Gentoo Archives: gentoo-commits

From: Mike Pagano <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/linux-patches:4.4 commit in: /
Date: Wed, 29 Jan 2020 12:36:14
Message-Id: 1580301344.a96d7847b6078a1647ccdb098d313511cef950de.mpagano@gentoo
1 commit: a96d7847b6078a1647ccdb098d313511cef950de
2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
3 AuthorDate: Wed Jan 29 12:35:44 2020 +0000
4 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
5 CommitDate: Wed Jan 29 12:35:44 2020 +0000
6 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a96d7847
7
8 Linux patch 4.4.212
9
10 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
11
12 0000_README | 4 +
13 1211_linux-4.4.212.patch | 5145 ++++++++++++++++++++++++++++++++++++++++++++++
14 2 files changed, 5149 insertions(+)
15
16 diff --git a/0000_README b/0000_README
17 index 8e923ff..17859bd 100644
18 --- a/0000_README
19 +++ b/0000_README
20 @@ -887,6 +887,10 @@ Patch: 1210_linux-4.4.211.patch
21 From: http://www.kernel.org
22 Desc: Linux 4.4.211
23
24 +Patch: 1211_linux-4.4.212.patch
25 +From: http://www.kernel.org
26 +Desc: Linux 4.4.212
27 +
28 Patch: 1500_XATTR_USER_PREFIX.patch
29 From: https://bugs.gentoo.org/show_bug.cgi?id=470644
30 Desc: Support for namespace user.pax.* on tmpfs.
31
32 diff --git a/1211_linux-4.4.212.patch b/1211_linux-4.4.212.patch
33 new file mode 100644
34 index 0000000..150526f
35 --- /dev/null
36 +++ b/1211_linux-4.4.212.patch
37 @@ -0,0 +1,5145 @@
38 +diff --git a/Makefile b/Makefile
39 +index 9f03733dac69..379f2a525c02 100644
40 +--- a/Makefile
41 ++++ b/Makefile
42 +@@ -1,6 +1,6 @@
43 + VERSION = 4
44 + PATCHLEVEL = 4
45 +-SUBLEVEL = 211
46 ++SUBLEVEL = 212
47 + EXTRAVERSION =
48 + NAME = Blurry Fish Butt
49 +
50 +diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
51 +index a923524d1040..8617323eb273 100644
52 +--- a/arch/arm/common/mcpm_entry.c
53 ++++ b/arch/arm/common/mcpm_entry.c
54 +@@ -379,7 +379,7 @@ static int __init nocache_trampoline(unsigned long _arg)
55 + unsigned int cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
56 + phys_reset_t phys_reset;
57 +
58 +- mcpm_set_entry_vector(cpu, cluster, cpu_resume);
59 ++ mcpm_set_entry_vector(cpu, cluster, cpu_resume_no_hyp);
60 + setup_mm_for_reboot();
61 +
62 + __mcpm_cpu_going_down(cpu, cluster);
63 +diff --git a/arch/arm/include/asm/suspend.h b/arch/arm/include/asm/suspend.h
64 +index 6c7182f32cef..e6c2f426f8c8 100644
65 +--- a/arch/arm/include/asm/suspend.h
66 ++++ b/arch/arm/include/asm/suspend.h
67 +@@ -7,6 +7,7 @@ struct sleep_save_sp {
68 + };
69 +
70 + extern void cpu_resume(void);
71 ++extern void cpu_resume_no_hyp(void);
72 + extern void cpu_resume_arm(void);
73 + extern int cpu_suspend(unsigned long, int (*)(unsigned long));
74 +
75 +diff --git a/arch/arm/kernel/sleep.S b/arch/arm/kernel/sleep.S
76 +index 0f6c1000582c..c8569390e7e7 100644
77 +--- a/arch/arm/kernel/sleep.S
78 ++++ b/arch/arm/kernel/sleep.S
79 +@@ -119,6 +119,14 @@ ENDPROC(cpu_resume_after_mmu)
80 + .text
81 + .align
82 +
83 ++#ifdef CONFIG_MCPM
84 ++ .arm
85 ++THUMB( .thumb )
86 ++ENTRY(cpu_resume_no_hyp)
87 ++ARM_BE8(setend be) @ ensure we are in BE mode
88 ++ b no_hyp
89 ++#endif
90 ++
91 + #ifdef CONFIG_MMU
92 + .arm
93 + ENTRY(cpu_resume_arm)
94 +@@ -134,6 +142,7 @@ ARM_BE8(setend be) @ ensure we are in BE mode
95 + bl __hyp_stub_install_secondary
96 + #endif
97 + safe_svcmode_maskall r1
98 ++no_hyp:
99 + mov r1, #0
100 + ALT_SMP(mrc p15, 0, r0, c0, c0, 5)
101 + ALT_UP_B(1f)
102 +@@ -162,6 +171,9 @@ ENDPROC(cpu_resume)
103 +
104 + #ifdef CONFIG_MMU
105 + ENDPROC(cpu_resume_arm)
106 ++#endif
107 ++#ifdef CONFIG_MCPM
108 ++ENDPROC(cpu_resume_no_hyp)
109 + #endif
110 +
111 + .align 2
112 +diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
113 +index 36706d32d656..1bc87c29467b 100644
114 +--- a/arch/arm/mach-omap2/omap_hwmod.c
115 ++++ b/arch/arm/mach-omap2/omap_hwmod.c
116 +@@ -2563,7 +2563,7 @@ static void _setup_iclk_autoidle(struct omap_hwmod *oh)
117 + */
118 + static int _setup_reset(struct omap_hwmod *oh)
119 + {
120 +- int r;
121 ++ int r = 0;
122 +
123 + if (oh->_state != _HWMOD_STATE_INITIALIZED)
124 + return -EINVAL;
125 +diff --git a/arch/arm/mach-rpc/irq.c b/arch/arm/mach-rpc/irq.c
126 +index 66502e6207fe..fce7fecbd8fa 100644
127 +--- a/arch/arm/mach-rpc/irq.c
128 ++++ b/arch/arm/mach-rpc/irq.c
129 +@@ -117,7 +117,7 @@ extern unsigned char rpc_default_fiq_start, rpc_default_fiq_end;
130 +
131 + void __init rpc_init_irq(void)
132 + {
133 +- unsigned int irq, clr, set = 0;
134 ++ unsigned int irq, clr, set;
135 +
136 + iomd_writeb(0, IOMD_IRQMASKA);
137 + iomd_writeb(0, IOMD_IRQMASKB);
138 +@@ -129,6 +129,7 @@ void __init rpc_init_irq(void)
139 +
140 + for (irq = 0; irq < NR_IRQS; irq++) {
141 + clr = IRQ_NOREQUEST;
142 ++ set = 0;
143 +
144 + if (irq <= 6 || (irq >= 9 && irq <= 15))
145 + clr |= IRQ_NOPROBE;
146 +diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c
147 +index 6748827c2ec8..b6b0979e3cf9 100644
148 +--- a/arch/arm/plat-pxa/ssp.c
149 ++++ b/arch/arm/plat-pxa/ssp.c
150 +@@ -231,18 +231,12 @@ static int pxa_ssp_probe(struct platform_device *pdev)
151 +
152 + static int pxa_ssp_remove(struct platform_device *pdev)
153 + {
154 +- struct resource *res;
155 + struct ssp_device *ssp;
156 +
157 + ssp = platform_get_drvdata(pdev);
158 + if (ssp == NULL)
159 + return -ENODEV;
160 +
161 +- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
162 +- release_mem_region(res->start, resource_size(res));
163 +-
164 +- clk_put(ssp->clk);
165 +-
166 + mutex_lock(&ssp_lock);
167 + list_del(&ssp->node);
168 + mutex_unlock(&ssp_lock);
169 +diff --git a/arch/arm64/boot/dts/arm/juno-clocks.dtsi b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
170 +index 25352ed943e6..00bcbf7688c7 100644
171 +--- a/arch/arm64/boot/dts/arm/juno-clocks.dtsi
172 ++++ b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
173 +@@ -8,10 +8,10 @@
174 + */
175 +
176 + /* SoC fixed clocks */
177 +- soc_uartclk: refclk7273800hz {
178 ++ soc_uartclk: refclk7372800hz {
179 + compatible = "fixed-clock";
180 + #clock-cells = <0>;
181 +- clock-frequency = <7273800>;
182 ++ clock-frequency = <7372800>;
183 + clock-output-names = "juno:uartclk";
184 + };
185 +
186 +diff --git a/arch/m68k/amiga/cia.c b/arch/m68k/amiga/cia.c
187 +index 2081b8cd5591..b9aee983e6f4 100644
188 +--- a/arch/m68k/amiga/cia.c
189 ++++ b/arch/m68k/amiga/cia.c
190 +@@ -88,10 +88,19 @@ static irqreturn_t cia_handler(int irq, void *dev_id)
191 + struct ciabase *base = dev_id;
192 + int mach_irq;
193 + unsigned char ints;
194 ++ unsigned long flags;
195 +
196 ++ /* Interrupts get disabled while the timer irq flag is cleared and
197 ++ * the timer interrupt serviced.
198 ++ */
199 + mach_irq = base->cia_irq;
200 ++ local_irq_save(flags);
201 + ints = cia_set_irq(base, CIA_ICR_ALL);
202 + amiga_custom.intreq = base->int_mask;
203 ++ if (ints & 1)
204 ++ generic_handle_irq(mach_irq);
205 ++ local_irq_restore(flags);
206 ++ mach_irq++, ints >>= 1;
207 + for (; ints; mach_irq++, ints >>= 1) {
208 + if (ints & 1)
209 + generic_handle_irq(mach_irq);
210 +diff --git a/arch/m68k/atari/ataints.c b/arch/m68k/atari/ataints.c
211 +index 3d2b63bedf05..56f02ea2c248 100644
212 +--- a/arch/m68k/atari/ataints.c
213 ++++ b/arch/m68k/atari/ataints.c
214 +@@ -142,7 +142,7 @@ struct mfptimerbase {
215 + .name = "MFP Timer D"
216 + };
217 +
218 +-static irqreturn_t mfptimer_handler(int irq, void *dev_id)
219 ++static irqreturn_t mfp_timer_d_handler(int irq, void *dev_id)
220 + {
221 + struct mfptimerbase *base = dev_id;
222 + int mach_irq;
223 +@@ -344,7 +344,7 @@ void __init atari_init_IRQ(void)
224 + st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 0xf0) | 0x6;
225 +
226 + /* request timer D dispatch handler */
227 +- if (request_irq(IRQ_MFP_TIMD, mfptimer_handler, IRQF_SHARED,
228 ++ if (request_irq(IRQ_MFP_TIMD, mfp_timer_d_handler, IRQF_SHARED,
229 + stmfp_base.name, &stmfp_base))
230 + pr_err("Couldn't register %s interrupt\n", stmfp_base.name);
231 +
232 +diff --git a/arch/m68k/atari/time.c b/arch/m68k/atari/time.c
233 +index c549b48174ec..972181c1fe4b 100644
234 +--- a/arch/m68k/atari/time.c
235 ++++ b/arch/m68k/atari/time.c
236 +@@ -24,6 +24,18 @@
237 + DEFINE_SPINLOCK(rtc_lock);
238 + EXPORT_SYMBOL_GPL(rtc_lock);
239 +
240 ++static irqreturn_t mfp_timer_c_handler(int irq, void *dev_id)
241 ++{
242 ++ irq_handler_t timer_routine = dev_id;
243 ++ unsigned long flags;
244 ++
245 ++ local_irq_save(flags);
246 ++ timer_routine(0, NULL);
247 ++ local_irq_restore(flags);
248 ++
249 ++ return IRQ_HANDLED;
250 ++}
251 ++
252 + void __init
253 + atari_sched_init(irq_handler_t timer_routine)
254 + {
255 +@@ -32,7 +44,8 @@ atari_sched_init(irq_handler_t timer_routine)
256 + /* start timer C, div = 1:100 */
257 + st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 15) | 0x60;
258 + /* install interrupt service routine for MFP Timer C */
259 +- if (request_irq(IRQ_MFP_TIMC, timer_routine, 0, "timer", timer_routine))
260 ++ if (request_irq(IRQ_MFP_TIMC, mfp_timer_c_handler, 0, "timer",
261 ++ timer_routine))
262 + pr_err("Couldn't register timer interrupt\n");
263 + }
264 +
265 +diff --git a/arch/m68k/bvme6000/config.c b/arch/m68k/bvme6000/config.c
266 +index 478623dbb209..62054c01ecb4 100644
267 +--- a/arch/m68k/bvme6000/config.c
268 ++++ b/arch/m68k/bvme6000/config.c
269 +@@ -46,11 +46,6 @@ extern int bvme6000_set_clock_mmss (unsigned long);
270 + extern void bvme6000_reset (void);
271 + void bvme6000_set_vectors (void);
272 +
273 +-/* Save tick handler routine pointer, will point to xtime_update() in
274 +- * kernel/timer/timekeeping.c, called via bvme6000_process_int() */
275 +-
276 +-static irq_handler_t tick_handler;
277 +-
278 +
279 + int __init bvme6000_parse_bootinfo(const struct bi_record *bi)
280 + {
281 +@@ -160,12 +155,18 @@ irqreturn_t bvme6000_abort_int (int irq, void *dev_id)
282 +
283 + static irqreturn_t bvme6000_timer_int (int irq, void *dev_id)
284 + {
285 ++ irq_handler_t timer_routine = dev_id;
286 ++ unsigned long flags;
287 + volatile RtcPtr_t rtc = (RtcPtr_t)BVME_RTC_BASE;
288 +- unsigned char msr = rtc->msr & 0xc0;
289 ++ unsigned char msr;
290 +
291 ++ local_irq_save(flags);
292 ++ msr = rtc->msr & 0xc0;
293 + rtc->msr = msr | 0x20; /* Ack the interrupt */
294 ++ timer_routine(0, NULL);
295 ++ local_irq_restore(flags);
296 +
297 +- return tick_handler(irq, dev_id);
298 ++ return IRQ_HANDLED;
299 + }
300 +
301 + /*
302 +@@ -184,9 +185,8 @@ void bvme6000_sched_init (irq_handler_t timer_routine)
303 +
304 + rtc->msr = 0; /* Ensure timer registers accessible */
305 +
306 +- tick_handler = timer_routine;
307 +- if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0,
308 +- "timer", bvme6000_timer_int))
309 ++ if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0, "timer",
310 ++ timer_routine))
311 + panic ("Couldn't register timer int");
312 +
313 + rtc->t1cr_omr = 0x04; /* Mode 2, ext clk */
314 +diff --git a/arch/m68k/hp300/time.c b/arch/m68k/hp300/time.c
315 +index 749543b425a4..03c83b8f9032 100644
316 +--- a/arch/m68k/hp300/time.c
317 ++++ b/arch/m68k/hp300/time.c
318 +@@ -37,13 +37,19 @@
319 +
320 + static irqreturn_t hp300_tick(int irq, void *dev_id)
321 + {
322 ++ irq_handler_t timer_routine = dev_id;
323 ++ unsigned long flags;
324 + unsigned long tmp;
325 +- irq_handler_t vector = dev_id;
326 ++
327 ++ local_irq_save(flags);
328 + in_8(CLOCKBASE + CLKSR);
329 + asm volatile ("movpw %1@(5),%0" : "=d" (tmp) : "a" (CLOCKBASE));
330 ++ timer_routine(0, NULL);
331 ++ local_irq_restore(flags);
332 ++
333 + /* Turn off the network and SCSI leds */
334 + blinken_leds(0, 0xe0);
335 +- return vector(irq, NULL);
336 ++ return IRQ_HANDLED;
337 + }
338 +
339 + u32 hp300_gettimeoffset(void)
340 +diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
341 +index ce56e04386e7..49f9fa4529a8 100644
342 +--- a/arch/m68k/mac/via.c
343 ++++ b/arch/m68k/mac/via.c
344 +@@ -53,16 +53,6 @@ static __u8 rbv_clear;
345 +
346 + static int gIER,gIFR,gBufA,gBufB;
347 +
348 +-/*
349 +- * Timer defs.
350 +- */
351 +-
352 +-#define TICK_SIZE 10000
353 +-#define MAC_CLOCK_TICK (783300/HZ) /* ticks per HZ */
354 +-#define MAC_CLOCK_LOW (MAC_CLOCK_TICK&0xFF)
355 +-#define MAC_CLOCK_HIGH (MAC_CLOCK_TICK>>8)
356 +-
357 +-
358 + /*
359 + * On Macs with a genuine VIA chip there is no way to mask an individual slot
360 + * interrupt. This limitation also seems to apply to VIA clone logic cores in
361 +@@ -277,22 +267,6 @@ void __init via_init(void)
362 + }
363 + }
364 +
365 +-/*
366 +- * Start the 100 Hz clock
367 +- */
368 +-
369 +-void __init via_init_clock(irq_handler_t func)
370 +-{
371 +- via1[vACR] |= 0x40;
372 +- via1[vT1LL] = MAC_CLOCK_LOW;
373 +- via1[vT1LH] = MAC_CLOCK_HIGH;
374 +- via1[vT1CL] = MAC_CLOCK_LOW;
375 +- via1[vT1CH] = MAC_CLOCK_HIGH;
376 +-
377 +- if (request_irq(IRQ_MAC_TIMER_1, func, 0, "timer", func))
378 +- pr_err("Couldn't register %s interrupt\n", "timer");
379 +-}
380 +-
381 + /*
382 + * Debugging dump, used in various places to see what's going on.
383 + */
384 +@@ -320,29 +294,6 @@ void via_debug_dump(void)
385 + }
386 + }
387 +
388 +-/*
389 +- * This is always executed with interrupts disabled.
390 +- *
391 +- * TBI: get time offset between scheduling timer ticks
392 +- */
393 +-
394 +-u32 mac_gettimeoffset(void)
395 +-{
396 +- unsigned long ticks, offset = 0;
397 +-
398 +- /* read VIA1 timer 2 current value */
399 +- ticks = via1[vT1CL] | (via1[vT1CH] << 8);
400 +- /* The probability of underflow is less than 2% */
401 +- if (ticks > MAC_CLOCK_TICK - MAC_CLOCK_TICK / 50)
402 +- /* Check for pending timer interrupt in VIA1 IFR */
403 +- if (via1[vIFR] & 0x40) offset = TICK_SIZE;
404 +-
405 +- ticks = MAC_CLOCK_TICK - ticks;
406 +- ticks = ticks * 10000L / MAC_CLOCK_TICK;
407 +-
408 +- return (ticks + offset) * 1000;
409 +-}
410 +-
411 + /*
412 + * Flush the L2 cache on Macs that have it by flipping
413 + * the system into 24-bit mode for an instant.
414 +@@ -446,6 +397,8 @@ void via_nubus_irq_shutdown(int irq)
415 + * via6522.c :-), disable/pending masks added.
416 + */
417 +
418 ++#define VIA_TIMER_1_INT BIT(6)
419 ++
420 + void via1_irq(struct irq_desc *desc)
421 + {
422 + int irq_num;
423 +@@ -455,6 +408,21 @@ void via1_irq(struct irq_desc *desc)
424 + if (!events)
425 + return;
426 +
427 ++ irq_num = IRQ_MAC_TIMER_1;
428 ++ irq_bit = VIA_TIMER_1_INT;
429 ++ if (events & irq_bit) {
430 ++ unsigned long flags;
431 ++
432 ++ local_irq_save(flags);
433 ++ via1[vIFR] = irq_bit;
434 ++ generic_handle_irq(irq_num);
435 ++ local_irq_restore(flags);
436 ++
437 ++ events &= ~irq_bit;
438 ++ if (!events)
439 ++ return;
440 ++ }
441 ++
442 + irq_num = VIA1_SOURCE_BASE;
443 + irq_bit = 1;
444 + do {
445 +@@ -619,3 +587,56 @@ int via2_scsi_drq_pending(void)
446 + return via2[gIFR] & (1 << IRQ_IDX(IRQ_MAC_SCSIDRQ));
447 + }
448 + EXPORT_SYMBOL(via2_scsi_drq_pending);
449 ++
450 ++/* timer and clock source */
451 ++
452 ++#define VIA_CLOCK_FREQ 783360 /* VIA "phase 2" clock in Hz */
453 ++#define VIA_TIMER_INTERVAL (1000000 / HZ) /* microseconds per jiffy */
454 ++#define VIA_TIMER_CYCLES (VIA_CLOCK_FREQ / HZ) /* clock cycles per jiffy */
455 ++
456 ++#define VIA_TC (VIA_TIMER_CYCLES - 2) /* including 0 and -1 */
457 ++#define VIA_TC_LOW (VIA_TC & 0xFF)
458 ++#define VIA_TC_HIGH (VIA_TC >> 8)
459 ++
460 ++void __init via_init_clock(irq_handler_t timer_routine)
461 ++{
462 ++ if (request_irq(IRQ_MAC_TIMER_1, timer_routine, 0, "timer", NULL)) {
463 ++ pr_err("Couldn't register %s interrupt\n", "timer");
464 ++ return;
465 ++ }
466 ++
467 ++ via1[vT1LL] = VIA_TC_LOW;
468 ++ via1[vT1LH] = VIA_TC_HIGH;
469 ++ via1[vT1CL] = VIA_TC_LOW;
470 ++ via1[vT1CH] = VIA_TC_HIGH;
471 ++ via1[vACR] |= 0x40;
472 ++}
473 ++
474 ++u32 mac_gettimeoffset(void)
475 ++{
476 ++ unsigned long flags;
477 ++ u8 count_high;
478 ++ u16 count, offset = 0;
479 ++
480 ++ /*
481 ++ * Timer counter wrap-around is detected with the timer interrupt flag
482 ++ * but reading the counter low byte (vT1CL) would reset the flag.
483 ++ * Also, accessing both counter registers is essentially a data race.
484 ++ * These problems are avoided by ignoring the low byte. Clock accuracy
485 ++ * is 256 times worse (error can reach 0.327 ms) but CPU overhead is
486 ++ * reduced by avoiding slow VIA register accesses.
487 ++ */
488 ++
489 ++ local_irq_save(flags);
490 ++ count_high = via1[vT1CH];
491 ++ if (count_high == 0xFF)
492 ++ count_high = 0;
493 ++ if (count_high > 0 && (via1[vIFR] & VIA_TIMER_1_INT))
494 ++ offset = VIA_TIMER_CYCLES;
495 ++ local_irq_restore(flags);
496 ++
497 ++ count = count_high << 8;
498 ++ count = VIA_TIMER_CYCLES - count + offset;
499 ++
500 ++ return ((count * VIA_TIMER_INTERVAL) / VIA_TIMER_CYCLES) * 1000;
501 ++}
502 +diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c
503 +index e6a3b56c6481..152fbde23424 100644
504 +--- a/arch/m68k/mvme147/config.c
505 ++++ b/arch/m68k/mvme147/config.c
506 +@@ -47,11 +47,6 @@ extern void mvme147_reset (void);
507 +
508 + static int bcd2int (unsigned char b);
509 +
510 +-/* Save tick handler routine pointer, will point to xtime_update() in
511 +- * kernel/time/timekeeping.c, called via mvme147_process_int() */
512 +-
513 +-irq_handler_t tick_handler;
514 +-
515 +
516 + int __init mvme147_parse_bootinfo(const struct bi_record *bi)
517 + {
518 +@@ -107,16 +102,23 @@ void __init config_mvme147(void)
519 +
520 + static irqreturn_t mvme147_timer_int (int irq, void *dev_id)
521 + {
522 ++ irq_handler_t timer_routine = dev_id;
523 ++ unsigned long flags;
524 ++
525 ++ local_irq_save(flags);
526 + m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR;
527 + m147_pcc->t1_int_cntrl = PCC_INT_ENAB|PCC_LEVEL_TIMER1;
528 +- return tick_handler(irq, dev_id);
529 ++ timer_routine(0, NULL);
530 ++ local_irq_restore(flags);
531 ++
532 ++ return IRQ_HANDLED;
533 + }
534 +
535 +
536 + void mvme147_sched_init (irq_handler_t timer_routine)
537 + {
538 +- tick_handler = timer_routine;
539 +- if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1", NULL))
540 ++ if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1",
541 ++ timer_routine))
542 + pr_err("Couldn't register timer interrupt\n");
543 +
544 + /* Init the clock with a value */
545 +diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c
546 +index a53803cc66cd..0d43bfb3324d 100644
547 +--- a/arch/m68k/mvme16x/config.c
548 ++++ b/arch/m68k/mvme16x/config.c
549 +@@ -52,11 +52,6 @@ extern void mvme16x_reset (void);
550 +
551 + int bcd2int (unsigned char b);
552 +
553 +-/* Save tick handler routine pointer, will point to xtime_update() in
554 +- * kernel/time/timekeeping.c, called via mvme16x_process_int() */
555 +-
556 +-static irq_handler_t tick_handler;
557 +-
558 +
559 + unsigned short mvme16x_config;
560 + EXPORT_SYMBOL(mvme16x_config);
561 +@@ -355,8 +350,15 @@ static irqreturn_t mvme16x_abort_int (int irq, void *dev_id)
562 +
563 + static irqreturn_t mvme16x_timer_int (int irq, void *dev_id)
564 + {
565 +- *(volatile unsigned char *)0xfff4201b |= 8;
566 +- return tick_handler(irq, dev_id);
567 ++ irq_handler_t timer_routine = dev_id;
568 ++ unsigned long flags;
569 ++
570 ++ local_irq_save(flags);
571 ++ *(volatile unsigned char *)0xfff4201b |= 8;
572 ++ timer_routine(0, NULL);
573 ++ local_irq_restore(flags);
574 ++
575 ++ return IRQ_HANDLED;
576 + }
577 +
578 + void mvme16x_sched_init (irq_handler_t timer_routine)
579 +@@ -364,14 +366,13 @@ void mvme16x_sched_init (irq_handler_t timer_routine)
580 + uint16_t brdno = be16_to_cpu(mvme_bdid.brdno);
581 + int irq;
582 +
583 +- tick_handler = timer_routine;
584 + /* Using PCCchip2 or MC2 chip tick timer 1 */
585 + *(volatile unsigned long *)0xfff42008 = 0;
586 + *(volatile unsigned long *)0xfff42004 = 10000; /* 10ms */
587 + *(volatile unsigned char *)0xfff42017 |= 3;
588 + *(volatile unsigned char *)0xfff4201b = 0x16;
589 +- if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0,
590 +- "timer", mvme16x_timer_int))
591 ++ if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0, "timer",
592 ++ timer_routine))
593 + panic ("Couldn't register timer int");
594 +
595 + if (brdno == 0x0162 || brdno == 0x172)
596 +diff --git a/arch/m68k/q40/q40ints.c b/arch/m68k/q40/q40ints.c
597 +index 513f9bb17b9c..60b51f5b9cfc 100644
598 +--- a/arch/m68k/q40/q40ints.c
599 ++++ b/arch/m68k/q40/q40ints.c
600 +@@ -126,10 +126,10 @@ void q40_mksound(unsigned int hz, unsigned int ticks)
601 + sound_ticks = ticks << 1;
602 + }
603 +
604 +-static irq_handler_t q40_timer_routine;
605 +-
606 +-static irqreturn_t q40_timer_int (int irq, void * dev)
607 ++static irqreturn_t q40_timer_int(int irq, void *dev_id)
608 + {
609 ++ irq_handler_t timer_routine = dev_id;
610 ++
611 + ql_ticks = ql_ticks ? 0 : 1;
612 + if (sound_ticks) {
613 + unsigned char sval=(sound_ticks & 1) ? 128-SVOL : 128+SVOL;
614 +@@ -138,8 +138,13 @@ static irqreturn_t q40_timer_int (int irq, void * dev)
615 + *DAC_RIGHT=sval;
616 + }
617 +
618 +- if (!ql_ticks)
619 +- q40_timer_routine(irq, dev);
620 ++ if (!ql_ticks) {
621 ++ unsigned long flags;
622 ++
623 ++ local_irq_save(flags);
624 ++ timer_routine(0, NULL);
625 ++ local_irq_restore(flags);
626 ++ }
627 + return IRQ_HANDLED;
628 + }
629 +
630 +@@ -147,11 +152,9 @@ void q40_sched_init (irq_handler_t timer_routine)
631 + {
632 + int timer_irq;
633 +
634 +- q40_timer_routine = timer_routine;
635 + timer_irq = Q40_IRQ_FRAME;
636 +
637 +- if (request_irq(timer_irq, q40_timer_int, 0,
638 +- "timer", q40_timer_int))
639 ++ if (request_irq(timer_irq, q40_timer_int, 0, "timer", timer_routine))
640 + panic("Couldn't register timer int");
641 +
642 + master_outb(-1, FRAME_CLEAR_REG);
643 +diff --git a/arch/m68k/sun3/sun3ints.c b/arch/m68k/sun3/sun3ints.c
644 +index 6bbca30c9188..a5824abb4a39 100644
645 +--- a/arch/m68k/sun3/sun3ints.c
646 ++++ b/arch/m68k/sun3/sun3ints.c
647 +@@ -61,8 +61,10 @@ static irqreturn_t sun3_int7(int irq, void *dev_id)
648 +
649 + static irqreturn_t sun3_int5(int irq, void *dev_id)
650 + {
651 ++ unsigned long flags;
652 + unsigned int cnt;
653 +
654 ++ local_irq_save(flags);
655 + #ifdef CONFIG_SUN3
656 + intersil_clear();
657 + #endif
658 +@@ -76,6 +78,7 @@ static irqreturn_t sun3_int5(int irq, void *dev_id)
659 + cnt = kstat_irqs_cpu(irq, 0);
660 + if (!(cnt % 20))
661 + sun3_leds(led_pattern[cnt % 160 / 20]);
662 ++ local_irq_restore(flags);
663 + return IRQ_HANDLED;
664 + }
665 +
666 +diff --git a/arch/m68k/sun3x/time.c b/arch/m68k/sun3x/time.c
667 +index c8eb08add6b0..7a195313ff4f 100644
668 +--- a/arch/m68k/sun3x/time.c
669 ++++ b/arch/m68k/sun3x/time.c
670 +@@ -77,15 +77,19 @@ u32 sun3x_gettimeoffset(void)
671 + }
672 +
673 + #if 0
674 +-static void sun3x_timer_tick(int irq, void *dev_id, struct pt_regs *regs)
675 ++static irqreturn_t sun3x_timer_tick(int irq, void *dev_id)
676 + {
677 +- void (*vector)(int, void *, struct pt_regs *) = dev_id;
678 ++ irq_handler_t timer_routine = dev_id;
679 ++ unsigned long flags;
680 +
681 +- /* Clear the pending interrupt - pulse the enable line low */
682 +- disable_irq(5);
683 +- enable_irq(5);
684 ++ local_irq_save(flags);
685 ++ /* Clear the pending interrupt - pulse the enable line low */
686 ++ disable_irq(5);
687 ++ enable_irq(5);
688 ++ timer_routine(0, NULL);
689 ++ local_irq_restore(flags);
690 +
691 +- vector(irq, NULL, regs);
692 ++ return IRQ_HANDLED;
693 + }
694 + #endif
695 +
696 +diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
697 +index ab1df19b0957..60604b26fa72 100644
698 +--- a/arch/mips/include/asm/io.h
699 ++++ b/arch/mips/include/asm/io.h
700 +@@ -60,21 +60,11 @@
701 + * instruction, so the lower 16 bits must be zero. Should be true on
702 + * on any sane architecture; generic code does not use this assumption.
703 + */
704 +-extern const unsigned long mips_io_port_base;
705 ++extern unsigned long mips_io_port_base;
706 +
707 +-/*
708 +- * Gcc will generate code to load the value of mips_io_port_base after each
709 +- * function call which may be fairly wasteful in some cases. So we don't
710 +- * play quite by the book. We tell gcc mips_io_port_base is a long variable
711 +- * which solves the code generation issue. Now we need to violate the
712 +- * aliasing rules a little to make initialization possible and finally we
713 +- * will need the barrier() to fight side effects of the aliasing chat.
714 +- * This trickery will eventually collapse under gcc's optimizer. Oh well.
715 +- */
716 + static inline void set_io_port_base(unsigned long base)
717 + {
718 +- * (unsigned long *) &mips_io_port_base = base;
719 +- barrier();
720 ++ mips_io_port_base = base;
721 + }
722 +
723 + /*
724 +diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
725 +index 4f9f1ae49213..fadc946b306d 100644
726 +--- a/arch/mips/kernel/setup.c
727 ++++ b/arch/mips/kernel/setup.c
728 +@@ -80,7 +80,7 @@ static char __initdata builtin_cmdline[COMMAND_LINE_SIZE] = CONFIG_CMDLINE;
729 + * mips_io_port_base is the begin of the address space to which x86 style
730 + * I/O ports are mapped.
731 + */
732 +-const unsigned long mips_io_port_base = -1;
733 ++unsigned long mips_io_port_base = -1;
734 + EXPORT_SYMBOL(mips_io_port_base);
735 +
736 + static struct resource code_resource = { .name = "Kernel code", };
737 +diff --git a/arch/nios2/kernel/nios2_ksyms.c b/arch/nios2/kernel/nios2_ksyms.c
738 +index bf2f55d10a4d..4e704046a150 100644
739 +--- a/arch/nios2/kernel/nios2_ksyms.c
740 ++++ b/arch/nios2/kernel/nios2_ksyms.c
741 +@@ -9,12 +9,20 @@
742 + #include <linux/export.h>
743 + #include <linux/string.h>
744 +
745 ++#include <asm/cacheflush.h>
746 ++#include <asm/pgtable.h>
747 ++
748 + /* string functions */
749 +
750 + EXPORT_SYMBOL(memcpy);
751 + EXPORT_SYMBOL(memset);
752 + EXPORT_SYMBOL(memmove);
753 +
754 ++/* memory management */
755 ++
756 ++EXPORT_SYMBOL(empty_zero_page);
757 ++EXPORT_SYMBOL(flush_icache_range);
758 ++
759 + /*
760 + * libgcc functions - functions that are used internally by the
761 + * compiler... (prototypes are not correct though, but that
762 +@@ -31,3 +39,7 @@ DECLARE_EXPORT(__udivsi3);
763 + DECLARE_EXPORT(__umoddi3);
764 + DECLARE_EXPORT(__umodsi3);
765 + DECLARE_EXPORT(__muldi3);
766 ++DECLARE_EXPORT(__ucmpdi2);
767 ++DECLARE_EXPORT(__lshrdi3);
768 ++DECLARE_EXPORT(__ashldi3);
769 ++DECLARE_EXPORT(__ashrdi3);
770 +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
771 +index d7eb035a9c96..65cb22541c66 100644
772 +--- a/arch/powerpc/Makefile
773 ++++ b/arch/powerpc/Makefile
774 +@@ -350,7 +350,9 @@ vdso_install:
775 + ifeq ($(CONFIG_PPC64),y)
776 + $(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso64 $@
777 + endif
778 ++ifdef CONFIG_VDSO32
779 + $(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso32 $@
780 ++endif
781 +
782 + archclean:
783 + $(Q)$(MAKE) $(clean)=$(boot)
784 +diff --git a/arch/powerpc/include/asm/archrandom.h b/arch/powerpc/include/asm/archrandom.h
785 +index 85e88f7a59c0..9ff848e3c4a6 100644
786 +--- a/arch/powerpc/include/asm/archrandom.h
787 ++++ b/arch/powerpc/include/asm/archrandom.h
788 +@@ -27,7 +27,7 @@ static inline int arch_get_random_seed_int(unsigned int *v)
789 + unsigned long val;
790 + int rc;
791 +
792 +- rc = arch_get_random_long(&val);
793 ++ rc = arch_get_random_seed_long(&val);
794 + if (rc)
795 + *v = val;
796 +
797 +diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
798 +index c641983bbdd6..3394a72b19f2 100644
799 +--- a/arch/powerpc/kernel/cacheinfo.c
800 ++++ b/arch/powerpc/kernel/cacheinfo.c
801 +@@ -867,4 +867,21 @@ void cacheinfo_cpu_offline(unsigned int cpu_id)
802 + if (cache)
803 + cache_cpu_clear(cache, cpu_id);
804 + }
805 ++
806 ++void cacheinfo_teardown(void)
807 ++{
808 ++ unsigned int cpu;
809 ++
810 ++ for_each_online_cpu(cpu)
811 ++ cacheinfo_cpu_offline(cpu);
812 ++}
813 ++
814 ++void cacheinfo_rebuild(void)
815 ++{
816 ++ unsigned int cpu;
817 ++
818 ++ for_each_online_cpu(cpu)
819 ++ cacheinfo_cpu_online(cpu);
820 ++}
821 ++
822 + #endif /* (CONFIG_PPC_PSERIES && CONFIG_SUSPEND) || CONFIG_HOTPLUG_CPU */
823 +diff --git a/arch/powerpc/kernel/cacheinfo.h b/arch/powerpc/kernel/cacheinfo.h
824 +index a7b74d36acd7..2cdee87a482c 100644
825 +--- a/arch/powerpc/kernel/cacheinfo.h
826 ++++ b/arch/powerpc/kernel/cacheinfo.h
827 +@@ -5,4 +5,8 @@
828 + extern void cacheinfo_cpu_online(unsigned int cpu_id);
829 + extern void cacheinfo_cpu_offline(unsigned int cpu_id);
830 +
831 ++/* Allow migration/suspend to tear down and rebuild the hierarchy. */
832 ++extern void cacheinfo_teardown(void);
833 ++extern void cacheinfo_rebuild(void);
834 ++
835 + #endif /* _PPC_CACHEINFO_H */
836 +diff --git a/arch/powerpc/sysdev/qe_lib/gpio.c b/arch/powerpc/sysdev/qe_lib/gpio.c
837 +index 521e67a49dc4..4052e3d7edbd 100644
838 +--- a/arch/powerpc/sysdev/qe_lib/gpio.c
839 ++++ b/arch/powerpc/sysdev/qe_lib/gpio.c
840 +@@ -155,8 +155,10 @@ struct qe_pin *qe_pin_request(struct device_node *np, int index)
841 + if (err < 0)
842 + goto err0;
843 + gc = gpio_to_chip(err);
844 +- if (WARN_ON(!gc))
845 ++ if (WARN_ON(!gc)) {
846 ++ err = -ENODEV;
847 + goto err0;
848 ++ }
849 +
850 + if (!of_device_is_compatible(gc->of_node, "fsl,mpc8323-qe-pario-bank")) {
851 + pr_debug("%s: tried to get a non-qe pin\n", __func__);
852 +diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
853 +index 2aa212fb0faf..31c191a08bb1 100644
854 +--- a/arch/x86/Kconfig.debug
855 ++++ b/arch/x86/Kconfig.debug
856 +@@ -221,7 +221,7 @@ config HAVE_MMIOTRACE_SUPPORT
857 +
858 + config X86_DECODER_SELFTEST
859 + bool "x86 instruction decoder selftest"
860 +- depends on DEBUG_KERNEL && KPROBES
861 ++ depends on DEBUG_KERNEL && INSTRUCTION_DECODER
862 + depends on !COMPILE_TEST
863 + ---help---
864 + Perform x86 instruction decoder selftests at build time.
865 +diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
866 +index 44256a62702b..4a08fda2b06f 100644
867 +--- a/arch/x86/kernel/kgdb.c
868 ++++ b/arch/x86/kernel/kgdb.c
869 +@@ -437,7 +437,7 @@ static void kgdb_disable_hw_debug(struct pt_regs *regs)
870 + */
871 + void kgdb_roundup_cpus(unsigned long flags)
872 + {
873 +- apic->send_IPI_allbutself(APIC_DM_NMI);
874 ++ apic->send_IPI_allbutself(NMI_VECTOR);
875 + }
876 + #endif
877 +
878 +diff --git a/block/blk-merge.c b/block/blk-merge.c
879 +index 7225511cf0b4..b8f1eaeeaac2 100644
880 +--- a/block/blk-merge.c
881 ++++ b/block/blk-merge.c
882 +@@ -296,13 +296,7 @@ void blk_recalc_rq_segments(struct request *rq)
883 +
884 + void blk_recount_segments(struct request_queue *q, struct bio *bio)
885 + {
886 +- unsigned short seg_cnt;
887 +-
888 +- /* estimate segment number by bi_vcnt for non-cloned bio */
889 +- if (bio_flagged(bio, BIO_CLONED))
890 +- seg_cnt = bio_segments(bio);
891 +- else
892 +- seg_cnt = bio->bi_vcnt;
893 ++ unsigned short seg_cnt = bio_segments(bio);
894 +
895 + if (test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags) &&
896 + (seg_cnt < queue_max_segments(q)))
897 +diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
898 +index f8ec3d4ba4a8..a5718c0a3dc4 100644
899 +--- a/crypto/pcrypt.c
900 ++++ b/crypto/pcrypt.c
901 +@@ -394,7 +394,7 @@ static int pcrypt_sysfs_add(struct padata_instance *pinst, const char *name)
902 + int ret;
903 +
904 + pinst->kobj.kset = pcrypt_kset;
905 +- ret = kobject_add(&pinst->kobj, NULL, name);
906 ++ ret = kobject_add(&pinst->kobj, NULL, "%s", name);
907 + if (!ret)
908 + kobject_uevent(&pinst->kobj, KOBJ_ADD);
909 +
910 +diff --git a/crypto/tgr192.c b/crypto/tgr192.c
911 +index 321bc6ff2a9d..904c8444aa0a 100644
912 +--- a/crypto/tgr192.c
913 ++++ b/crypto/tgr192.c
914 +@@ -25,8 +25,9 @@
915 + #include <linux/init.h>
916 + #include <linux/module.h>
917 + #include <linux/mm.h>
918 +-#include <asm/byteorder.h>
919 + #include <linux/types.h>
920 ++#include <asm/byteorder.h>
921 ++#include <asm/unaligned.h>
922 +
923 + #define TGR192_DIGEST_SIZE 24
924 + #define TGR160_DIGEST_SIZE 20
925 +@@ -468,10 +469,9 @@ static void tgr192_transform(struct tgr192_ctx *tctx, const u8 * data)
926 + u64 a, b, c, aa, bb, cc;
927 + u64 x[8];
928 + int i;
929 +- const __le64 *ptr = (const __le64 *)data;
930 +
931 + for (i = 0; i < 8; i++)
932 +- x[i] = le64_to_cpu(ptr[i]);
933 ++ x[i] = get_unaligned_le64(data + i * sizeof(__le64));
934 +
935 + /* save */
936 + a = aa = tctx->a;
937 +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
938 +index 8116cb2fef2d..1241cecfcfca 100644
939 +--- a/drivers/ata/libahci.c
940 ++++ b/drivers/ata/libahci.c
941 +@@ -187,7 +187,6 @@ struct ata_port_operations ahci_pmp_retry_srst_ops = {
942 + EXPORT_SYMBOL_GPL(ahci_pmp_retry_srst_ops);
943 +
944 + static bool ahci_em_messages __read_mostly = true;
945 +-EXPORT_SYMBOL_GPL(ahci_em_messages);
946 + module_param(ahci_em_messages, bool, 0444);
947 + /* add other LED protocol types when they become supported */
948 + MODULE_PARM_DESC(ahci_em_messages,
949 +diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
950 +index 82f2ae0d7cc4..04b39d0da868 100644
951 +--- a/drivers/atm/firestream.c
952 ++++ b/drivers/atm/firestream.c
953 +@@ -923,6 +923,7 @@ static int fs_open(struct atm_vcc *atm_vcc)
954 + }
955 + if (!to) {
956 + printk ("No more free channels for FS50..\n");
957 ++ kfree(vcc);
958 + return -EBUSY;
959 + }
960 + vcc->channo = dev->channo;
961 +@@ -933,6 +934,7 @@ static int fs_open(struct atm_vcc *atm_vcc)
962 + if (((DO_DIRECTION(rxtp) && dev->atm_vccs[vcc->channo])) ||
963 + ( DO_DIRECTION(txtp) && test_bit (vcc->channo, dev->tx_inuse))) {
964 + printk ("Channel is in use for FS155.\n");
965 ++ kfree(vcc);
966 + return -EBUSY;
967 + }
968 + }
969 +@@ -946,6 +948,7 @@ static int fs_open(struct atm_vcc *atm_vcc)
970 + tc, sizeof (struct fs_transmit_config));
971 + if (!tc) {
972 + fs_dprintk (FS_DEBUG_OPEN, "fs: can't alloc transmit_config.\n");
973 ++ kfree(vcc);
974 + return -ENOMEM;
975 + }
976 +
977 +diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
978 +index f499a469e66d..12b2cc9a3fbe 100644
979 +--- a/drivers/bcma/driver_pci.c
980 ++++ b/drivers/bcma/driver_pci.c
981 +@@ -78,7 +78,7 @@ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u16 device, u8 address)
982 + v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
983 + }
984 +
985 +- v = BCMA_CORE_PCI_MDIODATA_START;
986 ++ v |= BCMA_CORE_PCI_MDIODATA_START;
987 + v |= BCMA_CORE_PCI_MDIODATA_READ;
988 + v |= BCMA_CORE_PCI_MDIODATA_TA;
989 +
990 +@@ -121,7 +121,7 @@ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u16 device,
991 + v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
992 + }
993 +
994 +- v = BCMA_CORE_PCI_MDIODATA_START;
995 ++ v |= BCMA_CORE_PCI_MDIODATA_START;
996 + v |= BCMA_CORE_PCI_MDIODATA_WRITE;
997 + v |= BCMA_CORE_PCI_MDIODATA_TA;
998 + v |= data;
999 +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
1000 +index 385ec4ae3394..456350bd24b3 100644
1001 +--- a/drivers/block/drbd/drbd_main.c
1002 ++++ b/drivers/block/drbd/drbd_main.c
1003 +@@ -331,6 +331,8 @@ static int drbd_thread_setup(void *arg)
1004 + thi->name[0],
1005 + resource->name);
1006 +
1007 ++ allow_kernel_signal(DRBD_SIGKILL);
1008 ++ allow_kernel_signal(SIGXCPU);
1009 + restart:
1010 + retval = thi->function(thi);
1011 +
1012 +diff --git a/drivers/clk/clk-highbank.c b/drivers/clk/clk-highbank.c
1013 +index be3a21abb185..4105066b428c 100644
1014 +--- a/drivers/clk/clk-highbank.c
1015 ++++ b/drivers/clk/clk-highbank.c
1016 +@@ -294,6 +294,7 @@ static __init struct clk *hb_clk_init(struct device_node *node, const struct clk
1017 + /* Map system registers */
1018 + srnp = of_find_compatible_node(NULL, NULL, "calxeda,hb-sregs");
1019 + hb_clk->reg = of_iomap(srnp, 0);
1020 ++ of_node_put(srnp);
1021 + BUG_ON(!hb_clk->reg);
1022 + hb_clk->reg += reg;
1023 +
1024 +diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
1025 +index 7244a621c61b..efc9e1973295 100644
1026 +--- a/drivers/clk/clk-qoriq.c
1027 ++++ b/drivers/clk/clk-qoriq.c
1028 +@@ -1244,6 +1244,7 @@ static void __init clockgen_init(struct device_node *np)
1029 + pr_err("%s: Couldn't map %s regs\n", __func__,
1030 + guts->full_name);
1031 + }
1032 ++ of_node_put(guts);
1033 + }
1034 +
1035 + }
1036 +diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c
1037 +index 46c05c9a9354..39ea50102d52 100644
1038 +--- a/drivers/clk/imx/clk-imx6q.c
1039 ++++ b/drivers/clk/imx/clk-imx6q.c
1040 +@@ -155,6 +155,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
1041 + np = of_find_compatible_node(NULL, NULL, "fsl,imx6q-anatop");
1042 + base = of_iomap(np, 0);
1043 + WARN_ON(!base);
1044 ++ of_node_put(np);
1045 +
1046 + /* Audio/video PLL post dividers do not work on i.MX6q revision 1.0 */
1047 + if (clk_on_imx6q() && imx_get_soc_revision() == IMX_CHIP_REVISION_1_0) {
1048 +diff --git a/drivers/clk/imx/clk-imx6sx.c b/drivers/clk/imx/clk-imx6sx.c
1049 +index fea125eb4330..8f2958ac04e8 100644
1050 +--- a/drivers/clk/imx/clk-imx6sx.c
1051 ++++ b/drivers/clk/imx/clk-imx6sx.c
1052 +@@ -162,6 +162,7 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node)
1053 + np = of_find_compatible_node(NULL, NULL, "fsl,imx6sx-anatop");
1054 + base = of_iomap(np, 0);
1055 + WARN_ON(!base);
1056 ++ of_node_put(np);
1057 +
1058 + clks[IMX6SX_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
1059 + clks[IMX6SX_PLL2_BYPASS_SRC] = imx_clk_mux("pll2_bypass_src", base + 0x30, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
1060 +diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c
1061 +index 448ef321948b..863163b239a3 100644
1062 +--- a/drivers/clk/imx/clk-imx7d.c
1063 ++++ b/drivers/clk/imx/clk-imx7d.c
1064 +@@ -386,6 +386,7 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node)
1065 + np = of_find_compatible_node(NULL, NULL, "fsl,imx7d-anatop");
1066 + base = of_iomap(np, 0);
1067 + WARN_ON(!base);
1068 ++ of_node_put(np);
1069 +
1070 + clks[IMX7D_PLL_ARM_MAIN_SRC] = imx_clk_mux("pll_arm_main_src", base + 0x60, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
1071 + clks[IMX7D_PLL_DRAM_MAIN_SRC] = imx_clk_mux("pll_dram_main_src", base + 0x70, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
1072 +diff --git a/drivers/clk/imx/clk-vf610.c b/drivers/clk/imx/clk-vf610.c
1073 +index 0a94d9661d91..2c92a2706fdd 100644
1074 +--- a/drivers/clk/imx/clk-vf610.c
1075 ++++ b/drivers/clk/imx/clk-vf610.c
1076 +@@ -155,6 +155,7 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
1077 + np = of_find_compatible_node(NULL, NULL, "fsl,vf610-anatop");
1078 + anatop_base = of_iomap(np, 0);
1079 + BUG_ON(!anatop_base);
1080 ++ of_node_put(np);
1081 +
1082 + np = ccm_node;
1083 + ccm_base = of_iomap(np, 0);
1084 +diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c
1085 +index 2c7c1085f883..8fdfa97900cd 100644
1086 +--- a/drivers/clk/mvebu/armada-370.c
1087 ++++ b/drivers/clk/mvebu/armada-370.c
1088 +@@ -177,8 +177,10 @@ static void __init a370_clk_init(struct device_node *np)
1089 +
1090 + mvebu_coreclk_setup(np, &a370_coreclks);
1091 +
1092 +- if (cgnp)
1093 ++ if (cgnp) {
1094 + mvebu_clk_gating_setup(cgnp, a370_gating_desc);
1095 ++ of_node_put(cgnp);
1096 ++ }
1097 + }
1098 + CLK_OF_DECLARE(a370_clk, "marvell,armada-370-core-clock", a370_clk_init);
1099 +
1100 +diff --git a/drivers/clk/mvebu/armada-xp.c b/drivers/clk/mvebu/armada-xp.c
1101 +index b3094315a3c0..2fa15a274719 100644
1102 +--- a/drivers/clk/mvebu/armada-xp.c
1103 ++++ b/drivers/clk/mvebu/armada-xp.c
1104 +@@ -202,7 +202,9 @@ static void __init axp_clk_init(struct device_node *np)
1105 +
1106 + mvebu_coreclk_setup(np, &axp_coreclks);
1107 +
1108 +- if (cgnp)
1109 ++ if (cgnp) {
1110 + mvebu_clk_gating_setup(cgnp, axp_gating_desc);
1111 ++ of_node_put(cgnp);
1112 ++ }
1113 + }
1114 + CLK_OF_DECLARE(axp_clk, "marvell,armada-xp-core-clock", axp_clk_init);
1115 +diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c
1116 +index 99550f25975e..1d2b9a1a9609 100644
1117 +--- a/drivers/clk/mvebu/kirkwood.c
1118 ++++ b/drivers/clk/mvebu/kirkwood.c
1119 +@@ -335,6 +335,8 @@ static void __init kirkwood_clk_init(struct device_node *np)
1120 + if (cgnp) {
1121 + mvebu_clk_gating_setup(cgnp, kirkwood_gating_desc);
1122 + kirkwood_clk_muxing_setup(cgnp, kirkwood_mux_desc);
1123 ++
1124 ++ of_node_put(cgnp);
1125 + }
1126 + }
1127 + CLK_OF_DECLARE(kirkwood_clk, "marvell,kirkwood-core-clock",
1128 +diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
1129 +index 7f370d3e0983..6c8e45e007c8 100644
1130 +--- a/drivers/clk/samsung/clk-exynos4.c
1131 ++++ b/drivers/clk/samsung/clk-exynos4.c
1132 +@@ -1224,6 +1224,7 @@ static unsigned long exynos4_get_xom(void)
1133 + xom = readl(chipid_base + 8);
1134 +
1135 + iounmap(chipid_base);
1136 ++ of_node_put(np);
1137 + }
1138 +
1139 + return xom;
1140 +diff --git a/drivers/clk/socfpga/clk-pll-a10.c b/drivers/clk/socfpga/clk-pll-a10.c
1141 +index 402d630bd531..623d5b77fb43 100644
1142 +--- a/drivers/clk/socfpga/clk-pll-a10.c
1143 ++++ b/drivers/clk/socfpga/clk-pll-a10.c
1144 +@@ -95,6 +95,7 @@ static struct __init clk * __socfpga_pll_init(struct device_node *node,
1145 +
1146 + clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
1147 + clk_mgr_a10_base_addr = of_iomap(clkmgr_np, 0);
1148 ++ of_node_put(clkmgr_np);
1149 + BUG_ON(!clk_mgr_a10_base_addr);
1150 + pll_clk->hw.reg = clk_mgr_a10_base_addr + reg;
1151 +
1152 +diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c
1153 +index c7f463172e4b..b4b44e9b5901 100644
1154 +--- a/drivers/clk/socfpga/clk-pll.c
1155 ++++ b/drivers/clk/socfpga/clk-pll.c
1156 +@@ -100,6 +100,7 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
1157 +
1158 + clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
1159 + clk_mgr_base_addr = of_iomap(clkmgr_np, 0);
1160 ++ of_node_put(clkmgr_np);
1161 + BUG_ON(!clk_mgr_base_addr);
1162 + pll_clk->hw.reg = clk_mgr_base_addr + reg;
1163 +
1164 +diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
1165 +index bca9573e036a..32b2dab69fd7 100644
1166 +--- a/drivers/clocksource/timer-sun5i.c
1167 ++++ b/drivers/clocksource/timer-sun5i.c
1168 +@@ -201,6 +201,11 @@ static int __init sun5i_setup_clocksource(struct device_node *node,
1169 + }
1170 +
1171 + rate = clk_get_rate(clk);
1172 ++ if (!rate) {
1173 ++ pr_err("Couldn't get parent clock rate\n");
1174 ++ ret = -EINVAL;
1175 ++ goto err_disable_clk;
1176 ++ }
1177 +
1178 + cs->timer.base = base;
1179 + cs->timer.clk = clk;
1180 +@@ -274,6 +279,11 @@ static int __init sun5i_setup_clockevent(struct device_node *node, void __iomem
1181 + }
1182 +
1183 + rate = clk_get_rate(clk);
1184 ++ if (!rate) {
1185 ++ pr_err("Couldn't get parent clock rate\n");
1186 ++ ret = -EINVAL;
1187 ++ goto err_disable_clk;
1188 ++ }
1189 +
1190 + ce->timer.base = base;
1191 + ce->timer.ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
1192 +diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
1193 +index 9b92af2c7241..a77319bf221d 100644
1194 +--- a/drivers/crypto/caam/caamrng.c
1195 ++++ b/drivers/crypto/caam/caamrng.c
1196 +@@ -361,7 +361,10 @@ static int __init caam_rng_init(void)
1197 + goto free_rng_ctx;
1198 +
1199 + dev_info(dev, "registering rng-caam\n");
1200 +- return hwrng_register(&caam_rng);
1201 ++
1202 ++ err = hwrng_register(&caam_rng);
1203 ++ if (!err)
1204 ++ return err;
1205 +
1206 + free_rng_ctx:
1207 + kfree(rng_ctx);
1208 +diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c
1209 +index 5b2395e7e04d..6de3d2142c7d 100644
1210 +--- a/drivers/dma/dma-axi-dmac.c
1211 ++++ b/drivers/dma/dma-axi-dmac.c
1212 +@@ -441,7 +441,7 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_interleaved(
1213 +
1214 + if (chan->hw_2d) {
1215 + if (!axi_dmac_check_len(chan, xt->sgl[0].size) ||
1216 +- !axi_dmac_check_len(chan, xt->numf))
1217 ++ xt->numf == 0)
1218 + return NULL;
1219 + if (xt->sgl[0].size + dst_icg > chan->max_length ||
1220 + xt->sgl[0].size + src_icg > chan->max_length)
1221 +diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
1222 +index 68a4815750b5..22d0cc1855b5 100644
1223 +--- a/drivers/dma/dw/platform.c
1224 ++++ b/drivers/dma/dw/platform.c
1225 +@@ -87,13 +87,20 @@ static void dw_dma_acpi_controller_register(struct dw_dma *dw)
1226 + dma_cap_set(DMA_SLAVE, info->dma_cap);
1227 + info->filter_fn = dw_dma_acpi_filter;
1228 +
1229 +- ret = devm_acpi_dma_controller_register(dev, acpi_dma_simple_xlate,
1230 +- info);
1231 ++ ret = acpi_dma_controller_register(dev, acpi_dma_simple_xlate, info);
1232 + if (ret)
1233 + dev_err(dev, "could not register acpi_dma_controller\n");
1234 + }
1235 ++
1236 ++static void dw_dma_acpi_controller_free(struct dw_dma *dw)
1237 ++{
1238 ++ struct device *dev = dw->dma.dev;
1239 ++
1240 ++ acpi_dma_controller_free(dev);
1241 ++}
1242 + #else /* !CONFIG_ACPI */
1243 + static inline void dw_dma_acpi_controller_register(struct dw_dma *dw) {}
1244 ++static inline void dw_dma_acpi_controller_free(struct dw_dma *dw) {}
1245 + #endif /* !CONFIG_ACPI */
1246 +
1247 + #ifdef CONFIG_OF
1248 +@@ -225,6 +232,9 @@ static int dw_remove(struct platform_device *pdev)
1249 + {
1250 + struct dw_dma_chip *chip = platform_get_drvdata(pdev);
1251 +
1252 ++ if (ACPI_HANDLE(&pdev->dev))
1253 ++ dw_dma_acpi_controller_free(chip->dw);
1254 ++
1255 + if (pdev->dev.of_node)
1256 + of_dma_controller_free(pdev->dev.of_node);
1257 +
1258 +diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
1259 +index e508c8c5f3fd..17521fcf226f 100644
1260 +--- a/drivers/dma/edma.c
1261 ++++ b/drivers/dma/edma.c
1262 +@@ -2288,8 +2288,10 @@ static int edma_probe(struct platform_device *pdev)
1263 +
1264 + ecc->tc_list = devm_kcalloc(dev, ecc->num_tc,
1265 + sizeof(*ecc->tc_list), GFP_KERNEL);
1266 +- if (!ecc->tc_list)
1267 +- return -ENOMEM;
1268 ++ if (!ecc->tc_list) {
1269 ++ ret = -ENOMEM;
1270 ++ goto err_reg1;
1271 ++ }
1272 +
1273 + for (i = 0;; i++) {
1274 + ret = of_parse_phandle_with_fixed_args(node, "ti,tptcs",
1275 +diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
1276 +index dd97dbf6618c..1dc06e0e890f 100644
1277 +--- a/drivers/dma/imx-sdma.c
1278 ++++ b/drivers/dma/imx-sdma.c
1279 +@@ -1411,6 +1411,14 @@ static void sdma_add_scripts(struct sdma_engine *sdma,
1280 + if (!sdma->script_number)
1281 + sdma->script_number = SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V1;
1282 +
1283 ++ if (sdma->script_number > sizeof(struct sdma_script_start_addrs)
1284 ++ / sizeof(s32)) {
1285 ++ dev_err(sdma->dev,
1286 ++ "SDMA script number %d not match with firmware.\n",
1287 ++ sdma->script_number);
1288 ++ return;
1289 ++ }
1290 ++
1291 + for (i = 0; i < sdma->script_number; i++)
1292 + if (addr_arr[i] > 0)
1293 + saddr_arr[i] = addr_arr[i];
1294 +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
1295 +index 2cb924ffd5a3..4d0f77f0edad 100644
1296 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c
1297 ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
1298 +@@ -975,9 +975,20 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_
1299 + static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port)
1300 + {
1301 + struct drm_dp_mst_port *rport = NULL;
1302 ++
1303 + mutex_lock(&mgr->lock);
1304 +- if (mgr->mst_primary)
1305 +- rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port);
1306 ++ /*
1307 ++ * Port may or may not be 'valid' but we don't care about that when
1308 ++ * destroying the port and we are guaranteed that the port pointer
1309 ++ * will be valid until we've finished
1310 ++ */
1311 ++ if (current_work() == &mgr->destroy_connector_work) {
1312 ++ kref_get(&port->kref);
1313 ++ rport = port;
1314 ++ } else if (mgr->mst_primary) {
1315 ++ rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary,
1316 ++ port);
1317 ++ }
1318 + mutex_unlock(&mgr->lock);
1319 + return rport;
1320 + }
1321 +diff --git a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
1322 +index fd266ed963b6..25a0e7d13340 100644
1323 +--- a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
1324 ++++ b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
1325 +@@ -383,19 +383,17 @@ static const unsigned int a3xx_registers[] = {
1326 + 0x2200, 0x2212, 0x2214, 0x2217, 0x221a, 0x221a, 0x2240, 0x227e,
1327 + 0x2280, 0x228b, 0x22c0, 0x22c0, 0x22c4, 0x22ce, 0x22d0, 0x22d8,
1328 + 0x22df, 0x22e6, 0x22e8, 0x22e9, 0x22ec, 0x22ec, 0x22f0, 0x22f7,
1329 +- 0x22ff, 0x22ff, 0x2340, 0x2343, 0x2348, 0x2349, 0x2350, 0x2356,
1330 +- 0x2360, 0x2360, 0x2440, 0x2440, 0x2444, 0x2444, 0x2448, 0x244d,
1331 +- 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470, 0x2472, 0x2472,
1332 +- 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3, 0x24e4, 0x24ef,
1333 +- 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e, 0x2510, 0x2511,
1334 +- 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea, 0x25ec, 0x25ed,
1335 +- 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617, 0x261a, 0x261a,
1336 +- 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0, 0x26c4, 0x26ce,
1337 +- 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9, 0x26ec, 0x26ec,
1338 +- 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743, 0x2748, 0x2749,
1339 +- 0x2750, 0x2756, 0x2760, 0x2760, 0x300c, 0x300e, 0x301c, 0x301d,
1340 +- 0x302a, 0x302a, 0x302c, 0x302d, 0x3030, 0x3031, 0x3034, 0x3036,
1341 +- 0x303c, 0x303c, 0x305e, 0x305f,
1342 ++ 0x22ff, 0x22ff, 0x2340, 0x2343, 0x2440, 0x2440, 0x2444, 0x2444,
1343 ++ 0x2448, 0x244d, 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470,
1344 ++ 0x2472, 0x2472, 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3,
1345 ++ 0x24e4, 0x24ef, 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e,
1346 ++ 0x2510, 0x2511, 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea,
1347 ++ 0x25ec, 0x25ed, 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617,
1348 ++ 0x261a, 0x261a, 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0,
1349 ++ 0x26c4, 0x26ce, 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9,
1350 ++ 0x26ec, 0x26ec, 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743,
1351 ++ 0x300c, 0x300e, 0x301c, 0x301d, 0x302a, 0x302a, 0x302c, 0x302d,
1352 ++ 0x3030, 0x3031, 0x3034, 0x3036, 0x303c, 0x303c, 0x305e, 0x305f,
1353 + ~0 /* sentinel */
1354 + };
1355 +
1356 +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
1357 +index 4c49868efcda..12ddbbb53107 100644
1358 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
1359 ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
1360 +@@ -30,6 +30,8 @@
1361 + #include "dsi.xml.h"
1362 + #include "dsi_cfg.h"
1363 +
1364 ++#define DSI_RESET_TOGGLE_DELAY_MS 20
1365 ++
1366 + static int dsi_get_version(const void __iomem *base, u32 *major, u32 *minor)
1367 + {
1368 + u32 ver;
1369 +@@ -764,7 +766,7 @@ static void dsi_sw_reset(struct msm_dsi_host *msm_host)
1370 + wmb(); /* clocks need to be enabled before reset */
1371 +
1372 + dsi_write(msm_host, REG_DSI_RESET, 1);
1373 +- wmb(); /* make sure reset happen */
1374 ++ msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
1375 + dsi_write(msm_host, REG_DSI_RESET, 0);
1376 + }
1377 +
1378 +@@ -1111,7 +1113,7 @@ static void dsi_sw_reset_restore(struct msm_dsi_host *msm_host)
1379 +
1380 + /* dsi controller can only be reset while clocks are running */
1381 + dsi_write(msm_host, REG_DSI_RESET, 1);
1382 +- wmb(); /* make sure reset happen */
1383 ++ msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
1384 + dsi_write(msm_host, REG_DSI_RESET, 0);
1385 + wmb(); /* controller out of reset */
1386 + dsi_write(msm_host, REG_DSI_CTRL, data0);
1387 +diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
1388 +index bb1225aa2f75..89305ad3cde2 100644
1389 +--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
1390 ++++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
1391 +@@ -547,7 +547,7 @@ fail:
1392 + if (cfg_handler)
1393 + mdp5_cfg_destroy(cfg_handler);
1394 +
1395 +- return NULL;
1396 ++ return ERR_PTR(ret);
1397 + }
1398 +
1399 + static struct mdp5_cfg_platform *mdp5_get_config(struct platform_device *dev)
1400 +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
1401 +index 60ece0a8a2e1..1d2d6bae73cd 100644
1402 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
1403 ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
1404 +@@ -87,7 +87,7 @@ nvkm_gddr3_calc(struct nvkm_ram *ram)
1405 + WR = (ram->next->bios.timing[2] & 0x007f0000) >> 16;
1406 + /* XXX: Get these values from the VBIOS instead */
1407 + DLL = !(ram->mr[1] & 0x1);
1408 +- RON = !(ram->mr[1] & 0x300) >> 8;
1409 ++ RON = !((ram->mr[1] & 0x300) >> 8);
1410 + break;
1411 + default:
1412 + return -ENOSYS;
1413 +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
1414 +index e6f74168238c..2ef9e942f43a 100644
1415 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
1416 ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
1417 +@@ -87,10 +87,10 @@ nvkm_memx_fini(struct nvkm_memx **pmemx, bool exec)
1418 + if (exec) {
1419 + nvkm_pmu_send(pmu, reply, PROC_MEMX, MEMX_MSG_EXEC,
1420 + memx->base, finish);
1421 ++ nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
1422 ++ reply[0], reply[1]);
1423 + }
1424 +
1425 +- nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
1426 +- reply[0], reply[1]);
1427 + kfree(memx);
1428 + return 0;
1429 + }
1430 +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
1431 +index 80b6d6e4721a..7acde09c8e8f 100644
1432 +--- a/drivers/gpu/drm/radeon/cik.c
1433 ++++ b/drivers/gpu/drm/radeon/cik.c
1434 +@@ -7372,8 +7372,8 @@ static int cik_irq_init(struct radeon_device *rdev)
1435 + }
1436 +
1437 + /* setup interrupt control */
1438 +- /* XXX this should actually be a bus address, not an MC address. same on older asics */
1439 +- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
1440 ++ /* set dummy read address to dummy page address */
1441 ++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
1442 + interrupt_cntl = RREG32(INTERRUPT_CNTL);
1443 + /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
1444 + * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
1445 +diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
1446 +index 0e20c08f8977..2056224d0b3c 100644
1447 +--- a/drivers/gpu/drm/radeon/r600.c
1448 ++++ b/drivers/gpu/drm/radeon/r600.c
1449 +@@ -3647,8 +3647,8 @@ int r600_irq_init(struct radeon_device *rdev)
1450 + }
1451 +
1452 + /* setup interrupt control */
1453 +- /* set dummy read address to ring address */
1454 +- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
1455 ++ /* set dummy read address to dummy page address */
1456 ++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
1457 + interrupt_cntl = RREG32(INTERRUPT_CNTL);
1458 + /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
1459 + * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
1460 +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
1461 +index 5cf3a2cbc07e..4128c98d9054 100644
1462 +--- a/drivers/gpu/drm/radeon/si.c
1463 ++++ b/drivers/gpu/drm/radeon/si.c
1464 +@@ -6013,8 +6013,8 @@ static int si_irq_init(struct radeon_device *rdev)
1465 + }
1466 +
1467 + /* setup interrupt control */
1468 +- /* set dummy read address to ring address */
1469 +- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
1470 ++ /* set dummy read address to dummy page address */
1471 ++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
1472 + interrupt_cntl = RREG32(INTERRUPT_CNTL);
1473 + /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
1474 + * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
1475 +diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
1476 +index a1b3ea1ccb65..772a5a3b0ce1 100644
1477 +--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
1478 ++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
1479 +@@ -681,11 +681,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
1480 + {
1481 + struct virtio_gpu_get_capset *cmd_p;
1482 + struct virtio_gpu_vbuffer *vbuf;
1483 +- int max_size = vgdev->capsets[idx].max_size;
1484 ++ int max_size;
1485 + struct virtio_gpu_drv_cap_cache *cache_ent;
1486 + void *resp_buf;
1487 +
1488 +- if (idx > vgdev->num_capsets)
1489 ++ if (idx >= vgdev->num_capsets)
1490 + return -EINVAL;
1491 +
1492 + if (version > vgdev->capsets[idx].max_version)
1493 +@@ -695,6 +695,7 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
1494 + if (!cache_ent)
1495 + return -ENOMEM;
1496 +
1497 ++ max_size = vgdev->capsets[idx].max_size;
1498 + cache_ent->caps_cache = kmalloc(max_size, GFP_KERNEL);
1499 + if (!cache_ent->caps_cache) {
1500 + kfree(cache_ent);
1501 +diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c
1502 +index 9c262d955331..d2583caa8087 100644
1503 +--- a/drivers/hwmon/adt7475.c
1504 ++++ b/drivers/hwmon/adt7475.c
1505 +@@ -268,9 +268,10 @@ static inline u16 volt2reg(int channel, long volt, u8 bypass_attn)
1506 + long reg;
1507 +
1508 + if (bypass_attn & (1 << channel))
1509 +- reg = (volt * 1024) / 2250;
1510 ++ reg = DIV_ROUND_CLOSEST(volt * 1024, 2250);
1511 + else
1512 +- reg = (volt * r[1] * 1024) / ((r[0] + r[1]) * 2250);
1513 ++ reg = DIV_ROUND_CLOSEST(volt * r[1] * 1024,
1514 ++ (r[0] + r[1]) * 2250);
1515 + return clamp_val(reg, 0, 1023) & (0xff << 2);
1516 + }
1517 +
1518 +diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
1519 +index 7f8738a83cb9..40addb213bdf 100644
1520 +--- a/drivers/hwmon/nct7802.c
1521 ++++ b/drivers/hwmon/nct7802.c
1522 +@@ -32,8 +32,8 @@
1523 + static const u8 REG_VOLTAGE[5] = { 0x09, 0x0a, 0x0c, 0x0d, 0x0e };
1524 +
1525 + static const u8 REG_VOLTAGE_LIMIT_LSB[2][5] = {
1526 +- { 0x40, 0x00, 0x42, 0x44, 0x46 },
1527 +- { 0x3f, 0x00, 0x41, 0x43, 0x45 },
1528 ++ { 0x46, 0x00, 0x40, 0x42, 0x44 },
1529 ++ { 0x45, 0x00, 0x3f, 0x41, 0x43 },
1530 + };
1531 +
1532 + static const u8 REG_VOLTAGE_LIMIT_MSB[5] = { 0x48, 0x00, 0x47, 0x47, 0x48 };
1533 +diff --git a/drivers/hwmon/shtc1.c b/drivers/hwmon/shtc1.c
1534 +index decd7df995ab..2a18539591ea 100644
1535 +--- a/drivers/hwmon/shtc1.c
1536 ++++ b/drivers/hwmon/shtc1.c
1537 +@@ -38,7 +38,7 @@ static const unsigned char shtc1_cmd_read_id_reg[] = { 0xef, 0xc8 };
1538 +
1539 + /* constants for reading the ID register */
1540 + #define SHTC1_ID 0x07
1541 +-#define SHTC1_ID_REG_MASK 0x1f
1542 ++#define SHTC1_ID_REG_MASK 0x3f
1543 +
1544 + /* delays for non-blocking i2c commands, both in us */
1545 + #define SHTC1_NONBLOCKING_WAIT_TIME_HPM 14400
1546 +diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
1547 +index 721295b9a051..43c0f89cefdf 100644
1548 +--- a/drivers/hwmon/w83627hf.c
1549 ++++ b/drivers/hwmon/w83627hf.c
1550 +@@ -130,17 +130,23 @@ superio_select(struct w83627hf_sio_data *sio, int ld)
1551 + outb(ld, sio->sioaddr + 1);
1552 + }
1553 +
1554 +-static inline void
1555 ++static inline int
1556 + superio_enter(struct w83627hf_sio_data *sio)
1557 + {
1558 ++ if (!request_muxed_region(sio->sioaddr, 2, DRVNAME))
1559 ++ return -EBUSY;
1560 ++
1561 + outb(0x87, sio->sioaddr);
1562 + outb(0x87, sio->sioaddr);
1563 ++
1564 ++ return 0;
1565 + }
1566 +
1567 + static inline void
1568 + superio_exit(struct w83627hf_sio_data *sio)
1569 + {
1570 + outb(0xAA, sio->sioaddr);
1571 ++ release_region(sio->sioaddr, 2);
1572 + }
1573 +
1574 + #define W627_DEVID 0x52
1575 +@@ -1275,7 +1281,7 @@ static DEVICE_ATTR(name, S_IRUGO, show_name, NULL);
1576 + static int __init w83627hf_find(int sioaddr, unsigned short *addr,
1577 + struct w83627hf_sio_data *sio_data)
1578 + {
1579 +- int err = -ENODEV;
1580 ++ int err;
1581 + u16 val;
1582 +
1583 + static __initconst char *const names[] = {
1584 +@@ -1287,7 +1293,11 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
1585 + };
1586 +
1587 + sio_data->sioaddr = sioaddr;
1588 +- superio_enter(sio_data);
1589 ++ err = superio_enter(sio_data);
1590 ++ if (err)
1591 ++ return err;
1592 ++
1593 ++ err = -ENODEV;
1594 + val = force_id ? force_id : superio_inb(sio_data, DEVID);
1595 + switch (val) {
1596 + case W627_DEVID:
1597 +@@ -1641,9 +1651,21 @@ static int w83627thf_read_gpio5(struct platform_device *pdev)
1598 + struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
1599 + int res = 0xff, sel;
1600 +
1601 +- superio_enter(sio_data);
1602 ++ if (superio_enter(sio_data)) {
1603 ++ /*
1604 ++ * Some other driver reserved the address space for itself.
1605 ++ * We don't want to fail driver instantiation because of that,
1606 ++ * so display a warning and keep going.
1607 ++ */
1608 ++ dev_warn(&pdev->dev,
1609 ++ "Can not read VID data: Failed to enable SuperIO access\n");
1610 ++ return res;
1611 ++ }
1612 ++
1613 + superio_select(sio_data, W83627HF_LD_GPIO5);
1614 +
1615 ++ res = 0xff;
1616 ++
1617 + /* Make sure these GPIO pins are enabled */
1618 + if (!(superio_inb(sio_data, W83627THF_GPIO5_EN) & (1<<3))) {
1619 + dev_dbg(&pdev->dev, "GPIO5 disabled, no VID function\n");
1620 +@@ -1674,7 +1696,17 @@ static int w83687thf_read_vid(struct platform_device *pdev)
1621 + struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
1622 + int res = 0xff;
1623 +
1624 +- superio_enter(sio_data);
1625 ++ if (superio_enter(sio_data)) {
1626 ++ /*
1627 ++ * Some other driver reserved the address space for itself.
1628 ++ * We don't want to fail driver instantiation because of that,
1629 ++ * so display a warning and keep going.
1630 ++ */
1631 ++ dev_warn(&pdev->dev,
1632 ++ "Can not read VID data: Failed to enable SuperIO access\n");
1633 ++ return res;
1634 ++ }
1635 ++
1636 + superio_select(sio_data, W83627HF_LD_HWM);
1637 +
1638 + /* Make sure these GPIO pins are enabled */
1639 +diff --git a/drivers/iio/dac/ad5380.c b/drivers/iio/dac/ad5380.c
1640 +index 97d2c5111f43..8bf7fc626a9d 100644
1641 +--- a/drivers/iio/dac/ad5380.c
1642 ++++ b/drivers/iio/dac/ad5380.c
1643 +@@ -221,7 +221,7 @@ static int ad5380_read_raw(struct iio_dev *indio_dev,
1644 + if (ret)
1645 + return ret;
1646 + *val >>= chan->scan_type.shift;
1647 +- val -= (1 << chan->scan_type.realbits) / 2;
1648 ++ *val -= (1 << chan->scan_type.realbits) / 2;
1649 + return IIO_VAL_INT;
1650 + case IIO_CHAN_INFO_SCALE:
1651 + *val = 2 * st->vref;
1652 +diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
1653 +index 961afb5588be..864a61b05665 100644
1654 +--- a/drivers/iio/industrialio-buffer.c
1655 ++++ b/drivers/iio/industrialio-buffer.c
1656 +@@ -527,7 +527,7 @@ static int iio_compute_scan_bytes(struct iio_dev *indio_dev,
1657 + {
1658 + const struct iio_chan_spec *ch;
1659 + unsigned bytes = 0;
1660 +- int length, i;
1661 ++ int length, i, largest = 0;
1662 +
1663 + /* How much space will the demuxed element take? */
1664 + for_each_set_bit(i, mask,
1665 +@@ -540,6 +540,7 @@ static int iio_compute_scan_bytes(struct iio_dev *indio_dev,
1666 + length = ch->scan_type.storagebits / 8;
1667 + bytes = ALIGN(bytes, length);
1668 + bytes += length;
1669 ++ largest = max(largest, length);
1670 + }
1671 + if (timestamp) {
1672 + ch = iio_find_channel_from_si(indio_dev,
1673 +@@ -551,7 +552,10 @@ static int iio_compute_scan_bytes(struct iio_dev *indio_dev,
1674 + length = ch->scan_type.storagebits / 8;
1675 + bytes = ALIGN(bytes, length);
1676 + bytes += length;
1677 ++ largest = max(largest, length);
1678 + }
1679 ++
1680 ++ bytes = ALIGN(bytes, largest);
1681 + return bytes;
1682 + }
1683 +
1684 +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
1685 +index 43d277a931c2..eac5f5eff8d2 100644
1686 +--- a/drivers/infiniband/hw/mlx5/qp.c
1687 ++++ b/drivers/infiniband/hw/mlx5/qp.c
1688 +@@ -1426,6 +1426,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
1689 + [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_PKEY_INDEX |
1690 + MLX5_QP_OPTPAR_Q_KEY |
1691 + MLX5_QP_OPTPAR_PRI_PORT,
1692 ++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE |
1693 ++ MLX5_QP_OPTPAR_RAE |
1694 ++ MLX5_QP_OPTPAR_RWE |
1695 ++ MLX5_QP_OPTPAR_PKEY_INDEX |
1696 ++ MLX5_QP_OPTPAR_PRI_PORT,
1697 + },
1698 + [MLX5_QP_STATE_RTR] = {
1699 + [MLX5_QP_ST_RC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH |
1700 +@@ -1459,6 +1464,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
1701 + MLX5_QP_OPTPAR_RWE |
1702 + MLX5_QP_OPTPAR_PM_STATE,
1703 + [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY,
1704 ++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH |
1705 ++ MLX5_QP_OPTPAR_RRE |
1706 ++ MLX5_QP_OPTPAR_RAE |
1707 ++ MLX5_QP_OPTPAR_RWE |
1708 ++ MLX5_QP_OPTPAR_PM_STATE |
1709 ++ MLX5_QP_OPTPAR_RNR_TIMEOUT,
1710 + },
1711 + },
1712 + [MLX5_QP_STATE_RTS] = {
1713 +@@ -1475,6 +1486,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
1714 + [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY |
1715 + MLX5_QP_OPTPAR_SRQN |
1716 + MLX5_QP_OPTPAR_CQN_RCV,
1717 ++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE |
1718 ++ MLX5_QP_OPTPAR_RAE |
1719 ++ MLX5_QP_OPTPAR_RWE |
1720 ++ MLX5_QP_OPTPAR_RNR_TIMEOUT |
1721 ++ MLX5_QP_OPTPAR_PM_STATE |
1722 ++ MLX5_QP_OPTPAR_ALT_ADDR_PATH,
1723 + },
1724 + },
1725 + [MLX5_QP_STATE_SQER] = {
1726 +@@ -1486,6 +1503,10 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
1727 + MLX5_QP_OPTPAR_RWE |
1728 + MLX5_QP_OPTPAR_RAE |
1729 + MLX5_QP_OPTPAR_RRE,
1730 ++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RNR_TIMEOUT |
1731 ++ MLX5_QP_OPTPAR_RWE |
1732 ++ MLX5_QP_OPTPAR_RAE |
1733 ++ MLX5_QP_OPTPAR_RRE,
1734 + },
1735 + },
1736 + };
1737 +diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
1738 +index 76e96f97b3f6..6385448b22c5 100644
1739 +--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
1740 ++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
1741 +@@ -55,7 +55,7 @@
1742 +
1743 + int ocrdma_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
1744 + {
1745 +- if (index > 1)
1746 ++ if (index > 0)
1747 + return -EINVAL;
1748 +
1749 + *pkey = 0xffff;
1750 +diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
1751 +index f8e3211689a3..8e18bfca5516 100644
1752 +--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
1753 ++++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
1754 +@@ -427,7 +427,7 @@ int usnic_ib_query_gid(struct ib_device *ibdev, u8 port, int index,
1755 + int usnic_ib_query_pkey(struct ib_device *ibdev, u8 port, u16 index,
1756 + u16 *pkey)
1757 + {
1758 +- if (index > 1)
1759 ++ if (index > 0)
1760 + return -EINVAL;
1761 +
1762 + *pkey = 0xffff;
1763 +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
1764 +index 0b7f5a701c60..32ef17e1aef8 100644
1765 +--- a/drivers/infiniband/ulp/isert/ib_isert.c
1766 ++++ b/drivers/infiniband/ulp/isert/ib_isert.c
1767 +@@ -3277,17 +3277,6 @@ isert_wait4logout(struct isert_conn *isert_conn)
1768 + }
1769 + }
1770 +
1771 +-static void
1772 +-isert_wait4cmds(struct iscsi_conn *conn)
1773 +-{
1774 +- isert_info("iscsi_conn %p\n", conn);
1775 +-
1776 +- if (conn->sess) {
1777 +- target_sess_cmd_list_set_waiting(conn->sess->se_sess);
1778 +- target_wait_for_sess_cmds(conn->sess->se_sess);
1779 +- }
1780 +-}
1781 +-
1782 + static void
1783 + isert_wait4flush(struct isert_conn *isert_conn)
1784 + {
1785 +@@ -3361,7 +3350,6 @@ static void isert_wait_conn(struct iscsi_conn *conn)
1786 +
1787 + isert_wait4flush(isert_conn);
1788 + isert_put_unsol_pending_cmds(conn);
1789 +- isert_wait4cmds(conn);
1790 + isert_wait4logout(isert_conn);
1791 +
1792 + queue_work(isert_release_wq, &isert_conn->release_work);
1793 +diff --git a/drivers/input/keyboard/nomadik-ske-keypad.c b/drivers/input/keyboard/nomadik-ske-keypad.c
1794 +index 8567ee47761e..ae3b04557074 100644
1795 +--- a/drivers/input/keyboard/nomadik-ske-keypad.c
1796 ++++ b/drivers/input/keyboard/nomadik-ske-keypad.c
1797 +@@ -100,7 +100,7 @@ static int __init ske_keypad_chip_init(struct ske_keypad *keypad)
1798 + while ((readl(keypad->reg_base + SKE_RIS) != 0x00000000) && timeout--)
1799 + cpu_relax();
1800 +
1801 +- if (!timeout)
1802 ++ if (timeout == -1)
1803 + return -EINVAL;
1804 +
1805 + /*
1806 +diff --git a/drivers/input/misc/keyspan_remote.c b/drivers/input/misc/keyspan_remote.c
1807 +index a3fe4a990cc9..c7b889d13edd 100644
1808 +--- a/drivers/input/misc/keyspan_remote.c
1809 ++++ b/drivers/input/misc/keyspan_remote.c
1810 +@@ -344,7 +344,8 @@ static int keyspan_setup(struct usb_device* dev)
1811 + int retval = 0;
1812 +
1813 + retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
1814 +- 0x11, 0x40, 0x5601, 0x0, NULL, 0, 0);
1815 ++ 0x11, 0x40, 0x5601, 0x0, NULL, 0,
1816 ++ USB_CTRL_SET_TIMEOUT);
1817 + if (retval) {
1818 + dev_dbg(&dev->dev, "%s - failed to set bit rate due to error: %d\n",
1819 + __func__, retval);
1820 +@@ -352,7 +353,8 @@ static int keyspan_setup(struct usb_device* dev)
1821 + }
1822 +
1823 + retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
1824 +- 0x44, 0x40, 0x0, 0x0, NULL, 0, 0);
1825 ++ 0x44, 0x40, 0x0, 0x0, NULL, 0,
1826 ++ USB_CTRL_SET_TIMEOUT);
1827 + if (retval) {
1828 + dev_dbg(&dev->dev, "%s - failed to set resume sensitivity due to error: %d\n",
1829 + __func__, retval);
1830 +@@ -360,7 +362,8 @@ static int keyspan_setup(struct usb_device* dev)
1831 + }
1832 +
1833 + retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
1834 +- 0x22, 0x40, 0x0, 0x0, NULL, 0, 0);
1835 ++ 0x22, 0x40, 0x0, 0x0, NULL, 0,
1836 ++ USB_CTRL_SET_TIMEOUT);
1837 + if (retval) {
1838 + dev_dbg(&dev->dev, "%s - failed to turn receive on due to error: %d\n",
1839 + __func__, retval);
1840 +diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
1841 +index 78ca44840d60..40a166773c1b 100644
1842 +--- a/drivers/input/tablet/aiptek.c
1843 ++++ b/drivers/input/tablet/aiptek.c
1844 +@@ -1820,14 +1820,14 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
1845 + input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0);
1846 +
1847 + /* Verify that a device really has an endpoint */
1848 +- if (intf->altsetting[0].desc.bNumEndpoints < 1) {
1849 ++ if (intf->cur_altsetting->desc.bNumEndpoints < 1) {
1850 + dev_err(&intf->dev,
1851 + "interface has %d endpoints, but must have minimum 1\n",
1852 +- intf->altsetting[0].desc.bNumEndpoints);
1853 ++ intf->cur_altsetting->desc.bNumEndpoints);
1854 + err = -EINVAL;
1855 + goto fail3;
1856 + }
1857 +- endpoint = &intf->altsetting[0].endpoint[0].desc;
1858 ++ endpoint = &intf->cur_altsetting->endpoint[0].desc;
1859 +
1860 + /* Go set up our URB, which is called when the tablet receives
1861 + * input.
1862 +diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
1863 +index 5a0e4cd86353..67dc17c8bba9 100644
1864 +--- a/drivers/input/tablet/gtco.c
1865 ++++ b/drivers/input/tablet/gtco.c
1866 +@@ -876,18 +876,14 @@ static int gtco_probe(struct usb_interface *usbinterface,
1867 + }
1868 +
1869 + /* Sanity check that a device has an endpoint */
1870 +- if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) {
1871 ++ if (usbinterface->cur_altsetting->desc.bNumEndpoints < 1) {
1872 + dev_err(&usbinterface->dev,
1873 + "Invalid number of endpoints\n");
1874 + error = -EINVAL;
1875 + goto err_free_urb;
1876 + }
1877 +
1878 +- /*
1879 +- * The endpoint is always altsetting 0, we know this since we know
1880 +- * this device only has one interrupt endpoint
1881 +- */
1882 +- endpoint = &usbinterface->altsetting[0].endpoint[0].desc;
1883 ++ endpoint = &usbinterface->cur_altsetting->endpoint[0].desc;
1884 +
1885 + /* Some debug */
1886 + dev_dbg(&usbinterface->dev, "gtco # interfaces: %d\n", usbinterface->num_altsetting);
1887 +@@ -974,7 +970,7 @@ static int gtco_probe(struct usb_interface *usbinterface,
1888 + input_dev->dev.parent = &usbinterface->dev;
1889 +
1890 + /* Setup the URB, it will be posted later on open of input device */
1891 +- endpoint = &usbinterface->altsetting[0].endpoint[0].desc;
1892 ++ endpoint = &usbinterface->cur_altsetting->endpoint[0].desc;
1893 +
1894 + usb_fill_int_urb(gtco->urbinfo,
1895 + gtco->usbdev,
1896 +diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
1897 +index 0146e2c74649..6178e28baaba 100644
1898 +--- a/drivers/input/touchscreen/sur40.c
1899 ++++ b/drivers/input/touchscreen/sur40.c
1900 +@@ -496,7 +496,7 @@ static int sur40_probe(struct usb_interface *interface,
1901 + int error;
1902 +
1903 + /* Check if we really have the right interface. */
1904 +- iface_desc = &interface->altsetting[0];
1905 ++ iface_desc = interface->cur_altsetting;
1906 + if (iface_desc->desc.bInterfaceClass != 0xFF)
1907 + return -ENODEV;
1908 +
1909 +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
1910 +index 0ad8b7c78a43..66a406e87e11 100644
1911 +--- a/drivers/iommu/amd_iommu.c
1912 ++++ b/drivers/iommu/amd_iommu.c
1913 +@@ -2184,6 +2184,8 @@ static int attach_device(struct device *dev,
1914 + */
1915 + domain_flush_tlb_pde(domain);
1916 +
1917 ++ domain_flush_complete(domain);
1918 ++
1919 + return ret;
1920 + }
1921 +
1922 +diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
1923 +index 6a69b5bb231f..036fb186a3be 100644
1924 +--- a/drivers/iommu/amd_iommu_init.c
1925 ++++ b/drivers/iommu/amd_iommu_init.c
1926 +@@ -360,6 +360,9 @@ static void iommu_enable(struct amd_iommu *iommu)
1927 +
1928 + static void iommu_disable(struct amd_iommu *iommu)
1929 + {
1930 ++ if (!iommu->mmio_base)
1931 ++ return;
1932 ++
1933 + /* Disable command buffer */
1934 + iommu_feature_disable(iommu, CONTROL_CMDBUF_EN);
1935 +
1936 +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
1937 +index b965561a4162..a2005b82ec8f 100644
1938 +--- a/drivers/iommu/intel-iommu.c
1939 ++++ b/drivers/iommu/intel-iommu.c
1940 +@@ -3259,9 +3259,12 @@ static int __init init_dmars(void)
1941 + iommu_identity_mapping |= IDENTMAP_ALL;
1942 +
1943 + #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA
1944 +- iommu_identity_mapping |= IDENTMAP_GFX;
1945 ++ dmar_map_gfx = 0;
1946 + #endif
1947 +
1948 ++ if (!dmar_map_gfx)
1949 ++ iommu_identity_mapping |= IDENTMAP_GFX;
1950 ++
1951 + check_tylersburg_isoch();
1952 +
1953 + if (iommu_identity_mapping) {
1954 +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
1955 +index 5d5066cf3bbd..589207176ffa 100644
1956 +--- a/drivers/iommu/iommu.c
1957 ++++ b/drivers/iommu/iommu.c
1958 +@@ -1594,9 +1594,9 @@ int iommu_request_dm_for_dev(struct device *dev)
1959 + int ret;
1960 +
1961 + /* Device must already be in a group before calling this function */
1962 +- group = iommu_group_get_for_dev(dev);
1963 +- if (IS_ERR(group))
1964 +- return PTR_ERR(group);
1965 ++ group = iommu_group_get(dev);
1966 ++ if (!group)
1967 ++ return -EINVAL;
1968 +
1969 + mutex_lock(&group->mutex);
1970 +
1971 +diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
1972 +index 7a50728b9389..391090c455ce 100644
1973 +--- a/drivers/md/bitmap.c
1974 ++++ b/drivers/md/bitmap.c
1975 +@@ -1671,7 +1671,7 @@ void bitmap_flush(struct mddev *mddev)
1976 + /*
1977 + * free memory that was allocated
1978 + */
1979 +-static void bitmap_free(struct bitmap *bitmap)
1980 ++static void md_bitmap_free(struct bitmap *bitmap)
1981 + {
1982 + unsigned long k, pages;
1983 + struct bitmap_page *bp;
1984 +@@ -1721,7 +1721,7 @@ void bitmap_destroy(struct mddev *mddev)
1985 + if (bitmap->sysfs_can_clear)
1986 + sysfs_put(bitmap->sysfs_can_clear);
1987 +
1988 +- bitmap_free(bitmap);
1989 ++ md_bitmap_free(bitmap);
1990 + }
1991 +
1992 + /*
1993 +@@ -1805,7 +1805,7 @@ struct bitmap *bitmap_create(struct mddev *mddev, int slot)
1994 +
1995 + return bitmap;
1996 + error:
1997 +- bitmap_free(bitmap);
1998 ++ md_bitmap_free(bitmap);
1999 + return ERR_PTR(err);
2000 + }
2001 +
2002 +@@ -1904,7 +1904,7 @@ int bitmap_copy_from_slot(struct mddev *mddev, int slot,
2003 + *low = lo;
2004 + *high = hi;
2005 + err:
2006 +- bitmap_free(bitmap);
2007 ++ md_bitmap_free(bitmap);
2008 + return rv;
2009 + }
2010 + EXPORT_SYMBOL_GPL(bitmap_copy_from_slot);
2011 +diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
2012 +index 6eefb8bbb5b5..20e3c56991cf 100644
2013 +--- a/drivers/media/i2c/ov2659.c
2014 ++++ b/drivers/media/i2c/ov2659.c
2015 +@@ -1137,7 +1137,7 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd,
2016 + mf = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
2017 + *mf = fmt->format;
2018 + #else
2019 +- return -ENOTTY;
2020 ++ ret = -ENOTTY;
2021 + #endif
2022 + } else {
2023 + s64 val;
2024 +diff --git a/drivers/media/i2c/soc_camera/ov6650.c b/drivers/media/i2c/soc_camera/ov6650.c
2025 +index bb55ddfbf733..7928ea8528e1 100644
2026 +--- a/drivers/media/i2c/soc_camera/ov6650.c
2027 ++++ b/drivers/media/i2c/soc_camera/ov6650.c
2028 +@@ -203,7 +203,6 @@ struct ov6650 {
2029 + unsigned long pclk_max; /* from resolution and format */
2030 + struct v4l2_fract tpf; /* as requested with s_parm */
2031 + u32 code;
2032 +- enum v4l2_colorspace colorspace;
2033 + };
2034 +
2035 +
2036 +@@ -216,6 +215,17 @@ static u32 ov6650_codes[] = {
2037 + MEDIA_BUS_FMT_Y8_1X8,
2038 + };
2039 +
2040 ++static const struct v4l2_mbus_framefmt ov6650_def_fmt = {
2041 ++ .width = W_CIF,
2042 ++ .height = H_CIF,
2043 ++ .code = MEDIA_BUS_FMT_SBGGR8_1X8,
2044 ++ .colorspace = V4L2_COLORSPACE_SRGB,
2045 ++ .field = V4L2_FIELD_NONE,
2046 ++ .ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT,
2047 ++ .quantization = V4L2_QUANTIZATION_DEFAULT,
2048 ++ .xfer_func = V4L2_XFER_FUNC_DEFAULT,
2049 ++};
2050 ++
2051 + /* read a register */
2052 + static int ov6650_reg_read(struct i2c_client *client, u8 reg, u8 *val)
2053 + {
2054 +@@ -510,12 +520,20 @@ static int ov6650_get_fmt(struct v4l2_subdev *sd,
2055 + if (format->pad)
2056 + return -EINVAL;
2057 +
2058 +- mf->width = priv->rect.width >> priv->half_scale;
2059 +- mf->height = priv->rect.height >> priv->half_scale;
2060 +- mf->code = priv->code;
2061 +- mf->colorspace = priv->colorspace;
2062 +- mf->field = V4L2_FIELD_NONE;
2063 ++ /* initialize response with default media bus frame format */
2064 ++ *mf = ov6650_def_fmt;
2065 +
2066 ++ /* update media bus format code and frame size */
2067 ++ if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
2068 ++ mf->width = cfg->try_fmt.width;
2069 ++ mf->height = cfg->try_fmt.height;
2070 ++ mf->code = cfg->try_fmt.code;
2071 ++
2072 ++ } else {
2073 ++ mf->width = priv->rect.width >> priv->half_scale;
2074 ++ mf->height = priv->rect.height >> priv->half_scale;
2075 ++ mf->code = priv->code;
2076 ++ }
2077 + return 0;
2078 + }
2079 +
2080 +@@ -623,11 +641,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
2081 + priv->pclk_max = 8000000;
2082 + }
2083 +
2084 +- if (code == MEDIA_BUS_FMT_SBGGR8_1X8)
2085 +- priv->colorspace = V4L2_COLORSPACE_SRGB;
2086 +- else if (code != 0)
2087 +- priv->colorspace = V4L2_COLORSPACE_JPEG;
2088 +-
2089 + if (half_scale) {
2090 + dev_dbg(&client->dev, "max resolution: QCIF\n");
2091 + coma_set |= COMA_QCIF;
2092 +@@ -683,11 +696,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
2093 + if (!ret)
2094 + priv->code = code;
2095 +
2096 +- if (!ret) {
2097 +- mf->colorspace = priv->colorspace;
2098 +- mf->width = priv->rect.width >> half_scale;
2099 +- mf->height = priv->rect.height >> half_scale;
2100 +- }
2101 + return ret;
2102 + }
2103 +
2104 +@@ -706,8 +714,6 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
2105 + v4l_bound_align_image(&mf->width, 2, W_CIF, 1,
2106 + &mf->height, 2, H_CIF, 1, 0);
2107 +
2108 +- mf->field = V4L2_FIELD_NONE;
2109 +-
2110 + switch (mf->code) {
2111 + case MEDIA_BUS_FMT_Y10_1X10:
2112 + mf->code = MEDIA_BUS_FMT_Y8_1X8;
2113 +@@ -716,19 +722,38 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
2114 + case MEDIA_BUS_FMT_YUYV8_2X8:
2115 + case MEDIA_BUS_FMT_VYUY8_2X8:
2116 + case MEDIA_BUS_FMT_UYVY8_2X8:
2117 +- mf->colorspace = V4L2_COLORSPACE_JPEG;
2118 + break;
2119 + default:
2120 + mf->code = MEDIA_BUS_FMT_SBGGR8_1X8;
2121 + case MEDIA_BUS_FMT_SBGGR8_1X8:
2122 +- mf->colorspace = V4L2_COLORSPACE_SRGB;
2123 + break;
2124 + }
2125 +
2126 +- if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE)
2127 +- return ov6650_s_fmt(sd, mf);
2128 +- cfg->try_fmt = *mf;
2129 ++ if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
2130 ++ /* store media bus format code and frame size in pad config */
2131 ++ cfg->try_fmt.width = mf->width;
2132 ++ cfg->try_fmt.height = mf->height;
2133 ++ cfg->try_fmt.code = mf->code;
2134 +
2135 ++ /* return default mbus frame format updated with pad config */
2136 ++ *mf = ov6650_def_fmt;
2137 ++ mf->width = cfg->try_fmt.width;
2138 ++ mf->height = cfg->try_fmt.height;
2139 ++ mf->code = cfg->try_fmt.code;
2140 ++
2141 ++ } else {
2142 ++ /* apply new media bus format code and frame size */
2143 ++ int ret = ov6650_s_fmt(sd, mf);
2144 ++
2145 ++ if (ret)
2146 ++ return ret;
2147 ++
2148 ++ /* return default format updated with active size and code */
2149 ++ *mf = ov6650_def_fmt;
2150 ++ mf->width = priv->rect.width >> priv->half_scale;
2151 ++ mf->height = priv->rect.height >> priv->half_scale;
2152 ++ mf->code = priv->code;
2153 ++ }
2154 + return 0;
2155 + }
2156 +
2157 +@@ -1048,7 +1073,6 @@ static int ov6650_probe(struct i2c_client *client,
2158 + priv->rect.height = H_CIF;
2159 + priv->half_scale = false;
2160 + priv->code = MEDIA_BUS_FMT_YUYV8_2X8;
2161 +- priv->colorspace = V4L2_COLORSPACE_JPEG;
2162 +
2163 + ret = ov6650_video_probe(client);
2164 + if (ret)
2165 +diff --git a/drivers/media/pci/cx18/cx18-fileops.c b/drivers/media/pci/cx18/cx18-fileops.c
2166 +index df837408efd5..0171dc5b8809 100644
2167 +--- a/drivers/media/pci/cx18/cx18-fileops.c
2168 ++++ b/drivers/media/pci/cx18/cx18-fileops.c
2169 +@@ -490,7 +490,7 @@ static ssize_t cx18_read_pos(struct cx18_stream *s, char __user *ubuf,
2170 +
2171 + CX18_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
2172 + if (rc > 0)
2173 +- pos += rc;
2174 ++ *pos += rc;
2175 + return rc;
2176 + }
2177 +
2178 +diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
2179 +index e543cbbf2ec4..8fe78b8b1c25 100644
2180 +--- a/drivers/media/pci/cx23885/cx23885-dvb.c
2181 ++++ b/drivers/media/pci/cx23885/cx23885-dvb.c
2182 +@@ -1452,8 +1452,9 @@ static int dvb_register(struct cx23885_tsport *port)
2183 + if (fe0->dvb.frontend != NULL) {
2184 + struct i2c_adapter *tun_i2c;
2185 +
2186 +- fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL);
2187 +- memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops));
2188 ++ fe0->dvb.frontend->sec_priv = kmemdup(&dib7000p_ops, sizeof(dib7000p_ops), GFP_KERNEL);
2189 ++ if (!fe0->dvb.frontend->sec_priv)
2190 ++ return -ENOMEM;
2191 + tun_i2c = dib7000p_ops.get_i2c_master(fe0->dvb.frontend, DIBX000_I2C_INTERFACE_TUNER, 1);
2192 + if (!dvb_attach(dib0070_attach, fe0->dvb.frontend, tun_i2c, &dib7070p_dib0070_config))
2193 + return -ENODEV;
2194 +diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
2195 +index 605d280d8a5f..cb65fe6c49e0 100644
2196 +--- a/drivers/media/pci/ivtv/ivtv-fileops.c
2197 ++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
2198 +@@ -420,7 +420,7 @@ static ssize_t ivtv_read_pos(struct ivtv_stream *s, char __user *ubuf, size_t co
2199 +
2200 + IVTV_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
2201 + if (rc > 0)
2202 +- pos += rc;
2203 ++ *pos += rc;
2204 + return rc;
2205 + }
2206 +
2207 +diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
2208 +index 78e37cf3470f..b51b875c5a61 100644
2209 +--- a/drivers/media/platform/davinci/isif.c
2210 ++++ b/drivers/media/platform/davinci/isif.c
2211 +@@ -890,9 +890,7 @@ static int isif_set_hw_if_params(struct vpfe_hw_if_param *params)
2212 + static int isif_config_ycbcr(void)
2213 + {
2214 + struct isif_ycbcr_config *params = &isif_cfg.ycbcr;
2215 +- struct vpss_pg_frame_size frame_size;
2216 + u32 modeset = 0, ccdcfg = 0;
2217 +- struct vpss_sync_pol sync;
2218 +
2219 + dev_dbg(isif_cfg.dev, "\nStarting isif_config_ycbcr...");
2220 +
2221 +@@ -980,13 +978,6 @@ static int isif_config_ycbcr(void)
2222 + /* two fields are interleaved in memory */
2223 + regw(0x00000249, SDOFST);
2224 +
2225 +- /* Setup test pattern if enabled */
2226 +- if (isif_cfg.bayer.config_params.test_pat_gen) {
2227 +- sync.ccdpg_hdpol = params->hd_pol;
2228 +- sync.ccdpg_vdpol = params->vd_pol;
2229 +- dm365_vpss_set_sync_pol(sync);
2230 +- dm365_vpss_set_pg_frame_size(frame_size);
2231 +- }
2232 + return 0;
2233 + }
2234 +
2235 +diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c
2236 +index abce9c4a1a8e..59518c08528b 100644
2237 +--- a/drivers/media/platform/davinci/vpbe.c
2238 ++++ b/drivers/media/platform/davinci/vpbe.c
2239 +@@ -130,7 +130,7 @@ static int vpbe_enum_outputs(struct vpbe_device *vpbe_dev,
2240 + struct v4l2_output *output)
2241 + {
2242 + struct vpbe_config *cfg = vpbe_dev->cfg;
2243 +- int temp_index = output->index;
2244 ++ unsigned int temp_index = output->index;
2245 +
2246 + if (temp_index >= cfg->num_outputs)
2247 + return -EINVAL;
2248 +diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
2249 +index 596359576109..cf015bfc559b 100644
2250 +--- a/drivers/media/platform/omap/omap_vout.c
2251 ++++ b/drivers/media/platform/omap/omap_vout.c
2252 +@@ -1580,23 +1580,20 @@ static int vidioc_dqbuf(struct file *file, void *fh, struct v4l2_buffer *b)
2253 + unsigned long size;
2254 + struct videobuf_buffer *vb;
2255 +
2256 +- vb = q->bufs[b->index];
2257 +-
2258 + if (!vout->streaming)
2259 + return -EINVAL;
2260 +
2261 +- if (file->f_flags & O_NONBLOCK)
2262 +- /* Call videobuf_dqbuf for non blocking mode */
2263 +- ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 1);
2264 +- else
2265 +- /* Call videobuf_dqbuf for blocking mode */
2266 +- ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 0);
2267 ++ ret = videobuf_dqbuf(q, b, !!(file->f_flags & O_NONBLOCK));
2268 ++ if (ret)
2269 ++ return ret;
2270 ++
2271 ++ vb = q->bufs[b->index];
2272 +
2273 + addr = (unsigned long) vout->buf_phy_addr[vb->i];
2274 + size = (unsigned long) vb->size;
2275 + dma_unmap_single(vout->vid_dev->v4l2_dev.dev, addr,
2276 + size, DMA_TO_DEVICE);
2277 +- return ret;
2278 ++ return 0;
2279 + }
2280 +
2281 + static int vidioc_streamon(struct file *file, void *fh, enum v4l2_buf_type i)
2282 +diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
2283 +index 0d981bbf38bc..255f70999ee8 100644
2284 +--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
2285 ++++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
2286 +@@ -1952,7 +1952,7 @@ static int s5p_jpeg_controls_create(struct s5p_jpeg_ctx *ctx)
2287 +
2288 + v4l2_ctrl_new_std(&ctx->ctrl_handler, &s5p_jpeg_ctrl_ops,
2289 + V4L2_CID_JPEG_RESTART_INTERVAL,
2290 +- 0, 3, 0xffff, 0);
2291 ++ 0, 0xffff, 1, 0);
2292 + if (ctx->jpeg->variant->version == SJPEG_S5P)
2293 + mask = ~0x06; /* 422, 420 */
2294 + }
2295 +diff --git a/drivers/media/platform/vivid/vivid-osd.c b/drivers/media/platform/vivid/vivid-osd.c
2296 +index e15eef6a94e5..f3afc74f98ed 100644
2297 +--- a/drivers/media/platform/vivid/vivid-osd.c
2298 ++++ b/drivers/media/platform/vivid/vivid-osd.c
2299 +@@ -167,7 +167,7 @@ static int _vivid_fb_check_var(struct fb_var_screeninfo *var, struct vivid_dev *
2300 + var->nonstd = 0;
2301 +
2302 + var->vmode &= ~FB_VMODE_MASK;
2303 +- var->vmode = FB_VMODE_NONINTERLACED;
2304 ++ var->vmode |= FB_VMODE_NONINTERLACED;
2305 +
2306 + /* Dummy values */
2307 + var->hsync_len = 24;
2308 +diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
2309 +index 51639a3f7abe..0cee10cca0e5 100644
2310 +--- a/drivers/media/radio/wl128x/fmdrv_common.c
2311 ++++ b/drivers/media/radio/wl128x/fmdrv_common.c
2312 +@@ -1278,8 +1278,9 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
2313 +
2314 + switch (action->type) {
2315 + case ACTION_SEND_COMMAND: /* Send */
2316 +- if (fmc_send_cmd(fmdev, 0, 0, action->data,
2317 +- action->size, NULL, NULL))
2318 ++ ret = fmc_send_cmd(fmdev, 0, 0, action->data,
2319 ++ action->size, NULL, NULL);
2320 ++ if (ret)
2321 + goto rel_fw;
2322 +
2323 + cmd_cnt++;
2324 +diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
2325 +index 498875193386..adbb23b6595f 100644
2326 +--- a/drivers/mfd/intel-lpss.c
2327 ++++ b/drivers/mfd/intel-lpss.c
2328 +@@ -525,6 +525,7 @@ module_init(intel_lpss_init);
2329 +
2330 + static void __exit intel_lpss_exit(void)
2331 + {
2332 ++ ida_destroy(&intel_lpss_devid_ida);
2333 + debugfs_remove(intel_lpss_debugfs);
2334 + }
2335 + module_exit(intel_lpss_exit);
2336 +diff --git a/drivers/misc/mic/card/mic_x100.c b/drivers/misc/mic/card/mic_x100.c
2337 +index b2958ce2368c..cd778e2b4f3e 100644
2338 +--- a/drivers/misc/mic/card/mic_x100.c
2339 ++++ b/drivers/misc/mic/card/mic_x100.c
2340 +@@ -249,6 +249,9 @@ static int __init mic_probe(struct platform_device *pdev)
2341 + mdrv->dev = &pdev->dev;
2342 + snprintf(mdrv->name, sizeof(mic_driver_name), mic_driver_name);
2343 +
2344 ++ /* FIXME: use dma_set_mask_and_coherent() and check result */
2345 ++ dma_coerce_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
2346 ++
2347 + mdev->mmio.pa = MIC_X100_MMIO_BASE;
2348 + mdev->mmio.len = MIC_X100_MMIO_LEN;
2349 + mdev->mmio.va = devm_ioremap(&pdev->dev, MIC_X100_MMIO_BASE,
2350 +@@ -294,18 +297,6 @@ static void mic_platform_shutdown(struct platform_device *pdev)
2351 + mic_remove(pdev);
2352 + }
2353 +
2354 +-static u64 mic_dma_mask = DMA_BIT_MASK(64);
2355 +-
2356 +-static struct platform_device mic_platform_dev = {
2357 +- .name = mic_driver_name,
2358 +- .id = 0,
2359 +- .num_resources = 0,
2360 +- .dev = {
2361 +- .dma_mask = &mic_dma_mask,
2362 +- .coherent_dma_mask = DMA_BIT_MASK(64),
2363 +- },
2364 +-};
2365 +-
2366 + static struct platform_driver __refdata mic_platform_driver = {
2367 + .probe = mic_probe,
2368 + .remove = mic_remove,
2369 +@@ -315,6 +306,8 @@ static struct platform_driver __refdata mic_platform_driver = {
2370 + },
2371 + };
2372 +
2373 ++static struct platform_device *mic_platform_dev;
2374 ++
2375 + static int __init mic_init(void)
2376 + {
2377 + int ret;
2378 +@@ -327,9 +320,12 @@ static int __init mic_init(void)
2379 + }
2380 +
2381 + mic_init_card_debugfs();
2382 +- ret = platform_device_register(&mic_platform_dev);
2383 ++
2384 ++ mic_platform_dev = platform_device_register_simple(mic_driver_name,
2385 ++ 0, NULL, 0);
2386 ++ ret = PTR_ERR_OR_ZERO(mic_platform_dev);
2387 + if (ret) {
2388 +- pr_err("platform_device_register ret %d\n", ret);
2389 ++ pr_err("platform_device_register_full ret %d\n", ret);
2390 + goto cleanup_debugfs;
2391 + }
2392 + ret = platform_driver_register(&mic_platform_driver);
2393 +@@ -340,7 +336,7 @@ static int __init mic_init(void)
2394 + return ret;
2395 +
2396 + device_unregister:
2397 +- platform_device_unregister(&mic_platform_dev);
2398 ++ platform_device_unregister(mic_platform_dev);
2399 + cleanup_debugfs:
2400 + mic_exit_card_debugfs();
2401 + done:
2402 +@@ -350,7 +346,7 @@ done:
2403 + static void __exit mic_exit(void)
2404 + {
2405 + platform_driver_unregister(&mic_platform_driver);
2406 +- platform_device_unregister(&mic_platform_dev);
2407 ++ platform_device_unregister(mic_platform_dev);
2408 + mic_exit_card_debugfs();
2409 + }
2410 +
2411 +diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
2412 +index 6956f7e7d439..ca5f0102daef 100644
2413 +--- a/drivers/misc/sgi-xp/xpc_partition.c
2414 ++++ b/drivers/misc/sgi-xp/xpc_partition.c
2415 +@@ -70,7 +70,7 @@ xpc_get_rsvd_page_pa(int nasid)
2416 + unsigned long rp_pa = nasid; /* seed with nasid */
2417 + size_t len = 0;
2418 + size_t buf_len = 0;
2419 +- void *buf = buf;
2420 ++ void *buf = NULL;
2421 + void *buf_base = NULL;
2422 + enum xp_retval (*get_partition_rsvd_page_pa)
2423 + (void *, u64 *, unsigned long *, size_t *) =
2424 +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
2425 +index 2bae0214528b..bf309a8a66a1 100644
2426 +--- a/drivers/mmc/host/sdhci.c
2427 ++++ b/drivers/mmc/host/sdhci.c
2428 +@@ -3096,11 +3096,13 @@ int sdhci_add_host(struct sdhci_host *host)
2429 + if (host->ops->get_min_clock)
2430 + mmc->f_min = host->ops->get_min_clock(host);
2431 + else if (host->version >= SDHCI_SPEC_300) {
2432 +- if (host->clk_mul) {
2433 +- mmc->f_min = (host->max_clk * host->clk_mul) / 1024;
2434 ++ if (host->clk_mul)
2435 + max_clk = host->max_clk * host->clk_mul;
2436 +- } else
2437 +- mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
2438 ++ /*
2439 ++ * Divided Clock Mode minimum clock rate is always less than
2440 ++ * Programmable Clock Mode minimum clock rate.
