[gentoo-commits] proj/linux-patches:4.7 commit in: /

[Alice Ferrazzi]

commit:     62792f42f1f905a8040f299e7ad492de6b237028
Author:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Sat Oct  8 11:35:32 2016 +0000
Commit:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Sat Oct  8 11:35:32 2016 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=62792f42

Linux patch 4.7.7.

 0000_README            |    4 +
 1006_linux-4.7.7.patch | 3811 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 3815 insertions(+)

diff --git a/0000_README b/0000_README
index 87048e9..01abfe8 100644
--- a/0000_README
+++ b/0000_README
@@ -67,6 +67,10 @@ Patch:  1005_linux-4.7.6.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.7.6
 
+Patch:  1006_linux-4.7.7.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.7.7
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1006_linux-4.7.7.patch b/1006_linux-4.7.7.patch
new file mode 100644
index 0000000..3bee058
--- /dev/null
+++ b/1006_linux-4.7.7.patch
@@ -0,0 +1,3811 @@
+diff --git a/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt b/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
+index 46c6f3ed1a1c..0fa3b0fac129 100644
+--- a/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
++++ b/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
+@@ -113,9 +113,9 @@ pm8916:
+ 	l14, l15, l16, l17, l18
+ 
+ pm8941:
+-	s1, s2, s3, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13, l14,
+-	l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3,
+-	mvs1, mvs2
++	s1, s2, s3, s4, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13,
++	l14, l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3,
++	5vs1, 5vs2
+ 
+ pm8994:
+ 	s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, l1, l2, l3, l4, l5,
+diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt
+index 4976389e432d..dd15a699ee1c 100644
+--- a/Documentation/pinctrl.txt
++++ b/Documentation/pinctrl.txt
+@@ -831,7 +831,7 @@ separate memory range only intended for GPIO driving, and the register
+ range dealing with pin config and pin multiplexing get placed into a
+ different memory range and a separate section of the data sheet.
+ 
+-A flag "strict" in struct pinctrl_desc is available to check and deny
++A flag "strict" in struct pinmux_ops is available to check and deny
+ simultaneous access to the same pin from GPIO and pin multiplexing
+ consumers on hardware of this type. The pinctrl driver should set this flag
+ accordingly.
+diff --git a/Makefile b/Makefile
+index 48b0120be59b..320a9308470b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 7
+-SUBLEVEL = 6
++SUBLEVEL = 7
+ EXTRAVERSION =
+ NAME = Psychotic Stoned Sheep
+ 
+diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
+index af11c2f8f3b7..fc6d541549a2 100644
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -779,7 +779,7 @@ __armv7_mmu_cache_on:
+ 		orrne	r0, r0, #1		@ MMU enabled
+ 		movne	r1, #0xfffffffd		@ domain 0 = client
+ 		bic     r6, r6, #1 << 31        @ 32-bit translation system
+-		bic     r6, r6, #3 << 0         @ use only ttbr0
++		bic     r6, r6, #(7 << 0) | (1 << 4)	@ use only ttbr0
+ 		mcrne	p15, 0, r3, c2, c0, 0	@ load page table pointer
+ 		mcrne	p15, 0, r1, c3, c0, 0	@ load domain access control
+ 		mcrne   p15, 0, r6, c2, c0, 2   @ load ttb control
+diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts
+index 96ea936eeeb0..240a2864d044 100644
+--- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
++++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
+@@ -64,7 +64,7 @@
+ 	cd-gpios = <&gpio7 11 GPIO_ACTIVE_LOW>;
+ 	no-1-8-v;
+ 	keep-power-in-suspend;
+-	enable-sdio-wakup;
++	wakeup-source;
+ 	status = "okay";
+ };
+ 
+diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
+index 263d46dbc7e6..2d78eee7cb55 100644
+--- a/arch/arm/boot/dts/sun5i-a13.dtsi
++++ b/arch/arm/boot/dts/sun5i-a13.dtsi
+@@ -84,7 +84,7 @@
+ 			trips {
+ 				cpu_alert0: cpu_alert0 {
+ 					/* milliCelsius */
+-					temperature = <850000>;
++					temperature = <85000>;
+ 					hysteresis = <2000>;
+ 					type = "passive";
+ 				};
+diff --git a/arch/arm/common/sa1111.c b/arch/arm/common/sa1111.c
+index fb0a0a4dfea4..0e437189b095 100644
+--- a/arch/arm/common/sa1111.c
++++ b/arch/arm/common/sa1111.c
+@@ -869,9 +869,9 @@ struct sa1111_save_data {
+ 
+ #ifdef CONFIG_PM
+ 
+-static int sa1111_suspend(struct platform_device *dev, pm_message_t state)
++static int sa1111_suspend_noirq(struct device *dev)
+ {
+-	struct sa1111 *sachip = platform_get_drvdata(dev);
++	struct sa1111 *sachip = dev_get_drvdata(dev);
+ 	struct sa1111_save_data *save;
+ 	unsigned long flags;
+ 	unsigned int val;
+@@ -934,9 +934,9 @@ static int sa1111_suspend(struct platform_device *dev, pm_message_t state)
+  *	restored by their respective drivers, and must be called
+  *	via LDM after this function.
+  */
+-static int sa1111_resume(struct platform_device *dev)
++static int sa1111_resume_noirq(struct device *dev)
+ {
+-	struct sa1111 *sachip = platform_get_drvdata(dev);
++	struct sa1111 *sachip = dev_get_drvdata(dev);
+ 	struct sa1111_save_data *save;
+ 	unsigned long flags, id;
+ 	void __iomem *base;
+@@ -952,7 +952,7 @@ static int sa1111_resume(struct platform_device *dev)
+ 	id = sa1111_readl(sachip->base + SA1111_SKID);
+ 	if ((id & SKID_ID_MASK) != SKID_SA1111_ID) {
+ 		__sa1111_remove(sachip);
+-		platform_set_drvdata(dev, NULL);
++		dev_set_drvdata(dev, NULL);
+ 		kfree(save);
+ 		return 0;
+ 	}
+@@ -1003,8 +1003,8 @@ static int sa1111_resume(struct platform_device *dev)
+ }
+ 
+ #else
+-#define sa1111_suspend NULL
+-#define sa1111_resume  NULL
++#define sa1111_suspend_noirq NULL
++#define sa1111_resume_noirq  NULL
+ #endif
+ 
+ static int sa1111_probe(struct platform_device *pdev)
+@@ -1038,6 +1038,11 @@ static int sa1111_remove(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
++static struct dev_pm_ops sa1111_pm_ops = {
++	.suspend_noirq = sa1111_suspend_noirq,
++	.resume_noirq = sa1111_resume_noirq,
++};
++
+ /*
+  *	Not sure if this should be on the system bus or not yet.
+  *	We really want some way to register a system device at
+@@ -1050,10 +1055,9 @@ static int sa1111_remove(struct platform_device *pdev)
+ static struct platform_driver sa1111_device_driver = {
+ 	.probe		= sa1111_probe,
+ 	.remove		= sa1111_remove,
+-	.suspend	= sa1111_suspend,
+-	.resume		= sa1111_resume,
+ 	.driver		= {
+ 		.name	= "sa1111",
++		.pm	= &sa1111_pm_ops,
+ 	},
+ };
+ 
+diff --git a/arch/arm/include/asm/dma-mapping.h b/arch/arm/include/asm/dma-mapping.h
+index a83570f10124..8ec98fc4eb2a 100644
+--- a/arch/arm/include/asm/dma-mapping.h
++++ b/arch/arm/include/asm/dma-mapping.h
+@@ -112,7 +112,7 @@ static inline dma_addr_t virt_to_dma(struct device *dev, void *addr)
+ /* The ARM override for dma_max_pfn() */
+ static inline unsigned long dma_max_pfn(struct device *dev)
+ {
+-	return PHYS_PFN_OFFSET + dma_to_pfn(dev, *dev->dma_mask);
++	return dma_to_pfn(dev, *dev->dma_mask);
+ }
+ #define dma_max_pfn(dev) dma_max_pfn(dev)
+ 
+diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c
+index 2e26016a91a5..5204978ec4fa 100644
+--- a/arch/arm/kernel/devtree.c
++++ b/arch/arm/kernel/devtree.c
+@@ -87,6 +87,8 @@ void __init arm_dt_init_cpu_maps(void)
+ 		return;
+ 
+ 	for_each_child_of_node(cpus, cpu) {
++		const __be32 *cell;
++		int prop_bytes;
+ 		u32 hwid;
+ 
+ 		if (of_node_cmp(cpu->type, "cpu"))
+@@ -98,7 +100,8 @@ void __init arm_dt_init_cpu_maps(void)
+ 		 * properties is considered invalid to build the
+ 		 * cpu_logical_map.
+ 		 */
+-		if (of_property_read_u32(cpu, "reg", &hwid)) {
++		cell = of_get_property(cpu, "reg", &prop_bytes);
++		if (!cell || prop_bytes < sizeof(*cell)) {
+ 			pr_debug(" * %s missing reg property\n",
+ 				     cpu->full_name);
+ 			of_node_put(cpu);
+@@ -106,10 +109,15 @@ void __init arm_dt_init_cpu_maps(void)
+ 		}
+ 
+ 		/*
+-		 * 8 MSBs must be set to 0 in the DT since the reg property
++		 * Bits n:24 must be set to 0 in the DT since the reg property
+ 		 * defines the MPIDR[23:0].
+ 		 */
+-		if (hwid & ~MPIDR_HWID_BITMASK) {
++		do {
++			hwid = be32_to_cpu(*cell++);
++			prop_bytes -= sizeof(*cell);
++		} while (!hwid && prop_bytes > 0);
++
++		if (prop_bytes || (hwid & ~MPIDR_HWID_BITMASK)) {
+ 			of_node_put(cpu);
+ 			return;
+ 		}
+diff --git a/arch/arm/mach-sa1100/clock.c b/arch/arm/mach-sa1100/clock.c
+index cbf53bb9c814..0db46895c82a 100644
+--- a/arch/arm/mach-sa1100/clock.c
++++ b/arch/arm/mach-sa1100/clock.c
+@@ -125,6 +125,8 @@ static unsigned long clk_36864_get_rate(struct clk *clk)
+ }
+ 
+ static struct clkops clk_36864_ops = {
++	.enable		= clk_cpu_enable,
++	.disable	= clk_cpu_disable,
+ 	.get_rate	= clk_36864_get_rate,
+ };
+ 
+@@ -140,9 +142,8 @@ static struct clk_lookup sa11xx_clkregs[] = {
+ 	CLKDEV_INIT(NULL, "OSTIMER0", &clk_36864),
+ };
+ 
+-static int __init sa11xx_clk_init(void)
++int __init sa11xx_clk_init(void)
+ {
+ 	clkdev_add_table(sa11xx_clkregs, ARRAY_SIZE(sa11xx_clkregs));
+ 	return 0;
+ }
+-core_initcall(sa11xx_clk_init);
+diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
+index 345e63f4eb71..3e09beddb6e8 100644
+--- a/arch/arm/mach-sa1100/generic.c
++++ b/arch/arm/mach-sa1100/generic.c
+@@ -34,6 +34,7 @@
+ 
+ #include <mach/hardware.h>
+ #include <mach/irqs.h>
++#include <mach/reset.h>
+ 
+ #include "generic.h"
+ #include <clocksource/pxa.h>
+@@ -95,6 +96,8 @@ static void sa1100_power_off(void)
+ 
+ void sa11x0_restart(enum reboot_mode mode, const char *cmd)
+ {
++	clear_reset_status(RESET_STATUS_ALL);
++
+ 	if (mode == REBOOT_SOFT) {
+ 		/* Jump into ROM at address 0 */
+ 		soft_restart(0);
+@@ -388,6 +391,7 @@ void __init sa1100_init_irq(void)
+ 	sa11x0_init_irq_nodt(IRQ_GPIO0_SC, irq_resource.start);
+ 
+ 	sa1100_init_gpio();
++	sa11xx_clk_init();
+ }
+ 
+ /*
+diff --git a/arch/arm/mach-sa1100/generic.h b/arch/arm/mach-sa1100/generic.h
+index 0d92e119b36b..68199b603ff7 100644
+--- a/arch/arm/mach-sa1100/generic.h
++++ b/arch/arm/mach-sa1100/generic.h
+@@ -44,3 +44,5 @@ int sa11x0_pm_init(void);
+ #else
+ static inline int sa11x0_pm_init(void) { return 0; }
+ #endif
++
++int sa11xx_clk_init(void);
+diff --git a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
+index 62437b57813e..73e3adbc1330 100644
+--- a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
++++ b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
+@@ -41,39 +41,26 @@
+ 
+ #define REGULATOR_IRQ_MASK	BIT(2)	/* IRQ2, active low */
+ 
+-static void __iomem *irqc;
+-
+-static const u8 da9063_mask_regs[] = {
+-	DA9063_REG_IRQ_MASK_A,
+-	DA9063_REG_IRQ_MASK_B,
+-	DA9063_REG_IRQ_MASK_C,
+-	DA9063_REG_IRQ_MASK_D,
+-};
+-
+-/* DA9210 System Control and Event Registers */
++/* start of DA9210 System Control and Event Registers */
+ #define DA9210_REG_MASK_A		0x54
+-#define DA9210_REG_MASK_B		0x55
+-
+-static const u8 da9210_mask_regs[] = {
+-	DA9210_REG_MASK_A,
+-	DA9210_REG_MASK_B,
+-};
+-
+-static void da9xxx_mask_irqs(struct i2c_client *client, const u8 regs[],
+-			     unsigned int nregs)
+-{
+-	unsigned int i;
+ 
+-	dev_info(&client->dev, "Masking %s interrupt sources\n", client->name);
++static void __iomem *irqc;
+ 
+-	for (i = 0; i < nregs; i++) {
+-		int error = i2c_smbus_write_byte_data(client, regs[i], ~0);
+-		if (error) {
+-			dev_err(&client->dev, "i2c error %d\n", error);
+-			return;
+-		}
+-	}
+-}
++/* first byte sets the memory pointer, following are consecutive reg values */
++static u8 da9063_irq_clr[] = { DA9063_REG_IRQ_MASK_A, 0xff, 0xff, 0xff, 0xff };
++static u8 da9210_irq_clr[] = { DA9210_REG_MASK_A, 0xff, 0xff };
++
++static struct i2c_msg da9xxx_msgs[2] = {
++	{
++		.addr = 0x58,
++		.len = ARRAY_SIZE(da9063_irq_clr),
++		.buf = da9063_irq_clr,
++	}, {
++		.addr = 0x68,
++		.len = ARRAY_SIZE(da9210_irq_clr),
++		.buf = da9210_irq_clr,
++	},
++};
+ 
+ static int regulator_quirk_notify(struct notifier_block *nb,
+ 				  unsigned long action, void *data)
+@@ -93,12 +80,15 @@ static int regulator_quirk_notify(struct notifier_block *nb,
+ 	client = to_i2c_client(dev);
+ 	dev_dbg(dev, "Detected %s\n", client->name);
+ 
+-	if ((client->addr == 0x58 && !strcmp(client->name, "da9063")))
+-		da9xxx_mask_irqs(client, da9063_mask_regs,
+-				 ARRAY_SIZE(da9063_mask_regs));
+-	else if (client->addr == 0x68 && !strcmp(client->name, "da9210"))
+-		da9xxx_mask_irqs(client, da9210_mask_regs,
+-				 ARRAY_SIZE(da9210_mask_regs));
++	if ((client->addr == 0x58 && !strcmp(client->name, "da9063")) ||
++	    (client->addr == 0x68 && !strcmp(client->name, "da9210"))) {
++		int ret;
++
++		dev_info(&client->dev, "clearing da9063/da9210 interrupts\n");
++		ret = i2c_transfer(client->adapter, da9xxx_msgs, ARRAY_SIZE(da9xxx_msgs));
++		if (ret != ARRAY_SIZE(da9xxx_msgs))
++			dev_err(&client->dev, "i2c error %d\n", ret);
++	}
+ 
+ 	mon = ioread32(irqc + IRQC_MONITOR);
+ 	if (mon & REGULATOR_IRQ_MASK)
+diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
+index 0800d23e2fdd..b463607bc816 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -417,8 +417,10 @@ int kernel_active_single_step(void)
+ /* ptrace API */
+ void user_enable_single_step(struct task_struct *task)
+ {
+-	set_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP);
+-	set_regs_spsr_ss(task_pt_regs(task));
++	struct thread_info *ti = task_thread_info(task);
++
++	if (!test_and_set_ti_thread_flag(ti, TIF_SINGLESTEP))
++		set_regs_spsr_ss(task_pt_regs(task));
+ }
+ 
+ void user_disable_single_step(struct task_struct *task)
+diff --git a/arch/avr32/mach-at32ap/pio.c b/arch/avr32/mach-at32ap/pio.c
+index 83c2a0021b56..13d3fc4270b7 100644
+--- a/arch/avr32/mach-at32ap/pio.c
++++ b/arch/avr32/mach-at32ap/pio.c
+@@ -435,7 +435,7 @@ void __init at32_init_pio(struct platform_device *pdev)
+ 	struct resource *regs;
+ 	struct pio_device *pio;
+ 
+-	if (pdev->id > MAX_NR_PIO_DEVICES) {
++	if (pdev->id >= MAX_NR_PIO_DEVICES) {
+ 		dev_err(&pdev->dev, "only %d PIO devices supported\n",
+ 			MAX_NR_PIO_DEVICES);
+ 		return;
+diff --git a/arch/mips/include/asm/uprobes.h b/arch/mips/include/asm/uprobes.h
+index 34c325c674c4..70a4a2f173ff 100644
+--- a/arch/mips/include/asm/uprobes.h
++++ b/arch/mips/include/asm/uprobes.h
+@@ -36,7 +36,6 @@ struct arch_uprobe {
+ 	unsigned long	resume_epc;
+ 	u32	insn[2];
+ 	u32	ixol[2];
+-	union	mips_instruction orig_inst[MAX_UINSN_BYTES / 4];
+ };
+ 
+ struct arch_uprobe_task {
+diff --git a/arch/mips/kernel/uprobes.c b/arch/mips/kernel/uprobes.c
+index 8452d933a645..4e7b89f2e244 100644
+--- a/arch/mips/kernel/uprobes.c
++++ b/arch/mips/kernel/uprobes.c
+@@ -157,7 +157,6 @@ bool is_trap_insn(uprobe_opcode_t *insn)
+ int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
+ {
+ 	struct uprobe_task *utask = current->utask;
+-	union mips_instruction insn;
+ 
+ 	/*
+ 	 * Now find the EPC where to resume after the breakpoint has been
+@@ -168,10 +167,10 @@ int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
+ 		unsigned long epc;
+ 
+ 		epc = regs->cp0_epc;
+-		__compute_return_epc_for_insn(regs, insn);
++		__compute_return_epc_for_insn(regs,
++			(union mips_instruction) aup->insn[0]);
+ 		aup->resume_epc = regs->cp0_epc;
+ 	}
+-
+ 	utask->autask.saved_trap_nr = current->thread.trap_nr;
+ 	current->thread.trap_nr = UPROBE_TRAP_NR;
+ 	regs->cp0_epc = current->utask->xol_vaddr;
+@@ -257,7 +256,7 @@ unsigned long arch_uretprobe_hijack_return_addr(
+ 	ra = regs->regs[31];
+ 
+ 	/* Replace the return address with the trampoline address */
+-	regs->regs[31] = ra;
++	regs->regs[31] = trampoline_vaddr;
+ 
+ 	return ra;
+ }
+@@ -280,24 +279,6 @@ int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm,
+ 	return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
+ }
+ 
+-/**
+- * set_orig_insn - Restore the original instruction.
+- * @mm: the probed process address space.
+- * @auprobe: arch specific probepoint information.
+- * @vaddr: the virtual address to insert the opcode.
+- *
+- * For mm @mm, restore the original opcode (opcode) at @vaddr.
+- * Return 0 (success) or a negative errno.
+- *
+- * This overrides the weak version in kernel/events/uprobes.c.
