Index: linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt
===================================================================
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:17 @ Optional properties :
  - i2c-sda-hold-time-ns : should contain the SDA hold time in nanoseconds.
    This option is only supported in hardware blocks version 1.11a or newer.
 
- - i2c-scl-falling-time : should contain the SCL falling time in nanoseconds.
+ - i2c-scl-falling-time-ns : should contain the SCL falling time in nanoseconds.
    This value which is by default 300ns is used to compute the tLOW period.
 
- - i2c-sda-falling-time : should contain the SDA falling time in nanoseconds.
+ - i2c-sda-falling-time-ns : should contain the SDA falling time in nanoseconds.
    This value which is by default 300ns is used to compute the tHIGH period.
 
 Example :
Index: linux-3.18.13-rt10-r7s4/Documentation/kernel-parameters.txt
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/Documentation/kernel-parameters.txt
+++ linux-3.18.13-rt10-r7s4/Documentation/kernel-parameters.txt
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1273 @ bytes respectively. Such letter suffixes
 	i8042.notimeout	[HW] Ignore timeout condition signalled by controller
 	i8042.reset	[HW] Reset the controller during init and cleanup
 	i8042.unlock	[HW] Unlock (ignore) the keylock
+	i8042.kbdreset  [HW] Reset device connected to KBD port
 
 	i810=		[HW,DRM]
 
Index: linux-3.18.13-rt10-r7s4/Documentation/ramoops.txt
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/Documentation/ramoops.txt
+++ linux-3.18.13-rt10-r7s4/Documentation/ramoops.txt
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:17 @ survive after a restart.
 
 1. Ramoops concepts
 
-Ramoops uses a predefined memory area to store the dump. The start and size of
-the memory area are set using two variables:
+Ramoops uses a predefined memory area to store the dump. The start and size
+and type of the memory area are set using three variables:
   * "mem_address" for the start
   * "mem_size" for the size. The memory size will be rounded down to a
   power of two.
+  * "mem_type" to specifiy if the memory type (default is pgprot_writecombine).
+
+Typically the default value of mem_type=0 should be used as that sets the pstore
+mapping to pgprot_writecombine. Setting mem_type=1 attempts to use
+pgprot_noncached, which only works on some platforms. This is because pstore
+depends on atomic operations. At least on ARM, pgprot_noncached causes the
+memory to be mapped strongly ordered, and atomic operations on strongly ordered
+memory are implementation defined, and won't work on many ARMs such as omaps.
 
 The memory area is divided into "record_size" chunks (also rounded down to
 power of two) and each oops/panic writes a "record_size" chunk of
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:66 @ Setting the ramoops parameters can be do
 static struct ramoops_platform_data ramoops_data = {
         .mem_size               = <...>,
         .mem_address            = <...>,
+        .mem_type               = <...>,
         .record_size            = <...>,
         .dump_oops              = <...>,
         .ecc                    = <...>,
Index: linux-3.18.13-rt10-r7s4/Documentation/stable_kernel_rules.txt
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/Documentation/stable_kernel_rules.txt
+++ linux-3.18.13-rt10-r7s4/Documentation/stable_kernel_rules.txt
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:35 @ Procedure for submitting patches to the
  - If the patch covers files in net/ or drivers/net please follow netdev stable
    submission guidelines as described in
    Documentation/networking/netdev-FAQ.txt
- - Send the patch, after verifying that it follows the above rules, to
-   stable@vger.kernel.org.  You must note the upstream commit ID in the
-   changelog of your submission, as well as the kernel version you wish
-   it to be applied to.
- - To have the patch automatically included in the stable tree, add the tag
+ - Security patches should not be handled (solely) by the -stable review
+   process but should follow the procedures in Documentation/SecurityBugs.
+
+For all other submissions, choose one of the following procedures:
+
+   --- Option 1 ---
+
+   To have the patch automatically included in the stable tree, add the tag
      Cc: stable@vger.kernel.org
    in the sign-off area. Once the patch is merged it will be applied to
    the stable tree without anything else needing to be done by the author
    or subsystem maintainer.
- - If the patch requires other patches as prerequisites which can be
-   cherry-picked, then this can be specified in the following format in
-   the sign-off area:
+
+   --- Option 2 ---
+
+   After the patch has been merged to Linus' tree, send an email to
+   stable@vger.kernel.org containing the subject of the patch, the commit ID,
+   why you think it should be applied, and what kernel version you wish it to
+   be applied to.
+
+   --- Option 3 ---
+
+   Send the patch, after verifying that it follows the above rules, to
+   stable@vger.kernel.org.  You must note the upstream commit ID in the
+   changelog of your submission, as well as the kernel version you wish
+   it to be applied to.
+
+Option 1 is probably the easiest and most common. Options 2 and 3 are more
+useful if the patch isn't deemed worthy at the time it is applied to a public
+git tree (for instance, because it deserves more regression testing first).
+Option 3 is especially useful if the patch needs some special handling to apply
+to an older kernel (e.g., if API's have changed in the meantime).
+
+Additionally, some patches submitted via Option 1 may have additional patch
+prerequisites which can be cherry-picked. This can be specified in the following
+format in the sign-off area:
 
      Cc: <stable@vger.kernel.org> # 3.3.x: a1f84a3: sched: Check for idle
      Cc: <stable@vger.kernel.org> # 3.3.x: 1b9508f: sched: Rate-limit newidle
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:84 @ Procedure for submitting patches to the
      git cherry-pick fd21073
      git cherry-pick <this commit>
 
+Following the submission:
+
  - The sender will receive an ACK when the patch has been accepted into the
    queue, or a NAK if the patch is rejected.  This response might take a few
    days, according to the developer's schedules.
  - If accepted, the patch will be added to the -stable queue, for review by
    other developers and by the relevant subsystem maintainer.
- - Security patches should not be sent to this alias, but instead to the
-   documented security@kernel.org address.
 
 
 Review cycle:
Index: linux-3.18.13-rt10-r7s4/Makefile
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/Makefile
+++ linux-3.18.13-rt10-r7s4/Makefile
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4 @
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 0
-EXTRAVERSION = -linux4sam_4.7
+SUBLEVEL = 13
+EXTRAVERSION =
 NAME = Diseased Newt
 
 # *DOCUMENTATION*
Index: linux-3.18.13-rt10-r7s4/arch/alpha/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/alpha/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/alpha/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:159 @ retry:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/arc/boot/dts/nsimosci.dts
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arc/boot/dts/nsimosci.dts
+++ linux-3.18.13-rt10-r7s4/arch/arc/boot/dts/nsimosci.dts
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:23 @
 		/* this is for console on PGU */
 		/* bootargs = "console=tty0 consoleblank=0"; */
 		/* this is for console on serial */
-		bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug";
+		bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug";
 	};
 
 	aliases {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:44 @
 			#interrupt-cells = <1>;
 		};
 
-		uart0: serial@c0000000 {
+		uart0: serial@f0000000 {
 			compatible = "ns8250";
-			reg = <0xc0000000 0x2000>;
+			reg = <0xf0000000 0x2000>;
 			interrupts = <11>;
 			clock-frequency = <3686400>;
 			baud = <115200>;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:55 @
 			no-loopback-test = <1>;
 		};
 
-		pgu0: pgu@c9000000 {
+		pgu0: pgu@f9000000 {
 			compatible = "snps,arcpgufb";
-			reg = <0xc9000000 0x400>;
+			reg = <0xf9000000 0x400>;
 		};
 
-		ps2: ps2@c9001000 {
+		ps2: ps2@f9001000 {
 			compatible = "snps,arc_ps2";
-			reg = <0xc9000400 0x14>;
+			reg = <0xf9000400 0x14>;
 			interrupts = <13>;
 			interrupt-names = "arc_ps2_irq";
 		};
 
-		eth0: ethernet@c0003000 {
+		eth0: ethernet@f0003000 {
 			compatible = "snps,oscilan";
-			reg = <0xc0003000 0x44>;
+			reg = <0xf0003000 0x44>;
 			interrupts = <7>, <8>;
 			interrupt-names = "rx", "tx";
 		};
Index: linux-3.18.13-rt10-r7s4/arch/arc/include/asm/pgtable.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arc/include/asm/pgtable.h
+++ linux-3.18.13-rt10-r7s4/arch/arc/include/asm/pgtable.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:262 @ static inline void pmd_set(pmd_t *pmdp,
 #define pmd_clear(xp)			do { pmd_val(*(xp)) = 0; } while (0)
 
 #define pte_page(x) (mem_map + \
-		(unsigned long)(((pte_val(x) - PAGE_OFFSET) >> PAGE_SHIFT)))
+		(unsigned long)(((pte_val(x) - CONFIG_LINUX_LINK_BASE) >> \
+				PAGE_SHIFT)))
 
 #define mk_pte(page, pgprot)						\
 ({									\
Index: linux-3.18.13-rt10-r7s4/arch/arc/include/asm/processor.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arc/include/asm/processor.h
+++ linux-3.18.13-rt10-r7s4/arch/arc/include/asm/processor.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:78 @ unsigned long thread_saved_pc(struct tas
 #define release_segments(mm)        do { } while (0)
 
 #define KSTK_EIP(tsk)   (task_pt_regs(tsk)->ret)
+#define KSTK_ESP(tsk)   (task_pt_regs(tsk)->sp)
 
 /*
  * Where abouts of Task's sp, fp, blink when it was last seen in kernel mode.
  * Look in process.c for details of kernel stack layout
  */
-#define KSTK_ESP(tsk)   (tsk->thread.ksp)
+#define TSK_K_ESP(tsk)		(tsk->thread.ksp)
 
-#define KSTK_REG(tsk, off)	(*((unsigned int *)(KSTK_ESP(tsk) + \
+#define TSK_K_REG(tsk, off)	(*((unsigned int *)(TSK_K_ESP(tsk) + \
 					sizeof(struct callee_regs) + off)))
 
-#define KSTK_BLINK(tsk) KSTK_REG(tsk, 4)
-#define KSTK_FP(tsk)    KSTK_REG(tsk, 0)
+#define TSK_K_BLINK(tsk)	TSK_K_REG(tsk, 4)
+#define TSK_K_FP(tsk)		TSK_K_REG(tsk, 0)
 
 extern void start_thread(struct pt_regs * regs, unsigned long pc,
 			 unsigned long usp);
Index: linux-3.18.13-rt10-r7s4/arch/arc/kernel/signal.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arc/kernel/signal.c
+++ linux-3.18.13-rt10-r7s4/arch/arc/kernel/signal.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:70 @ stash_usr_regs(struct rt_sigframe __user
 	       sigset_t *set)
 {
 	int err;
-	err = __copy_to_user(&(sf->uc.uc_mcontext.regs), regs,
+	err = __copy_to_user(&(sf->uc.uc_mcontext.regs.scratch), regs,
 			     sizeof(sf->uc.uc_mcontext.regs.scratch));
 	err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(sigset_t));
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:86 @ static int restore_usr_regs(struct pt_re
 	if (!err)
 		set_current_blocked(&set);
 
-	err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs),
+	err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs.scratch),
 				sizeof(sf->uc.uc_mcontext.regs.scratch));
 
 	return err;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:134 @ SYSCALL_DEFINE0(rt_sigreturn)
 	/* Don't restart from sigreturn */
 	syscall_wont_restart(regs);
 
+	/*
+	 * Ensure that sigreturn always returns to user mode (in case the
+	 * regs saved on user stack got fudged between save and sigreturn)
+	 * Otherwise it is easy to panic the kernel with a custom
+	 * signal handler and/or restorer which clobberes the status32/ret
+	 * to return to a bogus location in kernel mode.
+	 */
+	regs->status32 |= STATUS_U_MASK;
+
 	return regs->r0;
 
 badframe:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:241 @ setup_rt_frame(struct ksignal *ksig, sig
 
 	/*
 	 * handler returns using sigreturn stub provided already by userpsace
+	 * If not, nuke the process right away
 	 */
-	BUG_ON(!(ksig->ka.sa.sa_flags & SA_RESTORER));
+	if(!(ksig->ka.sa.sa_flags & SA_RESTORER))
+		return 1;
+
 	regs->blink = (unsigned long)ksig->ka.sa.sa_restorer;
 
 	/* User Stack for signal handler will be above the frame just carved */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:311 @ static void
 handle_signal(struct ksignal *ksig, struct pt_regs *regs)
 {
 	sigset_t *oldset = sigmask_to_save();
-	int ret;
+	int failed;
 
 	/* Set up the stack frame */
-	ret = setup_rt_frame(ksig, oldset, regs);
+	failed = setup_rt_frame(ksig, oldset, regs);
 
-	signal_setup_done(ret, ksig, 0);
+	signal_setup_done(failed, ksig, 0);
 }
 
 void do_signal(struct pt_regs *regs)
Index: linux-3.18.13-rt10-r7s4/arch/arc/kernel/stacktrace.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arc/kernel/stacktrace.c
+++ linux-3.18.13-rt10-r7s4/arch/arc/kernel/stacktrace.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:67 @ static void seed_unwind_frame_info(struc
 
 		frame_info->task = tsk;
 
-		frame_info->regs.r27 = KSTK_FP(tsk);
-		frame_info->regs.r28 = KSTK_ESP(tsk);
-		frame_info->regs.r31 = KSTK_BLINK(tsk);
+		frame_info->regs.r27 = TSK_K_FP(tsk);
+		frame_info->regs.r28 = TSK_K_ESP(tsk);
+		frame_info->regs.r31 = TSK_K_BLINK(tsk);
 		frame_info->regs.r63 = (unsigned int)__switch_to;
 
 		/* In the prologue of __switch_to, first FP is saved on stack
Index: linux-3.18.13-rt10-r7s4/arch/arc/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arc/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/arc/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:164 @ good_area:
 
 	if (fault & VM_FAULT_OOM)
 		goto out_of_memory;
+	else if (fault & VM_FAULT_SIGSEGV)
+		goto bad_area;
 	else if (fault & VM_FAULT_SIGBUS)
 		goto do_sigbus;
 
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/am335x-bone-common.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/am335x-bone-common.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/am335x-bone-common.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:198 @
 
 &usb0 {
 	status = "okay";
+	dr_mode = "peripheral";
 };
 
 &usb1 {
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/am33xx-clocks.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/am33xx-clocks.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/am33xx-clocks.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:102 @
 	ehrpwm0_tbclk: ehrpwm0_tbclk@44e10664 {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <0>;
 		reg = <0x0664>;
 	};
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:110 @
 	ehrpwm1_tbclk: ehrpwm1_tbclk@44e10664 {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <1>;
 		reg = <0x0664>;
 	};
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:118 @
 	ehrpwm2_tbclk: ehrpwm2_tbclk@44e10664 {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <2>;
 		reg = <0x0664>;
 	};
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/am437x-sk-evm.dts
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/am437x-sk-evm.dts
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/am437x-sk-evm.dts
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:103 @
 	};
 
 	lcd0: display {
-		compatible = "osddisplays,osd057T0559-34ts", "panel-dpi";
+		compatible = "newhaven,nhd-4.3-480272ef-atxl", "panel-dpi";
 		label = "lcd";
 
 		pinctrl-names = "default";
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:115 @
 			clock-frequency = <9000000>;
 			hactive = <480>;
 			vactive = <272>;
-			hfront-porch = <8>;
-			hback-porch = <43>;
-			hsync-len = <4>;
-			vback-porch = <12>;
-			vfront-porch = <4>;
+			hfront-porch = <2>;
+			hback-porch = <2>;
+			hsync-len = <41>;
+			vfront-porch = <2>;
+			vback-porch = <2>;
 			vsync-len = <10>;
 			hsync-active = <0>;
 			vsync-active = <0>;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:323 @
 
 	lcd_pins: lcd_pins {
 		pinctrl-single,pins = <
-			/* GPIO 5_8 to select LCD / HDMI */
-			0x238 (PIN_OUTPUT_PULLUP | MUX_MODE7)
+			0x1c (PIN_OUTPUT_PULLDOWN | MUX_MODE7) /* gpcm_ad7.gpio1_7 */
 		>;
 	};
 };
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/am43xx-clocks.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/am43xx-clocks.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/am43xx-clocks.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:110 @
 	ehrpwm0_tbclk: ehrpwm0_tbclk {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <0>;
 		reg = <0x0664>;
 	};
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:118 @
 	ehrpwm1_tbclk: ehrpwm1_tbclk {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <1>;
 		reg = <0x0664>;
 	};
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:126 @
 	ehrpwm2_tbclk: ehrpwm2_tbclk {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <2>;
 		reg = <0x0664>;
 	};
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:134 @
 	ehrpwm3_tbclk: ehrpwm3_tbclk {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <4>;
 		reg = <0x0664>;
 	};
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:142 @
 	ehrpwm4_tbclk: ehrpwm4_tbclk {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <5>;
 		reg = <0x0664>;
 	};
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:150 @
 	ehrpwm5_tbclk: ehrpwm5_tbclk {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <6>;
 		reg = <0x0664>;
 	};
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/armada-370-db.dts
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/armada-370-db.dts
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/armada-370-db.dts
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:105 @
 				broken-cd;
 			};
 
-			pinctrl {
-				/*
-				 * These pins might be muxed as I2S by
-				 * the bootloader, but it conflicts
-				 * with the real I2S pins that are
-				 * muxed using i2s_pins. We must mux
-				 * those pins to a function other than
-				 * I2S.
-				 */
-				pinctrl-0 = <&hog_pins1 &hog_pins2>;
-				pinctrl-names = "default";
-
-				hog_pins1: hog-pins1 {
-					marvell,pins = "mpp6",  "mpp8", "mpp10",
-						       "mpp12", "mpp13";
-					marvell,function = "gpio";
-				};
-
-				hog_pins2: hog-pins2 {
-					marvell,pins = "mpp5", "mpp7", "mpp9";
-					marvell,function = "gpo";
-				};
-			};
-
 			usb@50000 {
 				status = "okay";
 			};
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/armada-370.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/armada-370.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/armada-370.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:109 @
 				reg = <0x11100 0x20>;
 			};
 
-			system-controller@18200 {
-				compatible = "marvell,armada-370-xp-system-controller";
-				reg = <0x18200 0x100>;
-			};
-
 			pinctrl {
 				compatible = "marvell,mv88f6710-pinctrl";
 				reg = <0x18000 0x38>;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:203 @
 				interrupts = <91>;
 			};
 
+			system-controller@18200 {
+				compatible = "marvell,armada-370-xp-system-controller";
+				reg = <0x18200 0x100>;
+			};
+
 			gateclk: clock-gating-control@18220 {
 				compatible = "marvell,armada-370-gating-clock";
 				reg = <0x18220 0x4>;
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/bcm63138.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/bcm63138.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/bcm63138.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:69 @
 			reg = <0x1d000 0x1000>;
 			cache-unified;
 			cache-level = <2>;
-			cache-sets = <16>;
-			cache-size = <0x80000>;
+			cache-size = <524288>;
+			cache-sets = <1024>;
+			cache-line-size = <32>;
 			interrupts = <GIC_PPI 0 IRQ_TYPE_LEVEL_HIGH>;
 		};
 
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/berlin2q-marvell-dmp.dts
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/berlin2q-marvell-dmp.dts
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/berlin2q-marvell-dmp.dts
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:33 @
 };
 
 &sdhci2 {
+	broken-cd;
+	bus-width = <8>;
 	non-removable;
 	status = "okay";
 };
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/berlin2q.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/berlin2q.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/berlin2q.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:86 @
 			compatible = "mrvl,pxav3-mmc";
 			reg = <0xab1000 0x200>;
 			interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&chip CLKID_SDIO1XIN>;
+			clocks = <&chip CLKID_NFC_ECC>, <&chip CLKID_NFC>;
+			clock-names = "io", "core";
 			status = "disabled";
 		};
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:318 @
 				interrupt-parent = <&gic>;
 				interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
 			};
-
-			gpio4: gpio@5000 {
-				compatible = "snps,dw-apb-gpio";
-				reg = <0x5000 0x400>;
-				#address-cells = <1>;
-				#size-cells = <0>;
-
-				porte: gpio-port@4 {
-					compatible = "snps,dw-apb-gpio-port";
-					gpio-controller;
-					#gpio-cells = <2>;
-					snps,nr-gpios = <32>;
-					reg = <0>;
-				};
-			};
-
-			gpio5: gpio@c000 {
-				compatible = "snps,dw-apb-gpio";
-				reg = <0xc000 0x400>;
-				#address-cells = <1>;
-				#size-cells = <0>;
-
-				portf: gpio-port@5 {
-					compatible = "snps,dw-apb-gpio-port";
-					gpio-controller;
-					#gpio-cells = <2>;
-					snps,nr-gpios = <32>;
-					reg = <0>;
-				};
-			};
 		};
 
 		chip: chip-control@ea0000 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:346 @
 			ranges = <0 0xfc0000 0x10000>;
 			interrupt-parent = <&sic>;
 
+			sm_gpio1: gpio@5000 {
+				compatible = "snps,dw-apb-gpio";
+				reg = <0x5000 0x400>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				portf: gpio-port@5 {
+					compatible = "snps,dw-apb-gpio-port";
+					gpio-controller;
+					#gpio-cells = <2>;
+					snps,nr-gpios = <32>;
+					reg = <0>;
+				};
+			};
+
 			i2c2: i2c@7000 {
 				compatible = "snps,designware-i2c";
 				#address-cells = <1>;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:411 @
 				status = "disabled";
 			};
 
+			sm_gpio0: gpio@c000 {
+				compatible = "snps,dw-apb-gpio";
+				reg = <0xc000 0x400>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				porte: gpio-port@4 {
+					compatible = "snps,dw-apb-gpio-port";
+					gpio-controller;
+					#gpio-cells = <2>;
+					snps,nr-gpios = <32>;
+					reg = <0>;
+				};
+			};
+
 			sysctrl: pin-controller@d000 {
 				compatible = "marvell,berlin2q-system-ctrl";
 				reg = <0xd000 0x100>;
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/dra7-evm.dts
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/dra7-evm.dts
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/dra7-evm.dts
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:402 @
 		};
 		partition@5 {
 			label = "QSPI.u-boot-spl-os";
-			reg = <0x00140000 0x00010000>;
+			reg = <0x00140000 0x00080000>;
 		};
 		partition@6 {
 			label = "QSPI.u-boot-env";
-			reg = <0x00150000 0x00010000>;
+			reg = <0x001c0000 0x00010000>;
 		};
 		partition@7 {
 			label = "QSPI.u-boot-env.backup1";
-			reg = <0x00160000 0x0010000>;
+			reg = <0x001d0000 0x0010000>;
 		};
 		partition@8 {
 			label = "QSPI.kernel";
-			reg = <0x00170000 0x0800000>;
+			reg = <0x001e0000 0x0800000>;
 		};
 		partition@9 {
 			label = "QSPI.file-system";
-			reg = <0x00970000 0x01690000>;
+			reg = <0x009e0000 0x01620000>;
 		};
 	};
 };
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/dra7.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/dra7.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/dra7.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:656 @
 		};
 
 		wdt2: wdt@4ae14000 {
-			compatible = "ti,omap4-wdt";
+			compatible = "ti,omap3-wdt";
 			reg = <0x4ae14000 0x80>;
 			interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>;
 			ti,hwmods = "wd_timer2";
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/dra7xx-clocks.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/dra7xx-clocks.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/dra7xx-clocks.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:246 @
 		ti,invert-autoidle-bit;
 	};
 
+	dpll_core_byp_mux: dpll_core_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		ti,bit-shift = <23>;
+		reg = <0x012c>;
+	};
+
 	dpll_core_ck: dpll_core_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-core-clock";
-		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		clocks = <&sys_clkin1>, <&dpll_core_byp_mux>;
 		reg = <0x0120>, <0x0124>, <0x012c>, <0x0128>;
 	};
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:320 @
 		clock-div = <1>;
 	};
 
+	dpll_dsp_byp_mux: dpll_dsp_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
+		ti,bit-shift = <23>;
+		reg = <0x0240>;
+	};
+
 	dpll_dsp_ck: dpll_dsp_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-clock";
-		clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
+		clocks = <&sys_clkin1>, <&dpll_dsp_byp_mux>;
 		reg = <0x0234>, <0x0238>, <0x0240>, <0x023c>;
 	};
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:354 @
 		clock-div = <1>;
 	};
 
+	dpll_iva_byp_mux: dpll_iva_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
+		ti,bit-shift = <23>;
+		reg = <0x01ac>;
+	};
+
 	dpll_iva_ck: dpll_iva_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-clock";
-		clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
+		clocks = <&sys_clkin1>, <&dpll_iva_byp_mux>;
 		reg = <0x01a0>, <0x01a4>, <0x01ac>, <0x01a8>;
 	};
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:388 @
 		clock-div = <1>;
 	};
 
+	dpll_gpu_byp_mux: dpll_gpu_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		ti,bit-shift = <23>;
+		reg = <0x02e4>;
+	};
+
 	dpll_gpu_ck: dpll_gpu_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-clock";
-		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		clocks = <&sys_clkin1>, <&dpll_gpu_byp_mux>;
 		reg = <0x02d8>, <0x02dc>, <0x02e4>, <0x02e0>;
 	};
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:433 @
 		clock-div = <1>;
 	};
 
+	dpll_ddr_byp_mux: dpll_ddr_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		ti,bit-shift = <23>;
+		reg = <0x021c>;
+	};
+
 	dpll_ddr_ck: dpll_ddr_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-clock";
-		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		clocks = <&sys_clkin1>, <&dpll_ddr_byp_mux>;
 		reg = <0x0210>, <0x0214>, <0x021c>, <0x0218>;
 	};
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:459 @
 		ti,invert-autoidle-bit;
 	};
 
+	dpll_gmac_byp_mux: dpll_gmac_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		ti,bit-shift = <23>;
+		reg = <0x02b4>;
+	};
+
 	dpll_gmac_ck: dpll_gmac_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-clock";
-		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		clocks = <&sys_clkin1>, <&dpll_gmac_byp_mux>;
 		reg = <0x02a8>, <0x02ac>, <0x02b4>, <0x02b0>;
 	};
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:533 @
 		clock-div = <1>;
 	};
 
+	dpll_eve_byp_mux: dpll_eve_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
+		ti,bit-shift = <23>;
+		reg = <0x0290>;
+	};
+
 	dpll_eve_ck: dpll_eve_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-clock";
-		clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
+		clocks = <&sys_clkin1>, <&dpll_eve_byp_mux>;
 		reg = <0x0284>, <0x0288>, <0x0290>, <0x028c>;
 	};
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1308 @
 		clock-div = <1>;
 	};
 
+	dpll_per_byp_mux: dpll_per_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
+		ti,bit-shift = <23>;
+		reg = <0x014c>;
+	};
+
 	dpll_per_ck: dpll_per_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-clock";
-		clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
+		clocks = <&sys_clkin1>, <&dpll_per_byp_mux>;
 		reg = <0x0140>, <0x0144>, <0x014c>, <0x0148>;
 	};
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1342 @
 		clock-div = <1>;
 	};
 
+	dpll_usb_byp_mux: dpll_usb_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
+		ti,bit-shift = <23>;
+		reg = <0x018c>;
+	};
+
 	dpll_usb_ck: dpll_usb_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-j-type-clock";
-		clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
+		clocks = <&sys_clkin1>, <&dpll_usb_byp_mux>;
 		reg = <0x0180>, <0x0184>, <0x018c>, <0x0188>;
 	};
 
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/exynos4.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/exynos4.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/exynos4.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:371 @
 	};
 
 	i2s1: i2s@13960000 {
-		compatible = "samsung,s5pv210-i2s";
+		compatible = "samsung,s3c6410-i2s";
 		reg = <0x13960000 0x100>;
 		clocks = <&clock CLK_I2S1>;
 		clock-names = "iis";
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:381 @
 	};
 
 	i2s2: i2s@13970000 {
-		compatible = "samsung,s5pv210-i2s";
+		compatible = "samsung,s3c6410-i2s";
 		reg = <0x13970000 0x100>;
 		clocks = <&clock CLK_I2S2>;
 		clock-names = "iis";
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/imx25.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/imx25.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/imx25.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:165 @
 				#size-cells = <0>;
 				compatible = "fsl,imx25-cspi", "fsl,imx35-cspi";
 				reg = <0x43fa4000 0x4000>;
-				clocks = <&clks 62>, <&clks 62>;
+				clocks = <&clks 78>, <&clks 78>;
 				clock-names = "ipg", "per";
 				interrupts = <14>;
 				status = "disabled";
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:372 @
 				compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
 				#pwm-cells = <2>;
 				reg = <0x53fa0000 0x4000>;
-				clocks = <&clks 106>, <&clks 36>;
+				clocks = <&clks 106>, <&clks 52>;
 				clock-names = "ipg", "per";
 				interrupts = <36>;
 			};
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:391 @
 				compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
 				#pwm-cells = <2>;
 				reg = <0x53fa8000 0x4000>;
-				clocks = <&clks 107>, <&clks 36>;
+				clocks = <&clks 107>, <&clks 52>;
 				clock-names = "ipg", "per";
 				interrupts = <41>;
 			};
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:432 @
 			pwm4: pwm@53fc8000 {
 				compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
 				reg = <0x53fc8000 0x4000>;
-				clocks = <&clks 108>, <&clks 36>;
+				clocks = <&clks 108>, <&clks 52>;
 				clock-names = "ipg", "per";
 				interrupts = <42>;
 			};
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:479 @
 				compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
 				#pwm-cells = <2>;
 				reg = <0x53fe0000 0x4000>;
-				clocks = <&clks 105>, <&clks 36>;
+				clocks = <&clks 105>, <&clks 52>;
 				clock-names = "ipg", "per";
 				interrupts = <26>;
 			};
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/imx51-babbage.dts
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/imx51-babbage.dts
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/imx51-babbage.dts
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:130 @
 		#address-cells = <1>;
 		#size-cells = <0>;
 
-		reg_usbh1_vbus: regulator@0 {
-			compatible = "regulator-fixed";
-			pinctrl-names = "default";
-			pinctrl-0 = <&pinctrl_usbh1reg>;
-			reg = <0>;
-			regulator-name = "usbh1_vbus";
-			regulator-min-microvolt = <5000000>;
-			regulator-max-microvolt = <5000000>;
-			gpio = <&gpio2 5 GPIO_ACTIVE_HIGH>;
-			enable-active-high;
-		};
-
-		reg_usbotg_vbus: regulator@1 {
+		reg_hub_reset: regulator@0 {
 			compatible = "regulator-fixed";
 			pinctrl-names = "default";
 			pinctrl-0 = <&pinctrl_usbotgreg>;
-			reg = <1>;
-			regulator-name = "usbotg_vbus";
+			reg = <0>;
+			regulator-name = "hub_reset";
 			regulator-min-microvolt = <5000000>;
 			regulator-max-microvolt = <5000000>;
 			gpio = <&gpio1 7 GPIO_ACTIVE_HIGH>;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:167 @
 			reg = <0>;
 			clocks = <&clks IMX5_CLK_DUMMY>;
 			clock-names = "main_clk";
+			reset-gpios = <&gpio2 5 GPIO_ACTIVE_LOW>;
 		};
 	};
 };
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:411 @
 &usbh1 {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_usbh1>;
-	vbus-supply = <&reg_usbh1_vbus>;
+	vbus-supply = <&reg_hub_reset>;
 	fsl,usbphy = <&usbh1phy>;
 	phy_type = "ulpi";
 	status = "okay";
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:421 @
 	dr_mode = "otg";
 	disable-over-current;
 	phy_type = "utmi_wide";
-	vbus-supply = <&reg_usbotg_vbus>;
 	status = "okay";
 };
 
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:38 @
 			regulator-max-microvolt = <5000000>;
 			gpio = <&gpio3 22 0>;
 			enable-active-high;
+			vin-supply = <&swbst_reg>;
 		};
 
 		reg_usb_h1_vbus: regulator@1 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:49 @
 			regulator-max-microvolt = <5000000>;
 			gpio = <&gpio1 29 0>;
 			enable-active-high;
+			vin-supply = <&swbst_reg>;
 		};
 
 		reg_audio: regulator@2 {
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/s3c6410-mini6410.dts
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/s3c6410-mini6410.dts
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/s3c6410-mini6410.dts
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:201 @
 	status = "okay";
 };
 
-&pwm {
-	status = "okay";
-};
-
 &pinctrl0 {
 	gpio_leds: gpio-leds {
 		samsung,pins = "gpk-4", "gpk-5", "gpk-6", "gpk-7";
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/s3c64xx.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/s3c64xx.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/s3c64xx.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:175 @
 			clocks = <&clocks PCLK_PWM>;
 			samsung,pwm-outputs = <0>, <1>;
 			#pwm-cells = <3>;
-			status = "disabled";
 		};
 
 		pinctrl0: pinctrl@7f008000 {
Index: linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/tegra20.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/boot/dts/tegra20.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/arm/boot/dts/tegra20.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:71 @
 			reset-names = "2d";
 		};
 
-		gr3d@54140000 {
+		gr3d@54180000 {
 			compatible = "nvidia,tegra20-gr3d";
-			reg = <0x54140000 0x00040000>;
+			reg = <0x54180000 0x00040000>;
 			clocks = <&tegra_car TEGRA20_CLK_GR3D>;
 			resets = <&tegra_car 24>;
 			reset-names = "3d";
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:133 @
 			status = "disabled";
 		};
 
-		dsi@542c0000 {
+		dsi@54300000 {
 			compatible = "nvidia,tegra20-dsi";
-			reg = <0x542c0000 0x00040000>;
+			reg = <0x54300000 0x00040000>;
 			clocks = <&tegra_car TEGRA20_CLK_DSI>;
 			resets = <&tegra_car 48>;
 			reset-names = "dsi";
Index: linux-3.18.13-rt10-r7s4/arch/arm/configs/multi_v7_defconfig
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/configs/multi_v7_defconfig
+++ linux-3.18.13-rt10-r7s4/arch/arm/configs/multi_v7_defconfig
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:323 @ CONFIG_USB=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_XHCI_MVEBU=y
 CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_EXYNOS=y
 CONFIG_USB_EHCI_TEGRA=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
 CONFIG_USB_ISP1760_HCD=y
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:449 @ CONFIG_DEBUG_FS=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_LOCKUP_DETECTOR=y
 CONFIG_CRYPTO_DEV_TEGRA_AES=y
-CONFIG_GENERIC_CPUFREQ_CPU0=y
+CONFIG_CPUFREQ_DT=y
Index: linux-3.18.13-rt10-r7s4/arch/arm/configs/omap2plus_defconfig
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/configs/omap2plus_defconfig
+++ linux-3.18.13-rt10-r7s4/arch/arm/configs/omap2plus_defconfig
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:71 @ CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
 CONFIG_CPU_FREQ_GOV_POWERSAVE=y
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
-CONFIG_GENERIC_CPUFREQ_CPU0=y
+CONFIG_CPUFREQ_DT=y
 # CONFIG_ARM_OMAP2PLUS_CPUFREQ is not set
 CONFIG_CPU_IDLE=y
 CONFIG_BINFMT_MISC=y
Index: linux-3.18.13-rt10-r7s4/arch/arm/configs/shmobile_defconfig
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/configs/shmobile_defconfig
+++ linux-3.18.13-rt10-r7s4/arch/arm/configs/shmobile_defconfig
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:179 @ CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
 CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
 CONFIG_CPU_THERMAL=y
-CONFIG_GENERIC_CPUFREQ_CPU0=y
+CONFIG_CPUFREQ_DT=y
 CONFIG_REGULATOR_DA9210=y
Index: linux-3.18.13-rt10-r7s4/arch/arm/crypto/aes_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/crypto/aes_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/crypto/aes_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:96 @ module_exit(aes_fini);
 
 MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm (ASM)");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("aes");
-MODULE_ALIAS("aes-asm");
+MODULE_ALIAS_CRYPTO("aes");
+MODULE_ALIAS_CRYPTO("aes-asm");
 MODULE_AUTHOR("David McCullough <ucdevel@gmail.com>");
Index: linux-3.18.13-rt10-r7s4/arch/arm/crypto/aesbs-core.S_shipped
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/crypto/aesbs-core.S_shipped
+++ linux-3.18.13-rt10-r7s4/arch/arm/crypto/aesbs-core.S_shipped
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:61 @
 # define VFP_ABI_FRAME	0
 # define BSAES_ASM_EXTENDED_KEY
 # define XTS_CHAIN_TWEAK
-# define __ARM_ARCH__	7
+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
+# define __ARM_MAX_ARCH__ 7
 #endif
 
 #ifdef __thumb__
 # define adrl adr
 #endif
 
-#if __ARM_ARCH__>=7
+#if __ARM_MAX_ARCH__>=7
+.arch	armv7-a
+.fpu	neon
+
 .text
 .syntax	unified 	@ ARMv7-capable assembler is expected to handle this
 #ifdef __thumb2__
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:81 @
 .code   32
 #endif
 
-.fpu	neon
-
 .type	_bsaes_decrypt8,%function
 .align	4
 _bsaes_decrypt8:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2100 @ bsaes_xts_decrypt:
 	vld1.8	{q8}, [r0]			@ initial tweak
 	adr	r2, .Lxts_magic
 
+#ifndef	XTS_CHAIN_TWEAK
 	tst	r9, #0xf			@ if not multiple of 16
 	it	ne				@ Thumb2 thing, sanity check in ARM
 	subne	r9, #0x10			@ subtract another 16 bytes
+#endif
 	subs	r9, #0x80
 
 	blo	.Lxts_dec_short
Index: linux-3.18.13-rt10-r7s4/arch/arm/crypto/bsaes-armv7.pl
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/crypto/bsaes-armv7.pl
+++ linux-3.18.13-rt10-r7s4/arch/arm/crypto/bsaes-armv7.pl
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:704 @ $code.=<<___;
 # define VFP_ABI_FRAME	0
 # define BSAES_ASM_EXTENDED_KEY
 # define XTS_CHAIN_TWEAK
-# define __ARM_ARCH__	7
+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
+# define __ARM_MAX_ARCH__ 7
 #endif
 
 #ifdef __thumb__
 # define adrl adr
 #endif
 
-#if __ARM_ARCH__>=7
+#if __ARM_MAX_ARCH__>=7
+.arch	armv7-a
+.fpu	neon
+
 .text
 .syntax	unified 	@ ARMv7-capable assembler is expected to handle this
 #ifdef __thumb2__
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:724 @ $code.=<<___;
 .code   32
 #endif
 
-.fpu	neon
-
 .type	_bsaes_decrypt8,%function
 .align	4
 _bsaes_decrypt8:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2081 @ bsaes_xts_decrypt:
 	vld1.8	{@XMM[8]}, [r0]			@ initial tweak
 	adr	$magic, .Lxts_magic
 
+#ifndef	XTS_CHAIN_TWEAK
 	tst	$len, #0xf			@ if not multiple of 16
 	it	ne				@ Thumb2 thing, sanity check in ARM
 	subne	$len, #0x10			@ subtract another 16 bytes
+#endif
 	subs	$len, #0x80
 
 	blo	.Lxts_dec_short
Index: linux-3.18.13-rt10-r7s4/arch/arm/crypto/sha1_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/crypto/sha1_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/crypto/sha1_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:174 @ module_exit(sha1_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm (ARM)");
-MODULE_ALIAS("sha1");
+MODULE_ALIAS_CRYPTO("sha1");
 MODULE_AUTHOR("David McCullough <ucdevel@gmail.com>");
Index: linux-3.18.13-rt10-r7s4/arch/arm/crypto/sha1_neon_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/crypto/sha1_neon_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/crypto/sha1_neon_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:197 @ module_exit(sha1_neon_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm, NEON accelerated");
-MODULE_ALIAS("sha1");
+MODULE_ALIAS_CRYPTO("sha1");
Index: linux-3.18.13-rt10-r7s4/arch/arm/crypto/sha512_neon_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/crypto/sha512_neon_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/crypto/sha512_neon_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:304 @ module_exit(sha512_neon_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA512 Secure Hash Algorithm, NEON accelerated");
 
-MODULE_ALIAS("sha512");
-MODULE_ALIAS("sha384");
+MODULE_ALIAS_CRYPTO("sha512");
+MODULE_ALIAS_CRYPTO("sha384");
Index: linux-3.18.13-rt10-r7s4/arch/arm/include/asm/arch_timer.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/include/asm/arch_timer.h
+++ linux-3.18.13-rt10-r7s4/arch/arm/include/asm/arch_timer.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:81 @ static inline u32 arch_timer_get_cntfrq(
 	return val;
 }
 
+static inline u64 arch_counter_get_cntpct(void)
+{
+	u64 cval;
+
+	isb();
+	asm volatile("mrrc p15, 0, %Q0, %R0, c14" : "=r" (cval));
+	return cval;
+}
+
 static inline u64 arch_counter_get_cntvct(void)
 {
 	u64 cval;
Index: linux-3.18.13-rt10-r7s4/arch/arm/include/asm/xen/page.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/include/asm/xen/page.h
+++ linux-3.18.13-rt10-r7s4/arch/arm/include/asm/xen/page.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:110 @ static inline bool set_phys_to_machine(u
 #define xen_remap(cookie, size) ioremap_cache((cookie), (size))
 #define xen_unmap(cookie) iounmap((cookie))
 
+bool xen_arch_need_swiotlb(struct device *dev,
+			   unsigned long pfn,
+			   unsigned long mfn);
+
 #endif /* _ASM_ARM_XEN_PAGE_H */
Index: linux-3.18.13-rt10-r7s4/arch/arm/kernel/setup.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/kernel/setup.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/kernel/setup.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1046 @ static int c_show(struct seq_file *m, vo
 		seq_printf(m, "model name\t: %s rev %d (%s)\n",
 			   cpu_name, cpuid & 15, elf_platform);
 
+#if defined(CONFIG_SMP)
+		seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
+			   per_cpu(cpu_data, i).loops_per_jiffy / (500000UL/HZ),
+			   (per_cpu(cpu_data, i).loops_per_jiffy / (5000UL/HZ)) % 100);
+#else
+		seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
+			   loops_per_jiffy / (500000/HZ),
+			   (loops_per_jiffy / (5000/HZ)) % 100);
+#endif
 		/* dump out the processor features */
 		seq_puts(m, "Features\t: ");
 
Index: linux-3.18.13-rt10-r7s4/arch/arm/kernel/smp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/kernel/smp.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/kernel/smp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:390 @ asmlinkage void secondary_start_kernel(v
 
 void __init smp_cpus_done(unsigned int max_cpus)
 {
-	printk(KERN_INFO "SMP: Total of %d processors activated.\n",
-	       num_online_cpus());
+	int cpu;
+	unsigned long bogosum = 0;
+
+	for_each_online_cpu(cpu)
+		bogosum += per_cpu(cpu_data, cpu).loops_per_jiffy;
+
+	printk(KERN_INFO "SMP: Total of %d processors activated "
+	       "(%lu.%02lu BogoMIPS).\n",
+	       num_online_cpus(),
+	       bogosum / (500000/HZ),
+	       (bogosum / (5000/HZ)) % 100);
 
 	hyp_mode_check();
 }
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-at91/pm.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-at91/pm.h
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-at91/pm.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:59 @ static inline void at91rm9200_standby(vo
 		"    mcr    p15, 0, %0, c7, c0, 4\n\t"
 		"    str    %5, [%1, %2]"
 		:
-		: "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR),
+		: "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR),
 		  "r" (1), "r" (AT91RM9200_SDRAMC_SRR),
 		  "r" (lpr));
 }
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-imx/clk-imx6q.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-imx/clk-imx6q.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-imx/clk-imx6q.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:147 @ static void __init imx6q_clocks_init(str
 		post_div_table[1].div = 1;
 		post_div_table[2].div = 1;
 		video_div_table[1].div = 1;
-		video_div_table[2].div = 1;
-	};
+		video_div_table[3].div = 1;
+	}
 
 	clk[IMX6QDL_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 2, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
 	clk[IMX6QDL_PLL2_BYPASS_SRC] = imx_clk_mux("pll2_bypass_src", base + 0x30, 14, 2, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-imx/clk-imx6sx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-imx/clk-imx6sx.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-imx/clk-imx6sx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:561 @ static void __init imx6sx_clocks_init(st
 	clk_set_parent(clks[IMX6SX_CLK_GPU_CORE_SEL], clks[IMX6SX_CLK_PLL3_PFD0]);
 	clk_set_parent(clks[IMX6SX_CLK_GPU_AXI_SEL], clks[IMX6SX_CLK_PLL3_PFD0]);
 
+	clk_set_parent(clks[IMX6SX_CLK_QSPI1_SEL], clks[IMX6SX_CLK_PLL2_BUS]);
+	clk_set_parent(clks[IMX6SX_CLK_QSPI2_SEL], clks[IMX6SX_CLK_PLL2_BUS]);
+
 	/* Set initial power mode */
 	imx6q_set_lpm(WAIT_CLOCKED);
 }
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-mvebu/coherency.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-mvebu/coherency.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-mvebu/coherency.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:345 @ static void __init armada_375_380_cohere
 	arch_ioremap_caller = armada_pcie_wa_ioremap_caller;
 
 	/*
+	 * We should switch the PL310 to I/O coherency mode only if
+	 * I/O coherency is actually enabled.
+	 */
+	if (!coherency_available())
+		return;
+
+	/*
 	 * Add the PL310 property "arm,io-coherent". This makes sure the
 	 * outer sync operation is not used, which allows to
 	 * workaround the system erratum that causes deadlocks when
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:371 @ static int coherency_type(void)
 {
 	struct device_node *np;
 	const struct of_device_id *match;
+	int type;
+
+	/*
+	 * The coherency fabric is needed:
+	 * - For coherency between processors on Armada XP, so only
+	 *   when SMP is enabled.
+	 * - For coherency between the processor and I/O devices, but
+	 *   this coherency requires many pre-requisites (write
+	 *   allocate cache policy, shareable pages, SMP bit set) that
+	 *   are only meant in SMP situations.
+	 *
+	 * Note that this means that on Armada 370, there is currently
+	 * no way to use hardware I/O coherency, because even when
+	 * CONFIG_SMP is enabled, is_smp() returns false due to the
+	 * Armada 370 being a single-core processor. To lift this
+	 * limitation, we would have to find a way to make the cache
+	 * policy set to write-allocate (on all Armada SoCs), and to
+	 * set the shareable attribute in page tables (on all Armada
+	 * SoCs except the Armada 370). Unfortunately, such decisions
+	 * are taken very early in the kernel boot process, at a point
+	 * where we don't know yet on which SoC we are running.
+
+	 */
+	if (!is_smp())
+		return COHERENCY_FABRIC_TYPE_NONE;
 
 	np = of_find_matching_node_and_match(NULL, of_coherency_table, &match);
-	if (np) {
-		int type = (int) match->data;
+	if (!np)
+		return COHERENCY_FABRIC_TYPE_NONE;
 
-		/* Armada 370/XP coherency works in both UP and SMP */
-		if (type == COHERENCY_FABRIC_TYPE_ARMADA_370_XP)
-			return type;
-
-		/* Armada 375 coherency works only on SMP */
-		else if (type == COHERENCY_FABRIC_TYPE_ARMADA_375 && is_smp())
-			return type;
-
-		/* Armada 380 coherency works only on SMP */
-		else if (type == COHERENCY_FABRIC_TYPE_ARMADA_380 && is_smp())
-			return type;
-	}
+	type = (int) match->data;
+
+	of_node_put(np);
 
-	return COHERENCY_FABRIC_TYPE_NONE;
+	return type;
 }
 
+/*
+ * As a precaution, we currently completely disable hardware I/O
+ * coherency, until enough testing is done with automatic I/O
+ * synchronization barriers to validate that it is a proper solution.
+ */
 int coherency_available(void)
 {
-	return coherency_type() != COHERENCY_FABRIC_TYPE_NONE;
+	return false;
 }
 
 int __init coherency_init(void)
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-mvebu/coherency_ll.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-mvebu/coherency_ll.S
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-mvebu/coherency_ll.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:27 @
 #include <asm/cp15.h>
 
 	.text
-/* Returns the coherency base address in r1 (r0 is untouched) */
+/*
+ * Returns the coherency base address in r1 (r0 is untouched), or 0 if
+ * the coherency fabric is not enabled.
+ */
 ENTRY(ll_get_coherency_base)
 	mrc	p15, 0, r1, c1, c0, 0
 	tst	r1, #CR_M @ Check MMU bit enabled
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:38 @ ENTRY(ll_get_coherency_base)
 
 	/*
 	 * MMU is disabled, use the physical address of the coherency
-	 * base address.
+	 * base address. However, if the coherency fabric isn't mapped
+	 * (i.e its virtual address is zero), it means coherency is
+	 * not enabled, so we return 0.
 	 */
+	ldr	r1, =coherency_base
+	cmp	r1, #0
+	beq	2f
 	adr	r1, 3f
 	ldr	r3, [r1]
 	ldr	r1, [r1, r3]
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:96 @ ENTRY(ll_add_cpu_to_smp_group)
 	 */
 	mov 	r0, lr
 	bl	ll_get_coherency_base
+	/* Bail out if the coherency is not enabled */
+	cmp	r1, #0
+	reteq	r0
 	bl	ll_get_coherency_cpumask
 	mov 	lr, r0
 	add	r0, r1, #ARMADA_XP_CFB_CFG_REG_OFFSET
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:121 @ ENTRY(ll_enable_coherency)
 	 */
 	mov r0, lr
 	bl	ll_get_coherency_base
+	/* Bail out if the coherency is not enabled */
+	cmp	r1, #0
+	reteq	r0
 	bl	ll_get_coherency_cpumask
 	mov lr, r0
 	add	r0, r1, #ARMADA_XP_CFB_CTL_REG_OFFSET
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:148 @ ENTRY(ll_disable_coherency)
 	 */
 	mov 	r0, lr
 	bl	ll_get_coherency_base
+	/* Bail out if the coherency is not enabled */
+	cmp	r1, #0
+	reteq	r0
 	bl	ll_get_coherency_cpumask
 	mov 	lr, r0
 	add	r0, r1, #ARMADA_XP_CFB_CTL_REG_OFFSET
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-mvebu/system-controller.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-mvebu/system-controller.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-mvebu/system-controller.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:129 @ int mvebu_system_controller_get_soc_id(u
 		return -ENODEV;
 }
 
-#ifdef CONFIG_SMP
+#if defined(CONFIG_SMP) && defined(CONFIG_MACH_MVEBU_V7)
 void mvebu_armada375_smp_wa_init(void)
 {
 	u32 dev, rev;
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-omap2/common.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-omap2/common.h
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-omap2/common.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:252 @ extern void omap4_cpu_die(unsigned int c
 extern struct smp_operations omap4_smp_ops;
 
 extern void omap5_secondary_startup(void);
+extern void omap5_secondary_hyp_startup(void);
 #endif
 
 #if defined(CONFIG_SMP) && defined(CONFIG_PM)
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-omap2/omap-headsmp.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-omap2/omap-headsmp.S
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-omap2/omap-headsmp.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:25 @
 
 /* Physical address needed since MMU not enabled yet on secondary core */
 #define AUX_CORE_BOOT0_PA			0x48281800
+#define API_HYP_ENTRY				0x102
 
 /*
  * OMAP5 specific entry point for secondary CPU to jump from ROM
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:45 @ wait:	ldr	r2, =AUX_CORE_BOOT0_PA	@ read
 	b	secondary_startup
 ENDPROC(omap5_secondary_startup)
 /*
+ * Same as omap5_secondary_startup except we call into the ROM to
+ * enable HYP mode first.  This is called instead of
+ * omap5_secondary_startup if the primary CPU was put into HYP mode by
+ * the boot loader.
+ */
+ENTRY(omap5_secondary_hyp_startup)
+wait_2:	ldr	r2, =AUX_CORE_BOOT0_PA	@ read from AuxCoreBoot0
+	ldr	r0, [r2]
+	mov	r0, r0, lsr #5
+	mrc	p15, 0, r4, c0, c0, 5
+	and	r4, r4, #0x0f
+	cmp	r0, r4
+	bne	wait_2
+	ldr	r12, =API_HYP_ENTRY
+	adr	r0, hyp_boot
+	smc	#0
+hyp_boot:
+	b	secondary_startup
+ENDPROC(omap5_secondary_hyp_startup)
+/*
  * OMAP4 specific entry point for secondary CPU to jump from ROM
  * code.  This routine also provides a holding flag into which
  * secondary core is held until we're ready for it to initialise.
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-omap2/omap-smp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-omap2/omap-smp.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-omap2/omap-smp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:25 @
 #include <linux/irqchip/arm-gic.h>
 
 #include <asm/smp_scu.h>
+#include <asm/virt.h>
 
 #include "omap-secure.h"
 #include "omap-wakeupgen.h"
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:231 @ static void __init omap4_smp_prepare_cpu
 	if (omap_secure_apis_support())
 		omap_auxcoreboot_addr(virt_to_phys(startup_addr));
 	else
-		writel_relaxed(virt_to_phys(omap5_secondary_startup),
-			       base + OMAP_AUX_CORE_BOOT_1);
+		/*
+		 * If the boot CPU is in HYP mode then start secondary
+		 * CPU in HYP mode as well.
+		 */
+		if ((__boot_cpu_mode & MODE_MASK) == HYP_MODE)
+			writel_relaxed(virt_to_phys(omap5_secondary_hyp_startup),
+				       base + OMAP_AUX_CORE_BOOT_1);
+		else
+			writel_relaxed(virt_to_phys(omap5_secondary_startup),
+				       base + OMAP_AUX_CORE_BOOT_1);
 
 }
 
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2020 @ static struct omap_hwmod dra7xx_uart3_hw
 	.class		= &dra7xx_uart_hwmod_class,
 	.clkdm_name	= "l4per_clkdm",
 	.main_clk	= "uart3_gfclk_mux",
-	.flags		= HWMOD_SWSUP_SIDLE_ACT,
+	.flags		= HWMOD_SWSUP_SIDLE_ACT | DEBUG_OMAP4UART3_FLAGS,
 	.prcm = {
 		.omap4 = {
 			.clkctrl_offs = DRA7XX_CM_L4PER_UART3_CLKCTRL_OFFSET,
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-omap2/pm44xx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-omap2/pm44xx.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-omap2/pm44xx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:163 @ static inline int omap4_init_static_deps
 	struct clockdomain *ducati_clkdm, *l3_2_clkdm;
 	int ret = 0;
 
-	if (omap_rev() == OMAP4430_REV_ES1_0) {
-		WARN(1, "Power Management not supported on OMAP4430 ES1.0\n");
-		return -ENODEV;
-	}
-
-	pr_err("Power Management for TI OMAP4.\n");
-	/*
-	 * OMAP4 chip PM currently works only with certain (newer)
-	 * versions of bootloaders. This is due to missing code in the
-	 * kernel to properly reset and initialize some devices.
-	 * http://www.spinics.net/lists/arm-kernel/msg218641.html
-	 */
-	pr_warn("OMAP4 PM: u-boot >= v2012.07 is required for full PM support\n");
-
-	ret = pwrdm_for_each(pwrdms_setup, NULL);
-	if (ret) {
-		pr_err("Failed to setup powerdomains\n");
-		return ret;
-	}
-
 	/*
 	 * The dynamic dependency between MPUSS -> MEMIF and
 	 * MPUSS -> L4_PER/L3_* and DUCATI -> L3_* doesn't work as
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:255 @ int __init omap4_pm_init(void)
 
 	pr_info("Power Management for TI OMAP4+ devices.\n");
 
+	/*
+	 * OMAP4 chip PM currently works only with certain (newer)
+	 * versions of bootloaders. This is due to missing code in the
+	 * kernel to properly reset and initialize some devices.
+	 * http://www.spinics.net/lists/arm-kernel/msg218641.html
+	 */
+	if (cpu_is_omap44xx())
+		pr_warn("OMAP4 PM: u-boot >= v2012.07 is required for full PM support\n");
+
 	ret = pwrdm_for_each(pwrdms_setup, NULL);
 	if (ret) {
 		pr_err("Failed to setup powerdomains.\n");
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-omap2/timer.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-omap2/timer.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-omap2/timer.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:516 @ static void __init realtime_counter_init
 	rate = clk_get_rate(sys_clk);
 	/* Numerator/denumerator values refer TRM Realtime Counter section */
 	switch (rate) {
-	case 1200000:
+	case 12000000:
 		num = 64;
 		den = 125;
 		break;
-	case 1300000:
+	case 13000000:
 		num = 768;
 		den = 1625;
 		break;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:532 @ static void __init realtime_counter_init
 		num = 192;
 		den = 625;
 		break;
-	case 2600000:
+	case 26000000:
 		num = 384;
 		den = 1625;
 		break;
-	case 2700000:
+	case 27000000:
 		num = 256;
 		den = 1125;
 		break;
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-pxa/corgi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-pxa/corgi.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-pxa/corgi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:29 @
 #include <linux/i2c.h>
 #include <linux/i2c/pxa-i2c.h>
 #include <linux/io.h>
+#include <linux/regulator/machine.h>
 #include <linux/spi/spi.h>
 #include <linux/spi/ads7846.h>
 #include <linux/spi/corgi_lcd.h>
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:756 @ static void __init corgi_init(void)
 		sharpsl_nand_partitions[1].size = 53 * 1024 * 1024;
 
 	platform_add_devices(devices, ARRAY_SIZE(devices));
+
+	regulator_has_full_constraints();
 }
 
 static void __init fixup_corgi(struct tag *tags, char **cmdline)
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-pxa/hx4700.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-pxa/hx4700.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-pxa/hx4700.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:896 @ static void __init hx4700_init(void)
 	mdelay(10);
 	gpio_set_value(GPIO71_HX4700_ASIC3_nRESET, 1);
 	mdelay(10);
+
+	regulator_has_full_constraints();
 }
 
 MACHINE_START(H4700, "HP iPAQ HX4700")
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-pxa/poodle.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-pxa/poodle.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-pxa/poodle.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:28 @
 #include <linux/gpio.h>
 #include <linux/i2c.h>
 #include <linux/i2c/pxa-i2c.h>
+#include <linux/regulator/machine.h>
 #include <linux/spi/spi.h>
 #include <linux/spi/ads7846.h>
 #include <linux/spi/pxa2xx_spi.h>
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:459 @ static void __init poodle_init(void)
 	pxa_set_i2c_info(NULL);
 	i2c_register_board_info(0, ARRAY_AND_SIZE(poodle_i2c_devices));
 	poodle_init_spi();
+	regulator_has_full_constraints();
 }
 
 static void __init fixup_poodle(struct tag *tags, char **cmdline)
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-sa1100/pm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-sa1100/pm.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-sa1100/pm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:84 @ static int sa11x0_pm_enter(suspend_state
 	/*
 	 * Ensure not to come back here if it wasn't intended
 	 */
+	RCSR = RCSR_SMR;
 	PSPR = 0;
 
 	/*
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-shmobile/setup-sh73a0.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-shmobile/setup-sh73a0.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-shmobile/setup-sh73a0.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:601 @ static struct platform_device ipmmu_devi
 
 static struct renesas_intc_irqpin_config irqpin0_platform_data = {
 	.irq_base = irq_pin(0), /* IRQ0 -> IRQ7 */
+	.control_parent = true,
 };
 
 static struct resource irqpin0_resources[] = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:663 @ static struct platform_device irqpin1_de
 
 static struct renesas_intc_irqpin_config irqpin2_platform_data = {
 	.irq_base = irq_pin(16), /* IRQ16 -> IRQ23 */
+	.control_parent = true,
 };
 
 static struct resource irqpin2_resources[] = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:694 @ static struct platform_device irqpin2_de
 
 static struct renesas_intc_irqpin_config irqpin3_platform_data = {
 	.irq_base = irq_pin(24), /* IRQ24 -> IRQ31 */
+	.control_parent = true,
 };
 
 static struct resource irqpin3_resources[] = {
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-sunxi/Kconfig
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-sunxi/Kconfig
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-sunxi/Kconfig
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4 @
 menuconfig ARCH_SUNXI
 	bool "Allwinner SoCs" if ARCH_MULTI_V7
 	select ARCH_REQUIRE_GPIOLIB
+	select ARCH_HAS_RESET_CONTROLLER
 	select CLKSRC_MMIO
 	select GENERIC_IRQ_CHIP
 	select PINCTRL
 	select SUN4I_TIMER
+	select RESET_CONTROLLER
 
 if ARCH_SUNXI
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:25 @ config MACH_SUN5I
 config MACH_SUN6I
 	bool "Allwinner A31 (sun6i) SoCs support"
 	default ARCH_SUNXI
-	select ARCH_HAS_RESET_CONTROLLER
 	select ARM_GIC
 	select MFD_SUN6I_PRCM
-	select RESET_CONTROLLER
 	select SUN5I_HSTIMER
 
 config MACH_SUN7I
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:40 @ config MACH_SUN7I
 config MACH_SUN8I
 	bool "Allwinner A23 (sun8i) SoCs support"
 	default ARCH_SUNXI
-	select ARCH_HAS_RESET_CONTROLLER
 	select ARM_GIC
 	select MFD_SUN6I_PRCM
-	select RESET_CONTROLLER
 
 endif
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-tegra/reset-handler.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-tegra/reset-handler.S
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-tegra/reset-handler.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:54 @ ENTRY(tegra_resume)
  THUMB(	it	ne )
 	bne	cpu_resume			@ no
 
+	tegra_get_soc_id TEGRA_APB_MISC_BASE, r6
 	/* Are we on Tegra20? */
 	cmp	r6, #TEGRA20
 	beq	1f				@ Yes
Index: linux-3.18.13-rt10-r7s4/arch/arm/mach-vexpress/Kconfig
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mach-vexpress/Kconfig
+++ linux-3.18.13-rt10-r7s4/arch/arm/mach-vexpress/Kconfig
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:78 @ config ARCH_VEXPRESS_TC2_PM
 	depends on MCPM
 	select ARM_CCI
 	select ARCH_VEXPRESS_SPC
+	select ARM_CPU_SUSPEND
 	help
 	  Support for CPU and cluster power management on Versatile Express
 	  with a TC2 (A15x2 A7x3) big.LITTLE core tile.
Index: linux-3.18.13-rt10-r7s4/arch/arm/mm/context.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/mm/context.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/mm/context.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:147 @ static void flush_context(unsigned int c
 	/* Update the list of reserved ASIDs and the ASID bitmap. */
 	bitmap_clear(asid_map, 0, NUM_USER_ASIDS);
 	for_each_possible_cpu(i) {
-		if (i == cpu) {
-			asid = 0;
-		} else {
-			asid = atomic64_xchg(&per_cpu(active_asids, i), 0);
-			/*
-			 * If this CPU has already been through a
-			 * rollover, but hasn't run another task in
-			 * the meantime, we must preserve its reserved
-			 * ASID, as this is the only trace we have of
-			 * the process it is still running.
-			 */
-			if (asid == 0)
-				asid = per_cpu(reserved_asids, i);
-			__set_bit(asid & ~ASID_MASK, asid_map);
-		}
+		asid = atomic64_xchg(&per_cpu(active_asids, i), 0);
+		/*
+		 * If this CPU has already been through a
+		 * rollover, but hasn't run another task in
+		 * the meantime, we must preserve its reserved
+		 * ASID, as this is the only trace we have of
+		 * the process it is still running.
+		 */
+		if (asid == 0)
+			asid = per_cpu(reserved_asids, i);
+		__set_bit(asid & ~ASID_MASK, asid_map);
 		per_cpu(reserved_asids, i) = asid;
 	}
 
Index: linux-3.18.13-rt10-r7s4/arch/arm/xen/mm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm/xen/mm.c
+++ linux-3.18.13-rt10-r7s4/arch/arm/xen/mm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:19 @
 #include <asm/xen/hypercall.h>
 #include <asm/xen/interface.h>
 
+bool xen_arch_need_swiotlb(struct device *dev,
+			   unsigned long pfn,
+			   unsigned long mfn)
+{
+	return (pfn != mfn);
+}
+
 int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order,
 				 unsigned int address_bits,
 				 dma_addr_t *dma_handle)
Index: linux-3.18.13-rt10-r7s4/arch/arm64/Kconfig
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/Kconfig
+++ linux-3.18.13-rt10-r7s4/arch/arm64/Kconfig
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:196 @ endmenu
 
 menu "Kernel Features"
 
+menu "ARM errata workarounds via the alternatives framework"
+
+config ARM64_ERRATUM_826319
+	bool "Cortex-A53: 826319: System might deadlock if a write cannot complete until read data is accepted"
+	default y
+	help
+	  This option adds an alternative code sequence to work around ARM
+	  erratum 826319 on Cortex-A53 parts up to r0p2 with an AMBA 4 ACE or
+	  AXI master interface and an L2 cache.
+
+	  If a Cortex-A53 uses an AMBA AXI4 ACE interface to other processors
+	  and is unable to accept a certain write via this interface, it will
+	  not progress on read data presented on the read data channel and the
+	  system can deadlock.
+
+	  The workaround promotes data cache clean instructions to
+	  data cache clean-and-invalidate.
+	  Please note that this does not necessarily enable the workaround,
+	  as it depends on the alternative framework, which will only patch
+	  the kernel if an affected CPU is detected.
+
+	  If unsure, say Y.
+
+config ARM64_ERRATUM_827319
+	bool "Cortex-A53: 827319: Data cache clean instructions might cause overlapping transactions to the interconnect"
+	default y
+	help
+	  This option adds an alternative code sequence to work around ARM
+	  erratum 827319 on Cortex-A53 parts up to r0p2 with an AMBA 5 CHI
+	  master interface and an L2 cache.
+
+	  Under certain conditions this erratum can cause a clean line eviction
+	  to occur at the same time as another transaction to the same address
+	  on the AMBA 5 CHI interface, which can cause data corruption if the
+	  interconnect reorders the two transactions.
+
+	  The workaround promotes data cache clean instructions to
+	  data cache clean-and-invalidate.
+	  Please note that this does not necessarily enable the workaround,
+	  as it depends on the alternative framework, which will only patch
+	  the kernel if an affected CPU is detected.
+
+	  If unsure, say Y.
+
+config ARM64_ERRATUM_824069
+	bool "Cortex-A53: 824069: Cache line might not be marked as clean after a CleanShared snoop"
+	default y
+	help
+	  This option adds an alternative code sequence to work around ARM
+	  erratum 824069 on Cortex-A53 parts up to r0p2 when it is connected
+	  to a coherent interconnect.
+
+	  If a Cortex-A53 processor is executing a store or prefetch for
+	  write instruction at the same time as a processor in another
+	  cluster is executing a cache maintenance operation to the same
+	  address, then this erratum might cause a clean cache line to be
+	  incorrectly marked as dirty.
+
+	  The workaround promotes data cache clean instructions to
+	  data cache clean-and-invalidate.
+	  Please note that this option does not necessarily enable the
+	  workaround, as it depends on the alternative framework, which will
+	  only patch the kernel if an affected CPU is detected.
+
+	  If unsure, say Y.
+
+config ARM64_ERRATUM_819472
+	bool "Cortex-A53: 819472: Store exclusive instructions might cause data corruption"
+	default y
+	help
+	  This option adds an alternative code sequence to work around ARM
+	  erratum 819472 on Cortex-A53 parts up to r0p1 with an L2 cache
+	  present when it is connected to a coherent interconnect.
+
+	  If the processor is executing a load and store exclusive sequence at
+	  the same time as a processor in another cluster is executing a cache
+	  maintenance operation to the same address, then this erratum might
+	  cause data corruption.
+
+	  The workaround promotes data cache clean instructions to
+	  data cache clean-and-invalidate.
+	  Please note that this does not necessarily enable the workaround,
+	  as it depends on the alternative framework, which will only patch
+	  the kernel if an affected CPU is detected.
+
+	  If unsure, say Y.
+
+config ARM64_ERRATUM_832075
+	bool "Cortex-A57: 832075: possible deadlock on mixing exclusive memory accesses with device loads"
+	default y
+	help
+	  This option adds an alternative code sequence to work around ARM
+	  erratum 832075 on Cortex-A57 parts up to r1p2.
+
+	  Affected Cortex-A57 parts might deadlock when exclusive load/store
+	  instructions to Write-Back memory are mixed with Device loads.
+
+	  The workaround is to promote device loads to use Load-Acquire
+	  semantics.
+	  Please note that this does not necessarily enable the workaround,
+	  as it depends on the alternative framework, which will only patch
+	  the kernel if an affected CPU is detected.
+
+	  If unsure, say Y.
+
+config ARM64_ERRATUM_845719
+	bool "Cortex-A53: 845719: a load might read incorrect data"
+	depends on COMPAT
+	default y
+	help
+	  This option adds an alternative code sequence to work around ARM
+	  erratum 845719 on Cortex-A53 parts up to r0p4.
+
+	  When running a compat (AArch32) userspace on an affected Cortex-A53
+	  part, a load at EL0 from a virtual address that matches the bottom 32
+	  bits of the virtual address used by a recent load at (AArch64) EL1
+	  might return incorrect data.
+
+	  The workaround is to write the contextidr_el1 register on exception
+	  return to a 32-bit task.
+	  Please note that this does not necessarily enable the workaround,
+	  as it depends on the alternative framework, which will only patch
+	  the kernel if an affected CPU is detected.
+
+	  If unsure, say Y.
+
+endmenu
+
+
 choice
 	prompt "Page size"
 	default ARM64_4K_PAGES
Index: linux-3.18.13-rt10-r7s4/arch/arm64/crypto/aes-ce-ccm-glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/crypto/aes-ce-ccm-glue.c
+++ linux-3.18.13-rt10-r7s4/arch/arm64/crypto/aes-ce-ccm-glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:297 @ module_exit(aes_mod_exit);
 MODULE_DESCRIPTION("Synchronous AES in CCM mode using ARMv8 Crypto Extensions");
 MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
 MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("ccm(aes)");
+MODULE_ALIAS_CRYPTO("ccm(aes)");
Index: linux-3.18.13-rt10-r7s4/arch/arm64/crypto/aes-glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/crypto/aes-glue.c
+++ linux-3.18.13-rt10-r7s4/arch/arm64/crypto/aes-glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:41 @ MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS
 #define aes_xts_encrypt		neon_aes_xts_encrypt
 #define aes_xts_decrypt		neon_aes_xts_decrypt
 MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS using ARMv8 NEON");
-MODULE_ALIAS("ecb(aes)");
-MODULE_ALIAS("cbc(aes)");
-MODULE_ALIAS("ctr(aes)");
-MODULE_ALIAS("xts(aes)");
+MODULE_ALIAS_CRYPTO("ecb(aes)");
+MODULE_ALIAS_CRYPTO("cbc(aes)");
+MODULE_ALIAS_CRYPTO("ctr(aes)");
+MODULE_ALIAS_CRYPTO("xts(aes)");
 #endif
 
 MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
Index: linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/alternative-asm.h
===================================================================
--- /dev/null
+++ linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/alternative-asm.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4 @
+#ifndef __ASM_ALTERNATIVE_ASM_H
+#define __ASM_ALTERNATIVE_ASM_H
+
+#ifdef __ASSEMBLY__
+
+.macro altinstruction_entry orig_offset alt_offset feature orig_len alt_len
+	.word \orig_offset - .
+	.word \alt_offset - .
+	.hword \feature
+	.byte \orig_len
+	.byte \alt_len
+.endm
+
+.macro alternative_insn insn1 insn2 cap
+661:	\insn1
+662:	.pushsection .altinstructions, "a"
+	altinstruction_entry 661b, 663f, \cap, 662b-661b, 664f-663f
+	.popsection
+	.pushsection .altinstr_replacement, "ax"
+663:	\insn2
+664:	.popsection
+	.if ((664b-663b) != (662b-661b))
+		.error "Alternatives instruction length mismatch"
+	.endif
+.endm
+
+#endif  /*  __ASSEMBLY__  */
+
+#endif /* __ASM_ALTERNATIVE_ASM_H */
Index: linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/alternative.h
===================================================================
--- /dev/null
+++ linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/alternative.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4 @
+#ifndef __ASM_ALTERNATIVE_H
+#define __ASM_ALTERNATIVE_H
+
+#include <linux/types.h>
+#include <linux/stddef.h>
+#include <linux/stringify.h>
+
+struct alt_instr {
+	s32 orig_offset;	/* offset to original instruction */
+	s32 alt_offset;		/* offset to replacement instruction */
+	u16 cpufeature;		/* cpufeature bit set for replacement */
+	u8  orig_len;		/* size of original instruction(s) */
+	u8  alt_len;		/* size of new instruction(s), <= orig_len */
+};
+
+void apply_alternatives(void);
+void free_alternatives_memory(void);
+
+#define ALTINSTR_ENTRY(feature)						      \
+	" .word 661b - .\n"				/* label           */ \
+	" .word 663f - .\n"				/* new instruction */ \
+	" .hword " __stringify(feature) "\n"		/* feature bit     */ \
+	" .byte 662b-661b\n"				/* source len      */ \
+	" .byte 664f-663f\n"				/* replacement len */
+
+/* alternative assembly primitive: */
+#define ALTERNATIVE(oldinstr, newinstr, feature)			\
+	"661:\n\t"							\
+	oldinstr "\n"							\
+	"662:\n"							\
+	".pushsection .altinstructions,\"a\"\n"				\
+	ALTINSTR_ENTRY(feature)						\
+	".popsection\n"							\
+	".pushsection .altinstr_replacement, \"a\"\n"			\
+	"663:\n\t"							\
+	newinstr "\n"							\
+	"664:\n\t"							\
+	".popsection\n\t"						\
+	".if ((664b-663b) != (662b-661b))\n\t"				\
+	"	.error \"Alternatives instruction length mismatch\"\n\t"\
+	".endif\n"
+
+#endif /* __ASM_ALTERNATIVE_H */
Index: linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/arch_timer.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/include/asm/arch_timer.h
+++ linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/arch_timer.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:107 @ static inline void arch_timer_set_cntkct
 	asm volatile("msr	cntkctl_el1, %0" : : "r" (cntkctl));
 }
 
+static inline u64 arch_counter_get_cntpct(void)
+{
+	/*
+	 * AArch64 kernel and user space mandate the use of CNTVCT.
+	 */
+	BUG();
+	return 0;
+}
+
 static inline u64 arch_counter_get_cntvct(void)
 {
 	u64 cval;
Index: linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/cpufeature.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/include/asm/cpufeature.h
+++ linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/cpufeature.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:24 @
 #define MAX_CPU_FEATURES	(8 * sizeof(elf_hwcap))
 #define cpu_feature(x)		ilog2(HWCAP_ ## x)
 
+#define ARM64_WORKAROUND_CLEAN_CACHE		0
+#define ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE	1
+#define ARM64_WORKAROUND_845719			2
+
+#define NCAPS					3
+
+#ifndef __ASSEMBLY__
+
+extern DECLARE_BITMAP(cpu_hwcaps, NCAPS);
+
 static inline bool cpu_have_feature(unsigned int num)
 {
 	return elf_hwcap & (1UL << num);
 }
 
+static inline bool cpus_have_cap(unsigned int num)
+{
+	if (num >= NCAPS)
+		return false;
+	return test_bit(num, cpu_hwcaps);
+}
+
+static inline void cpus_set_cap(unsigned int num)
+{
+	if (num >= NCAPS)
+		pr_warn("Attempt to set an illegal CPU capability (%d >= %d)\n",
+			num, NCAPS);
+	else
+		__set_bit(num, cpu_hwcaps);
+}
+
+void check_local_cpu_errata(void);
+
+#endif /* __ASSEMBLY__ */
+
 #endif
Index: linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/cputype.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/include/asm/cputype.h
+++ linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/cputype.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:60 @
 #define MIDR_IMPLEMENTOR(midr)	\
 	(((midr) & MIDR_IMPLEMENTOR_MASK) >> MIDR_IMPLEMENTOR_SHIFT)
 
+#define MIDR_CPU_PART(imp, partnum) \
+	(((imp)			<< MIDR_IMPLEMENTOR_SHIFT) | \
+	(0xf			<< MIDR_ARCHITECTURE_SHIFT) | \
+	((partnum)		<< MIDR_PARTNUM_SHIFT))
+
 #define ARM_CPU_IMP_ARM		0x41
 #define ARM_CPU_IMP_APM		0x50
 
Index: linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/hwcap.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/include/asm/hwcap.h
+++ linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/hwcap.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:33 @
 #define COMPAT_HWCAP_IDIVA	(1 << 17)
 #define COMPAT_HWCAP_IDIVT	(1 << 18)
 #define COMPAT_HWCAP_IDIV	(COMPAT_HWCAP_IDIVA|COMPAT_HWCAP_IDIVT)
+#define COMPAT_HWCAP_LPAE	(1 << 20)
 #define COMPAT_HWCAP_EVTSTRM	(1 << 21)
 
 #define COMPAT_HWCAP2_AES	(1 << 0)
Index: linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/io.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/include/asm/io.h
+++ linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/io.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:31 @
 #include <asm/barrier.h>
 #include <asm/pgtable.h>
 #include <asm/early_ioremap.h>
+#include <asm/alternative.h>
+#include <asm/cpufeature.h>
 
 #include <xen/xen.h>
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:62 @ static inline void __raw_writeq(u64 val,
 static inline u8 __raw_readb(const volatile void __iomem *addr)
 {
 	u8 val;
-	asm volatile("ldrb %w0, [%1]" : "=r" (val) : "r" (addr));
+	asm volatile(ALTERNATIVE("ldrb %w0, [%1]",
+				 "ldarb %w0, [%1]",
+				 ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE)
+		     : "=r" (val) : "r" (addr));
 	return val;
 }
 
 static inline u16 __raw_readw(const volatile void __iomem *addr)
 {
 	u16 val;
-	asm volatile("ldrh %w0, [%1]" : "=r" (val) : "r" (addr));
+
+	asm volatile(ALTERNATIVE("ldrh %w0, [%1]",
+				 "ldarh %w0, [%1]",
+				 ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE)
+		     : "=r" (val) : "r" (addr));
 	return val;
 }
 
 static inline u32 __raw_readl(const volatile void __iomem *addr)
 {
 	u32 val;
-	asm volatile("ldr %w0, [%1]" : "=r" (val) : "r" (addr));
+	asm volatile(ALTERNATIVE("ldr %w0, [%1]",
+				 "ldar %w0, [%1]",
+				 ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE)
+		     : "=r" (val) : "r" (addr));
 	return val;
 }
 
 static inline u64 __raw_readq(const volatile void __iomem *addr)
 {
 	u64 val;
-	asm volatile("ldr %0, [%1]" : "=r" (val) : "r" (addr));
+	asm volatile(ALTERNATIVE("ldr %0, [%1]",
+				 "ldar %0, [%1]",
+				 ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE)
+		     : "=r" (val) : "r" (addr));
 	return val;
 }
 
Index: linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/mmu_context.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/include/asm/mmu_context.h
+++ linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/mmu_context.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:154 @ switch_mm(struct mm_struct *prev, struct
 {
 	unsigned int cpu = smp_processor_id();
 
+	/*
+	 * init_mm.pgd does not contain any user mappings and it is always
+	 * active for kernel addresses in TTBR1. Just set the reserved TTBR0.
+	 */
+	if (next == &init_mm) {
+		cpu_set_reserved_ttbr0();
+		return;
+	}
+
 	if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next)) || prev != next)
 		check_and_switch_context(next, tsk);
 }
Index: linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/tlb.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/include/asm/tlb.h
+++ linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/tlb.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:22 @
 #ifndef __ASM_TLB_H
 #define __ASM_TLB_H
 
-#define  __tlb_remove_pmd_tlb_entry __tlb_remove_pmd_tlb_entry
-
-#include <asm-generic/tlb.h>
-
 #include <linux/pagemap.h>
 #include <linux/swap.h>
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:36 @ static inline void __tlb_remove_table(vo
 #define tlb_remove_entry(tlb, entry)	tlb_remove_page(tlb, entry)
 #endif /* CONFIG_HAVE_RCU_TABLE_FREE */
 
-/*
- * There's three ways the TLB shootdown code is used:
- *  1. Unmapping a range of vmas.  See zap_page_range(), unmap_region().
- *     tlb->fullmm = 0, and tlb_start_vma/tlb_end_vma will be called.
- *  2. Unmapping all vmas.  See exit_mmap().
- *     tlb->fullmm = 1, and tlb_start_vma/tlb_end_vma will be called.
- *     Page tables will be freed.
- *  3. Unmapping argument pages.  See shift_arg_pages().
- *     tlb->fullmm = 0, but tlb_start_vma/tlb_end_vma will not be called.
- */
+#include <asm-generic/tlb.h>
+
 static inline void tlb_flush(struct mmu_gather *tlb)
 {
 	if (tlb->fullmm) {
 		flush_tlb_mm(tlb->mm);
-	} else if (tlb->end > 0) {
+	} else {
 		struct vm_area_struct vma = { .vm_mm = tlb->mm, };
 		flush_tlb_range(&vma, tlb->start, tlb->end);
-		tlb->start = TASK_SIZE;
-		tlb->end = 0;
-	}
-}
-
-static inline void tlb_add_flush(struct mmu_gather *tlb, unsigned long addr)
-{
-	if (!tlb->fullmm) {
-		tlb->start = min(tlb->start, addr);
-		tlb->end = max(tlb->end, addr + PAGE_SIZE);
-	}
-}
-
-/*
- * Memorize the range for the TLB flush.
- */
-static inline void __tlb_remove_tlb_entry(struct mmu_gather *tlb, pte_t *ptep,
-					  unsigned long addr)
-{
-	tlb_add_flush(tlb, addr);
-}
-
-/*
- * In the case of tlb vma handling, we can optimise these away in the
- * case where we're doing a full MM flush.  When we're doing a munmap,
- * the vmas are adjusted to only cover the region to be torn down.
- */
-static inline void tlb_start_vma(struct mmu_gather *tlb,
-				 struct vm_area_struct *vma)
-{
-	if (!tlb->fullmm) {
-		tlb->start = TASK_SIZE;
-		tlb->end = 0;
 	}
 }
 
-static inline void tlb_end_vma(struct mmu_gather *tlb,
-			       struct vm_area_struct *vma)
-{
-	if (!tlb->fullmm)
-		tlb_flush(tlb);
-}
-
 static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
 				  unsigned long addr)
 {
+	__flush_tlb_pgtable(tlb->mm, addr);
 	pgtable_page_dtor(pte);
-	tlb_add_flush(tlb, addr);
 	tlb_remove_entry(tlb, pte);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:60 @ static inline void __pte_free_tlb(struct
 static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
 				  unsigned long addr)
 {
-	tlb_add_flush(tlb, addr);
+	__flush_tlb_pgtable(tlb->mm, addr);
 	tlb_remove_entry(tlb, virt_to_page(pmdp));
 }
 #endif
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:69 @ static inline void __pmd_free_tlb(struct
 static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pudp,
 				  unsigned long addr)
 {
-	tlb_add_flush(tlb, addr);
+	__flush_tlb_pgtable(tlb->mm, addr);
 	tlb_remove_entry(tlb, virt_to_page(pudp));
 }
 #endif
 
-static inline void __tlb_remove_pmd_tlb_entry(struct mmu_gather *tlb, pmd_t *pmdp,
-						unsigned long address)
-{
-	tlb_add_flush(tlb, address);
-}
-
 #endif
Index: linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/tlbflush.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/include/asm/tlbflush.h
+++ linux-3.18.13-rt10-r7s4/arch/arm64/include/asm/tlbflush.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:152 @ static inline void flush_tlb_kernel_rang
 }
 
 /*
+ * Used to invalidate the TLB (walk caches) corresponding to intermediate page
+ * table levels (pgd/pud/pmd).
+ */
+static inline void __flush_tlb_pgtable(struct mm_struct *mm,
+				       unsigned long uaddr)
+{
+	unsigned long addr = uaddr >> 12 | ((unsigned long)ASID(mm) << 48);
+
+	dsb(ishst);
+	asm("tlbi	vae1is, %0" : : "r" (addr));
+	dsb(ish);
+}
+/*
  * On AArch64, the cache coherency is handled via the set_pte_at() function.
  */
 static inline void update_mmu_cache(struct vm_area_struct *vma,
Index: linux-3.18.13-rt10-r7s4/arch/arm64/kernel/Makefile
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/kernel/Makefile
+++ linux-3.18.13-rt10-r7s4/arch/arm64/kernel/Makefile
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:18 @ arm64-obj-y		:= cputable.o debug-monitor
 			   entry-fpsimd.o process.o ptrace.o setup.o signal.o	\
 			   sys.o stacktrace.o time.o traps.o io.o vdso.o	\
 			   hyp-stub.o psci.o cpu_ops.o insn.o return_address.o	\
-			   cpuinfo.o
+			   cpuinfo.o cpu_errata.o alternative.o
 
 arm64-obj-$(CONFIG_COMPAT)		+= sys32.o kuser32.o signal32.o 	\
 					   sys_compat.o
Index: linux-3.18.13-rt10-r7s4/arch/arm64/kernel/alternative.c
===================================================================
--- /dev/null
+++ linux-3.18.13-rt10-r7s4/arch/arm64/kernel/alternative.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4 @
+/*
+ * alternative runtime patching
+ * inspired by the x86 version
+ *
+ * Copyright (C) 2014 ARM Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define pr_fmt(fmt) "alternatives: " fmt
+
+#include <linux/init.h>
+#include <linux/cpu.h>
+#include <asm/cacheflush.h>
+#include <asm/alternative.h>
+#include <asm/cpufeature.h>
+#include <linux/stop_machine.h>
+
+extern struct alt_instr __alt_instructions[], __alt_instructions_end[];
+
+static int __apply_alternatives(void *dummy)
+{
+	struct alt_instr *alt;
+	u8 *origptr, *replptr;
+
+	for (alt = __alt_instructions; alt < __alt_instructions_end; alt++) {
+		if (!cpus_have_cap(alt->cpufeature))
+			continue;
+
+		BUG_ON(alt->alt_len > alt->orig_len);
+
+		pr_info_once("patching kernel code\n");
+
+		origptr = (u8 *)&alt->orig_offset + alt->orig_offset;
+		replptr = (u8 *)&alt->alt_offset + alt->alt_offset;
+		memcpy(origptr, replptr, alt->alt_len);
+		flush_icache_range((uintptr_t)origptr,
+				   (uintptr_t)(origptr + alt->alt_len));
+	}
+
+	return 0;
+}
+
+void apply_alternatives(void)
+{
+	/* better not try code patching on a live SMP system */
+	stop_machine(__apply_alternatives, NULL, NULL);
+}
+
+void free_alternatives_memory(void)
+{
+	free_reserved_area(__alt_instructions, __alt_instructions_end,
+			   0, "alternatives");
+}
Index: linux-3.18.13-rt10-r7s4/arch/arm64/kernel/cpu_errata.c
===================================================================
--- /dev/null
+++ linux-3.18.13-rt10-r7s4/arch/arm64/kernel/cpu_errata.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4 @
+/*
+ * Contains CPU specific errata definitions
+ *
+ * Copyright (C) 2014 ARM Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define pr_fmt(fmt) "alternative: " fmt
+
+#include <linux/types.h>
+#include <asm/cpu.h>
+#include <asm/cputype.h>
+#include <asm/cpufeature.h>
+
+#define MIDR_CORTEX_A53 MIDR_CPU_PART(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53)
+#define MIDR_CORTEX_A57 MIDR_CPU_PART(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57)
+
+/*
+ * Add a struct or another datatype to the union below if you need
+ * different means to detect an affected CPU.
+ */
+struct arm64_cpu_capabilities {
+	const char *desc;
+	u16 capability;
+	bool (*is_affected)(struct arm64_cpu_capabilities *);
+	union {
+		struct {
+			u32 midr_model;
+			u32 midr_range_min, midr_range_max;
+		};
+	};
+};
+
+#define CPU_MODEL_MASK (MIDR_IMPLEMENTOR_MASK | MIDR_PARTNUM_MASK | \
+			MIDR_ARCHITECTURE_MASK)
+
+static bool __maybe_unused
+is_affected_midr_range(struct arm64_cpu_capabilities *entry)
+{
+	u32 midr = read_cpuid_id();
+
+	if ((midr & CPU_MODEL_MASK) != entry->midr_model)
+		return false;
+
+	midr &= MIDR_REVISION_MASK | MIDR_VARIANT_MASK;
+
+	return (midr >= entry->midr_range_min && midr <= entry->midr_range_max);
+}
+
+#define MIDR_RANGE(model, min, max) \
+	.is_affected = is_affected_midr_range, \
+	.midr_model = model, \
+	.midr_range_min = min, \
+	.midr_range_max = max
+
+struct arm64_cpu_capabilities arm64_errata[] = {
+#if	defined(CONFIG_ARM64_ERRATUM_826319) || \
+	defined(CONFIG_ARM64_ERRATUM_827319) || \
+	defined(CONFIG_ARM64_ERRATUM_824069)
+	{
+	/* Cortex-A53 r0p[012] */
+		.desc = "ARM errata 826319, 827319, 824069",
+		.capability = ARM64_WORKAROUND_CLEAN_CACHE,
+		MIDR_RANGE(MIDR_CORTEX_A53, 0x00, 0x02),
+	},
+#endif
+#ifdef CONFIG_ARM64_ERRATUM_819472
+	{
+	/* Cortex-A53 r0p[01] */
+		.desc = "ARM errata 819472",
+		.capability = ARM64_WORKAROUND_CLEAN_CACHE,
+		MIDR_RANGE(MIDR_CORTEX_A53, 0x00, 0x01),
+	},
+#endif
+#ifdef CONFIG_ARM64_ERRATUM_832075
+	{
+	/* Cortex-A57 r0p0 - r1p2 */
+		.desc = "ARM erratum 832075",
+		.capability = ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE,
+		MIDR_RANGE(MIDR_CORTEX_A57, 0x00,
+			   (1 << MIDR_VARIANT_SHIFT) | 2),
+	},
+#endif
+#ifdef CONFIG_ARM64_ERRATUM_845719
+	{
+	/* Cortex-A53 r0p[01234] */
+		.desc = "ARM erratum 845719",
+		.capability = ARM64_WORKAROUND_845719,
+		MIDR_RANGE(MIDR_CORTEX_A53, 0x00, 0x04),
+	},
+#endif
+	{
+	}
+};
+
+void check_local_cpu_errata(void)
+{
+	struct arm64_cpu_capabilities *cpus = arm64_errata;
+	int i;
+
+	for (i = 0; cpus[i].desc; i++) {
+		if (!cpus[i].is_affected(&cpus[i]))
+			continue;
+
+		if (!cpus_have_cap(cpus[i].capability))
+			pr_info("enabling workaround for %s\n", cpus[i].desc);
+		cpus_set_cap(cpus[i].capability);
+	}
+}
Index: linux-3.18.13-rt10-r7s4/arch/arm64/kernel/cpuinfo.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/kernel/cpuinfo.c
+++ linux-3.18.13-rt10-r7s4/arch/arm64/kernel/cpuinfo.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:21 @
 #include <asm/cachetype.h>
 #include <asm/cpu.h>
 #include <asm/cputype.h>
+#include <asm/cpufeature.h>
 
 #include <linux/bitops.h>
 #include <linux/bug.h>
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:190 @ static void __cpuinfo_store_cpu(struct c
 	info->reg_id_pfr1 = read_cpuid(ID_PFR1_EL1);
 
 	cpuinfo_detect_icache_policy(info);
+
+	check_local_cpu_errata();
 }
 
 void cpuinfo_store_cpu(void)
Index: linux-3.18.13-rt10-r7s4/arch/arm64/kernel/efi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/kernel/efi.c
+++ linux-3.18.13-rt10-r7s4/arch/arm64/kernel/efi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:330 @ void __init efi_idmap_init(void)
 
 	/* boot time idmap_pg_dir is incomplete, so fill in missing parts */
 	efi_setup_idmap();
+	early_memunmap(memmap.map, memmap.map_end - memmap.map);
 }
 
 static int __init remap_region(efi_memory_desc_t *md, void **new)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:385 @ static int __init arm64_enter_virtual_mo
 	}
 
 	mapsize = memmap.map_end - memmap.map;
-	early_memunmap(memmap.map, mapsize);
 
 	if (efi_runtime_disabled()) {
 		pr_info("EFI runtime services will be disabled.\n");
Index: linux-3.18.13-rt10-r7s4/arch/arm64/kernel/entry.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/kernel/entry.S
+++ linux-3.18.13-rt10-r7s4/arch/arm64/kernel/entry.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:24 @
 #include <linux/init.h>
 #include <linux/linkage.h>
 
+#include <asm/alternative-asm.h>
 #include <asm/assembler.h>
 #include <asm/asm-offsets.h>
+#include <asm/cpufeature.h>
 #include <asm/errno.h>
 #include <asm/esr.h>
 #include <asm/thread_info.h>
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:123 @
 	.if	\el == 0
 	ct_user_enter
 	ldr	x23, [sp, #S_SP]		// load return stack pointer
+
+#ifdef CONFIG_ARM64_ERRATUM_845719
+	alternative_insn						\
+	"nop",								\
+	"tbz x22, #4, 1f",						\
+	ARM64_WORKAROUND_845719
+#ifdef CONFIG_PID_IN_CONTEXTIDR
+	alternative_insn						\
+	"nop; nop",							\
+	"mrs x29, contextidr_el1; msr contextidr_el1, x29; 1:",		\
+	ARM64_WORKAROUND_845719
+#else
+	alternative_insn						\
+	"nop",								\
+	"msr contextidr_el1, xzr; 1:",					\
+	ARM64_WORKAROUND_845719
+#endif
+#endif
 	.endif
 	.if	\ret
 	ldr	x1, [sp, #S_X1]			// preserve x0 (syscall return)
Index: linux-3.18.13-rt10-r7s4/arch/arm64/kernel/setup.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/kernel/setup.c
+++ linux-3.18.13-rt10-r7s4/arch/arm64/kernel/setup.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:46 @
 #include <linux/of_fdt.h>
 #include <linux/of_platform.h>
 #include <linux/efi.h>
+#include <linux/personality.h>
 
 #include <asm/fixmap.h>
 #include <asm/cpu.h>
 #include <asm/cputype.h>
 #include <asm/elf.h>
 #include <asm/cputable.h>
+#include <asm/cpufeature.h>
 #include <asm/cpu_ops.h>
 #include <asm/sections.h>
 #include <asm/setup.h>
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:77 @ EXPORT_SYMBOL_GPL(elf_hwcap);
 				 COMPAT_HWCAP_FAST_MULT|COMPAT_HWCAP_EDSP|\
 				 COMPAT_HWCAP_TLS|COMPAT_HWCAP_VFP|\
 				 COMPAT_HWCAP_VFPv3|COMPAT_HWCAP_VFPv4|\
-				 COMPAT_HWCAP_NEON|COMPAT_HWCAP_IDIV)
+				 COMPAT_HWCAP_NEON|COMPAT_HWCAP_IDIV|\
+				 COMPAT_HWCAP_LPAE)
 unsigned int compat_elf_hwcap __read_mostly = COMPAT_ELF_HWCAP_DEFAULT;
 unsigned int compat_elf_hwcap2 __read_mostly;
 #endif
 
+DECLARE_BITMAP(cpu_hwcaps, NCAPS);
+
 static const char *cpu_name;
-static const char *machine_name;
 phys_addr_t __fdt_pointer __initdata;
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:317 @ static void __init setup_machine_fdt(phy
 		while (true)
 			cpu_relax();
 	}
-
-	machine_name = of_flat_dt_get_machine_name();
 }
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:398 @ void __init setup_arch(char **cmdline_p)
 	request_standard_resources();
 
 	efi_idmap_init();
+	early_ioremap_reset();
 
 	unflatten_device_tree();
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:453 @ static const char *hwcap_str[] = {
 	NULL
 };
 
+#ifdef CONFIG_COMPAT
+static const char *compat_hwcap_str[] = {
+	"swp",
+	"half",
+	"thumb",
+	"26bit",
+	"fastmult",
+	"fpa",
+	"vfp",
+	"edsp",
+	"java",
+	"iwmmxt",
+	"crunch",
+	"thumbee",
+	"neon",
+	"vfpv3",
+	"vfpv3d16",
+	"tls",
+	"vfpv4",
+	"idiva",
+	"idivt",
+	"vfpd32",
+	"lpae",
+	"evtstrm"
+};
+
+static const char *compat_hwcap2_str[] = {
+	"aes",
+	"pmull",
+	"sha1",
+	"sha2",
+	"crc32",
+	NULL
+};
+#endif /* CONFIG_COMPAT */
+
 static int c_show(struct seq_file *m, void *v)
 {
-	int i;
-
-	seq_printf(m, "Processor\t: %s rev %d (%s)\n",
-		   cpu_name, read_cpuid_id() & 15, ELF_PLATFORM);
+	int i, j;
 
 	for_each_online_cpu(i) {
+		struct cpuinfo_arm64 *cpuinfo = &per_cpu(cpu_data, i);
+		u32 midr = cpuinfo->reg_midr;
+
 		/*
 		 * glibc reads /proc/cpuinfo to determine the number of
 		 * online processors, looking for lines beginning with
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:505 @ static int c_show(struct seq_file *m, vo
 #ifdef CONFIG_SMP
 		seq_printf(m, "processor\t: %d\n", i);
 #endif
-	}
-
-	/* dump out the processor features */
-	seq_puts(m, "Features\t: ");
 
-	for (i = 0; hwcap_str[i]; i++)
-		if (elf_hwcap & (1 << i))
-			seq_printf(m, "%s ", hwcap_str[i]);
-
-	seq_printf(m, "\nCPU implementer\t: 0x%02x\n", read_cpuid_id() >> 24);
-	seq_printf(m, "CPU architecture: AArch64\n");
-	seq_printf(m, "CPU variant\t: 0x%x\n", (read_cpuid_id() >> 20) & 15);
-	seq_printf(m, "CPU part\t: 0x%03x\n", (read_cpuid_id() >> 4) & 0xfff);
-	seq_printf(m, "CPU revision\t: %d\n", read_cpuid_id() & 15);
-
-	seq_puts(m, "\n");
+		/*
+		 * Dump out the common processor features in a single line.
+		 * Userspace should read the hwcaps with getauxval(AT_HWCAP)
+		 * rather than attempting to parse this, but there's a body of
+		 * software which does already (at least for 32-bit).
+		 */
+		seq_puts(m, "Features\t:");
+		if (personality(current->personality) == PER_LINUX32) {
+#ifdef CONFIG_COMPAT
+			for (j = 0; compat_hwcap_str[j]; j++)
+				if (compat_elf_hwcap & (1 << j))
+					seq_printf(m, " %s", compat_hwcap_str[j]);
+
+			for (j = 0; compat_hwcap2_str[j]; j++)
+				if (compat_elf_hwcap2 & (1 << j))
+					seq_printf(m, " %s", compat_hwcap2_str[j]);
+#endif /* CONFIG_COMPAT */
+		} else {
+			for (j = 0; hwcap_str[j]; j++)
+				if (elf_hwcap & (1 << j))
+					seq_printf(m, " %s", hwcap_str[j]);
+		}
+		seq_puts(m, "\n");
 
-	seq_printf(m, "Hardware\t: %s\n", machine_name);
+		seq_printf(m, "CPU implementer\t: 0x%02x\n",
+			   MIDR_IMPLEMENTOR(midr));
+		seq_printf(m, "CPU architecture: 8\n");
+		seq_printf(m, "CPU variant\t: 0x%x\n", MIDR_VARIANT(midr));
+		seq_printf(m, "CPU part\t: 0x%03x\n", MIDR_PARTNUM(midr));
+		seq_printf(m, "CPU revision\t: %d\n\n", MIDR_REVISION(midr));
+	}
 
 	return 0;
 }
Index: linux-3.18.13-rt10-r7s4/arch/arm64/kernel/signal32.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/kernel/signal32.c
+++ linux-3.18.13-rt10-r7s4/arch/arm64/kernel/signal32.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:157 @ int copy_siginfo_to_user32(compat_siginf
 	case __SI_TIMER:
 		 err |= __put_user(from->si_tid, &to->si_tid);
 		 err |= __put_user(from->si_overrun, &to->si_overrun);
-		 err |= __put_user((compat_uptr_t)(unsigned long)from->si_ptr,
-				   &to->si_ptr);
+		 err |= __put_user(from->si_int, &to->si_int);
 		break;
 	case __SI_POLL:
 		err |= __put_user(from->si_band, &to->si_band);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:186 @ int copy_siginfo_to_user32(compat_siginf
 	case __SI_MESGQ: /* But this is */
 		err |= __put_user(from->si_pid, &to->si_pid);
 		err |= __put_user(from->si_uid, &to->si_uid);
-		err |= __put_user((compat_uptr_t)(unsigned long)from->si_ptr, &to->si_ptr);
+		err |= __put_user(from->si_int, &to->si_int);
 		break;
 	default: /* this is just in case for now ... */
 		err |= __put_user(from->si_pid, &to->si_pid);
Index: linux-3.18.13-rt10-r7s4/arch/arm64/kernel/sleep.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/kernel/sleep.S
+++ linux-3.18.13-rt10-r7s4/arch/arm64/kernel/sleep.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:150 @ cpu_resume_after_mmu:
 	ret
 ENDPROC(cpu_resume_after_mmu)
 
-	.data
 ENTRY(cpu_resume)
 	bl	el2_setup		// if in EL2 drop to EL1 cleanly
 #ifdef CONFIG_SMP
 	mrs	x1, mpidr_el1
-	adr	x4, mpidr_hash_ptr
-	ldr	x5, [x4]
-	add	x8, x4, x5		// x8 = struct mpidr_hash phys address
+	adrp	x8, mpidr_hash
+	add x8, x8, #:lo12:mpidr_hash // x8 = struct mpidr_hash phys address
         /* retrieve mpidr_hash members to compute the hash */
 	ldr	x2, [x8, #MPIDR_HASH_MASK]
 	ldp	w3, w4, [x8, #MPIDR_HASH_SHIFTS]
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:165 @ ENTRY(cpu_resume)
 #else
 	mov	x7, xzr
 #endif
-	adr	x0, sleep_save_sp
+	adrp	x0, sleep_save_sp
+	add	x0, x0, #:lo12:sleep_save_sp
 	ldr	x0, [x0, #SLEEP_SAVE_SP_PHYS]
 	ldr	x0, [x0, x7, lsl #3]
 	/* load sp from context */
 	ldr	x2, [x0, #CPU_CTX_SP]
-	adr	x1, sleep_idmap_phys
+	adrp	x1, sleep_idmap_phys
 	/* load physical address of identity map page table in x1 */
-	ldr	x1, [x1]
+	ldr	x1, [x1, #:lo12:sleep_idmap_phys]
 	mov	sp, x2
 	/*
 	 * cpu_do_resume expects x0 to contain context physical address
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:182 @ ENTRY(cpu_resume)
 	bl	cpu_do_resume		// PC relative jump, MMU off
 	b	cpu_resume_mmu		// Resume MMU, never returns
 ENDPROC(cpu_resume)
-
-	.align 3
-mpidr_hash_ptr:
-	/*
-	 * offset of mpidr_hash symbol from current location
-	 * used to obtain run-time mpidr_hash address with MMU off
-         */
-	.quad	mpidr_hash - .
-/*
- * physical address of identity mapped page tables
- */
-	.type	sleep_idmap_phys, #object
-ENTRY(sleep_idmap_phys)
-	.quad	0
-/*
- * struct sleep_save_sp {
- *	phys_addr_t *save_ptr_stash;
- *	phys_addr_t save_ptr_stash_phys;
- * };
- */
-	.type	sleep_save_sp, #object
-ENTRY(sleep_save_sp)
-	.space	SLEEP_SAVE_SP_SZ	// struct sleep_save_sp
Index: linux-3.18.13-rt10-r7s4/arch/arm64/kernel/smp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/kernel/smp.c
+++ linux-3.18.13-rt10-r7s4/arch/arm64/kernel/smp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:40 @
 #include <linux/of.h>
 #include <linux/irq_work.h>
 
+#include <asm/alternative.h>
 #include <asm/atomic.h>
 #include <asm/cacheflush.h>
 #include <asm/cpu.h>
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:313 @ void cpu_die(void)
 void __init smp_cpus_done(unsigned int max_cpus)
 {
 	pr_info("SMP: Total of %d processors activated.\n", num_online_cpus());
+	apply_alternatives();
 }
 
 void __init smp_prepare_boot_cpu(void)
Index: linux-3.18.13-rt10-r7s4/arch/arm64/kernel/suspend.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/kernel/suspend.c
+++ linux-3.18.13-rt10-r7s4/arch/arm64/kernel/suspend.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:8 @
 #include <asm/debug-monitors.h>
 #include <asm/pgtable.h>
 #include <asm/memory.h>
+#include <asm/mmu_context.h>
 #include <asm/smp_plat.h>
 #include <asm/suspend.h>
 #include <asm/tlbflush.h>
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:102 @ int __cpu_suspend(unsigned long arg, int
 	 */
 	ret = __cpu_suspend_enter(arg, fn);
 	if (ret == 0) {
-		cpu_switch_mm(mm->pgd, mm);
+		/*
+		 * We are resuming from reset with TTBR0_EL1 set to the
+		 * idmap to enable the MMU; restore the active_mm mappings in
+		 * TTBR0_EL1 unless the active_mm == &init_mm, in which case
+		 * the thread entered __cpu_suspend with TTBR0_EL1 set to
+		 * reserved TTBR0 page tables and should be restored as such.
+		 */
+		if (mm == &init_mm)
+			cpu_set_reserved_ttbr0();
+		else
+			cpu_switch_mm(mm->pgd, mm);
+
 		flush_tlb_all();
 
 		/*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:141 @ int __cpu_suspend(unsigned long arg, int
 	return ret;
 }
 
-extern struct sleep_save_sp sleep_save_sp;
-extern phys_addr_t sleep_idmap_phys;
+struct sleep_save_sp sleep_save_sp;
+phys_addr_t sleep_idmap_phys;
 
 static int __init cpu_suspend_init(void)
 {
Index: linux-3.18.13-rt10-r7s4/arch/arm64/kernel/vmlinux.lds.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/kernel/vmlinux.lds.S
+++ linux-3.18.13-rt10-r7s4/arch/arm64/kernel/vmlinux.lds.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:103 @ SECTIONS
 	. = ALIGN(PAGE_SIZE);
 	__init_end = .;
 
+	. = ALIGN(4);
+	.altinstructions : {
+		__alt_instructions = .;
+		*(.altinstructions)
+		__alt_instructions_end = .;
+	}
+	.altinstr_replacement : {
+		*(.altinstr_replacement)
+	}
+
+	. = ALIGN(PAGE_SIZE);
 	_data = .;
 	_sdata = .;
 	RW_DATA_SECTION(64, PAGE_SIZE, THREAD_SIZE)
Index: linux-3.18.13-rt10-r7s4/arch/arm64/mm/cache.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/mm/cache.S
+++ linux-3.18.13-rt10-r7s4/arch/arm64/mm/cache.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:23 @
 #include <linux/linkage.h>
 #include <linux/init.h>
 #include <asm/assembler.h>
+#include <asm/cpufeature.h>
+#include <asm/alternative-asm.h>
 
 #include "proc-macros.S"
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:215 @ __dma_clean_range:
 	dcache_line_size x2, x3
 	sub	x3, x2, #1
 	bic	x0, x0, x3
-1:	dc	cvac, x0			// clean D / U line
+1:	alternative_insn "dc cvac, x0", "dc civac, x0", ARM64_WORKAROUND_CLEAN_CACHE
 	add	x0, x0, x2
 	cmp	x0, x1
 	b.lo	1b
Index: linux-3.18.13-rt10-r7s4/arch/arm64/mm/dma-mapping.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/mm/dma-mapping.c
+++ linux-3.18.13-rt10-r7s4/arch/arm64/mm/dma-mapping.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:54 @ static int __init early_coherent_pool(ch
 }
 early_param("coherent_pool", early_coherent_pool);
 
-static void *__alloc_from_pool(size_t size, struct page **ret_page)
+static void *__alloc_from_pool(size_t size, struct page **ret_page, gfp_t flags)
 {
 	unsigned long val;
 	void *ptr = NULL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:70 @ static void *__alloc_from_pool(size_t si
 
 		*ret_page = phys_to_page(phys);
 		ptr = (void *)val;
+		if (flags & __GFP_ZERO)
+			memset(ptr, 0, size);
 	}
 
 	return ptr;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:106 @ static void *__dma_alloc_coherent(struct
 		flags |= GFP_DMA;
 	if (IS_ENABLED(CONFIG_DMA_CMA) && (flags & __GFP_WAIT)) {
 		struct page *page;
+		void *addr;
 
 		size = PAGE_ALIGN(size);
 		page = dma_alloc_from_contiguous(dev, size >> PAGE_SHIFT,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:115 @ static void *__dma_alloc_coherent(struct
 			return NULL;
 
 		*dma_handle = phys_to_dma(dev, page_to_phys(page));
-		return page_address(page);
+		addr = page_address(page);
+		if (flags & __GFP_ZERO)
+			memset(addr, 0, size);
+		return addr;
 	} else {
 		return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:154 @ static void *__dma_alloc_noncoherent(str
 
 	if (!(flags & __GFP_WAIT)) {
 		struct page *page = NULL;
-		void *addr = __alloc_from_pool(size, &page);
+		void *addr = __alloc_from_pool(size, &page, flags);
 
 		if (addr)
 			*dma_handle = phys_to_dma(dev, page_to_phys(page));
Index: linux-3.18.13-rt10-r7s4/arch/arm64/mm/init.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/mm/init.c
+++ linux-3.18.13-rt10-r7s4/arch/arm64/mm/init.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:42 @
 #include <asm/setup.h>
 #include <asm/sizes.h>
 #include <asm/tlb.h>
+#include <asm/alternative.h>
 
 #include "mm.h"
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:329 @ void __init mem_init(void)
 void free_initmem(void)
 {
 	free_initmem_default(0);
+	free_alternatives_memory();
 }
 
 #ifdef CONFIG_BLK_DEV_INITRD
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:338 @ static int keep_initrd;
 
 void free_initrd_mem(unsigned long start, unsigned long end)
 {
-	if (!keep_initrd) {
-		if (start == initrd_start)
-			start = round_down(start, PAGE_SIZE);
-		if (end == initrd_end)
-			end = round_up(end, PAGE_SIZE);
-
+	if (!keep_initrd)
 		free_reserved_area((void *)start, (void *)end, 0, "initrd");
-	}
 }
 
 static int __init keepinitrd_setup(char *__unused)
Index: linux-3.18.13-rt10-r7s4/arch/arm64/net/bpf_jit_comp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/arm64/net/bpf_jit_comp.c
+++ linux-3.18.13-rt10-r7s4/arch/arm64/net/bpf_jit_comp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:63 @ struct jit_ctx {
 	const struct bpf_prog *prog;
 	int idx;
 	int tmp_used;
-	int body_offset;
+	int epilogue_offset;
 	int *offset;
 	u32 *image;
 };
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:133 @ static void jit_fill_hole(void *area, un
 
 static inline int epilogue_offset(const struct jit_ctx *ctx)
 {
-	int to = ctx->offset[ctx->prog->len - 1];
-	int from = ctx->idx - ctx->body_offset;
+	int to = ctx->epilogue_offset;
+	int from = ctx->idx;
 
 	return to - from;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:466 @ emit_cond_jmp:
 	}
 	/* function return */
 	case BPF_JMP | BPF_EXIT:
+		/* Optimization: when last instruction is EXIT,
+		   simply fallthrough to epilogue. */
 		if (i == ctx->prog->len - 1)
 			break;
 		jmp_offset = epilogue_offset(ctx);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:690 @ void bpf_int_jit_compile(struct bpf_prog
 
 	/* 1. Initial fake pass to compute ctx->idx. */
 
-	/* Fake pass to fill in ctx->offset. */
+	/* Fake pass to fill in ctx->offset and ctx->tmp_used. */
 	if (build_body(&ctx))
 		goto out;
 
 	build_prologue(&ctx);
+
+	ctx.epilogue_offset = ctx.idx;
 	build_epilogue(&ctx);
 
 	/* Now we know the actual image size. */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:713 @ void bpf_int_jit_compile(struct bpf_prog
 
 	build_prologue(&ctx);
 
-	ctx.body_offset = ctx.idx;
 	if (build_body(&ctx)) {
 		bpf_jit_binary_free(header);
 		goto out;
Index: linux-3.18.13-rt10-r7s4/arch/avr32/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/avr32/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/avr32/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:145 @ good_area:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/cris/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/cris/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/cris/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:179 @ retry:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/frv/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/frv/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/frv/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:171 @ asmlinkage void do_page_fault(int datamm
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/ia64/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/ia64/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/ia64/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:175 @ retry:
 		 */
 		if (fault & VM_FAULT_OOM) {
 			goto out_of_memory;
+		} else if (fault & VM_FAULT_SIGSEGV) {
+			goto bad_area;
 		} else if (fault & VM_FAULT_SIGBUS) {
 			signal = SIGBUS;
 			goto bad_area;
Index: linux-3.18.13-rt10-r7s4/arch/m32r/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/m32r/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/m32r/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:203 @ good_area:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/m68k/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/m68k/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/m68k/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:148 @ good_area:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto map_err;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto bus_err;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/metag/include/asm/processor.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/metag/include/asm/processor.h
+++ linux-3.18.13-rt10-r7s4/arch/metag/include/asm/processor.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:152 @ extern void exit_thread(void);
 
 unsigned long get_wchan(struct task_struct *p);
 
-#define	KSTK_EIP(tsk)	((tsk)->thread.kernel_context->CurrPC)
-#define	KSTK_ESP(tsk)	((tsk)->thread.kernel_context->AX[0].U0)
+#define	KSTK_EIP(tsk)	(task_pt_regs(tsk)->ctx.CurrPC)
+#define	KSTK_ESP(tsk)	(task_pt_regs(tsk)->ctx.AX[0].U0)
 
 #define user_stack_pointer(regs)        ((regs)->ctx.AX[0].U0)
 
Index: linux-3.18.13-rt10-r7s4/arch/metag/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/metag/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/metag/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:144 @ good_area:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/microblaze/include/asm/tlb.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/microblaze/include/asm/tlb.h
+++ linux-3.18.13-rt10-r7s4/arch/microblaze/include/asm/tlb.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:17 @
 #define tlb_flush(tlb)	flush_tlb_mm((tlb)->mm)
 
 #include <linux/pagemap.h>
-#include <asm-generic/tlb.h>
 
 #ifdef CONFIG_MMU
 #define tlb_start_vma(tlb, vma)		do { } while (0)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:24 @
 #define __tlb_remove_tlb_entry(tlb, pte, address) do { } while (0)
 #endif
 
+#include <asm-generic/tlb.h>
+
 #endif /* _ASM_MICROBLAZE_TLB_H */
Index: linux-3.18.13-rt10-r7s4/arch/microblaze/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/microblaze/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/microblaze/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:227 @ good_area:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/mips/alchemy/common/clock.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/alchemy/common/clock.c
+++ linux-3.18.13-rt10-r7s4/arch/mips/alchemy/common/clock.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:131 @ static unsigned long alchemy_clk_cpu_rec
 		t = 396000000;
 	else {
 		t = alchemy_rdsys(AU1000_SYS_CPUPLL) & 0x7f;
+		if (alchemy_get_cputype() < ALCHEMY_CPU_AU1300)
+			t &= 0x3f;
 		t *= parent_rate;
 	}
 
Index: linux-3.18.13-rt10-r7s4/arch/mips/cavium-octeon/smp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/cavium-octeon/smp.c
+++ linux-3.18.13-rt10-r7s4/arch/mips/cavium-octeon/smp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:243 @ static int octeon_cpu_disable(void)
 
 	set_cpu_online(cpu, false);
 	cpu_clear(cpu, cpu_callin_map);
-	local_irq_disable();
 	octeon_fixup_irqs();
-	local_irq_enable();
 
 	flush_cache_all();
 	local_flush_tlb_all();
Index: linux-3.18.13-rt10-r7s4/arch/mips/include/asm/asmmacro.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/include/asm/asmmacro.h
+++ linux-3.18.13-rt10-r7s4/arch/mips/include/asm/asmmacro.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:307 @
 	.set	push
 	.set	noat
 	SET_HARDFLOAT
-	add	$1, \base, \off
+	addu	$1, \base, \off
 	.word	LDD_MSA_INSN | (\wd << 6)
 	.set	pop
 	.endm
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:316 @
 	.set	push
 	.set	noat
 	SET_HARDFLOAT
-	add	$1, \base, \off
+	addu	$1, \base, \off
 	.word	STD_MSA_INSN | (\wd << 6)
 	.set	pop
 	.endm
Index: linux-3.18.13-rt10-r7s4/arch/mips/include/asm/cpu-info.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/include/asm/cpu-info.h
+++ linux-3.18.13-rt10-r7s4/arch/mips/include/asm/cpu-info.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:87 @ struct cpuinfo_mips {
 	 * (shifted by _CACHE_SHIFT)
 	 */
 	unsigned int		writecombine;
+	/*
+	 * Simple counter to prevent enabling HTW in nested
+	 * htw_start/htw_stop calls
+	 */
+	unsigned int		htw_seq;
 } __attribute__((aligned(SMP_CACHE_BYTES)));
 
 extern struct cpuinfo_mips cpu_data[];
Index: linux-3.18.13-rt10-r7s4/arch/mips/include/asm/mipsregs.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/include/asm/mipsregs.h
+++ linux-3.18.13-rt10-r7s4/arch/mips/include/asm/mipsregs.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1346 @ do {									\
 	__res;								\
 })
 
+#define _write_32bit_cp1_register(dest, val, gas_hardfloat)		\
+do {									\
+	__asm__ __volatile__(						\
+	"	.set	push					\n"	\
+	"	.set	reorder					\n"	\
+	"	"STR(gas_hardfloat)"				\n"	\
+	"	ctc1	%0,"STR(dest)"				\n"	\
+	"	.set	pop					\n"	\
+	: : "r" (val));							\
+} while (0)
+
 #ifdef GAS_HAS_SET_HARDFLOAT
 #define read_32bit_cp1_register(source)					\
 	_read_32bit_cp1_register(source, .set hardfloat)
+#define write_32bit_cp1_register(dest, val)				\
+	_write_32bit_cp1_register(dest, val, .set hardfloat)
 #else
 #define read_32bit_cp1_register(source)					\
 	_read_32bit_cp1_register(source, )
+#define write_32bit_cp1_register(dest, val)				\
+	_write_32bit_cp1_register(dest, val, )
 #endif
 
 #ifdef HAVE_AS_DSP
Index: linux-3.18.13-rt10-r7s4/arch/mips/include/asm/mmu_context.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/include/asm/mmu_context.h
+++ linux-3.18.13-rt10-r7s4/arch/mips/include/asm/mmu_context.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:28 @ do {									\
 	if (cpu_has_htw) {						\
 		write_c0_pwbase(pgd);					\
 		back_to_back_c0_hazard();				\
-		htw_reset();						\
 	}								\
 } while (0)
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:144 @ static inline void switch_mm(struct mm_s
 	unsigned long flags;
 	local_irq_save(flags);
 
+	htw_stop();
 	/* Check if our ASID is of an older version and thus invalid */
 	if ((cpu_context(cpu, next) ^ asid_cache(cpu)) & ASID_VERSION_MASK)
 		get_new_mmu_context(next, cpu);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:157 @ static inline void switch_mm(struct mm_s
 	 */
 	cpumask_clear_cpu(cpu, mm_cpumask(prev));
 	cpumask_set_cpu(cpu, mm_cpumask(next));
+	htw_start();
 
 	local_irq_restore(flags);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:184 @ activate_mm(struct mm_struct *prev, stru
 
 	local_irq_save(flags);
 
+	htw_stop();
 	/* Unconditionally get a new ASID.  */
 	get_new_mmu_context(next, cpu);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:194 @ activate_mm(struct mm_struct *prev, stru
 	/* mark mmu ownership change */
 	cpumask_clear_cpu(cpu, mm_cpumask(prev));
 	cpumask_set_cpu(cpu, mm_cpumask(next));
+	htw_start();
 
 	local_irq_restore(flags);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:209 @ drop_mmu_context(struct mm_struct *mm, u
 	unsigned long flags;
 
 	local_irq_save(flags);
+	htw_stop();
 
 	if (cpumask_test_cpu(cpu, mm_cpumask(mm)))  {
 		get_new_mmu_context(mm, cpu);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:218 @ drop_mmu_context(struct mm_struct *mm, u
 		/* will get a new context next time */
 		cpu_context(cpu, mm) = 0;
 	}
+	htw_start();
 	local_irq_restore(flags);
 }
 
Index: linux-3.18.13-rt10-r7s4/arch/mips/include/asm/pgtable.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/include/asm/pgtable.h
+++ linux-3.18.13-rt10-r7s4/arch/mips/include/asm/pgtable.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:102 @ extern void paging_init(void);
 
 #define htw_stop()							\
 do {									\
-	if (cpu_has_htw)						\
-		write_c0_pwctl(read_c0_pwctl() &			\
-			       ~(1 << MIPS_PWCTL_PWEN_SHIFT));		\
+	unsigned long flags;						\
+									\
+	if (cpu_has_htw) {						\
+		local_irq_save(flags);					\
+		if(!raw_current_cpu_data.htw_seq++) {			\
+			write_c0_pwctl(read_c0_pwctl() &		\
+				       ~(1 << MIPS_PWCTL_PWEN_SHIFT));	\
+			back_to_back_c0_hazard();			\
+		}							\
+		local_irq_restore(flags);				\
+	}								\
 } while(0)
 
 #define htw_start()							\
 do {									\
-	if (cpu_has_htw)						\
-		write_c0_pwctl(read_c0_pwctl() |			\
-			       (1 << MIPS_PWCTL_PWEN_SHIFT));		\
-} while(0)
-
-
-#define htw_reset()							\
-do {									\
+	unsigned long flags;						\
+									\
 	if (cpu_has_htw) {						\
-		htw_stop();						\
-		back_to_back_c0_hazard();				\
-		htw_start();						\
-		back_to_back_c0_hazard();				\
+		local_irq_save(flags);					\
+		if (!--raw_current_cpu_data.htw_seq) {			\
+			write_c0_pwctl(read_c0_pwctl() |		\
+				       (1 << MIPS_PWCTL_PWEN_SHIFT));	\
+			back_to_back_c0_hazard();			\
+		}							\
+		local_irq_restore(flags);				\
 	}								\
 } while(0)
 
+
 extern void set_pte_at(struct mm_struct *mm, unsigned long addr, pte_t *ptep,
 	pte_t pteval);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:162 @ static inline void pte_clear(struct mm_s
 {
 	pte_t null = __pte(0);
 
+	htw_stop();
 	/* Preserve global status for the pair */
 	if (ptep_buddy(ptep)->pte_low & _PAGE_GLOBAL)
 		null.pte_low = null.pte_high = _PAGE_GLOBAL;
 
 	set_pte_at(mm, addr, ptep, null);
-	htw_reset();
+	htw_start();
 }
 #else
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:198 @ static inline void set_pte(pte_t *ptep,
 
 static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 {
+	htw_stop();
 #if !defined(CONFIG_CPU_R3000) && !defined(CONFIG_CPU_TX39XX)
 	/* Preserve global status for the pair */
 	if (pte_val(*ptep_buddy(ptep)) & _PAGE_GLOBAL)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:206 @ static inline void pte_clear(struct mm_s
 	else
 #endif
 		set_pte_at(mm, addr, ptep, __pte(0));
-	htw_reset();
+	htw_start();
 }
 #endif
 
Index: linux-3.18.13-rt10-r7s4/arch/mips/kernel/cps-vec.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/kernel/cps-vec.S
+++ linux-3.18.13-rt10-r7s4/arch/mips/kernel/cps-vec.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:102 @ not_nmi:
 	xori	t2, t1, 0x7
 	beqz	t2, 1f
 	 li	t3, 32
-	addi	t1, t1, 1
+	addiu	t1, t1, 1
 	sllv	t1, t3, t1
 1:	/* At this point t1 == I-cache sets per way */
 	_EXT	t2, v0, MIPS_CONF1_IA_SHF, MIPS_CONF1_IA_SZ
-	addi	t2, t2, 1
+	addiu	t2, t2, 1
 	mul	t1, t1, t0
 	mul	t1, t1, t2
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:129 @ icache_done:
 	xori	t2, t1, 0x7
 	beqz	t2, 1f
 	 li	t3, 32
-	addi	t1, t1, 1
+	addiu	t1, t1, 1
 	sllv	t1, t3, t1
 1:	/* At this point t1 == D-cache sets per way */
 	_EXT	t2, v0, MIPS_CONF1_DA_SHF, MIPS_CONF1_DA_SZ
-	addi	t2, t2, 1
+	addiu	t2, t2, 1
 	mul	t1, t1, t0
 	mul	t1, t1, t2
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:253 @ LEAF(mips_cps_core_init)
 	mfc0	t0, CP0_MVPCONF0
 	srl	t0, t0, MVPCONF0_PVPE_SHIFT
 	andi	t0, t0, (MVPCONF0_PVPE >> MVPCONF0_PVPE_SHIFT)
-	addi	t7, t0, 1
+	addiu	t7, t0, 1
 
 	/* If there's only 1, we're done */
 	beqz	t0, 2f
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:283 @ LEAF(mips_cps_core_init)
 	mttc0	t0, CP0_TCHALT
 
 	/* Next VPE */
-	addi	t5, t5, 1
+	addiu	t5, t5, 1
 	slt	t0, t5, t7
 	bnez	t0, 1b
 	 nop
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:320 @ LEAF(mips_cps_boot_vpes)
 	mfc0	t1, CP0_MVPCONF0
 	srl	t1, t1, MVPCONF0_PVPE_SHIFT
 	andi	t1, t1, MVPCONF0_PVPE >> MVPCONF0_PVPE_SHIFT
-	addi	t1, t1, 1
+	addiu	t1, t1, 1
 
 	/* Calculate a mask for the VPE ID from EBase.CPUNum */
 	clz	t1, t1
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:427 @ LEAF(mips_cps_boot_vpes)
 
 	/* Next VPE */
 2:	srl	t6, t6, 1
-	addi	t5, t5, 1
+	addiu	t5, t5, 1
 	bnez	t6, 1b
 	 nop
 
Index: linux-3.18.13-rt10-r7s4/arch/mips/kernel/cpu-probe.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/kernel/cpu-probe.c
+++ linux-3.18.13-rt10-r7s4/arch/mips/kernel/cpu-probe.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:370 @ static inline unsigned int decode_config
 	if (config3 & MIPS_CONF3_MSA)
 		c->ases |= MIPS_ASE_MSA;
 	/* Only tested on 32-bit cores */
-	if ((config3 & MIPS_CONF3_PW) && config_enabled(CONFIG_32BIT))
+	if ((config3 & MIPS_CONF3_PW) && config_enabled(CONFIG_32BIT)) {
+		c->htw_seq = 0;
 		c->options |= MIPS_CPU_HTW;
+	}
 
 	return config3 & MIPS_CONF_M;
 }
Index: linux-3.18.13-rt10-r7s4/arch/mips/kernel/irq_cpu.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/kernel/irq_cpu.c
+++ linux-3.18.13-rt10-r7s4/arch/mips/kernel/irq_cpu.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:59 @ static struct irq_chip mips_cpu_irq_cont
 	.irq_mask_ack	= mask_mips_irq,
 	.irq_unmask	= unmask_mips_irq,
 	.irq_eoi	= unmask_mips_irq,
+	.irq_disable	= mask_mips_irq,
+	.irq_enable	= unmask_mips_irq,
 };
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:97 @ static struct irq_chip mips_mt_cpu_irq_c
 	.irq_mask_ack	= mips_mt_cpu_irq_ack,
 	.irq_unmask	= unmask_mips_irq,
 	.irq_eoi	= unmask_mips_irq,
+	.irq_disable	= mask_mips_irq,
+	.irq_enable	= unmask_mips_irq,
 };
 
 void __init mips_cpu_irq_init(void)
Index: linux-3.18.13-rt10-r7s4/arch/mips/kernel/mips_ksyms.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/kernel/mips_ksyms.c
+++ linux-3.18.13-rt10-r7s4/arch/mips/kernel/mips_ksyms.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:17 @
 #include <linux/mm.h>
 #include <asm/uaccess.h>
 #include <asm/ftrace.h>
+#include <asm/fpu.h>
+#include <asm/msa.h>
 
 extern void *__bzero(void *__s, size_t __count);
 extern long __strncpy_from_kernel_nocheck_asm(char *__to,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:39 @ extern long __strnlen_user_nocheck_asm(c
 extern long __strnlen_user_asm(const char *s);
 
 /*
+ * Core architecture code
+ */
+EXPORT_SYMBOL_GPL(_save_fp);
+#ifdef CONFIG_CPU_HAS_MSA
+EXPORT_SYMBOL_GPL(_save_msa);
+#endif
+
+/*
  * String functions
  */
 EXPORT_SYMBOL(memset);
Index: linux-3.18.13-rt10-r7s4/arch/mips/kernel/smp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/kernel/smp.c
+++ linux-3.18.13-rt10-r7s4/arch/mips/kernel/smp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:126 @ asmlinkage void start_secondary(void)
 	unsigned int cpu;
 
 	cpu_probe();
-	cpu_report();
 	per_cpu_trap_init(false);
 	mips_clockevent_init();
 	mp_ops->init_secondary();
+	cpu_report();
 
 	/*
 	 * XXX parity protection should be folded in here when it's converted
Index: linux-3.18.13-rt10-r7s4/arch/mips/kernel/traps.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/kernel/traps.c
+++ linux-3.18.13-rt10-r7s4/arch/mips/kernel/traps.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1187 @ static int enable_restore_fp_context(int
 
 		/* Restore the scalar FP control & status register */
 		if (!was_fpu_owner)
-			asm volatile("ctc1 %0, $31" : : "r"(current->thread.fpu.fcr31));
+			write_32bit_cp1_register(CP1_STATUS,
+						 current->thread.fpu.fcr31);
 	}
 
 out:
Index: linux-3.18.13-rt10-r7s4/arch/mips/kvm/locore.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/kvm/locore.S
+++ linux-3.18.13-rt10-r7s4/arch/mips/kvm/locore.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:437 @ __kvm_mips_return_to_guest:
 	/* Setup status register for running guest in UM */
 	.set	at
 	or	v1, v1, (ST0_EXL | KSU_USER | ST0_IE)
-	and	v1, v1, ~ST0_CU0
+	and	v1, v1, ~(ST0_CU0 | ST0_MX)
 	.set	noat
 	mtc0	v1, CP0_STATUS
 	ehb
Index: linux-3.18.13-rt10-r7s4/arch/mips/kvm/mips.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/kvm/mips.c
+++ linux-3.18.13-rt10-r7s4/arch/mips/kvm/mips.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:18 @
 #include <linux/vmalloc.h>
 #include <linux/fs.h>
 #include <linux/bootmem.h>
+#include <asm/fpu.h>
 #include <asm/page.h>
 #include <asm/cacheflush.h>
 #include <asm/mmu_context.h>
+#include <asm/pgtable.h>
 
 #include <linux/kvm_host.h>
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:383 @ int kvm_arch_vcpu_ioctl_run(struct kvm_v
 		vcpu->mmio_needed = 0;
 	}
 
+	lose_fpu(1);
+
 	local_irq_disable();
 	/* Check if we have any exceptions/interrupts pending */
 	kvm_mips_deliver_interrupts(vcpu,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:392 @ int kvm_arch_vcpu_ioctl_run(struct kvm_v
 
 	kvm_guest_enter();
 
+	/* Disable hardware page table walking while in guest */
+	htw_stop();
+
 	r = __kvm_mips_vcpu_run(run, vcpu);
 
+	/* Re-enable HTW before enabling interrupts */
+	htw_start();
+
 	kvm_guest_exit();
 	local_irq_enable();
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:993 @ static void kvm_mips_set_c0_status(void)
 {
 	uint32_t status = read_c0_status();
 
-	if (cpu_has_fpu)
-		status |= (ST0_CU1);
-
 	if (cpu_has_dsp)
 		status |= (ST0_MX);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1012 @ int kvm_mips_handle_exit(struct kvm_run
 	enum emulation_result er = EMULATE_DONE;
 	int ret = RESUME_GUEST;
 
+	/* re-enable HTW before enabling interrupts */
+	htw_start();
+
 	/* Set a default exit reason */
 	run->exit_reason = KVM_EXIT_UNKNOWN;
 	run->ready_for_interrupt_injection = 1;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1149 @ skip_emul:
 		}
 	}
 
+	/* Disable HTW before returning to guest or host */
+	htw_stop();
+
 	return ret;
 }
 
Index: linux-3.18.13-rt10-r7s4/arch/mips/kvm/trace.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/kvm/trace.h
+++ linux-3.18.13-rt10-r7s4/arch/mips/kvm/trace.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:27 @ TRACE_EVENT(kvm_exit,
 	    TP_PROTO(struct kvm_vcpu *vcpu, unsigned int reason),
 	    TP_ARGS(vcpu, reason),
 	    TP_STRUCT__entry(
-			__field(struct kvm_vcpu *, vcpu)
+			__field(unsigned long, pc)
 			__field(unsigned int, reason)
 	    ),
 
 	    TP_fast_assign(
-			__entry->vcpu = vcpu;
+			__entry->pc = vcpu->arch.pc;
 			__entry->reason = reason;
 	    ),
 
 	    TP_printk("[%s]PC: 0x%08lx",
 		      kvm_mips_exit_types_str[__entry->reason],
-		      __entry->vcpu->arch.pc)
+		      __entry->pc)
 );
 
 #endif /* _TRACE_KVM_H */
Index: linux-3.18.13-rt10-r7s4/arch/mips/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/mips/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:161 @ good_area:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/mips/mm/tlb-r4k.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/mm/tlb-r4k.c
+++ linux-3.18.13-rt10-r7s4/arch/mips/mm/tlb-r4k.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:492 @ static void r4k_tlb_configure(void)
 #ifdef CONFIG_64BIT
 		pg |= PG_ELPA;
 #endif
+		if (cpu_has_rixiex)
+			pg |= PG_IEC;
 		write_c0_pagegrain(pg);
 	}
 
Index: linux-3.18.13-rt10-r7s4/arch/mips/net/bpf_jit.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mips/net/bpf_jit.c
+++ linux-3.18.13-rt10-r7s4/arch/mips/net/bpf_jit.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:429 @ static inline void emit_mod(unsigned int
 		u32 *p = &ctx->target[ctx->idx];
 		uasm_i_divu(&p, dst, src);
 		p = &ctx->target[ctx->idx + 1];
-		uasm_i_mflo(&p, dst);
+		uasm_i_mfhi(&p, dst);
 	}
 	ctx->idx += 2; /* 2 insts */
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:974 @ load_ind:
 			break;
 		case BPF_ALU | BPF_MOD | BPF_K:
 			/* A %= k */
-			if (k == 1 || optimize_div(&k)) {
+			if (k == 1) {
 				ctx->flags |= SEEN_A;
 				emit_jit_reg_move(r_A, r_zero, ctx);
 			} else {
Index: linux-3.18.13-rt10-r7s4/arch/mn10300/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/mn10300/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/mn10300/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:265 @ good_area:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/openrisc/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/openrisc/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/openrisc/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:174 @ good_area:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/parisc/include/asm/ldcw.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/parisc/include/asm/ldcw.h
+++ linux-3.18.13-rt10-r7s4/arch/parisc/include/asm/ldcw.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:36 @
 
 #endif /*!CONFIG_PA20*/
 
-/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*.  */
+/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*.
+   We don't explicitly expose that "*a" may be written as reload
+   fails to find a register in class R1_REGS when "a" needs to be
+   reloaded when generating 64-bit PIC code.  Instead, we clobber
+   memory to indicate to the compiler that the assembly code reads
+   or writes to items other than those listed in the input and output
+   operands.  This may pessimize the code somewhat but __ldcw is
+   usually used within code blocks surrounded by memory barriors.  */
 #define __ldcw(a) ({						\
 	unsigned __ret;						\
-	__asm__ __volatile__(__LDCW " 0(%2),%0"			\
-		: "=r" (__ret), "+m" (*(a)) : "r" (a));		\
+	__asm__ __volatile__(__LDCW " 0(%1),%0"			\
+		: "=r" (__ret) : "r" (a) : "memory");		\
 	__ret;							\
 })
 
Index: linux-3.18.13-rt10-r7s4/arch/parisc/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/parisc/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/parisc/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:259 @ good_area:
 		 */
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto bad_area;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:53 @ ethernet@b0000 {
 	fsl,num_tx_queues = <0x8>;
 	fsl,magic-packet;
 	local-mac-address = [ 00 00 00 00 00 00 ];
+	ranges;
 
 	queue-group@b0000 {
 		#address-cells = <1>;
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:53 @ ethernet@b1000 {
 	fsl,num_tx_queues = <0x8>;
 	fsl,magic-packet;
 	local-mac-address = [ 00 00 00 00 00 00 ];
+	ranges;
 
 	queue-group@b1000 {
 		#address-cells = <1>;
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:52 @ ethernet@b2000 {
 	fsl,num_tx_queues = <0x8>;
 	fsl,magic-packet;
 	local-mac-address = [ 00 00 00 00 00 00 ];
+	ranges;
 
 	queue-group@b2000 {
 		#address-cells = <1>;
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/crypto/sha1.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/crypto/sha1.c
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/crypto/sha1.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:157 @ module_exit(sha1_powerpc_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm");
 
-MODULE_ALIAS("sha1-powerpc");
+MODULE_ALIAS_CRYPTO("sha1");
+MODULE_ALIAS_CRYPTO("sha1-powerpc");
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/include/asm/cputhreads.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/include/asm/cputhreads.h
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/include/asm/cputhreads.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:58 @ static inline cpumask_t cpu_thread_mask_
 
 static inline int cpu_nr_cores(void)
 {
-	return NR_CPUS >> threads_shift;
+	return nr_cpu_ids >> threads_shift;
 }
 
 static inline cpumask_t cpu_online_cores_map(void)
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/include/asm/irq_work.h
===================================================================
--- /dev/null
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/include/asm/irq_work.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4 @
+#ifndef _ASM_POWERPC_IRQ_WORK_H
+#define _ASM_POWERPC_IRQ_WORK_H
+
+static inline bool arch_irq_work_has_interrupt(void)
+{
+	return true;
+}
+
+#endif /* _ASM_POWERPC_IRQ_WORK_H */
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/include/asm/pgalloc.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/include/asm/pgalloc.h
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/include/asm/pgalloc.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6 @
 #ifdef __KERNEL__
 
 #include <linux/mm.h>
-#include <asm-generic/tlb.h>
 
 #ifdef CONFIG_PPC_BOOK3E
 extern void tlb_flush_pgtable(struct mmu_gather *tlb, unsigned long address);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:16 @ static inline void tlb_flush_pgtable(str
 }
 #endif /* !CONFIG_PPC_BOOK3E */
 
+extern void tlb_remove_table(struct mmu_gather *tlb, void *table);
+
 #ifdef CONFIG_PPC64
 #include <asm/pgalloc-64.h>
 #else
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/include/asm/pnv-pci.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/include/asm/pnv-pci.h
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/include/asm/pnv-pci.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:22 @ int pnv_cxl_ioda_msi_setup(struct pci_de
 int pnv_cxl_alloc_hwirqs(struct pci_dev *dev, int num);
 void pnv_cxl_release_hwirqs(struct pci_dev *dev, int hwirq, int num);
 int pnv_cxl_get_irq_count(struct pci_dev *dev);
-struct device_node *pnv_pci_to_phb_node(struct pci_dev *dev);
+struct device_node *pnv_pci_get_phb_node(struct pci_dev *dev);
 
 #ifdef CONFIG_CXL_BASE
 int pnv_cxl_alloc_hwirq_ranges(struct cxl_irq_ranges *irqs,
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/include/asm/reg.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/include/asm/reg.h
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/include/asm/reg.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:121 @
 #define __MSR		(MSR_ME | MSR_RI | MSR_IR | MSR_DR | MSR_ISF |MSR_HV)
 #ifdef __BIG_ENDIAN__
 #define MSR_		__MSR
+#define MSR_IDLE	(MSR_ME | MSR_SF | MSR_HV)
 #else
 #define MSR_		(__MSR | MSR_LE)
+#define MSR_IDLE	(MSR_ME | MSR_SF | MSR_HV | MSR_LE)
 #endif
 #define MSR_KERNEL	(MSR_ | MSR_64BIT)
 #define MSR_USER32	(MSR_ | MSR_PR | MSR_EE)
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/include/asm/syscall.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/include/asm/syscall.h
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/include/asm/syscall.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:93 @ static inline void syscall_set_arguments
 
 static inline int syscall_get_arch(void)
 {
-	return is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64;
+	int arch = is_32bit_task() ? AUDIT_ARCH_PPC : AUDIT_ARCH_PPC64;
+#ifdef __LITTLE_ENDIAN__
+	arch |= __AUDIT_ARCH_LE;
+#endif
+	return arch;
 }
 #endif	/* _ASM_SYSCALL_H */
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/include/asm/tlb.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/include/asm/tlb.h
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/include/asm/tlb.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:30 @
 
 #define tlb_start_vma(tlb, vma)	do { } while (0)
 #define tlb_end_vma(tlb, vma)	do { } while (0)
+#define __tlb_remove_tlb_entry	__tlb_remove_tlb_entry
 
 extern void tlb_flush(struct mmu_gather *tlb);
 
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/kernel/exceptions-64s.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/kernel/exceptions-64s.S
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/kernel/exceptions-64s.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1402 @ machine_check_handle_early:
 	bne	9f			/* continue in V mode if we are. */
 
 5:
-#ifdef CONFIG_KVM_BOOK3S_64_HV
+#ifdef CONFIG_KVM_BOOK3S_64_HANDLER
 	/*
 	 * We are coming from kernel context. Check if we are coming from
 	 * guest. if yes, then we can continue. We will fall through
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/kernel/idle_power7.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/kernel/idle_power7.S
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/kernel/idle_power7.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:104 @ _GLOBAL(power7_powersave_common)
 	std	r9,_MSR(r1)
 	std	r1,PACAR1(r13)
 
-_GLOBAL(power7_enter_nap_mode)
+	/*
+	 * Go to real mode to do the nap, as required by the architecture.
+	 * Also, we need to be in real mode before setting hwthread_state,
+	 * because as soon as we do that, another thread can switch
+	 * the MMU context to the guest.
+	 */
+	LOAD_REG_IMMEDIATE(r5, MSR_IDLE)
+	li	r6, MSR_RI
+	andc	r6, r9, r6
+	LOAD_REG_ADDR(r7, power7_enter_nap_mode)
+	mtmsrd	r6, 1		/* clear RI before setting SRR0/1 */
+	mtspr	SPRN_SRR0, r7
+	mtspr	SPRN_SRR1, r5
+	rfid
+
+	.globl	power7_enter_nap_mode
+power7_enter_nap_mode:
 #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
 	/* Tell KVM we're napping */
 	li	r4,KVM_HWTHREAD_IN_NAP
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/kernel/mce_power.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/kernel/mce_power.c
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/kernel/mce_power.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:82 @ static long mce_handle_derror(uint64_t d
 	}
 	if (dsisr & P7_DSISR_MC_TLB_MULTIHIT_MFTLB) {
 		if (cur_cpu_spec && cur_cpu_spec->flush_tlb)
-			cur_cpu_spec->flush_tlb(TLBIEL_INVAL_PAGE);
+			cur_cpu_spec->flush_tlb(TLBIEL_INVAL_SET);
 		/* reset error bits */
 		dsisr &= ~P7_DSISR_MC_TLB_MULTIHIT_MFTLB;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:113 @ static long mce_handle_common_ierror(uin
 		break;
 	case P7_SRR1_MC_IFETCH_TLB_MULTIHIT:
 		if (cur_cpu_spec && cur_cpu_spec->flush_tlb) {
-			cur_cpu_spec->flush_tlb(TLBIEL_INVAL_PAGE);
+			cur_cpu_spec->flush_tlb(TLBIEL_INVAL_SET);
 			handled = 1;
 		}
 		break;
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/kernel/udbg_16550.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/kernel/udbg_16550.c
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/kernel/udbg_16550.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:72 @ static void udbg_uart_putc(char c)
 
 static int udbg_uart_getc_poll(void)
 {
-	if (!udbg_uart_in || !(udbg_uart_in(UART_LSR) & LSR_DR))
+	if (!udbg_uart_in)
+		return -1;
+
+	if (!(udbg_uart_in(UART_LSR) & LSR_DR))
 		return udbg_uart_in(UART_RBR);
+
 	return -1;
 }
 
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/mm/copro_fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/mm/copro_fault.c
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/mm/copro_fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:79 @ int copro_handle_mm_fault(struct mm_stru
 		if (*flt & VM_FAULT_OOM) {
 			ret = -ENOMEM;
 			goto out_unlock;
-		} else if (*flt & VM_FAULT_SIGBUS) {
+		} else if (*flt & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) {
 			ret = -EFAULT;
 			goto out_unlock;
 		}
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:447 @ good_area:
 	 */
 	fault = handle_mm_fault(mm, vma, address, flags);
 	if (unlikely(fault & (VM_FAULT_RETRY|VM_FAULT_ERROR))) {
+		if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		rc = mm_fault_error(regs, address, fault);
 		if (rc >= MM_FAULT_RETURN)
 			goto bail;
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/mm/hugetlbpage.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/mm/hugetlbpage.c
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/mm/hugetlbpage.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:520 @ static void free_hugepd_range(struct mmu
 	for (i = 0; i < num_hugepd; i++, hpdp++)
 		hpdp->pd = 0;
 
-	tlb->need_flush = 1;
-
 #ifdef CONFIG_PPC_FSL_BOOK3E
 	hugepd_free(tlb, hugepte);
 #else
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/perf/hv-24x7.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/perf/hv-24x7.c
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/perf/hv-24x7.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:220 @ static bool is_physical_domain(int domai
 		domain == HV_24X7_PERF_DOMAIN_PHYSICAL_CORE;
 }
 
+DEFINE_PER_CPU(char, hv_24x7_reqb[4096]) __aligned(4096);
+DEFINE_PER_CPU(char, hv_24x7_resb[4096]) __aligned(4096);
+
 static unsigned long single_24x7_request(u8 domain, u32 offset, u16 ix,
 					 u16 lpar, u64 *res,
 					 bool success_expected)
 {
-	unsigned long ret = -ENOMEM;
+	unsigned long ret;
 
 	/*
 	 * request_buffer and result_buffer are not required to be 4k aligned,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:249 @ static unsigned long single_24x7_request
 	BUILD_BUG_ON(sizeof(*request_buffer) > 4096);
 	BUILD_BUG_ON(sizeof(*result_buffer) > 4096);
 
-	request_buffer = kmem_cache_zalloc(hv_page_cache, GFP_USER);
-	if (!request_buffer)
-		goto out;
+	request_buffer = (void *)get_cpu_var(hv_24x7_reqb);
+	result_buffer = (void *)get_cpu_var(hv_24x7_resb);
 
-	result_buffer = kmem_cache_zalloc(hv_page_cache, GFP_USER);
-	if (!result_buffer)
-		goto out_free_request_buffer;
+	memset(request_buffer, 0, 4096);
+	memset(result_buffer, 0, 4096);
 
 	*request_buffer = (struct reqb) {
 		.buf = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:282 @ static unsigned long single_24x7_request
 				domain, offset, ix, lpar, ret, ret,
 				result_buffer->buf.detailed_rc,
 				result_buffer->buf.failing_request_ix);
-		goto out_free_result_buffer;
+		goto out;
 	}
 
 	*res = be64_to_cpu(result_buffer->result);
 
-out_free_result_buffer:
-	kfree(result_buffer);
-out_free_request_buffer:
-	kfree(request_buffer);
 out:
 	return ret;
 }
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/platforms/cell/spufs/inode.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/platforms/cell/spufs/inode.c
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/platforms/cell/spufs/inode.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:167 @ static void spufs_prune_dir(struct dentr
 	struct dentry *dentry, *tmp;
 
 	mutex_lock(&dir->d_inode->i_mutex);
-	list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_u.d_child) {
+	list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_child) {
 		spin_lock(&dentry->d_lock);
 		if (!(d_unhashed(dentry)) && dentry->d_inode) {
 			dget_dlock(dentry);
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/platforms/powernv/opal-wrappers.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/platforms/powernv/opal-wrappers.S
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/platforms/powernv/opal-wrappers.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:43 @ BEGIN_FTR_SECTION;						\
 	b	1f;						\
 END_FTR_SECTION(0, 1);						\
 	ld	r12,opal_tracepoint_refcount@toc(r2);		\
-	std	r12,32(r1);					\
 	cmpdi	r12,0;						\
 	bne-	LABEL;						\
 1:
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/platforms/powernv/pci-ioda.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/platforms/powernv/pci-ioda.c
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/platforms/powernv/pci-ioda.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1358 @ static void set_msi_irq_chip(struct pnv_
 
 #ifdef CONFIG_CXL_BASE
 
-struct device_node *pnv_pci_to_phb_node(struct pci_dev *dev)
+struct device_node *pnv_pci_get_phb_node(struct pci_dev *dev)
 {
 	struct pci_controller *hose = pci_bus_to_host(dev->bus);
 
-	return hose->dn;
+	return of_node_get(hose->dn);
 }
-EXPORT_SYMBOL(pnv_pci_to_phb_node);
+EXPORT_SYMBOL(pnv_pci_get_phb_node);
 
 int pnv_phb_to_cxl(struct pci_dev *dev)
 {
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/platforms/pseries/mobility.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/platforms/pseries/mobility.c
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/platforms/pseries/mobility.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:28 @
 static struct kobject *mobility_kobj;
 
 struct update_props_workarea {
-	u32 phandle;
-	u32 state;
-	u64 reserved;
-	u32 nprops;
+	__be32 phandle;
+	__be32 state;
+	__be64 reserved;
+	__be32 nprops;
 } __packed;
 
 #define NODE_ACTION_MASK	0xff000000
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:57 @ static int mobility_rtas_call(int token,
 	return rc;
 }
 
-static int delete_dt_node(u32 phandle)
+static int delete_dt_node(__be32 phandle)
 {
 	struct device_node *dn;
 
-	dn = of_find_node_by_phandle(phandle);
+	dn = of_find_node_by_phandle(be32_to_cpu(phandle));
 	if (!dn)
 		return -ENOENT;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:130 @ static int update_dt_property(struct dev
 	return 0;
 }
 
-static int update_dt_node(u32 phandle, s32 scope)
+static int update_dt_node(__be32 phandle, s32 scope)
 {
 	struct update_props_workarea *upwa;
 	struct device_node *dn;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:139 @ static int update_dt_node(u32 phandle, s
 	char *prop_data;
 	char *rtas_buf;
 	int update_properties_token;
+	u32 nprops;
 	u32 vd;
 
 	update_properties_token = rtas_token("ibm,update-properties");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:150 @ static int update_dt_node(u32 phandle, s
 	if (!rtas_buf)
 		return -ENOMEM;
 
-	dn = of_find_node_by_phandle(phandle);
+	dn = of_find_node_by_phandle(be32_to_cpu(phandle));
 	if (!dn) {
 		kfree(rtas_buf);
 		return -ENOENT;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:166 @ static int update_dt_node(u32 phandle, s
 			break;
 
 		prop_data = rtas_buf + sizeof(*upwa);
+		nprops = be32_to_cpu(upwa->nprops);
 
 		/* On the first call to ibm,update-properties for a node the
 		 * the first property value descriptor contains an empty
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:175 @ static int update_dt_node(u32 phandle, s
 		 */
 		if (*prop_data == 0) {
 			prop_data++;
-			vd = *(u32 *)prop_data;
+			vd = be32_to_cpu(*(__be32 *)prop_data);
 			prop_data += vd + sizeof(vd);
-			upwa->nprops--;
+			nprops--;
 		}
 
-		for (i = 0; i < upwa->nprops; i++) {
+		for (i = 0; i < nprops; i++) {
 			char *prop_name;
 
 			prop_name = prop_data;
 			prop_data += strlen(prop_name) + 1;
-			vd = *(u32 *)prop_data;
+			vd = be32_to_cpu(*(__be32 *)prop_data);
 			prop_data += sizeof(vd);
 
 			switch (vd) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:217 @ static int update_dt_node(u32 phandle, s
 	return 0;
 }
 
-static int add_dt_node(u32 parent_phandle, u32 drc_index)
+static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
 {
 	struct device_node *dn;
 	struct device_node *parent_dn;
 	int rc;
 
-	parent_dn = of_find_node_by_phandle(parent_phandle);
+	parent_dn = of_find_node_by_phandle(be32_to_cpu(parent_phandle));
 	if (!parent_dn)
 		return -ENOENT;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:242 @ static int add_dt_node(u32 parent_phandl
 int pseries_devicetree_update(s32 scope)
 {
 	char *rtas_buf;
-	u32 *data;
+	__be32 *data;
 	int update_nodes_token;
 	int rc;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:259 @ int pseries_devicetree_update(s32 scope)
 		if (rc && rc != 1)
 			break;
 
-		data = (u32 *)rtas_buf + 4;
-		while (*data & NODE_ACTION_MASK) {
+		data = (__be32 *)rtas_buf + 4;
+		while (be32_to_cpu(*data) & NODE_ACTION_MASK) {
 			int i;
-			u32 action = *data & NODE_ACTION_MASK;
-			int node_count = *data & NODE_COUNT_MASK;
+			u32 action = be32_to_cpu(*data) & NODE_ACTION_MASK;
+			u32 node_count = be32_to_cpu(*data) & NODE_COUNT_MASK;
 
 			data++;
 
 			for (i = 0; i < node_count; i++) {
-				u32 phandle = *data++;
-				u32 drc_index;
+				__be32 phandle = *data++;
+				__be32 drc_index;
 
 				switch (action) {
 				case DELETE_DT_NODE:
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/sysdev/axonram.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/sysdev/axonram.c
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/sysdev/axonram.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:159 @ axon_ram_direct_access(struct block_devi
 	}
 
 	*kaddr = (void *)(bank->ph_addr + offset);
-	*pfn = virt_to_phys(kaddr) >> PAGE_SHIFT;
+	*pfn = virt_to_phys(*kaddr) >> PAGE_SHIFT;
 
 	return 0;
 }
Index: linux-3.18.13-rt10-r7s4/arch/powerpc/xmon/xmon.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/powerpc/xmon/xmon.c
+++ linux-3.18.13-rt10-r7s4/arch/powerpc/xmon/xmon.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:296 @ static inline void disable_surveillance(
 	args.token = rtas_token("set-indicator");
 	if (args.token == RTAS_UNKNOWN_SERVICE)
 		return;
+	args.token = cpu_to_be32(args.token);
 	args.nargs = cpu_to_be32(3);
 	args.nret = cpu_to_be32(1);
 	args.rets = &args.args[3];
Index: linux-3.18.13-rt10-r7s4/arch/s390/crypto/aes_s390.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/s390/crypto/aes_s390.c
+++ linux-3.18.13-rt10-r7s4/arch/s390/crypto/aes_s390.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:982 @ static void __exit aes_s390_fini(void)
 module_init(aes_s390_init);
 module_exit(aes_s390_fini);
 
-MODULE_ALIAS("aes-all");
+MODULE_ALIAS_CRYPTO("aes-all");
 
 MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm");
 MODULE_LICENSE("GPL");
Index: linux-3.18.13-rt10-r7s4/arch/s390/crypto/des_s390.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/s390/crypto/des_s390.c
+++ linux-3.18.13-rt10-r7s4/arch/s390/crypto/des_s390.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:622 @ static void __exit des_s390_exit(void)
 module_init(des_s390_init);
 module_exit(des_s390_exit);
 
-MODULE_ALIAS("des");
-MODULE_ALIAS("des3_ede");
+MODULE_ALIAS_CRYPTO("des");
+MODULE_ALIAS_CRYPTO("des3_ede");
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms");
Index: linux-3.18.13-rt10-r7s4/arch/s390/crypto/ghash_s390.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/s390/crypto/ghash_s390.c
+++ linux-3.18.13-rt10-r7s4/arch/s390/crypto/ghash_s390.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:163 @ static void __exit ghash_mod_exit(void)
 module_init(ghash_mod_init);
 module_exit(ghash_mod_exit);
 
-MODULE_ALIAS("ghash");
+MODULE_ALIAS_CRYPTO("ghash");
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("GHASH Message Digest Algorithm, s390 implementation");
Index: linux-3.18.13-rt10-r7s4/arch/s390/crypto/sha1_s390.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/s390/crypto/sha1_s390.c
+++ linux-3.18.13-rt10-r7s4/arch/s390/crypto/sha1_s390.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:106 @ static void __exit sha1_s390_fini(void)
 module_init(sha1_s390_init);
 module_exit(sha1_s390_fini);
 
-MODULE_ALIAS("sha1");
+MODULE_ALIAS_CRYPTO("sha1");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm");
Index: linux-3.18.13-rt10-r7s4/arch/s390/crypto/sha256_s390.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/s390/crypto/sha256_s390.c
+++ linux-3.18.13-rt10-r7s4/arch/s390/crypto/sha256_s390.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:146 @ static void __exit sha256_s390_fini(void
 module_init(sha256_s390_init);
 module_exit(sha256_s390_fini);
 
-MODULE_ALIAS("sha256");
-MODULE_ALIAS("sha224");
+MODULE_ALIAS_CRYPTO("sha256");
+MODULE_ALIAS_CRYPTO("sha224");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA256 and SHA224 Secure Hash Algorithm");
Index: linux-3.18.13-rt10-r7s4/arch/s390/crypto/sha512_s390.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/s390/crypto/sha512_s390.c
+++ linux-3.18.13-rt10-r7s4/arch/s390/crypto/sha512_s390.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:89 @ static struct shash_alg sha512_alg = {
 	}
 };
 
-MODULE_ALIAS("sha512");
+MODULE_ALIAS_CRYPTO("sha512");
 
 static int sha384_init(struct shash_desc *desc)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:129 @ static struct shash_alg sha384_alg = {
 	}
 };
 
-MODULE_ALIAS("sha384");
+MODULE_ALIAS_CRYPTO("sha384");
 
 static int __init init(void)
 {
Index: linux-3.18.13-rt10-r7s4/arch/s390/kernel/compat_linux.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/s390/kernel/compat_linux.c
+++ linux-3.18.13-rt10-r7s4/arch/s390/kernel/compat_linux.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:252 @ COMPAT_SYSCALL_DEFINE2(s390_setgroups16,
 	struct group_info *group_info;
 	int retval;
 
-	if (!capable(CAP_SETGID))
+	if (!may_setgroups())
 		return -EPERM;
 	if ((unsigned)gidsetsize > NGROUPS_MAX)
 		return -EINVAL;
Index: linux-3.18.13-rt10-r7s4/arch/s390/kvm/gaccess.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/s390/kvm/gaccess.c
+++ linux-3.18.13-rt10-r7s4/arch/s390/kvm/gaccess.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:232 @ static void ipte_lock_simple(struct kvm_
 		goto out;
 	ic = &vcpu->kvm->arch.sca->ipte_control;
 	do {
-		old = ACCESS_ONCE(*ic);
+		old = *ic;
+		barrier();
 		while (old.k) {
 			cond_resched();
-			old = ACCESS_ONCE(*ic);
+			old = *ic;
+			barrier();
 		}
 		new = old;
 		new.k = 1;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:256 @ static void ipte_unlock_simple(struct kv
 		goto out;
 	ic = &vcpu->kvm->arch.sca->ipte_control;
 	do {
-		new = old = ACCESS_ONCE(*ic);
+		old = *ic;
+		barrier();
+		new = old;
 		new.k = 0;
 	} while (cmpxchg(&ic->val, old.val, new.val) != old.val);
 	wake_up(&vcpu->kvm->arch.ipte_wq);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:272 @ static void ipte_lock_siif(struct kvm_vc
 
 	ic = &vcpu->kvm->arch.sca->ipte_control;
 	do {
-		old = ACCESS_ONCE(*ic);
+		old = *ic;
+		barrier();
 		while (old.kg) {
 			cond_resched();
-			old = ACCESS_ONCE(*ic);
+			old = *ic;
+			barrier();
 		}
 		new = old;
 		new.k = 1;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:291 @ static void ipte_unlock_siif(struct kvm_
 
 	ic = &vcpu->kvm->arch.sca->ipte_control;
 	do {
-		new = old = ACCESS_ONCE(*ic);
+		old = *ic;
+		barrier();
+		new = old;
 		new.kh--;
 		if (!new.kh)
 			new.k = 0;
Index: linux-3.18.13-rt10-r7s4/arch/s390/kvm/interrupt.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/s390/kvm/interrupt.c
+++ linux-3.18.13-rt10-r7s4/arch/s390/kvm/interrupt.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:273 @ static int __must_check __deliver_prog_i
 		break;
 	case PGM_MONITOR:
 		rc = put_guest_lc(vcpu, pgm_info->mon_class_nr,
-				  (u64 *)__LC_MON_CLASS_NR);
+				  (u16 *)__LC_MON_CLASS_NR);
 		rc |= put_guest_lc(vcpu, pgm_info->mon_code,
 				   (u64 *)__LC_MON_CODE);
 		break;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:616 @ no_timer:
 	__unset_cpu_idle(vcpu);
 	vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
 
-	hrtimer_try_to_cancel(&vcpu->arch.ckc_timer);
+	hrtimer_cancel(&vcpu->arch.ckc_timer);
 	return 0;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:636 @ void kvm_s390_vcpu_wakeup(struct kvm_vcp
 enum hrtimer_restart kvm_s390_idle_wakeup(struct hrtimer *timer)
 {
 	struct kvm_vcpu *vcpu;
+	u64 now, sltime;
 
 	vcpu = container_of(timer, struct kvm_vcpu, arch.ckc_timer);
-	kvm_s390_vcpu_wakeup(vcpu);
+	now = get_tod_clock_fast() + vcpu->arch.sie_block->epoch;
+	sltime = tod_to_ns(vcpu->arch.sie_block->ckc - now);
 
+	/*
+	 * If the monotonic clock runs faster than the tod clock we might be
+	 * woken up too early and have to go back to sleep to avoid deadlocks.
+	 */
+	if (vcpu->arch.sie_block->ckc > now &&
+	    hrtimer_forward_now(timer, ns_to_ktime(sltime)))
+		return HRTIMER_RESTART;
+	kvm_s390_vcpu_wakeup(vcpu);
 	return HRTIMER_NORESTART;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:853 @ static int __inject_vm(struct kvm *kvm,
 		list_add_tail(&inti->list, &iter->list);
 	}
 	atomic_set(&fi->active, 1);
+	if (atomic_read(&kvm->online_vcpus) == 0)
+		goto unlock_fi;
 	sigcpu = find_first_bit(fi->idle_mask, KVM_MAX_VCPUS);
 	if (sigcpu == KVM_MAX_VCPUS) {
 		do {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:879 @ int kvm_s390_inject_vm(struct kvm *kvm,
 		       struct kvm_s390_interrupt *s390int)
 {
 	struct kvm_s390_interrupt_info *inti;
+	int rc;
 
 	inti = kzalloc(sizeof(*inti), GFP_KERNEL);
 	if (!inti)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:927 @ int kvm_s390_inject_vm(struct kvm *kvm,
 	trace_kvm_s390_inject_vm(s390int->type, s390int->parm, s390int->parm64,
 				 2);
 
-	return __inject_vm(kvm, inti);
+	rc = __inject_vm(kvm, inti);
+	if (rc)
+		kfree(inti);
+	return rc;
 }
 
 void kvm_s390_reinject_io_int(struct kvm *kvm,
Index: linux-3.18.13-rt10-r7s4/arch/s390/kvm/kvm-s390.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/s390/kvm/kvm-s390.c
+++ linux-3.18.13-rt10-r7s4/arch/s390/kvm/kvm-s390.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:155 @ int kvm_vm_ioctl_check_extension(struct
 	case KVM_CAP_ONE_REG:
 	case KVM_CAP_ENABLE_CAP:
 	case KVM_CAP_S390_CSS_SUPPORT:
-	case KVM_CAP_IRQFD:
 	case KVM_CAP_IOEVENTFD:
 	case KVM_CAP_DEVICE_CTRL:
 	case KVM_CAP_ENABLE_CAP_VM:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:664 @ int kvm_arch_vcpu_setup(struct kvm_vcpu
 		if (rc)
 			return rc;
 	}
-	hrtimer_init(&vcpu->arch.ckc_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS);
+	hrtimer_init(&vcpu->arch.ckc_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
 	vcpu->arch.ckc_timer.function = kvm_s390_idle_wakeup;
 	get_cpu_id(&vcpu->arch.cpu_id);
 	vcpu->arch.cpu_id.version = 0xff;
Index: linux-3.18.13-rt10-r7s4/arch/s390/kvm/priv.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/s390/kvm/priv.c
+++ linux-3.18.13-rt10-r7s4/arch/s390/kvm/priv.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:794 @ int kvm_s390_handle_lctl(struct kvm_vcpu
 			break;
 		reg = (reg + 1) % 16;
 	} while (1);
-
+	kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
 	return 0;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:866 @ static int handle_lctlg(struct kvm_vcpu
 			break;
 		reg = (reg + 1) % 16;
 	} while (1);
-
+	kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
 	return 0;
 }
 
Index: linux-3.18.13-rt10-r7s4/arch/s390/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/s390/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/s390/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:377 @ static noinline void do_fault_error(stru
 				do_no_context(regs);
 			else
 				pagefault_out_of_memory();
+		} else if (fault & VM_FAULT_SIGSEGV) {
+			/* Kernel mode? Handle exceptions or die */
+			if (!user_mode(regs))
+				do_no_context(regs);
+			else
+				do_sigsegv(regs, SEGV_MAPERR);
 		} else if (fault & VM_FAULT_SIGBUS) {
 			/* Kernel mode? Handle exceptions or die */
 			if (!user_mode(regs))
Index: linux-3.18.13-rt10-r7s4/arch/score/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/score/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/score/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:117 @ good_area:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/sh/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sh/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/sh/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:356 @ mm_fault_error(struct pt_regs *regs, uns
 	} else {
 		if (fault & VM_FAULT_SIGBUS)
 			do_sigbus(regs, error_code, address);
+		else if (fault & VM_FAULT_SIGSEGV)
+			bad_area(regs, error_code, address);
 		else
 			BUG();
 	}
Index: linux-3.18.13-rt10-r7s4/arch/sparc/crypto/aes_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/crypto/aes_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/sparc/crypto/aes_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:502 @ module_exit(aes_sparc64_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("AES Secure Hash Algorithm, sparc64 aes opcode accelerated");
 
-MODULE_ALIAS("aes");
+MODULE_ALIAS_CRYPTO("aes");
 
 #include "crop_devid.c"
Index: linux-3.18.13-rt10-r7s4/arch/sparc/crypto/camellia_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/crypto/camellia_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/sparc/crypto/camellia_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:325 @ module_exit(camellia_sparc64_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Camellia Cipher Algorithm, sparc64 camellia opcode accelerated");
 
-MODULE_ALIAS("aes");
+MODULE_ALIAS_CRYPTO("aes");
 
 #include "crop_devid.c"
Index: linux-3.18.13-rt10-r7s4/arch/sparc/crypto/crc32c_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/crypto/crc32c_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/sparc/crypto/crc32c_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:179 @ module_exit(crc32c_sparc64_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("CRC32c (Castagnoli), sparc64 crc32c opcode accelerated");
 
-MODULE_ALIAS("crc32c");
+MODULE_ALIAS_CRYPTO("crc32c");
 
 #include "crop_devid.c"
Index: linux-3.18.13-rt10-r7s4/arch/sparc/crypto/des_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/crypto/des_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/sparc/crypto/des_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:535 @ module_exit(des_sparc64_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms, sparc64 des opcode accelerated");
 
-MODULE_ALIAS("des");
+MODULE_ALIAS_CRYPTO("des");
 
 #include "crop_devid.c"
Index: linux-3.18.13-rt10-r7s4/arch/sparc/crypto/md5_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/crypto/md5_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/sparc/crypto/md5_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:188 @ module_exit(md5_sparc64_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("MD5 Secure Hash Algorithm, sparc64 md5 opcode accelerated");
 
-MODULE_ALIAS("md5");
+MODULE_ALIAS_CRYPTO("md5");
 
 #include "crop_devid.c"
Index: linux-3.18.13-rt10-r7s4/arch/sparc/crypto/sha1_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/crypto/sha1_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/sparc/crypto/sha1_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:183 @ module_exit(sha1_sparc64_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm, sparc64 sha1 opcode accelerated");
 
-MODULE_ALIAS("sha1");
+MODULE_ALIAS_CRYPTO("sha1");
 
 #include "crop_devid.c"
Index: linux-3.18.13-rt10-r7s4/arch/sparc/crypto/sha256_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/crypto/sha256_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/sparc/crypto/sha256_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:240 @ module_exit(sha256_sparc64_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA-224 and SHA-256 Secure Hash Algorithm, sparc64 sha256 opcode accelerated");
 
-MODULE_ALIAS("sha224");
-MODULE_ALIAS("sha256");
+MODULE_ALIAS_CRYPTO("sha224");
+MODULE_ALIAS_CRYPTO("sha256");
 
 #include "crop_devid.c"
Index: linux-3.18.13-rt10-r7s4/arch/sparc/crypto/sha512_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/crypto/sha512_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/sparc/crypto/sha512_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:225 @ module_exit(sha512_sparc64_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA-384 and SHA-512 Secure Hash Algorithm, sparc64 sha512 opcode accelerated");
 
-MODULE_ALIAS("sha384");
-MODULE_ALIAS("sha512");
+MODULE_ALIAS_CRYPTO("sha384");
+MODULE_ALIAS_CRYPTO("sha512");
 
 #include "crop_devid.c"
Index: linux-3.18.13-rt10-r7s4/arch/sparc/kernel/perf_event.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/kernel/perf_event.c
+++ linux-3.18.13-rt10-r7s4/arch/sparc/kernel/perf_event.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:963 @ out:
 	cpuc->pcr[0] |= cpuc->event[0]->hw.config_base;
 }
 
+static void sparc_pmu_start(struct perf_event *event, int flags);
+
 /* On this PMU each PIC has it's own PCR control register.  */
 static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:977 @ static void calculate_multiple_pcrs(stru
 		struct perf_event *cp = cpuc->event[i];
 		struct hw_perf_event *hwc = &cp->hw;
 		int idx = hwc->idx;
-		u64 enc;
 
 		if (cpuc->current_idx[i] != PIC_NO_INDEX)
 			continue;
 
-		sparc_perf_event_set_period(cp, hwc, idx);
 		cpuc->current_idx[i] = idx;
 
-		enc = perf_event_get_enc(cpuc->events[i]);
-		cpuc->pcr[idx] &= ~mask_for_index(idx);
-		if (hwc->state & PERF_HES_STOPPED)
-			cpuc->pcr[idx] |= nop_for_index(idx);
-		else
-			cpuc->pcr[idx] |= event_encoding(enc, idx);
+		sparc_pmu_start(cp, PERF_EF_RELOAD);
 	}
 out:
 	for (i = 0; i < cpuc->n_events; i++) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1099 @ static void sparc_pmu_del(struct perf_ev
 	int i;
 
 	local_irq_save(flags);
-	perf_pmu_disable(event->pmu);
 
 	for (i = 0; i < cpuc->n_events; i++) {
 		if (event == cpuc->event[i]) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1124 @ static void sparc_pmu_del(struct perf_ev
 		}
 	}
 
-	perf_pmu_enable(event->pmu);
 	local_irq_restore(flags);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1357 @ static int sparc_pmu_add(struct perf_eve
 	unsigned long flags;
 
 	local_irq_save(flags);
-	perf_pmu_disable(event->pmu);
 
 	n0 = cpuc->n_events;
 	if (n0 >= sparc_pmu->max_hw_events)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1389 @ nocheck:
 
 	ret = 0;
 out:
-	perf_pmu_enable(event->pmu);
 	local_irq_restore(flags);
 	return ret;
 }
Index: linux-3.18.13-rt10-r7s4/arch/sparc/kernel/process_64.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/kernel/process_64.c
+++ linux-3.18.13-rt10-r7s4/arch/sparc/kernel/process_64.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:290 @ void arch_trigger_all_cpu_backtrace(bool
 			printk("             TPC[%lx] O7[%lx] I7[%lx] RPC[%lx]\n",
 			       gp->tpc, gp->o7, gp->i7, gp->rpc);
 		}
+
+		touch_nmi_watchdog();
 	}
 
 	memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:367 @ static void pmu_snapshot_all_cpus(void)
 		       (cpu == this_cpu ? '*' : ' '), cpu,
 		       pp->pcr[0], pp->pcr[1], pp->pcr[2], pp->pcr[3],
 		       pp->pic[0], pp->pic[1], pp->pic[2], pp->pic[3]);
+
+		touch_nmi_watchdog();
 	}
 
 	memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
Index: linux-3.18.13-rt10-r7s4/arch/sparc/kernel/sys_sparc_64.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/kernel/sys_sparc_64.c
+++ linux-3.18.13-rt10-r7s4/arch/sparc/kernel/sys_sparc_64.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:336 @ SYSCALL_DEFINE6(sparc_ipc, unsigned int,
 	long err;
 
 	/* No need for backward compatibility. We can start fresh... */
-	if (call <= SEMCTL) {
+	if (call <= SEMTIMEDOP) {
 		switch (call) {
 		case SEMOP:
 			err = sys_semtimedop(first, ptr,
Index: linux-3.18.13-rt10-r7s4/arch/sparc/lib/memmove.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/lib/memmove.S
+++ linux-3.18.13-rt10-r7s4/arch/sparc/lib/memmove.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:11 @
 
 	.text
 ENTRY(memmove) /* o0=dst o1=src o2=len */
-	mov		%o0, %g1
+	brz,pn		%o2, 99f
+	 mov		%o0, %g1
+
 	cmp		%o0, %o1
-	bleu,pt		%xcc, memcpy
+	bleu,pt		%xcc, 2f
 	 add		%o1, %o2, %g7
 	cmp		%g7, %o0
 	bleu,pt		%xcc, memcpy
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:29 @ ENTRY(memmove) /* o0=dst o1=src o2=len *
 	stb		%g7, [%o0]
 	bne,pt		%icc, 1b
 	 sub		%o0, 1, %o0
-
+99:
 	retl
 	 mov		%g1, %o0
+
+	/* We can't just call memcpy for these memmove cases.  On some
+	 * chips the memcpy uses cache initializing stores and when dst
+	 * and src are close enough, those can clobber the source data
+	 * before we've loaded it in.
+	 */
+2:	or		%o0, %o1, %g7
+	or		%o2, %g7, %g7
+	andcc		%g7, 0x7, %g0
+	bne,pn		%xcc, 4f
+	 nop
+
+3:	ldx		[%o1], %g7
+	add		%o1, 8, %o1
+	subcc		%o2, 8, %o2
+	add		%o0, 8, %o0
+	bne,pt		%icc, 3b
+	 stx		%g7, [%o0 - 0x8]
+	ba,a,pt		%xcc, 99b
+
+4:	ldub		[%o1], %g7
+	add		%o1, 1, %o1
+	subcc		%o2, 1, %o2
+	add		%o0, 1, %o0
+	bne,pt		%icc, 4b
+	 stb		%g7, [%o0 - 0x1]
+	ba,a,pt		%xcc, 99b
 ENDPROC(memmove)
Index: linux-3.18.13-rt10-r7s4/arch/sparc/mm/fault_32.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/mm/fault_32.c
+++ linux-3.18.13-rt10-r7s4/arch/sparc/mm/fault_32.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:252 @ good_area:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/sparc/mm/fault_64.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/mm/fault_64.c
+++ linux-3.18.13-rt10-r7s4/arch/sparc/mm/fault_64.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:449 @ good_area:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/sparc/mm/srmmu.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/sparc/mm/srmmu.c
+++ linux-3.18.13-rt10-r7s4/arch/sparc/mm/srmmu.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:463 @ static void __init sparc_context_init(in
 void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm,
 	       struct task_struct *tsk)
 {
+	unsigned long flags;
+
 	if (mm->context == NO_CONTEXT) {
-		spin_lock(&srmmu_context_spinlock);
+		spin_lock_irqsave(&srmmu_context_spinlock, flags);
 		alloc_context(old_mm, mm);
-		spin_unlock(&srmmu_context_spinlock);
+		spin_unlock_irqrestore(&srmmu_context_spinlock, flags);
 		srmmu_ctxd_set(&srmmu_context_table[mm->context], mm->pgd);
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:991 @ int init_new_context(struct task_struct
 
 void destroy_context(struct mm_struct *mm)
 {
+	unsigned long flags;
 
 	if (mm->context != NO_CONTEXT) {
 		flush_cache_mm(mm);
 		srmmu_ctxd_set(&srmmu_context_table[mm->context], srmmu_swapper_pg_dir);
 		flush_tlb_mm(mm);
-		spin_lock(&srmmu_context_spinlock);
+		spin_lock_irqsave(&srmmu_context_spinlock, flags);
 		free_context(mm->context);
-		spin_unlock(&srmmu_context_spinlock);
+		spin_unlock_irqrestore(&srmmu_context_spinlock, flags);
 		mm->context = NO_CONTEXT;
 	}
 }
Index: linux-3.18.13-rt10-r7s4/arch/tile/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/tile/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/tile/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:447 @ good_area:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/arch/um/Kconfig.common
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/um/Kconfig.common
+++ linux-3.18.13-rt10-r7s4/arch/um/Kconfig.common
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6 @ config UML
 	default y
 	select HAVE_ARCH_AUDITSYSCALL
 	select HAVE_UID16
+	select HAVE_FUTEX_CMPXCHG if FUTEX
 	select GENERIC_IRQ_SHOW
 	select GENERIC_CPU_DEVICES
 	select GENERIC_IO
Index: linux-3.18.13-rt10-r7s4/arch/um/kernel/trap.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/um/kernel/trap.c
+++ linux-3.18.13-rt10-r7s4/arch/um/kernel/trap.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:83 @ good_area:
 		if (unlikely(fault & VM_FAULT_ERROR)) {
 			if (fault & VM_FAULT_OOM) {
 				goto out_of_memory;
+			} else if (fault & VM_FAULT_SIGSEGV) {
+				goto out;
 			} else if (fault & VM_FAULT_SIGBUS) {
 				err = -EACCES;
 				goto out;
Index: linux-3.18.13-rt10-r7s4/arch/x86/Kconfig
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/Kconfig
+++ linux-3.18.13-rt10-r7s4/arch/x86/Kconfig
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:859 @ source "kernel/Kconfig.preempt"
 
 config X86_UP_APIC
 	bool "Local APIC support on uniprocessors"
-	depends on X86_32 && !SMP && !X86_32_NON_STANDARD && !PCI_MSI
+	depends on X86_32 && !SMP && !X86_32_NON_STANDARD
 	---help---
 	  A local APIC (Advanced Programmable Interrupt Controller) is an
 	  integrated interrupt controller in the CPU. If you have a single-CPU
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:870 @ config X86_UP_APIC
 	  performance counters), and the NMI watchdog which detects hard
 	  lockups.
 
+config X86_UP_APIC_MSI
+	def_bool y
+	select X86_UP_APIC if X86_32 && !SMP && !X86_32_NON_STANDARD && PCI_MSI
+
 config X86_UP_IOAPIC
 	bool "IO-APIC support on uniprocessors"
 	depends on X86_UP_APIC
Index: linux-3.18.13-rt10-r7s4/arch/x86/boot/Makefile
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/boot/Makefile
+++ linux-3.18.13-rt10-r7s4/arch/x86/boot/Makefile
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:54 @ targets += cpustr.h
 $(obj)/cpustr.h: $(obj)/mkcpustr FORCE
 	$(call if_changed,cpustr)
 endif
+clean-files += cpustr.h
 
 # ---------------------------------------------------------------------------
 
Index: linux-3.18.13-rt10-r7s4/arch/x86/boot/compressed/Makefile
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/boot/compressed/Makefile
+++ linux-3.18.13-rt10-r7s4/arch/x86/boot/compressed/Makefile
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:39 @ vmlinux-objs-$(CONFIG_RANDOMIZE_BASE) +=
 $(obj)/eboot.o: KBUILD_CFLAGS += -fshort-wchar -mno-red-zone
 
 vmlinux-objs-$(CONFIG_EFI_STUB) += $(obj)/eboot.o $(obj)/efi_stub_$(BITS).o
+vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_thunk_$(BITS).o
 
 $(obj)/vmlinux: $(vmlinux-objs-y) FORCE
 	$(call if_changed,ld)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:81 @ suffix-$(CONFIG_KERNEL_LZO) 	:= lzo
 suffix-$(CONFIG_KERNEL_LZ4) 	:= lz4
 
 RUN_SIZE = $(shell $(OBJDUMP) -h vmlinux | \
-	     perl $(srctree)/arch/x86/tools/calc_run_size.pl)
+	     $(CONFIG_SHELL) $(srctree)/arch/x86/tools/calc_run_size.sh)
 quiet_cmd_mkpiggy = MKPIGGY $@
       cmd_mkpiggy = $(obj)/mkpiggy $< $(RUN_SIZE) > $@ || ( rm -f $@ ; false )
 
Index: linux-3.18.13-rt10-r7s4/arch/x86/boot/compressed/efi_stub_64.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/boot/compressed/efi_stub_64.S
+++ linux-3.18.13-rt10-r7s4/arch/x86/boot/compressed/efi_stub_64.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6 @
 #include <asm/processor-flags.h>
 
 #include "../../platform/efi/efi_stub_64.S"
-
-#ifdef CONFIG_EFI_MIXED
-	.code64
-	.text
-ENTRY(efi64_thunk)
-	push	%rbp
-	push	%rbx
-
-	subq	$16, %rsp
-	leaq	efi_exit32(%rip), %rax
-	movl	%eax, 8(%rsp)
-	leaq	efi_gdt64(%rip), %rax
-	movl	%eax, 4(%rsp)
-	movl	%eax, 2(%rax)		/* Fixup the gdt base address */
-	leaq	efi32_boot_gdt(%rip), %rax
-	movl	%eax, (%rsp)
-
-	call	__efi64_thunk
-
-	addq	$16, %rsp
-	pop	%rbx
-	pop	%rbp
-	ret
-ENDPROC(efi64_thunk)
-#endif /* CONFIG_EFI_MIXED */
Index: linux-3.18.13-rt10-r7s4/arch/x86/boot/compressed/efi_thunk_64.S
===================================================================
--- /dev/null
+++ linux-3.18.13-rt10-r7s4/arch/x86/boot/compressed/efi_thunk_64.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4 @
+/*
+ * Copyright (C) 2014, 2015 Intel Corporation; author Matt Fleming
+ *
+ * Early support for invoking 32-bit EFI services from a 64-bit kernel.
+ *
+ * Because this thunking occurs before ExitBootServices() we have to
+ * restore the firmware's 32-bit GDT before we make EFI serivce calls,
+ * since the firmware's 32-bit IDT is still currently installed and it
+ * needs to be able to service interrupts.
+ *
+ * On the plus side, we don't have to worry about mangling 64-bit
+ * addresses into 32-bits because we're executing with an identify
+ * mapped pagetable and haven't transitioned to 64-bit virtual addresses
+ * yet.
+ */
+
+#include <linux/linkage.h>
+#include <asm/msr.h>
+#include <asm/page_types.h>
+#include <asm/processor-flags.h>
+#include <asm/segment.h>
+
+	.code64
+	.text
+ENTRY(efi64_thunk)
+	push	%rbp
+	push	%rbx
+
+	subq	$8, %rsp
+	leaq	efi_exit32(%rip), %rax
+	movl	%eax, 4(%rsp)
+	leaq	efi_gdt64(%rip), %rax
+	movl	%eax, (%rsp)
+	movl	%eax, 2(%rax)		/* Fixup the gdt base address */
+
+	movl	%ds, %eax
+	push	%rax
+	movl	%es, %eax
+	push	%rax
+	movl	%ss, %eax
+	push	%rax
+
+	/*
+	 * Convert x86-64 ABI params to i386 ABI
+	 */
+	subq	$32, %rsp
+	movl	%esi, 0x0(%rsp)
+	movl	%edx, 0x4(%rsp)
+	movl	%ecx, 0x8(%rsp)
+	movq	%r8, %rsi
+	movl	%esi, 0xc(%rsp)
+	movq	%r9, %rsi
+	movl	%esi,  0x10(%rsp)
+
+	sgdt	save_gdt(%rip)
+
+	leaq	1f(%rip), %rbx
+	movq	%rbx, func_rt_ptr(%rip)
+
+	/*
+	 * Switch to gdt with 32-bit segments. This is the firmware GDT
+	 * that was installed when the kernel started executing. This
+	 * pointer was saved at the EFI stub entry point in head_64.S.
+	 */
+	leaq	efi32_boot_gdt(%rip), %rax
+	lgdt	(%rax)
+
+	pushq	$__KERNEL_CS
+	leaq	efi_enter32(%rip), %rax
+	pushq	%rax
+	lretq
+
+1:	addq	$32, %rsp
+
+	lgdt	save_gdt(%rip)
+
+	pop	%rbx
+	movl	%ebx, %ss
+	pop	%rbx
+	movl	%ebx, %es
+	pop	%rbx
+	movl	%ebx, %ds
+
+	/*
+	 * Convert 32-bit status code into 64-bit.
+	 */
+	test	%rax, %rax
+	jz	1f
+	movl	%eax, %ecx
+	andl	$0x0fffffff, %ecx
+	andl	$0xf0000000, %eax
+	shl	$32, %rax
+	or	%rcx, %rax
+1:
+	addq	$8, %rsp
+	pop	%rbx
+	pop	%rbp
+	ret
+ENDPROC(efi64_thunk)
+
+ENTRY(efi_exit32)
+	movq	func_rt_ptr(%rip), %rax
+	push	%rax
+	mov	%rdi, %rax
+	ret
+ENDPROC(efi_exit32)
+
+	.code32
+/*
+ * EFI service pointer must be in %edi.
+ *
+ * The stack should represent the 32-bit calling convention.
+ */
+ENTRY(efi_enter32)
+	movl	$__KERNEL_DS, %eax
+	movl	%eax, %ds
+	movl	%eax, %es
+	movl	%eax, %ss
+
+	/* Reload pgtables */
+	movl	%cr3, %eax
+	movl	%eax, %cr3
+
+	/* Disable paging */
+	movl	%cr0, %eax
+	btrl	$X86_CR0_PG_BIT, %eax
+	movl	%eax, %cr0
+
+	/* Disable long mode via EFER */
+	movl	$MSR_EFER, %ecx
+	rdmsr
+	btrl	$_EFER_LME, %eax
+	wrmsr
+
+	call	*%edi
+
+	/* We must preserve return value */
+	movl	%eax, %edi
+
+	/*
+	 * Some firmware will return with interrupts enabled. Be sure to
+	 * disable them before we switch GDTs.
+	 */
+	cli
+
+	movl	56(%esp), %eax
+	movl	%eax, 2(%eax)
+	lgdtl	(%eax)
+
+	movl	%cr4, %eax
+	btsl	$(X86_CR4_PAE_BIT), %eax
+	movl	%eax, %cr4
+
+	movl	%cr3, %eax
+	movl	%eax, %cr3
+
+	movl	$MSR_EFER, %ecx
+	rdmsr
+	btsl	$_EFER_LME, %eax
+	wrmsr
+
+	xorl	%eax, %eax
+	lldt	%ax
+
+	movl	60(%esp), %eax
+	pushl	$__KERNEL_CS
+	pushl	%eax
+
+	/* Enable paging */
+	movl	%cr0, %eax
+	btsl	$X86_CR0_PG_BIT, %eax
+	movl	%eax, %cr0
+	lret
+ENDPROC(efi_enter32)
+
+	.data
+	.balign	8
+	.global	efi32_boot_gdt
+efi32_boot_gdt:	.word	0
+		.quad	0
+
+save_gdt:	.word	0
+		.quad	0
+func_rt_ptr:	.quad	0
+
+	.global efi_gdt64
+efi_gdt64:
+	.word	efi_gdt64_end - efi_gdt64
+	.long	0			/* Filled out by user */
+	.word	0
+	.quad	0x0000000000000000	/* NULL descriptor */
+	.quad	0x00af9a000000ffff	/* __KERNEL_CS */
+	.quad	0x00cf92000000ffff	/* __KERNEL_DS */
+	.quad	0x0080890000000000	/* TS descriptor */
+	.quad   0x0000000000000000	/* TS continued */
+efi_gdt64_end:
Index: linux-3.18.13-rt10-r7s4/arch/x86/boot/compressed/misc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/boot/compressed/misc.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/boot/compressed/misc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:364 @ asmlinkage __visible void *decompress_ke
 				  unsigned long output_len,
 				  unsigned long run_size)
 {
+	unsigned char *output_orig = output;
+
 	real_mode = rmode;
 
 	sanitize_boot_params(real_mode);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:414 @ asmlinkage __visible void *decompress_ke
 	debug_putstr("\nDecompressing Linux... ");
 	decompress(input_data, input_len, NULL, NULL, output, NULL, error);
 	parse_elf(output);
-	handle_relocations(output, output_len);
+	/*
+	 * 32-bit always performs relocations. 64-bit relocations are only
+	 * needed if kASLR has chosen a different load address.
+	 */
+	if (!IS_ENABLED(CONFIG_X86_64) || output != output_orig)
+		handle_relocations(output, output_len);
 	debug_putstr("done.\nBooting the kernel.\n");
 	return output;
 }
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/Makefile
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/Makefile
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/Makefile
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:29 @ obj-$(CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL
 
 obj-$(CONFIG_CRYPTO_CRC32C_INTEL) += crc32c-intel.o
 obj-$(CONFIG_CRYPTO_SHA1_SSSE3) += sha1-ssse3.o
-obj-$(CONFIG_CRYPTO_SHA1_MB) += sha-mb/
 obj-$(CONFIG_CRYPTO_CRC32_PCLMUL) += crc32-pclmul.o
 obj-$(CONFIG_CRYPTO_SHA256_SSSE3) += sha256-ssse3.o
 obj-$(CONFIG_CRYPTO_SHA512_SSSE3) += sha512-ssse3.o
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:48 @ endif
 ifeq ($(avx2_supported),yes)
 	obj-$(CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64) += camellia-aesni-avx2.o
 	obj-$(CONFIG_CRYPTO_SERPENT_AVX2_X86_64) += serpent-avx2.o
+	obj-$(CONFIG_CRYPTO_SHA1_MB) += sha-mb/
 endif
 
 aes-i586-y := aes-i586-asm_32.o aes_glue.o
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:211 @ ddq_add_8:
 
 	.if (klen == KEY_128)
 		.if (load_keys)
-			vmovdqa	3*16(p_keys), xkeyA
+			vmovdqa	3*16(p_keys), xkey4
 		.endif
 	.else
 		vmovdqa	3*16(p_keys), xkeyA
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:227 @ ddq_add_8:
 	add	$(16*by), p_in
 
 	.if (klen == KEY_128)
-		vmovdqa	4*16(p_keys), xkey4
+		vmovdqa	4*16(p_keys), xkeyB
 	.else
 		.if (load_keys)
 			vmovdqa	4*16(p_keys), xkey4
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:237 @ ddq_add_8:
 	.set i, 0
 	.rept by
 		club XDATA, i
-		vaesenc	xkeyA, var_xdata, var_xdata		/* key 3 */
+		/* key 3 */
+		.if (klen == KEY_128)
+			vaesenc	xkey4, var_xdata, var_xdata
+		.else
+			vaesenc	xkeyA, var_xdata, var_xdata
+		.endif
 		.set i, (i +1)
 	.endr
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:251 @ ddq_add_8:
 	.set i, 0
 	.rept by
 		club XDATA, i
-		vaesenc	xkey4, var_xdata, var_xdata		/* key 4 */
+		/* key 4 */
+		.if (klen == KEY_128)
+			vaesenc	xkeyB, var_xdata, var_xdata
+		.else
+			vaesenc	xkey4, var_xdata, var_xdata
+		.endif
 		.set i, (i +1)
 	.endr
 
 	.if (klen == KEY_128)
 		.if (load_keys)
-			vmovdqa	6*16(p_keys), xkeyB
+			vmovdqa	6*16(p_keys), xkey8
 		.endif
 	.else
 		vmovdqa	6*16(p_keys), xkeyB
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:280 @ ddq_add_8:
 	.set i, 0
 	.rept by
 		club XDATA, i
-		vaesenc	xkeyB, var_xdata, var_xdata		/* key 6 */
+		/* key 6 */
+		.if (klen == KEY_128)
+			vaesenc	xkey8, var_xdata, var_xdata
+		.else
+			vaesenc	xkeyB, var_xdata, var_xdata
+		.endif
 		.set i, (i +1)
 	.endr
 
 	.if (klen == KEY_128)
-		vmovdqa	8*16(p_keys), xkey8
+		vmovdqa	8*16(p_keys), xkeyB
 	.else
 		.if (load_keys)
 			vmovdqa	8*16(p_keys), xkey8
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:306 @ ddq_add_8:
 
 	.if (klen == KEY_128)
 		.if (load_keys)
-			vmovdqa	9*16(p_keys), xkeyA
+			vmovdqa	9*16(p_keys), xkey12
 		.endif
 	.else
 		vmovdqa	9*16(p_keys), xkeyA
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:315 @ ddq_add_8:
 	.set i, 0
 	.rept by
 		club XDATA, i
-		vaesenc	xkey8, var_xdata, var_xdata		/* key 8 */
+		/* key 8 */
+		.if (klen == KEY_128)
+			vaesenc	xkeyB, var_xdata, var_xdata
+		.else
+			vaesenc	xkey8, var_xdata, var_xdata
+		.endif
 		.set i, (i +1)
 	.endr
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:329 @ ddq_add_8:
 	.set i, 0
 	.rept by
 		club XDATA, i
-		vaesenc	xkeyA, var_xdata, var_xdata		/* key 9 */
+		/* key 9 */
+		.if (klen == KEY_128)
+			vaesenc	xkey12, var_xdata, var_xdata
+		.else
+			vaesenc	xkeyA, var_xdata, var_xdata
+		.endif
 		.set i, (i +1)
 	.endr
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:440 @ ddq_add_8:
 /* main body of aes ctr load */
 
 .macro do_aes_ctrmain key_len
-
 	cmp	$16, num_bytes
 	jb	.Ldo_return2\key_len
 
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/aes_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/aes_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/aes_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:69 @ module_exit(aes_fini);
 
 MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm, asm optimized");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("aes");
-MODULE_ALIAS("aes-asm");
+MODULE_ALIAS_CRYPTO("aes");
+MODULE_ALIAS_CRYPTO("aes-asm");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/aesni-intel_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/aesni-intel_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/aesni-intel_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1140 @ static int __driver_rfc4106_decrypt(stru
 		src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
 		if (!src)
 			return -ENOMEM;
-		assoc = (src + req->cryptlen + auth_tag_len);
+		assoc = (src + req->cryptlen);
 		scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
 		scatterwalk_map_and_copy(assoc, req->assoc, 0,
 			req->assoclen, 0);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1165 @ static int __driver_rfc4106_decrypt(stru
 		scatterwalk_done(&src_sg_walk, 0, 0);
 		scatterwalk_done(&assoc_sg_walk, 0, 0);
 	} else {
-		scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
+		scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
 		kfree(src);
 	}
 	return retval;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1553 @ module_exit(aesni_exit);
 
 MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm, Intel AES-NI instructions optimized");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("aes");
+MODULE_ALIAS_CRYPTO("aes");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/blowfish_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/blowfish_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/blowfish_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:481 @ module_exit(fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Blowfish Cipher Algorithm, asm optimized");
-MODULE_ALIAS("blowfish");
-MODULE_ALIAS("blowfish-asm");
+MODULE_ALIAS_CRYPTO("blowfish");
+MODULE_ALIAS_CRYPTO("blowfish-asm");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/camellia_aesni_avx2_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/camellia_aesni_avx2_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/camellia_aesni_avx2_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:585 @ module_exit(camellia_aesni_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Camellia Cipher Algorithm, AES-NI/AVX2 optimized");
-MODULE_ALIAS("camellia");
-MODULE_ALIAS("camellia-asm");
+MODULE_ALIAS_CRYPTO("camellia");
+MODULE_ALIAS_CRYPTO("camellia-asm");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/camellia_aesni_avx_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/camellia_aesni_avx_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/camellia_aesni_avx_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:577 @ module_exit(camellia_aesni_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Camellia Cipher Algorithm, AES-NI/AVX optimized");
-MODULE_ALIAS("camellia");
-MODULE_ALIAS("camellia-asm");
+MODULE_ALIAS_CRYPTO("camellia");
+MODULE_ALIAS_CRYPTO("camellia-asm");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/camellia_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/camellia_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/camellia_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1728 @ module_exit(fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Camellia Cipher Algorithm, asm optimized");
-MODULE_ALIAS("camellia");
-MODULE_ALIAS("camellia-asm");
+MODULE_ALIAS_CRYPTO("camellia");
+MODULE_ALIAS_CRYPTO("camellia-asm");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/cast5_avx_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/cast5_avx_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/cast5_avx_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:494 @ module_exit(cast5_exit);
 
 MODULE_DESCRIPTION("Cast5 Cipher Algorithm, AVX optimized");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("cast5");
+MODULE_ALIAS_CRYPTO("cast5");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/cast6_avx_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/cast6_avx_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/cast6_avx_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:614 @ module_exit(cast6_exit);
 
 MODULE_DESCRIPTION("Cast6 Cipher Algorithm, AVX optimized");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("cast6");
+MODULE_ALIAS_CRYPTO("cast6");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/crc32-pclmul_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/crc32-pclmul_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/crc32-pclmul_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:200 @ module_exit(crc32_pclmul_mod_fini);
 MODULE_AUTHOR("Alexander Boyko <alexander_boyko@xyratex.com>");
 MODULE_LICENSE("GPL");
 
-MODULE_ALIAS("crc32");
-MODULE_ALIAS("crc32-pclmul");
+MODULE_ALIAS_CRYPTO("crc32");
+MODULE_ALIAS_CRYPTO("crc32-pclmul");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/crc32c-intel_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/crc32c-intel_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/crc32c-intel_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:283 @ MODULE_AUTHOR("Austin Zhang <austin.zhan
 MODULE_DESCRIPTION("CRC32c (Castagnoli) optimization using Intel Hardware.");
 MODULE_LICENSE("GPL");
 
-MODULE_ALIAS("crc32c");
-MODULE_ALIAS("crc32c-intel");
+MODULE_ALIAS_CRYPTO("crc32c");
+MODULE_ALIAS_CRYPTO("crc32c-intel");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/crct10dif-pclmul_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/crct10dif-pclmul_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/crct10dif-pclmul_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:150 @ MODULE_AUTHOR("Tim Chen <tim.c.chen@linu
 MODULE_DESCRIPTION("T10 DIF CRC calculation accelerated with PCLMULQDQ.");
 MODULE_LICENSE("GPL");
 
-MODULE_ALIAS("crct10dif");
-MODULE_ALIAS("crct10dif-pclmul");
+MODULE_ALIAS_CRYPTO("crct10dif");
+MODULE_ALIAS_CRYPTO("crct10dif-pclmul");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/des3_ede_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/des3_ede_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/des3_ede_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:505 @ module_exit(des3_ede_x86_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Triple DES EDE Cipher Algorithm, asm optimized");
-MODULE_ALIAS("des3_ede");
-MODULE_ALIAS("des3_ede-asm");
-MODULE_ALIAS("des");
-MODULE_ALIAS("des-asm");
+MODULE_ALIAS_CRYPTO("des3_ede");
+MODULE_ALIAS_CRYPTO("des3_ede-asm");
+MODULE_ALIAS_CRYPTO("des");
+MODULE_ALIAS_CRYPTO("des-asm");
 MODULE_AUTHOR("Jussi Kivilinna <jussi.kivilinna@iki.fi>");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/fpu.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/fpu.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/fpu.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:20 @
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/crypto.h>
 #include <asm/i387.h>
 
 struct crypto_fpu_ctx {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:163 @ void __exit crypto_fpu_exit(void)
 {
 	crypto_unregister_template(&crypto_fpu_tmpl);
 }
+
+MODULE_ALIAS_CRYPTO("fpu");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/ghash-clmulni-intel_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/ghash-clmulni-intel_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/ghash-clmulni-intel_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:344 @ module_exit(ghash_pclmulqdqni_mod_exit);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("GHASH Message Digest Algorithm, "
 		   "acclerated by PCLMULQDQ-NI");
-MODULE_ALIAS("ghash");
+MODULE_ALIAS_CRYPTO("ghash");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/salsa20_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/salsa20_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/salsa20_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:122 @ module_exit(fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION ("Salsa20 stream cipher algorithm (optimized assembly version)");
-MODULE_ALIAS("salsa20");
-MODULE_ALIAS("salsa20-asm");
+MODULE_ALIAS_CRYPTO("salsa20");
+MODULE_ALIAS_CRYPTO("salsa20-asm");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/serpent_avx2_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/serpent_avx2_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/serpent_avx2_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:561 @ module_exit(fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Serpent Cipher Algorithm, AVX2 optimized");
-MODULE_ALIAS("serpent");
-MODULE_ALIAS("serpent-asm");
+MODULE_ALIAS_CRYPTO("serpent");
+MODULE_ALIAS_CRYPTO("serpent-asm");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/serpent_avx_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/serpent_avx_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/serpent_avx_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:620 @ module_exit(serpent_exit);
 
 MODULE_DESCRIPTION("Serpent Cipher Algorithm, AVX optimized");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("serpent");
+MODULE_ALIAS_CRYPTO("serpent");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/serpent_sse2_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/serpent_sse2_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/serpent_sse2_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:621 @ module_exit(serpent_sse2_exit);
 
 MODULE_DESCRIPTION("Serpent Cipher Algorithm, SSE2 optimized");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("serpent");
+MODULE_ALIAS_CRYPTO("serpent");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/sha-mb/sha1_mb.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/sha-mb/sha1_mb.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/sha-mb/sha1_mb.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:935 @ module_exit(sha1_mb_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm, multi buffer accelerated");
 
-MODULE_ALIAS("sha1");
+MODULE_ALIAS_CRYPTO("sha1");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/sha1_ssse3_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/sha1_ssse3_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/sha1_ssse3_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:281 @ module_exit(sha1_ssse3_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm, Supplemental SSE3 accelerated");
 
-MODULE_ALIAS("sha1");
+MODULE_ALIAS_CRYPTO("sha1");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/sha256_ssse3_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/sha256_ssse3_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/sha256_ssse3_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:321 @ module_exit(sha256_ssse3_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA256 Secure Hash Algorithm, Supplemental SSE3 accelerated");
 
-MODULE_ALIAS("sha256");
-MODULE_ALIAS("sha224");
+MODULE_ALIAS_CRYPTO("sha256");
+MODULE_ALIAS_CRYPTO("sha224");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/sha512_ssse3_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/sha512_ssse3_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/sha512_ssse3_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:329 @ module_exit(sha512_ssse3_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA512 Secure Hash Algorithm, Supplemental SSE3 accelerated");
 
-MODULE_ALIAS("sha512");
-MODULE_ALIAS("sha384");
+MODULE_ALIAS_CRYPTO("sha512");
+MODULE_ALIAS_CRYPTO("sha384");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/twofish_avx_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/twofish_avx_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/twofish_avx_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:582 @ module_exit(twofish_exit);
 
 MODULE_DESCRIPTION("Twofish Cipher Algorithm, AVX optimized");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("twofish");
+MODULE_ALIAS_CRYPTO("twofish");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/twofish_glue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/twofish_glue.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/twofish_glue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:99 @ module_exit(fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION ("Twofish Cipher Algorithm, asm optimized");
-MODULE_ALIAS("twofish");
-MODULE_ALIAS("twofish-asm");
+MODULE_ALIAS_CRYPTO("twofish");
+MODULE_ALIAS_CRYPTO("twofish-asm");
Index: linux-3.18.13-rt10-r7s4/arch/x86/crypto/twofish_glue_3way.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/crypto/twofish_glue_3way.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/crypto/twofish_glue_3way.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:498 @ module_exit(fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Twofish Cipher Algorithm, 3-way parallel asm optimized");
-MODULE_ALIAS("twofish");
-MODULE_ALIAS("twofish-asm");
+MODULE_ALIAS_CRYPTO("twofish");
+MODULE_ALIAS_CRYPTO("twofish-asm");
Index: linux-3.18.13-rt10-r7s4/arch/x86/include/asm/desc.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/include/asm/desc.h
+++ linux-3.18.13-rt10-r7s4/arch/x86/include/asm/desc.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:254 @ static inline void native_load_tls(struc
 		gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
 }
 
-#define _LDT_empty(info)				\
+/* This intentionally ignores lm, since 32-bit apps don't have that field. */
+#define LDT_empty(info)					\
 	((info)->base_addr		== 0	&&	\
 	 (info)->limit			== 0	&&	\
 	 (info)->contents		== 0	&&	\
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:265 @ static inline void native_load_tls(struc
 	 (info)->seg_not_present	== 1	&&	\
 	 (info)->useable		== 0)
 
-#ifdef CONFIG_X86_64
-#define LDT_empty(info) (_LDT_empty(info) && ((info)->lm == 0))
-#else
-#define LDT_empty(info) (_LDT_empty(info))
-#endif
+/* Lots of programs expect an all-zero user_desc to mean "no segment at all". */
+static inline bool LDT_zero(const struct user_desc *info)
+{
+	return (info->base_addr		== 0 &&
+		info->limit		== 0 &&
+		info->contents		== 0 &&
+		info->read_exec_only	== 0 &&
+		info->seg_32bit		== 0 &&
+		info->limit_in_pages	== 0 &&
+		info->seg_not_present	== 0 &&
+		info->useable		== 0);
+}
 
 static inline void clear_LDT(void)
 {
Index: linux-3.18.13-rt10-r7s4/arch/x86/include/asm/fpu-internal.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/include/asm/fpu-internal.h
+++ linux-3.18.13-rt10-r7s4/arch/x86/include/asm/fpu-internal.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:371 @ static inline void drop_fpu(struct task_
 	preempt_disable();
 	tsk->thread.fpu_counter = 0;
 	__drop_fpu(tsk);
-	clear_used_math();
+	clear_stopped_child_used_math(tsk);
 	preempt_enable();
 }
 
Index: linux-3.18.13-rt10-r7s4/arch/x86/include/asm/microcode.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/include/asm/microcode.h
+++ linux-3.18.13-rt10-r7s4/arch/x86/include/asm/microcode.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:81 @ static inline void __exit exit_amd_micro
 extern void __init load_ucode_bsp(void);
 extern void load_ucode_ap(void);
 extern int __init save_microcode_in_initrd(void);
+void reload_early_microcode(void);
 #else
 static inline void __init load_ucode_bsp(void) {}
 static inline void load_ucode_ap(void) {}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:89 @ static inline int __init save_microcode_
 {
 	return 0;
 }
+static inline void reload_early_microcode(void) {}
 #endif
 
 #endif /* _ASM_X86_MICROCODE_H */
Index: linux-3.18.13-rt10-r7s4/arch/x86/include/asm/microcode_amd.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/include/asm/microcode_amd.h
+++ linux-3.18.13-rt10-r7s4/arch/x86/include/asm/microcode_amd.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:62 @ static inline u16 find_equiv_id(struct e
 
 extern int __apply_microcode_amd(struct microcode_amd *mc_amd);
 extern int apply_microcode_amd(int cpu);
-extern enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size);
+extern enum ucode_state load_microcode_amd(int cpu, u8 family, const u8 *data, size_t size);
 
 #define PATCH_MAX_SIZE PAGE_SIZE
 extern u8 amd_ucode_patch[PATCH_MAX_SIZE];
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:71 @ extern u8 amd_ucode_patch[PATCH_MAX_SIZE
 extern void __init load_ucode_amd_bsp(void);
 extern void load_ucode_amd_ap(void);
 extern int __init save_microcode_in_initrd_amd(void);
+void reload_ucode_amd(void);
 #else
 static inline void __init load_ucode_amd_bsp(void) {}
 static inline void load_ucode_amd_ap(void) {}
 static inline int __init save_microcode_in_initrd_amd(void) { return -EINVAL; }
+void reload_ucode_amd(void) {}
 #endif
 
 #endif /* _ASM_X86_MICROCODE_AMD_H */
Index: linux-3.18.13-rt10-r7s4/arch/x86/include/asm/microcode_intel.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/include/asm/microcode_intel.h
+++ linux-3.18.13-rt10-r7s4/arch/x86/include/asm/microcode_intel.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:71 @ extern void __init load_ucode_intel_bsp(
 extern void load_ucode_intel_ap(void);
 extern void show_ucode_info_early(void);
 extern int __init save_microcode_in_initrd_intel(void);
+void reload_ucode_intel(void);
 #else
 static inline __init void load_ucode_intel_bsp(void) {}
 static inline void load_ucode_intel_ap(void) {}
 static inline void show_ucode_info_early(void) {}
 static inline int __init save_microcode_in_initrd_intel(void) { return -EINVAL; }
+static inline void reload_ucode_intel(void) {}
 #endif
 
 #if defined(CONFIG_MICROCODE_INTEL_EARLY) && defined(CONFIG_HOTPLUG_CPU)
Index: linux-3.18.13-rt10-r7s4/arch/x86/include/asm/vsyscall.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/include/asm/vsyscall.h
+++ linux-3.18.13-rt10-r7s4/arch/x86/include/asm/vsyscall.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:37 @ static inline unsigned int __getcpu(void
 		native_read_tscp(&p);
 	} else {
 		/* Load per CPU data from GDT */
-		asm("lsl %1,%0" : "=r" (p) : "r" (__PER_CPU_SEG));
+		asm volatile ("lsl %1,%0" : "=r" (p) : "r" (__PER_CPU_SEG));
 	}
 
 	return p;
Index: linux-3.18.13-rt10-r7s4/arch/x86/include/asm/xen/page.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/include/asm/xen/page.h
+++ linux-3.18.13-rt10-r7s4/arch/x86/include/asm/xen/page.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:239 @ void make_lowmem_page_readwrite(void *va
 #define xen_remap(cookie, size) ioremap((cookie), (size));
 #define xen_unmap(cookie) iounmap((cookie))
 
+static inline bool xen_arch_need_swiotlb(struct device *dev,
+					 unsigned long pfn,
+					 unsigned long mfn)
+{
+	return false;
+}
+
 #endif /* _ASM_X86_XEN_PAGE_H */
Index: linux-3.18.13-rt10-r7s4/arch/x86/include/asm/xsave.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/include/asm/xsave.h
+++ linux-3.18.13-rt10-r7s4/arch/x86/include/asm/xsave.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:84 @ static inline int xsave_state_booting(st
 	if (boot_cpu_has(X86_FEATURE_XSAVES))
 		asm volatile("1:"XSAVES"\n\t"
 			"2:\n\t"
-			: : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+			     xstate_fault
+			: "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
 			:   "memory");
 	else
 		asm volatile("1:"XSAVE"\n\t"
 			"2:\n\t"
-			: : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+			     xstate_fault
+			: "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
 			:   "memory");
-
-	asm volatile(xstate_fault
-		     : "0" (0)
-		     : "memory");
-
 	return err;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:111 @ static inline int xrstor_state_booting(s
 	if (boot_cpu_has(X86_FEATURE_XSAVES))
 		asm volatile("1:"XRSTORS"\n\t"
 			"2:\n\t"
-			: : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+			     xstate_fault
+			: "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
 			:   "memory");
 	else
 		asm volatile("1:"XRSTOR"\n\t"
 			"2:\n\t"
-			: : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+			     xstate_fault
+			: "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
 			:   "memory");
-
-	asm volatile(xstate_fault
-		     : "0" (0)
-		     : "memory");
-
 	return err;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:145 @ static inline int xsave_state(struct xsa
 	 */
 	alternative_input_2(
 		"1:"XSAVE,
-		"1:"XSAVEOPT,
+		XSAVEOPT,
 		X86_FEATURE_XSAVEOPT,
-		"1:"XSAVES,
+		XSAVES,
 		X86_FEATURE_XSAVES,
 		[fx] "D" (fx), "a" (lmask), "d" (hmask) :
 		"memory");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:174 @ static inline int xrstor_state(struct xs
 	 */
 	alternative_input(
 		"1: " XRSTOR,
-		"1: " XRSTORS,
+		XRSTORS,
 		X86_FEATURE_XSAVES,
 		"D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
 		: "memory");
Index: linux-3.18.13-rt10-r7s4/arch/x86/include/uapi/asm/ldt.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/include/uapi/asm/ldt.h
+++ linux-3.18.13-rt10-r7s4/arch/x86/include/uapi/asm/ldt.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:31 @ struct user_desc {
 	unsigned int  seg_not_present:1;
 	unsigned int  useable:1;
 #ifdef __x86_64__
+	/*
+	 * Because this bit is not present in 32-bit user code, user
+	 * programs can pass uninitialized values here.  Therefore, in
+	 * any context in which a user_desc comes from a 32-bit program,
+	 * the kernel must act as though lm == 0, regardless of the
+	 * actual value.
+	 */
 	unsigned int  lm:1;
 #endif
 };
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/acpi/boot.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/acpi/boot.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/acpi/boot.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:607 @ void __init acpi_pic_sci_set_trigger(uns
 
 int acpi_gsi_to_irq(u32 gsi, unsigned int *irqp)
 {
-	int irq;
+	int rc, irq, trigger, polarity;
 
 	if (acpi_irq_model == ACPI_IRQ_MODEL_PIC) {
 		*irqp = gsi;
-	} else {
-		irq = mp_map_gsi_to_irq(gsi,
-					IOAPIC_MAP_ALLOC | IOAPIC_MAP_CHECK);
-		if (irq < 0)
-			return -1;
-		*irqp = irq;
+		return 0;
 	}
-	return 0;
+
+	rc = acpi_get_override_irq(gsi, &trigger, &polarity);
+	if (rc == 0) {
+		trigger = trigger ? ACPI_LEVEL_SENSITIVE : ACPI_EDGE_SENSITIVE;
+		polarity = polarity ? ACPI_ACTIVE_LOW : ACPI_ACTIVE_HIGH;
+		irq = acpi_register_gsi(NULL, gsi, trigger, polarity);
+		if (irq >= 0) {
+			*irqp = irq;
+			return 0;
+		}
+	}
+	return -1;
 }
 EXPORT_SYMBOL_GPL(acpi_gsi_to_irq);
 
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/apic/apic_numachip.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/apic/apic_numachip.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/apic/apic_numachip.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:43 @ static unsigned int get_apic_id(unsigned
 	unsigned int id;
 
 	rdmsrl(MSR_FAM10H_NODE_ID, value);
-	id = ((x >> 24) & 0xffU) | ((value << 2) & 0x3f00U);
+	id = ((x >> 24) & 0xffU) | ((value << 2) & 0xff00U);
 
 	return id;
 }
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/Makefile
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/cpu/Makefile
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/Makefile
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:69 @ targets += capflags.c
 $(obj)/capflags.c: $(cpufeature) $(src)/mkcapflags.sh FORCE
 	$(call if_changed,mkcapflags)
 endif
+clean-files += capflags.c
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/microcode/amd.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/cpu/microcode/amd.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/microcode/amd.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:379 @ static enum ucode_state __load_microcode
 	return UCODE_OK;
 }
 
-enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size)
+enum ucode_state load_microcode_amd(int cpu, u8 family, const u8 *data, size_t size)
 {
 	enum ucode_state ret;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:393 @ enum ucode_state load_microcode_amd(u8 f
 
 #if defined(CONFIG_MICROCODE_AMD_EARLY) && defined(CONFIG_X86_32)
 	/* save BSP's matching patch for early load */
-	if (cpu_data(smp_processor_id()).cpu_index == boot_cpu_data.cpu_index) {
-		struct ucode_patch *p = find_patch(smp_processor_id());
+	if (cpu_data(cpu).cpu_index == boot_cpu_data.cpu_index) {
+		struct ucode_patch *p = find_patch(cpu);
 		if (p) {
 			memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);
 			memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:447 @ static enum ucode_state request_microcod
 		goto fw_release;
 	}
 
-	ret = load_microcode_amd(c->x86, fw->data, fw->size);
+	ret = load_microcode_amd(cpu, c->x86, fw->data, fw->size);
 
  fw_release:
 	release_firmware(fw);
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/microcode/amd_early.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/cpu/microcode/amd_early.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/microcode/amd_early.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:392 @ int __init save_microcode_in_initrd_amd(
 	eax   = cpuid_eax(0x00000001);
 	eax   = ((eax >> 8) & 0xf) + ((eax >> 20) & 0xff);
 
-	ret = load_microcode_amd(eax, container, container_size);
+	ret = load_microcode_amd(smp_processor_id(), eax, container, container_size);
 	if (ret != UCODE_OK)
 		retval = -EINVAL;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:405 @ int __init save_microcode_in_initrd_amd(
 
 	return retval;
 }
+
+void reload_ucode_amd(void)
+{
+	struct microcode_amd *mc;
+	u32 rev, eax;
+
+	rdmsr(MSR_AMD64_PATCH_LEVEL, rev, eax);
+
+	mc = (struct microcode_amd *)amd_ucode_patch;
+
+	if (mc && rev < mc->hdr.patch_id) {
+		if (!__apply_microcode_amd(mc)) {
+			ucode_new_rev = mc->hdr.patch_id;
+			pr_info("microcode: reload patch_level=0x%08x\n",
+				ucode_new_rev);
+		}
+	}
+}
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/microcode/core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/cpu/microcode/core.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/microcode/core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:468 @ static void mc_bp_resume(void)
 
 	if (uci->valid && uci->mc)
 		microcode_ops->apply_microcode(cpu);
-#ifdef CONFIG_X86_64
 	else if (!uci->mc)
-		/*
-		 * We might resume and not have applied late microcode but still
-		 * have a newer patch stashed from the early loader. We don't
-		 * have it in uci->mc so we have to load it the same way we're
-		 * applying patches early on the APs.
-		 */
-		load_ucode_ap();
-#endif
+		reload_early_microcode();
 }
 
 static struct syscore_ops mc_syscore_ops = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:554 @ static int __init microcode_init(void)
 	struct cpuinfo_x86 *c = &cpu_data(0);
 	int error;
 
-	if (dis_ucode_ldr)
-		return 0;
+	if (paravirt_enabled() || dis_ucode_ldr)
+		return -EINVAL;
 
 	if (c->x86_vendor == X86_VENDOR_INTEL)
 		microcode_ops = init_intel_microcode();
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/microcode/core_early.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/cpu/microcode/core_early.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/microcode/core_early.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:179 @ int __init save_microcode_in_initrd(void
 
 	return 0;
 }
+
+void reload_early_microcode(void)
+{
+	int vendor, x86;
+
+	vendor = x86_vendor();
+	x86 = x86_family();
+
+	switch (vendor) {
+	case X86_VENDOR_INTEL:
+		if (x86 >= 6)
+			reload_ucode_intel();
+		break;
+	case X86_VENDOR_AMD:
+		if (x86 >= 0x10)
+			reload_ucode_amd();
+		break;
+	default:
+		break;
+	}
+}
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/microcode/intel_early.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/cpu/microcode/intel_early.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/microcode/intel_early.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:653 @ static inline void print_ucode(struct uc
 }
 #endif
 
-static int apply_microcode_early(struct mc_saved_data *mc_saved_data,
-				 struct ucode_cpu_info *uci)
+static int apply_microcode_early(struct ucode_cpu_info *uci, bool early)
 {
 	struct microcode_intel *mc_intel;
 	unsigned int val[2];
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:682 @ static int apply_microcode_early(struct
 #endif
 	uci->cpu_sig.rev = val[1];
 
-	print_ucode(uci);
+	if (early)
+		print_ucode(uci);
+	else
+		print_ucode_info(uci, mc_intel->hdr.date);
 
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:720 @ _load_ucode_intel_bsp(struct mc_saved_da
 		      unsigned long initrd_end_early,
 		      struct ucode_cpu_info *uci)
 {
+	enum ucode_state ret;
+
 	collect_cpu_info_early(uci);
 	scan_microcode(initrd_start_early, initrd_end_early, mc_saved_data,
 		       mc_saved_in_initrd, uci);
-	load_microcode(mc_saved_data, mc_saved_in_initrd,
-		       initrd_start_early, uci);
-	apply_microcode_early(mc_saved_data, uci);
+
+	ret = load_microcode(mc_saved_data, mc_saved_in_initrd,
+			     initrd_start_early, uci);
+
+	if (ret == UCODE_OK)
+		apply_microcode_early(uci, true);
 }
 
 void __init
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:759 @ load_ucode_intel_bsp(void)
 	initrd_end_early = initrd_start_early + ramdisk_size;
 
 	_load_ucode_intel_bsp(&mc_saved_data, mc_saved_in_initrd,
-			      initrd_start_early, initrd_end_early, &uci);
+			      initrd_start_early, initrd_end_early,
+			      &uci);
 #endif
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:794 @ void load_ucode_intel_ap(void)
 	collect_cpu_info_early(&uci);
 	load_microcode(mc_saved_data_p, mc_saved_in_initrd_p,
 		       initrd_start_addr, &uci);
-	apply_microcode_early(mc_saved_data_p, &uci);
+	apply_microcode_early(&uci, true);
+}
+
+void reload_ucode_intel(void)
+{
+	struct ucode_cpu_info uci;
+	enum ucode_state ret;
+
+	if (!mc_saved_data.mc_saved_count)
+		return;
+
+	collect_cpu_info_early(&uci);
+
+	ret = generic_load_microcode_early(mc_saved_data.mc_saved,
+					   mc_saved_data.mc_saved_count, &uci);
+	if (ret != UCODE_OK)
+		return;
+
+	apply_microcode_early(&uci, false);
 }
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/mshyperv.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/cpu/mshyperv.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/mshyperv.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:110 @ static struct clocksource hyperv_cs = {
 	.rating		= 400, /* use this when running on Hyperv*/
 	.read		= read_hv_clock,
 	.mask		= CLOCKSOURCE_MASK(64),
+	.flags		= CLOCK_SOURCE_IS_CONTINUOUS,
 };
 
 static void __init ms_hyperv_init_platform(void)
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/perf_event_intel.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/cpu/perf_event_intel.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/perf_event_intel.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2434 @ __init int intel_pmu_init(void)
 		break;
 
 	case 55: /* 22nm Atom "Silvermont"                */
+	case 76: /* 14nm Atom "Airmont"                   */
 	case 77: /* 22nm Atom "Silvermont Avoton/Rangely" */
 		memcpy(hw_cache_event_ids, slm_hw_cache_event_ids,
 			sizeof(hw_cache_event_ids));
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/perf_event_intel_rapl.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/cpu/perf_event_intel_rapl.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/perf_event_intel_rapl.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:138 @ static inline u64 rapl_scale(u64 v)
 	 * or use ldexp(count, -32).
 	 * Watts = Joules/Time delta
 	 */
-	return v << (32 - __this_cpu_read(rapl_pmu->hw_unit));
+	return v << (32 - __this_cpu_read(rapl_pmu)->hw_unit);
 }
 
 static u64 rapl_event_update(struct perf_event *event)
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/perf_event_intel_uncore.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:279 @ static struct intel_uncore_box *uncore_a
 	return box;
 }
 
+/*
+ * Using uncore_pmu_event_init pmu event_init callback
+ * as a detection point for uncore events.
+ */
+static int uncore_pmu_event_init(struct perf_event *event);
+
+static bool is_uncore_event(struct perf_event *event)
+{
+	return event->pmu->event_init == uncore_pmu_event_init;
+}
+
 static int
 uncore_collect_events(struct intel_uncore_box *box, struct perf_event *leader, bool dogrp)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:304 @ uncore_collect_events(struct intel_uncor
 		return -EINVAL;
 
 	n = box->n_events;
-	box->event_list[n] = leader;
-	n++;
+
+	if (is_uncore_event(leader)) {
+		box->event_list[n] = leader;
+		n++;
+	}
+
 	if (!dogrp)
 		return n;
 
 	list_for_each_entry(event, &leader->sibling_list, group_entry) {
-		if (event->state <= PERF_EVENT_STATE_OFF)
+		if (!is_uncore_event(event) ||
+		    event->state <= PERF_EVENT_STATE_OFF)
 			continue;
 
 		if (n >= max_count)
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/perf_event_intel_uncore.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/cpu/perf_event_intel_uncore.h
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/perf_event_intel_uncore.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:20 @
 #define UNCORE_PCI_DEV_TYPE(data)	((data >> 8) & 0xff)
 #define UNCORE_PCI_DEV_IDX(data)	(data & 0xff)
 #define UNCORE_EXTRA_PCI_DEV		0xff
-#define UNCORE_EXTRA_PCI_DEV_MAX	2
+#define UNCORE_EXTRA_PCI_DEV_MAX	3
 
 /* support up to 8 sockets */
 #define UNCORE_SOCKET_MAX		8
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:890 @ void snbep_uncore_cpu_init(void)
 enum {
 	SNBEP_PCI_QPI_PORT0_FILTER,
 	SNBEP_PCI_QPI_PORT1_FILTER,
+	HSWEP_PCI_PCU_3,
 };
 
 static int snbep_qpi_hw_config(struct intel_uncore_box *box, struct perf_event *event)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2026 @ void hswep_uncore_cpu_init(void)
 {
 	if (hswep_uncore_cbox.num_boxes > boot_cpu_data.x86_max_cores)
 		hswep_uncore_cbox.num_boxes = boot_cpu_data.x86_max_cores;
+
+	/* Detect 6-8 core systems with only two SBOXes */
+	if (uncore_extra_pci_dev[0][HSWEP_PCI_PCU_3]) {
+		u32 capid4;
+
+		pci_read_config_dword(uncore_extra_pci_dev[0][HSWEP_PCI_PCU_3],
+				      0x94, &capid4);
+		if (((capid4 >> 6) & 0x3) == 0)
+			hswep_uncore_sbox.num_boxes = 2;
+	}
+
 	uncore_msr_uncores = hswep_msr_uncores;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2294 @ static DEFINE_PCI_DEVICE_TABLE(hswep_unc
 		.driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
 						   SNBEP_PCI_QPI_PORT1_FILTER),
 	},
+	{ /* PCU.3 (for Capability registers) */
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fc0),
+		.driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
+						   HSWEP_PCI_PCU_3),
+	},
 	{ /* end: all zeroes */ }
 };
 
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/entry_64.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/entry_64.S
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/entry_64.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:337 @ ENTRY(ret_from_fork)
 	testl $3, CS-ARGOFFSET(%rsp)		# from kernel_thread?
 	jz   1f
 
-	testl $_TIF_IA32, TI_flags(%rcx)	# 32-bit compat task needs IRET
-	jnz  int_ret_from_sys_call
-
-	RESTORE_TOP_OF_STACK %rdi, -ARGOFFSET
-	jmp ret_from_sys_call			# go to the SYSRET fastpath
+	/*
+	 * By the time we get here, we have no idea whether our pt_regs,
+	 * ti flags, and ti status came from the 64-bit SYSCALL fast path,
+	 * the slow path, or one of the ia32entry paths.
+	 * Use int_ret_from_sys_call to return, since it can safely handle
+	 * all of the above.
+	 */
+	jmp  int_ret_from_sys_call
 
 1:
 	subq $REST_SKIP, %rsp	# leave space for volatiles
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/irq.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/irq.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/irq.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:130 @ int arch_show_interrupts(struct seq_file
 	seq_printf(p, "  Machine check polls\n");
 #endif
 #if IS_ENABLED(CONFIG_HYPERV) || defined(CONFIG_XEN)
-	seq_printf(p, "%*s: ", prec, "THR");
+	seq_printf(p, "%*s: ", prec, "HYP");
 	for_each_online_cpu(j)
 		seq_printf(p, "%10u ", irq_stats(j)->irq_hv_callback_count);
 	seq_printf(p, "  Hypervisor callback interrupts\n");
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/kprobes/core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/kprobes/core.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/kprobes/core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1021 @ int setjmp_pre_handler(struct kprobe *p,
 	regs->flags &= ~X86_EFLAGS_IF;
 	trace_hardirqs_off();
 	regs->ip = (unsigned long)(jp->entry);
+
+	/*
+	 * jprobes use jprobe_return() which skips the normal return
+	 * path of the function, and this messes up the accounting of the
+	 * function graph tracer to get messed up.
+	 *
+	 * Pause function graph tracing while performing the jprobe function.
+	 */
+	pause_graph_tracing();
 	return 1;
 }
 NOKPROBE_SYMBOL(setjmp_pre_handler);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1058 @ int longjmp_break_handler(struct kprobe
 	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
 	u8 *addr = (u8 *) (regs->ip - 1);
 	struct jprobe *jp = container_of(p, struct jprobe, kp);
+	void *saved_sp = kcb->jprobe_saved_sp;
 
 	if ((addr > (u8 *) jprobe_return) &&
 	    (addr < (u8 *) jprobe_return_end)) {
-		if (stack_addr(regs) != kcb->jprobe_saved_sp) {
+		if (stack_addr(regs) != saved_sp) {
 			struct pt_regs *saved_regs = &kcb->jprobe_saved_regs;
 			printk(KERN_ERR
 			       "current sp %p does not match saved sp %p\n",
-			       stack_addr(regs), kcb->jprobe_saved_sp);
+			       stack_addr(regs), saved_sp);
 			printk(KERN_ERR "Saved registers for jprobe %p\n", jp);
 			show_regs(saved_regs);
 			printk(KERN_ERR "Current registers\n");
 			show_regs(regs);
 			BUG();
 		}
+		/* It's OK to start function graph tracing again */
+		unpause_graph_tracing();
 		*regs = kcb->jprobe_saved_regs;
-		memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp),
-		       kcb->jprobes_stack,
-		       MIN_STACK_SIZE(kcb->jprobe_saved_sp));
+		memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp));
 		preempt_enable_no_resched();
 		return 1;
 	}
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/kvm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/kvm.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/kvm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:286 @ NOKPROBE_SYMBOL(do_async_page_fault);
 static void __init paravirt_ops_setup(void)
 {
 	pv_info.name = "KVM";
-	pv_info.paravirt_enabled = 1;
+
+	/*
+	 * KVM isn't paravirt in the sense of paravirt_enabled.  A KVM
+	 * guest kernel works like a bare metal kernel with additional
+	 * features, and paravirt_enabled is about features that are
+	 * missing.
+	 */
+	pv_info.paravirt_enabled = 0;
 
 	if (kvm_para_has_feature(KVM_FEATURE_NOP_IO_DELAY))
 		pv_cpu_ops.io_delay = kvm_io_delay;
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/kvmclock.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/kvmclock.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/kvmclock.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:266 @ void __init kvmclock_init(void)
 #endif
 	kvm_get_preset_lpj();
 	clocksource_register_hz(&kvm_clock, NSEC_PER_SEC);
-	pv_info.paravirt_enabled = 1;
 	pv_info.name = "KVM";
 
 	if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE_STABLE_BIT))
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/pmc_atom.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/pmc_atom.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/pmc_atom.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:220 @ static int pmc_dbgfs_register(struct pmc
 	if (!dir)
 		return -ENOMEM;
 
+	pmc->dbgfs_dir = dir;
+
 	f = debugfs_create_file("dev_state", S_IFREG | S_IRUGO,
 				dir, pmc, &pmc_dev_state_ops);
 	if (!f) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:234 @ static int pmc_dbgfs_register(struct pmc
 		dev_err(&pdev->dev, "sleep_state register failed\n");
 		goto err;
 	}
-	pmc->dbgfs_dir = dir;
+
 	return 0;
 err:
 	pmc_dbgfs_unregister(pmc);
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/process_64.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/process_64.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/process_64.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:286 @ __switch_to(struct task_struct *prev_p,
 
 	fpu = switch_fpu_prepare(prev_p, next_p, cpu);
 
-	/*
-	 * Reload esp0, LDT and the page table pointer:
-	 */
+	/* Reload esp0 and ss1. */
 	load_sp0(tss, next);
 
-	/*
-	 * Switch DS and ES.
-	 * This won't pick up thread selector changes, but I guess that is ok.
-	 */
-	savesegment(es, prev->es);
-	if (unlikely(next->es | prev->es))
-		loadsegment(es, next->es);
-
-	savesegment(ds, prev->ds);
-	if (unlikely(next->ds | prev->ds))
-		loadsegment(ds, next->ds);
-
-
 	/* We must save %fs and %gs before load_TLS() because
 	 * %fs and %gs may be cleared by load_TLS().
 	 *
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:297 @ __switch_to(struct task_struct *prev_p,
 	savesegment(fs, fsindex);
 	savesegment(gs, gsindex);
 
+	/*
+	 * Load TLS before restoring any segments so that segment loads
+	 * reference the correct GDT entries.
+	 */
 	load_TLS(next, cpu);
 
 	/*
-	 * Leave lazy mode, flushing any hypercalls made here.
-	 * This must be done before restoring TLS segments so
-	 * the GDT and LDT are properly updated, and must be
-	 * done before math_state_restore, so the TS bit is up
-	 * to date.
+	 * Leave lazy mode, flushing any hypercalls made here.  This
+	 * must be done after loading TLS entries in the GDT but before
+	 * loading segments that might reference them, and and it must
+	 * be done before math_state_restore, so the TS bit is up to
+	 * date.
 	 */
 	arch_end_context_switch(next_p);
 
+	/* Switch DS and ES.
+	 *
+	 * Reading them only returns the selectors, but writing them (if
+	 * nonzero) loads the full descriptor from the GDT or LDT.  The
+	 * LDT for next is loaded in switch_mm, and the GDT is loaded
+	 * above.
+	 *
+	 * We therefore need to write new values to the segment
+	 * registers on every context switch unless both the new and old
+	 * values are zero.
+	 *
+	 * Note that we don't need to do anything for CS and SS, as
+	 * those are saved and restored as part of pt_regs.
+	 */
+	savesegment(es, prev->es);
+	if (unlikely(next->es | prev->es))
+		loadsegment(es, next->es);
+
+	savesegment(ds, prev->ds);
+	if (unlikely(next->ds | prev->ds))
+		loadsegment(ds, next->ds);
+
 	/*
 	 * Switch FS and GS.
 	 *
-	 * Segment register != 0 always requires a reload.  Also
-	 * reload when it has changed.  When prev process used 64bit
-	 * base always reload to avoid an information leak.
+	 * These are even more complicated than FS and GS: they have
+	 * 64-bit bases are that controlled by arch_prctl.  Those bases
+	 * only differ from the values in the GDT or LDT if the selector
+	 * is 0.
+	 *
+	 * Loading the segment register resets the hidden base part of
+	 * the register to 0 or the value from the GDT / LDT.  If the
+	 * next base address zero, writing 0 to the segment register is
+	 * much faster than using wrmsr to explicitly zero the base.
+	 *
+	 * The thread_struct.fs and thread_struct.gs values are 0
+	 * if the fs and gs bases respectively are not overridden
+	 * from the values implied by fsindex and gsindex.  They
+	 * are nonzero, and store the nonzero base addresses, if
+	 * the bases are overridden.
+	 *
+	 * (fs != 0 && fsindex != 0) || (gs != 0 && gsindex != 0) should
+	 * be impossible.
+	 *
+	 * Therefore we need to reload the segment registers if either
+	 * the old or new selector is nonzero, and we need to override
+	 * the base address if next thread expects it to be overridden.
+	 *
+	 * This code is unnecessarily slow in the case where the old and
+	 * new indexes are zero and the new base is nonzero -- it will
+	 * unnecessarily write 0 to the selector before writing the new
+	 * base address.
+	 *
+	 * Note: This all depends on arch_prctl being the only way that
+	 * user code can override the segment base.  Once wrfsbase and
+	 * wrgsbase are enabled, most of this code will need to change.
 	 */
 	if (unlikely(fsindex | next->fsindex | prev->fs)) {
 		loadsegment(fs, next->fsindex);
+
 		/*
-		 * Check if the user used a selector != 0; if yes
-		 *  clear 64bit base, since overloaded base is always
-		 *  mapped to the Null selector
+		 * If user code wrote a nonzero value to FS, then it also
+		 * cleared the overridden base address.
+		 *
+		 * XXX: if user code wrote 0 to FS and cleared the base
+		 * address itself, we won't notice and we'll incorrectly
+		 * restore the prior base address next time we reschdule
+		 * the process.
 		 */
 		if (fsindex)
 			prev->fs = 0;
 	}
-	/* when next process has a 64bit base use it */
 	if (next->fs)
 		wrmsrl(MSR_FS_BASE, next->fs);
 	prev->fsindex = fsindex;
 
 	if (unlikely(gsindex | next->gsindex | prev->gs)) {
 		load_gs_index(next->gsindex);
+
+		/* This works (and fails) the same way as fsindex above. */
 		if (gsindex)
 			prev->gs = 0;
 	}
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/reboot.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/reboot.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/reboot.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:185 @ static struct dmi_system_id __initdata r
 		},
 	},
 
+	/* ASRock */
+	{	/* Handle problems with rebooting on ASRock Q1900DC-ITX */
+		.callback = set_pci_reboot,
+		.ident = "ASRock Q1900DC-ITX",
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "ASRock"),
+			DMI_MATCH(DMI_BOARD_NAME, "Q1900DC-ITX"),
+		},
+	},
+
 	/* ASUS */
 	{	/* Handle problems with rebooting on ASUS P4S800 */
 		.callback = set_bios_reboot,
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/tls.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/tls.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/tls.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:30 @ static int get_free_idx(void)
 	return -ESRCH;
 }
 
+static bool tls_desc_okay(const struct user_desc *info)
+{
+	/*
+	 * For historical reasons (i.e. no one ever documented how any
+	 * of the segmentation APIs work), user programs can and do
+	 * assume that a struct user_desc that's all zeros except for
+	 * entry_number means "no segment at all".  This never actually
+	 * worked.  In fact, up to Linux 3.19, a struct user_desc like
+	 * this would create a 16-bit read-write segment with base and
+	 * limit both equal to zero.
+	 *
+	 * That was close enough to "no segment at all" until we
+	 * hardened this function to disallow 16-bit TLS segments.  Fix
+	 * it up by interpreting these zeroed segments the way that they
+	 * were almost certainly intended to be interpreted.
+	 *
+	 * The correct way to ask for "no segment at all" is to specify
+	 * a user_desc that satisfies LDT_empty.  To keep everything
+	 * working, we accept both.
+	 *
+	 * Note that there's a similar kludge in modify_ldt -- look at
+	 * the distinction between modes 1 and 0x11.
+	 */
+	if (LDT_empty(info) || LDT_zero(info))
+		return true;
+
+	/*
+	 * espfix is required for 16-bit data segments, but espfix
+	 * only works for LDT segments.
+	 */
+	if (!info->seg_32bit)
+		return false;
+
+	/* Only allow data segments in the TLS array. */
+	if (info->contents > 1)
+		return false;
+
+	/*
+	 * Non-present segments with DPL 3 present an interesting attack
+	 * surface.  The kernel should handle such segments correctly,
+	 * but TLS is very difficult to protect in a sandbox, so prevent
+	 * such segments from being created.
+	 *
+	 * If userspace needs to remove a TLS entry, it can still delete
+	 * it outright.
+	 */
+	if (info->seg_not_present)
+		return false;
+
+	return true;
+}
+
 static void set_tls_desc(struct task_struct *p, int idx,
 			 const struct user_desc *info, int n)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:95 @ static void set_tls_desc(struct task_str
 	cpu = get_cpu();
 
 	while (n-- > 0) {
-		if (LDT_empty(info))
+		if (LDT_empty(info) || LDT_zero(info))
 			desc->a = desc->b = 0;
 		else
 			fill_ldt(desc, info);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:121 @ int do_set_thread_area(struct task_struc
 	if (copy_from_user(&info, u_info, sizeof(info)))
 		return -EFAULT;
 
+	if (!tls_desc_okay(&info))
+		return -EINVAL;
+
 	if (idx == -1)
 		idx = info.entry_number;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:250 @ int regset_tls_set(struct task_struct *t
 {
 	struct user_desc infobuf[GDT_ENTRY_TLS_ENTRIES];
 	const struct user_desc *info;
+	int i;
 
 	if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
 	    (pos % sizeof(struct user_desc)) != 0 ||
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:264 @ int regset_tls_set(struct task_struct *t
 	else
 		info = infobuf;
 
+	for (i = 0; i < count / sizeof(struct user_desc); i++)
+		if (!tls_desc_okay(info + i))
+			return -EINVAL;
+
 	set_tls_desc(target,
 		     GDT_ENTRY_TLS_MIN + (pos / sizeof(struct user_desc)),
 		     info, count / sizeof(struct user_desc));
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/traps.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/traps.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/traps.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:390 @ NOKPROBE_SYMBOL(do_int3);
  * for scheduling or signal handling. The actual stack switch is done in
  * entry.S
  */
-asmlinkage __visible struct pt_regs *sync_regs(struct pt_regs *eregs)
+asmlinkage __visible notrace struct pt_regs *sync_regs(struct pt_regs *eregs)
 {
 	struct pt_regs *regs = eregs;
 	/* Did already sync */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:416 @ struct bad_iret_stack {
 	struct pt_regs regs;
 };
 
-asmlinkage __visible
+asmlinkage __visible notrace
 struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
 {
 	/*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:439 @ struct bad_iret_stack *fixup_bad_iret(st
 	BUG_ON(!user_mode_vm(&new_stack->regs));
 	return new_stack;
 }
+NOKPROBE_SYMBOL(fixup_bad_iret);
 #endif
 
 /*
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/tsc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/tsc.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/tsc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:620 @ static unsigned long quick_pit_calibrate
 			goto success;
 		}
 	}
-	pr_err("Fast TSC calibration failed\n");
+	pr_info("Fast TSC calibration failed\n");
 	return 0;
 
 success:
Index: linux-3.18.13-rt10-r7s4/arch/x86/kernel/xsave.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kernel/xsave.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kernel/xsave.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:381 @ int __restore_xstate_sig(void __user *bu
 		 * thread's fpu state, reconstruct fxstate from the fsave
 		 * header. Sanitize the copied state etc.
 		 */
-		struct xsave_struct *xsave = &tsk->thread.fpu.state->xsave;
+		struct fpu *fpu = &tsk->thread.fpu;
 		struct user_i387_ia32_struct env;
 		int err = 0;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:395 @ int __restore_xstate_sig(void __user *bu
 		 */
 		drop_fpu(tsk);
 
-		if (__copy_from_user(xsave, buf_fx, state_size) ||
+		if (__copy_from_user(&fpu->state->xsave, buf_fx, state_size) ||
 		    __copy_from_user(&env, buf, sizeof(env))) {
+			fpu_finit(fpu);
 			err = -1;
 		} else {
 			sanitize_restored_xstate(tsk, &env, xstate_bv, fx_only);
-			set_used_math();
 		}
 
+		set_used_math();
 		if (use_eager_fpu()) {
 			preempt_disable();
 			math_state_restore();
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:742 @ void *get_xsave_addr(struct xsave_struct
 
 	return (void *)xsave + xstate_comp_offsets[feature];
 }
+EXPORT_SYMBOL_GPL(get_xsave_addr);
Index: linux-3.18.13-rt10-r7s4/arch/x86/kvm/cpuid.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kvm/cpuid.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kvm/cpuid.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:322 @ static inline int __do_cpuid_ent(struct
 		F(BMI2) | F(ERMS) | f_invpcid | F(RTM) | f_mpx | F(RDSEED) |
 		F(ADX) | F(SMAP);
 
+	/* cpuid 0xD.1.eax */
+	const u32 kvm_supported_word10_x86_features =
+		F(XSAVEOPT) | F(XSAVEC) | F(XGETBV1);
+
 	/* all calls to cpuid_count() should be made on the same cpu */
 	get_cpu();
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:462 @ static inline int __do_cpuid_ent(struct
 		entry->eax &= supported;
 		entry->edx &= supported >> 32;
 		entry->flags |= KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
+		if (!supported)
+			break;
+
 		for (idx = 1, i = 1; idx < 64; ++idx) {
 			u64 mask = ((u64)1 << idx);
 			if (*nent >= maxnent)
 				goto out;
 
 			do_cpuid_1_ent(&entry[i], function, idx);
-			if (entry[i].eax == 0 || !(supported & mask))
+			if (idx == 1)
+				entry[i].eax &= kvm_supported_word10_x86_features;
+			else if (entry[i].eax == 0 || !(supported & mask))
 				continue;
 			entry[i].flags |=
 			       KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
Index: linux-3.18.13-rt10-r7s4/arch/x86/kvm/emulate.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kvm/emulate.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kvm/emulate.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2131 @ static int em_ret_far(struct x86_emulate
 	/* Outer-privilege level return is not implemented */
 	if (ctxt->mode >= X86EMUL_MODE_PROT16 && (cs & 3) > cpl)
 		return X86EMUL_UNHANDLEABLE;
-	rc = __load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, 0, false,
+	rc = __load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, cpl, false,
 				       &new_desc);
 	if (rc != X86EMUL_CONTINUE)
 		return rc;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2348 @ static int em_sysenter(struct x86_emulat
 	 * Not recognized on AMD in compat mode (but is recognized in legacy
 	 * mode).
 	 */
-	if ((ctxt->mode == X86EMUL_MODE_PROT32) && (efer & EFER_LMA)
+	if ((ctxt->mode != X86EMUL_MODE_PROT64) && (efer & EFER_LMA)
 	    && !vendor_intel(ctxt))
 		return emulate_ud(ctxt);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2361 @ static int em_sysenter(struct x86_emulat
 	setup_syscalls_segments(ctxt, &cs, &ss);
 
 	ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
-	switch (ctxt->mode) {
-	case X86EMUL_MODE_PROT32:
-		if ((msr_data & 0xfffc) == 0x0)
-			return emulate_gp(ctxt, 0);
-		break;
-	case X86EMUL_MODE_PROT64:
-		if (msr_data == 0x0)
-			return emulate_gp(ctxt, 0);
-		break;
-	default:
-		break;
-	}
+	if ((msr_data & 0xfffc) == 0x0)
+		return emulate_gp(ctxt, 0);
 
 	ctxt->eflags &= ~(EFLG_VM | EFLG_IF);
-	cs_sel = (u16)msr_data;
-	cs_sel &= ~SELECTOR_RPL_MASK;
+	cs_sel = (u16)msr_data & ~SELECTOR_RPL_MASK;
 	ss_sel = cs_sel + 8;
-	ss_sel &= ~SELECTOR_RPL_MASK;
-	if (ctxt->mode == X86EMUL_MODE_PROT64 || (efer & EFER_LMA)) {
+	if (efer & EFER_LMA) {
 		cs.d = 0;
 		cs.l = 1;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2376 @ static int em_sysenter(struct x86_emulat
 	ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
 
 	ops->get_msr(ctxt, MSR_IA32_SYSENTER_EIP, &msr_data);
-	ctxt->_eip = msr_data;
+	ctxt->_eip = (efer & EFER_LMA) ? msr_data : (u32)msr_data;
 
 	ops->get_msr(ctxt, MSR_IA32_SYSENTER_ESP, &msr_data);
-	*reg_write(ctxt, VCPU_REGS_RSP) = msr_data;
+	*reg_write(ctxt, VCPU_REGS_RSP) = (efer & EFER_LMA) ? msr_data :
+							      (u32)msr_data;
 
 	return X86EMUL_CONTINUE;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3780 @ static const struct opcode group5[] = {
 };
 
 static const struct opcode group6[] = {
-	DI(Prot,	sldt),
-	DI(Prot,	str),
+	DI(Prot | DstMem,	sldt),
+	DI(Prot | DstMem,	str),
 	II(Prot | Priv | SrcMem16, em_lldt, lldt),
 	II(Prot | Priv | SrcMem16, em_ltr, ltr),
 	N, N, N, N,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4832 @ int x86_emulate_insn(struct x86_emulate_
 		if (rc != X86EMUL_CONTINUE)
 			goto done;
 	}
-	ctxt->dst.orig_val = ctxt->dst.val;
+	/* Copy full 64-bit value for CMPXCHG8B.  */
+	ctxt->dst.orig_val64 = ctxt->dst.val64;
 
 special_insn:
 
Index: linux-3.18.13-rt10-r7s4/arch/x86/kvm/mmu.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kvm/mmu.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kvm/mmu.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4452 @ void kvm_mmu_invalidate_mmio_sptes(struc
 	 * zap all shadow pages.
 	 */
 	if (unlikely(kvm_current_mmio_generation(kvm) == 0)) {
-		printk_ratelimited(KERN_INFO "kvm: zapping shadow pages for mmio generation wraparound\n");
+		printk_ratelimited(KERN_DEBUG "kvm: zapping shadow pages for mmio generation wraparound\n");
 		kvm_mmu_invalidate_zap_all_pages(kvm);
 	}
 }
Index: linux-3.18.13-rt10-r7s4/arch/x86/kvm/vmx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kvm/vmx.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kvm/vmx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2380 @ static __init void nested_vmx_setup_ctls
 	nested_vmx_secondary_ctls_low = 0;
 	nested_vmx_secondary_ctls_high &=
 		SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
-		SECONDARY_EXEC_UNRESTRICTED_GUEST |
 		SECONDARY_EXEC_WBINVD_EXITING;
 
 	if (enable_ept) {
 		/* nested EPT: emulate EPT also to L1 */
-		nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT;
+		nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT |
+			SECONDARY_EXEC_UNRESTRICTED_GUEST;
 		nested_vmx_ept_caps = VMX_EPT_PAGE_WALK_4_BIT |
 			 VMX_EPTP_WB_BIT | VMX_EPT_2MB_PAGE_BIT |
 			 VMX_EPT_INVEPT_BIT;
Index: linux-3.18.13-rt10-r7s4/arch/x86/kvm/x86.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/kvm/x86.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/kvm/x86.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1240 @ void kvm_track_tsc_matching(struct kvm_v
 {
 #ifdef CONFIG_X86_64
 	bool vcpus_matched;
-	bool do_request = false;
 	struct kvm_arch *ka = &vcpu->kvm->arch;
 	struct pvclock_gtod_data *gtod = &pvclock_gtod_data;
 
 	vcpus_matched = (ka->nr_vcpus_matched_tsc + 1 ==
 			 atomic_read(&vcpu->kvm->online_vcpus));
 
-	if (vcpus_matched && gtod->clock.vclock_mode == VCLOCK_TSC)
-		if (!ka->use_master_clock)
-			do_request = 1;
-
-	if (!vcpus_matched && ka->use_master_clock)
-			do_request = 1;
-
-	if (do_request)
+	/*
+	 * Once the masterclock is enabled, always perform request in
+	 * order to update it.
+	 *
+	 * In order to enable masterclock, the host clocksource must be TSC
+	 * and the vcpus need to have matched TSCs.  When that happens,
+	 * perform request to enable masterclock.
+	 */
+	if (ka->use_master_clock ||
+	    (gtod->clock.vclock_mode == VCLOCK_TSC && vcpus_matched))
 		kvm_make_request(KVM_REQ_MASTERCLOCK_UPDATE, vcpu);
 
 	trace_kvm_track_tsc(vcpu->vcpu_id, ka->nr_vcpus_matched_tsc,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2716 @ int kvm_vm_ioctl_check_extension(struct
 	case KVM_CAP_USER_NMI:
 	case KVM_CAP_REINJECT_CONTROL:
 	case KVM_CAP_IRQ_INJECT_STATUS:
-	case KVM_CAP_IRQFD:
 	case KVM_CAP_IOEVENTFD:
 	case KVM_CAP_IOEVENTFD_NO_LENGTH:
 	case KVM_CAP_PIT2:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3131 @ static int kvm_vcpu_ioctl_x86_set_debugr
 	return 0;
 }
 
+#define XSTATE_COMPACTION_ENABLED (1ULL << 63)
+
+static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu)
+{
+	struct xsave_struct *xsave = &vcpu->arch.guest_fpu.state->xsave;
+	u64 xstate_bv = xsave->xsave_hdr.xstate_bv;
+	u64 valid;
+
+	/*
+	 * Copy legacy XSAVE area, to avoid complications with CPUID
+	 * leaves 0 and 1 in the loop below.
+	 */
+	memcpy(dest, xsave, XSAVE_HDR_OFFSET);
+
+	/* Set XSTATE_BV */
+	*(u64 *)(dest + XSAVE_HDR_OFFSET) = xstate_bv;
+
+	/*
+	 * Copy each region from the possibly compacted offset to the
+	 * non-compacted offset.
+	 */
+	valid = xstate_bv & ~XSTATE_FPSSE;
+	while (valid) {
+		u64 feature = valid & -valid;
+		int index = fls64(feature) - 1;
+		void *src = get_xsave_addr(xsave, feature);
+
+		if (src) {
+			u32 size, offset, ecx, edx;
+			cpuid_count(XSTATE_CPUID, index,
+				    &size, &offset, &ecx, &edx);
+			memcpy(dest + offset, src, size);
+		}
+
+		valid -= feature;
+	}
+}
+
+static void load_xsave(struct kvm_vcpu *vcpu, u8 *src)
+{
+	struct xsave_struct *xsave = &vcpu->arch.guest_fpu.state->xsave;
+	u64 xstate_bv = *(u64 *)(src + XSAVE_HDR_OFFSET);
+	u64 valid;
+
+	/*
+	 * Copy legacy XSAVE area, to avoid complications with CPUID
+	 * leaves 0 and 1 in the loop below.
+	 */
+	memcpy(xsave, src, XSAVE_HDR_OFFSET);
+
+	/* Set XSTATE_BV and possibly XCOMP_BV.  */
+	xsave->xsave_hdr.xstate_bv = xstate_bv;
+	if (cpu_has_xsaves)
+		xsave->xsave_hdr.xcomp_bv = host_xcr0 | XSTATE_COMPACTION_ENABLED;
+
+	/*
+	 * Copy each region from the non-compacted offset to the
+	 * possibly compacted offset.
+	 */
+	valid = xstate_bv & ~XSTATE_FPSSE;
+	while (valid) {
+		u64 feature = valid & -valid;
+		int index = fls64(feature) - 1;
+		void *dest = get_xsave_addr(xsave, feature);
+
+		if (dest) {
+			u32 size, offset, ecx, edx;
+			cpuid_count(XSTATE_CPUID, index,
+				    &size, &offset, &ecx, &edx);
+			memcpy(dest, src + offset, size);
+		} else
+			WARN_ON_ONCE(1);
+
+		valid -= feature;
+	}
+}
+
 static void kvm_vcpu_ioctl_x86_get_xsave(struct kvm_vcpu *vcpu,
 					 struct kvm_xsave *guest_xsave)
 {
 	if (cpu_has_xsave) {
-		memcpy(guest_xsave->region,
-			&vcpu->arch.guest_fpu.state->xsave,
-			vcpu->arch.guest_xstate_size);
-		*(u64 *)&guest_xsave->region[XSAVE_HDR_OFFSET / sizeof(u32)] &=
-			vcpu->arch.guest_supported_xcr0 | XSTATE_FPSSE;
+		memset(guest_xsave, 0, sizeof(struct kvm_xsave));
+		fill_xsave((u8 *) guest_xsave->region, vcpu);
 	} else {
 		memcpy(guest_xsave->region,
 			&vcpu->arch.guest_fpu.state->fxsave,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3237 @ static int kvm_vcpu_ioctl_x86_set_xsave(
 		 */
 		if (xstate_bv & ~kvm_supported_xcr0())
 			return -EINVAL;
-		memcpy(&vcpu->arch.guest_fpu.state->xsave,
-			guest_xsave->region, vcpu->arch.guest_xstate_size);
+		load_xsave(vcpu, (u8 *)guest_xsave->region);
 	} else {
 		if (xstate_bv & ~XSTATE_FPSSE)
 			return -EINVAL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6949 @ int fx_init(struct kvm_vcpu *vcpu)
 		return err;
 
 	fpu_finit(&vcpu->arch.guest_fpu);
+	if (cpu_has_xsaves)
+		vcpu->arch.guest_fpu.state->xsave.xsave_hdr.xcomp_bv =
+			host_xcr0 | XSTATE_COMPACTION_ENABLED;
 
 	/*
 	 * Ensure guest xcr0 is valid for loading
Index: linux-3.18.13-rt10-r7s4/arch/x86/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:847 @ do_sigbus(struct pt_regs *regs, unsigned
 	  unsigned int fault)
 {
 	struct task_struct *tsk = current;
-	struct mm_struct *mm = tsk->mm;
 	int code = BUS_ADRERR;
 
-	up_read(&mm->mmap_sem);
-
 	/* Kernel mode? Handle exceptions or die: */
 	if (!(error_code & PF_USER)) {
 		no_context(regs, error_code, address, SIGBUS, BUS_ADRERR);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:879 @ mm_fault_error(struct pt_regs *regs, uns
 	       unsigned long address, unsigned int fault)
 {
 	if (fatal_signal_pending(current) && !(error_code & PF_USER)) {
-		up_read(&current->mm->mmap_sem);
 		no_context(regs, error_code, address, 0, 0);
 		return;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:886 @ mm_fault_error(struct pt_regs *regs, uns
 	if (fault & VM_FAULT_OOM) {
 		/* Kernel mode? Handle exceptions or die: */
 		if (!(error_code & PF_USER)) {
-			up_read(&current->mm->mmap_sem);
 			no_context(regs, error_code, address,
 				   SIGSEGV, SEGV_MAPERR);
 			return;
 		}
 
-		up_read(&current->mm->mmap_sem);
-
 		/*
 		 * We ran out of memory, call the OOM killer, and return the
 		 * userspace (which will retry the fault, or kill us if we got
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:901 @ mm_fault_error(struct pt_regs *regs, uns
 		if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON|
 			     VM_FAULT_HWPOISON_LARGE))
 			do_sigbus(regs, error_code, address, fault);
+		else if (fault & VM_FAULT_SIGSEGV)
+			bad_area_nosemaphore(regs, error_code, address);
 		else
 			BUG();
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1245 @ good_area:
 		return;
 
 	if (unlikely(fault & VM_FAULT_ERROR)) {
+		up_read(&mm->mmap_sem);
 		mm_fault_error(regs, error_code, address, fault);
 		return;
 	}
Index: linux-3.18.13-rt10-r7s4/arch/x86/mm/gup.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/mm/gup.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/mm/gup.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:175 @ static int gup_pmd_range(pud_t pud, unsi
 		 */
 		if (pmd_none(pmd) || pmd_trans_splitting(pmd))
 			return 0;
-		if (unlikely(pmd_large(pmd))) {
+		if (unlikely(pmd_large(pmd) || !pmd_present(pmd))) {
 			/*
 			 * NUMA hinting faults need to be handled in the GUP
 			 * slowpath for accounting purposes and so that they
Index: linux-3.18.13-rt10-r7s4/arch/x86/mm/hugetlbpage.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/mm/hugetlbpage.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/mm/hugetlbpage.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:69 @ follow_huge_addr(struct mm_struct *mm, u
 	return ERR_PTR(-EINVAL);
 }
 
+/*
+ * pmd_huge() returns 1 if @pmd is hugetlb related entry, that is normal
+ * hugetlb entry or non-present (migration or hwpoisoned) hugetlb entry.
+ * Otherwise, returns 0.
+ */
 int pmd_huge(pmd_t pmd)
 {
-	return !!(pmd_val(pmd) & _PAGE_PSE);
+	return !pmd_none(pmd) &&
+		(pmd_val(pmd) & (_PAGE_PRESENT|_PAGE_PSE)) != _PAGE_PRESENT;
 }
 
 int pud_huge(pud_t pud)
Index: linux-3.18.13-rt10-r7s4/arch/x86/mm/mmap.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/mm/mmap.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/mm/mmap.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:38 @ struct va_alignment __read_mostly va_ali
 	.flags = -1,
 };
 
-static unsigned int stack_maxrandom_size(void)
+static unsigned long stack_maxrandom_size(void)
 {
-	unsigned int max = 0;
+	unsigned long max = 0;
 	if ((current->flags & PF_RANDOMIZE) &&
 		!(current->personality & ADDR_NO_RANDOMIZE)) {
-		max = ((-1U) & STACK_RND_MASK) << PAGE_SHIFT;
+		max = ((-1UL) & STACK_RND_MASK) << PAGE_SHIFT;
 	}
 
 	return max;
Index: linux-3.18.13-rt10-r7s4/arch/x86/pci/common.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/pci/common.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/pci/common.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:451 @ static const struct dmi_system_id pcipro
 			DMI_MATCH(DMI_PRODUCT_NAME, "ftServer"),
 		},
 	},
+        {
+                .callback = set_scan_all,
+                .ident = "Stratus/NEC ftServer",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R32"),
+                },
+        },
+        {
+                .callback = set_scan_all,
+                .ident = "Stratus/NEC ftServer",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R31"),
+                },
+        },
 	{}
 };
 
Index: linux-3.18.13-rt10-r7s4/arch/x86/pci/i386.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/pci/i386.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/pci/i386.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:219 @ static void pcibios_allocate_bridge_reso
 			continue;
 		if (r->parent)	/* Already allocated */
 			continue;
-		if (!r->start || pci_claim_resource(dev, idx) < 0) {
+		if (!r->start || pci_claim_bridge_resource(dev, idx) < 0) {
 			/*
 			 * Something is wrong with the region.
 			 * Invalidate the resource to prevent
Index: linux-3.18.13-rt10-r7s4/arch/x86/pci/xen.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/pci/xen.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/pci/xen.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:455 @ int __init pci_xen_hvm_init(void)
 }
 
 #ifdef CONFIG_XEN_DOM0
-static __init void xen_setup_acpi_sci(void)
-{
-	int rc;
-	int trigger, polarity;
-	int gsi = acpi_sci_override_gsi;
-	int irq = -1;
-	int gsi_override = -1;
-
-	if (!gsi)
-		return;
-
-	rc = acpi_get_override_irq(gsi, &trigger, &polarity);
-	if (rc) {
-		printk(KERN_WARNING "xen: acpi_get_override_irq failed for acpi"
-				" sci, rc=%d\n", rc);
-		return;
-	}
-	trigger = trigger ? ACPI_LEVEL_SENSITIVE : ACPI_EDGE_SENSITIVE;
-	polarity = polarity ? ACPI_ACTIVE_LOW : ACPI_ACTIVE_HIGH;
-
-	printk(KERN_INFO "xen: sci override: global_irq=%d trigger=%d "
-			"polarity=%d\n", gsi, trigger, polarity);
-
-	/* Before we bind the GSI to a Linux IRQ, check whether
-	 * we need to override it with bus_irq (IRQ) value. Usually for
-	 * IRQs below IRQ_LEGACY_IRQ this holds IRQ == GSI, as so:
-	 *  ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 low level)
-	 * but there are oddballs where the IRQ != GSI:
-	 *  ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 20 low level)
-	 * which ends up being: gsi_to_irq[9] == 20
-	 * (which is what acpi_gsi_to_irq ends up calling when starting the
-	 * the ACPI interpreter and keels over since IRQ 9 has not been
-	 * setup as we had setup IRQ 20 for it).
-	 */
-	if (acpi_gsi_to_irq(gsi, &irq) == 0) {
-		/* Use the provided value if it's valid. */
-		if (irq >= 0)
-			gsi_override = irq;
-	}
-
-	gsi = xen_register_gsi(gsi, gsi_override, trigger, polarity);
-	printk(KERN_INFO "xen: acpi sci %d\n", gsi);
-
-	return;
-}
-
 int __init pci_xen_initial_domain(void)
 {
 	int irq;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:466 @ int __init pci_xen_initial_domain(void)
 	x86_msi.msi_mask_irq = xen_nop_msi_mask_irq;
 	x86_msi.msix_mask_irq = xen_nop_msix_mask_irq;
 #endif
-	xen_setup_acpi_sci();
 	__acpi_register_gsi = acpi_register_gsi_xen;
 	/* Pre-allocate legacy irqs */
 	for (irq = 0; irq < nr_legacy_irqs(); irq++) {
Index: linux-3.18.13-rt10-r7s4/arch/x86/platform/efi/efi_stub_64.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/platform/efi/efi_stub_64.S
+++ linux-3.18.13-rt10-r7s4/arch/x86/platform/efi/efi_stub_64.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:94 @ ENTRY(efi_call)
 	ret
 ENDPROC(efi_call)
 
-#ifdef CONFIG_EFI_MIXED
-
-/*
- * We run this function from the 1:1 mapping.
- *
- * This function must be invoked with a 1:1 mapped stack.
- */
-ENTRY(__efi64_thunk)
-	movl	%ds, %eax
-	push	%rax
-	movl	%es, %eax
-	push	%rax
-	movl	%ss, %eax
-	push	%rax
-
-	subq	$32, %rsp
-	movl	%esi, 0x0(%rsp)
-	movl	%edx, 0x4(%rsp)
-	movl	%ecx, 0x8(%rsp)
-	movq	%r8, %rsi
-	movl	%esi, 0xc(%rsp)
-	movq	%r9, %rsi
-	movl	%esi,  0x10(%rsp)
-
-	sgdt	save_gdt(%rip)
-
-	leaq	1f(%rip), %rbx
-	movq	%rbx, func_rt_ptr(%rip)
-
-	/* Switch to gdt with 32-bit segments */
-	movl	64(%rsp), %eax
-	lgdt	(%rax)
-
-	leaq	efi_enter32(%rip), %rax
-	pushq	$__KERNEL_CS
-	pushq	%rax
-	lretq
-
-1:	addq	$32, %rsp
-
-	lgdt	save_gdt(%rip)
-
-	pop	%rbx
-	movl	%ebx, %ss
-	pop	%rbx
-	movl	%ebx, %es
-	pop	%rbx
-	movl	%ebx, %ds
-
-	/*
-	 * Convert 32-bit status code into 64-bit.
-	 */
-	test	%rax, %rax
-	jz	1f
-	movl	%eax, %ecx
-	andl	$0x0fffffff, %ecx
-	andl	$0xf0000000, %eax
-	shl	$32, %rax
-	or	%rcx, %rax
-1:
-	ret
-ENDPROC(__efi64_thunk)
-
-ENTRY(efi_exit32)
-	movq	func_rt_ptr(%rip), %rax
-	push	%rax
-	mov	%rdi, %rax
-	ret
-ENDPROC(efi_exit32)
-
-	.code32
-/*
- * EFI service pointer must be in %edi.
- *
- * The stack should represent the 32-bit calling convention.
- */
-ENTRY(efi_enter32)
-	movl	$__KERNEL_DS, %eax
-	movl	%eax, %ds
-	movl	%eax, %es
-	movl	%eax, %ss
-
-	/* Reload pgtables */
-	movl	%cr3, %eax
-	movl	%eax, %cr3
-
-	/* Disable paging */
-	movl	%cr0, %eax
-	btrl	$X86_CR0_PG_BIT, %eax
-	movl	%eax, %cr0
-
-	/* Disable long mode via EFER */
-	movl	$MSR_EFER, %ecx
-	rdmsr
-	btrl	$_EFER_LME, %eax
-	wrmsr
-
-	call	*%edi
-
-	/* We must preserve return value */
-	movl	%eax, %edi
-
-	/*
-	 * Some firmware will return with interrupts enabled. Be sure to
-	 * disable them before we switch GDTs.
-	 */
-	cli
-
-	movl	68(%esp), %eax
-	movl	%eax, 2(%eax)
-	lgdtl	(%eax)
-
-	movl	%cr4, %eax
-	btsl	$(X86_CR4_PAE_BIT), %eax
-	movl	%eax, %cr4
-
-	movl	%cr3, %eax
-	movl	%eax, %cr3
-
-	movl	$MSR_EFER, %ecx
-	rdmsr
-	btsl	$_EFER_LME, %eax
-	wrmsr
-
-	xorl	%eax, %eax
-	lldt	%ax
-
-	movl	72(%esp), %eax
-	pushl	$__KERNEL_CS
-	pushl	%eax
-
-	/* Enable paging */
-	movl	%cr0, %eax
-	btsl	$X86_CR0_PG_BIT, %eax
-	movl	%eax, %cr0
-	lret
-ENDPROC(efi_enter32)
-
-	.data
-	.balign	8
-	.global	efi32_boot_gdt
-efi32_boot_gdt:	.word	0
-		.quad	0
-
-save_gdt:	.word	0
-		.quad	0
-func_rt_ptr:	.quad	0
-
-	.global efi_gdt64
-efi_gdt64:
-	.word	efi_gdt64_end - efi_gdt64
-	.long	0			/* Filled out by user */
-	.word	0
-	.quad	0x0000000000000000	/* NULL descriptor */
-	.quad	0x00af9a000000ffff	/* __KERNEL_CS */
-	.quad	0x00cf92000000ffff	/* __KERNEL_DS */
-	.quad	0x0080890000000000	/* TS descriptor */
-	.quad   0x0000000000000000	/* TS continued */
-efi_gdt64_end:
-#endif /* CONFIG_EFI_MIXED */
-
 	.data
 ENTRY(efi_scratch)
 	.fill 3,8,0
Index: linux-3.18.13-rt10-r7s4/arch/x86/platform/efi/efi_thunk_64.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/platform/efi/efi_thunk_64.S
+++ linux-3.18.13-rt10-r7s4/arch/x86/platform/efi/efi_thunk_64.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4 @
 /*
  * Copyright (C) 2014 Intel Corporation; author Matt Fleming
+ *
+ * Support for invoking 32-bit EFI runtime services from a 64-bit
+ * kernel.
+ *
+ * The below thunking functions are only used after ExitBootServices()
+ * has been called. This simplifies things considerably as compared with
+ * the early EFI thunking because we can leave all the kernel state
+ * intact (GDT, IDT, etc) and simply invoke the the 32-bit EFI runtime
+ * services from __KERNEL32_CS. This means we can continue to service
+ * interrupts across an EFI mixed mode call.
+ *
+ * We do however, need to handle the fact that we're running in a full
+ * 64-bit virtual address space. Things like the stack and instruction
+ * addresses need to be accessible by the 32-bit firmware, so we rely on
+ * using the identity mappings in the EFI page table to access the stack
+ * and kernel text (see efi_setup_page_tables()).
  */
 
 #include <linux/linkage.h>
 #include <asm/page_types.h>
+#include <asm/segment.h>
 
 	.text
 	.code64
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:53 @ ENTRY(efi64_thunk)
 	leaq	efi_exit32(%rip), %rbx
 	subq	%rax, %rbx
 	movl	%ebx, 8(%rsp)
-	leaq	efi_gdt64(%rip), %rbx
-	subq	%rax, %rbx
-	movl	%ebx, 2(%ebx)
-	movl	%ebx, 4(%rsp)
-	leaq	efi_gdt32(%rip), %rbx
-	subq	%rax, %rbx
-	movl	%ebx, 2(%ebx)
-	movl	%ebx, (%rsp)
 
 	leaq	__efi64_thunk(%rip), %rbx
 	subq	%rax, %rbx
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:64 @ ENTRY(efi64_thunk)
 	retq
 ENDPROC(efi64_thunk)
 
-	.data
-efi_gdt32:
-	.word 	efi_gdt32_end - efi_gdt32
-	.long	0			/* Filled out above */
-	.word	0
-	.quad	0x0000000000000000	/* NULL descriptor */
-	.quad	0x00cf9a000000ffff	/* __KERNEL_CS */
-	.quad	0x00cf93000000ffff	/* __KERNEL_DS */
-efi_gdt32_end:
+/*
+ * We run this function from the 1:1 mapping.
+ *
+ * This function must be invoked with a 1:1 mapped stack.
+ */
+ENTRY(__efi64_thunk)
+	movl	%ds, %eax
+	push	%rax
+	movl	%es, %eax
+	push	%rax
+	movl	%ss, %eax
+	push	%rax
+
+	subq	$32, %rsp
+	movl	%esi, 0x0(%rsp)
+	movl	%edx, 0x4(%rsp)
+	movl	%ecx, 0x8(%rsp)
+	movq	%r8, %rsi
+	movl	%esi, 0xc(%rsp)
+	movq	%r9, %rsi
+	movl	%esi,  0x10(%rsp)
+
+	leaq	1f(%rip), %rbx
+	movq	%rbx, func_rt_ptr(%rip)
+
+	/* Switch to 32-bit descriptor */
+	pushq	$__KERNEL32_CS
+	leaq	efi_enter32(%rip), %rax
+	pushq	%rax
+	lretq
+
+1:	addq	$32, %rsp
+
+	pop	%rbx
+	movl	%ebx, %ss
+	pop	%rbx
+	movl	%ebx, %es
+	pop	%rbx
+	movl	%ebx, %ds
 
+	/*
+	 * Convert 32-bit status code into 64-bit.
+	 */
+	test	%rax, %rax
+	jz	1f
+	movl	%eax, %ecx
+	andl	$0x0fffffff, %ecx
+	andl	$0xf0000000, %eax
+	shl	$32, %rax
+	or	%rcx, %rax
+1:
+	ret
+ENDPROC(__efi64_thunk)
+
+ENTRY(efi_exit32)
+	movq	func_rt_ptr(%rip), %rax
+	push	%rax
+	mov	%rdi, %rax
+	ret
+ENDPROC(efi_exit32)
+
+	.code32
+/*
+ * EFI service pointer must be in %edi.
+ *
+ * The stack should represent the 32-bit calling convention.
+ */
+ENTRY(efi_enter32)
+	movl	$__KERNEL_DS, %eax
+	movl	%eax, %ds
+	movl	%eax, %es
+	movl	%eax, %ss
+
+	call	*%edi
+
+	/* We must preserve return value */
+	movl	%eax, %edi
+
+	movl	72(%esp), %eax
+	pushl	$__KERNEL_CS
+	pushl	%eax
+
+	lret
+ENDPROC(efi_enter32)
+
+	.data
+	.balign	8
+func_rt_ptr:		.quad 0
 efi_saved_sp:		.quad 0
Index: linux-3.18.13-rt10-r7s4/arch/x86/tools/calc_run_size.pl
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/tools/calc_run_size.pl
+++ /dev/null
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1 @
-#!/usr/bin/perl
-#
-# Calculate the amount of space needed to run the kernel, including room for
-# the .bss and .brk sections.
-#
-# Usage:
-# objdump -h a.out | perl calc_run_size.pl
-use strict;
-
-my $mem_size = 0;
-my $file_offset = 0;
-
-my $sections=" *[0-9]+ \.(?:bss|brk) +";
-while (<>) {
-	if (/^$sections([0-9a-f]+) +(?:[0-9a-f]+ +){2}([0-9a-f]+)/) {
-		my $size = hex($1);
-		my $offset = hex($2);
-		$mem_size += $size;
-		if ($file_offset == 0) {
-			$file_offset = $offset;
-		} elsif ($file_offset != $offset) {
-			# BFD linker shows the same file offset in ELF.
-			# Gold linker shows them as consecutive.
-			next if ($file_offset + $mem_size == $offset + $size);
-
-			printf STDERR "file_offset: 0x%lx\n", $file_offset;
-			printf STDERR "mem_size: 0x%lx\n", $mem_size;
-			printf STDERR "offset: 0x%lx\n", $offset;
-			printf STDERR "size: 0x%lx\n", $size;
-
-			die ".bss and .brk are non-contiguous\n";
-		}
-	}
-}
-
-if ($file_offset == 0) {
-	die "Never found .bss or .brk file offset\n";
-}
-printf("%d\n", $mem_size + $file_offset);
Index: linux-3.18.13-rt10-r7s4/arch/x86/tools/calc_run_size.sh
===================================================================
--- /dev/null
+++ linux-3.18.13-rt10-r7s4/arch/x86/tools/calc_run_size.sh
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4 @
+#!/bin/sh
+#
+# Calculate the amount of space needed to run the kernel, including room for
+# the .bss and .brk sections.
+#
+# Usage:
+# objdump -h a.out | sh calc_run_size.sh
+
+NUM='\([0-9a-fA-F]*[ \t]*\)'
+OUT=$(sed -n 's/^[ \t0-9]*.b[sr][sk][ \t]*'"$NUM$NUM$NUM$NUM"'.*/\1\4/p')
+if [ -z "$OUT" ] ; then
+	echo "Never found .bss or .brk file offset" >&2
+	exit 1
+fi
+
+OUT=$(echo ${OUT# })
+sizeA=$(printf "%d" 0x${OUT%% *})
+OUT=${OUT#* }
+offsetA=$(printf "%d" 0x${OUT%% *})
+OUT=${OUT#* }
+sizeB=$(printf "%d" 0x${OUT%% *})
+OUT=${OUT#* }
+offsetB=$(printf "%d" 0x${OUT%% *})
+
+run_size=$(( $offsetA + $sizeA + $sizeB ))
+
+# BFD linker shows the same file offset in ELF.
+if [ "$offsetA" -ne "$offsetB" ] ; then
+	# Gold linker shows them as consecutive.
+	endB=$(( $offsetB + $sizeB ))
+	if [ "$endB" != "$run_size" ] ; then
+		printf "sizeA: 0x%x\n" $sizeA >&2
+		printf "offsetA: 0x%x\n" $offsetA >&2
+		printf "sizeB: 0x%x\n" $sizeB >&2
+		printf "offsetB: 0x%x\n" $offsetB >&2
+		echo ".bss and .brk are non-contiguous" >&2
+		exit 1
+	fi
+fi
+
+printf "%d\n" $run_size
+exit 0
Index: linux-3.18.13-rt10-r7s4/arch/x86/um/sys_call_table_32.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/um/sys_call_table_32.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/um/sys_call_table_32.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:37 @ typedef asmlinkage void (*sys_call_ptr_t
 
 extern asmlinkage void sys_ni_syscall(void);
 
-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
+const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
 	/*
 	 * Smells like a compiler bug -- it doesn't work
 	 * when the & below is removed.
Index: linux-3.18.13-rt10-r7s4/arch/x86/um/sys_call_table_64.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/um/sys_call_table_64.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/um/sys_call_table_64.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:49 @ typedef void (*sys_call_ptr_t)(void);
 
 extern void sys_ni_syscall(void);
 
-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
+const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
 	/*
 	 * Smells like a compiler bug -- it doesn't work
 	 * when the & below is removed.
Index: linux-3.18.13-rt10-r7s4/arch/x86/vdso/vdso32/sigreturn.S
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/vdso/vdso32/sigreturn.S
+++ linux-3.18.13-rt10-r7s4/arch/x86/vdso/vdso32/sigreturn.S
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:20 @
 	.text
 	.globl __kernel_sigreturn
 	.type __kernel_sigreturn,@function
+	nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */
 	ALIGN
 __kernel_sigreturn:
 .LSTART_sigreturn:
Index: linux-3.18.13-rt10-r7s4/arch/x86/vdso/vma.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/x86/vdso/vma.c
+++ linux-3.18.13-rt10-r7s4/arch/x86/vdso/vma.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:57 @ subsys_initcall(init_vdso);
 
 struct linux_binprm;
 
-/* Put the vdso above the (randomized) stack with another randomized offset.
-   This way there is no hole in the middle of address space.
-   To save memory make sure it is still in the same PTE as the stack top.
-   This doesn't give that many random bits.
-
-   Only used for the 64-bit and x32 vdsos. */
+/*
+ * Put the vdso above the (randomized) stack with another randomized
+ * offset.  This way there is no hole in the middle of address space.
+ * To save memory make sure it is still in the same PTE as the stack
+ * top.  This doesn't give that many random bits.
+ *
+ * Note that this algorithm is imperfect: the distribution of the vdso
+ * start address within a PMD is biased toward the end.
+ *
+ * Only used for the 64-bit and x32 vdsos.
+ */
 static unsigned long vdso_addr(unsigned long start, unsigned len)
 {
 #ifdef CONFIG_X86_32
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:75 @ static unsigned long vdso_addr(unsigned
 #else
 	unsigned long addr, end;
 	unsigned offset;
-	end = (start + PMD_SIZE - 1) & PMD_MASK;
+
+	/*
+	 * Round up the start address.  It can start out unaligned as a result
+	 * of stack start randomization.
+	 */
+	start = PAGE_ALIGN(start);
+
+	/* Round the lowest possible end address up to a PMD boundary. */
+	end = (start + len + PMD_SIZE - 1) & PMD_MASK;
 	if (end >= TASK_SIZE_MAX)
 		end = TASK_SIZE_MAX;
 	end -= len;
-	/* This loses some more bits than a modulo, but is cheaper */
-	offset = get_random_int() & (PTRS_PER_PTE - 1);
-	addr = start + (offset << PAGE_SHIFT);
-	if (addr >= end)
-		addr = end;
+
+	if (end > start) {
+		offset = get_random_int() % (((end - start) >> PAGE_SHIFT) + 1);
+		addr = start + (offset << PAGE_SHIFT);
+	} else {
+		addr = start;
+	}
 
 	/*
-	 * page-align it here so that get_unmapped_area doesn't
-	 * align it wrongfully again to the next page. addr can come in 4K
-	 * unaligned here as a result of stack start randomization.
+	 * Forcibly align the final address in case we have a hardware
+	 * issue that requires alignment for performance reasons.
 	 */
-	addr = PAGE_ALIGN(addr);
 	addr = align_vdso_addr(addr);
 
 	return addr;
Index: linux-3.18.13-rt10-r7s4/arch/xtensa/include/asm/highmem.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/xtensa/include/asm/highmem.h
+++ linux-3.18.13-rt10-r7s4/arch/xtensa/include/asm/highmem.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:28 @
 #define PKMAP_NR(virt)		(((virt) - PKMAP_BASE) >> PAGE_SHIFT)
 #define PKMAP_ADDR(nr)		(PKMAP_BASE + ((nr) << PAGE_SHIFT))
 
-#define kmap_prot		PAGE_KERNEL
+#define kmap_prot		PAGE_KERNEL_EXEC
 
 #if DCACHE_WAY_SIZE > PAGE_SIZE
 #define get_pkmap_color get_pkmap_color
Index: linux-3.18.13-rt10-r7s4/arch/xtensa/mm/fault.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/arch/xtensa/mm/fault.c
+++ linux-3.18.13-rt10-r7s4/arch/xtensa/mm/fault.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:120 @ good_area:
 	if (unlikely(fault & VM_FAULT_ERROR)) {
 		if (fault & VM_FAULT_OOM)
 			goto out_of_memory;
+		else if (fault & VM_FAULT_SIGSEGV)
+			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
 		BUG();
Index: linux-3.18.13-rt10-r7s4/block/blk-core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/block/blk-core.c
+++ linux-3.18.13-rt10-r7s4/block/blk-core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:528 @ void blk_cleanup_queue(struct request_qu
 	del_timer_sync(&q->backing_dev_info.laptop_mode_wb_timer);
 	blk_sync_queue(q);
 
+	if (q->mq_ops)
+		blk_mq_free_queue(q);
+
 	spin_lock_irq(lock);
 	if (q->queue_lock != &q->__queue_lock)
 		q->queue_lock = &q->__queue_lock;
Index: linux-3.18.13-rt10-r7s4/block/blk-merge.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/block/blk-merge.c
+++ linux-3.18.13-rt10-r7s4/block/blk-merge.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:612 @ bool blk_rq_merge_ok(struct request *rq,
 	if (q->queue_flags & (1 << QUEUE_FLAG_SG_GAPS)) {
 		struct bio_vec *bprev;
 
-		bprev = &rq->biotail->bi_io_vec[bio->bi_vcnt - 1];
+		bprev = &rq->biotail->bi_io_vec[rq->biotail->bi_vcnt - 1];
 		if (bvec_gap_to_prev(bprev, bio->bi_io_vec[0].bv_offset))
 			return false;
 	}
Index: linux-3.18.13-rt10-r7s4/block/blk-mq-cpumap.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/block/blk-mq-cpumap.c
+++ linux-3.18.13-rt10-r7s4/block/blk-mq-cpumap.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:93 @ unsigned int *blk_mq_make_queue_map(stru
 	unsigned int *map;
 
 	/* If cpus are offline, map them to first hctx */
-	map = kzalloc_node(sizeof(*map) * num_possible_cpus(), GFP_KERNEL,
+	map = kzalloc_node(sizeof(*map) * nr_cpu_ids, GFP_KERNEL,
 				set->numa_node);
 	if (!map)
 		return NULL;
Index: linux-3.18.13-rt10-r7s4/block/blk-mq-sysfs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/block/blk-mq-sysfs.c
+++ linux-3.18.13-rt10-r7s4/block/blk-mq-sysfs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:393 @ static void blk_mq_sysfs_init(struct req
 {
 	struct blk_mq_hw_ctx *hctx;
 	struct blk_mq_ctx *ctx;
-	int i, j;
+	int i;
 
 	kobject_init(&q->mq_kobj, &blk_mq_ktype);
 
-	queue_for_each_hw_ctx(q, hctx, i) {
+	queue_for_each_hw_ctx(q, hctx, i)
 		kobject_init(&hctx->kobj, &blk_mq_hw_ktype);
 
-		hctx_for_each_ctx(hctx, ctx, j)
-			kobject_init(&ctx->kobj, &blk_mq_ctx_ktype);
-	}
+	queue_for_each_ctx(q, ctx, i)
+		kobject_init(&ctx->kobj, &blk_mq_ctx_ktype);
 }
 
 /* see blk_register_queue() */
Index: linux-3.18.13-rt10-r7s4/block/blk-mq-tag.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/block/blk-mq-tag.c
+++ linux-3.18.13-rt10-r7s4/block/blk-mq-tag.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:140 @ static inline bool hctx_may_queue(struct
 static int __bt_get_word(struct blk_align_bitmap *bm, unsigned int last_tag)
 {
 	int tag, org_last_tag, end;
+	bool wrap = last_tag != 0;
 
 	org_last_tag = last_tag;
 	end = bm->depth;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:152 @ restart:
 			 * We started with an offset, start from 0 to
 			 * exhaust the map.
 			 */
-			if (org_last_tag && last_tag) {
-				end = last_tag;
+			if (wrap) {
+				wrap = false;
+				end = org_last_tag;
 				last_tag = 0;
 				goto restart;
 			}
 			return -1;
 		}
 		last_tag = tag + 1;
-	} while (test_and_set_bit_lock(tag, &bm->word));
+	} while (test_and_set_bit(tag, &bm->word));
 
 	return tag;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:345 @ static void bt_clear_tag(struct blk_mq_b
 	struct bt_wait_state *bs;
 	int wait_cnt;
 
-	/*
-	 * The unlock memory barrier need to order access to req in free
-	 * path and clearing tag bit
-	 */
-	clear_bit_unlock(TAG_TO_BIT(bt, tag), &bt->map[index].word);
+	clear_bit(TAG_TO_BIT(bt, tag), &bt->map[index].word);
+
+	/* Ensure that the wait list checks occur after clear_bit(). */
+	smp_mb();
 
 	bs = bt_wake_ptr(bt);
 	if (!bs)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:503 @ static int bt_alloc(struct blk_mq_bitmap
 	bt->bs = kzalloc(BT_WAIT_QUEUES * sizeof(*bt->bs), GFP_KERNEL);
 	if (!bt->bs) {
 		kfree(bt->map);
+		bt->map = NULL;
 		return -ENOMEM;
 	}
 
Index: linux-3.18.13-rt10-r7s4/block/blk-mq.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/block/blk-mq.c
+++ linux-3.18.13-rt10-r7s4/block/blk-mq.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1834 @ struct request_queue *blk_mq_init_queue(
 	 */
 	if (percpu_ref_init(&q->mq_usage_counter, blk_mq_usage_counter_release,
 			    PERCPU_REF_INIT_ATOMIC, GFP_KERNEL))
-		goto err_map;
+		goto err_mq_usage;
 
 	setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q);
 	blk_queue_rq_timeout(q, 30000);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1877 @ struct request_queue *blk_mq_init_queue(
 	blk_mq_init_cpu_queues(q, set->nr_hw_queues);
 
 	if (blk_mq_init_hw_queues(q, set))
-		goto err_hw;
+		goto err_mq_usage;
 
 	mutex_lock(&all_q_mutex);
 	list_add_tail(&q->all_q_node, &all_q_list);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1889 @ struct request_queue *blk_mq_init_queue(
 
 	return q;
 
-err_hw:
+err_mq_usage:
 	blk_cleanup_queue(q);
 err_hctxs:
 	kfree(map);
Index: linux-3.18.13-rt10-r7s4/block/blk-sysfs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/block/blk-sysfs.c
+++ linux-3.18.13-rt10-r7s4/block/blk-sysfs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:495 @ static void blk_free_queue_rcu(struct rc
  *     Currently, its primary task it to free all the &struct request
  *     structures that were allocated to the queue and the queue itself.
  *
- * Caveat:
- *     Hopefully the low level driver will have finished any
- *     outstanding requests first...
+ * Note:
+ *     The low level driver must have finished any outstanding requests first
+ *     via blk_cleanup_queue().
  **/
 static void blk_release_queue(struct kobject *kobj)
 {
 	struct request_queue *q =
 		container_of(kobj, struct request_queue, kobj);
 
-	blk_sync_queue(q);
-
 	blkcg_exit_queue(q);
 
 	if (q->elevator) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:518 @ static void blk_release_queue(struct kob
 	if (q->queue_tags)
 		__blk_queue_free_tags(q);
 
-	if (q->mq_ops)
-		blk_mq_free_queue(q);
-	else
+	if (!q->mq_ops)
 		blk_free_flush_queue(q->fq);
 
 	blk_trace_shutdown(q);
Index: linux-3.18.13-rt10-r7s4/block/blk-throttle.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/block/blk-throttle.c
+++ linux-3.18.13-rt10-r7s4/block/blk-throttle.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1295 @ static u64 tg_prfill_cpu_rwstat(struct s
 	struct blkg_rwstat rwstat = { }, tmp;
 	int i, cpu;
 
+	if (tg->stats_cpu == NULL)
+		return 0;
+
 	for_each_possible_cpu(cpu) {
 		struct tg_stats_cpu *sc = per_cpu_ptr(tg->stats_cpu, cpu);
 
Index: linux-3.18.13-rt10-r7s4/block/cfq-iosched.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/block/cfq-iosched.c
+++ linux-3.18.13-rt10-r7s4/block/cfq-iosched.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3593 @ retry:
 
 	blkcg = bio_blkcg(bio);
 	cfqg = cfq_lookup_create_cfqg(cfqd, blkcg);
+	if (!cfqg) {
+		cfqq = &cfqd->oom_cfqq;
+		goto out;
+	}
+
 	cfqq = cic_to_cfqq(cic, is_sync);
 
 	/*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3634 @ retry:
 		} else
 			cfqq = &cfqd->oom_cfqq;
 	}
-
+out:
 	if (new_cfqq)
 		kmem_cache_free(cfq_pool, new_cfqq);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3664 @ static struct cfq_queue *
 cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic,
 	      struct bio *bio, gfp_t gfp_mask)
 {
-	const int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio);
-	const int ioprio = IOPRIO_PRIO_DATA(cic->ioprio);
+	int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio);
+	int ioprio = IOPRIO_PRIO_DATA(cic->ioprio);
 	struct cfq_queue **async_cfqq = NULL;
 	struct cfq_queue *cfqq = NULL;
 
 	if (!is_sync) {
+		if (!ioprio_valid(cic->ioprio)) {
+			struct task_struct *tsk = current;
+			ioprio = task_nice_ioprio(tsk);
+			ioprio_class = task_nice_ioclass(tsk);
+		}
 		async_cfqq = cfq_async_queue_prio(cfqd, ioprio_class, ioprio);
 		cfqq = *async_cfqq;
 	}
Index: linux-3.18.13-rt10-r7s4/block/genhd.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/block/genhd.c
+++ linux-3.18.13-rt10-r7s4/block/genhd.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1073 @ int disk_expand_part_tbl(struct gendisk
 	struct disk_part_tbl *old_ptbl = disk->part_tbl;
 	struct disk_part_tbl *new_ptbl;
 	int len = old_ptbl ? old_ptbl->len : 0;
-	int target = partno + 1;
+	int i, target;
 	size_t size;
-	int i;
+
+	/*
+	 * check for int overflow, since we can get here from blkpg_ioctl()
+	 * with a user passed 'partno'.
+	 */
+	target = partno + 1;
+	if (target < 0)
+		return -EINVAL;
 
 	/* disk_max_parts() is zero during initialization, ignore if so */
 	if (disk_max_parts(disk) && target > disk_max_parts(disk))
Index: linux-3.18.13-rt10-r7s4/crypto/842.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/842.c
+++ linux-3.18.13-rt10-r7s4/crypto/842.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:183 @ module_exit(nx842_mod_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("842 Compression Algorithm");
+MODULE_ALIAS_CRYPTO("842");
Index: linux-3.18.13-rt10-r7s4/crypto/aes_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/aes_generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/aes_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1477 @ module_exit(aes_fini);
 
 MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm");
 MODULE_LICENSE("Dual BSD/GPL");
-MODULE_ALIAS("aes");
+MODULE_ALIAS_CRYPTO("aes");
+MODULE_ALIAS_CRYPTO("aes-generic");
Index: linux-3.18.13-rt10-r7s4/crypto/af_alg.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/af_alg.c
+++ linux-3.18.13-rt10-r7s4/crypto/af_alg.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:452 @ void af_alg_complete(struct crypto_async
 {
 	struct af_alg_completion *completion = req->data;
 
+	if (err == -EINPROGRESS)
+		return;
+
 	completion->err = err;
 	complete(&completion->completion);
 }
Index: linux-3.18.13-rt10-r7s4/crypto/algapi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/algapi.c
+++ linux-3.18.13-rt10-r7s4/crypto/algapi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:512 @ static struct crypto_template *__crypto_
 
 struct crypto_template *crypto_lookup_template(const char *name)
 {
-	return try_then_request_module(__crypto_lookup_template(name), "%s",
-				       name);
+	return try_then_request_module(__crypto_lookup_template(name),
+				       "crypto-%s", name);
 }
 EXPORT_SYMBOL_GPL(crypto_lookup_template);
 
Index: linux-3.18.13-rt10-r7s4/crypto/ansi_cprng.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/ansi_cprng.c
+++ linux-3.18.13-rt10-r7s4/crypto/ansi_cprng.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:479 @ module_param(dbg, int, 0);
 MODULE_PARM_DESC(dbg, "Boolean to enable debugging (0/1 == off/on)");
 module_init(prng_mod_init);
 module_exit(prng_mod_fini);
-MODULE_ALIAS("stdrng");
+MODULE_ALIAS_CRYPTO("stdrng");
+MODULE_ALIAS_CRYPTO("ansi_cprng");
Index: linux-3.18.13-rt10-r7s4/crypto/anubis.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/anubis.c
+++ linux-3.18.13-rt10-r7s4/crypto/anubis.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:707 @ module_exit(anubis_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Anubis Cryptographic Algorithm");
+MODULE_ALIAS_CRYPTO("anubis");
Index: linux-3.18.13-rt10-r7s4/crypto/api.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/api.c
+++ linux-3.18.13-rt10-r7s4/crypto/api.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:219 @ struct crypto_alg *crypto_larval_lookup(
 
 	alg = crypto_alg_lookup(name, type, mask);
 	if (!alg) {
-		request_module("%s", name);
+		request_module("crypto-%s", name);
 
 		if (!((type ^ CRYPTO_ALG_NEED_FALLBACK) & mask &
 		      CRYPTO_ALG_NEED_FALLBACK))
-			request_module("%s-all", name);
+			request_module("crypto-%s-all", name);
 
 		alg = crypto_alg_lookup(name, type, mask);
 	}
Index: linux-3.18.13-rt10-r7s4/crypto/arc4.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/arc4.c
+++ linux-3.18.13-rt10-r7s4/crypto/arc4.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:169 @ module_exit(arc4_exit);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("ARC4 Cipher Algorithm");
 MODULE_AUTHOR("Jon Oberheide <jon@oberheide.org>");
+MODULE_ALIAS_CRYPTO("arc4");
Index: linux-3.18.13-rt10-r7s4/crypto/authenc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/authenc.c
+++ linux-3.18.13-rt10-r7s4/crypto/authenc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:724 @ module_exit(crypto_authenc_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Simple AEAD wrapper for IPsec");
+MODULE_ALIAS_CRYPTO("authenc");
Index: linux-3.18.13-rt10-r7s4/crypto/authencesn.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/authencesn.c
+++ linux-3.18.13-rt10-r7s4/crypto/authencesn.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:817 @ module_exit(crypto_authenc_esn_module_ex
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>");
 MODULE_DESCRIPTION("AEAD wrapper for IPsec with extended sequence numbers");
+MODULE_ALIAS_CRYPTO("authencesn");
Index: linux-3.18.13-rt10-r7s4/crypto/blowfish_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/blowfish_generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/blowfish_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:141 @ module_exit(blowfish_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Blowfish Cipher Algorithm");
-MODULE_ALIAS("blowfish");
+MODULE_ALIAS_CRYPTO("blowfish");
+MODULE_ALIAS_CRYPTO("blowfish-generic");
Index: linux-3.18.13-rt10-r7s4/crypto/camellia_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/camellia_generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/camellia_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1101 @ module_exit(camellia_fini);
 
 MODULE_DESCRIPTION("Camellia Cipher Algorithm");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("camellia");
+MODULE_ALIAS_CRYPTO("camellia");
+MODULE_ALIAS_CRYPTO("camellia-generic");
Index: linux-3.18.13-rt10-r7s4/crypto/cast5_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/cast5_generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/cast5_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:552 @ module_exit(cast5_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Cast5 Cipher Algorithm");
-MODULE_ALIAS("cast5");
+MODULE_ALIAS_CRYPTO("cast5");
+MODULE_ALIAS_CRYPTO("cast5-generic");
Index: linux-3.18.13-rt10-r7s4/crypto/cast6_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/cast6_generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/cast6_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:294 @ module_exit(cast6_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Cast6 Cipher Algorithm");
-MODULE_ALIAS("cast6");
+MODULE_ALIAS_CRYPTO("cast6");
+MODULE_ALIAS_CRYPTO("cast6-generic");
Index: linux-3.18.13-rt10-r7s4/crypto/cbc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/cbc.c
+++ linux-3.18.13-rt10-r7s4/crypto/cbc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:292 @ module_exit(crypto_cbc_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("CBC block cipher algorithm");
+MODULE_ALIAS_CRYPTO("cbc");
Index: linux-3.18.13-rt10-r7s4/crypto/ccm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/ccm.c
+++ linux-3.18.13-rt10-r7s4/crypto/ccm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:882 @ module_exit(crypto_ccm_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Counter with CBC MAC");
-MODULE_ALIAS("ccm_base");
-MODULE_ALIAS("rfc4309");
+MODULE_ALIAS_CRYPTO("ccm_base");
+MODULE_ALIAS_CRYPTO("rfc4309");
+MODULE_ALIAS_CRYPTO("ccm");
Index: linux-3.18.13-rt10-r7s4/crypto/chainiv.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/chainiv.c
+++ linux-3.18.13-rt10-r7s4/crypto/chainiv.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:362 @ module_exit(chainiv_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Chain IV Generator");
+MODULE_ALIAS_CRYPTO("chainiv");
Index: linux-3.18.13-rt10-r7s4/crypto/cmac.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/cmac.c
+++ linux-3.18.13-rt10-r7s4/crypto/cmac.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:316 @ module_exit(crypto_cmac_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("CMAC keyed hash algorithm");
+MODULE_ALIAS_CRYPTO("cmac");
Index: linux-3.18.13-rt10-r7s4/crypto/crc32.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/crc32.c
+++ linux-3.18.13-rt10-r7s4/crypto/crc32.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:159 @ module_exit(crc32_mod_fini);
 MODULE_AUTHOR("Alexander Boyko <alexander_boyko@xyratex.com>");
 MODULE_DESCRIPTION("CRC32 calculations wrapper for lib/crc32");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_CRYPTO("crc32");
Index: linux-3.18.13-rt10-r7s4/crypto/crc32c_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/crc32c_generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/crc32c_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:173 @ module_exit(crc32c_mod_fini);
 MODULE_AUTHOR("Clay Haapala <chaapala@cisco.com>");
 MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations wrapper for lib/crc32c");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("crc32c");
+MODULE_ALIAS_CRYPTO("crc32c");
+MODULE_ALIAS_CRYPTO("crc32c-generic");
 MODULE_SOFTDEP("pre: crc32c");
Index: linux-3.18.13-rt10-r7s4/crypto/crct10dif_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/crct10dif_generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/crct10dif_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:127 @ module_exit(crct10dif_mod_fini);
 MODULE_AUTHOR("Tim Chen <tim.c.chen@linux.intel.com>");
 MODULE_DESCRIPTION("T10 DIF CRC calculation.");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("crct10dif");
+MODULE_ALIAS_CRYPTO("crct10dif");
+MODULE_ALIAS_CRYPTO("crct10dif-generic");
Index: linux-3.18.13-rt10-r7s4/crypto/cryptd.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/cryptd.c
+++ linux-3.18.13-rt10-r7s4/crypto/cryptd.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:958 @ module_exit(cryptd_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Software async crypto daemon");
+MODULE_ALIAS_CRYPTO("cryptd");
Index: linux-3.18.13-rt10-r7s4/crypto/crypto_null.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/crypto_null.c
+++ linux-3.18.13-rt10-r7s4/crypto/crypto_null.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:148 @ static struct crypto_alg null_algs[3] =
 	.coa_decompress		=	null_compress } }
 } };
 
-MODULE_ALIAS("compress_null");
-MODULE_ALIAS("digest_null");
-MODULE_ALIAS("cipher_null");
+MODULE_ALIAS_CRYPTO("compress_null");
+MODULE_ALIAS_CRYPTO("digest_null");
+MODULE_ALIAS_CRYPTO("cipher_null");
 
 static int __init crypto_null_mod_init(void)
 {
Index: linux-3.18.13-rt10-r7s4/crypto/ctr.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/ctr.c
+++ linux-3.18.13-rt10-r7s4/crypto/ctr.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:469 @ module_exit(crypto_ctr_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("CTR Counter block mode");
-MODULE_ALIAS("rfc3686");
+MODULE_ALIAS_CRYPTO("rfc3686");
+MODULE_ALIAS_CRYPTO("ctr");
Index: linux-3.18.13-rt10-r7s4/crypto/cts.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/cts.c
+++ linux-3.18.13-rt10-r7s4/crypto/cts.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:354 @ module_exit(crypto_cts_module_exit);
 
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_DESCRIPTION("CTS-CBC CipherText Stealing for CBC");
+MODULE_ALIAS_CRYPTO("cts");
Index: linux-3.18.13-rt10-r7s4/crypto/deflate.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/deflate.c
+++ linux-3.18.13-rt10-r7s4/crypto/deflate.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:225 @ module_exit(deflate_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Deflate Compression Algorithm for IPCOMP");
 MODULE_AUTHOR("James Morris <jmorris@intercode.com.au>");
-
+MODULE_ALIAS_CRYPTO("deflate");
Index: linux-3.18.13-rt10-r7s4/crypto/des_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/des_generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/des_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:986 @ static struct crypto_alg des_algs[2] = {
 	.cia_decrypt		=	des3_ede_decrypt } }
 } };
 
-MODULE_ALIAS("des3_ede");
-
 static int __init des_generic_mod_init(void)
 {
 	return crypto_register_algs(des_algs, ARRAY_SIZE(des_algs));
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1002 @ module_exit(des_generic_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms");
 MODULE_AUTHOR("Dag Arne Osvik <da@osvik.no>");
-MODULE_ALIAS("des");
+MODULE_ALIAS_CRYPTO("des");
+MODULE_ALIAS_CRYPTO("des-generic");
+MODULE_ALIAS_CRYPTO("des3_ede");
+MODULE_ALIAS_CRYPTO("des3_ede-generic");
Index: linux-3.18.13-rt10-r7s4/crypto/ecb.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/ecb.c
+++ linux-3.18.13-rt10-r7s4/crypto/ecb.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:188 @ module_exit(crypto_ecb_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("ECB block cipher algorithm");
+MODULE_ALIAS_CRYPTO("ecb");
Index: linux-3.18.13-rt10-r7s4/crypto/eseqiv.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/eseqiv.c
+++ linux-3.18.13-rt10-r7s4/crypto/eseqiv.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:270 @ module_exit(eseqiv_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Encrypted Sequence Number IV Generator");
+MODULE_ALIAS_CRYPTO("eseqiv");
Index: linux-3.18.13-rt10-r7s4/crypto/fcrypt.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/fcrypt.c
+++ linux-3.18.13-rt10-r7s4/crypto/fcrypt.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:423 @ module_exit(fcrypt_mod_fini);
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_DESCRIPTION("FCrypt Cipher Algorithm");
 MODULE_AUTHOR("David Howells <dhowells@redhat.com>");
+MODULE_ALIAS_CRYPTO("fcrypt");
Index: linux-3.18.13-rt10-r7s4/crypto/gcm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/gcm.c
+++ linux-3.18.13-rt10-r7s4/crypto/gcm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1444 @ module_exit(crypto_gcm_module_exit);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Galois/Counter Mode");
 MODULE_AUTHOR("Mikko Herranen <mh1@iki.fi>");
-MODULE_ALIAS("gcm_base");
-MODULE_ALIAS("rfc4106");
-MODULE_ALIAS("rfc4543");
+MODULE_ALIAS_CRYPTO("gcm_base");
+MODULE_ALIAS_CRYPTO("rfc4106");
+MODULE_ALIAS_CRYPTO("rfc4543");
+MODULE_ALIAS_CRYPTO("gcm");
Index: linux-3.18.13-rt10-r7s4/crypto/ghash-generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/ghash-generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/ghash-generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:175 @ module_exit(ghash_mod_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("GHASH Message Digest Algorithm");
-MODULE_ALIAS("ghash");
+MODULE_ALIAS_CRYPTO("ghash");
+MODULE_ALIAS_CRYPTO("ghash-generic");
Index: linux-3.18.13-rt10-r7s4/crypto/hmac.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/hmac.c
+++ linux-3.18.13-rt10-r7s4/crypto/hmac.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:271 @ module_exit(hmac_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("HMAC hash algorithm");
+MODULE_ALIAS_CRYPTO("hmac");
Index: linux-3.18.13-rt10-r7s4/crypto/khazad.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/khazad.c
+++ linux-3.18.13-rt10-r7s4/crypto/khazad.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:883 @ module_exit(khazad_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Khazad Cryptographic Algorithm");
+MODULE_ALIAS_CRYPTO("khazad");
Index: linux-3.18.13-rt10-r7s4/crypto/krng.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/krng.c
+++ linux-3.18.13-rt10-r7s4/crypto/krng.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:65 @ module_exit(krng_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Kernel Random Number Generator");
-MODULE_ALIAS("stdrng");
+MODULE_ALIAS_CRYPTO("stdrng");
+MODULE_ALIAS_CRYPTO("krng");
Index: linux-3.18.13-rt10-r7s4/crypto/lrw.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/lrw.c
+++ linux-3.18.13-rt10-r7s4/crypto/lrw.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:403 @ module_exit(crypto_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("LRW block cipher mode");
+MODULE_ALIAS_CRYPTO("lrw");
Index: linux-3.18.13-rt10-r7s4/crypto/lz4.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/lz4.c
+++ linux-3.18.13-rt10-r7s4/crypto/lz4.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:107 @ module_exit(lz4_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("LZ4 Compression Algorithm");
+MODULE_ALIAS_CRYPTO("lz4");
Index: linux-3.18.13-rt10-r7s4/crypto/lz4hc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/lz4hc.c
+++ linux-3.18.13-rt10-r7s4/crypto/lz4hc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:107 @ module_exit(lz4hc_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("LZ4HC Compression Algorithm");
+MODULE_ALIAS_CRYPTO("lz4hc");
Index: linux-3.18.13-rt10-r7s4/crypto/lzo.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/lzo.c
+++ linux-3.18.13-rt10-r7s4/crypto/lzo.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:110 @ module_exit(lzo_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("LZO Compression Algorithm");
+MODULE_ALIAS_CRYPTO("lzo");
Index: linux-3.18.13-rt10-r7s4/crypto/mcryptd.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/mcryptd.c
+++ linux-3.18.13-rt10-r7s4/crypto/mcryptd.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:706 @ module_exit(mcryptd_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Software async multibuffer crypto daemon");
+MODULE_ALIAS_CRYPTO("mcryptd");
Index: linux-3.18.13-rt10-r7s4/crypto/md4.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/md4.c
+++ linux-3.18.13-rt10-r7s4/crypto/md4.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:258 @ module_exit(md4_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("MD4 Message Digest Algorithm");
-
+MODULE_ALIAS_CRYPTO("md4");
Index: linux-3.18.13-rt10-r7s4/crypto/md5.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/md5.c
+++ linux-3.18.13-rt10-r7s4/crypto/md5.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:171 @ module_exit(md5_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("MD5 Message Digest Algorithm");
+MODULE_ALIAS_CRYPTO("md5");
Index: linux-3.18.13-rt10-r7s4/crypto/michael_mic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/michael_mic.c
+++ linux-3.18.13-rt10-r7s4/crypto/michael_mic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:187 @ module_exit(michael_mic_exit);
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("Michael MIC");
 MODULE_AUTHOR("Jouni Malinen <j@w1.fi>");
+MODULE_ALIAS_CRYPTO("michael_mic");
Index: linux-3.18.13-rt10-r7s4/crypto/pcbc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/pcbc.c
+++ linux-3.18.13-rt10-r7s4/crypto/pcbc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:298 @ module_exit(crypto_pcbc_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("PCBC block cipher algorithm");
+MODULE_ALIAS_CRYPTO("pcbc");
Index: linux-3.18.13-rt10-r7s4/crypto/pcrypt.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/pcrypt.c
+++ linux-3.18.13-rt10-r7s4/crypto/pcrypt.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:568 @ module_exit(pcrypt_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>");
 MODULE_DESCRIPTION("Parallel crypto wrapper");
+MODULE_ALIAS_CRYPTO("pcrypt");
Index: linux-3.18.13-rt10-r7s4/crypto/rmd128.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/rmd128.c
+++ linux-3.18.13-rt10-r7s4/crypto/rmd128.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:330 @ module_exit(rmd128_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Adrian-Ken Rueegsegger <ken@codelabs.ch>");
 MODULE_DESCRIPTION("RIPEMD-128 Message Digest");
+MODULE_ALIAS_CRYPTO("rmd128");
Index: linux-3.18.13-rt10-r7s4/crypto/rmd160.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/rmd160.c
+++ linux-3.18.13-rt10-r7s4/crypto/rmd160.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:374 @ module_exit(rmd160_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Adrian-Ken Rueegsegger <ken@codelabs.ch>");
 MODULE_DESCRIPTION("RIPEMD-160 Message Digest");
+MODULE_ALIAS_CRYPTO("rmd160");
Index: linux-3.18.13-rt10-r7s4/crypto/rmd256.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/rmd256.c
+++ linux-3.18.13-rt10-r7s4/crypto/rmd256.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:349 @ module_exit(rmd256_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Adrian-Ken Rueegsegger <ken@codelabs.ch>");
 MODULE_DESCRIPTION("RIPEMD-256 Message Digest");
+MODULE_ALIAS_CRYPTO("rmd256");
Index: linux-3.18.13-rt10-r7s4/crypto/rmd320.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/rmd320.c
+++ linux-3.18.13-rt10-r7s4/crypto/rmd320.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:398 @ module_exit(rmd320_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Adrian-Ken Rueegsegger <ken@codelabs.ch>");
 MODULE_DESCRIPTION("RIPEMD-320 Message Digest");
+MODULE_ALIAS_CRYPTO("rmd320");
Index: linux-3.18.13-rt10-r7s4/crypto/salsa20_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/salsa20_generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/salsa20_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:251 @ module_exit(salsa20_generic_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION ("Salsa20 stream cipher algorithm");
-MODULE_ALIAS("salsa20");
+MODULE_ALIAS_CRYPTO("salsa20");
+MODULE_ALIAS_CRYPTO("salsa20-generic");
Index: linux-3.18.13-rt10-r7s4/crypto/seed.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/seed.c
+++ linux-3.18.13-rt10-r7s4/crypto/seed.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:479 @ module_exit(seed_fini);
 MODULE_DESCRIPTION("SEED Cipher Algorithm");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Hye-Shik Chang <perky@FreeBSD.org>, Kim Hyun <hkim@kisa.or.kr>");
+MODULE_ALIAS_CRYPTO("seed");
Index: linux-3.18.13-rt10-r7s4/crypto/seqiv.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/seqiv.c
+++ linux-3.18.13-rt10-r7s4/crypto/seqiv.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:365 @ module_exit(seqiv_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Sequence Number IV Generator");
+MODULE_ALIAS_CRYPTO("seqiv");
Index: linux-3.18.13-rt10-r7s4/crypto/serpent_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/serpent_generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/serpent_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:668 @ module_exit(serpent_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Serpent and tnepres (kerneli compatible serpent reversed) Cipher Algorithm");
 MODULE_AUTHOR("Dag Arne Osvik <osvik@ii.uib.no>");
-MODULE_ALIAS("tnepres");
-MODULE_ALIAS("serpent");
+MODULE_ALIAS_CRYPTO("tnepres");
+MODULE_ALIAS_CRYPTO("serpent");
+MODULE_ALIAS_CRYPTO("serpent-generic");
Index: linux-3.18.13-rt10-r7s4/crypto/sha1_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/sha1_generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/sha1_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:156 @ module_exit(sha1_generic_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm");
 
-MODULE_ALIAS("sha1");
+MODULE_ALIAS_CRYPTO("sha1");
+MODULE_ALIAS_CRYPTO("sha1-generic");
Index: linux-3.18.13-rt10-r7s4/crypto/sha256_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/sha256_generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/sha256_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:387 @ module_exit(sha256_generic_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA-224 and SHA-256 Secure Hash Algorithm");
 
-MODULE_ALIAS("sha224");
-MODULE_ALIAS("sha256");
+MODULE_ALIAS_CRYPTO("sha224");
+MODULE_ALIAS_CRYPTO("sha224-generic");
+MODULE_ALIAS_CRYPTO("sha256");
+MODULE_ALIAS_CRYPTO("sha256-generic");
Index: linux-3.18.13-rt10-r7s4/crypto/sha512_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/sha512_generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/sha512_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:291 @ module_exit(sha512_generic_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA-512 and SHA-384 Secure Hash Algorithms");
 
-MODULE_ALIAS("sha384");
-MODULE_ALIAS("sha512");
+MODULE_ALIAS_CRYPTO("sha384");
+MODULE_ALIAS_CRYPTO("sha384-generic");
+MODULE_ALIAS_CRYPTO("sha512");
+MODULE_ALIAS_CRYPTO("sha512-generic");
Index: linux-3.18.13-rt10-r7s4/crypto/tea.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/tea.c
+++ linux-3.18.13-rt10-r7s4/crypto/tea.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:273 @ static void __exit tea_mod_fini(void)
 	crypto_unregister_algs(tea_algs, ARRAY_SIZE(tea_algs));
 }
 
-MODULE_ALIAS("xtea");
-MODULE_ALIAS("xeta");
+MODULE_ALIAS_CRYPTO("tea");
+MODULE_ALIAS_CRYPTO("xtea");
+MODULE_ALIAS_CRYPTO("xeta");
 
 module_init(tea_mod_init);
 module_exit(tea_mod_fini);
Index: linux-3.18.13-rt10-r7s4/crypto/tgr192.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/tgr192.c
+++ linux-3.18.13-rt10-r7s4/crypto/tgr192.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:679 @ static void __exit tgr192_mod_fini(void)
 	crypto_unregister_shashes(tgr_algs, ARRAY_SIZE(tgr_algs));
 }
 
-MODULE_ALIAS("tgr160");
-MODULE_ALIAS("tgr128");
+MODULE_ALIAS_CRYPTO("tgr192");
+MODULE_ALIAS_CRYPTO("tgr160");
+MODULE_ALIAS_CRYPTO("tgr128");
 
 module_init(tgr192_mod_init);
 module_exit(tgr192_mod_fini);
Index: linux-3.18.13-rt10-r7s4/crypto/twofish_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/twofish_generic.c
+++ linux-3.18.13-rt10-r7s4/crypto/twofish_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:214 @ module_exit(twofish_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION ("Twofish Cipher Algorithm");
-MODULE_ALIAS("twofish");
+MODULE_ALIAS_CRYPTO("twofish");
+MODULE_ALIAS_CRYPTO("twofish-generic");
Index: linux-3.18.13-rt10-r7s4/crypto/vmac.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/vmac.c
+++ linux-3.18.13-rt10-r7s4/crypto/vmac.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:716 @ module_exit(vmac_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("VMAC hash algorithm");
+MODULE_ALIAS_CRYPTO("vmac");
Index: linux-3.18.13-rt10-r7s4/crypto/wp512.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/wp512.c
+++ linux-3.18.13-rt10-r7s4/crypto/wp512.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1170 @ static void __exit wp512_mod_fini(void)
 	crypto_unregister_shashes(wp_algs, ARRAY_SIZE(wp_algs));
 }
 
-MODULE_ALIAS("wp384");
-MODULE_ALIAS("wp256");
+MODULE_ALIAS_CRYPTO("wp512");
+MODULE_ALIAS_CRYPTO("wp384");
+MODULE_ALIAS_CRYPTO("wp256");
 
 module_init(wp512_mod_init);
 module_exit(wp512_mod_fini);
Index: linux-3.18.13-rt10-r7s4/crypto/xcbc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/xcbc.c
+++ linux-3.18.13-rt10-r7s4/crypto/xcbc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:289 @ module_exit(crypto_xcbc_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("XCBC keyed hash algorithm");
+MODULE_ALIAS_CRYPTO("xcbc");
Index: linux-3.18.13-rt10-r7s4/crypto/xts.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/xts.c
+++ linux-3.18.13-rt10-r7s4/crypto/xts.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:365 @ module_exit(crypto_module_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("XTS block cipher mode");
+MODULE_ALIAS_CRYPTO("xts");
Index: linux-3.18.13-rt10-r7s4/crypto/zlib.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/crypto/zlib.c
+++ linux-3.18.13-rt10-r7s4/crypto/zlib.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:381 @ module_exit(zlib_mod_fini);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Zlib Compression Algorithm");
 MODULE_AUTHOR("Sony Corporation");
+MODULE_ALIAS_CRYPTO("zlib");
Index: linux-3.18.13-rt10-r7s4/drivers/acpi/acpi_lpss.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/acpi/acpi_lpss.c
+++ linux-3.18.13-rt10-r7s4/drivers/acpi/acpi_lpss.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:68 @ struct lpss_private_data;
 
 struct lpss_device_desc {
 	unsigned int flags;
+	const char *clk_con_id;
 	unsigned int prv_offset;
 	size_t prv_size_override;
 	void (*setup)(struct lpss_private_data *pdata);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:109 @ static void lpss_uart_setup(struct lpss_
 	}
 }
 
-static void byt_i2c_setup(struct lpss_private_data *pdata)
+static void lpss_deassert_reset(struct lpss_private_data *pdata)
 {
 	unsigned int offset;
 	u32 val;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:118 @ static void byt_i2c_setup(struct lpss_pr
 	val = readl(pdata->mmio_base + offset);
 	val |= LPSS_RESETS_RESET_APB | LPSS_RESETS_RESET_FUNC;
 	writel(val, pdata->mmio_base + offset);
+}
+
+#define LPSS_I2C_ENABLE			0x6c
+
+static void byt_i2c_setup(struct lpss_private_data *pdata)
+{
+	lpss_deassert_reset(pdata);
 
 	if (readl(pdata->mmio_base + pdata->dev_desc->prv_offset))
 		pdata->fixed_clk_rate = 133000000;
+
+	writel(0, pdata->mmio_base + LPSS_I2C_ENABLE);
 }
 
 static struct lpss_device_desc lpt_dev_desc = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:144 @ static struct lpss_device_desc lpt_i2c_d
 
 static struct lpss_device_desc lpt_uart_dev_desc = {
 	.flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_LTR,
+	.clk_con_id = "baudclk",
 	.prv_offset = 0x800,
 	.setup = lpss_uart_setup,
 };
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:161 @ static struct lpss_device_desc byt_pwm_d
 
 static struct lpss_device_desc byt_uart_dev_desc = {
 	.flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX,
+	.clk_con_id = "baudclk",
 	.prv_offset = 0x800,
 	.setup = lpss_uart_setup,
 };
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:181 @ static struct lpss_device_desc byt_i2c_d
 	.setup = byt_i2c_setup,
 };
 
+static struct lpss_device_desc bsw_spi_dev_desc = {
+	.flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX,
+	.prv_offset = 0x400,
+	.setup = lpss_deassert_reset,
+};
+
 #else
 
 #define LPSS_ADDR(desc) (0UL)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:219 @ static const struct acpi_device_id acpi_
 	/* Braswell LPSS devices */
 	{ "80862288", LPSS_ADDR(byt_pwm_dev_desc) },
 	{ "8086228A", LPSS_ADDR(byt_uart_dev_desc) },
-	{ "8086228E", LPSS_ADDR(byt_spi_dev_desc) },
+	{ "8086228E", LPSS_ADDR(bsw_spi_dev_desc) },
 	{ "808622C1", LPSS_ADDR(byt_i2c_dev_desc) },
 
 	{ "INT3430", LPSS_ADDR(lpt_dev_desc) },
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:319 @ out:
 		return PTR_ERR(clk);
 
 	pdata->clk = clk;
-	clk_register_clkdev(clk, NULL, devname);
+	clk_register_clkdev(clk, dev_desc->clk_con_id, devname);
 	return 0;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/acpi/device_pm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/acpi/device_pm.c
+++ linux-3.18.13-rt10-r7s4/drivers/acpi/device_pm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:260 @ int acpi_bus_init_power(struct acpi_devi
 
 	device->power.state = ACPI_STATE_UNKNOWN;
 	if (!acpi_device_is_present(device))
-		return 0;
+		return -ENXIO;
 
 	result = acpi_device_get_power(device, &state);
 	if (result)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:683 @ static int acpi_device_wakeup(struct acp
 		if (error)
 			return error;
 
+		if (adev->wakeup.flags.enabled)
+			return 0;
+
 		res = acpi_enable_gpe(wakeup->gpe_device, wakeup->gpe_number);
-		if (ACPI_FAILURE(res)) {
+		if (ACPI_SUCCESS(res)) {
+			adev->wakeup.flags.enabled = 1;
+		} else {
 			acpi_disable_wakeup_device_power(adev);
 			return -EIO;
 		}
 	} else {
-		acpi_disable_gpe(wakeup->gpe_device, wakeup->gpe_number);
+		if (adev->wakeup.flags.enabled) {
+			acpi_disable_gpe(wakeup->gpe_device, wakeup->gpe_number);
+			adev->wakeup.flags.enabled = 0;
+		}
 		acpi_disable_wakeup_device_power(adev);
 	}
 	return 0;
Index: linux-3.18.13-rt10-r7s4/drivers/acpi/processor_idle.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/acpi/processor_idle.c
+++ linux-3.18.13-rt10-r7s4/drivers/acpi/processor_idle.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:965 @ static int acpi_processor_setup_cpuidle_
 		return -EINVAL;
 
 	drv->safe_state_index = -1;
-	for (i = 0; i < CPUIDLE_STATE_MAX; i++) {
+	for (i = CPUIDLE_DRIVER_STATE_START; i < CPUIDLE_STATE_MAX; i++) {
 		drv->states[i].name[0] = '\0';
 		drv->states[i].desc[0] = '\0';
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/acpi/scan.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/acpi/scan.c
+++ linux-3.18.13-rt10-r7s4/drivers/acpi/scan.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:912 @ static void acpi_free_power_resources_li
 	if (device->wakeup.flags.valid)
 		acpi_power_resources_list_free(&device->wakeup.resources);
 
-	if (!device->flags.power_manageable)
+	if (!device->power.flags.power_resources)
 		return;
 
 	for (i = ACPI_STATE_D0; i <= ACPI_STATE_D3_HOT; i++) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1634 @ static void acpi_bus_get_power_flags(str
 			device->power.flags.power_resources)
 		device->power.states[ACPI_STATE_D3_COLD].flags.os_accessible = 1;
 
-	if (acpi_bus_init_power(device)) {
-		acpi_free_power_resources_lists(device);
+	if (acpi_bus_init_power(device))
 		device->flags.power_manageable = 0;
-	}
 }
 
 static void acpi_bus_get_flags(struct acpi_device *device)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2203 @ static void acpi_bus_attach(struct acpi_
 	/* Skip devices that are not present. */
 	if (!acpi_device_is_present(device)) {
 		device->flags.visited = false;
+		device->flags.power_manageable = 0;
 		return;
 	}
 	if (device->handler)
 		goto ok;
 
 	if (!device->flags.initialized) {
-		acpi_bus_update_power(device, NULL);
+		device->flags.power_manageable =
+			device->power.states[ACPI_STATE_D0].flags.valid;
+		if (acpi_bus_init_power(device))
+			device->flags.power_manageable = 0;
+
 		device->flags.initialized = true;
 	}
 	device->flags.visited = false;
Index: linux-3.18.13-rt10-r7s4/drivers/acpi/video.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/acpi/video.c
+++ linux-3.18.13-rt10-r7s4/drivers/acpi/video.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:158 @ struct acpi_video_bus {
 	u8 dos_setting;
 	struct acpi_video_enumerated_device *attached_array;
 	u8 attached_count;
+	u8 child_count;
 	struct acpi_video_bus_cap cap;
 	struct acpi_video_bus_flags flags;
 	struct list_head video_device_list;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:508 @ static struct dmi_system_id video_dmi_ta
 		DMI_MATCH(DMI_PRODUCT_NAME, "HP ENVY 15 Notebook PC"),
 		},
 	},
+
+	{
+	 .callback = video_disable_native_backlight,
+	 .ident = "SAMSUNG 870Z5E/880Z5E/680Z5E",
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+		DMI_MATCH(DMI_PRODUCT_NAME, "870Z5E/880Z5E/680Z5E"),
+		},
+	},
+	{
+	 .callback = video_disable_native_backlight,
+	 .ident = "SAMSUNG 370R4E/370R4V/370R5E/3570RE/370R5V",
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+		DMI_MATCH(DMI_PRODUCT_NAME, "370R4E/370R4V/370R5E/3570RE/370R5V"),
+		},
+	},
 	{}
 };
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1180 @ static bool acpi_video_device_in_dod(str
 	struct acpi_video_bus *video = device->video;
 	int i;
 
-	/* If we have a broken _DOD, no need to test */
-	if (!video->attached_count)
+	/*
+	 * If we have a broken _DOD or we have more than 8 output devices
+	 * under the graphics controller node that we can't proper deal with
+	 * in the operation region code currently, no need to test.
+	 */
+	if (!video->attached_count || video->child_count > 8)
 		return true;
 
 	for (i = 0; i < video->attached_count; i++) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1438 @ acpi_video_bus_get_devices(struct acpi_v
 			dev_err(&dev->dev, "Can't attach device\n");
 			break;
 		}
+		video->child_count++;
 	}
 	return status;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2127 @ EXPORT_SYMBOL(acpi_video_unregister_back
 
 static int __init acpi_video_init(void)
 {
+	/*
+	 * Let the module load even if ACPI is disabled (e.g. due to
+	 * a broken BIOS) so that i915.ko can still be loaded on such
+	 * old systems without an AcpiOpRegion.
+	 *
+	 * acpi_video_register() will report -ENODEV later as well due
+	 * to acpi_disabled when i915.ko tries to register itself afterwards.
+	 */
+	if (acpi_disabled)
+		return 0;
+
 	dmi_check_system(video_dmi_table);
 
 	if (intel_opregion_present())
Index: linux-3.18.13-rt10-r7s4/drivers/ata/ahci_xgene.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/ata/ahci_xgene.c
+++ linux-3.18.13-rt10-r7s4/drivers/ata/ahci_xgene.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:191 @ static unsigned int xgene_ahci_read_id(s
 	 *
 	 * Clear reserved bit 8 (DEVSLP bit) as we don't support DEVSLP
 	 */
-	id[ATA_ID_FEATURE_SUPP] &= ~(1 << 8);
+	id[ATA_ID_FEATURE_SUPP] &= cpu_to_le16(~(1 << 8));
 
 	return 0;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/ata/libata-core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/ata/libata-core.c
+++ linux-3.18.13-rt10-r7s4/drivers/ata/libata-core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4743 @ static struct ata_queued_cmd *ata_qc_new
 		return NULL;
 
 	for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) {
-		tag = tag < max_queue ? tag : 0;
+		if (ap->flags & ATA_FLAG_LOWTAG)
+			tag = i;
+		else
+			tag = tag < max_queue ? tag : 0;
 
 		/* the last tag is reserved for internal command. */
 		if (tag == ATA_TAG_INTERNAL)
Index: linux-3.18.13-rt10-r7s4/drivers/ata/libata-sff.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/ata/libata-sff.c
+++ linux-3.18.13-rt10-r7s4/drivers/ata/libata-sff.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1336 @ void ata_sff_flush_pio_task(struct ata_p
 	DPRINTK("ENTER\n");
 
 	cancel_delayed_work_sync(&ap->sff_pio_task);
+
+	/*
+	 * We wanna reset the HSM state to IDLE.  If we do so without
+	 * grabbing the port lock, critical sections protected by it which
+	 * expect the HSM state to stay stable may get surprised.  For
+	 * example, we may set IDLE in between the time
+	 * __ata_sff_port_intr() checks for HSM_ST_IDLE and before it calls
+	 * ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG().
+	 */
+	spin_lock_irq(ap->lock);
 	ap->hsm_task_state = HSM_ST_IDLE;
+	spin_unlock_irq(ap->lock);
+
 	ap->sff_pio_task_link = NULL;
 
 	if (ata_msg_ctl(ap))
Index: linux-3.18.13-rt10-r7s4/drivers/ata/sata_dwc_460ex.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/ata/sata_dwc_460ex.c
+++ linux-3.18.13-rt10-r7s4/drivers/ata/sata_dwc_460ex.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:800 @ static int dma_dwc_init(struct sata_dwc_
 	if (err) {
 		dev_err(host_pvt.dwc_dev, "%s: dma_request_interrupts returns"
 			" %d\n", __func__, err);
-		goto error_out;
+		return err;
 	}
 
 	/* Enabe DMA */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:811 @ static int dma_dwc_init(struct sata_dwc_
 		sata_dma_regs);
 
 	return 0;
-
-error_out:
-	dma_dwc_exit(hsdev);
-
-	return err;
 }
 
 static int sata_dwc_scr_read(struct ata_link *link, unsigned int scr, u32 *val)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1660 @ static int sata_dwc_probe(struct platfor
 	char *ver = (char *)&versionr;
 	u8 *base = NULL;
 	int err = 0;
-	int irq, rc;
+	int irq;
 	struct ata_host *host;
 	struct ata_port_info pi = sata_dwc_port_info[0];
 	const struct ata_port_info *ppi[] = { &pi, NULL };
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1723 @ static int sata_dwc_probe(struct platfor
 	if (irq == NO_IRQ) {
 		dev_err(&ofdev->dev, "no SATA DMA irq\n");
 		err = -ENODEV;
-		goto error_out;
+		goto error_iomap;
 	}
 
 	/* Get physical SATA DMA register base address */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1732 @ static int sata_dwc_probe(struct platfor
 		dev_err(&ofdev->dev, "ioremap failed for AHBDMA register"
 			" address\n");
 		err = -ENODEV;
-		goto error_out;
+		goto error_iomap;
 	}
 
 	/* Save dev for later use in dev_xxx() routines */
 	host_pvt.dwc_dev = &ofdev->dev;
 
 	/* Initialize AHB DMAC */
-	dma_dwc_init(hsdev, irq);
+	err = dma_dwc_init(hsdev, irq);
+	if (err)
+		goto error_dma_iomap;
 
 	/* Enable SATA Interrupts */
 	sata_dwc_enable_interrupts(hsdev);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1759 @ static int sata_dwc_probe(struct platfor
 	 * device discovery process, invoking our port_start() handler &
 	 * error_handler() to execute a dummy Softreset EH session
 	 */
-	rc = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht);
-
-	if (rc != 0)
+	err = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht);
+	if (err)
 		dev_err(&ofdev->dev, "failed to activate host");
 
 	dev_set_drvdata(&ofdev->dev, host);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1769 @ static int sata_dwc_probe(struct platfor
 error_out:
 	/* Free SATA DMA resources */
 	dma_dwc_exit(hsdev);
-
+error_dma_iomap:
+	iounmap((void __iomem *)host_pvt.sata_dma_regs);
 error_iomap:
 	iounmap(base);
 error_kmalloc:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1791 @ static int sata_dwc_remove(struct platfo
 	/* Free SATA DMA resources */
 	dma_dwc_exit(hsdev);
 
+	iounmap((void __iomem *)host_pvt.sata_dma_regs);
 	iounmap(hsdev->reg_base);
 	kfree(hsdev);
 	kfree(host);
Index: linux-3.18.13-rt10-r7s4/drivers/ata/sata_sil24.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/ata/sata_sil24.c
+++ linux-3.18.13-rt10-r7s4/drivers/ata/sata_sil24.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:249 @ enum {
 	/* host flags */
 	SIL24_COMMON_FLAGS	= ATA_FLAG_SATA | ATA_FLAG_PIO_DMA |
 				  ATA_FLAG_NCQ | ATA_FLAG_ACPI_SATA |
-				  ATA_FLAG_AN | ATA_FLAG_PMP,
+				  ATA_FLAG_AN | ATA_FLAG_PMP | ATA_FLAG_LOWTAG,
 	SIL24_FLAG_PCIX_IRQ_WOC	= (1 << 24), /* IRQ loss errata on PCI-X */
 
 	IRQ_STAT_4PORTS		= 0xf,
Index: linux-3.18.13-rt10-r7s4/drivers/base/bus.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/base/bus.c
+++ linux-3.18.13-rt10-r7s4/drivers/base/bus.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:257 @ static ssize_t store_drivers_probe(struc
 				   const char *buf, size_t count)
 {
 	struct device *dev;
+	int err = -EINVAL;
 
 	dev = bus_find_device_by_name(bus, NULL, buf);
 	if (!dev)
 		return -ENODEV;
-	if (bus_rescan_devices_helper(dev, NULL) != 0)
-		return -EINVAL;
-	return count;
+	if (bus_rescan_devices_helper(dev, NULL) == 0)
+		err = count;
+	put_device(dev);
+	return err;
 }
 
 static struct device *next_device(struct klist_iter *i)
Index: linux-3.18.13-rt10-r7s4/drivers/base/regmap/internal.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/base/regmap/internal.h
+++ linux-3.18.13-rt10-r7s4/drivers/base/regmap/internal.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:240 @ extern struct regcache_ops regcache_rbtr
 extern struct regcache_ops regcache_lzo_ops;
 extern struct regcache_ops regcache_flat_ops;
 
+static inline const char *regmap_name(const struct regmap *map)
+{
+	if (map->dev)
+		return dev_name(map->dev);
+
+	return map->name;
+}
+
 #endif
Index: linux-3.18.13-rt10-r7s4/drivers/base/regmap/regcache-rbtree.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/base/regmap/regcache-rbtree.c
+++ linux-3.18.13-rt10-r7s4/drivers/base/regmap/regcache-rbtree.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:310 @ static int regcache_rbtree_insert_to_blo
 	if (pos == 0) {
 		memmove(blk + offset * map->cache_word_size,
 			blk, rbnode->blklen * map->cache_word_size);
-		bitmap_shift_right(present, present, offset, blklen);
+		bitmap_shift_left(present, present, offset, blklen);
 	}
 
 	/* update the rbnode block, its size and the base register */
Index: linux-3.18.13-rt10-r7s4/drivers/base/regmap/regcache.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/base/regmap/regcache.c
+++ linux-3.18.13-rt10-r7s4/drivers/base/regmap/regcache.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:216 @ int regcache_read(struct regmap *map,
 		ret = map->cache_ops->read(map, reg, value);
 
 		if (ret == 0)
-			trace_regmap_reg_read_cache(map->dev, reg, *value);
+			trace_regmap_reg_read_cache(map, reg, *value);
 
 		return ret;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:309 @ int regcache_sync(struct regmap *map)
 	dev_dbg(map->dev, "Syncing %s cache\n",
 		map->cache_ops->name);
 	name = map->cache_ops->name;
-	trace_regcache_sync(map->dev, name, "start");
+	trace_regcache_sync(map, name, "start");
 
 	if (!map->cache_dirty)
 		goto out;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:344 @ out:
 
 	regmap_async_complete(map);
 
-	trace_regcache_sync(map->dev, name, "stop");
+	trace_regcache_sync(map, name, "stop");
 
 	return ret;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:379 @ int regcache_sync_region(struct regmap *
 	name = map->cache_ops->name;
 	dev_dbg(map->dev, "Syncing %s cache from %d-%d\n", name, min, max);
 
-	trace_regcache_sync(map->dev, name, "start region");
+	trace_regcache_sync(map, name, "start region");
 
 	if (!map->cache_dirty)
 		goto out;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:399 @ out:
 
 	regmap_async_complete(map);
 
-	trace_regcache_sync(map->dev, name, "stop region");
+	trace_regcache_sync(map, name, "stop region");
 
 	return ret;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:426 @ int regcache_drop_region(struct regmap *
 
 	map->lock(map->lock_arg);
 
-	trace_regcache_drop_region(map->dev, min, max);
+	trace_regcache_drop_region(map, min, max);
 
 	ret = map->cache_ops->drop(map, min, max);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:453 @ void regcache_cache_only(struct regmap *
 	map->lock(map->lock_arg);
 	WARN_ON(map->cache_bypass && enable);
 	map->cache_only = enable;
-	trace_regmap_cache_only(map->dev, enable);
+	trace_regmap_cache_only(map, enable);
 	map->unlock(map->lock_arg);
 }
 EXPORT_SYMBOL_GPL(regcache_cache_only);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:491 @ void regcache_cache_bypass(struct regmap
 	map->lock(map->lock_arg);
 	WARN_ON(map->cache_only && enable);
 	map->cache_bypass = enable;
-	trace_regmap_cache_bypass(map->dev, enable);
+	trace_regmap_cache_bypass(map, enable);
 	map->unlock(map->lock_arg);
 }
 EXPORT_SYMBOL_GPL(regcache_cache_bypass);
Index: linux-3.18.13-rt10-r7s4/drivers/base/regmap/regmap.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/base/regmap/regmap.c
+++ linux-3.18.13-rt10-r7s4/drivers/base/regmap/regmap.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1283 @ int _regmap_raw_write(struct regmap *map
 	if (map->async && map->bus->async_write) {
 		struct regmap_async *async;
 
-		trace_regmap_async_write_start(map->dev, reg, val_len);
+		trace_regmap_async_write_start(map, reg, val_len);
 
 		spin_lock_irqsave(&map->async_lock, flags);
 		async = list_first_entry_or_null(&map->async_free,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1341 @ int _regmap_raw_write(struct regmap *map
 		return ret;
 	}
 
-	trace_regmap_hw_write_start(map->dev, reg,
-				    val_len / map->format.val_bytes);
+	trace_regmap_hw_write_start(map, reg, val_len / map->format.val_bytes);
 
 	/* If we're doing a single register write we can probably just
 	 * send the work_buf directly, otherwise try to do a gather
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1373 @ int _regmap_raw_write(struct regmap *map
 		kfree(buf);
 	}
 
-	trace_regmap_hw_write_done(map->dev, reg,
-				   val_len / map->format.val_bytes);
+	trace_regmap_hw_write_done(map, reg, val_len / map->format.val_bytes);
 
 	return ret;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1407 @ static int _regmap_bus_formatted_write(v
 
 	map->format.format_write(map, reg, val);
 
-	trace_regmap_hw_write_start(map->dev, reg, 1);
+	trace_regmap_hw_write_start(map, reg, 1);
 
 	ret = map->bus->write(map->bus_context, map->work_buf,
 			      map->format.buf_size);
 
-	trace_regmap_hw_write_done(map->dev, reg, 1);
+	trace_regmap_hw_write_done(map, reg, 1);
 
 	return ret;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1470 @ int _regmap_write(struct regmap *map, un
 		dev_info(map->dev, "%x <= %x\n", reg, val);
 #endif
 
-	trace_regmap_reg_write(map->dev, reg, val);
+	trace_regmap_reg_write(map, reg, val);
 
 	return map->reg_write(context, reg, val);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1773 @ static int _regmap_raw_multi_reg_write(s
 	for (i = 0; i < num_regs; i++) {
 		int reg = regs[i].reg;
 		int val = regs[i].def;
-		trace_regmap_hw_write_start(map->dev, reg, 1);
+		trace_regmap_hw_write_start(map, reg, 1);
 		map->format.format_reg(u8, reg, map->reg_shift);
 		u8 += reg_bytes + pad_bytes;
 		map->format.format_val(u8, val, 0);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1788 @ static int _regmap_raw_multi_reg_write(s
 
 	for (i = 0; i < num_regs; i++) {
 		int reg = regs[i].reg;
-		trace_regmap_hw_write_done(map->dev, reg, 1);
+		trace_regmap_hw_write_done(map, reg, 1);
 	}
 	return ret;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2059 @ static int _regmap_raw_read(struct regma
 	 */
 	u8[0] |= map->read_flag_mask;
 
-	trace_regmap_hw_read_start(map->dev, reg,
-				   val_len / map->format.val_bytes);
+	trace_regmap_hw_read_start(map, reg, val_len / map->format.val_bytes);
 
 	ret = map->bus->read(map->bus_context, map->work_buf,
 			     map->format.reg_bytes + map->format.pad_bytes,
 			     val, val_len);
 
-	trace_regmap_hw_read_done(map->dev, reg,
-				  val_len / map->format.val_bytes);
+	trace_regmap_hw_read_done(map, reg, val_len / map->format.val_bytes);
 
 	return ret;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2121 @ static int _regmap_read(struct regmap *m
 			dev_info(map->dev, "%x => %x\n", reg, *val);
 #endif
 
-		trace_regmap_reg_read(map->dev, reg, *val);
+		trace_regmap_reg_read(map, reg, *val);
 
 		if (!map->cache_bypass)
 			regcache_write(map, reg, *val);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2478 @ void regmap_async_complete_cb(struct reg
 	struct regmap *map = async->map;
 	bool wake;
 
-	trace_regmap_async_io_complete(map->dev);
+	trace_regmap_async_io_complete(map);
 
 	spin_lock(&map->async_lock);
 	list_move(&async->list, &map->async_free);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2523 @ int regmap_async_complete(struct regmap
 	if (!map->bus || !map->bus->async_write)
 		return 0;
 
-	trace_regmap_async_complete_start(map->dev);
+	trace_regmap_async_complete_start(map);
 
 	wait_event(map->async_waitq, regmap_async_is_done(map));
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2532 @ int regmap_async_complete(struct regmap
 	map->async_ret = 0;
 	spin_unlock_irqrestore(&map->async_lock, flags);
 
-	trace_regmap_async_complete_done(map->dev);
+	trace_regmap_async_complete_done(map);
 
 	return ret;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/block/drbd/drbd_req.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/block/drbd/drbd_req.c
+++ linux-3.18.13-rt10-r7s4/drivers/block/drbd/drbd_req.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1548 @ int drbd_merge_bvec(struct request_queue
 		struct request_queue * const b =
 			device->ldev->backing_bdev->bd_disk->queue;
 		if (b->merge_bvec_fn) {
+			bvm->bi_bdev = device->ldev->backing_bdev;
 			backing_limit = b->merge_bvec_fn(b, bvm, bvec);
 			limit = min(limit, backing_limit);
 		}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1632 @ void request_timer_fn(unsigned long data
 		 time_after(now, req_peer->pre_send_jif + ent) &&
 		!time_in_range(now, connection->last_reconnect_jif, connection->last_reconnect_jif + ent)) {
 		drbd_warn(device, "Remote failed to finish a request within ko-count * timeout\n");
-		_drbd_set_state(_NS(device, conn, C_TIMEOUT), CS_VERBOSE | CS_HARD, NULL);
+		_conn_request_state(connection, NS(conn, C_TIMEOUT), CS_VERBOSE | CS_HARD);
 	}
 	if (dt && oldest_submit_jif != now &&
 		 time_after(now, oldest_submit_jif + dt) &&
Index: linux-3.18.13-rt10-r7s4/drivers/block/nbd.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/block/nbd.c
+++ linux-3.18.13-rt10-r7s4/drivers/block/nbd.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:806 @ static int __init nbd_init(void)
 		return -EINVAL;
 	}
 
-	nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
-	if (!nbd_dev)
-		return -ENOMEM;
-
 	part_shift = 0;
 	if (max_part > 0) {
 		part_shift = fls(max_part);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:827 @ static int __init nbd_init(void)
 	if (nbds_max > 1UL << (MINORBITS - part_shift))
 		return -EINVAL;
 
+	nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
+	if (!nbd_dev)
+		return -ENOMEM;
+
 	for (i = 0; i < nbds_max; i++) {
 		struct gendisk *disk = alloc_disk(1 << part_shift);
 		if (!disk)
Index: linux-3.18.13-rt10-r7s4/drivers/block/rbd.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/block/rbd.c
+++ linux-3.18.13-rt10-r7s4/drivers/block/rbd.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2101 @ static void rbd_dev_parent_put(struct rb
  * If an image has a non-zero parent overlap, get a reference to its
  * parent.
  *
- * We must get the reference before checking for the overlap to
- * coordinate properly with zeroing the parent overlap in
- * rbd_dev_v2_parent_info() when an image gets flattened.  We
- * drop it again if there is no overlap.
- *
  * Returns true if the rbd device has a parent with a non-zero
  * overlap and a reference for it was successfully taken, or
  * false otherwise.
  */
 static bool rbd_dev_parent_get(struct rbd_device *rbd_dev)
 {
-	int counter;
+	int counter = 0;
 
 	if (!rbd_dev->parent_spec)
 		return false;
 
-	counter = atomic_inc_return_safe(&rbd_dev->parent_ref);
-	if (counter > 0 && rbd_dev->parent_overlap)
-		return true;
-
-	/* Image was flattened, but parent is not yet torn down */
+	down_read(&rbd_dev->header_rwsem);
+	if (rbd_dev->parent_overlap)
+		counter = atomic_inc_return_safe(&rbd_dev->parent_ref);
+	up_read(&rbd_dev->header_rwsem);
 
 	if (counter < 0)
 		rbd_warn(rbd_dev, "parent reference overflow");
 
-	return false;
+	return counter > 0;
 }
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4233 @ static int rbd_dev_v2_parent_info(struct
 		 */
 		if (rbd_dev->parent_overlap) {
 			rbd_dev->parent_overlap = 0;
-			smp_mb();
 			rbd_dev_parent_put(rbd_dev);
 			pr_info("%s: clone image has been flattened\n",
 				rbd_dev->disk->disk_name);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4278 @ static int rbd_dev_v2_parent_info(struct
 	 * treat it specially.
 	 */
 	rbd_dev->parent_overlap = overlap;
-	smp_mb();
 	if (!overlap) {
 
 		/* A null parent_spec indicates it's the initial probe */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5106 @ static void rbd_dev_unprobe(struct rbd_d
 {
 	struct rbd_image_header	*header;
 
-	/* Drop parent reference unless it's already been done (or none) */
-
-	if (rbd_dev->parent_overlap)
-		rbd_dev_parent_put(rbd_dev);
+	rbd_dev_parent_put(rbd_dev);
 
 	/* Free dynamic fields from the header, then zero it out */
 
Index: linux-3.18.13-rt10-r7s4/drivers/bluetooth/ath3k.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/bluetooth/ath3k.c
+++ linux-3.18.13-rt10-r7s4/drivers/bluetooth/ath3k.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:82 @ static const struct usb_device_id ath3k_
 	{ USB_DEVICE(0x0489, 0xe057) },
 	{ USB_DEVICE(0x0489, 0xe056) },
 	{ USB_DEVICE(0x0489, 0xe05f) },
+	{ USB_DEVICE(0x0489, 0xe078) },
 	{ USB_DEVICE(0x04c5, 0x1330) },
 	{ USB_DEVICE(0x04CA, 0x3004) },
 	{ USB_DEVICE(0x04CA, 0x3005) },
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:90 @ static const struct usb_device_id ath3k_
 	{ USB_DEVICE(0x04CA, 0x3007) },
 	{ USB_DEVICE(0x04CA, 0x3008) },
 	{ USB_DEVICE(0x04CA, 0x300b) },
+	{ USB_DEVICE(0x04CA, 0x3010) },
 	{ USB_DEVICE(0x0930, 0x0219) },
 	{ USB_DEVICE(0x0930, 0x0220) },
 	{ USB_DEVICE(0x0930, 0x0227) },
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:110 @ static const struct usb_device_id ath3k_
 	{ USB_DEVICE(0x13d3, 0x3375) },
 	{ USB_DEVICE(0x13d3, 0x3393) },
 	{ USB_DEVICE(0x13d3, 0x3402) },
+	{ USB_DEVICE(0x13d3, 0x3408) },
+	{ USB_DEVICE(0x13d3, 0x3423) },
 	{ USB_DEVICE(0x13d3, 0x3432) },
 
 	/* Atheros AR5BBU12 with sflash firmware */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:137 @ static const struct usb_device_id ath3k_
 	{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:145 @ static const struct usb_device_id ath3k_
 	{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:165 @ static const struct usb_device_id ath3k_
 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
 
 	/* Atheros AR5BBU22 with sflash firmware */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:179 @ static const struct usb_device_id ath3k_
 #define USB_REQ_DFU_DNLOAD	1
 #define BULK_SIZE		4096
 #define FW_HDR_SIZE		20
+#define TIMEGAP_USEC_MIN	50
+#define TIMEGAP_USEC_MAX	100
 
 static int ath3k_load_firmware(struct usb_device *udev,
 				const struct firmware *firmware)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:212 @ static int ath3k_load_firmware(struct us
 	pipe = usb_sndbulkpipe(udev, 0x02);
 
 	while (count) {
+		/* workaround the compatibility issue with xHCI controller*/
+		usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX);
+
 		size = min_t(uint, count, BULK_SIZE);
 		memcpy(send_buf, firmware->data + sent, size);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:312 @ static int ath3k_load_fwfile(struct usb_
 	pipe = usb_sndbulkpipe(udev, 0x02);
 
 	while (count) {
+		/* workaround the compatibility issue with xHCI controller*/
+		usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX);
+
 		size = min_t(uint, count, BULK_SIZE);
 		memcpy(send_buf, firmware->data + sent, size);
 
Index: linux-3.18.13-rt10-r7s4/drivers/bluetooth/btusb.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/bluetooth/btusb.c
+++ linux-3.18.13-rt10-r7s4/drivers/bluetooth/btusb.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:110 @ static const struct usb_device_id btusb_
 	{ USB_DEVICE(0x0b05, 0x17cb) },
 	{ USB_DEVICE(0x413c, 0x8197) },
 
+	/* Broadcom BCM20702B0 (Dynex/Insignia) */
+	{ USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
+
 	/* Foxconn - Hon Hai */
 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
 
+	/* Lite-On Technology - Broadcom based */
+	{ USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
+	  .driver_info = BTUSB_BCM_PATCHRAM },
+
 	/* Broadcom devices with vendor specific id */
 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
 	  .driver_info = BTUSB_BCM_PATCHRAM },
 
 	/* ASUSTek Computer - Broadcom based */
+	{ USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
+	  .driver_info = BTUSB_BCM_PATCHRAM },
+
+	/* ASUSTek Computer - Broadcom based */
 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01) },
 
 	/* Belkin F8065bf - Broadcom based */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:170 @ static const struct usb_device_id blackl
 	{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:178 @ static const struct usb_device_id blackl
 	{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:198 @ static const struct usb_device_id blackl
 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
 
 	/* Atheros AR5BBU12 with sflash firmware */
Index: linux-3.18.13-rt10-r7s4/drivers/bus/mvebu-mbus.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/bus/mvebu-mbus.c
+++ linux-3.18.13-rt10-r7s4/drivers/bus/mvebu-mbus.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:185 @ static void mvebu_mbus_disable_window(st
 }
 
 /* Checks whether the given window number is available */
+
+/* On Armada XP, 375 and 38x the MBus window 13 has the remap
+ * capability, like windows 0 to 7. However, the mvebu-mbus driver
+ * isn't currently taking into account this special case, which means
+ * that when window 13 is actually used, the remap registers are left
+ * to 0, making the device using this MBus window unavailable. The
+ * quick fix for stable is to not use window 13. A follow up patch
+ * will correctly handle this window.
+*/
 static int mvebu_mbus_window_is_free(struct mvebu_mbus_state *mbus,
 				     const int win)
 {
 	void __iomem *addr = mbus->mbuswins_base +
 		mbus->soc->win_cfg_offset(win);
 	u32 ctrl = readl(addr + WIN_CTRL_OFF);
+
+	if (win == 13)
+		return false;
+
 	return !(ctrl & WIN_CTRL_ENABLE);
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/bus/omap_l3_noc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/bus/omap_l3_noc.c
+++ linux-3.18.13-rt10-r7s4/drivers/bus/omap_l3_noc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:225 @ static irqreturn_t l3_interrupt_handler(
 			}
 
 			/* Error found so break the for loop */
-			break;
+			return IRQ_HANDLED;
 		}
 	}
-	return IRQ_HANDLED;
+
+	dev_err(l3->dev, "L3 %s IRQ not handled!!\n",
+		inttype ? "debug" : "application");
+
+	return IRQ_NONE;
 }
 
 static const struct of_device_id l3_noc_match[] = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:303 @ static int omap_l3_probe(struct platform
 	return ret;
 }
 
+#ifdef	CONFIG_PM
+
+/**
+ * l3_resume_noirq() - resume function for l3_noc
+ * @dev:	pointer to l3_noc device structure
+ *
+ * We only have the resume handler only since we
+ * have already maintained the delta register
+ * configuration as part of configuring the system
+ */
+static int l3_resume_noirq(struct device *dev)
+{
+	struct omap_l3 *l3 = dev_get_drvdata(dev);
+	int i;
+	struct l3_flagmux_data *flag_mux;
+	void __iomem *base, *mask_regx = NULL;
+	u32 mask_val;
+
+	for (i = 0; i < l3->num_modules; i++) {
+		base = l3->l3_base[i];
+		flag_mux = l3->l3_flagmux[i];
+		if (!flag_mux->mask_app_bits && !flag_mux->mask_dbg_bits)
+			continue;
+
+		mask_regx = base + flag_mux->offset + L3_FLAGMUX_MASK0 +
+			   (L3_APPLICATION_ERROR << 3);
+		mask_val = readl_relaxed(mask_regx);
+		mask_val &= ~(flag_mux->mask_app_bits);
+
+		writel_relaxed(mask_val, mask_regx);
+		mask_regx = base + flag_mux->offset + L3_FLAGMUX_MASK0 +
+			   (L3_DEBUG_ERROR << 3);
+		mask_val = readl_relaxed(mask_regx);
+		mask_val &= ~(flag_mux->mask_dbg_bits);
+
+		writel_relaxed(mask_val, mask_regx);
+	}
+
+	/* Dummy read to force OCP barrier */
+	if (mask_regx)
+		(void)readl(mask_regx);
+
+	return 0;
+}
+
+static const struct dev_pm_ops l3_dev_pm_ops = {
+	.resume_noirq		= l3_resume_noirq,
+};
+
+#define L3_DEV_PM_OPS (&l3_dev_pm_ops)
+#else
+#define L3_DEV_PM_OPS NULL
+#endif
+
 static struct platform_driver omap_l3_driver = {
 	.probe		= omap_l3_probe,
 	.driver		= {
 		.name		= "omap_l3_noc",
 		.owner		= THIS_MODULE,
+		.pm		= L3_DEV_PM_OPS,
 		.of_match_table = of_match_ptr(l3_noc_match),
 	},
 };
Index: linux-3.18.13-rt10-r7s4/drivers/char/i8k.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/char/i8k.c
+++ linux-3.18.13-rt10-r7s4/drivers/char/i8k.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:714 @ static struct dmi_system_id i8k_dmi_tabl
 		.driver_data = (void *)&i8k_config_data[DELL_LATITUDE_D520],
 	},
 	{
+		.ident = "Dell Latitude E6440",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6440"),
+		},
+		.driver_data = (void *)&i8k_config_data[DELL_LATITUDE_E6540],
+	},
+	{
 		.ident = "Dell Latitude E6540",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
Index: linux-3.18.13-rt10-r7s4/drivers/char/random.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/char/random.c
+++ linux-3.18.13-rt10-r7s4/drivers/char/random.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:572 @ static void fast_mix(struct fast_pool *f
 	__u32 c = f->pool[2],	d = f->pool[3];
 
 	a += b;			c += d;
-	b = rol32(a, 6);	d = rol32(c, 27);
+	b = rol32(b, 6);	d = rol32(d, 27);
 	d ^= a;			b ^= c;
 
 	a += b;			c += d;
-	b = rol32(a, 16);	d = rol32(c, 14);
+	b = rol32(b, 16);	d = rol32(d, 14);
 	d ^= a;			b ^= c;
 
 	a += b;			c += d;
-	b = rol32(a, 6);	d = rol32(c, 27);
+	b = rol32(b, 6);	d = rol32(d, 27);
 	d ^= a;			b ^= c;
 
 	a += b;			c += d;
-	b = rol32(a, 16);	d = rol32(c, 14);
+	b = rol32(b, 16);	d = rol32(d, 14);
 	d ^= a;			b ^= c;
 
 	f->pool[0] = a;  f->pool[1] = b;
Index: linux-3.18.13-rt10-r7s4/drivers/char/tpm/tpm-interface.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/char/tpm/tpm-interface.c
+++ linux-3.18.13-rt10-r7s4/drivers/char/tpm/tpm-interface.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1125 @ struct tpm_chip *tpm_register_hardware(s
 
 	/* Make chip available */
 	spin_lock(&driver_lock);
-	list_add_rcu(&chip->list, &tpm_chip_list);
+	list_add_tail_rcu(&chip->list, &tpm_chip_list);
 	spin_unlock(&driver_lock);
 
 	return chip;
Index: linux-3.18.13-rt10-r7s4/drivers/char/tpm/tpm_i2c_atmel.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/char/tpm/tpm_i2c_atmel.c
+++ linux-3.18.13-rt10-r7s4/drivers/char/tpm/tpm_i2c_atmel.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:171 @ static int i2c_atmel_probe(struct i2c_cl
 
 	chip->vendor.priv = devm_kzalloc(dev, sizeof(struct priv_data),
 					 GFP_KERNEL);
+	if (!chip->vendor.priv) {
+		rc = -ENOMEM;
+		goto out_err;
+	}
 
 	/* Default timeouts */
 	chip->vendor.timeout_a = msecs_to_jiffies(TPM_I2C_SHORT_TIMEOUT);
Index: linux-3.18.13-rt10-r7s4/drivers/char/tpm/tpm_i2c_nuvoton.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/char/tpm/tpm_i2c_nuvoton.c
+++ linux-3.18.13-rt10-r7s4/drivers/char/tpm/tpm_i2c_nuvoton.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:541 @ static int i2c_nuvoton_probe(struct i2c_
 
 	chip->vendor.priv = devm_kzalloc(dev, sizeof(struct priv_data),
 					 GFP_KERNEL);
+	if (!chip->vendor.priv) {
+		rc = -ENOMEM;
+		goto out_err;
+	}
+
 	init_waitqueue_head(&chip->vendor.read_queue);
 	init_waitqueue_head(&chip->vendor.int_queue);
 
Index: linux-3.18.13-rt10-r7s4/drivers/char/tpm/tpm_i2c_stm_st33.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/char/tpm/tpm_i2c_stm_st33.c
+++ linux-3.18.13-rt10-r7s4/drivers/char/tpm/tpm_i2c_stm_st33.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:400 @ static int wait_for_stat(struct tpm_chip
  */
 static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
 {
-	int size = 0, burstcnt, len;
+	int size = 0, burstcnt, len, ret;
 	struct i2c_client *client;
 
 	client = (struct i2c_client *)TPM_VPRIV(chip);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:409 @ static int recv_data(struct tpm_chip *ch
 	       wait_for_stat(chip,
 			     TPM_STS_DATA_AVAIL | TPM_STS_VALID,
 			     chip->vendor.timeout_c,
-			     &chip->vendor.read_queue)
-	       == 0) {
+			     &chip->vendor.read_queue) == 0) {
 		burstcnt = get_burstcount(chip);
 		if (burstcnt < 0)
 			return burstcnt;
 		len = min_t(int, burstcnt, count - size);
-		I2C_READ_DATA(client, TPM_DATA_FIFO, buf + size, len);
+		ret = I2C_READ_DATA(client, TPM_DATA_FIFO, buf + size, len);
+		if (ret < 0)
+			return ret;
+
 		size += len;
 	}
 	return size;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:492 @ static int tpm_stm_i2c_send(struct tpm_c
 		if (burstcnt < 0)
 			return burstcnt;
 		size = min_t(int, len - i - 1, burstcnt);
-		ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf, size);
+		ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf + i, size);
 		if (ret < 0)
 			goto out_err;
 
Index: linux-3.18.13-rt10-r7s4/drivers/char/tpm/tpm_ibmvtpm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/char/tpm/tpm_ibmvtpm.c
+++ linux-3.18.13-rt10-r7s4/drivers/char/tpm/tpm_ibmvtpm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:127 @ static int tpm_ibmvtpm_send(struct tpm_c
 {
 	struct ibmvtpm_dev *ibmvtpm;
 	struct ibmvtpm_crq crq;
-	u64 *word = (u64 *) &crq;
+	__be64 *word = (__be64 *)&crq;
 	int rc;
 
 	ibmvtpm = (struct ibmvtpm_dev *)TPM_VPRIV(chip);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:148 @ static int tpm_ibmvtpm_send(struct tpm_c
 	memcpy((void *)ibmvtpm->rtce_buf, (void *)buf, count);
 	crq.valid = (u8)IBMVTPM_VALID_CMD;
 	crq.msg = (u8)VTPM_TPM_COMMAND;
-	crq.len = (u16)count;
-	crq.data = ibmvtpm->rtce_dma_handle;
+	crq.len = cpu_to_be16(count);
+	crq.data = cpu_to_be32(ibmvtpm->rtce_dma_handle);
 
-	rc = ibmvtpm_send_crq(ibmvtpm->vdev, word[0], word[1]);
+	rc = ibmvtpm_send_crq(ibmvtpm->vdev, be64_to_cpu(word[0]),
+			      be64_to_cpu(word[1]));
 	if (rc != H_SUCCESS) {
 		dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
 		rc = 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:190 @ static int ibmvtpm_crq_get_rtce_size(str
 	crq.valid = (u8)IBMVTPM_VALID_CMD;
 	crq.msg = (u8)VTPM_GET_RTCE_BUFFER_SIZE;
 
-	rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]);
+	rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
+			      cpu_to_be64(buf[1]));
 	if (rc != H_SUCCESS)
 		dev_err(ibmvtpm->dev,
 			"ibmvtpm_crq_get_rtce_size failed rc=%d\n", rc);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:217 @ static int ibmvtpm_crq_get_version(struc
 	crq.valid = (u8)IBMVTPM_VALID_CMD;
 	crq.msg = (u8)VTPM_GET_VERSION;
 
-	rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]);
+	rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
+			      cpu_to_be64(buf[1]));
 	if (rc != H_SUCCESS)
 		dev_err(ibmvtpm->dev,
 			"ibmvtpm_crq_get_version failed rc=%d\n", rc);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:313 @ static int tpm_ibmvtpm_remove(struct vio
 static unsigned long tpm_ibmvtpm_get_desired_dma(struct vio_dev *vdev)
 {
 	struct ibmvtpm_dev *ibmvtpm = ibmvtpm_get_data(&vdev->dev);
+
+	/* ibmvtpm initializes at probe time, so the data we are
+	* asking for may not be set yet. Estimate that 4K required
+	* for TCE-mapped buffer in addition to CRQ.
+	*/
+	if (!ibmvtpm)
+		return CRQ_RES_BUF_SIZE + PAGE_SIZE;
+
 	return CRQ_RES_BUF_SIZE + ibmvtpm->rtce_size;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:341 @ static int tpm_ibmvtpm_suspend(struct de
 	crq.valid = (u8)IBMVTPM_VALID_CMD;
 	crq.msg = (u8)VTPM_PREPARE_TO_SUSPEND;
 
-	rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]);
+	rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
+			      cpu_to_be64(buf[1]));
 	if (rc != H_SUCCESS)
 		dev_err(ibmvtpm->dev,
 			"tpm_ibmvtpm_suspend failed rc=%d\n", rc);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:487 @ static void ibmvtpm_crq_process(struct i
 	case IBMVTPM_VALID_CMD:
 		switch (crq->msg) {
 		case VTPM_GET_RTCE_BUFFER_SIZE_RES:
-			if (crq->len <= 0) {
+			if (be16_to_cpu(crq->len) <= 0) {
 				dev_err(ibmvtpm->dev, "Invalid rtce size\n");
 				return;
 			}
-			ibmvtpm->rtce_size = crq->len;
+			ibmvtpm->rtce_size = be16_to_cpu(crq->len);
 			ibmvtpm->rtce_buf = kmalloc(ibmvtpm->rtce_size,
 						    GFP_KERNEL);
 			if (!ibmvtpm->rtce_buf) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:512 @ static void ibmvtpm_crq_process(struct i
 
 			return;
 		case VTPM_GET_VERSION_RES:
-			ibmvtpm->vtpm_version = crq->data;
+			ibmvtpm->vtpm_version = be32_to_cpu(crq->data);
 			return;
 		case VTPM_TPM_COMMAND_RES:
 			/* len of the data in rtce buffer */
-			ibmvtpm->res_len = crq->len;
+			ibmvtpm->res_len = be16_to_cpu(crq->len);
 			wake_up_interruptible(&ibmvtpm->wq);
 			return;
 		default:
Index: linux-3.18.13-rt10-r7s4/drivers/char/tpm/tpm_ibmvtpm.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/char/tpm/tpm_ibmvtpm.h
+++ linux-3.18.13-rt10-r7s4/drivers/char/tpm/tpm_ibmvtpm.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:25 @
 struct ibmvtpm_crq {
 	u8 valid;
 	u8 msg;
-	u16 len;
-	u32 data;
-	u64 reserved;
+	__be16 len;
+	__be32 data;
+	__be64 reserved;
 } __attribute__((packed, aligned(8)));
 
 struct ibmvtpm_crq_queue {
Index: linux-3.18.13-rt10-r7s4/drivers/char/tpm/tpm_tis.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/char/tpm/tpm_tis.c
+++ linux-3.18.13-rt10-r7s4/drivers/char/tpm/tpm_tis.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:78 @ enum tis_defaults {
 #define	TPM_DID_VID(l)			(0x0F00 | ((l) << 12))
 #define	TPM_RID(l)			(0x0F04 | ((l) << 12))
 
+struct priv_data {
+	bool irq_tested;
+};
+
 static LIST_HEAD(tis_chips);
 static DEFINE_MUTEX(tis_lock);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:345 @ out_err:
 	return rc;
 }
 
+static void disable_interrupts(struct tpm_chip *chip)
+{
+	u32 intmask;
+
+	intmask =
+	    ioread32(chip->vendor.iobase +
+		     TPM_INT_ENABLE(chip->vendor.locality));
+	intmask &= ~TPM_GLOBAL_INT_ENABLE;
+	iowrite32(intmask,
+		  chip->vendor.iobase +
+		  TPM_INT_ENABLE(chip->vendor.locality));
+	free_irq(chip->vendor.irq, chip);
+	chip->vendor.irq = 0;
+}
+
 /*
  * If interrupts are used (signaled by an irq set in the vendor structure)
  * tpm.c can skip polling for the data to be available as the interrupt is
  * waited for here
  */
-static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
+static int tpm_tis_send_main(struct tpm_chip *chip, u8 *buf, size_t len)
 {
 	int rc;
 	u32 ordinal;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:395 @ out_err:
 	return rc;
 }
 
+static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
+{
+	int rc, irq;
+	struct priv_data *priv = chip->vendor.priv;
+
+	if (!chip->vendor.irq || priv->irq_tested)
+		return tpm_tis_send_main(chip, buf, len);
+
+	/* Verify receipt of the expected IRQ */
+	irq = chip->vendor.irq;
+	chip->vendor.irq = 0;
+	rc = tpm_tis_send_main(chip, buf, len);
+	chip->vendor.irq = irq;
+	if (!priv->irq_tested)
+		msleep(1);
+	if (!priv->irq_tested) {
+		disable_interrupts(chip);
+		dev_err(chip->dev,
+			FW_BUG "TPM interrupt not working, polling instead\n");
+	}
+	priv->irq_tested = true;
+	return rc;
+}
+
 struct tis_vendor_timeout_override {
 	u32 did_vid;
 	unsigned long timeout_us[4];
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:551 @ static irqreturn_t tis_int_handler(int d
 	if (interrupt == 0)
 		return IRQ_NONE;
 
+	((struct priv_data *)chip->vendor.priv)->irq_tested = true;
 	if (interrupt & TPM_INTF_DATA_AVAIL_INT)
 		wake_up_interruptible(&chip->vendor.read_queue);
 	if (interrupt & TPM_INTF_LOCALITY_CHANGE_INT)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:581 @ static int tpm_tis_init(struct device *d
 	u32 vendor, intfcaps, intmask;
 	int rc, i, irq_s, irq_e, probe;
 	struct tpm_chip *chip;
+	struct priv_data *priv;
 
+	priv = devm_kzalloc(dev, sizeof(struct priv_data), GFP_KERNEL);
+	if (priv == NULL)
+		return -ENOMEM;
 	if (!(chip = tpm_register_hardware(dev, &tpm_tis)))
 		return -ENODEV;
+	chip->vendor.priv = priv;
 
 	chip->vendor.iobase = ioremap(start, len);
 	if (!chip->vendor.iobase) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:657 @ static int tpm_tis_init(struct device *d
 	if (intfcaps & TPM_INTF_DATA_AVAIL_INT)
 		dev_dbg(dev, "\tData Avail Int Support\n");
 
-	/* get the timeouts before testing for irqs */
-	if (tpm_get_timeouts(chip)) {
-		dev_err(dev, "Could not get TPM timeouts and durations\n");
-		rc = -ENODEV;
-		goto out_err;
-	}
-
-	if (tpm_do_selftest(chip)) {
-		dev_err(dev, "TPM self test failed\n");
-		rc = -ENODEV;
-		goto out_err;
-	}
-
 	/* INTERRUPT Setup */
 	init_waitqueue_head(&chip->vendor.read_queue);
 	init_waitqueue_head(&chip->vendor.int_queue);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:758 @ static int tpm_tis_init(struct device *d
 		}
 	}
 
+	if (tpm_get_timeouts(chip)) {
+		dev_err(dev, "Could not get TPM timeouts and durations\n");
+		rc = -ENODEV;
+		goto out_err;
+	}
+
+	if (tpm_do_selftest(chip)) {
+		dev_err(dev, "TPM self test failed\n");
+		rc = -ENODEV;
+		goto out_err;
+	}
+
 	INIT_LIST_HEAD(&chip->vendor.list);
 	mutex_lock(&tis_lock);
 	list_add(&chip->vendor.list, &tis_chips);
Index: linux-3.18.13-rt10-r7s4/drivers/char/virtio_console.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/char/virtio_console.c
+++ linux-3.18.13-rt10-r7s4/drivers/char/virtio_console.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:145 @ struct ports_device {
 	 * notification
 	 */
 	struct work_struct control_work;
+	struct work_struct config_work;
 
 	struct list_head ports;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1836 @ static void config_intr(struct virtio_de
 
 	portdev = vdev->priv;
 
+	if (!use_multiport(portdev))
+		schedule_work(&portdev->config_work);
+}
+
+static void config_work_handler(struct work_struct *work)
+{
+	struct ports_device *portdev;
+
+	portdev = container_of(work, struct ports_device, control_work);
 	if (!use_multiport(portdev)) {
+		struct virtio_device *vdev;
 		struct port *port;
 		u16 rows, cols;
 
+		vdev = portdev->vdev;
 		virtio_cread(vdev, struct virtio_console_config, cols, &cols);
 		virtio_cread(vdev, struct virtio_console_config, rows, &rows);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2041 @ static int virtcons_probe(struct virtio_
 
 	virtio_device_ready(portdev->vdev);
 
+	INIT_WORK(&portdev->config_work, &config_work_handler);
+	INIT_WORK(&portdev->control_work, &control_work_handler);
+
 	if (multiport) {
 		unsigned int nr_added_bufs;
 
 		spin_lock_init(&portdev->c_ivq_lock);
 		spin_lock_init(&portdev->c_ovq_lock);
-		INIT_WORK(&portdev->control_work, &control_work_handler);
 
 		nr_added_bufs = fill_queue(portdev->c_ivq,
 					   &portdev->c_ivq_lock);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2116 @ static void virtcons_remove(struct virti
 	/* Finish up work that's lined up */
 	if (use_multiport(portdev))
 		cancel_work_sync(&portdev->control_work);
+	else
+		cancel_work_sync(&portdev->config_work);
 
 	list_for_each_entry_safe(port, port2, &portdev->ports, list)
 		unplug_port(port);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2169 @ static int virtcons_freeze(struct virtio
 
 	virtqueue_disable_cb(portdev->c_ivq);
 	cancel_work_sync(&portdev->control_work);
+	cancel_work_sync(&portdev->config_work);
 	/*
 	 * Once more: if control_work_handler() was running, it would
 	 * enable the cb as the last step.
Index: linux-3.18.13-rt10-r7s4/drivers/clk/berlin/bg2q.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clk/berlin/bg2q.c
+++ linux-3.18.13-rt10-r7s4/drivers/clk/berlin/bg2q.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:288 @ static const struct berlin2_gate_data bg
 	{ "pbridge",	"perif",	15, CLK_IGNORE_UNUSED },
 	{ "sdio",	"perif",	16, CLK_IGNORE_UNUSED },
 	{ "nfc",	"perif",	18 },
-	{ "smemc",	"perif",	19 },
 	{ "pcie",	"perif",	22 },
 };
 
Index: linux-3.18.13-rt10-r7s4/drivers/clk/clk-divider.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clk/clk-divider.c
+++ linux-3.18.13-rt10-r7s4/drivers/clk/clk-divider.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:132 @ static unsigned long clk_divider_recalc_
 	return DIV_ROUND_UP(parent_rate, div);
 }
 
-/*
- * The reverse of DIV_ROUND_UP: The maximum number which
- * divided by m is r
- */
-#define MULT_ROUND_UP(r, m) ((r) * (m) + (m) - 1)
-
 static bool _is_valid_table_div(const struct clk_div_table *table,
 							 unsigned int div)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:205 @ static int _div_round_closest(struct clk
 		unsigned long parent_rate, unsigned long rate)
 {
 	int up, down, div;
+	unsigned long up_rate, down_rate;
 
 	up = down = div = DIV_ROUND_CLOSEST(parent_rate, rate);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:217 @ static int _div_round_closest(struct clk
 		down = _round_down_table(divider->table, div);
 	}
 
-	return (up - div) <= (div - down) ? up : down;
+	up_rate = DIV_ROUND_UP(parent_rate, up);
+	down_rate = DIV_ROUND_UP(parent_rate, down);
+
+	return (rate - up_rate) <= (down_rate - rate) ? up : down;
 }
 
 static int _div_round(struct clk_divider *divider, unsigned long parent_rate,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:301 @ static int clk_divider_bestdiv(struct cl
 			return i;
 		}
 		parent_rate = __clk_round_rate(__clk_get_parent(hw->clk),
-				MULT_ROUND_UP(rate, i));
+					       rate * i);
 		now = DIV_ROUND_UP(parent_rate, i);
 		if (_is_best_div(divider, rate, now, best)) {
 			bestdiv = i;
Index: linux-3.18.13-rt10-r7s4/drivers/clk/clk-gate.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clk/clk-gate.c
+++ linux-3.18.13-rt10-r7s4/drivers/clk/clk-gate.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:131 @ struct clk *clk_register_gate(struct dev
 	struct clk_init_data init;
 
 	if (clk_gate_flags & CLK_GATE_HIWORD_MASK) {
-		if (bit_idx > 16) {
+		if (bit_idx > 15) {
 			pr_err("gate bit exceeds LOWORD field\n");
 			return ERR_PTR(-EINVAL);
 		}
Index: linux-3.18.13-rt10-r7s4/drivers/clk/clk-ppc-corenet.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clk/clk-ppc-corenet.c
+++ linux-3.18.13-rt10-r7s4/drivers/clk/clk-ppc-corenet.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:294 @ static const struct of_device_id ppc_clk
 	{}
 };
 
-static struct platform_driver ppc_corenet_clk_driver __initdata = {
+static struct platform_driver ppc_corenet_clk_driver = {
 	.driver = {
 		.name = "ppc_corenet_clock",
 		.owner = THIS_MODULE,
Index: linux-3.18.13-rt10-r7s4/drivers/clk/clk.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clk/clk.c
+++ linux-3.18.13-rt10-r7s4/drivers/clk/clk.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:243 @ static const struct file_operations clk_
 	.release	= single_release,
 };
 
-/* caller must hold prepare_lock */
 static int clk_debug_create_one(struct clk *clk, struct dentry *pdentry)
 {
 	struct dentry *d;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:346 @ unlock:
 static void clk_debug_unregister(struct clk *clk)
 {
 	mutex_lock(&clk_debug_lock);
-	if (!clk->dentry)
-		goto out;
-
 	hlist_del_init(&clk->debug_node);
 	debugfs_remove_recursive(clk->dentry);
 	clk->dentry = NULL;
-out:
 	mutex_unlock(&clk_debug_lock);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1942 @ int __clk_init(struct device *dev, struc
 	else
 		clk->rate = 0;
 
-	clk_debug_register(clk);
 	/*
 	 * walk the list of orphan clocks and reparent any that are children of
 	 * this clock
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1976 @ int __clk_init(struct device *dev, struc
 out:
 	clk_prepare_unlock();
 
+	if (!ret)
+		clk_debug_register(clk);
+
 	return ret;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/clk/rockchip/clk-rk3188.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clk/rockchip/clk-rk3188.c
+++ linux-3.18.13-rt10-r7s4/drivers/clk/rockchip/clk-rk3188.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:213 @ PNAME(mux_sclk_hsadc_p)		= { "hsadc_src"
 PNAME(mux_mac_p)		= { "gpll", "dpll" };
 PNAME(mux_sclk_macref_p)	= { "mac_src", "ext_rmii" };
 
+static struct rockchip_pll_clock rk3066_pll_clks[] __initdata = {
+	[apll] = PLL(pll_rk3066, PLL_APLL, "apll", mux_pll_p, 0, RK2928_PLL_CON(0),
+		     RK2928_MODE_CON, 0, 5, rk3188_pll_rates),
+	[dpll] = PLL(pll_rk3066, PLL_DPLL, "dpll", mux_pll_p, 0, RK2928_PLL_CON(4),
+		     RK2928_MODE_CON, 4, 4, NULL),
+	[cpll] = PLL(pll_rk3066, PLL_CPLL, "cpll", mux_pll_p, 0, RK2928_PLL_CON(8),
+		     RK2928_MODE_CON, 8, 6, rk3188_pll_rates),
+	[gpll] = PLL(pll_rk3066, PLL_GPLL, "gpll", mux_pll_p, 0, RK2928_PLL_CON(12),
+		     RK2928_MODE_CON, 12, 7, rk3188_pll_rates),
+};
+
 static struct rockchip_pll_clock rk3188_pll_clks[] __initdata = {
 	[apll] = PLL(pll_rk3066, PLL_APLL, "apll", mux_pll_p, 0, RK2928_PLL_CON(0),
 		     RK2928_MODE_CON, 0, 6, rk3188_pll_rates),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:756 @ static void __init rk3188_common_clk_ini
 static void __init rk3066a_clk_init(struct device_node *np)
 {
 	rk3188_common_clk_init(np);
-	rockchip_clk_register_plls(rk3188_pll_clks,
-				   ARRAY_SIZE(rk3188_pll_clks),
+	rockchip_clk_register_plls(rk3066_pll_clks,
+				   ARRAY_SIZE(rk3066_pll_clks),
 				   RK3066_GRF_SOC_STATUS);
 	rockchip_clk_register_branches(rk3066a_clk_branches,
 				  ARRAY_SIZE(rk3066a_clk_branches));
Index: linux-3.18.13-rt10-r7s4/drivers/clk/rockchip/clk-rk3288.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clk/rockchip/clk-rk3288.c
+++ linux-3.18.13-rt10-r7s4/drivers/clk/rockchip/clk-rk3288.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:145 @ struct rockchip_pll_rate_table rk3288_pl
 	}
 
 static struct rockchip_cpuclk_rate_table rk3288_cpuclk_rates[] __initdata = {
-	RK3288_CPUCLK_RATE(1800000000, 2, 4, 2, 4, 4),
-	RK3288_CPUCLK_RATE(1704000000, 2, 4, 2, 4, 4),
-	RK3288_CPUCLK_RATE(1608000000, 2, 4, 2, 4, 4),
-	RK3288_CPUCLK_RATE(1512000000, 2, 4, 2, 4, 4),
-	RK3288_CPUCLK_RATE(1416000000, 2, 4, 2, 4, 4),
-	RK3288_CPUCLK_RATE(1200000000, 2, 4, 2, 4, 4),
-	RK3288_CPUCLK_RATE(1008000000, 2, 4, 2, 4, 4),
-	RK3288_CPUCLK_RATE( 816000000, 2, 4, 2, 4, 4),
-	RK3288_CPUCLK_RATE( 696000000, 2, 4, 2, 4, 4),
-	RK3288_CPUCLK_RATE( 600000000, 2, 4, 2, 4, 4),
-	RK3288_CPUCLK_RATE( 408000000, 2, 4, 2, 4, 4),
-	RK3288_CPUCLK_RATE( 312000000, 2, 4, 2, 4, 4),
-	RK3288_CPUCLK_RATE( 216000000, 2, 4, 2, 4, 4),
-	RK3288_CPUCLK_RATE( 126000000, 2, 4, 2, 4, 4),
+	RK3288_CPUCLK_RATE(1800000000, 1, 3, 1, 3, 3),
+	RK3288_CPUCLK_RATE(1704000000, 1, 3, 1, 3, 3),
+	RK3288_CPUCLK_RATE(1608000000, 1, 3, 1, 3, 3),
+	RK3288_CPUCLK_RATE(1512000000, 1, 3, 1, 3, 3),
+	RK3288_CPUCLK_RATE(1416000000, 1, 3, 1, 3, 3),
+	RK3288_CPUCLK_RATE(1200000000, 1, 3, 1, 3, 3),
+	RK3288_CPUCLK_RATE(1008000000, 1, 3, 1, 3, 3),
+	RK3288_CPUCLK_RATE( 816000000, 1, 3, 1, 3, 3),
+	RK3288_CPUCLK_RATE( 696000000, 1, 3, 1, 3, 3),
+	RK3288_CPUCLK_RATE( 600000000, 1, 3, 1, 3, 3),
+	RK3288_CPUCLK_RATE( 408000000, 1, 3, 1, 3, 3),
+	RK3288_CPUCLK_RATE( 312000000, 1, 3, 1, 3, 3),
+	RK3288_CPUCLK_RATE( 216000000, 1, 3, 1, 3, 3),
+	RK3288_CPUCLK_RATE( 126000000, 1, 3, 1, 3, 3),
 };
 
 static const struct rockchip_cpuclk_reg_data rk3288_cpuclk_data = {
Index: linux-3.18.13-rt10-r7s4/drivers/clk/samsung/clk-exynos-audss.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clk/samsung/clk-exynos-audss.c
+++ linux-3.18.13-rt10-r7s4/drivers/clk/samsung/clk-exynos-audss.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:213 @ static int exynos_audss_clk_remove(struc
 {
 	int i;
 
+#ifdef CONFIG_PM_SLEEP
+	unregister_syscore_ops(&exynos_audss_clk_syscore_ops);
+#endif
+
 	of_clk_del_provider(pdev->dev.of_node);
 
 	for (i = 0; i < clk_data.clk_num; i++) {
Index: linux-3.18.13-rt10-r7s4/drivers/clk/sunxi/clk-sunxi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clk/sunxi/clk-sunxi.c
+++ linux-3.18.13-rt10-r7s4/drivers/clk/sunxi/clk-sunxi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:422 @ static struct clk_factors_config sun6i_a
 	.kwidth = 2,
 	.mshift = 0,
 	.mwidth = 2,
+	.n_start = 1,
 };
 
 static struct clk_factors_config sun8i_a23_pll1_config = {
Index: linux-3.18.13-rt10-r7s4/drivers/clk/zynq/clkc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clk/zynq/clkc.c
+++ linux-3.18.13-rt10-r7s4/drivers/clk/zynq/clkc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:306 @ static void __init zynq_clk_setup(struct
 	clks[cpu_2x] = clk_register_gate(NULL, clk_output_name[cpu_2x],
 			"cpu_2x_div", CLK_IGNORE_UNUSED, SLCR_ARM_CLK_CTRL,
 			26, 0, &armclk_lock);
+	clk_prepare_enable(clks[cpu_2x]);
 
 	clk = clk_register_fixed_factor(NULL, "cpu_1x_div", "cpu_div", 0, 1,
 			4 + 2 * tmp);
Index: linux-3.18.13-rt10-r7s4/drivers/clocksource/arm_arch_timer.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clocksource/arm_arch_timer.c
+++ linux-3.18.13-rt10-r7s4/drivers/clocksource/arm_arch_timer.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:465 @ static void __init arch_counter_register
 
 	/* Register the CP15 based counter if we have one */
 	if (type & ARCH_CP15_TIMER) {
-		arch_timer_read_counter = arch_counter_get_cntvct;
+		if (IS_ENABLED(CONFIG_ARM64) || arch_timer_use_virtual)
+			arch_timer_read_counter = arch_counter_get_cntvct;
+		else
+			arch_timer_read_counter = arch_counter_get_cntpct;
 	} else {
 		arch_timer_read_counter = arch_counter_get_cntvct_mem;
 
Index: linux-3.18.13-rt10-r7s4/drivers/clocksource/exynos_mct.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clocksource/exynos_mct.c
+++ linux-3.18.13-rt10-r7s4/drivers/clocksource/exynos_mct.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:100 @ static void exynos4_mct_write(unsigned i
 	writel_relaxed(value, reg_base + offset);
 
 	if (likely(offset >= EXYNOS4_MCT_L_BASE(0))) {
-		stat_addr = (offset & ~EXYNOS4_MCT_L_MASK) + MCT_L_WSTAT_OFFSET;
-		switch (offset & EXYNOS4_MCT_L_MASK) {
+		stat_addr = (offset & EXYNOS4_MCT_L_MASK) + MCT_L_WSTAT_OFFSET;
+		switch (offset & ~EXYNOS4_MCT_L_MASK) {
 		case MCT_L_TCON_OFFSET:
 			mask = 1 << 3;		/* L_TCON write status */
 			break;
Index: linux-3.18.13-rt10-r7s4/drivers/clocksource/mtk_timer.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clocksource/mtk_timer.c
+++ linux-3.18.13-rt10-r7s4/drivers/clocksource/mtk_timer.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:227 @ static void __init mtk_timer_init(struct
 	}
 	rate = clk_get_rate(clk);
 
+	mtk_timer_global_reset(evt);
+
 	if (request_irq(evt->dev.irq, mtk_timer_interrupt,
 			IRQF_TIMER | IRQF_IRQPOLL, "mtk_timer", evt)) {
 		pr_warn("failed to setup irq %d\n", evt->dev.irq);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:237 @ static void __init mtk_timer_init(struct
 
 	evt->ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
 
-	mtk_timer_global_reset(evt);
-
 	/* Configure clock source */
 	mtk_timer_setup(evt, GPT_CLK_SRC, TIMER_CTRL_OP_FREERUN);
 	clocksource_mmio_init(evt->gpt_base + TIMER_CNT_REG(GPT_CLK_SRC),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:244 @ static void __init mtk_timer_init(struct
 
 	/* Configure clock event */
 	mtk_timer_setup(evt, GPT_CLK_EVT, TIMER_CTRL_OP_REPEAT);
-	mtk_timer_enable_irq(evt, GPT_CLK_EVT);
-
 	clockevents_config_and_register(&evt->dev, rate, 0x3,
 					0xffffffff);
+
+	mtk_timer_enable_irq(evt, GPT_CLK_EVT);
+
 	return;
 
 err_clk_disable:
Index: linux-3.18.13-rt10-r7s4/drivers/clocksource/time-efm32.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clocksource/time-efm32.c
+++ linux-3.18.13-rt10-r7s4/drivers/clocksource/time-efm32.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:228 @ static int __init efm32_clockevent_init(
 	clock_event_ddata.base = base;
 	clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ);
 
-	setup_irq(irq, &efm32_clock_event_irq);
-
 	clockevents_config_and_register(&clock_event_ddata.evtdev,
 					DIV_ROUND_CLOSEST(rate, 1024),
 					0xf, 0xffff);
 
+	setup_irq(irq, &efm32_clock_event_irq);
+
 	return 0;
 
 err_get_irq:
Index: linux-3.18.13-rt10-r7s4/drivers/clocksource/timer-sun5i.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/clocksource/timer-sun5i.c
+++ linux-3.18.13-rt10-r7s4/drivers/clocksource/timer-sun5i.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:181 @ static void __init sun5i_timer_init(stru
 
 	ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
 
-	ret = setup_irq(irq, &sun5i_timer_irq);
-	if (ret)
-		pr_warn("failed to setup irq %d\n", irq);
-
 	/* Enable timer0 interrupt */
 	val = readl(timer_base + TIMER_IRQ_EN_REG);
 	writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:190 @ static void __init sun5i_timer_init(stru
 
 	clockevents_config_and_register(&sun5i_clockevent, rate,
 					TIMER_SYNC_TICKS, 0xffffffff);
+
+	ret = setup_irq(irq, &sun5i_timer_irq);
+	if (ret)
+		pr_warn("failed to setup irq %d\n", irq);
 }
 CLOCKSOURCE_OF_DECLARE(sun5i_a13, "allwinner,sun5i-a13-hstimer",
 		       sun5i_timer_init);
Index: linux-3.18.13-rt10-r7s4/drivers/cpufreq/cpufreq.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/cpufreq/cpufreq.c
+++ linux-3.18.13-rt10-r7s4/drivers/cpufreq/cpufreq.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1412 @ static int __cpufreq_remove_dev_finish(s
 	unsigned long flags;
 	struct cpufreq_policy *policy;
 
-	read_lock_irqsave(&cpufreq_driver_lock, flags);
+	write_lock_irqsave(&cpufreq_driver_lock, flags);
 	policy = per_cpu(cpufreq_cpu_data, cpu);
-	read_unlock_irqrestore(&cpufreq_driver_lock, flags);
+	per_cpu(cpufreq_cpu_data, cpu) = NULL;
+	write_unlock_irqrestore(&cpufreq_driver_lock, flags);
 
 	if (!policy) {
 		pr_debug("%s: No cpu_data found\n", __func__);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1470 @ static int __cpufreq_remove_dev_finish(s
 		}
 	}
 
-	per_cpu(cpufreq_cpu_data, cpu) = NULL;
 	return 0;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1720 @ void cpufreq_resume(void)
 		    || __cpufreq_governor(policy, CPUFREQ_GOV_LIMITS))
 			pr_err("%s: Failed to start governor for policy: %p\n",
 				__func__, policy);
-
-		/*
-		 * schedule call cpufreq_update_policy() for boot CPU, i.e. last
-		 * policy in list. It will verify that the current freq is in
-		 * sync with what we believe it to be.
-		 */
-		if (list_is_last(&policy->policy_list, &cpufreq_policy_list))
-			schedule_work(&policy->update);
 	}
+
+	/*
+	 * schedule call cpufreq_update_policy() for first-online CPU, as that
+	 * wouldn't be hotplugged-out on suspend. It will verify that the
+	 * current freq is in sync with what we believe it to be.
+	 */
+	policy = cpufreq_cpu_get_raw(cpumask_first(cpu_online_mask));
+	if (WARN_ON(!policy))
+		return;
+
+	schedule_work(&policy->update);
 }
 
 /**
Index: linux-3.18.13-rt10-r7s4/drivers/cpufreq/s3c2416-cpufreq.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/cpufreq/s3c2416-cpufreq.c
+++ linux-3.18.13-rt10-r7s4/drivers/cpufreq/s3c2416-cpufreq.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:266 @ out:
 }
 
 #ifdef CONFIG_ARM_S3C2416_CPUFREQ_VCORESCALE
-static void __init s3c2416_cpufreq_cfg_regulator(struct s3c2416_data *s3c_freq)
+static void s3c2416_cpufreq_cfg_regulator(struct s3c2416_data *s3c_freq)
 {
 	int count, v, i, found;
 	struct cpufreq_frequency_table *pos;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:336 @ static struct notifier_block s3c2416_cpu
 	.notifier_call = s3c2416_cpufreq_reboot_notifier_evt,
 };
 
-static int __init s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy)
+static int s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy)
 {
 	struct s3c2416_data *s3c_freq = &s3c2416_cpufreq;
 	struct cpufreq_frequency_table *pos;
Index: linux-3.18.13-rt10-r7s4/drivers/cpufreq/s3c24xx-cpufreq.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/cpufreq/s3c24xx-cpufreq.c
+++ linux-3.18.13-rt10-r7s4/drivers/cpufreq/s3c24xx-cpufreq.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:147 @ static void s3c_cpufreq_setfvco(struct s
 	(cfg->info->set_fvco)(cfg);
 }
 
-static inline void s3c_cpufreq_resume_clocks(void)
-{
-	cpu_cur.info->resume_clocks();
-}
-
 static inline void s3c_cpufreq_updateclk(struct clk *clk,
 					 unsigned int freq)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:415 @ static int s3c_cpufreq_resume(struct cpu
 
 	last_target = ~0;	/* invalidate last_target setting */
 
-	/* first, find out what speed we resumed at. */
-	s3c_cpufreq_resume_clocks();
-
 	/* whilst we will be called later on, we try and re-set the
 	 * cpu frequencies as soon as possible so that we do not end
 	 * up resuming devices and then immediately having to re-set
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:449 @ static struct cpufreq_driver s3c24xx_dri
 };
 
 
-int __init s3c_cpufreq_register(struct s3c_cpufreq_info *info)
+int s3c_cpufreq_register(struct s3c_cpufreq_info *info)
 {
 	if (!info || !info->name) {
 		printk(KERN_ERR "%s: failed to pass valid information\n",
Index: linux-3.18.13-rt10-r7s4/drivers/cpufreq/speedstep-lib.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/cpufreq/speedstep-lib.c
+++ linux-3.18.13-rt10-r7s4/drivers/cpufreq/speedstep-lib.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:403 @ unsigned int speedstep_get_freqs(enum sp
 
 	pr_debug("previous speed is %u\n", prev_speed);
 
+	preempt_disable();
 	local_irq_save(flags);
 
 	/* switch to low state */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:468 @ unsigned int speedstep_get_freqs(enum sp
 
 out:
 	local_irq_restore(flags);
+	preempt_enable();
+
 	return ret;
 }
 EXPORT_SYMBOL_GPL(speedstep_get_freqs);
Index: linux-3.18.13-rt10-r7s4/drivers/cpufreq/speedstep-smi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/cpufreq/speedstep-smi.c
+++ linux-3.18.13-rt10-r7s4/drivers/cpufreq/speedstep-smi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:159 @ static void speedstep_set_state(unsigned
 		return;
 
 	/* Disable IRQs */
+	preempt_disable();
 	local_irq_save(flags);
 
 	command = (smi_sig & 0xffffff00) | (smi_cmd & 0xff);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:170 @ static void speedstep_set_state(unsigned
 
 	do {
 		if (retry) {
+			/*
+			 * We need to enable interrupts, otherwise the blockage
+			 * won't resolve.
+			 *
+			 * We disable preemption so that other processes don't
+			 * run. If other processes were running, they could
+			 * submit more DMA requests, making the blockage worse.
+			 */
 			pr_debug("retry %u, previous result %u, waiting...\n",
 					retry, result);
+			local_irq_enable();
 			mdelay(retry * 50);
+			local_irq_disable();
 		}
 		retry++;
 		__asm__ __volatile__(
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:199 @ static void speedstep_set_state(unsigned
 
 	/* enable IRQs */
 	local_irq_restore(flags);
+	preempt_enable();
 
 	if (new_state == state)
 		pr_debug("change to %u MHz succeeded after %u tries "
Index: linux-3.18.13-rt10-r7s4/drivers/cpuidle/cpuidle-mvebu-v7.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/cpuidle/cpuidle-mvebu-v7.c
+++ linux-3.18.13-rt10-r7s4/drivers/cpuidle/cpuidle-mvebu-v7.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:40 @ static int mvebu_v7_enter_idle(struct cp
 		deepidle = true;
 
 	ret = mvebu_v7_cpu_suspend(deepidle);
+	cpu_pm_exit();
+
 	if (ret)
 		return ret;
 
-	cpu_pm_exit();
-
 	return index;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/cpuidle/cpuidle.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/cpuidle/cpuidle.c
+++ linux-3.18.13-rt10-r7s4/drivers/cpuidle/cpuidle.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:300 @ int cpuidle_enable_device(struct cpuidle
 	if (!dev->registered)
 		return -EINVAL;
 
-	if (!dev->state_count)
-		dev->state_count = drv->state_count;
-
 	ret = cpuidle_add_device_sysfs(dev);
 	if (ret)
 		return ret;
Index: linux-3.18.13-rt10-r7s4/drivers/cpuidle/sysfs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/cpuidle/sysfs.c
+++ linux-3.18.13-rt10-r7s4/drivers/cpuidle/sysfs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:404 @ static int cpuidle_add_state_sysfs(struc
 	struct cpuidle_driver *drv = cpuidle_get_cpu_driver(device);
 
 	/* state statistics */
-	for (i = 0; i < device->state_count; i++) {
+	for (i = 0; i < drv->state_count; i++) {
 		kobj = kzalloc(sizeof(struct cpuidle_state_kobj), GFP_KERNEL);
 		if (!kobj)
 			goto error_state;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:436 @ error_state:
  */
 static void cpuidle_remove_state_sysfs(struct cpuidle_device *device)
 {
+	struct cpuidle_driver *drv = cpuidle_get_cpu_driver(device);
 	int i;
 
-	for (i = 0; i < device->state_count; i++)
+	for (i = 0; i < drv->state_count; i++)
 		cpuidle_free_state_kobj(device, i);
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/crypto/padlock-aes.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/crypto/padlock-aes.c
+++ linux-3.18.13-rt10-r7s4/drivers/crypto/padlock-aes.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:566 @ MODULE_DESCRIPTION("VIA PadLock AES algo
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Michal Ludvig");
 
-MODULE_ALIAS("aes");
+MODULE_ALIAS_CRYPTO("aes");
Index: linux-3.18.13-rt10-r7s4/drivers/crypto/padlock-sha.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/crypto/padlock-sha.c
+++ linux-3.18.13-rt10-r7s4/drivers/crypto/padlock-sha.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:596 @ MODULE_DESCRIPTION("VIA PadLock SHA1/SHA
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Michal Ludvig");
 
-MODULE_ALIAS("sha1-all");
-MODULE_ALIAS("sha256-all");
-MODULE_ALIAS("sha1-padlock");
-MODULE_ALIAS("sha256-padlock");
+MODULE_ALIAS_CRYPTO("sha1-all");
+MODULE_ALIAS_CRYPTO("sha256-all");
+MODULE_ALIAS_CRYPTO("sha1-padlock");
+MODULE_ALIAS_CRYPTO("sha256-padlock");
Index: linux-3.18.13-rt10-r7s4/drivers/crypto/qat/qat_common/adf_ctl_drv.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/crypto/qat/qat_common/adf_ctl_drv.c
+++ linux-3.18.13-rt10-r7s4/drivers/crypto/qat/qat_common/adf_ctl_drv.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:55 @
 #include <linux/pci.h>
 #include <linux/cdev.h>
 #include <linux/uaccess.h>
+#include <linux/crypto.h>
 
 #include "adf_accel_devices.h"
 #include "adf_common_drv.h"
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:491 @ module_exit(adf_unregister_ctl_device_dr
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Intel");
 MODULE_DESCRIPTION("Intel(R) QuickAssist Technology");
-MODULE_ALIAS("intel_qat");
+MODULE_ALIAS_CRYPTO("intel_qat");
Index: linux-3.18.13-rt10-r7s4/drivers/crypto/ux500/cryp/cryp_core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/crypto/ux500/cryp/cryp_core.c
+++ linux-3.18.13-rt10-r7s4/drivers/crypto/ux500/cryp/cryp_core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1813 @ module_exit(ux500_cryp_mod_fini);
 module_param(cryp_mode, int, 0);
 
 MODULE_DESCRIPTION("Driver for ST-Ericsson UX500 CRYP crypto engine.");
-MODULE_ALIAS("aes-all");
-MODULE_ALIAS("des-all");
+MODULE_ALIAS_CRYPTO("aes-all");
+MODULE_ALIAS_CRYPTO("des-all");
 
 MODULE_LICENSE("GPL");
Index: linux-3.18.13-rt10-r7s4/drivers/crypto/ux500/hash/hash_core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/crypto/ux500/hash/hash_core.c
+++ linux-3.18.13-rt10-r7s4/drivers/crypto/ux500/hash/hash_core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1998 @ module_exit(ux500_hash_mod_fini);
 MODULE_DESCRIPTION("Driver for ST-Ericsson UX500 HASH engine.");
 MODULE_LICENSE("GPL");
 
-MODULE_ALIAS("sha1-all");
-MODULE_ALIAS("sha256-all");
-MODULE_ALIAS("hmac-sha1-all");
-MODULE_ALIAS("hmac-sha256-all");
+MODULE_ALIAS_CRYPTO("sha1-all");
+MODULE_ALIAS_CRYPTO("sha256-all");
+MODULE_ALIAS_CRYPTO("hmac-sha1-all");
+MODULE_ALIAS_CRYPTO("hmac-sha256-all");
Index: linux-3.18.13-rt10-r7s4/drivers/dma-buf/reservation.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/dma-buf/reservation.c
+++ linux-3.18.13-rt10-r7s4/drivers/dma-buf/reservation.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:405 @ reservation_object_test_signaled_single(
 	int ret = 1;
 
 	if (!test_bit(FENCE_FLAG_SIGNALED_BIT, &lfence->flags)) {
-		int ret;
-
 		fence = fence_get_rcu(lfence);
 		if (!fence)
 			return -1;
Index: linux-3.18.13-rt10-r7s4/drivers/dma/dw/platform.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/dma/dw/platform.c
+++ linux-3.18.13-rt10-r7s4/drivers/dma/dw/platform.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:28 @
 
 #include "internal.h"
 
+#define DRV_NAME	"dw_dmac"
+
 static struct dma_chan *dw_dma_of_xlate(struct of_phandle_args *dma_spec,
 					struct of_dma *ofdma)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:284 @ static struct platform_driver dw_driver
 	.remove		= dw_remove,
 	.shutdown       = dw_shutdown,
 	.driver = {
-		.name	= "dw_dmac",
+		.name	= DRV_NAME,
 		.pm	= &dw_dev_pm_ops,
 		.of_match_table = of_match_ptr(dw_dma_of_id_table),
 		.acpi_match_table = ACPI_PTR(dw_dma_acpi_id_table),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:305 @ module_exit(dw_exit);
 
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("Synopsys DesignWare DMA Controller platform driver");
+MODULE_ALIAS("platform:" DRV_NAME);
Index: linux-3.18.13-rt10-r7s4/drivers/dma/edma.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/dma/edma.c
+++ linux-3.18.13-rt10-r7s4/drivers/dma/edma.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:261 @ static int edma_terminate_all(struct edm
 	 */
 	if (echan->edesc) {
 		int cyclic = echan->edesc->cyclic;
+
+		/*
+		 * free the running request descriptor
+		 * since it is not in any of the vdesc lists
+		 */
+		edma_desc_free(&echan->edesc->vdesc);
+
 		echan->edesc = NULL;
 		edma_stop(echan->ch_num);
 		/* Move the cyclic channel back to default queue */
Index: linux-3.18.13-rt10-r7s4/drivers/dma/omap-dma.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/dma/omap-dma.c
+++ linux-3.18.13-rt10-r7s4/drivers/dma/omap-dma.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:981 @ static int omap_dma_terminate_all(struct
 	 * c->desc is NULL and exit.)
 	 */
 	if (c->desc) {
+		omap_dma_desc_free(&c->desc->vd);
 		c->desc = NULL;
 		/* Avoid stopping the dma twice */
 		if (!c->paused)
Index: linux-3.18.13-rt10-r7s4/drivers/edac/amd64_edac.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/edac/amd64_edac.c
+++ linux-3.18.13-rt10-r7s4/drivers/edac/amd64_edac.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2042 @ static void __log_bus_error(struct mem_c
 
 static inline void decode_bus_error(int node_id, struct mce *m)
 {
-	struct mem_ctl_info *mci = mcis[node_id];
-	struct amd64_pvt *pvt = mci->pvt_info;
+	struct mem_ctl_info *mci;
+	struct amd64_pvt *pvt;
 	u8 ecc_type = (m->status >> 45) & 0x3;
 	u8 xec = XEC(m->status, 0x1f);
 	u16 ec = EC(m->status);
 	u64 sys_addr;
 	struct err_info err;
 
+	mci = edac_mc_find(node_id);
+	if (!mci)
+		return;
+
+	pvt = mci->pvt_info;
+
 	/* Bail out early if this was an 'observed' error */
 	if (PP(ec) == NBSL_PP_OBS)
 		return;
Index: linux-3.18.13-rt10-r7s4/drivers/edac/sb_edac.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/edac/sb_edac.c
+++ linux-3.18.13-rt10-r7s4/drivers/edac/sb_edac.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:138 @ static inline int sad_pkg(const struct i
 
 #define TOLM		0x80
 #define	TOHM		0x84
+#define HASWELL_TOLM	0xd0
 #define HASWELL_TOHM_0	0xd4
 #define HASWELL_TOHM_1	0xd8
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:710 @ static u64 haswell_get_tolm(struct sbrid
 {
 	u32 reg;
 
-	pci_read_config_dword(pvt->info.pci_vtd, TOLM, &reg);
-	return (GET_BITFIELD(reg, 26, 31) << 26) | 0x1ffffff;
+	pci_read_config_dword(pvt->info.pci_vtd, HASWELL_TOLM, &reg);
+	return (GET_BITFIELD(reg, 26, 31) << 26) | 0x3ffffff;
 }
 
 static u64 haswell_get_tohm(struct sbridge_pvt *pvt)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:852 @ static int get_dimm_config(struct mem_ct
 	else
 		edac_dbg(0, "Memory is unregistered\n");
 
-	if (mtype == MEM_DDR4 || MEM_RDDR4)
+	if (mtype == MEM_DDR4 || mtype == MEM_RDDR4)
 		banks = 16;
 	else
 		banks = 8;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2301 @ static int sbridge_probe(struct pci_dev
 		rc = sbridge_get_all_devices(&num_mc, pci_dev_descr_ibridge_table);
 		type = IVY_BRIDGE;
 		break;
-	case PCI_DEVICE_ID_INTEL_SBRIDGE_IMC_TA:
+	case PCI_DEVICE_ID_INTEL_SBRIDGE_IMC_HA0:
 		rc = sbridge_get_all_devices(&num_mc, pci_dev_descr_sbridge_table);
 		type = SANDY_BRIDGE;
 		break;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2310 @ static int sbridge_probe(struct pci_dev
 		type = HASWELL;
 		break;
 	}
-	if (unlikely(rc < 0))
+	if (unlikely(rc < 0)) {
+		edac_dbg(0, "couldn't get all devices for 0x%x\n", pdev->device);
 		goto fail0;
+	}
+
 	mc = 0;
 
 	list_for_each_entry(sbridge_dev, &sbridge_edac_list, list) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2327 @ static int sbridge_probe(struct pci_dev
 			goto fail1;
 	}
 
-	sbridge_printk(KERN_INFO, "Driver loaded.\n");
+	sbridge_printk(KERN_INFO, "%s\n", SBRIDGE_REVISION);
 
 	mutex_unlock(&sbridge_edac_lock);
 	return 0;
Index: linux-3.18.13-rt10-r7s4/drivers/firmware/efi/libstub/efi-stub-helper.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ linux-3.18.13-rt10-r7s4/drivers/firmware/efi/libstub/efi-stub-helper.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:173 @ again:
 		start = desc->phys_addr;
 		end = start + desc->num_pages * (1UL << EFI_PAGE_SHIFT);
 
-		if ((start + size) > end || (start + size) > max)
-			continue;
-
-		if (end - size > max)
+		if (end > max)
 			end = max;
 
+		if ((start + size) > end)
+			continue;
+
 		if (round_down(end - size, align) < start)
 			continue;
 
Index: linux-3.18.13-rt10-r7s4/drivers/firmware/efi/runtime-map.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/firmware/efi/runtime-map.c
+++ linux-3.18.13-rt10-r7s4/drivers/firmware/efi/runtime-map.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:194 @ int __init efi_runtime_map_init(struct k
 
 	return 0;
 out_add_entry:
-	for (j = i - 1; j > 0; j--) {
+	for (j = i - 1; j >= 0; j--) {
 		entry = *(map_entries + j);
 		kobject_put(&entry->kobj);
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/gpio/gpio-crystalcove.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpio/gpio-crystalcove.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpio/gpio-crystalcove.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:275 @ static irqreturn_t crystalcove_gpio_irq_
 	for (gpio = 0; gpio < CRYSTALCOVE_GPIO_NUM; gpio++) {
 		if (pending & BIT(gpio)) {
 			virq = irq_find_mapping(cg->chip.irqdomain, gpio);
-			generic_handle_irq(virq);
+			handle_nested_irq(virq);
 		}
 	}
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpio/gpio-mcp23s08.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpio/gpio-mcp23s08.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpio/gpio-mcp23s08.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:788 @ static int mcp230xx_probe(struct i2c_cli
 		client->irq = irq_of_parse_and_map(client->dev.of_node, 0);
 	} else {
 		pdata = dev_get_platdata(&client->dev);
-		if (!pdata || !gpio_is_valid(pdata->base)) {
-			dev_dbg(&client->dev, "invalid platform data\n");
-			return -EINVAL;
+		if (!pdata) {
+			pdata = devm_kzalloc(&client->dev,
+					sizeof(struct mcp23s08_platform_data),
+					GFP_KERNEL);
+			pdata->base = -1;
 		}
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:913 @ static int mcp23s08_probe(struct spi_dev
 	} else {
 		type = spi_get_device_id(spi)->driver_data;
 		pdata = dev_get_platdata(&spi->dev);
-		if (!pdata || !gpio_is_valid(pdata->base)) {
-			dev_dbg(&spi->dev,
-					"invalid or missing platform data\n");
-			return -EINVAL;
+		if (!pdata) {
+			pdata = devm_kzalloc(&spi->dev,
+					sizeof(struct mcp23s08_platform_data),
+					GFP_KERNEL);
+			pdata->base = -1;
 		}
 
 		for (addr = 0; addr < ARRAY_SIZE(pdata->chip); addr++) {
Index: linux-3.18.13-rt10-r7s4/drivers/gpio/gpio-tps65912.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpio/gpio-tps65912.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpio/gpio-tps65912.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:29 @ struct tps65912_gpio_data {
 	struct gpio_chip gpio_chip;
 };
 
+#define to_tgd(gc) container_of(gc, struct tps65912_gpio_data, gpio_chip)
+
 static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset)
 {
-	struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
+	struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
+	struct tps65912 *tps65912 = tps65912_gpio->tps65912;
 	int val;
 
 	val = tps65912_reg_read(tps65912, TPS65912_GPIO1 + offset);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:48 @ static int tps65912_gpio_get(struct gpio
 static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset,
 			      int value)
 {
-	struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
+	struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
+	struct tps65912 *tps65912 = tps65912_gpio->tps65912;
 
 	if (value)
 		tps65912_set_bits(tps65912, TPS65912_GPIO1 + offset,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:62 @ static void tps65912_gpio_set(struct gpi
 static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset,
 				int value)
 {
-	struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
+	struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
+	struct tps65912 *tps65912 = tps65912_gpio->tps65912;
 
 	/* Set the initial value */
 	tps65912_gpio_set(gc, offset, value);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:74 @ static int tps65912_gpio_output(struct g
 
 static int tps65912_gpio_input(struct gpio_chip *gc, unsigned offset)
 {
-	struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
+	struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
+	struct tps65912 *tps65912 = tps65912_gpio->tps65912;
 
 	return tps65912_clear_bits(tps65912, TPS65912_GPIO1 + offset,
 								GPIO_CFG_MASK);
Index: linux-3.18.13-rt10-r7s4/drivers/gpio/gpiolib-of.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpio/gpiolib-of.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpio/gpiolib-of.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:48 @ static int of_gpiochip_find_and_xlate(st
 		return false;
 
 	ret = gc->of_xlate(gc, &gg_data->gpiospec, gg_data->flags);
-	if (ret < 0)
+	if (ret < 0) {
+		/* We've found a gpio chip, but the translation failed.
+		 * Store translation error in out_gpio.
+		 * Return false to keep looking, as more than one gpio chip
+		 * could be registered per of-node.
+		 */
+		gg_data->out_gpio = ERR_PTR(ret);
 		return false;
+	 }
 
 	gg_data->out_gpio = gpiochip_get_desc(gc, ret);
 	return true;
Index: linux-3.18.13-rt10-r7s4/drivers/gpio/gpiolib-sysfs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpio/gpiolib-sysfs.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpio/gpiolib-sysfs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:131 @ static ssize_t gpio_value_store(struct d
 	return status;
 }
 
-static const DEVICE_ATTR(value, 0644,
+static DEVICE_ATTR(value, 0644,
 		gpio_value_show, gpio_value_store);
 
 static irqreturn_t gpio_sysfs_irq(int irq, void *priv)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:356 @ static ssize_t gpio_active_low_store(str
 	return status ? : size;
 }
 
-static const DEVICE_ATTR(active_low, 0644,
+static DEVICE_ATTR(active_low, 0644,
 		gpio_active_low_show, gpio_active_low_store);
 
-static const struct attribute *gpio_attrs[] = {
+static struct attribute *gpio_attrs[] = {
 	&dev_attr_value.attr,
 	&dev_attr_active_low.attr,
 	NULL,
 };
-
-static const struct attribute_group gpio_attr_group = {
-	.attrs = (struct attribute **) gpio_attrs,
-};
+ATTRIBUTE_GROUPS(gpio);
 
 /*
  * /sys/class/gpio/gpiochipN/
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:400 @ static ssize_t chip_ngpio_show(struct de
 }
 static DEVICE_ATTR(ngpio, 0444, chip_ngpio_show, NULL);
 
-static const struct attribute *gpiochip_attrs[] = {
+static struct attribute *gpiochip_attrs[] = {
 	&dev_attr_base.attr,
 	&dev_attr_label.attr,
 	&dev_attr_ngpio.attr,
 	NULL,
 };
-
-static const struct attribute_group gpiochip_attr_group = {
-	.attrs = (struct attribute **) gpiochip_attrs,
-};
+ATTRIBUTE_GROUPS(gpiochip);
 
 /*
  * /sys/class/gpio/export ... write-only
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:561 @ int gpiod_export(struct gpio_desc *desc,
 	if (desc->chip->names && desc->chip->names[offset])
 		ioname = desc->chip->names[offset];
 
-	dev = device_create(&gpio_class, desc->chip->dev, MKDEV(0, 0),
-			    desc, ioname ? ioname : "gpio%u",
-			    desc_to_gpio(desc));
+	dev = device_create_with_groups(&gpio_class, desc->chip->dev,
+					MKDEV(0, 0), desc, gpio_groups,
+					ioname ? ioname : "gpio%u",
+					desc_to_gpio(desc));
 	if (IS_ERR(dev)) {
 		status = PTR_ERR(dev);
 		goto fail_unlock;
 	}
 
-	status = sysfs_create_group(&dev->kobj, &gpio_attr_group);
-	if (status)
-		goto fail_unregister_device;
-
 	if (direction_may_change) {
 		status = device_create_file(dev, &dev_attr_direction);
 		if (status)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:580 @ int gpiod_export(struct gpio_desc *desc,
 				       !test_bit(FLAG_IS_OUT, &desc->flags))) {
 		status = device_create_file(dev, &dev_attr_edge);
 		if (status)
-			goto fail_unregister_device;
+			goto fail_remove_attr_direction;
 	}
 
 	set_bit(FLAG_EXPORT, &desc->flags);
 	mutex_unlock(&sysfs_lock);
 	return 0;
 
+fail_remove_attr_direction:
+	device_remove_file(dev, &dev_attr_direction);
 fail_unregister_device:
 	device_unregister(dev);
 fail_unlock:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:633 @ int gpiod_export_link(struct device *dev
 		if (tdev != NULL) {
 			status = sysfs_create_link(&dev->kobj, &tdev->kobj,
 						name);
+			put_device(tdev);
 		} else {
 			status = -ENODEV;
 		}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:681 @ int gpiod_sysfs_set_active_low(struct gp
 	}
 
 	status = sysfs_set_active_low(desc, dev, value);
-
+	put_device(dev);
 unlock:
 	mutex_unlock(&sysfs_lock);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:723 @ void gpiod_unexport(struct gpio_desc *de
 	mutex_unlock(&sysfs_lock);
 
 	if (dev) {
+		device_remove_file(dev, &dev_attr_edge);
+		device_remove_file(dev, &dev_attr_direction);
 		device_unregister(dev);
 		put_device(dev);
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:749 @ int gpiochip_export(struct gpio_chip *ch
 
 	/* use chip->base for the ID; it's already known to be unique */
 	mutex_lock(&sysfs_lock);
-	dev = device_create(&gpio_class, chip->dev, MKDEV(0, 0), chip,
-				"gpiochip%d", chip->base);
-	if (!IS_ERR(dev)) {
-		status = sysfs_create_group(&dev->kobj,
-				&gpiochip_attr_group);
-	} else
+	dev = device_create_with_groups(&gpio_class, chip->dev, MKDEV(0, 0),
+					chip, gpiochip_groups,
+					"gpiochip%d", chip->base);
+	if (IS_ERR(dev))
 		status = PTR_ERR(dev);
+	else
+		status = 0;
 	chip->exported = (status == 0);
 	mutex_unlock(&sysfs_lock);
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpio/gpiolib.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpio/gpiolib.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpio/gpiolib.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:271 @ int gpiochip_add(struct gpio_chip *chip)
 
 	spin_unlock_irqrestore(&gpio_lock, flags);
 
+	if (status)
+		goto fail;
+
 #ifdef CONFIG_PINCTRL
 	INIT_LIST_HEAD(&chip->pin_ranges);
 #endif
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:281 @ int gpiochip_add(struct gpio_chip *chip)
 	of_gpiochip_add(chip);
 	acpi_gpiochip_add(chip);
 
-	if (status)
-		goto fail;
-
 	status = gpiochip_export(chip);
-	if (status)
+	if (status) {
+		acpi_gpiochip_remove(chip);
+		of_gpiochip_remove(chip);
 		goto fail;
+	}
 
 	pr_debug("%s: registered GPIOs %d to %d on device: %s\n", __func__,
 		chip->base, chip->base + chip->ngpio - 1,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:319 @ void gpiochip_remove(struct gpio_chip *c
 	unsigned long	flags;
 	unsigned	id;
 
-	acpi_gpiochip_remove(chip);
-
-	spin_lock_irqsave(&gpio_lock, flags);
-
 	gpiochip_irqchip_remove(chip);
+
+	acpi_gpiochip_remove(chip);
 	gpiochip_remove_pin_ranges(chip);
 	of_gpiochip_remove(chip);
 
+	spin_lock_irqsave(&gpio_lock, flags);
 	for (id = 0; id < chip->ngpio; id++) {
 		if (test_bit(FLAG_REQUESTED, &chip->desc[id].flags))
 			dev_crit(chip->dev, "REMOVING GPIOCHIP WITH GPIOS STILL REQUESTED\n");
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/drm_crtc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/drm_crtc.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/drm_crtc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:45 @
 #include "drm_crtc_internal.h"
 #include "drm_internal.h"
 
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
-							struct drm_mode_fb_cmd2 *r,
-							struct drm_file *file_priv);
+static struct drm_framebuffer *
+internal_framebuffer_create(struct drm_device *dev,
+			    struct drm_mode_fb_cmd2 *r,
+			    struct drm_file *file_priv);
 
 /* Avoid boilerplate.  I'm tired of typing. */
 #define DRM_ENUM_NAME_FN(fnname, list)				\
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:534 @ void drm_framebuffer_reference(struct dr
 }
 EXPORT_SYMBOL(drm_framebuffer_reference);
 
-static void drm_framebuffer_free_bug(struct kref *kref)
-{
-	BUG();
-}
-
-static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
-{
-	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
-	kref_put(&fb->refcount, drm_framebuffer_free_bug);
-}
-
 /**
  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
  * @fb: fb to unregister
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1324 @ void drm_plane_force_disable(struct drm_
 		return;
 	}
 	/* disconnect the plane from the fb and crtc: */
-	__drm_framebuffer_unreference(plane->old_fb);
+	drm_framebuffer_unreference(plane->old_fb);
 	plane->old_fb = NULL;
 	plane->fb = NULL;
 	plane->crtc = NULL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2767 @ static int drm_mode_cursor_universal(str
 	 */
 	if (req->flags & DRM_MODE_CURSOR_BO) {
 		if (req->handle) {
-			fb = add_framebuffer_internal(dev, &fbreq, file_priv);
+			fb = internal_framebuffer_create(dev, &fbreq, file_priv);
 			if (IS_ERR(fb)) {
 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
 				return PTR_ERR(fb);
 			}
-
-			drm_framebuffer_reference(fb);
 		} else {
 			fb = NULL;
 		}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3140 @ static int framebuffer_check(const struc
 	return 0;
 }
 
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
-							struct drm_mode_fb_cmd2 *r,
-							struct drm_file *file_priv)
+static struct drm_framebuffer *
+internal_framebuffer_create(struct drm_device *dev,
+			    struct drm_mode_fb_cmd2 *r,
+			    struct drm_file *file_priv)
 {
 	struct drm_mode_config *config = &dev->mode_config;
 	struct drm_framebuffer *fb;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3175 @ static struct drm_framebuffer *add_frame
 		return fb;
 	}
 
-	mutex_lock(&file_priv->fbs_lock);
-	r->fb_id = fb->base.id;
-	list_add(&fb->filp_head, &file_priv->fbs);
-	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
-	mutex_unlock(&file_priv->fbs_lock);
-
 	return fb;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3196 @ static struct drm_framebuffer *add_frame
 int drm_mode_addfb2(struct drm_device *dev,
 		    void *data, struct drm_file *file_priv)
 {
+	struct drm_mode_fb_cmd2 *r = data;
 	struct drm_framebuffer *fb;
 
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
 
-	fb = add_framebuffer_internal(dev, data, file_priv);
+	fb = internal_framebuffer_create(dev, r, file_priv);
 	if (IS_ERR(fb))
 		return PTR_ERR(fb);
 
+	/* Transfer ownership to the filp for reaping on close */
+
+	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
+	mutex_lock(&file_priv->fbs_lock);
+	r->fb_id = fb->base.id;
+	list_add(&fb->filp_head, &file_priv->fbs);
+	mutex_unlock(&file_priv->fbs_lock);
+
 	return 0;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/drm_dp_helper.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/drm_dp_helper.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/drm_dp_helper.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:381 @ static int drm_dp_dpcd_access(struct drm
 
 	/*
 	 * The specification doesn't give any recommendation on how often to
-	 * retry native transactions, so retry 7 times like for I2C-over-AUX
-	 * transactions.
+	 * retry native transactions. We used to retry 7 times like for
+	 * aux i2c transactions but real world devices this wasn't
+	 * sufficient, bump to 32 which makes Dell 4k monitors happier.
 	 */
-	for (retry = 0; retry < 7; retry++) {
+	for (retry = 0; retry < 32; retry++) {
 
 		mutex_lock(&aux->hw_mutex);
 		err = aux->transfer(aux, &msg);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/drm_dp_mst_topology.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/drm_dp_mst_topology.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/drm_dp_mst_topology.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:842 @ static void drm_dp_put_mst_branch_device
 
 static void drm_dp_port_teardown_pdt(struct drm_dp_mst_port *port, int old_pdt)
 {
+	struct drm_dp_mst_branch *mstb;
+
 	switch (old_pdt) {
 	case DP_PEER_DEVICE_DP_LEGACY_CONV:
 	case DP_PEER_DEVICE_SST_SINK:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:851 @ static void drm_dp_port_teardown_pdt(str
 		drm_dp_mst_unregister_i2c_bus(&port->aux);
 		break;
 	case DP_PEER_DEVICE_MST_BRANCHING:
-		drm_dp_put_mst_branch_device(port->mstb);
+		mstb = port->mstb;
 		port->mstb = NULL;
+		drm_dp_put_mst_branch_device(mstb);
 		break;
 	}
 }
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/drm_edid_load.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/drm_edid_load.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/drm_edid_load.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:291 @ int drm_load_edid_firmware(struct drm_co
 
 	drm_mode_connector_update_edid_property(connector, edid);
 	ret = drm_add_edid_modes(connector, edid);
+	drm_edid_to_eld(connector, edid);
 	kfree(edid);
 
 	return ret;
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/drm_fb_helper.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/drm_fb_helper.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/drm_fb_helper.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:148 @ int drm_fb_helper_add_one_connector(stru
 }
 EXPORT_SYMBOL(drm_fb_helper_add_one_connector);
 
+static void remove_from_modeset(struct drm_mode_set *set,
+		struct drm_connector *connector)
+{
+	int i, j;
+
+	for (i = 0; i < set->num_connectors; i++) {
+		if (set->connectors[i] == connector)
+			break;
+	}
+
+	if (i == set->num_connectors)
+		return;
+
+	for (j = i + 1; j < set->num_connectors; j++) {
+		set->connectors[j - 1] = set->connectors[j];
+	}
+	set->num_connectors--;
+
+	/* because i915 is pissy about this..
+	 * TODO maybe need to makes sure we set it back to !=NULL somewhere?
+	 */
+	if (set->num_connectors == 0)
+		set->fb = NULL;
+}
+
 int drm_fb_helper_remove_one_connector(struct drm_fb_helper *fb_helper,
 				       struct drm_connector *connector)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:195 @ int drm_fb_helper_remove_one_connector(s
 	}
 	fb_helper->connector_count--;
 	kfree(fb_helper_connector);
+
+	/* also cleanup dangling references to the connector: */
+	for (i = 0; i < fb_helper->crtc_count; i++)
+		remove_from_modeset(&fb_helper->crtc_info[i].mode_set, connector);
+
 	return 0;
 }
 EXPORT_SYMBOL(drm_fb_helper_remove_one_connector);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:380 @ bool drm_fb_helper_restore_fbdev_mode_un
 {
 	struct drm_device *dev = fb_helper->dev;
 	bool ret;
+	bool do_delayed = false;
+
 	drm_modeset_lock_all(dev);
 	ret = restore_fbdev_mode(fb_helper);
+
+	do_delayed = fb_helper->delayed_hotplug;
+	if (do_delayed)
+		fb_helper->delayed_hotplug = false;
 	drm_modeset_unlock_all(dev);
+
+	if (do_delayed)
+		drm_fb_helper_hotplug_event(fb_helper);
 	return ret;
 }
 EXPORT_SYMBOL(drm_fb_helper_restore_fbdev_mode_unlocked);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:930 @ int drm_fb_helper_set_par(struct fb_info
 
 	drm_fb_helper_restore_fbdev_mode_unlocked(fb_helper);
 
-	if (fb_helper->delayed_hotplug) {
-		fb_helper->delayed_hotplug = false;
-		drm_fb_helper_hotplug_event(fb_helper);
-	}
 	return 0;
 }
 EXPORT_SYMBOL(drm_fb_helper_set_par);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/drm_irq.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/drm_irq.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/drm_irq.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1032 @ void drm_vblank_put(struct drm_device *d
 {
 	struct drm_vblank_crtc *vblank = &dev->vblank[crtc];
 
-	BUG_ON(atomic_read(&vblank->refcount) == 0);
+	if (WARN_ON(atomic_read(&vblank->refcount) == 0))
+		return;
 
 	if (WARN_ON(crtc >= dev->num_crtcs))
 		return;
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/drm_probe_helper.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/drm_probe_helper.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/drm_probe_helper.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:154 @ static int drm_helper_probe_single_conne
 			struct edid *edid = (struct edid *) connector->edid_blob_ptr->data;
 
 			count = drm_add_edid_modes(connector, edid);
+			drm_edid_to_eld(connector, edid);
 		} else
 			count = (*connector_funcs->get_modes)(connector);
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_drv.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/i915_drv.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_drv.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:695 @ static int __i915_drm_thaw(struct drm_de
 			spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
 		}
 
-		intel_dp_mst_resume(dev);
 		drm_modeset_lock_all(dev);
 		intel_modeset_setup_hw_state(dev, true);
 		drm_modeset_unlock_all(dev);
 
+		intel_dp_mst_resume(dev);
+
 		/*
 		 * ... but also need to make sure that hotplug processing
 		 * doesn't cause havoc. Like in the driver load code we don't
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1144 @ static void vlv_save_gunit_s0ix_state(st
 	/* Gunit-Display CZ domain, 0x182028-0x1821CF */
 	s->gu_ctl0		= I915_READ(VLV_GU_CTL0);
 	s->gu_ctl1		= I915_READ(VLV_GU_CTL1);
+	s->pcbr			= I915_READ(VLV_PCBR);
 	s->clock_gate_dis2	= I915_READ(VLV_GUNIT_CLOCK_GATE2);
 
 	/*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1239 @ static void vlv_restore_gunit_s0ix_state
 	/* Gunit-Display CZ domain, 0x182028-0x1821CF */
 	I915_WRITE(VLV_GU_CTL0,			s->gu_ctl0);
 	I915_WRITE(VLV_GU_CTL1,			s->gu_ctl1);
+	I915_WRITE(VLV_PCBR,			s->pcbr);
 	I915_WRITE(VLV_GUNIT_CLOCK_GATE2,	s->clock_gate_dis2);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1248 @ int vlv_force_gfx_clock(struct drm_i915_
 	u32 val;
 	int err;
 
-	val = I915_READ(VLV_GTLC_SURVIVABILITY_REG);
-	WARN_ON(!!(val & VLV_GFX_CLK_FORCE_ON_BIT) == force_on);
-
 #define COND (I915_READ(VLV_GTLC_SURVIVABILITY_REG) & VLV_GFX_CLK_STATUS_BIT)
-	/* Wait for a previous force-off to settle */
-	if (force_on) {
-		err = wait_for(!COND, 20);
-		if (err) {
-			DRM_ERROR("timeout waiting for GFX clock force-off (%08x)\n",
-				  I915_READ(VLV_GTLC_SURVIVABILITY_REG));
-			return err;
-		}
-	}
 
 	val = I915_READ(VLV_GTLC_SURVIVABILITY_REG);
 	val &= ~VLV_GFX_CLK_FORCE_ON_BIT;
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_drv.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/i915_drv.h
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_drv.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:880 @ struct i915_suspend_saved_registers {
 	u32 savePIPEB_LINK_N1;
 	u32 saveMCHBAR_RENDER_STANDBY;
 	u32 savePCH_PORT_HOTPLUG;
+	u16 saveGCDGMBUS;
 };
 
 struct vlv_s0ix_state {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:941 @ struct vlv_s0ix_state {
 	/* Display 2 CZ domain */
 	u32 gu_ctl0;
 	u32 gu_ctl1;
+	u32 pcbr;
 	u32 clock_gate_dis2;
 };
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1670 @ struct drm_i915_private {
 	 */
 	struct workqueue_struct *dp_wq;
 
-	uint32_t bios_vgacntr;
-
 	/* Old dri1 support infrastructure, beware the dragons ya fools entering
 	 * here! */
 	struct i915_dri1_state dri1;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2080 @ struct drm_i915_cmd_table {
 #define IS_HSW_EARLY_SDV(dev)	(IS_HASWELL(dev) && \
 				 (INTEL_DEVID(dev) & 0xFF00) == 0x0C00)
 #define IS_BDW_ULT(dev)		(IS_BROADWELL(dev) && \
-				 ((INTEL_DEVID(dev) & 0xf) == 0x2  || \
-				 (INTEL_DEVID(dev) & 0xf) == 0x6 || \
+				 ((INTEL_DEVID(dev) & 0xf) == 0x6 ||	\
+				 (INTEL_DEVID(dev) & 0xf) == 0xb ||	\
 				 (INTEL_DEVID(dev) & 0xf) == 0xe))
 #define IS_HSW_ULT(dev)		(IS_HASWELL(dev) && \
 				 (INTEL_DEVID(dev) & 0xFF00) == 0x0A00)
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_gem.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/i915_gem.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_gem.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3053 @ static void i965_write_fence_reg(struct
 		u32 size = i915_gem_obj_ggtt_size(obj);
 		uint64_t val;
 
+		/* Adjust fence size to match tiled area */
+		if (obj->tiling_mode != I915_TILING_NONE) {
+			uint32_t row_size = obj->stride *
+				(obj->tiling_mode == I915_TILING_Y ? 32 : 8);
+			size = (size / row_size) * row_size;
+		}
+
 		val = (uint64_t)((i915_gem_obj_ggtt_offset(obj) + size - 4096) &
 				 0xfffff000) << 32;
 		val |= i915_gem_obj_ggtt_offset(obj) & 0xfffff000;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4203 @ i915_gem_pin_ioctl(struct drm_device *de
 	struct drm_i915_gem_object *obj;
 	int ret;
 
-	if (INTEL_INFO(dev)->gen >= 6)
+	if (drm_core_check_feature(dev, DRIVER_MODESET))
 		return -ENODEV;
 
 	ret = i915_mutex_lock_interruptible(dev);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4259 @ i915_gem_unpin_ioctl(struct drm_device *
 	struct drm_i915_gem_object *obj;
 	int ret;
 
+	if (drm_core_check_feature(dev, DRIVER_MODESET))
+		return -ENODEV;
+
 	ret = i915_mutex_lock_interruptible(dev);
 	if (ret)
 		return ret;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4821 @ i915_gem_init_hw(struct drm_device *dev)
 	for (i = 0; i < NUM_L3_SLICES(dev); i++)
 		i915_gem_l3_remap(&dev_priv->ring[RCS], i);
 
-	/*
-	 * XXX: Contexts should only be initialized once. Doing a switch to the
-	 * default context switch however is something we'd like to do after
-	 * reset or thaw (the latter may not actually be necessary for HW, but
-	 * goes with our code better). Context switching requires rings (for
-	 * the do_switch), but before enabling PPGTT. So don't move this.
-	 */
-	ret = i915_gem_context_enable(dev_priv);
+	ret = i915_ppgtt_init_hw(dev);
 	if (ret && ret != -EIO) {
-		DRM_ERROR("Context enable failed %d\n", ret);
+		DRM_ERROR("PPGTT enable failed %d\n", ret);
 		i915_gem_cleanup_ringbuffer(dev);
-
-		return ret;
 	}
 
-	ret = i915_ppgtt_init_hw(dev);
+	ret = i915_gem_context_enable(dev_priv);
 	if (ret && ret != -EIO) {
-		DRM_ERROR("PPGTT enable failed %d\n", ret);
+		DRM_ERROR("Context enable failed %d\n", ret);
 		i915_gem_cleanup_ringbuffer(dev);
+
+		return ret;
 	}
 
 	return ret;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5147 @ static bool mutex_is_locked_by(struct mu
 	if (!mutex_is_locked(mutex))
 		return false;
 
-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_MUTEXES)
+#if defined(CONFIG_SMP) && !defined(CONFIG_DEBUG_MUTEXES)
 	return mutex->owner == task;
 #else
 	/* Since UP may be pre-empted, we cannot assume that we own the lock */
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_gem_context.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/i915_gem_context.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_gem_context.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:471 @ mi_set_context(struct intel_engine_cs *r
 	       u32 hw_flags)
 {
 	u32 flags = hw_flags | MI_MM_SPACE_GTT;
-	int ret;
+	const int num_rings =
+		/* Use an extended w/a on ivb+ if signalling from other rings */
+		i915_semaphore_is_enabled(ring->dev) ?
+		hweight32(INTEL_INFO(ring->dev)->ring_mask) - 1 :
+		0;
+	int len, i, ret;
 
 	/* w/a: If Flush TLB Invalidation Mode is enabled, driver must do a TLB
 	 * invalidation prior to MI_SET_CONTEXT. On GEN6 we don't set the value
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:493 @ mi_set_context(struct intel_engine_cs *r
 	if (!IS_HASWELL(ring->dev) && INTEL_INFO(ring->dev)->gen < 8)
 		flags |= (MI_SAVE_EXT_STATE_EN | MI_RESTORE_EXT_STATE_EN);
 
-	ret = intel_ring_begin(ring, 6);
+
+	len = 4;
+	if (INTEL_INFO(ring->dev)->gen >= 7)
+		len += 2 + (num_rings ? 4*num_rings + 2 : 0);
+
+	ret = intel_ring_begin(ring, len);
 	if (ret)
 		return ret;
 
 	/* WaProgramMiArbOnOffAroundMiSetContext:ivb,vlv,hsw,bdw,chv */
-	if (INTEL_INFO(ring->dev)->gen >= 7)
+	if (INTEL_INFO(ring->dev)->gen >= 7) {
 		intel_ring_emit(ring, MI_ARB_ON_OFF | MI_ARB_DISABLE);
-	else
-		intel_ring_emit(ring, MI_NOOP);
+		if (num_rings) {
+			struct intel_engine_cs *signaller;
+
+			intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(num_rings));
+			for_each_ring(signaller, to_i915(ring->dev), i) {
+				if (signaller == ring)
+					continue;
+
+				intel_ring_emit(ring, RING_PSMI_CTL(signaller->mmio_base));
+				intel_ring_emit(ring, _MASKED_BIT_ENABLE(GEN6_PSMI_SLEEP_MSG_DISABLE));
+			}
+		}
+	}
 
 	intel_ring_emit(ring, MI_NOOP);
 	intel_ring_emit(ring, MI_SET_CONTEXT);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:529 @ mi_set_context(struct intel_engine_cs *r
 	 */
 	intel_ring_emit(ring, MI_NOOP);
 
-	if (INTEL_INFO(ring->dev)->gen >= 7)
+	if (INTEL_INFO(ring->dev)->gen >= 7) {
+		if (num_rings) {
+			struct intel_engine_cs *signaller;
+
+			intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(num_rings));
+			for_each_ring(signaller, to_i915(ring->dev), i) {
+				if (signaller == ring)
+					continue;
+
+				intel_ring_emit(ring, RING_PSMI_CTL(signaller->mmio_base));
+				intel_ring_emit(ring, _MASKED_BIT_DISABLE(GEN6_PSMI_SLEEP_MSG_DISABLE));
+			}
+		}
 		intel_ring_emit(ring, MI_ARB_ON_OFF | MI_ARB_ENABLE);
-	else
-		intel_ring_emit(ring, MI_NOOP);
+	}
 
 	intel_ring_advance(ring);
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_gem_stolen.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_gem_stolen.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:140 @ static unsigned long i915_stolen_to_phys
 		r = devm_request_mem_region(dev->dev, base + 1,
 					    dev_priv->gtt.stolen_size - 1,
 					    "Graphics Stolen Memory");
-		if (r == NULL) {
+		/*
+		 * GEN3 firmware likes to smash pci bridges into the stolen
+		 * range. Apparently this works.
+		 */
+		if (r == NULL && !IS_GEN3(dev)) {
 			DRM_ERROR("conflict detected with stolen region: [0x%08x - 0x%08x]\n",
 				  base, base + (uint32_t)dev_priv->gtt.stolen_size);
 			base = 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:488 @ i915_gem_object_create_stolen_for_preall
 			stolen_offset, gtt_offset, size);
 
 	/* KISS and expect everything to be page-aligned */
-	BUG_ON(stolen_offset & 4095);
-	BUG_ON(size & 4095);
-
-	if (WARN_ON(size == 0))
+	if (WARN_ON(size == 0 || stolen_offset & 4095 || size & 4095))
 		return NULL;
 
 	stolen = kzalloc(sizeof(*stolen), GFP_KERNEL);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_gem_tiling.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_gem_tiling.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:318 @ i915_gem_set_tiling(struct drm_device *d
 		return -EINVAL;
 	}
 
+	mutex_lock(&dev->struct_mutex);
 	if (i915_gem_obj_is_pinned(obj) || obj->framebuffer_references) {
-		drm_gem_object_unreference_unlocked(&obj->base);
-		return -EBUSY;
+		ret = -EBUSY;
+		goto err;
 	}
 
 	if (args->tiling_mode == I915_TILING_NONE) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:353 @ i915_gem_set_tiling(struct drm_device *d
 		}
 	}
 
-	mutex_lock(&dev->struct_mutex);
 	if (args->tiling_mode != obj->tiling_mode ||
 	    args->stride != obj->stride) {
 		/* We need to rebind the object if its current allocation
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:398 @ i915_gem_set_tiling(struct drm_device *d
 		obj->bit_17 = NULL;
 	}
 
+err:
 	drm_gem_object_unreference(&obj->base);
 	mutex_unlock(&dev->struct_mutex);
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_gem_userptr.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/i915_gem_userptr.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_gem_userptr.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:116 @ restart:
 			continue;
 
 		obj = mo->obj;
-		drm_gem_object_reference(&obj->base);
+
+		if (!kref_get_unless_zero(&obj->base.refcount))
+			continue;
+
 		spin_unlock(&mn->lock);
 
 		cancel_userptr(obj);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:155 @ static void i915_gem_userptr_mn_invalida
 			it = interval_tree_iter_first(&mn->objects, start, end);
 		if (it != NULL) {
 			obj = container_of(it, struct i915_mmu_object, it)->obj;
-			drm_gem_object_reference(&obj->base);
+
+			/* The mmu_object is released late when destroying the
+			 * GEM object so it is entirely possible to gain a
+			 * reference on an object in the process of being freed
+			 * since our serialisation is via the spinlock and not
+			 * the struct_mutex - and consequently use it after it
+			 * is freed and then double free it.
+			 */
+			if (!kref_get_unless_zero(&obj->base.refcount)) {
+				spin_unlock(&mn->lock);
+				serial = 0;
+				continue;
+			}
+
 			serial = mn->serial;
 		}
 		spin_unlock(&mn->lock);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_irq.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/i915_irq.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_irq.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2126 @ static irqreturn_t valleyview_irq_handle
 	u32 iir, gt_iir, pm_iir;
 	irqreturn_t ret = IRQ_NONE;
 
+	if (!intel_irqs_enabled(dev_priv))
+		return IRQ_NONE;
+
 	while (true) {
 		/* Find, clear, then process each source of interrupt */
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2173 @ static irqreturn_t cherryview_irq_handle
 	u32 master_ctl, iir;
 	irqreturn_t ret = IRQ_NONE;
 
+	if (!intel_irqs_enabled(dev_priv))
+		return IRQ_NONE;
+
 	for (;;) {
 		master_ctl = I915_READ(GEN8_MASTER_IRQ) & ~GEN8_MASTER_IRQ_CONTROL;
 		iir = I915_READ(VLV_IIR);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2464 @ static irqreturn_t ironlake_irq_handler(
 	u32 de_iir, gt_iir, de_ier, sde_ier = 0;
 	irqreturn_t ret = IRQ_NONE;
 
+	if (!intel_irqs_enabled(dev_priv))
+		return IRQ_NONE;
+
 	/* We get interrupts on unclaimed registers, so check for this before we
 	 * do any I915_{READ,WRITE}. */
 	intel_uncore_check_errors(dev);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2537 @ static irqreturn_t gen8_irq_handler(int
 	uint32_t tmp = 0;
 	enum pipe pipe;
 
+	if (!intel_irqs_enabled(dev_priv))
+		return IRQ_NONE;
+
 	master_ctl = I915_READ(GEN8_MASTER_IRQ);
 	master_ctl &= ~GEN8_MASTER_IRQ_CONTROL;
 	if (!master_ctl)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4037 @ static bool i8xx_handle_vblank(struct dr
 	if ((iir & flip_pending) == 0)
 		goto check_page_flip;
 
-	intel_prepare_page_flip(dev, plane);
-
 	/* We detect FlipDone by looking for the change in PendingFlip from '1'
 	 * to '0' on the following vblank, i.e. IIR has the Pendingflip
 	 * asserted following the MI_DISPLAY_FLIP, but ISR is deasserted, hence
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4046 @ static bool i8xx_handle_vblank(struct dr
 	if (I915_READ16(ISR) & flip_pending)
 		goto check_page_flip;
 
+	intel_prepare_page_flip(dev, plane);
 	intel_finish_page_flip(dev, pipe);
 	return true;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4067 @ static irqreturn_t i8xx_irq_handler(int
 		I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
 		I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
 
+	if (!intel_irqs_enabled(dev_priv))
+		return IRQ_NONE;
+
 	iir = I915_READ16(IIR);
 	if (iir == 0)
 		return IRQ_NONE;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4227 @ static bool i915_handle_vblank(struct dr
 	if ((iir & flip_pending) == 0)
 		goto check_page_flip;
 
-	intel_prepare_page_flip(dev, plane);
-
 	/* We detect FlipDone by looking for the change in PendingFlip from '1'
 	 * to '0' on the following vblank, i.e. IIR has the Pendingflip
 	 * asserted following the MI_DISPLAY_FLIP, but ISR is deasserted, hence
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4236 @ static bool i915_handle_vblank(struct dr
 	if (I915_READ(ISR) & flip_pending)
 		goto check_page_flip;
 
+	intel_prepare_page_flip(dev, plane);
 	intel_finish_page_flip(dev, pipe);
 	return true;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4256 @ static irqreturn_t i915_irq_handler(int
 		I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
 	int pipe, ret = IRQ_NONE;
 
+	if (!intel_irqs_enabled(dev_priv))
+		return IRQ_NONE;
+
 	iir = I915_READ(IIR);
 	do {
 		bool irq_received = (iir & ~flip_mask) != 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4487 @ static irqreturn_t i965_irq_handler(int
 		I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
 		I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
 
+	if (!intel_irqs_enabled(dev_priv))
+		return IRQ_NONE;
+
 	iir = I915_READ(IIR);
 
 	for (;;) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4801 @ void intel_runtime_pm_restore_interrupts
 	dev_priv->pm._irqs_disabled = false;
 	dev->driver->irq_preinstall(dev);
 	dev->driver->irq_postinstall(dev);
+	synchronize_irq(dev_priv->dev->irq);
 }
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_reg.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/i915_reg.h
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_reg.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:77 @
 #define   I915_GC_RENDER_CLOCK_166_MHZ	(0 << 0)
 #define   I915_GC_RENDER_CLOCK_200_MHZ	(1 << 0)
 #define   I915_GC_RENDER_CLOCK_333_MHZ	(4 << 0)
+#define GCDGMBUS 0xcc
 #define PCI_LBPC 0xf4 /* legacy/combination backlight modes, also called LBB */
 
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:374 @
 #define   PIPE_CONTROL_STORE_DATA_INDEX			(1<<21)
 #define   PIPE_CONTROL_CS_STALL				(1<<20)
 #define   PIPE_CONTROL_TLB_INVALIDATE			(1<<18)
+#define   PIPE_CONTROL_MEDIA_STATE_CLEAR		(1<<16)
 #define   PIPE_CONTROL_QW_WRITE				(1<<14)
 #define   PIPE_CONTROL_POST_SYNC_OP_MASK                (3<<14)
 #define   PIPE_CONTROL_DEPTH_STALL			(1<<13)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1076 @ enum punit_power_well {
 #define GEN6_VERSYNC	(RING_SYNC_1(VEBOX_RING_BASE))
 #define GEN6_VEVSYNC	(RING_SYNC_2(VEBOX_RING_BASE))
 #define GEN6_NOSYNC 0
+#define RING_PSMI_CTL(base)	((base)+0x50)
 #define RING_MAX_IDLE(base)	((base)+0x54)
 #define RING_HWS_PGA(base)	((base)+0x80)
 #define RING_HWS_PGA_GEN6(base)	((base)+0x2080)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1407 @ enum punit_power_well {
 #define   GEN6_BLITTER_FBC_NOTIFY			(1<<3)
 
 #define GEN6_RC_SLEEP_PSMI_CONTROL	0x2050
+#define   GEN6_PSMI_SLEEP_MSG_DISABLE	(1 << 0)
 #define   GEN8_RC_SEMA_IDLE_MSG_DISABLE	(1 << 12)
 #define   GEN8_FF_DOP_CLOCK_GATE_DISABLE	(1<<10)
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_suspend.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/i915_suspend.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/i915_suspend.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:331 @ int i915_save_state(struct drm_device *d
 		}
 	}
 
+	if (IS_GEN4(dev))
+		pci_read_config_word(dev->pdev, GCDGMBUS,
+				     &dev_priv->regfile.saveGCDGMBUS);
+
 	/* Cache mode state */
 	if (INTEL_INFO(dev)->gen < 7)
 		dev_priv->regfile.saveCACHE_MODE_0 = I915_READ(CACHE_MODE_0);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:363 @ int i915_restore_state(struct drm_device
 	mutex_lock(&dev->struct_mutex);
 
 	i915_gem_restore_fences(dev);
+
+	if (IS_GEN4(dev))
+		pci_write_config_word(dev->pdev, GCDGMBUS,
+				      dev_priv->regfile.saveGCDGMBUS);
 	i915_restore_display(dev);
 
 	if (!drm_core_check_feature(dev, DRIVER_MODESET)) {
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_display.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/intel_display.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_display.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2361 @ static bool intel_alloc_plane_obj(struct
 	struct drm_device *dev = crtc->base.dev;
 	struct drm_i915_gem_object *obj = NULL;
 	struct drm_mode_fb_cmd2 mode_cmd = { 0 };
-	u32 base = plane_config->base;
+	u32 base_aligned = round_down(plane_config->base, PAGE_SIZE);
+	u32 size_aligned = round_up(plane_config->base + plane_config->size,
+				    PAGE_SIZE);
+
+	size_aligned -= base_aligned;
 
 	if (plane_config->size == 0)
 		return false;
 
-	obj = i915_gem_object_create_stolen_for_preallocated(dev, base, base,
-							     plane_config->size);
+	obj = i915_gem_object_create_stolen_for_preallocated(dev,
+							     base_aligned,
+							     base_aligned,
+							     size_aligned);
 	if (!obj)
 		return false;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6392 @ static void i9xx_get_plane_config(struct
 	aligned_height = intel_align_height(dev, crtc->base.primary->fb->height,
 					    plane_config->tiled);
 
-	plane_config->size = PAGE_ALIGN(crtc->base.primary->fb->pitches[0] *
-					aligned_height);
+	plane_config->size = crtc->base.primary->fb->pitches[0] * aligned_height;
 
 	DRM_DEBUG_KMS("pipe/plane %d/%d with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n",
 		      pipe, plane, crtc->base.primary->fb->width,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7432 @ static void ironlake_get_plane_config(st
 	aligned_height = intel_align_height(dev, crtc->base.primary->fb->height,
 					    plane_config->tiled);
 
-	plane_config->size = PAGE_ALIGN(crtc->base.primary->fb->pitches[0] *
-					aligned_height);
+	plane_config->size = crtc->base.primary->fb->pitches[0] * aligned_height;
 
 	DRM_DEBUG_KMS("pipe/plane %d/%d with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n",
 		      pipe, plane, crtc->base.primary->fb->width,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:10026 @ static int intel_crtc_page_flip(struct d
 		if (obj->tiling_mode != work->old_fb_obj->tiling_mode)
 			/* vlv: DISPLAY_FLIP fails to change tiling */
 			ring = NULL;
-	} else if (IS_IVYBRIDGE(dev)) {
+	} else if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev)) {
 		ring = &dev_priv->ring[BCS];
 	} else if (INTEL_INFO(dev)->gen >= 7) {
 		ring = obj->ring;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:12902 @ static struct intel_quirk intel_quirks[]
 
 	/* HP Chromebook 14 (Celeron 2955U) */
 	{ 0x0a06, 0x103c, 0x21ed, quirk_backlight_present },
+
+	/* Dell Chromebook 11 */
+	{ 0x0a06, 0x1028, 0x0a35, quirk_backlight_present },
 };
 
 static void intel_init_quirks(struct drm_device *dev)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:12943 @ static void i915_disable_vga(struct drm_
 	vga_put(dev->pdev, VGA_RSRC_LEGACY_IO);
 	udelay(300);
 
-	/*
-	 * Fujitsu-Siemens Lifebook S6010 (830) has problems resuming
-	 * from S3 without preserving (some of?) the other bits.
-	 */
-	I915_WRITE(vga_reg, dev_priv->bios_vgacntr | VGA_DISP_DISABLE);
+	I915_WRITE(vga_reg, VGA_DISP_DISABLE);
 	POSTING_READ(vga_reg);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:13032 @ void intel_modeset_init(struct drm_devic
 
 	intel_shared_dpll_init(dev);
 
-	/* save the BIOS value before clobbering it */
-	dev_priv->bios_vgacntr = I915_READ(i915_vgacntrl_reg(dev));
 	/* Just disable it once at startup */
 	i915_disable_vga(dev);
 	intel_setup_outputs(dev);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_dp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/intel_dp.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_dp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3648 @ intel_dp_link_down(struct intel_dp *inte
 	enum port port = intel_dig_port->port;
 	struct drm_device *dev = intel_dig_port->base.base.dev;
 	struct drm_i915_private *dev_priv = dev->dev_private;
-	struct intel_crtc *intel_crtc =
-		to_intel_crtc(intel_dig_port->base.base.crtc);
 	uint32_t DP = intel_dp->DP;
 
 	if (WARN_ON(HAS_DDI(dev)))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3672 @ intel_dp_link_down(struct intel_dp *inte
 
 	if (HAS_PCH_IBX(dev) &&
 	    I915_READ(intel_dp->output_reg) & DP_PIPEB_SELECT) {
-		struct drm_crtc *crtc = intel_dig_port->base.base.crtc;
-
 		/* Hardware workaround: leaving our transcoder select
 		 * set to transcoder B while it's off will prevent the
 		 * corresponding HDMI output on transcoder A.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3682 @ intel_dp_link_down(struct intel_dp *inte
 		 */
 		DP &= ~DP_PIPEB_SELECT;
 		I915_WRITE(intel_dp->output_reg, DP);
-
-		/* Changes to enable or select take place the vblank
-		 * after being written.
-		 */
-		if (WARN_ON(crtc == NULL)) {
-			/* We should never try to disable a port without a crtc
-			 * attached. For paranoia keep the code around for a
-			 * bit. */
-			POSTING_READ(intel_dp->output_reg);
-			msleep(50);
-		} else
-			intel_wait_for_vblank(dev, intel_crtc->pipe);
+		POSTING_READ(intel_dp->output_reg);
 	}
 
 	DP &= ~DP_AUDIO_OUTPUT_ENABLE;
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_lrc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/intel_lrc.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_lrc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1109 @ static int gen8_emit_flush(struct intel_
 
 	cmd = MI_FLUSH_DW + 1;
 
-	if (ring == &dev_priv->ring[VCS]) {
-		if (invalidate_domains & I915_GEM_GPU_DOMAINS)
-			cmd |= MI_INVALIDATE_TLB | MI_INVALIDATE_BSD |
-				MI_FLUSH_DW_STORE_INDEX |
-				MI_FLUSH_DW_OP_STOREDW;
-	} else {
-		if (invalidate_domains & I915_GEM_DOMAIN_RENDER)
-			cmd |= MI_INVALIDATE_TLB | MI_FLUSH_DW_STORE_INDEX |
-				MI_FLUSH_DW_OP_STOREDW;
+	/* We always require a command barrier so that subsequent
+	 * commands, such as breadcrumb interrupts, are strictly ordered
+	 * wrt the contents of the write cache being flushed to memory
+	 * (and thus being coherent from the CPU).
+	 */
+	cmd |= MI_FLUSH_DW_STORE_INDEX | MI_FLUSH_DW_OP_STOREDW;
+
+	if (invalidate_domains & I915_GEM_GPU_DOMAINS) {
+		cmd |= MI_INVALIDATE_TLB;
+		if (ring == &dev_priv->ring[VCS])
+			cmd |= MI_INVALIDATE_BSD;
 	}
 
 	intel_logical_ring_emit(ringbuf, cmd);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_panel.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/intel_panel.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_panel.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:950 @ void intel_panel_enable_backlight(struct
 
 	WARN_ON(panel->backlight.max == 0);
 
-	if (panel->backlight.level == 0) {
+	if (panel->backlight.level <= panel->backlight.min) {
 		panel->backlight.level = panel->backlight.max;
 		if (panel->backlight.device)
 			panel->backlight.device->props.brightness =
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_pm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/intel_pm.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_pm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6523 @ static void chv_pipe_power_well_disable(
 	chv_set_pipe_power_well(dev_priv, power_well, false);
 }
 
-static void check_power_well_state(struct drm_i915_private *dev_priv,
-				   struct i915_power_well *power_well)
-{
-	bool enabled = power_well->ops->is_enabled(dev_priv, power_well);
-
-	if (power_well->always_on || !i915.disable_power_well) {
-		if (!enabled)
-			goto mismatch;
-
-		return;
-	}
-
-	if (enabled != (power_well->count > 0))
-		goto mismatch;
-
-	return;
-
-mismatch:
-	WARN(1, "state mismatch for '%s' (always_on %d hw state %d use-count %d disable_power_well %d\n",
-		  power_well->name, power_well->always_on, enabled,
-		  power_well->count, i915.disable_power_well);
-}
-
 void intel_display_power_get(struct drm_i915_private *dev_priv,
 			     enum intel_display_power_domain domain)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6542 @ void intel_display_power_get(struct drm_
 			power_well->ops->enable(dev_priv, power_well);
 			power_well->hw_enabled = true;
 		}
-
-		check_power_well_state(dev_priv, power_well);
 	}
 
 	power_domains->domain_use_count[domain]++;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6571 @ void intel_display_power_put(struct drm_
 			power_well->hw_enabled = false;
 			power_well->ops->disable(dev_priv, power_well);
 		}
-
-		check_power_well_state(dev_priv, power_well);
 	}
 
 	mutex_unlock(&power_domains->lock);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_ringbuffer.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_ringbuffer.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:365 @ gen7_render_ring_flush(struct intel_engi
 		flags |= PIPE_CONTROL_VF_CACHE_INVALIDATE;
 		flags |= PIPE_CONTROL_CONST_CACHE_INVALIDATE;
 		flags |= PIPE_CONTROL_STATE_CACHE_INVALIDATE;
+		flags |= PIPE_CONTROL_MEDIA_STATE_CLEAR;
 		/*
 		 * TLB invalidate requires a post-sync write.
 		 */
 		flags |= PIPE_CONTROL_QW_WRITE;
 		flags |= PIPE_CONTROL_GLOBAL_GTT_IVB;
 
+		flags |= PIPE_CONTROL_STALL_AT_SCOREBOARD;
+
 		/* Workaround: we must issue a pipe_control with CS-stall bit
 		 * set before a pipe_control command that has the state cache
 		 * invalidate bit set. */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2142 @ static int gen6_bsd_ring_flush(struct in
 	cmd = MI_FLUSH_DW;
 	if (INTEL_INFO(ring->dev)->gen >= 8)
 		cmd += 1;
+
+	/* We always require a command barrier so that subsequent
+	 * commands, such as breadcrumb interrupts, are strictly ordered
+	 * wrt the contents of the write cache being flushed to memory
+	 * (and thus being coherent from the CPU).
+	 */
+	cmd |= MI_FLUSH_DW_STORE_INDEX | MI_FLUSH_DW_OP_STOREDW;
+
 	/*
 	 * Bspec vol 1c.5 - video engine command streamer:
 	 * "If ENABLED, all TLBs will be invalidated once the flush
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2157 @ static int gen6_bsd_ring_flush(struct in
 	 * Post-Sync Operation field is a value of 1h or 3h."
 	 */
 	if (invalidate & I915_GEM_GPU_DOMAINS)
-		cmd |= MI_INVALIDATE_TLB | MI_INVALIDATE_BSD |
-			MI_FLUSH_DW_STORE_INDEX | MI_FLUSH_DW_OP_STOREDW;
+		cmd |= MI_INVALIDATE_TLB | MI_INVALIDATE_BSD;
+
 	intel_ring_emit(ring, cmd);
 	intel_ring_emit(ring, I915_GEM_HWS_SCRATCH_ADDR | MI_FLUSH_DW_USE_GTT);
 	if (INTEL_INFO(ring->dev)->gen >= 8) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2253 @ static int gen6_ring_flush(struct intel_
 	cmd = MI_FLUSH_DW;
 	if (INTEL_INFO(ring->dev)->gen >= 8)
 		cmd += 1;
+
+	/* We always require a command barrier so that subsequent
+	 * commands, such as breadcrumb interrupts, are strictly ordered
+	 * wrt the contents of the write cache being flushed to memory
+	 * (and thus being coherent from the CPU).
+	 */
+	cmd |= MI_FLUSH_DW_STORE_INDEX | MI_FLUSH_DW_OP_STOREDW;
+
 	/*
 	 * Bspec vol 1c.3 - blitter engine command streamer:
 	 * "If ENABLED, all TLBs will be invalidated once the flush
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2268 @ static int gen6_ring_flush(struct intel_
 	 * Post-Sync Operation field is a value of 1h or 3h."
 	 */
 	if (invalidate & I915_GEM_DOMAIN_RENDER)
-		cmd |= MI_INVALIDATE_TLB | MI_FLUSH_DW_STORE_INDEX |
-			MI_FLUSH_DW_OP_STOREDW;
+		cmd |= MI_INVALIDATE_TLB;
 	intel_ring_emit(ring, cmd);
 	intel_ring_emit(ring, I915_GEM_HWS_SCRATCH_ADDR | MI_FLUSH_DW_USE_GTT);
 	if (INTEL_INFO(ring->dev)->gen >= 8) {
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_sideband.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/intel_sideband.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_sideband.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:85 @ u32 vlv_punit_read(struct drm_i915_priva
 	WARN_ON(!mutex_is_locked(&dev_priv->rps.hw_lock));
 
 	mutex_lock(&dev_priv->dpio_lock);
-	vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_PUNIT,
+	vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_PUNIT,
 			SB_CRRDDA_NP, addr, &val);
 	mutex_unlock(&dev_priv->dpio_lock);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:97 @ void vlv_punit_write(struct drm_i915_pri
 	WARN_ON(!mutex_is_locked(&dev_priv->rps.hw_lock));
 
 	mutex_lock(&dev_priv->dpio_lock);
-	vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_PUNIT,
+	vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_PUNIT,
 			SB_CRWRDA_NP, addr, &val);
 	mutex_unlock(&dev_priv->dpio_lock);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:106 @ u32 vlv_bunit_read(struct drm_i915_priva
 {
 	u32 val = 0;
 
-	vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_BUNIT,
+	vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_BUNIT,
 			SB_CRRDDA_NP, reg, &val);
 
 	return val;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:114 @ u32 vlv_bunit_read(struct drm_i915_priva
 
 void vlv_bunit_write(struct drm_i915_private *dev_priv, u32 reg, u32 val)
 {
-	vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_BUNIT,
+	vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_BUNIT,
 			SB_CRWRDA_NP, reg, &val);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:125 @ u32 vlv_nc_read(struct drm_i915_private
 	WARN_ON(!mutex_is_locked(&dev_priv->rps.hw_lock));
 
 	mutex_lock(&dev_priv->dpio_lock);
-	vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_NC,
+	vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_NC,
 			SB_CRRDDA_NP, addr, &val);
 	mutex_unlock(&dev_priv->dpio_lock);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:135 @ u32 vlv_nc_read(struct drm_i915_private
 u32 vlv_gpio_nc_read(struct drm_i915_private *dev_priv, u32 reg)
 {
 	u32 val = 0;
-	vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_GPIO_NC,
+	vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_GPIO_NC,
 			SB_CRRDDA_NP, reg, &val);
 	return val;
 }
 
 void vlv_gpio_nc_write(struct drm_i915_private *dev_priv, u32 reg, u32 val)
 {
-	vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_GPIO_NC,
+	vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_GPIO_NC,
 			SB_CRWRDA_NP, reg, &val);
 }
 
 u32 vlv_cck_read(struct drm_i915_private *dev_priv, u32 reg)
 {
 	u32 val = 0;
-	vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_CCK,
+	vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_CCK,
 			SB_CRRDDA_NP, reg, &val);
 	return val;
 }
 
 void vlv_cck_write(struct drm_i915_private *dev_priv, u32 reg, u32 val)
 {
-	vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_CCK,
+	vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_CCK,
 			SB_CRWRDA_NP, reg, &val);
 }
 
 u32 vlv_ccu_read(struct drm_i915_private *dev_priv, u32 reg)
 {
 	u32 val = 0;
-	vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_CCU,
+	vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_CCU,
 			SB_CRRDDA_NP, reg, &val);
 	return val;
 }
 
 void vlv_ccu_write(struct drm_i915_private *dev_priv, u32 reg, u32 val)
 {
-	vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_CCU,
+	vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_CCU,
 			SB_CRWRDA_NP, reg, &val);
 }
 
 u32 vlv_gps_core_read(struct drm_i915_private *dev_priv, u32 reg)
 {
 	u32 val = 0;
-	vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_GPS_CORE,
+	vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_GPS_CORE,
 			SB_CRRDDA_NP, reg, &val);
 	return val;
 }
 
 void vlv_gps_core_write(struct drm_i915_private *dev_priv, u32 reg, u32 val)
 {
-	vlv_sideband_rw(dev_priv, PCI_DEVFN(2, 0), IOSF_PORT_GPS_CORE,
+	vlv_sideband_rw(dev_priv, PCI_DEVFN(0, 0), IOSF_PORT_GPS_CORE,
 			SB_CRWRDA_NP, reg, &val);
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_sprite.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/intel_sprite.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_sprite.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1181 @ int intel_sprite_set_colorkey(struct drm
 	drm_modeset_lock_all(dev);
 
 	plane = drm_plane_find(dev, set->plane_id);
-	if (!plane) {
+	if (!plane || plane->type != DRM_PLANE_TYPE_OVERLAY) {
 		ret = -ENOENT;
 		goto out_unlock;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1208 @ int intel_sprite_get_colorkey(struct drm
 	drm_modeset_lock_all(dev);
 
 	plane = drm_plane_find(dev, get->plane_id);
-	if (!plane) {
+	if (!plane || plane->type != DRM_PLANE_TYPE_OVERLAY) {
 		ret = -ENOENT;
 		goto out_unlock;
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_uncore.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/i915/intel_uncore.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/i915/intel_uncore.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:46 @
 static void
 assert_device_not_suspended(struct drm_i915_private *dev_priv)
 {
-	WARN(HAS_RUNTIME_PM(dev_priv->dev) && dev_priv->pm.suspended,
-	     "Device suspended\n");
+	WARN_ONCE(HAS_RUNTIME_PM(dev_priv->dev) && dev_priv->pm.suspended,
+		  "Device suspended\n");
 }
 
 static void __gen6_gt_wait_for_thread_c0(struct drm_i915_private *dev_priv)
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/nouveau/core/core/event.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/nouveau/core/core/event.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/nouveau/core/core/event.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:29 @
 void
 nvkm_event_put(struct nvkm_event *event, u32 types, int index)
 {
-	BUG_ON(!spin_is_locked(&event->refs_lock));
+	assert_spin_locked(&event->refs_lock);
 	while (types) {
 		int type = __ffs(types); types &= ~(1 << type);
 		if (--event->refs[index * event->types_nr + type] == 0) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:42 @ nvkm_event_put(struct nvkm_event *event,
 void
 nvkm_event_get(struct nvkm_event *event, u32 types, int index)
 {
-	BUG_ON(!spin_is_locked(&event->refs_lock));
+	assert_spin_locked(&event->refs_lock);
 	while (types) {
 		int type = __ffs(types); types &= ~(1 << type);
 		if (++event->refs[index * event->types_nr + type] == 1) {
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/nouveau/core/core/notify.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/nouveau/core/core/notify.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/nouveau/core/core/notify.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:101 @ nvkm_notify_send(struct nvkm_notify *not
 	struct nvkm_event *event = notify->event;
 	unsigned long flags;
 
-	BUG_ON(!spin_is_locked(&event->list_lock));
+	assert_spin_locked(&event->list_lock);
 	BUG_ON(size != notify->size);
 
 	spin_lock_irqsave(&event->refs_lock, flags);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:27 @
 
 #include "nv04.h"
 
-static void
-nv4c_mc_msi_rearm(struct nouveau_mc *pmc)
-{
-	struct nv04_mc_priv *priv = (void *)pmc;
-	nv_wr08(priv, 0x088050, 0xff);
-}
-
 struct nouveau_oclass *
 nv4c_mc_oclass = &(struct nouveau_mc_oclass) {
 	.base.handle = NV_SUBDEV(MC, 0x4c),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:37 @ nv4c_mc_oclass = &(struct nouveau_mc_ocl
 		.fini = _nouveau_mc_fini,
 	},
 	.intr = nv04_mc_intr,
-	.msi_rearm = nv4c_mc_msi_rearm,
 }.base;
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/nouveau/nouveau_ttm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/nouveau/nouveau_ttm.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/nouveau/nouveau_ttm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:31 @
 #include "nouveau_ttm.h"
 #include "nouveau_gem.h"
 
+#include "drm_legacy.h"
 static int
 nouveau_vram_manager_init(struct ttm_mem_type_manager *man, unsigned long psize)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:285 @ nouveau_ttm_mmap(struct file *filp, stru
 	struct nouveau_drm *drm = nouveau_drm(file_priv->minor->dev);
 
 	if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET))
-		return -EINVAL;
+		return drm_legacy_mmap(filp, vma);
 
 	return ttm_bo_mmap(filp, vma, &drm->ttm.bdev);
 }
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/atombios_crtc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/atombios_crtc.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/atombios_crtc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1408 @ static int dce4_crtc_do_set_base(struct
 	       (x << 16) | y);
 	viewport_w = crtc->mode.hdisplay;
 	viewport_h = (crtc->mode.vdisplay + 1) & ~1;
+	if ((rdev->family >= CHIP_BONAIRE) &&
+	    (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE))
+		viewport_h *= 2;
 	WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
 	       (viewport_w << 16) | viewport_h);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1857 @ static int radeon_atom_pick_pll(struct d
 				return pll;
 		}
 		/* otherwise, pick one of the plls */
-		if ((rdev->family == CHIP_KAVERI) ||
-		    (rdev->family == CHIP_KABINI) ||
+		if ((rdev->family == CHIP_KABINI) ||
 		    (rdev->family == CHIP_MULLINS)) {
-			/* KB/KV/ML has PPLL1 and PPLL2 */
+			/* KB/ML has PPLL1 and PPLL2 */
 			pll_in_use = radeon_get_pll_use_mask(crtc);
 			if (!(pll_in_use & (1 << ATOM_PPLL2)))
 				return ATOM_PPLL2;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1868 @ static int radeon_atom_pick_pll(struct d
 			DRM_ERROR("unable to allocate a PPLL\n");
 			return ATOM_PPLL_INVALID;
 		} else {
-			/* CI has PPLL0, PPLL1, and PPLL2 */
+			/* CI/KV has PPLL0, PPLL1, and PPLL2 */
 			pll_in_use = radeon_get_pll_use_mask(crtc);
 			if (!(pll_in_use & (1 << ATOM_PPLL2)))
 				return ATOM_PPLL2;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2159 @ static void atombios_crtc_disable(struct
 	case ATOM_PPLL0:
 		/* disable the ppll */
 		if ((rdev->family == CHIP_ARUBA) ||
+		    (rdev->family == CHIP_KAVERI) ||
 		    (rdev->family == CHIP_BONAIRE) ||
 		    (rdev->family == CHIP_HAWAII))
 			atombios_crtc_program_pll(crtc, radeon_crtc->crtc_id, radeon_crtc->pll_id,
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/atombios_dp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/atombios_dp.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/atombios_dp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:495 @ int radeon_dp_mode_valid_helper(struct d
 	struct radeon_connector_atom_dig *dig_connector;
 	int dp_clock;
 
+	if ((mode->clock > 340000) &&
+	    (!radeon_connector_is_dp12_capable(connector)))
+		return MODE_CLOCK_HIGH;
+
 	if (!radeon_connector->con_priv)
 		return MODE_CLOCK_HIGH;
 	dig_connector = radeon_connector->con_priv;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:626 @ static int radeon_dp_link_train_init(str
 		drm_dp_dpcd_writeb(dp_info->aux,
 				   DP_DOWNSPREAD_CTRL, 0);
 
-	if ((dp_info->connector->connector_type == DRM_MODE_CONNECTOR_eDP) &&
-	    (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)) {
+	if (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)
 		drm_dp_dpcd_writeb(dp_info->aux, DP_EDP_CONFIGURATION_SET, 1);
-	}
 
 	/* set the lane count on the sink */
 	tmp = dp_info->dp_lane_count;
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/ci_dpm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/ci_dpm.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/ci_dpm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4732 @ void ci_dpm_disable(struct radeon_device
 	ci_enable_spread_spectrum(rdev, false);
 	ci_enable_auto_throttle_source(rdev, RADEON_DPM_AUTO_THROTTLE_SRC_THERMAL, false);
 	ci_stop_dpm(rdev);
-	ci_enable_ds_master_switch(rdev, true);
+	ci_enable_ds_master_switch(rdev, false);
 	ci_enable_ulv(rdev, false);
 	ci_clear_vc(rdev);
 	ci_reset_to_default(rdev);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/cik.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/cik.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/cik.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3883 @ void cik_fence_gfx_ring_emit(struct rade
 	struct radeon_ring *ring = &rdev->ring[fence->ring];
 	u64 addr = rdev->fence_drv[fence->ring].gpu_addr;
 
-	/* EVENT_WRITE_EOP - flush caches, send int */
+	/* Workaround for cache flush problems. First send a dummy EOP
+	 * event down the pipe with seq one below.
+	 */
+	radeon_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE_EOP, 4));
+	radeon_ring_write(ring, (EOP_TCL1_ACTION_EN |
+				 EOP_TC_ACTION_EN |
+				 EVENT_TYPE(CACHE_FLUSH_AND_INV_TS_EVENT) |
+				 EVENT_INDEX(5)));
+	radeon_ring_write(ring, addr & 0xfffffffc);
+	radeon_ring_write(ring, (upper_32_bits(addr) & 0xffff) |
+				DATA_SEL(1) | INT_SEL(0));
+	radeon_ring_write(ring, fence->seq - 1);
+	radeon_ring_write(ring, 0);
+
+	/* Then send the real EOP event down the pipe. */
 	radeon_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE_EOP, 4));
 	radeon_ring_write(ring, (EOP_TCL1_ACTION_EN |
 				 EOP_TC_ACTION_EN |
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6331 @ static void cik_enable_mgcg(struct radeo
 		}
 
 		orig = data = RREG32(RLC_CGTT_MGCG_OVERRIDE);
+		data |= 0x00000001;
 		data &= 0xfffffffd;
 		if (orig != data)
 			WREG32(RLC_CGTT_MGCG_OVERRIDE, data);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6363 @ static void cik_enable_mgcg(struct radeo
 		}
 	} else {
 		orig = data = RREG32(RLC_CGTT_MGCG_OVERRIDE);
-		data |= 0x00000002;
+		data |= 0x00000003;
 		if (orig != data)
 			WREG32(RLC_CGTT_MGCG_OVERRIDE, data);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7312 @ int cik_irq_set(struct radeon_device *rd
 	u32 hpd1, hpd2, hpd3, hpd4, hpd5, hpd6;
 	u32 grbm_int_cntl = 0;
 	u32 dma_cntl, dma_cntl1;
-	u32 thermal_int;
 
 	if (!rdev->irq.installed) {
 		WARN(1, "Can't enable IRQ/MSI because no handler is installed\n");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7348 @ int cik_irq_set(struct radeon_device *rd
 	cp_m2p2 = RREG32(CP_ME2_PIPE2_INT_CNTL) & ~TIME_STAMP_INT_ENABLE;
 	cp_m2p3 = RREG32(CP_ME2_PIPE3_INT_CNTL) & ~TIME_STAMP_INT_ENABLE;
 
-	if (rdev->flags & RADEON_IS_IGP)
-		thermal_int = RREG32_SMC(CG_THERMAL_INT_CTRL) &
-			~(THERM_INTH_MASK | THERM_INTL_MASK);
-	else
-		thermal_int = RREG32_SMC(CG_THERMAL_INT) &
-			~(THERM_INT_MASK_HIGH | THERM_INT_MASK_LOW);
-
 	/* enable CP interrupts on all rings */
 	if (atomic_read(&rdev->irq.ring_int[RADEON_RING_TYPE_GFX_INDEX])) {
 		DRM_DEBUG("cik_irq_set: sw int gfx\n");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7505 @ int cik_irq_set(struct radeon_device *rd
 		hpd6 |= DC_HPDx_INT_EN;
 	}
 
-	if (rdev->irq.dpm_thermal) {
-		DRM_DEBUG("dpm thermal\n");
-		if (rdev->flags & RADEON_IS_IGP)
-			thermal_int |= THERM_INTH_MASK | THERM_INTL_MASK;
-		else
-			thermal_int |= THERM_INT_MASK_HIGH | THERM_INT_MASK_LOW;
-	}
-
 	WREG32(CP_INT_CNTL_RING0, cp_int_cntl);
 
 	WREG32(SDMA0_CNTL + SDMA0_REGISTER_OFFSET, dma_cntl);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7558 @ int cik_irq_set(struct radeon_device *rd
 	WREG32(DC_HPD5_INT_CONTROL, hpd5);
 	WREG32(DC_HPD6_INT_CONTROL, hpd6);
 
-	if (rdev->flags & RADEON_IS_IGP)
-		WREG32_SMC(CG_THERMAL_INT_CTRL, thermal_int);
-	else
-		WREG32_SMC(CG_THERMAL_INT, thermal_int);
+	/* posting read */
+	RREG32(SRBM_STATUS);
 
 	return 0;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/dce3_1_afmt.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/dce3_1_afmt.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/dce3_1_afmt.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:106 @ static void dce3_2_afmt_write_sad_regs(s
 	}
 
 	sad_count = drm_edid_to_sad(radeon_connector->edid, &sads);
-	if (sad_count < 0) {
+	if (sad_count <= 0) {
 		DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
 		return;
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/evergreen.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/evergreen.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/evergreen.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4592 @ int evergreen_irq_set(struct radeon_devi
 	WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, afmt5);
 	WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, afmt6);
 
+	/* posting read */
+	RREG32(SRBM_STATUS);
+
 	return 0;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/kv_dpm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/kv_dpm.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/kv_dpm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1172 @ void kv_dpm_enable_bapm(struct radeon_de
 	}
 }
 
+static void kv_enable_thermal_int(struct radeon_device *rdev, bool enable)
+{
+	u32 thermal_int;
+
+	thermal_int = RREG32_SMC(CG_THERMAL_INT_CTRL);
+	if (enable)
+		thermal_int |= THERM_INTH_MASK | THERM_INTL_MASK;
+	else
+		thermal_int &= ~(THERM_INTH_MASK | THERM_INTL_MASK);
+	WREG32_SMC(CG_THERMAL_INT_CTRL, thermal_int);
+
+}
+
 int kv_dpm_enable(struct radeon_device *rdev)
 {
 	struct kv_power_info *pi = kv_get_pi(rdev);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1296 @ int kv_dpm_late_enable(struct radeon_dev
 			DRM_ERROR("kv_set_thermal_temperature_range failed\n");
 			return ret;
 		}
-		rdev->irq.dpm_thermal = true;
-		radeon_irq_set(rdev);
+		kv_enable_thermal_int(rdev, true);
 	}
 
 	/* powerdown unused blocks for now */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1327 @ void kv_dpm_disable(struct radeon_device
 	kv_stop_dpm(rdev);
 	kv_enable_ulv(rdev, false);
 	kv_reset_am(rdev);
+	kv_enable_thermal_int(rdev, false);
 
 	kv_update_current_ps(rdev, rdev->pm.dpm.boot_ps);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2761 @ int kv_dpm_init(struct radeon_device *rd
 	pi->enable_auto_thermal_throttling = true;
 	pi->disable_nb_ps3_in_battery = false;
 	if (radeon_bapm == -1) {
-		/* There are stability issues reported on with
-		 * bapm enabled on an asrock system.
-		 */
-		if (rdev->pdev->subsystem_vendor == 0x1849)
-			pi->bapm_enable = false;
-		else
+		/* only enable bapm on KB, ML by default */
+		if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
 			pi->bapm_enable = true;
+		else
+			pi->bapm_enable = false;
 	} else if (radeon_bapm == 0) {
 		pi->bapm_enable = false;
 	} else {
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/ni.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/ni.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/ni.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1088 @ static void cayman_gpu_init(struct radeo
 
 	if ((rdev->config.cayman.max_backends_per_se == 1) &&
 	    (rdev->flags & RADEON_IS_IGP)) {
-		if ((disabled_rb_mask & 3) == 1) {
-			/* RB0 disabled, RB1 enabled */
-			tmp = 0x11111111;
-		} else {
+		if ((disabled_rb_mask & 3) == 2) {
 			/* RB1 disabled, RB0 enabled */
 			tmp = 0x00000000;
+		} else {
+			/* RB0 disabled, RB1 enabled */
+			tmp = 0x11111111;
 		}
 	} else {
 		tmp = gb_addr_config & NUM_PIPES_MASK;
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/r100.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/r100.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/r100.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:647 @ int r100_pci_gart_init(struct radeon_dev
 		return r;
 	rdev->gart.table_size = rdev->gart.num_gpu_pages * 4;
 	rdev->asic->gart.tlb_flush = &r100_pci_gart_tlb_flush;
+	rdev->asic->gart.get_page_entry = &r100_pci_gart_get_page_entry;
 	rdev->asic->gart.set_page = &r100_pci_gart_set_page;
 	return radeon_gart_table_ram_alloc(rdev);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:685 @ void r100_pci_gart_disable(struct radeon
 	WREG32(RADEON_AIC_HI_ADDR, 0);
 }
 
+uint64_t r100_pci_gart_get_page_entry(uint64_t addr, uint32_t flags)
+{
+	return addr;
+}
+
 void r100_pci_gart_set_page(struct radeon_device *rdev, unsigned i,
-			    uint64_t addr, uint32_t flags)
+			    uint64_t entry)
 {
 	u32 *gtt = rdev->gart.ptr;
-	gtt[i] = cpu_to_le32(lower_32_bits(addr));
+	gtt[i] = cpu_to_le32(lower_32_bits(entry));
 }
 
 void r100_pci_gart_fini(struct radeon_device *rdev)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:731 @ int r100_irq_set(struct radeon_device *r
 		tmp |= RADEON_FP2_DETECT_MASK;
 	}
 	WREG32(RADEON_GEN_INT_CNTL, tmp);
+
+	/* read back to post the write */
+	RREG32(RADEON_GEN_INT_CNTL);
+
 	return 0;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/r300.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/r300.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/r300.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:76 @ void rv370_pcie_gart_tlb_flush(struct ra
 #define R300_PTE_WRITEABLE (1 << 2)
 #define R300_PTE_READABLE  (1 << 3)
 
-void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
-			      uint64_t addr, uint32_t flags)
+uint64_t rv370_pcie_gart_get_page_entry(uint64_t addr, uint32_t flags)
 {
-	void __iomem *ptr = rdev->gart.ptr;
-
 	addr = (lower_32_bits(addr) >> 8) |
 		((upper_32_bits(addr) & 0xff) << 24);
 	if (flags & RADEON_GART_PAGE_READ)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:86 @ void rv370_pcie_gart_set_page(struct rad
 		addr |= R300_PTE_WRITEABLE;
 	if (!(flags & RADEON_GART_PAGE_SNOOP))
 		addr |= R300_PTE_UNSNOOPED;
+	return addr;
+}
+
+void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
+			      uint64_t entry)
+{
+	void __iomem *ptr = rdev->gart.ptr;
+
 	/* on x86 we want this to be CPU endian, on powerpc
 	 * on powerpc without HW swappers, it'll get swapped on way
 	 * into VRAM - so no need for cpu_to_le32 on VRAM tables */
-	writel(addr, ((void __iomem *)ptr) + (i * 4));
+	writel(entry, ((void __iomem *)ptr) + (i * 4));
 }
 
 int rv370_pcie_gart_init(struct radeon_device *rdev)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:117 @ int rv370_pcie_gart_init(struct radeon_d
 		DRM_ERROR("Failed to register debugfs file for PCIE gart !\n");
 	rdev->gart.table_size = rdev->gart.num_gpu_pages * 4;
 	rdev->asic->gart.tlb_flush = &rv370_pcie_gart_tlb_flush;
+	rdev->asic->gart.get_page_entry = &rv370_pcie_gart_get_page_entry;
 	rdev->asic->gart.set_page = &rv370_pcie_gart_set_page;
 	return radeon_gart_table_vram_alloc(rdev);
 }
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/r600.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/r600.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/r600.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3790 @ int r600_irq_set(struct radeon_device *r
 		WREG32(RV770_CG_THERMAL_INT, thermal_int);
 	}
 
+	/* posting read */
+	RREG32(R_000E50_SRBM_STATUS);
+
 	return 0;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/r600_dpm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/r600_dpm.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/r600_dpm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:191 @ u32 r600_dpm_get_vrefresh(struct radeon_
 		list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
 			radeon_crtc = to_radeon_crtc(crtc);
 			if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
-				vrefresh = radeon_crtc->hw_mode.vrefresh;
+				vrefresh = drm_mode_vrefresh(&radeon_crtc->hw_mode);
 				break;
 			}
 		}
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon.h
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:248 @ bool radeon_get_bios(struct radeon_devic
  * Dummy page
  */
 struct radeon_dummy_page {
+	uint64_t	entry;
 	struct page	*page;
 	dma_addr_t	addr;
 };
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:630 @ struct radeon_gart {
 	unsigned			table_size;
 	struct page			**pages;
 	dma_addr_t			*pages_addr;
+	uint64_t			*pages_entry;
 	bool				ready;
 };
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1547 @ struct radeon_dpm {
 	int			new_active_crtc_count;
 	u32			current_active_crtcs;
 	int			current_active_crtc_count;
+	bool single_display;
 	struct radeon_dpm_dynamic_state dyn_state;
 	struct radeon_dpm_fan fan;
 	u32 tdp_limit;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1825 @ struct radeon_asic {
 	/* gart */
 	struct {
 		void (*tlb_flush)(struct radeon_device *rdev);
+		uint64_t (*get_page_entry)(uint64_t addr, uint32_t flags);
 		void (*set_page)(struct radeon_device *rdev, unsigned i,
-				 uint64_t addr, uint32_t flags);
+				 uint64_t entry);
 	} gart;
 	struct {
 		int (*init)(struct radeon_device *rdev);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2825 @ static inline void radeon_ring_write(str
 #define radeon_vga_set_state(rdev, state) (rdev)->asic->vga_set_state((rdev), (state))
 #define radeon_asic_reset(rdev) (rdev)->asic->asic_reset((rdev))
 #define radeon_gart_tlb_flush(rdev) (rdev)->asic->gart.tlb_flush((rdev))
-#define radeon_gart_set_page(rdev, i, p, f) (rdev)->asic->gart.set_page((rdev), (i), (p), (f))
+#define radeon_gart_get_page_entry(a, f) (rdev)->asic->gart.get_page_entry((a), (f))
+#define radeon_gart_set_page(rdev, i, e) (rdev)->asic->gart.set_page((rdev), (i), (e))
 #define radeon_asic_vm_init(rdev) (rdev)->asic->vm.init((rdev))
 #define radeon_asic_vm_fini(rdev) (rdev)->asic->vm.fini((rdev))
 #define radeon_asic_vm_copy_pages(rdev, ib, pe, src, count) ((rdev)->asic->vm.copy_pages((rdev), (ib), (pe), (src), (count)))
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_asic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_asic.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_asic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:162 @ void radeon_agp_disable(struct radeon_de
 		DRM_INFO("Forcing AGP to PCIE mode\n");
 		rdev->flags |= RADEON_IS_PCIE;
 		rdev->asic->gart.tlb_flush = &rv370_pcie_gart_tlb_flush;
+		rdev->asic->gart.get_page_entry = &rv370_pcie_gart_get_page_entry;
 		rdev->asic->gart.set_page = &rv370_pcie_gart_set_page;
 	} else {
 		DRM_INFO("Forcing AGP to PCI mode\n");
 		rdev->flags |= RADEON_IS_PCI;
 		rdev->asic->gart.tlb_flush = &r100_pci_gart_tlb_flush;
+		rdev->asic->gart.get_page_entry = &r100_pci_gart_get_page_entry;
 		rdev->asic->gart.set_page = &r100_pci_gart_set_page;
 	}
 	rdev->mc.gtt_size = radeon_gart_size * 1024 * 1024;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:204 @ static struct radeon_asic r100_asic = {
 	.mc_wait_for_idle = &r100_mc_wait_for_idle,
 	.gart = {
 		.tlb_flush = &r100_pci_gart_tlb_flush,
+		.get_page_entry = &r100_pci_gart_get_page_entry,
 		.set_page = &r100_pci_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:271 @ static struct radeon_asic r200_asic = {
 	.mc_wait_for_idle = &r100_mc_wait_for_idle,
 	.gart = {
 		.tlb_flush = &r100_pci_gart_tlb_flush,
+		.get_page_entry = &r100_pci_gart_get_page_entry,
 		.set_page = &r100_pci_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:340 @ static struct radeon_asic_ring r300_gfx_
 	.set_wptr = &r100_gfx_set_wptr,
 };
 
+static struct radeon_asic_ring rv515_gfx_ring = {
+	.ib_execute = &r100_ring_ib_execute,
+	.emit_fence = &r300_fence_ring_emit,
+	.emit_semaphore = &r100_semaphore_ring_emit,
+	.cs_parse = &r300_cs_parse,
+	.ring_start = &rv515_ring_start,
+	.ring_test = &r100_ring_test,
+	.ib_test = &r100_ib_test,
+	.is_lockup = &r100_gpu_is_lockup,
+	.get_rptr = &r100_gfx_get_rptr,
+	.get_wptr = &r100_gfx_get_wptr,
+	.set_wptr = &r100_gfx_set_wptr,
+};
+
 static struct radeon_asic r300_asic = {
 	.init = &r300_init,
 	.fini = &r300_fini,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:366 @ static struct radeon_asic r300_asic = {
 	.mc_wait_for_idle = &r300_mc_wait_for_idle,
 	.gart = {
 		.tlb_flush = &r100_pci_gart_tlb_flush,
+		.get_page_entry = &r100_pci_gart_get_page_entry,
 		.set_page = &r100_pci_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:433 @ static struct radeon_asic r300_asic_pcie
 	.mc_wait_for_idle = &r300_mc_wait_for_idle,
 	.gart = {
 		.tlb_flush = &rv370_pcie_gart_tlb_flush,
+		.get_page_entry = &rv370_pcie_gart_get_page_entry,
 		.set_page = &rv370_pcie_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:500 @ static struct radeon_asic r420_asic = {
 	.mc_wait_for_idle = &r300_mc_wait_for_idle,
 	.gart = {
 		.tlb_flush = &rv370_pcie_gart_tlb_flush,
+		.get_page_entry = &rv370_pcie_gart_get_page_entry,
 		.set_page = &rv370_pcie_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:567 @ static struct radeon_asic rs400_asic = {
 	.mc_wait_for_idle = &rs400_mc_wait_for_idle,
 	.gart = {
 		.tlb_flush = &rs400_gart_tlb_flush,
+		.get_page_entry = &rs400_gart_get_page_entry,
 		.set_page = &rs400_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:634 @ static struct radeon_asic rs600_asic = {
 	.mc_wait_for_idle = &rs600_mc_wait_for_idle,
 	.gart = {
 		.tlb_flush = &rs600_gart_tlb_flush,
+		.get_page_entry = &rs600_gart_get_page_entry,
 		.set_page = &rs600_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:703 @ static struct radeon_asic rs690_asic = {
 	.mc_wait_for_idle = &rs690_mc_wait_for_idle,
 	.gart = {
 		.tlb_flush = &rs400_gart_tlb_flush,
+		.get_page_entry = &rs400_gart_get_page_entry,
 		.set_page = &rs400_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:772 @ static struct radeon_asic rv515_asic = {
 	.mc_wait_for_idle = &rv515_mc_wait_for_idle,
 	.gart = {
 		.tlb_flush = &rv370_pcie_gart_tlb_flush,
+		.get_page_entry = &rv370_pcie_gart_get_page_entry,
 		.set_page = &rv370_pcie_gart_set_page,
 	},
 	.ring = {
-		[RADEON_RING_TYPE_GFX_INDEX] = &r300_gfx_ring
+		[RADEON_RING_TYPE_GFX_INDEX] = &rv515_gfx_ring
 	},
 	.irq = {
 		.set = &rs600_irq_set,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:839 @ static struct radeon_asic r520_asic = {
 	.mc_wait_for_idle = &r520_mc_wait_for_idle,
 	.gart = {
 		.tlb_flush = &rv370_pcie_gart_tlb_flush,
+		.get_page_entry = &rv370_pcie_gart_get_page_entry,
 		.set_page = &rv370_pcie_gart_set_page,
 	},
 	.ring = {
-		[RADEON_RING_TYPE_GFX_INDEX] = &r300_gfx_ring
+		[RADEON_RING_TYPE_GFX_INDEX] = &rv515_gfx_ring
 	},
 	.irq = {
 		.set = &rs600_irq_set,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:934 @ static struct radeon_asic r600_asic = {
 	.get_gpu_clock_counter = &r600_get_gpu_clock_counter,
 	.gart = {
 		.tlb_flush = &r600_pcie_gart_tlb_flush,
+		.get_page_entry = &rs600_gart_get_page_entry,
 		.set_page = &rs600_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1020 @ static struct radeon_asic rv6xx_asic = {
 	.get_gpu_clock_counter = &r600_get_gpu_clock_counter,
 	.gart = {
 		.tlb_flush = &r600_pcie_gart_tlb_flush,
+		.get_page_entry = &rs600_gart_get_page_entry,
 		.set_page = &rs600_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1112 @ static struct radeon_asic rs780_asic = {
 	.get_gpu_clock_counter = &r600_get_gpu_clock_counter,
 	.gart = {
 		.tlb_flush = &r600_pcie_gart_tlb_flush,
+		.get_page_entry = &rs600_gart_get_page_entry,
 		.set_page = &rs600_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1217 @ static struct radeon_asic rv770_asic = {
 	.get_gpu_clock_counter = &r600_get_gpu_clock_counter,
 	.gart = {
 		.tlb_flush = &r600_pcie_gart_tlb_flush,
+		.get_page_entry = &rs600_gart_get_page_entry,
 		.set_page = &rs600_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1336 @ static struct radeon_asic evergreen_asic
 	.get_gpu_clock_counter = &r600_get_gpu_clock_counter,
 	.gart = {
 		.tlb_flush = &evergreen_pcie_gart_tlb_flush,
+		.get_page_entry = &rs600_gart_get_page_entry,
 		.set_page = &rs600_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1429 @ static struct radeon_asic sumo_asic = {
 	.get_gpu_clock_counter = &r600_get_gpu_clock_counter,
 	.gart = {
 		.tlb_flush = &evergreen_pcie_gart_tlb_flush,
+		.get_page_entry = &rs600_gart_get_page_entry,
 		.set_page = &rs600_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1521 @ static struct radeon_asic btc_asic = {
 	.get_gpu_clock_counter = &r600_get_gpu_clock_counter,
 	.gart = {
 		.tlb_flush = &evergreen_pcie_gart_tlb_flush,
+		.get_page_entry = &rs600_gart_get_page_entry,
 		.set_page = &rs600_gart_set_page,
 	},
 	.ring = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1657 @ static struct radeon_asic cayman_asic =
 	.get_gpu_clock_counter = &r600_get_gpu_clock_counter,
 	.gart = {
 		.tlb_flush = &cayman_pcie_gart_tlb_flush,
+		.get_page_entry = &rs600_gart_get_page_entry,
 		.set_page = &rs600_gart_set_page,
 	},
 	.vm = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1761 @ static struct radeon_asic trinity_asic =
 	.get_gpu_clock_counter = &r600_get_gpu_clock_counter,
 	.gart = {
 		.tlb_flush = &cayman_pcie_gart_tlb_flush,
+		.get_page_entry = &rs600_gart_get_page_entry,
 		.set_page = &rs600_gart_set_page,
 	},
 	.vm = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1895 @ static struct radeon_asic si_asic = {
 	.get_gpu_clock_counter = &si_get_gpu_clock_counter,
 	.gart = {
 		.tlb_flush = &si_pcie_gart_tlb_flush,
+		.get_page_entry = &rs600_gart_get_page_entry,
 		.set_page = &rs600_gart_set_page,
 	},
 	.vm = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2057 @ static struct radeon_asic ci_asic = {
 	.get_gpu_clock_counter = &cik_get_gpu_clock_counter,
 	.gart = {
 		.tlb_flush = &cik_pcie_gart_tlb_flush,
+		.get_page_entry = &rs600_gart_get_page_entry,
 		.set_page = &rs600_gart_set_page,
 	},
 	.vm = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2165 @ static struct radeon_asic kv_asic = {
 	.get_gpu_clock_counter = &cik_get_gpu_clock_counter,
 	.gart = {
 		.tlb_flush = &cik_pcie_gart_tlb_flush,
+		.get_page_entry = &rs600_gart_get_page_entry,
 		.set_page = &rs600_gart_set_page,
 	},
 	.vm = {
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_asic.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_asic.h
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_asic.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:70 @ bool r100_gpu_is_lockup(struct radeon_de
 int r100_asic_reset(struct radeon_device *rdev);
 u32 r100_get_vblank_counter(struct radeon_device *rdev, int crtc);
 void r100_pci_gart_tlb_flush(struct radeon_device *rdev);
+uint64_t r100_pci_gart_get_page_entry(uint64_t addr, uint32_t flags);
 void r100_pci_gart_set_page(struct radeon_device *rdev, unsigned i,
-			    uint64_t addr, uint32_t flags);
+			    uint64_t entry);
 void r100_ring_start(struct radeon_device *rdev, struct radeon_ring *ring);
 int r100_irq_set(struct radeon_device *rdev);
 int r100_irq_process(struct radeon_device *rdev);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:176 @ extern void r300_fence_ring_emit(struct
 				struct radeon_fence *fence);
 extern int r300_cs_parse(struct radeon_cs_parser *p);
 extern void rv370_pcie_gart_tlb_flush(struct radeon_device *rdev);
+extern uint64_t rv370_pcie_gart_get_page_entry(uint64_t addr, uint32_t flags);
 extern void rv370_pcie_gart_set_page(struct radeon_device *rdev, unsigned i,
-				     uint64_t addr, uint32_t flags);
+				     uint64_t entry);
 extern void rv370_set_pcie_lanes(struct radeon_device *rdev, int lanes);
 extern int rv370_get_pcie_lanes(struct radeon_device *rdev);
 extern void r300_set_reg_safe(struct radeon_device *rdev);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:213 @ extern void rs400_fini(struct radeon_dev
 extern int rs400_suspend(struct radeon_device *rdev);
 extern int rs400_resume(struct radeon_device *rdev);
 void rs400_gart_tlb_flush(struct radeon_device *rdev);
+uint64_t rs400_gart_get_page_entry(uint64_t addr, uint32_t flags);
 void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
-			 uint64_t addr, uint32_t flags);
+			 uint64_t entry);
 uint32_t rs400_mc_rreg(struct radeon_device *rdev, uint32_t reg);
 void rs400_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
 int rs400_gart_init(struct radeon_device *rdev);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:238 @ int rs600_irq_process(struct radeon_devi
 void rs600_irq_disable(struct radeon_device *rdev);
 u32 rs600_get_vblank_counter(struct radeon_device *rdev, int crtc);
 void rs600_gart_tlb_flush(struct radeon_device *rdev);
+uint64_t rs600_gart_get_page_entry(uint64_t addr, uint32_t flags);
 void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
-			 uint64_t addr, uint32_t flags);
+			 uint64_t entry);
 uint32_t rs600_mc_rreg(struct radeon_device *rdev, uint32_t reg);
 void rs600_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
 void rs600_bandwidth_update(struct radeon_device *rdev);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_atombios.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_atombios.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_atombios.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3283 @ int radeon_atom_get_voltage_evv(struct r
 
 	args.in.ucVoltageType = VOLTAGE_TYPE_VDDC;
 	args.in.ucVoltageMode = ATOM_GET_VOLTAGE_EVV_VOLTAGE;
+	args.in.usVoltageLevel = cpu_to_le16(virtual_voltage_id);
 	args.in.ulSCLKFreq =
 		cpu_to_le32(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].clk);
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_benchmark.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_benchmark.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_benchmark.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:37 @
 
 static int radeon_benchmark_do_move(struct radeon_device *rdev, unsigned size,
 				    uint64_t saddr, uint64_t daddr,
-				    int flag, int n)
+				    int flag, int n,
+				    struct reservation_object *resv)
 {
 	unsigned long start_jiffies;
 	unsigned long end_jiffies;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:51 @ static int radeon_benchmark_do_move(stru
 		case RADEON_BENCHMARK_COPY_DMA:
 			fence = radeon_copy_dma(rdev, saddr, daddr,
 						size / RADEON_GPU_PAGE_SIZE,
-						NULL);
+						resv);
 			break;
 		case RADEON_BENCHMARK_COPY_BLIT:
 			fence = radeon_copy_blit(rdev, saddr, daddr,
 						 size / RADEON_GPU_PAGE_SIZE,
-						 NULL);
+						 resv);
 			break;
 		default:
 			DRM_ERROR("Unknown copy method\n");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:124 @ static void radeon_benchmark_move(struct
 
 	if (rdev->asic->copy.dma) {
 		time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
-						RADEON_BENCHMARK_COPY_DMA, n);
+						RADEON_BENCHMARK_COPY_DMA, n,
+						dobj->tbo.resv);
 		if (time < 0)
 			goto out_cleanup;
 		if (time > 0)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:135 @ static void radeon_benchmark_move(struct
 
 	if (rdev->asic->copy.blit) {
 		time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
-						RADEON_BENCHMARK_COPY_BLIT, n);
+						RADEON_BENCHMARK_COPY_BLIT, n,
+						dobj->tbo.resv);
 		if (time < 0)
 			goto out_cleanup;
 		if (time > 0)
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_bios.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_bios.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_bios.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:79 @ static bool igp_read_bios_from_vram(stru
 
 static bool radeon_read_bios(struct radeon_device *rdev)
 {
-	uint8_t __iomem *bios;
+	uint8_t __iomem *bios, val1, val2;
 	size_t size;
 
 	rdev->bios = NULL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:89 @ static bool radeon_read_bios(struct rade
 		return false;
 	}
 
-	if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) {
+	val1 = readb(&bios[0]);
+	val2 = readb(&bios[1]);
+
+	if (size == 0 || val1 != 0x55 || val2 != 0xaa) {
 		pci_unmap_rom(rdev->pdev, bios);
 		return false;
 	}
-	rdev->bios = kmemdup(bios, size, GFP_KERNEL);
+	rdev->bios = kzalloc(size, GFP_KERNEL);
 	if (rdev->bios == NULL) {
 		pci_unmap_rom(rdev->pdev, bios);
 		return false;
 	}
+	memcpy_fromio(rdev->bios, bios, size);
 	pci_unmap_rom(rdev->pdev, bios);
 	return true;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_cs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_cs.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_cs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:278 @ int radeon_cs_parser_init(struct radeon_
 	u32 ring = RADEON_CS_RING_GFX;
 	s32 priority = 0;
 
+	INIT_LIST_HEAD(&p->validated);
+
 	if (!cs->num_chunks) {
 		return 0;
 	}
+
 	/* get chunks */
-	INIT_LIST_HEAD(&p->validated);
 	p->idx = 0;
 	p->ib.sa_bo = NULL;
 	p->ib.semaphore = NULL;
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_device.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_device.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_device.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:746 @ int radeon_dummy_page_init(struct radeon
 		rdev->dummy_page.page = NULL;
 		return -ENOMEM;
 	}
+	rdev->dummy_page.entry = radeon_gart_get_page_entry(rdev->dummy_page.addr,
+							    RADEON_GART_PAGE_DUMMY);
 	return 0;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_display.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_display.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_display.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:962 @ void radeon_compute_pll_avivo(struct rad
 	if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV &&
 	    pll->flags & RADEON_PLL_USE_REF_DIV)
 		ref_div_max = pll->reference_div;
+	else if (pll->flags & RADEON_PLL_PREFER_MINM_OVER_MAXP)
+		/* fix for problems on RS880 */
+		ref_div_max = min(pll->max_ref_div, 7u);
 	else
 		ref_div_max = pll->max_ref_div;
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_encoders.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_encoders.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_encoders.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:182 @ static void radeon_encoder_add_backlight
 		    (rdev->pdev->subsystem_vendor == 0x1734) &&
 		    (rdev->pdev->subsystem_device == 0x1107))
 			use_bl = false;
+/* Older PPC macs use on-GPU backlight controller */
+#ifndef CONFIG_PPC_PMAC
 		/* disable native backlight control on older asics */
 		else if (rdev->family < CHIP_R600)
 			use_bl = false;
+#endif
 		else
 			use_bl = true;
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_fence.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_fence.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_fence.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1032 @ static inline bool radeon_test_signaled(
 	return test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->base.flags);
 }
 
+struct radeon_wait_cb {
+	struct fence_cb base;
+	struct task_struct *task;
+};
+
+static void
+radeon_fence_wait_cb(struct fence *fence, struct fence_cb *cb)
+{
+	struct radeon_wait_cb *wait =
+		container_of(cb, struct radeon_wait_cb, base);
+
+	wake_up_process(wait->task);
+}
+
 static signed long radeon_fence_default_wait(struct fence *f, bool intr,
 					     signed long t)
 {
 	struct radeon_fence *fence = to_radeon_fence(f);
 	struct radeon_device *rdev = fence->rdev;
-	bool signaled;
+	struct radeon_wait_cb cb;
+
+	cb.task = current;
+
+	if (fence_add_callback(f, &cb.base, radeon_fence_wait_cb))
+		return t;
 
-	fence_enable_sw_signaling(&fence->base);
+	while (t > 0) {
+		if (intr)
+			set_current_state(TASK_INTERRUPTIBLE);
+		else
+			set_current_state(TASK_UNINTERRUPTIBLE);
+
+		/*
+		 * radeon_test_signaled must be called after
+		 * set_current_state to prevent a race with wake_up_process
+		 */
+		if (radeon_test_signaled(fence))
+			break;
+
+		if (rdev->needs_reset) {
+			t = -EDEADLK;
+			break;
+		}
+
+		t = schedule_timeout(t);
+
+		if (t > 0 && intr && signal_pending(current))
+			t = -ERESTARTSYS;
+	}
 
-	/*
-	 * This function has to return -EDEADLK, but cannot hold
-	 * exclusive_lock during the wait because some callers
-	 * may already hold it. This means checking needs_reset without
-	 * lock, and not fiddling with any gpu internals.
-	 *
-	 * The callback installed with fence_enable_sw_signaling will
-	 * run before our wait_event_*timeout call, so we will see
-	 * both the signaled fence and the changes to needs_reset.
-	 */
-
-	if (intr)
-		t = wait_event_interruptible_timeout(rdev->fence_queue,
-			((signaled = radeon_test_signaled(fence)) ||
-			 rdev->needs_reset), t);
-	else
-		t = wait_event_timeout(rdev->fence_queue,
-			((signaled = radeon_test_signaled(fence)) ||
-			 rdev->needs_reset), t);
+	__set_current_state(TASK_RUNNING);
+	fence_remove_callback(f, &cb.base);
 
-	if (t > 0 && !signaled)
-		return -EDEADLK;
 	return t;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_gart.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_gart.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_gart.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:168 @ int radeon_gart_table_vram_pin(struct ra
 		radeon_bo_unpin(rdev->gart.robj);
 	radeon_bo_unreserve(rdev->gart.robj);
 	rdev->gart.table_addr = gpu_addr;
+
+	if (!r) {
+		int i;
+
+		/* We might have dropped some GART table updates while it wasn't
+		 * mapped, restore all entries
+		 */
+		for (i = 0; i < rdev->gart.num_gpu_pages; i++)
+			radeon_gart_set_page(rdev, i, rdev->gart.pages_entry[i]);
+		mb();
+		radeon_gart_tlb_flush(rdev);
+	}
+
 	return r;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:244 @ void radeon_gart_unbind(struct radeon_de
 	unsigned t;
 	unsigned p;
 	int i, j;
-	u64 page_base;
 
 	if (!rdev->gart.ready) {
 		WARN(1, "trying to unbind memory from uninitialized GART !\n");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:255 @ void radeon_gart_unbind(struct radeon_de
 		if (rdev->gart.pages[p]) {
 			rdev->gart.pages[p] = NULL;
 			rdev->gart.pages_addr[p] = rdev->dummy_page.addr;
-			page_base = rdev->gart.pages_addr[p];
 			for (j = 0; j < (PAGE_SIZE / RADEON_GPU_PAGE_SIZE); j++, t++) {
+				rdev->gart.pages_entry[t] = rdev->dummy_page.entry;
 				if (rdev->gart.ptr) {
-					radeon_gart_set_page(rdev, t, page_base,
-							     RADEON_GART_PAGE_DUMMY);
+					radeon_gart_set_page(rdev, t,
+							     rdev->dummy_page.entry);
 				}
-				page_base += RADEON_GPU_PAGE_SIZE;
 			}
 		}
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:288 @ int radeon_gart_bind(struct radeon_devic
 {
 	unsigned t;
 	unsigned p;
-	uint64_t page_base;
+	uint64_t page_base, page_entry;
 	int i, j;
 
 	if (!rdev->gart.ready) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:301 @ int radeon_gart_bind(struct radeon_devic
 	for (i = 0; i < pages; i++, p++) {
 		rdev->gart.pages_addr[p] = dma_addr[i];
 		rdev->gart.pages[p] = pagelist[i];
-		if (rdev->gart.ptr) {
-			page_base = rdev->gart.pages_addr[p];
-			for (j = 0; j < (PAGE_SIZE / RADEON_GPU_PAGE_SIZE); j++, t++) {
-				radeon_gart_set_page(rdev, t, page_base, flags);
-				page_base += RADEON_GPU_PAGE_SIZE;
+		page_base = dma_addr[i];
+		for (j = 0; j < (PAGE_SIZE / RADEON_GPU_PAGE_SIZE); j++, t++) {
+			page_entry = radeon_gart_get_page_entry(page_base, flags);
+			rdev->gart.pages_entry[t] = page_entry;
+			if (rdev->gart.ptr) {
+				radeon_gart_set_page(rdev, t, page_entry);
 			}
+			page_base += RADEON_GPU_PAGE_SIZE;
 		}
 	}
 	mb();
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:356 @ int radeon_gart_init(struct radeon_devic
 		radeon_gart_fini(rdev);
 		return -ENOMEM;
 	}
+	rdev->gart.pages_entry = vmalloc(sizeof(uint64_t) *
+					 rdev->gart.num_gpu_pages);
+	if (rdev->gart.pages_entry == NULL) {
+		radeon_gart_fini(rdev);
+		return -ENOMEM;
+	}
 	/* set GART entry to point to the dummy page by default */
-	for (i = 0; i < rdev->gart.num_cpu_pages; i++) {
+	for (i = 0; i < rdev->gart.num_cpu_pages; i++)
 		rdev->gart.pages_addr[i] = rdev->dummy_page.addr;
-	}
+	for (i = 0; i < rdev->gart.num_gpu_pages; i++)
+		rdev->gart.pages_entry[i] = rdev->dummy_page.entry;
 	return 0;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:379 @ int radeon_gart_init(struct radeon_devic
  */
 void radeon_gart_fini(struct radeon_device *rdev)
 {
-	if (rdev->gart.pages && rdev->gart.pages_addr && rdev->gart.ready) {
+	if (rdev->gart.ready) {
 		/* unbind pages */
 		radeon_gart_unbind(rdev, 0, rdev->gart.num_cpu_pages);
 	}
 	rdev->gart.ready = false;
 	vfree(rdev->gart.pages);
 	vfree(rdev->gart.pages_addr);
+	vfree(rdev->gart.pages_entry);
 	rdev->gart.pages = NULL;
 	rdev->gart.pages_addr = NULL;
+	rdev->gart.pages_entry = NULL;
 
 	radeon_dummy_page_fini(rdev);
 }
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_gem.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_gem.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_gem.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:149 @ int radeon_gem_object_open(struct drm_ge
 	struct radeon_bo_va *bo_va;
 	int r;
 
-	if (rdev->family < CHIP_CAYMAN) {
+	if ((rdev->family < CHIP_CAYMAN) ||
+	    (!rdev->accel_working)) {
 		return 0;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:180 @ void radeon_gem_object_close(struct drm_
 	struct radeon_bo_va *bo_va;
 	int r;
 
-	if (rdev->family < CHIP_CAYMAN) {
+	if ((rdev->family < CHIP_CAYMAN) ||
+	    (!rdev->accel_working)) {
 		return;
 	}
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_kms.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_kms.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_kms.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:601 @ int radeon_driver_open_kms(struct drm_de
 			return -ENOMEM;
 		}
 
-		vm = &fpriv->vm;
-		r = radeon_vm_init(rdev, vm);
-		if (r) {
-			kfree(fpriv);
-			return r;
-		}
-
 		if (rdev->accel_working) {
+			vm = &fpriv->vm;
+			r = radeon_vm_init(rdev, vm);
+			if (r) {
+				kfree(fpriv);
+				return r;
+			}
+
 			r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
 			if (r) {
 				radeon_vm_fini(rdev, vm);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:666 @ void radeon_driver_postclose_kms(struct
 					radeon_vm_bo_rmv(rdev, vm->ib_bo_va);
 				radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
 			}
+			radeon_vm_fini(rdev, vm);
 		}
 
-		radeon_vm_fini(rdev, vm);
 		kfree(fpriv);
 		file_priv->driver_priv = NULL;
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_mn.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_mn.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_mn.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:125 @ static void radeon_mn_invalidate_range_s
 	it = interval_tree_iter_first(&rmn->objects, start, end);
 	while (it) {
 		struct radeon_bo *bo;
-		struct fence *fence;
 		int r;
 
 		bo = container_of(it, struct radeon_bo, mn_it);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:136 @ static void radeon_mn_invalidate_range_s
 			continue;
 		}
 
-		fence = reservation_object_get_excl(bo->tbo.resv);
-		if (fence) {
-			r = radeon_fence_wait((struct radeon_fence *)fence, false);
-			if (r)
-				DRM_ERROR("(%d) failed to wait for user bo\n", r);
-		}
+		r = reservation_object_wait_timeout_rcu(bo->tbo.resv, true,
+			false, MAX_SCHEDULE_TIMEOUT);
+		if (r)
+			DRM_ERROR("(%d) failed to wait for user bo\n", r);
 
 		radeon_ttm_placement_from_domain(bo, RADEON_GEM_DOMAIN_CPU);
 		r = ttm_bo_validate(&bo->tbo, &bo->placement, false, false);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_object.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_object.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_object.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:154 @ void radeon_ttm_placement_from_domain(st
 		else
 			rbo->placements[i].lpfn = 0;
 	}
-
-	/*
-	 * Use two-ended allocation depending on the buffer size to
-	 * improve fragmentation quality.
-	 * 512kb was measured as the most optimal number.
-	 */
-	if (!((rbo->flags & RADEON_GEM_CPU_ACCESS) &&
-	      (rbo->placements[i].flags & TTM_PL_FLAG_VRAM)) &&
-	    rbo->tbo.mem.size > 512 * 1024) {
-		for (i = 0; i < c; i++) {
-			rbo->placements[i].flags |= TTM_PL_FLAG_TOPDOWN;
-		}
-	}
 }
 
 int radeon_bo_create(struct radeon_device *rdev,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:208 @ int radeon_bo_create(struct radeon_devic
 	 * See https://bugs.freedesktop.org/show_bug.cgi?id=84627
 	 */
 	bo->flags &= ~RADEON_GEM_GTT_WC;
+#elif defined(CONFIG_X86) && !defined(CONFIG_X86_PAT)
+	/* Don't try to enable write-combining when it can't work, or things
+	 * may be slow
+	 * See https://bugs.freedesktop.org/show_bug.cgi?id=88758
+	 */
+
+#warning Please enable CONFIG_MTRR and CONFIG_X86_PAT for better performance \
+	 thanks to write-combining
+
+	DRM_INFO_ONCE("Please enable CONFIG_MTRR and CONFIG_X86_PAT for "
+		      "better performance thanks to write-combining\n");
+	bo->flags &= ~RADEON_GEM_GTT_WC;
 #endif
 
 	radeon_ttm_placement_from_domain(bo, domain);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_pm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_pm.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_pm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:707 @ static void radeon_dpm_thermal_work_hand
 	radeon_pm_compute_clocks(rdev);
 }
 
-static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
-						     enum radeon_pm_state_type dpm_state)
+static bool radeon_dpm_single_display(struct radeon_device *rdev)
 {
-	int i;
-	struct radeon_ps *ps;
-	u32 ui_class;
 	bool single_display = (rdev->pm.dpm.new_active_crtc_count < 2) ?
 		true : false;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:718 @ static struct radeon_ps *radeon_dpm_pick
 			single_display = false;
 	}
 
+	return single_display;
+}
+
+static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
+						     enum radeon_pm_state_type dpm_state)
+{
+	int i;
+	struct radeon_ps *ps;
+	u32 ui_class;
+	bool single_display = radeon_dpm_single_display(rdev);
+
 	/* certain older asics have a separare 3D performance state,
 	 * so try that first if the user selected performance
 	 */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:854 @ static void radeon_dpm_change_power_stat
 	struct radeon_ps *ps;
 	enum radeon_pm_state_type dpm_state;
 	int ret;
+	bool single_display = radeon_dpm_single_display(rdev);
 
 	/* if dpm init failed */
 	if (!rdev->pm.dpm_enabled)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:879 @ static void radeon_dpm_change_power_stat
 		/* vce just modifies an existing state so force a change */
 		if (ps->vce_active != rdev->pm.dpm.vce_active)
 			goto force;
+		/* user has made a display change (such as timing) */
+		if (rdev->pm.dpm.single_display != single_display)
+			goto force;
 		if ((rdev->family < CHIP_BARTS) || (rdev->flags & RADEON_IS_IGP)) {
 			/* for pre-BTC and APUs if the num crtcs changed but state is the same,
 			 * all we need to do is update the display configuration.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:944 @ force:
 
 	rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs;
 	rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count;
+	rdev->pm.dpm.single_display = single_display;
 
 	/* wait for the rings to drain */
 	for (i = 0; i < RADEON_NUM_RINGS; i++) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1302 @ dpm_failed:
 	return ret;
 }
 
+struct radeon_dpm_quirk {
+	u32 chip_vendor;
+	u32 chip_device;
+	u32 subsys_vendor;
+	u32 subsys_device;
+};
+
+/* cards with dpm stability problems */
+static struct radeon_dpm_quirk radeon_dpm_quirk_list[] = {
+	/* TURKS - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1386534 */
+	{ PCI_VENDOR_ID_ATI, 0x6759, 0x1682, 0x3195 },
+	/* TURKS - https://bugzilla.kernel.org/show_bug.cgi?id=83731 */
+	{ PCI_VENDOR_ID_ATI, 0x6840, 0x1179, 0xfb81 },
+	{ 0, 0, 0, 0 },
+};
+
 int radeon_pm_init(struct radeon_device *rdev)
 {
+	struct radeon_dpm_quirk *p = radeon_dpm_quirk_list;
+	bool disable_dpm = false;
+
+	/* Apply dpm quirks */
+	while (p && p->chip_device != 0) {
+		if (rdev->pdev->vendor == p->chip_vendor &&
+		    rdev->pdev->device == p->chip_device &&
+		    rdev->pdev->subsystem_vendor == p->subsys_vendor &&
+		    rdev->pdev->subsystem_device == p->subsys_device) {
+			disable_dpm = true;
+			break;
+		}
+		++p;
+	}
+
 	/* enable dpm on rv6xx+ */
 	switch (rdev->family) {
 	case CHIP_RV610:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1390 @ int radeon_pm_init(struct radeon_device
 			 (!(rdev->flags & RADEON_IS_IGP)) &&
 			 (!rdev->smc_fw))
 			rdev->pm.pm_method = PM_METHOD_PROFILE;
+		else if (disable_dpm && (radeon_dpm == -1))
+			rdev->pm.pm_method = PM_METHOD_PROFILE;
 		else if (radeon_dpm == 0)
 			rdev->pm.pm_method = PM_METHOD_PROFILE;
 		else
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_test.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_test.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_test.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:122 @ static void radeon_do_test_moves(struct
 		if (ring == R600_RING_TYPE_DMA_INDEX)
 			fence = radeon_copy_dma(rdev, gtt_addr, vram_addr,
 						size / RADEON_GPU_PAGE_SIZE,
-						NULL);
+						vram_obj->tbo.resv);
 		else
 			fence = radeon_copy_blit(rdev, gtt_addr, vram_addr,
 						 size / RADEON_GPU_PAGE_SIZE,
-						 NULL);
+						 vram_obj->tbo.resv);
 		if (IS_ERR(fence)) {
 			DRM_ERROR("Failed GTT->VRAM copy %d\n", i);
 			r = PTR_ERR(fence);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:173 @ static void radeon_do_test_moves(struct
 		if (ring == R600_RING_TYPE_DMA_INDEX)
 			fence = radeon_copy_dma(rdev, vram_addr, gtt_addr,
 						size / RADEON_GPU_PAGE_SIZE,
-						NULL);
+						vram_obj->tbo.resv);
 		else
 			fence = radeon_copy_blit(rdev, vram_addr, gtt_addr,
 						 size / RADEON_GPU_PAGE_SIZE,
-						 NULL);
+						 vram_obj->tbo.resv);
 		if (IS_ERR(fence)) {
 			DRM_ERROR("Failed VRAM->GTT copy %d\n", i);
 			r = PTR_ERR(fence);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_ttm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_ttm.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_ttm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:199 @ static void radeon_evict_flags(struct tt
 	rbo = container_of(bo, struct radeon_bo, tbo);
 	switch (bo->mem.mem_type) {
 	case TTM_PL_VRAM:
-		if (rbo->rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ready == false)
+		if (rbo->rdev->ring[radeon_copy_ring_index(rbo->rdev)].ready == false)
 			radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU);
 		else
 			radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:578 @ static void radeon_ttm_tt_unpin_userptr(
 	enum dma_data_direction direction = write ?
 		DMA_BIDIRECTIONAL : DMA_TO_DEVICE;
 
+	/* double check that we don't free the table twice */
+	if (!ttm->sg->sgl)
+		return;
+
 	/* free the sg table and pages again */
 	dma_unmap_sg(rdev->dev, ttm->sg->sgl, ttm->sg->nents, direction);
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_vm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/radeon_vm.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/radeon_vm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:756 @ static void radeon_vm_frag_ptes(struct r
 	 */
 
 	/* NI is optimized for 256KB fragments, SI and newer for 64KB */
-	uint64_t frag_flags = rdev->family == CHIP_CAYMAN ?
+	uint64_t frag_flags = ((rdev->family == CHIP_CAYMAN) ||
+			       (rdev->family == CHIP_ARUBA)) ?
 			R600_PTE_FRAG_256KB : R600_PTE_FRAG_64KB;
-	uint64_t frag_align = rdev->family == CHIP_CAYMAN ? 0x200 : 0x80;
+	uint64_t frag_align = ((rdev->family == CHIP_CAYMAN) ||
+			       (rdev->family == CHIP_ARUBA)) ? 0x200 : 0x80;
 
 	uint64_t frag_start = ALIGN(pe_start, frag_align);
 	uint64_t frag_end = pe_end & ~(frag_align - 1);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/rs400.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/rs400.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/rs400.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:215 @ void rs400_gart_fini(struct radeon_devic
 #define RS400_PTE_WRITEABLE (1 << 2)
 #define RS400_PTE_READABLE  (1 << 3)
 
-void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
-			 uint64_t addr, uint32_t flags)
+uint64_t rs400_gart_get_page_entry(uint64_t addr, uint32_t flags)
 {
 	uint32_t entry;
-	u32 *gtt = rdev->gart.ptr;
 
 	entry = (lower_32_bits(addr) & PAGE_MASK) |
 		((upper_32_bits(addr) & 0xff) << 4);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:227 @ void rs400_gart_set_page(struct radeon_d
 		entry |= RS400_PTE_WRITEABLE;
 	if (!(flags & RADEON_GART_PAGE_SNOOP))
 		entry |= RS400_PTE_UNSNOOPED;
-	entry = cpu_to_le32(entry);
-	gtt[i] = entry;
+	return entry;
+}
+
+void rs400_gart_set_page(struct radeon_device *rdev, unsigned i,
+			 uint64_t entry)
+{
+	u32 *gtt = rdev->gart.ptr;
+	gtt[i] = cpu_to_le32(lower_32_bits(entry));
 }
 
 int rs400_mc_wait_for_idle(struct radeon_device *rdev)
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/rs600.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/rs600.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/rs600.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:628 @ static void rs600_gart_fini(struct radeo
 	radeon_gart_table_vram_free(rdev);
 }
 
-void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
-			 uint64_t addr, uint32_t flags)
+uint64_t rs600_gart_get_page_entry(uint64_t addr, uint32_t flags)
 {
-	void __iomem *ptr = (void *)rdev->gart.ptr;
-
 	addr = addr & 0xFFFFFFFFFFFFF000ULL;
 	addr |= R600_PTE_SYSTEM;
 	if (flags & RADEON_GART_PAGE_VALID)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:640 @ void rs600_gart_set_page(struct radeon_d
 		addr |= R600_PTE_WRITEABLE;
 	if (flags & RADEON_GART_PAGE_SNOOP)
 		addr |= R600_PTE_SNOOPED;
-	writeq(addr, ptr + (i * 8));
+	return addr;
+}
+
+void rs600_gart_set_page(struct radeon_device *rdev, unsigned i,
+			 uint64_t entry)
+{
+	void __iomem *ptr = (void *)rdev->gart.ptr;
+	writeq(entry, ptr + (i * 8));
 }
 
 int rs600_irq_set(struct radeon_device *rdev)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:696 @ int rs600_irq_set(struct radeon_device *
 	WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
 	if (ASIC_IS_DCE2(rdev))
 		WREG32(R_007408_HDMI0_AUDIO_PACKET_CONTROL, hdmi0);
+
+	/* posting read */
+	RREG32(R_000040_GEN_INT_CNTL);
+
 	return 0;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/si.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/si.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/si.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6195 @ int si_irq_set(struct radeon_device *rde
 
 	WREG32(CG_THERMAL_INT, thermal_int);
 
+	/* posting read */
+	RREG32(SRBM_STATUS);
+
 	return 0;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7118 @ int si_set_uvd_clocks(struct radeon_devi
 	WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK);
 
 	if (!vclk || !dclk) {
-		/* keep the Bypass mode, put PLL to sleep */
-		WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
+		/* keep the Bypass mode */
 		return 0;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7134 @ int si_set_uvd_clocks(struct radeon_devi
 	/* set VCO_MODE to 1 */
 	WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK);
 
-	/* toggle UPLL_SLEEP to 1 then back to 0 */
-	WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
+	/* disable sleep mode */
 	WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK);
 
 	/* deassert UPLL_RESET */
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/si_dpm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/radeon/si_dpm.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/radeon/si_dpm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2911 @ static int si_init_smc_spll_table(struct
 	return ret;
 }
 
+struct si_dpm_quirk {
+	u32 chip_vendor;
+	u32 chip_device;
+	u32 subsys_vendor;
+	u32 subsys_device;
+	u32 max_sclk;
+	u32 max_mclk;
+};
+
+/* cards with dpm stability problems */
+static struct si_dpm_quirk si_dpm_quirk_list[] = {
+	/* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
+	{ PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
+	{ 0, 0, 0, 0 },
+};
+
 static void si_apply_state_adjust_rules(struct radeon_device *rdev,
 					struct radeon_ps *rps)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2937 @ static void si_apply_state_adjust_rules(
 	u32 mclk, sclk;
 	u16 vddc, vddci;
 	u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
+	u32 max_sclk = 0, max_mclk = 0;
 	int i;
+	struct si_dpm_quirk *p = si_dpm_quirk_list;
+
+	/* Apply dpm quirks */
+	while (p && p->chip_device != 0) {
+		if (rdev->pdev->vendor == p->chip_vendor &&
+		    rdev->pdev->device == p->chip_device &&
+		    rdev->pdev->subsystem_vendor == p->subsys_vendor &&
+		    rdev->pdev->subsystem_device == p->subsys_device) {
+			max_sclk = p->max_sclk;
+			max_mclk = p->max_mclk;
+			break;
+		}
+		++p;
+	}
 
 	if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
 	    ni_dpm_vblank_too_short(rdev))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3006 @ static void si_apply_state_adjust_rules(
 			if (ps->performance_levels[i].mclk > max_mclk_vddc)
 				ps->performance_levels[i].mclk = max_mclk_vddc;
 		}
+		if (max_mclk) {
+			if (ps->performance_levels[i].mclk > max_mclk)
+				ps->performance_levels[i].mclk = max_mclk;
+		}
+		if (max_sclk) {
+			if (ps->performance_levels[i].sclk > max_sclk)
+				ps->performance_levels[i].sclk = max_sclk;
+		}
 	}
 
 	/* XXX validate the min clocks required for display */
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/tegra/drm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/tegra/drm.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/tegra/drm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:155 @ static int host1x_reloc_copy_from_user(s
 	if (err < 0)
 		return err;
 
-	err = get_user(dest->target.offset, &src->cmdbuf.offset);
+	err = get_user(dest->target.offset, &src->target.offset);
 	if (err < 0)
 		return err;
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/tegra/gem.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/tegra/gem.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/tegra/gem.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:262 @ void tegra_bo_free_object(struct drm_gem
 int tegra_bo_dumb_create(struct drm_file *file, struct drm_device *drm,
 			 struct drm_mode_create_dumb *args)
 {
-	int min_pitch = DIV_ROUND_UP(args->width * args->bpp, 8);
+	unsigned int min_pitch = DIV_ROUND_UP(args->width * args->bpp, 8);
 	struct tegra_drm *tegra = drm->dev_private;
 	struct tegra_bo *bo;
 
-	min_pitch = round_up(min_pitch, tegra->pitch_align);
-	if (args->pitch < min_pitch)
-		args->pitch = min_pitch;
-
-	if (args->size < args->pitch * args->height)
-		args->size = args->pitch * args->height;
+	args->pitch = round_up(min_pitch, tegra->pitch_align);
+	args->size = args->pitch * args->height;
 
 	bo = tegra_bo_create_with_handle(file, drm, args->size, 0,
 					 &args->handle);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/ttm/ttm_page_alloc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/ttm/ttm_page_alloc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:300 @ static void ttm_pool_update_free_locked(
  *
  * @pool: to free the pages from
  * @free_all: If set to true will free all pages in pool
- * @gfp: GFP flags.
+ * @use_static: Safe to use static buffer
  **/
 static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free,
-			      gfp_t gfp)
+			      bool use_static)
 {
+	static struct page *static_buf[NUM_PAGES_TO_ALLOC];
 	unsigned long irq_flags;
 	struct page *p;
 	struct page **pages_to_free;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:315 @ static int ttm_page_pool_free(struct ttm
 	if (NUM_PAGES_TO_ALLOC < nr_free)
 		npages_to_free = NUM_PAGES_TO_ALLOC;
 
-	pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp);
+	if (use_static)
+		pages_to_free = static_buf;
+	else
+		pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
+					GFP_KERNEL);
 	if (!pages_to_free) {
 		pr_err("Failed to allocate memory for pool free operation\n");
 		return 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:382 @ restart:
 	if (freed_pages)
 		ttm_pages_put(pages_to_free, freed_pages);
 out:
-	kfree(pages_to_free);
+	if (pages_to_free != static_buf)
+		kfree(pages_to_free);
 	return nr_free;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:392 @ out:
  *
  * XXX: (dchinner) Deadlock warning!
  *
- * We need to pass sc->gfp_mask to ttm_page_pool_free().
- *
  * This code is crying out for a shrinker per pool....
  */
 static unsigned long
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:414 @ ttm_pool_shrink_scan(struct shrinker *sh
 		if (shrink_pages == 0)
 			break;
 		pool = &_manager->pools[(i + pool_offset)%NUM_POOLS];
-		shrink_pages = ttm_page_pool_free(pool, nr_free,
-						  sc->gfp_mask);
+		/* OK to use static buffer since global mutex is held. */
+		shrink_pages = ttm_page_pool_free(pool, nr_free, true);
 		freed += nr_free - shrink_pages;
 	}
 	mutex_unlock(&lock);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:717 @ static void ttm_put_pages(struct page **
 	}
 	spin_unlock_irqrestore(&pool->lock, irq_flags);
 	if (npages)
-		ttm_page_pool_free(pool, npages, GFP_KERNEL);
+		ttm_page_pool_free(pool, npages, false);
 }
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:856 @ void ttm_page_alloc_fini(void)
 	pr_info("Finalizing pool allocator\n");
 	ttm_pool_mm_shrink_fini(_manager);
 
+	/* OK to use static buffer since global mutex is no longer used. */
 	for (i = 0; i < NUM_POOLS; ++i)
-		ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES,
-				   GFP_KERNEL);
+		ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES, true);
 
 	kobject_put(&_manager->kobj);
 	_manager = NULL;
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:414 @ static void ttm_dma_page_put(struct dma_
  *
  * @pool: to free the pages from
  * @nr_free: If set to true will free all pages in pool
- * @gfp: GFP flags.
+ * @use_static: Safe to use static buffer
  **/
 static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free,
-				       gfp_t gfp)
+				       bool use_static)
 {
+	static struct page *static_buf[NUM_PAGES_TO_ALLOC];
 	unsigned long irq_flags;
 	struct dma_page *dma_p, *tmp;
 	struct page **pages_to_free;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:436 @ static unsigned ttm_dma_page_pool_free(s
 			 npages_to_free, nr_free);
 	}
 #endif
-	pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp);
+	if (use_static)
+		pages_to_free = static_buf;
+	else
+		pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
+					GFP_KERNEL);
 
 	if (!pages_to_free) {
 		pr_err("%s: Failed to allocate memory for pool free operation\n",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:510 @ restart:
 	if (freed_pages)
 		ttm_dma_pages_put(pool, &d_pages, pages_to_free, freed_pages);
 out:
-	kfree(pages_to_free);
+	if (pages_to_free != static_buf)
+		kfree(pages_to_free);
 	return nr_free;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:540 @ static void ttm_dma_free_pool(struct dev
 		if (pool->type != type)
 			continue;
 		/* Takes a spinlock.. */
-		ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, GFP_KERNEL);
+		/* OK to use static buffer since global mutex is held. */
+		ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, true);
 		WARN_ON(((pool->npages_in_use + pool->npages_free) != 0));
 		/* This code path is called after _all_ references to the
 		 * struct device has been dropped - so nobody should be
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:996 @ void ttm_dma_unpopulate(struct ttm_dma_t
 
 	/* shrink pool if necessary (only on !is_cached pools)*/
 	if (npages)
-		ttm_dma_page_pool_free(pool, npages, GFP_KERNEL);
+		ttm_dma_page_pool_free(pool, npages, false);
 	ttm->state = tt_unpopulated;
 }
 EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1006 @ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
  *
  * XXX: (dchinner) Deadlock warning!
  *
- * We need to pass sc->gfp_mask to ttm_dma_page_pool_free().
- *
  * I'm getting sadder as I hear more pathetical whimpers about needing per-pool
  * shrinkers
  */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1038 @ ttm_dma_pool_shrink_scan(struct shrinker
 		if (++idx < pool_offset)
 			continue;
 		nr_free = shrink_pages;
-		shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free,
-						      sc->gfp_mask);
+		/* OK to use static buffer since global mutex is held. */
+		shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free, true);
 		freed += nr_free - shrink_pages;
 
 		pr_debug("%s: (%s:%d) Asked to shrink %d, have %d more to go\n",
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:409 @ int vmw_3d_resource_inc(struct vmw_priva
 		if (unlikely(ret != 0))
 			--dev_priv->num_3d_resources;
 	} else if (unhide_svga) {
-		mutex_lock(&dev_priv->hw_mutex);
 		vmw_write(dev_priv, SVGA_REG_ENABLE,
 			  vmw_read(dev_priv, SVGA_REG_ENABLE) &
 			  ~SVGA_REG_ENABLE_HIDE);
-		mutex_unlock(&dev_priv->hw_mutex);
 	}
 
 	mutex_unlock(&dev_priv->release_mutex);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:434 @ void vmw_3d_resource_dec(struct vmw_priv
 	mutex_lock(&dev_priv->release_mutex);
 	if (unlikely(--dev_priv->num_3d_resources == 0))
 		vmw_release_device(dev_priv);
-	else if (hide_svga) {
-		mutex_lock(&dev_priv->hw_mutex);
+	else if (hide_svga)
 		vmw_write(dev_priv, SVGA_REG_ENABLE,
 			  vmw_read(dev_priv, SVGA_REG_ENABLE) |
 			  SVGA_REG_ENABLE_HIDE);
-		mutex_unlock(&dev_priv->hw_mutex);
-	}
 
 	n3d = (int32_t) dev_priv->num_3d_resources;
 	mutex_unlock(&dev_priv->release_mutex);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:598 @ static int vmw_driver_load(struct drm_de
 	dev_priv->dev = dev;
 	dev_priv->vmw_chipset = chipset;
 	dev_priv->last_read_seqno = (uint32_t) -100;
-	mutex_init(&dev_priv->hw_mutex);
 	mutex_init(&dev_priv->cmdbuf_mutex);
 	mutex_init(&dev_priv->release_mutex);
 	mutex_init(&dev_priv->binding_mutex);
 	rwlock_init(&dev_priv->resource_lock);
 	ttm_lock_init(&dev_priv->reservation_sem);
+	spin_lock_init(&dev_priv->hw_lock);
+	spin_lock_init(&dev_priv->waiter_lock);
+	spin_lock_init(&dev_priv->cap_lock);
 
 	for (i = vmw_res_context; i < vmw_res_max; ++i) {
 		idr_init(&dev_priv->res_idr[i]);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:626 @ static int vmw_driver_load(struct drm_de
 
 	dev_priv->enable_fb = enable_fbdev;
 
-	mutex_lock(&dev_priv->hw_mutex);
-
 	vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
 	svga_id = vmw_read(dev_priv, SVGA_REG_ID);
 	if (svga_id != SVGA_ID_2) {
 		ret = -ENOSYS;
 		DRM_ERROR("Unsupported SVGA ID 0x%x\n", svga_id);
-		mutex_unlock(&dev_priv->hw_mutex);
 		goto out_err0;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:680 @ static int vmw_driver_load(struct drm_de
 		dev_priv->prim_bb_mem = dev_priv->vram_size;
 
 	ret = vmw_dma_masks(dev_priv);
-	if (unlikely(ret != 0)) {
-		mutex_unlock(&dev_priv->hw_mutex);
+	if (unlikely(ret != 0))
 		goto out_err0;
-	}
 
 	/*
 	 * Limit back buffer size to VRAM size.  Remove this once
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:690 @ static int vmw_driver_load(struct drm_de
 	if (dev_priv->prim_bb_mem > dev_priv->vram_size)
 		dev_priv->prim_bb_mem = dev_priv->vram_size;
 
-	mutex_unlock(&dev_priv->hw_mutex);
-
 	vmw_print_capabilities(dev_priv->capabilities);
 
 	if (dev_priv->capabilities & SVGA_CAP_GMR2) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:728 @ static int vmw_driver_load(struct drm_de
 		goto out_err1;
 	}
 
-	ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
-			     (dev_priv->vram_size >> PAGE_SHIFT));
-	if (unlikely(ret != 0)) {
-		DRM_ERROR("Failed initializing memory manager for VRAM.\n");
-		goto out_err2;
-	}
-
-	dev_priv->has_gmr = true;
-	if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
-	    refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
-					 VMW_PL_GMR) != 0) {
-		DRM_INFO("No GMR memory available. "
-			 "Graphics memory resources are very limited.\n");
-		dev_priv->has_gmr = false;
-	}
-
-	if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
-		dev_priv->has_mob = true;
-		if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
-				   VMW_PL_MOB) != 0) {
-			DRM_INFO("No MOB memory available. "
-				 "3D will be disabled.\n");
-			dev_priv->has_mob = false;
-		}
-	}
-
 	dev_priv->mmio_mtrr = arch_phys_wc_add(dev_priv->mmio_start,
 					       dev_priv->mmio_size);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:790 @ static int vmw_driver_load(struct drm_de
 		goto out_no_fman;
 	}
 
+
+	ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
+			     (dev_priv->vram_size >> PAGE_SHIFT));
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("Failed initializing memory manager for VRAM.\n");
+		goto out_no_vram;
+	}
+
+	dev_priv->has_gmr = true;
+	if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
+	    refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
+					 VMW_PL_GMR) != 0) {
+		DRM_INFO("No GMR memory available. "
+			 "Graphics memory resources are very limited.\n");
+		dev_priv->has_gmr = false;
+	}
+
+	if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
+		dev_priv->has_mob = true;
+		if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
+				   VMW_PL_MOB) != 0) {
+			DRM_INFO("No MOB memory available. "
+				 "3D will be disabled.\n");
+			dev_priv->has_mob = false;
+		}
+	}
+
 	vmw_kms_save_vga(dev_priv);
 
 	/* Start kms and overlay systems, needs fifo. */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:842 @ out_no_fifo:
 	vmw_kms_close(dev_priv);
 out_no_kms:
 	vmw_kms_restore_vga(dev_priv);
+	if (dev_priv->has_mob)
+		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+	if (dev_priv->has_gmr)
+		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+out_no_vram:
 	vmw_fence_manager_takedown(dev_priv->fman);
 out_no_fman:
 	if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:863 @ out_err4:
 	iounmap(dev_priv->mmio_virt);
 out_err3:
 	arch_phys_wc_del(dev_priv->mmio_mtrr);
-	if (dev_priv->has_mob)
-		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-	if (dev_priv->has_gmr)
-		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-out_err2:
 	(void)ttm_bo_device_release(&dev_priv->bdev);
 out_err1:
 	vmw_ttm_global_release(dev_priv);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:892 @ static int vmw_driver_unload(struct drm_
 	}
 	vmw_kms_close(dev_priv);
 	vmw_overlay_close(dev_priv);
+
+	if (dev_priv->has_mob)
+		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+	if (dev_priv->has_gmr)
+		(void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+
 	vmw_fence_manager_takedown(dev_priv->fman);
 	if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
 		drm_irq_uninstall(dev_priv->dev);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:910 @ static int vmw_driver_unload(struct drm_
 	ttm_object_device_release(&dev_priv->tdev);
 	iounmap(dev_priv->mmio_virt);
 	arch_phys_wc_del(dev_priv->mmio_mtrr);
-	if (dev_priv->has_mob)
-		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-	if (dev_priv->has_gmr)
-		(void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
 	(void)ttm_bo_device_release(&dev_priv->bdev);
 	vmw_ttm_global_release(dev_priv);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1059 @ static long vmw_generic_ioctl(struct fil
 
 	vmaster = vmw_master_check(dev, file_priv, flags);
 	if (unlikely(IS_ERR(vmaster))) {
-		DRM_INFO("IOCTL ERROR %d\n", nr);
-		return PTR_ERR(vmaster);
+		ret = PTR_ERR(vmaster);
+
+		if (ret != -ERESTARTSYS)
+			DRM_INFO("IOCTL ERROR Command %d, Error %ld.\n",
+				 nr, ret);
+		return ret;
 	}
 
 	ret = ioctl_func(filp, cmd, arg);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1157 @ static int vmw_master_set(struct drm_dev
 		if (unlikely(ret != 0))
 			return ret;
 		vmw_kms_save_vga(dev_priv);
-		mutex_lock(&dev_priv->hw_mutex);
 		vmw_write(dev_priv, SVGA_REG_TRACES, 0);
-		mutex_unlock(&dev_priv->hw_mutex);
 	}
 
 	if (active) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1191 @ out_no_active_lock:
 	if (!dev_priv->enable_fb) {
 		vmw_kms_restore_vga(dev_priv);
 		vmw_3d_resource_dec(dev_priv, true);
-		mutex_lock(&dev_priv->hw_mutex);
 		vmw_write(dev_priv, SVGA_REG_TRACES, 1);
-		mutex_unlock(&dev_priv->hw_mutex);
 	}
 	return ret;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1226 @ static void vmw_master_drop(struct drm_d
 			DRM_ERROR("Unable to clean VRAM on master drop.\n");
 		vmw_kms_restore_vga(dev_priv);
 		vmw_3d_resource_dec(dev_priv, true);
-		mutex_lock(&dev_priv->hw_mutex);
 		vmw_write(dev_priv, SVGA_REG_TRACES, 1);
-		mutex_unlock(&dev_priv->hw_mutex);
 	}
 
 	dev_priv->active_master = &dev_priv->fbdev_master;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1358 @ static void vmw_pm_complete(struct devic
 	struct drm_device *dev = pci_get_drvdata(pdev);
 	struct vmw_private *dev_priv = vmw_priv(dev);
 
-	mutex_lock(&dev_priv->hw_mutex);
 	vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
 	(void) vmw_read(dev_priv, SVGA_REG_ID);
-	mutex_unlock(&dev_priv->hw_mutex);
 
 	/**
 	 * Reclaim 3d reference held by fbdev and potentially
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:402 @ struct vmw_private {
 	uint32_t memory_size;
 	bool has_gmr;
 	bool has_mob;
-	struct mutex hw_mutex;
+	spinlock_t hw_lock;
+	spinlock_t cap_lock;
 
 	/*
 	 * VGA registers.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:453 @ struct vmw_private {
 	atomic_t marker_seq;
 	wait_queue_head_t fence_queue;
 	wait_queue_head_t fifo_queue;
-	int fence_queue_waiters; /* Protected by hw_mutex */
-	int goal_queue_waiters; /* Protected by hw_mutex */
+	spinlock_t waiter_lock;
+	int fence_queue_waiters; /* Protected by waiter_lock */
+	int goal_queue_waiters; /* Protected by waiter_lock */
 	atomic_t fifo_queue_waiters;
 	uint32_t last_read_seqno;
 	spinlock_t irq_lock;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:558 @ static inline struct vmw_master *vmw_mas
 	return (struct vmw_master *) master->driver_priv;
 }
 
+/*
+ * The locking here is fine-grained, so that it is performed once
+ * for every read- and write operation. This is of course costly, but we
+ * don't perform much register access in the timing critical paths anyway.
+ * Instead we have the extra benefit of being sure that we don't forget
+ * the hw lock around register accesses.
+ */
 static inline void vmw_write(struct vmw_private *dev_priv,
 			     unsigned int offset, uint32_t value)
 {
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&dev_priv->hw_lock, irq_flags);
 	outl(offset, dev_priv->io_start + VMWGFX_INDEX_PORT);
 	outl(value, dev_priv->io_start + VMWGFX_VALUE_PORT);
+	spin_unlock_irqrestore(&dev_priv->hw_lock, irq_flags);
 }
 
 static inline uint32_t vmw_read(struct vmw_private *dev_priv,
 				unsigned int offset)
 {
-	uint32_t val;
+	unsigned long irq_flags;
+	u32 val;
 
+	spin_lock_irqsave(&dev_priv->hw_lock, irq_flags);
 	outl(offset, dev_priv->io_start + VMWGFX_INDEX_PORT);
 	val = inl(dev_priv->io_start + VMWGFX_VALUE_PORT);
+	spin_unlock_irqrestore(&dev_priv->hw_lock, irq_flags);
+
 	return val;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2781 @ int vmw_execbuf_ioctl(struct drm_device
 				  NULL, arg->command_size, arg->throttle_us,
 				  (void __user *)(unsigned long)arg->fence_rep,
 				  NULL);
-
+	ttm_read_unlock(&dev_priv->reservation_sem);
 	if (unlikely(ret != 0))
-		goto out_unlock;
+		return ret;
 
 	vmw_kms_cursor_post_execbuf(dev_priv);
 
-out_unlock:
-	ttm_read_unlock(&dev_priv->reservation_sem);
-	return ret;
+	return 0;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:38 @ struct vmw_fence_manager {
 	struct vmw_private *dev_priv;
 	spinlock_t lock;
 	struct list_head fence_list;
-	struct work_struct work, ping_work;
+	struct work_struct work;
 	u32 user_fence_size;
 	u32 fence_size;
 	u32 event_fence_action_size;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:137 @ static const char *vmw_fence_get_timelin
 	return "svga";
 }
 
-static void vmw_fence_ping_func(struct work_struct *work)
-{
-	struct vmw_fence_manager *fman =
-		container_of(work, struct vmw_fence_manager, ping_work);
-
-	vmw_fifo_ping_host(fman->dev_priv, SVGA_SYNC_GENERIC);
-}
-
 static bool vmw_fence_enable_signaling(struct fence *f)
 {
 	struct vmw_fence_obj *fence =
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:150 @ static bool vmw_fence_enable_signaling(s
 	if (seqno - fence->base.seqno < VMW_FENCE_WRAP)
 		return false;
 
-	if (mutex_trylock(&dev_priv->hw_mutex)) {
-		vmw_fifo_ping_host_locked(dev_priv, SVGA_SYNC_GENERIC);
-		mutex_unlock(&dev_priv->hw_mutex);
-	} else
-		schedule_work(&fman->ping_work);
+	vmw_fifo_ping_host(dev_priv, SVGA_SYNC_GENERIC);
 
 	return true;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:296 @ struct vmw_fence_manager *vmw_fence_mana
 	INIT_LIST_HEAD(&fman->fence_list);
 	INIT_LIST_HEAD(&fman->cleanup_list);
 	INIT_WORK(&fman->work, &vmw_fence_work_func);
-	INIT_WORK(&fman->ping_work, &vmw_fence_ping_func);
 	fman->fifo_down = true;
 	fman->user_fence_size = ttm_round_pot(sizeof(struct vmw_user_fence));
 	fman->fence_size = ttm_round_pot(sizeof(struct vmw_fence_obj));
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:313 @ void vmw_fence_manager_takedown(struct v
 	bool lists_empty;
 
 	(void) cancel_work_sync(&fman->work);
-	(void) cancel_work_sync(&fman->ping_work);
 
 	spin_lock_irqsave(&fman->lock, irq_flags);
 	lists_empty = list_empty(&fman->fence_list) &&
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:534 @ void vmw_fence_obj_flush(struct vmw_fenc
 
 static void vmw_fence_destroy(struct vmw_fence_obj *fence)
 {
-	struct vmw_fence_manager *fman = fman_from_fence(fence);
-
 	fence_free(&fence->base);
-
-	/*
-	 * Free kernel space accounting.
-	 */
-	ttm_mem_global_free(vmw_mem_glob(fman->dev_priv),
-			    fman->fence_size);
 }
 
 int vmw_fence_create(struct vmw_fence_manager *fman,
 		     uint32_t seqno,
 		     struct vmw_fence_obj **p_fence)
 {
-	struct ttm_mem_global *mem_glob = vmw_mem_glob(fman->dev_priv);
 	struct vmw_fence_obj *fence;
 	int ret;
 
-	ret = ttm_mem_global_alloc(mem_glob, fman->fence_size,
-				   false, false);
-	if (unlikely(ret != 0))
-		return ret;
-
 	fence = kzalloc(sizeof(*fence), GFP_KERNEL);
-	if (unlikely(fence == NULL)) {
-		ret = -ENOMEM;
-		goto out_no_object;
-	}
+	if (unlikely(fence == NULL))
+		return -ENOMEM;
 
 	ret = vmw_fence_obj_init(fman, fence, seqno,
 				 vmw_fence_destroy);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:558 @ int vmw_fence_create(struct vmw_fence_ma
 
 out_err_init:
 	kfree(fence);
-out_no_object:
-	ttm_mem_global_free(mem_glob, fman->fence_size);
 	return ret;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1076 @ static int vmw_event_fence_action_create
 	if (ret != 0)
 		goto out_no_queue;
 
+	return 0;
+
 out_no_queue:
 	event->base.destroy(&event->base);
 out_no_event:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1153 @ int vmw_fence_event_ioctl(struct drm_dev
 
 	BUG_ON(fence == NULL);
 
-	if (arg->flags & DRM_VMW_FE_FLAG_REQ_TIME)
-		ret = vmw_event_fence_action_create(file_priv, fence,
-						    arg->flags,
-						    arg->user_data,
-						    true);
-	else
-		ret = vmw_event_fence_action_create(file_priv, fence,
-						    arg->flags,
-						    arg->user_data,
-						    true);
-
+	ret = vmw_event_fence_action_create(file_priv, fence,
+					    arg->flags,
+					    arg->user_data,
+					    true);
 	if (unlikely(ret != 0)) {
 		if (ret != -ERESTARTSYS)
 			DRM_ERROR("Failed to attach event to fence.\n");
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:47 @ bool vmw_fifo_have_3d(struct vmw_private
 		if (!dev_priv->has_mob)
 			return false;
 
-		mutex_lock(&dev_priv->hw_mutex);
+		spin_lock(&dev_priv->cap_lock);
 		vmw_write(dev_priv, SVGA_REG_DEV_CAP, SVGA3D_DEVCAP_3D);
 		result = vmw_read(dev_priv, SVGA_REG_DEV_CAP);
-		mutex_unlock(&dev_priv->hw_mutex);
+		spin_unlock(&dev_priv->cap_lock);
 
 		return (result != 0);
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:123 @ int vmw_fifo_init(struct vmw_private *de
 	DRM_INFO("height %d\n", vmw_read(dev_priv, SVGA_REG_HEIGHT));
 	DRM_INFO("bpp %d\n", vmw_read(dev_priv, SVGA_REG_BITS_PER_PIXEL));
 
-	mutex_lock(&dev_priv->hw_mutex);
 	dev_priv->enable_state = vmw_read(dev_priv, SVGA_REG_ENABLE);
 	dev_priv->config_done_state = vmw_read(dev_priv, SVGA_REG_CONFIG_DONE);
 	dev_priv->traces_state = vmw_read(dev_priv, SVGA_REG_TRACES);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:145 @ int vmw_fifo_init(struct vmw_private *de
 	mb();
 
 	vmw_write(dev_priv, SVGA_REG_CONFIG_DONE, 1);
-	mutex_unlock(&dev_priv->hw_mutex);
 
 	max = ioread32(fifo_mem + SVGA_FIFO_MAX);
 	min = ioread32(fifo_mem  + SVGA_FIFO_MIN);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:161 @ int vmw_fifo_init(struct vmw_private *de
 	return vmw_fifo_send_fence(dev_priv, &dummy);
 }
 
-void vmw_fifo_ping_host_locked(struct vmw_private *dev_priv, uint32_t reason)
+void vmw_fifo_ping_host(struct vmw_private *dev_priv, uint32_t reason)
 {
 	__le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+	static DEFINE_SPINLOCK(ping_lock);
+	unsigned long irq_flags;
 
+	/*
+	 * The ping_lock is needed because we don't have an atomic
+	 * test-and-set of the SVGA_FIFO_BUSY register.
+	 */
+	spin_lock_irqsave(&ping_lock, irq_flags);
 	if (unlikely(ioread32(fifo_mem + SVGA_FIFO_BUSY) == 0)) {
 		iowrite32(1, fifo_mem + SVGA_FIFO_BUSY);
 		vmw_write(dev_priv, SVGA_REG_SYNC, reason);
 	}
-}
-
-void vmw_fifo_ping_host(struct vmw_private *dev_priv, uint32_t reason)
-{
-	mutex_lock(&dev_priv->hw_mutex);
-
-	vmw_fifo_ping_host_locked(dev_priv, reason);
-
-	mutex_unlock(&dev_priv->hw_mutex);
+	spin_unlock_irqrestore(&ping_lock, irq_flags);
 }
 
 void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
 {
 	__le32 __iomem *fifo_mem = dev_priv->mmio_virt;
 
-	mutex_lock(&dev_priv->hw_mutex);
-
 	vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
 	while (vmw_read(dev_priv, SVGA_REG_BUSY) != 0)
 		;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:196 @ void vmw_fifo_release(struct vmw_private
 	vmw_write(dev_priv, SVGA_REG_TRACES,
 		  dev_priv->traces_state);
 
-	mutex_unlock(&dev_priv->hw_mutex);
 	vmw_marker_queue_takedown(&fifo->marker_queue);
 
 	if (likely(fifo->static_buffer != NULL)) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:268 @ static int vmw_fifo_wait(struct vmw_priv
 		return vmw_fifo_wait_noirq(dev_priv, bytes,
 					   interruptible, timeout);
 
-	mutex_lock(&dev_priv->hw_mutex);
+	spin_lock(&dev_priv->waiter_lock);
 	if (atomic_add_return(1, &dev_priv->fifo_queue_waiters) > 0) {
 		spin_lock_irqsave(&dev_priv->irq_lock, irq_flags);
 		outl(SVGA_IRQFLAG_FIFO_PROGRESS,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:277 @ static int vmw_fifo_wait(struct vmw_priv
 		vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
 		spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
 	}
-	mutex_unlock(&dev_priv->hw_mutex);
+	spin_unlock(&dev_priv->waiter_lock);
 
 	if (interruptible)
 		ret = wait_event_interruptible_timeout
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:293 @ static int vmw_fifo_wait(struct vmw_priv
 	else if (likely(ret > 0))
 		ret = 0;
 
-	mutex_lock(&dev_priv->hw_mutex);
+	spin_lock(&dev_priv->waiter_lock);
 	if (atomic_dec_and_test(&dev_priv->fifo_queue_waiters)) {
 		spin_lock_irqsave(&dev_priv->irq_lock, irq_flags);
 		dev_priv->irq_mask &= ~SVGA_IRQFLAG_FIFO_PROGRESS;
 		vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
 		spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
 	}
-	mutex_unlock(&dev_priv->hw_mutex);
+	spin_unlock(&dev_priv->waiter_lock);
 
 	return ret;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:138 @ static int vmw_fill_compat_cap(struct vm
 		(pair_offset + max_size * sizeof(SVGA3dCapPair)) / sizeof(u32);
 	compat_cap->header.type = SVGA3DCAPS_RECORD_DEVCAPS;
 
-	mutex_lock(&dev_priv->hw_mutex);
+	spin_lock(&dev_priv->cap_lock);
 	for (i = 0; i < max_size; ++i) {
 		vmw_write(dev_priv, SVGA_REG_DEV_CAP, i);
 		compat_cap->pairs[i][0] = i;
 		compat_cap->pairs[i][1] = vmw_read(dev_priv, SVGA_REG_DEV_CAP);
 	}
-	mutex_unlock(&dev_priv->hw_mutex);
+	spin_unlock(&dev_priv->cap_lock);
 
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:194 @ int vmw_get_cap_3d_ioctl(struct drm_devi
 		if (num > SVGA3D_DEVCAP_MAX)
 			num = SVGA3D_DEVCAP_MAX;
 
-		mutex_lock(&dev_priv->hw_mutex);
+		spin_lock(&dev_priv->cap_lock);
 		for (i = 0; i < num; ++i) {
 			vmw_write(dev_priv, SVGA_REG_DEV_CAP, i);
 			*bounce32++ = vmw_read(dev_priv, SVGA_REG_DEV_CAP);
 		}
-		mutex_unlock(&dev_priv->hw_mutex);
+		spin_unlock(&dev_priv->cap_lock);
 	} else if (gb_objects) {
 		ret = vmw_fill_compat_cap(dev_priv, bounce, size);
 		if (unlikely(ret != 0))
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:65 @ irqreturn_t vmw_irq_handler(int irq, voi
 
 static bool vmw_fifo_idle(struct vmw_private *dev_priv, uint32_t seqno)
 {
-	uint32_t busy;
 
-	mutex_lock(&dev_priv->hw_mutex);
-	busy = vmw_read(dev_priv, SVGA_REG_BUSY);
-	mutex_unlock(&dev_priv->hw_mutex);
-
-	return (busy == 0);
+	return (vmw_read(dev_priv, SVGA_REG_BUSY) == 0);
 }
 
 void vmw_update_seqno(struct vmw_private *dev_priv,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:182 @ int vmw_fallback_wait(struct vmw_private
 
 void vmw_seqno_waiter_add(struct vmw_private *dev_priv)
 {
-	mutex_lock(&dev_priv->hw_mutex);
+	spin_lock(&dev_priv->waiter_lock);
 	if (dev_priv->fence_queue_waiters++ == 0) {
 		unsigned long irq_flags;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:193 @ void vmw_seqno_waiter_add(struct vmw_pri
 		vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
 		spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
 	}
-	mutex_unlock(&dev_priv->hw_mutex);
+	spin_unlock(&dev_priv->waiter_lock);
 }
 
 void vmw_seqno_waiter_remove(struct vmw_private *dev_priv)
 {
-	mutex_lock(&dev_priv->hw_mutex);
+	spin_lock(&dev_priv->waiter_lock);
 	if (--dev_priv->fence_queue_waiters == 0) {
 		unsigned long irq_flags;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:207 @ void vmw_seqno_waiter_remove(struct vmw_
 		vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
 		spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
 	}
-	mutex_unlock(&dev_priv->hw_mutex);
+	spin_unlock(&dev_priv->waiter_lock);
 }
 
 
 void vmw_goal_waiter_add(struct vmw_private *dev_priv)
 {
-	mutex_lock(&dev_priv->hw_mutex);
+	spin_lock(&dev_priv->waiter_lock);
 	if (dev_priv->goal_queue_waiters++ == 0) {
 		unsigned long irq_flags;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:224 @ void vmw_goal_waiter_add(struct vmw_priv
 		vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
 		spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
 	}
-	mutex_unlock(&dev_priv->hw_mutex);
+	spin_unlock(&dev_priv->waiter_lock);
 }
 
 void vmw_goal_waiter_remove(struct vmw_private *dev_priv)
 {
-	mutex_lock(&dev_priv->hw_mutex);
+	spin_lock(&dev_priv->waiter_lock);
 	if (--dev_priv->goal_queue_waiters == 0) {
 		unsigned long irq_flags;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:238 @ void vmw_goal_waiter_remove(struct vmw_p
 		vmw_write(dev_priv, SVGA_REG_IRQMASK, dev_priv->irq_mask);
 		spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
 	}
-	mutex_unlock(&dev_priv->hw_mutex);
+	spin_unlock(&dev_priv->waiter_lock);
 }
 
 int vmw_wait_seqno(struct vmw_private *dev_priv,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:313 @ void vmw_irq_uninstall(struct drm_device
 	if (!(dev_priv->capabilities & SVGA_CAP_IRQMASK))
 		return;
 
-	mutex_lock(&dev_priv->hw_mutex);
 	vmw_write(dev_priv, SVGA_REG_IRQMASK, 0);
-	mutex_unlock(&dev_priv->hw_mutex);
 
 	status = inl(dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
 	outl(status, dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
Index: linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ linux-3.18.13-rt10-r7s4/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1831 @ vmw_du_connector_detect(struct drm_conne
 	struct vmw_private *dev_priv = vmw_priv(dev);
 	struct vmw_display_unit *du = vmw_connector_to_du(connector);
 
-	mutex_lock(&dev_priv->hw_mutex);
 	num_displays = vmw_read(dev_priv, SVGA_REG_NUM_DISPLAYS);
-	mutex_unlock(&dev_priv->hw_mutex);
 
 	return ((vmw_connector_to_du(connector)->unit < num_displays &&
 		 du->pref_active) ?
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2036 @ int vmw_kms_update_layout_ioctl(struct d
 	int i;
 	struct drm_mode_config *mode_config = &dev->mode_config;
 
-	ret = ttm_read_lock(&dev_priv->reservation_sem, true);
-	if (unlikely(ret != 0))
-		return ret;
-
 	if (!arg->num_outputs) {
 		struct drm_vmw_rect def_rect = {0, 0, 800, 600};
 		vmw_du_update_layout(dev_priv, 1, &def_rect);
-		goto out_unlock;
+		return 0;
 	}
 
 	rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
 	rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect),
 			GFP_KERNEL);
-	if (unlikely(!rects)) {
-		ret = -ENOMEM;
-		goto out_unlock;
-	}
+	if (unlikely(!rects))
+		return -ENOMEM;
 
 	user_rects = (void __user *)(unsigned long)arg->rects;
 	ret = copy_from_user(rects, user_rects, rects_size);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2071 @ int vmw_kms_update_layout_ioctl(struct d
 
 out_free:
 	kfree(rects);
-out_unlock:
-	ttm_read_unlock(&dev_priv->reservation_sem);
 	return ret;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/hid/hid-core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/hid/hid-core.c
+++ linux-3.18.13-rt10-r7s4/drivers/hid/hid-core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1812 @ static const struct hid_device_id hid_ha
 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_I405X) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_LCPOWER, USB_DEVICE_ID_LCPOWER_LC1000 ) },
Index: linux-3.18.13-rt10-r7s4/drivers/hid/hid-ids.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/hid/hid-ids.h
+++ linux-3.18.13-rt10-r7s4/drivers/hid/hid-ids.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:303 @
 #define USB_DEVICE_ID_ELAN_TOUCHSCREEN	0x0089
 #define USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B	0x009b
 #define USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103	0x0103
+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_010c	0x010c
 #define USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F	0x016f
 
 #define USB_VENDOR_ID_ELECOM		0x056e
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:529 @
 #define USB_DEVICE_ID_KYE_GPEN_560	0x5003
 #define USB_DEVICE_ID_KYE_EASYPEN_I405X	0x5010
 #define USB_DEVICE_ID_KYE_MOUSEPEN_I608X	0x5011
+#define USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2	0x501a
 #define USB_DEVICE_ID_KYE_EASYPEN_M610X	0x5013
 
 #define USB_VENDOR_ID_LABTEC		0x1020
Index: linux-3.18.13-rt10-r7s4/drivers/hid/hid-input.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/hid/hid-input.c
+++ linux-3.18.13-rt10-r7s4/drivers/hid/hid-input.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:315 @ static const struct hid_device_id hid_ba
 			       USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI),
 	  HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE },
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
+			       USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO),
+	  HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE },
+	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
 		USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI),
 	  HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE },
 	{}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1107 @ void hidinput_hid_event(struct hid_devic
 		return;
 	}
 
+	/*
+	 * Ignore reports for absolute data if the data didn't change. This is
+	 * not only an optimization but also fixes 'dead' key reports. Some
+	 * RollOver implementations for localized keys (like BACKSLASH/PIPE; HID
+	 * 0x31 and 0x32) report multiple keys, even though a localized keyboard
+	 * can only have one of them physically available. The 'dead' keys
+	 * report constant 0. As all map to the same keycode, they'd confuse
+	 * the input layer. If we filter the 'dead' keys on the HID level, we
+	 * skip the keycode translation and only forward real events.
+	 */
+	if (!(field->flags & (HID_MAIN_ITEM_RELATIVE |
+	                      HID_MAIN_ITEM_BUFFERED_BYTE)) &&
+			      (field->flags & HID_MAIN_ITEM_VARIABLE) &&
+	    usage->usage_index < field->maxusage &&
+	    value == field->value[usage->usage_index])
+		return;
+
 	/* report the usage code as scancode if the key status has changed */
 	if (usage->type == EV_KEY && !!test_bit(usage->code, input->key) != value)
 		input_event(input, EV_MSC, MSC_SCAN, usage->hid);
Index: linux-3.18.13-rt10-r7s4/drivers/hid/hid-kye.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/hid/hid-kye.c
+++ linux-3.18.13-rt10-r7s4/drivers/hid/hid-kye.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:326 @ static __u8 *kye_report_fixup(struct hid
 		}
 		break;
 	case USB_DEVICE_ID_KYE_MOUSEPEN_I608X:
+	case USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2:
 		if (*rsize == MOUSEPEN_I608X_RDESC_ORIG_SIZE) {
 			rdesc = mousepen_i608x_rdesc_fixed;
 			*rsize = sizeof(mousepen_i608x_rdesc_fixed);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:419 @ static int kye_probe(struct hid_device *
 	switch (id->product) {
 	case USB_DEVICE_ID_KYE_EASYPEN_I405X:
 	case USB_DEVICE_ID_KYE_MOUSEPEN_I608X:
+	case USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2:
 	case USB_DEVICE_ID_KYE_EASYPEN_M610X:
 		ret = kye_tablet_enable(hdev);
 		if (ret) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:451 @ static const struct hid_device_id kye_de
 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE,
 				USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+				USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE,
 				USB_DEVICE_ID_KYE_EASYPEN_M610X) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE,
 				USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
Index: linux-3.18.13-rt10-r7s4/drivers/hid/hid-rmi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/hid/hid-rmi.c
+++ linux-3.18.13-rt10-r7s4/drivers/hid/hid-rmi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:587 @ static int rmi_populate_f11(struct hid_d
 	bool has_query10 = false;
 	bool has_query11;
 	bool has_query12;
+	bool has_query27;
+	bool has_query28;
+	bool has_query36 = false;
 	bool has_physical_props;
 	bool has_gestures;
 	bool has_rel;
+	bool has_data40 = false;
 	unsigned x_size, y_size;
-	u16 query12_offset;
+	u16 query_offset;
 
 	if (!data->f11.query_base_addr) {
 		hid_err(hdev, "No 2D sensor found, giving up.\n");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:611 @ static int rmi_populate_f11(struct hid_d
 	has_query9 = !!(buf[0] & BIT(3));
 	has_query11 = !!(buf[0] & BIT(4));
 	has_query12 = !!(buf[0] & BIT(5));
+	has_query27 = !!(buf[0] & BIT(6));
+	has_query28 = !!(buf[0] & BIT(7));
 
 	/* query 1 to get the max number of fingers */
 	ret = rmi_read(hdev, data->f11.query_base_addr + 1, buf);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:651 @ static int rmi_populate_f11(struct hid_d
 	 * +1 for query 5 which is present since absolute events are
 	 * reported and +1 for query 12.
 	 */
-	query12_offset = 6;
+	query_offset = 6;
 
 	if (has_rel)
-		++query12_offset; /* query 6 is present */
+		++query_offset; /* query 6 is present */
 
 	if (has_gestures)
-		query12_offset += 2; /* query 7 and 8 are present */
+		query_offset += 2; /* query 7 and 8 are present */
 
 	if (has_query9)
-		++query12_offset;
+		++query_offset;
 
 	if (has_query10)
-		++query12_offset;
+		++query_offset;
 
 	if (has_query11)
-		++query12_offset;
+		++query_offset;
 
 	/* query 12 to know if the physical properties are reported */
 	if (has_query12) {
 		ret = rmi_read(hdev, data->f11.query_base_addr
-				+ query12_offset, buf);
+				+ query_offset, buf);
 		if (ret) {
 			hid_err(hdev, "can not get query 12: %d.\n", ret);
 			return ret;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:679 @ static int rmi_populate_f11(struct hid_d
 		has_physical_props = !!(buf[0] & BIT(5));
 
 		if (has_physical_props) {
+			query_offset += 1;
 			ret = rmi_read_block(hdev,
 					data->f11.query_base_addr
-						+ query12_offset + 1, buf, 4);
+						+ query_offset, buf, 4);
 			if (ret) {
 				hid_err(hdev, "can not read query 15-18: %d.\n",
 					ret);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:697 @ static int rmi_populate_f11(struct hid_d
 
 			hid_info(hdev, "%s: size in mm: %d x %d\n",
 				 __func__, data->x_size_mm, data->y_size_mm);
+
+			/*
+			 * query 15 - 18 contain the size of the sensor
+			 * and query 19 - 26 contain bezel dimensions
+			 */
+			query_offset += 12;
+		}
+	}
+
+	if (has_query27)
+		++query_offset;
+
+	if (has_query28) {
+		ret = rmi_read(hdev, data->f11.query_base_addr
+				+ query_offset, buf);
+		if (ret) {
+			hid_err(hdev, "can not get query 28: %d.\n", ret);
+			return ret;
+		}
+
+		has_query36 = !!(buf[0] & BIT(6));
+	}
+
+	if (has_query36) {
+		query_offset += 2;
+		ret = rmi_read(hdev, data->f11.query_base_addr
+				+ query_offset, buf);
+		if (ret) {
+			hid_err(hdev, "can not get query 36: %d.\n", ret);
+			return ret;
 		}
+
+		has_data40 = !!(buf[0] & BIT(5));
 	}
 
+
+	if (has_data40)
+		data->f11.report_size += data->max_fingers * 2;
+
 	/*
 	 * retrieve the ctrl registers
 	 * the ctrl register has a size of 20 but a fw bug split it into 16 + 4,
Index: linux-3.18.13-rt10-r7s4/drivers/hid/hid-roccat-pyra.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/hid/hid-roccat-pyra.c
+++ linux-3.18.13-rt10-r7s4/drivers/hid/hid-roccat-pyra.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:38 @ static struct class *pyra_class;
 static void profile_activated(struct pyra_device *pyra,
 		unsigned int new_profile)
 {
+	if (new_profile >= ARRAY_SIZE(pyra->profile_settings))
+		return;
 	pyra->actual_profile = new_profile;
 	pyra->actual_cpi = pyra->profile_settings[pyra->actual_profile].y_cpi;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:262 @ static ssize_t pyra_sysfs_write_settings
 	if (off != 0 || count != PYRA_SIZE_SETTINGS)
 		return -EINVAL;
 
-	mutex_lock(&pyra->pyra_lock);
-
 	settings = (struct pyra_settings const *)buf;
+	if (settings->startup_profile >= ARRAY_SIZE(pyra->profile_settings))
+		return -EINVAL;
+
+	mutex_lock(&pyra->pyra_lock);
 
 	retval = pyra_set_settings(usb_dev, settings);
 	if (retval) {
Index: linux-3.18.13-rt10-r7s4/drivers/hid/i2c-hid/i2c-hid.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/hid/i2c-hid/i2c-hid.c
+++ linux-3.18.13-rt10-r7s4/drivers/hid/i2c-hid/i2c-hid.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:140 @ struct i2c_hid {
 						   * descriptor. */
 	unsigned int		bufsize;	/* i2c buffer size */
 	char			*inbuf;		/* Input buffer */
+	char			*rawbuf;	/* Raw Input buffer */
 	char			*cmdbuf;	/* Command buffer */
 	char			*argsbuf;	/* Command arguments buffer */
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:375 @ static void i2c_hid_get_input(struct i2c
 	int ret, ret_size;
 	int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
 
+	if (size > ihid->bufsize)
+		size = ihid->bufsize;
+
 	ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
 	if (ret != size) {
 		if (ret < 0)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:511 @ static void i2c_hid_find_max_report(stru
 static void i2c_hid_free_buffers(struct i2c_hid *ihid)
 {
 	kfree(ihid->inbuf);
+	kfree(ihid->rawbuf);
 	kfree(ihid->argsbuf);
 	kfree(ihid->cmdbuf);
 	ihid->inbuf = NULL;
+	ihid->rawbuf = NULL;
 	ihid->cmdbuf = NULL;
 	ihid->argsbuf = NULL;
 	ihid->bufsize = 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:531 @ static int i2c_hid_alloc_buffers(struct
 		       report_size; /* report */
 
 	ihid->inbuf = kzalloc(report_size, GFP_KERNEL);
+	ihid->rawbuf = kzalloc(report_size, GFP_KERNEL);
 	ihid->argsbuf = kzalloc(args_len, GFP_KERNEL);
 	ihid->cmdbuf = kzalloc(sizeof(union command) + args_len, GFP_KERNEL);
 
-	if (!ihid->inbuf || !ihid->argsbuf || !ihid->cmdbuf) {
+	if (!ihid->inbuf || !ihid->rawbuf || !ihid->argsbuf || !ihid->cmdbuf) {
 		i2c_hid_free_buffers(ihid);
 		return -ENOMEM;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:562 @ static int i2c_hid_get_raw_report(struct
 
 	ret = i2c_hid_get_report(client,
 			report_type == HID_FEATURE_REPORT ? 0x03 : 0x01,
-			report_number, ihid->inbuf, ask_count);
+			report_number, ihid->rawbuf, ask_count);
 
 	if (ret < 0)
 		return ret;
 
-	ret_count = ihid->inbuf[0] | (ihid->inbuf[1] << 8);
+	ret_count = ihid->rawbuf[0] | (ihid->rawbuf[1] << 8);
 
 	if (ret_count <= 2)
 		return 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:576 @ static int i2c_hid_get_raw_report(struct
 
 	/* The query buffer contains the size, dropping it in the reply */
 	count = min(count, ret_count - 2);
-	memcpy(buf, ihid->inbuf + 2, count);
+	memcpy(buf, ihid->rawbuf + 2, count);
 
 	return count;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:712 @ static int i2c_hid_start(struct hid_devi
 
 static void i2c_hid_stop(struct hid_device *hid)
 {
-	struct i2c_client *client = hid->driver_data;
-	struct i2c_hid *ihid = i2c_get_clientdata(client);
-
 	hid->claimed = 0;
-
-	i2c_hid_free_buffers(ihid);
 }
 
 static int i2c_hid_open(struct hid_device *hid)
Index: linux-3.18.13-rt10-r7s4/drivers/hid/usbhid/hid-quirks.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/hid/usbhid/hid-quirks.c
+++ linux-3.18.13-rt10-r7s4/drivers/hid/usbhid/hid-quirks.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:76 @ static const struct hid_blacklist {
 	{ USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
 	{ USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL },
 	{ USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103, HID_QUIRK_ALWAYS_POLL },
+	{ USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_010c, HID_QUIRK_ALWAYS_POLL },
 	{ USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F, HID_QUIRK_ALWAYS_POLL },
 	{ USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:126 @ static const struct hid_blacklist {
 	{ USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS, HID_QUIRK_MULTI_INPUT },
 	{ USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
 	{ USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
+	{ USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2, HID_QUIRK_MULTI_INPUT },
 	{ USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
 	{ USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
 	{ USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD, HID_QUIRK_NO_INIT_REPORTS },
Index: linux-3.18.13-rt10-r7s4/drivers/hid/wacom_sys.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/hid/wacom_sys.c
+++ linux-3.18.13-rt10-r7s4/drivers/hid/wacom_sys.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:73 @ static int wacom_raw_event(struct hid_de
 static int wacom_open(struct input_dev *dev)
 {
 	struct wacom *wacom = input_get_drvdata(dev);
-	int retval;
 
-	mutex_lock(&wacom->lock);
-	retval = hid_hw_open(wacom->hdev);
-	mutex_unlock(&wacom->lock);
-
-	return retval;
+	return hid_hw_open(wacom->hdev);
 }
 
 static void wacom_close(struct input_dev *dev)
 {
 	struct wacom *wacom = input_get_drvdata(dev);
 
-	mutex_lock(&wacom->lock);
 	hid_hw_close(wacom->hdev);
-	mutex_unlock(&wacom->lock);
 }
 
 /*
Index: linux-3.18.13-rt10-r7s4/drivers/hid/wacom_wac.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/hid/wacom_wac.c
+++ linux-3.18.13-rt10-r7s4/drivers/hid/wacom_wac.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:759 @ static int wacom_intuos_irq(struct wacom
 			input_report_key(input, BTN_7, (data[4] & 0x40));  /* Left   */
 			input_report_key(input, BTN_8, (data[4] & 0x80));  /* Down   */
 			input_report_key(input, BTN_0, (data[3] & 0x01));  /* Center */
+
+			if (data[4] | (data[3] & 0x01)) {
+				input_report_abs(input, ABS_MISC, PAD_DEVICE_ID);
+			} else {
+				input_report_abs(input, ABS_MISC, 0);
+			}
 		} else if (features->type >= INTUOS5S && features->type <= INTUOSPL) {
 			int i;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3035 @ const struct hid_device_id wacom_ids[] =
 	{ USB_DEVICE_WACOM(0x4004) },
 	{ USB_DEVICE_WACOM(0x5000) },
 	{ USB_DEVICE_WACOM(0x5002) },
+	{ USB_DEVICE_LENOVO(0x6004) },
 
 	{ USB_DEVICE_WACOM(HID_ANY_ID) },
 	{ }
Index: linux-3.18.13-rt10-r7s4/drivers/hv/channel_mgmt.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/hv/channel_mgmt.c
+++ linux-3.18.13-rt10-r7s4/drivers/hv/channel_mgmt.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:219 @ static void vmbus_process_rescind_offer(
 	unsigned long flags;
 	struct vmbus_channel *primary_channel;
 	struct vmbus_channel_relid_released msg;
+	struct device *dev;
+
+	if (channel->device_obj) {
+		dev = get_device(&channel->device_obj->device);
+		if (dev) {
+			vmbus_device_unregister(channel->device_obj);
+			put_device(dev);
+		}
+	}
 
-	if (channel->device_obj)
-		vmbus_device_unregister(channel->device_obj);
 	memset(&msg, 0, sizeof(struct vmbus_channel_relid_released));
 	msg.child_relid = channel->offermsg.child_relid;
 	msg.header.msgtype = CHANNELMSG_RELID_RELEASED;
Index: linux-3.18.13-rt10-r7s4/drivers/i2c/busses/i2c-s3c2410.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/i2c/busses/i2c-s3c2410.c
+++ linux-3.18.13-rt10-r7s4/drivers/i2c/busses/i2c-s3c2410.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:781 @ static int s3c24xx_i2c_xfer(struct i2c_a
 	int ret;
 
 	pm_runtime_get_sync(&adap->dev);
-	clk_prepare_enable(i2c->clk);
+	ret = clk_enable(i2c->clk);
+	if (ret)
+		return ret;
 
 	for (retry = 0; retry < adap->retries; retry++) {
 
 		ret = s3c24xx_i2c_doxfer(i2c, msgs, num);
 
 		if (ret != -EAGAIN) {
-			clk_disable_unprepare(i2c->clk);
+			clk_disable(i2c->clk);
 			pm_runtime_put(&adap->dev);
 			return ret;
 		}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:800 @ static int s3c24xx_i2c_xfer(struct i2c_a
 		udelay(100);
 	}
 
-	clk_disable_unprepare(i2c->clk);
+	clk_disable(i2c->clk);
 	pm_runtime_put(&adap->dev);
 	return -EREMOTEIO;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1179 @ static int s3c24xx_i2c_probe(struct plat
 
 	clk_prepare_enable(i2c->clk);
 	ret = s3c24xx_i2c_init(i2c);
-	clk_disable_unprepare(i2c->clk);
+	clk_disable(i2c->clk);
 	if (ret != 0) {
 		dev_err(&pdev->dev, "I2C controller init failed\n");
 		return ret;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1192 @ static int s3c24xx_i2c_probe(struct plat
 		i2c->irq = ret = platform_get_irq(pdev, 0);
 		if (ret <= 0) {
 			dev_err(&pdev->dev, "cannot find IRQ\n");
+			clk_unprepare(i2c->clk);
 			return ret;
 		}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1201 @ static int s3c24xx_i2c_probe(struct plat
 
 		if (ret != 0) {
 			dev_err(&pdev->dev, "cannot claim IRQ %d\n", i2c->irq);
+			clk_unprepare(i2c->clk);
 			return ret;
 		}
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1209 @ static int s3c24xx_i2c_probe(struct plat
 	ret = s3c24xx_i2c_register_cpufreq(i2c);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "failed to register cpufreq notifier\n");
+		clk_unprepare(i2c->clk);
 		return ret;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1226 @ static int s3c24xx_i2c_probe(struct plat
 	if (ret < 0) {
 		dev_err(&pdev->dev, "failed to add bus to i2c core\n");
 		s3c24xx_i2c_deregister_cpufreq(i2c);
+		clk_unprepare(i2c->clk);
 		return ret;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1248 @ static int s3c24xx_i2c_remove(struct pla
 {
 	struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
 
+	clk_unprepare(i2c->clk);
+
 	pm_runtime_disable(&i2c->adap.dev);
 	pm_runtime_disable(&pdev->dev);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1278 @ static int s3c24xx_i2c_resume_noirq(stru
 {
 	struct platform_device *pdev = to_platform_device(dev);
 	struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
+	int ret;
 
-	clk_prepare_enable(i2c->clk);
+	ret = clk_enable(i2c->clk);
+	if (ret)
+		return ret;
 	s3c24xx_i2c_init(i2c);
-	clk_disable_unprepare(i2c->clk);
+	clk_disable(i2c->clk);
 	i2c->suspended = 0;
 
 	return 0;
Index: linux-3.18.13-rt10-r7s4/drivers/i2c/i2c-core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/i2c/i2c-core.c
+++ linux-3.18.13-rt10-r7s4/drivers/i2c/i2c-core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:668 @ static int i2c_device_remove(struct devi
 		status = driver->remove(client);
 	}
 
-	if (dev->of_node)
-		irq_dispose_mapping(client->irq);
-
 	dev_pm_domain_detach(&client->dev, true);
 	return status;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/iio/accel/bmc150-accel.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/iio/accel/bmc150-accel.c
+++ linux-3.18.13-rt10-r7s4/drivers/iio/accel/bmc150-accel.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:171 @ static const struct {
 	int val;
 	int val2;
 	u8 bw_bits;
-} bmc150_accel_samp_freq_table[] = { {7, 810000, 0x08},
-				     {15, 630000, 0x09},
-				     {31, 250000, 0x0A},
-				     {62, 500000, 0x0B},
-				     {125, 0, 0x0C},
-				     {250, 0, 0x0D},
-				     {500, 0, 0x0E},
-				     {1000, 0, 0x0F} };
+} bmc150_accel_samp_freq_table[] = { {15, 620000, 0x08},
+				     {31, 260000, 0x09},
+				     {62, 500000, 0x0A},
+				     {125, 0, 0x0B},
+				     {250, 0, 0x0C},
+				     {500, 0, 0x0D},
+				     {1000, 0, 0x0E},
+				     {2000, 0, 0x0F} };
 
 static const struct {
 	int bw_bits;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:843 @ static int bmc150_accel_validate_trigger
 }
 
 static IIO_CONST_ATTR_SAMP_FREQ_AVAIL(
-		"7.810000 15.630000 31.250000 62.500000 125 250 500 1000");
+		"15.620000 31.260000 62.50000 125 250 500 1000 2000");
 
 static struct attribute *bmc150_accel_attributes[] = {
 	&iio_const_attr_sampling_frequency_available.dev_attr.attr,
Index: linux-3.18.13-rt10-r7s4/drivers/iio/adc/ad799x.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/iio/adc/ad799x.c
+++ linux-3.18.13-rt10-r7s4/drivers/iio/adc/ad799x.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:146 @ static int ad799x_write_config(struct ad
 	case ad7998:
 		return i2c_smbus_write_word_swapped(st->client, AD7998_CONF_REG,
 			val);
-	default:
+	case ad7992:
+	case ad7993:
+	case ad7994:
 		return i2c_smbus_write_byte_data(st->client, AD7998_CONF_REG,
 			val);
+	default:
+		/* Will be written when doing a conversion */
+		st->config = val;
+		return 0;
 	}
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:164 @ static int ad799x_read_config(struct ad7
 	case ad7997:
 	case ad7998:
 		return i2c_smbus_read_word_swapped(st->client, AD7998_CONF_REG);
-	default:
+	case ad7992:
+	case ad7993:
+	case ad7994:
 		return i2c_smbus_read_byte_data(st->client, AD7998_CONF_REG);
+	default:
+		/* No readback support */
+		return st->config;
 	}
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/iio/adc/mcp3422.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/iio/adc/mcp3422.c
+++ linux-3.18.13-rt10-r7s4/drivers/iio/adc/mcp3422.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:61 @
 		.info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SAMP_FREQ), \
 	}
 
-/* LSB is in nV to eliminate floating point */
-static const u32 rates_to_lsb[] = {1000000, 250000, 62500, 15625};
-
-/*
- *  scales calculated as:
- *  rates_to_lsb[sample_rate] / (1 << pga);
- *  pga is 1 for 0, 2
- */
-
 static const int mcp3422_scales[4][4] = {
-	{ 1000000, 250000, 62500, 15625 },
-	{ 500000 , 125000, 31250, 7812 },
-	{ 250000 , 62500 , 15625, 3906 },
-	{ 125000 , 31250 , 7812 , 1953 } };
+	{ 1000000, 500000, 250000, 125000 },
+	{ 250000 , 125000, 62500 , 31250  },
+	{ 62500  , 31250 , 15625 , 7812   },
+	{ 15625  , 7812  , 3906  , 1953   } };
 
 /* Constant msleep times for data acquisitions */
 static const int mcp3422_read_times[4] = {
Index: linux-3.18.13-rt10-r7s4/drivers/iio/adc/vf610_adc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/iio/adc/vf610_adc.c
+++ linux-3.18.13-rt10-r7s4/drivers/iio/adc/vf610_adc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:144 @ struct vf610_adc {
 	struct regulator *vref;
 	struct vf610_adc_feature adc_feature;
 
+	u32 sample_freq_avail[5];
+
 	struct completion completion;
 };
 
+static const u32 vf610_hw_avgs[] = { 1, 4, 8, 16, 32 };
+
 #define VF610_ADC_CHAN(_idx, _chan_type) {			\
 	.type = (_chan_type),					\
 	.indexed = 1,						\
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:180 @ static const struct iio_chan_spec vf610_
 	/* sentinel */
 };
 
-/*
- * ADC sample frequency, unit is ADCK cycles.
- * ADC clk source is ipg clock, which is the same as bus clock.
- *
- * ADC conversion time = SFCAdder + AverageNum x (BCT + LSTAdder)
- * SFCAdder: fixed to 6 ADCK cycles
- * AverageNum: 1, 4, 8, 16, 32 samples for hardware average.
- * BCT (Base Conversion Time): fixed to 25 ADCK cycles for 12 bit mode
- * LSTAdder(Long Sample Time): fixed to 3 ADCK cycles
- *
- * By default, enable 12 bit resolution mode, clock source
- * set to ipg clock, So get below frequency group:
- */
-static const u32 vf610_sample_freq_avail[5] =
-{1941176, 559332, 286957, 145374, 73171};
+static inline void vf610_adc_calculate_rates(struct vf610_adc *info)
+{
+	unsigned long adck_rate, ipg_rate = clk_get_rate(info->clk);
+	int i;
+
+	/*
+	 * Calculate ADC sample frequencies
+	 * Sample time unit is ADCK cycles. ADCK clk source is ipg clock,
+	 * which is the same as bus clock.
+	 *
+	 * ADC conversion time = SFCAdder + AverageNum x (BCT + LSTAdder)
+	 * SFCAdder: fixed to 6 ADCK cycles
+	 * AverageNum: 1, 4, 8, 16, 32 samples for hardware average.
+	 * BCT (Base Conversion Time): fixed to 25 ADCK cycles for 12 bit mode
+	 * LSTAdder(Long Sample Time): fixed to 3 ADCK cycles
+	 */
+	adck_rate = ipg_rate / info->adc_feature.clk_div;
+	for (i = 0; i < ARRAY_SIZE(vf610_hw_avgs); i++)
+		info->sample_freq_avail[i] =
+			adck_rate / (6 + vf610_hw_avgs[i] * (25 + 3));
+}
 
 static inline void vf610_adc_cfg_init(struct vf610_adc *info)
 {
+	struct vf610_adc_feature *adc_feature = &info->adc_feature;
+
 	/* set default Configuration for ADC controller */
-	info->adc_feature.clk_sel = VF610_ADCIOC_BUSCLK_SET;
-	info->adc_feature.vol_ref = VF610_ADCIOC_VR_VREF_SET;
+	adc_feature->clk_sel = VF610_ADCIOC_BUSCLK_SET;
+	adc_feature->vol_ref = VF610_ADCIOC_VR_VREF_SET;
+
+	adc_feature->calibration = true;
+	adc_feature->ovwren = true;
 
-	info->adc_feature.calibration = true;
-	info->adc_feature.ovwren = true;
+	adc_feature->res_mode = 12;
+	adc_feature->sample_rate = 1;
+	adc_feature->lpm = true;
 
-	info->adc_feature.clk_div = 1;
-	info->adc_feature.res_mode = 12;
-	info->adc_feature.sample_rate = 1;
-	info->adc_feature.lpm = true;
+	/* Use a save ADCK which is below 20MHz on all devices */
+	adc_feature->clk_div = 8;
+
+	vf610_adc_calculate_rates(info);
 }
 
 static void vf610_adc_cfg_post_set(struct vf610_adc *info)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:302 @ static void vf610_adc_cfg_set(struct vf6
 
 	cfg_data = readl(info->regs + VF610_REG_ADC_CFG);
 
-	/* low power configuration */
 	cfg_data &= ~VF610_ADC_ADLPC_EN;
 	if (adc_feature->lpm)
 		cfg_data |= VF610_ADC_ADLPC_EN;
 
-	/* disable high speed */
 	cfg_data &= ~VF610_ADC_ADHSC_EN;
 
 	writel(cfg_data, info->regs + VF610_REG_ADC_CFG);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:445 @ static irqreturn_t vf610_adc_isr(int irq
 	return IRQ_HANDLED;
 }
 
-static IIO_CONST_ATTR_SAMP_FREQ_AVAIL("1941176, 559332, 286957, 145374, 73171");
+static ssize_t vf610_show_samp_freq_avail(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct vf610_adc *info = iio_priv(dev_to_iio_dev(dev));
+	size_t len = 0;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(info->sample_freq_avail); i++)
+		len += scnprintf(buf + len, PAGE_SIZE - len,
+			"%u ", info->sample_freq_avail[i]);
+
+	/* replace trailing space by newline */
+	buf[len - 1] = '\n';
+
+	return len;
+}
+
+static IIO_DEV_ATTR_SAMP_FREQ_AVAIL(vf610_show_samp_freq_avail);
 
 static struct attribute *vf610_attributes[] = {
-	&iio_const_attr_sampling_frequency_available.dev_attr.attr,
+	&iio_dev_attr_sampling_frequency_available.dev_attr.attr,
 	NULL
 };
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:512 @ static int vf610_read_raw(struct iio_dev
 		return IIO_VAL_FRACTIONAL_LOG2;
 
 	case IIO_CHAN_INFO_SAMP_FREQ:
-		*val = vf610_sample_freq_avail[info->adc_feature.sample_rate];
+		*val = info->sample_freq_avail[info->adc_feature.sample_rate];
 		*val2 = 0;
 		return IIO_VAL_INT;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:535 @ static int vf610_write_raw(struct iio_de
 	switch (mask) {
 		case IIO_CHAN_INFO_SAMP_FREQ:
 			for (i = 0;
-				i < ARRAY_SIZE(vf610_sample_freq_avail);
+				i < ARRAY_SIZE(info->sample_freq_avail);
 				i++)
-				if (val == vf610_sample_freq_avail[i]) {
+				if (val == info->sample_freq_avail[i]) {
 					info->adc_feature.sample_rate = i;
 					vf610_adc_sample_set(info);
 					return 0;
Index: linux-3.18.13-rt10-r7s4/drivers/iio/dac/ad5686.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/iio/dac/ad5686.c
+++ linux-3.18.13-rt10-r7s4/drivers/iio/dac/ad5686.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:325 @ static int ad5686_probe(struct spi_devic
 	st = iio_priv(indio_dev);
 	spi_set_drvdata(spi, indio_dev);
 
-	st->reg = devm_regulator_get(&spi->dev, "vcc");
+	st->reg = devm_regulator_get_optional(&spi->dev, "vcc");
 	if (!IS_ERR(st->reg)) {
 		ret = regulator_enable(st->reg);
 		if (ret)
Index: linux-3.18.13-rt10-r7s4/drivers/iio/imu/adis16400_core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/iio/imu/adis16400_core.c
+++ linux-3.18.13-rt10-r7s4/drivers/iio/imu/adis16400_core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:29 @
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/debugfs.h>
+#include <linux/bitops.h>
 
 #include <linux/iio/iio.h>
 #include <linux/iio/sysfs.h>
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:418 @ static int adis16400_read_raw(struct iio
 		mutex_unlock(&indio_dev->mlock);
 		if (ret)
 			return ret;
-		val16 = ((val16 & 0xFFF) << 4) >> 4;
+		val16 = sign_extend32(val16, 11);
 		*val = val16;
 		return IIO_VAL_INT;
 	case IIO_CHAN_INFO_OFFSET:
Index: linux-3.18.13-rt10-r7s4/drivers/iio/imu/adis_trigger.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/iio/imu/adis_trigger.c
+++ linux-3.18.13-rt10-r7s4/drivers/iio/imu/adis_trigger.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:63 @ int adis_probe_trigger(struct adis *adis
 	iio_trigger_set_drvdata(adis->trig, adis);
 	ret = iio_trigger_register(adis->trig);
 
-	indio_dev->trig = adis->trig;
+	indio_dev->trig = iio_trigger_get(adis->trig);
 	if (ret)
 		goto error_free_irq;
 
Index: linux-3.18.13-rt10-r7s4/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
+++ linux-3.18.13-rt10-r7s4/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:27 @
 #include <linux/poll.h>
 #include "inv_mpu_iio.h"
 
+static void inv_clear_kfifo(struct inv_mpu6050_state *st)
+{
+	unsigned long flags;
+
+	/* take the spin lock sem to avoid interrupt kick in */
+	spin_lock_irqsave(&st->time_stamp_lock, flags);
+	kfifo_reset(&st->timestamps);
+	spin_unlock_irqrestore(&st->time_stamp_lock, flags);
+}
+
 int inv_reset_fifo(struct iio_dev *indio_dev)
 {
 	int result;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:63 @ int inv_reset_fifo(struct iio_dev *indio
 					INV_MPU6050_BIT_FIFO_RST);
 	if (result)
 		goto reset_fifo_fail;
+
+	/* clear timestamps fifo */
+	inv_clear_kfifo(st);
+
 	/* enable interrupt */
 	if (st->chip_config.accl_fifo_enable ||
 	    st->chip_config.gyro_fifo_enable) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:100 @ reset_fifo_fail:
 	return result;
 }
 
-static void inv_clear_kfifo(struct inv_mpu6050_state *st)
-{
-	unsigned long flags;
-
-	/* take the spin lock sem to avoid interrupt kick in */
-	spin_lock_irqsave(&st->time_stamp_lock, flags);
-	kfifo_reset(&st->timestamps);
-	spin_unlock_irqrestore(&st->time_stamp_lock, flags);
-}
-
 /**
  * inv_mpu6050_irq_handler() - Cache a timestamp at each data ready interrupt.
  */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:191 @ end_session:
 flush_fifo:
 	/* Flush HW and SW FIFOs. */
 	inv_reset_fifo(indio_dev);
-	inv_clear_kfifo(st);
 	mutex_unlock(&indio_dev->mlock);
 	iio_trigger_notify_done(indio_dev->trig);
 
Index: linux-3.18.13-rt10-r7s4/drivers/iio/industrialio-core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/iio/industrialio-core.c
+++ linux-3.18.13-rt10-r7s4/drivers/iio/industrialio-core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:835 @ static int iio_device_add_channel_sysfs(
  * @attr_list: List of IIO device attributes
  *
  * This function frees the memory allocated for each of the IIO device
- * attributes in the list. Note: if you want to reuse the list after calling
- * this function you have to reinitialize it using INIT_LIST_HEAD().
+ * attributes in the list.
  */
 void iio_free_chan_devattr_list(struct list_head *attr_list)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:843 @ void iio_free_chan_devattr_list(struct l
 
 	list_for_each_entry_safe(p, n, attr_list, l) {
 		kfree(p->dev_attr.attr.name);
+		list_del(&p->l);
 		kfree(p);
 	}
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:924 @ static void iio_device_unregister_sysfs(
 
 	iio_free_chan_devattr_list(&indio_dev->channel_attr_list);
 	kfree(indio_dev->chan_attr_group.attrs);
+	indio_dev->chan_attr_group.attrs = NULL;
 }
 
 static void iio_dev_release(struct device *device)
Index: linux-3.18.13-rt10-r7s4/drivers/iio/industrialio-event.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/iio/industrialio-event.c
+++ linux-3.18.13-rt10-r7s4/drivers/iio/industrialio-event.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:496 @ int iio_device_register_eventset(struct
 error_free_setup_event_lines:
 	iio_free_chan_devattr_list(&indio_dev->event_interface->dev_attr_list);
 	kfree(indio_dev->event_interface);
+	indio_dev->event_interface = NULL;
 	return ret;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/core/ucma.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/core/ucma.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/core/ucma.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1127 @ static int ucma_set_ib_path(struct ucma_
 	if (!optlen)
 		return -EINVAL;
 
+	memset(&sa_path, 0, sizeof(sa_path));
+	sa_path.vlan_id = 0xffff;
+
 	ib_sa_unpack_path(path_data->path_rec, &sa_path);
 	ret = rdma_set_ib_paths(ctx->cm_id, &sa_path, 1);
 	if (ret)
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/core/umem.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/core/umem.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/core/umem.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:97 @ struct ib_umem *ib_umem_get(struct ib_uc
 	if (dmasync)
 		dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
 
+	/*
+	 * If the combination of the addr and size requested for this memory
+	 * region causes an integer overflow, return error.
+	 */
+	if ((PAGE_ALIGN(addr + size) <= size) ||
+	    (PAGE_ALIGN(addr + size) <= addr))
+		return ERR_PTR(-EINVAL);
+
 	if (!can_do_mlock())
 		return ERR_PTR(-EPERM);
 
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/core/uverbs_cmd.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/core/uverbs_cmd.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/core/uverbs_cmd.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2060 @ ssize_t ib_uverbs_modify_qp(struct ib_uv
 	if (qp->real_qp == qp) {
 		ret = ib_resolve_eth_l2_attrs(qp, attr, &cmd.attr_mask);
 		if (ret)
-			goto out;
+			goto release_qp;
 		ret = qp->device->modify_qp(qp, attr,
 			modify_qp_mask(qp->qp_type, cmd.attr_mask), &udata);
 	} else {
 		ret = ib_modify_qp(qp, attr, modify_qp_mask(qp->qp_type, cmd.attr_mask));
 	}
 
-	put_qp_read(qp);
-
 	if (ret)
-		goto out;
+		goto release_qp;
 
 	ret = in_len;
 
+release_qp:
+	put_qp_read(qp);
+
 out:
 	kfree(attr);
 
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/mlx4/mad.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/hw/mlx4/mad.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/mlx4/mad.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:67 @ enum {
 #define GUID_TBL_BLK_NUM_ENTRIES 8
 #define GUID_TBL_BLK_SIZE (GUID_TBL_ENTRY_SIZE * GUID_TBL_BLK_NUM_ENTRIES)
 
+/* Counters should be saturate once they reach their maximum value */
+#define ASSIGN_32BIT_COUNTER(counter, value) do {\
+	if ((value) > U32_MAX)			 \
+		counter = cpu_to_be32(U32_MAX); \
+	else					 \
+		counter = cpu_to_be32(value);	 \
+} while (0)
+
 struct mlx4_mad_rcv_buf {
 	struct ib_grh grh;
 	u8 payload[256];
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:817 @ static int ib_process_mad(struct ib_devi
 static void edit_counter(struct mlx4_counter *cnt,
 					struct ib_pma_portcounters *pma_cnt)
 {
-	pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2));
-	pma_cnt->port_rcv_data  = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2));
-	pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames));
-	pma_cnt->port_rcv_packets  = cpu_to_be32(be64_to_cpu(cnt->rx_frames));
+	ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
+			     (be64_to_cpu(cnt->tx_bytes) >> 2));
+	ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
+			     (be64_to_cpu(cnt->rx_bytes) >> 2));
+	ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
+			     be64_to_cpu(cnt->tx_frames));
+	ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
+			     be64_to_cpu(cnt->rx_frames));
 }
 
 static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/mlx4/main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/hw/mlx4/main.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/mlx4/main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1224 @ static int mlx4_ib_mcg_attach(struct ib_
 	struct mlx4_ib_qp *mqp = to_mqp(ibqp);
 	u64 reg_id;
 	struct mlx4_ib_steering *ib_steering = NULL;
-	enum mlx4_protocol prot = (gid->raw[1] == 0x0e) ?
-		MLX4_PROT_IB_IPV4 : MLX4_PROT_IB_IPV6;
+	enum mlx4_protocol prot = MLX4_PROT_IB_IPV6;
 
 	if (mdev->dev->caps.steering_mode ==
 	    MLX4_STEERING_MODE_DEVICE_MANAGED) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1237 @ static int mlx4_ib_mcg_attach(struct ib_
 				    !!(mqp->flags &
 				       MLX4_IB_QP_BLOCK_MULTICAST_LOOPBACK),
 				    prot, &reg_id);
-	if (err)
+	if (err) {
+		pr_err("multicast attach op failed, err %d\n", err);
 		goto err_malloc;
+	}
 
 	err = add_gid_entry(ibqp, gid);
 	if (err)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1288 @ static int mlx4_ib_mcg_detach(struct ib_
 	struct net_device *ndev;
 	struct mlx4_ib_gid_entry *ge;
 	u64 reg_id = 0;
-	enum mlx4_protocol prot = (gid->raw[1] == 0x0e) ?
-		MLX4_PROT_IB_IPV4 : MLX4_PROT_IB_IPV6;
+	enum mlx4_protocol prot =  MLX4_PROT_IB_IPV6;
 
 	if (mdev->dev->caps.steering_mode ==
 	    MLX4_STEERING_MODE_DEVICE_MANAGED) {
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/mlx4/qp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/hw/mlx4/qp.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/mlx4/qp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1672 @ static int __mlx4_ib_modify_qp(struct ib
 			    qp->mlx4_ib_qp_type == MLX4_IB_QPT_PROXY_GSI ||
 			    qp->mlx4_ib_qp_type == MLX4_IB_QPT_TUN_GSI) {
 				err = handle_eth_ud_smac_index(dev, qp, (u8 *)attr->smac, context);
-				if (err)
-					return -EINVAL;
+				if (err) {
+					err = -EINVAL;
+					goto out;
+				}
 				if (qp->mlx4_ib_qp_type == MLX4_IB_QPT_PROXY_GSI)
 					dev->qp1_proxy[qp->port - 1] = qp;
 			}
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/mlx5/main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/hw/mlx5/main.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/mlx5/main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:990 @ static int get_port_caps(struct mlx5_ib_
 	struct ib_device_attr *dprops = NULL;
 	struct ib_port_attr *pprops = NULL;
 	struct mlx5_general_caps *gen;
-	int err = 0;
+	int err = -ENOMEM;
 	int port;
 
 	gen = &dev->mdev->caps.gen;
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/qib/qib.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/hw/qib/qib.h
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/qib/qib.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1085 @ struct qib_devdata {
 	/* control high-level access to EEPROM */
 	struct mutex eep_lock;
 	uint64_t traffic_wds;
-	/* active time is kept in seconds, but logged in hours */
-	atomic_t active_time;
-	/* Below are nominal shadow of EEPROM, new since last EEPROM update */
-	uint8_t eep_st_errs[QIB_EEP_LOG_CNT];
-	uint8_t eep_st_new_errs[QIB_EEP_LOG_CNT];
-	uint16_t eep_hrs;
 	/*
 	 * masks for which bits of errs, hwerrs that cause
 	 * each of the counters to increment.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1306 @ int qib_twsi_blk_rd(struct qib_devdata *
 int qib_twsi_blk_wr(struct qib_devdata *dd, int dev, int addr,
 		    const void *buffer, int len);
 void qib_get_eeprom_info(struct qib_devdata *);
-int qib_update_eeprom_log(struct qib_devdata *dd);
-void qib_inc_eeprom_err(struct qib_devdata *dd, u32 eidx, u32 incr);
+#define qib_inc_eeprom_err(dd, eidx, incr)
 void qib_dump_lookup_output_queue(struct qib_devdata *);
 void qib_force_pio_avail_update(struct qib_devdata *);
 void qib_clear_symerror_on_linkup(unsigned long opaque);
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/qib/qib_eeprom.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/hw/qib/qib_eeprom.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/qib/qib_eeprom.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:270 @ void qib_get_eeprom_info(struct qib_devd
 			"Board SN %s did not pass functional test: %s\n",
 			dd->serial, ifp->if_comment);
 
-	memcpy(&dd->eep_st_errs, &ifp->if_errcntp, QIB_EEP_LOG_CNT);
-	/*
-	 * Power-on (actually "active") hours are kept as little-endian value
-	 * in EEPROM, but as seconds in a (possibly as small as 24-bit)
-	 * atomic_t while running.
-	 */
-	atomic_set(&dd->active_time, 0);
-	dd->eep_hrs = ifp->if_powerhour[0] | (ifp->if_powerhour[1] << 8);
-
 done:
 	vfree(buf);
 
 bail:;
 }
 
-/**
- * qib_update_eeprom_log - copy active-time and error counters to eeprom
- * @dd: the qlogic_ib device
- *
- * Although the time is kept as seconds in the qib_devdata struct, it is
- * rounded to hours for re-write, as we have only 16 bits in EEPROM.
- * First-cut code reads whole (expected) struct qib_flash, modifies,
- * re-writes. Future direction: read/write only what we need, assuming
- * that the EEPROM had to have been "good enough" for driver init, and
- * if not, we aren't making it worse.
- *
- */
-int qib_update_eeprom_log(struct qib_devdata *dd)
-{
-	void *buf;
-	struct qib_flash *ifp;
-	int len, hi_water;
-	uint32_t new_time, new_hrs;
-	u8 csum;
-	int ret, idx;
-	unsigned long flags;
-
-	/* first, check if we actually need to do anything. */
-	ret = 0;
-	for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) {
-		if (dd->eep_st_new_errs[idx]) {
-			ret = 1;
-			break;
-		}
-	}
-	new_time = atomic_read(&dd->active_time);
-
-	if (ret == 0 && new_time < 3600)
-		goto bail;
-
-	/*
-	 * The quick-check above determined that there is something worthy
-	 * of logging, so get current contents and do a more detailed idea.
-	 * read full flash, not just currently used part, since it may have
-	 * been written with a newer definition
-	 */
-	len = sizeof(struct qib_flash);
-	buf = vmalloc(len);
-	ret = 1;
-	if (!buf) {
-		qib_dev_err(dd,
-			"Couldn't allocate memory to read %u bytes from eeprom for logging\n",
-			len);
-		goto bail;
-	}
-
-	/* Grab semaphore and read current EEPROM. If we get an
-	 * error, let go, but if not, keep it until we finish write.
-	 */
-	ret = mutex_lock_interruptible(&dd->eep_lock);
-	if (ret) {
-		qib_dev_err(dd, "Unable to acquire EEPROM for logging\n");
-		goto free_bail;
-	}
-	ret = qib_twsi_blk_rd(dd, dd->twsi_eeprom_dev, 0, buf, len);
-	if (ret) {
-		mutex_unlock(&dd->eep_lock);
-		qib_dev_err(dd, "Unable read EEPROM for logging\n");
-		goto free_bail;
-	}
-	ifp = (struct qib_flash *)buf;
-
-	csum = flash_csum(ifp, 0);
-	if (csum != ifp->if_csum) {
-		mutex_unlock(&dd->eep_lock);
-		qib_dev_err(dd, "EEPROM cks err (0x%02X, S/B 0x%02X)\n",
-			    csum, ifp->if_csum);
-		ret = 1;
-		goto free_bail;
-	}
-	hi_water = 0;
-	spin_lock_irqsave(&dd->eep_st_lock, flags);
-	for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) {
-		int new_val = dd->eep_st_new_errs[idx];
-		if (new_val) {
-			/*
-			 * If we have seen any errors, add to EEPROM values
-			 * We need to saturate at 0xFF (255) and we also
-			 * would need to adjust the checksum if we were
-			 * trying to minimize EEPROM traffic
-			 * Note that we add to actual current count in EEPROM,
-			 * in case it was altered while we were running.
-			 */
-			new_val += ifp->if_errcntp[idx];
-			if (new_val > 0xFF)
-				new_val = 0xFF;
-			if (ifp->if_errcntp[idx] != new_val) {
-				ifp->if_errcntp[idx] = new_val;
-				hi_water = offsetof(struct qib_flash,
-						    if_errcntp) + idx;
-			}
-			/*
-			 * update our shadow (used to minimize EEPROM
-			 * traffic), to match what we are about to write.
-			 */
-			dd->eep_st_errs[idx] = new_val;
-			dd->eep_st_new_errs[idx] = 0;
-		}
-	}
-	/*
-	 * Now update active-time. We would like to round to the nearest hour
-	 * but unless atomic_t are sure to be proper signed ints we cannot,
-	 * because we need to account for what we "transfer" to EEPROM and
-	 * if we log an hour at 31 minutes, then we would need to set
-	 * active_time to -29 to accurately count the _next_ hour.
-	 */
-	if (new_time >= 3600) {
-		new_hrs = new_time / 3600;
-		atomic_sub((new_hrs * 3600), &dd->active_time);
-		new_hrs += dd->eep_hrs;
-		if (new_hrs > 0xFFFF)
-			new_hrs = 0xFFFF;
-		dd->eep_hrs = new_hrs;
-		if ((new_hrs & 0xFF) != ifp->if_powerhour[0]) {
-			ifp->if_powerhour[0] = new_hrs & 0xFF;
-			hi_water = offsetof(struct qib_flash, if_powerhour);
-		}
-		if ((new_hrs >> 8) != ifp->if_powerhour[1]) {
-			ifp->if_powerhour[1] = new_hrs >> 8;
-			hi_water = offsetof(struct qib_flash, if_powerhour) + 1;
-		}
-	}
-	/*
-	 * There is a tiny possibility that we could somehow fail to write
-	 * the EEPROM after updating our shadows, but problems from holding
-	 * the spinlock too long are a much bigger issue.
-	 */
-	spin_unlock_irqrestore(&dd->eep_st_lock, flags);
-	if (hi_water) {
-		/* we made some change to the data, uopdate cksum and write */
-		csum = flash_csum(ifp, 1);
-		ret = eeprom_write_with_enable(dd, 0, buf, hi_water + 1);
-	}
-	mutex_unlock(&dd->eep_lock);
-	if (ret)
-		qib_dev_err(dd, "Failed updating EEPROM\n");
-
-free_bail:
-	vfree(buf);
-bail:
-	return ret;
-}
-
-/**
- * qib_inc_eeprom_err - increment one of the four error counters
- * that are logged to EEPROM.
- * @dd: the qlogic_ib device
- * @eidx: 0..3, the counter to increment
- * @incr: how much to add
- *
- * Each counter is 8-bits, and saturates at 255 (0xFF). They
- * are copied to the EEPROM (aka flash) whenever qib_update_eeprom_log()
- * is called, but it can only be called in a context that allows sleep.
- * This function can be called even at interrupt level.
- */
-void qib_inc_eeprom_err(struct qib_devdata *dd, u32 eidx, u32 incr)
-{
-	uint new_val;
-	unsigned long flags;
-
-	spin_lock_irqsave(&dd->eep_st_lock, flags);
-	new_val = dd->eep_st_new_errs[eidx] + incr;
-	if (new_val > 255)
-		new_val = 255;
-	dd->eep_st_new_errs[eidx] = new_val;
-	spin_unlock_irqrestore(&dd->eep_st_lock, flags);
-}
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/qib/qib_iba6120.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/hw/qib/qib_iba6120.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/qib/qib_iba6120.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2684 @ static void qib_get_6120_faststats(unsig
 	spin_lock_irqsave(&dd->eep_st_lock, flags);
 	traffic_wds -= dd->traffic_wds;
 	dd->traffic_wds += traffic_wds;
-	if (traffic_wds  >= QIB_TRAFFIC_ACTIVE_THRESHOLD)
-		atomic_add(5, &dd->active_time); /* S/B #define */
 	spin_unlock_irqrestore(&dd->eep_st_lock, flags);
 
 	qib_chk_6120_errormask(dd);
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/qib/qib_iba7220.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/hw/qib/qib_iba7220.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/qib/qib_iba7220.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3300 @ static void qib_get_7220_faststats(unsig
 	spin_lock_irqsave(&dd->eep_st_lock, flags);
 	traffic_wds -= dd->traffic_wds;
 	dd->traffic_wds += traffic_wds;
-	if (traffic_wds  >= QIB_TRAFFIC_ACTIVE_THRESHOLD)
-		atomic_add(5, &dd->active_time); /* S/B #define */
 	spin_unlock_irqrestore(&dd->eep_st_lock, flags);
 done:
 	mod_timer(&dd->stats_timer, jiffies + HZ * ACTIVITY_TIMER);
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/qib/qib_iba7322.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/hw/qib/qib_iba7322.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/qib/qib_iba7322.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5181 @ static void qib_get_7322_faststats(unsig
 		spin_lock_irqsave(&ppd->dd->eep_st_lock, flags);
 		traffic_wds -= ppd->dd->traffic_wds;
 		ppd->dd->traffic_wds += traffic_wds;
-		if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD)
-			atomic_add(ACTIVITY_TIMER, &ppd->dd->active_time);
 		spin_unlock_irqrestore(&ppd->dd->eep_st_lock, flags);
 		if (ppd->cpspec->qdr_dfe_on && (ppd->link_speed_active &
 						QIB_IB_QDR) &&
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/qib/qib_init.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/hw/qib/qib_init.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/qib/qib_init.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:934 @ static void qib_shutdown_device(struct q
 		qib_free_pportdata(ppd);
 	}
 
-	qib_update_eeprom_log(dd);
 }
 
 /**
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/qib/qib_sysfs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/hw/qib/qib_sysfs.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/hw/qib/qib_sysfs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:614 @ bail:
 	return ret < 0 ? ret : count;
 }
 
-static ssize_t show_logged_errs(struct device *device,
-				struct device_attribute *attr, char *buf)
-{
-	struct qib_ibdev *dev =
-		container_of(device, struct qib_ibdev, ibdev.dev);
-	struct qib_devdata *dd = dd_from_dev(dev);
-	int idx, count;
-
-	/* force consistency with actual EEPROM */
-	if (qib_update_eeprom_log(dd) != 0)
-		return -ENXIO;
-
-	count = 0;
-	for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) {
-		count += scnprintf(buf + count, PAGE_SIZE - count, "%d%c",
-				   dd->eep_st_errs[idx],
-				   idx == (QIB_EEP_LOG_CNT - 1) ? '\n' : ' ');
-	}
-
-	return count;
-}
-
 /*
  * Dump tempsense regs. in decimal, to ease shell-scripts.
  */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:660 @ static DEVICE_ATTR(nctxts, S_IRUGO, show
 static DEVICE_ATTR(nfreectxts, S_IRUGO, show_nfreectxts, NULL);
 static DEVICE_ATTR(serial, S_IRUGO, show_serial, NULL);
 static DEVICE_ATTR(boardversion, S_IRUGO, show_boardversion, NULL);
-static DEVICE_ATTR(logged_errors, S_IRUGO, show_logged_errs, NULL);
 static DEVICE_ATTR(tempsense, S_IRUGO, show_tempsense, NULL);
 static DEVICE_ATTR(localbus_info, S_IRUGO, show_localbus_info, NULL);
 static DEVICE_ATTR(chip_reset, S_IWUSR, NULL, store_chip_reset);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:673 @ static struct device_attribute *qib_attr
 	&dev_attr_nfreectxts,
 	&dev_attr_serial,
 	&dev_attr_boardversion,
-	&dev_attr_logged_errors,
 	&dev_attr_tempsense,
 	&dev_attr_localbus_info,
 	&dev_attr_chip_reset,
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/ulp/iser/iscsi_iser.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/ulp/iser/iscsi_iser.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:435 @ struct fast_reg_descriptor {
  * @cma_id:              rdma_cm connection maneger handle
  * @qp:                  Connection Queue-pair
  * @post_recv_buf_count: post receive counter
+ * @sig_count:           send work request signal count
  * @rx_wr:               receive work request for batch posts
  * @device:              reference to iser device
  * @comp:                iser completion context
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:456 @ struct ib_conn {
 	struct rdma_cm_id           *cma_id;
 	struct ib_qp	            *qp;
 	int                          post_recv_buf_count;
+	u8                           sig_count;
 	struct ib_recv_wr	     rx_wr[ISER_MIN_POSTED_RX];
 	struct iser_device          *device;
 	struct iser_comp	    *comp;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:657 @ int iser_dma_map_task_data(struct iscsi_
 			   enum dma_data_direction dma_dir);
 
 void iser_dma_unmap_task_data(struct iscsi_iser_task *iser_task,
-			      struct iser_data_buf *data);
+			      struct iser_data_buf *data,
+			      enum dma_data_direction dir);
+
 int  iser_initialize_task_headers(struct iscsi_task *task,
 			struct iser_tx_desc *tx_desc);
 int iser_alloc_rx_descriptors(struct iser_conn *iser_conn,
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/ulp/iser/iser_initiator.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/ulp/iser/iser_initiator.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/ulp/iser/iser_initiator.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:323 @ void iser_free_rx_descriptors(struct ise
 	struct ib_conn *ib_conn = &iser_conn->ib_conn;
 	struct iser_device *device = ib_conn->device;
 
-	if (!iser_conn->rx_descs)
-		goto free_login_buf;
-
 	if (device->iser_free_rdma_reg_res)
 		device->iser_free_rdma_reg_res(ib_conn);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:334 @ void iser_free_rx_descriptors(struct ise
 	/* make sure we never redo any unmapping */
 	iser_conn->rx_descs = NULL;
 
-free_login_buf:
 	iser_free_login_buf(iser_conn);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:368 @ static int iser_post_rx_bufs(struct iscs
 	return 0;
 }
 
-static inline bool iser_signal_comp(int sig_count)
+static inline bool iser_signal_comp(u8 sig_count)
 {
 	return ((sig_count % ISER_SIGNAL_CMD_COUNT) == 0);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:387 @ int iser_send_command(struct iscsi_conn
 	struct iscsi_scsi_req *hdr = (struct iscsi_scsi_req *)task->hdr;
 	struct scsi_cmnd *sc  =  task->sc;
 	struct iser_tx_desc *tx_desc = &iser_task->desc;
-	static unsigned sig_count;
+	u8 sig_count = ++iser_conn->ib_conn.sig_count;
 
 	edtl = ntohl(hdr->data_length);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:434 @ int iser_send_command(struct iscsi_conn
 	iser_task->status = ISER_TASK_STATUS_STARTED;
 
 	err = iser_post_send(&iser_conn->ib_conn, tx_desc,
-			     iser_signal_comp(++sig_count));
+			     iser_signal_comp(sig_count));
 	if (!err)
 		return 0;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:713 @ void iser_task_rdma_finalize(struct iscs
 		device->iser_unreg_rdma_mem(iser_task, ISER_DIR_IN);
 		if (is_rdma_data_aligned)
 			iser_dma_unmap_task_data(iser_task,
-						 &iser_task->data[ISER_DIR_IN]);
+						 &iser_task->data[ISER_DIR_IN],
+						 DMA_FROM_DEVICE);
 		if (prot_count && is_rdma_prot_aligned)
 			iser_dma_unmap_task_data(iser_task,
-						 &iser_task->prot[ISER_DIR_IN]);
+						 &iser_task->prot[ISER_DIR_IN],
+						 DMA_FROM_DEVICE);
 	}
 
 	if (iser_task->dir[ISER_DIR_OUT]) {
 		device->iser_unreg_rdma_mem(iser_task, ISER_DIR_OUT);
 		if (is_rdma_data_aligned)
 			iser_dma_unmap_task_data(iser_task,
-						 &iser_task->data[ISER_DIR_OUT]);
+						 &iser_task->data[ISER_DIR_OUT],
+						 DMA_TO_DEVICE);
 		if (prot_count && is_rdma_prot_aligned)
 			iser_dma_unmap_task_data(iser_task,
-						 &iser_task->prot[ISER_DIR_OUT]);
+						 &iser_task->prot[ISER_DIR_OUT],
+						 DMA_TO_DEVICE);
 	}
 }
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/ulp/iser/iser_memory.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/ulp/iser/iser_memory.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/ulp/iser/iser_memory.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:336 @ int iser_dma_map_task_data(struct iscsi_
 }
 
 void iser_dma_unmap_task_data(struct iscsi_iser_task *iser_task,
-			      struct iser_data_buf *data)
+			      struct iser_data_buf *data,
+			      enum dma_data_direction dir)
 {
 	struct ib_device *dev;
 
 	dev = iser_task->iser_conn->ib_conn.device->ib_device;
-	ib_dma_unmap_sg(dev, data->buf, data->size, DMA_FROM_DEVICE);
+	ib_dma_unmap_sg(dev, data->buf, data->size, dir);
 }
 
 static int fall_to_bounce_buf(struct iscsi_iser_task *iser_task,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:362 @ static int fall_to_bounce_buf(struct isc
 		iser_data_buf_dump(mem, ibdev);
 
 	/* unmap the command data before accessing it */
-	iser_dma_unmap_task_data(iser_task, mem);
+	iser_dma_unmap_task_data(iser_task, mem,
+				 (cmd_dir == ISER_DIR_OUT) ?
+				 DMA_TO_DEVICE : DMA_FROM_DEVICE);
 
 	/* allocate copy buf, if we are writing, copy the */
 	/* unaligned scatterlist, dma map the copy        */
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/ulp/iser/iser_verbs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/ulp/iser/iser_verbs.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/ulp/iser/iser_verbs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:570 @ void iser_release_work(struct work_struc
 /**
  * iser_free_ib_conn_res - release IB related resources
  * @iser_conn: iser connection struct
- * @destroy_device: indicator if we need to try to release
- *     the iser device (only iscsi shutdown and DEVICE_REMOVAL
- *     will use this.
+ * @destroy: indicator if we need to try to release the
+ *     iser device and memory regoins pool (only iscsi
+ *     shutdown and DEVICE_REMOVAL will use this).
  *
  * This routine is called with the iser state mutex held
  * so the cm_id removal is out of here. It is Safe to
  * be invoked multiple times.
  */
 static void iser_free_ib_conn_res(struct iser_conn *iser_conn,
-				  bool destroy_device)
+				  bool destroy)
 {
 	struct ib_conn *ib_conn = &iser_conn->ib_conn;
 	struct iser_device *device = ib_conn->device;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:587 @ static void iser_free_ib_conn_res(struct
 	iser_info("freeing conn %p cma_id %p qp %p\n",
 		  iser_conn, ib_conn->cma_id, ib_conn->qp);
 
-	iser_free_rx_descriptors(iser_conn);
-
 	if (ib_conn->qp != NULL) {
 		ib_conn->comp->active_qps--;
 		rdma_destroy_qp(ib_conn->cma_id);
 		ib_conn->qp = NULL;
 	}
 
-	if (destroy_device && device != NULL) {
-		iser_device_try_release(device);
-		ib_conn->device = NULL;
+	if (destroy) {
+		if (iser_conn->rx_descs)
+			iser_free_rx_descriptors(iser_conn);
+
+		if (device != NULL) {
+			iser_device_try_release(device);
+			ib_conn->device = NULL;
+		}
 	}
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:809 @ static void iser_disconnected_handler(st
 }
 
 static void iser_cleanup_handler(struct rdma_cm_id *cma_id,
-				 bool destroy_device)
+				 bool destroy)
 {
 	struct iser_conn *iser_conn = (struct iser_conn *)cma_id->context;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:819 @ static void iser_cleanup_handler(struct
 	 * and flush errors.
 	 */
 	iser_disconnected_handler(cma_id);
-	iser_free_ib_conn_res(iser_conn, destroy_device);
+	iser_free_ib_conn_res(iser_conn, destroy);
 	complete(&iser_conn->ib_completion);
 };
 
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/ulp/isert/ib_isert.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/ulp/isert/ib_isert.c
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/ulp/isert/ib_isert.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:44 @ static DEFINE_MUTEX(device_list_mutex);
 static LIST_HEAD(device_list);
 static struct workqueue_struct *isert_rx_wq;
 static struct workqueue_struct *isert_comp_wq;
+static struct workqueue_struct *isert_release_wq;
 
 static void
 isert_unmap_cmd(struct isert_cmd *isert_cmd, struct isert_conn *isert_conn);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:58 @ isert_reg_rdma(struct iscsi_conn *conn,
 	       struct isert_rdma_wr *wr);
 static int
 isert_put_response(struct iscsi_conn *conn, struct iscsi_cmd *cmd);
+static int
+isert_rdma_post_recvl(struct isert_conn *isert_conn);
+static int
+isert_rdma_accept(struct isert_conn *isert_conn);
+struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);
+
+static inline bool
+isert_prot_cmd(struct isert_conn *conn, struct se_cmd *cmd)
+{
+	return (conn->pi_support &&
+		cmd->prot_op != TARGET_PROT_NORMAL);
+}
+
 
 static void
 isert_qp_event_callback(struct ib_event *e, void *context)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:107 @ isert_query_device(struct ib_device *ib_
 }
 
 static int
-isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id,
-		    u8 protection)
+isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id)
 {
 	struct isert_device *device = isert_conn->conn_device;
 	struct ib_qp_init_attr attr;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:142 @ isert_conn_setup_qp(struct isert_conn *i
 	attr.cap.max_recv_sge = 1;
 	attr.sq_sig_type = IB_SIGNAL_REQ_WR;
 	attr.qp_type = IB_QPT_RC;
-	if (protection)
+	if (device->pi_capable)
 		attr.create_flags |= IB_QP_CREATE_SIGNATURE_EN;
 
 	pr_debug("isert_conn_setup_qp cma_id->device: %p\n",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:153 @ isert_conn_setup_qp(struct isert_conn *i
 	ret = rdma_create_qp(cma_id, isert_conn->conn_pd, &attr);
 	if (ret) {
 		pr_err("rdma_create_qp failed for cma_id %d\n", ret);
-		return ret;
+		goto err;
 	}
 	isert_conn->conn_qp = cma_id->qp;
 	pr_debug("rdma_create_qp() returned success >>>>>>>>>>>>>>>>>>>>>>>>>.\n");
 
 	return 0;
+err:
+	mutex_lock(&device_list_mutex);
+	device->cq_active_qps[min_index]--;
+	mutex_unlock(&device_list_mutex);
+
+	return ret;
 }
 
 static void
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:452 @ isert_conn_free_fastreg_pool(struct iser
 }
 
 static int
+isert_create_pi_ctx(struct fast_reg_descriptor *desc,
+		    struct ib_device *device,
+		    struct ib_pd *pd)
+{
+	struct ib_mr_init_attr mr_init_attr;
+	struct pi_context *pi_ctx;
+	int ret;
+
+	pi_ctx = kzalloc(sizeof(*desc->pi_ctx), GFP_KERNEL);
+	if (!pi_ctx) {
+		pr_err("Failed to allocate pi context\n");
+		return -ENOMEM;
+	}
+
+	pi_ctx->prot_frpl = ib_alloc_fast_reg_page_list(device,
+					    ISCSI_ISER_SG_TABLESIZE);
+	if (IS_ERR(pi_ctx->prot_frpl)) {
+		pr_err("Failed to allocate prot frpl err=%ld\n",
+			  PTR_ERR(pi_ctx->prot_frpl));
+		ret = PTR_ERR(pi_ctx->prot_frpl);
+		goto err_pi_ctx;
+	}
+
+	pi_ctx->prot_mr = ib_alloc_fast_reg_mr(pd, ISCSI_ISER_SG_TABLESIZE);
+	if (IS_ERR(pi_ctx->prot_mr)) {
+		pr_err("Failed to allocate prot frmr err=%ld\n",
+			  PTR_ERR(pi_ctx->prot_mr));
+		ret = PTR_ERR(pi_ctx->prot_mr);
+		goto err_prot_frpl;
+	}
+	desc->ind |= ISERT_PROT_KEY_VALID;
+
+	memset(&mr_init_attr, 0, sizeof(mr_init_attr));
+	mr_init_attr.max_reg_descriptors = 2;
+	mr_init_attr.flags |= IB_MR_SIGNATURE_EN;
+	pi_ctx->sig_mr = ib_create_mr(pd, &mr_init_attr);
+	if (IS_ERR(pi_ctx->sig_mr)) {
+		pr_err("Failed to allocate signature enabled mr err=%ld\n",
+			  PTR_ERR(pi_ctx->sig_mr));
+		ret = PTR_ERR(pi_ctx->sig_mr);
+		goto err_prot_mr;
+	}
+
+	desc->pi_ctx = pi_ctx;
+	desc->ind |= ISERT_SIG_KEY_VALID;
+	desc->ind &= ~ISERT_PROTECTED;
+
+	return 0;
+
+err_prot_mr:
+	ib_dereg_mr(desc->pi_ctx->prot_mr);
+err_prot_frpl:
+	ib_free_fast_reg_page_list(desc->pi_ctx->prot_frpl);
+err_pi_ctx:
+	kfree(desc->pi_ctx);
+
+	return ret;
+}
+
+static int
 isert_create_fr_desc(struct ib_device *ib_device, struct ib_pd *pd,
-		     struct fast_reg_descriptor *fr_desc, u8 protection)
+		     struct fast_reg_descriptor *fr_desc)
 {
 	int ret;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:532 @ isert_create_fr_desc(struct ib_device *i
 		ret = PTR_ERR(fr_desc->data_mr);
 		goto err_data_frpl;
 	}
-	pr_debug("Create fr_desc %p page_list %p\n",
-		 fr_desc, fr_desc->data_frpl->page_list);
 	fr_desc->ind |= ISERT_DATA_KEY_VALID;
 
-	if (protection) {
-		struct ib_mr_init_attr mr_init_attr = {0};
-		struct pi_context *pi_ctx;
-
-		fr_desc->pi_ctx = kzalloc(sizeof(*fr_desc->pi_ctx), GFP_KERNEL);
-		if (!fr_desc->pi_ctx) {
-			pr_err("Failed to allocate pi context\n");
-			ret = -ENOMEM;
-			goto err_data_mr;
-		}
-		pi_ctx = fr_desc->pi_ctx;
-
-		pi_ctx->prot_frpl = ib_alloc_fast_reg_page_list(ib_device,
-						    ISCSI_ISER_SG_TABLESIZE);
-		if (IS_ERR(pi_ctx->prot_frpl)) {
-			pr_err("Failed to allocate prot frpl err=%ld\n",
-			       PTR_ERR(pi_ctx->prot_frpl));
-			ret = PTR_ERR(pi_ctx->prot_frpl);
-			goto err_pi_ctx;
-		}
-
-		pi_ctx->prot_mr = ib_alloc_fast_reg_mr(pd, ISCSI_ISER_SG_TABLESIZE);
-		if (IS_ERR(pi_ctx->prot_mr)) {
-			pr_err("Failed to allocate prot frmr err=%ld\n",
-			       PTR_ERR(pi_ctx->prot_mr));
-			ret = PTR_ERR(pi_ctx->prot_mr);
-			goto err_prot_frpl;
-		}
-		fr_desc->ind |= ISERT_PROT_KEY_VALID;
-
-		mr_init_attr.max_reg_descriptors = 2;
-		mr_init_attr.flags |= IB_MR_SIGNATURE_EN;
-		pi_ctx->sig_mr = ib_create_mr(pd, &mr_init_attr);
-		if (IS_ERR(pi_ctx->sig_mr)) {
-			pr_err("Failed to allocate signature enabled mr err=%ld\n",
-			       PTR_ERR(pi_ctx->sig_mr));
-			ret = PTR_ERR(pi_ctx->sig_mr);
-			goto err_prot_mr;
-		}
-		fr_desc->ind |= ISERT_SIG_KEY_VALID;
-	}
-	fr_desc->ind &= ~ISERT_PROTECTED;
+	pr_debug("Created fr_desc %p\n", fr_desc);
 
 	return 0;
-err_prot_mr:
-	ib_dereg_mr(fr_desc->pi_ctx->prot_mr);
-err_prot_frpl:
-	ib_free_fast_reg_page_list(fr_desc->pi_ctx->prot_frpl);
-err_pi_ctx:
-	kfree(fr_desc->pi_ctx);
-err_data_mr:
-	ib_dereg_mr(fr_desc->data_mr);
+
 err_data_frpl:
 	ib_free_fast_reg_page_list(fr_desc->data_frpl);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:545 @ err_data_frpl:
 }
 
 static int
-isert_conn_create_fastreg_pool(struct isert_conn *isert_conn, u8 pi_support)
+isert_conn_create_fastreg_pool(struct isert_conn *isert_conn)
 {
 	struct fast_reg_descriptor *fr_desc;
 	struct isert_device *device = isert_conn->conn_device;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:569 @ isert_conn_create_fastreg_pool(struct is
 		}
 
 		ret = isert_create_fr_desc(device->ib_device,
-					   isert_conn->conn_pd, fr_desc,
-					   pi_support);
+					   isert_conn->conn_pd, fr_desc);
 		if (ret) {
 			pr_err("Failed to create fastreg descriptor err=%d\n",
 			       ret);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:594 @ err:
 static int
 isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
 {
-	struct iscsi_np *np = cma_id->context;
-	struct isert_np *isert_np = np->np_context;
+	struct isert_np *isert_np = cma_id->context;
+	struct iscsi_np *np = isert_np->np;
 	struct isert_conn *isert_conn;
 	struct isert_device *device;
 	struct ib_device *ib_dev = cma_id->device;
 	int ret = 0;
-	u8 pi_support;
 
 	spin_lock_bh(&np->np_thread_lock);
 	if (!np->enabled) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:620 @ isert_connect_request(struct rdma_cm_id
 	isert_conn->state = ISER_CONN_INIT;
 	INIT_LIST_HEAD(&isert_conn->conn_accept_node);
 	init_completion(&isert_conn->conn_login_comp);
+	init_completion(&isert_conn->login_req_comp);
 	init_completion(&isert_conn->conn_wait);
 	init_completion(&isert_conn->conn_wait_comp_err);
 	kref_init(&isert_conn->conn_kref);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:628 @ isert_connect_request(struct rdma_cm_id
 	spin_lock_init(&isert_conn->conn_lock);
 	INIT_LIST_HEAD(&isert_conn->conn_fr_pool);
 
-	cma_id->context = isert_conn;
 	isert_conn->conn_cm_id = cma_id;
 
 	isert_conn->login_buf = kzalloc(ISCSI_DEF_MAX_RECV_SEG_LEN +
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:699 @ isert_connect_request(struct rdma_cm_id
 		goto out_mr;
 	}
 
-	pi_support = np->tpg_np->tpg->tpg_attrib.t10_pi;
-	if (pi_support && !device->pi_capable) {
-		pr_err("Protection information requested but not supported, "
-		       "rejecting connect request\n");
-		ret = rdma_reject(cma_id, NULL, 0);
-		goto out_mr;
-	}
+	ret = isert_conn_setup_qp(isert_conn, cma_id);
+	if (ret)
+		goto out_conn_dev;
 
-	ret = isert_conn_setup_qp(isert_conn, cma_id, pi_support);
+	ret = isert_rdma_post_recvl(isert_conn);
+	if (ret)
+		goto out_conn_dev;
+
+	ret = isert_rdma_accept(isert_conn);
 	if (ret)
 		goto out_conn_dev;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:735 @ out_login_buf:
 	kfree(isert_conn->login_buf);
 out:
 	kfree(isert_conn);
+	rdma_reject(cma_id, NULL, 0);
 	return ret;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:751 @ isert_connect_release(struct isert_conn
 	if (device && device->use_fastreg)
 		isert_conn_free_fastreg_pool(isert_conn);
 
+	isert_free_rx_descriptors(isert_conn);
+	rdma_destroy_id(isert_conn->conn_cm_id);
+
 	if (isert_conn->conn_qp) {
 		cq_index = ((struct isert_cq_desc *)
 			isert_conn->conn_qp->recv_cq->cq_context)->cq_index;
 		pr_debug("isert_connect_release: cq_index: %d\n", cq_index);
+		mutex_lock(&device_list_mutex);
 		isert_conn->conn_device->cq_active_qps[cq_index]--;
+		mutex_unlock(&device_list_mutex);
 
-		rdma_destroy_qp(isert_conn->conn_cm_id);
+		ib_destroy_qp(isert_conn->conn_qp);
 	}
 
-	isert_free_rx_descriptors(isert_conn);
-	rdma_destroy_id(isert_conn->conn_cm_id);
-
 	ib_dereg_mr(isert_conn->conn_mr);
 	ib_dealloc_pd(isert_conn->conn_pd);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:787 @ isert_connect_release(struct isert_conn
 static void
 isert_connected_handler(struct rdma_cm_id *cma_id)
 {
-	struct isert_conn *isert_conn = cma_id->context;
+	struct isert_conn *isert_conn = cma_id->qp->qp_context;
+
+	pr_info("conn %p\n", isert_conn);
 
-	kref_get(&isert_conn->conn_kref);
+	if (!kref_get_unless_zero(&isert_conn->conn_kref)) {
+		pr_warn("conn %p connect_release is running\n", isert_conn);
+		return;
+	}
+
+	mutex_lock(&isert_conn->conn_mutex);
+	if (isert_conn->state != ISER_CONN_FULL_FEATURE)
+		isert_conn->state = ISER_CONN_UP;
+	mutex_unlock(&isert_conn->conn_mutex);
 }
 
 static void
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:820 @ isert_put_conn(struct isert_conn *isert_
 	kref_put(&isert_conn->conn_kref, isert_release_conn_kref);
 }
 
+/**
+ * isert_conn_terminate() - Initiate connection termination
+ * @isert_conn: isert connection struct
+ *
+ * Notes:
+ * In case the connection state is FULL_FEATURE, move state
+ * to TEMINATING and start teardown sequence (rdma_disconnect).
+ * In case the connection state is UP, complete flush as well.
+ *
+ * This routine must be called with conn_mutex held. Thus it is
+ * safe to call multiple times.
+ */
 static void
-isert_disconnect_work(struct work_struct *work)
+isert_conn_terminate(struct isert_conn *isert_conn)
 {
-	struct isert_conn *isert_conn = container_of(work,
-				struct isert_conn, conn_logout_work);
+	int err;
 
-	pr_debug("isert_disconnect_work(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
-	mutex_lock(&isert_conn->conn_mutex);
-	if (isert_conn->state == ISER_CONN_UP)
+	switch (isert_conn->state) {
+	case ISER_CONN_TERMINATING:
+		break;
+	case ISER_CONN_UP:
+		/*
+		 * No flush completions will occur as we didn't
+		 * get to ISER_CONN_FULL_FEATURE yet, complete
+		 * to allow teardown progress.
+		 */
+		complete(&isert_conn->conn_wait_comp_err);
+	case ISER_CONN_FULL_FEATURE: /* FALLTHRU */
+		pr_info("Terminating conn %p state %d\n",
+			   isert_conn, isert_conn->state);
 		isert_conn->state = ISER_CONN_TERMINATING;
-
-	if (isert_conn->post_recv_buf_count == 0 &&
-	    atomic_read(&isert_conn->post_send_buf_count) == 0) {
-		mutex_unlock(&isert_conn->conn_mutex);
-		goto wake_up;
-	}
-	if (!isert_conn->conn_cm_id) {
-		mutex_unlock(&isert_conn->conn_mutex);
-		isert_put_conn(isert_conn);
-		return;
+		err = rdma_disconnect(isert_conn->conn_cm_id);
+		if (err)
+			pr_warn("Failed rdma_disconnect isert_conn %p\n",
+				   isert_conn);
+		break;
+	default:
+		pr_warn("conn %p teminating in state %d\n",
+			   isert_conn, isert_conn->state);
 	}
+}
 
-	if (isert_conn->disconnect) {
-		/* Send DREQ/DREP towards our initiator */
-		rdma_disconnect(isert_conn->conn_cm_id);
-	}
+static int
+isert_np_cma_handler(struct isert_np *isert_np,
+		     enum rdma_cm_event_type event)
+{
+	pr_debug("isert np %p, handling event %d\n", isert_np, event);
 
-	mutex_unlock(&isert_conn->conn_mutex);
+	switch (event) {
+	case RDMA_CM_EVENT_DEVICE_REMOVAL:
+		isert_np->np_cm_id = NULL;
+		break;
+	case RDMA_CM_EVENT_ADDR_CHANGE:
+		isert_np->np_cm_id = isert_setup_id(isert_np);
+		if (IS_ERR(isert_np->np_cm_id)) {
+			pr_err("isert np %p setup id failed: %ld\n",
+				 isert_np, PTR_ERR(isert_np->np_cm_id));
+			isert_np->np_cm_id = NULL;
+		}
+		break;
+	default:
+		pr_err("isert np %p Unexpected event %d\n",
+			  isert_np, event);
+	}
 
-wake_up:
-	complete(&isert_conn->conn_wait);
+	return -1;
 }
 
 static int
-isert_disconnected_handler(struct rdma_cm_id *cma_id, bool disconnect)
+isert_disconnected_handler(struct rdma_cm_id *cma_id,
+			   enum rdma_cm_event_type event)
 {
+	struct isert_np *isert_np = cma_id->context;
 	struct isert_conn *isert_conn;
 
-	if (!cma_id->qp) {
-		struct isert_np *isert_np = cma_id->context;
+	if (isert_np->np_cm_id == cma_id)
+		return isert_np_cma_handler(cma_id->context, event);
 
-		isert_np->np_cm_id = NULL;
-		return -1;
-	}
+	isert_conn = cma_id->qp->qp_context;
 
-	isert_conn = (struct isert_conn *)cma_id->context;
+	mutex_lock(&isert_conn->conn_mutex);
+	isert_conn_terminate(isert_conn);
+	mutex_unlock(&isert_conn->conn_mutex);
 
-	isert_conn->disconnect = disconnect;
-	INIT_WORK(&isert_conn->conn_logout_work, isert_disconnect_work);
-	schedule_work(&isert_conn->conn_logout_work);
+	pr_info("conn %p completing conn_wait\n", isert_conn);
+	complete(&isert_conn->conn_wait);
 
 	return 0;
 }
 
+static void
+isert_connect_error(struct rdma_cm_id *cma_id)
+{
+	struct isert_conn *isert_conn = cma_id->qp->qp_context;
+
+	isert_put_conn(isert_conn);
+}
+
 static int
 isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
 {
 	int ret = 0;
-	bool disconnect = false;
 
 	pr_debug("isert_cma_handler: event %d status %d conn %p id %p\n",
 		 event->event, event->status, cma_id->context, cma_id);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:939 @ isert_cma_handler(struct rdma_cm_id *cma
 	case RDMA_CM_EVENT_ADDR_CHANGE:    /* FALLTHRU */
 	case RDMA_CM_EVENT_DISCONNECTED:   /* FALLTHRU */
 	case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */
-		disconnect = true;
 	case RDMA_CM_EVENT_TIMEWAIT_EXIT:  /* FALLTHRU */
-		ret = isert_disconnected_handler(cma_id, disconnect);
+		ret = isert_disconnected_handler(cma_id, event->event);
 		break;
+	case RDMA_CM_EVENT_REJECTED:       /* FALLTHRU */
+	case RDMA_CM_EVENT_UNREACHABLE:    /* FALLTHRU */
 	case RDMA_CM_EVENT_CONNECT_ERROR:
+		isert_connect_error(cma_id);
+		break;
 	default:
 		pr_err("Unhandled RDMA CMA event: %d\n", event->event);
 		break;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1080 @ isert_init_send_wr(struct isert_conn *is
 	 * bit for every ISERT_COMP_BATCH_COUNT number of ib_post_send() calls.
 	 */
 	mutex_lock(&isert_conn->conn_mutex);
-	if (coalesce && isert_conn->state == ISER_CONN_UP &&
+	if (coalesce && isert_conn->state == ISER_CONN_FULL_FEATURE &&
 	    ++isert_conn->conn_comp_batch < ISERT_COMP_BATCH_COUNT) {
 		tx_desc->llnode_active = true;
 		llist_add(&tx_desc->comp_llnode, &isert_conn->conn_comp_llist);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1161 @ isert_put_login_tx(struct iscsi_conn *co
 		if (login->login_complete) {
 			if (!conn->sess->sess_ops->SessionType &&
 			    isert_conn->conn_device->use_fastreg) {
-				/* Normal Session and fastreg is used */
-				u8 pi_support = login->np->tpg_np->tpg->tpg_attrib.t10_pi;
-
-				ret = isert_conn_create_fastreg_pool(isert_conn,
-								     pi_support);
+				ret = isert_conn_create_fastreg_pool(isert_conn);
 				if (ret) {
 					pr_err("Conn: %p failed to create"
 					       " fastreg pool\n", isert_conn);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1177 @ isert_put_login_tx(struct iscsi_conn *co
 			if (ret)
 				return ret;
 
-			isert_conn->state = ISER_CONN_UP;
+			/* Now we are in FULL_FEATURE phase */
+			mutex_lock(&isert_conn->conn_mutex);
+			isert_conn->state = ISER_CONN_FULL_FEATURE;
+			mutex_unlock(&isert_conn->conn_mutex);
 			goto post_send;
 		}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1197 @ post_send:
 }
 
 static void
-isert_rx_login_req(struct iser_rx_desc *rx_desc, int rx_buflen,
-		   struct isert_conn *isert_conn)
+isert_rx_login_req(struct isert_conn *isert_conn)
 {
+	struct iser_rx_desc *rx_desc = (void *)isert_conn->login_req_buf;
+	int rx_buflen = isert_conn->login_req_len;
 	struct iscsi_conn *conn = isert_conn->conn;
 	struct iscsi_login *login = conn->conn_login;
 	int size;
 
-	if (!login) {
-		pr_err("conn->conn_login is NULL\n");
-		dump_stack();
-		return;
-	}
+	pr_info("conn %p\n", isert_conn);
+
+	WARN_ON_ONCE(!login);
 
 	if (login->first_request) {
 		struct iscsi_login_req *login_req =
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1570 @ isert_rx_completion(struct iser_rx_desc
 		 hdr->opcode, hdr->itt, hdr->flags,
 		 (int)(xfer_len - ISER_HEADERS_LEN));
 
-	if ((char *)desc == isert_conn->login_req_buf)
-		isert_rx_login_req(desc, xfer_len - ISER_HEADERS_LEN,
-				   isert_conn);
-	else
+	if ((char *)desc == isert_conn->login_req_buf) {
+		isert_conn->login_req_len = xfer_len - ISER_HEADERS_LEN;
+		if (isert_conn->conn) {
+			struct iscsi_login *login = isert_conn->conn->conn_login;
+
+			if (login && !login->first_request)
+				isert_rx_login_req(isert_conn);
+		}
+		mutex_lock(&isert_conn->conn_mutex);
+		complete(&isert_conn->login_req_comp);
+		mutex_unlock(&isert_conn->conn_mutex);
+	} else {
 		isert_rx_do_work(desc, isert_conn);
+	}
 
 	ib_dma_sync_single_for_device(ib_dev, rx_dma, rx_buflen,
 				      DMA_FROM_DEVICE);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2142 @ isert_cq_rx_comp_err(struct isert_conn *
 		msleep(3000);
 
 	mutex_lock(&isert_conn->conn_mutex);
-	isert_conn->state = ISER_CONN_DOWN;
+	isert_conn_terminate(isert_conn);
 	mutex_unlock(&isert_conn->conn_mutex);
 
 	iscsit_cause_connection_reinstatement(isert_conn->conn, 0);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2327 @ isert_get_sup_prot_ops(struct iscsi_conn
 	struct isert_conn *isert_conn = (struct isert_conn *)conn->context;
 	struct isert_device *device = isert_conn->conn_device;
 
-	if (device->pi_capable)
-		return TARGET_PROT_ALL;
+	if (conn->tpg->tpg_attrib.t10_pi) {
+		if (device->pi_capable) {
+			pr_info("conn %p PI offload enabled\n", isert_conn);
+			isert_conn->pi_support = true;
+			return TARGET_PROT_ALL;
+		}
+	}
+
+	pr_info("conn %p PI offload disabled\n", isert_conn);
+	isert_conn->pi_support = false;
 
 	return TARGET_PROT_NORMAL;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2785 @ isert_set_prot_checks(u8 prot_checks)
 }
 
 static int
-isert_reg_sig_mr(struct isert_conn *isert_conn, struct se_cmd *se_cmd,
-		 struct fast_reg_descriptor *fr_desc,
-		 struct ib_sge *data_sge, struct ib_sge *prot_sge,
-		 struct ib_sge *sig_sge)
+isert_reg_sig_mr(struct isert_conn *isert_conn,
+		 struct se_cmd *se_cmd,
+		 struct isert_rdma_wr *rdma_wr,
+		 struct fast_reg_descriptor *fr_desc)
 {
 	struct ib_send_wr sig_wr, inv_wr;
 	struct ib_send_wr *bad_wr, *wr = NULL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2818 @ isert_reg_sig_mr(struct isert_conn *iser
 	memset(&sig_wr, 0, sizeof(sig_wr));
 	sig_wr.opcode = IB_WR_REG_SIG_MR;
 	sig_wr.wr_id = ISER_FASTREG_LI_WRID;
-	sig_wr.sg_list = data_sge;
+	sig_wr.sg_list = &rdma_wr->ib_sg[DATA];
 	sig_wr.num_sge = 1;
 	sig_wr.wr.sig_handover.access_flags = IB_ACCESS_LOCAL_WRITE;
 	sig_wr.wr.sig_handover.sig_attrs = &sig_attrs;
 	sig_wr.wr.sig_handover.sig_mr = pi_ctx->sig_mr;
 	if (se_cmd->t_prot_sg)
-		sig_wr.wr.sig_handover.prot = prot_sge;
+		sig_wr.wr.sig_handover.prot = &rdma_wr->ib_sg[PROT];
 
 	if (!wr)
 		wr = &sig_wr;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2838 @ isert_reg_sig_mr(struct isert_conn *iser
 	}
 	fr_desc->ind &= ~ISERT_SIG_KEY_VALID;
 
-	sig_sge->lkey = pi_ctx->sig_mr->lkey;
-	sig_sge->addr = 0;
-	sig_sge->length = se_cmd->data_length;
+	rdma_wr->ib_sg[SIG].lkey = pi_ctx->sig_mr->lkey;
+	rdma_wr->ib_sg[SIG].addr = 0;
+	rdma_wr->ib_sg[SIG].length = se_cmd->data_length;
 	if (se_cmd->prot_op != TARGET_PROT_DIN_STRIP &&
 	    se_cmd->prot_op != TARGET_PROT_DOUT_INSERT)
 		/*
 		 * We have protection guards on the wire
 		 * so we need to set a larget transfer
 		 */
-		sig_sge->length += se_cmd->prot_length;
+		rdma_wr->ib_sg[SIG].length += se_cmd->prot_length;
 
 	pr_debug("sig_sge: addr: 0x%llx  length: %u lkey: %x\n",
-		 sig_sge->addr, sig_sge->length,
-		 sig_sge->lkey);
+		  rdma_wr->ib_sg[SIG].addr, rdma_wr->ib_sg[SIG].length,
+		  rdma_wr->ib_sg[SIG].lkey);
 err:
 	return ret;
 }
 
 static int
+isert_handle_prot_cmd(struct isert_conn *isert_conn,
+		      struct isert_cmd *isert_cmd,
+		      struct isert_rdma_wr *wr)
+{
+	struct isert_device *device = isert_conn->conn_device;
+	struct se_cmd *se_cmd = &isert_cmd->iscsi_cmd->se_cmd;
+	int ret;
+
+	if (!wr->fr_desc->pi_ctx) {
+		ret = isert_create_pi_ctx(wr->fr_desc,
+					  device->ib_device,
+					  isert_conn->conn_pd);
+		if (ret) {
+			pr_err("conn %p failed to allocate pi_ctx\n",
+				  isert_conn);
+			return ret;
+		}
+	}
+
+	if (se_cmd->t_prot_sg) {
+		ret = isert_map_data_buf(isert_conn, isert_cmd,
+					 se_cmd->t_prot_sg,
+					 se_cmd->t_prot_nents,
+					 se_cmd->prot_length,
+					 0, wr->iser_ib_op, &wr->prot);
+		if (ret) {
+			pr_err("conn %p failed to map protection buffer\n",
+				  isert_conn);
+			return ret;
+		}
+
+		memset(&wr->ib_sg[PROT], 0, sizeof(wr->ib_sg[PROT]));
+		ret = isert_fast_reg_mr(isert_conn, wr->fr_desc, &wr->prot,
+					ISERT_PROT_KEY_VALID, &wr->ib_sg[PROT]);
+		if (ret) {
+			pr_err("conn %p failed to fast reg mr\n",
+				  isert_conn);
+			goto unmap_prot_cmd;
+		}
+	}
+
+	ret = isert_reg_sig_mr(isert_conn, se_cmd, wr, wr->fr_desc);
+	if (ret) {
+		pr_err("conn %p failed to fast reg mr\n",
+			  isert_conn);
+		goto unmap_prot_cmd;
+	}
+	wr->fr_desc->ind |= ISERT_PROTECTED;
+
+	return 0;
+
+unmap_prot_cmd:
+	if (se_cmd->t_prot_sg)
+		isert_unmap_data_buf(isert_conn, &wr->prot);
+
+	return ret;
+}
+
+static int
 isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
 	       struct isert_rdma_wr *wr)
 {
 	struct se_cmd *se_cmd = &cmd->se_cmd;
 	struct isert_cmd *isert_cmd = iscsit_priv_cmd(cmd);
 	struct isert_conn *isert_conn = conn->context;
-	struct ib_sge data_sge;
-	struct ib_send_wr *send_wr;
 	struct fast_reg_descriptor *fr_desc = NULL;
+	struct ib_send_wr *send_wr;
+	struct ib_sge *ib_sg;
 	u32 offset;
 	int ret = 0;
 	unsigned long flags;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2938 @ isert_reg_rdma(struct iscsi_conn *conn,
 	if (ret)
 		return ret;
 
-	if (wr->data.dma_nents != 1 ||
-	    se_cmd->prot_op != TARGET_PROT_NORMAL) {
+	if (wr->data.dma_nents != 1 || isert_prot_cmd(isert_conn, se_cmd)) {
 		spin_lock_irqsave(&isert_conn->conn_lock, flags);
 		fr_desc = list_first_entry(&isert_conn->conn_fr_pool,
 					   struct fast_reg_descriptor, list);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2948 @ isert_reg_rdma(struct iscsi_conn *conn,
 	}
 
 	ret = isert_fast_reg_mr(isert_conn, fr_desc, &wr->data,
-				ISERT_DATA_KEY_VALID, &data_sge);
+				ISERT_DATA_KEY_VALID, &wr->ib_sg[DATA]);
 	if (ret)
 		goto unmap_cmd;
 
-	if (se_cmd->prot_op != TARGET_PROT_NORMAL) {
-		struct ib_sge prot_sge, sig_sge;
-
-		if (se_cmd->t_prot_sg) {
-			ret = isert_map_data_buf(isert_conn, isert_cmd,
-						 se_cmd->t_prot_sg,
-						 se_cmd->t_prot_nents,
-						 se_cmd->prot_length,
-						 0, wr->iser_ib_op, &wr->prot);
-			if (ret)
-				goto unmap_cmd;
-
-			ret = isert_fast_reg_mr(isert_conn, fr_desc, &wr->prot,
-						ISERT_PROT_KEY_VALID, &prot_sge);
-			if (ret)
-				goto unmap_prot_cmd;
-		}
-
-		ret = isert_reg_sig_mr(isert_conn, se_cmd, fr_desc,
-				       &data_sge, &prot_sge, &sig_sge);
+	if (isert_prot_cmd(isert_conn, se_cmd)) {
+		ret = isert_handle_prot_cmd(isert_conn, isert_cmd, wr);
 		if (ret)
-			goto unmap_prot_cmd;
+			goto unmap_cmd;
 
-		fr_desc->ind |= ISERT_PROTECTED;
-		memcpy(&wr->s_ib_sge, &sig_sge, sizeof(sig_sge));
-	} else
-		memcpy(&wr->s_ib_sge, &data_sge, sizeof(data_sge));
+		ib_sg = &wr->ib_sg[SIG];
+	} else {
+		ib_sg = &wr->ib_sg[DATA];
+	}
 
+	memcpy(&wr->s_ib_sge, ib_sg, sizeof(*ib_sg));
 	wr->ib_sge = &wr->s_ib_sge;
 	wr->send_wr_num = 1;
 	memset(&wr->s_send_wr, 0, sizeof(*send_wr));
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2977 @ isert_reg_rdma(struct iscsi_conn *conn,
 		send_wr->opcode = IB_WR_RDMA_WRITE;
 		send_wr->wr.rdma.remote_addr = isert_cmd->read_va;
 		send_wr->wr.rdma.rkey = isert_cmd->read_stag;
-		send_wr->send_flags = se_cmd->prot_op == TARGET_PROT_NORMAL ?
+		send_wr->send_flags = !isert_prot_cmd(isert_conn, se_cmd) ?
 				      0 : IB_SEND_SIGNALED;
 	} else {
 		send_wr->opcode = IB_WR_RDMA_READ;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2987 @ isert_reg_rdma(struct iscsi_conn *conn,
 	}
 
 	return 0;
-unmap_prot_cmd:
-	if (se_cmd->t_prot_sg)
-		isert_unmap_data_buf(isert_conn, &wr->prot);
+
 unmap_cmd:
 	if (fr_desc) {
 		spin_lock_irqsave(&isert_conn->conn_lock, flags);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3019 @ isert_put_datain(struct iscsi_conn *conn
 		return rc;
 	}
 
-	if (se_cmd->prot_op == TARGET_PROT_NORMAL) {
+	if (!isert_prot_cmd(isert_conn, se_cmd)) {
 		/*
 		 * Build isert_conn->tx_desc for iSCSI response PDU and attach
 		 */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3042 @ isert_put_datain(struct iscsi_conn *conn
 		atomic_sub(wr->send_wr_num, &isert_conn->post_send_buf_count);
 	}
 
-	if (se_cmd->prot_op == TARGET_PROT_NORMAL)
+	if (!isert_prot_cmd(isert_conn, se_cmd))
 		pr_debug("Cmd: %p posted RDMA_WRITE + Response for iSER Data "
 			 "READ\n", isert_cmd);
 	else
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3144 @ isert_response_queue(struct iscsi_conn *
 	return ret;
 }
 
+struct rdma_cm_id *
+isert_setup_id(struct isert_np *isert_np)
+{
+	struct iscsi_np *np = isert_np->np;
+	struct rdma_cm_id *id;
+	struct sockaddr *sa;
+	int ret;
+
+	sa = (struct sockaddr *)&np->np_sockaddr;
+	pr_debug("ksockaddr: %p, sa: %p\n", &np->np_sockaddr, sa);
+
+	id = rdma_create_id(isert_cma_handler, isert_np,
+			    RDMA_PS_TCP, IB_QPT_RC);
+	if (IS_ERR(id)) {
+		pr_err("rdma_create_id() failed: %ld\n", PTR_ERR(id));
+		ret = PTR_ERR(id);
+		goto out;
+	}
+	pr_debug("id %p context %p\n", id, id->context);
+
+	ret = rdma_bind_addr(id, sa);
+	if (ret) {
+		pr_err("rdma_bind_addr() failed: %d\n", ret);
+		goto out_id;
+	}
+
+	ret = rdma_listen(id, ISERT_RDMA_LISTEN_BACKLOG);
+	if (ret) {
+		pr_err("rdma_listen() failed: %d\n", ret);
+		goto out_id;
+	}
+
+	return id;
+out_id:
+	rdma_destroy_id(id);
+out:
+	return ERR_PTR(ret);
+}
+
 static int
 isert_setup_np(struct iscsi_np *np,
 	       struct __kernel_sockaddr_storage *ksockaddr)
 {
 	struct isert_np *isert_np;
 	struct rdma_cm_id *isert_lid;
-	struct sockaddr *sa;
 	int ret;
 
 	isert_np = kzalloc(sizeof(struct isert_np), GFP_KERNEL);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3200 @ isert_setup_np(struct iscsi_np *np,
 	mutex_init(&isert_np->np_accept_mutex);
 	INIT_LIST_HEAD(&isert_np->np_accept_list);
 	init_completion(&isert_np->np_login_comp);
+	isert_np->np = np;
 
-	sa = (struct sockaddr *)ksockaddr;
-	pr_debug("ksockaddr: %p, sa: %p\n", ksockaddr, sa);
 	/*
 	 * Setup the np->np_sockaddr from the passed sockaddr setup
 	 * in iscsi_target_configfs.c code..
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3209 @ isert_setup_np(struct iscsi_np *np,
 	memcpy(&np->np_sockaddr, ksockaddr,
 	       sizeof(struct __kernel_sockaddr_storage));
 
-	isert_lid = rdma_create_id(isert_cma_handler, np, RDMA_PS_TCP,
-				IB_QPT_RC);
+	isert_lid = isert_setup_id(isert_np);
 	if (IS_ERR(isert_lid)) {
-		pr_err("rdma_create_id() for isert_listen_handler failed: %ld\n",
-		       PTR_ERR(isert_lid));
 		ret = PTR_ERR(isert_lid);
 		goto out;
 	}
 
-	ret = rdma_bind_addr(isert_lid, sa);
-	if (ret) {
-		pr_err("rdma_bind_addr() for isert_lid failed: %d\n", ret);
-		goto out_lid;
-	}
-
-	ret = rdma_listen(isert_lid, ISERT_RDMA_LISTEN_BACKLOG);
-	if (ret) {
-		pr_err("rdma_listen() for isert_lid failed: %d\n", ret);
-		goto out_lid;
-	}
-
 	isert_np->np_cm_id = isert_lid;
 	np->np_context = isert_np;
-	pr_debug("Setup isert_lid->context: %p\n", isert_lid->context);
 
 	return 0;
 
-out_lid:
-	rdma_destroy_id(isert_lid);
 out:
 	kfree(isert_np);
+
 	return ret;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3257 @ isert_get_login_rx(struct iscsi_conn *co
 	struct isert_conn *isert_conn = (struct isert_conn *)conn->context;
 	int ret;
 
-	pr_debug("isert_get_login_rx before conn_login_comp conn: %p\n", conn);
+	pr_info("before login_req comp conn: %p\n", isert_conn);
+	ret = wait_for_completion_interruptible(&isert_conn->login_req_comp);
+	if (ret) {
+		pr_err("isert_conn %p interrupted before got login req\n",
+			  isert_conn);
+		return ret;
+	}
+	reinit_completion(&isert_conn->login_req_comp);
+
 	/*
 	 * For login requests after the first PDU, isert_rx_login_req() will
 	 * kick schedule_delayed_work(&conn->login_work) as the packet is
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3275 @ isert_get_login_rx(struct iscsi_conn *co
 	if (!login->first_request)
 		return 0;
 
+	isert_rx_login_req(isert_conn);
+
+	pr_info("before conn_login_comp conn: %p\n", conn);
 	ret = wait_for_completion_interruptible(&isert_conn->conn_login_comp);
 	if (ret)
 		return ret;
 
-	pr_debug("isert_get_login_rx processing login->req: %p\n", login->req);
+	pr_info("processing login->req: %p\n", login->req);
+
 	return 0;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3361 @ accept_wait:
 	isert_conn->conn = conn;
 	max_accept = 0;
 
-	ret = isert_rdma_post_recvl(isert_conn);
-	if (ret)
-		return ret;
-
-	ret = isert_rdma_accept(isert_conn);
-	if (ret)
-		return ret;
-
 	isert_set_conn_info(np, conn, isert_conn);
 
-	pr_debug("Processing isert_accept_np: isert_conn: %p\n", isert_conn);
+	pr_debug("Processing isert_conn: %p\n", isert_conn);
+
 	return 0;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3380 @ isert_free_np(struct iscsi_np *np)
 	kfree(isert_np);
 }
 
+static void isert_release_work(struct work_struct *work)
+{
+	struct isert_conn *isert_conn = container_of(work,
+						     struct isert_conn,
+						     release_work);
+
+	pr_info("Starting release conn %p\n", isert_conn);
+
+	wait_for_completion(&isert_conn->conn_wait);
+
+	mutex_lock(&isert_conn->conn_mutex);
+	isert_conn->state = ISER_CONN_DOWN;
+	mutex_unlock(&isert_conn->conn_mutex);
+
+	pr_info("Destroying conn %p\n", isert_conn);
+	isert_put_conn(isert_conn);
+}
+
 static void isert_wait_conn(struct iscsi_conn *conn)
 {
 	struct isert_conn *isert_conn = conn->context;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3405 @ static void isert_wait_conn(struct iscsi
 	pr_debug("isert_wait_conn: Starting \n");
 
 	mutex_lock(&isert_conn->conn_mutex);
-	if (isert_conn->conn_cm_id && !isert_conn->disconnect) {
-		pr_debug("Calling rdma_disconnect from isert_wait_conn\n");
-		rdma_disconnect(isert_conn->conn_cm_id);
-	}
 	/*
 	 * Only wait for conn_wait_comp_err if the isert_conn made it
 	 * into full feature phase..
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3413 @ static void isert_wait_conn(struct iscsi
 		mutex_unlock(&isert_conn->conn_mutex);
 		return;
 	}
-	if (isert_conn->state == ISER_CONN_UP)
-		isert_conn->state = ISER_CONN_TERMINATING;
+	isert_conn_terminate(isert_conn);
 	mutex_unlock(&isert_conn->conn_mutex);
 
 	wait_for_completion(&isert_conn->conn_wait_comp_err);
 
-	wait_for_completion(&isert_conn->conn_wait);
-	isert_put_conn(isert_conn);
+	INIT_WORK(&isert_conn->release_work, isert_release_work);
+	queue_work(isert_release_wq, &isert_conn->release_work);
 }
 
 static void isert_free_conn(struct iscsi_conn *conn)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3467 @ static int __init isert_init(void)
 		goto destroy_rx_wq;
 	}
 
+	isert_release_wq = alloc_workqueue("isert_release_wq", WQ_UNBOUND,
+					WQ_UNBOUND_MAX_ACTIVE);
+	if (!isert_release_wq) {
+		pr_err("Unable to allocate isert_release_wq\n");
+		ret = -ENOMEM;
+		goto destroy_comp_wq;
+	}
+
 	iscsit_register_transport(&iser_target_transport);
-	pr_debug("iSER_TARGET[0] - Loaded iser_target_transport\n");
+	pr_info("iSER_TARGET[0] - Loaded iser_target_transport\n");
+
 	return 0;
 
+destroy_comp_wq:
+	destroy_workqueue(isert_comp_wq);
 destroy_rx_wq:
 	destroy_workqueue(isert_rx_wq);
 	return ret;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3490 @ destroy_rx_wq:
 static void __exit isert_exit(void)
 {
 	flush_scheduled_work();
+	destroy_workqueue(isert_release_wq);
 	destroy_workqueue(isert_comp_wq);
 	destroy_workqueue(isert_rx_wq);
 	iscsit_unregister_transport(&iser_target_transport);
Index: linux-3.18.13-rt10-r7s4/drivers/infiniband/ulp/isert/ib_isert.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/infiniband/ulp/isert/ib_isert.h
+++ linux-3.18.13-rt10-r7s4/drivers/infiniband/ulp/isert/ib_isert.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:26 @ enum iser_ib_op_code {
 enum iser_conn_state {
 	ISER_CONN_INIT,
 	ISER_CONN_UP,
+	ISER_CONN_FULL_FEATURE,
 	ISER_CONN_TERMINATING,
 	ISER_CONN_DOWN,
 };
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:85 @ struct isert_data_buf {
 	enum dma_data_direction dma_dir;
 };
 
+enum {
+	DATA = 0,
+	PROT = 1,
+	SIG = 2,
+};
+
 struct isert_rdma_wr {
 	struct list_head	wr_list;
 	struct isert_cmd	*isert_cmd;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:100 @ struct isert_rdma_wr {
 	int			send_wr_num;
 	struct ib_send_wr	*send_wr;
 	struct ib_send_wr	s_send_wr;
+	struct ib_sge		ib_sg[3];
 	struct isert_data_buf	data;
 	struct isert_data_buf	prot;
 	struct fast_reg_descriptor *fr_desc;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:131 @ struct isert_conn {
 	atomic_t		post_send_buf_count;
 	u32			responder_resources;
 	u32			initiator_depth;
+	bool			pi_support;
 	u32			max_sge;
 	char			*login_buf;
 	char			*login_req_buf;
 	char			*login_rsp_buf;
 	u64			login_req_dma;
+	int			login_req_len;
 	u64			login_rsp_dma;
 	unsigned int		conn_rx_desc_head;
 	struct iser_rx_desc	*conn_rx_descs;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:145 @ struct isert_conn {
 	struct iscsi_conn	*conn;
 	struct list_head	conn_accept_node;
 	struct completion	conn_login_comp;
+	struct completion	login_req_comp;
 	struct iser_tx_desc	conn_login_tx_desc;
 	struct rdma_cm_id	*conn_cm_id;
 	struct ib_pd		*conn_pd;
 	struct ib_mr		*conn_mr;
 	struct ib_qp		*conn_qp;
 	struct isert_device	*conn_device;
-	struct work_struct	conn_logout_work;
 	struct mutex		conn_mutex;
 	struct completion	conn_wait;
 	struct completion	conn_wait_comp_err;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:160 @ struct isert_conn {
 	int			conn_fr_pool_size;
 	/* lock to protect fastreg pool */
 	spinlock_t		conn_lock;
+	struct work_struct	release_work;
 #define ISERT_COMP_BATCH_COUNT	8
 	int			conn_comp_batch;
 	struct llist_head	conn_comp_llist;
-	bool                    disconnect;
 };
 
 #define ISERT_MAX_CQ 64
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:195 @ struct isert_device {
 };
 
 struct isert_np {
+	struct iscsi_np         *np;
 	struct semaphore	np_sem;
 	struct rdma_cm_id	*np_cm_id;
 	struct mutex		np_accept_mutex;
Index: linux-3.18.13-rt10-r7s4/drivers/input/mouse/alps.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/input/mouse/alps.c
+++ linux-3.18.13-rt10-r7s4/drivers/input/mouse/alps.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:922 @ static void alps_get_finger_coordinate_v
 
 static int alps_get_mt_count(struct input_mt_pos *mt)
 {
-	int i;
+	int i, fingers = 0;
 
-	for (i = 0; i < MAX_TOUCHES && mt[i].x != 0 && mt[i].y != 0; i++)
-		/* empty */;
+	for (i = 0; i < MAX_TOUCHES; i++) {
+		if (mt[i].x != 0 || mt[i].y != 0)
+			fingers++;
+	}
 
-	return i;
+	return fingers;
 }
 
 static int alps_decode_packet_v7(struct alps_fields *f,
 				  unsigned char *p,
 				  struct psmouse *psmouse)
 {
+	struct alps_data *priv = psmouse->private;
 	unsigned char pkt_id;
 
 	pkt_id = alps_get_packet_id_v7(p);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:944 @ static int alps_decode_packet_v7(struct
 		return 0;
 	if (pkt_id == V7_PACKET_ID_UNKNOWN)
 		return -1;
+	/*
+	 * NEW packets are send to indicate a discontinuity in the finger
+	 * coordinate reporting. Specifically a finger may have moved from
+	 * slot 0 to 1 or vice versa. INPUT_MT_TRACK takes care of this for
+	 * us.
+	 *
+	 * NEW packets have 3 problems:
+	 * 1) They do not contain middle / right button info (on non clickpads)
+	 *    this can be worked around by preserving the old button state
+	 * 2) They do not contain an accurate fingercount, and they are
+	 *    typically send when the number of fingers changes. We cannot use
+	 *    the old finger count as that may mismatch with the amount of
+	 *    touch coordinates we've available in the NEW packet
+	 * 3) Their x data for the second touch is inaccurate leading to
+	 *    a possible jump of the x coordinate by 16 units when the first
+	 *    non NEW packet comes in
+	 * Since problems 2 & 3 cannot be worked around, just ignore them.
+	 */
+	if (pkt_id == V7_PACKET_ID_NEW)
+		return 1;
 
 	alps_get_finger_coordinate_v7(f->mt, p, pkt_id);
 
-	if (pkt_id == V7_PACKET_ID_TWO || pkt_id == V7_PACKET_ID_MULTI) {
-		f->left = (p[0] & 0x80) >> 7;
+	if (pkt_id == V7_PACKET_ID_TWO)
+		f->fingers = alps_get_mt_count(f->mt);
+	else /* pkt_id == V7_PACKET_ID_MULTI */
+		f->fingers = 3 + (p[5] & 0x03);
+
+	f->left = (p[0] & 0x80) >> 7;
+	if (priv->flags & ALPS_BUTTONPAD) {
+		if (p[0] & 0x20)
+			f->fingers++;
+		if (p[0] & 0x10)
+			f->fingers++;
+	} else {
 		f->right = (p[0] & 0x20) >> 5;
 		f->middle = (p[0] & 0x10) >> 4;
 	}
 
-	if (pkt_id == V7_PACKET_ID_TWO)
-		f->fingers = alps_get_mt_count(f->mt);
-	else if (pkt_id == V7_PACKET_ID_MULTI)
-		f->fingers = 3 + (p[5] & 0x03);
+	/* Sometimes a single touch is reported in mt[1] rather then mt[0] */
+	if (f->fingers == 1 && f->mt[0].x == 0 && f->mt[0].y == 0) {
+		f->mt[0].x = f->mt[1].x;
+		f->mt[0].y = f->mt[1].y;
+		f->mt[1].x = 0;
+		f->mt[1].y = 0;
+	}
 
 	return 0;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/input/mouse/elantech.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/input/mouse/elantech.c
+++ linux-3.18.13-rt10-r7s4/drivers/input/mouse/elantech.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1100 @ static int elantech_get_resolution_v4(st
  * Asus UX31               0x361f00        20, 15, 0e      clickpad
  * Asus UX32VD             0x361f02        00, 15, 0e      clickpad
  * Avatar AVIU-145A2       0x361f00        ?               clickpad
+ * Fujitsu LIFEBOOK E544   0x470f00        d0, 12, 09      2 hw buttons
+ * Fujitsu LIFEBOOK E554   0x570f01        40, 14, 0c      2 hw buttons
  * Fujitsu H730            0x570f00        c0, 14, 0c      3 hw buttons (**)
  * Gigabyte U2442          0x450f01        58, 17, 0c      2 hw buttons
  * Lenovo L430             0x350f02        b9, 15, 0c      2 hw buttons (*)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1480 @ static const struct dmi_system_id elante
 			DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H730"),
 		},
 	},
+	{
+		/* Fujitsu LIFEBOOK E554  does not work with crc_enabled == 0 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E554"),
+		},
+	},
+	{
+		/* Fujitsu LIFEBOOK E544  does not work with crc_enabled == 0 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E544"),
+		},
+	},
 #endif
 	{ }
 };
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1539 @ static int elantech_set_properties(struc
 		case 7:
 		case 8:
 		case 9:
+		case 10:
+		case 13:
 			etd->hw_version = 4;
 			break;
 		default:
Index: linux-3.18.13-rt10-r7s4/drivers/input/mouse/synaptics.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/input/mouse/synaptics.c
+++ linux-3.18.13-rt10-r7s4/drivers/input/mouse/synaptics.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:123 @ void synaptics_reset(struct psmouse *psm
 
 static bool cr48_profile_sensor;
 
+#define ANY_BOARD_ID 0
 struct min_max_quirk {
 	const char * const *pnp_ids;
+	struct {
+		unsigned long int min, max;
+	} board_id;
 	int x_min, x_max, y_min, y_max;
 };
 
 static const struct min_max_quirk min_max_pnpid_table[] = {
 	{
 		(const char * const []){"LEN0033", NULL},
+		{ANY_BOARD_ID, ANY_BOARD_ID},
 		1024, 5052, 2258, 4832
 	},
 	{
-		(const char * const []){"LEN0035", "LEN0042", NULL},
+		(const char * const []){"LEN0042", NULL},
+		{ANY_BOARD_ID, ANY_BOARD_ID},
 		1232, 5710, 1156, 4696
 	},
 	{
-		(const char * const []){"LEN0034", "LEN0036", "LEN0039",
-					"LEN2002", "LEN2004", NULL},
+		(const char * const []){"LEN0034", "LEN0036", "LEN0037",
+					"LEN0039", "LEN2002", "LEN2004",
+					NULL},
+		{ANY_BOARD_ID, 2961},
 		1024, 5112, 2024, 4832
 	},
 	{
 		(const char * const []){"LEN2001", NULL},
+		{ANY_BOARD_ID, ANY_BOARD_ID},
 		1024, 5022, 2508, 4832
 	},
 	{
 		(const char * const []){"LEN2006", NULL},
+		{ANY_BOARD_ID, ANY_BOARD_ID},
 		1264, 5675, 1171, 4688
 	},
 	{ }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:178 @ static const char * const topbuttonpad_p
 	"LEN0034", /* T431s, L440, L540, T540, W540, X1 Carbon 2nd */
 	"LEN0035", /* X240 */
 	"LEN0036", /* T440 */
-	"LEN0037",
+	"LEN0037", /* X1 Carbon 2nd */
 	"LEN0038",
 	"LEN0039", /* T440s */
 	"LEN0041",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:253 @ static int synaptics_board_id(struct psm
 	struct synaptics_data *priv = psmouse->private;
 	unsigned char bid[3];
 
+	/* firmwares prior 7.5 have no board_id encoded */
+	if (SYN_ID_FULL(priv->identity) < 0x705)
+		return 0;
+
 	if (synaptics_send_cmd(psmouse, SYN_QUE_MODES, bid))
 		return -1;
 	priv->board_id = ((bid[0] & 0xfc) << 6) | bid[1];
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:359 @ static int synaptics_resolution(struct p
 {
 	struct synaptics_data *priv = psmouse->private;
 	unsigned char resp[3];
-	int i;
 
 	if (SYN_ID_MAJOR(priv->identity) < 4)
 		return 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:370 @ static int synaptics_resolution(struct p
 		}
 	}
 
-	for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
-		if (psmouse_matches_pnp_id(psmouse,
-					   min_max_pnpid_table[i].pnp_ids)) {
-			priv->x_min = min_max_pnpid_table[i].x_min;
-			priv->x_max = min_max_pnpid_table[i].x_max;
-			priv->y_min = min_max_pnpid_table[i].y_min;
-			priv->y_max = min_max_pnpid_table[i].y_max;
-			return 0;
-		}
-	}
-
 	if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 5 &&
 	    SYN_CAP_MAX_DIMENSIONS(priv->ext_cap_0c)) {
 		if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MAX_COORDS, resp)) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:378 @ static int synaptics_resolution(struct p
 		} else {
 			priv->x_max = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
 			priv->y_max = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
+			psmouse_info(psmouse,
+				     "queried max coordinates: x [..%d], y [..%d]\n",
+				     priv->x_max, priv->y_max);
 		}
 	}
 
-	if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 &&
-	    SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c)) {
+	if (SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c) &&
+	    (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 ||
+	     /*
+	      * Firmware v8.1 does not report proper number of extended
+	      * capabilities, but has been proven to report correct min
+	      * coordinates.
+	      */
+	     SYN_ID_FULL(priv->identity) == 0x801)) {
 		if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MIN_COORDS, resp)) {
 			psmouse_warn(psmouse,
 				     "device claims to have min coordinates query, but I'm not able to read it.\n");
 		} else {
 			priv->x_min = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
 			priv->y_min = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
+			psmouse_info(psmouse,
+				     "queried min coordinates: x [%d..], y [%d..]\n",
+				     priv->x_min, priv->y_min);
 		}
 	}
 
 	return 0;
 }
 
+/*
+ * Apply quirk(s) if the hardware matches
+ */
+
+static void synaptics_apply_quirks(struct psmouse *psmouse)
+{
+	struct synaptics_data *priv = psmouse->private;
+	int i;
+
+	for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
+		if (!psmouse_matches_pnp_id(psmouse,
+					    min_max_pnpid_table[i].pnp_ids))
+			continue;
+
+		if (min_max_pnpid_table[i].board_id.min != ANY_BOARD_ID &&
+		    priv->board_id < min_max_pnpid_table[i].board_id.min)
+			continue;
+
+		if (min_max_pnpid_table[i].board_id.max != ANY_BOARD_ID &&
+		    priv->board_id > min_max_pnpid_table[i].board_id.max)
+			continue;
+
+		priv->x_min = min_max_pnpid_table[i].x_min;
+		priv->x_max = min_max_pnpid_table[i].x_max;
+		priv->y_min = min_max_pnpid_table[i].y_min;
+		priv->y_max = min_max_pnpid_table[i].y_max;
+		psmouse_info(psmouse,
+			     "quirked min/max coordinates: x [%d..%d], y [%d..%d]\n",
+			     priv->x_min, priv->x_max,
+			     priv->y_min, priv->y_max);
+		break;
+	}
+}
+
 static int synaptics_query_hardware(struct psmouse *psmouse)
 {
 	if (synaptics_identify(psmouse))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:456 @ static int synaptics_query_hardware(stru
 	if (synaptics_resolution(psmouse))
 		return -1;
 
+	synaptics_apply_quirks(psmouse);
+
 	return 0;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:665 @ static void synaptics_parse_agm(const un
 	priv->agm_pending = true;
 }
 
+static void synaptics_parse_ext_buttons(const unsigned char buf[],
+					struct synaptics_data *priv,
+					struct synaptics_hw_state *hw)
+{
+	unsigned int ext_bits =
+		(SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
+	unsigned int ext_mask = GENMASK(ext_bits - 1, 0);
+
+	hw->ext_buttons = buf[4] & ext_mask;
+	hw->ext_buttons |= (buf[5] & ext_mask) << ext_bits;
+}
+
 static bool is_forcepad;
 
 static int synaptics_parse_hw_state(const unsigned char buf[],
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:763 @ static int synaptics_parse_hw_state(cons
 			hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
 		}
 
-		if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
+		if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) > 0 &&
 		    ((buf[0] ^ buf[3]) & 0x02)) {
-			switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
-			default:
-				/*
-				 * if nExtBtn is greater than 8 it should be
-				 * considered invalid and treated as 0
-				 */
-				break;
-			case 8:
-				hw->ext_buttons |= ((buf[5] & 0x08)) ? 0x80 : 0;
-				hw->ext_buttons |= ((buf[4] & 0x08)) ? 0x40 : 0;
-			case 6:
-				hw->ext_buttons |= ((buf[5] & 0x04)) ? 0x20 : 0;
-				hw->ext_buttons |= ((buf[4] & 0x04)) ? 0x10 : 0;
-			case 4:
-				hw->ext_buttons |= ((buf[5] & 0x02)) ? 0x08 : 0;
-				hw->ext_buttons |= ((buf[4] & 0x02)) ? 0x04 : 0;
-			case 2:
-				hw->ext_buttons |= ((buf[5] & 0x01)) ? 0x02 : 0;
-				hw->ext_buttons |= ((buf[4] & 0x01)) ? 0x01 : 0;
-			}
+			synaptics_parse_ext_buttons(buf, priv, hw);
 		}
 	} else {
 		hw->x = (((buf[1] & 0x1f) << 8) | buf[2]);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:827 @ static void synaptics_report_semi_mt_dat
 	}
 }
 
+static void synaptics_report_ext_buttons(struct psmouse *psmouse,
+					 const struct synaptics_hw_state *hw)
+{
+	struct input_dev *dev = psmouse->dev;
+	struct synaptics_data *priv = psmouse->private;
+	int ext_bits = (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
+	int i;
+
+	if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap))
+		return;
+
+	/* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
+	if (SYN_ID_FULL(priv->identity) == 0x801 &&
+	    !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
+		return;
+
+	for (i = 0; i < ext_bits; i++) {
+		input_report_key(dev, BTN_0 + 2 * i,
+			hw->ext_buttons & (1 << i));
+		input_report_key(dev, BTN_1 + 2 * i,
+			hw->ext_buttons & (1 << (i + ext_bits)));
+	}
+}
+
 static void synaptics_report_buttons(struct psmouse *psmouse,
 				     const struct synaptics_hw_state *hw)
 {
 	struct input_dev *dev = psmouse->dev;
 	struct synaptics_data *priv = psmouse->private;
-	int i;
 
 	input_report_key(dev, BTN_LEFT, hw->left);
 	input_report_key(dev, BTN_RIGHT, hw->right);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:868 @ static void synaptics_report_buttons(str
 		input_report_key(dev, BTN_BACK, hw->down);
 	}
 
-	for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
-		input_report_key(dev, BTN_0 + i, hw->ext_buttons & (1 << i));
+	synaptics_report_ext_buttons(psmouse, hw);
 }
 
 static void synaptics_report_slot(struct input_dev *dev, int slot,
Index: linux-3.18.13-rt10-r7s4/drivers/input/serio/i8042-x86ia64io.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/input/serio/i8042-x86ia64io.h
+++ linux-3.18.13-rt10-r7s4/drivers/input/serio/i8042-x86ia64io.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:155 @ static const struct dmi_system_id __init
 		},
 	},
 	{
+		/* Medion Akoya E7225 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Medion"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Akoya E7225"),
+			DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+		},
+	},
+	{
 		/* Blue FB5601 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "blue"),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:426 @ static const struct dmi_system_id __init
 		},
 	},
 	{
+		/* Acer Aspire 7738 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"),
+		},
+	},
+	{
 		/* Gericom Bellagio */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:753 @ static const struct dmi_system_id __init
 	{ }
 };
 
+/*
+ * Some laptops need keyboard reset before probing for the trackpad to get
+ * it detected, initialised & finally work.
+ */
+static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
+	{
+		/* Gigabyte P35 v2 - Elantech touchpad */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"),
+		},
+	},
+		{
+		/* Aorus branded Gigabyte X3 Plus - Elantech touchpad */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "X3"),
+		},
+	},
+	{
+		/* Gigabyte P34 - Elantech touchpad */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
+		},
+	},
+	{ }
+};
+
 #endif /* CONFIG_X86 */
 
 #ifdef CONFIG_PNP
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1077 @ static int __init i8042_platform_init(vo
 	if (dmi_check_system(i8042_dmi_dritek_table))
 		i8042_dritek = true;
 
+	if (dmi_check_system(i8042_dmi_kbdreset_table))
+		i8042_kbdreset = true;
+
 	/*
 	 * A20 was already enabled during early kernel init. But some buggy
 	 * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to
Index: linux-3.18.13-rt10-r7s4/drivers/input/serio/i8042.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/input/serio/i8042.c
+++ linux-3.18.13-rt10-r7s4/drivers/input/serio/i8042.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:70 @ static bool i8042_notimeout;
 module_param_named(notimeout, i8042_notimeout, bool, 0);
 MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042");
 
+static bool i8042_kbdreset;
+module_param_named(kbdreset, i8042_kbdreset, bool, 0);
+MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port");
+
 #ifdef CONFIG_X86
 static bool i8042_dritek;
 module_param_named(dritek, i8042_dritek, bool, 0);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:797 @ static int __init i8042_check_aux(void)
 		return -1;
 
 /*
+ * Reset keyboard (needed on some laptops to successfully detect
+ * touchpad, e.g., some Gigabyte laptop models with Elantech
+ * touchpads).
+ */
+	if (i8042_kbdreset) {
+		pr_warn("Attempting to reset device connected to KBD port\n");
+		i8042_kbd_write(NULL, (unsigned char) 0xff);
+	}
+
+/*
  * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and
  * used it for a PCI card or somethig else.
  */
Index: linux-3.18.13-rt10-r7s4/drivers/iommu/intel-iommu.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/iommu/intel-iommu.c
+++ linux-3.18.13-rt10-r7s4/drivers/iommu/intel-iommu.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1749 @ static int domain_init(struct dmar_domai
 static void domain_exit(struct dmar_domain *domain)
 {
 	struct dmar_drhd_unit *drhd;
-	struct intel_iommu *iommu;
 	struct page *freelist = NULL;
+	int i;
 
 	/* Domain 0 is reserved, so dont process it */
 	if (!domain)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1770 @ static void domain_exit(struct dmar_doma
 
 	/* clear attached or cached domains */
 	rcu_read_lock();
-	for_each_active_iommu(iommu, drhd)
-		iommu_detach_domain(domain, iommu);
+	for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus)
+		iommu_detach_domain(domain, g_iommus[i]);
 	rcu_read_unlock();
 
 	dma_free_pagelist(freelist);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1986 @ static int __domain_mapping(struct dmar_
 {
 	struct dma_pte *first_pte = NULL, *pte = NULL;
 	phys_addr_t uninitialized_var(pteval);
-	unsigned long sg_res;
+	unsigned long sg_res = 0;
 	unsigned int largepage_lvl = 0;
 	unsigned long lvl_pages = 0;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1997 @ static int __domain_mapping(struct dmar_
 
 	prot &= DMA_PTE_READ | DMA_PTE_WRITE | DMA_PTE_SNP;
 
-	if (sg)
-		sg_res = 0;
-	else {
-		sg_res = nr_pages + 1;
+	if (!sg) {
+		sg_res = nr_pages;
 		pteval = ((phys_addr_t)phys_pfn << VTD_PAGE_SHIFT) | prot;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4268 @ static int intel_iommu_attach_device(str
 				domain_remove_one_dev_info(old_domain, dev);
 			else
 				domain_remove_dev_info(old_domain);
+
+			if (!domain_type_is_vm_or_si(old_domain) &&
+			     list_empty(&old_domain->devices))
+				domain_exit(old_domain);
 		}
 	}
 
Index: linux-3.18.13-rt10-r7s4/drivers/irqchip/irq-armada-370-xp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/irqchip/irq-armada-370-xp.c
+++ linux-3.18.13-rt10-r7s4/drivers/irqchip/irq-armada-370-xp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:70 @
 static void __iomem *per_cpu_int_base;
 static void __iomem *main_int_base;
 static struct irq_domain *armada_370_xp_mpic_domain;
+static int parent_irq;
 #ifdef CONFIG_PCI_MSI
 static struct irq_domain *armada_370_xp_msi_domain;
 static DECLARE_BITMAP(msi_used, PCI_MSI_DOORBELL_NR);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:358 @ static int armada_xp_mpic_secondary_init
 {
 	if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
 		armada_xp_mpic_smp_cpu_init();
+
 	return NOTIFY_OK;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:367 @ static struct notifier_block armada_370_
 	.priority = 100,
 };
 
+static int mpic_cascaded_secondary_init(struct notifier_block *nfb,
+					unsigned long action, void *hcpu)
+{
+	if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
+		enable_percpu_irq(parent_irq, IRQ_TYPE_NONE);
+
+	return NOTIFY_OK;
+}
+
+static struct notifier_block mpic_cascaded_cpu_notifier = {
+	.notifier_call = mpic_cascaded_secondary_init,
+	.priority = 100,
+};
+
 #endif /* CONFIG_SMP */
 
 static struct irq_domain_ops armada_370_xp_mpic_irq_ops = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:508 @ static int __init armada_370_xp_mpic_of_
 					     struct device_node *parent)
 {
 	struct resource main_int_res, per_cpu_int_res;
-	int parent_irq, nr_irqs, i;
+	int nr_irqs, i;
 	u32 control;
 
 	BUG_ON(of_address_to_resource(node, 0, &main_int_res));
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:556 @ static int __init armada_370_xp_mpic_of_
 		register_cpu_notifier(&armada_370_xp_mpic_cpu_notifier);
 #endif
 	} else {
+#ifdef CONFIG_SMP
+		register_cpu_notifier(&mpic_cascaded_cpu_notifier);
+#endif
 		irq_set_chained_handler(parent_irq,
 					armada_370_xp_mpic_handle_cascade_irq);
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/irqchip/irq-atmel-aic-common.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/irqchip/irq-atmel-aic-common.c
+++ linux-3.18.13-rt10-r7s4/drivers/irqchip/irq-atmel-aic-common.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:31 @
 #define AT91_AIC_IRQ_MIN_PRIORITY	0
 #define AT91_AIC_IRQ_MAX_PRIORITY	7
 
-#define AT91_AIC_SRCTYPE		GENMASK(7, 6)
+#define AT91_AIC_SRCTYPE		GENMASK(6, 5)
 #define AT91_AIC_SRCTYPE_LOW		(0 << 5)
 #define AT91_AIC_SRCTYPE_FALLING	(1 << 5)
 #define AT91_AIC_SRCTYPE_HIGH		(2 << 5)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:77 @ int aic_common_set_type(struct irq_data
 		return -EINVAL;
 	}
 
-	*val &= AT91_AIC_SRCTYPE;
+	*val &= ~AT91_AIC_SRCTYPE;
 	*val |= aic_type;
 
 	return 0;
Index: linux-3.18.13-rt10-r7s4/drivers/irqchip/irq-omap-intc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/irqchip/irq-omap-intc.c
+++ linux-3.18.13-rt10-r7s4/drivers/irqchip/irq-omap-intc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:266 @ static int __init omap_init_irq_of(struc
 	return ret;
 }
 
-static int __init omap_init_irq_legacy(u32 base)
+static int __init omap_init_irq_legacy(u32 base, struct device_node *node)
 {
 	int j, irq_base;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:280 @ static int __init omap_init_irq_legacy(u
 		irq_base = 0;
 	}
 
-	domain = irq_domain_add_legacy(NULL, omap_nr_irqs, irq_base, 0,
+	domain = irq_domain_add_legacy(node, omap_nr_irqs, irq_base, 0,
 			&irq_domain_simple_ops, NULL);
 
 	omap_irq_soft_reset();
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:304 @ static int __init omap_init_irq(u32 base
 {
 	int ret;
 
-	if (node)
+	/*
+	 * FIXME legacy OMAP DMA driver sitting under arch/arm/plat-omap/dma.c
+	 * depends is still not ready for linear IRQ domains; because of that
+	 * we need to temporarily "blacklist" OMAP2 and OMAP3 devices from using
+	 * linear IRQ Domain until that driver is finally fixed.
+	 */
+	if (of_device_is_compatible(node, "ti,omap2-intc") ||
+			of_device_is_compatible(node, "ti,omap3-intc")) {
+		struct resource res;
+
+		if (of_address_to_resource(node, 0, &res))
+			return -ENOMEM;
+
+		base = res.start;
+		ret = omap_init_irq_legacy(base, node);
+	} else if (node) {
 		ret = omap_init_irq_of(node);
-	else
-		ret = omap_init_irq_legacy(base);
+	} else {
+		ret = omap_init_irq_legacy(base, NULL);
+	}
 
 	if (ret == 0)
 		omap_irq_enable_protection();
Index: linux-3.18.13-rt10-r7s4/drivers/leds/leds-netxbig.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/leds/leds-netxbig.c
+++ linux-3.18.13-rt10-r7s4/drivers/leds/leds-netxbig.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:333 @ create_netxbig_led(struct platform_devic
 	led_dat->sata = 0;
 	led_dat->cdev.brightness = LED_OFF;
 	led_dat->cdev.flags |= LED_CORE_SUSPENDRESUME;
-	/*
-	 * If available, expose the SATA activity blink capability through
-	 * a "sata" sysfs attribute.
-	 */
-	if (led_dat->mode_val[NETXBIG_LED_SATA] != NETXBIG_LED_INVALID_MODE)
-		led_dat->cdev.groups = netxbig_led_groups;
 	led_dat->mode_addr = template->mode_addr;
 	led_dat->mode_val = template->mode_val;
 	led_dat->bright_addr = template->bright_addr;
 	led_dat->bright_max = (1 << pdata->gpio_ext->num_data) - 1;
 	led_dat->timer = pdata->timer;
 	led_dat->num_timer = pdata->num_timer;
+	/*
+	 * If available, expose the SATA activity blink capability through
+	 * a "sata" sysfs attribute.
+	 */
+	if (led_dat->mode_val[NETXBIG_LED_SATA] != NETXBIG_LED_INVALID_MODE)
+		led_dat->cdev.groups = netxbig_led_groups;
 
 	return led_classdev_register(&pdev->dev, &led_dat->cdev);
 }
Index: linux-3.18.13-rt10-r7s4/drivers/md/dm-bufio.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/md/dm-bufio.c
+++ linux-3.18.13-rt10-r7s4/drivers/md/dm-bufio.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:535 @ static void use_dmio(struct dm_buffer *b
 		end_io(&b->bio, r);
 }
 
+static void inline_endio(struct bio *bio, int error)
+{
+	bio_end_io_t *end_fn = bio->bi_private;
+
+	/*
+	 * Reset the bio to free any attached resources
+	 * (e.g. bio integrity profiles).
+	 */
+	bio_reset(bio);
+
+	end_fn(bio, error);
+}
+
 static void use_inline_bio(struct dm_buffer *b, int rw, sector_t block,
 			   bio_end_io_t *end_io)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:559 @ static void use_inline_bio(struct dm_buf
 	b->bio.bi_max_vecs = DM_BUFIO_INLINE_VECS;
 	b->bio.bi_iter.bi_sector = block << b->c->sectors_per_block_bits;
 	b->bio.bi_bdev = b->c->bdev;
-	b->bio.bi_end_io = end_io;
+	b->bio.bi_end_io = inline_endio;
+	/*
+	 * Use of .bi_private isn't a problem here because
+	 * the dm_buffer's inline bio is local to bufio.
+	 */
+	b->bio.bi_private = end_io;
 
 	/*
 	 * We assume that if len >= PAGE_SIZE ptr is page-aligned.
Index: linux-3.18.13-rt10-r7s4/drivers/md/dm-cache-metadata.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/md/dm-cache-metadata.c
+++ linux-3.18.13-rt10-r7s4/drivers/md/dm-cache-metadata.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:97 @ struct cache_disk_superblock {
 } __packed;
 
 struct dm_cache_metadata {
+	atomic_t ref_count;
+	struct list_head list;
+
 	struct block_device *bdev;
 	struct dm_block_manager *bm;
 	struct dm_space_map *metadata_sm;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:675 @ static void unpack_value(__le64 value_le
 
 /*----------------------------------------------------------------*/
 
-struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev,
-						 sector_t data_block_size,
-						 bool may_format_device,
-						 size_t policy_hint_size)
+static struct dm_cache_metadata *metadata_open(struct block_device *bdev,
+					       sector_t data_block_size,
+					       bool may_format_device,
+					       size_t policy_hint_size)
 {
 	int r;
 	struct dm_cache_metadata *cmd;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:686 @ struct dm_cache_metadata *dm_cache_metad
 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
 	if (!cmd) {
 		DMERR("could not allocate metadata struct");
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 	}
 
+	atomic_set(&cmd->ref_count, 1);
 	init_rwsem(&cmd->root_lock);
 	cmd->bdev = bdev;
 	cmd->data_block_size = data_block_size;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:712 @ struct dm_cache_metadata *dm_cache_metad
 	return cmd;
 }
 
+/*
+ * We keep a little list of ref counted metadata objects to prevent two
+ * different target instances creating separate bufio instances.  This is
+ * an issue if a table is reloaded before the suspend.
+ */
+static DEFINE_MUTEX(table_lock);
+static LIST_HEAD(table);
+
+static struct dm_cache_metadata *lookup(struct block_device *bdev)
+{
+	struct dm_cache_metadata *cmd;
+
+	list_for_each_entry(cmd, &table, list)
+		if (cmd->bdev == bdev) {
+			atomic_inc(&cmd->ref_count);
+			return cmd;
+		}
+
+	return NULL;
+}
+
+static struct dm_cache_metadata *lookup_or_open(struct block_device *bdev,
+						sector_t data_block_size,
+						bool may_format_device,
+						size_t policy_hint_size)
+{
+	struct dm_cache_metadata *cmd, *cmd2;
+
+	mutex_lock(&table_lock);
+	cmd = lookup(bdev);
+	mutex_unlock(&table_lock);
+
+	if (cmd)
+		return cmd;
+
+	cmd = metadata_open(bdev, data_block_size, may_format_device, policy_hint_size);
+	if (!IS_ERR(cmd)) {
+		mutex_lock(&table_lock);
+		cmd2 = lookup(bdev);
+		if (cmd2) {
+			mutex_unlock(&table_lock);
+			__destroy_persistent_data_objects(cmd);
+			kfree(cmd);
+			return cmd2;
+		}
+		list_add(&cmd->list, &table);
+		mutex_unlock(&table_lock);
+	}
+
+	return cmd;
+}
+
+static bool same_params(struct dm_cache_metadata *cmd, sector_t data_block_size)
+{
+	if (cmd->data_block_size != data_block_size) {
+		DMERR("data_block_size (%llu) different from that in metadata (%llu)\n",
+		      (unsigned long long) data_block_size,
+		      (unsigned long long) cmd->data_block_size);
+		return false;
+	}
+
+	return true;
+}
+
+struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev,
+						 sector_t data_block_size,
+						 bool may_format_device,
+						 size_t policy_hint_size)
+{
+	struct dm_cache_metadata *cmd = lookup_or_open(bdev, data_block_size,
+						       may_format_device, policy_hint_size);
+
+	if (!IS_ERR(cmd) && !same_params(cmd, data_block_size)) {
+		dm_cache_metadata_close(cmd);
+		return ERR_PTR(-EINVAL);
+	}
+
+	return cmd;
+}
+
 void dm_cache_metadata_close(struct dm_cache_metadata *cmd)
 {
-	__destroy_persistent_data_objects(cmd);
-	kfree(cmd);
+	if (atomic_dec_and_test(&cmd->ref_count)) {
+		mutex_lock(&table_lock);
+		list_del(&cmd->list);
+		mutex_unlock(&table_lock);
+
+		__destroy_persistent_data_objects(cmd);
+		kfree(cmd);
+	}
 }
 
 /*
Index: linux-3.18.13-rt10-r7s4/drivers/md/dm-cache-target.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/md/dm-cache-target.c
+++ linux-3.18.13-rt10-r7s4/drivers/md/dm-cache-target.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:225 @ struct cache {
 	struct list_head need_commit_migrations;
 	sector_t migration_threshold;
 	wait_queue_head_t migration_wait;
-	atomic_t nr_migrations;
+	atomic_t nr_allocated_migrations;
+
+	/*
+	 * The number of in flight migrations that are performing
+	 * background io. eg, promotion, writeback.
+	 */
+	atomic_t nr_io_migrations;
 
 	wait_queue_head_t quiescing_wait;
 	atomic_t quiescing;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:267 @ struct cache {
 	struct dm_deferred_set *all_io_ds;
 
 	mempool_t *migration_pool;
-	struct dm_cache_migration *next_migration;
 
 	struct dm_cache_policy *policy;
 	unsigned policy_nr_args;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:357 @ static void free_prison_cell(struct cach
 	dm_bio_prison_free_cell(cache->prison, cell);
 }
 
+static struct dm_cache_migration *alloc_migration(struct cache *cache)
+{
+	struct dm_cache_migration *mg;
+
+	mg = mempool_alloc(cache->migration_pool, GFP_NOWAIT);
+	if (mg) {
+		mg->cache = cache;
+		atomic_inc(&mg->cache->nr_allocated_migrations);
+	}
+
+	return mg;
+}
+
+static void free_migration(struct dm_cache_migration *mg)
+{
+	if (atomic_dec_and_test(&mg->cache->nr_allocated_migrations))
+		wake_up(&mg->cache->migration_wait);
+
+	mempool_free(mg, mg->cache->migration_pool);
+}
+
 static int prealloc_data_structs(struct cache *cache, struct prealloc *p)
 {
 	if (!p->mg) {
-		p->mg = mempool_alloc(cache->migration_pool, GFP_NOWAIT);
+		p->mg = alloc_migration(cache);
 		if (!p->mg)
 			return -ENOMEM;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:410 @ static void prealloc_free_structs(struct
 		free_prison_cell(cache, p->cell1);
 
 	if (p->mg)
-		mempool_free(p->mg, cache->migration_pool);
+		free_migration(p->mg);
 }
 
 static struct dm_cache_migration *prealloc_get_migration(struct prealloc *p)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:846 @ static void remap_to_origin_then_cache(s
  * Migration covers moving data from the origin device to the cache, or
  * vice versa.
  *--------------------------------------------------------------*/
-static void free_migration(struct dm_cache_migration *mg)
-{
-	mempool_free(mg, mg->cache->migration_pool);
-}
-
-static void inc_nr_migrations(struct cache *cache)
+static void inc_io_migrations(struct cache *cache)
 {
-	atomic_inc(&cache->nr_migrations);
+	atomic_inc(&cache->nr_io_migrations);
 }
 
-static void dec_nr_migrations(struct cache *cache)
+static void dec_io_migrations(struct cache *cache)
 {
-	atomic_dec(&cache->nr_migrations);
-
-	/*
-	 * Wake the worker in case we're suspending the target.
-	 */
-	wake_up(&cache->migration_wait);
+	atomic_dec(&cache->nr_io_migrations);
 }
 
 static void __cell_defer(struct cache *cache, struct dm_bio_prison_cell *cell,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:876 @ static void cell_defer(struct cache *cac
 	wake_worker(cache);
 }
 
-static void cleanup_migration(struct dm_cache_migration *mg)
+static void free_io_migration(struct dm_cache_migration *mg)
 {
-	struct cache *cache = mg->cache;
+	dec_io_migrations(mg->cache);
 	free_migration(mg);
-	dec_nr_migrations(cache);
 }
 
 static void migration_failure(struct dm_cache_migration *mg)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:904 @ static void migration_failure(struct dm_
 		cell_defer(cache, mg->new_ocell, true);
 	}
 
-	cleanup_migration(mg);
+	free_io_migration(mg);
 }
 
 static void migration_success_pre_commit(struct dm_cache_migration *mg)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:915 @ static void migration_success_pre_commit
 	if (mg->writeback) {
 		clear_dirty(cache, mg->old_oblock, mg->cblock);
 		cell_defer(cache, mg->old_ocell, false);
-		cleanup_migration(mg);
+		free_io_migration(mg);
 		return;
 
 	} else if (mg->demote) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:925 @ static void migration_success_pre_commit
 					     mg->old_oblock);
 			if (mg->promote)
 				cell_defer(cache, mg->new_ocell, true);
-			cleanup_migration(mg);
+			free_io_migration(mg);
 			return;
 		}
 	} else {
 		if (dm_cache_insert_mapping(cache->cmd, mg->cblock, mg->new_oblock)) {
 			DMWARN_LIMIT("promotion failed; couldn't update on disk metadata");
 			policy_remove_mapping(cache->policy, mg->new_oblock);
-			cleanup_migration(mg);
+			free_io_migration(mg);
 			return;
 		}
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:965 @ static void migration_success_post_commi
 		} else {
 			if (mg->invalidate)
 				policy_remove_mapping(cache->policy, mg->old_oblock);
-			cleanup_migration(mg);
+			free_io_migration(mg);
 		}
 
 	} else {
-		clear_dirty(cache, mg->new_oblock, mg->cblock);
-		if (mg->requeue_holder)
+		if (mg->requeue_holder) {
+			clear_dirty(cache, mg->new_oblock, mg->cblock);
 			cell_defer(cache, mg->new_ocell, true);
-		else {
+		} else {
+			/*
+			 * The block was promoted via an overwrite, so it's dirty.
+			 */
+			set_dirty(cache, mg->new_oblock, mg->cblock);
 			bio_endio(mg->new_ocell->holder, 0);
 			cell_defer(cache, mg->new_ocell, false);
 		}
-		cleanup_migration(mg);
+		free_io_migration(mg);
 	}
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1092 @ static void issue_copy(struct dm_cache_m
 
 		avoid = is_discarded_oblock(cache, mg->new_oblock);
 
-		if (!avoid && bio_writes_complete_block(cache, bio)) {
+		if (writeback_mode(&cache->features) &&
+		    !avoid && bio_writes_complete_block(cache, bio)) {
 			issue_overwrite(mg, bio);
 			return;
 		}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1196 @ static void promote(struct cache *cache,
 	mg->new_ocell = cell;
 	mg->start_jiffies = jiffies;
 
-	inc_nr_migrations(cache);
+	inc_io_migrations(cache);
 	quiesce_migration(mg);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1219 @ static void writeback(struct cache *cach
 	mg->new_ocell = NULL;
 	mg->start_jiffies = jiffies;
 
-	inc_nr_migrations(cache);
+	inc_io_migrations(cache);
 	quiesce_migration(mg);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1245 @ static void demote_then_promote(struct c
 	mg->new_ocell = new_ocell;
 	mg->start_jiffies = jiffies;
 
-	inc_nr_migrations(cache);
+	inc_io_migrations(cache);
 	quiesce_migration(mg);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1272 @ static void invalidate(struct cache *cac
 	mg->new_ocell = NULL;
 	mg->start_jiffies = jiffies;
 
-	inc_nr_migrations(cache);
+	inc_io_migrations(cache);
 	quiesce_migration(mg);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1338 @ static void process_discard_bio(struct c
 
 static bool spare_migration_bandwidth(struct cache *cache)
 {
-	sector_t current_volume = (atomic_read(&cache->nr_migrations) + 1) *
+	sector_t current_volume = (atomic_read(&cache->nr_io_migrations) + 1) *
 		cache->sectors_per_block;
 	return current_volume < cache->migration_threshold;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1688 @ static void stop_quiescing(struct cache
 
 static void wait_for_migrations(struct cache *cache)
 {
-	wait_event(cache->migration_wait, !atomic_read(&cache->nr_migrations));
+	wait_event(cache->migration_wait, !atomic_read(&cache->nr_allocated_migrations));
 }
 
 static void stop_worker(struct cache *cache)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1800 @ static void destroy(struct cache *cache)
 {
 	unsigned i;
 
-	if (cache->next_migration)
-		mempool_free(cache->next_migration, cache->migration_pool);
-
 	if (cache->migration_pool)
 		mempool_destroy(cache->migration_pool);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2307 @ static int cache_create(struct cache_arg
 	INIT_LIST_HEAD(&cache->quiesced_migrations);
 	INIT_LIST_HEAD(&cache->completed_migrations);
 	INIT_LIST_HEAD(&cache->need_commit_migrations);
-	atomic_set(&cache->nr_migrations, 0);
+	atomic_set(&cache->nr_allocated_migrations, 0);
+	atomic_set(&cache->nr_io_migrations, 0);
 	init_waitqueue_head(&cache->migration_wait);
 
 	init_waitqueue_head(&cache->quiescing_wait);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2367 @ static int cache_create(struct cache_arg
 		goto bad;
 	}
 
-	cache->next_migration = NULL;
-
 	cache->need_tick_bio = true;
 	cache->sized = false;
 	cache->invalidate = false;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2568 @ static int __cache_map(struct cache *cac
 static int cache_map(struct dm_target *ti, struct bio *bio)
 {
 	int r;
-	struct dm_bio_prison_cell *cell;
+	struct dm_bio_prison_cell *cell = NULL;
 	struct cache *cache = ti->private;
 
 	r = __cache_map(cache, bio, &cell);
-	if (r == DM_MAPIO_REMAPPED) {
+	if (r == DM_MAPIO_REMAPPED && cell) {
 		inc_ds(cache, bio, cell);
 		cell_defer(cache, cell, false);
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/md/dm-crypt.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/md/dm-crypt.c
+++ linux-3.18.13-rt10-r7s4/drivers/md/dm-crypt.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:708 @ static int crypt_iv_tcw_whitening(struct
 	for (i = 0; i < ((1 << SECTOR_SHIFT) / 8); i++)
 		crypto_xor(data + i * 8, buf, 8);
 out:
-	memset(buf, 0, sizeof(buf));
+	memzero_explicit(buf, sizeof(buf));
 	return r;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/md/dm-io.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/md/dm-io.c
+++ linux-3.18.13-rt10-r7s4/drivers/md/dm-io.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:292 @ static void do_region(int rw, unsigned r
 	struct request_queue *q = bdev_get_queue(where->bdev);
 	unsigned short logical_block_size = queue_logical_block_size(q);
 	sector_t num_sectors;
+	unsigned int uninitialized_var(special_cmd_max_sectors);
+
+	/*
+	 * Reject unsupported discard and write same requests.
+	 */
+	if (rw & REQ_DISCARD)
+		special_cmd_max_sectors = q->limits.max_discard_sectors;
+	else if (rw & REQ_WRITE_SAME)
+		special_cmd_max_sectors = q->limits.max_write_same_sectors;
+	if ((rw & (REQ_DISCARD | REQ_WRITE_SAME)) && special_cmd_max_sectors == 0) {
+		dec_count(io, region, -EOPNOTSUPP);
+		return;
+	}
 
 	/*
 	 * where->count may be zero if rw holds a flush and we need to
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:327 @ static void do_region(int rw, unsigned r
 		store_io_and_region_in_bio(bio, io, region);
 
 		if (rw & REQ_DISCARD) {
-			num_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
+			num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
 			bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
 			remaining -= num_sectors;
 		} else if (rw & REQ_WRITE_SAME) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:336 @ static void do_region(int rw, unsigned r
 			 */
 			dp->get_page(dp, &page, &len, &offset);
 			bio_add_page(bio, page, logical_block_size, offset);
-			num_sectors = min_t(sector_t, q->limits.max_write_same_sectors, remaining);
+			num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
 			bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
 
 			offset = 0;
Index: linux-3.18.13-rt10-r7s4/drivers/md/dm-raid1.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/md/dm-raid1.c
+++ linux-3.18.13-rt10-r7s4/drivers/md/dm-raid1.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:607 @ static void write_callback(unsigned long
 		return;
 	}
 
+	/*
+	 * If the bio is discard, return an error, but do not
+	 * degrade the array.
+	 */
+	if (bio->bi_rw & REQ_DISCARD) {
+		bio_endio(bio, -EOPNOTSUPP);
+		return;
+	}
+
 	for (i = 0; i < ms->nr_mirrors; i++)
 		if (test_bit(i, &error))
 			fail_mirror(ms->mirror + i, DM_RAID1_WRITE_ERROR);
Index: linux-3.18.13-rt10-r7s4/drivers/md/dm-snap.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/md/dm-snap.c
+++ linux-3.18.13-rt10-r7s4/drivers/md/dm-snap.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:23 @
 #include <linux/log2.h>
 #include <linux/dm-kcopyd.h>
 
+#include "dm.h"
+
 #include "dm-exception-store.h"
 
 #define DM_MSG_PREFIX "snapshots"
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:296 @ struct origin {
 };
 
 /*
+ * This structure is allocated for each origin target
+ */
+struct dm_origin {
+	struct dm_dev *dev;
+	struct dm_target *ti;
+	unsigned split_boundary;
+	struct list_head hash_list;
+};
+
+/*
  * Size of the hash table for origin volumes. If we make this
  * the size of the minors list then it should be nearly perfect
  */
 #define ORIGIN_HASH_SIZE 256
 #define ORIGIN_MASK      0xFF
 static struct list_head *_origins;
+static struct list_head *_dm_origins;
 static struct rw_semaphore _origins_lock;
 
 static DECLARE_WAIT_QUEUE_HEAD(_pending_exceptions_done);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:326 @ static int init_origin_hash(void)
 	_origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
 			   GFP_KERNEL);
 	if (!_origins) {
-		DMERR("unable to allocate memory");
+		DMERR("unable to allocate memory for _origins");
 		return -ENOMEM;
 	}
-
 	for (i = 0; i < ORIGIN_HASH_SIZE; i++)
 		INIT_LIST_HEAD(_origins + i);
+
+	_dm_origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
+			      GFP_KERNEL);
+	if (!_dm_origins) {
+		DMERR("unable to allocate memory for _dm_origins");
+		kfree(_origins);
+		return -ENOMEM;
+	}
+	for (i = 0; i < ORIGIN_HASH_SIZE; i++)
+		INIT_LIST_HEAD(_dm_origins + i);
+
 	init_rwsem(&_origins_lock);
 
 	return 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:350 @ static int init_origin_hash(void)
 static void exit_origin_hash(void)
 {
 	kfree(_origins);
+	kfree(_dm_origins);
 }
 
 static unsigned origin_hash(struct block_device *bdev)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:377 @ static void __insert_origin(struct origi
 	list_add_tail(&o->hash_list, sl);
 }
 
+static struct dm_origin *__lookup_dm_origin(struct block_device *origin)
+{
+	struct list_head *ol;
+	struct dm_origin *o;
+
+	ol = &_dm_origins[origin_hash(origin)];
+	list_for_each_entry (o, ol, hash_list)
+		if (bdev_equal(o->dev->bdev, origin))
+			return o;
+
+	return NULL;
+}
+
+static void __insert_dm_origin(struct dm_origin *o)
+{
+	struct list_head *sl = &_dm_origins[origin_hash(o->dev->bdev)];
+	list_add_tail(&o->hash_list, sl);
+}
+
+static void __remove_dm_origin(struct dm_origin *o)
+{
+	list_del(&o->hash_list);
+}
+
 /*
  * _origins_lock must be held when calling this function.
  * Returns number of snapshots registered using the supplied cow device, plus:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1483 @ out:
 		full_bio->bi_private = pe->full_bio_private;
 		atomic_inc(&full_bio->bi_remaining);
 	}
-	free_pending_exception(pe);
-
 	increment_pending_exceptions_done_count();
 
 	up_write(&s->lock);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1499 @ out:
 	}
 
 	retry_origin_bios(s, origin_bios);
+
+	free_pending_exception(pe);
 }
 
 static void commit_callback(void *context, int success)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1891 @ static int snapshot_preresume(struct dm_
 static void snapshot_resume(struct dm_target *ti)
 {
 	struct dm_snapshot *s = ti->private;
-	struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
+	struct dm_snapshot *snap_src = NULL, *snap_dest = NULL, *snap_merging = NULL;
+	struct dm_origin *o;
+	struct mapped_device *origin_md = NULL;
+	bool must_restart_merging = false;
 
 	down_read(&_origins_lock);
+
+	o = __lookup_dm_origin(s->origin->bdev);
+	if (o)
+		origin_md = dm_table_get_md(o->ti->table);
+	if (!origin_md) {
+		(void) __find_snapshots_sharing_cow(s, NULL, NULL, &snap_merging);
+		if (snap_merging)
+			origin_md = dm_table_get_md(snap_merging->ti->table);
+	}
+	if (origin_md == dm_table_get_md(ti->table))
+		origin_md = NULL;
+	if (origin_md) {
+		if (dm_hold(origin_md))
+			origin_md = NULL;
+	}
+
+	up_read(&_origins_lock);
+
+	if (origin_md) {
+		dm_internal_suspend(origin_md);
+		if (snap_merging && test_bit(RUNNING_MERGE, &snap_merging->state_bits)) {
+			must_restart_merging = true;
+			stop_merge(snap_merging);
+		}
+	}
+
+	down_read(&_origins_lock);
+
 	(void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL);
 	if (snap_src && snap_dest) {
 		down_write(&snap_src->lock);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1933 @ static void snapshot_resume(struct dm_ta
 		up_write(&snap_dest->lock);
 		up_write(&snap_src->lock);
 	}
+
 	up_read(&_origins_lock);
 
+	if (origin_md) {
+		if (must_restart_merging)
+			start_merge(snap_merging);
+		dm_internal_resume(origin_md);
+		dm_put(origin_md);
+	}
+
 	/* Now we have correct chunk size, reregister */
 	reregister_snapshot(s);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2223 @ static int origin_write_extent(struct dm
  * Origin: maps a linear range of a device, with hooks for snapshotting.
  */
 
-struct dm_origin {
-	struct dm_dev *dev;
-	unsigned split_boundary;
-};
-
 /*
  * Construct an origin mapping: <dev_path>
  * The context for an origin is merely a 'struct dm_dev *'
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2251 @ static int origin_ctr(struct dm_target *
 		goto bad_open;
 	}
 
+	o->ti = ti;
 	ti->private = o;
 	ti->num_flush_bios = 1;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2266 @ bad_alloc:
 static void origin_dtr(struct dm_target *ti)
 {
 	struct dm_origin *o = ti->private;
+
 	dm_put_device(ti, o->dev);
 	kfree(o);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2303 @ static void origin_resume(struct dm_targ
 	struct dm_origin *o = ti->private;
 
 	o->split_boundary = get_origin_minimum_chunksize(o->dev->bdev);
+
+	down_write(&_origins_lock);
+	__insert_dm_origin(o);
+	up_write(&_origins_lock);
+}
+
+static void origin_postsuspend(struct dm_target *ti)
+{
+	struct dm_origin *o = ti->private;
+
+	down_write(&_origins_lock);
+	__remove_dm_origin(o);
+	up_write(&_origins_lock);
 }
 
 static void origin_status(struct dm_target *ti, status_type_t type,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2358 @ static int origin_iterate_devices(struct
 
 static struct target_type origin_target = {
 	.name    = "snapshot-origin",
-	.version = {1, 8, 1},
+	.version = {1, 9, 0},
 	.module  = THIS_MODULE,
 	.ctr     = origin_ctr,
 	.dtr     = origin_dtr,
 	.map     = origin_map,
 	.resume  = origin_resume,
+	.postsuspend = origin_postsuspend,
 	.status  = origin_status,
 	.merge	 = origin_merge,
 	.iterate_devices = origin_iterate_devices,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2372 @ static struct target_type origin_target
 
 static struct target_type snapshot_target = {
 	.name    = "snapshot",
-	.version = {1, 12, 0},
+	.version = {1, 13, 0},
 	.module  = THIS_MODULE,
 	.ctr     = snapshot_ctr,
 	.dtr     = snapshot_dtr,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2386 @ static struct target_type snapshot_targe
 
 static struct target_type merge_target = {
 	.name    = dm_snapshot_merge_target_name,
-	.version = {1, 2, 0},
+	.version = {1, 3, 0},
 	.module  = THIS_MODULE,
 	.ctr     = snapshot_ctr,
 	.dtr     = snapshot_dtr,
Index: linux-3.18.13-rt10-r7s4/drivers/md/dm-thin.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/md/dm-thin.c
+++ linux-3.18.13-rt10-r7s4/drivers/md/dm-thin.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:993 @ static void schedule_external_copy(struc
 		schedule_zero(tc, virt_block, data_dest, cell, bio);
 }
 
+static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
+
+static void check_for_space(struct pool *pool)
+{
+	int r;
+	dm_block_t nr_free;
+
+	if (get_pool_mode(pool) != PM_OUT_OF_DATA_SPACE)
+		return;
+
+	r = dm_pool_get_free_block_count(pool->pmd, &nr_free);
+	if (r)
+		return;
+
+	if (nr_free)
+		set_pool_mode(pool, PM_WRITE);
+}
+
 /*
  * A non-zero return indicates read_only or fail_io mode.
  * Many callers don't care about the return value.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1025 @ static int commit(struct pool *pool)
 	r = dm_pool_commit_metadata(pool->pmd);
 	if (r)
 		metadata_operation_failed(pool, "dm_pool_commit_metadata", r);
+	else
+		check_for_space(pool);
 
 	return r;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1045 @ static void check_low_water_mark(struct
 	}
 }
 
-static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
-
 static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
 {
 	int r;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1845 @ static void set_pool_mode(struct pool *p
 		pool->process_bio = process_bio_read_only;
 		pool->process_discard = process_discard;
 		pool->process_prepared_mapping = process_prepared_mapping;
-		pool->process_prepared_discard = process_prepared_discard_passdown;
+		pool->process_prepared_discard = process_prepared_discard;
 
 		if (!pool->pf.error_if_no_space && no_space_timeout)
 			queue_delayed_work(pool->wq, &pool->no_space_timeout, no_space_timeout);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2006 @ static int thin_bio_map(struct dm_target
 		return DM_MAPIO_REMAPPED;
 
 	case -ENODATA:
-		if (get_pool_mode(tc->pool) == PM_READ_ONLY) {
-			/*
-			 * This block isn't provisioned, and we have no way
-			 * of doing so.
-			 */
-			handle_unserviceable_bio(tc->pool, bio);
-			cell_defer_no_holder_no_free(tc, &cell1);
-			return DM_MAPIO_SUBMITTED;
-		}
-		/* fall through */
-
 	case -EWOULDBLOCK:
 		/*
 		 * In future, the failed dm_thin_find_block above could
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2970 @ static int pool_message(struct dm_target
 	struct pool_c *pt = ti->private;
 	struct pool *pool = pt->pool;
 
+	if (get_pool_mode(pool) >= PM_READ_ONLY) {
+		DMERR("%s: unable to service pool target messages in READ_ONLY or FAIL mode",
+		      dm_device_name(pool->pool_md));
+		return -EINVAL;
+	}
+
 	if (!strcasecmp(argv[0], "create_thin"))
 		r = process_create_thin_mesg(argc, argv, pool);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3264 @ static void thin_dtr(struct dm_target *t
 	struct thin_c *tc = ti->private;
 	unsigned long flags;
 
-	thin_put(tc);
-	wait_for_completion(&tc->can_destroy);
-
 	spin_lock_irqsave(&tc->pool->lock, flags);
 	list_del_rcu(&tc->list);
 	spin_unlock_irqrestore(&tc->pool->lock, flags);
 	synchronize_rcu();
 
+	thin_put(tc);
+	wait_for_completion(&tc->can_destroy);
+
 	mutex_lock(&dm_thin_pool_table.mutex);
 
 	__pool_dec(tc->pool);
Index: linux-3.18.13-rt10-r7s4/drivers/md/dm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/md/dm.c
+++ linux-3.18.13-rt10-r7s4/drivers/md/dm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:902 @ static void disable_write_same(struct ma
 
 static void clone_endio(struct bio *bio, int error)
 {
-	int r = 0;
+	int r = error;
 	struct dm_target_io *tio = container_of(bio, struct dm_target_io, clone);
 	struct dm_io *io = tio->io;
 	struct mapped_device *md = tio->io->md;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2465 @ int dm_setup_md_queue(struct mapped_devi
 	return 0;
 }
 
-static struct mapped_device *dm_find_md(dev_t dev)
+struct mapped_device *dm_get_md(dev_t dev)
 {
 	struct mapped_device *md;
 	unsigned minor = MINOR(dev);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2476 @ static struct mapped_device *dm_find_md(
 	spin_lock(&_minor_lock);
 
 	md = idr_find(&_minor_idr, minor);
-	if (md && (md == MINOR_ALLOCED ||
-		   (MINOR(disk_devt(dm_disk(md))) != minor) ||
-		   dm_deleting_md(md) ||
-		   test_bit(DMF_FREEING, &md->flags))) {
-		md = NULL;
-		goto out;
+	if (md) {
+		if ((md == MINOR_ALLOCED ||
+		     (MINOR(disk_devt(dm_disk(md))) != minor) ||
+		     dm_deleting_md(md) ||
+		     test_bit(DMF_FREEING, &md->flags))) {
+			md = NULL;
+			goto out;
+		}
+		dm_get(md);
 	}
 
 out:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2492 @ out:
 
 	return md;
 }
-
-struct mapped_device *dm_get_md(dev_t dev)
-{
-	struct mapped_device *md = dm_find_md(dev);
-
-	if (md)
-		dm_get(md);
-
-	return md;
-}
 EXPORT_SYMBOL_GPL(dm_get_md);
 
 void *dm_get_mdptr(struct mapped_device *md)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2510 @ void dm_get(struct mapped_device *md)
 	BUG_ON(test_bit(DMF_FREEING, &md->flags));
 }
 
+int dm_hold(struct mapped_device *md)
+{
+	spin_lock(&_minor_lock);
+	if (test_bit(DMF_FREEING, &md->flags)) {
+		spin_unlock(&_minor_lock);
+		return -EBUSY;
+	}
+	dm_get(md);
+	spin_unlock(&_minor_lock);
+	return 0;
+}
+EXPORT_SYMBOL_GPL(dm_hold);
+
 const char *dm_device_name(struct mapped_device *md)
 {
 	return md->name;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2542 @ static void __dm_destroy(struct mapped_d
 	set_bit(DMF_FREEING, &md->flags);
 	spin_unlock(&_minor_lock);
 
+	/*
+	 * Take suspend_lock so that presuspend and postsuspend methods
+	 * do not race with internal suspend.
+	 */
+	mutex_lock(&md->suspend_lock);
 	if (!dm_suspended_md(md)) {
 		dm_table_presuspend_targets(map);
 		dm_table_postsuspend_targets(map);
 	}
+	mutex_unlock(&md->suspend_lock);
 
 	/* dm_put_live_table must be before msleep, otherwise deadlock is possible */
 	dm_put_live_table(md, srcu_idx);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2903 @ void dm_internal_suspend(struct mapped_d
 	flush_workqueue(md->wq);
 	dm_wait_for_completion(md, TASK_UNINTERRUPTIBLE);
 }
+EXPORT_SYMBOL_GPL(dm_internal_suspend);
 
 void dm_internal_resume(struct mapped_device *md)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2915 @ void dm_internal_resume(struct mapped_de
 done:
 	mutex_unlock(&md->suspend_lock);
 }
+EXPORT_SYMBOL_GPL(dm_internal_resume);
 
 /*-----------------------------------------------------------------
  * Event notification.
Index: linux-3.18.13-rt10-r7s4/drivers/md/persistent-data/dm-space-map-metadata.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/md/persistent-data/dm-space-map-metadata.c
+++ linux-3.18.13-rt10-r7s4/drivers/md/persistent-data/dm-space-map-metadata.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:567 @ static int sm_bootstrap_get_nr_blocks(st
 {
 	struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
 
-	return smm->ll.nr_blocks;
+	*count = smm->ll.nr_blocks;
+
+	return 0;
 }
 
 static int sm_bootstrap_get_nr_free(struct dm_space_map *sm, dm_block_t *count)
Index: linux-3.18.13-rt10-r7s4/drivers/md/raid1.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/md/raid1.c
+++ linux-3.18.13-rt10-r7s4/drivers/md/raid1.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:563 @ static int read_balance(struct r1conf *c
 		if (test_bit(WriteMostly, &rdev->flags)) {
 			/* Don't balance among write-mostly, just
 			 * use the first as a last resort */
-			if (best_disk < 0) {
+			if (best_dist_disk < 0) {
 				if (is_badblock(rdev, this_sector, sectors,
 						&first_bad, &bad_sectors)) {
 					if (first_bad < this_sector)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:572 @ static int read_balance(struct r1conf *c
 					best_good_sectors = first_bad - this_sector;
 				} else
 					best_good_sectors = sectors;
-				best_disk = disk;
+				best_dist_disk = disk;
+				best_pending_disk = disk;
 			}
 			continue;
 		}
Index: linux-3.18.13-rt10-r7s4/drivers/md/raid5.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/md/raid5.c
+++ linux-3.18.13-rt10-r7s4/drivers/md/raid5.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2920 @ static int fetch_block(struct stripe_hea
 	     (sh->raid_conf->level <= 5 && s->failed && fdev[0]->towrite &&
 	      (!test_bit(R5_Insync, &dev->flags) || test_bit(STRIPE_PREREAD_ACTIVE, &sh->state)) &&
 	      !test_bit(R5_OVERWRITE, &fdev[0]->flags)) ||
-	     (sh->raid_conf->level == 6 && s->failed && s->to_write &&
-	      s->to_write - s->non_overwrite < sh->raid_conf->raid_disks - 2 &&
+	     ((sh->raid_conf->level == 6 ||
+	       sh->sector >= sh->raid_conf->mddev->recovery_cp)
+	      && s->failed && s->to_write &&
+	      (s->to_write - s->non_overwrite <
+	       sh->raid_conf->raid_disks - sh->raid_conf->max_degraded) &&
 	      (!test_bit(R5_Insync, &dev->flags) || test_bit(STRIPE_PREREAD_ACTIVE, &sh->state))))) {
 		/* we would like to get this block, possibly by computing it,
 		 * otherwise read it if the backing disk is insync
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3105 @ static void handle_stripe_dirtying(struc
 	 * generate correct data from the parity.
 	 */
 	if (conf->max_degraded == 2 ||
-	    (recovery_cp < MaxSector && sh->sector >= recovery_cp)) {
+	    (recovery_cp < MaxSector && sh->sector >= recovery_cp &&
+	     s->failed == 0)) {
 		/* Calculate the real rcw later - for now make it
 		 * look like rcw is cheaper
 		 */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3199 @ static void handle_stripe_dirtying(struc
 					  (unsigned long long)sh->sector,
 					  rcw, qread, test_bit(STRIPE_DELAYED, &sh->state));
 	}
+
+	if (rcw > disks && rmw > disks &&
+	    !test_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
+		set_bit(STRIPE_DELAYED, &sh->state);
+
 	/* now if nothing is locked, and if we have enough data,
 	 * we can start a write request
 	 */
Index: linux-3.18.13-rt10-r7s4/drivers/media/dvb-frontends/si2168.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/dvb-frontends/si2168.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/dvb-frontends/si2168.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:608 @ static const struct dvb_frontend_ops si2
 	.delsys = {SYS_DVBT, SYS_DVBT2, SYS_DVBC_ANNEX_A},
 	.info = {
 		.name = "Silicon Labs Si2168",
+		.symbol_rate_min = 1000000,
+		.symbol_rate_max = 7200000,
 		.caps =	FE_CAN_FEC_1_2 |
 			FE_CAN_FEC_2_3 |
 			FE_CAN_FEC_3_4 |
Index: linux-3.18.13-rt10-r7s4/drivers/media/i2c/smiapp-pll.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/i2c/smiapp-pll.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/i2c/smiapp-pll.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:70 @ static void print_pll(struct device *dev
 {
 	dev_dbg(dev, "pre_pll_clk_div\t%d\n",  pll->pre_pll_clk_div);
 	dev_dbg(dev, "pll_multiplier \t%d\n",  pll->pll_multiplier);
-	if (pll->flags != SMIAPP_PLL_FLAG_NO_OP_CLOCKS) {
+	if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) {
 		dev_dbg(dev, "op_sys_clk_div \t%d\n", pll->op_sys_clk_div);
 		dev_dbg(dev, "op_pix_clk_div \t%d\n", pll->op_pix_clk_div);
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:80 @ static void print_pll(struct device *dev
 	dev_dbg(dev, "ext_clk_freq_hz \t%d\n", pll->ext_clk_freq_hz);
 	dev_dbg(dev, "pll_ip_clk_freq_hz \t%d\n", pll->pll_ip_clk_freq_hz);
 	dev_dbg(dev, "pll_op_clk_freq_hz \t%d\n", pll->pll_op_clk_freq_hz);
-	if (pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS) {
+	if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) {
 		dev_dbg(dev, "op_sys_clk_freq_hz \t%d\n",
 			pll->op_sys_clk_freq_hz);
 		dev_dbg(dev, "op_pix_clk_freq_hz \t%d\n",
Index: linux-3.18.13-rt10-r7s4/drivers/media/i2c/smiapp/smiapp-core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/i2c/smiapp/smiapp-core.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/i2c/smiapp/smiapp-core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2680 @ static int smiapp_registered(struct v4l2
 		pll->flags |= SMIAPP_PLL_FLAG_NO_OP_CLOCKS;
 	pll->scale_n = sensor->limits[SMIAPP_LIMIT_SCALER_N_MIN];
 
+	mutex_lock(&sensor->mutex);
 	rval = smiapp_update_mode(sensor);
+	mutex_unlock(&sensor->mutex);
 	if (rval) {
 		dev_err(&client->dev, "update mode failed\n");
 		goto out_nvm_release;
Index: linux-3.18.13-rt10-r7s4/drivers/media/pci/cx23885/cx23885-cards.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/pci/cx23885/cx23885-cards.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/pci/cx23885/cx23885-cards.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:617 @ struct cx23885_board cx23885_boards[] =
 		.portb		= CX23885_MPEG_DVB,
 	},
 	[CX23885_BOARD_HAUPPAUGE_HVR4400] = {
-		.name		= "Hauppauge WinTV-HVR4400",
+		.name		= "Hauppauge WinTV-HVR4400/HVR5500",
 		.porta		= CX23885_ANALOG_VIDEO,
 		.portb		= CX23885_MPEG_DVB,
 		.portc		= CX23885_MPEG_DVB,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:625 @ struct cx23885_board cx23885_boards[] =
 		.tuner_addr	= 0x60, /* 0xc0 >> 1 */
 		.tuner_bus	= 1,
 	},
+	[CX23885_BOARD_HAUPPAUGE_STARBURST] = {
+		.name		= "Hauppauge WinTV Starburst",
+		.portb		= CX23885_MPEG_DVB,
+	},
 	[CX23885_BOARD_AVERMEDIA_HC81R] = {
 		.name		= "AVerTV Hybrid Express Slim HC81R",
 		.tuner_type	= TUNER_XC2028,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:917 @ struct cx23885_subid cx23885_subids[] =
 	}, {
 		.subvendor = 0x0070,
 		.subdevice = 0xc108,
-		.card      = CX23885_BOARD_HAUPPAUGE_HVR4400,
+		.card      = CX23885_BOARD_HAUPPAUGE_HVR4400, /* Hauppauge WinTV HVR-4400 (Model 121xxx, Hybrid DVB-T/S2, IR) */
 	}, {
 		.subvendor = 0x0070,
 		.subdevice = 0xc138,
-		.card      = CX23885_BOARD_HAUPPAUGE_HVR4400,
+		.card      = CX23885_BOARD_HAUPPAUGE_HVR4400, /* Hauppauge WinTV HVR-5500 (Model 121xxx, Hybrid DVB-T/C/S2, IR) */
 	}, {
 		.subvendor = 0x0070,
 		.subdevice = 0xc12a,
-		.card      = CX23885_BOARD_HAUPPAUGE_HVR4400,
+		.card      = CX23885_BOARD_HAUPPAUGE_STARBURST, /* Hauppauge WinTV Starburst (Model 121x00, DVB-S2, IR) */
 	}, {
 		.subvendor = 0x0070,
 		.subdevice = 0xc1f8,
-		.card      = CX23885_BOARD_HAUPPAUGE_HVR4400,
+		.card      = CX23885_BOARD_HAUPPAUGE_HVR4400, /* Hauppauge WinTV HVR-5500 (Model 121xxx, Hybrid DVB-T/C/S2, IR) */
 	}, {
 		.subvendor = 0x1461,
 		.subdevice = 0xd939,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1502 @ void cx23885_gpio_setup(struct cx23885_d
 		cx_write(GPIO_ISM, 0x00000000);/* INTERRUPTS active low*/
 		break;
 	case CX23885_BOARD_HAUPPAUGE_HVR4400:
+	case CX23885_BOARD_HAUPPAUGE_STARBURST:
 		/* GPIO-8 tda10071 demod reset */
-		/* GPIO-9 si2165 demod reset */
+		/* GPIO-9 si2165 demod reset (only HVR4400/HVR5500)*/
 
 		/* Put the parts into reset and back */
 		cx23885_gpio_enable(dev, GPIO_8 | GPIO_9, 1);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1768 @ void cx23885_card_setup(struct cx23885_d
 	case CX23885_BOARD_HAUPPAUGE_HVR1850:
 	case CX23885_BOARD_HAUPPAUGE_HVR1290:
 	case CX23885_BOARD_HAUPPAUGE_HVR4400:
+	case CX23885_BOARD_HAUPPAUGE_STARBURST:
 	case CX23885_BOARD_HAUPPAUGE_IMPACTVCBE:
 		if (dev->i2c_bus[0].i2c_rc == 0)
 			hauppauge_eeprom(dev, eeprom+0xc0);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1873 @ void cx23885_card_setup(struct cx23885_d
 		ts2->ts_clk_en_val = 0x1; /* Enable TS_CLK */
 		ts2->src_sel_val   = CX23885_SRC_SEL_PARALLEL_MPEG_VIDEO;
 		break;
+	case CX23885_BOARD_HAUPPAUGE_STARBURST:
+		ts1->gen_ctrl_val  = 0xc; /* Serial bus + punctured clock */
+		ts1->ts_clk_en_val = 0x1; /* Enable TS_CLK */
+		ts1->src_sel_val   = CX23885_SRC_SEL_PARALLEL_MPEG_VIDEO;
+		break;
 	case CX23885_BOARD_DVBSKY_T9580:
 		ts1->gen_ctrl_val  = 0x5; /* Parallel */
 		ts1->ts_clk_en_val = 0x1; /* Enable TS_CLK */
Index: linux-3.18.13-rt10-r7s4/drivers/media/pci/cx23885/cx23885-dvb.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/pci/cx23885/cx23885-dvb.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/pci/cx23885/cx23885-dvb.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1589 @ static int dvb_register(struct cx23885_t
 			break;
 		}
 		break;
+	case CX23885_BOARD_HAUPPAUGE_STARBURST:
+		i2c_bus = &dev->i2c_bus[0];
+		fe0->dvb.frontend = dvb_attach(tda10071_attach,
+						&hauppauge_tda10071_config,
+						&i2c_bus->i2c_adap);
+		if (fe0->dvb.frontend != NULL) {
+			dvb_attach(a8293_attach, fe0->dvb.frontend,
+				   &i2c_bus->i2c_adap,
+				   &hauppauge_a8293_config);
+		}
+		break;
 	case CX23885_BOARD_DVBSKY_T9580:
 		i2c_bus = &dev->i2c_bus[0];
 		i2c_bus2 = &dev->i2c_bus[1];
Index: linux-3.18.13-rt10-r7s4/drivers/media/pci/cx23885/cx23885.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/pci/cx23885/cx23885.h
+++ linux-3.18.13-rt10-r7s4/drivers/media/pci/cx23885/cx23885.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:96 @
 #define CX23885_BOARD_HAUPPAUGE_IMPACTVCBE     43
 #define CX23885_BOARD_DVICO_FUSIONHDTV_DVB_T_DUAL_EXP2 44
 #define CX23885_BOARD_DVBSKY_T9580             45
+#define CX23885_BOARD_HAUPPAUGE_STARBURST      52
 
 #define GPIO_0 0x00000001
 #define GPIO_1 0x00000002
Index: linux-3.18.13-rt10-r7s4/drivers/media/platform/Kconfig
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/platform/Kconfig
+++ linux-3.18.13-rt10-r7s4/drivers/media/platform/Kconfig
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:59 @ config VIDEO_VIU
 
 config VIDEO_TIMBERDALE
 	tristate "Support for timberdale Video In/LogiWIN"
-	depends on VIDEO_V4L2 && I2C && DMADEVICES
-	depends on MFD_TIMBERDALE || COMPILE_TEST
-	select DMA_ENGINE
-	select TIMB_DMA
+	depends on VIDEO_V4L2 && I2C
+	depends on (MFD_TIMBERDALE && TIMB_DMA) || COMPILE_TEST
 	select VIDEO_ADV7180
 	select VIDEOBUF_DMA_CONTIG
 	---help---
Index: linux-3.18.13-rt10-r7s4/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
+++ linux-3.18.13-rt10-r7s4/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:32 @
 
 /* Offset base used to differentiate between CAPTURE and OUTPUT
 *  while mmaping */
-#define DST_QUEUE_OFF_BASE      (TASK_SIZE / 2)
+#define DST_QUEUE_OFF_BASE	(1 << 30)
 
 #define MFC_BANK1_ALLOC_CTX	0
 #define MFC_BANK2_ALLOC_CTX	1
Index: linux-3.18.13-rt10-r7s4/drivers/media/platform/sh_veu.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/platform/sh_veu.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/platform/sh_veu.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1182 @ static int sh_veu_probe(struct platform_
 	}
 
 	*vdev = sh_veu_videodev;
+	vdev->v4l2_dev = &veu->v4l2_dev;
 	spin_lock_init(&veu->lock);
 	mutex_init(&veu->fop_lock);
 	vdev->lock = &veu->fop_lock;
Index: linux-3.18.13-rt10-r7s4/drivers/media/platform/soc_camera/soc_camera.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/platform/soc_camera/soc_camera.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/platform/soc_camera/soc_camera.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1686 @ eclkreg:
 eaddpdev:
 	platform_device_put(sasc->pdev);
 eallocpdev:
-	devm_kfree(ici->v4l2_dev.dev, sasc);
+	devm_kfree(ici->v4l2_dev.dev, info);
 	dev_err(ici->v4l2_dev.dev, "group probe failed: %d\n", ret);
 
 	return ret;
Index: linux-3.18.13-rt10-r7s4/drivers/media/platform/vivid/vivid-vid-out.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/platform/vivid/vivid-vid-out.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/platform/vivid/vivid-vid-out.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:615 @ int vivid_vid_out_g_selection(struct fil
 		sel->r = dev->fmt_out_rect;
 		break;
 	case V4L2_SEL_TGT_CROP_BOUNDS:
-		if (!dev->has_compose_out)
+		if (!dev->has_crop_out)
 			return -EINVAL;
 		sel->r = vivid_max_rect;
 		break;
Index: linux-3.18.13-rt10-r7s4/drivers/media/rc/img-ir/img-ir-hw.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/rc/img-ir/img-ir-hw.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/rc/img-ir/img-ir-hw.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:533 @ static void img_ir_set_decoder(struct im
 	u32 ir_status, irq_en;
 	spin_lock_irq(&priv->lock);
 
+	/*
+	 * First record that the protocol is being stopped so that the end timer
+	 * isn't restarted while we're trying to stop it.
+	 */
+	hw->stopping = true;
+
+	/*
+	 * Release the lock to stop the end timer, since the end timer handler
+	 * acquires the lock and we don't want to deadlock waiting for it.
+	 */
+	spin_unlock_irq(&priv->lock);
+	del_timer_sync(&hw->end_timer);
+	spin_lock_irq(&priv->lock);
+
+	hw->stopping = false;
+
 	/* switch off and disable interrupts */
 	img_ir_write(priv, IMG_IR_CONTROL, 0);
 	irq_en = img_ir_read(priv, IMG_IR_IRQ_ENABLE);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:560 @ static void img_ir_set_decoder(struct im
 	if (ir_status & (IMG_IR_RXDVAL | IMG_IR_RXDVALD2)) {
 		ir_status &= ~(IMG_IR_RXDVAL | IMG_IR_RXDVALD2);
 		img_ir_write(priv, IMG_IR_STATUS, ir_status);
-		img_ir_read(priv, IMG_IR_DATA_LW);
-		img_ir_read(priv, IMG_IR_DATA_UP);
 	}
 
-	/* stop the end timer and switch back to normal mode */
-	del_timer_sync(&hw->end_timer);
+	/* always read data to clear buffer if IR wakes the device */
+	img_ir_read(priv, IMG_IR_DATA_LW);
+	img_ir_read(priv, IMG_IR_DATA_UP);
+
+	/* switch back to normal mode */
 	hw->mode = IMG_IR_M_NORMAL;
 
 	/* clear the wakeup scancode filter */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:837 @ static void img_ir_handle_data(struct im
 	}
 
 
-	if (dec->repeat) {
+	/* we mustn't update the end timer while trying to stop it */
+	if (dec->repeat && !hw->stopping) {
 		unsigned long interval;
 
 		img_ir_begin_repeat(priv);
Index: linux-3.18.13-rt10-r7s4/drivers/media/rc/img-ir/img-ir-hw.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/rc/img-ir/img-ir-hw.h
+++ linux-3.18.13-rt10-r7s4/drivers/media/rc/img-ir/img-ir-hw.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:217 @ enum img_ir_mode {
  * @flags:		IMG_IR_F_*.
  * @filters:		HW filters (derived from scancode filters).
  * @mode:		Current decode mode.
+ * @stopping:		Indicates that decoder is being taken down and timers
+ *			should not be restarted.
  * @suspend_irqen:	Saved IRQ enable mask over suspend.
  */
 struct img_ir_priv_hw {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:234 @ struct img_ir_priv_hw {
 	struct img_ir_filter		filters[RC_FILTER_MAX];
 
 	enum img_ir_mode		mode;
+	bool				stopping;
 	u32				suspend_irqen;
 };
 
Index: linux-3.18.13-rt10-r7s4/drivers/media/rc/ir-lirc-codec.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/rc/ir-lirc-codec.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/rc/ir-lirc-codec.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:45 @ static int ir_lirc_decode(struct rc_dev
 		return -EINVAL;
 
 	/* Packet start */
-	if (ev.reset)
-		return 0;
+	if (ev.reset) {
+		/* Userspace expects a long space event before the start of
+		 * the signal to use as a sync.  This may be done with repeat
+		 * packets and normal samples.  But if a reset has been sent
+		 * then we assume that a long time has passed, so we send a
+		 * space with the maximum time value. */
+		sample = LIRC_SPACE(LIRC_VALUE_MASK);
+		IR_dprintk(2, "delivering reset sync space to lirc_dev\n");
 
 	/* Carrier reports */
-	if (ev.carrier_report) {
+	} else if (ev.carrier_report) {
 		sample = LIRC_FREQUENCY(ev.carrier);
 		IR_dprintk(2, "carrier report (freq: %d)\n", sample);
 
Index: linux-3.18.13-rt10-r7s4/drivers/media/rc/rc-main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/rc/rc-main.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/rc/rc-main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1024 @ static ssize_t store_protocols(struct de
 		goto out;
 	}
 
-	if (new_protocols == old_protocols) {
-		rc = len;
-		goto out;
+	if (new_protocols != old_protocols) {
+		*current_protocols = new_protocols;
+		IR_dprintk(1, "Protocols changed to 0x%llx\n",
+			   (long long)new_protocols);
 	}
 
-	*current_protocols = new_protocols;
-	IR_dprintk(1, "Protocols changed to 0x%llx\n", (long long)new_protocols);
-
 	/*
-	 * If the protocol is changed the filter needs updating.
+	 * If a protocol change was attempted the filter may need updating, even
+	 * if the actual protocol mask hasn't changed (since the driver may have
+	 * cleared the filter).
 	 * Try setting the same filter with the new protocol (if any).
 	 * Fall back to clearing the filter.
 	 */
Index: linux-3.18.13-rt10-r7s4/drivers/media/usb/au0828/au0828-cards.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/usb/au0828/au0828-cards.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/usb/au0828/au0828-cards.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:39 @ static void hvr950q_cs5340_audio(void *p
 		au0828_clear(dev, REG_000, 0x10);
 }
 
+/*
+ * WARNING: There's a quirks table at sound/usb/quirks-table.h
+ * that should also be updated every time a new device with V4L2 support
+ * is added here.
+ */
 struct au0828_board au0828_boards[] = {
 	[AU0828_BOARD_UNKNOWN] = {
 		.name	= "Unknown board",
Index: linux-3.18.13-rt10-r7s4/drivers/media/usb/dvb-usb-v2/lmedm04.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/usb/dvb-usb-v2/lmedm04.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/usb/dvb-usb-v2/lmedm04.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:347 @ static void lme2510_int_response(struct
 
 	usb_submit_urb(lme_urb, GFP_ATOMIC);
 
-	/* interrupt urb is due every 48 msecs while streaming
-	 *	add 12msecs for system lag */
-	st->int_urb_due = jiffies + msecs_to_jiffies(60);
+	/* Interrupt urb is due every 48 msecs while streaming the buffer
+	 * stores up to 4 periods if missed. Allow 200 msec for next interrupt.
+	 */
+	st->int_urb_due = jiffies + msecs_to_jiffies(200);
 }
 
 static int lme2510_int_read(struct dvb_usb_adapter *adap)
 {
 	struct dvb_usb_device *d = adap_to_d(adap);
 	struct lme2510_state *lme_int = adap_to_priv(adap);
+	struct usb_host_endpoint *ep;
 
 	lme_int->lme_urb = usb_alloc_urb(0, GFP_ATOMIC);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:379 @ static int lme2510_int_read(struct dvb_u
 				adap,
 				8);
 
+	/* Quirk of pipe reporting PIPE_BULK but behaves as interrupt */
+	ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe);
+
+	if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
+		lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa),
+
 	lme_int->lme_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 
 	usb_submit_urb(lme_int->lme_urb, GFP_ATOMIC);
Index: linux-3.18.13-rt10-r7s4/drivers/media/usb/dvb-usb/af9005.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/usb/dvb-usb/af9005.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/usb/dvb-usb/af9005.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1084 @ static int __init af9005_usb_module_init
 		err("usb_register failed. (%d)", result);
 		return result;
 	}
+#if IS_MODULE(CONFIG_DVB_USB_AF9005) || defined(CONFIG_DVB_USB_AF9005_REMOTE)
+	/* FIXME: convert to todays kernel IR infrastructure */
 	rc_decode = symbol_request(af9005_rc_decode);
 	rc_keys = symbol_request(rc_map_af9005_table);
 	rc_keys_size = symbol_request(rc_map_af9005_table_size);
+#endif
 	if (rc_decode == NULL || rc_keys == NULL || rc_keys_size == NULL) {
 		err("af9005_rc_decode function not found, disabling remote");
 		af9005_properties.rc.legacy.rc_query = NULL;
Index: linux-3.18.13-rt10-r7s4/drivers/media/usb/em28xx/em28xx-audio.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/usb/em28xx/em28xx-audio.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/usb/em28xx/em28xx-audio.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:824 @ static int em28xx_audio_urb_init(struct
 	if (urb_size > ep_size * npackets)
 		npackets = DIV_ROUND_UP(urb_size, ep_size);
 
-	em28xx_info("Number of URBs: %d, with %d packets and %d size",
+	em28xx_info("Number of URBs: %d, with %d packets and %d size\n",
 		    num_urb, npackets, urb_size);
 
 	/* Estimate the bytes per period */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:985 @ static int em28xx_audio_fini(struct em28
 		return 0;
 	}
 
-	em28xx_info("Closing audio extension");
+	em28xx_info("Closing audio extension\n");
 
 	if (dev->adev.sndcard) {
 		snd_card_disconnect(dev->adev.sndcard);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1009 @ static int em28xx_audio_suspend(struct e
 	if (dev->usb_audio_type != EM28XX_USB_AUDIO_VENDOR)
 		return 0;
 
-	em28xx_info("Suspending audio extension");
+	em28xx_info("Suspending audio extension\n");
 	em28xx_deinit_isoc_audio(dev);
 	atomic_set(&dev->adev.stream_started, 0);
 	return 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1023 @ static int em28xx_audio_resume(struct em
 	if (dev->usb_audio_type != EM28XX_USB_AUDIO_VENDOR)
 		return 0;
 
-	em28xx_info("Resuming audio extension");
+	em28xx_info("Resuming audio extension\n");
 	/* Nothing to do other than schedule_work() ?? */
 	schedule_work(&dev->adev.wq_trigger);
 	return 0;
Index: linux-3.18.13-rt10-r7s4/drivers/media/usb/em28xx/em28xx-core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/usb/em28xx/em28xx-core.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/usb/em28xx/em28xx-core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1125 @ int em28xx_suspend_extension(struct em28
 {
 	const struct em28xx_ops *ops = NULL;
 
-	em28xx_info("Suspending extensions");
+	em28xx_info("Suspending extensions\n");
 	mutex_lock(&em28xx_devlist_mutex);
 	list_for_each_entry(ops, &em28xx_extension_devlist, next) {
 		if (ops->suspend)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1139 @ int em28xx_resume_extension(struct em28x
 {
 	const struct em28xx_ops *ops = NULL;
 
-	em28xx_info("Resuming extensions");
+	em28xx_info("Resuming extensions\n");
 	mutex_lock(&em28xx_devlist_mutex);
 	list_for_each_entry(ops, &em28xx_extension_devlist, next) {
 		if (ops->resume)
Index: linux-3.18.13-rt10-r7s4/drivers/media/usb/em28xx/em28xx-dvb.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/usb/em28xx/em28xx-dvb.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/usb/em28xx/em28xx-dvb.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1670 @ static int em28xx_dvb_fini(struct em28xx
 	if (!dev->dvb)
 		return 0;
 
-	em28xx_info("Closing DVB extension");
+	em28xx_info("Closing DVB extension\n");
 
 	dvb = dev->dvb;
 	client = dvb->i2c_client_tuner;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1721 @ static int em28xx_dvb_suspend(struct em2
 	if (!dev->board.has_dvb)
 		return 0;
 
-	em28xx_info("Suspending DVB extension");
+	em28xx_info("Suspending DVB extension\n");
 	if (dev->dvb) {
 		struct em28xx_dvb *dvb = dev->dvb;
 
 		if (dvb->fe[0]) {
 			ret = dvb_frontend_suspend(dvb->fe[0]);
-			em28xx_info("fe0 suspend %d", ret);
+			em28xx_info("fe0 suspend %d\n", ret);
 		}
 		if (dvb->fe[1]) {
 			dvb_frontend_suspend(dvb->fe[1]);
-			em28xx_info("fe1 suspend %d", ret);
+			em28xx_info("fe1 suspend %d\n", ret);
 		}
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1748 @ static int em28xx_dvb_resume(struct em28
 	if (!dev->board.has_dvb)
 		return 0;
 
-	em28xx_info("Resuming DVB extension");
+	em28xx_info("Resuming DVB extension\n");
 	if (dev->dvb) {
 		struct em28xx_dvb *dvb = dev->dvb;
 
 		if (dvb->fe[0]) {
 			ret = dvb_frontend_resume(dvb->fe[0]);
-			em28xx_info("fe0 resume %d", ret);
+			em28xx_info("fe0 resume %d\n", ret);
 		}
 
 		if (dvb->fe[1]) {
 			ret = dvb_frontend_resume(dvb->fe[1]);
-			em28xx_info("fe1 resume %d", ret);
+			em28xx_info("fe1 resume %d\n", ret);
 		}
 	}
 
Index: linux-3.18.13-rt10-r7s4/drivers/media/usb/em28xx/em28xx-input.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/usb/em28xx/em28xx-input.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/usb/em28xx/em28xx-input.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:836 @ static int em28xx_ir_fini(struct em28xx
 		return 0;
 	}
 
-	em28xx_info("Closing input extension");
+	em28xx_info("Closing input extension\n");
 
 	em28xx_shutdown_buttons(dev);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:866 @ static int em28xx_ir_suspend(struct em28
 	if (dev->is_audio_only)
 		return 0;
 
-	em28xx_info("Suspending input extension");
+	em28xx_info("Suspending input extension\n");
 	if (ir)
 		cancel_delayed_work_sync(&ir->work);
 	cancel_delayed_work_sync(&dev->buttons_query_work);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:883 @ static int em28xx_ir_resume(struct em28x
 	if (dev->is_audio_only)
 		return 0;
 
-	em28xx_info("Resuming input extension");
+	em28xx_info("Resuming input extension\n");
 	/* if suspend calls ir_raw_event_unregister(), the should call
 	   ir_raw_event_register() */
 	if (ir)
Index: linux-3.18.13-rt10-r7s4/drivers/media/usb/em28xx/em28xx-video.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/usb/em28xx/em28xx-video.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/usb/em28xx/em28xx-video.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1959 @ static int em28xx_v4l2_fini(struct em28x
 	if (v4l2 == NULL)
 		return 0;
 
-	em28xx_info("Closing video extension");
+	em28xx_info("Closing video extension\n");
 
 	mutex_lock(&dev->lock);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2008 @ static int em28xx_v4l2_suspend(struct em
 	if (!dev->has_video)
 		return 0;
 
-	em28xx_info("Suspending video extension");
+	em28xx_info("Suspending video extension\n");
 	em28xx_stop_urbs(dev);
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2021 @ static int em28xx_v4l2_resume(struct em2
 	if (!dev->has_video)
 		return 0;
 
-	em28xx_info("Resuming video extension");
+	em28xx_info("Resuming video extension\n");
 	/* what do we do here */
 	return 0;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/media/usb/uvc/uvc_driver.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/usb/uvc/uvc_driver.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/usb/uvc/uvc_driver.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1626 @ static void uvc_delete(struct uvc_device
 {
 	struct list_head *p, *n;
 
-	usb_put_intf(dev->intf);
-	usb_put_dev(dev->udev);
-
 	uvc_status_cleanup(dev);
 	uvc_ctrl_cleanup_device(dev);
 
+	usb_put_intf(dev->intf);
+	usb_put_dev(dev->udev);
+
 	if (dev->vdev.dev)
 		v4l2_device_unregister(&dev->vdev);
 #ifdef CONFIG_MEDIA_CONTROLLER
Index: linux-3.18.13-rt10-r7s4/drivers/media/v4l2-core/videobuf2-core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/media/v4l2-core/videobuf2-core.c
+++ linux-3.18.13-rt10-r7s4/drivers/media/v4l2-core/videobuf2-core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3145 @ static int vb2_thread(void *data)
 			prequeue--;
 		} else {
 			call_void_qop(q, wait_finish, q);
-			ret = vb2_internal_dqbuf(q, &fileio->b, 0);
+			if (!threadio->stop)
+				ret = vb2_internal_dqbuf(q, &fileio->b, 0);
 			call_void_qop(q, wait_prepare, q);
 			dprintk(5, "file io: vb2_dqbuf result: %d\n", ret);
 		}
-		if (threadio->stop)
-			break;
-		if (ret)
+		if (ret || threadio->stop)
 			break;
 		try_to_freeze();
 
 		vb = q->bufs[fileio->b.index];
 		if (!(fileio->b.flags & V4L2_BUF_FLAG_ERROR))
-			ret = threadio->fnc(vb, threadio->priv);
-		if (ret)
-			break;
+			if (threadio->fnc(vb, threadio->priv))
+				break;
 		call_void_qop(q, wait_finish, q);
 		if (set_timestamp)
 			v4l2_get_timestamp(&fileio->b.timestamp);
-		ret = vb2_internal_qbuf(q, &fileio->b);
+		if (!threadio->stop)
+			ret = vb2_internal_qbuf(q, &fileio->b);
 		call_void_qop(q, wait_prepare, q);
-		if (ret)
+		if (ret || threadio->stop)
 			break;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3229 @ int vb2_thread_stop(struct vb2_queue *q)
 
 	if (threadio == NULL)
 		return 0;
-	call_void_qop(q, wait_finish, q);
 	threadio->stop = true;
-	vb2_internal_streamoff(q, q->type);
-	call_void_qop(q, wait_prepare, q);
-	q->fileio = NULL;
-	fileio->req.count = 0;
-	vb2_reqbufs(q, &fileio->req);
-	kfree(fileio);
+	/* Wake up all pending sleeps in the thread */
+	vb2_queue_error(q);
 	err = kthread_stop(threadio->thread);
+	__vb2_cleanup_fileio(q);
 	threadio->thread = NULL;
 	kfree(threadio);
-	q->fileio = NULL;
 	q->threadio = NULL;
 	return err;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/mfd/kempld-core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mfd/kempld-core.c
+++ linux-3.18.13-rt10-r7s4/drivers/mfd/kempld-core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:743 @ static int __init kempld_init(void)
 		for (id = kempld_dmi_table;
 		     id->matches[0].slot != DMI_NONE; id++)
 			if (strstr(id->ident, force_device_id))
-				if (id->callback && id->callback(id))
+				if (id->callback && !id->callback(id))
 					break;
 		if (id->matches[0].slot == DMI_NONE)
 			return -ENODEV;
Index: linux-3.18.13-rt10-r7s4/drivers/mfd/rtsx_usb.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mfd/rtsx_usb.c
+++ linux-3.18.13-rt10-r7s4/drivers/mfd/rtsx_usb.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:684 @ static void rtsx_usb_disconnect(struct u
 #ifdef CONFIG_PM
 static int rtsx_usb_suspend(struct usb_interface *intf, pm_message_t message)
 {
-	struct rtsx_ucr *ucr =
-		(struct rtsx_ucr *)usb_get_intfdata(intf);
-
 	dev_dbg(&intf->dev, "%s called with pm message 0x%04x\n",
 			__func__, message.event);
 
-	/*
-	 * Call to make sure LED is off during suspend to save more power.
-	 * It is NOT a permanent state and could be turned on anytime later.
-	 * Thus no need to call turn_on when resunming.
-	 */
-	mutex_lock(&ucr->dev_mutex);
-	rtsx_usb_turn_off_led(ucr);
-	mutex_unlock(&ucr->dev_mutex);
-
 	return 0;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/mfd/tc6393xb.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mfd/tc6393xb.c
+++ linux-3.18.13-rt10-r7s4/drivers/mfd/tc6393xb.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:266 @ static int tc6393xb_ohci_disable(struct
 	return 0;
 }
 
+static int tc6393xb_ohci_suspend(struct platform_device *dev)
+{
+	struct tc6393xb_platform_data *tcpd = dev_get_platdata(dev->dev.parent);
+
+	/* We can't properly store/restore OHCI state, so fail here */
+	if (tcpd->resume_restore)
+		return -EBUSY;
+
+	return tc6393xb_ohci_disable(dev);
+}
+
 static int tc6393xb_fb_enable(struct platform_device *dev)
 {
 	struct tc6393xb *tc6393xb = dev_get_drvdata(dev->dev.parent);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:417 @ static struct mfd_cell tc6393xb_cells[]
 		.num_resources = ARRAY_SIZE(tc6393xb_ohci_resources),
 		.resources = tc6393xb_ohci_resources,
 		.enable = tc6393xb_ohci_enable,
-		.suspend = tc6393xb_ohci_disable,
+		.suspend = tc6393xb_ohci_suspend,
 		.resume = tc6393xb_ohci_enable,
 		.disable = tc6393xb_ohci_disable,
 	},
Index: linux-3.18.13-rt10-r7s4/drivers/mfd/tps65218.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mfd/tps65218.c
+++ linux-3.18.13-rt10-r7s4/drivers/mfd/tps65218.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:128 @ int tps65218_clear_bits(struct tps65218
 }
 EXPORT_SYMBOL_GPL(tps65218_clear_bits);
 
+static const struct regmap_range tps65218_yes_ranges[] = {
+	regmap_reg_range(TPS65218_REG_INT1, TPS65218_REG_INT2),
+	regmap_reg_range(TPS65218_REG_STATUS, TPS65218_REG_STATUS),
+};
+
+static const struct regmap_access_table tps65218_volatile_table = {
+	.yes_ranges = tps65218_yes_ranges,
+	.n_yes_ranges = ARRAY_SIZE(tps65218_yes_ranges),
+};
+
 static struct regmap_config tps65218_regmap_config = {
 	.reg_bits = 8,
 	.val_bits = 8,
 	.cache_type = REGCACHE_RBTREE,
+	.volatile_table = &tps65218_volatile_table,
 };
 
 static const struct regmap_irq tps65218_irqs[] = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:207 @ static struct regmap_irq_chip tps65218_i
 
 	.num_regs = 2,
 	.mask_base = TPS65218_REG_INT_MASK1,
+	.status_base = TPS65218_REG_INT1,
 };
 
 static const struct of_device_id of_tps65218_match_table[] = {
Index: linux-3.18.13-rt10-r7s4/drivers/mfd/twl4030-power.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mfd/twl4030-power.c
+++ linux-3.18.13-rt10-r7s4/drivers/mfd/twl4030-power.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:834 @ static struct twl4030_power_data osc_off
 
 static struct of_device_id twl4030_power_of_match[] = {
 	{
+		.compatible = "ti,twl4030-power",
+	},
+	{
 		.compatible = "ti,twl4030-power-reset",
 		.data = &omap3_reset,
 	},
Index: linux-3.18.13-rt10-r7s4/drivers/misc/cxl/context.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/misc/cxl/context.c
+++ linux-3.18.13-rt10-r7s4/drivers/misc/cxl/context.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:37 @ struct cxl_context *cxl_context_alloc(vo
 /*
  * Initialises a CXL context.
  */
-int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master)
+int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master,
+		     struct address_space *mapping)
 {
 	int i;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:46 @ int cxl_context_init(struct cxl_context
 	ctx->afu = afu;
 	ctx->master = master;
 	ctx->pid = NULL; /* Set in start work ioctl */
+	mutex_init(&ctx->mapping_lock);
+	ctx->mapping = mapping;
 
 	/*
 	 * Allocate the segment table before we put it in the IDR so that we
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:88 @ int cxl_context_init(struct cxl_context
 	 * Allocating IDR! We better make sure everything's setup that
 	 * dereferences from it.
 	 */
+	mutex_lock(&afu->contexts_lock);
 	idr_preload(GFP_KERNEL);
-	spin_lock(&afu->contexts_lock);
 	i = idr_alloc(&ctx->afu->contexts_idr, ctx, 0,
 		      ctx->afu->num_procs, GFP_NOWAIT);
-	spin_unlock(&afu->contexts_lock);
 	idr_preload_end();
+	mutex_unlock(&afu->contexts_lock);
 	if (i < 0)
 		return i;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:153 @ static void __detach_context(struct cxl_
 	afu_release_irqs(ctx);
 	flush_work(&ctx->fault_work); /* Only needed for dedicated process */
 	wake_up_all(&ctx->wq);
+
+	/* Release Problem State Area mapping */
+	mutex_lock(&ctx->mapping_lock);
+	if (ctx->mapping)
+		unmap_mapping_range(ctx->mapping, 0, 0, 1);
+	mutex_unlock(&ctx->mapping_lock);
 }
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:180 @ void cxl_context_detach_all(struct cxl_a
 	struct cxl_context *ctx;
 	int tmp;
 
-	rcu_read_lock();
-	idr_for_each_entry(&afu->contexts_idr, ctx, tmp)
+	mutex_lock(&afu->contexts_lock);
+	idr_for_each_entry(&afu->contexts_idr, ctx, tmp) {
 		/*
 		 * Anything done in here needs to be setup before the IDR is
 		 * created and torn down after the IDR removed
 		 */
 		__detach_context(ctx);
-	rcu_read_unlock();
+	}
+	mutex_unlock(&afu->contexts_lock);
 }
 
 void cxl_context_free(struct cxl_context *ctx)
 {
-	spin_lock(&ctx->afu->contexts_lock);
+	mutex_lock(&ctx->afu->contexts_lock);
 	idr_remove(&ctx->afu->contexts_idr, ctx->pe);
-	spin_unlock(&ctx->afu->contexts_lock);
+	mutex_unlock(&ctx->afu->contexts_lock);
 	synchronize_rcu();
 
 	free_page((u64)ctx->sstp);
Index: linux-3.18.13-rt10-r7s4/drivers/misc/cxl/cxl.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/misc/cxl/cxl.h
+++ linux-3.18.13-rt10-r7s4/drivers/misc/cxl/cxl.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:352 @ struct cxl_afu {
 	struct device *chardev_s, *chardev_m, *chardev_d;
 	struct idr contexts_idr;
 	struct dentry *debugfs;
-	spinlock_t contexts_lock;
+	struct mutex contexts_lock;
 	struct mutex spa_mutex;
 	spinlock_t afu_cntl_lock;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:393 @ struct cxl_context {
 	phys_addr_t psn_phys;
 	u64 psn_size;
 
+	/* Used to unmap any mmaps when force detaching */
+	struct address_space *mapping;
+	struct mutex mapping_lock;
+
 	spinlock_t sste_lock; /* Protects segment table entries */
 	struct cxl_sste *sstp;
 	u64 sstp0, sstp1;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:474 @ void cxl_release_one_irq(struct cxl *ada
 int cxl_alloc_irq_ranges(struct cxl_irq_ranges *irqs, struct cxl *adapter, unsigned int num);
 void cxl_release_irq_ranges(struct cxl_irq_ranges *irqs, struct cxl *adapter);
 int cxl_setup_irq(struct cxl *adapter, unsigned int hwirq, unsigned int virq);
+int cxl_update_image_control(struct cxl *adapter);
 
 /* common == phyp + powernv */
 struct cxl_process_element_common {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:600 @ int cxl_alloc_sst(struct cxl_context *ct
 void init_cxl_native(void);
 
 struct cxl_context *cxl_context_alloc(void);
-int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master);
+int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master,
+		     struct address_space *mapping);
 void cxl_context_free(struct cxl_context *ctx);
 int cxl_context_iomap(struct cxl_context *ctx, struct vm_area_struct *vma);
 
Index: linux-3.18.13-rt10-r7s4/drivers/misc/cxl/file.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/misc/cxl/file.c
+++ linux-3.18.13-rt10-r7s4/drivers/misc/cxl/file.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:80 @ static int __afu_open(struct inode *inod
 		goto err_put_afu;
 	}
 
-	if ((rc = cxl_context_init(ctx, afu, master)))
+	if ((rc = cxl_context_init(ctx, afu, master, inode->i_mapping)))
 		goto err_put_afu;
 
 	pr_devel("afu_open pe: %i\n", ctx->pe);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:116 @ static int afu_release(struct inode *ino
 		 __func__, ctx->pe);
 	cxl_context_detach(ctx);
 
+	mutex_lock(&ctx->mapping_lock);
+	ctx->mapping = NULL;
+	mutex_unlock(&ctx->mapping_lock);
+
 	put_device(&ctx->afu->dev);
 
 	/*
Index: linux-3.18.13-rt10-r7s4/drivers/misc/cxl/irq.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/misc/cxl/irq.c
+++ linux-3.18.13-rt10-r7s4/drivers/misc/cxl/irq.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:177 @ static irqreturn_t cxl_irq(int irq, void
 		}
 
 		cxl_ack_irq(ctx, CXL_PSL_TFC_An_A, 0);
+		return IRQ_HANDLED;
 	}
 	if (dsisr & CXL_PSL_DSISR_An_OC)
 		pr_devel("CXL interrupt: OS Context Warning\n");
Index: linux-3.18.13-rt10-r7s4/drivers/misc/cxl/native.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/misc/cxl/native.c
+++ linux-3.18.13-rt10-r7s4/drivers/misc/cxl/native.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:280 @ static int do_process_element_cmd(struct
 				  u64 cmd, u64 pe_state)
 {
 	u64 state;
+	unsigned long timeout = jiffies + (HZ * CXL_TIMEOUT);
 
 	WARN_ON(!ctx->afu->enabled);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:290 @ static int do_process_element_cmd(struct
 	smp_mb();
 	cxl_p1n_write(ctx->afu, CXL_PSL_LLCMD_An, cmd | ctx->pe);
 	while (1) {
+		if (time_after_eq(jiffies, timeout)) {
+			dev_warn(&ctx->afu->dev, "WARNING: Process Element Command timed out!\n");
+			return -EBUSY;
+		}
 		state = be64_to_cpup(ctx->afu->sw_command_status);
 		if (state == ~0ULL) {
 			pr_err("cxl: Error adding process element to AFU\n");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:618 @ static inline int detach_process_native_
 	return 0;
 }
 
-/*
- * TODO: handle case when this is called inside a rcu_read_lock() which may
- * happen when we unbind the driver (ie. cxl_context_detach_all()) .  Terminate
- * & remove use a mutex lock and schedule which will not good with lock held.
- * May need to write do_process_element_cmd() that handles outstanding page
- * faults synchronously.
- */
 static inline int detach_process_native_afu_directed(struct cxl_context *ctx)
 {
 	if (!ctx->pe_inserted)
Index: linux-3.18.13-rt10-r7s4/drivers/misc/cxl/pci.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/misc/cxl/pci.c
+++ linux-3.18.13-rt10-r7s4/drivers/misc/cxl/pci.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:319 @ static int init_implementation_adapter_r
 	u64 psl_dsnctl;
 	u64 chipid;
 
-	if (!(np = pnv_pci_to_phb_node(dev)))
+	if (!(np = pnv_pci_get_phb_node(dev)))
 		return -ENODEV;
 
 	while (np && !(prop = of_get_property(np, "ibm,chip-id", NULL)))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:364 @ int cxl_setup_irq(struct cxl *adapter, u
 	return pnv_cxl_ioda_msi_setup(dev, hwirq, virq);
 }
 
+int cxl_update_image_control(struct cxl *adapter)
+{
+	struct pci_dev *dev = to_pci_dev(adapter->dev.parent);
+	int rc;
+	int vsec;
+	u8 image_state;
+
+	if (!(vsec = find_cxl_vsec(dev))) {
+		dev_err(&dev->dev, "ABORTING: CXL VSEC not found!\n");
+		return -ENODEV;
+	}
+
+	if ((rc = CXL_READ_VSEC_IMAGE_STATE(dev, vsec, &image_state))) {
+		dev_err(&dev->dev, "failed to read image state: %i\n", rc);
+		return rc;
+	}
+
+	if (adapter->perst_loads_image)
+		image_state |= CXL_VSEC_PERST_LOADS_IMAGE;
+	else
+		image_state &= ~CXL_VSEC_PERST_LOADS_IMAGE;
+
+	if (adapter->perst_select_user)
+		image_state |= CXL_VSEC_PERST_SELECT_USER;
+	else
+		image_state &= ~CXL_VSEC_PERST_SELECT_USER;
+
+	if ((rc = CXL_WRITE_VSEC_IMAGE_STATE(dev, vsec, image_state))) {
+		dev_err(&dev->dev, "failed to update image control: %i\n", rc);
+		return rc;
+	}
+
+	return 0;
+}
+
 int cxl_alloc_one_irq(struct cxl *adapter)
 {
 	struct pci_dev *dev = to_pci_dev(adapter->dev.parent);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:540 @ static struct cxl_afu *cxl_alloc_afu(str
 	afu->dev.release = cxl_release_afu;
 	afu->slice = slice;
 	idr_init(&afu->contexts_idr);
-	spin_lock_init(&afu->contexts_lock);
+	mutex_init(&afu->contexts_lock);
 	spin_lock_init(&afu->afu_cntl_lock);
 	mutex_init(&afu->spa_mutex);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:808 @ static int cxl_read_vsec(struct cxl *ada
 	CXL_READ_VSEC_BASE_IMAGE(dev, vsec, &adapter->base_image);
 	CXL_READ_VSEC_IMAGE_STATE(dev, vsec, &image_state);
 	adapter->user_image_loaded = !!(image_state & CXL_VSEC_USER_IMAGE_LOADED);
-	adapter->perst_loads_image = !!(image_state & CXL_VSEC_PERST_LOADS_IMAGE);
-	adapter->perst_select_user = !!(image_state & CXL_VSEC_PERST_SELECT_USER);
+	adapter->perst_loads_image = true;
+	adapter->perst_select_user = !!(image_state & CXL_VSEC_USER_IMAGE_LOADED);
 
 	CXL_READ_VSEC_NAFUS(dev, vsec, &adapter->slices);
 	CXL_READ_VSEC_AFU_DESC_OFF(dev, vsec, &afu_desc_off);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:917 @ static struct cxl *cxl_init_adapter(stru
 	if ((rc = cxl_vsec_looks_ok(adapter, dev)))
 		goto err2;
 
+	if ((rc = cxl_update_image_control(adapter)))
+		goto err2;
+
 	if ((rc = cxl_map_adapter_regs(adapter, dev)))
 		goto err2;
 
Index: linux-3.18.13-rt10-r7s4/drivers/misc/cxl/sysfs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/misc/cxl/sysfs.c
+++ linux-3.18.13-rt10-r7s4/drivers/misc/cxl/sysfs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:124 @ static ssize_t reset_store_afu(struct de
 	int rc;
 
 	/* Not safe to reset if it is currently in use */
-	spin_lock(&afu->contexts_lock);
+	mutex_lock(&afu->contexts_lock);
 	if (!idr_is_empty(&afu->contexts_idr)) {
 		rc = -EBUSY;
 		goto err;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:135 @ static ssize_t reset_store_afu(struct de
 
 	rc = count;
 err:
-	spin_unlock(&afu->contexts_lock);
+	mutex_unlock(&afu->contexts_lock);
 	return rc;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:250 @ static ssize_t mode_store(struct device
 	int rc = -EBUSY;
 
 	/* can't change this if we have a user */
-	spin_lock(&afu->contexts_lock);
+	mutex_lock(&afu->contexts_lock);
 	if (!idr_is_empty(&afu->contexts_idr))
 		goto err;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:274 @ static ssize_t mode_store(struct device
 	afu->current_mode = 0;
 	afu->num_procs = 0;
 
-	spin_unlock(&afu->contexts_lock);
+	mutex_unlock(&afu->contexts_lock);
 
 	if ((rc = _cxl_afu_deactivate_mode(afu, old_mode)))
 		return rc;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:283 @ static ssize_t mode_store(struct device
 
 	return count;
 err:
-	spin_unlock(&afu->contexts_lock);
+	mutex_unlock(&afu->contexts_lock);
 	return rc;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/misc/genwqe/card_utils.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/misc/genwqe/card_utils.c
+++ linux-3.18.13-rt10-r7s4/drivers/misc/genwqe/card_utils.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:593 @ int genwqe_user_vmap(struct genwqe_dev *
 				 m->nr_pages,
 				 1,		/* write by caller */
 				 m->page_list);	/* ptrs to pages */
+	if (rc < 0)
+		goto fail_get_user_pages;
 
 	/* assumption: get_user_pages can be killed by signals. */
 	if (rc < m->nr_pages) {
Index: linux-3.18.13-rt10-r7s4/drivers/misc/mei/hw-me.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/misc/mei/hw-me.c
+++ linux-3.18.13-rt10-r7s4/drivers/misc/mei/hw-me.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:237 @ static int mei_me_hw_reset(struct mei_de
 	struct mei_me_hw *hw = to_me_hw(dev);
 	u32 hcsr = mei_hcsr_read(hw);
 
+	/* H_RST may be found lit before reset is started,
+	 * for example if preceding reset flow hasn't completed.
+	 * In that case asserting H_RST will be ignored, therefore
+	 * we need to clean H_RST bit to start a successful reset sequence.
+	 */
+	if ((hcsr & H_RST) == H_RST) {
+		dev_warn(dev->dev, "H_RST is set = 0x%08X", hcsr);
+		hcsr &= ~H_RST;
+		mei_hcsr_set(hw, hcsr);
+		hcsr = mei_hcsr_read(hw);
+	}
+
 	hcsr |= H_RST | H_IG | H_IS;
 
 	if (intr_enable)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:338 @ static int mei_me_hw_ready_wait(struct m
 		return -ETIME;
 	}
 
+	mei_me_hw_reset_release(dev);
 	dev->recvd_hw_ready = false;
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:733 @ irqreturn_t mei_me_irq_thread_handler(in
 	/*  check if we need to start the dev */
 	if (!mei_host_is_ready(dev)) {
 		if (mei_hw_is_ready(dev)) {
-			mei_me_hw_reset_release(dev);
 			dev_dbg(dev->dev, "we need to start the dev.\n");
-
 			dev->recvd_hw_ready = true;
 			wake_up(&dev->wait_hw_ready);
 		} else {
Index: linux-3.18.13-rt10-r7s4/drivers/misc/mei/init.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/misc/mei/init.c
+++ linux-3.18.13-rt10-r7s4/drivers/misc/mei/init.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:316 @ void mei_stop(struct mei_device *dev)
 
 	dev->dev_state = MEI_DEV_POWER_DOWN;
 	mei_reset(dev);
+	/* move device to disabled state unconditionally */
+	dev->dev_state = MEI_DEV_DISABLED;
 
 	mutex_unlock(&dev->device_lock);
 
Index: linux-3.18.13-rt10-r7s4/drivers/mmc/card/block.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mmc/card/block.c
+++ linux-3.18.13-rt10-r7s4/drivers/mmc/card/block.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:263 @ static ssize_t force_ro_show(struct devi
 	int ret;
 	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
 
-	ret = snprintf(buf, PAGE_SIZE, "%d",
+	ret = snprintf(buf, PAGE_SIZE, "%d\n",
 		       get_disk_ro(dev_to_disk(dev)) ^
 		       md->read_only);
 	mmc_blk_put(md);
Index: linux-3.18.13-rt10-r7s4/drivers/mmc/host/dw_mmc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mmc/host/dw_mmc.c
+++ linux-3.18.13-rt10-r7s4/drivers/mmc/host/dw_mmc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:629 @ static void dw_mci_ctrl_rd_thld(struct d
 
 	WARN_ON(!(data->flags & MMC_DATA_READ));
 
+	/*
+	 * CDTHRCTL doesn't exist prior to 240A (in fact that register offset is
+	 * in the FIFO region, so we really shouldn't access it).
+	 */
+	if (host->verid < DW_MMC_240A)
+		return;
+
 	if (host->timing != MMC_TIMING_MMC_HS200 &&
 	    host->timing != MMC_TIMING_UHS_SDR104)
 		goto disable;
Index: linux-3.18.13-rt10-r7s4/drivers/mmc/host/omap_hsmmc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mmc/host/omap_hsmmc.c
+++ linux-3.18.13-rt10-r7s4/drivers/mmc/host/omap_hsmmc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:612 @ static void omap_hsmmc_set_clock(struct
 	 */
 	if ((mmc_slot(host).features & HSMMC_HAS_HSPE_SUPPORT) &&
 	    (ios->timing != MMC_TIMING_MMC_DDR52) &&
+	    (ios->timing != MMC_TIMING_UHS_DDR50) &&
 	    ((OMAP_HSMMC_READ(host->base, CAPA) & HSS) == HSS)) {
 		regval = OMAP_HSMMC_READ(host->base, HCTL);
 		if (clkdiv && (clk_get_rate(host->fclk)/clkdiv) > 25000000)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:632 @ static void omap_hsmmc_set_bus_width(str
 	u32 con;
 
 	con = OMAP_HSMMC_READ(host->base, CON);
-	if (ios->timing == MMC_TIMING_MMC_DDR52)
+	if (ios->timing == MMC_TIMING_MMC_DDR52 ||
+	    ios->timing == MMC_TIMING_UHS_DDR50)
 		con |= DDR;	/* configure in DDR mode */
 	else
 		con &= ~DDR;
Index: linux-3.18.13-rt10-r7s4/drivers/mmc/host/sdhci-pci-o2micro.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mmc/host/sdhci-pci-o2micro.c
+++ linux-3.18.13-rt10-r7s4/drivers/mmc/host/sdhci-pci-o2micro.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:130 @ void sdhci_pci_o2_fujin2_pci_init(struct
 		return;
 	scratch_32 &= ~((1 << 21) | (1 << 30));
 
-	/* Set RTD3 function disabled */
-	scratch_32 |= ((1 << 29) | (1 << 28));
 	pci_write_config_dword(chip->pdev, O2_SD_FUNC_REG3, scratch_32);
 
 	/* Set L1 Entrance Timer */
Index: linux-3.18.13-rt10-r7s4/drivers/mmc/host/sdhci-pxav3.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mmc/host/sdhci-pxav3.c
+++ linux-3.18.13-rt10-r7s4/drivers/mmc/host/sdhci-pxav3.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:115 @ static int mv_conf_mbus_windows(struct p
 	return 0;
 }
 
+static int armada_38x_quirks(struct platform_device *pdev,
+			     struct sdhci_host *host)
+{
+	struct device_node *np = pdev->dev.of_node;
+
+	host->quirks |= SDHCI_QUIRK_MISSING_CAPS;
+	/*
+	 * According to erratum 'FE-2946959' both SDR50 and DDR50
+	 * modes require specific clock adjustments in SDIO3
+	 * Configuration register, if the adjustment is not done,
+	 * remove them from the capabilities.
+	 */
+	host->caps1 = sdhci_readl(host, SDHCI_CAPABILITIES_1);
+	host->caps1 &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_DDR50);
+
+	/*
+	 * According to erratum 'ERR-7878951' Armada 38x SDHCI
+	 * controller has different capabilities than the ones shown
+	 * in its registers
+	 */
+	host->caps = sdhci_readl(host, SDHCI_CAPABILITIES);
+	if (of_property_read_bool(np, "no-1-8-v")) {
+		host->caps &= ~SDHCI_CAN_VDD_180;
+		host->mmc->caps &= ~MMC_CAP_1_8V_DDR;
+	} else {
+		host->caps &= ~SDHCI_CAN_VDD_330;
+	}
+	host->caps1 &= ~(SDHCI_SUPPORT_SDR104 | SDHCI_USE_SDR50_TUNING);
+
+	return 0;
+}
+
 static void pxav3_reset(struct sdhci_host *host, u8 mask)
 {
 	struct platform_device *pdev = to_platform_device(mmc_dev(host->mmc));
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:296 @ static struct sdhci_pxa_platdata *pxav3_
 	if (!pdata)
 		return NULL;
 
-	of_property_read_u32(np, "mrvl,clk-delay-cycles", &clk_delay_cycles);
-	if (clk_delay_cycles > 0)
+	if (!of_property_read_u32(np, "mrvl,clk-delay-cycles",
+				  &clk_delay_cycles))
 		pdata->clk_delay_cycles = clk_delay_cycles;
 
 	return pdata;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:330 @ static int sdhci_pxav3_probe(struct plat
 	if (IS_ERR(host))
 		return PTR_ERR(host);
 
+	/* enable 1/8V DDR capable */
+	host->mmc->caps |= MMC_CAP_1_8V_DDR;
+
 	if (of_device_is_compatible(np, "marvell,armada-380-sdhci")) {
+		ret = armada_38x_quirks(pdev, host);
+		if (ret < 0)
+			goto err_clk_get;
 		ret = mv_conf_mbus_windows(pdev, mv_mbus_dram_info());
 		if (ret < 0)
 			goto err_mbus_win;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:355 @ static int sdhci_pxav3_probe(struct plat
 	pltfm_host->clk = clk;
 	clk_prepare_enable(clk);
 
-	/* enable 1/8V DDR capable */
-	host->mmc->caps |= MMC_CAP_1_8V_DDR;
-
 	match = of_match_device(of_match_ptr(sdhci_pxav3_of_match), &pdev->dev);
 	if (match) {
 		ret = mmc_of_parse(host->mmc);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:393 @ static int sdhci_pxav3_probe(struct plat
 		}
 	}
 
-	pm_runtime_enable(&pdev->dev);
-	pm_runtime_get_sync(&pdev->dev);
+	pm_runtime_get_noresume(&pdev->dev);
+	pm_runtime_set_active(&pdev->dev);
 	pm_runtime_set_autosuspend_delay(&pdev->dev, PXAV3_RPM_DELAY_MS);
 	pm_runtime_use_autosuspend(&pdev->dev);
+	pm_runtime_enable(&pdev->dev);
 	pm_suspend_ignore_children(&pdev->dev, 1);
 
 	ret = sdhci_add_host(host);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:420 @ static int sdhci_pxav3_probe(struct plat
 	return 0;
 
 err_add_host:
-	pm_runtime_put_sync(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
+	pm_runtime_put_noidle(&pdev->dev);
 err_of_parse:
 err_cd_req:
 	clk_disable_unprepare(clk);
Index: linux-3.18.13-rt10-r7s4/drivers/mmc/host/sdhci.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mmc/host/sdhci.c
+++ linux-3.18.13-rt10-r7s4/drivers/mmc/host/sdhci.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1242 @ static void sdhci_set_power(struct sdhci
 		spin_unlock_irq(&host->lock);
 		mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
 		spin_lock_irq(&host->lock);
+
+		if (mode != MMC_POWER_OFF)
+			sdhci_writeb(host, SDHCI_POWER_ON, SDHCI_POWER_CONTROL);
+		else
+			sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
+
 		return;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1328 @ static void sdhci_request(struct mmc_hos
 
 	sdhci_runtime_pm_get(host);
 
+	present = mmc_gpio_get_cd(host->mmc);
+
 	spin_lock_irqsave(&host->lock, flags);
 
 	WARN_ON(host->mrq != NULL);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1358 @ static void sdhci_request(struct mmc_hos
 	 *     zero: cd-gpio is used, and card is removed
 	 *     one: cd-gpio is used, and card is present
 	 */
-	present = mmc_gpio_get_cd(host->mmc);
 	if (present < 0) {
 		/* If polling, assume that the card is always present. */
 		if (host->quirks & SDHCI_QUIRK_BROKEN_CARD_DETECTION)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2082 @ static void sdhci_card_event(struct mmc_
 {
 	struct sdhci_host *host = mmc_priv(mmc);
 	unsigned long flags;
+	int present;
 
 	/* First check if client has provided their own card event */
 	if (host->ops->card_event)
 		host->ops->card_event(host);
 
+	present = sdhci_do_get_cd(host);
+
 	spin_lock_irqsave(&host->lock, flags);
 
 	/* Check host->mrq first in case we are runtime suspended */
-	if (host->mrq && !sdhci_do_get_cd(host)) {
+	if (host->mrq && !present) {
 		pr_err("%s: Card removed during transfer!\n",
 			mmc_hostname(host->mmc));
 		pr_err("%s: Resetting controller.\n",
Index: linux-3.18.13-rt10-r7s4/drivers/mtd/devices/m25p80.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mtd/devices/m25p80.c
+++ linux-3.18.13-rt10-r7s4/drivers/mtd/devices/m25p80.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:303 @ static const struct spi_device_id m25p_i
 	{"m45pe10"},	{"m45pe80"},	{"m45pe16"},
 	{"m25pe20"},	{"m25pe80"},	{"m25pe16"},
 	{"m25px16"},	{"m25px32"},	{"m25px32-s0"},	{"m25px32-s1"},
-	{"m25px64"},
+	{"m25px64"},	{"m25px80"},
 	{"w25x10"},	{"w25x20"},	{"w25x40"},	{"w25x80"},
 	{"w25x16"},	{"w25x32"},	{"w25q32"},	{"w25q32dw"},
-	{"w25x64"},	{"w25q64"},	{"w25q128"},	{"w25q80"},
-	{"w25q80bl"},	{"w25q128"},	{"w25q256"},	{"cat25c11"},
+	{"w25x64"},	{"w25q64"},	{"w25q80"},	{"w25q80bl"},
+	{"w25q128"},	{"w25q256"},	{"cat25c11"},
 	{"cat25c03"},	{"cat25c09"},	{"cat25c17"},	{"cat25128"},
 	{ },
 };
Index: linux-3.18.13-rt10-r7s4/drivers/mtd/nand/omap2.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mtd/nand/omap2.c
+++ linux-3.18.13-rt10-r7s4/drivers/mtd/nand/omap2.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1744 @ static int omap_nand_probe(struct platfo
 		goto return_error;
 	}
 
-	/* check for small page devices */
-	if ((mtd->oobsize < 64) && (pdata->ecc_opt != OMAP_ECC_HAM1_CODE_HW)) {
-		dev_err(&info->pdev->dev, "small page devices are not supported\n");
-		err = -EINVAL;
-		goto return_error;
-	}
-
 	/* re-populate low-level callbacks based on xfer modes */
 	switch (pdata->xfer_type) {
 	case NAND_OMAP_PREFETCH_POLLED:
Index: linux-3.18.13-rt10-r7s4/drivers/mtd/nand/pxa3xx_nand.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mtd/nand/pxa3xx_nand.c
+++ linux-3.18.13-rt10-r7s4/drivers/mtd/nand/pxa3xx_nand.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:483 @ static void disable_int(struct pxa3xx_na
 	nand_writel(info, NDCR, ndcr | int_mask);
 }
 
+static void drain_fifo(struct pxa3xx_nand_info *info, void *data, int len)
+{
+	if (info->ecc_bch) {
+		int timeout;
+
+		/*
+		 * According to the datasheet, when reading from NDDB
+		 * with BCH enabled, after each 32 bytes reads, we
+		 * have to make sure that the NDSR.RDDREQ bit is set.
+		 *
+		 * Drain the FIFO 8 32 bits reads at a time, and skip
+		 * the polling on the last read.
+		 */
+		while (len > 8) {
+			__raw_readsl(info->mmio_base + NDDB, data, 8);
+
+			for (timeout = 0;
+			     !(nand_readl(info, NDSR) & NDSR_RDDREQ);
+			     timeout++) {
+				if (timeout >= 5) {
+					dev_err(&info->pdev->dev,
+						"Timeout on RDDREQ while draining the FIFO\n");
+					return;
+				}
+
+				mdelay(1);
+			}
+
+			data += 32;
+			len -= 8;
+		}
+	}
+
+	__raw_readsl(info->mmio_base + NDDB, data, len);
+}
+
 static void handle_data_pio(struct pxa3xx_nand_info *info)
 {
 	unsigned int do_bytes = min(info->data_size, info->chunk_size);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:535 @ static void handle_data_pio(struct pxa3x
 				      DIV_ROUND_UP(info->oob_size, 4));
 		break;
 	case STATE_PIO_READING:
-		__raw_readsl(info->mmio_base + NDDB,
-			     info->data_buff + info->data_buff_pos,
-			     DIV_ROUND_UP(do_bytes, 4));
+		drain_fifo(info,
+			   info->data_buff + info->data_buff_pos,
+			   DIV_ROUND_UP(do_bytes, 4));
 
 		if (info->oob_size > 0)
-			__raw_readsl(info->mmio_base + NDDB,
-				     info->oob_buff + info->oob_buff_pos,
-				     DIV_ROUND_UP(info->oob_size, 4));
+			drain_fifo(info,
+				   info->oob_buff + info->oob_buff_pos,
+				   DIV_ROUND_UP(info->oob_size, 4));
 		break;
 	default:
 		dev_err(&info->pdev->dev, "%s: invalid state %d\n", __func__,
Index: linux-3.18.13-rt10-r7s4/drivers/mtd/tests/torturetest.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mtd/tests/torturetest.c
+++ linux-3.18.13-rt10-r7s4/drivers/mtd/tests/torturetest.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:267 @ static int __init tort_init(void)
 		int i;
 		void *patt;
 
-		mtdtest_erase_good_eraseblocks(mtd, bad_ebs, eb, ebcnt);
+		err = mtdtest_erase_good_eraseblocks(mtd, bad_ebs, eb, ebcnt);
+		if (err)
+			goto out;
 
 		/* Check if the eraseblocks contain only 0xFF bytes */
 		if (check) {
Index: linux-3.18.13-rt10-r7s4/drivers/mtd/ubi/upd.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mtd/ubi/upd.c
+++ linux-3.18.13-rt10-r7s4/drivers/mtd/ubi/upd.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:136 @ int ubi_start_update(struct ubi_device *
 	ubi_assert(!vol->updating && !vol->changing_leb);
 	vol->updating = 1;
 
+	vol->upd_buf = vmalloc(ubi->leb_size);
+	if (!vol->upd_buf)
+		return -ENOMEM;
+
 	err = set_update_marker(ubi, vol);
 	if (err)
 		return err;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:159 @ int ubi_start_update(struct ubi_device *
 		err = clear_update_marker(ubi, vol, 0);
 		if (err)
 			return err;
+
+		vfree(vol->upd_buf);
 		vol->updating = 0;
 		return 0;
 	}
 
-	vol->upd_buf = vmalloc(ubi->leb_size);
-	if (!vol->upd_buf)
-		return -ENOMEM;
-
 	vol->upd_ebs = div_u64(bytes + vol->usable_leb_size - 1,
 			       vol->usable_leb_size);
 	vol->upd_bytes = bytes;
Index: linux-3.18.13-rt10-r7s4/drivers/mtd/ubi/wl.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/mtd/ubi/wl.c
+++ linux-3.18.13-rt10-r7s4/drivers/mtd/ubi/wl.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1215 @ static int wear_leveling_worker(struct u
 
 	err = do_sync_erase(ubi, e1, vol_id, lnum, 0);
 	if (err) {
-		kmem_cache_free(ubi_wl_entry_slab, e1);
 		if (e2)
 			kmem_cache_free(ubi_wl_entry_slab, e2);
 		goto out_ro;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1228 @ static int wear_leveling_worker(struct u
 		dbg_wl("PEB %d (LEB %d:%d) was put meanwhile, erase",
 		       e2->pnum, vol_id, lnum);
 		err = do_sync_erase(ubi, e2, vol_id, lnum, 0);
-		if (err) {
-			kmem_cache_free(ubi_wl_entry_slab, e2);
+		if (err)
 			goto out_ro;
-		}
 	}
 
 	dbg_wl("done");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1265 @ out_not_moved:
 
 	ubi_free_vid_hdr(ubi, vid_hdr);
 	err = do_sync_erase(ubi, e2, vol_id, lnum, torture);
-	if (err) {
-		kmem_cache_free(ubi_wl_entry_slab, e2);
+	if (err)
 		goto out_ro;
-	}
+
 	mutex_unlock(&ubi->move_mutex);
 	return 0;
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/bonding/bond_alb.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/bonding/bond_alb.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/bonding/bond_alb.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:478 @ static void rlb_update_client(struct rlb
 		skb->dev = client_info->slave->dev;
 
 		if (client_info->vlan_id) {
-			skb = vlan_put_tag(skb, htons(ETH_P_8021Q), client_info->vlan_id);
-			if (!skb) {
-				netdev_err(client_info->slave->bond->dev,
-					   "failed to insert VLAN tag\n");
-				continue;
-			}
+			__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q),
+					       client_info->vlan_id);
 		}
 
 		arp_xmit(skb);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:950 @ static void alb_send_lp_vid(struct slave
 	skb->priority = TC_PRIO_CONTROL;
 	skb->dev = slave->dev;
 
-	if (vid) {
-		skb = vlan_put_tag(skb, vlan_proto, vid);
-		if (!skb) {
-			netdev_err(slave->bond->dev, "failed to insert VLAN tag\n");
-			return;
-		}
-	}
+	if (vid)
+		__vlan_hwaccel_put_tag(skb, vlan_proto, vid);
 
 	dev_queue_xmit(skb);
 }
Index: linux-3.18.13-rt10-r7s4/drivers/net/bonding/bond_main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/bonding/bond_main.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/bonding/bond_main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2146 @ static void bond_arp_send(struct net_dev
 
 		netdev_dbg(slave_dev, "inner tag: proto %X vid %X\n",
 			   ntohs(outer_tag->vlan_proto), tags->vlan_id);
-		skb = __vlan_put_tag(skb, tags->vlan_proto,
-				     tags->vlan_id);
+		skb = vlan_insert_tag_set_proto(skb, tags->vlan_proto,
+						tags->vlan_id);
 		if (!skb) {
 			net_err_ratelimited("failed to insert inner VLAN tag\n");
 			return;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2159 @ static void bond_arp_send(struct net_dev
 	if (outer_tag->vlan_id) {
 		netdev_dbg(slave_dev, "outer tag: proto %X vid %X\n",
 			   ntohs(outer_tag->vlan_proto), outer_tag->vlan_id);
-		skb = vlan_put_tag(skb, outer_tag->vlan_proto,
-				   outer_tag->vlan_id);
-		if (!skb) {
-			net_err_ratelimited("failed to insert outer VLAN tag\n");
-			return;
-		}
+		__vlan_hwaccel_put_tag(skb, outer_tag->vlan_proto,
+				       outer_tag->vlan_id);
 	}
 
 xmit:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3798 @ static inline int bond_slave_override(st
 	/* Find out if any slaves have the same mapping as this skb. */
 	bond_for_each_slave_rcu(bond, slave, iter) {
 		if (slave->queue_id == skb->queue_mapping) {
-			if (bond_slave_can_tx(slave)) {
+			if (bond_slave_is_up(slave) &&
+			    slave->link == BOND_LINK_UP) {
 				bond_dev_queue_xmit(bond, skb, slave->dev);
 				return 0;
 			}
Index: linux-3.18.13-rt10-r7s4/drivers/net/can/c_can/c_can.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/can/c_can/c_can.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/can/c_can/c_can.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:614 @ static void c_can_stop(struct net_device
 	struct c_can_priv *priv = netdev_priv(dev);
 
 	c_can_irq_control(priv, false);
+
+	/* put ctrl to init on stop to end ongoing transmission */
+	priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_INIT);
+
 	priv->can.state = CAN_STATE_STOPPED;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/can/dev.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/can/dev.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/can/dev.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:503 @ struct sk_buff *alloc_can_skb(struct net
 	skb->pkt_type = PACKET_BROADCAST;
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
 
+	skb_reset_mac_header(skb);
+	skb_reset_network_header(skb);
+	skb_reset_transport_header(skb);
+
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:531 @ struct sk_buff *alloc_canfd_skb(struct n
 	skb->pkt_type = PACKET_BROADCAST;
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
 
+	skb_reset_mac_header(skb);
+	skb_reset_network_header(skb);
+	skb_reset_transport_header(skb);
+
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:740 @ static int can_changelink(struct net_dev
 		if (dev->flags & IFF_UP)
 			return -EBUSY;
 		cm = nla_data(data[IFLA_CAN_CTRLMODE]);
-		if (cm->flags & ~priv->ctrlmode_supported)
+
+		/* check whether changed bits are allowed to be modified */
+		if (cm->mask & ~priv->ctrlmode_supported)
 			return -EOPNOTSUPP;
+
+		/* clear bits to be modified and copy the flag values */
 		priv->ctrlmode &= ~cm->mask;
-		priv->ctrlmode |= cm->flags;
+		priv->ctrlmode |= (cm->flags & cm->mask);
 
 		/* CAN_CTRLMODE_FD can only be set when driver supports FD */
 		if (priv->ctrlmode & CAN_CTRLMODE_FD)
Index: linux-3.18.13-rt10-r7s4/drivers/net/can/flexcan.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/can/flexcan.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/can/flexcan.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1227 @ static int flexcan_probe(struct platform
 	const struct flexcan_devtype_data *devtype_data;
 	struct net_device *dev;
 	struct flexcan_priv *priv;
+	struct regulator *reg_xceiver;
 	struct resource *mem;
 	struct clk *clk_ipg = NULL, *clk_per = NULL;
 	void __iomem *base;
 	int err, irq;
 	u32 clock_freq = 0;
 
+	reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver");
+	if (PTR_ERR(reg_xceiver) == -EPROBE_DEFER)
+		return -EPROBE_DEFER;
+	else if (IS_ERR(reg_xceiver))
+		reg_xceiver = NULL;
+
 	if (pdev->dev.of_node)
 		of_property_read_u32(pdev->dev.of_node,
 						"clock-frequency", &clock_freq);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1301 @ static int flexcan_probe(struct platform
 	priv->pdata = dev_get_platdata(&pdev->dev);
 	priv->devtype_data = devtype_data;
 
-	priv->reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver");
-	if (IS_ERR(priv->reg_xceiver))
-		priv->reg_xceiver = NULL;
+	priv->reg_xceiver = reg_xceiver;
 
 	netif_napi_add(dev, &priv->napi, flexcan_poll, FLEXCAN_NAPI_WEIGHT);
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/can/m_can/m_can.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/can/m_can/m_can.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/can/m_can/m_can.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:958 @ static struct net_device *alloc_m_can_de
 	priv->can.data_bittiming_const = &m_can_data_bittiming_const;
 	priv->can.do_set_mode = m_can_set_mode;
 	priv->can.do_get_berr_counter = m_can_get_berr_counter;
+
+	/* CAN_CTRLMODE_FD_NON_ISO is fixed with M_CAN IP v3.0.1 */
+	priv->can.ctrlmode = CAN_CTRLMODE_FD_NON_ISO;
+
+	/* CAN_CTRLMODE_FD_NON_ISO can not be changed with M_CAN IP v3.0.1 */
 	priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK |
 					CAN_CTRLMODE_LISTENONLY |
 					CAN_CTRLMODE_BERR_REPORTING |
Index: linux-3.18.13-rt10-r7s4/drivers/net/can/usb/kvaser_usb.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/can/usb/kvaser_usb.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/can/usb/kvaser_usb.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:15 @
  * Copyright (C) 2012 Olivier Sobrie <olivier@sobrie.be>
  */
 
+#include <linux/kernel.h>
 #include <linux/completion.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:407 @ static int kvaser_usb_wait_msg(const str
 		while (pos <= actual_len - MSG_HEADER_LEN) {
 			tmp = buf + pos;
 
-			if (!tmp->len)
-				break;
+			/* Handle messages crossing the USB endpoint max packet
+			 * size boundary. Check kvaser_usb_read_bulk_callback()
+			 * for further details.
+			 */
+			if (tmp->len == 0) {
+				pos = round_up(pos,
+					       dev->bulk_in->wMaxPacketSize);
+				continue;
+			}
 
 			if (pos + tmp->len > actual_len) {
 				dev_err(dev->udev->dev.parent,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:598 @ static int kvaser_usb_simple_msg_async(s
 			  usb_sndbulkpipe(dev->udev,
 					  dev->bulk_out->bEndpointAddress),
 			  buf, msg->len,
-			  kvaser_usb_simple_msg_callback, priv);
+			  kvaser_usb_simple_msg_callback, netdev);
 	usb_anchor_urb(urb, &priv->tx_submitted);
 
 	err = usb_submit_urb(urb, GFP_ATOMIC);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:673 @ static void kvaser_usb_rx_error(const st
 	priv = dev->nets[channel];
 	stats = &priv->netdev->stats;
 
-	if (status & M16C_STATE_BUS_RESET) {
-		kvaser_usb_unlink_tx_urbs(priv);
-		return;
-	}
-
 	skb = alloc_can_err_skb(priv->netdev, &cf);
 	if (!skb) {
 		stats->rx_dropped++;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:683 @ static void kvaser_usb_rx_error(const st
 
 	netdev_dbg(priv->netdev, "Error status: 0x%02x\n", status);
 
-	if (status & M16C_STATE_BUS_OFF) {
+	if (status & (M16C_STATE_BUS_OFF | M16C_STATE_BUS_RESET)) {
 		cf->can_id |= CAN_ERR_BUSOFF;
 
 		priv->can.can_stats.bus_off++;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:709 @ static void kvaser_usb_rx_error(const st
 		}
 
 		new_state = CAN_STATE_ERROR_PASSIVE;
-	}
-
-	if (status == M16C_STATE_BUS_ERROR) {
+	} else if (status & M16C_STATE_BUS_ERROR) {
 		if ((priv->can.state < CAN_STATE_ERROR_WARNING) &&
 		    ((txerr >= 96) || (rxerr >= 96))) {
 			cf->can_id |= CAN_ERR_CRTL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:719 @ static void kvaser_usb_rx_error(const st
 
 			priv->can.can_stats.error_warning++;
 			new_state = CAN_STATE_ERROR_WARNING;
-		} else if (priv->can.state > CAN_STATE_ERROR_ACTIVE) {
+		} else if ((priv->can.state > CAN_STATE_ERROR_ACTIVE) &&
+			   ((txerr < 96) && (rxerr < 96))) {
 			cf->can_id |= CAN_ERR_PROT;
 			cf->data[2] = CAN_ERR_PROT_ACTIVE;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:994 @ static void kvaser_usb_read_bulk_callbac
 	while (pos <= urb->actual_length - MSG_HEADER_LEN) {
 		msg = urb->transfer_buffer + pos;
 
-		if (!msg->len)
-			break;
+		/* The Kvaser firmware can only read and write messages that
+		 * does not cross the USB's endpoint wMaxPacketSize boundary.
+		 * If a follow-up command crosses such boundary, firmware puts
+		 * a placeholder zero-length command in its place then aligns
+		 * the real command to the next max packet size.
+		 *
+		 * Handle such cases or we're going to miss a significant
+		 * number of events in case of a heavy rx load on the bus.
+		 */
+		if (msg->len == 0) {
+			pos = round_up(pos, dev->bulk_in->wMaxPacketSize);
+			continue;
+		}
 
 		if (pos + msg->len > urb->actual_length) {
 			dev_err(dev->udev->dev.parent, "Format error\n");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1014 @ static void kvaser_usb_read_bulk_callbac
 		}
 
 		kvaser_usb_handle_message(dev, msg);
-
 		pos += msg->len;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1261 @ static int kvaser_usb_close(struct net_d
 	if (err)
 		netdev_warn(netdev, "Cannot stop device, error %d\n", err);
 
+	/* reset tx contexts */
+	kvaser_usb_unlink_tx_urbs(priv);
+
 	priv->can.state = CAN_STATE_STOPPED;
 	close_candev(priv->netdev);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1312 @ static netdev_tx_t kvaser_usb_start_xmit
 	if (!urb) {
 		netdev_err(netdev, "No memory left for URBs\n");
 		stats->tx_dropped++;
-		goto nourbmem;
+		dev_kfree_skb(skb);
+		return NETDEV_TX_OK;
 	}
 
 	buf = kmalloc(sizeof(struct kvaser_msg), GFP_ATOMIC);
 	if (!buf) {
 		stats->tx_dropped++;
+		dev_kfree_skb(skb);
 		goto nobufmem;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1354 @ static netdev_tx_t kvaser_usb_start_xmit
 		}
 	}
 
+	/* This should never happen; it implies a flow control bug */
 	if (!context) {
 		netdev_warn(netdev, "cannot find free context\n");
 		ret =  NETDEV_TX_BUSY;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1385 @ static netdev_tx_t kvaser_usb_start_xmit
 	if (unlikely(err)) {
 		can_free_echo_skb(netdev, context->echo_index);
 
-		skb = NULL; /* set to NULL to avoid double free in
-			     * dev_kfree_skb(skb) */
-
 		atomic_dec(&priv->active_tx_urbs);
 		usb_unanchor_urb(urb);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1406 @ releasebuf:
 	kfree(buf);
 nobufmem:
 	usb_free_urb(urb);
-nourbmem:
-	dev_kfree_skb(skb);
 	return ret;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1518 @ static int kvaser_usb_init_one(struct us
 	struct kvaser_usb_net_priv *priv;
 	int i, err;
 
+	err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel);
+	if (err)
+		return err;
+
 	netdev = alloc_candev(sizeof(*priv), MAX_TX_URBS);
 	if (!netdev) {
 		dev_err(&intf->dev, "Cannot alloc candev\n");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1608 @ static int kvaser_usb_probe(struct usb_i
 {
 	struct kvaser_usb *dev;
 	int err = -ENOMEM;
-	int i;
+	int i, retry = 3;
 
 	dev = devm_kzalloc(&intf->dev, sizeof(*dev), GFP_KERNEL);
 	if (!dev)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1626 @ static int kvaser_usb_probe(struct usb_i
 
 	usb_set_intfdata(intf, dev);
 
-	for (i = 0; i < MAX_NET_DEVICES; i++)
-		kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, i);
+	/* On some x86 laptops, plugging a Kvaser device again after
+	 * an unplug makes the firmware always ignore the very first
+	 * command. For such a case, provide some room for retries
+	 * instead of completely exiting the driver.
+	 */
+	do {
+		err = kvaser_usb_get_software_info(dev);
+	} while (--retry && err == -ETIMEDOUT);
 
-	err = kvaser_usb_get_software_info(dev);
 	if (err) {
 		dev_err(&intf->dev,
 			"Cannot get software infos, error %d\n", err);
Index: linux-3.18.13-rt10-r7s4/drivers/net/can/usb/peak_usb/pcan_usb_core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:738 @ static int peak_usb_create_dev(struct pe
 	dev->cmd_buf = kmalloc(PCAN_USB_MAX_CMD_LEN, GFP_KERNEL);
 	if (!dev->cmd_buf) {
 		err = -ENOMEM;
-		goto lbl_set_intf_data;
+		goto lbl_free_candev;
 	}
 
 	dev->udev = usb_dev;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:778 @ static int peak_usb_create_dev(struct pe
 	err = register_candev(netdev);
 	if (err) {
 		dev_err(&intf->dev, "couldn't register CAN device: %d\n", err);
-		goto lbl_free_cmd_buf;
+		goto lbl_restore_intf_data;
 	}
 
 	if (dev->prev_siblings)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:791 @ static int peak_usb_create_dev(struct pe
 	if (dev->adapter->dev_init) {
 		err = dev->adapter->dev_init(dev);
 		if (err)
-			goto lbl_free_cmd_buf;
+			goto lbl_unregister_candev;
 	}
 
 	/* set bus off */
 	if (dev->adapter->dev_set_bus) {
 		err = dev->adapter->dev_set_bus(dev, 0);
 		if (err)
-			goto lbl_free_cmd_buf;
+			goto lbl_unregister_candev;
 	}
 
 	/* get device number early */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:810 @ static int peak_usb_create_dev(struct pe
 
 	return 0;
 
-lbl_free_cmd_buf:
-	kfree(dev->cmd_buf);
+lbl_unregister_candev:
+	unregister_candev(netdev);
 
-lbl_set_intf_data:
+lbl_restore_intf_data:
 	usb_set_intfdata(intf, dev->prev_siblings);
+	kfree(dev->cmd_buf);
+
+lbl_free_candev:
 	free_candev(netdev);
 
 	return err;
Index: linux-3.18.13-rt10-r7s4/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:336 @ static int pcan_usb_pro_send_req(struct
 	if (!(dev->state & PCAN_USB_STATE_CONNECTED))
 		return 0;
 
-	memset(req_addr, '\0', req_size);
-
 	req_type = USB_TYPE_VENDOR | USB_RECIP_OTHER;
 
 	switch (req_id) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:346 @ static int pcan_usb_pro_send_req(struct
 	default:
 		p = usb_rcvctrlpipe(dev->udev, 0);
 		req_type |= USB_DIR_IN;
+		memset(req_addr, '\0', req_size);
 		break;
 	}
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/amd/pcnet32.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/amd/pcnet32.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/amd/pcnet32.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1546 @ pcnet32_probe1(unsigned long ioaddr, int
 {
 	struct pcnet32_private *lp;
 	int i, media;
-	int fdx, mii, fset, dxsuflo;
+	int fdx, mii, fset, dxsuflo, sram;
 	int chip_version;
 	char *chipname;
 	struct net_device *dev;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1583 @ pcnet32_probe1(unsigned long ioaddr, int
 	}
 
 	/* initialize variables */
-	fdx = mii = fset = dxsuflo = 0;
+	fdx = mii = fset = dxsuflo = sram = 0;
 	chip_version = (chip_version >> 12) & 0xffff;
 
 	switch (chip_version) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1616 @ pcnet32_probe1(unsigned long ioaddr, int
 		chipname = "PCnet/FAST III 79C973";	/* PCI */
 		fdx = 1;
 		mii = 1;
+		sram = 1;
 		break;
 	case 0x2626:
 		chipname = "PCnet/Home 79C978";	/* PCI */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1640 @ pcnet32_probe1(unsigned long ioaddr, int
 		chipname = "PCnet/FAST III 79C975";	/* PCI */
 		fdx = 1;
 		mii = 1;
+		sram = 1;
 		break;
 	case 0x2628:
 		chipname = "PCnet/PRO 79C976";
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1669 @ pcnet32_probe1(unsigned long ioaddr, int
 		dxsuflo = 1;
 	}
 
+	/*
+	 * The Am79C973/Am79C975 controllers come with 12K of SRAM
+	 * which we can use for the Tx/Rx buffers but most importantly,
+	 * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
+	 * Tx fifo underflows.
+	 */
+	if (sram) {
+		/*
+		 * The SRAM is being configured in two steps. First we
+		 * set the SRAM size in the BCR25:SRAM_SIZE bits. According
+		 * to the datasheet, each bit corresponds to a 512-byte
+		 * page so we can have at most 24 pages. The SRAM_SIZE
+		 * holds the value of the upper 8 bits of the 16-bit SRAM size.
+		 * The low 8-bits start at 0x00 and end at 0xff. So the
+		 * address range is from 0x0000 up to 0x17ff. Therefore,
+		 * the SRAM_SIZE is set to 0x17. The next step is to set
+		 * the BCR26:SRAM_BND midway through so the Tx and Rx
+		 * buffers can share the SRAM equally.
+		 */
+		a->write_bcr(ioaddr, 25, 0x17);
+		a->write_bcr(ioaddr, 26, 0xc);
+		/* And finally enable the NOUFLO bit */
+		a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
+	}
+
 	dev = alloc_etherdev(sizeof(*lp));
 	if (!dev) {
 		ret = -ENOMEM;
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/atheros/alx/main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/atheros/alx/main.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/atheros/alx/main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:187 @ static void alx_schedule_reset(struct al
 	schedule_work(&alx->reset_wk);
 }
 
-static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
+static int alx_clean_rx_irq(struct alx_priv *alx, int budget)
 {
 	struct alx_rx_queue *rxq = &alx->rxq;
 	struct alx_rrd *rrd;
 	struct alx_buffer *rxb;
 	struct sk_buff *skb;
 	u16 length, rfd_cleaned = 0;
+	int work = 0;
 
-	while (budget > 0) {
+	while (work < budget) {
 		rrd = &rxq->rrd[rxq->rrd_read_idx];
 		if (!(rrd->word3 & cpu_to_le32(1 << RRD_UPDATED_SHIFT)))
 			break;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:207 @ static bool alx_clean_rx_irq(struct alx_
 		    ALX_GET_FIELD(le32_to_cpu(rrd->word0),
 				  RRD_NOR) != 1) {
 			alx_schedule_reset(alx);
-			return 0;
+			return work;
 		}
 
 		rxb = &rxq->bufs[rxq->read_idx];
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:247 @ static bool alx_clean_rx_irq(struct alx_
 		}
 
 		napi_gro_receive(&alx->napi, skb);
-		budget--;
+		work++;
 
 next_pkt:
 		if (++rxq->read_idx == alx->rx_ringsz)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:262 @ next_pkt:
 	if (rfd_cleaned)
 		alx_refill_rx_ring(alx, GFP_ATOMIC);
 
-	return budget > 0;
+	return work;
 }
 
 static int alx_poll(struct napi_struct *napi, int budget)
 {
 	struct alx_priv *alx = container_of(napi, struct alx_priv, napi);
 	struct alx_hw *hw = &alx->hw;
-	bool complete = true;
 	unsigned long flags;
+	bool tx_complete;
+	int work;
 
-	complete = alx_clean_tx_irq(alx) &&
-		   alx_clean_rx_irq(alx, budget);
+	tx_complete = alx_clean_tx_irq(alx);
+	work = alx_clean_rx_irq(alx, budget);
 
-	if (!complete)
-		return 1;
+	if (!tx_complete || work == budget)
+		return budget;
 
 	napi_complete(&alx->napi);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:289 @ static int alx_poll(struct napi_struct *
 
 	alx_post_write(hw);
 
-	return 0;
+	return work;
 }
 
 static irqreturn_t alx_intr_handle(struct alx_priv *alx, u32 intr)
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:534 @ struct bnx2x_fastpath {
 	struct napi_struct	napi;
 
 #ifdef CONFIG_NET_RX_BUSY_POLL
-	unsigned int state;
-#define BNX2X_FP_STATE_IDLE		      0
-#define BNX2X_FP_STATE_NAPI		(1 << 0)    /* NAPI owns this FP */
-#define BNX2X_FP_STATE_POLL		(1 << 1)    /* poll owns this FP */
-#define BNX2X_FP_STATE_DISABLED		(1 << 2)
-#define BNX2X_FP_STATE_NAPI_YIELD	(1 << 3)    /* NAPI yielded this FP */
-#define BNX2X_FP_STATE_POLL_YIELD	(1 << 4)    /* poll yielded this FP */
-#define BNX2X_FP_OWNED	(BNX2X_FP_STATE_NAPI | BNX2X_FP_STATE_POLL)
-#define BNX2X_FP_YIELD	(BNX2X_FP_STATE_NAPI_YIELD | BNX2X_FP_STATE_POLL_YIELD)
-#define BNX2X_FP_LOCKED	(BNX2X_FP_OWNED | BNX2X_FP_STATE_DISABLED)
-#define BNX2X_FP_USER_PEND (BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_POLL_YIELD)
-	/* protect state */
-	spinlock_t lock;
-#endif /* CONFIG_NET_RX_BUSY_POLL */
+	unsigned long		busy_poll_state;
+#endif
 
 	union host_hc_status_block	status_blk;
 	/* chip independent shortcuts into sb structure */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:610 @ struct bnx2x_fastpath {
 #define bnx2x_fp_qstats(bp, fp)	(&((bp)->fp_stats[(fp)->index].eth_q_stats))
 
 #ifdef CONFIG_NET_RX_BUSY_POLL
-static inline void bnx2x_fp_init_lock(struct bnx2x_fastpath *fp)
+
+enum bnx2x_fp_state {
+	BNX2X_STATE_FP_NAPI	= BIT(0), /* NAPI handler owns the queue */
+
+	BNX2X_STATE_FP_NAPI_REQ_BIT = 1, /* NAPI would like to own the queue */
+	BNX2X_STATE_FP_NAPI_REQ = BIT(1),
+
+	BNX2X_STATE_FP_POLL_BIT = 2,
+	BNX2X_STATE_FP_POLL     = BIT(2), /* busy_poll owns the queue */
+
+	BNX2X_STATE_FP_DISABLE_BIT = 3, /* queue is dismantled */
+};
+
+static inline void bnx2x_fp_busy_poll_init(struct bnx2x_fastpath *fp)
 {
-	spin_lock_init(&fp->lock);
-	fp->state = BNX2X_FP_STATE_IDLE;
+	WRITE_ONCE(fp->busy_poll_state, 0);
 }
 
 /* called from the device poll routine to get ownership of a FP */
 static inline bool bnx2x_fp_lock_napi(struct bnx2x_fastpath *fp)
 {
-	bool rc = true;
+	unsigned long prev, old = READ_ONCE(fp->busy_poll_state);
 
-	spin_lock_bh(&fp->lock);
-	if (fp->state & BNX2X_FP_LOCKED) {
-		WARN_ON(fp->state & BNX2X_FP_STATE_NAPI);
-		fp->state |= BNX2X_FP_STATE_NAPI_YIELD;
-		rc = false;
-	} else {
-		/* we don't care if someone yielded */
-		fp->state = BNX2X_FP_STATE_NAPI;
+	while (1) {
+		switch (old) {
+		case BNX2X_STATE_FP_POLL:
+			/* make sure bnx2x_fp_lock_poll() wont starve us */
+			set_bit(BNX2X_STATE_FP_NAPI_REQ_BIT,
+				&fp->busy_poll_state);
+			/* fallthrough */
+		case BNX2X_STATE_FP_POLL | BNX2X_STATE_FP_NAPI_REQ:
+			return false;
+		default:
+			break;
+		}
+		prev = cmpxchg(&fp->busy_poll_state, old, BNX2X_STATE_FP_NAPI);
+		if (unlikely(prev != old)) {
+			old = prev;
+			continue;
+		}
+		return true;
 	}
-	spin_unlock_bh(&fp->lock);
-	return rc;
 }
 
-/* returns true is someone tried to get the FP while napi had it */
-static inline bool bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
+static inline void bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
 {
-	bool rc = false;
-
-	spin_lock_bh(&fp->lock);
-	WARN_ON(fp->state &
-		(BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_NAPI_YIELD));
-
-	if (fp->state & BNX2X_FP_STATE_POLL_YIELD)
-		rc = true;
-
-	/* state ==> idle, unless currently disabled */
-	fp->state &= BNX2X_FP_STATE_DISABLED;
-	spin_unlock_bh(&fp->lock);
-	return rc;
+	smp_wmb();
+	fp->busy_poll_state = 0;
 }
 
 /* called from bnx2x_low_latency_poll() */
 static inline bool bnx2x_fp_lock_poll(struct bnx2x_fastpath *fp)
 {
-	bool rc = true;
-
-	spin_lock_bh(&fp->lock);
-	if ((fp->state & BNX2X_FP_LOCKED)) {
-		fp->state |= BNX2X_FP_STATE_POLL_YIELD;
-		rc = false;
-	} else {
-		/* preserve yield marks */
-		fp->state |= BNX2X_FP_STATE_POLL;
-	}
-	spin_unlock_bh(&fp->lock);
-	return rc;
+	return cmpxchg(&fp->busy_poll_state, 0, BNX2X_STATE_FP_POLL) == 0;
 }
 
-/* returns true if someone tried to get the FP while it was locked */
-static inline bool bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
+static inline void bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
 {
-	bool rc = false;
-
-	spin_lock_bh(&fp->lock);
-	WARN_ON(fp->state & BNX2X_FP_STATE_NAPI);
-
-	if (fp->state & BNX2X_FP_STATE_POLL_YIELD)
-		rc = true;
-
-	/* state ==> idle, unless currently disabled */
-	fp->state &= BNX2X_FP_STATE_DISABLED;
-	spin_unlock_bh(&fp->lock);
-	return rc;
+	smp_mb__before_atomic();
+	clear_bit(BNX2X_STATE_FP_POLL_BIT, &fp->busy_poll_state);
 }
 
-/* true if a socket is polling, even if it did not get the lock */
+/* true if a socket is polling */
 static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
 {
-	WARN_ON(!(fp->state & BNX2X_FP_OWNED));
-	return fp->state & BNX2X_FP_USER_PEND;
+	return READ_ONCE(fp->busy_poll_state) & BNX2X_STATE_FP_POLL;
 }
 
 /* false if fp is currently owned */
 static inline bool bnx2x_fp_ll_disable(struct bnx2x_fastpath *fp)
 {
-	int rc = true;
-
-	spin_lock_bh(&fp->lock);
-	if (fp->state & BNX2X_FP_OWNED)
-		rc = false;
-	fp->state |= BNX2X_FP_STATE_DISABLED;
-	spin_unlock_bh(&fp->lock);
+	set_bit(BNX2X_STATE_FP_DISABLE_BIT, &fp->busy_poll_state);
+	return !bnx2x_fp_ll_polling(fp);
 
-	return rc;
 }
 #else
-static inline void bnx2x_fp_init_lock(struct bnx2x_fastpath *fp)
+static inline void bnx2x_fp_busy_poll_init(struct bnx2x_fastpath *fp)
 {
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:695 @ static inline bool bnx2x_fp_lock_napi(st
 	return true;
 }
 
-static inline bool bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
+static inline void bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
 {
-	return false;
 }
 
 static inline bool bnx2x_fp_lock_poll(struct bnx2x_fastpath *fp)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:704 @ static inline bool bnx2x_fp_lock_poll(st
 	return false;
 }
 
-static inline bool bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
+static inline void bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
 {
-	return false;
 }
 
 static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1852 @ static void bnx2x_napi_enable_cnic(struc
 	int i;
 
 	for_each_rx_queue_cnic(bp, i) {
-		bnx2x_fp_init_lock(&bp->fp[i]);
+		bnx2x_fp_busy_poll_init(&bp->fp[i]);
 		napi_enable(&bnx2x_fp(bp, i, napi));
 	}
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1862 @ static void bnx2x_napi_enable(struct bnx
 	int i;
 
 	for_each_eth_queue(bp, i) {
-		bnx2x_fp_init_lock(&bp->fp[i]);
+		bnx2x_fp_busy_poll_init(&bp->fp[i]);
 		napi_enable(&bnx2x_fp(bp, i, napi));
 	}
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3178 @ static int bnx2x_poll(struct napi_struct
 		}
 #endif
 		if (!bnx2x_fp_lock_napi(fp))
-			return work_done;
+			return budget;
 
 		for_each_cos_in_tx_queue(fp, cos)
 			if (bnx2x_tx_queue_has_work(fp->txdata_ptr[cos]))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3194 @ static int bnx2x_poll(struct napi_struct
 			}
 		}
 
+		bnx2x_fp_unlock_napi(fp);
+
 		/* Fall out from the NAPI loop if needed */
-		if (!bnx2x_fp_unlock_napi(fp) &&
-		    !(bnx2x_has_rx_work(fp) || bnx2x_has_tx_work(fp))) {
+		if (!(bnx2x_has_rx_work(fp) || bnx2x_has_tx_work(fp))) {
 
 			/* No need to update SB for FCoE L2 ring as long as
 			 * it's connected to the default SB and the SB
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:12714 @ static int bnx2x_init_dev(struct bnx2x *
 	pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
 			       PCICFG_VENDOR_ID_OFFSET);
 
+	/* Set PCIe reset type to fundamental for EEH recovery */
+	pdev->needs_freset = 1;
+
 	/* AER (Advanced Error reporting) configuration */
 	rc = pci_enable_pcie_error_reporting(pdev);
 	if (!rc)
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/broadcom/genet/bcmgenet.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:875 @ static inline void bcmgenet_tx_ring_int_
 }
 
 /* Unlocked version of the reclaim routine */
-static void __bcmgenet_tx_reclaim(struct net_device *dev,
-				  struct bcmgenet_tx_ring *ring)
+static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
+					  struct bcmgenet_tx_ring *ring)
 {
 	struct bcmgenet_priv *priv = netdev_priv(dev);
 	int last_tx_cn, last_c_index, num_tx_bds;
 	struct enet_cb *tx_cb_ptr;
 	struct netdev_queue *txq;
+	unsigned int pkts_compl = 0;
 	unsigned int bds_compl;
 	unsigned int c_index;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:910 @ static void __bcmgenet_tx_reclaim(struct
 		tx_cb_ptr = ring->cbs + last_c_index;
 		bds_compl = 0;
 		if (tx_cb_ptr->skb) {
+			pkts_compl++;
 			bds_compl = skb_shinfo(tx_cb_ptr->skb)->nr_frags + 1;
 			dev->stats.tx_bytes += tx_cb_ptr->skb->len;
 			dma_unmap_single(&dev->dev,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:934 @ static void __bcmgenet_tx_reclaim(struct
 		last_c_index &= (num_tx_bds - 1);
 	}
 
-	if (ring->free_bds > (MAX_SKB_FRAGS + 1))
-		ring->int_disable(priv, ring);
-
-	if (netif_tx_queue_stopped(txq))
-		netif_tx_wake_queue(txq);
+	if (ring->free_bds > (MAX_SKB_FRAGS + 1)) {
+		if (netif_tx_queue_stopped(txq))
+			netif_tx_wake_queue(txq);
+	}
 
 	ring->c_index = c_index;
+
+	return pkts_compl;
 }
 
-static void bcmgenet_tx_reclaim(struct net_device *dev,
+static unsigned int bcmgenet_tx_reclaim(struct net_device *dev,
 				struct bcmgenet_tx_ring *ring)
 {
+	unsigned int released;
 	unsigned long flags;
 
 	spin_lock_irqsave(&ring->lock, flags);
-	__bcmgenet_tx_reclaim(dev, ring);
+	released = __bcmgenet_tx_reclaim(dev, ring);
 	spin_unlock_irqrestore(&ring->lock, flags);
+
+	return released;
+}
+
+static int bcmgenet_tx_poll(struct napi_struct *napi, int budget)
+{
+	struct bcmgenet_tx_ring *ring =
+		container_of(napi, struct bcmgenet_tx_ring, napi);
+	unsigned int work_done = 0;
+
+	work_done = bcmgenet_tx_reclaim(ring->priv->dev, ring);
+
+	if (work_done == 0) {
+		napi_complete(napi);
+		ring->int_enable(ring->priv, ring);
+
+		return 0;
+	}
+
+	return budget;
 }
 
 static void bcmgenet_tx_reclaim_all(struct net_device *dev)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1228 @ static netdev_tx_t bcmgenet_xmit(struct
 	bcmgenet_tdma_ring_writel(priv, ring->index,
 				  ring->prod_index, TDMA_PROD_INDEX);
 
-	if (ring->free_bds <= (MAX_SKB_FRAGS + 1)) {
+	if (ring->free_bds <= (MAX_SKB_FRAGS + 1))
 		netif_tx_stop_queue(txq);
-		ring->int_enable(priv, ring);
-	}
 
 out:
 	spin_unlock_irqrestore(&ring->lock, flags);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1542 @ static int init_umac(struct bcmgenet_pri
 	struct device *kdev = &priv->pdev->dev;
 	int ret;
 	u32 reg, cpu_mask_clear;
+	int index;
 
 	dev_dbg(&priv->pdev->dev, "bcmgenet: init_umac\n");
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1569 @ static int init_umac(struct bcmgenet_pri
 
 	bcmgenet_intr_disable(priv);
 
-	cpu_mask_clear = UMAC_IRQ_RXDMA_BDONE;
+	cpu_mask_clear = UMAC_IRQ_RXDMA_BDONE | UMAC_IRQ_TXDMA_BDONE;
 
 	dev_dbg(kdev, "%s:Enabling RXDMA_BDONE interrupt\n", __func__);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1596 @ static int init_umac(struct bcmgenet_pri
 
 	bcmgenet_intrl2_0_writel(priv, cpu_mask_clear, INTRL2_CPU_MASK_CLEAR);
 
+	for (index = 0; index < priv->hw_params->tx_queues; index++)
+		bcmgenet_intrl2_1_writel(priv, (1 << index),
+					 INTRL2_CPU_MASK_CLEAR);
+
 	/* Enable rx/tx engine.*/
 	dev_dbg(kdev, "done init umac\n");
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1619 @ static void bcmgenet_init_tx_ring(struct
 	unsigned int first_bd;
 
 	spin_lock_init(&ring->lock);
+	ring->priv = priv;
+	netif_napi_add(priv->dev, &ring->napi, bcmgenet_tx_poll, 64);
 	ring->index = index;
 	if (index == DESC_INDEX) {
 		ring->queue = 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1666 @ static void bcmgenet_init_tx_ring(struct
 				  TDMA_WRITE_PTR);
 	bcmgenet_tdma_ring_writel(priv, index, end_ptr * words_per_bd - 1,
 				  DMA_END_ADDR);
+
+	napi_enable(&ring->napi);
+}
+
+static void bcmgenet_fini_tx_ring(struct bcmgenet_priv *priv,
+				  unsigned int index)
+{
+	struct bcmgenet_tx_ring *ring = &priv->tx_rings[index];
+
+	napi_disable(&ring->napi);
+	netif_napi_del(&ring->napi);
 }
 
 /* Initialize a RDMA ring */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1846 @ static int bcmgenet_dma_teardown(struct
 	return ret;
 }
 
-static void bcmgenet_fini_dma(struct bcmgenet_priv *priv)
+static void __bcmgenet_fini_dma(struct bcmgenet_priv *priv)
 {
 	int i;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1865 @ static void bcmgenet_fini_dma(struct bcm
 	kfree(priv->tx_cbs);
 }
 
+static void bcmgenet_fini_dma(struct bcmgenet_priv *priv)
+{
+	int i;
+
+	bcmgenet_fini_tx_ring(priv, DESC_INDEX);
+
+	for (i = 0; i < priv->hw_params->tx_queues; i++)
+		bcmgenet_fini_tx_ring(priv, i);
+
+	__bcmgenet_fini_dma(priv);
+}
+
 /* init_edma: Initialize DMA control register */
 static int bcmgenet_init_dma(struct bcmgenet_priv *priv)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1903 @ static int bcmgenet_init_dma(struct bcmg
 	priv->tx_cbs = kcalloc(priv->num_tx_bds, sizeof(struct enet_cb),
 			       GFP_KERNEL);
 	if (!priv->tx_cbs) {
-		bcmgenet_fini_dma(priv);
+		__bcmgenet_fini_dma(priv);
 		return -ENOMEM;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1926 @ static int bcmgenet_poll(struct napi_str
 			struct bcmgenet_priv, napi);
 	unsigned int work_done;
 
-	/* tx reclaim */
-	bcmgenet_tx_reclaim(priv->dev, &priv->tx_rings[DESC_INDEX]);
-
 	work_done = bcmgenet_desc_rx(priv, budget);
 
 	/* Advancing our consumer index*/
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1970 @ static void bcmgenet_irq_task(struct wor
 static irqreturn_t bcmgenet_isr1(int irq, void *dev_id)
 {
 	struct bcmgenet_priv *priv = dev_id;
+	struct bcmgenet_tx_ring *ring;
 	unsigned int index;
 
 	/* Save irq status for bottom-half processing. */
 	priv->irq1_stat =
 		bcmgenet_intrl2_1_readl(priv, INTRL2_CPU_STAT) &
-		~priv->int1_mask;
+		~bcmgenet_intrl2_1_readl(priv, INTRL2_CPU_MASK_STATUS);
 	/* clear interrupts */
 	bcmgenet_intrl2_1_writel(priv, priv->irq1_stat, INTRL2_CPU_CLEAR);
 
 	netif_dbg(priv, intr, priv->dev,
 		  "%s: IRQ=0x%x\n", __func__, priv->irq1_stat);
+
 	/* Check the MBDONE interrupts.
 	 * packet is done, reclaim descriptors
 	 */
-	if (priv->irq1_stat & 0x0000ffff) {
-		index = 0;
-		for (index = 0; index < 16; index++) {
-			if (priv->irq1_stat & (1 << index))
-				bcmgenet_tx_reclaim(priv->dev,
-						    &priv->tx_rings[index]);
+	for (index = 0; index < priv->hw_params->tx_queues; index++) {
+		if (!(priv->irq1_stat & BIT(index)))
+			continue;
+
+		ring = &priv->tx_rings[index];
+
+		if (likely(napi_schedule_prep(&ring->napi))) {
+			ring->int_disable(priv, ring);
+			__napi_schedule(&ring->napi);
 		}
 	}
+
 	return IRQ_HANDLED;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2029 @ static irqreturn_t bcmgenet_isr0(int irq
 	}
 	if (priv->irq0_stat &
 			(UMAC_IRQ_TXDMA_BDONE | UMAC_IRQ_TXDMA_PDONE)) {
-		/* Tx reclaim */
-		bcmgenet_tx_reclaim(priv->dev, &priv->tx_rings[DESC_INDEX]);
+		struct bcmgenet_tx_ring *ring = &priv->tx_rings[DESC_INDEX];
+
+		if (likely(napi_schedule_prep(&ring->napi))) {
+			ring->int_disable(priv, ring);
+			__napi_schedule(&ring->napi);
+		}
 	}
 	if (priv->irq0_stat & (UMAC_IRQ_PHY_DET_R |
 				UMAC_IRQ_PHY_DET_F |
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/broadcom/genet/bcmgenet.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:498 @ struct bcmgenet_hw_params {
 
 struct bcmgenet_tx_ring {
 	spinlock_t	lock;		/* ring lock */
+	struct napi_struct napi;	/* NAPI per tx queue */
 	unsigned int	index;		/* ring index */
 	unsigned int	queue;		/* queue index */
 	struct enet_cb	*cbs;		/* tx ring buffer control block*/
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:513 @ struct bcmgenet_tx_ring {
 			   struct bcmgenet_tx_ring *);
 	void (*int_disable)(struct bcmgenet_priv *priv,
 			    struct bcmgenet_tx_ring *);
+	struct bcmgenet_priv *priv;
 };
 
 /* device context */
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/broadcom/tg3.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/broadcom/tg3.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/broadcom/tg3.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:17792 @ static int tg3_init_one(struct pci_dev *
 		goto err_out_apeunmap;
 	}
 
-	/*
-	 * Reset chip in case UNDI or EFI driver did not shutdown
-	 * DMA self test will enable WDMAC and we'll see (spurious)
-	 * pending DMA on the PCI bus at that point.
-	 */
-	if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
-	    (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
-		tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
-		tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-	}
-
-	err = tg3_test_dma(tp);
-	if (err) {
-		dev_err(&pdev->dev, "DMA engine test failed, aborting\n");
-		goto err_out_apeunmap;
-	}
-
 	intmbx = MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW;
 	rcvmbx = MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW;
 	sndmbx = MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:17836 @ static int tg3_init_one(struct pci_dev *
 			sndmbx += 0xc;
 	}
 
+	/*
+	 * Reset chip in case UNDI or EFI driver did not shutdown
+	 * DMA self test will enable WDMAC and we'll see (spurious)
+	 * pending DMA on the PCI bus at that point.
+	 */
+	if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
+	    (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
+		tg3_full_lock(tp, 0);
+		tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
+		tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+		tg3_full_unlock(tp);
+	}
+
+	err = tg3_test_dma(tp);
+	if (err) {
+		dev_err(&pdev->dev, "DMA engine test failed, aborting\n");
+		goto err_out_apeunmap;
+	}
+
 	tg3_init_coal(tp);
 
 	pci_set_drvdata(pdev, dev);
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/cisco/enic/enic_main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/cisco/enic/enic_main.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/cisco/enic/enic_main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1062 @ static void enic_rq_indicate_buf(struct
 				     PKT_HASH_TYPE_L4 : PKT_HASH_TYPE_L3);
 		}
 
-		if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc) {
-			skb->csum = htons(checksum);
-			skb->ip_summed = CHECKSUM_COMPLETE;
-		}
+		/* Hardware does not provide whole packet checksum. It only
+		 * provides pseudo checksum. Since hw validates the packet
+		 * checksum but not provide us the checksum value. use
+		 * CHECSUM_UNNECESSARY.
+		 */
+		if ((netdev->features & NETIF_F_RXCSUM) && tcp_udp_csum_ok &&
+		    ipv4_csum_ok)
+			skb->ip_summed = CHECKSUM_UNNECESSARY;
 
 		if (vlan_stripped)
 			__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vlan_tci);
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/emulex/benet/be_main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/emulex/benet/be_main.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/emulex/benet/be_main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:890 @ static struct sk_buff *be_insert_vlan_in
 	}
 
 	if (vlan_tag) {
-		skb = __vlan_put_tag(skb, htons(ETH_P_8021Q), vlan_tag);
+		skb = vlan_insert_tag_set_proto(skb, htons(ETH_P_8021Q),
+						vlan_tag);
 		if (unlikely(!skb))
 			return skb;
 		skb->vlan_tci = 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:900 @ static struct sk_buff *be_insert_vlan_in
 	/* Insert the outer VLAN, if any */
 	if (adapter->qnq_vid) {
 		vlan_tag = adapter->qnq_vid;
-		skb = __vlan_put_tag(skb, htons(ETH_P_8021Q), vlan_tag);
+		skb = vlan_insert_tag_set_proto(skb, htons(ETH_P_8021Q),
+						vlan_tag);
 		if (unlikely(!skb))
 			return skb;
 		if (skip_hw_vlan)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4432 @ static void be_del_vxlan_port(struct net
 		 be16_to_cpu(port));
 }
 
-static bool be_gso_check(struct sk_buff *skb, struct net_device *dev)
+static netdev_features_t be_features_check(struct sk_buff *skb,
+					   struct net_device *dev,
+					   netdev_features_t features)
 {
-	return vxlan_gso_check(skb);
+	return vxlan_features_check(skb, features);
 }
 #endif
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4467 @ static const struct net_device_ops be_ne
 #ifdef CONFIG_BE2NET_VXLAN
 	.ndo_add_vxlan_port	= be_add_vxlan_port,
 	.ndo_del_vxlan_port	= be_del_vxlan_port,
-	.ndo_gso_check		= be_gso_check,
+	.ndo_features_check	= be_features_check,
 #endif
 };
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/freescale/fec_main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/freescale/fec_main.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/freescale/fec_main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1467 @ fec_enet_rx_queue(struct net_device *nde
 
 			vlan_packet_rcvd = true;
 
-			skb_copy_to_linear_data_offset(skb, VLAN_HLEN,
-						       data, (2 * ETH_ALEN));
+			memmove(skb->data + VLAN_HLEN, data, ETH_ALEN * 2);
 			skb_pull(skb, VLAN_HLEN);
 		}
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/intel/Kconfig
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/intel/Kconfig
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/intel/Kconfig
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:284 @ config I40E_DCB
 
 	  If unsure, say N.
 
+config I40E_FCOE
+	bool "Fibre Channel over Ethernet (FCoE)"
+	default n
+	depends on I40E && DCB && FCOE
+	---help---
+	  Say Y here if you want to use Fibre Channel over Ethernet (FCoE)
+	  in the driver. This will create new netdev for exclusive FCoE
+	  use with XL710 FCoE offloads enabled.
+
+	  If unsure, say N.
+
 config I40EVF
 	tristate "Intel(R) XL710 X710 Virtual Function Ethernet support"
 	depends on PCI_MSI
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/intel/i40e/Makefile
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/intel/i40e/Makefile
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/intel/i40e/Makefile
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:47 @ i40e-objs := i40e_main.o \
 	i40e_virtchnl_pf.o
 
 i40e-$(CONFIG_I40E_DCB) += i40e_dcb.o i40e_dcb_nl.o
-i40e-$(CONFIG_FCOE:m=y) += i40e_fcoe.o
+i40e-$(CONFIG_I40E_FCOE) += i40e_fcoe.o
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/intel/i40e/i40e_osdep.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/intel/i40e/i40e_osdep.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/intel/i40e/i40e_osdep.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:81 @ do {
 } while (0)
 
 typedef enum i40e_status_code i40e_status;
-#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
+#ifdef CONFIG_I40E_FCOE
 #define I40E_FCOE
-#endif /* CONFIG_FCOE or CONFIG_FCOE_MODULE */
+#endif
 #endif /* _I40E_OSDEP_H_ */
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/marvell/mvneta.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/marvell/mvneta.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/marvell/mvneta.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:219 @
 /* Various constants */
 
 /* Coalescing */
-#define MVNETA_TXDONE_COAL_PKTS		16
+#define MVNETA_TXDONE_COAL_PKTS		1
 #define MVNETA_RX_COAL_PKTS		32
 #define MVNETA_RX_COAL_USEC		100
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1724 @ static int mvneta_tx(struct sk_buff *skb
 	u16 txq_id = skb_get_queue_mapping(skb);
 	struct mvneta_tx_queue *txq = &pp->txqs[txq_id];
 	struct mvneta_tx_desc *tx_desc;
+	int len = skb->len;
 	int frags = 0;
 	u32 tx_cmd;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1792 @ out:
 
 		u64_stats_update_begin(&stats->syncp);
 		stats->tx_packets++;
-		stats->tx_bytes  += skb->len;
+		stats->tx_bytes  += len;
 		u64_stats_update_end(&stats->syncp);
 	} else {
 		dev->stats.tx_dropped++;
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/mellanox/mlx4/cmd.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/mellanox/mlx4/cmd.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:588 @ static int mlx4_cmd_wait(struct mlx4_dev
 		 * on the host, we deprecate the error message for this
 		 * specific command/input_mod/opcode_mod/fw-status to be debug.
 		 */
-		if (op == MLX4_CMD_SET_PORT && in_modifier == 1 &&
+		if (op == MLX4_CMD_SET_PORT &&
+		    (in_modifier == 1 || in_modifier == 2) &&
 		    op_modifier == 0 && context->fw_status == CMD_STAT_BAD_SIZE)
 			mlx4_dbg(dev, "command 0x%x failed: fw status = 0x%x\n",
 				 op, context->fw_status);
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1572 @ int mlx4_en_start_port(struct net_device
 			mlx4_en_free_affinity_hint(priv, i);
 			goto cq_err;
 		}
-		for (j = 0; j < cq->size; j++)
-			cq->buf[j].owner_sr_opcode = MLX4_CQE_OWNER_MASK;
+
+		for (j = 0; j < cq->size; j++) {
+			struct mlx4_cqe *cqe = NULL;
+
+			cqe = mlx4_en_get_cqe(cq->buf, j, priv->cqe_size) +
+			      priv->cqe_factor;
+			cqe->owner_sr_opcode = MLX4_CQE_OWNER_MASK;
+		}
+
 		err = mlx4_en_set_cq_moder(priv, cq);
 		if (err) {
 			en_err(priv, "Failed setting cq moderation parameters\n");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2366 @ static void mlx4_en_del_vxlan_port(struc
 	queue_work(priv->mdev->workqueue, &priv->vxlan_del_task);
 }
 
-static bool mlx4_en_gso_check(struct sk_buff *skb, struct net_device *dev)
+static netdev_features_t mlx4_en_features_check(struct sk_buff *skb,
+						struct net_device *dev,
+						netdev_features_t features)
 {
-	return vxlan_gso_check(skb);
+	return vxlan_features_check(skb, features);
 }
 #endif
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2403 @ static const struct net_device_ops mlx4_
 #ifdef CONFIG_MLX4_EN_VXLAN
 	.ndo_add_vxlan_port	= mlx4_en_add_vxlan_port,
 	.ndo_del_vxlan_port	= mlx4_en_del_vxlan_port,
-	.ndo_gso_check		= mlx4_en_gso_check,
+	.ndo_features_check	= mlx4_en_features_check,
 #endif
 };
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2437 @ static const struct net_device_ops mlx4_
 #ifdef CONFIG_MLX4_EN_VXLAN
 	.ndo_add_vxlan_port	= mlx4_en_add_vxlan_port,
 	.ndo_del_vxlan_port	= mlx4_en_del_vxlan_port,
-	.ndo_gso_check		= mlx4_en_gso_check,
+	.ndo_features_check	= mlx4_en_features_check,
 #endif
 };
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2609 @ int mlx4_en_init_netdev(struct mlx4_en_d
 	netif_carrier_off(dev);
 	mlx4_en_set_default_moderation(priv);
 
-	err = register_netdev(dev);
-	if (err) {
-		en_err(priv, "Netdev registration failed for port %d\n", port);
-		goto out;
-	}
-	priv->registered = 1;
-
 	en_warn(priv, "Using %d TX rings\n", prof->tx_ring_num);
 	en_warn(priv, "Using %d RX rings\n", prof->rx_ring_num);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2648 @ int mlx4_en_init_netdev(struct mlx4_en_d
 		queue_delayed_work(mdev->workqueue, &priv->service_task,
 				   SERVICE_TASK_DELAY);
 
+	err = register_netdev(dev);
+	if (err) {
+		en_err(priv, "Netdev registration failed for port %d\n", port);
+		goto out;
+	}
+
+	priv->registered = 1;
+
 	return 0;
 
 out:
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/mellanox/mlx4/en_tx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:957 @ netdev_tx_t mlx4_en_xmit(struct sk_buff
 		tx_desc->ctrl.owner_opcode = op_own;
 		if (send_doorbell) {
 			wmb();
-			iowrite32(ring->doorbell_qpn,
+			/* Since there is no iowrite*_native() that writes the
+			 * value as is, without byteswapping - using the one
+			 * the doesn't do byteswapping in the relevant arch
+			 * endianness.
+			 */
+#if defined(__LITTLE_ENDIAN)
+			iowrite32(
+#else
+			iowrite32be(
+#endif
+				  ring->doorbell_qpn,
 				  ring->bf.uar->map + MLX4_SEND_DOORBELL);
 		} else {
 			ring->xmit_more++;
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/mellanox/mlx4/fw.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/mellanox/mlx4/fw.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1650 @ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
 	/* CX3 is capable of extending CQEs\EQEs to strides larger than 64B */
 	MLX4_GET(byte_field, outbox, INIT_HCA_EQE_CQE_STRIDE_OFFSET);
 	if (byte_field) {
-		param->dev_cap_enabled |= MLX4_DEV_CAP_64B_EQE_ENABLED;
-		param->dev_cap_enabled |= MLX4_DEV_CAP_64B_CQE_ENABLED;
+		param->dev_cap_enabled |= MLX4_DEV_CAP_EQE_STRIDE_ENABLED;
+		param->dev_cap_enabled |= MLX4_DEV_CAP_CQE_STRIDE_ENABLED;
 		param->cqe_size = 1 << ((byte_field &
 					 MLX4_CQE_SIZE_MASK_STRIDE) + 5);
 		param->eqe_size = 1 << (((byte_field &
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/mellanox/mlx4/mr.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/mellanox/mlx4/mr.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:593 @ EXPORT_SYMBOL_GPL(mlx4_mr_free);
 void mlx4_mr_rereg_mem_cleanup(struct mlx4_dev *dev, struct mlx4_mr *mr)
 {
 	mlx4_mtt_cleanup(dev, &mr->mtt);
+	mr->mtt.order = -1;
 }
 EXPORT_SYMBOL_GPL(mlx4_mr_rereg_mem_cleanup);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:603 @ int mlx4_mr_rereg_mem_write(struct mlx4_
 {
 	int err;
 
-	mpt_entry->start       = cpu_to_be64(iova);
-	mpt_entry->length      = cpu_to_be64(size);
-	mpt_entry->entity_size = cpu_to_be32(page_shift);
-
 	err = mlx4_mtt_init(dev, npages, page_shift, &mr->mtt);
 	if (err)
 		return err;
 
+	mpt_entry->start       = cpu_to_be64(mr->iova);
+	mpt_entry->length      = cpu_to_be64(mr->size);
+	mpt_entry->entity_size = cpu_to_be32(mr->mtt.page_shift);
+
 	mpt_entry->pd_flags &= cpu_to_be32(MLX4_MPT_PD_MASK |
 					   MLX4_MPT_PD_FLAG_EN_INV);
 	mpt_entry->flags    &= cpu_to_be32(MLX4_MPT_FLAG_FREE |
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2391 @ static int netxen_nic_poll(struct napi_s
 
 	work_done = netxen_process_rcv_ring(sds_ring, budget);
 
-	if ((work_done < budget) && tx_complete) {
+	if (!tx_complete)
+		work_done = budget;
+
+	if (work_done < budget) {
 		napi_complete(&sds_ring->napi);
 		if (test_bit(__NX_DEV_UP, &adapter->state))
 			netxen_nic_enable_int(sds_ring);
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:507 @ static void qlcnic_del_vxlan_port(struct
 	adapter->flags |= QLCNIC_DEL_VXLAN_PORT;
 }
 
-static bool qlcnic_gso_check(struct sk_buff *skb, struct net_device *dev)
+static netdev_features_t qlcnic_features_check(struct sk_buff *skb,
+					       struct net_device *dev,
+					       netdev_features_t features)
 {
-	return vxlan_gso_check(skb);
+	return vxlan_features_check(skb, features);
 }
 #endif
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:536 @ static const struct net_device_ops qlcni
 #ifdef CONFIG_QLCNIC_VXLAN
 	.ndo_add_vxlan_port	= qlcnic_add_vxlan_port,
 	.ndo_del_vxlan_port	= qlcnic_del_vxlan_port,
-	.ndo_gso_check		= qlcnic_gso_check,
+	.ndo_features_check	= qlcnic_features_check,
 #endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
 	.ndo_poll_controller = qlcnic_poll_controller,
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/realtek/r8169.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/realtek/r8169.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/realtek/r8169.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5065 @ static void rtl_hw_reset(struct rtl8169_
 	RTL_W8(ChipCmd, CmdReset);
 
 	rtl_udelay_loop_wait_low(tp, &rtl_chipcmd_cond, 100, 100);
-
-	netdev_reset_queue(tp->dev);
 }
 
 static void rtl_request_uncached_firmware(struct rtl8169_private *tp)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7074 @ static netdev_tx_t rtl8169_start_xmit(st
 
 	txd->opts2 = cpu_to_le32(opts[1]);
 
-	netdev_sent_queue(dev, skb->len);
-
 	skb_tx_timestamp(skb);
 
 	wmb();
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7173 @ static void rtl8169_pcierr_interrupt(str
 static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp)
 {
 	unsigned int dirty_tx, tx_left;
-	unsigned int bytes_compl = 0, pkts_compl = 0;
 
 	dirty_tx = tp->dirty_tx;
 	smp_rmb();
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7191 @ static void rtl_tx(struct net_device *de
 		rtl8169_unmap_tx_skb(&tp->pci_dev->dev, tx_skb,
 				     tp->TxDescArray + entry);
 		if (status & LastFrag) {
-			pkts_compl++;
-			bytes_compl += tx_skb->skb->len;
+			u64_stats_update_begin(&tp->tx_stats.syncp);
+			tp->tx_stats.packets++;
+			tp->tx_stats.bytes += tx_skb->skb->len;
+			u64_stats_update_end(&tp->tx_stats.syncp);
 			dev_kfree_skb_any(tx_skb->skb);
 			tx_skb->skb = NULL;
 		}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7203 @ static void rtl_tx(struct net_device *de
 	}
 
 	if (tp->dirty_tx != dirty_tx) {
-		netdev_completed_queue(tp->dev, pkts_compl, bytes_compl);
-
-		u64_stats_update_begin(&tp->tx_stats.syncp);
-		tp->tx_stats.packets += pkts_compl;
-		tp->tx_stats.bytes += bytes_compl;
-		u64_stats_update_end(&tp->tx_stats.syncp);
-
 		tp->dirty_tx = dirty_tx;
 		/* Sync with rtl8169_start_xmit:
 		 * - publish dirty_tx ring index (write barrier)
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/ti/cpsw.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/ti/cpsw.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/ti/cpsw.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:613 @ static void cpsw_set_promiscious(struct
 
 			/* Clear all mcast from ALE */
 			cpsw_ale_flush_multicast(ale, ALE_ALL_PORTS <<
-						 priv->host_port);
+						 priv->host_port, -1);
 
 			/* Flood All Unicast Packets to Host port */
 			cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:637 @ static void cpsw_set_promiscious(struct
 static void cpsw_ndo_set_rx_mode(struct net_device *ndev)
 {
 	struct cpsw_priv *priv = netdev_priv(ndev);
+	int vid;
+
+	if (priv->data.dual_emac)
+		vid = priv->slaves[priv->emac_port].port_vlan;
+	else
+		vid = priv->data.default_vlan;
 
 	if (ndev->flags & IFF_PROMISC) {
 		/* Enable promiscuous mode */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:658 @ static void cpsw_ndo_set_rx_mode(struct
 	cpsw_ale_set_allmulti(priv->ale, priv->ndev->flags & IFF_ALLMULTI);
 
 	/* Clear all mcast from ALE */
-	cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port);
+	cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port,
+				 vid);
 
 	if (!netdev_mc_empty(ndev)) {
 		struct netdev_hw_addr *ha;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:767 @ requeue:
 static irqreturn_t cpsw_interrupt(int irq, void *dev_id)
 {
 	struct cpsw_priv *priv = dev_id;
+	int value = irq - priv->irqs_table[0];
+
+	/* NOTICE: Ending IRQ here. The trick with the 'value' variable above
+	 * is to make sure we will always write the correct value to the EOI
+	 * register. Namely 0 for RX_THRESH Interrupt, 1 for RX Interrupt, 2
+	 * for TX Interrupt and 3 for MISC Interrupt.
+	 */
+	cpdma_ctlr_eoi(priv->dma, value);
 
 	cpsw_intr_disable(priv);
 	if (priv->irq_enabled == true) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:804 @ static int cpsw_poll(struct napi_struct
 	int			num_tx, num_rx;
 
 	num_tx = cpdma_chan_process(priv->txch, 128);
-	if (num_tx)
-		cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
 
 	num_rx = cpdma_chan_process(priv->rxch, budget);
 	if (num_rx < budget) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:811 @ static int cpsw_poll(struct napi_struct
 
 		napi_complete(napi);
 		cpsw_intr_enable(priv);
-		cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
 		prim_cpsw = cpsw_get_slave_priv(priv, 0);
 		if (prim_cpsw->irq_enabled == false) {
 			prim_cpsw->irq_enabled = true;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1325 @ static int cpsw_ndo_open(struct net_devi
 	napi_enable(&priv->napi);
 	cpdma_ctlr_start(priv->dma);
 	cpsw_intr_enable(priv);
-	cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
-	cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
 
 	prim_cpsw = cpsw_get_slave_priv(priv, 0);
 	if (prim_cpsw->irq_enabled == false) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1591 @ static void cpsw_ndo_tx_timeout(struct n
 	cpdma_chan_start(priv->txch);
 	cpdma_ctlr_int_ctrl(priv->dma, true);
 	cpsw_intr_enable(priv);
-	cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
-	cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
-
 }
 
 static int cpsw_ndo_set_mac_address(struct net_device *ndev, void *p)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1630 @ static void cpsw_ndo_poll_controller(str
 	cpsw_interrupt(ndev->irq, priv);
 	cpdma_ctlr_int_ctrl(priv->dma, true);
 	cpsw_intr_enable(priv);
-	cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
-	cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
-
 }
 #endif
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1679 @ static int cpsw_ndo_vlan_rx_add_vid(stru
 	if (vid == priv->data.default_vlan)
 		return 0;
 
+	if (priv->data.dual_emac) {
+		/* In dual EMAC, reserved VLAN id should not be used for
+		 * creating VLAN interfaces as this can break the dual
+		 * EMAC port separation
+		 */
+		int i;
+
+		for (i = 0; i < priv->data.slaves; i++) {
+			if (vid == priv->slaves[i].port_vlan)
+				return -EINVAL;
+		}
+	}
+
 	dev_info(priv->dev, "Adding vlanid %d to vlan filter\n", vid);
 	return cpsw_add_vlan_ale_entry(priv, vid);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1705 @ static int cpsw_ndo_vlan_rx_kill_vid(str
 	if (vid == priv->data.default_vlan)
 		return 0;
 
+	if (priv->data.dual_emac) {
+		int i;
+
+		for (i = 0; i < priv->data.slaves; i++) {
+			if (vid == priv->slaves[i].port_vlan)
+				return -EINVAL;
+		}
+	}
+
 	dev_info(priv->dev, "removing vlanid %d from vlan filter\n", vid);
 	ret = cpsw_ale_del_vlan(priv->ale, vid, 0);
 	if (ret != 0)
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/ti/cpsw_ale.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/ti/cpsw_ale.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/ti/cpsw_ale.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:237 @ static void cpsw_ale_flush_mcast(struct
 		cpsw_ale_set_entry_type(ale_entry, ALE_TYPE_FREE);
 }
 
-int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask)
+int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid)
 {
 	u32 ale_entry[ALE_ENTRY_WORDS];
 	int ret, idx;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:248 @ int cpsw_ale_flush_multicast(struct cpsw
 		if (ret != ALE_TYPE_ADDR && ret != ALE_TYPE_VLAN_ADDR)
 			continue;
 
+		/* if vid passed is -1 then remove all multicast entry from
+		 * the table irrespective of vlan id, if a valid vlan id is
+		 * passed then remove only multicast added to that vlan id.
+		 * if vlan id doesn't match then move on to next entry.
+		 */
+		if (vid != -1 && cpsw_ale_get_vlan_id(ale_entry) != vid)
+			continue;
+
 		if (cpsw_ale_get_mcast(ale_entry)) {
 			u8 addr[6];
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/ethernet/ti/cpsw_ale.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ethernet/ti/cpsw_ale.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/ethernet/ti/cpsw_ale.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:95 @ void cpsw_ale_stop(struct cpsw_ale *ale)
 
 int cpsw_ale_set_ageout(struct cpsw_ale *ale, int ageout);
 int cpsw_ale_flush(struct cpsw_ale *ale, int port_mask);
-int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask);
+int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid);
 int cpsw_ale_add_ucast(struct cpsw_ale *ale, u8 *addr, int port,
 		       int flags, u16 vid);
 int cpsw_ale_del_ucast(struct cpsw_ale *ale, u8 *addr, int port,
Index: linux-3.18.13-rt10-r7s4/drivers/net/hyperv/netvsc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/hyperv/netvsc.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/hyperv/netvsc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:719 @ int netvsc_send(struct hv_device *device
 	u64 req_id;
 	unsigned int section_index = NETVSC_INVALID_INDEX;
 	u32 msg_size = 0;
-	struct sk_buff *skb;
+	struct sk_buff *skb = NULL;
 	u16 q_idx = packet->q_idx;
 
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:746 @ int netvsc_send(struct hv_device *device
 							   packet);
 			skb = (struct sk_buff *)
 			      (unsigned long)packet->send_completion_tid;
-			if (skb)
-				dev_kfree_skb_any(skb);
 			packet->page_buf_cnt = 0;
 		}
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:808 @ int netvsc_send(struct hv_device *device
 			   packet, ret);
 	}
 
+	if (ret != 0) {
+		if (section_index != NETVSC_INVALID_INDEX)
+			netvsc_free_send_slot(net_device, section_index);
+	} else if (skb) {
+		dev_kfree_skb_any(skb);
+	}
+
 	return ret;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/macvtap.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/macvtap.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/macvtap.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:640 @ static void macvtap_skb_to_vnet_hdr(cons
 	} /* else everything is zero */
 }
 
+/* Neighbour code has some assumptions on HH_DATA_MOD alignment */
+#define MACVTAP_RESERVE HH_DATA_OFF(ETH_HLEN)
+
 /* Get packet from user space buffer */
 static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
 				const struct iovec *iv, unsigned long total_len,
 				size_t count, int noblock)
 {
-	int good_linear = SKB_MAX_HEAD(NET_IP_ALIGN);
+	int good_linear = SKB_MAX_HEAD(MACVTAP_RESERVE);
 	struct sk_buff *skb;
 	struct macvlan_dev *vlan;
 	unsigned long len = total_len;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:707 @ static ssize_t macvtap_get_user(struct m
 			linear = vnet_hdr.hdr_len;
 	}
 
-	skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen,
+	skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen,
 				linear, noblock, &err);
 	if (!skb)
 		goto err;
Index: linux-3.18.13-rt10-r7s4/drivers/net/phy/phy.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/phy/phy.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/phy/phy.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:239 @ static inline unsigned int phy_find_vali
 }
 
 /**
+ * phy_check_valid - check if there is a valid PHY setting which matches
+ *		     speed, duplex, and feature mask
+ * @speed: speed to match
+ * @duplex: duplex to match
+ * @features: A mask of the valid settings
+ *
+ * Description: Returns true if there is a valid setting, false otherwise.
+ */
+static inline bool phy_check_valid(int speed, int duplex, u32 features)
+{
+	unsigned int idx;
+
+	idx = phy_find_valid(phy_find_setting(speed, duplex), features);
+
+	return settings[idx].speed == speed && settings[idx].duplex == duplex &&
+		(settings[idx].setting & features);
+}
+
+/**
  * phy_sanitize_settings - make sure the PHY is set to supported speed and duplex
  * @phydev: the target phy_device struct
  *
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1064 @ int phy_init_eee(struct phy_device *phyd
 		int eee_lp, eee_cap, eee_adv;
 		u32 lp, cap, adv;
 		int status;
-		unsigned int idx;
 
 		/* Read phy status to properly get the right settings */
 		status = phy_read_status(phydev);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1095 @ int phy_init_eee(struct phy_device *phyd
 
 		adv = mmd_eee_adv_to_ethtool_adv_t(eee_adv);
 		lp = mmd_eee_adv_to_ethtool_adv_t(eee_lp);
-		idx = phy_find_setting(phydev->speed, phydev->duplex);
-		if (!(lp & adv & settings[idx].setting))
+		if (!phy_check_valid(phydev->speed, phydev->duplex, lp & adv))
 			goto eee_exit_err;
 
 		if (clk_stop_enable) {
Index: linux-3.18.13-rt10-r7s4/drivers/net/ppp/ppp_deflate.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/ppp/ppp_deflate.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/ppp/ppp_deflate.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:249 @ static int z_compress(void *arg, unsigne
 	/*
 	 * See if we managed to reduce the size of the packet.
 	 */
-	if (olen < isize) {
+	if (olen < isize && olen <= osize) {
 		state->stats.comp_bytes += olen;
 		state->stats.comp_packets++;
 	} else {
Index: linux-3.18.13-rt10-r7s4/drivers/net/team/team.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/team/team.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/team/team.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:45 @
 
 static struct team_port *team_port_get_rcu(const struct net_device *dev)
 {
-	struct team_port *port = rcu_dereference(dev->rx_handler_data);
-
-	return team_port_exists(dev) ? port : NULL;
+	return rcu_dereference(dev->rx_handler_data);
 }
 
 static struct team_port *team_port_get_rtnl(const struct net_device *dev)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:630 @ static int team_change_mode(struct team
 static void team_notify_peers_work(struct work_struct *work)
 {
 	struct team *team;
+	int val;
 
 	team = container_of(work, struct team, notify_peers.dw.work);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:638 @ static void team_notify_peers_work(struc
 		schedule_delayed_work(&team->notify_peers.dw, 0);
 		return;
 	}
+	val = atomic_dec_if_positive(&team->notify_peers.count_pending);
+	if (val < 0) {
+		rtnl_unlock();
+		return;
+	}
 	call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, team->dev);
 	rtnl_unlock();
-	if (!atomic_dec_and_test(&team->notify_peers.count_pending))
+	if (val)
 		schedule_delayed_work(&team->notify_peers.dw,
 				      msecs_to_jiffies(team->notify_peers.interval));
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:676 @ static void team_notify_peers_fini(struc
 static void team_mcast_rejoin_work(struct work_struct *work)
 {
 	struct team *team;
+	int val;
 
 	team = container_of(work, struct team, mcast_rejoin.dw.work);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:684 @ static void team_mcast_rejoin_work(struc
 		schedule_delayed_work(&team->mcast_rejoin.dw, 0);
 		return;
 	}
+	val = atomic_dec_if_positive(&team->mcast_rejoin.count_pending);
+	if (val < 0) {
+		rtnl_unlock();
+		return;
+	}
 	call_netdevice_notifiers(NETDEV_RESEND_IGMP, team->dev);
 	rtnl_unlock();
-	if (!atomic_dec_and_test(&team->mcast_rejoin.count_pending))
+	if (val)
 		schedule_delayed_work(&team->mcast_rejoin.dw,
 				      msecs_to_jiffies(team->mcast_rejoin.interval));
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1736 @ static int team_set_mac_address(struct n
 	if (dev->type == ARPHRD_ETHER && !is_valid_ether_addr(addr->sa_data))
 		return -EADDRNOTAVAIL;
 	memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
-	rcu_read_lock();
-	list_for_each_entry_rcu(port, &team->port_list, list)
+	mutex_lock(&team->lock);
+	list_for_each_entry(port, &team->port_list, list)
 		if (team->ops.port_change_dev_addr)
 			team->ops.port_change_dev_addr(team, port);
-	rcu_read_unlock();
+	mutex_unlock(&team->lock);
 	return 0;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/usb/asix_common.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/usb/asix_common.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/usb/asix_common.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:191 @ struct sk_buff *asix_tx_fixup(struct usb
 		memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
 		skb_put(skb, sizeof(padbytes));
 	}
+
+	usbnet_set_skb_tx_stats(skb, 1, 0);
 	return skb;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/usb/cdc_mbim.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/usb/cdc_mbim.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/usb/cdc_mbim.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:405 @ static struct sk_buff *cdc_mbim_process_
 
 	/* map MBIM session to VLAN */
 	if (tci)
-		vlan_put_tag(skb, htons(ETH_P_8021Q), tci);
+		__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), tci);
 err:
 	return skb;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/net/usb/cdc_ncm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/usb/cdc_ncm.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/usb/cdc_ncm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1175 @ cdc_ncm_fill_tx_frame(struct usbnet *dev
 
 	/* return skb */
 	ctx->tx_curr_skb = NULL;
-	dev->net->stats.tx_packets += ctx->tx_curr_frame_num;
 
 	/* keep private stats: framing overhead and number of NTBs */
 	ctx->tx_overhead += skb_out->len - ctx->tx_curr_frame_payload;
 	ctx->tx_ntbs++;
 
-	/* usbnet has already counted all the framing overhead.
+	/* usbnet will count all the framing overhead by default.
 	 * Adjust the stats so that the tx_bytes counter show real
 	 * payload data instead.
 	 */
-	dev->net->stats.tx_bytes -= skb_out->len - ctx->tx_curr_frame_payload;
+	usbnet_set_skb_tx_stats(skb_out, n,
+				ctx->tx_curr_frame_payload - skb_out->len);
 
 	return skb_out;
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/usb/cx82310_eth.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/usb/cx82310_eth.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/usb/cx82310_eth.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:303 @ static const struct driver_info	cx82310_
 	.tx_fixup	= cx82310_tx_fixup,
 };
 
+#define USB_DEVICE_CLASS(vend, prod, cl, sc, pr) \
+	.match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
+		       USB_DEVICE_ID_MATCH_DEV_INFO, \
+	.idVendor = (vend), \
+	.idProduct = (prod), \
+	.bDeviceClass = (cl), \
+	.bDeviceSubClass = (sc), \
+	.bDeviceProtocol = (pr)
+
 static const struct usb_device_id products[] = {
 	{
-		USB_DEVICE_AND_INTERFACE_INFO(0x0572, 0xcb01, 0xff, 0, 0),
+		USB_DEVICE_CLASS(0x0572, 0xcb01, 0xff, 0, 0),
 		.driver_info = (unsigned long) &cx82310_info
 	},
 	{ },
Index: linux-3.18.13-rt10-r7s4/drivers/net/usb/plusb.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/usb/plusb.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/usb/plusb.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:137 @ static const struct usb_device_id	produc
 }, {
 	USB_DEVICE(0x050d, 0x258a),     /* Belkin F5U258/F5U279 (PL-25A1) */
 	.driver_info =  (unsigned long) &prolific_info,
+}, {
+	USB_DEVICE(0x3923, 0x7825),     /* National Instruments USB
+					 * Host-to-Host Cable
+					 */
+	.driver_info =  (unsigned long) &prolific_info,
 },
 
 	{ },		// END
Index: linux-3.18.13-rt10-r7s4/drivers/net/usb/sr9800.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/usb/sr9800.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/usb/sr9800.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:147 @ static struct sk_buff *sr_tx_fixup(struc
 		skb_put(skb, sizeof(padbytes));
 	}
 
+	usbnet_set_skb_tx_stats(skb, 1, 0);
 	return skb;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/usb/usbnet.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/usb/usbnet.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/usb/usbnet.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1192 @ static void tx_complete (struct urb *urb
 	struct usbnet		*dev = entry->dev;
 
 	if (urb->status == 0) {
-		if (!(dev->driver_info->flags & FLAG_MULTI_PACKET))
-			dev->net->stats.tx_packets++;
+		dev->net->stats.tx_packets += entry->packets;
 		dev->net->stats.tx_bytes += entry->length;
 	} else {
 		dev->net->stats.tx_errors++;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1350 @ netdev_tx_t usbnet_start_xmit (struct sk
 		} else
 			urb->transfer_flags |= URB_ZERO_PACKET;
 	}
-	entry->length = urb->transfer_buffer_length = length;
+	urb->transfer_buffer_length = length;
+
+	if (info->flags & FLAG_MULTI_PACKET) {
+		/* Driver has set number of packets and a length delta.
+		 * Calculate the complete length and ensure that it's
+		 * positive.
+		 */
+		entry->length += length;
+		if (WARN_ON_ONCE(entry->length <= 0))
+			entry->length = length;
+	} else {
+		usbnet_set_skb_tx_stats(skb, 1, length);
+	}
 
 	spin_lock_irqsave(&dev->txq.lock, flags);
 	retval = usb_autopm_get_interface_async(dev->intf);
Index: linux-3.18.13-rt10-r7s4/drivers/net/virtio_net.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/virtio_net.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/virtio_net.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1455 @ static void virtnet_free_queues(struct v
 {
 	int i;
 
-	for (i = 0; i < vi->max_queue_pairs; i++)
+	for (i = 0; i < vi->max_queue_pairs; i++) {
+		napi_hash_del(&vi->rq[i].napi);
 		netif_napi_del(&vi->rq[i].napi);
+	}
 
 	kfree(vi->rq);
 	kfree(vi->sq);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1944 @ static int virtnet_freeze(struct virtio_
 	cancel_delayed_work_sync(&vi->refill);
 
 	if (netif_running(vi->dev)) {
-		for (i = 0; i < vi->max_queue_pairs; i++) {
+		for (i = 0; i < vi->max_queue_pairs; i++)
 			napi_disable(&vi->rq[i].napi);
-			napi_hash_del(&vi->rq[i].napi);
-			netif_napi_del(&vi->rq[i].napi);
-		}
 	}
 
 	remove_vq_common(vi);
Index: linux-3.18.13-rt10-r7s4/drivers/net/vxlan.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/vxlan.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/vxlan.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1581 @ static int vxlan6_xmit_skb(struct vxlan_
 	int err;
 	bool udp_sum = !udp_get_no_check6_tx(vs->sock->sk);
 
-	skb = udp_tunnel_handle_offloads(skb, udp_sum);
-	if (IS_ERR(skb))
-		return -EINVAL;
-
 	skb_scrub_packet(skb, xnet);
 
 	min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1589 @ static int vxlan6_xmit_skb(struct vxlan_
 
 	/* Need space for new headers (invalidates iph ptr) */
 	err = skb_cow_head(skb, min_headroom);
-	if (unlikely(err))
-		return err;
+	if (unlikely(err)) {
+		kfree_skb(skb);
+		goto err;
+	}
 
-	if (vlan_tx_tag_present(skb)) {
-		if (WARN_ON(!__vlan_put_tag(skb,
-					    skb->vlan_proto,
-					    vlan_tx_tag_get(skb))))
-			return -ENOMEM;
+	skb = vlan_hwaccel_push_inside(skb);
+	if (WARN_ON(!skb)) {
+		err = -ENOMEM;
+		goto err;
+	}
 
-		skb->vlan_tci = 0;
+	skb = udp_tunnel_handle_offloads(skb, udp_sum);
+	if (IS_ERR(skb)) {
+		err = -EINVAL;
+		goto err;
 	}
 
 	vxh = (struct vxlanhdr *) __skb_push(skb, sizeof(*vxh));
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1615 @ static int vxlan6_xmit_skb(struct vxlan_
 	udp_tunnel6_xmit_skb(vs->sock, dst, skb, dev, saddr, daddr, prio,
 			     ttl, src_port, dst_port);
 	return 0;
+err:
+	dst_release(dst);
+	return err;
 }
 #endif
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1631 @ int vxlan_xmit_skb(struct vxlan_sock *vs
 	int err;
 	bool udp_sum = !vs->sock->sk->sk_no_check_tx;
 
-	skb = udp_tunnel_handle_offloads(skb, udp_sum);
-	if (IS_ERR(skb))
-		return -EINVAL;
-
 	min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len
 			+ VXLAN_HLEN + sizeof(struct iphdr)
 			+ (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
 
 	/* Need space for new headers (invalidates iph ptr) */
 	err = skb_cow_head(skb, min_headroom);
-	if (unlikely(err))
+	if (unlikely(err)) {
+		kfree_skb(skb);
 		return err;
+	}
 
-	if (vlan_tx_tag_present(skb)) {
-		if (WARN_ON(!__vlan_put_tag(skb,
-					    skb->vlan_proto,
-					    vlan_tx_tag_get(skb))))
-			return -ENOMEM;
+	skb = vlan_hwaccel_push_inside(skb);
+	if (WARN_ON(!skb))
+		return -ENOMEM;
 
-		skb->vlan_tci = 0;
-	}
+	skb = udp_tunnel_handle_offloads(skb, udp_sum);
+	if (IS_ERR(skb))
+		return PTR_ERR(skb);
 
 	vxh = (struct vxlanhdr *) __skb_push(skb, sizeof(*vxh));
 	vxh->vx_flags = htonl(VXLAN_FLAGS);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1790 @ static void vxlan_xmit_one(struct sk_buf
 				     tos, ttl, df, src_port, dst_port,
 				     htonl(vni << 8),
 				     !net_eq(vxlan->net, dev_net(vxlan->dev)));
-
-		if (err < 0)
+		if (err < 0) {
+			/* skb is already freed. */
+			skb = NULL;
 			goto rt_tx_error;
+		}
+
 		iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
 #if IS_ENABLED(CONFIG_IPV6)
 	} else {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2002 @ static int vxlan_init(struct net_device
 	spin_lock(&vn->sock_lock);
 	vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET,
 			     vxlan->dst_port);
-	if (vs) {
+	if (vs && atomic_add_unless(&vs->refcnt, 1, 0)) {
 		/* If we have a socket with same port already, reuse it */
-		atomic_inc(&vs->refcnt);
 		vxlan_vs_add_dev(vs, vxlan);
 	} else {
 		/* otherwise make new socket outside of RTNL */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2402 @ struct vxlan_sock *vxlan_sock_add(struct
 
 	spin_lock(&vn->sock_lock);
 	vs = vxlan_find_sock(net, ipv6 ? AF_INET6 : AF_INET, port);
-	if (vs) {
-		if (vs->rcv == rcv)
-			atomic_inc(&vs->refcnt);
-		else
+	if (vs && ((vs->rcv != rcv) ||
+		   !atomic_add_unless(&vs->refcnt, 1, 0)))
 			vs = ERR_PTR(-EBUSY);
-	}
 	spin_unlock(&vn->sock_lock);
 
 	if (!vs)
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/ath/ath5k/qcu.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/ath/ath5k/qcu.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/ath/ath5k/qcu.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:228 @ ath5k_hw_setup_tx_queue(struct ath5k_hw
 	} else {
 		switch (queue_type) {
 		case AR5K_TX_QUEUE_DATA:
-			for (queue = AR5K_TX_QUEUE_ID_DATA_MIN;
-				ah->ah_txq[queue].tqi_type !=
-				AR5K_TX_QUEUE_INACTIVE; queue++) {
-
-				if (queue > AR5K_TX_QUEUE_ID_DATA_MAX)
-					return -EINVAL;
-			}
+			queue = queue_info->tqi_subtype;
 			break;
 		case AR5K_TX_QUEUE_UAPSD:
 			queue = AR5K_TX_QUEUE_ID_UAPSD;
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/ath/ath5k/reset.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/ath/ath5k/reset.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/ath/ath5k/reset.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:481 @ ath5k_hw_wisoc_reset(struct ath5k_hw *ah
 	regval = ioread32(reg);
 	iowrite32(regval | val, reg);
 	regval = ioread32(reg);
-	usleep_range(100, 150);
+	udelay(100);	/* NB: should be atomic */
 
 	/* Bring BB/MAC out of reset */
 	iowrite32(regval & ~val, reg);
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/ath/ath9k/beacon.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/ath/ath9k/beacon.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/ath/ath9k/beacon.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:221 @ void ath9k_beacon_remove_slot(struct ath
 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 	struct ath_vif *avp = (void *)vif->drv_priv;
 	struct ath_buf *bf = avp->av_bcbuf;
+	struct ath_beacon_config *cur_conf = &sc->cur_chan->beacon;
 
 	ath_dbg(common, CONFIG, "Removing interface at beacon slot: %d\n",
 		avp->av_bslot);
 
 	tasklet_disable(&sc->bcon_tasklet);
 
+	cur_conf->enable_beacon &= ~BIT(avp->av_bslot);
+
 	if (bf && bf->bf_mpdu) {
 		struct sk_buff *skb = bf->bf_mpdu;
 		dma_unmap_single(sc->dev, bf->bf_buf_addr,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:526 @ static bool ath9k_allow_beacon_config(st
 	}
 
 	if (sc->sc_ah->opmode == NL80211_IFTYPE_AP) {
-		if ((vif->type != NL80211_IFTYPE_AP) ||
-		    (sc->nbcnvifs > 1)) {
+		if (vif->type != NL80211_IFTYPE_AP) {
 			ath_dbg(common, CONFIG,
 				"An AP interface is already present !\n");
 			return false;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:620 @ void ath9k_beacon_config(struct ath_soft
 	 * enabling/disabling SWBA.
 	 */
 	if (changed & BSS_CHANGED_BEACON_ENABLED) {
-		if (!bss_conf->enable_beacon &&
-		    (sc->nbcnvifs <= 1)) {
-			cur_conf->enable_beacon = false;
-		} else if (bss_conf->enable_beacon) {
-			cur_conf->enable_beacon = true;
-			ath9k_cache_beacon_config(sc, ctx, bss_conf);
+		bool enabled = cur_conf->enable_beacon;
+
+		if (!bss_conf->enable_beacon) {
+			cur_conf->enable_beacon &= ~BIT(avp->av_bslot);
+		} else {
+			cur_conf->enable_beacon |= BIT(avp->av_bslot);
+			if (!enabled)
+				ath9k_cache_beacon_config(sc, ctx, bss_conf);
 		}
 	}
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/ath/ath9k/common.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/ath/ath9k/common.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/ath/ath9k/common.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:56 @ struct ath_beacon_config {
 	u16 dtim_period;
 	u16 bmiss_timeout;
 	u8 dtim_count;
-	bool enable_beacon;
+	u8 enable_beacon;
 	bool ibss_creator;
 	u32 nexttbtt;
 	u32 intval;
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/ath/ath9k/hw.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/ath/ath9k/hw.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/ath/ath9k/hw.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:220 @
 #define AH_WOW_BEACON_MISS		BIT(3)
 
 enum ath_hw_txq_subtype {
-	ATH_TXQ_AC_BE = 0,
-	ATH_TXQ_AC_BK = 1,
+	ATH_TXQ_AC_BK = 0,
+	ATH_TXQ_AC_BE = 1,
 	ATH_TXQ_AC_VI = 2,
 	ATH_TXQ_AC_VO = 3,
 };
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/ath/ath9k/mac.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/ath/ath9k/mac.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/ath/ath9k/mac.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:314 @ int ath9k_hw_setuptxqueue(struct ath_hw
 		q = ATH9K_NUM_TX_QUEUES - 3;
 		break;
 	case ATH9K_TX_QUEUE_DATA:
-		for (q = 0; q < ATH9K_NUM_TX_QUEUES; q++)
-			if (ah->txq[q].tqi_type ==
-			    ATH9K_TX_QUEUE_INACTIVE)
-				break;
-		if (q == ATH9K_NUM_TX_QUEUES) {
-			ath_err(common, "No available TX queue\n");
-			return -1;
-		}
+		q = qinfo->tqi_subtype;
 		break;
 	default:
 		ath_err(common, "Invalid TX queue type: %u\n", type);
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1084 @ brcmf_msgbuf_rx_skb(struct brcmf_msgbuf
 {
 	struct brcmf_if *ifp;
 
+	/* The ifidx is the idx to map to matching netdev/ifp. When receiving
+	 * events this is easy because it contains the bssidx which maps
+	 * 1-on-1 to the netdev/ifp. But for data frames the ifidx is rcvd.
+	 * bssidx 1 is used for p2p0 and no data can be received or
+	 * transmitted on it. Therefor bssidx is ifidx + 1 if ifidx > 0
+	 */
+	if (ifidx)
+		(ifidx)++;
 	ifp = msgbuf->drvr->iflist[ifidx];
 	if (!ifp || !ifp->ndev) {
+		brcmf_err("Received pkt for invalid ifidx %d\n", ifidx);
 		brcmu_pkt_buf_free_skb(skb);
 		return;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1367 @ int brcmf_proto_msgbuf_attach(struct brc
 	}
 	INIT_WORK(&msgbuf->txflow_work, brcmf_msgbuf_txflow_worker);
 	count = BITS_TO_LONGS(if_msgbuf->nrof_flowrings);
+	count = count * sizeof(unsigned long);
 	msgbuf->flow_map = kzalloc(count, GFP_KERNEL);
 	if (!msgbuf->flow_map)
 		goto fail;
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/dvm/commands.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/iwlwifi/dvm/commands.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/dvm/commands.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:969 @ struct iwl_rem_sta_cmd {
 
 
 /* WiFi queues mask */
-#define IWL_SCD_BK_MSK			cpu_to_le32(BIT(0))
-#define IWL_SCD_BE_MSK			cpu_to_le32(BIT(1))
-#define IWL_SCD_VI_MSK			cpu_to_le32(BIT(2))
-#define IWL_SCD_VO_MSK			cpu_to_le32(BIT(3))
-#define IWL_SCD_MGMT_MSK		cpu_to_le32(BIT(3))
+#define IWL_SCD_BK_MSK			BIT(0)
+#define IWL_SCD_BE_MSK			BIT(1)
+#define IWL_SCD_VI_MSK			BIT(2)
+#define IWL_SCD_VO_MSK			BIT(3)
+#define IWL_SCD_MGMT_MSK		BIT(3)
 
 /* PAN queues mask */
-#define IWL_PAN_SCD_BK_MSK		cpu_to_le32(BIT(4))
-#define IWL_PAN_SCD_BE_MSK		cpu_to_le32(BIT(5))
-#define IWL_PAN_SCD_VI_MSK		cpu_to_le32(BIT(6))
-#define IWL_PAN_SCD_VO_MSK		cpu_to_le32(BIT(7))
-#define IWL_PAN_SCD_MGMT_MSK		cpu_to_le32(BIT(7))
-#define IWL_PAN_SCD_MULTICAST_MSK	cpu_to_le32(BIT(8))
+#define IWL_PAN_SCD_BK_MSK		BIT(4)
+#define IWL_PAN_SCD_BE_MSK		BIT(5)
+#define IWL_PAN_SCD_VI_MSK		BIT(6)
+#define IWL_PAN_SCD_VO_MSK		BIT(7)
+#define IWL_PAN_SCD_MGMT_MSK		BIT(7)
+#define IWL_PAN_SCD_MULTICAST_MSK	BIT(8)
 
-#define IWL_AGG_TX_QUEUE_MSK		cpu_to_le32(0xffc00)
+#define IWL_AGG_TX_QUEUE_MSK		0xffc00
 
 #define IWL_DROP_ALL			BIT(1)
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1008 @ struct iwl_rem_sta_cmd {
  *	1: Dump multiple MSDU according to PS, INVALID STA, TTL, TID disable.
  *	2: Dump all FIFO
  */
-struct iwl_txfifo_flush_cmd {
+struct iwl_txfifo_flush_cmd_v3 {
 	__le32 queue_control;
 	__le16 flush_control;
 	__le16 reserved;
 } __packed;
 
+struct iwl_txfifo_flush_cmd_v2 {
+	__le16 queue_control;
+	__le16 flush_control;
+} __packed;
+
 /*
  * REPLY_WEP_KEY = 0x20
  */
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/dvm/dev.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/iwlwifi/dvm/dev.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/dvm/dev.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:711 @ struct iwl_priv {
 	unsigned long reload_jiffies;
 	int reload_count;
 	bool ucode_loaded;
-	bool init_ucode_run;		/* Don't run init uCode again */
 
 	u8 plcp_delta_threshold;
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/dvm/lib.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/iwlwifi/dvm/lib.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/dvm/lib.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:140 @ int iwlagn_manage_ibss_station(struct iw
  */
 int iwlagn_txfifo_flush(struct iwl_priv *priv, u32 scd_q_msk)
 {
-	struct iwl_txfifo_flush_cmd flush_cmd;
-	struct iwl_host_cmd cmd = {
-		.id = REPLY_TXFIFO_FLUSH,
-		.len = { sizeof(struct iwl_txfifo_flush_cmd), },
-		.data = { &flush_cmd, },
+	struct iwl_txfifo_flush_cmd_v3 flush_cmd_v3 = {
+		.flush_control = cpu_to_le16(IWL_DROP_ALL),
+	};
+	struct iwl_txfifo_flush_cmd_v2 flush_cmd_v2 = {
+		.flush_control = cpu_to_le16(IWL_DROP_ALL),
 	};
 
-	memset(&flush_cmd, 0, sizeof(flush_cmd));
+	u32 queue_control = IWL_SCD_VO_MSK | IWL_SCD_VI_MSK |
+			    IWL_SCD_BE_MSK | IWL_SCD_BK_MSK | IWL_SCD_MGMT_MSK;
 
-	flush_cmd.queue_control = IWL_SCD_VO_MSK | IWL_SCD_VI_MSK |
-				  IWL_SCD_BE_MSK | IWL_SCD_BK_MSK |
-				  IWL_SCD_MGMT_MSK;
 	if ((priv->valid_contexts != BIT(IWL_RXON_CTX_BSS)))
-		flush_cmd.queue_control |= IWL_PAN_SCD_VO_MSK |
-					   IWL_PAN_SCD_VI_MSK |
-					   IWL_PAN_SCD_BE_MSK |
-					   IWL_PAN_SCD_BK_MSK |
-					   IWL_PAN_SCD_MGMT_MSK |
-					   IWL_PAN_SCD_MULTICAST_MSK;
+		queue_control |= IWL_PAN_SCD_VO_MSK | IWL_PAN_SCD_VI_MSK |
+				 IWL_PAN_SCD_BE_MSK | IWL_PAN_SCD_BK_MSK |
+				 IWL_PAN_SCD_MGMT_MSK |
+				 IWL_PAN_SCD_MULTICAST_MSK;
 
 	if (priv->nvm_data->sku_cap_11n_enable)
-		flush_cmd.queue_control |= IWL_AGG_TX_QUEUE_MSK;
+		queue_control |= IWL_AGG_TX_QUEUE_MSK;
 
 	if (scd_q_msk)
-		flush_cmd.queue_control = cpu_to_le32(scd_q_msk);
-
-	IWL_DEBUG_INFO(priv, "queue control: 0x%x\n",
-		       flush_cmd.queue_control);
-	flush_cmd.flush_control = cpu_to_le16(IWL_DROP_ALL);
+		queue_control = scd_q_msk;
 
-	return iwl_dvm_send_cmd(priv, &cmd);
+	IWL_DEBUG_INFO(priv, "queue control: 0x%x\n", queue_control);
+	flush_cmd_v3.queue_control = cpu_to_le32(queue_control);
+	flush_cmd_v2.queue_control = cpu_to_le16((u16)queue_control);
+
+	if (IWL_UCODE_API(priv->fw->ucode_ver) > 2)
+		return iwl_dvm_send_cmd_pdu(priv, REPLY_TXFIFO_FLUSH, 0,
+					    sizeof(flush_cmd_v3),
+					    &flush_cmd_v3);
+	return iwl_dvm_send_cmd_pdu(priv, REPLY_TXFIFO_FLUSH, 0,
+				    sizeof(flush_cmd_v2), &flush_cmd_v2);
 }
 
 void iwlagn_dev_txfifo_flush(struct iwl_priv *priv)
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/dvm/ucode.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/dvm/ucode.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:421 @ int iwl_run_init_ucode(struct iwl_priv *
 	if (!priv->fw->img[IWL_UCODE_INIT].sec[0].len)
 		return 0;
 
-	if (priv->init_ucode_run)
-		return 0;
-
 	iwl_init_notification_wait(&priv->notif_wait, &calib_wait,
 				   calib_complete, ARRAY_SIZE(calib_complete),
 				   iwlagn_wait_calib, priv);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:440 @ int iwl_run_init_ucode(struct iwl_priv *
 	 */
 	ret = iwl_wait_notification(&priv->notif_wait, &calib_wait,
 					UCODE_CALIB_TIMEOUT);
-	if (!ret)
-		priv->init_ucode_run = true;
 
 	goto out;
 
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:675 @ struct iwl_scan_channel_opt {
  * @IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED: all passive scans will be fragmented
  * @IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED: insert WFA vendor-specific TPC report
  *	and DS parameter set IEs into probe requests.
+ * @IWL_MVM_LMAC_SCAN_FLAG_MATCH: Send match found notification on matches
  */
 enum iwl_mvm_lmac_scan_flags {
 	IWL_MVM_LMAC_SCAN_FLAG_PASS_ALL		= BIT(0),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:685 @ enum iwl_mvm_lmac_scan_flags {
 	IWL_MVM_LMAC_SCAN_FLAG_MULTIPLE_SSIDS	= BIT(4),
 	IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED	= BIT(5),
 	IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED	= BIT(6),
+	IWL_MVM_LMAC_SCAN_FLAG_MATCH		= BIT(9),
 };
 
 enum iwl_scan_priority {
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/mvm/fw-api.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1592 @ enum iwl_sf_scenario {
 #define SF_NUM_TIMEOUT_TYPES 2		/* Aging timer and Idle timer */
 
 /* smart FIFO default values */
-#define SF_W_MARK_SISO 4096
+#define SF_W_MARK_SISO 6144
 #define SF_W_MARK_MIMO2 8192
 #define SF_W_MARK_MIMO3 6144
 #define SF_W_MARK_LEGACY 4096
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/mvm/mac80211.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:671 @ static void iwl_mvm_cleanup_iterator(voi
 	mvmvif->uploaded = false;
 	mvmvif->ap_sta_id = IWL_MVM_STATION_COUNT;
 
-	/* does this make sense at all? */
-	mvmvif->color++;
-
 	spin_lock_bh(&mvm->time_event_lock);
 	iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
 	spin_unlock_bh(&mvm->time_event_lock);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1014 @ static int iwl_mvm_mac_add_interface(str
 
 	ret = iwl_mvm_power_update_mac(mvm);
 	if (ret)
-		goto out_release;
+		goto out_remove_mac;
 
 	/* beacon filtering */
 	ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/mvm/scan.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/mvm/scan.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1337 @ int iwl_mvm_unified_sched_scan_lmac(stru
 		IWL_DEBUG_SCAN(mvm,
 			       "Sending scheduled scan with filtering, n_match_sets %d\n",
 			       req->n_match_sets);
+		flags |= IWL_MVM_LMAC_SCAN_FLAG_MATCH;
 	} else {
 		IWL_DEBUG_SCAN(mvm,
 			       "Sending Scheduled scan without filtering\n");
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/mvm/tx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/mvm/tx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:905 @ int iwl_mvm_rx_ba_notif(struct iwl_mvm *
 	sta_id = ba_notif->sta_id;
 	tid = ba_notif->tid;
 
+	if (WARN_ONCE(sta_id >= IWL_MVM_STATION_COUNT ||
+		      tid >= IWL_MAX_TID_COUNT,
+		      "sta_id %d tid %d", sta_id, tid))
+		return 0;
+
 	rcu_read_lock();
 
 	sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/mvm/utils.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/mvm/utils.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:668 @ bool iwl_mvm_rx_diversity_allowed(struct
 	if (num_of_ant(mvm->fw->valid_rx_ant) == 1)
 		return false;
 
-	if (!mvm->cfg->rx_with_siso_diversity)
+	if (mvm->cfg->rx_with_siso_diversity)
 		return false;
 
 	ieee80211_iterate_active_interfaces_atomic(
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/pcie/drv.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/pcie/drv.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:370 @ static const struct pci_device_id iwl_hw
 
 /* 3165 Series */
 	{IWL_PCI_DEVICE(0x3165, 0x4010, iwl3165_2ac_cfg)},
+	{IWL_PCI_DEVICE(0x3165, 0x4012, iwl3165_2ac_cfg)},
+	{IWL_PCI_DEVICE(0x3165, 0x4110, iwl3165_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x3165, 0x4210, iwl3165_2ac_cfg)},
+	{IWL_PCI_DEVICE(0x3165, 0x4410, iwl3165_2ac_cfg)},
+	{IWL_PCI_DEVICE(0x3165, 0x4510, iwl3165_2ac_cfg)},
 
 /* 7265 Series */
 	{IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/pcie/tx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/iwlwifi/pcie/tx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:725 @ void iwl_trans_pcie_tx_reset(struct iwl_
 	iwl_write_direct32(trans, FH_KW_MEM_ADDR_REG,
 			   trans_pcie->kw.dma >> 4);
 
-	iwl_pcie_tx_start(trans, trans_pcie->scd_base_addr);
+	/*
+	 * Send 0 as the scd_base_addr since the device may have be reset
+	 * while we were in WoWLAN in which case SCD_SRAM_BASE_ADDR will
+	 * contain garbage.
+	 */
+	iwl_pcie_tx_start(trans, 0);
 }
 
 /*
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/base.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/rtlwifi/base.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/base.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1317 @ u8 rtl_is_special_data(struct ieee80211_
 		}
 
 		return true;
-	} else if (0x86DD == ether_type) {
-		return true;
+	} else if (ETH_P_IPV6 == ether_type) {
+		/* TODO: Handle any IPv6 cases that need special handling.
+		 * For now, always return false
+		 */
+		goto end;
 	}
 
 end:
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/pci.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/rtlwifi/pci.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/pci.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:669 @ tx_status_ok:
 }
 
 static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
-				    u8 *entry, int rxring_idx, int desc_idx)
+				    struct sk_buff *new_skb, u8 *entry,
+				    int rxring_idx, int desc_idx)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:678 @ static int _rtl_pci_init_one_rxdesc(stru
 	u8 tmp_one = 1;
 	struct sk_buff *skb;
 
+	if (likely(new_skb)) {
+		skb = new_skb;
+		goto remap;
+	}
 	skb = dev_alloc_skb(rtlpci->rxbuffersize);
 	if (!skb)
 		return 0;
-	rtlpci->rx_ring[rxring_idx].rx_buf[desc_idx] = skb;
 
+remap:
 	/* just set skb->cb to mapping addr for pci_unmap_single use */
 	*((dma_addr_t *)skb->cb) =
 		pci_map_single(rtlpci->pdev, skb_tail_pointer(skb),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:694 @ static int _rtl_pci_init_one_rxdesc(stru
 	bufferaddress = *((dma_addr_t *)skb->cb);
 	if (pci_dma_mapping_error(rtlpci->pdev, bufferaddress))
 		return 0;
+	rtlpci->rx_ring[rxring_idx].rx_buf[desc_idx] = skb;
 	if (rtlpriv->use_new_trx_flow) {
 		rtlpriv->cfg->ops->set_desc(hw, (u8 *)entry, false,
 					    HW_DESC_RX_PREPARE,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:790 @ static void _rtl_pci_rx_interrupt(struct
 		/*rx pkt */
 		struct sk_buff *skb = rtlpci->rx_ring[rxring_idx].rx_buf[
 				      rtlpci->rx_ring[rxring_idx].idx];
+		struct sk_buff *new_skb;
 
 		if (rtlpriv->use_new_trx_flow) {
 			rx_remained_cnt =
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:817 @ static void _rtl_pci_rx_interrupt(struct
 		pci_unmap_single(rtlpci->pdev, *((dma_addr_t *)skb->cb),
 				 rtlpci->rxbuffersize, PCI_DMA_FROMDEVICE);
 
+		/* get a new skb - if fail, old one will be reused */
+		new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
+		if (unlikely(!new_skb))
+			goto no_new;
 		if (rtlpriv->use_new_trx_flow) {
 			buffer_desc =
 			  &rtlpci->rx_ring[rxring_idx].buffer_desc
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:925 @ static void _rtl_pci_rx_interrupt(struct
 			schedule_work(&rtlpriv->works.lps_change_work);
 		}
 end:
+		skb = new_skb;
+no_new:
 		if (rtlpriv->use_new_trx_flow) {
-			_rtl_pci_init_one_rxdesc(hw, (u8 *)buffer_desc,
+			_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc,
 						 rxring_idx,
-					       rtlpci->rx_ring[rxring_idx].idx);
+						 rtlpci->rx_ring[rxring_idx].idx);
 		} else {
-			_rtl_pci_init_one_rxdesc(hw, (u8 *)pdesc, rxring_idx,
+			_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc,
+						 rxring_idx,
 						 rtlpci->rx_ring[rxring_idx].idx);
-
 			if (rtlpci->rx_ring[rxring_idx].idx ==
 			    rtlpci->rxringcount - 1)
 				rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1121 @ static void _rtl_pci_prepare_bcn_tasklet
 	/*This is for new trx flow*/
 	struct rtl_tx_buffer_desc *pbuffer_desc = NULL;
 	u8 temp_one = 1;
+	u8 *entry;
 
 	memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
 	ring = &rtlpci->tx_ring[BEACON_QUEUE];
 	pskb = __skb_dequeue(&ring->queue);
-	if (pskb)
+	if (rtlpriv->use_new_trx_flow)
+		entry = (u8 *)(&ring->buffer_desc[ring->idx]);
+	else
+		entry = (u8 *)(&ring->desc[ring->idx]);
+	if (pskb) {
+		pci_unmap_single(rtlpci->pdev,
+				 rtlpriv->cfg->ops->get_desc(
+				 (u8 *)entry, true, HW_DESC_TXBUFF_ADDR),
+				 pskb->len, PCI_DMA_TODEVICE);
 		kfree_skb(pskb);
+	}
 
 	/*NB: the beacon data buffer must be 32-bit aligned. */
 	pskb = ieee80211_beacon_get(hw, mac->vif);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1333 @ static int _rtl_pci_init_rx_ring(struct
 		rtlpci->rx_ring[rxring_idx].idx = 0;
 		for (i = 0; i < rtlpci->rxringcount; i++) {
 			entry = &rtlpci->rx_ring[rxring_idx].buffer_desc[i];
-			if (!_rtl_pci_init_one_rxdesc(hw, (u8 *)entry,
+			if (!_rtl_pci_init_one_rxdesc(hw, NULL, (u8 *)entry,
 						      rxring_idx, i))
 				return -ENOMEM;
 		}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1358 @ static int _rtl_pci_init_rx_ring(struct
 
 		for (i = 0; i < rtlpci->rxringcount; i++) {
 			entry = &rtlpci->rx_ring[rxring_idx].desc[i];
-			if (!_rtl_pci_init_one_rxdesc(hw, (u8 *)entry,
+			if (!_rtl_pci_init_one_rxdesc(hw, NULL, (u8 *)entry,
 						      rxring_idx, i))
 				return -ENOMEM;
 		}
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/pci.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/rtlwifi/pci.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/pci.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:328 @ static inline void pci_write32_async(str
 	writel(val, (u8 __iomem *) rtlpriv->io.pci_mem_start + addr);
 }
 
+static inline u16 calc_fifo_space(u16 rp, u16 wp)
+{
+	if (rp <= wp)
+		return RTL_PCI_MAX_RX_COUNT - 1 + rp - wp;
+	return rp - wp - 1;
+}
+
 #endif
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:958 @ int rtl92ce_hw_init(struct ieee80211_hw
 	local_save_flags(flags);
 	local_irq_enable();
 
+	rtlhal->fw_ready = false;
 	rtlpriv->intf_ops->disable_aspm(hw);
 	rtstatus = _rtl92ce_init_mac(hw);
 	if (!rtstatus) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:975 @ int rtl92ce_hw_init(struct ieee80211_hw
 		goto exit;
 	}
 
+	rtlhal->fw_ready = true;
 	rtlhal->last_hmeboxnum = 0;
 	rtl92c_phy_mac_config(hw);
 	/* because last function modify RCR, so we update
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1292 @ void rtl92ce_enable_interrupt(struct iee
 
 	rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
 	rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
+	rtlpci->irq_enabled = true;
 }
 
 void rtl92ce_disable_interrupt(struct ieee80211_hw *hw)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1302 @ void rtl92ce_disable_interrupt(struct ie
 
 	rtl_write_dword(rtlpriv, REG_HIMR, IMR8190_DISABLED);
 	rtl_write_dword(rtlpriv, REG_HIMRE, IMR8190_DISABLED);
-	synchronize_irq(rtlpci->pdev->irq);
+	rtlpci->irq_enabled = false;
 }
 
 static void _rtl92ce_poweroff_adapter(struct ieee80211_hw *hw)
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:231 @ static struct rtl_hal_ops rtl8192ce_hal_
 	.led_control = rtl92ce_led_control,
 	.set_desc = rtl92ce_set_desc,
 	.get_desc = rtl92ce_get_desc,
+	.is_tx_desc_closed = rtl92ce_is_tx_desc_closed,
 	.tx_polling = rtl92ce_tx_polling,
 	.enable_hw_sec = rtl92ce_enable_hw_security_config,
 	.set_key = rtl92ce_set_key,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:275 @ static struct rtl_hal_cfg rtl92ce_hal_cf
 	.maps[MAC_RCR_ACRC32] = ACRC32,
 	.maps[MAC_RCR_ACF] = ACF,
 	.maps[MAC_RCR_AAP] = AAP,
+	.maps[MAC_HIMR] = REG_HIMR,
+	.maps[MAC_HIMRE] = REG_HIMRE,
 
 	.maps[EFUSE_TEST] = REG_EFUSE_TEST,
 	.maps[EFUSE_CTRL] = REG_EFUSE_CTRL,
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:723 @ u32 rtl92ce_get_desc(u8 *p_desc, bool is
 			break;
 		}
 	} else {
-		struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc;
 		switch (desc_name) {
 		case HW_DESC_OWN:
-			ret = GET_RX_DESC_OWN(pdesc);
+			ret = GET_RX_DESC_OWN(p_desc);
 			break;
 		case HW_DESC_RXPKT_LEN:
-			ret = GET_RX_DESC_PKT_LEN(pdesc);
+			ret = GET_RX_DESC_PKT_LEN(p_desc);
 			break;
 		case HW_DESC_RXBUFF_ADDR:
-			ret = GET_RX_STATUS_DESC_BUFF_ADDR(pdesc);
+			ret = GET_RX_DESC_BUFF_ADDR(p_desc);
 			break;
 		default:
 			RT_ASSERT(false, "ERR rxdesc :%d not process\n",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:742 @ u32 rtl92ce_get_desc(u8 *p_desc, bool is
 	return ret;
 }
 
+bool rtl92ce_is_tx_desc_closed(struct ieee80211_hw *hw,
+			       u8 hw_queue, u16 index)
+{
+	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+	struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue];
+	u8 *entry = (u8 *)(&ring->desc[ring->idx]);
+	u8 own = (u8)rtl92ce_get_desc(entry, true, HW_DESC_OWN);
+
+	/*beacon packet will only use the first
+	 *descriptor defautly,and the own may not
+	 *be cleared by the hardware
+	 */
+	if (own)
+		return false;
+	return true;
+}
+
 void rtl92ce_tx_polling(struct ieee80211_hw *hw, u8 hw_queue)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ce/trx.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/rtlwifi/rtl8192ce/trx.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ce/trx.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:726 @ bool rtl92ce_rx_query_desc(struct ieee80
 void rtl92ce_set_desc(struct ieee80211_hw *hw, u8 *pdesc, bool istx,
 		      u8 desc_name, u8 *val);
 u32 rtl92ce_get_desc(u8 *pdesc, bool istx, u8 desc_name);
+bool rtl92ce_is_tx_desc_closed(struct ieee80211_hw *hw,
+			       u8 hw_queue, u16 index);
 void rtl92ce_tx_polling(struct ieee80211_hw *hw, u8 hw_queue);
 void rtl92ce_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc,
 			     bool b_firstseg, bool b_lastseg,
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:669 @ void rtl92ee_set_fw_rsvdpagepkt(struct i
 	struct sk_buff *skb = NULL;
 
 	u32 totalpacketlen;
-	bool rtstatus;
 	u8 u1rsvdpageloc[5] = { 0 };
 	bool b_dlok = false;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:730 @ void rtl92ee_set_fw_rsvdpagepkt(struct i
 	memcpy((u8 *)skb_put(skb, totalpacketlen),
 	       &reserved_page_packet, totalpacketlen);
 
-	rtstatus = rtl_cmd_send_packet(hw, skb);
-
-	if (rtstatus)
-		b_dlok = true;
+	b_dlok = true;
 
 	if (b_dlok) {
 		RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD ,
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:88 @ static void _rtl92ee_enable_bcn_sub_func
 	_rtl92ee_set_bcn_ctrl_reg(hw, 0, BIT(1));
 }
 
-static void _rtl92ee_return_beacon_queue_skb(struct ieee80211_hw *hw)
-{
-	struct rtl_priv *rtlpriv = rtl_priv(hw);
-	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-	struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE];
-	unsigned long flags;
-
-	spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags);
-	while (skb_queue_len(&ring->queue)) {
-		struct rtl_tx_buffer_desc *entry =
-						&ring->buffer_desc[ring->idx];
-		struct sk_buff *skb = __skb_dequeue(&ring->queue);
-
-		pci_unmap_single(rtlpci->pdev,
-				 rtlpriv->cfg->ops->get_desc(
-				 (u8 *)entry, true, HW_DESC_TXBUFF_ADDR),
-				 skb->len, PCI_DMA_TODEVICE);
-		kfree_skb(skb);
-		ring->idx = (ring->idx + 1) % ring->entries;
-	}
-	spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
-}
-
 static void _rtl92ee_disable_bcn_sub_func(struct ieee80211_hw *hw)
 {
 	_rtl92ee_set_bcn_ctrl_reg(hw, BIT(1), 0);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:383 @ static void _rtl92ee_download_rsvd_page(
 		rtl_write_byte(rtlpriv, REG_DWBCN0_CTRL + 2,
 			       bcnvalid_reg | BIT(0));
 
-		/* Return Beacon TCB */
-		_rtl92ee_return_beacon_queue_skb(hw);
-
 		/* download rsvd page */
 		rtl92ee_set_fw_rsvdpagepkt(hw, false);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1140 @ void rtl92ee_enable_hw_security_config(s
 	rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_WPA_CONFIG, &sec_reg_value);
 }
 
+static bool _rtl8192ee_check_pcie_dma_hang(struct rtl_priv *rtlpriv)
+{
+	u8 tmp;
+
+	/* write reg 0x350 Bit[26]=1. Enable debug port. */
+	tmp = rtl_read_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3);
+	if (!(tmp & BIT(2))) {
+		rtl_write_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3,
+			       tmp | BIT(2));
+		mdelay(100); /* Suggested by DD Justin_tsai. */
+	}
+
+	/* read reg 0x350 Bit[25] if 1 : RX hang
+	 * read reg 0x350 Bit[24] if 1 : TX hang
+	 */
+	tmp = rtl_read_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3);
+	if ((tmp & BIT(0)) || (tmp & BIT(1))) {
+		RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+			 "CheckPcieDMAHang8192EE(): true!!\n");
+		return true;
+	}
+	return false;
+}
+
+static void _rtl8192ee_reset_pcie_interface_dma(struct rtl_priv *rtlpriv,
+						bool mac_power_on)
+{
+	u8 tmp;
+	bool release_mac_rx_pause;
+	u8 backup_pcie_dma_pause;
+
+	RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+		 "ResetPcieInterfaceDMA8192EE()\n");
+
+	/* Revise Note: Follow the document "PCIe RX DMA Hang Reset Flow_v03"
+	 * released by SD1 Alan.
+	 */
+
+	/* 1. disable register write lock
+	 *	write 0x1C bit[1:0] = 2'h0
+	 *	write 0xCC bit[2] = 1'b1
+	 */
+	tmp = rtl_read_byte(rtlpriv, REG_RSV_CTRL);
+	tmp &= ~(BIT(1) | BIT(0));
+	rtl_write_byte(rtlpriv, REG_RSV_CTRL, tmp);
+	tmp = rtl_read_byte(rtlpriv, REG_PMC_DBG_CTRL2);
+	tmp |= BIT(2);
+	rtl_write_byte(rtlpriv, REG_PMC_DBG_CTRL2, tmp);
+
+	/* 2. Check and pause TRX DMA
+	 *	write 0x284 bit[18] = 1'b1
+	 *	write 0x301 = 0xFF
+	 */
+	tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL);
+	if (tmp & BIT(2)) {
+		/* Already pause before the function for another reason. */
+		release_mac_rx_pause = false;
+	} else {
+		rtl_write_byte(rtlpriv, REG_RXDMA_CONTROL, (tmp | BIT(2)));
+		release_mac_rx_pause = true;
+	}
+
+	backup_pcie_dma_pause = rtl_read_byte(rtlpriv, REG_PCIE_CTRL_REG + 1);
+	if (backup_pcie_dma_pause != 0xFF)
+		rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG + 1, 0xFF);
+
+	if (mac_power_on) {
+		/* 3. reset TRX function
+		 *	write 0x100 = 0x00
+		 */
+		rtl_write_byte(rtlpriv, REG_CR, 0);
+	}
+
+	/* 4. Reset PCIe DMA
+	 *	write 0x003 bit[0] = 0
+	 */
+	tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1);
+	tmp &= ~(BIT(0));
+	rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp);
+
+	/* 5. Enable PCIe DMA
+	 *	write 0x003 bit[0] = 1
+	 */
+	tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1);
+	tmp |= BIT(0);
+	rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp);
+
+	if (mac_power_on) {
+		/* 6. enable TRX function
+		 *	write 0x100 = 0xFF
+		 */
+		rtl_write_byte(rtlpriv, REG_CR, 0xFF);
+
+		/* We should init LLT & RQPN and
+		 * prepare Tx/Rx descrptor address later
+		 * because MAC function is reset.
+		 */
+	}
+
+	/* 7. Restore PCIe autoload down bit
+	 *	write 0xF8 bit[17] = 1'b1
+	 */
+	tmp = rtl_read_byte(rtlpriv, REG_MAC_PHY_CTRL_NORMAL + 2);
+	tmp |= BIT(1);
+	rtl_write_byte(rtlpriv, REG_MAC_PHY_CTRL_NORMAL + 2, tmp);
+
+	/* In MAC power on state, BB and RF maybe in ON state,
+	 * if we release TRx DMA here
+	 * it will cause packets to be started to Tx/Rx,
+	 * so we release Tx/Rx DMA later.
+	 */
+	if (!mac_power_on) {
+		/* 8. release TRX DMA
+		 *	write 0x284 bit[18] = 1'b0
+		 *	write 0x301 = 0x00
+		 */
+		if (release_mac_rx_pause) {
+			tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL);
+			rtl_write_byte(rtlpriv, REG_RXDMA_CONTROL,
+				       (tmp & (~BIT(2))));
+		}
+		rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG + 1,
+			       backup_pcie_dma_pause);
+	}
+
+	/* 9. lock system register
+	 *	write 0xCC bit[2] = 1'b0
+	 */
+	tmp = rtl_read_byte(rtlpriv, REG_PMC_DBG_CTRL2);
+	tmp &= ~(BIT(2));
+	rtl_write_byte(rtlpriv, REG_PMC_DBG_CTRL2, tmp);
+}
+
 int rtl92ee_hw_init(struct ieee80211_hw *hw)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1298 @ int rtl92ee_hw_init(struct ieee80211_hw
 		rtlhal->fw_ps_state = FW_PS_STATE_ALL_ON_92E;
 	}
 
+	if (_rtl8192ee_check_pcie_dma_hang(rtlpriv)) {
+		RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "92ee dma hang!\n");
+		_rtl8192ee_reset_pcie_interface_dma(rtlpriv,
+						    rtlhal->mac_func_enable);
+		rtlhal->mac_func_enable = false;
+	}
+
 	rtstatus = _rtl92ee_init_mac(hw);
 
 	rtl_write_byte(rtlpriv, 0x577, 0x03);
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:80 @
 #define REG_HIMRE				0x00B8
 #define REG_HISRE				0x00BC
 
+#define REG_PMC_DBG_CTRL2			0x00CC
 #define REG_EFUSE_ACCESS			0x00CF
 #define REG_HPON_FSM				0x00EC
 #define REG_SYS_CFG1				0x00F0
+#define REG_MAC_PHY_CTRL_NORMAL			0x00F8
 #define REG_SYS_CFG2				0x00FC
 
 #define REG_CR					0x0100
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:515 @ bool rtl92ee_rx_query_desc(struct ieee80
 	struct ieee80211_hdr *hdr;
 	u32 phystatus = GET_RX_DESC_PHYST(pdesc);
 
+	if (GET_RX_STATUS_DESC_RPT_SEL(pdesc) == 0)
+		status->packet_report_type = NORMAL_RX;
+	else
+		status->packet_report_type = C2H_PACKET;
 	status->length = (u16)GET_RX_DESC_PKT_LEN(pdesc);
 	status->rx_drvinfo_size = (u8)GET_RX_DESC_DRV_INFO_SIZE(pdesc) *
 				  RX_DRV_INFO_SIZE_UNIT;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:661 @ u16 rtl92ee_rx_desc_buff_remained_cnt(st
 	if (!start_rx)
 		return 0;
 
-	if ((last_read_point > (RX_DESC_NUM_92E / 2)) &&
-	    (read_point <= (RX_DESC_NUM_92E / 2))) {
-		remind_cnt = RX_DESC_NUM_92E - write_point;
-	} else {
-		remind_cnt = (read_point >= write_point) ?
-			     (read_point - write_point) :
-			     (RX_DESC_NUM_92E - write_point + read_point);
-	}
+	remind_cnt = calc_fifo_space(read_point, write_point);
 
 	if (remind_cnt == 0)
 		return 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1207 @ bool rtl92ee_is_tx_desc_closed(struct ie
 	static u8 stop_report_cnt;
 	struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue];
 
-	/*checking Read/Write Point each interrupt wastes CPU */
-	if (stop_report_cnt > 15 || !rtlpriv->link_info.busytraffic) {
+	{
 		u16 point_diff = 0;
 		u16 cur_tx_rp, cur_tx_wp;
 		u32 tmpu32 = 0;
Index: linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:545 @
 	LE_BITS_TO_4BYTE(__pdesc+8, 12, 4)
 #define GET_RX_DESC_RX_IS_QOS(__pdesc)			\
 	LE_BITS_TO_4BYTE(__pdesc+8, 16, 1)
+#define GET_RX_STATUS_DESC_RPT_SEL(__pdesc)		\
+	LE_BITS_TO_4BYTE(__pdesc+8, 28, 1)
 
 #define GET_RX_DESC_RXMCS(__pdesc)			\
 	LE_BITS_TO_4BYTE(__pdesc+12, 0, 7)
Index: linux-3.18.13-rt10-r7s4/drivers/net/xen-netback/common.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/xen-netback/common.h
+++ linux-3.18.13-rt10-r7s4/drivers/net/xen-netback/common.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:233 @ struct xenvif {
 	 */
 	bool disabled;
 	unsigned long status;
+	unsigned long drain_timeout;
+	unsigned long stall_timeout;
 
 	/* Queues */
 	struct xenvif_queue *queues;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:333 @ irqreturn_t xenvif_interrupt(int irq, vo
 extern bool separate_tx_rx_irq;
 
 extern unsigned int rx_drain_timeout_msecs;
-extern unsigned int rx_drain_timeout_jiffies;
+extern unsigned int rx_stall_timeout_msecs;
 extern unsigned int xenvif_max_queues;
 
 #ifdef CONFIG_DEBUG_FS
Index: linux-3.18.13-rt10-r7s4/drivers/net/xen-netback/interface.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/xen-netback/interface.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/xen-netback/interface.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:169 @ static int xenvif_start_xmit(struct sk_b
 		goto drop;
 
 	cb = XENVIF_RX_CB(skb);
-	cb->expires = jiffies + rx_drain_timeout_jiffies;
+	cb->expires = jiffies + vif->drain_timeout;
 
 	xenvif_rx_queue_tail(queue, skb);
 	xenvif_kick_thread(queue);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:417 @ struct xenvif *xenvif_alloc(struct devic
 	vif->ip_csum = 1;
 	vif->dev = dev;
 	vif->disabled = false;
+	vif->drain_timeout = msecs_to_jiffies(rx_drain_timeout_msecs);
+	vif->stall_timeout = msecs_to_jiffies(rx_stall_timeout_msecs);
 
 	/* Start out with no queues. */
 	vif->queues = NULL;
Index: linux-3.18.13-rt10-r7s4/drivers/net/xen-netback/netback.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/xen-netback/netback.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/xen-netback/netback.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:63 @ module_param(separate_tx_rx_irq, bool, 0
  */
 unsigned int rx_drain_timeout_msecs = 10000;
 module_param(rx_drain_timeout_msecs, uint, 0444);
-unsigned int rx_drain_timeout_jiffies;
 
 /* The length of time before the frontend is considered unresponsive
  * because it isn't providing Rx slots.
  */
-static unsigned int rx_stall_timeout_msecs = 60000;
+unsigned int rx_stall_timeout_msecs = 60000;
 module_param(rx_stall_timeout_msecs, uint, 0444);
-static unsigned int rx_stall_timeout_jiffies;
 
 unsigned int xenvif_max_queues;
 module_param_named(max_queues, xenvif_max_queues, uint, 0644);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2023 @ static bool xenvif_rx_queue_stalled(stru
 	return !queue->stalled
 		&& prod - cons < XEN_NETBK_RX_SLOTS_MAX
 		&& time_after(jiffies,
-			      queue->last_rx_time + rx_stall_timeout_jiffies);
+			      queue->last_rx_time + queue->vif->stall_timeout);
 }
 
 static bool xenvif_rx_queue_ready(struct xenvif_queue *queue)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2041 @ static bool xenvif_have_rx_work(struct x
 {
 	return (!skb_queue_empty(&queue->rx_queue)
 		&& xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX))
-		|| xenvif_rx_queue_stalled(queue)
-		|| xenvif_rx_queue_ready(queue)
+		|| (queue->vif->stall_timeout &&
+		    (xenvif_rx_queue_stalled(queue)
+		     || xenvif_rx_queue_ready(queue)))
 		|| kthread_should_stop()
 		|| queue->vif->disabled;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2096 @ int xenvif_kthread_guest_rx(void *data)
 	struct xenvif_queue *queue = data;
 	struct xenvif *vif = queue->vif;
 
+	if (!vif->stall_timeout)
+		xenvif_queue_carrier_on(queue);
+
 	for (;;) {
 		xenvif_wait_for_rx_work(queue);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2125 @ int xenvif_kthread_guest_rx(void *data)
 		 * while it's probably not responsive, drop the
 		 * carrier so packets are dropped earlier.
 		 */
-		if (xenvif_rx_queue_stalled(queue))
-			xenvif_queue_carrier_off(queue);
-		else if (xenvif_rx_queue_ready(queue))
-			xenvif_queue_carrier_on(queue);
+		if (vif->stall_timeout) {
+			if (xenvif_rx_queue_stalled(queue))
+				xenvif_queue_carrier_off(queue);
+			else if (xenvif_rx_queue_ready(queue))
+				xenvif_queue_carrier_on(queue);
+		}
 
 		/* Queued packets may have foreign pages from other
 		 * domains.  These cannot be queued indefinitely as
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2201 @ static int __init netback_init(void)
 	if (rc)
 		goto failed_init;
 
-	rx_drain_timeout_jiffies = msecs_to_jiffies(rx_drain_timeout_msecs);
-	rx_stall_timeout_jiffies = msecs_to_jiffies(rx_stall_timeout_msecs);
-
 #ifdef CONFIG_DEBUG_FS
 	xen_netback_dbg_root = debugfs_create_dir("xen-netback", NULL);
 	if (IS_ERR_OR_NULL(xen_netback_dbg_root))
Index: linux-3.18.13-rt10-r7s4/drivers/net/xen-netback/xenbus.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/xen-netback/xenbus.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/xen-netback/xenbus.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:739 @ static void connect(struct backend_info
 		}
 
 		queue->remaining_credit = credit_bytes;
+		queue->credit_usec = credit_usec;
 
 		err = connect_rings(be, queue);
 		if (err) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:890 @ static int read_xenbus_vif_flags(struct
 		return -EOPNOTSUPP;
 
 	if (xenbus_scanf(XBT_NIL, dev->otherend,
-			 "feature-rx-notify", "%d", &val) < 0 || val == 0) {
-		xenbus_dev_fatal(dev, -EINVAL, "feature-rx-notify is mandatory");
-		return -EINVAL;
+			 "feature-rx-notify", "%d", &val) < 0)
+		val = 0;
+	if (!val) {
+		/* - Reduce drain timeout to poll more frequently for
+		 *   Rx requests.
+		 * - Disable Rx stall detection.
+		 */
+		be->vif->drain_timeout = msecs_to_jiffies(30);
+		be->vif->stall_timeout = 0;
 	}
 
 	if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-sg",
Index: linux-3.18.13-rt10-r7s4/drivers/net/xen-netfront.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/net/xen-netfront.c
+++ linux-3.18.13-rt10-r7s4/drivers/net/xen-netfront.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:630 @ static int xennet_start_xmit(struct sk_b
 				    slots, skb->len);
 		if (skb_linearize(skb))
 			goto drop;
+		data = skb->data;
+		offset = offset_in_page(data);
+		len = skb_headlen(skb);
 	}
 
 	spin_lock_irqsave(&queue->tx_lock, flags);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1101 @ err:
 
 static int xennet_change_mtu(struct net_device *dev, int mtu)
 {
-	int max = xennet_can_sg(dev) ?
-		XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER : ETH_DATA_LEN;
+	int max = xennet_can_sg(dev) ? XEN_NETIF_MAX_TX_SIZE : ETH_DATA_LEN;
 
 	if (mtu > max)
 		return -EINVAL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1355 @ static struct net_device *xennet_create_
 	netdev->ethtool_ops = &xennet_ethtool_ops;
 	SET_NETDEV_DEV(netdev, &dev->dev);
 
-	netif_set_gso_max_size(netdev, XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER);
-
 	np->netdev = netdev;
 
 	netif_carrier_off(netdev);
Index: linux-3.18.13-rt10-r7s4/drivers/of/address.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/of/address.c
+++ linux-3.18.13-rt10-r7s4/drivers/of/address.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:453 @ static struct of_bus *of_match_bus(struc
 	return NULL;
 }
 
-static int of_empty_ranges_quirk(void)
+static int of_empty_ranges_quirk(struct device_node *np)
 {
 	if (IS_ENABLED(CONFIG_PPC)) {
-		/* To save cycles, we cache the result */
+		/* To save cycles, we cache the result for global "Mac" setting */
 		static int quirk_state = -1;
 
+		/* PA-SEMI sdc DT bug */
+		if (of_device_is_compatible(np, "1682m-sdc"))
+			return true;
+
+		/* Make quirk cached */
 		if (quirk_state < 0)
 			quirk_state =
 				of_machine_is_compatible("Power Macintosh") ||
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:498 @ static int of_translate_one(struct devic
 	 * This code is only enabled on powerpc. --gcl
 	 */
 	ranges = of_get_property(parent, rprop, &rlen);
-	if (ranges == NULL && !of_empty_ranges_quirk()) {
+	if (ranges == NULL && !of_empty_ranges_quirk(parent)) {
 		pr_err("OF: no ranges; cannot translate\n");
 		return 1;
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/of/irq.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/of/irq.c
+++ linux-3.18.13-rt10-r7s4/drivers/of/irq.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:293 @ int of_irq_parse_one(struct device_node
 	struct device_node *p;
 	const __be32 *intspec, *tmp, *addr;
 	u32 intsize, intlen;
-	int i, res = -EINVAL;
+	int i, res;
 
 	pr_debug("of_irq_parse_one: dev=%s, index=%d\n", of_node_full_name(device), index);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:326 @ int of_irq_parse_one(struct device_node
 
 	/* Get size of interrupt specifier */
 	tmp = of_get_property(p, "#interrupt-cells", NULL);
-	if (tmp == NULL)
+	if (tmp == NULL) {
+		res = -EINVAL;
 		goto out;
+	}
 	intsize = be32_to_cpu(*tmp);
 
 	pr_debug(" intsize=%d intlen=%d\n", intsize, intlen);
 
 	/* Check index */
-	if ((index + 1) * intsize > intlen)
+	if ((index + 1) * intsize > intlen) {
+		res = -EINVAL;
 		goto out;
+	}
 
 	/* Copy intspec into irq structure */
 	intspec += index * intsize;
Index: linux-3.18.13-rt10-r7s4/drivers/of/of_pci.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/of/of_pci.c
+++ linux-3.18.13-rt10-r7s4/drivers/of/of_pci.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:143 @ int of_pci_get_host_bridge_resources(str
 			unsigned char busno, unsigned char bus_max,
 			struct list_head *resources, resource_size_t *io_base)
 {
+	struct pci_host_bridge_window *window;
 	struct resource *res;
 	struct resource *bus_range;
 	struct of_pci_range range;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:229 @ int of_pci_get_host_bridge_resources(str
 conversion_failed:
 	kfree(res);
 parse_failed:
+	list_for_each_entry(window, resources, list)
+		kfree(window->res);
 	pci_free_resource_list(resources);
+	kfree(bus_range);
 	return err;
 }
 EXPORT_SYMBOL_GPL(of_pci_get_host_bridge_resources);
Index: linux-3.18.13-rt10-r7s4/drivers/pci/bus.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pci/bus.c
+++ linux-3.18.13-rt10-r7s4/drivers/pci/bus.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:231 @ int pci_bus_alloc_resource(struct pci_bu
 }
 EXPORT_SYMBOL(pci_bus_alloc_resource);
 
+/*
+ * The @idx resource of @dev should be a PCI-PCI bridge window.  If this
+ * resource fits inside a window of an upstream bridge, do nothing.  If it
+ * overlaps an upstream window but extends outside it, clip the resource so
+ * it fits completely inside.
+ */
+bool pci_bus_clip_resource(struct pci_dev *dev, int idx)
+{
+	struct pci_bus *bus = dev->bus;
+	struct resource *res = &dev->resource[idx];
+	struct resource orig_res = *res;
+	struct resource *r;
+	int i;
+
+	pci_bus_for_each_resource(bus, r, i) {
+		resource_size_t start, end;
+
+		if (!r)
+			continue;
+
+		if (resource_type(res) != resource_type(r))
+			continue;
+
+		start = max(r->start, res->start);
+		end = min(r->end, res->end);
+
+		if (start > end)
+			continue;	/* no overlap */
+
+		if (res->start == start && res->end == end)
+			return false;	/* no change */
+
+		res->start = start;
+		res->end = end;
+		dev_printk(KERN_DEBUG, &dev->dev, "%pR clipped to %pR\n",
+				 &orig_res, res);
+
+		return true;
+	}
+
+	return false;
+}
+
 void __weak pcibios_resource_survey_bus(struct pci_bus *bus) { }
 
 /**
Index: linux-3.18.13-rt10-r7s4/drivers/pci/host/pcie-designware.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pci/host/pcie-designware.c
+++ linux-3.18.13-rt10-r7s4/drivers/pci/host/pcie-designware.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:286 @ static int dw_msi_setup_irq(struct msi_c
 	struct msi_msg msg;
 	struct pcie_port *pp = sys_to_pcie(pdev->bus->sysdata);
 
+	if (desc->msi_attrib.is_msix)
+		return -EINVAL;
+
 	irq = assign_irq(1, desc, &pos);
 	if (irq < 0)
 		return irq;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:345 @ static const struct irq_domain_ops msi_d
 	.map = dw_pcie_msi_map,
 };
 
-int __init dw_pcie_host_init(struct pcie_port *pp)
+int dw_pcie_host_init(struct pcie_port *pp)
 {
 	struct device_node *np = pp->dev->of_node;
 	struct platform_device *pdev = to_platform_device(pp->dev);
Index: linux-3.18.13-rt10-r7s4/drivers/pci/host/pcie-spear13xx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pci/host/pcie-spear13xx.c
+++ linux-3.18.13-rt10-r7s4/drivers/pci/host/pcie-spear13xx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:301 @ static int add_pcie_port(struct pcie_por
 	return 0;
 }
 
-static int __init spear13xx_pcie_probe(struct platform_device *pdev)
+static int spear13xx_pcie_probe(struct platform_device *pdev)
 {
 	struct spear13xx_pcie *spear13xx_pcie;
 	struct pcie_port *pp;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:374 @ static const struct of_device_id spear13
 };
 MODULE_DEVICE_TABLE(of, spear13xx_pcie_of_match);
 
-static struct platform_driver spear13xx_pcie_driver __initdata = {
+static struct platform_driver spear13xx_pcie_driver = {
 	.probe		= spear13xx_pcie_probe,
 	.driver = {
 		.name	= "spear-pcie",
Index: linux-3.18.13-rt10-r7s4/drivers/pci/hotplug/cpci_hotplug_pci.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pci/hotplug/cpci_hotplug_pci.c
+++ linux-3.18.13-rt10-r7s4/drivers/pci/hotplug/cpci_hotplug_pci.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:289 @ int cpci_configure_slot(struct slot *slo
 	}
 	parent = slot->dev->bus;
 
-	list_for_each_entry(dev, &parent->devices, bus_list)
+	list_for_each_entry(dev, &parent->devices, bus_list) {
 		if (PCI_SLOT(dev->devfn) != PCI_SLOT(slot->devfn))
 			continue;
 		if (pci_is_bridge(dev))
 			pci_hp_add_bridge(dev);
+	}
 
 
 	pci_assign_unassigned_bridge_resources(parent->self);
Index: linux-3.18.13-rt10-r7s4/drivers/pci/pci-acpi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pci/pci-acpi.c
+++ linux-3.18.13-rt10-r7s4/drivers/pci/pci-acpi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:251 @ int pci_get_hp_params(struct pci_dev *de
 	acpi_handle handle, phandle;
 	struct pci_bus *pbus;
 
+	if (acpi_pci_disabled)
+		return -ENODEV;
+
 	handle = NULL;
 	for (pbus = dev->bus; pbus; pbus = pbus->parent) {
 		handle = acpi_pci_get_bridge_handle(pbus);
Index: linux-3.18.13-rt10-r7s4/drivers/pci/pci-driver.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pci/pci-driver.c
+++ linux-3.18.13-rt10-r7s4/drivers/pci/pci-driver.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1392 @ static int pci_uevent(struct device *dev
 	if (add_uevent_var(env, "PCI_SLOT_NAME=%s", pci_name(pdev)))
 		return -ENOMEM;
 
-	if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x",
+	if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02X",
 			   pdev->vendor, pdev->device,
 			   pdev->subsystem_vendor, pdev->subsystem_device,
 			   (u8)(pdev->class >> 16), (u8)(pdev->class >> 8),
Index: linux-3.18.13-rt10-r7s4/drivers/pci/pci-sysfs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pci/pci-sysfs.c
+++ linux-3.18.13-rt10-r7s4/drivers/pci/pci-sysfs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:518 @ static ssize_t driver_override_store(str
 	struct pci_dev *pdev = to_pci_dev(dev);
 	char *driver_override, *old = pdev->driver_override, *cp;
 
-	if (count > PATH_MAX)
+	/* We need to keep extra room for a newline */
+	if (count >= (PAGE_SIZE - 1))
 		return -EINVAL;
 
 	driver_override = kstrndup(buf, count, GFP_KERNEL);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:547 @ static ssize_t driver_override_show(stru
 {
 	struct pci_dev *pdev = to_pci_dev(dev);
 
-	return sprintf(buf, "%s\n", pdev->driver_override);
+	return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
 }
 static DEVICE_ATTR_RW(driver_override);
 
Index: linux-3.18.13-rt10-r7s4/drivers/pci/pci.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pci/pci.c
+++ linux-3.18.13-rt10-r7s4/drivers/pci/pci.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3283 @ static int pci_parent_bus_reset(struct p
 {
 	struct pci_dev *pdev;
 
-	if (pci_is_root_bus(dev->bus) || dev->subordinate || !dev->bus->self)
+	if (pci_is_root_bus(dev->bus) || dev->subordinate ||
+	    !dev->bus->self || dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)
 		return -ENOTTY;
 
 	list_for_each_entry(pdev, &dev->bus->devices, bus_list)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3318 @ static int pci_dev_reset_slot_function(s
 {
 	struct pci_dev *pdev;
 
-	if (dev->subordinate || !dev->slot)
+	if (dev->subordinate || !dev->slot ||
+	    dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)
 		return -ENOTTY;
 
 	list_for_each_entry(pdev, &dev->bus->devices, bus_list)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3571 @ int pci_try_reset_function(struct pci_de
 }
 EXPORT_SYMBOL_GPL(pci_try_reset_function);
 
+/* Do any devices on or below this bus prevent a bus reset? */
+static bool pci_bus_resetable(struct pci_bus *bus)
+{
+	struct pci_dev *dev;
+
+	list_for_each_entry(dev, &bus->devices, bus_list) {
+		if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET ||
+		    (dev->subordinate && !pci_bus_resetable(dev->subordinate)))
+			return false;
+	}
+
+	return true;
+}
+
 /* Lock devices from the top of the tree down */
 static void pci_bus_lock(struct pci_bus *bus)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3635 @ unlock:
 	return 0;
 }
 
+/* Do any devices on or below this slot prevent a bus reset? */
+static bool pci_slot_resetable(struct pci_slot *slot)
+{
+	struct pci_dev *dev;
+
+	list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+		if (!dev->slot || dev->slot != slot)
+			continue;
+		if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET ||
+		    (dev->subordinate && !pci_bus_resetable(dev->subordinate)))
+			return false;
+	}
+
+	return true;
+}
+
 /* Lock devices from the top of the tree down */
 static void pci_slot_lock(struct pci_slot *slot)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3772 @ static int pci_slot_reset(struct pci_slo
 {
 	int rc;
 
-	if (!slot)
+	if (!slot || !pci_slot_resetable(slot))
 		return -ENOTTY;
 
 	if (!probe)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3864 @ EXPORT_SYMBOL_GPL(pci_try_reset_slot);
 
 static int pci_bus_reset(struct pci_bus *bus, int probe)
 {
-	if (!bus->self)
+	if (!bus->self || !pci_bus_resetable(bus))
 		return -ENOTTY;
 
 	if (probe)
Index: linux-3.18.13-rt10-r7s4/drivers/pci/pci.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pci/pci.h
+++ linux-3.18.13-rt10-r7s4/drivers/pci/pci.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:211 @ void __pci_bus_size_bridges(struct pci_b
 void __pci_bus_assign_resources(const struct pci_bus *bus,
 				struct list_head *realloc_head,
 				struct list_head *fail_head);
+bool pci_bus_clip_resource(struct pci_dev *dev, int idx);
 
 /**
  * pci_ari_enabled - query ARI forwarding status
Index: linux-3.18.13-rt10-r7s4/drivers/pci/pcie/aer/aerdrv_errprint.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pci/pcie/aer/aerdrv_errprint.c
+++ linux-3.18.13-rt10-r7s4/drivers/pci/pcie/aer/aerdrv_errprint.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:135 @ static const char *aer_agent_string[] =
 static void __print_tlp_header(struct pci_dev *dev,
 			       struct aer_header_log_regs *t)
 {
-	unsigned char *tlp = (unsigned char *)&t;
-
-	dev_err(&dev->dev, "  TLP Header:"
-		" %02x%02x%02x%02x %02x%02x%02x%02x"
-		" %02x%02x%02x%02x %02x%02x%02x%02x\n",
-		*(tlp + 3), *(tlp + 2), *(tlp + 1), *tlp,
-		*(tlp + 7), *(tlp + 6), *(tlp + 5), *(tlp + 4),
-		*(tlp + 11), *(tlp + 10), *(tlp + 9),
-		*(tlp + 8), *(tlp + 15), *(tlp + 14),
-		*(tlp + 13), *(tlp + 12));
+	dev_err(&dev->dev, "  TLP Header: %08x %08x %08x %08x\n",
+		t->dw0, t->dw1, t->dw2, t->dw3);
 }
 
 static void __aer_print_error(struct pci_dev *dev,
Index: linux-3.18.13-rt10-r7s4/drivers/pci/probe.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pci/probe.c
+++ linux-3.18.13-rt10-r7s4/drivers/pci/probe.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:219 @ int __pci_read_base(struct pci_dev *dev,
 		res->flags |= IORESOURCE_SIZEALIGN;
 		if (res->flags & IORESOURCE_IO) {
 			l &= PCI_BASE_ADDRESS_IO_MASK;
+			sz &= PCI_BASE_ADDRESS_IO_MASK;
 			mask = PCI_BASE_ADDRESS_IO_MASK & (u32) IO_SPACE_LIMIT;
 		} else {
 			l &= PCI_BASE_ADDRESS_MEM_MASK;
+			sz &= PCI_BASE_ADDRESS_MEM_MASK;
 			mask = (u32)PCI_BASE_ADDRESS_MEM_MASK;
 		}
 	} else {
 		res->flags |= (l & IORESOURCE_ROM_ENABLE);
 		l &= PCI_ROM_ADDRESS_MASK;
+		sz &= PCI_ROM_ADDRESS_MASK;
 		mask = (u32)PCI_ROM_ADDRESS_MASK;
 	}
 
Index: linux-3.18.13-rt10-r7s4/drivers/pci/quirks.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pci/quirks.c
+++ linux-3.18.13-rt10-r7s4/drivers/pci/quirks.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:327 @ static void quirk_s3_64M(struct pci_dev
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3,	PCI_DEVICE_ID_S3_868,		quirk_s3_64M);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3,	PCI_DEVICE_ID_S3_968,		quirk_s3_64M);
 
+static void quirk_io(struct pci_dev *dev, int pos, unsigned size,
+		     const char *name)
+{
+	u32 region;
+	struct pci_bus_region bus_region;
+	struct resource *res = dev->resource + pos;
+
+	pci_read_config_dword(dev, PCI_BASE_ADDRESS_0 + (pos << 2), &region);
+
+	if (!region)
+		return;
+
+	res->name = pci_name(dev);
+	res->flags = region & ~PCI_BASE_ADDRESS_IO_MASK;
+	res->flags |=
+		(IORESOURCE_IO | IORESOURCE_PCI_FIXED | IORESOURCE_SIZEALIGN);
+	region &= ~(size - 1);
+
+	/* Convert from PCI bus to resource space */
+	bus_region.start = region;
+	bus_region.end = region + size - 1;
+	pcibios_bus_to_resource(dev->bus, res, &bus_region);
+
+	dev_info(&dev->dev, FW_BUG "%s quirk: reg 0x%x: %pR\n",
+		 name, PCI_BASE_ADDRESS_0 + (pos << 2), res);
+}
+
 /*
  * Some CS5536 BIOSes (for example, the Soekris NET5501 board w/ comBIOS
  * ver. 1.33  20070103) don't set the correct ISA PCI region header info.
  * BAR0 should be 8 bytes; instead, it may be set to something like 8k
  * (which conflicts w/ BAR1's memory range).
+ *
+ * CS553x's ISA PCI BARs may also be read-only (ref:
+ * https://bugzilla.kernel.org/show_bug.cgi?id=85991 - Comment #4 forward).
  */
 static void quirk_cs5536_vsa(struct pci_dev *dev)
 {
+	static char *name = "CS5536 ISA bridge";
+
 	if (pci_resource_len(dev, 0) != 8) {
-		struct resource *res = &dev->resource[0];
-		res->end = res->start + 8 - 1;
-		dev_info(&dev->dev, "CS5536 ISA bridge bug detected (incorrect header); workaround applied\n");
+		quirk_io(dev, 0,   8, name);	/* SMB */
+		quirk_io(dev, 1, 256, name);	/* GPIO */
+		quirk_io(dev, 2,  64, name);	/* MFGPT */
+		dev_info(&dev->dev, "%s bug detected (incorrect header); workaround applied\n",
+			 name);
 	}
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA, quirk_cs5536_vsa);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3045 @ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_R
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID,
 			 quirk_broken_intx_masking);
 
+static void quirk_no_bus_reset(struct pci_dev *dev)
+{
+	dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET;
+}
+
+/*
+ * Atheros AR93xx chips do not behave after a bus reset.  The device will
+ * throw a Link Down error on AER-capable systems and regardless of AER,
+ * config space of the device is never accessible again and typically
+ * causes the system to hang or reset when access is attempted.
+ * http://www.spinics.net/lists/linux-pci/msg34797.html
+ */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset);
+
 #ifdef CONFIG_ACPI
 /*
  * Apple: Shutdown Cactus Ridge Thunderbolt controller.
Index: linux-3.18.13-rt10-r7s4/drivers/pci/rom.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pci/rom.c
+++ linux-3.18.13-rt10-r7s4/drivers/pci/rom.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:74 @ size_t pci_get_rom_size(struct pci_dev *
 {
 	void __iomem *image;
 	int last_image;
+	unsigned length;
 
 	image = rom;
 	do {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:97 @ size_t pci_get_rom_size(struct pci_dev *
 		if (readb(pds + 3) != 'R')
 			break;
 		last_image = readb(pds + 21) & 0x80;
-		/* this length is reliable */
-		image += readw(pds + 16) * 512;
-	} while (!last_image);
+		length = readw(pds + 16);
+		image += length * 512;
+	} while (length && !last_image);
 
 	/* never return a size larger than the PCI resource window */
 	/* there are known ROMs that get the size wrong */
Index: linux-3.18.13-rt10-r7s4/drivers/pci/setup-bus.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pci/setup-bus.c
+++ linux-3.18.13-rt10-r7s4/drivers/pci/setup-bus.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:533 @ EXPORT_SYMBOL(pci_setup_cardbus);
    config space writes, so it's quite possible that an I/O window of
    the bridge will have some undesirable address (e.g. 0) after the
    first write. Ditto 64-bit prefetchable MMIO.  */
-static void pci_setup_bridge_io(struct pci_bus *bus)
+static void pci_setup_bridge_io(struct pci_dev *bridge)
 {
-	struct pci_dev *bridge = bus->self;
 	struct resource *res;
 	struct pci_bus_region region;
 	unsigned long io_mask;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:547 @ static void pci_setup_bridge_io(struct p
 		io_mask = PCI_IO_1K_RANGE_MASK;
 
 	/* Set up the top and bottom of the PCI I/O segment for this bus. */
-	res = bus->resource[0];
+	res = &bridge->resource[PCI_BRIDGE_RESOURCES + 0];
 	pcibios_resource_to_bus(bridge->bus, &region, res);
 	if (res->flags & IORESOURCE_IO) {
 		pci_read_config_word(bridge, PCI_IO_BASE, &l);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:570 @ static void pci_setup_bridge_io(struct p
 	pci_write_config_dword(bridge, PCI_IO_BASE_UPPER16, io_upper16);
 }
 
-static void pci_setup_bridge_mmio(struct pci_bus *bus)
+static void pci_setup_bridge_mmio(struct pci_dev *bridge)
 {
-	struct pci_dev *bridge = bus->self;
 	struct resource *res;
 	struct pci_bus_region region;
 	u32 l;
 
 	/* Set up the top and bottom of the PCI Memory segment for this bus. */
-	res = bus->resource[1];
+	res = &bridge->resource[PCI_BRIDGE_RESOURCES + 1];
 	pcibios_resource_to_bus(bridge->bus, &region, res);
 	if (res->flags & IORESOURCE_MEM) {
 		l = (region.start >> 16) & 0xfff0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:589 @ static void pci_setup_bridge_mmio(struct
 	pci_write_config_dword(bridge, PCI_MEMORY_BASE, l);
 }
 
-static void pci_setup_bridge_mmio_pref(struct pci_bus *bus)
+static void pci_setup_bridge_mmio_pref(struct pci_dev *bridge)
 {
-	struct pci_dev *bridge = bus->self;
 	struct resource *res;
 	struct pci_bus_region region;
 	u32 l, bu, lu;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:602 @ static void pci_setup_bridge_mmio_pref(s
 
 	/* Set up PREF base/limit. */
 	bu = lu = 0;
-	res = bus->resource[2];
+	res = &bridge->resource[PCI_BRIDGE_RESOURCES + 2];
 	pcibios_resource_to_bus(bridge->bus, &region, res);
 	if (res->flags & IORESOURCE_PREFETCH) {
 		l = (region.start >> 16) & 0xfff0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:630 @ static void __pci_setup_bridge(struct pc
 		 &bus->busn_res);
 
 	if (type & IORESOURCE_IO)
-		pci_setup_bridge_io(bus);
+		pci_setup_bridge_io(bridge);
 
 	if (type & IORESOURCE_MEM)
-		pci_setup_bridge_mmio(bus);
+		pci_setup_bridge_mmio(bridge);
 
 	if (type & IORESOURCE_PREFETCH)
-		pci_setup_bridge_mmio_pref(bus);
+		pci_setup_bridge_mmio_pref(bridge);
 
 	pci_write_config_word(bridge, PCI_BRIDGE_CONTROL, bus->bridge_ctl);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:649 @ void pci_setup_bridge(struct pci_bus *bu
 	__pci_setup_bridge(bus, type);
 }
 
+
+int pci_claim_bridge_resource(struct pci_dev *bridge, int i)
+{
+	if (i < PCI_BRIDGE_RESOURCES || i > PCI_BRIDGE_RESOURCE_END)
+		return 0;
+
+	if (pci_claim_resource(bridge, i) == 0)
+		return 0;	/* claimed the window */
+
+	if ((bridge->class >> 8) != PCI_CLASS_BRIDGE_PCI)
+		return 0;
+
+	if (!pci_bus_clip_resource(bridge, i))
+		return -EINVAL;	/* clipping didn't change anything */
+
+	switch (i - PCI_BRIDGE_RESOURCES) {
+	case 0:
+		pci_setup_bridge_io(bridge);
+		break;
+	case 1:
+		pci_setup_bridge_mmio(bridge);
+		break;
+	case 2:
+		pci_setup_bridge_mmio_pref(bridge);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (pci_claim_resource(bridge, i) == 0)
+		return 0;	/* claimed a smaller window */
+
+	return -EINVAL;
+}
+
 /* Check whether the bridge supports optional I/O and
    prefetchable memory ranges. If not, the respective
    base/limit registers must be read-only and read as 0. */
Index: linux-3.18.13-rt10-r7s4/drivers/phy/phy-core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/phy/phy-core.c
+++ linux-3.18.13-rt10-r7s4/drivers/phy/phy-core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:54 @ static void devm_phy_consume(struct devi
 
 static int devm_phy_match(struct device *dev, void *res, void *match_data)
 {
-	return res == match_data;
+	struct phy **phy = res;
+
+	return *phy == match_data;
 }
 
 static struct phy *phy_lookup(struct device *device, const char *port)
Index: linux-3.18.13-rt10-r7s4/drivers/pinctrl/core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pinctrl/core.c
+++ linux-3.18.13-rt10-r7s4/drivers/pinctrl/core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1804 @ void pinctrl_unregister(struct pinctrl_d
 	if (pctldev == NULL)
 		return;
 
-	mutex_lock(&pinctrldev_list_mutex);
 	mutex_lock(&pctldev->mutex);
-
 	pinctrl_remove_device_debugfs(pctldev);
+	mutex_unlock(&pctldev->mutex);
 
 	if (!IS_ERR(pctldev->p))
 		pinctrl_put(pctldev->p);
 
+	mutex_lock(&pinctrldev_list_mutex);
+	mutex_lock(&pctldev->mutex);
 	/* TODO: check that no pinmuxes are still active? */
 	list_del(&pctldev->node);
 	/* Destroy descriptor tree */
Index: linux-3.18.13-rt10-r7s4/drivers/pinctrl/freescale/pinctrl-imx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pinctrl/freescale/pinctrl-imx.c
+++ linux-3.18.13-rt10-r7s4/drivers/pinctrl/freescale/pinctrl-imx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:368 @ static void imx_pinconf_dbg_show(struct
 	const struct imx_pin_reg *pin_reg = &info->pin_regs[pin_id];
 	unsigned long config;
 
-	if (!pin_reg || !pin_reg->conf_reg) {
+	if (!pin_reg || pin_reg->conf_reg == -1) {
 		seq_printf(s, "N/A");
 		return;
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/pinctrl/freescale/pinctrl-imx25.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pinctrl/freescale/pinctrl-imx25.c
+++ linux-3.18.13-rt10-r7s4/drivers/pinctrl/freescale/pinctrl-imx25.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:30 @
 
 enum imx25_pads {
 	MX25_PAD_RESERVE0 = 1,
-	MX25_PAD_RESERVE1 = 2,
-	MX25_PAD_A10 = 3,
-	MX25_PAD_A13 = 4,
-	MX25_PAD_A14 = 5,
-	MX25_PAD_A15 = 6,
-	MX25_PAD_A16 = 7,
-	MX25_PAD_A17 = 8,
-	MX25_PAD_A18 = 9,
-	MX25_PAD_A19 = 10,
-	MX25_PAD_A20 = 11,
-	MX25_PAD_A21 = 12,
-	MX25_PAD_A22 = 13,
-	MX25_PAD_A23 = 14,
-	MX25_PAD_A24 = 15,
-	MX25_PAD_A25 = 16,
-	MX25_PAD_EB0 = 17,
-	MX25_PAD_EB1 = 18,
-	MX25_PAD_OE = 19,
-	MX25_PAD_CS0 = 20,
-	MX25_PAD_CS1 = 21,
-	MX25_PAD_CS4 = 22,
-	MX25_PAD_CS5 = 23,
-	MX25_PAD_NF_CE0 = 24,
-	MX25_PAD_ECB = 25,
-	MX25_PAD_LBA = 26,
-	MX25_PAD_BCLK = 27,
-	MX25_PAD_RW = 28,
-	MX25_PAD_NFWE_B = 29,
-	MX25_PAD_NFRE_B = 30,
-	MX25_PAD_NFALE = 31,
-	MX25_PAD_NFCLE = 32,
-	MX25_PAD_NFWP_B = 33,
-	MX25_PAD_NFRB = 34,
-	MX25_PAD_D15 = 35,
-	MX25_PAD_D14 = 36,
-	MX25_PAD_D13 = 37,
-	MX25_PAD_D12 = 38,
-	MX25_PAD_D11 = 39,
-	MX25_PAD_D10 = 40,
-	MX25_PAD_D9 = 41,
-	MX25_PAD_D8 = 42,
-	MX25_PAD_D7 = 43,
-	MX25_PAD_D6 = 44,
-	MX25_PAD_D5 = 45,
-	MX25_PAD_D4 = 46,
-	MX25_PAD_D3 = 47,
-	MX25_PAD_D2 = 48,
-	MX25_PAD_D1 = 49,
-	MX25_PAD_D0 = 50,
-	MX25_PAD_LD0 = 51,
-	MX25_PAD_LD1 = 52,
-	MX25_PAD_LD2 = 53,
-	MX25_PAD_LD3 = 54,
-	MX25_PAD_LD4 = 55,
-	MX25_PAD_LD5 = 56,
-	MX25_PAD_LD6 = 57,
-	MX25_PAD_LD7 = 58,
-	MX25_PAD_LD8 = 59,
-	MX25_PAD_LD9 = 60,
-	MX25_PAD_LD10 = 61,
-	MX25_PAD_LD11 = 62,
-	MX25_PAD_LD12 = 63,
-	MX25_PAD_LD13 = 64,
-	MX25_PAD_LD14 = 65,
-	MX25_PAD_LD15 = 66,
-	MX25_PAD_HSYNC = 67,
-	MX25_PAD_VSYNC = 68,
-	MX25_PAD_LSCLK = 69,
-	MX25_PAD_OE_ACD = 70,
-	MX25_PAD_CONTRAST = 71,
-	MX25_PAD_PWM = 72,
-	MX25_PAD_CSI_D2 = 73,
-	MX25_PAD_CSI_D3 = 74,
-	MX25_PAD_CSI_D4 = 75,
-	MX25_PAD_CSI_D5 = 76,
-	MX25_PAD_CSI_D6 = 77,
-	MX25_PAD_CSI_D7 = 78,
-	MX25_PAD_CSI_D8 = 79,
-	MX25_PAD_CSI_D9 = 80,
-	MX25_PAD_CSI_MCLK = 81,
-	MX25_PAD_CSI_VSYNC = 82,
-	MX25_PAD_CSI_HSYNC = 83,
-	MX25_PAD_CSI_PIXCLK = 84,
-	MX25_PAD_I2C1_CLK = 85,
-	MX25_PAD_I2C1_DAT = 86,
-	MX25_PAD_CSPI1_MOSI = 87,
-	MX25_PAD_CSPI1_MISO = 88,
-	MX25_PAD_CSPI1_SS0 = 89,
-	MX25_PAD_CSPI1_SS1 = 90,
-	MX25_PAD_CSPI1_SCLK = 91,
-	MX25_PAD_CSPI1_RDY = 92,
-	MX25_PAD_UART1_RXD = 93,
-	MX25_PAD_UART1_TXD = 94,
-	MX25_PAD_UART1_RTS = 95,
-	MX25_PAD_UART1_CTS = 96,
-	MX25_PAD_UART2_RXD = 97,
-	MX25_PAD_UART2_TXD = 98,
-	MX25_PAD_UART2_RTS = 99,
-	MX25_PAD_UART2_CTS = 100,
-	MX25_PAD_SD1_CMD = 101,
-	MX25_PAD_SD1_CLK = 102,
-	MX25_PAD_SD1_DATA0 = 103,
-	MX25_PAD_SD1_DATA1 = 104,
-	MX25_PAD_SD1_DATA2 = 105,
-	MX25_PAD_SD1_DATA3 = 106,
-	MX25_PAD_KPP_ROW0 = 107,
-	MX25_PAD_KPP_ROW1 = 108,
-	MX25_PAD_KPP_ROW2 = 109,
-	MX25_PAD_KPP_ROW3 = 110,
-	MX25_PAD_KPP_COL0 = 111,
-	MX25_PAD_KPP_COL1 = 112,
-	MX25_PAD_KPP_COL2 = 113,
-	MX25_PAD_KPP_COL3 = 114,
-	MX25_PAD_FEC_MDC = 115,
-	MX25_PAD_FEC_MDIO = 116,
-	MX25_PAD_FEC_TDATA0 = 117,
-	MX25_PAD_FEC_TDATA1 = 118,
-	MX25_PAD_FEC_TX_EN = 119,
-	MX25_PAD_FEC_RDATA0 = 120,
-	MX25_PAD_FEC_RDATA1 = 121,
-	MX25_PAD_FEC_RX_DV = 122,
-	MX25_PAD_FEC_TX_CLK = 123,
-	MX25_PAD_RTCK = 124,
-	MX25_PAD_DE_B = 125,
-	MX25_PAD_GPIO_A = 126,
-	MX25_PAD_GPIO_B = 127,
-	MX25_PAD_GPIO_C = 128,
-	MX25_PAD_GPIO_D = 129,
-	MX25_PAD_GPIO_E = 130,
-	MX25_PAD_GPIO_F = 131,
-	MX25_PAD_EXT_ARMCLK = 132,
-	MX25_PAD_UPLL_BYPCLK = 133,
-	MX25_PAD_VSTBY_REQ = 134,
-	MX25_PAD_VSTBY_ACK = 135,
-	MX25_PAD_POWER_FAIL  = 136,
-	MX25_PAD_CLKO = 137,
-	MX25_PAD_BOOT_MODE0 = 138,
-	MX25_PAD_BOOT_MODE1 = 139,
+	MX25_PAD_A10 = 2,
+	MX25_PAD_A13 = 3,
+	MX25_PAD_A14 = 4,
+	MX25_PAD_A15 = 5,
+	MX25_PAD_A16 = 6,
+	MX25_PAD_A17 = 7,
+	MX25_PAD_A18 = 8,
+	MX25_PAD_A19 = 9,
+	MX25_PAD_A20 = 10,
+	MX25_PAD_A21 = 11,
+	MX25_PAD_A22 = 12,
+	MX25_PAD_A23 = 13,
+	MX25_PAD_A24 = 14,
+	MX25_PAD_A25 = 15,
+	MX25_PAD_EB0 = 16,
+	MX25_PAD_EB1 = 17,
+	MX25_PAD_OE = 18,
+	MX25_PAD_CS0 = 19,
+	MX25_PAD_CS1 = 20,
+	MX25_PAD_CS4 = 21,
+	MX25_PAD_CS5 = 22,
+	MX25_PAD_NF_CE0 = 23,
+	MX25_PAD_ECB = 24,
+	MX25_PAD_LBA = 25,
+	MX25_PAD_BCLK = 26,
+	MX25_PAD_RW = 27,
+	MX25_PAD_NFWE_B = 28,
+	MX25_PAD_NFRE_B = 29,
+	MX25_PAD_NFALE = 30,
+	MX25_PAD_NFCLE = 31,
+	MX25_PAD_NFWP_B = 32,
+	MX25_PAD_NFRB = 33,
+	MX25_PAD_D15 = 34,
+	MX25_PAD_D14 = 35,
+	MX25_PAD_D13 = 36,
+	MX25_PAD_D12 = 37,
+	MX25_PAD_D11 = 38,
+	MX25_PAD_D10 = 39,
+	MX25_PAD_D9 = 40,
+	MX25_PAD_D8 = 41,
+	MX25_PAD_D7 = 42,
+	MX25_PAD_D6 = 43,
+	MX25_PAD_D5 = 44,
+	MX25_PAD_D4 = 45,
+	MX25_PAD_D3 = 46,
+	MX25_PAD_D2 = 47,
+	MX25_PAD_D1 = 48,
+	MX25_PAD_D0 = 49,
+	MX25_PAD_LD0 = 50,
+	MX25_PAD_LD1 = 51,
+	MX25_PAD_LD2 = 52,
+	MX25_PAD_LD3 = 53,
+	MX25_PAD_LD4 = 54,
+	MX25_PAD_LD5 = 55,
+	MX25_PAD_LD6 = 56,
+	MX25_PAD_LD7 = 57,
+	MX25_PAD_LD8 = 58,
+	MX25_PAD_LD9 = 59,
+	MX25_PAD_LD10 = 60,
+	MX25_PAD_LD11 = 61,
+	MX25_PAD_LD12 = 62,
+	MX25_PAD_LD13 = 63,
+	MX25_PAD_LD14 = 64,
+	MX25_PAD_LD15 = 65,
+	MX25_PAD_HSYNC = 66,
+	MX25_PAD_VSYNC = 67,
+	MX25_PAD_LSCLK = 68,
+	MX25_PAD_OE_ACD = 69,
+	MX25_PAD_CONTRAST = 70,
+	MX25_PAD_PWM = 71,
+	MX25_PAD_CSI_D2 = 72,
+	MX25_PAD_CSI_D3 = 73,
+	MX25_PAD_CSI_D4 = 74,
+	MX25_PAD_CSI_D5 = 75,
+	MX25_PAD_CSI_D6 = 76,
+	MX25_PAD_CSI_D7 = 77,
+	MX25_PAD_CSI_D8 = 78,
+	MX25_PAD_CSI_D9 = 79,
+	MX25_PAD_CSI_MCLK = 80,
+	MX25_PAD_CSI_VSYNC = 81,
+	MX25_PAD_CSI_HSYNC = 82,
+	MX25_PAD_CSI_PIXCLK = 83,
+	MX25_PAD_I2C1_CLK = 84,
+	MX25_PAD_I2C1_DAT = 85,
+	MX25_PAD_CSPI1_MOSI = 86,
+	MX25_PAD_CSPI1_MISO = 87,
+	MX25_PAD_CSPI1_SS0 = 88,
+	MX25_PAD_CSPI1_SS1 = 89,
+	MX25_PAD_CSPI1_SCLK = 90,
+	MX25_PAD_CSPI1_RDY = 91,
+	MX25_PAD_UART1_RXD = 92,
+	MX25_PAD_UART1_TXD = 93,
+	MX25_PAD_UART1_RTS = 94,
+	MX25_PAD_UART1_CTS = 95,
+	MX25_PAD_UART2_RXD = 96,
+	MX25_PAD_UART2_TXD = 97,
+	MX25_PAD_UART2_RTS = 98,
+	MX25_PAD_UART2_CTS = 99,
+	MX25_PAD_SD1_CMD = 100,
+	MX25_PAD_SD1_CLK = 101,
+	MX25_PAD_SD1_DATA0 = 102,
+	MX25_PAD_SD1_DATA1 = 103,
+	MX25_PAD_SD1_DATA2 = 104,
+	MX25_PAD_SD1_DATA3 = 105,
+	MX25_PAD_KPP_ROW0 = 106,
+	MX25_PAD_KPP_ROW1 = 107,
+	MX25_PAD_KPP_ROW2 = 108,
+	MX25_PAD_KPP_ROW3 = 109,
+	MX25_PAD_KPP_COL0 = 110,
+	MX25_PAD_KPP_COL1 = 111,
+	MX25_PAD_KPP_COL2 = 112,
+	MX25_PAD_KPP_COL3 = 113,
+	MX25_PAD_FEC_MDC = 114,
+	MX25_PAD_FEC_MDIO = 115,
+	MX25_PAD_FEC_TDATA0 = 116,
+	MX25_PAD_FEC_TDATA1 = 117,
+	MX25_PAD_FEC_TX_EN = 118,
+	MX25_PAD_FEC_RDATA0 = 119,
+	MX25_PAD_FEC_RDATA1 = 120,
+	MX25_PAD_FEC_RX_DV = 121,
+	MX25_PAD_FEC_TX_CLK = 122,
+	MX25_PAD_RTCK = 123,
+	MX25_PAD_DE_B = 124,
+	MX25_PAD_GPIO_A = 125,
+	MX25_PAD_GPIO_B = 126,
+	MX25_PAD_GPIO_C = 127,
+	MX25_PAD_GPIO_D = 128,
+	MX25_PAD_GPIO_E = 129,
+	MX25_PAD_GPIO_F = 130,
+	MX25_PAD_EXT_ARMCLK = 131,
+	MX25_PAD_UPLL_BYPCLK = 132,
+	MX25_PAD_VSTBY_REQ = 133,
+	MX25_PAD_VSTBY_ACK = 134,
+	MX25_PAD_POWER_FAIL  = 135,
+	MX25_PAD_CLKO = 136,
+	MX25_PAD_BOOT_MODE0 = 137,
+	MX25_PAD_BOOT_MODE1 = 138,
 };
 
 /* Pad names for the pinmux subsystem */
 static const struct pinctrl_pin_desc imx25_pinctrl_pads[] = {
 	IMX_PINCTRL_PIN(MX25_PAD_RESERVE0),
-	IMX_PINCTRL_PIN(MX25_PAD_RESERVE1),
 	IMX_PINCTRL_PIN(MX25_PAD_A10),
 	IMX_PINCTRL_PIN(MX25_PAD_A13),
 	IMX_PINCTRL_PIN(MX25_PAD_A14),
Index: linux-3.18.13-rt10-r7s4/drivers/pinctrl/pinctrl-xway.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pinctrl/pinctrl-xway.c
+++ linux-3.18.13-rt10-r7s4/drivers/pinctrl/pinctrl-xway.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:801 @ static int pinmux_xway_probe(struct plat
 
 	/* load the gpio chip */
 	xway_chip.dev = &pdev->dev;
-	of_gpiochip_add(&xway_chip);
 	ret = gpiochip_add(&xway_chip);
 	if (ret) {
-		of_gpiochip_remove(&xway_chip);
 		dev_err(&pdev->dev, "Failed to register gpio chip\n");
 		return ret;
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/pinctrl/qcom/pinctrl-msm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/pinctrl/qcom/pinctrl-msm.c
+++ linux-3.18.13-rt10-r7s4/drivers/pinctrl/qcom/pinctrl-msm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:868 @ static int msm_ps_hold_restart(struct no
 
 static void msm_pinctrl_setup_pm_reset(struct msm_pinctrl *pctrl)
 {
-	int i = 0;
+	int i;
 	const struct msm_function *func = pctrl->soc->functions;
 
-	for (; i <= pctrl->soc->nfunctions; i++)
+	for (i = 0; i < pctrl->soc->nfunctions; i++)
 		if (!strcmp(func[i].name, "ps_hold")) {
 			pctrl->restart_nb.notifier_call = msm_ps_hold_restart;
 			pctrl->restart_nb.priority = 128;
Index: linux-3.18.13-rt10-r7s4/drivers/platform/x86/asus-nb-wmi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/platform/x86/asus-nb-wmi.c
+++ linux-3.18.13-rt10-r7s4/drivers/platform/x86/asus-nb-wmi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:194 @ static const struct dmi_system_id asus_q
 	},
 	{
 		.callback = dmi_matched,
+		.ident = "ASUSTeK COMPUTER INC. X551CA",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "X551CA"),
+		},
+		.driver_data = &quirk_asus_wapf4,
+	},
+	{
+		.callback = dmi_matched,
 		.ident = "ASUSTeK COMPUTER INC. X55A",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
Index: linux-3.18.13-rt10-r7s4/drivers/platform/x86/hp_accel.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/platform/x86/hp_accel.c
+++ linux-3.18.13-rt10-r7s4/drivers/platform/x86/hp_accel.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:249 @ static const struct dmi_system_id lis3lv
 	AXIS_DMI_MATCH("HPB64xx", "HP ProBook 64", xy_swap),
 	AXIS_DMI_MATCH("HPB64xx", "HP EliteBook 84", xy_swap),
 	AXIS_DMI_MATCH("HPB65xx", "HP ProBook 65", x_inverted),
+	AXIS_DMI_MATCH("HPZBook15", "HP ZBook 15", x_inverted),
 	{ NULL, }
 /* Laptop models without axis info (yet):
  * "NC6910" "HP Compaq 6910"
Index: linux-3.18.13-rt10-r7s4/drivers/platform/x86/samsung-laptop.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/platform/x86/samsung-laptop.c
+++ linux-3.18.13-rt10-r7s4/drivers/platform/x86/samsung-laptop.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:356 @ struct samsung_quirks {
 	bool broken_acpi_video;
 	bool four_kbd_backlight_levels;
 	bool enable_kbd_backlight;
+	bool use_native_backlight;
 };
 
 static struct samsung_quirks samsung_unknown = {};
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:365 @ static struct samsung_quirks samsung_bro
 	.broken_acpi_video = true,
 };
 
+static struct samsung_quirks samsung_use_native_backlight = {
+	.use_native_backlight = true,
+};
+
 static struct samsung_quirks samsung_np740u3e = {
 	.four_kbd_backlight_levels = true,
 	.enable_kbd_backlight = true,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1515 @ static struct dmi_system_id __initdata s
 		DMI_MATCH(DMI_PRODUCT_NAME, "N150P"),
 		DMI_MATCH(DMI_BOARD_NAME, "N150P"),
 		},
-	 .driver_data = &samsung_broken_acpi_video,
+	 .driver_data = &samsung_use_native_backlight,
 	},
 	{
 	 .callback = samsung_dmi_matched,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1525 @ static struct dmi_system_id __initdata s
 		DMI_MATCH(DMI_PRODUCT_NAME, "N145P/N250P/N260P"),
 		DMI_MATCH(DMI_BOARD_NAME, "N145P/N250P/N260P"),
 		},
-	 .driver_data = &samsung_broken_acpi_video,
+	 .driver_data = &samsung_use_native_backlight,
 	},
 	{
 	 .callback = samsung_dmi_matched,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1565 @ static struct dmi_system_id __initdata s
 		DMI_MATCH(DMI_PRODUCT_NAME, "N250P"),
 		DMI_MATCH(DMI_BOARD_NAME, "N250P"),
 		},
-	 .driver_data = &samsung_broken_acpi_video,
+	 .driver_data = &samsung_use_native_backlight,
 	},
 	{
 	 .callback = samsung_dmi_matched,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1624 @ static int __init samsung_init(void)
 		pr_info("Disabling ACPI video driver\n");
 		acpi_video_unregister();
 	}
+
+	if (samsung->quirks->use_native_backlight) {
+		pr_info("Using native backlight driver\n");
+		/* Tell acpi-video to not handle the backlight */
+		acpi_video_dmi_promote_vendor();
+		acpi_video_unregister();
+		/* And also do not handle it ourselves */
+		samsung->handle_backlight = false;
+	}
 #endif
 
 	ret = samsung_platform_init(samsung);
Index: linux-3.18.13-rt10-r7s4/drivers/power/88pm860x_charger.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/power/88pm860x_charger.c
+++ linux-3.18.13-rt10-r7s4/drivers/power/88pm860x_charger.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:714 @ static int pm860x_charger_probe(struct p
 	return 0;
 
 out_irq:
+	power_supply_unregister(&info->usb);
 	while (--i >= 0)
 		free_irq(info->irq[i], info);
 out:
Index: linux-3.18.13-rt10-r7s4/drivers/power/bq24190_charger.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/power/bq24190_charger.c
+++ linux-3.18.13-rt10-r7s4/drivers/power/bq24190_charger.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:932 @ static void bq24190_charger_init(struct
 	charger->properties = bq24190_charger_properties;
 	charger->num_properties = ARRAY_SIZE(bq24190_charger_properties);
 	charger->supplied_to = bq24190_charger_supplied_to;
-	charger->num_supplies = ARRAY_SIZE(bq24190_charger_supplied_to);
+	charger->num_supplicants = ARRAY_SIZE(bq24190_charger_supplied_to);
 	charger->get_property = bq24190_charger_get_property;
 	charger->set_property = bq24190_charger_set_property;
 	charger->property_is_writeable = bq24190_charger_property_is_writeable;
Index: linux-3.18.13-rt10-r7s4/drivers/power/gpio-charger.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/power/gpio-charger.c
+++ linux-3.18.13-rt10-r7s4/drivers/power/gpio-charger.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:171 @ static int gpio_charger_suspend(struct d
 
 	if (device_may_wakeup(dev))
 		gpio_charger->wakeup_enabled =
-			enable_irq_wake(gpio_charger->irq);
+			!enable_irq_wake(gpio_charger->irq);
 
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:181 @ static int gpio_charger_resume(struct de
 	struct platform_device *pdev = to_platform_device(dev);
 	struct gpio_charger *gpio_charger = platform_get_drvdata(pdev);
 
-	if (gpio_charger->wakeup_enabled)
+	if (device_may_wakeup(dev) && gpio_charger->wakeup_enabled)
 		disable_irq_wake(gpio_charger->irq);
 	power_supply_changed(&gpio_charger->charger);
 
Index: linux-3.18.13-rt10-r7s4/drivers/regulator/anatop-regulator.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/regulator/anatop-regulator.c
+++ linux-3.18.13-rt10-r7s4/drivers/regulator/anatop-regulator.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:286 @ static int anatop_regulator_probe(struct
 			sreg->sel = 0;
 			sreg->bypass = true;
 		}
+
+		/*
+		 * In case vddpu was disabled by the bootloader, we need to set
+		 * a sane default until imx6-cpufreq was probed and changes the
+		 * voltage to the correct value. In this case we set 1.25V.
+		 */
+		if (!sreg->sel && !strcmp(sreg->name, "vddpu"))
+			sreg->sel = 22;
 	} else {
 		rdesc->ops = &anatop_rops;
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/regulator/core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/regulator/core.c
+++ linux-3.18.13-rt10-r7s4/drivers/regulator/core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1491 @ struct regulator *regulator_get_optional
 }
 EXPORT_SYMBOL_GPL(regulator_get_optional);
 
-/* Locks held by regulator_put() */
+/* regulator_list_mutex lock held by regulator_put() */
 static void _regulator_put(struct regulator *regulator)
 {
 	struct regulator_dev *rdev;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1506 @ static void _regulator_put(struct regula
 	/* remove any sysfs entries */
 	if (regulator->dev)
 		sysfs_remove_link(&rdev->dev.kobj, regulator->supply_name);
+	mutex_lock(&rdev->mutex);
 	kfree(regulator->supply_name);
 	list_del(&regulator->list);
 	kfree(regulator);
 
 	rdev->open_count--;
 	rdev->exclusive = 0;
+	mutex_unlock(&rdev->mutex);
 
 	module_put(rdev->owner);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1844 @ static int _regulator_do_enable(struct r
 	}
 
 	if (rdev->ena_pin) {
-		ret = regulator_ena_gpio_ctrl(rdev, true);
-		if (ret < 0)
-			return ret;
-		rdev->ena_gpio_state = 1;
+		if (!rdev->ena_gpio_state) {
+			ret = regulator_ena_gpio_ctrl(rdev, true);
+			if (ret < 0)
+				return ret;
+			rdev->ena_gpio_state = 1;
+		}
 	} else if (rdev->desc->ops->enable) {
 		ret = rdev->desc->ops->enable(rdev);
 		if (ret < 0)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1946 @ static int _regulator_do_disable(struct
 	trace_regulator_disable(rdev_get_name(rdev));
 
 	if (rdev->ena_pin) {
-		ret = regulator_ena_gpio_ctrl(rdev, false);
-		if (ret < 0)
-			return ret;
-		rdev->ena_gpio_state = 0;
+		if (rdev->ena_gpio_state) {
+			ret = regulator_ena_gpio_ctrl(rdev, false);
+			if (ret < 0)
+				return ret;
+			rdev->ena_gpio_state = 0;
+		}
 
 	} else if (rdev->desc->ops->disable) {
 		ret = rdev->desc->ops->disable(rdev);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3666 @ regulator_register(const struct regulato
 				 config->ena_gpio, ret);
 			goto wash;
 		}
-
-		if (config->ena_gpio_flags & GPIOF_OUT_INIT_HIGH)
-			rdev->ena_gpio_state = 1;
-
-		if (config->ena_gpio_invert)
-			rdev->ena_gpio_state = !rdev->ena_gpio_state;
 	}
 
 	/* set regulator constraints */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3838 @ int regulator_suspend_finish(void)
 	list_for_each_entry(rdev, &regulator_list, list) {
 		mutex_lock(&rdev->mutex);
 		if (rdev->use_count > 0  || rdev->constraints->always_on) {
-			error = _regulator_do_enable(rdev);
-			if (error)
-				ret = error;
+			if (!_regulator_is_enabled(rdev)) {
+				error = _regulator_do_enable(rdev);
+				if (error)
+					ret = error;
+			}
 		} else {
 			if (!have_full_constraints())
 				goto unlock;
Index: linux-3.18.13-rt10-r7s4/drivers/regulator/palmas-regulator.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/regulator/palmas-regulator.c
+++ linux-3.18.13-rt10-r7s4/drivers/regulator/palmas-regulator.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1575 @ static int palmas_regulators_probe(struc
 	if (!pmic)
 		return -ENOMEM;
 
+	if (of_device_is_compatible(node, "ti,tps659038-pmic"))
+		palmas_generic_regs_info[PALMAS_REG_REGEN2].ctrl_addr =
+							TPS659038_REGEN2_CTRL;
+
 	pmic->dev = &pdev->dev;
 	pmic->palmas = palmas;
 	palmas->pmic = pmic;
Index: linux-3.18.13-rt10-r7s4/drivers/regulator/rk808-regulator.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/regulator/rk808-regulator.c
+++ linux-3.18.13-rt10-r7s4/drivers/regulator/rk808-regulator.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:187 @ static const struct regulator_desc rk808
 		.vsel_mask = RK808_LDO_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(0),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "LDO_REG2",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:202 @ static const struct regulator_desc rk808
 		.vsel_mask = RK808_LDO_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(1),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "LDO_REG3",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:217 @ static const struct regulator_desc rk808
 		.vsel_mask = RK808_BUCK4_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(2),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "LDO_REG4",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:232 @ static const struct regulator_desc rk808
 		.vsel_mask = RK808_LDO_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(3),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "LDO_REG5",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:247 @ static const struct regulator_desc rk808
 		.vsel_mask = RK808_LDO_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(4),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "LDO_REG6",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:262 @ static const struct regulator_desc rk808
 		.vsel_mask = RK808_LDO_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(5),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "LDO_REG7",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:277 @ static const struct regulator_desc rk808
 		.vsel_mask = RK808_LDO_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(6),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "LDO_REG8",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:292 @ static const struct regulator_desc rk808
 		.vsel_mask = RK808_LDO_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(7),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "SWITCH_REG1",
Index: linux-3.18.13-rt10-r7s4/drivers/regulator/s2mps11.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/regulator/s2mps11.c
+++ linux-3.18.13-rt10-r7s4/drivers/regulator/s2mps11.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:482 @ static struct regulator_ops s2mps14_reg_
 	.enable_mask	= S2MPS14_ENABLE_MASK		\
 }
 
-#define regulator_desc_s2mps14_buck(num, min, step) {		\
+#define regulator_desc_s2mps14_buck(num, min, step, min_sel) {	\
 	.name		= "BUCK"#num,				\
 	.id		= S2MPS14_BUCK##num,			\
 	.ops		= &s2mps14_reg_ops,			\
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:491 @ static struct regulator_ops s2mps14_reg_
 	.min_uV		= min,					\
 	.uV_step	= step,					\
 	.n_voltages	= S2MPS14_BUCK_N_VOLTAGES,		\
-	.linear_min_sel = S2MPS14_BUCK1235_START_SEL,		\
+	.linear_min_sel = min_sel,				\
 	.ramp_delay	= S2MPS14_BUCK_RAMP_DELAY,		\
 	.vsel_reg	= S2MPS14_REG_B1CTRL2 + (num - 1) * 2,	\
 	.vsel_mask	= S2MPS14_BUCK_VSEL_MASK,		\
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:525 @ static const struct regulator_desc s2mps
 	regulator_desc_s2mps14_ldo(23, MIN_800_MV, STEP_25_MV),
 	regulator_desc_s2mps14_ldo(24, MIN_1800_MV, STEP_25_MV),
 	regulator_desc_s2mps14_ldo(25, MIN_1800_MV, STEP_25_MV),
-	regulator_desc_s2mps14_buck(1, MIN_600_MV, STEP_6_25_MV),
-	regulator_desc_s2mps14_buck(2, MIN_600_MV, STEP_6_25_MV),
-	regulator_desc_s2mps14_buck(3, MIN_600_MV, STEP_6_25_MV),
-	regulator_desc_s2mps14_buck(4, MIN_1400_MV, STEP_12_5_MV),
-	regulator_desc_s2mps14_buck(5, MIN_600_MV, STEP_6_25_MV),
+	regulator_desc_s2mps14_buck(1, MIN_600_MV, STEP_6_25_MV,
+				    S2MPS14_BUCK1235_START_SEL),
+	regulator_desc_s2mps14_buck(2, MIN_600_MV, STEP_6_25_MV,
+				    S2MPS14_BUCK1235_START_SEL),
+	regulator_desc_s2mps14_buck(3, MIN_600_MV, STEP_6_25_MV,
+				    S2MPS14_BUCK1235_START_SEL),
+	regulator_desc_s2mps14_buck(4, MIN_1400_MV, STEP_12_5_MV,
+				    S2MPS14_BUCK4_START_SEL),
+	regulator_desc_s2mps14_buck(5, MIN_600_MV, STEP_6_25_MV,
+				    S2MPS14_BUCK1235_START_SEL),
 };
 
 static int s2mps14_pmic_enable_ext_control(struct s2mps11_info *s2mps11,
Index: linux-3.18.13-rt10-r7s4/drivers/reset/reset-sunxi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/reset/reset-sunxi.c
+++ linux-3.18.13-rt10-r7s4/drivers/reset/reset-sunxi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:105 @ static int sunxi_reset_init(struct devic
 		goto err_alloc;
 	}
 
+	spin_lock_init(&data->lock);
+
 	data->rcdev.owner = THIS_MODULE;
 	data->rcdev.nr_resets = size * 32;
 	data->rcdev.ops = &sunxi_reset_ops;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:162 @ static int sunxi_reset_probe(struct plat
 	if (IS_ERR(data->membase))
 		return PTR_ERR(data->membase);
 
+	spin_lock_init(&data->lock);
+
 	data->rcdev.owner = THIS_MODULE;
 	data->rcdev.nr_resets = resource_size(res) * 32;
 	data->rcdev.ops = &sunxi_reset_ops;
Index: linux-3.18.13-rt10-r7s4/drivers/rtc/rtc-isl12057.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/rtc/rtc-isl12057.c
+++ linux-3.18.13-rt10-r7s4/drivers/rtc/rtc-isl12057.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:91 @ static void isl12057_rtc_regs_to_tm(stru
 	tm->tm_min = bcd2bin(regs[ISL12057_REG_RTC_MN]);
 
 	if (regs[ISL12057_REG_RTC_HR] & ISL12057_REG_RTC_HR_MIL) { /* AM/PM */
-		tm->tm_hour = bcd2bin(regs[ISL12057_REG_RTC_HR] & 0x0f);
+		tm->tm_hour = bcd2bin(regs[ISL12057_REG_RTC_HR] & 0x1f);
 		if (regs[ISL12057_REG_RTC_HR] & ISL12057_REG_RTC_HR_PM)
 			tm->tm_hour += 12;
 	} else {					    /* 24 hour mode */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:100 @ static void isl12057_rtc_regs_to_tm(stru
 
 	tm->tm_mday = bcd2bin(regs[ISL12057_REG_RTC_DT]);
 	tm->tm_wday = bcd2bin(regs[ISL12057_REG_RTC_DW]) - 1; /* starts at 1 */
-	tm->tm_mon  = bcd2bin(regs[ISL12057_REG_RTC_MO]) - 1; /* starts at 1 */
+	tm->tm_mon  = bcd2bin(regs[ISL12057_REG_RTC_MO] & 0x1f) - 1; /* ditto */
 	tm->tm_year = bcd2bin(regs[ISL12057_REG_RTC_YR]) + 100;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/rtc/rtc-omap.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/rtc/rtc-omap.c
+++ linux-3.18.13-rt10-r7s4/drivers/rtc/rtc-omap.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:419 @ static int __init omap_rtc_probe(struct
 		rtc_writel(KICK1_VALUE, OMAP_RTC_KICK1_REG);
 	}
 
+	device_init_wakeup(&pdev->dev, true);
+
 	rtc = devm_rtc_device_register(&pdev->dev, pdev->name,
 			&omap_rtc_ops, THIS_MODULE);
 	if (IS_ERR(rtc)) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:436 @ static int __init omap_rtc_probe(struct
 	rtc_write(0, OMAP_RTC_INTERRUPTS_REG);
 
 	/* enable RTC functional clock */
-	if (id_entry->driver_data & OMAP_RTC_HAS_32KCLK_EN)
-		rtc_writel(OMAP_RTC_OSC_32KCLK_EN, OMAP_RTC_OSC_REG);
+	if (id_entry->driver_data & OMAP_RTC_HAS_32KCLK_EN) {
+		reg = rtc_read(OMAP_RTC_OSC_REG);
+		rtc_writel(reg | OMAP_RTC_OSC_32KCLK_EN, OMAP_RTC_OSC_REG);
+	}
 
 	/* clear old status */
 	reg = rtc_read(OMAP_RTC_STATUS_REG);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:489 @ static int __init omap_rtc_probe(struct
 	 *    is write-only, and always reads as zero...)
 	 */
 
-	device_init_wakeup(&pdev->dev, true);
-
 	if (new_ctrl & (u8) OMAP_RTC_CTRL_SPLIT)
 		pr_info("%s: split power mode\n", pdev->name);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:498 @ static int __init omap_rtc_probe(struct
 	return 0;
 
 fail0:
+	device_init_wakeup(&pdev->dev, false);
 	if (id_entry->driver_data & OMAP_RTC_HAS_KICKER)
 		rtc_writel(0, OMAP_RTC_KICK0_REG);
 	pm_runtime_put_sync(&pdev->dev);
Index: linux-3.18.13-rt10-r7s4/drivers/rtc/rtc-s3c.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/rtc/rtc-s3c.c
+++ linux-3.18.13-rt10-r7s4/drivers/rtc/rtc-s3c.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:852 @ static struct s3c_rtc_data const s3c2443
 
 static struct s3c_rtc_data const s3c6410_rtc_data = {
 	.max_user_freq		= 32768,
+	.needs_src_clk		= true,
 	.irq_handler		= s3c6410_rtc_irq,
 	.set_freq		= s3c6410_rtc_setfreq,
 	.enable_tick		= s3c6410_rtc_enable_tick,
Index: linux-3.18.13-rt10-r7s4/drivers/rtc/rtc-s5m.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/rtc/rtc-s5m.c
+++ linux-3.18.13-rt10-r7s4/drivers/rtc/rtc-s5m.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:835 @ static SIMPLE_DEV_PM_OPS(s5m_rtc_pm_ops,
 static const struct platform_device_id s5m_rtc_id[] = {
 	{ "s5m-rtc",		S5M8767X },
 	{ "s2mps14-rtc",	S2MPS14X },
+	{ },
 };
 
 static struct platform_driver s5m_rtc_driver = {
Index: linux-3.18.13-rt10-r7s4/drivers/rtc/rtc-sirfsoc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/rtc/rtc-sirfsoc.c
+++ linux-3.18.13-rt10-r7s4/drivers/rtc/rtc-sirfsoc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:289 @ static int sirfsoc_rtc_probe(struct plat
 	rtc_div = ((32768 / RTC_HZ) / 2) - 1;
 	sirfsoc_rtc_iobrg_writel(rtc_div, rtcdrv->rtc_base + RTC_DIV);
 
-	rtcdrv->rtc = devm_rtc_device_register(&pdev->dev, pdev->name,
-			&sirfsoc_rtc_ops, THIS_MODULE);
-	if (IS_ERR(rtcdrv->rtc)) {
-		err = PTR_ERR(rtcdrv->rtc);
-		dev_err(&pdev->dev, "can't register RTC device\n");
-		return err;
-	}
-
 	/* 0x3 -> RTC_CLK */
 	sirfsoc_rtc_iobrg_writel(SIRFSOC_RTC_CLK,
 			rtcdrv->rtc_base + RTC_CLOCK_SWITCH);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:303 @ static int sirfsoc_rtc_probe(struct plat
 	rtcdrv->overflow_rtc =
 		sirfsoc_rtc_iobrg_readl(rtcdrv->rtc_base + RTC_SW_VALUE);
 
+	rtcdrv->rtc = devm_rtc_device_register(&pdev->dev, pdev->name,
+			&sirfsoc_rtc_ops, THIS_MODULE);
+	if (IS_ERR(rtcdrv->rtc)) {
+		err = PTR_ERR(rtcdrv->rtc);
+		dev_err(&pdev->dev, "can't register RTC device\n");
+		return err;
+	}
+
 	rtcdrv->irq = platform_get_irq(pdev, 0);
 	err = devm_request_irq(
 			&pdev->dev,
Index: linux-3.18.13-rt10-r7s4/drivers/s390/crypto/ap_bus.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/s390/crypto/ap_bus.c
+++ linux-3.18.13-rt10-r7s4/drivers/s390/crypto/ap_bus.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:47 @
 #include <linux/hrtimer.h>
 #include <linux/ktime.h>
 #include <asm/facility.h>
+#include <linux/crypto.h>
 
 #include "ap_bus.h"
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:75 @ MODULE_AUTHOR("IBM Corporation");
 MODULE_DESCRIPTION("Adjunct Processor Bus driver, " \
 		   "Copyright IBM Corp. 2006, 2012");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("z90crypt");
+MODULE_ALIAS_CRYPTO("z90crypt");
 
 /*
  * Module parameter
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/NCR5380.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/NCR5380.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/NCR5380.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2650 @ static void NCR5380_dma_complete(NCR5380
  *
  * Purpose : abort a command
  *
- * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the 
- *      host byte of the result field to, if zero DID_ABORTED is 
+ * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the
+ *      host byte of the result field to, if zero DID_ABORTED is
  *      used.
  *
- * Returns : 0 - success, -1 on failure.
+ * Returns : SUCCESS - success, FAILED on failure.
  *
- *	XXX - there is no way to abort the command that is currently 
- *	connected, you have to wait for it to complete.  If this is 
+ *	XXX - there is no way to abort the command that is currently
+ *	connected, you have to wait for it to complete.  If this is
  *	a problem, we could implement longjmp() / setjmp(), setjmp()
  *	called where the loop started in NCR5380_main().
  *
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2707 @ static int NCR5380_abort(Scsi_Cmnd * cmd
  * aborted flag and get back into our main loop.
  */
 
-		return 0;
+		return SUCCESS;
 	}
 #endif
 
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/aha1740.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/aha1740.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/aha1740.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:534 @ static int aha1740_eh_abort_handler (Scs
  * quiet as possible...
  */
 
-	return 0;
+	return SUCCESS;
 }
 
 static struct scsi_host_template aha1740_template = {
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/atari_NCR5380.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/atari_NCR5380.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/atari_NCR5380.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2610 @ static void NCR5380_reselect(struct Scsi
  *	host byte of the result field to, if zero DID_ABORTED is
  *	used.
  *
- * Returns : 0 - success, -1 on failure.
+ * Returns : SUCCESS - success, FAILED on failure.
  *
  * XXX - there is no way to abort the command that is currently
  *	 connected, you have to wait for it to complete.  If this is
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/be2iscsi/be_main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/be2iscsi/be_main.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/be2iscsi/be_main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:589 @ static struct beiscsi_hba *beiscsi_hba_a
 			"beiscsi_hba_alloc - iscsi_host_alloc failed\n");
 		return NULL;
 	}
-	shost->dma_boundary = pcidev->dma_mask;
 	shost->max_id = BE2_MAX_SESSIONS;
 	shost->max_channel = 0;
 	shost->max_cmd_len = BEISCSI_MAX_CMD_LEN;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5738 @ free_port:
 hba_free:
 	if (phba->msix_enabled)
 		pci_disable_msix(phba->pcidev);
-	iscsi_host_remove(phba->shost);
 	pci_dev_put(phba->pcidev);
 	iscsi_host_free(phba->shost);
+	pci_set_drvdata(pcidev, NULL);
 disable_pci:
 	pci_disable_device(pcidev);
 	return ret;
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/esas2r/esas2r_main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/esas2r/esas2r_main.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/esas2r/esas2r_main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1060 @ int esas2r_eh_abort(struct scsi_cmnd *cm
 
 		cmd->scsi_done(cmd);
 
-		return 0;
+		return SUCCESS;
 	}
 
 	spin_lock_irqsave(&a->queue_lock, flags);
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/ipr.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/ipr.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/ipr.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:686 @ static void ipr_init_ipr_cmnd(struct ipr
 	ipr_reinit_ipr_cmnd(ipr_cmd);
 	ipr_cmd->u.scratch = 0;
 	ipr_cmd->sibling = NULL;
+	ipr_cmd->eh_comp = NULL;
 	ipr_cmd->fast_done = fast_done;
 	init_timer(&ipr_cmd->timer);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:852 @ static void ipr_scsi_eh_done(struct ipr_
 
 	scsi_dma_unmap(ipr_cmd->scsi_cmd);
 	scsi_cmd->scsi_done(scsi_cmd);
+	if (ipr_cmd->eh_comp)
+		complete(ipr_cmd->eh_comp);
 	list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4859 @ static int ipr_slave_alloc(struct scsi_d
 	return rc;
 }
 
+/**
+ * ipr_match_lun - Match function for specified LUN
+ * @ipr_cmd:	ipr command struct
+ * @device:		device to match (sdev)
+ *
+ * Returns:
+ *	1 if command matches sdev / 0 if command does not match sdev
+ **/
+static int ipr_match_lun(struct ipr_cmnd *ipr_cmd, void *device)
+{
+	if (ipr_cmd->scsi_cmd && ipr_cmd->scsi_cmd->device == device)
+		return 1;
+	return 0;
+}
+
+/**
+ * ipr_wait_for_ops - Wait for matching commands to complete
+ * @ipr_cmd:	ipr command struct
+ * @device:		device to match (sdev)
+ * @match:		match function to use
+ *
+ * Returns:
+ *	SUCCESS / FAILED
+ **/
+static int ipr_wait_for_ops(struct ipr_ioa_cfg *ioa_cfg, void *device,
+			    int (*match)(struct ipr_cmnd *, void *))
+{
+	struct ipr_cmnd *ipr_cmd;
+	int wait;
+	unsigned long flags;
+	struct ipr_hrr_queue *hrrq;
+	signed long timeout = IPR_ABORT_TASK_TIMEOUT;
+	DECLARE_COMPLETION_ONSTACK(comp);
+
+	ENTER;
+	do {
+		wait = 0;
+
+		for_each_hrrq(hrrq, ioa_cfg) {
+			spin_lock_irqsave(hrrq->lock, flags);
+			list_for_each_entry(ipr_cmd, &hrrq->hrrq_pending_q, queue) {
+				if (match(ipr_cmd, device)) {
+					ipr_cmd->eh_comp = &comp;
+					wait++;
+				}
+			}
+			spin_unlock_irqrestore(hrrq->lock, flags);
+		}
+
+		if (wait) {
+			timeout = wait_for_completion_timeout(&comp, timeout);
+
+			if (!timeout) {
+				wait = 0;
+
+				for_each_hrrq(hrrq, ioa_cfg) {
+					spin_lock_irqsave(hrrq->lock, flags);
+					list_for_each_entry(ipr_cmd, &hrrq->hrrq_pending_q, queue) {
+						if (match(ipr_cmd, device)) {
+							ipr_cmd->eh_comp = NULL;
+							wait++;
+						}
+					}
+					spin_unlock_irqrestore(hrrq->lock, flags);
+				}
+
+				if (wait)
+					dev_err(&ioa_cfg->pdev->dev, "Timed out waiting for aborted commands\n");
+				LEAVE;
+				return wait ? FAILED : SUCCESS;
+			}
+		}
+	} while (wait);
+
+	LEAVE;
+	return SUCCESS;
+}
+
 static int ipr_eh_host_reset(struct scsi_cmnd *cmd)
 {
 	struct ipr_ioa_cfg *ioa_cfg;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5156 @ static int __ipr_eh_dev_reset(struct scs
 static int ipr_eh_dev_reset(struct scsi_cmnd *cmd)
 {
 	int rc;
+	struct ipr_ioa_cfg *ioa_cfg;
+
+	ioa_cfg = (struct ipr_ioa_cfg *) cmd->device->host->hostdata;
 
 	spin_lock_irq(cmd->device->host->host_lock);
 	rc = __ipr_eh_dev_reset(cmd);
 	spin_unlock_irq(cmd->device->host->host_lock);
 
+	if (rc == SUCCESS)
+		rc = ipr_wait_for_ops(ioa_cfg, cmd->device, ipr_match_lun);
+
 	return rc;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5344 @ static int ipr_eh_abort(struct scsi_cmnd
 {
 	unsigned long flags;
 	int rc;
+	struct ipr_ioa_cfg *ioa_cfg;
 
 	ENTER;
 
+	ioa_cfg = (struct ipr_ioa_cfg *) scsi_cmd->device->host->hostdata;
+
 	spin_lock_irqsave(scsi_cmd->device->host->host_lock, flags);
 	rc = ipr_cancel_op(scsi_cmd);
 	spin_unlock_irqrestore(scsi_cmd->device->host->host_lock, flags);
 
+	if (rc == SUCCESS)
+		rc = ipr_wait_for_ops(ioa_cfg, scsi_cmd->device, ipr_match_lun);
 	LEAVE;
 	return rc;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/ipr.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/ipr.h
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/ipr.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1611 @ struct ipr_cmnd {
 		struct scsi_device *sdev;
 	} u;
 
+	struct completion *eh_comp;
 	struct ipr_hrr_queue *hrrq;
 	struct ipr_ioa_cfg *ioa_cfg;
 };
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/libsas/sas_discover.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/libsas/sas_discover.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/libsas/sas_discover.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:503 @ static void sas_revalidate_domain(struct
 	struct sas_discovery_event *ev = to_sas_discovery_event(work);
 	struct asd_sas_port *port = ev->port;
 	struct sas_ha_struct *ha = port->ha;
+	struct domain_device *ddev = port->port_dev;
 
 	/* prevent revalidation from finding sata links in recovery */
 	mutex_lock(&ha->disco_mutex);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:518 @ static void sas_revalidate_domain(struct
 	SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id,
 		    task_pid_nr(current));
 
-	if (port->port_dev)
-		res = sas_ex_revalidate_domain(port->port_dev);
+	if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE ||
+		     ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE))
+		res = sas_ex_revalidate_domain(ddev);
 
 	SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n",
 		    port->id, task_pid_nr(current), res);
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/megaraid.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/megaraid.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/megaraid.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1948 @ megaraid_abort_and_reset(adapter_t *adap
 	     cmd->device->id, (u32)cmd->device->lun);
 
 	if(list_empty(&adapter->pending_list))
-		return FALSE;
+		return FAILED;
 
 	list_for_each_safe(pos, next, &adapter->pending_list) {
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1971 @ megaraid_abort_and_reset(adapter_t *adap
 					(aor==SCB_ABORT) ? "ABORTING":"RESET",
 					scb->idx);
 
-				return FALSE;
+				return FAILED;
 			}
 			else {
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1996 @ megaraid_abort_and_reset(adapter_t *adap
 				list_add_tail(SCSI_LIST(cmd),
 						&adapter->completed_list);
 
-				return TRUE;
+				return SUCCESS;
 			}
 		}
 	}
 
-	return FALSE;
+	return FAILED;
 }
 
 static inline int
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/megaraid/megaraid_sas_base.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/megaraid/megaraid_sas_base.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/megaraid/megaraid_sas_base.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1011 @ megasas_issue_blocked_abort_cmd(struct m
 		cpu_to_le32(upper_32_bits(cmd_to_abort->frame_phys_addr));
 
 	cmd->sync_cmd = 1;
-	cmd->cmd_status = 0xFF;
+	cmd->cmd_status = ENODATA;
 
 	instance->instancet->issue_dcmd(instance, cmd);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3559 @ static int megasas_create_frame_pool(str
 	int i;
 	u32 max_cmd;
 	u32 sge_sz;
-	u32 sgl_sz;
 	u32 total_sz;
 	u32 frame_count;
 	struct megasas_cmd *cmd;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3577 @ static int megasas_create_frame_pool(str
 	}
 
 	/*
-	 * Calculated the number of 64byte frames required for SGL
+	 * For MFI controllers.
+	 * max_num_sge = 60
+	 * max_sge_sz  = 16 byte (sizeof megasas_sge_skinny)
+	 * Total 960 byte (15 MFI frame of 64 byte)
+	 *
+	 * Fusion adapter require only 3 extra frame.
+	 * max_num_sge = 16 (defined as MAX_IOCTL_SGE)
+	 * max_sge_sz  = 12 byte (sizeof  megasas_sge64)
+	 * Total 192 byte (3 MFI frame of 64 byte)
 	 */
-	sgl_sz = sge_sz * instance->max_num_sge;
-	frame_count = (sgl_sz + MEGAMFI_FRAME_SIZE - 1) / MEGAMFI_FRAME_SIZE;
-	frame_count = 15;
-
-	/*
-	 * We need one extra frame for the MFI command
-	 */
-	frame_count++;
-
+	frame_count = instance->ctrl_context ? (3 + 1) : (15 + 1);
 	total_sz = MEGAMFI_FRAME_SIZE * frame_count;
 	/*
 	 * Use DMA pool facility provided by PCI layer
 	 */
 	instance->frame_dma_pool = pci_pool_create("megasas frame pool",
-						   instance->pdev, total_sz, 64,
-						   0);
+					instance->pdev, total_sz, 256, 0);
 
 	if (!instance->frame_dma_pool) {
 		printk(KERN_DEBUG "megasas: failed to setup frame pool\n");
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/megaraid/megaraid_sas_fp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/megaraid/megaraid_sas_fp.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/megaraid/megaraid_sas_fp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:173 @ void MR_PopulateDrvRaidMap(struct megasa
 	struct MR_FW_RAID_MAP_ALL     *fw_map_old    = NULL;
 	struct MR_FW_RAID_MAP         *pFwRaidMap    = NULL;
 	int i;
+	u16 ld_count;
 
 
 	struct MR_DRV_RAID_MAP_ALL *drv_map =
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:187 @ void MR_PopulateDrvRaidMap(struct megasa
 		/* New Raid map will not set totalSize, so keep expected value
 		 * for legacy code in ValidateMapInfo
 		 */
-		pDrvRaidMap->totalSize = sizeof(struct MR_FW_RAID_MAP_EXT);
+		pDrvRaidMap->totalSize =
+			cpu_to_le32(sizeof(struct MR_FW_RAID_MAP_EXT));
 	} else {
 		fw_map_old = (struct MR_FW_RAID_MAP_ALL *)
 			fusion->ld_map[(instance->map_id & 1)];
 		pFwRaidMap = &fw_map_old->raidMap;
+		ld_count = (u16)le32_to_cpu(pFwRaidMap->ldCount);
 
 #if VD_EXT_DEBUG
-		for (i = 0; i < pFwRaidMap->ldCount; i++) {
+		for (i = 0; i < ld_count; i++) {
 			dev_dbg(&instance->pdev->dev, "(%d) :Index 0x%x "
 				"Target Id 0x%x Seq Num 0x%x Size 0/%llx\n",
 				instance->unique_id, i,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:208 @ void MR_PopulateDrvRaidMap(struct megasa
 
 		memset(drv_map, 0, fusion->drv_map_sz);
 		pDrvRaidMap->totalSize = pFwRaidMap->totalSize;
-		pDrvRaidMap->ldCount = pFwRaidMap->ldCount;
+		pDrvRaidMap->ldCount = (__le16)cpu_to_le16(ld_count);
 		pDrvRaidMap->fpPdIoTimeoutSec = pFwRaidMap->fpPdIoTimeoutSec;
 		for (i = 0; i < MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS; i++)
 			pDrvRaidMap->ldTgtIdToLd[i] =
 				(u8)pFwRaidMap->ldTgtIdToLd[i];
-		for (i = 0; i < pDrvRaidMap->ldCount; i++) {
+		for (i = (MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS);
+			i < MAX_LOGICAL_DRIVES_EXT; i++)
+			pDrvRaidMap->ldTgtIdToLd[i] = 0xff;
+		for (i = 0; i < ld_count; i++) {
 			pDrvRaidMap->ldSpanMap[i] = pFwRaidMap->ldSpanMap[i];
 #if VD_EXT_DEBUG
 			dev_dbg(&instance->pdev->dev,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:258 @ u8 MR_ValidateMapInfo(struct megasas_ins
 	struct LD_LOAD_BALANCE_INFO *lbInfo;
 	PLD_SPAN_INFO ldSpanInfo;
 	struct MR_LD_RAID         *raid;
-	int ldCount, num_lds;
+	u16 ldCount, num_lds;
 	u16 ld;
 	u32 expected_size;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:277 @ u8 MR_ValidateMapInfo(struct megasas_ins
 	else
 		expected_size =
 			(sizeof(struct MR_FW_RAID_MAP) - sizeof(struct MR_LD_SPAN_MAP) +
-			(sizeof(struct MR_LD_SPAN_MAP) * le32_to_cpu(pDrvRaidMap->ldCount)));
+			(sizeof(struct MR_LD_SPAN_MAP) * le16_to_cpu(pDrvRaidMap->ldCount)));
 
 	if (le32_to_cpu(pDrvRaidMap->totalSize) != expected_size) {
 		dev_err(&instance->pdev->dev, "map info structure size 0x%x is not matching with ld count\n",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:293 @ u8 MR_ValidateMapInfo(struct megasas_ins
 
 	mr_update_load_balance_params(drv_map, lbInfo);
 
-	num_lds = le32_to_cpu(drv_map->raidMap.ldCount);
+	num_lds = le16_to_cpu(drv_map->raidMap.ldCount);
 
 	/*Convert Raid capability values to CPU arch */
 	for (ldCount = 0; ldCount < num_lds; ldCount++) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:362 @ static int getSpanInfo(struct MR_DRV_RAI
 
 	for (ldCount = 0; ldCount < MAX_LOGICAL_DRIVES_EXT; ldCount++) {
 		ld = MR_TargetIdToLdGet(ldCount, map);
-			if (ld >= MAX_LOGICAL_DRIVES_EXT)
+			if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1))
 				continue;
 		raid = MR_LdRaidGet(ld, map);
 		dev_dbg(&instance->pdev->dev, "LD %x: span_depth=%x\n",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:466 @ u32 mr_spanset_get_span_block(struct meg
 				quad = &map->raidMap.ldSpanMap[ld].
 					spanBlock[span].
 					block_span_info.quad[info];
-				if (le32_to_cpu(quad->diff == 0))
+				if (le32_to_cpu(quad->diff) == 0)
 					return SPAN_INVALID;
 				if (le64_to_cpu(quad->logStart) <= row  &&
 					row <= le64_to_cpu(quad->logEnd)  &&
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:529 @ static u64  get_row_from_strip(struct me
 				span_set->span_row_data_width) * span_set->diff;
 		for (span = 0, span_offset = 0; span < raid->spanDepth; span++)
 			if (le32_to_cpu(map->raidMap.ldSpanMap[ld].spanBlock[span].
-				block_span_info.noElements >= info+1)) {
+				block_span_info.noElements) >= info+1) {
 				if (strip_offset >=
 					span_set->strip_offset[span])
 					span_offset++;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1163 @ void mr_update_span_set(struct MR_DRV_RA
 
 	for (ldCount = 0; ldCount < MAX_LOGICAL_DRIVES_EXT; ldCount++) {
 		ld = MR_TargetIdToLdGet(ldCount, map);
-		if (ld >= MAX_LOGICAL_DRIVES_EXT)
+		if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1))
 			continue;
 		raid = MR_LdRaidGet(ld, map);
 		for (element = 0; element < MAX_QUAD_DEPTH; element++) {
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/megaraid/megaraid_sas_fusion.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/megaraid/megaraid_sas_fusion.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:104 @ megasas_enable_intr_fusion(struct megasa
 {
 	struct megasas_register_set __iomem *regs;
 	regs = instance->reg_set;
+
+	instance->mask_interrupts = 0;
 	/* For Thunderbolt/Invader also clear intr on enable */
 	writel(~0, &regs->outbound_intr_status);
 	readl(&regs->outbound_intr_status);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:114 @ megasas_enable_intr_fusion(struct megasa
 
 	/* Dummy readl to force pci flush */
 	readl(&regs->outbound_intr_mask);
-	instance->mask_interrupts = 0;
 }
 
 /**
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:700 @ megasas_ioc_init_fusion(struct megasas_i
 		cpu_to_le32(lower_32_bits(ioc_init_handle));
 	init_frame->data_xfer_len = cpu_to_le32(sizeof(struct MPI2_IOC_INIT_REQUEST));
 
-	req_desc.Words = 0;
+	req_desc.u.low = cpu_to_le32(lower_32_bits(cmd->frame_phys_addr));
+	req_desc.u.high = cpu_to_le32(upper_32_bits(cmd->frame_phys_addr));
 	req_desc.MFAIo.RequestFlags =
 		(MEGASAS_REQ_DESCRIPT_FLAGS_MFA <<
-		 MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
-	cpu_to_le32s((u32 *)&req_desc.MFAIo);
-	req_desc.Words |= cpu_to_le64(cmd->frame_phys_addr);
+		MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
 
 	/*
 	 * disable the intr before firing the init frame
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:883 @ megasas_sync_map_info(struct megasas_ins
 
 	map = fusion->ld_drv_map[instance->map_id & 1];
 
-	num_lds = le32_to_cpu(map->raidMap.ldCount);
+	num_lds = le16_to_cpu(map->raidMap.ldCount);
 
 	dcmd = &cmd->frame->dcmd;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1176 @ megasas_fire_cmd_fusion(struct megasas_i
 			struct megasas_register_set __iomem *regs)
 {
 #if defined(writeq) && defined(CONFIG_64BIT)
-	u64 req_data = (((u64)req_desc_hi << 32) | (u32)req_desc_lo);
+	u64 req_data = (((u64)le32_to_cpu(req_desc_hi) << 32) |
+			le32_to_cpu(req_desc_lo));
 
-	writeq(le64_to_cpu(req_data), &(regs)->inbound_low_queue_port);
+	writeq(req_data, &(regs)->inbound_low_queue_port);
 #else
 	unsigned long flags;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1377 @ megasas_set_pd_lba(struct MPI2_RAID_SCSI
 		/* Logical block reference tag */
 		io_request->CDB.EEDP32.PrimaryReferenceTag =
 			cpu_to_be32(ref_tag);
-		io_request->CDB.EEDP32.PrimaryApplicationTagMask = 0xffff;
+		io_request->CDB.EEDP32.PrimaryApplicationTagMask = cpu_to_be16(0xffff);
 		io_request->IoFlags = cpu_to_le16(32); /* Specify 32-byte cdb */
 
 		/* Transfer length */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1756 @ megasas_build_dcdb_fusion(struct megasas
 		if (scmd->device->channel < MEGASAS_MAX_PD_CHANNELS)
 			goto NonFastPath;
 
+		/*
+		 * For older firmware, Driver should not access ldTgtIdToLd
+		 * beyond index 127 and for Extended VD firmware, ldTgtIdToLd
+		 * should not go beyond 255.
+		 */
+
+		if ((!fusion->fast_path_io) ||
+			(device_id >= instance->fw_supported_vd_count))
+			goto NonFastPath;
+
 		ld = MR_TargetIdToLdGet(device_id, local_map_ptr);
-		if ((ld >= instance->fw_supported_vd_count) ||
-			(!fusion->fast_path_io))
+
+		if (ld >= instance->fw_supported_vd_count)
 			goto NonFastPath;
 
 		raid = MR_LdRaidGet(ld, local_map_ptr);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1783 @ megasas_build_dcdb_fusion(struct megasas
 
 		/* set RAID context values */
 		pRAID_Context->regLockFlags     = REGION_TYPE_SHARED_READ;
-		pRAID_Context->timeoutValue     = raid->fpIoTimeoutForLd;
+		pRAID_Context->timeoutValue     = cpu_to_le16(raid->fpIoTimeoutForLd);
 		pRAID_Context->VirtualDiskTgtId = cpu_to_le16(device_id);
 		pRAID_Context->regLockRowLBA    = 0;
 		pRAID_Context->regLockLength    = 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2268 @ build_mpt_mfi_pass_thru(struct megasas_i
 	 * megasas_complete_cmd
 	 */
 
-	if (frame_hdr->flags & MFI_FRAME_DONT_POST_IN_REPLY_QUEUE)
+	if (frame_hdr->flags & cpu_to_le16(MFI_FRAME_DONT_POST_IN_REPLY_QUEUE))
 		cmd->flags = MFI_FRAME_DONT_POST_IN_REPLY_QUEUE;
 
 	fusion = instance->ctrl_context;
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/megaraid/megaraid_sas_fusion.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/megaraid/megaraid_sas_fusion.h
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/megaraid/megaraid_sas_fusion.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:307 @ struct MPI2_RAID_SCSI_IO_REQUEST {
  * MPT RAID MFA IO Descriptor.
  */
 struct MEGASAS_RAID_MFA_IO_REQUEST_DESCRIPTOR {
-#if   defined(__BIG_ENDIAN_BITFIELD)
-	u32     MessageAddress1:24; /* bits 31:8*/
 	u32     RequestFlags:8;
-#else
-	u32     RequestFlags:8;
-	u32     MessageAddress1:24; /* bits 31:8*/
-#endif
-	u32     MessageAddress2;      /* bits 61:32 */
+	u32     MessageAddress1:24;
+	u32     MessageAddress2;
 };
 
 /* Default Request Descriptor */
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/mpt2sas/mpt2sas_transport.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/mpt2sas/mpt2sas_transport.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/mpt2sas/mpt2sas_transport.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1009 @ mpt2sas_transport_update_links(struct MP
 		    &mpt2sas_phy->remote_identify);
 		_transport_add_phy_to_an_existing_port(ioc, sas_node,
 		    mpt2sas_phy, mpt2sas_phy->remote_identify.sas_address);
-	} else {
+	} else
 		memset(&mpt2sas_phy->remote_identify, 0 , sizeof(struct
 		    sas_identify));
-		_transport_del_phy_from_an_existing_port(ioc, sas_node,
-		    mpt2sas_phy);
-	}
 
 	if (mpt2sas_phy->phy)
 		mpt2sas_phy->phy->negotiated_linkrate =
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/mpt3sas/mpt3sas_transport.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/mpt3sas/mpt3sas_transport.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/mpt3sas/mpt3sas_transport.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1006 @ mpt3sas_transport_update_links(struct MP
 		    &mpt3sas_phy->remote_identify);
 		_transport_add_phy_to_an_existing_port(ioc, sas_node,
 		    mpt3sas_phy, mpt3sas_phy->remote_identify.sas_address);
-	} else {
+	} else
 		memset(&mpt3sas_phy->remote_identify, 0 , sizeof(struct
 		    sas_identify));
-		_transport_del_phy_from_an_existing_port(ioc, sas_node,
-		    mpt3sas_phy);
-	}
 
 	if (mpt3sas_phy->phy)
 		mpt3sas_phy->phy->negotiated_linkrate =
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/qla2xxx/tcm_qla2xxx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1601 @ static int tcm_qla2xxx_check_initiator_n
 	/*
 	 * Finally register the new FC Nexus with TCM
 	 */
-	__transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
+	transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
 
 	return 0;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/scsi_devinfo.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/scsi_devinfo.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/scsi_devinfo.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:214 @ static struct {
 	{"Medion", "Flash XL  MMC/SD", "2.6D", BLIST_FORCELUN},
 	{"MegaRAID", "LD", NULL, BLIST_FORCELUN},
 	{"MICROP", "4110", NULL, BLIST_NOTQ},
+	{"MSFT", "Virtual HD", NULL, BLIST_NO_RSOC},
 	{"MYLEX", "DACARMRB", "*", BLIST_REPORTLUN2},
 	{"nCipher", "Fastness Crypto", NULL, BLIST_FORCELUN},
 	{"NAKAMICH", "MJ-4.8S", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/scsi_error.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/scsi_error.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/scsi_error.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1030 @ retry:
 		}
 		/* signal not to enter either branch of the if () below */
 		timeleft = 0;
-		rtn = NEEDS_RETRY;
+		rtn = FAILED;
 	} else {
 		timeleft = wait_for_completion_timeout(&done, timeout);
 		rtn = SUCCESS;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1070 @ retry:
 			rtn = FAILED;
 			break;
 		}
-	} else if (!rtn) {
+	} else if (rtn != FAILED) {
 		scsi_abort_eh_cmnd(scmd);
 		rtn = FAILED;
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/scsi_lib.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/scsi_lib.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/scsi_lib.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1302 @ scsi_prep_state_check(struct scsi_device
 				    "rejecting I/O to dead device\n");
 			ret = BLKPREP_KILL;
 			break;
-		case SDEV_QUIESCE:
 		case SDEV_BLOCK:
 		case SDEV_CREATED_BLOCK:
+			ret = BLKPREP_DEFER;
+			break;
+		case SDEV_QUIESCE:
 			/*
 			 * If the devices is blocked we defer normal commands.
 			 */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1834 @ static int scsi_mq_prep_fn(struct reques
 
 	if (scsi_host_get_prot(shost)) {
 		cmd->prot_sdb = (void *)sg +
-			shost->sg_tablesize * sizeof(struct scatterlist);
+			min_t(unsigned int,
+			      shost->sg_tablesize, SCSI_MAX_SG_SEGMENTS) *
+			sizeof(struct scatterlist);
 		memset(cmd->prot_sdb, 0, sizeof(struct scsi_data_buffer));
 
 		cmd->prot_sdb->table.sgl =
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/sd.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/sd.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/sd.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2821 @ static int sd_revalidate_disk(struct gen
 	 */
 	sd_set_flush_flag(sdkp);
 
-	max_xfer = min_not_zero(queue_max_hw_sectors(sdkp->disk->queue),
-				sdkp->max_xfer_blocks);
+	max_xfer = sdkp->max_xfer_blocks;
 	max_xfer <<= ilog2(sdp->sector_size) - 9;
+
+	max_xfer = min_not_zero(queue_max_hw_sectors(sdkp->disk->queue),
+				max_xfer);
 	blk_queue_max_hw_sectors(sdkp->disk->queue, max_xfer);
 	set_capacity(disk, sdkp->capacity);
 	sd_config_write_same(sdkp);
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/sg.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/sg.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/sg.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:549 @ static ssize_t
 sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
 {
 	sg_io_hdr_t *hp = &srp->header;
-	int err = 0;
+	int err = 0, err2;
 	int len;
 
 	if (count < SZ_SG_IO_HDR) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:578 @ sg_new_read(Sg_fd * sfp, char __user *bu
 		goto err_out;
 	}
 err_out:
-	err = sg_finish_rem_req(srp);
-	return (0 == err) ? count : err;
+	err2 = sg_finish_rem_req(srp);
+	return err ? : err2 ? : count;
 }
 
 static ssize_t
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1379 @ sg_rq_end_io(struct request *rq, int upt
 	}
 	/* Rely on write phase to clean out srp status values, so no "else" */
 
+	/*
+	 * Free the request as soon as it is complete so that its resources
+	 * can be reused without waiting for userspace to read() the
+	 * result.  But keep the associated bio (if any) around until
+	 * blk_rq_unmap_user() can be called from user context.
+	 */
+	srp->rq = NULL;
+	if (rq->cmd != rq->__cmd)
+		kfree(rq->cmd);
+	__blk_put_request(rq->q, rq);
+
 	write_lock_irqsave(&sfp->rq_list_lock, iflags);
 	if (unlikely(srp->orphan)) {
 		if (sfp->keep_orphan)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1724 @ sg_start_req(Sg_request *srp, unsigned c
 			return -ENOMEM;
 	}
 
-	rq = blk_get_request(q, rw, GFP_ATOMIC);
+	/*
+	 * NOTE
+	 *
+	 * With scsi-mq enabled, there are a fixed number of preallocated
+	 * requests equal in number to shost->can_queue.  If all of the
+	 * preallocated requests are already in use, then using GFP_ATOMIC with
+	 * blk_get_request() will return -EWOULDBLOCK, whereas using GFP_KERNEL
+	 * will cause blk_get_request() to sleep until an active command
+	 * completes, freeing up a request.  Neither option is ideal, but
+	 * GFP_KERNEL is the better choice to prevent userspace from getting an
+	 * unexpected EWOULDBLOCK.
+	 *
+	 * With scsi-mq disabled, blk_get_request() with GFP_KERNEL usually
+	 * does not sleep except under memory pressure.
+	 */
+	rq = blk_get_request(q, rw, GFP_KERNEL);
 	if (IS_ERR(rq)) {
 		kfree(long_cmdp);
 		return PTR_ERR(rq);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1832 @ sg_finish_rem_req(Sg_request *srp)
 	SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp,
 				      "sg_finish_rem_req: res_used=%d\n",
 				      (int) srp->res_used));
-	if (srp->rq) {
-		if (srp->bio)
-			ret = blk_rq_unmap_user(srp->bio);
+	if (srp->bio)
+		ret = blk_rq_unmap_user(srp->bio);
 
+	if (srp->rq) {
 		if (srp->rq->cmd != srp->rq->__cmd)
 			kfree(srp->rq->cmd);
 		blk_put_request(srp->rq);
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/storvsc_drv.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/storvsc_drv.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/storvsc_drv.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1691 @ static int storvsc_queuecommand(struct S
 	if (ret == -EAGAIN) {
 		/* no more space */
 
-		if (cmd_request->bounce_sgl_count) {
+		if (cmd_request->bounce_sgl_count)
 			destroy_bounce_buffer(cmd_request->bounce_sgl,
 					cmd_request->bounce_sgl_count);
 
-			ret = SCSI_MLQUEUE_DEVICE_BUSY;
-			goto queue_error;
-		}
+		ret = SCSI_MLQUEUE_DEVICE_BUSY;
+		goto queue_error;
 	}
 
 	return 0;
Index: linux-3.18.13-rt10-r7s4/drivers/scsi/sun3_NCR5380.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/scsi/sun3_NCR5380.c
+++ linux-3.18.13-rt10-r7s4/drivers/scsi/sun3_NCR5380.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2593 @ static void NCR5380_reselect (struct Scs
  * Purpose : abort a command
  *
  * Inputs : cmd - the struct scsi_cmnd to abort, code - code to set the
- * 	host byte of the result field to, if zero DID_ABORTED is 
+ *	host byte of the result field to, if zero DID_ABORTED is
  *	used.
  *
- * Returns : 0 - success, -1 on failure.
+ * Returns : SUCCESS - success, FAILED on failure.
  *
- * XXX - there is no way to abort the command that is currently 
- * 	 connected, you have to wait for it to complete.  If this is 
+ * XXX - there is no way to abort the command that is currently
+ *	 connected, you have to wait for it to complete.  If this is
  *	 a problem, we could implement longjmp() / setjmp(), setjmp()
- * 	 called where the loop started in NCR5380_main().
+ *	 called where the loop started in NCR5380_main().
  */
 
 static int NCR5380_abort(struct scsi_cmnd *cmd)
Index: linux-3.18.13-rt10-r7s4/drivers/spi/spi-atmel.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/spi/spi-atmel.c
+++ linux-3.18.13-rt10-r7s4/drivers/spi/spi-atmel.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:767 @ static void atmel_spi_pdc_next_xfer(stru
 			(unsigned long long)xfer->rx_dma);
 	}
 
-	/* REVISIT: We're waiting for ENDRX before we start the next
+	/* REVISIT: We're waiting for RXBUFF before we start the next
 	 * transfer because we need to handle some difficult timing
-	 * issues otherwise. If we wait for ENDTX in one transfer and
-	 * then starts waiting for ENDRX in the next, it's difficult
-	 * to tell the difference between the ENDRX interrupt we're
-	 * actually waiting for and the ENDRX interrupt of the
+	 * issues otherwise. If we wait for TXBUFE in one transfer and
+	 * then starts waiting for RXBUFF in the next, it's difficult
+	 * to tell the difference between the RXBUFF interrupt we're
+	 * actually waiting for and the RXBUFF interrupt of the
 	 * previous transfer.
 	 *
 	 * It should be doable, though. Just not now...
 	 */
-	spi_writel(as, IER, SPI_BIT(ENDRX) | SPI_BIT(OVRES));
+	spi_writel(as, IER, SPI_BIT(RXBUFF) | SPI_BIT(OVRES));
 	spi_writel(as, PTCR, SPI_BIT(TXTEN) | SPI_BIT(RXTEN));
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/spi/spi-dw-mid.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/spi/spi-dw-mid.c
+++ linux-3.18.13-rt10-r7s4/drivers/spi/spi-dw-mid.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:154 @ static int mid_spi_dma_transfer(struct d
 				1,
 				DMA_MEM_TO_DEV,
 				DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+	if (!txdesc)
+		return NULL;
+
 	txdesc->callback = dw_spi_dma_done;
 	txdesc->callback_param = dws;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:179 @ static int mid_spi_dma_transfer(struct d
 				1,
 				DMA_DEV_TO_MEM,
 				DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+	if (!rxdesc)
+		return NULL;
+
 	rxdesc->callback = dw_spi_dma_done;
 	rxdesc->callback_param = dws;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:228 @ int dw_spi_mid_init(struct dw_spi *dws)
 	iounmap(clk_reg);
 
 	dws->num_cs = 16;
-	dws->fifo_len = 40;	/* FIFO has 40 words buffer */
 
 #ifdef CONFIG_SPI_DW_MID_DMA
 	dws->dma_priv = kzalloc(sizeof(struct mid_dma), GFP_KERNEL);
Index: linux-3.18.13-rt10-r7s4/drivers/spi/spi-dw.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/spi/spi-dw.c
+++ linux-3.18.13-rt10-r7s4/drivers/spi/spi-dw.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:624 @ static void spi_hw_init(struct dw_spi *d
 	if (!dws->fifo_len) {
 		u32 fifo;
 
-		for (fifo = 2; fifo <= 257; fifo++) {
+		for (fifo = 2; fifo <= 256; fifo++) {
 			dw_writew(dws, DW_SPI_TXFLTR, fifo);
 			if (fifo != dw_readw(dws, DW_SPI_TXFLTR))
 				break;
 		}
 
-		dws->fifo_len = (fifo == 257) ? 0 : fifo;
+		dws->fifo_len = (fifo == 2) ? 0 : fifo - 1;
 		dw_writew(dws, DW_SPI_TXFLTR, 0);
 	}
 }
Index: linux-3.18.13-rt10-r7s4/drivers/spi/spi-fsl-dspi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/spi/spi-fsl-dspi.c
+++ linux-3.18.13-rt10-r7s4/drivers/spi/spi-fsl-dspi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:345 @ static int dspi_setup_transfer(struct sp
 	/* Only alloc on first setup */
 	chip = spi_get_ctldata(spi);
 	if (chip == NULL) {
-		chip = devm_kzalloc(&spi->dev, sizeof(struct chip_data),
-				    GFP_KERNEL);
+		chip = kzalloc(sizeof(struct chip_data), GFP_KERNEL);
 		if (!chip)
 			return -ENOMEM;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:384 @ static int dspi_setup(struct spi_device
 	return dspi_setup_transfer(spi, NULL);
 }
 
+static void dspi_cleanup(struct spi_device *spi)
+{
+	struct chip_data *chip = spi_get_ctldata((struct spi_device *)spi);
+
+	dev_dbg(&spi->dev, "spi_device %u.%u cleanup\n",
+			spi->master->bus_num, spi->chip_select);
+
+	kfree(chip);
+}
+
 static irqreturn_t dspi_interrupt(int irq, void *dev_id)
 {
 	struct fsl_dspi *dspi = (struct fsl_dspi *)dev_id;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:479 @ static int dspi_probe(struct platform_de
 	dspi->bitbang.master->setup = dspi_setup;
 	dspi->bitbang.master->dev.of_node = pdev->dev.of_node;
 
+	master->cleanup = dspi_cleanup;
 	master->mode_bits = SPI_CPOL | SPI_CPHA;
 	master->bits_per_word_mask = SPI_BPW_MASK(4) | SPI_BPW_MASK(8) |
 					SPI_BPW_MASK(16);
Index: linux-3.18.13-rt10-r7s4/drivers/spi/spi-imx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/spi/spi-imx.c
+++ linux-3.18.13-rt10-r7s4/drivers/spi/spi-imx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:826 @ static int spi_imx_sdma_init(struct devi
 	struct dma_slave_config slave_config = {};
 	int ret;
 
+	/* use pio mode for i.mx6dl chip TKT238285 */
+	if (of_machine_is_compatible("fsl,imx6dl"))
+		return 0;
+
 	/* Prepare for TX DMA: */
 	master->dma_tx = dma_request_slave_channel(dev, "tx");
 	if (!master->dma_tx) {
Index: linux-3.18.13-rt10-r7s4/drivers/spi/spi-pl022.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/spi/spi-pl022.c
+++ linux-3.18.13-rt10-r7s4/drivers/spi/spi-pl022.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:537 @ static void giveback(struct pl022 *pl022
 	pl022->cur_msg = NULL;
 	pl022->cur_transfer = NULL;
 	pl022->cur_chip = NULL;
-	spi_finalize_current_message(pl022->master);
 
 	/* disable the SPI/SSP operation */
 	writew((readw(SSP_CR1(pl022->virtbase)) &
 		(~SSP_CR1_MASK_SSE)), SSP_CR1(pl022->virtbase));
 
+	spi_finalize_current_message(pl022->master);
 }
 
 /**
Index: linux-3.18.13-rt10-r7s4/drivers/spi/spi-pxa2xx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/spi/spi-pxa2xx.c
+++ linux-3.18.13-rt10-r7s4/drivers/spi/spi-pxa2xx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:405 @ static void giveback(struct driver_data
 			cs_deassert(drv_data);
 	}
 
-	spi_finalize_current_message(drv_data->master);
 	drv_data->cur_chip = NULL;
+	spi_finalize_current_message(drv_data->master);
 }
 
 static void reset_sccr1(struct driver_data *drv_data)
Index: linux-3.18.13-rt10-r7s4/drivers/spi/spi-qup.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/spi/spi-qup.c
+++ linux-3.18.13-rt10-r7s4/drivers/spi/spi-qup.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:492 @ static int spi_qup_probe(struct platform
 	struct resource *res;
 	struct device *dev;
 	void __iomem *base;
-	u32 max_freq, iomode;
+	u32 max_freq, iomode, num_cs;
 	int ret, irq, size;
 
 	dev = &pdev->dev;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:544 @ static int spi_qup_probe(struct platform
 	}
 
 	/* use num-cs unless not present or out of range */
-	if (of_property_read_u16(dev->of_node, "num-cs",
-			&master->num_chipselect) ||
-			(master->num_chipselect > SPI_NUM_CHIPSELECTS))
+	if (of_property_read_u32(dev->of_node, "num-cs", &num_cs) ||
+	    num_cs > SPI_NUM_CHIPSELECTS)
 		master->num_chipselect = SPI_NUM_CHIPSELECTS;
+	else
+		master->num_chipselect = num_cs;
 
 	master->bus_num = pdev->id;
 	master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP;
Index: linux-3.18.13-rt10-r7s4/drivers/spi/spi-sh-msiof.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/spi/spi-sh-msiof.c
+++ linux-3.18.13-rt10-r7s4/drivers/spi/spi-sh-msiof.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:483 @ static int sh_msiof_spi_setup(struct spi
 	struct device_node	*np = spi->master->dev.of_node;
 	struct sh_msiof_spi_priv *p = spi_master_get_devdata(spi->master);
 
+	pm_runtime_get_sync(&p->pdev->dev);
+
 	if (!np) {
 		/*
 		 * Use spi->controller_data for CS (same strategy as spi_gpio),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:503 @ static int sh_msiof_spi_setup(struct spi
 	if (spi->cs_gpio >= 0)
 		gpio_set_value(spi->cs_gpio, !(spi->mode & SPI_CS_HIGH));
 
+
+	pm_runtime_put_sync(&p->pdev->dev);
+
 	return 0;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/spi/spi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/spi/spi.c
+++ linux-3.18.13-rt10-r7s4/drivers/spi/spi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1076 @ void spi_finalize_current_message(struct
 				"failed to unprepare message: %d\n", ret);
 		}
 	}
+
+	trace_spi_message_done(mesg);
+
 	master->cur_msg_prepared = false;
 
 	mesg->state = NULL;
 	if (mesg->complete)
 		mesg->complete(mesg->context);
-
-	trace_spi_message_done(mesg);
 }
 EXPORT_SYMBOL_GPL(spi_finalize_current_message);
 
Index: linux-3.18.13-rt10-r7s4/drivers/staging/comedi/comedi_compat32.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/staging/comedi/comedi_compat32.c
+++ linux-3.18.13-rt10-r7s4/drivers/staging/comedi/comedi_compat32.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:265 @ static int compat_cmd(struct file *file,
 {
 	struct comedi_cmd __user *cmd;
 	struct comedi32_cmd_struct __user *cmd32;
-	int rc;
+	int rc, err;
 
 	cmd32 = compat_ptr(arg);
 	cmd = compat_alloc_user_space(sizeof(*cmd));
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:274 @ static int compat_cmd(struct file *file,
 	if (rc)
 		return rc;
 
-	return translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd);
+	rc = translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd);
+	if (rc == -EAGAIN) {
+		/* Special case: copy cmd back to user. */
+		err = put_compat_cmd(cmd32, cmd);
+		if (err)
+			rc = err;
+	}
+
+	return rc;
 }
 
 /* Handle 32-bit COMEDI_CMDTEST ioctl. */
Index: linux-3.18.13-rt10-r7s4/drivers/staging/comedi/drivers/cb_pcidas64.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/staging/comedi/drivers/cb_pcidas64.c
+++ linux-3.18.13-rt10-r7s4/drivers/staging/comedi/drivers/cb_pcidas64.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:442 @ static const struct comedi_lrange ai_ran
 	}
 };
 
+static const uint8_t ai_range_code_64xx[8] = {
+	0x0, 0x1, 0x2, 0x3,	/* bipolar 10, 5, 2,5, 1.25 */
+	0x8, 0x9, 0xa, 0xb	/* unipolar 10, 5, 2.5, 1.25 */
+};
+
+/* analog input ranges for 64-Mx boards */
+static const struct comedi_lrange ai_ranges_64_mx = {
+	7, {
+		BIP_RANGE(5),
+		BIP_RANGE(2.5),
+		BIP_RANGE(1.25),
+		BIP_RANGE(0.625),
+		UNI_RANGE(5),
+		UNI_RANGE(2.5),
+		UNI_RANGE(1.25)
+	}
+};
+
+static const uint8_t ai_range_code_64_mx[7] = {
+	0x0, 0x1, 0x2, 0x3,	/* bipolar 5, 2.5, 1.25, 0.625 */
+	0x9, 0xa, 0xb		/* unipolar 5, 2.5, 1.25 */
+};
+
 /* analog input ranges for 60xx boards */
 static const struct comedi_lrange ai_ranges_60xx = {
 	4, {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:475 @ static const struct comedi_lrange ai_ran
 	}
 };
 
+static const uint8_t ai_range_code_60xx[4] = {
+	0x0, 0x1, 0x4, 0x7	/* bipolar 10, 5, 0.5, 0.05 */
+};
+
 /* analog input ranges for 6030, etc boards */
 static const struct comedi_lrange ai_ranges_6030 = {
 	14, {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:499 @ static const struct comedi_lrange ai_ran
 	}
 };
 
+static const uint8_t ai_range_code_6030[14] = {
+	0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, /* bip 10, 5, 2, 1, 0.5, 0.2, 0.1 */
+	0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf  /* uni 10, 5, 2, 1, 0.5, 0.2, 0.1 */
+};
+
 /* analog input ranges for 6052, etc boards */
 static const struct comedi_lrange ai_ranges_6052 = {
 	15, {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:525 @ static const struct comedi_lrange ai_ran
 	}
 };
 
+static const uint8_t ai_range_code_6052[15] = {
+	0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7,	/* bipolar 10 ... 0.05 */
+	0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf	/* unipolar 10 ... 0.1 */
+};
+
 /* analog input ranges for 4020 board */
 static const struct comedi_lrange ai_ranges_4020 = {
 	2, {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:633 @ struct pcidas64_board {
 	int ai_bits;		/*  analog input resolution */
 	int ai_speed;		/*  fastest conversion period in ns */
 	const struct comedi_lrange *ai_range_table;
+	const uint8_t *ai_range_code;
 	int ao_nchan;		/*  number of analog out channels */
 	int ao_bits;		/*  analog output resolution */
 	int ao_scan_speed;	/*  analog output scan speed */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:692 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 10000,
 		.layout		= LAYOUT_64XX,
 		.ai_range_table	= &ai_ranges_64xx,
+		.ai_range_code	= ai_range_code_64xx,
 		.ao_range_table	= &ao_ranges_64xx,
 		.ao_range_code	= ao_range_code_64xx,
 		.ai_fifo	= &ai_fifo_64xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:708 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 10000,
 		.layout		= LAYOUT_64XX,
 		.ai_range_table	= &ai_ranges_64xx,
+		.ai_range_code	= ai_range_code_64xx,
 		.ao_range_table	= &ao_ranges_64xx,
 		.ao_range_code	= ao_range_code_64xx,
 		.ai_fifo	= &ai_fifo_64xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:723 @ static const struct pcidas64_board pcida
 		.ao_bits	= 16,
 		.ao_scan_speed	= 10000,
 		.layout		= LAYOUT_64XX,
-		.ai_range_table	= &ai_ranges_64xx,
+		.ai_range_table	= &ai_ranges_64_mx,
+		.ai_range_code	= ai_range_code_64_mx,
 		.ao_range_table	= &ao_ranges_64xx,
 		.ao_range_code	= ao_range_code_64xx,
 		.ai_fifo	= &ai_fifo_64xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:739 @ static const struct pcidas64_board pcida
 		.ao_bits	= 16,
 		.ao_scan_speed	= 10000,
 		.layout		= LAYOUT_64XX,
-		.ai_range_table	= &ai_ranges_64xx,
+		.ai_range_table	= &ai_ranges_64_mx,
+		.ai_range_code	= ai_range_code_64_mx,
 		.ao_range_table	= &ao_ranges_64xx,
 		.ao_range_code	= ao_range_code_64xx,
 		.ai_fifo	= &ai_fifo_64xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:755 @ static const struct pcidas64_board pcida
 		.ao_bits	= 16,
 		.ao_scan_speed	= 10000,
 		.layout		= LAYOUT_64XX,
-		.ai_range_table	= &ai_ranges_64xx,
+		.ai_range_table	= &ai_ranges_64_mx,
+		.ai_range_code	= ai_range_code_64_mx,
 		.ao_range_table	= &ao_ranges_64xx,
 		.ao_range_code	= ao_range_code_64xx,
 		.ai_fifo	= &ai_fifo_64xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:771 @ static const struct pcidas64_board pcida
 		.ao_bits	= 16,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_60xx,
+		.ai_range_code	= ai_range_code_60xx,
 		.ao_range_table	= &range_bipolar10,
 		.ao_range_code	= ao_range_code_60xx,
 		.ai_fifo	= &ai_fifo_60xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:787 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 100000,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_60xx,
+		.ai_range_code	= ai_range_code_60xx,
 		.ao_range_table	= &range_bipolar10,
 		.ao_range_code	= ao_range_code_60xx,
 		.ai_fifo	= &ai_fifo_60xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:802 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 100000,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_60xx,
+		.ai_range_code	= ai_range_code_60xx,
 		.ao_range_table	= &range_bipolar10,
 		.ao_range_code	= ao_range_code_60xx,
 		.ai_fifo	= &ai_fifo_60xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:818 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 100000,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_60xx,
+		.ai_range_code	= ai_range_code_60xx,
 		.ao_range_table	= &range_bipolar10,
 		.ao_range_code	= ao_range_code_60xx,
 		.ai_fifo	= &ai_fifo_60xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:834 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 10000,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_6030,
+		.ai_range_code	= ai_range_code_6030,
 		.ao_range_table	= &ao_ranges_6030,
 		.ao_range_code	= ao_range_code_6030,
 		.ai_fifo	= &ai_fifo_60xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:850 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 10000,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_6030,
+		.ai_range_code	= ai_range_code_6030,
 		.ao_range_table	= &ao_ranges_6030,
 		.ao_range_code	= ao_range_code_6030,
 		.ai_fifo	= &ai_fifo_60xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:864 @ static const struct pcidas64_board pcida
 		.ao_nchan	= 0,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_6030,
+		.ai_range_code	= ai_range_code_6030,
 		.ai_fifo	= &ai_fifo_60xx,
 		.has_8255	= 0,
 	},
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:876 @ static const struct pcidas64_board pcida
 		.ao_nchan	= 0,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_6030,
+		.ai_range_code	= ai_range_code_6030,
 		.ai_fifo	= &ai_fifo_60xx,
 		.has_8255	= 0,
 	},
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:889 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 0,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_60xx,
+		.ai_range_code	= ai_range_code_60xx,
 		.ai_fifo	= &ai_fifo_60xx,
 		.has_8255	= 0,
 	},
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:903 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 100000,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_60xx,
+		.ai_range_code	= ai_range_code_60xx,
 		.ao_range_table	= &range_bipolar10,
 		.ao_range_code	= ao_range_code_60xx,
 		.ai_fifo	= &ai_fifo_60xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:919 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 100000,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_60xx,
+		.ai_range_code	= ai_range_code_60xx,
 		.ao_range_table	= &range_bipolar10,
 		.ao_range_code	= ao_range_code_60xx,
 		.ai_fifo	= &ai_fifo_60xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:935 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 1000,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_6052,
+		.ai_range_code	= ai_range_code_6052,
 		.ao_range_table	= &ao_ranges_6030,
 		.ao_range_code	= ao_range_code_6030,
 		.ai_fifo	= &ai_fifo_60xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:951 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 3333,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_6052,
+		.ai_range_code	= ai_range_code_6052,
 		.ao_range_table	= &ao_ranges_6030,
 		.ao_range_code	= ao_range_code_6030,
 		.ai_fifo	= &ai_fifo_60xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:967 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 1000,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_6052,
+		.ai_range_code	= ai_range_code_6052,
 		.ao_range_table	= &ao_ranges_6030,
 		.ao_range_code	= ao_range_code_6030,
 		.ai_fifo	= &ai_fifo_60xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:983 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 1000,
 		.layout		= LAYOUT_60XX,
 		.ai_range_table	= &ai_ranges_6052,
+		.ai_range_code	= ai_range_code_6052,
 		.ao_range_table	= &ao_ranges_6030,
 		.ao_range_code	= ao_range_code_6030,
 		.ai_fifo	= &ai_fifo_60xx,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1018 @ static const struct pcidas64_board pcida
 		.ao_scan_speed	= 10000,
 		.layout		= LAYOUT_64XX,
 		.ai_range_table	= &ai_ranges_64xx,
+		.ai_range_code	= ai_range_code_64xx,
 		.ai_fifo	= ai_fifo_64xx,
 		.has_8255	= 1,
 	},
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1030 @ static const struct pcidas64_board pcida
 		.ao_nchan	= 0,
 		.ao_scan_speed	= 10000,
 		.layout		= LAYOUT_64XX,
-		.ai_range_table	= &ai_ranges_64xx,
+		.ai_range_table	= &ai_ranges_64_mx,
+		.ai_range_code	= ai_range_code_64_mx,
 		.ai_fifo	= ai_fifo_64xx,
 		.has_8255	= 1,
 	},
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1043 @ static const struct pcidas64_board pcida
 		.ao_nchan	= 0,
 		.ao_scan_speed	= 10000,
 		.layout		= LAYOUT_64XX,
-		.ai_range_table	= &ai_ranges_64xx,
+		.ai_range_table	= &ai_ranges_64_mx,
+		.ai_range_code	= ai_range_code_64_mx,
 		.ai_fifo	= ai_fifo_64xx,
 		.has_8255	= 1,
 	},
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1056 @ static const struct pcidas64_board pcida
 		.ao_nchan	= 0,
 		.ao_scan_speed	= 10000,
 		.layout		= LAYOUT_64XX,
-		.ai_range_table	= &ai_ranges_64xx,
+		.ai_range_table	= &ai_ranges_64_mx,
+		.ai_range_code	= ai_range_code_64_mx,
 		.ai_fifo	= ai_fifo_64xx,
 		.has_8255	= 1,
 	},
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1069 @ static const struct pcidas64_board pcida
 		.ao_nchan	= 2,
 		.ao_scan_speed	= 10000,
 		.layout		= LAYOUT_64XX,
-		.ai_range_table	= &ai_ranges_64xx,
+		.ai_range_table	= &ai_ranges_64_mx,
+		.ai_range_code	= ai_range_code_64_mx,
 		.ai_fifo	= ai_fifo_64xx,
 		.has_8255	= 1,
 	},
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1082 @ static const struct pcidas64_board pcida
 		.ao_nchan	= 2,
 		.ao_scan_speed	= 10000,
 		.layout		= LAYOUT_64XX,
-		.ai_range_table	= &ai_ranges_64xx,
+		.ai_range_table	= &ai_ranges_64_mx,
+		.ai_range_code	= ai_range_code_64_mx,
 		.ai_fifo	= ai_fifo_64xx,
 		.has_8255	= 1,
 	},
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1095 @ static const struct pcidas64_board pcida
 		.ao_nchan	= 2,
 		.ao_scan_speed	= 10000,
 		.layout		= LAYOUT_64XX,
-		.ai_range_table	= &ai_ranges_64xx,
+		.ai_range_table	= &ai_ranges_64_mx,
+		.ai_range_code	= ai_range_code_64_mx,
 		.ai_fifo	= ai_fifo_64xx,
 		.has_8255	= 1,
 	},
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1190 @ static unsigned int ai_range_bits_6xxx(c
 				       unsigned int range_index)
 {
 	const struct pcidas64_board *thisboard = dev->board_ptr;
-	const struct comedi_krange *range =
-		&thisboard->ai_range_table->range[range_index];
-	unsigned int bits = 0;
-
-	switch (range->max) {
-	case 10000000:
-		bits = 0x000;
-		break;
-	case 5000000:
-		bits = 0x100;
-		break;
-	case 2000000:
-	case 2500000:
-		bits = 0x200;
-		break;
-	case 1000000:
-	case 1250000:
-		bits = 0x300;
-		break;
-	case 500000:
-		bits = 0x400;
-		break;
-	case 200000:
-	case 250000:
-		bits = 0x500;
-		break;
-	case 100000:
-		bits = 0x600;
-		break;
-	case 50000:
-		bits = 0x700;
-		break;
-	default:
-		dev_err(dev->class_dev, "bug! in %s\n", __func__);
-		break;
-	}
-	if (range->min == 0)
-		bits += 0x900;
-	return bits;
+
+	return thisboard->ai_range_code[range_index] << 8;
 }
 
 static unsigned int hw_revision(const struct comedi_device *dev,
Index: linux-3.18.13-rt10-r7s4/drivers/staging/iio/adc/mxs-lradc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/staging/iio/adc/mxs-lradc.c
+++ linux-3.18.13-rt10-r7s4/drivers/staging/iio/adc/mxs-lradc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:217 @ struct mxs_lradc {
 	unsigned long		is_divided;
 
 	/*
-	 * Touchscreen LRADC channels receives a private slot in the CTRL4
-	 * register, the slot #7. Therefore only 7 slots instead of 8 in the
-	 * CTRL4 register can be mapped to LRADC channels when using the
-	 * touchscreen.
-	 *
+	 * When the touchscreen is enabled, we give it two private virtual
+	 * channels: #6 and #7. This means that only 6 virtual channels (instead
+	 * of 8) will be available for buffered capture.
+	 */
+#define TOUCHSCREEN_VCHANNEL1		7
+#define TOUCHSCREEN_VCHANNEL2		6
+#define BUFFER_VCHANS_LIMITED		0x3f
+#define BUFFER_VCHANS_ALL		0xff
+	u8			buffer_vchans;
+
+	/*
 	 * Furthermore, certain LRADC channels are shared between touchscreen
 	 * and/or touch-buttons and generic LRADC block. Therefore when using
 	 * either of these, these channels are not available for the regular
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:351 @ struct mxs_lradc {
 #define	LRADC_CTRL4				0x140
 #define	LRADC_CTRL4_LRADCSELECT_MASK(n)		(0xf << ((n) * 4))
 #define	LRADC_CTRL4_LRADCSELECT_OFFSET(n)	((n) * 4)
+#define	LRADC_CTRL4_LRADCSELECT(n, x) \
+				(((x) << LRADC_CTRL4_LRADCSELECT_OFFSET(n)) & \
+				LRADC_CTRL4_LRADCSELECT_MASK(n))
 
 #define LRADC_RESOLUTION			12
 #define LRADC_SINGLE_SAMPLE_MASK		((1 << LRADC_RESOLUTION) - 1)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:428 @ static bool mxs_lradc_check_touch_event(
 					LRADC_STATUS_TOUCH_DETECT_RAW);
 }
 
+static void mxs_lradc_map_channel(struct mxs_lradc *lradc, unsigned vch,
+				  unsigned ch)
+{
+	mxs_lradc_reg_clear(lradc, LRADC_CTRL4_LRADCSELECT_MASK(vch),
+				LRADC_CTRL4);
+	mxs_lradc_reg_set(lradc, LRADC_CTRL4_LRADCSELECT(vch, ch), LRADC_CTRL4);
+}
+
 static void mxs_lradc_setup_ts_channel(struct mxs_lradc *lradc, unsigned ch)
 {
 	/*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:463 @ static void mxs_lradc_setup_ts_channel(s
 		LRADC_DELAY_DELAY(lradc->over_sample_delay - 1),
 			LRADC_DELAY(3));
 
-	mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(2) |
-			LRADC_CTRL1_LRADC_IRQ(3) | LRADC_CTRL1_LRADC_IRQ(4) |
-			LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1);
+	mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(ch), LRADC_CTRL1);
 
-	/* wake us again, when the complete conversion is done */
-	mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(ch), LRADC_CTRL1);
 	/*
 	 * after changing the touchscreen plates setting
 	 * the signals need some initial time to settle. Start the
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:517 @ static void mxs_lradc_setup_ts_pressure(
 		LRADC_DELAY_DELAY(lradc->over_sample_delay - 1),
 					LRADC_DELAY(3));
 
-	mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(2) |
-			LRADC_CTRL1_LRADC_IRQ(3) | LRADC_CTRL1_LRADC_IRQ(4) |
-			LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1);
+	mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(ch2), LRADC_CTRL1);
 
-	/* wake us again, when the conversions are done */
-	mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(ch2), LRADC_CTRL1);
 	/*
 	 * after changing the touchscreen plates setting
 	 * the signals need some initial time to settle. Start the
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:583 @ static unsigned mxs_lradc_read_ts_pressu
 #define TS_CH_XM 4
 #define TS_CH_YM 5
 
-static int mxs_lradc_read_ts_channel(struct mxs_lradc *lradc)
-{
-	u32 reg;
-	int val;
-
-	reg = readl(lradc->base + LRADC_CTRL1);
-
-	/* only channels 3 to 5 are of interest here */
-	if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_YP)) {
-		mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_YP) |
-			LRADC_CTRL1_LRADC_IRQ(TS_CH_YP), LRADC_CTRL1);
-		val = mxs_lradc_read_raw_channel(lradc, TS_CH_YP);
-	} else if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_XM)) {
-		mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_XM) |
-			LRADC_CTRL1_LRADC_IRQ(TS_CH_XM), LRADC_CTRL1);
-		val = mxs_lradc_read_raw_channel(lradc, TS_CH_XM);
-	} else if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_YM)) {
-		mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_YM) |
-			LRADC_CTRL1_LRADC_IRQ(TS_CH_YM), LRADC_CTRL1);
-		val = mxs_lradc_read_raw_channel(lradc, TS_CH_YM);
-	} else {
-		return -EIO;
-	}
-
-	mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(2));
-	mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(3));
-
-	return val;
-}
-
 /*
  * YP(open)--+-------------+
  *           |             |--+
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:626 @ static void mxs_lradc_prepare_x_pos(stru
 	mxs_lradc_reg_set(lradc, mxs_lradc_drive_x_plate(lradc), LRADC_CTRL0);
 
 	lradc->cur_plate = LRADC_SAMPLE_X;
-	mxs_lradc_setup_ts_channel(lradc, TS_CH_YP);
+	mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_YP);
+	mxs_lradc_setup_ts_channel(lradc, TOUCHSCREEN_VCHANNEL1);
 }
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:648 @ static void mxs_lradc_prepare_y_pos(stru
 	mxs_lradc_reg_set(lradc, mxs_lradc_drive_y_plate(lradc), LRADC_CTRL0);
 
 	lradc->cur_plate = LRADC_SAMPLE_Y;
-	mxs_lradc_setup_ts_channel(lradc, TS_CH_XM);
+	mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_XM);
+	mxs_lradc_setup_ts_channel(lradc, TOUCHSCREEN_VCHANNEL1);
 }
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:670 @ static void mxs_lradc_prepare_pressure(s
 	mxs_lradc_reg_set(lradc, mxs_lradc_drive_pressure(lradc), LRADC_CTRL0);
 
 	lradc->cur_plate = LRADC_SAMPLE_PRESSURE;
-	mxs_lradc_setup_ts_pressure(lradc, TS_CH_XP, TS_CH_YM);
+	mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_YM);
+	mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL2, TS_CH_XP);
+	mxs_lradc_setup_ts_pressure(lradc, TOUCHSCREEN_VCHANNEL2,
+						TOUCHSCREEN_VCHANNEL1);
 }
 
 static void mxs_lradc_enable_touch_detection(struct mxs_lradc *lradc)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:686 @ static void mxs_lradc_enable_touch_detec
 	mxs_lradc_reg_set(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN, LRADC_CTRL1);
 }
 
+static void mxs_lradc_start_touch_event(struct mxs_lradc *lradc)
+{
+	mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN,
+				LRADC_CTRL1);
+	mxs_lradc_reg_set(lradc,
+		LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1), LRADC_CTRL1);
+	/*
+	 * start with the Y-pos, because it uses nearly the same plate
+	 * settings like the touch detection
+	 */
+	mxs_lradc_prepare_y_pos(lradc);
+}
+
 static void mxs_lradc_report_ts_event(struct mxs_lradc *lradc)
 {
 	input_report_abs(lradc->ts_input, ABS_X, lradc->ts_x_pos);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:716 @ static void mxs_lradc_complete_touch_eve
 	 * start a dummy conversion to burn time to settle the signals
 	 * note: we are not interested in the conversion's value
 	 */
-	mxs_lradc_reg_wrt(lradc, 0, LRADC_CH(5));
-	mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1);
-	mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(5), LRADC_CTRL1);
-	mxs_lradc_reg_wrt(lradc, LRADC_DELAY_TRIGGER(1 << 5) |
+	mxs_lradc_reg_wrt(lradc, 0, LRADC_CH(TOUCHSCREEN_VCHANNEL1));
+	mxs_lradc_reg_clear(lradc,
+		LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) |
+		LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2), LRADC_CTRL1);
+	mxs_lradc_reg_wrt(lradc,
+		LRADC_DELAY_TRIGGER(1 << TOUCHSCREEN_VCHANNEL1) |
 		LRADC_DELAY_KICK | LRADC_DELAY_DELAY(10), /* waste 5 ms */
 			LRADC_DELAY(2));
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:753 @ static void mxs_lradc_finish_touch_event
 
 	/* if it is released, wait for the next touch via IRQ */
 	lradc->cur_plate = LRADC_TOUCH;
-	mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ, LRADC_CTRL1);
+	mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(2));
+	mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(3));
+	mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ |
+		LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1) |
+		LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1), LRADC_CTRL1);
 	mxs_lradc_reg_set(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN, LRADC_CTRL1);
 }
 
 /* touchscreen's state machine */
 static void mxs_lradc_handle_touch(struct mxs_lradc *lradc)
 {
-	int val;
-
 	switch (lradc->cur_plate) {
 	case LRADC_TOUCH:
-		/*
-		 * start with the Y-pos, because it uses nearly the same plate
-		 * settings like the touch detection
-		 */
-		if (mxs_lradc_check_touch_event(lradc)) {
-			mxs_lradc_reg_clear(lradc,
-					LRADC_CTRL1_TOUCH_DETECT_IRQ_EN,
-					LRADC_CTRL1);
-			mxs_lradc_prepare_y_pos(lradc);
-		}
+		if (mxs_lradc_check_touch_event(lradc))
+			mxs_lradc_start_touch_event(lradc);
 		mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ,
 					LRADC_CTRL1);
 		return;
 
 	case LRADC_SAMPLE_Y:
-		val = mxs_lradc_read_ts_channel(lradc);
-		if (val < 0) {
-			mxs_lradc_enable_touch_detection(lradc); /* re-start */
-			return;
-		}
-		lradc->ts_y_pos = val;
+		lradc->ts_y_pos = mxs_lradc_read_raw_channel(lradc,
+							TOUCHSCREEN_VCHANNEL1);
 		mxs_lradc_prepare_x_pos(lradc);
 		return;
 
 	case LRADC_SAMPLE_X:
-		val = mxs_lradc_read_ts_channel(lradc);
-		if (val < 0) {
-			mxs_lradc_enable_touch_detection(lradc); /* re-start */
-			return;
-		}
-		lradc->ts_x_pos = val;
+		lradc->ts_x_pos = mxs_lradc_read_raw_channel(lradc,
+							TOUCHSCREEN_VCHANNEL1);
 		mxs_lradc_prepare_pressure(lradc);
 		return;
 
 	case LRADC_SAMPLE_PRESSURE:
-		lradc->ts_pressure =
-			mxs_lradc_read_ts_pressure(lradc, TS_CH_XP, TS_CH_YM);
+		lradc->ts_pressure = mxs_lradc_read_ts_pressure(lradc,
+							TOUCHSCREEN_VCHANNEL2,
+							TOUCHSCREEN_VCHANNEL1);
 		mxs_lradc_complete_touch_event(lradc);
 		return;
 
 	case LRADC_SAMPLE_VALID:
-		val = mxs_lradc_read_ts_channel(lradc); /* ignore the value */
 		mxs_lradc_finish_touch_event(lradc, 1);
 		break;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:823 @ static int mxs_lradc_read_single(struct
 	 * used if doing raw sampling.
 	 */
 	if (lradc->soc == IMX28_LRADC)
-		mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK,
+		mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(0),
 			LRADC_CTRL1);
-	mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
+	mxs_lradc_reg_clear(lradc, 0x1, LRADC_CTRL0);
 
 	/* Enable / disable the divider per requirement */
 	if (test_bit(chan, &lradc->is_divided))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1069 @ static void mxs_lradc_disable_ts(struct
 {
 	/* stop all interrupts from firing */
 	mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN |
-		LRADC_CTRL1_LRADC_IRQ_EN(2) | LRADC_CTRL1_LRADC_IRQ_EN(3) |
-		LRADC_CTRL1_LRADC_IRQ_EN(4) | LRADC_CTRL1_LRADC_IRQ_EN(5),
-		LRADC_CTRL1);
+		LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1) |
+		LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL2), LRADC_CTRL1);
 
 	/* Power-down touchscreen touch-detect circuitry. */
 	mxs_lradc_reg_clear(lradc, mxs_lradc_plate_mask(lradc), LRADC_CTRL0);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1136 @ static irqreturn_t mxs_lradc_handle_irq(
 	struct iio_dev *iio = data;
 	struct mxs_lradc *lradc = iio_priv(iio);
 	unsigned long reg = readl(lradc->base + LRADC_CTRL1);
+	uint32_t clr_irq = mxs_lradc_irq_mask(lradc);
 	const uint32_t ts_irq_mask =
 		LRADC_CTRL1_TOUCH_DETECT_IRQ |
-		LRADC_CTRL1_LRADC_IRQ(2) |
-		LRADC_CTRL1_LRADC_IRQ(3) |
-		LRADC_CTRL1_LRADC_IRQ(4) |
-		LRADC_CTRL1_LRADC_IRQ(5);
+		LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) |
+		LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2);
 
 	if (!(reg & mxs_lradc_irq_mask(lradc)))
 		return IRQ_NONE;
 
-	if (lradc->use_touchscreen && (reg & ts_irq_mask))
+	if (lradc->use_touchscreen && (reg & ts_irq_mask)) {
 		mxs_lradc_handle_touch(lradc);
 
-	if (iio_buffer_enabled(iio))
-		iio_trigger_poll(iio->trig);
-	else if (reg & LRADC_CTRL1_LRADC_IRQ(0))
+		/* Make sure we don't clear the next conversion's interrupt. */
+		clr_irq &= ~(LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) |
+				LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2));
+	}
+
+	if (iio_buffer_enabled(iio)) {
+		if (reg & lradc->buffer_vchans)
+			iio_trigger_poll(iio->trig);
+	} else if (reg & LRADC_CTRL1_LRADC_IRQ(0)) {
 		complete(&lradc->completion);
+	}
 
-	mxs_lradc_reg_clear(lradc, reg & mxs_lradc_irq_mask(lradc),
-			LRADC_CTRL1);
+	mxs_lradc_reg_clear(lradc, reg & clr_irq, LRADC_CTRL1);
 
 	return IRQ_HANDLED;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1272 @ static int mxs_lradc_buffer_preenable(st
 	}
 
 	if (lradc->soc == IMX28_LRADC)
-		mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK,
-							LRADC_CTRL1);
-	mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
+		mxs_lradc_reg_clear(lradc,
+			lradc->buffer_vchans << LRADC_CTRL1_LRADC_IRQ_EN_OFFSET,
+			LRADC_CTRL1);
+	mxs_lradc_reg_clear(lradc, lradc->buffer_vchans, LRADC_CTRL0);
 
 	for_each_set_bit(chan, iio->active_scan_mask, LRADC_MAX_TOTAL_CHANS) {
 		ctrl4_set |= chan << LRADC_CTRL4_LRADCSELECT_OFFSET(ofs);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1308 @ static int mxs_lradc_buffer_postdisable(
 	mxs_lradc_reg_clear(lradc, LRADC_DELAY_TRIGGER_LRADCS_MASK |
 					LRADC_DELAY_KICK, LRADC_DELAY(0));
 
-	mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
+	mxs_lradc_reg_clear(lradc, lradc->buffer_vchans, LRADC_CTRL0);
 	if (lradc->soc == IMX28_LRADC)
-		mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK,
-					LRADC_CTRL1);
+		mxs_lradc_reg_clear(lradc,
+			lradc->buffer_vchans << LRADC_CTRL1_LRADC_IRQ_EN_OFFSET,
+			LRADC_CTRL1);
 
 	kfree(lradc->buffer);
 	mutex_unlock(&lradc->lock);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1338 @ static bool mxs_lradc_validate_scan_mask
 	if (lradc->use_touchbutton)
 		rsvd_chans++;
 	if (lradc->use_touchscreen)
-		rsvd_chans++;
+		rsvd_chans += 2;
 
 	/* Test for attempts to map channels with special mode of operation. */
 	if (bitmap_intersects(mask, &rsvd_mask, LRADC_MAX_TOTAL_CHANS))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1398 @ static const struct iio_chan_spec mxs_lr
 		.channel = 8,
 		.scan_type = {.sign = 'u', .realbits = 18, .storagebits = 32,},
 	},
+	/* Hidden channel to keep indexes */
+	{
+		.type = IIO_TEMP,
+		.indexed = 1,
+		.scan_index = -1,
+		.channel = 9,
+	},
 	MXS_ADC_CHAN(10, IIO_VOLTAGE),	/* VDDIO */
 	MXS_ADC_CHAN(11, IIO_VOLTAGE),	/* VTH */
 	MXS_ADC_CHAN(12, IIO_VOLTAGE),	/* VDDA */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1557 @ static int mxs_lradc_probe(struct platfo
 
 	touch_ret = mxs_lradc_probe_touchscreen(lradc, node);
 
+	if (touch_ret == 0)
+		lradc->buffer_vchans = BUFFER_VCHANS_LIMITED;
+	else
+		lradc->buffer_vchans = BUFFER_VCHANS_ALL;
+
 	/* Grab all IRQ sources */
 	for (i = 0; i < of_cfg->irq_count; i++) {
 		lradc->irq[i] = platform_get_irq(pdev, i);
Index: linux-3.18.13-rt10-r7s4/drivers/staging/lustre/lustre/llite/dcache.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/staging/lustre/lustre/llite/dcache.c
+++ linux-3.18.13-rt10-r7s4/drivers/staging/lustre/lustre/llite/dcache.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:261 @ void ll_invalidate_aliases(struct inode
 	       inode->i_ino, inode->i_generation, inode);
 
 	ll_lock_dcache(inode);
-	ll_d_hlist_for_each_entry(dentry, p, &inode->i_dentry, d_alias) {
+	ll_d_hlist_for_each_entry(dentry, p, &inode->i_dentry, d_u.d_alias) {
 		CDEBUG(D_DENTRY, "dentry in drop %.*s (%p) parent %p "
 		       "inode %p flags %d\n", dentry->d_name.len,
 		       dentry->d_name.name, dentry, dentry->d_parent,
Index: linux-3.18.13-rt10-r7s4/drivers/staging/lustre/lustre/llite/llite_lib.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/staging/lustre/lustre/llite/llite_lib.c
+++ linux-3.18.13-rt10-r7s4/drivers/staging/lustre/lustre/llite/llite_lib.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:714 @ void lustre_dump_dentry(struct dentry *d
 		return;
 
 	list_for_each(tmp, &dentry->d_subdirs) {
-		struct dentry *d = list_entry(tmp, struct dentry, d_u.d_child);
+		struct dentry *d = list_entry(tmp, struct dentry, d_child);
 		lustre_dump_dentry(d, recur - 1);
 	}
 }
Index: linux-3.18.13-rt10-r7s4/drivers/staging/lustre/lustre/llite/namei.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/staging/lustre/lustre/llite/namei.c
+++ linux-3.18.13-rt10-r7s4/drivers/staging/lustre/lustre/llite/namei.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:170 @ static void ll_invalidate_negative_child
 	struct ll_d_hlist_node *p;
 
 	ll_lock_dcache(dir);
-	ll_d_hlist_for_each_entry(dentry, p, &dir->i_dentry, d_alias) {
+	ll_d_hlist_for_each_entry(dentry, p, &dir->i_dentry, d_u.d_alias) {
 		spin_lock(&dentry->d_lock);
 		if (!list_empty(&dentry->d_subdirs)) {
 			struct dentry *child;
 
 			list_for_each_entry_safe(child, tmp_subdir,
 						 &dentry->d_subdirs,
-						 d_u.d_child) {
+						 d_child) {
 				if (child->d_inode == NULL)
 					d_lustre_invalidate(child, 1);
 			}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:365 @ static struct dentry *ll_find_alias(stru
 	discon_alias = invalid_alias = NULL;
 
 	ll_lock_dcache(inode);
-	ll_d_hlist_for_each_entry(alias, p, &inode->i_dentry, d_alias) {
+	ll_d_hlist_for_each_entry(alias, p, &inode->i_dentry, d_u.d_alias) {
 		LASSERT(alias != dentry);
 
 		spin_lock(&alias->d_lock);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:956 @ static void ll_get_child_fid(struct inod
 {
 	struct dentry *parent, *child;
 
-	parent = ll_d_hlist_entry(dir->i_dentry, struct dentry, d_alias);
+	parent = ll_d_hlist_entry(dir->i_dentry, struct dentry, d_u.d_alias);
 	child = d_lookup(parent, name);
 	if (child) {
 		if (child->d_inode)
Index: linux-3.18.13-rt10-r7s4/drivers/staging/lustre/lustre/llite/vvp_io.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/staging/lustre/lustre/llite/vvp_io.c
+++ linux-3.18.13-rt10-r7s4/drivers/staging/lustre/lustre/llite/vvp_io.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:635 @ static int vvp_io_kernel_fault(struct vv
 		return 0;
 	}
 
-	if (cfio->fault.ft_flags & VM_FAULT_SIGBUS) {
+	if (cfio->fault.ft_flags & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) {
 		CDEBUG(D_PAGE, "got addr %p - SIGBUS\n", vmf->virtual_address);
 		return -EFAULT;
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/staging/vt6655/rf.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/staging/vt6655/rf.c
+++ linux-3.18.13-rt10-r7s4/drivers/staging/vt6655/rf.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:926 @ bool RFbSetPower(
 		break;
 	case RATE_6M:
 	case RATE_9M:
+	case RATE_12M:
 	case RATE_18M:
 		byPwr = pDevice->abyOFDMPwrTbl[uCH];
 		if (pDevice->byRFType == RF_UW2452)
Index: linux-3.18.13-rt10-r7s4/drivers/staging/vt6656/rf.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/staging/vt6656/rf.c
+++ linux-3.18.13-rt10-r7s4/drivers/staging/vt6656/rf.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:643 @ int vnt_rf_setpower(struct vnt_private *
 		break;
 	case RATE_6M:
 	case RATE_9M:
+	case RATE_12M:
 	case RATE_18M:
 	case RATE_24M:
 	case RATE_36M:
Index: linux-3.18.13-rt10-r7s4/drivers/target/iscsi/iscsi_target.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/iscsi/iscsi_target.c
+++ linux-3.18.13-rt10-r7s4/drivers/target/iscsi/iscsi_target.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1187 @ iscsit_handle_scsi_cmd(struct iscsi_conn
 	 * traditional iSCSI block I/O.
 	 */
 	if (iscsit_allocate_iovecs(cmd) < 0) {
-		return iscsit_add_reject_cmd(cmd,
+		return iscsit_reject_cmd(cmd,
 				ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
 	}
 	immed_data = cmd->immediate_data;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4223 @ int iscsit_close_connection(
 	pr_debug("Closing iSCSI connection CID %hu on SID:"
 		" %u\n", conn->cid, sess->sid);
 	/*
-	 * Always up conn_logout_comp just in case the RX Thread is sleeping
-	 * and the logout response never got sent because the connection
-	 * failed.
+	 * Always up conn_logout_comp for the traditional TCP case just in case
+	 * the RX Thread in iscsi_target_rx_opcode() is sleeping and the logout
+	 * response never got sent because the connection failed.
+	 *
+	 * However for iser-target, isert_wait4logout() is using conn_logout_comp
+	 * to signal logout response TX interrupt completion.  Go ahead and skip
+	 * this for iser since isert_rx_opcode() does not wait on logout failure,
+	 * and to avoid iscsi_conn pointer dereference in iser-target code.
 	 */
-	complete(&conn->conn_logout_comp);
+	if (conn->conn_transport->transport_type == ISCSI_TCP)
+		complete(&conn->conn_logout_comp);
 
 	iscsi_release_thread_set(conn);
 
Index: linux-3.18.13-rt10-r7s4/drivers/target/iscsi/iscsi_target_login.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/iscsi/iscsi_target_login.c
+++ linux-3.18.13-rt10-r7s4/drivers/target/iscsi/iscsi_target_login.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:284 @ static int iscsi_login_zero_tsih_s1(
 {
 	struct iscsi_session *sess = NULL;
 	struct iscsi_login_req *pdu = (struct iscsi_login_req *)buf;
-	enum target_prot_op sup_pro_ops;
 	int ret;
 
 	sess = kzalloc(sizeof(struct iscsi_session), GFP_KERNEL);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:345 @ static int iscsi_login_zero_tsih_s1(
 		kfree(sess);
 		return -ENOMEM;
 	}
-	sup_pro_ops = conn->conn_transport->iscsit_get_sup_prot_ops(conn);
 
-	sess->se_sess = transport_init_session(sup_pro_ops);
+	sess->se_sess = transport_init_session(TARGET_PROT_NORMAL);
 	if (IS_ERR(sess->se_sess)) {
 		iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
 				ISCSI_LOGIN_STATUS_NO_RESOURCES);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1205 @ old_sess_out:
 		conn->sock = NULL;
 	}
 
+	if (conn->conn_transport->iscsit_wait_conn)
+		conn->conn_transport->iscsit_wait_conn(conn);
+
 	if (conn->conn_transport->iscsit_free_conn)
 		conn->conn_transport->iscsit_free_conn(conn);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1368 @ static int __iscsi_target_login_thread(s
 	}
 	login->zero_tsih = zero_tsih;
 
+	conn->sess->se_sess->sup_prot_ops =
+		conn->conn_transport->iscsit_get_sup_prot_ops(conn);
+
 	tpg = conn->tpg;
 	if (!tpg) {
 		pr_err("Unable to locate struct iscsi_conn->tpg\n");
Index: linux-3.18.13-rt10-r7s4/drivers/target/iscsi/iscsi_target_tq.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/iscsi/iscsi_target_tq.c
+++ linux-3.18.13-rt10-r7s4/drivers/target/iscsi/iscsi_target_tq.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:27 @
 #include "iscsi_target_tq.h"
 #include "iscsi_target.h"
 
-static LIST_HEAD(active_ts_list);
 static LIST_HEAD(inactive_ts_list);
-static DEFINE_SPINLOCK(active_ts_lock);
 static DEFINE_SPINLOCK(inactive_ts_lock);
 static DEFINE_SPINLOCK(ts_bitmap_lock);
 
-static void iscsi_add_ts_to_active_list(struct iscsi_thread_set *ts)
-{
-	spin_lock(&active_ts_lock);
-	list_add_tail(&ts->ts_list, &active_ts_list);
-	iscsit_global->active_ts++;
-	spin_unlock(&active_ts_lock);
-}
-
 static void iscsi_add_ts_to_inactive_list(struct iscsi_thread_set *ts)
 {
+	if (!list_empty(&ts->ts_list)) {
+		WARN_ON(1);
+		return;
+	}
 	spin_lock(&inactive_ts_lock);
 	list_add_tail(&ts->ts_list, &inactive_ts_list);
 	iscsit_global->inactive_ts++;
 	spin_unlock(&inactive_ts_lock);
 }
 
-static void iscsi_del_ts_from_active_list(struct iscsi_thread_set *ts)
-{
-	spin_lock(&active_ts_lock);
-	list_del(&ts->ts_list);
-	iscsit_global->active_ts--;
-	spin_unlock(&active_ts_lock);
-}
-
 static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void)
 {
 	struct iscsi_thread_set *ts;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:55 @ static struct iscsi_thread_set *iscsi_ge
 
 	ts = list_first_entry(&inactive_ts_list, struct iscsi_thread_set, ts_list);
 
-	list_del(&ts->ts_list);
+	list_del_init(&ts->ts_list);
 	iscsit_global->inactive_ts--;
 	spin_unlock(&inactive_ts_lock);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:193 @ static void iscsi_deallocate_extra_threa
 
 void iscsi_activate_thread_set(struct iscsi_conn *conn, struct iscsi_thread_set *ts)
 {
-	iscsi_add_ts_to_active_list(ts);
-
 	spin_lock_bh(&ts->ts_state_lock);
 	conn->thread_set = ts;
 	ts->conn = conn;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:384 @ struct iscsi_conn *iscsi_rx_thread_pre_h
 
 	if (ts->delay_inactive && (--ts->thread_count == 0)) {
 		spin_unlock_bh(&ts->ts_state_lock);
-		iscsi_del_ts_from_active_list(ts);
 
 		if (!iscsit_global->in_shutdown)
 			iscsi_deallocate_extra_thread_sets();
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:438 @ struct iscsi_conn *iscsi_tx_thread_pre_h
 
 	if (ts->delay_inactive && (--ts->thread_count == 0)) {
 		spin_unlock_bh(&ts->ts_state_lock);
-		iscsi_del_ts_from_active_list(ts);
 
 		if (!iscsit_global->in_shutdown)
 			iscsi_deallocate_extra_thread_sets();
Index: linux-3.18.13-rt10-r7s4/drivers/target/iscsi/iscsi_target_util.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/iscsi/iscsi_target_util.c
+++ linux-3.18.13-rt10-r7s4/drivers/target/iscsi/iscsi_target_util.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1361 @ static int iscsit_do_tx_data(
 	struct iscsi_conn *conn,
 	struct iscsi_data_count *count)
 {
-	int data = count->data_length, total_tx = 0, tx_loop = 0, iov_len;
+	int ret, iov_len;
 	struct kvec *iov_p;
 	struct msghdr msg;
 
 	if (!conn || !conn->sock || !conn->conn_ops)
 		return -1;
 
-	if (data <= 0) {
-		pr_err("Data length is: %d\n", data);
+	if (count->data_length <= 0) {
+		pr_err("Data length is: %d\n", count->data_length);
 		return -1;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1378 @ static int iscsit_do_tx_data(
 	iov_p = count->iov;
 	iov_len = count->iov_count;
 
-	while (total_tx < data) {
-		tx_loop = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
-					(data - total_tx));
-		if (tx_loop <= 0) {
-			pr_debug("tx_loop: %d total_tx %d\n",
-				tx_loop, total_tx);
-			return tx_loop;
-		}
-		total_tx += tx_loop;
-		pr_debug("tx_loop: %d, total_tx: %d, data: %d\n",
-					tx_loop, total_tx, data);
+	ret = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
+			     count->data_length);
+	if (ret != count->data_length) {
+		pr_err("Unexpected ret: %d send data %d\n",
+		       ret, count->data_length);
+		return -EPIPE;
 	}
+	pr_debug("ret: %d, sent data: %d\n", ret, count->data_length);
 
-	return total_tx;
+	return ret;
 }
 
 int rx_data(
Index: linux-3.18.13-rt10-r7s4/drivers/target/loopback/tcm_loop.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/loopback/tcm_loop.c
+++ linux-3.18.13-rt10-r7s4/drivers/target/loopback/tcm_loop.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:193 @ static void tcm_loop_submission_work(str
 		set_host_byte(sc, DID_TRANSPORT_DISRUPTED);
 		goto out_done;
 	}
-	tl_nexus = tl_hba->tl_nexus;
+	tl_nexus = tl_tpg->tl_nexus;
 	if (!tl_nexus) {
 		scmd_printk(KERN_ERR, sc, "TCM_Loop I_T Nexus"
 				" does not exist\n");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:273 @ static int tcm_loop_queuecommand(struct
  * to struct scsi_device
  */
 static int tcm_loop_issue_tmr(struct tcm_loop_tpg *tl_tpg,
-			      struct tcm_loop_nexus *tl_nexus,
 			      int lun, int task, enum tcm_tmreq_table tmr)
 {
 	struct se_cmd *se_cmd = NULL;
 	struct se_session *se_sess;
 	struct se_portal_group *se_tpg;
+	struct tcm_loop_nexus *tl_nexus;
 	struct tcm_loop_cmd *tl_cmd = NULL;
 	struct tcm_loop_tmr *tl_tmr = NULL;
 	int ret = TMR_FUNCTION_FAILED, rc;
 
+	/*
+	 * Locate the tl_nexus and se_sess pointers
+	 */
+	tl_nexus = tl_tpg->tl_nexus;
+	if (!tl_nexus) {
+		pr_err("Unable to perform device reset without"
+				" active I_T Nexus\n");
+		return ret;
+	}
+
 	tl_cmd = kmem_cache_zalloc(tcm_loop_cmd_cache, GFP_KERNEL);
 	if (!tl_cmd) {
 		pr_err("Unable to allocate memory for tl_cmd\n");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:308 @ static int tcm_loop_issue_tmr(struct tcm
 
 	se_cmd = &tl_cmd->tl_se_cmd;
 	se_tpg = &tl_tpg->tl_se_tpg;
-	se_sess = tl_nexus->se_sess;
+	se_sess = tl_tpg->tl_nexus->se_sess;
 	/*
 	 * Initialize struct se_cmd descriptor from target_core_mod infrastructure
 	 */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:353 @ release:
 static int tcm_loop_abort_task(struct scsi_cmnd *sc)
 {
 	struct tcm_loop_hba *tl_hba;
-	struct tcm_loop_nexus *tl_nexus;
 	struct tcm_loop_tpg *tl_tpg;
 	int ret = FAILED;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:360 @ static int tcm_loop_abort_task(struct sc
 	 * Locate the tcm_loop_hba_t pointer
 	 */
 	tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host);
-	/*
-	 * Locate the tl_nexus and se_sess pointers
-	 */
-	tl_nexus = tl_hba->tl_nexus;
-	if (!tl_nexus) {
-		pr_err("Unable to perform device reset without"
-				" active I_T Nexus\n");
-		return FAILED;
-	}
-
-	/*
-	 * Locate the tl_tpg pointer from TargetID in sc->device->id
-	 */
 	tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];
-	ret = tcm_loop_issue_tmr(tl_tpg, tl_nexus, sc->device->lun,
+	ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun,
 				 sc->request->tag, TMR_ABORT_TASK);
 	return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:373 @ static int tcm_loop_abort_task(struct sc
 static int tcm_loop_device_reset(struct scsi_cmnd *sc)
 {
 	struct tcm_loop_hba *tl_hba;
-	struct tcm_loop_nexus *tl_nexus;
 	struct tcm_loop_tpg *tl_tpg;
 	int ret = FAILED;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:380 @ static int tcm_loop_device_reset(struct
 	 * Locate the tcm_loop_hba_t pointer
 	 */
 	tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host);
-	/*
-	 * Locate the tl_nexus and se_sess pointers
-	 */
-	tl_nexus = tl_hba->tl_nexus;
-	if (!tl_nexus) {
-		pr_err("Unable to perform device reset without"
-				" active I_T Nexus\n");
-		return FAILED;
-	}
-	/*
-	 * Locate the tl_tpg pointer from TargetID in sc->device->id
-	 */
 	tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];
-	ret = tcm_loop_issue_tmr(tl_tpg, tl_nexus, sc->device->lun,
+
+	ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun,
 				 0, TMR_LUN_RESET);
 	return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:992 @ static int tcm_loop_make_nexus(
 	struct tcm_loop_nexus *tl_nexus;
 	int ret = -ENOMEM;
 
-	if (tl_tpg->tl_hba->tl_nexus) {
-		pr_debug("tl_tpg->tl_hba->tl_nexus already exists\n");
+	if (tl_tpg->tl_nexus) {
+		pr_debug("tl_tpg->tl_nexus already exists\n");
 		return -EEXIST;
 	}
 	se_tpg = &tl_tpg->tl_se_tpg;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1028 @ static int tcm_loop_make_nexus(
 	 */
 	__transport_register_session(se_tpg, tl_nexus->se_sess->se_node_acl,
 			tl_nexus->se_sess, tl_nexus);
-	tl_tpg->tl_hba->tl_nexus = tl_nexus;
+	tl_tpg->tl_nexus = tl_nexus;
 	pr_debug("TCM_Loop_ConfigFS: Established I_T Nexus to emulated"
 		" %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tl_hba),
 		name);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1044 @ static int tcm_loop_drop_nexus(
 {
 	struct se_session *se_sess;
 	struct tcm_loop_nexus *tl_nexus;
-	struct tcm_loop_hba *tl_hba = tpg->tl_hba;
 
-	if (!tl_hba)
-		return -ENODEV;
-
-	tl_nexus = tl_hba->tl_nexus;
+	tl_nexus = tpg->tl_nexus;
 	if (!tl_nexus)
 		return -ENODEV;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1061 @ static int tcm_loop_drop_nexus(
 	}
 
 	pr_debug("TCM_Loop_ConfigFS: Removing I_T Nexus to emulated"
-		" %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tl_hba),
+		" %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tpg->tl_hba),
 		tl_nexus->se_sess->se_node_acl->initiatorname);
 	/*
 	 * Release the SCSI I_T Nexus to the emulated SAS Target Port
 	 */
 	transport_deregister_session(tl_nexus->se_sess);
-	tpg->tl_hba->tl_nexus = NULL;
+	tpg->tl_nexus = NULL;
 	kfree(tl_nexus);
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1083 @ static ssize_t tcm_loop_tpg_show_nexus(
 	struct tcm_loop_nexus *tl_nexus;
 	ssize_t ret;
 
-	tl_nexus = tl_tpg->tl_hba->tl_nexus;
+	tl_nexus = tl_tpg->tl_nexus;
 	if (!tl_nexus)
 		return -ENODEV;
 
Index: linux-3.18.13-rt10-r7s4/drivers/target/loopback/tcm_loop.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/loopback/tcm_loop.h
+++ linux-3.18.13-rt10-r7s4/drivers/target/loopback/tcm_loop.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:30 @ struct tcm_loop_tmr {
 };
 
 struct tcm_loop_nexus {
-	int it_nexus_active;
-	/*
-	 * Pointer to Linux/SCSI HBA from linux/include/scsi_host.h
-	 */
-	struct scsi_host *sh;
 	/*
 	 * Pointer to TCM session for I_T Nexus
 	 */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:49 @ struct tcm_loop_tpg {
 	atomic_t tl_tpg_port_count;
 	struct se_portal_group tl_se_tpg;
 	struct tcm_loop_hba *tl_hba;
+	struct tcm_loop_nexus *tl_nexus;
 };
 
 struct tcm_loop_hba {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:58 @ struct tcm_loop_hba {
 	struct se_hba_s *se_hba;
 	struct se_lun *tl_hba_lun;
 	struct se_port *tl_hba_lun_sep;
-	struct tcm_loop_nexus *tl_nexus;
 	struct device dev;
 	struct Scsi_Host *sh;
 	struct tcm_loop_tpg tl_hba_tpgs[TL_TPGS_PER_HBA];
Index: linux-3.18.13-rt10-r7s4/drivers/target/target_core_device.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/target_core_device.c
+++ linux-3.18.13-rt10-r7s4/drivers/target/target_core_device.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1172 @ int se_dev_set_optimal_sectors(struct se
 				" changed for TCM/pSCSI\n", dev);
 		return -EINVAL;
 	}
-	if (optimal_sectors > dev->dev_attrib.fabric_max_sectors) {
+	if (optimal_sectors > dev->dev_attrib.hw_max_sectors) {
 		pr_err("dev[%p]: Passed optimal_sectors %u cannot be"
-			" greater than fabric_max_sectors: %u\n", dev,
-			optimal_sectors, dev->dev_attrib.fabric_max_sectors);
+			" greater than hw_max_sectors: %u\n", dev,
+			optimal_sectors, dev->dev_attrib.hw_max_sectors);
 		return -EINVAL;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1575 @ struct se_device *target_alloc_device(st
 				DA_UNMAP_GRANULARITY_ALIGNMENT_DEFAULT;
 	dev->dev_attrib.max_write_same_len = DA_MAX_WRITE_SAME_LEN;
 	dev->dev_attrib.fabric_max_sectors = DA_FABRIC_MAX_SECTORS;
-	dev->dev_attrib.optimal_sectors = DA_FABRIC_MAX_SECTORS;
 
 	xcopy_lun = &dev->xcopy_lun;
 	xcopy_lun->lun_se_dev = dev;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1601 @ int target_configure_device(struct se_de
 	ret = dev->transport->configure_device(dev);
 	if (ret)
 		goto out;
-	dev->dev_flags |= DF_CONFIGURED;
-
 	/*
 	 * XXX: there is not much point to have two different values here..
 	 */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1613 @ int target_configure_device(struct se_de
 	dev->dev_attrib.hw_max_sectors =
 		se_dev_align_max_sectors(dev->dev_attrib.hw_max_sectors,
 					 dev->dev_attrib.hw_block_size);
+	dev->dev_attrib.optimal_sectors = dev->dev_attrib.hw_max_sectors;
 
 	dev->dev_index = scsi_get_new_index(SCSI_DEVICE_INDEX);
 	dev->creation_time = get_jiffies_64();
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1662 @ int target_configure_device(struct se_de
 	list_add_tail(&dev->g_dev_node, &g_device_list);
 	mutex_unlock(&g_device_mutex);
 
+	dev->dev_flags |= DF_CONFIGURED;
+
 	return 0;
 
 out_free_alua:
Index: linux-3.18.13-rt10-r7s4/drivers/target/target_core_file.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/target_core_file.c
+++ linux-3.18.13-rt10-r7s4/drivers/target/target_core_file.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:623 @ fd_execute_rw(struct se_cmd *cmd, struct
 	struct fd_prot fd_prot;
 	sense_reason_t rc;
 	int ret = 0;
-
+	/*
+	 * We are currently limited by the number of iovecs (2048) per
+	 * single vfs_[writev,readv] call.
+	 */
+	if (cmd->data_length > FD_MAX_BYTES) {
+		pr_err("FILEIO: Not able to process I/O of %u bytes due to"
+		       "FD_MAX_BYTES: %u iovec count limitiation\n",
+			cmd->data_length, FD_MAX_BYTES);
+		return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+	}
 	/*
 	 * Call vectorized fileio functions to map struct scatterlist
 	 * physical memory addresses to struct iovec virtual memory.
Index: linux-3.18.13-rt10-r7s4/drivers/target/target_core_iblock.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/target_core_iblock.c
+++ linux-3.18.13-rt10-r7s4/drivers/target/target_core_iblock.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:126 @ static int iblock_configure_device(struc
 	q = bdev_get_queue(bd);
 
 	dev->dev_attrib.hw_block_size = bdev_logical_block_size(bd);
-	dev->dev_attrib.hw_max_sectors = UINT_MAX;
+	dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q);
 	dev->dev_attrib.hw_queue_depth = q->nr_requests;
 
 	/*
Index: linux-3.18.13-rt10-r7s4/drivers/target/target_core_pr.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/target_core_pr.c
+++ linux-3.18.13-rt10-r7s4/drivers/target/target_core_pr.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1860 @ static int core_scsi3_update_aptpl_buf(
 		}
 
 		if ((len + strlen(tmp) >= pr_aptpl_buf_len)) {
-			pr_err("Unable to update renaming"
-				" APTPL metadata\n");
+			pr_err("Unable to update renaming APTPL metadata,"
+			       " reallocating larger buffer\n");
 			ret = -EMSGSIZE;
 			goto out;
 		}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1878 @ static int core_scsi3_update_aptpl_buf(
 			lun->lun_sep->sep_rtpi, lun->unpacked_lun, reg_count);
 
 		if ((len + strlen(tmp) >= pr_aptpl_buf_len)) {
-			pr_err("Unable to update renaming"
-				" APTPL metadata\n");
+			pr_err("Unable to update renaming APTPL metadata,"
+			       " reallocating larger buffer\n");
 			ret = -EMSGSIZE;
 			goto out;
 		}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1942 @ static int __core_scsi3_write_aptpl_to_f
 static sense_reason_t core_scsi3_update_and_write_aptpl(struct se_device *dev, bool aptpl)
 {
 	unsigned char *buf;
-	int rc;
+	int rc, len = PR_APTPL_BUF_LEN;
 
 	if (!aptpl) {
 		char *null_buf = "No Registrations or Reservations\n";
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1956 @ static sense_reason_t core_scsi3_update_
 
 		return 0;
 	}
-
-	buf = kzalloc(PR_APTPL_BUF_LEN, GFP_KERNEL);
+retry:
+	buf = vzalloc(len);
 	if (!buf)
 		return TCM_OUT_OF_RESOURCES;
 
-	rc = core_scsi3_update_aptpl_buf(dev, buf, PR_APTPL_BUF_LEN);
+	rc = core_scsi3_update_aptpl_buf(dev, buf, len);
 	if (rc < 0) {
-		kfree(buf);
-		return TCM_OUT_OF_RESOURCES;
+		vfree(buf);
+		len *= 2;
+		goto retry;
 	}
 
 	rc = __core_scsi3_write_aptpl_to_file(dev, buf);
 	if (rc != 0) {
 		pr_err("SPC-3 PR: Could not update APTPL\n");
-		kfree(buf);
+		vfree(buf);
 		return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
 	}
 	dev->t10_pr.pr_aptpl_active = 1;
-	kfree(buf);
+	vfree(buf);
 	pr_debug("SPC-3 PR: Set APTPL Bit Activated\n");
 	return 0;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/target/target_core_pscsi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/target_core_pscsi.c
+++ linux-3.18.13-rt10-r7s4/drivers/target/target_core_pscsi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1123 @ static u32 pscsi_get_device_type(struct
 	struct pscsi_dev_virt *pdv = PSCSI_DEV(dev);
 	struct scsi_device *sd = pdv->pdv_sd;
 
-	return sd->type;
+	return (sd) ? sd->type : TYPE_NO_LUN;
 }
 
 static sector_t pscsi_get_blocks(struct se_device *dev)
Index: linux-3.18.13-rt10-r7s4/drivers/target/target_core_sbc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/target_core_sbc.c
+++ linux-3.18.13-rt10-r7s4/drivers/target/target_core_sbc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:254 @ static inline unsigned long long transpo
 static sense_reason_t
 sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *ops)
 {
+	struct se_device *dev = cmd->se_dev;
+	sector_t end_lba = dev->transport->get_blocks(dev) + 1;
 	unsigned int sectors = sbc_get_write_same_sectors(cmd);
 
 	if ((flags[0] & 0x04) || (flags[0] & 0x02)) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:269 @ sbc_setup_write_same(struct se_cmd *cmd,
 			sectors, cmd->se_dev->dev_attrib.max_write_same_len);
 		return TCM_INVALID_CDB_FIELD;
 	}
+	/*
+	 * Sanity check for LBA wrap and request past end of device.
+	 */
+	if (((cmd->t_task_lba + sectors) < cmd->t_task_lba) ||
+	    ((cmd->t_task_lba + sectors) > end_lba)) {
+		pr_err("WRITE_SAME exceeds last lba %llu (lba %llu, sectors %u)\n",
+		       (unsigned long long)end_lba, cmd->t_task_lba, sectors);
+		return TCM_ADDRESS_OUT_OF_RANGE;
+	}
+
 	/* We always have ANC_SUP == 0 so setting ANCHOR is always an error */
 	if (flags[0] & 0x10) {
 		pr_warn("WRITE SAME with ANCHOR not supported\n");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:968 @ sbc_parse_cdb(struct se_cmd *cmd, struct
 
 	if (cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) {
 		unsigned long long end_lba;
-
-		if (sectors > dev->dev_attrib.fabric_max_sectors) {
-			printk_ratelimited(KERN_ERR "SCSI OP %02xh with too"
-				" big sectors %u exceeds fabric_max_sectors:"
-				" %u\n", cdb[0], sectors,
-				dev->dev_attrib.fabric_max_sectors);
-			return TCM_INVALID_CDB_FIELD;
-		}
-		if (sectors > dev->dev_attrib.hw_max_sectors) {
-			printk_ratelimited(KERN_ERR "SCSI OP %02xh with too"
-				" big sectors %u exceeds backend hw_max_sectors:"
-				" %u\n", cdb[0], sectors,
-				dev->dev_attrib.hw_max_sectors);
-			return TCM_INVALID_CDB_FIELD;
-		}
 check_lba:
 		end_lba = dev->transport->get_blocks(dev) + 1;
-		if (cmd->t_task_lba + sectors > end_lba) {
+		if (((cmd->t_task_lba + sectors) < cmd->t_task_lba) ||
+		    ((cmd->t_task_lba + sectors) > end_lba)) {
 			pr_err("cmd exceeds last lba %llu "
 				"(lba %llu, sectors %u)\n",
 				end_lba, cmd->t_task_lba, sectors);
Index: linux-3.18.13-rt10-r7s4/drivers/target/target_core_spc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/target_core_spc.c
+++ linux-3.18.13-rt10-r7s4/drivers/target/target_core_spc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:508 @ static sense_reason_t
 spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf)
 {
 	struct se_device *dev = cmd->se_dev;
-	u32 max_sectors;
 	int have_tp = 0;
 	int opt, min;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:541 @ spc_emulate_evpd_b0(struct se_cmd *cmd,
 	/*
 	 * Set MAXIMUM TRANSFER LENGTH
 	 */
-	max_sectors = min(dev->dev_attrib.fabric_max_sectors,
-			  dev->dev_attrib.hw_max_sectors);
-	put_unaligned_be32(max_sectors, &buf[8]);
+	put_unaligned_be32(dev->dev_attrib.hw_max_sectors, &buf[8]);
 
 	/*
 	 * Set OPTIMAL TRANSFER LENGTH
Index: linux-3.18.13-rt10-r7s4/drivers/target/target_core_transport.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/target_core_transport.c
+++ linux-3.18.13-rt10-r7s4/drivers/target/target_core_transport.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2392 @ int target_get_sess_cmd(struct se_sessio
 	list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list);
 out:
 	spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+
+	if (ret && ack_kref)
+		target_put_sess_cmd(se_sess, se_cmd);
+
 	return ret;
 }
 EXPORT_SYMBOL(target_get_sess_cmd);
Index: linux-3.18.13-rt10-r7s4/drivers/target/tcm_fc/tfc_io.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/target/tcm_fc/tfc_io.c
+++ linux-3.18.13-rt10-r7s4/drivers/target/tcm_fc/tfc_io.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:362 @ void ft_invl_hw_context(struct ft_cmd *c
 		ep = fc_seq_exch(seq);
 		if (ep) {
 			lport = ep->lp;
-			if (lport && (ep->xid <= lport->lro_xid))
+			if (lport && (ep->xid <= lport->lro_xid)) {
 				/*
 				 * "ddp_done" trigger invalidation of HW
 				 * specific DDP context
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:377 @ void ft_invl_hw_context(struct ft_cmd *c
 				 * identified using ep->xid)
 				 */
 				cmd->was_ddp_setup = 0;
+			}
 		}
 	}
 }
Index: linux-3.18.13-rt10-r7s4/drivers/thermal/intel_powerclamp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/thermal/intel_powerclamp.c
+++ linux-3.18.13-rt10-r7s4/drivers/thermal/intel_powerclamp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:438 @ static int clamp_thread(void *arg)
 		 * allowed. thus jiffies are updated properly.
 		 */
 		preempt_disable();
-		tick_nohz_idle_enter();
 		/* mwait until target jiffies is reached */
 		while (time_before(jiffies, target_jiffies)) {
 			unsigned long ecx = 1;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:453 @ static int clamp_thread(void *arg)
 			start_critical_timings();
 			atomic_inc(&idle_wakeup_counter);
 		}
-		tick_nohz_idle_exit();
 		preempt_enable();
 	}
 	del_timer_sync(&wakeup_timer);
Index: linux-3.18.13-rt10-r7s4/drivers/thermal/thermal_core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/thermal/thermal_core.c
+++ linux-3.18.13-rt10-r7s4/drivers/thermal/thermal_core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1838 @ static int __init thermal_init(void)
 
 exit_netlink:
 	genetlink_exit();
-unregister_governors:
-	thermal_unregister_governors();
 unregister_class:
 	class_unregister(&thermal_class);
+unregister_governors:
+	thermal_unregister_governors();
 error:
 	idr_destroy(&thermal_tz_idr);
 	idr_destroy(&thermal_cdev_idr);
Index: linux-3.18.13-rt10-r7s4/drivers/tty/n_tty.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/tty/n_tty.c
+++ linux-3.18.13-rt10-r7s4/drivers/tty/n_tty.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:250 @ static void n_tty_write_wakeup(struct tt
 
 static void n_tty_check_throttle(struct tty_struct *tty)
 {
-	if (tty->driver->type == TTY_DRIVER_TYPE_PTY)
-		return;
 	/*
 	 * Check the remaining room for the input canonicalization
 	 * mode.  We don't want to throttle the driver if we're in
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:322 @ static void n_tty_check_unthrottle(struc
 
 static inline void put_tty_queue(unsigned char c, struct n_tty_data *ldata)
 {
-	*read_buf_addr(ldata, ldata->read_head++) = c;
+	*read_buf_addr(ldata, ldata->read_head) = c;
+	ldata->read_head++;
 }
 
 /**
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1513 @ n_tty_receive_char_lnext(struct tty_stru
 		n_tty_receive_char_flagged(tty, c, flag);
 }
 
-/**
- *	n_tty_receive_buf	-	data receive
- *	@tty: terminal device
- *	@cp: buffer
- *	@fp: flag buffer
- *	@count: characters
- *
- *	Called by the terminal driver when a block of characters has
- *	been received. This function must be called from soft contexts
- *	not from interrupt context. The driver is responsible for making
- *	calls one at a time and in order (or using flush_to_ldisc)
- *
- *	n_tty_receive_buf()/producer path:
- *		claims non-exclusive termios_rwsem
- *		publishes read_head and canon_head
- */
-
 static void
 n_tty_receive_buf_real_raw(struct tty_struct *tty, const unsigned char *cp,
 			   char *fp, int count)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1668 @ static void __receive_buf(struct tty_str
 	}
 }
 
+/**
+ *	n_tty_receive_buf_common	-	process input
+ *	@tty: device to receive input
+ *	@cp: input chars
+ *	@fp: flags for each char (if NULL, all chars are TTY_NORMAL)
+ *	@count: number of input chars in @cp
+ *
+ *	Called by the terminal driver when a block of characters has
+ *	been received. This function must be called from soft contexts
+ *	not from interrupt context. The driver is responsible for making
+ *	calls one at a time and in order (or using flush_to_ldisc)
+ *
+ *	Returns the # of input chars from @cp which were processed.
+ *
+ *	In canonical mode, the maximum line length is 4096 chars (including
+ *	the line termination char); lines longer than 4096 chars are
+ *	truncated. After 4095 chars, input data is still processed but
+ *	not stored. Overflow processing ensures the tty can always
+ *	receive more input until at least one line can be read.
+ *
+ *	In non-canonical mode, the read buffer will only accept 4095 chars;
+ *	this provides the necessary space for a newline char if the input
+ *	mode is switched to canonical.
+ *
+ *	Note it is possible for the read buffer to _contain_ 4096 chars
+ *	in non-canonical mode: the read buffer could already contain the
+ *	maximum canon line of 4096 chars when the mode is switched to
+ *	non-canonical.
+ *
+ *	n_tty_receive_buf()/producer path:
+ *		claims non-exclusive termios_rwsem
+ *		publishes commit_head or canon_head
+ */
 static int
 n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp,
 			 char *fp, int count, int flow)
 {
 	struct n_tty_data *ldata = tty->disc_data;
-	int room, n, rcvd = 0;
+	int room, n, rcvd = 0, overflow;
 
 	down_read(&tty->termios_rwsem);
 
 	while (1) {
-		room = receive_room(tty);
+		/*
+		 * When PARMRK is set, each input char may take up to 3 chars
+		 * in the read buf; reduce the buffer space avail by 3x
+		 *
+		 * If we are doing input canonicalization, and there are no
+		 * pending newlines, let characters through without limit, so
+		 * that erase characters will be handled.  Other excess
+		 * characters will be beeped.
+		 *
+		 * paired with store in *_copy_from_read_buf() -- guarantees
+		 * the consumer has loaded the data in read_buf up to the new
+		 * read_tail (so this producer will not overwrite unread data)
+		 */
+		size_t tail = ldata->read_tail;
+
+		room = N_TTY_BUF_SIZE - (ldata->read_head - tail);
+		if (I_PARMRK(tty))
+			room = (room + 2) / 3;
+		room--;
+		if (room <= 0) {
+			overflow = ldata->icanon && ldata->canon_head == tail;
+			if (overflow && room < 0)
+				ldata->read_head--;
+			room = overflow;
+			ldata->no_room = flow && !room;
+		} else
+			overflow = 0;
+
 		n = min(count, room);
-		if (!n) {
-			if (flow && !room)
-				ldata->no_room = 1;
+		if (!n)
 			break;
-		}
-		__receive_buf(tty, cp, fp, n);
+
+		/* ignore parity errors if handling overflow */
+		if (!overflow || !fp || *fp != TTY_PARITY)
+			__receive_buf(tty, cp, fp, n);
+
 		cp += n;
 		if (fp)
 			fp += n;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1755 @ n_tty_receive_buf_common(struct tty_stru
 	}
 
 	tty->receive_room = room;
-	n_tty_check_throttle(tty);
+
+	/* Unthrottle if handling overflow on pty */
+	if (tty->driver->type == TTY_DRIVER_TYPE_PTY) {
+		if (overflow) {
+			tty_set_flow_change(tty, TTY_UNTHROTTLE_SAFE);
+			tty_unthrottle_safe(tty);
+			__tty_set_flow_change(tty, 0);
+		}
+	} else
+		n_tty_check_throttle(tty);
+
 	up_read(&tty->termios_rwsem);
 
 	return rcvd;
Index: linux-3.18.13-rt10-r7s4/drivers/tty/pty.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/tty/pty.c
+++ linux-3.18.13-rt10-r7s4/drivers/tty/pty.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:213 @ static int pty_signal(struct tty_struct
 	unsigned long flags;
 	struct pid *pgrp;
 
+	if (sig != SIGINT && sig != SIGQUIT && sig != SIGTSTP)
+		return -EINVAL;
+
 	if (tty->link) {
 		spin_lock_irqsave(&tty->link->ctrl_lock, flags);
 		pgrp = get_pid(tty->link->pgrp);
Index: linux-3.18.13-rt10-r7s4/drivers/tty/serial/8250/8250_core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/tty/serial/8250/8250_core.c
+++ linux-3.18.13-rt10-r7s4/drivers/tty/serial/8250/8250_core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2091 @ int serial8250_do_startup(struct uart_po
 	/*
 	 * Clear the interrupt registers.
 	 */
-	if (serial_port_in(port, UART_LSR) & UART_LSR_DR)
-		serial_port_in(port, UART_RX);
+	serial_port_in(port, UART_LSR);
+	serial_port_in(port, UART_RX);
 	serial_port_in(port, UART_IIR);
 	serial_port_in(port, UART_MSR);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2253 @ dont_test_tx_en:
 	 * saved flags to avoid getting false values from polling
 	 * routines or the previous session.
 	 */
-	if (serial_port_in(port, UART_LSR) & UART_LSR_DR)
-		serial_port_in(port, UART_RX);
+	serial_port_in(port, UART_LSR);
+	serial_port_in(port, UART_RX);
 	serial_port_in(port, UART_IIR);
 	serial_port_in(port, UART_MSR);
 	up->lsr_saved_flags = 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2347 @ void serial8250_do_shutdown(struct uart_
 	 * Read data port to reset things, and then unlink from
 	 * the IRQ chain.
 	 */
-	if (serial_port_in(port, UART_LSR) & UART_LSR_DR)
-		serial_port_in(port, UART_RX);
+	serial_port_in(port, UART_RX);
 	serial8250_rpm_put(up);
 
 	del_timer_sync(&up->timer);
Index: linux-3.18.13-rt10-r7s4/drivers/tty/serial/8250/8250_dw.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/tty/serial/8250/8250_dw.c
+++ linux-3.18.13-rt10-r7s4/drivers/tty/serial/8250/8250_dw.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:114 @ static void dw8250_serial_out(struct uar
 			dw8250_force_idle(p);
 			writeb(value, p->membase + (UART_LCR << p->regshift));
 		}
-		dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+		/*
+		 * FIXME: this deadlocks if port->lock is already held
+		 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+		 */
 	}
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:154 @ static void dw8250_serial_out32(struct u
 			dw8250_force_idle(p);
 			writel(value, p->membase + (UART_LCR << p->regshift));
 		}
-		dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+		/*
+		 * FIXME: this deadlocks if port->lock is already held
+		 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+		 */
 	}
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/tty/serial/8250/8250_pci.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/tty/serial/8250/8250_pci.c
+++ linux-3.18.13-rt10-r7s4/drivers/tty/serial/8250/8250_pci.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:72 @ static void moan_device(const char *str,
 	       "Please send the output of lspci -vv, this\n"
 	       "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n"
 	       "manufacturer and name of serial board or\n"
-	       "modem board to rmk+serial@arm.linux.org.uk.\n",
+	       "modem board to <linux-serial@vger.kernel.org>.\n",
 	       pci_name(dev), str, dev->vendor, dev->device,
 	       dev->subsystem_vendor, dev->subsystem_device);
 }
Index: linux-3.18.13-rt10-r7s4/drivers/tty/serial/fsl_lpuart.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/tty/serial/fsl_lpuart.c
+++ linux-3.18.13-rt10-r7s4/drivers/tty/serial/fsl_lpuart.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:509 @ static inline void lpuart_prepare_rx(str
 
 	spin_lock_irqsave(&sport->port.lock, flags);
 
-	init_timer(&sport->lpuart_timer);
-	sport->lpuart_timer.function = lpuart_timer_func;
-	sport->lpuart_timer.data = (unsigned long)sport;
 	sport->lpuart_timer.expires = jiffies + sport->dma_rx_timeout;
 	add_timer(&sport->lpuart_timer);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:758 @ out:
 static irqreturn_t lpuart_int(int irq, void *dev_id)
 {
 	struct lpuart_port *sport = dev_id;
-	unsigned char sts;
+	unsigned char sts, crdma;
 
 	sts = readb(sport->port.membase + UARTSR1);
+	crdma = readb(sport->port.membase + UARTCR5);
 
-	if (sts & UARTSR1_RDRF) {
+	if (sts & UARTSR1_RDRF && !(crdma & UARTCR5_RDMAS)) {
 		if (sport->lpuart_dma_use)
 			lpuart_prepare_rx(sport);
 		else
 			lpuart_rxint(irq, dev_id);
 	}
-	if (sts & UARTSR1_TDRE &&
-		!(readb(sport->port.membase + UARTCR5) & UARTCR5_TDMAS)) {
+	if (sts & UARTSR1_TDRE && !(crdma & UARTCR5_TDMAS)) {
 		if (sport->lpuart_dma_use)
 			lpuart_pio_tx(sport);
 		else
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:913 @ static void lpuart_setup_watermark(struc
 	writeb(val | UARTPFIFO_TXFE | UARTPFIFO_RXFE,
 			sport->port.membase + UARTPFIFO);
 
+	/* explicitly clear RDRF */
+	readb(sport->port.membase + UARTSR1);
+
 	/* flush Tx and Rx FIFO */
 	writeb(UARTCFIFO_TXFLUSH | UARTCFIFO_RXFLUSH,
 			sport->port.membase + UARTCFIFO);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1101 @ static int lpuart_startup(struct uart_po
 	sport->txfifo_size = 0x1 << (((temp >> UARTPFIFO_TXSIZE_OFF) &
 		UARTPFIFO_FIFOSIZE_MASK) + 1);
 
+	sport->port.fifosize = sport->txfifo_size;
+
 	sport->rxfifo_size = 0x1 << (((temp >> UARTPFIFO_RXSIZE_OFF) &
 		UARTPFIFO_FIFOSIZE_MASK) + 1);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1111 @ static int lpuart_startup(struct uart_po
 		sport->lpuart_dma_use = false;
 	} else {
 		sport->lpuart_dma_use = true;
+		setup_timer(&sport->lpuart_timer, lpuart_timer_func,
+			    (unsigned long)sport);
 		temp = readb(port->membase + UARTCR5);
+		temp &= ~UARTCR5_RDMAS;
 		writeb(temp | UARTCR5_TDMAS, port->membase + UARTCR5);
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1188 @ static void lpuart_shutdown(struct uart_
 	devm_free_irq(port->dev, port->irq, sport);
 
 	if (sport->lpuart_dma_use) {
+		del_timer_sync(&sport->lpuart_timer);
+
 		lpuart_dma_tx_free(port);
 		lpuart_dma_rx_free(port);
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/tty/serial/men_z135_uart.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/tty/serial/men_z135_uart.c
+++ linux-3.18.13-rt10-r7s4/drivers/tty/serial/men_z135_uart.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:812 @ static void men_z135_remove(struct mcb_d
 
 static const struct mcb_device_id men_z135_ids[] = {
 	{ .device = 0x87 },
+	{ }
 };
 MODULE_DEVICE_TABLE(mcb, men_z135_ids);
 
Index: linux-3.18.13-rt10-r7s4/drivers/tty/serial/samsung.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/tty/serial/samsung.c
+++ linux-3.18.13-rt10-r7s4/drivers/tty/serial/samsung.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:562 @ static void s3c24xx_serial_pm(struct uar
 			      unsigned int old)
 {
 	struct s3c24xx_uart_port *ourport = to_ourport(port);
+	int timeout = 10000;
 
 	ourport->pm_level = level;
 
 	switch (level) {
 	case 3:
+		while (--timeout && !s3c24xx_serial_txempty_nofifo(port))
+			udelay(100);
+
 		if (!IS_ERR(ourport->baudclk))
 			clk_disable_unprepare(ourport->baudclk);
 
Index: linux-3.18.13-rt10-r7s4/drivers/tty/serial/serial_core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/tty/serial/serial_core.c
+++ linux-3.18.13-rt10-r7s4/drivers/tty/serial/serial_core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2104 @ uart_report_port(struct uart_driver *drv
 		break;
 	}
 
-	dev_info(port->dev, "%s%d at %s (irq = %d, base_baud = %d) is a %s\n",
+	printk(KERN_INFO "%s%s%s%d at %s (irq = %d, base_baud = %d) is a %s\n",
+	       port->dev ? dev_name(port->dev) : "",
+	       port->dev ? ": " : "",
 	       drv->dev_name,
 	       drv->tty_driver->name_base + port->line,
 	       address, port->irq, port->uartclk / 16, uart_type(port));
Index: linux-3.18.13-rt10-r7s4/drivers/tty/tty_io.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/tty/tty_io.c
+++ linux-3.18.13-rt10-r7s4/drivers/tty/tty_io.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:978 @ EXPORT_SYMBOL(start_tty);
 /* We limit tty time update visibility to every 8 seconds or so. */
 static void tty_update_time(struct timespec *time)
 {
-	unsigned long sec = get_seconds() & ~7;
-	if ((long)(sec - time->tv_sec) > 0)
+	unsigned long sec = get_seconds();
+	if (abs(sec - time->tv_sec) & ~7)
 		time->tv_sec = sec;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/tty/tty_ioctl.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/tty/tty_ioctl.c
+++ linux-3.18.13-rt10-r7s4/drivers/tty/tty_ioctl.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:220 @ void tty_wait_until_sent(struct tty_stru
 #endif
 	if (!timeout)
 		timeout = MAX_SCHEDULE_TIMEOUT;
+
 	if (wait_event_interruptible_timeout(tty->write_wait,
-			!tty_chars_in_buffer(tty), timeout) >= 0) {
-		if (tty->ops->wait_until_sent)
-			tty->ops->wait_until_sent(tty, timeout);
+			!tty_chars_in_buffer(tty), timeout) < 0) {
+		return;
 	}
+
+	if (timeout == MAX_SCHEDULE_TIMEOUT)
+		timeout = 0;
+
+	if (tty->ops->wait_until_sent)
+		tty->ops->wait_until_sent(tty, timeout);
 }
 EXPORT_SYMBOL(tty_wait_until_sent);
 
Index: linux-3.18.13-rt10-r7s4/drivers/tty/vt/vt.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/tty/vt/vt.c
+++ linux-3.18.13-rt10-r7s4/drivers/tty/vt/vt.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:501 @ void invert_screen(struct vc_data *vc, i
 #endif
 	if (DO_UPDATE(vc))
 		do_update_region(vc, (unsigned long) p, count);
+	notify_update(vc);
 }
 
 /* used by selection: complement pointer position */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:518 @ void complement_pos(struct vc_data *vc,
 		scr_writew(old, screenpos(vc, old_offset, 1));
 		if (DO_UPDATE(vc))
 			vc->vc_sw->con_putc(vc, old, oldy, oldx);
+		notify_update(vc);
 	}
 
 	old_offset = offset;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:536 @ void complement_pos(struct vc_data *vc,
 			oldy = (offset >> 1) / vc->vc_cols;
 			vc->vc_sw->con_putc(vc, new, oldy, oldx);
 		}
+		notify_update(vc);
 	}
-
 }
 
 static void insert_char(struct vc_data *vc, unsigned int nr)
Index: linux-3.18.13-rt10-r7s4/drivers/usb/chipidea/udc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/chipidea/udc.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/chipidea/udc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:936 @ __acquires(hwep->lock)
 	return retval;
 }
 
+static int otg_a_alt_hnp_support(struct ci_hdrc *ci)
+{
+	dev_warn(&ci->gadget.dev,
+		"connect the device to an alternate port if you want HNP\n");
+	return isr_setup_status_phase(ci);
+}
+
 /**
  * isr_setup_packet_handler: setup packet handler
  * @ci: UDC descriptor
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1075 @ __acquires(ci->lock)
 							ci);
 				}
 				break;
+			case USB_DEVICE_A_ALT_HNP_SUPPORT:
+				if (ci_otg_is_fsm_mode(ci))
+					err = otg_a_alt_hnp_support(ci);
+				break;
 			default:
 				goto delegate;
 			}
Index: linux-3.18.13-rt10-r7s4/drivers/usb/class/cdc-acm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/class/cdc-acm.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/class/cdc-acm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1200 @ next_desc:
 	} else {
 		control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0);
 		data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = union_header->bSlaveInterface0));
-		if (!control_interface || !data_interface) {
-			dev_dbg(&intf->dev, "no interfaces\n");
-			return -ENODEV;
-		}
+	}
+
+	if (!control_interface || !data_interface) {
+		dev_dbg(&intf->dev, "no interfaces\n");
+		return -ENODEV;
 	}
 
 	if (data_interface_num != call_interface_num)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1479 @ alloc_fail8:
 				&dev_attr_wCountryCodes);
 		device_remove_file(&acm->control->dev,
 				&dev_attr_iCountryCodeRelDate);
+		kfree(acm->country_codes);
 	}
 	device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);
 alloc_fail7:
Index: linux-3.18.13-rt10-r7s4/drivers/usb/common/usb-otg-fsm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/common/usb-otg-fsm.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/common/usb-otg-fsm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:153 @ static int otg_set_state(struct otg_fsm
 		break;
 	case OTG_STATE_B_PERIPHERAL:
 		otg_chrg_vbus(fsm, 0);
-		otg_loc_conn(fsm, 1);
 		otg_loc_sof(fsm, 0);
 		otg_set_protocol(fsm, PROTO_GADGET);
+		otg_loc_conn(fsm, 1);
 		break;
 	case OTG_STATE_B_WAIT_ACON:
 		otg_chrg_vbus(fsm, 0);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:216 @ static int otg_set_state(struct otg_fsm
 
 		break;
 	case OTG_STATE_A_PERIPHERAL:
-		otg_loc_conn(fsm, 1);
 		otg_loc_sof(fsm, 0);
 		otg_set_protocol(fsm, PROTO_GADGET);
 		otg_drv_vbus(fsm, 1);
+		otg_loc_conn(fsm, 1);
 		otg_add_timer(fsm, A_BIDL_ADIS);
 		break;
 	case OTG_STATE_A_WAIT_VFALL:
Index: linux-3.18.13-rt10-r7s4/drivers/usb/core/buffer.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/core/buffer.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/core/buffer.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:25 @
  */
 
 /* FIXME tune these based on pool statistics ... */
-static const size_t	pool_max[HCD_BUFFER_POOLS] = {
-	/* platforms without dma-friendly caches might need to
-	 * prevent cacheline sharing...
-	 */
-	32,
-	128,
-	512,
-	PAGE_SIZE / 2
-	/* bigger --> allocate pages */
+static size_t pool_max[HCD_BUFFER_POOLS] = {
+	32, 128, 512, 2048,
 };
 
+void __init usb_init_pool_max(void)
+{
+	/*
+	 * The pool_max values must never be smaller than
+	 * ARCH_KMALLOC_MINALIGN.
+	 */
+	if (ARCH_KMALLOC_MINALIGN <= 32)
+		;			/* Original value is okay */
+	else if (ARCH_KMALLOC_MINALIGN <= 64)
+		pool_max[0] = 64;
+	else if (ARCH_KMALLOC_MINALIGN <= 128)
+		pool_max[0] = 0;	/* Don't use this pool */
+	else
+		BUILD_BUG();		/* We don't allow this */
+}
 
 /* SETUP primitives */
 
Index: linux-3.18.13-rt10-r7s4/drivers/usb/core/devio.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/core/devio.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/core/devio.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:504 @ static void async_completed(struct urb *
 	as->status = urb->status;
 	signr = as->signr;
 	if (signr) {
+		memset(&sinfo, 0, sizeof(sinfo));
 		sinfo.si_signo = as->signr;
 		sinfo.si_errno = as->status;
 		sinfo.si_code = SI_ASYNCIO;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2375 @ static void usbdev_remove(struct usb_dev
 		wake_up_all(&ps->wait);
 		list_del_init(&ps->list);
 		if (ps->discsignr) {
+			memset(&sinfo, 0, sizeof(sinfo));
 			sinfo.si_signo = ps->discsignr;
 			sinfo.si_errno = EPIPE;
 			sinfo.si_code = SI_ASYNCIO;
Index: linux-3.18.13-rt10-r7s4/drivers/usb/core/driver.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/core/driver.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/core/driver.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:278 @ static int usb_unbind_device(struct devi
 	return 0;
 }
 
-/*
- * Cancel any pending scheduled resets
- *
- * [see usb_queue_reset_device()]
- *
- * Called after unconfiguring / when releasing interfaces. See
- * comments in __usb_queue_reset_device() regarding
- * udev->reset_running.
- */
-static void usb_cancel_queued_reset(struct usb_interface *iface)
-{
-	if (iface->reset_running == 0)
-		cancel_work_sync(&iface->reset_ws);
-}
-
 /* called from driver core with dev locked */
 static int usb_probe_interface(struct device *dev)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:368 @ static int usb_probe_interface(struct de
 	usb_set_intfdata(intf, NULL);
 	intf->needs_remote_wakeup = 0;
 	intf->condition = USB_INTERFACE_UNBOUND;
-	usb_cancel_queued_reset(intf);
 
 	/* If the LPM disable succeeded, balance the ref counts. */
 	if (!lpm_disable_error)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:412 @ static int usb_unbind_interface(struct d
 		usb_disable_interface(udev, intf, false);
 
 	driver->disconnect(intf);
-	usb_cancel_queued_reset(intf);
 
 	/* Free streams */
 	for (i = 0, j = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1787 @ static int autosuspend_check(struct usb_
 		dev_dbg(&udev->dev, "remote wakeup needed for autosuspend\n");
 		return -EOPNOTSUPP;
 	}
+
+	/*
+	 * If the device is a direct child of the root hub and the HCD
+	 * doesn't handle wakeup requests, don't allow autosuspend when
+	 * wakeup is needed.
+	 */
+	if (w && udev->parent == udev->bus->root_hub &&
+			bus_to_hcd(udev->bus)->cant_recv_wakeups) {
+		dev_dbg(&udev->dev, "HCD doesn't handle wakeup requests\n");
+		return -EOPNOTSUPP;
+	}
+
 	udev->do_remote_wakeup = w;
 	return 0;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/usb/core/hcd.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/core/hcd.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/core/hcd.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1621 @ static int unlink1(struct usb_hcd *hcd,
 int usb_hcd_unlink_urb (struct urb *urb, int status)
 {
 	struct usb_hcd		*hcd;
+	struct usb_device	*udev = urb->dev;
 	int			retval = -EIDRM;
 	unsigned long		flags;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1633 @ int usb_hcd_unlink_urb (struct urb *urb,
 	spin_lock_irqsave(&hcd_urb_unlink_lock, flags);
 	if (atomic_read(&urb->use_count) > 0) {
 		retval = 0;
-		usb_get_dev(urb->dev);
+		usb_get_dev(udev);
 	}
 	spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags);
 	if (retval == 0) {
 		hcd = bus_to_hcd(urb->dev->bus);
 		retval = unlink1(hcd, urb, status);
-		usb_put_dev(urb->dev);
+		if (retval == 0)
+			retval = -EINPROGRESS;
+		else if (retval != -EIDRM && retval != -EBUSY)
+			dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
+					urb, retval);
+		usb_put_dev(udev);
 	}
-
-	if (retval == 0)
-		retval = -EINPROGRESS;
-	else if (retval != -EIDRM && retval != -EBUSY)
-		dev_dbg(&urb->dev->dev, "hcd_unlink_urb %p fail %d\n",
-				urb, retval);
 	return retval;
 }
 
Index: linux-3.18.13-rt10-r7s4/drivers/usb/core/hub.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/core/hub.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/core/hub.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5594 @ EXPORT_SYMBOL_GPL(usb_reset_device);
  *   possible; depending on how the driver attached to each interface
  *   handles ->pre_reset(), the second reset might happen or not.
  *
- * - If a driver is unbound and it had a pending reset, the reset will
- *   be cancelled.
+ * - If the reset is delayed so long that the interface is unbound from
+ *   its driver, the reset will be skipped.
  *
- * - This function can be called during .probe() or .disconnect()
- *   times. On return from .disconnect(), any pending resets will be
- *   cancelled.
- *
- * There is no no need to lock/unlock the @reset_ws as schedule_work()
- * does its own.
- *
- * NOTE: We don't do any reference count tracking because it is not
- *     needed. The lifecycle of the work_struct is tied to the
- *     usb_interface. Before destroying the interface we cancel the
- *     work_struct, so the fact that work_struct is queued and or
- *     running means the interface (and thus, the device) exist and
- *     are referenced.
+ * - This function can be called during .probe().  It can also be called
+ *   during .disconnect(), but doing so is pointless because the reset
+ *   will not occur.  If you really want to reset the device during
+ *   .disconnect(), call usb_reset_device() directly -- but watch out
+ *   for nested unbinding issues!
  */
 void usb_queue_reset_device(struct usb_interface *iface)
 {
-	schedule_work(&iface->reset_ws);
+	if (schedule_work(&iface->reset_ws))
+		usb_get_intf(iface);
 }
 EXPORT_SYMBOL_GPL(usb_queue_reset_device);
 
Index: linux-3.18.13-rt10-r7s4/drivers/usb/core/message.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/core/message.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/core/message.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1554 @ static void usb_release_interface(struct
 			altsetting_to_usb_interface_cache(intf->altsetting);
 
 	kref_put(&intfc->ref, usb_release_interface_cache);
+	usb_put_dev(interface_to_usbdev(intf));
 	kfree(intf);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1630 @ static struct usb_interface_assoc_descri
 
 /*
  * Internal function to queue a device reset
- *
- * This is initialized into the workstruct in 'struct
- * usb_device->reset_ws' that is launched by
- * message.c:usb_set_configuration() when initializing each 'struct
- * usb_interface'.
- *
- * It is safe to get the USB device without reference counts because
- * the life cycle of @iface is bound to the life cycle of @udev. Then,
- * this function will be ran only if @iface is alive (and before
- * freeing it any scheduled instances of it will have been cancelled).
- *
- * We need to set a flag (usb_dev->reset_running) because when we call
- * the reset, the interfaces might be unbound. The current interface
- * cannot try to remove the queued work as it would cause a deadlock
- * (you cannot remove your work from within your executing
- * workqueue). This flag lets it know, so that
- * usb_cancel_queued_reset() doesn't try to do it.
- *
  * See usb_queue_reset_device() for more details
  */
 static void __usb_queue_reset_device(struct work_struct *ws)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1641 @ static void __usb_queue_reset_device(str
 
 	rc = usb_lock_device_for_reset(udev, iface);
 	if (rc >= 0) {
-		iface->reset_running = 1;
 		usb_reset_device(udev);
-		iface->reset_running = 0;
 		usb_unlock_device(udev);
 	}
+	usb_put_intf(iface);	/* Undo _get_ in usb_queue_reset_device() */
 }
 
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1839 @ free_interfaces:
 		dev_set_name(&intf->dev, "%d-%s:%d.%d",
 			dev->bus->busnum, dev->devpath,
 			configuration, alt->desc.bInterfaceNumber);
+		usb_get_dev(dev);
 	}
 	kfree(new_interfaces);
 
Index: linux-3.18.13-rt10-r7s4/drivers/usb/core/otg_whitelist.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/core/otg_whitelist.h
+++ linux-3.18.13-rt10-r7s4/drivers/usb/core/otg_whitelist.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:58 @ static int is_targeted(struct usb_device
 	     le16_to_cpu(dev->descriptor.idProduct) == 0xbadd))
 		return 0;
 
+	/* OTG PET device is always targeted (see OTG 2.0 ECN 6.4.2) */
+	if ((le16_to_cpu(dev->descriptor.idVendor) == 0x1a0a &&
+	     le16_to_cpu(dev->descriptor.idProduct) == 0x0200))
+		return 1;
+
 	/* NOTE: can't use usb_match_id() since interface caches
 	 * aren't set up yet. this is cut/paste from that code.
 	 */
Index: linux-3.18.13-rt10-r7s4/drivers/usb/core/quirks.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/core/quirks.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/core/quirks.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:106 @ static const struct usb_device_id usb_qu
 	{ USB_DEVICE(0x04f3, 0x009b), .driver_info =
 			USB_QUIRK_DEVICE_QUALIFIER },
 
+	{ USB_DEVICE(0x04f3, 0x010c), .driver_info =
+			USB_QUIRK_DEVICE_QUALIFIER },
+
 	{ USB_DEVICE(0x04f3, 0x016f), .driver_info =
 			USB_QUIRK_DEVICE_QUALIFIER },
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:182 @ static const struct usb_device_id usb_qu
 	{ USB_DEVICE(0x0b05, 0x17e0), .driver_info =
 			USB_QUIRK_IGNORE_REMOTE_WAKEUP },
 
+	/* Protocol and OTG Electrical Test Device */
+	{ USB_DEVICE(0x1a0a, 0x0200), .driver_info =
+			USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+
 	{ }  /* terminating entry must be last */
 };
 
Index: linux-3.18.13-rt10-r7s4/drivers/usb/core/usb.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/core/usb.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/core/usb.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1054 @ static int __init usb_init(void)
 		pr_info("%s: USB support disabled\n", usbcore_name);
 		return 0;
 	}
+	usb_init_pool_max();
 
 	retval = usb_debugfs_init();
 	if (retval)
Index: linux-3.18.13-rt10-r7s4/drivers/usb/dwc3/dwc3-omap.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/dwc3/dwc3-omap.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/dwc3/dwc3-omap.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:208 @ static void dwc3_omap_write_irq0_set(str
 						omap->irq0_offset, value);
 }
 
+static void dwc3_omap_write_irqmisc_clr(struct dwc3_omap *omap, u32 value)
+{
+	dwc3_omap_writel(omap->base, USBOTGSS_IRQENABLE_CLR_MISC +
+						omap->irqmisc_offset, value);
+}
+
+static void dwc3_omap_write_irq0_clr(struct dwc3_omap *omap, u32 value)
+{
+	dwc3_omap_writel(omap->base, USBOTGSS_IRQENABLE_CLR_0 -
+						omap->irq0_offset, value);
+}
+
 static void dwc3_omap_set_mailbox(struct dwc3_omap *omap,
 	enum omap_dwc3_vbus_id_status status)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:360 @ static void dwc3_omap_enable_irqs(struct
 
 static void dwc3_omap_disable_irqs(struct dwc3_omap *omap)
 {
+	u32			reg;
+
 	/* disable all IRQs */
-	dwc3_omap_write_irqmisc_set(omap, 0x00);
-	dwc3_omap_write_irq0_set(omap, 0x00);
+	reg = USBOTGSS_IRQO_COREIRQ_ST;
+	dwc3_omap_write_irq0_clr(omap, reg);
+
+	reg = (USBOTGSS_IRQMISC_OEVT |
+			USBOTGSS_IRQMISC_DRVVBUS_RISE |
+			USBOTGSS_IRQMISC_CHRGVBUS_RISE |
+			USBOTGSS_IRQMISC_DISCHRGVBUS_RISE |
+			USBOTGSS_IRQMISC_IDPULLUP_RISE |
+			USBOTGSS_IRQMISC_DRVVBUS_FALL |
+			USBOTGSS_IRQMISC_CHRGVBUS_FALL |
+			USBOTGSS_IRQMISC_DISCHRGVBUS_FALL |
+			USBOTGSS_IRQMISC_IDPULLUP_FALL);
+
+	dwc3_omap_write_irqmisc_clr(omap, reg);
 }
 
 static u64 dwc3_omap_dma_mask = DMA_BIT_MASK(32);
Index: linux-3.18.13-rt10-r7s4/drivers/usb/dwc3/gadget.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/dwc3/gadget.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/dwc3/gadget.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:885 @ static void dwc3_prepare_trbs(struct dwc
 
 				if (i == (request->num_mapped_sgs - 1) ||
 						sg_is_last(s)) {
-					if (list_is_last(&req->list,
-							&dep->request_list))
+					if (list_empty(&dep->request_list))
 						last_one = true;
 					chain = false;
 				}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:903 @ static void dwc3_prepare_trbs(struct dwc
 				if (last_one)
 					break;
 			}
+
+			if (last_one)
+				break;
 		} else {
 			dma = req->request.dma;
 			length = req->request.length;
Index: linux-3.18.13-rt10-r7s4/drivers/usb/gadget/configfs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/gadget/configfs.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/gadget/configfs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1164 @ static ssize_t interf_grp_compatible_id_
 	if (desc->opts_mutex)
 		mutex_lock(desc->opts_mutex);
 	memcpy(desc->ext_compat_id, page, l);
-	desc->ext_compat_id[l] = '\0';
 
 	if (desc->opts_mutex)
 		mutex_unlock(desc->opts_mutex);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1194 @ static ssize_t interf_grp_sub_compatible
 	if (desc->opts_mutex)
 		mutex_lock(desc->opts_mutex);
 	memcpy(desc->ext_compat_id + 8, page, l);
-	desc->ext_compat_id[l + 8] = '\0';
 
 	if (desc->opts_mutex)
 		mutex_unlock(desc->opts_mutex);
Index: linux-3.18.13-rt10-r7s4/drivers/usb/gadget/legacy/inode.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/gadget/legacy/inode.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/gadget/legacy/inode.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:452 @ ep_write (struct file *fd, const char __
 		data->name, len, (int) value);
 free1:
 	mutex_unlock(&data->lock);
+	kfree (kbuf);
 	return value;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:568 @ static ssize_t ep_copy_to_user(struct ki
 		if (total == 0)
 			break;
 	}
-
 	return len;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:586 @ static void ep_user_copy_worker(struct w
 	aio_complete(iocb, ret, ret);
 
 	kfree(priv->buf);
+	kfree(priv->iv);
 	kfree(priv);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:607 @ static void ep_aio_complete(struct usb_e
 	 */
 	if (priv->iv == NULL || unlikely(req->actual == 0)) {
 		kfree(req->buf);
+		kfree(priv->iv);
 		kfree(priv);
 		iocb->private = NULL;
 		/* aio_complete() reports bytes-transferred _and_ faults */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:643 @ ep_aio_rwtail(
 	struct usb_request	*req;
 	ssize_t			value;
 
-	priv = kmalloc(sizeof *priv, GFP_KERNEL);
+	priv = kzalloc(sizeof *priv, GFP_KERNEL);
 	if (!priv) {
 		value = -ENOMEM;
 fail:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:652 @ fail:
 	}
 	iocb->private = priv;
 	priv->iocb = iocb;
-	priv->iv = iv;
+	if (iv) {
+		priv->iv = kmemdup(iv, nr_segs * sizeof(struct iovec),
+				   GFP_KERNEL);
+		if (!priv->iv) {
+			kfree(priv);
+			goto fail;
+		}
+	}
 	priv->nr_segs = nr_segs;
 	INIT_WORK(&priv->work, ep_user_copy_worker);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:699 @ fail:
 	mutex_unlock(&epdata->lock);
 
 	if (unlikely(value)) {
+		kfree(priv->iv);
 		kfree(priv);
 		put_ep(epdata);
 	} else
Index: linux-3.18.13-rt10-r7s4/drivers/usb/gadget/udc/at91_udc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/gadget/udc/at91_udc.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/gadget/udc/at91_udc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:873 @ static void clk_on(struct at91_udc *udc)
 		return;
 	udc->clocked = 1;
 
-	if (IS_ENABLED(CONFIG_COMMON_CLK)) {
-		clk_set_rate(udc->uclk, 48000000);
-		clk_prepare_enable(udc->uclk);
-	}
-	clk_prepare_enable(udc->iclk);
-	clk_prepare_enable(udc->fclk);
+	if (IS_ENABLED(CONFIG_COMMON_CLK))
+		clk_enable(udc->uclk);
+	clk_enable(udc->iclk);
+	clk_enable(udc->fclk);
 }
 
 static void clk_off(struct at91_udc *udc)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:885 @ static void clk_off(struct at91_udc *udc
 		return;
 	udc->clocked = 0;
 	udc->gadget.speed = USB_SPEED_UNKNOWN;
-	clk_disable_unprepare(udc->fclk);
-	clk_disable_unprepare(udc->iclk);
+	clk_disable(udc->fclk);
+	clk_disable(udc->iclk);
 	if (IS_ENABLED(CONFIG_COMMON_CLK))
-		clk_disable_unprepare(udc->uclk);
+		clk_disable(udc->uclk);
 }
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1772 @ static int at91udc_probe(struct platform
 	}
 
 	/* don't do anything until we have both gadget driver and VBUS */
+	if (IS_ENABLED(CONFIG_COMMON_CLK)) {
+		clk_set_rate(udc->uclk, 48000000);
+		retval = clk_prepare(udc->uclk);
+		if (retval)
+			goto fail1;
+	}
+	retval = clk_prepare(udc->fclk);
+	if (retval)
+		goto fail1a;
+
 	retval = clk_prepare_enable(udc->iclk);
 	if (retval)
-		goto fail1;
+		goto fail1b;
 	at91_udp_write(udc, AT91_UDP_TXVC, AT91_UDP_TXVC_TXVDIS);
 	at91_udp_write(udc, AT91_UDP_IDR, 0xffffffff);
 	/* Clear all pending interrupts - UDP may be used by bootloader. */
 	at91_udp_write(udc, AT91_UDP_ICR, 0xffffffff);
-	clk_disable_unprepare(udc->iclk);
+	clk_disable(udc->iclk);
 
 	/* request UDC and maybe VBUS irqs */
 	udc->udp_irq = platform_get_irq(pdev, 0);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1797 @ static int at91udc_probe(struct platform
 			0, driver_name, udc);
 	if (retval < 0) {
 		DBG("request irq %d failed\n", udc->udp_irq);
-		goto fail1;
+		goto fail1c;
 	}
 	if (gpio_is_valid(udc->board.vbus_pin)) {
 		retval = gpio_request(udc->board.vbus_pin, "udc_vbus");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1850 @ fail3:
 		gpio_free(udc->board.vbus_pin);
 fail2:
 	free_irq(udc->udp_irq, udc);
+fail1c:
+	clk_unprepare(udc->iclk);
+fail1b:
+	clk_unprepare(udc->fclk);
+fail1a:
+	if (IS_ENABLED(CONFIG_COMMON_CLK))
+		clk_unprepare(udc->uclk);
 fail1:
 	if (IS_ENABLED(CONFIG_COMMON_CLK) && !IS_ERR(udc->uclk))
 		clk_put(udc->uclk);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1905 @ static int __exit at91udc_remove(struct
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	release_mem_region(res->start, resource_size(res));
 
+	if (IS_ENABLED(CONFIG_COMMON_CLK))
+		clk_unprepare(udc->uclk);
+	clk_unprepare(udc->fclk);
+	clk_unprepare(udc->iclk);
+
 	clk_put(udc->iclk);
 	clk_put(udc->fclk);
 	if (IS_ENABLED(CONFIG_COMMON_CLK))
Index: linux-3.18.13-rt10-r7s4/drivers/usb/host/ehci-sched.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/host/ehci-sched.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/host/ehci-sched.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1584 @ iso_stream_schedule (
 	else
 		next = (now + 2 + 7) & ~0x07;	/* full frame cache */
 
+	/* If needed, initialize last_iso_frame so that this URB will be seen */
+	if (ehci->isoc_count == 0)
+		ehci->last_iso_frame = now >> 3;
+
 	/*
 	 * Use ehci->last_iso_frame as the base.  There can't be any
 	 * TDs scheduled for earlier than that.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1678 @ iso_stream_schedule (
 	urb->start_frame = start & (mod - 1);
 	if (!stream->highspeed)
 		urb->start_frame >>= 3;
-
-	/* Make sure scan_isoc() sees these */
-	if (ehci->isoc_count == 0)
-		ehci->last_iso_frame = now >> 3;
 	return status;
 
  fail:
Index: linux-3.18.13-rt10-r7s4/drivers/usb/host/isp1760-hcd.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/host/isp1760-hcd.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/host/isp1760-hcd.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2250 @ struct usb_hcd *isp1760_register(phys_ad
 	hcd->rsrc_start = res_start;
 	hcd->rsrc_len = res_len;
 
+	/* This driver doesn't support wakeup requests */
+	hcd->cant_recv_wakeups = 1;
+
 	ret = usb_add_hcd(hcd, irq, irqflags);
 	if (ret)
 		goto err_unmap;
Index: linux-3.18.13-rt10-r7s4/drivers/usb/host/pci-quirks.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/host/pci-quirks.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/host/pci-quirks.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:574 @ static void quirk_usb_handoff_ohci(struc
 {
 	void __iomem *base;
 	u32 control;
-	u32 fminterval;
+	u32 fminterval = 0;
+	bool no_fminterval = false;
 	int cnt;
 
 	if (!mmio_resource_enabled(pdev, 0))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:585 @ static void quirk_usb_handoff_ohci(struc
 	if (base == NULL)
 		return;
 
+	/*
+	 * ULi M5237 OHCI controller locks the whole system when accessing
+	 * the OHCI_FMINTERVAL offset.
+	 */
+	if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237)
+		no_fminterval = true;
+
 	control = readl(base + OHCI_CONTROL);
 
 /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:630 @ static void quirk_usb_handoff_ohci(struc
 	}
 
 	/* software reset of the controller, preserving HcFmInterval */
-	fminterval = readl(base + OHCI_FMINTERVAL);
+	if (!no_fminterval)
+		fminterval = readl(base + OHCI_FMINTERVAL);
+
 	writel(OHCI_HCR, base + OHCI_CMDSTATUS);
 
 	/* reset requires max 10 us delay */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:641 @ static void quirk_usb_handoff_ohci(struc
 			break;
 		udelay(1);
 	}
-	writel(fminterval, base + OHCI_FMINTERVAL);
+
+	if (!no_fminterval)
+		writel(fminterval, base + OHCI_FMINTERVAL);
 
 	/* Now the controller is safely in SUSPEND and nothing can wake it up */
 	iounmap(base);
Index: linux-3.18.13-rt10-r7s4/drivers/usb/host/xhci-hub.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/host/xhci-hub.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/host/xhci-hub.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:390 @ static void xhci_clear_port_change_bit(s
 		status = PORT_PLC;
 		port_change_bit = "link state";
 		break;
+	case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
+		status = PORT_CEC;
+		port_change_bit = "config error";
+		break;
 	default:
 		/* Should never happen */
 		return;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:595 @ static u32 xhci_get_port_status(struct u
 			status |= USB_PORT_STAT_C_LINK_STATE << 16;
 		if ((raw_port_status & PORT_WRC))
 			status |= USB_PORT_STAT_C_BH_RESET << 16;
+		if ((raw_port_status & PORT_CEC))
+			status |= USB_PORT_STAT_C_CONFIG_ERROR << 16;
 	}
 
 	if (hcd->speed != HCD_USB3) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1014 @ int xhci_hub_control(struct usb_hcd *hcd
 		case USB_PORT_FEAT_C_OVER_CURRENT:
 		case USB_PORT_FEAT_C_ENABLE:
 		case USB_PORT_FEAT_C_PORT_LINK_STATE:
+		case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
 			xhci_clear_port_change_bit(xhci, wValue, wIndex,
 					port_array[wIndex], temp);
 			break;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1079 @ int xhci_hub_status_data(struct usb_hcd
 	 */
 	status = bus_state->resuming_ports;
 
-	mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC;
+	mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC;
 
 	spin_lock_irqsave(&xhci->lock, flags);
 	/* For each port, did anything change?  If so, set that bit in buf. */
Index: linux-3.18.13-rt10-r7s4/drivers/usb/host/xhci-pci.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/host/xhci-pci.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/host/xhci-pci.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:40 @
 
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI	0x8c31
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI	0x9c31
+#define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI		0x22b5
+#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI		0xa12f
+#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI	0x9d2f
 
 static const char hcd_name[] = "xhci_hcd";
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:88 @ static void xhci_pci_quirks(struct devic
 				"must be suspended extra slowly",
 				pdev->revision);
 		}
+		if (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK)
+			xhci->quirks |= XHCI_BROKEN_STREAMS;
 		/* Fresco Logic confirms: all revisions of this chip do not
 		 * support MSI, even though some of them claim to in their PCI
 		 * capabilities.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:118 @ static void xhci_pci_quirks(struct devic
 	if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
 		xhci->quirks |= XHCI_LPM_SUPPORT;
 		xhci->quirks |= XHCI_INTEL_HOST;
+		xhci->quirks |= XHCI_AVOID_BEI;
 	}
 	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
 			pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:134 @ static void xhci_pci_quirks(struct devic
 		 * PPT chipsets.
 		 */
 		xhci->quirks |= XHCI_SPURIOUS_REBOOT;
-		xhci->quirks |= XHCI_AVOID_BEI;
 	}
 	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
 		pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
 		xhci->quirks |= XHCI_SPURIOUS_REBOOT;
 	}
+	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+		(pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
+		 pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
+		 pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)) {
+		xhci->quirks |= XHCI_PME_STUCK_QUIRK;
+	}
 	if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
 			pdev->device == PCI_DEVICE_ID_EJ168) {
 		xhci->quirks |= XHCI_RESET_ON_RESUME;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:171 @ static void xhci_pci_quirks(struct devic
 				"QUIRK: Resetting on resume");
 }
 
+/*
+ * Make sure PME works on some Intel xHCI controllers by writing 1 to clear
+ * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4
+ */
+static void xhci_pme_quirk(struct xhci_hcd *xhci)
+{
+	u32 val;
+	void __iomem *reg;
+
+	reg = (void __iomem *) xhci->cap_regs + 0x80a4;
+	val = readl(reg);
+	writel(val | BIT(28), reg);
+	readl(reg);
+}
+
 /* called during probe() after chip reset completes */
 static int xhci_pci_setup(struct usb_hcd *hcd)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:310 @ static int xhci_pci_suspend(struct usb_h
 	if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
 		pdev->no_d3cold = true;
 
+	if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+		xhci_pme_quirk(xhci);
+
 	return xhci_suspend(xhci, do_wakeup);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:343 @ static int xhci_pci_resume(struct usb_hc
 	if (pdev->vendor == PCI_VENDOR_ID_INTEL)
 		usb_enable_intel_xhci_ports(pdev);
 
+	if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+		xhci_pme_quirk(xhci);
+
 	retval = xhci_resume(xhci, hibernated);
 	return retval;
 }
Index: linux-3.18.13-rt10-r7s4/drivers/usb/host/xhci-plat.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/host/xhci-plat.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/host/xhci-plat.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:90 @ static int xhci_plat_probe(struct platfo
 	if (!res)
 		return -ENODEV;
 
-	if (of_device_is_compatible(pdev->dev.of_node,
-				    "marvell,armada-375-xhci") ||
-	    of_device_is_compatible(pdev->dev.of_node,
-				    "marvell,armada-380-xhci")) {
-		ret = xhci_mvebu_mbus_init_quirk(pdev);
-		if (ret)
-			return ret;
-	}
-
 	/* Initialize dma_mask and coherent_dma_mask to 32-bits */
 	ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
 	if (ret)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:123 @ static int xhci_plat_probe(struct platfo
 			goto put_hcd;
 	}
 
+	if (of_device_is_compatible(pdev->dev.of_node,
+				    "marvell,armada-375-xhci") ||
+	    of_device_is_compatible(pdev->dev.of_node,
+				    "marvell,armada-380-xhci")) {
+		ret = xhci_mvebu_mbus_init_quirk(pdev);
+		if (ret)
+			goto disable_clk;
+	}
+
 	ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
 	if (ret)
 		goto disable_clk;
Index: linux-3.18.13-rt10-r7s4/drivers/usb/host/xhci-ring.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/host/xhci-ring.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/host/xhci-ring.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1960 @ static int process_ctrl_td(struct xhci_h
 	if (event_trb != ep_ring->dequeue) {
 		/* The event was for the status stage */
 		if (event_trb == td->last_trb) {
-			if (td->urb->actual_length != 0) {
+			if (td->urb_length_set) {
 				/* Don't overwrite a previously set error code
 				 */
 				if ((*status == -EINPROGRESS || *status == 0) &&
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1974 @ static int process_ctrl_td(struct xhci_h
 					td->urb->transfer_buffer_length;
 			}
 		} else {
-		/* Maybe the event was for the data stage? */
+			/*
+			 * Maybe the event was for the data stage? If so, update
+			 * already the actual_length of the URB and flag it as
+			 * set, so that it is not overwritten in the event for
+			 * the last TRB.
+			 */
+			td->urb_length_set = true;
 			td->urb->actual_length =
 				td->urb->transfer_buffer_length -
 				EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
Index: linux-3.18.13-rt10-r7s4/drivers/usb/host/xhci.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/host/xhci.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/host/xhci.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3806 @ static int xhci_setup_device(struct usb_
 		return -EINVAL;
 	}
 
+	if (setup == SETUP_CONTEXT_ONLY) {
+		slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx);
+		if (GET_SLOT_STATE(le32_to_cpu(slot_ctx->dev_state)) ==
+		    SLOT_STATE_DEFAULT) {
+			xhci_dbg(xhci, "Slot already in default state\n");
+			return 0;
+		}
+	}
+
 	command = xhci_alloc_command(xhci, false, false, GFP_KERNEL);
 	if (!command)
 		return -ENOMEM;
Index: linux-3.18.13-rt10-r7s4/drivers/usb/host/xhci.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/host/xhci.h
+++ linux-3.18.13-rt10-r7s4/drivers/usb/host/xhci.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1 @
+
 /*
  * xHCI host controller driver
  *
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:92 @ struct xhci_cap_regs {
 #define HCS_IST(p)		(((p) >> 0) & 0xf)
 /* bits 4:7, max number of Event Ring segments */
 #define HCS_ERST_MAX(p)		(((p) >> 4) & 0xf)
+/* bits 21:25 Hi 5 bits of Scratchpad buffers SW must allocate for the HW */
 /* bit 26 Scratchpad restore - for save/restore HW state - not used yet */
-/* bits 27:31 number of Scratchpad buffers SW must allocate for the HW */
-#define HCS_MAX_SCRATCHPAD(p)   (((p) >> 27) & 0x1f)
+/* bits 27:31 Lo 5 bits of Scratchpad buffers SW must allocate for the HW */
+#define HCS_MAX_SCRATCHPAD(p)   ((((p) >> 16) & 0x3e0) | (((p) >> 27) & 0x1f))
 
 /* HCSPARAMS3 - hcs_params3 - bitmasks */
 /* bits 0:7, Max U1 to U0 latency for the roothub ports */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1293 @ struct xhci_td {
 	struct xhci_segment	*start_seg;
 	union xhci_trb		*first_trb;
 	union xhci_trb		*last_trb;
+	/* actual_length of the URB has already been set */
+	bool			urb_length_set;
 };
 
 /* xHCI command default timeout value */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1567 @ struct xhci_hcd {
 #define XHCI_SPURIOUS_WAKEUP	(1 << 18)
 /* For controllers with a broken beyond repair streams implementation */
 #define XHCI_BROKEN_STREAMS	(1 << 19)
+#define XHCI_PME_STUCK_QUIRK	(1 << 20)
 	unsigned int		num_active_eps;
 	unsigned int		limit_active_eps;
 	/* There are two roothubs to keep track of bus suspend info for */
Index: linux-3.18.13-rt10-r7s4/drivers/usb/musb/musb_host.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/musb/musb_host.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/musb/musb_host.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2666 @ void musb_host_cleanup(struct musb *musb
 	if (musb->port_mode == MUSB_PORT_MODE_GADGET)
 		return;
 	usb_remove_hcd(musb->hcd);
-	musb->hcd = NULL;
 }
 
 void musb_host_free(struct musb *musb)
Index: linux-3.18.13-rt10-r7s4/drivers/usb/phy/phy-am335x-control.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/phy/phy-am335x-control.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/phy/phy-am335x-control.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:129 @ struct phy_control *am335x_get_phy_contr
 		return NULL;
 
 	dev = bus_find_device(&platform_bus_type, NULL, node, match);
+	if (!dev)
+		return NULL;
+
 	ctrl_usb = dev_get_drvdata(dev);
 	if (!ctrl_usb)
 		return NULL;
Index: linux-3.18.13-rt10-r7s4/drivers/usb/renesas_usbhs/mod_gadget.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/renesas_usbhs/mod_gadget.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/renesas_usbhs/mod_gadget.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:605 @ static int usbhsg_ep_disable(struct usb_
 	struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
 	struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
 
+	if (!pipe)
+		return -EINVAL;
+
 	usbhsg_pipe_disable(uep);
 	usbhs_pipe_free(pipe);
 
Index: linux-3.18.13-rt10-r7s4/drivers/usb/serial/bus.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/serial/bus.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/serial/bus.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:54 @ static int usb_serial_device_probe(struc
 {
 	struct usb_serial_driver *driver;
 	struct usb_serial_port *port;
+	struct device *tty_dev;
 	int retval = 0;
 	int minor;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:79 @ static int usb_serial_device_probe(struc
 	retval = device_create_file(dev, &dev_attr_port_number);
 	if (retval) {
 		if (driver->port_remove)
-			retval = driver->port_remove(port);
+			driver->port_remove(port);
 		goto exit_with_autopm;
 	}
 
 	minor = port->minor;
-	tty_register_device(usb_serial_tty_driver, minor, dev);
+	tty_dev = tty_register_device(usb_serial_tty_driver, minor, dev);
+	if (IS_ERR(tty_dev)) {
+		retval = PTR_ERR(tty_dev);
+		device_remove_file(dev, &dev_attr_port_number);
+		if (driver->port_remove)
+			driver->port_remove(port);
+		goto exit_with_autopm;
+	}
+
 	dev_info(&port->serial->dev->dev,
 		 "%s converter now attached to ttyUSB%d\n",
 		 driver->description, minor);
Index: linux-3.18.13-rt10-r7s4/drivers/usb/serial/console.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/serial/console.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/serial/console.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:49 @ static struct console usbcons;
  * ------------------------------------------------------------
  */
 
+static const struct tty_operations usb_console_fake_tty_ops = {
+};
 
 /*
  * The parsing of the command line works exactly like the
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:142 @ static int usb_console_setup(struct cons
 				goto reset_open_count;
 			}
 			kref_init(&tty->kref);
-			tty_port_tty_set(&port->port, tty);
 			tty->driver = usb_serial_tty_driver;
 			tty->index = co->index;
+			init_ldsem(&tty->ldisc_sem);
+			INIT_LIST_HEAD(&tty->tty_files);
+			kref_get(&tty->driver->kref);
+			tty->ops = &usb_console_fake_tty_ops;
 			if (tty_init_termios(tty)) {
 				retval = -ENOMEM;
-				goto free_tty;
+				goto put_tty;
 			}
+			tty_port_tty_set(&port->port, tty);
 		}
 
 		/* only call the device specific open if this
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:170 @ static int usb_console_setup(struct cons
 			serial->type->set_termios(tty, port, &dummy);
 
 			tty_port_tty_set(&port->port, NULL);
-			kfree(tty);
+			tty_kref_put(tty);
 		}
 		set_bit(ASYNCB_INITIALIZED, &port->port.flags);
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:186 @ static int usb_console_setup(struct cons
 
  fail:
 	tty_port_tty_set(&port->port, NULL);
- free_tty:
-	kfree(tty);
+ put_tty:
+	tty_kref_put(tty);
  reset_open_count:
 	port->port.count = 0;
 	usb_autopm_put_interface(serial->interface);
Index: linux-3.18.13-rt10-r7s4/drivers/usb/serial/cp210x.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/serial/cp210x.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/serial/cp210x.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:59 @ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
 	{ USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
 	{ USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
+	{ USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */
 	{ USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
 	{ USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */
 	{ USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:124 @ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
 	{ USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
 	{ USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
-	{ USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */
+	{ USB_DEVICE(0x10C4, 0x8856) },	/* CEL EM357 ZigBee USB Stick - LR */
+	{ USB_DEVICE(0x10C4, 0x8857) },	/* CEL EM357 ZigBee USB Stick */
 	{ USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
 	{ USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
 	{ USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
+	{ USB_DEVICE(0x10C4, 0x8977) },	/* CEL MeshWorks DevKit Device */
 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
 	{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
 	{ USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:150 @ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */
 	{ USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */
 	{ USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */
+	{ USB_DEVICE(0x16C0, 0x09B0) }, /* Lunatico Seletek */
+	{ USB_DEVICE(0x16C0, 0x09B1) }, /* Lunatico Seletek */
 	{ USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
 	{ USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */
 	{ USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
Index: linux-3.18.13-rt10-r7s4/drivers/usb/serial/ftdi_sio.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/serial/ftdi_sio.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/serial/ftdi_sio.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:607 @ static const struct usb_device_id id_tab
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
 	{ USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
 	/*
 	 * ELV devices:
 	 */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:803 @ static const struct usb_device_id id_tab
 	{ USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
+	{ USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID),
+		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
 	{ USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
 	{ USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:984 @ static const struct usb_device_id id_tab
 	{ USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
 	/* GE Healthcare devices */
 	{ USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
+	/* Active Research (Actisense) devices */
+	{ USB_DEVICE(FTDI_VID, ACTISENSE_NDC_PID) },
+	{ USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) },
+	{ USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) },
+	{ USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) },
+	{ USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) },
+	{ USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) },
+	{ USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) },
+	{ USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) },
+	{ USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) },
+	{ USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) },
+	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_NMEA2000_PID) },
+	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ETHERNET_PID) },
+	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_WIFI_PID) },
+	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
+	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
+	{ USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
 	{ }					/* Terminating entry */
 };
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1887 @ static int ftdi_8u2232c_probe(struct usb
 {
 	struct usb_device *udev = serial->dev;
 
-	if ((udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) ||
-	    (udev->product && !strcmp(udev->product, "BeagleBone/XDS100V2")))
+	if (udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems"))
+		return ftdi_jtag_probe(serial);
+
+	if (udev->product &&
+		(!strcmp(udev->product, "BeagleBone/XDS100V2") ||
+		 !strcmp(udev->product, "SNAP Connect E10")))
 		return ftdi_jtag_probe(serial);
 
 	return 0;
Index: linux-3.18.13-rt10-r7s4/drivers/usb/serial/ftdi_sio_ids.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/serial/ftdi_sio_ids.h
+++ linux-3.18.13-rt10-r7s4/drivers/usb/serial/ftdi_sio_ids.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:41 @
 
 #define FTDI_LUMEL_PD12_PID	0x6002
 
+/* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */
+#define CYBER_CORTEX_AV_PID	0x8698
+
 /*
  * Marvell OpenRD Base, Client
  * http://www.open-rd.org
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:564 @
  */
 #define FTDI_NT_ORIONLXM_PID	0x7c90	/* OrionLXm Substation Automation Platform */
 
+/*
+ * Synapse Wireless product ids (FTDI_VID)
+ * http://www.synapse-wireless.com
+ */
+#define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
+
 
 /********************************/
 /** third-party VID/PID combos **/
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1450 @
  */
 #define GE_HEALTHCARE_VID		0x1901
 #define GE_HEALTHCARE_NEMO_TRACKER_PID	0x0015
+
+/*
+ * Active Research (Actisense) devices
+ */
+#define ACTISENSE_NDC_PID		0xD9A8 /* NDC USB Serial Adapter */
+#define ACTISENSE_USG_PID		0xD9A9 /* USG USB Serial Adapter */
+#define ACTISENSE_NGT_PID		0xD9AA /* NGT NMEA2000 Interface */
+#define ACTISENSE_NGW_PID		0xD9AB /* NGW NMEA2000 Gateway */
+#define ACTISENSE_D9AC_PID		0xD9AC /* Actisense Reserved */
+#define ACTISENSE_D9AD_PID		0xD9AD /* Actisense Reserved */
+#define ACTISENSE_D9AE_PID		0xD9AE /* Actisense Reserved */
+#define ACTISENSE_D9AF_PID		0xD9AF /* Actisense Reserved */
+#define CHETCO_SEAGAUGE_PID		0xA548 /* SeaGauge USB Adapter */
+#define CHETCO_SEASWITCH_PID		0xA549 /* SeaSwitch USB Adapter */
+#define CHETCO_SEASMART_NMEA2000_PID	0xA54A /* SeaSmart NMEA2000 Gateway */
+#define CHETCO_SEASMART_ETHERNET_PID	0xA54B /* SeaSmart Ethernet Gateway */
+#define CHETCO_SEASMART_WIFI_PID	0xA5AC /* SeaSmart Wifi Gateway */
+#define CHETCO_SEASMART_DISPLAY_PID	0xA5AD /* SeaSmart NMEA2000 Display */
+#define CHETCO_SEASMART_LITE_PID	0xA5AE /* SeaSmart Lite USB Adapter */
+#define CHETCO_SEASMART_ANALOG_PID	0xA5AF /* SeaSmart Analog Adapter */
Index: linux-3.18.13-rt10-r7s4/drivers/usb/serial/generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/serial/generic.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/serial/generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:261 @ void usb_serial_generic_wait_until_sent(
 	 * character or at least one jiffy.
 	 */
 	period = max_t(unsigned long, (10 * HZ / bps), 1);
-	period = min_t(unsigned long, period, timeout);
+	if (timeout)
+		period = min_t(unsigned long, period, timeout);
 
 	dev_dbg(&port->dev, "%s - timeout = %u ms, period = %u ms\n",
 					__func__, jiffies_to_msecs(timeout),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:272 @ void usb_serial_generic_wait_until_sent(
 		schedule_timeout_interruptible(period);
 		if (signal_pending(current))
 			break;
-		if (time_after(jiffies, expire))
+		if (timeout && time_after(jiffies, expire))
 			break;
 	}
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:377 @ void usb_serial_generic_read_bulk_callba
 							__func__, urb->status);
 		return;
 	default:
-		dev_err(&port->dev, "%s - nonzero urb status: %d\n",
+		dev_dbg(&port->dev, "%s - nonzero urb status: %d\n",
 							__func__, urb->status);
 		goto resubmit;
 	}
Index: linux-3.18.13-rt10-r7s4/drivers/usb/serial/keyspan.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/serial/keyspan.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/serial/keyspan.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:413 @ static void	usa26_instat_callback(struct
 	}
 	port = serial->port[msg->port];
 	p_priv = usb_get_serial_port_data(port);
+	if (!p_priv)
+		goto resubmit;
 
 	/* Update handshaking pin state information */
 	old_dcd_state = p_priv->dcd_state;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:425 @ static void	usa26_instat_callback(struct
 
 	if (old_dcd_state != p_priv->dcd_state)
 		tty_port_tty_hangup(&port->port, true);
-
+resubmit:
 	/* Resubmit urb so we continue receiving */
 	err = usb_submit_urb(urb, GFP_ATOMIC);
 	if (err != 0)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:532 @ static void	usa28_instat_callback(struct
 	}
 	port = serial->port[msg->port];
 	p_priv = usb_get_serial_port_data(port);
+	if (!p_priv)
+		goto resubmit;
 
 	/* Update handshaking pin state information */
 	old_dcd_state = p_priv->dcd_state;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:544 @ static void	usa28_instat_callback(struct
 
 	if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
 		tty_port_tty_hangup(&port->port, true);
-
+resubmit:
 		/* Resubmit urb so we continue receiving */
 	err = usb_submit_urb(urb, GFP_ATOMIC);
 	if (err != 0)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:614 @ static void	usa49_instat_callback(struct
 	}
 	port = serial->port[msg->portNumber];
 	p_priv = usb_get_serial_port_data(port);
+	if (!p_priv)
+		goto resubmit;
 
 	/* Update handshaking pin state information */
 	old_dcd_state = p_priv->dcd_state;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:626 @ static void	usa49_instat_callback(struct
 
 	if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
 		tty_port_tty_hangup(&port->port, true);
-
+resubmit:
 	/* Resubmit urb so we continue receiving */
 	err = usb_submit_urb(urb, GFP_ATOMIC);
 	if (err != 0)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:864 @ static void	usa90_instat_callback(struct
 
 	port = serial->port[0];
 	p_priv = usb_get_serial_port_data(port);
+	if (!p_priv)
+		goto resubmit;
 
 	/* Update handshaking pin state information */
 	old_dcd_state = p_priv->dcd_state;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:876 @ static void	usa90_instat_callback(struct
 
 	if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
 		tty_port_tty_hangup(&port->port, true);
-
+resubmit:
 	/* Resubmit urb so we continue receiving */
 	err = usb_submit_urb(urb, GFP_ATOMIC);
 	if (err != 0)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:937 @ static void	usa67_instat_callback(struct
 
 	port = serial->port[msg->port];
 	p_priv = usb_get_serial_port_data(port);
+	if (!p_priv)
+		goto resubmit;
 
 	/* Update handshaking pin state information */
 	old_dcd_state = p_priv->dcd_state;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:947 @ static void	usa67_instat_callback(struct
 
 	if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
 		tty_port_tty_hangup(&port->port, true);
-
+resubmit:
 	/* Resubmit urb so we continue receiving */
 	err = usb_submit_urb(urb, GFP_ATOMIC);
 	if (err != 0)
Index: linux-3.18.13-rt10-r7s4/drivers/usb/serial/keyspan_pda.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/serial/keyspan_pda.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/serial/keyspan_pda.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:64 @ struct keyspan_pda_private {
 /* For Xircom PGSDB9 and older Entregra version of the same device */
 #define XIRCOM_VENDOR_ID		0x085a
 #define XIRCOM_FAKE_ID			0x8027
+#define XIRCOM_FAKE_ID_2                0x8025 /* "PGMFHUB" serial */
 #define ENTREGRA_VENDOR_ID		0x1645
 #define ENTREGRA_FAKE_ID		0x8093
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:74 @ static const struct usb_device_id id_tab
 #endif
 #ifdef XIRCOM
 	{ USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID) },
+	{ USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID_2) },
 	{ USB_DEVICE(ENTREGRA_VENDOR_ID, ENTREGRA_FAKE_ID) },
 #endif
 	{ USB_DEVICE(KEYSPAN_VENDOR_ID, KEYSPAN_PDA_ID) },
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:98 @ static const struct usb_device_id id_tab
 #ifdef XIRCOM
 static const struct usb_device_id id_table_fake_xircom[] = {
 	{ USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID) },
+	{ USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID_2) },
 	{ USB_DEVICE(ENTREGRA_VENDOR_ID, ENTREGRA_FAKE_ID) },
 	{ }
 };
Index: linux-3.18.13-rt10-r7s4/drivers/usb/serial/mxuport.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/serial/mxuport.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/serial/mxuport.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1287 @ static int mxuport_open(struct tty_struc
 	}
 
 	/* Initial port termios */
-	mxuport_set_termios(tty, port, NULL);
+	if (tty)
+		mxuport_set_termios(tty, port, NULL);
 
 	/*
 	 * TODO: use RQ_VENDOR_GET_MSR, once we know what it
Index: linux-3.18.13-rt10-r7s4/drivers/usb/serial/option.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/serial/option.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/serial/option.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:237 @ static void option_instat_callback(struc
 
 #define QUALCOMM_VENDOR_ID			0x05C6
 
+#define SIERRA_VENDOR_ID			0x1199
+
 #define CMOTECH_VENDOR_ID			0x16d8
 #define CMOTECH_PRODUCT_6001			0x6001
 #define CMOTECH_PRODUCT_CMU_300			0x6002
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:517 @ enum option_blacklist_reason {
 		OPTION_BLACKLIST_RESERVED_IF = 2
 };
 
-#define MAX_BL_NUM  8
+#define MAX_BL_NUM  11
 struct option_blacklist_info {
 	/* bitfield of interface numbers for OPTION_BLACKLIST_SENDSETUP */
 	const unsigned long sendsetup;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:606 @ static const struct option_blacklist_inf
 	.reserved = BIT(1) | BIT(5),
 };
 
+static const struct option_blacklist_info sierra_mc73xx_blacklist = {
+	.sendsetup = BIT(0) | BIT(2),
+	.reserved = BIT(8) | BIT(10) | BIT(11),
+};
+
 static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1108 @ static const struct usb_device_id option
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+	{ USB_DEVICE_INTERFACE_CLASS(SIERRA_VENDOR_ID, 0x68c0, 0xff),
+	  .driver_info = (kernel_ulong_t)&sierra_mc73xx_blacklist }, /* MC73xx */
 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
Index: linux-3.18.13-rt10-r7s4/drivers/usb/serial/qcserial.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/serial/qcserial.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/serial/qcserial.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:30 @ enum qcserial_layouts {
 	QCSERIAL_G2K = 0,	/* Gobi 2000 */
 	QCSERIAL_G1K = 1,	/* Gobi 1000 */
 	QCSERIAL_SWI = 2,	/* Sierra Wireless */
+	QCSERIAL_HWI = 3,	/* Huawei */
 };
 
 #define DEVICE_G1K(v, p) \
 	USB_DEVICE(v, p), .driver_info = QCSERIAL_G1K
 #define DEVICE_SWI(v, p) \
 	USB_DEVICE(v, p), .driver_info = QCSERIAL_SWI
+#define DEVICE_HWI(v, p) \
+	USB_DEVICE(v, p), .driver_info = QCSERIAL_HWI
 
 static const struct usb_device_id id_table[] = {
 	/* Gobi 1000 devices */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:145 @ static const struct usb_device_id id_tab
 	{DEVICE_SWI(0x0f3d, 0x68a2)},	/* Sierra Wireless MC7700 */
 	{DEVICE_SWI(0x114f, 0x68a2)},	/* Sierra Wireless MC7750 */
 	{DEVICE_SWI(0x1199, 0x68a2)},	/* Sierra Wireless MC7710 */
-	{DEVICE_SWI(0x1199, 0x68c0)},	/* Sierra Wireless MC73xx */
 	{DEVICE_SWI(0x1199, 0x901c)},	/* Sierra Wireless EM7700 */
 	{DEVICE_SWI(0x1199, 0x901f)},	/* Sierra Wireless EM7355 */
 	{DEVICE_SWI(0x1199, 0x9040)},	/* Sierra Wireless Modem */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:162 @ static const struct usb_device_id id_tab
 	{DEVICE_SWI(0x413c, 0x81a8)},	/* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
 	{DEVICE_SWI(0x413c, 0x81a9)},	/* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
 
+	/* Huawei devices */
+	{DEVICE_HWI(0x03f0, 0x581d)},	/* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
+
 	{ }				/* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, id_table);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:291 @ static int qcprobe(struct usb_serial *se
 			break;
 		default:
 			/* don't claim any unsupported interface */
+			altsetting = -1;
+			break;
+		}
+		break;
+	case QCSERIAL_HWI:
+		/*
+		 * Huawei layout:
+		 * 0: AT-capable modem port
+		 * 1: DM/DIAG
+		 * 2: AT-capable modem port
+		 * 3: CCID-compatible PCSC interface
+		 * 4: QMI/net
+		 * 5: NMEA
+		 */
+		switch (ifnum) {
+		case 0:
+		case 2:
+			dev_dbg(dev, "Modem port found\n");
+			break;
+		case 1:
+			dev_dbg(dev, "DM/DIAG interface found\n");
+			break;
+		case 5:
+			dev_dbg(dev, "NMEA GPS interface found\n");
+			break;
+		default:
+			/* don't claim any unsupported interface */
 			altsetting = -1;
 			break;
 		}
Index: linux-3.18.13-rt10-r7s4/drivers/usb/serial/usb-serial.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/serial/usb-serial.c
+++ linux-3.18.13-rt10-r7s4/drivers/usb/serial/usb-serial.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:943 @ static int usb_serial_probe(struct usb_i
 		port = serial->port[i];
 		if (kfifo_alloc(&port->write_fifo, PAGE_SIZE, GFP_KERNEL))
 			goto probe_error;
-		buffer_size = max_t(int, serial->type->bulk_out_size,
-						usb_endpoint_maxp(endpoint));
+		buffer_size = serial->type->bulk_out_size;
+		if (!buffer_size)
+			buffer_size = usb_endpoint_maxp(endpoint);
 		port->bulk_out_size = buffer_size;
 		port->bulk_out_endpointAddress = endpoint->bEndpointAddress;
 
Index: linux-3.18.13-rt10-r7s4/drivers/usb/storage/unusual_devs.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/storage/unusual_devs.h
+++ linux-3.18.13-rt10-r7s4/drivers/usb/storage/unusual_devs.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1998 @ UNUSUAL_DEV(  0x152d, 0x2329, 0x0100, 0x
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
 
+/* Reported by Dmitry Nezhevenko <dion@dion.org.ua> */
+UNUSUAL_DEV(  0x152d, 0x2566, 0x0114, 0x0114,
+		"JMicron",
+		"USB to ATA/ATAPI Bridge",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_BROKEN_FUA ),
+
 /* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI)
  * and Mac USB Dock USB-SCSI */
 UNUSUAL_DEV(  0x1645, 0x0007, 0x0100, 0x0133,
Index: linux-3.18.13-rt10-r7s4/drivers/usb/storage/unusual_uas.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/usb/storage/unusual_uas.h
+++ linux-3.18.13-rt10-r7s4/drivers/usb/storage/unusual_uas.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:71 @ UNUSUAL_DEV(0x0bc2, 0xa003, 0x0000, 0x99
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_NO_ATA_1X),
 
+/* Reported-by: Marcin ZajÄ…czkowski <mszpak@wp.pl> */
+UNUSUAL_DEV(0x0bc2, 0xa013, 0x0000, 0x9999,
+		"Seagate",
+		"Backup Plus",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_NO_ATA_1X),
+
+/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+UNUSUAL_DEV(0x0bc2, 0xa0a4, 0x0000, 0x9999,
+		"Seagate",
+		"Backup Plus Desk",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_NO_ATA_1X),
+
 /* https://bbs.archlinux.org/viewtopic.php?id=183190 */
 UNUSUAL_DEV(0x0bc2, 0xab20, 0x0000, 0x9999,
 		"Seagate",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:99 @ UNUSUAL_DEV(0x0bc2, 0xab21, 0x0000, 0x99
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_NO_ATA_1X),
 
+/* Reported-by: G. Richard Bellamy <rbellamy@pteradigm.com> */
+UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
+		"Seagate",
+		"BUP Fast HDD",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_NO_ATA_1X),
+
+/* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
+		"Initio Corporation",
+		"",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_NO_ATA_1X),
+
+/* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
+UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
+		"JMicron",
+		"JMS539",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_NO_REPORT_OPCODES),
+
 /* Reported-by: Claudio Bizzarri <claudio.bizzarri@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
 		"JMicron",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:142 @ UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x99
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_NO_ATA_1X),
 
+/* Reported-by: Takeo Nakayama <javhera@gmx.com> */
+UNUSUAL_DEV(0x357d, 0x7788, 0x0000, 0x9999,
+		"JMicron",
+		"JMS566",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_NO_REPORT_OPCODES),
+
 /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
 UNUSUAL_DEV(0x4971, 0x1012, 0x0000, 0x9999,
 		"Hitachi",
 		"External HDD",
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_IGNORE_UAS),
+
+/* Reported-by: Richard Henderson <rth@redhat.com> */
+UNUSUAL_DEV(0x4971, 0x8017, 0x0000, 0x9999,
+		"SimpleTech",
+		"External HDD",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_NO_REPORT_OPCODES),
Index: linux-3.18.13-rt10-r7s4/drivers/vfio/pci/vfio_pci.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/vfio/pci/vfio_pci.c
+++ linux-3.18.13-rt10-r7s4/drivers/vfio/pci/vfio_pci.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:842 @ static const struct vfio_device_ops vfio
 
 static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
-	u8 type;
 	struct vfio_pci_device *vdev;
 	struct iommu_group *group;
 	int ret;
 
-	pci_read_config_byte(pdev, PCI_HEADER_TYPE, &type);
-	if ((type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL)
+	if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL)
 		return -EINVAL;
 
 	group = iommu_group_get(&pdev->dev);
Index: linux-3.18.13-rt10-r7s4/drivers/vhost/scsi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/vhost/scsi.c
+++ linux-3.18.13-rt10-r7s4/drivers/vhost/scsi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:912 @ vhost_scsi_map_iov_to_prot(struct tcm_vh
 	return 0;
 }
 
+static int vhost_scsi_to_tcm_attr(int attr)
+{
+	switch (attr) {
+	case VIRTIO_SCSI_S_SIMPLE:
+		return MSG_SIMPLE_TAG;
+	case VIRTIO_SCSI_S_ORDERED:
+		return MSG_ORDERED_TAG;
+	case VIRTIO_SCSI_S_HEAD:
+		return MSG_HEAD_TAG;
+	case VIRTIO_SCSI_S_ACA:
+		return MSG_ACA_TAG;
+	default:
+		break;
+	}
+	return MSG_SIMPLE_TAG;
+}
+
 static void tcm_vhost_submission_work(struct work_struct *work)
 {
 	struct tcm_vhost_cmd *cmd =
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:954 @ static void tcm_vhost_submission_work(st
 	rc = target_submit_cmd_map_sgls(se_cmd, tv_nexus->tvn_se_sess,
 			cmd->tvc_cdb, &cmd->tvc_sense_buf[0],
 			cmd->tvc_lun, cmd->tvc_exp_data_len,
-			cmd->tvc_task_attr, cmd->tvc_data_direction,
-			TARGET_SCF_ACK_KREF, sg_ptr, cmd->tvc_sgl_count,
-			NULL, 0, sg_prot_ptr, cmd->tvc_prot_sgl_count);
+			vhost_scsi_to_tcm_attr(cmd->tvc_task_attr),
+			cmd->tvc_data_direction, TARGET_SCF_ACK_KREF,
+			sg_ptr, cmd->tvc_sgl_count, NULL, 0,
+			sg_prot_ptr, cmd->tvc_prot_sgl_count);
 	if (rc < 0) {
 		transport_send_check_condition_and_sense(se_cmd,
 				TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE, 0);
Index: linux-3.18.13-rt10-r7s4/drivers/video/fbdev/core/fb_defio.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/video/fbdev/core/fb_defio.c
+++ linux-3.18.13-rt10-r7s4/drivers/video/fbdev/core/fb_defio.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:86 @ int fb_deferred_io_fsync(struct file *fi
 	cancel_delayed_work_sync(&info->deferred_work);
 
 	/* Run it immediately */
-	err = schedule_delayed_work(&info->deferred_work, 0);
+	schedule_delayed_work(&info->deferred_work, 0);
 	mutex_unlock(&inode->i_mutex);
-	return err;
+
+	return 0;
 }
 EXPORT_SYMBOL_GPL(fb_deferred_io_fsync);
 
Index: linux-3.18.13-rt10-r7s4/drivers/video/logo/logo.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/video/logo/logo.c
+++ linux-3.18.13-rt10-r7s4/drivers/video/logo/logo.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:24 @ static bool nologo;
 module_param(nologo, bool, 0);
 MODULE_PARM_DESC(nologo, "Disables startup logo");
 
+/*
+ * Logos are located in the initdata, and will be freed in kernel_init.
+ * Use late_init to mark the logos as freed to prevent any further use.
+ */
+
+static bool logos_freed;
+
+static int __init fb_logo_late_init(void)
+{
+	logos_freed = true;
+	return 0;
+}
+
+late_initcall(fb_logo_late_init);
+
 /* logo's are marked __initdata. Use __init_refok to tell
  * modpost that it is intended that this function uses data
  * marked __initdata.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:47 @ const struct linux_logo * __init_refok f
 {
 	const struct linux_logo *logo = NULL;
 
-	if (nologo)
+	if (nologo || logos_freed)
 		return NULL;
 
 	if (depth >= 1) {
Index: linux-3.18.13-rt10-r7s4/drivers/virtio/virtio_balloon.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/virtio/virtio_balloon.c
+++ linux-3.18.13-rt10-r7s4/drivers/virtio/virtio_balloon.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:31 @
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/balloon_compaction.h>
+#include <linux/wait.h>
 
 /*
  * Balloon device works in 4K page units.  So each page is pointed to by
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:294 @ static void update_balloon_size(struct v
 static int balloon(void *_vballoon)
 {
 	struct virtio_balloon *vb = _vballoon;
+	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 
 	set_freezable();
 	while (!kthread_should_stop()) {
 		s64 diff;
 
 		try_to_freeze();
-		wait_event_interruptible(vb->config_change,
-					 (diff = towards_target(vb)) != 0
-					 || vb->need_stats_update
-					 || kthread_should_stop()
-					 || freezing(current));
+
+		add_wait_queue(&vb->config_change, &wait);
+		for (;;) {
+			if ((diff = towards_target(vb)) != 0 ||
+			    vb->need_stats_update ||
+			    kthread_should_stop() ||
+			    freezing(current))
+				break;
+			wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
+		}
+		remove_wait_queue(&vb->config_change, &wait);
+
 		if (vb->need_stats_update)
 			stats_handle_request(vb);
 		if (diff > 0)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:455 @ static int virtballoon_probe(struct virt
 	if (err)
 		goto out_free_vb;
 
+	virtio_device_ready(vdev);
+
 	vb->thread = kthread_run(balloon, vb, "vballoon");
 	if (IS_ERR(vb->thread)) {
 		err = PTR_ERR(vb->thread);
Index: linux-3.18.13-rt10-r7s4/drivers/xen/balloon.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/xen/balloon.c
+++ linux-3.18.13-rt10-r7s4/drivers/xen/balloon.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:233 @ static enum bp_state reserve_additional_
 	balloon_hotplug = round_up(balloon_hotplug, PAGES_PER_SECTION);
 	nid = memory_add_physaddr_to_nid(hotplug_start_paddr);
 
+#ifdef CONFIG_XEN_HAVE_PVMMU
+        /*
+         * add_memory() will build page tables for the new memory so
+         * the p2m must contain invalid entries so the correct
+         * non-present PTEs will be written.
+         *
+         * If a failure occurs, the original (identity) p2m entries
+         * are not restored since this region is now known not to
+         * conflict with any devices.
+         */
+	if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+		unsigned long pfn, i;
+
+		pfn = PFN_DOWN(hotplug_start_paddr);
+		for (i = 0; i < balloon_hotplug; i++) {
+			if (!set_phys_to_machine(pfn + i, INVALID_P2M_ENTRY)) {
+				pr_warn("set_phys_to_machine() failed, no memory added\n");
+				return BP_ECANCELED;
+			}
+                }
+	}
+#endif
+
 	rc = add_memory(nid, hotplug_start_paddr, balloon_hotplug << PAGE_SHIFT);
 
 	if (rc) {
Index: linux-3.18.13-rt10-r7s4/drivers/xen/events/events_base.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/xen/events/events_base.c
+++ linux-3.18.13-rt10-r7s4/drivers/xen/events/events_base.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:529 @ static unsigned int __startup_pirq(unsig
 	pirq_query_unmask(irq);
 
 	rc = set_evtchn_to_irq(evtchn, irq);
-	if (rc != 0) {
-		pr_err("irq%d: Failed to set port to irq mapping (%d)\n",
-		       irq, rc);
-		xen_evtchn_close(evtchn);
-		return 0;
-	}
+	if (rc)
+		goto err;
+
 	bind_evtchn_to_cpu(evtchn, 0);
 	info->evtchn = evtchn;
 
+	rc = xen_evtchn_port_setup(info);
+	if (rc)
+		goto err;
+
 out:
 	unmask_evtchn(evtchn);
 	eoi_pirq(irq_get_irq_data(irq));
 
 	return 0;
+
+err:
+	pr_err("irq%d: Failed to set port to irq mapping (%d)\n", irq, rc);
+	xen_evtchn_close(evtchn);
+	return 0;
 }
 
 static unsigned int startup_pirq(struct irq_data *data)
Index: linux-3.18.13-rt10-r7s4/drivers/xen/manage.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/xen/manage.c
+++ linux-3.18.13-rt10-r7s4/drivers/xen/manage.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:108 @ static void do_suspend(void)
 
 	err = freeze_processes();
 	if (err) {
-		pr_err("%s: freeze failed %d\n", __func__, err);
+		pr_err("%s: freeze processes failed %d\n", __func__, err);
 		goto out;
 	}
 
+	err = freeze_kernel_threads();
+	if (err) {
+		pr_err("%s: freeze kernel threads failed %d\n", __func__, err);
+		goto out_thaw;
+	}
+
 	err = dpm_suspend_start(PMSG_FREEZE);
 	if (err) {
 		pr_err("%s: dpm_suspend_start %d\n", __func__, err);
Index: linux-3.18.13-rt10-r7s4/drivers/xen/swiotlb-xen.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/xen/swiotlb-xen.c
+++ linux-3.18.13-rt10-r7s4/drivers/xen/swiotlb-xen.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:99 @ static inline phys_addr_t xen_bus_to_phy
 	dma_addr_t dma = (dma_addr_t)pfn << PAGE_SHIFT;
 	phys_addr_t paddr = dma;
 
-	BUG_ON(paddr != dma); /* truncation has occurred, should never happen */
-
 	paddr |= baddr & ~PAGE_MASK;
 
 	return paddr;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:400 @ dma_addr_t xen_swiotlb_map_page(struct d
 	 * buffering it.
 	 */
 	if (dma_capable(dev, dev_addr, size) &&
-	    !range_straddles_page_boundary(phys, size) && !swiotlb_force) {
+	    !range_straddles_page_boundary(phys, size) &&
+		!xen_arch_need_swiotlb(dev, PFN_DOWN(phys), PFN_DOWN(dev_addr)) &&
+		!swiotlb_force) {
 		/* we are not interested in the dma_addr returned by
 		 * xen_dma_map_page, only in the potential cache flushes executed
 		 * by the function. */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:450 @ static void xen_unmap_single(struct devi
 
 	BUG_ON(dir == DMA_NONE);
 
-	xen_dma_unmap_page(hwdev, paddr, size, dir, attrs);
+	xen_dma_unmap_page(hwdev, dev_addr, size, dir, attrs);
 
 	/* NOTE: We use dev_addr here, not paddr! */
 	if (is_xen_swiotlb_buffer(dev_addr)) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:498 @ xen_swiotlb_sync_single(struct device *h
 	BUG_ON(dir == DMA_NONE);
 
 	if (target == SYNC_FOR_CPU)
-		xen_dma_sync_single_for_cpu(hwdev, paddr, size, dir);
+		xen_dma_sync_single_for_cpu(hwdev, dev_addr, size, dir);
 
 	/* NOTE: We use dev_addr here, not paddr! */
 	if (is_xen_swiotlb_buffer(dev_addr))
 		swiotlb_tbl_sync_single(hwdev, paddr, size, dir, target);
 
 	if (target == SYNC_FOR_DEVICE)
-		xen_dma_sync_single_for_cpu(hwdev, paddr, size, dir);
+		xen_dma_sync_single_for_device(hwdev, dev_addr, size, dir);
 
 	if (dir != DMA_FROM_DEVICE)
 		return;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:560 @ xen_swiotlb_map_sg_attrs(struct device *
 		dma_addr_t dev_addr = xen_phys_to_bus(paddr);
 
 		if (swiotlb_force ||
+		    xen_arch_need_swiotlb(hwdev, PFN_DOWN(paddr), PFN_DOWN(dev_addr)) ||
 		    !dma_capable(hwdev, dev_addr, sg->length) ||
 		    range_straddles_page_boundary(paddr, sg->length)) {
 			phys_addr_t map = swiotlb_tbl_map_single(hwdev,
Index: linux-3.18.13-rt10-r7s4/drivers/xen/xen-pciback/conf_space.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/xen/xen-pciback/conf_space.c
+++ linux-3.18.13-rt10-r7s4/drivers/xen/xen-pciback/conf_space.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:19 @
 #include "conf_space.h"
 #include "conf_space_quirks.h"
 
-static bool permissive;
+bool permissive;
 module_param(permissive, bool, 0644);
 
 /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
Index: linux-3.18.13-rt10-r7s4/drivers/xen/xen-pciback/conf_space.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/xen/xen-pciback/conf_space.h
+++ linux-3.18.13-rt10-r7s4/drivers/xen/xen-pciback/conf_space.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:67 @ struct config_field_entry {
 	void *data;
 };
 
+extern bool permissive;
+
 #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
 
 /* Add fields to a device - the add_fields macro expects to get a pointer to
Index: linux-3.18.13-rt10-r7s4/drivers/xen/xen-pciback/conf_space_header.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/xen/xen-pciback/conf_space_header.c
+++ linux-3.18.13-rt10-r7s4/drivers/xen/xen-pciback/conf_space_header.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:14 @
 #include "pciback.h"
 #include "conf_space.h"
 
+struct pci_cmd_info {
+	u16 val;
+};
+
 struct pci_bar_info {
 	u32 val;
 	u32 len_val;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:27 @ struct pci_bar_info {
 #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
 #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)
 
-static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
+/* Bits guests are allowed to control in permissive mode. */
+#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
+			   PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
+			   PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
+
+static void *command_init(struct pci_dev *dev, int offset)
 {
-	int i;
-	int ret;
+	struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
+	int err;
 
-	ret = xen_pcibk_read_config_word(dev, offset, value, data);
-	if (!pci_is_enabled(dev))
-		return ret;
-
-	for (i = 0; i < PCI_ROM_RESOURCE; i++) {
-		if (dev->resource[i].flags & IORESOURCE_IO)
-			*value |= PCI_COMMAND_IO;
-		if (dev->resource[i].flags & IORESOURCE_MEM)
-			*value |= PCI_COMMAND_MEMORY;
+	if (!cmd)
+		return ERR_PTR(-ENOMEM);
+
+	err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
+	if (err) {
+		kfree(cmd);
+		return ERR_PTR(err);
 	}
 
+	return cmd;
+}
+
+static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
+{
+	int ret = pci_read_config_word(dev, offset, value);
+	const struct pci_cmd_info *cmd = data;
+
+	*value &= PCI_COMMAND_GUEST;
+	*value |= cmd->val & ~PCI_COMMAND_GUEST;
+
 	return ret;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:64 @ static int command_write(struct pci_dev
 {
 	struct xen_pcibk_dev_data *dev_data;
 	int err;
+	u16 val;
+	struct pci_cmd_info *cmd = data;
 
 	dev_data = pci_get_drvdata(dev);
 	if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:106 @ static int command_write(struct pci_dev
 		}
 	}
 
+	cmd->val = value;
+
+	if (!permissive && (!dev_data || !dev_data->permissive))
+		return 0;
+
+	/* Only allow the guest to control certain bits. */
+	err = pci_read_config_word(dev, offset, &val);
+	if (err || val == value)
+		return err;
+
+	value &= PCI_COMMAND_GUEST;
+	value |= val & ~PCI_COMMAND_GUEST;
+
 	return pci_write_config_word(dev, offset, value);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:318 @ static const struct config_field header_
 	{
 	 .offset    = PCI_COMMAND,
 	 .size      = 2,
+	 .init      = command_init,
+	 .release   = bar_release,
 	 .u.w.read  = command_read,
 	 .u.w.write = command_write,
 	},
Index: linux-3.18.13-rt10-r7s4/drivers/xen/xen-scsiback.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/drivers/xen/xen-scsiback.c
+++ linux-3.18.13-rt10-r7s4/drivers/xen/xen-scsiback.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:715 @ static int prepare_pending_reqs(struct v
 static int scsiback_do_cmd_fn(struct vscsibk_info *info)
 {
 	struct vscsiif_back_ring *ring = &info->ring;
-	struct vscsiif_request *ring_req;
+	struct vscsiif_request ring_req;
 	struct vscsibk_pend *pending_req;
 	RING_IDX rc, rp;
 	int err, more_to_do;
 	uint32_t result;
-	uint8_t act;
 
 	rc = ring->req_cons;
 	rp = ring->sring->req_prod;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:740 @ static int scsiback_do_cmd_fn(struct vsc
 		if (!pending_req)
 			return 1;
 
-		ring_req = RING_GET_REQUEST(ring, rc);
+		ring_req = *RING_GET_REQUEST(ring, rc);
 		ring->req_cons = ++rc;
 
-		act = ring_req->act;
-		err = prepare_pending_reqs(info, ring_req, pending_req);
+		err = prepare_pending_reqs(info, &ring_req, pending_req);
 		if (err) {
 			switch (err) {
 			case -ENODEV:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:759 @ static int scsiback_do_cmd_fn(struct vsc
 			return 1;
 		}
 
-		switch (act) {
+		switch (ring_req.act) {
 		case VSCSIIF_ACT_SCSI_CDB:
-			if (scsiback_gnttab_data_map(ring_req, pending_req)) {
+			if (scsiback_gnttab_data_map(&ring_req, pending_req)) {
 				scsiback_fast_flush_area(pending_req);
 				scsiback_do_resp_with_sense(NULL,
 					DRIVER_ERROR << 24, 0, pending_req);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:772 @ static int scsiback_do_cmd_fn(struct vsc
 			break;
 		case VSCSIIF_ACT_SCSI_ABORT:
 			scsiback_device_action(pending_req, TMR_ABORT_TASK,
-				ring_req->ref_rqid);
+				ring_req.ref_rqid);
 			break;
 		case VSCSIIF_ACT_SCSI_RESET:
 			scsiback_device_action(pending_req, TMR_LUN_RESET, 0);
Index: linux-3.18.13-rt10-r7s4/fs/affs/amigaffs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/affs/amigaffs.c
+++ linux-3.18.13-rt10-r7s4/fs/affs/amigaffs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:128 @ affs_fix_dcache(struct inode *inode, u32
 {
 	struct dentry *dentry;
 	spin_lock(&inode->i_lock);
-	hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
+	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
 		if (entry_ino == (u32)(long)dentry->d_fsdata) {
 			dentry->d_fsdata = (void *)inode->i_ino;
 			break;
Index: linux-3.18.13-rt10-r7s4/fs/aio.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/aio.c
+++ linux-3.18.13-rt10-r7s4/fs/aio.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:718 @ static struct kioctx *ioctx_alloc(unsign
 err_cleanup:
 	aio_nr_sub(ctx->max_reqs);
 err_ctx:
+	atomic_set(&ctx->dead, 1);
+	if (ctx->mmap_size)
+		vm_munmap(ctx->mmap_base, ctx->mmap_size);
 	aio_free_ring(ctx);
 err:
 	mutex_unlock(&ctx->ring_lock);
Index: linux-3.18.13-rt10-r7s4/fs/autofs4/dev-ioctl.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/autofs4/dev-ioctl.c
+++ linux-3.18.13-rt10-r7s4/fs/autofs4/dev-ioctl.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:98 @ static int check_dev_ioctl_version(int c
  */
 static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in)
 {
-	struct autofs_dev_ioctl tmp;
+	struct autofs_dev_ioctl tmp, *res;
 
 	if (copy_from_user(&tmp, in, sizeof(tmp)))
 		return ERR_PTR(-EFAULT);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:109 @ static struct autofs_dev_ioctl *copy_dev
 	if (tmp.size > (PATH_MAX + sizeof(tmp)))
 		return ERR_PTR(-ENAMETOOLONG);
 
-	return memdup_user(in, tmp.size);
+	res = memdup_user(in, tmp.size);
+	if (!IS_ERR(res))
+		res->size = tmp.size;
+
+	return res;
 }
 
 static inline void free_dev_ioctl(struct autofs_dev_ioctl *param)
Index: linux-3.18.13-rt10-r7s4/fs/autofs4/expire.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/autofs4/expire.c
+++ linux-3.18.13-rt10-r7s4/fs/autofs4/expire.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:88 @ static struct dentry *get_next_positive_
 	spin_lock(&root->d_lock);
 
 	if (prev)
-		next = prev->d_u.d_child.next;
+		next = prev->d_child.next;
 	else {
 		prev = dget_dlock(root);
 		next = prev->d_subdirs.next;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:102 @ cont:
 		return NULL;
 	}
 
-	q = list_entry(next, struct dentry, d_u.d_child);
+	q = list_entry(next, struct dentry, d_child);
 
 	spin_lock_nested(&q->d_lock, DENTRY_D_LOCK_NESTED);
 	/* Already gone or negative dentry (under construction) - try next */
 	if (!d_count(q) || !simple_positive(q)) {
 		spin_unlock(&q->d_lock);
-		next = q->d_u.d_child.next;
+		next = q->d_child.next;
 		goto cont;
 	}
 	dget_dlock(q);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:158 @ again:
 				goto relock;
 			}
 			spin_unlock(&p->d_lock);
-			next = p->d_u.d_child.next;
+			next = p->d_child.next;
 			p = parent;
 			if (next != &parent->d_subdirs)
 				break;
 		}
 	}
-	ret = list_entry(next, struct dentry, d_u.d_child);
+	ret = list_entry(next, struct dentry, d_child);
 
 	spin_lock_nested(&ret->d_lock, DENTRY_D_LOCK_NESTED);
 	/* Negative dentry - try next */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:492 @ found:
 	spin_lock(&sbi->lookup_lock);
 	spin_lock(&expired->d_parent->d_lock);
 	spin_lock_nested(&expired->d_lock, DENTRY_D_LOCK_NESTED);
-	list_move(&expired->d_parent->d_subdirs, &expired->d_u.d_child);
+	list_move(&expired->d_parent->d_subdirs, &expired->d_child);
 	spin_unlock(&expired->d_lock);
 	spin_unlock(&expired->d_parent->d_lock);
 	spin_unlock(&sbi->lookup_lock);
Index: linux-3.18.13-rt10-r7s4/fs/autofs4/root.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/autofs4/root.c
+++ linux-3.18.13-rt10-r7s4/fs/autofs4/root.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:690 @ static void autofs_clear_leaf_automount_
 	/* only consider parents below dentrys in the root */
 	if (IS_ROOT(parent->d_parent))
 		return;
-	d_child = &dentry->d_u.d_child;
+	d_child = &dentry->d_child;
 	/* Set parent managed if it's becoming empty */
 	if (d_child->next == &parent->d_subdirs &&
 	    d_child->prev == &parent->d_subdirs)
Index: linux-3.18.13-rt10-r7s4/fs/binfmt_elf.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/binfmt_elf.c
+++ linux-3.18.13-rt10-r7s4/fs/binfmt_elf.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:557 @ out:
 
 static unsigned long randomize_stack_top(unsigned long stack_top)
 {
-	unsigned int random_variable = 0;
+	unsigned long random_variable = 0;
 
 	if ((current->flags & PF_RANDOMIZE) &&
 		!(current->personality & ADDR_NO_RANDOMIZE)) {
-		random_variable = get_random_int() & STACK_RND_MASK;
+		random_variable = (unsigned long) get_random_int();
+		random_variable &= STACK_RND_MASK;
 		random_variable <<= PAGE_SHIFT;
 	}
 #ifdef CONFIG_STACK_GROWSUP
Index: linux-3.18.13-rt10-r7s4/fs/btrfs/ctree.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/btrfs/ctree.c
+++ linux-3.18.13-rt10-r7s4/fs/btrfs/ctree.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2612 @ static int key_search(struct extent_buff
 	return 0;
 }
 
-int btrfs_find_item(struct btrfs_root *fs_root, struct btrfs_path *found_path,
+int btrfs_find_item(struct btrfs_root *fs_root, struct btrfs_path *path,
 		u64 iobjectid, u64 ioff, u8 key_type,
 		struct btrfs_key *found_key)
 {
 	int ret;
 	struct btrfs_key key;
 	struct extent_buffer *eb;
-	struct btrfs_path *path;
+
+	ASSERT(path);
 
 	key.type = key_type;
 	key.objectid = iobjectid;
 	key.offset = ioff;
 
-	if (found_path == NULL) {
-		path = btrfs_alloc_path();
-		if (!path)
-			return -ENOMEM;
-	} else
-		path = found_path;
-
 	ret = btrfs_search_slot(NULL, fs_root, &key, path, 0, 0);
-	if ((ret < 0) || (found_key == NULL)) {
-		if (path != found_path)
-			btrfs_free_path(path);
+	if ((ret < 0) || (found_key == NULL))
 		return ret;
-	}
 
 	eb = path->nodes[0];
 	if (ret && path->slots[0] >= btrfs_header_nritems(eb)) {
Index: linux-3.18.13-rt10-r7s4/fs/btrfs/delayed-inode.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/btrfs/delayed-inode.c
+++ linux-3.18.13-rt10-r7s4/fs/btrfs/delayed-inode.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1860 @ int btrfs_delayed_delete_inode_ref(struc
 {
 	struct btrfs_delayed_node *delayed_node;
 
+	/*
+	 * we don't do delayed inode updates during log recovery because it
+	 * leads to enospc problems.  This means we also can't do
+	 * delayed inode refs
+	 */
+	if (BTRFS_I(inode)->root->fs_info->log_root_recovering)
+		return -EAGAIN;
+
 	delayed_node = btrfs_get_or_create_delayed_node(inode);
 	if (IS_ERR(delayed_node))
 		return PTR_ERR(delayed_node);
Index: linux-3.18.13-rt10-r7s4/fs/btrfs/disk-io.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/btrfs/disk-io.c
+++ linux-3.18.13-rt10-r7s4/fs/btrfs/disk-io.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1633 @ struct btrfs_root *btrfs_get_fs_root(str
 				     bool check_ref)
 {
 	struct btrfs_root *root;
+	struct btrfs_path *path;
 	int ret;
 
 	if (location->objectid == BTRFS_ROOT_TREE_OBJECTID)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1673 @ again:
 	if (ret)
 		goto fail;
 
-	ret = btrfs_find_item(fs_info->tree_root, NULL, BTRFS_ORPHAN_OBJECTID,
+	path = btrfs_alloc_path();
+	if (!path) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+	ret = btrfs_find_item(fs_info->tree_root, path, BTRFS_ORPHAN_OBJECTID,
 			location->objectid, BTRFS_ORPHAN_ITEM_KEY, NULL);
+	btrfs_free_path(path);
 	if (ret < 0)
 		goto fail;
 	if (ret == 0)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2506 @ int open_ctree(struct super_block *sb,
 		features |= BTRFS_FEATURE_INCOMPAT_COMPRESS_LZO;
 
 	if (features & BTRFS_FEATURE_INCOMPAT_SKINNY_METADATA)
-		printk(KERN_ERR "BTRFS: has skinny extents\n");
+		printk(KERN_INFO "BTRFS: has skinny extents\n");
 
 	/*
 	 * flag our filesystem as having big metadata blocks if
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4116 @ again:
 		if (ret)
 			break;
 
-		/* opt_discard */
-		if (btrfs_test_opt(root, DISCARD))
-			ret = btrfs_error_discard_extent(root, start,
-							 end + 1 - start,
-							 NULL);
-
 		clear_extent_dirty(unpin, start, end, GFP_NOFS);
 		btrfs_error_unpin_extent_range(root, start, end);
 		cond_resched();
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4133 @ again:
 	return 0;
 }
 
+static void btrfs_free_pending_ordered(struct btrfs_transaction *cur_trans,
+				       struct btrfs_fs_info *fs_info)
+{
+	struct btrfs_ordered_extent *ordered;
+
+	spin_lock(&fs_info->trans_lock);
+	while (!list_empty(&cur_trans->pending_ordered)) {
+		ordered = list_first_entry(&cur_trans->pending_ordered,
+					   struct btrfs_ordered_extent,
+					   trans_list);
+		list_del_init(&ordered->trans_list);
+		spin_unlock(&fs_info->trans_lock);
+
+		btrfs_put_ordered_extent(ordered);
+		spin_lock(&fs_info->trans_lock);
+	}
+	spin_unlock(&fs_info->trans_lock);
+}
+
 void btrfs_cleanup_one_transaction(struct btrfs_transaction *cur_trans,
 				   struct btrfs_root *root)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4163 @ void btrfs_cleanup_one_transaction(struc
 	cur_trans->state = TRANS_STATE_UNBLOCKED;
 	wake_up(&root->fs_info->transaction_wait);
 
+	btrfs_free_pending_ordered(cur_trans, root->fs_info);
 	btrfs_destroy_delayed_inodes(root);
 	btrfs_assert_delayed_root_empty(root);
 
Index: linux-3.18.13-rt10-r7s4/fs/btrfs/extent-tree.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/btrfs/extent-tree.c
+++ linux-3.18.13-rt10-r7s4/fs/btrfs/extent-tree.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5718 @ void btrfs_prepare_extent_commit(struct
 	update_global_block_rsv(fs_info);
 }
 
-static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end)
+static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end,
+			      const bool return_free_space)
 {
 	struct btrfs_fs_info *fs_info = root->fs_info;
 	struct btrfs_block_group_cache *cache = NULL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5743 @ static int unpin_extent_range(struct btr
 
 		if (start < cache->last_byte_to_unpin) {
 			len = min(len, cache->last_byte_to_unpin - start);
-			btrfs_add_free_space(cache, start, len);
+			if (return_free_space)
+				btrfs_add_free_space(cache, start, len);
 		}
 
 		start += len;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5808 @ int btrfs_finish_extent_commit(struct bt
 						   end + 1 - start, NULL);
 
 		clear_extent_dirty(unpin, start, end, GFP_NOFS);
-		unpin_extent_range(root, start, end);
+		unpin_extent_range(root, start, end, true);
 		cond_resched();
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:9590 @ out:
 
 int btrfs_error_unpin_extent_range(struct btrfs_root *root, u64 start, u64 end)
 {
-	return unpin_extent_range(root, start, end);
+	return unpin_extent_range(root, start, end, false);
 }
 
 int btrfs_error_discard_extent(struct btrfs_root *root, u64 bytenr,
Index: linux-3.18.13-rt10-r7s4/fs/btrfs/extent_map.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/btrfs/extent_map.c
+++ linux-3.18.13-rt10-r7s4/fs/btrfs/extent_map.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:290 @ int unpin_extent_cache(struct extent_map
 	if (!em)
 		goto out;
 
-	if (!test_bit(EXTENT_FLAG_LOGGING, &em->flags))
-		list_move(&em->list, &tree->modified_extents);
 	em->generation = gen;
 	clear_bit(EXTENT_FLAG_PINNED, &em->flags);
 	em->mod_start = em->start;
Index: linux-3.18.13-rt10-r7s4/fs/btrfs/file.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/btrfs/file.c
+++ linux-3.18.13-rt10-r7s4/fs/btrfs/file.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1806 @ static ssize_t btrfs_file_write_iter(str
 	mutex_unlock(&inode->i_mutex);
 
 	/*
-	 * we want to make sure fsync finds this change
-	 * but we haven't joined a transaction running right now.
-	 *
-	 * Later on, someone is sure to update the inode and get the
-	 * real transid recorded.
-	 *
-	 * We set last_trans now to the fs_info generation + 1,
-	 * this will either be one more than the running transaction
-	 * or the generation used for the next transaction if there isn't
-	 * one running right now.
-	 *
 	 * We also have to set last_sub_trans to the current log transid,
 	 * otherwise subsequent syncs to a file that's been synced in this
 	 * transaction will appear to have already occured.
 	 */
-	BTRFS_I(inode)->last_trans = root->fs_info->generation + 1;
 	BTRFS_I(inode)->last_sub_trans = root->log_transid;
 	if (num_written > 0) {
 		err = generic_write_sync(file, pos, num_written);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1945 @ int btrfs_sync_file(struct file *file, l
 	atomic_inc(&root->log_batch);
 
 	/*
-	 * check the transaction that last modified this inode
-	 * and see if its already been committed
-	 */
-	if (!BTRFS_I(inode)->last_trans) {
-		mutex_unlock(&inode->i_mutex);
-		goto out;
-	}
-
-	/*
-	 * if the last transaction that changed this file was before
-	 * the current transaction, we can bail out now without any
-	 * syncing
+	 * If the last transaction that changed this file was before the current
+	 * transaction and we have the full sync flag set in our inode, we can
+	 * bail out now without any syncing.
+	 *
+	 * Note that we can't bail out if the full sync flag isn't set. This is
+	 * because when the full sync flag is set we start all ordered extents
+	 * and wait for them to fully complete - when they complete they update
+	 * the inode's last_trans field through:
+	 *
+	 *     btrfs_finish_ordered_io() ->
+	 *         btrfs_update_inode_fallback() ->
+	 *             btrfs_update_inode() ->
+	 *                 btrfs_set_inode_last_trans()
+	 *
+	 * So we are sure that last_trans is up to date and can do this check to
+	 * bail out safely. For the fast path, when the full sync flag is not
+	 * set in our inode, we can not do it because we start only our ordered
+	 * extents and don't wait for them to complete (that is when
+	 * btrfs_finish_ordered_io runs), so here at this point their last_trans
+	 * value might be less than or equals to fs_info->last_trans_committed,
+	 * and setting a speculative last_trans for an inode when a buffered
+	 * write is made (such as fs_info->generation + 1 for example) would not
+	 * be reliable since after setting the value and before fsync is called
+	 * any number of transactions can start and commit (transaction kthread
+	 * commits the current transaction periodically), and a transaction
+	 * commit does not start nor waits for ordered extents to complete.
 	 */
 	smp_mb();
 	if (btrfs_inode_in_log(inode, root->fs_info->generation) ||
-	    BTRFS_I(inode)->last_trans <=
-	    root->fs_info->last_trans_committed) {
-		BTRFS_I(inode)->last_trans = 0;
-
+	    (full_sync && BTRFS_I(inode)->last_trans <=
+	     root->fs_info->last_trans_committed)) {
 		/*
 		 * We'v had everything committed since the last time we were
 		 * modified so clear this flag in case it was set for whatever
Index: linux-3.18.13-rt10-r7s4/fs/btrfs/inode.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/btrfs/inode.c
+++ linux-3.18.13-rt10-r7s4/fs/btrfs/inode.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7154 @ static int btrfs_get_blocks_direct(struc
 	    ((BTRFS_I(inode)->flags & BTRFS_INODE_NODATACOW) &&
 	     em->block_start != EXTENT_MAP_HOLE)) {
 		int type;
-		int ret;
 		u64 block_start, orig_start, orig_block_len, ram_bytes;
 
 		if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
Index: linux-3.18.13-rt10-r7s4/fs/btrfs/ordered-data.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/btrfs/ordered-data.c
+++ linux-3.18.13-rt10-r7s4/fs/btrfs/ordered-data.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:223 @ static int __btrfs_add_ordered_extent(st
 	INIT_LIST_HEAD(&entry->work_list);
 	init_completion(&entry->completion);
 	INIT_LIST_HEAD(&entry->log_list);
+	INIT_LIST_HEAD(&entry->trans_list);
 
 	trace_btrfs_ordered_extent_add(inode, entry);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:445 @ void btrfs_get_logged_extents(struct ino
 	spin_lock_irq(&tree->lock);
 	for (n = rb_first(&tree->tree); n; n = rb_next(n)) {
 		ordered = rb_entry(n, struct btrfs_ordered_extent, rb_node);
-		if (!list_empty(&ordered->log_list))
+		if (test_and_set_bit(BTRFS_ORDERED_LOGGED, &ordered->flags))
 			continue;
 		list_add_tail(&ordered->log_list, logged_list);
 		atomic_inc(&ordered->refs);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:476 @ void btrfs_submit_logged_extents(struct
 	spin_unlock_irq(&log->log_extents_lock[index]);
 }
 
-void btrfs_wait_logged_extents(struct btrfs_root *log, u64 transid)
+void btrfs_wait_logged_extents(struct btrfs_trans_handle *trans,
+			       struct btrfs_root *log, u64 transid)
 {
 	struct btrfs_ordered_extent *ordered;
 	int index = transid % 2;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:502 @ void btrfs_wait_logged_extents(struct bt
 		wait_event(ordered->wait, test_bit(BTRFS_ORDERED_IO_DONE,
 						   &ordered->flags));
 
-		btrfs_put_ordered_extent(ordered);
+		list_add_tail(&ordered->trans_list, &trans->ordered);
 		spin_lock_irq(&log->log_extents_lock[index]);
 	}
 	spin_unlock_irq(&log->log_extents_lock[index]);
Index: linux-3.18.13-rt10-r7s4/fs/btrfs/ordered-data.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/btrfs/ordered-data.h
+++ linux-3.18.13-rt10-r7s4/fs/btrfs/ordered-data.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:74 @ struct btrfs_ordered_sum {
 				       ordered extent */
 #define BTRFS_ORDERED_TRUNCATED 9 /* Set when we have to truncate an extent */
 
+#define BTRFS_ORDERED_LOGGED 10 /* Set when we've waited on this ordered extent
+				 * in the logging code. */
 struct btrfs_ordered_extent {
 	/* logical offset in the file */
 	u64 file_offset;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:126 @ struct btrfs_ordered_extent {
 	/* If we need to wait on this to be done */
 	struct list_head log_list;
 
+	/* If the transaction needs to wait on this ordered extent */
+	struct list_head trans_list;
+
 	/* used to wait for the BTRFS_ORDERED_COMPLETE bit */
 	wait_queue_head_t wait;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:205 @ void btrfs_get_logged_extents(struct ino
 void btrfs_put_logged_extents(struct list_head *logged_list);
 void btrfs_submit_logged_extents(struct list_head *logged_list,
 				 struct btrfs_root *log);
-void btrfs_wait_logged_extents(struct btrfs_root *log, u64 transid);
+void btrfs_wait_logged_extents(struct btrfs_trans_handle *trans,
+			       struct btrfs_root *log, u64 transid);
 void btrfs_free_logged_extents(struct btrfs_root *log, u64 transid);
 int __init ordered_data_init(void);
 void ordered_data_exit(void);
Index: linux-3.18.13-rt10-r7s4/fs/btrfs/super.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/btrfs/super.c
+++ linux-3.18.13-rt10-r7s4/fs/btrfs/super.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1827 @ static int btrfs_statfs(struct dentry *d
 	buf->f_bfree -= block_rsv->size >> bits;
 	spin_unlock(&block_rsv->lock);
 
-	buf->f_bavail = total_free_data;
+	buf->f_bavail = div_u64(total_free_data, factor);
 	ret = btrfs_calc_avail_data_space(fs_info->tree_root, &total_free_data);
 	if (ret) {
 		mutex_unlock(&fs_info->chunk_mutex);
Index: linux-3.18.13-rt10-r7s4/fs/btrfs/transaction.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/btrfs/transaction.c
+++ linux-3.18.13-rt10-r7s4/fs/btrfs/transaction.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:223 @ loop:
 	INIT_LIST_HEAD(&cur_trans->pending_snapshots);
 	INIT_LIST_HEAD(&cur_trans->pending_chunks);
 	INIT_LIST_HEAD(&cur_trans->switch_commits);
+	INIT_LIST_HEAD(&cur_trans->pending_ordered);
 	list_add_tail(&cur_trans->list, &fs_info->trans_list);
 	extent_io_tree_init(&cur_trans->dirty_pages,
 			     fs_info->btree_inode->i_mapping);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:492 @ again:
 	h->sync = false;
 	INIT_LIST_HEAD(&h->qgroup_ref_list);
 	INIT_LIST_HEAD(&h->new_bgs);
+	INIT_LIST_HEAD(&h->ordered);
 
 	smp_mb();
 	if (cur_trans->state >= TRANS_STATE_BLOCKED &&
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:724 @ static int __btrfs_end_transaction(struc
 	if (!list_empty(&trans->new_bgs))
 		btrfs_create_pending_block_groups(trans, root);
 
+	if (!list_empty(&trans->ordered)) {
+		spin_lock(&info->trans_lock);
+		list_splice(&trans->ordered, &cur_trans->pending_ordered);
+		spin_unlock(&info->trans_lock);
+	}
+
 	trans->delayed_ref_updates = 0;
 	if (!trans->sync) {
 		must_run_delayed_refs =
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1663 @ static inline void btrfs_wait_delalloc_f
 		btrfs_wait_ordered_roots(fs_info, -1);
 }
 
+static inline void
+btrfs_wait_pending_ordered(struct btrfs_transaction *cur_trans,
+			   struct btrfs_fs_info *fs_info)
+{
+	struct btrfs_ordered_extent *ordered;
+
+	spin_lock(&fs_info->trans_lock);
+	while (!list_empty(&cur_trans->pending_ordered)) {
+		ordered = list_first_entry(&cur_trans->pending_ordered,
+					   struct btrfs_ordered_extent,
+					   trans_list);
+		list_del_init(&ordered->trans_list);
+		spin_unlock(&fs_info->trans_lock);
+
+		wait_event(ordered->wait, test_bit(BTRFS_ORDERED_COMPLETE,
+						   &ordered->flags));
+		btrfs_put_ordered_extent(ordered);
+		spin_lock(&fs_info->trans_lock);
+	}
+	spin_unlock(&fs_info->trans_lock);
+}
+
 int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 			     struct btrfs_root *root)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1735 @ int btrfs_commit_transaction(struct btrf
 	}
 
 	spin_lock(&root->fs_info->trans_lock);
+	list_splice(&trans->ordered, &cur_trans->pending_ordered);
 	if (cur_trans->state >= TRANS_STATE_COMMIT_START) {
 		spin_unlock(&root->fs_info->trans_lock);
 		atomic_inc(&cur_trans->use_count);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1788 @ int btrfs_commit_transaction(struct btrf
 
 	btrfs_wait_delalloc_flush(root->fs_info);
 
+	btrfs_wait_pending_ordered(cur_trans, root->fs_info);
+
 	btrfs_scrub_pause(root);
 	/*
 	 * Ok now we need to make sure to block out any other joins while we
Index: linux-3.18.13-rt10-r7s4/fs/btrfs/transaction.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/btrfs/transaction.h
+++ linux-3.18.13-rt10-r7s4/fs/btrfs/transaction.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:59 @ struct btrfs_transaction {
 	wait_queue_head_t commit_wait;
 	struct list_head pending_snapshots;
 	struct list_head pending_chunks;
+	struct list_head pending_ordered;
 	struct list_head switch_commits;
 	struct btrfs_delayed_ref_root delayed_refs;
 	int aborted;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:109 @ struct btrfs_trans_handle {
 	 */
 	struct btrfs_root *root;
 	struct seq_list delayed_ref_elem;
+	struct list_head ordered;
 	struct list_head qgroup_ref_list;
 	struct list_head new_bgs;
 };
Index: linux-3.18.13-rt10-r7s4/fs/btrfs/tree-log.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/btrfs/tree-log.c
+++ linux-3.18.13-rt10-r7s4/fs/btrfs/tree-log.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:491 @ insert:
 		src_item = (struct btrfs_inode_item *)src_ptr;
 		dst_item = (struct btrfs_inode_item *)dst_ptr;
 
-		if (btrfs_inode_generation(eb, src_item) == 0)
+		if (btrfs_inode_generation(eb, src_item) == 0) {
+			struct extent_buffer *dst_eb = path->nodes[0];
+
+			if (S_ISREG(btrfs_inode_mode(eb, src_item)) &&
+			    S_ISREG(btrfs_inode_mode(dst_eb, dst_item))) {
+				struct btrfs_map_token token;
+				u64 ino_size = btrfs_inode_size(eb, src_item);
+
+				btrfs_init_map_token(&token);
+				btrfs_set_token_inode_size(dst_eb, dst_item,
+							   ino_size, &token);
+			}
 			goto no_copy;
+		}
 
 		if (overwrite_root &&
 		    S_ISDIR(btrfs_inode_mode(eb, src_item)) &&
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1013 @ again:
 		base = btrfs_item_ptr_offset(leaf, path->slots[0]);
 
 		while (cur_offset < item_size) {
-			extref = (struct btrfs_inode_extref *)base + cur_offset;
+			extref = (struct btrfs_inode_extref *)(base + cur_offset);
 
 			victim_name_len = btrfs_inode_extref_name_len(leaf, extref);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1269 @ out:
 }
 
 static int insert_orphan_item(struct btrfs_trans_handle *trans,
-			      struct btrfs_root *root, u64 offset)
+			      struct btrfs_root *root, u64 ino)
 {
 	int ret;
-	ret = btrfs_find_item(root, NULL, BTRFS_ORPHAN_OBJECTID,
-			offset, BTRFS_ORPHAN_ITEM_KEY, NULL);
-	if (ret > 0)
-		ret = btrfs_insert_orphan_item(trans, root, offset);
+
+	ret = btrfs_insert_orphan_item(trans, root, ino);
+	if (ret == -EEXIST)
+		ret = 0;
+
 	return ret;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2616 @ int btrfs_sync_log(struct btrfs_trans_ha
 	if (atomic_read(&log_root_tree->log_commit[index2])) {
 		blk_finish_plug(&plug);
 		btrfs_wait_marked_extents(log, &log->dirty_log_pages, mark);
+		btrfs_wait_logged_extents(trans, log, log_transid);
 		wait_log_commit(trans, log_root_tree,
 				root_log_ctx.log_transid);
-		btrfs_free_logged_extents(log, log_transid);
 		mutex_unlock(&log_root_tree->log_mutex);
 		ret = root_log_ctx.log_ret;
 		goto out;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2661 @ int btrfs_sync_log(struct btrfs_trans_ha
 	btrfs_wait_marked_extents(log_root_tree,
 				  &log_root_tree->dirty_log_pages,
 				  EXTENT_NEW | EXTENT_DIRTY);
-	btrfs_wait_logged_extents(log, log_transid);
+	btrfs_wait_logged_extents(trans, log, log_transid);
 
 	btrfs_set_super_log_root(root->fs_info->super_for_commit,
 				log_root_tree->node->start);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3225 @ static int drop_objectid_items(struct bt
 static void fill_inode_item(struct btrfs_trans_handle *trans,
 			    struct extent_buffer *leaf,
 			    struct btrfs_inode_item *item,
-			    struct inode *inode, int log_inode_only)
+			    struct inode *inode, int log_inode_only,
+			    u64 logged_isize)
 {
 	struct btrfs_map_token token;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3239 @ static void fill_inode_item(struct btrfs
 		 * to say 'update this inode with these values'
 		 */
 		btrfs_set_token_inode_generation(leaf, item, 0, &token);
-		btrfs_set_token_inode_size(leaf, item, 0, &token);
+		btrfs_set_token_inode_size(leaf, item, logged_isize, &token);
 	} else {
 		btrfs_set_token_inode_generation(leaf, item,
 						 BTRFS_I(inode)->generation,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3291 @ static int log_inode_item(struct btrfs_t
 		return ret;
 	inode_item = btrfs_item_ptr(path->nodes[0], path->slots[0],
 				    struct btrfs_inode_item);
-	fill_inode_item(trans, path->nodes[0], inode_item, inode, 0);
+	fill_inode_item(trans, path->nodes[0], inode_item, inode, 0, 0);
 	btrfs_release_path(path);
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3300 @ static noinline int copy_items(struct bt
 			       struct inode *inode,
 			       struct btrfs_path *dst_path,
 			       struct btrfs_path *src_path, u64 *last_extent,
-			       int start_slot, int nr, int inode_only)
+			       int start_slot, int nr, int inode_only,
+			       u64 logged_isize)
 {
 	unsigned long src_offset;
 	unsigned long dst_offset;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3358 @ static noinline int copy_items(struct bt
 						    dst_path->slots[0],
 						    struct btrfs_inode_item);
 			fill_inode_item(trans, dst_path->nodes[0], inode_item,
-					inode, inode_only == LOG_INODE_EXISTS);
+					inode, inode_only == LOG_INODE_EXISTS,
+					logged_isize);
 		} else {
 			copy_extent_buffer(dst_path->nodes[0], src, dst_offset,
 					   src_offset, ins_sizes[i]);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3785 @ static int log_one_extent(struct btrfs_t
 	fi = btrfs_item_ptr(leaf, path->slots[0],
 			    struct btrfs_file_extent_item);
 
-	btrfs_set_token_file_extent_generation(leaf, fi, em->generation,
+	btrfs_set_token_file_extent_generation(leaf, fi, trans->transid,
 					       &token);
 	if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
 		btrfs_set_token_file_extent_type(leaf, fi,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3905 @ process:
 	return ret;
 }
 
+static int logged_inode_size(struct btrfs_root *log, struct inode *inode,
+			     struct btrfs_path *path, u64 *size_ret)
+{
+	struct btrfs_key key;
+	int ret;
+
+	key.objectid = btrfs_ino(inode);
+	key.type = BTRFS_INODE_ITEM_KEY;
+	key.offset = 0;
+
+	ret = btrfs_search_slot(NULL, log, &key, path, 0, 0);
+	if (ret < 0) {
+		return ret;
+	} else if (ret > 0) {
+		*size_ret = i_size_read(inode);
+	} else {
+		struct btrfs_inode_item *item;
+
+		item = btrfs_item_ptr(path->nodes[0], path->slots[0],
+				      struct btrfs_inode_item);
+		*size_ret = btrfs_inode_size(path->nodes[0], item);
+	}
+
+	btrfs_release_path(path);
+	return 0;
+}
+
 /* log a single inode in the tree log.
  * At least one parent directory for this inode must exist in the tree
  * or be logged already.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3969 @ static int btrfs_log_inode(struct btrfs_
 	bool fast_search = false;
 	u64 ino = btrfs_ino(inode);
 	struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
+	u64 logged_isize = 0;
 
 	path = btrfs_alloc_path();
 	if (!path)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4023 @ static int btrfs_log_inode(struct btrfs_
 			max_key_type = BTRFS_XATTR_ITEM_KEY;
 		ret = drop_objectid_items(trans, log, path, ino, max_key_type);
 	} else {
+		if (inode_only == LOG_INODE_EXISTS) {
+			/*
+			 * Make sure the new inode item we write to the log has
+			 * the same isize as the current one (if it exists).
+			 * This is necessary to prevent data loss after log
+			 * replay, and also to prevent doing a wrong expanding
+			 * truncate - for e.g. create file, write 4K into offset
+			 * 0, fsync, write 4K into offset 4096, add hard link,
+			 * fsync some other file (to sync log), power fail - if
+			 * we use the inode's current i_size, after log replay
+			 * we get a 8Kb file, with the last 4Kb extent as a hole
+			 * (zeroes), as if an expanding truncate happened,
+			 * instead of getting a file of 4Kb only.
+			 */
+			err = logged_inode_size(log, inode, path,
+						&logged_isize);
+			if (err)
+				goto out_unlock;
+		}
 		if (test_and_clear_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
 				       &BTRFS_I(inode)->runtime_flags)) {
 			clear_bit(BTRFS_INODE_COPY_EVERYTHING,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4097 @ again:
 		}
 
 		ret = copy_items(trans, inode, dst_path, path, &last_extent,
-				 ins_start_slot, ins_nr, inode_only);
+				 ins_start_slot, ins_nr, inode_only,
+				 logged_isize);
 		if (ret < 0) {
 			err = ret;
 			goto out_unlock;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4122 @ next_slot:
 		if (ins_nr) {
 			ret = copy_items(trans, inode, dst_path, path,
 					 &last_extent, ins_start_slot,
-					 ins_nr, inode_only);
+					 ins_nr, inode_only, logged_isize);
 			if (ret < 0) {
 				err = ret;
 				goto out_unlock;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4143 @ next_slot:
 	}
 	if (ins_nr) {
 		ret = copy_items(trans, inode, dst_path, path, &last_extent,
-				 ins_start_slot, ins_nr, inode_only);
+				 ins_start_slot, ins_nr, inode_only,
+				 logged_isize);
 		if (ret < 0) {
 			err = ret;
 			goto out_unlock;
Index: linux-3.18.13-rt10-r7s4/fs/ceph/addr.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ceph/addr.c
+++ linux-3.18.13-rt10-r7s4/fs/ceph/addr.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:676 @ static int ceph_writepages_start(struct
 	int rc = 0;
 	unsigned wsize = 1 << inode->i_blkbits;
 	struct ceph_osd_request *req = NULL;
-	int do_sync;
+	int do_sync = 0;
 	u64 truncate_size, snap_size;
 	u32 truncate_seq;
 
Index: linux-3.18.13-rt10-r7s4/fs/ceph/dir.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ceph/dir.c
+++ linux-3.18.13-rt10-r7s4/fs/ceph/dir.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:114 @ static int fpos_cmp(loff_t l, loff_t r)
 /*
  * When possible, we try to satisfy a readdir by peeking at the
  * dcache.  We make this work by carefully ordering dentries on
- * d_u.d_child when we initially get results back from the MDS, and
+ * d_child when we initially get results back from the MDS, and
  * falling back to a "normal" sync readdir if any dentries in the dir
  * are dropped.
  *
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:150 @ static int __dcache_readdir(struct file
 		p = parent->d_subdirs.prev;
 		dout(" initial p %p/%p\n", p->prev, p->next);
 	} else {
-		p = last->d_u.d_child.prev;
+		p = last->d_child.prev;
 	}
 
 more:
-	dentry = list_entry(p, struct dentry, d_u.d_child);
+	dentry = list_entry(p, struct dentry, d_child);
 	di = ceph_dentry(dentry);
 	while (1) {
 		dout(" p %p/%p %s d_subdirs %p/%p\n", p->prev, p->next,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:177 @ more:
 		     !dentry->d_inode ? " null" : "");
 		spin_unlock(&dentry->d_lock);
 		p = p->prev;
-		dentry = list_entry(p, struct dentry, d_u.d_child);
+		dentry = list_entry(p, struct dentry, d_child);
 		di = ceph_dentry(dentry);
 	}
 
Index: linux-3.18.13-rt10-r7s4/fs/ceph/inode.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ceph/inode.c
+++ linux-3.18.13-rt10-r7s4/fs/ceph/inode.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1402 @ retry_lookup:
 			/* reorder parent's d_subdirs */
 			spin_lock(&parent->d_lock);
 			spin_lock_nested(&dn->d_lock, DENTRY_D_LOCK_NESTED);
-			list_move(&dn->d_u.d_child, &parent->d_subdirs);
+			list_move(&dn->d_child, &parent->d_subdirs);
 			spin_unlock(&dn->d_lock);
 			spin_unlock(&parent->d_lock);
 		}
Index: linux-3.18.13-rt10-r7s4/fs/cifs/file.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/cifs/file.c
+++ linux-3.18.13-rt10-r7s4/fs/cifs/file.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:369 @ void cifsFileInfo_put(struct cifsFileInf
 	struct cifsLockInfo *li, *tmp;
 	struct cifs_fid fid;
 	struct cifs_pending_open open;
+	bool oplock_break_cancelled;
 
 	spin_lock(&cifs_file_list_lock);
 	if (--cifs_file->count > 0) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:401 @ void cifsFileInfo_put(struct cifsFileInf
 	}
 	spin_unlock(&cifs_file_list_lock);
 
-	cancel_work_sync(&cifs_file->oplock_break);
+	oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break);
 
 	if (!tcon->need_reconnect && !cifs_file->invalidHandle) {
 		struct TCP_Server_Info *server = tcon->ses->server;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:413 @ void cifsFileInfo_put(struct cifsFileInf
 		_free_xid(xid);
 	}
 
+	if (oplock_break_cancelled)
+		cifs_done_oplock_break(cifsi);
+
 	cifs_del_pending_open(&open);
 
 	/*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1832 @ refind_writable:
 			cifsFileInfo_put(inv_file);
 			spin_lock(&cifs_file_list_lock);
 			++refind;
+			inv_file = NULL;
 			goto refind_writable;
 		}
 	}
Index: linux-3.18.13-rt10-r7s4/fs/cifs/inode.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/cifs/inode.c
+++ linux-3.18.13-rt10-r7s4/fs/cifs/inode.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:898 @ inode_has_hashed_dentries(struct inode *
 	struct dentry *dentry;
 
 	spin_lock(&inode->i_lock);
-	hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
+	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
 		if (!d_unhashed(dentry) || IS_ROOT(dentry)) {
 			spin_unlock(&inode->i_lock);
 			return true;
Index: linux-3.18.13-rt10-r7s4/fs/cifs/ioctl.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/cifs/ioctl.c
+++ linux-3.18.13-rt10-r7s4/fs/cifs/ioctl.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:89 @ static long cifs_ioctl_clone(unsigned in
 	}
 
 	src_inode = file_inode(src_file.file);
+	rc = -EINVAL;
+	if (S_ISDIR(src_inode->i_mode))
+		goto out_fput;
 
 	/*
 	 * Note: cifs case is easier than btrfs since server responsible for
 	 * checks for proper open modes and file type and if it wants
 	 * server could even support copy of range where source = target
 	 */
-
-	/* so we do not deadlock racing two ioctls on same files */
-	if (target_inode < src_inode) {
-		mutex_lock_nested(&target_inode->i_mutex, I_MUTEX_PARENT);
-		mutex_lock_nested(&src_inode->i_mutex, I_MUTEX_CHILD);
-	} else {
-		mutex_lock_nested(&src_inode->i_mutex, I_MUTEX_PARENT);
-		mutex_lock_nested(&target_inode->i_mutex, I_MUTEX_CHILD);
-	}
+	lock_two_nondirectories(target_inode, src_inode);
 
 	/* determine range to clone */
 	rc = -EINVAL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:122 @ static long cifs_ioctl_clone(unsigned in
 out_unlock:
 	/* although unlocking in the reverse order from locking is not
 	   strictly necessary here it is a little cleaner to be consistent */
-	if (target_inode < src_inode) {
-		mutex_unlock(&src_inode->i_mutex);
-		mutex_unlock(&target_inode->i_mutex);
-	} else {
-		mutex_unlock(&target_inode->i_mutex);
-		mutex_unlock(&src_inode->i_mutex);
-	}
+	unlock_two_nondirectories(src_inode, target_inode);
 out_fput:
 	fdput(src_file);
 out_drop_write:
Index: linux-3.18.13-rt10-r7s4/fs/cifs/smb2ops.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/cifs/smb2ops.c
+++ linux-3.18.13-rt10-r7s4/fs/cifs/smb2ops.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:686 @ smb2_clone_range(const unsigned int xid,
 
 			/* No need to change MaxChunks since already set to 1 */
 			chunk_sizes_updated = true;
-		}
+		} else
+			goto cchunk_out;
 	}
 
 cchunk_out:
Index: linux-3.18.13-rt10-r7s4/fs/coda/cache.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/coda/cache.c
+++ linux-3.18.13-rt10-r7s4/fs/coda/cache.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:95 @ static void coda_flag_children(struct de
 	struct dentry *de;
 
 	spin_lock(&parent->d_lock);
-	list_for_each_entry(de, &parent->d_subdirs, d_u.d_child) {
+	list_for_each_entry(de, &parent->d_subdirs, d_child) {
 		/* don't know what to do with negative dentries */
 		if (de->d_inode ) 
 			coda_flag_inode(de->d_inode, flag);
Index: linux-3.18.13-rt10-r7s4/fs/dcache.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/dcache.c
+++ linux-3.18.13-rt10-r7s4/fs/dcache.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:47 @
 /*
  * Usage:
  * dcache->d_inode->i_lock protects:
- *   - i_dentry, d_alias, d_inode of aliases
+ *   - i_dentry, d_u.d_alias, d_inode of aliases
  * dcache_hash_bucket lock protects:
  *   - the dcache hash table
  * s_anon bl list spinlock protects:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:62 @
  *   - d_unhashed()
  *   - d_parent and d_subdirs
  *   - childrens' d_child and d_parent
- *   - d_alias, d_inode
+ *   - d_u.d_alias, d_inode
  *
  * Ordering:
  * dentry->d_inode->i_lock
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:255 @ static void __d_free(struct rcu_head *he
 {
 	struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
 
-	WARN_ON(!hlist_unhashed(&dentry->d_alias));
 	kmem_cache_free(dentry_cache, dentry); 
 }
 
 static void __d_free_external(struct rcu_head *head)
 {
 	struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
-	WARN_ON(!hlist_unhashed(&dentry->d_alias));
 	kfree(external_name(dentry));
 	kmem_cache_free(dentry_cache, dentry); 
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:272 @ static inline int dname_external(const s
 
 static void dentry_free(struct dentry *dentry)
 {
+	WARN_ON(!hlist_unhashed(&dentry->d_u.d_alias));
 	if (unlikely(dname_external(dentry))) {
 		struct external_name *p = external_name(dentry);
 		if (likely(atomic_dec_and_test(&p->u.count))) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:313 @ static void dentry_iput(struct dentry *
 	struct inode *inode = dentry->d_inode;
 	if (inode) {
 		dentry->d_inode = NULL;
-		hlist_del_init(&dentry->d_alias);
+		hlist_del_init(&dentry->d_u.d_alias);
 		spin_unlock(&dentry->d_lock);
 		spin_unlock(&inode->i_lock);
 		if (!inode->i_nlink)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:338 @ static void dentry_unlink_inode(struct d
 	struct inode *inode = dentry->d_inode;
 	__d_clear_type(dentry);
 	dentry->d_inode = NULL;
-	hlist_del_init(&dentry->d_alias);
+	hlist_del_init(&dentry->d_u.d_alias);
 	dentry_rcuwalk_barrier(dentry);
 	spin_unlock(&dentry->d_lock);
 	spin_unlock(&inode->i_lock);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:498 @ static void __dentry_kill(struct dentry
 	}
 	/* if it was on the hash then remove it */
 	__d_drop(dentry);
-	list_del(&dentry->d_u.d_child);
+	__list_del_entry(&dentry->d_child);
 	/*
 	 * Inform d_walk() that we are no longer attached to the
 	 * dentry tree
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:724 @ static struct dentry *__d_find_alias(str
 
 again:
 	discon_alias = NULL;
-	hlist_for_each_entry(alias, &inode->i_dentry, d_alias) {
+	hlist_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
 		spin_lock(&alias->d_lock);
  		if (S_ISDIR(inode->i_mode) || !d_unhashed(alias)) {
 			if (IS_ROOT(alias) &&
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:774 @ void d_prune_aliases(struct inode *inode
 	struct dentry *dentry;
 restart:
 	spin_lock(&inode->i_lock);
-	hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
+	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
 		spin_lock(&dentry->d_lock);
 		if (!dentry->d_lockref.count) {
 			struct dentry *parent = lock_parent(dentry);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1053 @ repeat:
 resume:
 	while (next != &this_parent->d_subdirs) {
 		struct list_head *tmp = next;
-		struct dentry *dentry = list_entry(tmp, struct dentry, d_u.d_child);
+		struct dentry *dentry = list_entry(tmp, struct dentry, d_child);
 		next = tmp->next;
 
 		spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1085 @ resume:
 	/*
 	 * All done at this level ... ascend and resume the search.
 	 */
+	rcu_read_lock();
+ascend:
 	if (this_parent != parent) {
 		struct dentry *child = this_parent;
 		this_parent = child->d_parent;
 
-		rcu_read_lock();
 		spin_unlock(&child->d_lock);
 		spin_lock(&this_parent->d_lock);
 
-		/*
-		 * might go back up the wrong parent if we have had a rename
-		 * or deletion
-		 */
-		if (this_parent != child->d_parent ||
-			 (child->d_flags & DCACHE_DENTRY_KILLED) ||
-			 need_seqretry(&rename_lock, seq)) {
-			spin_unlock(&this_parent->d_lock);
-			rcu_read_unlock();
+		/* might go back up the wrong parent if we have had a rename. */
+		if (need_seqretry(&rename_lock, seq))
 			goto rename_retry;
+		next = child->d_child.next;
+		while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
+			if (next == &this_parent->d_subdirs)
+				goto ascend;
+			child = list_entry(next, struct dentry, d_child);
+			next = next->next;
 		}
 		rcu_read_unlock();
-		next = child->d_u.d_child.next;
 		goto resume;
 	}
-	if (need_seqretry(&rename_lock, seq)) {
-		spin_unlock(&this_parent->d_lock);
+	if (need_seqretry(&rename_lock, seq))
 		goto rename_retry;
-	}
+	rcu_read_unlock();
 	if (finish)
 		finish(data);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1119 @ out_unlock:
 	return;
 
 rename_retry:
+	spin_unlock(&this_parent->d_lock);
+	rcu_read_unlock();
+	BUG_ON(seq & 1);
 	if (!retry)
 		return;
 	seq = 1;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1458 @ struct dentry *__d_alloc(struct super_bl
 	INIT_HLIST_BL_NODE(&dentry->d_hash);
 	INIT_LIST_HEAD(&dentry->d_lru);
 	INIT_LIST_HEAD(&dentry->d_subdirs);
-	INIT_HLIST_NODE(&dentry->d_alias);
-	INIT_LIST_HEAD(&dentry->d_u.d_child);
+	INIT_HLIST_NODE(&dentry->d_u.d_alias);
+	INIT_LIST_HEAD(&dentry->d_child);
 	d_set_d_op(dentry, dentry->d_sb->s_d_op);
 
 	this_cpu_inc(nr_dentry);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1489 @ struct dentry *d_alloc(struct dentry * p
 	 */
 	__dget_dlock(parent);
 	dentry->d_parent = parent;
-	list_add(&dentry->d_u.d_child, &parent->d_subdirs);
+	list_add(&dentry->d_child, &parent->d_subdirs);
 	spin_unlock(&parent->d_lock);
 
 	return dentry;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1582 @ static void __d_instantiate(struct dentr
 	spin_lock(&dentry->d_lock);
 	__d_set_type(dentry, add_flags);
 	if (inode)
-		hlist_add_head(&dentry->d_alias, &inode->i_dentry);
+		hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry);
 	dentry->d_inode = inode;
 	dentry_rcuwalk_barrier(dentry);
 	spin_unlock(&dentry->d_lock);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1606 @ static void __d_instantiate(struct dentr
  
 void d_instantiate(struct dentry *entry, struct inode * inode)
 {
-	BUG_ON(!hlist_unhashed(&entry->d_alias));
+	BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
 	if (inode)
 		spin_lock(&inode->i_lock);
 	__d_instantiate(entry, inode);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1645 @ static struct dentry *__d_instantiate_un
 		return NULL;
 	}
 
-	hlist_for_each_entry(alias, &inode->i_dentry, d_alias) {
+	hlist_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
 		/*
 		 * Don't need alias->d_lock here, because aliases with
 		 * d_parent == entry->d_parent are not subject to name or
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1671 @ struct dentry *d_instantiate_unique(stru
 {
 	struct dentry *result;
 
-	BUG_ON(!hlist_unhashed(&entry->d_alias));
+	BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
 
 	if (inode)
 		spin_lock(&inode->i_lock);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1702 @ EXPORT_SYMBOL(d_instantiate_unique);
  */
 int d_instantiate_no_diralias(struct dentry *entry, struct inode *inode)
 {
-	BUG_ON(!hlist_unhashed(&entry->d_alias));
+	BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
 
 	spin_lock(&inode->i_lock);
 	if (S_ISDIR(inode->i_mode) && !hlist_empty(&inode->i_dentry)) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1741 @ static struct dentry * __d_find_any_alia
 
 	if (hlist_empty(&inode->i_dentry))
 		return NULL;
-	alias = hlist_entry(inode->i_dentry.first, struct dentry, d_alias);
+	alias = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias);
 	__dget(alias);
 	return alias;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1803 @ static struct dentry *__d_obtain_alias(s
 	spin_lock(&tmp->d_lock);
 	tmp->d_inode = inode;
 	tmp->d_flags |= add_flags;
-	hlist_add_head(&tmp->d_alias, &inode->i_dentry);
+	hlist_add_head(&tmp->d_u.d_alias, &inode->i_dentry);
 	hlist_bl_lock(&tmp->d_sb->s_anon);
 	hlist_bl_add_head(&tmp->d_hash, &tmp->d_sb->s_anon);
 	hlist_bl_unlock(&tmp->d_sb->s_anon);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2238 @ int d_validate(struct dentry *dentry, st
 	struct dentry *child;
 
 	spin_lock(&dparent->d_lock);
-	list_for_each_entry(child, &dparent->d_subdirs, d_u.d_child) {
+	list_for_each_entry(child, &dparent->d_subdirs, d_child) {
 		if (dentry == child) {
 			spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
 			__dget_dlock(dentry);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2396 @ static void swap_names(struct dentry *de
 			 */
 			unsigned int i;
 			BUILD_BUG_ON(!IS_ALIGNED(DNAME_INLINE_LEN, sizeof(long)));
+			kmemcheck_mark_initialized(dentry->d_iname, DNAME_INLINE_LEN);
+			kmemcheck_mark_initialized(target->d_iname, DNAME_INLINE_LEN);
 			for (i = 0; i < DNAME_INLINE_LEN / sizeof(long); i++) {
 				swap(((long *) &dentry->d_iname)[i],
 				     ((long *) &target->d_iname)[i]);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2531 @ static void __d_move(struct dentry *dent
 		/* splicing a tree */
 		dentry->d_parent = target->d_parent;
 		target->d_parent = target;
-		list_del_init(&target->d_u.d_child);
-		list_move(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
+		list_del_init(&target->d_child);
+		list_move(&dentry->d_child, &dentry->d_parent->d_subdirs);
 	} else {
 		/* swapping two dentries */
 		swap(dentry->d_parent, target->d_parent);
-		list_move(&target->d_u.d_child, &target->d_parent->d_subdirs);
-		list_move(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
+		list_move(&target->d_child, &target->d_parent->d_subdirs);
+		list_move(&dentry->d_child, &dentry->d_parent->d_subdirs);
 		if (exchange)
 			fsnotify_d_move(target);
 		fsnotify_d_move(dentry);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3326 @ void d_tmpfile(struct dentry *dentry, st
 {
 	inode_dec_link_count(inode);
 	BUG_ON(dentry->d_name.name != dentry->d_iname ||
-		!hlist_unhashed(&dentry->d_alias) ||
+		!hlist_unhashed(&dentry->d_u.d_alias) ||
 		!d_unlinked(dentry));
 	spin_lock(&dentry->d_parent->d_lock);
 	spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
Index: linux-3.18.13-rt10-r7s4/fs/debugfs/inode.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/debugfs/inode.c
+++ linux-3.18.13-rt10-r7s4/fs/debugfs/inode.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:249 @ static int debugfs_show_options(struct s
 	return 0;
 }
 
+static void debugfs_evict_inode(struct inode *inode)
+{
+	truncate_inode_pages_final(&inode->i_data);
+	clear_inode(inode);
+	if (S_ISLNK(inode->i_mode))
+		kfree(inode->i_private);
+}
+
 static const struct super_operations debugfs_super_operations = {
 	.statfs		= simple_statfs,
 	.remount_fs	= debugfs_remount,
 	.show_options	= debugfs_show_options,
+	.evict_inode	= debugfs_evict_inode,
 };
 
 static int debug_fill_super(struct super_block *sb, void *data, int silent)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:478 @ static int __debugfs_remove(struct dentr
 	int ret = 0;
 
 	if (debugfs_positive(dentry)) {
-		if (dentry->d_inode) {
-			dget(dentry);
-			switch (dentry->d_inode->i_mode & S_IFMT) {
-			case S_IFDIR:
-				ret = simple_rmdir(parent->d_inode, dentry);
-				break;
-			case S_IFLNK:
-				kfree(dentry->d_inode->i_private);
-				/* fall through */
-			default:
-				simple_unlink(parent->d_inode, dentry);
-				break;
-			}
-			if (!ret)
-				d_delete(dentry);
-			dput(dentry);
-		}
+		dget(dentry);
+		if (S_ISDIR(dentry->d_inode->i_mode))
+			ret = simple_rmdir(parent->d_inode, dentry);
+		else
+			simple_unlink(parent->d_inode, dentry);
+		if (!ret)
+			d_delete(dentry);
+		dput(dentry);
 	}
 	return ret;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:556 @ void debugfs_remove_recursive(struct den
 	 * use the d_u.d_child as the rcu head and corrupt this list.
 	 */
 	spin_lock(&parent->d_lock);
-	list_for_each_entry(child, &parent->d_subdirs, d_u.d_child) {
+	list_for_each_entry(child, &parent->d_subdirs, d_child) {
 		if (!debugfs_positive(child))
 			continue;
 
Index: linux-3.18.13-rt10-r7s4/fs/ecryptfs/crypto.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ecryptfs/crypto.c
+++ linux-3.18.13-rt10-r7s4/fs/ecryptfs/crypto.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1920 @ ecryptfs_decode_from_filename(unsigned c
 			break;
 		case 2:
 			dst[dst_byte_offset++] |= (src_byte);
-			dst[dst_byte_offset] = 0;
 			current_bit_offset = 0;
 			break;
 		}
Index: linux-3.18.13-rt10-r7s4/fs/ecryptfs/file.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ecryptfs/file.c
+++ linux-3.18.13-rt10-r7s4/fs/ecryptfs/file.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:193 @ static int ecryptfs_open(struct inode *i
 {
 	int rc = 0;
 	struct ecryptfs_crypt_stat *crypt_stat = NULL;
-	struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
 	struct dentry *ecryptfs_dentry = file->f_path.dentry;
 	/* Private value of ecryptfs_dentry allocated in
 	 * ecryptfs_lookup() */
 	struct ecryptfs_file_info *file_info;
 
-	mount_crypt_stat = &ecryptfs_superblock_to_private(
-		ecryptfs_dentry->d_sb)->mount_crypt_stat;
-	if ((mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
-	    && ((file->f_flags & O_WRONLY) || (file->f_flags & O_RDWR)
-		|| (file->f_flags & O_CREAT) || (file->f_flags & O_TRUNC)
-		|| (file->f_flags & O_APPEND))) {
-		printk(KERN_WARNING "Mount has encrypted view enabled; "
-		       "files may only be read\n");
-		rc = -EPERM;
-		goto out;
-	}
 	/* Released in ecryptfs_release or end of function if failure */
 	file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
 	ecryptfs_set_file_private(file, file_info);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:306 @ ecryptfs_unlocked_ioctl(struct file *fil
 	struct file *lower_file = ecryptfs_file_to_lower(file);
 	long rc = -ENOTTY;
 
-	if (lower_file->f_op->unlocked_ioctl)
+	if (!lower_file->f_op->unlocked_ioctl)
+		return rc;
+
+	switch (cmd) {
+	case FITRIM:
+	case FS_IOC_GETFLAGS:
+	case FS_IOC_SETFLAGS:
+	case FS_IOC_GETVERSION:
+	case FS_IOC_SETVERSION:
 		rc = lower_file->f_op->unlocked_ioctl(lower_file, cmd, arg);
-	return rc;
+		fsstack_copy_attr_all(file_inode(file), file_inode(lower_file));
+
+		return rc;
+	default:
+		return rc;
+	}
 }
 
 #ifdef CONFIG_COMPAT
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:331 @ ecryptfs_compat_ioctl(struct file *file,
 	struct file *lower_file = ecryptfs_file_to_lower(file);
 	long rc = -ENOIOCTLCMD;
 
-	if (lower_file->f_op->compat_ioctl)
+	if (!lower_file->f_op->compat_ioctl)
+		return rc;
+
+	switch (cmd) {
+	case FITRIM:
+	case FS_IOC32_GETFLAGS:
+	case FS_IOC32_SETFLAGS:
+	case FS_IOC32_GETVERSION:
+	case FS_IOC32_SETVERSION:
 		rc = lower_file->f_op->compat_ioctl(lower_file, cmd, arg);
-	return rc;
+		fsstack_copy_attr_all(file_inode(file), file_inode(lower_file));
+
+		return rc;
+	default:
+		return rc;
+	}
 }
 #endif
 
Index: linux-3.18.13-rt10-r7s4/fs/ecryptfs/main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ecryptfs/main.c
+++ linux-3.18.13-rt10-r7s4/fs/ecryptfs/main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:496 @ static struct dentry *ecryptfs_mount(str
 {
 	struct super_block *s;
 	struct ecryptfs_sb_info *sbi;
+	struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
 	struct ecryptfs_dentry_info *root_info;
 	const char *err = "Getting sb failed";
 	struct inode *inode;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:515 @ static struct dentry *ecryptfs_mount(str
 		err = "Error parsing options";
 		goto out;
 	}
+	mount_crypt_stat = &sbi->mount_crypt_stat;
 
 	s = sget(fs_type, NULL, set_anon_super, flags, NULL);
 	if (IS_ERR(s)) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:562 @ static struct dentry *ecryptfs_mount(str
 
 	/**
 	 * Set the POSIX ACL flag based on whether they're enabled in the lower
-	 * mount. Force a read-only eCryptfs mount if the lower mount is ro.
-	 * Allow a ro eCryptfs mount even when the lower mount is rw.
+	 * mount.
 	 */
 	s->s_flags = flags & ~MS_POSIXACL;
-	s->s_flags |= path.dentry->d_sb->s_flags & (MS_RDONLY | MS_POSIXACL);
+	s->s_flags |= path.dentry->d_sb->s_flags & MS_POSIXACL;
+
+	/**
+	 * Force a read-only eCryptfs mount when:
+	 *   1) The lower mount is ro
+	 *   2) The ecryptfs_encrypted_view mount option is specified
+	 */
+	if (path.dentry->d_sb->s_flags & MS_RDONLY ||
+	    mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
+		s->s_flags |= MS_RDONLY;
 
 	s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
 	s->s_blocksize = path.dentry->d_sb->s_blocksize;
Index: linux-3.18.13-rt10-r7s4/fs/exportfs/expfs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/exportfs/expfs.c
+++ linux-3.18.13-rt10-r7s4/fs/exportfs/expfs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:53 @ find_acceptable_alias(struct dentry *res
 
 	inode = result->d_inode;
 	spin_lock(&inode->i_lock);
-	hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
+	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
 		dget(dentry);
 		spin_unlock(&inode->i_lock);
 		if (toput)
Index: linux-3.18.13-rt10-r7s4/fs/ext4/indirect.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ext4/indirect.c
+++ linux-3.18.13-rt10-r7s4/fs/ext4/indirect.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1396 @ end_range:
 				 * to free. Everything was covered by the start
 				 * of the range.
 				 */
-				return 0;
-			} else {
-				/* Shared branch grows from an indirect block */
-				partial2--;
+				goto do_indirects;
 			}
 		} else {
 			/*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1427 @ end_range:
 	/* Punch happened within the same level (n == n2) */
 	partial = ext4_find_shared(inode, n, offsets, chain, &nr);
 	partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
-	/*
-	 * ext4_find_shared returns Indirect structure which
-	 * points to the last element which should not be
-	 * removed by truncate. But this is end of the range
-	 * in punch_hole so we need to point to the next element
-	 */
-	partial2->p++;
-	while ((partial > chain) || (partial2 > chain2)) {
-		/* We're at the same block, so we're almost finished */
-		if ((partial->bh && partial2->bh) &&
-		    (partial->bh->b_blocknr == partial2->bh->b_blocknr)) {
-			if ((partial > chain) && (partial2 > chain2)) {
+
+	/* Free top, but only if partial2 isn't its subtree. */
+	if (nr) {
+		int level = min(partial - chain, partial2 - chain2);
+		int i;
+		int subtree = 1;
+
+		for (i = 0; i <= level; i++) {
+			if (offsets[i] != offsets2[i]) {
+				subtree = 0;
+				break;
+			}
+		}
+
+		if (!subtree) {
+			if (partial == chain) {
+				/* Shared branch grows from the inode */
+				ext4_free_branches(handle, inode, NULL,
+						   &nr, &nr+1,
+						   (chain+n-1) - partial);
+				*partial->p = 0;
+			} else {
+				/* Shared branch grows from an indirect block */
+				BUFFER_TRACE(partial->bh, "get_write_access");
 				ext4_free_branches(handle, inode, partial->bh,
-						   partial->p + 1,
-						   partial2->p,
+						   partial->p,
+						   partial->p+1,
 						   (chain+n-1) - partial);
-				BUFFER_TRACE(partial->bh, "call brelse");
-				brelse(partial->bh);
-				BUFFER_TRACE(partial2->bh, "call brelse");
-				brelse(partial2->bh);
 			}
-			return 0;
 		}
+	}
+
+	if (!nr2) {
 		/*
-		 * Clear the ends of indirect blocks on the shared branch
-		 * at the start of the range
+		 * ext4_find_shared returns Indirect structure which
+		 * points to the last element which should not be
+		 * removed by truncate. But this is end of the range
+		 * in punch_hole so we need to point to the next element
 		 */
-		if (partial > chain) {
+		partial2->p++;
+	}
+
+	while (partial > chain || partial2 > chain2) {
+		int depth = (chain+n-1) - partial;
+		int depth2 = (chain2+n2-1) - partial2;
+
+		if (partial > chain && partial2 > chain2 &&
+		    partial->bh->b_blocknr == partial2->bh->b_blocknr) {
+			/*
+			 * We've converged on the same block. Clear the range,
+			 * then we're done.
+			 */
 			ext4_free_branches(handle, inode, partial->bh,
-				   partial->p + 1,
-				   (__le32 *)partial->bh->b_data+addr_per_block,
-				   (chain+n-1) - partial);
+					   partial->p + 1,
+					   partial2->p,
+					   (chain+n-1) - partial);
 			BUFFER_TRACE(partial->bh, "call brelse");
 			brelse(partial->bh);
-			partial--;
+			BUFFER_TRACE(partial2->bh, "call brelse");
+			brelse(partial2->bh);
+			return 0;
 		}
+
 		/*
-		 * Clear the ends of indirect blocks on the shared branch
-		 * at the end of the range
+		 * The start and end partial branches may not be at the same
+		 * level even though the punch happened within one level. So, we
+		 * give them a chance to arrive at the same level, then walk
+		 * them in step with each other until we converge on the same
+		 * block.
 		 */
-		if (partial2 > chain2) {
+		if (partial > chain && depth <= depth2) {
+			ext4_free_branches(handle, inode, partial->bh,
+					   partial->p + 1,
+					   (__le32 *)partial->bh->b_data+addr_per_block,
+					   (chain+n-1) - partial);
+			BUFFER_TRACE(partial->bh, "call brelse");
+			brelse(partial->bh);
+			partial--;
+		}
+		if (partial2 > chain2 && depth2 <= depth) {
 			ext4_free_branches(handle, inode, partial2->bh,
 					   (__le32 *)partial2->bh->b_data,
 					   partial2->p,
-					   (chain2+n-1) - partial2);
+					   (chain2+n2-1) - partial2);
 			BUFFER_TRACE(partial2->bh, "call brelse");
 			brelse(partial2->bh);
 			partial2--;
 		}
 	}
+	return 0;
 
 do_indirects:
 	/* Kill the remaining (whole) subtrees */
Index: linux-3.18.13-rt10-r7s4/fs/ext4/super.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ext4/super.c
+++ linux-3.18.13-rt10-r7s4/fs/ext4/super.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4852 @ static int ext4_remount(struct super_blo
 	if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^
 	    test_opt(sb, JOURNAL_CHECKSUM)) {
 		ext4_msg(sb, KERN_ERR, "changing journal_checksum "
-			 "during remount not supported");
-		err = -EINVAL;
-		goto restore_opts;
+			 "during remount not supported; ignoring");
+		sbi->s_mount_opt ^= EXT4_MOUNT_JOURNAL_CHECKSUM;
 	}
 
 	if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) {
Index: linux-3.18.13-rt10-r7s4/fs/f2fs/data.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/f2fs/data.c
+++ linux-3.18.13-rt10-r7s4/fs/f2fs/data.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1010 @ inline_data:
 		goto out;
 	}
 
-	if (dn.data_blkaddr == NEW_ADDR) {
+	if (f2fs_has_inline_data(inode)) {
+		err = f2fs_read_inline_data(inode, page);
+		if (err) {
+			page_cache_release(page);
+			goto fail;
+		}
+	} else if (dn.data_blkaddr == NEW_ADDR) {
 		zero_user_segment(page, 0, PAGE_CACHE_SIZE);
 	} else {
-		if (f2fs_has_inline_data(inode)) {
-			err = f2fs_read_inline_data(inode, page);
-			if (err) {
-				page_cache_release(page);
-				goto fail;
-			}
-		} else {
-			err = f2fs_submit_page_bio(sbi, page, dn.data_blkaddr,
-							READ_SYNC);
-			if (err)
-				goto fail;
-		}
+		err = f2fs_submit_page_bio(sbi, page, dn.data_blkaddr,
+					   READ_SYNC);
+		if (err)
+			goto fail;
 
 		lock_page(page);
 		if (unlikely(!PageUptodate(page))) {
Index: linux-3.18.13-rt10-r7s4/fs/f2fs/segment.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/f2fs/segment.c
+++ linux-3.18.13-rt10-r7s4/fs/f2fs/segment.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1007 @ int f2fs_trim_fs(struct f2fs_sb_info *sb
 						range->len < sbi->blocksize)
 		return -EINVAL;
 
+	cpc.trimmed = 0;
 	if (end <= MAIN_BLKADDR(sbi))
 		goto out;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1019 @ int f2fs_trim_fs(struct f2fs_sb_info *sb
 	cpc.trim_start = start_segno;
 	cpc.trim_end = end_segno;
 	cpc.trim_minlen = range->minlen >> sbi->log_blocksize;
-	cpc.trimmed = 0;
 
 	/* do checkpoint to issue discard commands safely */
 	write_checkpoint(sbi, &cpc);
Index: linux-3.18.13-rt10-r7s4/fs/fs-writeback.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/fs-writeback.c
+++ linux-3.18.13-rt10-r7s4/fs/fs-writeback.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:482 @ __writeback_single_inode(struct inode *i
 	 * write_inode()
 	 */
 	spin_lock(&inode->i_lock);
-	/* Clear I_DIRTY_PAGES if we've written out all dirty pages */
-	if (!mapping_tagged(mapping, PAGECACHE_TAG_DIRTY))
-		inode->i_state &= ~I_DIRTY_PAGES;
+
 	dirty = inode->i_state & I_DIRTY;
-	inode->i_state &= ~(I_DIRTY_SYNC | I_DIRTY_DATASYNC);
+	inode->i_state &= ~I_DIRTY;
+
+	/*
+	 * Paired with smp_mb() in __mark_inode_dirty().  This allows
+	 * __mark_inode_dirty() to test i_state without grabbing i_lock -
+	 * either they see the I_DIRTY bits cleared or we see the dirtied
+	 * inode.
+	 *
+	 * I_DIRTY_PAGES is always cleared together above even if @mapping
+	 * still has dirty pages.  The flag is reinstated after smp_mb() if
+	 * necessary.  This guarantees that either __mark_inode_dirty()
+	 * sees clear I_DIRTY_PAGES or we see PAGECACHE_TAG_DIRTY.
+	 */
+	smp_mb();
+
+	if (mapping_tagged(mapping, PAGECACHE_TAG_DIRTY))
+		inode->i_state |= I_DIRTY_PAGES;
+
 	spin_unlock(&inode->i_lock);
+
 	/* Don't write the inode if only I_DIRTY_PAGES was set */
 	if (dirty & (I_DIRTY_SYNC | I_DIRTY_DATASYNC)) {
 		int err = write_inode(inode, wbc);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1167 @ void __mark_inode_dirty(struct inode *in
 	}
 
 	/*
-	 * make sure that changes are seen by all cpus before we test i_state
-	 * -- mikulas
+	 * Paired with smp_mb() in __writeback_single_inode() for the
+	 * following lockless i_state test.  See there for details.
 	 */
 	smp_mb();
 
-	/* avoid the locking if we can */
 	if ((inode->i_state & flags) == flags)
 		return;
 
Index: linux-3.18.13-rt10-r7s4/fs/fuse/dev.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/fuse/dev.c
+++ linux-3.18.13-rt10-r7s4/fs/fuse/dev.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:817 @ static int fuse_try_move_page(struct fus
 
 	newpage = buf->page;
 
-	if (WARN_ON(!PageUptodate(newpage)))
-		return -EIO;
+	if (!PageUptodate(newpage))
+		SetPageUptodate(newpage);
 
 	ClearPageMappedToDisk(newpage);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1724 @ copy_finish:
 static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
 		       unsigned int size, struct fuse_copy_state *cs)
 {
+	/* Don't try to move pages (yet) */
+	cs->move_pages = 0;
+
 	switch (code) {
 	case FUSE_NOTIFY_POLL:
 		return fuse_notify_poll(fc, size, cs);
Index: linux-3.18.13-rt10-r7s4/fs/gfs2/acl.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/gfs2/acl.c
+++ linux-3.18.13-rt10-r7s4/fs/gfs2/acl.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:76 @ int gfs2_set_acl(struct inode *inode, st
 
 	BUG_ON(name == NULL);
 
-	if (acl->a_count > GFS2_ACL_MAX_ENTRIES(GFS2_SB(inode)))
+	if (acl && acl->a_count > GFS2_ACL_MAX_ENTRIES(GFS2_SB(inode)))
 		return -E2BIG;
 
 	if (type == ACL_TYPE_ACCESS) {
Index: linux-3.18.13-rt10-r7s4/fs/gfs2/quota.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/gfs2/quota.c
+++ linux-3.18.13-rt10-r7s4/fs/gfs2/quota.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:670 @ static void do_qc(struct gfs2_quota_data
 
 static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
 			     s64 change, struct gfs2_quota_data *qd,
-			     struct fs_disk_quota *fdq)
+			     struct qc_dqblk *fdq)
 {
 	struct inode *inode = &ip->i_inode;
 	struct gfs2_sbd *sdp = GFS2_SB(inode);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:700 @ static int gfs2_adjust_quota(struct gfs2
 	be64_add_cpu(&q.qu_value, change);
 	qd->qd_qb.qb_value = q.qu_value;
 	if (fdq) {
-		if (fdq->d_fieldmask & FS_DQ_BSOFT) {
-			q.qu_warn = cpu_to_be64(fdq->d_blk_softlimit >> sdp->sd_fsb2bb_shift);
+		if (fdq->d_fieldmask & QC_SPC_SOFT) {
+			q.qu_warn = cpu_to_be64(fdq->d_spc_softlimit >> sdp->sd_sb.sb_bsize_shift);
 			qd->qd_qb.qb_warn = q.qu_warn;
 		}
-		if (fdq->d_fieldmask & FS_DQ_BHARD) {
-			q.qu_limit = cpu_to_be64(fdq->d_blk_hardlimit >> sdp->sd_fsb2bb_shift);
+		if (fdq->d_fieldmask & QC_SPC_HARD) {
+			q.qu_limit = cpu_to_be64(fdq->d_spc_hardlimit >> sdp->sd_sb.sb_bsize_shift);
 			qd->qd_qb.qb_limit = q.qu_limit;
 		}
-		if (fdq->d_fieldmask & FS_DQ_BCOUNT) {
-			q.qu_value = cpu_to_be64(fdq->d_bcount >> sdp->sd_fsb2bb_shift);
+		if (fdq->d_fieldmask & QC_SPACE) {
+			q.qu_value = cpu_to_be64(fdq->d_space >> sdp->sd_sb.sb_bsize_shift);
 			qd->qd_qb.qb_value = q.qu_value;
 		}
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1505 @ static int gfs2_quota_get_xstate(struct
 }
 
 static int gfs2_get_dqblk(struct super_block *sb, struct kqid qid,
-			  struct fs_disk_quota *fdq)
+			  struct qc_dqblk *fdq)
 {
 	struct gfs2_sbd *sdp = sb->s_fs_info;
 	struct gfs2_quota_lvb *qlvb;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1513 @ static int gfs2_get_dqblk(struct super_b
 	struct gfs2_holder q_gh;
 	int error;
 
-	memset(fdq, 0, sizeof(struct fs_disk_quota));
+	memset(fdq, 0, sizeof(*fdq));
 
 	if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
 		return -ESRCH; /* Crazy XFS error code */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1530 @ static int gfs2_get_dqblk(struct super_b
 		goto out;
 
 	qlvb = (struct gfs2_quota_lvb *)qd->qd_gl->gl_lksb.sb_lvbptr;
-	fdq->d_version = FS_DQUOT_VERSION;
-	fdq->d_flags = (qid.type == USRQUOTA) ? FS_USER_QUOTA : FS_GROUP_QUOTA;
-	fdq->d_id = from_kqid_munged(current_user_ns(), qid);
-	fdq->d_blk_hardlimit = be64_to_cpu(qlvb->qb_limit) << sdp->sd_fsb2bb_shift;
-	fdq->d_blk_softlimit = be64_to_cpu(qlvb->qb_warn) << sdp->sd_fsb2bb_shift;
-	fdq->d_bcount = be64_to_cpu(qlvb->qb_value) << sdp->sd_fsb2bb_shift;
+	fdq->d_spc_hardlimit = be64_to_cpu(qlvb->qb_limit) << sdp->sd_sb.sb_bsize_shift;
+	fdq->d_spc_softlimit = be64_to_cpu(qlvb->qb_warn) << sdp->sd_sb.sb_bsize_shift;
+	fdq->d_space = be64_to_cpu(qlvb->qb_value) << sdp->sd_sb.sb_bsize_shift;
 
 	gfs2_glock_dq_uninit(&q_gh);
 out:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1541 @ out:
 }
 
 /* GFS2 only supports a subset of the XFS fields */
-#define GFS2_FIELDMASK (FS_DQ_BSOFT|FS_DQ_BHARD|FS_DQ_BCOUNT)
+#define GFS2_FIELDMASK (QC_SPC_SOFT|QC_SPC_HARD|QC_SPACE)
 
 static int gfs2_set_dqblk(struct super_block *sb, struct kqid qid,
-			  struct fs_disk_quota *fdq)
+			  struct qc_dqblk *fdq)
 {
 	struct gfs2_sbd *sdp = sb->s_fs_info;
 	struct gfs2_inode *ip = GFS2_I(sdp->sd_quota_inode);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1588 @ static int gfs2_set_dqblk(struct super_b
 		goto out_i;
 
 	/* If nothing has changed, this is a no-op */
-	if ((fdq->d_fieldmask & FS_DQ_BSOFT) &&
-	    ((fdq->d_blk_softlimit >> sdp->sd_fsb2bb_shift) == be64_to_cpu(qd->qd_qb.qb_warn)))
-		fdq->d_fieldmask ^= FS_DQ_BSOFT;
-
-	if ((fdq->d_fieldmask & FS_DQ_BHARD) &&
-	    ((fdq->d_blk_hardlimit >> sdp->sd_fsb2bb_shift) == be64_to_cpu(qd->qd_qb.qb_limit)))
-		fdq->d_fieldmask ^= FS_DQ_BHARD;
-
-	if ((fdq->d_fieldmask & FS_DQ_BCOUNT) &&
-	    ((fdq->d_bcount >> sdp->sd_fsb2bb_shift) == be64_to_cpu(qd->qd_qb.qb_value)))
-		fdq->d_fieldmask ^= FS_DQ_BCOUNT;
+	if ((fdq->d_fieldmask & QC_SPC_SOFT) &&
+	    ((fdq->d_spc_softlimit >> sdp->sd_sb.sb_bsize_shift) == be64_to_cpu(qd->qd_qb.qb_warn)))
+		fdq->d_fieldmask ^= QC_SPC_SOFT;
+
+	if ((fdq->d_fieldmask & QC_SPC_HARD) &&
+	    ((fdq->d_spc_hardlimit >> sdp->sd_sb.sb_bsize_shift) == be64_to_cpu(qd->qd_qb.qb_limit)))
+		fdq->d_fieldmask ^= QC_SPC_HARD;
+
+	if ((fdq->d_fieldmask & QC_SPACE) &&
+	    ((fdq->d_space >> sdp->sd_sb.sb_bsize_shift) == be64_to_cpu(qd->qd_qb.qb_value)))
+		fdq->d_fieldmask ^= QC_SPACE;
 
 	if (fdq->d_fieldmask == 0)
 		goto out_i;
Index: linux-3.18.13-rt10-r7s4/fs/hfsplus/brec.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/hfsplus/brec.c
+++ linux-3.18.13-rt10-r7s4/fs/hfsplus/brec.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:134 @ skip:
 	hfs_bnode_write(node, entry, data_off + key_len, entry_len);
 	hfs_bnode_dump(node);
 
-	if (new_node) {
-		/* update parent key if we inserted a key
-		 * at the start of the first node
-		 */
-		if (!rec && new_node != node)
-			hfs_brec_update_parent(fd);
+	/*
+	 * update parent key if we inserted a key
+	 * at the start of the node and it is not the new node
+	 */
+	if (!rec && new_node != node) {
+		hfs_bnode_read_key(node, fd->search_key, data_off + size);
+		hfs_brec_update_parent(fd);
+	}
 
+	if (new_node) {
 		hfs_bnode_put(fd->bnode);
 		if (!new_node->parent) {
 			hfs_btree_inc_height(tree);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:174 @ skip:
 		goto again;
 	}
 
-	if (!rec)
-		hfs_brec_update_parent(fd);
-
 	return 0;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:373 @ again:
 	if (IS_ERR(parent))
 		return PTR_ERR(parent);
 	__hfs_brec_find(parent, fd, hfs_find_rec_by_key);
+	if (fd->record < 0)
+		return -ENOENT;
 	hfs_bnode_dump(parent);
 	rec = fd->record;
 
Index: linux-3.18.13-rt10-r7s4/fs/isofs/rock.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/isofs/rock.c
+++ linux-3.18.13-rt10-r7s4/fs/isofs/rock.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:33 @ struct rock_state {
 	int cont_size;
 	int cont_extent;
 	int cont_offset;
+	int cont_loops;
 	struct inode *inode;
 };
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:77 @ static void init_rock_state(struct rock_
 	rs->inode = inode;
 }
 
+/* Maximum number of Rock Ridge continuation entries */
+#define RR_MAX_CE_ENTRIES 32
+
 /*
  * Returns 0 if the caller should continue scanning, 1 if the scan must end
  * and -ve on error.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:112 @ static int rock_continue(struct rock_sta
 			goto out;
 		}
 		ret = -EIO;
+		if (++rs->cont_loops >= RR_MAX_CE_ENTRIES)
+			goto out;
 		bh = sb_bread(rs->inode->i_sb, rs->cont_extent);
 		if (bh) {
 			memcpy(rs->buffer, bh->b_data + rs->cont_offset,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:365 @ repeat:
 			rs.cont_size = isonum_733(rr->u.CE.size);
 			break;
 		case SIG('E', 'R'):
+			/* Invalid length of ER tag id? */
+			if (rr->u.ER.len_id + offsetof(struct rock_ridge, u.ER.data) > rr->len)
+				goto out;
 			ISOFS_SB(inode->i_sb)->s_rock = 1;
 			printk(KERN_DEBUG "ISO 9660 Extensions: ");
 			{
Index: linux-3.18.13-rt10-r7s4/fs/jffs2/scan.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/jffs2/scan.c
+++ linux-3.18.13-rt10-r7s4/fs/jffs2/scan.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:513 @ static int jffs2_scan_eraseblock (struct
 				sumlen = c->sector_size - je32_to_cpu(sm->offset);
 				sumptr = buf + buf_size - sumlen;
 
+				/* sm->offset maybe wrong but MAGIC maybe right */
+				if (sumlen > c->sector_size)
+					goto full_scan;
+
 				/* Now, make sure the summary itself is available */
 				if (sumlen > buf_size) {
 					/* Need to kmalloc for this. */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:551 @ static int jffs2_scan_eraseblock (struct
 		}
 	}
 
+full_scan:
 	buf_ofs = jeb->offset;
 
 	if (!buf_size) {
Index: linux-3.18.13-rt10-r7s4/fs/libfs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/libfs.c
+++ linux-3.18.13-rt10-r7s4/fs/libfs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:117 @ loff_t dcache_dir_lseek(struct file *fil
 
 			spin_lock(&dentry->d_lock);
 			/* d_lock not required for cursor */
-			list_del(&cursor->d_u.d_child);
+			list_del(&cursor->d_child);
 			p = dentry->d_subdirs.next;
 			while (n && p != &dentry->d_subdirs) {
 				struct dentry *next;
-				next = list_entry(p, struct dentry, d_u.d_child);
+				next = list_entry(p, struct dentry, d_child);
 				spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
 				if (simple_positive(next))
 					n--;
 				spin_unlock(&next->d_lock);
 				p = p->next;
 			}
-			list_add_tail(&cursor->d_u.d_child, p);
+			list_add_tail(&cursor->d_child, p);
 			spin_unlock(&dentry->d_lock);
 		}
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:153 @ int dcache_readdir(struct file *file, st
 {
 	struct dentry *dentry = file->f_path.dentry;
 	struct dentry *cursor = file->private_data;
-	struct list_head *p, *q = &cursor->d_u.d_child;
+	struct list_head *p, *q = &cursor->d_child;
 
 	if (!dir_emit_dots(file, ctx))
 		return 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:162 @ int dcache_readdir(struct file *file, st
 		list_move(q, &dentry->d_subdirs);
 
 	for (p = q->next; p != &dentry->d_subdirs; p = p->next) {
-		struct dentry *next = list_entry(p, struct dentry, d_u.d_child);
+		struct dentry *next = list_entry(p, struct dentry, d_child);
 		spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
 		if (!simple_positive(next)) {
 			spin_unlock(&next->d_lock);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:290 @ int simple_empty(struct dentry *dentry)
 	int ret = 0;
 
 	spin_lock(&dentry->d_lock);
-	list_for_each_entry(child, &dentry->d_subdirs, d_u.d_child) {
+	list_for_each_entry(child, &dentry->d_subdirs, d_child) {
 		spin_lock_nested(&child->d_lock, DENTRY_D_LOCK_NESTED);
 		if (simple_positive(child)) {
 			spin_unlock(&child->d_lock);
Index: linux-3.18.13-rt10-r7s4/fs/lockd/mon.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/lockd/mon.c
+++ linux-3.18.13-rt10-r7s4/fs/lockd/mon.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:68 @ static inline struct sockaddr *nsm_addr(
 	return (struct sockaddr *)&nsm->sm_addr;
 }
 
-static struct rpc_clnt *nsm_create(struct net *net)
+static struct rpc_clnt *nsm_create(struct net *net, const char *nodename)
 {
 	struct sockaddr_in sin = {
 		.sin_family		= AF_INET,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:80 @ static struct rpc_clnt *nsm_create(struc
 		.address		= (struct sockaddr *)&sin,
 		.addrsize		= sizeof(sin),
 		.servername		= "rpc.statd",
+		.nodename		= nodename,
 		.program		= &nsm_program,
 		.version		= NSM_VERSION,
 		.authflavor		= RPC_AUTH_NULL,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:106 @ out:
 	return clnt;
 }
 
-static struct rpc_clnt *nsm_client_get(struct net *net)
+static struct rpc_clnt *nsm_client_get(struct net *net, const char *nodename)
 {
 	struct rpc_clnt	*clnt, *new;
 	struct lockd_net *ln = net_generic(net, lockd_net_id);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:115 @ static struct rpc_clnt *nsm_client_get(s
 	if (clnt != NULL)
 		goto out;
 
-	clnt = new = nsm_create(net);
+	clnt = new = nsm_create(net, nodename);
 	if (IS_ERR(clnt))
 		goto out;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:194 @ int nsm_monitor(const struct nlm_host *h
 	struct nsm_res	res;
 	int		status;
 	struct rpc_clnt *clnt;
+	const char *nodename = NULL;
 
 	dprintk("lockd: nsm_monitor(%s)\n", nsm->sm_name);
 
 	if (nsm->sm_monitored)
 		return 0;
 
+	if (host->h_rpcclnt)
+		nodename = host->h_rpcclnt->cl_nodename;
+
 	/*
 	 * Choose whether to record the caller_name or IP address of
 	 * this peer in the local rpc.statd's database.
 	 */
 	nsm->sm_mon_name = nsm_use_hostnames ? nsm->sm_name : nsm->sm_addrbuf;
 
-	clnt = nsm_client_get(host->net);
+	clnt = nsm_client_get(host->net, nodename);
 	if (IS_ERR(clnt)) {
 		status = PTR_ERR(clnt);
 		dprintk("lockd: failed to create NSM upcall transport, "
Index: linux-3.18.13-rt10-r7s4/fs/lockd/svc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/lockd/svc.c
+++ linux-3.18.13-rt10-r7s4/fs/lockd/svc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:141 @ lockd(void *vrqstp)
 
 	dprintk("NFS locking service started (ver " LOCKD_VERSION ").\n");
 
-	if (!nlm_timeout)
-		nlm_timeout = LOCKD_DFLT_TIMEO;
-	nlmsvc_timeout = nlm_timeout * HZ;
-
 	/*
 	 * The main request loop. We don't terminate until the last
 	 * NFS mount or NFS daemon has gone away.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:349 @ static struct svc_serv *lockd_create_svc
 		printk(KERN_WARNING
 			"lockd_up: no pid, %d users??\n", nlmsvc_users);
 
+	if (!nlm_timeout)
+		nlm_timeout = LOCKD_DFLT_TIMEO;
+	nlmsvc_timeout = nlm_timeout * HZ;
+
 	serv = svc_create(&nlmsvc_program, LOCKD_BUFSIZE, NULL);
 	if (!serv) {
 		printk(KERN_WARNING "lockd_up: create service failed\n");
Index: linux-3.18.13-rt10-r7s4/fs/locks.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/locks.c
+++ linux-3.18.13-rt10-r7s4/fs/locks.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1705 @ static int generic_delete_lease(struct f
 			break;
 	}
 	trace_generic_delete_lease(inode, fl);
-	if (fl)
+	if (fl && IS_LEASE(fl))
 		error = fl->fl_lmops->lm_change(before, F_UNLCK, &dispose);
 	spin_unlock(&inode->i_lock);
 	locks_dispose_list(&dispose);
Index: linux-3.18.13-rt10-r7s4/fs/namespace.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/namespace.c
+++ linux-3.18.13-rt10-r7s4/fs/namespace.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1372 @ void umount_tree(struct mount *mnt, int
 	}
 	if (last) {
 		last->mnt_hash.next = unmounted.first;
+		if (unmounted.first)
+			unmounted.first->pprev = &last->mnt_hash.next;
 		unmounted.first = tmp_list.first;
 		unmounted.first->pprev = &unmounted.first;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1549 @ SYSCALL_DEFINE2(umount, char __user *, n
 		goto dput_and_out;
 	if (mnt->mnt.mnt_flags & MNT_LOCKED)
 		goto dput_and_out;
+	retval = -EPERM;
+	if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN))
+		goto dput_and_out;
 
 	retval = do_umount(mnt, flags);
 dput_and_out:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2106 @ static int do_remount(struct path *path,
 	}
 	if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) &&
 	    !(mnt_flags & MNT_NODEV)) {
-		return -EPERM;
+		/* Was the nodev implicitly added in mount? */
+		if ((mnt->mnt_ns->user_ns != &init_user_ns) &&
+		    !(sb->s_type->fs_flags & FS_USERNS_DEV_MOUNT)) {
+			mnt_flags |= MNT_NODEV;
+		} else {
+			return -EPERM;
+		}
 	}
 	if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) &&
 	    !(mnt_flags & MNT_NOSUID)) {
Index: linux-3.18.13-rt10-r7s4/fs/ncpfs/dir.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ncpfs/dir.c
+++ linux-3.18.13-rt10-r7s4/fs/ncpfs/dir.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:406 @ ncp_dget_fpos(struct dentry *dentry, str
 
 	/* If a pointer is invalid, we search the dentry. */
 	spin_lock(&parent->d_lock);
-	list_for_each_entry(dent, &parent->d_subdirs, d_u.d_child) {
+	list_for_each_entry(dent, &parent->d_subdirs, d_child) {
 		if ((unsigned long)dent->d_fsdata == fpos) {
 			if (dent->d_inode)
 				dget(dent);
Index: linux-3.18.13-rt10-r7s4/fs/ncpfs/ioctl.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ncpfs/ioctl.c
+++ linux-3.18.13-rt10-r7s4/fs/ncpfs/ioctl.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:450 @ static long __ncp_ioctl(struct inode *in
 						result = -EIO;
 					}
 				}
-				result = 0;
 			}
 			mutex_unlock(&server->root_setup_lock);
 
Index: linux-3.18.13-rt10-r7s4/fs/ncpfs/ncplib_kernel.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ncpfs/ncplib_kernel.h
+++ linux-3.18.13-rt10-r7s4/fs/ncpfs/ncplib_kernel.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:194 @ ncp_renew_dentries(struct dentry *parent
 	struct dentry *dentry;
 
 	spin_lock(&parent->d_lock);
-	list_for_each_entry(dentry, &parent->d_subdirs, d_u.d_child) {
+	list_for_each_entry(dentry, &parent->d_subdirs, d_child) {
 		if (dentry->d_fsdata == NULL)
 			ncp_age_dentry(server, dentry);
 		else
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:210 @ ncp_invalidate_dircache_entries(struct d
 	struct dentry *dentry;
 
 	spin_lock(&parent->d_lock);
-	list_for_each_entry(dentry, &parent->d_subdirs, d_u.d_child) {
+	list_for_each_entry(dentry, &parent->d_subdirs, d_child) {
 		dentry->d_fsdata = NULL;
 		ncp_age_dentry(server, dentry);
 	}
Index: linux-3.18.13-rt10-r7s4/fs/nfs/callback.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nfs/callback.c
+++ linux-3.18.13-rt10-r7s4/fs/nfs/callback.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:131 @ nfs41_callback_svc(void *vrqstp)
 		if (try_to_freeze())
 			continue;
 
-		prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_INTERRUPTIBLE);
+		prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_UNINTERRUPTIBLE);
 		spin_lock_bh(&serv->sv_cb_lock);
 		if (!list_empty(&serv->sv_cb_list)) {
 			req = list_first_entry(&serv->sv_cb_list,
 					struct rpc_rqst, rq_bc_list);
 			list_del(&req->rq_bc_list);
 			spin_unlock_bh(&serv->sv_cb_lock);
+			finish_wait(&serv->sv_cb_waitq, &wq);
 			dprintk("Invoking bc_svc_process()\n");
 			error = bc_svc_process(serv, req, rqstp);
 			dprintk("bc_svc_process() returned w/ error code= %d\n",
 				error);
 		} else {
 			spin_unlock_bh(&serv->sv_cb_lock);
-			schedule();
+			/* schedule_timeout to game the hung task watchdog */
+			schedule_timeout(60 * HZ);
+			finish_wait(&serv->sv_cb_waitq, &wq);
 		}
-		finish_wait(&serv->sv_cb_waitq, &wq);
 	}
 	return 0;
 }
Index: linux-3.18.13-rt10-r7s4/fs/nfs/callback_xdr.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nfs/callback_xdr.c
+++ linux-3.18.13-rt10-r7s4/fs/nfs/callback_xdr.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:467 @ static __be32 decode_cb_sequence_args(st
 
 		for (i = 0; i < args->csa_nrclists; i++) {
 			status = decode_rc_list(xdr, &args->csa_rclists[i]);
-			if (status)
+			if (status) {
+				args->csa_nrclists = i;
 				goto out_free;
+			}
 		}
 	}
 	status = 0;
Index: linux-3.18.13-rt10-r7s4/fs/nfs/delegation.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nfs/delegation.c
+++ linux-3.18.13-rt10-r7s4/fs/nfs/delegation.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:180 @ void nfs_inode_reclaim_delegation(struct
 				  &delegation->flags);
 			NFS_I(inode)->delegation_state = delegation->type;
 			spin_unlock(&delegation->lock);
-			put_rpccred(oldcred);
 			rcu_read_unlock();
+			put_rpccred(oldcred);
 			trace_nfs4_reclaim_delegation(inode, res->delegation_type);
 		} else {
 			/* We appear to have raced with a delegation return. */
Index: linux-3.18.13-rt10-r7s4/fs/nfs/dir.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nfs/dir.c
+++ linux-3.18.13-rt10-r7s4/fs/nfs/dir.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:472 @ void nfs_prime_dcache(struct dentry *par
 	struct inode *inode;
 	int status;
 
+	if (!(entry->fattr->valid & NFS_ATTR_FATTR_FSID))
+		return;
 	if (filename.name[0] == '.') {
 		if (filename.len == 1)
 			return;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:484 @ void nfs_prime_dcache(struct dentry *par
 
 	dentry = d_lookup(parent, &filename);
 	if (dentry != NULL) {
+		/* Is there a mountpoint here? If so, just exit */
+		if (!nfs_fsid_equal(&NFS_SB(dentry->d_sb)->fsid,
+					&entry->fattr->fsid))
+			goto out;
 		if (nfs_same_file(dentry, entry)) {
 			nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
 			status = nfs_refresh_inode(dentry->d_inode, entry->fattr);
Index: linux-3.18.13-rt10-r7s4/fs/nfs/direct.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nfs/direct.c
+++ linux-3.18.13-rt10-r7s4/fs/nfs/direct.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:215 @ static int nfs_direct_cmp_commit_data_ve
  */
 ssize_t nfs_direct_IO(int rw, struct kiocb *iocb, struct iov_iter *iter, loff_t pos)
 {
+	struct inode *inode = iocb->ki_filp->f_mapping->host;
+
+	/* we only support swap file calling nfs_direct_IO */
+	if (!IS_SWAPFILE(inode))
+		return 0;
+
 #ifndef CONFIG_NFS_SWAP
 	dprintk("NFS: nfs_direct_IO (%pD) off/no(%Ld/%lu) EINVAL\n",
 			iocb->ki_filp, (long long) pos, iter->nr_segs);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:245 @ static void nfs_direct_release_pages(str
 void nfs_init_cinfo_from_dreq(struct nfs_commit_info *cinfo,
 			      struct nfs_direct_req *dreq)
 {
-	cinfo->lock = &dreq->lock;
+	cinfo->lock = &dreq->inode->i_lock;
 	cinfo->mds = &dreq->mds_cinfo;
 	cinfo->ds = &dreq->ds_cinfo;
 	cinfo->dreq = dreq;
Index: linux-3.18.13-rt10-r7s4/fs/nfs/getroot.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nfs/getroot.c
+++ linux-3.18.13-rt10-r7s4/fs/nfs/getroot.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:61 @ static int nfs_superblock_set_dummy_root
 		 */
 		spin_lock(&sb->s_root->d_inode->i_lock);
 		spin_lock(&sb->s_root->d_lock);
-		hlist_del_init(&sb->s_root->d_alias);
+		hlist_del_init(&sb->s_root->d_u.d_alias);
 		spin_unlock(&sb->s_root->d_lock);
 		spin_unlock(&sb->s_root->d_inode->i_lock);
 	}
Index: linux-3.18.13-rt10-r7s4/fs/nfs/internal.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nfs/internal.h
+++ linux-3.18.13-rt10-r7s4/fs/nfs/internal.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:380 @ extern struct rpc_stat nfs_rpcstat;
 
 extern int __init register_nfs_fs(void);
 extern void __exit unregister_nfs_fs(void);
-extern void nfs_sb_active(struct super_block *sb);
+extern bool nfs_sb_active(struct super_block *sb);
 extern void nfs_sb_deactive(struct super_block *sb);
 
 /* namespace.c */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:498 @ extern int nfs41_walk_client_list(struct
 				struct nfs_client **result,
 				struct rpc_cred *cred);
 
+static inline struct inode *nfs_igrab_and_active(struct inode *inode)
+{
+	inode = igrab(inode);
+	if (inode != NULL && !nfs_sb_active(inode->i_sb)) {
+		iput(inode);
+		inode = NULL;
+	}
+	return inode;
+}
+
+static inline void nfs_iput_and_deactive(struct inode *inode)
+{
+	if (inode != NULL) {
+		struct super_block *sb = inode->i_sb;
+
+		iput(inode);
+		nfs_sb_deactive(sb);
+	}
+}
+
 /*
  * Determine the device name as a string
  */
Index: linux-3.18.13-rt10-r7s4/fs/nfs/nfs4client.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nfs/nfs4client.c
+++ linux-3.18.13-rt10-r7s4/fs/nfs/nfs4client.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:575 @ static bool nfs4_match_clientids(struct
 }
 
 /*
- * Returns true if the server owners match
+ * Returns true if the server major ids match
  */
 static bool
-nfs4_match_serverowners(struct nfs_client *a, struct nfs_client *b)
+nfs4_check_clientid_trunking(struct nfs_client *a, struct nfs_client *b)
 {
 	struct nfs41_server_owner *o1 = a->cl_serverowner;
 	struct nfs41_server_owner *o2 = b->cl_serverowner;
 
-	if (o1->minor_id != o2->minor_id) {
-		dprintk("NFS: --> %s server owner minor IDs do not match\n",
-			__func__);
-		return false;
-	}
-
 	if (o1->major_id_sz != o2->major_id_sz)
 		goto out_major_mismatch;
 	if (memcmp(o1->major_id, o2->major_id, o1->major_id_sz) != 0)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:643 @ int nfs41_walk_client_list(struct nfs_cl
 			prev = pos;
 
 			status = nfs_wait_client_init_complete(pos);
-			if (status == 0) {
+			if (pos->cl_cons_state == NFS_CS_SESSION_INITING) {
 				nfs4_schedule_lease_recovery(pos);
 				status = nfs4_wait_clnt_recover(pos);
 			}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:658 @ int nfs41_walk_client_list(struct nfs_cl
 		if (!nfs4_match_clientids(pos, new))
 			continue;
 
-		if (!nfs4_match_serverowners(pos, new))
+		/*
+		 * Note that session trunking is just a special subcase of
+		 * client id trunking. In either case, we want to fall back
+		 * to using the existing nfs_client.
+		 */
+		if (!nfs4_check_clientid_trunking(pos, new))
 			continue;
 
 		atomic_inc(&pos->cl_count);
Index: linux-3.18.13-rt10-r7s4/fs/nfs/nfs4proc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nfs/nfs4proc.c
+++ linux-3.18.13-rt10-r7s4/fs/nfs/nfs4proc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5133 @ static void nfs4_delegreturn_done(struct
 static void nfs4_delegreturn_release(void *calldata)
 {
 	struct nfs4_delegreturndata *data = calldata;
+	struct inode *inode = data->inode;
 
-	if (data->roc)
-		pnfs_roc_release(data->inode);
+	if (inode) {
+		if (data->roc)
+			pnfs_roc_release(inode);
+		nfs_iput_and_deactive(inode);
+	}
 	kfree(calldata);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5196 @ static int _nfs4_proc_delegreturn(struct
 	nfs_fattr_init(data->res.fattr);
 	data->timestamp = jiffies;
 	data->rpc_status = 0;
-	data->inode = inode;
-	data->roc = list_empty(&NFS_I(inode)->open_files) ?
-		    pnfs_roc(inode) : false;
+	data->inode = nfs_igrab_and_active(inode);
+	if (data->inode)
+		data->roc = nfs4_roc(inode);
 
 	task_setup_data.callback_data = data;
 	msg.rpc_argp = &data->args;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7711 @ nfs4_proc_layoutget(struct nfs4_layoutge
 
 	dprintk("--> %s\n", __func__);
 
+	/* nfs4_layoutget_release calls pnfs_put_layout_hdr */
+	pnfs_get_layout_hdr(NFS_I(inode)->layout);
+
 	lgp->args.layout.pages = nfs4_alloc_pages(max_pages, gfp_flags);
 	if (!lgp->args.layout.pages) {
 		nfs4_layoutget_release(lgp);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7726 @ nfs4_proc_layoutget(struct nfs4_layoutge
 	lgp->res.seq_res.sr_slot = NULL;
 	nfs4_init_sequence(&lgp->args.seq_args, &lgp->res.seq_res, 0);
 
-	/* nfs4_layoutget_release calls pnfs_put_layout_hdr */
-	pnfs_get_layout_hdr(NFS_I(inode)->layout);
-
 	task = rpc_run_task(&task_setup_data);
 	if (IS_ERR(task))
 		return ERR_CAST(task);
Index: linux-3.18.13-rt10-r7s4/fs/nfs/pnfs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nfs/pnfs.c
+++ linux-3.18.13-rt10-r7s4/fs/nfs/pnfs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1448 @ pnfs_generic_pg_init_read(struct nfs_pag
 {
 	u64 rd_size = req->wb_bytes;
 
-	WARN_ON_ONCE(pgio->pg_lseg != NULL);
-
-	if (pgio->pg_dreq == NULL)
-		rd_size = i_size_read(pgio->pg_inode) - req_offset(req);
-	else
-		rd_size = nfs_dreq_bytes_left(pgio->pg_dreq);
-
-	pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
-					   req->wb_context,
-					   req_offset(req),
-					   rd_size,
-					   IOMODE_READ,
-					   GFP_KERNEL);
+	if (pgio->pg_lseg == NULL) {
+		if (pgio->pg_dreq == NULL)
+			rd_size = i_size_read(pgio->pg_inode) - req_offset(req);
+		else
+			rd_size = nfs_dreq_bytes_left(pgio->pg_dreq);
+
+		pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
+						   req->wb_context,
+						   req_offset(req),
+						   rd_size,
+						   IOMODE_READ,
+						   GFP_KERNEL);
+	}
 	/* If no lseg, fall back to read through mds */
 	if (pgio->pg_lseg == NULL)
 		nfs_pageio_reset_read_mds(pgio);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1472 @ void
 pnfs_generic_pg_init_write(struct nfs_pageio_descriptor *pgio,
 			   struct nfs_page *req, u64 wb_size)
 {
-	WARN_ON_ONCE(pgio->pg_lseg != NULL);
-
-	pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
-					   req->wb_context,
-					   req_offset(req),
-					   wb_size,
-					   IOMODE_RW,
-					   GFP_NOFS);
+	if (pgio->pg_lseg == NULL)
+		pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
+						   req->wb_context,
+						   req_offset(req),
+						   wb_size,
+						   IOMODE_RW,
+						   GFP_NOFS);
 	/* If no lseg, fall back to write through mds */
 	if (pgio->pg_lseg == NULL)
 		nfs_pageio_reset_write_mds(pgio);
Index: linux-3.18.13-rt10-r7s4/fs/nfs/super.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nfs/super.c
+++ linux-3.18.13-rt10-r7s4/fs/nfs/super.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:408 @ void __exit unregister_nfs_fs(void)
 	unregister_filesystem(&nfs_fs_type);
 }
 
-void nfs_sb_active(struct super_block *sb)
+bool nfs_sb_active(struct super_block *sb)
 {
 	struct nfs_server *server = NFS_SB(sb);
 
-	if (atomic_inc_return(&server->active) == 1)
-		atomic_inc(&sb->s_active);
+	if (!atomic_inc_not_zero(&sb->s_active))
+		return false;
+	if (atomic_inc_return(&server->active) != 1)
+		atomic_dec(&sb->s_active);
+	return true;
 }
 EXPORT_SYMBOL_GPL(nfs_sb_active);
 
Index: linux-3.18.13-rt10-r7s4/fs/nfsd/nfs4state.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nfsd/nfs4state.c
+++ linux-3.18.13-rt10-r7s4/fs/nfsd/nfs4state.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1653 @ __destroy_client(struct nfs4_client *clp
 		nfs4_put_stid(&dp->dl_stid);
 	}
 	while (!list_empty(&clp->cl_revoked)) {
-		dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
+		dp = list_entry(clp->cl_revoked.next, struct nfs4_delegation, dl_recall_lru);
 		list_del_init(&dp->dl_recall_lru);
 		nfs4_put_stid(&dp->dl_stid);
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1714 @ static int copy_cred(struct svc_cred *ta
 	return 0;
 }
 
-static long long
+static int
 compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2)
 {
-	long long res;
-
-	res = o1->len - o2->len;
-	if (res)
-		return res;
-	return (long long)memcmp(o1->data, o2->data, o1->len);
+	if (o1->len < o2->len)
+		return -1;
+	if (o1->len > o2->len)
+		return 1;
+	return memcmp(o1->data, o2->data, o1->len);
 }
 
 static int same_name(const char *n1, const char *n2)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1909 @ add_clp_to_name_tree(struct nfs4_client
 static struct nfs4_client *
 find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root)
 {
-	long long cmp;
+	int cmp;
 	struct rb_node *node = root->rb_node;
 	struct nfs4_client *clp;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3229 @ alloc_init_open_stateowner(unsigned int
 	} else
 		nfs4_free_openowner(&oo->oo_owner);
 	spin_unlock(&clp->cl_lock);
-	return oo;
+	return ret;
 }
 
 static void init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, struct nfsd4_open *open) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3893 @ nfs4_set_delegation(struct nfs4_client *
 		status = nfs4_setlease(dp);
 		goto out;
 	}
-	atomic_inc(&fp->fi_delegees);
 	if (fp->fi_had_conflict) {
 		status = -EAGAIN;
 		goto out_unlock;
 	}
+	atomic_inc(&fp->fi_delegees);
 	hash_delegation_locked(dp, fp);
 	status = 0;
 out_unlock:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5061 @ alloc_init_lock_stateowner(unsigned int
 	} else
 		nfs4_free_lockowner(&lo->lo_owner);
 	spin_unlock(&clp->cl_lock);
-	return lo;
+	return ret;
 }
 
 static void
Index: linux-3.18.13-rt10-r7s4/fs/nfsd/nfs4xdr.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nfsd/nfs4xdr.c
+++ linux-3.18.13-rt10-r7s4/fs/nfsd/nfs4xdr.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1798 @ static __be32 nfsd4_encode_components_es
 		}
 		else
 			end++;
+		if (found_esc)
+			end = next;
+
 		str = end;
 	}
-	pathlen = htonl(xdr->buf->len - pathlen_offset);
+	pathlen = htonl(count);
 	write_bytes_to_xdr_buf(xdr->buf, pathlen_offset, &pathlen, 4);
 	return 0;
 }
Index: linux-3.18.13-rt10-r7s4/fs/nilfs2/btree.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nilfs2/btree.c
+++ linux-3.18.13-rt10-r7s4/fs/nilfs2/btree.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:34 @
 #include "alloc.h"
 #include "dat.h"
 
+static void __nilfs_btree_init(struct nilfs_bmap *bmap);
+
 static struct nilfs_btree_path *nilfs_btree_alloc_path(void)
 {
 	struct nilfs_btree_path *path;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:373 @ static int nilfs_btree_node_broken(const
 	return ret;
 }
 
+/**
+ * nilfs_btree_root_broken - verify consistency of btree root node
+ * @node: btree root node to be examined
+ * @ino: inode number
+ *
+ * Return Value: If node is broken, 1 is returned. Otherwise, 0 is returned.
+ */
+static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
+				   unsigned long ino)
+{
+	int level, flags, nchildren;
+	int ret = 0;
+
+	level = nilfs_btree_node_get_level(node);
+	flags = nilfs_btree_node_get_flags(node);
+	nchildren = nilfs_btree_node_get_nchildren(node);
+
+	if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
+		     level > NILFS_BTREE_LEVEL_MAX ||
+		     nchildren < 0 ||
+		     nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
+		pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
+			ino, level, flags, nchildren);
+		ret = 1;
+	}
+	return ret;
+}
+
 int nilfs_btree_broken_node_block(struct buffer_head *bh)
 {
 	int ret;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1746 @ nilfs_btree_commit_convert_and_insert(st
 
 	/* convert and insert */
 	dat = NILFS_BMAP_USE_VBN(btree) ? nilfs_bmap_get_dat(btree) : NULL;
-	nilfs_btree_init(btree);
+	__nilfs_btree_init(btree);
 	if (nreq != NULL) {
 		nilfs_bmap_commit_alloc_ptr(btree, dreq, dat);
 		nilfs_bmap_commit_alloc_ptr(btree, nreq, dat);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2327 @ static const struct nilfs_bmap_operation
 	.bop_gather_data	=	NULL,
 };
 
-int nilfs_btree_init(struct nilfs_bmap *bmap)
+static void __nilfs_btree_init(struct nilfs_bmap *bmap)
 {
 	bmap->b_ops = &nilfs_btree_ops;
 	bmap->b_nchildren_per_block =
 		NILFS_BTREE_NODE_NCHILDREN_MAX(nilfs_btree_node_size(bmap));
-	return 0;
+}
+
+int nilfs_btree_init(struct nilfs_bmap *bmap)
+{
+	int ret = 0;
+
+	__nilfs_btree_init(bmap);
+
+	if (nilfs_btree_root_broken(nilfs_btree_get_root(bmap),
+				    bmap->b_inode->i_ino))
+		ret = -EIO;
+	return ret;
 }
 
 void nilfs_btree_init_gc(struct nilfs_bmap *bmap)
Index: linux-3.18.13-rt10-r7s4/fs/nilfs2/inode.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nilfs2/inode.c
+++ linux-3.18.13-rt10-r7s4/fs/nilfs2/inode.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:52 @ struct nilfs_iget_args {
 	int for_gc;
 };
 
+static int nilfs_iget_test(struct inode *inode, void *opaque);
+
 void nilfs_inode_add_blocks(struct inode *inode, int n)
 {
 	struct nilfs_root *root = NILFS_I(inode)->i_root;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:353 @ const struct address_space_operations ni
 	.is_partially_uptodate  = block_is_partially_uptodate,
 };
 
+static int nilfs_insert_inode_locked(struct inode *inode,
+				     struct nilfs_root *root,
+				     unsigned long ino)
+{
+	struct nilfs_iget_args args = {
+		.ino = ino, .root = root, .cno = 0, .for_gc = 0
+	};
+
+	return insert_inode_locked4(inode, ino, nilfs_iget_test, &args);
+}
+
 struct inode *nilfs_new_inode(struct inode *dir, umode_t mode)
 {
 	struct super_block *sb = dir->i_sb;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:399 @ struct inode *nilfs_new_inode(struct ino
 	if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)) {
 		err = nilfs_bmap_read(ii->i_bmap, NULL);
 		if (err < 0)
-			goto failed_bmap;
+			goto failed_after_creation;
 
 		set_bit(NILFS_I_BMAP, &ii->i_state);
 		/* No lock is needed; iget() ensures it. */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:415 @ struct inode *nilfs_new_inode(struct ino
 	spin_lock(&nilfs->ns_next_gen_lock);
 	inode->i_generation = nilfs->ns_next_generation++;
 	spin_unlock(&nilfs->ns_next_gen_lock);
-	insert_inode_hash(inode);
+	if (nilfs_insert_inode_locked(inode, root, ino) < 0) {
+		err = -EIO;
+		goto failed_after_creation;
+	}
 
 	err = nilfs_init_acl(inode, dir);
 	if (unlikely(err))
-		goto failed_acl; /* never occur. When supporting
+		goto failed_after_creation; /* never occur. When supporting
 				    nilfs_init_acl(), proper cancellation of
 				    above jobs should be considered */
 
 	return inode;
 
- failed_acl:
- failed_bmap:
+ failed_after_creation:
 	clear_nlink(inode);
+	unlock_new_inode(inode);
 	iput(inode);  /* raw_inode will be deleted through
-			 generic_delete_inode() */
+			 nilfs_evict_inode() */
 	goto failed;
 
  failed_ifile_create_inode:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:480 @ int nilfs_read_inode_common(struct inode
 	inode->i_atime.tv_nsec = le32_to_cpu(raw_inode->i_mtime_nsec);
 	inode->i_ctime.tv_nsec = le32_to_cpu(raw_inode->i_ctime_nsec);
 	inode->i_mtime.tv_nsec = le32_to_cpu(raw_inode->i_mtime_nsec);
-	if (inode->i_nlink == 0 && inode->i_mode == 0)
-		return -EINVAL; /* this inode is deleted */
+	if (inode->i_nlink == 0)
+		return -ESTALE; /* this inode is deleted */
 
 	inode->i_blocks = le64_to_cpu(raw_inode->i_blocks);
 	ii->i_flags = le32_to_cpu(raw_inode->i_flags);
Index: linux-3.18.13-rt10-r7s4/fs/nilfs2/namei.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nilfs2/namei.c
+++ linux-3.18.13-rt10-r7s4/fs/nilfs2/namei.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:54 @ static inline int nilfs_add_nondir(struc
 	int err = nilfs_add_link(dentry, inode);
 	if (!err) {
 		d_instantiate(dentry, inode);
+		unlock_new_inode(inode);
 		return 0;
 	}
 	inode_dec_link_count(inode);
+	unlock_new_inode(inode);
 	iput(inode);
 	return err;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:187 @ out:
 out_fail:
 	drop_nlink(inode);
 	nilfs_mark_inode_dirty(inode);
+	unlock_new_inode(inode);
 	iput(inode);
 	goto out;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:207 @ static int nilfs_link(struct dentry *old
 	inode_inc_link_count(inode);
 	ihold(inode);
 
-	err = nilfs_add_nondir(dentry, inode);
-	if (!err)
+	err = nilfs_add_link(dentry, inode);
+	if (!err) {
+		d_instantiate(dentry, inode);
 		err = nilfs_transaction_commit(dir->i_sb);
-	else
+	} else {
+		inode_dec_link_count(inode);
+		iput(inode);
 		nilfs_transaction_abort(dir->i_sb);
+	}
 
 	return err;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:253 @ static int nilfs_mkdir(struct inode *dir
 
 	nilfs_mark_inode_dirty(inode);
 	d_instantiate(dentry, inode);
+	unlock_new_inode(inode);
 out:
 	if (!err)
 		err = nilfs_transaction_commit(dir->i_sb);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:266 @ out_fail:
 	drop_nlink(inode);
 	drop_nlink(inode);
 	nilfs_mark_inode_dirty(inode);
+	unlock_new_inode(inode);
 	iput(inode);
 out_dir:
 	drop_nlink(dir);
Index: linux-3.18.13-rt10-r7s4/fs/nilfs2/nilfs.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nilfs2/nilfs.h
+++ linux-3.18.13-rt10-r7s4/fs/nilfs2/nilfs.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:144 @ enum {
  * @ti_save: Backup of journal_info field of task_struct
  * @ti_flags: Flags
  * @ti_count: Nest level
- * @ti_garbage:	List of inode to be put when releasing semaphore
  */
 struct nilfs_transaction_info {
 	u32			ti_magic;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:152 @ struct nilfs_transaction_info {
 				   one of other filesystems has a bug. */
 	unsigned short		ti_flags;
 	unsigned short		ti_count;
-	struct list_head	ti_garbage;
 };
 
 /* ti_magic */
Index: linux-3.18.13-rt10-r7s4/fs/nilfs2/segment.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nilfs2/segment.c
+++ linux-3.18.13-rt10-r7s4/fs/nilfs2/segment.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:308 @ static void nilfs_transaction_lock(struc
 	ti->ti_count = 0;
 	ti->ti_save = cur_ti;
 	ti->ti_magic = NILFS_TI_MAGIC;
-	INIT_LIST_HEAD(&ti->ti_garbage);
 	current->journal_info = ti;
 
 	for (;;) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:334 @ static void nilfs_transaction_unlock(str
 
 	up_write(&nilfs->ns_segctor_sem);
 	current->journal_info = ti->ti_save;
-	if (!list_empty(&ti->ti_garbage))
-		nilfs_dispose_list(nilfs, &ti->ti_garbage, 0);
 }
 
 static void *nilfs_segctor_map_segsum_entry(struct nilfs_sc_info *sci,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:746 @ static void nilfs_dispose_list(struct th
 	}
 }
 
+static void nilfs_iput_work_func(struct work_struct *work)
+{
+	struct nilfs_sc_info *sci = container_of(work, struct nilfs_sc_info,
+						 sc_iput_work);
+	struct the_nilfs *nilfs = sci->sc_super->s_fs_info;
+
+	nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 0);
+}
+
 static int nilfs_test_metadata_dirty(struct the_nilfs *nilfs,
 				     struct nilfs_root *root)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1909 @ static int nilfs_segctor_collect_dirty_f
 static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
 					     struct the_nilfs *nilfs)
 {
-	struct nilfs_transaction_info *ti = current->journal_info;
 	struct nilfs_inode_info *ii, *n;
+	int during_mount = !(sci->sc_super->s_flags & MS_ACTIVE);
+	int defer_iput = false;
 
 	spin_lock(&nilfs->ns_inode_lock);
 	list_for_each_entry_safe(ii, n, &sci->sc_dirty_files, i_dirty) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1922 @ static void nilfs_segctor_drop_written_f
 		clear_bit(NILFS_I_BUSY, &ii->i_state);
 		brelse(ii->i_bh);
 		ii->i_bh = NULL;
-		list_move_tail(&ii->i_dirty, &ti->ti_garbage);
+		list_del_init(&ii->i_dirty);
+		if (!ii->vfs_inode.i_nlink || during_mount) {
+			/*
+			 * Defer calling iput() to avoid deadlocks if
+			 * i_nlink == 0 or mount is not yet finished.
+			 */
+			list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
+			defer_iput = true;
+		} else {
+			spin_unlock(&nilfs->ns_inode_lock);
+			iput(&ii->vfs_inode);
+			spin_lock(&nilfs->ns_inode_lock);
+		}
 	}
 	spin_unlock(&nilfs->ns_inode_lock);
+
+	if (defer_iput)
+		schedule_work(&sci->sc_iput_work);
 }
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2608 @ static struct nilfs_sc_info *nilfs_segct
 	INIT_LIST_HEAD(&sci->sc_segbufs);
 	INIT_LIST_HEAD(&sci->sc_write_logs);
 	INIT_LIST_HEAD(&sci->sc_gc_inodes);
+	INIT_LIST_HEAD(&sci->sc_iput_queue);
+	INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func);
 	init_timer(&sci->sc_timer);
 
 	sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2636 @ static void nilfs_segctor_write_out(stru
 		ret = nilfs_segctor_construct(sci, SC_LSEG_SR);
 		nilfs_transaction_unlock(sci->sc_super);
 
+		flush_work(&sci->sc_iput_work);
+
 	} while (ret && retrycount-- > 0);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2662 @ static void nilfs_segctor_destroy(struct
 		|| sci->sc_seq_request != sci->sc_seq_done);
 	spin_unlock(&sci->sc_state_lock);
 
+	if (flush_work(&sci->sc_iput_work))
+		flag = true;
+
 	if (flag || !nilfs_segctor_confirm(sci))
 		nilfs_segctor_write_out(sci);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2674 @ static void nilfs_segctor_destroy(struct
 		nilfs_dispose_list(nilfs, &sci->sc_dirty_files, 1);
 	}
 
+	if (!list_empty(&sci->sc_iput_queue)) {
+		nilfs_warning(sci->sc_super, __func__,
+			      "iput queue is not empty\n");
+		nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 1);
+	}
+
 	WARN_ON(!list_empty(&sci->sc_segbufs));
 	WARN_ON(!list_empty(&sci->sc_write_logs));
 
Index: linux-3.18.13-rt10-r7s4/fs/nilfs2/segment.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/nilfs2/segment.h
+++ linux-3.18.13-rt10-r7s4/fs/nilfs2/segment.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:29 @
 #include <linux/types.h>
 #include <linux/fs.h>
 #include <linux/buffer_head.h>
+#include <linux/workqueue.h>
 #include <linux/nilfs2_fs.h>
 #include "nilfs.h"
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:96 @ struct nilfs_segsum_pointer {
  * @sc_nblk_inc: Block count of current generation
  * @sc_dirty_files: List of files to be written
  * @sc_gc_inodes: List of GC inodes having blocks to be written
+ * @sc_iput_queue: list of inodes for which iput should be done
+ * @sc_iput_work: work struct to defer iput call
  * @sc_freesegs: array of segment numbers to be freed
  * @sc_nfreesegs: number of segments on @sc_freesegs
  * @sc_dsync_inode: inode whose data pages are written for a sync operation
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:141 @ struct nilfs_sc_info {
 
 	struct list_head	sc_dirty_files;
 	struct list_head	sc_gc_inodes;
+	struct list_head	sc_iput_queue;
+	struct work_struct	sc_iput_work;
 
 	__u64		       *sc_freesegs;
 	size_t			sc_nfreesegs;
Index: linux-3.18.13-rt10-r7s4/fs/notify/fsnotify.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/notify/fsnotify.c
+++ linux-3.18.13-rt10-r7s4/fs/notify/fsnotify.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:66 @ void __fsnotify_update_child_dentry_flag
 	spin_lock(&inode->i_lock);
 	/* run all of the dentries associated with this inode.  Since this is a
 	 * directory, there damn well better only be one item on this list */
-	hlist_for_each_entry(alias, &inode->i_dentry, d_alias) {
+	hlist_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
 		struct dentry *child;
 
 		/* run all of the children of the original inode and fix their
 		 * d_flags to indicate parental interest (their parent is the
 		 * original inode) */
 		spin_lock(&alias->d_lock);
-		list_for_each_entry(child, &alias->d_subdirs, d_u.d_child) {
+		list_for_each_entry(child, &alias->d_subdirs, d_child) {
 			if (!child->d_inode)
 				continue;
 
Index: linux-3.18.13-rt10-r7s4/fs/ocfs2/aops.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ocfs2/aops.c
+++ linux-3.18.13-rt10-r7s4/fs/ocfs2/aops.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:897 @ void ocfs2_unlock_and_free_pages(struct
 	}
 }
 
-static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
+static void ocfs2_unlock_pages(struct ocfs2_write_ctxt *wc)
 {
 	int i;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:918 @ static void ocfs2_free_write_ctxt(struct
 		page_cache_release(wc->w_target_page);
 	}
 	ocfs2_unlock_and_free_pages(wc->w_pages, wc->w_num_pages);
+}
 
+static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
+{
+	ocfs2_unlock_pages(wc);
 	brelse(wc->w_di_bh);
 	kfree(wc);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2049 @ out_write_size:
 	ocfs2_update_inode_fsync_trans(handle, inode, 1);
 	ocfs2_journal_dirty(handle, wc->w_di_bh);
 
+	/* unlock pages before dealloc since it needs acquiring j_trans_barrier
+	 * lock, or it will cause a deadlock since journal commit threads holds
+	 * this lock and will ask for the page lock when flushing the data.
+	 * put it here to preserve the unlock order.
+	 */
+	ocfs2_unlock_pages(wc);
+
 	ocfs2_commit_trans(osb, handle);
 
 	ocfs2_run_deallocs(osb, &wc->w_dealloc);
 
-	ocfs2_free_write_ctxt(wc);
+	brelse(wc->w_di_bh);
+	kfree(wc);
 
 	return copied;
 }
Index: linux-3.18.13-rt10-r7s4/fs/ocfs2/dcache.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ocfs2/dcache.c
+++ linux-3.18.13-rt10-r7s4/fs/ocfs2/dcache.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:175 @ struct dentry *ocfs2_find_local_alias(st
 	struct dentry *dentry;
 
 	spin_lock(&inode->i_lock);
-	hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
+	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
 		spin_lock(&dentry->d_lock);
 		if (ocfs2_match_dentry(dentry, parent_blkno, skip_unhashed)) {
 			trace_ocfs2_find_local_alias(dentry->d_name.len,
Index: linux-3.18.13-rt10-r7s4/fs/ocfs2/file.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ocfs2/file.c
+++ linux-3.18.13-rt10-r7s4/fs/ocfs2/file.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2377 @ out_dio:
 	/* buffered aio wouldn't have proper lock coverage today */
 	BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));
 
+	if (unlikely(written <= 0))
+		goto no_sync;
+
 	if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
 	    ((file->f_flags & O_DIRECT) && !direct_io)) {
-		ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
-					       *ppos + count - 1);
+		ret = filemap_fdatawrite_range(file->f_mapping,
+					       iocb->ki_pos - written,
+					       iocb->ki_pos - 1);
 		if (ret < 0)
 			written = ret;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2397 @ out_dio:
 		}
 
 		if (!ret)
-			ret = filemap_fdatawait_range(file->f_mapping, *ppos,
-						      *ppos + count - 1);
+			ret = filemap_fdatawait_range(file->f_mapping,
+						      iocb->ki_pos - written,
+						      iocb->ki_pos - 1);
 	}
 
+no_sync:
 	/*
 	 * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
 	 * function pointer which is called when o_direct io completes so that
Index: linux-3.18.13-rt10-r7s4/fs/ocfs2/namei.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ocfs2/namei.c
+++ linux-3.18.13-rt10-r7s4/fs/ocfs2/namei.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:97 @ static int ocfs2_create_symlink_data(str
 				     struct inode *inode,
 				     const char *symname);
 
+static int ocfs2_double_lock(struct ocfs2_super *osb,
+			     struct buffer_head **bh1,
+			     struct inode *inode1,
+			     struct buffer_head **bh2,
+			     struct inode *inode2,
+			     int rename);
+
+static void ocfs2_double_unlock(struct inode *inode1, struct inode *inode2);
 /* An orphan dir name is an 8 byte value, printed as a hex string */
 #define OCFS2_ORPHAN_NAMELEN ((int)(2 * sizeof(u64)))
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:689 @ static int ocfs2_link(struct dentry *old
 {
 	handle_t *handle;
 	struct inode *inode = old_dentry->d_inode;
+	struct inode *old_dir = old_dentry->d_parent->d_inode;
 	int err;
 	struct buffer_head *fe_bh = NULL;
+	struct buffer_head *old_dir_bh = NULL;
 	struct buffer_head *parent_fe_bh = NULL;
 	struct ocfs2_dinode *fe = NULL;
 	struct ocfs2_super *osb = OCFS2_SB(dir->i_sb);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:709 @ static int ocfs2_link(struct dentry *old
 
 	dquot_initialize(dir);
 
-	err = ocfs2_inode_lock_nested(dir, &parent_fe_bh, 1, OI_LS_PARENT);
+	err = ocfs2_double_lock(osb, &old_dir_bh, old_dir,
+			&parent_fe_bh, dir, 0);
 	if (err < 0) {
 		if (err != -ENOENT)
 			mlog_errno(err);
 		return err;
 	}
 
+	/* make sure both dirs have bhs
+	 * get an extra ref on old_dir_bh if old==new */
+	if (!parent_fe_bh) {
+		if (old_dir_bh) {
+			parent_fe_bh = old_dir_bh;
+			get_bh(parent_fe_bh);
+		} else {
+			mlog(ML_ERROR, "%s: no old_dir_bh!\n", osb->uuid_str);
+			err = -EIO;
+			goto out;
+		}
+	}
+
 	if (!dir->i_nlink) {
 		err = -ENOENT;
 		goto out;
 	}
 
-	err = ocfs2_lookup_ino_from_name(dir, old_dentry->d_name.name,
+	err = ocfs2_lookup_ino_from_name(old_dir, old_dentry->d_name.name,
 			old_dentry->d_name.len, &old_de_ino);
 	if (err) {
 		err = -ENOENT;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:828 @ out_unlock_inode:
 	ocfs2_inode_unlock(inode, 1);
 
 out:
-	ocfs2_inode_unlock(dir, 1);
+	ocfs2_double_unlock(old_dir, dir);
 
 	brelse(fe_bh);
 	brelse(parent_fe_bh);
+	brelse(old_dir_bh);
 
 	ocfs2_free_dir_lookup_result(&lookup);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1100 @ static int ocfs2_check_if_ancestor(struc
 }
 
 /*
- * The only place this should be used is rename!
+ * The only place this should be used is rename and link!
  * if they have the same id, then the 1st one is the only one locked.
  */
 static int ocfs2_double_lock(struct ocfs2_super *osb,
 			     struct buffer_head **bh1,
 			     struct inode *inode1,
 			     struct buffer_head **bh2,
-			     struct inode *inode2)
+			     struct inode *inode2,
+			     int rename)
 {
 	int status;
 	int inode1_is_ancestor, inode2_is_ancestor;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1156 @ static int ocfs2_double_lock(struct ocfs
 		}
 		/* lock id2 */
 		status = ocfs2_inode_lock_nested(inode2, bh2, 1,
-						 OI_LS_RENAME1);
+				rename == 1 ? OI_LS_RENAME1 : OI_LS_PARENT);
 		if (status < 0) {
 			if (status != -ENOENT)
 				mlog_errno(status);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1165 @ static int ocfs2_double_lock(struct ocfs
 	}
 
 	/* lock id1 */
-	status = ocfs2_inode_lock_nested(inode1, bh1, 1, OI_LS_RENAME2);
+	status = ocfs2_inode_lock_nested(inode1, bh1, 1,
+			rename == 1 ?  OI_LS_RENAME2 : OI_LS_PARENT);
 	if (status < 0) {
 		/*
 		 * An error return must mean that no cluster locks
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1282 @ static int ocfs2_rename(struct inode *ol
 
 	/* if old and new are the same, this'll just do one lock. */
 	status = ocfs2_double_lock(osb, &old_dir_bh, old_dir,
-				   &new_dir_bh, new_dir);
+				   &new_dir_bh, new_dir, 1);
 	if (status < 0) {
 		mlog_errno(status);
 		goto bail;
Index: linux-3.18.13-rt10-r7s4/fs/ocfs2/quota_local.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/ocfs2/quota_local.c
+++ linux-3.18.13-rt10-r7s4/fs/ocfs2/quota_local.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:704 @ static int ocfs2_local_read_info(struct
 	/* We don't need the lock and we have to acquire quota file locks
 	 * which will later depend on this lock */
 	mutex_unlock(&sb_dqopt(sb)->dqio_mutex);
-	info->dqi_maxblimit = 0x7fffffffffffffffLL;
-	info->dqi_maxilimit = 0x7fffffffffffffffLL;
+	info->dqi_max_spc_limit = 0x7fffffffffffffffLL;
+	info->dqi_max_ino_limit = 0x7fffffffffffffffLL;
 	oinfo = kmalloc(sizeof(struct ocfs2_mem_dqinfo), GFP_NOFS);
 	if (!oinfo) {
 		mlog(ML_ERROR, "failed to allocate memory for ocfs2 quota"
Index: linux-3.18.13-rt10-r7s4/fs/proc/base.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/proc/base.c
+++ linux-3.18.13-rt10-r7s4/fs/proc/base.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2467 @ static const struct file_operations proc
 	.llseek		= seq_lseek,
 	.release	= proc_id_map_release,
 };
+
+static int proc_setgroups_open(struct inode *inode, struct file *file)
+{
+	struct user_namespace *ns = NULL;
+	struct task_struct *task;
+	int ret;
+
+	ret = -ESRCH;
+	task = get_proc_task(inode);
+	if (task) {
+		rcu_read_lock();
+		ns = get_user_ns(task_cred_xxx(task, user_ns));
+		rcu_read_unlock();
+		put_task_struct(task);
+	}
+	if (!ns)
+		goto err;
+
+	if (file->f_mode & FMODE_WRITE) {
+		ret = -EACCES;
+		if (!ns_capable(ns, CAP_SYS_ADMIN))
+			goto err_put_ns;
+	}
+
+	ret = single_open(file, &proc_setgroups_show, ns);
+	if (ret)
+		goto err_put_ns;
+
+	return 0;
+err_put_ns:
+	put_user_ns(ns);
+err:
+	return ret;
+}
+
+static int proc_setgroups_release(struct inode *inode, struct file *file)
+{
+	struct seq_file *seq = file->private_data;
+	struct user_namespace *ns = seq->private;
+	int ret = single_release(inode, file);
+	put_user_ns(ns);
+	return ret;
+}
+
+static const struct file_operations proc_setgroups_operations = {
+	.open		= proc_setgroups_open,
+	.write		= proc_setgroups_write,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= proc_setgroups_release,
+};
 #endif /* CONFIG_USER_NS */
 
 static int proc_pid_personality(struct seq_file *m, struct pid_namespace *ns,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2626 @ static const struct pid_entry tgid_base_
 	REG("uid_map",    S_IRUGO|S_IWUSR, proc_uid_map_operations),
 	REG("gid_map",    S_IRUGO|S_IWUSR, proc_gid_map_operations),
 	REG("projid_map", S_IRUGO|S_IWUSR, proc_projid_map_operations),
+	REG("setgroups",  S_IRUGO|S_IWUSR, proc_setgroups_operations),
 #endif
 #ifdef CONFIG_CHECKPOINT_RESTORE
 	REG("timers",	  S_IRUGO, proc_timers_operations),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2968 @ static const struct pid_entry tid_base_s
 	REG("uid_map",    S_IRUGO|S_IWUSR, proc_uid_map_operations),
 	REG("gid_map",    S_IRUGO|S_IWUSR, proc_gid_map_operations),
 	REG("projid_map", S_IRUGO|S_IWUSR, proc_projid_map_operations),
+	REG("setgroups",  S_IRUGO|S_IWUSR, proc_setgroups_operations),
 #endif
 };
 
Index: linux-3.18.13-rt10-r7s4/fs/proc/generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/proc/generic.c
+++ linux-3.18.13-rt10-r7s4/fs/proc/generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:22 @
 #include <linux/mount.h>
 #include <linux/init.h>
 #include <linux/idr.h>
-#include <linux/namei.h>
 #include <linux/bitops.h>
 #include <linux/spinlock.h>
 #include <linux/completion.h>
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:164 @ void proc_free_inum(unsigned int inum)
 	spin_unlock_irqrestore(&proc_inum_lock, flags);
 }
 
-static void *proc_follow_link(struct dentry *dentry, struct nameidata *nd)
-{
-	nd_set_link(nd, __PDE_DATA(dentry->d_inode));
-	return NULL;
-}
-
-static const struct inode_operations proc_link_inode_operations = {
-	.readlink	= generic_readlink,
-	.follow_link	= proc_follow_link,
-};
-
 /*
  * Don't create negative dentries here, return -ENOENT by hand
  * instead.
Index: linux-3.18.13-rt10-r7s4/fs/proc/inode.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/proc/inode.c
+++ linux-3.18.13-rt10-r7s4/fs/proc/inode.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:26 @
 #include <linux/slab.h>
 #include <linux/mount.h>
 #include <linux/magic.h>
+#include <linux/namei.h>
 
 #include <asm/uaccess.h>
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:405 @ static const struct file_operations proc
 };
 #endif
 
+static void *proc_follow_link(struct dentry *dentry, struct nameidata *nd)
+{
+	struct proc_dir_entry *pde = PDE(dentry->d_inode);
+	if (unlikely(!use_pde(pde)))
+		return ERR_PTR(-EINVAL);
+	nd_set_link(nd, pde->data);
+	return pde;
+}
+
+static void proc_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
+{
+	unuse_pde(p);
+}
+
+const struct inode_operations proc_link_inode_operations = {
+	.readlink	= generic_readlink,
+	.follow_link	= proc_follow_link,
+	.put_link	= proc_put_link,
+};
+
 struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
 {
 	struct inode *inode = new_inode_pseudo(sb);
Index: linux-3.18.13-rt10-r7s4/fs/proc/internal.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/proc/internal.h
+++ linux-3.18.13-rt10-r7s4/fs/proc/internal.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:202 @ struct pde_opener {
 	int closing;
 	struct completion *c;
 };
+extern const struct inode_operations proc_link_inode_operations;
 
 extern const struct inode_operations proc_pid_link_inode_operations;
 
Index: linux-3.18.13-rt10-r7s4/fs/proc/stat.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/proc/stat.c
+++ linux-3.18.13-rt10-r7s4/fs/proc/stat.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:162 @ static int show_stat(struct seq_file *p,
 
 	/* sum again ? it could be updated? */
 	for_each_irq_nr(j)
-		seq_put_decimal_ull(p, ' ', kstat_irqs(j));
+		seq_put_decimal_ull(p, ' ', kstat_irqs_usr(j));
 
 	seq_printf(p,
 		"\nctxt %llu\n"
Index: linux-3.18.13-rt10-r7s4/fs/proc/task_mmu.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/proc/task_mmu.c
+++ linux-3.18.13-rt10-r7s4/fs/proc/task_mmu.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1037 @ static int pagemap_pte_range(pmd_t *pmd,
 	struct vm_area_struct *vma;
 	struct pagemapread *pm = walk->private;
 	spinlock_t *ptl;
-	pte_t *pte;
+	pte_t *pte, *orig_pte;
 	int err = 0;
 
 	/* find the first VMA at or above 'addr' */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1098 @ static int pagemap_pte_range(pmd_t *pmd,
 		BUG_ON(is_vm_hugetlb_page(vma));
 
 		/* Addresses in the VMA. */
-		for (; addr < min(end, vma->vm_end); addr += PAGE_SIZE) {
+		orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
+		for (; addr < min(end, vma->vm_end); pte++, addr += PAGE_SIZE) {
 			pagemap_entry_t pme;
-			pte = pte_offset_map(pmd, addr);
+
 			pte_to_pagemap_entry(&pme, pm, vma, addr, *pte);
-			pte_unmap(pte);
 			err = add_to_pagemap(addr, &pme, pm);
 			if (err)
-				return err;
+				break;
 		}
+		pte_unmap_unlock(orig_pte, ptl);
+
+		if (err)
+			return err;
 
 		if (addr == end)
 			break;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1294 @ out:
 
 static int pagemap_open(struct inode *inode, struct file *file)
 {
+	/* do not disclose physical addresses: attack vector */
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
 	pr_warn_once("Bits 55-60 of /proc/PID/pagemap entries are about "
 			"to stop being page-shift some time soon. See the "
 			"linux/Documentation/vm/pagemap.txt for details.\n");
Index: linux-3.18.13-rt10-r7s4/fs/pstore/ram.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/pstore/ram.c
+++ linux-3.18.13-rt10-r7s4/fs/pstore/ram.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:64 @ module_param(mem_size, ulong, 0400);
 MODULE_PARM_DESC(mem_size,
 		"size of reserved RAM used to store oops/panic logs");
 
+static unsigned int mem_type;
+module_param(mem_type, uint, 0600);
+MODULE_PARM_DESC(mem_type,
+		"set to 1 to try to use unbuffered memory (default 0)");
+
 static int dump_oops = 1;
 module_param(dump_oops, int, 0600);
 MODULE_PARM_DESC(dump_oops,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:87 @ struct ramoops_context {
 	struct persistent_ram_zone *fprz;
 	phys_addr_t phys_addr;
 	unsigned long size;
+	unsigned int memtype;
 	size_t record_size;
 	size_t console_size;
 	size_t ftrace_size;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:367 @ static int ramoops_init_przs(struct devi
 		size_t sz = cxt->record_size;
 
 		cxt->przs[i] = persistent_ram_new(*paddr, sz, 0,
-						  &cxt->ecc_info);
+						  &cxt->ecc_info,
+						  cxt->memtype);
 		if (IS_ERR(cxt->przs[i])) {
 			err = PTR_ERR(cxt->przs[i]);
 			dev_err(dev, "failed to request mem region (0x%zx@0x%llx): %d\n",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:398 @ static int ramoops_init_prz(struct devic
 		return -ENOMEM;
 	}
 
-	*prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info);
+	*prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info, cxt->memtype);
 	if (IS_ERR(*prz)) {
 		int err = PTR_ERR(*prz);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:445 @ static int ramoops_probe(struct platform
 
 	cxt->size = pdata->mem_size;
 	cxt->phys_addr = pdata->mem_address;
+	cxt->memtype = pdata->mem_type;
 	cxt->record_size = pdata->record_size;
 	cxt->console_size = pdata->console_size;
 	cxt->ftrace_size = pdata->ftrace_size;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:575 @ static void ramoops_register_dummy(void)
 
 	dummy_data->mem_size = mem_size;
 	dummy_data->mem_address = mem_address;
+	dummy_data->mem_type = 0;
 	dummy_data->record_size = record_size;
 	dummy_data->console_size = ramoops_console_size;
 	dummy_data->ftrace_size = ramoops_ftrace_size;
Index: linux-3.18.13-rt10-r7s4/fs/pstore/ram_core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/pstore/ram_core.c
+++ linux-3.18.13-rt10-r7s4/fs/pstore/ram_core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:383 @ void persistent_ram_zap(struct persisten
 	persistent_ram_update_header_ecc(prz);
 }
 
-static void *persistent_ram_vmap(phys_addr_t start, size_t size)
+static void *persistent_ram_vmap(phys_addr_t start, size_t size,
+		unsigned int memtype)
 {
 	struct page **pages;
 	phys_addr_t page_start;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:396 @ static void *persistent_ram_vmap(phys_ad
 	page_start = start - offset_in_page(start);
 	page_count = DIV_ROUND_UP(size + offset_in_page(start), PAGE_SIZE);
 
-	prot = pgprot_noncached(PAGE_KERNEL);
+	if (memtype)
+		prot = pgprot_noncached(PAGE_KERNEL);
+	else
+		prot = pgprot_writecombine(PAGE_KERNEL);
 
 	pages = kmalloc_array(page_count, sizeof(struct page *), GFP_KERNEL);
 	if (!pages) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:418 @ static void *persistent_ram_vmap(phys_ad
 	return vaddr;
 }
 
-static void *persistent_ram_iomap(phys_addr_t start, size_t size)
+static void *persistent_ram_iomap(phys_addr_t start, size_t size,
+		unsigned int memtype)
 {
+	void *va;
+
 	if (!request_mem_region(start, size, "persistent_ram")) {
 		pr_err("request mem region (0x%llx@0x%llx) failed\n",
 			(unsigned long long)size, (unsigned long long)start);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:432 @ static void *persistent_ram_iomap(phys_a
 	buffer_start_add = buffer_start_add_locked;
 	buffer_size_add = buffer_size_add_locked;
 
-	return ioremap(start, size);
+	if (memtype)
+		va = ioremap(start, size);
+	else
+		va = ioremap_wc(start, size);
+
+	return va;
 }
 
 static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size,
-		struct persistent_ram_zone *prz)
+		struct persistent_ram_zone *prz, int memtype)
 {
 	prz->paddr = start;
 	prz->size = size;
 
 	if (pfn_valid(start >> PAGE_SHIFT))
-		prz->vaddr = persistent_ram_vmap(start, size);
+		prz->vaddr = persistent_ram_vmap(start, size, memtype);
 	else
-		prz->vaddr = persistent_ram_iomap(start, size);
+		prz->vaddr = persistent_ram_iomap(start, size, memtype);
 
 	if (!prz->vaddr) {
 		pr_err("%s: Failed to map 0x%llx pages at 0x%llx\n", __func__,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:515 @ void persistent_ram_free(struct persiste
 }
 
 struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
-			u32 sig, struct persistent_ram_ecc_info *ecc_info)
+			u32 sig, struct persistent_ram_ecc_info *ecc_info,
+			unsigned int memtype)
 {
 	struct persistent_ram_zone *prz;
 	int ret = -ENOMEM;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:527 @ struct persistent_ram_zone *persistent_r
 		goto err;
 	}
 
-	ret = persistent_ram_buffer_map(start, size, prz);
+	ret = persistent_ram_buffer_map(start, size, prz, memtype);
 	if (ret)
 		goto err;
 
Index: linux-3.18.13-rt10-r7s4/fs/quota/dquot.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/quota/dquot.c
+++ linux-3.18.13-rt10-r7s4/fs/quota/dquot.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2383 @ out:
 }
 EXPORT_SYMBOL(dquot_quota_on_mount);
 
-static inline qsize_t qbtos(qsize_t blocks)
-{
-	return blocks << QIF_DQBLKSIZE_BITS;
-}
-
-static inline qsize_t stoqb(qsize_t space)
-{
-	return (space + QIF_DQBLKSIZE - 1) >> QIF_DQBLKSIZE_BITS;
-}
-
 /* Generic routine for getting common part of quota structure */
-static void do_get_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
+static void do_get_dqblk(struct dquot *dquot, struct qc_dqblk *di)
 {
 	struct mem_dqblk *dm = &dquot->dq_dqb;
 
 	memset(di, 0, sizeof(*di));
-	di->d_version = FS_DQUOT_VERSION;
-	di->d_flags = dquot->dq_id.type == USRQUOTA ?
-			FS_USER_QUOTA : FS_GROUP_QUOTA;
-	di->d_id = from_kqid_munged(current_user_ns(), dquot->dq_id);
-
 	spin_lock(&dq_data_lock);
-	di->d_blk_hardlimit = stoqb(dm->dqb_bhardlimit);
-	di->d_blk_softlimit = stoqb(dm->dqb_bsoftlimit);
+	di->d_spc_hardlimit = dm->dqb_bhardlimit;
+	di->d_spc_softlimit = dm->dqb_bsoftlimit;
 	di->d_ino_hardlimit = dm->dqb_ihardlimit;
 	di->d_ino_softlimit = dm->dqb_isoftlimit;
-	di->d_bcount = dm->dqb_curspace + dm->dqb_rsvspace;
-	di->d_icount = dm->dqb_curinodes;
-	di->d_btimer = dm->dqb_btime;
-	di->d_itimer = dm->dqb_itime;
+	di->d_space = dm->dqb_curspace + dm->dqb_rsvspace;
+	di->d_ino_count = dm->dqb_curinodes;
+	di->d_spc_timer = dm->dqb_btime;
+	di->d_ino_timer = dm->dqb_itime;
 	spin_unlock(&dq_data_lock);
 }
 
 int dquot_get_dqblk(struct super_block *sb, struct kqid qid,
-		    struct fs_disk_quota *di)
+		    struct qc_dqblk *di)
 {
 	struct dquot *dquot;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2416 @ int dquot_get_dqblk(struct super_block *
 }
 EXPORT_SYMBOL(dquot_get_dqblk);
 
-#define VFS_FS_DQ_MASK \
-	(FS_DQ_BCOUNT | FS_DQ_BSOFT | FS_DQ_BHARD | \
-	 FS_DQ_ICOUNT | FS_DQ_ISOFT | FS_DQ_IHARD | \
-	 FS_DQ_BTIMER | FS_DQ_ITIMER)
+#define VFS_QC_MASK \
+	(QC_SPACE | QC_SPC_SOFT | QC_SPC_HARD | \
+	 QC_INO_COUNT | QC_INO_SOFT | QC_INO_HARD | \
+	 QC_SPC_TIMER | QC_INO_TIMER)
 
 /* Generic routine for setting common part of quota structure */
-static int do_set_dqblk(struct dquot *dquot, struct fs_disk_quota *di)
+static int do_set_dqblk(struct dquot *dquot, struct qc_dqblk *di)
 {
 	struct mem_dqblk *dm = &dquot->dq_dqb;
 	int check_blim = 0, check_ilim = 0;
 	struct mem_dqinfo *dqi = &sb_dqopt(dquot->dq_sb)->info[dquot->dq_id.type];
 
-	if (di->d_fieldmask & ~VFS_FS_DQ_MASK)
+	if (di->d_fieldmask & ~VFS_QC_MASK)
 		return -EINVAL;
 
-	if (((di->d_fieldmask & FS_DQ_BSOFT) &&
-	     (di->d_blk_softlimit > dqi->dqi_maxblimit)) ||
-	    ((di->d_fieldmask & FS_DQ_BHARD) &&
-	     (di->d_blk_hardlimit > dqi->dqi_maxblimit)) ||
-	    ((di->d_fieldmask & FS_DQ_ISOFT) &&
-	     (di->d_ino_softlimit > dqi->dqi_maxilimit)) ||
-	    ((di->d_fieldmask & FS_DQ_IHARD) &&
-	     (di->d_ino_hardlimit > dqi->dqi_maxilimit)))
+	if (((di->d_fieldmask & QC_SPC_SOFT) &&
+	     di->d_spc_softlimit > dqi->dqi_max_spc_limit) ||
+	    ((di->d_fieldmask & QC_SPC_HARD) &&
+	     di->d_spc_hardlimit > dqi->dqi_max_spc_limit) ||
+	    ((di->d_fieldmask & QC_INO_SOFT) &&
+	     (di->d_ino_softlimit > dqi->dqi_max_ino_limit)) ||
+	    ((di->d_fieldmask & QC_INO_HARD) &&
+	     (di->d_ino_hardlimit > dqi->dqi_max_ino_limit)))
 		return -ERANGE;
 
 	spin_lock(&dq_data_lock);
-	if (di->d_fieldmask & FS_DQ_BCOUNT) {
-		dm->dqb_curspace = di->d_bcount - dm->dqb_rsvspace;
+	if (di->d_fieldmask & QC_SPACE) {
+		dm->dqb_curspace = di->d_space - dm->dqb_rsvspace;
 		check_blim = 1;
 		set_bit(DQ_LASTSET_B + QIF_SPACE_B, &dquot->dq_flags);
 	}
 
-	if (di->d_fieldmask & FS_DQ_BSOFT)
-		dm->dqb_bsoftlimit = qbtos(di->d_blk_softlimit);
-	if (di->d_fieldmask & FS_DQ_BHARD)
-		dm->dqb_bhardlimit = qbtos(di->d_blk_hardlimit);
-	if (di->d_fieldmask & (FS_DQ_BSOFT | FS_DQ_BHARD)) {
+	if (di->d_fieldmask & QC_SPC_SOFT)
+		dm->dqb_bsoftlimit = di->d_spc_softlimit;
+	if (di->d_fieldmask & QC_SPC_HARD)
+		dm->dqb_bhardlimit = di->d_spc_hardlimit;
+	if (di->d_fieldmask & (QC_SPC_SOFT | QC_SPC_HARD)) {
 		check_blim = 1;
 		set_bit(DQ_LASTSET_B + QIF_BLIMITS_B, &dquot->dq_flags);
 	}
 
-	if (di->d_fieldmask & FS_DQ_ICOUNT) {
-		dm->dqb_curinodes = di->d_icount;
+	if (di->d_fieldmask & QC_INO_COUNT) {
+		dm->dqb_curinodes = di->d_ino_count;
 		check_ilim = 1;
 		set_bit(DQ_LASTSET_B + QIF_INODES_B, &dquot->dq_flags);
 	}
 
-	if (di->d_fieldmask & FS_DQ_ISOFT)
+	if (di->d_fieldmask & QC_INO_SOFT)
 		dm->dqb_isoftlimit = di->d_ino_softlimit;
-	if (di->d_fieldmask & FS_DQ_IHARD)
+	if (di->d_fieldmask & QC_INO_HARD)
 		dm->dqb_ihardlimit = di->d_ino_hardlimit;
-	if (di->d_fieldmask & (FS_DQ_ISOFT | FS_DQ_IHARD)) {
+	if (di->d_fieldmask & (QC_INO_SOFT | QC_INO_HARD)) {
 		check_ilim = 1;
 		set_bit(DQ_LASTSET_B + QIF_ILIMITS_B, &dquot->dq_flags);
 	}
 
-	if (di->d_fieldmask & FS_DQ_BTIMER) {
-		dm->dqb_btime = di->d_btimer;
+	if (di->d_fieldmask & QC_SPC_TIMER) {
+		dm->dqb_btime = di->d_spc_timer;
 		check_blim = 1;
 		set_bit(DQ_LASTSET_B + QIF_BTIME_B, &dquot->dq_flags);
 	}
 
-	if (di->d_fieldmask & FS_DQ_ITIMER) {
-		dm->dqb_itime = di->d_itimer;
+	if (di->d_fieldmask & QC_INO_TIMER) {
+		dm->dqb_itime = di->d_ino_timer;
 		check_ilim = 1;
 		set_bit(DQ_LASTSET_B + QIF_ITIME_B, &dquot->dq_flags);
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2489 @ static int do_set_dqblk(struct dquot *dq
 		    dm->dqb_curspace < dm->dqb_bsoftlimit) {
 			dm->dqb_btime = 0;
 			clear_bit(DQ_BLKS_B, &dquot->dq_flags);
-		} else if (!(di->d_fieldmask & FS_DQ_BTIMER))
+		} else if (!(di->d_fieldmask & QC_SPC_TIMER))
 			/* Set grace only if user hasn't provided his own... */
 			dm->dqb_btime = get_seconds() + dqi->dqi_bgrace;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2498 @ static int do_set_dqblk(struct dquot *dq
 		    dm->dqb_curinodes < dm->dqb_isoftlimit) {
 			dm->dqb_itime = 0;
 			clear_bit(DQ_INODES_B, &dquot->dq_flags);
-		} else if (!(di->d_fieldmask & FS_DQ_ITIMER))
+		} else if (!(di->d_fieldmask & QC_INO_TIMER))
 			/* Set grace only if user hasn't provided his own... */
 			dm->dqb_itime = get_seconds() + dqi->dqi_igrace;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2514 @ static int do_set_dqblk(struct dquot *dq
 }
 
 int dquot_set_dqblk(struct super_block *sb, struct kqid qid,
-		  struct fs_disk_quota *di)
+		  struct qc_dqblk *di)
 {
 	struct dquot *dquot;
 	int rc;
Index: linux-3.18.13-rt10-r7s4/fs/quota/quota.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/quota/quota.c
+++ linux-3.18.13-rt10-r7s4/fs/quota/quota.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:118 @ static int quota_setinfo(struct super_bl
 	return sb->s_qcop->set_info(sb, type, &info);
 }
 
-static void copy_to_if_dqblk(struct if_dqblk *dst, struct fs_disk_quota *src)
+static inline qsize_t qbtos(qsize_t blocks)
+{
+	return blocks << QIF_DQBLKSIZE_BITS;
+}
+
+static inline qsize_t stoqb(qsize_t space)
+{
+	return (space + QIF_DQBLKSIZE - 1) >> QIF_DQBLKSIZE_BITS;
+}
+
+static void copy_to_if_dqblk(struct if_dqblk *dst, struct qc_dqblk *src)
 {
 	memset(dst, 0, sizeof(*dst));
-	dst->dqb_bhardlimit = src->d_blk_hardlimit;
-	dst->dqb_bsoftlimit = src->d_blk_softlimit;
-	dst->dqb_curspace = src->d_bcount;
+	dst->dqb_bhardlimit = stoqb(src->d_spc_hardlimit);
+	dst->dqb_bsoftlimit = stoqb(src->d_spc_softlimit);
+	dst->dqb_curspace = src->d_space;
 	dst->dqb_ihardlimit = src->d_ino_hardlimit;
 	dst->dqb_isoftlimit = src->d_ino_softlimit;
-	dst->dqb_curinodes = src->d_icount;
-	dst->dqb_btime = src->d_btimer;
-	dst->dqb_itime = src->d_itimer;
+	dst->dqb_curinodes = src->d_ino_count;
+	dst->dqb_btime = src->d_spc_timer;
+	dst->dqb_itime = src->d_ino_timer;
 	dst->dqb_valid = QIF_ALL;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:146 @ static int quota_getquota(struct super_b
 			  void __user *addr)
 {
 	struct kqid qid;
-	struct fs_disk_quota fdq;
+	struct qc_dqblk fdq;
 	struct if_dqblk idq;
 	int ret;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:164 @ static int quota_getquota(struct super_b
 	return 0;
 }
 
-static void copy_from_if_dqblk(struct fs_disk_quota *dst, struct if_dqblk *src)
+static void copy_from_if_dqblk(struct qc_dqblk *dst, struct if_dqblk *src)
 {
-	dst->d_blk_hardlimit = src->dqb_bhardlimit;
-	dst->d_blk_softlimit  = src->dqb_bsoftlimit;
-	dst->d_bcount = src->dqb_curspace;
+	dst->d_spc_hardlimit = qbtos(src->dqb_bhardlimit);
+	dst->d_spc_softlimit = qbtos(src->dqb_bsoftlimit);
+	dst->d_space = src->dqb_curspace;
 	dst->d_ino_hardlimit = src->dqb_ihardlimit;
 	dst->d_ino_softlimit = src->dqb_isoftlimit;
-	dst->d_icount = src->dqb_curinodes;
-	dst->d_btimer = src->dqb_btime;
-	dst->d_itimer = src->dqb_itime;
+	dst->d_ino_count = src->dqb_curinodes;
+	dst->d_spc_timer = src->dqb_btime;
+	dst->d_ino_timer = src->dqb_itime;
 
 	dst->d_fieldmask = 0;
 	if (src->dqb_valid & QIF_BLIMITS)
-		dst->d_fieldmask |= FS_DQ_BSOFT | FS_DQ_BHARD;
+		dst->d_fieldmask |= QC_SPC_SOFT | QC_SPC_HARD;
 	if (src->dqb_valid & QIF_SPACE)
-		dst->d_fieldmask |= FS_DQ_BCOUNT;
+		dst->d_fieldmask |= QC_SPACE;
 	if (src->dqb_valid & QIF_ILIMITS)
-		dst->d_fieldmask |= FS_DQ_ISOFT | FS_DQ_IHARD;
+		dst->d_fieldmask |= QC_INO_SOFT | QC_INO_HARD;
 	if (src->dqb_valid & QIF_INODES)
-		dst->d_fieldmask |= FS_DQ_ICOUNT;
+		dst->d_fieldmask |= QC_INO_COUNT;
 	if (src->dqb_valid & QIF_BTIME)
-		dst->d_fieldmask |= FS_DQ_BTIMER;
+		dst->d_fieldmask |= QC_SPC_TIMER;
 	if (src->dqb_valid & QIF_ITIME)
-		dst->d_fieldmask |= FS_DQ_ITIMER;
+		dst->d_fieldmask |= QC_INO_TIMER;
 }
 
 static int quota_setquota(struct super_block *sb, int type, qid_t id,
 			  void __user *addr)
 {
-	struct fs_disk_quota fdq;
+	struct qc_dqblk fdq;
 	struct if_dqblk idq;
 	struct kqid qid;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:257 @ static int quota_getxstatev(struct super
 	return ret;
 }
 
+/*
+ * XFS defines BBTOB and BTOBB macros inside fs/xfs/ and we cannot move them
+ * out of there as xfsprogs rely on definitions being in that header file. So
+ * just define same functions here for quota purposes.
+ */
+#define XFS_BB_SHIFT 9
+
+static inline u64 quota_bbtob(u64 blocks)
+{
+	return blocks << XFS_BB_SHIFT;
+}
+
+static inline u64 quota_btobb(u64 bytes)
+{
+	return (bytes + (1 << XFS_BB_SHIFT) - 1) >> XFS_BB_SHIFT;
+}
+
+static void copy_from_xfs_dqblk(struct qc_dqblk *dst, struct fs_disk_quota *src)
+{
+	dst->d_spc_hardlimit = quota_bbtob(src->d_blk_hardlimit);
+	dst->d_spc_softlimit = quota_bbtob(src->d_blk_softlimit);
+	dst->d_ino_hardlimit = src->d_ino_hardlimit;
+	dst->d_ino_softlimit = src->d_ino_softlimit;
+	dst->d_space = quota_bbtob(src->d_bcount);
+	dst->d_ino_count = src->d_icount;
+	dst->d_ino_timer = src->d_itimer;
+	dst->d_spc_timer = src->d_btimer;
+	dst->d_ino_warns = src->d_iwarns;
+	dst->d_spc_warns = src->d_bwarns;
+	dst->d_rt_spc_hardlimit = quota_bbtob(src->d_rtb_hardlimit);
+	dst->d_rt_spc_softlimit = quota_bbtob(src->d_rtb_softlimit);
+	dst->d_rt_space = quota_bbtob(src->d_rtbcount);
+	dst->d_rt_spc_timer = src->d_rtbtimer;
+	dst->d_rt_spc_warns = src->d_rtbwarns;
+	dst->d_fieldmask = 0;
+	if (src->d_fieldmask & FS_DQ_ISOFT)
+		dst->d_fieldmask |= QC_INO_SOFT;
+	if (src->d_fieldmask & FS_DQ_IHARD)
+		dst->d_fieldmask |= QC_INO_HARD;
+	if (src->d_fieldmask & FS_DQ_BSOFT)
+		dst->d_fieldmask |= QC_SPC_SOFT;
+	if (src->d_fieldmask & FS_DQ_BHARD)
+		dst->d_fieldmask |= QC_SPC_HARD;
+	if (src->d_fieldmask & FS_DQ_RTBSOFT)
+		dst->d_fieldmask |= QC_RT_SPC_SOFT;
+	if (src->d_fieldmask & FS_DQ_RTBHARD)
+		dst->d_fieldmask |= QC_RT_SPC_HARD;
+	if (src->d_fieldmask & FS_DQ_BTIMER)
+		dst->d_fieldmask |= QC_SPC_TIMER;
+	if (src->d_fieldmask & FS_DQ_ITIMER)
+		dst->d_fieldmask |= QC_INO_TIMER;
+	if (src->d_fieldmask & FS_DQ_RTBTIMER)
+		dst->d_fieldmask |= QC_RT_SPC_TIMER;
+	if (src->d_fieldmask & FS_DQ_BWARNS)
+		dst->d_fieldmask |= QC_SPC_WARNS;
+	if (src->d_fieldmask & FS_DQ_IWARNS)
+		dst->d_fieldmask |= QC_INO_WARNS;
+	if (src->d_fieldmask & FS_DQ_RTBWARNS)
+		dst->d_fieldmask |= QC_RT_SPC_WARNS;
+	if (src->d_fieldmask & FS_DQ_BCOUNT)
+		dst->d_fieldmask |= QC_SPACE;
+	if (src->d_fieldmask & FS_DQ_ICOUNT)
+		dst->d_fieldmask |= QC_INO_COUNT;
+	if (src->d_fieldmask & FS_DQ_RTBCOUNT)
+		dst->d_fieldmask |= QC_RT_SPACE;
+}
+
 static int quota_setxquota(struct super_block *sb, int type, qid_t id,
 			   void __user *addr)
 {
 	struct fs_disk_quota fdq;
+	struct qc_dqblk qdq;
 	struct kqid qid;
 
 	if (copy_from_user(&fdq, addr, sizeof(fdq)))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:338 @ static int quota_setxquota(struct super_
 	qid = make_kqid(current_user_ns(), type, id);
 	if (!qid_valid(qid))
 		return -EINVAL;
-	return sb->s_qcop->set_dqblk(sb, qid, &fdq);
+	copy_from_xfs_dqblk(&qdq, &fdq);
+	return sb->s_qcop->set_dqblk(sb, qid, &qdq);
+}
+
+static void copy_to_xfs_dqblk(struct fs_disk_quota *dst, struct qc_dqblk *src,
+			      int type, qid_t id)
+{
+	memset(dst, 0, sizeof(*dst));
+	dst->d_version = FS_DQUOT_VERSION;
+	dst->d_id = id;
+	if (type == USRQUOTA)
+		dst->d_flags = FS_USER_QUOTA;
+	else if (type == PRJQUOTA)
+		dst->d_flags = FS_PROJ_QUOTA;
+	else
+		dst->d_flags = FS_GROUP_QUOTA;
+	dst->d_blk_hardlimit = quota_btobb(src->d_spc_hardlimit);
+	dst->d_blk_softlimit = quota_btobb(src->d_spc_softlimit);
+	dst->d_ino_hardlimit = src->d_ino_hardlimit;
+	dst->d_ino_softlimit = src->d_ino_softlimit;
+	dst->d_bcount = quota_btobb(src->d_space);
+	dst->d_icount = src->d_ino_count;
+	dst->d_itimer = src->d_ino_timer;
+	dst->d_btimer = src->d_spc_timer;
+	dst->d_iwarns = src->d_ino_warns;
+	dst->d_bwarns = src->d_spc_warns;
+	dst->d_rtb_hardlimit = quota_btobb(src->d_rt_spc_hardlimit);
+	dst->d_rtb_softlimit = quota_btobb(src->d_rt_spc_softlimit);
+	dst->d_rtbcount = quota_btobb(src->d_rt_space);
+	dst->d_rtbtimer = src->d_rt_spc_timer;
+	dst->d_rtbwarns = src->d_rt_spc_warns;
 }
 
 static int quota_getxquota(struct super_block *sb, int type, qid_t id,
 			   void __user *addr)
 {
 	struct fs_disk_quota fdq;
+	struct qc_dqblk qdq;
 	struct kqid qid;
 	int ret;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:384 @ static int quota_getxquota(struct super_
 	qid = make_kqid(current_user_ns(), type, id);
 	if (!qid_valid(qid))
 		return -EINVAL;
-	ret = sb->s_qcop->get_dqblk(sb, qid, &fdq);
-	if (!ret && copy_to_user(addr, &fdq, sizeof(fdq)))
+	ret = sb->s_qcop->get_dqblk(sb, qid, &qdq);
+	if (ret)
+		return ret;
+	copy_to_xfs_dqblk(&fdq, &qdq, type, id);
+	if (copy_to_user(addr, &fdq, sizeof(fdq)))
 		return -EFAULT;
 	return ret;
 }
Index: linux-3.18.13-rt10-r7s4/fs/quota/quota_v1.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/quota/quota_v1.c
+++ linux-3.18.13-rt10-r7s4/fs/quota/quota_v1.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:172 @ static int v1_read_file_info(struct supe
 	}
 	ret = 0;
 	/* limits are stored as unsigned 32-bit data */
-	dqopt->info[type].dqi_maxblimit = 0xffffffff;
-	dqopt->info[type].dqi_maxilimit = 0xffffffff;
+	dqopt->info[type].dqi_max_spc_limit = 0xffffffffULL << QUOTABLOCK_BITS;
+	dqopt->info[type].dqi_max_ino_limit = 0xffffffff;
 	dqopt->info[type].dqi_igrace =
 			dqblk.dqb_itime ? dqblk.dqb_itime : MAX_IQ_TIME;
 	dqopt->info[type].dqi_bgrace =
Index: linux-3.18.13-rt10-r7s4/fs/quota/quota_v2.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/quota/quota_v2.c
+++ linux-3.18.13-rt10-r7s4/fs/quota/quota_v2.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:120 @ static int v2_read_file_info(struct supe
 	qinfo = info->dqi_priv;
 	if (version == 0) {
 		/* limits are stored as unsigned 32-bit data */
-		info->dqi_maxblimit = 0xffffffff;
-		info->dqi_maxilimit = 0xffffffff;
+		info->dqi_max_spc_limit = 0xffffffffULL << QUOTABLOCK_BITS;
+		info->dqi_max_ino_limit = 0xffffffff;
 	} else {
-		/* used space is stored as unsigned 64-bit value */
-		info->dqi_maxblimit = 0xffffffffffffffffULL;	/* 2^64-1 */
-		info->dqi_maxilimit = 0xffffffffffffffffULL;
+		/* used space is stored as unsigned 64-bit value in bytes */
+		info->dqi_max_spc_limit = 0xffffffffffffffffULL; /* 2^64-1 */
+		info->dqi_max_ino_limit = 0xffffffffffffffffULL;
 	}
 	info->dqi_bgrace = le32_to_cpu(dinfo.dqi_bgrace);
 	info->dqi_igrace = le32_to_cpu(dinfo.dqi_igrace);
Index: linux-3.18.13-rt10-r7s4/fs/reiserfs/super.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/reiserfs/super.c
+++ linux-3.18.13-rt10-r7s4/fs/reiserfs/super.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2164 @ error_unlocked:
 		reiserfs_write_unlock(s);
 	}
 
+	if (sbi->commit_wq)
+		destroy_workqueue(sbi->commit_wq);
+
 	cancel_delayed_work_sync(&REISERFS_SB(s)->old_work);
 
 	reiserfs_free_bitmap_cache(s);
Index: linux-3.18.13-rt10-r7s4/fs/udf/dir.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/udf/dir.c
+++ linux-3.18.13-rt10-r7s4/fs/udf/dir.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:170 @ static int udf_readdir(struct file *file
 			continue;
 		}
 
-		flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
+		flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
+					UDF_NAME_LEN);
 		if (!flen)
 			continue;
 
Index: linux-3.18.13-rt10-r7s4/fs/udf/file.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/udf/file.c
+++ linux-3.18.13-rt10-r7s4/fs/udf/file.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:227 @ out:
 static int udf_release_file(struct inode *inode, struct file *filp)
 {
 	if (filp->f_mode & FMODE_WRITE &&
-	    atomic_read(&inode->i_writecount) > 1) {
+	    atomic_read(&inode->i_writecount) == 1) {
 		/*
 		 * Grab i_mutex to avoid races with writes changing i_size
 		 * while we are running.
Index: linux-3.18.13-rt10-r7s4/fs/udf/inode.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/udf/inode.c
+++ linux-3.18.13-rt10-r7s4/fs/udf/inode.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1291 @ static int udf_read_inode(struct inode *
 	struct kernel_lb_addr *iloc = &iinfo->i_location;
 	unsigned int link_count;
 	unsigned int indirections = 0;
+	int bs = inode->i_sb->s_blocksize;
 	int ret = -EIO;
 
 reread:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1378 @ reread:
 	if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_EFE)) {
 		iinfo->i_efe = 1;
 		iinfo->i_use = 0;
-		ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
+		ret = udf_alloc_i_data(inode, bs -
 					sizeof(struct extendedFileEntry));
 		if (ret)
 			goto out;
 		memcpy(iinfo->i_ext.i_data,
 		       bh->b_data + sizeof(struct extendedFileEntry),
-		       inode->i_sb->s_blocksize -
-					sizeof(struct extendedFileEntry));
+		       bs - sizeof(struct extendedFileEntry));
 	} else if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_FE)) {
 		iinfo->i_efe = 0;
 		iinfo->i_use = 0;
-		ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
-						sizeof(struct fileEntry));
+		ret = udf_alloc_i_data(inode, bs - sizeof(struct fileEntry));
 		if (ret)
 			goto out;
 		memcpy(iinfo->i_ext.i_data,
 		       bh->b_data + sizeof(struct fileEntry),
-		       inode->i_sb->s_blocksize - sizeof(struct fileEntry));
+		       bs - sizeof(struct fileEntry));
 	} else if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_USE)) {
 		iinfo->i_efe = 0;
 		iinfo->i_use = 1;
 		iinfo->i_lenAlloc = le32_to_cpu(
 				((struct unallocSpaceEntry *)bh->b_data)->
 				 lengthAllocDescs);
-		ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
+		ret = udf_alloc_i_data(inode, bs -
 					sizeof(struct unallocSpaceEntry));
 		if (ret)
 			goto out;
 		memcpy(iinfo->i_ext.i_data,
 		       bh->b_data + sizeof(struct unallocSpaceEntry),
-		       inode->i_sb->s_blocksize -
-					sizeof(struct unallocSpaceEntry));
+		       bs - sizeof(struct unallocSpaceEntry));
 		return 0;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1490 @ reread:
 	}
 	inode->i_generation = iinfo->i_unique;
 
+	/*
+	 * Sanity check length of allocation descriptors and extended attrs to
+	 * avoid integer overflows
+	 */
+	if (iinfo->i_lenEAttr > bs || iinfo->i_lenAlloc > bs)
+		goto out;
+	/* Now do exact checks */
+	if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > bs)
+		goto out;
+	/* Sanity checks for files in ICB so that we don't get confused later */
+	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
+		/*
+		 * For file in ICB data is stored in allocation descriptor
+		 * so sizes should match
+		 */
+		if (iinfo->i_lenAlloc != inode->i_size)
+			goto out;
+		/* File in ICB has to fit in there... */
+		if (inode->i_size > bs - udf_file_entry_alloc_offset(inode))
+			goto out;
+	}
+
 	switch (fe->icbTag.fileType) {
 	case ICBTAG_FILE_TYPE_DIRECTORY:
 		inode->i_op = &udf_dir_inode_operations;
Index: linux-3.18.13-rt10-r7s4/fs/udf/namei.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/udf/namei.c
+++ linux-3.18.13-rt10-r7s4/fs/udf/namei.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:236 @ static struct fileIdentDesc *udf_find_en
 		if (!lfi)
 			continue;
 
-		flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
+		flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
+					UDF_NAME_LEN);
 		if (flen && udf_match(flen, fname, child->len, child->name))
 			goto out_ok;
 	}
Index: linux-3.18.13-rt10-r7s4/fs/udf/symlink.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/udf/symlink.c
+++ linux-3.18.13-rt10-r7s4/fs/udf/symlink.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:33 @
 #include <linux/buffer_head.h>
 #include "udf_i.h"
 
-static void udf_pc_to_char(struct super_block *sb, unsigned char *from,
-			   int fromlen, unsigned char *to)
+static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
+			  int fromlen, unsigned char *to, int tolen)
 {
 	struct pathComponent *pc;
 	int elen = 0;
+	int comp_len;
 	unsigned char *p = to;
 
+	/* Reserve one byte for terminating \0 */
+	tolen--;
 	while (elen < fromlen) {
 		pc = (struct pathComponent *)(from + elen);
+		elen += sizeof(struct pathComponent);
 		switch (pc->componentType) {
 		case 1:
 			/*
 			 * Symlink points to some place which should be agreed
  			 * upon between originator and receiver of the media. Ignore.
 			 */
-			if (pc->lengthComponentIdent > 0)
+			if (pc->lengthComponentIdent > 0) {
+				elen += pc->lengthComponentIdent;
 				break;
+			}
 			/* Fall through */
 		case 2:
+			if (tolen == 0)
+				return -ENAMETOOLONG;
 			p = to;
 			*p++ = '/';
+			tolen--;
 			break;
 		case 3:
+			if (tolen < 3)
+				return -ENAMETOOLONG;
 			memcpy(p, "../", 3);
 			p += 3;
+			tolen -= 3;
 			break;
 		case 4:
+			if (tolen < 2)
+				return -ENAMETOOLONG;
 			memcpy(p, "./", 2);
 			p += 2;
+			tolen -= 2;
 			/* that would be . - just ignore */
 			break;
 		case 5:
-			p += udf_get_filename(sb, pc->componentIdent, p,
-					      pc->lengthComponentIdent);
+			elen += pc->lengthComponentIdent;
+			if (elen > fromlen)
+				return -EIO;
+			comp_len = udf_get_filename(sb, pc->componentIdent,
+						    pc->lengthComponentIdent,
+						    p, tolen);
+			p += comp_len;
+			tolen -= comp_len;
+			if (tolen == 0)
+				return -ENAMETOOLONG;
 			*p++ = '/';
+			tolen--;
 			break;
 		}
-		elen += sizeof(struct pathComponent) + pc->lengthComponentIdent;
 	}
 	if (p > to + 1)
 		p[-1] = '\0';
 	else
 		p[0] = '\0';
+	return 0;
 }
 
 static int udf_symlink_filler(struct file *file, struct page *page)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:107 @ static int udf_symlink_filler(struct fil
 	struct inode *inode = page->mapping->host;
 	struct buffer_head *bh = NULL;
 	unsigned char *symlink;
-	int err = -EIO;
+	int err;
 	unsigned char *p = kmap(page);
 	struct udf_inode_info *iinfo;
 	uint32_t pos;
 
+	/* We don't support symlinks longer than one block */
+	if (inode->i_size > inode->i_sb->s_blocksize) {
+		err = -ENAMETOOLONG;
+		goto out_unmap;
+	}
+
 	iinfo = UDF_I(inode);
 	pos = udf_block_map(inode, 0);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:127 @ static int udf_symlink_filler(struct fil
 	} else {
 		bh = sb_bread(inode->i_sb, pos);
 
-		if (!bh)
-			goto out;
+		if (!bh) {
+			err = -EIO;
+			goto out_unlock_inode;
+		}
 
 		symlink = bh->b_data;
 	}
 
-	udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p);
+	err = udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p, PAGE_SIZE);
 	brelse(bh);
+	if (err)
+		goto out_unlock_inode;
 
 	up_read(&iinfo->i_data_sem);
 	SetPageUptodate(page);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:146 @ static int udf_symlink_filler(struct fil
 	unlock_page(page);
 	return 0;
 
-out:
+out_unlock_inode:
 	up_read(&iinfo->i_data_sem);
 	SetPageError(page);
+out_unmap:
 	kunmap(page);
 	unlock_page(page);
 	return err;
Index: linux-3.18.13-rt10-r7s4/fs/udf/udfdecl.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/udf/udfdecl.h
+++ linux-3.18.13-rt10-r7s4/fs/udf/udfdecl.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:214 @ udf_get_lb_pblock(struct super_block *sb
 }
 
 /* unicode.c */
-extern int udf_get_filename(struct super_block *, uint8_t *, uint8_t *, int);
+extern int udf_get_filename(struct super_block *, uint8_t *, int, uint8_t *,
+			    int);
 extern int udf_put_filename(struct super_block *, const uint8_t *, uint8_t *,
 			    int);
 extern int udf_build_ustr(struct ustr *, dstring *, int);
Index: linux-3.18.13-rt10-r7s4/fs/udf/unicode.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/udf/unicode.c
+++ linux-3.18.13-rt10-r7s4/fs/udf/unicode.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:31 @
 
 #include "udf_sb.h"
 
-static int udf_translate_to_linux(uint8_t *, uint8_t *, int, uint8_t *, int);
+static int udf_translate_to_linux(uint8_t *, int, uint8_t *, int, uint8_t *,
+				  int);
 
 static int udf_char_to_ustr(struct ustr *dest, const uint8_t *src, int strlen)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:337 @ try_again:
 	return u_len + 1;
 }
 
-int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
-		     int flen)
+int udf_get_filename(struct super_block *sb, uint8_t *sname, int slen,
+		     uint8_t *dname, int dlen)
 {
 	struct ustr *filename, *unifilename;
 	int len = 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:351 @ int udf_get_filename(struct super_block
 	if (!unifilename)
 		goto out1;
 
-	if (udf_build_ustr_exact(unifilename, sname, flen))
+	if (udf_build_ustr_exact(unifilename, sname, slen))
 		goto out2;
 
 	if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:370 @ int udf_get_filename(struct super_block
 	} else
 		goto out2;
 
-	len = udf_translate_to_linux(dname, filename->u_name, filename->u_len,
+	len = udf_translate_to_linux(dname, dlen,
+				     filename->u_name, filename->u_len,
 				     unifilename->u_name, unifilename->u_len);
 out2:
 	kfree(unifilename);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:408 @ int udf_put_filename(struct super_block
 #define EXT_MARK		'.'
 #define CRC_MARK		'#'
 #define EXT_SIZE 		5
+/* Number of chars we need to store generated CRC to make filename unique */
+#define CRC_LEN			5
 
-static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
-				  int udfLen, uint8_t *fidName,
-				  int fidNameLen)
+static int udf_translate_to_linux(uint8_t *newName, int newLen,
+				  uint8_t *udfName, int udfLen,
+				  uint8_t *fidName, int fidNameLen)
 {
 	int index, newIndex = 0, needsCRC = 0;
 	int extIndex = 0, newExtIndex = 0, hasExt = 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:446 @ static int udf_translate_to_linux(uint8_
 					newExtIndex = newIndex;
 				}
 			}
-			if (newIndex < 256)
+			if (newIndex < newLen)
 				newName[newIndex++] = curr;
 			else
 				needsCRC = 1;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:474 @ static int udf_translate_to_linux(uint8_
 				}
 				ext[localExtIndex++] = curr;
 			}
-			maxFilenameLen = 250 - localExtIndex;
+			maxFilenameLen = newLen - CRC_LEN - localExtIndex;
 			if (newIndex > maxFilenameLen)
 				newIndex = maxFilenameLen;
 			else
 				newIndex = newExtIndex;
-		} else if (newIndex > 250)
-			newIndex = 250;
+		} else if (newIndex > newLen - CRC_LEN)
+			newIndex = newLen - CRC_LEN;
 		newName[newIndex++] = CRC_MARK;
 		valueCRC = crc_itu_t(0, fidName, fidNameLen);
 		newName[newIndex++] = hex_asc_upper_hi(valueCRC >> 8);
Index: linux-3.18.13-rt10-r7s4/fs/xfs/libxfs/xfs_bmap.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/xfs/libxfs/xfs_bmap.c
+++ linux-3.18.13-rt10-r7s4/fs/xfs/libxfs/xfs_bmap.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:979 @ xfs_bmap_local_to_extents(
 	*firstblock = args.fsbno;
 	bp = xfs_btree_get_bufl(args.mp, tp, args.fsbno, 0);
 
-	/* initialise the block and copy the data */
+	/*
+	 * Initialise the block and copy the data
+	 *
+	 * Note: init_fn must set the buffer log item type correctly!
+	 */
 	init_fn(tp, bp, ip, ifp);
 
 	/* account for the change in fork size and log everything */
Index: linux-3.18.13-rt10-r7s4/fs/xfs/libxfs/xfs_symlink_remote.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/xfs/libxfs/xfs_symlink_remote.c
+++ linux-3.18.13-rt10-r7s4/fs/xfs/libxfs/xfs_symlink_remote.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:183 @ xfs_symlink_local_to_remote(
 	struct xfs_mount	*mp = ip->i_mount;
 	char			*buf;
 
+	xfs_trans_buf_set_type(tp, bp, XFS_BLFT_SYMLINK_BUF);
+
 	if (!xfs_sb_version_hascrc(&mp->m_sb)) {
 		bp->b_ops = NULL;
 		memcpy(bp->b_addr, ifp->if_u1.if_data, ifp->if_bytes);
Index: linux-3.18.13-rt10-r7s4/fs/xfs/xfs_buf_item.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/xfs/xfs_buf_item.c
+++ linux-3.18.13-rt10-r7s4/fs/xfs/xfs_buf_item.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:322 @ xfs_buf_item_format(
 	ASSERT(atomic_read(&bip->bli_refcount) > 0);
 	ASSERT((bip->bli_flags & XFS_BLI_LOGGED) ||
 	       (bip->bli_flags & XFS_BLI_STALE));
+	ASSERT((bip->bli_flags & XFS_BLI_STALE) ||
+	       (xfs_blft_from_flags(&bip->__bli_format) > XFS_BLFT_UNKNOWN_BUF
+	        && xfs_blft_from_flags(&bip->__bli_format) < XFS_BLFT_MAX_BUF));
+
 
 	/*
 	 * If it is an inode buffer, transfer the in-memory state to the
Index: linux-3.18.13-rt10-r7s4/fs/xfs/xfs_file.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/xfs/xfs_file.c
+++ linux-3.18.13-rt10-r7s4/fs/xfs/xfs_file.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:366 @ STATIC int				/* error (positive) */
 xfs_zero_last_block(
 	struct xfs_inode	*ip,
 	xfs_fsize_t		offset,
-	xfs_fsize_t		isize)
+	xfs_fsize_t		isize,
+	bool			*did_zeroing)
 {
 	struct xfs_mount	*mp = ip->i_mount;
 	xfs_fileoff_t		last_fsb = XFS_B_TO_FSBT(mp, isize);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:395 @ xfs_zero_last_block(
 	zero_len = mp->m_sb.sb_blocksize - zero_offset;
 	if (isize + zero_len > offset)
 		zero_len = offset - isize;
+	*did_zeroing = true;
 	return xfs_iozero(ip, isize, zero_len);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:414 @ int					/* error (positive) */
 xfs_zero_eof(
 	struct xfs_inode	*ip,
 	xfs_off_t		offset,		/* starting I/O offset */
-	xfs_fsize_t		isize)		/* current inode size */
+	xfs_fsize_t		isize,		/* current inode size */
+	bool			*did_zeroing)
 {
 	struct xfs_mount	*mp = ip->i_mount;
 	xfs_fileoff_t		start_zero_fsb;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:437 @ xfs_zero_eof(
 	 * We only zero a part of that block so it is handled specially.
 	 */
 	if (XFS_B_FSB_OFFSET(mp, isize) != 0) {
-		error = xfs_zero_last_block(ip, offset, isize);
+		error = xfs_zero_last_block(ip, offset, isize, did_zeroing);
 		if (error)
 			return error;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:497 @ xfs_zero_eof(
 		if (error)
 			return error;
 
+		*did_zeroing = true;
 		start_zero_fsb = imap.br_startoff + imap.br_blockcount;
 		ASSERT(start_zero_fsb <= (end_zero_fsb + 1));
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:536 @ restart:
 	 * having to redo all checks before.
 	 */
 	if (*pos > i_size_read(inode)) {
+		bool	zero = false;
+
 		if (*iolock == XFS_IOLOCK_SHARED) {
 			xfs_rw_iunlock(ip, *iolock);
 			*iolock = XFS_IOLOCK_EXCL;
 			xfs_rw_ilock(ip, *iolock);
 			goto restart;
 		}
-		error = xfs_zero_eof(ip, *pos, i_size_read(inode));
+		error = xfs_zero_eof(ip, *pos, i_size_read(inode), &zero);
 		if (error)
 			return error;
 	}
Index: linux-3.18.13-rt10-r7s4/fs/xfs/xfs_inode.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/xfs/xfs_inode.c
+++ linux-3.18.13-rt10-r7s4/fs/xfs/xfs_inode.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2003 @ xfs_iunlink(
 	agi->agi_unlinked[bucket_index] = cpu_to_be32(agino);
 	offset = offsetof(xfs_agi_t, agi_unlinked) +
 		(sizeof(xfs_agino_t) * bucket_index);
+	xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF);
 	xfs_trans_log_buf(tp, agibp, offset,
 			  (offset + sizeof(xfs_agino_t) - 1));
 	return 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2095 @ xfs_iunlink_remove(
 		agi->agi_unlinked[bucket_index] = cpu_to_be32(next_agino);
 		offset = offsetof(xfs_agi_t, agi_unlinked) +
 			(sizeof(xfs_agino_t) * bucket_index);
+		xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF);
 		xfs_trans_log_buf(tp, agibp, offset,
 				  (offset + sizeof(xfs_agino_t) - 1));
 	} else {
Index: linux-3.18.13-rt10-r7s4/fs/xfs/xfs_inode.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/xfs/xfs_inode.h
+++ linux-3.18.13-rt10-r7s4/fs/xfs/xfs_inode.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:382 @ int		xfs_droplink(struct xfs_trans *, st
 int		xfs_bumplink(struct xfs_trans *, struct xfs_inode *);
 
 /* from xfs_file.c */
-int		xfs_zero_eof(struct xfs_inode *, xfs_off_t, xfs_fsize_t);
-int		xfs_iozero(struct xfs_inode *, loff_t, size_t);
+int	xfs_zero_eof(struct xfs_inode *ip, xfs_off_t offset,
+		     xfs_fsize_t isize, bool *did_zeroing);
+int	xfs_iozero(struct xfs_inode *ip, loff_t pos, size_t count);
 
 
 #define IHOLD(ip) \
Index: linux-3.18.13-rt10-r7s4/fs/xfs/xfs_iops.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/xfs/xfs_iops.c
+++ linux-3.18.13-rt10-r7s4/fs/xfs/xfs_iops.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:747 @ xfs_setattr_size(
 	int			error;
 	uint			lock_flags = 0;
 	uint			commit_flags = 0;
+	bool			did_zeroing = false;
 
 	trace_xfs_setattr(ip);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:791 @ xfs_setattr_size(
 		return error;
 
 	/*
-	 * Now we can make the changes.  Before we join the inode to the
-	 * transaction, take care of the part of the truncation that must be
-	 * done without the inode lock.  This needs to be done before joining
-	 * the inode to the transaction, because the inode cannot be unlocked
-	 * once it is a part of the transaction.
+	 * File data changes must be complete before we start the transaction to
+	 * modify the inode.  This needs to be done before joining the inode to
+	 * the transaction because the inode cannot be unlocked once it is a
+	 * part of the transaction.
+	 *
+	 * Start with zeroing any data block beyond EOF that we may expose on
+	 * file extension.
 	 */
 	if (newsize > oldsize) {
-		/*
-		 * Do the first part of growing a file: zero any data in the
-		 * last block that is beyond the old EOF.  We need to do this
-		 * before the inode is joined to the transaction to modify
-		 * i_size.
-		 */
-		error = xfs_zero_eof(ip, newsize, oldsize);
+		error = xfs_zero_eof(ip, newsize, oldsize, &did_zeroing);
 		if (error)
 			return error;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:810 @ xfs_setattr_size(
 	 * any previous writes that are beyond the on disk EOF and the new
 	 * EOF that have not been written out need to be written here.  If we
 	 * do not write the data out, we expose ourselves to the null files
-	 * problem.
-	 *
-	 * Only flush from the on disk size to the smaller of the in memory
-	 * file size or the new size as that's the range we really care about
-	 * here and prevents waiting for other data not within the range we
-	 * care about here.
+	 * problem. Note that this includes any block zeroing we did above;
+	 * otherwise those blocks may not be zeroed after a crash.
 	 */
-	if (oldsize != ip->i_d.di_size && newsize > ip->i_d.di_size) {
+	if (newsize > ip->i_d.di_size &&
+	    (oldsize != ip->i_d.di_size || did_zeroing)) {
 		error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
 						      ip->i_d.di_size, newsize);
 		if (error)
 			return error;
 	}
 
-	/*
-	 * Wait for all direct I/O to complete.
-	 */
+	/* Now wait for all direct I/O to complete. */
 	inode_dio_wait(inode);
 
 	/*
Index: linux-3.18.13-rt10-r7s4/fs/xfs/xfs_qm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/xfs/xfs_qm.c
+++ linux-3.18.13-rt10-r7s4/fs/xfs/xfs_qm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:847 @ xfs_qm_reset_dqcounts(
 		 */
 		xfs_dqcheck(mp, ddq, id+j, type, XFS_QMOPT_DQREPAIR,
 			    "xfs_quotacheck");
+		/*
+		 * Reset type in case we are reusing group quota file for
+		 * project quotas or vice versa
+		 */
+		ddq->d_flags = type;
 		ddq->d_bcount = 0;
 		ddq->d_icount = 0;
 		ddq->d_rtbcount = 0;
Index: linux-3.18.13-rt10-r7s4/fs/xfs/xfs_qm.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/xfs/xfs_qm.h
+++ linux-3.18.13-rt10-r7s4/fs/xfs/xfs_qm.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:169 @ extern void		xfs_qm_dqrele_all_inodes(st
 /* quota ops */
 extern int		xfs_qm_scall_trunc_qfiles(struct xfs_mount *, uint);
 extern int		xfs_qm_scall_getquota(struct xfs_mount *, xfs_dqid_t,
-					uint, struct fs_disk_quota *);
+					uint, struct qc_dqblk *);
 extern int		xfs_qm_scall_setqlim(struct xfs_mount *, xfs_dqid_t, uint,
-					struct fs_disk_quota *);
+					struct qc_dqblk *);
 extern int		xfs_qm_scall_getqstat(struct xfs_mount *,
 					struct fs_quota_stat *);
 extern int		xfs_qm_scall_getqstatv(struct xfs_mount *,
Index: linux-3.18.13-rt10-r7s4/fs/xfs/xfs_qm_syscalls.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/xfs/xfs_qm_syscalls.c
+++ linux-3.18.13-rt10-r7s4/fs/xfs/xfs_qm_syscalls.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:43 @ STATIC int	xfs_qm_log_quotaoff(xfs_mount
 STATIC int	xfs_qm_log_quotaoff_end(xfs_mount_t *, xfs_qoff_logitem_t *,
 					uint);
 STATIC uint	xfs_qm_export_flags(uint);
-STATIC uint	xfs_qm_export_qtype_flags(uint);
 
 /*
  * Turn off quota accounting and/or enforcement for all udquots and/or
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:576 @ xfs_qm_scall_getqstatv(
 	return 0;
 }
 
-#define XFS_DQ_MASK \
-	(FS_DQ_LIMIT_MASK | FS_DQ_TIMER_MASK | FS_DQ_WARNS_MASK)
+#define XFS_QC_MASK \
+	(QC_LIMIT_MASK | QC_TIMER_MASK | QC_WARNS_MASK)
 
 /*
  * Adjust quota limits, and start/stop timers accordingly.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:587 @ xfs_qm_scall_setqlim(
 	struct xfs_mount	*mp,
 	xfs_dqid_t		id,
 	uint			type,
-	fs_disk_quota_t		*newlim)
+	struct qc_dqblk		*newlim)
 {
 	struct xfs_quotainfo	*q = mp->m_quotainfo;
 	struct xfs_disk_dquot	*ddq;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:596 @ xfs_qm_scall_setqlim(
 	int			error;
 	xfs_qcnt_t		hard, soft;
 
-	if (newlim->d_fieldmask & ~XFS_DQ_MASK)
+	if (newlim->d_fieldmask & ~XFS_QC_MASK)
 		return -EINVAL;
-	if ((newlim->d_fieldmask & XFS_DQ_MASK) == 0)
+	if ((newlim->d_fieldmask & XFS_QC_MASK) == 0)
 		return 0;
 
 	/*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:636 @ xfs_qm_scall_setqlim(
 	/*
 	 * Make sure that hardlimits are >= soft limits before changing.
 	 */
-	hard = (newlim->d_fieldmask & FS_DQ_BHARD) ?
-		(xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_blk_hardlimit) :
+	hard = (newlim->d_fieldmask & QC_SPC_HARD) ?
+		(xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_spc_hardlimit) :
 			be64_to_cpu(ddq->d_blk_hardlimit);
-	soft = (newlim->d_fieldmask & FS_DQ_BSOFT) ?
-		(xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_blk_softlimit) :
+	soft = (newlim->d_fieldmask & QC_SPC_SOFT) ?
+		(xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_spc_softlimit) :
 			be64_to_cpu(ddq->d_blk_softlimit);
 	if (hard == 0 || hard >= soft) {
 		ddq->d_blk_hardlimit = cpu_to_be64(hard);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:653 @ xfs_qm_scall_setqlim(
 	} else {
 		xfs_debug(mp, "blkhard %Ld < blksoft %Ld", hard, soft);
 	}
-	hard = (newlim->d_fieldmask & FS_DQ_RTBHARD) ?
-		(xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_rtb_hardlimit) :
+	hard = (newlim->d_fieldmask & QC_RT_SPC_HARD) ?
+		(xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_rt_spc_hardlimit) :
 			be64_to_cpu(ddq->d_rtb_hardlimit);
-	soft = (newlim->d_fieldmask & FS_DQ_RTBSOFT) ?
-		(xfs_qcnt_t) XFS_BB_TO_FSB(mp, newlim->d_rtb_softlimit) :
+	soft = (newlim->d_fieldmask & QC_RT_SPC_SOFT) ?
+		(xfs_qcnt_t) XFS_B_TO_FSB(mp, newlim->d_rt_spc_softlimit) :
 			be64_to_cpu(ddq->d_rtb_softlimit);
 	if (hard == 0 || hard >= soft) {
 		ddq->d_rtb_hardlimit = cpu_to_be64(hard);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:670 @ xfs_qm_scall_setqlim(
 		xfs_debug(mp, "rtbhard %Ld < rtbsoft %Ld", hard, soft);
 	}
 
-	hard = (newlim->d_fieldmask & FS_DQ_IHARD) ?
+	hard = (newlim->d_fieldmask & QC_INO_HARD) ?
 		(xfs_qcnt_t) newlim->d_ino_hardlimit :
 			be64_to_cpu(ddq->d_ino_hardlimit);
-	soft = (newlim->d_fieldmask & FS_DQ_ISOFT) ?
+	soft = (newlim->d_fieldmask & QC_INO_SOFT) ?
 		(xfs_qcnt_t) newlim->d_ino_softlimit :
 			be64_to_cpu(ddq->d_ino_softlimit);
 	if (hard == 0 || hard >= soft) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:690 @ xfs_qm_scall_setqlim(
 	/*
 	 * Update warnings counter(s) if requested
 	 */
-	if (newlim->d_fieldmask & FS_DQ_BWARNS)
-		ddq->d_bwarns = cpu_to_be16(newlim->d_bwarns);
-	if (newlim->d_fieldmask & FS_DQ_IWARNS)
-		ddq->d_iwarns = cpu_to_be16(newlim->d_iwarns);
-	if (newlim->d_fieldmask & FS_DQ_RTBWARNS)
-		ddq->d_rtbwarns = cpu_to_be16(newlim->d_rtbwarns);
+	if (newlim->d_fieldmask & QC_SPC_WARNS)
+		ddq->d_bwarns = cpu_to_be16(newlim->d_spc_warns);
+	if (newlim->d_fieldmask & QC_INO_WARNS)
+		ddq->d_iwarns = cpu_to_be16(newlim->d_ino_warns);
+	if (newlim->d_fieldmask & QC_RT_SPC_WARNS)
+		ddq->d_rtbwarns = cpu_to_be16(newlim->d_rt_spc_warns);
 
 	if (id == 0) {
 		/*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:705 @ xfs_qm_scall_setqlim(
 		 * soft and hard limit values (already done, above), and
 		 * for warnings.
 		 */
-		if (newlim->d_fieldmask & FS_DQ_BTIMER) {
-			q->qi_btimelimit = newlim->d_btimer;
-			ddq->d_btimer = cpu_to_be32(newlim->d_btimer);
+		if (newlim->d_fieldmask & QC_SPC_TIMER) {
+			q->qi_btimelimit = newlim->d_spc_timer;
+			ddq->d_btimer = cpu_to_be32(newlim->d_spc_timer);
 		}
-		if (newlim->d_fieldmask & FS_DQ_ITIMER) {
-			q->qi_itimelimit = newlim->d_itimer;
-			ddq->d_itimer = cpu_to_be32(newlim->d_itimer);
+		if (newlim->d_fieldmask & QC_INO_TIMER) {
+			q->qi_itimelimit = newlim->d_ino_timer;
+			ddq->d_itimer = cpu_to_be32(newlim->d_ino_timer);
 		}
-		if (newlim->d_fieldmask & FS_DQ_RTBTIMER) {
-			q->qi_rtbtimelimit = newlim->d_rtbtimer;
-			ddq->d_rtbtimer = cpu_to_be32(newlim->d_rtbtimer);
+		if (newlim->d_fieldmask & QC_RT_SPC_TIMER) {
+			q->qi_rtbtimelimit = newlim->d_rt_spc_timer;
+			ddq->d_rtbtimer = cpu_to_be32(newlim->d_rt_spc_timer);
 		}
-		if (newlim->d_fieldmask & FS_DQ_BWARNS)
-			q->qi_bwarnlimit = newlim->d_bwarns;
-		if (newlim->d_fieldmask & FS_DQ_IWARNS)
-			q->qi_iwarnlimit = newlim->d_iwarns;
-		if (newlim->d_fieldmask & FS_DQ_RTBWARNS)
-			q->qi_rtbwarnlimit = newlim->d_rtbwarns;
+		if (newlim->d_fieldmask & QC_SPC_WARNS)
+			q->qi_bwarnlimit = newlim->d_spc_warns;
+		if (newlim->d_fieldmask & QC_INO_WARNS)
+			q->qi_iwarnlimit = newlim->d_ino_warns;
+		if (newlim->d_fieldmask & QC_RT_SPC_WARNS)
+			q->qi_rtbwarnlimit = newlim->d_rt_spc_warns;
 	} else {
 		/*
 		 * If the user is now over quota, start the timelimit.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:833 @ xfs_qm_scall_getquota(
 	struct xfs_mount	*mp,
 	xfs_dqid_t		id,
 	uint			type,
-	struct fs_disk_quota	*dst)
+	struct qc_dqblk		*dst)
 {
 	struct xfs_dquot	*dqp;
 	int			error;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:857 @ xfs_qm_scall_getquota(
 	}
 
 	memset(dst, 0, sizeof(*dst));
-	dst->d_version = FS_DQUOT_VERSION;
-	dst->d_flags = xfs_qm_export_qtype_flags(dqp->q_core.d_flags);
-	dst->d_id = be32_to_cpu(dqp->q_core.d_id);
-	dst->d_blk_hardlimit =
-		XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_blk_hardlimit));
-	dst->d_blk_softlimit =
-		XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_blk_softlimit));
+	dst->d_spc_hardlimit =
+		XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_blk_hardlimit));
+	dst->d_spc_softlimit =
+		XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_blk_softlimit));
 	dst->d_ino_hardlimit = be64_to_cpu(dqp->q_core.d_ino_hardlimit);
 	dst->d_ino_softlimit = be64_to_cpu(dqp->q_core.d_ino_softlimit);
-	dst->d_bcount = XFS_FSB_TO_BB(mp, dqp->q_res_bcount);
-	dst->d_icount = dqp->q_res_icount;
-	dst->d_btimer = be32_to_cpu(dqp->q_core.d_btimer);
-	dst->d_itimer = be32_to_cpu(dqp->q_core.d_itimer);
-	dst->d_iwarns = be16_to_cpu(dqp->q_core.d_iwarns);
-	dst->d_bwarns = be16_to_cpu(dqp->q_core.d_bwarns);
-	dst->d_rtb_hardlimit =
-		XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_rtb_hardlimit));
-	dst->d_rtb_softlimit =
-		XFS_FSB_TO_BB(mp, be64_to_cpu(dqp->q_core.d_rtb_softlimit));
-	dst->d_rtbcount = XFS_FSB_TO_BB(mp, dqp->q_res_rtbcount);
-	dst->d_rtbtimer = be32_to_cpu(dqp->q_core.d_rtbtimer);
-	dst->d_rtbwarns = be16_to_cpu(dqp->q_core.d_rtbwarns);
+	dst->d_space = XFS_FSB_TO_B(mp, dqp->q_res_bcount);
+	dst->d_ino_count = dqp->q_res_icount;
+	dst->d_spc_timer = be32_to_cpu(dqp->q_core.d_btimer);
+	dst->d_ino_timer = be32_to_cpu(dqp->q_core.d_itimer);
+	dst->d_ino_warns = be16_to_cpu(dqp->q_core.d_iwarns);
+	dst->d_spc_warns = be16_to_cpu(dqp->q_core.d_bwarns);
+	dst->d_rt_spc_hardlimit =
+		XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_rtb_hardlimit));
+	dst->d_rt_spc_softlimit =
+		XFS_FSB_TO_B(mp, be64_to_cpu(dqp->q_core.d_rtb_softlimit));
+	dst->d_rt_space = XFS_FSB_TO_B(mp, dqp->q_res_rtbcount);
+	dst->d_rt_spc_timer = be32_to_cpu(dqp->q_core.d_rtbtimer);
+	dst->d_rt_spc_warns = be16_to_cpu(dqp->q_core.d_rtbwarns);
 
 	/*
 	 * Internally, we don't reset all the timers when quota enforcement
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:888 @ xfs_qm_scall_getquota(
 	     dqp->q_core.d_flags == XFS_DQ_GROUP) ||
 	    (!XFS_IS_PQUOTA_ENFORCED(mp) &&
 	     dqp->q_core.d_flags == XFS_DQ_PROJ)) {
-		dst->d_btimer = 0;
-		dst->d_itimer = 0;
-		dst->d_rtbtimer = 0;
+		dst->d_spc_timer = 0;
+		dst->d_ino_timer = 0;
+		dst->d_rt_spc_timer = 0;
 	}
 
 #ifdef DEBUG
-	if (((XFS_IS_UQUOTA_ENFORCED(mp) && dst->d_flags == FS_USER_QUOTA) ||
-	     (XFS_IS_GQUOTA_ENFORCED(mp) && dst->d_flags == FS_GROUP_QUOTA) ||
-	     (XFS_IS_PQUOTA_ENFORCED(mp) && dst->d_flags == FS_PROJ_QUOTA)) &&
-	    dst->d_id != 0) {
-		if ((dst->d_bcount > dst->d_blk_softlimit) &&
-		    (dst->d_blk_softlimit > 0)) {
-			ASSERT(dst->d_btimer != 0);
+	if (((XFS_IS_UQUOTA_ENFORCED(mp) && type == XFS_DQ_USER) ||
+	     (XFS_IS_GQUOTA_ENFORCED(mp) && type == XFS_DQ_GROUP) ||
+	     (XFS_IS_PQUOTA_ENFORCED(mp) && type == XFS_DQ_PROJ)) &&
+	    id != 0) {
+		if ((dst->d_space > dst->d_spc_softlimit) &&
+		    (dst->d_spc_softlimit > 0)) {
+			ASSERT(dst->d_spc_timer != 0);
 		}
-		if ((dst->d_icount > dst->d_ino_softlimit) &&
+		if ((dst->d_ino_count > dst->d_ino_softlimit) &&
 		    (dst->d_ino_softlimit > 0)) {
-			ASSERT(dst->d_itimer != 0);
+			ASSERT(dst->d_ino_timer != 0);
 		}
 	}
 #endif
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:914 @ out_put:
 }
 
 STATIC uint
-xfs_qm_export_qtype_flags(
-	uint flags)
-{
-	/*
-	 * Can't be more than one, or none.
-	 */
-	ASSERT((flags & (FS_PROJ_QUOTA | FS_USER_QUOTA)) !=
-		(FS_PROJ_QUOTA | FS_USER_QUOTA));
-	ASSERT((flags & (FS_PROJ_QUOTA | FS_GROUP_QUOTA)) !=
-		(FS_PROJ_QUOTA | FS_GROUP_QUOTA));
-	ASSERT((flags & (FS_USER_QUOTA | FS_GROUP_QUOTA)) !=
-		(FS_USER_QUOTA | FS_GROUP_QUOTA));
-	ASSERT((flags & (FS_PROJ_QUOTA|FS_USER_QUOTA|FS_GROUP_QUOTA)) != 0);
-
-	return (flags & XFS_DQ_USER) ?
-		FS_USER_QUOTA : (flags & XFS_DQ_PROJ) ?
-			FS_PROJ_QUOTA : FS_GROUP_QUOTA;
-}
-
-STATIC uint
 xfs_qm_export_flags(
 	uint flags)
 {
Index: linux-3.18.13-rt10-r7s4/fs/xfs/xfs_quotaops.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/xfs/xfs_quotaops.c
+++ linux-3.18.13-rt10-r7s4/fs/xfs/xfs_quotaops.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:136 @ STATIC int
 xfs_fs_get_dqblk(
 	struct super_block	*sb,
 	struct kqid		qid,
-	struct fs_disk_quota	*fdq)
+	struct qc_dqblk		*qdq)
 {
 	struct xfs_mount	*mp = XFS_M(sb);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:146 @ xfs_fs_get_dqblk(
 		return -ESRCH;
 
 	return xfs_qm_scall_getquota(mp, from_kqid(&init_user_ns, qid),
-				      xfs_quota_type(qid.type), fdq);
+				      xfs_quota_type(qid.type), qdq);
 }
 
 STATIC int
 xfs_fs_set_dqblk(
 	struct super_block	*sb,
 	struct kqid		qid,
-	struct fs_disk_quota	*fdq)
+	struct qc_dqblk		*qdq)
 {
 	struct xfs_mount	*mp = XFS_M(sb);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:165 @ xfs_fs_set_dqblk(
 		return -ESRCH;
 
 	return xfs_qm_scall_setqlim(mp, from_kqid(&init_user_ns, qid),
-				     xfs_quota_type(qid.type), fdq);
+				     xfs_quota_type(qid.type), qdq);
 }
 
 const struct quotactl_ops xfs_quotactl_operations = {
Index: linux-3.18.13-rt10-r7s4/fs/xfs/xfs_trans.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/fs/xfs/xfs_trans.c
+++ linux-3.18.13-rt10-r7s4/fs/xfs/xfs_trans.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:477 @ xfs_trans_apply_sb_deltas(
 		whole = 1;
 	}
 
+	xfs_trans_buf_set_type(tp, bp, XFS_BLFT_SB_BUF);
 	if (whole)
 		/*
 		 * Log the whole thing, the fields are noncontiguous.
Index: linux-3.18.13-rt10-r7s4/include/acpi/acpi_bus.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/acpi/acpi_bus.h
+++ linux-3.18.13-rt10-r7s4/include/acpi/acpi_bus.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:315 @ struct acpi_device_wakeup_flags {
 	u8 valid:1;		/* Can successfully enable wakeup? */
 	u8 run_wake:1;		/* Run-Wake GPE devices */
 	u8 notifier_present:1;  /* Wake-up notify handler has been installed */
+	u8 enabled:1;		/* Enabled for wakeup */
 };
 
 struct acpi_device_wakeup_context {
Index: linux-3.18.13-rt10-r7s4/include/asm-generic/tlb.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/asm-generic/tlb.h
+++ linux-3.18.13-rt10-r7s4/include/asm-generic/tlb.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:99 @ struct mmu_gather {
 #endif
 	unsigned long		start;
 	unsigned long		end;
-	unsigned int		need_flush : 1,	/* Did free PTEs */
 	/* we are in the middle of an operation to clear
 	 * a full mm and can make some optimizations */
-				fullmm : 1,
+	unsigned int		fullmm : 1,
 	/* we have performed an operation which
 	 * requires a complete flush of the tlb */
 				need_flush_all : 1;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:130 @ static inline void tlb_remove_page(struc
 		tlb_flush_mmu(tlb);
 }
 
+static inline void __tlb_adjust_range(struct mmu_gather *tlb,
+				      unsigned long address)
+{
+	tlb->start = min(tlb->start, address);
+	tlb->end = max(tlb->end, address + PAGE_SIZE);
+}
+
+static inline void __tlb_reset_range(struct mmu_gather *tlb)
+{
+	tlb->start = TASK_SIZE;
+	tlb->end = 0;
+}
+
+/*
+ * In the case of tlb vma handling, we can optimise these away in the
+ * case where we're doing a full MM flush.  When we're doing a munmap,
+ * the vmas are adjusted to only cover the region to be torn down.
+ */
+#ifndef tlb_start_vma
+#define tlb_start_vma(tlb, vma) do { } while (0)
+#endif
+
+#define __tlb_end_vma(tlb, vma)					\
+	do {							\
+		if (!tlb->fullmm && tlb->end) {			\
+			tlb_flush(tlb);				\
+			__tlb_reset_range(tlb);			\
+		}						\
+	} while (0)
+
+#ifndef tlb_end_vma
+#define tlb_end_vma	__tlb_end_vma
+#endif
+
+#ifndef __tlb_remove_tlb_entry
+#define __tlb_remove_tlb_entry(tlb, ptep, address) do { } while (0)
+#endif
+
 /**
  * tlb_remove_tlb_entry - remember a pte unmapping for later tlb invalidation.
  *
- * Record the fact that pte's were really umapped in ->need_flush, so we can
- * later optimise away the tlb invalidate.   This helps when userspace is
- * unmapping already-unmapped pages, which happens quite a lot.
+ * Record the fact that pte's were really unmapped by updating the range,
+ * so we can later optimise away the tlb invalidate.   This helps when
+ * userspace is unmapping already-unmapped pages, which happens quite a lot.
  */
 #define tlb_remove_tlb_entry(tlb, ptep, address)		\
 	do {							\
-		tlb->need_flush = 1;				\
+		__tlb_adjust_range(tlb, address);		\
 		__tlb_remove_tlb_entry(tlb, ptep, address);	\
 	} while (0)
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:191 @ static inline void tlb_remove_page(struc
 
 #define tlb_remove_pmd_tlb_entry(tlb, pmdp, address)		\
 	do {							\
-		tlb->need_flush = 1;				\
+		__tlb_adjust_range(tlb, address);		\
 		__tlb_remove_pmd_tlb_entry(tlb, pmdp, address);	\
 	} while (0)
 
 #define pte_free_tlb(tlb, ptep, address)			\
 	do {							\
-		tlb->need_flush = 1;				\
+		__tlb_adjust_range(tlb, address);		\
 		__pte_free_tlb(tlb, ptep, address);		\
 	} while (0)
 
 #ifndef __ARCH_HAS_4LEVEL_HACK
 #define pud_free_tlb(tlb, pudp, address)			\
 	do {							\
-		tlb->need_flush = 1;				\
+		__tlb_adjust_range(tlb, address);		\
 		__pud_free_tlb(tlb, pudp, address);		\
 	} while (0)
 #endif
 
 #define pmd_free_tlb(tlb, pmdp, address)			\
 	do {							\
-		tlb->need_flush = 1;				\
+		__tlb_adjust_range(tlb, address);		\
 		__pmd_free_tlb(tlb, pmdp, address);		\
 	} while (0)
 
Index: linux-3.18.13-rt10-r7s4/include/drm/i915_pciids.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/drm/i915_pciids.h
+++ linux-3.18.13-rt10-r7s4/include/drm/i915_pciids.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:217 @
 	INTEL_VGA_DEVICE((((gt) - 1) << 4) | (id), info)
 
 #define _INTEL_BDW_M_IDS(gt, info) \
-	_INTEL_BDW_M(gt, 0x1602, info), /* ULT */ \
+	_INTEL_BDW_M(gt, 0x1602, info), /* Halo */ \
 	_INTEL_BDW_M(gt, 0x1606, info), /* ULT */ \
-	_INTEL_BDW_M(gt, 0x160B, info), /* Iris */ \
+	_INTEL_BDW_M(gt, 0x160B, info), /* ULT */ \
 	_INTEL_BDW_M(gt, 0x160E, info) /* ULX */
 
 #define _INTEL_BDW_D_IDS(gt, info) \
Index: linux-3.18.13-rt10-r7s4/include/linux/audit.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/audit.h
+++ linux-3.18.13-rt10-r7s4/include/linux/audit.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:50 @ struct sk_buff;
 
 struct audit_krule {
 	int			vers_ops;
+	u32			pflags;
 	u32			flags;
 	u32			listnr;
 	u32			action;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:68 @ struct audit_krule {
 	u64			prio;
 };
 
+/* Flag to indicate legacy AUDIT_LOGINUID unset usage */
+#define AUDIT_LOGINUID_LEGACY		0x1
+
 struct audit_field {
 	u32				type;
 	union {
Index: linux-3.18.13-rt10-r7s4/include/linux/blk_types.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/blk_types.h
+++ linux-3.18.13-rt10-r7s4/include/linux/blk_types.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:184 @ enum rq_flag_bits {
 	__REQ_ELVPRIV,		/* elevator private data attached */
 	__REQ_FAILED,		/* set if the request failed */
 	__REQ_QUIET,		/* don't worry about errors */
-	__REQ_PREEMPT,		/* set for "ide_preempt" requests */
+	__REQ_PREEMPT,		/* set for "ide_preempt" requests and also
+				   for requests for which the SCSI "quiesce"
+				   state must be ignored. */
 	__REQ_ALLOCED,		/* request came from our alloc pool */
 	__REQ_COPY_USER,	/* contains copies of user pages */
 	__REQ_FLUSH_SEQ,	/* request for flush sequence */
Index: linux-3.18.13-rt10-r7s4/include/linux/compiler.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/compiler.h
+++ linux-3.18.13-rt10-r7s4/include/linux/compiler.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:189 @ void ftrace_likely_update(struct ftrace_
 # define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __LINE__)
 #endif
 
+#include <uapi/linux/types.h>
+
+static __always_inline void data_access_exceeds_word_size(void)
+#ifdef __compiletime_warning
+__compiletime_warning("data access exceeds word size and won't be atomic")
+#endif
+;
+
+static __always_inline void data_access_exceeds_word_size(void)
+{
+}
+
+static __always_inline void __read_once_size(volatile void *p, void *res, int size)
+{
+	switch (size) {
+	case 1: *(__u8 *)res = *(volatile __u8 *)p; break;
+	case 2: *(__u16 *)res = *(volatile __u16 *)p; break;
+	case 4: *(__u32 *)res = *(volatile __u32 *)p; break;
+#ifdef CONFIG_64BIT
+	case 8: *(__u64 *)res = *(volatile __u64 *)p; break;
+#endif
+	default:
+		barrier();
+		__builtin_memcpy((void *)res, (const void *)p, size);
+		data_access_exceeds_word_size();
+		barrier();
+	}
+}
+
+static __always_inline void __write_once_size(volatile void *p, void *res, int size)
+{
+	switch (size) {
+	case 1: *(volatile __u8 *)p = *(__u8 *)res; break;
+	case 2: *(volatile __u16 *)p = *(__u16 *)res; break;
+	case 4: *(volatile __u32 *)p = *(__u32 *)res; break;
+#ifdef CONFIG_64BIT
+	case 8: *(volatile __u64 *)p = *(__u64 *)res; break;
+#endif
+	default:
+		barrier();
+		__builtin_memcpy((void *)p, (const void *)res, size);
+		data_access_exceeds_word_size();
+		barrier();
+	}
+}
+
+/*
+ * Prevent the compiler from merging or refetching reads or writes. The
+ * compiler is also forbidden from reordering successive instances of
+ * READ_ONCE, WRITE_ONCE and ACCESS_ONCE (see below), but only when the
+ * compiler is aware of some particular ordering.  One way to make the
+ * compiler aware of ordering is to put the two invocations of READ_ONCE,
+ * WRITE_ONCE or ACCESS_ONCE() in different C statements.
+ *
+ * In contrast to ACCESS_ONCE these two macros will also work on aggregate
+ * data types like structs or unions. If the size of the accessed data
+ * type exceeds the word size of the machine (e.g., 32 bits or 64 bits)
+ * READ_ONCE() and WRITE_ONCE()  will fall back to memcpy and print a
+ * compile-time warning.
+ *
+ * Their two major use cases are: (1) Mediating communication between
+ * process-level code and irq/NMI handlers, all running on the same CPU,
+ * and (2) Ensuring that the compiler does not  fold, spindle, or otherwise
+ * mutilate accesses that either do not require ordering or that interact
+ * with an explicit memory barrier or atomic instruction that provides the
+ * required ordering.
+ */
+
+#define READ_ONCE(x) \
+	({ typeof(x) __val; __read_once_size(&x, &__val, sizeof(__val)); __val; })
+
+#define WRITE_ONCE(x, val) \
+	({ typeof(x) __val; __val = val; __write_once_size(&x, &__val, sizeof(__val)); __val; })
+
 #endif /* __KERNEL__ */
 
 #endif /* __ASSEMBLY__ */
Index: linux-3.18.13-rt10-r7s4/include/linux/cpuidle.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/cpuidle.h
+++ linux-3.18.13-rt10-r7s4/include/linux/cpuidle.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:72 @ struct cpuidle_device {
 	unsigned int		cpu;
 
 	int			last_residency;
-	int			state_count;
 	struct cpuidle_state_usage	states_usage[CPUIDLE_STATE_MAX];
 	struct cpuidle_state_kobj *kobjs[CPUIDLE_STATE_MAX];
 	struct cpuidle_driver_kobj *kobj_driver;
Index: linux-3.18.13-rt10-r7s4/include/linux/cred.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/cred.h
+++ linux-3.18.13-rt10-r7s4/include/linux/cred.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:71 @ extern void groups_free(struct group_inf
 extern int set_current_groups(struct group_info *);
 extern void set_groups(struct cred *, struct group_info *);
 extern int groups_search(const struct group_info *, kgid_t);
+extern bool may_setgroups(void);
 
 /* access the groups "array" with this macro */
 #define GROUP_AT(gi, i) \
Index: linux-3.18.13-rt10-r7s4/include/linux/crypto.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/crypto.h
+++ linux-3.18.13-rt10-r7s4/include/linux/crypto.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:29 @
 #include <linux/uaccess.h>
 
 /*
+ * Autoloaded crypto modules should only use a prefixed name to avoid allowing
+ * arbitrary modules to be loaded. Loading from userspace may still need the
+ * unprefixed names, so retains those aliases as well.
+ * This uses __MODULE_INFO directly instead of MODULE_ALIAS because pre-4.3
+ * gcc (e.g. avr32 toolchain) uses __LINE__ for uniqueness, and this macro
+ * expands twice on the same line. Instead, use a separate base name for the
+ * alias.
+ */
+#define MODULE_ALIAS_CRYPTO(name)	\
+		__MODULE_INFO(alias, alias_userspace, name);	\
+		__MODULE_INFO(alias, alias_crypto, "crypto-" name)
+
+/*
  * Algorithm masks and types.
  */
 #define CRYPTO_ALG_TYPE_MASK		0x0000000f
Index: linux-3.18.13-rt10-r7s4/include/linux/dcache.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/dcache.h
+++ linux-3.18.13-rt10-r7s4/include/linux/dcache.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:127 @ struct dentry {
 	void *d_fsdata;			/* fs-specific data */
 
 	struct list_head d_lru;		/* LRU list */
+	struct list_head d_child;	/* child of parent list */
+	struct list_head d_subdirs;	/* our children */
 	/*
-	 * d_child and d_rcu can share memory
+	 * d_alias and d_rcu can share memory
 	 */
 	union {
-		struct list_head d_child;	/* child of parent list */
+		struct hlist_node d_alias;	/* inode alias list */
 	 	struct rcu_head d_rcu;
 	} d_u;
-	struct list_head d_subdirs;	/* our children */
-	struct hlist_node d_alias;	/* inode alias list */
 };
 
 /*
Index: linux-3.18.13-rt10-r7s4/include/linux/device-mapper.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/device-mapper.h
+++ linux-3.18.13-rt10-r7s4/include/linux/device-mapper.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:369 @ int dm_create(int minor, struct mapped_d
  */
 struct mapped_device *dm_get_md(dev_t dev);
 void dm_get(struct mapped_device *md);
+int dm_hold(struct mapped_device *md);
 void dm_put(struct mapped_device *md);
 
 /*
Index: linux-3.18.13-rt10-r7s4/include/linux/fsnotify.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/fsnotify.h
+++ linux-3.18.13-rt10-r7s4/include/linux/fsnotify.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:104 @ static inline void fsnotify_move(struct
 		new_dir_mask |= FS_ISDIR;
 	}
 
-	fsnotify(old_dir, old_dir_mask, old_dir, FSNOTIFY_EVENT_INODE, old_name, fs_cookie);
-	fsnotify(new_dir, new_dir_mask, new_dir, FSNOTIFY_EVENT_INODE, new_name, fs_cookie);
+	fsnotify(old_dir, old_dir_mask, source, FSNOTIFY_EVENT_INODE, old_name,
+		 fs_cookie);
+	fsnotify(new_dir, new_dir_mask, source, FSNOTIFY_EVENT_INODE, new_name,
+		 fs_cookie);
 
 	if (target)
 		fsnotify_link_count(target);
Index: linux-3.18.13-rt10-r7s4/include/linux/if_vlan.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/if_vlan.h
+++ linux-3.18.13-rt10-r7s4/include/linux/if_vlan.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:323 @ static inline struct sk_buff *vlan_inser
 }
 
 /**
- * __vlan_put_tag - regular VLAN tag inserting
+ * vlan_insert_tag_set_proto - regular VLAN tag inserting
  * @skb: skbuff to tag
+ * @vlan_proto: VLAN encapsulation protocol
  * @vlan_tci: VLAN TCI to insert
  *
  * Inserts the VLAN tag into @skb as part of the payload
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:334 @ static inline struct sk_buff *vlan_inser
  * Following the skb_unshare() example, in case of error, the calling function
  * doesn't have to worry about freeing the original skb.
  */
-static inline struct sk_buff *__vlan_put_tag(struct sk_buff *skb,
-					     __be16 vlan_proto, u16 vlan_tci)
+static inline struct sk_buff *vlan_insert_tag_set_proto(struct sk_buff *skb,
+							__be16 vlan_proto,
+							u16 vlan_tci)
 {
 	skb = vlan_insert_tag(skb, vlan_proto, vlan_tci);
 	if (skb)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:344 @ static inline struct sk_buff *__vlan_put
 	return skb;
 }
 
+/*
+ * __vlan_hwaccel_push_inside - pushes vlan tag to the payload
+ * @skb: skbuff to tag
+ *
+ * Pushes the VLAN tag from @skb->vlan_tci inside to the payload.
+ *
+ * Following the skb_unshare() example, in case of error, the calling function
+ * doesn't have to worry about freeing the original skb.
+ */
+static inline struct sk_buff *__vlan_hwaccel_push_inside(struct sk_buff *skb)
+{
+	skb = vlan_insert_tag_set_proto(skb, skb->vlan_proto,
+					vlan_tx_tag_get(skb));
+	if (likely(skb))
+		skb->vlan_tci = 0;
+	return skb;
+}
+/*
+ * vlan_hwaccel_push_inside - pushes vlan tag to the payload
+ * @skb: skbuff to tag
+ *
+ * Checks is tag is present in @skb->vlan_tci and if it is, it pushes the
+ * VLAN tag from @skb->vlan_tci inside to the payload.
+ *
+ * Following the skb_unshare() example, in case of error, the calling function
+ * doesn't have to worry about freeing the original skb.
+ */
+static inline struct sk_buff *vlan_hwaccel_push_inside(struct sk_buff *skb)
+{
+	if (vlan_tx_tag_present(skb))
+		skb = __vlan_hwaccel_push_inside(skb);
+	return skb;
+}
+
 /**
  * __vlan_hwaccel_put_tag - hardware accelerated VLAN inserting
  * @skb: skbuff to tag
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:396 @ static inline struct sk_buff *__vlan_hwa
 }
 
 /**
- * vlan_put_tag - inserts VLAN tag according to device features
- * @skb: skbuff to tag
- * @vlan_tci: VLAN TCI to insert
- *
- * Assumes skb->dev is the target that will xmit this frame.
- * Returns a VLAN tagged skb.
- */
-static inline struct sk_buff *vlan_put_tag(struct sk_buff *skb,
-					   __be16 vlan_proto, u16 vlan_tci)
-{
-	if (vlan_hw_offload_capable(skb->dev->features, vlan_proto)) {
-		return __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);
-	} else {
-		return __vlan_put_tag(skb, vlan_proto, vlan_tci);
-	}
-}
-
-/**
  * __vlan_get_tag - get the VLAN ID that is part of the payload
  * @skb: skbuff to query
  * @vlan_tci: buffer to store vlaue
Index: linux-3.18.13-rt10-r7s4/include/linux/kernel_stat.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/kernel_stat.h
+++ linux-3.18.13-rt10-r7s4/include/linux/kernel_stat.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:71 @ static inline unsigned int kstat_softirq
  * Number of interrupts per specific IRQ source, since bootup
  */
 extern unsigned int kstat_irqs(unsigned int irq);
+extern unsigned int kstat_irqs_usr(unsigned int irq);
 
 /*
  * Number of interrupts per cpu, since bootup
Index: linux-3.18.13-rt10-r7s4/include/linux/libata.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/libata.h
+++ linux-3.18.13-rt10-r7s4/include/linux/libata.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:233 @ enum {
 	ATA_FLAG_SW_ACTIVITY	= (1 << 22), /* driver supports sw activity
 					      * led */
 	ATA_FLAG_NO_DIPM	= (1 << 23), /* host not happy with DIPM */
+	ATA_FLAG_LOWTAG		= (1 << 24), /* host wants lowest available tag */
 
 	/* bits 24:31 of ap->flags are reserved for LLD specific flags */
 
Index: linux-3.18.13-rt10-r7s4/include/linux/mfd/palmas.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/mfd/palmas.h
+++ linux-3.18.13-rt10-r7s4/include/linux/mfd/palmas.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3002 @ enum usb_irq_events {
 #define PALMAS_GPADC_TRIM15					0x0E
 #define PALMAS_GPADC_TRIM16					0x0F
 
+/* TPS659038 regen2_ctrl offset iss different from palmas */
+#define TPS659038_REGEN2_CTRL					0x12
+
 /* TPS65917 Interrupt registers */
 
 /* Registers for function INTERRUPT */
Index: linux-3.18.13-rt10-r7s4/include/linux/mm.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/mm.h
+++ linux-3.18.13-rt10-r7s4/include/linux/mm.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1057 @ static inline int page_mapped(struct pag
 #define VM_FAULT_WRITE	0x0008	/* Special case for get_user_pages */
 #define VM_FAULT_HWPOISON 0x0010	/* Hit poisoned small page */
 #define VM_FAULT_HWPOISON_LARGE 0x0020  /* Hit poisoned large page. Index encoded in upper bits */
+#define VM_FAULT_SIGSEGV 0x0040
 
 #define VM_FAULT_NOPAGE	0x0100	/* ->fault installed the pte, not return page */
 #define VM_FAULT_LOCKED	0x0200	/* ->fault locked the returned page */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1066 @ static inline int page_mapped(struct pag
 
 #define VM_FAULT_HWPOISON_LARGE_MASK 0xf000 /* encodes hpage index for large hwpoison */
 
-#define VM_FAULT_ERROR	(VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_HWPOISON | \
-			 VM_FAULT_FALLBACK | VM_FAULT_HWPOISON_LARGE)
+#define VM_FAULT_ERROR	(VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | \
+			 VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE | \
+			 VM_FAULT_FALLBACK)
 
 /* Encode hstate index for a hwpoisoned large page */
 #define VM_FAULT_SET_HINDEX(x) ((x) << 12)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1941 @ extern int expand_downwards(struct vm_ar
 #if VM_GROWSUP
 extern int expand_upwards(struct vm_area_struct *vma, unsigned long address);
 #else
-  #define expand_upwards(vma, address) do { } while (0)
+  #define expand_upwards(vma, address) (0)
 #endif
 
 /* Look up the first VMA which satisfies  addr < vm_end,  NULL if none. */
Index: linux-3.18.13-rt10-r7s4/include/linux/netdevice.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/netdevice.h
+++ linux-3.18.13-rt10-r7s4/include/linux/netdevice.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1001 @ typedef u16 (*select_queue_fallback_t)(s
  *	Callback to use for xmit over the accelerated station. This
  *	is used in place of ndo_start_xmit on accelerated net
  *	devices.
- * bool	(*ndo_gso_check) (struct sk_buff *skb,
- *			  struct net_device *dev);
+ * netdev_features_t (*ndo_features_check) (struct sk_buff *skb,
+ *					    struct net_device *dev
+ *					    netdev_features_t features);
  *	Called by core transmit path to determine if device is capable of
- *	performing GSO on a packet. The device returns true if it is
- *	able to GSO the packet, false otherwise. If the return value is
- *	false the stack will do software GSO.
+ *	performing offload operations on a given packet. This is to give
+ *	the device an opportunity to implement any restrictions that cannot
+ *	be otherwise expressed by feature flags. The check is called with
+ *	the set of features that the stack has calculated and it returns
+ *	those the driver believes to be appropriate.
  */
 struct net_device_ops {
 	int			(*ndo_init)(struct net_device *dev);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1159 @ struct net_device_ops {
 							struct net_device *dev,
 							void *priv);
 	int			(*ndo_get_lock_subclass)(struct net_device *dev);
-	bool			(*ndo_gso_check) (struct sk_buff *skb,
-						  struct net_device *dev);
+	netdev_features_t	(*ndo_features_check) (struct sk_buff *skb,
+						       struct net_device *dev,
+						       netdev_features_t features);
 };
 
 /**
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2125 @ void netdev_freemem(struct net_device *d
 void synchronize_net(void);
 int init_dummy_netdev(struct net_device *dev);
 
+DECLARE_PER_CPU(int, xmit_recursion);
+static inline int dev_recursion_level(void)
+{
+	return this_cpu_read(xmit_recursion);
+}
+
 struct net_device *dev_get_by_index(struct net *net, int ifindex);
 struct net_device *__dev_get_by_index(struct net *net, int ifindex);
 struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3597 @ static inline bool netif_needs_gso(struc
 				   netdev_features_t features)
 {
 	return skb_is_gso(skb) && (!skb_gso_ok(skb, features) ||
-		(dev->netdev_ops->ndo_gso_check &&
-		 !dev->netdev_ops->ndo_gso_check(skb, dev)) ||
 		unlikely((skb->ip_summed != CHECKSUM_PARTIAL) &&
 			 (skb->ip_summed != CHECKSUM_UNNECESSARY)));
 }
Index: linux-3.18.13-rt10-r7s4/include/linux/nfs_xdr.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/nfs_xdr.h
+++ linux-3.18.13-rt10-r7s4/include/linux/nfs_xdr.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1331 @ struct nfs_commit_completion_ops {
 };
 
 struct nfs_commit_info {
-	spinlock_t			*lock;
+	spinlock_t			*lock;	/* inode->i_lock */
 	struct nfs_mds_commit_info	*mds;
 	struct pnfs_ds_commit_info	*ds;
 	struct nfs_direct_req		*dreq;	/* O_DIRECT request */
Index: linux-3.18.13-rt10-r7s4/include/linux/pagemap.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/pagemap.h
+++ linux-3.18.13-rt10-r7s4/include/linux/pagemap.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:254 @ pgoff_t page_cache_prev_hole(struct addr
 #define FGP_NOWAIT		0x00000020
 
 struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
-		int fgp_flags, gfp_t cache_gfp_mask, gfp_t radix_gfp_mask);
+		int fgp_flags, gfp_t cache_gfp_mask);
 
 /**
  * find_get_page - find and get a page reference
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:269 @ struct page *pagecache_get_page(struct a
 static inline struct page *find_get_page(struct address_space *mapping,
 					pgoff_t offset)
 {
-	return pagecache_get_page(mapping, offset, 0, 0, 0);
+	return pagecache_get_page(mapping, offset, 0, 0);
 }
 
 static inline struct page *find_get_page_flags(struct address_space *mapping,
 					pgoff_t offset, int fgp_flags)
 {
-	return pagecache_get_page(mapping, offset, fgp_flags, 0, 0);
+	return pagecache_get_page(mapping, offset, fgp_flags, 0);
 }
 
 /**
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:295 @ static inline struct page *find_get_page
 static inline struct page *find_lock_page(struct address_space *mapping,
 					pgoff_t offset)
 {
-	return pagecache_get_page(mapping, offset, FGP_LOCK, 0, 0);
+	return pagecache_get_page(mapping, offset, FGP_LOCK, 0);
 }
 
 /**
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:322 @ static inline struct page *find_or_creat
 {
 	return pagecache_get_page(mapping, offset,
 					FGP_LOCK|FGP_ACCESSED|FGP_CREAT,
-					gfp_mask, gfp_mask & GFP_RECLAIM_MASK);
+					gfp_mask);
 }
 
 /**
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:343 @ static inline struct page *grab_cache_pa
 {
 	return pagecache_get_page(mapping, index,
 			FGP_LOCK|FGP_CREAT|FGP_NOFS|FGP_NOWAIT,
-			mapping_gfp_mask(mapping),
-			GFP_NOFS);
+			mapping_gfp_mask(mapping));
 }
 
 struct page *find_get_entry(struct address_space *mapping, pgoff_t offset);
Index: linux-3.18.13-rt10-r7s4/include/linux/pci.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/pci.h
+++ linux-3.18.13-rt10-r7s4/include/linux/pci.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:178 @ enum pci_dev_flags {
 	PCI_DEV_FLAGS_DMA_ALIAS_DEVFN = (__force pci_dev_flags_t) (1 << 4),
 	/* Use a PCIe-to-PCI bridge alias even if !pci_is_pcie */
 	PCI_DEV_FLAG_PCIE_BRIDGE_ALIAS = (__force pci_dev_flags_t) (1 << 5),
+	/* Do not use bus resets for device */
+	PCI_DEV_FLAGS_NO_BUS_RESET = (__force pci_dev_flags_t) (1 << 6),
 };
 
 enum pci_irq_reroute_variant {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1067 @ resource_size_t pcibios_retrieve_fw_addr
 void pci_bus_assign_resources(const struct pci_bus *bus);
 void pci_bus_size_bridges(struct pci_bus *bus);
 int pci_claim_resource(struct pci_dev *, int);
+int pci_claim_bridge_resource(struct pci_dev *bridge, int i);
 void pci_assign_unassigned_resources(void);
 void pci_assign_unassigned_bridge_resources(struct pci_dev *bridge);
 void pci_assign_unassigned_bus_resources(struct pci_bus *bus);
Index: linux-3.18.13-rt10-r7s4/include/linux/pstore_ram.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/pstore_ram.h
+++ linux-3.18.13-rt10-r7s4/include/linux/pstore_ram.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:56 @ struct persistent_ram_zone {
 };
 
 struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
-			u32 sig, struct persistent_ram_ecc_info *ecc_info);
+			u32 sig, struct persistent_ram_ecc_info *ecc_info,
+			unsigned int memtype);
 void persistent_ram_free(struct persistent_ram_zone *prz);
 void persistent_ram_zap(struct persistent_ram_zone *prz);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:80 @ ssize_t persistent_ram_ecc_string(struct
 struct ramoops_platform_data {
 	unsigned long	mem_size;
 	unsigned long	mem_address;
+	unsigned int	mem_type;
 	unsigned long	record_size;
 	unsigned long	console_size;
 	unsigned long	ftrace_size;
Index: linux-3.18.13-rt10-r7s4/include/linux/quota.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/quota.h
+++ linux-3.18.13-rt10-r7s4/include/linux/quota.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:214 @ struct mem_dqinfo {
 	unsigned long dqi_flags;
 	unsigned int dqi_bgrace;
 	unsigned int dqi_igrace;
-	qsize_t dqi_maxblimit;
-	qsize_t dqi_maxilimit;
+	qsize_t dqi_max_spc_limit;
+	qsize_t dqi_max_ino_limit;
 	void *dqi_priv;
 };
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:319 @ struct dquot_operations {
 
 struct path;
 
+/* Structure for communicating via ->get_dqblk() & ->set_dqblk() */
+struct qc_dqblk {
+	int d_fieldmask;	/* mask of fields to change in ->set_dqblk() */
+	u64 d_spc_hardlimit;	/* absolute limit on used space */
+	u64 d_spc_softlimit;	/* preferred limit on used space */
+	u64 d_ino_hardlimit;	/* maximum # allocated inodes */
+	u64 d_ino_softlimit;	/* preferred inode limit */
+	u64 d_space;		/* Space owned by the user */
+	u64 d_ino_count;	/* # inodes owned by the user */
+	s64 d_ino_timer;	/* zero if within inode limits */
+				/* if not, we refuse service */
+	s64 d_spc_timer;	/* similar to above; for space */
+	int d_ino_warns;	/* # warnings issued wrt num inodes */
+	int d_spc_warns;	/* # warnings issued wrt used space */
+	u64 d_rt_spc_hardlimit;	/* absolute limit on realtime space */
+	u64 d_rt_spc_softlimit;	/* preferred limit on RT space */
+	u64 d_rt_space;		/* realtime space owned */
+	s64 d_rt_spc_timer;	/* similar to above; for RT space */
+	int d_rt_spc_warns;	/* # warnings issued wrt RT space */
+};
+
+/* Field specifiers for ->set_dqblk() in struct qc_dqblk */
+#define	QC_INO_SOFT	(1<<0)
+#define	QC_INO_HARD	(1<<1)
+#define	QC_SPC_SOFT	(1<<2)
+#define	QC_SPC_HARD	(1<<3)
+#define	QC_RT_SPC_SOFT	(1<<4)
+#define	QC_RT_SPC_HARD	(1<<5)
+#define QC_LIMIT_MASK (QC_INO_SOFT | QC_INO_HARD | QC_SPC_SOFT | QC_SPC_HARD | \
+		       QC_RT_SPC_SOFT | QC_RT_SPC_HARD)
+#define	QC_SPC_TIMER	(1<<6)
+#define	QC_INO_TIMER	(1<<7)
+#define	QC_RT_SPC_TIMER	(1<<8)
+#define QC_TIMER_MASK (QC_SPC_TIMER | QC_INO_TIMER | QC_RT_SPC_TIMER)
+#define	QC_SPC_WARNS	(1<<9)
+#define	QC_INO_WARNS	(1<<10)
+#define	QC_RT_SPC_WARNS	(1<<11)
+#define QC_WARNS_MASK (QC_SPC_WARNS | QC_INO_WARNS | QC_RT_SPC_WARNS)
+#define	QC_SPACE	(1<<12)
+#define	QC_INO_COUNT	(1<<13)
+#define	QC_RT_SPACE	(1<<14)
+#define QC_ACCT_MASK (QC_SPACE | QC_INO_COUNT | QC_RT_SPACE)
+
 /* Operations handling requests from userspace */
 struct quotactl_ops {
 	int (*quota_on)(struct super_block *, int, int, struct path *);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:370 @ struct quotactl_ops {
 	int (*quota_sync)(struct super_block *, int);
 	int (*get_info)(struct super_block *, int, struct if_dqinfo *);
 	int (*set_info)(struct super_block *, int, struct if_dqinfo *);
-	int (*get_dqblk)(struct super_block *, struct kqid, struct fs_disk_quota *);
-	int (*set_dqblk)(struct super_block *, struct kqid, struct fs_disk_quota *);
+	int (*get_dqblk)(struct super_block *, struct kqid, struct qc_dqblk *);
+	int (*set_dqblk)(struct super_block *, struct kqid, struct qc_dqblk *);
 	int (*get_xstate)(struct super_block *, struct fs_quota_stat *);
 	int (*set_xstate)(struct super_block *, unsigned int, int);
 	int (*get_xstatev)(struct super_block *, struct fs_quota_statv *);
Index: linux-3.18.13-rt10-r7s4/include/linux/quotaops.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/quotaops.h
+++ linux-3.18.13-rt10-r7s4/include/linux/quotaops.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:101 @ int dquot_quota_sync(struct super_block
 int dquot_get_dqinfo(struct super_block *sb, int type, struct if_dqinfo *ii);
 int dquot_set_dqinfo(struct super_block *sb, int type, struct if_dqinfo *ii);
 int dquot_get_dqblk(struct super_block *sb, struct kqid id,
-		struct fs_disk_quota *di);
+		struct qc_dqblk *di);
 int dquot_set_dqblk(struct super_block *sb, struct kqid id,
-		struct fs_disk_quota *di);
+		struct qc_dqblk *di);
 
 int __dquot_transfer(struct inode *inode, struct dquot **transfer_to);
 int dquot_transfer(struct inode *inode, struct iattr *iattr);
Index: linux-3.18.13-rt10-r7s4/include/linux/rmap.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/rmap.h
+++ linux-3.18.13-rt10-r7s4/include/linux/rmap.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:40 @ struct anon_vma {
 	atomic_t refcount;
 
 	/*
+	 * Count of child anon_vmas and VMAs which points to this anon_vma.
+	 *
+	 * This counter is used for making decision about reusing anon_vma
+	 * instead of forking new one. See comments in function anon_vma_clone.
+	 */
+	unsigned degree;
+
+	struct anon_vma *parent;	/* Parent of this anon_vma */
+
+	/*
 	 * NOTE: the LSB of the rb_root.rb_node is set by
 	 * mm_take_all_locks() _after_ taking the above lock. So the
 	 * rb_root must only be read/written after taking the above lock
Index: linux-3.18.13-rt10-r7s4/include/linux/sunrpc/clnt.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/sunrpc/clnt.h
+++ linux-3.18.13-rt10-r7s4/include/linux/sunrpc/clnt.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:60 @ struct rpc_clnt {
 	const struct rpc_timeout *cl_timeout;	/* Timeout strategy */
 
 	int			cl_nodelen;	/* nodename length */
-	char 			cl_nodename[UNX_MAXNODENAME];
+	char 			cl_nodename[UNX_MAXNODENAME+1];
 	struct rpc_pipe_dir_head cl_pipedir_objects;
 	struct rpc_clnt *	cl_parent;	/* Points to parent of clones */
 	struct rpc_rtt		cl_rtt_default;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:112 @ struct rpc_create_args {
 	struct sockaddr		*saddress;
 	const struct rpc_timeout *timeout;
 	const char		*servername;
+	const char		*nodename;
 	const struct rpc_program *program;
 	u32			prognumber;	/* overrides program->number */
 	u32			version;
Index: linux-3.18.13-rt10-r7s4/include/linux/time.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/time.h
+++ linux-3.18.13-rt10-r7s4/include/linux/time.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:102 @ static inline bool timespec_valid_strict
 	return true;
 }
 
+static inline bool timeval_valid(const struct timeval *tv)
+{
+	/* Dates before 1970 are bogus */
+	if (tv->tv_sec < 0)
+		return false;
+
+	/* Can't have more microseconds then a second */
+	if (tv->tv_usec < 0 || tv->tv_usec >= USEC_PER_SEC)
+		return false;
+
+	return true;
+}
+
 extern struct timespec timespec_trunc(struct timespec t, unsigned gran);
 
 #define CURRENT_TIME		(current_kernel_time())
Index: linux-3.18.13-rt10-r7s4/include/linux/tracepoint.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/tracepoint.h
+++ linux-3.18.13-rt10-r7s4/include/linux/tracepoint.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:176 @ extern void syscall_unregfunc(void);
 				TP_PROTO(data_proto),			\
 				TP_ARGS(data_args),			\
 				TP_CONDITION(cond),,);			\
-		if (IS_ENABLED(CONFIG_LOCKDEP)) {			\
+		if (IS_ENABLED(CONFIG_LOCKDEP) && (cond)) {		\
 			rcu_read_lock_sched_notrace();			\
 			rcu_dereference_sched(__tracepoint_##name.funcs);\
 			rcu_read_unlock_sched_notrace();		\
Index: linux-3.18.13-rt10-r7s4/include/linux/usb.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/usb.h
+++ linux-3.18.13-rt10-r7s4/include/linux/usb.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:130 @ enum usb_interface_condition {
  *	to the sysfs representation for that device.
  * @pm_usage_cnt: PM usage counter for this interface
  * @reset_ws: Used for scheduling resets from atomic context.
- * @reset_running: set to 1 if the interface is currently running a
- *      queued reset so that usb_cancel_queued_reset() doesn't try to
- *      remove from the workqueue when running inside the worker
- *      thread. See __usb_queue_reset_device().
  * @resetting_device: USB core reset the device, so use alt setting 0 as
  *	current; needs bandwidth alloc after reset.
  *
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:180 @ struct usb_interface {
 	unsigned needs_remote_wakeup:1;	/* driver requires remote wakeup */
 	unsigned needs_altsetting0:1;	/* switch to altsetting 0 is pending */
 	unsigned needs_binding:1;	/* needs delayed unbind/rebind */
-	unsigned reset_running:1;
 	unsigned resetting_device:1;	/* true: bandwidth alloc after reset */
 
 	struct device dev;		/* interface specific device info */
Index: linux-3.18.13-rt10-r7s4/include/linux/usb/hcd.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/usb/hcd.h
+++ linux-3.18.13-rt10-r7s4/include/linux/usb/hcd.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:149 @ struct usb_hcd {
 	unsigned		amd_resume_bug:1; /* AMD remote wakeup quirk */
 	unsigned		can_do_streams:1; /* HC supports streams */
 	unsigned		tpl_support:1; /* OTG & EH TPL support */
+	unsigned		cant_recv_wakeups:1;
+			/* wakeup requests from downstream aren't received */
 
 	unsigned int		irq;		/* irq allocated */
 	void __iomem		*regs;		/* device memory/io */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:455 @ extern const struct dev_pm_ops usb_hcd_p
 #endif /* CONFIG_PCI */
 
 /* pci-ish (pdev null is ok) buffer alloc/mapping support */
+void usb_init_pool_max(void);
 int hcd_buffer_create(struct usb_hcd *hcd);
 void hcd_buffer_destroy(struct usb_hcd *hcd);
 
Index: linux-3.18.13-rt10-r7s4/include/linux/usb/serial.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/usb/serial.h
+++ linux-3.18.13-rt10-r7s4/include/linux/usb/serial.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:193 @ static inline void usb_set_serial_data(s
  * @num_ports: the number of different ports this device will have.
  * @bulk_in_size: minimum number of bytes to allocate for bulk-in buffer
  *	(0 = end-point size)
- * @bulk_out_size: minimum number of bytes to allocate for bulk-out buffer
- *	(0 = end-point size)
+ * @bulk_out_size: bytes to allocate for bulk-out buffer (0 = end-point size)
  * @calc_num_ports: pointer to a function to determine how many ports this
  *	device has dynamically.  It will be called after the probe()
  *	callback is called, but before attach()
Index: linux-3.18.13-rt10-r7s4/include/linux/usb/usbnet.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/usb/usbnet.h
+++ linux-3.18.13-rt10-r7s4/include/linux/usb/usbnet.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:230 @ struct skb_data {	/* skb->cb is one of t
 	struct urb		*urb;
 	struct usbnet		*dev;
 	enum skb_state		state;
-	size_t			length;
+	long			length;
+	unsigned long		packets;
 };
 
+/* Drivers that set FLAG_MULTI_PACKET must call this in their
+ * tx_fixup method before returning an skb.
+ */
+static inline void
+usbnet_set_skb_tx_stats(struct sk_buff *skb,
+			unsigned long packets, long bytes_delta)
+{
+	struct skb_data *entry = (struct skb_data *) skb->cb;
+
+	entry->packets = packets;
+	entry->length = bytes_delta;
+}
+
 extern int usbnet_open(struct net_device *net);
 extern int usbnet_stop(struct net_device *net);
 extern netdev_tx_t usbnet_start_xmit(struct sk_buff *skb,
Index: linux-3.18.13-rt10-r7s4/include/linux/user_namespace.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/user_namespace.h
+++ linux-3.18.13-rt10-r7s4/include/linux/user_namespace.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:20 @ struct uid_gid_map {	/* 64 bytes -- 1 ca
 	} extent[UID_GID_MAP_MAX_EXTENTS];
 };
 
+#define USERNS_SETGROUPS_ALLOWED 1UL
+
+#define USERNS_INIT_FLAGS USERNS_SETGROUPS_ALLOWED
+
 struct user_namespace {
 	struct uid_gid_map	uid_map;
 	struct uid_gid_map	gid_map;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:34 @ struct user_namespace {
 	kuid_t			owner;
 	kgid_t			group;
 	unsigned int		proc_inum;
+	unsigned long		flags;
 
 	/* Register of per-UID persistent keyrings for this namespace */
 #ifdef CONFIG_PERSISTENT_KEYRINGS
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:71 @ extern const struct seq_operations proc_
 extern ssize_t proc_uid_map_write(struct file *, const char __user *, size_t, loff_t *);
 extern ssize_t proc_gid_map_write(struct file *, const char __user *, size_t, loff_t *);
 extern ssize_t proc_projid_map_write(struct file *, const char __user *, size_t, loff_t *);
+extern ssize_t proc_setgroups_write(struct file *, const char __user *, size_t, loff_t *);
+extern int proc_setgroups_show(struct seq_file *m, void *v);
+extern bool userns_may_setgroups(const struct user_namespace *ns);
 #else
 
 static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:98 @ static inline void put_user_ns(struct us
 {
 }
 
+static inline bool userns_may_setgroups(const struct user_namespace *ns)
+{
+	return true;
+}
 #endif
 
 #endif /* _LINUX_USER_H */
Index: linux-3.18.13-rt10-r7s4/include/linux/wait.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/wait.h
+++ linux-3.18.13-rt10-r7s4/include/linux/wait.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:16 @ typedef struct __wait_queue wait_queue_t
 typedef int (*wait_queue_func_t)(wait_queue_t *wait, unsigned mode, int flags, void *key);
 int default_wake_function(wait_queue_t *wait, unsigned mode, int flags, void *key);
 
+/* __wait_queue::flags */
+#define WQ_FLAG_EXCLUSIVE	0x01
+#define WQ_FLAG_WOKEN		0x02
+
 struct __wait_queue {
 	unsigned int		flags;
-#define WQ_FLAG_EXCLUSIVE	0x01
 	void			*private;
 	wait_queue_func_t	func;
 	struct list_head	task_list;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:836 @ void prepare_to_wait_exclusive(wait_queu
 long prepare_to_wait_event(wait_queue_head_t *q, wait_queue_t *wait, int state);
 void finish_wait(wait_queue_head_t *q, wait_queue_t *wait);
 void abort_exclusive_wait(wait_queue_head_t *q, wait_queue_t *wait, unsigned int mode, void *key);
+long wait_woken(wait_queue_t *wait, unsigned mode, long timeout);
+int woken_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
 int autoremove_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
 int wake_bit_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
 
Index: linux-3.18.13-rt10-r7s4/include/linux/workqueue.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/workqueue.h
+++ linux-3.18.13-rt10-r7s4/include/linux/workqueue.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:73 @ enum {
 	/* data contains off-queue information when !WORK_STRUCT_PWQ */
 	WORK_OFFQ_FLAG_BASE	= WORK_STRUCT_COLOR_SHIFT,
 
-	WORK_OFFQ_CANCELING	= (1 << WORK_OFFQ_FLAG_BASE),
+	__WORK_OFFQ_CANCELING	= WORK_OFFQ_FLAG_BASE,
+	WORK_OFFQ_CANCELING	= (1 << __WORK_OFFQ_CANCELING),
 
 	/*
 	 * When a work item is off queue, its high bits point to the last
Index: linux-3.18.13-rt10-r7s4/include/linux/writeback.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/linux/writeback.h
+++ linux-3.18.13-rt10-r7s4/include/linux/writeback.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:180 @ int write_cache_pages(struct address_spa
 		      struct writeback_control *wbc, writepage_t writepage,
 		      void *data);
 int do_writepages(struct address_space *mapping, struct writeback_control *wbc);
-void set_page_dirty_balance(struct page *page);
 void writeback_set_ratelimit(void);
 void tag_pages_for_writeback(struct address_space *mapping,
 			     pgoff_t start, pgoff_t end);
Index: linux-3.18.13-rt10-r7s4/include/net/cipso_ipv4.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/net/cipso_ipv4.h
+++ linux-3.18.13-rt10-r7s4/include/net/cipso_ipv4.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:124 @ extern int cipso_v4_rbm_strictvalid;
 #endif
 
 /*
- * Helper Functions
- */
-
-#define CIPSO_V4_OPTEXIST(x) (IPCB(x)->opt.cipso != 0)
-#define CIPSO_V4_OPTPTR(x) (skb_network_header(x) + IPCB(x)->opt.cipso)
-
-/*
  * DOI List Functions
  */
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:186 @ static inline int cipso_v4_doi_domhsh_re
 
 #ifdef CONFIG_NETLABEL
 void cipso_v4_cache_invalidate(void);
-int cipso_v4_cache_add(const struct sk_buff *skb,
+int cipso_v4_cache_add(const unsigned char *cipso_ptr,
 		       const struct netlbl_lsm_secattr *secattr);
 #else
 static inline void cipso_v4_cache_invalidate(void)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:194 @ static inline void cipso_v4_cache_invali
 	return;
 }
 
-static inline int cipso_v4_cache_add(const struct sk_buff *skb,
+static inline int cipso_v4_cache_add(const unsigned char *cipso_ptr,
 				     const struct netlbl_lsm_secattr *secattr)
 {
 	return 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:207 @ static inline int cipso_v4_cache_add(con
 
 #ifdef CONFIG_NETLABEL
 void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway);
+int cipso_v4_getattr(const unsigned char *cipso,
+		     struct netlbl_lsm_secattr *secattr);
 int cipso_v4_sock_setattr(struct sock *sk,
 			  const struct cipso_v4_doi *doi_def,
 			  const struct netlbl_lsm_secattr *secattr);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:224 @ int cipso_v4_skbuff_setattr(struct sk_bu
 int cipso_v4_skbuff_delattr(struct sk_buff *skb);
 int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
 			    struct netlbl_lsm_secattr *secattr);
+unsigned char *cipso_v4_optptr(const struct sk_buff *skb);
 int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option);
 #else
 static inline void cipso_v4_error(struct sk_buff *skb,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:234 @ static inline void cipso_v4_error(struct
 	return;
 }
 
+static inline int cipso_v4_getattr(const unsigned char *cipso,
+				   struct netlbl_lsm_secattr *secattr)
+{
+	return -ENOSYS;
+}
+
 static inline int cipso_v4_sock_setattr(struct sock *sk,
 				      const struct cipso_v4_doi *doi_def,
 				      const struct netlbl_lsm_secattr *secattr)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:287 @ static inline int cipso_v4_skbuff_getatt
 	return -ENOSYS;
 }
 
+static inline unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
+{
+	return NULL;
+}
+
 static inline int cipso_v4_validate(const struct sk_buff *skb,
 				    unsigned char **option)
 {
Index: linux-3.18.13-rt10-r7s4/include/net/ip.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/net/ip.h
+++ linux-3.18.13-rt10-r7s4/include/net/ip.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:42 @ struct inet_skb_parm {
 	struct ip_options	opt;		/* Compiled IP options		*/
 	unsigned char		flags;
 
-#define IPSKB_FORWARDED		1
-#define IPSKB_XFRM_TUNNEL_SIZE	2
-#define IPSKB_XFRM_TRANSFORMED	4
-#define IPSKB_FRAG_COMPLETE	8
-#define IPSKB_REROUTED		16
+#define IPSKB_FORWARDED		BIT(0)
+#define IPSKB_XFRM_TUNNEL_SIZE	BIT(1)
+#define IPSKB_XFRM_TRANSFORMED	BIT(2)
+#define IPSKB_FRAG_COMPLETE	BIT(3)
+#define IPSKB_REROUTED		BIT(4)
+#define IPSKB_DOREDIRECT	BIT(5)
 
 	u16			frag_max_size;
 };
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:184 @ static inline __u8 ip_reply_arg_flowi_fl
 	return (arg->flags & IP_REPLY_ARG_NOSRCCHECK) ? FLOWI_FLAG_ANYSRC : 0;
 }
 
-void ip_send_unicast_reply(struct net *net, struct sk_buff *skb,
+void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
 			   const struct ip_options *sopt,
 			   __be32 daddr, __be32 saddr,
 			   const struct ip_reply_arg *arg,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:456 @ static __inline__ void inet_reset_saddr(
 
 #endif
 
-static inline int sk_mc_loop(struct sock *sk)
-{
-	if (!sk)
-		return 1;
-	switch (sk->sk_family) {
-	case AF_INET:
-		return inet_sk(sk)->mc_loop;
-#if IS_ENABLED(CONFIG_IPV6)
-	case AF_INET6:
-		return inet6_sk(sk)->mc_loop;
-#endif
-	}
-	WARN_ON(1);
-	return 1;
-}
-
 bool ip_call_ra_chain(struct sk_buff *skb);
 
 /*
Index: linux-3.18.13-rt10-r7s4/include/net/ip6_route.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/net/ip6_route.h
+++ linux-3.18.13-rt10-r7s4/include/net/ip6_route.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:177 @ int ip6_fragment(struct sk_buff *skb, in
 
 static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
 {
-	struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
+	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
+				inet6_sk(skb->sk) : NULL;
 
 	return (np && np->pmtudisc >= IPV6_PMTUDISC_PROBE) ?
 	       skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
Index: linux-3.18.13-rt10-r7s4/include/net/mac80211.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/net/mac80211.h
+++ linux-3.18.13-rt10-r7s4/include/net/mac80211.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1230 @ struct ieee80211_vif *wdev_to_ieee80211_
  *
  * @IEEE80211_KEY_FLAG_GENERATE_IV: This flag should be set by the
  *	driver to indicate that it requires IV generation for this
- *	particular key. Setting this flag does not necessarily mean that SKBs
- *	will have sufficient tailroom for ICV or MIC.
+ *	particular key.
  * @IEEE80211_KEY_FLAG_GENERATE_MMIC: This flag should be set by
  *	the driver for a TKIP key if it requires Michael MIC
  *	generation in software.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1242 @ struct ieee80211_vif *wdev_to_ieee80211_
  * @IEEE80211_KEY_FLAG_PUT_IV_SPACE: This flag should be set by the driver
  *	if space should be prepared for the IV, but the IV
  *	itself should not be generated. Do not set together with
- *	@IEEE80211_KEY_FLAG_GENERATE_IV on the same key. Setting this flag does
- *	not necessarily mean that SKBs will have sufficient tailroom for ICV or
- *	MIC.
+ *	@IEEE80211_KEY_FLAG_GENERATE_IV on the same key.
  * @IEEE80211_KEY_FLAG_RX_MGMT: This key will be used to decrypt received
  *	management frames. The flag can help drivers that have a hardware
  *	crypto implementation that doesn't deal with management frames
Index: linux-3.18.13-rt10-r7s4/include/net/netns/ipv4.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/net/netns/ipv4.h
+++ linux-3.18.13-rt10-r7s4/include/net/netns/ipv4.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:55 @ struct netns_ipv4 {
 	struct inet_peer_base	*peers;
 	struct tcpm_hash_bucket	*tcp_metrics_hash;
 	unsigned int		tcp_metrics_hash_log;
+	struct sock  * __percpu	*tcp_sk;
 	struct netns_frags	frags;
 #ifdef CONFIG_NETFILTER
 	struct xt_table		*iptable_filter;
Index: linux-3.18.13-rt10-r7s4/include/net/sch_generic.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/net/sch_generic.h
+++ linux-3.18.13-rt10-r7s4/include/net/sch_generic.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:82 @ struct Qdisc {
 	struct netdev_queue	*dev_queue;
 
 	struct gnet_stats_rate_est64	rate_est;
+	struct gnet_stats_basic_cpu __percpu *cpu_bstats;
+	struct gnet_stats_queue	__percpu *cpu_qstats;
+
 	struct Qdisc		*next_sched;
 	struct sk_buff		*gso_skb;
 	/*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:92 @ struct Qdisc {
 	 */
 	unsigned long		state;
 	struct sk_buff_head	q;
-	union {
-		struct gnet_stats_basic_packed bstats;
-		struct gnet_stats_basic_cpu __percpu *cpu_bstats;
-	} __packed;
+	struct gnet_stats_basic_packed bstats;
 	unsigned int		__state;
-	union {
-		struct gnet_stats_queue	qstats;
-		struct gnet_stats_queue	__percpu *cpu_qstats;
-	} __packed;
+	struct gnet_stats_queue	qstats;
 	struct rcu_head		rcu_head;
 	int			padded;
 	atomic_t		refcnt;
Index: linux-3.18.13-rt10-r7s4/include/net/sock.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/net/sock.h
+++ linux-3.18.13-rt10-r7s4/include/net/sock.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1809 @ struct dst_entry *__sk_dst_check(struct
 
 struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie);
 
+bool sk_mc_loop(struct sock *sk);
+
 static inline bool sk_can_gso(const struct sock *sk)
 {
 	return net_gso_ok(sk->sk_route_caps, sk->sk_gso_type);
Index: linux-3.18.13-rt10-r7s4/include/net/vxlan.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/net/vxlan.h
+++ linux-3.18.13-rt10-r7s4/include/net/vxlan.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4 @
 #ifndef __NET_VXLAN_H
 #define __NET_VXLAN_H 1
 
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <linux/if_vlan.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/udp.h>
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:57 @ int vxlan_xmit_skb(struct vxlan_sock *vs
 		   __be32 src, __be32 dst, __u8 tos, __u8 ttl, __be16 df,
 		   __be16 src_port, __be16 dst_port, __be32 vni, bool xnet);
 
-static inline bool vxlan_gso_check(struct sk_buff *skb)
+static inline netdev_features_t vxlan_features_check(struct sk_buff *skb,
+						     netdev_features_t features)
 {
-	if ((skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL) &&
+	u8 l4_hdr = 0;
+
+	if (!skb->encapsulation)
+		return features;
+
+	switch (vlan_get_protocol(skb)) {
+	case htons(ETH_P_IP):
+		l4_hdr = ip_hdr(skb)->protocol;
+		break;
+	case htons(ETH_P_IPV6):
+		l4_hdr = ipv6_hdr(skb)->nexthdr;
+		break;
+	default:
+		return features;;
+	}
+
+	if ((l4_hdr == IPPROTO_UDP) &&
 	    (skb->inner_protocol_type != ENCAP_TYPE_ETHER ||
 	     skb->inner_protocol != htons(ETH_P_TEB) ||
 	     (skb_inner_mac_header(skb) - skb_transport_header(skb) !=
 	      sizeof(struct udphdr) + sizeof(struct vxlanhdr))))
-		return false;
+		return features & ~(NETIF_F_ALL_CSUM | NETIF_F_GSO_MASK);
 
-	return true;
+	return features;
 }
 
 /* IP header + UDP + VXLAN + Ethernet header */
Index: linux-3.18.13-rt10-r7s4/include/sound/ak4113.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/sound/ak4113.h
+++ linux-3.18.13-rt10-r7s4/include/sound/ak4113.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:289 @ struct ak4113 {
 	ak4113_write_t *write;
 	ak4113_read_t *read;
 	void *private_data;
-	unsigned int init:1;
+	atomic_t wq_processing;
 	spinlock_t lock;
 	unsigned char regmap[AK4113_WRITABLE_REGS];
 	struct snd_kcontrol *kctls[AK4113_CONTROLS];
Index: linux-3.18.13-rt10-r7s4/include/sound/ak4114.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/sound/ak4114.h
+++ linux-3.18.13-rt10-r7s4/include/sound/ak4114.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:171 @ struct ak4114 {
 	ak4114_write_t * write;
 	ak4114_read_t * read;
 	void * private_data;
-	unsigned int init: 1;
+	atomic_t wq_processing;
 	spinlock_t lock;
 	unsigned char regmap[6];
 	unsigned char txcsb[5];
Index: linux-3.18.13-rt10-r7s4/include/target/target_core_base.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/target/target_core_base.h
+++ linux-3.18.13-rt10-r7s4/include/target/target_core_base.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:412 @ struct t10_reservation {
 	/* Activate Persistence across Target Power Loss enabled
 	 * for SCSI device */
 	int pr_aptpl_active;
-#define PR_APTPL_BUF_LEN			8192
+#define PR_APTPL_BUF_LEN			262144
 	u32 pr_generation;
 	spinlock_t registration_lock;
 	spinlock_t aptpl_reg_lock;
Index: linux-3.18.13-rt10-r7s4/include/trace/events/kmem.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/trace/events/kmem.h
+++ linux-3.18.13-rt10-r7s4/include/trace/events/kmem.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:271 @ TRACE_EVENT(mm_page_alloc_extfrag,
 
 	TP_PROTO(struct page *page,
 		int alloc_order, int fallback_order,
-		int alloc_migratetype, int fallback_migratetype, int new_migratetype),
+		int alloc_migratetype, int fallback_migratetype),
 
 	TP_ARGS(page,
 		alloc_order, fallback_order,
-		alloc_migratetype, fallback_migratetype, new_migratetype),
+		alloc_migratetype, fallback_migratetype),
 
 	TP_STRUCT__entry(
 		__field(	struct page *,	page			)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:292 @ TRACE_EVENT(mm_page_alloc_extfrag,
 		__entry->fallback_order		= fallback_order;
 		__entry->alloc_migratetype	= alloc_migratetype;
 		__entry->fallback_migratetype	= fallback_migratetype;
-		__entry->change_ownership	= (new_migratetype == alloc_migratetype);
+		__entry->change_ownership	= (alloc_migratetype ==
+					get_pageblock_migratetype(page));
 	),
 
 	TP_printk("page=%p pfn=%lu alloc_order=%d fallback_order=%d pageblock_order=%d alloc_migratetype=%d fallback_migratetype=%d fragmenting=%d change_ownership=%d",
Index: linux-3.18.13-rt10-r7s4/include/trace/events/regmap.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/trace/events/regmap.h
+++ linux-3.18.13-rt10-r7s4/include/trace/events/regmap.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:10 @
 #include <linux/ktime.h>
 #include <linux/tracepoint.h>
 
-struct device;
-struct regmap;
+#include "../../../drivers/base/regmap/internal.h"
 
 /*
  * Log register events
  */
 DECLARE_EVENT_CLASS(regmap_reg,
 
-	TP_PROTO(struct device *dev, unsigned int reg,
+	TP_PROTO(struct regmap *map, unsigned int reg,
 		 unsigned int val),
 
-	TP_ARGS(dev, reg, val),
+	TP_ARGS(map, reg, val),
 
 	TP_STRUCT__entry(
-		__string(	name,		dev_name(dev)	)
-		__field(	unsigned int,	reg		)
-		__field(	unsigned int,	val		)
+		__string(	name,		regmap_name(map)	)
+		__field(	unsigned int,	reg			)
+		__field(	unsigned int,	val			)
 	),
 
 	TP_fast_assign(
-		__assign_str(name, dev_name(dev));
+		__assign_str(name, regmap_name(map));
 		__entry->reg = reg;
 		__entry->val = val;
 	),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:41 @ DECLARE_EVENT_CLASS(regmap_reg,
 
 DEFINE_EVENT(regmap_reg, regmap_reg_write,
 
-	TP_PROTO(struct device *dev, unsigned int reg,
+	TP_PROTO(struct regmap *map, unsigned int reg,
 		 unsigned int val),
 
-	TP_ARGS(dev, reg, val)
+	TP_ARGS(map, reg, val)
 
 );
 
 DEFINE_EVENT(regmap_reg, regmap_reg_read,
 
-	TP_PROTO(struct device *dev, unsigned int reg,
+	TP_PROTO(struct regmap *map, unsigned int reg,
 		 unsigned int val),
 
-	TP_ARGS(dev, reg, val)
+	TP_ARGS(map, reg, val)
 
 );
 
 DEFINE_EVENT(regmap_reg, regmap_reg_read_cache,
 
-	TP_PROTO(struct device *dev, unsigned int reg,
+	TP_PROTO(struct regmap *map, unsigned int reg,
 		 unsigned int val),
 
-	TP_ARGS(dev, reg, val)
+	TP_ARGS(map, reg, val)
 
 );
 
 DECLARE_EVENT_CLASS(regmap_block,
 
-	TP_PROTO(struct device *dev, unsigned int reg, int count),
+	TP_PROTO(struct regmap *map, unsigned int reg, int count),
 
-	TP_ARGS(dev, reg, count),
+	TP_ARGS(map, reg, count),
 
 	TP_STRUCT__entry(
-		__string(	name,		dev_name(dev)	)
-		__field(	unsigned int,	reg		)
-		__field(	int,		count		)
+		__string(	name,		regmap_name(map)	)
+		__field(	unsigned int,	reg			)
+		__field(	int,		count			)
 	),
 
 	TP_fast_assign(
-		__assign_str(name, dev_name(dev));
+		__assign_str(name, regmap_name(map));
 		__entry->reg = reg;
 		__entry->count = count;
 	),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:91 @ DECLARE_EVENT_CLASS(regmap_block,
 
 DEFINE_EVENT(regmap_block, regmap_hw_read_start,
 
-	TP_PROTO(struct device *dev, unsigned int reg, int count),
+	TP_PROTO(struct regmap *map, unsigned int reg, int count),
 
-	TP_ARGS(dev, reg, count)
+	TP_ARGS(map, reg, count)
 );
 
 DEFINE_EVENT(regmap_block, regmap_hw_read_done,
 
-	TP_PROTO(struct device *dev, unsigned int reg, int count),
+	TP_PROTO(struct regmap *map, unsigned int reg, int count),
 
-	TP_ARGS(dev, reg, count)
+	TP_ARGS(map, reg, count)
 );
 
 DEFINE_EVENT(regmap_block, regmap_hw_write_start,
 
-	TP_PROTO(struct device *dev, unsigned int reg, int count),
+	TP_PROTO(struct regmap *map, unsigned int reg, int count),
 
-	TP_ARGS(dev, reg, count)
+	TP_ARGS(map, reg, count)
 );
 
 DEFINE_EVENT(regmap_block, regmap_hw_write_done,
 
-	TP_PROTO(struct device *dev, unsigned int reg, int count),
+	TP_PROTO(struct regmap *map, unsigned int reg, int count),
 
-	TP_ARGS(dev, reg, count)
+	TP_ARGS(map, reg, count)
 );
 
 TRACE_EVENT(regcache_sync,
 
-	TP_PROTO(struct device *dev, const char *type,
+	TP_PROTO(struct regmap *map, const char *type,
 		 const char *status),
 
-	TP_ARGS(dev, type, status),
+	TP_ARGS(map, type, status),
 
 	TP_STRUCT__entry(
-		__string(       name,           dev_name(dev)   )
-		__string(	status,		status		)
-		__string(	type,		type		)
-		__field(	int,		type		)
+		__string(       name,           regmap_name(map)	)
+		__string(	status,		status			)
+		__string(	type,		type			)
+		__field(	int,		type			)
 	),
 
 	TP_fast_assign(
-		__assign_str(name, dev_name(dev));
+		__assign_str(name, regmap_name(map));
 		__assign_str(status, status);
 		__assign_str(type, type);
 	),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:143 @ TRACE_EVENT(regcache_sync,
 
 DECLARE_EVENT_CLASS(regmap_bool,
 
-	TP_PROTO(struct device *dev, bool flag),
+	TP_PROTO(struct regmap *map, bool flag),
 
-	TP_ARGS(dev, flag),
+	TP_ARGS(map, flag),
 
 	TP_STRUCT__entry(
-		__string(	name,		dev_name(dev)	)
-		__field(	int,		flag		)
+		__string(	name,		regmap_name(map)	)
+		__field(	int,		flag			)
 	),
 
 	TP_fast_assign(
-		__assign_str(name, dev_name(dev));
+		__assign_str(name, regmap_name(map));
 		__entry->flag = flag;
 	),
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:163 @ DECLARE_EVENT_CLASS(regmap_bool,
 
 DEFINE_EVENT(regmap_bool, regmap_cache_only,
 
-	TP_PROTO(struct device *dev, bool flag),
+	TP_PROTO(struct regmap *map, bool flag),
 
-	TP_ARGS(dev, flag)
+	TP_ARGS(map, flag)
 
 );
 
 DEFINE_EVENT(regmap_bool, regmap_cache_bypass,
 
-	TP_PROTO(struct device *dev, bool flag),
+	TP_PROTO(struct regmap *map, bool flag),
 
-	TP_ARGS(dev, flag)
+	TP_ARGS(map, flag)
 
 );
 
 DECLARE_EVENT_CLASS(regmap_async,
 
-	TP_PROTO(struct device *dev),
+	TP_PROTO(struct regmap *map),
 
-	TP_ARGS(dev),
+	TP_ARGS(map),
 
 	TP_STRUCT__entry(
-		__string(	name,		dev_name(dev)	)
+		__string(	name,		regmap_name(map)	)
 	),
 
 	TP_fast_assign(
-		__assign_str(name, dev_name(dev));
+		__assign_str(name, regmap_name(map));
 	),
 
 	TP_printk("%s", __get_str(name))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:196 @ DECLARE_EVENT_CLASS(regmap_async,
 
 DEFINE_EVENT(regmap_block, regmap_async_write_start,
 
-	TP_PROTO(struct device *dev, unsigned int reg, int count),
+	TP_PROTO(struct regmap *map, unsigned int reg, int count),
 
-	TP_ARGS(dev, reg, count)
+	TP_ARGS(map, reg, count)
 );
 
 DEFINE_EVENT(regmap_async, regmap_async_io_complete,
 
-	TP_PROTO(struct device *dev),
+	TP_PROTO(struct regmap *map),
 
-	TP_ARGS(dev)
+	TP_ARGS(map)
 
 );
 
 DEFINE_EVENT(regmap_async, regmap_async_complete_start,
 
-	TP_PROTO(struct device *dev),
+	TP_PROTO(struct regmap *map),
 
-	TP_ARGS(dev)
+	TP_ARGS(map)
 
 );
 
 DEFINE_EVENT(regmap_async, regmap_async_complete_done,
 
-	TP_PROTO(struct device *dev),
+	TP_PROTO(struct regmap *map),
 
-	TP_ARGS(dev)
+	TP_ARGS(map)
 
 );
 
 TRACE_EVENT(regcache_drop_region,
 
-	TP_PROTO(struct device *dev, unsigned int from,
+	TP_PROTO(struct regmap *map, unsigned int from,
 		 unsigned int to),
 
-	TP_ARGS(dev, from, to),
+	TP_ARGS(map, from, to),
 
 	TP_STRUCT__entry(
-		__string(       name,           dev_name(dev)   )
-		__field(	unsigned int,	from		)
-		__field(	unsigned int,	to		)
+		__string(       name,           regmap_name(map)	)
+		__field(	unsigned int,	from			)
+		__field(	unsigned int,	to			)
 	),
 
 	TP_fast_assign(
-		__assign_str(name, dev_name(dev));
+		__assign_str(name, regmap_name(map));
 		__entry->from = from;
 		__entry->to = to;
 	),
Index: linux-3.18.13-rt10-r7s4/include/trace/events/sched.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/trace/events/sched.h
+++ linux-3.18.13-rt10-r7s4/include/trace/events/sched.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:103 @ static inline long __trace_sched_switch_
 	/*
 	 * For all intents and purposes a preempted task is a running task.
 	 */
-	if (task_preempt_count(p) & PREEMPT_ACTIVE)
+	if (preempt_count() & PREEMPT_ACTIVE)
 		state = TASK_RUNNING | TASK_STATE_MAX;
 #endif
 
Index: linux-3.18.13-rt10-r7s4/include/trace/events/tlb.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/trace/events/tlb.h
+++ linux-3.18.13-rt10-r7s4/include/trace/events/tlb.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:16 @
 	{ TLB_LOCAL_SHOOTDOWN,		"local shootdown" },		\
 	{ TLB_LOCAL_MM_SHOOTDOWN,	"local mm shootdown" }
 
-TRACE_EVENT(tlb_flush,
+TRACE_EVENT_CONDITION(tlb_flush,
 
 	TP_PROTO(int reason, unsigned long pages),
 	TP_ARGS(reason, pages),
 
+	TP_CONDITION(cpu_online(smp_processor_id())),
+
 	TP_STRUCT__entry(
 		__field(	  int, reason)
 		__field(unsigned long,  pages)
Index: linux-3.18.13-rt10-r7s4/include/uapi/linux/audit.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/uapi/linux/audit.h
+++ linux-3.18.13-rt10-r7s4/include/uapi/linux/audit.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:368 @ enum {
 #define AUDIT_ARCH_PARISC	(EM_PARISC)
 #define AUDIT_ARCH_PARISC64	(EM_PARISC|__AUDIT_ARCH_64BIT)
 #define AUDIT_ARCH_PPC		(EM_PPC)
+/* do not define AUDIT_ARCH_PPCLE since it is not supported by audit */
 #define AUDIT_ARCH_PPC64	(EM_PPC64|__AUDIT_ARCH_64BIT)
+#define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_S390		(EM_S390)
 #define AUDIT_ARCH_S390X	(EM_S390|__AUDIT_ARCH_64BIT)
 #define AUDIT_ARCH_SH		(EM_SH)
Index: linux-3.18.13-rt10-r7s4/include/uapi/linux/can/netlink.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/uapi/linux/can/netlink.h
+++ linux-3.18.13-rt10-r7s4/include/uapi/linux/can/netlink.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:101 @ struct can_ctrlmode {
 #define CAN_CTRLMODE_BERR_REPORTING	0x10	/* Bus-error reporting */
 #define CAN_CTRLMODE_FD			0x20	/* CAN FD mode */
 #define CAN_CTRLMODE_PRESUME_ACK	0x40	/* Ignore missing CAN ACKs */
+#define CAN_CTRLMODE_FD_NON_ISO		0x80	/* CAN FD in non-ISO mode */
 
 /*
  * CAN device statistics
Index: linux-3.18.13-rt10-r7s4/include/uapi/linux/hyperv.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/uapi/linux/hyperv.h
+++ linux-3.18.13-rt10-r7s4/include/uapi/linux/hyperv.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:137 @ struct hv_start_fcopy {
 
 struct hv_do_fcopy {
 	struct hv_fcopy_hdr hdr;
+	__u32   pad;
 	__u64	offset;
 	__u32	size;
 	__u8	data[DATA_FRAGMENT];
Index: linux-3.18.13-rt10-r7s4/include/uapi/linux/in6.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/uapi/linux/in6.h
+++ linux-3.18.13-rt10-r7s4/include/uapi/linux/in6.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:152 @ struct in6_flowlabel_req {
 /*
  *	IPV6 socket options
  */
-
+#if __UAPI_DEF_IPV6_OPTIONS
 #define IPV6_ADDRFORM		1
 #define IPV6_2292PKTINFO	2
 #define IPV6_2292HOPOPTS	3
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:199 @ struct in6_flowlabel_req {
 
 #define IPV6_IPSEC_POLICY	34
 #define IPV6_XFRM_POLICY	35
+#endif
 
 /*
  * Multicast:
Index: linux-3.18.13-rt10-r7s4/include/uapi/linux/libc-compat.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/uapi/linux/libc-compat.h
+++ linux-3.18.13-rt10-r7s4/include/uapi/linux/libc-compat.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:72 @
 #define __UAPI_DEF_SOCKADDR_IN6		0
 #define __UAPI_DEF_IPV6_MREQ		0
 #define __UAPI_DEF_IPPROTO_V6		0
+#define __UAPI_DEF_IPV6_OPTIONS		0
 
 #else
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:86 @
 #define __UAPI_DEF_SOCKADDR_IN6		1
 #define __UAPI_DEF_IPV6_MREQ		1
 #define __UAPI_DEF_IPPROTO_V6		1
+#define __UAPI_DEF_IPV6_OPTIONS		1
 
 #endif /* _NETINET_IN_H */
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:108 @
 #define __UAPI_DEF_SOCKADDR_IN6		1
 #define __UAPI_DEF_IPV6_MREQ		1
 #define __UAPI_DEF_IPPROTO_V6		1
+#define __UAPI_DEF_IPV6_OPTIONS		1
 
 /* Definitions for xattr.h */
 #define __UAPI_DEF_XATTR		1
Index: linux-3.18.13-rt10-r7s4/include/uapi/linux/target_core_user.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/include/uapi/linux/target_core_user.h
+++ linux-3.18.13-rt10-r7s4/include/uapi/linux/target_core_user.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:9 @
 #include <linux/types.h>
 #include <linux/uio.h>
 
-#ifndef __packed
-#define __packed                        __attribute__((packed))
-#endif
-
 #define TCMU_VERSION "1.0"
 
 /*
Index: linux-3.18.13-rt10-r7s4/kernel/audit.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/audit.c
+++ linux-3.18.13-rt10-r7s4/kernel/audit.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:432 @ static void kauditd_send_skb(struct sk_b
  * This function doesn't consume an skb as might be expected since it has to
  * copy it anyways.
  */
-static void kauditd_send_multicast_skb(struct sk_buff *skb)
+static void kauditd_send_multicast_skb(struct sk_buff *skb, gfp_t gfp_mask)
 {
 	struct sk_buff		*copy;
 	struct audit_net	*aunet = net_generic(&init_net, audit_net_id);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:451 @ static void kauditd_send_multicast_skb(s
 	 * no reason for new multicast clients to continue with this
 	 * non-compliance.
 	 */
-	copy = skb_copy(skb, GFP_KERNEL);
+	copy = skb_copy(skb, gfp_mask);
 	if (!copy)
 		return;
 
-	nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, GFP_KERNEL);
+	nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, gfp_mask);
 }
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1952 @ void audit_log_end(struct audit_buffer *
 		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
 
 		nlh->nlmsg_len = ab->skb->len;
-		kauditd_send_multicast_skb(ab->skb);
+		kauditd_send_multicast_skb(ab->skb, ab->gfp_mask);
 
 		/*
 		 * The original kaudit unicast socket sends up messages with
Index: linux-3.18.13-rt10-r7s4/kernel/auditfilter.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/auditfilter.c
+++ linux-3.18.13-rt10-r7s4/kernel/auditfilter.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:445 @ static struct audit_entry *audit_data_to
 		if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {
 			f->type = AUDIT_LOGINUID_SET;
 			f->val = 0;
-		}
-
-		if ((f->type == AUDIT_PID) || (f->type == AUDIT_PPID)) {
-			struct pid *pid;
-			rcu_read_lock();
-			pid = find_vpid(f->val);
-			if (!pid) {
-				rcu_read_unlock();
-				err = -ESRCH;
-				goto exit_free;
-			}
-			f->val = pid_nr(pid);
-			rcu_read_unlock();
+			entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;
 		}
 
 		err = audit_field_valid(entry, f);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:621 @ static struct audit_rule_data *audit_kru
 			data->buflen += data->values[i] =
 				audit_pack_string(&bufp, krule->filterkey);
 			break;
+		case AUDIT_LOGINUID_SET:
+			if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {
+				data->fields[i] = AUDIT_LOGINUID;
+				data->values[i] = AUDIT_UID_UNSET;
+				break;
+			}
+			/* fallthrough if set */
 		default:
 			data->values[i] = f->val;
 		}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:644 @ static int audit_compare_rule(struct aud
 	int i;
 
 	if (a->flags != b->flags ||
+	    a->pflags != b->pflags ||
 	    a->listnr != b->listnr ||
 	    a->action != b->action ||
 	    a->field_count != b->field_count)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:763 @ struct audit_entry *audit_dupe_rule(stru
 	new = &entry->rule;
 	new->vers_ops = old->vers_ops;
 	new->flags = old->flags;
+	new->pflags = old->pflags;
 	new->listnr = old->listnr;
 	new->action = old->action;
 	for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
Index: linux-3.18.13-rt10-r7s4/kernel/bpf/verifier.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/bpf/verifier.c
+++ linux-3.18.13-rt10-r7s4/kernel/bpf/verifier.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1327 @ peek_stack:
 			/* tell verifier to check for equivalent states
 			 * after every call and jump
 			 */
-			env->explored_states[t + 1] = STATE_LIST_MARK;
+			if (t + 1 < insn_cnt)
+				env->explored_states[t + 1] = STATE_LIST_MARK;
 		} else {
 			/* conditional jump with two edges */
 			ret = push_insn(t, t + 1, FALLTHROUGH, env);
Index: linux-3.18.13-rt10-r7s4/kernel/cpuset.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/cpuset.c
+++ linux-3.18.13-rt10-r7s4/kernel/cpuset.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:541 @ static void update_domain_attr_tree(stru
 
 	rcu_read_lock();
 	cpuset_for_each_descendant_pre(cp, pos_css, root_cs) {
-		if (cp == root_cs)
-			continue;
-
 		/* skip the whole subtree if @cp doesn't have any CPU */
 		if (cpumask_empty(cp->cpus_allowed)) {
 			pos_css = css_rightmost_descendant(pos_css);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:863 @ static void update_cpumasks_hier(struct
 		 * If it becomes empty, inherit the effective mask of the
 		 * parent, which is guaranteed to have some CPUs.
 		 */
-		if (cpumask_empty(new_cpus))
+		if (cgroup_on_dfl(cp->css.cgroup) && cpumask_empty(new_cpus))
 			cpumask_copy(new_cpus, parent->effective_cpus);
 
 		/* Skip the whole subtree if the cpumask remains the same. */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1119 @ static void update_nodemasks_hier(struct
 		 * If it becomes empty, inherit the effective mask of the
 		 * parent, which is guaranteed to have some MEMs.
 		 */
-		if (nodes_empty(*new_mems))
+		if (cgroup_on_dfl(cp->css.cgroup) && nodes_empty(*new_mems))
 			*new_mems = parent->effective_mems;
 
 		/* Skip the whole subtree if the nodemask remains the same. */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1991 @ static int cpuset_css_online(struct cgro
 
 	mutex_lock(&callback_mutex);
 	cs->mems_allowed = parent->mems_allowed;
+	cs->effective_mems = parent->mems_allowed;
 	cpumask_copy(cs->cpus_allowed, parent->cpus_allowed);
+	cpumask_copy(cs->effective_cpus, parent->cpus_allowed);
 	mutex_unlock(&callback_mutex);
 out_unlock:
 	mutex_unlock(&cpuset_mutex);
Index: linux-3.18.13-rt10-r7s4/kernel/debug/kdb/kdb_main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/debug/kdb/kdb_main.c
+++ linux-3.18.13-rt10-r7s4/kernel/debug/kdb/kdb_main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2538 @ static int kdb_summary(int argc, const c
 #define K(x) ((x) << (PAGE_SHIFT - 10))
 	kdb_printf("\nMemTotal:       %8lu kB\nMemFree:        %8lu kB\n"
 		   "Buffers:        %8lu kB\n",
-		   val.totalram, val.freeram, val.bufferram);
+		   K(val.totalram), K(val.freeram), K(val.bufferram));
 	return 0;
 }
 
Index: linux-3.18.13-rt10-r7s4/kernel/events/core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/events/core.c
+++ linux-3.18.13-rt10-r7s4/kernel/events/core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4415 @ static void perf_pending_event(struct ir
 {
 	struct perf_event *event = container_of(entry,
 			struct perf_event, pending);
+	int rctx;
+
+	rctx = perf_swevent_get_recursion_context();
+	/*
+	 * If we 'fail' here, that's OK, it means recursion is already disabled
+	 * and we won't recurse 'further'.
+	 */
 
 	if (event->pending_disable) {
 		event->pending_disable = 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4432 @ static void perf_pending_event(struct ir
 		event->pending_wakeup = 0;
 		perf_event_wakeup(event);
 	}
+
+	if (rctx >= 0)
+		perf_swevent_put_recursion_context(rctx);
 }
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7448 @ SYSCALL_DEFINE5(perf_event_open,
 
 	if (move_group) {
 		synchronize_rcu();
-		perf_install_in_context(ctx, group_leader, event->cpu);
+		perf_install_in_context(ctx, group_leader, group_leader->cpu);
 		get_ctx(ctx);
 		list_for_each_entry(sibling, &group_leader->sibling_list,
 				    group_entry) {
-			perf_install_in_context(ctx, sibling, event->cpu);
+			perf_install_in_context(ctx, sibling, sibling->cpu);
 			get_ctx(ctx);
 		}
 	}
Index: linux-3.18.13-rt10-r7s4/kernel/exit.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/exit.c
+++ linux-3.18.13-rt10-r7s4/kernel/exit.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1305 @ static int wait_task_continued(struct wa
 static int wait_consider_task(struct wait_opts *wo, int ptrace,
 				struct task_struct *p)
 {
+	/*
+	 * We can race with wait_task_zombie() from another thread.
+	 * Ensure that EXIT_ZOMBIE -> EXIT_DEAD/EXIT_TRACE transition
+	 * can't confuse the checks below.
+	 */
+	int exit_state = ACCESS_ONCE(p->exit_state);
 	int ret;
 
-	if (unlikely(p->exit_state == EXIT_DEAD))
+	if (unlikely(exit_state == EXIT_DEAD))
 		return 0;
 
 	ret = eligible_child(wo, p);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1334 @ static int wait_consider_task(struct wai
 		return 0;
 	}
 
-	if (unlikely(p->exit_state == EXIT_TRACE)) {
+	if (unlikely(exit_state == EXIT_TRACE)) {
 		/*
 		 * ptrace == 0 means we are the natural parent. In this case
 		 * we should clear notask_error, debugger will notify us.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1361 @ static int wait_consider_task(struct wai
 	}
 
 	/* slay zombie? */
-	if (p->exit_state == EXIT_ZOMBIE) {
+	if (exit_state == EXIT_ZOMBIE) {
 		/* we don't reap group leaders with subthreads */
 		if (!delay_group_leader(p)) {
 			/*
Index: linux-3.18.13-rt10-r7s4/kernel/groups.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/groups.c
+++ linux-3.18.13-rt10-r7s4/kernel/groups.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:9 @
 #include <linux/slab.h>
 #include <linux/security.h>
 #include <linux/syscalls.h>
+#include <linux/user_namespace.h>
 #include <asm/uaccess.h>
 
 /* init to 2 - one for init_task, one to ensure it is never freed */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:217 @ out:
 	return i;
 }
 
+bool may_setgroups(void)
+{
+	struct user_namespace *user_ns = current_user_ns();
+
+	return ns_capable(user_ns, CAP_SETGID) &&
+		userns_may_setgroups(user_ns);
+}
+
 /*
  *	SMP: Our groups are copy-on-write. We can set them safely
  *	without another task interfering.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:235 @ SYSCALL_DEFINE2(setgroups, int, gidsetsi
 	struct group_info *group_info;
 	int retval;
 
-	if (!ns_capable(current_user_ns(), CAP_SETGID))
+	if (!may_setgroups())
 		return -EPERM;
 	if ((unsigned)gidsetsize > NGROUPS_MAX)
 		return -EINVAL;
Index: linux-3.18.13-rt10-r7s4/kernel/irq/internals.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/irq/internals.h
+++ linux-3.18.13-rt10-r7s4/kernel/irq/internals.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:81 @ extern void unmask_threaded_irq(struct i
 
 #ifdef CONFIG_SPARSE_IRQ
 static inline void irq_mark_irq(unsigned int irq) { }
+extern void irq_lock_sparse(void);
+extern void irq_unlock_sparse(void);
 #else
 extern void irq_mark_irq(unsigned int irq);
+static inline void irq_lock_sparse(void) { }
+static inline void irq_unlock_sparse(void) { }
 #endif
 
 extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr);
Index: linux-3.18.13-rt10-r7s4/kernel/irq/irqdesc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/irq/irqdesc.c
+++ linux-3.18.13-rt10-r7s4/kernel/irq/irqdesc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:135 @ static void free_masks(struct irq_desc *
 static inline void free_masks(struct irq_desc *desc) { }
 #endif
 
+void irq_lock_sparse(void)
+{
+	mutex_lock(&sparse_irq_lock);
+}
+
+void irq_unlock_sparse(void)
+{
+	mutex_unlock(&sparse_irq_lock);
+}
+
 static struct irq_desc *alloc_desc(int irq, int node, struct module *owner)
 {
 	struct irq_desc *desc;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:181 @ static void free_desc(unsigned int irq)
 
 	unregister_irq_proc(irq, desc);
 
+	/*
+	 * sparse_irq_lock protects also show_interrupts() and
+	 * kstat_irq_usr(). Once we deleted the descriptor from the
+	 * sparse tree we can free it. Access in proc will fail to
+	 * lookup the descriptor.
+	 */
 	mutex_lock(&sparse_irq_lock);
 	delete_irq_desc(irq);
 	mutex_unlock(&sparse_irq_lock);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:593 @ void kstat_incr_irq_this_cpu(unsigned in
 	kstat_incr_irqs_this_cpu(irq, irq_to_desc(irq));
 }
 
+/**
+ * kstat_irqs_cpu - Get the statistics for an interrupt on a cpu
+ * @irq:	The interrupt number
+ * @cpu:	The cpu number
+ *
+ * Returns the sum of interrupt counts on @cpu since boot for
+ * @irq. The caller must ensure that the interrupt is not removed
+ * concurrently.
+ */
 unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
 {
 	struct irq_desc *desc = irq_to_desc(irq);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:610 @ unsigned int kstat_irqs_cpu(unsigned int
 			*per_cpu_ptr(desc->kstat_irqs, cpu) : 0;
 }
 
+/**
+ * kstat_irqs - Get the statistics for an interrupt
+ * @irq:	The interrupt number
+ *
+ * Returns the sum of interrupt counts on all cpus since boot for
+ * @irq. The caller must ensure that the interrupt is not removed
+ * concurrently.
+ */
 unsigned int kstat_irqs(unsigned int irq)
 {
 	struct irq_desc *desc = irq_to_desc(irq);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:630 @ unsigned int kstat_irqs(unsigned int irq
 		sum += *per_cpu_ptr(desc->kstat_irqs, cpu);
 	return sum;
 }
+
+/**
+ * kstat_irqs_usr - Get the statistics for an interrupt
+ * @irq:	The interrupt number
+ *
+ * Returns the sum of interrupt counts on all cpus since boot for
+ * @irq. Contrary to kstat_irqs() this can be called from any
+ * preemptible context. It's protected against concurrent removal of
+ * an interrupt descriptor when sparse irqs are enabled.
+ */
+unsigned int kstat_irqs_usr(unsigned int irq)
+{
+	int sum;
+
+	irq_lock_sparse();
+	sum = kstat_irqs(irq);
+	irq_unlock_sparse();
+	return sum;
+}
Index: linux-3.18.13-rt10-r7s4/kernel/irq/proc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/irq/proc.c
+++ linux-3.18.13-rt10-r7s4/kernel/irq/proc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:18 @
 
 #include "internals.h"
 
+/*
+ * Access rules:
+ *
+ * procfs protects read/write of /proc/irq/N/ files against a
+ * concurrent free of the interrupt descriptor. remove_proc_entry()
+ * immediately prevents new read/writes to happen and waits for
+ * already running read/write functions to complete.
+ *
+ * We remove the proc entries first and then delete the interrupt
+ * descriptor from the radix tree and free it. So it is guaranteed
+ * that irq_to_desc(N) is valid as long as the read/writes are
+ * permitted by procfs.
+ *
+ * The read from /proc/interrupts is a different problem because there
+ * is no protection. So the lookup and the access to irqdesc
+ * information must be protected by sparse_irq_lock.
+ */
 static struct proc_dir_entry *root_irq_dir;
 
 #ifdef CONFIG_SMP
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:457 @ int show_interrupts(struct seq_file *p,
 		seq_putc(p, '\n');
 	}
 
+	irq_lock_sparse();
 	desc = irq_to_desc(i);
 	if (!desc)
-		return 0;
+		goto outsparse;
 
 	raw_spin_lock_irqsave(&desc->lock, flags);
 	for_each_online_cpu(j)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:500 @ int show_interrupts(struct seq_file *p,
 	seq_putc(p, '\n');
 out:
 	raw_spin_unlock_irqrestore(&desc->lock, flags);
+outsparse:
+	irq_unlock_sparse();
 	return 0;
 }
 #endif
Index: linux-3.18.13-rt10-r7s4/kernel/locking/rtmutex.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/locking/rtmutex.c
+++ linux-3.18.13-rt10-r7s4/kernel/locking/rtmutex.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1196 @ rt_mutex_slowlock(struct rt_mutex *lock,
 	set_current_state(TASK_RUNNING);
 
 	if (unlikely(ret)) {
-		remove_waiter(lock, &waiter);
+		if (rt_mutex_has_waiters(lock))
+			remove_waiter(lock, &waiter);
 		rt_mutex_handle_deadlock(ret, chwalk, &waiter);
 	}
 
Index: linux-3.18.13-rt10-r7s4/kernel/pid.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/pid.c
+++ linux-3.18.13-rt10-r7s4/kernel/pid.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:344 @ out:
 
 out_unlock:
 	spin_unlock_irq(&pidmap_lock);
+	put_pid_ns(ns);
+
 out_free:
 	while (++i <= ns->level)
 		free_pidmap(pid->numbers + i);
Index: linux-3.18.13-rt10-r7s4/kernel/power/snapshot.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/power/snapshot.c
+++ linux-3.18.13-rt10-r7s4/kernel/power/snapshot.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:957 @ static void mark_nosave_pages(struct mem
 	}
 }
 
-static bool is_nosave_page(unsigned long pfn)
-{
-	struct nosave_region *region;
-
-	list_for_each_entry(region, &nosave_regions, list) {
-		if (pfn >= region->start_pfn && pfn < region->end_pfn) {
-			pr_err("PM: %#010llx in e820 nosave region: "
-			       "[mem %#010llx-%#010llx]\n",
-			       (unsigned long long) pfn << PAGE_SHIFT,
-			       (unsigned long long) region->start_pfn << PAGE_SHIFT,
-			       ((unsigned long long) region->end_pfn << PAGE_SHIFT)
-					- 1);
-			return true;
-		}
-	}
-
-	return false;
-}
-
 /**
  *	create_basic_memory_bitmaps - create bitmaps needed for marking page
  *	frames that should not be saved and free page frames.  The pointers
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2022 @ static int mark_unsafe_pages(struct memo
 	do {
 		pfn = memory_bm_next_pfn(bm);
 		if (likely(pfn != BM_END_OF_MAP)) {
-			if (likely(pfn_valid(pfn)) && !is_nosave_page(pfn))
+			if (likely(pfn_valid(pfn)))
 				swsusp_set_page_free(pfn_to_page(pfn));
 			else
 				return -EFAULT;
Index: linux-3.18.13-rt10-r7s4/kernel/printk/console_cmdline.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/printk/console_cmdline.h
+++ linux-3.18.13-rt10-r7s4/kernel/printk/console_cmdline.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6 @
 
 struct console_cmdline
 {
-	char	name[8];			/* Name of the driver	    */
+	char	name[16];			/* Name of the driver	    */
 	int	index;				/* Minor dev. to use	    */
 	char	*options;			/* Options for the driver   */
 #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
Index: linux-3.18.13-rt10-r7s4/kernel/printk/printk.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/printk/printk.c
+++ linux-3.18.13-rt10-r7s4/kernel/printk/printk.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2443 @ void register_console(struct console *ne
 	for (i = 0, c = console_cmdline;
 	     i < MAX_CMDLINECONSOLES && c->name[0];
 	     i++, c++) {
+		BUILD_BUG_ON(sizeof(c->name) != sizeof(newcon->name));
 		if (strcmp(c->name, newcon->name) != 0)
 			continue;
 		if (newcon->index >= 0 &&
Index: linux-3.18.13-rt10-r7s4/kernel/sched/auto_group.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/sched/auto_group.c
+++ linux-3.18.13-rt10-r7s4/kernel/sched/auto_group.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:90 @ static inline struct autogroup *autogrou
 	 * so we don't have to move tasks around upon policy change,
 	 * or flail around trying to allocate bandwidth on the fly.
 	 * A bandwidth exception in __sched_setscheduler() allows
-	 * the policy change to proceed.  Thereafter, task_group()
-	 * returns &root_task_group, so zero bandwidth is required.
+	 * the policy change to proceed.
 	 */
 	free_rt_sched_group(tg);
 	tg->rt_se = root_task_group.rt_se;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:117 @ bool task_wants_autogroup(struct task_st
 	if (tg != &root_task_group)
 		return false;
 
-	if (p->sched_class != &fair_sched_class)
-		return false;
-
 	/*
 	 * We can only assume the task group can't go away on us if
 	 * autogroup_move_group() can see us on ->thread_group list.
Index: linux-3.18.13-rt10-r7s4/kernel/sched/core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/sched/core.c
+++ linux-3.18.13-rt10-r7s4/kernel/sched/core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:493 @ static __init void init_hrtick(void)
  */
 void hrtick_start(struct rq *rq, u64 delay)
 {
+	/*
+	 * Don't schedule slices shorter than 10000ns, that just
+	 * doesn't make sense. Rely on vruntime for fairness.
+	 */
+	delay = max_t(u64, delay, 10000LL);
 	__hrtimer_start_range_ns(&rq->hrtick_timer, ns_to_ktime(delay), 0,
 			HRTIMER_MODE_REL_PINNED, 0);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1631 @ void wake_up_if_idle(int cpu)
 	struct rq *rq = cpu_rq(cpu);
 	unsigned long flags;
 
-	if (!is_idle_task(rq->curr))
-		return;
+	rcu_read_lock();
+
+	if (!is_idle_task(rcu_dereference(rq->curr)))
+		goto out;
 
 	if (set_nr_if_polling(rq->idle)) {
 		trace_sched_wake_idle_without_ipi(cpu);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1645 @ void wake_up_if_idle(int cpu)
 		/* Else cpu is not in idle, do nothing here */
 		raw_spin_unlock_irqrestore(&rq->lock, flags);
 	}
+
+out:
+	rcu_read_unlock();
 }
 
 bool cpus_share_cache(int this_cpu, int that_cpu)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3100 @ void rt_mutex_setprio(struct task_struct
 	} else {
 		if (dl_prio(oldprio))
 			p->dl.dl_boosted = 0;
+		if (rt_prio(oldprio))
+			p->rt.timeout = 0;
 		p->sched_class = &fair_sched_class;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7475 @ static inline int tg_has_rt_tasks(struct
 {
 	struct task_struct *g, *p;
 
+	/*
+	 * Autogroups do not have RT tasks; see autogroup_create().
+	 */
+	if (task_group_is_autogroup(tg))
+		return 0;
+
 	for_each_process_thread(g, p) {
 		if (rt_task(p) && task_group(p) == tg)
 			return 1;
Index: linux-3.18.13-rt10-r7s4/kernel/sched/deadline.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/sched/deadline.c
+++ linux-3.18.13-rt10-r7s4/kernel/sched/deadline.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:578 @ void init_dl_task_timer(struct sched_dl_
 static
 int dl_runtime_exceeded(struct rq *rq, struct sched_dl_entity *dl_se)
 {
-	int dmiss = dl_time_before(dl_se->deadline, rq_clock(rq));
-	int rorun = dl_se->runtime <= 0;
-
-	if (!rorun && !dmiss)
-		return 0;
-
-	/*
-	 * If we are beyond our current deadline and we are still
-	 * executing, then we have already used some of the runtime of
-	 * the next instance. Thus, if we do not account that, we are
-	 * stealing bandwidth from the system at each deadline miss!
-	 */
-	if (dmiss) {
-		dl_se->runtime = rorun ? dl_se->runtime : 0;
-		dl_se->runtime -= rq_clock(rq) - dl_se->deadline;
-	}
-
-	return 1;
+	return (dl_se->runtime <= 0);
 }
 
 extern bool sched_rt_bandwidth_account(struct rt_rq *rt_rq);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:817 @ enqueue_dl_entity(struct sched_dl_entity
 	 * parameters of the task might need updating. Otherwise,
 	 * we want a replenishment of its runtime.
 	 */
-	if (!dl_se->dl_new && flags & ENQUEUE_REPLENISH)
-		replenish_dl_entity(dl_se, pi_se);
-	else
+	if (dl_se->dl_new || flags & ENQUEUE_WAKEUP)
 		update_dl_entity(dl_se, pi_se);
+	else if (flags & ENQUEUE_REPLENISH)
+		replenish_dl_entity(dl_se, pi_se);
 
 	__enqueue_dl_entity(dl_se);
 }
Index: linux-3.18.13-rt10-r7s4/kernel/sched/wait.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/sched/wait.c
+++ linux-3.18.13-rt10-r7s4/kernel/sched/wait.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:300 @ int autoremove_wake_function(wait_queue_
 }
 EXPORT_SYMBOL(autoremove_wake_function);
 
+
+/*
+ * DEFINE_WAIT_FUNC(wait, woken_wake_func);
+ *
+ * add_wait_queue(&wq, &wait);
+ * for (;;) {
+ *     if (condition)
+ *         break;
+ *
+ *     p->state = mode;				condition = true;
+ *     smp_mb(); // A				smp_wmb(); // C
+ *     if (!wait->flags & WQ_FLAG_WOKEN)	wait->flags |= WQ_FLAG_WOKEN;
+ *         schedule()				try_to_wake_up();
+ *     p->state = TASK_RUNNING;		    ~~~~~~~~~~~~~~~~~~
+ *     wait->flags &= ~WQ_FLAG_WOKEN;		condition = true;
+ *     smp_mb() // B				smp_wmb(); // C
+ *						wait->flags |= WQ_FLAG_WOKEN;
+ * }
+ * remove_wait_queue(&wq, &wait);
+ *
+ */
+long wait_woken(wait_queue_t *wait, unsigned mode, long timeout)
+{
+	set_current_state(mode); /* A */
+	/*
+	 * The above implies an smp_mb(), which matches with the smp_wmb() from
+	 * woken_wake_function() such that if we observe WQ_FLAG_WOKEN we must
+	 * also observe all state before the wakeup.
+	 */
+	if (!(wait->flags & WQ_FLAG_WOKEN))
+		timeout = schedule_timeout(timeout);
+	__set_current_state(TASK_RUNNING);
+
+	/*
+	 * The below implies an smp_mb(), it too pairs with the smp_wmb() from
+	 * woken_wake_function() such that we must either observe the wait
+	 * condition being true _OR_ WQ_FLAG_WOKEN such that we will not miss
+	 * an event.
+	 */
+	set_mb(wait->flags, wait->flags & ~WQ_FLAG_WOKEN); /* B */
+
+	return timeout;
+}
+EXPORT_SYMBOL(wait_woken);
+
+int woken_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key)
+{
+	/*
+	 * Although this function is called under waitqueue lock, LOCK
+	 * doesn't imply write barrier and the users expects write
+	 * barrier semantics on wakeup functions.  The following
+	 * smp_wmb() is equivalent to smp_wmb() in try_to_wake_up()
+	 * and is paired with set_mb() in wait_woken().
+	 */
+	smp_wmb(); /* C */
+	wait->flags |= WQ_FLAG_WOKEN;
+
+	return default_wake_function(wait, mode, sync, key);
+}
+EXPORT_SYMBOL(woken_wake_function);
+
 int wake_bit_function(wait_queue_t *wait, unsigned mode, int sync, void *arg)
 {
 	struct wait_bit_key *key = arg;
Index: linux-3.18.13-rt10-r7s4/kernel/smpboot.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/smpboot.c
+++ linux-3.18.13-rt10-r7s4/kernel/smpboot.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:282 @ int smpboot_register_percpu_thread(struc
 	unsigned int cpu;
 	int ret = 0;
 
+	get_online_cpus();
 	mutex_lock(&smpboot_threads_lock);
 	for_each_online_cpu(cpu) {
 		ret = __smpboot_create_thread(plug_thread, cpu);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:295 @ int smpboot_register_percpu_thread(struc
 	list_add(&plug_thread->list, &hotplug_threads);
 out:
 	mutex_unlock(&smpboot_threads_lock);
+	put_online_cpus();
 	return ret;
 }
 EXPORT_SYMBOL_GPL(smpboot_register_percpu_thread);
Index: linux-3.18.13-rt10-r7s4/kernel/sysctl.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/sysctl.c
+++ linux-3.18.13-rt10-r7s4/kernel/sysctl.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1235 @ static struct ctl_table vm_table[] = {
 		.maxlen		= sizeof(unsigned long),
 		.mode		= 0644,
 		.proc_handler	= hugetlb_sysctl_handler,
-		.extra1		= &zero,
 	},
 #ifdef CONFIG_NUMA
 	{
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1243 @ static struct ctl_table vm_table[] = {
 		.maxlen         = sizeof(unsigned long),
 		.mode           = 0644,
 		.proc_handler   = &hugetlb_mempolicy_sysctl_handler,
-		.extra1		= &zero,
 	},
 #endif
 	 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1265 @ static struct ctl_table vm_table[] = {
 		.maxlen		= sizeof(unsigned long),
 		.mode		= 0644,
 		.proc_handler	= hugetlb_overcommit_handler,
-		.extra1		= &zero,
 	},
 #endif
 	{
Index: linux-3.18.13-rt10-r7s4/kernel/time/hrtimer.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/time/hrtimer.c
+++ linux-3.18.13-rt10-r7s4/kernel/time/hrtimer.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:125 @ static void hrtimer_get_softirq_time(str
 	mono = ktime_get_update_offsets_tick(&off_real, &off_boot, &off_tai);
 	boot = ktime_add(mono, off_boot);
 	xtim = ktime_add(mono, off_real);
-	tai = ktime_add(xtim, off_tai);
+	tai = ktime_add(mono, off_tai);
 
 	base->clock_base[HRTIMER_BASE_REALTIME].softirq_time = xtim;
 	base->clock_base[HRTIMER_BASE_MONOTONIC].softirq_time = mono;
Index: linux-3.18.13-rt10-r7s4/kernel/time/ntp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/time/ntp.c
+++ linux-3.18.13-rt10-r7s4/kernel/time/ntp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:636 @ int ntp_validate_timex(struct timex *txc
 	if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME)))
 		return -EPERM;
 
+	/*
+	 * Check for potential multiplication overflows that can
+	 * only happen on 64-bit systems:
+	 */
+	if ((txc->modes & ADJ_FREQUENCY) && (BITS_PER_LONG == 64)) {
+		if (LLONG_MIN / PPM_SCALE > txc->freq)
+			return -EINVAL;
+		if (LLONG_MAX / PPM_SCALE < txc->freq)
+			return -EINVAL;
+	}
+
 	return 0;
 }
 
Index: linux-3.18.13-rt10-r7s4/kernel/time/tick-broadcast-hrtimer.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/time/tick-broadcast-hrtimer.c
+++ linux-3.18.13-rt10-r7s4/kernel/time/tick-broadcast-hrtimer.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:52 @ static void bc_set_mode(enum clock_event
  */
 static int bc_set_next(ktime_t expires, struct clock_event_device *bc)
 {
+	int bc_moved;
 	/*
 	 * We try to cancel the timer first. If the callback is on
 	 * flight on some other cpu then we let it handle it. If we
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:64 @ static int bc_set_next(ktime_t expires,
 	 * restart the timer because we are in the callback, but we
 	 * can set the expiry time and let the callback return
 	 * HRTIMER_RESTART.
+	 *
+	 * Since we are in the idle loop at this point and because
+	 * hrtimer_{start/cancel} functions call into tracing,
+	 * calls to these functions must be bound within RCU_NONIDLE.
 	 */
-	if (hrtimer_try_to_cancel(&bctimer) >= 0) {
-		hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED);
+	RCU_NONIDLE(bc_moved = (hrtimer_try_to_cancel(&bctimer) >= 0) ?
+		!hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED) :
+			0);
+	if (bc_moved) {
 		/* Bind the "device" to the cpu */
 		bc->bound_on = smp_processor_id();
 	} else if (bc->bound_on == smp_processor_id()) {
Index: linux-3.18.13-rt10-r7s4/kernel/time/tick-sched.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/time/tick-sched.c
+++ linux-3.18.13-rt10-r7s4/kernel/time/tick-sched.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:850 @ void tick_nohz_idle_enter(void)
 
 	local_irq_enable();
 }
-EXPORT_SYMBOL_GPL(tick_nohz_idle_enter);
 
 /**
  * tick_nohz_irq_exit - update next tick event from interrupt exit
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:976 @ void tick_nohz_idle_exit(void)
 
 	local_irq_enable();
 }
-EXPORT_SYMBOL_GPL(tick_nohz_idle_exit);
 
 static int tick_nohz_reprogram(struct tick_sched *ts, ktime_t now)
 {
Index: linux-3.18.13-rt10-r7s4/kernel/time/time.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/time/time.c
+++ linux-3.18.13-rt10-r7s4/kernel/time/time.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:199 @ SYSCALL_DEFINE2(settimeofday, struct tim
 	if (tv) {
 		if (copy_from_user(&user_tv, tv, sizeof(*tv)))
 			return -EFAULT;
+
+		if (!timeval_valid(&user_tv))
+			return -EINVAL;
+
 		new_ts.tv_sec = user_tv.tv_sec;
 		new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC;
 	}
Index: linux-3.18.13-rt10-r7s4/kernel/trace/ftrace.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/trace/ftrace.c
+++ linux-3.18.13-rt10-r7s4/kernel/trace/ftrace.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1056 @ static __init void ftrace_profile_debugf
 
 static struct pid * const ftrace_swapper_pid = &init_struct_pid;
 
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+static int ftrace_graph_active;
+#else
+# define ftrace_graph_active 0
+#endif
+
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 static struct ftrace_ops *removed_ops;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1858 @ static int ftrace_check_record(struct dy
 		if (!ftrace_rec_count(rec))
 			rec->flags = 0;
 		else
-			/* Just disable the record (keep REGS state) */
-			rec->flags &= ~FTRACE_FL_ENABLED;
+			/*
+			 * Just disable the record, but keep the ops TRAMP
+			 * and REGS states. The _EN flags must be disabled though.
+			 */
+			rec->flags &= ~(FTRACE_FL_ENABLED | FTRACE_FL_TRAMP_EN |
+					FTRACE_FL_REGS_EN);
 	}
 
 	return FTRACE_UPDATE_MAKE_NOP;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2321 @ static void ftrace_run_update_code(int c
 }
 
 static void ftrace_run_modify_code(struct ftrace_ops *ops, int command,
-				   struct ftrace_hash *old_hash)
+				   struct ftrace_ops_hash *old_hash)
 {
 	ops->flags |= FTRACE_OPS_FL_MODIFYING;
-	ops->old_hash.filter_hash = old_hash;
+	ops->old_hash.filter_hash = old_hash->filter_hash;
+	ops->old_hash.notrace_hash = old_hash->notrace_hash;
 	ftrace_run_update_code(command);
 	ops->old_hash.filter_hash = NULL;
+	ops->old_hash.notrace_hash = NULL;
 	ops->flags &= ~FTRACE_OPS_FL_MODIFYING;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2495 @ static int ftrace_shutdown(struct ftrace
 
 static void ftrace_startup_sysctl(void)
 {
+	int command;
+
 	if (unlikely(ftrace_disabled))
 		return;
 
 	/* Force update next time */
 	saved_ftrace_func = NULL;
 	/* ftrace_start_up is true if we want ftrace running */
-	if (ftrace_start_up)
-		ftrace_run_update_code(FTRACE_UPDATE_CALLS);
+	if (ftrace_start_up) {
+		command = FTRACE_UPDATE_CALLS;
+		if (ftrace_graph_active)
+			command |= FTRACE_START_FUNC_RET;
+		ftrace_startup_enable(command);
+	}
 }
 
 static void ftrace_shutdown_sysctl(void)
 {
+	int command;
+
 	if (unlikely(ftrace_disabled))
 		return;
 
 	/* ftrace_start_up is true if ftrace is running */
-	if (ftrace_start_up)
-		ftrace_run_update_code(FTRACE_DISABLE_CALLS);
+	if (ftrace_start_up) {
+		command = FTRACE_DISABLE_CALLS;
+		if (ftrace_graph_active)
+			command |= FTRACE_STOP_FUNC_RET;
+		ftrace_run_update_code(command);
+	}
 }
 
 static cycle_t		ftrace_update_time;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3384 @ static struct ftrace_ops trace_probe_ops
 
 static int ftrace_probe_registered;
 
-static void __enable_ftrace_function_probe(struct ftrace_hash *old_hash)
+static void __enable_ftrace_function_probe(struct ftrace_ops_hash *old_hash)
 {
 	int ret;
 	int i;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3442 @ int
 register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
 			      void *data)
 {
+	struct ftrace_ops_hash old_hash_ops;
 	struct ftrace_func_probe *entry;
 	struct ftrace_hash **orig_hash = &trace_probe_ops.func_hash->filter_hash;
 	struct ftrace_hash *old_hash = *orig_hash;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3464 @ register_ftrace_function_probe(char *glo
 
 	mutex_lock(&trace_probe_ops.func_hash->regex_lock);
 
+	old_hash_ops.filter_hash = old_hash;
+	/* Probes only have filters */
+	old_hash_ops.notrace_hash = NULL;
+
 	hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, old_hash);
 	if (!hash) {
 		count = -ENOMEM;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3528 @ register_ftrace_function_probe(char *glo
 
 	ret = ftrace_hash_move(&trace_probe_ops, 1, orig_hash, hash);
 
-	__enable_ftrace_function_probe(old_hash);
+	__enable_ftrace_function_probe(&old_hash_ops);
 
 	if (!ret)
 		free_ftrace_hash_rcu(old_hash);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3816 @ ftrace_match_addr(struct ftrace_hash *ha
 }
 
 static void ftrace_ops_update_code(struct ftrace_ops *ops,
-				   struct ftrace_hash *old_hash)
+				   struct ftrace_ops_hash *old_hash)
 {
-	if (ops->flags & FTRACE_OPS_FL_ENABLED && ftrace_enabled)
+	struct ftrace_ops *op;
+
+	if (!ftrace_enabled)
+		return;
+
+	if (ops->flags & FTRACE_OPS_FL_ENABLED) {
 		ftrace_run_modify_code(ops, FTRACE_UPDATE_CALLS, old_hash);
+		return;
+	}
+
+	/*
+	 * If this is the shared global_ops filter, then we need to
+	 * check if there is another ops that shares it, is enabled.
+	 * If so, we still need to run the modify code.
+	 */
+	if (ops->func_hash != &global_ops.local_hash)
+		return;
+
+	do_for_each_ftrace_op(op, ftrace_ops_list) {
+		if (op->func_hash == &global_ops.local_hash &&
+		    op->flags & FTRACE_OPS_FL_ENABLED) {
+			ftrace_run_modify_code(op, FTRACE_UPDATE_CALLS, old_hash);
+			/* Only need to do this once */
+			return;
+		}
+	} while_for_each_ftrace_op(op);
 }
 
 static int
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3851 @ ftrace_set_hash(struct ftrace_ops *ops,
 		unsigned long ip, int remove, int reset, int enable)
 {
 	struct ftrace_hash **orig_hash;
+	struct ftrace_ops_hash old_hash_ops;
 	struct ftrace_hash *old_hash;
 	struct ftrace_hash *hash;
 	int ret;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3888 @ ftrace_set_hash(struct ftrace_ops *ops,
 
 	mutex_lock(&ftrace_lock);
 	old_hash = *orig_hash;
+	old_hash_ops.filter_hash = ops->func_hash->filter_hash;
+	old_hash_ops.notrace_hash = ops->func_hash->notrace_hash;
 	ret = ftrace_hash_move(ops, enable, orig_hash, hash);
 	if (!ret) {
-		ftrace_ops_update_code(ops, old_hash);
+		ftrace_ops_update_code(ops, &old_hash_ops);
 		free_ftrace_hash_rcu(old_hash);
 	}
 	mutex_unlock(&ftrace_lock);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4101 @ static void __init set_ftrace_early_filt
 int ftrace_regex_release(struct inode *inode, struct file *file)
 {
 	struct seq_file *m = (struct seq_file *)file->private_data;
+	struct ftrace_ops_hash old_hash_ops;
 	struct ftrace_iterator *iter;
 	struct ftrace_hash **orig_hash;
 	struct ftrace_hash *old_hash;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4135 @ int ftrace_regex_release(struct inode *i
 
 		mutex_lock(&ftrace_lock);
 		old_hash = *orig_hash;
+		old_hash_ops.filter_hash = iter->ops->func_hash->filter_hash;
+		old_hash_ops.notrace_hash = iter->ops->func_hash->notrace_hash;
 		ret = ftrace_hash_move(iter->ops, filter_hash,
 				       orig_hash, iter->hash);
 		if (!ret) {
-			ftrace_ops_update_code(iter->ops, old_hash);
+			ftrace_ops_update_code(iter->ops, &old_hash_ops);
 			free_ftrace_hash_rcu(old_hash);
 		}
 		mutex_unlock(&ftrace_lock);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5328 @ ftrace_enable_sysctl(struct ctl_table *t
 
 	if (ftrace_enabled) {
 
-		ftrace_startup_sysctl();
-
 		/* we are starting ftrace again */
 		if (ftrace_ops_list != &ftrace_list_end)
 			update_ftrace_function();
 
+		ftrace_startup_sysctl();
+
 	} else {
 		/* stopping ftrace calls (just send to ftrace_stub) */
 		ftrace_trace_function = ftrace_stub;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5359 @ static struct ftrace_ops graph_ops = {
 	ASSIGN_OPS_HASH(graph_ops, &global_ops.local_hash)
 };
 
-static int ftrace_graph_active;
-
 int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
 {
 	return 0;
Index: linux-3.18.13-rt10-r7s4/kernel/trace/ring_buffer.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/trace/ring_buffer.c
+++ linux-3.18.13-rt10-r7s4/kernel/trace/ring_buffer.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:453 @ int ring_buffer_print_page_header(struct
 struct rb_irq_work {
 	struct irq_work			work;
 	wait_queue_head_t		waiters;
+	wait_queue_head_t		full_waiters;
 	bool				waiters_pending;
+	bool				full_waiters_pending;
+	bool				wakeup_full;
 };
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:538 @ static void rb_wake_up_waiters(struct ir
 	struct rb_irq_work *rbwork = container_of(work, struct rb_irq_work, work);
 
 	wake_up_all(&rbwork->waiters);
+	if (rbwork->wakeup_full) {
+		rbwork->wakeup_full = false;
+		wake_up_all(&rbwork->full_waiters);
+	}
 }
 
 /**
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:566 @ int ring_buffer_wait(struct ring_buffer
 	 * data in any cpu buffer, or a specific buffer, put the
 	 * caller on the appropriate wait queue.
 	 */
-	if (cpu == RING_BUFFER_ALL_CPUS)
+	if (cpu == RING_BUFFER_ALL_CPUS) {
 		work = &buffer->irq_work;
-	else {
+		/* Full only makes sense on per cpu reads */
+		full = false;
+	} else {
 		if (!cpumask_test_cpu(cpu, buffer->cpumask))
 			return -ENODEV;
 		cpu_buffer = buffer->buffers[cpu];
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:579 @ int ring_buffer_wait(struct ring_buffer
 
 
 	while (true) {
-		prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE);
+		if (full)
+			prepare_to_wait(&work->full_waiters, &wait, TASK_INTERRUPTIBLE);
+		else
+			prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE);
 
 		/*
 		 * The events can happen in critical sections where
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:604 @ int ring_buffer_wait(struct ring_buffer
 		 * that is necessary is that the wake up happens after
 		 * a task has been queued. It's OK for spurious wake ups.
 		 */
-		work->waiters_pending = true;
+		if (full)
+			work->full_waiters_pending = true;
+		else
+			work->waiters_pending = true;
 
 		if (signal_pending(current)) {
 			ret = -EINTR;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:636 @ int ring_buffer_wait(struct ring_buffer
 		schedule();
 	}
 
-	finish_wait(&work->waiters, &wait);
+	if (full)
+		finish_wait(&work->full_waiters, &wait);
+	else
+		finish_wait(&work->waiters, &wait);
 
 	return ret;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1254 @ rb_allocate_cpu_buffer(struct ring_buffe
 	init_completion(&cpu_buffer->update_done);
 	init_irq_work(&cpu_buffer->irq_work.work, rb_wake_up_waiters);
 	init_waitqueue_head(&cpu_buffer->irq_work.waiters);
+	init_waitqueue_head(&cpu_buffer->irq_work.full_waiters);
 
 	bpage = kzalloc_node(ALIGN(sizeof(*bpage), cache_line_size()),
 			    GFP_KERNEL, cpu_to_node(cpu));
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2826 @ static void rb_commit(struct ring_buffer
 static __always_inline void
 rb_wakeups(struct ring_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer)
 {
+	bool pagebusy;
+
 	if (buffer->irq_work.waiters_pending) {
 		buffer->irq_work.waiters_pending = false;
 		/* irq_work_queue() supplies it's own memory barriers */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2839 @ rb_wakeups(struct ring_buffer *buffer, s
 		/* irq_work_queue() supplies it's own memory barriers */
 		irq_work_queue(&cpu_buffer->irq_work.work);
 	}
+
+	pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page;
+
+	if (!pagebusy && cpu_buffer->irq_work.full_waiters_pending) {
+		cpu_buffer->irq_work.wakeup_full = true;
+		cpu_buffer->irq_work.full_waiters_pending = false;
+		/* irq_work_queue() supplies it's own memory barriers */
+		irq_work_queue(&cpu_buffer->irq_work.work);
+	}
 }
 
 /**
Index: linux-3.18.13-rt10-r7s4/kernel/trace/trace.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/trace/trace.c
+++ linux-3.18.13-rt10-r7s4/kernel/trace/trace.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4919 @ tracing_mark_write(struct file *filp, co
 	*fpos += written;
 
  out_unlock:
-	for (i = 0; i < nr_pages; i++){
+	for (i = nr_pages - 1; i >= 0; i--) {
 		kunmap_atomic(map_page[i]);
 		put_page(pages[i]);
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6420 @ static int instance_mkdir (struct inode
 	int ret;
 
 	/* Paranoid: Make sure the parent is the "instances" directory */
-	parent = hlist_entry(inode->i_dentry.first, struct dentry, d_alias);
+	parent = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias);
 	if (WARN_ON_ONCE(parent != trace_instance_dir))
 		return -ENOENT;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6447 @ static int instance_rmdir(struct inode *
 	int ret;
 
 	/* Paranoid: Make sure the parent is the "instances" directory */
-	parent = hlist_entry(inode->i_dentry.first, struct dentry, d_alias);
+	parent = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias);
 	if (WARN_ON_ONCE(parent != trace_instance_dir))
 		return -ENOENT;
 
Index: linux-3.18.13-rt10-r7s4/kernel/trace/trace_events.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/trace/trace_events.c
+++ linux-3.18.13-rt10-r7s4/kernel/trace/trace_events.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:464 @ static void remove_event_file_dir(struct
 
 	if (dir) {
 		spin_lock(&dir->d_lock);	/* probably unneeded */
-		list_for_each_entry(child, &dir->d_subdirs, d_u.d_child) {
+		list_for_each_entry(child, &dir->d_subdirs, d_child) {
 			if (child->d_inode)	/* probably unneeded */
 				child->d_inode->i_private = NULL;
 		}
Index: linux-3.18.13-rt10-r7s4/kernel/uid16.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/uid16.c
+++ linux-3.18.13-rt10-r7s4/kernel/uid16.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:179 @ SYSCALL_DEFINE2(setgroups16, int, gidset
 	struct group_info *group_info;
 	int retval;
 
-	if (!ns_capable(current_user_ns(), CAP_SETGID))
+	if (!may_setgroups())
 		return -EPERM;
 	if ((unsigned)gidsetsize > NGROUPS_MAX)
 		return -EINVAL;
Index: linux-3.18.13-rt10-r7s4/kernel/user.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/user.c
+++ linux-3.18.13-rt10-r7s4/kernel/user.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:54 @ struct user_namespace init_user_ns = {
 	.owner = GLOBAL_ROOT_UID,
 	.group = GLOBAL_ROOT_GID,
 	.proc_inum = PROC_USER_INIT_INO,
+	.flags = USERNS_INIT_FLAGS,
 #ifdef CONFIG_PERSISTENT_KEYRINGS
 	.persistent_keyring_register_sem =
 	__RWSEM_INITIALIZER(init_user_ns.persistent_keyring_register_sem),
Index: linux-3.18.13-rt10-r7s4/kernel/user_namespace.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/user_namespace.c
+++ linux-3.18.13-rt10-r7s4/kernel/user_namespace.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:27 @
 #include <linux/fs_struct.h>
 
 static struct kmem_cache *user_ns_cachep __read_mostly;
+static DEFINE_MUTEX(userns_state_mutex);
 
 static bool new_idmap_permitted(const struct file *file,
 				struct user_namespace *ns, int cap_setid,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:103 @ int create_user_ns(struct cred *new)
 	ns->owner = owner;
 	ns->group = group;
 
+	/* Inherit USERNS_SETGROUPS_ALLOWED from our parent */
+	mutex_lock(&userns_state_mutex);
+	ns->flags = parent_ns->flags;
+	mutex_unlock(&userns_state_mutex);
+
 	set_cred_user_ns(new, ns);
 
 #ifdef CONFIG_PERSISTENT_KEYRINGS
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:592 @ static bool mappings_overlap(struct uid_
 	return false;
 }
 
-
-static DEFINE_MUTEX(id_map_mutex);
-
 static ssize_t map_write(struct file *file, const char __user *buf,
 			 size_t count, loff_t *ppos,
 			 int cap_setid,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:608 @ static ssize_t map_write(struct file *fi
 	ssize_t ret = -EINVAL;
 
 	/*
-	 * The id_map_mutex serializes all writes to any given map.
+	 * The userns_state_mutex serializes all writes to any given map.
 	 *
 	 * Any map is only ever written once.
 	 *
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:626 @ static ssize_t map_write(struct file *fi
 	 * order and smp_rmb() is guaranteed that we don't have crazy
 	 * architectures returning stale data.
 	 */
-	mutex_lock(&id_map_mutex);
+	mutex_lock(&userns_state_mutex);
 
 	ret = -EPERM;
 	/* Only allow one successful write to the map */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:756 @ static ssize_t map_write(struct file *fi
 	*ppos = count;
 	ret = count;
 out:
-	mutex_unlock(&id_map_mutex);
+	mutex_unlock(&userns_state_mutex);
 	if (page)
 		free_page(page);
 	return ret;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:818 @ static bool new_idmap_permitted(const st
 				struct user_namespace *ns, int cap_setid,
 				struct uid_gid_map *new_map)
 {
-	/* Allow mapping to your own filesystem ids */
-	if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1)) {
+	const struct cred *cred = file->f_cred;
+	/* Don't allow mappings that would allow anything that wouldn't
+	 * be allowed without the establishment of unprivileged mappings.
+	 */
+	if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1) &&
+	    uid_eq(ns->owner, cred->euid)) {
 		u32 id = new_map->extent[0].lower_first;
 		if (cap_setid == CAP_SETUID) {
 			kuid_t uid = make_kuid(ns->parent, id);
-			if (uid_eq(uid, file->f_cred->fsuid))
+			if (uid_eq(uid, cred->euid))
 				return true;
 		} else if (cap_setid == CAP_SETGID) {
 			kgid_t gid = make_kgid(ns->parent, id);
-			if (gid_eq(gid, file->f_cred->fsgid))
+			if (!(ns->flags & USERNS_SETGROUPS_ALLOWED) &&
+			    gid_eq(gid, cred->egid))
 				return true;
 		}
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:852 @ static bool new_idmap_permitted(const st
 	return false;
 }
 
+int proc_setgroups_show(struct seq_file *seq, void *v)
+{
+	struct user_namespace *ns = seq->private;
+	unsigned long userns_flags = ACCESS_ONCE(ns->flags);
+
+	seq_printf(seq, "%s\n",
+		   (userns_flags & USERNS_SETGROUPS_ALLOWED) ?
+		   "allow" : "deny");
+	return 0;
+}
+
+ssize_t proc_setgroups_write(struct file *file, const char __user *buf,
+			     size_t count, loff_t *ppos)
+{
+	struct seq_file *seq = file->private_data;
+	struct user_namespace *ns = seq->private;
+	char kbuf[8], *pos;
+	bool setgroups_allowed;
+	ssize_t ret;
+
+	/* Only allow a very narrow range of strings to be written */
+	ret = -EINVAL;
+	if ((*ppos != 0) || (count >= sizeof(kbuf)))
+		goto out;
+
+	/* What was written? */
+	ret = -EFAULT;
+	if (copy_from_user(kbuf, buf, count))
+		goto out;
+	kbuf[count] = '\0';
+	pos = kbuf;
+
+	/* What is being requested? */
+	ret = -EINVAL;
+	if (strncmp(pos, "allow", 5) == 0) {
+		pos += 5;
+		setgroups_allowed = true;
+	}
+	else if (strncmp(pos, "deny", 4) == 0) {
+		pos += 4;
+		setgroups_allowed = false;
+	}
+	else
+		goto out;
+
+	/* Verify there is not trailing junk on the line */
+	pos = skip_spaces(pos);
+	if (*pos != '\0')
+		goto out;
+
+	ret = -EPERM;
+	mutex_lock(&userns_state_mutex);
+	if (setgroups_allowed) {
+		/* Enabling setgroups after setgroups has been disabled
+		 * is not allowed.
+		 */
+		if (!(ns->flags & USERNS_SETGROUPS_ALLOWED))
+			goto out_unlock;
+	} else {
+		/* Permanently disabling setgroups after setgroups has
+		 * been enabled by writing the gid_map is not allowed.
+		 */
+		if (ns->gid_map.nr_extents != 0)
+			goto out_unlock;
+		ns->flags &= ~USERNS_SETGROUPS_ALLOWED;
+	}
+	mutex_unlock(&userns_state_mutex);
+
+	/* Report a successful write */
+	*ppos = count;
+	ret = count;
+out:
+	return ret;
+out_unlock:
+	mutex_unlock(&userns_state_mutex);
+	goto out;
+}
+
+bool userns_may_setgroups(const struct user_namespace *ns)
+{
+	bool allowed;
+
+	mutex_lock(&userns_state_mutex);
+	/* It is not safe to use setgroups until a gid mapping in
+	 * the user namespace has been established.
+	 */
+	allowed = ns->gid_map.nr_extents != 0;
+	/* Is setgroups allowed? */
+	allowed = allowed && (ns->flags & USERNS_SETGROUPS_ALLOWED);
+	mutex_unlock(&userns_state_mutex);
+
+	return allowed;
+}
+
 static void *userns_get(struct task_struct *task)
 {
 	struct user_namespace *user_ns;
Index: linux-3.18.13-rt10-r7s4/kernel/workqueue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/kernel/workqueue.c
+++ linux-3.18.13-rt10-r7s4/kernel/workqueue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1844 @ static void pool_mayday_timeout(unsigned
  * spin_lock_irq(pool->lock) which may be released and regrabbed
  * multiple times.  Does GFP_KERNEL allocations.  Called only from
  * manager.
- *
- * Return:
- * %false if no action was taken and pool->lock stayed locked, %true
- * otherwise.
  */
-static bool maybe_create_worker(struct worker_pool *pool)
+static void maybe_create_worker(struct worker_pool *pool)
 __releases(&pool->lock)
 __acquires(&pool->lock)
 {
-	if (!need_to_create_worker(pool))
-		return false;
 restart:
 	spin_unlock_irq(&pool->lock);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1874 @ restart:
 	 */
 	if (need_to_create_worker(pool))
 		goto restart;
-	return true;
 }
 
 /**
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1893 @ restart:
  * multiple times.  Does GFP_KERNEL allocations.
  *
  * Return:
- * %false if the pool don't need management and the caller can safely start
- * processing works, %true indicates that the function released pool->lock
- * and reacquired it to perform some management function and that the
- * conditions that the caller verified while holding the lock before
- * calling the function might no longer be true.
+ * %false if the pool doesn't need management and the caller can safely
+ * start processing works, %true if management function was performed and
+ * the conditions that the caller verified before calling the function may
+ * no longer be true.
  */
 static bool manage_workers(struct worker *worker)
 {
 	struct worker_pool *pool = worker->pool;
-	bool ret = false;
 
 	/*
 	 * Anyone who successfully grabs manager_arb wins the arbitration
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1913 @ static bool manage_workers(struct worker
 	 * actual management, the pool may stall indefinitely.
 	 */
 	if (!mutex_trylock(&pool->manager_arb))
-		return ret;
+		return false;
 
-	ret |= maybe_create_worker(pool);
+	maybe_create_worker(pool);
 
 	mutex_unlock(&pool->manager_arb);
-	return ret;
+	return true;
 }
 
 /**
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2713 @ bool flush_work(struct work_struct *work
 }
 EXPORT_SYMBOL_GPL(flush_work);
 
+struct cwt_wait {
+	wait_queue_t		wait;
+	struct work_struct	*work;
+};
+
+static int cwt_wakefn(wait_queue_t *wait, unsigned mode, int sync, void *key)
+{
+	struct cwt_wait *cwait = container_of(wait, struct cwt_wait, wait);
+
+	if (cwait->work != key)
+		return 0;
+	return autoremove_wake_function(wait, mode, sync, key);
+}
+
 static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
 {
+	static DECLARE_WAIT_QUEUE_HEAD(cancel_waitq);
 	unsigned long flags;
 	int ret;
 
 	do {
 		ret = try_to_grab_pending(work, is_dwork, &flags);
 		/*
-		 * If someone else is canceling, wait for the same event it
-		 * would be waiting for before retrying.
+		 * If someone else is already canceling, wait for it to
+		 * finish.  flush_work() doesn't work for PREEMPT_NONE
+		 * because we may get scheduled between @work's completion
+		 * and the other canceling task resuming and clearing
+		 * CANCELING - flush_work() will return false immediately
+		 * as @work is no longer busy, try_to_grab_pending() will
+		 * return -ENOENT as @work is still being canceled and the
+		 * other canceling task won't be able to clear CANCELING as
+		 * we're hogging the CPU.
+		 *
+		 * Let's wait for completion using a waitqueue.  As this
+		 * may lead to the thundering herd problem, use a custom
+		 * wake function which matches @work along with exclusive
+		 * wait and wakeup.
 		 */
-		if (unlikely(ret == -ENOENT))
-			flush_work(work);
+		if (unlikely(ret == -ENOENT)) {
+			struct cwt_wait cwait;
+
+			init_wait(&cwait.wait);
+			cwait.wait.func = cwt_wakefn;
+			cwait.work = work;
+
+			prepare_to_wait_exclusive(&cancel_waitq, &cwait.wait,
+						  TASK_UNINTERRUPTIBLE);
+			if (work_is_canceling(work))
+				schedule();
+			finish_wait(&cancel_waitq, &cwait.wait);
+		}
 	} while (unlikely(ret < 0));
 
 	/* tell other tasks trying to grab @work to back off */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2772 @ static bool __cancel_work_timer(struct w
 
 	flush_work(work);
 	clear_work_data(work);
+
+	/*
+	 * Paired with prepare_to_wait() above so that either
+	 * waitqueue_active() is visible here or !work_is_canceling() is
+	 * visible there.
+	 */
+	smp_mb();
+	if (waitqueue_active(&cancel_waitq))
+		__wake_up(&cancel_waitq, TASK_NORMAL, 1, work);
+
 	return ret;
 }
 
Index: linux-3.18.13-rt10-r7s4/lib/checksum.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/lib/checksum.c
+++ linux-3.18.13-rt10-r7s4/lib/checksum.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:184 @ csum_partial_copy(const void *src, void
 EXPORT_SYMBOL(csum_partial_copy);
 
 #ifndef csum_tcpudp_nofold
+static inline u32 from64to32(u64 x)
+{
+	/* add up 32-bit and 32-bit for 32+c bit */
+	x = (x & 0xffffffff) + (x >> 32);
+	/* add up carry.. */
+	x = (x & 0xffffffff) + (x >> 32);
+	return (u32)x;
+}
+
 __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr,
 			unsigned short len,
 			unsigned short proto,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:207 @ __wsum csum_tcpudp_nofold(__be32 saddr,
 #else
 	s += (proto + len) << 8;
 #endif
-	s += (s >> 32);
-	return (__force __wsum)s;
+	return (__force __wsum)from64to32(s);
 }
 EXPORT_SYMBOL(csum_tcpudp_nofold);
 #endif
Index: linux-3.18.13-rt10-r7s4/lib/decompress_bunzip2.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/lib/decompress_bunzip2.c
+++ linux-3.18.13-rt10-r7s4/lib/decompress_bunzip2.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:187 @ static int INIT get_next_block(struct bu
 	if (get_bits(bd, 1))
 		return RETVAL_OBSOLETE_INPUT;
 	origPtr = get_bits(bd, 24);
-	if (origPtr > dbufSize)
+	if (origPtr >= dbufSize)
 		return RETVAL_DATA_ERROR;
 	/* mapping table: if some byte values are never used (encoding things
 	   like ascii text), the compression code removes the gaps to have fewer
Index: linux-3.18.13-rt10-r7s4/lib/lz4/lz4_decompress.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/lib/lz4/lz4_decompress.c
+++ linux-3.18.13-rt10-r7s4/lib/lz4/lz4_decompress.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:142 @ static int lz4_uncompress(const char *so
 			/* Error: request to write beyond destination buffer */
 			if (cpy > oend)
 				goto _output_error;
+			if ((ref + COPYLENGTH) > oend ||
+					(op + COPYLENGTH) > oend)
+				goto _output_error;
 			LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
 			while (op < cpy)
 				*op++ = *ref++;
Index: linux-3.18.13-rt10-r7s4/mm/cma.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/cma.c
+++ linux-3.18.13-rt10-r7s4/mm/cma.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:218 @ int __init cma_declare_contiguous(phys_a
 			bool fixed, struct cma **res_cma)
 {
 	phys_addr_t memblock_end = memblock_end_of_DRAM();
-	phys_addr_t highmem_start = __pa(high_memory);
+	phys_addr_t highmem_start;
 	int ret = 0;
 
+#ifdef CONFIG_X86
+	/*
+	 * high_memory isn't direct mapped memory so retrieving its physical
+	 * address isn't appropriate.  But it would be useful to check the
+	 * physical address of the highmem boundary so it's justfiable to get
+	 * the physical address from it.  On x86 there is a validation check for
+	 * this case, so the following workaround is needed to avoid it.
+	 */
+	highmem_start = __pa_nodebug(high_memory);
+#else
+	highmem_start = __pa(high_memory);
+#endif
 	pr_debug("%s(size %pa, base %pa, limit %pa alignment %pa)\n",
 		__func__, &size, &base, &limit, &alignment);
 
Index: linux-3.18.13-rt10-r7s4/mm/compaction.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/compaction.c
+++ linux-3.18.13-rt10-r7s4/mm/compaction.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1030 @ static isolate_migrate_t isolate_migrate
 		low_pfn = isolate_migratepages_block(cc, low_pfn, end_pfn,
 								isolate_mode);
 
-		if (!low_pfn || cc->contended)
+		if (!low_pfn || cc->contended) {
+			acct_isolated(zone, cc);
 			return ISOLATE_ABORT;
+		}
 
 		/*
 		 * Either we isolated something and proceed with migration. Or
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1105 @ static int compact_finished(struct zone
 			return COMPACT_PARTIAL;
 
 		/* Job done if allocation would set block type */
-		if (cc->order >= pageblock_order && area->nr_free)
+		if (order >= pageblock_order && area->nr_free)
 			return COMPACT_PARTIAL;
 	}
 
Index: linux-3.18.13-rt10-r7s4/mm/filemap.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/filemap.c
+++ linux-3.18.13-rt10-r7s4/mm/filemap.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1049 @ EXPORT_SYMBOL(find_lock_entry);
  * @mapping: the address_space to search
  * @offset: the page index
  * @fgp_flags: PCG flags
- * @cache_gfp_mask: gfp mask to use for the page cache data page allocation
- * @radix_gfp_mask: gfp mask to use for radix tree node allocation
+ * @gfp_mask: gfp mask to use for the page cache data page allocation
  *
  * Looks up the page cache slot at @mapping & @offset.
  *
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1058 @ EXPORT_SYMBOL(find_lock_entry);
  * FGP_ACCESSED: the page will be marked accessed
  * FGP_LOCK: Page is return locked
  * FGP_CREAT: If page is not present then a new page is allocated using
- *		@cache_gfp_mask and added to the page cache and the VM's LRU
- *		list. If radix tree nodes are allocated during page cache
- *		insertion then @radix_gfp_mask is used. The page is returned
- *		locked and with an increased refcount. Otherwise, %NULL is
- *		returned.
+ *		@gfp_mask and added to the page cache and the VM's LRU
+ *		list. The page is returned locked and with an increased
+ *		refcount. Otherwise, %NULL is returned.
  *
  * If FGP_LOCK or FGP_CREAT are specified then the function may sleep even
  * if the GFP flags specified for FGP_CREAT are atomic.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1068 @ EXPORT_SYMBOL(find_lock_entry);
  * If there is a page cache page, it is returned with an increased refcount.
  */
 struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
-	int fgp_flags, gfp_t cache_gfp_mask, gfp_t radix_gfp_mask)
+	int fgp_flags, gfp_t gfp_mask)
 {
 	struct page *page;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1105 @ no_page:
 	if (!page && (fgp_flags & FGP_CREAT)) {
 		int err;
 		if ((fgp_flags & FGP_WRITE) && mapping_cap_account_dirty(mapping))
-			cache_gfp_mask |= __GFP_WRITE;
-		if (fgp_flags & FGP_NOFS) {
-			cache_gfp_mask &= ~__GFP_FS;
-			radix_gfp_mask &= ~__GFP_FS;
-		}
+			gfp_mask |= __GFP_WRITE;
+		if (fgp_flags & FGP_NOFS)
+			gfp_mask &= ~__GFP_FS;
 
-		page = __page_cache_alloc(cache_gfp_mask);
+		page = __page_cache_alloc(gfp_mask);
 		if (!page)
 			return NULL;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1120 @ no_page:
 		if (fgp_flags & FGP_ACCESSED)
 			__SetPageReferenced(page);
 
-		err = add_to_page_cache_lru(page, mapping, offset, radix_gfp_mask);
+		err = add_to_page_cache_lru(page, mapping, offset,
+				gfp_mask & GFP_RECLAIM_MASK);
 		if (unlikely(err)) {
 			page_cache_release(page);
 			page = NULL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2442 @ struct page *grab_cache_page_write_begin
 		fgp_flags |= FGP_NOFS;
 
 	page = pagecache_get_page(mapping, index, fgp_flags,
-			mapping_gfp_mask(mapping),
-			GFP_KERNEL);
+			mapping_gfp_mask(mapping));
 	if (page)
 		wait_for_stable_page(page);
 
Index: linux-3.18.13-rt10-r7s4/mm/gup.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/gup.c
+++ linux-3.18.13-rt10-r7s4/mm/gup.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:299 @ static int faultin_page(struct task_stru
 			return -ENOMEM;
 		if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
 			return *flags & FOLL_HWPOISON ? -EHWPOISON : -EFAULT;
-		if (ret & VM_FAULT_SIGBUS)
+		if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
 			return -EFAULT;
 		BUG();
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:574 @ int fixup_user_fault(struct task_struct
 			return -ENOMEM;
 		if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
 			return -EHWPOISON;
-		if (ret & VM_FAULT_SIGBUS)
+		if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
 			return -EFAULT;
 		BUG();
 	}
Index: linux-3.18.13-rt10-r7s4/mm/hugetlb.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/hugetlb.c
+++ linux-3.18.13-rt10-r7s4/mm/hugetlb.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2656 @ again:
 			goto unlock;
 
 		/*
-		 * HWPoisoned hugepage is already unmapped and dropped reference
+		 * Migrating hugepage or HWPoisoned hugepage is already
+		 * unmapped and its refcount is dropped, so just clear pte here.
 		 */
-		if (unlikely(is_hugetlb_entry_hwpoisoned(pte))) {
+		if (unlikely(!pte_present(pte))) {
 			huge_pte_clear(mm, address, ptep);
 			goto unlock;
 		}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3132 @ int hugetlb_fault(struct mm_struct *mm,
 	struct page *pagecache_page = NULL;
 	struct hstate *h = hstate_vma(vma);
 	struct address_space *mapping;
+	int need_wait_lock = 0;
 
 	address &= huge_page_mask(h);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3171 @ int hugetlb_fault(struct mm_struct *mm,
 	ret = 0;
 
 	/*
+	 * entry could be a migration/hwpoison entry at this point, so this
+	 * check prevents the kernel from going below assuming that we have
+	 * a active hugepage in pagecache. This goto expects the 2nd page fault,
+	 * and is_hugetlb_entry_(migration|hwpoisoned) check will properly
+	 * handle it.
+	 */
+	if (!pte_present(entry))
+		goto out_mutex;
+
+	/*
 	 * If we are going to COW the mapping later, we examine the pending
 	 * reservations for this page now. This will ensure that any
 	 * allocations necessary to record that reservation occur outside the
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3199 @ int hugetlb_fault(struct mm_struct *mm,
 								vma, address);
 	}
 
+	ptl = huge_pte_lock(h, mm, ptep);
+
+	/* Check for a racing update before calling hugetlb_cow */
+	if (unlikely(!pte_same(entry, huge_ptep_get(ptep))))
+		goto out_ptl;
+
 	/*
 	 * hugetlb_cow() requires page locks of pte_page(entry) and
 	 * pagecache_page, so here we need take the former one
 	 * when page != pagecache_page or !pagecache_page.
-	 * Note that locking order is always pagecache_page -> page,
-	 * so no worry about deadlock.
 	 */
 	page = pte_page(entry);
-	get_page(page);
 	if (page != pagecache_page)
-		lock_page(page);
-
-	ptl = huge_pte_lockptr(h, mm, ptep);
-	spin_lock(ptl);
-	/* Check for a racing update before calling hugetlb_cow */
-	if (unlikely(!pte_same(entry, huge_ptep_get(ptep))))
-		goto out_ptl;
+		if (!trylock_page(page)) {
+			need_wait_lock = 1;
+			goto out_ptl;
+		}
 
+	get_page(page);
 
 	if (flags & FAULT_FLAG_WRITE) {
 		if (!huge_pte_write(entry)) {
 			ret = hugetlb_cow(mm, vma, address, ptep, entry,
 					pagecache_page, ptl);
-			goto out_ptl;
+			goto out_put_page;
 		}
 		entry = huge_pte_mkdirty(entry);
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3231 @ int hugetlb_fault(struct mm_struct *mm,
 	if (huge_ptep_set_access_flags(vma, address, ptep, entry,
 						flags & FAULT_FLAG_WRITE))
 		update_mmu_cache(vma, address, ptep);
-
+out_put_page:
+	if (page != pagecache_page)
+		unlock_page(page);
+	put_page(page);
 out_ptl:
 	spin_unlock(ptl);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3242 @ out_ptl:
 		unlock_page(pagecache_page);
 		put_page(pagecache_page);
 	}
-	if (page != pagecache_page)
-		unlock_page(page);
-	put_page(page);
-
 out_mutex:
 	mutex_unlock(&htlb_fault_mutex_table[hash]);
+	/*
+	 * Generally it's safe to hold refcount during waiting page lock. But
+	 * here we just wait to defer the next page fault to avoid busy loop and
+	 * the page is not used after unlocked before returning from the current
+	 * page fault. So we are safe from accessing freed page, even if we wait
+	 * here without taking refcount.
+	 */
+	if (need_wait_lock)
+		wait_on_page_locked(page);
 	return ret;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3382 @ unsigned long hugetlb_change_protection(
 			spin_unlock(ptl);
 			continue;
 		}
-		if (!huge_pte_none(huge_ptep_get(ptep))) {
+		pte = huge_ptep_get(ptep);
+		if (unlikely(is_hugetlb_entry_hwpoisoned(pte))) {
+			spin_unlock(ptl);
+			continue;
+		}
+		if (unlikely(is_hugetlb_entry_migration(pte))) {
+			swp_entry_t entry = pte_to_swp_entry(pte);
+
+			if (is_write_migration_entry(entry)) {
+				pte_t newpte;
+
+				make_migration_entry_read(&entry);
+				newpte = swp_entry_to_pte(entry);
+				set_huge_pte_at(mm, address, ptep, newpte);
+				pages++;
+			}
+			spin_unlock(ptl);
+			continue;
+		}
+		if (!huge_pte_none(pte)) {
 			pte = huge_ptep_get_and_clear(mm, address, ptep);
 			pte = pte_mkhuge(huge_pte_modify(pte, newprot));
 			pte = arch_make_huge_pte(pte, vma, NULL, 0);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3702 @ follow_huge_pmd(struct mm_struct *mm, un
 {
 	struct page *page;
 
+	if (!pmd_present(*pmd))
+		return NULL;
 	page = pte_page(*(pte_t *)pmd);
 	if (page)
 		page += ((address & ~PMD_MASK) >> PAGE_SHIFT);
Index: linux-3.18.13-rt10-r7s4/mm/ksm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/ksm.c
+++ linux-3.18.13-rt10-r7s4/mm/ksm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:379 @ static int break_ksm(struct vm_area_stru
 		else
 			ret = VM_FAULT_WRITE;
 		put_page(page);
-	} while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_OOM)));
+	} while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | VM_FAULT_OOM)));
 	/*
 	 * We must loop because handle_mm_fault() may back out if there's
 	 * any difficulty e.g. if pte accessed bit gets updated concurrently.
Index: linux-3.18.13-rt10-r7s4/mm/memcontrol.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/memcontrol.c
+++ linux-3.18.13-rt10-r7s4/mm/memcontrol.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1641 @ void mem_cgroup_print_oom_info(struct me
 
 	pr_info("Task in ");
 	pr_cont_cgroup_path(task_cgroup(p, memory_cgrp_id));
-	pr_info(" killed as a result of limit of ");
+	pr_cont(" killed as a result of limit of ");
 	pr_cont_cgroup_path(memcg->css.cgroup);
-	pr_info("\n");
+	pr_cont("\n");
 
 	rcu_read_unlock();
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6592 @ void mem_cgroup_uncharge_list(struct lis
  * mem_cgroup_migrate - migrate a charge to another page
  * @oldpage: currently charged page
  * @newpage: page to transfer the charge to
- * @lrucare: both pages might be on the LRU already
+ * @lrucare: either or both pages might be on the LRU already
  *
  * Migrate the charge from @oldpage to @newpage.
  *
Index: linux-3.18.13-rt10-r7s4/mm/memory-failure.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/memory-failure.c
+++ linux-3.18.13-rt10-r7s4/mm/memory-failure.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1662 @ static int __soft_offline_page(struct pa
 			 * setting PG_hwpoison.
 			 */
 			if (!is_free_buddy_page(page))
-				lru_add_drain_all();
-			if (!is_free_buddy_page(page))
 				drain_all_pages();
 			SetPageHWPoison(page);
 			if (!is_free_buddy_page(page))
Index: linux-3.18.13-rt10-r7s4/mm/memory.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/memory.c
+++ linux-3.18.13-rt10-r7s4/mm/memory.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:223 @ void tlb_gather_mmu(struct mmu_gather *t
 	/* Is it from 0 to ~0? */
 	tlb->fullmm     = !(start | (end+1));
 	tlb->need_flush_all = 0;
-	tlb->start	= start;
-	tlb->end	= end;
-	tlb->need_flush = 0;
 	tlb->local.next = NULL;
 	tlb->local.nr   = 0;
 	tlb->local.max  = ARRAY_SIZE(tlb->__pages);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:232 @ void tlb_gather_mmu(struct mmu_gather *t
 #ifdef CONFIG_HAVE_RCU_TABLE_FREE
 	tlb->batch = NULL;
 #endif
+
+	__tlb_reset_range(tlb);
 }
 
 static void tlb_flush_mmu_tlbonly(struct mmu_gather *tlb)
 {
-	tlb->need_flush = 0;
+	if (!tlb->end)
+		return;
+
 	tlb_flush(tlb);
 #ifdef CONFIG_HAVE_RCU_TABLE_FREE
 	tlb_table_flush(tlb);
 #endif
+	__tlb_reset_range(tlb);
 }
 
 static void tlb_flush_mmu_free(struct mmu_gather *tlb)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:261 @ static void tlb_flush_mmu_free(struct mm
 
 void tlb_flush_mmu(struct mmu_gather *tlb)
 {
-	if (!tlb->need_flush)
-		return;
 	tlb_flush_mmu_tlbonly(tlb);
 	tlb_flush_mmu_free(tlb);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:295 @ int __tlb_remove_page(struct mmu_gather
 {
 	struct mmu_gather_batch *batch;
 
-	VM_BUG_ON(!tlb->need_flush);
+	VM_BUG_ON(!tlb->end);
 
 	batch = tlb->active;
 	batch->pages[batch->nr++] = page;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:362 @ void tlb_remove_table(struct mmu_gather
 {
 	struct mmu_table_batch **batch = &tlb->batch;
 
-	tlb->need_flush = 1;
-
 	/*
 	 * When there's less then two users of this mm there cannot be a
 	 * concurrent page-table walk.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1187 @ again:
 	arch_leave_lazy_mmu_mode();
 
 	/* Do the actual TLB flush before dropping ptl */
-	if (force_flush) {
-		unsigned long old_end;
-
-		/*
-		 * Flush the TLB just for the previous segment,
-		 * then update the range to be the remaining
-		 * TLB range.
-		 */
-		old_end = tlb->end;
-		tlb->end = addr;
+	if (force_flush)
 		tlb_flush_mmu_tlbonly(tlb);
-		tlb->start = addr;
-		tlb->end = old_end;
-	}
 	pte_unmap_unlock(start_pte, ptl);
 
 	/*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2139 @ reuse:
 		if (!dirty_page)
 			return ret;
 
-		/*
-		 * Yes, Virginia, this is actually required to prevent a race
-		 * with clear_page_dirty_for_io() from clearing the page dirty
-		 * bit after it clear all dirty ptes, but before a racing
-		 * do_wp_page installs a dirty pte.
-		 *
-		 * do_shared_fault is protected similarly.
-		 */
 		if (!page_mkwrite) {
-			wait_on_page_locked(dirty_page);
-			set_page_dirty_balance(dirty_page);
+			struct address_space *mapping;
+			int dirtied;
+
+			lock_page(dirty_page);
+			dirtied = set_page_dirty(dirty_page);
+			VM_BUG_ON_PAGE(PageAnon(dirty_page), dirty_page);
+			mapping = dirty_page->mapping;
+			unlock_page(dirty_page);
+
+			if (dirtied && mapping) {
+				/*
+				 * Some device drivers do not set page.mapping
+				 * but still dirty their pages
+				 */
+				balance_dirty_pages_ratelimited(mapping);
+			}
+
 			/* file_update_time outside page_lock */
 			if (vma->vm_file)
 				file_update_time(vma->vm_file);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2602 @ static inline int check_stack_guard_page
 		if (prev && prev->vm_end == address)
 			return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
 
-		expand_downwards(vma, address - PAGE_SIZE);
+		return expand_downwards(vma, address - PAGE_SIZE);
 	}
 	if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
 		struct vm_area_struct *next = vma->vm_next;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2611 @ static inline int check_stack_guard_page
 		if (next && next->vm_start == address + PAGE_SIZE)
 			return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
 
-		expand_upwards(vma, address + PAGE_SIZE);
+		return expand_upwards(vma, address + PAGE_SIZE);
 	}
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2634 @ static int do_anonymous_page(struct mm_s
 
 	/* Check if we need to add a guard page to the stack */
 	if (check_stack_guard_page(vma, address) < 0)
-		return VM_FAULT_SIGBUS;
+		return VM_FAULT_SIGSEGV;
 
 	/* Use the zero-page for reads */
 	if (!(flags & FAULT_FLAG_WRITE)) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3547 @ int generic_access_phys(struct vm_area_s
 	if (follow_phys(vma, addr, write, &prot, &phys_addr))
 		return -EINVAL;
 
-	maddr = ioremap_prot(phys_addr, PAGE_SIZE, prot);
+	maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot);
 	if (write)
 		memcpy_toio(maddr + offset, buf, len);
 	else
Index: linux-3.18.13-rt10-r7s4/mm/memory_hotplug.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/memory_hotplug.c
+++ linux-3.18.13-rt10-r7s4/mm/memory_hotplug.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1095 @ static pg_data_t __ref *hotadd_new_pgdat
 			return NULL;
 
 		arch_refresh_nodedata(nid, pgdat);
+	} else {
+		/* Reset the nr_zones and classzone_idx to 0 before reuse */
+		pgdat->nr_zones = 0;
+		pgdat->classzone_idx = 0;
 	}
 
 	/* we can use NODE_DATA(nid) from here */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1984 @ void try_offline_node(int nid)
 		if (is_vmalloc_addr(zone->wait_table))
 			vfree(zone->wait_table);
 	}
-
-	/*
-	 * Since there is no way to guarentee the address of pgdat/zone is not
-	 * on stack of any kernel threads or used by other kernel objects
-	 * without reference counting or other symchronizing method, do not
-	 * reset node_data and free pgdat here. Just reset it to 0 and reuse
-	 * the memory when the node is online again.
-	 */
-	memset(pgdat, 0, sizeof(*pgdat));
 }
 EXPORT_SYMBOL(try_offline_node);
 
Index: linux-3.18.13-rt10-r7s4/mm/mmap.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/mmap.c
+++ linux-3.18.13-rt10-r7s4/mm/mmap.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:155 @ EXPORT_SYMBOL_GPL(vm_memory_committed);
  */
 int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
 {
-	unsigned long free, allowed, reserve;
+	long free, allowed, reserve;
 
 	VM_WARN_ONCE(percpu_counter_read(&vm_committed_as) <
 			-(s64)vm_committed_as_batch * num_online_cpus(),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:223 @ int __vm_enough_memory(struct mm_struct
 	 */
 	if (mm) {
 		reserve = sysctl_user_reserve_kbytes >> (PAGE_SHIFT - 10);
-		allowed -= min(mm->total_vm / 32, reserve);
+		allowed -= min_t(long, mm->total_vm / 32, reserve);
 	}
 
 	if (percpu_counter_read_positive(&vm_committed_as) < allowed)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:781 @ again:			remove_next = 1 + (end > next->
 		if (exporter && exporter->anon_vma && !importer->anon_vma) {
 			int error;
 
+			importer->anon_vma = exporter->anon_vma;
 			error = anon_vma_clone(importer, exporter);
 			if (error)
 				return error;
-			importer->anon_vma = exporter->anon_vma;
 		}
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2102 @ static int acct_stack_growth(struct vm_a
 {
 	struct mm_struct *mm = vma->vm_mm;
 	struct rlimit *rlim = current->signal->rlim;
-	unsigned long new_start;
+	unsigned long new_start, actual_size;
 
 	/* address space limit tests */
 	if (!may_expand_vm(mm, grow))
 		return -ENOMEM;
 
 	/* Stack limit test */
-	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
+	actual_size = size;
+	if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN)))
+		actual_size -= PAGE_SIZE;
+	if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
 		return -ENOMEM;
 
 	/* mlock limit tests */
Index: linux-3.18.13-rt10-r7s4/mm/nommu.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/nommu.c
+++ linux-3.18.13-rt10-r7s4/mm/nommu.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1908 @ EXPORT_SYMBOL(unmap_mapping_range);
  */
 int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
 {
-	unsigned long free, allowed, reserve;
+	long free, allowed, reserve;
 
 	vm_acct_memory(pages);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1972 @ int __vm_enough_memory(struct mm_struct
 	 */
 	if (mm) {
 		reserve = sysctl_user_reserve_kbytes >> (PAGE_SHIFT - 10);
-		allowed -= min(mm->total_vm / 32, reserve);
+		allowed -= min_t(long, mm->total_vm / 32, reserve);
 	}
 
 	if (percpu_counter_read_positive(&vm_committed_as) < allowed)
Index: linux-3.18.13-rt10-r7s4/mm/page-writeback.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/page-writeback.c
+++ linux-3.18.13-rt10-r7s4/mm/page-writeback.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:860 @ static void bdi_update_write_bandwidth(s
 	 *                   bw * elapsed + write_bandwidth * (period - elapsed)
 	 * write_bandwidth = ---------------------------------------------------
 	 *                                          period
+	 *
+	 * @written may have decreased due to account_page_redirty().
+	 * Avoid underflowing @bw calculation.
 	 */
-	bw = written - bdi->written_stamp;
+	bw = written - min(written, bdi->written_stamp);
 	bw *= HZ;
 	if (unlikely(elapsed > period)) {
 		do_div(bw, elapsed);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:928 @ static void global_update_bandwidth(unsi
 				    unsigned long now)
 {
 	static DEFINE_SPINLOCK(dirty_lock);
-	static unsigned long update_time;
+	static unsigned long update_time = INITIAL_JIFFIES;
 
 	/*
 	 * check locklessly first to optimize away locking for the most time
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1547 @ pause:
 		bdi_start_background_writeback(bdi);
 }
 
-void set_page_dirty_balance(struct page *page)
-{
-	if (set_page_dirty(page)) {
-		struct address_space *mapping = page_mapping(page);
-
-		if (mapping)
-			balance_dirty_pages_ratelimited(mapping);
-	}
-}
-
 static DEFINE_PER_CPU(int, bdp_ratelimits);
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2119 @ EXPORT_SYMBOL(account_page_dirtied);
  * page dirty in that case, but not all the buffers.  This is a "bottom-up"
  * dirtying, whereas __set_page_dirty_buffers() is a "top-down" dirtying.
  *
- * Most callers have locked the page, which pins the address_space in memory.
- * But zap_pte_range() does not lock the page, however in that case the
- * mapping is pinned by the vma's ->vm_file reference.
- *
- * We take care to handle the case where the page was truncated from the
- * mapping by re-checking page_mapping() inside tree_lock.
+ * The caller must ensure this doesn't race with truncation.  Most will simply
+ * hold the page lock, but e.g. zap_pte_range() calls with the page mapped and
+ * the pte lock held, which also locks out truncation.
  */
 int __set_page_dirty_nobuffers(struct page *page)
 {
 	if (!TestSetPageDirty(page)) {
 		struct address_space *mapping = page_mapping(page);
-		struct address_space *mapping2;
 		unsigned long flags;
 
 		if (!mapping)
 			return 1;
 
 		spin_lock_irqsave(&mapping->tree_lock, flags);
-		mapping2 = page_mapping(page);
-		if (mapping2) { /* Race with truncate? */
-			BUG_ON(mapping2 != mapping);
-			WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
-			account_page_dirtied(page, mapping);
-			radix_tree_tag_set(&mapping->page_tree,
-				page_index(page), PAGECACHE_TAG_DIRTY);
-		}
+		BUG_ON(page_mapping(page) != mapping);
+		WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
+		account_page_dirtied(page, mapping);
+		radix_tree_tag_set(&mapping->page_tree, page_index(page),
+				   PAGECACHE_TAG_DIRTY);
 		spin_unlock_irqrestore(&mapping->tree_lock, flags);
 		if (mapping->host) {
 			/* !PageAnon && !swapper_space */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2294 @ int clear_page_dirty_for_io(struct page
 		/*
 		 * We carefully synchronise fault handlers against
 		 * installing a dirty pte and marking the page dirty
-		 * at this point. We do this by having them hold the
-		 * page lock at some point after installing their
-		 * pte, but before marking the page dirty.
-		 * Pages are always locked coming in here, so we get
-		 * the desired exclusion. See mm/memory.c:do_wp_page()
-		 * for more comments.
+		 * at this point.  We do this by having them hold the
+		 * page lock while dirtying the page, and pages are
+		 * always locked coming in here, so we get the desired
+		 * exclusion.
 		 */
 		if (TestClearPageDirty(page)) {
 			dec_zone_page_state(page, NR_FILE_DIRTY);
Index: linux-3.18.13-rt10-r7s4/mm/page_alloc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/page_alloc.c
+++ linux-3.18.13-rt10-r7s4/mm/page_alloc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1076 @ static void change_pageblock_range(struc
  * nor move CMA pages to different free lists. We don't want unmovable pages
  * to be allocated from MIGRATE_CMA areas.
  *
- * Returns the new migratetype of the pageblock (or the same old migratetype
- * if it was unchanged).
+ * Returns the allocation migratetype if free pages were stolen, or the
+ * fallback migratetype if it was decided not to steal.
  */
 static int try_to_steal_freepages(struct zone *zone, struct page *page,
 				  int start_type, int fallback_type)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1108 @ static int try_to_steal_freepages(struct
 
 		/* Claim the whole block if over half of it is free */
 		if (pages >= (1 << (pageblock_order-1)) ||
-				page_group_by_mobility_disabled) {
-
+				page_group_by_mobility_disabled)
 			set_pageblock_migratetype(page, start_type);
-			return start_type;
-		}
 
+		return start_type;
 	}
 
 	return fallback_type;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1163 @ __rmqueue_fallback(struct zone *zone, un
 			set_freepage_migratetype(page, new_type);
 
 			trace_mm_page_alloc_extfrag(page, order, current_order,
-				start_migratetype, migratetype, new_type);
+				start_migratetype, migratetype);
 
 			return page;
 		}
Index: linux-3.18.13-rt10-r7s4/mm/page_isolation.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/page_isolation.c
+++ linux-3.18.13-rt10-r7s4/mm/page_isolation.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:106 @ void unset_migratetype_isolate(struct pa
 
 			if (!is_migrate_isolate_page(buddy)) {
 				__isolate_free_page(page, order);
+				kernel_map_pages(page, (1 << order), 1);
 				set_page_refcounted(page);
 				isolated_page = page;
 			}
Index: linux-3.18.13-rt10-r7s4/mm/pagewalk.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/pagewalk.c
+++ linux-3.18.13-rt10-r7s4/mm/pagewalk.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:202 @ int walk_page_range(unsigned long addr,
 			 */
 			if ((vma->vm_start <= addr) &&
 			    (vma->vm_flags & VM_PFNMAP)) {
-				next = vma->vm_end;
+				if (walk->pte_hole)
+					err = walk->pte_hole(addr, next, walk);
+				if (err)
+					break;
 				pgd = pgd_offset(walk->mm, next);
 				continue;
 			}
Index: linux-3.18.13-rt10-r7s4/mm/rmap.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/rmap.c
+++ linux-3.18.13-rt10-r7s4/mm/rmap.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:75 @ static inline struct anon_vma *anon_vma_
 	anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL);
 	if (anon_vma) {
 		atomic_set(&anon_vma->refcount, 1);
+		anon_vma->degree = 1;	/* Reference for first vma */
+		anon_vma->parent = anon_vma;
 		/*
 		 * Initialise the anon_vma root to point to itself. If called
 		 * from fork, the root will be reset to the parents anon_vma.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:193 @ int anon_vma_prepare(struct vm_area_stru
 		if (likely(!vma->anon_vma)) {
 			vma->anon_vma = anon_vma;
 			anon_vma_chain_link(vma, avc, anon_vma);
+			/* vma reference or self-parent link for new root */
+			anon_vma->degree++;
 			allocated = NULL;
 			avc = NULL;
 		}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:243 @ static inline void unlock_anon_vma_root(
 /*
  * Attach the anon_vmas from src to dst.
  * Returns 0 on success, -ENOMEM on failure.
+ *
+ * If dst->anon_vma is NULL this function tries to find and reuse existing
+ * anon_vma which has no vmas and only one child anon_vma. This prevents
+ * degradation of anon_vma hierarchy to endless linear chain in case of
+ * constantly forking task. On the other hand, an anon_vma with more than one
+ * child isn't reused even if there was no alive vma, thus rmap walker has a
+ * good chance of avoiding scanning the whole hierarchy when it searches where
+ * page is mapped.
  */
 int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:271 @ int anon_vma_clone(struct vm_area_struct
 		anon_vma = pavc->anon_vma;
 		root = lock_anon_vma_root(root, anon_vma);
 		anon_vma_chain_link(dst, avc, anon_vma);
+
+		/*
+		 * Reuse existing anon_vma if its degree lower than two,
+		 * that means it has no vma and only one anon_vma child.
+		 *
+		 * Do not chose parent anon_vma, otherwise first child
+		 * will always reuse it. Root anon_vma is never reused:
+		 * it has self-parent reference and at least one child.
+		 */
+		if (!dst->anon_vma && anon_vma != src->anon_vma &&
+				anon_vma->degree < 2)
+			dst->anon_vma = anon_vma;
 	}
+	if (dst->anon_vma)
+		dst->anon_vma->degree++;
 	unlock_anon_vma_root(root);
 	return 0;
 
  enomem_failure:
+	/*
+	 * dst->anon_vma is dropped here otherwise its degree can be incorrectly
+	 * decremented in unlink_anon_vmas().
+	 * We can safely do this because callers of anon_vma_clone() don't care
+	 * about dst->anon_vma if anon_vma_clone() failed.
+	 */
+	dst->anon_vma = NULL;
 	unlink_anon_vmas(dst);
 	return -ENOMEM;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:316 @ int anon_vma_fork(struct vm_area_struct
 	if (!pvma->anon_vma)
 		return 0;
 
+	/* Drop inherited anon_vma, we'll reuse existing or allocate new. */
+	vma->anon_vma = NULL;
+
 	/*
 	 * First, attach the new VMA to the parent VMA's anon_vmas,
 	 * so rmap can find non-COWed pages in child processes.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:327 @ int anon_vma_fork(struct vm_area_struct
 	if (error)
 		return error;
 
+	/* An existing anon_vma has been reused, all done then. */
+	if (vma->anon_vma)
+		return 0;
+
 	/* Then add our own anon_vma. */
 	anon_vma = anon_vma_alloc();
 	if (!anon_vma)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:344 @ int anon_vma_fork(struct vm_area_struct
 	 * lock any of the anon_vmas in this anon_vma tree.
 	 */
 	anon_vma->root = pvma->anon_vma->root;
+	anon_vma->parent = pvma->anon_vma;
 	/*
 	 * With refcounts, an anon_vma can stay around longer than the
 	 * process it belongs to. The root anon_vma needs to be pinned until
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:355 @ int anon_vma_fork(struct vm_area_struct
 	vma->anon_vma = anon_vma;
 	anon_vma_lock_write(anon_vma);
 	anon_vma_chain_link(vma, avc, anon_vma);
+	anon_vma->parent->degree++;
 	anon_vma_unlock_write(anon_vma);
 
 	return 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:386 @ void unlink_anon_vmas(struct vm_area_str
 		 * Leave empty anon_vmas on the list - we'll need
 		 * to free them outside the lock.
 		 */
-		if (RB_EMPTY_ROOT(&anon_vma->rb_root))
+		if (RB_EMPTY_ROOT(&anon_vma->rb_root)) {
+			anon_vma->parent->degree--;
 			continue;
+		}
 
 		list_del(&avc->same_vma);
 		anon_vma_chain_free(avc);
 	}
+	if (vma->anon_vma)
+		vma->anon_vma->degree--;
 	unlock_anon_vma_root(root);
 
 	/*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:406 @ void unlink_anon_vmas(struct vm_area_str
 	list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
 		struct anon_vma *anon_vma = avc->anon_vma;
 
+		BUG_ON(anon_vma->degree);
 		put_anon_vma(anon_vma);
 
 		list_del(&avc->same_vma);
Index: linux-3.18.13-rt10-r7s4/mm/shmem.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/shmem.c
+++ linux-3.18.13-rt10-r7s4/mm/shmem.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1016 @ static int shmem_replace_page(struct pag
 		 */
 		oldpage = newpage;
 	} else {
-		mem_cgroup_migrate(oldpage, newpage, false);
+		mem_cgroup_migrate(oldpage, newpage, true);
 		lru_cache_add_anon(newpage);
 		*pagep = newpage;
 	}
Index: linux-3.18.13-rt10-r7s4/mm/vmscan.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/vmscan.c
+++ linux-3.18.13-rt10-r7s4/mm/vmscan.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2907 @ static bool prepare_kswapd_sleep(pg_data
 		return false;
 
 	/*
-	 * There is a potential race between when kswapd checks its watermarks
-	 * and a process gets throttled. There is also a potential race if
-	 * processes get throttled, kswapd wakes, a large process exits therby
-	 * balancing the zones that causes kswapd to miss a wakeup. If kswapd
-	 * is going to sleep, no process should be sleeping on pfmemalloc_wait
-	 * so wake them now if necessary. If necessary, processes will wake
-	 * kswapd and get throttled again
+	 * The throttled processes are normally woken up in balance_pgdat() as
+	 * soon as pfmemalloc_watermark_ok() is true. But there is a potential
+	 * race between when kswapd checks the watermarks and a process gets
+	 * throttled. There is also a potential race if processes get
+	 * throttled, kswapd wakes, a large process exits thereby balancing the
+	 * zones, which causes kswapd to exit balance_pgdat() before reaching
+	 * the wake up checks. If kswapd is going to sleep, no process should
+	 * be sleeping on pfmemalloc_wait, so wake them now if necessary. If
+	 * the wake up is premature, processes will wake kswapd and get
+	 * throttled again. The difference from wake ups in balance_pgdat() is
+	 * that here we are under prepare_to_wait().
 	 */
-	if (waitqueue_active(&pgdat->pfmemalloc_wait)) {
-		wake_up(&pgdat->pfmemalloc_wait);
-		return false;
-	}
+	if (waitqueue_active(&pgdat->pfmemalloc_wait))
+		wake_up_all(&pgdat->pfmemalloc_wait);
 
 	return pgdat_balanced(pgdat, order, classzone_idx);
 }
Index: linux-3.18.13-rt10-r7s4/mm/vmstat.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/mm/vmstat.c
+++ linux-3.18.13-rt10-r7s4/mm/vmstat.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1351 @ static void __init start_shepherd_timer(
 	int cpu;
 
 	for_each_possible_cpu(cpu)
-		INIT_DEFERRABLE_WORK(per_cpu_ptr(&vmstat_work, cpu),
+		INIT_DELAYED_WORK(per_cpu_ptr(&vmstat_work, cpu),
 			vmstat_update);
 
 	if (!alloc_cpumask_var(&cpu_stat_off, GFP_KERNEL))
Index: linux-3.18.13-rt10-r7s4/net/batman-adv/fragmentation.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/batman-adv/fragmentation.c
+++ linux-3.18.13-rt10-r7s4/net/batman-adv/fragmentation.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:254 @ batadv_frag_merge_packets(struct hlist_h
 	kfree(entry);
 
 	/* Make room for the rest of the fragments. */
-	if (pskb_expand_head(skb_out, 0, size - skb->len, GFP_ATOMIC) < 0) {
+	if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
 		kfree_skb(skb_out);
 		skb_out = NULL;
 		goto free;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:437 @ bool batadv_frag_send_packet(struct sk_b
 	 * fragments larger than BATADV_FRAG_MAX_FRAG_SIZE
 	 */
 	mtu = min_t(unsigned, mtu, BATADV_FRAG_MAX_FRAG_SIZE);
-	max_fragment_size = (mtu - header_size - ETH_HLEN);
+	max_fragment_size = mtu - header_size;
 	max_packet_size = max_fragment_size * BATADV_FRAG_MAX_FRAGMENTS;
 
 	/* Don't even try to fragment, if we need more than 16 fragments */
Index: linux-3.18.13-rt10-r7s4/net/batman-adv/gateway_client.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/batman-adv/gateway_client.c
+++ linux-3.18.13-rt10-r7s4/net/batman-adv/gateway_client.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:813 @ bool batadv_gw_out_of_range(struct batad
 		goto out;
 
 	gw_node = batadv_gw_node_get(bat_priv, orig_dst_node);
-	if (!gw_node->bandwidth_down == 0)
+	if (!gw_node)
 		goto out;
 
 	switch (atomic_read(&bat_priv->gw_mode)) {
Index: linux-3.18.13-rt10-r7s4/net/bluetooth/6lowpan.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/bluetooth/6lowpan.c
+++ linux-3.18.13-rt10-r7s4/net/bluetooth/6lowpan.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:594 @ static netdev_tx_t bt_xmit(struct sk_buf
 	int err = 0;
 	bdaddr_t addr;
 	u8 addr_type;
-	struct sk_buff *tmpskb;
 
 	/* We must take a copy of the skb before we modify/replace the ipv6
 	 * header as the header could be used elsewhere
 	 */
-	tmpskb = skb_unshare(skb, GFP_ATOMIC);
-	if (!tmpskb) {
-		kfree_skb(skb);
+	skb = skb_unshare(skb, GFP_ATOMIC);
+	if (!skb)
 		return NET_XMIT_DROP;
-	}
-	skb = tmpskb;
 
 	/* Return values from setup_header()
 	 *  <0 - error, packet is dropped
Index: linux-3.18.13-rt10-r7s4/net/bluetooth/hci_conn.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/bluetooth/hci_conn.c
+++ linux-3.18.13-rt10-r7s4/net/bluetooth/hci_conn.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:418 @ static void le_conn_timeout(struct work_
 	 * happen with broken hardware or if low duty cycle was used
 	 * (which doesn't have a timeout of its own).
 	 */
-	if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
+	if (conn->role == HCI_ROLE_SLAVE) {
 		u8 enable = 0x00;
 		hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
 			     &enable);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:520 @ int hci_conn_del(struct hci_conn *conn)
 		/* Unacked frames */
 		hdev->acl_cnt += conn->sent;
 	} else if (conn->type == LE_LINK) {
-		cancel_delayed_work_sync(&conn->le_conn_timeout);
+		cancel_delayed_work(&conn->le_conn_timeout);
 
 		if (hdev->le_pkts)
 			hdev->le_cnt += conn->sent;
Index: linux-3.18.13-rt10-r7s4/net/bluetooth/hci_event.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/bluetooth/hci_event.c
+++ linux-3.18.13-rt10-r7s4/net/bluetooth/hci_event.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:208 @ static void hci_cc_reset(struct hci_dev
 	hdev->le_scan_type = LE_SCAN_PASSIVE;
 
 	hdev->ssp_debug_mode = 0;
+
+	hci_bdaddr_list_clear(&hdev->le_white_list);
 }
 
 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:242 @ static void hci_cc_read_local_name(struc
 	if (rp->status)
 		return;
 
-	if (test_bit(HCI_SETUP, &hdev->dev_flags))
+	if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
+	    test_bit(HCI_CONFIG, &hdev->dev_flags))
 		memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:498 @ static void hci_cc_read_local_version(st
 	if (rp->status)
 		return;
 
-	if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
+	if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
+	    test_bit(HCI_CONFIG, &hdev->dev_flags)) {
 		hdev->hci_ver = rp->hci_ver;
 		hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 		hdev->lmp_ver = rp->lmp_ver;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:518 @ static void hci_cc_read_local_commands(s
 	if (rp->status)
 		return;
 
-	if (test_bit(HCI_SETUP, &hdev->dev_flags))
+	if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
+	    test_bit(HCI_CONFIG, &hdev->dev_flags))
 		memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2147 @ static void hci_conn_request_evt(struct
 		return;
 	}
 
-	if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
+	/* Require HCI_CONNECTABLE or a whitelist entry to accept the
+	 * connection. These features are only touched through mgmt so
+	 * only do the checks if HCI_MGMT is set.
+	 */
+	if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
+	    !test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
 	    !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
 				    BDADDR_BREDR)) {
 		    hci_reject_conn(hdev, &ev->bdaddr);
Index: linux-3.18.13-rt10-r7s4/net/bluetooth/smp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/bluetooth/smp.c
+++ linux-3.18.13-rt10-r7s4/net/bluetooth/smp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1395 @ static int smp_cmd_ident_addr_info(struc
 	 * implementations are not known of and in order to not over
 	 * complicate our implementation, simply pretend that we never
 	 * received an IRK for such a device.
+	 *
+	 * The Identity Address must also be a Static Random or Public
+	 * Address, which hci_is_identity_address() checks for.
 	 */
-	if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
+	if (!bacmp(&info->bdaddr, BDADDR_ANY) ||
+	    !hci_is_identity_address(&info->bdaddr, info->addr_type)) {
 		BT_ERR("Ignoring IRK with no identity address");
 		goto distribute;
 	}
Index: linux-3.18.13-rt10-r7s4/net/bridge/br_vlan.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/bridge/br_vlan.c
+++ linux-3.18.13-rt10-r7s4/net/bridge/br_vlan.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:202 @ bool br_allowed_ingress(struct net_bridg
 		if (skb->vlan_proto != proto) {
 			/* Protocol-mismatch, empty out vlan_tci for new tag */
 			skb_push(skb, ETH_HLEN);
-			skb = __vlan_put_tag(skb, skb->vlan_proto,
-					     vlan_tx_tag_get(skb));
+			skb = vlan_insert_tag_set_proto(skb, skb->vlan_proto,
+							vlan_tx_tag_get(skb));
 			if (unlikely(!skb))
 				return false;
 
Index: linux-3.18.13-rt10-r7s4/net/caif/caif_socket.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/caif/caif_socket.c
+++ linux-3.18.13-rt10-r7s4/net/caif/caif_socket.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:284 @ static int caif_seqpkt_recvmsg(struct ki
 	int copylen;
 
 	ret = -EOPNOTSUPP;
-	if (m->msg_flags&MSG_OOB)
+	if (flags & MSG_OOB)
 		goto read_error;
 
 	skb = skb_recv_datagram(sk, flags, 0 , &ret);
Index: linux-3.18.13-rt10-r7s4/net/can/af_can.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/can/af_can.c
+++ linux-3.18.13-rt10-r7s4/net/can/af_can.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:265 @ int can_send(struct sk_buff *skb, int lo
 		goto inval_skb;
 	}
 
+	skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+	skb_reset_mac_header(skb);
 	skb_reset_network_header(skb);
 	skb_reset_transport_header(skb);
 
Index: linux-3.18.13-rt10-r7s4/net/ceph/messenger.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ceph/messenger.c
+++ linux-3.18.13-rt10-r7s4/net/ceph/messenger.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:487 @ static int ceph_tcp_connect(struct ceph_
 			       IPPROTO_TCP, &sock);
 	if (ret)
 		return ret;
-	sock->sk->sk_allocation = GFP_NOFS | __GFP_MEMALLOC;
+	sock->sk->sk_allocation = GFP_NOFS;
 
 #ifdef CONFIG_LOCKDEP
 	lockdep_set_class(&sock->sk->sk_lock, &socket_class);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:513 @ static int ceph_tcp_connect(struct ceph_
 		return ret;
 	}
 
-	sk_set_memalloc(sock->sk);
-
 	con->sock = sock;
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2773 @ static void con_work(struct work_struct
 {
 	struct ceph_connection *con = container_of(work, struct ceph_connection,
 						   work.work);
-	unsigned long pflags = current->flags;
 	bool fault;
 
-	current->flags |= PF_MEMALLOC;
-
 	mutex_lock(&con->mutex);
 	while (true) {
 		int ret;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2828 @ static void con_work(struct work_struct
 		con_fault_finish(con);
 
 	con->ops->put(con);
-
-	tsk_restore_flags(current, pflags, PF_MEMALLOC);
 }
 
 /*
Index: linux-3.18.13-rt10-r7s4/net/ceph/osd_client.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ceph/osd_client.c
+++ linux-3.18.13-rt10-r7s4/net/ceph/osd_client.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1009 @ static void put_osd(struct ceph_osd *osd
  */
 static void __remove_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
 {
-	dout("__remove_osd %p\n", osd);
+	dout("%s %p osd%d\n", __func__, osd, osd->o_osd);
 	WARN_ON(!list_empty(&osd->o_requests));
 	WARN_ON(!list_empty(&osd->o_linger_requests));
 
-	rb_erase(&osd->o_node, &osdc->osds);
 	list_del_init(&osd->o_osd_lru);
-	ceph_con_close(&osd->o_con);
-	put_osd(osd);
+	rb_erase(&osd->o_node, &osdc->osds);
+	RB_CLEAR_NODE(&osd->o_node);
+}
+
+static void remove_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
+{
+	dout("%s %p osd%d\n", __func__, osd, osd->o_osd);
+
+	if (!RB_EMPTY_NODE(&osd->o_node)) {
+		ceph_con_close(&osd->o_con);
+		__remove_osd(osdc, osd);
+		put_osd(osd);
+	}
 }
 
 static void remove_all_osds(struct ceph_osd_client *osdc)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1036 @ static void remove_all_osds(struct ceph_
 	while (!RB_EMPTY_ROOT(&osdc->osds)) {
 		struct ceph_osd *osd = rb_entry(rb_first(&osdc->osds),
 						struct ceph_osd, o_node);
-		__remove_osd(osdc, osd);
+		remove_osd(osdc, osd);
 	}
 	mutex_unlock(&osdc->request_mutex);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1077 @ static void remove_old_osds(struct ceph_
 	list_for_each_entry_safe(osd, nosd, &osdc->osd_lru, o_osd_lru) {
 		if (time_before(jiffies, osd->lru_ttl))
 			break;
-		__remove_osd(osdc, osd);
+		remove_osd(osdc, osd);
 	}
 	mutex_unlock(&osdc->request_mutex);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1092 @ static int __reset_osd(struct ceph_osd_c
 	dout("__reset_osd %p osd%d\n", osd, osd->o_osd);
 	if (list_empty(&osd->o_requests) &&
 	    list_empty(&osd->o_linger_requests)) {
-		__remove_osd(osdc, osd);
-
+		remove_osd(osdc, osd);
 		return -ENODEV;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1896 @ static void reset_changed_osds(struct ce
 {
 	struct rb_node *p, *n;
 
+	dout("%s %p\n", __func__, osdc);
 	for (p = rb_first(&osdc->osds); p; p = n) {
 		struct ceph_osd *osd = rb_entry(p, struct ceph_osd, o_node);
 
Index: linux-3.18.13-rt10-r7s4/net/compat.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/compat.c
+++ linux-3.18.13-rt10-r7s4/net/compat.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:74 @ int get_compat_msghdr(struct msghdr *kms
 	    __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
 	    __get_user(kmsg->msg_flags, &umsg->msg_flags))
 		return -EFAULT;
+
+	if (!tmp1)
+		kmsg->msg_namelen = 0;
+
+	if (kmsg->msg_namelen < 0)
+		return -EINVAL;
+
 	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
 		kmsg->msg_namelen = sizeof(struct sockaddr_storage);
 	kmsg->msg_name = compat_ptr(tmp1);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:748 @ static unsigned char nas[21] = {
 
 COMPAT_SYSCALL_DEFINE3(sendmsg, int, fd, struct compat_msghdr __user *, msg, unsigned int, flags)
 {
-	if (flags & MSG_CMSG_COMPAT)
-		return -EINVAL;
 	return __sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
 COMPAT_SYSCALL_DEFINE4(sendmmsg, int, fd, struct compat_mmsghdr __user *, mmsg,
 		       unsigned int, vlen, unsigned int, flags)
 {
-	if (flags & MSG_CMSG_COMPAT)
-		return -EINVAL;
 	return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
 			      flags | MSG_CMSG_COMPAT);
 }
 
 COMPAT_SYSCALL_DEFINE3(recvmsg, int, fd, struct compat_msghdr __user *, msg, unsigned int, flags)
 {
-	if (flags & MSG_CMSG_COMPAT)
-		return -EINVAL;
 	return __sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:782 @ COMPAT_SYSCALL_DEFINE5(recvmmsg, int, fd
 	int datagrams;
 	struct timespec ktspec;
 
-	if (flags & MSG_CMSG_COMPAT)
-		return -EINVAL;
-
 	if (timeout == NULL)
 		return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
 				      flags | MSG_CMSG_COMPAT, NULL);
Index: linux-3.18.13-rt10-r7s4/net/core/dev.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/core/dev.c
+++ linux-3.18.13-rt10-r7s4/net/core/dev.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:946 @ bool dev_valid_name(const char *name)
 		return false;
 
 	while (*name) {
-		if (*name == '/' || isspace(*name))
+		if (*name == '/' || *name == ':' || isspace(*name))
 			return false;
 		name++;
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1700 @ int __dev_forward_skb(struct net_device
 
 	skb_scrub_packet(skb, true);
 	skb->protocol = eth_type_trans(skb, dev);
+	skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
 
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2569 @ static netdev_features_t harmonize_featu
 
 netdev_features_t netif_skb_features(struct sk_buff *skb)
 {
-	const struct net_device *dev = skb->dev;
+	struct net_device *dev = skb->dev;
 	netdev_features_t features = dev->features;
 	u16 gso_segs = skb_shinfo(skb)->gso_segs;
 	__be16 protocol = skb->protocol;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2577 @ netdev_features_t netif_skb_features(str
 	if (gso_segs > dev->gso_max_segs || gso_segs < dev->gso_min_segs)
 		features &= ~NETIF_F_GSO_MASK;
 
-	if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD)) {
-		struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
-		protocol = veh->h_vlan_encapsulated_proto;
-	} else if (!vlan_tx_tag_present(skb)) {
-		return harmonize_features(skb, features);
+	/* If encapsulation offload request, verify we are testing
+	 * hardware encapsulation features instead of standard
+	 * features for the netdev
+	 */
+	if (skb->encapsulation)
+		features &= dev->hw_enc_features;
+
+	if (!vlan_tx_tag_present(skb)) {
+		if (unlikely(protocol == htons(ETH_P_8021Q) ||
+			     protocol == htons(ETH_P_8021AD))) {
+			struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
+			protocol = veh->h_vlan_encapsulated_proto;
+		} else {
+			goto finalize;
+		}
 	}
 
 	features = netdev_intersect_features(features,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2608 @ netdev_features_t netif_skb_features(str
 						     NETIF_F_HW_VLAN_CTAG_TX |
 						     NETIF_F_HW_VLAN_STAG_TX);
 
+finalize:
+	if (dev->netdev_ops->ndo_features_check)
+		features &= dev->netdev_ops->ndo_features_check(skb, dev,
+								features);
+
 	return harmonize_features(skb, features);
 }
 EXPORT_SYMBOL(netif_skb_features);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2666 @ static struct sk_buff *validate_xmit_vla
 					  netdev_features_t features)
 {
 	if (vlan_tx_tag_present(skb) &&
-	    !vlan_hw_offload_capable(features, skb->vlan_proto)) {
-		skb = __vlan_put_tag(skb, skb->vlan_proto,
-				     vlan_tx_tag_get(skb));
-		if (skb)
-			skb->vlan_tci = 0;
-	}
+	    !vlan_hw_offload_capable(features, skb->vlan_proto))
+		skb = __vlan_hwaccel_push_inside(skb);
 	return skb;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2683 @ static struct sk_buff *validate_xmit_skb
 	if (unlikely(!skb))
 		goto out_null;
 
-	/* If encapsulation offload request, verify we are testing
-	 * hardware encapsulation features instead of standard
-	 * features for the netdev
-	 */
-	if (skb->encapsulation)
-		features &= dev->hw_enc_features;
-
 	if (netif_needs_gso(dev, skb, features)) {
 		struct sk_buff *segs;
 
 		segs = skb_gso_segment(skb, features);
 		if (IS_ERR(segs)) {
-			segs = NULL;
+			goto out_kfree_skb;
 		} else if (segs) {
 			consume_skb(skb);
 			skb = segs;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2856 @ static void skb_update_prio(struct sk_bu
 #define skb_update_prio(skb)
 #endif
 
-static DEFINE_PER_CPU(int, xmit_recursion);
+DEFINE_PER_CPU(int, xmit_recursion);
+EXPORT_SYMBOL(xmit_recursion);
+
 #define RECURSION_LIMIT 10
 
 /**
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6991 @ static int dev_cpu_callback(struct notif
 		oldsd->output_queue = NULL;
 		oldsd->output_queue_tailp = &oldsd->output_queue;
 	}
-	/* Append NAPI poll list from offline CPU. */
-	if (!list_empty(&oldsd->poll_list)) {
-		list_splice_init(&oldsd->poll_list, &sd->poll_list);
-		raise_softirq_irqoff(NET_RX_SOFTIRQ);
+	/* Append NAPI poll list from offline CPU, with one exception :
+	 * process_backlog() must be called by cpu owning percpu backlog.
+	 * We properly handle process_queue & input_pkt_queue later.
+	 */
+	while (!list_empty(&oldsd->poll_list)) {
+		struct napi_struct *napi = list_first_entry(&oldsd->poll_list,
+							    struct napi_struct,
+							    poll_list);
+
+		list_del_init(&napi->poll_list);
+		if (napi->poll == process_backlog)
+			napi->state = 0;
+		else
+			____napi_schedule(sd, napi);
 	}
 
 	raise_softirq_irqoff(NET_TX_SOFTIRQ);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:7015 @ static int dev_cpu_callback(struct notif
 		netif_rx_internal(skb);
 		input_queue_head_incr(oldsd);
 	}
-	while ((skb = __skb_dequeue(&oldsd->input_pkt_queue))) {
+	while ((skb = skb_dequeue(&oldsd->input_pkt_queue))) {
 		netif_rx_internal(skb);
 		input_queue_head_incr(oldsd);
 	}
Index: linux-3.18.13-rt10-r7s4/net/core/flow.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/core/flow.c
+++ linux-3.18.13-rt10-r7s4/net/core/flow.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:382 @ done:
 static void flow_cache_flush_task(struct work_struct *work)
 {
 	struct netns_xfrm *xfrm = container_of(work, struct netns_xfrm,
-						flow_cache_gc_work);
+						flow_cache_flush_work);
 	struct net *net = container_of(xfrm, struct net, xfrm);
 
 	flow_cache_flush(net);
Index: linux-3.18.13-rt10-r7s4/net/core/gen_stats.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/core/gen_stats.c
+++ linux-3.18.13-rt10-r7s4/net/core/gen_stats.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:35 @ gnet_stats_copy(struct gnet_dump *d, int
 	return 0;
 
 nla_put_failure:
+	kfree(d->xstats);
+	d->xstats = NULL;
+	d->xstats_len = 0;
 	spin_unlock_bh(d->lock);
 	return -1;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:311 @ int
 gnet_stats_copy_app(struct gnet_dump *d, void *st, int len)
 {
 	if (d->compat_xstats) {
-		d->xstats = st;
+		d->xstats = kmemdup(st, len, GFP_ATOMIC);
+		if (!d->xstats)
+			goto err_out;
 		d->xstats_len = len;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:321 @ gnet_stats_copy_app(struct gnet_dump *d,
 		return gnet_stats_copy(d, TCA_STATS_APP, st, len);
 
 	return 0;
+
+err_out:
+	d->xstats_len = 0;
+	spin_unlock_bh(d->lock);
+	return -1;
 }
 EXPORT_SYMBOL(gnet_stats_copy_app);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:358 @ gnet_stats_finish_copy(struct gnet_dump
 			return -1;
 	}
 
+	kfree(d->xstats);
+	d->xstats = NULL;
+	d->xstats_len = 0;
 	spin_unlock_bh(d->lock);
 	return 0;
 }
Index: linux-3.18.13-rt10-r7s4/net/core/netpoll.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/core/netpoll.c
+++ linux-3.18.13-rt10-r7s4/net/core/netpoll.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:82 @ static int netpoll_start_xmit(struct sk_
 
 	if (vlan_tx_tag_present(skb) &&
 	    !vlan_hw_offload_capable(features, skb->vlan_proto)) {
-		skb = __vlan_put_tag(skb, skb->vlan_proto,
-				     vlan_tx_tag_get(skb));
+		skb = __vlan_hwaccel_push_inside(skb);
 		if (unlikely(!skb)) {
 			/* This is actually a packet drop, but we
 			 * don't want the code that calls this
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:90 @ static int netpoll_start_xmit(struct sk_
 			 */
 			goto out;
 		}
-		skb->vlan_tci = 0;
 	}
 
 	status = netdev_start_xmit(skb, dev, txq, false);
Index: linux-3.18.13-rt10-r7s4/net/core/pktgen.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/core/pktgen.c
+++ linux-3.18.13-rt10-r7s4/net/core/pktgen.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1137 @ static ssize_t pktgen_if_write(struct fi
 			return len;
 
 		i += len;
+		if ((value > 1) &&
+		    (!(pkt_dev->odev->priv_flags & IFF_TX_SKB_SHARING)))
+			return -ENOTSUPP;
 		pkt_dev->burst = value < 1 ? 1 : value;
 		sprintf(pg_result, "OK: burst=%d", pkt_dev->burst);
 		return count;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2848 @ static struct sk_buff *fill_packet_ipv4(
 	skb->dev = odev;
 	skb->pkt_type = PACKET_HOST;
 
+	pktgen_finalize_skb(pkt_dev, skb, datalen);
+
 	if (!(pkt_dev->flags & F_UDPCSUM)) {
 		skb->ip_summed = CHECKSUM_NONE;
 	} else if (odev->features & NETIF_F_V4_CSUM) {
 		skb->ip_summed = CHECKSUM_PARTIAL;
 		skb->csum = 0;
-		udp4_hwcsum(skb, udph->source, udph->dest);
+		udp4_hwcsum(skb, iph->saddr, iph->daddr);
 	} else {
-		__wsum csum = udp_csum(skb);
+		__wsum csum = skb_checksum(skb, skb_transport_offset(skb), datalen + 8, 0);
 
 		/* add protocol-dependent pseudo-header */
-		udph->check = csum_tcpudp_magic(udph->source, udph->dest,
+		udph->check = csum_tcpudp_magic(iph->saddr, iph->daddr,
 						datalen + 8, IPPROTO_UDP, csum);
 
 		if (udph->check == 0)
 			udph->check = CSUM_MANGLED_0;
 	}
 
-	pktgen_finalize_skb(pkt_dev, skb, datalen);
-
 #ifdef CONFIG_XFRM
 	if (!process_ipsec(pkt_dev, skb, protocol))
 		return NULL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2982 @ static struct sk_buff *fill_packet_ipv6(
 	skb->dev = odev;
 	skb->pkt_type = PACKET_HOST;
 
+	pktgen_finalize_skb(pkt_dev, skb, datalen);
+
 	if (!(pkt_dev->flags & F_UDPCSUM)) {
 		skb->ip_summed = CHECKSUM_NONE;
 	} else if (odev->features & NETIF_F_V6_CSUM) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2992 @ static struct sk_buff *fill_packet_ipv6(
 		skb->csum_offset = offsetof(struct udphdr, check);
 		udph->check = ~csum_ipv6_magic(&iph->saddr, &iph->daddr, udplen, IPPROTO_UDP, 0);
 	} else {
-		__wsum csum = udp_csum(skb);
+		__wsum csum = skb_checksum(skb, skb_transport_offset(skb), udplen, 0);
 
 		/* add protocol-dependent pseudo-header */
 		udph->check = csum_ipv6_magic(&iph->saddr, &iph->daddr, udplen, IPPROTO_UDP, csum);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3001 @ static struct sk_buff *fill_packet_ipv6(
 			udph->check = CSUM_MANGLED_0;
 	}
 
-	pktgen_finalize_skb(pkt_dev, skb, datalen);
-
 	return skb;
 }
 
Index: linux-3.18.13-rt10-r7s4/net/core/rtnetlink.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/core/rtnetlink.c
+++ linux-3.18.13-rt10-r7s4/net/core/rtnetlink.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1215 @ static const struct nla_policy ifla_vfin
 };
 
 static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
-	[IFLA_VF_MAC]		= { .type = NLA_BINARY,
-				    .len = sizeof(struct ifla_vf_mac) },
-	[IFLA_VF_VLAN]		= { .type = NLA_BINARY,
-				    .len = sizeof(struct ifla_vf_vlan) },
-	[IFLA_VF_TX_RATE]	= { .type = NLA_BINARY,
-				    .len = sizeof(struct ifla_vf_tx_rate) },
-	[IFLA_VF_SPOOFCHK]	= { .type = NLA_BINARY,
-				    .len = sizeof(struct ifla_vf_spoofchk) },
-	[IFLA_VF_RATE]		= { .type = NLA_BINARY,
-				    .len = sizeof(struct ifla_vf_rate) },
-	[IFLA_VF_LINK_STATE]	= { .type = NLA_BINARY,
-				    .len = sizeof(struct ifla_vf_link_state) },
+	[IFLA_VF_MAC]		= { .len = sizeof(struct ifla_vf_mac) },
+	[IFLA_VF_VLAN]		= { .len = sizeof(struct ifla_vf_vlan) },
+	[IFLA_VF_TX_RATE]	= { .len = sizeof(struct ifla_vf_tx_rate) },
+	[IFLA_VF_SPOOFCHK]	= { .len = sizeof(struct ifla_vf_spoofchk) },
+	[IFLA_VF_RATE]		= { .len = sizeof(struct ifla_vf_rate) },
+	[IFLA_VF_LINK_STATE]	= { .len = sizeof(struct ifla_vf_link_state) },
 };
 
 static const struct nla_policy ifla_port_policy[IFLA_PORT_MAX+1] = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1252 @ static int rtnl_dump_ifinfo(struct sk_bu
 	s_h = cb->args[0];
 	s_idx = cb->args[1];
 
-	rcu_read_lock();
 	cb->seq = net->dev_base_seq;
 
 	/* A hack to preserve kernel<->userspace interface.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1273 @ static int rtnl_dump_ifinfo(struct sk_bu
 	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
 		idx = 0;
 		head = &net->dev_index_head[h];
-		hlist_for_each_entry_rcu(dev, head, index_hlist) {
+		hlist_for_each_entry(dev, head, index_hlist) {
 			if (idx < s_idx)
 				goto cont;
 			err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1295 @ cont:
 		}
 	}
 out:
-	rcu_read_unlock();
 	cb->args[1] = idx;
 	cb->args[0] = h;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2100 @ replay:
 			}
 		}
 		err = rtnl_configure_link(dev, ifm);
-		if (err < 0)
-			unregister_netdevice(dev);
+		if (err < 0) {
+			if (ops->newlink) {
+				LIST_HEAD(list_kill);
+
+				ops->dellink(dev, &list_kill);
+				unregister_netdevice_many(&list_kill);
+			} else {
+				unregister_netdevice(dev);
+			}
+		}
 out:
 		put_net(dest_net);
 		return err;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2773 @ static int rtnl_bridge_notify(struct net
 			goto errout;
 	}
 
+	if (!skb->len)
+		goto errout;
+
 	rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
 	return 0;
 errout:
 	WARN_ON(err == -EMSGSIZE);
 	kfree_skb(skb);
-	rtnl_set_sk_err(net, RTNLGRP_LINK, err);
+	if (err)
+		rtnl_set_sk_err(net, RTNLGRP_LINK, err);
 	return err;
 }
 
Index: linux-3.18.13-rt10-r7s4/net/core/skbuff.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/core/skbuff.c
+++ linux-3.18.13-rt10-r7s4/net/core/skbuff.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3518 @ struct sk_buff *sock_dequeue_err_skb(str
 {
 	struct sk_buff_head *q = &sk->sk_error_queue;
 	struct sk_buff *skb, *skb_next;
+	unsigned long flags;
 	int err = 0;
 
-	spin_lock_bh(&q->lock);
+	spin_lock_irqsave(&q->lock, flags);
 	skb = __skb_dequeue(q);
 	if (skb && (skb_next = skb_peek(q)))
 		err = SKB_EXT_ERR(skb_next)->ee.ee_errno;
-	spin_unlock_bh(&q->lock);
+	spin_unlock_irqrestore(&q->lock, flags);
 
 	sk->sk_err = err;
 	if (err)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4036 @ EXPORT_SYMBOL(skb_try_coalesce);
  */
 void skb_scrub_packet(struct sk_buff *skb, bool xnet)
 {
-	if (xnet)
-		skb_orphan(skb);
 	skb->tstamp.tv64 = 0;
 	skb->pkt_type = PACKET_HOST;
 	skb->skb_iif = 0;
 	skb->ignore_df = 0;
 	skb_dst_drop(skb);
-	skb->mark = 0;
 	secpath_reset(skb);
 	nf_reset(skb);
 	nf_reset_trace(skb);
+
+	if (!xnet)
+		return;
+
+	skb_orphan(skb);
+	skb->mark = 0;
 }
 EXPORT_SYMBOL_GPL(skb_scrub_packet);
 
Index: linux-3.18.13-rt10-r7s4/net/core/sock.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/core/sock.c
+++ linux-3.18.13-rt10-r7s4/net/core/sock.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:654 @ static inline void sock_valbool_flag(str
 		sock_reset_flag(sk, bit);
 }
 
+bool sk_mc_loop(struct sock *sk)
+{
+	if (dev_recursion_level())
+		return false;
+	if (!sk)
+		return true;
+	switch (sk->sk_family) {
+	case AF_INET:
+		return inet_sk(sk)->mc_loop;
+#if IS_ENABLED(CONFIG_IPV6)
+	case AF_INET6:
+		return inet6_sk(sk)->mc_loop;
+#endif
+	}
+	WARN_ON(1);
+	return true;
+}
+EXPORT_SYMBOL(sk_mc_loop);
+
 /*
  *	This is meant for all protocols to use and covers goings on
  *	at the socket level. Everything here is generic.
Index: linux-3.18.13-rt10-r7s4/net/core/sysctl_net_core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/core/sysctl_net_core.c
+++ linux-3.18.13-rt10-r7s4/net/core/sysctl_net_core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:28 @
 static int zero = 0;
 static int one = 1;
 static int ushort_max = USHRT_MAX;
+static int min_sndbuf = SOCK_MIN_SNDBUF;
+static int min_rcvbuf = SOCK_MIN_RCVBUF;
 
 #ifdef CONFIG_RPS
 static int rps_sock_flow_sysctl(struct ctl_table *table, int write,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:228 @ static struct ctl_table net_core_table[]
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_minmax,
-		.extra1		= &one,
+		.extra1		= &min_sndbuf,
 	},
 	{
 		.procname	= "rmem_max",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:236 @ static struct ctl_table net_core_table[]
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_minmax,
-		.extra1		= &one,
+		.extra1		= &min_rcvbuf,
 	},
 	{
 		.procname	= "wmem_default",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:244 @ static struct ctl_table net_core_table[]
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_minmax,
-		.extra1		= &one,
+		.extra1		= &min_sndbuf,
 	},
 	{
 		.procname	= "rmem_default",
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:252 @ static struct ctl_table net_core_table[]
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_minmax,
-		.extra1		= &one,
+		.extra1		= &min_rcvbuf,
 	},
 	{
 		.procname	= "dev_weight",
Index: linux-3.18.13-rt10-r7s4/net/ipv4/cipso_ipv4.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/cipso_ipv4.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/cipso_ipv4.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:379 @ static int cipso_v4_cache_check(const un
  * negative values on failure.
  *
  */
-int cipso_v4_cache_add(const struct sk_buff *skb,
+int cipso_v4_cache_add(const unsigned char *cipso_ptr,
 		       const struct netlbl_lsm_secattr *secattr)
 {
 	int ret_val = -EPERM;
 	u32 bkt;
 	struct cipso_v4_map_cache_entry *entry = NULL;
 	struct cipso_v4_map_cache_entry *old_entry = NULL;
-	unsigned char *cipso_ptr;
 	u32 cipso_ptr_len;
 
 	if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0)
 		return 0;
 
-	cipso_ptr = CIPSO_V4_OPTPTR(skb);
 	cipso_ptr_len = cipso_ptr[1];
 
 	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1578 @ static int cipso_v4_parsetag_loc(const s
 }
 
 /**
+ * cipso_v4_optptr - Find the CIPSO option in the packet
+ * @skb: the packet
+ *
+ * Description:
+ * Parse the packet's IP header looking for a CIPSO option.  Returns a pointer
+ * to the start of the CIPSO option on success, NULL if one if not found.
+ *
+ */
+unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
+{
+	const struct iphdr *iph = ip_hdr(skb);
+	unsigned char *optptr = (unsigned char *)&(ip_hdr(skb)[1]);
+	int optlen;
+	int taglen;
+
+	for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
+		if (optptr[0] == IPOPT_CIPSO)
+			return optptr;
+		taglen = optptr[1];
+		optlen -= taglen;
+		optptr += taglen;
+	}
+
+	return NULL;
+}
+
+/**
  * cipso_v4_validate - Validate a CIPSO option
  * @option: the start of the option, on error it is set to point to the error
  *
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2145 @ void cipso_v4_req_delattr(struct request
  * on success and negative values on failure.
  *
  */
-static int cipso_v4_getattr(const unsigned char *cipso,
-			    struct netlbl_lsm_secattr *secattr)
+int cipso_v4_getattr(const unsigned char *cipso,
+		     struct netlbl_lsm_secattr *secattr)
 {
 	int ret_val = -ENOMSG;
 	u32 doi;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2331 @ int cipso_v4_skbuff_delattr(struct sk_bu
 	return 0;
 }
 
-/**
- * cipso_v4_skbuff_getattr - Get the security attributes from the CIPSO option
- * @skb: the packet
- * @secattr: the security attributes
- *
- * Description:
- * Parse the given packet's CIPSO option and return the security attributes.
- * Returns zero on success and negative values on failure.
- *
- */
-int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
-			    struct netlbl_lsm_secattr *secattr)
-{
-	return cipso_v4_getattr(CIPSO_V4_OPTPTR(skb), secattr);
-}
-
 /*
  * Setup Functions
  */
Index: linux-3.18.13-rt10-r7s4/net/ipv4/geneve.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/geneve.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/geneve.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:124 @ int geneve_xmit_skb(struct geneve_sock *
 	int min_headroom;
 	int err;
 
-	skb = udp_tunnel_handle_offloads(skb, !gs->sock->sk->sk_no_check_tx);
-
 	min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len
 			+ GENEVE_BASE_HLEN + opt_len + sizeof(struct iphdr)
 			+ (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:132 @ int geneve_xmit_skb(struct geneve_sock *
 	if (unlikely(err))
 		return err;
 
-	if (vlan_tx_tag_present(skb)) {
-		if (unlikely(!__vlan_put_tag(skb,
-					     skb->vlan_proto,
-					     vlan_tx_tag_get(skb)))) {
-			err = -ENOMEM;
-			return err;
-		}
-		skb->vlan_tci = 0;
-	}
+	skb = vlan_hwaccel_push_inside(skb);
+	if (unlikely(!skb))
+		return -ENOMEM;
+
+	skb = udp_tunnel_handle_offloads(skb, !gs->sock->sk->sk_no_check_tx);
+	if (IS_ERR(skb))
+		return PTR_ERR(skb);
 
 	gnvh = (struct genevehdr *)__skb_push(skb, sizeof(*gnvh) + opt_len);
 	geneve_build_header(gnvh, tun_flags, vni, opt_len, opt);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:164 @ static void geneve_notify_add_rx_port(st
 	}
 }
 
+static void geneve_notify_del_rx_port(struct geneve_sock *gs)
+{
+	struct sock *sk = gs->sock->sk;
+	sa_family_t sa_family = sk->sk_family;
+
+	if (sa_family == AF_INET)
+		udp_del_offload(&gs->udp_offloads);
+}
+
 /* Callback from net/ipv4/udp.c to receive packets */
 static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:301 @ struct geneve_sock *geneve_sock_add(stru
 				    geneve_rcv_t *rcv, void *data,
 				    bool no_share, bool ipv6)
 {
+	struct geneve_net *gn = net_generic(net, geneve_net_id);
 	struct geneve_sock *gs;
 
 	gs = geneve_socket_create(net, port, rcv, data, ipv6);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:311 @ struct geneve_sock *geneve_sock_add(stru
 	if (no_share)	/* Return error if sharing is not allowed. */
 		return ERR_PTR(-EINVAL);
 
+	spin_lock(&gn->sock_lock);
 	gs = geneve_find_sock(net, port);
-	if (gs) {
-		if (gs->rcv == rcv)
-			atomic_inc(&gs->refcnt);
-		else
+	if (gs && ((gs->rcv != rcv) ||
+		   !atomic_add_unless(&gs->refcnt, 1, 0)))
 			gs = ERR_PTR(-EBUSY);
-	} else {
+	spin_unlock(&gn->sock_lock);
+
+	if (!gs)
 		gs = ERR_PTR(-EINVAL);
-	}
 
 	return gs;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:327 @ EXPORT_SYMBOL_GPL(geneve_sock_add);
 
 void geneve_sock_release(struct geneve_sock *gs)
 {
+	struct net *net = sock_net(gs->sock->sk);
+	struct geneve_net *gn = net_generic(net, geneve_net_id);
+
 	if (!atomic_dec_and_test(&gs->refcnt))
 		return;
 
+	spin_lock(&gn->sock_lock);
+	hlist_del_rcu(&gs->hlist);
+	geneve_notify_del_rx_port(gs);
+	spin_unlock(&gn->sock_lock);
+
 	queue_work(geneve_wq, &gs->del_work);
 }
 EXPORT_SYMBOL_GPL(geneve_sock_release);
Index: linux-3.18.13-rt10-r7s4/net/ipv4/gre_offload.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/gre_offload.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/gre_offload.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:250 @ static int gre_gro_complete(struct sk_bu
 		err = ptype->callbacks.gro_complete(skb, nhoff + grehlen);
 
 	rcu_read_unlock();
+
+	skb_set_inner_mac_header(skb, nhoff + grehlen);
+
 	return err;
 }
 
Index: linux-3.18.13-rt10-r7s4/net/ipv4/inet_diag.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/inet_diag.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/inet_diag.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:74 @ static inline void inet_diag_unlock_hand
 	mutex_unlock(&inet_diag_table_mutex);
 }
 
+static size_t inet_sk_attr_size(void)
+{
+	return	  nla_total_size(sizeof(struct tcp_info))
+		+ nla_total_size(1) /* INET_DIAG_SHUTDOWN */
+		+ nla_total_size(1) /* INET_DIAG_TOS */
+		+ nla_total_size(1) /* INET_DIAG_TCLASS */
+		+ nla_total_size(sizeof(struct inet_diag_meminfo))
+		+ nla_total_size(sizeof(struct inet_diag_msg))
+		+ nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
+		+ nla_total_size(TCP_CA_NAME_MAX)
+		+ nla_total_size(sizeof(struct tcpvegas_info))
+		+ 64;
+}
+
 int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
 			      struct sk_buff *skb, struct inet_diag_req_v2 *req,
 			      struct user_namespace *user_ns,		      	
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:341 @ int inet_diag_dump_one_icsk(struct inet_
 	if (err)
 		goto out;
 
-	rep = nlmsg_new(sizeof(struct inet_diag_msg) +
-			sizeof(struct inet_diag_meminfo) +
-			sizeof(struct tcp_info) + 64, GFP_KERNEL);
+	rep = nlmsg_new(inet_sk_attr_size(), GFP_KERNEL);
 	if (!rep) {
 		err = -ENOMEM;
 		goto out;
Index: linux-3.18.13-rt10-r7s4/net/ipv4/ip_forward.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/ip_forward.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/ip_forward.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:132 @ int ip_forward(struct sk_buff *skb)
 	 *	We now generate an ICMP HOST REDIRECT giving the route
 	 *	we calculated.
 	 */
-	if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb_sec_path(skb))
+	if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr &&
+	    !skb_sec_path(skb))
 		ip_rt_send_redirect(skb);
 
 	skb->priority = rt_tos2priority(iph->tos);
Index: linux-3.18.13-rt10-r7s4/net/ipv4/ip_fragment.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/ip_fragment.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/ip_fragment.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:663 @ EXPORT_SYMBOL(ip_defrag);
 struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
 {
 	struct iphdr iph;
+	int netoff;
 	u32 len;
 
 	if (skb->protocol != htons(ETH_P_IP))
 		return skb;
 
-	if (!skb_copy_bits(skb, 0, &iph, sizeof(iph)))
+	netoff = skb_network_offset(skb);
+
+	if (skb_copy_bits(skb, netoff, &iph, sizeof(iph)) < 0)
 		return skb;
 
 	if (iph.ihl < 5 || iph.version != 4)
 		return skb;
 
 	len = ntohs(iph.tot_len);
-	if (skb->len < len || len < (iph.ihl * 4))
+	if (skb->len < netoff + len || len < (iph.ihl * 4))
 		return skb;
 
 	if (ip_is_fragment(&iph)) {
 		skb = skb_share_check(skb, GFP_ATOMIC);
 		if (skb) {
-			if (!pskb_may_pull(skb, iph.ihl*4))
+			if (!pskb_may_pull(skb, netoff + iph.ihl * 4))
 				return skb;
-			if (pskb_trim_rcsum(skb, len))
+			if (pskb_trim_rcsum(skb, netoff + len))
 				return skb;
 			memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
 			if (ip_defrag(skb, user))
Index: linux-3.18.13-rt10-r7s4/net/ipv4/ip_gre.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/ip_gre.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/ip_gre.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:255 @ static netdev_tx_t ipgre_xmit(struct sk_
 	struct ip_tunnel *tunnel = netdev_priv(dev);
 	const struct iphdr *tnl_params;
 
-	skb = gre_handle_offloads(skb, !!(tunnel->parms.o_flags&TUNNEL_CSUM));
-	if (IS_ERR(skb))
-		goto out;
-
 	if (dev->header_ops) {
 		/* Need space for new headers */
 		if (skb_cow_head(skb, dev->needed_headroom -
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:267 @ static netdev_tx_t ipgre_xmit(struct sk_
 		 * to gre header.
 		 */
 		skb_pull(skb, tunnel->hlen + sizeof(struct iphdr));
+		skb_reset_mac_header(skb);
 	} else {
 		if (skb_cow_head(skb, dev->needed_headroom))
 			goto free_skb;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:275 @ static netdev_tx_t ipgre_xmit(struct sk_
 		tnl_params = &tunnel->parms.iph;
 	}
 
+	skb = gre_handle_offloads(skb, !!(tunnel->parms.o_flags&TUNNEL_CSUM));
+	if (IS_ERR(skb))
+		goto out;
+
 	__gre_xmit(skb, dev, tnl_params, skb->protocol);
 
 	return NETDEV_TX_OK;
Index: linux-3.18.13-rt10-r7s4/net/ipv4/ip_output.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/ip_output.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/ip_output.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:893 @ static int __ip_append_data(struct sock
 	cork->length += length;
 	if (((length > mtu) || (skb && skb_is_gso(skb))) &&
 	    (sk->sk_protocol == IPPROTO_UDP) &&
-	    (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
+	    (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+	    (sk->sk_type == SOCK_DGRAM)) {
 		err = ip_ufo_append_data(sk, queue, getfrag, from, length,
 					 hh_len, fragheaderlen, transhdrlen,
 					 maxfraglen, flags);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1510 @ static int ip_reply_glue_bits(void *dptr
 /*
  *	Generic function to send a packet as reply to another packet.
  *	Used to send some TCP resets/acks so far.
- *
- *	Use a fake percpu inet socket to avoid false sharing and contention.
  */
-static DEFINE_PER_CPU(struct inet_sock, unicast_sock) = {
-	.sk = {
-		.__sk_common = {
-			.skc_refcnt = ATOMIC_INIT(1),
-		},
-		.sk_wmem_alloc	= ATOMIC_INIT(1),
-		.sk_allocation	= GFP_ATOMIC,
-		.sk_flags	= (1UL << SOCK_USE_WRITE_QUEUE),
-	},
-	.pmtudisc	= IP_PMTUDISC_WANT,
-	.uc_ttl		= -1,
-};
-
-void ip_send_unicast_reply(struct net *net, struct sk_buff *skb,
+void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
 			   const struct ip_options *sopt,
 			   __be32 daddr, __be32 saddr,
 			   const struct ip_reply_arg *arg,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1521 @ void ip_send_unicast_reply(struct net *n
 	struct ipcm_cookie ipc;
 	struct flowi4 fl4;
 	struct rtable *rt = skb_rtable(skb);
+	struct net *net = sock_net(sk);
 	struct sk_buff *nskb;
-	struct sock *sk;
-	struct inet_sock *inet;
 	int err;
 
 	if (__ip_options_echo(&replyopts.opt.opt, skb, sopt))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1553 @ void ip_send_unicast_reply(struct net *n
 	if (IS_ERR(rt))
 		return;
 
-	inet = &get_cpu_var(unicast_sock);
+	inet_sk(sk)->tos = arg->tos;
 
-	inet->tos = arg->tos;
-	sk = &inet->sk;
 	sk->sk_priority = skb->priority;
 	sk->sk_protocol = ip_hdr(skb)->protocol;
 	sk->sk_bound_dev_if = arg->bound_dev_if;
-	sock_net_set(sk, net);
-	__skb_queue_head_init(&sk->sk_write_queue);
 	sk->sk_sndbuf = sysctl_wmem_default;
 	err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base,
 			     len, 0, &ipc, &rt, MSG_DONTWAIT);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1573 @ void ip_send_unicast_reply(struct net *n
 			  arg->csumoffset) = csum_fold(csum_add(nskb->csum,
 								arg->csum));
 		nskb->ip_summed = CHECKSUM_NONE;
-		skb_orphan(nskb);
 		skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb));
 		ip_push_pending_frames(sk, &fl4);
 	}
 out:
-	put_cpu_var(unicast_sock);
-
 	ip_rt_put(rt);
 }
 
Index: linux-3.18.13-rt10-r7s4/net/ipv4/ip_sockglue.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/ip_sockglue.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/ip_sockglue.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:446 @ int ip_recv_error(struct sock *sk, struc
 
 	memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
 	sin = &errhdr.offender;
-	sin->sin_family = AF_UNSPEC;
+	memset(sin, 0, sizeof(*sin));
 	if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP) {
-		struct inet_sock *inet = inet_sk(sk);
-
 		sin->sin_family = AF_INET;
 		sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
-		sin->sin_port = 0;
-		memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
-		if (inet->cmsg_flags)
+		if (inet_sk(sk)->cmsg_flags)
 			ip_cmsg_recv(msg, skb);
 	}
 
Index: linux-3.18.13-rt10-r7s4/net/ipv4/ping.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/ping.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/ping.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:262 @ int ping_init_sock(struct sock *sk)
 	kgid_t low, high;
 	int ret = 0;
 
+	if (sk->sk_family == AF_INET6)
+		sk->sk_ipv6only = 1;
+
 	inet_get_ping_group_range_net(net, &low, &high);
 	if (gid_lte(low, group) && gid_lte(group, high))
 		return 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:311 @ static int ping_check_bind_addr(struct s
 		if (addr_len < sizeof(*addr))
 			return -EINVAL;
 
+		if (addr->sin_family != AF_INET &&
+		    !(addr->sin_family == AF_UNSPEC &&
+		      addr->sin_addr.s_addr == htonl(INADDR_ANY)))
+			return -EAFNOSUPPORT;
+
 		pr_debug("ping_check_bind_addr(sk=%p,addr=%pI4,port=%d)\n",
 			 sk, &addr->sin_addr.s_addr, ntohs(addr->sin_port));
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:341 @ static int ping_check_bind_addr(struct s
 			return -EINVAL;
 
 		if (addr->sin6_family != AF_INET6)
-			return -EINVAL;
+			return -EAFNOSUPPORT;
 
 		pr_debug("ping_check_bind_addr(sk=%p,addr=%pI6c,port=%d)\n",
 			 sk, addr->sin6_addr.s6_addr, ntohs(addr->sin6_port));
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:727 @ static int ping_v4_sendmsg(struct kiocb
 		if (msg->msg_namelen < sizeof(*usin))
 			return -EINVAL;
 		if (usin->sin_family != AF_INET)
-			return -EINVAL;
+			return -EAFNOSUPPORT;
 		daddr = usin->sin_addr.s_addr;
 		/* no remote port */
 	} else {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:976 @ void ping_rcv(struct sk_buff *skb)
 
 	sk = ping_lookup(net, skb, ntohs(icmph->un.echo.id));
 	if (sk != NULL) {
+		struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
+
 		pr_debug("rcv on socket %p\n", sk);
-		ping_queue_rcv_skb(sk, skb_get(skb));
+		if (skb2)
+			ping_queue_rcv_skb(sk, skb2);
 		sock_put(sk);
 		return;
 	}
Index: linux-3.18.13-rt10-r7s4/net/ipv4/route.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/route.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/route.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1557 @ static int __mkroute_input(struct sk_buf
 
 	do_cache = res->fi && !itag;
 	if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
+	    skb->protocol == htons(ETH_P_IP) &&
 	    (IN_DEV_SHARED_MEDIA(out_dev) ||
-	     inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) {
-		flags |= RTCF_DOREDIRECT;
-		do_cache = false;
-	}
+	     inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
+		IPCB(skb)->flags |= IPSKB_DOREDIRECT;
 
 	if (skb->protocol != htons(ETH_P_IP)) {
 		/* Not IP (i.e. ARP). Do not create route, if it is
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2305 @ static int rt_fill_info(struct net *net,
 	r->rtm_flags	= (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
 	if (rt->rt_flags & RTCF_NOTIFY)
 		r->rtm_flags |= RTM_F_NOTIFY;
+	if (IPCB(skb)->flags & IPSKB_DOREDIRECT)
+		r->rtm_flags |= RTCF_DOREDIRECT;
 
 	if (nla_put_be32(skb, RTA_DST, dst))
 		goto nla_put_failure;
Index: linux-3.18.13-rt10-r7s4/net/ipv4/tcp_fastopen.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/tcp_fastopen.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/tcp_fastopen.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:137 @ static bool tcp_fastopen_create_child(st
 	struct tcp_sock *tp;
 	struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
 	struct sock *child;
+	u32 end_seq;
 
 	req->num_retrans = 0;
 	req->num_timeout = 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:189 @ static bool tcp_fastopen_create_child(st
 
 	/* Queue the data carried in the SYN packet. We need to first
 	 * bump skb's refcnt because the caller will attempt to free it.
+	 * Note that IPv6 might also have used skb_get() trick
+	 * in tcp_v6_conn_request() to keep this SYN around (treq->pktopts)
+	 * So we need to eventually get a clone of the packet,
+	 * before inserting it in sk_receive_queue.
 	 *
 	 * XXX (TFO) - we honor a zero-payload TFO request for now,
 	 * (any reason not to?) but no need to queue the skb since
 	 * there is no data. How about SYN+FIN?
 	 */
-	if (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1) {
-		skb = skb_get(skb);
-		skb_dst_drop(skb);
-		__skb_pull(skb, tcp_hdr(skb)->doff * 4);
-		skb_set_owner_r(skb, child);
-		__skb_queue_tail(&child->sk_receive_queue, skb);
-		tp->syn_data_acked = 1;
+	end_seq = TCP_SKB_CB(skb)->end_seq;
+	if (end_seq != TCP_SKB_CB(skb)->seq + 1) {
+		struct sk_buff *skb2;
+
+		if (unlikely(skb_shared(skb)))
+			skb2 = skb_clone(skb, GFP_ATOMIC);
+		else
+			skb2 = skb_get(skb);
+
+		if (likely(skb2)) {
+			skb_dst_drop(skb2);
+			__skb_pull(skb2, tcp_hdrlen(skb));
+			skb_set_owner_r(skb2, child);
+			__skb_queue_tail(&child->sk_receive_queue, skb2);
+			tp->syn_data_acked = 1;
+		} else {
+			end_seq = TCP_SKB_CB(skb)->seq + 1;
+		}
 	}
-	tcp_rsk(req)->rcv_nxt = tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
+	tcp_rsk(req)->rcv_nxt = tp->rcv_nxt = end_seq;
 	sk->sk_data_ready(sk);
 	bh_unlock_sock(child);
 	sock_put(child);
Index: linux-3.18.13-rt10-r7s4/net/ipv4/tcp_input.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/tcp_input.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/tcp_input.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3106 @ static int tcp_clean_rtx_queue(struct so
 			if (!first_ackt.v64)
 				first_ackt = last_ackt;
 
-			if (!(sacked & TCPCB_SACKED_ACKED))
+			if (!(sacked & TCPCB_SACKED_ACKED)) {
 				reord = min(pkts_acked, reord);
-			if (!after(scb->end_seq, tp->high_seq))
-				flag |= FLAG_ORIG_SACK_ACKED;
+				if (!after(scb->end_seq, tp->high_seq))
+					flag |= FLAG_ORIG_SACK_ACKED;
+			}
 		}
 
 		if (sacked & TCPCB_SACKED_ACKED)
Index: linux-3.18.13-rt10-r7s4/net/ipv4/tcp_ipv4.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/tcp_ipv4.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/tcp_ipv4.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:626 @ static void tcp_v4_send_reset(struct soc
 	arg.iov[0].iov_base = (unsigned char *)&rep;
 	arg.iov[0].iov_len  = sizeof(rep.th);
 
+	net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 #ifdef CONFIG_TCP_MD5SIG
 	hash_location = tcp_parse_md5sig_option(th);
 	if (!sk && hash_location) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:637 @ static void tcp_v4_send_reset(struct soc
 		 * Incoming packet is checked with md5 hash with finding key,
 		 * no RST generated if md5 hash doesn't match.
 		 */
-		sk1 = __inet_lookup_listener(dev_net(skb_dst(skb)->dev),
+		sk1 = __inet_lookup_listener(net,
 					     &tcp_hashinfo, ip_hdr(skb)->saddr,
 					     th->source, ip_hdr(skb)->daddr,
 					     ntohs(th->source), inet_iif(skb));
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:685 @ static void tcp_v4_send_reset(struct soc
 	if (sk)
 		arg.bound_dev_if = sk->sk_bound_dev_if;
 
-	net = dev_net(skb_dst(skb)->dev);
 	arg.tos = ip_hdr(skb)->tos;
-	ip_send_unicast_reply(net, skb, &TCP_SKB_CB(skb)->header.h4.opt,
+	ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
+			      skb, &TCP_SKB_CB(skb)->header.h4.opt,
 			      ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
 			      &arg, arg.iov[0].iov_len);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:771 @ static void tcp_v4_send_ack(struct sk_bu
 	if (oif)
 		arg.bound_dev_if = oif;
 	arg.tos = tos;
-	ip_send_unicast_reply(net, skb, &TCP_SKB_CB(skb)->header.h4.opt,
+	ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
+			      skb, &TCP_SKB_CB(skb)->header.h4.opt,
 			      ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
 			      &arg, arg.iov[0].iov_len);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1517 @ void tcp_v4_early_demux(struct sk_buff *
 		skb->sk = sk;
 		skb->destructor = sock_edemux;
 		if (sk->sk_state != TCP_TIME_WAIT) {
-			struct dst_entry *dst = sk->sk_rx_dst;
+			struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
 
 			if (dst)
 				dst = dst_check(dst, 0);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2431 @ struct proto tcp_prot = {
 };
 EXPORT_SYMBOL(tcp_prot);
 
+static void __net_exit tcp_sk_exit(struct net *net)
+{
+	int cpu;
+
+	for_each_possible_cpu(cpu)
+		inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.tcp_sk, cpu));
+	free_percpu(net->ipv4.tcp_sk);
+}
+
 static int __net_init tcp_sk_init(struct net *net)
 {
+	int res, cpu;
+
+	net->ipv4.tcp_sk = alloc_percpu(struct sock *);
+	if (!net->ipv4.tcp_sk)
+		return -ENOMEM;
+
+	for_each_possible_cpu(cpu) {
+		struct sock *sk;
+
+		res = inet_ctl_sock_create(&sk, PF_INET, SOCK_RAW,
+					   IPPROTO_TCP, net);
+		if (res)
+			goto fail;
+		*per_cpu_ptr(net->ipv4.tcp_sk, cpu) = sk;
+	}
 	net->ipv4.sysctl_tcp_ecn = 2;
 	return 0;
-}
 
-static void __net_exit tcp_sk_exit(struct net *net)
-{
+fail:
+	tcp_sk_exit(net);
+
+	return res;
 }
 
 static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
Index: linux-3.18.13-rt10-r7s4/net/ipv4/tcp_output.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/tcp_output.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/tcp_output.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1987 @ static bool tcp_write_xmit(struct sock *
 		if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
 			break;
 
-		if (tso_segs == 1) {
+		if (tso_segs == 1 || !sk->sk_gso_max_segs) {
 			if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
 						     (tcp_skb_is_last(sk, skb) ?
 						      nonagle : TCP_NAGLE_PUSH))))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2023 @ static bool tcp_write_xmit(struct sock *
 		}
 
 		limit = mss_now;
-		if (tso_segs > 1 && !tcp_urg_mode(tp))
+		if (tso_segs > 1 && sk->sk_gso_max_segs && !tcp_urg_mode(tp))
 			limit = tcp_mss_split_point(sk, skb, mss_now,
 						    min_t(unsigned int,
 							  cwnd_quota,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2742 @ void tcp_send_fin(struct sock *sk)
 	} else {
 		/* Socket is locked, keep trying until memory is available. */
 		for (;;) {
-			skb = alloc_skb_fclone(MAX_TCP_HEADER,
-					       sk->sk_allocation);
+			skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
 			if (skb)
 				break;
 			yield();
 		}
-
-		/* Reserve space for headers and prepare control bits. */
-		skb_reserve(skb, MAX_TCP_HEADER);
 		/* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
 		tcp_init_nondata_skb(skb, tp->write_seq,
 				     TCPHDR_ACK | TCPHDR_FIN);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2898 @ struct sk_buff *tcp_make_synack(struct s
 	}
 #endif
 
+	/* Do not fool tcpdump (if any), clean our debris */
+	skb->tstamp.tv64 = 0;
 	return skb;
 }
 EXPORT_SYMBOL(tcp_make_synack);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2999 @ static int tcp_send_syn_data(struct sock
 {
 	struct tcp_sock *tp = tcp_sk(sk);
 	struct tcp_fastopen_request *fo = tp->fastopen_req;
-	int syn_loss = 0, space, i, err = 0, iovlen = fo->data->msg_iovlen;
-	struct sk_buff *syn_data = NULL, *data;
+	int syn_loss = 0, space, err = 0;
 	unsigned long last_syn_loss = 0;
+	struct sk_buff *syn_data;
 
 	tp->rx_opt.mss_clamp = tp->advmss;  /* If MSS is not cached */
 	tcp_fastopen_cache_get(sk, &tp->rx_opt.mss_clamp, &fo->cookie,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3032 @ static int tcp_send_syn_data(struct sock
 	/* limit to order-0 allocations */
 	space = min_t(size_t, space, SKB_MAX_HEAD(MAX_TCP_HEADER));
 
-	syn_data = skb_copy_expand(syn, MAX_TCP_HEADER, space,
-				   sk->sk_allocation);
-	if (syn_data == NULL)
+	syn_data = sk_stream_alloc_skb(sk, space, sk->sk_allocation);
+	if (!syn_data)
 		goto fallback;
-
-	for (i = 0; i < iovlen && syn_data->len < space; ++i) {
-		struct iovec *iov = &fo->data->msg_iov[i];
-		unsigned char __user *from = iov->iov_base;
-		int len = iov->iov_len;
-
-		if (syn_data->len + len > space)
-			len = space - syn_data->len;
-		else if (i + 1 == iovlen)
-			/* No more data pending in inet_wait_for_connect() */
-			fo->data = NULL;
-
-		if (skb_add_data(syn_data, from, len))
-			goto fallback;
-	}
-
-	/* Queue a data-only packet after the regular SYN for retransmission */
-	data = pskb_copy(syn_data, sk->sk_allocation);
-	if (data == NULL)
+	syn_data->ip_summed = CHECKSUM_PARTIAL;
+	memcpy(syn_data->cb, syn->cb, sizeof(syn->cb));
+	if (unlikely(memcpy_fromiovecend(skb_put(syn_data, space),
+					 fo->data->msg_iov, 0, space))) {
+		kfree_skb(syn_data);
 		goto fallback;
-	TCP_SKB_CB(data)->seq++;
-	TCP_SKB_CB(data)->tcp_flags &= ~TCPHDR_SYN;
-	TCP_SKB_CB(data)->tcp_flags = (TCPHDR_ACK|TCPHDR_PSH);
-	tcp_connect_queue_skb(sk, data);
-	fo->copied = data->len;
+	}
 
-	/* syn_data is about to be sent, we need to take current time stamps
-	 * for the packets that are in write queue : SYN packet and DATA
-	 */
-	skb_mstamp_get(&syn->skb_mstamp);
-	data->skb_mstamp = syn->skb_mstamp;
+	/* No more data pending in inet_wait_for_connect() */
+	if (space == fo->size)
+		fo->data = NULL;
+	fo->copied = space;
+
+	tcp_connect_queue_skb(sk, syn_data);
 
-	if (tcp_transmit_skb(sk, syn_data, 0, sk->sk_allocation) == 0) {
+	err = tcp_transmit_skb(sk, syn_data, 1, sk->sk_allocation);
+
+	syn->skb_mstamp = syn_data->skb_mstamp;
+
+	/* Now full SYN+DATA was cloned and sent (or not),
+	 * remove the SYN from the original skb (syn_data)
+	 * we keep in write queue in case of a retransmit, as we
+	 * also have the SYN packet (with no data) in the same queue.
+	 */
+	TCP_SKB_CB(syn_data)->seq++;
+	TCP_SKB_CB(syn_data)->tcp_flags = TCPHDR_ACK | TCPHDR_PSH;
+	if (!err) {
 		tp->syn_data = (fo->copied > 0);
 		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT);
 		goto done;
 	}
-	syn_data = NULL;
 
 fallback:
 	/* Send a regular SYN with Fast Open cookie request option */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3074 @ fallback:
 	err = tcp_transmit_skb(sk, syn, 1, sk->sk_allocation);
 	if (err)
 		tp->syn_fastopen = 0;
-	kfree_skb(syn_data);
 done:
 	fo->cookie.len = -1;  /* Exclude Fast Open option for SYN retries */
 	return err;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3093 @ int tcp_connect(struct sock *sk)
 		return 0;
 	}
 
-	buff = alloc_skb_fclone(MAX_TCP_HEADER + 15, sk->sk_allocation);
-	if (unlikely(buff == NULL))
+	buff = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
+	if (unlikely(!buff))
 		return -ENOBUFS;
 
-	/* Reserve space for headers. */
-	skb_reserve(buff, MAX_TCP_HEADER);
-
 	tcp_init_nondata_skb(buff, tp->write_seq++, TCPHDR_SYN);
 	tp->retrans_stamp = tcp_time_stamp;
 	tcp_connect_queue_skb(sk, buff);
Index: linux-3.18.13-rt10-r7s4/net/ipv4/udp_diag.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv4/udp_diag.c
+++ linux-3.18.13-rt10-r7s4/net/ipv4/udp_diag.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:102 @ static void udp_dump(struct udp_table *t
 	s_slot = cb->args[0];
 	num = s_num = cb->args[1];
 
-	for (slot = s_slot; slot <= table->mask; num = s_num = 0, slot++) {
+	for (slot = s_slot; slot <= table->mask; s_num = 0, slot++) {
 		struct sock *sk;
 		struct hlist_nulls_node *node;
 		struct udp_hslot *hslot = &table->hash[slot];
 
+		num = 0;
+
 		if (hlist_nulls_empty(&hslot->head))
 			continue;
 
Index: linux-3.18.13-rt10-r7s4/net/ipv6/addrconf.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv6/addrconf.c
+++ linux-3.18.13-rt10-r7s4/net/ipv6/addrconf.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4539 @ static int inet6_set_iftoken(struct inet
 	return 0;
 }
 
+static const struct nla_policy inet6_af_policy[IFLA_INET6_MAX + 1] = {
+	[IFLA_INET6_ADDR_GEN_MODE]	= { .type = NLA_U8 },
+	[IFLA_INET6_TOKEN]		= { .len = sizeof(struct in6_addr) },
+};
+
+static int inet6_validate_link_af(const struct net_device *dev,
+				  const struct nlattr *nla)
+{
+	struct nlattr *tb[IFLA_INET6_MAX + 1];
+
+	if (dev && !__in6_dev_get(dev))
+		return -EAFNOSUPPORT;
+
+	return nla_parse_nested(tb, IFLA_INET6_MAX, nla, inet6_af_policy);
+}
+
 static int inet6_set_link_af(struct net_device *dev, const struct nlattr *nla)
 {
 	int err = -EINVAL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5370 @ static struct rtnl_af_ops inet6_ops = {
 	.family		  = AF_INET6,
 	.fill_link_af	  = inet6_fill_link_af,
 	.get_link_af_size = inet6_get_link_af_size,
+	.validate_link_af = inet6_validate_link_af,
 	.set_link_af	  = inet6_set_link_af,
 };
 
Index: linux-3.18.13-rt10-r7s4/net/ipv6/datagram.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv6/datagram.c
+++ linux-3.18.13-rt10-r7s4/net/ipv6/datagram.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:386 @ int ipv6_recv_error(struct sock *sk, str
 
 	memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
 	sin = &errhdr.offender;
-	sin->sin6_family = AF_UNSPEC;
+	memset(sin, 0, sizeof(*sin));
+
 	if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {
 		sin->sin6_family = AF_INET6;
-		sin->sin6_flowinfo = 0;
-		sin->sin6_port = 0;
 		if (np->rxopt.all)
 			ip6_datagram_recv_common_ctl(sk, msg, skb);
 		if (skb->protocol == htons(ETH_P_IPV6)) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:400 @ int ipv6_recv_error(struct sock *sk, str
 				ipv6_iface_scope_id(&sin->sin6_addr,
 						    IP6CB(skb)->iif);
 		} else {
-			struct inet_sock *inet = inet_sk(sk);
-
 			ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
 					       &sin->sin6_addr);
-			sin->sin6_scope_id = 0;
-			if (inet->cmsg_flags)
+			if (inet_sk(sk)->cmsg_flags)
 				ip_cmsg_recv(msg, skb);
 		}
 	}
Index: linux-3.18.13-rt10-r7s4/net/ipv6/fib6_rules.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv6/fib6_rules.c
+++ linux-3.18.13-rt10-r7s4/net/ipv6/fib6_rules.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:107 @ static int fib6_rule_action(struct fib_r
 				goto again;
 			flp6->saddr = saddr;
 		}
+		err = rt->dst.error;
 		goto out;
 	}
 again:
Index: linux-3.18.13-rt10-r7s4/net/ipv6/ip6_fib.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv6/ip6_fib.c
+++ linux-3.18.13-rt10-r7s4/net/ipv6/ip6_fib.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:662 @ static int fib6_commit_metrics(struct ds
 	return 0;
 }
 
+static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn,
+			  struct net *net)
+{
+	if (atomic_read(&rt->rt6i_ref) != 1) {
+		/* This route is used as dummy address holder in some split
+		 * nodes. It is not leaked, but it still holds other resources,
+		 * which must be released in time. So, scan ascendant nodes
+		 * and replace dummy references to this route with references
+		 * to still alive ones.
+		 */
+		while (fn) {
+			if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
+				fn->leaf = fib6_find_prefix(net, fn);
+				atomic_inc(&fn->leaf->rt6i_ref);
+				rt6_release(rt);
+			}
+			fn = fn->parent;
+		}
+		/* No more references are possible at this point. */
+		BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
+	}
+}
+
 /*
  *	Insert routing information in a node.
  */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:833 @ add:
 		rt->dst.rt6_next = iter->dst.rt6_next;
 		atomic_inc(&rt->rt6i_ref);
 		inet6_rt_notify(RTM_NEWROUTE, rt, info);
-		rt6_release(iter);
 		if (!(fn->fn_flags & RTN_RTINFO)) {
 			info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
 			fn->fn_flags |= RTN_RTINFO;
 		}
+		fib6_purge_rt(iter, fn, info->nl_net);
+		rt6_release(iter);
 	}
 
 	return 0;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1349 @ static void fib6_del_route(struct fib6_n
 		fn = fib6_repair_tree(net, fn);
 	}
 
-	if (atomic_read(&rt->rt6i_ref) != 1) {
-		/* This route is used as dummy address holder in some split
-		 * nodes. It is not leaked, but it still holds other resources,
-		 * which must be released in time. So, scan ascendant nodes
-		 * and replace dummy references to this route with references
-		 * to still alive ones.
-		 */
-		while (fn) {
-			if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
-				fn->leaf = fib6_find_prefix(net, fn);
-				atomic_inc(&fn->leaf->rt6i_ref);
-				rt6_release(rt);
-			}
-			fn = fn->parent;
-		}
-		/* No more references are possible at this point. */
-		BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
-	}
+	fib6_purge_rt(rt, fn, net);
 
 	inet6_rt_notify(RTM_DELROUTE, rt, info);
 	rt6_release(rt);
Index: linux-3.18.13-rt10-r7s4/net/ipv6/ip6_output.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv6/ip6_output.c
+++ linux-3.18.13-rt10-r7s4/net/ipv6/ip6_output.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:558 @ int ip6_fragment(struct sk_buff *skb, in
 {
 	struct sk_buff *frag;
 	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
-	struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
+	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
+				inet6_sk(skb->sk) : NULL;
 	struct ipv6hdr *tmp_hdr;
 	struct frag_hdr *fh;
 	unsigned int mtu, hlen, left, len;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1300 @ emsgsize:
 	if (((length > mtu) ||
 	     (skb && skb_is_gso(skb))) &&
 	    (sk->sk_protocol == IPPROTO_UDP) &&
-	    (rt->dst.dev->features & NETIF_F_UFO)) {
+	    (rt->dst.dev->features & NETIF_F_UFO) &&
+	    (sk->sk_type == SOCK_DGRAM)) {
 		err = ip6_ufo_append_data(sk, getfrag, from, length,
 					  hh_len, fragheaderlen,
 					  transhdrlen, mtu, flags, rt);
Index: linux-3.18.13-rt10-r7s4/net/ipv6/ndisc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv6/ndisc.c
+++ linux-3.18.13-rt10-r7s4/net/ipv6/ndisc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1218 @ static void ndisc_router_discovery(struc
 	if (rt)
 		rt6_set_expires(rt, jiffies + (HZ * lifetime));
 	if (ra_msg->icmph.icmp6_hop_limit) {
-		in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+		/* Only set hop_limit on the interface if it is higher than
+		 * the current hop_limit.
+		 */
+		if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
+			in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+		} else {
+			ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
+		}
 		if (rt)
 			dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
 				       ra_msg->icmph.icmp6_hop_limit);
Index: linux-3.18.13-rt10-r7s4/net/ipv6/ping.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv6/ping.c
+++ linux-3.18.13-rt10-r7s4/net/ipv6/ping.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:105 @ int ping_v6_sendmsg(struct kiocb *iocb,
 
 	if (msg->msg_name) {
 		DECLARE_SOCKADDR(struct sockaddr_in6 *, u, msg->msg_name);
-		if (msg->msg_namelen < sizeof(struct sockaddr_in6) ||
-		    u->sin6_family != AF_INET6) {
+		if (msg->msg_namelen < sizeof(*u))
 			return -EINVAL;
+		if (u->sin6_family != AF_INET6) {
+			return -EAFNOSUPPORT;
 		}
 		if (sk->sk_bound_dev_if &&
 		    sk->sk_bound_dev_if != u->sin6_scope_id) {
Index: linux-3.18.13-rt10-r7s4/net/ipv6/route.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv6/route.c
+++ linux-3.18.13-rt10-r7s4/net/ipv6/route.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:144 @ static u32 *ipv6_cow_metrics(struct dst_
 	u32 *p = NULL;
 
 	if (!(rt->dst.flags & DST_HOST))
-		return NULL;
+		return dst_cow_metrics_generic(dst, old);
 
 	peer = rt6_get_peer_create(rt);
 	if (peer) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1153 @ static void ip6_rt_update_pmtu(struct ds
 		struct net *net = dev_net(dst->dev);
 
 		rt6->rt6i_flags |= RTF_MODIFIED;
-		if (mtu < IPV6_MIN_MTU) {
-			u32 features = dst_metric(dst, RTAX_FEATURES);
+		if (mtu < IPV6_MIN_MTU)
 			mtu = IPV6_MIN_MTU;
-			features |= RTAX_FEATURE_ALLFRAG;
-			dst_metric_set(dst, RTAX_FEATURES, features);
-		}
+
 		dst_metric_set(dst, RTAX_MTU, mtu);
 		rt6_update_expires(rt6, net->ipv6.sysctl.ip6_rt_mtu_expires);
 	}
Index: linux-3.18.13-rt10-r7s4/net/ipv6/tcp_ipv6.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/ipv6/tcp_ipv6.c
+++ linux-3.18.13-rt10-r7s4/net/ipv6/tcp_ipv6.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:790 @ static const struct tcp_request_sock_ops
 	.queue_hash_add =	inet6_csk_reqsk_queue_hash_add,
 };
 
-static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
-				 u32 tsval, u32 tsecr, int oif,
-				 struct tcp_md5sig_key *key, int rst, u8 tclass,
-				 u32 label)
+static void tcp_v6_send_response(struct sock *sk, struct sk_buff *skb, u32 seq,
+				 u32 ack, u32 win, u32 tsval, u32 tsecr,
+				 int oif, struct tcp_md5sig_key *key, int rst,
+				 u8 tclass, u32 label)
 {
 	const struct tcphdr *th = tcp_hdr(skb);
 	struct tcphdr *t1;
 	struct sk_buff *buff;
 	struct flowi6 fl6;
-	struct net *net = dev_net(skb_dst(skb)->dev);
+	struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 	struct sock *ctl_sk = net->ipv6.tcp_sk;
 	unsigned int tot_len = sizeof(struct tcphdr);
 	struct dst_entry *dst;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:949 @ static void tcp_v6_send_reset(struct soc
 			  (th->doff << 2);
 
 	oif = sk ? sk->sk_bound_dev_if : 0;
-	tcp_v6_send_response(skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
+	tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 
 #ifdef CONFIG_TCP_MD5SIG
 release_sk1:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:960 @ release_sk1:
 #endif
 }
 
-static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
-			    u32 win, u32 tsval, u32 tsecr, int oif,
+static void tcp_v6_send_ack(struct sock *sk, struct sk_buff *skb, u32 seq,
+			    u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 			    struct tcp_md5sig_key *key, u8 tclass,
 			    u32 label)
 {
-	tcp_v6_send_response(skb, seq, ack, win, tsval, tsecr, oif, key, 0, tclass,
-			     label);
+	tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
+			     tclass, label);
 }
 
 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:974 @ static void tcp_v6_timewait_ack(struct s
 	struct inet_timewait_sock *tw = inet_twsk(sk);
 	struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 
-	tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
+	tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 			tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 			tcp_time_stamp + tcptw->tw_ts_offset,
 			tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:989 @ static void tcp_v6_reqsk_send_ack(struct
 	/* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
 	 * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
 	 */
-	tcp_v6_send_ack(skb, (sk->sk_state == TCP_LISTEN) ?
+	tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
 			tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
-			tcp_rsk(req)->rcv_nxt,
-			req->rcv_wnd, tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
+			tcp_rsk(req)->rcv_nxt, req->rcv_wnd,
+			tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
 			tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
 			0, 0);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1388 @ ipv6_pktoptions:
 	return 0;
 }
 
+static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
+			   const struct tcphdr *th)
+{
+	/* This is tricky: we move IP6CB at its correct location into
+	 * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
+	 * _decode_session6() uses IP6CB().
+	 * barrier() makes sure compiler won't play aliasing games.
+	 */
+	memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
+		sizeof(struct inet6_skb_parm));
+	barrier();
+
+	TCP_SKB_CB(skb)->seq = ntohl(th->seq);
+	TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
+				    skb->len - th->doff*4);
+	TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
+	TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
+	TCP_SKB_CB(skb)->tcp_tw_isn = 0;
+	TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
+	TCP_SKB_CB(skb)->sacked = 0;
+}
+
+static void tcp_v6_restore_cb(struct sk_buff *skb)
+{
+	/* We need to move header back to the beginning if xfrm6_policy_check()
+	 * and tcp_v6_fill_cb() are going to be called again.
+	 */
+	memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
+		sizeof(struct inet6_skb_parm));
+}
+
 static int tcp_v6_rcv(struct sk_buff *skb)
 {
 	const struct tcphdr *th;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1450 @ static int tcp_v6_rcv(struct sk_buff *sk
 
 	th = tcp_hdr(skb);
 	hdr = ipv6_hdr(skb);
-	/* This is tricky : We move IPCB at its correct location into TCP_SKB_CB()
-	 * barrier() makes sure compiler wont play fool^Waliasing games.
-	 */
-	memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
-		sizeof(struct inet6_skb_parm));
-	barrier();
-
-	TCP_SKB_CB(skb)->seq = ntohl(th->seq);
-	TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
-				    skb->len - th->doff*4);
-	TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
-	TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
-	TCP_SKB_CB(skb)->tcp_tw_isn = 0;
-	TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
-	TCP_SKB_CB(skb)->sacked = 0;
 
 	sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
-				tcp_v6_iif(skb));
+				inet6_iif(skb));
 	if (!sk)
 		goto no_tcp_socket;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1468 @ process:
 	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
 		goto discard_and_relse;
 
+	tcp_v6_fill_cb(skb, hdr, th);
+
 #ifdef CONFIG_TCP_MD5SIG
 	if (tcp_v6_inbound_md5_hash(sk, skb))
 		goto discard_and_relse;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1501 @ no_tcp_socket:
 	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
 		goto discard_it;
 
+	tcp_v6_fill_cb(skb, hdr, th);
+
 	if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
 csum_error:
 		TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1526 @ do_time_wait:
 		goto discard_it;
 	}
 
+	tcp_v6_fill_cb(skb, hdr, th);
+
 	if (skb->len < (th->doff<<2)) {
 		inet_twsk_put(inet_twsk(sk));
 		goto bad_packet;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1551 @ do_time_wait:
 			inet_twsk_deschedule(tw, &tcp_death_row);
 			inet_twsk_put(tw);
 			sk = sk2;
+			tcp_v6_restore_cb(skb);
 			goto process;
 		}
 		/* Fall through to ACK */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1560 @ do_time_wait:
 		tcp_v6_timewait_ack(sk, skb);
 		break;
 	case TCP_TW_RST:
+		tcp_v6_restore_cb(skb);
 		goto no_tcp_socket;
 	case TCP_TW_SUCCESS:
 		;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1595 @ static void tcp_v6_early_demux(struct sk
 		skb->sk = sk;
 		skb->destructor = sock_edemux;
 		if (sk->sk_state != TCP_TIME_WAIT) {
-			struct dst_entry *dst = sk->sk_rx_dst;
+			struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
 
 			if (dst)
 				dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
Index: linux-3.18.13-rt10-r7s4/net/irda/ircomm/ircomm_tty.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/irda/ircomm/ircomm_tty.c
+++ linux-3.18.13-rt10-r7s4/net/irda/ircomm/ircomm_tty.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:819 @ static void ircomm_tty_wait_until_sent(s
 	orig_jiffies = jiffies;
 
 	/* Set poll time to 200 ms */
-	poll_time = IRDA_MIN(timeout, msecs_to_jiffies(200));
+	poll_time = msecs_to_jiffies(200);
+	if (timeout)
+		poll_time = min_t(unsigned long, timeout, poll_time);
 
 	spin_lock_irqsave(&self->spinlock, flags);
 	while (self->tx_skb && self->tx_skb->len) {
Index: linux-3.18.13-rt10-r7s4/net/mac80211/agg-rx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/mac80211/agg-rx.c
+++ linux-3.18.13-rt10-r7s4/net/mac80211/agg-rx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:52 @ static void ieee80211_free_tid_rx(struct
 		container_of(h, struct tid_ampdu_rx, rcu_head);
 	int i;
 
-	del_timer_sync(&tid_rx->reorder_timer);
-
 	for (i = 0; i < tid_rx->buf_size; i++)
 		__skb_queue_purge(&tid_rx->reorder_buf[i]);
 	kfree(tid_rx->reorder_buf);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:94 @ void ___ieee80211_stop_rx_ba_session(str
 
 	del_timer_sync(&tid_rx->session_timer);
 
+	/* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */
+	spin_lock_bh(&tid_rx->reorder_lock);
+	tid_rx->removed = true;
+	spin_unlock_bh(&tid_rx->reorder_lock);
+	del_timer_sync(&tid_rx->reorder_timer);
+
 	call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
 }
 
Index: linux-3.18.13-rt10-r7s4/net/mac80211/chan.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/mac80211/chan.c
+++ linux-3.18.13-rt10-r7s4/net/mac80211/chan.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:932 @ ieee80211_vif_chanctx_reservation_comple
 	}
 }
 
+static void
+ieee80211_vif_update_chandef(struct ieee80211_sub_if_data *sdata,
+			     const struct cfg80211_chan_def *chandef)
+{
+	struct ieee80211_sub_if_data *vlan;
+
+	sdata->vif.bss_conf.chandef = *chandef;
+
+	if (sdata->vif.type != NL80211_IFTYPE_AP)
+		return;
+
+	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+		vlan->vif.bss_conf.chandef = *chandef;
+}
+
 static int
 ieee80211_vif_use_reserved_reassign(struct ieee80211_sub_if_data *sdata)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1009 @ ieee80211_vif_use_reserved_reassign(stru
 	if (sdata->vif.bss_conf.chandef.width != sdata->reserved_chandef.width)
 		changed = BSS_CHANGED_BANDWIDTH;
 
-	sdata->vif.bss_conf.chandef = sdata->reserved_chandef;
+	ieee80211_vif_update_chandef(sdata, &sdata->reserved_chandef);
 
 	if (changed)
 		ieee80211_bss_info_change_notify(sdata, changed);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1351 @ static int ieee80211_vif_use_reserved_sw
 			    sdata->reserved_chandef.width)
 				changed = BSS_CHANGED_BANDWIDTH;
 
-			sdata->vif.bss_conf.chandef = sdata->reserved_chandef;
+			ieee80211_vif_update_chandef(sdata, &sdata->reserved_chandef);
 			if (changed)
 				ieee80211_bss_info_change_notify(sdata,
 								 changed);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1522 @ int ieee80211_vif_use_channel(struct iee
 		goto out;
 	}
 
-	sdata->vif.bss_conf.chandef = *chandef;
+	ieee80211_vif_update_chandef(sdata, chandef);
 
 	ret = ieee80211_assign_vif_chanctx(sdata, ctx);
 	if (ret) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1664 @ int ieee80211_vif_change_bandwidth(struc
 		break;
 	}
 
-	sdata->vif.bss_conf.chandef = *chandef;
+	ieee80211_vif_update_chandef(sdata, chandef);
 
 	ieee80211_recalc_chanctx_chantype(local, ctx);
 
Index: linux-3.18.13-rt10-r7s4/net/mac80211/ieee80211_i.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/mac80211/ieee80211_i.h
+++ linux-3.18.13-rt10-r7s4/net/mac80211/ieee80211_i.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:61 @ struct ieee80211_local;
 #define IEEE80211_UNSET_POWER_LEVEL	INT_MIN
 
 /*
- * Some APs experience problems when working with U-APSD. Decrease the
- * probability of that happening by using legacy mode for all ACs but VO.
- * The AP that caused us trouble was a Cisco 4410N. It ignores our
- * setting, and always treats non-VO ACs as legacy.
+ * Some APs experience problems when working with U-APSD. Decreasing the
+ * probability of that happening by using legacy mode for all ACs but VO isn't
+ * enough.
+ *
+ * Cisco 4410N originally forced us to enable VO by default only because it
+ * treated non-VO ACs as legacy.
+ *
+ * However some APs (notably Netgear R7000) silently reclassify packets to
+ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval
+ * clients would never see some frames (e.g. ARP responses) or would fetch them
+ * accidentally after a long time.
+ *
+ * It makes little sense to enable u-APSD queues by default because it needs
+ * userspace applications to be aware of it to actually take advantage of the
+ * possible additional powersavings. Implicitly depending on driver autotrigger
+ * frame support doesn't make much sense.
  */
-#define IEEE80211_DEFAULT_UAPSD_QUEUES \
-	IEEE80211_WMM_IE_STA_QOSINFO_AC_VO
+#define IEEE80211_DEFAULT_UAPSD_QUEUES 0
 
 #define IEEE80211_DEFAULT_MAX_SP_LEN		\
 	IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
Index: linux-3.18.13-rt10-r7s4/net/mac80211/iface.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/mac80211/iface.c
+++ linux-3.18.13-rt10-r7s4/net/mac80211/iface.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:514 @ int ieee80211_do_open(struct wireless_de
 		sdata->vif.cab_queue = master->vif.cab_queue;
 		memcpy(sdata->vif.hw_queue, master->vif.hw_queue,
 		       sizeof(sdata->vif.hw_queue));
+		sdata->vif.bss_conf.chandef = master->vif.bss_conf.chandef;
 		break;
 		}
 	case NL80211_IFTYPE_AP:
Index: linux-3.18.13-rt10-r7s4/net/mac80211/key.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/mac80211/key.c
+++ linux-3.18.13-rt10-r7s4/net/mac80211/key.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:134 @ static int ieee80211_key_enable_hw_accel
 	if (!ret) {
 		key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
 
-		if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+		if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+		      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+		      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
 			sdata->crypto_tx_tailroom_needed_cnt--;
 
 		WARN_ON((key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:184 @ static void ieee80211_key_disable_hw_acc
 	sta = key->sta;
 	sdata = key->sdata;
 
-	if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+	if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+	      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+	      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
 		increment_tailroom_need_count(sdata);
 
 	ret = drv_set_key(key->local, DISABLE_KEY, sdata,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:654 @ void ieee80211_free_sta_keys(struct ieee
 	int i;
 
 	mutex_lock(&local->key_mtx);
-	for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+	for (i = 0; i < ARRAY_SIZE(sta->gtk); i++) {
 		key = key_mtx_dereference(local, sta->gtk[i]);
 		if (!key)
 			continue;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:882 @ void ieee80211_remove_key(struct ieee802
 	if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
 		key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
 
-		if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+		if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+		      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+		      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
 			increment_tailroom_need_count(key->sdata);
 	}
 
Index: linux-3.18.13-rt10-r7s4/net/mac80211/mlme.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/mac80211/mlme.c
+++ linux-3.18.13-rt10-r7s4/net/mac80211/mlme.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:177 @ ieee80211_determine_chantype(struct ieee
 	if (!(ht_cap->cap_info &
 	      cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40))) {
 		ret = IEEE80211_STA_DISABLE_40MHZ;
+		vht_chandef = *chandef;
 		goto out;
 	}
 
Index: linux-3.18.13-rt10-r7s4/net/mac80211/pm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/mac80211/pm.c
+++ linux-3.18.13-rt10-r7s4/net/mac80211/pm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:89 @ int __ieee80211_suspend(struct ieee80211
 		}
 	}
 
-	/* tear down aggregation sessions and remove STAs */
-	mutex_lock(&local->sta_mtx);
-	list_for_each_entry(sta, &local->sta_list, list) {
-		if (sta->uploaded) {
-			enum ieee80211_sta_state state;
-
-			state = sta->sta_state;
-			for (; state > IEEE80211_STA_NOTEXIST; state--)
-				WARN_ON(drv_sta_state(local, sta->sdata, sta,
-						      state, state - 1));
-		}
-	}
-	mutex_unlock(&local->sta_mtx);
-
 	/* remove all interfaces that were created in the driver */
 	list_for_each_entry(sdata, &local->interfaces, list) {
 		if (!ieee80211_sdata_running(sdata))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:100 @ int __ieee80211_suspend(struct ieee80211
 		case NL80211_IFTYPE_STATION:
 			ieee80211_mgd_quiesce(sdata);
 			break;
+		case NL80211_IFTYPE_WDS:
+			/* tear down aggregation sessions and remove STAs */
+			mutex_lock(&local->sta_mtx);
+			sta = sdata->u.wds.sta;
+			if (sta && sta->uploaded) {
+				enum ieee80211_sta_state state;
+
+				state = sta->sta_state;
+				for (; state > IEEE80211_STA_NOTEXIST; state--)
+					WARN_ON(drv_sta_state(local, sta->sdata,
+							      sta, state,
+							      state - 1));
+			}
+			mutex_unlock(&local->sta_mtx);
+			break;
 		default:
 			break;
 		}
Index: linux-3.18.13-rt10-r7s4/net/mac80211/rx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/mac80211/rx.c
+++ linux-3.18.13-rt10-r7s4/net/mac80211/rx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:238 @ ieee80211_add_rx_radiotap_header(struct
 	else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
 		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
 	else if (rate)
-		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
+		channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
 	else
 		channel_flags |= IEEE80211_CHAN_2GHZ;
 	put_unaligned_le16(channel_flags, pos);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:811 @ static void ieee80211_sta_reorder_releas
 
  set_release_timer:
 
-		mod_timer(&tid_agg_rx->reorder_timer,
-			  tid_agg_rx->reorder_time[j] + 1 +
-			  HT_RX_REORDER_BUF_TIMEOUT);
+		if (!tid_agg_rx->removed)
+			mod_timer(&tid_agg_rx->reorder_timer,
+				  tid_agg_rx->reorder_time[j] + 1 +
+				  HT_RX_REORDER_BUF_TIMEOUT);
 	} else {
 		del_timer(&tid_agg_rx->reorder_timer);
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1682 @ ieee80211_rx_h_defragment(struct ieee802
 	sc = le16_to_cpu(hdr->seq_ctrl);
 	frag = sc & IEEE80211_SCTL_FRAG;
 
-	if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
-		goto out;
-
 	if (is_multicast_ether_addr(hdr->addr1)) {
 		rx->local->dot11MulticastReceivedFrameCount++;
-		goto out;
+		goto out_no_led;
 	}
 
+	if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
+		goto out;
+
 	I802_DEBUG_INC(rx->local->rx_handlers_fragments);
 
 	if (skb_linearize(rx->skb))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1780 @ ieee80211_rx_h_defragment(struct ieee802
 	status->rx_flags |= IEEE80211_RX_FRAGMENTED;
 
  out:
+	ieee80211_led_rx(rx->local);
+ out_no_led:
 	if (rx->sta)
 		rx->sta->rx_packets++;
-	ieee80211_led_rx(rx->local);
 	return RX_CONTINUE;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2112 @ ieee80211_rx_h_mesh_fwding(struct ieee80
 	hdr = (struct ieee80211_hdr *) skb->data;
 	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
 
+	if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
+		return RX_DROP_MONITOR;
+
 	/* frame is in RMC, don't forward */
 	if (ieee80211_is_data(hdr->frame_control) &&
 	    is_multicast_ether_addr(hdr->addr1) &&
Index: linux-3.18.13-rt10-r7s4/net/mac80211/sta_info.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/mac80211/sta_info.h
+++ linux-3.18.13-rt10-r7s4/net/mac80211/sta_info.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:173 @ struct tid_ampdu_tx {
  * @reorder_lock: serializes access to reorder buffer, see below.
  * @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and
  *	and ssn.
+ * @removed: this session is removed (but might have been found due to RCU)
  *
  * This structure's lifetime is managed by RCU, assignments to
  * the array holding it must hold the aggregation mutex.
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:198 @ struct tid_ampdu_rx {
 	u16 timeout;
 	u8 dialog_token;
 	bool auto_seq;
+	bool removed;
 };
 
 /**
Index: linux-3.18.13-rt10-r7s4/net/mac80211/tx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/mac80211/tx.c
+++ linux-3.18.13-rt10-r7s4/net/mac80211/tx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:566 @ ieee80211_tx_h_check_control_port_protoc
 		if (tx->sdata->control_port_no_encrypt)
 			info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 		info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
+		info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
 	}
 
 	return TX_CONTINUE;
Index: linux-3.18.13-rt10-r7s4/net/mac80211/util.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/mac80211/util.c
+++ linux-3.18.13-rt10-r7s4/net/mac80211/util.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3053 @ int ieee80211_check_combinations(struct
 		wdev_iter = &sdata_iter->wdev;
 
 		if (sdata_iter == sdata ||
-		    rcu_access_pointer(sdata_iter->vif.chanctx_conf) == NULL ||
+		    !ieee80211_sdata_running(sdata_iter) ||
 		    local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
 			continue;
 
Index: linux-3.18.13-rt10-r7s4/net/netfilter/ipvs/ip_vs_ftp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/netfilter/ipvs/ip_vs_ftp.c
+++ linux-3.18.13-rt10-r7s4/net/netfilter/ipvs/ip_vs_ftp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:186 @ static int ip_vs_ftp_out(struct ip_vs_ap
 	struct nf_conn *ct;
 	struct net *net;
 
+	*diff = 0;
+
 #ifdef CONFIG_IP_VS_IPV6
 	/* This application helper doesn't work with IPv6 yet,
 	 * so turn this into a no-op for IPv6 packets
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:196 @ static int ip_vs_ftp_out(struct ip_vs_ap
 		return 1;
 #endif
 
-	*diff = 0;
-
 	/* Only useful for established sessions */
 	if (cp->state != IP_VS_TCP_S_ESTABLISHED)
 		return 1;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:325 @ static int ip_vs_ftp_in(struct ip_vs_app
 	struct ip_vs_conn *n_cp;
 	struct net *net;
 
+	/* no diff required for incoming packets */
+	*diff = 0;
+
 #ifdef CONFIG_IP_VS_IPV6
 	/* This application helper doesn't work with IPv6 yet,
 	 * so turn this into a no-op for IPv6 packets
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:336 @ static int ip_vs_ftp_in(struct ip_vs_app
 		return 1;
 #endif
 
-	/* no diff required for incoming packets */
-	*diff = 0;
-
 	/* Only useful for established sessions */
 	if (cp->state != IP_VS_TCP_S_ESTABLISHED)
 		return 1;
Index: linux-3.18.13-rt10-r7s4/net/netfilter/nf_conntrack_core.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/netfilter/nf_conntrack_core.c
+++ linux-3.18.13-rt10-r7s4/net/netfilter/nf_conntrack_core.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:614 @ __nf_conntrack_confirm(struct sk_buff *s
 	 */
 	NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
 	pr_debug("Confirming conntrack %p\n", ct);
-	/* We have to check the DYING flag inside the lock to prevent
-	   a race against nf_ct_get_next_corpse() possibly called from
-	   user context, else we insert an already 'dead' hash, blocking
-	   further use of that particular connection -JM */
-
-	if (unlikely(nf_ct_is_dying(ct))) {
-		nf_conntrack_double_unlock(hash, reply_hash);
-		local_bh_enable();
-		return NF_ACCEPT;
-	}
+	/* We have to check the DYING flag after unlink to prevent
+	 * a race against nf_ct_get_next_corpse() possibly called from
+	 * user context, else we insert an already 'dead' hash, blocking
+	 * further use of that particular connection -JM.
+	 */
+	nf_ct_del_from_dying_or_unconfirmed_list(ct);
+
+	if (unlikely(nf_ct_is_dying(ct)))
+		goto out;
 
 	/* See if there's one in the list already, including reverse:
 	   NAT could have grabbed it without realizing, since we're
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:638 @ __nf_conntrack_confirm(struct sk_buff *s
 		    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
 			goto out;
 
-	nf_ct_del_from_dying_or_unconfirmed_list(ct);
-
 	/* Timer relative to confirmation time, not original
 	   setting time, otherwise we'd get timer wrap in
 	   weird delay cases. */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:673 @ __nf_conntrack_confirm(struct sk_buff *s
 	return NF_ACCEPT;
 
 out:
+	nf_ct_add_to_dying_list(ct);
 	nf_conntrack_double_unlock(hash, reply_hash);
 	NF_CT_STAT_INC(net, insert_failed);
 	local_bh_enable();
Index: linux-3.18.13-rt10-r7s4/net/netfilter/nf_tables_api.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/netfilter/nf_tables_api.c
+++ linux-3.18.13-rt10-r7s4/net/netfilter/nf_tables_api.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:716 @ static int nft_flush_table(struct nft_ct
 	struct nft_chain *chain, *nc;
 	struct nft_set *set, *ns;
 
-	list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
+	list_for_each_entry(chain, &ctx->table->chains, list) {
 		ctx->chain = chain;
 
 		err = nft_delrule_by_chain(ctx);
 		if (err < 0)
 			goto out;
-
-		err = nft_delchain(ctx);
-		if (err < 0)
-			goto out;
 	}
 
 	list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:733 @ static int nft_flush_table(struct nft_ct
 		if (err < 0)
 			goto out;
 	}
+
+	list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
+		ctx->chain = chain;
+
+		err = nft_delchain(ctx);
+		if (err < 0)
+			goto out;
+	}
 
 	err = nft_deltable(ctx);
 out:
Index: linux-3.18.13-rt10-r7s4/net/netfilter/nfnetlink.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/netfilter/nfnetlink.c
+++ linux-3.18.13-rt10-r7s4/net/netfilter/nfnetlink.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:324 @ replay:
 		nlh = nlmsg_hdr(skb);
 		err = 0;
 
-		if (nlh->nlmsg_len < NLMSG_HDRLEN) {
+		if (nlmsg_len(nlh) < sizeof(struct nfgenmsg) ||
+		    skb->len < nlh->nlmsg_len) {
 			err = -EINVAL;
 			goto ack;
 		}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:473 @ static int nfnetlink_bind(int group)
 	int type;
 
 	if (group <= NFNLGRP_NONE || group > NFNLGRP_MAX)
-		return -EINVAL;
+		return 0;
 
 	type = nfnl_group2type[group];
 
Index: linux-3.18.13-rt10-r7s4/net/netlabel/netlabel_kapi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/netlabel/netlabel_kapi.c
+++ linux-3.18.13-rt10-r7s4/net/netlabel/netlabel_kapi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1068 @ int netlbl_skbuff_getattr(const struct s
 			  u16 family,
 			  struct netlbl_lsm_secattr *secattr)
 {
+	unsigned char *ptr;
+
 	switch (family) {
 	case AF_INET:
-		if (CIPSO_V4_OPTEXIST(skb) &&
-		    cipso_v4_skbuff_getattr(skb, secattr) == 0)
+		ptr = cipso_v4_optptr(skb);
+		if (ptr && cipso_v4_getattr(ptr, secattr) == 0)
 			return 0;
 		break;
 #if IS_ENABLED(CONFIG_IPV6)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1099 @ int netlbl_skbuff_getattr(const struct s
  */
 void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway)
 {
-	if (CIPSO_V4_OPTEXIST(skb))
+	if (cipso_v4_optptr(skb))
 		cipso_v4_error(skb, error, gateway);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1131 @ void netlbl_cache_invalidate(void)
 int netlbl_cache_add(const struct sk_buff *skb,
 		     const struct netlbl_lsm_secattr *secattr)
 {
+	unsigned char *ptr;
+
 	if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0)
 		return -ENOMSG;
 
-	if (CIPSO_V4_OPTEXIST(skb))
-		return cipso_v4_cache_add(skb, secattr);
+	ptr = cipso_v4_optptr(skb);
+	if (ptr)
+		return cipso_v4_cache_add(ptr, secattr);
 
 	return -ENOMSG;
 }
Index: linux-3.18.13-rt10-r7s4/net/netlink/af_netlink.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/netlink/af_netlink.c
+++ linux-3.18.13-rt10-r7s4/net/netlink/af_netlink.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:529 @ out:
 	return err;
 }
 
-static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr)
+static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len)
 {
 #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1
 	struct page *p_start, *p_end;
 
 	/* First page is flushed through netlink_{get,set}_status */
 	p_start = pgvec_to_page(hdr + PAGE_SIZE);
-	p_end   = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + hdr->nm_len - 1);
+	p_end   = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1);
 	while (p_start <= p_end) {
 		flush_dcache_page(p_start);
 		p_start++;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:554 @ static enum nl_mmap_status netlink_get_s
 static void netlink_set_status(struct nl_mmap_hdr *hdr,
 			       enum nl_mmap_status status)
 {
+	smp_mb();
 	hdr->nm_status = status;
 	flush_dcache_page(pgvec_to_page(hdr));
-	smp_wmb();
 }
 
 static struct nl_mmap_hdr *
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:718 @ static int netlink_mmap_sendmsg(struct s
 	struct nl_mmap_hdr *hdr;
 	struct sk_buff *skb;
 	unsigned int maxlen;
-	bool excl = true;
 	int err = 0, len = 0;
 
-	/* Netlink messages are validated by the receiver before processing.
-	 * In order to avoid userspace changing the contents of the message
-	 * after validation, the socket and the ring may only be used by a
-	 * single process, otherwise we fall back to copying.
-	 */
-	if (atomic_long_read(&sk->sk_socket->file->f_count) > 1 ||
-	    atomic_read(&nlk->mapped) > 1)
-		excl = false;
-
 	mutex_lock(&nlk->pg_vec_lock);
 
 	ring   = &nlk->tx_ring;
 	maxlen = ring->frame_size - NL_MMAP_HDRLEN;
 
 	do {
+		unsigned int nm_len;
+
 		hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID);
 		if (hdr == NULL) {
 			if (!(msg->msg_flags & MSG_DONTWAIT) &&
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:735 @ static int netlink_mmap_sendmsg(struct s
 				schedule();
 			continue;
 		}
-		if (hdr->nm_len > maxlen) {
+
+		nm_len = ACCESS_ONCE(hdr->nm_len);
+		if (nm_len > maxlen) {
 			err = -EINVAL;
 			goto out;
 		}
 
-		netlink_frame_flush_dcache(hdr);
+		netlink_frame_flush_dcache(hdr, nm_len);
 
-		if (likely(dst_portid == 0 && dst_group == 0 && excl)) {
-			skb = alloc_skb_head(GFP_KERNEL);
-			if (skb == NULL) {
-				err = -ENOBUFS;
-				goto out;
-			}
-			sock_hold(sk);
-			netlink_ring_setup_skb(skb, sk, ring, hdr);
-			NETLINK_CB(skb).flags |= NETLINK_SKB_TX;
-			__skb_put(skb, hdr->nm_len);
-			netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
-			atomic_inc(&ring->pending);
-		} else {
-			skb = alloc_skb(hdr->nm_len, GFP_KERNEL);
-			if (skb == NULL) {
-				err = -ENOBUFS;
-				goto out;
-			}
-			__skb_put(skb, hdr->nm_len);
-			memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, hdr->nm_len);
-			netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
+		skb = alloc_skb(nm_len, GFP_KERNEL);
+		if (skb == NULL) {
+			err = -ENOBUFS;
+			goto out;
 		}
+		__skb_put(skb, nm_len);
+		memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len);
+		netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
 
 		netlink_increment_head(ring);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:797 @ static void netlink_queue_mmaped_skb(str
 	hdr->nm_pid	= NETLINK_CB(skb).creds.pid;
 	hdr->nm_uid	= from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
 	hdr->nm_gid	= from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
-	netlink_frame_flush_dcache(hdr);
+	netlink_frame_flush_dcache(hdr, hdr->nm_len);
 	netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
 
 	NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3113 @ static int __init netlink_proto_init(voi
 		.head_offset = offsetof(struct netlink_sock, node),
 		.key_offset = offsetof(struct netlink_sock, portid),
 		.key_len = sizeof(u32), /* portid */
-		.hashfn = arch_fast_hash,
+		.hashfn = jhash,
 		.max_shift = 16, /* 64K */
 		.grow_decision = rht_grow_above_75,
 		.shrink_decision = rht_shrink_below_30,
Index: linux-3.18.13-rt10-r7s4/net/openvswitch/actions.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/openvswitch/actions.c
+++ linux-3.18.13-rt10-r7s4/net/openvswitch/actions.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:187 @ static int push_vlan(struct sk_buff *skb
 		/* push down current VLAN tag */
 		current_tag = vlan_tx_tag_get(skb);
 
-		if (!__vlan_put_tag(skb, skb->vlan_proto, current_tag))
+		skb = vlan_insert_tag_set_proto(skb, skb->vlan_proto,
+						current_tag);
+		if (!skb)
 			return -ENOMEM;
 
 		if (skb->ip_summed == CHECKSUM_COMPLETE)
Index: linux-3.18.13-rt10-r7s4/net/openvswitch/datapath.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/openvswitch/datapath.c
+++ linux-3.18.13-rt10-r7s4/net/openvswitch/datapath.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:426 @ static int queue_userspace_packet(struct
 		if (!nskb)
 			return -ENOMEM;
 
-		nskb = __vlan_put_tag(nskb, nskb->vlan_proto, vlan_tx_tag_get(nskb));
+		nskb = __vlan_hwaccel_push_inside(nskb);
 		if (!nskb)
 			return -ENOMEM;
 
-		nskb->vlan_tci = 0;
 		skb = nskb;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2062 @ static int __net_init ovs_init_net(struc
 	return 0;
 }
 
-static void __net_exit ovs_exit_net(struct net *net)
+static void __net_exit list_vports_from_net(struct net *net, struct net *dnet,
+					    struct list_head *head)
 {
-	struct datapath *dp, *dp_next;
 	struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
+	struct datapath *dp;
+
+	list_for_each_entry(dp, &ovs_net->dps, list_node) {
+		int i;
+
+		for (i = 0; i < DP_VPORT_HASH_BUCKETS; i++) {
+			struct vport *vport;
+
+			hlist_for_each_entry(vport, &dp->ports[i], dp_hash_node) {
+				struct netdev_vport *netdev_vport;
+
+				if (vport->ops->type != OVS_VPORT_TYPE_INTERNAL)
+					continue;
+
+				netdev_vport = netdev_vport_priv(vport);
+				if (dev_net(netdev_vport->dev) == dnet)
+					list_add(&vport->detach_list, head);
+			}
+		}
+	}
+}
+
+static void __net_exit ovs_exit_net(struct net *dnet)
+{
+	struct datapath *dp, *dp_next;
+	struct ovs_net *ovs_net = net_generic(dnet, ovs_net_id);
+	struct vport *vport, *vport_next;
+	struct net *net;
+	LIST_HEAD(head);
 
 	ovs_lock();
 	list_for_each_entry_safe(dp, dp_next, &ovs_net->dps, list_node)
 		__dp_destroy(dp);
+
+	rtnl_lock();
+	for_each_net(net)
+		list_vports_from_net(net, dnet, &head);
+	rtnl_unlock();
+
+	/* Detach all vports from given namespace. */
+	list_for_each_entry_safe(vport, vport_next, &head, detach_list) {
+		list_del(&vport->detach_list);
+		ovs_dp_detach_port(vport);
+	}
+
 	ovs_unlock();
 
 	cancel_work_sync(&ovs_net->dp_notify_work);
Index: linux-3.18.13-rt10-r7s4/net/openvswitch/flow_netlink.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/openvswitch/flow_netlink.c
+++ linux-3.18.13-rt10-r7s4/net/openvswitch/flow_netlink.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:148 @ static bool match_validate(const struct
 	if (match->key->eth.type == htons(ETH_P_ARP)
 			|| match->key->eth.type == htons(ETH_P_RARP)) {
 		key_expected |= 1 << OVS_KEY_ATTR_ARP;
-		if (match->mask && (match->mask->key.tp.src == htons(0xff)))
+		if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
 			mask_allowed |= 1 << OVS_KEY_ATTR_ARP;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:223 @ static bool match_validate(const struct
 						htons(NDISC_NEIGHBOUR_SOLICITATION) ||
 				    match->key->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) {
 					key_expected |= 1 << OVS_KEY_ATTR_ND;
-					if (match->mask && (match->mask->key.tp.src == htons(0xffff)))
+					if (match->mask && (match->mask->key.tp.src == htons(0xff)))
 						mask_allowed |= 1 << OVS_KEY_ATTR_ND;
 				}
 			}
Index: linux-3.18.13-rt10-r7s4/net/openvswitch/vport-gre.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/openvswitch/vport-gre.c
+++ linux-3.18.13-rt10-r7s4/net/openvswitch/vport-gre.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:175 @ static int gre_tnl_send(struct vport *vp
 			goto err_free_rt;
 	}
 
-	if (vlan_tx_tag_present(skb)) {
-		if (unlikely(!__vlan_put_tag(skb,
-					     skb->vlan_proto,
-					     vlan_tx_tag_get(skb)))) {
-			err = -ENOMEM;
-			goto err_free_rt;
-		}
-		skb->vlan_tci = 0;
+	skb = vlan_hwaccel_push_inside(skb);
+	if (unlikely(!skb)) {
+		err = -ENOMEM;
+		goto err_free_rt;
 	}
 
 	/* Push Tunnel header. */
Index: linux-3.18.13-rt10-r7s4/net/openvswitch/vport.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/openvswitch/vport.h
+++ linux-3.18.13-rt10-r7s4/net/openvswitch/vport.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:96 @ struct vport_portids {
  * @ops: Class structure.
  * @percpu_stats: Points to per-CPU statistics used and maintained by vport
  * @err_stats: Points to error statistics used and maintained by vport
+ * @detach_list: list used for detaching vport in net-exit call.
  */
 struct vport {
 	struct rcu_head rcu;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:111 @ struct vport {
 	struct pcpu_sw_netstats __percpu *percpu_stats;
 
 	struct vport_err_stats err_stats;
+	struct list_head detach_list;
 };
 
 /**
Index: linux-3.18.13-rt10-r7s4/net/rds/iw_rdma.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/rds/iw_rdma.c
+++ linux-3.18.13-rt10-r7s4/net/rds/iw_rdma.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:91 @ static unsigned int rds_iw_unmap_fastreg
 			int *unpinned);
 static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
 
-static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
+static int rds_iw_get_device(struct sockaddr_in *src, struct sockaddr_in *dst,
+			     struct rds_iw_device **rds_iwdev,
+			     struct rdma_cm_id **cm_id)
 {
 	struct rds_iw_device *iwdev;
 	struct rds_iw_cm_id *i_cm_id;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:117 @ static int rds_iw_get_device(struct rds_
 				src_addr->sin_port,
 				dst_addr->sin_addr.s_addr,
 				dst_addr->sin_port,
-				rs->rs_bound_addr,
-				rs->rs_bound_port,
-				rs->rs_conn_addr,
-				rs->rs_conn_port);
+				src->sin_addr.s_addr,
+				src->sin_port,
+				dst->sin_addr.s_addr,
+				dst->sin_port);
 #ifdef WORKING_TUPLE_DETECTION
-			if (src_addr->sin_addr.s_addr == rs->rs_bound_addr &&
-			    src_addr->sin_port == rs->rs_bound_port &&
-			    dst_addr->sin_addr.s_addr == rs->rs_conn_addr &&
-			    dst_addr->sin_port == rs->rs_conn_port) {
+			if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr &&
+			    src_addr->sin_port == src->sin_port &&
+			    dst_addr->sin_addr.s_addr == dst->sin_addr.s_addr &&
+			    dst_addr->sin_port == dst->sin_port) {
 #else
 			/* FIXME - needs to compare the local and remote
 			 * ipaddr/port tuple, but the ipaddr is the only
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:133 @ static int rds_iw_get_device(struct rds_
 			 * zero'ed.  It doesn't appear to be properly populated
 			 * during connection setup...
 			 */
-			if (src_addr->sin_addr.s_addr == rs->rs_bound_addr) {
+			if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr) {
 #endif
 				spin_unlock_irq(&iwdev->spinlock);
 				*rds_iwdev = iwdev;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:185 @ int rds_iw_update_cm_id(struct rds_iw_de
 {
 	struct sockaddr_in *src_addr, *dst_addr;
 	struct rds_iw_device *rds_iwdev_old;
-	struct rds_sock rs;
 	struct rdma_cm_id *pcm_id;
 	int rc;
 
 	src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
 	dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
 
-	rs.rs_bound_addr = src_addr->sin_addr.s_addr;
-	rs.rs_bound_port = src_addr->sin_port;
-	rs.rs_conn_addr = dst_addr->sin_addr.s_addr;
-	rs.rs_conn_port = dst_addr->sin_port;
-
-	rc = rds_iw_get_device(&rs, &rds_iwdev_old, &pcm_id);
+	rc = rds_iw_get_device(src_addr, dst_addr, &rds_iwdev_old, &pcm_id);
 	if (rc)
 		rds_iw_remove_cm_id(rds_iwdev, cm_id);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:597 @ void *rds_iw_get_mr(struct scatterlist *
 	struct rds_iw_device *rds_iwdev;
 	struct rds_iw_mr *ibmr = NULL;
 	struct rdma_cm_id *cm_id;
+	struct sockaddr_in src = {
+		.sin_addr.s_addr = rs->rs_bound_addr,
+		.sin_port = rs->rs_bound_port,
+	};
+	struct sockaddr_in dst = {
+		.sin_addr.s_addr = rs->rs_conn_addr,
+		.sin_port = rs->rs_conn_port,
+	};
 	int ret;
 
-	ret = rds_iw_get_device(rs, &rds_iwdev, &cm_id);
+	ret = rds_iw_get_device(&src, &dst, &rds_iwdev, &cm_id);
 	if (ret || !cm_id) {
 		ret = -ENODEV;
 		goto out;
Index: linux-3.18.13-rt10-r7s4/net/rxrpc/ar-recvmsg.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/rxrpc/ar-recvmsg.c
+++ linux-3.18.13-rt10-r7s4/net/rxrpc/ar-recvmsg.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:90 @ int rxrpc_recvmsg(struct kiocb *iocb, st
 		if (!skb) {
 			/* nothing remains on the queue */
 			if (copied &&
-			    (msg->msg_flags & MSG_PEEK || timeo == 0))
+			    (flags & MSG_PEEK || timeo == 0))
 				goto out;
 
 			/* wait for a message to turn up */
Index: linux-3.18.13-rt10-r7s4/net/sched/cls_u32.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/sched/cls_u32.c
+++ linux-3.18.13-rt10-r7s4/net/sched/cls_u32.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:81 @ struct tc_u_hnode {
 	struct tc_u_common	*tp_c;
 	int			refcnt;
 	unsigned int		divisor;
-	struct tc_u_knode __rcu	*ht[1];
 	struct rcu_head		rcu;
+	/* The 'ht' field MUST be the last field in structure to allow for
+	 * more entries allocated at end of structure.
+	 */
+	struct tc_u_knode __rcu	*ht[1];
 };
 
 struct tc_u_common {
Index: linux-3.18.13-rt10-r7s4/net/sched/ematch.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/sched/ematch.c
+++ linux-3.18.13-rt10-r7s4/net/sched/ematch.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:231 @ static int tcf_em_validate(struct tcf_pr
 				 * to replay the request.
 				 */
 				module_put(em->ops->owner);
+				em->ops = NULL;
 				err = -EAGAIN;
 			}
 #endif
Index: linux-3.18.13-rt10-r7s4/net/sched/sch_fq_codel.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/sched/sch_fq_codel.c
+++ linux-3.18.13-rt10-r7s4/net/sched/sch_fq_codel.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:97 @ static unsigned int fq_codel_classify(st
 	    TC_H_MIN(skb->priority) <= q->flows_cnt)
 		return TC_H_MIN(skb->priority);
 
-	filter = rcu_dereference(q->filter_list);
+	filter = rcu_dereference_bh(q->filter_list);
 	if (!filter)
 		return fq_codel_hash(q, skb) + 1;
 
Index: linux-3.18.13-rt10-r7s4/net/sctp/associola.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/sctp/associola.c
+++ linux-3.18.13-rt10-r7s4/net/sctp/associola.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1185 @ void sctp_assoc_update(struct sctp_assoc
 	asoc->peer.peer_hmacs = new->peer.peer_hmacs;
 	new->peer.peer_hmacs = NULL;
 
-	sctp_auth_key_put(asoc->asoc_shared_key);
 	sctp_auth_asoc_init_active_key(asoc, GFP_ATOMIC);
 }
 
Index: linux-3.18.13-rt10-r7s4/net/sctp/output.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/sctp/output.c
+++ linux-3.18.13-rt10-r7s4/net/sctp/output.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:404 @ int sctp_packet_transmit(struct sctp_pac
 	sk = chunk->skb->sk;
 
 	/* Allocate the new skb.  */
-	nskb = alloc_skb(packet->size + LL_MAX_HEADER, GFP_ATOMIC);
+	nskb = alloc_skb(packet->size + MAX_HEADER, GFP_ATOMIC);
 	if (!nskb)
 		goto nomem;
 
 	/* Make sure the outbound skb has enough header room reserved. */
-	skb_reserve(nskb, packet->overhead + LL_MAX_HEADER);
+	skb_reserve(nskb, packet->overhead + MAX_HEADER);
 
 	/* Set the owning socket so that we know where to get the
 	 * destination IP address.
Index: linux-3.18.13-rt10-r7s4/net/sctp/sm_make_chunk.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/sctp/sm_make_chunk.c
+++ linux-3.18.13-rt10-r7s4/net/sctp/sm_make_chunk.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2611 @ do_addr_param:
 
 		addr_param = param.v + sizeof(sctp_addip_param_t);
 
-		af = sctp_get_af_specific(param_type2af(param.p->type));
+		af = sctp_get_af_specific(param_type2af(addr_param->p.type));
 		if (af == NULL)
 			break;
 
Index: linux-3.18.13-rt10-r7s4/net/socket.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/socket.c
+++ linux-3.18.13-rt10-r7s4/net/socket.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:895 @ static ssize_t sock_splice_read(struct f
 static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
 					 struct sock_iocb *siocb)
 {
-	if (!is_sync_kiocb(iocb))
-		BUG();
-
 	siocb->kiocb = iocb;
 	iocb->private = siocb;
 	return siocb;
Index: linux-3.18.13-rt10-r7s4/net/sunrpc/backchannel_rqst.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/sunrpc/backchannel_rqst.c
+++ linux-3.18.13-rt10-r7s4/net/sunrpc/backchannel_rqst.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:312 @ void xprt_complete_bc_request(struct rpc
 	struct rpc_xprt *xprt = req->rq_xprt;
 	struct svc_serv *bc_serv = xprt->bc_serv;
 
+	spin_lock(&xprt->bc_pa_lock);
+	list_del(&req->rq_bc_pa_list);
+	spin_unlock(&xprt->bc_pa_lock);
+
 	req->rq_private_buf.len = copied;
 	set_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state);
 
 	dprintk("RPC:       add callback request to list\n");
 	spin_lock(&bc_serv->sv_cb_lock);
-	list_del(&req->rq_bc_pa_list);
 	list_add(&req->rq_bc_list, &bc_serv->sv_cb_list);
 	wake_up(&bc_serv->sv_cb_waitq);
 	spin_unlock(&bc_serv->sv_cb_lock);
Index: linux-3.18.13-rt10-r7s4/net/sunrpc/cache.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/sunrpc/cache.c
+++ linux-3.18.13-rt10-r7s4/net/sunrpc/cache.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:923 @ static unsigned int cache_poll(struct fi
 	poll_wait(filp, &queue_wait, wait);
 
 	/* alway allow write */
-	mask = POLL_OUT | POLLWRNORM;
+	mask = POLLOUT | POLLWRNORM;
 
 	if (!rp)
 		return mask;
Index: linux-3.18.13-rt10-r7s4/net/sunrpc/clnt.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/sunrpc/clnt.c
+++ linux-3.18.13-rt10-r7s4/net/sunrpc/clnt.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:289 @ static struct rpc_xprt *rpc_clnt_set_tra
 
 static void rpc_clnt_set_nodename(struct rpc_clnt *clnt, const char *nodename)
 {
-	clnt->cl_nodelen = strlen(nodename);
-	if (clnt->cl_nodelen > UNX_MAXNODENAME)
-		clnt->cl_nodelen = UNX_MAXNODENAME;
-	memcpy(clnt->cl_nodename, nodename, clnt->cl_nodelen);
+	clnt->cl_nodelen = strlcpy(clnt->cl_nodename,
+			nodename, sizeof(clnt->cl_nodename));
 }
 
 static int rpc_client_register(struct rpc_clnt *clnt,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:361 @ static struct rpc_clnt * rpc_new_client(
 	const struct rpc_version *version;
 	struct rpc_clnt *clnt = NULL;
 	const struct rpc_timeout *timeout;
+	const char *nodename = args->nodename;
 	int err;
 
 	/* sanity check the name before trying to print it */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:417 @ static struct rpc_clnt * rpc_new_client(
 
 	atomic_set(&clnt->cl_count, 1);
 
+	if (nodename == NULL)
+		nodename = utsname()->nodename;
 	/* save the nodename */
-	rpc_clnt_set_nodename(clnt, utsname()->nodename);
+	rpc_clnt_set_nodename(clnt, nodename);
 
 	err = rpc_client_register(clnt, args->authflavor, args->client_name);
 	if (err)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:575 @ static struct rpc_clnt *__rpc_clone_clie
 	if (xprt == NULL)
 		goto out_err;
 	args->servername = xprt->servername;
+	args->nodename = clnt->cl_nodename;
 
 	new = rpc_new_client(args, xprt, clnt);
 	if (IS_ERR(new)) {
Index: linux-3.18.13-rt10-r7s4/net/sunrpc/rpcb_clnt.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/sunrpc/rpcb_clnt.c
+++ linux-3.18.13-rt10-r7s4/net/sunrpc/rpcb_clnt.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:358 @ out:
 	return result;
 }
 
-static struct rpc_clnt *rpcb_create(struct net *net, const char *hostname,
+static struct rpc_clnt *rpcb_create(struct net *net, const char *nodename,
+				    const char *hostname,
 				    struct sockaddr *srvaddr, size_t salen,
 				    int proto, u32 version)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:369 @ static struct rpc_clnt *rpcb_create(stru
 		.address	= srvaddr,
 		.addrsize	= salen,
 		.servername	= hostname,
+		.nodename	= nodename,
 		.program	= &rpcb_program,
 		.version	= version,
 		.authflavor	= RPC_AUTH_UNIX,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:745 @ void rpcb_getport_async(struct rpc_task
 	dprintk("RPC: %5u %s: trying rpcbind version %u\n",
 		task->tk_pid, __func__, bind_version);
 
-	rpcb_clnt = rpcb_create(xprt->xprt_net, xprt->servername, sap, salen,
+	rpcb_clnt = rpcb_create(xprt->xprt_net,
+				clnt->cl_nodename,
+				xprt->servername, sap, salen,
 				xprt->prot, bind_version);
 	if (IS_ERR(rpcb_clnt)) {
 		status = PTR_ERR(rpcb_clnt);
Index: linux-3.18.13-rt10-r7s4/net/sunrpc/xdr.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/sunrpc/xdr.c
+++ linux-3.18.13-rt10-r7s4/net/sunrpc/xdr.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:609 @ void xdr_truncate_encode(struct xdr_stre
 	struct kvec *head = buf->head;
 	struct kvec *tail = buf->tail;
 	int fraglen;
-	int new, old;
+	int new;
 
 	if (len > buf->len) {
 		WARN_ON_ONCE(1);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:631 @ void xdr_truncate_encode(struct xdr_stre
 	buf->len -= fraglen;
 
 	new = buf->page_base + buf->page_len;
-	old = new + fraglen;
-	xdr->page_ptr -= (old >> PAGE_SHIFT) - (new >> PAGE_SHIFT);
+
+	xdr->page_ptr = buf->pages + (new >> PAGE_SHIFT);
 
 	if (buf->page_len && buf->len == len) {
 		xdr->p = page_address(*xdr->page_ptr);
Index: linux-3.18.13-rt10-r7s4/net/wireless/chan.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/wireless/chan.c
+++ linux-3.18.13-rt10-r7s4/net/wireless/chan.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:605 @ bool cfg80211_chandef_usable(struct wiph
 {
 	struct ieee80211_sta_ht_cap *ht_cap;
 	struct ieee80211_sta_vht_cap *vht_cap;
-	u32 width, control_freq;
+	u32 width, control_freq, cap;
 
 	if (WARN_ON(!cfg80211_chandef_valid(chandef)))
 		return false;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:645 @ bool cfg80211_chandef_usable(struct wiph
 			return false;
 		break;
 	case NL80211_CHAN_WIDTH_80P80:
-		if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ))
+		cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
+		if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
 			return false;
 	case NL80211_CHAN_WIDTH_80:
 		if (!vht_cap->vht_supported)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:657 @ bool cfg80211_chandef_usable(struct wiph
 	case NL80211_CHAN_WIDTH_160:
 		if (!vht_cap->vht_supported)
 			return false;
-		if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ))
+		cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
+		if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ &&
+		    cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
 			return false;
 		prohibited_flags |= IEEE80211_CHAN_NO_160MHZ;
 		width = 160;
Index: linux-3.18.13-rt10-r7s4/net/wireless/nl80211.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/wireless/nl80211.c
+++ linux-3.18.13-rt10-r7s4/net/wireless/nl80211.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2808 @ static int nl80211_get_key(struct sk_buf
 	if (!rdev->ops->get_key)
 		return -EOPNOTSUPP;
 
+	if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
+		return -ENOENT;
+
 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 	if (!msg)
 		return -ENOMEM;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2830 @ static int nl80211_get_key(struct sk_buf
 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
 		goto nla_put_failure;
 
-	if (pairwise && mac_addr &&
-	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
-		return -ENOENT;
-
 	err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
 			   get_key_callback);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3000 @ static int nl80211_del_key(struct sk_buf
 	wdev_lock(dev->ieee80211_ptr);
 	err = nl80211_key_allowed(dev->ieee80211_ptr);
 
-	if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
+	if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
 	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
 		err = -ENOENT;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4314 @ static int nl80211_new_station(struct sk
 	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
 		return -EINVAL;
 
+	/* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
+	 * as userspace might just pass through the capabilities from the IEs
+	 * directly, rather than enforcing this restriction and returning an
+	 * error in this case.
+	 */
+	if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
+		params.ht_capa = NULL;
+		params.vht_capa = NULL;
+	}
+
 	/* When you run into this, adjust the code below for the new flag */
 	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5811 @ static int nl80211_start_sched_scan(stru
 		}
 
 		/* there was no other matchset, so the RSSI one is alone */
-		if (i == 0)
+		if (i == 0 && n_match_sets)
 			request->match_sets[0].rssi_thold = default_match_rssi;
 
 		request->min_rssi_thold = INT_MAX;
Index: linux-3.18.13-rt10-r7s4/net/wireless/reg.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/net/wireless/reg.c
+++ linux-3.18.13-rt10-r7s4/net/wireless/reg.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1763 @ static enum reg_request_treatment
 reg_process_hint_driver(struct wiphy *wiphy,
 			struct regulatory_request *driver_request)
 {
-	const struct ieee80211_regdomain *regd;
+	const struct ieee80211_regdomain *regd, *tmp;
 	enum reg_request_treatment treatment;
 
 	treatment = __reg_process_hint_driver(driver_request);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1783 @ reg_process_hint_driver(struct wiphy *wi
 			reg_free_request(driver_request);
 			return REG_REQ_IGNORE;
 		}
+
+		tmp = get_wiphy_regdom(wiphy);
 		rcu_assign_pointer(wiphy->regd, regd);
+		rcu_free_regdom(tmp);
 	}
 
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1845 @ __reg_process_hint_country_ie(struct wip
 			return REG_REQ_IGNORE;
 		return REG_REQ_ALREADY_SET;
 	}
-	/*
-	 * Two consecutive Country IE hints on the same wiphy.
-	 * This should be picked up early by the driver/stack
-	 */
-	if (WARN_ON(regdom_changes(country_ie_request->alpha2)))
+
+	if (regdom_changes(country_ie_request->alpha2))
 		return REG_REQ_OK;
 	return REG_REQ_ALREADY_SET;
 }
Index: linux-3.18.13-rt10-r7s4/scripts/Makefile.clean
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/scripts/Makefile.clean
+++ linux-3.18.13-rt10-r7s4/scripts/Makefile.clean
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:48 @ __clean-files	:= $(extra-y) $(extra-m) $
 
 __clean-files   := $(filter-out $(no-clean-files), $(__clean-files))
 
-# as clean-files is given relative to the current directory, this adds
-# a $(obj) prefix, except for absolute paths
+# clean-files is given relative to the current directory, unless it
+# starts with $(objtree)/ (which means "./", so do not add "./" unless
+# you want to delete a file from the toplevel object directory).
 
 __clean-files   := $(wildcard                                               \
-                   $(addprefix $(obj)/, $(filter-out /%, $(__clean-files))) \
-		   $(filter /%, $(__clean-files)))
+		   $(addprefix $(obj)/, $(filter-out $(objtree)/%, $(__clean-files))) \
+		   $(filter $(objtree)/%, $(__clean-files)))
 
-# as clean-dirs is given relative to the current directory, this adds
-# a $(obj) prefix, except for absolute paths
+# same as clean-files
 
 __clean-dirs    := $(wildcard                                               \
-                   $(addprefix $(obj)/, $(filter-out /%, $(clean-dirs)))    \
-		   $(filter /%, $(clean-dirs)))
+		   $(addprefix $(obj)/, $(filter-out $(objtree)/%, $(clean-dirs)))    \
+		   $(filter $(objtree)/%, $(clean-dirs)))
 
 # ==========================================================================
 
Index: linux-3.18.13-rt10-r7s4/scripts/coccinelle/misc/bugon.cocci
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/scripts/coccinelle/misc/bugon.cocci
+++ linux-3.18.13-rt10-r7s4/scripts/coccinelle/misc/bugon.cocci
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:11 @
 // Confidence: High
 // Copyright: (C) 2014 Himangi Saraogi.  GPLv2.
 // Comments:
-// Options: --no-includes, --include-headers
+// Options: --no-includes --include-headers
 
 virtual patch
 virtual context
Index: linux-3.18.13-rt10-r7s4/scripts/kconfig/menu.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/scripts/kconfig/menu.c
+++ linux-3.18.13-rt10-r7s4/scripts/kconfig/menu.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:551 @ static void get_prompt_str(struct gstr *
 {
 	int i, j;
 	struct menu *submenu[8], *menu, *location = NULL;
-	struct jump_key *jump;
+	struct jump_key *jump = NULL;
 
 	str_printf(r, _("Prompt: %s\n"), _(prop->text));
 	menu = prop->menu->parent;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:589 @ static void get_prompt_str(struct gstr *
 		str_printf(r, _("  Location:\n"));
 		for (j = 4; --i >= 0; j += 2) {
 			menu = submenu[i];
-			if (head && location && menu == location)
+			if (jump && menu == location)
 				jump->offset = strlen(r->s);
 			str_printf(r, "%*c-> %s", j, ' ',
 				   _(menu_get_prompt(menu)));
Index: linux-3.18.13-rt10-r7s4/scripts/kernel-doc
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/scripts/kernel-doc
+++ linux-3.18.13-rt10-r7s4/scripts/kernel-doc
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1756 @ sub dump_struct($$) {
 	# strip kmemcheck_bitfield_{begin,end}.*;
 	$members =~ s/kmemcheck_bitfield_.*?;//gos;
 	# strip attributes
-	$members =~ s/__aligned\s*\(.+\)//gos;
+	$members =~ s/__aligned\s*\([^;]*\)//gos;
 
 	create_parameterlist($members, ';', $file);
 	check_sections($file, $declaration_name, "struct", $sectcheck, $struct_actual, $nested);
Index: linux-3.18.13-rt10-r7s4/scripts/recordmcount.pl
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/scripts/recordmcount.pl
+++ linux-3.18.13-rt10-r7s4/scripts/recordmcount.pl
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:258 @ if ($arch eq "x86_64") {
     # force flags for this arch
     $ld .= " -m shlelf_linux";
     $objcopy .= " -O elf32-sh-linux";
-    $cc .= " -m32";
 
 } elsif ($arch eq "powerpc") {
     $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)";
Index: linux-3.18.13-rt10-r7s4/security/keys/encrypted-keys/encrypted.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/security/keys/encrypted-keys/encrypted.c
+++ linux-3.18.13-rt10-r7s4/security/keys/encrypted-keys/encrypted.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1020 @ static int __init init_encrypted(void)
 	ret = encrypted_shash_alloc();
 	if (ret < 0)
 		return ret;
+	ret = aes_get_sizes();
+	if (ret < 0)
+		goto out;
 	ret = register_key_type(&key_type_encrypted);
 	if (ret < 0)
 		goto out;
-	return aes_get_sizes();
+	return 0;
 out:
 	encrypted_shash_release();
 	return ret;
Index: linux-3.18.13-rt10-r7s4/security/keys/gc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/security/keys/gc.c
+++ linux-3.18.13-rt10-r7s4/security/keys/gc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:151 @ static noinline void key_gc_unused_keys(
 		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
 			atomic_dec(&key->user->nikeys);
 
-		key_user_put(key->user);
-
 		/* now throw away the key memory */
 		if (key->type->destroy)
 			key->type->destroy(key);
 
+		key_user_put(key->user);
+
 		kfree(key->description);
 
 #ifdef KEY_DEBUGGING
Index: linux-3.18.13-rt10-r7s4/security/selinux/selinuxfs.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/security/selinux/selinuxfs.c
+++ linux-3.18.13-rt10-r7s4/security/selinux/selinuxfs.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:155 @ static ssize_t sel_write_enforce(struct
 		goto out;
 
 	/* No partial writes. */
-	length = EINVAL;
+	length = -EINVAL;
 	if (*ppos != 0)
 		goto out;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1203 @ static void sel_remove_entries(struct de
 	spin_lock(&de->d_lock);
 	node = de->d_subdirs.next;
 	while (node != &de->d_subdirs) {
-		struct dentry *d = list_entry(node, struct dentry, d_u.d_child);
+		struct dentry *d = list_entry(node, struct dentry, d_child);
 
 		spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED);
 		list_del_init(node);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1677 @ static void sel_remove_classes(void)
 
 	list_for_each(class_node, &class_dir->d_subdirs) {
 		struct dentry *class_subdir = list_entry(class_node,
-					struct dentry, d_u.d_child);
+					struct dentry, d_child);
 		struct list_head *class_subdir_node;
 
 		list_for_each(class_subdir_node, &class_subdir->d_subdirs) {
 			struct dentry *d = list_entry(class_subdir_node,
-						struct dentry, d_u.d_child);
+						struct dentry, d_child);
 
 			if (d->d_inode)
 				if (d->d_inode->i_mode & S_IFDIR)
Index: linux-3.18.13-rt10-r7s4/security/smack/smack.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/security/smack/smack.h
+++ linux-3.18.13-rt10-r7s4/security/smack/smack.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:301 @ static inline struct smack_known *smk_of
 	return tsp->smk_task;
 }
 
+static inline struct smack_known *smk_of_task_struct(const struct task_struct *t)
+{
+	struct smack_known *skp;
+
+	rcu_read_lock();
+	skp = smk_of_task(__task_cred(t)->security);
+	rcu_read_unlock();
+	return skp;
+}
+
 /*
  * Present a pointer to the forked smack label entry in an task blob.
  */
Index: linux-3.18.13-rt10-r7s4/security/smack/smack_lsm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/security/smack/smack_lsm.c
+++ linux-3.18.13-rt10-r7s4/security/smack/smack_lsm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:46 @
 #include <linux/binfmts.h>
 #include "smack.h"
 
-#define task_security(task)	(task_cred_xxx((task), security))
-
 #define TRANS_TRUE	"TRUE"
 #define TRANS_TRUE_SIZE	4
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:120 @ static int smk_bu_current(char *note, st
 static int smk_bu_task(struct task_struct *otp, int mode, int rc)
 {
 	struct task_smack *tsp = current_security();
-	struct task_smack *otsp = task_security(otp);
+	struct smack_known *smk_task = smk_of_task_struct(otp);
 	char acc[SMK_NUM_ACCESS_TYPE + 1];
 
 	if (rc <= 0)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:128 @ static int smk_bu_task(struct task_struc
 
 	smk_bu_mode(mode, acc);
 	pr_info("Smack Bringup: (%s %s %s) %s to %s\n",
-		tsp->smk_task->smk_known, otsp->smk_task->smk_known, acc,
+		tsp->smk_task->smk_known, smk_task->smk_known, acc,
 		current->comm, otp->comm);
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:345 @ static int smk_ptrace_rule_check(struct
 		saip = &ad;
 	}
 
-	tsp = task_security(tracer);
+	rcu_read_lock();
+	tsp = __task_cred(tracer)->security;
 	tracer_known = smk_of_task(tsp);
 
 	if ((mode & PTRACE_MODE_ATTACH) &&
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:366 @ static int smk_ptrace_rule_check(struct
 				  tracee_known->smk_known,
 				  0, rc, saip);
 
+		rcu_read_unlock();
 		return rc;
 	}
 
 	/* In case of rule==SMACK_PTRACE_DEFAULT or mode==PTRACE_MODE_READ */
 	rc = smk_tskacc(tsp, tracee_known, smk_ptrace_mode(mode), saip);
+
+	rcu_read_unlock();
 	return rc;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:400 @ static int smack_ptrace_access_check(str
 	if (rc != 0)
 		return rc;
 
-	skp = smk_of_task(task_security(ctp));
+	skp = smk_of_task_struct(ctp);
 
 	rc = smk_ptrace_rule_check(current, skp, mode, __func__);
 	return rc;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1830 @ static int smk_curacc_on_task(struct tas
 				const char *caller)
 {
 	struct smk_audit_info ad;
-	struct smack_known *skp = smk_of_task(task_security(p));
+	struct smack_known *skp = smk_of_task_struct(p);
 	int rc;
 
 	smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1883 @ static int smack_task_getsid(struct task
  */
 static void smack_task_getsecid(struct task_struct *p, u32 *secid)
 {
-	struct smack_known *skp = smk_of_task(task_security(p));
+	struct smack_known *skp = smk_of_task_struct(p);
 
 	*secid = skp->smk_secid;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1990 @ static int smack_task_kill(struct task_s
 {
 	struct smk_audit_info ad;
 	struct smack_known *skp;
-	struct smack_known *tkp = smk_of_task(task_security(p));
+	struct smack_known *tkp = smk_of_task_struct(p);
 	int rc;
 
 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2044 @ static int smack_task_wait(struct task_s
 static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
 {
 	struct inode_smack *isp = inode->i_security;
-	struct smack_known *skp = smk_of_task(task_security(p));
+	struct smack_known *skp = smk_of_task_struct(p);
 
 	isp->smk_inode = skp;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3204 @ unlockandout:
  */
 static int smack_getprocattr(struct task_struct *p, char *name, char **value)
 {
-	struct smack_known *skp = smk_of_task(task_security(p));
+	struct smack_known *skp = smk_of_task_struct(p);
 	char *cp;
 	int slen;
 
Index: linux-3.18.13-rt10-r7s4/sound/core/control.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/core/control.c
+++ linux-3.18.13-rt10-r7s4/sound/core/control.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1170 @ static int snd_ctl_elem_add(struct snd_c
 
 	if (info->count < 1)
 		return -EINVAL;
+	if (!*info->id.name)
+		return -EINVAL;
+	if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
+		return -EINVAL;
 	access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
 		(info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
 				 SNDRV_CTL_ELEM_ACCESS_INACTIVE|
Index: linux-3.18.13-rt10-r7s4/sound/core/pcm_native.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/core/pcm_native.c
+++ linux-3.18.13-rt10-r7s4/sound/core/pcm_native.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1526 @ static int snd_pcm_do_drain_init(struct
 			if (! snd_pcm_playback_empty(substream)) {
 				snd_pcm_do_start(substream, SNDRV_PCM_STATE_DRAINING);
 				snd_pcm_post_start(substream, SNDRV_PCM_STATE_DRAINING);
+			} else {
+				runtime->status->state = SNDRV_PCM_STATE_SETUP;
 			}
 			break;
 		case SNDRV_PCM_STATE_RUNNING:
Index: linux-3.18.13-rt10-r7s4/sound/core/seq/seq_dummy.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/core/seq/seq_dummy.c
+++ linux-3.18.13-rt10-r7s4/sound/core/seq/seq_dummy.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:85 @ struct snd_seq_dummy_port {
 static int my_client = -1;
 
 /*
- * unuse callback - send ALL_SOUNDS_OFF and RESET_CONTROLLERS events
- * to subscribers.
- * Note: this callback is called only after all subscribers are removed.
- */
-static int
-dummy_unuse(void *private_data, struct snd_seq_port_subscribe *info)
-{
-	struct snd_seq_dummy_port *p;
-	int i;
-	struct snd_seq_event ev;
-
-	p = private_data;
-	memset(&ev, 0, sizeof(ev));
-	if (p->duplex)
-		ev.source.port = p->connect;
-	else
-		ev.source.port = p->port;
-	ev.dest.client = SNDRV_SEQ_ADDRESS_SUBSCRIBERS;
-	ev.type = SNDRV_SEQ_EVENT_CONTROLLER;
-	for (i = 0; i < 16; i++) {
-		ev.data.control.channel = i;
-		ev.data.control.param = MIDI_CTL_ALL_SOUNDS_OFF;
-		snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0);
-		ev.data.control.param = MIDI_CTL_RESET_CONTROLLERS;
-		snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0);
-	}
-	return 0;
-}
-
-/*
  * event input callback - just redirect events to subscribers
  */
 static int
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:148 @ create_port(int idx, int type)
 		| SNDRV_SEQ_PORT_TYPE_PORT;
 	memset(&pcb, 0, sizeof(pcb));
 	pcb.owner = THIS_MODULE;
-	pcb.unuse = dummy_unuse;
 	pcb.event_input = dummy_input;
 	pcb.private_free = dummy_free;
 	pcb.private_data = rec;
Index: linux-3.18.13-rt10-r7s4/sound/firewire/bebob/bebob_maudio.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/firewire/bebob/bebob_maudio.c
+++ linux-3.18.13-rt10-r7s4/sound/firewire/bebob/bebob_maudio.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:99 @ int snd_bebob_maudio_load_firmware(struc
 	struct fw_device *device = fw_parent_device(unit);
 	int err, rcode;
 	u64 date;
-	__be32 cues[3] = {
-		MAUDIO_BOOTLOADER_CUE1,
-		MAUDIO_BOOTLOADER_CUE2,
-		MAUDIO_BOOTLOADER_CUE3
+	__le32 cues[3] = {
+		cpu_to_le32(MAUDIO_BOOTLOADER_CUE1),
+		cpu_to_le32(MAUDIO_BOOTLOADER_CUE2),
+		cpu_to_le32(MAUDIO_BOOTLOADER_CUE3)
 	};
 
 	/* check date of software used to build */
Index: linux-3.18.13-rt10-r7s4/sound/firewire/fireworks/fireworks_transaction.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/firewire/fireworks/fireworks_transaction.c
+++ linux-3.18.13-rt10-r7s4/sound/firewire/fireworks/fireworks_transaction.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:127 @ copy_resp_to_buf(struct snd_efw *efw, vo
 	spin_lock_irq(&efw->lock);
 
 	t = (struct snd_efw_transaction *)data;
-	length = min_t(size_t, t->length * sizeof(t->length), length);
+	length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length);
 
 	if (efw->push_ptr < efw->pull_ptr)
 		capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr);
Index: linux-3.18.13-rt10-r7s4/sound/i2c/other/ak4113.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/i2c/other/ak4113.c
+++ linux-3.18.13-rt10-r7s4/sound/i2c/other/ak4113.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:59 @ static inline unsigned char reg_read(str
 
 static void snd_ak4113_free(struct ak4113 *chip)
 {
-	chip->init = 1;	/* don't schedule new work */
-	mb();
+	atomic_inc(&chip->wq_processing);	/* don't schedule new work */
 	cancel_delayed_work_sync(&chip->work);
 	kfree(chip);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:91 @ int snd_ak4113_create(struct snd_card *c
 	chip->write = write;
 	chip->private_data = private_data;
 	INIT_DELAYED_WORK(&chip->work, ak4113_stats);
+	atomic_set(&chip->wq_processing, 0);
 
 	for (reg = 0; reg < AK4113_WRITABLE_REGS ; reg++)
 		chip->regmap[reg] = pgm[reg];
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:142 @ static void ak4113_init_regs(struct ak41
 
 void snd_ak4113_reinit(struct ak4113 *chip)
 {
-	chip->init = 1;
-	mb();
-	flush_delayed_work(&chip->work);
+	if (atomic_inc_return(&chip->wq_processing) == 1)
+		cancel_delayed_work_sync(&chip->work);
 	ak4113_init_regs(chip);
 	/* bring up statistics / event queing */
-	chip->init = 0;
-	if (chip->kctls[0])
+	if (atomic_dec_and_test(&chip->wq_processing))
 		schedule_delayed_work(&chip->work, HZ / 10);
 }
 EXPORT_SYMBOL_GPL(snd_ak4113_reinit);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:633 @ static void ak4113_stats(struct work_str
 {
 	struct ak4113 *chip = container_of(work, struct ak4113, work.work);
 
-	if (!chip->init)
+	if (atomic_inc_return(&chip->wq_processing) == 1)
 		snd_ak4113_check_rate_and_errors(chip, chip->check_flags);
 
-	schedule_delayed_work(&chip->work, HZ / 10);
+	if (atomic_dec_and_test(&chip->wq_processing))
+		schedule_delayed_work(&chip->work, HZ / 10);
 }
Index: linux-3.18.13-rt10-r7s4/sound/i2c/other/ak4114.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/i2c/other/ak4114.c
+++ linux-3.18.13-rt10-r7s4/sound/i2c/other/ak4114.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:69 @ static void reg_dump(struct ak4114 *ak41
 
 static void snd_ak4114_free(struct ak4114 *chip)
 {
-	chip->init = 1;	/* don't schedule new work */
-	mb();
+	atomic_inc(&chip->wq_processing);	/* don't schedule new work */
 	cancel_delayed_work_sync(&chip->work);
 	kfree(chip);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:102 @ int snd_ak4114_create(struct snd_card *c
 	chip->write = write;
 	chip->private_data = private_data;
 	INIT_DELAYED_WORK(&chip->work, ak4114_stats);
+	atomic_set(&chip->wq_processing, 0);
 
 	for (reg = 0; reg < 6; reg++)
 		chip->regmap[reg] = pgm[reg];
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:155 @ static void ak4114_init_regs(struct ak41
 
 void snd_ak4114_reinit(struct ak4114 *chip)
 {
-	chip->init = 1;
-	mb();
-	flush_delayed_work(&chip->work);
+	if (atomic_inc_return(&chip->wq_processing) == 1)
+		cancel_delayed_work_sync(&chip->work);
 	ak4114_init_regs(chip);
 	/* bring up statistics / event queing */
-	chip->init = 0;
-	if (chip->kctls[0])
+	if (atomic_dec_and_test(&chip->wq_processing))
 		schedule_delayed_work(&chip->work, HZ / 10);
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:613 @ static void ak4114_stats(struct work_str
 {
 	struct ak4114 *chip = container_of(work, struct ak4114, work.work);
 
-	if (!chip->init)
+	if (atomic_inc_return(&chip->wq_processing) == 1)
 		snd_ak4114_check_rate_and_errors(chip, chip->check_flags);
-
-	schedule_delayed_work(&chip->work, HZ / 10);
+	if (atomic_dec_and_test(&chip->wq_processing))
+		schedule_delayed_work(&chip->work, HZ / 10);
 }
 
 EXPORT_SYMBOL(snd_ak4114_create);
Index: linux-3.18.13-rt10-r7s4/sound/pci/hda/hda_codec.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/pci/hda/hda_codec.c
+++ linux-3.18.13-rt10-r7s4/sound/pci/hda/hda_codec.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:341 @ int snd_hda_get_sub_nodes(struct hda_cod
 	unsigned int parm;
 
 	parm = snd_hda_param_read(codec, nid, AC_PAR_NODE_COUNT);
-	if (parm == -1)
+	if (parm == -1) {
+		*start_id = 0;
 		return 0;
+	}
 	*start_id = (parm >> 16) & 0x7fff;
 	return (int)(parm & 0x7fff);
 }
Index: linux-3.18.13-rt10-r7s4/sound/pci/hda/hda_controller.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/pci/hda/hda_controller.c
+++ linux-3.18.13-rt10-r7s4/sound/pci/hda/hda_controller.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:960 @ static int azx_alloc_cmd_io(struct azx *
 		dev_err(chip->card->dev, "cannot allocate CORB/RIRB\n");
 	return err;
 }
-EXPORT_SYMBOL_GPL(azx_alloc_cmd_io);
 
 static void azx_init_cmd_io(struct azx *chip)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1024 @ static void azx_init_cmd_io(struct azx *
 	azx_writeb(chip, RIRBCTL, AZX_RBCTL_DMA_EN | AZX_RBCTL_IRQ_EN);
 	spin_unlock_irq(&chip->reg_lock);
 }
-EXPORT_SYMBOL_GPL(azx_init_cmd_io);
 
 static void azx_free_cmd_io(struct azx *chip)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1033 @ static void azx_free_cmd_io(struct azx *
 	azx_writeb(chip, CORBCTL, 0);
 	spin_unlock_irq(&chip->reg_lock);
 }
-EXPORT_SYMBOL_GPL(azx_free_cmd_io);
 
 static unsigned int azx_command_addr(u32 cmd)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1163 @ static unsigned int azx_rirb_get_respons
 		}
 	}
 
-	if (!bus->no_response_fallback)
+	if (bus->no_response_fallback)
 		return -1;
 
 	if (!chip->polling_mode && chip->poll_count < 2) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1312 @ static int azx_send_cmd(struct hda_bus *
 	else
 		return azx_corb_send_cmd(bus, val);
 }
-EXPORT_SYMBOL_GPL(azx_send_cmd);
 
 /* get a response */
 static unsigned int azx_get_response(struct hda_bus *bus,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1325 @ static unsigned int azx_get_response(str
 	else
 		return azx_rirb_get_response(bus, addr);
 }
-EXPORT_SYMBOL_GPL(azx_get_response);
 
 #ifdef CONFIG_SND_HDA_DSP_LOADER
 /*
Index: linux-3.18.13-rt10-r7s4/sound/pci/hda/hda_generic.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/pci/hda/hda_generic.c
+++ linux-3.18.13-rt10-r7s4/sound/pci/hda/hda_generic.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:640 @ static int get_amp_val_to_activate(struc
 	return val;
 }
 
+/* is this a stereo widget or a stereo-to-mono mix? */
+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid, int dir)
+{
+	unsigned int wcaps = get_wcaps(codec, nid);
+	hda_nid_t conn;
+
+	if (wcaps & AC_WCAP_STEREO)
+		return true;
+	if (dir != HDA_INPUT || get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
+		return false;
+	if (snd_hda_get_num_conns(codec, nid) != 1)
+		return false;
+	if (snd_hda_get_connections(codec, nid, &conn, 1) < 0)
+		return false;
+	return !!(get_wcaps(codec, conn) & AC_WCAP_STEREO);
+}
+
 /* initialize the amp value (only at the first time) */
 static void init_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx)
 {
 	unsigned int caps = query_amp_caps(codec, nid, dir);
 	int val = get_amp_val_to_activate(codec, nid, dir, caps, false);
-	snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
+
+	if (is_stereo_amps(codec, nid, dir))
+		snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
+	else
+		snd_hda_codec_amp_init(codec, nid, 0, dir, idx, 0xff, val);
+}
+
+/* update the amp, doing in stereo or mono depending on NID */
+static int update_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx,
+		      unsigned int mask, unsigned int val)
+{
+	if (is_stereo_amps(codec, nid, dir))
+		return snd_hda_codec_amp_stereo(codec, nid, dir, idx,
+						mask, val);
+	else
+		return snd_hda_codec_amp_update(codec, nid, 0, dir, idx,
+						mask, val);
 }
 
 /* calculate amp value mask we can modify;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:718 @ static void activate_amp(struct hda_code
 		return;
 
 	val &= mask;
-	snd_hda_codec_amp_stereo(codec, nid, dir, idx, mask, val);
+	update_amp(codec, nid, dir, idx, mask, val);
 }
 
 static void activate_amp_out(struct hda_codec *codec, struct nid_path *path,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4367 @ static void mute_all_mixer_nid(struct hd
 	has_amp = nid_has_mute(codec, mix, HDA_INPUT);
 	for (i = 0; i < nums; i++) {
 		if (has_amp)
-			snd_hda_codec_amp_stereo(codec, mix,
-						 HDA_INPUT, i,
-						 0xff, HDA_AMP_MUTE);
+			update_amp(codec, mix, HDA_INPUT, i,
+				   0xff, HDA_AMP_MUTE);
 		else if (nid_has_volume(codec, conn[i], HDA_OUTPUT))
-			snd_hda_codec_amp_stereo(codec, conn[i],
-						 HDA_OUTPUT, 0,
-						 0xff, HDA_AMP_MUTE);
+			update_amp(codec, conn[i], HDA_OUTPUT, 0,
+				   0xff, HDA_AMP_MUTE);
 	}
 }
 
Index: linux-3.18.13-rt10-r7s4/sound/pci/hda/hda_intel.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/pci/hda/hda_intel.c
+++ linux-3.18.13-rt10-r7s4/sound/pci/hda/hda_intel.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1998 @ static const struct pci_device_id azx_id
 	  .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM },
 	/* Panther Point */
 	{ PCI_DEVICE(0x8086, 0x1e20),
-	  .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+	  .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM },
 	/* Lynx Point */
 	{ PCI_DEVICE(0x8086, 0x8c20),
 	  .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
Index: linux-3.18.13-rt10-r7s4/sound/pci/hda/hda_proc.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/pci/hda/hda_proc.c
+++ linux-3.18.13-rt10-r7s4/sound/pci/hda/hda_proc.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:137 @ static void print_amp_caps(struct snd_in
 		    (caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT);
 }
 
+/* is this a stereo widget or a stereo-to-mono mix? */
+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid,
+			   int dir, unsigned int wcaps, int indices)
+{
+	hda_nid_t conn;
+
+	if (wcaps & AC_WCAP_STEREO)
+		return true;
+	/* check for a stereo-to-mono mix; it must be:
+	 * only a single connection, only for input, and only a mixer widget
+	 */
+	if (indices != 1 || dir != HDA_INPUT ||
+	    get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
+		return false;
+
+	if (snd_hda_get_raw_connections(codec, nid, &conn, 1) < 0)
+		return false;
+	/* the connection source is a stereo? */
+	wcaps = snd_hda_param_read(codec, conn, AC_PAR_AUDIO_WIDGET_CAP);
+	return !!(wcaps & AC_WCAP_STEREO);
+}
+
 static void print_amp_vals(struct snd_info_buffer *buffer,
 			   struct hda_codec *codec, hda_nid_t nid,
-			   int dir, int stereo, int indices)
+			   int dir, unsigned int wcaps, int indices)
 {
 	unsigned int val;
+	bool stereo;
 	int i;
 
+	stereo = is_stereo_amps(codec, nid, dir, wcaps, indices);
+
 	dir = dir == HDA_OUTPUT ? AC_AMP_GET_OUTPUT : AC_AMP_GET_INPUT;
 	for (i = 0; i < indices; i++) {
 		snd_iprintf(buffer, " [");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:785 @ static void print_codec_info(struct snd_
 			    (codec->single_adc_amp &&
 			     wid_type == AC_WID_AUD_IN))
 				print_amp_vals(buffer, codec, nid, HDA_INPUT,
-					       wid_caps & AC_WCAP_STEREO,
-					       1);
+					       wid_caps, 1);
 			else
 				print_amp_vals(buffer, codec, nid, HDA_INPUT,
-					       wid_caps & AC_WCAP_STEREO,
-					       conn_len);
+					       wid_caps, conn_len);
 		}
 		if (wid_caps & AC_WCAP_OUT_AMP) {
 			snd_iprintf(buffer, "  Amp-Out caps: ");
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:797 @ static void print_codec_info(struct snd_
 			if (wid_type == AC_WID_PIN &&
 			    codec->pin_amp_workaround)
 				print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-					       wid_caps & AC_WCAP_STEREO,
-					       conn_len);
+					       wid_caps, conn_len);
 			else
 				print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-					       wid_caps & AC_WCAP_STEREO, 1);
+					       wid_caps, 1);
 		}
 
 		switch (wid_type) {
Index: linux-3.18.13-rt10-r7s4/sound/pci/hda/patch_analog.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/pci/hda/patch_analog.c
+++ linux-3.18.13-rt10-r7s4/sound/pci/hda/patch_analog.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:335 @ static const struct hda_fixup ad1986a_fi
 
 static const struct snd_pci_quirk ad1986a_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x30af, "HP B2800", AD1986A_FIXUP_LAPTOP_IMIC),
+	SND_PCI_QUIRK(0x1043, 0x1443, "ASUS Z99He", AD1986A_FIXUP_EAPD),
 	SND_PCI_QUIRK(0x1043, 0x1447, "ASUS A8JN", AD1986A_FIXUP_EAPD),
 	SND_PCI_QUIRK_MASK(0x1043, 0xff00, 0x8100, "ASUS P5", AD1986A_FIXUP_3STACK),
 	SND_PCI_QUIRK_MASK(0x1043, 0xff00, 0x8200, "ASUS M2", AD1986A_FIXUP_3STACK),
Index: linux-3.18.13-rt10-r7s4/sound/pci/hda/patch_cirrus.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/pci/hda/patch_cirrus.c
+++ linux-3.18.13-rt10-r7s4/sound/pci/hda/patch_cirrus.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:396 @ static const struct snd_pci_quirk cs420x
 	SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
 	SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
 	SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
+	SND_PCI_QUIRK(0x106b, 0x5600, "MacBookAir 5,2", CS420X_MBP81),
 	SND_PCI_QUIRK(0x106b, 0x5b00, "MacBookAir 4,2", CS420X_MBA42),
 	SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE),
 	{} /* terminator */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:588 @ static int patch_cs420x(struct hda_codec
 		return -ENOMEM;
 
 	spec->gen.automute_hook = cs_automute;
+	codec->single_adc_amp = 1;
 
 	snd_hda_pick_fixup(codec, cs420x_models, cs420x_fixup_tbl,
 			   cs420x_fixups);
Index: linux-3.18.13-rt10-r7s4/sound/pci/hda/patch_conexant.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/pci/hda/patch_conexant.c
+++ linux-3.18.13-rt10-r7s4/sound/pci/hda/patch_conexant.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:226 @ enum {
 	CXT_PINCFG_LENOVO_TP410,
 	CXT_PINCFG_LEMOTE_A1004,
 	CXT_PINCFG_LEMOTE_A1205,
+	CXT_PINCFG_COMPAQ_CQ60,
 	CXT_FIXUP_STEREO_DMIC,
 	CXT_FIXUP_INC_MIC_BOOST,
 	CXT_FIXUP_HEADPHONE_MIC_PIN,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:664 @ static const struct hda_fixup cxt_fixups
 		.type = HDA_FIXUP_PINS,
 		.v.pins = cxt_pincfg_lemote,
 	},
+	[CXT_PINCFG_COMPAQ_CQ60] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			/* 0x17 was falsely set up as a mic, it should 0x1d */
+			{ 0x17, 0x400001f0 },
+			{ 0x1d, 0x97a70120 },
+			{ }
+		}
+	},
 	[CXT_FIXUP_STEREO_DMIC] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = cxt_fixup_stereo_dmic,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:782 @ static const struct hda_model_fixup cxt5
 };
 
 static const struct snd_pci_quirk cxt5051_fixups[] = {
+	SND_PCI_QUIRK(0x103c, 0x360b, "Compaq CQ60", CXT_PINCFG_COMPAQ_CQ60),
 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
 	{}
 };
Index: linux-3.18.13-rt10-r7s4/sound/pci/hda/patch_hdmi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/pci/hda/patch_hdmi.c
+++ linux-3.18.13-rt10-r7s4/sound/pci/hda/patch_hdmi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3354 @ static const struct hda_codec_preset snd
 { .id = 0x10de0067, .name = "MCP67 HDMI",	.patch = patch_nvhdmi_2ch },
 { .id = 0x10de0070, .name = "GPU 70 HDMI/DP",	.patch = patch_nvhdmi },
 { .id = 0x10de0071, .name = "GPU 71 HDMI/DP",	.patch = patch_nvhdmi },
+{ .id = 0x10de0072, .name = "GPU 72 HDMI/DP",	.patch = patch_nvhdmi },
 { .id = 0x10de8001, .name = "MCP73 HDMI",	.patch = patch_nvhdmi_2ch },
 { .id = 0x11069f80, .name = "VX900 HDMI/DP",	.patch = patch_via_hdmi },
 { .id = 0x11069f81, .name = "VX900 HDMI/DP",	.patch = patch_via_hdmi },
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3414 @ MODULE_ALIAS("snd-hda-codec-id:10de0060"
 MODULE_ALIAS("snd-hda-codec-id:10de0067");
 MODULE_ALIAS("snd-hda-codec-id:10de0070");
 MODULE_ALIAS("snd-hda-codec-id:10de0071");
+MODULE_ALIAS("snd-hda-codec-id:10de0072");
 MODULE_ALIAS("snd-hda-codec-id:10de8001");
 MODULE_ALIAS("snd-hda-codec-id:11069f80");
 MODULE_ALIAS("snd-hda-codec-id:11069f81");
Index: linux-3.18.13-rt10-r7s4/sound/pci/hda/patch_realtek.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/pci/hda/patch_realtek.c
+++ linux-3.18.13-rt10-r7s4/sound/pci/hda/patch_realtek.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:322 @ static void alc_fill_eapd_coef(struct hd
 		break;
 	case 0x10ec0233:
 	case 0x10ec0255:
+	case 0x10ec0256:
 	case 0x10ec0282:
 	case 0x10ec0283:
 	case 0x10ec0286:
 	case 0x10ec0288:
+	case 0x10ec0298:
 		alc_update_coef_idx(codec, 0x10, 1<<9, 0);
 		break;
 	case 0x10ec0285:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:395 @ static void alc_auto_setup_eapd(struct h
 {
 	/* We currently only handle front, HP */
 	static hda_nid_t pins[] = {
-		0x0f, 0x10, 0x14, 0x15, 0
+		0x0f, 0x10, 0x14, 0x15, 0x17, 0
 	};
 	hda_nid_t *p;
 	for (p = pins; *p; p++)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2662 @ enum {
 	ALC269_TYPE_ALC284,
 	ALC269_TYPE_ALC285,
 	ALC269_TYPE_ALC286,
+	ALC269_TYPE_ALC298,
 	ALC269_TYPE_ALC255,
+	ALC269_TYPE_ALC256,
 };
 
 /*
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2691 @ static int alc269_parse_auto_config(stru
 	case ALC269_TYPE_ALC282:
 	case ALC269_TYPE_ALC283:
 	case ALC269_TYPE_ALC286:
+	case ALC269_TYPE_ALC298:
 	case ALC269_TYPE_ALC255:
+	case ALC269_TYPE_ALC256:
 		ssids = alc269_ssids;
 		break;
 	default:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2911 @ static void alc283_init(struct hda_codec
 
 	if (!hp_pin)
 		return;
+
+	msleep(30);
 	hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
 
 	/* Index 0x43 Direct Drive HP AMP LPM Control 1 */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4260 @ enum {
 	ALC269_FIXUP_QUANTA_MUTE,
 	ALC269_FIXUP_LIFEBOOK,
 	ALC269_FIXUP_LIFEBOOK_EXTMIC,
+	ALC269_FIXUP_LIFEBOOK_HP_PIN,
 	ALC269_FIXUP_AMIC,
 	ALC269_FIXUP_DMIC,
 	ALC269VB_FIXUP_AMIC,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4411 @ static const struct hda_fixup alc269_fix
 			{ }
 		},
 	},
+	[ALC269_FIXUP_LIFEBOOK_HP_PIN] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x21, 0x0221102f }, /* HP out */
+			{ }
+		},
+	},
 	[ALC269_FIXUP_AMIC] = {
 		.type = HDA_FIXUP_PINS,
 		.v.pins = (const struct hda_pintbl[]) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4809 @ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1028, 0x0638, "Dell Inspiron 5439", ALC290_FIXUP_MONO_SPEAKERS_HSJACK),
 	SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x06da, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4818 @ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x103c, 0x18e6, "HP", ALC269_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
 	/* ALC282 */
+	SND_PCI_QUIRK(0x103c, 0x21f9, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x2214, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x2236, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4888 @ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
 	SND_PCI_QUIRK(0x104d, 0x9099, "Sony VAIO S13", ALC275_FIXUP_SONY_DISABLE_AAMIX),
 	SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
+	SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
 	SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
 	SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_BXBT2807_MIC),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:4909 @ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad T440", ALC292_FIXUP_TPT440_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad X240", ALC292_FIXUP_TPT440_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+	SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
 	SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
 	SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
 	SND_PCI_QUIRK(0x17aa, 0x501e, "Thinkpad L440", ALC292_FIXUP_TPT440_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x5026, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+	SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
 	SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5089 @ static const struct snd_hda_pin_quirk al
 		{0x17, 0x40000000},
 		{0x1d, 0x40700001},
 		{0x21, 0x02211040}),
+	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+		ALC255_STANDARD_PINS,
+		{0x12, 0x90a60170},
+		{0x14, 0x90170140},
+		{0x17, 0x40000000},
+		{0x1d, 0x40700001},
+		{0x21, 0x02211050}),
 	SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
 		{0x12, 0x90a60130},
 		{0x13, 0x40000000},
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:5407 @ static int patch_alc269(struct hda_codec
 		spec->codec_variant = ALC269_TYPE_ALC286;
 		spec->shutup = alc286_shutup;
 		break;
+	case 0x10ec0298:
+		spec->codec_variant = ALC269_TYPE_ALC298;
+		break;
 	case 0x10ec0255:
 		spec->codec_variant = ALC269_TYPE_ALC255;
 		break;
+	case 0x10ec0256:
+		spec->codec_variant = ALC269_TYPE_ALC256;
+		break;
 	}
 
 	if (snd_hda_codec_read(codec, 0x51, 0, AC_VERB_PARAMETERS, 0) == 0x10ec5505) {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6351 @ static const struct hda_codec_preset snd
 	{ .id = 0x10ec0233, .name = "ALC233", .patch = patch_alc269 },
 	{ .id = 0x10ec0235, .name = "ALC233", .patch = patch_alc269 },
 	{ .id = 0x10ec0255, .name = "ALC255", .patch = patch_alc269 },
+	{ .id = 0x10ec0256, .name = "ALC256", .patch = patch_alc269 },
 	{ .id = 0x10ec0260, .name = "ALC260", .patch = patch_alc260 },
 	{ .id = 0x10ec0262, .name = "ALC262", .patch = patch_alc262 },
 	{ .id = 0x10ec0267, .name = "ALC267", .patch = patch_alc268 },
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6371 @ static const struct hda_codec_preset snd
 	{ .id = 0x10ec0290, .name = "ALC290", .patch = patch_alc269 },
 	{ .id = 0x10ec0292, .name = "ALC292", .patch = patch_alc269 },
 	{ .id = 0x10ec0293, .name = "ALC293", .patch = patch_alc269 },
+	{ .id = 0x10ec0298, .name = "ALC298", .patch = patch_alc269 },
 	{ .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660",
 	  .patch = patch_alc861 },
 	{ .id = 0x10ec0660, .name = "ALC660-VD", .patch = patch_alc861vd },
Index: linux-3.18.13-rt10-r7s4/sound/pci/hda/patch_sigmatel.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/pci/hda/patch_sigmatel.c
+++ linux-3.18.13-rt10-r7s4/sound/pci/hda/patch_sigmatel.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:82 @ enum {
 	STAC_ALIENWARE_M17X,
 	STAC_92HD89XX_HP_FRONT_JACK,
 	STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK,
+	STAC_92HD73XX_ASUS_MOBO,
 	STAC_92HD73XX_MODELS
 };
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:103 @ enum {
 	STAC_HP_ENVY_BASS,
 	STAC_HP_BNB13_EQ,
 	STAC_HP_ENVY_TS_BASS,
+	STAC_92HD83XXX_GPIO10_EAPD,
 	STAC_92HD83XXX_MODELS
 };
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:573 @ static void stac_store_hints(struct hda_
 			spec->gpio_mask;
 	}
 	if (get_int_hint(codec, "gpio_dir", &spec->gpio_dir))
-		spec->gpio_mask &= spec->gpio_mask;
-	if (get_int_hint(codec, "gpio_data", &spec->gpio_data))
 		spec->gpio_dir &= spec->gpio_mask;
+	if (get_int_hint(codec, "gpio_data", &spec->gpio_data))
+		spec->gpio_data &= spec->gpio_mask;
 	if (get_int_hint(codec, "eapd_mask", &spec->eapd_mask))
 		spec->eapd_mask &= spec->gpio_mask;
 	if (get_int_hint(codec, "gpio_mute", &spec->gpio_mute))
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1915 @ static const struct hda_fixup stac92hd73
 	[STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK] = {
 		.type = HDA_FIXUP_PINS,
 		.v.pins = stac92hd89xx_hp_z1_g2_right_mic_jack_pin_configs,
-	}
+	},
+	[STAC_92HD73XX_ASUS_MOBO] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			/* enable 5.1 and SPDIF out */
+			{ 0x0c, 0x01014411 },
+			{ 0x0d, 0x01014410 },
+			{ 0x0e, 0x01014412 },
+			{ 0x22, 0x014b1180 },
+			{ }
+		}
+	},
 };
 
 static const struct hda_model_fixup stac92hd73xx_models[] = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1938 @ static const struct hda_model_fixup stac
 	{ .id = STAC_DELL_M6_BOTH, .name = "dell-m6" },
 	{ .id = STAC_DELL_EQ, .name = "dell-eq" },
 	{ .id = STAC_ALIENWARE_M17X, .name = "alienware" },
+	{ .id = STAC_92HD73XX_ASUS_MOBO, .name = "asus-mobo" },
 	{}
 };
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1991 @ static const struct snd_pci_quirk stac92
 				"HP Z1 G2", STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK),
 	SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x2b17,
 				"unknown HP", STAC_92HD89XX_HP_FRONT_JACK),
+	SND_PCI_QUIRK(PCI_VENDOR_ID_ASUSTEK, 0x83f8, "ASUS AT4NM10",
+		      STAC_92HD73XX_ASUS_MOBO),
 	{} /* terminator */
 };
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2160 @ static void stac92hd83xxx_fixup_headset_
 		spec->headset_jack = 1;
 }
 
+static void stac92hd83xxx_fixup_gpio10_eapd(struct hda_codec *codec,
+					    const struct hda_fixup *fix,
+					    int action)
+{
+	struct sigmatel_spec *spec = codec->spec;
+
+	if (action != HDA_FIXUP_ACT_PRE_PROBE)
+		return;
+	spec->eapd_mask = spec->gpio_mask = spec->gpio_dir =
+		spec->gpio_data = 0x10;
+	spec->eapd_switch = 0;
+}
+
 static const struct hda_verb hp_bnb13_eq_verbs[] = {
 	/* 44.1KHz base */
 	{ 0x22, 0x7A6, 0x3E },
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2688 @ static const struct hda_fixup stac92hd83
 			{}
 		},
 	},
+	[STAC_92HD83XXX_GPIO10_EAPD] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = stac92hd83xxx_fixup_gpio10_eapd,
+	},
 };
 
 static const struct hda_model_fixup stac92hd83xxx_models[] = {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2897 @ static const struct snd_pci_quirk stac92
 	SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x148a,
 		      "HP Mini", STAC_92HD83XXX_HP_LED),
 	SND_PCI_QUIRK_VENDOR(PCI_VENDOR_ID_HP, "HP", STAC_92HD83XXX_HP),
+	SND_PCI_QUIRK(PCI_VENDOR_ID_TOSHIBA, 0xfa91,
+		      "Toshiba Satellite S50D", STAC_92HD83XXX_GPIO10_EAPD),
 	{} /* terminator */
 };
 
Index: linux-3.18.13-rt10-r7s4/sound/pci/riptide/riptide.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/pci/riptide/riptide.c
+++ linux-3.18.13-rt10-r7s4/sound/pci/riptide/riptide.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2033 @ snd_riptide_joystick_probe(struct pci_de
 {
 	static int dev;
 	struct gameport *gameport;
+	int ret;
 
 	if (dev >= SNDRV_CARDS)
 		return -ENODEV;
+
 	if (!enable[dev]) {
-		dev++;
-		return -ENOENT;
+		ret = -ENOENT;
+		goto inc_dev;
 	}
 
-	if (!joystick_port[dev++])
-		return 0;
+	if (!joystick_port[dev]) {
+		ret = 0;
+		goto inc_dev;
+	}
 
 	gameport = gameport_allocate_port();
-	if (!gameport)
-		return -ENOMEM;
+	if (!gameport) {
+		ret = -ENOMEM;
+		goto inc_dev;
+	}
 	if (!request_region(joystick_port[dev], 8, "Riptide gameport")) {
 		snd_printk(KERN_WARNING
 			   "Riptide: cannot grab gameport 0x%x\n",
 			   joystick_port[dev]);
 		gameport_free_port(gameport);
-		return -EBUSY;
+		ret = -EBUSY;
+		goto inc_dev;
 	}
 
 	gameport->io = joystick_port[dev];
 	gameport_register_port(gameport);
 	pci_set_drvdata(pci, gameport);
-	return 0;
+
+	ret = 0;
+inc_dev:
+	dev++;
+	return ret;
 }
 
 static void snd_riptide_joystick_remove(struct pci_dev *pci)
Index: linux-3.18.13-rt10-r7s4/sound/pci/rme9652/hdspm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/pci/rme9652/hdspm.c
+++ linux-3.18.13-rt10-r7s4/sound/pci/rme9652/hdspm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6117 @ static int snd_hdspm_playback_open(struc
 		snd_pcm_hw_constraint_minmax(runtime,
 					     SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
 					     64, 8192);
+		snd_pcm_hw_constraint_minmax(runtime,
+					     SNDRV_PCM_HW_PARAM_PERIODS,
+					     2, 2);
 		break;
 	}
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:6194 @ static int snd_hdspm_capture_open(struct
 		snd_pcm_hw_constraint_minmax(runtime,
 					     SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
 					     64, 8192);
+		snd_pcm_hw_constraint_minmax(runtime,
+					     SNDRV_PCM_HW_PARAM_PERIODS,
+					     2, 2);
 		break;
 	}
 
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/adav80x.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/adav80x.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/adav80x.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:320 @ static int adav80x_put_deemph(struct snd
 {
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
-	unsigned int deemph = ucontrol->value.enumerated.item[0];
+	unsigned int deemph = ucontrol->value.integer.value[0];
 
 	if (deemph > 1)
 		return -EINVAL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:336 @ static int adav80x_get_deemph(struct snd
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
 
-	ucontrol->value.enumerated.item[0] = adav80x->deemph;
+	ucontrol->value.integer.value[0] = adav80x->deemph;
 	return 0;
 };
 
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/ak4641.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/ak4641.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/ak4641.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:79 @ static int ak4641_put_deemph(struct snd_
 {
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
-	int deemph = ucontrol->value.enumerated.item[0];
+	int deemph = ucontrol->value.integer.value[0];
 
 	if (deemph > 1)
 		return -EINVAL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:95 @ static int ak4641_get_deemph(struct snd_
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
 
-	ucontrol->value.enumerated.item[0] = ak4641->deemph;
+	ucontrol->value.integer.value[0] = ak4641->deemph;
 	return 0;
 };
 
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/ak4671.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/ak4671.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/ak4671.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:346 @ static const struct snd_soc_dapm_widget
 };
 
 static const struct snd_soc_dapm_route ak4671_intercon[] = {
-	{"DAC Left", "NULL", "PMPLL"},
-	{"DAC Right", "NULL", "PMPLL"},
-	{"ADC Left", "NULL", "PMPLL"},
-	{"ADC Right", "NULL", "PMPLL"},
+	{"DAC Left", NULL, "PMPLL"},
+	{"DAC Right", NULL, "PMPLL"},
+	{"ADC Left", NULL, "PMPLL"},
+	{"ADC Right", NULL, "PMPLL"},
 
 	/* Outputs */
-	{"LOUT1", "NULL", "LOUT1 Mixer"},
-	{"ROUT1", "NULL", "ROUT1 Mixer"},
-	{"LOUT2", "NULL", "LOUT2 Mix Amp"},
-	{"ROUT2", "NULL", "ROUT2 Mix Amp"},
-	{"LOUT3", "NULL", "LOUT3 Mixer"},
-	{"ROUT3", "NULL", "ROUT3 Mixer"},
+	{"LOUT1", NULL, "LOUT1 Mixer"},
+	{"ROUT1", NULL, "ROUT1 Mixer"},
+	{"LOUT2", NULL, "LOUT2 Mix Amp"},
+	{"ROUT2", NULL, "ROUT2 Mix Amp"},
+	{"LOUT3", NULL, "LOUT3 Mixer"},
+	{"ROUT3", NULL, "ROUT3 Mixer"},
 
 	{"LOUT1 Mixer", "DACL", "DAC Left"},
 	{"ROUT1 Mixer", "DACR", "DAC Right"},
 	{"LOUT2 Mixer", "DACHL", "DAC Left"},
 	{"ROUT2 Mixer", "DACHR", "DAC Right"},
-	{"LOUT2 Mix Amp", "NULL", "LOUT2 Mixer"},
-	{"ROUT2 Mix Amp", "NULL", "ROUT2 Mixer"},
+	{"LOUT2 Mix Amp", NULL, "LOUT2 Mixer"},
+	{"ROUT2 Mix Amp", NULL, "ROUT2 Mixer"},
 	{"LOUT3 Mixer", "DACSL", "DAC Left"},
 	{"ROUT3 Mixer", "DACSR", "DAC Right"},
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:384 @ static const struct snd_soc_dapm_route a
 	{"LIN2", NULL, "Mic Bias"},
 	{"RIN2", NULL, "Mic Bias"},
 
-	{"ADC Left", "NULL", "LIN MUX"},
-	{"ADC Right", "NULL", "RIN MUX"},
+	{"ADC Left", NULL, "LIN MUX"},
+	{"ADC Right", NULL, "RIN MUX"},
 
 	/* Analog Loops */
-	{"LIN1 Mixing Circuit", "NULL", "LIN1"},
-	{"RIN1 Mixing Circuit", "NULL", "RIN1"},
-	{"LIN2 Mixing Circuit", "NULL", "LIN2"},
-	{"RIN2 Mixing Circuit", "NULL", "RIN2"},
-	{"LIN3 Mixing Circuit", "NULL", "LIN3"},
-	{"RIN3 Mixing Circuit", "NULL", "RIN3"},
-	{"LIN4 Mixing Circuit", "NULL", "LIN4"},
-	{"RIN4 Mixing Circuit", "NULL", "RIN4"},
+	{"LIN1 Mixing Circuit", NULL, "LIN1"},
+	{"RIN1 Mixing Circuit", NULL, "RIN1"},
+	{"LIN2 Mixing Circuit", NULL, "LIN2"},
+	{"RIN2 Mixing Circuit", NULL, "RIN2"},
+	{"LIN3 Mixing Circuit", NULL, "LIN3"},
+	{"RIN3 Mixing Circuit", NULL, "RIN3"},
+	{"LIN4 Mixing Circuit", NULL, "LIN4"},
+	{"RIN4 Mixing Circuit", NULL, "RIN4"},
 
 	{"LOUT1 Mixer", "LINL1", "LIN1 Mixing Circuit"},
 	{"ROUT1 Mixer", "RINR1", "RIN1 Mixing Circuit"},
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/cs4271.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/cs4271.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/cs4271.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:290 @ static int cs4271_get_deemph(struct snd_
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
 
-	ucontrol->value.enumerated.item[0] = cs4271->deemph;
+	ucontrol->value.integer.value[0] = cs4271->deemph;
 	return 0;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:300 @ static int cs4271_put_deemph(struct snd_
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
 
-	cs4271->deemph = ucontrol->value.enumerated.item[0];
+	cs4271->deemph = ucontrol->value.integer.value[0];
 	return cs4271_set_deemph(codec);
 }
 
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/da732x.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/da732x.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/da732x.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:879 @ static const struct snd_soc_dapm_widget
 
 static const struct snd_soc_dapm_route da732x_dapm_routes[] = {
 	/* Inputs */
-	{"AUX1L PGA", "NULL", "AUX1L"},
-	{"AUX1R PGA", "NULL", "AUX1R"},
+	{"AUX1L PGA", NULL, "AUX1L"},
+	{"AUX1R PGA", NULL, "AUX1R"},
 	{"MIC1 PGA", NULL, "MIC1"},
-	{"MIC2 PGA", "NULL", "MIC2"},
-	{"MIC3 PGA", "NULL", "MIC3"},
+	{"MIC2 PGA", NULL, "MIC2"},
+	{"MIC3 PGA", NULL, "MIC3"},
 
 	/* Capture Path */
 	{"ADC1 Left MUX", "MIC1", "MIC1 PGA"},
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/es8328.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/es8328.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/es8328.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:123 @ static int es8328_get_deemph(struct snd_
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
 
-	ucontrol->value.enumerated.item[0] = es8328->deemph;
+	ucontrol->value.integer.value[0] = es8328->deemph;
 	return 0;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:132 @ static int es8328_put_deemph(struct snd_
 {
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
-	int deemph = ucontrol->value.enumerated.item[0];
+	int deemph = ucontrol->value.integer.value[0];
 	int ret;
 
 	if (deemph > 1)
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/max98090.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/max98090.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/max98090.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1398 @ static const struct snd_soc_dapm_route m
 	{"STENL Mux", "Sidetone Left", "DMICL"},
 	{"STENR Mux", "Sidetone Right", "ADCR"},
 	{"STENR Mux", "Sidetone Right", "DMICR"},
-	{"DACL", "NULL", "STENL Mux"},
-	{"DACR", "NULL", "STENL Mux"},
+	{"DACL", NULL, "STENL Mux"},
+	{"DACR", NULL, "STENL Mux"},
 
 	{"AIFINL", NULL, "SHDN"},
 	{"AIFINR", NULL, "SHDN"},
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/pcm1681.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/pcm1681.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/pcm1681.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:121 @ static int pcm1681_get_deemph(struct snd
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
 
-	ucontrol->value.enumerated.item[0] = priv->deemph;
+	ucontrol->value.integer.value[0] = priv->deemph;
 
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:132 @ static int pcm1681_put_deemph(struct snd
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
 
-	priv->deemph = ucontrol->value.enumerated.item[0];
+	priv->deemph = ucontrol->value.integer.value[0];
 
 	return pcm1681_set_deemph(codec);
 }
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/pcm512x-i2c.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/pcm512x-i2c.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/pcm512x-i2c.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:27 @ static int pcm512x_i2c_probe(struct i2c_
 			     const struct i2c_device_id *id)
 {
 	struct regmap *regmap;
+	struct regmap_config config = pcm512x_regmap;
 
-	regmap = devm_regmap_init_i2c(i2c, &pcm512x_regmap);
+	/* msb needs to be set to enable auto-increment of addresses */
+	config.read_flag_mask = 0x80;
+	config.write_flag_mask = 0x80;
+
+	regmap = devm_regmap_init_i2c(i2c, &config);
 	if (IS_ERR(regmap))
 		return PTR_ERR(regmap);
 
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/pcm512x.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/pcm512x.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/pcm512x.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:191 @ static const DECLARE_TLV_DB_SCALE(boost_
 static const char * const pcm512x_dsp_program_texts[] = {
 	"FIR interpolation with de-emphasis",
 	"Low latency IIR with de-emphasis",
-	"Fixed process flow",
 	"High attenuation with de-emphasis",
+	"Fixed process flow",
 	"Ringing-less low latency FIR",
 };
 
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/rt5670.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/rt5670.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/rt5670.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:225 @ static bool rt5670_volatile_register(str
 	case RT5670_ADC_EQ_CTRL1:
 	case RT5670_EQ_CTRL1:
 	case RT5670_ALC_CTRL_1:
-	case RT5670_IRQ_CTRL1:
 	case RT5670_IRQ_CTRL2:
 	case RT5670_INT_IRQ_ST:
 	case RT5670_IL_CMD:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2441 @ static struct snd_soc_codec_driver soc_c
 static const struct regmap_config rt5670_regmap = {
 	.reg_bits = 8,
 	.val_bits = 16,
+	.use_single_rw = true,
 	.max_register = RT5670_VENDOR_ID2 + 1 + (ARRAY_SIZE(rt5670_ranges) *
 					       RT5670_PR_SPACING),
 	.volatile_reg = rt5670_volatile_register,
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/sgtl5000.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/sgtl5000.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/sgtl5000.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1139 @ static int sgtl5000_set_power_regs(struc
 		/* Enable VDDC charge pump */
 		ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP;
 	} else if (vddio >= 3100 && vdda >= 3100) {
-		/*
-		 * if vddio and vddd > 3.1v,
-		 * charge pump should be clean before set ana_pwr
-		 */
-		snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
-				SGTL5000_VDDC_CHRGPMP_POWERUP, 0);
-
+		ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP;
 		/* VDDC use VDDIO rail */
 		lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
 		lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1449 @ static int sgtl5000_i2c_probe(struct i2c
 	if (ret)
 		return ret;
 
+	/* Need 8 clocks before I2C accesses */
+	udelay(1);
+
 	/* read chip information */
 	ret = regmap_read(sgtl5000->regmap, SGTL5000_CHIP_ID, &reg);
 	if (ret)
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/sigmadsp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/sigmadsp.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/sigmadsp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:162 @ int _process_sigma_firmware(struct devic
 		goto done;
 	}
 
+	if (ssfw_head->version != 1) {
+		dev_err(dev,
+			"Failed to load firmware: Invalid version %d. Supported firmware versions: 1\n",
+			ssfw_head->version);
+		goto done;
+	}
+
 	crc = crc32(0, fw->data + sizeof(*ssfw_head),
 			fw->size - sizeof(*ssfw_head));
 	pr_debug("%s: crc=%x\n", __func__, crc);
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/sn95031.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/sn95031.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/sn95031.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:534 @ static const struct snd_soc_dapm_route s
 	/* speaker map */
 	{ "IHFOUTL", NULL, "Speaker Rail"},
 	{ "IHFOUTR", NULL, "Speaker Rail"},
-	{ "IHFOUTL", "NULL", "Speaker Left Playback"},
-	{ "IHFOUTR", "NULL", "Speaker Right Playback"},
+	{ "IHFOUTL", NULL, "Speaker Left Playback"},
+	{ "IHFOUTR", NULL, "Speaker Right Playback"},
 	{ "Speaker Left Playback", NULL, "Speaker Left Filter"},
 	{ "Speaker Right Playback", NULL, "Speaker Right Filter"},
 	{ "Speaker Left Filter", NULL, "IHFDAC Left"},
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/tas5086.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/tas5086.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/tas5086.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:284 @ static int tas5086_get_deemph(struct snd
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
 
-	ucontrol->value.enumerated.item[0] = priv->deemph;
+	ucontrol->value.integer.value[0] = priv->deemph;
 
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:295 @ static int tas5086_put_deemph(struct snd
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
 
-	priv->deemph = ucontrol->value.enumerated.item[0];
+	priv->deemph = ucontrol->value.integer.value[0];
 
 	return tas5086_set_deemph(codec);
 }
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/tlv320aic31xx.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/tlv320aic31xx.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/tlv320aic31xx.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:914 @ static int aic31xx_set_dai_sysclk(struct
 	}
 	aic31xx->p_div = i;
 
-	for (i = 0; aic31xx_divs[i].mclk_p != freq/aic31xx->p_div; i++) {
-		if (i == ARRAY_SIZE(aic31xx_divs)) {
-			dev_err(aic31xx->dev, "%s: Unsupported frequency %d\n",
-				__func__, freq);
-			return -EINVAL;
-		}
+	for (i = 0; i < ARRAY_SIZE(aic31xx_divs) &&
+		     aic31xx_divs[i].mclk_p != freq/aic31xx->p_div; i++)
+		;
+	if (i == ARRAY_SIZE(aic31xx_divs)) {
+		dev_err(aic31xx->dev, "%s: Unsupported frequency %d\n",
+			__func__, freq);
+		return -EINVAL;
 	}
 
 	/* set clock on MCLK, BCLK, or GPIO1 as PLL input */
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/wm2000.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/wm2000.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/wm2000.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:613 @ static int wm2000_anc_mode_get(struct sn
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
 
-	ucontrol->value.enumerated.item[0] = wm2000->anc_active;
+	ucontrol->value.integer.value[0] = wm2000->anc_active;
 
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:623 @ static int wm2000_anc_mode_put(struct sn
 {
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
-	int anc_active = ucontrol->value.enumerated.item[0];
+	int anc_active = ucontrol->value.integer.value[0];
 	int ret;
 
 	if (anc_active > 1)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:646 @ static int wm2000_speaker_get(struct snd
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
 
-	ucontrol->value.enumerated.item[0] = wm2000->spk_ena;
+	ucontrol->value.integer.value[0] = wm2000->spk_ena;
 
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:656 @ static int wm2000_speaker_put(struct snd
 {
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
-	int val = ucontrol->value.enumerated.item[0];
+	int val = ucontrol->value.integer.value[0];
 	int ret;
 
 	if (val > 1)
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/wm8731.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/wm8731.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/wm8731.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:130 @ static int wm8731_get_deemph(struct snd_
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
 
-	ucontrol->value.enumerated.item[0] = wm8731->deemph;
+	ucontrol->value.integer.value[0] = wm8731->deemph;
 
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:140 @ static int wm8731_put_deemph(struct snd_
 {
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
-	int deemph = ucontrol->value.enumerated.item[0];
+	int deemph = ucontrol->value.integer.value[0];
 	int ret = 0;
 
 	if (deemph > 1)
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/wm8903.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/wm8903.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/wm8903.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:444 @ static int wm8903_get_deemph(struct snd_
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
 
-	ucontrol->value.enumerated.item[0] = wm8903->deemph;
+	ucontrol->value.integer.value[0] = wm8903->deemph;
 
 	return 0;
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:454 @ static int wm8903_put_deemph(struct snd_
 {
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
-	int deemph = ucontrol->value.enumerated.item[0];
+	int deemph = ucontrol->value.integer.value[0];
 	int ret = 0;
 
 	if (deemph > 1)
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/wm8904.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/wm8904.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/wm8904.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:528 @ static int wm8904_get_deemph(struct snd_
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
 
-	ucontrol->value.enumerated.item[0] = wm8904->deemph;
+	ucontrol->value.integer.value[0] = wm8904->deemph;
 	return 0;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:537 @ static int wm8904_put_deemph(struct snd_
 {
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
-	int deemph = ucontrol->value.enumerated.item[0];
+	int deemph = ucontrol->value.integer.value[0];
 
 	if (deemph > 1)
 		return -EINVAL;
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/wm8955.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/wm8955.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/wm8955.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:396 @ static int wm8955_get_deemph(struct snd_
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
 
-	ucontrol->value.enumerated.item[0] = wm8955->deemph;
+	ucontrol->value.integer.value[0] = wm8955->deemph;
 	return 0;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:405 @ static int wm8955_put_deemph(struct snd_
 {
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
-	int deemph = ucontrol->value.enumerated.item[0];
+	int deemph = ucontrol->value.integer.value[0];
 
 	if (deemph > 1)
 		return -EINVAL;
Index: linux-3.18.13-rt10-r7s4/sound/soc/codecs/wm8960.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/codecs/wm8960.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/codecs/wm8960.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:184 @ static int wm8960_get_deemph(struct snd_
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
 
-	ucontrol->value.enumerated.item[0] = wm8960->deemph;
+	ucontrol->value.integer.value[0] = wm8960->deemph;
 	return 0;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:193 @ static int wm8960_put_deemph(struct snd_
 {
 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
 	struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
-	int deemph = ucontrol->value.enumerated.item[0];
+	int deemph = ucontrol->value.integer.value[0];
 
 	if (deemph > 1)
 		return -EINVAL;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:558 @ static struct {
 	{ 22050, 2 },
 	{ 24000, 2 },
 	{ 16000, 3 },
-	{ 11250, 4 },
+	{ 11025, 4 },
 	{ 12000, 4 },
 	{  8000, 5 },
 };
Index: linux-3.18.13-rt10-r7s4/sound/soc/davinci/Kconfig
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/davinci/Kconfig
+++ linux-3.18.13-rt10-r7s4/sound/soc/davinci/Kconfig
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:61 @ choice
 	depends on MACH_DAVINCI_DM365_EVM
 
 config SND_DM365_AIC3X_CODEC
-	bool "Audio Codec - AIC3101"
+	tristate "Audio Codec - AIC3101"
 	help
 	  Say Y if you want to add support for AIC3101 audio codec
 
 config SND_DM365_VOICE_CODEC
 	tristate "Voice Codec - CQ93VC"
-	depends on SND_DAVINCI_SOC
 	select MFD_DAVINCI_VOICECODEC
 	select SND_DAVINCI_SOC_VCIF
 	select SND_SOC_CQ0093VC
Index: linux-3.18.13-rt10-r7s4/sound/soc/dwc/designware_i2s.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/dwc/designware_i2s.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/dwc/designware_i2s.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:266 @ static void dw_i2s_shutdown(struct snd_p
 	snd_soc_dai_set_dma_data(dai, substream, NULL);
 }
 
+static int dw_i2s_prepare(struct snd_pcm_substream *substream,
+			  struct snd_soc_dai *dai)
+{
+	struct dw_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
+
+	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+		i2s_write_reg(dev->i2s_base, TXFFR, 1);
+	else
+		i2s_write_reg(dev->i2s_base, RXFFR, 1);
+
+	return 0;
+}
+
 static int dw_i2s_trigger(struct snd_pcm_substream *substream,
 		int cmd, struct snd_soc_dai *dai)
 {
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:310 @ static struct snd_soc_dai_ops dw_i2s_dai
 	.startup	= dw_i2s_startup,
 	.shutdown	= dw_i2s_shutdown,
 	.hw_params	= dw_i2s_hw_params,
+	.prepare	= dw_i2s_prepare,
 	.trigger	= dw_i2s_trigger,
 };
 
Index: linux-3.18.13-rt10-r7s4/sound/soc/fsl/eukrea-tlv320.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/fsl/eukrea-tlv320.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/fsl/eukrea-tlv320.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:108 @ static int eukrea_tlv320_probe(struct pl
 	int ret;
 	int int_port = 0, ext_port;
 	struct device_node *np = pdev->dev.of_node;
-	struct device_node *ssi_np, *codec_np;
+	struct device_node *ssi_np = NULL, *codec_np = NULL;
 
 	eukrea_tlv320.dev = &pdev->dev;
 	if (np) {
Index: linux-3.18.13-rt10-r7s4/sound/soc/fsl/fsl_esai.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/fsl/fsl_esai.h
+++ linux-3.18.13-rt10-r7s4/sound/soc/fsl/fsl_esai.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:305 @
 #define ESAI_xCCR_xFP_MASK	(((1 << ESAI_xCCR_xFP_WIDTH) - 1) << ESAI_xCCR_xFP_SHIFT)
 #define ESAI_xCCR_xFP(v)	((((v) - 1) << ESAI_xCCR_xFP_SHIFT) & ESAI_xCCR_xFP_MASK)
 #define ESAI_xCCR_xDC_SHIFT     9
-#define ESAI_xCCR_xDC_WIDTH	4
+#define ESAI_xCCR_xDC_WIDTH	5
 #define ESAI_xCCR_xDC_MASK	(((1 << ESAI_xCCR_xDC_WIDTH) - 1) << ESAI_xCCR_xDC_SHIFT)
 #define ESAI_xCCR_xDC(v)	((((v) - 1) << ESAI_xCCR_xDC_SHIFT) & ESAI_xCCR_xDC_MASK)
 #define ESAI_xCCR_xPSR_SHIFT	8
Index: linux-3.18.13-rt10-r7s4/sound/soc/generic/simple-card.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/generic/simple-card.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/generic/simple-card.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:456 @ static int asoc_simple_card_parse_of(str
 }
 
 /* Decrease the reference count of the device nodes */
-static int asoc_simple_card_unref(struct platform_device *pdev)
+static int asoc_simple_card_unref(struct snd_soc_card *card)
 {
-	struct snd_soc_card *card = platform_get_drvdata(pdev);
 	struct snd_soc_dai_link *dai_link;
 	struct device_node *np;
 	int num_links;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:564 @ static int asoc_simple_card_probe(struct
 		return ret;
 
 err:
-	asoc_simple_card_unref(pdev);
+	asoc_simple_card_unref(&priv->snd_card);
 	return ret;
 }
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:580 @ static int asoc_simple_card_remove(struc
 		snd_soc_jack_free_gpios(&simple_card_mic_jack, 1,
 					&simple_card_mic_jack_gpio);
 
-	return asoc_simple_card_unref(pdev);
+	return asoc_simple_card_unref(card);
 }
 
 static const struct of_device_id asoc_simple_of_match[] = {
Index: linux-3.18.13-rt10-r7s4/sound/soc/omap/omap-mcbsp.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/omap/omap-mcbsp.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/omap/omap-mcbsp.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:437 @ static int omap_mcbsp_dai_set_dai_fmt(st
 	case SND_SOC_DAIFMT_CBM_CFS:
 		/* McBSP slave. FS clock as output */
 		regs->srgr2	|= FSGM;
-		regs->pcr0	|= FSXM;
+		regs->pcr0	|= FSXM | FSRM;
 		break;
 	case SND_SOC_DAIFMT_CBM_CFM:
 		/* McBSP slave */
Index: linux-3.18.13-rt10-r7s4/sound/soc/omap/omap-pcm.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/omap/omap-pcm.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/omap/omap-pcm.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:204 @ static int omap_pcm_new(struct snd_soc_p
 	struct snd_pcm *pcm = rtd->pcm;
 	int ret;
 
-	ret = dma_coerce_mask_and_coherent(card->dev, DMA_BIT_MASK(64));
+	ret = dma_coerce_mask_and_coherent(card->dev, DMA_BIT_MASK(32));
 	if (ret)
 		return ret;
 
Index: linux-3.18.13-rt10-r7s4/sound/soc/pxa/mioa701_wm9713.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/pxa/mioa701_wm9713.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/pxa/mioa701_wm9713.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:84 @ static int rear_amp_power(struct snd_soc
 static int rear_amp_event(struct snd_soc_dapm_widget *widget,
 			  struct snd_kcontrol *kctl, int event)
 {
-	struct snd_soc_codec *codec = widget->codec;
+	struct snd_soc_codec *codec = widget->dapm->card->rtd[0].codec;
 
 	return rear_amp_power(codec, SND_SOC_DAPM_EVENT_ON(event));
 }
Index: linux-3.18.13-rt10-r7s4/sound/soc/soc-compress.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/soc/soc-compress.c
+++ linux-3.18.13-rt10-r7s4/sound/soc/soc-compress.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:669 @ int soc_new_compress(struct snd_soc_pcm_
 			rtd->dai_link->stream_name);
 
 		ret = snd_pcm_new_internal(rtd->card->snd_card, new_name, num,
-				1, 0, &be_pcm);
+				rtd->dai_link->dpcm_playback,
+				rtd->dai_link->dpcm_capture, &be_pcm);
 		if (ret < 0) {
 			dev_err(rtd->card->dev, "ASoC: can't create compressed for %s\n",
 				rtd->dai_link->name);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:679 @ int soc_new_compress(struct snd_soc_pcm_
 
 		rtd->pcm = be_pcm;
 		rtd->fe_compr = 1;
-		be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd;
-		be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd;
+		if (rtd->dai_link->dpcm_playback)
+			be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd;
+		else if (rtd->dai_link->dpcm_capture)
+			be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd;
 		memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops));
 	} else
 		memcpy(compr->ops, &soc_compr_ops, sizeof(soc_compr_ops));
Index: linux-3.18.13-rt10-r7s4/sound/usb/caiaq/audio.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/usb/caiaq/audio.c
+++ linux-3.18.13-rt10-r7s4/sound/usb/caiaq/audio.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:819 @ int snd_usb_caiaq_audio_init(struct snd_
 		return -EINVAL;
 	}
 
-	if (cdev->n_streams < 2) {
+	if (cdev->n_streams < 1) {
 		dev_err(dev, "bogus number of streams: %d\n", cdev->n_streams);
 		return -EINVAL;
 	}
Index: linux-3.18.13-rt10-r7s4/sound/usb/midi.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/usb/midi.c
+++ linux-3.18.13-rt10-r7s4/sound/usb/midi.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:368 @ static void snd_usbmidi_error_timer(unsi
 		if (in && in->error_resubmit) {
 			in->error_resubmit = 0;
 			for (j = 0; j < INPUT_URBS; ++j) {
+				if (atomic_read(&in->urbs[j]->use_count))
+					continue;
 				in->urbs[j]->dev = umidi->dev;
 				snd_usbmidi_submit_urb(in->urbs[j], GFP_ATOMIC);
 			}
Index: linux-3.18.13-rt10-r7s4/sound/usb/mixer.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/usb/mixer.c
+++ linux-3.18.13-rt10-r7s4/sound/usb/mixer.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:912 @ static void volume_control_quirks(struct
 	case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */
 	case USB_ID(0x046d, 0x0808):
 	case USB_ID(0x046d, 0x0809):
+	case USB_ID(0x046d, 0x0819): /* Logitech Webcam C210 */
 	case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
 	case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
 	case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
Index: linux-3.18.13-rt10-r7s4/sound/usb/mixer_maps.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/usb/mixer_maps.c
+++ linux-3.18.13-rt10-r7s4/sound/usb/mixer_maps.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:331 @ static struct usbmix_name_map gamecom780
 	{}
 };
 
-static const struct usbmix_name_map kef_x300a_map[] = {
-	{ 10, NULL }, /* firmware locks up (?) when we try to access this FU */
+/* some (all?) SCMS USB3318 devices are affected by a firmware lock up
+ * when anything attempts to access FU 10 (control)
+ */
+static const struct usbmix_name_map scms_usb3318_map[] = {
+	{ 10, NULL },
 	{ 0 }
 };
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:431 @ static struct usbmix_ctl_map usbmix_ctl_
 		.map = ebox44_map,
 	},
 	{
+		/* KEF X300A */
 		.id = USB_ID(0x27ac, 0x1000),
-		.map = kef_x300a_map,
+		.map = scms_usb3318_map,
+	},
+	{
+		/* Arcam rPAC */
+		.id = USB_ID(0x25c4, 0x0003),
+		.map = scms_usb3318_map,
 	},
 	{ 0 } /* terminator */
 };
Index: linux-3.18.13-rt10-r7s4/sound/usb/mixer_quirks.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/usb/mixer_quirks.c
+++ linux-3.18.13-rt10-r7s4/sound/usb/mixer_quirks.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:181 @ static const struct rc_config {
 	{ USB_ID(0x041e, 0x3040), 2, 2, 6, 6,  2,  0x6e91 }, /* Live! 24-bit */
 	{ USB_ID(0x041e, 0x3042), 0, 1, 1, 1,  1,  0x000d }, /* Usb X-Fi S51 */
 	{ USB_ID(0x041e, 0x30df), 0, 1, 1, 1,  1,  0x000d }, /* Usb X-Fi S51 Pro */
+	{ USB_ID(0x041e, 0x3237), 0, 1, 1, 1,  1,  0x000d }, /* Usb X-Fi S51 Pro */
 	{ USB_ID(0x041e, 0x3048), 2, 2, 6, 6,  2,  0x6e91 }, /* Toshiba SB0500 */
 };
 
Index: linux-3.18.13-rt10-r7s4/sound/usb/quirks-table.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/sound/usb/quirks-table.h
+++ linux-3.18.13-rt10-r7s4/sound/usb/quirks-table.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1776 @ YAMAHA_DEVICE(0x7010, "UB99"),
 		}
 	}
 },
+{
+	USB_DEVICE(0x0582, 0x0159),
+	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+		/* .vendor_name = "Roland", */
+		/* .product_name = "UA-22", */
+		.ifnum = QUIRK_ANY_INTERFACE,
+		.type = QUIRK_COMPOSITE,
+		.data = (const struct snd_usb_audio_quirk[]) {
+			{
+				.ifnum = 0,
+				.type = QUIRK_AUDIO_STANDARD_INTERFACE
+			},
+			{
+				.ifnum = 1,
+				.type = QUIRK_AUDIO_STANDARD_INTERFACE
+			},
+			{
+				.ifnum = 2,
+				.type = QUIRK_MIDI_FIXED_ENDPOINT,
+				.data = & (const struct snd_usb_midi_endpoint_info) {
+					.out_cables = 0x0001,
+					.in_cables = 0x0001
+				}
+			},
+			{
+				.ifnum = -1
+			}
+		}
+	}
+},
 /* this catches most recent vendor-specific Roland devices */
 {
 	.match_flags = USB_DEVICE_ID_MATCH_VENDOR |
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2837 @ YAMAHA_DEVICE(0x7010, "UB99"),
 	}
 },
 
-/* Hauppauge HVR-950Q and HVR-850 */
-{
-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x7200),
-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
-		       USB_DEVICE_ID_MATCH_INT_CLASS |
-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
-	.bInterfaceClass = USB_CLASS_AUDIO,
-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.vendor_name = "Hauppauge",
-		.product_name = "HVR-950Q",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
-	}
-},
-{
-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x7210),
-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
-		       USB_DEVICE_ID_MATCH_INT_CLASS |
-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
-	.bInterfaceClass = USB_CLASS_AUDIO,
-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.vendor_name = "Hauppauge",
-		.product_name = "HVR-950Q",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
-	}
-},
-{
-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x7217),
-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
-		       USB_DEVICE_ID_MATCH_INT_CLASS |
-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
-	.bInterfaceClass = USB_CLASS_AUDIO,
-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.vendor_name = "Hauppauge",
-		.product_name = "HVR-950Q",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
-	}
-},
-{
-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x721b),
-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
-		       USB_DEVICE_ID_MATCH_INT_CLASS |
-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
-	.bInterfaceClass = USB_CLASS_AUDIO,
-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.vendor_name = "Hauppauge",
-		.product_name = "HVR-950Q",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
-	}
-},
-{
-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x721e),
-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
-		       USB_DEVICE_ID_MATCH_INT_CLASS |
-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
-	.bInterfaceClass = USB_CLASS_AUDIO,
-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.vendor_name = "Hauppauge",
-		.product_name = "HVR-950Q",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
-	}
-},
-{
-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x721f),
-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
-		       USB_DEVICE_ID_MATCH_INT_CLASS |
-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
-	.bInterfaceClass = USB_CLASS_AUDIO,
-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.vendor_name = "Hauppauge",
-		.product_name = "HVR-950Q",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
-	}
-},
-{
-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x7240),
-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
-		       USB_DEVICE_ID_MATCH_INT_CLASS |
-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
-	.bInterfaceClass = USB_CLASS_AUDIO,
-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.vendor_name = "Hauppauge",
-		.product_name = "HVR-850",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
-	}
-},
-{
-	USB_DEVICE_VENDOR_SPEC(0x2040, 0x7280),
-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
-		       USB_DEVICE_ID_MATCH_INT_CLASS |
-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
-	.bInterfaceClass = USB_CLASS_AUDIO,
-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.vendor_name = "Hauppauge",
-		.product_name = "HVR-950Q",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
-	}
-},
-{
-	USB_DEVICE_VENDOR_SPEC(0x0fd9, 0x0008),
-	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
-		       USB_DEVICE_ID_MATCH_INT_CLASS |
-		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
-	.bInterfaceClass = USB_CLASS_AUDIO,
-	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
-	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-		.vendor_name = "Hauppauge",
-		.product_name = "HVR-950Q",
-		.ifnum = QUIRK_ANY_INTERFACE,
-		.type = QUIRK_AUDIO_ALIGN_TRANSFER,
-	}
-},
+/*
+ * Auvitek au0828 devices with audio interface.
+ * This should be kept in sync with drivers/media/usb/au0828/au0828-cards.c
+ * Please notice that some drivers are DVB only, and don't need to be
+ * here. That's the case, for example, of DVICO_FUSIONHDTV7.
+ */
+
+#define AU0828_DEVICE(vid, pid, vname, pname) { \
+	USB_DEVICE_VENDOR_SPEC(vid, pid), \
+	.match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
+		       USB_DEVICE_ID_MATCH_INT_CLASS | \
+		       USB_DEVICE_ID_MATCH_INT_SUBCLASS, \
+	.bInterfaceClass = USB_CLASS_AUDIO, \
+	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, \
+	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { \
+		.vendor_name = vname, \
+		.product_name = pname, \
+		.ifnum = QUIRK_ANY_INTERFACE, \
+		.type = QUIRK_AUDIO_ALIGN_TRANSFER, \
+	} \
+}
+
+AU0828_DEVICE(0x2040, 0x7200, "Hauppauge", "HVR-950Q"),
+AU0828_DEVICE(0x2040, 0x7240, "Hauppauge", "HVR-850"),
+AU0828_DEVICE(0x2040, 0x7210, "Hauppauge", "HVR-950Q"),
+AU0828_DEVICE(0x2040, 0x7217, "Hauppauge", "HVR-950Q"),
+AU0828_DEVICE(0x2040, 0x721b, "Hauppauge", "HVR-950Q"),
+AU0828_DEVICE(0x2040, 0x721e, "Hauppauge", "HVR-950Q"),
+AU0828_DEVICE(0x2040, 0x721f, "Hauppauge", "HVR-950Q"),
+AU0828_DEVICE(0x2040, 0x7280, "Hauppauge", "HVR-950Q"),
+AU0828_DEVICE(0x0fd9, 0x0008, "Hauppauge", "HVR-950Q"),
+AU0828_DEVICE(0x2040, 0x7201, "Hauppauge", "HVR-950Q-MXL"),
+AU0828_DEVICE(0x2040, 0x7211, "Hauppauge", "HVR-950Q-MXL"),
+AU0828_DEVICE(0x2040, 0x7281, "Hauppauge", "HVR-950Q-MXL"),
+AU0828_DEVICE(0x05e1, 0x0480, "Hauppauge", "Woodbury"),
+AU0828_DEVICE(0x2040, 0x8200, "Hauppauge", "Woodbury"),
+AU0828_DEVICE(0x2040, 0x7260, "Hauppauge", "HVR-950Q"),
+AU0828_DEVICE(0x2040, 0x7213, "Hauppauge", "HVR-950Q"),
+AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
 
 /* Digidesign Mbox */
 {
Index: linux-3.18.13-rt10-r7s4/tools/perf/util/cloexec.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/tools/perf/util/cloexec.c
+++ linux-3.18.13-rt10-r7s4/tools/perf/util/cloexec.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:28 @ static int perf_flag_probe(void)
 	if (cpu < 0)
 		cpu = 0;
 
+	/*
+	 * Using -1 for the pid is a workaround to avoid gratuitous jump label
+	 * changes.
+	 */
 	while (1) {
 		/* check cloexec flag */
 		fd = sys_perf_event_open(&attr, pid, cpu, -1,
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:54 @ static int perf_flag_probe(void)
 		  err, strerror_r(err, sbuf, sizeof(sbuf)));
 
 	/* not supported, confirm error related to PERF_FLAG_FD_CLOEXEC */
-	fd = sys_perf_event_open(&attr, pid, cpu, -1, 0);
+	while (1) {
+		fd = sys_perf_event_open(&attr, pid, cpu, -1, 0);
+		if (fd < 0 && pid == -1 && errno == EACCES) {
+			pid = 0;
+			continue;
+		}
+		break;
+	}
 	err = errno;
 
+	if (fd >= 0)
+		close(fd);
+
 	if (WARN_ONCE(fd < 0 && err != EBUSY,
 		      "perf_event_open(..., 0) failed unexpectedly with error %d (%s)\n",
 		      err, strerror_r(err, sbuf, sizeof(sbuf))))
 		return -1;
 
-	close(fd);
-
 	return 0;
 }
 
Index: linux-3.18.13-rt10-r7s4/tools/perf/util/event.h
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/tools/perf/util/event.h
+++ linux-3.18.13-rt10-r7s4/tools/perf/util/event.h
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:217 @ struct events_stats {
 	u32 nr_invalid_chains;
 	u32 nr_unknown_id;
 	u32 nr_unprocessable_samples;
+	u32 nr_unordered_events;
 };
 
 struct attr_event {
Index: linux-3.18.13-rt10-r7s4/tools/perf/util/session.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/tools/perf/util/session.c
+++ linux-3.18.13-rt10-r7s4/tools/perf/util/session.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:524 @ int perf_session_queue_event(struct perf
 		return -ETIME;
 
 	if (timestamp < oe->last_flush) {
-		WARN_ONCE(1, "Timestamp below last timeslice flush\n");
-
-		pr_oe_time(timestamp,      "out of order event");
+		pr_oe_time(timestamp,      "out of order event\n");
 		pr_oe_time(oe->last_flush, "last flush, last_flush_type %d\n",
 			   oe->last_flush_type);
 
-		/* We could get out of order messages after forced flush. */
-		if (oe->last_flush_type != OE_FLUSH__HALF)
-			return -EINVAL;
+		s->stats.nr_unordered_events++;
 	}
 
 	new = ordered_events__new(oe, timestamp, event);
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:1056 @ static void perf_session__warn_about_err
 			    "Do you have a KVM guest running and not using 'perf kvm'?\n",
 			    session->stats.nr_unprocessable_samples);
 	}
+
+	if (session->stats.nr_unordered_events != 0)
+		ui__warning("%u out of order events recorded.\n", session->stats.nr_unordered_events);
 }
 
 volatile int session_done;
Index: linux-3.18.13-rt10-r7s4/tools/testing/ktest/ktest.pl
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/tools/testing/ktest/ktest.pl
+++ linux-3.18.13-rt10-r7s4/tools/testing/ktest/ktest.pl
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:3574 @ sub test_this_config {
     undef %configs;
     assign_configs \%configs, $output_config;
 
-    return $config if (!defined($configs{$config}));
+    if (!defined($configs{$config}) || $configs{$config} =~ /^#/) {
+	return $config;
+    }
 
     doprint "disabling config $config did not change .config\n";
 
Index: linux-3.18.13-rt10-r7s4/tools/testing/selftests/mount/unprivileged-remount-test.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/tools/testing/selftests/mount/unprivileged-remount-test.c
+++ linux-3.18.13-rt10-r7s4/tools/testing/selftests/mount/unprivileged-remount-test.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:9 @
 #include <sys/types.h>
 #include <sys/mount.h>
 #include <sys/wait.h>
+#include <sys/vfs.h>
+#include <sys/statvfs.h>
 #include <stdlib.h>
 #include <unistd.h>
 #include <fcntl.h>
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:37 @
 # define CLONE_NEWPID 0x20000000
 #endif
 
+#ifndef MS_REC
+# define MS_REC 16384
+#endif
 #ifndef MS_RELATIME
-#define MS_RELATIME (1 << 21)
+# define MS_RELATIME (1 << 21)
 #endif
 #ifndef MS_STRICTATIME
-#define MS_STRICTATIME (1 << 24)
+# define MS_STRICTATIME (1 << 24)
 #endif
 
 static void die(char *fmt, ...)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:56 @ static void die(char *fmt, ...)
 	exit(EXIT_FAILURE);
 }
 
-static void write_file(char *filename, char *fmt, ...)
+static void vmaybe_write_file(bool enoent_ok, char *filename, char *fmt, va_list ap)
 {
 	char buf[4096];
 	int fd;
 	ssize_t written;
 	int buf_len;
-	va_list ap;
 
-	va_start(ap, fmt);
 	buf_len = vsnprintf(buf, sizeof(buf), fmt, ap);
-	va_end(ap);
 	if (buf_len < 0) {
 		die("vsnprintf failed: %s\n",
 		    strerror(errno));
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:74 @ static void write_file(char *filename, c
 
 	fd = open(filename, O_WRONLY);
 	if (fd < 0) {
+		if ((errno == ENOENT) && enoent_ok)
+			return;
 		die("open of %s failed: %s\n",
 		    filename, strerror(errno));
 	}
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:94 @ static void write_file(char *filename, c
 	}
 }
 
+static void maybe_write_file(char *filename, char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	vmaybe_write_file(true, filename, fmt, ap);
+	va_end(ap);
+
+}
+
+static void write_file(char *filename, char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	vmaybe_write_file(false, filename, fmt, ap);
+	va_end(ap);
+
+}
+
+static int read_mnt_flags(const char *path)
+{
+	int ret;
+	struct statvfs stat;
+	int mnt_flags;
+
+	ret = statvfs(path, &stat);
+	if (ret != 0) {
+		die("statvfs of %s failed: %s\n",
+			path, strerror(errno));
+	}
+	if (stat.f_flag & ~(ST_RDONLY | ST_NOSUID | ST_NODEV | \
+			ST_NOEXEC | ST_NOATIME | ST_NODIRATIME | ST_RELATIME | \
+			ST_SYNCHRONOUS | ST_MANDLOCK)) {
+		die("Unrecognized mount flags\n");
+	}
+	mnt_flags = 0;
+	if (stat.f_flag & ST_RDONLY)
+		mnt_flags |= MS_RDONLY;
+	if (stat.f_flag & ST_NOSUID)
+		mnt_flags |= MS_NOSUID;
+	if (stat.f_flag & ST_NODEV)
+		mnt_flags |= MS_NODEV;
+	if (stat.f_flag & ST_NOEXEC)
+		mnt_flags |= MS_NOEXEC;
+	if (stat.f_flag & ST_NOATIME)
+		mnt_flags |= MS_NOATIME;
+	if (stat.f_flag & ST_NODIRATIME)
+		mnt_flags |= MS_NODIRATIME;
+	if (stat.f_flag & ST_RELATIME)
+		mnt_flags |= MS_RELATIME;
+	if (stat.f_flag & ST_SYNCHRONOUS)
+		mnt_flags |= MS_SYNCHRONOUS;
+	if (stat.f_flag & ST_MANDLOCK)
+		mnt_flags |= ST_MANDLOCK;
+
+	return mnt_flags;
+}
+
 static void create_and_enter_userns(void)
 {
 	uid_t uid;
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:166 @ static void create_and_enter_userns(void
 			strerror(errno));
 	}
 
+	maybe_write_file("/proc/self/setgroups", "deny");
 	write_file("/proc/self/uid_map", "0 %d 1", uid);
 	write_file("/proc/self/gid_map", "0 %d 1", gid);
 
-	if (setgroups(0, NULL) != 0) {
-		die("setgroups failed: %s\n",
-			strerror(errno));
-	}
 	if (setgid(0) != 0) {
 		die ("setgid(0) failed %s\n",
 			strerror(errno));
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:181 @ static void create_and_enter_userns(void
 }
 
 static
-bool test_unpriv_remount(int mount_flags, int remount_flags, int invalid_flags)
+bool test_unpriv_remount(const char *fstype, const char *mount_options,
+			 int mount_flags, int remount_flags, int invalid_flags)
 {
 	pid_t child;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:215 @ bool test_unpriv_remount(int mount_flags
 			strerror(errno));
 	}
 
-	if (mount("testing", "/tmp", "ramfs", mount_flags, NULL) != 0) {
-		die("mount of /tmp failed: %s\n",
-			strerror(errno));
+	if (mount("testing", "/tmp", fstype, mount_flags, mount_options) != 0) {
+		die("mount of %s with options '%s' on /tmp failed: %s\n",
+		    fstype,
+		    mount_options? mount_options : "",
+		    strerror(errno));
 	}
 
 	create_and_enter_userns();
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:247 @ bool test_unpriv_remount(int mount_flags
 
 static bool test_unpriv_remount_simple(int mount_flags)
 {
-	return test_unpriv_remount(mount_flags, mount_flags, 0);
+	return test_unpriv_remount("ramfs", NULL, mount_flags, mount_flags, 0);
 }
 
 static bool test_unpriv_remount_atime(int mount_flags, int invalid_flags)
 {
-	return test_unpriv_remount(mount_flags, mount_flags, invalid_flags);
+	return test_unpriv_remount("ramfs", NULL, mount_flags, mount_flags,
+				   invalid_flags);
+}
+
+static bool test_priv_mount_unpriv_remount(void)
+{
+	pid_t child;
+	int ret;
+	const char *orig_path = "/dev";
+	const char *dest_path = "/tmp";
+	int orig_mnt_flags, remount_mnt_flags;
+
+	child = fork();
+	if (child == -1) {
+		die("fork failed: %s\n",
+			strerror(errno));
+	}
+	if (child != 0) { /* parent */
+		pid_t pid;
+		int status;
+		pid = waitpid(child, &status, 0);
+		if (pid == -1) {
+			die("waitpid failed: %s\n",
+				strerror(errno));
+		}
+		if (pid != child) {
+			die("waited for %d got %d\n",
+				child, pid);
+		}
+		if (!WIFEXITED(status)) {
+			die("child did not terminate cleanly\n");
+		}
+		return WEXITSTATUS(status) == EXIT_SUCCESS ? true : false;
+	}
+
+	orig_mnt_flags = read_mnt_flags(orig_path);
+
+	create_and_enter_userns();
+	ret = unshare(CLONE_NEWNS);
+	if (ret != 0) {
+		die("unshare(CLONE_NEWNS) failed: %s\n",
+			strerror(errno));
+	}
+
+	ret = mount(orig_path, dest_path, "bind", MS_BIND | MS_REC, NULL);
+	if (ret != 0) {
+		die("recursive bind mount of %s onto %s failed: %s\n",
+			orig_path, dest_path, strerror(errno));
+	}
+
+	ret = mount(dest_path, dest_path, "none",
+		    MS_REMOUNT | MS_BIND | orig_mnt_flags , NULL);
+	if (ret != 0) {
+		/* system("cat /proc/self/mounts"); */
+		die("remount of /tmp failed: %s\n",
+		    strerror(errno));
+	}
+
+	remount_mnt_flags = read_mnt_flags(dest_path);
+	if (orig_mnt_flags != remount_mnt_flags) {
+		die("Mount flags unexpectedly changed during remount of %s originally mounted on %s\n",
+			dest_path, orig_path);
+	}
+	exit(EXIT_SUCCESS);
 }
 
 int main(int argc, char **argv)
 {
-	if (!test_unpriv_remount_simple(MS_RDONLY|MS_NODEV)) {
+	if (!test_unpriv_remount_simple(MS_RDONLY)) {
 		die("MS_RDONLY malfunctions\n");
 	}
-	if (!test_unpriv_remount_simple(MS_NODEV)) {
+	if (!test_unpriv_remount("devpts", "newinstance", MS_NODEV, MS_NODEV, 0)) {
 		die("MS_NODEV malfunctions\n");
 	}
-	if (!test_unpriv_remount_simple(MS_NOSUID|MS_NODEV)) {
+	if (!test_unpriv_remount_simple(MS_NOSUID)) {
 		die("MS_NOSUID malfunctions\n");
 	}
-	if (!test_unpriv_remount_simple(MS_NOEXEC|MS_NODEV)) {
+	if (!test_unpriv_remount_simple(MS_NOEXEC)) {
 		die("MS_NOEXEC malfunctions\n");
 	}
-	if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODEV,
-				       MS_NOATIME|MS_NODEV))
+	if (!test_unpriv_remount_atime(MS_RELATIME,
+				       MS_NOATIME))
 	{
 		die("MS_RELATIME malfunctions\n");
 	}
-	if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODEV,
-				       MS_NOATIME|MS_NODEV))
+	if (!test_unpriv_remount_atime(MS_STRICTATIME,
+				       MS_NOATIME))
 	{
 		die("MS_STRICTATIME malfunctions\n");
 	}
-	if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODEV,
-				       MS_STRICTATIME|MS_NODEV))
+	if (!test_unpriv_remount_atime(MS_NOATIME,
+				       MS_STRICTATIME))
 	{
-		die("MS_RELATIME malfunctions\n");
+		die("MS_NOATIME malfunctions\n");
 	}
-	if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODIRATIME|MS_NODEV,
-				       MS_NOATIME|MS_NODEV))
+	if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODIRATIME,
+				       MS_NOATIME))
 	{
-		die("MS_RELATIME malfunctions\n");
+		die("MS_RELATIME|MS_NODIRATIME malfunctions\n");
 	}
-	if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODIRATIME|MS_NODEV,
-				       MS_NOATIME|MS_NODEV))
+	if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODIRATIME,
+				       MS_NOATIME))
 	{
-		die("MS_RELATIME malfunctions\n");
+		die("MS_STRICTATIME|MS_NODIRATIME malfunctions\n");
 	}
-	if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODIRATIME|MS_NODEV,
-				       MS_STRICTATIME|MS_NODEV))
+	if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODIRATIME,
+				       MS_STRICTATIME))
 	{
-		die("MS_RELATIME malfunctions\n");
+		die("MS_NOATIME|MS_DIRATIME malfunctions\n");
 	}
-	if (!test_unpriv_remount(MS_STRICTATIME|MS_NODEV, MS_NODEV,
-				 MS_NOATIME|MS_NODEV))
+	if (!test_unpriv_remount("ramfs", NULL, MS_STRICTATIME, 0, MS_NOATIME))
 	{
 		die("Default atime malfunctions\n");
 	}
+	if (!test_priv_mount_unpriv_remount()) {
+		die("Mount flags unexpectedly changed after remount\n");
+	}
 	return EXIT_SUCCESS;
 }
Index: linux-3.18.13-rt10-r7s4/virt/kvm/kvm_main.c
===================================================================
--- linux-3.18.13-rt10-r7s4.orig/virt/kvm/kvm_main.c
+++ linux-3.18.13-rt10-r7s4/virt/kvm/kvm_main.c
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:481 @ static struct kvm *kvm_create_vm(unsigne
 	BUILD_BUG_ON(KVM_MEM_SLOTS_NUM > SHRT_MAX);
 
 	r = -ENOMEM;
-	kvm->memslots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
+	kvm->memslots = kvm_kvzalloc(sizeof(struct kvm_memslots));
 	if (!kvm->memslots)
 		goto out_err_no_srcu;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:532 @ out_err_no_srcu:
 out_err_no_disable:
 	for (i = 0; i < KVM_NR_BUSES; i++)
 		kfree(kvm->buses[i]);
-	kfree(kvm->memslots);
+	kvfree(kvm->memslots);
 	kvm_arch_free_vm(kvm);
 	return ERR_PTR(r);
 }
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:588 @ static void kvm_free_physmem(struct kvm
 	kvm_for_each_memslot(memslot, slots)
 		kvm_free_physmem_slot(kvm, memslot, NULL);
 
-	kfree(kvm->memslots);
+	kvfree(kvm->memslots);
 }
 
 static void kvm_destroy_devices(struct kvm *kvm)
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:870 @ int __kvm_set_memory_region(struct kvm *
 	}
 
 	if ((change == KVM_MR_DELETE) || (change == KVM_MR_MOVE)) {
-		slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots),
-				GFP_KERNEL);
+		slots = kvm_kvzalloc(sizeof(struct kvm_memslots));
 		if (!slots)
 			goto out_free;
+		memcpy(slots, kvm->memslots, sizeof(struct kvm_memslots));
+
 		slot = id_to_memslot(slots, mem->slot);
 		slot->flags |= KVM_MEMSLOT_INVALID;
 
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:904 @ int __kvm_set_memory_region(struct kvm *
 	 * will get overwritten by update_memslots anyway.
 	 */
 	if (!slots) {
-		slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots),
-				GFP_KERNEL);
+		slots = kvm_kvzalloc(sizeof(struct kvm_memslots));
 		if (!slots)
 			goto out_free;
+		memcpy(slots, kvm->memslots, sizeof(struct kvm_memslots));
 	}
 
 	/* actual memory is freed via old in kvm_free_physmem_slot below */
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:921 @ int __kvm_set_memory_region(struct kvm *
 	kvm_arch_commit_memory_region(kvm, mem, &old, change);
 
 	kvm_free_physmem_slot(kvm, &old, &new);
-	kfree(old_memslots);
+	kvfree(old_memslots);
 
 	/*
 	 * IOMMU mapping:  New slots need to be mapped.  Old slots need to be
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:940 @ int __kvm_set_memory_region(struct kvm *
 	return 0;
 
 out_slots:
-	kfree(slots);
+	kvfree(slots);
 out_free:
 	kvm_free_physmem_slot(kvm, &new, &old);
 out:
@ linux-3.18.13-rt10-r7s4/Documentation/devicetree/bindings/i2c/i2c-designware.txt:2421 @ static long kvm_vm_ioctl_check_extension
 	case KVM_CAP_SIGNAL_MSI:
 #endif
 #ifdef CONFIG_HAVE_KVM_IRQFD
+	case KVM_CAP_IRQFD:
 	case KVM_CAP_IRQFD_RESAMPLE:
 #endif
 	case KVM_CAP_CHECK_EXTENSION_VM: