[gentoo-commits] proj/linux-patches:4.9 commit in: /

[Mike Pagano]

commit:     371bb07b0e2c28329a10c91f7dd7e85653d8454c
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul  1 12:10:36 2020 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul  1 12:10:36 2020 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=371bb07b

Linux patch 4.9.229

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1228_linux-4.9.229.patch | 7171 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 7175 insertions(+)

diff --git a/0000_README b/0000_README
index f7c5f42..0a85d73 100644
--- a/0000_README
+++ b/0000_README
@@ -955,6 +955,10 @@ Patch:  1227_linux-4.9.228.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.228
 
+Patch:  1228_linux-4.9.229.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.229
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1228_linux-4.9.229.patch b/1228_linux-4.9.229.patch
new file mode 100644
index 0000000..53a13fb
--- /dev/null
+++ b/1228_linux-4.9.229.patch
@@ -0,0 +1,7171 @@
+diff --git a/Documentation/media/uapi/dvb/fe-get-property.rst b/Documentation/media/uapi/dvb/fe-get-property.rst
+index 015d4db597b5..c80c5fc6e916 100644
+--- a/Documentation/media/uapi/dvb/fe-get-property.rst
++++ b/Documentation/media/uapi/dvb/fe-get-property.rst
+@@ -48,8 +48,11 @@ depends on the delivery system and on the device:
+ 
+    -  This call requires read/write access to the device.
+ 
+-   -  At return, the values are updated to reflect the actual parameters
+-      used.
++.. note::
++
++   At return, the values aren't updated to reflect the actual
++   parameters used. If the actual parameters are needed, an explicit
++   call to ``FE_GET_PROPERTY`` is needed.
+ 
+ -  ``FE_GET_PROPERTY:``
+ 
+diff --git a/Makefile b/Makefile
+index af23d7b67442..a8a9704a6e2e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 228
++SUBLEVEL = 229
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/arm/mach-imx/pm-imx5.c b/arch/arm/mach-imx/pm-imx5.c
+index 868781fd460c..14c630c899c5 100644
+--- a/arch/arm/mach-imx/pm-imx5.c
++++ b/arch/arm/mach-imx/pm-imx5.c
+@@ -301,14 +301,14 @@ static int __init imx_suspend_alloc_ocram(
+ 	if (!ocram_pool) {
+ 		pr_warn("%s: ocram pool unavailable!\n", __func__);
+ 		ret = -ENODEV;
+-		goto put_node;
++		goto put_device;
+ 	}
+ 
+ 	ocram_base = gen_pool_alloc(ocram_pool, size);
+ 	if (!ocram_base) {
+ 		pr_warn("%s: unable to alloc ocram!\n", __func__);
+ 		ret = -ENOMEM;
+-		goto put_node;
++		goto put_device;
+ 	}
+ 
+ 	phys = gen_pool_virt_to_phys(ocram_pool, ocram_base);
+@@ -318,6 +318,8 @@ static int __init imx_suspend_alloc_ocram(
+ 	if (virt_out)
+ 		*virt_out = virt;
+ 
++put_device:
++	put_device(&pdev->dev);
+ put_node:
+ 	of_node_put(node);
+ 
+diff --git a/arch/arm/mach-integrator/Kconfig b/arch/arm/mach-integrator/Kconfig
+index cefe44f6889b..ba124f8704fa 100644
+--- a/arch/arm/mach-integrator/Kconfig
++++ b/arch/arm/mach-integrator/Kconfig
+@@ -3,6 +3,8 @@ menuconfig ARCH_INTEGRATOR
+ 	depends on ARCH_MULTI_V4T || ARCH_MULTI_V5 || ARCH_MULTI_V6
+ 	select ARM_AMBA
+ 	select COMMON_CLK_VERSATILE
++	select CMA
++	select DMA_CMA
+ 	select HAVE_TCM
+ 	select ICST
+ 	select MFD_SYSCON
+@@ -34,14 +36,13 @@ config INTEGRATOR_IMPD1
+ 	select ARM_VIC
+ 	select GPIO_PL061
+ 	select GPIOLIB
++	select REGULATOR
++	select REGULATOR_FIXED_VOLTAGE
+ 	help
+ 	  The IM-PD1 is an add-on logic module for the Integrator which
+ 	  allows ARM(R) Ltd PrimeCells to be developed and evaluated.
+ 	  The IM-PD1 can be found on the Integrator/PP2 platform.
+ 
+-	  To compile this driver as a module, choose M here: the
+-	  module will be called impd1.
+-
+ config INTEGRATOR_CM7TDMI
+ 	bool "Integrator/CM7TDMI core module"
+ 	depends on ARCH_INTEGRATOR_AP
+diff --git a/arch/arm64/kernel/perf_regs.c b/arch/arm64/kernel/perf_regs.c
+index 3f62b35fb6f1..815c395a1076 100644
+--- a/arch/arm64/kernel/perf_regs.c
++++ b/arch/arm64/kernel/perf_regs.c
+@@ -13,15 +13,34 @@ u64 perf_reg_value(struct pt_regs *regs, int idx)
+ 		return 0;
+ 
+ 	/*
+-	 * Compat (i.e. 32 bit) mode:
+-	 * - PC has been set in the pt_regs struct in kernel_entry,
+-	 * - Handle SP and LR here.
++	 * Our handling of compat tasks (PERF_SAMPLE_REGS_ABI_32) is weird, but
++	 * we're stuck with it for ABI compatability reasons.
++	 *
++	 * For a 32-bit consumer inspecting a 32-bit task, then it will look at
++	 * the first 16 registers (see arch/arm/include/uapi/asm/perf_regs.h).
++	 * These correspond directly to a prefix of the registers saved in our
++	 * 'struct pt_regs', with the exception of the PC, so we copy that down
++	 * (x15 corresponds to SP_hyp in the architecture).
++	 *
++	 * So far, so good.
++	 *
++	 * The oddity arises when a 64-bit consumer looks at a 32-bit task and
++	 * asks for registers beyond PERF_REG_ARM_MAX. In this case, we return
++	 * SP_usr, LR_usr and PC in the positions where the AArch64 SP, LR and
++	 * PC registers would normally live. The initial idea was to allow a
++	 * 64-bit unwinder to unwind a 32-bit task and, although it's not clear
++	 * how well that works in practice, somebody might be relying on it.
++	 *
++	 * At the time we make a sample, we don't know whether the consumer is
++	 * 32-bit or 64-bit, so we have to cater for both possibilities.
+ 	 */
+ 	if (compat_user_mode(regs)) {
+ 		if ((u32)idx == PERF_REG_ARM64_SP)
+ 			return regs->compat_sp;
+ 		if ((u32)idx == PERF_REG_ARM64_LR)
+ 			return regs->compat_lr;
++		if (idx == 15)
++			return regs->pc;
+ 	}
+ 
+ 	if ((u32)idx == PERF_REG_ARM64_SP)
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index c17e8451d997..3fbe420f49c4 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -1092,13 +1092,13 @@ ENTRY(__sys_clone)
+ 	l.movhi	r29,hi(sys_clone)
+ 	l.ori	r29,r29,lo(sys_clone)
+ 	l.j	_fork_save_extra_regs_and_call
+-	 l.addi	r7,r1,0
++	 l.nop
+ 
+ ENTRY(__sys_fork)
+ 	l.movhi	r29,hi(sys_fork)
+ 	l.ori	r29,r29,lo(sys_fork)
+ 	l.j	_fork_save_extra_regs_and_call
+-	 l.addi	r3,r1,0
++	 l.nop
+ 
+ ENTRY(sys_rt_sigreturn)
+ 	l.j	_sys_rt_sigreturn
+diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
+index 9fd77f8794a0..315758c84187 100644
+--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
++++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
+@@ -754,10 +754,25 @@ extern struct page *pgd_page(pgd_t pgd);
+ #define pud_page_vaddr(pud)	__va(pud_val(pud) & ~PUD_MASKED_BITS)
+ #define pgd_page_vaddr(pgd)	__va(pgd_val(pgd) & ~PGD_MASKED_BITS)
+ 
+-#define pgd_index(address) (((address) >> (PGDIR_SHIFT)) & (PTRS_PER_PGD - 1))
+-#define pud_index(address) (((address) >> (PUD_SHIFT)) & (PTRS_PER_PUD - 1))
+-#define pmd_index(address) (((address) >> (PMD_SHIFT)) & (PTRS_PER_PMD - 1))
+-#define pte_index(address) (((address) >> (PAGE_SHIFT)) & (PTRS_PER_PTE - 1))
++static inline unsigned long pgd_index(unsigned long address)
++{
++	return (address >> PGDIR_SHIFT) & (PTRS_PER_PGD - 1);
++}
++
++static inline unsigned long pud_index(unsigned long address)
++{
++	return (address >> PUD_SHIFT) & (PTRS_PER_PUD - 1);
++}
++
++static inline unsigned long pmd_index(unsigned long address)
++{
++	return (address >> PMD_SHIFT) & (PTRS_PER_PMD - 1);
++}
++
++static inline unsigned long pte_index(unsigned long address)
++{
++	return (address >> PAGE_SHIFT) & (PTRS_PER_PTE - 1);
++}
+ 
+ /*
+  * Find an entry in a page-table-directory.  We combine the address region
+diff --git a/arch/powerpc/include/asm/kprobes.h b/arch/powerpc/include/asm/kprobes.h
+index 2c9759bdb63b..063d64c1c9e8 100644
+--- a/arch/powerpc/include/asm/kprobes.h
++++ b/arch/powerpc/include/asm/kprobes.h
+@@ -29,6 +29,7 @@
+ #include <linux/types.h>
+ #include <linux/ptrace.h>
+ #include <linux/percpu.h>
++#include <linux/module.h>
+ #include <asm/probes.h>
+ #include <asm/code-patching.h>
+ 
+@@ -60,7 +61,7 @@ typedef ppc_opcode_t kprobe_opcode_t;
+ #define kprobe_lookup_name(name, addr)					\
+ {									\
+ 	char dot_name[MODULE_NAME_LEN + 1 + KSYM_NAME_LEN];		\
+-	char *modsym;							\
++	const char *modsym;							\
+ 	bool dot_appended = false;					\
+ 	if ((modsym = strchr(name, ':')) != NULL) {			\
+ 		modsym++;						\
+diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
+index 9dafd7af39b8..cb4d6cd949fc 100644
+--- a/arch/powerpc/kernel/machine_kexec.c
++++ b/arch/powerpc/kernel/machine_kexec.c
+@@ -113,11 +113,12 @@ void machine_kexec(struct kimage *image)
+ 
+ void __init reserve_crashkernel(void)
+ {
+-	unsigned long long crash_size, crash_base;
++	unsigned long long crash_size, crash_base, total_mem_sz;
+ 	int ret;
+ 
++	total_mem_sz = memory_limit ? memory_limit : memblock_phys_mem_size();
+ 	/* use common parsing */
+-	ret = parse_crashkernel(boot_command_line, memblock_phys_mem_size(),
++	ret = parse_crashkernel(boot_command_line, total_mem_sz,
+ 			&crash_size, &crash_base);
+ 	if (ret == 0 && crash_size > 0) {
+ 		crashk_res.start = crash_base;
+@@ -176,6 +177,7 @@ void __init reserve_crashkernel(void)
+ 	/* Crash kernel trumps memory limit */
+ 	if (memory_limit && memory_limit <= crashk_res.end) {
+ 		memory_limit = crashk_res.end + 1;
++		total_mem_sz = memory_limit;
+ 		printk("Adjusted memory limit for crashkernel, now 0x%llx\n",
+ 		       memory_limit);
+ 	}
+@@ -184,7 +186,7 @@ void __init reserve_crashkernel(void)
+ 			"for crashkernel (System RAM: %ldMB)\n",
+ 			(unsigned long)(crash_size >> 20),
+ 			(unsigned long)(crashk_res.start >> 20),
+-			(unsigned long)(memblock_phys_mem_size() >> 20));
++			(unsigned long)(total_mem_sz >> 20));
+ 
+ 	if (!memblock_is_region_memory(crashk_res.start, crash_size) ||
+ 	    memblock_reserve(crashk_res.start, crash_size)) {
+diff --git a/arch/powerpc/perf/hv-24x7.c b/arch/powerpc/perf/hv-24x7.c
+index 991c6a517ddc..2456522583c2 100644
+--- a/arch/powerpc/perf/hv-24x7.c
++++ b/arch/powerpc/perf/hv-24x7.c
+@@ -1306,16 +1306,6 @@ static void h_24x7_event_read(struct perf_event *event)
+ 			h24x7hw = &get_cpu_var(hv_24x7_hw);
+ 			h24x7hw->events[i] = event;
+ 			put_cpu_var(h24x7hw);
+-			/*
+-			 * Clear the event count so we can compute the _change_
+-			 * in the 24x7 raw counter value at the end of the txn.
+-			 *
+-			 * Note that we could alternatively read the 24x7 value
+-			 * now and save its value in event->hw.prev_count. But
+-			 * that would require issuing a hcall, which would then
+-			 * defeat the purpose of using the txn interface.
+-			 */
+-			local64_set(&event->count, 0);
+ 		}
+ 
+ 		put_cpu_var(hv_24x7_reqb);
+diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c
+index b0f34663b1ae..19bae78b1f25 100644
+--- a/arch/powerpc/platforms/ps3/mm.c
++++ b/arch/powerpc/platforms/ps3/mm.c
+@@ -212,13 +212,14 @@ void ps3_mm_vas_destroy(void)
+ {
+ 	int result;
+ 
+-	DBG("%s:%d: map.vas_id    = %llu\n", __func__, __LINE__, map.vas_id);
+-
+ 	if (map.vas_id) {
+ 		result = lv1_select_virtual_address_space(0);
+-		BUG_ON(result);
+-		result = lv1_destruct_virtual_address_space(map.vas_id);
+-		BUG_ON(result);
++		result += lv1_destruct_virtual_address_space(map.vas_id);
++
++		if (result) {
++			lv1_panic(0);
++		}
++
+ 		map.vas_id = 0;
+ 	}
+ }
+@@ -316,19 +317,20 @@ static void ps3_mm_region_destroy(struct mem_region *r)
+ 	int result;
+ 
+ 	if (!r->destroy) {
+-		pr_info("%s:%d: Not destroying high region: %llxh %llxh\n",
+-			__func__, __LINE__, r->base, r->size);
+ 		return;
+ 	}
+ 
+-	DBG("%s:%d: r->base = %llxh\n", __func__, __LINE__, r->base);
+-
+ 	if (r->base) {
+ 		result = lv1_release_memory(r->base);
+-		BUG_ON(result);
++
++		if (result) {
++			lv1_panic(0);
++		}
++
+ 		r->size = r->base = r->offset = 0;
+ 		map.total = map.rm.size;
+ 	}
++
+ 	ps3_mm_set_repository_highmem(NULL);
+ }
+ 
+diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
+index 8799d8a83d56..0af19aa1df57 100644
+--- a/arch/powerpc/platforms/pseries/ras.c
++++ b/arch/powerpc/platforms/pseries/ras.c
+@@ -311,10 +311,11 @@ static irqreturn_t ras_error_interrupt(int irq, void *dev_id)
+ /*
+  * Some versions of FWNMI place the buffer inside the 4kB page starting at
+  * 0x7000. Other versions place it inside the rtas buffer. We check both.
++ * Minimum size of the buffer is 16 bytes.
+  */
+ #define VALID_FWNMI_BUFFER(A) \
+-	((((A) >= 0x7000) && ((A) < 0x7ff0)) || \
+-	(((A) >= rtas.base) && ((A) < (rtas.base + rtas.size - 16))))
++	((((A) >= 0x7000) && ((A) <= 0x8000 - 16)) || \
++	(((A) >= rtas.base) && ((A) <= (rtas.base + rtas.size - 16))))
+ 
+ /*
+  * Get the error information for errors coming through the
+diff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h
+index 6bc941be6921..166fbd74e316 100644
+--- a/arch/s390/include/asm/syscall.h
++++ b/arch/s390/include/asm/syscall.h
+@@ -41,7 +41,17 @@ static inline void syscall_rollback(struct task_struct *task,
+ static inline long syscall_get_error(struct task_struct *task,
+ 				     struct pt_regs *regs)
+ {
+-	return IS_ERR_VALUE(regs->gprs[2]) ? regs->gprs[2] : 0;
++	unsigned long error = regs->gprs[2];
++#ifdef CONFIG_COMPAT
++	if (test_tsk_thread_flag(task, TIF_31BIT)) {
++		/*
++		 * Sign-extend the value so (int)-EFOO becomes (long)-EFOO
++		 * and will match correctly in comparisons.
++		 */
++		error = (long)(int)error;
++	}
++#endif
++	return IS_ERR_VALUE(error) ? error : 0;
+ }
+ 
+ static inline long syscall_get_return_value(struct task_struct *task,
+diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
+index fc2974b929c3..ee757d6f585e 100644
+--- a/arch/s390/kernel/ptrace.c
++++ b/arch/s390/kernel/ptrace.c
+@@ -308,6 +308,25 @@ static inline void __poke_user_per(struct task_struct *child,
+ 		child->thread.per_user.end = data;
+ }
+ 
++static void fixup_int_code(struct task_struct *child, addr_t data)
++{
++	struct pt_regs *regs = task_pt_regs(child);
++	int ilc = regs->int_code >> 16;
++	u16 insn;
++
++	if (ilc > 6)
++		return;
++
++	if (ptrace_access_vm(child, regs->psw.addr - (regs->int_code >> 16),
++			&insn, sizeof(insn), FOLL_FORCE) != sizeof(insn))
++		return;
++
++	/* double check that tracee stopped on svc instruction */
++	if ((insn >> 8) != 0xa)
++		return;
++
++	regs->int_code = 0x20000 | (data & 0xffff);
++}
+ /*
+  * Write a word to the user area of a process at location addr. This
+  * operation does have an additional problem compared to peek_user.
+@@ -319,7 +338,9 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
+ 	struct user *dummy = NULL;
+ 	addr_t offset;
+ 
++
+ 	if (addr < (addr_t) &dummy->regs.acrs) {
++		struct pt_regs *regs = task_pt_regs(child);
+ 		/*
+ 		 * psw and gprs are stored on the stack
+ 		 */
+@@ -337,7 +358,11 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
+ 				/* Invalid addressing mode bits */
+ 				return -EINVAL;
+ 		}
+-		*(addr_t *)((addr_t) &task_pt_regs(child)->psw + addr) = data;
++
++		if (test_pt_regs_flag(regs, PIF_SYSCALL) &&
++			addr == offsetof(struct user, regs.gprs[2]))
++			fixup_int_code(child, data);
++		*(addr_t *)((addr_t) &regs->psw + addr) = data;
+ 
+ 	} else if (addr < (addr_t) (&dummy->regs.orig_gpr2)) {
+ 		/*
+@@ -703,6 +728,10 @@ static int __poke_user_compat(struct task_struct *child,
+ 			regs->psw.mask = (regs->psw.mask & ~PSW_MASK_BA) |
+ 				(__u64)(tmp & PSW32_ADDR_AMODE);
+ 		} else {
++
++			if (test_pt_regs_flag(regs, PIF_SYSCALL) &&
++				addr == offsetof(struct compat_user, regs.gprs[2]))
++				fixup_int_code(child, data);
+ 			/* gpr 0-15 */
+ 			*(__u32*)((addr_t) &regs->psw + addr*2 + 4) = tmp;
+ 		}
+diff --git a/arch/sparc/kernel/ptrace_32.c b/arch/sparc/kernel/ptrace_32.c
+index 396dbdea0cfa..2f4316c14266 100644
+--- a/arch/sparc/kernel/ptrace_32.c
++++ b/arch/sparc/kernel/ptrace_32.c
+@@ -167,12 +167,17 @@ static int genregs32_set(struct task_struct *target,
+ 	if (ret || !count)
+ 		return ret;
+ 	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
+-				 &regs->y,
++				 &regs->npc,
+ 				 34 * sizeof(u32), 35 * sizeof(u32));
+ 	if (ret || !count)
+ 		return ret;
++	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
++				 &regs->y,
++				 35 * sizeof(u32), 36 * sizeof(u32));
++	if (ret || !count)
++		return ret;
+ 	return user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
+-					 35 * sizeof(u32), 38 * sizeof(u32));
++					 36 * sizeof(u32), 38 * sizeof(u32));
+ }
+ 
+ static int fpregs32_get(struct task_struct *target,
+diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
+index 3b16935b22bc..d1df7d2e31b1 100644
+--- a/arch/x86/boot/Makefile
++++ b/arch/x86/boot/Makefile
+@@ -87,7 +87,7 @@ $(obj)/vmlinux.bin: $(obj)/compressed/vmlinux FORCE
+ 
+ SETUP_OBJS = $(addprefix $(obj)/,$(setup-y))
+ 
+-sed-zoffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(startup_32\|startup_64\|efi32_stub_entry\|efi64_stub_entry\|efi_pe_entry\|input_data\|_end\|_ehead\|_text\|z_.*\)$$/\#define ZO_\2 0x\1/p'
++sed-zoffset := -e 's/^\([0-9a-fA-F]*\) [a-zA-Z] \(startup_32\|startup_64\|efi32_stub_entry\|efi64_stub_entry\|efi_pe_entry\|input_data\|_end\|_ehead\|_text\|z_.*\)$$/\#define ZO_\2 0x\1/p'
+ 
+ quiet_cmd_zoffset = ZOFFSET $@
+       cmd_zoffset = $(NM) $< | sed -n $(sed-zoffset) > $@
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index dcd6df5943d6..86aec286e4f2 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -754,6 +754,13 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ 	void *frame_pointer;
+ 	bool skipped = false;
+ 
++	/*
++	 * Set a dummy kprobe for avoiding kretprobe recursion.
++	 * Since kretprobe never run in kprobe handler, kprobe must not
++	 * be running at this point.
++	 */
++	kprobe_busy_begin();
++
+ 	INIT_HLIST_HEAD(&empty_rp);
+ 	kretprobe_hash_lock(current, &head, &flags);
+ 	/* fixup registers */
+@@ -829,10 +836,9 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ 		orig_ret_address = (unsigned long)ri->ret_addr;
+ 		if (ri->rp && ri->rp->handler) {
+ 			__this_cpu_write(current_kprobe, &ri->rp->kp);
+-			get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
+ 			ri->ret_addr = correct_ret_addr;
+ 			ri->rp->handler(ri, regs);
+-			__this_cpu_write(current_kprobe, NULL);
++			__this_cpu_write(current_kprobe, &kprobe_busy);
+ 		}
+ 
+ 		recycle_rp_inst(ri, &empty_rp);
+@@ -848,6 +854,8 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ 
+ 	kretprobe_hash_unlock(current, &flags);
+ 
++	kprobe_busy_end();
++
+ 	hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
+ 		hlist_del(&ri->hlist);
+ 		kfree(ri);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 0f66f7dd8938..6b7faa14c27b 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2304,7 +2304,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ 		return kvm_mtrr_set_msr(vcpu, msr, data);
+ 	case MSR_IA32_APICBASE:
+ 		return kvm_set_apic_base(vcpu, msr_info);
+-	case APIC_BASE_MSR ... APIC_BASE_MSR + 0x3ff:
++	case APIC_BASE_MSR ... APIC_BASE_MSR + 0xff:
+ 		return kvm_x2apic_msr_write(vcpu, msr, data);
+ 	case MSR_IA32_TSCDEADLINE:
+ 		kvm_set_lapic_tscdeadline_msr(vcpu, data);
+@@ -2576,7 +2576,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ 	case MSR_IA32_APICBASE:
+ 		msr_info->data = kvm_get_apic_base(vcpu);
+ 		break;
+-	case APIC_BASE_MSR ... APIC_BASE_MSR + 0x3ff:
++	case APIC_BASE_MSR ... APIC_BASE_MSR + 0xff:
+ 		return kvm_x2apic_msr_read(vcpu, msr_info->index, &msr_info->data);
+ 		break;
+ 	case MSR_IA32_TSCDEADLINE:
+diff --git a/crypto/algboss.c b/crypto/algboss.c
+index 6e39d9c05b98..5cbc588555ca 100644
+--- a/crypto/algboss.c
++++ b/crypto/algboss.c
+@@ -194,8 +194,6 @@ static int cryptomgr_schedule_probe(struct crypto_larval *larval)
+ 	if (IS_ERR(thread))
+ 		goto err_put_larval;
+ 
+-	wait_for_completion_interruptible(&larval->completion);
+-
+ 	return NOTIFY_STOP;
+ 
+ err_put_larval:
+diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
+index 7502441b1400..764786cfb0d9 100644
+--- a/drivers/acpi/sysfs.c
++++ b/drivers/acpi/sysfs.c
+@@ -843,13 +843,13 @@ static void __exit interrupt_stats_exit(void)
+ }
+ 
+ static ssize_t
+-acpi_show_profile(struct device *dev, struct device_attribute *attr,
++acpi_show_profile(struct kobject *kobj, struct kobj_attribute *attr,
+ 		  char *buf)
+ {
+ 	return sprintf(buf, "%d\n", acpi_gbl_FADT.preferred_profile);
+ }
+ 
+-static const struct device_attribute pm_profile_attr =
++static const struct kobj_attribute pm_profile_attr =
+ 	__ATTR(pm_profile, S_IRUGO, acpi_show_profile, NULL);
+ 
+ static ssize_t hotplug_enabled_show(struct kobject *kobj,
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index ba0cffbd0bb6..46bf7e9d00ab 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -57,7 +57,6 @@
+ #include <linux/workqueue.h>
+ #include <linux/scatterlist.h>
+ #include <linux/io.h>
+-#include <linux/async.h>
+ #include <linux/log2.h>
+ #include <linux/slab.h>
+ #include <linux/glob.h>
+@@ -6410,7 +6409,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
+ 	/* perform each probe asynchronously */
+ 	for (i = 0; i < host->n_ports; i++) {
+ 		struct ata_port *ap = host->ports[i];
+-		async_schedule(async_port_probe, ap);
++		ap->cookie = async_schedule(async_port_probe, ap);
+ 	}
+ 
+ 	return 0;
+@@ -6550,11 +6549,11 @@ void ata_host_detach(struct ata_host *host)
+ {
+ 	int i;
+ 
+-	/* Ensure ata_port probe has completed */
+-	async_synchronize_full();
+-
+-	for (i = 0; i < host->n_ports; i++)
++	for (i = 0; i < host->n_ports; i++) {
++		/* Ensure ata_port probe has completed */
++		async_synchronize_cookie(host->ports[i]->cookie + 1);
+ 		ata_port_detach(host->ports[i]);
++	}
+ 
+ 	/* the host is dead now, dissociate ACPI */
+ 	ata_acpi_dissociate(host);
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index c4f2b563c9f0..f4b38adb9d8a 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -3967,12 +3967,13 @@ static unsigned int ata_scsi_mode_select_xlat(struct ata_queued_cmd *qc)
+ {
+ 	struct scsi_cmnd *scmd = qc->scsicmd;
+ 	const u8 *cdb = scmd->cmnd;
+-	const u8 *p;
+ 	u8 pg, spg;
+ 	unsigned six_byte, pg_len, hdr_len, bd_len;
+ 	int len;
+ 	u16 fp = (u16)-1;
+ 	u8 bp = 0xff;
++	u8 buffer[64];
++	const u8 *p = buffer;
+ 
+ 	VPRINTK("ENTER\n");
+ 
+@@ -4006,12 +4007,14 @@ static unsigned int ata_scsi_mode_select_xlat(struct ata_queued_cmd *qc)
+ 	if (!scsi_sg_count(scmd) || scsi_sglist(scmd)->length < len)
+ 		goto invalid_param_len;
+ 
+-	p = page_address(sg_page(scsi_sglist(scmd)));
+-
+ 	/* Move past header and block descriptors.  */
+ 	if (len < hdr_len)
+ 		goto invalid_param_len;
+ 
++	if (!sg_copy_to_buffer(scsi_sglist(scmd), scsi_sg_count(scmd),
++			       buffer, sizeof(buffer)))
++		goto invalid_param_len;
++
+ 	if (six_byte)
+ 		bd_len = p[3];
+ 	else
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index bef299ef6227..ec2e4b6bc56f 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -692,6 +692,8 @@ int __init_or_module __platform_driver_probe(struct platform_driver *drv,
+ 	/* temporary section violation during probe() */
+ 	drv->probe = probe;
+ 	retval = code = __platform_driver_register(drv, module);
++	if (retval)
++		return retval;
+ 
+ 	/*
+ 	 * Fixup that section violation, being paranoid about code scanning
+diff --git a/drivers/block/ps3disk.c b/drivers/block/ps3disk.c
+index 76f33c84ce3d..7ec5e8f0cbe5 100644
+--- a/drivers/block/ps3disk.c
++++ b/drivers/block/ps3disk.c
+@@ -464,7 +464,6 @@ static int ps3disk_probe(struct ps3_system_bus_device *_dev)
+ 	blk_queue_bounce_limit(queue, BLK_BOUNCE_HIGH);
+ 
+ 	blk_queue_max_hw_sectors(queue, dev->bounce_size >> 9);
+-	blk_queue_segment_boundary(queue, -1UL);
+ 	blk_queue_dma_alignment(queue, dev->blk_size-1);
+ 	blk_queue_logical_block_size(queue, dev->blk_size);
+ 
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
+index 73aab6e984cd..2b5075298cdc 100644
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1295,13 +1295,13 @@ static struct clk_hw *bcm2835_register_clock(struct bcm2835_cprman *cprman,
+ 	return &clock->hw;
+ }
+ 
+-static struct clk *bcm2835_register_gate(struct bcm2835_cprman *cprman,
++static struct clk_hw *bcm2835_register_gate(struct bcm2835_cprman *cprman,
+ 					 const struct bcm2835_gate_data *data)
+ {
+-	return clk_register_gate(cprman->dev, data->name, data->parent,
+-				 CLK_IGNORE_UNUSED | CLK_SET_RATE_GATE,
+-				 cprman->regs + data->ctl_reg,
+-				 CM_GATE_BIT, 0, &cprman->regs_lock);
++	return clk_hw_register_gate(cprman->dev, data->name, data->parent,
++				    CLK_IGNORE_UNUSED | CLK_SET_RATE_GATE,
++				    cprman->regs + data->ctl_reg,
++				    CM_GATE_BIT, 0, &cprman->regs_lock);
+ }
+ 
+ typedef struct clk_hw *(*bcm2835_clk_register)(struct bcm2835_cprman *cprman,
+diff --git a/drivers/clk/qcom/gcc-msm8916.c b/drivers/clk/qcom/gcc-msm8916.c
+index 8dd71345b5d0..55430c8f1bc2 100644
+--- a/drivers/clk/qcom/gcc-msm8916.c
++++ b/drivers/clk/qcom/gcc-msm8916.c
+@@ -270,7 +270,7 @@ static struct clk_pll gpll0 = {
+ 	.l_reg = 0x21004,
+ 	.m_reg = 0x21008,
+ 	.n_reg = 0x2100c,
+-	.config_reg = 0x21014,
++	.config_reg = 0x21010,
+ 	.mode_reg = 0x21000,
+ 	.status_reg = 0x2101c,
+ 	.status_bit = 17,
+@@ -297,7 +297,7 @@ static struct clk_pll gpll1 = {
+ 	.l_reg = 0x20004,
+ 	.m_reg = 0x20008,
+ 	.n_reg = 0x2000c,
+-	.config_reg = 0x20014,
++	.config_reg = 0x20010,
+ 	.mode_reg = 0x20000,
+ 	.status_reg = 0x2001c,
+ 	.status_bit = 17,
+@@ -324,7 +324,7 @@ static struct clk_pll gpll2 = {
+ 	.l_reg = 0x4a004,
+ 	.m_reg = 0x4a008,
+ 	.n_reg = 0x4a00c,
+-	.config_reg = 0x4a014,
++	.config_reg = 0x4a010,
+ 	.mode_reg = 0x4a000,
+ 	.status_reg = 0x4a01c,
+ 	.status_bit = 17,
+@@ -351,7 +351,7 @@ static struct clk_pll bimc_pll = {
+ 	.l_reg = 0x23004,
+ 	.m_reg = 0x23008,
+ 	.n_reg = 0x2300c,
+-	.config_reg = 0x23014,
++	.config_reg = 0x23010,
+ 	.mode_reg = 0x23000,
+ 	.status_reg = 0x2301c,
+ 	.status_bit = 17,
+diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c
+index 09cdd35dc434..a082b026791a 100644
+--- a/drivers/clk/samsung/clk-exynos5433.c
++++ b/drivers/clk/samsung/clk-exynos5433.c
+@@ -1672,7 +1672,8 @@ static const struct samsung_gate_clock peric_gate_clks[] __initconst = {
+ 	GATE(CLK_SCLK_PCM1, "sclk_pcm1", "sclk_pcm1_peric",
+ 			ENABLE_SCLK_PERIC, 7, CLK_SET_RATE_PARENT, 0),
+ 	GATE(CLK_SCLK_I2S1, "sclk_i2s1", "sclk_i2s1_peric",
+-			ENABLE_SCLK_PERIC, 6, CLK_SET_RATE_PARENT, 0),
++			ENABLE_SCLK_PERIC, 6,
++			CLK_SET_RATE_PARENT | CLK_IGNORE_UNUSED, 0),
+ 	GATE(CLK_SCLK_SPI2, "sclk_spi2", "sclk_spi2_peric", ENABLE_SCLK_PERIC,
+ 			5, CLK_SET_RATE_PARENT, 0),
+ 	GATE(CLK_SCLK_SPI1, "sclk_spi1", "sclk_spi1_peric", ENABLE_SCLK_PERIC,
+diff --git a/drivers/clk/st/clk-flexgen.c b/drivers/clk/st/clk-flexgen.c
+index a485f3b284b9..033e6062599d 100644
+--- a/drivers/clk/st/clk-flexgen.c
++++ b/drivers/clk/st/clk-flexgen.c
+@@ -371,6 +371,7 @@ static void __init st_of_flexgen_setup(struct device_node *np)
+ 			break;
+ 		}
+ 
++		flex_flags &= ~CLK_IS_CRITICAL;
+ 		of_clk_detect_critical(np, i, &flex_flags);
+ 
+ 		/*
+diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c
+index f2c9274b8bd5..369164f0bd0e 100644
+--- a/drivers/clk/sunxi/clk-sunxi.c
++++ b/drivers/clk/sunxi/clk-sunxi.c
+@@ -98,7 +98,7 @@ static void sun6i_a31_get_pll1_factors(struct factors_request *req)
+ 	 * Round down the frequency to the closest multiple of either
+ 	 * 6 or 16
+ 	 */
+-	u32 round_freq_6 = round_down(freq_mhz, 6);
++	u32 round_freq_6 = rounddown(freq_mhz, 6);
+ 	u32 round_freq_16 = round_down(freq_mhz, 16);
+ 
+ 	if (round_freq_6 > round_freq_16)
+diff --git a/drivers/clk/ti/composite.c b/drivers/clk/ti/composite.c
+index 1cf70f452e1e..3725b2e0c788 100644
+--- a/drivers/clk/ti/composite.c
++++ b/drivers/clk/ti/composite.c
+@@ -226,6 +226,7 @@ cleanup:
+ 		if (!cclk->comp_clks[i])
+ 			continue;
+ 		list_del(&cclk->comp_clks[i]->link);
++		kfree(cclk->comp_clks[i]->parent_names);
+ 		kfree(cclk->comp_clks[i]);
+ 	}
+ 
+diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
+index ff6ac4e824b5..e7ca922a45e1 100644
+--- a/drivers/crypto/omap-sham.c
++++ b/drivers/crypto/omap-sham.c
+@@ -167,8 +167,6 @@ struct omap_sham_hmac_ctx {
+ };
+ 
+ struct omap_sham_ctx {
+-	struct omap_sham_dev	*dd;
+-
+ 	unsigned long		flags;
+ 
+ 	/* fallback stuff */
+@@ -915,27 +913,35 @@ static int omap_sham_update_dma_stop(struct omap_sham_dev *dd)
+ 	return 0;
+ }
+ 
++struct omap_sham_dev *omap_sham_find_dev(struct omap_sham_reqctx *ctx)
++{
++	struct omap_sham_dev *dd;
++
++	if (ctx->dd)
++		return ctx->dd;
++
++	spin_lock_bh(&sham.lock);
++	dd = list_first_entry(&sham.dev_list, struct omap_sham_dev, list);
++	list_move_tail(&dd->list, &sham.dev_list);
++	ctx->dd = dd;
++	spin_unlock_bh(&sham.lock);
++
++	return dd;
++}
++
+ static int omap_sham_init(struct ahash_request *req)
+ {
+ 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+ 	struct omap_sham_ctx *tctx = crypto_ahash_ctx(tfm);
+ 	struct omap_sham_reqctx *ctx = ahash_request_ctx(req);
+-	struct omap_sham_dev *dd = NULL, *tmp;
++	struct omap_sham_dev *dd;
+ 	int bs = 0;
+ 
+-	spin_lock_bh(&sham.lock);
+-	if (!tctx->dd) {
+-		list_for_each_entry(tmp, &sham.dev_list, list) {
+-			dd = tmp;
+-			break;
+-		}
+-		tctx->dd = dd;
+-	} else {
+-		dd = tctx->dd;
+-	}
+-	spin_unlock_bh(&sham.lock);
++	ctx->dd = NULL;
+ 
+-	ctx->dd = dd;
++	dd = omap_sham_find_dev(ctx);
++	if (!dd)
++		return -ENODEV;
+ 
+ 	ctx->flags = 0;
+ 
+@@ -1185,8 +1191,7 @@ err1:
+ static int omap_sham_enqueue(struct ahash_request *req, unsigned int op)
+ {
+ 	struct omap_sham_reqctx *ctx = ahash_request_ctx(req);
+-	struct omap_sham_ctx *tctx = crypto_tfm_ctx(req->base.tfm);
+-	struct omap_sham_dev *dd = tctx->dd;
++	struct omap_sham_dev *dd = ctx->dd;
+ 
+ 	ctx->op = op;
+ 
+@@ -1196,7 +1201,7 @@ static int omap_sham_enqueue(struct ahash_request *req, unsigned int op)
+ static int omap_sham_update(struct ahash_request *req)
+ {
+ 	struct omap_sham_reqctx *ctx = ahash_request_ctx(req);
+-	struct omap_sham_dev *dd = ctx->dd;
++	struct omap_sham_dev *dd = omap_sham_find_dev(ctx);
+ 
+ 	if (!req->nbytes)
+ 		return 0;
+@@ -1301,21 +1306,8 @@ static int omap_sham_setkey(struct crypto_ahash *tfm, const u8 *key,
+ 	struct omap_sham_hmac_ctx *bctx = tctx->base;
+ 	int bs = crypto_shash_blocksize(bctx->shash);
+ 	int ds = crypto_shash_digestsize(bctx->shash);
+-	struct omap_sham_dev *dd = NULL, *tmp;
+ 	int err, i;
+ 
+-	spin_lock_bh(&sham.lock);
+-	if (!tctx->dd) {
+-		list_for_each_entry(tmp, &sham.dev_list, list) {
+-			dd = tmp;
+-			break;
+-		}
+-		tctx->dd = dd;
+-	} else {
+-		dd = tctx->dd;
+-	}
+-	spin_unlock_bh(&sham.lock);
+-
+ 	err = crypto_shash_setkey(tctx->fallback, key, keylen);
+ 	if (err)
+ 		return err;
+@@ -1333,7 +1325,7 @@ static int omap_sham_setkey(struct crypto_ahash *tfm, const u8 *key,
+ 
+ 	memset(bctx->ipad + keylen, 0, bs - keylen);
+ 
+-	if (!test_bit(FLAGS_AUTO_XOR, &dd->flags)) {
++	if (!test_bit(FLAGS_AUTO_XOR, &sham.flags)) {
+ 		memcpy(bctx->opad, bctx->ipad, bs);
+ 
+ 		for (i = 0; i < bs; i++) {
+@@ -2072,6 +2064,7 @@ static int omap_sham_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	dd->flags |= dd->pdata->flags;
++	sham.flags |= dd->pdata->flags;
+ 
+ 	pm_runtime_use_autosuspend(dev);
+ 	pm_runtime_set_autosuspend_delay(dev, DEFAULT_AUTOSUSPEND_DELAY);
+@@ -2097,6 +2090,9 @@ static int omap_sham_probe(struct platform_device *pdev)
+ 	spin_unlock(&sham.lock);
+ 
+ 	for (i = 0; i < dd->pdata->algs_info_size; i++) {
++		if (dd->pdata->algs_info[i].registered)
++			break;
++
+ 		for (j = 0; j < dd->pdata->algs_info[i].size; j++) {
+ 			struct ahash_alg *alg;
+ 
+@@ -2142,9 +2138,11 @@ static int omap_sham_remove(struct platform_device *pdev)
+ 	list_del(&dd->list);
+ 	spin_unlock(&sham.lock);
+ 	for (i = dd->pdata->algs_info_size - 1; i >= 0; i--)
+-		for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--)
++		for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--) {
+ 			crypto_unregister_ahash(
+ 					&dd->pdata->algs_info[i].algs_list[j]);
++			dd->pdata->algs_info[i].registered--;
++		}
+ 	tasklet_kill(&dd->done_task);
+ 	pm_runtime_disable(&pdev->dev);
+ 
+diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c
+index bc538708c753..cdee6d6d5453 100644
+--- a/drivers/extcon/extcon-adc-jack.c
++++ b/drivers/extcon/extcon-adc-jack.c
+@@ -128,7 +128,7 @@ static int adc_jack_probe(struct platform_device *pdev)
+ 	for (i = 0; data->adc_conditions[i].id != EXTCON_NONE; i++);
+ 	data->num_conditions = i;
+ 
+-	data->chan = iio_channel_get(&pdev->dev, pdata->consumer_channel);
++	data->chan = devm_iio_channel_get(&pdev->dev, pdata->consumer_channel);
+ 	if (IS_ERR(data->chan))
+ 		return PTR_ERR(data->chan);
+ 
+@@ -170,7 +170,6 @@ static int adc_jack_remove(struct platform_device *pdev)
+ 
+ 	free_irq(data->irq, data);
+ 	cancel_work_sync(&data->handler.work);
+-	iio_channel_release(data->chan);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c
+index 241dd7c63d2c..481b2f0a190b 100644
+--- a/drivers/firmware/efi/esrt.c
++++ b/drivers/firmware/efi/esrt.c
+@@ -180,7 +180,7 @@ static int esre_create_sysfs_entry(void *esre, int entry_num)
+ 		rc = kobject_init_and_add(&entry->kobj, &esre1_ktype, NULL,
+ 					  "entry%d", entry_num);
+ 		if (rc) {
+-			kfree(entry);
++			kobject_put(&entry->kobj);
+ 			return rc;
+ 		}
+ 	}
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 41e67e983a7f..bb70c5272fe8 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -29,6 +29,7 @@
+ #include <linux/i2c.h>
+ #include <drm/drm_dp_mst_helper.h>
+ #include <drm/drmP.h>
++#include <linux/iopoll.h>
+ 
+ #include <drm/drm_fixed.h>
+ 
+@@ -2673,6 +2674,17 @@ fail:
+ 	return ret;
+ }
+ 
++static int do_get_act_status(struct drm_dp_aux *aux)
++{
++	int ret;
++	u8 status;
++
++	ret = drm_dp_dpcd_readb(aux, DP_PAYLOAD_TABLE_UPDATE_STATUS, &status);
++	if (ret < 0)
++		return ret;
++
++	return status;
++}
+ 
+ /**
+  * drm_dp_check_act_status() - Check ACT handled status.
+@@ -2682,33 +2694,29 @@ fail:
+  */
+ int drm_dp_check_act_status(struct drm_dp_mst_topology_mgr *mgr)
+ {
+-	u8 status;
+-	int ret;
+-	int count = 0;
+-
+-	do {
+-		ret = drm_dp_dpcd_readb(mgr->aux, DP_PAYLOAD_TABLE_UPDATE_STATUS, &status);
+-
+-		if (ret < 0) {
+-			DRM_DEBUG_KMS("failed to read payload table status %d\n", ret);
+-			goto fail;
+-		}
+-
+-		if (status & DP_PAYLOAD_ACT_HANDLED)
+-			break;
+-		count++;
+-		udelay(100);
+-
+-	} while (count < 30);
+-
+-	if (!(status & DP_PAYLOAD_ACT_HANDLED)) {
+-		DRM_DEBUG_KMS("failed to get ACT bit %d after %d retries\n", status, count);
+-		ret = -EINVAL;
+-		goto fail;
++	/*
++	 * There doesn't seem to be any recommended retry count or timeout in
++	 * the MST specification. Since some hubs have been observed to take
++	 * over 1 second to update their payload allocations under certain
++	 * conditions, we use a rather large timeout value.
++	 */
++	const int timeout_ms = 3000;
++	int ret, status;
++
++	ret = readx_poll_timeout(do_get_act_status, mgr->aux, status,
++				 status & DP_PAYLOAD_ACT_HANDLED || status < 0,
++				 200, timeout_ms * USEC_PER_MSEC);
++	if (ret < 0 && status >= 0) {
++		DRM_DEBUG_KMS("Failed to get ACT after %dms, last status: %02x\n",
++			      timeout_ms, status);
++		return -EINVAL;
++	} else if (status < 0) {
++		DRM_DEBUG_KMS("Failed to read payload table status: %d\n",
++			      status);
++		return status;
+ 	}
++
+ 	return 0;
+-fail:
+-	return ret;
+ }
+ EXPORT_SYMBOL(drm_dp_check_act_status);
+ 
+diff --git a/drivers/gpu/drm/drm_encoder_slave.c b/drivers/gpu/drm/drm_encoder_slave.c
+index 4484785cd9ac..95d5a5949753 100644
+--- a/drivers/gpu/drm/drm_encoder_slave.c
++++ b/drivers/gpu/drm/drm_encoder_slave.c
+@@ -84,7 +84,7 @@ int drm_i2c_encoder_init(struct drm_device *dev,
+ 
+ 	err = encoder_drv->encoder_init(client, dev, encoder);
+ 	if (err)
+-		goto fail_unregister;
++		goto fail_module_put;
+ 
+ 	if (info->platform_data)
+ 		encoder->slave_funcs->set_config(&encoder->base,
+@@ -92,9 +92,10 @@ int drm_i2c_encoder_init(struct drm_device *dev,
+ 
+ 	return 0;
+ 
++fail_module_put:
++	module_put(module);
+ fail_unregister:
+ 	i2c_unregister_device(client);
+-	module_put(module);
+ fail:
+ 	return err;
+ }
+diff --git a/drivers/gpu/drm/i915/i915_cmd_parser.c b/drivers/gpu/drm/i915/i915_cmd_parser.c
+index 1e104518192d..8a98442d494b 100644
+--- a/drivers/gpu/drm/i915/i915_cmd_parser.c
++++ b/drivers/gpu/drm/i915/i915_cmd_parser.c
+@@ -570,6 +570,9 @@ struct drm_i915_reg_descriptor {
+ #define REG32(_reg, ...) \
+ 	{ .addr = (_reg), __VA_ARGS__ }
+ 
++#define REG32_IDX(_reg, idx) \
++	{ .addr = _reg(idx) }
++
+ /*
+  * Convenience macro for adding 64-bit registers.
+  *
+@@ -667,6 +670,7 @@ static const struct drm_i915_reg_descriptor gen9_blt_regs[] = {
+ 	REG64_IDX(RING_TIMESTAMP, BSD_RING_BASE),
+ 	REG32(BCS_SWCTRL),
+ 	REG64_IDX(RING_TIMESTAMP, BLT_RING_BASE),
++	REG32_IDX(RING_CTX_TIMESTAMP, BLT_RING_BASE),
+ 	REG64_IDX(BCS_GPR, 0),
+ 	REG64_IDX(BCS_GPR, 1),
+ 	REG64_IDX(BCS_GPR, 2),
+diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
+index ed7143d35b25..6224aca7cd29 100644
+--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
++++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
+@@ -769,7 +769,8 @@ static int mdp5_init(struct platform_device *pdev, struct drm_device *dev)
+ 
+ 	return 0;
+ fail:
+-	mdp5_destroy(pdev);
++	if (mdp5_kms)
++		mdp5_destroy(pdev);
+ 	return ret;
+ }
+ 
+diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c
+index e642242728c0..a886652ed895 100644
+--- a/drivers/gpu/drm/qxl/qxl_kms.c
++++ b/drivers/gpu/drm/qxl/qxl_kms.c
+@@ -199,7 +199,7 @@ static int qxl_device_init(struct qxl_device *qdev,
+ 				&(qdev->ram_header->cursor_ring_hdr),
+ 				sizeof(struct qxl_command),
+ 				QXL_CURSOR_RING_SIZE,
+-				qdev->io_base + QXL_IO_NOTIFY_CMD,
++				qdev->io_base + QXL_IO_NOTIFY_CURSOR,
+ 				false,
+ 				&qdev->cursor_event);
+ 
+diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
+index 4a601f990562..a32cf6dbd3ee 100644
+--- a/drivers/gpu/drm/radeon/ni_dpm.c
++++ b/drivers/gpu/drm/radeon/ni_dpm.c
+@@ -2126,7 +2126,7 @@ static int ni_init_smc_spll_table(struct radeon_device *rdev)
+ 		if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT))
+ 			ret = -EINVAL;
+ 
+-		if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT))
++		if (fb_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_SHIFT))
+ 			ret = -EINVAL;
+ 
+ 		if (clk_v & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKV_SHIFT))
+diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
+index 62785aa76b3f..8324d2729088 100644
+--- a/drivers/i2c/busses/i2c-piix4.c
++++ b/drivers/i2c/busses/i2c-piix4.c
+@@ -840,7 +840,8 @@ static int piix4_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 	}
+ 
+ 	if (dev->vendor == PCI_VENDOR_ID_AMD &&
+-	    dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) {
++	    (dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS ||
++	     dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)) {
+ 		retval = piix4_setup_sb800(dev, id, 1);
+ 	}
+ 
+diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
+index e28b825b0433..fb191ad8fc3a 100644
+--- a/drivers/i2c/busses/i2c-pxa.c
++++ b/drivers/i2c/busses/i2c-pxa.c
+@@ -297,11 +297,10 @@ static void i2c_pxa_scream_blue_murder(struct pxa_i2c *i2c, const char *why)
+ 	dev_err(dev, "IBMR: %08x IDBR: %08x ICR: %08x ISR: %08x\n",
+ 		readl(_IBMR(i2c)), readl(_IDBR(i2c)), readl(_ICR(i2c)),
+ 		readl(_ISR(i2c)));
+-	dev_dbg(dev, "log: ");
++	dev_err(dev, "log:");
+ 	for (i = 0; i < i2c->irqlogidx; i++)
+-		pr_debug("[%08x:%08x] ", i2c->isrlog[i], i2c->icrlog[i]);
+-
+-	pr_debug("\n");
++		pr_cont(" [%03x:%05x]", i2c->isrlog[i], i2c->icrlog[i]);
++	pr_cont("\n");
+ }
+ 
+ #else /* ifdef DEBUG */
+@@ -691,11 +690,9 @@ static inline void i2c_pxa_stop_message(struct pxa_i2c *i2c)
+ {
+ 	u32 icr;
+ 
+-	/*
+-	 * Clear the STOP and ACK flags
+-	 */
++	/* Clear the START, STOP, ACK, TB and MA flags */
+ 	icr = readl(_ICR(i2c));
+-	icr &= ~(ICR_STOP | ICR_ACKNAK);
++	icr &= ~(ICR_START | ICR_STOP | ICR_ACKNAK | ICR_TB | ICR_MA);
+ 	writel(icr, _ICR(i2c));
+ }
+ 
+diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
+index c9263acc190b..85b90b5939db 100644
+--- a/drivers/iio/pressure/bmp280-core.c
++++ b/drivers/iio/pressure/bmp280-core.c
+@@ -182,6 +182,8 @@ static u32 bmp280_compensate_humidity(struct bmp280_data *data,
+ 		+ (s32)2097152) * H2 + 8192) >> 14);
+ 	var -= ((((var >> 15) * (var >> 15)) >> 7) * (s32)H1) >> 4;
+ 
++	var = clamp_val(var, 0, 419430400);
++
+ 	return var >> 12;
+ };
+ 
+@@ -630,7 +632,7 @@ static int bmp180_measure(struct bmp280_data *data, u8 ctrl_meas)
+ 	unsigned int ctrl;
+ 
+ 	if (data->use_eoc)
+-		init_completion(&data->done);
++		reinit_completion(&data->done);
+ 
+ 	ret = regmap_write(data->regmap, BMP280_REG_CTRL_MEAS, ctrl_meas);
+ 	if (ret)
+@@ -886,6 +888,9 @@ static int bmp085_fetch_eoc_irq(struct device *dev,
+ 			"trying to enforce it\n");
+ 		irq_trig = IRQF_TRIGGER_RISING;
+ 	}
++
++	init_completion(&data->done);
++
+ 	ret = devm_request_threaded_irq(dev,
+ 			irq,
+ 			bmp085_eoc_irq,
+diff --git a/drivers/infiniband/core/cma_configfs.c b/drivers/infiniband/core/cma_configfs.c
+index 41573df1d9fc..692fc42255c9 100644
+--- a/drivers/infiniband/core/cma_configfs.c
++++ b/drivers/infiniband/core/cma_configfs.c
+@@ -277,8 +277,21 @@ fail:
+ 	return ERR_PTR(err);
+ }
+ 
++static void drop_cma_dev(struct config_group *cgroup, struct config_item *item)
++{
++	struct config_group *group =
++		container_of(item, struct config_group, cg_item);
++	struct cma_dev_group *cma_dev_group =
++		container_of(group, struct cma_dev_group, device_group);
++
++	configfs_remove_default_groups(&cma_dev_group->ports_group);
++	configfs_remove_default_groups(&cma_dev_group->device_group);
++	config_item_put(item);
++}
++
+ static struct configfs_group_operations cma_subsys_group_ops = {
+ 	.make_group	= make_cma_dev,
++	.drop_item	= drop_cma_dev,
+ };
+ 
+ static struct config_item_type cma_subsys_type = {
+diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
+index a1f059a9c751..f03e10517acc 100644
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -2885,6 +2885,7 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
+ 						 DMA_FROM_DEVICE);
+ 		if (unlikely(ib_dma_mapping_error(qp_info->port_priv->device,
+ 						  sg_list.addr))) {
++			kfree(mad_priv);
+ 			ret = -ENOMEM;
+ 			break;
+ 		}
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index c8c5e3368b8b..12849829077d 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -1370,7 +1370,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op,
+ 			if (__set_blocks(n1, n1->keys + n2->keys,
+ 					 block_bytes(b->c)) >
+ 			    btree_blocks(new_nodes[i]))
+-				goto out_nocoalesce;
++				goto out_unlock_nocoalesce;
+ 
+ 			keys = n2->keys;
+ 			/* Take the key of the node we're getting rid of */
+@@ -1399,7 +1399,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op,
+ 
+ 		if (__bch_keylist_realloc(&keylist,
+ 					  bkey_u64s(&new_nodes[i]->key)))
+-			goto out_nocoalesce;
++			goto out_unlock_nocoalesce;
+ 
+ 		bch_btree_node_write(new_nodes[i], &cl);
+ 		bch_keylist_add(&keylist, &new_nodes[i]->key);
+@@ -1445,6 +1445,10 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op,
+ 	/* Invalidated our iterator */
+ 	return -EINTR;
+ 
++out_unlock_nocoalesce:
++	for (i = 0; i < nodes; i++)
++		mutex_unlock(&new_nodes[i]->write_lock);
++
+ out_nocoalesce:
+ 	closure_sync(&cl);
+ 	bch_keylist_free(&keylist);
+diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
+index 372057cabea4..cd45b3894661 100644
+--- a/drivers/media/dvb-core/dvb_frontend.c
++++ b/drivers/media/dvb-core/dvb_frontend.c
+@@ -41,6 +41,7 @@
+ #include <linux/jiffies.h>
+ #include <linux/kthread.h>
+ #include <linux/ktime.h>
++#include <linux/compat.h>
+ #include <asm/processor.h>
+ 
+ #include "dvb_frontend.h"
+@@ -458,7 +459,7 @@ static int dvb_frontend_swzigzag_autotune(struct dvb_frontend *fe, int check_wra
+ 
+ static void dvb_frontend_swzigzag(struct dvb_frontend *fe)
+ {
+-	enum fe_status s = 0;
++	enum fe_status s = FE_NONE;
+ 	int retval = 0;
+ 	struct dvb_frontend_private *fepriv = fe->frontend_priv;
+ 	struct dtv_frontend_properties *c = &fe->dtv_property_cache, tmp;
+@@ -932,8 +933,6 @@ static int dvb_frontend_clear_cache(struct dvb_frontend *fe)
+ 	memset(c, 0, offsetof(struct dtv_frontend_properties, strength));
+ 	c->delivery_system = delsys;
+ 
+-	c->state = DTV_CLEAR;
+-
+ 	dev_dbg(fe->dvb->device, "%s: Clearing cache for delivery system %d\n",
+ 			__func__, c->delivery_system);
+ 
+@@ -998,6 +997,17 @@ static int dvb_frontend_clear_cache(struct dvb_frontend *fe)
+ 	.buffer = b \
+ }
+ 
++struct dtv_cmds_h {
++	char	*name;		/* A display name for debugging purposes */
++
++	__u32	cmd;		/* A unique ID */
++
++	/* Flags */
++	__u32	set:1;		/* Either a set or get property */
++	__u32	buffer:1;	/* Does this property use the buffer? */
++	__u32	reserved:30;	/* Align */
++};
++
+ static struct dtv_cmds_h dtv_cmds[DTV_MAX_COMMAND + 1] = {
+ 	_DTV_CMD(DTV_TUNE, 1, 0),
+ 	_DTV_CMD(DTV_CLEAR, 1, 0),
+@@ -1079,22 +1089,19 @@ static struct dtv_cmds_h dtv_cmds[DTV_MAX_COMMAND + 1] = {
+ 	_DTV_CMD(DTV_STAT_TOTAL_BLOCK_COUNT, 0, 0),
+ };
+ 
+-static void dtv_property_dump(struct dvb_frontend *fe,
+-			      bool is_set,
++static void dtv_get_property_dump(struct dvb_frontend *fe,
+ 			      struct dtv_property *tvp)
+ {
+ 	int i;
+ 
+ 	if (tvp->cmd <= 0 || tvp->cmd > DTV_MAX_COMMAND) {
+-		dev_warn(fe->dvb->device, "%s: %s tvp.cmd = 0x%08x undefined\n",
+-				__func__,
+-				is_set ? "SET" : "GET",
++		dev_warn(fe->dvb->device, "%s: GET tvp.cmd = 0x%08x undefined\n"
++				, __func__,
+ 				tvp->cmd);
+ 		return;
+ 	}
+ 
+-	dev_dbg(fe->dvb->device, "%s: %s tvp.cmd    = 0x%08x (%s)\n", __func__,
+-		is_set ? "SET" : "GET",
++	dev_dbg(fe->dvb->device, "%s: GET tvp.cmd    = 0x%08x (%s)\n", __func__,
+ 		tvp->cmd,
+ 		dtv_cmds[tvp->cmd].name);
+ 
+@@ -1285,17 +1292,15 @@ static int dtv_get_frontend(struct dvb_frontend *fe,
+ 	return 0;
+ }
+ 
+-static int dvb_frontend_ioctl_legacy(struct file *file,
+-			unsigned int cmd, void *parg);
+-static int dvb_frontend_ioctl_properties(struct file *file,
+-			unsigned int cmd, void *parg);
++static int dvb_frontend_handle_ioctl(struct file *file,
++				     unsigned int cmd, void *parg);
+ 
+ static int dtv_property_process_get(struct dvb_frontend *fe,
+ 				    const struct dtv_frontend_properties *c,
+ 				    struct dtv_property *tvp,
+ 				    struct file *file)
+ {
+-	int r, ncaps;
++	int ncaps;
+ 
+ 	switch(tvp->cmd) {
+ 	case DTV_ENUM_DELSYS:
+@@ -1506,14 +1511,7 @@ static int dtv_property_process_get(struct dvb_frontend *fe,
+ 		return -EINVAL;
+ 	}
+ 
+-	/* Allow the frontend to override outgoing properties */
+-	if (fe->ops.get_property) {
+-		r = fe->ops.get_property(fe, tvp);
+-		if (r < 0)
+-			return r;
+-	}
+-
+-	dtv_property_dump(fe, false, tvp);
++	dtv_get_property_dump(fe, tvp);
+ 
+ 	return 0;
+ }
+@@ -1740,23 +1738,36 @@ static int dvbv3_set_delivery_system(struct dvb_frontend *fe)
+ 	return emulate_delivery_system(fe, delsys);
+ }
+ 
++/**
++ * dtv_property_process_set -  Sets a single DTV property
++ * @fe:		Pointer to &struct dvb_frontend
++ * @file:	Pointer to &struct file
++ * @cmd:	Digital TV command
++ * @data:	An unsigned 32-bits number
++ *
++ * This routine assigns the property
++ * value to the corresponding member of
++ * &struct dtv_frontend_properties
++ *
++ * Returns:
++ * Zero on success, negative errno on failure.
++ */
+ static int dtv_property_process_set(struct dvb_frontend *fe,
+-				    struct dtv_property *tvp,
+-				    struct file *file)
++					struct file *file,
++					u32 cmd, u32 data)
+ {
+ 	int r = 0;
+ 	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+ 
+-	/* Allow the frontend to validate incoming properties */
+-	if (fe->ops.set_property) {
+-		r = fe->ops.set_property(fe, tvp);
+-		if (r < 0)
+-			return r;
+-	}
+-
+-	dtv_property_dump(fe, true, tvp);
+-
+-	switch(tvp->cmd) {
++	/** Dump DTV command name and value*/
++	if (!cmd || cmd > DTV_MAX_COMMAND)
++		dev_warn(fe->dvb->device, "%s: SET cmd 0x%08x undefined\n",
++				 __func__, cmd);
++	else
++		dev_dbg(fe->dvb->device,
++				"%s: SET cmd 0x%08x (%s) to 0x%08x\n",
++				__func__, cmd, dtv_cmds[cmd].name, data);
++	switch (cmd) {
+ 	case DTV_CLEAR:
+ 		/*
+ 		 * Reset a cache of data specific to the frontend here. This does
+@@ -1765,144 +1776,144 @@ static int dtv_property_process_set(struct dvb_frontend *fe,
+ 		dvb_frontend_clear_cache(fe);
+ 		break;
+ 	case DTV_TUNE:
+-		/* interpret the cache of data, build either a traditional frontend
+-		 * tunerequest so we can pass validation in the FE_SET_FRONTEND
+-		 * ioctl.
++		/*
++		 * Use the cached Digital TV properties to tune the
++		 * frontend
+ 		 */
+-		c->state = tvp->cmd;
+-		dev_dbg(fe->dvb->device, "%s: Finalised property cache\n",
+-				__func__);
++		dev_dbg(fe->dvb->device,
++			"%s: Setting the frontend from property cache\n",
++			__func__);
+ 
+ 		r = dtv_set_frontend(fe);
+ 		break;
+ 	case DTV_FREQUENCY:
+-		c->frequency = tvp->u.data;
++		c->frequency = data;
+ 		break;
+ 	case DTV_MODULATION:
+-		c->modulation = tvp->u.data;
++		c->modulation = data;
+ 		break;
+ 	case DTV_BANDWIDTH_HZ:
+-		c->bandwidth_hz = tvp->u.data;
++		c->bandwidth_hz = data;
+ 		break;
+ 	case DTV_INVERSION:
+-		c->inversion = tvp->u.data;
++		c->inversion = data;
+ 		break;
+ 	case DTV_SYMBOL_RATE:
+-		c->symbol_rate = tvp->u.data;
++		c->symbol_rate = data;
+ 		break;
+ 	case DTV_INNER_FEC:
+-		c->fec_inner = tvp->u.data;
++		c->fec_inner = data;
+ 		break;
+ 	case DTV_PILOT:
+-		c->pilot = tvp->u.data;
++		c->pilot = data;
+ 		break;
+ 	case DTV_ROLLOFF:
+-		c->rolloff = tvp->u.data;
++		c->rolloff = data;
+ 		break;
+ 	case DTV_DELIVERY_SYSTEM:
+-		r = dvbv5_set_delivery_system(fe, tvp->u.data);
++		r = dvbv5_set_delivery_system(fe, data);
+ 		break;
+ 	case DTV_VOLTAGE:
+-		c->voltage = tvp->u.data;
+-		r = dvb_frontend_ioctl_legacy(file, FE_SET_VOLTAGE,
++		c->voltage = data;
++		r = dvb_frontend_handle_ioctl(file, FE_SET_VOLTAGE,
+ 			(void *)c->voltage);
+ 		break;
+ 	case DTV_TONE:
+-		c->sectone = tvp->u.data;
+-		r = dvb_frontend_ioctl_legacy(file, FE_SET_TONE,
++		c->sectone = data;
++		r = dvb_frontend_handle_ioctl(file, FE_SET_TONE,
+ 			(void *)c->sectone);
+ 		break;
+ 	case DTV_CODE_RATE_HP:
+-		c->code_rate_HP = tvp->u.data;
++		c->code_rate_HP = data;
+ 		break;
+ 	case DTV_CODE_RATE_LP:
+-		c->code_rate_LP = tvp->u.data;
++		c->code_rate_LP = data;
+ 		break;
+ 	case DTV_GUARD_INTERVAL:
+-		c->guard_interval = tvp->u.data;
++		c->guard_interval = data;
+ 		break;
+ 	case DTV_TRANSMISSION_MODE:
+-		c->transmission_mode = tvp->u.data;
++		c->transmission_mode = data;
+ 		break;
+ 	case DTV_HIERARCHY:
+-		c->hierarchy = tvp->u.data;
++		c->hierarchy = data;
+ 		break;
+ 	case DTV_INTERLEAVING:
+-		c->interleaving = tvp->u.data;
++		c->interleaving = data;
+ 		break;
+ 
+ 	/* ISDB-T Support here */
+ 	case DTV_ISDBT_PARTIAL_RECEPTION:
+-		c->isdbt_partial_reception = tvp->u.data;
++		c->isdbt_partial_reception = data;
+ 		break;
+ 	case DTV_ISDBT_SOUND_BROADCASTING:
+-		c->isdbt_sb_mode = tvp->u.data;
++		c->isdbt_sb_mode = data;
+ 		break;
+ 	case DTV_ISDBT_SB_SUBCHANNEL_ID:
+-		c->isdbt_sb_subchannel = tvp->u.data;
++		c->isdbt_sb_subchannel = data;
+ 		break;
+ 	case DTV_ISDBT_SB_SEGMENT_IDX:
+-		c->isdbt_sb_segment_idx = tvp->u.data;
++		c->isdbt_sb_segment_idx = data;
+ 		break;
+ 	case DTV_ISDBT_SB_SEGMENT_COUNT:
+-		c->isdbt_sb_segment_count = tvp->u.data;
++		c->isdbt_sb_segment_count = data;
+ 		break;
+ 	case DTV_ISDBT_LAYER_ENABLED:
+-		c->isdbt_layer_enabled = tvp->u.data;
++		c->isdbt_layer_enabled = data;
+ 		break;
+ 	case DTV_ISDBT_LAYERA_FEC:
+-		c->layer[0].fec = tvp->u.data;
++		c->layer[0].fec = data;
+ 		break;
+ 	case DTV_ISDBT_LAYERA_MODULATION:
+-		c->layer[0].modulation = tvp->u.data;
++		c->layer[0].modulation = data;
+ 		break;
+ 	case DTV_ISDBT_LAYERA_SEGMENT_COUNT:
+-		c->layer[0].segment_count = tvp->u.data;
++		c->layer[0].segment_count = data;
+ 		break;
+ 	case DTV_ISDBT_LAYERA_TIME_INTERLEAVING:
+-		c->layer[0].interleaving = tvp->u.data;
++		c->layer[0].interleaving = data;
+ 		break;
+ 	case DTV_ISDBT_LAYERB_FEC:
+-		c->layer[1].fec = tvp->u.data;
++		c->layer[1].fec = data;
+ 		break;
+ 	case DTV_ISDBT_LAYERB_MODULATION:
+-		c->layer[1].modulation = tvp->u.data;
++		c->layer[1].modulation = data;
+ 		break;
+ 	case DTV_ISDBT_LAYERB_SEGMENT_COUNT:
+-		c->layer[1].segment_count = tvp->u.data;
++		c->layer[1].segment_count = data;
+ 		break;
+ 	case DTV_ISDBT_LAYERB_TIME_INTERLEAVING:
+-		c->layer[1].interleaving = tvp->u.data;
++		c->layer[1].interleaving = data;
+ 		break;
+ 	case DTV_ISDBT_LAYERC_FEC:
+-		c->layer[2].fec = tvp->u.data;
++		c->layer[2].fec = data;
+ 		break;
+ 	case DTV_ISDBT_LAYERC_MODULATION:
+-		c->layer[2].modulation = tvp->u.data;
++		c->layer[2].modulation = data;
+ 		break;
+ 	case DTV_ISDBT_LAYERC_SEGMENT_COUNT:
+-		c->layer[2].segment_count = tvp->u.data;
++		c->layer[2].segment_count = data;
+ 		break;
+ 	case DTV_ISDBT_LAYERC_TIME_INTERLEAVING:
+-		c->layer[2].interleaving = tvp->u.data;
++		c->layer[2].interleaving = data;
+ 		break;
+ 
+ 	/* Multistream support */
+ 	case DTV_STREAM_ID:
+ 	case DTV_DVBT2_PLP_ID_LEGACY:
+-		c->stream_id = tvp->u.data;
++		c->stream_id = data;
+ 		break;
+ 
+ 	/* ATSC-MH */
+ 	case DTV_ATSCMH_PARADE_ID:
+-		fe->dtv_property_cache.atscmh_parade_id = tvp->u.data;
++		fe->dtv_property_cache.atscmh_parade_id = data;
+ 		break;
+ 	case DTV_ATSCMH_RS_FRAME_ENSEMBLE:
+-		fe->dtv_property_cache.atscmh_rs_frame_ensemble = tvp->u.data;
++		fe->dtv_property_cache.atscmh_rs_frame_ensemble = data;
+ 		break;
+ 
+ 	case DTV_LNA:
+-		c->lna = tvp->u.data;
++		c->lna = data;
+ 		if (fe->ops.set_lna)
+ 			r = fe->ops.set_lna(fe);
+ 		if (r < 0)
+@@ -1916,14 +1927,13 @@ static int dtv_property_process_set(struct dvb_frontend *fe,
+ 	return r;
+ }
+ 
+-static int dvb_frontend_ioctl(struct file *file,
+-			unsigned int cmd, void *parg)
++static int dvb_frontend_do_ioctl(struct file *file, unsigned int cmd,
++				 void *parg)
+ {
+ 	struct dvb_device *dvbdev = file->private_data;
+ 	struct dvb_frontend *fe = dvbdev->priv;
+-	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+ 	struct dvb_frontend_private *fepriv = fe->frontend_priv;
+-	int err = -EOPNOTSUPP;
++	int err;
+ 
+ 	dev_dbg(fe->dvb->device, "%s: (%d)\n", __func__, _IOC_NR(cmd));
+ 	if (down_interruptible(&fepriv->sem))
+@@ -1934,74 +1944,125 @@ static int dvb_frontend_ioctl(struct file *file,
+ 		return -ENODEV;
+ 	}
+ 
+-	if ((file->f_flags & O_ACCMODE) == O_RDONLY &&
+-	    (_IOC_DIR(cmd) != _IOC_READ || cmd == FE_GET_EVENT ||
+-	     cmd == FE_DISEQC_RECV_SLAVE_REPLY)) {
++	/*
++	 * If the frontend is opened in read-only mode, only the ioctls
++	 * that don't interfere with the tune logic should be accepted.
++	 * That allows an external application to monitor the DVB QoS and
++	 * statistics parameters.
++	 *
++	 * That matches all _IOR() ioctls, except for two special cases:
++	 *   - FE_GET_EVENT is part of the tuning logic on a DVB application;
++	 *   - FE_DISEQC_RECV_SLAVE_REPLY is part of DiSEqC 2.0
++	 *     setup
++	 * So, those two ioctls should also return -EPERM, as otherwise
++	 * reading from them would interfere with a DVB tune application
++	 */
++	if ((file->f_flags & O_ACCMODE) == O_RDONLY
++	    && (_IOC_DIR(cmd) != _IOC_READ
++		|| cmd == FE_GET_EVENT
++		|| cmd == FE_DISEQC_RECV_SLAVE_REPLY)) {
+ 		up(&fepriv->sem);
+ 		return -EPERM;
+ 	}
+ 
+-	if ((cmd == FE_SET_PROPERTY) || (cmd == FE_GET_PROPERTY))
+-		err = dvb_frontend_ioctl_properties(file, cmd, parg);
+-	else {
+-		c->state = DTV_UNDEFINED;
+-		err = dvb_frontend_ioctl_legacy(file, cmd, parg);
+-	}
++	err = dvb_frontend_handle_ioctl(file, cmd, parg);
+ 
+ 	up(&fepriv->sem);
+ 	return err;
+ }
+ 
+-static int dvb_frontend_ioctl_properties(struct file *file,
+-			unsigned int cmd, void *parg)
++static long dvb_frontend_ioctl(struct file *file, unsigned int cmd,
++			       unsigned long arg)
++{
++	struct dvb_device *dvbdev = file->private_data;
++
++	if (!dvbdev)
++		return -ENODEV;
++
++	return dvb_usercopy(file, cmd, arg, dvb_frontend_do_ioctl);
++}
++
++#ifdef CONFIG_COMPAT
++struct compat_dtv_property {
++	__u32 cmd;
++	__u32 reserved[3];
++	union {
++		__u32 data;
++		struct dtv_fe_stats st;
++		struct {
++			__u8 data[32];
++			__u32 len;
++			__u32 reserved1[3];
++			compat_uptr_t reserved2;
++		} buffer;
++	} u;
++	int result;
++} __attribute__ ((packed));
++
++struct compat_dtv_properties {
++	__u32 num;
++	compat_uptr_t props;
++};
++
++#define COMPAT_FE_SET_PROPERTY	   _IOW('o', 82, struct compat_dtv_properties)
++#define COMPAT_FE_GET_PROPERTY	   _IOR('o', 83, struct compat_dtv_properties)
++
++static int dvb_frontend_handle_compat_ioctl(struct file *file, unsigned int cmd,
++					    unsigned long arg)
+ {
+ 	struct dvb_device *dvbdev = file->private_data;
+ 	struct dvb_frontend *fe = dvbdev->priv;
+ 	struct dvb_frontend_private *fepriv = fe->frontend_priv;
+-	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+-	int err = 0;
++	int i, err = 0;
+ 
+-	struct dtv_properties *tvps = parg;
+-	struct dtv_property *tvp = NULL;
+-	int i;
++	if (cmd == COMPAT_FE_SET_PROPERTY) {
++		struct compat_dtv_properties prop, *tvps = NULL;
++		struct compat_dtv_property *tvp = NULL;
+ 
+-	dev_dbg(fe->dvb->device, "%s:\n", __func__);
++		if (copy_from_user(&prop, compat_ptr(arg), sizeof(prop)))
++			return -EFAULT;
+ 
+-	if (cmd == FE_SET_PROPERTY) {
+-		dev_dbg(fe->dvb->device, "%s: properties.num = %d\n", __func__, tvps->num);
+-		dev_dbg(fe->dvb->device, "%s: properties.props = %p\n", __func__, tvps->props);
++		tvps = &prop;
+ 
+-		/* Put an arbitrary limit on the number of messages that can
+-		 * be sent at once */
+-		if ((tvps->num == 0) || (tvps->num > DTV_IOCTL_MAX_MSGS))
++		/*
++		 * Put an arbitrary limit on the number of messages that can
++		 * be sent at once
++		 */
++		if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS))
+ 			return -EINVAL;
+ 
+-		tvp = memdup_user(tvps->props, tvps->num * sizeof(*tvp));
++		tvp = memdup_user(compat_ptr(tvps->props), tvps->num * sizeof(*tvp));
+ 		if (IS_ERR(tvp))
+ 			return PTR_ERR(tvp);
+ 
+ 		for (i = 0; i < tvps->num; i++) {
+-			err = dtv_property_process_set(fe, tvp + i, file);
+-			if (err < 0)
+-				goto out;
+-			(tvp + i)->result = err;
++			err = dtv_property_process_set(fe, file,
++							(tvp + i)->cmd,
++							(tvp + i)->u.data);
++			if (err < 0) {
++				kfree(tvp);
++				return err;
++			}
+ 		}
+-
+-		if (c->state == DTV_TUNE)
+-			dev_dbg(fe->dvb->device, "%s: Property cache is full, tuning\n", __func__);
+-
+-	} else if (cmd == FE_GET_PROPERTY) {
++		kfree(tvp);
++	} else if (cmd == COMPAT_FE_GET_PROPERTY) {
++		struct compat_dtv_properties prop, *tvps = NULL;
++		struct compat_dtv_property *tvp = NULL;
+ 		struct dtv_frontend_properties getp = fe->dtv_property_cache;
+ 
+-		dev_dbg(fe->dvb->device, "%s: properties.num = %d\n", __func__, tvps->num);
+-		dev_dbg(fe->dvb->device, "%s: properties.props = %p\n", __func__, tvps->props);
++		if (copy_from_user(&prop, compat_ptr(arg), sizeof(prop)))
++			return -EFAULT;
+ 
+-		/* Put an arbitrary limit on the number of messages that can
+-		 * be sent at once */
+-		if ((tvps->num == 0) || (tvps->num > DTV_IOCTL_MAX_MSGS))
++		tvps = &prop;
++
++		/*
++		 * Put an arbitrary limit on the number of messages that can
++		 * be sent at once
++		 */
++		if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS))
+ 			return -EINVAL;
+ 
+-		tvp = memdup_user(tvps->props, tvps->num * sizeof(*tvp));
++		tvp = memdup_user(compat_ptr(tvps->props), tvps->num * sizeof(*tvp));
+ 		if (IS_ERR(tvp))
+ 			return PTR_ERR(tvp);
+ 
+@@ -2013,30 +2074,53 @@ static int dvb_frontend_ioctl_properties(struct file *file,
+ 		 */
+ 		if (fepriv->state != FESTATE_IDLE) {
+ 			err = dtv_get_frontend(fe, &getp, NULL);
+-			if (err < 0)
+-				goto out;
++			if (err < 0) {
++				kfree(tvp);
++				return err;
++			}
+ 		}
+ 		for (i = 0; i < tvps->num; i++) {
+-			err = dtv_property_process_get(fe, &getp, tvp + i, file);
+-			if (err < 0)
+-				goto out;
+-			(tvp + i)->result = err;
++			err = dtv_property_process_get(
++			    fe, &getp, (struct dtv_property *)(tvp + i), file);
++			if (err < 0) {
++				kfree(tvp);
++				return err;
++			}
+ 		}
+ 
+-		if (copy_to_user((void __user *)tvps->props, tvp,
+-				 tvps->num * sizeof(struct dtv_property))) {
+-			err = -EFAULT;
+-			goto out;
++		if (copy_to_user((void __user *)compat_ptr(tvps->props), tvp,
++				 tvps->num * sizeof(struct compat_dtv_property))) {
++			kfree(tvp);
++			return -EFAULT;
+ 		}
++		kfree(tvp);
++	}
+ 
+-	} else
+-		err = -EOPNOTSUPP;
+-
+-out:
+-	kfree(tvp);
+ 	return err;
+ }
+ 
++static long dvb_frontend_compat_ioctl(struct file *file, unsigned int cmd,
++				      unsigned long arg)
++{
++	struct dvb_device *dvbdev = file->private_data;
++	struct dvb_frontend *fe = dvbdev->priv;
++	struct dvb_frontend_private *fepriv = fe->frontend_priv;
++	int err;
++
++	if (cmd == COMPAT_FE_SET_PROPERTY || cmd == COMPAT_FE_GET_PROPERTY) {
++		if (down_interruptible(&fepriv->sem))
++			return -ERESTARTSYS;
++
++		err = dvb_frontend_handle_compat_ioctl(file, cmd, arg);
++
++		up(&fepriv->sem);
++		return err;
++	}
++
++	return dvb_frontend_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
++}
++#endif
++
+ static int dtv_set_frontend(struct dvb_frontend *fe)
+ {
+ 	struct dvb_frontend_private *fepriv = fe->frontend_priv;
+@@ -2174,16 +2258,103 @@ static int dtv_set_frontend(struct dvb_frontend *fe)
+ }
+ 
+ 
+-static int dvb_frontend_ioctl_legacy(struct file *file,
+-			unsigned int cmd, void *parg)
++static int dvb_frontend_handle_ioctl(struct file *file,
++				     unsigned int cmd, void *parg)
+ {
+ 	struct dvb_device *dvbdev = file->private_data;
+ 	struct dvb_frontend *fe = dvbdev->priv;
+ 	struct dvb_frontend_private *fepriv = fe->frontend_priv;
+ 	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+-	int err = -EOPNOTSUPP;
++	int i, err = -ENOTSUPP;
++
++	dev_dbg(fe->dvb->device, "%s:\n", __func__);
++
++	switch(cmd) {
++	case FE_SET_PROPERTY: {
++		struct dtv_properties *tvps = parg;
++		struct dtv_property *tvp = NULL;
++
++		dev_dbg(fe->dvb->device, "%s: properties.num = %d\n",
++			__func__, tvps->num);
++		dev_dbg(fe->dvb->device, "%s: properties.props = %p\n",
++			__func__, tvps->props);
++
++		/*
++		 * Put an arbitrary limit on the number of messages that can
++		 * be sent at once
++		 */
++		if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS))
++			return -EINVAL;
++
++		tvp = memdup_user(tvps->props, tvps->num * sizeof(*tvp));
++		if (IS_ERR(tvp))
++			return PTR_ERR(tvp);
++
++		for (i = 0; i < tvps->num; i++) {
++			err = dtv_property_process_set(fe, file,
++							(tvp + i)->cmd,
++							(tvp + i)->u.data);
++			if (err < 0) {
++				kfree(tvp);
++				return err;
++			}
++		}
++		kfree(tvp);
++		err = 0;
++		break;
++	}
++	case FE_GET_PROPERTY: {
++		struct dtv_properties *tvps = parg;
++		struct dtv_property *tvp = NULL;
++		struct dtv_frontend_properties getp = fe->dtv_property_cache;
++
++		dev_dbg(fe->dvb->device, "%s: properties.num = %d\n",
++			__func__, tvps->num);
++		dev_dbg(fe->dvb->device, "%s: properties.props = %p\n",
++			__func__, tvps->props);
++
++		/*
++		 * Put an arbitrary limit on the number of messages that can
++		 * be sent at once
++		 */
++		if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS))
++			return -EINVAL;
++
++		tvp = memdup_user(tvps->props, tvps->num * sizeof(*tvp));
++		if (IS_ERR(tvp))
++			return PTR_ERR(tvp);
++
++		/*
++		 * Let's use our own copy of property cache, in order to
++		 * avoid mangling with DTV zigzag logic, as drivers might
++		 * return crap, if they don't check if the data is available
++		 * before updating the properties cache.
++		 */
++		if (fepriv->state != FESTATE_IDLE) {
++			err = dtv_get_frontend(fe, &getp, NULL);
++			if (err < 0) {
++				kfree(tvp);
++				return err;
++			}
++		}
++		for (i = 0; i < tvps->num; i++) {
++			err = dtv_property_process_get(fe, &getp, tvp + i, file);
++			if (err < 0) {
++				kfree(tvp);
++				return err;
++			}
++		}
++
++		if (copy_to_user((void __user *)tvps->props, tvp,
++				 tvps->num * sizeof(struct dtv_property))) {
++			kfree(tvp);
++			return -EFAULT;
++		}
++		kfree(tvp);
++		err = 0;
++		break;
++	}
+ 
+-	switch (cmd) {
+ 	case FE_GET_INFO: {
+ 		struct dvb_frontend_info* info = parg;
+ 
+@@ -2247,42 +2418,6 @@ static int dvb_frontend_ioctl_legacy(struct file *file,
+ 		break;
+ 	}
+ 
+-	case FE_READ_BER:
+-		if (fe->ops.read_ber) {
+-			if (fepriv->thread)
+-				err = fe->ops.read_ber(fe, (__u32 *) parg);
+-			else
+-				err = -EAGAIN;
+-		}
+-		break;
+-
+-	case FE_READ_SIGNAL_STRENGTH:
+-		if (fe->ops.read_signal_strength) {
+-			if (fepriv->thread)
+-				err = fe->ops.read_signal_strength(fe, (__u16 *) parg);
+-			else
+-				err = -EAGAIN;
+-		}
+-		break;
+-
+-	case FE_READ_SNR:
+-		if (fe->ops.read_snr) {
+-			if (fepriv->thread)
+-				err = fe->ops.read_snr(fe, (__u16 *) parg);
+-			else
+-				err = -EAGAIN;
+-		}
+-		break;
+-
+-	case FE_READ_UNCORRECTED_BLOCKS:
+-		if (fe->ops.read_ucblocks) {
+-			if (fepriv->thread)
+-				err = fe->ops.read_ucblocks(fe, (__u32 *) parg);
+-			else
+-				err = -EAGAIN;
+-		}
+-		break;
+-
+ 	case FE_DISEQC_RESET_OVERLOAD:
+ 		if (fe->ops.diseqc_reset_overload) {
+ 			err = fe->ops.diseqc_reset_overload(fe);
+@@ -2334,6 +2469,23 @@ static int dvb_frontend_ioctl_legacy(struct file *file,
+ 		}
+ 		break;
+ 
++	case FE_DISEQC_RECV_SLAVE_REPLY:
++		if (fe->ops.diseqc_recv_slave_reply)
++			err = fe->ops.diseqc_recv_slave_reply(fe, (struct dvb_diseqc_slave_reply*) parg);
++		break;
++
++	case FE_ENABLE_HIGH_LNB_VOLTAGE:
++		if (fe->ops.enable_high_lnb_voltage)
++			err = fe->ops.enable_high_lnb_voltage(fe, (long) parg);
++		break;
++
++	case FE_SET_FRONTEND_TUNE_MODE:
++		fepriv->tune_mode_flags = (unsigned long) parg;
++		err = 0;
++		break;
++
++	/* DEPRECATED dish control ioctls */
++
+ 	case FE_DISHNETWORK_SEND_LEGACY_CMD:
+ 		if (fe->ops.dishnetwork_send_legacy_command) {
+ 			err = fe->ops.dishnetwork_send_legacy_command(fe,
+@@ -2398,16 +2550,46 @@ static int dvb_frontend_ioctl_legacy(struct file *file,
+ 		}
+ 		break;
+ 
+-	case FE_DISEQC_RECV_SLAVE_REPLY:
+-		if (fe->ops.diseqc_recv_slave_reply)
+-			err = fe->ops.diseqc_recv_slave_reply(fe, (struct dvb_diseqc_slave_reply*) parg);
++	/* DEPRECATED statistics ioctls */
++
++	case FE_READ_BER:
++		if (fe->ops.read_ber) {
++			if (fepriv->thread)
++				err = fe->ops.read_ber(fe, (__u32 *) parg);
++			else
++				err = -EAGAIN;
++		}
+ 		break;
+ 
+-	case FE_ENABLE_HIGH_LNB_VOLTAGE:
+-		if (fe->ops.enable_high_lnb_voltage)
+-			err = fe->ops.enable_high_lnb_voltage(fe, (long) parg);
++	case FE_READ_SIGNAL_STRENGTH:
++		if (fe->ops.read_signal_strength) {
++			if (fepriv->thread)
++				err = fe->ops.read_signal_strength(fe, (__u16 *) parg);
++			else
++				err = -EAGAIN;
++		}
++		break;
++
++	case FE_READ_SNR:
++		if (fe->ops.read_snr) {
++			if (fepriv->thread)
++				err = fe->ops.read_snr(fe, (__u16 *) parg);
++			else
++				err = -EAGAIN;
++		}
++		break;
++
++	case FE_READ_UNCORRECTED_BLOCKS:
++		if (fe->ops.read_ucblocks) {
++			if (fepriv->thread)
++				err = fe->ops.read_ucblocks(fe, (__u32 *) parg);
++			else
++				err = -EAGAIN;
++		}
+ 		break;
+ 
++	/* DEPRECATED DVBv3 ioctls */
++
+ 	case FE_SET_FRONTEND:
+ 		err = dvbv3_set_delivery_system(fe);
+ 		if (err)
+@@ -2434,11 +2616,10 @@ static int dvb_frontend_ioctl_legacy(struct file *file,
+ 		err = dtv_get_frontend(fe, &getp, parg);
+ 		break;
+ 	}
+-	case FE_SET_FRONTEND_TUNE_MODE:
+-		fepriv->tune_mode_flags = (unsigned long) parg;
+-		err = 0;
+-		break;
+-	}
++
++	default:
++		return -ENOTSUPP;
++	} /* switch */
+ 
+ 	return err;
+ }
+@@ -2609,7 +2790,10 @@ static int dvb_frontend_release(struct inode *inode, struct file *file)
+ 
+ static const struct file_operations dvb_frontend_fops = {
+ 	.owner		= THIS_MODULE,
+-	.unlocked_ioctl	= dvb_generic_ioctl,
++	.unlocked_ioctl	= dvb_frontend_ioctl,
++#ifdef CONFIG_COMPAT
++	.compat_ioctl	= dvb_frontend_compat_ioctl,
++#endif
+ 	.poll		= dvb_frontend_poll,
+ 	.open		= dvb_frontend_open,
+ 	.release	= dvb_frontend_release,
+@@ -2677,7 +2861,6 @@ int dvb_register_frontend(struct dvb_adapter* dvb,
+ #if defined(CONFIG_MEDIA_CONTROLLER_DVB)
+ 		.name = fe->ops.info.name,
+ #endif
+-		.kernel_ioctl = dvb_frontend_ioctl
+ 	};
+ 
+ 	dev_dbg(dvb->device, "%s:\n", __func__);
+diff --git a/drivers/media/dvb-core/dvb_frontend.h b/drivers/media/dvb-core/dvb_frontend.h
+index fb6e84811504..8a6267ad56d6 100644
+--- a/drivers/media/dvb-core/dvb_frontend.h
++++ b/drivers/media/dvb-core/dvb_frontend.h
+@@ -397,13 +397,8 @@ struct dtv_frontend_properties;
+  * @search:		callback function used on some custom algo search algos.
+  * @tuner_ops:		pointer to struct dvb_tuner_ops
+  * @analog_ops:		pointer to struct analog_demod_ops
+- * @set_property:	callback function to allow the frontend to validade
+- *			incoming properties. Should not be used on new drivers.
+- * @get_property:	callback function to allow the frontend to override
+- *			outcoming properties. Should not be used on new drivers.
+  */
+ struct dvb_frontend_ops {
+-
+ 	struct dvb_frontend_info info;
+ 
+ 	u8 delsys[MAX_DELSYS];
+@@ -461,9 +456,6 @@ struct dvb_frontend_ops {
+ 
+ 	struct dvb_tuner_ops tuner_ops;
+ 	struct analog_demod_ops analog_ops;
+-
+-	int (*set_property)(struct dvb_frontend* fe, struct dtv_property* tvp);
+-	int (*get_property)(struct dvb_frontend* fe, struct dtv_property* tvp);
+ };
+ 
+ #ifdef __DVB_CORE__
+@@ -623,11 +615,6 @@ struct dtv_frontend_properties {
+ 	struct dtv_fe_stats	post_bit_count;
+ 	struct dtv_fe_stats	block_error;
+ 	struct dtv_fe_stats	block_count;
+-
+-	/* private: */
+-	/* Cache State */
+-	u32			state;
+-
+ };
+ 
+ #define DVB_FE_NO_EXIT  0
+diff --git a/drivers/media/dvb-frontends/lg2160.c b/drivers/media/dvb-frontends/lg2160.c
+index f51a3a0b3949..1b640651531d 100644
+--- a/drivers/media/dvb-frontends/lg2160.c
++++ b/drivers/media/dvb-frontends/lg2160.c
+@@ -1052,16 +1052,6 @@ fail:
+ 	return ret;
+ }
+ 
+-static int lg216x_get_property(struct dvb_frontend *fe,
+-			       struct dtv_property *tvp)
+-{
+-	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+-
+-	return (DTV_ATSCMH_FIC_VER == tvp->cmd) ?
+-		lg216x_get_frontend(fe, c) : 0;
+-}
+-
+-
+ static int lg2160_set_frontend(struct dvb_frontend *fe)
+ {
+ 	struct lg216x_state *state = fe->demodulator_priv;
+@@ -1372,8 +1362,6 @@ static struct dvb_frontend_ops lg2160_ops = {
+ 	.init                 = lg216x_init,
+ 	.sleep                = lg216x_sleep,
+ #endif
+-	.get_property         = lg216x_get_property,
+-
+ 	.set_frontend         = lg2160_set_frontend,
+ 	.get_frontend         = lg216x_get_frontend,
+ 	.get_tune_settings    = lg216x_get_tune_settings,
+@@ -1400,8 +1388,6 @@ static struct dvb_frontend_ops lg2161_ops = {
+ 	.init                 = lg216x_init,
+ 	.sleep                = lg216x_sleep,
+ #endif
+-	.get_property         = lg216x_get_property,
+-
+ 	.set_frontend         = lg2160_set_frontend,
+ 	.get_frontend         = lg216x_get_frontend,
+ 	.get_tune_settings    = lg216x_get_tune_settings,
+diff --git a/drivers/media/dvb-frontends/stv0288.c b/drivers/media/dvb-frontends/stv0288.c
+index c93d9a45f7f7..2b8c75f28d2e 100644
+--- a/drivers/media/dvb-frontends/stv0288.c
++++ b/drivers/media/dvb-frontends/stv0288.c
+@@ -447,12 +447,6 @@ static int stv0288_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks)
+ 	return 0;
+ }
+ 
+-static int stv0288_set_property(struct dvb_frontend *fe, struct dtv_property *p)
+-{
+-	dprintk("%s(..)\n", __func__);
+-	return 0;
+-}
+-
+ static int stv0288_set_frontend(struct dvb_frontend *fe)
+ {
+ 	struct stv0288_state *state = fe->demodulator_priv;
+@@ -568,7 +562,6 @@ static struct dvb_frontend_ops stv0288_ops = {
+ 	.set_tone = stv0288_set_tone,
+ 	.set_voltage = stv0288_set_voltage,
+ 
+-	.set_property = stv0288_set_property,
+ 	.set_frontend = stv0288_set_frontend,
+ };
+ 
+diff --git a/drivers/media/dvb-frontends/stv6110.c b/drivers/media/dvb-frontends/stv6110.c
+index 66a5a7f2295c..93262b13c644 100644
+--- a/drivers/media/dvb-frontends/stv6110.c
++++ b/drivers/media/dvb-frontends/stv6110.c
+@@ -263,11 +263,9 @@ static int stv6110_get_frequency(struct dvb_frontend *fe, u32 *frequency)
+ static int stv6110_set_frequency(struct dvb_frontend *fe, u32 frequency)
+ {
+ 	struct stv6110_priv *priv = fe->tuner_priv;
+-	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+ 	u8 ret = 0x04;
+ 	u32 divider, ref, p, presc, i, result_freq, vco_freq;
+ 	s32 p_calc, p_calc_opt = 1000, r_div, r_div_opt = 0, p_val;
+-	s32 srate;
+ 
+ 	dprintk("%s, freq=%d kHz, mclk=%d Hz\n", __func__,
+ 						frequency, priv->mclk);
+@@ -278,13 +276,6 @@ static int stv6110_set_frequency(struct dvb_frontend *fe, u32 frequency)
+ 				((((priv->mclk / 1000000) - 16) & 0x1f) << 3);
+ 
+ 	/* BB_GAIN = db/2 */
+-	if (fe->ops.set_property && fe->ops.get_property) {
+-		srate = c->symbol_rate;
+-		dprintk("%s: Get Frontend parameters: srate=%d\n",
+-							__func__, srate);
+-	} else
+-		srate = 15000000;
+-
+ 	priv->regs[RSTV6110_CTRL2] &= ~0x0f;
+ 	priv->regs[RSTV6110_CTRL2] |= (priv->gain & 0x0f);
+ 
+diff --git a/drivers/media/usb/dvb-usb/friio-fe.c b/drivers/media/usb/dvb-usb/friio-fe.c
+index 979f05b4b87c..237f12f9a7f2 100644
+--- a/drivers/media/usb/dvb-usb/friio-fe.c
++++ b/drivers/media/usb/dvb-usb/friio-fe.c
+@@ -261,28 +261,6 @@ static int jdvbt90502_read_signal_strength(struct dvb_frontend *fe,
+ 	return 0;
+ }
+ 
+-
+-/* filter out un-supported properties to notify users */
+-static int jdvbt90502_set_property(struct dvb_frontend *fe,
+-				   struct dtv_property *tvp)
+-{
+-	int r = 0;
+-
+-	switch (tvp->cmd) {
+-	case DTV_DELIVERY_SYSTEM:
+-		if (tvp->u.data != SYS_ISDBT)
+-			r = -EINVAL;
+-		break;
+-	case DTV_CLEAR:
+-	case DTV_TUNE:
+-	case DTV_FREQUENCY:
+-		break;
+-	default:
+-		r = -EINVAL;
+-	}
+-	return r;
+-}
+-
+ static int jdvbt90502_set_frontend(struct dvb_frontend *fe)
+ {
+ 	struct dtv_frontend_properties *p = &fe->dtv_property_cache;
+@@ -457,8 +435,6 @@ static struct dvb_frontend_ops jdvbt90502_ops = {
+ 	.init = jdvbt90502_init,
+ 	.write = _jdvbt90502_write,
+ 
+-	.set_property = jdvbt90502_set_property,
+-
+ 	.set_frontend = jdvbt90502_set_frontend,
+ 
+ 	.read_status = jdvbt90502_read_status,
+diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
+index 8588dbad3301..925c1828ec28 100644
+--- a/drivers/mfd/wm8994-core.c
++++ b/drivers/mfd/wm8994-core.c
+@@ -698,3 +698,4 @@ module_i2c_driver(wm8994_i2c_driver);
+ MODULE_DESCRIPTION("Core support for the WM8994 audio CODEC");
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Mark Brown <broonie@×××××××××××××××××××××××.com>");
++MODULE_SOFTDEP("pre: wm8994_regulator");
+diff --git a/drivers/mtd/nand/ams-delta.c b/drivers/mtd/nand/ams-delta.c
+index 78e12cc8bac2..02ec2d183607 100644
+--- a/drivers/mtd/nand/ams-delta.c
++++ b/drivers/mtd/nand/ams-delta.c
+@@ -264,7 +264,7 @@ static int ams_delta_cleanup(struct platform_device *pdev)
+ 	void __iomem *io_base = platform_get_drvdata(pdev);
+ 
+ 	/* Release resources, unregister device */
+-	nand_release(ams_delta_mtd);
++	nand_release(mtd_to_nand(ams_delta_mtd));
+ 
+ 	gpio_free_array(_mandatory_gpio, ARRAY_SIZE(_mandatory_gpio));
+ 	gpio_free(AMS_DELTA_GPIO_PIN_NAND_RB);
+diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c
+index 68b9160108c9..45495bc1a70e 100644
+--- a/drivers/mtd/nand/atmel_nand.c
++++ b/drivers/mtd/nand/atmel_nand.c
+@@ -2336,7 +2336,7 @@ static int atmel_nand_remove(struct platform_device *pdev)
+ 	struct atmel_nand_host *host = platform_get_drvdata(pdev);
+ 	struct mtd_info *mtd = nand_to_mtd(&host->nand_chip);
+ 
+-	nand_release(mtd);
++	nand_release(&host->nand_chip);
+ 
+ 	atmel_nand_disable(host);
+ 
+diff --git a/drivers/mtd/nand/au1550nd.c b/drivers/mtd/nand/au1550nd.c
+index 9bf6d9915694..a0e7789131df 100644
+--- a/drivers/mtd/nand/au1550nd.c
++++ b/drivers/mtd/nand/au1550nd.c
+@@ -496,7 +496,7 @@ static int au1550nd_remove(struct platform_device *pdev)
+ 	struct au1550nd_ctx *ctx = platform_get_drvdata(pdev);
+ 	struct resource *r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 
+-	nand_release(nand_to_mtd(&ctx->chip));
++	nand_release(&ctx->chip);
+ 	iounmap(ctx->base);
+ 	release_mem_region(r->start, 0x1000);
+ 	kfree(ctx);
+diff --git a/drivers/mtd/nand/bcm47xxnflash/main.c b/drivers/mtd/nand/bcm47xxnflash/main.c
+index fb31429b70a9..d79694160845 100644
+--- a/drivers/mtd/nand/bcm47xxnflash/main.c
++++ b/drivers/mtd/nand/bcm47xxnflash/main.c
+@@ -65,7 +65,7 @@ static int bcm47xxnflash_remove(struct platform_device *pdev)
+ {
+ 	struct bcm47xxnflash *nflash = platform_get_drvdata(pdev);
+ 
+-	nand_release(nand_to_mtd(&nflash->nand_chip));
++	nand_release(&nflash->nand_chip);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/mtd/nand/bf5xx_nand.c b/drivers/mtd/nand/bf5xx_nand.c
+index 3962f55bd034..020bb350a2db 100644
+--- a/drivers/mtd/nand/bf5xx_nand.c
++++ b/drivers/mtd/nand/bf5xx_nand.c
+@@ -688,7 +688,7 @@ static int bf5xx_nand_remove(struct platform_device *pdev)
+ 	 * and their partitions, then go through freeing the
+ 	 * resources used
+ 	 */
+-	nand_release(nand_to_mtd(&info->chip));
++	nand_release(&info->chip);
+ 
+ 	peripheral_free_list(bfin_nfc_pin_req);
+ 	bf5xx_nand_dma_remove(info);
+diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
+index 1291492a1cef..fbee81909d38 100644
+--- a/drivers/mtd/nand/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/brcmnand/brcmnand.c
+@@ -2595,7 +2595,7 @@ int brcmnand_remove(struct platform_device *pdev)
+ 	struct brcmnand_host *host;
+ 
+ 	list_for_each_entry(host, &ctrl->host_list, node)
+-		nand_release(nand_to_mtd(&host->chip));
++		nand_release(&host->chip);
+ 
+ 	clk_disable_unprepare(ctrl->clk);
+ 
+diff --git a/drivers/mtd/nand/cafe_nand.c b/drivers/mtd/nand/cafe_nand.c
+index 0b0c93702abb..c16e740c01c3 100644
+--- a/drivers/mtd/nand/cafe_nand.c
++++ b/drivers/mtd/nand/cafe_nand.c
+@@ -825,7 +825,7 @@ static void cafe_nand_remove(struct pci_dev *pdev)
+ 	/* Disable NAND IRQ in global IRQ mask register */
+ 	cafe_writel(cafe, ~1 & cafe_readl(cafe, GLOBAL_IRQ_MASK), GLOBAL_IRQ_MASK);
+ 	free_irq(pdev->irq, mtd);
+-	nand_release(mtd);
++	nand_release(chip);
+ 	free_rs(cafe->rs);
+ 	pci_iounmap(pdev, cafe->mmio);
+ 	dma_free_coherent(&cafe->pdev->dev,
+diff --git a/drivers/mtd/nand/cmx270_nand.c b/drivers/mtd/nand/cmx270_nand.c
+index 49133783ca53..b9667204e711 100644
+--- a/drivers/mtd/nand/cmx270_nand.c
++++ b/drivers/mtd/nand/cmx270_nand.c
+@@ -230,7 +230,7 @@ module_init(cmx270_init);
+ static void __exit cmx270_cleanup(void)
+ {
+ 	/* Release resources, unregister device */
+-	nand_release(cmx270_nand_mtd);
++	nand_release(mtd_to_nand(cmx270_nand_mtd));
+ 
+ 	gpio_free(GPIO_NAND_RB);
+ 	gpio_free(GPIO_NAND_CS);
+diff --git a/drivers/mtd/nand/cs553x_nand.c b/drivers/mtd/nand/cs553x_nand.c
+index a65e4e0f57a1..4779dfec3576 100644
+--- a/drivers/mtd/nand/cs553x_nand.c
++++ b/drivers/mtd/nand/cs553x_nand.c
+@@ -339,7 +339,7 @@ static void __exit cs553x_cleanup(void)
+ 		mmio_base = this->IO_ADDR_R;
+ 
+ 		/* Release resources, unregister device */
+-		nand_release(mtd);
++		nand_release(this);
+ 		kfree(mtd->name);
+ 		cs553x_mtd[i] = NULL;
+ 
+diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
+index 27fa8b87cd5f..c7f535676e49 100644
+--- a/drivers/mtd/nand/davinci_nand.c
++++ b/drivers/mtd/nand/davinci_nand.c
+@@ -840,7 +840,7 @@ static int nand_davinci_remove(struct platform_device *pdev)
+ 		ecc4_busy = false;
+ 	spin_unlock_irq(&davinci_nand_lock);
+ 
+-	nand_release(nand_to_mtd(&info->chip));
++	nand_release(&info->chip);
+ 
+ 	clk_disable_unprepare(info->clk);
+ 
+diff --git a/drivers/mtd/nand/denali.c b/drivers/mtd/nand/denali.c
+index 0476ae8776d9..982cbc7f412f 100644
+--- a/drivers/mtd/nand/denali.c
++++ b/drivers/mtd/nand/denali.c
+@@ -1655,7 +1655,7 @@ void denali_remove(struct denali_nand_info *denali)
+ 	 */
+ 	int bufsize = mtd->writesize + mtd->oobsize;
+ 
+-	nand_release(mtd);
++	nand_release(&denali->nand);
+ 	denali_irq_cleanup(denali->irq, denali);
+ 	dma_unmap_single(denali->dev, denali->buf.dma_buf, bufsize,
+ 			 DMA_BIDIRECTIONAL);
+diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
+index a023ab9e9cbf..374b7a10ba51 100644
+--- a/drivers/mtd/nand/diskonchip.c
++++ b/drivers/mtd/nand/diskonchip.c
+@@ -1605,13 +1605,10 @@ static int __init doc_probe(unsigned long physadr)
+ 		numchips = doc2001_init(mtd);
+ 
+ 	if ((ret = nand_scan(mtd, numchips)) || (ret = doc->late_init(mtd))) {
+-		/* DBB note: i believe nand_release is necessary here, as
++		/* DBB note: i believe nand_cleanup is necessary here, as
+ 		   buffers may have been allocated in nand_base.  Check with
+ 		   Thomas. FIX ME! */
+-		/* nand_release will call mtd_device_unregister, but we
+-		   haven't yet added it.  This is handled without incident by
+-		   mtd_device_unregister, as far as I can tell. */
+-		nand_release(mtd);
++		nand_cleanup(nand);
+ 		kfree(nand);
+ 		goto fail;
+ 	}
+@@ -1644,7 +1641,7 @@ static void release_nanddoc(void)
+ 		doc = nand_get_controller_data(nand);
+ 
+ 		nextmtd = doc->nextdoc;
+-		nand_release(mtd);
++		nand_release(nand);
+ 		iounmap(doc->virtadr);
+ 		release_mem_region(doc->physadr, DOC_IOREMAP_LEN);
+ 		kfree(nand);
+diff --git a/drivers/mtd/nand/docg4.c b/drivers/mtd/nand/docg4.c
+index 7af2a3cd949e..5798cd87f340 100644
+--- a/drivers/mtd/nand/docg4.c
++++ b/drivers/mtd/nand/docg4.c
+@@ -1374,7 +1374,7 @@ static int __init probe_docg4(struct platform_device *pdev)
+ 	return 0;
+ 
+ fail:
+-	nand_release(mtd); /* deletes partitions and mtd devices */
++	nand_release(nand); /* deletes partitions and mtd devices */
+ 	free_bch(doc->bch);
+ 	kfree(nand);
+ 
+@@ -1387,7 +1387,7 @@ fail_unmap:
+ static int __exit cleanup_docg4(struct platform_device *pdev)
+ {
+ 	struct docg4_priv *doc = platform_get_drvdata(pdev);
+-	nand_release(doc->mtd);
++	nand_release(mtd_to_nand(doc->mtd));
+ 	free_bch(doc->bch);
+ 	kfree(mtd_to_nand(doc->mtd));
+ 	iounmap(doc->virtadr);
+diff --git a/drivers/mtd/nand/fsl_elbc_nand.c b/drivers/mtd/nand/fsl_elbc_nand.c
+index 113f76e59937..2fc4f2ab89ff 100644
+--- a/drivers/mtd/nand/fsl_elbc_nand.c
++++ b/drivers/mtd/nand/fsl_elbc_nand.c
+@@ -811,7 +811,7 @@ static int fsl_elbc_chip_remove(struct fsl_elbc_mtd *priv)
+ 	struct fsl_elbc_fcm_ctrl *elbc_fcm_ctrl = priv->ctrl->nand;
+ 	struct mtd_info *mtd = nand_to_mtd(&priv->chip);
+ 
+-	nand_release(mtd);
++	nand_release(&priv->chip);
+ 
+ 	kfree(mtd->name);
+ 
+diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c
+index 4c3b986dd74d..cf0fccb5908e 100644
+--- a/drivers/mtd/nand/fsl_ifc_nand.c
++++ b/drivers/mtd/nand/fsl_ifc_nand.c
+@@ -918,7 +918,7 @@ static int fsl_ifc_chip_remove(struct fsl_ifc_mtd *priv)
+ {
+ 	struct mtd_info *mtd = nand_to_mtd(&priv->chip);
+ 
+-	nand_release(mtd);
++	nand_release(&priv->chip);
+ 
+ 	kfree(mtd->name);
+ 
+diff --git a/drivers/mtd/nand/fsl_upm.c b/drivers/mtd/nand/fsl_upm.c
+index d85fa2555b68..0b4d2489cc71 100644
+--- a/drivers/mtd/nand/fsl_upm.c
++++ b/drivers/mtd/nand/fsl_upm.c
+@@ -326,7 +326,7 @@ static int fun_remove(struct platform_device *ofdev)
+ 	struct mtd_info *mtd = nand_to_mtd(&fun->chip);
+ 	int i;
+ 
+-	nand_release(mtd);
++	nand_release(&fun->chip);
+ 	kfree(mtd->name);
+ 
+ 	for (i = 0; i < fun->mchip_count; i++) {
+diff --git a/drivers/mtd/nand/fsmc_nand.c b/drivers/mtd/nand/fsmc_nand.c
+index d4f454a4b35e..92737deb7845 100644
+--- a/drivers/mtd/nand/fsmc_nand.c
++++ b/drivers/mtd/nand/fsmc_nand.c
+@@ -1038,7 +1038,7 @@ static int fsmc_nand_remove(struct platform_device *pdev)
+ 	struct fsmc_nand_data *host = platform_get_drvdata(pdev);
+ 
+ 	if (host) {
+-		nand_release(nand_to_mtd(&host->nand));
++		nand_release(&host->nand);
+ 
+ 		if (host->mode == USE_DMA_ACCESS) {
+ 			dma_release_channel(host->write_dma_chan);
+diff --git a/drivers/mtd/nand/gpio.c b/drivers/mtd/nand/gpio.c
+index 6317f6836022..c7461ca1c1a6 100644
+--- a/drivers/mtd/nand/gpio.c
++++ b/drivers/mtd/nand/gpio.c
+@@ -197,7 +197,7 @@ static int gpio_nand_remove(struct platform_device *pdev)
+ {
+ 	struct gpiomtd *gpiomtd = platform_get_drvdata(pdev);
+ 
+-	nand_release(nand_to_mtd(&gpiomtd->nand_chip));
++	nand_release(&gpiomtd->nand_chip);
+ 
+ 	if (gpio_is_valid(gpiomtd->plat.gpio_nwp))
+ 		gpio_set_value(gpiomtd->plat.gpio_nwp, 0);
+diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+index d9dab4275859..f4a99e91c250 100644
+--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+@@ -1930,7 +1930,7 @@ static int gpmi_set_geometry(struct gpmi_nand_data *this)
+ 
+ static void gpmi_nand_exit(struct gpmi_nand_data *this)
+ {
+-	nand_release(nand_to_mtd(&this->nand));
++	nand_release(&this->nand);
+ 	gpmi_free_dma_buffer(this);
+ }
+ 
+diff --git a/drivers/mtd/nand/hisi504_nand.c b/drivers/mtd/nand/hisi504_nand.c
+index 9432546f4cd4..6c96d9d29a31 100644
+--- a/drivers/mtd/nand/hisi504_nand.c
++++ b/drivers/mtd/nand/hisi504_nand.c
+@@ -823,7 +823,7 @@ static int hisi_nfc_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ err_mtd:
+-	nand_release(mtd);
++	nand_release(chip);
+ err_res:
+ 	return ret;
+ }
+@@ -831,9 +831,8 @@ err_res:
+ static int hisi_nfc_remove(struct platform_device *pdev)
+ {
+ 	struct hinfc_host *host = platform_get_drvdata(pdev);
+-	struct mtd_info *mtd = nand_to_mtd(&host->chip);
+ 
+-	nand_release(mtd);
++	nand_release(&host->chip);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/mtd/nand/jz4740_nand.c b/drivers/mtd/nand/jz4740_nand.c
+index 5551c36adbdf..6f323858d51a 100644
+--- a/drivers/mtd/nand/jz4740_nand.c
++++ b/drivers/mtd/nand/jz4740_nand.c
+@@ -499,7 +499,7 @@ static int jz_nand_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ err_nand_release:
+-	nand_release(mtd);
++	nand_release(chip);
+ err_unclaim_banks:
+ 	while (chipnr--) {
+ 		unsigned char bank = nand->banks[chipnr];
+@@ -520,7 +520,7 @@ static int jz_nand_remove(struct platform_device *pdev)
+ 	struct jz_nand *nand = platform_get_drvdata(pdev);
+ 	size_t i;
+ 
+-	nand_release(nand_to_mtd(&nand->chip));
++	nand_release(&nand->chip);
+ 
+ 	/* Deassert and disable all chips */
+ 	writel(0, nand->base + JZ_REG_NAND_CTRL);
+diff --git a/drivers/mtd/nand/jz4780_nand.c b/drivers/mtd/nand/jz4780_nand.c
+index a39bb70175ee..e8aaf2543946 100644
+--- a/drivers/mtd/nand/jz4780_nand.c
++++ b/drivers/mtd/nand/jz4780_nand.c
+@@ -293,7 +293,7 @@ static int jz4780_nand_init_chip(struct platform_device *pdev,
+ 
+ 	ret = mtd_device_register(mtd, NULL, 0);
+ 	if (ret) {
+-		nand_release(mtd);
++		nand_release(chip);
+ 		return ret;
+ 	}
+ 
+@@ -308,7 +308,7 @@ static void jz4780_nand_cleanup_chips(struct jz4780_nand_controller *nfc)
+ 
+ 	while (!list_empty(&nfc->chips)) {
+ 		chip = list_first_entry(&nfc->chips, struct jz4780_nand_chip, chip_list);
+-		nand_release(nand_to_mtd(&chip->chip));
++		nand_release(&chip->chip);
+ 		list_del(&chip->chip_list);
+ 	}
+ }
+diff --git a/drivers/mtd/nand/lpc32xx_mlc.c b/drivers/mtd/nand/lpc32xx_mlc.c
+index bc6e49af063a..839f8f4ace9e 100644
+--- a/drivers/mtd/nand/lpc32xx_mlc.c
++++ b/drivers/mtd/nand/lpc32xx_mlc.c
+@@ -805,7 +805,7 @@ static int lpc32xx_nand_probe(struct platform_device *pdev)
+ 	if (!res)
+ 		return res;
+ 
+-	nand_release(mtd);
++	nand_release(nand_chip);
+ 
+ err_exit4:
+ 	free_irq(host->irq, host);
+@@ -828,9 +828,8 @@ err_exit1:
+ static int lpc32xx_nand_remove(struct platform_device *pdev)
+ {
+ 	struct lpc32xx_nand_host *host = platform_get_drvdata(pdev);
+-	struct mtd_info *mtd = nand_to_mtd(&host->nand_chip);
+ 
+-	nand_release(mtd);
++	nand_release(&host->nand_chip);
+ 	free_irq(host->irq, host);
+ 	if (use_dma)
+ 		dma_release_channel(host->dma_chan);
+diff --git a/drivers/mtd/nand/lpc32xx_slc.c b/drivers/mtd/nand/lpc32xx_slc.c
+index 8d3edc34958e..0b5fa254ea60 100644
+--- a/drivers/mtd/nand/lpc32xx_slc.c
++++ b/drivers/mtd/nand/lpc32xx_slc.c
+@@ -940,7 +940,7 @@ static int lpc32xx_nand_probe(struct platform_device *pdev)
+ 	if (!res)
+ 		return res;
+ 
+-	nand_release(mtd);
++	nand_release(chip);
+ 
+ err_exit3:
+ 	dma_release_channel(host->dma_chan);
+@@ -959,9 +959,8 @@ static int lpc32xx_nand_remove(struct platform_device *pdev)
+ {
+ 	uint32_t tmp;
+ 	struct lpc32xx_nand_host *host = platform_get_drvdata(pdev);
+-	struct mtd_info *mtd = nand_to_mtd(&host->nand_chip);
+ 
+-	nand_release(mtd);
++	nand_release(&host->nand_chip);
+ 	dma_release_channel(host->dma_chan);
+ 
+ 	/* Force CE high */
+diff --git a/drivers/mtd/nand/mpc5121_nfc.c b/drivers/mtd/nand/mpc5121_nfc.c
+index 7eacb2f545f5..9662f8fe4713 100644
+--- a/drivers/mtd/nand/mpc5121_nfc.c
++++ b/drivers/mtd/nand/mpc5121_nfc.c
+@@ -827,7 +827,7 @@ static int mpc5121_nfc_remove(struct platform_device *op)
+ 	struct device *dev = &op->dev;
+ 	struct mtd_info *mtd = dev_get_drvdata(dev);
+ 
+-	nand_release(mtd);
++	nand_release(mtd_to_nand(mtd));
+ 	mpc5121_nfc_free(dev, mtd);
+ 
+ 	return 0;
+diff --git a/drivers/mtd/nand/mtk_nand.c b/drivers/mtd/nand/mtk_nand.c
+index ca95ae00215e..2375dce766ef 100644
+--- a/drivers/mtd/nand/mtk_nand.c
++++ b/drivers/mtd/nand/mtk_nand.c
+@@ -1327,7 +1327,7 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,
+ 	ret = mtd_device_parse_register(mtd, NULL, NULL, NULL, 0);
+ 	if (ret) {
+ 		dev_err(dev, "mtd parse partition error\n");
+-		nand_release(mtd);
++		nand_cleanup(nand);
+ 		return ret;
+ 	}
+ 
+@@ -1450,7 +1450,7 @@ static int mtk_nfc_remove(struct platform_device *pdev)
+ 	while (!list_empty(&nfc->chips)) {
+ 		chip = list_first_entry(&nfc->chips, struct mtk_nfc_nand_chip,
+ 					node);
+-		nand_release(nand_to_mtd(&chip->nand));
++		nand_release(&chip->nand);
+ 		list_del(&chip->node);
+ 	}
+ 
+diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
+index 5c44eb57885b..deb3cbadbc51 100644
+--- a/drivers/mtd/nand/mxc_nand.c
++++ b/drivers/mtd/nand/mxc_nand.c
+@@ -1838,7 +1838,7 @@ static int mxcnd_remove(struct platform_device *pdev)
+ {
+ 	struct mxc_nand_host *host = platform_get_drvdata(pdev);
+ 
+-	nand_release(nand_to_mtd(&host->nand));
++	nand_release(&host->nand);
+ 	if (host->clk_act)
+ 		clk_disable_unprepare(host->clk);
+ 
+diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
+index 5fb45161789c..bdf40c090acd 100644
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -4941,12 +4941,12 @@ EXPORT_SYMBOL_GPL(nand_cleanup);
+ /**
+  * nand_release - [NAND Interface] Unregister the MTD device and free resources
+  *		  held by the NAND device
+- * @mtd: MTD device structure
++ * @chip: NAND chip object
+  */
+-void nand_release(struct mtd_info *mtd)
++void nand_release(struct nand_chip *chip)
+ {
+-	mtd_device_unregister(mtd);
+-	nand_cleanup(mtd_to_nand(mtd));
++	mtd_device_unregister(nand_to_mtd(chip));
++	nand_cleanup(chip);
+ }
+ EXPORT_SYMBOL_GPL(nand_release);
+ 
+diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
+index 1eb934414eb5..fe593f2f1ec7 100644
+--- a/drivers/mtd/nand/nandsim.c
++++ b/drivers/mtd/nand/nandsim.c
+@@ -2394,7 +2394,7 @@ static int __init ns_init_module(void)
+ 
+ err_exit:
+ 	free_nandsim(nand);
+-	nand_release(nsmtd);
++	nand_release(chip);
+ 	for (i = 0;i < ARRAY_SIZE(nand->partitions); ++i)
+ 		kfree(nand->partitions[i].name);
+ error:
+@@ -2417,7 +2417,7 @@ static void __exit ns_cleanup_module(void)
+ 
+ 	nandsim_debugfs_remove(ns);
+ 	free_nandsim(ns);    /* Free nandsim private resources */
+-	nand_release(nsmtd); /* Unregister driver */
++	nand_release(chip); /* Unregister driver */
+ 	for (i = 0;i < ARRAY_SIZE(ns->partitions); ++i)
+ 		kfree(ns->partitions[i].name);
+ 	kfree(mtd_to_nand(nsmtd));        /* Free other structures */
+diff --git a/drivers/mtd/nand/ndfc.c b/drivers/mtd/nand/ndfc.c
+index 28e6118362f7..d03b47d2664b 100644
+--- a/drivers/mtd/nand/ndfc.c
++++ b/drivers/mtd/nand/ndfc.c
+@@ -258,7 +258,7 @@ static int ndfc_remove(struct platform_device *ofdev)
+ 	struct ndfc_controller *ndfc = dev_get_drvdata(&ofdev->dev);
+ 	struct mtd_info *mtd = nand_to_mtd(&ndfc->chip);
+ 
+-	nand_release(mtd);
++	nand_release(&ndfc->chip);
+ 	kfree(mtd->name);
+ 
+ 	return 0;
+diff --git a/drivers/mtd/nand/nuc900_nand.c b/drivers/mtd/nand/nuc900_nand.c
+index 8f64011d32ef..f7f54b46f246 100644
+--- a/drivers/mtd/nand/nuc900_nand.c
++++ b/drivers/mtd/nand/nuc900_nand.c
+@@ -284,7 +284,7 @@ static int nuc900_nand_remove(struct platform_device *pdev)
+ {
+ 	struct nuc900_nand *nuc900_nand = platform_get_drvdata(pdev);
+ 
+-	nand_release(nand_to_mtd(&nuc900_nand->chip));
++	nand_release(&nuc900_nand->chip);
+ 	clk_disable(nuc900_nand->clk);
+ 
+ 	return 0;
+diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
+index f3a516b3f108..62c0ca437c91 100644
+--- a/drivers/mtd/nand/omap2.c
++++ b/drivers/mtd/nand/omap2.c
+@@ -2307,7 +2307,7 @@ static int omap_nand_remove(struct platform_device *pdev)
+ 	}
+ 	if (info->dma)
+ 		dma_release_channel(info->dma);
+-	nand_release(mtd);
++	nand_release(nand_chip);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/mtd/nand/orion_nand.c b/drivers/mtd/nand/orion_nand.c
+index af2f09135fb0..0acfc0a7d8e0 100644
+--- a/drivers/mtd/nand/orion_nand.c
++++ b/drivers/mtd/nand/orion_nand.c
+@@ -167,7 +167,7 @@ static int __init orion_nand_probe(struct platform_device *pdev)
+ 	mtd->name = "orion_nand";
+ 	ret = mtd_device_register(mtd, board->parts, board->nr_parts);
+ 	if (ret) {
+-		nand_release(mtd);
++		nand_cleanup(nc);
+ 		goto no_dev;
+ 	}
+ 
+@@ -184,9 +184,8 @@ static int orion_nand_remove(struct platform_device *pdev)
+ {
+ 	struct orion_nand_info *info = platform_get_drvdata(pdev);
+ 	struct nand_chip *chip = &info->chip;
+-	struct mtd_info *mtd = nand_to_mtd(chip);
+ 
+-	nand_release(mtd);
++	nand_release(chip);
+ 
+ 	if (!IS_ERR(info->clk))
+ 		clk_disable_unprepare(info->clk);
+diff --git a/drivers/mtd/nand/pasemi_nand.c b/drivers/mtd/nand/pasemi_nand.c
+index 80c98eef44d9..3300e43e2cb9 100644
+--- a/drivers/mtd/nand/pasemi_nand.c
++++ b/drivers/mtd/nand/pasemi_nand.c
+@@ -194,7 +194,7 @@ static int pasemi_nand_remove(struct platform_device *ofdev)
+ 	chip = mtd_to_nand(pasemi_nand_mtd);
+ 
+ 	/* Release resources, unregister device */
+-	nand_release(pasemi_nand_mtd);
++	nand_release(chip);
+ 
+ 	release_region(lpcctl, 4);
+ 
+diff --git a/drivers/mtd/nand/plat_nand.c b/drivers/mtd/nand/plat_nand.c
+index 415a53a0deeb..ae2b3c0804ce 100644
+--- a/drivers/mtd/nand/plat_nand.c
++++ b/drivers/mtd/nand/plat_nand.c
+@@ -100,7 +100,7 @@ static int plat_nand_probe(struct platform_device *pdev)
+ 	if (!err)
+ 		return err;
+ 
+-	nand_release(mtd);
++	nand_cleanup(&data->chip);
+ out:
+ 	if (pdata->ctrl.remove)
+ 		pdata->ctrl.remove(pdev);
+@@ -115,7 +115,7 @@ static int plat_nand_remove(struct platform_device *pdev)
+ 	struct plat_nand_data *data = platform_get_drvdata(pdev);
+ 	struct platform_nand_data *pdata = dev_get_platdata(&pdev->dev);
+ 
+-	nand_release(nand_to_mtd(&data->chip));
++	nand_release(&data->chip);
+ 	if (pdata->ctrl.remove)
+ 		pdata->ctrl.remove(pdev);
+ 
+diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
+index 3b8911cd3a19..46f13f7e54da 100644
+--- a/drivers/mtd/nand/pxa3xx_nand.c
++++ b/drivers/mtd/nand/pxa3xx_nand.c
+@@ -1907,7 +1907,7 @@ static int pxa3xx_nand_remove(struct platform_device *pdev)
+ 	clk_disable_unprepare(info->clk);
+ 
+ 	for (cs = 0; cs < pdata->num_cs; cs++)
+-		nand_release(nand_to_mtd(&info->host[cs]->chip));
++		nand_release(&info->host[cs]->chip);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/mtd/nand/qcom_nandc.c b/drivers/mtd/nand/qcom_nandc.c
+index 9f6c9a34b9eb..1594770987fd 100644
+--- a/drivers/mtd/nand/qcom_nandc.c
++++ b/drivers/mtd/nand/qcom_nandc.c
+@@ -2163,7 +2163,7 @@ static int qcom_nandc_probe(struct platform_device *pdev)
+ 
+ err_cs_init:
+ 	list_for_each_entry(host, &nandc->host_list, node)
+-		nand_release(nand_to_mtd(&host->chip));
++		nand_release(&host->chip);
+ err_setup:
+ 	clk_disable_unprepare(nandc->aon_clk);
+ err_aon_clk:
+@@ -2180,7 +2180,7 @@ static int qcom_nandc_remove(struct platform_device *pdev)
+ 	struct qcom_nand_host *host;
+ 
+ 	list_for_each_entry(host, &nandc->host_list, node)
+-		nand_release(nand_to_mtd(&host->chip));
++		nand_release(&host->chip);
+ 
+ 	qcom_nandc_unalloc(nandc);
+ 
+diff --git a/drivers/mtd/nand/r852.c b/drivers/mtd/nand/r852.c
+index fc9287af4614..2cfa54941395 100644
+--- a/drivers/mtd/nand/r852.c
++++ b/drivers/mtd/nand/r852.c
+@@ -656,7 +656,7 @@ static int r852_register_nand_device(struct r852_device *dev)
+ 	dev->card_registred = 1;
+ 	return 0;
+ error3:
+-	nand_release(mtd);
++	nand_release(dev->chip);
+ error1:
+ 	/* Force card redetect */
+ 	dev->card_detected = 0;
+@@ -675,7 +675,7 @@ static void r852_unregister_nand_device(struct r852_device *dev)
+ 		return;
+ 
+ 	device_remove_file(&mtd->dev, &dev_attr_media_type);
+-	nand_release(mtd);
++	nand_release(dev->chip);
+ 	r852_engine_disable(dev);
+ 	dev->card_registred = 0;
+ }
+diff --git a/drivers/mtd/nand/s3c2410.c b/drivers/mtd/nand/s3c2410.c
+index d459c19d78de..be9c145b743c 100644
+--- a/drivers/mtd/nand/s3c2410.c
++++ b/drivers/mtd/nand/s3c2410.c
+@@ -768,7 +768,7 @@ static int s3c24xx_nand_remove(struct platform_device *pdev)
+ 
+ 		for (mtdno = 0; mtdno < info->mtd_count; mtdno++, ptr++) {
+ 			pr_debug("releasing mtd %d (%p)\n", mtdno, ptr);
+-			nand_release(nand_to_mtd(&ptr->chip));
++			nand_release(&ptr->chip);
+ 		}
+ 	}
+ 
+diff --git a/drivers/mtd/nand/sh_flctl.c b/drivers/mtd/nand/sh_flctl.c
+index d6c013f93b8c..31f98acdba07 100644
+--- a/drivers/mtd/nand/sh_flctl.c
++++ b/drivers/mtd/nand/sh_flctl.c
+@@ -1229,7 +1229,7 @@ static int flctl_remove(struct platform_device *pdev)
+ 	struct sh_flctl *flctl = platform_get_drvdata(pdev);
+ 
+ 	flctl_release_dma(flctl);
+-	nand_release(nand_to_mtd(&flctl->chip));
++	nand_release(&flctl->chip);
+ 	pm_runtime_disable(&pdev->dev);
+ 
+ 	return 0;
+diff --git a/drivers/mtd/nand/sharpsl.c b/drivers/mtd/nand/sharpsl.c
+index 064ca1757589..661b4928e0fc 100644
+--- a/drivers/mtd/nand/sharpsl.c
++++ b/drivers/mtd/nand/sharpsl.c
+@@ -192,7 +192,7 @@ static int sharpsl_nand_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ err_add:
+-	nand_release(mtd);
++	nand_cleanup(this);
+ 
+ err_scan:
+ 	iounmap(sharpsl->io);
+@@ -210,7 +210,7 @@ static int sharpsl_nand_remove(struct platform_device *pdev)
+ 	struct sharpsl_nand *sharpsl = platform_get_drvdata(pdev);
+ 
+ 	/* Release resources, unregister device */
+-	nand_release(nand_to_mtd(&sharpsl->chip));
++	nand_release(&sharpsl->chip);
+ 
+ 	iounmap(sharpsl->io);
+ 
+diff --git a/drivers/mtd/nand/socrates_nand.c b/drivers/mtd/nand/socrates_nand.c
+index 888fd314c62a..957d9597c484 100644
+--- a/drivers/mtd/nand/socrates_nand.c
++++ b/drivers/mtd/nand/socrates_nand.c
+@@ -203,7 +203,7 @@ static int socrates_nand_probe(struct platform_device *ofdev)
+ 	if (!res)
+ 		return res;
+ 
+-	nand_release(mtd);
++	nand_cleanup(nand_chip);
+ 
+ out:
+ 	iounmap(host->io_base);
+@@ -216,9 +216,8 @@ out:
+ static int socrates_nand_remove(struct platform_device *ofdev)
+ {
+ 	struct socrates_nand_host *host = dev_get_drvdata(&ofdev->dev);
+-	struct mtd_info *mtd = nand_to_mtd(&host->nand_chip);
+ 
+-	nand_release(mtd);
++	nand_release(&host->nand_chip);
+ 
+ 	iounmap(host->io_base);
+ 
+diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c
+index 886355bfa761..ddf3e24cc289 100644
+--- a/drivers/mtd/nand/sunxi_nand.c
++++ b/drivers/mtd/nand/sunxi_nand.c
+@@ -2108,7 +2108,7 @@ static int sunxi_nand_chip_init(struct device *dev, struct sunxi_nfc *nfc,
+ 	ret = mtd_device_register(mtd, NULL, 0);
+ 	if (ret) {
+ 		dev_err(dev, "failed to register mtd device: %d\n", ret);
+-		nand_release(mtd);
++		nand_release(nand);
+ 		return ret;
+ 	}
+ 
+@@ -2147,7 +2147,7 @@ static void sunxi_nand_chips_cleanup(struct sunxi_nfc *nfc)
+ 	while (!list_empty(&nfc->chips)) {
+ 		chip = list_first_entry(&nfc->chips, struct sunxi_nand_chip,
+ 					node);
+-		nand_release(nand_to_mtd(&chip->nand));
++		nand_release(&chip->nand);
+ 		sunxi_nand_ecc_cleanup(&chip->nand.ecc);
+ 		list_del(&chip->node);
+ 	}
+diff --git a/drivers/mtd/nand/tmio_nand.c b/drivers/mtd/nand/tmio_nand.c
+index 08b30549ec0a..d07c729f5b9b 100644
+--- a/drivers/mtd/nand/tmio_nand.c
++++ b/drivers/mtd/nand/tmio_nand.c
+@@ -446,7 +446,7 @@ static int tmio_probe(struct platform_device *dev)
+ 	if (!retval)
+ 		return retval;
+ 
+-	nand_release(mtd);
++	nand_cleanup(nand_chip);
+ 
+ err_irq:
+ 	tmio_hw_stop(dev, tmio);
+@@ -457,7 +457,7 @@ static int tmio_remove(struct platform_device *dev)
+ {
+ 	struct tmio_nand *tmio = platform_get_drvdata(dev);
+ 
+-	nand_release(nand_to_mtd(&tmio->chip));
++	nand_release(&tmio->chip);
+ 	tmio_hw_stop(dev, tmio);
+ 	return 0;
+ }
+diff --git a/drivers/mtd/nand/txx9ndfmc.c b/drivers/mtd/nand/txx9ndfmc.c
+index 0a14fda2e41b..f2ba55b0a1e9 100644
+--- a/drivers/mtd/nand/txx9ndfmc.c
++++ b/drivers/mtd/nand/txx9ndfmc.c
+@@ -390,7 +390,7 @@ static int __exit txx9ndfmc_remove(struct platform_device *dev)
+ 		chip = mtd_to_nand(mtd);
+ 		txx9_priv = nand_get_controller_data(chip);
+ 
+-		nand_release(mtd);
++		nand_release(chip);
+ 		kfree(txx9_priv->mtdname);
+ 		kfree(txx9_priv);
+ 	}
+diff --git a/drivers/mtd/nand/vf610_nfc.c b/drivers/mtd/nand/vf610_nfc.c
+index ddc629e3f63a..ec004e0a94a3 100644
+--- a/drivers/mtd/nand/vf610_nfc.c
++++ b/drivers/mtd/nand/vf610_nfc.c
+@@ -795,7 +795,7 @@ static int vf610_nfc_remove(struct platform_device *pdev)
+ 	struct mtd_info *mtd = platform_get_drvdata(pdev);
+ 	struct vf610_nfc *nfc = mtd_to_nfc(mtd);
+ 
+-	nand_release(mtd);
++	nand_release(mtd_to_nand(mtd));
+ 	clk_disable_unprepare(nfc->clk);
+ 	return 0;
+ }
+diff --git a/drivers/mtd/nand/xway_nand.c b/drivers/mtd/nand/xway_nand.c
+index 895101a5e686..3d51b8fc5aaf 100644
+--- a/drivers/mtd/nand/xway_nand.c
++++ b/drivers/mtd/nand/xway_nand.c
+@@ -211,7 +211,7 @@ static int xway_nand_probe(struct platform_device *pdev)
+ 
+ 	err = mtd_device_register(mtd, NULL, 0);
+ 	if (err)
+-		nand_release(mtd);
++		nand_cleanup(&data->chip);
+ 
+ 	return err;
+ }
+@@ -223,7 +223,7 @@ static int xway_nand_remove(struct platform_device *pdev)
+ {
+ 	struct xway_nand_data *data = platform_get_drvdata(pdev);
+ 
+-	nand_release(nand_to_mtd(&data->chip));
++	nand_release(&data->chip);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
+index c0f84b73574d..2a5bb1012385 100644
+--- a/drivers/net/ethernet/atheros/alx/main.c
++++ b/drivers/net/ethernet/atheros/alx/main.c
+@@ -1056,8 +1056,12 @@ out_disable_adv_intr:
+ 
+ static void __alx_stop(struct alx_priv *alx)
+ {
+-	alx_halt(alx);
+ 	alx_free_irq(alx);
++
++	cancel_work_sync(&alx->link_check_wk);
++	cancel_work_sync(&alx->reset_wk);
++
++	alx_halt(alx);
+ 	alx_free_rings(alx);
+ }
+ 
+@@ -1659,9 +1663,6 @@ static void alx_remove(struct pci_dev *pdev)
+ 	struct alx_priv *alx = pci_get_drvdata(pdev);
+ 	struct alx_hw *hw = &alx->hw;
+ 
+-	cancel_work_sync(&alx->link_check_wk);
+-	cancel_work_sync(&alx->reset_wk);
+-
+ 	/* restore permanent mac address */
+ 	alx_set_macaddr(hw, hw->perm_addr);
+ 
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index c069a04a6e7e..5790b35064a8 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -18174,8 +18174,8 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,
+ 
+ 	rtnl_lock();
+ 
+-	/* We probably don't have netdev yet */
+-	if (!netdev || !netif_running(netdev))
++	/* Could be second call or maybe we don't have netdev yet */
++	if (!netdev || tp->pcierr_recovery || !netif_running(netdev))
+ 		goto done;
+ 
+ 	/* We needn't recover from permanent error */
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index be324b4761eb..3c01bc43889a 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -6315,11 +6315,17 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime)
+ 	struct net_device *netdev = pci_get_drvdata(pdev);
+ 	struct e1000_adapter *adapter = netdev_priv(netdev);
+ 	struct e1000_hw *hw = &adapter->hw;
+-	u32 ctrl, ctrl_ext, rctl, status;
+-	/* Runtime suspend should only enable wakeup for link changes */
+-	u32 wufc = runtime ? E1000_WUFC_LNKC : adapter->wol;
++	u32 ctrl, ctrl_ext, rctl, status, wufc;
+ 	int retval = 0;
+ 
++	/* Runtime suspend should only enable wakeup for link changes */
++	if (runtime)
++		wufc = E1000_WUFC_LNKC;
++	else if (device_may_wakeup(&pdev->dev))
++		wufc = adapter->wol;
++	else
++		wufc = 0;
++
+ 	status = er32(STATUS);
+ 	if (status & E1000_STATUS_LU)
+ 		wufc &= ~E1000_WUFC_LNKC;
+@@ -6377,7 +6383,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime)
+ 		e1000e_igp3_phy_powerdown_workaround_ich8lan(&adapter->hw);
+ 	} else if ((hw->mac.type == e1000_pch_lpt) ||
+ 		   (hw->mac.type == e1000_pch_spt)) {
+-		if (!(wufc & (E1000_WUFC_EX | E1000_WUFC_MC | E1000_WUFC_BC)))
++		if (wufc && !(wufc & (E1000_WUFC_EX | E1000_WUFC_MC | E1000_WUFC_BC)))
+ 			/* ULP does not support wake from unicast, multicast
+ 			 * or broadcast.
+ 			 */
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+index f1956c4d02a0..d026da36e47e 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+@@ -339,7 +339,7 @@ static void qed_cxt_qm_iids(struct qed_hwfn *p_hwfn,
+ 		vf_tids += segs[NUM_TASK_PF_SEGMENTS].count;
+ 	}
+ 
+-	iids->vf_cids += vf_cids * p_mngr->vf_count;
++	iids->vf_cids = vf_cids;
+ 	iids->tids += vf_tids * p_mngr->vf_count;
+ 
+ 	DP_VERBOSE(p_hwfn, QED_MSG_ILT,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c
+index cf34908ec8e1..170243d3276b 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c
+@@ -57,12 +57,17 @@ static void qed_vf_pf_req_end(struct qed_hwfn *p_hwfn, int req_status)
+ 	mutex_unlock(&(p_hwfn->vf_iov_info->mutex));
+ }
+ 
++#define QED_VF_CHANNEL_USLEEP_ITERATIONS	90
++#define QED_VF_CHANNEL_USLEEP_DELAY		100
++#define QED_VF_CHANNEL_MSLEEP_ITERATIONS	10
++#define QED_VF_CHANNEL_MSLEEP_DELAY		25
++
+ static int qed_send_msg2pf(struct qed_hwfn *p_hwfn, u8 *done, u32 resp_size)
+ {
+ 	union vfpf_tlvs *p_req = p_hwfn->vf_iov_info->vf2pf_request;
+ 	struct ustorm_trigger_vf_zone trigger;
+ 	struct ustorm_vf_zone *zone_data;
+-	int rc = 0, time = 100;
++	int iter, rc = 0;
+ 
+ 	zone_data = (struct ustorm_vf_zone *)PXP_VF_BAR0_START_USDM_ZONE_B;
+ 
+@@ -102,11 +107,19 @@ static int qed_send_msg2pf(struct qed_hwfn *p_hwfn, u8 *done, u32 resp_size)
+ 	REG_WR(p_hwfn, (uintptr_t)&zone_data->trigger, *((u32 *)&trigger));
+ 
+ 	/* When PF would be done with the response, it would write back to the
+-	 * `done' address. Poll until then.
++	 * `done' address from a coherent DMA zone. Poll until then.
+ 	 */
+-	while ((!*done) && time) {
+-		msleep(25);
+-		time--;
++
++	iter = QED_VF_CHANNEL_USLEEP_ITERATIONS;
++	while (!*done && iter--) {
++		udelay(QED_VF_CHANNEL_USLEEP_DELAY);
++		dma_rmb();
++	}
++
++	iter = QED_VF_CHANNEL_MSLEEP_ITERATIONS;
++	while (!*done && iter--) {
++		msleep(QED_VF_CHANNEL_MSLEEP_DELAY);
++		dma_rmb();
+ 	}
+ 
+ 	if (!*done) {
+diff --git a/drivers/net/ethernet/rocker/rocker_main.c b/drivers/net/ethernet/rocker/rocker_main.c
+index 24b746406bc7..4640e6c4aecf 100644
+--- a/drivers/net/ethernet/rocker/rocker_main.c
++++ b/drivers/net/ethernet/rocker/rocker_main.c
+@@ -648,10 +648,10 @@ static int rocker_dma_rings_init(struct rocker *rocker)
+ err_dma_event_ring_bufs_alloc:
+ 	rocker_dma_ring_destroy(rocker, &rocker->event_ring);
+ err_dma_event_ring_create:
++	rocker_dma_cmd_ring_waits_free(rocker);
++err_dma_cmd_ring_waits_alloc:
+ 	rocker_dma_ring_bufs_free(rocker, &rocker->cmd_ring,
+ 				  PCI_DMA_BIDIRECTIONAL);
+-err_dma_cmd_ring_waits_alloc:
+-	rocker_dma_cmd_ring_waits_free(rocker);
+ err_dma_cmd_ring_bufs_alloc:
+ 	rocker_dma_ring_destroy(rocker, &rocker->cmd_ring);
+ 	return err;
+diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
+index aaff07c10058..a453b82d1077 100644
+--- a/drivers/net/hamradio/yam.c
++++ b/drivers/net/hamradio/yam.c
+@@ -1160,6 +1160,7 @@ static int __init yam_init_driver(void)
+ 		err = register_netdev(dev);
+ 		if (err) {
+ 			printk(KERN_WARNING "yam: cannot register net device %s\n", dev->name);
++			free_netdev(dev);
+ 			goto error;
+ 		}
+ 		yam_devs[i] = dev;
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index 559af8e6ad90..0434ecf67712 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1396,10 +1396,10 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ 		}
+ 
+ 		if (pkt_cnt == 0) {
+-			/* Skip IP alignment psudo header */
+-			skb_pull(skb, 2);
+ 			skb->len = pkt_len;
+-			skb_set_tail_pointer(skb, pkt_len);
++			/* Skip IP alignment pseudo header */
++			skb_pull(skb, 2);
++			skb_set_tail_pointer(skb, skb->len);
+ 			skb->truesize = pkt_len + sizeof(struct sk_buff);
+ 			ax88179_rx_checksum(skb, pkt_hdr);
+ 			return 1;
+@@ -1408,8 +1408,9 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ 		ax_skb = skb_clone(skb, GFP_ATOMIC);
+ 		if (ax_skb) {
+ 			ax_skb->len = pkt_len;
+-			ax_skb->data = skb->data + 2;
+-			skb_set_tail_pointer(ax_skb, pkt_len);
++			/* Skip IP alignment pseudo header */
++			skb_pull(ax_skb, 2);
++			skb_set_tail_pointer(ax_skb, ax_skb->len);
+ 			ax_skb->truesize = pkt_len + sizeof(struct sk_buff);
+ 			ax88179_rx_checksum(ax_skb, pkt_hdr);
+ 			usbnet_skb_return(dev, ax_skb);
+diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
+index 1dbd09c91a7c..736d9f58438e 100644
+--- a/drivers/pci/host/pci-aardvark.c
++++ b/drivers/pci/host/pci-aardvark.c
+@@ -363,10 +363,6 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
+ 
+ 	advk_pcie_wait_for_link(pcie);
+ 
+-	reg = PCIE_CORE_LINK_L0S_ENTRY |
+-		(1 << PCIE_CORE_LINK_WIDTH_SHIFT);
+-	advk_writel(pcie, reg, PCIE_CORE_LINK_CTRL_STAT_REG);
+-
+ 	reg = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG);
+ 	reg |= PCIE_CORE_CMD_MEM_ACCESS_EN |
+ 		PCIE_CORE_CMD_IO_ACCESS_EN |
+diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c
+index 7f6b454bca65..3ff423220df6 100644
+--- a/drivers/pci/host/pcie-rcar.c
++++ b/drivers/pci/host/pcie-rcar.c
+@@ -328,11 +328,12 @@ static struct pci_ops rcar_pcie_ops = {
+ };
+ 
+ static void rcar_pcie_setup_window(int win, struct rcar_pcie *pcie,
+-				   struct resource *res)
++				   struct resource_entry *window)
+ {
+ 	/* Setup PCIe address space mappings for each resource */
+ 	resource_size_t size;
+ 	resource_size_t res_start;
++	struct resource *res = window->res;
+ 	u32 mask;
+ 
+ 	rcar_pci_write_reg(pcie, 0x00000000, PCIEPTCTLR(win));
+@@ -346,9 +347,9 @@ static void rcar_pcie_setup_window(int win, struct rcar_pcie *pcie,
+ 	rcar_pci_write_reg(pcie, mask << 7, PCIEPAMR(win));
+ 
+ 	if (res->flags & IORESOURCE_IO)
+-		res_start = pci_pio_to_address(res->start);
++		res_start = pci_pio_to_address(res->start) - window->offset;
+ 	else
+-		res_start = res->start;
++		res_start = res->start - window->offset;
+ 
+ 	rcar_pci_write_reg(pcie, upper_32_bits(res_start), PCIEPAUR(win));
+ 	rcar_pci_write_reg(pcie, lower_32_bits(res_start) & ~0x7F,
+@@ -377,7 +378,7 @@ static int rcar_pcie_setup(struct list_head *resource, struct rcar_pcie *pci)
+ 		switch (resource_type(res)) {
+ 		case IORESOURCE_IO:
+ 		case IORESOURCE_MEM:
+-			rcar_pcie_setup_window(i, pci, res);
++			rcar_pcie_setup_window(i, pci, win);
+ 			i++;
+ 			break;
+ 		case IORESOURCE_BUS:
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 4a5fde58974a..75551a781e88 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -410,16 +410,6 @@ static void pcie_aspm_cap_init(struct pcie_link_state *link, int blacklist)
+ 
+ 	/* Setup initial capable state. Will be updated later */
+ 	link->aspm_capable = link->aspm_support;
+-	/*
+-	 * If the downstream component has pci bridge function, don't
+-	 * do ASPM for now.
+-	 */
+-	list_for_each_entry(child, &linkbus->devices, bus_list) {
+-		if (pci_pcie_type(child) == PCI_EXP_TYPE_PCI_BRIDGE) {
+-			link->aspm_disable = ASPM_STATE_ALL;
+-			break;
+-		}
+-	}
+ 
+ 	/* Get and check endpoint acceptable latencies */
+ 	list_for_each_entry(child, &linkbus->devices, bus_list) {
+diff --git a/drivers/pci/pcie/ptm.c b/drivers/pci/pcie/ptm.c
+index 3008bba360f3..ec6f6213960b 100644
+--- a/drivers/pci/pcie/ptm.c
++++ b/drivers/pci/pcie/ptm.c
+@@ -47,10 +47,6 @@ void pci_ptm_init(struct pci_dev *dev)
+ 	if (!pci_is_pcie(dev))
+ 		return;
+ 
+-	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_PTM);
+-	if (!pos)
+-		return;
+-
+ 	/*
+ 	 * Enable PTM only on interior devices (root ports, switch ports,
+ 	 * etc.) on the assumption that it causes no link traffic until an
+@@ -60,6 +56,23 @@ void pci_ptm_init(struct pci_dev *dev)
+ 	     pci_pcie_type(dev) == PCI_EXP_TYPE_RC_END))
+ 		return;
+ 
++	/*
++	 * Switch Downstream Ports are not permitted to have a PTM
++	 * capability; their PTM behavior is controlled by the Upstream
++	 * Port (PCIe r5.0, sec 7.9.16).
++	 */
++	ups = pci_upstream_bridge(dev);
++	if (pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM &&
++	    ups && ups->ptm_enabled) {
++		dev->ptm_granularity = ups->ptm_granularity;
++		dev->ptm_enabled = 1;
++		return;
++	}
++
++	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_PTM);
++	if (!pos)
++		return;
++
+ 	pci_read_config_dword(dev, pos + PCI_PTM_CAP, &cap);
+ 	local_clock = (cap & PCI_PTM_GRANULARITY_MASK) >> 8;
+ 
+@@ -69,7 +82,6 @@ void pci_ptm_init(struct pci_dev *dev)
+ 	 * the spec recommendation (PCIe r3.1, sec 7.32.3), select the
+ 	 * furthest upstream Time Source as the PTM Root.
+ 	 */
+-	ups = pci_upstream_bridge(dev);
+ 	if (ups && ups->ptm_enabled) {
+ 		ctrl = PCI_PTM_CTRL_ENABLE;
+ 		if (ups->ptm_granularity == 0)
+diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+index e2cca91fd266..68108c4c3969 100644
+--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c
++++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+@@ -642,7 +642,6 @@ int imx1_pinctrl_core_probe(struct platform_device *pdev,
+ 
+ 	ret = of_platform_populate(pdev->dev.of_node, NULL, NULL, &pdev->dev);
+ 	if (ret) {
+-		pinctrl_unregister(ipctl->pctl);
+ 		dev_err(&pdev->dev, "Failed to populate subdevices\n");
+ 		return ret;
+ 	}
+diff --git a/drivers/power/supply/Kconfig b/drivers/power/supply/Kconfig
+index 76806a0be820..0de9a958b29a 100644
+--- a/drivers/power/supply/Kconfig
++++ b/drivers/power/supply/Kconfig
+@@ -424,7 +424,7 @@ config CHARGER_BQ24257
+ 	tristate "TI BQ24250/24251/24257 battery charger driver"
+ 	depends on I2C
+ 	depends on GPIOLIB || COMPILE_TEST
+-	depends on REGMAP_I2C
++	select REGMAP_I2C
+ 	help
+ 	  Say Y to enable support for the TI BQ24250, BQ24251, and BQ24257 battery
+ 	  chargers.
+diff --git a/drivers/power/supply/lp8788-charger.c b/drivers/power/supply/lp8788-charger.c
+index cd614fe69d14..c3075ea011b6 100644
+--- a/drivers/power/supply/lp8788-charger.c
++++ b/drivers/power/supply/lp8788-charger.c
+@@ -603,27 +603,14 @@ static void lp8788_setup_adc_channel(struct device *dev,
+ 		return;
+ 
+ 	/* ADC channel for battery voltage */
+-	chan = iio_channel_get(dev, pdata->adc_vbatt);
++	chan = devm_iio_channel_get(dev, pdata->adc_vbatt);
+ 	pchg->chan[LP8788_VBATT] = IS_ERR(chan) ? NULL : chan;
+ 
+ 	/* ADC channel for battery temperature */
+-	chan = iio_channel_get(dev, pdata->adc_batt_temp);
++	chan = devm_iio_channel_get(dev, pdata->adc_batt_temp);
+ 	pchg->chan[LP8788_BATT_TEMP] = IS_ERR(chan) ? NULL : chan;
+ }
+ 
+-static void lp8788_release_adc_channel(struct lp8788_charger *pchg)
+-{
+-	int i;
+-
+-	for (i = 0; i < LP8788_NUM_CHG_ADC; i++) {
+-		if (!pchg->chan[i])
+-			continue;
+-
+-		iio_channel_release(pchg->chan[i]);
+-		pchg->chan[i] = NULL;
+-	}
+-}
+-
+ static ssize_t lp8788_show_charger_status(struct device *dev,
+ 				struct device_attribute *attr, char *buf)
+ {
+@@ -744,7 +731,6 @@ static int lp8788_charger_remove(struct platform_device *pdev)
+ 	lp8788_irq_unregister(pdev, pchg);
+ 	sysfs_remove_group(&pdev->dev.kobj, &lp8788_attr_group);
+ 	lp8788_psy_unregister(pchg);
+-	lp8788_release_adc_channel(pchg);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/power/supply/smb347-charger.c b/drivers/power/supply/smb347-charger.c
+index 072c5189bd6d..0655dbdc7000 100644
+--- a/drivers/power/supply/smb347-charger.c
++++ b/drivers/power/supply/smb347-charger.c
+@@ -1141,6 +1141,7 @@ static bool smb347_volatile_reg(struct device *dev, unsigned int reg)
+ 	switch (reg) {
+ 	case IRQSTAT_A:
+ 	case IRQSTAT_C:
++	case IRQSTAT_D:
+ 	case IRQSTAT_E:
+ 	case IRQSTAT_F:
+ 	case STAT_A:
+diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h
+index 7e70f9298cc1..11f6ebd04545 100644
+--- a/drivers/s390/cio/qdio.h
++++ b/drivers/s390/cio/qdio.h
+@@ -376,7 +376,6 @@ static inline int multicast_outbound(struct qdio_q *q)
+ extern u64 last_ai_time;
+ 
+ /* prototypes for thin interrupt */
+-void qdio_setup_thinint(struct qdio_irq *irq_ptr);
+ int qdio_establish_thinint(struct qdio_irq *irq_ptr);
+ void qdio_shutdown_thinint(struct qdio_irq *irq_ptr);
+ void tiqdio_add_input_queues(struct qdio_irq *irq_ptr);
+diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
+index d0090c5c88e7..a64615a10352 100644
+--- a/drivers/s390/cio/qdio_setup.c
++++ b/drivers/s390/cio/qdio_setup.c
+@@ -479,7 +479,6 @@ int qdio_setup_irq(struct qdio_initialize *init_data)
+ 	setup_queues(irq_ptr, init_data);
+ 
+ 	setup_qib(irq_ptr, init_data);
+-	qdio_setup_thinint(irq_ptr);
+ 	set_impl_params(irq_ptr, init_data->qib_param_field_format,
+ 			init_data->qib_param_field,
+ 			init_data->input_slib_elements,
+diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
+index debe69adfc70..aecb6445a567 100644
+--- a/drivers/s390/cio/qdio_thinint.c
++++ b/drivers/s390/cio/qdio_thinint.c
+@@ -268,17 +268,19 @@ int __init tiqdio_register_thinints(void)
+ 
+ int qdio_establish_thinint(struct qdio_irq *irq_ptr)
+ {
++	int rc;
++
+ 	if (!is_thinint_irq(irq_ptr))
+ 		return 0;
+-	return set_subchannel_ind(irq_ptr, 0);
+-}
+ 
+-void qdio_setup_thinint(struct qdio_irq *irq_ptr)
+-{
+-	if (!is_thinint_irq(irq_ptr))
+-		return;
+ 	irq_ptr->dsci = get_indicator();
+ 	DBF_HEX(&irq_ptr->dsci, sizeof(void *));
++
++	rc = set_subchannel_ind(irq_ptr, 0);
++	if (rc)
++		put_indicator(irq_ptr->dsci);
++
++	return rc;
+ }
+ 
+ void qdio_shutdown_thinint(struct qdio_irq *irq_ptr)
+diff --git a/drivers/scsi/arm/acornscsi.c b/drivers/scsi/arm/acornscsi.c
+index 12b88294d667..76ad20e49126 100644
+--- a/drivers/scsi/arm/acornscsi.c
++++ b/drivers/scsi/arm/acornscsi.c
+@@ -2913,8 +2913,10 @@ static int acornscsi_probe(struct expansion_card *ec, const struct ecard_id *id)
+ 
+ 	ashost->base = ecardm_iomap(ec, ECARD_RES_MEMC, 0, 0);
+ 	ashost->fast = ecardm_iomap(ec, ECARD_RES_IOCFAST, 0, 0);
+-	if (!ashost->base || !ashost->fast)
++	if (!ashost->base || !ashost->fast) {
++		ret = -ENOMEM;
+ 		goto out_put;
++	}
+ 
+ 	host->irq = ec->irq;
+ 	ashost->host = host;
+diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
+index e1730227b448..f299839698a3 100644
+--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
+@@ -425,6 +425,8 @@ static int ibmvscsi_reenable_crq_queue(struct crq_queue *queue,
+ 	int rc = 0;
+ 	struct vio_dev *vdev = to_vio_dev(hostdata->dev);
+ 
++	set_adapter_info(hostdata);
++
+ 	/* Re-enable the CRQ */
+ 	do {
+ 		if (rc)
+diff --git a/drivers/scsi/iscsi_boot_sysfs.c b/drivers/scsi/iscsi_boot_sysfs.c
+index d453667612f8..15d64f96e623 100644
+--- a/drivers/scsi/iscsi_boot_sysfs.c
++++ b/drivers/scsi/iscsi_boot_sysfs.c
+@@ -360,7 +360,7 @@ iscsi_boot_create_kobj(struct iscsi_boot_kset *boot_kset,
+ 	boot_kobj->kobj.kset = boot_kset->kset;
+ 	if (kobject_init_and_add(&boot_kobj->kobj, &iscsi_boot_ktype,
+ 				 NULL, name, index)) {
+-		kfree(boot_kobj);
++		kobject_put(&boot_kobj->kobj);
+ 		return NULL;
+ 	}
+ 	boot_kobj->data = data;
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 4901bf24916b..09dbf3021bb0 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -7606,6 +7606,8 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
+ 	spin_lock_irq(shost->host_lock);
+ 	if (ndlp->nlp_flag & NLP_IN_DEV_LOSS) {
+ 		spin_unlock_irq(shost->host_lock);
++		if (newnode)
++			lpfc_nlp_put(ndlp);
+ 		goto dropit;
+ 	}
+ 	spin_unlock_irq(shost->host_lock);
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 6ccde2b41517..601a93953307 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -3166,7 +3166,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
+ 		ioc->scsi_lookup = NULL;
+ 	}
+ 	kfree(ioc->hpr_lookup);
++	ioc->hpr_lookup = NULL;
+ 	kfree(ioc->internal_lookup);
++	ioc->internal_lookup = NULL;
+ 	if (ioc->chain_lookup) {
+ 		for (i = 0; i < ioc->chain_depth; i++) {
+ 			if (ioc->chain_lookup[i].chain_buffer)
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index abdd6f93c8fe..324cddd4656e 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -855,6 +855,7 @@ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item,
+ 
+ 		atomic_set(&tpg->lport_tpg_enabled, 0);
+ 		qlt_stop_phase1(vha->vha_tgt.qla_tgt);
++		qlt_stop_phase2(vha->vha_tgt.qla_tgt);
+ 	}
+ 
+ 	return count;
+@@ -1019,6 +1020,7 @@ static ssize_t tcm_qla2xxx_npiv_tpg_enable_store(struct config_item *item,
+ 
+ 		atomic_set(&tpg->lport_tpg_enabled, 0);
+ 		qlt_stop_phase1(vha->vha_tgt.qla_tgt);
++		qlt_stop_phase2(vha->vha_tgt.qla_tgt);
+ 	}
+ 
+ 	return count;
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index d596b76eea64..aad9195b356a 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -451,7 +451,8 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
+ 			/*
+ 			 * vendor strings must be an exact match
+ 			 */
+-			if (vmax != strlen(devinfo->vendor) ||
++			if (vmax != strnlen(devinfo->vendor,
++					    sizeof(devinfo->vendor)) ||
+ 			    memcmp(devinfo->vendor, vskip, vmax))
+ 				continue;
+ 
+@@ -459,7 +460,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
+ 			 * @model specifies the full string, and
+ 			 * must be larger or equal to devinfo->model
+ 			 */
+-			mlen = strlen(devinfo->model);
++			mlen = strnlen(devinfo->model, sizeof(devinfo->model));
+ 			if (mmax < mlen || memcmp(devinfo->model, mskip, mlen))
+ 				continue;
+ 			return devinfo;
+diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
+index cc484cb287d2..67a73ea0a615 100644
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -745,7 +745,7 @@ static int sr_probe(struct device *dev)
+ 	cd->cdi.disk = disk;
+ 
+ 	if (register_cdrom(&cd->cdi))
+-		goto fail_put;
++		goto fail_minor;
+ 
+ 	/*
+ 	 * Initialize block layer runtime PM stuffs before the
+@@ -763,6 +763,10 @@ static int sr_probe(struct device *dev)
+ 
+ 	return 0;
+ 
++fail_minor:
++	spin_lock(&sr_index_lock);
++	clear_bit(minor, sr_index_bits);
++	spin_unlock(&sr_index_lock);
+ fail_put:
+ 	put_disk(disk);
+ fail_free:
+diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
+index 86ace1449309..ee54711cf8e8 100644
+--- a/drivers/staging/sm750fb/sm750.c
++++ b/drivers/staging/sm750fb/sm750.c
+@@ -897,6 +897,7 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
+ 		fix->visual = FB_VISUAL_PSEUDOCOLOR;
+ 		break;
+ 	case 16:
++	case 24:
+ 	case 32:
+ 		fix->visual = FB_VISUAL_TRUECOLOR;
+ 		break;
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index 9e9016e67843..1ab9bd433542 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -681,11 +681,10 @@ static struct gsm_msg *gsm_data_alloc(struct gsm_mux *gsm, u8 addr, int len,
+  *	FIXME: lock against link layer control transmissions
+  */
+ 
+-static void gsm_data_kick(struct gsm_mux *gsm)
++static void gsm_data_kick(struct gsm_mux *gsm, struct gsm_dlci *dlci)
+ {
+ 	struct gsm_msg *msg, *nmsg;
+ 	int len;
+-	int skip_sof = 0;
+ 
+ 	list_for_each_entry_safe(msg, nmsg, &gsm->tx_list, list) {
+ 		if (gsm->constipated && msg->addr)
+@@ -707,18 +706,23 @@ static void gsm_data_kick(struct gsm_mux *gsm)
+ 			print_hex_dump_bytes("gsm_data_kick: ",
+ 					     DUMP_PREFIX_OFFSET,
+ 					     gsm->txframe, len);
+-
+-		if (gsm->output(gsm, gsm->txframe + skip_sof,
+-						len - skip_sof) < 0)
++		if (gsm->output(gsm, gsm->txframe, len) < 0)
+ 			break;
+ 		/* FIXME: Can eliminate one SOF in many more cases */
+ 		gsm->tx_bytes -= msg->len;
+-		/* For a burst of frames skip the extra SOF within the
+-		   burst */
+-		skip_sof = 1;
+ 
+ 		list_del(&msg->list);
+ 		kfree(msg);
++
++		if (dlci) {
++			tty_port_tty_wakeup(&dlci->port);
++		} else {
++			int i = 0;
++
++			for (i = 0; i < NUM_DLCI; i++)
++				if (gsm->dlci[i])
++					tty_port_tty_wakeup(&gsm->dlci[i]->port);
++		}
+ 	}
+ }
+ 
+@@ -770,7 +774,7 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)
+ 	/* Add to the actual output queue */
+ 	list_add_tail(&msg->list, &gsm->tx_list);
+ 	gsm->tx_bytes += msg->len;
+-	gsm_data_kick(gsm);
++	gsm_data_kick(gsm, dlci);
+ }
+ 
+ /**
+@@ -1231,7 +1235,7 @@ static void gsm_control_message(struct gsm_mux *gsm, unsigned int command,
+ 		gsm_control_reply(gsm, CMD_FCON, NULL, 0);
+ 		/* Kick the link in case it is idling */
+ 		spin_lock_irqsave(&gsm->tx_lock, flags);
+-		gsm_data_kick(gsm);
++		gsm_data_kick(gsm, NULL);
+ 		spin_unlock_irqrestore(&gsm->tx_lock, flags);
+ 		break;
+ 	case CMD_FCOFF:
+@@ -2414,7 +2418,7 @@ static void gsmld_write_wakeup(struct tty_struct *tty)
+ 	/* Queue poll */
+ 	clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+ 	spin_lock_irqsave(&gsm->tx_lock, flags);
+-	gsm_data_kick(gsm);
++	gsm_data_kick(gsm, NULL);
+ 	if (gsm->tx_bytes < TX_THRESH_LO) {
+ 		gsm_dlci_data_sweep(gsm);
+ 	}
+diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
+index f6586a8681b9..b3b9b3d2cddf 100644
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -2524,6 +2524,7 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap,
+ 	uap->port.fifosize = uap->fifosize;
+ 	uap->port.flags = UPF_BOOT_AUTOCONF;
+ 	uap->port.line = index;
++	spin_lock_init(&uap->port.lock);
+ 
+ 	amba_ports[index] = uap;
+ 
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 5b0bffba4aac..2dc563b61b88 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1627,6 +1627,8 @@ static int acm_reset_resume(struct usb_interface *intf)
+ 
+ static const struct usb_device_id acm_ids[] = {
+ 	/* quirky and broken devices */
++	{ USB_DEVICE(0x0424, 0x274e), /* Microchip Technology, Inc. (formerly SMSC) */
++	  .driver_info = DISABLE_ECHO, }, /* DISABLE ECHO in termios flag */
+ 	{ USB_DEVICE(0x076d, 0x0006), /* Denso Cradle CU-321 */
+ 	.driver_info = NO_UNION_NORMAL, },/* has no union descriptor */
+ 	{ USB_DEVICE(0x17ef, 0x7000), /* Lenovo USB modem */
+diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
+index 07c3c3449147..c578d64edc15 100644
+--- a/drivers/usb/class/usblp.c
++++ b/drivers/usb/class/usblp.c
+@@ -481,7 +481,8 @@ static int usblp_release(struct inode *inode, struct file *file)
+ 	usb_autopm_put_interface(usblp->intf);
+ 
+ 	if (!usblp->present)		/* finish cleanup from disconnect */
+-		usblp_cleanup(usblp);
++		usblp_cleanup(usblp);	/* any URBs must be dead */
++
+ 	mutex_unlock(&usblp_mutex);
+ 	return 0;
+ }
+@@ -1397,9 +1398,11 @@ static void usblp_disconnect(struct usb_interface *intf)
+ 
+ 	usblp_unlink_urbs(usblp);
+ 	mutex_unlock(&usblp->mut);
++	usb_poison_anchored_urbs(&usblp->urbs);
+ 
+ 	if (!usblp->used)
+ 		usblp_cleanup(usblp);
++
+ 	mutex_unlock(&usblp_mutex);
+ }
+ 
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 27d05f0134de..e6e0f786547b 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -73,11 +73,12 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Logitech HD Webcam C270 */
+ 	{ USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+-	/* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
++	/* Logitech HD Pro Webcams C920, C920-C, C922, C925e and C930e */
+ 	{ USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+ 	{ USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
+ 	{ USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
+ 	{ USB_DEVICE(0x046d, 0x085b), .driver_info = USB_QUIRK_DELAY_INIT },
++	{ USB_DEVICE(0x046d, 0x085c), .driver_info = USB_QUIRK_DELAY_INIT },
+ 
+ 	/* Logitech ConferenceCam CC3000e */
+ 	{ USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
+diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c
+index d85c5c9f96c1..f046703f63f2 100644
+--- a/drivers/usb/dwc2/core_intr.c
++++ b/drivers/usb/dwc2/core_intr.c
+@@ -365,10 +365,13 @@ static void dwc2_handle_wakeup_detected_intr(struct dwc2_hsotg *hsotg)
+ 			if (ret && (ret != -ENOTSUPP))
+ 				dev_err(hsotg->dev, "exit hibernation failed\n");
+ 
++			/* Change to L0 state */
++			hsotg->lx_state = DWC2_L0;
+ 			call_gadget(hsotg, resume);
++		} else {
++			/* Change to L0 state */
++			hsotg->lx_state = DWC2_L0;
+ 		}
+-		/* Change to L0 state */
+-		hsotg->lx_state = DWC2_L0;
+ 	} else {
+ 		if (hsotg->core_params->hibernation)
+ 			return;
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 3ae27b6ed07c..9381a108a985 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -3947,12 +3947,6 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg, int irq)
+ 								epnum, 0);
+ 	}
+ 
+-	ret = usb_add_gadget_udc(dev, &hsotg->gadget);
+-	if (ret) {
+-		dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep,
+-					   hsotg->ctrl_req);
+-		return ret;
+-	}
+ 	dwc2_hsotg_dump(hsotg);
+ 
+ 	return 0;
+diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
+index 8e1728b39a49..63178ed7f650 100644
+--- a/drivers/usb/dwc2/platform.c
++++ b/drivers/usb/dwc2/platform.c
+@@ -661,6 +661,17 @@ static int dwc2_driver_probe(struct platform_device *dev)
+ 	if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL)
+ 		dwc2_lowlevel_hw_disable(hsotg);
+ 
++#if IS_ENABLED(CONFIG_USB_DWC2_PERIPHERAL) || \
++	IS_ENABLED(CONFIG_USB_DWC2_DUAL_ROLE)
++	/* Postponed adding a new gadget to the udc class driver list */
++	if (hsotg->gadget_enabled) {
++		retval = usb_add_gadget_udc(hsotg->dev, &hsotg->gadget);
++		if (retval) {
++			dwc2_hsotg_remove(hsotg);
++			goto error;
++		}
++	}
++#endif /* CONFIG_USB_DWC2_PERIPHERAL || CONFIG_USB_DWC2_DUAL_ROLE */
+ 	return 0;
+ 
+ error:
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index 2e545d025030..5a1723d99fe5 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -100,40 +100,43 @@ function_descriptors(struct usb_function *f,
+ }
+ 
+ /**
+- * next_ep_desc() - advance to the next EP descriptor
++ * next_desc() - advance to the next desc_type descriptor
+  * @t: currect pointer within descriptor array
++ * @desc_type: descriptor type
+  *
+- * Return: next EP descriptor or NULL
++ * Return: next desc_type descriptor or NULL
+  *
+- * Iterate over @t until either EP descriptor found or
++ * Iterate over @t until either desc_type descriptor found or
+  * NULL (that indicates end of list) encountered
+  */
+ static struct usb_descriptor_header**
+-next_ep_desc(struct usb_descriptor_header **t)
++next_desc(struct usb_descriptor_header **t, u8 desc_type)
+ {
+ 	for (; *t; t++) {
+-		if ((*t)->bDescriptorType == USB_DT_ENDPOINT)
++		if ((*t)->bDescriptorType == desc_type)
+ 			return t;
+ 	}
+ 	return NULL;
+ }
+ 
+ /*
+- * for_each_ep_desc()- iterate over endpoint descriptors in the
+- *		descriptors list
+- * @start:	pointer within descriptor array.
+- * @ep_desc:	endpoint descriptor to use as the loop cursor
++ * for_each_desc() - iterate over desc_type descriptors in the
++ * descriptors list
++ * @start: pointer within descriptor array.
++ * @iter_desc: desc_type descriptor to use as the loop cursor
++ * @desc_type: wanted descriptr type
+  */
+-#define for_each_ep_desc(start, ep_desc) \
+-	for (ep_desc = next_ep_desc(start); \
+-	      ep_desc; ep_desc = next_ep_desc(ep_desc+1))
++#define for_each_desc(start, iter_desc, desc_type) \
++	for (iter_desc = next_desc(start, desc_type); \
++	     iter_desc; iter_desc = next_desc(iter_desc + 1, desc_type))
+ 
+ /**
+- * config_ep_by_speed() - configures the given endpoint
++ * config_ep_by_speed_and_alt() - configures the given endpoint
+  * according to gadget speed.
+  * @g: pointer to the gadget
+  * @f: usb function
+  * @_ep: the endpoint to configure
++ * @alt: alternate setting number
+  *
+  * Return: error code, 0 on success
+  *
+@@ -146,11 +149,13 @@ next_ep_desc(struct usb_descriptor_header **t)
+  * Note: the supplied function should hold all the descriptors
+  * for supported speeds
+  */
+-int config_ep_by_speed(struct usb_gadget *g,
+-			struct usb_function *f,
+-			struct usb_ep *_ep)
++int config_ep_by_speed_and_alt(struct usb_gadget *g,
++				struct usb_function *f,
++				struct usb_ep *_ep,
++				u8 alt)
+ {
+ 	struct usb_endpoint_descriptor *chosen_desc = NULL;
++	struct usb_interface_descriptor *int_desc = NULL;
+ 	struct usb_descriptor_header **speed_desc = NULL;
+ 
+ 	struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
+@@ -186,8 +191,21 @@ int config_ep_by_speed(struct usb_gadget *g,
+ 	default:
+ 		speed_desc = f->fs_descriptors;
+ 	}
++
++	/* find correct alternate setting descriptor */
++	for_each_desc(speed_desc, d_spd, USB_DT_INTERFACE) {
++		int_desc = (struct usb_interface_descriptor *)*d_spd;
++
++		if (int_desc->bAlternateSetting == alt) {
++			speed_desc = d_spd;
++			goto intf_found;
++		}
++	}
++	return -EIO;
++
++intf_found:
+ 	/* find descriptors */
+-	for_each_ep_desc(speed_desc, d_spd) {
++	for_each_desc(speed_desc, d_spd, USB_DT_ENDPOINT) {
+ 		chosen_desc = (struct usb_endpoint_descriptor *)*d_spd;
+ 		if (chosen_desc->bEndpointAddress == _ep->address)
+ 			goto ep_found;
+@@ -240,6 +258,32 @@ ep_found:
+ 	}
+ 	return 0;
+ }
++EXPORT_SYMBOL_GPL(config_ep_by_speed_and_alt);
++
++/**
++ * config_ep_by_speed() - configures the given endpoint
++ * according to gadget speed.
++ * @g: pointer to the gadget
++ * @f: usb function
++ * @_ep: the endpoint to configure
++ *
++ * Return: error code, 0 on success
++ *
++ * This function chooses the right descriptors for a given
++ * endpoint according to gadget speed and saves it in the
++ * endpoint desc field. If the endpoint already has a descriptor
++ * assigned to it - overwrites it with currently corresponding
++ * descriptor. The endpoint maxpacket field is updated according
++ * to the chosen descriptor.
++ * Note: the supplied function should hold all the descriptors
++ * for supported speeds
++ */
++int config_ep_by_speed(struct usb_gadget *g,
++			struct usb_function *f,
++			struct usb_ep *_ep)
++{
++	return config_ep_by_speed_and_alt(g, f, _ep, 0);
++}
+ EXPORT_SYMBOL_GPL(config_ep_by_speed);
+ 
+ /**
+diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
+index ac2aa04ca657..710793161795 100644
+--- a/drivers/usb/gadget/udc/lpc32xx_udc.c
++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
+@@ -1615,17 +1615,17 @@ static int lpc32xx_ep_enable(struct usb_ep *_ep,
+ 			     const struct usb_endpoint_descriptor *desc)
+ {
+ 	struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep);
+-	struct lpc32xx_udc *udc = ep->udc;
++	struct lpc32xx_udc *udc;
+ 	u16 maxpacket;
+ 	u32 tmp;
+ 	unsigned long flags;
+ 
+ 	/* Verify EP data */
+ 	if ((!_ep) || (!ep) || (!desc) ||
+-	    (desc->bDescriptorType != USB_DT_ENDPOINT)) {
+-		dev_dbg(udc->dev, "bad ep or descriptor\n");
++	    (desc->bDescriptorType != USB_DT_ENDPOINT))
+ 		return -EINVAL;
+-	}
++
++	udc = ep->udc;
+ 	maxpacket = usb_endpoint_maxp(desc);
+ 	if ((maxpacket == 0) || (maxpacket > ep->maxpacket)) {
+ 		dev_dbg(udc->dev, "bad ep descriptor's packet size\n");
+@@ -1873,7 +1873,7 @@ static int lpc32xx_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+ static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value)
+ {
+ 	struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep);
+-	struct lpc32xx_udc *udc = ep->udc;
++	struct lpc32xx_udc *udc;
+ 	unsigned long flags;
+ 
+ 	if ((!ep) || (ep->hwep_num <= 1))
+@@ -1883,6 +1883,7 @@ static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value)
+ 	if (ep->is_in)
+ 		return -EAGAIN;
+ 
++	udc = ep->udc;
+ 	spin_lock_irqsave(&udc->lock, flags);
+ 
+ 	if (value == 1) {
+diff --git a/drivers/usb/gadget/udc/m66592-udc.c b/drivers/usb/gadget/udc/m66592-udc.c
+index 6e977dc22570..1be409644a48 100644
+--- a/drivers/usb/gadget/udc/m66592-udc.c
++++ b/drivers/usb/gadget/udc/m66592-udc.c
+@@ -1672,7 +1672,7 @@ static int m66592_probe(struct platform_device *pdev)
+ 
+ err_add_udc:
+ 	m66592_free_request(&m66592->ep[0].ep, m66592->ep0_req);
+-
++	m66592->ep0_req = NULL;
+ clean_up3:
+ 	if (m66592->pdata->on_chip) {
+ 		clk_disable(m66592->clk);
+diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c
+index ce73b3552269..8700db903382 100644
+--- a/drivers/usb/gadget/udc/mv_udc_core.c
++++ b/drivers/usb/gadget/udc/mv_udc_core.c
+@@ -2317,7 +2317,8 @@ static int mv_udc_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ err_create_workqueue:
+-	destroy_workqueue(udc->qwork);
++	if (udc->qwork)
++		destroy_workqueue(udc->qwork);
+ err_destroy_dma:
+ 	dma_pool_destroy(udc->dtd_pool);
+ err_free_dma:
+diff --git a/drivers/usb/gadget/udc/s3c2410_udc.c b/drivers/usb/gadget/udc/s3c2410_udc.c
+index eb3571ee59e3..08153a48704b 100644
+--- a/drivers/usb/gadget/udc/s3c2410_udc.c
++++ b/drivers/usb/gadget/udc/s3c2410_udc.c
+@@ -269,10 +269,6 @@ static void s3c2410_udc_done(struct s3c2410_ep *ep,
+ static void s3c2410_udc_nuke(struct s3c2410_udc *udc,
+ 		struct s3c2410_ep *ep, int status)
+ {
+-	/* Sanity check */
+-	if (&ep->queue == NULL)
+-		return;
+-
+ 	while (!list_empty(&ep->queue)) {
+ 		struct s3c2410_request *req;
+ 		req = list_entry(ep->queue.next, struct s3c2410_request,
+diff --git a/drivers/usb/host/ehci-exynos.c b/drivers/usb/host/ehci-exynos.c
+index 7a603f66a9bc..44b7c3e780f6 100644
+--- a/drivers/usb/host/ehci-exynos.c
++++ b/drivers/usb/host/ehci-exynos.c
+@@ -199,9 +199,8 @@ skip_phy:
+ 	hcd->rsrc_len = resource_size(res);
+ 
+ 	irq = platform_get_irq(pdev, 0);
+-	if (!irq) {
+-		dev_err(&pdev->dev, "Failed to get IRQ\n");
+-		err = -ENODEV;
++	if (irq < 0) {
++		err = irq;
+ 		goto fail_io;
+ 	}
+ 
+diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
+index c7a9b31eeaef..637079a35003 100644
+--- a/drivers/usb/host/ehci-mxc.c
++++ b/drivers/usb/host/ehci-mxc.c
+@@ -63,6 +63,8 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	irq = platform_get_irq(pdev, 0);
++	if (irq < 0)
++		return irq;
+ 
+ 	hcd = usb_create_hcd(&ehci_mxc_hc_driver, dev, dev_name(dev));
+ 	if (!hcd)
+diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
+index 3b3649d88c5f..08b3f8c80601 100644
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -229,6 +229,13 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
+ 		ehci_info(ehci, "applying MosChip frame-index workaround\n");
+ 		ehci->frame_index_bug = 1;
+ 		break;
++	case PCI_VENDOR_ID_HUAWEI:
++		/* Synopsys HC bug */
++		if (pdev->device == 0xa239) {
++			ehci_info(ehci, "applying Synopsys HC workaround\n");
++			ehci->has_synopsys_hc_bug = 1;
++		}
++		break;
+ 	}
+ 
+ 	/* optional debug port, normally in the first BAR */
+diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
+index a268d9e8d6cf..1b141e9299f9 100644
+--- a/drivers/usb/host/ehci-platform.c
++++ b/drivers/usb/host/ehci-platform.c
+@@ -378,6 +378,11 @@ static int ehci_platform_resume(struct device *dev)
+ 	}
+ 
+ 	ehci_resume(hcd, priv->reset_on_resume);
++
++	pm_runtime_disable(dev);
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++
+ 	return 0;
+ }
+ #endif /* CONFIG_PM_SLEEP */
+diff --git a/drivers/usb/host/ohci-platform.c b/drivers/usb/host/ohci-platform.c
+index 898b74086c12..9e3fdb1421f7 100644
+--- a/drivers/usb/host/ohci-platform.c
++++ b/drivers/usb/host/ohci-platform.c
+@@ -340,6 +340,11 @@ static int ohci_platform_resume(struct device *dev)
+ 	}
+ 
+ 	ohci_resume(hcd, false);
++
++	pm_runtime_disable(dev);
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++
+ 	return 0;
+ }
+ #endif /* CONFIG_PM_SLEEP */
+diff --git a/drivers/usb/host/ohci-sm501.c b/drivers/usb/host/ohci-sm501.c
+index a8b8d8b8d9f3..a960d2bb8dd1 100644
+--- a/drivers/usb/host/ohci-sm501.c
++++ b/drivers/usb/host/ohci-sm501.c
+@@ -196,6 +196,7 @@ static int ohci_hcd_sm501_drv_remove(struct platform_device *pdev)
+ 	struct resource	*mem;
+ 
+ 	usb_remove_hcd(hcd);
++	iounmap(hcd->regs);
+ 	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+ 	usb_put_hcd(hcd);
+ 	dma_release_declared_memory(&pdev->dev);
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 781283a5138e..169d7b2feb1f 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -313,8 +313,17 @@ static int xhci_plat_resume(struct device *dev)
+ {
+ 	struct usb_hcd	*hcd = dev_get_drvdata(dev);
+ 	struct xhci_hcd	*xhci = hcd_to_xhci(hcd);
++	int ret;
++
++	ret = xhci_resume(xhci, 0);
++	if (ret)
++		return ret;
++
++	pm_runtime_disable(dev);
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
+ 
+-	return xhci_resume(xhci, 0);
++	return 0;
+ }
+ 
+ static const struct dev_pm_ops xhci_plat_pm_ops = {
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index baacc442ec6a..b27987431079 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1347,6 +1347,7 @@ static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id,
+ 				xhci->devs[slot_id]->out_ctx, ep_index);
+ 
+ 		ep_ctx = xhci_get_ep_ctx(xhci, command->in_ctx, ep_index);
++		ep_ctx->ep_info &= cpu_to_le32(~EP_STATE_MASK);/* must clear */
+ 		ep_ctx->ep_info2 &= cpu_to_le32(~MAX_PACKET_MASK);
+ 		ep_ctx->ep_info2 |= cpu_to_le32(MAX_PACKET(max_packet_size));
+ 
+@@ -4244,6 +4245,9 @@ int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd,
+ 			mutex_lock(hcd->bandwidth_mutex);
+ 			xhci_change_max_exit_latency(xhci, udev, 0);
+ 			mutex_unlock(hcd->bandwidth_mutex);
++			readl_poll_timeout(port_array[port_num], pm_val,
++					   (pm_val & PORT_PLS_MASK) == XDEV_U0,
++					   100, 10000);
+ 			return 0;
+ 		}
+ 	}
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 2b603ef5c10c..2b8df83dad38 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -709,7 +709,7 @@ struct xhci_ep_ctx {
+  * 4 - TRB error
+  * 5-7 - reserved
+  */
+-#define EP_STATE_MASK		(0xf)
++#define EP_STATE_MASK		(0x7)
+ #define EP_STATE_DISABLED	0
+ #define EP_STATE_RUNNING	1
+ #define EP_STATE_HALTED		2
+diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
+index 84905d074c4f..ef45b8f5bf51 100644
+--- a/drivers/vfio/pci/vfio_pci_config.c
++++ b/drivers/vfio/pci/vfio_pci_config.c
+@@ -1461,7 +1461,12 @@ static int vfio_cap_init(struct vfio_pci_device *vdev)
+ 		if (ret)
+ 			return ret;
+ 
+-		if (cap <= PCI_CAP_ID_MAX) {
++		/*
++		 * ID 0 is a NULL capability, conflicting with our fake
++		 * PCI_CAP_ID_BASIC.  As it has no content, consider it
++		 * hidden for now.
++		 */
++		if (cap && cap <= PCI_CAP_ID_MAX) {
+ 			len = pci_cap_length[cap];
+ 			if (len == 0xFF) { /* Variable length */
+ 				len = vfio_cap_len(vdev, cap, pos);
+@@ -1729,8 +1734,11 @@ void vfio_config_free(struct vfio_pci_device *vdev)
+ 	vdev->vconfig = NULL;
+ 	kfree(vdev->pci_config_map);
+ 	vdev->pci_config_map = NULL;
+-	kfree(vdev->msi_perm);
+-	vdev->msi_perm = NULL;
++	if (vdev->msi_perm) {
++		free_perm_bits(vdev->msi_perm);
++		kfree(vdev->msi_perm);
++		vdev->msi_perm = NULL;
++	}
+ }
+ 
+ /*
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index 939f057836e1..4cdc7a3f6dc5 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -460,7 +460,7 @@ static int lp855x_probe(struct i2c_client *cl, const struct i2c_device_id *id)
+ 		ret = regulator_enable(lp->enable);
+ 		if (ret < 0) {
+ 			dev_err(lp->dev, "failed to enable vddio: %d\n", ret);
+-			return ret;
++			goto disable_supply;
+ 		}
+ 
+ 		/*
+@@ -475,24 +475,34 @@ static int lp855x_probe(struct i2c_client *cl, const struct i2c_device_id *id)
+ 	ret = lp855x_configure(lp);
+ 	if (ret) {
+ 		dev_err(lp->dev, "device config err: %d", ret);
+-		return ret;
++		goto disable_vddio;
+ 	}
+ 
+ 	ret = lp855x_backlight_register(lp);
+ 	if (ret) {
+ 		dev_err(lp->dev,
+ 			"failed to register backlight. err: %d\n", ret);
+-		return ret;
++		goto disable_vddio;
+ 	}
+ 
+ 	ret = sysfs_create_group(&lp->dev->kobj, &lp855x_attr_group);
+ 	if (ret) {
+ 		dev_err(lp->dev, "failed to register sysfs. err: %d\n", ret);
+-		return ret;
++		goto disable_vddio;
+ 	}
+ 
+ 	backlight_update_status(lp->bl);
++
+ 	return 0;
++
++disable_vddio:
++	if (lp->enable)
++		regulator_disable(lp->enable);
++disable_supply:
++	if (lp->supply)
++		regulator_disable(lp->supply);
++
++	return ret;
+ }
+ 
+ static int lp855x_remove(struct i2c_client *cl)
+@@ -501,6 +511,8 @@ static int lp855x_remove(struct i2c_client *cl)
+ 
+ 	lp->bl->props.brightness = 0;
+ 	backlight_update_status(lp->bl);
++	if (lp->enable)
++		regulator_disable(lp->enable);
+ 	if (lp->supply)
+ 		regulator_disable(lp->supply);
+ 	sysfs_remove_group(&lp->dev->kobj, &lp855x_attr_group);
+diff --git a/drivers/watchdog/da9062_wdt.c b/drivers/watchdog/da9062_wdt.c
+index daeb645fcea8..519419136ce8 100644
+--- a/drivers/watchdog/da9062_wdt.c
++++ b/drivers/watchdog/da9062_wdt.c
+@@ -94,11 +94,6 @@ static int da9062_wdt_update_timeout_register(struct da9062_watchdog *wdt,
+ 					      unsigned int regval)
+ {
+ 	struct da9062 *chip = wdt->hw;
+-	int ret;
+-
+-	ret = da9062_reset_watchdog_timer(wdt);
+-	if (ret)
+-		return ret;
+ 
+ 	return regmap_update_bits(chip->regmap,
+ 				  DA9062AA_CONTROL_D,
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 8a894cd4875b..06f7cbe20132 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1255,10 +1255,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ 	 */
+ 	if (!for_part) {
+ 		ret = devcgroup_inode_permission(bdev->bd_inode, perm);
+-		if (ret != 0) {
+-			bdput(bdev);
++		if (ret != 0)
+ 			return ret;
+-		}
+ 	}
+ 
+  restart:
+@@ -1330,8 +1328,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ 				goto out_clear;
+ 			BUG_ON(for_part);
+ 			ret = __blkdev_get(whole, mode, 1);
+-			if (ret)
++			if (ret) {
++				bdput(whole);
+ 				goto out_clear;
++			}
+ 			bdev->bd_contains = whole;
+ 			bdev->bd_part = disk_get_part(disk, partno);
+ 			if (!(disk->flags & GENHD_FL_UP) ||
+@@ -1382,7 +1382,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ 	put_disk(disk);
+ 	module_put(owner);
+  out:
+-	bdput(bdev);
+ 
+ 	return ret;
+ }
+@@ -1468,6 +1467,9 @@ int blkdev_get(struct block_device *bdev, fmode_t mode, void *holder)
+ 		bdput(whole);
+ 	}
+ 
++	if (res)
++		bdput(bdev);
++
+ 	return res;
+ }
+ EXPORT_SYMBOL(blkdev_get);
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 67d9b7a277a3..edd4c7292be0 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -1220,6 +1220,12 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
+ 	inode = d_inode(cfile->dentry);
+ 	cifsi = CIFS_I(inode);
+ 
++	/*
++	 * We zero the range through ioctl, so we need remove the page caches
++	 * first, otherwise the data may be inconsistent with the server.
++	 */
++	truncate_pagecache_range(inode, offset, offset + len - 1);
++
+ 	/* if file not oplocked can't be sure whether asking to extend size */
+ 	if (!CIFS_CACHE_READ(cifsi))
+ 		if (keep_size == false)
+@@ -1276,6 +1282,12 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon,
+ 	if (!smb2_set_sparse(xid, tcon, cfile, inode, set_sparse))
+ 		return -EOPNOTSUPP;
+ 
++	/*
++	 * We implement the punch hole through ioctl, so we need remove the page
++	 * caches first, otherwise the data may be inconsistent with the server.
++	 */
++	truncate_pagecache_range(inode, offset, offset + len - 1);
++
+ 	cifs_dbg(FYI, "offset %lld len %lld", offset, len);
+ 
+ 	fsctl_buf.FileOffset = cpu_to_le64(offset);
+diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
+index 02ac9067a354..9fa3285425fe 100644
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -1340,23 +1340,6 @@ COMPATIBLE_IOCTL(DMX_GET_PES_PIDS)
+ COMPATIBLE_IOCTL(DMX_GET_CAPS)
+ COMPATIBLE_IOCTL(DMX_SET_SOURCE)
+ COMPATIBLE_IOCTL(DMX_GET_STC)
+-COMPATIBLE_IOCTL(FE_GET_INFO)
+-COMPATIBLE_IOCTL(FE_DISEQC_RESET_OVERLOAD)
+-COMPATIBLE_IOCTL(FE_DISEQC_SEND_MASTER_CMD)
+-COMPATIBLE_IOCTL(FE_DISEQC_RECV_SLAVE_REPLY)
+-COMPATIBLE_IOCTL(FE_DISEQC_SEND_BURST)
+-COMPATIBLE_IOCTL(FE_SET_TONE)
+-COMPATIBLE_IOCTL(FE_SET_VOLTAGE)
+-COMPATIBLE_IOCTL(FE_ENABLE_HIGH_LNB_VOLTAGE)
+-COMPATIBLE_IOCTL(FE_READ_STATUS)
+-COMPATIBLE_IOCTL(FE_READ_BER)
+-COMPATIBLE_IOCTL(FE_READ_SIGNAL_STRENGTH)
+-COMPATIBLE_IOCTL(FE_READ_SNR)
+-COMPATIBLE_IOCTL(FE_READ_UNCORRECTED_BLOCKS)
+-COMPATIBLE_IOCTL(FE_SET_FRONTEND)
+-COMPATIBLE_IOCTL(FE_GET_FRONTEND)
+-COMPATIBLE_IOCTL(FE_GET_EVENT)
+-COMPATIBLE_IOCTL(FE_DISHNETWORK_SEND_LEGACY_CMD)
+ COMPATIBLE_IOCTL(VIDEO_STOP)
+ COMPATIBLE_IOCTL(VIDEO_PLAY)
+ COMPATIBLE_IOCTL(VIDEO_FREEZE)
+diff --git a/fs/dlm/dlm_internal.h b/fs/dlm/dlm_internal.h
+index 216b61604ef9..c211156aabe2 100644
+--- a/fs/dlm/dlm_internal.h
++++ b/fs/dlm/dlm_internal.h
+@@ -100,7 +100,6 @@ do { \
+                __LINE__, __FILE__, #x, jiffies); \
+     {do} \
+     printk("\n"); \
+-    BUG(); \
+     panic("DLM:  Record message above and reboot.\n"); \
+   } \
+ }
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 51c2713a615a..ab19f61bd04b 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -2916,7 +2916,7 @@ again:
+ 			 * in use to avoid freeing it when removing blocks.
+ 			 */
+ 			if (sbi->s_cluster_ratio > 1) {
+-				pblk = ext4_ext_pblock(ex) + end - ee_block + 2;
++				pblk = ext4_ext_pblock(ex) + end - ee_block + 1;
+ 				partial_cluster =
+ 					-(long long) EXT4_B2C(sbi, pblk);
+ 			}
+diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
+index 84e5ac061b17..bb5ddaabc218 100644
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -920,7 +920,7 @@ fail:
+ }
+ 
+ static const match_table_t nolock_tokens = {
+-	{ Opt_jid, "jid=%d\n", },
++	{ Opt_jid, "jid=%d", },
+ 	{ Opt_err, NULL },
+ };
+ 
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index de135d2591ff..1affdec23729 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -379,8 +379,6 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq)
+ {
+ 	struct inode *inode = dreq->inode;
+ 
+-	inode_dio_end(inode);
+-
+ 	if (dreq->iocb) {
+ 		long res = (long) dreq->error;
+ 		if (dreq->count != 0) {
+@@ -392,7 +390,10 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq)
+ 
+ 	complete(&dreq->completion);
+ 
++	igrab(inode);
+ 	nfs_direct_req_release(dreq);
++	inode_dio_end(inode);
++	iput(inode);
+ }
+ 
+ static void nfs_direct_readpage_release(struct nfs_page *req)
+@@ -534,8 +535,10 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq,
+ 	 * generic layer handle the completion.
+ 	 */
+ 	if (requested_bytes == 0) {
+-		inode_dio_end(inode);
++		igrab(inode);
+ 		nfs_direct_req_release(dreq);
++		inode_dio_end(inode);
++		iput(inode);
+ 		return result < 0 ? result : -EIO;
+ 	}
+ 
+@@ -953,8 +956,10 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
+ 	 * generic layer handle the completion.
+ 	 */
+ 	if (requested_bytes == 0) {
+-		inode_dio_end(inode);
++		igrab(inode);
+ 		nfs_direct_req_release(dreq);
++		inode_dio_end(inode);
++		iput(inode);
+ 		return result < 0 ? result : -EIO;
+ 	}
+ 
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index 1eec947c562d..a89d2f793c1b 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -82,6 +82,7 @@ nfs_file_release(struct inode *inode, struct file *filp)
+ 	dprintk("NFS: release(%pD2)\n", filp);
+ 
+ 	nfs_inc_stats(inode, NFSIOS_VFSRELEASE);
++	inode_dio_wait(inode);
+ 	nfs_file_clear_open_context(filp);
+ 	return 0;
+ }
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
+index 4539008502ce..83149cbae093 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -939,9 +939,8 @@ retry:
+ 		goto out_mds;
+ 
+ 	/* Use a direct mapping of ds_idx to pgio mirror_idx */
+-	if (WARN_ON_ONCE(pgio->pg_mirror_count !=
+-	    FF_LAYOUT_MIRROR_COUNT(pgio->pg_lseg)))
+-		goto out_mds;
++	if (pgio->pg_mirror_count != FF_LAYOUT_MIRROR_COUNT(pgio->pg_lseg))
++		goto out_eagain;
+ 
+ 	for (i = 0; i < pgio->pg_mirror_count; i++) {
+ 		ds = nfs4_ff_layout_prepare_ds(pgio->pg_lseg, i, true);
+@@ -960,11 +959,15 @@ retry:
+ 	}
+ 
+ 	return;
+-
++out_eagain:
++	pnfs_generic_pg_cleanup(pgio);
++	pgio->pg_error = -EAGAIN;
++	return;
+ out_mds:
+ 	pnfs_put_lseg(pgio->pg_lseg);
+ 	pgio->pg_lseg = NULL;
+ 	nfs_pageio_reset_write_mds(pgio);
++	pgio->pg_error = -EAGAIN;
+ }
+ 
+ static unsigned int
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 632d3c3f8dfb..c189722bf9c7 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7151,7 +7151,7 @@ nfs4_bind_one_conn_to_session_done(struct rpc_task *task, void *calldata)
+ }
+ 
+ static const struct rpc_call_ops nfs4_bind_one_conn_to_session_ops = {
+-	.rpc_call_done =  &nfs4_bind_one_conn_to_session_done,
++	.rpc_call_done =  nfs4_bind_one_conn_to_session_done,
+ };
+ 
+ /*
+diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
+index 8d842282111b..172f697864ab 100644
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -1156,6 +1156,8 @@ static void nfsd4_process_cb_update(struct nfsd4_callback *cb)
+ 	err = setup_callback_client(clp, &conn, ses);
+ 	if (err) {
+ 		nfsd4_mark_cb_down(clp, err);
++		if (c)
++			svc_xprt_put(c->cn_xprt);
+ 		return;
+ 	}
+ }
+diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
+index 44d178b8d1aa..c3697cf60500 100644
+--- a/fs/ocfs2/ocfs2_fs.h
++++ b/fs/ocfs2/ocfs2_fs.h
+@@ -304,7 +304,7 @@
+ #define OCFS2_MAX_SLOTS			255
+ 
+ /* Slot map indicator for an empty slot */
+-#define OCFS2_INVALID_SLOT		-1
++#define OCFS2_INVALID_SLOT		((u16)-1)
+ 
+ #define OCFS2_VOL_UUID_LEN		16
+ #define OCFS2_MAX_VOL_LABEL_LEN		64
+@@ -340,8 +340,8 @@ struct ocfs2_system_inode_info {
+ enum {
+ 	BAD_BLOCK_SYSTEM_INODE = 0,
+ 	GLOBAL_INODE_ALLOC_SYSTEM_INODE,
++#define OCFS2_FIRST_ONLINE_SYSTEM_INODE GLOBAL_INODE_ALLOC_SYSTEM_INODE
+ 	SLOT_MAP_SYSTEM_INODE,
+-#define OCFS2_FIRST_ONLINE_SYSTEM_INODE SLOT_MAP_SYSTEM_INODE
+ 	HEARTBEAT_SYSTEM_INODE,
+ 	GLOBAL_BITMAP_SYSTEM_INODE,
+ 	USER_QUOTA_SYSTEM_INODE,
+diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
+index 6ad3533940ba..00558bc59052 100644
+--- a/fs/ocfs2/suballoc.c
++++ b/fs/ocfs2/suballoc.c
+@@ -2891,9 +2891,12 @@ int ocfs2_test_inode_bit(struct ocfs2_super *osb, u64 blkno, int *res)
+ 		goto bail;
+ 	}
+ 
+-	inode_alloc_inode =
+-		ocfs2_get_system_file_inode(osb, INODE_ALLOC_SYSTEM_INODE,
+-					    suballoc_slot);
++	if (suballoc_slot == (u16)OCFS2_INVALID_SLOT)
++		inode_alloc_inode = ocfs2_get_system_file_inode(osb,
++			GLOBAL_INODE_ALLOC_SYSTEM_INODE, suballoc_slot);
++	else
++		inode_alloc_inode = ocfs2_get_system_file_inode(osb,
++			INODE_ALLOC_SYSTEM_INODE, suballoc_slot);
+ 	if (!inode_alloc_inode) {
+ 		/* the error code could be inaccurate, but we are not able to
+ 		 * get the correct one. */
+diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
+index e567551402a6..b904d4634355 100644
+--- a/fs/xfs/libxfs/xfs_alloc.c
++++ b/fs/xfs/libxfs/xfs_alloc.c
+@@ -2507,6 +2507,13 @@ xfs_agf_verify(
+ 	      be32_to_cpu(agf->agf_flcount) <= XFS_AGFL_SIZE(mp)))
+ 		return false;
+ 
++	if (be32_to_cpu(agf->agf_length) > mp->m_sb.sb_dblocks)
++		return false;
++
++	if (be32_to_cpu(agf->agf_freeblks) < be32_to_cpu(agf->agf_longest) ||
++	    be32_to_cpu(agf->agf_freeblks) > be32_to_cpu(agf->agf_length))
++		return false;
++
+ 	if (be32_to_cpu(agf->agf_levels[XFS_BTNUM_BNO]) < 1 ||
+ 	    be32_to_cpu(agf->agf_levels[XFS_BTNUM_CNT]) < 1 ||
+ 	    be32_to_cpu(agf->agf_levels[XFS_BTNUM_BNO]) > XFS_BTREE_MAXLEVELS ||
+@@ -2518,6 +2525,10 @@ xfs_agf_verify(
+ 	     be32_to_cpu(agf->agf_levels[XFS_BTNUM_RMAP]) > XFS_BTREE_MAXLEVELS))
+ 		return false;
+ 
++	if (xfs_sb_version_hasrmapbt(&mp->m_sb) &&
++	    be32_to_cpu(agf->agf_rmap_blocks) > be32_to_cpu(agf->agf_length))
++		return false;
++
+ 	/*
+ 	 * during growfs operations, the perag is not fully initialised,
+ 	 * so we can't use it for any useful checking. growfs ensures we can't
+@@ -2531,6 +2542,11 @@ xfs_agf_verify(
+ 	    be32_to_cpu(agf->agf_btreeblks) > be32_to_cpu(agf->agf_length))
+ 		return false;
+ 
++	if (xfs_sb_version_hasreflink(&mp->m_sb) &&
++	    be32_to_cpu(agf->agf_refcount_blocks) >
++	    be32_to_cpu(agf->agf_length))
++		return false;
++
+ 	if (xfs_sb_version_hasreflink(&mp->m_sb) &&
+ 	    (be32_to_cpu(agf->agf_refcount_level) < 1 ||
+ 	     be32_to_cpu(agf->agf_refcount_level) > XFS_BTREE_MAXLEVELS))
+diff --git a/include/linux/bitops.h b/include/linux/bitops.h
+index cee74a52b9eb..e1dee6c91ff5 100644
+--- a/include/linux/bitops.h
++++ b/include/linux/bitops.h
+@@ -49,7 +49,7 @@ static inline int get_bitmask_order(unsigned int count)
+ 
+ static __always_inline unsigned long hweight_long(unsigned long w)
+ {
+-	return sizeof(w) == 4 ? hweight32(w) : hweight64(w);
++	return sizeof(w) == 4 ? hweight32(w) : hweight64((__u64)w);
+ }
+ 
+ /**
+diff --git a/include/linux/elfnote.h b/include/linux/elfnote.h
+index 278e3ef05336..56c6d9031663 100644
+--- a/include/linux/elfnote.h
++++ b/include/linux/elfnote.h
+@@ -53,7 +53,7 @@
+ .popsection				;
+ 
+ #define ELFNOTE(name, type, desc)		\
+-	ELFNOTE_START(name, type, "")		\
++	ELFNOTE_START(name, type, "a")		\
+ 		desc			;	\
+ 	ELFNOTE_END
+ 
+diff --git a/include/linux/genhd.h b/include/linux/genhd.h
+index 3c99fb6727ca..12a2f5ac51c9 100644
+--- a/include/linux/genhd.h
++++ b/include/linux/genhd.h
+@@ -716,9 +716,11 @@ static inline sector_t part_nr_sects_read(struct hd_struct *part)
+ static inline void part_nr_sects_write(struct hd_struct *part, sector_t size)
+ {
+ #if BITS_PER_LONG==32 && defined(CONFIG_LBDAF) && defined(CONFIG_SMP)
++	preempt_disable();
+ 	write_seqcount_begin(&part->nr_sects_seq);
+ 	part->nr_sects = size;
+ 	write_seqcount_end(&part->nr_sects_seq);
++	preempt_enable();
+ #elif BITS_PER_LONG==32 && defined(CONFIG_LBDAF) && defined(CONFIG_PREEMPT)
+ 	preempt_disable();
+ 	part->nr_sects = size;
+diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
+index cb527c78de9f..4db62045f01a 100644
+--- a/include/linux/kprobes.h
++++ b/include/linux/kprobes.h
+@@ -366,6 +366,10 @@ static inline struct kprobe_ctlblk *get_kprobe_ctlblk(void)
+ 	return this_cpu_ptr(&kprobe_ctlblk);
+ }
+ 
++extern struct kprobe kprobe_busy;
++void kprobe_busy_begin(void);
++void kprobe_busy_end(void);
++
+ int register_kprobe(struct kprobe *p);
+ void unregister_kprobe(struct kprobe *p);
+ int register_kprobes(struct kprobe **kps, int num);
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index cdfb67b22317..780ccde2c312 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -38,6 +38,7 @@
+ #include <linux/acpi.h>
+ #include <linux/cdrom.h>
+ #include <linux/sched.h>
++#include <linux/async.h>
+ 
+ /*
+  * Define if arch has non-standard setup.  This is a _PCI_ standard
+@@ -878,6 +879,8 @@ struct ata_port {
+ 	struct timer_list	fastdrain_timer;
+ 	unsigned long		fastdrain_cnt;
+ 
++	async_cookie_t		cookie;
++
+ 	int			em_message_type;
+ 	void			*private_data;
+ 
+diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
+index d8905a229f34..573e744223a2 100644
+--- a/include/linux/mtd/nand.h
++++ b/include/linux/mtd/nand.h
+@@ -24,6 +24,7 @@
+ #include <linux/mtd/flashchip.h>
+ #include <linux/mtd/bbm.h>
+ 
++struct nand_chip;
+ struct mtd_info;
+ struct nand_flash_dev;
+ struct device_node;
+@@ -39,7 +40,7 @@ int nand_scan_ident(struct mtd_info *mtd, int max_chips,
+ int nand_scan_tail(struct mtd_info *mtd);
+ 
+ /* Unregister the MTD device and free resources held by the NAND device */
+-void nand_release(struct mtd_info *mtd);
++void nand_release(struct nand_chip *chip);
+ 
+ /* Internal helper for board drivers which need to override command function */
+ void nand_wait_ready(struct mtd_info *mtd);
+@@ -219,9 +220,6 @@ enum nand_ecc_algo {
+ #define NAND_CI_CELLTYPE_MSK	0x0C
+ #define NAND_CI_CELLTYPE_SHIFT	2
+ 
+-/* Keep gcc happy */
+-struct nand_chip;
+-
+ /* ONFI features */
+ #define ONFI_FEATURE_16_BIT_BUS		(1 << 0)
+ #define ONFI_FEATURE_EXT_PARAM_PAGE	(1 << 7)
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 81c85ba6e2b8..4d1b1056ac97 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2480,7 +2480,7 @@ void synchronize_net(void);
+ int init_dummy_netdev(struct net_device *dev);
+ 
+ DECLARE_PER_CPU(int, xmit_recursion);
+-#define XMIT_RECURSION_LIMIT	10
++#define XMIT_RECURSION_LIMIT	8
+ 
+ static inline int dev_recursion_level(void)
+ {
+diff --git a/include/linux/qed/qed_chain.h b/include/linux/qed/qed_chain.h
+index 72d88cf3ca25..5a215da57b55 100644
+--- a/include/linux/qed/qed_chain.h
++++ b/include/linux/qed/qed_chain.h
+@@ -155,28 +155,34 @@ static inline u32 qed_chain_get_cons_idx_u32(struct qed_chain *p_chain)
+ 
+ static inline u16 qed_chain_get_elem_left(struct qed_chain *p_chain)
+ {
++	u16 elem_per_page = p_chain->elem_per_page;
++	u32 prod = p_chain->u.chain16.prod_idx;
++	u32 cons = p_chain->u.chain16.cons_idx;
+ 	u16 used;
+ 
+-	used = (u16) (((u32)0x10000 +
+-		       (u32)p_chain->u.chain16.prod_idx) -
+-		      (u32)p_chain->u.chain16.cons_idx);
++	if (prod < cons)
++		prod += (u32)U16_MAX + 1;
++
++	used = (u16)(prod - cons);
+ 	if (p_chain->mode == QED_CHAIN_MODE_NEXT_PTR)
+-		used -= p_chain->u.chain16.prod_idx / p_chain->elem_per_page -
+-		    p_chain->u.chain16.cons_idx / p_chain->elem_per_page;
++		used -= prod / elem_per_page - cons / elem_per_page;
+ 
+ 	return (u16)(p_chain->capacity - used);
+ }
+ 
+ static inline u32 qed_chain_get_elem_left_u32(struct qed_chain *p_chain)
+ {
++	u16 elem_per_page = p_chain->elem_per_page;
++	u64 prod = p_chain->u.chain32.prod_idx;
++	u64 cons = p_chain->u.chain32.cons_idx;
+ 	u32 used;
+ 
+-	used = (u32) (((u64)0x100000000ULL +
+-		       (u64)p_chain->u.chain32.prod_idx) -
+-		      (u64)p_chain->u.chain32.cons_idx);
++	if (prod < cons)
++		prod += (u64)U32_MAX + 1;
++
++	used = (u32)(prod - cons);
+ 	if (p_chain->mode == QED_CHAIN_MODE_NEXT_PTR)
+-		used -= p_chain->u.chain32.prod_idx / p_chain->elem_per_page -
+-		    p_chain->u.chain32.cons_idx / p_chain->elem_per_page;
++		used -= (u32)(prod / elem_per_page - cons / elem_per_page);
+ 
+ 	return p_chain->capacity - used;
+ }
+diff --git a/include/linux/usb/composite.h b/include/linux/usb/composite.h
+index 667d20454a21..0ec7185e5ddf 100644
+--- a/include/linux/usb/composite.h
++++ b/include/linux/usb/composite.h
+@@ -248,6 +248,9 @@ int usb_function_activate(struct usb_function *);
+ 
+ int usb_interface_id(struct usb_configuration *, struct usb_function *);
+ 
++int config_ep_by_speed_and_alt(struct usb_gadget *g, struct usb_function *f,
++				struct usb_ep *_ep, u8 alt);
++
+ int config_ep_by_speed(struct usb_gadget *g, struct usb_function *f,
+ 			struct usb_ep *_ep);
+ 
+diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
+index 5b847e49f7e9..8890fd66021d 100644
+--- a/include/net/sctp/constants.h
++++ b/include/net/sctp/constants.h
+@@ -357,11 +357,13 @@ typedef enum {
+ 	 ipv4_is_anycast_6to4(a))
+ 
+ /* Flags used for the bind address copy functions.  */
+-#define SCTP_ADDR6_ALLOWED	0x00000001	/* IPv6 address is allowed by
++#define SCTP_ADDR4_ALLOWED	0x00000001	/* IPv4 address is allowed by
+ 						   local sock family */
+-#define SCTP_ADDR4_PEERSUPP	0x00000002	/* IPv4 address is supported by
++#define SCTP_ADDR6_ALLOWED	0x00000002	/* IPv6 address is allowed by
++						   local sock family */
++#define SCTP_ADDR4_PEERSUPP	0x00000004	/* IPv4 address is supported by
+ 						   peer */
+-#define SCTP_ADDR6_PEERSUPP	0x00000004	/* IPv6 address is supported by
++#define SCTP_ADDR6_PEERSUPP	0x00000008	/* IPv6 address is supported by
+ 						   peer */
+ 
+ /* Reasons to retransmit. */
+diff --git a/include/net/sock.h b/include/net/sock.h
+index d6bce19ca261..db68c72126d5 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1631,7 +1631,6 @@ static inline int sk_tx_queue_get(const struct sock *sk)
+ 
+ static inline void sk_set_socket(struct sock *sk, struct socket *sock)
+ {
+-	sk_tx_queue_clear(sk);
+ 	sk->sk_socket = sock;
+ }
+ 
+diff --git a/include/uapi/linux/dvb/frontend.h b/include/uapi/linux/dvb/frontend.h
+index afc3972b0879..b653754ee9cf 100644
+--- a/include/uapi/linux/dvb/frontend.h
++++ b/include/uapi/linux/dvb/frontend.h
+@@ -28,13 +28,46 @@
+ 
+ #include <linux/types.h>
+ 
+-enum fe_type {
+-	FE_QPSK,
+-	FE_QAM,
+-	FE_OFDM,
+-	FE_ATSC
+-};
+-
++/**
++ * enum fe_caps - Frontend capabilities
++ *
++ * @FE_IS_STUPID:			There's something wrong at the
++ *					frontend, and it can't report its
++ *					capabilities.
++ * @FE_CAN_INVERSION_AUTO:		Can auto-detect frequency spectral
++ *					band inversion
++ * @FE_CAN_FEC_1_2:			Supports FEC 1/2
++ * @FE_CAN_FEC_2_3:			Supports FEC 2/3
++ * @FE_CAN_FEC_3_4:			Supports FEC 3/4
++ * @FE_CAN_FEC_4_5:			Supports FEC 4/5
++ * @FE_CAN_FEC_5_6:			Supports FEC 5/6
++ * @FE_CAN_FEC_6_7:			Supports FEC 6/7
++ * @FE_CAN_FEC_7_8:			Supports FEC 7/8
++ * @FE_CAN_FEC_8_9:			Supports FEC 8/9
++ * @FE_CAN_FEC_AUTO:			Can auto-detect FEC
++ * @FE_CAN_QPSK:			Supports QPSK modulation
++ * @FE_CAN_QAM_16:			Supports 16-QAM modulation
++ * @FE_CAN_QAM_32:			Supports 32-QAM modulation
++ * @FE_CAN_QAM_64:			Supports 64-QAM modulation
++ * @FE_CAN_QAM_128:			Supports 128-QAM modulation
++ * @FE_CAN_QAM_256:			Supports 256-QAM modulation
++ * @FE_CAN_QAM_AUTO:			Can auto-detect QAM modulation
++ * @FE_CAN_TRANSMISSION_MODE_AUTO:	Can auto-detect transmission mode
++ * @FE_CAN_BANDWIDTH_AUTO:		Can auto-detect bandwidth
++ * @FE_CAN_GUARD_INTERVAL_AUTO:		Can auto-detect guard interval
++ * @FE_CAN_HIERARCHY_AUTO:		Can auto-detect hierarchy
++ * @FE_CAN_8VSB:			Supports 8-VSB modulation
++ * @FE_CAN_16VSB:			Supporta 16-VSB modulation
++ * @FE_HAS_EXTENDED_CAPS:		Unused
++ * @FE_CAN_MULTISTREAM:			Supports multistream filtering
++ * @FE_CAN_TURBO_FEC:			Supports "turbo FEC" modulation
++ * @FE_CAN_2G_MODULATION:		Supports "2nd generation" modulation,
++ *					e. g. DVB-S2, DVB-T2, DVB-C2
++ * @FE_NEEDS_BENDING:			Unused
++ * @FE_CAN_RECOVER:			Can recover from a cable unplug
++ *					automatically
++ * @FE_CAN_MUTE_TS:			Can stop spurious TS data output
++ */
+ enum fe_caps {
+ 	FE_IS_STUPID			= 0,
+ 	FE_CAN_INVERSION_AUTO		= 0x1,
+@@ -60,15 +93,55 @@ enum fe_caps {
+ 	FE_CAN_HIERARCHY_AUTO		= 0x100000,
+ 	FE_CAN_8VSB			= 0x200000,
+ 	FE_CAN_16VSB			= 0x400000,
+-	FE_HAS_EXTENDED_CAPS		= 0x800000,   /* We need more bitspace for newer APIs, indicate this. */
+-	FE_CAN_MULTISTREAM		= 0x4000000,  /* frontend supports multistream filtering */
+-	FE_CAN_TURBO_FEC		= 0x8000000,  /* frontend supports "turbo fec modulation" */
+-	FE_CAN_2G_MODULATION		= 0x10000000, /* frontend supports "2nd generation modulation" (DVB-S2) */
+-	FE_NEEDS_BENDING		= 0x20000000, /* not supported anymore, don't use (frontend requires frequency bending) */
+-	FE_CAN_RECOVER			= 0x40000000, /* frontend can recover from a cable unplug automatically */
+-	FE_CAN_MUTE_TS			= 0x80000000  /* frontend can stop spurious TS data output */
++	FE_HAS_EXTENDED_CAPS		= 0x800000,
++	FE_CAN_MULTISTREAM		= 0x4000000,
++	FE_CAN_TURBO_FEC		= 0x8000000,
++	FE_CAN_2G_MODULATION		= 0x10000000,
++	FE_NEEDS_BENDING		= 0x20000000,
++	FE_CAN_RECOVER			= 0x40000000,
++	FE_CAN_MUTE_TS			= 0x80000000
++};
++
++/*
++ * DEPRECATED: Should be kept just due to backward compatibility.
++ */
++enum fe_type {
++	FE_QPSK,
++	FE_QAM,
++	FE_OFDM,
++	FE_ATSC
+ };
+ 
++/**
++ * struct dvb_frontend_info - Frontend properties and capabilities
++ *
++ * @name:			Name of the frontend
++ * @type:			**DEPRECATED**.
++ *				Should not be used on modern programs,
++ *				as a frontend may have more than one type.
++ *				In order to get the support types of a given
++ *				frontend, use :c:type:`DTV_ENUM_DELSYS`
++ *				instead.
++ * @frequency_min:		Minimal frequency supported by the frontend.
++ * @frequency_max:		Minimal frequency supported by the frontend.
++ * @frequency_stepsize:		All frequencies are multiple of this value.
++ * @frequency_tolerance:	Frequency tolerance.
++ * @symbol_rate_min:		Minimal symbol rate, in bauds
++ *				(for Cable/Satellite systems).
++ * @symbol_rate_max:		Maximal symbol rate, in bauds
++ *				(for Cable/Satellite systems).
++ * @symbol_rate_tolerance:	Maximal symbol rate tolerance, in ppm
++ *				(for Cable/Satellite systems).
++ * @notifier_delay:		**DEPRECATED**. Not used by any driver.
++ * @caps:			Capabilities supported by the frontend,
++ *				as specified in &enum fe_caps.
++ *
++ * .. note:
++ *
++ *    #. The frequencies are specified in Hz for Terrestrial and Cable
++ *       systems.
++ *    #. The frequencies are specified in kHz for Satellite systems.
++ */
+ struct dvb_frontend_info {
+ 	char       name[128];
+ 	enum fe_type type;	/* DEPRECATED. Use DTV_ENUM_DELSYS instead */
+@@ -78,53 +151,102 @@ struct dvb_frontend_info {
+ 	__u32      frequency_tolerance;
+ 	__u32      symbol_rate_min;
+ 	__u32      symbol_rate_max;
+-	__u32      symbol_rate_tolerance;	/* ppm */
++	__u32      symbol_rate_tolerance;
+ 	__u32      notifier_delay;		/* DEPRECATED */
+ 	enum fe_caps caps;
+ };
+ 
+-
+ /**
+- *  Check out the DiSEqC bus spec available on http://www.eutelsat.org/ for
+- *  the meaning of this struct...
++ * struct dvb_diseqc_master_cmd - DiSEqC master command
++ *
++ * @msg:
++ *	DiSEqC message to be sent. It contains a 3 bytes header with:
++ *	framing + address + command, and an optional argument
++ *	of up to 3 bytes of data.
++ * @msg_len:
++ *	Length of the DiSEqC message. Valid values are 3 to 6.
++ *
++ * Check out the DiSEqC bus spec available on http://www.eutelsat.org/ for
++ * the possible messages that can be used.
+  */
+ struct dvb_diseqc_master_cmd {
+-	__u8 msg [6];	/*  { framing, address, command, data [3] } */
+-	__u8 msg_len;	/*  valid values are 3...6  */
++	__u8 msg[6];
++	__u8 msg_len;
+ };
+ 
++/**
++ * struct dvb_diseqc_slave_reply - DiSEqC received data
++ *
++ * @msg:
++ *	DiSEqC message buffer to store a message received via DiSEqC.
++ *	It contains one byte header with: framing and
++ *	an optional argument of up to 3 bytes of data.
++ * @msg_len:
++ *	Length of the DiSEqC message. Valid values are 0 to 4,
++ *	where 0 means no message.
++ * @timeout:
++ *	Return from ioctl after timeout ms with errorcode when
++ *	no message was received.
++ *
++ * Check out the DiSEqC bus spec available on http://www.eutelsat.org/ for
++ * the possible messages that can be used.
++ */
+ struct dvb_diseqc_slave_reply {
+-	__u8 msg [4];	/*  { framing, data [3] } */
+-	__u8 msg_len;	/*  valid values are 0...4, 0 means no msg  */
+-	int  timeout;	/*  return from ioctl after timeout ms with */
+-};			/*  errorcode when no message was received  */
++	__u8 msg[4];
++	__u8 msg_len;
++	int  timeout;
++};
+ 
++/**
++ * enum fe_sec_voltage - DC Voltage used to feed the LNBf
++ *
++ * @SEC_VOLTAGE_13:	Output 13V to the LNBf
++ * @SEC_VOLTAGE_18:	Output 18V to the LNBf
++ * @SEC_VOLTAGE_OFF:	Don't feed the LNBf with a DC voltage
++ */
+ enum fe_sec_voltage {
+ 	SEC_VOLTAGE_13,
+ 	SEC_VOLTAGE_18,
+ 	SEC_VOLTAGE_OFF
+ };
+ 
++/**
++ * enum fe_sec_tone_mode - Type of tone to be send to the LNBf.
++ * @SEC_TONE_ON:	Sends a 22kHz tone burst to the antenna.
++ * @SEC_TONE_OFF:	Don't send a 22kHz tone to the antenna (except
++ *			if the ``FE_DISEQC_*`` ioctls are called).
++ */
+ enum fe_sec_tone_mode {
+ 	SEC_TONE_ON,
+ 	SEC_TONE_OFF
+ };
+ 
++/**
++ * enum fe_sec_mini_cmd - Type of mini burst to be sent
++ *
++ * @SEC_MINI_A:		Sends a mini-DiSEqC 22kHz '0' Tone Burst to select
++ *			satellite-A
++ * @SEC_MINI_B:		Sends a mini-DiSEqC 22kHz '1' Data Burst to select
++ *			satellite-B
++ */
+ enum fe_sec_mini_cmd {
+ 	SEC_MINI_A,
+ 	SEC_MINI_B
+ };
+ 
+ /**
+- * enum fe_status - enumerates the possible frontend status
+- * @FE_HAS_SIGNAL:	found something above the noise level
+- * @FE_HAS_CARRIER:	found a DVB signal
+- * @FE_HAS_VITERBI:	FEC is stable
+- * @FE_HAS_SYNC:	found sync bytes
+- * @FE_HAS_LOCK:	everything's working
+- * @FE_TIMEDOUT:	no lock within the last ~2 seconds
+- * @FE_REINIT:		frontend was reinitialized, application is recommended
+- *			to reset DiSEqC, tone and parameters
++ * enum fe_status - Enumerates the possible frontend status.
++ * @FE_NONE:		The frontend doesn't have any kind of lock.
++ *			That's the initial frontend status
++ * @FE_HAS_SIGNAL:	Has found something above the noise level.
++ * @FE_HAS_CARRIER:	Has found a DVB signal.
++ * @FE_HAS_VITERBI:	FEC inner coding (Viterbi, LDPC or other inner code).
++ *			is stable.
++ * @FE_HAS_SYNC:	Synchronization bytes was found.
++ * @FE_HAS_LOCK:	DVB were locked and everything is working.
++ * @FE_TIMEDOUT:	Fo lock within the last about 2 seconds.
++ * @FE_REINIT:		Frontend was reinitialized, application is recommended
++ *			to reset DiSEqC, tone and parameters.
+  */
+ enum fe_status {
+ 	FE_NONE			= 0x00,
+@@ -137,12 +259,45 @@ enum fe_status {
+ 	FE_REINIT		= 0x40,
+ };
+ 
++/**
++ * enum fe_spectral_inversion - Type of inversion band
++ *
++ * @INVERSION_OFF:	Don't do spectral band inversion.
++ * @INVERSION_ON:	Do spectral band inversion.
++ * @INVERSION_AUTO:	Autodetect spectral band inversion.
++ *
++ * This parameter indicates if spectral inversion should be presumed or
++ * not. In the automatic setting (``INVERSION_AUTO``) the hardware will try
++ * to figure out the correct setting by itself. If the hardware doesn't
++ * support, the DVB core will try to lock at the carrier first with
++ * inversion off. If it fails, it will try to enable inversion.
++ */
+ enum fe_spectral_inversion {
+ 	INVERSION_OFF,
+ 	INVERSION_ON,
+ 	INVERSION_AUTO
+ };
+ 
++/**
++ * enum fe_code_rate - Type of Forward Error Correction (FEC)
++ *
++ *
++ * @FEC_NONE: No Forward Error Correction Code
++ * @FEC_1_2:  Forward Error Correction Code 1/2
++ * @FEC_2_3:  Forward Error Correction Code 2/3
++ * @FEC_3_4:  Forward Error Correction Code 3/4
++ * @FEC_4_5:  Forward Error Correction Code 4/5
++ * @FEC_5_6:  Forward Error Correction Code 5/6
++ * @FEC_6_7:  Forward Error Correction Code 6/7
++ * @FEC_7_8:  Forward Error Correction Code 7/8
++ * @FEC_8_9:  Forward Error Correction Code 8/9
++ * @FEC_AUTO: Autodetect Error Correction Code
++ * @FEC_3_5:  Forward Error Correction Code 3/5
++ * @FEC_9_10: Forward Error Correction Code 9/10
++ * @FEC_2_5:  Forward Error Correction Code 2/5
++ *
++ * Please note that not all FEC types are supported by a given standard.
++ */
+ enum fe_code_rate {
+ 	FEC_NONE = 0,
+ 	FEC_1_2,
+@@ -159,6 +314,26 @@ enum fe_code_rate {
+ 	FEC_2_5,
+ };
+ 
++/**
++ * enum fe_modulation - Type of modulation/constellation
++ * @QPSK:	QPSK modulation
++ * @QAM_16:	16-QAM modulation
++ * @QAM_32:	32-QAM modulation
++ * @QAM_64:	64-QAM modulation
++ * @QAM_128:	128-QAM modulation
++ * @QAM_256:	256-QAM modulation
++ * @QAM_AUTO:	Autodetect QAM modulation
++ * @VSB_8:	8-VSB modulation
++ * @VSB_16:	16-VSB modulation
++ * @PSK_8:	8-PSK modulation
++ * @APSK_16:	16-APSK modulation
++ * @APSK_32:	32-APSK modulation
++ * @DQPSK:	DQPSK modulation
++ * @QAM_4_NR:	4-QAM-NR modulation
++ *
++ * Please note that not all modulations are supported by a given standard.
++ *
++ */
+ enum fe_modulation {
+ 	QPSK,
+ 	QAM_16,
+@@ -176,6 +351,32 @@ enum fe_modulation {
+ 	QAM_4_NR,
+ };
+ 
++/**
++ * enum fe_transmit_mode - Transmission mode
++ *
++ * @TRANSMISSION_MODE_AUTO:
++ *	Autodetect transmission mode. The hardware will try to find the
++ *	correct FFT-size (if capable) to fill in the missing parameters.
++ * @TRANSMISSION_MODE_1K:
++ *	Transmission mode 1K
++ * @TRANSMISSION_MODE_2K:
++ *	Transmission mode 2K
++ * @TRANSMISSION_MODE_8K:
++ *	Transmission mode 8K
++ * @TRANSMISSION_MODE_4K:
++ *	Transmission mode 4K
++ * @TRANSMISSION_MODE_16K:
++ *	Transmission mode 16K
++ * @TRANSMISSION_MODE_32K:
++ *	Transmission mode 32K
++ * @TRANSMISSION_MODE_C1:
++ *	Single Carrier (C=1) transmission mode (DTMB only)
++ * @TRANSMISSION_MODE_C3780:
++ *	Multi Carrier (C=3780) transmission mode (DTMB only)
++ *
++ * Please note that not all transmission modes are supported by a given
++ * standard.
++ */
+ enum fe_transmit_mode {
+ 	TRANSMISSION_MODE_2K,
+ 	TRANSMISSION_MODE_8K,
+@@ -188,6 +389,23 @@ enum fe_transmit_mode {
+ 	TRANSMISSION_MODE_C3780,
+ };
+ 
++/**
++ * enum fe_guard_interval - Guard interval
++ *
++ * @GUARD_INTERVAL_AUTO:	Autodetect the guard interval
++ * @GUARD_INTERVAL_1_128:	Guard interval 1/128
++ * @GUARD_INTERVAL_1_32:	Guard interval 1/32
++ * @GUARD_INTERVAL_1_16:	Guard interval 1/16
++ * @GUARD_INTERVAL_1_8:		Guard interval 1/8
++ * @GUARD_INTERVAL_1_4:		Guard interval 1/4
++ * @GUARD_INTERVAL_19_128:	Guard interval 19/128
++ * @GUARD_INTERVAL_19_256:	Guard interval 19/256
++ * @GUARD_INTERVAL_PN420:	PN length 420 (1/4)
++ * @GUARD_INTERVAL_PN595:	PN length 595 (1/6)
++ * @GUARD_INTERVAL_PN945:	PN length 945 (1/9)
++ *
++ * Please note that not all guard intervals are supported by a given standard.
++ */
+ enum fe_guard_interval {
+ 	GUARD_INTERVAL_1_32,
+ 	GUARD_INTERVAL_1_16,
+@@ -202,6 +420,16 @@ enum fe_guard_interval {
+ 	GUARD_INTERVAL_PN945,
+ };
+ 
++/**
++ * enum fe_hierarchy - Hierarchy
++ * @HIERARCHY_NONE:	No hierarchy
++ * @HIERARCHY_AUTO:	Autodetect hierarchy (if supported)
++ * @HIERARCHY_1:	Hierarchy 1
++ * @HIERARCHY_2:	Hierarchy 2
++ * @HIERARCHY_4:	Hierarchy 4
++ *
++ * Please note that not all hierarchy types are supported by a given standard.
++ */
+ enum fe_hierarchy {
+ 	HIERARCHY_NONE,
+ 	HIERARCHY_1,
+@@ -210,6 +438,15 @@ enum fe_hierarchy {
+ 	HIERARCHY_AUTO
+ };
+ 
++/**
++ * enum fe_interleaving - Interleaving
++ * @INTERLEAVING_NONE:	No interleaving.
++ * @INTERLEAVING_AUTO:	Auto-detect interleaving.
++ * @INTERLEAVING_240:	Interleaving of 240 symbols.
++ * @INTERLEAVING_720:	Interleaving of 720 symbols.
++ *
++ * Please note that, currently, only DTMB uses it.
++ */
+ enum fe_interleaving {
+ 	INTERLEAVING_NONE,
+ 	INTERLEAVING_AUTO,
+@@ -217,7 +454,8 @@ enum fe_interleaving {
+ 	INTERLEAVING_720,
+ };
+ 
+-/* S2API Commands */
++/* DVBv5 property Commands */
++
+ #define DTV_UNDEFINED		0
+ #define DTV_TUNE		1
+ #define DTV_CLEAR		2
+@@ -310,19 +548,79 @@ enum fe_interleaving {
+ 
+ #define DTV_MAX_COMMAND		DTV_STAT_TOTAL_BLOCK_COUNT
+ 
++/**
++ * enum fe_pilot - Type of pilot tone
++ *
++ * @PILOT_ON:	Pilot tones enabled
++ * @PILOT_OFF:	Pilot tones disabled
++ * @PILOT_AUTO:	Autodetect pilot tones
++ */
+ enum fe_pilot {
+ 	PILOT_ON,
+ 	PILOT_OFF,
+ 	PILOT_AUTO,
+ };
+ 
++/**
++ * enum fe_rolloff - Rolloff factor (also known as alpha)
++ * @ROLLOFF_35:		Roloff factor: 35%
++ * @ROLLOFF_20:		Roloff factor: 20%
++ * @ROLLOFF_25:		Roloff factor: 25%
++ * @ROLLOFF_AUTO:	Auto-detect the roloff factor.
++ *
++ * .. note:
++ *
++ *    Roloff factor of 35% is implied on DVB-S. On DVB-S2, it is default.
++ */
+ enum fe_rolloff {
+-	ROLLOFF_35, /* Implied value in DVB-S, default for DVB-S2 */
++	ROLLOFF_35,
+ 	ROLLOFF_20,
+ 	ROLLOFF_25,
+ 	ROLLOFF_AUTO,
+ };
+ 
++/**
++ * enum fe_delivery_system - Type of the delivery system
++ *
++ * @SYS_UNDEFINED:
++ *	Undefined standard. Generally, indicates an error
++ * @SYS_DVBC_ANNEX_A:
++ *	Cable TV: DVB-C following ITU-T J.83 Annex A spec
++ * @SYS_DVBC_ANNEX_B:
++ *	Cable TV: DVB-C following ITU-T J.83 Annex B spec (ClearQAM)
++ * @SYS_DVBC_ANNEX_C:
++ *	Cable TV: DVB-C following ITU-T J.83 Annex C spec
++ * @SYS_ISDBC:
++ *	Cable TV: ISDB-C (no drivers yet)
++ * @SYS_DVBT:
++ *	Terrestrial TV: DVB-T
++ * @SYS_DVBT2:
++ *	Terrestrial TV: DVB-T2
++ * @SYS_ISDBT:
++ *	Terrestrial TV: ISDB-T
++ * @SYS_ATSC:
++ *	Terrestrial TV: ATSC
++ * @SYS_ATSCMH:
++ *	Terrestrial TV (mobile): ATSC-M/H
++ * @SYS_DTMB:
++ *	Terrestrial TV: DTMB
++ * @SYS_DVBS:
++ *	Satellite TV: DVB-S
++ * @SYS_DVBS2:
++ *	Satellite TV: DVB-S2
++ * @SYS_TURBO:
++ *	Satellite TV: DVB-S Turbo
++ * @SYS_ISDBS:
++ *	Satellite TV: ISDB-S
++ * @SYS_DAB:
++ *	Digital audio: DAB (not fully supported)
++ * @SYS_DSS:
++ *	Satellite TV: DSS (not fully supported)
++ * @SYS_CMMB:
++ *	Terrestrial TV (mobile): CMMB (not fully supported)
++ * @SYS_DVBH:
++ *	Terrestrial TV (mobile): DVB-H (standard deprecated)
++ */
+ enum fe_delivery_system {
+ 	SYS_UNDEFINED,
+ 	SYS_DVBC_ANNEX_A,
+@@ -345,35 +643,85 @@ enum fe_delivery_system {
+ 	SYS_DVBC_ANNEX_C,
+ };
+ 
+-/* backward compatibility */
++/* backward compatibility definitions for delivery systems */
+ #define SYS_DVBC_ANNEX_AC	SYS_DVBC_ANNEX_A
+-#define SYS_DMBTH SYS_DTMB /* DMB-TH is legacy name, use DTMB instead */
++#define SYS_DMBTH		SYS_DTMB /* DMB-TH is legacy name, use DTMB */
+ 
+-/* ATSC-MH */
++/* ATSC-MH specific parameters */
+ 
++/**
++ * enum atscmh_sccc_block_mode - Type of Series Concatenated Convolutional
++ *				 Code Block Mode.
++ *
++ * @ATSCMH_SCCC_BLK_SEP:
++ *	Separate SCCC: the SCCC outer code mode shall be set independently
++ *	for each Group Region (A, B, C, D)
++ * @ATSCMH_SCCC_BLK_COMB:
++ *	Combined SCCC: all four Regions shall have the same SCCC outer
++ *	code mode.
++ * @ATSCMH_SCCC_BLK_RES:
++ *	Reserved. Shouldn't be used.
++ */
+ enum atscmh_sccc_block_mode {
+ 	ATSCMH_SCCC_BLK_SEP      = 0,
+ 	ATSCMH_SCCC_BLK_COMB     = 1,
+ 	ATSCMH_SCCC_BLK_RES      = 2,
+ };
+ 
++/**
++ * enum atscmh_sccc_code_mode - Type of Series Concatenated Convolutional
++ *				Code Rate.
++ *
++ * @ATSCMH_SCCC_CODE_HLF:
++ *	The outer code rate of a SCCC Block is 1/2 rate.
++ * @ATSCMH_SCCC_CODE_QTR:
++ *	The outer code rate of a SCCC Block is 1/4 rate.
++ * @ATSCMH_SCCC_CODE_RES:
++ *	Reserved. Should not be used.
++ */
+ enum atscmh_sccc_code_mode {
+ 	ATSCMH_SCCC_CODE_HLF     = 0,
+ 	ATSCMH_SCCC_CODE_QTR     = 1,
+ 	ATSCMH_SCCC_CODE_RES     = 2,
+ };
+ 
++/**
++ * enum atscmh_rs_frame_ensemble - Reed Solomon(RS) frame ensemble.
++ *
++ * @ATSCMH_RSFRAME_ENS_PRI:	Primary Ensemble.
++ * @ATSCMH_RSFRAME_ENS_SEC:	Secondary Ensemble.
++ */
+ enum atscmh_rs_frame_ensemble {
+ 	ATSCMH_RSFRAME_ENS_PRI   = 0,
+ 	ATSCMH_RSFRAME_ENS_SEC   = 1,
+ };
+ 
++/**
++ * enum atscmh_rs_frame_mode - Reed Solomon (RS) frame mode.
++ *
++ * @ATSCMH_RSFRAME_PRI_ONLY:
++ *	Single Frame: There is only a primary RS Frame for all Group
++ *	Regions.
++ * @ATSCMH_RSFRAME_PRI_SEC:
++ *	Dual Frame: There are two separate RS Frames: Primary RS Frame for
++ *	Group Region A and B and Secondary RS Frame for Group Region C and
++ *	D.
++ * @ATSCMH_RSFRAME_RES:
++ *	Reserved. Shouldn't be used.
++ */
+ enum atscmh_rs_frame_mode {
+ 	ATSCMH_RSFRAME_PRI_ONLY  = 0,
+ 	ATSCMH_RSFRAME_PRI_SEC   = 1,
+ 	ATSCMH_RSFRAME_RES       = 2,
+ };
+ 
++/**
++ * enum atscmh_rs_code_mode
++ * @ATSCMH_RSCODE_211_187:	Reed Solomon code (211,187).
++ * @ATSCMH_RSCODE_223_187:	Reed Solomon code (223,187).
++ * @ATSCMH_RSCODE_235_187:	Reed Solomon code (235,187).
++ * @ATSCMH_RSCODE_RES:		Reserved. Shouldn't be used.
++ */
+ enum atscmh_rs_code_mode {
+ 	ATSCMH_RSCODE_211_187    = 0,
+ 	ATSCMH_RSCODE_223_187    = 1,
+@@ -384,28 +732,18 @@ enum atscmh_rs_code_mode {
+ #define NO_STREAM_ID_FILTER	(~0U)
+ #define LNA_AUTO                (~0U)
+ 
+-struct dtv_cmds_h {
+-	char	*name;		/* A display name for debugging purposes */
+-
+-	__u32	cmd;		/* A unique ID */
+-
+-	/* Flags */
+-	__u32	set:1;		/* Either a set or get property */
+-	__u32	buffer:1;	/* Does this property use the buffer? */
+-	__u32	reserved:30;	/* Align */
+-};
+-
+ /**
+- * Scale types for the quality parameters.
++ * enum fecap_scale_params - scale types for the quality parameters.
++ *
+  * @FE_SCALE_NOT_AVAILABLE: That QoS measure is not available. That
+  *			    could indicate a temporary or a permanent
+  *			    condition.
+  * @FE_SCALE_DECIBEL: The scale is measured in 0.001 dB steps, typically
+- *		  used on signal measures.
++ *		      used on signal measures.
+  * @FE_SCALE_RELATIVE: The scale is a relative percentual measure,
+- *			ranging from 0 (0%) to 0xffff (100%).
++ *		       ranging from 0 (0%) to 0xffff (100%).
+  * @FE_SCALE_COUNTER: The scale counts the occurrence of an event, like
+- *			bit error, block error, lapsed time.
++ *		      bit error, block error, lapsed time.
+  */
+ enum fecap_scale_params {
+ 	FE_SCALE_NOT_AVAILABLE = 0,
+@@ -417,24 +755,38 @@ enum fecap_scale_params {
+ /**
+  * struct dtv_stats - Used for reading a DTV status property
+  *
+- * @value:	value of the measure. Should range from 0 to 0xffff;
+  * @scale:	Filled with enum fecap_scale_params - the scale
+  *		in usage for that parameter
+  *
++ * The ``{unnamed_union}`` may have either one of the values below:
++ *
++ * %svalue
++ *	integer value of the measure, for %FE_SCALE_DECIBEL,
++ *	used for dB measures. The unit is 0.001 dB.
++ *
++ * %uvalue
++ *	unsigned integer value of the measure, used when @scale is
++ *	either %FE_SCALE_RELATIVE or %FE_SCALE_COUNTER.
++ *
+  * For most delivery systems, this will return a single value for each
+  * parameter.
++ *
+  * It should be noticed, however, that new OFDM delivery systems like
+  * ISDB can use different modulation types for each group of carriers.
+  * On such standards, up to 8 groups of statistics can be provided, one
+  * for each carrier group (called "layer" on ISDB).
++ *
+  * In order to be consistent with other delivery systems, the first
+  * value refers to the entire set of carriers ("global").
+- * dtv_status:scale should use the value FE_SCALE_NOT_AVAILABLE when
++ *
++ * @scale should use the value %FE_SCALE_NOT_AVAILABLE when
+  * the value for the entire group of carriers or from one specific layer
+  * is not provided by the hardware.
+- * st.len should be filled with the latest filled status + 1.
+  *
+- * In other words, for ISDB, those values should be filled like:
++ * @len should be filled with the latest filled status + 1.
++ *
++ * In other words, for ISDB, those values should be filled like::
++ *
+  *	u.st.stat.svalue[0] = global statistics;
+  *	u.st.stat.scale[0] = FE_SCALE_DECIBEL;
+  *	u.st.stat.value[1] = layer A statistics;
+@@ -456,11 +808,39 @@ struct dtv_stats {
+ 
+ #define MAX_DTV_STATS   4
+ 
++/**
++ * struct dtv_fe_stats - store Digital TV frontend statistics
++ *
++ * @len:	length of the statistics - if zero, stats is disabled.
++ * @stat:	array with digital TV statistics.
++ *
++ * On most standards, @len can either be 0 or 1. However, for ISDB, each
++ * layer is modulated in separate. So, each layer may have its own set
++ * of statistics. If so, stat[0] carries on a global value for the property.
++ * Indexes 1 to 3 means layer A to B.
++ */
+ struct dtv_fe_stats {
+ 	__u8 len;
+ 	struct dtv_stats stat[MAX_DTV_STATS];
+ } __attribute__ ((packed));
+ 
++/**
++ * struct dtv_property - store one of frontend command and its value
++ *
++ * @cmd:	Digital TV command.
++ * @reserved:	Not used.
++ * @u:		Union with the values for the command.
++ * @result:	Unused
++ *
++ * The @u union may have either one of the values below:
++ *
++ * %data
++ *	an unsigned 32-bits number.
++ * %st
++ *	a &struct dtv_fe_stats array of statistics.
++ * %buffer
++ *	a buffer of up to 32 characters (currently unused).
++ */
+ struct dtv_property {
+ 	__u32 cmd;
+ 	__u32 reserved[3];
+@@ -480,17 +860,70 @@ struct dtv_property {
+ /* num of properties cannot exceed DTV_IOCTL_MAX_MSGS per ioctl */
+ #define DTV_IOCTL_MAX_MSGS 64
+ 
++/**
++ * struct dtv_properties - a set of command/value pairs.
++ *
++ * @num:	amount of commands stored at the struct.
++ * @props:	a pointer to &struct dtv_property.
++ */
+ struct dtv_properties {
+ 	__u32 num;
+ 	struct dtv_property *props;
+ };
+ 
++/*
++ * When set, this flag will disable any zigzagging or other "normal" tuning
++ * behavior. Additionally, there will be no automatic monitoring of the lock
++ * status, and hence no frontend events will be generated. If a frontend device
++ * is closed, this flag will be automatically turned off when the device is
++ * reopened read-write.
++ */
++#define FE_TUNE_MODE_ONESHOT 0x01
++
++/* Digital TV Frontend API calls */
++
++#define FE_GET_INFO		   _IOR('o', 61, struct dvb_frontend_info)
++
++#define FE_DISEQC_RESET_OVERLOAD   _IO('o', 62)
++#define FE_DISEQC_SEND_MASTER_CMD  _IOW('o', 63, struct dvb_diseqc_master_cmd)
++#define FE_DISEQC_RECV_SLAVE_REPLY _IOR('o', 64, struct dvb_diseqc_slave_reply)
++#define FE_DISEQC_SEND_BURST       _IO('o', 65)  /* fe_sec_mini_cmd_t */
++
++#define FE_SET_TONE		   _IO('o', 66)  /* fe_sec_tone_mode_t */
++#define FE_SET_VOLTAGE		   _IO('o', 67)  /* fe_sec_voltage_t */
++#define FE_ENABLE_HIGH_LNB_VOLTAGE _IO('o', 68)  /* int */
++
++#define FE_READ_STATUS		   _IOR('o', 69, fe_status_t)
++#define FE_READ_BER		   _IOR('o', 70, __u32)
++#define FE_READ_SIGNAL_STRENGTH    _IOR('o', 71, __u16)
++#define FE_READ_SNR		   _IOR('o', 72, __u16)
++#define FE_READ_UNCORRECTED_BLOCKS _IOR('o', 73, __u32)
++
++#define FE_SET_FRONTEND_TUNE_MODE  _IO('o', 81) /* unsigned int */
++#define FE_GET_EVENT		   _IOR('o', 78, struct dvb_frontend_event)
++
++#define FE_DISHNETWORK_SEND_LEGACY_CMD _IO('o', 80) /* unsigned int */
++
++#define FE_SET_PROPERTY		   _IOW('o', 82, struct dtv_properties)
++#define FE_GET_PROPERTY		   _IOR('o', 83, struct dtv_properties)
++
+ #if defined(__DVB_CORE__) || !defined (__KERNEL__)
+ 
+ /*
+- * DEPRECATED: The DVBv3 ioctls, structs and enums should not be used on
+- * newer programs, as it doesn't support the second generation of digital
+- * TV standards, nor supports newer delivery systems.
++ * DEPRECATED: Everything below is deprecated in favor of DVBv5 API
++ *
++ * The DVBv3 only ioctls, structs and enums should not be used on
++ * newer programs, as it doesn't support the second generation of
++ * digital TV standards, nor supports newer delivery systems.
++ * They also don't support modern frontends with usually support multiple
++ * delivery systems.
++ *
++ * Drivers shouldn't use them.
++ *
++ * New applications should use DVBv5 delivery system instead
++ */
++
++/*
+  */
+ 
+ enum fe_bandwidth {
+@@ -503,7 +936,7 @@ enum fe_bandwidth {
+ 	BANDWIDTH_1_712_MHZ,
+ };
+ 
+-/* This is needed for legacy userspace support */
++/* This is kept for legacy userspace support */
+ typedef enum fe_sec_voltage fe_sec_voltage_t;
+ typedef enum fe_caps fe_caps_t;
+ typedef enum fe_type fe_type_t;
+@@ -521,6 +954,8 @@ typedef enum fe_pilot fe_pilot_t;
+ typedef enum fe_rolloff fe_rolloff_t;
+ typedef enum fe_delivery_system fe_delivery_system_t;
+ 
++/* DVBv3 structs */
++
+ struct dvb_qpsk_parameters {
+ 	__u32		symbol_rate;  /* symbol rate in Symbols per second */
+ 	fe_code_rate_t	fec_inner;    /* forward error correction (see above) */
+@@ -562,42 +997,12 @@ struct dvb_frontend_event {
+ 	fe_status_t status;
+ 	struct dvb_frontend_parameters parameters;
+ };
+-#endif
+ 
+-#define FE_SET_PROPERTY		   _IOW('o', 82, struct dtv_properties)
+-#define FE_GET_PROPERTY		   _IOR('o', 83, struct dtv_properties)
+-
+-/**
+- * When set, this flag will disable any zigzagging or other "normal" tuning
+- * behaviour. Additionally, there will be no automatic monitoring of the lock
+- * status, and hence no frontend events will be generated. If a frontend device
+- * is closed, this flag will be automatically turned off when the device is
+- * reopened read-write.
+- */
+-#define FE_TUNE_MODE_ONESHOT 0x01
+-
+-#define FE_GET_INFO		   _IOR('o', 61, struct dvb_frontend_info)
+-
+-#define FE_DISEQC_RESET_OVERLOAD   _IO('o', 62)
+-#define FE_DISEQC_SEND_MASTER_CMD  _IOW('o', 63, struct dvb_diseqc_master_cmd)
+-#define FE_DISEQC_RECV_SLAVE_REPLY _IOR('o', 64, struct dvb_diseqc_slave_reply)
+-#define FE_DISEQC_SEND_BURST       _IO('o', 65)  /* fe_sec_mini_cmd_t */
+-
+-#define FE_SET_TONE		   _IO('o', 66)  /* fe_sec_tone_mode_t */
+-#define FE_SET_VOLTAGE		   _IO('o', 67)  /* fe_sec_voltage_t */
+-#define FE_ENABLE_HIGH_LNB_VOLTAGE _IO('o', 68)  /* int */
+-
+-#define FE_READ_STATUS		   _IOR('o', 69, fe_status_t)
+-#define FE_READ_BER		   _IOR('o', 70, __u32)
+-#define FE_READ_SIGNAL_STRENGTH    _IOR('o', 71, __u16)
+-#define FE_READ_SNR		   _IOR('o', 72, __u16)
+-#define FE_READ_UNCORRECTED_BLOCKS _IOR('o', 73, __u32)
++/* DVBv3 API calls */
+ 
+ #define FE_SET_FRONTEND		   _IOW('o', 76, struct dvb_frontend_parameters)
+ #define FE_GET_FRONTEND		   _IOR('o', 77, struct dvb_frontend_parameters)
+-#define FE_SET_FRONTEND_TUNE_MODE  _IO('o', 81) /* unsigned int */
+-#define FE_GET_EVENT		   _IOR('o', 78, struct dvb_frontend_event)
+ 
+-#define FE_DISHNETWORK_SEND_LEGACY_CMD _IO('o', 80) /* unsigned int */
++#endif
+ 
+ #endif /*_DVBFRONTEND_H_*/
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 1b75fb8c7735..a864e94ecb6b 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -561,11 +561,12 @@ static void kprobe_optimizer(struct work_struct *work)
+ 	do_free_cleaned_kprobes();
+ 
+ 	mutex_unlock(&module_mutex);
+-	mutex_unlock(&kprobe_mutex);
+ 
+ 	/* Step 5: Kick optimizer again if needed */
+ 	if (!list_empty(&optimizing_list) || !list_empty(&unoptimizing_list))
+ 		kick_kprobe_optimizer();
++
++	mutex_unlock(&kprobe_mutex);
+ }
+ 
+ /* Wait for completing optimization and unoptimization */
+@@ -1149,6 +1150,26 @@ __releases(hlist_lock)
+ }
+ NOKPROBE_SYMBOL(kretprobe_table_unlock);
+ 
++struct kprobe kprobe_busy = {
++	.addr = (void *) get_kprobe,
++};
++
++void kprobe_busy_begin(void)
++{
++	struct kprobe_ctlblk *kcb;
++
++	preempt_disable();
++	__this_cpu_write(current_kprobe, &kprobe_busy);
++	kcb = get_kprobe_ctlblk();
++	kcb->kprobe_status = KPROBE_HIT_ACTIVE;
++}
++
++void kprobe_busy_end(void)
++{
++	__this_cpu_write(current_kprobe, NULL);
++	preempt_enable();
++}
++
+ /*
+  * This function is called from finish_task_switch when task tk becomes dead,
+  * so that we can recycle any function-return probe instances associated
+@@ -1166,6 +1187,8 @@ void kprobe_flush_task(struct task_struct *tk)
+ 		/* Early boot.  kretprobe_table_locks not yet initialized. */
+ 		return;
+ 
++	kprobe_busy_begin();
++
+ 	INIT_HLIST_HEAD(&empty_rp);
+ 	hash = hash_ptr(tk, KPROBE_HASH_BITS);
+ 	head = &kretprobe_inst_table[hash];
+@@ -1179,6 +1202,8 @@ void kprobe_flush_task(struct task_struct *tk)
+ 		hlist_del(&ri->hlist);
+ 		kfree(ri);
+ 	}
++
++	kprobe_busy_end();
+ }
+ NOKPROBE_SYMBOL(kprobe_flush_task);
+ 
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 82cec9a666e7..870d802c46f9 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -3697,7 +3697,8 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
+ 	if (dl_prio(prio)) {
+ 		struct task_struct *pi_task = rt_mutex_get_top_task(p);
+ 		if (!dl_prio(p->normal_prio) ||
+-		    (pi_task && dl_entity_preempt(&pi_task->dl, &p->dl))) {
++		    (pi_task && dl_prio(pi_task->prio) &&
++		     dl_entity_preempt(&pi_task->dl, &p->dl))) {
+ 			p->dl.dl_boosted = 1;
+ 			queue_flag |= ENQUEUE_REPLENISH;
+ 		} else
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index 6d3b432a748a..88eb9261c7b5 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -15,6 +15,9 @@
+  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+  *
+  */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
+ #include <linux/kernel.h>
+ #include <linux/blkdev.h>
+ #include <linux/blktrace_api.h>
+@@ -481,6 +484,16 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+ 	 */
+ 	strreplace(buts->name, '/', '_');
+ 
++	/*
++	 * bdev can be NULL, as with scsi-generic, this is a helpful as
++	 * we can be.
++	 */
++	if (q->blk_trace) {
++		pr_warn("Concurrent blktraces are not allowed on %s\n",
++			buts->name);
++		return -EBUSY;
++	}
++
+ 	bt = kzalloc(sizeof(*bt), GFP_KERNEL);
+ 	if (!bt)
+ 		return -ENOMEM;
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index c9ca2ed50c0e..a371c7def875 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -222,11 +222,17 @@ static int event_trigger_regex_open(struct inode *inode, struct file *file)
+ 
+ static int trigger_process_regex(struct trace_event_file *file, char *buff)
+ {
+-	char *command, *next = buff;
++	char *command, *next;
+ 	struct event_command *p;
+ 	int ret = -EINVAL;
+ 
++	next = buff = skip_spaces(buff);
+ 	command = strsep(&next, ": \t");
++	if (next) {
++		next = skip_spaces(next);
++		if (!*next)
++			next = NULL;
++	}
+ 	command = (command[0] != '!') ? command : command + 1;
+ 
+ 	mutex_lock(&trigger_cmd_mutex);
+@@ -629,8 +635,14 @@ event_trigger_callback(struct event_command *cmd_ops,
+ 	int ret;
+ 
+ 	/* separate the trigger from the filter (t:n [if filter]) */
+-	if (param && isdigit(param[0]))
++	if (param && isdigit(param[0])) {
+ 		trigger = strsep(&param, " \t");
++		if (param) {
++			param = skip_spaces(param);
++			if (!*param)
++				param = NULL;
++		}
++	}
+ 
+ 	trigger_ops = cmd_ops->get_trigger_ops(cmd, trigger);
+ 
+@@ -1335,6 +1347,11 @@ int event_enable_trigger_func(struct event_command *cmd_ops,
+ 	trigger = strsep(&param, " \t");
+ 	if (!trigger)
+ 		return -EINVAL;
++	if (param) {
++		param = skip_spaces(param);
++		if (!*param)
++			param = NULL;
++	}
+ 
+ 	system = strsep(&trigger, ":");
+ 	if (!trigger)
+diff --git a/lib/zlib_inflate/inffast.c b/lib/zlib_inflate/inffast.c
+index 2c13ecc5bb2c..ed1f3df27260 100644
+--- a/lib/zlib_inflate/inffast.c
++++ b/lib/zlib_inflate/inffast.c
+@@ -10,17 +10,6 @@
+ 
+ #ifndef ASMINF
+ 
+-/* Allow machine dependent optimization for post-increment or pre-increment.
+-   Based on testing to date,
+-   Pre-increment preferred for:
+-   - PowerPC G3 (Adler)
+-   - MIPS R5000 (Randers-Pehrson)
+-   Post-increment preferred for:
+-   - none
+-   No measurable difference:
+-   - Pentium III (Anderson)
+-   - M68060 (Nikl)
+- */
+ union uu {
+ 	unsigned short us;
+ 	unsigned char b[2];
+@@ -38,16 +27,6 @@ get_unaligned16(const unsigned short *p)
+ 	return mm.us;
+ }
+ 
+-#ifdef POSTINC
+-#  define OFF 0
+-#  define PUP(a) *(a)++
+-#  define UP_UNALIGNED(a) get_unaligned16((a)++)
+-#else
+-#  define OFF 1
+-#  define PUP(a) *++(a)
+-#  define UP_UNALIGNED(a) get_unaligned16(++(a))
+-#endif
+-
+ /*
+    Decode literal, length, and distance codes and write out the resulting
+    literal and match bytes until either not enough input or output is
+@@ -115,9 +94,9 @@ void inflate_fast(z_streamp strm, unsigned start)
+ 
+     /* copy state to local variables */
+     state = (struct inflate_state *)strm->state;
+-    in = strm->next_in - OFF;
++    in = strm->next_in;
+     last = in + (strm->avail_in - 5);
+-    out = strm->next_out - OFF;
++    out = strm->next_out;
+     beg = out - (start - strm->avail_out);
+     end = out + (strm->avail_out - 257);
+ #ifdef INFLATE_STRICT
+@@ -138,9 +117,9 @@ void inflate_fast(z_streamp strm, unsigned start)
+        input data or output space */
+     do {
+         if (bits < 15) {
+-            hold += (unsigned long)(PUP(in)) << bits;
++            hold += (unsigned long)(*in++) << bits;
+             bits += 8;
+-            hold += (unsigned long)(PUP(in)) << bits;
++            hold += (unsigned long)(*in++) << bits;
+             bits += 8;
+         }
+         this = lcode[hold & lmask];
+@@ -150,14 +129,14 @@ void inflate_fast(z_streamp strm, unsigned start)
+         bits -= op;
+         op = (unsigned)(this.op);
+         if (op == 0) {                          /* literal */
+-            PUP(out) = (unsigned char)(this.val);
++            *out++ = (unsigned char)(this.val);
+         }
+         else if (op & 16) {                     /* length base */
+             len = (unsigned)(this.val);
+             op &= 15;                           /* number of extra bits */
+             if (op) {
+                 if (bits < op) {
+-                    hold += (unsigned long)(PUP(in)) << bits;
++                    hold += (unsigned long)(*in++) << bits;
+                     bits += 8;
+                 }
+                 len += (unsigned)hold & ((1U << op) - 1);
+@@ -165,9 +144,9 @@ void inflate_fast(z_streamp strm, unsigned start)
+                 bits -= op;
+             }
+             if (bits < 15) {
+-                hold += (unsigned long)(PUP(in)) << bits;
++                hold += (unsigned long)(*in++) << bits;
+                 bits += 8;
+-                hold += (unsigned long)(PUP(in)) << bits;
++                hold += (unsigned long)(*in++) << bits;
+                 bits += 8;
+             }
+             this = dcode[hold & dmask];
+@@ -180,10 +159,10 @@ void inflate_fast(z_streamp strm, unsigned start)
+                 dist = (unsigned)(this.val);
+                 op &= 15;                       /* number of extra bits */
+                 if (bits < op) {
+-                    hold += (unsigned long)(PUP(in)) << bits;
++                    hold += (unsigned long)(*in++) << bits;
+                     bits += 8;
+                     if (bits < op) {
+-                        hold += (unsigned long)(PUP(in)) << bits;
++                        hold += (unsigned long)(*in++) << bits;
+                         bits += 8;
+                     }
+                 }
+@@ -205,13 +184,13 @@ void inflate_fast(z_streamp strm, unsigned start)
+                         state->mode = BAD;
+                         break;
+                     }
+-                    from = window - OFF;
++                    from = window;
+                     if (write == 0) {           /* very common case */
+                         from += wsize - op;
+                         if (op < len) {         /* some from window */
+                             len -= op;
+                             do {
+-                                PUP(out) = PUP(from);
++                                *out++ = *from++;
+                             } while (--op);
+                             from = out - dist;  /* rest from output */
+                         }
+@@ -222,14 +201,14 @@ void inflate_fast(z_streamp strm, unsigned start)
+                         if (op < len) {         /* some from end of window */
+                             len -= op;
+                             do {
+-                                PUP(out) = PUP(from);
++                                *out++ = *from++;
+                             } while (--op);
+-                            from = window - OFF;
++                            from = window;
+                             if (write < len) {  /* some from start of window */
+                                 op = write;
+                                 len -= op;
+                                 do {
+-                                    PUP(out) = PUP(from);
++                                    *out++ = *from++;
+                                 } while (--op);
+                                 from = out - dist;      /* rest from output */
+                             }
+@@ -240,21 +219,21 @@ void inflate_fast(z_streamp strm, unsigned start)
+                         if (op < len) {         /* some from window */
+                             len -= op;
+                             do {
+-                                PUP(out) = PUP(from);
++                                *out++ = *from++;
+                             } while (--op);
+                             from = out - dist;  /* rest from output */
+                         }
+                     }
+                     while (len > 2) {
+-                        PUP(out) = PUP(from);
+-                        PUP(out) = PUP(from);
+-                        PUP(out) = PUP(from);
++                        *out++ = *from++;
++                        *out++ = *from++;
++                        *out++ = *from++;
+                         len -= 3;
+                     }
+                     if (len) {
+-                        PUP(out) = PUP(from);
++                        *out++ = *from++;
+                         if (len > 1)
+-                            PUP(out) = PUP(from);
++                            *out++ = *from++;
+                     }
+                 }
+                 else {
+@@ -264,29 +243,29 @@ void inflate_fast(z_streamp strm, unsigned start)
+                     from = out - dist;          /* copy direct from output */
+ 		    /* minimum length is three */
+ 		    /* Align out addr */
+-		    if (!((long)(out - 1 + OFF) & 1)) {
+-			PUP(out) = PUP(from);
++		    if (!((long)(out - 1) & 1)) {
++			*out++ = *from++;
+ 			len--;
+ 		    }
+-		    sout = (unsigned short *)(out - OFF);
++		    sout = (unsigned short *)(out);
+ 		    if (dist > 2) {
+ 			unsigned short *sfrom;
+ 
+-			sfrom = (unsigned short *)(from - OFF);
++			sfrom = (unsigned short *)(from);
+ 			loops = len >> 1;
+ 			do
+ #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+-			    PUP(sout) = PUP(sfrom);
++			    *sout++ = *sfrom++;
+ #else
+-			    PUP(sout) = UP_UNALIGNED(sfrom);
++			    *sout++ = get_unaligned16(sfrom++);
+ #endif
+ 			while (--loops);
+-			out = (unsigned char *)sout + OFF;
+-			from = (unsigned char *)sfrom + OFF;
++			out = (unsigned char *)sout;
++			from = (unsigned char *)sfrom;
+ 		    } else { /* dist == 1 or dist == 2 */
+ 			unsigned short pat16;
+ 
+-			pat16 = *(sout-1+OFF);
++			pat16 = *(sout-1);
+ 			if (dist == 1) {
+ 				union uu mm;
+ 				/* copy one char pattern to both bytes */
+@@ -296,12 +275,12 @@ void inflate_fast(z_streamp strm, unsigned start)
+ 			}
+ 			loops = len >> 1;
+ 			do
+-			    PUP(sout) = pat16;
++			    *sout++ = pat16;
+ 			while (--loops);
+-			out = (unsigned char *)sout + OFF;
++			out = (unsigned char *)sout;
+ 		    }
+ 		    if (len & 1)
+-			PUP(out) = PUP(from);
++			*out++ = *from++;
+                 }
+             }
+             else if ((op & 64) == 0) {          /* 2nd level distance code */
+@@ -336,8 +315,8 @@ void inflate_fast(z_streamp strm, unsigned start)
+     hold &= (1U << bits) - 1;
+ 
+     /* update state and return */
+-    strm->next_in = in + OFF;
+-    strm->next_out = out + OFF;
++    strm->next_in = in;
++    strm->next_out = out;
+     strm->avail_in = (unsigned)(in < last ? 5 + (last - in) : 5 - (in - last));
+     strm->avail_out = (unsigned)(out < end ?
+                                  257 + (end - out) : 257 - (out - end));
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index 13f1926f8fcd..26c4d4722927 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -1345,7 +1345,7 @@ void kzfree(const void *p)
+ 	if (unlikely(ZERO_OR_NULL_PTR(mem)))
+ 		return;
+ 	ks = ksize(mem);
+-	memset(mem, 0, ks);
++	memzero_explicit(mem, ks);
+ 	kfree(mem);
+ }
+ EXPORT_SYMBOL(kzfree);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 1041523aaa76..267b648a0645 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -82,6 +82,7 @@
+ #include <linux/slab.h>
+ #include <linux/sched.h>
+ #include <linux/mutex.h>
++#include <linux/rwsem.h>
+ #include <linux/string.h>
+ #include <linux/mm.h>
+ #include <linux/socket.h>
+@@ -189,7 +190,7 @@ static DEFINE_SPINLOCK(napi_hash_lock);
+ static unsigned int napi_gen_id = NR_CPUS;
+ static DEFINE_READ_MOSTLY_HASHTABLE(napi_hash, 8);
+ 
+-static seqcount_t devnet_rename_seq;
++static DECLARE_RWSEM(devnet_rename_sem);
+ 
+ static inline void dev_base_seq_inc(struct net *net)
+ {
+@@ -866,33 +867,28 @@ EXPORT_SYMBOL(dev_get_by_index);
+  *	@net: network namespace
+  *	@name: a pointer to the buffer where the name will be stored.
+  *	@ifindex: the ifindex of the interface to get the name from.
+- *
+- *	The use of raw_seqcount_begin() and cond_resched() before
+- *	retrying is required as we want to give the writers a chance
+- *	to complete when CONFIG_PREEMPT is not set.
+  */
+ int netdev_get_name(struct net *net, char *name, int ifindex)
+ {
+ 	struct net_device *dev;
+-	unsigned int seq;
++	int ret;
+ 
+-retry:
+-	seq = raw_seqcount_begin(&devnet_rename_seq);
++	down_read(&devnet_rename_sem);
+ 	rcu_read_lock();
++
+ 	dev = dev_get_by_index_rcu(net, ifindex);
+ 	if (!dev) {
+-		rcu_read_unlock();
+-		return -ENODEV;
++		ret = -ENODEV;
++		goto out;
+ 	}
+ 
+ 	strcpy(name, dev->name);
+-	rcu_read_unlock();
+-	if (read_seqcount_retry(&devnet_rename_seq, seq)) {
+-		cond_resched();
+-		goto retry;
+-	}
+ 
+-	return 0;
++	ret = 0;
++out:
++	rcu_read_unlock();
++	up_read(&devnet_rename_sem);
++	return ret;
+ }
+ 
+ /**
+@@ -1157,10 +1153,10 @@ int dev_change_name(struct net_device *dev, const char *newname)
+ 	if (dev->flags & IFF_UP)
+ 		return -EBUSY;
+ 
+-	write_seqcount_begin(&devnet_rename_seq);
++	down_write(&devnet_rename_sem);
+ 
+ 	if (strncmp(newname, dev->name, IFNAMSIZ) == 0) {
+-		write_seqcount_end(&devnet_rename_seq);
++		up_write(&devnet_rename_sem);
+ 		return 0;
+ 	}
+ 
+@@ -1168,7 +1164,7 @@ int dev_change_name(struct net_device *dev, const char *newname)
+ 
+ 	err = dev_get_valid_name(net, dev, newname);
+ 	if (err < 0) {
+-		write_seqcount_end(&devnet_rename_seq);
++		up_write(&devnet_rename_sem);
+ 		return err;
+ 	}
+ 
+@@ -1183,11 +1179,11 @@ rollback:
+ 	if (ret) {
+ 		memcpy(dev->name, oldname, IFNAMSIZ);
+ 		dev->name_assign_type = old_assign_type;
+-		write_seqcount_end(&devnet_rename_seq);
++		up_write(&devnet_rename_sem);
+ 		return ret;
+ 	}
+ 
+-	write_seqcount_end(&devnet_rename_seq);
++	up_write(&devnet_rename_sem);
+ 
+ 	netdev_adjacent_rename_links(dev, oldname);
+ 
+@@ -1208,7 +1204,7 @@ rollback:
+ 		/* err >= 0 after dev_alloc_name() or stores the first errno */
+ 		if (err >= 0) {
+ 			err = ret;
+-			write_seqcount_begin(&devnet_rename_seq);
++			down_write(&devnet_rename_sem);
+ 			memcpy(dev->name, oldname, IFNAMSIZ);
+ 			memcpy(oldname, newname, IFNAMSIZ);
+ 			dev->name_assign_type = old_assign_type;
+@@ -7359,6 +7355,13 @@ int register_netdevice(struct net_device *dev)
+ 		rcu_barrier();
+ 
+ 		dev->reg_state = NETREG_UNREGISTERED;
++		/* We should put the kobject that hold in
++		 * netdev_unregister_kobject(), otherwise
++		 * the net device cannot be freed when
++		 * driver calls free_netdev(), because the
++		 * kobject is being hold.
++		 */
++		kobject_put(&dev->dev.kobj);
+ 	}
+ 	/*
+ 	 *	Prevent userspace races by waiting until the network
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 41794a698da6..dac9365151df 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1403,6 +1403,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
+ 		cgroup_sk_alloc(&sk->sk_cgrp_data);
+ 		sock_update_classid(&sk->sk_cgrp_data);
+ 		sock_update_netprioidx(&sk->sk_cgrp_data);
++		sk_tx_queue_clear(sk);
+ 	}
+ 
+ 	return sk;
+@@ -1587,6 +1588,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
+ 		 */
+ 		sk_refcnt_debug_inc(newsk);
+ 		sk_set_socket(newsk, NULL);
++		sk_tx_queue_clear(newsk);
+ 		newsk->sk_wq = NULL;
+ 
+ 		if (newsk->sk_prot->sockets_allocated)
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
+index 6aec95e1fc13..305104d116d6 100644
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -776,7 +776,7 @@ static int fib_check_nh(struct fib_config *cfg, struct fib_info *fi,
+ 			if (fl4.flowi4_scope < RT_SCOPE_LINK)
+ 				fl4.flowi4_scope = RT_SCOPE_LINK;
+ 
+-			if (cfg->fc_table)
++			if (cfg->fc_table && cfg->fc_table != RT_TABLE_MAIN)
+ 				tbl = fib_get_table(net, cfg->fc_table);
+ 
+ 			if (tbl)
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index dd5db4cc7d06..5f2e3334ccce 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -98,9 +98,10 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
+ 				   __be32 remote, __be32 local,
+ 				   __be32 key)
+ {
+-	unsigned int hash;
+ 	struct ip_tunnel *t, *cand = NULL;
+ 	struct hlist_head *head;
++	struct net_device *ndev;
++	unsigned int hash;
+ 
+ 	hash = ip_tunnel_hash(key, remote);
+ 	head = &itn->tunnels[hash];
+@@ -175,8 +176,9 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
+ 	if (t)
+ 		return t;
+ 
+-	if (itn->fb_tunnel_dev && itn->fb_tunnel_dev->flags & IFF_UP)
+-		return netdev_priv(itn->fb_tunnel_dev);
++	ndev = READ_ONCE(itn->fb_tunnel_dev);
++	if (ndev && ndev->flags & IFF_UP)
++		return netdev_priv(ndev);
+ 
+ 	return NULL;
+ }
+@@ -1193,9 +1195,9 @@ void ip_tunnel_uninit(struct net_device *dev)
+ 	struct ip_tunnel_net *itn;
+ 
+ 	itn = net_generic(net, tunnel->ip_tnl_net_id);
+-	/* fb_tunnel_dev will be unregisted in net-exit call. */
+-	if (itn->fb_tunnel_dev != dev)
+-		ip_tunnel_del(itn, netdev_priv(dev));
++	ip_tunnel_del(itn, netdev_priv(dev));
++	if (itn->fb_tunnel_dev == dev)
++		WRITE_ONCE(itn->fb_tunnel_dev, NULL);
+ 
+ 	dst_cache_reset(&tunnel->dst_cache);
+ }
+diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
+index c99230efcd52..00397c6add20 100644
+--- a/net/ipv4/tcp_cubic.c
++++ b/net/ipv4/tcp_cubic.c
+@@ -414,6 +414,8 @@ static void hystart_update(struct sock *sk, u32 delay)
+ 
+ 	if (hystart_detect & HYSTART_DELAY) {
+ 		/* obtain the minimum delay of more than sampling packets */
++		if (ca->curr_rtt > delay)
++			ca->curr_rtt = delay;
+ 		if (ca->sample_cnt < HYSTART_MIN_SAMPLES) {
+ 			if (ca->curr_rtt == 0 || ca->curr_rtt > delay)
+ 				ca->curr_rtt = delay;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 52014c5312b9..b3953f789891 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -4537,7 +4537,11 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
+ 	if (tcp_ooo_try_coalesce(sk, tp->ooo_last_skb,
+ 				 skb, &fragstolen)) {
+ coalesce_done:
+-		tcp_grow_window(sk, skb);
++		/* For non sack flows, do not grow window to force DUPACK
++		 * and trigger fast retransmit.
++		 */
++		if (tcp_is_sack(tp))
++			tcp_grow_window(sk, skb);
+ 		kfree_skb_partial(skb, fragstolen);
+ 		skb = NULL;
+ 		goto add_sack;
+@@ -4621,7 +4625,11 @@ add_sack:
+ 		tcp_sack_new_ofo_skb(sk, seq, end_seq);
+ end:
+ 	if (skb) {
+-		tcp_grow_window(sk, skb);
++		/* For non sack flows, do not grow window to force DUPACK
++		 * and trigger fast retransmit.
++		 */
++		if (tcp_is_sack(tp))
++			tcp_grow_window(sk, skb);
+ 		skb_set_owner_r(skb, sk);
+ 	}
+ }
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index caee5530ae2c..ca001ecb7197 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -124,6 +124,7 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev,
+ 	int dev_type = (gre_proto == htons(ETH_P_TEB)) ?
+ 		       ARPHRD_ETHER : ARPHRD_IP6GRE;
+ 	int score, cand_score = 4;
++	struct net_device *ndev;
+ 
+ 	for_each_ip_tunnel_rcu(t, ign->tunnels_r_l[h0 ^ h1]) {
+ 		if (!ipv6_addr_equal(local, &t->parms.laddr) ||
+@@ -226,9 +227,9 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev,
+ 	if (cand)
+ 		return cand;
+ 
+-	dev = ign->fb_tunnel_dev;
+-	if (dev->flags & IFF_UP)
+-		return netdev_priv(dev);
++	ndev = READ_ONCE(ign->fb_tunnel_dev);
++	if (ndev && ndev->flags & IFF_UP)
++		return netdev_priv(ndev);
+ 
+ 	return NULL;
+ }
+@@ -364,6 +365,8 @@ static void ip6gre_tunnel_uninit(struct net_device *dev)
+ 	struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
+ 
+ 	ip6gre_tunnel_unlink(ign, t);
++	if (ign->fb_tunnel_dev == dev)
++		WRITE_ONCE(ign->fb_tunnel_dev, NULL);
+ 	dst_cache_reset(&t->dst_cache);
+ 	dev_put(dev);
+ }
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index e065d48b31b9..f904b9b24027 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -2601,6 +2601,7 @@ void ipv6_mc_destroy_dev(struct inet6_dev *idev)
+ 		idev->mc_list = i->next;
+ 
+ 		write_unlock_bh(&idev->lock);
++		ip6_mc_clear_src(i);
+ 		ma_put(i);
+ 		write_lock_bh(&idev->lock);
+ 	}
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index fdc1de1cb4fa..c191ea65a6c7 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -351,8 +351,13 @@ int l2tp_session_register(struct l2tp_session *session,
+ 
+ 		spin_lock_bh(&pn->l2tp_session_hlist_lock);
+ 
++		/* IP encap expects session IDs to be globally unique, while
++		 * UDP encap doesn't.
++		 */
+ 		hlist_for_each_entry(session_walk, g_head, global_hlist)
+-			if (session_walk->session_id == session->session_id) {
++			if (session_walk->session_id == session->session_id &&
++			    (session_walk->tunnel->encap == L2TP_ENCAPTYPE_IP ||
++			     tunnel->encap == L2TP_ENCAPTYPE_IP)) {
+ 				err = -EEXIST;
+ 				goto err_tlock_pnlock;
+ 			}
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index f64660e9ff87..511496278262 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -379,6 +379,8 @@ ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len,
+ 	for (id = 0; id < IPSET_EXT_ID_MAX; id++) {
+ 		if (!add_extension(id, cadt_flags, tb))
+ 			continue;
++		if (align < ip_set_extensions[id].align)
++			align = ip_set_extensions[id].align;
+ 		len = ALIGN(len, ip_set_extensions[id].align);
+ 		set->offset[id] = len;
+ 		set->extensions |= ip_set_extensions[id].type;
+diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
+index 832d854c2d5c..01ad588144e3 100644
+--- a/net/rxrpc/call_accept.c
++++ b/net/rxrpc/call_accept.c
+@@ -26,6 +26,11 @@
+ #include <net/ip.h>
+ #include "ar-internal.h"
+ 
++static void rxrpc_dummy_notify(struct sock *sk, struct rxrpc_call *call,
++			       unsigned long user_call_ID)
++{
++}
++
+ /*
+  * Preallocate a single service call, connection and peer and, if possible,
+  * give them a user ID and attach the user's side of the ID to them.
+@@ -224,6 +229,8 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx)
+ 		if (rx->discard_new_call) {
+ 			_debug("discard %lx", call->user_call_ID);
+ 			rx->discard_new_call(call, call->user_call_ID);
++			if (call->notify_rx)
++				call->notify_rx = rxrpc_dummy_notify;
+ 			rxrpc_put_call(call, rxrpc_call_put_kernel);
+ 		}
+ 		rxrpc_call_completed(call);
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index 88ce8edf1261..04ca08f85220 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -337,6 +337,7 @@ void __netdev_watchdog_up(struct net_device *dev)
+ 			dev_hold(dev);
+ 	}
+ }
++EXPORT_SYMBOL_GPL(__netdev_watchdog_up);
+ 
+ static void dev_watchdog_up(struct net_device *dev)
+ {
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index 16e120b84118..8c5597d07240 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1583,12 +1583,15 @@ void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len)
+ int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc,
+ 				     sctp_scope_t scope, gfp_t gfp)
+ {
++	struct sock *sk = asoc->base.sk;
+ 	int flags;
+ 
+ 	/* Use scoping rules to determine the subset of addresses from
+ 	 * the endpoint.
+ 	 */
+-	flags = (PF_INET6 == asoc->base.sk->sk_family) ? SCTP_ADDR6_ALLOWED : 0;
++	flags = (PF_INET6 == sk->sk_family) ? SCTP_ADDR6_ALLOWED : 0;
++	if (!inet_v6_ipv6only(sk))
++		flags |= SCTP_ADDR4_ALLOWED;
+ 	if (asoc->peer.ipv4_address)
+ 		flags |= SCTP_ADDR4_PEERSUPP;
+ 	if (asoc->peer.ipv6_address)
+diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
+index 401c60750b20..dc4335d817d8 100644
+--- a/net/sctp/bind_addr.c
++++ b/net/sctp/bind_addr.c
+@@ -451,6 +451,7 @@ static int sctp_copy_one_addr(struct net *net, struct sctp_bind_addr *dest,
+ 		 * well as the remote peer.
+ 		 */
+ 		if ((((AF_INET == addr->sa.sa_family) &&
++		      (flags & SCTP_ADDR4_ALLOWED) &&
+ 		      (flags & SCTP_ADDR4_PEERSUPP))) ||
+ 		    (((AF_INET6 == addr->sa.sa_family) &&
+ 		      (flags & SCTP_ADDR6_ALLOWED) &&
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index c5a2a538279b..b2c242facf1b 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -210,6 +210,7 @@ int sctp_copy_local_addr_list(struct net *net, struct sctp_bind_addr *bp,
+ 			 * sock as well as the remote peer.
+ 			 */
+ 			if ((((AF_INET == addr->a.sa.sa_family) &&
++			      (copy_flags & SCTP_ADDR4_ALLOWED) &&
+ 			      (copy_flags & SCTP_ADDR4_PEERSUPP))) ||
+ 			    (((AF_INET6 == addr->a.sa.sa_family) &&
+ 			      (copy_flags & SCTP_ADDR6_ALLOWED) &&
+diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
+index 2e0a6f92e563..8391c2785550 100644
+--- a/net/sunrpc/addr.c
++++ b/net/sunrpc/addr.c
+@@ -81,11 +81,11 @@ static size_t rpc_ntop6(const struct sockaddr *sap,
+ 
+ 	rc = snprintf(scopebuf, sizeof(scopebuf), "%c%u",
+ 			IPV6_SCOPE_DELIMITER, sin6->sin6_scope_id);
+-	if (unlikely((size_t)rc > sizeof(scopebuf)))
++	if (unlikely((size_t)rc >= sizeof(scopebuf)))
+ 		return 0;
+ 
+ 	len += rc;
+-	if (unlikely(len > buflen))
++	if (unlikely(len >= buflen))
+ 		return 0;
+ 
+ 	strcat(buf, scopebuf);
+diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
+index 34f94052c519..137f92bfafac 100644
+--- a/net/sunrpc/rpc_pipe.c
++++ b/net/sunrpc/rpc_pipe.c
+@@ -1347,6 +1347,7 @@ rpc_gssd_dummy_populate(struct dentry *root, struct rpc_pipe *pipe_data)
+ 	q.len = strlen(gssd_dummy_clnt_dir[0].name);
+ 	clnt_dentry = d_hash_and_lookup(gssd_dentry, &q);
+ 	if (!clnt_dentry) {
++		__rpc_depopulate(gssd_dentry, gssd_dummy_clnt_dir, 0, 1);
+ 		pipe_dentry = ERR_PTR(-ENOENT);
+ 		goto out;
+ 	}
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index 69846c6574ef..dd547edee59f 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -1036,6 +1036,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
+ 		base = 0;
+ 	} else {
+ 		base -= buf->head[0].iov_len;
++		subbuf->head[0].iov_base = buf->head[0].iov_base;
+ 		subbuf->head[0].iov_len = 0;
+ 	}
+ 
+@@ -1048,6 +1049,8 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
+ 		base = 0;
+ 	} else {
+ 		base -= buf->page_len;
++		subbuf->pages = buf->pages;
++		subbuf->page_base = 0;
+ 		subbuf->page_len = 0;
+ 	}
+ 
+@@ -1059,6 +1062,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
+ 		base = 0;
+ 	} else {
+ 		base -= buf->tail[0].iov_len;
++		subbuf->tail[0].iov_base = buf->tail[0].iov_base;
+ 		subbuf->tail[0].iov_len = 0;
+ 	}
+ 
+diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
+index 558dea61db11..1920b9e2d251 100644
+--- a/scripts/Kbuild.include
++++ b/scripts/Kbuild.include
+@@ -82,20 +82,21 @@ cc-cross-prefix =  \
+ 		fi)))
+ 
+ # output directory for tests below
+-TMPOUT := $(if $(KBUILD_EXTMOD),$(firstword $(KBUILD_EXTMOD))/)
++TMPOUT = $(if $(KBUILD_EXTMOD),$(firstword $(KBUILD_EXTMOD))/).tmp_$$$$
+ 
+ # try-run
+ # Usage: option = $(call try-run, $(CC)...-o "$$TMP",option-ok,otherwise)
+ # Exit code chooses option. "$$TMP" is can be used as temporary file and
+ # is automatically cleaned up.
+ try-run = $(shell set -e;		\
+-	TMP="$(TMPOUT).$$$$.tmp";	\
+-	TMPO="$(TMPOUT).$$$$.o";	\
++	TMP=$(TMPOUT)/tmp;		\
++	TMPO=$(TMPOUT)/tmp.o;		\
++	mkdir -p $(TMPOUT);		\
++	trap "rm -rf $(TMPOUT)" EXIT;	\
+ 	if ($(1)) >/dev/null 2>&1;	\
+ 	then echo "$(2)";		\
+ 	else echo "$(3)";		\
+-	fi;				\
+-	rm -f "$$TMP" "$$TMPO")
++	fi)
+ 
+ # as-option
+ # Usage: cflags-y += $(call as-option,-Wa$(comma)-isa=foo,)
+diff --git a/scripts/mksysmap b/scripts/mksysmap
+index a35acc0d0b82..9aa23d15862a 100755
+--- a/scripts/mksysmap
++++ b/scripts/mksysmap
+@@ -41,4 +41,4 @@
+ # so we just ignore them to let readprofile continue to work.
+ # (At least sparc64 has __crc_ in the middle).
+ 
+-$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( .L\)' > $2
++$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)' > $2
+diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
+index bfc4ffa1fa1a..6ca297821d45 100644
+--- a/security/selinux/ss/services.c
++++ b/security/selinux/ss/services.c
+@@ -2616,8 +2616,12 @@ err:
+ 	if (*names) {
+ 		for (i = 0; i < *len; i++)
+ 			kfree((*names)[i]);
++		kfree(*names);
+ 	}
+ 	kfree(*values);
++	*len = 0;
++	*names = NULL;
++	*values = NULL;
+ 	goto out;
+ }
+ 
+diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c
+index 718d5e3b7806..6c06d0645779 100644
+--- a/sound/isa/wavefront/wavefront_synth.c
++++ b/sound/isa/wavefront/wavefront_synth.c
+@@ -1174,7 +1174,10 @@ wavefront_send_alias (snd_wavefront_t *dev, wavefront_patch_info *header)
+ 				      "alias for %d\n",
+ 				      header->number,
+ 				      header->hdr.a.OriginalSample);
+-    
++
++	if (header->number >= WF_MAX_SAMPLE)
++		return -EINVAL;
++
+ 	munge_int32 (header->number, &alias_hdr[0], 2);
+ 	munge_int32 (header->hdr.a.OriginalSample, &alias_hdr[2], 2);
+ 	munge_int32 (*((unsigned int *)&header->hdr.a.sampleStartOffset),
+@@ -1205,6 +1208,9 @@ wavefront_send_multisample (snd_wavefront_t *dev, wavefront_patch_info *header)
+ 	int num_samples;
+ 	unsigned char *msample_hdr;
+ 
++	if (header->number >= WF_MAX_SAMPLE)
++		return -EINVAL;
++
+ 	msample_hdr = kmalloc(WF_MSAMPLE_BYTES, GFP_KERNEL);
+ 	if (! msample_hdr)
+ 		return -ENOMEM;
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index a866a20349c3..2def4ad579cc 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3687,6 +3687,11 @@ HDA_CODEC_ENTRY(0x10de0095, "GPU 95 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0097, "GPU 97 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0098, "GPU 98 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0099, "GPU 99 HDMI/DP",	patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de009a, "GPU 9a HDMI/DP",	patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de009d, "GPU 9d HDMI/DP",	patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de009e, "GPU 9e HDMI/DP",	patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de009f, "GPU 9f HDMI/DP",	patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de00a0, "GPU a0 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI",	patch_nvhdmi_2ch),
+ HDA_CODEC_ENTRY(0x10de8067, "MCP67/68 HDMI",	patch_nvhdmi_2ch),
+ HDA_CODEC_ENTRY(0x11069f80, "VX900 HDMI/DP",	patch_via_hdmi),
+diff --git a/sound/soc/fsl/fsl_asrc_dma.c b/sound/soc/fsl/fsl_asrc_dma.c
+index dc30d780f874..3fcf174b99d3 100644
+--- a/sound/soc/fsl/fsl_asrc_dma.c
++++ b/sound/soc/fsl/fsl_asrc_dma.c
+@@ -243,6 +243,7 @@ static int fsl_asrc_dma_hw_params(struct snd_pcm_substream *substream,
+ 	ret = dmaengine_slave_config(pair->dma_chan[dir], &config_be);
+ 	if (ret) {
+ 		dev_err(dev, "failed to config DMA channel for Back-End\n");
++		dma_release_channel(pair->dma_chan[dir]);
+ 		return ret;
+ 	}
+ 
+diff --git a/sound/usb/card.h b/sound/usb/card.h
+index 111b0f009afa..c4599cf0ddc9 100644
+--- a/sound/usb/card.h
++++ b/sound/usb/card.h
+@@ -80,6 +80,10 @@ struct snd_usb_endpoint {
+ 	dma_addr_t sync_dma;		/* DMA address of syncbuf */
+ 
+ 	unsigned int pipe;		/* the data i/o pipe */
++	unsigned int framesize[2];	/* small/large frame sizes in samples */
++	unsigned int sample_rem;	/* remainder from division fs/fps */
++	unsigned int sample_accum;	/* sample accumulator */
++	unsigned int fps;		/* frames per second */
+ 	unsigned int freqn;		/* nominal sampling rate in fs/fps in Q16.16 format */
+ 	unsigned int freqm;		/* momentary sampling rate in fs/fps in Q16.16 format */
+ 	int	   freqshift;		/* how much to shift the feedback value to get Q16.16 */
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 30aa5f2df6da..b5207e71ed72 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -137,12 +137,12 @@ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep)
+ 
+ /*
+  * For streaming based on information derived from sync endpoints,
+- * prepare_outbound_urb_sizes() will call next_packet_size() to
++ * prepare_outbound_urb_sizes() will call slave_next_packet_size() to
+  * determine the number of samples to be sent in the next packet.
+  *
+- * For implicit feedback, next_packet_size() is unused.
++ * For implicit feedback, slave_next_packet_size() is unused.
+  */
+-int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
++int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep)
+ {
+ 	unsigned long flags;
+ 	int ret;
+@@ -159,6 +159,29 @@ int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
+ 	return ret;
+ }
+ 
++/*
++ * For adaptive and synchronous endpoints, prepare_outbound_urb_sizes()
++ * will call next_packet_size() to determine the number of samples to be
++ * sent in the next packet.
++ */
++int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
++{
++	int ret;
++
++	if (ep->fill_max)
++		return ep->maxframesize;
++
++	ep->sample_accum += ep->sample_rem;
++	if (ep->sample_accum >= ep->fps) {
++		ep->sample_accum -= ep->fps;
++		ret = ep->framesize[1];
++	} else {
++		ret = ep->framesize[0];
++	}
++
++	return ret;
++}
++
+ static void retire_outbound_urb(struct snd_usb_endpoint *ep,
+ 				struct snd_urb_ctx *urb_ctx)
+ {
+@@ -203,6 +226,8 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+ 
+ 		if (ctx->packet_size[i])
+ 			counts = ctx->packet_size[i];
++		else if (ep->sync_master)
++			counts = snd_usb_endpoint_slave_next_packet_size(ep);
+ 		else
+ 			counts = snd_usb_endpoint_next_packet_size(ep);
+ 
+@@ -875,10 +900,17 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep,
+ 	ep->maxpacksize = fmt->maxpacksize;
+ 	ep->fill_max = !!(fmt->attributes & UAC_EP_CS_ATTR_FILL_MAX);
+ 
+-	if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL)
++	if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL) {
+ 		ep->freqn = get_usb_full_speed_rate(rate);
+-	else
++		ep->fps = 1000;
++	} else {
+ 		ep->freqn = get_usb_high_speed_rate(rate);
++		ep->fps = 8000;
++	}
++
++	ep->sample_rem = rate % ep->fps;
++	ep->framesize[0] = rate / ep->fps;
++	ep->framesize[1] = (rate + (ep->fps - 1)) / ep->fps;
+ 
+ 	/* calculate the frequency in 16.16 format */
+ 	ep->freqm = ep->freqn;
+@@ -937,6 +969,7 @@ int snd_usb_endpoint_start(struct snd_usb_endpoint *ep)
+ 	ep->active_mask = 0;
+ 	ep->unlink_mask = 0;
+ 	ep->phase = 0;
++	ep->sample_accum = 0;
+ 
+ 	snd_usb_endpoint_start_quirk(ep);
+ 
+diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h
+index 584f295d7c77..4aad49cbeb5f 100644
+--- a/sound/usb/endpoint.h
++++ b/sound/usb/endpoint.h
+@@ -27,6 +27,7 @@ void snd_usb_endpoint_release(struct snd_usb_endpoint *ep);
+ void snd_usb_endpoint_free(struct snd_usb_endpoint *ep);
+ 
+ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep);
++int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep);
+ int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep);
+ 
+ void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep,
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 024864ce3f76..6913ea27e978 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -585,8 +585,9 @@ static int check_matrix_bitmap(unsigned char *bmap,
+  * if failed, give up and free the control instance.
+  */
+ 
+-int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list,
+-			      struct snd_kcontrol *kctl)
++int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list,
++			   struct snd_kcontrol *kctl,
++			   bool is_std_info)
+ {
+ 	struct usb_mixer_interface *mixer = list->mixer;
+ 	int err;
+@@ -599,6 +600,7 @@ int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list,
+ 		return err;
+ 	}
+ 	list->kctl = kctl;
++	list->is_std_info = is_std_info;
+ 	list->next_id_elem = mixer->id_elems[list->id];
+ 	mixer->id_elems[list->id] = list;
+ 	return 0;
+@@ -2397,15 +2399,23 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid)
+ {
+ 	struct usb_mixer_elem_list *list;
+ 
+-	for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem)
++	for_each_mixer_elem(list, mixer, unitid) {
++		struct usb_mixer_elem_info *info;
++
++		if (!list->is_std_info)
++			continue;
++		info = mixer_elem_list_to_info(list);
++		/* invalidate cache, so the value is read from the device */
++		info->cached = 0;
+ 		snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
+ 			       &list->kctl->id);
++	}
+ }
+ 
+ static void snd_usb_mixer_dump_cval(struct snd_info_buffer *buffer,
+ 				    struct usb_mixer_elem_list *list)
+ {
+-	struct usb_mixer_elem_info *cval = (struct usb_mixer_elem_info *)list;
++	struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list);
+ 	static char *val_types[] = {"BOOLEAN", "INV_BOOLEAN",
+ 				    "S8", "U8", "S16", "U16"};
+ 	snd_iprintf(buffer, "    Info: id=%i, control=%i, cmask=0x%x, "
+@@ -2431,8 +2441,7 @@ static void snd_usb_mixer_proc_read(struct snd_info_entry *entry,
+ 				mixer->ignore_ctl_error);
+ 		snd_iprintf(buffer, "Card: %s\n", chip->card->longname);
+ 		for (unitid = 0; unitid < MAX_ID_ELEMS; unitid++) {
+-			for (list = mixer->id_elems[unitid]; list;
+-			     list = list->next_id_elem) {
++			for_each_mixer_elem(list, mixer, unitid) {
+ 				snd_iprintf(buffer, "  Unit: %i\n", list->id);
+ 				if (list->kctl)
+ 					snd_iprintf(buffer,
+@@ -2462,19 +2471,21 @@ static void snd_usb_mixer_interrupt_v2(struct usb_mixer_interface *mixer,
+ 		return;
+ 	}
+ 
+-	for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem)
++	for_each_mixer_elem(list, mixer, unitid)
+ 		count++;
+ 
+ 	if (count == 0)
+ 		return;
+ 
+-	for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem) {
++	for_each_mixer_elem(list, mixer, unitid) {
+ 		struct usb_mixer_elem_info *info;
+ 
+ 		if (!list->kctl)
+ 			continue;
++		if (!list->is_std_info)
++			continue;
+ 
+-		info = (struct usb_mixer_elem_info *)list;
++		info = mixer_elem_list_to_info(list);
+ 		if (count > 1 && info->control != control)
+ 			continue;
+ 
+@@ -2694,7 +2705,7 @@ int snd_usb_mixer_suspend(struct usb_mixer_interface *mixer)
+ 
+ static int restore_mixer_value(struct usb_mixer_elem_list *list)
+ {
+-	struct usb_mixer_elem_info *cval = (struct usb_mixer_elem_info *)list;
++	struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list);
+ 	int c, err, idx;
+ 
+ 	if (cval->cmask) {
+@@ -2730,8 +2741,7 @@ int snd_usb_mixer_resume(struct usb_mixer_interface *mixer, bool reset_resume)
+ 	if (reset_resume) {
+ 		/* restore cached mixer values */
+ 		for (id = 0; id < MAX_ID_ELEMS; id++) {
+-			for (list = mixer->id_elems[id]; list;
+-			     list = list->next_id_elem) {
++			for_each_mixer_elem(list, mixer, id) {
+ 				if (list->resume) {
+ 					err = list->resume(list);
+ 					if (err < 0)
+diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
+index 545d99b09706..7d16a9221070 100644
+--- a/sound/usb/mixer.h
++++ b/sound/usb/mixer.h
+@@ -48,10 +48,17 @@ struct usb_mixer_elem_list {
+ 	struct usb_mixer_elem_list *next_id_elem; /* list of controls with same id */
+ 	struct snd_kcontrol *kctl;
+ 	unsigned int id;
++	bool is_std_info;
+ 	usb_mixer_elem_dump_func_t dump;
+ 	usb_mixer_elem_resume_func_t resume;
+ };
+ 
++/* iterate over mixer element list of the given unit id */
++#define for_each_mixer_elem(list, mixer, id)	\
++	for ((list) = (mixer)->id_elems[id]; (list); (list) = (list)->next_id_elem)
++#define mixer_elem_list_to_info(list) \
++	container_of(list, struct usb_mixer_elem_info, head)
++
+ struct usb_mixer_elem_info {
+ 	struct usb_mixer_elem_list head;
+ 	unsigned int control;	/* CS or ICN (high byte) */
+@@ -79,8 +86,12 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid);
+ int snd_usb_mixer_set_ctl_value(struct usb_mixer_elem_info *cval,
+ 				int request, int validx, int value_set);
+ 
+-int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list,
+-			      struct snd_kcontrol *kctl);
++int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list,
++			   struct snd_kcontrol *kctl,
++			   bool is_std_info);
++
++#define snd_usb_mixer_add_control(list, kctl) \
++	snd_usb_mixer_add_list(list, kctl, true)
+ 
+ void snd_usb_mixer_elem_init_std(struct usb_mixer_elem_list *list,
+ 				 struct usb_mixer_interface *mixer,
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index 723b535ca2ec..198515f86fcc 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -168,7 +168,8 @@ static int add_single_ctl_with_resume(struct usb_mixer_interface *mixer,
+ 		return -ENOMEM;
+ 	}
+ 	kctl->private_free = snd_usb_mixer_elem_free;
+-	return snd_usb_mixer_add_control(list, kctl);
++	/* don't use snd_usb_mixer_add_control() here, this is a special list element */
++	return snd_usb_mixer_add_list(list, kctl, false);
+ }
+ 
+ /*
+@@ -1170,7 +1171,7 @@ void snd_emuusb_set_samplerate(struct snd_usb_audio *chip,
+ 	int unitid = 12; /* SamleRate ExtensionUnit ID */
+ 
+ 	list_for_each_entry(mixer, &chip->mixer_list, list) {
+-		cval = (struct usb_mixer_elem_info *)mixer->id_elems[unitid];
++		cval = mixer_elem_list_to_info(mixer->id_elems[unitid]);
+ 		if (cval) {
+ 			snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR,
+ 						    cval->control << 8,
+diff --git a/sound/usb/mixer_scarlett.c b/sound/usb/mixer_scarlett.c
+index 7438e7c4a842..2876cd9b35b3 100644
+--- a/sound/usb/mixer_scarlett.c
++++ b/sound/usb/mixer_scarlett.c
+@@ -287,8 +287,7 @@ static int scarlett_ctl_switch_put(struct snd_kcontrol *kctl,
+ 
+ static int scarlett_ctl_resume(struct usb_mixer_elem_list *list)
+ {
+-	struct usb_mixer_elem_info *elem =
+-		container_of(list, struct usb_mixer_elem_info, head);
++	struct usb_mixer_elem_info *elem = mixer_elem_list_to_info(list);
+ 	int i;
+ 
+ 	for (i = 0; i < elem->channels; i++)
+@@ -447,8 +446,7 @@ static int scarlett_ctl_enum_put(struct snd_kcontrol *kctl,
+ 
+ static int scarlett_ctl_enum_resume(struct usb_mixer_elem_list *list)
+ {
+-	struct usb_mixer_elem_info *elem =
+-		container_of(list, struct usb_mixer_elem_info, head);
++	struct usb_mixer_elem_info *elem = mixer_elem_list_to_info(list);
+ 
+ 	if (elem->cached)
+ 		snd_usb_set_cur_mix_value(elem, 0, 0, *elem->cache_val);
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 9bc995f9b4e1..615213aeda33 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -1483,6 +1483,8 @@ static void prepare_playback_urb(struct snd_usb_substream *subs,
+ 	for (i = 0; i < ctx->packets; i++) {
+ 		if (ctx->packet_size[i])
+ 			counts = ctx->packet_size[i];
++		else if (ep->sync_master)
++			counts = snd_usb_endpoint_slave_next_packet_size(ep);
+ 		else
+ 			counts = snd_usb_endpoint_next_packet_size(ep);
+ 
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 0484a8d8a5bb..486d27129ac3 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1162,6 +1162,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ static bool is_itf_usb_dsd_2alts_dac(unsigned int id)
+ {
+ 	switch (id) {
++	case USB_ID(0x154e, 0x1002): /* Denon DCD-1500RE */
+ 	case USB_ID(0x154e, 0x1003): /* Denon DA-300USB */
+ 	case USB_ID(0x154e, 0x3005): /* Marantz HD-DAC1 */
+ 	case USB_ID(0x154e, 0x3006): /* Marantz SA-14S1 */
+diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
+index 0abca8783bb3..78485edb9467 100644
+--- a/tools/perf/builtin-report.c
++++ b/tools/perf/builtin-report.c
+@@ -341,8 +341,7 @@ static size_t hists__fprintf_nr_sample_events(struct hists *hists, struct report
+ 	if (evname != NULL)
+ 		ret += fprintf(fp, " of event '%s'", evname);
+ 
+-	if (symbol_conf.show_ref_callgraph &&
+-	    strstr(evname, "call-graph=no")) {
++	if (symbol_conf.show_ref_callgraph && evname && strstr(evname, "call-graph=no")) {
+ 		ret += fprintf(fp, ", show reference callgraph");
+ 	}
+ 
+diff --git a/tools/testing/selftests/networking/timestamping/timestamping.c b/tools/testing/selftests/networking/timestamping/timestamping.c
+index 5cdfd743447b..900ed4b47899 100644
+--- a/tools/testing/selftests/networking/timestamping/timestamping.c
++++ b/tools/testing/selftests/networking/timestamping/timestamping.c
+@@ -332,10 +332,16 @@ int main(int argc, char **argv)
+ 	int val;
+ 	socklen_t len;
+ 	struct timeval next;
++	size_t if_len;
+ 
+ 	if (argc < 2)
+ 		usage(0);
+ 	interface = argv[1];
++	if_len = strlen(interface);
++	if (if_len >= IFNAMSIZ) {
++		printf("interface name exceeds IFNAMSIZ\n");
++		exit(1);
++	}
+ 
+ 	for (i = 2; i < argc; i++) {
+ 		if (!strcasecmp(argv[i], "SO_TIMESTAMP"))
+@@ -369,12 +375,12 @@ int main(int argc, char **argv)
+ 		bail("socket");
+ 
+ 	memset(&device, 0, sizeof(device));
+-	strncpy(device.ifr_name, interface, sizeof(device.ifr_name));
++	memcpy(device.ifr_name, interface, if_len + 1);
+ 	if (ioctl(sock, SIOCGIFADDR, &device) < 0)
+ 		bail("getting interface IP address");
+ 
+ 	memset(&hwtstamp, 0, sizeof(hwtstamp));
+-	strncpy(hwtstamp.ifr_name, interface, sizeof(hwtstamp.ifr_name));
++	memcpy(hwtstamp.ifr_name, interface, if_len + 1);
+ 	hwtstamp.ifr_data = (void *)&hwconfig;
+ 	memset(&hwconfig, 0, sizeof(hwconfig));
+ 	hwconfig.tx_type =
+diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
+index 874972ccfc95..5338e668b5e6 100644
+--- a/tools/testing/selftests/x86/protection_keys.c
++++ b/tools/testing/selftests/x86/protection_keys.c
+@@ -23,6 +23,7 @@
+ #define _GNU_SOURCE
+ #include <errno.h>
+ #include <linux/futex.h>
++#include <time.h>
+ #include <sys/time.h>
+ #include <sys/syscall.h>
+ #include <string.h>
+@@ -608,10 +609,10 @@ int alloc_random_pkey(void)
+ 	int nr_alloced = 0;
+ 	int random_index;
+ 	memset(alloced_pkeys, 0, sizeof(alloced_pkeys));
++	srand((unsigned int)time(NULL));
+ 
+ 	/* allocate every possible key and make a note of which ones we got */
+ 	max_nr_pkey_allocs = NR_PKEYS;
+-	max_nr_pkey_allocs = 1;
+ 	for (i = 0; i < max_nr_pkey_allocs; i++) {
+ 		int new_pkey = alloc_pkey();
+ 		if (new_pkey < 0)