ i2c_high_speed = voltdm->pmic->i2c_high_speed;
+ if (i2c_high_speed)
+- voltdm->rmw(vc->common->i2c_cfg_hsen_mask,
++ voltdm->rmw(vc->common->i2c_cfg_clear_mask,
+ vc->common->i2c_cfg_hsen_mask,
+ vc->common->i2c_cfg_reg);
+
+diff --git a/arch/arm/mach-omap2/vc.h b/arch/arm/mach-omap2/vc.h
+index cdbdd78e755e..89b83b7ff3ec 100644
+--- a/arch/arm/mach-omap2/vc.h
++++ b/arch/arm/mach-omap2/vc.h
+@@ -34,6 +34,7 @@ struct voltagedomain;
+ * @cmd_ret_shift: RET field shift in PRM_VC_CMD_VAL_* register
+ * @cmd_off_shift: OFF field shift in PRM_VC_CMD_VAL_* register
+ * @i2c_cfg_reg: I2C configuration register offset
++ * @i2c_cfg_clear_mask: high-speed mode bit clear mask in I2C config register
+ * @i2c_cfg_hsen_mask: high-speed mode bit field mask in I2C config register
+ * @i2c_mcode_mask: MCODE field mask for I2C config register
+ *
+@@ -52,6 +53,7 @@ struct omap_vc_common {
+ u8 cmd_ret_shift;
+ u8 cmd_off_shift;
+ u8 i2c_cfg_reg;
++ u8 i2c_cfg_clear_mask;
+ u8 i2c_cfg_hsen_mask;
+ u8 i2c_mcode_mask;
+ };
+diff --git a/arch/arm/mach-omap2/vc3xxx_data.c b/arch/arm/mach-omap2/vc3xxx_data.c
+index 75bc4aa22b3a..71d74c9172c1 100644
+--- a/arch/arm/mach-omap2/vc3xxx_data.c
++++ b/arch/arm/mach-omap2/vc3xxx_data.c
+@@ -40,6 +40,7 @@ static struct omap_vc_common omap3_vc_common = {
+ .cmd_onlp_shift = OMAP3430_VC_CMD_ONLP_SHIFT,
+ .cmd_ret_shift = OMAP3430_VC_CMD_RET_SHIFT,
+ .cmd_off_shift = OMAP3430_VC_CMD_OFF_SHIFT,
++ .i2c_cfg_clear_mask = OMAP3430_SREN_MASK | OMAP3430_HSEN_MASK,
+ .i2c_cfg_hsen_mask = OMAP3430_HSEN_MASK,
+ .i2c_cfg_reg = OMAP3_PRM_VC_I2C_CFG_OFFSET,
+ .i2c_mcode_mask = OMAP3430_MCODE_MASK,
+diff --git a/arch/arm/mach-omap2/vc44xx_data.c b/arch/arm/mach-omap2/vc44xx_data.c
+index 085e5d6a04fd..2abd5fa8a697 100644
+--- a/arch/arm/mach-omap2/vc44xx_data.c
++++ b/arch/arm/mach-omap2/vc44xx_data.c
+@@ -42,6 +42,7 @@ static const struct omap_vc_common omap4_vc_common = {
+ .cmd_ret_shift = OMAP4430_RET_SHIFT,
+ .cmd_off_shift = OMAP4430_OFF_SHIFT,
+ .i2c_cfg_reg = OMAP4_PRM_VC_CFG_I2C_MODE_OFFSET,
++ .i2c_cfg_clear_mask = OMAP4430_SRMODEEN_MASK | OMAP4430_HSMODEEN_MASK,
+ .i2c_cfg_hsen_mask = OMAP4430_HSMODEEN_MASK,
+ .i2c_mcode_mask = OMAP4430_HSMCODE_MASK,
+ };
+diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
+index e1268f905026..f412b53ed268 100644
+--- a/arch/arm/net/bpf_jit_32.c
++++ b/arch/arm/net/bpf_jit_32.c
+@@ -449,10 +449,21 @@ static inline void emit_udiv(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx)
+ return;
+ }
+ #endif
+- if (rm != ARM_R0)
+- emit(ARM_MOV_R(ARM_R0, rm), ctx);
++
++ /*
++ * For BPF_ALU | BPF_DIV | BPF_K instructions, rm is ARM_R4
++ * (r_A) and rn is ARM_R0 (r_scratch) so load rn first into
++ * ARM_R1 to avoid accidentally overwriting ARM_R0 with rm
++ * before using it as a source for ARM_R1.
++ *
++ * For BPF_ALU | BPF_DIV | BPF_X rm is ARM_R4 (r_A) and rn is
++ * ARM_R5 (r_X) so there is no particular register overlap
++ * issues.
++ */
+ if (rn != ARM_R1)
+ emit(ARM_MOV_R(ARM_R1, rn), ctx);
++ if (rm != ARM_R0)
++ emit(ARM_MOV_R(ARM_R0, rm), ctx);
+
+ ctx->seen |= SEEN_CALL;
+ emit_mov_i(ARM_R3, (u32)jit_udiv, ctx);
+diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
+index cf87de3fc390..64b611782ef0 100644
+--- a/arch/x86/include/asm/spinlock.h
++++ b/arch/x86/include/asm/spinlock.h
+@@ -169,7 +169,7 @@ static inline int arch_spin_is_contended(arch_spinlock_t *lock)
+ struct __raw_tickets tmp = READ_ONCE(lock->tickets);
+
+ tmp.head &= ~TICKET_SLOWPATH_FLAG;
+- return (tmp.tail - tmp.head) > TICKET_LOCK_INC;
++ return (__ticket_t)(tmp.tail - tmp.head) > TICKET_LOCK_INC;
+ }
+ #define arch_spin_is_contended arch_spin_is_contended
+
+diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
+index e4695985f9de..d93963340c3c 100644
+--- a/arch/x86/pci/acpi.c
++++ b/arch/x86/pci/acpi.c
+@@ -325,6 +325,26 @@ static void release_pci_root_info(struct pci_host_bridge *bridge)
+ kfree(info);
+ }
+
++/*
++ * An IO port or MMIO resource assigned to a PCI host bridge may be
++ * consumed by the host bridge itself or available to its child
++ * bus/devices. The ACPI specification defines a bit (Producer/Consumer)
++ * to tell whether the resource is consumed by the host bridge itself,
++ * but firmware hasn't used that bit consistently, so we can't rely on it.
++ *
++ * On x86 and IA64 platforms, all IO port and MMIO resources are assumed
++ * to be available to child bus/devices except one special case:
++ * IO port [0xCF8-0xCFF] is consumed by the host bridge itself
++ * to access PCI configuration space.
++ *
++ * So explicitly filter out PCI CFG IO ports[0xCF8-0xCFF].
++ */
++static bool resource_is_pcicfg_ioport(struct resource *res)
++{
++ return (res->flags & IORESOURCE_IO) &&
++ res->start == 0xCF8 && res->end == 0xCFF;
++}
++
+ static void probe_pci_root_info(struct pci_root_info *info,
+ struct acpi_device *device,
+ int busnum, int domain,
+@@ -346,8 +366,8 @@ static void probe_pci_root_info(struct pci_root_info *info,
+ "no IO and memory resources present in _CRS\n");
+ else
+ resource_list_for_each_entry_safe(entry, tmp, list) {
+- if ((entry->res->flags & IORESOURCE_WINDOW) == 0 ||
+- (entry->res->flags & IORESOURCE_DISABLED))
++ if ((entry->res->flags & IORESOURCE_DISABLED) ||
++ resource_is_pcicfg_ioport(entry->res))
+ resource_list_destroy_entry(entry);
+ else
+ entry->res->name = info->name;
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 794c3e7f01cf..66406474f0c4 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -552,6 +552,8 @@ void blk_cleanup_queue(struct request_queue *q)
+ q->queue_lock = &q->__queue_lock;
+ spin_unlock_irq(lock);
+
++ bdi_destroy(&q->backing_dev_info);
++
+ /* @q is and will stay empty, shutdown and put */
+ blk_put_queue(q);
+ }
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 33c428530193..5c39703e644f 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -675,8 +675,11 @@ static void blk_mq_rq_timer(unsigned long priv)
+ data.next = blk_rq_timeout(round_jiffies_up(data.next));
+ mod_timer(&q->timeout, data.next);
+ } else {
+- queue_for_each_hw_ctx(q, hctx, i)
+- blk_mq_tag_idle(hctx);
++ queue_for_each_hw_ctx(q, hctx, i) {
++ /* the hctx may be unmapped, so check it here */
++ if (blk_mq_hw_queue_mapped(hctx))
++ blk_mq_tag_idle(hctx);
++ }
+ }
+ }
+
+@@ -1570,22 +1573,6 @@ static int blk_mq_hctx_cpu_offline(struct blk_mq_hw_ctx *hctx, int cpu)
+ return NOTIFY_OK;
+ }
+
+-static int blk_mq_hctx_cpu_online(struct blk_mq_hw_ctx *hctx, int cpu)
+-{
+- struct request_queue *q = hctx->queue;
+- struct blk_mq_tag_set *set = q->tag_set;
+-
+- if (set->tags[hctx->queue_num])
+- return NOTIFY_OK;
+-
+- set->tags[hctx->queue_num] = blk_mq_init_rq_map(set, hctx->queue_num);
+- if (!set->tags[hctx->queue_num])
+- return NOTIFY_STOP;
+-
+- hctx->tags = set->tags[hctx->queue_num];
+- return NOTIFY_OK;
+-}
+-
+ static int blk_mq_hctx_notify(void *data, unsigned long action,
+ unsigned int cpu)
+ {
+@@ -1593,8 +1580,11 @@ static int blk_mq_hctx_notify(void *data, unsigned long action,
+
+ if (action == CPU_DEAD || action == CPU_DEAD_FROZEN)
+ return blk_mq_hctx_cpu_offline(hctx, cpu);
+- else if (action == CPU_ONLINE || action == CPU_ONLINE_FROZEN)
+- return blk_mq_hctx_cpu_online(hctx, cpu);
++
++ /*
++ * In case of CPU online, tags may be reallocated
++ * in blk_mq_map_swqueue() after mapping is updated.
++ */
+
+ return NOTIFY_OK;
+ }
+@@ -1776,6 +1766,7 @@ static void blk_mq_map_swqueue(struct request_queue *q)
+ unsigned int i;
+ struct blk_mq_hw_ctx *hctx;
+ struct blk_mq_ctx *ctx;
++ struct blk_mq_tag_set *set = q->tag_set;
+
+ queue_for_each_hw_ctx(q, hctx, i) {
+ cpumask_clear(hctx->cpumask);
+@@ -1802,16 +1793,20 @@ static void blk_mq_map_swqueue(struct request_queue *q)
+ * disable it and free the request entries.
+ */
+ if (!hctx->nr_ctx) {
+- struct blk_mq_tag_set *set = q->tag_set;
+-
+ if (set->tags[i]) {
+ blk_mq_free_rq_map(set, set->tags[i], i);
+ set->tags[i] = NULL;
+- hctx->tags = NULL;
+ }
++ hctx->tags = NULL;
+ continue;
+ }
+
++ /* unmapped hw queue can be remapped after CPU topo changed */
++ if (!set->tags[i])
++ set->tags[i] = blk_mq_init_rq_map(set, i);
++ hctx->tags = set->tags[i];
++ WARN_ON(!hctx->tags);
++
+ /*
+ * Initialize batch roundrobin counts
+ */
+@@ -2075,9 +2070,16 @@ static int blk_mq_queue_reinit_notify(struct notifier_block *nb,
+ */
+ list_for_each_entry(q, &all_q_list, all_q_node)
+ blk_mq_freeze_queue_start(q);
+- list_for_each_entry(q, &all_q_list, all_q_node)
++ list_for_each_entry(q, &all_q_list, all_q_node) {
+ blk_mq_freeze_queue_wait(q);
+
++ /*
++ * timeout handler can't touch hw queue during the
++ * reinitialization
++ */
++ del_timer_sync(&q->timeout);
++ }
++
+ list_for_each_entry(q, &all_q_list, all_q_node)
+ blk_mq_queue_reinit(q);
+
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index faaf36ade7eb..2b8fd302f677 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -522,8 +522,6 @@ static void blk_release_queue(struct kobject *kobj)
+
+ blk_trace_shutdown(q);
+
+- bdi_destroy(&q->backing_dev_info);
+-
+ ida_simple_remove(&blk_queue_ida, q->id);
+ call_rcu(&q->rcu_head, blk_free_queue_rcu);
+ }
+diff --git a/drivers/acpi/acpi_pnp.c b/drivers/acpi/acpi_pnp.c
+index b193f8425999..ff6d8adc9cda 100644
+--- a/drivers/acpi/acpi_pnp.c
++++ b/drivers/acpi/acpi_pnp.c
+@@ -304,6 +304,8 @@ static const struct acpi_device_id acpi_pnp_device_ids[] = {
+ {"PNPb006"},
+ /* cs423x-pnpbios */
+ {"CSC0100"},
++ {"CSC0103"},
++ {"CSC0110"},
+ {"CSC0000"},
+ {"GIM0100"}, /* Guillemot Turtlebeach something appears to be cs4232 compatible */
+ /* es18xx-pnpbios */
+diff --git a/drivers/acpi/acpica/acmacros.h b/drivers/acpi/acpica/acmacros.h
+index cf607fe69dbd..c240bdf824f2 100644
+--- a/drivers/acpi/acpica/acmacros.h
++++ b/drivers/acpi/acpica/acmacros.h
+@@ -63,23 +63,12 @@
+ #define ACPI_SET64(ptr, val) (*ACPI_CAST64 (ptr) = (u64) (val))
+
+ /*
+- * printf() format helpers. These macros are workarounds for the difficulties
++ * printf() format helper. This macros is a workaround for the difficulties
+ * with emitting 64-bit integers and 64-bit pointers with the same code
+ * for both 32-bit and 64-bit hosts.
+ */
+ #define ACPI_FORMAT_UINT64(i) ACPI_HIDWORD(i), ACPI_LODWORD(i)
+
+-#if ACPI_MACHINE_WIDTH == 64
+-#define ACPI_FORMAT_NATIVE_UINT(i) ACPI_FORMAT_UINT64(i)
+-#define ACPI_FORMAT_TO_UINT(i) ACPI_FORMAT_UINT64(i)
+-#define ACPI_PRINTF_UINT "0x%8.8X%8.8X"
+-
+-#else
+-#define ACPI_FORMAT_NATIVE_UINT(i) 0, (u32) (i)
+-#define ACPI_FORMAT_TO_UINT(i) (u32) (i)
+-#define ACPI_PRINTF_UINT "0x%8.8X"
+-#endif
+-
+ /*
+ * Macros for moving data around to/from buffers that are possibly unaligned.
+ * If the hardware supports the transfer of unaligned data, just do the store.
+diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
+index 77244182ff02..ea0cc4e08f80 100644
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -446,7 +446,7 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state,
+
+ ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n",
+ obj_desc,
+- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address),
++ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
+ /* Now the address and length are valid for this opregion */
+@@ -539,13 +539,12 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state,
+ return_ACPI_STATUS(AE_NOT_EXIST);
+ }
+
+- obj_desc->region.address =
+- (acpi_physical_address) ACPI_TO_INTEGER(table);
++ obj_desc->region.address = ACPI_PTR_TO_PHYSADDR(table);
+ obj_desc->region.length = table->length;
+
+ ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n",
+ obj_desc,
+- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address),
++ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
+ /* Now the address and length are valid for this opregion */
+diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c
+index 9abace3401f9..2ba28a63fb68 100644
+--- a/drivers/acpi/acpica/evregion.c
++++ b/drivers/acpi/acpica/evregion.c
+@@ -272,7 +272,7 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj,
+ ACPI_DEBUG_PRINT((ACPI_DB_OPREGION,
+ "Handler %p (@%p) Address %8.8X%8.8X [%s]\n",
+ &region_obj->region.handler->address_space, handler,
+- ACPI_FORMAT_NATIVE_UINT(address),
++ ACPI_FORMAT_UINT64(address),
+ acpi_ut_get_region_name(region_obj->region.
+ space_id)));
+
+diff --git a/drivers/acpi/acpica/exdump.c b/drivers/acpi/acpica/exdump.c
+index 7c213b6b6472..1da52bef632e 100644
+--- a/drivers/acpi/acpica/exdump.c
++++ b/drivers/acpi/acpica/exdump.c
+@@ -767,8 +767,8 @@ void acpi_ex_dump_operand(union acpi_operand_object *obj_desc, u32 depth)
+ acpi_os_printf("\n");
+ } else {
+ acpi_os_printf(" base %8.8X%8.8X Length %X\n",
+- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.
+- address),
++ ACPI_FORMAT_UINT64(obj_desc->region.
++ address),
+ obj_desc->region.length);
+ }
+ break;
+diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
+index 49479927e7f7..725a3746a2df 100644
+--- a/drivers/acpi/acpica/exfldio.c
++++ b/drivers/acpi/acpica/exfldio.c
+@@ -263,17 +263,15 @@ acpi_ex_access_region(union acpi_operand_object *obj_desc,
+ }
+
+ ACPI_DEBUG_PRINT_RAW((ACPI_DB_BFIELD,
+- " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %p\n",
++ " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %8.8X%8.8X\n",
+ acpi_ut_get_region_name(rgn_desc->region.
+ space_id),
+ rgn_desc->region.space_id,
+ obj_desc->common_field.access_byte_width,
+ obj_desc->common_field.base_byte_offset,
+- field_datum_byte_offset, ACPI_CAST_PTR(void,
+- (rgn_desc->
+- region.
+- address +
+- region_offset))));
++ field_datum_byte_offset,
++ ACPI_FORMAT_UINT64(rgn_desc->region.address +
++ region_offset)));
+
+ /* Invoke the appropriate address_space/op_region handler */
+
+diff --git a/drivers/acpi/acpica/exregion.c b/drivers/acpi/acpica/exregion.c
+index 0fe188e238ef..b4bbf3150bc1 100644
+--- a/drivers/acpi/acpica/exregion.c
++++ b/drivers/acpi/acpica/exregion.c
+@@ -181,7 +181,7 @@ acpi_ex_system_memory_space_handler(u32 function,
+ if (!mem_info->mapped_logical_address) {
+ ACPI_ERROR((AE_INFO,
+ "Could not map memory at 0x%8.8X%8.8X, size %u",
+- ACPI_FORMAT_NATIVE_UINT(address),
++ ACPI_FORMAT_UINT64(address),
+ (u32) map_length));
+ mem_info->mapped_length = 0;
+ return_ACPI_STATUS(AE_NO_MEMORY);
+@@ -202,8 +202,7 @@ acpi_ex_system_memory_space_handler(u32 function,
+
+ ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+ "System-Memory (width %u) R/W %u Address=%8.8X%8.8X\n",
+- bit_width, function,
+- ACPI_FORMAT_NATIVE_UINT(address)));
++ bit_width, function, ACPI_FORMAT_UINT64(address)));
+
+ /*
+ * Perform the memory read or write
+@@ -318,8 +317,7 @@ acpi_ex_system_io_space_handler(u32 function,
+
+ ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+ "System-IO (width %u) R/W %u Address=%8.8X%8.8X\n",
+- bit_width, function,
+- ACPI_FORMAT_NATIVE_UINT(address)));
++ bit_width, function, ACPI_FORMAT_UINT64(address)));
+
+ /* Decode the function parameter */
+
+diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c
+index 2bd33fe56cb3..29033d71417b 100644
+--- a/drivers/acpi/acpica/hwvalid.c
++++ b/drivers/acpi/acpica/hwvalid.c
+@@ -142,17 +142,17 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
+ byte_width = ACPI_DIV_8(bit_width);
+ last_address = address + byte_width - 1;
+
+- ACPI_DEBUG_PRINT((ACPI_DB_IO, "Address %p LastAddress %p Length %X",
+- ACPI_CAST_PTR(void, address), ACPI_CAST_PTR(void,
+- last_address),
+- byte_width));
++ ACPI_DEBUG_PRINT((ACPI_DB_IO,
++ "Address %8.8X%8.8X LastAddress %8.8X%8.8X Length %X",
++ ACPI_FORMAT_UINT64(address),
++ ACPI_FORMAT_UINT64(last_address), byte_width));
+
+ /* Maximum 16-bit address in I/O space */
+
+ if (last_address > ACPI_UINT16_MAX) {
+ ACPI_ERROR((AE_INFO,
+- "Illegal I/O port address/length above 64K: %p/0x%X",
+- ACPI_CAST_PTR(void, address), byte_width));
++ "Illegal I/O port address/length above 64K: %8.8X%8.8X/0x%X",
++ ACPI_FORMAT_UINT64(address), byte_width));
+ return_ACPI_STATUS(AE_LIMIT);
+ }
+
+@@ -181,8 +181,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
+
+ if (acpi_gbl_osi_data >= port_info->osi_dependency) {
+ ACPI_DEBUG_PRINT((ACPI_DB_IO,
+- "Denied AML access to port 0x%p/%X (%s 0x%.4X-0x%.4X)",
+- ACPI_CAST_PTR(void, address),
++ "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)",
++ ACPI_FORMAT_UINT64(address),
+ byte_width, port_info->name,
+ port_info->start,
+ port_info->end));
+diff --git a/drivers/acpi/acpica/nsdump.c b/drivers/acpi/acpica/nsdump.c
+index 80f097eb7381..d259393505fa 100644
+--- a/drivers/acpi/acpica/nsdump.c
++++ b/drivers/acpi/acpica/nsdump.c
+@@ -271,12 +271,11 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,
+ switch (type) {
+ case ACPI_TYPE_PROCESSOR:
+
+- acpi_os_printf("ID %02X Len %02X Addr %p\n",
++ acpi_os_printf("ID %02X Len %02X Addr %8.8X%8.8X\n",
+ obj_desc->processor.proc_id,
+ obj_desc->processor.length,
+- ACPI_CAST_PTR(void,
+- obj_desc->processor.
+- address));
++ ACPI_FORMAT_UINT64(obj_desc->processor.
++ address));
+ break;
+
+ case ACPI_TYPE_DEVICE:
+@@ -347,8 +346,9 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,
+ space_id));
+ if (obj_desc->region.flags & AOPOBJ_DATA_VALID) {
+ acpi_os_printf(" Addr %8.8X%8.8X Len %.4X\n",
+- ACPI_FORMAT_NATIVE_UINT
+- (obj_desc->region.address),
++ ACPI_FORMAT_UINT64(obj_desc->
++ region.
++ address),
+ obj_desc->region.length);
+ } else {
+ acpi_os_printf
+diff --git a/drivers/acpi/acpica/tbdata.c b/drivers/acpi/acpica/tbdata.c
+index 6a144957aadd..fd5998b2b46b 100644
+--- a/drivers/acpi/acpica/tbdata.c
++++ b/drivers/acpi/acpica/tbdata.c
+@@ -113,9 +113,9 @@ acpi_tb_acquire_table(struct acpi_table_desc *table_desc,
+ case ACPI_TABLE_ORIGIN_INTERNAL_VIRTUAL:
+ case ACPI_TABLE_ORIGIN_EXTERNAL_VIRTUAL:
+
+- table =
+- ACPI_CAST_PTR(struct acpi_table_header,
+- table_desc->address);
++ table = ACPI_CAST_PTR(struct acpi_table_header,
++ ACPI_PHYSADDR_TO_PTR(table_desc->
++ address));
+ break;
+
+ default:
+@@ -214,7 +214,8 @@ acpi_tb_acquire_temp_table(struct acpi_table_desc *table_desc,
+ case ACPI_TABLE_ORIGIN_INTERNAL_VIRTUAL:
+ case ACPI_TABLE_ORIGIN_EXTERNAL_VIRTUAL:
+
+- table_header = ACPI_CAST_PTR(struct acpi_table_header, address);
++ table_header = ACPI_CAST_PTR(struct acpi_table_header,
++ ACPI_PHYSADDR_TO_PTR(address));
+ if (!table_header) {
+ return (AE_NO_MEMORY);
+ }
+@@ -398,14 +399,14 @@ acpi_tb_verify_temp_table(struct acpi_table_desc * table_desc, char *signature)
+ table_desc->length);
+ if (ACPI_FAILURE(status)) {
+ ACPI_EXCEPTION((AE_INFO, AE_NO_MEMORY,
+- "%4.4s " ACPI_PRINTF_UINT
++ "%4.4s 0x%8.8X%8.8X"
+ " Attempted table install failed",
+ acpi_ut_valid_acpi_name(table_desc->
+ signature.
+ ascii) ?
+ table_desc->signature.ascii : "????",
+- ACPI_FORMAT_TO_UINT(table_desc->
+- address)));
++ ACPI_FORMAT_UINT64(table_desc->
++ address)));
+ goto invalidate_and_exit;
+ }
+ }
+diff --git a/drivers/acpi/acpica/tbinstal.c b/drivers/acpi/acpica/tbinstal.c
+index 7fbc2b9dcbbb..7e69bc73bd16 100644
+--- a/drivers/acpi/acpica/tbinstal.c
++++ b/drivers/acpi/acpica/tbinstal.c
+@@ -187,8 +187,9 @@ acpi_tb_install_fixed_table(acpi_physical_address address,
+ status = acpi_tb_acquire_temp_table(&new_table_desc, address,
+ ACPI_TABLE_ORIGIN_INTERNAL_PHYSICAL);
+ if (ACPI_FAILURE(status)) {
+- ACPI_ERROR((AE_INFO, "Could not acquire table length at %p",
+- ACPI_CAST_PTR(void, address)));
++ ACPI_ERROR((AE_INFO,
++ "Could not acquire table length at %8.8X%8.8X",
++ ACPI_FORMAT_UINT64(address)));
+ return_ACPI_STATUS(status);
+ }
+
+@@ -246,8 +247,9 @@ acpi_tb_install_standard_table(acpi_physical_address address,
+
+ status = acpi_tb_acquire_temp_table(&new_table_desc, address, flags);
+ if (ACPI_FAILURE(status)) {
+- ACPI_ERROR((AE_INFO, "Could not acquire table length at %p",
+- ACPI_CAST_PTR(void, address)));
++ ACPI_ERROR((AE_INFO,
++ "Could not acquire table length at %8.8X%8.8X",
++ ACPI_FORMAT_UINT64(address)));
+ return_ACPI_STATUS(status);
+ }
+
+@@ -258,9 +260,10 @@ acpi_tb_install_standard_table(acpi_physical_address address,
+ if (!reload &&
+ acpi_gbl_disable_ssdt_table_install &&
+ ACPI_COMPARE_NAME(&new_table_desc.signature, ACPI_SIG_SSDT)) {
+- ACPI_INFO((AE_INFO, "Ignoring installation of %4.4s at %p",
+- new_table_desc.signature.ascii, ACPI_CAST_PTR(void,
+- address)));
++ ACPI_INFO((AE_INFO,
++ "Ignoring installation of %4.4s at %8.8X%8.8X",
++ new_table_desc.signature.ascii,
++ ACPI_FORMAT_UINT64(address)));
+ goto release_and_exit;
+ }
+
+@@ -428,11 +431,11 @@ finish_override:
+ return;
+ }
+
+- ACPI_INFO((AE_INFO, "%4.4s " ACPI_PRINTF_UINT
+- " %s table override, new table: " ACPI_PRINTF_UINT,
++ ACPI_INFO((AE_INFO, "%4.4s 0x%8.8X%8.8X"
++ " %s table override, new table: 0x%8.8X%8.8X",
+ old_table_desc->signature.ascii,
+- ACPI_FORMAT_TO_UINT(old_table_desc->address),
+- override_type, ACPI_FORMAT_TO_UINT(new_table_desc.address)));
++ ACPI_FORMAT_UINT64(old_table_desc->address),
++ override_type, ACPI_FORMAT_UINT64(new_table_desc.address)));
+
+ /* We can now uninstall the original table */
+
+@@ -516,7 +519,7 @@ void acpi_tb_uninstall_table(struct acpi_table_desc *table_desc)
+
+ if ((table_desc->flags & ACPI_TABLE_ORIGIN_MASK) ==
+ ACPI_TABLE_ORIGIN_INTERNAL_VIRTUAL) {
+- ACPI_FREE(ACPI_CAST_PTR(void, table_desc->address));
++ ACPI_FREE(ACPI_PHYSADDR_TO_PTR(table_desc->address));
+ }
+
+ table_desc->address = ACPI_PTR_TO_PHYSADDR(NULL);
+diff --git a/drivers/acpi/acpica/tbprint.c b/drivers/acpi/acpica/tbprint.c
+index ef16c06e5091..77ba5c71c6e7 100644
+--- a/drivers/acpi/acpica/tbprint.c
++++ b/drivers/acpi/acpica/tbprint.c
+@@ -127,18 +127,12 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ {
+ struct acpi_table_header local_header;
+
+- /*
+- * The reason that we use ACPI_PRINTF_UINT and ACPI_FORMAT_TO_UINT is to
+- * support both 32-bit and 64-bit hosts/addresses in a consistent manner.
+- * The %p specifier does not emit uniform output on all hosts. On some,
+- * leading zeros are not supported.
+- */
+ if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_FACS)) {
+
+ /* FACS only has signature and length fields */
+
+- ACPI_INFO((AE_INFO, "%-4.4s " ACPI_PRINTF_UINT " %06X",
+- header->signature, ACPI_FORMAT_TO_UINT(address),
++ ACPI_INFO((AE_INFO, "%-4.4s 0x%8.8X%8.8X %06X",
++ header->signature, ACPI_FORMAT_UINT64(address),
+ header->length));
+ } else if (ACPI_VALIDATE_RSDP_SIG(header->signature)) {
+
+@@ -149,9 +143,8 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ header)->oem_id, ACPI_OEM_ID_SIZE);
+ acpi_tb_fix_string(local_header.oem_id, ACPI_OEM_ID_SIZE);
+
+- ACPI_INFO((AE_INFO,
+- "RSDP " ACPI_PRINTF_UINT " %06X (v%.2d %-6.6s)",
+- ACPI_FORMAT_TO_UINT(address),
++ ACPI_INFO((AE_INFO, "RSDP 0x%8.8X%8.8X %06X (v%.2d %-6.6s)",
++ ACPI_FORMAT_UINT64(address),
+ (ACPI_CAST_PTR(struct acpi_table_rsdp, header)->
+ revision >
+ 0) ? ACPI_CAST_PTR(struct acpi_table_rsdp,
+@@ -165,9 +158,9 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ acpi_tb_cleanup_table_header(&local_header, header);
+
+ ACPI_INFO((AE_INFO,
+- "%-4.4s " ACPI_PRINTF_UINT
++ "%-4.4s 0x%8.8X%8.8X"
+ " %06X (v%.2d %-6.6s %-8.8s %08X %-4.4s %08X)",
+- local_header.signature, ACPI_FORMAT_TO_UINT(address),
++ local_header.signature, ACPI_FORMAT_UINT64(address),
+ local_header.length, local_header.revision,
+ local_header.oem_id, local_header.oem_table_id,
+ local_header.oem_revision,
+diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c
+index eac52cf14f1a..fa76a3603aa1 100644
+--- a/drivers/acpi/acpica/tbxfroot.c
++++ b/drivers/acpi/acpica/tbxfroot.c
+@@ -142,7 +142,7 @@ acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp * rsdp)
+ *
+ ******************************************************************************/
+
+-acpi_status __init acpi_find_root_pointer(acpi_size *table_address)
++acpi_status __init acpi_find_root_pointer(acpi_physical_address * table_address)
+ {
+ u8 *table_ptr;
+ u8 *mem_rover;
+@@ -200,7 +200,8 @@ acpi_status __init acpi_find_root_pointer(acpi_size *table_address)
+ physical_address +=
+ (u32) ACPI_PTR_DIFF(mem_rover, table_ptr);
+
+- *table_address = physical_address;
++ *table_address =
++ (acpi_physical_address) physical_address;
+ return_ACPI_STATUS(AE_OK);
+ }
+ }
+@@ -233,7 +234,7 @@ acpi_status __init acpi_find_root_pointer(acpi_size *table_address)
+ (ACPI_HI_RSDP_WINDOW_BASE +
+ ACPI_PTR_DIFF(mem_rover, table_ptr));
+
+- *table_address = physical_address;
++ *table_address = (acpi_physical_address) physical_address;
+ return_ACPI_STATUS(AE_OK);
+ }
+
+diff --git a/drivers/acpi/acpica/utaddress.c b/drivers/acpi/acpica/utaddress.c
+index 1279f50da757..911ea8e7fe87 100644
+--- a/drivers/acpi/acpica/utaddress.c
++++ b/drivers/acpi/acpica/utaddress.c
+@@ -107,10 +107,10 @@ acpi_ut_add_address_range(acpi_adr_space_type space_id,
+ acpi_gbl_address_range_list[space_id] = range_info;
+
+ ACPI_DEBUG_PRINT((ACPI_DB_NAMES,
+- "\nAdded [%4.4s] address range: 0x%p-0x%p\n",
++ "\nAdded [%4.4s] address range: 0x%8.8X%8.8X-0x%8.8X%8.8X\n",
+ acpi_ut_get_node_name(range_info->region_node),
+- ACPI_CAST_PTR(void, address),
+- ACPI_CAST_PTR(void, range_info->end_address)));
++ ACPI_FORMAT_UINT64(address),
++ ACPI_FORMAT_UINT64(range_info->end_address)));
+
+ (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
+ return_ACPI_STATUS(AE_OK);
+@@ -160,15 +160,13 @@ acpi_ut_remove_address_range(acpi_adr_space_type space_id,
+ }
+
+ ACPI_DEBUG_PRINT((ACPI_DB_NAMES,
+- "\nRemoved [%4.4s] address range: 0x%p-0x%p\n",
++ "\nRemoved [%4.4s] address range: 0x%8.8X%8.8X-0x%8.8X%8.8X\n",
+ acpi_ut_get_node_name(range_info->
+ region_node),
+- ACPI_CAST_PTR(void,
+- range_info->
+- start_address),
+- ACPI_CAST_PTR(void,
+- range_info->
+- end_address)));
++ ACPI_FORMAT_UINT64(range_info->
++ start_address),
++ ACPI_FORMAT_UINT64(range_info->
++ end_address)));
+
+ ACPI_FREE(range_info);
+ return_VOID;
+@@ -245,16 +243,14 @@ acpi_ut_check_address_range(acpi_adr_space_type space_id,
+ region_node);
+
+ ACPI_WARNING((AE_INFO,
+- "%s range 0x%p-0x%p conflicts with OpRegion 0x%p-0x%p (%s)",
++ "%s range 0x%8.8X%8.8X-0x%8.8X%8.8X conflicts with OpRegion 0x%8.8X%8.8X-0x%8.8X%8.8X (%s)",
+ acpi_ut_get_region_name(space_id),
+- ACPI_CAST_PTR(void, address),
+- ACPI_CAST_PTR(void, end_address),
+- ACPI_CAST_PTR(void,
+- range_info->
+- start_address),
+- ACPI_CAST_PTR(void,
+- range_info->
+- end_address),
++ ACPI_FORMAT_UINT64(address),
++ ACPI_FORMAT_UINT64(end_address),
++ ACPI_FORMAT_UINT64(range_info->
++ start_address),
++ ACPI_FORMAT_UINT64(range_info->
++ end_address),
+ pathname));
+ ACPI_FREE(pathname);
+ }
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 5589a6e2a023..8244f013f210 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -573,7 +573,7 @@ EXPORT_SYMBOL_GPL(acpi_dev_get_resources);
+ * @ares: Input ACPI resource object.
+ * @types: Valid resource types of IORESOURCE_XXX
+ *
+- * This is a hepler function to support acpi_dev_get_resources(), which filters
++ * This is a helper function to support acpi_dev_get_resources(), which filters
+ * ACPI resource objects according to resource types.
