[gentoo-commits] proj/linux-patches:4.4 commit in: /

[Mike Pagano]

commit:     d9a45c4f89a6625b8423a1e24753d7def3844932
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Mar 30 18:16:38 2017 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Mar 30 18:16:38 2017 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d9a45c4f

Linux patch 4.4.58

 0000_README             |    4 +
 1057_linux-4.4.58.patch | 2653 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 2657 insertions(+)

diff --git a/0000_README b/0000_README
index e08ec98..62c89c5 100644
--- a/0000_README
+++ b/0000_README
@@ -271,6 +271,10 @@ Patch:  1056_linux-4.4.57.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.4.57
 
+Patch:  1057_linux-4.4.58.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.4.58
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1057_linux-4.4.58.patch b/1057_linux-4.4.58.patch
new file mode 100644
index 0000000..628aea1
--- /dev/null
+++ b/1057_linux-4.4.58.patch
@@ -0,0 +1,2653 @@
+diff --git a/Makefile b/Makefile
+index 841675e63a38..3efe2ea99e2d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 57
++SUBLEVEL = 58
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
+index 4dfca8fc49b3..1bc61ece2589 100644
+--- a/arch/arm/boot/dts/sama5d2.dtsi
++++ b/arch/arm/boot/dts/sama5d2.dtsi
+@@ -856,6 +856,13 @@
+ 				compatible = "atmel,at91sam9260-usart";
+ 				reg = <0xf801c000 0x100>;
+ 				interrupts = <24 IRQ_TYPE_LEVEL_HIGH 7>;
++				dmas = <&dma0
++					(AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
++					 AT91_XDMAC_DT_PERID(35))>,
++				       <&dma0
++					(AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
++					 AT91_XDMAC_DT_PERID(36))>;
++				dma-names = "tx", "rx";
+ 				clocks = <&uart0_clk>;
+ 				clock-names = "usart";
+ 				status = "disabled";
+@@ -865,6 +872,13 @@
+ 				compatible = "atmel,at91sam9260-usart";
+ 				reg = <0xf8020000 0x100>;
+ 				interrupts = <25 IRQ_TYPE_LEVEL_HIGH 7>;
++				dmas = <&dma0
++					(AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
++					 AT91_XDMAC_DT_PERID(37))>,
++				       <&dma0
++					(AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
++					 AT91_XDMAC_DT_PERID(38))>;
++				dma-names = "tx", "rx";
+ 				clocks = <&uart1_clk>;
+ 				clock-names = "usart";
+ 				status = "disabled";
+@@ -874,6 +888,13 @@
+ 				compatible = "atmel,at91sam9260-usart";
+ 				reg = <0xf8024000 0x100>;
+ 				interrupts = <26 IRQ_TYPE_LEVEL_HIGH 7>;
++				dmas = <&dma0
++					(AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
++					 AT91_XDMAC_DT_PERID(39))>,
++				       <&dma0
++					(AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
++					 AT91_XDMAC_DT_PERID(40))>;
++				dma-names = "tx", "rx";
+ 				clocks = <&uart2_clk>;
+ 				clock-names = "usart";
+ 				status = "disabled";
+@@ -985,6 +1006,13 @@
+ 				compatible = "atmel,at91sam9260-usart";
+ 				reg = <0xfc008000 0x100>;
+ 				interrupts = <27 IRQ_TYPE_LEVEL_HIGH 7>;
++				dmas = <&dma0
++					(AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
++					 AT91_XDMAC_DT_PERID(41))>,
++				       <&dma0
++					(AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
++					 AT91_XDMAC_DT_PERID(42))>;
++				dma-names = "tx", "rx";
+ 				clocks = <&uart3_clk>;
+ 				clock-names = "usart";
+ 				status = "disabled";
+@@ -993,6 +1021,13 @@
+ 			uart4: serial@fc00c000 {
+ 				compatible = "atmel,at91sam9260-usart";
+ 				reg = <0xfc00c000 0x100>;
++				dmas = <&dma0
++					(AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
++					 AT91_XDMAC_DT_PERID(43))>,
++				       <&dma0
++					(AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
++					 AT91_XDMAC_DT_PERID(44))>;
++				dma-names = "tx", "rx";
+ 				interrupts = <28 IRQ_TYPE_LEVEL_HIGH 7>;
+ 				clocks = <&uart4_clk>;
+ 				clock-names = "usart";
+diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
+index 23726fb31741..d687f860a2da 100644
+--- a/arch/arm/mach-at91/pm.c
++++ b/arch/arm/mach-at91/pm.c
+@@ -286,6 +286,22 @@ static void at91_ddr_standby(void)
+ 		at91_ramc_write(1, AT91_DDRSDRC_LPR, saved_lpr1);
+ }
+ 
++static void sama5d3_ddr_standby(void)
++{
++	u32 lpr0;
++	u32 saved_lpr0;
++
++	saved_lpr0 = at91_ramc_read(0, AT91_DDRSDRC_LPR);
++	lpr0 = saved_lpr0 & ~AT91_DDRSDRC_LPCB;
++	lpr0 |= AT91_DDRSDRC_LPCB_POWER_DOWN;
++
++	at91_ramc_write(0, AT91_DDRSDRC_LPR, lpr0);
++
++	cpu_do_idle();
++
++	at91_ramc_write(0, AT91_DDRSDRC_LPR, saved_lpr0);
++}
++
+ /* We manage both DDRAM/SDRAM controllers, we need more than one value to
+  * remember.
+  */
+@@ -320,7 +336,7 @@ static const struct of_device_id const ramc_ids[] __initconst = {
+ 	{ .compatible = "atmel,at91rm9200-sdramc", .data = at91rm9200_standby },
+ 	{ .compatible = "atmel,at91sam9260-sdramc", .data = at91sam9_sdram_standby },
+ 	{ .compatible = "atmel,at91sam9g45-ddramc", .data = at91_ddr_standby },
+-	{ .compatible = "atmel,sama5d3-ddramc", .data = at91_ddr_standby },
++	{ .compatible = "atmel,sama5d3-ddramc", .data = sama5d3_ddr_standby },
+ 	{ /*sentinel*/ }
+ };
+ 
+diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
+index cfc4a966e2b9..83b5f7a323a9 100644
+--- a/arch/x86/kernel/cpu/mshyperv.c
++++ b/arch/x86/kernel/cpu/mshyperv.c
+@@ -30,6 +30,7 @@
+ #include <asm/apic.h>
+ #include <asm/timer.h>
+ #include <asm/reboot.h>
++#include <asm/nmi.h>
+ 
+ struct ms_hyperv_info ms_hyperv;
+ EXPORT_SYMBOL_GPL(ms_hyperv);
+@@ -157,6 +158,26 @@ static unsigned char hv_get_nmi_reason(void)
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_X86_LOCAL_APIC
++/*
++ * Prior to WS2016 Debug-VM sends NMIs to all CPUs which makes
++ * it dificult to process CHANNELMSG_UNLOAD in case of crash. Handle
++ * unknown NMI on the first CPU which gets it.
++ */
++static int hv_nmi_unknown(unsigned int val, struct pt_regs *regs)
++{
++	static atomic_t nmi_cpu = ATOMIC_INIT(-1);
++
++	if (!unknown_nmi_panic)
++		return NMI_DONE;
++
++	if (atomic_cmpxchg(&nmi_cpu, -1, raw_smp_processor_id()) != -1)
++		return NMI_HANDLED;
++
++	return NMI_DONE;
++}
++#endif
++
+ static void __init ms_hyperv_init_platform(void)
+ {
+ 	/*
+@@ -182,6 +203,9 @@ static void __init ms_hyperv_init_platform(void)
+ 		printk(KERN_INFO "HyperV: LAPIC Timer Frequency: %#x\n",
+ 				lapic_timer_frequency);
+ 	}
++
++	register_nmi_handler(NMI_UNKNOWN, hv_nmi_unknown, NMI_FLAG_FIRST,
++			     "hv_nmi_unknown");
+ #endif
+ 
+ 	if (ms_hyperv.features & HV_X64_MSR_TIME_REF_COUNT_AVAILABLE)
+diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
+index c6d6efed392a..7575f0798194 100644
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -231,23 +231,14 @@ static int xen_hvm_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
+ 		return 1;
+ 
+ 	for_each_pci_msi_entry(msidesc, dev) {
+-		__pci_read_msi_msg(msidesc, &msg);
+-		pirq = MSI_ADDR_EXT_DEST_ID(msg.address_hi) |
+-			((msg.address_lo >> MSI_ADDR_DEST_ID_SHIFT) & 0xff);
+-		if (msg.data != XEN_PIRQ_MSI_DATA ||
+-		    xen_irq_from_pirq(pirq) < 0) {
+-			pirq = xen_allocate_pirq_msi(dev, msidesc);
+-			if (pirq < 0) {
+-				irq = -ENODEV;
+-				goto error;
+-			}
+-			xen_msi_compose_msg(dev, pirq, &msg);
+-			__pci_write_msi_msg(msidesc, &msg);
+-			dev_dbg(&dev->dev, "xen: msi bound to pirq=%d\n", pirq);
+-		} else {
+-			dev_dbg(&dev->dev,
+-				"xen: msi already bound to pirq=%d\n", pirq);
++		pirq = xen_allocate_pirq_msi(dev, msidesc);
++		if (pirq < 0) {
++			irq = -ENODEV;
++			goto error;
+ 		}
++		xen_msi_compose_msg(dev, pirq, &msg);
++		__pci_write_msi_msg(msidesc, &msg);
++		dev_dbg(&dev->dev, "xen: msi bound to pirq=%d\n", pirq);
+ 		irq = xen_bind_pirq_msi_to_irq(dev, msidesc, pirq,
+ 					       (type == PCI_CAP_ID_MSI) ? nvec : 1,
+ 					       (type == PCI_CAP_ID_MSIX) ?
+diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
+index 0774799942e0..c6fee7437be4 100644
+--- a/block/scsi_ioctl.c
++++ b/block/scsi_ioctl.c
+@@ -182,6 +182,9 @@ static void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter)
+ 	__set_bit(WRITE_16, filter->write_ok);
+ 	__set_bit(WRITE_LONG, filter->write_ok);
+ 	__set_bit(WRITE_LONG_2, filter->write_ok);
++	__set_bit(WRITE_SAME, filter->write_ok);
++	__set_bit(WRITE_SAME_16, filter->write_ok);
++	__set_bit(WRITE_SAME_32, filter->write_ok);
+ 	__set_bit(ERASE, filter->write_ok);
+ 	__set_bit(GPCMD_MODE_SELECT_10, filter->write_ok);
+ 	__set_bit(MODE_SELECT, filter->write_ok);
+diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
+index 68a5ceaa04c8..8d8b3eeba725 100644
+--- a/crypto/algif_hash.c
++++ b/crypto/algif_hash.c
+@@ -184,7 +184,7 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
+ 	struct alg_sock *ask = alg_sk(sk);
+ 	struct hash_ctx *ctx = ask->private;
+ 	struct ahash_request *req = &ctx->req;
+-	char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req))];
++	char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req)) ? : 1];
+ 	struct sock *sk2;
+ 	struct alg_sock *ask2;
+ 	struct hash_ctx *ctx2;
+diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
+index 96809cd99ace..2f24b578bcaf 100644
+--- a/drivers/acpi/blacklist.c
++++ b/drivers/acpi/blacklist.c
+@@ -346,6 +346,34 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
+ 		      DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9343"),
+ 		},
+ 	},
++	{
++	 .callback = dmi_enable_rev_override,
++	 .ident = "DELL Precision 5520",
++	 .matches = {
++		      DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++		      DMI_MATCH(DMI_PRODUCT_NAME, "Precision 5520"),
++		},
++	},
++	{
++	 .callback = dmi_enable_rev_override,
++	 .ident = "DELL Precision 3520",
++	 .matches = {
++		      DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++		      DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3520"),
++		},
++	},
++	/*
++	 * Resolves a quirk with the Dell Latitude 3350 that
++	 * causes the ethernet adapter to not function.
++	 */
++	{
++	 .callback = dmi_enable_rev_override,
++	 .ident = "DELL Latitude 3350",
++	 .matches = {
++		      DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++		      DMI_MATCH(DMI_PRODUCT_NAME, "Latitude 3350"),
++		},
++	},
+ #endif
+ 	{}
+ };
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index 86fa9fdc8323..38b363f4316b 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1186,6 +1186,9 @@ static int cpufreq_online(unsigned int cpu)
+ 		for_each_cpu(j, policy->related_cpus)
+ 			per_cpu(cpufreq_cpu_data, j) = policy;
+ 		write_unlock_irqrestore(&cpufreq_driver_lock, flags);
++	} else {
++		policy->min = policy->user_policy.min;
++		policy->max = policy->user_policy.max;
+ 	}
+ 
+ 	if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {
+diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
+index 0470fc843d4e..9b6854607d73 100644
+--- a/drivers/iio/adc/ti_am335x_adc.c
++++ b/drivers/iio/adc/ti_am335x_adc.c
+@@ -151,7 +151,9 @@ static irqreturn_t tiadc_irq_h(int irq, void *private)
+ {
+ 	struct iio_dev *indio_dev = private;
+ 	struct tiadc_device *adc_dev = iio_priv(indio_dev);
+-	unsigned int status, config;
++	unsigned int status, config, adc_fsm;
++	unsigned short count = 0;
++
+ 	status = tiadc_readl(adc_dev, REG_IRQSTATUS);
+ 
+ 	/*
+@@ -165,6 +167,15 @@ static irqreturn_t tiadc_irq_h(int irq, void *private)
+ 		tiadc_writel(adc_dev, REG_CTRL, config);
+ 		tiadc_writel(adc_dev, REG_IRQSTATUS, IRQENB_FIFO1OVRRUN
+ 				| IRQENB_FIFO1UNDRFLW | IRQENB_FIFO1THRES);
++
++		/* wait for idle state.
++		 * ADC needs to finish the current conversion
++		 * before disabling the module
++		 */
++		do {
++			adc_fsm = tiadc_readl(adc_dev, REG_ADCFSM);
++		} while (adc_fsm != 0x10 && count++ < 100);
++
+ 		tiadc_writel(adc_dev, REG_CTRL, (config | CNTRLREG_TSCSSENB));
+ 		return IRQ_HANDLED;
+ 	} else if (status & IRQENB_FIFO1THRES) {
+diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+index 595511022795..0a86ef43e781 100644
+--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
++++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+@@ -51,8 +51,6 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
+ 			st->report_state.report_id,
+ 			st->report_state.index,
+ 			HID_USAGE_SENSOR_PROP_REPORTING_STATE_ALL_EVENTS_ENUM);
+-
+-		poll_value = hid_sensor_read_poll_value(st);
+ 	} else {
+ 		int val;
+ 
+@@ -89,7 +87,9 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
+ 	sensor_hub_get_feature(st->hsdev, st->power_state.report_id,
+ 			       st->power_state.index,
+ 			       sizeof(state_val), &state_val);
+-	if (state && poll_value)
++	if (state)
++		poll_value = hid_sensor_read_poll_value(st);
++	if (poll_value > 0)
+ 		msleep_interruptible(poll_value * 2);
+ 
+ 	return 0;
+diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
+index d96aa27dfcdc..db64adfbe1af 100644
+--- a/drivers/input/joystick/iforce/iforce-usb.c
++++ b/drivers/input/joystick/iforce/iforce-usb.c
+@@ -141,6 +141,9 @@ static int iforce_usb_probe(struct usb_interface *intf,
+ 
+ 	interface = intf->cur_altsetting;
+ 
++	if (interface->desc.bNumEndpoints < 2)
++		return -ENODEV;
++
+ 	epirq = &interface->endpoint[0].desc;
+ 	epout = &interface->endpoint[1].desc;
+ 
+diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
+index 9365535ba7f1..50a7faa504f7 100644
+--- a/drivers/input/misc/cm109.c
++++ b/drivers/input/misc/cm109.c
+@@ -675,6 +675,10 @@ static int cm109_usb_probe(struct usb_interface *intf,
+ 	int error = -ENOMEM;
+ 
+ 	interface = intf->cur_altsetting;
++
++	if (interface->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	endpoint = &interface->endpoint[0].desc;
+ 
+ 	if (!usb_endpoint_is_int_in(endpoint))
+diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
+index 9c0ea36913b4..f4e8fbec6a94 100644
+--- a/drivers/input/misc/ims-pcu.c
++++ b/drivers/input/misc/ims-pcu.c
+@@ -1667,6 +1667,10 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc
+ 		return -EINVAL;
+ 
+ 	alt = pcu->ctrl_intf->cur_altsetting;
++
++	if (alt->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	pcu->ep_ctrl = &alt->endpoint[0].desc;
+ 	pcu->max_ctrl_size = usb_endpoint_maxp(pcu->ep_ctrl);
+ 
+diff --git a/drivers/input/misc/yealink.c b/drivers/input/misc/yealink.c
+index 79c964c075f1..6e7ff9561d92 100644
+--- a/drivers/input/misc/yealink.c
++++ b/drivers/input/misc/yealink.c
+@@ -875,6 +875,10 @@ static int usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ 	int ret, pipe, i;
+ 
+ 	interface = intf->cur_altsetting;
++
++	if (interface->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	endpoint = &interface->endpoint[0].desc;
+ 	if (!usb_endpoint_is_int_in(endpoint))
+ 		return -ENODEV;
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index ed1935f300a7..da5458dfb1e3 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -218,17 +218,19 @@ static int elan_query_product(struct elan_tp_data *data)
+ 
+ static int elan_check_ASUS_special_fw(struct elan_tp_data *data)
+ {
+-	if (data->ic_type != 0x0E)
+-		return false;
+-
+-	switch (data->product_id) {
+-	case 0x05 ... 0x07:
+-	case 0x09:
+-	case 0x13:
++	if (data->ic_type == 0x0E) {
++		switch (data->product_id) {
++		case 0x05 ... 0x07:
++		case 0x09:
++		case 0x13:
++			return true;
++		}
++	} else if (data->ic_type == 0x08 && data->product_id == 0x26) {
++		/* ASUS EeeBook X205TA */
+ 		return true;
+-	default:
+-		return false;
+ 	}
++
++	return false;
+ }
+ 
+ static int __elan_initialize(struct elan_tp_data *data)
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 0cdd95801a25..25eab453f2b2 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -120,6 +120,13 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
+ 		},
+ 	},
+ 	{
++		/* Dell Embedded Box PC 3000 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Embedded Box PC 3000"),
++		},
++	},
++	{
+ 		/* OQO Model 01 */
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "OQO"),
+diff --git a/drivers/input/tablet/hanwang.c b/drivers/input/tablet/hanwang.c
+index cd852059b99e..df4bea96d7ed 100644
+--- a/drivers/input/tablet/hanwang.c
++++ b/drivers/input/tablet/hanwang.c
+@@ -340,6 +340,9 @@ static int hanwang_probe(struct usb_interface *intf, const struct usb_device_id
+ 	int error;
+ 	int i;
+ 
++	if (intf->cur_altsetting->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	hanwang = kzalloc(sizeof(struct hanwang), GFP_KERNEL);
+ 	input_dev = input_allocate_device();
+ 	if (!hanwang || !input_dev) {
+diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c
+index d2ac7c2b5b82..2812f9236b7d 100644
+--- a/drivers/input/tablet/kbtab.c
++++ b/drivers/input/tablet/kbtab.c
+@@ -122,6 +122,9 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
+ 	struct input_dev *input_dev;
+ 	int error = -ENOMEM;
+ 
++	if (intf->cur_altsetting->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL);
+ 	input_dev = input_allocate_device();
+ 	if (!kbtab || !input_dev)
+diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
+index 45b466e3bbe8..0146e2c74649 100644
+--- a/drivers/input/touchscreen/sur40.c
++++ b/drivers/input/touchscreen/sur40.c
+@@ -500,6 +500,9 @@ static int sur40_probe(struct usb_interface *interface,
+ 	if (iface_desc->desc.bInterfaceClass != 0xFF)
+ 		return -ENODEV;
+ 
++	if (iface_desc->desc.bNumEndpoints < 5)
++		return -ENODEV;
++
+ 	/* Use endpoint #4 (0x86). */
+ 	endpoint = &iface_desc->endpoint[4].desc;
+ 	if (endpoint->bEndpointAddress != TOUCH_ENDPOINT)
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index f0fc6f7b5d98..0628372f3591 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -908,7 +908,7 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
+ 				 * which we used for the IOMMU lookup. Strictly speaking
+ 				 * we could do this for all PCI devices; we only need to
+ 				 * get the BDF# from the scope table for ACPI matches. */
+-				if (pdev->is_virtfn)
++				if (pdev && pdev->is_virtfn)
+ 					goto got_pdev;
+ 
+ 				*bus = drhd->devices[i].bus;
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 122af340a531..a92979e704e3 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1072,6 +1072,8 @@ static void __make_request(struct mddev *mddev, struct bio *bio)
+ 	int max_sectors;
+ 	int sectors;
+ 
++	md_write_start(mddev, bio);
++
+ 	/*
+ 	 * Register the new request and wait if the reconstruction
+ 	 * thread has put up a bar for new requests.
+@@ -1455,8 +1457,6 @@ static void make_request(struct mddev *mddev, struct bio *bio)
+ 		return;
+ 	}
+ 
+-	md_write_start(mddev, bio);
+-
+ 	do {
+ 
+ 		/*
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 5cefca95734e..885f689ac870 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -1595,6 +1595,114 @@ static const char *uvc_print_chain(struct uvc_video_chain *chain)
+ 	return buffer;
+ }
+ 
++static struct uvc_video_chain *uvc_alloc_chain(struct uvc_device *dev)
++{
++	struct uvc_video_chain *chain;
++
++	chain = kzalloc(sizeof(*chain), GFP_KERNEL);
++	if (chain == NULL)
++		return NULL;
++
++	INIT_LIST_HEAD(&chain->entities);
++	mutex_init(&chain->ctrl_mutex);
++	chain->dev = dev;
++	v4l2_prio_init(&chain->prio);
++
++	return chain;
++}
++
++/*
++ * Fallback heuristic for devices that don't connect units and terminals in a
++ * valid chain.
++ *
++ * Some devices have invalid baSourceID references, causing uvc_scan_chain()
++ * to fail, but if we just take the entities we can find and put them together
++ * in the most sensible chain we can think of, turns out they do work anyway.
++ * Note: This heuristic assumes there is a single chain.
++ *
++ * At the time of writing, devices known to have such a broken chain are
++ *  - Acer Integrated Camera (5986:055a)
++ *  - Realtek rtl157a7 (0bda:57a7)
++ */
++static int uvc_scan_fallback(struct uvc_device *dev)
++{
++	struct uvc_video_chain *chain;
++	struct uvc_entity *iterm = NULL;
++	struct uvc_entity *oterm = NULL;
++	struct uvc_entity *entity;
++	struct uvc_entity *prev;
++
++	/*
++	 * Start by locating the input and output terminals. We only support
++	 * devices with exactly one of each for now.
++	 */
++	list_for_each_entry(entity, &dev->entities, list) {
++		if (UVC_ENTITY_IS_ITERM(entity)) {
++			if (iterm)
++				return -EINVAL;
++			iterm = entity;
++		}
++
++		if (UVC_ENTITY_IS_OTERM(entity)) {
++			if (oterm)
++				return -EINVAL;
++			oterm = entity;
++		}
++	}
++
++	if (iterm == NULL || oterm == NULL)
++		return -EINVAL;
++
++	/* Allocate the chain and fill it. */
++	chain = uvc_alloc_chain(dev);
++	if (chain == NULL)
++		return -ENOMEM;
++
++	if (uvc_scan_chain_entity(chain, oterm) < 0)
++		goto error;
++
++	prev = oterm;
++
++	/*
++	 * Add all Processing and Extension Units with two pads. The order
++	 * doesn't matter much, use reverse list traversal to connect units in
++	 * UVC descriptor order as we build the chain from output to input. This
++	 * leads to units appearing in the order meant by the manufacturer for
++	 * the cameras known to require this heuristic.
++	 */
++	list_for_each_entry_reverse(entity, &dev->entities, list) {
++		if (entity->type != UVC_VC_PROCESSING_UNIT &&
++		    entity->type != UVC_VC_EXTENSION_UNIT)
++			continue;
++
++		if (entity->num_pads != 2)
++			continue;
++
++		if (uvc_scan_chain_entity(chain, entity) < 0)
++			goto error;
++
++		prev->baSourceID[0] = entity->id;
++		prev = entity;
++	}
++
++	if (uvc_scan_chain_entity(chain, iterm) < 0)
++		goto error;
++
++	prev->baSourceID[0] = iterm->id;
++
++	list_add_tail(&chain->list, &dev->chains);
++
++	uvc_trace(UVC_TRACE_PROBE,
++		  "Found a video chain by fallback heuristic (%s).\n",
++		  uvc_print_chain(chain));
++
++	return 0;
++
++error:
++	kfree(chain);
++	return -EINVAL;
++}
++
+ /*
+  * Scan the device for video chains and register video devices.
+  *
+@@ -1617,15 +1725,10 @@ static int uvc_scan_device(struct uvc_device *dev)
+ 		if (term->chain.next || term->chain.prev)
+ 			continue;
+ 
+-		chain = kzalloc(sizeof(*chain), GFP_KERNEL);
++		chain = uvc_alloc_chain(dev);
+ 		if (chain == NULL)
+ 			return -ENOMEM;
+ 
+-		INIT_LIST_HEAD(&chain->entities);
+-		mutex_init(&chain->ctrl_mutex);
+-		chain->dev = dev;
+-		v4l2_prio_init(&chain->prio);
+-
+ 		term->flags |= UVC_ENTITY_FLAG_DEFAULT;
+ 
+ 		if (uvc_scan_chain(chain, term) < 0) {
+@@ -1639,6 +1742,9 @@ static int uvc_scan_device(struct uvc_device *dev)
+ 		list_add_tail(&chain->list, &dev->chains);
+ 	}
+ 
++	if (list_empty(&dev->chains))
++		uvc_scan_fallback(dev);
++
+ 	if (list_empty(&dev->chains)) {
+ 		uvc_printk(KERN_INFO, "No valid video chain found.\n");
+ 		return -1;
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index bda164089904..62d37d2ac557 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1274,7 +1274,9 @@ clock_set:
+ 			return;
+ 		}
+ 		timeout--;
+-		mdelay(1);
++		spin_unlock_irq(&host->lock);
++		usleep_range(900, 1100);
++		spin_lock_irq(&host->lock);
+ 	}
+ 
+ 	clk |= SDHCI_CLOCK_CARD_EN;
+diff --git a/drivers/mmc/host/ushc.c b/drivers/mmc/host/ushc.c
+index d2c386f09d69..1d843357422e 100644
+--- a/drivers/mmc/host/ushc.c
++++ b/drivers/mmc/host/ushc.c
+@@ -426,6 +426,9 @@ static int ushc_probe(struct usb_interface *intf, const struct usb_device_id *id
+ 	struct ushc_data *ushc;
+ 	int ret;
+ 
++	if (intf->cur_altsetting->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	mmc = mmc_alloc_host(sizeof(struct ushc_data), &intf->dev);
+ 	if (mmc == NULL)
+ 		return -ENOMEM;
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+index b6fa89102526..66ba1e0ff37e 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+@@ -913,8 +913,8 @@
+ #define RX_PACKET_ATTRIBUTES_CSUM_DONE_WIDTH	1
+ #define RX_PACKET_ATTRIBUTES_VLAN_CTAG_INDEX	1
+ #define RX_PACKET_ATTRIBUTES_VLAN_CTAG_WIDTH	1
+-#define RX_PACKET_ATTRIBUTES_INCOMPLETE_INDEX	2
+-#define RX_PACKET_ATTRIBUTES_INCOMPLETE_WIDTH	1
++#define RX_PACKET_ATTRIBUTES_LAST_INDEX		2
++#define RX_PACKET_ATTRIBUTES_LAST_WIDTH		1
+ #define RX_PACKET_ATTRIBUTES_CONTEXT_NEXT_INDEX	3
+ #define RX_PACKET_ATTRIBUTES_CONTEXT_NEXT_WIDTH	1
+ #define RX_PACKET_ATTRIBUTES_CONTEXT_INDEX	4
+@@ -923,6 +923,8 @@
+ #define RX_PACKET_ATTRIBUTES_RX_TSTAMP_WIDTH	1
+ #define RX_PACKET_ATTRIBUTES_RSS_HASH_INDEX	6
+ #define RX_PACKET_ATTRIBUTES_RSS_HASH_WIDTH	1
++#define RX_PACKET_ATTRIBUTES_FIRST_INDEX	7
++#define RX_PACKET_ATTRIBUTES_FIRST_WIDTH	1
+ 
+ #define RX_NORMAL_DESC0_OVT_INDEX		0
+ #define RX_NORMAL_DESC0_OVT_WIDTH		16
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+index f6a7161e3b85..5e6238e0b2bd 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+@@ -1658,10 +1658,15 @@ static int xgbe_dev_read(struct xgbe_channel *channel)
+ 
+ 	/* Get the header length */
+ 	if (XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, FD)) {
++		XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
++			       FIRST, 1);
+ 		rdata->rx.hdr_len = XGMAC_GET_BITS_LE(rdesc->desc2,
+ 						      RX_NORMAL_DESC2, HL);
+ 		if (rdata->rx.hdr_len)
+ 			pdata->ext_stats.rx_split_header_packets++;
++	} else {
++		XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
++			       FIRST, 0);
+ 	}
+ 
+ 	/* Get the RSS hash */
+@@ -1684,19 +1689,16 @@ static int xgbe_dev_read(struct xgbe_channel *channel)
+ 		}
+ 	}
+ 
+-	/* Get the packet length */
+-	rdata->rx.len = XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, PL);
+-
+-	if (!XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, LD)) {
+-		/* Not all the data has been transferred for this packet */
+-		XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
+-			       INCOMPLETE, 1);
++	/* Not all the data has been transferred for this packet */
++	if (!XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, LD))
+ 		return 0;
+-	}
+ 
+ 	/* This is the last of the data for this packet */
+ 	XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
+-		       INCOMPLETE, 0);
++		       LAST, 1);
++
++	/* Get the packet length */
++	rdata->rx.len = XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, PL);
+ 
+ 	/* Set checksum done indicator as appropriate */
+ 	if (netdev->features & NETIF_F_RXCSUM)
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 53ce1222b11d..865b7e0b133b 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1760,13 +1760,12 @@ static struct sk_buff *xgbe_create_skb(struct xgbe_prv_data *pdata,
+ {
+ 	struct sk_buff *skb;
+ 	u8 *packet;
+-	unsigned int copy_len;
+ 
+ 	skb = napi_alloc_skb(napi, rdata->rx.hdr.dma_len);
+ 	if (!skb)
+ 		return NULL;
+ 
+-	/* Start with the header buffer which may contain just the header
++	/* Pull in the header buffer which may contain just the header
+ 	 * or the header plus data
+ 	 */
+ 	dma_sync_single_range_for_cpu(pdata->dev, rdata->rx.hdr.dma_base,
+@@ -1775,30 +1774,49 @@ static struct sk_buff *xgbe_create_skb(struct xgbe_prv_data *pdata,
+ 
+ 	packet = page_address(rdata->rx.hdr.pa.pages) +
+ 		 rdata->rx.hdr.pa.pages_offset;
+-	copy_len = (rdata->rx.hdr_len) ? rdata->rx.hdr_len : len;
+-	copy_len = min(rdata->rx.hdr.dma_len, copy_len);
+-	skb_copy_to_linear_data(skb, packet, copy_len);
+-	skb_put(skb, copy_len);
+-
+-	len -= copy_len;
+-	if (len) {
+-		/* Add the remaining data as a frag */
+-		dma_sync_single_range_for_cpu(pdata->dev,
+-					      rdata->rx.buf.dma_base,
+-					      rdata->rx.buf.dma_off,
+-					      rdata->rx.buf.dma_len,
+-					      DMA_FROM_DEVICE);
+-
+-		skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+-				rdata->rx.buf.pa.pages,
+-				rdata->rx.buf.pa.pages_offset,
+-				len, rdata->rx.buf.dma_len);
+-		rdata->rx.buf.pa.pages = NULL;
+-	}
++	skb_copy_to_linear_data(skb, packet, len);
++	skb_put(skb, len);
+ 
+ 	return skb;
+ }
+ 
++static unsigned int xgbe_rx_buf1_len(struct xgbe_ring_data *rdata,
++				     struct xgbe_packet_data *packet)
++{
++	/* Always zero if not the first descriptor */
++	if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, FIRST))
++		return 0;
++
++	/* First descriptor with split header, return header length */
++	if (rdata->rx.hdr_len)
++		return rdata->rx.hdr_len;
++
++	/* First descriptor but not the last descriptor and no split header,
++	 * so the full buffer was used
++	 */
++	if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, LAST))
++		return rdata->rx.hdr.dma_len;
++
++	/* First descriptor and last descriptor and no split header, so
++	 * calculate how much of the buffer was used
++	 */
++	return min_t(unsigned int, rdata->rx.hdr.dma_len, rdata->rx.len);
++}
++
++static unsigned int xgbe_rx_buf2_len(struct xgbe_ring_data *rdata,
++				     struct xgbe_packet_data *packet,
++				     unsigned int len)
++{
++	/* Always the full buffer if not the last descriptor */
++	if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, LAST))
++		return rdata->rx.buf.dma_len;
++
++	/* Last descriptor so calculate how much of the buffer was used
++	 * for the last bit of data
++	 */
++	return rdata->rx.len - len;
++}
++
+ static int xgbe_tx_poll(struct xgbe_channel *channel)
+ {
+ 	struct xgbe_prv_data *pdata = channel->pdata;
+@@ -1881,8 +1899,8 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
+ 	struct napi_struct *napi;
+ 	struct sk_buff *skb;
+ 	struct skb_shared_hwtstamps *hwtstamps;
+-	unsigned int incomplete, error, context_next, context;
+-	unsigned int len, rdesc_len, max_len;
++	unsigned int last, error, context_next, context;
++	unsigned int len, buf1_len, buf2_len, max_len;
+ 	unsigned int received = 0;
+ 	int packet_count = 0;
+ 
+@@ -1892,7 +1910,7 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
+ 	if (!ring)
+ 		return 0;
+ 
+-	incomplete = 0;
++	last = 0;
+ 	context_next = 0;
+ 
+ 	napi = (pdata->per_channel_irq) ? &channel->napi : &pdata->napi;
+@@ -1926,9 +1944,8 @@ read_again:
+ 		received++;
+ 		ring->cur++;
+ 
+-		incomplete = XGMAC_GET_BITS(packet->attributes,
+-					    RX_PACKET_ATTRIBUTES,
+-					    INCOMPLETE);
++		last = XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
++				      LAST);
+ 		context_next = XGMAC_GET_BITS(packet->attributes,
+ 					      RX_PACKET_ATTRIBUTES,
+ 					      CONTEXT_NEXT);
+@@ -1937,7 +1954,7 @@ read_again:
+ 					 CONTEXT);
+ 
+ 		/* Earlier error, just drain the remaining data */
+-		if ((incomplete || context_next) && error)
++		if ((!last || context_next) && error)
+ 			goto read_again;
+ 
+ 		if (error || packet->errors) {
+@@ -1949,16 +1966,22 @@ read_again:
+ 		}
+ 
+ 		if (!context) {
+-			/* Length is cumulative, get this descriptor's length */
+-			rdesc_len = rdata->rx.len - len;
+-			len += rdesc_len;
++			/* Get the data length in the descriptor buffers */
++			buf1_len = xgbe_rx_buf1_len(rdata, packet);
++			len += buf1_len;
++			buf2_len = xgbe_rx_buf2_len(rdata, packet, len);
++			len += buf2_len;
+ 
+-			if (rdesc_len && !skb) {
++			if (!skb) {
+ 				skb = xgbe_create_skb(pdata, napi, rdata,
+-						      rdesc_len);
+-				if (!skb)
++						      buf1_len);
++				if (!skb) {
+ 					error = 1;
+-			} else if (rdesc_len) {
++					goto skip_data;
++				}
++			}
++
++			if (buf2_len) {
+ 				dma_sync_single_range_for_cpu(pdata->dev,
+ 							rdata->rx.buf.dma_base,
+ 							rdata->rx.buf.dma_off,
+@@ -1968,13 +1991,14 @@ read_again:
+ 				skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+ 						rdata->rx.buf.pa.pages,
+ 						rdata->rx.buf.pa.pages_offset,
+-						rdesc_len,
++						buf2_len,
+ 						rdata->rx.buf.dma_len);
+ 				rdata->rx.buf.pa.pages = NULL;
+ 			}
+ 		}
+ 
+-		if (incomplete || context_next)
++skip_data:
++		if (!last || context_next)
+ 			goto read_again;
+ 
+ 		if (!skb)
+@@ -2033,7 +2057,7 @@ next_packet:
+ 	}
+ 
+ 	/* Check if we need to save state before leaving */
+-	if (received && (incomplete || context_next)) {
++	if (received && (!last || context_next)) {
+ 		rdata = XGBE_GET_DESC_DATA(ring, ring->cur);
+ 		rdata->state_saved = 1;
+ 		rdata->state.skb = skb;
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 91627561c58d..f971d92f7b41 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -3495,7 +3495,8 @@ static int bcmgenet_suspend(struct device *d)
+ 
+ 	bcmgenet_netif_stop(dev);
+ 
+-	phy_suspend(priv->phydev);
++	if (!device_may_wakeup(d))
++		phy_suspend(priv->phydev);
+ 
+ 	netif_device_detach(dev);
+ 
+@@ -3592,7 +3593,8 @@ static int bcmgenet_resume(struct device *d)
+ 
+ 	netif_device_attach(dev);
+ 
+-	phy_resume(priv->phydev);
++	if (!device_may_wakeup(d))
++		phy_resume(priv->phydev);
+ 
+ 	if (priv->eee.eee_enabled)
+ 		bcmgenet_eee_enable_set(dev, true);
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index 8bdfe53754ba..e96d1f95bb47 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -220,20 +220,6 @@ void bcmgenet_phy_power_set(struct net_device *dev, bool enable)
+ 	udelay(60);
+ }
+ 
+-static void bcmgenet_internal_phy_setup(struct net_device *dev)
+-{
+-	struct bcmgenet_priv *priv = netdev_priv(dev);
+-	u32 reg;
+-
+-	/* Power up PHY */
+-	bcmgenet_phy_power_set(dev, true);
+-	/* enable APD */
+-	reg = bcmgenet_ext_readl(priv, EXT_EXT_PWR_MGMT);
+-	reg |= EXT_PWR_DN_EN_LD;
+-	bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT);
+-	bcmgenet_mii_reset(dev);
+-}
+-
+ static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv)
+ {
+ 	u32 reg;
+@@ -281,7 +267,6 @@ int bcmgenet_mii_config(struct net_device *dev)
+ 
+ 		if (priv->internal_phy) {
+ 			phy_name = "internal PHY";
+-			bcmgenet_internal_phy_setup(dev);
+ 		} else if (priv->phy_interface == PHY_INTERFACE_MODE_MOCA) {
+ 			phy_name = "MoCA";
+ 			bcmgenet_moca_phy_setup(priv);
+diff --git a/drivers/net/ethernet/intel/igb/e1000_phy.c b/drivers/net/ethernet/intel/igb/e1000_phy.c
+index 23ec28f43f6d..afaa98d1d4e4 100644
+--- a/drivers/net/ethernet/intel/igb/e1000_phy.c
++++ b/drivers/net/ethernet/intel/igb/e1000_phy.c
+@@ -77,6 +77,10 @@ s32 igb_get_phy_id(struct e1000_hw *hw)
+ 	s32 ret_val = 0;
+ 	u16 phy_id;
+ 
++	/* ensure PHY page selection to fix misconfigured i210 */
++	if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211))
++		phy->ops.write_reg(hw, I347AT4_PAGE_SELECT, 0);
++
+ 	ret_val = phy->ops.read_reg(hw, PHY_ID1, &phy_id);
+ 	if (ret_val)
+ 		goto out;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index cf0098596e85..e9408f5e2a1d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -197,6 +197,10 @@ static inline void mlx5e_build_rx_skb(struct mlx5_cqe64 *cqe,
+ 	if (lro_num_seg > 1) {
+ 		mlx5e_lro_update_hdr(skb, cqe);
+ 		skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt, lro_num_seg);
++		/* Subtract one since we already counted this as one
++		 * "regular" packet in mlx5e_complete_rx_cqe()
++		 */
++		rq->stats.packets += lro_num_seg - 1;
+ 		rq->stats.lro_packets++;
+ 		rq->stats.lro_bytes += cqe_bcnt;
+ 	}
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index ba115ec7aa92..1e611980cf99 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -85,7 +85,7 @@ static struct mlx5_profile profile[] = {
+ 	[2] = {
+ 		.mask		= MLX5_PROF_MASK_QP_SIZE |
+ 				  MLX5_PROF_MASK_MR_CACHE,
+-		.log_max_qp	= 17,
++		.log_max_qp	= 18,
+ 		.mr_cache[0]	= {
+ 			.size	= 500,
+ 			.limit	= 250
+diff --git a/drivers/parport/share.c b/drivers/parport/share.c
+index 5ce5ef211bdb..754f21fd9768 100644
+--- a/drivers/parport/share.c
++++ b/drivers/parport/share.c
+@@ -936,8 +936,10 @@ parport_register_dev_model(struct parport *port, const char *name,
+ 	 * pardevice fields. -arca
+ 	 */
+ 	port->ops->init_state(par_dev, par_dev->state);
+-	port->proc_device = par_dev;
+-	parport_device_proc_register(par_dev);
++	if (!test_and_set_bit(PARPORT_DEVPROC_REGISTERED, &port->devflags)) {
++		port->proc_device = par_dev;
++		parport_device_proc_register(par_dev);
++	}
+ 
+ 	return par_dev;
+ 
+diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
+index 31f31d460fc9..357527712539 100644
+--- a/drivers/pci/iov.c
++++ b/drivers/pci/iov.c
+@@ -303,13 +303,6 @@ static int sriov_enable(struct pci_dev *dev, int nr_virtfn)
+ 			return rc;
+ 	}
+ 
+-	pci_iov_set_numvfs(dev, nr_virtfn);
+-	iov->ctrl |= PCI_SRIOV_CTRL_VFE | PCI_SRIOV_CTRL_MSE;
+-	pci_cfg_access_lock(dev);
+-	pci_write_config_word(dev, iov->pos + PCI_SRIOV_CTRL, iov->ctrl);
+-	msleep(100);
+-	pci_cfg_access_unlock(dev);
+-
+ 	iov->initial_VFs = initial;
+ 	if (nr_virtfn < initial)
+ 		initial = nr_virtfn;
+@@ -320,6 +313,13 @@ static int sriov_enable(struct pci_dev *dev, int nr_virtfn)
+ 		goto err_pcibios;
+ 	}
+ 
++	pci_iov_set_numvfs(dev, nr_virtfn);
++	iov->ctrl |= PCI_SRIOV_CTRL_VFE | PCI_SRIOV_CTRL_MSE;
++	pci_cfg_access_lock(dev);
++	pci_write_config_word(dev, iov->pos + PCI_SRIOV_CTRL, iov->ctrl);
++	msleep(100);
++	pci_cfg_access_unlock(dev);
++
+ 	for (i = 0; i < initial; i++) {
+ 		rc = virtfn_add(dev, i, 0);
+ 		if (rc)
+@@ -555,21 +555,61 @@ void pci_iov_release(struct pci_dev *dev)
+ }
+ 
+ /**
+- * pci_iov_resource_bar - get position of the SR-IOV BAR
++ * pci_iov_update_resource - update a VF BAR
+  * @dev: the PCI device
+  * @resno: the resource number
+  *
+- * Returns position of the BAR encapsulated in the SR-IOV capability.
++ * Update a VF BAR in the SR-IOV capability of a PF.
+  */
+-int pci_iov_resource_bar(struct pci_dev *dev, int resno)
++void pci_iov_update_resource(struct pci_dev *dev, int resno)
+ {
+-	if (resno < PCI_IOV_RESOURCES || resno > PCI_IOV_RESOURCE_END)
+-		return 0;
++	struct pci_sriov *iov = dev->is_physfn ? dev->sriov : NULL;
++	struct resource *res = dev->resource + resno;
++	int vf_bar = resno - PCI_IOV_RESOURCES;
++	struct pci_bus_region region;
++	u16 cmd;
++	u32 new;
++	int reg;
++
++	/*
++	 * The generic pci_restore_bars() path calls this for all devices,
++	 * including VFs and non-SR-IOV devices.  If this is not a PF, we
++	 * have nothing to do.
++	 */
++	if (!iov)
++		return;
++
++	pci_read_config_word(dev, iov->pos + PCI_SRIOV_CTRL, &cmd);
++	if ((cmd & PCI_SRIOV_CTRL_VFE) && (cmd & PCI_SRIOV_CTRL_MSE)) {
++		dev_WARN(&dev->dev, "can't update enabled VF BAR%d %pR\n",
++			 vf_bar, res);
++		return;
++	}
++
++	/*
++	 * Ignore unimplemented BARs, unused resource slots for 64-bit
++	 * BARs, and non-movable resources, e.g., those described via
++	 * Enhanced Allocation.
++	 */
++	if (!res->flags)
++		return;
++
++	if (res->flags & IORESOURCE_UNSET)
++		return;
++
++	if (res->flags & IORESOURCE_PCI_FIXED)
++		return;
+ 
+-	BUG_ON(!dev->is_physfn);
++	pcibios_resource_to_bus(dev->bus, &region, res);
++	new = region.start;
++	new |= res->flags & ~PCI_BASE_ADDRESS_MEM_MASK;
+ 
+-	return dev->sriov->pos + PCI_SRIOV_BAR +
+-		4 * (resno - PCI_IOV_RESOURCES);
++	reg = iov->pos + PCI_SRIOV_BAR + 4 * vf_bar;
++	pci_write_config_dword(dev, reg, new);
++	if (res->flags & IORESOURCE_MEM_64) {
++		new = region.start >> 16 >> 16;
++		pci_write_config_dword(dev, reg + 4, new);
++	}
+ }
+ 
+ resource_size_t __weak pcibios_iov_resource_alignment(struct pci_dev *dev,
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index e311a9bf2c90..0e53488f8ec1 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -519,10 +519,6 @@ static void pci_restore_bars(struct pci_dev *dev)
+ {
+ 	int i;
+ 
+-	/* Per SR-IOV spec 3.4.1.11, VF BARs are RO zero */
+-	if (dev->is_virtfn)
+-		return;
+-
+ 	for (i = 0; i < PCI_BRIDGE_RESOURCES; i++)
+ 		pci_update_resource(dev, i);
+ }
+@@ -4472,36 +4468,6 @@ int pci_select_bars(struct pci_dev *dev, unsigned long flags)
+ }
+ EXPORT_SYMBOL(pci_select_bars);
+ 
+-/**
+- * pci_resource_bar - get position of the BAR associated with a resource
+- * @dev: the PCI device
+- * @resno: the resource number
+- * @type: the BAR type to be filled in
+- *
+- * Returns BAR position in config space, or 0 if the BAR is invalid.
+- */
+-int pci_resource_bar(struct pci_dev *dev, int resno, enum pci_bar_type *type)
+-{
+-	int reg;
+-
+-	if (resno < PCI_ROM_RESOURCE) {
+-		*type = pci_bar_unknown;
+-		return PCI_BASE_ADDRESS_0 + 4 * resno;
+-	} else if (resno == PCI_ROM_RESOURCE) {
+-		*type = pci_bar_mem32;
+-		return dev->rom_base_reg;
+-	} else if (resno < PCI_BRIDGE_RESOURCES) {
+-		/* device specific resource */
+-		*type = pci_bar_unknown;
+-		reg = pci_iov_resource_bar(dev, resno);
+-		if (reg)
+-			return reg;
+-	}
+-
+-	dev_err(&dev->dev, "BAR %d: invalid resource\n", resno);
+-	return 0;
+-}
+-
+ /* Some architectures require additional programming to enable VGA */
+ static arch_set_vga_state_t arch_set_vga_state;
+ 
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index d390fc1475ec..c43e448873ca 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -232,7 +232,6 @@ bool pci_bus_read_dev_vendor_id(struct pci_bus *bus, int devfn, u32 *pl,
+ int pci_setup_device(struct pci_dev *dev);
+ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
+ 		    struct resource *res, unsigned int reg);
+-int pci_resource_bar(struct pci_dev *dev, int resno, enum pci_bar_type *type);
+ void pci_configure_ari(struct pci_dev *dev);
+ void __pci_bus_size_bridges(struct pci_bus *bus,
+ 			struct list_head *realloc_head);
+@@ -276,7 +275,7 @@ static inline void pci_restore_ats_state(struct pci_dev *dev)
+ #ifdef CONFIG_PCI_IOV
+ int pci_iov_init(struct pci_dev *dev);
+ void pci_iov_release(struct pci_dev *dev);
+-int pci_iov_resource_bar(struct pci_dev *dev, int resno);
++void pci_iov_update_resource(struct pci_dev *dev, int resno);
+ resource_size_t pci_sriov_resource_alignment(struct pci_dev *dev, int resno);
+ void pci_restore_iov_state(struct pci_dev *dev);
+ int pci_iov_bus_range(struct pci_bus *bus);
+@@ -290,10 +289,6 @@ static inline void pci_iov_release(struct pci_dev *dev)
+ 
+ {
+ }
+-static inline int pci_iov_resource_bar(struct pci_dev *dev, int resno)
+-{
+-	return 0;
+-}
+ static inline void pci_restore_iov_state(struct pci_dev *dev)
+ {
+ }
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 71d9a6d1bd56..b83df942794f 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -226,7 +226,8 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
+ 			mask64 = (u32)PCI_BASE_ADDRESS_MEM_MASK;
+ 		}
+ 	} else {
+-		res->flags |= (l & IORESOURCE_ROM_ENABLE);
++		if (l & PCI_ROM_ADDRESS_ENABLE)
++			res->flags |= IORESOURCE_ROM_ENABLE;
+ 		l64 = l & PCI_ROM_ADDRESS_MASK;
+ 		sz64 = sz & PCI_ROM_ADDRESS_MASK;
+ 		mask64 = (u32)PCI_ROM_ADDRESS_MASK;
+diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
+index eb0ad530dc43..3eea7fc5e1a2 100644
+--- a/drivers/pci/rom.c
++++ b/drivers/pci/rom.c
+@@ -31,6 +31,11 @@ int pci_enable_rom(struct pci_dev *pdev)
+ 	if (!res->flags)
+ 		return -1;
+ 
++	/*
++	 * Ideally pci_update_resource() would update the ROM BAR address,
++	 * and we would only set the enable bit here.  But apparently some
++	 * devices have buggy ROM BARs that read as zero when disabled.
++	 */
+ 	pcibios_resource_to_bus(pdev->bus, &region, res);
+ 	pci_read_config_dword(pdev, pdev->rom_base_reg, &rom_addr);
+ 	rom_addr &= ~PCI_ROM_ADDRESS_MASK;
+diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
+index 604011e047d6..25062966cbfa 100644
+--- a/drivers/pci/setup-res.c
++++ b/drivers/pci/setup-res.c
+@@ -25,21 +25,18 @@
+ #include <linux/slab.h>
+ #include "pci.h"
+ 
+-
+-void pci_update_resource(struct pci_dev *dev, int resno)
++static void pci_std_update_resource(struct pci_dev *dev, int resno)
+ {
+ 	struct pci_bus_region region;
+ 	bool disable;
+ 	u16 cmd;
+ 	u32 new, check, mask;
+ 	int reg;
+-	enum pci_bar_type type;
+ 	struct resource *res = dev->resource + resno;
+ 
+-	if (dev->is_virtfn) {
+-		dev_warn(&dev->dev, "can't update VF BAR%d\n", resno);
++	/* Per SR-IOV spec 3.4.1.11, VF BARs are RO zero */
++	if (dev->is_virtfn)
+ 		return;
+-	}
+ 
+ 	/*
+ 	 * Ignore resources for unimplemented BARs and unused resource slots
+@@ -60,21 +57,34 @@ void pci_update_resource(struct pci_dev *dev, int resno)
+ 		return;
+ 
+ 	pcibios_resource_to_bus(dev->bus, &region, res);
++	new = region.start;
+ 
+-	new = region.start | (res->flags & PCI_REGION_FLAG_MASK);
+-	if (res->flags & IORESOURCE_IO)
++	if (res->flags & IORESOURCE_IO) {
+ 		mask = (u32)PCI_BASE_ADDRESS_IO_MASK;
+-	else
++		new |= res->flags & ~PCI_BASE_ADDRESS_IO_MASK;
++	} else if (resno == PCI_ROM_RESOURCE) {
++		mask = (u32)PCI_ROM_ADDRESS_MASK;
++	} else {
+ 		mask = (u32)PCI_BASE_ADDRESS_MEM_MASK;
++		new |= res->flags & ~PCI_BASE_ADDRESS_MEM_MASK;
++	}
+ 
+-	reg = pci_resource_bar(dev, resno, &type);
+-	if (!reg)
+-		return;
+-	if (type != pci_bar_unknown) {
++	if (resno < PCI_ROM_RESOURCE) {
++		reg = PCI_BASE_ADDRESS_0 + 4 * resno;
++	} else if (resno == PCI_ROM_RESOURCE) {
++
++		/*
++		 * Apparently some Matrox devices have ROM BARs that read
++		 * as zero when disabled, so don't update ROM BARs unless
++		 * they're enabled.  See https://lkml.org/lkml/2005/8/30/138.
++		 */
+ 		if (!(res->flags & IORESOURCE_ROM_ENABLE))
+ 			return;
++
++		reg = dev->rom_base_reg;
+ 		new |= PCI_ROM_ADDRESS_ENABLE;
+-	}
++	} else
++		return;
+ 
+ 	/*
+ 	 * We can't update a 64-bit BAR atomically, so when possible,
+@@ -110,6 +120,16 @@ void pci_update_resource(struct pci_dev *dev, int resno)
+ 		pci_write_config_word(dev, PCI_COMMAND, cmd);
+ }
+ 
++void pci_update_resource(struct pci_dev *dev, int resno)
++{
++	if (resno <= PCI_ROM_RESOURCE)
++		pci_std_update_resource(dev, resno);
++#ifdef CONFIG_PCI_IOV
++	else if (resno >= PCI_IOV_RESOURCES && resno <= PCI_IOV_RESOURCE_END)
++		pci_iov_update_resource(dev, resno);
++#endif
++}
++
+ int pci_claim_resource(struct pci_dev *dev, int resource)
+ {
+ 	struct resource *res = &dev->resource[resource];
+diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
+index 24ec282e15d8..7c3b8d3516e3 100644
+--- a/drivers/s390/crypto/ap_bus.c
++++ b/drivers/s390/crypto/ap_bus.c
+@@ -1651,6 +1651,9 @@ static void ap_scan_bus(struct work_struct *unused)
+ 		ap_dev->queue_depth = queue_depth;
+ 		ap_dev->raw_hwtype = device_type;
+ 		ap_dev->device_type = device_type;
++		/* CEX6 toleration: map to CEX5 */
++		if (device_type == AP_DEVICE_TYPE_CEX6)
++			ap_dev->device_type = AP_DEVICE_TYPE_CEX5;
+ 		ap_dev->functions = device_functions;
+ 		spin_lock_init(&ap_dev->lock);
+ 		INIT_LIST_HEAD(&ap_dev->pendingq);
+diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
+index 6adcbdf225d1..cc741e948170 100644
+--- a/drivers/s390/crypto/ap_bus.h
++++ b/drivers/s390/crypto/ap_bus.h
+@@ -105,6 +105,7 @@ static inline int ap_test_bit(unsigned int *ptr, unsigned int nr)
+ #define AP_DEVICE_TYPE_CEX3C	9
+ #define AP_DEVICE_TYPE_CEX4	10
+ #define AP_DEVICE_TYPE_CEX5	11
++#define AP_DEVICE_TYPE_CEX6	12
+ 
+ /*
+  * Known function facilities
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index 5b24ffd93649..83ff1724ec79 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -57,6 +57,7 @@ struct serial_private {
+ 	unsigned int		nr;
+ 	void __iomem		*remapped_bar[PCI_NUM_BAR_RESOURCES];
+ 	struct pci_serial_quirk	*quirk;
++	const struct pciserial_board *board;
+ 	int			line[0];
+ };
+ 
+@@ -4058,6 +4059,7 @@ pciserial_init_ports(struct pci_dev *dev, const struct pciserial_board *board)
+ 		}
+ 	}
+ 	priv->nr = i;
++	priv->board = board;
+ 	return priv;
+ 
+ err_deinit:
+@@ -4068,7 +4070,7 @@ err_out:
+ }
+ EXPORT_SYMBOL_GPL(pciserial_init_ports);
+ 
+-void pciserial_remove_ports(struct serial_private *priv)
++void pciserial_detach_ports(struct serial_private *priv)
+ {
+ 	struct pci_serial_quirk *quirk;
+ 	int i;
+@@ -4088,7 +4090,11 @@ void pciserial_remove_ports(struct serial_private *priv)
+ 	quirk = find_quirk(priv->dev);
+ 	if (quirk->exit)
+ 		quirk->exit(priv->dev);
++}
+ 
++void pciserial_remove_ports(struct serial_private *priv)
++{
++	pciserial_detach_ports(priv);
+ 	kfree(priv);
+ }
+ EXPORT_SYMBOL_GPL(pciserial_remove_ports);
+@@ -5819,7 +5825,7 @@ static pci_ers_result_t serial8250_io_error_detected(struct pci_dev *dev,
+ 		return PCI_ERS_RESULT_DISCONNECT;
+ 
+ 	if (priv)
+-		pciserial_suspend_ports(priv);
++		pciserial_detach_ports(priv);
+ 
+ 	pci_disable_device(dev);
+ 
+@@ -5844,9 +5850,18 @@ static pci_ers_result_t serial8250_io_slot_reset(struct pci_dev *dev)
+ static void serial8250_io_resume(struct pci_dev *dev)
+ {
+ 	struct serial_private *priv = pci_get_drvdata(dev);
++	const struct pciserial_board *board;
+ 
+-	if (priv)
+-		pciserial_resume_ports(priv);
++	if (!priv)
++		return;
++
++	board = priv->board;
++	kfree(priv);
++	priv = pciserial_init_ports(dev, board);
++
++	if (!IS_ERR(priv)) {
++		pci_set_drvdata(dev, priv);
++	}
+ }
+ 
+ static const struct pci_error_handlers serial8250_err_handler = {
+diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
+index deaddb950c20..24337ac3323f 100644
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -1105,7 +1105,7 @@ static int usbtmc_probe(struct usb_interface *intf,
+ 
+ 	dev_dbg(&intf->dev, "%s called\n", __func__);
+ 
+-	data = kmalloc(sizeof(*data), GFP_KERNEL);
++	data = kzalloc(sizeof(*data), GFP_KERNEL);
+ 	if (!data)
+ 		return -ENOMEM;
+ 
+@@ -1163,6 +1163,12 @@ static int usbtmc_probe(struct usb_interface *intf,
+ 		}
+ 	}
+ 
++	if (!data->bulk_out || !data->bulk_in) {
++		dev_err(&intf->dev, "bulk endpoints not found\n");
++		retcode = -ENODEV;
++		goto err_put;
++	}
++
+ 	retcode = get_capabilities(data);
+ 	if (retcode)
+ 		dev_err(&intf->dev, "can't read capabilities\n");
+@@ -1186,6 +1192,7 @@ static int usbtmc_probe(struct usb_interface *intf,
+ error_register:
+ 	sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp);
+ 	sysfs_remove_group(&intf->dev.kobj, &data_attr_grp);
++err_put:
+ 	kref_put(&data->kref, usbtmc_delete);
+ 	return retcode;
+ }
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index ac30a051ad71..325cbc9c35d8 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -246,6 +246,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+ 
+ 			/*
+ 			 * Adjust bInterval for quirked devices.
++			 */
++			/*
++			 * This quirk fixes bIntervals reported in ms.
++			 */
++			if (to_usb_device(ddev)->quirks &
++				USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL) {
++				n = clamp(fls(d->bInterval) + 3, i, j);
++				i = j = n;
++			}
++			/*
+ 			 * This quirk fixes bIntervals reported in
+ 			 * linear microframes.
+ 			 */
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index f52d8abf6979..9e62c93af96e 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -4199,7 +4199,7 @@ static void hub_set_initial_usb2_lpm_policy(struct usb_device *udev)
+ 	struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent);
+ 	int connect_type = USB_PORT_CONNECT_TYPE_UNKNOWN;
+ 
+-	if (!udev->usb2_hw_lpm_capable)
++	if (!udev->usb2_hw_lpm_capable || !udev->bos)
+ 		return;
+ 
+ 	if (hub)
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 24f9f98968a5..96b21b0dac1e 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -170,6 +170,14 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* M-Systems Flash Disk Pioneers */
+ 	{ USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
++	/* Baum Vario Ultra */
++	{ USB_DEVICE(0x0904, 0x6101), .driver_info =
++			USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
++	{ USB_DEVICE(0x0904, 0x6102), .driver_info =
++			USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
++	{ USB_DEVICE(0x0904, 0x6103), .driver_info =
++			USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
++
+ 	/* Keytouch QWERTY Panel keyboard */
+ 	{ USB_DEVICE(0x0926, 0x3333), .driver_info =
+ 			USB_QUIRK_CONFIG_INTF_STRINGS },
+diff --git a/drivers/usb/gadget/function/f_acm.c b/drivers/usb/gadget/function/f_acm.c
+index 2fa1e80a3ce7..67e474b13fca 100644
+--- a/drivers/usb/gadget/function/f_acm.c
++++ b/drivers/usb/gadget/function/f_acm.c
+@@ -535,13 +535,15 @@ static int acm_notify_serial_state(struct f_acm *acm)
+ {
+ 	struct usb_composite_dev *cdev = acm->port.func.config->cdev;
+ 	int			status;
++	__le16			serial_state;
+ 
+ 	spin_lock(&acm->lock);
+ 	if (acm->notify_req) {
+ 		dev_dbg(&cdev->gadget->dev, "acm ttyGS%d serial state %04x\n",
+ 			acm->port_num, acm->serial_state);
++		serial_state = cpu_to_le16(acm->serial_state);
+ 		status = acm_cdc_notify(acm, USB_CDC_NOTIFY_SERIAL_STATE,
+-				0, &acm->serial_state, sizeof(acm->serial_state));
++				0, &serial_state, sizeof(acm->serial_state));
+ 	} else {
+ 		acm->pending = true;
+ 		status = 0;
+diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
+index 29b41b5dee04..c7689d05356c 100644
+--- a/drivers/usb/gadget/function/f_uvc.c
++++ b/drivers/usb/gadget/function/f_uvc.c
+@@ -625,7 +625,7 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
+ 	uvc_ss_streaming_comp.bMaxBurst = opts->streaming_maxburst;
+ 	uvc_ss_streaming_comp.wBytesPerInterval =
+ 		cpu_to_le16(max_packet_size * max_packet_mult *
+-			    opts->streaming_maxburst);
++			    (opts->streaming_maxburst + 1));
+ 
+ 	/* Allocate endpoints. */
+ 	ep = usb_ep_autoconfig(cdev->gadget, &uvc_control_ep);
+diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c
+index 4e38683c653c..6d4e75785710 100644
+--- a/drivers/usb/misc/idmouse.c
++++ b/drivers/usb/misc/idmouse.c
+@@ -346,6 +346,9 @@ static int idmouse_probe(struct usb_interface *interface,
+ 	if (iface_desc->desc.bInterfaceClass != 0x0A)
+ 		return -ENODEV;
+ 
++	if (iface_desc->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	/* allocate memory for our device state and initialize it */
+ 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+ 	if (dev == NULL)
+diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c
+index 86b4e4b2ab9a..383fa007348f 100644
+--- a/drivers/usb/misc/lvstest.c
++++ b/drivers/usb/misc/lvstest.c
+@@ -370,6 +370,10 @@ static int lvs_rh_probe(struct usb_interface *intf,
+ 
+ 	hdev = interface_to_usbdev(intf);
+ 	desc = intf->cur_altsetting;
++
++	if (desc->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	endpoint = &desc->endpoint[0].desc;
+ 
+ 	/* valid only for SS root hub */
+diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
+index bbd029c9c725..442b6631162e 100644
+--- a/drivers/usb/misc/uss720.c
++++ b/drivers/usb/misc/uss720.c
+@@ -711,6 +711,11 @@ static int uss720_probe(struct usb_interface *intf,
+ 
+ 	interface = intf->cur_altsetting;
+ 
++	if (interface->desc.bNumEndpoints < 3) {
++		usb_put_dev(usbdev);
++		return -ENODEV;
++	}
++
+ 	/*
+ 	 * Allocate parport interface 
+ 	 */
+diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
+index e499b862a946..88f26ac2a185 100644
+--- a/drivers/usb/musb/musb_cppi41.c
++++ b/drivers/usb/musb/musb_cppi41.c
+@@ -250,8 +250,27 @@ static void cppi41_dma_callback(void *private_data)
+ 			transferred < cppi41_channel->packet_sz)
+ 		cppi41_channel->prog_len = 0;
+ 
+-	if (cppi41_channel->is_tx)
+-		empty = musb_is_tx_fifo_empty(hw_ep);
++	if (cppi41_channel->is_tx) {
++		u8 type;
++
++		if (is_host_active(musb))
++			type = hw_ep->out_qh->type;
++		else
++			type = hw_ep->ep_in.type;
++
++		if (type == USB_ENDPOINT_XFER_ISOC)
++			/*
++			 * Don't use the early-TX-interrupt workaround below
++			 * for Isoch transfter. Since Isoch are periodic
++			 * transfer, by the time the next transfer is
++			 * scheduled, the current one should be done already.
++			 *
++			 * This avoids audio playback underrun issue.
++			 */
++			empty = true;
++		else
++			empty = musb_is_tx_fifo_empty(hw_ep);
++	}
+ 
+ 	if (!cppi41_channel->is_tx || empty) {
+ 		cppi41_trans_done(cppi41_channel);
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 42cc72e54c05..af67a0de6b5d 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -233,6 +233,14 @@ static void option_instat_callback(struct urb *urb);
+ #define BANDRICH_PRODUCT_1012			0x1012
+ 
+ #define QUALCOMM_VENDOR_ID			0x05C6
++/* These Quectel products use Qualcomm's vendor ID */
++#define QUECTEL_PRODUCT_UC20			0x9003
++#define QUECTEL_PRODUCT_UC15			0x9090
++
++#define QUECTEL_VENDOR_ID			0x2c7c
++/* These Quectel products use Quectel's vendor ID */
++#define QUECTEL_PRODUCT_EC21			0x0121
++#define QUECTEL_PRODUCT_EC25			0x0125
+ 
+ #define CMOTECH_VENDOR_ID			0x16d8
+ #define CMOTECH_PRODUCT_6001			0x6001
+@@ -1161,7 +1169,14 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+-	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9003), /* Quectel UC20 */
++	/* Quectel products using Qualcomm vendor ID */
++	{ USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
++	{ USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
++	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	/* Quectel products using Quectel vendor ID */
++	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
++	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25),
+ 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index 696458db7e3c..38b3f0d8cd58 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -169,6 +169,8 @@ static const struct usb_device_id id_table[] = {
+ 	{DEVICE_SWI(0x413c, 0x81a9)},	/* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
+ 	{DEVICE_SWI(0x413c, 0x81b1)},	/* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */
+ 	{DEVICE_SWI(0x413c, 0x81b3)},	/* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
++	{DEVICE_SWI(0x413c, 0x81b5)},	/* Dell Wireless 5811e QDL */
++	{DEVICE_SWI(0x413c, 0x81b6)},	/* Dell Wireless 5811e QDL */
+ 
+ 	/* Huawei devices */
+ 	{DEVICE_HWI(0x03f0, 0x581d)},	/* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
+diff --git a/drivers/usb/wusbcore/wa-hc.c b/drivers/usb/wusbcore/wa-hc.c
+index 252c7bd9218a..d01496fd27fe 100644
+--- a/drivers/usb/wusbcore/wa-hc.c
++++ b/drivers/usb/wusbcore/wa-hc.c
+@@ -39,6 +39,9 @@ int wa_create(struct wahc *wa, struct usb_interface *iface,
+ 	int result;
+ 	struct device *dev = &iface->dev;
+ 
++	if (iface->cur_altsetting->desc.bNumEndpoints < 3)
++		return -ENODEV;
++
+ 	result = wa_rpipes_create(wa);
+ 	if (result < 0)
+ 		goto error_rpipes_create;
+diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
+index 0257f35cfb9d..e75bbe5a10cd 100644
+--- a/drivers/uwb/hwa-rc.c
++++ b/drivers/uwb/hwa-rc.c
+@@ -825,6 +825,9 @@ static int hwarc_probe(struct usb_interface *iface,
+ 	struct hwarc *hwarc;
+ 	struct device *dev = &iface->dev;
+ 
++	if (iface->cur_altsetting->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	result = -ENOMEM;
+ 	uwb_rc = uwb_rc_alloc();
+ 	if (uwb_rc == NULL) {
+diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c
+index 2bfc846ac071..6345e85822a4 100644
+--- a/drivers/uwb/i1480/dfu/usb.c
++++ b/drivers/uwb/i1480/dfu/usb.c
+@@ -362,6 +362,9 @@ int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
+ 				 result);
+ 	}
+ 
++	if (iface->cur_altsetting->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	result = -ENOMEM;
+ 	i1480_usb = kzalloc(sizeof(*i1480_usb), GFP_KERNEL);
+ 	if (i1480_usb == NULL) {
+diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
+index 0582b72ef377..1a9f18b40be6 100644
+--- a/drivers/vfio/vfio_iommu_spapr_tce.c
++++ b/drivers/vfio/vfio_iommu_spapr_tce.c
+@@ -511,6 +511,12 @@ static long tce_iommu_build_v2(struct tce_container *container,
+ 	unsigned long hpa;
+ 	enum dma_data_direction dirtmp;
+ 
++	if (!tbl->it_userspace) {
++		ret = tce_iommu_userspace_view_alloc(tbl);
++		if (ret)
++			return ret;
++	}
++
+ 	for (i = 0; i < pages; ++i) {
+ 		struct mm_iommu_table_group_mem_t *mem = NULL;
+ 		unsigned long *pua = IOMMU_TABLE_USERSPACE_ENTRY(tbl,
+@@ -584,15 +590,6 @@ static long tce_iommu_create_table(struct tce_container *container,
+ 	WARN_ON(!ret && !(*ptbl)->it_ops->free);
+ 	WARN_ON(!ret && ((*ptbl)->it_allocated_size != table_size));
+ 
+-	if (!ret && container->v2) {
+-		ret = tce_iommu_userspace_view_alloc(*ptbl);
+-		if (ret)
+-			(*ptbl)->it_ops->free(*ptbl);
+-	}
+-
+-	if (ret)
+-		decrement_locked_vm(table_size >> PAGE_SHIFT);
+-
+ 	return ret;
+ }
+ 
+@@ -1064,10 +1061,7 @@ static int tce_iommu_take_ownership(struct tce_container *container,
+ 		if (!tbl || !tbl->it_map)
+ 			continue;
+ 
+-		rc = tce_iommu_userspace_view_alloc(tbl);
+-		if (!rc)
+-			rc = iommu_take_ownership(tbl);
+-
++		rc = iommu_take_ownership(tbl);
+ 		if (rc) {
+ 			for (j = 0; j < i; ++j)
+ 				iommu_release_ownership(
+diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
+index 6e92917ba77a..4e3c78d88832 100644
+--- a/drivers/video/console/fbcon.c
++++ b/drivers/video/console/fbcon.c
+@@ -1168,6 +1168,8 @@ static void fbcon_free_font(struct display *p, bool freefont)
+ 	p->userfont = 0;
+ }
+ 
++static void set_vc_hi_font(struct vc_data *vc, bool set);
++
+ static void fbcon_deinit(struct vc_data *vc)
+ {
+ 	struct display *p = &fb_display[vc->vc_num];
+@@ -1203,6 +1205,9 @@ finished:
+ 	if (free_font)
+ 		vc->vc_font.data = NULL;
+ 
++	if (vc->vc_hi_font_mask)
++		set_vc_hi_font(vc, false);
++
+ 	if (!con_is_bound(&fb_con))
+ 		fbcon_exit();
+ 
+@@ -2439,32 +2444,10 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
+ 	return 0;
+ }
+ 
+-static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
+-			     const u8 * data, int userfont)
++/* set/clear vc_hi_font_mask and update vc attrs accordingly */
++static void set_vc_hi_font(struct vc_data *vc, bool set)
+ {
+-	struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
+-	struct fbcon_ops *ops = info->fbcon_par;
+-	struct display *p = &fb_display[vc->vc_num];
+-	int resize;
+-	int cnt;
+-	char *old_data = NULL;
+-
+-	if (CON_IS_VISIBLE(vc) && softback_lines)
+-		fbcon_set_origin(vc);
+-
+-	resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);
+-	if (p->userfont)
+-		old_data = vc->vc_font.data;
+-	if (userfont)
+-		cnt = FNTCHARCNT(data);
+-	else
+-		cnt = 256;
+-	vc->vc_font.data = (void *)(p->fontdata = data);
+-	if ((p->userfont = userfont))
+-		REFCOUNT(data)++;
+-	vc->vc_font.width = w;
+-	vc->vc_font.height = h;
+-	if (vc->vc_hi_font_mask && cnt == 256) {
++	if (!set) {
+ 		vc->vc_hi_font_mask = 0;
+ 		if (vc->vc_can_do_color) {
+ 			vc->vc_complement_mask >>= 1;
+@@ -2487,7 +2470,7 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
+ 			    ((c & 0xfe00) >> 1) | (c & 0xff);
+ 			vc->vc_attr >>= 1;
+ 		}
+-	} else if (!vc->vc_hi_font_mask && cnt == 512) {
++	} else {
+ 		vc->vc_hi_font_mask = 0x100;
+ 		if (vc->vc_can_do_color) {
+ 			vc->vc_complement_mask <<= 1;
+@@ -2519,8 +2502,38 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
+ 			} else
+ 				vc->vc_video_erase_char = c & ~0x100;
+ 		}
+-
+ 	}
++}
++
++static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
++			     const u8 * data, int userfont)
++{
++	struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
++	struct fbcon_ops *ops = info->fbcon_par;
++	struct display *p = &fb_display[vc->vc_num];
++	int resize;
++	int cnt;
++	char *old_data = NULL;
++
++	if (CON_IS_VISIBLE(vc) && softback_lines)
++		fbcon_set_origin(vc);
++
++	resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);
++	if (p->userfont)
++		old_data = vc->vc_font.data;
++	if (userfont)
++		cnt = FNTCHARCNT(data);
++	else
++		cnt = 256;
++	vc->vc_font.data = (void *)(p->fontdata = data);
++	if ((p->userfont = userfont))
++		REFCOUNT(data)++;
++	vc->vc_font.width = w;
++	vc->vc_font.height = h;
++	if (vc->vc_hi_font_mask && cnt == 256)
++		set_vc_hi_font(vc, false);
++	else if (!vc->vc_hi_font_mask && cnt == 512)
++		set_vc_hi_font(vc, true);
+ 
+ 	if (resize) {
+ 		int cols, rows;
+diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
+index 611f9c11da85..2e319d0c395d 100644
+--- a/drivers/xen/xen-acpi-processor.c
++++ b/drivers/xen/xen-acpi-processor.c
+@@ -27,10 +27,10 @@
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/types.h>
++#include <linux/syscore_ops.h>
+ #include <linux/acpi.h>
+ #include <acpi/processor.h>
+ #include <xen/xen.h>
+-#include <xen/xen-ops.h>
+ #include <xen/interface/platform.h>
+ #include <asm/xen/hypercall.h>
+ 
+@@ -466,15 +466,33 @@ static int xen_upload_processor_pm_data(void)
+ 	return rc;
+ }
+ 
+-static int xen_acpi_processor_resume(struct notifier_block *nb,
+-				     unsigned long action, void *data)
++static void xen_acpi_processor_resume_worker(struct work_struct *dummy)
+ {
++	int rc;
++
+ 	bitmap_zero(acpi_ids_done, nr_acpi_bits);
+-	return xen_upload_processor_pm_data();
++
++	rc = xen_upload_processor_pm_data();
++	if (rc != 0)
++		pr_info("ACPI data upload failed, error = %d\n", rc);
++}
++
++static void xen_acpi_processor_resume(void)
++{
++	static DECLARE_WORK(wq, xen_acpi_processor_resume_worker);
++
++	/*
++	 * xen_upload_processor_pm_data() calls non-atomic code.
++	 * However, the context for xen_acpi_processor_resume is syscore
++	 * with only the boot CPU online and in an atomic context.
++	 *
++	 * So defer the upload for some point safer.
++	 */
++	schedule_work(&wq);
+ }
+ 
+-struct notifier_block xen_acpi_processor_resume_nb = {
+-	.notifier_call = xen_acpi_processor_resume,
++static struct syscore_ops xap_syscore_ops = {
++	.resume	= xen_acpi_processor_resume,
+ };
+ 
+ static int __init xen_acpi_processor_init(void)
+@@ -527,7 +545,7 @@ static int __init xen_acpi_processor_init(void)
+ 	if (rc)
+ 		goto err_unregister;
+ 
+-	xen_resume_notifier_register(&xen_acpi_processor_resume_nb);
++	register_syscore_ops(&xap_syscore_ops);
+ 
+ 	return 0;
+ err_unregister:
+@@ -544,7 +562,7 @@ static void __exit xen_acpi_processor_exit(void)
+ {
+ 	int i;
+ 
+-	xen_resume_notifier_unregister(&xen_acpi_processor_resume_nb);
++	unregister_syscore_ops(&xap_syscore_ops);
+ 	kfree(acpi_ids_done);
+ 	kfree(acpi_id_present);
+ 	kfree(acpi_id_cst_present);
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index d4be4e23bc21..dad8e7bdf0a6 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1158,10 +1158,9 @@ static int ext4_finish_convert_inline_dir(handle_t *handle,
+ 	set_buffer_uptodate(dir_block);
+ 	err = ext4_handle_dirty_dirent_node(handle, inode, dir_block);
+ 	if (err)
+-		goto out;
++		return err;
+ 	set_buffer_verified(dir_block);
+-out:
+-	return err;
++	return ext4_mark_inode_dirty(handle, inode);
+ }
+ 
+ static int ext4_convert_inline_data_nolock(handle_t *handle,
+diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
+index 1aabfda669b0..7183b7ea065b 100644
+--- a/fs/xfs/libxfs/xfs_inode_buf.c
++++ b/fs/xfs/libxfs/xfs_inode_buf.c
+@@ -299,6 +299,14 @@ xfs_dinode_verify(
+ 	if (dip->di_magic != cpu_to_be16(XFS_DINODE_MAGIC))
+ 		return false;
+ 
++	/* don't allow invalid i_size */
++	if (be64_to_cpu(dip->di_size) & (1ULL << 63))
++		return false;
++
++	/* No zero-length symlinks. */
++	if (S_ISLNK(be16_to_cpu(dip->di_mode)) && dip->di_size == 0)
++		return false;
++
+ 	/* only version 3 or greater inodes are extensively verified here */
+ 	if (dip->di_version < 3)
+ 		return true;
+diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
+index dbae6490a79a..832764ee035a 100644
+--- a/fs/xfs/xfs_bmap_util.c
++++ b/fs/xfs/xfs_bmap_util.c
+@@ -1713,6 +1713,7 @@ xfs_swap_extents(
+ 	xfs_trans_t	*tp;
+ 	xfs_bstat_t	*sbp = &sxp->sx_stat;
+ 	xfs_ifork_t	*tempifp, *ifp, *tifp;
++	xfs_extnum_t	nextents;
+ 	int		src_log_flags, target_log_flags;
+ 	int		error = 0;
+ 	int		aforkblks = 0;
+@@ -1899,7 +1900,8 @@ xfs_swap_extents(
+ 		 * pointer.  Otherwise it's already NULL or
+ 		 * pointing to the extent.
+ 		 */
+-		if (ip->i_d.di_nextents <= XFS_INLINE_EXTS) {
++		nextents = ip->i_df.if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
++		if (nextents <= XFS_INLINE_EXTS) {
+ 			ifp->if_u1.if_extents =
+ 				ifp->if_u2.if_inline_ext;
+ 		}
+@@ -1918,7 +1920,8 @@ xfs_swap_extents(
+ 		 * pointer.  Otherwise it's already NULL or
+ 		 * pointing to the extent.
+ 		 */
+-		if (tip->i_d.di_nextents <= XFS_INLINE_EXTS) {
++		nextents = tip->i_df.if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
++		if (nextents <= XFS_INLINE_EXTS) {
+ 			tifp->if_u1.if_extents =
+ 				tifp->if_u2.if_inline_ext;
+ 		}
+diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
+index eb1b8c8acfcb..8146b0cf20ce 100644
+--- a/fs/xfs/xfs_buf.c
++++ b/fs/xfs/xfs_buf.c
+@@ -375,6 +375,7 @@ retry:
+ out_free_pages:
+ 	for (i = 0; i < bp->b_page_count; i++)
+ 		__free_page(bp->b_pages[i]);
++	bp->b_flags &= ~_XBF_PAGES;
+ 	return error;
+ }
+ 
+diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
+index 1d0043dc34e4..de2a722fe3cf 100644
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -50,4 +50,10 @@
+ /* device can't handle Link Power Management */
+ #define USB_QUIRK_NO_LPM			BIT(10)
+ 
++/*
++ * Device reports its bInterval as linear frames instead of the
++ * USB 2.0 calculation.
++ */
++#define USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL	BIT(11)
++
+ #endif /* __LINUX_USB_QUIRKS_H */
+diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
+index ddc3573894b0..bc95e48d5cfb 100644
+--- a/net/ceph/osdmap.c
++++ b/net/ceph/osdmap.c
+@@ -1265,7 +1265,6 @@ static int decode_new_up_state_weight(void **p, void *end,
+ 		if ((map->osd_state[osd] & CEPH_OSD_EXISTS) &&
+ 		    (xorstate & CEPH_OSD_EXISTS)) {
+ 			pr_info("osd%d does not exist\n", osd);
+-			map->osd_weight[osd] = CEPH_OSD_IN;
+ 			ret = set_primary_affinity(map, osd,
+ 						   CEPH_OSD_DEFAULT_PRIMARY_AFFINITY);
+ 			if (ret)
+diff --git a/net/core/sock.c b/net/core/sock.c
+index f4c0917e66b5..9c708a5fb751 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1459,6 +1459,11 @@ void sk_destruct(struct sock *sk)
+ 		pr_debug("%s: optmem leakage (%d bytes) detected\n",
+ 			 __func__, atomic_read(&sk->sk_omem_alloc));
+ 
++	if (sk->sk_frag.page) {
++		put_page(sk->sk_frag.page);
++		sk->sk_frag.page = NULL;
++	}
++
+ 	if (sk->sk_peer_cred)
+ 		put_cred(sk->sk_peer_cred);
+ 	put_pid(sk->sk_peer_pid);
+@@ -1552,6 +1557,12 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
+ 			is_charged = sk_filter_charge(newsk, filter);
+ 
+ 		if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) {
++			/* We need to make sure that we don't uncharge the new
++			 * socket if we couldn't charge it in the first place
++			 * as otherwise we uncharge the parent's filter.
++			 */
++			if (!is_charged)
++				RCU_INIT_POINTER(newsk->sk_filter, NULL);
+ 			/* It is still raw copy of parent, so invalidate
+ 			 * destructor and make plain sk_free() */
+ 			newsk->sk_destruct = NULL;
+@@ -2691,11 +2702,6 @@ void sk_common_release(struct sock *sk)
+ 
+ 	sk_refcnt_debug_release(sk);
+ 
+-	if (sk->sk_frag.page) {
+-		put_page(sk->sk_frag.page);
+-		sk->sk_frag.page = NULL;
+-	}
+-
+ 	sock_put(sk);
+ }
+ EXPORT_SYMBOL(sk_common_release);
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index 4e60dae86df5..1adba44f8fbc 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -1080,7 +1080,8 @@ static void nl_fib_input(struct sk_buff *skb)
+ 
+ 	net = sock_net(skb->sk);
+ 	nlh = nlmsg_hdr(skb);
+-	if (skb->len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len ||
++	if (skb->len < nlmsg_total_size(sizeof(*frn)) ||
++	    skb->len < nlh->nlmsg_len ||
+ 	    nlmsg_len(nlh) < sizeof(*frn))
+ 		return;
+ 
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 7cc0f8aac28f..818630cec54f 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -5435,6 +5435,7 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb)
+ 	struct inet_connection_sock *icsk = inet_csk(sk);
+ 
+ 	tcp_set_state(sk, TCP_ESTABLISHED);
++	icsk->icsk_ack.lrcvtime = tcp_time_stamp;
+ 
+ 	if (skb) {
+ 		icsk->icsk_af_ops->sk_rx_dst_set(sk, skb);
+@@ -5647,7 +5648,6 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
+ 			 * to stand against the temptation 8)     --ANK
+ 			 */
+ 			inet_csk_schedule_ack(sk);
+-			icsk->icsk_ack.lrcvtime = tcp_time_stamp;
+ 			tcp_enter_quickack_mode(sk);
+ 			inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
+ 						  TCP_DELACK_MAX, TCP_RTO_MAX);
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index 9475a2748a9a..019db68bdb9f 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -472,6 +472,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
+ 		newtp->mdev_us = jiffies_to_usecs(TCP_TIMEOUT_INIT);
+ 		newtp->rtt_min[0].rtt = ~0U;
+ 		newicsk->icsk_rto = TCP_TIMEOUT_INIT;
++		newicsk->icsk_ack.lrcvtime = tcp_time_stamp;
+ 
+ 		newtp->packets_out = 0;
+ 		newtp->retrans_out = 0;
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index d1bd4a45ca2d..d26b28def310 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -588,7 +588,7 @@ static int ip_tun_from_nlattr(const struct nlattr *attr,
+ 			ipv4 = true;
+ 			break;
+ 		case OVS_TUNNEL_KEY_ATTR_IPV6_SRC:
+-			SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.dst,
++			SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.src,
+ 					nla_get_in6_addr(a), is_mask);
+ 			ipv6 = true;
+ 			break;
+diff --git a/net/unix/garbage.c b/net/unix/garbage.c
+index 6a0d48525fcf..c36757e72844 100644
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -146,6 +146,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp)
+ 	if (s) {
+ 		struct unix_sock *u = unix_sk(s);
+ 
++		BUG_ON(!atomic_long_read(&u->inflight));
+ 		BUG_ON(list_empty(&u->link));
+ 
+ 		if (atomic_long_dec_and_test(&u->inflight))
+@@ -341,6 +342,14 @@ void unix_gc(void)
+ 	}
+ 	list_del(&cursor);
+ 
++	/* Now gc_candidates contains only garbage.  Restore original
++	 * inflight counters for these as well, and remove the skbuffs
++	 * which are creating the cycle(s).
++	 */
++	skb_queue_head_init(&hitlist);
++	list_for_each_entry(u, &gc_candidates, link)
++		scan_children(&u->sk, inc_inflight, &hitlist);
++
+ 	/* not_cycle_list contains those sockets which do not make up a
+ 	 * cycle.  Restore these to the inflight list.
+ 	 */
+@@ -350,14 +359,6 @@ void unix_gc(void)
+ 		list_move_tail(&u->link, &gc_inflight_list);
+ 	}
+ 
+-	/* Now gc_candidates contains only garbage.  Restore original
+-	 * inflight counters for these as well, and remove the skbuffs
+-	 * which are creating the cycle(s).
+-	 */
+-	skb_queue_head_init(&hitlist);
+-	list_for_each_entry(u, &gc_candidates, link)
+-	scan_children(&u->sk, inc_inflight, &hitlist);
+-
+ 	spin_unlock(&unix_gc_lock);
+ 
+ 	/* Here we are. Hitlist is filled. Die. */
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 1f0de6d74daa..9d0953e5734f 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -492,21 +492,17 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
+ {
+ 	int err;
+ 
+-	rtnl_lock();
+-
+ 	if (!cb->args[0]) {
+ 		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
+ 				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
+ 				  nl80211_policy);
+ 		if (err)
+-			goto out_unlock;
++			return err;
+ 
+ 		*wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
+ 						   nl80211_fam.attrbuf);
+-		if (IS_ERR(*wdev)) {
+-			err = PTR_ERR(*wdev);
+-			goto out_unlock;
+-		}
++		if (IS_ERR(*wdev))
++			return PTR_ERR(*wdev);
+ 		*rdev = wiphy_to_rdev((*wdev)->wiphy);
+ 		/* 0 is the first index - add 1 to parse only once */
+ 		cb->args[0] = (*rdev)->wiphy_idx + 1;
+@@ -516,10 +512,8 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
+ 		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
+ 		struct wireless_dev *tmp;
+ 
+-		if (!wiphy) {
+-			err = -ENODEV;
+-			goto out_unlock;
+-		}
++		if (!wiphy)
++			return -ENODEV;
+ 		*rdev = wiphy_to_rdev(wiphy);
+ 		*wdev = NULL;
+ 
+@@ -530,21 +524,11 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
+ 			}
+ 		}
+ 
+-		if (!*wdev) {
+-			err = -ENODEV;
+-			goto out_unlock;
+-		}
++		if (!*wdev)
++			return -ENODEV;
+ 	}
+ 
+ 	return 0;
+- out_unlock:
+-	rtnl_unlock();
+-	return err;
+-}
+-
+-static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
+-{
+-	rtnl_unlock();
+ }
+ 
+ /* IE validation */
+@@ -3884,9 +3868,10 @@ static int nl80211_dump_station(struct sk_buff *skb,
+ 	int sta_idx = cb->args[2];
+ 	int err;
+ 
++	rtnl_lock();
+ 	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
+ 	if (err)
+-		return err;
++		goto out_err;
+ 
+ 	if (!wdev->netdev) {
+ 		err = -EINVAL;
+@@ -3922,7 +3907,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
+ 	cb->args[2] = sta_idx;
+ 	err = skb->len;
+  out_err:
+-	nl80211_finish_wdev_dump(rdev);
++	rtnl_unlock();
+ 
+ 	return err;
+ }
+@@ -4639,9 +4624,10 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
+ 	int path_idx = cb->args[2];
+ 	int err;
+ 
++	rtnl_lock();
+ 	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
+ 	if (err)
+-		return err;
++		goto out_err;
+ 
+ 	if (!rdev->ops->dump_mpath) {
+ 		err = -EOPNOTSUPP;
+@@ -4675,7 +4661,7 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
+ 	cb->args[2] = path_idx;
+ 	err = skb->len;
+  out_err:
+-	nl80211_finish_wdev_dump(rdev);
++	rtnl_unlock();
+ 	return err;
+ }
+ 
+@@ -4835,9 +4821,10 @@ static int nl80211_dump_mpp(struct sk_buff *skb,
+ 	int path_idx = cb->args[2];
+ 	int err;
+ 
++	rtnl_lock();
+ 	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
+ 	if (err)
+-		return err;
++		goto out_err;
+ 
+ 	if (!rdev->ops->dump_mpp) {
+ 		err = -EOPNOTSUPP;
+@@ -4870,7 +4857,7 @@ static int nl80211_dump_mpp(struct sk_buff *skb,
+ 	cb->args[2] = path_idx;
+ 	err = skb->len;
+  out_err:
+-	nl80211_finish_wdev_dump(rdev);
++	rtnl_unlock();
+ 	return err;
+ }
+ 
+@@ -6806,9 +6793,12 @@ static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
+ 	int start = cb->args[2], idx = 0;
+ 	int err;
+ 
++	rtnl_lock();
+ 	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
+-	if (err)
++	if (err) {
++		rtnl_unlock();
+ 		return err;
++	}
+ 
+ 	wdev_lock(wdev);
+ 	spin_lock_bh(&rdev->bss_lock);
+@@ -6831,7 +6821,7 @@ static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
+ 	wdev_unlock(wdev);
+ 
+ 	cb->args[2] = idx;
+-	nl80211_finish_wdev_dump(rdev);
++	rtnl_unlock();
+ 
+ 	return skb->len;
+ }
+@@ -6915,9 +6905,10 @@ static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
+ 	int res;
+ 	bool radio_stats;
+ 
++	rtnl_lock();
+ 	res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
+ 	if (res)
+-		return res;
++		goto out_err;
+ 
+ 	/* prepare_wdev_dump parsed the attributes */
+ 	radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
+@@ -6958,7 +6949,7 @@ static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
+ 	cb->args[2] = survey_idx;
+ 	res = skb->len;
+  out_err:
+-	nl80211_finish_wdev_dump(rdev);
++	rtnl_unlock();
+ 	return res;
+ }
+ 
+@@ -10158,17 +10149,13 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
+ 	void *data = NULL;
+ 	unsigned int data_len = 0;
+ 
+-	rtnl_lock();
+-
+ 	if (cb->args[0]) {
+ 		/* subtract the 1 again here */
+ 		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
+ 		struct wireless_dev *tmp;
+ 
+-		if (!wiphy) {
+-			err = -ENODEV;
+-			goto out_unlock;
+-		}
++		if (!wiphy)
++			return -ENODEV;
+ 		*rdev = wiphy_to_rdev(wiphy);
+ 		*wdev = NULL;
+ 
+@@ -10189,13 +10176,11 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
+ 			  nl80211_fam.attrbuf, nl80211_fam.maxattr,
+ 			  nl80211_policy);
+ 	if (err)
+-		goto out_unlock;
++		return err;
+ 
+ 	if (!nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID] ||
+-	    !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
+-		err = -EINVAL;
+-		goto out_unlock;
+-	}
++	    !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
++		return -EINVAL;
+ 
+ 	*wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
+ 					   nl80211_fam.attrbuf);
+@@ -10204,10 +10189,8 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
+ 
+ 	*rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
+ 					   nl80211_fam.attrbuf);
+-	if (IS_ERR(*rdev)) {
+-		err = PTR_ERR(*rdev);
+-		goto out_unlock;
+-	}
++	if (IS_ERR(*rdev))
++		return PTR_ERR(*rdev);
+ 
+ 	vid = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID]);
+ 	subcmd = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
+@@ -10220,19 +10203,15 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
+ 		if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
+ 			continue;
+ 
+-		if (!vcmd->dumpit) {
+-			err = -EOPNOTSUPP;
+-			goto out_unlock;
+-		}
++		if (!vcmd->dumpit)
++			return -EOPNOTSUPP;
+ 
+ 		vcmd_idx = i;
+ 		break;
+ 	}
+ 
+-	if (vcmd_idx < 0) {
+-		err = -EOPNOTSUPP;
+-		goto out_unlock;
+-	}
++	if (vcmd_idx < 0)
++		return -EOPNOTSUPP;
+ 
+ 	if (nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]) {
+ 		data = nla_data(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
+@@ -10249,9 +10228,6 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
+ 
+ 	/* keep rtnl locked in successful case */
+ 	return 0;
+- out_unlock:
+-	rtnl_unlock();
+-	return err;
+ }
+ 
+ static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
+@@ -10266,9 +10242,10 @@ static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
+ 	int err;
+ 	struct nlattr *vendor_data;
+ 
++	rtnl_lock();
+ 	err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
+ 	if (err)
+-		return err;
++		goto out;
+ 
+ 	vcmd_idx = cb->args[2];
+ 	data = (void *)cb->args[3];
+@@ -10277,18 +10254,26 @@ static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
+ 
+ 	if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
+ 			   WIPHY_VENDOR_CMD_NEED_NETDEV)) {
+-		if (!wdev)
+-			return -EINVAL;
++		if (!wdev) {
++			err = -EINVAL;
++			goto out;
++		}
+ 		if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
+-		    !wdev->netdev)
+-			return -EINVAL;
++		    !wdev->netdev) {
++			err = -EINVAL;
++			goto out;
++		}
+ 
+ 		if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
+ 			if (wdev->netdev &&
+-			    !netif_running(wdev->netdev))
+-				return -ENETDOWN;
+-			if (!wdev->netdev && !wdev->p2p_started)
+-				return -ENETDOWN;
++			    !netif_running(wdev->netdev)) {
++				err = -ENETDOWN;
++				goto out;
++			}
++			if (!wdev->netdev && !wdev->p2p_started) {
++				err = -ENETDOWN;
++				goto out;
++			}
+ 		}
+ 	}
+ 
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 58e79e02f217..c67f9c212dd1 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1921,6 +1921,7 @@ static int snd_seq_ioctl_set_client_pool(struct snd_seq_client *client,
+ 	     info.output_pool != client->pool->size)) {
+ 		if (snd_seq_write_pool_allocated(client)) {
+ 			/* remove all existing cells */
++			snd_seq_pool_mark_closing(client->pool);
+ 			snd_seq_queue_client_leave_cells(client->number);
+ 			snd_seq_pool_done(client->pool);
+ 		}
+diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
+index 86240d02b530..3f4efcb85df5 100644
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -70,6 +70,9 @@ void snd_seq_fifo_delete(struct snd_seq_fifo **fifo)
+ 		return;
+ 	*fifo = NULL;
+ 
++	if (f->pool)
++		snd_seq_pool_mark_closing(f->pool);
++
+ 	snd_seq_fifo_clear(f);
+ 
+ 	/* wake up clients if any */
+diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
+index dfa5156f3585..5847c4475bf3 100644
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -414,6 +414,18 @@ int snd_seq_pool_init(struct snd_seq_pool *pool)
+ 	return 0;
+ }
+ 
++/* refuse the further insertion to the pool */
++void snd_seq_pool_mark_closing(struct snd_seq_pool *pool)
++{
++	unsigned long flags;
++
++	if (snd_BUG_ON(!pool))
++		return;
++	spin_lock_irqsave(&pool->lock, flags);
++	pool->closing = 1;
++	spin_unlock_irqrestore(&pool->lock, flags);
++}
++
+ /* remove events */
+ int snd_seq_pool_done(struct snd_seq_pool *pool)
+ {
+@@ -424,10 +436,6 @@ int snd_seq_pool_done(struct snd_seq_pool *pool)
+ 		return -EINVAL;
+ 
+ 	/* wait for closing all threads */
+-	spin_lock_irqsave(&pool->lock, flags);
+-	pool->closing = 1;
+-	spin_unlock_irqrestore(&pool->lock, flags);
+-
+ 	if (waitqueue_active(&pool->output_sleep))
+ 		wake_up(&pool->output_sleep);
+ 
+@@ -484,6 +492,7 @@ int snd_seq_pool_delete(struct snd_seq_pool **ppool)
+ 	*ppool = NULL;
+ 	if (pool == NULL)
+ 		return 0;
++	snd_seq_pool_mark_closing(pool);
+ 	snd_seq_pool_done(pool);
+ 	kfree(pool);
+ 	return 0;
+diff --git a/sound/core/seq/seq_memory.h b/sound/core/seq/seq_memory.h
+index 4a2ec779b8a7..32f959c17786 100644
+--- a/sound/core/seq/seq_memory.h
++++ b/sound/core/seq/seq_memory.h
+@@ -84,6 +84,7 @@ static inline int snd_seq_total_cells(struct snd_seq_pool *pool)
+ int snd_seq_pool_init(struct snd_seq_pool *pool);
+ 
+ /* done pool - free events */
++void snd_seq_pool_mark_closing(struct snd_seq_pool *pool);
+ int snd_seq_pool_done(struct snd_seq_pool *pool);
+ 
+ /* create pool */
+diff --git a/sound/pci/ctxfi/cthw20k1.c b/sound/pci/ctxfi/cthw20k1.c
+index ab4cdab5cfa5..79edd88d5cd0 100644
+--- a/sound/pci/ctxfi/cthw20k1.c
++++ b/sound/pci/ctxfi/cthw20k1.c
+@@ -1905,7 +1905,7 @@ static int hw_card_start(struct hw *hw)
+ 		return err;
+ 
+ 	/* Set DMA transfer mask */
+-	if (dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
++	if (!dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
+ 		dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits));
+ 	} else {
+ 		dma_set_mask(&pci->dev, DMA_BIT_MASK(32));
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index cf0785ddbd14..1d4f34379f56 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6040,6 +6040,8 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ 		ALC295_STANDARD_PINS,
+ 		{0x17, 0x21014040},
+ 		{0x18, 0x21a19050}),
++	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
++		ALC295_STANDARD_PINS),
+ 	SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 		ALC298_STANDARD_PINS,
+ 		{0x17, 0x90170110}),