+- */
+-int set_orig_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
+-		 unsigned long vaddr)
+-{
+-	return uprobe_write_opcode(mm, vaddr,
+-			*(uprobe_opcode_t *)&auprobe->orig_inst[0].word);
+-}
+-
+ void __weak arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
+ 				  void *src, unsigned long len)
+ {
+diff --git a/arch/mips/mti-malta/malta-setup.c b/arch/mips/mti-malta/malta-setup.c
+index 33d5ff5069e5..18b37a573eb4 100644
+--- a/arch/mips/mti-malta/malta-setup.c
++++ b/arch/mips/mti-malta/malta-setup.c
+@@ -39,6 +39,9 @@
+ #include <linux/console.h>
+ #endif
+ 
++#define ROCIT_CONFIG_GEN0		0x1f403000
++#define  ROCIT_CONFIG_GEN0_PCI_IOCU	BIT(7)
++
+ extern void malta_be_init(void);
+ extern int malta_be_handler(struct pt_regs *regs, int is_fixup);
+ 
+@@ -107,6 +110,8 @@ static void __init fd_activate(void)
+ static int __init plat_enable_iocoherency(void)
+ {
+ 	int supported = 0;
++	u32 cfg;
++
+ 	if (mips_revision_sconid == MIPS_REVISION_SCON_BONITO) {
+ 		if (BONITO_PCICACHECTRL & BONITO_PCICACHECTRL_CPUCOH_PRES) {
+ 			BONITO_PCICACHECTRL |= BONITO_PCICACHECTRL_CPUCOH_EN;
+@@ -129,7 +134,8 @@ static int __init plat_enable_iocoherency(void)
+ 	} else if (mips_cm_numiocu() != 0) {
+ 		/* Nothing special needs to be done to enable coherency */
+ 		pr_info("CMP IOCU detected\n");
+-		if ((*(unsigned int *)0xbf403000 & 0x81) != 0x81) {
++		cfg = __raw_readl((u32 *)CKSEG1ADDR(ROCIT_CONFIG_GEN0));
++		if (!(cfg & ROCIT_CONFIG_GEN0_PCI_IOCU)) {
+ 			pr_crit("IOCU OPERATION DISABLED BY SWITCH - DEFAULTING TO SW IO COHERENCY\n");
+ 			return 0;
+ 		}
+diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
+index 6ee4b72cda42..e97925ffa6c7 100644
+--- a/arch/powerpc/kernel/prom_init.c
++++ b/arch/powerpc/kernel/prom_init.c
+@@ -695,7 +695,7 @@ unsigned char ibm_architecture_vec[] = {
+ 	OV4_MIN_ENT_CAP,		/* minimum VP entitled capacity */
+ 
+ 	/* option vector 5: PAPR/OF options */
+-	VECTOR_LENGTH(18),		/* length */
++	VECTOR_LENGTH(21),		/* length */
+ 	0,				/* don't ignore, don't halt */
+ 	OV5_FEAT(OV5_LPAR) | OV5_FEAT(OV5_SPLPAR) | OV5_FEAT(OV5_LARGE_PAGES) |
+ 	OV5_FEAT(OV5_DRCONF_MEMORY) | OV5_FEAT(OV5_DONATE_DEDICATE_CPU) |
+@@ -726,8 +726,11 @@ unsigned char ibm_architecture_vec[] = {
+ 	0,
+ 	0,
+ 	OV5_FEAT(OV5_PFO_HW_RNG) | OV5_FEAT(OV5_PFO_HW_ENCR) |
+-	OV5_FEAT(OV5_PFO_HW_842),
+-	OV5_FEAT(OV5_SUB_PROCESSORS),
++	OV5_FEAT(OV5_PFO_HW_842),				/* Byte 17 */
++	0,							/* Byte 18 */
++	0,							/* Byte 19 */
++	0,							/* Byte 20 */
++	OV5_FEAT(OV5_SUB_PROCESSORS),				/* Byte 21 */
+ 
+ 	/* option vector 6: IBM PAPR hints */
+ 	VECTOR_LENGTH(3),		/* length */
+diff --git a/arch/tile/include/asm/elf.h b/arch/tile/include/asm/elf.h
+index c505d77e4d06..e9d54a06736f 100644
+--- a/arch/tile/include/asm/elf.h
++++ b/arch/tile/include/asm/elf.h
+@@ -129,6 +129,7 @@ extern int dump_task_regs(struct task_struct *, elf_gregset_t *);
+ struct linux_binprm;
+ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
+ 				       int executable_stack);
++/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */
+ #define ARCH_DLINFO \
+ do { \
+ 	NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE); \
+diff --git a/arch/tile/include/uapi/asm/auxvec.h b/arch/tile/include/uapi/asm/auxvec.h
+index c93e92709f14..f497123ed980 100644
+--- a/arch/tile/include/uapi/asm/auxvec.h
++++ b/arch/tile/include/uapi/asm/auxvec.h
+@@ -18,4 +18,6 @@
+ /* The vDSO location. */
+ #define AT_SYSINFO_EHDR         33
+ 
++#define AT_VECTOR_SIZE_ARCH 1 /* entries in ARCH_DLINFO */
++
+ #endif /* _ASM_TILE_AUXVEC_H */
+diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
+index 6fa85944af83..dee8a70382ba 100644
+--- a/arch/x86/include/asm/tlbflush.h
++++ b/arch/x86/include/asm/tlbflush.h
+@@ -81,7 +81,7 @@ DECLARE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate);
+ /* Initialize cr4 shadow for this CPU. */
+ static inline void cr4_init_shadow(void)
+ {
+-	this_cpu_write(cpu_tlbstate.cr4, __read_cr4());
++	this_cpu_write(cpu_tlbstate.cr4, __read_cr4_safe());
+ }
+ 
+ /* Set in this cpu's CR4. */
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 0fe6953f421c..41f3f7dd6323 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -804,21 +804,20 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
+ 		identify_cpu_without_cpuid(c);
+ 
+ 	/* cyrix could have cpuid enabled via c_identify()*/
+-	if (!have_cpuid_p())
+-		return;
++	if (have_cpuid_p()) {
++		cpu_detect(c);
++		get_cpu_vendor(c);
++		get_cpu_cap(c);
+ 
+-	cpu_detect(c);
+-	get_cpu_vendor(c);
+-	get_cpu_cap(c);
+-
+-	if (this_cpu->c_early_init)
+-		this_cpu->c_early_init(c);
++		if (this_cpu->c_early_init)
++			this_cpu->c_early_init(c);
+ 
+-	c->cpu_index = 0;
+-	filter_cpuid_features(c, false);
++		c->cpu_index = 0;
++		filter_cpuid_features(c, false);
+ 
+-	if (this_cpu->c_bsp_init)
+-		this_cpu->c_bsp_init(c);
++		if (this_cpu->c_bsp_init)
++			this_cpu->c_bsp_init(c);
++	}
+ 
+ 	setup_force_cpu_cap(X86_FEATURE_ALWAYS);
+ 	fpu__init_system(c);
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 8326d6891395..9ed64d2b9ab1 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -409,6 +409,7 @@ struct nested_vmx {
+ 	struct list_head vmcs02_pool;
+ 	int vmcs02_num;
+ 	u64 vmcs01_tsc_offset;
++	bool change_vmcs01_virtual_x2apic_mode;
+ 	/* L2 must run next, and mustn't decide to exit to L1. */
+ 	bool nested_run_pending;
+ 	/*
+@@ -8284,6 +8285,12 @@ static void vmx_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set)
+ {
+ 	u32 sec_exec_control;
+ 
++	/* Postpone execution until vmcs01 is the current VMCS. */
++	if (is_guest_mode(vcpu)) {
++		to_vmx(vcpu)->nested.change_vmcs01_virtual_x2apic_mode = true;
++		return;
++	}
++
+ 	/*
+ 	 * There is not point to enable virtualize x2apic without enable
+ 	 * apicv
+@@ -10601,6 +10608,12 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
+ 	/* Update TSC_OFFSET if TSC was changed while L2 ran */
+ 	vmcs_write64(TSC_OFFSET, vmx->nested.vmcs01_tsc_offset);
+ 
++	if (vmx->nested.change_vmcs01_virtual_x2apic_mode) {
++		vmx->nested.change_vmcs01_virtual_x2apic_mode = false;
++		vmx_set_virtual_x2apic_mode(vcpu,
++				vcpu->arch.apic_base & X2APIC_ENABLE);
++	}
++
+ 	/* This is needed for same reason as it was needed in prepare_vmcs02 */
+ 	vmx->host_rsp = 0;
+ 
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index f9b9049b1284..27dafb3a7a0e 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -784,7 +784,7 @@ static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx)
+ 		switch (ret) {
+ 		case BLK_MQ_RQ_QUEUE_OK:
+ 			queued++;
+-			continue;
++			break;
+ 		case BLK_MQ_RQ_QUEUE_BUSY:
+ 			list_add(&rq->queuelist, &rq_list);
+ 			__blk_mq_requeue_request(rq);
+diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
+index aa56af87d941..b11af3f2c1db 100644
+--- a/drivers/base/regmap/regcache-rbtree.c
++++ b/drivers/base/regmap/regcache-rbtree.c
+@@ -404,6 +404,7 @@ static int regcache_rbtree_write(struct regmap *map, unsigned int reg,
+ 		unsigned int new_base_reg, new_top_reg;
+ 		unsigned int min, max;
+ 		unsigned int max_dist;
++		unsigned int dist, best_dist = UINT_MAX;
+ 
+ 		max_dist = map->reg_stride * sizeof(*rbnode_tmp) /
+ 			map->cache_word_size;
+@@ -423,24 +424,41 @@ static int regcache_rbtree_write(struct regmap *map, unsigned int reg,
+ 				&base_reg, &top_reg);
+ 
+ 			if (base_reg <= max && top_reg >= min) {
+-				new_base_reg = min(reg, base_reg);
+-				new_top_reg = max(reg, top_reg);
+-			} else {
+-				if (max < base_reg)
+-					node = node->rb_left;
++				if (reg < base_reg)
++					dist = base_reg - reg;
++				else if (reg > top_reg)
++					dist = reg - top_reg;
+ 				else
+-					node = node->rb_right;
+-
+-				continue;
++					dist = 0;
++				if (dist < best_dist) {
++					rbnode = rbnode_tmp;
++					best_dist = dist;
++					new_base_reg = min(reg, base_reg);
++					new_top_reg = max(reg, top_reg);
++				}
+ 			}
+ 
+-			ret = regcache_rbtree_insert_to_block(map, rbnode_tmp,
++			/*
++			 * Keep looking, we want to choose the closest block,
++			 * otherwise we might end up creating overlapping
++			 * blocks, which breaks the rbtree.
++			 */
++			if (reg < base_reg)
++				node = node->rb_left;
++			else if (reg > top_reg)
++				node = node->rb_right;
++			else
++				break;
++		}
++
++		if (rbnode) {
++			ret = regcache_rbtree_insert_to_block(map, rbnode,
+ 							      new_base_reg,
+ 							      new_top_reg, reg,
+ 							      value);
+ 			if (ret)
+ 				return ret;
+-			rbtree_ctx->cached_rbnode = rbnode_tmp;
++			rbtree_ctx->cached_rbnode = rbnode;
+ 			return 0;
+ 		}
+ 
+diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
+index 8a1432e8bb80..01d4be2c354b 100644
+--- a/drivers/char/hw_random/omap-rng.c
++++ b/drivers/char/hw_random/omap-rng.c
+@@ -384,7 +384,12 @@ static int omap_rng_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	pm_runtime_enable(&pdev->dev);
+-	pm_runtime_get_sync(&pdev->dev);
++	ret = pm_runtime_get_sync(&pdev->dev);
++	if (ret) {
++		dev_err(&pdev->dev, "Failed to runtime_get device: %d\n", ret);
++		pm_runtime_put_noidle(&pdev->dev);
++		goto err_ioremap;
++	}
+ 
+ 	ret = (dev->of_node) ? of_get_omap_rng_device_details(priv, pdev) :
+ 				get_omap_rng_device_details(priv);
+@@ -435,8 +440,15 @@ static int __maybe_unused omap_rng_suspend(struct device *dev)
+ static int __maybe_unused omap_rng_resume(struct device *dev)
+ {
+ 	struct omap_rng_dev *priv = dev_get_drvdata(dev);
++	int ret;
++
++	ret = pm_runtime_get_sync(dev);
++	if (ret) {
++		dev_err(dev, "Failed to runtime_get device: %d\n", ret);
++		pm_runtime_put_noidle(dev);
++		return ret;
++	}
+ 
+-	pm_runtime_get_sync(dev);
+ 	priv->pdata->init(priv);
+ 
+ 	return 0;
+diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
+index b28e4da3d2cf..ca2d2386a4eb 100644
+--- a/drivers/char/tpm/tpm2-cmd.c
++++ b/drivers/char/tpm/tpm2-cmd.c
+@@ -703,7 +703,7 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id,  u32 *value,
+ 
+ 	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), desc);
+ 	if (!rc)
+-		*value = cmd.params.get_tpm_pt_out.value;
++		*value = be32_to_cpu(cmd.params.get_tpm_pt_out.value);
+ 
+ 	return rc;
+ }
+diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
+index e9fd1d83f9f1..0f7ec0deed6c 100644
+--- a/drivers/char/tpm/tpm_crb.c
++++ b/drivers/char/tpm/tpm_crb.c
+@@ -77,7 +77,6 @@ enum crb_flags {
+ 
+ struct crb_priv {
+ 	unsigned int flags;
+-	struct resource res;
+ 	void __iomem *iobase;
+ 	struct crb_control_area __iomem *cca;
+ 	u8 __iomem *cmd;
+@@ -224,19 +223,19 @@ static int crb_init(struct acpi_device *device, struct crb_priv *priv)
+ 
+ static int crb_check_resource(struct acpi_resource *ares, void *data)
+ {
+-	struct crb_priv *priv = data;
++	struct resource *io_res = data;
+ 	struct resource res;
+ 
+ 	if (acpi_dev_resource_memory(ares, &res)) {
+-		priv->res = res;
+-		priv->res.name = NULL;
++		*io_res = res;
++		io_res->name = NULL;
+ 	}
+ 
+ 	return 1;
+ }
+ 
+ static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,
+-				 u64 start, u32 size)
++				 struct resource *io_res, u64 start, u32 size)
+ {
+ 	struct resource new_res = {
+ 		.start	= start,
+@@ -248,51 +247,72 @@ static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,
+ 	if (start != new_res.start)
+ 		return (void __iomem *) ERR_PTR(-EINVAL);
+ 
+-	if (!resource_contains(&priv->res, &new_res))
++	if (!resource_contains(io_res, &new_res))
+ 		return devm_ioremap_resource(dev, &new_res);
+ 
+-	return priv->iobase + (new_res.start - priv->res.start);
++	return priv->iobase + (new_res.start - io_res->start);
+ }
+ 
+ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+ 		      struct acpi_table_tpm2 *buf)
+ {
+ 	struct list_head resources;
++	struct resource io_res;
+ 	struct device *dev = &device->dev;
+-	u64 pa;
++	u64 cmd_pa;
++	u32 cmd_size;
++	u64 rsp_pa;
++	u32 rsp_size;
+ 	int ret;
+ 
+ 	INIT_LIST_HEAD(&resources);
+ 	ret = acpi_dev_get_resources(device, &resources, crb_check_resource,
+-				     priv);
++				     &io_res);
+ 	if (ret < 0)
+ 		return ret;
+ 	acpi_dev_free_resource_list(&resources);
+ 
+-	if (resource_type(&priv->res) != IORESOURCE_MEM) {
++	if (resource_type(&io_res) != IORESOURCE_MEM) {
+ 		dev_err(dev,
+ 			FW_BUG "TPM2 ACPI table does not define a memory resource\n");
+ 		return -EINVAL;
+ 	}
+ 
+-	priv->iobase = devm_ioremap_resource(dev, &priv->res);
++	priv->iobase = devm_ioremap_resource(dev, &io_res);
+ 	if (IS_ERR(priv->iobase))
+ 		return PTR_ERR(priv->iobase);
+ 
+-	priv->cca = crb_map_res(dev, priv, buf->control_address, 0x1000);
++	priv->cca = crb_map_res(dev, priv, &io_res, buf->control_address,
++				sizeof(struct crb_control_area));
+ 	if (IS_ERR(priv->cca))
+ 		return PTR_ERR(priv->cca);
+ 
+-	pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) |
+-	      (u64) ioread32(&priv->cca->cmd_pa_low);
+-	priv->cmd = crb_map_res(dev, priv, pa, ioread32(&priv->cca->cmd_size));
++	cmd_pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) |
++		  (u64) ioread32(&priv->cca->cmd_pa_low);
++	cmd_size = ioread32(&priv->cca->cmd_size);
++	priv->cmd = crb_map_res(dev, priv, &io_res, cmd_pa, cmd_size);
+ 	if (IS_ERR(priv->cmd))
+ 		return PTR_ERR(priv->cmd);
+ 
+-	memcpy_fromio(&pa, &priv->cca->rsp_pa, 8);
+-	pa = le64_to_cpu(pa);
+-	priv->rsp = crb_map_res(dev, priv, pa, ioread32(&priv->cca->rsp_size));
+-	return PTR_ERR_OR_ZERO(priv->rsp);
++	memcpy_fromio(&rsp_pa, &priv->cca->rsp_pa, 8);
++	rsp_pa = le64_to_cpu(rsp_pa);
++	rsp_size = ioread32(&priv->cca->rsp_size);
++
++	if (cmd_pa != rsp_pa) {
++		priv->rsp = crb_map_res(dev, priv, &io_res, rsp_pa, rsp_size);
++		return PTR_ERR_OR_ZERO(priv->rsp);
++	}
++
++	/* According to the PTP specification, overlapping command and response
++	 * buffer sizes must be identical.
++	 */
++	if (cmd_size != rsp_size) {
++		dev_err(dev, FW_BUG "overlapping command and response buffer sizes are not identical");
++		return -EINVAL;
++	}
++
++	priv->rsp = priv->cmd;
++	return 0;
+ }
+ 
+ static int crb_acpi_add(struct acpi_device *device)
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index 75bd6621dc5d..de9a3d7505a4 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -1195,8 +1195,8 @@ static struct at_xdmac_desc *at_xdmac_memset_create_desc(struct dma_chan *chan,
+ 	desc->lld.mbr_cfg = chan_cc;
+ 
+ 	dev_dbg(chan2dev(chan),
+-		"%s: lld: mbr_da=%pad, mbr_ds=%pad, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
+-		__func__, &desc->lld.mbr_da, &desc->lld.mbr_ds, desc->lld.mbr_ubc,
++		"%s: lld: mbr_da=%pad, mbr_ds=0x%08x, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
++		__func__, &desc->lld.mbr_da, desc->lld.mbr_ds, desc->lld.mbr_ubc,
+ 		desc->lld.mbr_cfg);
+ 
+ 	return desc;
+@@ -2067,7 +2067,7 @@ err_dma_unregister:
+ err_clk_disable:
+ 	clk_disable_unprepare(atxdmac->clk);
+ err_free_irq:
+-	free_irq(atxdmac->irq, atxdmac->dma.dev);
++	free_irq(atxdmac->irq, atxdmac);
+ 	return ret;
+ }
+ 
+@@ -2081,7 +2081,7 @@ static int at_xdmac_remove(struct platform_device *pdev)
+ 	dma_async_device_unregister(&atxdmac->dma);
+ 	clk_disable_unprepare(atxdmac->clk);
+ 
+-	free_irq(atxdmac->irq, atxdmac->dma.dev);
++	free_irq(atxdmac->irq, atxdmac);
+ 
+ 	for (i = 0; i < atxdmac->dma.chancnt; i++) {
+ 		struct at_xdmac_chan *atchan = &atxdmac->chan[i];
+diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
+index 6149b27c33ad..c8dd5b00c1b4 100644
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -393,11 +393,12 @@ static void bcm2835_dma_fill_cb_chain_with_sg(
+ 	unsigned int sg_len)
+ {
+ 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+-	size_t max_len = bcm2835_dma_max_frame_length(c);
+-	unsigned int i, len;
++	size_t len, max_len;
++	unsigned int i;
+ 	dma_addr_t addr;
+ 	struct scatterlist *sgent;
+ 
++	max_len = bcm2835_dma_max_frame_length(c);
+ 	for_each_sg(sgl, sgent, sg_len, i) {
+ 		for (addr = sg_dma_address(sgent), len = sg_dma_len(sgent);
+ 		     len > 0;
+diff --git a/drivers/gpio/gpio-sa1100.c b/drivers/gpio/gpio-sa1100.c
+index 0c99e8fb9af3..8d8ee0ebf14c 100644
+--- a/drivers/gpio/gpio-sa1100.c
++++ b/drivers/gpio/gpio-sa1100.c
+@@ -155,7 +155,7 @@ static int sa1100_gpio_irqdomain_map(struct irq_domain *d,
+ {
+ 	irq_set_chip_and_handler(irq, &sa1100_gpio_irq_chip,
+ 				 handle_edge_irq);
+-	irq_set_noprobe(irq);
++	irq_set_probe(irq);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c
+index edec30fd3ecd..0a7b6ed5ed28 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c
+@@ -37,7 +37,10 @@ nv04_fifo_dma_object_dtor(struct nvkm_fifo_chan *base, int cookie)
+ {
+ 	struct nv04_fifo_chan *chan = nv04_fifo_chan(base);
+ 	struct nvkm_instmem *imem = chan->fifo->base.engine.subdev.device->imem;
++
++	mutex_lock(&chan->fifo->base.engine.subdev.mutex);
+ 	nvkm_ramht_remove(imem->ramht, cookie);
++	mutex_unlock(&chan->fifo->base.engine.subdev.mutex);
+ }
+ 
+ static int
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index e6abc09b67e3..1f78ec2548ec 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -3015,6 +3015,12 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ 	if (rdev->pdev->device == 0x6811 &&
+ 	    rdev->pdev->revision == 0x81)
+ 		max_mclk = 120000;
++	/* limit sclk/mclk on Jet parts for stability */
++	if (rdev->pdev->device == 0x6665 &&
++	    rdev->pdev->revision == 0xc3) {
++		max_sclk = 75000;
++		max_mclk = 80000;
++	}
+ 
+ 	if (rps->vce_active) {
+ 		rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
+diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
+index d5df555aeba0..cc2dabab270b 100644
+--- a/drivers/gpu/drm/udl/udl_fb.c
++++ b/drivers/gpu/drm/udl/udl_fb.c
+@@ -122,7 +122,7 @@ int udl_handle_damage(struct udl_framebuffer *fb, int x, int y,
+ 		return 0;
+ 	cmd = urb->transfer_buffer;
+ 
+-	for (i = y; i < height ; i++) {
++	for (i = y; i < y + height ; i++) {
+ 		const int line_offset = fb->base.pitches[0] * i;
+ 		const int byte_offset = line_offset + (x * bpp);
+ 		const int dev_byte_offset = (fb->base.width * bpp * i) + (x * bpp);
+diff --git a/drivers/hwmon/adt7411.c b/drivers/hwmon/adt7411.c
+index 827c03703128..a7f886961830 100644
+--- a/drivers/hwmon/adt7411.c
++++ b/drivers/hwmon/adt7411.c
+@@ -30,6 +30,7 @@
+ 
+ #define ADT7411_REG_CFG1			0x18
+ #define ADT7411_CFG1_START_MONITOR		(1 << 0)
++#define ADT7411_CFG1_RESERVED_BIT3		(1 << 3)
+ 
+ #define ADT7411_REG_CFG2			0x19
+ #define ADT7411_CFG2_DISABLE_AVG		(1 << 5)
+@@ -296,8 +297,10 @@ static int adt7411_probe(struct i2c_client *client,
+ 	mutex_init(&data->device_lock);
+ 	mutex_init(&data->update_lock);
+ 
++	/* According to the datasheet, we must only write 1 to bit 3 */
+ 	ret = adt7411_modify_bit(client, ADT7411_REG_CFG1,
+-				 ADT7411_CFG1_START_MONITOR, 1);
++				 ADT7411_CFG1_RESERVED_BIT3
++				 | ADT7411_CFG1_START_MONITOR, 1);
+ 	if (ret < 0)
+ 		return ret;
+ 
+diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+index 215ac87f606d..e999125ce37d 100644
+--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+@@ -37,8 +37,6 @@ struct i2c_demux_pinctrl_priv {
+ 	struct i2c_demux_pinctrl_chan chan[];
+ };
+ 
+-static struct property status_okay = { .name = "status", .length = 3, .value = "ok" };
+-
+ static int i2c_demux_master_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
+ {
+ 	struct i2c_demux_pinctrl_priv *priv = adap->algo_data;
+@@ -192,6 +190,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
+ {
+ 	struct device_node *np = pdev->dev.of_node;
+ 	struct i2c_demux_pinctrl_priv *priv;
++	struct property *props;
+ 	int num_chan, i, j, err;
+ 
+ 	num_chan = of_count_phandle_with_args(np, "i2c-parent", NULL);
+@@ -202,7 +201,10 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
+ 
+ 	priv = devm_kzalloc(&pdev->dev, sizeof(*priv)
+ 			   + num_chan * sizeof(struct i2c_demux_pinctrl_chan), GFP_KERNEL);
+-	if (!priv)
++
++	props = devm_kcalloc(&pdev->dev, num_chan, sizeof(*props), GFP_KERNEL);
++
++	if (!priv || !props)
+ 		return -ENOMEM;
+ 
+ 	err = of_property_read_string(np, "i2c-bus-name", &priv->bus_name);
+@@ -220,8 +222,12 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
+ 		}
+ 		priv->chan[i].parent_np = adap_np;
+ 
++		props[i].name = devm_kstrdup(&pdev->dev, "status", GFP_KERNEL);
++		props[i].value = devm_kstrdup(&pdev->dev, "ok", GFP_KERNEL);
++		props[i].length = 3;
++
+ 		of_changeset_init(&priv->chan[i].chgset);
+-		of_changeset_update_property(&priv->chan[i].chgset, adap_np, &status_okay);
++		of_changeset_update_property(&priv->chan[i].chgset, adap_np, &props[i]);
+ 	}
+ 
+ 	priv->num_chan = num_chan;
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index ad1b1adcf6f0..8b5abc4ce202 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -2452,18 +2452,24 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv)
+ 
+ 	if (addr->dev_addr.bound_dev_if) {
+ 		ndev = dev_get_by_index(&init_net, addr->dev_addr.bound_dev_if);
+-		if (!ndev)
+-			return -ENODEV;
++		if (!ndev) {
++			ret = -ENODEV;
++			goto err2;
++		}
+ 
+ 		if (ndev->flags & IFF_LOOPBACK) {
+ 			dev_put(ndev);
+-			if (!id_priv->id.device->get_netdev)
+-				return -EOPNOTSUPP;
++			if (!id_priv->id.device->get_netdev) {
++				ret = -EOPNOTSUPP;
++				goto err2;
++			}
+ 
+ 			ndev = id_priv->id.device->get_netdev(id_priv->id.device,
+ 							      id_priv->id.port_num);
+-			if (!ndev)
+-				return -ENODEV;
++			if (!ndev) {
++				ret = -ENODEV;
++				goto err2;
++			}
+ 		}
+ 
+ 		route->path_rec->net = &init_net;
+diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
+index a83ec28a147b..365cb53cc8b2 100644
+--- a/drivers/infiniband/core/multicast.c
++++ b/drivers/infiniband/core/multicast.c
+@@ -118,7 +118,6 @@ struct mcast_group {
+ 	atomic_t		refcount;
+ 	enum mcast_group_state	state;
+ 	struct ib_sa_query	*query;
+-	int			query_id;
+ 	u16			pkey_index;
+ 	u8			leave_state;
+ 	int			retries;
+@@ -352,11 +351,7 @@ static int send_join(struct mcast_group *group, struct mcast_member *member)
+ 				       member->multicast.comp_mask,
+ 				       3000, GFP_KERNEL, join_handler, group,
+ 				       &group->query);
+-	if (ret >= 0) {
+-		group->query_id = ret;
+-		ret = 0;
+-	}
+-	return ret;
++	return (ret > 0) ? 0 : ret;
+ }
+ 
+ static int send_leave(struct mcast_group *group, u8 leave_state)
+@@ -376,11 +371,7 @@ static int send_leave(struct mcast_group *group, u8 leave_state)
+ 				       IB_SA_MCMEMBER_REC_JOIN_STATE,
+ 				       3000, GFP_KERNEL, leave_handler,
+ 				       group, &group->query);
+-	if (ret >= 0) {
+-		group->query_id = ret;
+-		ret = 0;
+-	}
+-	return ret;
++	return (ret > 0) ? 0 : ret;
+ }
+ 
+ static void join_group(struct mcast_group *group, struct mcast_member *member,
+diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h
+index b738acdb9b02..8ec09e470f84 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw.h
++++ b/drivers/infiniband/hw/i40iw/i40iw.h
+@@ -232,7 +232,7 @@ struct i40iw_device {
+ 	struct i40e_client *client;
+ 	struct i40iw_hw hw;
+ 	struct i40iw_cm_core cm_core;
+-	unsigned long *mem_resources;
++	u8 *mem_resources;
+ 	unsigned long *allocated_qps;
+ 	unsigned long *allocated_cqs;
+ 	unsigned long *allocated_mrs;
+@@ -435,8 +435,8 @@ static inline int i40iw_alloc_resource(struct i40iw_device *iwdev,
+ 	*next = resource_num + 1;
+ 	if (*next == max_resources)
+ 		*next = 0;
+-	spin_unlock_irqrestore(&iwdev->resource_lock, flags);
+ 	*req_resource_num = resource_num;
++	spin_unlock_irqrestore(&iwdev->resource_lock, flags);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+index d2fa72516960..406a345227c3 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+@@ -535,8 +535,8 @@ static struct i40iw_puda_buf *i40iw_form_cm_frame(struct i40iw_cm_node *cm_node,
+ 		buf += hdr_len;
+ 	}
+ 
+-	if (pd_len)
+-		memcpy(buf, pdata->addr, pd_len);
++	if (pdata && pdata->addr)
++		memcpy(buf, pdata->addr, pdata->size);
+ 
+ 	atomic_set(&sqbuf->refcount, 1);
+ 
+@@ -3347,26 +3347,6 @@ int i40iw_cm_disconn(struct i40iw_qp *iwqp)
+ }
+ 
+ /**
+- * i40iw_loopback_nop - Send a nop
+- * @qp: associated hw qp
+- */
+-static void i40iw_loopback_nop(struct i40iw_sc_qp *qp)
+-{
+-	u64 *wqe;
+-	u64 header;
+-
+-	wqe = qp->qp_uk.sq_base->elem;
+-	set_64bit_val(wqe, 0, 0);
+-	set_64bit_val(wqe, 8, 0);
+-	set_64bit_val(wqe, 16, 0);
+-
+-	header = LS_64(I40IWQP_OP_NOP, I40IWQPSQ_OPCODE) |
+-	    LS_64(0, I40IWQPSQ_SIGCOMPL) |
+-	    LS_64(qp->qp_uk.swqe_polarity, I40IWQPSQ_VALID);
+-	set_64bit_val(wqe, 24, header);
+-}
+-
+-/**
+  * i40iw_qp_disconnect - free qp and close cm
+  * @iwqp: associate qp for the connection
+  */
+@@ -3638,7 +3618,7 @@ int i40iw_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ 	} else {
+ 		if (iwqp->page)
+ 			iwqp->sc_qp.qp_uk.sq_base = kmap(iwqp->page);
+-		i40iw_loopback_nop(&iwqp->sc_qp);
++		dev->iw_priv_qp_ops->qp_send_lsmm(&iwqp->sc_qp, NULL, 0, 0);
+ 	}
+ 
+ 	if (iwqp->page)
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_hw.c b/drivers/infiniband/hw/i40iw/i40iw_hw.c
+index 3ee0cad96bc6..0c92a40b3e86 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_hw.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_hw.c
+@@ -265,6 +265,7 @@ void i40iw_next_iw_state(struct i40iw_qp *iwqp,
+ 		info.dont_send_fin = false;
+ 	if (iwqp->sc_qp.term_flags && (state == I40IW_QP_STATE_ERROR))
+ 		info.reset_tcp_conn = true;
++	iwqp->hw_iwarp_state = state;
+ 	i40iw_hw_modify_qp(iwqp->iwdev, iwqp, &info, 0);
+ }
+ 
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
+index 6e9081380a27..445e230d5ff8 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
+@@ -100,7 +100,7 @@ static struct notifier_block i40iw_net_notifier = {
+ 	.notifier_call = i40iw_net_event
+ };
+ 
+-static int i40iw_notifiers_registered;
++static atomic_t i40iw_notifiers_registered;
+ 
+ /**
+  * i40iw_find_i40e_handler - find a handler given a client info
+@@ -1342,12 +1342,11 @@ exit:
+  */
+ static void i40iw_register_notifiers(void)
+ {
+-	if (!i40iw_notifiers_registered) {
++	if (atomic_inc_return(&i40iw_notifiers_registered) == 1) {
+ 		register_inetaddr_notifier(&i40iw_inetaddr_notifier);
+ 		register_inet6addr_notifier(&i40iw_inetaddr6_notifier);
+ 		register_netevent_notifier(&i40iw_net_notifier);
+ 	}
+-	i40iw_notifiers_registered++;
+ }
+ 
+ /**
+@@ -1429,8 +1428,7 @@ static void i40iw_deinit_device(struct i40iw_device *iwdev, bool reset, bool del
+ 			i40iw_del_macip_entry(iwdev, (u8)iwdev->mac_ip_table_idx);
+ 		/* fallthrough */
+ 	case INET_NOTIFIER:
+-		if (i40iw_notifiers_registered > 0) {
+-			i40iw_notifiers_registered--;
++		if (!atomic_dec_return(&i40iw_notifiers_registered)) {
+ 			unregister_netevent_notifier(&i40iw_net_notifier);
+ 			unregister_inetaddr_notifier(&i40iw_inetaddr_notifier);
+ 			unregister_inet6addr_notifier(&i40iw_inetaddr6_notifier);
+@@ -1558,6 +1556,10 @@ static int i40iw_open(struct i40e_info *ldev, struct i40e_client *client)
+ 	enum i40iw_status_code status;
+ 	struct i40iw_handler *hdl;
+ 
++	hdl = i40iw_find_netdev(ldev->netdev);
++	if (hdl)
++		return 0;
++
+ 	hdl = kzalloc(sizeof(*hdl), GFP_KERNEL);
+ 	if (!hdl)
+ 		return -ENOMEM;
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
+index 0e8db0a35141..6fd043b1d714 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
+@@ -673,8 +673,11 @@ enum i40iw_status_code i40iw_free_virt_mem(struct i40iw_hw *hw,
+ {
+ 	if (!mem)
+ 		return I40IW_ERR_PARAM;
++	/*
++	 * mem->va points to the parent of mem, so both mem and mem->va
++	 * can not be touched once mem->va is freed
++	 */
+ 	kfree(mem->va);
+-	mem->va = NULL;
+ 	return 0;
+ }
+ 
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+index 283b64c942ee..f24bfbdddfaa 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+@@ -794,7 +794,6 @@ static struct ib_qp *i40iw_create_qp(struct ib_pd *ibpd,
+ 	return &iwqp->ibqp;
+ error:
+ 	i40iw_free_qp_resources(iwdev, iwqp, qp_num);
+-	kfree(mem);
+ 	return ERR_PTR(err_code);
+ }
+ 
+@@ -1925,8 +1924,7 @@ static int i40iw_dereg_mr(struct ib_mr *ib_mr)
+ 		}
+ 		if (iwpbl->pbl_allocated)
+ 			i40iw_free_pble(iwdev->pble_rsrc, palloc);
+-		kfree(iwpbl->iwmr);
+-		iwpbl->iwmr = NULL;
++		kfree(iwmr);
+ 		return 0;
+ 	}
+ 
+diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
+index 9c2e53d28f98..0f21c3a25552 100644
+--- a/drivers/infiniband/hw/mlx4/mad.c
++++ b/drivers/infiniband/hw/mlx4/mad.c
+@@ -1128,6 +1128,27 @@ void handle_port_mgmt_change_event(struct work_struct *work)
+ 
+ 		/* Generate GUID changed event */
+ 		if (changed_attr & MLX4_EQ_PORT_INFO_GID_PFX_CHANGE_MASK) {
++			if (mlx4_is_master(dev->dev)) {
++				union ib_gid gid;
++				int err = 0;
++
++				if (!eqe->event.port_mgmt_change.params.port_info.gid_prefix)
++					err = __mlx4_ib_query_gid(&dev->ib_dev, port, 0, &gid, 1);
++				else
++					gid.global.subnet_prefix =
++						eqe->event.port_mgmt_change.params.port_info.gid_prefix;
++				if (err) {
++					pr_warn("Could not change QP1 subnet prefix for port %d: query_gid error (%d)\n",
++						port, err);
++				} else {
++					pr_debug("Changing QP1 subnet prefix for port %d. old=0x%llx. new=0x%llx\n",
++						 port,
++						 (u64)atomic64_read(&dev->sriov.demux[port - 1].subnet_prefix),
++						 be64_to_cpu(gid.global.subnet_prefix));
++					atomic64_set(&dev->sriov.demux[port - 1].subnet_prefix,
++						     be64_to_cpu(gid.global.subnet_prefix));
++				}
++			}
+ 			mlx4_ib_dispatch_event(dev, port, IB_EVENT_GID_CHANGE);
+ 			/*if master, notify all slaves*/
+ 			if (mlx4_is_master(dev->dev))
+@@ -2202,6 +2223,8 @@ int mlx4_ib_init_sriov(struct mlx4_ib_dev *dev)
+ 		if (err)
+ 			goto demux_err;
+ 		dev->sriov.demux[i].guid_cache[0] = gid.global.interface_id;
++		atomic64_set(&dev->sriov.demux[i].subnet_prefix,
++			     be64_to_cpu(gid.global.subnet_prefix));
+ 		err = alloc_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1,
+ 				      &dev->sriov.sqps[i]);
+ 		if (err)
+diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c
+index 8f7ad07915b0..097bfcc4ee99 100644
+--- a/drivers/infiniband/hw/mlx4/mcg.c
++++ b/drivers/infiniband/hw/mlx4/mcg.c
+@@ -489,7 +489,7 @@ static u8 get_leave_state(struct mcast_group *group)
+ 		if (!group->members[i])
+ 			leave_state |= (1 << i);
+ 
+-	return leave_state & (group->rec.scope_join_state & 7);
++	return leave_state & (group->rec.scope_join_state & 0xf);
+ }
+ 
+ static int join_group(struct mcast_group *group, int slave, u8 join_mask)
+@@ -564,8 +564,8 @@ static void mlx4_ib_mcg_timeout_handler(struct work_struct *work)
+ 		} else
+ 			mcg_warn_group(group, "DRIVER BUG\n");
+ 	} else if (group->state == MCAST_LEAVE_SENT) {
+-		if (group->rec.scope_join_state & 7)
+-			group->rec.scope_join_state &= 0xf8;
++		if (group->rec.scope_join_state & 0xf)
++			group->rec.scope_join_state &= 0xf0;
+ 		group->state = MCAST_IDLE;
+ 		mutex_unlock(&group->lock);
+ 		if (release_group(group, 1))
+@@ -605,7 +605,7 @@ static int handle_leave_req(struct mcast_group *group, u8 leave_mask,
+ static int handle_join_req(struct mcast_group *group, u8 join_mask,
+ 			   struct mcast_req *req)
+ {
+-	u8 group_join_state = group->rec.scope_join_state & 7;
++	u8 group_join_state = group->rec.scope_join_state & 0xf;
+ 	int ref = 0;
+ 	u16 status;
+ 	struct ib_sa_mcmember_data *sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
+@@ -690,8 +690,8 @@ static void mlx4_ib_mcg_work_handler(struct work_struct *work)
+ 			u8 cur_join_state;
+ 
+ 			resp_join_state = ((struct ib_sa_mcmember_data *)
+-						group->response_sa_mad.data)->scope_join_state & 7;
+-			cur_join_state = group->rec.scope_join_state & 7;
++						group->response_sa_mad.data)->scope_join_state & 0xf;
++			cur_join_state = group->rec.scope_join_state & 0xf;
+ 
+ 			if (method == IB_MGMT_METHOD_GET_RESP) {
+ 				/* successfull join */
+@@ -710,7 +710,7 @@ process_requests:
+ 		req = list_first_entry(&group->pending_list, struct mcast_req,
+ 				       group_list);
+ 		sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
+-		req_join_state = sa_data->scope_join_state & 0x7;
++		req_join_state = sa_data->scope_join_state & 0xf;
+ 
+ 		/* For a leave request, we will immediately answer the VF, and
+ 		 * update our internal counters. The actual leave will be sent
+diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
+index 29acda249612..d4ca38103cec 100644
+--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
++++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
+@@ -448,7 +448,7 @@ struct mlx4_ib_demux_ctx {
+ 	struct workqueue_struct *wq;
+ 	struct workqueue_struct *ud_wq;
+ 	spinlock_t ud_lock;
+-	__be64 subnet_prefix;
++	atomic64_t subnet_prefix;
+ 	__be64 guid_cache[128];
+ 	struct mlx4_ib_dev *dev;
+ 	/* the following lock protects both mcg_table and mcg_mgid0_list */
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index 8db8405c1e99..d995222e661f 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -2492,24 +2492,27 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_ud_wr *wr,
+ 		sqp->ud_header.grh.flow_label    =
+ 			ah->av.ib.sl_tclass_flowlabel & cpu_to_be32(0xfffff);
+ 		sqp->ud_header.grh.hop_limit     = ah->av.ib.hop_limit;
+-		if (is_eth)
++		if (is_eth) {
+ 			memcpy(sqp->ud_header.grh.source_gid.raw, sgid.raw, 16);
+-		else {
+-		if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
+-			/* When multi-function is enabled, the ib_core gid
+-			 * indexes don't necessarily match the hw ones, so
+-			 * we must use our own cache */
+-			sqp->ud_header.grh.source_gid.global.subnet_prefix =
+-				to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
+-						       subnet_prefix;
+-			sqp->ud_header.grh.source_gid.global.interface_id =
+-				to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
+-					       guid_cache[ah->av.ib.gid_index];
+-		} else
+-			ib_get_cached_gid(ib_dev,
+-					  be32_to_cpu(ah->av.ib.port_pd) >> 24,
+-					  ah->av.ib.gid_index,
+-					  &sqp->ud_header.grh.source_gid, NULL);
++		} else {
++			if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
++				/* When multi-function is enabled, the ib_core gid
++				 * indexes don't necessarily match the hw ones, so
++				 * we must use our own cache
++				 */
++				sqp->ud_header.grh.source_gid.global.subnet_prefix =
++					cpu_to_be64(atomic64_read(&(to_mdev(ib_dev)->sriov.
++								    demux[sqp->qp.port - 1].
++								    subnet_prefix)));
++				sqp->ud_header.grh.source_gid.global.interface_id =
++					to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
++						       guid_cache[ah->av.ib.gid_index];
++			} else {
++				ib_get_cached_gid(ib_dev,
++						  be32_to_cpu(ah->av.ib.port_pd) >> 24,
++						  ah->av.ib.gid_index,
++						  &sqp->ud_header.grh.source_gid, NULL);
++			}
+ 		}
+ 		memcpy(sqp->ud_header.grh.destination_gid.raw,
+ 		       ah->av.ib.dgid, 16);
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index b48ad85315dc..c90f57579a92 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -287,7 +287,9 @@ __be16 mlx5_get_roce_udp_sport(struct mlx5_ib_dev *dev, u8 port_num,
+ 
+ static int mlx5_use_mad_ifc(struct mlx5_ib_dev *dev)
+ {
+-	return !MLX5_CAP_GEN(dev->mdev, ib_virt);
++	if (MLX5_CAP_GEN(dev->mdev, port_type) == MLX5_CAP_PORT_TYPE_IB)
++		return !MLX5_CAP_GEN(dev->mdev, ib_virt);
++	return 0;
+ }
+ 
+ enum {
+@@ -1275,6 +1277,13 @@ static int parse_flow_attr(u32 *match_c, u32 *match_v,
+ 					     dmac_47_16),
+ 				ib_spec->eth.val.dst_mac);
+ 
++		ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_c,
++					     smac_47_16),
++				ib_spec->eth.mask.src_mac);
++		ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_v,
++					     smac_47_16),
++				ib_spec->eth.val.src_mac);
++
+ 		if (ib_spec->eth.mask.vlan_tag) {
+ 			MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
+ 				 vlan_tag, 1);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
+index 4f7d9b48df64..9dbfcc0ab577 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib.h
++++ b/drivers/infiniband/ulp/ipoib/ipoib.h
+@@ -478,6 +478,7 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
+ 		struct ipoib_ah *address, u32 qpn);
+ void ipoib_reap_ah(struct work_struct *work);
+ 
++struct ipoib_path *__path_find(struct net_device *dev, void *gid);
+ void ipoib_mark_paths_invalid(struct net_device *dev);
+ void ipoib_flush_paths(struct net_device *dev);
+ int ipoib_check_sm_sendonly_fullmember_support(struct ipoib_dev_priv *priv);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index 951d9abcca8b..4ad297d3de89 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -1318,6 +1318,8 @@ void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx)
+ 	}
+ }
+ 
++#define QPN_AND_OPTIONS_OFFSET	4
++
+ static void ipoib_cm_tx_start(struct work_struct *work)
+ {
+ 	struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
+@@ -1326,6 +1328,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
+ 	struct ipoib_neigh *neigh;
+ 	struct ipoib_cm_tx *p;
+ 	unsigned long flags;
++	struct ipoib_path *path;
+ 	int ret;
+ 
+ 	struct ib_sa_path_rec pathrec;
+@@ -1338,7 +1341,19 @@ static void ipoib_cm_tx_start(struct work_struct *work)
+ 		p = list_entry(priv->cm.start_list.next, typeof(*p), list);
+ 		list_del_init(&p->list);
+ 		neigh = p->neigh;
++
+ 		qpn = IPOIB_QPN(neigh->daddr);
++		/*
++		 * As long as the search is with these 2 locks,
++		 * path existence indicates its validity.
++		 */
++		path = __path_find(dev, neigh->daddr + QPN_AND_OPTIONS_OFFSET);
++		if (!path) {
++			pr_info("%s ignore not valid path %pI6\n",
++				__func__,
++				neigh->daddr + QPN_AND_OPTIONS_OFFSET);
++			goto free_neigh;
++		}
+ 		memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);
+ 
+ 		spin_unlock_irqrestore(&priv->lock, flags);
+@@ -1350,6 +1365,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
+ 		spin_lock_irqsave(&priv->lock, flags);
+ 
+ 		if (ret) {
++free_neigh:
+ 			neigh = p->neigh;
+ 			if (neigh) {
+ 				neigh->cm = NULL;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+index dc6d241b9406..be11d5d5b8c1 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+@@ -1161,8 +1161,17 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
+ 	}
+ 
+ 	if (level == IPOIB_FLUSH_LIGHT) {
++		int oper_up;
+ 		ipoib_mark_paths_invalid(dev);
++		/* Set IPoIB operation as down to prevent races between:
++		 * the flush flow which leaves MCG and on the fly joins
++		 * which can happen during that time. mcast restart task
++		 * should deal with join requests we missed.
++		 */
++		oper_up = test_and_clear_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
+ 		ipoib_mcast_dev_flush(dev);
++		if (oper_up)
++			set_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
+ 		ipoib_flush_ah(dev);
+ 	}
+ 
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 5f58c41ef787..ddebda53e147 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -485,7 +485,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
+ 	return -EINVAL;
+ }
+ 
+-static struct ipoib_path *__path_find(struct net_device *dev, void *gid)
++struct ipoib_path *__path_find(struct net_device *dev, void *gid)
+ {
+ 	struct ipoib_dev_priv *priv = netdev_priv(dev);
+ 	struct rb_node *n = priv->path_tree.rb_node;
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index 2c5ba0e704bf..53891c34fe19 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -558,7 +558,7 @@ static struct notifier_block gic_cpu_notifier = {
+ static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
+ 				   unsigned long cluster_id)
+ {
+-	int cpu = *base_cpu;
++	int next_cpu, cpu = *base_cpu;
+ 	unsigned long mpidr = cpu_logical_map(cpu);
+ 	u16 tlist = 0;
+ 
+@@ -572,9 +572,10 @@ static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
+ 
+ 		tlist |= 1 << (mpidr & 0xf);
+ 
+-		cpu = cpumask_next(cpu, mask);
+-		if (cpu >= nr_cpu_ids)
++		next_cpu = cpumask_next(cpu, mask);
++		if (next_cpu >= nr_cpu_ids)
+ 			goto out;
++		cpu = next_cpu;
+ 
+ 		mpidr = cpu_logical_map(cpu);
+ 
+diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c
+index 58d04726cdd7..9ca96e9db6bf 100644
+--- a/drivers/mailbox/mailbox-test.c
++++ b/drivers/mailbox/mailbox-test.c
+@@ -133,6 +133,7 @@ static ssize_t mbox_test_message_write(struct file *filp,
+ out:
+ 	kfree(tdev->signal);
+ 	kfree(tdev->message);
++	tdev->signal = NULL;
+ 
+ 	return ret < 0 ? ret : count;
+ }
+diff --git a/drivers/md/dm-log-writes.c b/drivers/md/dm-log-writes.c
+index d8f8cc85f96c..dd230752b08a 100644
+--- a/drivers/md/dm-log-writes.c
++++ b/drivers/md/dm-log-writes.c
+@@ -259,7 +259,7 @@ static int log_one_block(struct log_writes_c *lc,
+ 	sector++;
+ 
+ 	atomic_inc(&lc->io_blocks);
+-	bio = bio_alloc(GFP_KERNEL, block->vec_cnt);
++	bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt, BIO_MAX_PAGES));
+ 	if (!bio) {
+ 		DMERR("Couldn't alloc log bio");
+ 		goto error;
+@@ -280,7 +280,7 @@ static int log_one_block(struct log_writes_c *lc,
+ 		if (ret != block->vecs[i].bv_len) {
+ 			atomic_inc(&lc->io_blocks);
+ 			submit_bio(WRITE, bio);
+-			bio = bio_alloc(GFP_KERNEL, block->vec_cnt - i);
++			bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt - i, BIO_MAX_PAGES));
+ 			if (!bio) {
+ 				DMERR("Couldn't alloc log bio");
+ 				goto error;
+diff --git a/drivers/media/platform/vsp1/vsp1_pipe.c b/drivers/media/platform/vsp1/vsp1_pipe.c
+index 4f3b4a1d028a..3c8f40bd8b9d 100644
+--- a/drivers/media/platform/vsp1/vsp1_pipe.c
++++ b/drivers/media/platform/vsp1/vsp1_pipe.c
+@@ -172,13 +172,17 @@ void vsp1_pipeline_reset(struct vsp1_pipeline *pipe)
+ 			bru->inputs[i].rpf = NULL;
+ 	}
+ 
+-	for (i = 0; i < pipe->num_inputs; ++i) {
+-		pipe->inputs[i]->pipe = NULL;
+-		pipe->inputs[i] = NULL;
++	for (i = 0; i < ARRAY_SIZE(pipe->inputs); ++i) {
++		if (pipe->inputs[i]) {
++			pipe->inputs[i]->pipe = NULL;
++			pipe->inputs[i] = NULL;
++		}
+ 	}
+ 
+-	pipe->output->pipe = NULL;
+-	pipe->output = NULL;
++	if (pipe->output) {
++		pipe->output->pipe = NULL;
++		pipe->output = NULL;
++	}
+ 
+ 	INIT_LIST_HEAD(&pipe->entities);
+ 	pipe->state = VSP1_PIPELINE_STOPPED;
+diff --git a/drivers/media/usb/em28xx/em28xx-i2c.c b/drivers/media/usb/em28xx/em28xx-i2c.c
+index a19b5c8b56ff..1a9e1e556706 100644
+--- a/drivers/media/usb/em28xx/em28xx-i2c.c
++++ b/drivers/media/usb/em28xx/em28xx-i2c.c
+@@ -507,9 +507,8 @@ static int em28xx_i2c_xfer(struct i2c_adapter *i2c_adap,
+ 	if (dev->disconnected)
+ 		return -ENODEV;
+ 
+-	rc = rt_mutex_trylock(&dev->i2c_bus_lock);
+-	if (rc < 0)
+-		return rc;
++	if (!rt_mutex_trylock(&dev->i2c_bus_lock))
++		return -EAGAIN;
+ 
+ 	/* Switch I2C bus if needed */
+ 	if (bus != dev->cur_i2c_bus &&
+diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c
+index f23df4a9d8c5..52b88e9e656b 100644
+--- a/drivers/media/usb/gspca/cpia1.c
++++ b/drivers/media/usb/gspca/cpia1.c
+@@ -1624,7 +1624,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
+ 
+ static void sd_stopN(struct gspca_dev *gspca_dev)
+ {
+-	struct sd *sd = (struct sd *) gspca_dev;
++	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
+ 
+ 	command_pause(gspca_dev);
+ 
+diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/konica.c
+index 39c96bb4c985..0712b1bc90b4 100644
+--- a/drivers/media/usb/gspca/konica.c
++++ b/drivers/media/usb/gspca/konica.c
+@@ -243,7 +243,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
+ 
+ static void sd_stopN(struct gspca_dev *gspca_dev)
+ {
+-	struct sd *sd = (struct sd *) gspca_dev;
++	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
+ 
+ 	konica_stream_off(gspca_dev);
+ #if IS_ENABLED(CONFIG_INPUT)
+diff --git a/drivers/media/usb/gspca/t613.c b/drivers/media/usb/gspca/t613.c
+index e2cc4e5a0ccb..bb52fc1fe598 100644
+--- a/drivers/media/usb/gspca/t613.c
++++ b/drivers/media/usb/gspca/t613.c
+@@ -837,7 +837,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
+ 			u8 *data,			/* isoc packet */
+ 			int len)			/* iso packet length */
+ {
+-	struct sd *sd = (struct sd *) gspca_dev;
++	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
+ 	int pkt_type;
+ 
+ 	if (data[0] == 0x5a) {
+diff --git a/drivers/misc/cxl/guest.c b/drivers/misc/cxl/guest.c
+index bc8d0b9870eb..df651935ed6f 100644
+--- a/drivers/misc/cxl/guest.c
++++ b/drivers/misc/cxl/guest.c
+@@ -1052,16 +1052,18 @@ static void free_adapter(struct cxl *adapter)
+ 	struct irq_avail *cur;
+ 	int i;
+ 
+-	if (adapter->guest->irq_avail) {
+-		for (i = 0; i < adapter->guest->irq_nranges; i++) {
+-			cur = &adapter->guest->irq_avail[i];
+-			kfree(cur->bitmap);
++	if (adapter->guest) {
++		if (adapter->guest->irq_avail) {
++			for (i = 0; i < adapter->guest->irq_nranges; i++) {
++				cur = &adapter->guest->irq_avail[i];
++				kfree(cur->bitmap);
++			}
++			kfree(adapter->guest->irq_avail);
+ 		}
+-		kfree(adapter->guest->irq_avail);
++		kfree(adapter->guest->status);
++		kfree(adapter->guest);
+ 	}
+-	kfree(adapter->guest->status);
+ 	cxl_remove_adapter_nr(adapter);
+-	kfree(adapter->guest);
+ 	kfree(adapter);
+ }
+ 
+diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
+index bcc0de47fe7e..bd1199825f9f 100644
+--- a/drivers/mmc/host/sdhci-tegra.c
++++ b/drivers/mmc/host/sdhci-tegra.c
+@@ -148,28 +148,37 @@ static void tegra_sdhci_reset(struct sdhci_host *host, u8 mask)
+ 		return;
+ 
+ 	misc_ctrl = sdhci_readl(host, SDHCI_TEGRA_VENDOR_MISC_CTRL);
+-	/* Erratum: Enable SDHCI spec v3.00 support */
+-	if (soc_data->nvquirks & NVQUIRK_ENABLE_SDHCI_SPEC_300)
+-		misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDHCI_SPEC_300;
+-	/* Advertise UHS modes as supported by host */
+-	if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR50)
+-		misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR50;
+-	else
+-		misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_SDR50;
+-	if (soc_data->nvquirks & NVQUIRK_ENABLE_DDR50)
+-		misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_DDR50;
+-	else
+-		misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_DDR50;
+-	if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR104)
+-		misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR104;
+-	else
+-		misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_SDR104;
+-	sdhci_writel(host, misc_ctrl, SDHCI_TEGRA_VENDOR_MISC_CTRL);
+-
+ 	clk_ctrl = sdhci_readl(host, SDHCI_TEGRA_VENDOR_CLOCK_CTRL);
++
++	misc_ctrl &= ~(SDHCI_MISC_CTRL_ENABLE_SDHCI_SPEC_300 |
++		       SDHCI_MISC_CTRL_ENABLE_SDR50 |
++		       SDHCI_MISC_CTRL_ENABLE_DDR50 |
++		       SDHCI_MISC_CTRL_ENABLE_SDR104);
++
+ 	clk_ctrl &= ~SDHCI_CLOCK_CTRL_SPI_MODE_CLKEN_OVERRIDE;
+-	if (soc_data->nvquirks & SDHCI_MISC_CTRL_ENABLE_SDR50)
+-		clk_ctrl |= SDHCI_CLOCK_CTRL_SDR50_TUNING_OVERRIDE;
++
++	/*
++	 * If the board does not define a regulator for the SDHCI
++	 * IO voltage, then don't advertise support for UHS modes
++	 * even if the device supports it because the IO voltage
++	 * cannot be configured.
++	 */
++	if (!IS_ERR(host->mmc->supply.vqmmc)) {
++		/* Erratum: Enable SDHCI spec v3.00 support */
++		if (soc_data->nvquirks & NVQUIRK_ENABLE_SDHCI_SPEC_300)
++			misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDHCI_SPEC_300;
++		/* Advertise UHS modes as supported by host */
++		if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR50)
++			misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR50;
++		if (soc_data->nvquirks & NVQUIRK_ENABLE_DDR50)
++			misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_DDR50;
++		if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR104)
++			misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR104;
++		if (soc_data->nvquirks & SDHCI_MISC_CTRL_ENABLE_SDR50)
++			clk_ctrl |= SDHCI_CLOCK_CTRL_SDR50_TUNING_OVERRIDE;
++	}
++
++	sdhci_writel(host, misc_ctrl, SDHCI_TEGRA_VENDOR_MISC_CTRL);
+ 	sdhci_writel(host, clk_ctrl, SDHCI_TEGRA_VENDOR_CLOCK_CTRL);
+ 
+ 	if (soc_data->nvquirks & NVQUIRK_HAS_PADCALIB)
+diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
+index cc07ba0f044d..27fa8b87cd5f 100644
+--- a/drivers/mtd/nand/davinci_nand.c
++++ b/drivers/mtd/nand/davinci_nand.c
+@@ -240,6 +240,9 @@ static void nand_davinci_hwctl_4bit(struct mtd_info *mtd, int mode)
+ 	unsigned long flags;
+ 	u32 val;
+ 
++	/* Reset ECC hardware */
++	davinci_nand_readl(info, NAND_4BIT_ECC1_OFFSET);
++
+ 	spin_lock_irqsave(&davinci_nand_lock, flags);
+ 
+ 	/* Start 4-bit ECC calculation for read/write */
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index ad535a854e5c..eab132778e67 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -21,6 +21,7 @@
+ #include <linux/slab.h>
+ #include <linux/netdevice.h>
+ #include <linux/if_arp.h>
++#include <linux/workqueue.h>
+ #include <linux/can.h>
+ #include <linux/can/dev.h>
+ #include <linux/can/skb.h>
+@@ -471,9 +472,8 @@ EXPORT_SYMBOL_GPL(can_free_echo_skb);
+ /*
+  * CAN device restart for bus-off recovery
+  */
+-static void can_restart(unsigned long data)
++static void can_restart(struct net_device *dev)
+ {
+-	struct net_device *dev = (struct net_device *)data;
+ 	struct can_priv *priv = netdev_priv(dev);
+ 	struct net_device_stats *stats = &dev->stats;
+ 	struct sk_buff *skb;
+@@ -513,6 +513,14 @@ restart:
+ 		netdev_err(dev, "Error %d during restart", err);
+ }
+ 
++static void can_restart_work(struct work_struct *work)
++{
++	struct delayed_work *dwork = to_delayed_work(work);
++	struct can_priv *priv = container_of(dwork, struct can_priv, restart_work);
++
++	can_restart(priv->dev);
++}
++
+ int can_restart_now(struct net_device *dev)
+ {
+ 	struct can_priv *priv = netdev_priv(dev);
+@@ -526,8 +534,8 @@ int can_restart_now(struct net_device *dev)
+ 	if (priv->state != CAN_STATE_BUS_OFF)
+ 		return -EBUSY;
+ 
+-	/* Runs as soon as possible in the timer context */
+-	mod_timer(&priv->restart_timer, jiffies);
++	cancel_delayed_work_sync(&priv->restart_work);
++	can_restart(dev);
+ 
+ 	return 0;
+ }
+@@ -548,8 +556,8 @@ void can_bus_off(struct net_device *dev)
+ 	netif_carrier_off(dev);
+ 
+ 	if (priv->restart_ms)
+-		mod_timer(&priv->restart_timer,
+-			  jiffies + (priv->restart_ms * HZ) / 1000);
++		schedule_delayed_work(&priv->restart_work,
++				      msecs_to_jiffies(priv->restart_ms));
+ }
+ EXPORT_SYMBOL_GPL(can_bus_off);
+ 
+@@ -658,6 +666,7 @@ struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max)
+ 		return NULL;
+ 
+ 	priv = netdev_priv(dev);
++	priv->dev = dev;
+ 
+ 	if (echo_skb_max) {
+ 		priv->echo_skb_max = echo_skb_max;
+@@ -667,7 +676,7 @@ struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max)
+ 
+ 	priv->state = CAN_STATE_STOPPED;
+ 
+-	init_timer(&priv->restart_timer);
++	INIT_DELAYED_WORK(&priv->restart_work, can_restart_work);
+ 
+ 	return dev;
+ }
+@@ -748,8 +757,6 @@ int open_candev(struct net_device *dev)
+ 	if (!netif_carrier_ok(dev))
+ 		netif_carrier_on(dev);
+ 
+-	setup_timer(&priv->restart_timer, can_restart, (unsigned long)dev);
+-
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(open_candev);
+@@ -764,7 +771,7 @@ void close_candev(struct net_device *dev)
+ {
+ 	struct can_priv *priv = netdev_priv(dev);
+ 
+-	del_timer_sync(&priv->restart_timer);
++	cancel_delayed_work_sync(&priv->restart_work);
+ 	can_flush_echo_skb(dev);
+ }
+ EXPORT_SYMBOL_GPL(close_candev);
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
+index 9c0d87503977..9b5195435c87 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
+@@ -983,9 +983,10 @@ void fm10k_write_reta(struct fm10k_intfc *interface, const u32 *indir)
+ 		/* generate a new table if we weren't given one */
+ 		for (j = 0; j < 4; j++) {
+ 			if (indir)
+-				n = indir[i + j];
++				n = indir[4 * i + j];
+ 			else
+-				n = ethtool_rxfh_indir_default(i + j, rss_i);
++				n = ethtool_rxfh_indir_default(4 * i + j,
++							       rss_i);
+ 
+ 			table[j] = n;
+ 		}
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
+index 422b41d61c9a..d5cb570d67b7 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
+@@ -297,13 +297,15 @@ void i40e_debug_aq(struct i40e_hw *hw, enum i40e_debug_mask mask, void *desc,
+ 		   void *buffer, u16 buf_len)
+ {
+ 	struct i40e_aq_desc *aq_desc = (struct i40e_aq_desc *)desc;
+-	u16 len = le16_to_cpu(aq_desc->datalen);
++	u16 len;
+ 	u8 *buf = (u8 *)buffer;
+ 	u16 i = 0;
+ 
+ 	if ((!(mask & hw->debug_mask)) || (desc == NULL))
+ 		return;
+ 
++	len = le16_to_cpu(aq_desc->datalen);
++
+ 	i40e_debug(hw, mask,
+ 		   "AQ CMD: opcode 0x%04X, flags 0x%04X, datalen 0x%04X, retval 0x%04X\n",
+ 		   le16_to_cpu(aq_desc->opcode),
+diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
+index 813cdd2621a1..d3f8b9f7756b 100644
+--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
+@@ -1524,7 +1524,7 @@ static void ath10k_htt_rx_h_filter(struct ath10k *ar,
+ static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
+ {
+ 	struct ath10k *ar = htt->ar;
+-	static struct ieee80211_rx_status rx_status;
++	struct ieee80211_rx_status *rx_status = &htt->rx_status;
+ 	struct sk_buff_head amsdu;
+ 	int ret;
+ 
+@@ -1548,11 +1548,11 @@ static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
+ 		return ret;
+ 	}
+ 
+-	ath10k_htt_rx_h_ppdu(ar, &amsdu, &rx_status, 0xffff);
++	ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff);
+ 	ath10k_htt_rx_h_unchain(ar, &amsdu, ret > 0);
+-	ath10k_htt_rx_h_filter(ar, &amsdu, &rx_status);
+-	ath10k_htt_rx_h_mpdu(ar, &amsdu, &rx_status);
+-	ath10k_htt_rx_h_deliver(ar, &amsdu, &rx_status);
++	ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
++	ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
++	ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+index dec1a317a070..e2083f4d2d48 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -4176,7 +4176,7 @@ static void ath9k_hw_ar9300_set_board_values(struct ath_hw *ah,
+ 	if (!AR_SREV_9330(ah) && !AR_SREV_9340(ah) && !AR_SREV_9531(ah))
+ 		ar9003_hw_internal_regulator_apply(ah);
+ 	ar9003_hw_apply_tuning_caps(ah);
+-	ar9003_hw_apply_minccapwr_thresh(ah, chan);
++	ar9003_hw_apply_minccapwr_thresh(ah, is2ghz);
+ 	ar9003_hw_txend_to_xpa_off_apply(ah, is2ghz);
+ 	ar9003_hw_thermometer_apply(ah);
+ 	ar9003_hw_thermo_cal_apply(ah);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+index c7550dab6a23..570c80a5419d 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -722,8 +722,10 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev,
+ 			return -ENOMEM;
+ 		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
+ 					 glom_skb);
+-		if (err)
++		if (err) {
++			brcmu_pkt_buf_free_skb(glom_skb);
+ 			goto done;
++		}
+ 
+ 		skb_queue_walk(pktq, skb) {
+ 			memcpy(skb->data, glom_skb->data, skb->len);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c
+index 796f5f9d5d5a..b7df576bb84d 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c
+@@ -1079,8 +1079,10 @@ bool dma_rxfill(struct dma_pub *pub)
+ 
+ 		pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
+ 				    DMA_FROM_DEVICE);
+-		if (dma_mapping_error(di->dmadev, pa))
++		if (dma_mapping_error(di->dmadev, pa)) {
++			brcmu_pkt_buf_free_skb(p);
+ 			return false;
++		}
+ 
+ 		/* save the free packet pointer */
+ 		di->rxp[rxout] = p;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/stf.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/stf.c
+index dd9162722495..0ab865de1491 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/stf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/stf.c
+@@ -87,7 +87,7 @@ void
+ brcms_c_stf_ss_algo_channel_get(struct brcms_c_info *wlc, u16 *ss_algo_channel,
+ 			    u16 chanspec)
+ {
+-	struct tx_power power;
++	struct tx_power power = { };
+ 	u8 siso_mcs_id, cdd_mcs_id, stbc_mcs_id;
+ 
+ 	/* Clear previous settings */
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+index e1b6b2c665eb..46b52bf705fb 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+@@ -288,7 +288,8 @@ static void iwl_mvm_dump_fifos(struct iwl_mvm *mvm,
+ 			fifo_hdr->fifo_num = cpu_to_le32(i);
+ 
+ 			/* Mark the number of TXF we're pulling now */
+-			iwl_trans_write_prph(mvm->trans, TXF_CPU2_NUM, i);
++			iwl_trans_write_prph(mvm->trans, TXF_CPU2_NUM, i +
++				ARRAY_SIZE(mvm->shared_mem_cfg.txfifo_size));
+ 
+ 			fifo_hdr->available_bytes =
+ 				cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+@@ -959,5 +960,6 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
+ 	}
+ 
+ 	mvm->fw_dbg_conf = conf_id;
+-	return ret;
++
++	return 0;
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 7057f35cb2e7..fb71cf6910df 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -139,17 +139,21 @@ void iwl_free_fw_paging(struct iwl_mvm *mvm)
+ 		return;
+ 
+ 	for (i = 0; i < NUM_OF_FW_PAGING_BLOCKS; i++) {
+-		if (!mvm->fw_paging_db[i].fw_paging_block) {
++		struct iwl_fw_paging *paging = &mvm->fw_paging_db[i];
++
++		if (!paging->fw_paging_block) {
+ 			IWL_DEBUG_FW(mvm,
+ 				     "Paging: block %d already freed, continue to next page\n",
+ 				     i);
+ 
+ 			continue;
+ 		}
++		dma_unmap_page(mvm->trans->dev, paging->fw_paging_phys,
++			       paging->fw_paging_size, DMA_BIDIRECTIONAL);
+ 
+-		__free_pages(mvm->fw_paging_db[i].fw_paging_block,
+-			     get_order(mvm->fw_paging_db[i].fw_paging_size));
+-		mvm->fw_paging_db[i].fw_paging_block = NULL;
++		__free_pages(paging->fw_paging_block,
++			     get_order(paging->fw_paging_size));
++		paging->fw_paging_block = NULL;
+ 	}
+ 	kfree(mvm->trans->paging_download_buf);
+ 	mvm->trans->paging_download_buf = NULL;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+index 25a98401a64f..0551a4bb163c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+@@ -667,8 +667,7 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2,
+ 		.mcc = cpu_to_le16(alpha2[0] << 8 | alpha2[1]),
+ 		.source_id = (u8)src_id,
+ 	};
+-	struct iwl_mcc_update_resp *mcc_resp, *resp_cp = NULL;
+-	struct iwl_mcc_update_resp_v1 *mcc_resp_v1 = NULL;
++	struct iwl_mcc_update_resp *resp_cp;
+ 	struct iwl_rx_packet *pkt;
+ 	struct iwl_host_cmd cmd = {
+ 		.id = MCC_UPDATE_CMD,
+@@ -701,34 +700,36 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2,
+ 
+ 	/* Extract MCC response */
+ 	if (resp_v2) {
+-		mcc_resp = (void *)pkt->data;
++		struct iwl_mcc_update_resp *mcc_resp = (void *)pkt->data;
++
+ 		n_channels =  __le32_to_cpu(mcc_resp->n_channels);
++		resp_len = sizeof(struct iwl_mcc_update_resp) +
++			   n_channels * sizeof(__le32);
++		resp_cp = kmemdup(mcc_resp, resp_len, GFP_KERNEL);
+ 	} else {
+-		mcc_resp_v1 = (void *)pkt->data;
++		struct iwl_mcc_update_resp_v1 *mcc_resp_v1 = (void *)pkt->data;
++
+ 		n_channels =  __le32_to_cpu(mcc_resp_v1->n_channels);
++		resp_len = sizeof(struct iwl_mcc_update_resp) +
++			   n_channels * sizeof(__le32);
++		resp_cp = kzalloc(resp_len, GFP_KERNEL);
++
++		if (resp_cp) {
++			resp_cp->status = mcc_resp_v1->status;
++			resp_cp->mcc = mcc_resp_v1->mcc;
++			resp_cp->cap = mcc_resp_v1->cap;
++			resp_cp->source_id = mcc_resp_v1->source_id;
++			resp_cp->n_channels = mcc_resp_v1->n_channels;
++			memcpy(resp_cp->channels, mcc_resp_v1->channels,
++			       n_channels * sizeof(__le32));
++		}
+ 	}
+ 
+-	resp_len = sizeof(struct iwl_mcc_update_resp) + n_channels *
+-		sizeof(__le32);
+-
+-	resp_cp = kzalloc(resp_len, GFP_KERNEL);
+ 	if (!resp_cp) {
+ 		ret = -ENOMEM;
+ 		goto exit;
+ 	}
+ 
+-	if (resp_v2) {
+-		memcpy(resp_cp, mcc_resp, resp_len);
+-	} else {
+-		resp_cp->status = mcc_resp_v1->status;
+-		resp_cp->mcc = mcc_resp_v1->mcc;
+-		resp_cp->cap = mcc_resp_v1->cap;
+-		resp_cp->source_id = mcc_resp_v1->source_id;
+-		resp_cp->n_channels = mcc_resp_v1->n_channels;
+-		memcpy(resp_cp->channels, mcc_resp_v1->channels,
+-		       n_channels * sizeof(__le32));
+-	}
+-
+ 	status = le32_to_cpu(resp_cp->status);
+ 
+ 	mcc = le16_to_cpu(resp_cp->mcc);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sf.c b/drivers/net/wireless/intel/iwlwifi/mvm/sf.c
+index 443a42855c9e..101fb04a8573 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sf.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sf.c
+@@ -215,7 +215,7 @@ static int iwl_mvm_sf_config(struct iwl_mvm *mvm, u8 sta_id,
+ 			     enum iwl_sf_state new_state)
+ {
+ 	struct iwl_sf_cfg_cmd sf_cmd = {
+-		.state = cpu_to_le32(SF_FULL_ON),
++		.state = cpu_to_le32(new_state),
+ 	};
+ 	struct ieee80211_sta *sta;
+ 	int ret = 0;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index b23ab4a4504f..1822ad374be3 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -1374,11 +1374,12 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ 		 */
+ 		WARN_ON(rcu_access_pointer(mvm->baid_map[baid]));
+ 		rcu_assign_pointer(mvm->baid_map[baid], baid_data);
+-	} else if (mvm->rx_ba_sessions > 0) {
++	} else  {
+ 		u8 baid = mvm_sta->tid_to_baid[tid];
+ 
+-		/* check that restart flow didn't zero the counter */
+-		mvm->rx_ba_sessions--;
++		if (mvm->rx_ba_sessions > 0)
++			/* check that restart flow didn't zero the counter */
++			mvm->rx_ba_sessions--;
+ 		if (!iwl_mvm_has_new_rx_api(mvm))
+ 			return 0;
+ 
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index b92b75fea92f..6b8d9a5ab855 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -138,28 +138,19 @@ static void iwl_mvm_tx_csum(struct iwl_mvm *mvm, struct sk_buff *skb,
+ 
+ 		protocol = ipv6h->nexthdr;
+ 		while (protocol != NEXTHDR_NONE && ipv6_ext_hdr(protocol)) {
++			struct ipv6_opt_hdr *hp;
++
+ 			/* only supported extension headers */
+ 			if (protocol != NEXTHDR_ROUTING &&
+ 			    protocol != NEXTHDR_HOP &&
+-			    protocol != NEXTHDR_DEST &&
+-			    protocol != NEXTHDR_FRAGMENT) {
++			    protocol != NEXTHDR_DEST) {
+ 				skb_checksum_help(skb);
+ 				return;
+ 			}
+ 
+-			if (protocol == NEXTHDR_FRAGMENT) {
+-				struct frag_hdr *hp =
+-					OPT_HDR(struct frag_hdr, skb, off);
+-
+-				protocol = hp->nexthdr;
+-				off += sizeof(struct frag_hdr);
+-			} else {
+-				struct ipv6_opt_hdr *hp =
+-					OPT_HDR(struct ipv6_opt_hdr, skb, off);
+-
+-				protocol = hp->nexthdr;
+-				off += ipv6_optlen(hp);
+-			}
++			hp = OPT_HDR(struct ipv6_opt_hdr, skb, off);
++			protocol = hp->nexthdr;
++			off += ipv6_optlen(hp);
+ 		}
+ 		/* if we get here - protocol now should be TCP/UDP */
+ #endif
+@@ -1312,7 +1303,15 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
+ 			bool send_eosp_ndp = false;
+ 
+ 			spin_lock_bh(&mvmsta->lock);
+-			txq_agg = (mvmsta->tid_data[tid].state == IWL_AGG_ON);
++			if (iwl_mvm_is_dqa_supported(mvm)) {
++				enum iwl_mvm_agg_state state;
++
++				state = mvmsta->tid_data[tid].state;
++				txq_agg = (state == IWL_AGG_ON ||
++					state == IWL_EMPTYING_HW_QUEUE_DELBA);
++			} else {
++				txq_agg = txq_id >= mvm->first_agg_queue;
++			}
+ 
+ 			if (!is_ndp) {
+ 				tid_data->next_reclaimed = next_reclaimed;
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+index d6beac9af029..dec63a0aef6b 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -1595,9 +1595,9 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+ 
+ 	/* start the TFD with the scratchbuf */
+ 	scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE);
+-	memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size);
++	memcpy(&txq->scratchbufs[idx], &out_cmd->hdr, scratch_size);
+ 	iwl_pcie_txq_build_tfd(trans, txq,
+-			       iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr),
++			       iwl_pcie_get_scratchbuf_dma(txq, idx),
+ 			       scratch_size, true);
+ 
+ 	/* map first command fragment, if any remains */
+diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+index 666e91af59d7..bf5660eb27d3 100644
+--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+@@ -272,7 +272,7 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv,
+ int mwifiex_uap_recv_packet(struct mwifiex_private *priv,
+ 			    struct sk_buff *skb)
+ {
+-	struct mwifiex_adapter *adapter = adapter;
++	struct mwifiex_adapter *adapter = priv->adapter;
+ 	struct mwifiex_sta_node *src_node;
+ 	struct ethhdr *p_ethhdr;
+ 	struct sk_buff *skb_uap;
+diff --git a/drivers/nfc/fdp/fdp.c b/drivers/nfc/fdp/fdp.c
+index e44a7a2f4061..16427420b1a2 100644
+--- a/drivers/nfc/fdp/fdp.c
++++ b/drivers/nfc/fdp/fdp.c
+@@ -353,7 +353,7 @@ static int fdp_nci_patch_otp(struct nci_dev *ndev)
+ {
+ 	struct fdp_nci_info *info = nci_get_drvdata(ndev);
+ 	struct device *dev = &info->phy->i2c_dev->dev;
+-	u8 conn_id;
++	int conn_id;
+ 	int r = 0;
+ 
+ 	if (info->otp_version >= info->otp_patch_version)
+@@ -424,7 +424,7 @@ static int fdp_nci_patch_ram(struct nci_dev *ndev)
+ {
+ 	struct fdp_nci_info *info = nci_get_drvdata(ndev);
+ 	struct device *dev = &info->phy->i2c_dev->dev;
+-	u8 conn_id;
++	int conn_id;
+ 	int r = 0;
+ 
+ 	if (info->ram_version >= info->ram_patch_version)
+diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
+index 489ea1098c96..69b5e811ea2b 100644
+--- a/drivers/pcmcia/ds.c
++++ b/drivers/pcmcia/ds.c
+@@ -977,7 +977,7 @@ static int pcmcia_bus_uevent(struct device *dev, struct kobj_uevent_env *env)
+ 
+ /************************ runtime PM support ***************************/
+ 
+-static int pcmcia_dev_suspend(struct device *dev, pm_message_t state);
++static int pcmcia_dev_suspend(struct device *dev);
+ static int pcmcia_dev_resume(struct device *dev);
+ 
+ static int runtime_suspend(struct device *dev)
+@@ -985,7 +985,7 @@ static int runtime_suspend(struct device *dev)
+ 	int rc;
+ 
+ 	device_lock(dev);
+-	rc = pcmcia_dev_suspend(dev, PMSG_SUSPEND);
++	rc = pcmcia_dev_suspend(dev);
+ 	device_unlock(dev);
+ 	return rc;
+ }
+@@ -1135,7 +1135,7 @@ ATTRIBUTE_GROUPS(pcmcia_dev);
+ 
+ /* PM support, also needed for reset */
+ 
+-static int pcmcia_dev_suspend(struct device *dev, pm_message_t state)
++static int pcmcia_dev_suspend(struct device *dev)
+ {
+ 	struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
+ 	struct pcmcia_driver *p_drv = NULL;
+@@ -1410,6 +1410,9 @@ static struct class_interface pcmcia_bus_interface __refdata = {
+ 	.remove_dev = &pcmcia_bus_remove_socket,
+ };
+ 
++static const struct dev_pm_ops pcmcia_bus_pm_ops = {
++	SET_SYSTEM_SLEEP_PM_OPS(pcmcia_dev_suspend, pcmcia_dev_resume)
++};
+ 
+ struct bus_type pcmcia_bus_type = {
+ 	.name = "pcmcia",
+@@ -1418,8 +1421,7 @@ struct bus_type pcmcia_bus_type = {
+ 	.dev_groups = pcmcia_dev_groups,
+ 	.probe = pcmcia_device_probe,
+ 	.remove = pcmcia_device_remove,
+-	.suspend = pcmcia_dev_suspend,
+-	.resume = pcmcia_dev_resume,
++	.pm = &pcmcia_bus_pm_ops,
+ };
+ 
+ 
+diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
+index 140436a046c0..5824045fab46 100644
+--- a/drivers/perf/arm_pmu.c
++++ b/drivers/perf/arm_pmu.c
+@@ -921,6 +921,7 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu)
+ 			if (i > 0 && spi != using_spi) {
+ 				pr_err("PPI/SPI IRQ type mismatch for %s!\n",
+ 					dn->name);
++				of_node_put(dn);
+ 				kfree(irqs);
+ 				return -EINVAL;
+ 			}
+diff --git a/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c b/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c
+index 967400971d45..5d08de0b13f5 100644
+--- a/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c
++++ b/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c
+@@ -73,6 +73,12 @@ static void uniphier_pctl_pin_dbg_show(struct pinctrl_dev *pctldev,
+ 	case UNIPHIER_PIN_PULL_DOWN:
+ 		pull_dir = "DOWN";
+ 		break;
++	case UNIPHIER_PIN_PULL_UP_FIXED:
++		pull_dir = "UP(FIXED)";
++		break;
++	case UNIPHIER_PIN_PULL_DOWN_FIXED:
++		pull_dir = "DOWN(FIXED)";
++		break;
+ 	case UNIPHIER_PIN_PULL_NONE:
+ 		pull_dir = "NONE";
+ 		break;
+diff --git a/drivers/regulator/pwm-regulator.c b/drivers/regulator/pwm-regulator.c
+index fafa3488e960..36e0c930ab49 100644
+--- a/drivers/regulator/pwm-regulator.c
++++ b/drivers/regulator/pwm-regulator.c
+@@ -132,6 +132,7 @@ static int pwm_regulator_set_voltage(struct regulator_dev *rdev,
+ 	unsigned int duty_pulse;
+ 	u64 req_period;
+ 	u32 rem;
++	int old_uV = pwm_regulator_get_voltage(rdev);
+ 	int ret;
+ 
+ 	pwm_get_args(drvdata->pwm, &pargs);
+@@ -166,8 +167,12 @@ static int pwm_regulator_set_voltage(struct regulator_dev *rdev,
+ 	}
+ 	drvdata->volt_uV = min_uV;
+ 
+-	/* Delay required by PWM regulator to settle to the new voltage */
+-	usleep_range(ramp_delay, ramp_delay + 1000);
++	if ((ramp_delay == 0) || !pwm_regulator_is_enabled(rdev))
++		return 0;
++
++	/* Ramp delay is in uV/uS. Adjust to uS and delay */
++	ramp_delay = DIV_ROUND_UP(abs(min_uV - old_uV), ramp_delay);
++	usleep_range(ramp_delay, ramp_delay + DIV_ROUND_UP(ramp_delay, 10));
+ 
+ 	return 0;
+ }
+diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c
+index 6c7fe4778793..891ae44a49c2 100644
+--- a/drivers/regulator/qcom_smd-regulator.c
++++ b/drivers/regulator/qcom_smd-regulator.c
+@@ -178,20 +178,21 @@ static const struct regulator_desc pma8084_hfsmps = {
+ static const struct regulator_desc pma8084_ftsmps = {
+ 	.linear_ranges = (struct regulator_linear_range[]) {
+ 		REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
+-		REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
++		REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
+ 	},
+ 	.n_linear_ranges = 2,
+-	.n_voltages = 340,
++	.n_voltages = 262,
+ 	.ops = &rpm_smps_ldo_ops,
+ };
+ 
+ static const struct regulator_desc pma8084_pldo = {
+ 	.linear_ranges = (struct regulator_linear_range[]) {
+-		REGULATOR_LINEAR_RANGE(750000,  0,  30, 25000),
+-		REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
++		REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
++		REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
++		REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
+ 	},
+-	.n_linear_ranges = 2,
+-	.n_voltages = 100,
++	.n_linear_ranges = 3,
++	.n_voltages = 164,
+ 	.ops = &rpm_smps_ldo_ops,
+ };
+ 
+@@ -221,29 +222,30 @@ static const struct regulator_desc pm8x41_hfsmps = {
+ static const struct regulator_desc pm8841_ftsmps = {
+ 	.linear_ranges = (struct regulator_linear_range[]) {
+ 		REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
+-		REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
++		REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
+ 	},
+ 	.n_linear_ranges = 2,
+-	.n_voltages = 340,
++	.n_voltages = 262,
+ 	.ops = &rpm_smps_ldo_ops,
+ };
+ 
+ static const struct regulator_desc pm8941_boost = {
+ 	.linear_ranges = (struct regulator_linear_range[]) {
+-		REGULATOR_LINEAR_RANGE(4000000, 0, 15, 100000),
++		REGULATOR_LINEAR_RANGE(4000000, 0, 30, 50000),
+ 	},
+ 	.n_linear_ranges = 1,
+-	.n_voltages = 16,
++	.n_voltages = 31,
+ 	.ops = &rpm_smps_ldo_ops,
+ };
+ 
+ static const struct regulator_desc pm8941_pldo = {
+ 	.linear_ranges = (struct regulator_linear_range[]) {
+-		REGULATOR_LINEAR_RANGE( 750000,  0,  30, 25000),
+-		REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
++		REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
++		REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
++		REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
+ 	},
+-	.n_linear_ranges = 2,
+-	.n_voltages = 100,
++	.n_linear_ranges = 3,
++	.n_voltages = 164,
+ 	.ops = &rpm_smps_ldo_ops,
+ };
+ 
+diff --git a/drivers/regulator/qcom_spmi-regulator.c b/drivers/regulator/qcom_spmi-regulator.c
+index 84cce21e98cd..16c5f84e06a7 100644
+--- a/drivers/regulator/qcom_spmi-regulator.c
++++ b/drivers/regulator/qcom_spmi-regulator.c
+@@ -1085,6 +1085,8 @@ static struct regulator_ops spmi_vs_ops = {
+ 	.set_pull_down		= spmi_regulator_common_set_pull_down,
+ 	.set_soft_start		= spmi_regulator_common_set_soft_start,
+ 	.set_over_current_protection = spmi_regulator_vs_ocp,
++	.set_mode		= spmi_regulator_common_set_mode,
++	.get_mode		= spmi_regulator_common_get_mode,
+ };
+ 
+ static struct regulator_ops spmi_boost_ops = {
+@@ -1496,6 +1498,7 @@ static const struct spmi_regulator_data pm8941_regulators[] = {
+ 	{ "s1", 0x1400, "vdd_s1", },
+ 	{ "s2", 0x1700, "vdd_s2", },
+ 	{ "s3", 0x1a00, "vdd_s3", },
++	{ "s4", 0xa000, },
+ 	{ "l1", 0x4000, "vdd_l1_l3", },
+ 	{ "l2", 0x4100, "vdd_l2_lvs_1_2_3", },
+ 	{ "l3", 0x4200, "vdd_l1_l3", },
+@@ -1523,8 +1526,8 @@ static const struct spmi_regulator_data pm8941_regulators[] = {
+ 	{ "lvs1", 0x8000, "vdd_l2_lvs_1_2_3", },
+ 	{ "lvs2", 0x8100, "vdd_l2_lvs_1_2_3", },
+ 	{ "lvs3", 0x8200, "vdd_l2_lvs_1_2_3", },
+-	{ "mvs1", 0x8300, "vin_5vs", },
+-	{ "mvs2", 0x8400, "vin_5vs", },
++	{ "5vs1", 0x8300, "vin_5vs", "ocp-5vs1", },
++	{ "5vs2", 0x8400, "vin_5vs", "ocp-5vs2", },
+ 	{ }
+ };
+ 
+diff --git a/drivers/scsi/fnic/fnic_fcs.c b/drivers/scsi/fnic/fnic_fcs.c
+index 67669a9e73c1..f3a33312a9a6 100644
+--- a/drivers/scsi/fnic/fnic_fcs.c
++++ b/drivers/scsi/fnic/fnic_fcs.c
+@@ -954,8 +954,8 @@ int fnic_alloc_rq_frame(struct vnic_rq *rq)
+ 	skb_put(skb, len);
+ 	pa = pci_map_single(fnic->pdev, skb->data, len, PCI_DMA_FROMDEVICE);
+ 
+-	r = pci_dma_mapping_error(fnic->pdev, pa);
+-	if (r) {
++	if (pci_dma_mapping_error(fnic->pdev, pa)) {
++		r = -ENOMEM;
+ 		printk(KERN_ERR "PCI mapping failed with error %d\n", r);
+ 		goto free_skb;
+ 	}
+@@ -1093,8 +1093,8 @@ static int fnic_send_frame(struct fnic *fnic, struct fc_frame *fp)
+ 
+ 	pa = pci_map_single(fnic->pdev, eth_hdr, tot_len, PCI_DMA_TODEVICE);
+ 
+-	ret = pci_dma_mapping_error(fnic->pdev, pa);
+-	if (ret) {
++	if (pci_dma_mapping_error(fnic->pdev, pa)) {
++		ret = -ENOMEM;
+ 		printk(KERN_ERR "DMA map failed with error %d\n", ret);
+ 		goto free_skb_on_err;
+ 	}
+diff --git a/drivers/scsi/qla2xxx/qla_fw.h b/drivers/scsi/qla2xxx/qla_fw.h
+index 4c0f3a774799..8a2368b32dec 100644
+--- a/drivers/scsi/qla2xxx/qla_fw.h
++++ b/drivers/scsi/qla2xxx/qla_fw.h
+@@ -1288,7 +1288,7 @@ struct vp_rpt_id_entry_24xx {
+ 
+ 	uint8_t vp_idx_map[16];
+ 
+-	uint8_t reserved_4[28];
++	uint8_t reserved_4[24];
+ 	uint16_t bbcr;
+ 	uint8_t reserved_5[6];
+ };
+diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
+index 53ef1cb6418e..1d82053a6a0c 100644
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -587,7 +587,7 @@ static void ses_match_to_enclosure(struct enclosure_device *edev,
+ 
+ 	ses_enclosure_data_process(edev, to_scsi_device(edev->edev.parent), 0);
+ 
+-	if (is_sas_attached(sdev))
++	if (scsi_is_sas_rphy(&sdev->sdev_gendev))
+ 		efd.addr = sas_get_address(sdev);
+ 
+ 	if (efd.addr) {
+diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
+index a7934ab00b96..d22de4c8c399 100644
+--- a/drivers/spi/spi-sh-msiof.c
++++ b/drivers/spi/spi-sh-msiof.c
+@@ -263,6 +263,9 @@ static void sh_msiof_spi_set_clk_regs(struct sh_msiof_spi_priv *p,
+ 
+ 	for (k = 0; k < ARRAY_SIZE(sh_msiof_spi_div_table); k++) {
+ 		brps = DIV_ROUND_UP(div, sh_msiof_spi_div_table[k].div);
++		/* SCR_BRDV_DIV_1 is valid only if BRPS is x 1/1 or x 1/2 */
++		if (sh_msiof_spi_div_table[k].div == 1 && brps > 2)
++			continue;
+ 		if (brps <= 32) /* max of brdv is 32 */
+ 			break;
+ 	}
+diff --git a/drivers/staging/comedi/drivers/adv_pci1760.c b/drivers/staging/comedi/drivers/adv_pci1760.c
+index d7dd1e55e347..9f525ff7290c 100644
+--- a/drivers/staging/comedi/drivers/adv_pci1760.c
++++ b/drivers/staging/comedi/drivers/adv_pci1760.c
+@@ -196,6 +196,7 @@ static int pci1760_pwm_ns_to_div(unsigned int flags, unsigned int ns)
+ 		break;
+ 	case CMDF_ROUND_DOWN:
+ 		divisor = ns / PCI1760_PWM_TIMEBASE;
++		break;
+ 	default:
+ 		return -EINVAL;
+ 	}
+diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c
+index 0c1a77cafe14..4c281df16816 100644
+--- a/drivers/staging/fbtft/fbtft-core.c
++++ b/drivers/staging/fbtft/fbtft-core.c
+@@ -391,11 +391,11 @@ static void fbtft_update_display(struct fbtft_par *par, unsigned start_line,
+ 
+ 	if (unlikely(timeit)) {
+ 		ts_end = ktime_get();
+-		if (ktime_to_ns(par->update_time))
++		if (!ktime_to_ns(par->update_time))
+ 			par->update_time = ts_start;
+ 
+-		par->update_time = ts_start;
+ 		fps = ktime_us_delta(ts_start, par->update_time);
++		par->update_time = ts_start;
+ 		fps = fps ? 1000000 / fps : 0;
+ 
+ 		throughput = ktime_us_delta(ts_end, ts_start);
+diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
+index 917a55c4480d..ffe9f8875311 100644
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -141,6 +141,7 @@ static void usbtmc_delete(struct kref *kref)
+ 	struct usbtmc_device_data *data = to_usbtmc_data(kref);
+ 
+ 	usb_put_dev(data->usb_dev);
++	kfree(data);
+ }
+ 
+ static int usbtmc_open(struct inode *inode, struct file *filp)
+@@ -1379,7 +1380,7 @@ static int usbtmc_probe(struct usb_interface *intf,
+ 
+ 	dev_dbg(&intf->dev, "%s called\n", __func__);
+ 
+-	data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
++	data = kmalloc(sizeof(*data), GFP_KERNEL);
+ 	if (!data)
+ 		return -ENOMEM;
+ 
+diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
+index cf8819a5c5b2..8bb011ea78f7 100644
+--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
++++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
+@@ -1878,11 +1878,8 @@ static int qe_get_frame(struct usb_gadget *gadget)
+ 
+ 	tmp = in_be16(&udc->usb_param->frame_n);
+ 	if (tmp & 0x8000)
+-		tmp = tmp & 0x07ff;
+-	else
+-		tmp = -EINVAL;
+-
+-	return (int)tmp;
++		return tmp & 0x07ff;
++	return -EINVAL;
+ }
+ 
+ static int fsl_qe_start(struct usb_gadget *gadget,
+diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
+index 7771be3ac178..4dd531ac5a7f 100644
+--- a/drivers/usb/misc/legousbtower.c
++++ b/drivers/usb/misc/legousbtower.c
+@@ -898,24 +898,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
+ 	dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval;
+ 	dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval;
+ 
+-	/* we can register the device now, as it is ready */
+-	usb_set_intfdata (interface, dev);
+-
+-	retval = usb_register_dev (interface, &tower_class);
+-
+-	if (retval) {
+-		/* something prevented us from registering this driver */
+-		dev_err(idev, "Not able to get a minor for this device.\n");
+-		usb_set_intfdata (interface, NULL);
+-		goto error;
+-	}
+-	dev->minor = interface->minor;
+-
+-	/* let the user know what node this device is now attached to */
+-	dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
+-		 "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
+-		 USB_MAJOR, dev->minor);
+-
+ 	/* get the firmware version and log it */
+ 	result = usb_control_msg (udev,
+ 				  usb_rcvctrlpipe(udev, 0),
+@@ -936,6 +918,23 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
+ 		 get_version_reply.minor,
+ 		 le16_to_cpu(get_version_reply.build_no));
+ 
++	/* we can register the device now, as it is ready */
++	usb_set_intfdata (interface, dev);
++
++	retval = usb_register_dev (interface, &tower_class);
++
++	if (retval) {
++		/* something prevented us from registering this driver */
++		dev_err(idev, "Not able to get a minor for this device.\n");
++		usb_set_intfdata (interface, NULL);
++		goto error;
++	}
++	dev->minor = interface->minor;
++
++	/* let the user know what node this device is now attached to */
++	dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
++		 "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
++		 USB_MAJOR, dev->minor);
+ 
+ exit:
+ 	return retval;
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 96a70789b4c2..7e91ee27ac3a 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -118,6 +118,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
+ 	{ USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
+ 	{ USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
++	{ USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */
+ 	{ USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
+ 	{ USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */
+ 	{ USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */
+diff --git a/drivers/usb/usbip/vudc_rx.c b/drivers/usb/usbip/vudc_rx.c
+index 344bd9473475..e429b59f6f8a 100644
+--- a/drivers/usb/usbip/vudc_rx.c
++++ b/drivers/usb/usbip/vudc_rx.c
+@@ -142,7 +142,7 @@ static int v_recv_cmd_submit(struct vudc *udc,
+ 	urb_p->urb->status = -EINPROGRESS;
+ 
+ 	/* FIXME: more pipe setup to please usbip_common */
+-	urb_p->urb->pipe &= ~(11 << 30);
++	urb_p->urb->pipe &= ~(3 << 30);
+ 	switch (urb_p->ep->type) {
+ 	case USB_ENDPOINT_XFER_BULK:
+ 		urb_p->urb->pipe |= (PIPE_BULK << 30);
+diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
+index 3595cffa24ea..cff8a65d7ef0 100644
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -258,10 +258,12 @@ static int watchdog_stop(struct watchdog_device *wdd)
+ 		return -EBUSY;
+ 	}
+ 
+-	if (wdd->ops->stop)
++	if (wdd->ops->stop) {
++		clear_bit(WDOG_HW_RUNNING, &wdd->status);
+ 		err = wdd->ops->stop(wdd);
+-	else
++	} else {
+ 		set_bit(WDOG_HW_RUNNING, &wdd->status);
++	}
+ 
+ 	if (err == 0) {
+ 		clear_bit(WDOG_ACTIVE, &wdd->status);
+diff --git a/fs/aio.c b/fs/aio.c
+index fb8e45b88cd4..4fe81d1c60f9 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct file_system_type *fs_type,
+ 	static const struct dentry_operations ops = {
+ 		.d_dname	= simple_dname,
+ 	};
+-	return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC);
++	struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
++					   AIO_RING_MAGIC);
++
++	if (!IS_ERR(root))
++		root->d_sb->s_iflags |= SB_I_NOEXEC;
++	return root;
+ }
+ 
+ /* aio_setup
+diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
+index 6e0fedf6713b..cf22f1e38fa3 100644
+--- a/fs/ceph/dir.c
++++ b/fs/ceph/dir.c
+@@ -597,7 +597,7 @@ static bool need_reset_readdir(struct ceph_file_info *fi, loff_t new_pos)
+ 	if (is_hash_order(new_pos)) {
+ 		/* no need to reset last_name for a forward seek when
+ 		 * dentries are sotred in hash order */
+-	} else if (fi->frag |= fpos_frag(new_pos)) {
++	} else if (fi->frag != fpos_frag(new_pos)) {
+ 		return true;
+ 	}
+ 	rinfo = fi->last_readdir ? &fi->last_readdir->r_reply_info : NULL;
+diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
+index d81f96aacd51..656f68f7fe53 100644
+--- a/fs/nfs/callback_xdr.c
++++ b/fs/nfs/callback_xdr.c
+@@ -925,7 +925,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
+ 	if (hdr_arg.minorversion == 0) {
+ 		cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident);
+ 		if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp))
+-			return rpc_drop_reply;
++			goto out_invalidcred;
+ 	}
+ 
+ 	cps.minorversion = hdr_arg.minorversion;
+@@ -953,6 +953,10 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
+ 	nfs_put_client(cps.clp);
+ 	dprintk("%s: done, status = %u\n", __func__, ntohl(status));
+ 	return rpc_success;
++
++out_invalidcred:
++	pr_warn_ratelimited("NFS: NFSv4 callback contains invalid cred\n");
++	return rpc_autherr_badcred;
+ }
+ 
+ /*
+diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
+index aa59757389dc..b4c1407e8fe4 100644
+--- a/fs/nfs/filelayout/filelayout.c
++++ b/fs/nfs/filelayout/filelayout.c
+@@ -375,8 +375,7 @@ static int filelayout_commit_done_cb(struct rpc_task *task,
+ 		return -EAGAIN;
+ 	}
+ 
+-	if (data->verf.committed == NFS_UNSTABLE)
+-		pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
++	pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
+ 
+ 	return 0;
+ }
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
+index 6da14aedde2b..1c15966c9f52 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -37,6 +37,7 @@ ff_layout_alloc_layout_hdr(struct inode *inode, gfp_t gfp_flags)
+ 	if (ffl) {
+ 		INIT_LIST_HEAD(&ffl->error_list);
+ 		INIT_LIST_HEAD(&ffl->mirrors);
++		ffl->last_report_time = ktime_get();
+ 		return &ffl->generic_hdr;
+ 	} else
+ 		return NULL;
+@@ -640,19 +641,18 @@ nfs4_ff_layoutstat_start_io(struct nfs4_ff_layout_mirror *mirror,
+ {
+ 	static const ktime_t notime = {0};
+ 	s64 report_interval = FF_LAYOUTSTATS_REPORT_INTERVAL;
++	struct nfs4_flexfile_layout *ffl = FF_LAYOUT_FROM_HDR(mirror->layout);
+ 
+ 	nfs4_ff_start_busy_timer(&layoutstat->busy_timer, now);
+ 	if (ktime_equal(mirror->start_time, notime))
+ 		mirror->start_time = now;
+-	if (ktime_equal(mirror->last_report_time, notime))
+-		mirror->last_report_time = now;
+ 	if (mirror->report_interval != 0)
+ 		report_interval = (s64)mirror->report_interval * 1000LL;
+ 	else if (layoutstats_timer != 0)
+ 		report_interval = (s64)layoutstats_timer * 1000LL;
+-	if (ktime_to_ms(ktime_sub(now, mirror->last_report_time)) >=
++	if (ktime_to_ms(ktime_sub(now, ffl->last_report_time)) >=
+ 			report_interval) {
+-		mirror->last_report_time = now;
++		ffl->last_report_time = now;
+ 		return true;
+ 	}
+ 
+@@ -1529,8 +1529,7 @@ static int ff_layout_commit_done_cb(struct rpc_task *task,
+ 		return -EAGAIN;
+ 	}
+ 
+-	if (data->verf.committed == NFS_UNSTABLE
+-	    && ff_layout_need_layoutcommit(data->lseg))
++	if (ff_layout_need_layoutcommit(data->lseg))
+ 		pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
+ 
+ 	return 0;
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
+index 1bcdb15d0c41..3ee0c9fcea76 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.h
++++ b/fs/nfs/flexfilelayout/flexfilelayout.h
+@@ -84,7 +84,6 @@ struct nfs4_ff_layout_mirror {
+ 	struct nfs4_ff_layoutstat	read_stat;
+ 	struct nfs4_ff_layoutstat	write_stat;
+ 	ktime_t				start_time;
+-	ktime_t				last_report_time;
+ 	u32				report_interval;
+ };
+ 
+@@ -101,6 +100,7 @@ struct nfs4_flexfile_layout {
+ 	struct pnfs_ds_commit_info commit_info;
+ 	struct list_head	mirrors;
+ 	struct list_head	error_list; /* nfs4_ff_layout_ds_err */
++	ktime_t			last_report_time; /* Layoutstat report times */
+ };
+ 
+ static inline struct nfs4_flexfile_layout *
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index e2320c643107..00fd0c716988 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -4393,7 +4393,8 @@ static void nfs4_proc_read_setup(struct nfs_pgio_header *hdr,
+ 				 struct rpc_message *msg)
+ {
+ 	hdr->timestamp   = jiffies;
+-	hdr->pgio_done_cb = nfs4_read_done_cb;
++	if (!hdr->pgio_done_cb)
++		hdr->pgio_done_cb = nfs4_read_done_cb;
+ 	msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_READ];
+ 	nfs4_init_sequence(&hdr->args.seq_args, &hdr->res.seq_res, 0);
+ }
+diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c
+index 45d6110744cb..ec9ddef5ae75 100644
+--- a/fs/pstore/inode.c
++++ b/fs/pstore/inode.c
+@@ -178,7 +178,6 @@ static loff_t pstore_file_llseek(struct file *file, loff_t off, int whence)
+ }
+ 
+ static const struct file_operations pstore_file_operations = {
+-	.owner		= THIS_MODULE,
+ 	.open		= pstore_file_open,
+ 	.read		= pstore_file_read,
+ 	.llseek		= pstore_file_llseek,
+diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
+index 5261751f6bd4..5f5270941ba0 100644
+--- a/include/linux/can/dev.h
++++ b/include/linux/can/dev.h
+@@ -32,6 +32,7 @@ enum can_mode {
+  * CAN common private data
+  */
+ struct can_priv {
++	struct net_device *dev;
+ 	struct can_device_stats can_stats;
+ 
+ 	struct can_bittiming bittiming, data_bittiming;
+@@ -47,7 +48,7 @@ struct can_priv {
+ 	u32 ctrlmode_static;	/* static enabled options for driver/hardware */
+ 
+ 	int restart_ms;
+-	struct timer_list restart_timer;
++	struct delayed_work restart_work;
+ 
+ 	int (*do_set_bittiming)(struct net_device *dev);
+ 	int (*do_set_data_bittiming)(struct net_device *dev);
+diff --git a/include/linux/nvmem-consumer.h b/include/linux/nvmem-consumer.h
+index 9bb77d3ed6e0..c2256d746543 100644
+--- a/include/linux/nvmem-consumer.h
++++ b/include/linux/nvmem-consumer.h
+@@ -74,7 +74,7 @@ static inline void nvmem_cell_put(struct nvmem_cell *cell)
+ {
+ }
+ 
+-static inline char *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
++static inline void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
+ {
+ 	return ERR_PTR(-ENOSYS);
+ }
+diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
+index d1faa019c02a..b71b2581811c 100644
+--- a/include/linux/slub_def.h
++++ b/include/linux/slub_def.h
+@@ -114,15 +114,17 @@ static inline void sysfs_slab_remove(struct kmem_cache *s)
+ void object_err(struct kmem_cache *s, struct page *page,
+ 		u8 *object, char *reason);
+ 
++void *fixup_red_left(struct kmem_cache *s, void *p);
++
+ static inline void *nearest_obj(struct kmem_cache *cache, struct page *page,
+ 				void *x) {
+ 	void *object = x - (x - page_address(page)) % cache->size;
+ 	void *last_object = page_address(page) +
+ 		(page->objects - 1) * cache->size;
+-	if (unlikely(object > last_object))
+-		return last_object;
+-	else
+-		return object;
++	void *result = (unlikely(object > last_object)) ? last_object : object;
++
++	result = fixup_red_left(cache, result);
++	return result;
+ }
+ 
+ #endif /* _LINUX_SLUB_DEF_H */
+diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
+index fa7bc29925c9..ef17db6caaed 100644
+--- a/include/linux/sysctl.h
++++ b/include/linux/sysctl.h
+@@ -41,6 +41,8 @@ extern int proc_dostring(struct ctl_table *, int,
+ 			 void __user *, size_t *, loff_t *);
+ extern int proc_dointvec(struct ctl_table *, int,
+ 			 void __user *, size_t *, loff_t *);
++extern int proc_douintvec(struct ctl_table *, int,
++			 void __user *, size_t *, loff_t *);
+ extern int proc_dointvec_minmax(struct ctl_table *, int,
+ 				void __user *, size_t *, loff_t *);
+ extern int proc_dointvec_jiffies(struct ctl_table *, int,
+diff --git a/include/scsi/scsi_transport_sas.h b/include/scsi/scsi_transport_sas.h
+index 13c0b2ba1b6c..31ae074dad9d 100644
+--- a/include/scsi/scsi_transport_sas.h
++++ b/include/scsi/scsi_transport_sas.h
+@@ -15,8 +15,14 @@ static inline int is_sas_attached(struct scsi_device *sdev)
+ {
+ 	return 0;
+ }
++
++static inline int scsi_is_sas_rphy(const struct device *sdev)
++{
++	return 0;
++}
+ #else
+ extern int is_sas_attached(struct scsi_device *sdev);
++extern int scsi_is_sas_rphy(const struct device *);
+ #endif
+ 
+ static inline int sas_protocol_ata(enum sas_protocol proto)
+@@ -202,7 +208,6 @@ extern int sas_rphy_add(struct sas_rphy *);
+ extern void sas_rphy_remove(struct sas_rphy *);
+ extern void sas_rphy_delete(struct sas_rphy *);
+ extern void sas_rphy_unlink(struct sas_rphy *);
+-extern int scsi_is_sas_rphy(const struct device *);
+ 
+ struct sas_port *sas_port_alloc(struct device *, int);
+ struct sas_port *sas_port_alloc_num(struct device *);
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index 129a7ca5f159..b1e0cbb8cf97 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -3452,9 +3452,28 @@ static ssize_t cgroup_subtree_control_write(struct kernfs_open_file *of,
+ 	 * Except for the root, subtree_control must be zero for a cgroup
+ 	 * with tasks so that child cgroups don't compete against tasks.
+ 	 */
+-	if (enable && cgroup_parent(cgrp) && !list_empty(&cgrp->cset_links)) {
+-		ret = -EBUSY;
+-		goto out_unlock;
++	if (enable && cgroup_parent(cgrp)) {
++		struct cgrp_cset_link *link;
++
++		/*
++		 * Because namespaces pin csets too, @cgrp->cset_links
++		 * might not be empty even when @cgrp is empty.  Walk and
++		 * verify each cset.
++		 */
++		spin_lock_irq(&css_set_lock);
++
++		ret = 0;
++		list_for_each_entry(link, &cgrp->cset_links, cset_link) {
++			if (css_set_populated(link->cset)) {
++				ret = -EBUSY;
++				break;
++			}
++		}
++
++		spin_unlock_irq(&css_set_lock);
++
++		if (ret)
++			goto out_unlock;
+ 	}
+ 
+ 	/* save and update control masks and prepare csses */
+@@ -3905,7 +3924,9 @@ void cgroup_file_notify(struct cgroup_file *cfile)
+  * cgroup_task_count - count the number of tasks in a cgroup.
+  * @cgrp: the cgroup in question
+  *
+- * Return the number of tasks in the cgroup.
++ * Return the number of tasks in the cgroup.  The returned number can be
++ * higher than the actual number of tasks due to css_set references from
++ * namespace roots and temporary usages.
+  */
+ static int cgroup_task_count(const struct cgroup *cgrp)
+ {
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index 40b6ed559448..8cee9627ac4b 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -325,8 +325,7 @@ static struct file_system_type cpuset_fs_type = {
+ /*
+  * Return in pmask the portion of a cpusets's cpus_allowed that
+  * are online.  If none are online, walk up the cpuset hierarchy
+- * until we find one that does have some online cpus.  The top
+- * cpuset always has some cpus online.
++ * until we find one that does have some online cpus.
+  *
+  * One way or another, we guarantee to return some non-empty subset
+  * of cpu_online_mask.
+@@ -335,8 +334,20 @@ static struct file_system_type cpuset_fs_type = {
+  */
+ static void guarantee_online_cpus(struct cpuset *cs, struct cpumask *pmask)
+ {
+-	while (!cpumask_intersects(cs->effective_cpus, cpu_online_mask))
++	while (!cpumask_intersects(cs->effective_cpus, cpu_online_mask)) {
+ 		cs = parent_cs(cs);
++		if (unlikely(!cs)) {
++			/*
++			 * The top cpuset doesn't have any online cpu as a
++			 * consequence of a race between cpuset_hotplug_work
++			 * and cpu hotplug notifier.  But we know the top
++			 * cpuset's effective_cpus is on its way to to be
++			 * identical to cpu_online_mask.
++			 */
++			cpumask_copy(pmask, cpu_online_mask);
++			return;
++		}
++	}
+ 	cpumask_and(pmask, cs->effective_cpus, cpu_online_mask);
+ }
+ 
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index e68c0a735c8f..31c1520b744d 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -6064,7 +6064,7 @@ static int __perf_pmu_output_stop(void *info)
+ {
+ 	struct perf_event *event = info;
+ 	struct pmu *pmu = event->pmu;
+-	struct perf_cpu_context *cpuctx = get_cpu_ptr(pmu->pmu_cpu_context);
++	struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
+ 	struct remote_output ro = {
+ 		.rb	= event->rb,
+ 	};
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 74fd39079031..d6404ede47eb 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -938,14 +938,12 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
+ 	deactivate_mm(tsk, mm);
+ 
+ 	/*
+-	 * If we're exiting normally, clear a user-space tid field if
+-	 * requested.  We leave this alone when dying by signal, to leave
+-	 * the value intact in a core dump, and to save the unnecessary
+-	 * trouble, say, a killed vfork parent shouldn't touch this mm.
+-	 * Userland only wants this done for a sys_exit.
++	 * Signal userspace if we're not exiting with a core dump
++	 * because we want to leave the value intact for debugging
++	 * purposes.
+ 	 */
+ 	if (tsk->clear_child_tid) {
+-		if (!(tsk->flags & PF_SIGNALED) &&
++		if (!(tsk->signal->flags & SIGNAL_GROUP_COREDUMP) &&
+ 		    atomic_read(&mm->mm_users) > 1) {
+ 			/*
+ 			 * We don't check the error code - if userspace has
+diff --git a/kernel/printk/braille.c b/kernel/printk/braille.c
+index 276762f3a460..d5760c42f042 100644
+--- a/kernel/printk/braille.c
++++ b/kernel/printk/braille.c
+@@ -9,10 +9,10 @@
+ 
+ char *_braille_console_setup(char **str, char **brl_options)
+ {
+-	if (!memcmp(*str, "brl,", 4)) {
++	if (!strncmp(*str, "brl,", 4)) {
+ 		*brl_options = "";
+ 		*str += 4;
+-	} else if (!memcmp(str, "brl=", 4)) {
++	} else if (!strncmp(*str, "brl=", 4)) {
+ 		*brl_options = *str + 4;
+ 		*str = strchr(*brl_options, ',');
+ 		if (!*str)
+diff --git a/kernel/rcu/rcuperf.c b/kernel/rcu/rcuperf.c
+index 3cee0d8393ed..8ce4eecff319 100644
+--- a/kernel/rcu/rcuperf.c
++++ b/kernel/rcu/rcuperf.c
+@@ -58,7 +58,7 @@ MODULE_AUTHOR("Paul E. McKenney <paulmck@××××××××××××××.com>");
+ #define VERBOSE_PERFOUT_ERRSTRING(s) \
+ 	do { if (verbose) pr_alert("%s" PERF_FLAG "!!! %s\n", perf_type, s); } while (0)
+ 
+-torture_param(bool, gp_exp, true, "Use expedited GP wait primitives");
++torture_param(bool, gp_exp, false, "Use expedited GP wait primitives");
+ torture_param(int, holdoff, 10, "Holdoff time before test start (s)");
+ torture_param(int, nreaders, -1, "Number of RCU reader threads");
+ torture_param(int, nwriters, -1, "Number of RCU updater threads");
+@@ -363,8 +363,6 @@ rcu_perf_writer(void *arg)
+ 	u64 *wdpp = writer_durations[me];
+ 
+ 	VERBOSE_PERFOUT_STRING("rcu_perf_writer task started");
+-	WARN_ON(rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp);
+-	WARN_ON(rcu_gp_is_normal() && gp_exp);
+ 	WARN_ON(!wdpp);
+ 	set_cpus_allowed_ptr(current, cpumask_of(me % nr_cpu_ids));
+ 	sp.sched_priority = 1;
+@@ -631,6 +629,16 @@ rcu_perf_init(void)
+ 		firsterr = -ENOMEM;
+ 		goto unwind;
+ 	}
++	if (rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp) {
++		VERBOSE_PERFOUT_ERRSTRING("All grace periods expedited, no normal ones to measure!");
++		firsterr = -EINVAL;
++		goto unwind;
++	}
++	if (rcu_gp_is_normal() && gp_exp) {
++		VERBOSE_PERFOUT_ERRSTRING("All grace periods normal, no expedited ones to measure!");
++		firsterr = -EINVAL;
++		goto unwind;
++	}
+ 	for (i = 0; i < nrealwriters; i++) {
+ 		writer_durations[i] =
+ 			kcalloc(MAX_MEAS, sizeof(*writer_durations[i]),
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 38eacc323fdd..e1422c1f5a29 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -7255,7 +7255,6 @@ static void sched_rq_cpu_starting(unsigned int cpu)
+ 	struct rq *rq = cpu_rq(cpu);
+ 
+ 	rq->calc_load_update = calc_load_update;
+-	account_reset_rq(rq);
+ 	update_max_interval();
+ }
+ 
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 898c0d2f18fe..b4f3edf9a219 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -1809,16 +1809,3 @@ static inline void cpufreq_trigger_update(u64 time) {}
+ #else /* arch_scale_freq_capacity */
+ #define arch_scale_freq_invariant()	(false)
+ #endif
+-
+-static inline void account_reset_rq(struct rq *rq)
+-{
+-#ifdef CONFIG_IRQ_TIME_ACCOUNTING
+-	rq->prev_irq_time = 0;
+-#endif
+-#ifdef CONFIG_PARAVIRT
+-	rq->prev_steal_time = 0;
+-#endif
+-#ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING
+-	rq->prev_steal_time_rq = 0;
+-#endif
+-}
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 87b2fc38398b..b58e447233bf 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2122,6 +2122,21 @@ static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp,
+ 	return 0;
+ }
+ 
++static int do_proc_douintvec_conv(bool *negp, unsigned long *lvalp,
++				 int *valp,
++				 int write, void *data)
++{
++	if (write) {
++		if (*negp)
++			return -EINVAL;
++		*valp = *lvalp;
++	} else {
++		unsigned int val = *valp;
++		*lvalp = (unsigned long)val;
++	}
++	return 0;
++}
++
+ static const char proc_wspace_sep[] = { ' ', '\t', '\n' };
+ 
+ static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
+@@ -2241,8 +2256,27 @@ static int do_proc_dointvec(struct ctl_table *table, int write,
+ int proc_dointvec(struct ctl_table *table, int write,
+ 		     void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+-    return do_proc_dointvec(table,write,buffer,lenp,ppos,
+-		    	    NULL,NULL);
++	return do_proc_dointvec(table, write, buffer, lenp, ppos, NULL, NULL);
++}
++
++/**
++ * proc_douintvec - read a vector of unsigned integers
++ * @table: the sysctl table
++ * @write: %TRUE if this is a write to the sysctl file
++ * @buffer: the user buffer
++ * @lenp: the size of the user buffer
++ * @ppos: file position
++ *
++ * Reads/writes up to table->maxlen/sizeof(unsigned int) unsigned integer
++ * values from/to the user buffer, treated as an ASCII string.
++ *
++ * Returns 0 on success.
++ */
++int proc_douintvec(struct ctl_table *table, int write,
++		     void __user *buffer, size_t *lenp, loff_t *ppos)
++{
++	return do_proc_dointvec(table, write, buffer, lenp, ppos,
++				do_proc_douintvec_conv, NULL);
+ }
+ 
+ /*
+@@ -2840,6 +2874,12 @@ int proc_dointvec(struct ctl_table *table, int write,
+ 	return -ENOSYS;
+ }
+ 
++int proc_douintvec(struct ctl_table *table, int write,
++		  void __user *buffer, size_t *lenp, loff_t *ppos)
++{
++	return -ENOSYS;
++}
++
+ int proc_dointvec_minmax(struct ctl_table *table, int write,
+ 		    void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+@@ -2885,6 +2925,7 @@ int proc_doulongvec_ms_jiffies_minmax(struct ctl_table *table, int write,
+  * exception granted :-)
+  */
+ EXPORT_SYMBOL(proc_dointvec);
++EXPORT_SYMBOL(proc_douintvec);
+ EXPORT_SYMBOL(proc_dointvec_jiffies);
+ EXPORT_SYMBOL(proc_dointvec_minmax);
+ EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
+diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
+index fafeaf803bd0..f4b86e8ca1e7 100644
+--- a/kernel/trace/Kconfig
++++ b/kernel/trace/Kconfig
+@@ -542,6 +542,7 @@ config HIST_TRIGGERS
+ 	bool "Histogram triggers"
+ 	depends on ARCH_HAVE_NMI_SAFE_CMPXCHG
+ 	select TRACING_MAP
++	select TRACING
+ 	default n
+ 	help
+ 	  Hist triggers allow one or more arbitrary trace event fields
+diff --git a/lib/test_hash.c b/lib/test_hash.c
+index c9549c8b4909..a06ac379ad42 100644
+--- a/lib/test_hash.c
++++ b/lib/test_hash.c
+@@ -143,7 +143,7 @@ static int __init
+ test_hash_init(void)
+ {
+ 	char buf[SIZE+1];
+-	u32 string_or = 0, hash_or[2][33] = { 0 };
++	u32 string_or = 0, hash_or[2][33] = { { 0, } };
+ 	unsigned tests = 0;
+ 	unsigned long long h64 = 0;
+ 	int i, j;
+@@ -219,21 +219,27 @@ test_hash_init(void)
+ 	}
+ 
+ 	/* Issue notices about skipped tests. */
+-#ifndef HAVE_ARCH__HASH_32
+-	pr_info("__hash_32() has no arch implementation to test.");
+-#elif HAVE_ARCH__HASH_32 != 1
++#ifdef HAVE_ARCH__HASH_32
++#if HAVE_ARCH__HASH_32 != 1
+ 	pr_info("__hash_32() is arch-specific; not compared to generic.");
+ #endif
+-#ifndef HAVE_ARCH_HASH_32
+-	pr_info("hash_32() has no arch implementation to test.");
+-#elif HAVE_ARCH_HASH_32 != 1
++#else
++	pr_info("__hash_32() has no arch implementation to test.");
++#endif
++#ifdef HAVE_ARCH_HASH_32
++#if HAVE_ARCH_HASH_32 != 1
+ 	pr_info("hash_32() is arch-specific; not compared to generic.");
+ #endif
+-#ifndef HAVE_ARCH_HASH_64
+-	pr_info("hash_64() has no arch implementation to test.");
+-#elif HAVE_ARCH_HASH_64 != 1
++#else
++	pr_info("hash_32() has no arch implementation to test.");
++#endif
++#ifdef HAVE_ARCH_HASH_64
++#if HAVE_ARCH_HASH_64 != 1
+ 	pr_info("hash_64() is arch-specific; not compared to generic.");
+ #endif
++#else
++	pr_info("hash_64() has no arch implementation to test.");
++#endif
+ 
+ 	pr_notice("%u tests passed.", tests);
+ 
+diff --git a/mm/ksm.c b/mm/ksm.c
+index 4786b4150f62..443bac35cd87 100644
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -283,7 +283,8 @@ static inline struct rmap_item *alloc_rmap_item(void)
+ {
+ 	struct rmap_item *rmap_item;
+ 
+-	rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL);
++	rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL |
++						__GFP_NORETRY | __GFP_NOWARN);
+ 	if (rmap_item)
+ 		ksm_rmap_items++;
+ 	return rmap_item;
+diff --git a/mm/slub.c b/mm/slub.c
+index 7a6d268840c0..b94fb362a018 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -124,7 +124,7 @@ static inline int kmem_cache_debug(struct kmem_cache *s)
+ #endif
+ }
+ 
+-static inline void *fixup_red_left(struct kmem_cache *s, void *p)
++inline void *fixup_red_left(struct kmem_cache *s, void *p)
+ {
+ 	if (kmem_cache_debug(s) && s->flags & SLAB_RED_ZONE)
+ 		p += s->red_left_pad;
+diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
+index df42eb1365a0..63762b3df7c7 100644
+--- a/net/batman-adv/bat_v_elp.c
++++ b/net/batman-adv/bat_v_elp.c
+@@ -334,7 +334,7 @@ int batadv_v_elp_iface_enable(struct batadv_hard_iface *hard_iface)
+ 		goto out;
+ 
+ 	skb_reserve(hard_iface->bat_v.elp_skb, ETH_HLEN + NET_IP_ALIGN);
+-	elp_buff = skb_push(hard_iface->bat_v.elp_skb, BATADV_ELP_HLEN);
++	elp_buff = skb_put(hard_iface->bat_v.elp_skb, BATADV_ELP_HLEN);
+ 	elp_packet = (struct batadv_elp_packet *)elp_buff;
+ 	memset(elp_packet, 0, BATADV_ELP_HLEN);
+ 
+diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
+index ab8c4f9738fe..1da7bfc61ac6 100644
+--- a/net/batman-adv/originator.c
++++ b/net/batman-adv/originator.c
+@@ -251,10 +251,8 @@ static void batadv_neigh_node_release(struct kref *ref)
+ 	struct hlist_node *node_tmp;
+ 	struct batadv_neigh_node *neigh_node;
+ 	struct batadv_neigh_ifinfo *neigh_ifinfo;
+-	struct batadv_algo_ops *bao;
+ 
+ 	neigh_node = container_of(ref, struct batadv_neigh_node, refcount);
+-	bao = neigh_node->orig_node->bat_priv->bat_algo_ops;
+ 
+ 	hlist_for_each_entry_safe(neigh_ifinfo, node_tmp,
+ 				  &neigh_node->ifinfo_list, list) {
+@@ -263,9 +261,6 @@ static void batadv_neigh_node_release(struct kref *ref)
+ 
+ 	batadv_hardif_neigh_put(neigh_node->hardif_neigh);
+ 
+-	if (bao->bat_neigh_free)
+-		bao->bat_neigh_free(neigh_node);
+-
+ 	batadv_hardif_put(neigh_node->if_incoming);
+ 
+ 	kfree_rcu(neigh_node, rcu);
+diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
+index bfac086b4d01..69d425d5729e 100644
+--- a/net/batman-adv/routing.c
++++ b/net/batman-adv/routing.c
+@@ -456,6 +456,29 @@ static int batadv_check_unicast_packet(struct batadv_priv *bat_priv,
+ }
+ 
+ /**
++ * batadv_last_bonding_get - Get last_bonding_candidate of orig_node
++ * @orig_node: originator node whose last bonding candidate should be retrieved
++ *
++ * Return: last bonding candidate of router or NULL if not found
++ *
++ * The object is returned with refcounter increased by 1.
++ */
++static struct batadv_orig_ifinfo *
++batadv_last_bonding_get(struct batadv_orig_node *orig_node)
++{
++	struct batadv_orig_ifinfo *last_bonding_candidate;
++
++	spin_lock_bh(&orig_node->neigh_list_lock);
++	last_bonding_candidate = orig_node->last_bonding_candidate;
++
++	if (last_bonding_candidate)
++		kref_get(&last_bonding_candidate->refcount);
++	spin_unlock_bh(&orig_node->neigh_list_lock);
++
++	return last_bonding_candidate;
++}
++
++/**
+  * batadv_last_bonding_replace - Replace last_bonding_candidate of orig_node
+  * @orig_node: originator node whose bonding candidates should be replaced
+  * @new_candidate: new bonding candidate or NULL
+@@ -525,7 +548,7 @@ batadv_find_router(struct batadv_priv *bat_priv,
+ 	 * router - obviously there are no other candidates.
+ 	 */
+ 	rcu_read_lock();
+-	last_candidate = orig_node->last_bonding_candidate;
++	last_candidate = batadv_last_bonding_get(orig_node);
+ 	if (last_candidate)
+ 		last_cand_router = rcu_dereference(last_candidate->router);
+ 
+@@ -617,6 +640,9 @@ next:
+ 		batadv_orig_ifinfo_put(next_candidate);
+ 	}
+ 
++	if (last_candidate)
++		batadv_orig_ifinfo_put(last_candidate);
++
+ 	return router;
+ }
+ 
+diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
+index 74d865a4df46..40aed16fbc28 100644
+--- a/net/batman-adv/types.h
++++ b/net/batman-adv/types.h
+@@ -1284,8 +1284,6 @@ struct batadv_forw_packet {
+  *  better than neigh2 for their respective outgoing interface from the metric
+  *  prospective
+  * @bat_neigh_print: print the single hop neighbor list (optional)
+- * @bat_neigh_free: free the resources allocated by the routing algorithm for a
+- *  neigh_node object
+  * @bat_orig_print: print the originator table (optional)
+  * @bat_orig_free: free the resources allocated by the routing algorithm for an
+  *  orig_node object
+@@ -1316,7 +1314,6 @@ struct batadv_algo_ops {
+ 		 struct batadv_neigh_node *neigh2,
+ 		 struct batadv_hard_iface *if_outgoing2);
+ 	void (*bat_neigh_print)(struct batadv_priv *priv, struct seq_file *seq);
+-	void (*bat_neigh_free)(struct batadv_neigh_node *neigh);
+ 	/* orig_node handling API */
+ 	void (*bat_orig_print)(struct batadv_priv *priv, struct seq_file *seq,
+ 			       struct batadv_hard_iface *hard_iface);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index eb4f5f24cbe3..106643e268ba 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -32,6 +32,7 @@
+ 
+ #include <linux/debugfs.h>
+ #include <linux/crc16.h>
++#include <linux/filter.h>
+ 
+ #include <net/bluetooth/bluetooth.h>
+ #include <net/bluetooth/hci_core.h>
+@@ -5835,6 +5836,9 @@ static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
+ 		if (chan->sdu)
+ 			break;
+ 
++		if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
++			break;
++
+ 		chan->sdu_len = get_unaligned_le16(skb->data);
+ 		skb_pull(skb, L2CAP_SDULEN_SIZE);
+ 
+@@ -6610,6 +6614,10 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
+ 		goto drop;
+ 	}
+ 
++	if ((chan->mode == L2CAP_MODE_ERTM ||
++	     chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
++		goto drop;
++
+ 	if (!control->sframe) {
+ 		int err;
+ 
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index 1842141baedb..a8ba752732c9 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -1019,7 +1019,7 @@ static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
+ 		goto done;
+ 
+ 	if (pi->rx_busy_skb) {
+-		if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
++		if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
+ 			pi->rx_busy_skb = NULL;
+ 		else
+ 			goto done;
+@@ -1270,7 +1270,17 @@ static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
+ 		goto done;
+ 	}
+ 
+-	err = sock_queue_rcv_skb(sk, skb);
++	if (chan->mode != L2CAP_MODE_ERTM &&
++	    chan->mode != L2CAP_MODE_STREAMING) {
++		/* Even if no filter is attached, we could potentially
++		 * get errors from security modules, etc.
++		 */
++		err = sk_filter(sk, skb);
++		if (err)
++			goto done;
++	}
++
++	err = __sock_queue_rcv_skb(sk, skb);
+ 
+ 	/* For ERTM, handle one skb that doesn't fit into the recv
+ 	 * buffer.  This is important to do because the data frames
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 8bad2ad81399..5f0ed8c6584d 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1330,8 +1330,12 @@ out:
+ 	spin_unlock_bh(&txqi->queue.lock);
+ 
+ 	if (skb && skb_has_frag_list(skb) &&
+-	    !ieee80211_hw_check(&local->hw, TX_FRAG_LIST))
+-		skb_linearize(skb);
++	    !ieee80211_hw_check(&local->hw, TX_FRAG_LIST)) {
++		if (skb_linearize(skb)) {
++			ieee80211_free_txskb(&local->hw, skb);
++			return NULL;
++		}
++	}
+ 
+ 	return skb;
+ }
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 2808d550d273..0294ada6bc40 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -453,7 +453,7 @@ static struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
+ 	struct rpc_xprt_switch *xps;
+ 
+ 	if (args->bc_xprt && args->bc_xprt->xpt_bc_xps) {
+-		WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
++		WARN_ON_ONCE(!(args->protocol & XPRT_TRANSPORT_BC));
+ 		xps = args->bc_xprt->xpt_bc_xps;
+ 		xprt_switch_get(xps);
+ 	} else {
+@@ -520,7 +520,7 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
+ 	char servername[48];
+ 
+ 	if (args->bc_xprt) {
+-		WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
++		WARN_ON_ONCE(!(args->protocol & XPRT_TRANSPORT_BC));
+ 		xprt = args->bc_xprt->xpt_bc_xprt;
+ 		if (xprt) {
+ 			xprt_get(xprt);
+diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
+index cc9852897395..c5b0cb4f4056 100644
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -1188,11 +1188,17 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
+ 		*statp = procp->pc_func(rqstp, rqstp->rq_argp, rqstp->rq_resp);
+ 
+ 		/* Encode reply */
+-		if (test_bit(RQ_DROPME, &rqstp->rq_flags)) {
++		if (*statp == rpc_drop_reply ||
++		    test_bit(RQ_DROPME, &rqstp->rq_flags)) {
+ 			if (procp->pc_release)
+ 				procp->pc_release(rqstp, NULL, rqstp->rq_resp);
+ 			goto dropit;
+ 		}
++		if (*statp == rpc_autherr_badcred) {
++			if (procp->pc_release)
++				procp->pc_release(rqstp, NULL, rqstp->rq_resp);
++			goto err_bad_auth;
++		}
+ 		if (*statp == rpc_success &&
+ 		    (xdr = procp->pc_encode) &&
+ 		    !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) {
+diff --git a/net/sunrpc/xprtrdma/fmr_ops.c b/net/sunrpc/xprtrdma/fmr_ops.c
+index 6326ebe8b595..c748ff6f6877 100644
+--- a/net/sunrpc/xprtrdma/fmr_ops.c
++++ b/net/sunrpc/xprtrdma/fmr_ops.c
+@@ -63,9 +63,12 @@ static int
+ __fmr_unmap(struct rpcrdma_mw *mw)
+ {
+ 	LIST_HEAD(l);
++	int rc;
+ 
+ 	list_add(&mw->fmr.fmr->list, &l);
+-	return ib_unmap_fmr(&l);
++	rc = ib_unmap_fmr(&l);
++	list_del_init(&mw->fmr.fmr->list);
++	return rc;
+ }
+ 
+ /* Deferred reset of a single FMR. Generate a fresh rkey by
+@@ -267,7 +270,7 @@ fmr_op_unmap_sync(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req)
+ 		seg = &req->rl_segments[i];
+ 		mw = seg->rl_mw;
+ 
+-		list_add(&mw->fmr.fmr->list, &unmap_list);
++		list_add_tail(&mw->fmr.fmr->list, &unmap_list);
+ 
+ 		i += seg->mr_nsegs;
+ 	}
+@@ -280,7 +283,9 @@ fmr_op_unmap_sync(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req)
+ 	 */
+ 	for (i = 0, nchunks = req->rl_nchunks; nchunks; nchunks--) {
+ 		seg = &req->rl_segments[i];
++		mw = seg->rl_mw;
+ 
++		list_del_init(&mw->fmr.fmr->list);
+ 		__fmr_dma_unmap(r_xprt, seg);
+ 		rpcrdma_put_mw(r_xprt, seg->rl_mw);
+ 
+diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
+index 42396a74405d..a68f03133df9 100644
+--- a/scripts/recordmcount.c
++++ b/scripts/recordmcount.c
+@@ -363,6 +363,7 @@ is_mcounted_section_name(char const *const txtname)
+ 		strcmp(".sched.text",    txtname) == 0 ||
+ 		strcmp(".spinlock.text", txtname) == 0 ||
+ 		strcmp(".irqentry.text", txtname) == 0 ||
++		strcmp(".softirqentry.text", txtname) == 0 ||
+ 		strcmp(".kprobes.text", txtname) == 0 ||
+ 		strcmp(".text.unlikely", txtname) == 0;
+ }
+diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
+index 96e2486a6fc4..2d48011bc362 100755
+--- a/scripts/recordmcount.pl
++++ b/scripts/recordmcount.pl
+@@ -134,6 +134,7 @@ my %text_sections = (
+      ".sched.text" => 1,
+      ".spinlock.text" => 1,
+      ".irqentry.text" => 1,
++     ".softirqentry.text" => 1,
+      ".kprobes.text" => 1,
+      ".text.unlikely" => 1,
+ );
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 56fefbd85782..ed62748a6d55 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -261,6 +261,7 @@ enum {
+ 	CXT_FIXUP_HP_530,
+ 	CXT_FIXUP_CAP_MIX_AMP_5047,
+ 	CXT_FIXUP_MUTE_LED_EAPD,
++	CXT_FIXUP_HP_SPECTRE,
+ };
+ 
+ /* for hda_fixup_thinkpad_acpi() */
+@@ -765,6 +766,14 @@ static const struct hda_fixup cxt_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = cxt_fixup_mute_led_eapd,
+ 	},
++	[CXT_FIXUP_HP_SPECTRE] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			/* enable NID 0x1d for the speaker on top */
++			{ 0x1d, 0x91170111 },
++			{ }
++		}
++	},
+ };
+ 
+ static const struct snd_pci_quirk cxt5045_fixups[] = {
+@@ -814,6 +823,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ 	SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC),
+ 	SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC),
+ 	SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
++	SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
+ 	SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
+ 	SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
+ 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index eaee626ab185..b1fa50aed888 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5790,6 +5790,13 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ 	{0x14, 0x90170110}, \
+ 	{0x15, 0x0221401f}
+ 
++#define ALC295_STANDARD_PINS \
++	{0x12, 0xb7a60130}, \
++	{0x14, 0x90170110}, \
++	{0x17, 0x21014020}, \
++	{0x18, 0x21a19030}, \
++	{0x21, 0x04211020}
++
+ #define ALC298_STANDARD_PINS \
+ 	{0x12, 0x90a60130}, \
+ 	{0x21, 0x03211020}
+@@ -5830,6 +5837,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ 		{0x14, 0x90170120},
+ 		{0x21, 0x02211030}),
+ 	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++		{0x14, 0x90170110},
++		{0x1b, 0x02011020},
++		{0x21, 0x0221101f}),
++	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 		{0x14, 0x90170130},
+ 		{0x1b, 0x01014020},
+ 		{0x21, 0x0221103f}),
+@@ -5895,6 +5906,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ 		{0x14, 0x90170120},
+ 		{0x21, 0x02211030}),
+ 	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++		{0x12, 0xb7a60130},
++		{0x14, 0x90170110},
++		{0x21, 0x02211020}),
++	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 		ALC256_STANDARD_PINS),
+ 	SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
+ 		{0x12, 0x90a60130},
+@@ -6005,6 +6020,8 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ 	SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 		ALC292_STANDARD_PINS,
+ 		{0x13, 0x90a60140}),
++	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
++		ALC295_STANDARD_PINS),
+ 	SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 		ALC298_STANDARD_PINS,
+ 		{0x17, 0x90170110}),
+diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
+index 06d8c263c68f..d5a0327e8ff1 100644
+--- a/sound/soc/intel/skylake/skl.c
++++ b/sound/soc/intel/skylake/skl.c
+@@ -659,8 +659,10 @@ static int skl_probe(struct pci_dev *pci,
+ 
+ 	skl->nhlt = skl_nhlt_init(bus->dev);
+ 
+-	if (skl->nhlt == NULL)
++	if (skl->nhlt == NULL) {
++		err = -ENODEV;
+ 		goto out_free;
++	}
+ 
+ 	skl_nhlt_update_topology_bin(skl);
+ 
+diff --git a/sound/soc/omap/omap-mcpdm.c b/sound/soc/omap/omap-mcpdm.c
+index b837265ac3e9..8d0d45d330e7 100644
+--- a/sound/soc/omap/omap-mcpdm.c
++++ b/sound/soc/omap/omap-mcpdm.c
+@@ -390,8 +390,8 @@ static int omap_mcpdm_probe(struct snd_soc_dai *dai)
+ 	pm_runtime_get_sync(mcpdm->dev);
+ 	omap_mcpdm_write(mcpdm, MCPDM_REG_CTRL, 0x00);
+ 
+-	ret = devm_request_irq(mcpdm->dev, mcpdm->irq, omap_mcpdm_irq_handler,
+-				0, "McPDM", (void *)mcpdm);
++	ret = request_irq(mcpdm->irq, omap_mcpdm_irq_handler, 0, "McPDM",
++			  (void *)mcpdm);
+ 
+ 	pm_runtime_put_sync(mcpdm->dev);
+ 
+@@ -416,6 +416,7 @@ static int omap_mcpdm_remove(struct snd_soc_dai *dai)
+ {
+ 	struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
+ 
++	free_irq(mcpdm->irq, (void *)mcpdm);
+ 	pm_runtime_disable(mcpdm->dev);
+ 
+ 	return 0;