+ */
+ int acpi_dev_filter_resource_type(struct acpi_resource *ares,
+diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
+index 26e5b5060523..bf034f8b7c1a 100644
+--- a/drivers/acpi/sbshc.c
++++ b/drivers/acpi/sbshc.c
+@@ -14,6 +14,7 @@
+ #include <linux/delay.h>
+ #include <linux/module.h>
+ #include <linux/interrupt.h>
++#include <linux/dmi.h>
+ #include "sbshc.h"
+
+ #define PREFIX "ACPI: "
+@@ -87,6 +88,8 @@ enum acpi_smb_offset {
+ ACPI_SMB_ALARM_DATA = 0x26, /* 2 bytes alarm data */
+ };
+
++static bool macbook;
++
+ static inline int smb_hc_read(struct acpi_smb_hc *hc, u8 address, u8 *data)
+ {
+ return ec_read(hc->offset + address, data);
+@@ -132,6 +135,8 @@ static int acpi_smbus_transaction(struct acpi_smb_hc *hc, u8 protocol,
+ }
+
+ mutex_lock(&hc->lock);
++ if (macbook)
++ udelay(5);
+ if (smb_hc_read(hc, ACPI_SMB_PROTOCOL, &temp))
+ goto end;
+ if (temp) {
+@@ -257,12 +262,29 @@ extern int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
+ acpi_handle handle, acpi_ec_query_func func,
+ void *data);
+
++static int macbook_dmi_match(const struct dmi_system_id *d)
++{
++ pr_debug("Detected MacBook, enabling workaround\n");
++ macbook = true;
++ return 0;
++}
++
++static struct dmi_system_id acpi_smbus_dmi_table[] = {
++ { macbook_dmi_match, "Apple MacBook", {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBook") },
++ },
++ { },
++};
++
+ static int acpi_smbus_hc_add(struct acpi_device *device)
+ {
+ int status;
+ unsigned long long val;
+ struct acpi_smb_hc *hc;
+
++ dmi_check_system(acpi_smbus_dmi_table);
++
+ if (!device)
+ return -EINVAL;
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index d1f168b73634..773e964f14d9 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1672,8 +1672,8 @@ out:
+
+ static void loop_remove(struct loop_device *lo)
+ {
+- del_gendisk(lo->lo_disk);
+ blk_cleanup_queue(lo->lo_queue);
++ del_gendisk(lo->lo_disk);
+ blk_mq_free_tag_set(&lo->tag_set);
+ put_disk(lo->lo_disk);
+ kfree(lo);
+diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
+index 7722ed53bd65..af3bc7a8033b 100644
+--- a/drivers/gpio/gpiolib-sysfs.c
++++ b/drivers/gpio/gpiolib-sysfs.c
+@@ -551,6 +551,7 @@ static struct class gpio_class = {
+ */
+ int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
+ {
++ struct gpio_chip *chip;
+ unsigned long flags;
+ int status;
+ const char *ioname = NULL;
+@@ -568,8 +569,16 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
+ return -EINVAL;
+ }
+
++ chip = desc->chip;
++
+ mutex_lock(&sysfs_lock);
+
++ /* check if chip is being removed */
++ if (!chip || !chip->exported) {
++ status = -ENODEV;
++ goto fail_unlock;
++ }
++
+ spin_lock_irqsave(&gpio_lock, flags);
+ if (!test_bit(FLAG_REQUESTED, &desc->flags) ||
+ test_bit(FLAG_EXPORT, &desc->flags)) {
+@@ -783,12 +792,15 @@ void gpiochip_unexport(struct gpio_chip *chip)
+ {
+ int status;
+ struct device *dev;
++ struct gpio_desc *desc;
++ unsigned int i;
+
+ mutex_lock(&sysfs_lock);
+ dev = class_find_device(&gpio_class, NULL, chip, match_export);
+ if (dev) {
+ put_device(dev);
+ device_unregister(dev);
++ /* prevent further gpiod exports */
+ chip->exported = false;
+ status = 0;
+ } else
+@@ -797,6 +809,13 @@ void gpiochip_unexport(struct gpio_chip *chip)
+
+ if (status)
+ chip_dbg(chip, "%s: status %d\n", __func__, status);
++
++ /* unregister gpiod class devices owned by sysfs */
++ for (i = 0; i < chip->ngpio; i++) {
++ desc = &chip->desc[i];
++ if (test_and_clear_bit(FLAG_SYSFS, &desc->flags))
++ gpiod_free(desc);
++ }
+ }
+
+ static int __init gpiolib_sysfs_init(void)
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+index d8135adb2238..39762a7d2ec7 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+@@ -429,9 +429,10 @@ static int unregister_process_nocpsch(struct device_queue_manager *dqm,
+
+ BUG_ON(!dqm || !qpd);
+
+- BUG_ON(!list_empty(&qpd->queues_list));
++ pr_debug("In func %s\n", __func__);
+
+- pr_debug("kfd: In func %s\n", __func__);
++ pr_debug("qpd->queues_list is %s\n",
++ list_empty(&qpd->queues_list) ? "empty" : "not empty");
+
+ retval = 0;
+ mutex_lock(&dqm->lock);
+@@ -878,6 +879,8 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
+ return -ENOMEM;
+ }
+
++ init_sdma_vm(dqm, q, qpd);
++
+ retval = mqd->init_mqd(mqd, &q->mqd, &q->mqd_mem_obj,
+ &q->gart_mqd_addr, &q->properties);
+ if (retval != 0)
+diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
+index 10574a0c3a55..5769db4f51f3 100644
+--- a/drivers/gpu/drm/drm_irq.c
++++ b/drivers/gpu/drm/drm_irq.c
+@@ -131,12 +131,11 @@ static void drm_update_vblank_count(struct drm_device *dev, int crtc)
+
+ /* Reinitialize corresponding vblank timestamp if high-precision query
+ * available. Skip this step if query unsupported or failed. Will
+- * reinitialize delayed at next vblank interrupt in that case.
++ * reinitialize delayed at next vblank interrupt in that case and
++ * assign 0 for now, to mark the vblanktimestamp as invalid.
+ */
+- if (rc) {
+- tslot = atomic_read(&vblank->count) + diff;
+- vblanktimestamp(dev, crtc, tslot) = t_vblank;
+- }
++ tslot = atomic_read(&vblank->count) + diff;
++ vblanktimestamp(dev, crtc, tslot) = rc ? t_vblank : (struct timeval) {0, 0};
+
+ smp_mb__before_atomic();
+ atomic_add(diff, &vblank->count);
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index a74aaf9242b9..88b36a9173c9 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1176,7 +1176,7 @@ intel_dp_compute_config(struct intel_encoder *encoder,
+
+ pipe_config->has_dp_encoder = true;
+ pipe_config->has_drrs = false;
+- pipe_config->has_audio = intel_dp->has_audio;
++ pipe_config->has_audio = intel_dp->has_audio && port != PORT_A;
+
+ if (is_edp(intel_dp) && intel_connector->panel.fixed_mode) {
+ intel_fixed_panel_mode(intel_connector->panel.fixed_mode,
+@@ -2026,8 +2026,8 @@ static void intel_dp_get_config(struct intel_encoder *encoder,
+ int dotclock;
+
+ tmp = I915_READ(intel_dp->output_reg);
+- if (tmp & DP_AUDIO_OUTPUT_ENABLE)
+- pipe_config->has_audio = true;
++
++ pipe_config->has_audio = tmp & DP_AUDIO_OUTPUT_ENABLE && port != PORT_A;
+
+ if ((port == PORT_A) || !HAS_PCH_CPT(dev)) {
+ if (tmp & DP_SYNC_HS_HIGH)
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index 071b96d6e146..fbc2a83795fa 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -812,12 +812,28 @@ static int intel_dual_link_lvds_callback(const struct dmi_system_id *id)
+ static const struct dmi_system_id intel_dual_link_lvds[] = {
+ {
+ .callback = intel_dual_link_lvds_callback,
+- .ident = "Apple MacBook Pro (Core i5/i7 Series)",
++ .ident = "Apple MacBook Pro 15\" (2010)",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro6,2"),
++ },
++ },
++ {
++ .callback = intel_dual_link_lvds_callback,
++ .ident = "Apple MacBook Pro 15\" (2011)",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro8,2"),
+ },
+ },
++ {
++ .callback = intel_dual_link_lvds_callback,
++ .ident = "Apple MacBook Pro 15\" (2012)",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro9,1"),
++ },
++ },
+ { } /* terminating entry */
+ };
+
+@@ -847,6 +863,11 @@ static bool compute_is_dual_link_lvds(struct intel_lvds_encoder *lvds_encoder)
+ if (i915.lvds_channel_mode > 0)
+ return i915.lvds_channel_mode == 2;
+
++ /* single channel LVDS is limited to 112 MHz */
++ if (lvds_encoder->attached_connector->base.panel.fixed_mode->clock
++ > 112999)
++ return true;
++
+ if (dmi_check_system(intel_dual_link_lvds))
+ return true;
+
+@@ -1104,6 +1125,8 @@ void intel_lvds_init(struct drm_device *dev)
+ out:
+ mutex_unlock(&dev->mode_config.mutex);
+
++ intel_panel_init(&intel_connector->panel, fixed_mode, downclock_mode);
++
+ lvds_encoder->is_dual_link = compute_is_dual_link_lvds(lvds_encoder);
+ DRM_DEBUG_KMS("detected %s-link lvds configuration\n",
+ lvds_encoder->is_dual_link ? "dual" : "single");
+@@ -1118,7 +1141,6 @@ out:
+ }
+ drm_connector_register(connector);
+
+- intel_panel_init(&intel_connector->panel, fixed_mode, downclock_mode);
+ intel_panel_setup_backlight(connector, INVALID_PIPE);
+
+ return;
+diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
+index c0ecd128b14b..7348f222684d 100644
+--- a/drivers/gpu/drm/radeon/radeon_asic.c
++++ b/drivers/gpu/drm/radeon/radeon_asic.c
+@@ -1180,7 +1180,7 @@ static struct radeon_asic rs780_asic = {
+ static struct radeon_asic_ring rv770_uvd_ring = {
+ .ib_execute = &uvd_v1_0_ib_execute,
+ .emit_fence = &uvd_v2_2_fence_emit,
+- .emit_semaphore = &uvd_v1_0_semaphore_emit,
++ .emit_semaphore = &uvd_v2_2_semaphore_emit,
+ .cs_parse = &radeon_uvd_cs_parse,
+ .ring_test = &uvd_v1_0_ring_test,
+ .ib_test = &uvd_v1_0_ib_test,
+diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
+index 72bdd3bf0d8e..c2fd3a5e6c55 100644
+--- a/drivers/gpu/drm/radeon/radeon_asic.h
++++ b/drivers/gpu/drm/radeon/radeon_asic.h
+@@ -919,6 +919,10 @@ void uvd_v1_0_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib);
+ int uvd_v2_2_resume(struct radeon_device *rdev);
+ void uvd_v2_2_fence_emit(struct radeon_device *rdev,
+ struct radeon_fence *fence);
++bool uvd_v2_2_semaphore_emit(struct radeon_device *rdev,
++ struct radeon_ring *ring,
++ struct radeon_semaphore *semaphore,
++ bool emit_wait);
+
+ /* uvd v3.1 */
+ bool uvd_v3_1_semaphore_emit(struct radeon_device *rdev,
+diff --git a/drivers/gpu/drm/radeon/radeon_audio.c b/drivers/gpu/drm/radeon/radeon_audio.c
+index b7d33a13db9f..b7c6bb69f3c7 100644
+--- a/drivers/gpu/drm/radeon/radeon_audio.c
++++ b/drivers/gpu/drm/radeon/radeon_audio.c
+@@ -464,6 +464,10 @@ void radeon_audio_detect(struct drm_connector *connector,
+ return;
+
+ rdev = connector->encoder->dev->dev_private;
++
++ if (!radeon_audio_chipset_supported(rdev))
++ return;
++
+ radeon_encoder = to_radeon_encoder(connector->encoder);
+ dig = radeon_encoder->enc_priv;
+
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index b292aca0f342..edafd3c2b170 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -591,8 +591,7 @@ static void radeon_ttm_tt_unpin_userptr(struct ttm_tt *ttm)
+ {
+ struct radeon_device *rdev = radeon_get_rdev(ttm->bdev);
+ struct radeon_ttm_tt *gtt = (void *)ttm;
+- struct scatterlist *sg;
+- int i;
++ struct sg_page_iter sg_iter;
+
+ int write = !(gtt->userflags & RADEON_GEM_USERPTR_READONLY);
+ enum dma_data_direction direction = write ?
+@@ -605,9 +604,8 @@ static void radeon_ttm_tt_unpin_userptr(struct ttm_tt *ttm)
+ /* free the sg table and pages again */
+ dma_unmap_sg(rdev->dev, ttm->sg->sgl, ttm->sg->nents, direction);
+
+- for_each_sg(ttm->sg->sgl, sg, ttm->sg->nents, i) {
+- struct page *page = sg_page(sg);
+-
++ for_each_sg_page(ttm->sg->sgl, &sg_iter, ttm->sg->nents, 0) {
++ struct page *page = sg_page_iter_page(&sg_iter);
+ if (!(gtt->userflags & RADEON_GEM_USERPTR_READONLY))
+ set_page_dirty(page);
+
+diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
+index c10b2aec6450..cd630287cf0a 100644
+--- a/drivers/gpu/drm/radeon/radeon_uvd.c
++++ b/drivers/gpu/drm/radeon/radeon_uvd.c
+@@ -396,6 +396,29 @@ static int radeon_uvd_cs_msg_decode(uint32_t *msg, unsigned buf_sizes[])
+ return 0;
+ }
+
++static int radeon_uvd_validate_codec(struct radeon_cs_parser *p,
++ unsigned stream_type)
++{
++ switch (stream_type) {
++ case 0: /* H264 */
++ case 1: /* VC1 */
++ /* always supported */
++ return 0;
++
++ case 3: /* MPEG2 */
++ case 4: /* MPEG4 */
++ /* only since UVD 3 */
++ if (p->rdev->family >= CHIP_PALM)
++ return 0;
++
++ /* fall through */
++ default:
++ DRM_ERROR("UVD codec not supported by hardware %d!\n",
++ stream_type);
++ return -EINVAL;
++ }
++}
++
+ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
+ unsigned offset, unsigned buf_sizes[])
+ {
+@@ -436,50 +459,70 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
+ return -EINVAL;
+ }
+
+- if (msg_type == 1) {
+- /* it's a decode msg, calc buffer sizes */
+- r = radeon_uvd_cs_msg_decode(msg, buf_sizes);
+- /* calc image size (width * height) */
+- img_size = msg[6] * msg[7];
++ switch (msg_type) {
++ case 0:
++ /* it's a create msg, calc image size (width * height) */
++ img_size = msg[7] * msg[8];
++
++ r = radeon_uvd_validate_codec(p, msg[4]);
++ radeon_bo_kunmap(bo);
++ if (r)
++ return r;
++
++ /* try to alloc a new handle */
++ for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
++ if (atomic_read(&p->rdev->uvd.handles[i]) == handle) {
++ DRM_ERROR("Handle 0x%x already in use!\n", handle);
++ return -EINVAL;
++ }
++
++ if (!atomic_cmpxchg(&p->rdev->uvd.handles[i], 0, handle)) {
++ p->rdev->uvd.filp[i] = p->filp;
++ p->rdev->uvd.img_size[i] = img_size;
++ return 0;
++ }
++ }
++
++ DRM_ERROR("No more free UVD handles!\n");
++ return -EINVAL;
++
++ case 1:
++ /* it's a decode msg, validate codec and calc buffer sizes */
++ r = radeon_uvd_validate_codec(p, msg[4]);
++ if (!r)
++ r = radeon_uvd_cs_msg_decode(msg, buf_sizes);
+ radeon_bo_kunmap(bo);
+ if (r)
+ return r;
+
+- } else if (msg_type == 2) {
++ /* validate the handle */
++ for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
++ if (atomic_read(&p->rdev->uvd.handles[i]) == handle) {
++ if (p->rdev->uvd.filp[i] != p->filp) {
++ DRM_ERROR("UVD handle collision detected!\n");
++ return -EINVAL;
++ }
++ return 0;
++ }
++ }
++
++ DRM_ERROR("Invalid UVD handle 0x%x!\n", handle);
++ return -ENOENT;
++
++ case 2:
+ /* it's a destroy msg, free the handle */
+ for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i)
+ atomic_cmpxchg(&p->rdev->uvd.handles[i], handle, 0);
+ radeon_bo_kunmap(bo);
+ return 0;
+- } else {
+- /* it's a create msg, calc image size (width * height) */
+- img_size = msg[7] * msg[8];
+- radeon_bo_kunmap(bo);
+
+- if (msg_type != 0) {
+- DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type);
+- return -EINVAL;
+- }
+-
+- /* it's a create msg, no special handling needed */
+- }
+-
+- /* create or decode, validate the handle */
+- for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
+- if (atomic_read(&p->rdev->uvd.handles[i]) == handle)
+- return 0;
+- }
++ default:
+
+- /* handle not found try to alloc a new one */
+- for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
+- if (!atomic_cmpxchg(&p->rdev->uvd.handles[i], 0, handle)) {
+- p->rdev->uvd.filp[i] = p->filp;
+- p->rdev->uvd.img_size[i] = img_size;
+- return 0;
+- }
++ DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type);
++ return -EINVAL;
+ }
+
+- DRM_ERROR("No more free UVD handles!\n");
++ BUG();
+ return -EINVAL;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c
+index 976fe432f4e2..7ed561225007 100644
+--- a/drivers/gpu/drm/radeon/radeon_vce.c
++++ b/drivers/gpu/drm/radeon/radeon_vce.c
+@@ -493,18 +493,27 @@ int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi,
+ *
+ * @p: parser context
+ * @handle: handle to validate
++ * @allocated: allocated a new handle?
+ *
+ * Validates the handle and return the found session index or -EINVAL
+ * we we don't have another free session index.
+ */
+-int radeon_vce_validate_handle(struct radeon_cs_parser *p, uint32_t handle)
++static int radeon_vce_validate_handle(struct radeon_cs_parser *p,
++ uint32_t handle, bool *allocated)
+ {
+ unsigned i;
+
++ *allocated = false;
++
+ /* validate the handle */
+ for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i) {
+- if (atomic_read(&p->rdev->vce.handles[i]) == handle)
++ if (atomic_read(&p->rdev->vce.handles[i]) == handle) {
++ if (p->rdev->vce.filp[i] != p->filp) {
++ DRM_ERROR("VCE handle collision detected!\n");
++ return -EINVAL;
++ }
+ return i;
++ }
+ }
+
+ /* handle not found try to alloc a new one */
+@@ -512,6 +521,7 @@ int radeon_vce_validate_handle(struct radeon_cs_parser *p, uint32_t handle)
+ if (!atomic_cmpxchg(&p->rdev->vce.handles[i], 0, handle)) {
+ p->rdev->vce.filp[i] = p->filp;
+ p->rdev->vce.img_size[i] = 0;
++ *allocated = true;
+ return i;
+ }
+ }
+@@ -529,10 +539,10 @@ int radeon_vce_validate_handle(struct radeon_cs_parser *p, uint32_t handle)
+ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
+ {
+ int session_idx = -1;
+- bool destroyed = false;
++ bool destroyed = false, created = false, allocated = false;
+ uint32_t tmp, handle = 0;
+ uint32_t *size = &tmp;
+- int i, r;
++ int i, r = 0;
+
+ while (p->idx < p->chunk_ib->length_dw) {
+ uint32_t len = radeon_get_ib_value(p, p->idx);
+@@ -540,18 +550,21 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
+
+ if ((len < 8) || (len & 3)) {
+ DRM_ERROR("invalid VCE command length (%d)!\n", len);
+- return -EINVAL;
++ r = -EINVAL;
++ goto out;
+ }
+
+ if (destroyed) {
+ DRM_ERROR("No other command allowed after destroy!\n");
+- return -EINVAL;
++ r = -EINVAL;
++ goto out;
+ }
+
+ switch (cmd) {
+ case 0x00000001: // session
+ handle = radeon_get_ib_value(p, p->idx + 2);
+- session_idx = radeon_vce_validate_handle(p, handle);
++ session_idx = radeon_vce_validate_handle(p, handle,
++ &allocated);
+ if (session_idx < 0)
+ return session_idx;
+ size = &p->rdev->vce.img_size[session_idx];
+@@ -561,6 +574,13 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
+ break;
+
+ case 0x01000001: // create
++ created = true;
++ if (!allocated) {
++ DRM_ERROR("Handle already in use!\n");
++ r = -EINVAL;
++ goto out;
++ }
++
+ *size = radeon_get_ib_value(p, p->idx + 8) *
+ radeon_get_ib_value(p, p->idx + 10) *
+ 8 * 3 / 2;
+@@ -577,12 +597,12 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
+ r = radeon_vce_cs_reloc(p, p->idx + 10, p->idx + 9,
+ *size);
+ if (r)
+- return r;
++ goto out;
+
+ r = radeon_vce_cs_reloc(p, p->idx + 12, p->idx + 11,
+ *size / 3);
+ if (r)
+- return r;
++ goto out;
+ break;
+
+ case 0x02000001: // destroy
+@@ -593,7 +613,7 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
+ r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2,
+ *size * 2);
+ if (r)
+- return r;
++ goto out;
+ break;
+
+ case 0x05000004: // video bitstream buffer
+@@ -601,36 +621,47 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
+ r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2,
+ tmp);
+ if (r)
+- return r;
++ goto out;
+ break;
+
+ case 0x05000005: // feedback buffer
+ r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2,
+ 4096);
+ if (r)
+- return r;
++ goto out;
+ break;
+
+ default:
+ DRM_ERROR("invalid VCE command (0x%x)!\n", cmd);
+- return -EINVAL;
++ r = -EINVAL;
++ goto out;
+ }
+
+ if (session_idx == -1) {
+ DRM_ERROR("no session command at start of IB\n");
+- return -EINVAL;
++ r = -EINVAL;
++ goto out;
+ }
+
+ p->idx += len / 4;
+ }
+
+- if (destroyed) {
+- /* IB contains a destroy msg, free the handle */
++ if (allocated && !created) {
++ DRM_ERROR("New session without create command!\n");
++ r = -ENOENT;
++ }
++
++out:
++ if ((!r && destroyed) || (r && allocated)) {
++ /*
++ * IB contains a destroy msg or we have allocated an
++ * handle and got an error, anyway free the handle
++ */
+ for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i)
+ atomic_cmpxchg(&p->rdev->vce.handles[i], handle, 0);
+ }
+
+- return 0;
++ return r;
+ }
+
+ /**
+diff --git a/drivers/gpu/drm/radeon/rv770d.h b/drivers/gpu/drm/radeon/rv770d.h
+index 3cf1e2921545..9ef2064b1c9c 100644
+--- a/drivers/gpu/drm/radeon/rv770d.h
++++ b/drivers/gpu/drm/radeon/rv770d.h
+@@ -989,6 +989,9 @@
+ ((n) & 0x3FFF) << 16)
+
+ /* UVD */
++#define UVD_SEMA_ADDR_LOW 0xef00
++#define UVD_SEMA_ADDR_HIGH 0xef04
++#define UVD_SEMA_CMD 0xef08
+ #define UVD_GPCOM_VCPU_CMD 0xef0c
+ #define UVD_GPCOM_VCPU_DATA0 0xef10
+ #define UVD_GPCOM_VCPU_DATA1 0xef14
+diff --git a/drivers/gpu/drm/radeon/uvd_v1_0.c b/drivers/gpu/drm/radeon/uvd_v1_0.c
+index e72b3cb59358..c6b1cbca47fc 100644
+--- a/drivers/gpu/drm/radeon/uvd_v1_0.c
++++ b/drivers/gpu/drm/radeon/uvd_v1_0.c
+@@ -466,18 +466,8 @@ bool uvd_v1_0_semaphore_emit(struct radeon_device *rdev,
+ struct radeon_semaphore *semaphore,
+ bool emit_wait)
+ {
+- uint64_t addr = semaphore->gpu_addr;
+-
+- radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_LOW, 0));
+- radeon_ring_write(ring, (addr >> 3) & 0x000FFFFF);
+-
+- radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_HIGH, 0));
+- radeon_ring_write(ring, (addr >> 23) & 0x000FFFFF);
+-
+- radeon_ring_write(ring, PACKET0(UVD_SEMA_CMD, 0));
+- radeon_ring_write(ring, emit_wait ? 1 : 0);
+-
+- return true;
++ /* disable semaphores for UVD V1 hardware */
++ return false;
+ }
+
+ /**
+diff --git a/drivers/gpu/drm/radeon/uvd_v2_2.c b/drivers/gpu/drm/radeon/uvd_v2_2.c
+index 89193519f8a1..7ed778cec7c6 100644
+--- a/drivers/gpu/drm/radeon/uvd_v2_2.c
++++ b/drivers/gpu/drm/radeon/uvd_v2_2.c
+@@ -60,6 +60,35 @@ void uvd_v2_2_fence_emit(struct radeon_device *rdev,
+ }
+
+ /**
++ * uvd_v2_2_semaphore_emit - emit semaphore command
++ *
++ * @rdev: radeon_device pointer
++ * @ring: radeon_ring pointer
++ * @semaphore: semaphore to emit commands for
++ * @emit_wait: true if we should emit a wait command
++ *
++ * Emit a semaphore command (either wait or signal) to the UVD ring.
++ */
++bool uvd_v2_2_semaphore_emit(struct radeon_device *rdev,
++ struct radeon_ring *ring,
++ struct radeon_semaphore *semaphore,
++ bool emit_wait)
++{
++ uint64_t addr = semaphore->gpu_addr;
++
++ radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_LOW, 0));
++ radeon_ring_write(ring, (addr >> 3) & 0x000FFFFF);
++
++ radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_HIGH, 0));
++ radeon_ring_write(ring, (addr >> 23) & 0x000FFFFF);
++
++ radeon_ring_write(ring, PACKET0(UVD_SEMA_CMD, 0));
++ radeon_ring_write(ring, emit_wait ? 1 : 0);
++
++ return true;
++}
++
++/**
+ * uvd_v2_2_resume - memory controller programming
+ *
+ * @rdev: radeon_device pointer
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index d570030d899c..06441a43c3aa 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -859,19 +859,27 @@ static void cma_save_ib_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id
+ memcpy(&ib->sib_addr, &path->dgid, 16);
+ }
+
++static __be16 ss_get_port(const struct sockaddr_storage *ss)
++{
++ if (ss->ss_family == AF_INET)
++ return ((struct sockaddr_in *)ss)->sin_port;
++ else if (ss->ss_family == AF_INET6)
++ return ((struct sockaddr_in6 *)ss)->sin6_port;
++ BUG();
++}
++
+ static void cma_save_ip4_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id,
+ struct cma_hdr *hdr)
+ {
+- struct sockaddr_in *listen4, *ip4;
++ struct sockaddr_in *ip4;
+
+- listen4 = (struct sockaddr_in *) &listen_id->route.addr.src_addr;
+ ip4 = (struct sockaddr_in *) &id->route.addr.src_addr;
+- ip4->sin_family = listen4->sin_family;
++ ip4->sin_family = AF_INET;
+ ip4->sin_addr.s_addr = hdr->dst_addr.ip4.addr;
+- ip4->sin_port = listen4->sin_port;
++ ip4->sin_port = ss_get_port(&listen_id->route.addr.src_addr);
+
+ ip4 = (struct sockaddr_in *) &id->route.addr.dst_addr;
+- ip4->sin_family = listen4->sin_family;
++ ip4->sin_family = AF_INET;
+ ip4->sin_addr.s_addr = hdr->src_addr.ip4.addr;
+ ip4->sin_port = hdr->port;
+ }
+@@ -879,16 +887,15 @@ static void cma_save_ip4_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_i
+ static void cma_save_ip6_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id,
+ struct cma_hdr *hdr)
+ {
+- struct sockaddr_in6 *listen6, *ip6;
++ struct sockaddr_in6 *ip6;
+
+- listen6 = (struct sockaddr_in6 *) &listen_id->route.addr.src_addr;
+ ip6 = (struct sockaddr_in6 *) &id->route.addr.src_addr;
+- ip6->sin6_family = listen6->sin6_family;
++ ip6->sin6_family = AF_INET6;
+ ip6->sin6_addr = hdr->dst_addr.ip6;
+- ip6->sin6_port = listen6->sin6_port;
++ ip6->sin6_port = ss_get_port(&listen_id->route.addr.src_addr);
+
+ ip6 = (struct sockaddr_in6 *) &id->route.addr.dst_addr;
+- ip6->sin6_family = listen6->sin6_family;
++ ip6->sin6_family = AF_INET6;
+ ip6->sin6_addr = hdr->src_addr.ip6;
+ ip6->sin6_port = hdr->port;
+ }
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 414739295d04..713a96237a80 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -925,10 +925,11 @@ static int crypt_convert(struct crypt_config *cc,
+
+ switch (r) {
+ /* async */
+- case -EINPROGRESS:
+ case -EBUSY:
+ wait_for_completion(&ctx->restart);
+ reinit_completion(&ctx->restart);
++ /* fall through*/
++ case -EINPROGRESS:
+ ctx->req = NULL;
+ ctx->cc_sector++;
+ continue;
+@@ -1345,8 +1346,10 @@ static void kcryptd_async_done(struct crypto_async_request *async_req,
+ struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx);
+ struct crypt_config *cc = io->cc;
+
+- if (error == -EINPROGRESS)
++ if (error == -EINPROGRESS) {
++ complete(&ctx->restart);
+ return;
++ }
+
+ if (!error && cc->iv_gen_ops && cc->iv_gen_ops->post)
+ error = cc->iv_gen_ops->post(cc, iv_of_dmreq(cc, dmreq), dmreq);
+@@ -1357,15 +1360,12 @@ static void kcryptd_async_done(struct crypto_async_request *async_req,
+ crypt_free_req(cc, req_of_dmreq(cc, dmreq), io->base_bio);
+
+ if (!atomic_dec_and_test(&ctx->cc_pending))
+- goto done;
++ return;
+
+ if (bio_data_dir(io->base_bio) == READ)
+ kcryptd_crypt_read_done(io);
+ else
+ kcryptd_crypt_write_io_submit(io, 1);
+-done:
+- if (!completion_done(&ctx->restart))
+- complete(&ctx->restart);
+ }
+
+ static void kcryptd_crypt(struct work_struct *work)
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index e6178787ce3d..e47d1dd046da 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -4754,12 +4754,12 @@ static void md_free(struct kobject *ko)
+ if (mddev->sysfs_state)
+ sysfs_put(mddev->sysfs_state);
+
++ if (mddev->queue)
++ blk_cleanup_queue(mddev->queue);
+ if (mddev->gendisk) {
+ del_gendisk(mddev->gendisk);
+ put_disk(mddev->gendisk);
+ }
+- if (mddev->queue)
+- blk_cleanup_queue(mddev->queue);
+
+ kfree(mddev);
+ }
+diff --git a/drivers/media/platform/marvell-ccic/mcam-core.c b/drivers/media/platform/marvell-ccic/mcam-core.c
+index dd5b1415f974..f902eb4ee569 100644
+--- a/drivers/media/platform/marvell-ccic/mcam-core.c
++++ b/drivers/media/platform/marvell-ccic/mcam-core.c
+@@ -116,8 +116,8 @@ static struct mcam_format_struct {
+ .planar = false,
+ },
+ {
+- .desc = "UYVY 4:2:2",
+- .pixelformat = V4L2_PIX_FMT_UYVY,
++ .desc = "YVYU 4:2:2",
++ .pixelformat = V4L2_PIX_FMT_YVYU,
+ .mbus_code = MEDIA_BUS_FMT_YUYV8_2X8,
+ .bpp = 2,
+ .planar = false,
+@@ -748,7 +748,7 @@ static void mcam_ctlr_image(struct mcam_camera *cam)
+
+ switch (fmt->pixelformat) {
+ case V4L2_PIX_FMT_YUYV:
+- case V4L2_PIX_FMT_UYVY:
++ case V4L2_PIX_FMT_YVYU:
+ widthy = fmt->width * 2;
+ widthuv = 0;
+ break;
+@@ -784,15 +784,15 @@ static void mcam_ctlr_image(struct mcam_camera *cam)
+ case V4L2_PIX_FMT_YUV420:
+ case V4L2_PIX_FMT_YVU420:
+ mcam_reg_write_mask(cam, REG_CTRL0,
+- C0_DF_YUV | C0_YUV_420PL | C0_YUVE_YVYU, C0_DF_MASK);
++ C0_DF_YUV | C0_YUV_420PL | C0_YUVE_VYUY, C0_DF_MASK);
+ break;
+ case V4L2_PIX_FMT_YUYV:
+ mcam_reg_write_mask(cam, REG_CTRL0,
+- C0_DF_YUV | C0_YUV_PACKED | C0_YUVE_UYVY, C0_DF_MASK);
++ C0_DF_YUV | C0_YUV_PACKED | C0_YUVE_NOSWAP, C0_DF_MASK);
+ break;
+- case V4L2_PIX_FMT_UYVY:
++ case V4L2_PIX_FMT_YVYU:
+ mcam_reg_write_mask(cam, REG_CTRL0,
+- C0_DF_YUV | C0_YUV_PACKED | C0_YUVE_YUYV, C0_DF_MASK);
++ C0_DF_YUV | C0_YUV_PACKED | C0_YUVE_SWAP24, C0_DF_MASK);
+ break;
+ case V4L2_PIX_FMT_JPEG:
+ mcam_reg_write_mask(cam, REG_CTRL0,
+diff --git a/drivers/media/platform/marvell-ccic/mcam-core.h b/drivers/media/platform/marvell-ccic/mcam-core.h
+index aa0c6eac254a..7ffdf4dbaf8c 100644
+--- a/drivers/media/platform/marvell-ccic/mcam-core.h
++++ b/drivers/media/platform/marvell-ccic/mcam-core.h
+@@ -330,10 +330,10 @@ int mccic_resume(struct mcam_camera *cam);
+ #define C0_YUVE_YVYU 0x00010000 /* Y1CrY0Cb */
+ #define C0_YUVE_VYUY 0x00020000 /* CrY1CbY0 */
+ #define C0_YUVE_UYVY 0x00030000 /* CbY1CrY0 */
+-#define C0_YUVE_XYUV 0x00000000 /* 420: .YUV */
+-#define C0_YUVE_XYVU 0x00010000 /* 420: .YVU */
+-#define C0_YUVE_XUVY 0x00020000 /* 420: .UVY */
+-#define C0_YUVE_XVUY 0x00030000 /* 420: .VUY */
++#define C0_YUVE_NOSWAP 0x00000000 /* no bytes swapping */
++#define C0_YUVE_SWAP13 0x00010000 /* swap byte 1 and 3 */
++#define C0_YUVE_SWAP24 0x00020000 /* swap byte 2 and 4 */
++#define C0_YUVE_SWAP1324 0x00030000 /* swap bytes 1&3 and 2&4 */
+ /* Bayer bits 18,19 if needed */
+ #define C0_EOF_VSYNC 0x00400000 /* Generate EOF by VSYNC */
+ #define C0_VEDGE_CTRL 0x00800000 /* Detect falling edge of VSYNC */
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index c69afb5e264e..ed2e71a74a58 100644
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -1029,6 +1029,18 @@ static inline void mmc_blk_reset_success(struct mmc_blk_data *md, int type)
+ md->reset_done &= ~type;
+ }
+
++int mmc_access_rpmb(struct mmc_queue *mq)
++{
++ struct mmc_blk_data *md = mq->data;
++ /*
++ * If this is a RPMB partition access, return ture
++ */
++ if (md && md->part_type == EXT_CSD_PART_CONFIG_ACC_RPMB)
++ return true;
++
++ return false;
++}
++
+ static int mmc_blk_issue_discard_rq(struct mmc_queue *mq, struct request *req)
+ {
+ struct mmc_blk_data *md = mq->data;
+diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
+index 236d194c2883..8efa3684aef8 100644
+--- a/drivers/mmc/card/queue.c
++++ b/drivers/mmc/card/queue.c
+@@ -38,7 +38,7 @@ static int mmc_prep_request(struct request_queue *q, struct request *req)
+ return BLKPREP_KILL;
+ }
+
+- if (mq && mmc_card_removed(mq->card))
++ if (mq && (mmc_card_removed(mq->card) || mmc_access_rpmb(mq)))
+ return BLKPREP_KILL;
+
+ req->cmd_flags |= REQ_DONTPREP;
+diff --git a/drivers/mmc/card/queue.h b/drivers/mmc/card/queue.h
+index 5752d50049a3..99e6521e6169 100644
+--- a/drivers/mmc/card/queue.h
++++ b/drivers/mmc/card/queue.h
+@@ -73,4 +73,6 @@ extern void mmc_queue_bounce_post(struct mmc_queue_req *);
+ extern int mmc_packed_init(struct mmc_queue *, struct mmc_card *);
+ extern void mmc_packed_clean(struct mmc_queue *);
+
++extern int mmc_access_rpmb(struct mmc_queue *);
++
+ #endif
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 23f10f72e5f3..57a8d00672d3 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -2648,6 +2648,7 @@ int mmc_pm_notify(struct notifier_block *notify_block,
+ switch (mode) {
+ case PM_HIBERNATION_PREPARE:
+ case PM_SUSPEND_PREPARE:
++ case PM_RESTORE_PREPARE:
+ spin_lock_irqsave(&host->lock, flags);
+ host->rescan_disable = 1;
+ spin_unlock_irqrestore(&host->lock, flags);
+diff --git a/drivers/mmc/host/sh_mmcif.c b/drivers/mmc/host/sh_mmcif.c
+index 7d9d6a321521..5165ae75d540 100644
+--- a/drivers/mmc/host/sh_mmcif.c
++++ b/drivers/mmc/host/sh_mmcif.c
+@@ -1402,7 +1402,7 @@ static int sh_mmcif_probe(struct platform_device *pdev)
+ host = mmc_priv(mmc);
+ host->mmc = mmc;
+ host->addr = reg;
+- host->timeout = msecs_to_jiffies(1000);
++ host->timeout = msecs_to_jiffies(10000);
+ host->ccs_enable = !pd || !pd->ccs_unsupported;
+ host->clk_ctrl2_enable = pd && pd->clk_ctrl2_present;
+
+diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
+index 89dca77ca038..18ee2089df4a 100644
+--- a/drivers/pinctrl/core.c
++++ b/drivers/pinctrl/core.c
+@@ -1110,7 +1110,7 @@ void devm_pinctrl_put(struct pinctrl *p)
+ EXPORT_SYMBOL_GPL(devm_pinctrl_put);
+
+ int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps,
+- bool dup, bool locked)
++ bool dup)
+ {
+ int i, ret;
+ struct pinctrl_maps *maps_node;
+@@ -1178,11 +1178,9 @@ int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps,
+ maps_node->maps = maps;
+ }
+
+- if (!locked)
+- mutex_lock(&pinctrl_maps_mutex);
++ mutex_lock(&pinctrl_maps_mutex);
+ list_add_tail(&maps_node->node, &pinctrl_maps);
+- if (!locked)
+- mutex_unlock(&pinctrl_maps_mutex);
++ mutex_unlock(&pinctrl_maps_mutex);
+
+ return 0;
+ }
+@@ -1197,7 +1195,7 @@ int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps,
+ int pinctrl_register_mappings(struct pinctrl_map const *maps,
+ unsigned num_maps)
+ {
+- return pinctrl_register_map(maps, num_maps, true, false);
++ return pinctrl_register_map(maps, num_maps, true);
+ }
+
+ void pinctrl_unregister_map(struct pinctrl_map const *map)
+diff --git a/drivers/pinctrl/core.h b/drivers/pinctrl/core.h
+index 75476b3d87da..b24ea846c867 100644
+--- a/drivers/pinctrl/core.h
++++ b/drivers/pinctrl/core.h
+@@ -183,7 +183,7 @@ static inline struct pin_desc *pin_desc_get(struct pinctrl_dev *pctldev,
+ }
+
+ int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps,
+- bool dup, bool locked);
++ bool dup);
+ void pinctrl_unregister_map(struct pinctrl_map const *map);
+
+ extern int pinctrl_force_sleep(struct pinctrl_dev *pctldev);
+diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c
+index eda13de2e7c0..0bbf7d71b281 100644
+--- a/drivers/pinctrl/devicetree.c
++++ b/drivers/pinctrl/devicetree.c
+@@ -92,7 +92,7 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename,
+ dt_map->num_maps = num_maps;
+ list_add_tail(&dt_map->node, &p->dt_maps);
+
+- return pinctrl_register_map(map, num_maps, false, true);
++ return pinctrl_register_map(map, num_maps, false);
+ }
+
+ struct pinctrl_dev *of_pinctrl_get(struct device_node *np)
+diff --git a/drivers/rtc/rtc-armada38x.c b/drivers/rtc/rtc-armada38x.c
+index 43e04af39e09..cb70ced7e0db 100644
+--- a/drivers/rtc/rtc-armada38x.c
++++ b/drivers/rtc/rtc-armada38x.c
+@@ -40,6 +40,13 @@ struct armada38x_rtc {
+ void __iomem *regs;
+ void __iomem *regs_soc;
+ spinlock_t lock;
++ /*
++ * While setting the time, the RTC TIME register should not be
++ * accessed. Setting the RTC time involves sleeping during
++ * 100ms, so a mutex instead of a spinlock is used to protect
++ * it
++ */
++ struct mutex mutex_time;
+ int irq;
+ };
+
+@@ -59,8 +66,7 @@ static int armada38x_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ struct armada38x_rtc *rtc = dev_get_drvdata(dev);
+ unsigned long time, time_check, flags;
+
+- spin_lock_irqsave(&rtc->lock, flags);
+-
++ mutex_lock(&rtc->mutex_time);
+ time = readl(rtc->regs + RTC_TIME);
+ /*
+ * WA for failing time set attempts. As stated in HW ERRATA if
+@@ -71,7 +77,7 @@ static int armada38x_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ if ((time_check - time) > 1)
+ time_check = readl(rtc->regs + RTC_TIME);
+
+- spin_unlock_irqrestore(&rtc->lock, flags);
++ mutex_unlock(&rtc->mutex_time);
+
+ rtc_time_to_tm(time_check, tm);
+
+@@ -94,19 +100,12 @@ static int armada38x_rtc_set_time(struct device *dev, struct rtc_time *tm)
+ * then wait for 100ms before writing to the time register to be
+ * sure that the data will be taken into account.
+ */
+- spin_lock_irqsave(&rtc->lock, flags);
+-
++ mutex_lock(&rtc->mutex_time);
+ rtc_delayed_write(0, rtc, RTC_STATUS);
+-
+- spin_unlock_irqrestore(&rtc->lock, flags);
+-
+ msleep(100);
+-
+- spin_lock_irqsave(&rtc->lock, flags);
+-
+ rtc_delayed_write(time, rtc, RTC_TIME);
++ mutex_unlock(&rtc->mutex_time);
+
+- spin_unlock_irqrestore(&rtc->lock, flags);
+ out:
+ return ret;
+ }
+@@ -230,6 +229,7 @@ static __init int armada38x_rtc_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ spin_lock_init(&rtc->lock);
++ mutex_init(&rtc->mutex_time);
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "rtc");
+ rtc->regs = devm_ioremap_resource(&pdev->dev, res);
+diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
+index f1e57425e39f..5bab1c684bb1 100644
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -299,11 +299,27 @@ static int xen_initial_domain_console_init(void)
+ return 0;
+ }
+
++static void xen_console_update_evtchn(struct xencons_info *info)
++{
++ if (xen_hvm_domain()) {
++ uint64_t v;
++ int err;
++
++ err = hvm_get_parameter(HVM_PARAM_CONSOLE_EVTCHN, &v);
++ if (!err && v)
++ info->evtchn = v;
++ } else
++ info->evtchn = xen_start_info->console.domU.evtchn;
++}
++
+ void xen_console_resume(void)
+ {
+ struct xencons_info *info = vtermno_to_xencons(HVC_COOKIE);
+- if (info != NULL && info->irq)
++ if (info != NULL && info->irq) {
++ if (!xen_initial_domain())
++ xen_console_update_evtchn(info);
+ rebind_evtchn_irq(info->evtchn, info->irq);
++ }
+ }
+
+ static void xencons_disconnect_backend(struct xencons_info *info)
+diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
+index 4cde85501444..837d1778970b 100644
+--- a/drivers/vfio/vfio.c
++++ b/drivers/vfio/vfio.c
+@@ -711,6 +711,8 @@ void *vfio_del_group_dev(struct device *dev)
+ void *device_data = device->device_data;
+ struct vfio_unbound_dev *unbound;
+ unsigned int i = 0;
++ long ret;
++ bool interrupted = false;
+
+ /*
+ * The group exists so long as we have a device reference. Get
+@@ -756,9 +758,22 @@ void *vfio_del_group_dev(struct device *dev)
+
+ vfio_device_put(device);
+
+- } while (wait_event_interruptible_timeout(vfio.release_q,
+- !vfio_dev_present(group, dev),
+- HZ * 10) <= 0);
++ if (interrupted) {
++ ret = wait_event_timeout(vfio.release_q,
++ !vfio_dev_present(group, dev), HZ * 10);
++ } else {
++ ret = wait_event_interruptible_timeout(vfio.release_q,
++ !vfio_dev_present(group, dev), HZ * 10);
++ if (ret == -ERESTARTSYS) {
++ interrupted = true;
++ dev_warn(dev,
++ "Device is currently in use, task"
++ " \"%s\" (%d) "
++ "blocked until device is released",
++ current->comm, task_pid_nr(current));
++ }
++ }
++ } while (ret <= 0);
+
+ vfio_group_put(group);
+
+diff --git a/drivers/xen/events/events_2l.c b/drivers/xen/events/events_2l.c
+index 5db43fc100a4..7dd46312c180 100644
+--- a/drivers/xen/events/events_2l.c
++++ b/drivers/xen/events/events_2l.c
+@@ -345,6 +345,15 @@ irqreturn_t xen_debug_interrupt(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
++static void evtchn_2l_resume(void)
++{
++ int i;
++
++ for_each_online_cpu(i)
++ memset(per_cpu(cpu_evtchn_mask, i), 0, sizeof(xen_ulong_t) *
++ EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD);
++}
++
+ static const struct evtchn_ops evtchn_ops_2l = {
+ .max_channels = evtchn_2l_max_channels,
+ .nr_channels = evtchn_2l_max_channels,
+@@ -356,6 +365,7 @@ static const struct evtchn_ops evtchn_ops_2l = {
+ .mask = evtchn_2l_mask,
+ .unmask = evtchn_2l_unmask,
+ .handle_events = evtchn_2l_handle_events,
++ .resume = evtchn_2l_resume,
+ };
+
+ void __init xen_evtchn_2l_init(void)
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index 70fba973a107..2b8553bd8715 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -529,8 +529,8 @@ static unsigned int __startup_pirq(unsigned int irq)
+ if (rc)
+ goto err;
+
+- bind_evtchn_to_cpu(evtchn, 0);
+ info->evtchn = evtchn;
++ bind_evtchn_to_cpu(evtchn, 0);
+
+ rc = xen_evtchn_port_setup(info);
+ if (rc)
+@@ -1279,8 +1279,9 @@ void rebind_evtchn_irq(int evtchn, int irq)
+
+ mutex_unlock(&irq_mapping_update_lock);
+
+- /* new event channels are always bound to cpu 0 */
+- irq_set_affinity(irq, cpumask_of(0));
++ bind_evtchn_to_cpu(evtchn, info->cpu);
++ /* This will be deferred until interrupt is processed */
++ irq_set_affinity(irq, cpumask_of(info->cpu));
+
+ /* Unmask the event channel. */
+ enable_irq(irq);
+diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
+index 75fe3d466515..9c234209d8b5 100644
+--- a/drivers/xen/xen-pciback/conf_space.c
++++ b/drivers/xen/xen-pciback/conf_space.c
+@@ -16,8 +16,8 @@
+ #include "conf_space.h"
+ #include "conf_space_quirks.h"
+
+-bool permissive;
+-module_param(permissive, bool, 0644);
++bool xen_pcibk_permissive;
++module_param_named(permissive, xen_pcibk_permissive, bool, 0644);
+
+ /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
+ * xen_pcibk_write_config_word, and xen_pcibk_write_config_byte are created. */
+@@ -262,7 +262,7 @@ int xen_pcibk_config_write(struct pci_dev *dev, int offset, int size, u32 value)
+ * This means that some fields may still be read-only because
+ * they have entries in the config_field list that intercept
+ * the write and do nothing. */
+- if (dev_data->permissive || permissive) {
++ if (dev_data->permissive || xen_pcibk_permissive) {
+ switch (size) {
+ case 1:
+ err = pci_write_config_byte(dev, offset,
+diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
+index 2e1d73d1d5d0..62461a8ba1d6 100644
+--- a/drivers/xen/xen-pciback/conf_space.h
++++ b/drivers/xen/xen-pciback/conf_space.h
+@@ -64,7 +64,7 @@ struct config_field_entry {
+ void *data;
+ };
+
+-extern bool permissive;
++extern bool xen_pcibk_permissive;
+
+ #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
+
+diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
+index 2d7369391472..f8baf463dd35 100644
+--- a/drivers/xen/xen-pciback/conf_space_header.c
++++ b/drivers/xen/xen-pciback/conf_space_header.c
+@@ -105,7 +105,7 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
+
+ cmd->val = value;
+
+- if (!permissive && (!dev_data || !dev_data->permissive))
++ if (!xen_pcibk_permissive && (!dev_data || !dev_data->permissive))
+ return 0;
+
+ /* Only allow the guest to control certain bits. */
+diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
+index 564b31584860..5390a674b5e3 100644
+--- a/drivers/xen/xenbus/xenbus_probe.c
++++ b/drivers/xen/xenbus/xenbus_probe.c
+@@ -57,6 +57,7 @@
+ #include <xen/xen.h>
+ #include <xen/xenbus.h>
+ #include <xen/events.h>
++#include <xen/xen-ops.h>
+ #include <xen/page.h>
+
+ #include <xen/hvm.h>
+@@ -735,6 +736,30 @@ static int __init xenstored_local_init(void)
+ return err;
+ }
+
++static int xenbus_resume_cb(struct notifier_block *nb,
++ unsigned long action, void *data)
++{
++ int err = 0;
++
++ if (xen_hvm_domain()) {
++ uint64_t v;
++
++ err = hvm_get_parameter(HVM_PARAM_STORE_EVTCHN, &v);
++ if (!err && v)
++ xen_store_evtchn = v;
++ else
++ pr_warn("Cannot update xenstore event channel: %d\n",
++ err);
++ } else
++ xen_store_evtchn = xen_start_info->store_evtchn;
++
++ return err;
++}
++
++static struct notifier_block xenbus_resume_nb = {
++ .notifier_call = xenbus_resume_cb,
++};
++
+ static int __init xenbus_init(void)
+ {
+ int err = 0;
+@@ -793,6 +818,10 @@ static int __init xenbus_init(void)
+ goto out_error;
+ }
+
++ if ((xen_store_domain_type != XS_LOCAL) &&
++ (xen_store_domain_type != XS_UNKNOWN))
++ xen_resume_notifier_register(&xenbus_resume_nb);
++
+ #ifdef CONFIG_XEN_COMPAT_XENFS
+ /*
+ * Create xenfs mountpoint in /proc for compatibility with
+diff --git a/fs/coredump.c b/fs/coredump.c
+index f319926ddf8c..bbbe139ab280 100644
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -657,7 +657,7 @@ void do_coredump(const siginfo_t *siginfo)
+ */
+ if (!uid_eq(inode->i_uid, current_fsuid()))
+ goto close_fail;
+- if (!cprm.file->f_op->write)
++ if (!(cprm.file->f_mode & FMODE_CAN_WRITE))
+ goto close_fail;
+ if (do_truncate(cprm.file->f_path.dentry, 0, 0, cprm.file))
+ goto close_fail;
+diff --git a/fs/namei.c b/fs/namei.c
+index caa38a24e1f7..50a8583e8156 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -3228,7 +3228,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
+
+ if (unlikely(file->f_flags & __O_TMPFILE)) {
+ error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened);
+- goto out;
++ goto out2;
+ }
+
+ error = path_init(dfd, pathname->name, flags, nd);
+@@ -3258,6 +3258,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
+ }
+ out:
+ path_cleanup(nd);
++out2:
+ if (!(opened & FILE_OPENED)) {
+ BUG_ON(!error);
+ put_filp(file);
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 4622ee32a5e2..38ed1e1bed41 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -3178,6 +3178,12 @@ bool fs_fully_visible(struct file_system_type *type)
+ if (mnt->mnt.mnt_sb->s_type != type)
+ continue;
+
++ /* This mount is not fully visible if it's root directory
++ * is not the root directory of the filesystem.
++ */
++ if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
++ continue;
++
+ /* This mount is not fully visible if there are any child mounts
+ * that cover anything except for empty directories.
+ */
+diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
+index ecdbae19a766..090d8ce25bd1 100644
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
+ nchildren = nilfs_btree_node_get_nchildren(node);
+
+ if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
+- level > NILFS_BTREE_LEVEL_MAX ||
++ level >= NILFS_BTREE_LEVEL_MAX ||
+ nchildren < 0 ||
+ nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
+ pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index a6944b25fd5b..fdf4b41d0609 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -757,6 +757,19 @@ lookup:
+ if (tmpres) {
+ spin_unlock(&dlm->spinlock);
+ spin_lock(&tmpres->spinlock);
++
++ /*
++ * Right after dlm spinlock was released, dlm_thread could have
++ * purged the lockres. Check if lockres got unhashed. If so
++ * start over.
++ */
++ if (hlist_unhashed(&tmpres->hash_node)) {
++ spin_unlock(&tmpres->spinlock);
++ dlm_lockres_put(tmpres);
++ tmpres = NULL;
++ goto lookup;
++ }
++
+ /* Wait on the thread that is mastering the resource */
+ if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) {
+ __dlm_wait_on_lockres(tmpres);
+diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
+index d56f5d722138..65aa4fa0ae4e 100644
+--- a/include/acpi/acpixf.h
++++ b/include/acpi/acpixf.h
+@@ -431,13 +431,13 @@ ACPI_EXTERNAL_RETURN_STATUS(acpi_status __init acpi_load_tables(void))
+ ACPI_EXTERNAL_RETURN_STATUS(acpi_status __init acpi_reallocate_root_table(void))
+
+ ACPI_EXTERNAL_RETURN_STATUS(acpi_status __init
+- acpi_find_root_pointer(acpi_size * rsdp_address))
+-
++ acpi_find_root_pointer(acpi_physical_address *
++ rsdp_address))
+ ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+- acpi_get_table_header(acpi_string signature,
+- u32 instance,
+- struct acpi_table_header
+- *out_table_header))
++ acpi_get_table_header(acpi_string signature,
++ u32 instance,
++ struct acpi_table_header
++ *out_table_header))
+ ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+ acpi_get_table(acpi_string signature, u32 instance,
+ struct acpi_table_header
+diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h
+index ff3fea3194c6..9abb763e4b86 100644
+--- a/include/linux/nilfs2_fs.h
++++ b/include/linux/nilfs2_fs.h
+@@ -460,7 +460,7 @@ struct nilfs_btree_node {
+ /* level */
+ #define NILFS_BTREE_LEVEL_DATA 0
+ #define NILFS_BTREE_LEVEL_NODE_MIN (NILFS_BTREE_LEVEL_DATA + 1)
+-#define NILFS_BTREE_LEVEL_MAX 14
++#define NILFS_BTREE_LEVEL_MAX 14 /* Max level (exclusive) */
+
+ /**
+ * struct nilfs_palloc_group_desc - block group descriptor
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index d487f8dc6d39..72a5224c8084 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1141,10 +1141,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
+ * The check (unnecessarily) ignores LRU pages being isolated and
+ * walked by the page reclaim code, however that's not a big loss.
+ */
+- if (!PageHuge(p) && !PageTransTail(p)) {
+- if (!PageLRU(p))
+- shake_page(p, 0);
+- if (!PageLRU(p)) {
++ if (!PageHuge(p)) {
++ if (!PageLRU(hpage))
++ shake_page(hpage, 0);
++ if (!PageLRU(hpage)) {
+ /*
+ * shake_page could have turned it free.
+ */
+@@ -1721,12 +1721,12 @@ int soft_offline_page(struct page *page, int flags)
+ } else if (ret == 0) { /* for free pages */
+ if (PageHuge(page)) {
+ set_page_hwpoison_huge_page(hpage);
+- dequeue_hwpoisoned_huge_page(hpage);
+- atomic_long_add(1 << compound_order(hpage),
++ if (!dequeue_hwpoisoned_huge_page(hpage))
++ atomic_long_add(1 << compound_order(hpage),
+ &num_poisoned_pages);
+ } else {
+- SetPageHWPoison(page);
+- atomic_long_inc(&num_poisoned_pages);
++ if (!TestSetPageHWPoison(page))
++ atomic_long_inc(&num_poisoned_pages);
+ }
+ }
+ unset_migratetype_isolate(page, MIGRATE_MOVABLE);
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 644bcb665773..ad05f2f7bb65 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -580,7 +580,7 @@ static long long pos_ratio_polynom(unsigned long setpoint,
+ long x;
+
+ x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
+- limit - setpoint + 1);
++ (limit - setpoint) | 1);
+ pos_ratio = x;
+ pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
+ pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
+@@ -807,7 +807,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ * scale global setpoint to bdi's:
+ * bdi_setpoint = setpoint * bdi_thresh / thresh
+ */
+- x = div_u64((u64)bdi_thresh << 16, thresh + 1);
++ x = div_u64((u64)bdi_thresh << 16, thresh | 1);
+ bdi_setpoint = setpoint * (u64)x >> 16;
+ /*
+ * Use span=(8*write_bw) in single bdi case as indicated by
+@@ -822,7 +822,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+
+ if (bdi_dirty < x_intercept - span / 4) {
+ pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty),
+- x_intercept - bdi_setpoint + 1);
++ (x_intercept - bdi_setpoint) | 1);
+ } else
+ pos_ratio /= 4;
+
+diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c
+index c0eea1dfe90f..f19da4b47c1d 100644
+--- a/sound/oss/sequencer.c
++++ b/sound/oss/sequencer.c
+@@ -681,13 +681,8 @@ static int seq_timing_event(unsigned char *event_rec)
+ break;
+
+ case TMR_ECHO:
+- if (seq_mode == SEQ_2)
+- seq_copy_to_input(event_rec, 8);
+- else
+- {
+- parm = (parm << 8 | SEQ_ECHO);
+- seq_copy_to_input((unsigned char *) &parm, 4);
+- }
++ parm = (parm << 8 | SEQ_ECHO);
++ seq_copy_to_input((unsigned char *) &parm, 4);
+ break;
+
+ default:;
+@@ -1324,7 +1319,6 @@ int sequencer_ioctl(int dev, struct file *file, unsigned int cmd, void __user *a
+ int mode = translate_mode(file);
+ struct synth_info inf;
+ struct seq_event_rec event_rec;
+- unsigned long flags;
+ int __user *p = arg;
+
+ orig_dev = dev = dev >> 4;
+@@ -1479,9 +1473,7 @@ int sequencer_ioctl(int dev, struct file *file, unsigned int cmd, void __user *a
+ case SNDCTL_SEQ_OUTOFBAND:
+ if (copy_from_user(&event_rec, arg, sizeof(event_rec)))
+ return -EFAULT;
+- spin_lock_irqsave(&lock,flags);
+ play_event(event_rec.arr);
+- spin_unlock_irqrestore(&lock,flags);
+ return 0;
+
+ case SNDCTL_MIDI_INFO: