[gentoo-commits] proj/linux-patches:4.9 commit in: /

[Mike Pagano]

commit:     6f107043194e328026b3274be0327224670b1922
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Aug  3 12:25:33 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Aug  3 12:25:33 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6f107043

Linux patch 4.9.117

 0000_README              |    4 +
 1116_linux-4.9.117.patch | 3610 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 3614 insertions(+)

diff --git a/0000_README b/0000_README
index 320185b..6be74fa 100644
--- a/0000_README
+++ b/0000_README
@@ -507,6 +507,10 @@ Patch:  1115_linux-4.9.116.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.116
 
+Patch:  1116_linux-4.9.117.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.117
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1116_linux-4.9.117.patch b/1116_linux-4.9.117.patch
new file mode 100644
index 0000000..0c2ee0f
--- /dev/null
+++ b/1116_linux-4.9.117.patch
@@ -0,0 +1,3610 @@
+diff --git a/Documentation/devicetree/bindings/net/dsa/qca8k.txt b/Documentation/devicetree/bindings/net/dsa/qca8k.txt
+index 9c67ee4890d7..bbcb255c3150 100644
+--- a/Documentation/devicetree/bindings/net/dsa/qca8k.txt
++++ b/Documentation/devicetree/bindings/net/dsa/qca8k.txt
+@@ -2,7 +2,10 @@
+ 
+ Required properties:
+ 
+-- compatible: should be "qca,qca8337"
++- compatible: should be one of:
++    "qca,qca8334"
++    "qca,qca8337"
++
+ - #size-cells: must be 0
+ - #address-cells: must be 1
+ 
+@@ -14,6 +17,20 @@ port and PHY id, each subnode describing a port needs to have a valid phandle
+ referencing the internal PHY connected to it. The CPU port of this switch is
+ always port 0.
+ 
++A CPU port node has the following optional node:
++
++- fixed-link            : Fixed-link subnode describing a link to a non-MDIO
++                          managed entity. See
++                          Documentation/devicetree/bindings/net/fixed-link.txt
++                          for details.
++
++For QCA8K the 'fixed-link' sub-node supports only the following properties:
++
++- 'speed' (integer, mandatory), to indicate the link speed. Accepted
++  values are 10, 100 and 1000
++- 'full-duplex' (boolean, optional), to indicate that full duplex is
++  used. When absent, half duplex is assumed.
++
+ Example:
+ 
+ 
+@@ -53,6 +70,10 @@ Example:
+ 					label = "cpu";
+ 					ethernet = <&gmac1>;
+ 					phy-mode = "rgmii";
++					fixed-link {
++						speed = 1000;
++						full-duplex;
++					};
+ 				};
+ 
+ 				port@1 {
+diff --git a/Documentation/devicetree/bindings/net/meson-dwmac.txt b/Documentation/devicetree/bindings/net/meson-dwmac.txt
+index 89e62ddc69ca..da37da0fdd3f 100644
+--- a/Documentation/devicetree/bindings/net/meson-dwmac.txt
++++ b/Documentation/devicetree/bindings/net/meson-dwmac.txt
+@@ -10,6 +10,7 @@ Required properties on all platforms:
+ 			- "amlogic,meson6-dwmac"
+ 			- "amlogic,meson8b-dwmac"
+ 			- "amlogic,meson-gxbb-dwmac"
++			- "amlogic,meson-axg-dwmac"
+ 		Additionally "snps,dwmac" and any applicable more
+ 		detailed version number described in net/stmmac.txt
+ 		should be used.
+diff --git a/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt
+index fe7fe0b03cfb..1b9881786ce9 100644
+--- a/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt
++++ b/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt
+@@ -3,8 +3,10 @@
+ Required properties for the root node:
+  - compatible: one of "amlogic,meson8-cbus-pinctrl"
+ 		      "amlogic,meson8b-cbus-pinctrl"
++		      "amlogic,meson8m2-cbus-pinctrl"
+ 		      "amlogic,meson8-aobus-pinctrl"
+ 		      "amlogic,meson8b-aobus-pinctrl"
++		      "amlogic,meson8m2-aobus-pinctrl"
+ 		      "amlogic,meson-gxbb-periphs-pinctrl"
+ 		      "amlogic,meson-gxbb-aobus-pinctrl"
+  - reg: address and size of registers controlling irq functionality
+diff --git a/Makefile b/Makefile
+index a6b011778960..773c26c95d98 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 116
++SUBLEVEL = 117
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/arm/boot/dts/emev2.dtsi b/arch/arm/boot/dts/emev2.dtsi
+index cd119400f440..fd6f9ce9206a 100644
+--- a/arch/arm/boot/dts/emev2.dtsi
++++ b/arch/arm/boot/dts/emev2.dtsi
+@@ -30,13 +30,13 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		cpu@0 {
++		cpu0: cpu@0 {
+ 			device_type = "cpu";
+ 			compatible = "arm,cortex-a9";
+ 			reg = <0>;
+ 			clock-frequency = <533000000>;
+ 		};
+-		cpu@1 {
++		cpu1: cpu@1 {
+ 			device_type = "cpu";
+ 			compatible = "arm,cortex-a9";
+ 			reg = <1>;
+@@ -56,6 +56,7 @@
+ 		compatible = "arm,cortex-a9-pmu";
+ 		interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+ 			     <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-affinity = <&cpu0>, <&cpu1>;
+ 	};
+ 
+ 	clocks@e0110000 {
+diff --git a/arch/arm/boot/dts/sh73a0.dtsi b/arch/arm/boot/dts/sh73a0.dtsi
+index 032fe2f14b16..6b0cc225149c 100644
+--- a/arch/arm/boot/dts/sh73a0.dtsi
++++ b/arch/arm/boot/dts/sh73a0.dtsi
+@@ -22,7 +22,7 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		cpu@0 {
++		cpu0: cpu@0 {
+ 			device_type = "cpu";
+ 			compatible = "arm,cortex-a9";
+ 			reg = <0>;
+@@ -30,7 +30,7 @@
+ 			power-domains = <&pd_a2sl>;
+ 			next-level-cache = <&L2>;
+ 		};
+-		cpu@1 {
++		cpu1: cpu@1 {
+ 			device_type = "cpu";
+ 			compatible = "arm,cortex-a9";
+ 			reg = <1>;
+@@ -89,6 +89,7 @@
+ 		compatible = "arm,cortex-a9-pmu";
+ 		interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>,
+ 			     <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-affinity = <&cpu0>, <&cpu1>;
+ 	};
+ 
+ 	cmt1: timer@e6138000 {
+diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
+index dab2cb0c1f1c..b4c4d823569a 100644
+--- a/arch/arm64/configs/defconfig
++++ b/arch/arm64/configs/defconfig
+@@ -260,6 +260,8 @@ CONFIG_GPIO_XGENE=y
+ CONFIG_GPIO_PCA953X=y
+ CONFIG_GPIO_PCA953X_IRQ=y
+ CONFIG_GPIO_MAX77620=y
++CONFIG_POWER_AVS=y
++CONFIG_ROCKCHIP_IODOMAIN=y
+ CONFIG_POWER_RESET_MSM=y
+ CONFIG_BATTERY_BQ27XXX=y
+ CONFIG_POWER_RESET_XGENE=y
+diff --git a/arch/arm64/include/asm/cmpxchg.h b/arch/arm64/include/asm/cmpxchg.h
+index ae852add053d..0f2e1ab5e166 100644
+--- a/arch/arm64/include/asm/cmpxchg.h
++++ b/arch/arm64/include/asm/cmpxchg.h
+@@ -229,7 +229,9 @@ static inline void __cmpwait_case_##name(volatile void *ptr,		\
+ 	unsigned long tmp;						\
+ 									\
+ 	asm volatile(							\
+-	"	ldxr" #sz "\t%" #w "[tmp], %[v]\n"		\
++	"	sevl\n"							\
++	"	wfe\n"							\
++	"	ldxr" #sz "\t%" #w "[tmp], %[v]\n"			\
+ 	"	eor	%" #w "[tmp], %" #w "[tmp], %" #w "[val]\n"	\
+ 	"	cbnz	%" #w "[tmp], 1f\n"				\
+ 	"	wfe\n"							\
+diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
+index 9b8b477c363d..9d07b421f090 100644
+--- a/arch/arm64/mm/init.c
++++ b/arch/arm64/mm/init.c
+@@ -468,11 +468,13 @@ void __init mem_init(void)
+ 	BUILD_BUG_ON(TASK_SIZE_32			> TASK_SIZE_64);
+ #endif
+ 
++#ifdef CONFIG_SPARSEMEM_VMEMMAP
+ 	/*
+ 	 * Make sure we chose the upper bound of sizeof(struct page)
+-	 * correctly.
++	 * correctly when sizing the VMEMMAP array.
+ 	 */
+ 	BUILD_BUG_ON(sizeof(struct page) > (1 << STRUCT_PAGE_MAX_SHIFT));
++#endif
+ 
+ 	if (PAGE_SIZE >= 16384 && get_num_physpages() <= 128) {
+ 		extern int sysctl_overcommit_memory;
+diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile
+index 91d2068da1b9..0f3fe6a151dc 100644
+--- a/arch/microblaze/boot/Makefile
++++ b/arch/microblaze/boot/Makefile
+@@ -21,17 +21,19 @@ $(obj)/linux.bin.gz: $(obj)/linux.bin FORCE
+ quiet_cmd_cp = CP      $< $@$2
+ 	cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false)
+ 
+-quiet_cmd_strip = STRIP   $@
++quiet_cmd_strip = STRIP   $< $@$2
+ 	cmd_strip = $(STRIP) -K microblaze_start -K _end -K __log_buf \
+-				-K _fdt_start vmlinux -o $@
++				-K _fdt_start $< -o $@$2
+ 
+ UIMAGE_LOADADDR = $(CONFIG_KERNEL_BASE_ADDR)
++UIMAGE_IN = $@
++UIMAGE_OUT = $@.ub
+ 
+ $(obj)/simpleImage.%: vmlinux FORCE
+ 	$(call if_changed,cp,.unstrip)
+ 	$(call if_changed,objcopy)
+ 	$(call if_changed,uimage)
+-	$(call if_changed,strip)
+-	@echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
++	$(call if_changed,strip,.strip)
++	@echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')'
+ 
+ clean-files += simpleImage.*.unstrip linux.bin.ub dts/*.dtb
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index 27843665da9e..620e08d4eb6e 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -450,9 +450,11 @@ static void *eeh_add_virt_device(void *data, void *userdata)
+ 
+ 	driver = eeh_pcid_get(dev);
+ 	if (driver) {
+-		eeh_pcid_put(dev);
+-		if (driver->err_handler)
++		if (driver->err_handler) {
++			eeh_pcid_put(dev);
+ 			return NULL;
++		}
++		eeh_pcid_put(dev);
+ 	}
+ 
+ #ifdef CONFIG_PPC_POWERNV
+@@ -489,17 +491,19 @@ static void *eeh_rmv_device(void *data, void *userdata)
+ 	if (eeh_dev_removed(edev))
+ 		return NULL;
+ 
+-	driver = eeh_pcid_get(dev);
+-	if (driver) {
+-		eeh_pcid_put(dev);
+-		if (removed &&
+-		    eeh_pe_passed(edev->pe))
+-			return NULL;
+-		if (removed &&
+-		    driver->err_handler &&
+-		    driver->err_handler->error_detected &&
+-		    driver->err_handler->slot_reset)
++	if (removed) {
++		if (eeh_pe_passed(edev->pe))
+ 			return NULL;
++		driver = eeh_pcid_get(dev);
++		if (driver) {
++			if (driver->err_handler &&
++			    driver->err_handler->error_detected &&
++			    driver->err_handler->slot_reset) {
++				eeh_pcid_put(dev);
++				return NULL;
++			}
++			eeh_pcid_put(dev);
++		}
+ 	}
+ 
+ 	/* Remove it from PCI subsystem */
+diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
+index fb133a163263..2274be535dda 100644
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -769,7 +769,7 @@ start_here:
+ 	tovirt(r6,r6)
+ 	lis	r5, abatron_pteptrs@h
+ 	ori	r5, r5, abatron_pteptrs@l
+-	stw	r5, 0xf0(r0)	/* Must match your Abatron config file */
++	stw	r5, 0xf0(0)	/* Must match your Abatron config file */
+ 	tophys(r5,r5)
+ 	stw	r6, 0(r5)
+ 
+diff --git a/arch/powerpc/kernel/pci_32.c b/arch/powerpc/kernel/pci_32.c
+index 678f87a63645..97b02b8c4f10 100644
+--- a/arch/powerpc/kernel/pci_32.c
++++ b/arch/powerpc/kernel/pci_32.c
+@@ -11,6 +11,7 @@
+ #include <linux/sched.h>
+ #include <linux/errno.h>
+ #include <linux/bootmem.h>
++#include <linux/syscalls.h>
+ #include <linux/irq.h>
+ #include <linux/list.h>
+ #include <linux/of.h>
+diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c
+index 48fc28bab544..64c9a91773af 100644
+--- a/arch/powerpc/mm/slb.c
++++ b/arch/powerpc/mm/slb.c
+@@ -68,14 +68,14 @@ static inline void slb_shadow_update(unsigned long ea, int ssize,
+ 	 * updating it.  No write barriers are needed here, provided
+ 	 * we only update the current CPU's SLB shadow buffer.
+ 	 */
+-	p->save_area[index].esid = 0;
+-	p->save_area[index].vsid = cpu_to_be64(mk_vsid_data(ea, ssize, flags));
+-	p->save_area[index].esid = cpu_to_be64(mk_esid_data(ea, ssize, index));
++	WRITE_ONCE(p->save_area[index].esid, 0);
++	WRITE_ONCE(p->save_area[index].vsid, cpu_to_be64(mk_vsid_data(ea, ssize, flags)));
++	WRITE_ONCE(p->save_area[index].esid, cpu_to_be64(mk_esid_data(ea, ssize, index)));
+ }
+ 
+ static inline void slb_shadow_clear(enum slb_index index)
+ {
+-	get_slb_shadow()->save_area[index].esid = 0;
++	WRITE_ONCE(get_slb_shadow()->save_area[index].esid, 0);
+ }
+ 
+ static inline void create_shadowed_slbe(unsigned long ea, int ssize,
+diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
+index be9d968244ad..c0e817f35e69 100644
+--- a/arch/powerpc/net/bpf_jit_comp64.c
++++ b/arch/powerpc/net/bpf_jit_comp64.c
+@@ -207,25 +207,37 @@ static void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
+ 
+ static void bpf_jit_emit_func_call(u32 *image, struct codegen_context *ctx, u64 func)
+ {
++	unsigned int i, ctx_idx = ctx->idx;
++
++	/* Load function address into r12 */
++	PPC_LI64(12, func);
++
++	/* For bpf-to-bpf function calls, the callee's address is unknown
++	 * until the last extra pass. As seen above, we use PPC_LI64() to
++	 * load the callee's address, but this may optimize the number of
++	 * instructions required based on the nature of the address.
++	 *
++	 * Since we don't want the number of instructions emitted to change,
++	 * we pad the optimized PPC_LI64() call with NOPs to guarantee that
++	 * we always have a five-instruction sequence, which is the maximum
++	 * that PPC_LI64() can emit.
++	 */
++	for (i = ctx->idx - ctx_idx; i < 5; i++)
++		PPC_NOP();
++
+ #ifdef PPC64_ELF_ABI_v1
+-	/* func points to the function descriptor */
+-	PPC_LI64(b2p[TMP_REG_2], func);
+-	/* Load actual entry point from function descriptor */
+-	PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_2], 0);
+-	/* ... and move it to LR */
+-	PPC_MTLR(b2p[TMP_REG_1]);
+ 	/*
+ 	 * Load TOC from function descriptor at offset 8.
+ 	 * We can clobber r2 since we get called through a
+ 	 * function pointer (so caller will save/restore r2)
+ 	 * and since we don't use a TOC ourself.
+ 	 */
+-	PPC_BPF_LL(2, b2p[TMP_REG_2], 8);
+-#else
+-	/* We can clobber r12 */
+-	PPC_FUNC_ADDR(12, func);
+-	PPC_MTLR(12);
++	PPC_BPF_LL(2, 12, 8);
++	/* Load actual entry point from function descriptor */
++	PPC_BPF_LL(12, 12, 0);
+ #endif
++
++	PPC_MTLR(12);
+ 	PPC_BLRL();
+ }
+ 
+diff --git a/arch/powerpc/platforms/chrp/time.c b/arch/powerpc/platforms/chrp/time.c
+index f803f4b8ab6f..8608e358217f 100644
+--- a/arch/powerpc/platforms/chrp/time.c
++++ b/arch/powerpc/platforms/chrp/time.c
+@@ -27,6 +27,8 @@
+ #include <asm/sections.h>
+ #include <asm/time.h>
+ 
++#include <platforms/chrp/chrp.h>
++
+ extern spinlock_t rtc_lock;
+ 
+ #define NVRAM_AS0  0x74
+@@ -62,7 +64,7 @@ long __init chrp_time_init(void)
+ 	return 0;
+ }
+ 
+-int chrp_cmos_clock_read(int addr)
++static int chrp_cmos_clock_read(int addr)
+ {
+ 	if (nvram_as1 != 0)
+ 		outb(addr>>8, nvram_as1);
+@@ -70,7 +72,7 @@ int chrp_cmos_clock_read(int addr)
+ 	return (inb(nvram_data));
+ }
+ 
+-void chrp_cmos_clock_write(unsigned long val, int addr)
++static void chrp_cmos_clock_write(unsigned long val, int addr)
+ {
+ 	if (nvram_as1 != 0)
+ 		outb(addr>>8, nvram_as1);
+diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+index 89c54de88b7a..bf4a125faec6 100644
+--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+@@ -35,6 +35,8 @@
+  */
+ #define HW_BROADWAY_ICR		0x00
+ #define HW_BROADWAY_IMR		0x04
++#define HW_STARLET_ICR		0x08
++#define HW_STARLET_IMR		0x0c
+ 
+ 
+ /*
+@@ -74,6 +76,9 @@ static void hlwd_pic_unmask(struct irq_data *d)
+ 	void __iomem *io_base = irq_data_get_irq_chip_data(d);
+ 
+ 	setbits32(io_base + HW_BROADWAY_IMR, 1 << irq);
++
++	/* Make sure the ARM (aka. Starlet) doesn't handle this interrupt. */
++	clrbits32(io_base + HW_STARLET_IMR, 1 << irq);
+ }
+ 
+ 
+diff --git a/arch/powerpc/platforms/powermac/bootx_init.c b/arch/powerpc/platforms/powermac/bootx_init.c
+index c3c9bbb3573a..ba0964c17620 100644
+--- a/arch/powerpc/platforms/powermac/bootx_init.c
++++ b/arch/powerpc/platforms/powermac/bootx_init.c
+@@ -468,7 +468,7 @@ void __init bootx_init(unsigned long r3, unsigned long r4)
+ 	boot_infos_t *bi = (boot_infos_t *) r4;
+ 	unsigned long hdr;
+ 	unsigned long space;
+-	unsigned long ptr, x;
++	unsigned long ptr;
+ 	char *model;
+ 	unsigned long offset = reloc_offset();
+ 
+@@ -562,6 +562,8 @@ void __init bootx_init(unsigned long r3, unsigned long r4)
+ 	 * MMU switched OFF, so this should not be useful anymore.
+ 	 */
+ 	if (bi->version < 4) {
++		unsigned long x __maybe_unused;
++
+ 		bootx_printf("Touching pages...\n");
+ 
+ 		/*
+diff --git a/arch/powerpc/platforms/powermac/setup.c b/arch/powerpc/platforms/powermac/setup.c
+index 6b4e9d181126..4929dd4b165e 100644
+--- a/arch/powerpc/platforms/powermac/setup.c
++++ b/arch/powerpc/platforms/powermac/setup.c
+@@ -352,6 +352,7 @@ static int pmac_late_init(void)
+ }
+ machine_late_initcall(powermac, pmac_late_init);
+ 
++void note_bootable_part(dev_t dev, int part, int goodness);
+ /*
+  * This is __ref because we check for "initializing" before
+  * touching any of the __init sensitive things and "initializing"
+diff --git a/arch/s390/include/asm/cpu_mf.h b/arch/s390/include/asm/cpu_mf.h
+index 03516476127b..ee64e624c511 100644
+--- a/arch/s390/include/asm/cpu_mf.h
++++ b/arch/s390/include/asm/cpu_mf.h
+@@ -113,7 +113,7 @@ struct hws_basic_entry {
+ 
+ struct hws_diag_entry {
+ 	unsigned int def:16;	    /* 0-15  Data Entry Format		 */
+-	unsigned int R:14;	    /* 16-19 and 20-30 reserved		 */
++	unsigned int R:15;	    /* 16-19 and 20-30 reserved		 */
+ 	unsigned int I:1;	    /* 31 entry valid or invalid	 */
+ 	u8	     data[];	    /* Machine-dependent sample data	 */
+ } __packed;
+@@ -129,7 +129,9 @@ struct hws_trailer_entry {
+ 			unsigned int f:1;	/* 0 - Block Full Indicator   */
+ 			unsigned int a:1;	/* 1 - Alert request control  */
+ 			unsigned int t:1;	/* 2 - Timestamp format	      */
+-			unsigned long long:61;	/* 3 - 63: Reserved	      */
++			unsigned int :29;	/* 3 - 31: Reserved	      */
++			unsigned int bsdes:16;	/* 32-47: size of basic SDE   */
++			unsigned int dsdes:16;	/* 48-63: size of diagnostic SDE */
+ 		};
+ 		unsigned long long flags;	/* 0 - 63: All indicators     */
+ 	};
+diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
+index aec6cc925af8..4f365267b12f 100644
+--- a/arch/x86/events/intel/uncore.c
++++ b/arch/x86/events/intel/uncore.c
+@@ -212,7 +212,7 @@ void uncore_perf_event_update(struct intel_uncore_box *box, struct perf_event *e
+ 	u64 prev_count, new_count, delta;
+ 	int shift;
+ 
+-	if (event->hw.idx >= UNCORE_PMC_IDX_FIXED)
++	if (event->hw.idx == UNCORE_PMC_IDX_FIXED)
+ 		shift = 64 - uncore_fixed_ctr_bits(box);
+ 	else
+ 		shift = 64 - uncore_perf_ctr_bits(box);
+diff --git a/arch/x86/events/intel/uncore_nhmex.c b/arch/x86/events/intel/uncore_nhmex.c
+index cda569332005..83e2188adac4 100644
+--- a/arch/x86/events/intel/uncore_nhmex.c
++++ b/arch/x86/events/intel/uncore_nhmex.c
+@@ -245,7 +245,7 @@ static void nhmex_uncore_msr_enable_event(struct intel_uncore_box *box, struct p
+ {
+ 	struct hw_perf_event *hwc = &event->hw;
+ 
+-	if (hwc->idx >= UNCORE_PMC_IDX_FIXED)
++	if (hwc->idx == UNCORE_PMC_IDX_FIXED)
+ 		wrmsrl(hwc->config_base, NHMEX_PMON_CTL_EN_BIT0);
+ 	else if (box->pmu->type->event_mask & NHMEX_PMON_CTL_EN_BIT0)
+ 		wrmsrl(hwc->config_base, hwc->config | NHMEX_PMON_CTL_EN_BIT22);
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index a16c06604a56..8a4d6bc8fed0 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -698,7 +698,7 @@ static int mmu_topup_memory_cache_page(struct kvm_mmu_memory_cache *cache,
+ 	if (cache->nobjs >= min)
+ 		return 0;
+ 	while (cache->nobjs < ARRAY_SIZE(cache->objects)) {
+-		page = (void *)__get_free_page(GFP_KERNEL);
++		page = (void *)__get_free_page(GFP_KERNEL_ACCOUNT);
+ 		if (!page)
+ 			return -ENOMEM;
+ 		cache->objects[cache->nobjs++] = page;
+diff --git a/crypto/authenc.c b/crypto/authenc.c
+index a7e1ac786c5d..c3180eb6d1ee 100644
+--- a/crypto/authenc.c
++++ b/crypto/authenc.c
+@@ -108,6 +108,7 @@ static int crypto_authenc_setkey(struct crypto_aead *authenc, const u8 *key,
+ 				       CRYPTO_TFM_RES_MASK);
+ 
+ out:
++	memzero_explicit(&keys, sizeof(keys));
+ 	return err;
+ 
+ badkey:
+diff --git a/crypto/authencesn.c b/crypto/authencesn.c
+index 18c94e1c31d1..49e7e85a23d5 100644
+--- a/crypto/authencesn.c
++++ b/crypto/authencesn.c
+@@ -90,6 +90,7 @@ static int crypto_authenc_esn_setkey(struct crypto_aead *authenc_esn, const u8 *
+ 					   CRYPTO_TFM_RES_MASK);
+ 
+ out:
++	memzero_explicit(&keys, sizeof(keys));
+ 	return err;
+ 
+ badkey:
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index bf601d4df8cf..b66815f35be6 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -472,9 +472,11 @@ static void negotiate_os_control(struct acpi_pci_root *root, int *no_aspm)
+ 	}
+ 
+ 	control = OSC_PCI_EXPRESS_CAPABILITY_CONTROL
+-		| OSC_PCI_EXPRESS_NATIVE_HP_CONTROL
+ 		| OSC_PCI_EXPRESS_PME_CONTROL;
+ 
++	if (IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE))
++		control |= OSC_PCI_EXPRESS_NATIVE_HP_CONTROL;
++
+ 	if (pci_aer_available()) {
+ 		if (aer_acpi_firmware_first())
+ 			dev_info(&device->dev,
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 6475a1343483..90c38778bc1f 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2282,12 +2282,16 @@ static void ata_eh_link_autopsy(struct ata_link *link)
+ 		if (qc->err_mask & ~AC_ERR_OTHER)
+ 			qc->err_mask &= ~AC_ERR_OTHER;
+ 
+-		/* SENSE_VALID trumps dev/unknown error and revalidation */
++		/*
++		 * SENSE_VALID trumps dev/unknown error and revalidation. Upper
++		 * layers will determine whether the command is worth retrying
++		 * based on the sense data and device class/type. Otherwise,
++		 * determine directly if the command is worth retrying using its
++		 * error mask and flags.
++		 */
+ 		if (qc->flags & ATA_QCFLAG_SENSE_VALID)
+ 			qc->err_mask &= ~(AC_ERR_DEV | AC_ERR_OTHER);
+-
+-		/* determine whether the command is worth retrying */
+-		if (ata_eh_worth_retry(qc))
++		else if (ata_eh_worth_retry(qc))
+ 			qc->flags |= ATA_QCFLAG_RETRY;
+ 
+ 		/* accumulate error info */
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index bff67c5a5fe7..44bccb1afa06 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -348,6 +348,9 @@ static const struct usb_device_id blacklist_table[] = {
+ 	/* Additional Realtek 8723BU Bluetooth devices */
+ 	{ USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
+ 
++	/* Additional Realtek 8723DE Bluetooth devices */
++	{ USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
++
+ 	/* Additional Realtek 8821AE Bluetooth devices */
+ 	{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
+ 	{ USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 3a8b9aef96a6..0986c324459f 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -884,7 +884,7 @@ static int qca_set_baudrate(struct hci_dev *hdev, uint8_t baudrate)
+ 	 */
+ 	set_current_state(TASK_UNINTERRUPTIBLE);
+ 	schedule_timeout(msecs_to_jiffies(BAUDRATE_SETTLE_TIMEOUT_MS));
+-	set_current_state(TASK_INTERRUPTIBLE);
++	set_current_state(TASK_RUNNING);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
+index 45d7ecc66b22..4e9e9e618c9f 100644
+--- a/drivers/bus/arm-ccn.c
++++ b/drivers/bus/arm-ccn.c
+@@ -736,7 +736,7 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
+ 	ccn = pmu_to_arm_ccn(event->pmu);
+ 
+ 	if (hw->sample_period) {
+-		dev_warn(ccn->dev, "Sampling not supported!\n");
++		dev_dbg(ccn->dev, "Sampling not supported!\n");
+ 		return -EOPNOTSUPP;
+ 	}
+ 
+@@ -744,12 +744,12 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
+ 			event->attr.exclude_kernel || event->attr.exclude_hv ||
+ 			event->attr.exclude_idle || event->attr.exclude_host ||
+ 			event->attr.exclude_guest) {
+-		dev_warn(ccn->dev, "Can't exclude execution levels!\n");
++		dev_dbg(ccn->dev, "Can't exclude execution levels!\n");
+ 		return -EINVAL;
+ 	}
+ 
+ 	if (event->cpu < 0) {
+-		dev_warn(ccn->dev, "Can't provide per-task data!\n");
++		dev_dbg(ccn->dev, "Can't provide per-task data!\n");
+ 		return -EOPNOTSUPP;
+ 	}
+ 	/*
+@@ -771,13 +771,13 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
+ 	switch (type) {
+ 	case CCN_TYPE_MN:
+ 		if (node_xp != ccn->mn_id) {
+-			dev_warn(ccn->dev, "Invalid MN ID %d!\n", node_xp);
++			dev_dbg(ccn->dev, "Invalid MN ID %d!\n", node_xp);
+ 			return -EINVAL;
+ 		}
+ 		break;
+ 	case CCN_TYPE_XP:
+ 		if (node_xp >= ccn->num_xps) {
+-			dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp);
++			dev_dbg(ccn->dev, "Invalid XP ID %d!\n", node_xp);
+ 			return -EINVAL;
+ 		}
+ 		break;
+@@ -785,11 +785,11 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
+ 		break;
+ 	default:
+ 		if (node_xp >= ccn->num_nodes) {
+-			dev_warn(ccn->dev, "Invalid node ID %d!\n", node_xp);
++			dev_dbg(ccn->dev, "Invalid node ID %d!\n", node_xp);
+ 			return -EINVAL;
+ 		}
+ 		if (!arm_ccn_pmu_type_eq(type, ccn->node[node_xp].type)) {
+-			dev_warn(ccn->dev, "Invalid type 0x%x for node %d!\n",
++			dev_dbg(ccn->dev, "Invalid type 0x%x for node %d!\n",
+ 					type, node_xp);
+ 			return -EINVAL;
+ 		}
+@@ -808,19 +808,19 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
+ 		if (event_id != e->event)
+ 			continue;
+ 		if (e->num_ports && port >= e->num_ports) {
+-			dev_warn(ccn->dev, "Invalid port %d for node/XP %d!\n",
++			dev_dbg(ccn->dev, "Invalid port %d for node/XP %d!\n",
+ 					port, node_xp);
+ 			return -EINVAL;
+ 		}
+ 		if (e->num_vcs && vc >= e->num_vcs) {
+-			dev_warn(ccn->dev, "Invalid vc %d for node/XP %d!\n",
++			dev_dbg(ccn->dev, "Invalid vc %d for node/XP %d!\n",
+ 					vc, node_xp);
+ 			return -EINVAL;
+ 		}
+ 		valid = 1;
+ 	}
+ 	if (!valid) {
+-		dev_warn(ccn->dev, "Invalid event 0x%x for node/XP %d!\n",
++		dev_dbg(ccn->dev, "Invalid event 0x%x for node/XP %d!\n",
+ 				event_id, node_xp);
+ 		return -EINVAL;
+ 	}
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index ddeac4eefd0a..81b65d0e7563 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1826,14 +1826,22 @@ static int
+ write_pool(struct entropy_store *r, const char __user *buffer, size_t count)
+ {
+ 	size_t bytes;
+-	__u32 buf[16];
++	__u32 t, buf[16];
+ 	const char __user *p = buffer;
+ 
+ 	while (count > 0) {
++		int b, i = 0;
++
+ 		bytes = min(count, sizeof(buf));
+ 		if (copy_from_user(&buf, p, bytes))
+ 			return -EFAULT;
+ 
++		for (b = bytes ; b > 0 ; b -= sizeof(__u32), i++) {
++			if (!arch_get_random_int(&t))
++				break;
++			buf[i] ^= t;
++		}
++
+ 		count -= bytes;
+ 		p += bytes;
+ 
+diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c
+index 61262a7a5c3a..b0bd0f64d8f2 100644
+--- a/drivers/edac/altera_edac.c
++++ b/drivers/edac/altera_edac.c
+@@ -1111,7 +1111,7 @@ static void *ocram_alloc_mem(size_t size, void **other)
+ 
+ static void ocram_free_mem(void *p, size_t size, void *other)
+ {
+-	gen_pool_free((struct gen_pool *)other, (u32)p, size);
++	gen_pool_free((struct gen_pool *)other, (unsigned long)p, size);
+ }
+ 
+ static const struct edac_device_prv_data ocramecc_data = {
+diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
+index 34adde169a78..dd6fff1c98d6 100644
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -1091,7 +1091,9 @@ drm_atomic_set_crtc_for_plane(struct drm_plane_state *plane_state,
+ {
+ 	struct drm_plane *plane = plane_state->plane;
+ 	struct drm_crtc_state *crtc_state;
+-
++	/* Nothing to do for same crtc*/
++	if (plane_state->crtc == crtc)
++		return 0;
+ 	if (plane_state->crtc) {
+ 		crtc_state = drm_atomic_get_crtc_state(plane_state->state,
+ 						       plane_state->crtc);
+diff --git a/drivers/gpu/drm/gma500/psb_intel_drv.h b/drivers/gpu/drm/gma500/psb_intel_drv.h
+index 2a3b7c684db2..fbd3fa340c4f 100644
+--- a/drivers/gpu/drm/gma500/psb_intel_drv.h
++++ b/drivers/gpu/drm/gma500/psb_intel_drv.h
+@@ -255,7 +255,7 @@ extern int intelfb_remove(struct drm_device *dev,
+ extern bool psb_intel_lvds_mode_fixup(struct drm_encoder *encoder,
+ 				      const struct drm_display_mode *mode,
+ 				      struct drm_display_mode *adjusted_mode);
+-extern int psb_intel_lvds_mode_valid(struct drm_connector *connector,
++extern enum drm_mode_status psb_intel_lvds_mode_valid(struct drm_connector *connector,
+ 				     struct drm_display_mode *mode);
+ extern int psb_intel_lvds_set_property(struct drm_connector *connector,
+ 					struct drm_property *property,
+diff --git a/drivers/gpu/drm/gma500/psb_intel_lvds.c b/drivers/gpu/drm/gma500/psb_intel_lvds.c
+index 79e9d3690667..e2c6ba3eded4 100644
+--- a/drivers/gpu/drm/gma500/psb_intel_lvds.c
++++ b/drivers/gpu/drm/gma500/psb_intel_lvds.c
+@@ -343,7 +343,7 @@ static void psb_intel_lvds_restore(struct drm_connector *connector)
+ 	}
+ }
+ 
+-int psb_intel_lvds_mode_valid(struct drm_connector *connector,
++enum drm_mode_status psb_intel_lvds_mode_valid(struct drm_connector *connector,
+ 				 struct drm_display_mode *mode)
+ {
+ 	struct drm_psb_private *dev_priv = connector->dev->dev_private;
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index f416f5c2e8e9..c5e1aa5f1d8e 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -850,7 +850,7 @@ static int radeon_lvds_get_modes(struct drm_connector *connector)
+ 	return ret;
+ }
+ 
+-static int radeon_lvds_mode_valid(struct drm_connector *connector,
++static enum drm_mode_status radeon_lvds_mode_valid(struct drm_connector *connector,
+ 				  struct drm_display_mode *mode)
+ {
+ 	struct drm_encoder *encoder = radeon_best_single_encoder(connector);
+@@ -1010,7 +1010,7 @@ static int radeon_vga_get_modes(struct drm_connector *connector)
+ 	return ret;
+ }
+ 
+-static int radeon_vga_mode_valid(struct drm_connector *connector,
++static enum drm_mode_status radeon_vga_mode_valid(struct drm_connector *connector,
+ 				  struct drm_display_mode *mode)
+ {
+ 	struct drm_device *dev = connector->dev;
+@@ -1154,7 +1154,7 @@ static int radeon_tv_get_modes(struct drm_connector *connector)
+ 	return 1;
+ }
+ 
+-static int radeon_tv_mode_valid(struct drm_connector *connector,
++static enum drm_mode_status radeon_tv_mode_valid(struct drm_connector *connector,
+ 				struct drm_display_mode *mode)
+ {
+ 	if ((mode->hdisplay > 1024) || (mode->vdisplay > 768))
+@@ -1496,7 +1496,7 @@ static void radeon_dvi_force(struct drm_connector *connector)
+ 		radeon_connector->use_digital = true;
+ }
+ 
+-static int radeon_dvi_mode_valid(struct drm_connector *connector,
++static enum drm_mode_status radeon_dvi_mode_valid(struct drm_connector *connector,
+ 				  struct drm_display_mode *mode)
+ {
+ 	struct drm_device *dev = connector->dev;
+@@ -1798,7 +1798,7 @@ out:
+ 	return ret;
+ }
+ 
+-static int radeon_dp_mode_valid(struct drm_connector *connector,
++static enum drm_mode_status radeon_dp_mode_valid(struct drm_connector *connector,
+ 				  struct drm_display_mode *mode)
+ {
+ 	struct drm_device *dev = connector->dev;
+diff --git a/drivers/hid/hid-plantronics.c b/drivers/hid/hid-plantronics.c
+index febb21ee190e..584b10d3fc3d 100644
+--- a/drivers/hid/hid-plantronics.c
++++ b/drivers/hid/hid-plantronics.c
+@@ -2,7 +2,7 @@
+  *  Plantronics USB HID Driver
+  *
+  *  Copyright (c) 2014 JD Cole <jd.cole@×××××××××××.com>
+- *  Copyright (c) 2015 Terry Junge <terry.junge@×××××××××××.com>
++ *  Copyright (c) 2015-2018 Terry Junge <terry.junge@×××××××××××.com>
+  */
+ 
+ /*
+@@ -48,6 +48,10 @@ static int plantronics_input_mapping(struct hid_device *hdev,
+ 	unsigned short mapped_key;
+ 	unsigned long plt_type = (unsigned long)hid_get_drvdata(hdev);
+ 
++	/* special case for PTT products */
++	if (field->application == HID_GD_JOYSTICK)
++		goto defaulted;
++
+ 	/* handle volume up/down mapping */
+ 	/* non-standard types or multi-HID interfaces - plt_type is PID */
+ 	if (!(plt_type & HID_USAGE_PAGE)) {
+diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
+index 00bce002b357..ce2b80009c19 100644
+--- a/drivers/hid/i2c-hid/i2c-hid.c
++++ b/drivers/hid/i2c-hid/i2c-hid.c
+@@ -1101,6 +1101,14 @@ static int i2c_hid_probe(struct i2c_client *client,
+ 	pm_runtime_enable(&client->dev);
+ 	device_enable_async_suspend(&client->dev);
+ 
++	/* Make sure there is something at this address */
++	ret = i2c_smbus_read_byte(client);
++	if (ret < 0) {
++		dev_dbg(&client->dev, "nothing at this address: %d\n", ret);
++		ret = -ENXIO;
++		goto err_pm;
++	}
++
+ 	ret = i2c_hid_fetch_hid_descriptor(ihid);
+ 	if (ret < 0)
+ 		goto err_pm;
+diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
+index 2395fe2021c9..3e2ab04201e2 100644
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -1549,7 +1549,8 @@ static int add_oui_reg_req(struct ib_mad_reg_req *mad_reg_req,
+ 			    mad_reg_req->oui, 3)) {
+ 			method = &(*vendor_table)->vendor_class[
+ 						vclass]->method_table[i];
+-			BUG_ON(!*method);
++			if (!*method)
++				goto error3;
+ 			goto check_in_use;
+ 		}
+ 	}
+@@ -1559,10 +1560,12 @@ static int add_oui_reg_req(struct ib_mad_reg_req *mad_reg_req,
+ 				vclass]->oui[i])) {
+ 			method = &(*vendor_table)->vendor_class[
+ 				vclass]->method_table[i];
+-			BUG_ON(*method);
+ 			/* Allocate method table for this OUI */
+-			if ((ret = allocate_method_table(method)))
+-				goto error3;
++			if (!*method) {
++				ret = allocate_method_table(method);
++				if (ret)
++					goto error3;
++			}
+ 			memcpy((*vendor_table)->vendor_class[vclass]->oui[i],
+ 			       mad_reg_req->oui, 3);
+ 			goto check_in_use;
+diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
+index a036d7087ddf..3bef6d4ffe6f 100644
+--- a/drivers/infiniband/core/ucma.c
++++ b/drivers/infiniband/core/ucma.c
+@@ -218,7 +218,7 @@ static struct ucma_multicast* ucma_alloc_multicast(struct ucma_context *ctx)
+ 		return NULL;
+ 
+ 	mutex_lock(&mut);
+-	mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL);
++	mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL);
+ 	mutex_unlock(&mut);
+ 	if (mc->id < 0)
+ 		goto error;
+@@ -1385,6 +1385,10 @@ static ssize_t ucma_process_join(struct ucma_file *file,
+ 		goto err3;
+ 	}
+ 
++	mutex_lock(&mut);
++	idr_replace(&multicast_idr, mc, mc->id);
++	mutex_unlock(&mut);
++
+ 	mutex_unlock(&file->mut);
+ 	ucma_put_ctx(ctx);
+ 	return 0;
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index 4b717cf50d27..6f875bf9cc9d 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -3725,6 +3725,11 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
+ 		goto err_uobj;
+ 	}
+ 
++	if (qp->qp_type != IB_QPT_UD && qp->qp_type != IB_QPT_RAW_PACKET) {
++		err = -EINVAL;
++		goto err_put;
++	}
++
+ 	flow_attr = kzalloc(sizeof(*flow_attr) + cmd.flow_attr.num_of_specs *
+ 			    sizeof(union ib_flow_spec), GFP_KERNEL);
+ 	if (!flow_attr) {
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index 97f6e05cffce..a716482774db 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1251,6 +1251,8 @@ static const struct acpi_device_id elan_acpi_id[] = {
+ 	{ "ELAN0611", 0 },
+ 	{ "ELAN0612", 0 },
+ 	{ "ELAN0618", 0 },
++	{ "ELAN061D", 0 },
++	{ "ELAN0622", 0 },
+ 	{ "ELAN1000", 0 },
+ 	{ }
+ };
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index e484ea2dc787..34be09651ee8 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -527,6 +527,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"),
+ 		},
+ 	},
++	{
++		/* Lenovo LaVie Z */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo LaVie Z"),
++		},
++	},
+ 	{ }
+ };
+ 
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 3bb985679f34..a7a0e3acdb2f 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -6192,6 +6192,9 @@ static int hot_remove_disk(struct mddev *mddev, dev_t dev)
+ 	char b[BDEVNAME_SIZE];
+ 	struct md_rdev *rdev;
+ 
++	if (!mddev->pers)
++		return -ENODEV;
++
+ 	rdev = find_rdev(mddev, dev);
+ 	if (!rdev)
+ 		return -ENXIO;
+diff --git a/drivers/media/common/siano/smsendian.c b/drivers/media/common/siano/smsendian.c
+index bfe831c10b1c..b95a631f23f9 100644
+--- a/drivers/media/common/siano/smsendian.c
++++ b/drivers/media/common/siano/smsendian.c
+@@ -35,7 +35,7 @@ void smsendian_handle_tx_message(void *buffer)
+ 	switch (msg->x_msg_header.msg_type) {
+ 	case MSG_SMS_DATA_DOWNLOAD_REQ:
+ 	{
+-		msg->msg_data[0] = le32_to_cpu(msg->msg_data[0]);
++		msg->msg_data[0] = le32_to_cpu((__force __le32)(msg->msg_data[0]));
+ 		break;
+ 	}
+ 
+@@ -44,7 +44,7 @@ void smsendian_handle_tx_message(void *buffer)
+ 				sizeof(struct sms_msg_hdr))/4;
+ 
+ 		for (i = 0; i < msg_words; i++)
+-			msg->msg_data[i] = le32_to_cpu(msg->msg_data[i]);
++			msg->msg_data[i] = le32_to_cpu((__force __le32)msg->msg_data[i]);
+ 
+ 		break;
+ 	}
+@@ -64,7 +64,7 @@ void smsendian_handle_rx_message(void *buffer)
+ 	{
+ 		struct sms_version_res *ver =
+ 			(struct sms_version_res *) msg;
+-		ver->chip_model = le16_to_cpu(ver->chip_model);
++		ver->chip_model = le16_to_cpu((__force __le16)ver->chip_model);
+ 		break;
+ 	}
+ 
+@@ -81,7 +81,7 @@ void smsendian_handle_rx_message(void *buffer)
+ 				sizeof(struct sms_msg_hdr))/4;
+ 
+ 		for (i = 0; i < msg_words; i++)
+-			msg->msg_data[i] = le32_to_cpu(msg->msg_data[i]);
++			msg->msg_data[i] = le32_to_cpu((__force __le32)msg->msg_data[i]);
+ 
+ 		break;
+ 	}
+@@ -95,9 +95,9 @@ void smsendian_handle_message_header(void *msg)
+ #ifdef __BIG_ENDIAN
+ 	struct sms_msg_hdr *phdr = (struct sms_msg_hdr *)msg;
+ 
+-	phdr->msg_type = le16_to_cpu(phdr->msg_type);
+-	phdr->msg_length = le16_to_cpu(phdr->msg_length);
+-	phdr->msg_flags = le16_to_cpu(phdr->msg_flags);
++	phdr->msg_type = le16_to_cpu((__force __le16)phdr->msg_type);
++	phdr->msg_length = le16_to_cpu((__force __le16)phdr->msg_length);
++	phdr->msg_flags = le16_to_cpu((__force __le16)phdr->msg_flags);
+ #endif /* __BIG_ENDIAN */
+ }
+ EXPORT_SYMBOL_GPL(smsendian_handle_message_header);
+diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
+index 44f8c7e10a35..8ffa13f39a86 100644
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -991,7 +991,7 @@ static int smiapp_read_nvm(struct smiapp_sensor *sensor,
+ 		if (rval)
+ 			goto out;
+ 
+-		for (i = 0; i < 1000; i++) {
++		for (i = 1000; i > 0; i--) {
+ 			rval = smiapp_read(
+ 				sensor,
+ 				SMIAPP_REG_U8_DATA_TRANSFER_IF_1_STATUS, &s);
+@@ -1002,11 +1002,10 @@ static int smiapp_read_nvm(struct smiapp_sensor *sensor,
+ 			if (s & SMIAPP_DATA_TRANSFER_IF_1_STATUS_RD_READY)
+ 				break;
+ 
+-			if (--i == 0) {
+-				rval = -ETIMEDOUT;
+-				goto out;
+-			}
+-
++		}
++		if (!i) {
++			rval = -ETIMEDOUT;
++			goto out;
+ 		}
+ 
+ 		for (i = 0; i < SMIAPP_NVM_PAGE_SIZE; i++) {
+diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
+index 4462d8c69d57..6f46c59415fe 100644
+--- a/drivers/media/media-device.c
++++ b/drivers/media/media-device.c
+@@ -58,9 +58,10 @@ static int media_device_close(struct file *filp)
+ 	return 0;
+ }
+ 
+-static int media_device_get_info(struct media_device *dev,
+-				 struct media_device_info *info)
++static long media_device_get_info(struct media_device *dev, void *arg)
+ {
++	struct media_device_info *info = arg;
++
+ 	memset(info, 0, sizeof(*info));
+ 
+ 	if (dev->driver_name[0])
+@@ -97,9 +98,9 @@ static struct media_entity *find_entity(struct media_device *mdev, u32 id)
+ 	return NULL;
+ }
+ 
+-static long media_device_enum_entities(struct media_device *mdev,
+-				       struct media_entity_desc *entd)
++static long media_device_enum_entities(struct media_device *mdev, void *arg)
+ {
++	struct media_entity_desc *entd = arg;
+ 	struct media_entity *ent;
+ 
+ 	ent = find_entity(mdev, entd->id);
+@@ -150,9 +151,9 @@ static void media_device_kpad_to_upad(const struct media_pad *kpad,
+ 	upad->flags = kpad->flags;
+ }
+ 
+-static long media_device_enum_links(struct media_device *mdev,
+-				    struct media_links_enum *links)
++static long media_device_enum_links(struct media_device *mdev, void *arg)
+ {
++	struct media_links_enum *links = arg;
+ 	struct media_entity *entity;
+ 
+ 	entity = find_entity(mdev, links->entity);
+@@ -198,9 +199,9 @@ static long media_device_enum_links(struct media_device *mdev,
+ 	return 0;
+ }
+ 
+-static long media_device_setup_link(struct media_device *mdev,
+-				    struct media_link_desc *linkd)
++static long media_device_setup_link(struct media_device *mdev, void *arg)
+ {
++	struct media_link_desc *linkd = arg;
+ 	struct media_link *link = NULL;
+ 	struct media_entity *source;
+ 	struct media_entity *sink;
+@@ -226,9 +227,9 @@ static long media_device_setup_link(struct media_device *mdev,
+ 	return __media_entity_setup_link(link, linkd->flags);
+ }
+ 
+-static long media_device_get_topology(struct media_device *mdev,
+-				      struct media_v2_topology *topo)
++static long media_device_get_topology(struct media_device *mdev, void *arg)
+ {
++	struct media_v2_topology *topo = arg;
+ 	struct media_entity *entity;
+ 	struct media_interface *intf;
+ 	struct media_pad *pad;
+diff --git a/drivers/media/pci/saa7164/saa7164-fw.c b/drivers/media/pci/saa7164/saa7164-fw.c
+index 269e0782c7b6..93d53195e8ca 100644
+--- a/drivers/media/pci/saa7164/saa7164-fw.c
++++ b/drivers/media/pci/saa7164/saa7164-fw.c
+@@ -430,7 +430,8 @@ int saa7164_downloadfirmware(struct saa7164_dev *dev)
+ 			__func__, fw->size);
+ 
+ 		if (fw->size != fwlength) {
+-			printk(KERN_ERR "xc5000: firmware incorrect size\n");
++			printk(KERN_ERR "saa7164: firmware incorrect size %zu != %u\n",
++				fw->size, fwlength);
+ 			ret = -ENOMEM;
+ 			goto out;
+ 		}
+diff --git a/drivers/media/pci/tw686x/tw686x-video.c b/drivers/media/pci/tw686x/tw686x-video.c
+index c3fafa97b2d0..0ea8dd44026c 100644
+--- a/drivers/media/pci/tw686x/tw686x-video.c
++++ b/drivers/media/pci/tw686x/tw686x-video.c
+@@ -1228,7 +1228,8 @@ int tw686x_video_init(struct tw686x_dev *dev)
+ 		vc->vidq.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
+ 		vc->vidq.min_buffers_needed = 2;
+ 		vc->vidq.lock = &vc->vb_mutex;
+-		vc->vidq.gfp_flags = GFP_DMA32;
++		vc->vidq.gfp_flags = dev->dma_mode != TW686X_DMA_MODE_MEMCPY ?
++				     GFP_DMA32 : 0;
+ 		vc->vidq.dev = &dev->pci_dev->dev;
+ 
+ 		err = vb2_queue_init(&vc->vidq);
+diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
+index 0321d84addc7..15a86bb4e61c 100644
+--- a/drivers/media/platform/omap3isp/isp.c
++++ b/drivers/media/platform/omap3isp/isp.c
+@@ -1941,6 +1941,7 @@ error_csiphy:
+ 
+ static void isp_detach_iommu(struct isp_device *isp)
+ {
++	arm_iommu_detach_device(isp->dev);
+ 	arm_iommu_release_mapping(isp->mapping);
+ 	isp->mapping = NULL;
+ 	iommu_group_remove_device(isp->dev);
+@@ -1974,8 +1975,7 @@ static int isp_attach_iommu(struct isp_device *isp)
+ 	mapping = arm_iommu_create_mapping(&platform_bus_type, SZ_1G, SZ_2G);
+ 	if (IS_ERR(mapping)) {
+ 		dev_err(isp->dev, "failed to create ARM IOMMU mapping\n");
+-		ret = PTR_ERR(mapping);
+-		goto error;
++		return PTR_ERR(mapping);
+ 	}
+ 
+ 	isp->mapping = mapping;
+@@ -1990,7 +1990,8 @@ static int isp_attach_iommu(struct isp_device *isp)
+ 	return 0;
+ 
+ error:
+-	isp_detach_iommu(isp);
++	arm_iommu_release_mapping(isp->mapping);
++	isp->mapping = NULL;
+ 	return ret;
+ }
+ 
+diff --git a/drivers/media/platform/rcar_jpu.c b/drivers/media/platform/rcar_jpu.c
+index d1746ecc645d..db1110a492e0 100644
+--- a/drivers/media/platform/rcar_jpu.c
++++ b/drivers/media/platform/rcar_jpu.c
+@@ -1280,7 +1280,7 @@ static int jpu_open(struct file *file)
+ 		/* ...issue software reset */
+ 		ret = jpu_reset(jpu);
+ 		if (ret)
+-			goto device_prepare_rollback;
++			goto jpu_reset_rollback;
+ 	}
+ 
+ 	jpu->ref_count++;
+@@ -1288,6 +1288,8 @@ static int jpu_open(struct file *file)
+ 	mutex_unlock(&jpu->mutex);
+ 	return 0;
+ 
++jpu_reset_rollback:
++	clk_disable_unprepare(jpu->clk);
+ device_prepare_rollback:
+ 	mutex_unlock(&jpu->mutex);
+ v4l_prepare_rollback:
+diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
+index ee0470a3196b..f218886c504d 100644
+--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
+@@ -96,7 +96,7 @@ MODULE_PARM_DESC(max_rds_errors, "RDS maximum block errors: *1*");
+  */
+ int si470x_get_register(struct si470x_device *radio, int regnr)
+ {
+-	u16 buf[READ_REG_NUM];
++	__be16 buf[READ_REG_NUM];
+ 	struct i2c_msg msgs[1] = {
+ 		{
+ 			.addr = radio->client->addr,
+@@ -121,7 +121,7 @@ int si470x_get_register(struct si470x_device *radio, int regnr)
+ int si470x_set_register(struct si470x_device *radio, int regnr)
+ {
+ 	int i;
+-	u16 buf[WRITE_REG_NUM];
++	__be16 buf[WRITE_REG_NUM];
+ 	struct i2c_msg msgs[1] = {
+ 		{
+ 			.addr = radio->client->addr,
+@@ -151,7 +151,7 @@ int si470x_set_register(struct si470x_device *radio, int regnr)
+ static int si470x_get_all_registers(struct si470x_device *radio)
+ {
+ 	int i;
+-	u16 buf[READ_REG_NUM];
++	__be16 buf[READ_REG_NUM];
+ 	struct i2c_msg msgs[1] = {
+ 		{
+ 			.addr = radio->client->addr,
+diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
+index 4299ce06c25b..b3a9fa75e8e7 100644
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -914,9 +914,12 @@ void vb2_buffer_done(struct vb2_buffer *vb, enum vb2_buffer_state state)
+ 	dprintk(4, "done processing on buffer %d, state: %d\n",
+ 			vb->index, state);
+ 
+-	/* sync buffers */
+-	for (plane = 0; plane < vb->num_planes; ++plane)
+-		call_void_memop(vb, finish, vb->planes[plane].mem_priv);
++	if (state != VB2_BUF_STATE_QUEUED &&
++	    state != VB2_BUF_STATE_REQUEUEING) {
++		/* sync buffers */
++		for (plane = 0; plane < vb->num_planes; ++plane)
++			call_void_memop(vb, finish, vb->planes[plane].mem_priv);
++	}
+ 
+ 	spin_lock_irqsave(&q->done_lock, flags);
+ 	if (state == VB2_BUF_STATE_QUEUED ||
+diff --git a/drivers/memory/tegra/mc.c b/drivers/memory/tegra/mc.c
+index a4803ac192bb..1d49a8dd4a37 100644
+--- a/drivers/memory/tegra/mc.c
++++ b/drivers/memory/tegra/mc.c
+@@ -20,14 +20,6 @@
+ #include "mc.h"
+ 
+ #define MC_INTSTATUS 0x000
+-#define  MC_INT_DECERR_MTS (1 << 16)
+-#define  MC_INT_SECERR_SEC (1 << 13)
+-#define  MC_INT_DECERR_VPR (1 << 12)
+-#define  MC_INT_INVALID_APB_ASID_UPDATE (1 << 11)
+-#define  MC_INT_INVALID_SMMU_PAGE (1 << 10)
+-#define  MC_INT_ARBITRATION_EMEM (1 << 9)
+-#define  MC_INT_SECURITY_VIOLATION (1 << 8)
+-#define  MC_INT_DECERR_EMEM (1 << 6)
+ 
+ #define MC_INTMASK 0x004
+ 
+@@ -248,12 +240,13 @@ static const char *const error_names[8] = {
+ static irqreturn_t tegra_mc_irq(int irq, void *data)
+ {
+ 	struct tegra_mc *mc = data;
+-	unsigned long status, mask;
++	unsigned long status;
+ 	unsigned int bit;
+ 
+ 	/* mask all interrupts to avoid flooding */
+-	status = mc_readl(mc, MC_INTSTATUS);
+-	mask = mc_readl(mc, MC_INTMASK);
++	status = mc_readl(mc, MC_INTSTATUS) & mc->soc->intmask;
++	if (!status)
++		return IRQ_NONE;
+ 
+ 	for_each_set_bit(bit, &status, 32) {
+ 		const char *error = status_names[bit] ?: "unknown";
+@@ -346,7 +339,6 @@ static int tegra_mc_probe(struct platform_device *pdev)
+ 	const struct of_device_id *match;
+ 	struct resource *res;
+ 	struct tegra_mc *mc;
+-	u32 value;
+ 	int err;
+ 
+ 	match = of_match_node(tegra_mc_of_match, pdev->dev.of_node);
+@@ -414,11 +406,7 @@ static int tegra_mc_probe(struct platform_device *pdev)
+ 
+ 	WARN(!mc->soc->client_id_mask, "Missing client ID mask for this SoC\n");
+ 
+-	value = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR |
+-		MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE |
+-		MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM;
+-
+-	mc_writel(mc, value, MC_INTMASK);
++	mc_writel(mc, mc->soc->intmask, MC_INTMASK);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/memory/tegra/mc.h b/drivers/memory/tegra/mc.h
+index ddb16676c3af..24e020b4609b 100644
+--- a/drivers/memory/tegra/mc.h
++++ b/drivers/memory/tegra/mc.h
+@@ -14,6 +14,15 @@
+ 
+ #include <soc/tegra/mc.h>
+ 
++#define MC_INT_DECERR_MTS (1 << 16)
++#define MC_INT_SECERR_SEC (1 << 13)
++#define MC_INT_DECERR_VPR (1 << 12)
++#define MC_INT_INVALID_APB_ASID_UPDATE (1 << 11)
++#define MC_INT_INVALID_SMMU_PAGE (1 << 10)
++#define MC_INT_ARBITRATION_EMEM (1 << 9)
++#define MC_INT_SECURITY_VIOLATION (1 << 8)
++#define MC_INT_DECERR_EMEM (1 << 6)
++
+ static inline u32 mc_readl(struct tegra_mc *mc, unsigned long offset)
+ {
+ 	return readl(mc->regs + offset);
+diff --git a/drivers/memory/tegra/tegra114.c b/drivers/memory/tegra/tegra114.c
+index ba8fff3d66a6..6d2a5a849d92 100644
+--- a/drivers/memory/tegra/tegra114.c
++++ b/drivers/memory/tegra/tegra114.c
+@@ -930,4 +930,6 @@ const struct tegra_mc_soc tegra114_mc_soc = {
+ 	.atom_size = 32,
+ 	.client_id_mask = 0x7f,
+ 	.smmu = &tegra114_smmu_soc,
++	.intmask = MC_INT_INVALID_SMMU_PAGE | MC_INT_SECURITY_VIOLATION |
++		   MC_INT_DECERR_EMEM,
+ };
+diff --git a/drivers/memory/tegra/tegra124.c b/drivers/memory/tegra/tegra124.c
+index 5a58e440f4a7..9f68a56f2727 100644
+--- a/drivers/memory/tegra/tegra124.c
++++ b/drivers/memory/tegra/tegra124.c
+@@ -1020,6 +1020,9 @@ const struct tegra_mc_soc tegra124_mc_soc = {
+ 	.smmu = &tegra124_smmu_soc,
+ 	.emem_regs = tegra124_mc_emem_regs,
+ 	.num_emem_regs = ARRAY_SIZE(tegra124_mc_emem_regs),
++	.intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR |
++		   MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE |
++		   MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM,
+ };
+ #endif /* CONFIG_ARCH_TEGRA_124_SOC */
+ 
+@@ -1042,5 +1045,8 @@ const struct tegra_mc_soc tegra132_mc_soc = {
+ 	.atom_size = 32,
+ 	.client_id_mask = 0x7f,
+ 	.smmu = &tegra132_smmu_soc,
++	.intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR |
++		   MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE |
++		   MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM,
+ };
+ #endif /* CONFIG_ARCH_TEGRA_132_SOC */
+diff --git a/drivers/memory/tegra/tegra210.c b/drivers/memory/tegra/tegra210.c
+index 5e144abe4c18..47c78a6d8f00 100644
+--- a/drivers/memory/tegra/tegra210.c
++++ b/drivers/memory/tegra/tegra210.c
+@@ -1077,4 +1077,7 @@ const struct tegra_mc_soc tegra210_mc_soc = {
+ 	.atom_size = 64,
+ 	.client_id_mask = 0xff,
+ 	.smmu = &tegra210_smmu_soc,
++	.intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR |
++		   MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE |
++		   MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM,
+ };
+diff --git a/drivers/memory/tegra/tegra30.c b/drivers/memory/tegra/tegra30.c
+index b44737840e70..d0689428ea1a 100644
+--- a/drivers/memory/tegra/tegra30.c
++++ b/drivers/memory/tegra/tegra30.c
+@@ -952,4 +952,6 @@ const struct tegra_mc_soc tegra30_mc_soc = {
+ 	.atom_size = 16,
+ 	.client_id_mask = 0x7f,
+ 	.smmu = &tegra30_smmu_soc,
++	.intmask = MC_INT_INVALID_SMMU_PAGE | MC_INT_SECURITY_VIOLATION |
++		   MC_INT_DECERR_EMEM,
+ };
+diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
+index abd83424b498..3e18d2595b6d 100644
+--- a/drivers/mfd/cros_ec.c
++++ b/drivers/mfd/cros_ec.c
+@@ -86,7 +86,11 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
+ 
+ 	mutex_init(&ec_dev->lock);
+ 
+-	cros_ec_query_all(ec_dev);
++	err = cros_ec_query_all(ec_dev);
++	if (err) {
++		dev_err(dev, "Cannot identify the EC: error %d\n", err);
++		return err;
++	}
+ 
+ 	if (ec_dev->irq) {
+ 		err = request_threaded_irq(ec_dev->irq, NULL, ec_irq_thread,
+diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c
+index 1304160de168..8cd9ddf1fab9 100644
+--- a/drivers/mmc/core/pwrseq_simple.c
++++ b/drivers/mmc/core/pwrseq_simple.c
+@@ -39,14 +39,18 @@ static void mmc_pwrseq_simple_set_gpios_value(struct mmc_pwrseq_simple *pwrseq,
+ 	struct gpio_descs *reset_gpios = pwrseq->reset_gpios;
+ 
+ 	if (!IS_ERR(reset_gpios)) {
+-		int i;
+-		int values[reset_gpios->ndescs];
++		int i, *values;
++		int nvalues = reset_gpios->ndescs;
+ 
+-		for (i = 0; i < reset_gpios->ndescs; i++)
++		values = kmalloc_array(nvalues, sizeof(int), GFP_KERNEL);
++		if (!values)
++			return;
++
++		for (i = 0; i < nvalues; i++)
+ 			values[i] = value;
+ 
+-		gpiod_set_array_value_cansleep(
+-			reset_gpios->ndescs, reset_gpios->desc, values);
++		gpiod_set_array_value_cansleep(nvalues, reset_gpios->desc, values);
++		kfree(values);
+ 	}
+ }
+ 
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
+index 1a1501fde010..e10a00d0d44d 100644
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -1164,6 +1164,8 @@ static void dw_mci_setup_bus(struct dw_mci_slot *slot, bool force_clkinit)
+ 	if (host->state == STATE_WAITING_CMD11_DONE)
+ 		sdmmc_cmd_bits |= SDMMC_CMD_VOLT_SWITCH;
+ 
++	slot->mmc->actual_clock = 0;
++
+ 	if (!clock) {
+ 		mci_writel(host, CLKENA, 0);
+ 		mci_send_cmd(slot, sdmmc_cmd_bits, 0);
+@@ -1209,6 +1211,8 @@ static void dw_mci_setup_bus(struct dw_mci_slot *slot, bool force_clkinit)
+ 
+ 		/* keep the last clock value that was requested from core */
+ 		slot->__clk_old = clock;
++		slot->mmc->actual_clock = div ? ((host->bus_hz / div) >> 1) :
++					  host->bus_hz;
+ 	}
+ 
+ 	host->current_speed = clock;
+diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c
+index 2f6b55229d5b..4c3b986dd74d 100644
+--- a/drivers/mtd/nand/fsl_ifc_nand.c
++++ b/drivers/mtd/nand/fsl_ifc_nand.c
+@@ -372,9 +372,16 @@ static void fsl_ifc_cmdfunc(struct mtd_info *mtd, unsigned int command,
+ 
+ 	case NAND_CMD_READID:
+ 	case NAND_CMD_PARAM: {
++		/*
++		 * For READID, read 8 bytes that are currently used.
++		 * For PARAM, read all 3 copies of 256-bytes pages.
++		 */
++		int len = 8;
+ 		int timing = IFC_FIR_OP_RB;
+-		if (command == NAND_CMD_PARAM)
++		if (command == NAND_CMD_PARAM) {
+ 			timing = IFC_FIR_OP_RBCD;
++			len = 256 * 3;
++		}
+ 
+ 		ifc_out32((IFC_FIR_OP_CW0 << IFC_NAND_FIR0_OP0_SHIFT) |
+ 			  (IFC_FIR_OP_UA  << IFC_NAND_FIR0_OP1_SHIFT) |
+@@ -384,12 +391,8 @@ static void fsl_ifc_cmdfunc(struct mtd_info *mtd, unsigned int command,
+ 			  &ifc->ifc_nand.nand_fcr0);
+ 		ifc_out32(column, &ifc->ifc_nand.row3);
+ 
+-		/*
+-		 * although currently it's 8 bytes for READID, we always read
+-		 * the maximum 256 bytes(for PARAM)
+-		 */
+-		ifc_out32(256, &ifc->ifc_nand.nand_fbcr);
+-		ifc_nand_ctrl->read_bytes = 256;
++		ifc_out32(len, &ifc->ifc_nand.nand_fbcr);
++		ifc_nand_ctrl->read_bytes = len;
+ 
+ 		set_addr(mtd, 0, 0, 0);
+ 		fsl_ifc_run_command(mtd);
+diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
+index b3df70d07ff6..7f64a76acd37 100644
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -474,7 +474,7 @@ qca8k_set_pad_ctrl(struct qca8k_priv *priv, int port, int mode)
+ static void
+ qca8k_port_set_status(struct qca8k_priv *priv, int port, int enable)
+ {
+-	u32 mask = QCA8K_PORT_STATUS_TXMAC;
++	u32 mask = QCA8K_PORT_STATUS_TXMAC | QCA8K_PORT_STATUS_RXMAC;
+ 
+ 	/* Port 0 and 6 have no internal PHY */
+ 	if ((port > 0) && (port < 6))
+@@ -491,6 +491,7 @@ qca8k_setup(struct dsa_switch *ds)
+ {
+ 	struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+ 	int ret, i, phy_mode = -1;
++	u32 mask;
+ 
+ 	/* Make sure that port 0 is the cpu port */
+ 	if (!dsa_is_cpu_port(ds, 0)) {
+@@ -516,7 +517,10 @@ qca8k_setup(struct dsa_switch *ds)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	/* Enable CPU Port */
++	/* Enable CPU Port, force it to maximum bandwidth and full-duplex */
++	mask = QCA8K_PORT_STATUS_SPEED_1000 | QCA8K_PORT_STATUS_TXFLOW |
++	       QCA8K_PORT_STATUS_RXFLOW | QCA8K_PORT_STATUS_DUPLEX;
++	qca8k_write(priv, QCA8K_REG_PORT_STATUS(QCA8K_CPU_PORT), mask);
+ 	qca8k_reg_set(priv, QCA8K_REG_GLOBAL_FW_CTRL0,
+ 		      QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN);
+ 	qca8k_port_set_status(priv, QCA8K_CPU_PORT, 1);
+@@ -585,6 +589,47 @@ qca8k_setup(struct dsa_switch *ds)
+ 	return 0;
+ }
+ 
++static void
++qca8k_adjust_link(struct dsa_switch *ds, int port, struct phy_device *phy)
++{
++	struct qca8k_priv *priv = ds->priv;
++	u32 reg;
++
++	/* Force fixed-link setting for CPU port, skip others. */
++	if (!phy_is_pseudo_fixed_link(phy))
++		return;
++
++	/* Set port speed */
++	switch (phy->speed) {
++	case 10:
++		reg = QCA8K_PORT_STATUS_SPEED_10;
++		break;
++	case 100:
++		reg = QCA8K_PORT_STATUS_SPEED_100;
++		break;
++	case 1000:
++		reg = QCA8K_PORT_STATUS_SPEED_1000;
++		break;
++	default:
++		dev_dbg(priv->dev, "port%d link speed %dMbps not supported.\n",
++			port, phy->speed);
++		return;
++	}
++
++	/* Set duplex mode */
++	if (phy->duplex == DUPLEX_FULL)
++		reg |= QCA8K_PORT_STATUS_DUPLEX;
++
++	/* Force flow control */
++	if (dsa_is_cpu_port(ds, port))
++		reg |= QCA8K_PORT_STATUS_RXFLOW | QCA8K_PORT_STATUS_TXFLOW;
++
++	/* Force link down before changing MAC options */
++	qca8k_port_set_status(priv, port, 0);
++	qca8k_write(priv, QCA8K_REG_PORT_STATUS(port), reg);
++	qca8k_port_set_status(priv, port, 1);
++}
++
+ static int
+ qca8k_phy_read(struct dsa_switch *ds, int phy, int regnum)
+ {
+@@ -914,6 +959,7 @@ qca8k_get_tag_protocol(struct dsa_switch *ds)
+ static struct dsa_switch_ops qca8k_switch_ops = {
+ 	.get_tag_protocol	= qca8k_get_tag_protocol,
+ 	.setup			= qca8k_setup,
++	.adjust_link            = qca8k_adjust_link,
+ 	.get_strings		= qca8k_get_strings,
+ 	.phy_read		= qca8k_phy_read,
+ 	.phy_write		= qca8k_phy_write,
+@@ -946,6 +992,7 @@ qca8k_sw_probe(struct mdio_device *mdiodev)
+ 		return -ENOMEM;
+ 
+ 	priv->bus = mdiodev->bus;
++	priv->dev = &mdiodev->dev;
+ 
+ 	/* read the switches ID register */
+ 	id = qca8k_read(priv, QCA8K_REG_MASK_CTRL);
+@@ -1018,6 +1065,7 @@ static SIMPLE_DEV_PM_OPS(qca8k_pm_ops,
+ 			 qca8k_suspend, qca8k_resume);
+ 
+ static const struct of_device_id qca8k_of_match[] = {
++	{ .compatible = "qca,qca8334" },
+ 	{ .compatible = "qca,qca8337" },
+ 	{ /* sentinel */ },
+ };
+diff --git a/drivers/net/dsa/qca8k.h b/drivers/net/dsa/qca8k.h
+index 201464719531..9c22bc3210cd 100644
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -51,8 +51,10 @@
+ #define QCA8K_GOL_MAC_ADDR0				0x60
+ #define QCA8K_GOL_MAC_ADDR1				0x64
+ #define QCA8K_REG_PORT_STATUS(_i)			(0x07c + (_i) * 4)
+-#define   QCA8K_PORT_STATUS_SPEED			GENMASK(2, 0)
+-#define   QCA8K_PORT_STATUS_SPEED_S			0
++#define   QCA8K_PORT_STATUS_SPEED			GENMASK(1, 0)
++#define   QCA8K_PORT_STATUS_SPEED_10			0
++#define   QCA8K_PORT_STATUS_SPEED_100			0x1
++#define   QCA8K_PORT_STATUS_SPEED_1000			0x2
+ #define   QCA8K_PORT_STATUS_TXMAC			BIT(2)
+ #define   QCA8K_PORT_STATUS_RXMAC			BIT(3)
+ #define   QCA8K_PORT_STATUS_TXFLOW			BIT(4)
+@@ -167,6 +169,7 @@ struct qca8k_priv {
+ 	struct ar8xxx_port_status port_sts[QCA8K_NUM_PORTS];
+ 	struct dsa_switch *ds;
+ 	struct mutex reg_mutex;
++	struct device *dev;
+ };
+ 
+ struct qca8k_mib_desc {
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index ca57eb56c717..8777c3a4c095 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -5257,6 +5257,9 @@ static int bnxt_update_link(struct bnxt *bp, bool chng_link_state)
+ 	}
+ 	mutex_unlock(&bp->hwrm_cmd_lock);
+ 
++	if (!BNXT_SINGLE_PF(bp))
++		return 0;
++
+ 	diff = link_info->support_auto_speeds ^ link_info->advertising;
+ 	if ((link_info->support_auto_speeds | diff) !=
+ 	    link_info->support_auto_speeds) {
+diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+index 1499ce2bf9f6..029513294984 100644
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -3729,6 +3729,7 @@ static int ixgbevf_set_mac(struct net_device *netdev, void *p)
+ 		return -EPERM;
+ 
+ 	ether_addr_copy(hw->mac.addr, addr->sa_data);
++	ether_addr_copy(hw->mac.perm_addr, addr->sa_data);
+ 	ether_addr_copy(netdev->dev_addr, addr->sa_data);
+ 
+ 	return 0;
+diff --git a/drivers/net/ethernet/ti/cpsw-phy-sel.c b/drivers/net/ethernet/ti/cpsw-phy-sel.c
+index 18013645e76c..0c1adad7415d 100644
+--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c
++++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c
+@@ -177,12 +177,18 @@ void cpsw_phy_sel(struct device *dev, phy_interface_t phy_mode, int slave)
+ 	}
+ 
+ 	dev = bus_find_device(&platform_bus_type, NULL, node, match);
+-	of_node_put(node);
++	if (!dev) {
++		dev_err(dev, "unable to find platform device for %pOF\n", node);
++		goto out;
++	}
++
+ 	priv = dev_get_drvdata(dev);
+ 
+ 	priv->cpsw_phy_sel(priv, phy_mode, slave);
+ 
+ 	put_device(dev);
++out:
++	of_node_put(node);
+ }
+ EXPORT_SYMBOL_GPL(cpsw_phy_sel);
+ 
+diff --git a/drivers/net/wireless/ath/regd.h b/drivers/net/wireless/ath/regd.h
+index 565d3075f06e..8553ab44d930 100644
+--- a/drivers/net/wireless/ath/regd.h
++++ b/drivers/net/wireless/ath/regd.h
+@@ -68,12 +68,14 @@ enum CountryCode {
+ 	CTRY_AUSTRALIA = 36,
+ 	CTRY_AUSTRIA = 40,
+ 	CTRY_AZERBAIJAN = 31,
++	CTRY_BAHAMAS = 44,
+ 	CTRY_BAHRAIN = 48,
+ 	CTRY_BANGLADESH = 50,
+ 	CTRY_BARBADOS = 52,
+ 	CTRY_BELARUS = 112,
+ 	CTRY_BELGIUM = 56,
+ 	CTRY_BELIZE = 84,
++	CTRY_BERMUDA = 60,
+ 	CTRY_BOLIVIA = 68,
+ 	CTRY_BOSNIA_HERZ = 70,
+ 	CTRY_BRAZIL = 76,
+@@ -159,6 +161,7 @@ enum CountryCode {
+ 	CTRY_ROMANIA = 642,
+ 	CTRY_RUSSIA = 643,
+ 	CTRY_SAUDI_ARABIA = 682,
++	CTRY_SERBIA = 688,
+ 	CTRY_SERBIA_MONTENEGRO = 891,
+ 	CTRY_SINGAPORE = 702,
+ 	CTRY_SLOVAKIA = 703,
+@@ -170,11 +173,13 @@ enum CountryCode {
+ 	CTRY_SWITZERLAND = 756,
+ 	CTRY_SYRIA = 760,
+ 	CTRY_TAIWAN = 158,
++	CTRY_TANZANIA = 834,
+ 	CTRY_THAILAND = 764,
+ 	CTRY_TRINIDAD_Y_TOBAGO = 780,
+ 	CTRY_TUNISIA = 788,
+ 	CTRY_TURKEY = 792,
+ 	CTRY_UAE = 784,
++	CTRY_UGANDA = 800,
+ 	CTRY_UKRAINE = 804,
+ 	CTRY_UNITED_KINGDOM = 826,
+ 	CTRY_UNITED_STATES = 840,
+diff --git a/drivers/net/wireless/ath/regd_common.h b/drivers/net/wireless/ath/regd_common.h
+index bdd2b4d61f2f..15bbd1e0d912 100644
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -35,6 +35,7 @@ enum EnumRd {
+ 	FRANCE_RES = 0x31,
+ 	FCC3_FCCA = 0x3A,
+ 	FCC3_WORLD = 0x3B,
++	FCC3_ETSIC = 0x3F,
+ 
+ 	ETSI1_WORLD = 0x37,
+ 	ETSI3_ETSIA = 0x32,
+@@ -44,6 +45,7 @@ enum EnumRd {
+ 	ETSI4_ETSIC = 0x38,
+ 	ETSI5_WORLD = 0x39,
+ 	ETSI6_WORLD = 0x34,
++	ETSI8_WORLD = 0x3D,
+ 	ETSI_RESERVED = 0x33,
+ 
+ 	MKK1_MKKA = 0x40,
+@@ -59,6 +61,7 @@ enum EnumRd {
+ 	MKK1_MKKA1 = 0x4A,
+ 	MKK1_MKKA2 = 0x4B,
+ 	MKK1_MKKC = 0x4C,
++	APL2_FCCA = 0x4D,
+ 
+ 	APL3_FCCA = 0x50,
+ 	APL1_WORLD = 0x52,
+@@ -67,6 +70,7 @@ enum EnumRd {
+ 	APL1_ETSIC = 0x55,
+ 	APL2_ETSIC = 0x56,
+ 	APL5_WORLD = 0x58,
++	APL13_WORLD = 0x5A,
+ 	APL6_WORLD = 0x5B,
+ 	APL7_FCCA = 0x5C,
+ 	APL8_WORLD = 0x5D,
+@@ -168,6 +172,7 @@ static struct reg_dmn_pair_mapping regDomainPairs[] = {
+ 	{FCC2_ETSIC, CTL_FCC, CTL_ETSI},
+ 	{FCC3_FCCA, CTL_FCC, CTL_FCC},
+ 	{FCC3_WORLD, CTL_FCC, CTL_ETSI},
++	{FCC3_ETSIC, CTL_FCC, CTL_ETSI},
+ 	{FCC4_FCCA, CTL_FCC, CTL_FCC},
+ 	{FCC5_FCCA, CTL_FCC, CTL_FCC},
+ 	{FCC6_FCCA, CTL_FCC, CTL_FCC},
+@@ -179,6 +184,7 @@ static struct reg_dmn_pair_mapping regDomainPairs[] = {
+ 	{ETSI4_WORLD, CTL_ETSI, CTL_ETSI},
+ 	{ETSI5_WORLD, CTL_ETSI, CTL_ETSI},
+ 	{ETSI6_WORLD, CTL_ETSI, CTL_ETSI},
++	{ETSI8_WORLD, CTL_ETSI, CTL_ETSI},
+ 
+ 	/* XXX: For ETSI3_ETSIA, Was NO_CTL meant for the 2 GHz band ? */
+ 	{ETSI3_ETSIA, CTL_ETSI, CTL_ETSI},
+@@ -188,9 +194,11 @@ static struct reg_dmn_pair_mapping regDomainPairs[] = {
+ 	{FCC1_FCCA, CTL_FCC, CTL_FCC},
+ 	{APL1_WORLD, CTL_FCC, CTL_ETSI},
+ 	{APL2_WORLD, CTL_FCC, CTL_ETSI},
++	{APL2_FCCA, CTL_FCC, CTL_FCC},
+ 	{APL3_WORLD, CTL_FCC, CTL_ETSI},
+ 	{APL4_WORLD, CTL_FCC, CTL_ETSI},
+ 	{APL5_WORLD, CTL_FCC, CTL_ETSI},
++	{APL13_WORLD, CTL_ETSI, CTL_ETSI},
+ 	{APL6_WORLD, CTL_ETSI, CTL_ETSI},
+ 	{APL8_WORLD, CTL_ETSI, CTL_ETSI},
+ 	{APL9_WORLD, CTL_ETSI, CTL_ETSI},
+@@ -298,6 +306,7 @@ static struct country_code_to_enum_rd allCountries[] = {
+ 	{CTRY_AUSTRALIA2, FCC6_WORLD, "AU"},
+ 	{CTRY_AUSTRIA, ETSI1_WORLD, "AT"},
+ 	{CTRY_AZERBAIJAN, ETSI4_WORLD, "AZ"},
++	{CTRY_BAHAMAS, FCC3_WORLD, "BS"},
+ 	{CTRY_BAHRAIN, APL6_WORLD, "BH"},
+ 	{CTRY_BANGLADESH, NULL1_WORLD, "BD"},
+ 	{CTRY_BARBADOS, FCC2_WORLD, "BB"},
+@@ -305,6 +314,7 @@ static struct country_code_to_enum_rd allCountries[] = {
+ 	{CTRY_BELGIUM, ETSI1_WORLD, "BE"},
+ 	{CTRY_BELGIUM2, ETSI4_WORLD, "BL"},
+ 	{CTRY_BELIZE, APL1_ETSIC, "BZ"},
++	{CTRY_BERMUDA, FCC3_FCCA, "BM"},
+ 	{CTRY_BOLIVIA, APL1_ETSIC, "BO"},
+ 	{CTRY_BOSNIA_HERZ, ETSI1_WORLD, "BA"},
+ 	{CTRY_BRAZIL, FCC3_WORLD, "BR"},
+@@ -444,6 +454,7 @@ static struct country_code_to_enum_rd allCountries[] = {
+ 	{CTRY_ROMANIA, NULL1_WORLD, "RO"},
+ 	{CTRY_RUSSIA, NULL1_WORLD, "RU"},
+ 	{CTRY_SAUDI_ARABIA, NULL1_WORLD, "SA"},
++	{CTRY_SERBIA, ETSI1_WORLD, "RS"},
+ 	{CTRY_SERBIA_MONTENEGRO, ETSI1_WORLD, "CS"},
+ 	{CTRY_SINGAPORE, APL6_WORLD, "SG"},
+ 	{CTRY_SLOVAKIA, ETSI1_WORLD, "SK"},
+@@ -455,10 +466,12 @@ static struct country_code_to_enum_rd allCountries[] = {
+ 	{CTRY_SWITZERLAND, ETSI1_WORLD, "CH"},
+ 	{CTRY_SYRIA, NULL1_WORLD, "SY"},
+ 	{CTRY_TAIWAN, APL3_FCCA, "TW"},
++	{CTRY_TANZANIA, APL1_WORLD, "TZ"},
+ 	{CTRY_THAILAND, FCC3_WORLD, "TH"},
+ 	{CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"},
+ 	{CTRY_TUNISIA, ETSI3_WORLD, "TN"},
+ 	{CTRY_TURKEY, ETSI3_WORLD, "TR"},
++	{CTRY_UGANDA, FCC3_WORLD, "UG"},
+ 	{CTRY_UKRAINE, NULL1_WORLD, "UA"},
+ 	{CTRY_UAE, NULL1_WORLD, "AE"},
+ 	{CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"},
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+index 746f8c9a891d..e69cf0ef9574 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -1099,6 +1099,7 @@ static const struct sdio_device_id brcmf_sdmmc_ids[] = {
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43340),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362),
++ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43364),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4339),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43430),
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index 6fe5546dc773..996a928142ad 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -898,6 +898,8 @@ int iwl_pcie_rx_init(struct iwl_trans *trans)
+ 						WQ_HIGHPRI | WQ_UNBOUND, 1);
+ 	INIT_WORK(&rba->rx_alloc, iwl_pcie_rx_allocator_work);
+ 
++	cancel_work_sync(&rba->rx_alloc);
++
+ 	spin_lock(&rba->lock);
+ 	atomic_set(&rba->req_pending, 0);
+ 	atomic_set(&rba->req_ready, 0);
+diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
+index 73eb0846db21..09185a1f7379 100644
+--- a/drivers/net/wireless/marvell/mwifiex/usb.c
++++ b/drivers/net/wireless/marvell/mwifiex/usb.c
+@@ -624,6 +624,9 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf)
+ 					 MWIFIEX_FUNC_SHUTDOWN);
+ 	}
+ 
++	if (adapter->workqueue)
++		flush_workqueue(adapter->workqueue);
++
+ 	mwifiex_usb_free(card);
+ 
+ 	mwifiex_dbg(adapter, FATAL,
+diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c
+index 18fbb96a46e9..d75756c68e16 100644
+--- a/drivers/net/wireless/marvell/mwifiex/util.c
++++ b/drivers/net/wireless/marvell/mwifiex/util.c
+@@ -723,12 +723,14 @@ void mwifiex_hist_data_set(struct mwifiex_private *priv, u8 rx_rate, s8 snr,
+ 			   s8 nflr)
+ {
+ 	struct mwifiex_histogram_data *phist_data = priv->hist_data;
++	s8 nf   = -nflr;
++	s8 rssi = snr - nflr;
+ 
+ 	atomic_inc(&phist_data->num_samples);
+ 	atomic_inc(&phist_data->rx_rate[rx_rate]);
+-	atomic_inc(&phist_data->snr[snr]);
+-	atomic_inc(&phist_data->noise_flr[128 + nflr]);
+-	atomic_inc(&phist_data->sig_str[nflr - snr]);
++	atomic_inc(&phist_data->snr[snr + 128]);
++	atomic_inc(&phist_data->noise_flr[nf + 128]);
++	atomic_inc(&phist_data->sig_str[rssi + 128]);
+ }
+ 
+ /* function to reset histogram data during init/reset */
+diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+index 8428858204a6..fc895b466ebb 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+@@ -155,7 +155,6 @@ static void rsi_reset_card(struct sdio_func *pfunction)
+ 	int err;
+ 	struct mmc_card *card = pfunction->card;
+ 	struct mmc_host *host = card->host;
+-	s32 bit = (fls(host->ocr_avail) - 1);
+ 	u8 cmd52_resp;
+ 	u32 clock, resp, i;
+ 	u16 rca;
+@@ -175,7 +174,6 @@ static void rsi_reset_card(struct sdio_func *pfunction)
+ 	msleep(20);
+ 
+ 	/* Initialize the SDIO card */
+-	host->ios.vdd = bit;
+ 	host->ios.chip_select = MMC_CS_DONTCARE;
+ 	host->ios.bus_mode = MMC_BUSMODE_OPENDRAIN;
+ 	host->ios.power_mode = MMC_POWER_UP;
+diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
+index 47fe7f96a242..6921cb0bf563 100644
+--- a/drivers/net/wireless/ti/wlcore/sdio.c
++++ b/drivers/net/wireless/ti/wlcore/sdio.c
+@@ -404,6 +404,11 @@ static int wl1271_suspend(struct device *dev)
+ 	mmc_pm_flag_t sdio_flags;
+ 	int ret = 0;
+ 
++	if (!wl) {
++		dev_err(dev, "no wilink module was probed\n");
++		goto out;
++	}
++
+ 	dev_dbg(dev, "wl1271 suspend. wow_enabled: %d\n",
+ 		wl->wow_enabled);
+ 
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 520050eae836..a5908e4c06cb 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -238,7 +238,7 @@ static void rx_refill_timeout(unsigned long data)
+ static int netfront_tx_slot_available(struct netfront_queue *queue)
+ {
+ 	return (queue->tx.req_prod_pvt - queue->tx.rsp_cons) <
+-		(NET_TX_RING_SIZE - MAX_SKB_FRAGS - 2);
++		(NET_TX_RING_SIZE - XEN_NETIF_NR_SLOTS_MIN - 1);
+ }
+ 
+ static void xennet_maybe_wake_tx(struct netfront_queue *queue)
+@@ -789,7 +789,7 @@ static int xennet_get_responses(struct netfront_queue *queue,
+ 	RING_IDX cons = queue->rx.rsp_cons;
+ 	struct sk_buff *skb = xennet_get_rx_skb(queue, cons);
+ 	grant_ref_t ref = xennet_get_rx_ref(queue, cons);
+-	int max = MAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD);
++	int max = XEN_NETIF_NR_SLOTS_MIN + (rx->status <= RX_COPY_THRESHOLD);
+ 	int slots = 1;
+ 	int err = 0;
+ 	unsigned long ret;
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index 1b4d93e9157e..824e282cd80e 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -1031,6 +1031,8 @@ static inline void *nvmem_cell_prepare_write_buffer(struct nvmem_cell *cell,
+ 
+ 		/* setup the first byte with lsb bits from nvmem */
+ 		rc = nvmem_reg_read(nvmem, cell->offset, &v, 1);
++		if (rc)
++			goto err;
+ 		*b++ |= GENMASK(bit_offset - 1, 0) & v;
+ 
+ 		/* setup rest of the byte if any */
+@@ -1049,11 +1051,16 @@ static inline void *nvmem_cell_prepare_write_buffer(struct nvmem_cell *cell,
+ 		/* setup the last byte with msb bits from nvmem */
+ 		rc = nvmem_reg_read(nvmem,
+ 				    cell->offset + cell->bytes - 1, &v, 1);
++		if (rc)
++			goto err;
+ 		*p |= GENMASK(7, (nbits + bit_offset) % BITS_PER_BYTE) & v;
+ 
+ 	}
+ 
+ 	return buf;
++err:
++	kfree(buf);
++	return ERR_PTR(rc);
+ }
+ 
+ /**
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index f9f4d1c18eb2..e5d8e2e2bd30 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -180,13 +180,16 @@ static ssize_t enable_store(struct device *dev, struct device_attribute *attr,
+ 	if (!capable(CAP_SYS_ADMIN))
+ 		return -EPERM;
+ 
+-	if (!val) {
+-		if (pci_is_enabled(pdev))
+-			pci_disable_device(pdev);
+-		else
+-			result = -EIO;
+-	} else
++	device_lock(dev);
++	if (dev->driver)
++		result = -EBUSY;
++	else if (val)
+ 		result = pci_enable_device(pdev);
++	else if (pci_is_enabled(pdev))
++		pci_disable_device(pdev);
++	else
++		result = -EIO;
++	device_unlock(dev);
+ 
+ 	return result < 0 ? result : count;
+ }
+diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
+index 28bbc1bb9e6c..88ba9c50cc8e 100644
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -573,8 +573,10 @@ static int atmel_pctl_dt_node_to_map(struct pinctrl_dev *pctldev,
+ 		for_each_child_of_node(np_config, np) {
+ 			ret = atmel_pctl_dt_subnode_to_map(pctldev, np, map,
+ 						    &reserved_maps, num_maps);
+-			if (ret < 0)
++			if (ret < 0) {
++				of_node_put(np);
+ 				break;
++			}
+ 		}
+ 	}
+ 
+diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
+index cb18b5c4f2db..86b348740fcd 100644
+--- a/drivers/regulator/pfuze100-regulator.c
++++ b/drivers/regulator/pfuze100-regulator.c
+@@ -153,6 +153,7 @@ static struct regulator_ops pfuze100_sw_regulator_ops = {
+ static struct regulator_ops pfuze100_swb_regulator_ops = {
+ 	.enable = regulator_enable_regmap,
+ 	.disable = regulator_disable_regmap,
++	.is_enabled = regulator_is_enabled_regmap,
+ 	.list_voltage = regulator_list_voltage_table,
+ 	.map_voltage = regulator_map_voltage_ascend,
+ 	.set_voltage_sel = regulator_set_voltage_sel_regmap,
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index 25cf3069e2e7..4131bfb2cc61 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -359,6 +359,11 @@ int rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ {
+ 	int err;
+ 
++	if (!rtc->ops)
++		return -ENODEV;
++	else if (!rtc->ops->set_alarm)
++		return -EINVAL;
++
+ 	err = rtc_valid_tm(&alarm->time);
+ 	if (err != 0)
+ 		return err;
+diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
+index a56a7b243e91..5466246c69b4 100644
+--- a/drivers/scsi/3w-9xxx.c
++++ b/drivers/scsi/3w-9xxx.c
+@@ -889,6 +889,11 @@ static int twa_chrdev_open(struct inode *inode, struct file *file)
+ 	unsigned int minor_number;
+ 	int retval = TW_IOCTL_ERROR_OS_ENODEV;
+ 
++	if (!capable(CAP_SYS_ADMIN)) {
++		retval = -EACCES;
++		goto out;
++	}
++
+ 	minor_number = iminor(inode);
+ 	if (minor_number >= twa_device_extension_count)
+ 		goto out;
+diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
+index 25aba1613e21..24ac19e31003 100644
+--- a/drivers/scsi/3w-xxxx.c
++++ b/drivers/scsi/3w-xxxx.c
+@@ -1034,6 +1034,9 @@ static int tw_chrdev_open(struct inode *inode, struct file *file)
+ 
+ 	dprintk(KERN_WARNING "3w-xxxx: tw_ioctl_open()\n");
+ 
++	if (!capable(CAP_SYS_ADMIN))
++		return -EACCES;
++
+ 	minor_number = iminor(inode);
+ 	if (minor_number >= tw_device_extension_count)
+ 		return -ENODEV;
+diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
+index 9d05302a3bcd..19bffe0b2cc0 100644
+--- a/drivers/scsi/megaraid.c
++++ b/drivers/scsi/megaraid.c
+@@ -4197,6 +4197,9 @@ megaraid_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	int irq, i, j;
+ 	int error = -ENODEV;
+ 
++	if (hba_count >= MAX_CONTROLLERS)
++		goto out;
++
+ 	if (pci_enable_device(pdev))
+ 		goto out;
+ 	pci_set_master(pdev);
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index a156451553a7..f722a0e6caa4 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -2031,6 +2031,9 @@ megasas_build_syspd_fusion(struct megasas_instance *instance,
+ 		pRAID_Context->timeoutValue = cpu_to_le16(os_timeout_value);
+ 		pRAID_Context->VirtualDiskTgtId = cpu_to_le16(device_id);
+ 	} else {
++		if (os_timeout_value)
++			os_timeout_value++;
++
+ 		/* system pd Fast Path */
+ 		io_request->Function = MPI2_FUNCTION_SCSI_IO_REQUEST;
+ 		timeout_limit = (scmd->device->type == TYPE_DISK) ?
+diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c
+index a5e30e9449ef..375cede0c534 100644
+--- a/drivers/scsi/scsi_dh.c
++++ b/drivers/scsi/scsi_dh.c
+@@ -58,7 +58,10 @@ static const struct scsi_dh_blist scsi_dh_blist[] = {
+ 	{"IBM", "3526",			"rdac", },
+ 	{"IBM", "3542",			"rdac", },
+ 	{"IBM", "3552",			"rdac", },
+-	{"SGI", "TP9",			"rdac", },
++	{"SGI", "TP9300",		"rdac", },
++	{"SGI", "TP9400",		"rdac", },
++	{"SGI", "TP9500",		"rdac", },
++	{"SGI", "TP9700",		"rdac", },
+ 	{"SGI", "IS",			"rdac", },
+ 	{"STK", "OPENstorage",		"rdac", },
+ 	{"STK", "FLEXLINE 380",		"rdac", },
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 86a3110c6d75..f857086ce2fa 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -4012,6 +4012,7 @@ static void ufshcd_exception_event_handler(struct work_struct *work)
+ 	hba = container_of(work, struct ufs_hba, eeh_work);
+ 
+ 	pm_runtime_get_sync(hba->dev);
++	scsi_block_requests(hba->host);
+ 	err = ufshcd_get_ee_status(hba, &status);
+ 	if (err) {
+ 		dev_err(hba->dev, "%s: failed to get exception status %d\n",
+@@ -4025,6 +4026,7 @@ static void ufshcd_exception_event_handler(struct work_struct *work)
+ 		ufshcd_bkops_exception_event_handler(hba);
+ 
+ out:
++	scsi_unblock_requests(hba->host);
+ 	pm_runtime_put_sync(hba->dev);
+ 	return;
+ }
+diff --git a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
+index ea9a0c21d29d..4ff293129675 100644
+--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
+@@ -1299,11 +1299,6 @@ kiblnd_connect_peer(struct kib_peer *peer)
+ 		goto failed2;
+ 	}
+ 
+-	LASSERT(cmid->device);
+-	CDEBUG(D_NET, "%s: connection bound to %s:%pI4h:%s\n",
+-	       libcfs_nid2str(peer->ibp_nid), dev->ibd_ifname,
+-	       &dev->ibd_ifip, cmid->device->name);
+-
+ 	return;
+ 
+  failed2:
+@@ -3005,8 +3000,19 @@ kiblnd_cm_callback(struct rdma_cm_id *cmid, struct rdma_cm_event *event)
+ 		} else {
+ 			rc = rdma_resolve_route(
+ 				cmid, *kiblnd_tunables.kib_timeout * 1000);
+-			if (!rc)
++			if (!rc) {
++				struct kib_net *net = peer->ibp_ni->ni_data;
++				struct kib_dev *dev = net->ibn_dev;
++
++				CDEBUG(D_NET, "%s: connection bound to "\
++				       "%s:%pI4h:%s\n",
++				       libcfs_nid2str(peer->ibp_nid),
++				       dev->ibd_ifname,
++				       &dev->ibd_ifip, cmid->device->name);
++
+ 				return 0;
++			}
++
+ 			/* Can't initiate route resolution */
+ 			CERROR("Can't resolve route for %s: %d\n",
+ 			       libcfs_nid2str(peer->ibp_nid), rc);
+diff --git a/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c b/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c
+index d18ab3f28c70..9addcdbe9374 100644
+--- a/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c
++++ b/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c
+@@ -1489,8 +1489,10 @@ struct ldlm_lock *ldlm_lock_create(struct ldlm_namespace *ns,
+ 		return ERR_CAST(res);
+ 
+ 	lock = ldlm_lock_new(res);
+-	if (!lock)
++	if (!lock) {
++		ldlm_resource_putref(res);
+ 		return ERR_PTR(-ENOMEM);
++	}
+ 
+ 	lock->l_req_mode = mode;
+ 	lock->l_ast_data = data;
+@@ -1533,6 +1535,8 @@ out:
+ 	return ERR_PTR(rc);
+ }
+ 
++
++
+ /**
+  * Enqueue (request) a lock.
+  * On the client this is called from ldlm_cli_enqueue_fini
+diff --git a/drivers/staging/lustre/lustre/llite/xattr.c b/drivers/staging/lustre/lustre/llite/xattr.c
+index e070adb7a3cc..57121fd5f050 100644
+--- a/drivers/staging/lustre/lustre/llite/xattr.c
++++ b/drivers/staging/lustre/lustre/llite/xattr.c
+@@ -103,7 +103,11 @@ ll_xattr_set_common(const struct xattr_handler *handler,
+ 	__u64 valid;
+ 	int rc;
+ 
+-	if (flags == XATTR_REPLACE) {
++	/* When setxattr() is called with a size of 0 the value is
++	 * unconditionally replaced by "". When removexattr() is
++	 * called we get a NULL value and XATTR_REPLACE for flags.
++	 */
++	if (!value && flags == XATTR_REPLACE) {
+ 		ll_stats_ops_tally(ll_i2sbi(inode), LPROC_LL_REMOVEXATTR, 1);
+ 		valid = OBD_MD_FLXATTRRM;
+ 	} else {
+diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
+index a45810b43f70..c974cb5fb958 100644
+--- a/drivers/thermal/samsung/exynos_tmu.c
++++ b/drivers/thermal/samsung/exynos_tmu.c
+@@ -598,6 +598,7 @@ static int exynos5433_tmu_initialize(struct platform_device *pdev)
+ 		threshold_code = temp_to_code(data, temp);
+ 
+ 		rising_threshold = readl(data->base + rising_reg_offset);
++		rising_threshold &= ~(0xff << j * 8);
+ 		rising_threshold |= (threshold_code << j * 8);
+ 		writel(rising_threshold, data->base + rising_reg_offset);
+ 
+diff --git a/drivers/tty/hvc/hvc_opal.c b/drivers/tty/hvc/hvc_opal.c
+index 510799311099..1fc5d5b82778 100644
+--- a/drivers/tty/hvc/hvc_opal.c
++++ b/drivers/tty/hvc/hvc_opal.c
+@@ -332,7 +332,6 @@ static void udbg_init_opal_common(void)
+ 	udbg_putc = udbg_opal_putc;
+ 	udbg_getc = udbg_opal_getc;
+ 	udbg_getc_poll = udbg_opal_getc_poll;
+-	tb_ticks_per_usec = 0x200; /* Make udelay not suck */
+ }
+ 
+ void __init hvc_opal_init_early(void)
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index 2b907385b4a8..171130a9ecc8 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -106,16 +106,19 @@ static void pty_unthrottle(struct tty_struct *tty)
+ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
+ {
+ 	struct tty_struct *to = tty->link;
++	unsigned long flags;
+ 
+ 	if (tty->stopped)
+ 		return 0;
+ 
+ 	if (c > 0) {
++		spin_lock_irqsave(&to->port->lock, flags);
+ 		/* Stuff the data into the input queue of the other end */
+ 		c = tty_insert_flip_string(to->port, buf, c);
+ 		/* And shovel */
+ 		if (c)
+ 			tty_flip_buffer_push(to->port);
++		spin_unlock_irqrestore(&to->port->lock, flags);
+ 	}
+ 	return c;
+ }
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index bdb19db542a4..7aee55244b4a 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3363,6 +3363,10 @@ static int wait_for_connected(struct usb_device *udev,
+ 	while (delay_ms < 2000) {
+ 		if (status || *portstatus & USB_PORT_STAT_CONNECTION)
+ 			break;
++		if (!port_is_power_on(hub, *portstatus)) {
++			status = -ENODEV;
++			break;
++		}
+ 		msleep(20);
+ 		delay_ms += 20;
+ 		status = hub_port_status(hub, *port1, portstatus, portchange);
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 0a0cf154814b..984d6aae7529 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -2544,34 +2544,29 @@ static void dwc2_hc_init_xfer(struct dwc2_hsotg *hsotg,
+ 
+ #define DWC2_USB_DMA_ALIGN 4
+ 
+-struct dma_aligned_buffer {
+-	void *kmalloc_ptr;
+-	void *old_xfer_buffer;
+-	u8 data[0];
+-};
+-
+ static void dwc2_free_dma_aligned_buffer(struct urb *urb)
+ {
+-	struct dma_aligned_buffer *temp;
++	void *stored_xfer_buffer;
+ 
+ 	if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER))
+ 		return;
+ 
+-	temp = container_of(urb->transfer_buffer,
+-		struct dma_aligned_buffer, data);
++	/* Restore urb->transfer_buffer from the end of the allocated area */
++	memcpy(&stored_xfer_buffer, urb->transfer_buffer +
++	       urb->transfer_buffer_length, sizeof(urb->transfer_buffer));
+ 
+ 	if (usb_urb_dir_in(urb))
+-		memcpy(temp->old_xfer_buffer, temp->data,
++		memcpy(stored_xfer_buffer, urb->transfer_buffer,
+ 		       urb->transfer_buffer_length);
+-	urb->transfer_buffer = temp->old_xfer_buffer;
+-	kfree(temp->kmalloc_ptr);
++	kfree(urb->transfer_buffer);
++	urb->transfer_buffer = stored_xfer_buffer;
+ 
+ 	urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
+ }
+ 
+ static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
+ {
+-	struct dma_aligned_buffer *temp, *kmalloc_ptr;
++	void *kmalloc_ptr;
+ 	size_t kmalloc_size;
+ 
+ 	if (urb->num_sgs || urb->sg ||
+@@ -2579,22 +2574,29 @@ static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
+ 	    !((uintptr_t)urb->transfer_buffer & (DWC2_USB_DMA_ALIGN - 1)))
+ 		return 0;
+ 
+-	/* Allocate a buffer with enough padding for alignment */
++	/*
++	 * Allocate a buffer with enough padding for original transfer_buffer
++	 * pointer. This allocation is guaranteed to be aligned properly for
++	 * DMA
++	 */
+ 	kmalloc_size = urb->transfer_buffer_length +
+-		sizeof(struct dma_aligned_buffer) + DWC2_USB_DMA_ALIGN - 1;
++		sizeof(urb->transfer_buffer);
+ 
+ 	kmalloc_ptr = kmalloc(kmalloc_size, mem_flags);
+ 	if (!kmalloc_ptr)
+ 		return -ENOMEM;
+ 
+-	/* Position our struct dma_aligned_buffer such that data is aligned */
+-	temp = PTR_ALIGN(kmalloc_ptr + 1, DWC2_USB_DMA_ALIGN) - 1;
+-	temp->kmalloc_ptr = kmalloc_ptr;
+-	temp->old_xfer_buffer = urb->transfer_buffer;
++	/*
++	 * Position value of original urb->transfer_buffer pointer to the end
++	 * of allocation for later referencing
++	 */
++	memcpy(kmalloc_ptr + urb->transfer_buffer_length,
++	       &urb->transfer_buffer, sizeof(urb->transfer_buffer));
++
+ 	if (usb_urb_dir_out(urb))
+-		memcpy(temp->data, urb->transfer_buffer,
++		memcpy(kmalloc_ptr, urb->transfer_buffer,
+ 		       urb->transfer_buffer_length);
+-	urb->transfer_buffer = temp->data;
++	urb->transfer_buffer = kmalloc_ptr;
+ 
+ 	urb->transfer_flags |= URB_ALIGNED_TEMP_BUFFER;
+ 
+diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c
+index d78142830754..d143d08c4f0f 100644
+--- a/drivers/vfio/platform/vfio_platform_common.c
++++ b/drivers/vfio/platform/vfio_platform_common.c
+@@ -696,18 +696,23 @@ int vfio_platform_probe_common(struct vfio_platform_device *vdev,
+ 	group = vfio_iommu_group_get(dev);
+ 	if (!group) {
+ 		pr_err("VFIO: No IOMMU group for device %s\n", vdev->name);
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto put_reset;
+ 	}
+ 
+ 	ret = vfio_add_group_dev(dev, &vfio_platform_ops, vdev);
+-	if (ret) {
+-		vfio_iommu_group_put(group, dev);
+-		return ret;
+-	}
++	if (ret)
++		goto put_iommu;
+ 
+ 	mutex_init(&vdev->igate);
+ 
+ 	return 0;
++
++put_iommu:
++	vfio_iommu_group_put(group, dev);
++put_reset:
++	vfio_platform_put_reset(vdev);
++	return ret;
+ }
+ EXPORT_SYMBOL_GPL(vfio_platform_probe_common);
+ 
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index dfd99867ff4d..9afad8c14220 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2236,6 +2236,21 @@ void assert_qgroups_uptodate(struct btrfs_trans_handle *trans)
+ 	BUG();
+ }
+ 
++/*
++ * Check if the leaf is the last leaf. Which means all node pointers
++ * are at their last position.
++ */
++static bool is_last_leaf(struct btrfs_path *path)
++{
++	int i;
++
++	for (i = 1; i < BTRFS_MAX_LEVEL && path->nodes[i]; i++) {
++		if (path->slots[i] != btrfs_header_nritems(path->nodes[i]) - 1)
++			return false;
++	}
++	return true;
++}
++
+ /*
+  * returns < 0 on error, 0 when more leafs are to be scanned.
+  * returns 1 when done.
+@@ -2249,6 +2264,7 @@ qgroup_rescan_leaf(struct btrfs_fs_info *fs_info, struct btrfs_path *path,
+ 	struct ulist *roots = NULL;
+ 	struct seq_list tree_mod_seq_elem = SEQ_LIST_INIT(tree_mod_seq_elem);
+ 	u64 num_bytes;
++	bool done;
+ 	int slot;
+ 	int ret;
+ 
+@@ -2277,6 +2293,7 @@ qgroup_rescan_leaf(struct btrfs_fs_info *fs_info, struct btrfs_path *path,
+ 		mutex_unlock(&fs_info->qgroup_rescan_lock);
+ 		return ret;
+ 	}
++	done = is_last_leaf(path);
+ 
+ 	btrfs_item_key_to_cpu(path->nodes[0], &found,
+ 			      btrfs_header_nritems(path->nodes[0]) - 1);
+@@ -2323,6 +2340,8 @@ out:
+ 	}
+ 	btrfs_put_tree_mod_seq(fs_info, &tree_mod_seq_elem);
+ 
++	if (done && !ret)
++		ret = 1;
+ 	return ret;
+ }
+ 
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 44d34923de9c..44966fd00790 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -2979,8 +2979,11 @@ out_wake_log_root:
+ 	mutex_unlock(&log_root_tree->log_mutex);
+ 
+ 	/*
+-	 * The barrier before waitqueue_active is implied by mutex_unlock
++	 * The barrier before waitqueue_active is needed so all the updates
++	 * above are seen by the woken threads. It might not be necessary, but
++	 * proving that seems to be hard.
+ 	 */
++	smp_mb();
+ 	if (waitqueue_active(&log_root_tree->log_commit_wait[index2]))
+ 		wake_up(&log_root_tree->log_commit_wait[index2]);
+ out:
+@@ -2991,8 +2994,11 @@ out:
+ 	mutex_unlock(&root->log_mutex);
+ 
+ 	/*
+-	 * The barrier before waitqueue_active is implied by mutex_unlock
++	 * The barrier before waitqueue_active is needed so all the updates
++	 * above are seen by the woken threads. It might not be necessary, but
++	 * proving that seems to be hard.
+ 	 */
++	smp_mb();
+ 	if (waitqueue_active(&root->log_commit_wait[index1]))
+ 		wake_up(&root->log_commit_wait[index1]);
+ 	return ret;
+diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c
+index 73de1446c8d4..1a8962569b5c 100644
+--- a/fs/crypto/crypto.c
++++ b/fs/crypto/crypto.c
+@@ -517,8 +517,17 @@ EXPORT_SYMBOL(fscrypt_initialize);
+  */
+ static int __init fscrypt_init(void)
+ {
++	/*
++	 * Use an unbound workqueue to allow bios to be decrypted in parallel
++	 * even when they happen to complete on the same CPU.  This sacrifices
++	 * locality, but it's worthwhile since decryption is CPU-intensive.
++	 *
++	 * Also use a high-priority workqueue to prioritize decryption work,
++	 * which blocks reads from completing, over regular application tasks.
++	 */
+ 	fscrypt_read_workqueue = alloc_workqueue("fscrypt_read_queue",
+-							WQ_HIGHPRI, 0);
++						 WQ_UNBOUND | WQ_HIGHPRI,
++						 num_online_cpus());
+ 	if (!fscrypt_read_workqueue)
+ 		goto fail;
+ 
+diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
+index ad13f07cf0d3..2455fe1446d6 100644
+--- a/fs/ext4/balloc.c
++++ b/fs/ext4/balloc.c
+@@ -378,6 +378,8 @@ static int ext4_validate_block_bitmap(struct super_block *sb,
+ 		return -EFSCORRUPTED;
+ 
+ 	ext4_lock_group(sb, block_group);
++	if (buffer_verified(bh))
++		goto verified;
+ 	if (unlikely(!ext4_block_bitmap_csum_verify(sb, block_group,
+ 			desc, bh))) {
+ 		ext4_unlock_group(sb, block_group);
+@@ -400,6 +402,7 @@ static int ext4_validate_block_bitmap(struct super_block *sb,
+ 		return -EFSCORRUPTED;
+ 	}
+ 	set_buffer_verified(bh);
++verified:
+ 	ext4_unlock_group(sb, block_group);
+ 	return 0;
+ }
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 460866b2166d..ffaf66a51de3 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -88,6 +88,8 @@ static int ext4_validate_inode_bitmap(struct super_block *sb,
+ 		return -EFSCORRUPTED;
+ 
+ 	ext4_lock_group(sb, block_group);
++	if (buffer_verified(bh))
++		goto verified;
+ 	blk = ext4_inode_bitmap(sb, desc);
+ 	if (!ext4_inode_bitmap_csum_verify(sb, block_group, desc, bh,
+ 					   EXT4_INODES_PER_GROUP(sb) / 8)) {
+@@ -105,6 +107,7 @@ static int ext4_validate_inode_bitmap(struct super_block *sb,
+ 		return -EFSBADCRC;
+ 	}
+ 	set_buffer_verified(bh);
++verified:
+ 	ext4_unlock_group(sb, block_group);
+ 	return 0;
+ }
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index e6ac24de119d..436baf7cdca3 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -679,6 +679,10 @@ int ext4_try_to_write_inline_data(struct address_space *mapping,
+ 		goto convert;
+ 	}
+ 
++	ret = ext4_journal_get_write_access(handle, iloc.bh);
++	if (ret)
++		goto out;
++
+ 	flags |= AOP_FLAG_NOFS;
+ 
+ 	page = grab_cache_page_write_begin(mapping, 0, flags);
+@@ -707,7 +711,7 @@ int ext4_try_to_write_inline_data(struct address_space *mapping,
+ out_up_read:
+ 	up_read(&EXT4_I(inode)->xattr_sem);
+ out:
+-	if (handle)
++	if (handle && (ret != 1))
+ 		ext4_journal_stop(handle);
+ 	brelse(iloc.bh);
+ 	return ret;
+@@ -749,6 +753,7 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
+ 
+ 	ext4_write_unlock_xattr(inode, &no_expand);
+ 	brelse(iloc.bh);
++	mark_inode_dirty(inode);
+ out:
+ 	return copied;
+ }
+@@ -895,7 +900,6 @@ retry_journal:
+ 		goto out;
+ 	}
+ 
+-
+ 	page = grab_cache_page_write_begin(mapping, 0, flags);
+ 	if (!page) {
+ 		ret = -ENOMEM;
+@@ -913,6 +917,9 @@ retry_journal:
+ 		if (ret < 0)
+ 			goto out_release_page;
+ 	}
++	ret = ext4_journal_get_write_access(handle, iloc.bh);
++	if (ret)
++		goto out_release_page;
+ 
+ 	up_read(&EXT4_I(inode)->xattr_sem);
+ 	*pagep = page;
+@@ -933,7 +940,6 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos,
+ 				  unsigned len, unsigned copied,
+ 				  struct page *page)
+ {
+-	int i_size_changed = 0;
+ 	int ret;
+ 
+ 	ret = ext4_write_inline_data_end(inode, pos, len, copied, page);
+@@ -951,10 +957,8 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos,
+ 	 * But it's important to update i_size while still holding page lock:
+ 	 * page writeout could otherwise come in and zero beyond i_size.
+ 	 */
+-	if (pos+copied > inode->i_size) {
++	if (pos+copied > inode->i_size)
+ 		i_size_write(inode, pos+copied);
+-		i_size_changed = 1;
+-	}
+ 	unlock_page(page);
+ 	put_page(page);
+ 
+@@ -964,8 +968,7 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos,
+ 	 * ordering of page lock and transaction start for journaling
+ 	 * filesystems.
+ 	 */
+-	if (i_size_changed)
+-		mark_inode_dirty(inode);
++	mark_inode_dirty(inode);
+ 
+ 	return copied;
+ }
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 5c4c9af4aaf4..f62eca8cbde0 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1318,9 +1318,10 @@ static int ext4_write_end(struct file *file,
+ 	loff_t old_size = inode->i_size;
+ 	int ret = 0, ret2;
+ 	int i_size_changed = 0;
++	int inline_data = ext4_has_inline_data(inode);
+ 
+ 	trace_ext4_write_end(inode, pos, len, copied);
+-	if (ext4_has_inline_data(inode)) {
++	if (inline_data) {
+ 		ret = ext4_write_inline_data_end(inode, pos, len,
+ 						 copied, page);
+ 		if (ret < 0) {
+@@ -1348,7 +1349,7 @@ static int ext4_write_end(struct file *file,
+ 	 * ordering of page lock and transaction start for journaling
+ 	 * filesystems.
+ 	 */
+-	if (i_size_changed)
++	if (i_size_changed || inline_data)
+ 		ext4_mark_inode_dirty(handle, inode);
+ 
+ 	if (pos + len > inode->i_size && ext4_can_truncate(inode))
+@@ -1422,6 +1423,7 @@ static int ext4_journalled_write_end(struct file *file,
+ 	int partial = 0;
+ 	unsigned from, to;
+ 	int size_changed = 0;
++	int inline_data = ext4_has_inline_data(inode);
+ 
+ 	trace_ext4_journalled_write_end(inode, pos, len, copied);
+ 	from = pos & (PAGE_SIZE - 1);
+@@ -1429,7 +1431,7 @@ static int ext4_journalled_write_end(struct file *file,
+ 
+ 	BUG_ON(!ext4_handle_valid(handle));
+ 
+-	if (ext4_has_inline_data(inode)) {
++	if (inline_data) {
+ 		ret = ext4_write_inline_data_end(inode, pos, len,
+ 						 copied, page);
+ 		if (ret < 0) {
+@@ -1460,7 +1462,7 @@ static int ext4_journalled_write_end(struct file *file,
+ 	if (old_size < pos)
+ 		pagecache_isize_extended(inode, old_size, pos);
+ 
+-	if (size_changed) {
++	if (size_changed || inline_data) {
+ 		ret2 = ext4_mark_inode_dirty(handle, inode);
+ 		if (!ret)
+ 			ret = ret2;
+@@ -1958,11 +1960,7 @@ static int __ext4_journalled_writepage(struct page *page,
+ 	}
+ 
+ 	if (inline_data) {
+-		BUFFER_TRACE(inode_bh, "get write access");
+-		ret = ext4_journal_get_write_access(handle, inode_bh);
+-
+-		err = ext4_handle_dirty_metadata(handle, inode, inode_bh);
+-
++		ret = ext4_mark_inode_dirty(handle, inode);
+ 	} else {
+ 		ret = ext4_walk_page_buffers(handle, page_bufs, 0, len, NULL,
+ 					     do_journal_get_write_access);
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 801111e1f8ef..7d0e8d6bf009 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1512,6 +1512,8 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)
+ 
+ 	inode_lock(inode);
+ 
++	down_write(&F2FS_I(inode)->dio_rwsem[WRITE]);
++
+ 	if (f2fs_is_atomic_file(inode))
+ 		goto out;
+ 
+@@ -1532,6 +1534,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)
+ 	if (ret)
+ 		clear_inode_flag(inode, FI_ATOMIC_FILE);
+ out:
++	up_write(&F2FS_I(inode)->dio_rwsem[WRITE]);
+ 	inode_unlock(inode);
+ 	mnt_drop_write_file(filp);
+ 	return ret;
+@@ -1670,9 +1673,11 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg)
+ 	if (get_user(in, (__u32 __user *)arg))
+ 		return -EFAULT;
+ 
+-	ret = mnt_want_write_file(filp);
+-	if (ret)
+-		return ret;
++	if (in != F2FS_GOING_DOWN_FULLSYNC) {
++		ret = mnt_want_write_file(filp);
++		if (ret)
++			return ret;
++	}
+ 
+ 	switch (in) {
+ 	case F2FS_GOING_DOWN_FULLSYNC:
+@@ -1700,7 +1705,8 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg)
+ 	}
+ 	f2fs_update_time(sbi, REQ_TIME);
+ out:
+-	mnt_drop_write_file(filp);
++	if (in != F2FS_GOING_DOWN_FULLSYNC)
++		mnt_drop_write_file(filp);
+ 	return ret;
+ }
+ 
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 17ab23f64bba..ad4dfd29d923 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -688,9 +688,14 @@ retry:
+ 		set_cold_data(page);
+ 
+ 		err = do_write_data_page(&fio);
+-		if (err == -ENOMEM && is_dirty) {
+-			congestion_wait(BLK_RW_ASYNC, HZ/50);
+-			goto retry;
++		if (err) {
++			clear_cold_data(page);
++			if (err == -ENOMEM) {
++				congestion_wait(BLK_RW_ASYNC, HZ/50);
++				goto retry;
++			}
++			if (is_dirty)
++				set_page_dirty(page);
+ 		}
+ 
+ 		clear_cold_data(page);
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index e10f61684ea4..35d48ef0573c 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -207,6 +207,8 @@ static int __revoke_inmem_pages(struct inode *inode,
+ 
+ 		lock_page(page);
+ 
++		f2fs_wait_on_page_writeback(page, DATA, true);
++
+ 		if (recover) {
+ 			struct dnode_of_data dn;
+ 			struct node_info ni;
+@@ -369,6 +371,9 @@ void f2fs_balance_fs(struct f2fs_sb_info *sbi, bool need)
+ 
+ void f2fs_balance_fs_bg(struct f2fs_sb_info *sbi)
+ {
++	if (unlikely(is_sbi_flag_set(sbi, SBI_POR_DOING)))
++		return;
++
+ 	/* try to shrink extent cache when there is no enough memory */
+ 	if (!available_free_memory(sbi, EXTENT_CACHE))
+ 		f2fs_shrink_extent_tree(sbi, EXTENT_CACHE_SHRINK_NUMBER);
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index eb20b8767f3c..e627671f0183 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1980,6 +1980,12 @@ static int __init init_f2fs_fs(void)
+ {
+ 	int err;
+ 
++	if (PAGE_SIZE != F2FS_BLKSIZE) {
++		printk("F2FS not supported on PAGE_SIZE(%lu) != %d\n",
++				PAGE_SIZE, F2FS_BLKSIZE);
++		return -EINVAL;
++	}
++
+ 	f2fs_build_trace_ios();
+ 
+ 	err = init_inodecache();
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 91e017ca7072..cf5fdc25289a 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2701,7 +2701,7 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata,
+ 	if (ret != 0)
+ 		goto out;
+ 
+-	state = nfs4_opendata_to_nfs4_state(opendata);
++	state = _nfs4_opendata_to_nfs4_state(opendata);
+ 	ret = PTR_ERR(state);
+ 	if (IS_ERR(state))
+ 		goto out;
+@@ -2737,6 +2737,7 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata,
+ 			nfs4_schedule_stateid_recovery(server, state);
+ 	}
+ out:
++	nfs4_sequence_free_slot(&opendata->o_res.seq_res);
+ 	return ret;
+ }
+ 
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index bdbd9e6d1ace..b16a6c036352 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -1536,6 +1536,8 @@ nfsd4_decode_getdeviceinfo(struct nfsd4_compoundargs *argp,
+ 	gdev->gd_maxcount = be32_to_cpup(p++);
+ 	num = be32_to_cpup(p++);
+ 	if (num) {
++		if (num > 1000)
++			goto xdr_error;
+ 		READ_BUF(4 * num);
+ 		gdev->gd_notify_types = be32_to_cpup(p++);
+ 		for (i = 1; i < num; i++) {
+diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c
+index 23813c078cc9..0839efa720b3 100644
+--- a/fs/squashfs/cache.c
++++ b/fs/squashfs/cache.c
+@@ -350,6 +350,9 @@ int squashfs_read_metadata(struct super_block *sb, void *buffer,
+ 
+ 	TRACE("Entered squashfs_read_metadata [%llx:%x]\n", *block, *offset);
+ 
++	if (unlikely(length < 0))
++		return -EIO;
++
+ 	while (length) {
+ 		entry = squashfs_cache_get(sb, msblk->block_cache, *block, 0);
+ 		if (entry->error) {
+diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
+index 13d80947bf9e..fcff2e0487fe 100644
+--- a/fs/squashfs/file.c
++++ b/fs/squashfs/file.c
+@@ -194,7 +194,11 @@ static long long read_indexes(struct super_block *sb, int n,
+ 		}
+ 
+ 		for (i = 0; i < blocks; i++) {
+-			int size = le32_to_cpu(blist[i]);
++			int size = squashfs_block_size(blist[i]);
++			if (size < 0) {
++				err = size;
++				goto failure;
++			}
+ 			block += SQUASHFS_COMPRESSED_SIZE_BLOCK(size);
+ 		}
+ 		n -= blocks;
+@@ -367,7 +371,7 @@ static int read_blocklist(struct inode *inode, int index, u64 *block)
+ 			sizeof(size));
+ 	if (res < 0)
+ 		return res;
+-	return le32_to_cpu(size);
++	return squashfs_block_size(size);
+ }
+ 
+ /* Copy data into page cache  */
+diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c
+index 0ed6edbc5c71..86ad9a4b8c36 100644
+--- a/fs/squashfs/fragment.c
++++ b/fs/squashfs/fragment.c
+@@ -61,9 +61,7 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment,
+ 		return size;
+ 
+ 	*fragment_block = le64_to_cpu(fragment_entry.start_block);
+-	size = le32_to_cpu(fragment_entry.size);
+-
+-	return size;
++	return squashfs_block_size(fragment_entry.size);
+ }
+ 
+ 
+diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h
+index 506f4ba5b983..e66486366f02 100644
+--- a/fs/squashfs/squashfs_fs.h
++++ b/fs/squashfs/squashfs_fs.h
+@@ -129,6 +129,12 @@
+ 
+ #define SQUASHFS_COMPRESSED_BLOCK(B)	(!((B) & SQUASHFS_COMPRESSED_BIT_BLOCK))
+ 
++static inline int squashfs_block_size(__le32 raw)
++{
++	u32 size = le32_to_cpu(raw);
++	return (size >> 25) ? -EIO : size;
++}
++
+ /*
+  * Inode number ops.  Inodes consist of a compressed block number, and an
+  * uncompressed offset within that block
+diff --git a/include/drm/drm_dp_helper.h b/include/drm/drm_dp_helper.h
+index 2a79882cb68e..2fff10de317d 100644
+--- a/include/drm/drm_dp_helper.h
++++ b/include/drm/drm_dp_helper.h
+@@ -345,6 +345,7 @@
+ # define DP_PSR_FRAME_CAPTURE		    (1 << 3)
+ # define DP_PSR_SELECTIVE_UPDATE	    (1 << 4)
+ # define DP_PSR_IRQ_HPD_WITH_CRC_ERRORS     (1 << 5)
++# define DP_PSR_ENABLE_PSR2		    (1 << 6) /* eDP 1.4a */
+ 
+ #define DP_ADAPTER_CTRL			    0x1a0
+ # define DP_ADAPTER_CTRL_FORCE_LOAD_SENSE   (1 << 0)
+diff --git a/include/linux/dma-iommu.h b/include/linux/dma-iommu.h
+index 32c589062bd9..f30d23011060 100644
+--- a/include/linux/dma-iommu.h
++++ b/include/linux/dma-iommu.h
+@@ -17,6 +17,7 @@
+ #define __DMA_IOMMU_H
+ 
+ #ifdef __KERNEL__
++#include <linux/types.h>
+ #include <asm/errno.h>
+ 
+ #ifdef CONFIG_IOMMU_DMA
+diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
+index d43ef96bf075..3e4d4f4bccd3 100644
+--- a/include/linux/mmc/sdio_ids.h
++++ b/include/linux/mmc/sdio_ids.h
+@@ -34,6 +34,7 @@
+ #define SDIO_DEVICE_ID_BROADCOM_4335_4339	0x4335
+ #define SDIO_DEVICE_ID_BROADCOM_4339		0x4339
+ #define SDIO_DEVICE_ID_BROADCOM_43362		0xa962
++#define SDIO_DEVICE_ID_BROADCOM_43364		0xa9a4
+ #define SDIO_DEVICE_ID_BROADCOM_43430		0xa9a6
+ #define SDIO_DEVICE_ID_BROADCOM_4345		0x4345
+ #define SDIO_DEVICE_ID_BROADCOM_4354		0x4354
+diff --git a/include/linux/netfilter/ipset/ip_set_timeout.h b/include/linux/netfilter/ipset/ip_set_timeout.h
+index 1d6a935c1ac5..8793f5a7b820 100644
+--- a/include/linux/netfilter/ipset/ip_set_timeout.h
++++ b/include/linux/netfilter/ipset/ip_set_timeout.h
+@@ -65,8 +65,14 @@ ip_set_timeout_set(unsigned long *timeout, u32 value)
+ static inline u32
+ ip_set_timeout_get(unsigned long *timeout)
+ {
+-	return *timeout == IPSET_ELEM_PERMANENT ? 0 :
+-		jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC;
++	u32 t;
++
++	if (*timeout == IPSET_ELEM_PERMANENT)
++		return 0;
++
++	t = jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC;
++	/* Zero value in userspace means no timeout */
++	return t == 0 ? 1 : t;
+ }
+ 
+ #endif	/* __KERNEL__ */
+diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
+index 7b16c5322673..eb4f6456521e 100644
+--- a/include/linux/serial_core.h
++++ b/include/linux/serial_core.h
+@@ -344,7 +344,8 @@ struct earlycon_device {
+ };
+ 
+ struct earlycon_id {
+-	char	name[16];
++	char	name[15];
++	char	name_term;	/* In case compiler didn't '\0' term name */
+ 	char	compatible[128];
+ 	int	(*setup)(struct earlycon_device *, const char *options);
+ };
+diff --git a/include/soc/tegra/mc.h b/include/soc/tegra/mc.h
+index 44202ff897fd..f759e0918037 100644
+--- a/include/soc/tegra/mc.h
++++ b/include/soc/tegra/mc.h
+@@ -99,6 +99,8 @@ struct tegra_mc_soc {
+ 	u8 client_id_mask;
+ 
+ 	const struct tegra_smmu_soc *smmu;
++
++	u32 intmask;
+ };
+ 
+ struct tegra_mc {
+diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
+index 85d9cac497e4..cd4f41397c7e 100644
+--- a/kernel/auditfilter.c
++++ b/kernel/auditfilter.c
+@@ -406,7 +406,7 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
+ 			return -EINVAL;
+ 		break;
+ 	case AUDIT_EXE:
+-		if (f->op != Audit_equal)
++		if (f->op != Audit_not_equal && f->op != Audit_equal)
+ 			return -EINVAL;
+ 		if (entry->rule.listnr != AUDIT_FILTER_EXIT)
+ 			return -EINVAL;
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index 2cd5256dbff7..c2aaf539728f 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -469,6 +469,8 @@ static int audit_filter_rules(struct task_struct *tsk,
+ 			break;
+ 		case AUDIT_EXE:
+ 			result = audit_exe_compare(tsk, rule->exe);
++			if (f->op == Audit_not_equal)
++				result = !result;
+ 			break;
+ 		case AUDIT_UID:
+ 			result = audit_uid_comparator(cred->uid, f->op, f->uid);
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 076e4a0ff95e..dafa2708ce9e 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -3225,7 +3225,7 @@ static int replace_map_fd_with_map_ptr(struct bpf_verifier_env *env)
+ 			/* hold the map. If the program is rejected by verifier,
+ 			 * the map will be released by release_maps() or it
+ 			 * will be used by the valid program until it's unloaded
+-			 * and all maps are released in free_bpf_prog_info()
++			 * and all maps are released in free_used_maps()
+ 			 */
+ 			map = bpf_map_inc(map, false);
+ 			if (IS_ERR(map)) {
+@@ -3629,7 +3629,7 @@ free_log_buf:
+ 		vfree(log_buf);
+ 	if (!env->prog->aux->used_maps)
+ 		/* if we didn't copy map pointers into bpf_prog_info, release
+-		 * them now. Otherwise free_bpf_prog_info() will release them.
++		 * them now. Otherwise free_used_maps() will release them.
+ 		 */
+ 		release_maps(env);
+ 	*prog = env->prog;
+diff --git a/kernel/kcov.c b/kernel/kcov.c
+index 3883df58aa12..b0ec31493fdc 100644
+--- a/kernel/kcov.c
++++ b/kernel/kcov.c
+@@ -103,7 +103,8 @@ static void kcov_put(struct kcov *kcov)
+ 
+ void kcov_task_init(struct task_struct *t)
+ {
+-	t->kcov_mode = KCOV_MODE_DISABLED;
++	WRITE_ONCE(t->kcov_mode, KCOV_MODE_DISABLED);
++	barrier();
+ 	t->kcov_size = 0;
+ 	t->kcov_area = NULL;
+ 	t->kcov = NULL;
+diff --git a/kernel/kthread.c b/kernel/kthread.c
+index c2c911a106cf..fbc230e41969 100644
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -290,8 +290,14 @@ static struct task_struct *__kthread_create_on_node(int (*threadfn)(void *data),
+ 	task = create->result;
+ 	if (!IS_ERR(task)) {
+ 		static const struct sched_param param = { .sched_priority = 0 };
++		char name[TASK_COMM_LEN];
+ 
+-		vsnprintf(task->comm, sizeof(task->comm), namefmt, args);
++		/*
++		 * task is already visible to other tasks, so updating
++		 * COMM must be protected.
++		 */
++		vsnprintf(name, sizeof(name), namefmt, args);
++		set_task_comm(task, name);
+ 		/*
+ 		 * root may have changed our (kthreadd's) priority or CPU mask.
+ 		 * The kernel thread should not inherit these properties.
+diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
+index ec9ab2f01489..9b8cd7ebf27b 100644
+--- a/kernel/stop_machine.c
++++ b/kernel/stop_machine.c
+@@ -36,7 +36,7 @@ struct cpu_stop_done {
+ struct cpu_stopper {
+ 	struct task_struct	*thread;
+ 
+-	spinlock_t		lock;
++	raw_spinlock_t		lock;
+ 	bool			enabled;	/* is this stopper enabled? */
+ 	struct list_head	works;		/* list of pending works */
+ 
+@@ -78,13 +78,13 @@ static bool cpu_stop_queue_work(unsigned int cpu, struct cpu_stop_work *work)
+ 	unsigned long flags;
+ 	bool enabled;
+ 
+-	spin_lock_irqsave(&stopper->lock, flags);
++	raw_spin_lock_irqsave(&stopper->lock, flags);
+ 	enabled = stopper->enabled;
+ 	if (enabled)
+ 		__cpu_stop_queue_work(stopper, work);
+ 	else if (work->done)
+ 		cpu_stop_signal_done(work->done);
+-	spin_unlock_irqrestore(&stopper->lock, flags);
++	raw_spin_unlock_irqrestore(&stopper->lock, flags);
+ 
+ 	return enabled;
+ }
+@@ -231,8 +231,8 @@ static int cpu_stop_queue_two_works(int cpu1, struct cpu_stop_work *work1,
+ 	struct cpu_stopper *stopper2 = per_cpu_ptr(&cpu_stopper, cpu2);
+ 	int err;
+ retry:
+-	spin_lock_irq(&stopper1->lock);
+-	spin_lock_nested(&stopper2->lock, SINGLE_DEPTH_NESTING);
++	raw_spin_lock_irq(&stopper1->lock);
++	raw_spin_lock_nested(&stopper2->lock, SINGLE_DEPTH_NESTING);
+ 
+ 	err = -ENOENT;
+ 	if (!stopper1->enabled || !stopper2->enabled)
+@@ -255,8 +255,8 @@ retry:
+ 	__cpu_stop_queue_work(stopper1, work1);
+ 	__cpu_stop_queue_work(stopper2, work2);
+ unlock:
+-	spin_unlock(&stopper2->lock);
+-	spin_unlock_irq(&stopper1->lock);
++	raw_spin_unlock(&stopper2->lock);
++	raw_spin_unlock_irq(&stopper1->lock);
+ 
+ 	if (unlikely(err == -EDEADLK)) {
+ 		while (stop_cpus_in_progress)
+@@ -448,9 +448,9 @@ static int cpu_stop_should_run(unsigned int cpu)
+ 	unsigned long flags;
+ 	int run;
+ 
+-	spin_lock_irqsave(&stopper->lock, flags);
++	raw_spin_lock_irqsave(&stopper->lock, flags);
+ 	run = !list_empty(&stopper->works);
+-	spin_unlock_irqrestore(&stopper->lock, flags);
++	raw_spin_unlock_irqrestore(&stopper->lock, flags);
+ 	return run;
+ }
+ 
+@@ -461,13 +461,13 @@ static void cpu_stopper_thread(unsigned int cpu)
+ 
+ repeat:
+ 	work = NULL;
+-	spin_lock_irq(&stopper->lock);
++	raw_spin_lock_irq(&stopper->lock);
+ 	if (!list_empty(&stopper->works)) {
+ 		work = list_first_entry(&stopper->works,
+ 					struct cpu_stop_work, list);
+ 		list_del_init(&work->list);
+ 	}
+-	spin_unlock_irq(&stopper->lock);
++	raw_spin_unlock_irq(&stopper->lock);
+ 
+ 	if (work) {
+ 		cpu_stop_fn_t fn = work->fn;
+@@ -541,7 +541,7 @@ static int __init cpu_stop_init(void)
+ 	for_each_possible_cpu(cpu) {
+ 		struct cpu_stopper *stopper = &per_cpu(cpu_stopper, cpu);
+ 
+-		spin_lock_init(&stopper->lock);
++		raw_spin_lock_init(&stopper->lock);
+ 		INIT_LIST_HEAD(&stopper->works);
+ 	}
+ 
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index 88f398af57fa..8819944bbcbf 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -678,6 +678,8 @@ event_trigger_callback(struct event_command *cmd_ops,
+ 		goto out_free;
+ 
+  out_reg:
++	/* Up the trigger_data count to make sure reg doesn't free it on failure */
++	event_trigger_init(trigger_ops, trigger_data);
+ 	ret = cmd_ops->reg(glob, trigger_ops, trigger_data, file);
+ 	/*
+ 	 * The above returns on success the # of functions enabled,
+@@ -685,11 +687,13 @@ event_trigger_callback(struct event_command *cmd_ops,
+ 	 * Consider no functions a failure too.
+ 	 */
+ 	if (!ret) {
++		cmd_ops->unreg(glob, trigger_ops, trigger_data, file);
+ 		ret = -ENOENT;
+-		goto out_free;
+-	} else if (ret < 0)
+-		goto out_free;
+-	ret = 0;
++	} else if (ret > 0)
++		ret = 0;
++
++	/* Down the counter of trigger_data or free it if not used anymore */
++	event_trigger_free(trigger_ops, trigger_data);
+  out:
+ 	return ret;
+ 
+@@ -1385,6 +1389,9 @@ int event_enable_trigger_func(struct event_command *cmd_ops,
+ 		goto out;
+ 	}
+ 
++	/* Up the trigger_data count to make sure nothing frees it on failure */
++	event_trigger_init(trigger_ops, trigger_data);
++
+ 	if (trigger) {
+ 		number = strsep(&trigger, ":");
+ 
+@@ -1435,6 +1442,7 @@ int event_enable_trigger_func(struct event_command *cmd_ops,
+ 		goto out_disable;
+ 	/* Just return zero, not the number of enabled functions */
+ 	ret = 0;
++	event_trigger_free(trigger_ops, trigger_data);
+  out:
+ 	return ret;
+ 
+@@ -1445,7 +1453,7 @@ int event_enable_trigger_func(struct event_command *cmd_ops,
+  out_free:
+ 	if (cmd_ops->set_filter)
+ 		cmd_ops->set_filter(NULL, trigger_data, NULL);
+-	kfree(trigger_data);
++	event_trigger_free(trigger_ops, trigger_data);
+ 	kfree(enable_data);
+ 	goto out;
+ }
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index ea3ed03fed7e..3b4cd44ad323 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -359,11 +359,10 @@ static struct trace_kprobe *find_trace_kprobe(const char *event,
+ static int
+ enable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file)
+ {
++	struct event_file_link *link = NULL;
+ 	int ret = 0;
+ 
+ 	if (file) {
+-		struct event_file_link *link;
+-
+ 		link = kmalloc(sizeof(*link), GFP_KERNEL);
+ 		if (!link) {
+ 			ret = -ENOMEM;
+@@ -383,6 +382,18 @@ enable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file)
+ 		else
+ 			ret = enable_kprobe(&tk->rp.kp);
+ 	}
++
++	if (ret) {
++		if (file) {
++			/* Notice the if is true on not WARN() */
++			if (!WARN_ON_ONCE(!link))
++				list_del_rcu(&link->list);
++			kfree(link);
++			tk->tp.flags &= ~TP_FLAG_TRACE;
++		} else {
++			tk->tp.flags &= ~TP_FLAG_PROFILE;
++		}
++	}
+  out:
+ 	return ret;
+ }
+diff --git a/mm/slub.c b/mm/slub.c
+index edc79ca3c6d5..e0ce5dec84ba 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -673,7 +673,7 @@ void object_err(struct kmem_cache *s, struct page *page,
+ 	print_trailer(s, page, object);
+ }
+ 
+-static void slab_err(struct kmem_cache *s, struct page *page,
++static __printf(3, 4) void slab_err(struct kmem_cache *s, struct page *page,
+ 			const char *fmt, ...)
+ {
+ 	va_list args;
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index 195de42bea1f..fa598162dbf0 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1494,7 +1494,7 @@ static void __vunmap(const void *addr, int deallocate_pages)
+ 			addr))
+ 		return;
+ 
+-	area = remove_vm_area(addr);
++	area = find_vmap_area((unsigned long)addr)->vm;
+ 	if (unlikely(!area)) {
+ 		WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n",
+ 				addr);
+@@ -1504,6 +1504,7 @@ static void __vunmap(const void *addr, int deallocate_pages)
+ 	debug_check_no_locks_freed(addr, get_vm_area_size(area));
+ 	debug_check_no_obj_freed(addr, get_vm_area_size(area));
+ 
++	remove_vm_area(addr);
+ 	if (deallocate_pages) {
+ 		int i;
+ 
+diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
+index b23464d9c538..d278b06459ac 100644
+--- a/net/ipv4/ipconfig.c
++++ b/net/ipv4/ipconfig.c
+@@ -779,6 +779,11 @@ static void __init ic_bootp_init_ext(u8 *e)
+  */
+ static inline void __init ic_bootp_init(void)
+ {
++	/* Re-initialise all name servers to NONE, in case any were set via the
++	 * "ip=" or "nfsaddrs=" kernel command line parameters: any IP addresses
++	 * specified there will already have been decoded but are no longer
++	 * needed
++	 */
+ 	ic_nameservers_predef();
+ 
+ 	dev_add_pack(&bootp_packet_type);
+@@ -1401,6 +1406,13 @@ static int __init ip_auto_config(void)
+ 	int err;
+ 	unsigned int i;
+ 
++	/* Initialise all name servers to NONE (but only if the "ip=" or
++	 * "nfsaddrs=" kernel command line parameters weren't decoded, otherwise
++	 * we'll overwrite the IP addresses specified there)
++	 */
++	if (ic_set_manually == 0)
++		ic_nameservers_predef();
++
+ #ifdef CONFIG_PROC_FS
+ 	proc_create("pnp", S_IRUGO, init_net.proc_net, &pnp_seq_fops);
+ #endif /* CONFIG_PROC_FS */
+@@ -1621,6 +1633,7 @@ static int __init ip_auto_config_setup(char *addrs)
+ 		return 1;
+ 	}
+ 
++	/* Initialise all name servers to NONE */
+ 	ic_nameservers_predef();
+ 
+ 	/* Parse string for static IP assignment.  */
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 762f31fb5b67..a3fb30f5a1a9 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2476,12 +2476,13 @@ struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
+ 	u32 id = ntohl(nla_get_be32(nla));
+ 
+ 	list_for_each_entry(trans, &net->nft.commit_list, list) {
+-		struct nft_set *set = nft_trans_set(trans);
++		if (trans->msg_type == NFT_MSG_NEWSET) {
++			struct nft_set *set = nft_trans_set(trans);
+ 
+-		if (trans->msg_type == NFT_MSG_NEWSET &&
+-		    id == nft_trans_set_id(trans) &&
+-		    nft_active_genmask(set, genmask))
+-			return set;
++			if (id == nft_trans_set_id(trans) &&
++			    nft_active_genmask(set, genmask))
++				return set;
++		}
+ 	}
+ 	return ERR_PTR(-ENOENT);
+ }
+diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
+index a71f906b4f7a..9652541c4d43 100644
+--- a/security/integrity/ima/ima_main.c
++++ b/security/integrity/ima/ima_main.c
+@@ -379,6 +379,7 @@ int ima_read_file(struct file *file, enum kernel_read_file_id read_id)
+ 
+ static int read_idmap[READING_MAX_ID] = {
+ 	[READING_FIRMWARE] = FIRMWARE_CHECK,
++	[READING_FIRMWARE_PREALLOC_BUFFER] = FIRMWARE_CHECK,
+ 	[READING_MODULE] = MODULE_CHECK,
+ 	[READING_KEXEC_IMAGE] = KEXEC_KERNEL_CHECK,
+ 	[READING_KEXEC_INITRAMFS] = KEXEC_INITRAMFS_CHECK,
+diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c
+index 37be1e14d756..0d2bb30d9f7e 100644
+--- a/sound/pci/emu10k1/emupcm.c
++++ b/sound/pci/emu10k1/emupcm.c
+@@ -1850,7 +1850,9 @@ int snd_emu10k1_pcm_efx(struct snd_emu10k1 *emu, int device)
+ 	if (!kctl)
+ 		return -ENOMEM;
+ 	kctl->id.device = device;
+-	snd_ctl_add(emu->card, kctl);
++	err = snd_ctl_add(emu->card, kctl);
++	if (err < 0)
++		return err;
+ 
+ 	snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(emu->pci), 64*1024, 64*1024);
+ 
+diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c
+index 4f1f69be1865..8c778fa33031 100644
+--- a/sound/pci/emu10k1/memory.c
++++ b/sound/pci/emu10k1/memory.c
+@@ -237,13 +237,13 @@ __found_pages:
+ static int is_valid_page(struct snd_emu10k1 *emu, dma_addr_t addr)
+ {
+ 	if (addr & ~emu->dma_mask) {
+-		dev_err(emu->card->dev,
++		dev_err_ratelimited(emu->card->dev,
+ 			"max memory size is 0x%lx (addr = 0x%lx)!!\n",
+ 			emu->dma_mask, (unsigned long)addr);
+ 		return 0;
+ 	}
+ 	if (addr & (EMUPAGESIZE-1)) {
+-		dev_err(emu->card->dev, "page is not aligned\n");
++		dev_err_ratelimited(emu->card->dev, "page is not aligned\n");
+ 		return 0;
+ 	}
+ 	return 1;
+@@ -334,7 +334,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst
+ 		else
+ 			addr = snd_pcm_sgbuf_get_addr(substream, ofs);
+ 		if (! is_valid_page(emu, addr)) {
+-			dev_err(emu->card->dev,
++			dev_err_ratelimited(emu->card->dev,
+ 				"emu: failure page = %d\n", idx);
+ 			mutex_unlock(&hdr->block_mutex);
+ 			return NULL;
+diff --git a/sound/pci/fm801.c b/sound/pci/fm801.c
+index a178e0d03088..8561f60b4284 100644
+--- a/sound/pci/fm801.c
++++ b/sound/pci/fm801.c
+@@ -1068,11 +1068,19 @@ static int snd_fm801_mixer(struct fm801 *chip)
+ 		if ((err = snd_ac97_mixer(chip->ac97_bus, &ac97, &chip->ac97_sec)) < 0)
+ 			return err;
+ 	}
+-	for (i = 0; i < FM801_CONTROLS; i++)
+-		snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls[i], chip));
++	for (i = 0; i < FM801_CONTROLS; i++) {
++		err = snd_ctl_add(chip->card,
++			snd_ctl_new1(&snd_fm801_controls[i], chip));
++		if (err < 0)
++			return err;
++	}
+ 	if (chip->multichannel) {
+-		for (i = 0; i < FM801_CONTROLS_MULTI; i++)
+-			snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls_multi[i], chip));
++		for (i = 0; i < FM801_CONTROLS_MULTI; i++) {
++			err = snd_ctl_add(chip->card,
++				snd_ctl_new1(&snd_fm801_controls_multi[i], chip));
++			if (err < 0)
++				return err;
++		}
+ 	}
+ 	return 0;
+ }
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 9ec4dba8a793..280999961226 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -38,6 +38,10 @@
+ /* Enable this to see controls for tuning purpose. */
+ /*#define ENABLE_TUNING_CONTROLS*/
+ 
++#ifdef ENABLE_TUNING_CONTROLS
++#include <sound/tlv.h>
++#endif
++
+ #define FLOAT_ZERO	0x00000000
+ #define FLOAT_ONE	0x3f800000
+ #define FLOAT_TWO	0x40000000
+@@ -3067,8 +3071,8 @@ static int equalizer_ctl_put(struct snd_kcontrol *kcontrol,
+ 	return 1;
+ }
+ 
+-static const DECLARE_TLV_DB_SCALE(voice_focus_db_scale, 2000, 100, 0);
+-static const DECLARE_TLV_DB_SCALE(eq_db_scale, -2400, 100, 0);
++static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(voice_focus_db_scale, 2000, 100, 0);
++static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(eq_db_scale, -2400, 100, 0);
+ 
+ static int add_tuning_control(struct hda_codec *codec,
+ 				hda_nid_t pnid, hda_nid_t nid,
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 80088c98ce27..20680a490897 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -1793,8 +1793,10 @@ int dpcm_be_dai_shutdown(struct snd_soc_pcm_runtime *fe, int stream)
+ 			continue;
+ 
+ 		if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_FREE) &&
+-		    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN))
+-			continue;
++		    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN)) {
++			soc_pcm_hw_free(be_substream);
++			be->dpcm[stream].state = SND_SOC_DPCM_STATE_HW_FREE;
++		}
+ 
+ 		dev_dbg(be->dev, "ASoC: close BE %s\n",
+ 			be->dai_link->name);
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index c5dfe82beb24..e6ac7b9b4648 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -1310,7 +1310,7 @@ static void retire_capture_urb(struct snd_usb_substream *subs,
+ 		if (bytes % (runtime->sample_bits >> 3) != 0) {
+ 			int oldbytes = bytes;
+ 			bytes = frames * stride;
+-			dev_warn(&subs->dev->dev,
++			dev_warn_ratelimited(&subs->dev->dev,
+ 				 "Corrected urb data len. %d->%d\n",
+ 							oldbytes, bytes);
+ 		}
+diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y
+index 879115f93edc..98a4205a5f8a 100644
+--- a/tools/perf/util/parse-events.y
++++ b/tools/perf/util/parse-events.y
+@@ -68,6 +68,7 @@ static void inc_group_count(struct list_head *list,
+ %type <num> value_sym
+ %type <head> event_config
+ %type <head> opt_event_config
++%type <head> opt_pmu_config
+ %type <term> event_term
+ %type <head> event_pmu
+ %type <head> event_legacy_symbol
+@@ -219,7 +220,7 @@ event_def: event_pmu |
+ 	   event_bpf_file
+ 
+ event_pmu:
+-PE_NAME opt_event_config
++PE_NAME opt_pmu_config
+ {
+ 	struct parse_events_evlist *data = _data;
+ 	struct list_head *list;
+@@ -482,6 +483,17 @@ opt_event_config:
+ 	$$ = NULL;
+ }
+ 
++opt_pmu_config:
++'/' event_config '/'
++{
++	$$ = $2;
++}
++|
++'/' '/'
++{
++	$$ = NULL;
++}
++
+ start_terms: event_config
+ {
+ 	struct parse_events_terms *data = _data;
+diff --git a/tools/testing/selftests/intel_pstate/run.sh b/tools/testing/selftests/intel_pstate/run.sh
+index 7868c106b8b1..b62876f41eca 100755
+--- a/tools/testing/selftests/intel_pstate/run.sh
++++ b/tools/testing/selftests/intel_pstate/run.sh
+@@ -48,11 +48,12 @@ function run_test () {
+ 
+ 	echo "sleeping for 5 seconds"
+ 	sleep 5
+-	num_freqs=$(cat /proc/cpuinfo | grep MHz | sort -u | wc -l)
+-	if [ $num_freqs -le 2 ]; then
+-		cat /proc/cpuinfo | grep MHz | sort -u | tail -1 > /tmp/result.$1
++	grep MHz /proc/cpuinfo | sort -u > /tmp/result.freqs
++	num_freqs=$(wc -l /tmp/result.freqs | awk ' { print $1 } ')
++	if [ $num_freqs -ge 2 ]; then
++		tail -n 1 /tmp/result.freqs > /tmp/result.$1
+ 	else
+-		cat /proc/cpuinfo | grep MHz | sort -u > /tmp/result.$1
++		cp /tmp/result.freqs /tmp/result.$1
+ 	fi
+ 	./msr 0 >> /tmp/result.$1
+ 
+@@ -82,21 +83,20 @@ _max_freq=$(cpupower frequency-info -l | tail -1 | awk ' { print $2 } ')
+ max_freq=$(($_max_freq / 1000))
+ 
+ 
+-for freq in `seq $max_freq -100 $min_freq`
++[ $EVALUATE_ONLY -eq 0 ] && for freq in `seq $max_freq -100 $min_freq`
+ do
+ 	echo "Setting maximum frequency to $freq"
+ 	cpupower frequency-set -g powersave --max=${freq}MHz >& /dev/null
+-	[ $EVALUATE_ONLY -eq 0 ] && run_test $freq
++	run_test $freq
+ done
+ 
+-echo "=============================================================================="
++[ $EVALUATE_ONLY -eq 0 ] && cpupower frequency-set -g powersave --max=${max_freq}MHz >& /dev/null
+ 
++echo "=============================================================================="
+ echo "The marketing frequency of the cpu is $mkt_freq MHz"
+ echo "The maximum frequency of the cpu is $max_freq MHz"
+ echo "The minimum frequency of the cpu is $min_freq MHz"
+ 
+-cpupower frequency-set -g powersave --max=${max_freq}MHz >& /dev/null
+-
+ # make a pretty table
+ echo "Target      Actual      Difference     MSR(0x199)     max_perf_pct"
+ for freq in `seq $max_freq -100 $min_freq`
+@@ -104,10 +104,6 @@ do
+ 	result_freq=$(cat /tmp/result.${freq} | grep "cpu MHz" | awk ' { print $4 } ' | awk -F "." ' { print $1 } ')
+ 	msr=$(cat /tmp/result.${freq} | grep "msr" | awk ' { print $3 } ')
+ 	max_perf_pct=$(cat /tmp/result.${freq} | grep "max_perf_pct" | awk ' { print $2 } ' )
+-	if [ $result_freq -eq $freq ]; then
+-		echo " $freq        $result_freq             0          $msr         $(($max_perf_pct*3300))"
+-	else
+-		echo " $freq        $result_freq          $(($result_freq-$freq))          $msr          $(($max_perf_pct*$max_freq))"
+-	fi
++	echo " $freq        $result_freq          $(($result_freq-$freq))          $msr          $(($max_perf_pct*$max_freq))"
+ done
+ exit 0
+diff --git a/tools/usb/usbip/src/usbip_detach.c b/tools/usb/usbip/src/usbip_detach.c
+index 9db9d21bb2ec..6a8db858caa5 100644
+--- a/tools/usb/usbip/src/usbip_detach.c
++++ b/tools/usb/usbip/src/usbip_detach.c
+@@ -43,7 +43,7 @@ void usbip_detach_usage(void)
+ 
+ static int detach_port(char *port)
+ {
+-	int ret;
++	int ret = 0;
+ 	uint8_t portnum;
+ 	char path[PATH_MAX+1];
+ 
+@@ -73,9 +73,12 @@ static int detach_port(char *port)
+ 	}
+ 
+ 	ret = usbip_vhci_detach_device(portnum);
+-	if (ret < 0)
+-		return -1;
++	if (ret < 0) {
++		ret = -1;
++		goto call_driver_close;
++	}
+ 
++call_driver_close:
+ 	usbip_vhci_driver_close();
+ 
+ 	return ret;