2441 ++ */
2442 ++ mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
2443 + } else
2444 + mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_200;
2445 +
2446 +diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
2447 +index 8a226cc05c10..cc4a0c48f090 100644
2448 +--- a/drivers/net/can/slcan.c
2449 ++++ b/drivers/net/can/slcan.c
2450 +@@ -344,9 +344,16 @@ static void slcan_transmit(struct work_struct *work)
2451 + */
2452 + static void slcan_write_wakeup(struct tty_struct *tty)
2453 + {
2454 +- struct slcan *sl = tty->disc_data;
2455 ++ struct slcan *sl;
2456 ++
2457 ++ rcu_read_lock();
2458 ++ sl = rcu_dereference(tty->disc_data);
2459 ++ if (!sl)
2460 ++ goto out;
2461 +
2462 + schedule_work(&sl->tx_work);
2463 ++out:
2464 ++ rcu_read_unlock();
2465 + }
2466 +
2467 + /* Send a can_frame to a TTY queue. */
2468 +@@ -640,10 +647,11 @@ static void slcan_close(struct tty_struct *tty)
2469 + return;
2470 +
2471 + spin_lock_bh(&sl->lock);
2472 +- tty->disc_data = NULL;
2473 ++ rcu_assign_pointer(tty->disc_data, NULL);
2474 + sl->tty = NULL;
2475 + spin_unlock_bh(&sl->lock);
2476 +
2477 ++ synchronize_rcu();
2478 + flush_work(&sl->tx_work);
2479 +
2480 + /* Flush network side */
2481 +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
2482 +index 53b3c1a5851c..9530ee12726f 100644
2483 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c
2484 ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
2485 +@@ -1794,7 +1794,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
2486 +
2487 + priv->phy_interface = of_get_phy_mode(dn);
2488 + /* Default to GMII interface mode */
2489 +- if (priv->phy_interface < 0)
2490 ++ if ((int)priv->phy_interface < 0)
2491 + priv->phy_interface = PHY_INTERFACE_MODE_GMII;
2492 +
2493 + /* In the case of a fixed PHY, the DT node associated
2494 +diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
2495 +index bee615cddbdd..f40eefd1b378 100644
2496 +--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
2497 ++++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
2498 +@@ -2437,6 +2437,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
2499 +
2500 + if (!is_offload(adapter))
2501 + return -EOPNOTSUPP;
2502 ++ if (!capable(CAP_NET_ADMIN))
2503 ++ return -EPERM;
2504 + if (!(adapter->flags & FULL_INIT_DONE))
2505 + return -EIO; /* need the memory controllers */
2506 + if (copy_from_user(&t, useraddr, sizeof(t)))
2507 +diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
2508 +index e51892d518ff..761c80eb8a68 100644
2509 +--- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
2510 ++++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
2511 +@@ -951,7 +951,7 @@ static int hix5hd2_dev_probe(struct platform_device *pdev)
2512 + goto err_free_mdio;
2513 +
2514 + priv->phy_mode = of_get_phy_mode(node);
2515 +- if (priv->phy_mode < 0) {
2516 ++ if ((int)priv->phy_mode < 0) {
2517 + netdev_err(ndev, "not find phy-mode\n");
2518 + ret = -EINVAL;
2519 + goto err_mdiobus;
2520 +diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
2521 +index 1a56de06b014..fdbba588c6db 100644
2522 +--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
2523 ++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
2524 +@@ -1477,7 +1477,7 @@ static int ehea_init_port_res(struct ehea_port *port, struct ehea_port_res *pr,
2525 +
2526 + memset(pr, 0, sizeof(struct ehea_port_res));
2527 +
2528 +- pr->tx_bytes = rx_bytes;
2529 ++ pr->tx_bytes = tx_bytes;
2530 + pr->tx_packets = tx_packets;
2531 + pr->rx_bytes = rx_bytes;
2532 + pr->rx_packets = rx_packets;
2533 +diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
2534 +index 0798b4adb039..667900578249 100644
2535 +--- a/drivers/net/ethernet/natsemi/sonic.c
2536 ++++ b/drivers/net/ethernet/natsemi/sonic.c
2537 +@@ -221,9 +221,9 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
2538 +
2539 + laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
2540 + if (!laddr) {
2541 +- printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
2542 +- dev_kfree_skb(skb);
2543 +- return NETDEV_TX_BUSY;
2544 ++ pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
2545 ++ dev_kfree_skb_any(skb);
2546 ++ return NETDEV_TX_OK;
2547 + }
2548 +
2549 + sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0); /* clear status */
2550 +diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
2551 +index 57a6e6cd74fc..48106953cf64 100644
2552 +--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
2553 ++++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
2554 +@@ -1091,7 +1091,6 @@ static int pasemi_mac_phy_init(struct net_device *dev)
2555 +
2556 + dn = pci_device_to_OF_node(mac->pdev);
2557 + phy_dn = of_parse_phandle(dn, "phy-handle", 0);
2558 +- of_node_put(phy_dn);
2559 +
2560 + mac->link = 0;
2561 + mac->speed = 0;
2562 +@@ -1100,6 +1099,7 @@ static int pasemi_mac_phy_init(struct net_device *dev)
2563 + phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0,
2564 + PHY_INTERFACE_MODE_SGMII);
2565 +
2566 ++ of_node_put(phy_dn);
2567 + if (!phydev) {
2568 + printk(KERN_ERR "%s: Could not attach to phy\n", dev->name);
2569 + return -ENODEV;
2570 +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
2571 +index 7886a8a5b55b..fb944e65c632 100644
2572 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c
2573 ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
2574 +@@ -438,7 +438,6 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
2575 + u16 signature = 0;
2576 + u16 spi_config;
2577 + u16 wrbuf_space = 0;
2578 +- static u16 reset_count;
2579 +
2580 + if (event == QCASPI_EVENT_CPUON) {
2581 + /* Read signature twice, if not valid
2582 +@@ -491,13 +490,13 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
2583 +
2584 + qca->sync = QCASPI_SYNC_RESET;
2585 + qca->stats.trig_reset++;
2586 +- reset_count = 0;
2587 ++ qca->reset_count = 0;
2588 + break;
2589 + case QCASPI_SYNC_RESET:
2590 +- reset_count++;
2591 ++ qca->reset_count++;
2592 + netdev_dbg(qca->net_dev, "sync: waiting for CPU on, count %u.\n",
2593 +- reset_count);
2594 +- if (reset_count >= QCASPI_RESET_TIMEOUT) {
2595 ++ qca->reset_count);
2596 ++ if (qca->reset_count >= QCASPI_RESET_TIMEOUT) {
2597 + /* reset did not seem to take place, try again */
2598 + qca->sync = QCASPI_SYNC_UNKNOWN;
2599 + qca->stats.reset_timeout++;
2600 +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.h b/drivers/net/ethernet/qualcomm/qca_spi.h
2601 +index 6e31a0e744a4..c48c314ca4df 100644
2602 +--- a/drivers/net/ethernet/qualcomm/qca_spi.h
2603 ++++ b/drivers/net/ethernet/qualcomm/qca_spi.h
2604 +@@ -97,6 +97,7 @@ struct qcaspi {
2605 +
2606 + unsigned int intr_req;
2607 + unsigned int intr_svc;
2608 ++ u16 reset_count;
2609 +
2610 + #ifdef CONFIG_DEBUG_FS
2611 + struct dentry *device_root;
2612 +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
2613 +index 2d9f4ed9a65e..8413f93f5cd9 100644
2614 +--- a/drivers/net/ethernet/renesas/sh_eth.c
2615 ++++ b/drivers/net/ethernet/renesas/sh_eth.c
2616 +@@ -3040,12 +3040,16 @@ static struct sh_eth_plat_data *sh_eth_parse_dt(struct device *dev)
2617 + struct device_node *np = dev->of_node;
2618 + struct sh_eth_plat_data *pdata;
2619 + const char *mac_addr;
2620 ++ int ret;
2621 +
2622 + pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
2623 + if (!pdata)
2624 + return NULL;
2625 +
2626 +- pdata->phy_interface = of_get_phy_mode(np);
2627 ++ ret = of_get_phy_mode(np);
2628 ++ if (ret < 0)
2629 ++ return NULL;
2630 ++ pdata->phy_interface = ret;
2631 +
2632 + mac_addr = of_get_mac_address(np);
2633 + if (mac_addr)
2634 +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
2635 +index 82de68b1a452..1fc356c17750 100644
2636 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
2637 ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
2638 +@@ -203,7 +203,7 @@ static void *ipq806x_gmac_of_parse(struct ipq806x_gmac *gmac)
2639 + struct device *dev = &gmac->pdev->dev;
2640 +
2641 + gmac->phy_mode = of_get_phy_mode(dev->of_node);
2642 +- if (gmac->phy_mode < 0) {
2643 ++ if ((int)gmac->phy_mode < 0) {
2644 + dev_err(dev, "missing phy mode property\n");
2645 + return ERR_PTR(-EINVAL);
2646 + }
2647 +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
2648 +index 170a18b61281..147c9f8cee7f 100644
2649 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
2650 ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
2651 +@@ -157,7 +157,7 @@ static int stmmac_enable(struct ptp_clock_info *ptp,
2652 + /* structure describing a PTP hardware clock */
2653 + static struct ptp_clock_info stmmac_ptp_clock_ops = {
2654 + .owner = THIS_MODULE,
2655 +- .name = "stmmac_ptp_clock",
2656 ++ .name = "stmmac ptp",
2657 + .max_adj = 62500000,
2658 + .n_alarm = 0,
2659 + .n_ext_ts = 0,
2660 +diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
2661 +index ef6b25ec75a1..0f8d5609ed51 100644
2662 +--- a/drivers/net/slip/slip.c
2663 ++++ b/drivers/net/slip/slip.c
2664 +@@ -452,9 +452,16 @@ static void slip_transmit(struct work_struct *work)
2665 + */
2666 + static void slip_write_wakeup(struct tty_struct *tty)
2667 + {
2668 +- struct slip *sl = tty->disc_data;
2669 ++ struct slip *sl;
2670 ++
2671 ++ rcu_read_lock();
2672 ++ sl = rcu_dereference(tty->disc_data);
2673 ++ if (!sl)
2674 ++ goto out;
2675 +
2676 + schedule_work(&sl->tx_work);
2677 ++out:
2678 ++ rcu_read_unlock();
2679 + }
2680 +
2681 + static void sl_tx_timeout(struct net_device *dev)
2682 +@@ -887,10 +894,11 @@ static void slip_close(struct tty_struct *tty)
2683 + return;
2684 +
2685 + spin_lock_bh(&sl->lock);
2686 +- tty->disc_data = NULL;
2687 ++ rcu_assign_pointer(tty->disc_data, NULL);
2688 + sl->tty = NULL;
2689 + spin_unlock_bh(&sl->lock);
2690 +
2691 ++ synchronize_rcu();
2692 + flush_work(&sl->tx_work);
2693 +
2694 + /* VSV = very important to remove timers */
2695 +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
2696 +index 4174b24963b9..75a3865a80d2 100644
2697 +--- a/drivers/net/usb/lan78xx.c
2698 ++++ b/drivers/net/usb/lan78xx.c
2699 +@@ -30,6 +30,7 @@
2700 + #include <linux/ipv6.h>
2701 + #include <linux/mdio.h>
2702 + #include <net/ip6_checksum.h>
2703 ++#include <net/vxlan.h>
2704 + #include <linux/microchipphy.h>
2705 + #include "lan78xx.h"
2706 +
2707 +@@ -2893,6 +2894,19 @@ void lan78xx_tx_timeout(struct net_device *net)
2708 + tasklet_schedule(&dev->bh);
2709 + }
2710 +
2711 ++static netdev_features_t lan78xx_features_check(struct sk_buff *skb,
2712 ++ struct net_device *netdev,
2713 ++ netdev_features_t features)
2714 ++{
2715 ++ if (skb->len + TX_OVERHEAD > MAX_SINGLE_PACKET_SIZE)
2716 ++ features &= ~NETIF_F_GSO_MASK;
2717 ++
2718 ++ features = vlan_features_check(skb, features);
2719 ++ features = vxlan_features_check(skb, features);
2720 ++
2721 ++ return features;
2722 ++}
2723 ++
2724 + static const struct net_device_ops lan78xx_netdev_ops = {
2725 + .ndo_open = lan78xx_open,
2726 + .ndo_stop = lan78xx_stop,
2727 +@@ -2906,6 +2920,7 @@ static const struct net_device_ops lan78xx_netdev_ops = {
2728 + .ndo_set_features = lan78xx_set_features,
2729 + .ndo_vlan_rx_add_vid = lan78xx_vlan_rx_add_vid,
2730 + .ndo_vlan_rx_kill_vid = lan78xx_vlan_rx_kill_vid,
2731 ++ .ndo_features_check = lan78xx_features_check,
2732 + };
2733 +
2734 + static int lan78xx_probe(struct usb_interface *intf,
2735 +diff --git a/drivers/net/wireless/ath/ath9k/dynack.c b/drivers/net/wireless/ath/ath9k/dynack.c
2736 +index 22b3cc4c27cd..58205a5bd74b 100644
2737 +--- a/drivers/net/wireless/ath/ath9k/dynack.c
2738 ++++ b/drivers/net/wireless/ath/ath9k/dynack.c
2739 +@@ -285,9 +285,9 @@ void ath_dynack_node_init(struct ath_hw *ah, struct ath_node *an)
2740 +
2741 + an->ackto = ackto;
2742 +
2743 +- spin_lock(&da->qlock);
2744 ++ spin_lock_bh(&da->qlock);
2745 + list_add_tail(&an->list, &da->nodes);
2746 +- spin_unlock(&da->qlock);
2747 ++ spin_unlock_bh(&da->qlock);
2748 + }
2749 + EXPORT_SYMBOL(ath_dynack_node_init);
2750 +
2751 +@@ -301,9 +301,9 @@ void ath_dynack_node_deinit(struct ath_hw *ah, struct ath_node *an)
2752 + {
2753 + struct ath_dynack *da = &ah->dynack;
2754 +
2755 +- spin_lock(&da->qlock);
2756 ++ spin_lock_bh(&da->qlock);
2757 + list_del(&an->list);
2758 +- spin_unlock(&da->qlock);
2759 ++ spin_unlock_bh(&da->qlock);
2760 + }
2761 + EXPORT_SYMBOL(ath_dynack_node_deinit);
2762 +
2763 +diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
2764 +index 8317afd065b4..0824697c3dca 100644
2765 +--- a/drivers/net/wireless/libertas/cfg.c
2766 ++++ b/drivers/net/wireless/libertas/cfg.c
2767 +@@ -272,6 +272,10 @@ add_ie_rates(u8 *tlv, const u8 *ie, int *nrates)
2768 + int hw, ap, ap_max = ie[1];
2769 + u8 hw_rate;
2770 +
2771 ++ if (ap_max > MAX_RATES) {
2772 ++ lbs_deb_assoc("invalid rates\n");
2773 ++ return tlv;
2774 ++ }
2775 + /* Advance past IE header */
2776 + ie += 2;
2777 +
2778 +@@ -1783,6 +1787,9 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
2779 + struct cmd_ds_802_11_ad_hoc_join cmd;
2780 + u8 preamble = RADIO_PREAMBLE_SHORT;
2781 + int ret = 0;
2782 ++ int hw, i;
2783 ++ u8 rates_max;
2784 ++ u8 *rates;
2785 +
2786 + lbs_deb_enter(LBS_DEB_CFG80211);
2787 +
2788 +@@ -1843,9 +1850,12 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
2789 + if (!rates_eid) {
2790 + lbs_add_rates(cmd.bss.rates);
2791 + } else {
2792 +- int hw, i;
2793 +- u8 rates_max = rates_eid[1];
2794 +- u8 *rates = cmd.bss.rates;
2795 ++ rates_max = rates_eid[1];
2796 ++ if (rates_max > MAX_RATES) {
2797 ++ lbs_deb_join("invalid rates");
2798 ++ goto out;
2799 ++ }
2800 ++ rates = cmd.bss.rates;
2801 + for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
2802 + u8 hw_rate = lbs_rates[hw].bitrate / 5;
2803 + for (i = 0; i < rates_max; i++) {
2804 +diff --git a/drivers/net/wireless/libertas_tf/cmd.c b/drivers/net/wireless/libertas_tf/cmd.c
2805 +index 909ac3685010..2b193f1257a5 100644
2806 +--- a/drivers/net/wireless/libertas_tf/cmd.c
2807 ++++ b/drivers/net/wireless/libertas_tf/cmd.c
2808 +@@ -69,7 +69,7 @@ static void lbtf_geo_init(struct lbtf_private *priv)
2809 + break;
2810 + }
2811 +
2812 +- for (ch = priv->range.start; ch < priv->range.end; ch++)
2813 ++ for (ch = range->start; ch < range->end; ch++)
2814 + priv->channels[CHAN_TO_IDX(ch)].flags = 0;
2815 + }
2816 +
2817 +diff --git a/drivers/net/wireless/mediatek/mt7601u/phy.c b/drivers/net/wireless/mediatek/mt7601u/phy.c
2818 +index 1908af6add87..59ed073a8572 100644
2819 +--- a/drivers/net/wireless/mediatek/mt7601u/phy.c
2820 ++++ b/drivers/net/wireless/mediatek/mt7601u/phy.c
2821 +@@ -219,7 +219,7 @@ int mt7601u_wait_bbp_ready(struct mt7601u_dev *dev)
2822 +
2823 + do {
2824 + val = mt7601u_bbp_rr(dev, MT_BBP_REG_VERSION);
2825 +- if (val && ~val)
2826 ++ if (val && val != 0xff)
2827 + break;
2828 + } while (--i);
2829 +
2830 +diff --git a/drivers/pinctrl/sh-pfc/pfc-emev2.c b/drivers/pinctrl/sh-pfc/pfc-emev2.c
2831 +index 02118ab336fc..5ab3ac61f418 100644
2832 +--- a/drivers/pinctrl/sh-pfc/pfc-emev2.c
2833 ++++ b/drivers/pinctrl/sh-pfc/pfc-emev2.c
2834 +@@ -1263,6 +1263,14 @@ static const char * const dtv_groups[] = {
2835 + "dtv_b",
2836 + };
2837 +
2838 ++static const char * const err_rst_reqb_groups[] = {
2839 ++ "err_rst_reqb",
2840 ++};
2841 ++
2842 ++static const char * const ext_clki_groups[] = {
2843 ++ "ext_clki",
2844 ++};
2845 ++
2846 + static const char * const iic0_groups[] = {
2847 + "iic0",
2848 + };
2849 +@@ -1285,6 +1293,10 @@ static const char * const lcd_groups[] = {
2850 + "yuv3",
2851 + };
2852 +
2853 ++static const char * const lowpwr_groups[] = {
2854 ++ "lowpwr",
2855 ++};
2856 ++
2857 + static const char * const ntsc_groups[] = {
2858 + "ntsc_clk",
2859 + "ntsc_data",
2860 +@@ -1298,6 +1310,10 @@ static const char * const pwm1_groups[] = {
2861 + "pwm1",
2862 + };
2863 +
2864 ++static const char * const ref_clko_groups[] = {
2865 ++ "ref_clko",
2866 ++};
2867 ++
2868 + static const char * const sd_groups[] = {
2869 + "sd_cki",
2870 + };
2871 +@@ -1391,13 +1407,17 @@ static const struct sh_pfc_function pinmux_functions[] = {
2872 + SH_PFC_FUNCTION(cam),
2873 + SH_PFC_FUNCTION(cf),
2874 + SH_PFC_FUNCTION(dtv),
2875 ++ SH_PFC_FUNCTION(err_rst_reqb),
2876 ++ SH_PFC_FUNCTION(ext_clki),
2877 + SH_PFC_FUNCTION(iic0),
2878 + SH_PFC_FUNCTION(iic1),
2879 + SH_PFC_FUNCTION(jtag),
2880 + SH_PFC_FUNCTION(lcd),
2881 ++ SH_PFC_FUNCTION(lowpwr),
2882 + SH_PFC_FUNCTION(ntsc),
2883 + SH_PFC_FUNCTION(pwm0),
2884 + SH_PFC_FUNCTION(pwm1),
2885 ++ SH_PFC_FUNCTION(ref_clko),
2886 + SH_PFC_FUNCTION(sd),
2887 + SH_PFC_FUNCTION(sdi0),
2888 + SH_PFC_FUNCTION(sdi1),
2889 +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
2890 +index 279e9dd442e4..bc2ee07fa92f 100644
2891 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
2892 ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
2893 +@@ -1983,7 +1983,7 @@ static const unsigned int gether_gmii_pins[] = {
2894 + */
2895 + 185, 186, 187, 188, 189, 190, 191, 192, 174, 161, 204,
2896 + 171, 170, 169, 168, 167, 166, 173, 172, 176, 184, 183, 203,
2897 +- 205, 163, 206, 207,
2898 ++ 205, 163, 206, 207, 158,
2899 + };
2900 + static const unsigned int gether_gmii_mux[] = {
2901 + ET_ERXD0_MARK, ET_ERXD1_MARK, ET_ERXD2_MARK, ET_ERXD3_MARK,
2902 +@@ -2155,6 +2155,7 @@ static const unsigned int lcd0_data24_1_mux[] = {
2903 + LCD0_D0_MARK, LCD0_D1_MARK, LCD0_D2_MARK, LCD0_D3_MARK,
2904 + LCD0_D4_MARK, LCD0_D5_MARK, LCD0_D6_MARK, LCD0_D7_MARK,
2905 + LCD0_D8_MARK, LCD0_D9_MARK, LCD0_D10_MARK, LCD0_D11_MARK,
2906 ++ LCD0_D12_MARK, LCD0_D13_MARK, LCD0_D14_MARK, LCD0_D15_MARK,
2907 + LCD0_D16_MARK, LCD0_D17_MARK, LCD0_D18_PORT163_MARK,
2908 + LCD0_D19_PORT162_MARK, LCD0_D20_PORT161_MARK, LCD0_D21_PORT158_MARK,
2909 + LCD0_D22_PORT160_MARK, LCD0_D23_PORT159_MARK,
2910 +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
2911 +index 42ffa8708abc..b2f8898ddb2c 100644
2912 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
2913 ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
2914 +@@ -3059,8 +3059,7 @@ static const unsigned int qspi_data4_b_pins[] = {
2915 + RCAR_GP_PIN(6, 4),
2916 + };
2917 + static const unsigned int qspi_data4_b_mux[] = {
2918 +- SPCLK_B_MARK, MOSI_IO0_B_MARK, MISO_IO1_B_MARK,
2919 +- IO2_B_MARK, IO3_B_MARK, SSL_B_MARK,
2920 ++ MOSI_IO0_B_MARK, MISO_IO1_B_MARK, IO2_B_MARK, IO3_B_MARK,
2921 + };
2922 + /* - SCIF0 ------------------------------------------------------------------ */
2923 + static const unsigned int scif0_data_pins[] = {
2924 +@@ -4171,17 +4170,14 @@ static const unsigned int vin1_b_data18_pins[] = {
2925 + };
2926 + static const unsigned int vin1_b_data18_mux[] = {
2927 + /* B */
2928 +- VI1_DATA0_B_MARK, VI1_DATA1_B_MARK,
2929 + VI1_DATA2_B_MARK, VI1_DATA3_B_MARK,
2930 + VI1_DATA4_B_MARK, VI1_DATA5_B_MARK,
2931 + VI1_DATA6_B_MARK, VI1_DATA7_B_MARK,
2932 + /* G */
2933 +- VI1_G0_B_MARK, VI1_G1_B_MARK,
2934 + VI1_G2_B_MARK, VI1_G3_B_MARK,
2935 + VI1_G4_B_MARK, VI1_G5_B_MARK,
2936 + VI1_G6_B_MARK, VI1_G7_B_MARK,
2937 + /* R */
2938 +- VI1_R0_B_MARK, VI1_R1_B_MARK,
2939 + VI1_R2_B_MARK, VI1_R3_B_MARK,
2940 + VI1_R4_B_MARK, VI1_R5_B_MARK,
2941 + VI1_R6_B_MARK, VI1_R7_B_MARK,
2942 +@@ -4971,7 +4967,7 @@ static const char * const scifb2_groups[] = {
2943 + "scifb2_data_b",
2944 + "scifb2_clk_b",
2945 + "scifb2_ctrl_b",
2946 +- "scifb0_data_c",
2947 ++ "scifb2_data_c",
2948 + "scifb2_clk_c",
2949 + "scifb2_data_d",
2950 + };
2951 +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
2952 +index 086f6798b129..3b79e893b5ed 100644
2953 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
2954 ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
2955 +@@ -4046,7 +4046,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
2956 + FN_AVB_MDC, FN_SSI_SDATA6_B, 0, 0, }
2957 + },
2958 + { PINMUX_CFG_REG_VAR("IPSR9", 0xE6060044, 32,
2959 +- 1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3, 3) {
2960 ++ 1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3) {
2961 + /* IP9_31 [1] */
2962 + 0, 0,
2963 + /* IP9_30_28 [3] */
2964 +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7269.c b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
2965 +index a50d22bef1f4..cfdb4fc177c3 100644
2966 +--- a/drivers/pinctrl/sh-pfc/pfc-sh7269.c
2967 ++++ b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
2968 +@@ -2119,7 +2119,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
2969 + },
2970 +
2971 + { PINMUX_CFG_REG("PCIOR0", 0xfffe3852, 16, 1) {
2972 +- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
2973 ++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
2974 + PC8_IN, PC8_OUT,
2975 + PC7_IN, PC7_OUT,
2976 + PC6_IN, PC6_OUT,
2977 +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
2978 +index 6a69c8c5d943..b173bd759ee1 100644
2979 +--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
2980 ++++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
2981 +@@ -2672,6 +2672,7 @@ static const unsigned int tpu4_to2_mux[] = {
2982 + };
2983 + static const unsigned int tpu4_to3_pins[] = {
2984 + /* TO */
2985 ++ PIN_NUMBER(6, 26),
2986 + };
2987 + static const unsigned int tpu4_to3_mux[] = {
2988 + TPU4TO3_MARK,
2989 +@@ -2894,7 +2895,8 @@ static const char * const fsic_groups[] = {
2990 + "fsic_sclk_out",
2991 + "fsic_data_in",
2992 + "fsic_data_out",
2993 +- "fsic_spdif",
2994 ++ "fsic_spdif_0",
2995 ++ "fsic_spdif_1",
2996 + };
2997 +
2998 + static const char * const fsid_groups[] = {
2999 +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
3000 +index ab09d385f95d..ce543f3c39b2 100644
3001 +--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
3002 ++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
3003 +@@ -2236,13 +2236,13 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
3004 + FN_LCD_CL1_B, 0, 0,
3005 + /* IP10_5_3 [3] */
3006 + FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
3007 +- FN_LCD_DON_B, 0, 0, 0,
3008 ++ FN_LCD_DON_B, 0, 0,
3009 + /* IP10_2_0 [3] */
3010 + FN_SSI_SCK23, FN_VI1_4_B, FN_RX1_D, FN_FCLE_B,
3011 + FN_LCD_DATA15_B, 0, 0, 0 }
3012 + },
3013 + { PINMUX_CFG_REG_VAR("IPSR11", 0xFFFC0048, 32,
3014 +- 3, 1, 2, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
3015 ++ 3, 1, 2, 3, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
3016 + /* IP11_31_29 [3] */
3017 + 0, 0, 0, 0, 0, 0, 0, 0,
3018 + /* IP11_28 [1] */
3019 +diff --git a/drivers/platform/mips/cpu_hwmon.c b/drivers/platform/mips/cpu_hwmon.c
3020 +index 0f6c63e17049..9a201c3caaf4 100644
3021 +--- a/drivers/platform/mips/cpu_hwmon.c
3022 ++++ b/drivers/platform/mips/cpu_hwmon.c
3023 +@@ -155,7 +155,7 @@ static int __init loongson_hwmon_init(void)
3024 +
3025 + cpu_hwmon_dev = hwmon_device_register(NULL);
3026 + if (IS_ERR(cpu_hwmon_dev)) {
3027 +- ret = -ENOMEM;
3028 ++ ret = PTR_ERR(cpu_hwmon_dev);
3029 + pr_err("hwmon_device_register fail!\n");
3030 + goto fail_hwmon_device_register;
3031 + }
3032 +diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
3033 +index 3df47c1b04ec..f5585740a765 100644
3034 +--- a/drivers/platform/x86/alienware-wmi.c
3035 ++++ b/drivers/platform/x86/alienware-wmi.c
3036 +@@ -511,7 +511,7 @@ static ssize_t show_hdmi_source(struct device *dev,
3037 + return scnprintf(buf, PAGE_SIZE,
3038 + "input [gpu] unknown\n");
3039 + }
3040 +- pr_err("alienware-wmi: unknown HDMI source status: %d\n", out_data);
3041 ++ pr_err("alienware-wmi: unknown HDMI source status: %u\n", status);
3042 + return scnprintf(buf, PAGE_SIZE, "input gpu [unknown]\n");
3043 + }
3044 +
3045 +diff --git a/drivers/power/power_supply_core.c b/drivers/power/power_supply_core.c
3046 +index b13cd074c52a..9281e42c9ed5 100644
3047 +--- a/drivers/power/power_supply_core.c
3048 ++++ b/drivers/power/power_supply_core.c
3049 +@@ -755,14 +755,14 @@ __power_supply_register(struct device *parent,
3050 + }
3051 +
3052 + spin_lock_init(&psy->changed_lock);
3053 +- rc = device_init_wakeup(dev, ws);
3054 +- if (rc)
3055 +- goto wakeup_init_failed;
3056 +-
3057 + rc = device_add(dev);
3058 + if (rc)
3059 + goto device_add_failed;
3060 +
3061 ++ rc = device_init_wakeup(dev, ws);
3062 ++ if (rc)
3063 ++ goto wakeup_init_failed;
3064 ++
3065 + rc = psy_register_thermal(psy);
3066 + if (rc)
3067 + goto register_thermal_failed;
3068 +@@ -798,8 +798,8 @@ register_cooler_failed:
3069 + psy_unregister_thermal(psy);
3070 + register_thermal_failed:
3071 + device_del(dev);
3072 +-device_add_failed:
3073 + wakeup_init_failed:
3074 ++device_add_failed:
3075 + check_supplies_failed:
3076 + dev_set_name_failed:
3077 + put_device(dev);
3078 +diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c
3079 +index 8cbb82ceec40..fad424e20bd5 100644
3080 +--- a/drivers/regulator/wm831x-dcdc.c
3081 ++++ b/drivers/regulator/wm831x-dcdc.c
3082 +@@ -327,8 +327,8 @@ static int wm831x_buckv_get_voltage_sel(struct regulator_dev *rdev)
3083 + }
3084 +
3085 + /* Current limit options */
3086 +-static u16 wm831x_dcdc_ilim[] = {
3087 +- 125, 250, 375, 500, 625, 750, 875, 1000
3088 ++static const unsigned int wm831x_dcdc_ilim[] = {
3089 ++ 125000, 250000, 375000, 500000, 625000, 750000, 875000, 1000000
3090 + };
3091 +
3092 + static int wm831x_buckv_set_current_limit(struct regulator_dev *rdev,
3093 +diff --git a/drivers/rtc/rtc-88pm80x.c b/drivers/rtc/rtc-88pm80x.c
3094 +index 466bf7f9a285..7da2a1fb50f8 100644
3095 +--- a/drivers/rtc/rtc-88pm80x.c
3096 ++++ b/drivers/rtc/rtc-88pm80x.c
3097 +@@ -116,12 +116,14 @@ static int pm80x_rtc_read_time(struct device *dev, struct rtc_time *tm)
3098 + unsigned char buf[4];
3099 + unsigned long ticks, base, data;
3100 + regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
3101 +- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
3102 ++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
3103 ++ (buf[1] << 8) | buf[0];
3104 + dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
3105 +
3106 + /* load 32-bit read-only counter */
3107 + regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
3108 +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
3109 ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
3110 ++ (buf[1] << 8) | buf[0];
3111 + ticks = base + data;
3112 + dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
3113 + base, data, ticks);
3114 +@@ -144,7 +146,8 @@ static int pm80x_rtc_set_time(struct device *dev, struct rtc_time *tm)
3115 +
3116 + /* load 32-bit read-only counter */
3117 + regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
3118 +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
3119 ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
3120 ++ (buf[1] << 8) | buf[0];
3121 + base = ticks - data;
3122 + dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
3123 + base, data, ticks);
3124 +@@ -165,11 +168,13 @@ static int pm80x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
3125 + int ret;
3126 +
3127 + regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
3128 +- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
3129 ++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
3130 ++ (buf[1] << 8) | buf[0];
3131 + dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
3132 +
3133 + regmap_raw_read(info->map, PM800_RTC_EXPIRE1_1, buf, 4);
3134 +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
3135 ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
3136 ++ (buf[1] << 8) | buf[0];
3137 + ticks = base + data;
3138 + dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
3139 + base, data, ticks);
3140 +@@ -192,12 +197,14 @@ static int pm80x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
3141 + regmap_update_bits(info->map, PM800_RTC_CONTROL, PM800_ALARM1_EN, 0);
3142 +
3143 + regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
3144 +- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
3145 ++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
3146 ++ (buf[1] << 8) | buf[0];
3147 + dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
3148 +
3149 + /* load 32-bit read-only counter */
3150 + regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
3151 +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
3152 ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
3153 ++ (buf[1] << 8) | buf[0];
3154 + ticks = base + data;
3155 + dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
3156 + base, data, ticks);
3157 +diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c
3158 +index 166faae3a59c..7d3e5168fcef 100644
3159 +--- a/drivers/rtc/rtc-88pm860x.c
3160 ++++ b/drivers/rtc/rtc-88pm860x.c
3161 +@@ -115,11 +115,13 @@ static int pm860x_rtc_read_time(struct device *dev, struct rtc_time *tm)
3162 + pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
3163 + dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
3164 + buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
3165 +- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
3166 ++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
3167 ++ (buf[5] << 8) | buf[7];
3168 +
3169 + /* load 32-bit read-only counter */
3170 + pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
3171 +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
3172 ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
3173 ++ (buf[1] << 8) | buf[0];
3174 + ticks = base + data;
3175 + dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
3176 + base, data, ticks);
3177 +@@ -145,7 +147,8 @@ static int pm860x_rtc_set_time(struct device *dev, struct rtc_time *tm)
3178 +
3179 + /* load 32-bit read-only counter */
3180 + pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
3181 +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
3182 ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
3183 ++ (buf[1] << 8) | buf[0];
3184 + base = ticks - data;
3185 + dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
3186 + base, data, ticks);
3187 +@@ -170,10 +173,12 @@ static int pm860x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
3188 + pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
3189 + dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
3190 + buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
3191 +- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
3192 ++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
3193 ++ (buf[5] << 8) | buf[7];
3194 +
3195 + pm860x_bulk_read(info->i2c, PM8607_RTC_EXPIRE1, 4, buf);
3196 +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
3197 ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
3198 ++ (buf[1] << 8) | buf[0];
3199 + ticks = base + data;
3200 + dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
3201 + base, data, ticks);
3202 +@@ -198,11 +203,13 @@ static int pm860x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
3203 + pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
3204 + dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
3205 + buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
3206 +- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
3207 ++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
3208 ++ (buf[5] << 8) | buf[7];
3209 +
3210 + /* load 32-bit read-only counter */
3211 + pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
3212 +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
3213 ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
3214 ++ (buf[1] << 8) | buf[0];
3215 + ticks = base + data;
3216 + dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
3217 + base, data, ticks);
3218 +diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c
3219 +index 92b1cbf2c4a7..2bea733b1589 100644
3220 +--- a/drivers/rtc/rtc-ds1672.c
3221 ++++ b/drivers/rtc/rtc-ds1672.c
3222 +@@ -60,7 +60,8 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm)
3223 + "%s: raw read data - counters=%02x,%02x,%02x,%02x\n",
3224 + __func__, buf[0], buf[1], buf[2], buf[3]);
3225 +
3226 +- time = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
3227 ++ time = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
3228 ++ (buf[1] << 8) | buf[0];
3229 +
3230 + rtc_time_to_tm(time, tm);
3231 +
3232 +diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
3233 +index 45b5a3d47ccf..1982eec0a3ea 100644
3234 +--- a/drivers/rtc/rtc-pcf8563.c
3235 ++++ b/drivers/rtc/rtc-pcf8563.c
3236 +@@ -568,7 +568,6 @@ static int pcf8563_probe(struct i2c_client *client,
3237 + struct pcf8563 *pcf8563;
3238 + int err;
3239 + unsigned char buf;
3240 +- unsigned char alm_pending;
3241 +
3242 + dev_dbg(&client->dev, "%s\n", __func__);
3243 +
3244 +@@ -594,13 +593,13 @@ static int pcf8563_probe(struct i2c_client *client,
3245 + return err;
3246 + }
3247 +
3248 +- err = pcf8563_get_alarm_mode(client, NULL, &alm_pending);
3249 +- if (err) {
3250 +- dev_err(&client->dev, "%s: read error\n", __func__);
3251 ++ /* Clear flags and disable interrupts */
3252 ++ buf = 0;
3253 ++ err = pcf8563_write_block_data(client, PCF8563_REG_ST2, 1, &buf);
3254 ++ if (err < 0) {
3255 ++ dev_err(&client->dev, "%s: write error\n", __func__);
3256 + return err;
3257 + }
3258 +- if (alm_pending)
3259 +- pcf8563_set_alarm_mode(client, 0);
3260 +
3261 + pcf8563->rtc = devm_rtc_device_register(&client->dev,
3262 + pcf8563_driver.driver.name,
3263 +diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c
3264 +index 795fcbd02ea3..a0dae6271ff6 100644
3265 +--- a/drivers/rtc/rtc-pm8xxx.c
3266 ++++ b/drivers/rtc/rtc-pm8xxx.c
3267 +@@ -186,7 +186,8 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
3268 + }
3269 + }
3270 +
3271 +- secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
3272 ++ secs = value[0] | (value[1] << 8) | (value[2] << 16) |
3273 ++ ((unsigned long)value[3] << 24);
3274 +
3275 + rtc_time_to_tm(secs, tm);
3276 +
3277 +@@ -267,7 +268,8 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
3278 + return rc;
3279 + }
3280 +
3281 +- secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
3282 ++ secs = value[0] | (value[1] << 8) | (value[2] << 16) |
3283 ++ ((unsigned long)value[3] << 24);
3284 +
3285 + rtc_time_to_tm(secs, &alarm->time);
3286 +
3287 +diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
3288 +index 30f9ef0c0d4f..b20c575564e4 100644
3289 +--- a/drivers/scsi/libfc/fc_exch.c
3290 ++++ b/drivers/scsi/libfc/fc_exch.c
3291 +@@ -2499,7 +2499,7 @@ void fc_exch_recv(struct fc_lport *lport, struct fc_frame *fp)
3292 +
3293 + /* lport lock ? */
3294 + if (!lport || lport->state == LPORT_ST_DISABLED) {
3295 +- FC_LPORT_DBG(lport, "Receiving frames for an lport that "
3296 ++ FC_LIBFC_DBG("Receiving frames for an lport that "
3297 + "has not been initialized correctly\n");
3298 + fc_frame_free(fp);
3299 + return;
3300 +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
3301 +index 7be968f60b59..1efd876f0728 100644
3302 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c
3303 ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
3304 +@@ -3585,12 +3585,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr)
3305 + /*
3306 + * The cur_state should not last for more than max_wait secs
3307 + */
3308 +- for (i = 0; i < max_wait; i++) {
3309 ++ for (i = 0; i < max_wait * 50; i++) {
3310 + curr_abs_state = instance->instancet->
3311 + read_fw_status_reg(instance->reg_set);
3312 +
3313 + if (abs_state == curr_abs_state) {
3314 +- msleep(1000);
3315 ++ msleep(20);
3316 + } else
3317 + break;
3318 + }
3319 +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
3320 +index 611a127f08d8..8975baab73e5 100644
3321 +--- a/drivers/scsi/qla2xxx/qla_os.c
3322 ++++ b/drivers/scsi/qla2xxx/qla_os.c
3323 +@@ -5780,8 +5780,7 @@ qla2x00_module_init(void)
3324 + /* Initialize target kmem_cache and mem_pools */
3325 + ret = qlt_init();
3326 + if (ret < 0) {
3327 +- kmem_cache_destroy(srb_cachep);
3328 +- return ret;
3329 ++ goto destroy_cache;
3330 + } else if (ret > 0) {
3331 + /*
3332 + * If initiator mode is explictly disabled by qlt_init(),
3333 +@@ -5800,11 +5799,10 @@ qla2x00_module_init(void)
3334 + qla2xxx_transport_template =
3335 + fc_attach_transport(&qla2xxx_transport_functions);
3336 + if (!qla2xxx_transport_template) {
3337 +- kmem_cache_destroy(srb_cachep);
3338 + ql_log(ql_log_fatal, NULL, 0x0002,
3339 + "fc_attach_transport failed...Failing load!.\n");
3340 +- qlt_exit();
3341 +- return -ENODEV;
3342 ++ ret = -ENODEV;
3343 ++ goto qlt_exit;
3344 + }
3345 +
3346 + apidev_major = register_chrdev(0, QLA2XXX_APIDEV, &apidev_fops);
3347 +@@ -5816,27 +5814,37 @@ qla2x00_module_init(void)
3348 + qla2xxx_transport_vport_template =
3349 + fc_attach_transport(&qla2xxx_transport_vport_functions);
3350 + if (!qla2xxx_transport_vport_template) {
3351 +- kmem_cache_destroy(srb_cachep);
3352 +- qlt_exit();
3353 +- fc_release_transport(qla2xxx_transport_template);
3354 + ql_log(ql_log_fatal, NULL, 0x0004,
3355 + "fc_attach_transport vport failed...Failing load!.\n");
3356 +- return -ENODEV;
3357 ++ ret = -ENODEV;
3358 ++ goto unreg_chrdev;
3359 + }
3360 + ql_log(ql_log_info, NULL, 0x0005,
3361 + "QLogic Fibre Channel HBA Driver: %s.\n",
3362 + qla2x00_version_str);
3363 + ret = pci_register_driver(&qla2xxx_pci_driver);
3364 + if (ret) {
3365 +- kmem_cache_destroy(srb_cachep);
3366 +- qlt_exit();
3367 +- fc_release_transport(qla2xxx_transport_template);
3368 +- fc_release_transport(qla2xxx_transport_vport_template);
3369 + ql_log(ql_log_fatal, NULL, 0x0006,
3370 + "pci_register_driver failed...ret=%d Failing load!.\n",
3371 + ret);
3372 ++ goto release_vport_transport;
3373 + }
3374 + return ret;
3375 ++
3376 ++release_vport_transport:
3377 ++ fc_release_transport(qla2xxx_transport_vport_template);
3378 ++
3379 ++unreg_chrdev:
3380 ++ if (apidev_major >= 0)
3381 ++ unregister_chrdev(apidev_major, QLA2XXX_APIDEV);
3382 ++ fc_release_transport(qla2xxx_transport_template);
3383 ++
3384 ++qlt_exit:
3385 ++ qlt_exit();
3386 ++
3387 ++destroy_cache:
3388 ++ kmem_cache_destroy(srb_cachep);
3389 ++ return ret;
3390 + }
3391 +
3392 + /**
3393 +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
3394 +index bb4ed7b1f5df..ab32e6073642 100644
3395 +--- a/drivers/scsi/scsi_transport_iscsi.c
3396 ++++ b/drivers/scsi/scsi_transport_iscsi.c
3397 +@@ -37,6 +37,8 @@
3398 +
3399 + #define ISCSI_TRANSPORT_VERSION "2.0-870"
3400 +
3401 ++#define ISCSI_SEND_MAX_ALLOWED 10
3402 ++
3403 + static int dbg_session;
3404 + module_param_named(debug_session, dbg_session, int,
3405 + S_IRUGO | S_IWUSR);
3406 +@@ -3695,6 +3697,7 @@ iscsi_if_rx(struct sk_buff *skb)
3407 + struct nlmsghdr *nlh;
3408 + struct iscsi_uevent *ev;
3409 + uint32_t group;
3410 ++ int retries = ISCSI_SEND_MAX_ALLOWED;
3411 +
3412 + nlh = nlmsg_hdr(skb);
3413 + if (nlh->nlmsg_len < sizeof(*nlh) + sizeof(*ev) ||
3414 +@@ -3725,6 +3728,10 @@ iscsi_if_rx(struct sk_buff *skb)
3415 + break;
3416 + err = iscsi_if_send_reply(group, nlh->nlmsg_seq,
3417 + nlh->nlmsg_type, 0, 0, ev, sizeof(*ev));
3418 ++ if (err == -EAGAIN && --retries < 0) {
3419 ++ printk(KERN_WARNING "Send reply failed, error %d\n", err);
3420 ++ break;
3421 ++ }
3422 + } while (err < 0 && err != -ECONNREFUSED && err != -ESRCH);
3423 + skb_pull(skb, rlen);
3424 + }
3425 +diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
3426 +index ca655593c5e0..1cedd640705f 100644
3427 +--- a/drivers/spi/spi-bcm2835aux.c
3428 ++++ b/drivers/spi/spi-bcm2835aux.c
3429 +@@ -390,7 +390,18 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
3430 + platform_set_drvdata(pdev, master);
3431 + master->mode_bits = BCM2835_AUX_SPI_MODE_BITS;
3432 + master->bits_per_word_mask = SPI_BPW_MASK(8);
3433 +- master->num_chipselect = -1;
3434 ++ /* even though the driver never officially supported native CS
3435 ++ * allow a single native CS for legacy DT support purposes when
3436 ++ * no cs-gpio is configured.
3437 ++ * Known limitations for native cs are:
3438 ++ * * multiple chip-selects: cs0-cs2 are all simultaniously asserted
3439 ++ * whenever there is a transfer - this even includes SPI_NO_CS
3440 ++ * * SPI_CS_HIGH: is ignores - cs are always asserted low
3441 ++ * * cs_change: cs is deasserted after each spi_transfer
3442 ++ * * cs_delay_usec: cs is always deasserted one SCK cycle after
3443 ++ * a spi_transfer
3444 ++ */
3445 ++ master->num_chipselect = 1;
3446 + master->transfer_one = bcm2835aux_spi_transfer_one;
3447 + master->handle_err = bcm2835aux_spi_handle_err;
3448 + master->dev.of_node = pdev->dev.of_node;
3449 +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
3450 +index 8b290d9d7935..5419de19859a 100644
3451 +--- a/drivers/spi/spi-fsl-spi.c
3452 ++++ b/drivers/spi/spi-fsl-spi.c
3453 +@@ -408,7 +408,6 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
3454 + }
3455 +
3456 + m->status = status;
3457 +- spi_finalize_current_message(master);
3458 +
3459 + if (status || !cs_change) {
3460 + ndelay(nsecs);
3461 +@@ -416,6 +415,7 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
3462 + }
3463 +
3464 + fsl_spi_setup_transfer(spi, NULL);
3465 ++ spi_finalize_current_message(master);
3466 + return 0;
3467 + }
3468 +
3469 +diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
3470 +index 705f515863d4..e37712bed0b2 100644
3471 +--- a/drivers/spi/spi-tegra114.c
3472 ++++ b/drivers/spi/spi-tegra114.c
3473 +@@ -307,10 +307,16 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
3474 + x |= (u32)(*tx_buf++) << (i * 8);
3475 + tegra_spi_writel(tspi, x, SPI_TX_FIFO);
3476 + }
3477 ++
3478 ++ tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
3479 + } else {
3480 ++ unsigned int write_bytes;
3481 + max_n_32bit = min(tspi->curr_dma_words, tx_empty_count);
3482 + written_words = max_n_32bit;
3483 + nbytes = written_words * tspi->bytes_per_word;
3484 ++ if (nbytes > t->len - tspi->cur_pos)
3485 ++ nbytes = t->len - tspi->cur_pos;
3486 ++ write_bytes = nbytes;
3487 + for (count = 0; count < max_n_32bit; count++) {
3488 + u32 x = 0;
3489 +
3490 +@@ -319,8 +325,10 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
3491 + x |= (u32)(*tx_buf++) << (i * 8);
3492 + tegra_spi_writel(tspi, x, SPI_TX_FIFO);
3493 + }
3494 ++
3495 ++ tspi->cur_tx_pos += write_bytes;
3496 + }
3497 +- tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
3498 ++
3499 + return written_words;
3500 + }
3501 +
3502 +@@ -344,20 +352,27 @@ static unsigned int tegra_spi_read_rx_fifo_to_client_rxbuf(
3503 + for (i = 0; len && (i < 4); i++, len--)
3504 + *rx_buf++ = (x >> i*8) & 0xFF;
3505 + }
3506 +- tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
3507 + read_words += tspi->curr_dma_words;
3508 ++ tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
3509 + } else {
3510 + u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
3511 ++ u8 bytes_per_word = tspi->bytes_per_word;
3512 ++ unsigned int read_bytes;
3513 +
3514 ++ len = rx_full_count * bytes_per_word;
3515 ++ if (len > t->len - tspi->cur_pos)
3516 ++ len = t->len - tspi->cur_pos;
3517 ++ read_bytes = len;
3518 + for (count = 0; count < rx_full_count; count++) {
3519 + u32 x = tegra_spi_readl(tspi, SPI_RX_FIFO) & rx_mask;
3520 +
3521 +- for (i = 0; (i < tspi->bytes_per_word); i++)
3522 ++ for (i = 0; len && (i < bytes_per_word); i++, len--)
3523 + *rx_buf++ = (x >> (i*8)) & 0xFF;
3524 + }
3525 +- tspi->cur_rx_pos += rx_full_count * tspi->bytes_per_word;
3526 + read_words += rx_full_count;
3527 ++ tspi->cur_rx_pos += read_bytes;
3528 + }
3529 ++
3530 + return read_words;
3531 + }
3532 +
3533 +@@ -372,12 +387,17 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
3534 + unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
3535 +
3536 + memcpy(tspi->tx_dma_buf, t->tx_buf + tspi->cur_pos, len);
3537 ++ tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
3538 + } else {
3539 + unsigned int i;
3540 + unsigned int count;
3541 + u8 *tx_buf = (u8 *)t->tx_buf + tspi->cur_tx_pos;
3542 + unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
3543 ++ unsigned int write_bytes;
3544 +
3545 ++ if (consume > t->len - tspi->cur_pos)
3546 ++ consume = t->len - tspi->cur_pos;
3547 ++ write_bytes = consume;
3548 + for (count = 0; count < tspi->curr_dma_words; count++) {
3549 + u32 x = 0;
3550 +
3551 +@@ -386,8 +406,9 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
3552 + x |= (u32)(*tx_buf++) << (i * 8);
3553 + tspi->tx_dma_buf[count] = x;
3554 + }
3555 ++
3556 ++ tspi->cur_tx_pos += write_bytes;
3557 + }
3558 +- tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
3559 +
3560 + /* Make the dma buffer to read by dma */
3561 + dma_sync_single_for_device(tspi->dev, tspi->tx_dma_phys,
3562 +@@ -405,20 +426,28 @@ static void tegra_spi_copy_spi_rxbuf_to_client_rxbuf(
3563 + unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
3564 +
3565 + memcpy(t->rx_buf + tspi->cur_rx_pos, tspi->rx_dma_buf, len);
3566 ++ tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
3567 + } else {
3568 + unsigned int i;
3569 + unsigned int count;
3570 + unsigned char *rx_buf = t->rx_buf + tspi->cur_rx_pos;
3571 + u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
3572 ++ unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
3573 ++ unsigned int read_bytes;
3574 +
3575 ++ if (consume > t->len - tspi->cur_pos)
3576 ++ consume = t->len - tspi->cur_pos;
3577 ++ read_bytes = consume;
3578 + for (count = 0; count < tspi->curr_dma_words; count++) {
3579 + u32 x = tspi->rx_dma_buf[count] & rx_mask;
3580 +
3581 +- for (i = 0; (i < tspi->bytes_per_word); i++)
3582 ++ for (i = 0; consume && (i < tspi->bytes_per_word);
3583 ++ i++, consume--)
3584 + *rx_buf++ = (x >> (i*8)) & 0xFF;
3585 + }
3586 ++
3587 ++ tspi->cur_rx_pos += read_bytes;
3588 + }
3589 +- tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
3590 +
3591 + /* Make the dma buffer to read by dma */
3592 + dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys,
3593 +@@ -730,6 +759,8 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
3594 +
3595 + if (tspi->is_packed)
3596 + command1 |= SPI_PACKED;
3597 ++ else
3598 ++ command1 &= ~SPI_PACKED;
3599 +
3600 + command1 &= ~(SPI_CS_SEL_MASK | SPI_TX_EN | SPI_RX_EN);
3601 + tspi->cur_direction = 0;
3602 +diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
3603 +index 619c989c5f37..d682907c146a 100644
3604 +--- a/drivers/staging/comedi/drivers/ni_mio_common.c
3605 ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
3606 +@@ -4809,7 +4809,10 @@ static int ni_valid_rtsi_output_source(struct comedi_device *dev,
3607 + case NI_RTSI_OUTPUT_G_SRC0:
3608 + case NI_RTSI_OUTPUT_G_GATE0:
3609 + case NI_RTSI_OUTPUT_RGOUT0:
3610 +- case NI_RTSI_OUTPUT_RTSI_BRD_0:
3611 ++ case NI_RTSI_OUTPUT_RTSI_BRD(0):
3612 ++ case NI_RTSI_OUTPUT_RTSI_BRD(1):
3613 ++ case NI_RTSI_OUTPUT_RTSI_BRD(2):
3614 ++ case NI_RTSI_OUTPUT_RTSI_BRD(3):
3615 + return 1;
3616 + case NI_RTSI_OUTPUT_RTSI_OSC:
3617 + return (devpriv->is_m_series) ? 1 : 0;
3618 +@@ -4830,11 +4833,18 @@ static int ni_set_rtsi_routing(struct comedi_device *dev,
3619 + devpriv->rtsi_trig_a_output_reg |= NISTC_RTSI_TRIG(chan, src);
3620 + ni_stc_writew(dev, devpriv->rtsi_trig_a_output_reg,
3621 + NISTC_RTSI_TRIGA_OUT_REG);
3622 +- } else if (chan < 8) {
3623 ++ } else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
3624 + devpriv->rtsi_trig_b_output_reg &= ~NISTC_RTSI_TRIG_MASK(chan);
3625 + devpriv->rtsi_trig_b_output_reg |= NISTC_RTSI_TRIG(chan, src);
3626 + ni_stc_writew(dev, devpriv->rtsi_trig_b_output_reg,
3627 + NISTC_RTSI_TRIGB_OUT_REG);
3628 ++ } else if (chan != NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
3629 ++ /* probably should never reach this, since the
3630 ++ * ni_valid_rtsi_output_source above errors out if chan is too
3631 ++ * high
3632 ++ */
3633 ++ dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
3634 ++ return -EINVAL;
3635 + }
3636 + return 2;
3637 + }
3638 +@@ -4849,12 +4859,12 @@ static unsigned ni_get_rtsi_routing(struct comedi_device *dev, unsigned chan)
3639 + } else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
3640 + return NISTC_RTSI_TRIG_TO_SRC(chan,
3641 + devpriv->rtsi_trig_b_output_reg);
3642 +- } else {
3643 +- if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN)
3644 +- return NI_RTSI_OUTPUT_RTSI_OSC;
3645 +- dev_err(dev->class_dev, "bug! should never get here?\n");
3646 +- return 0;
3647 ++ } else if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
3648 ++ return NI_RTSI_OUTPUT_RTSI_OSC;
3649 + }
3650 ++
3651 ++ dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
3652 ++ return -EINVAL;
3653 + }
3654 +
3655 + static int ni_rtsi_insn_config(struct comedi_device *dev,
3656 +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
3657 +index 564828554ca0..07d9384bce94 100644
3658 +--- a/drivers/target/iscsi/iscsi_target.c
3659 ++++ b/drivers/target/iscsi/iscsi_target.c
3660 +@@ -4309,9 +4309,6 @@ int iscsit_close_connection(
3661 + iscsit_stop_nopin_response_timer(conn);
3662 + iscsit_stop_nopin_timer(conn);
3663 +
3664 +- if (conn->conn_transport->iscsit_wait_conn)
3665 +- conn->conn_transport->iscsit_wait_conn(conn);
3666 +-
3667 + /*
3668 + * During Connection recovery drop unacknowledged out of order
3669 + * commands for this connection, and prepare the other commands
3670 +@@ -4397,6 +4394,9 @@ int iscsit_close_connection(
3671 + target_sess_cmd_list_set_waiting(sess->se_sess);
3672 + target_wait_for_sess_cmds(sess->se_sess);
3673 +
3674 ++ if (conn->conn_transport->iscsit_wait_conn)
3675 ++ conn->conn_transport->iscsit_wait_conn(conn);
3676 ++
3677 + if (conn->conn_rx_hash.tfm)
3678 + crypto_free_hash(conn->conn_rx_hash.tfm);
3679 + if (conn->conn_tx_hash.tfm)
3680 +diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
3681 +index 87d87ac1c8a0..96567b4a4f20 100644
3682 +--- a/drivers/thermal/cpu_cooling.c
3683 ++++ b/drivers/thermal/cpu_cooling.c
3684 +@@ -607,7 +607,7 @@ static int cpufreq_get_requested_power(struct thermal_cooling_device *cdev,
3685 + load = 0;
3686 +
3687 + total_load += load;
3688 +- if (trace_thermal_power_cpu_limit_enabled() && load_cpu)
3689 ++ if (load_cpu)
3690 + load_cpu[i] = load;
3691 +
3692 + i++;
3693 +diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
3694 +index ad7031a4f3c4..454cdc6f2c05 100644
3695 +--- a/drivers/tty/ipwireless/hardware.c
3696 ++++ b/drivers/tty/ipwireless/hardware.c
3697 +@@ -1515,6 +1515,8 @@ static void ipw_send_setup_packet(struct ipw_hardware *hw)
3698 + sizeof(struct ipw_setup_get_version_query_packet),
3699 + ADDR_SETUP_PROT, TL_PROTOCOLID_SETUP,
3700 + TL_SETUP_SIGNO_GET_VERSION_QRY);
3701 ++ if (!ver_packet)
3702 ++ return;
3703 + ver_packet->header.length = sizeof(struct tl_setup_get_version_qry);
3704 +
3705 + /*
3706 +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
3707 +index 71ad04d54212..1a1d1cfc3704 100644
3708 +--- a/drivers/usb/class/cdc-wdm.c
3709 ++++ b/drivers/usb/class/cdc-wdm.c
3710 +@@ -1098,7 +1098,7 @@ static int wdm_post_reset(struct usb_interface *intf)
3711 + rv = recover_from_urb_loss(desc);
3712 + mutex_unlock(&desc->wlock);
3713 + mutex_unlock(&desc->rlock);
3714 +- return 0;
3715 ++ return rv;
3716 + }
3717 +
3718 + static struct usb_driver wdm_driver = {
3719 +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
3720 +index 40c95ed6afbf..3ef80c2c0dcc 100644
3721 +--- a/drivers/usb/host/xhci-hub.c
3722 ++++ b/drivers/usb/host/xhci-hub.c
3723 +@@ -965,7 +965,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
3724 + }
3725 + port_li = readl(port_array[wIndex] + PORTLI);
3726 + status = xhci_get_ext_port_status(temp, port_li);
3727 +- put_unaligned_le32(cpu_to_le32(status), &buf[4]);
3728 ++ put_unaligned_le32(status, &buf[4]);
3729 + }
3730 + break;
3731 + case SetPortFeature:
3732 +diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
3733 +index 4b62eb3b5923..7a82735d5308 100644
3734 +--- a/drivers/vfio/pci/vfio_pci.c
3735 ++++ b/drivers/vfio/pci/vfio_pci.c
3736 +@@ -496,6 +496,7 @@ static long vfio_pci_ioctl(void *device_data,
3737 + {
3738 + void __iomem *io;
3739 + size_t size;
3740 ++ u16 orig_cmd;
3741 +
3742 + info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
3743 + info.flags = 0;
3744 +@@ -505,15 +506,23 @@ static long vfio_pci_ioctl(void *device_data,
3745 + if (!info.size)
3746 + break;
3747 +
3748 +- /* Is it really there? */
3749 ++ /*
3750 ++ * Is it really there? Enable memory decode for
3751 ++ * implicit access in pci_map_rom().
3752 ++ */
3753 ++ pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd);
3754 ++ pci_write_config_word(pdev, PCI_COMMAND,
3755 ++ orig_cmd | PCI_COMMAND_MEMORY);
3756 ++
3757 + io = pci_map_rom(pdev, &size);
3758 +- if (!io || !size) {
3759 ++ if (io) {
3760 ++ info.flags = VFIO_REGION_INFO_FLAG_READ;
3761 ++ pci_unmap_rom(pdev, io);
3762 ++ } else {
3763 + info.size = 0;
3764 +- break;
3765 + }
3766 +- pci_unmap_rom(pdev, io);
3767 +
3768 +- info.flags = VFIO_REGION_INFO_FLAG_READ;
3769 ++ pci_write_config_word(pdev, PCI_COMMAND, orig_cmd);
3770 + break;
3771 + }
3772 + case VFIO_PCI_VGA_REGION_INDEX:
3773 +diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
3774 +index 35fe4825a454..5ef6f9d420a2 100644
3775 +--- a/drivers/video/backlight/lm3630a_bl.c
3776 ++++ b/drivers/video/backlight/lm3630a_bl.c
3777 +@@ -200,7 +200,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
3778 + LM3630A_LEDA_ENABLE, LM3630A_LEDA_ENABLE);
3779 + if (ret < 0)
3780 + goto out_i2c_err;
3781 +- return bl->props.brightness;
3782 ++ return 0;
3783 +
3784 + out_i2c_err:
3785 + dev_err(pchip->dev, "i2c failed to access\n");
3786 +@@ -277,7 +277,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
3787 + LM3630A_LEDB_ENABLE, LM3630A_LEDB_ENABLE);
3788 + if (ret < 0)
3789 + goto out_i2c_err;
3790 +- return bl->props.brightness;
3791 ++ return 0;
3792 +
3793 + out_i2c_err:
3794 + dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
3795 +diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
3796 +index 59abdc6a97f6..314b7eceb81c 100644
3797 +--- a/drivers/video/fbdev/chipsfb.c
3798 ++++ b/drivers/video/fbdev/chipsfb.c
3799 +@@ -350,7 +350,7 @@ static void init_chips(struct fb_info *p, unsigned long addr)
3800 + static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
3801 + {
3802 + struct fb_info *p;
3803 +- unsigned long addr, size;
3804 ++ unsigned long addr;
3805 + unsigned short cmd;
3806 + int rc = -ENODEV;
3807 +
3808 +@@ -362,7 +362,6 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
3809 + if ((dp->resource[0].flags & IORESOURCE_MEM) == 0)
3810 + goto err_disable;
3811 + addr = pci_resource_start(dp, 0);
3812 +- size = pci_resource_len(dp, 0);
3813 + if (addr == 0)
3814 + goto err_disable;
3815 +
3816 +diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
3817 +index f4e59c445964..17054d695411 100644
3818 +--- a/drivers/xen/cpu_hotplug.c
3819 ++++ b/drivers/xen/cpu_hotplug.c
3820 +@@ -53,7 +53,7 @@ static int vcpu_online(unsigned int cpu)
3821 + }
3822 + static void vcpu_hotplug(unsigned int cpu)
3823 + {
3824 +- if (!cpu_possible(cpu))
3825 ++ if (cpu >= nr_cpu_ids || !cpu_possible(cpu))
3826 + return;
3827 +
3828 + switch (vcpu_online(cpu)) {
3829 +diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
3830 +index 07573dc1614a..3469c7ce7cb6 100644
3831 +--- a/fs/btrfs/inode-map.c
3832 ++++ b/fs/btrfs/inode-map.c
3833 +@@ -158,6 +158,7 @@ static void start_caching(struct btrfs_root *root)
3834 + spin_lock(&root->ino_cache_lock);
3835 + root->ino_cache_state = BTRFS_CACHE_FINISHED;
3836 + spin_unlock(&root->ino_cache_lock);
3837 ++ wake_up(&root->ino_cache_wait);
3838 + return;
3839 + }
3840 +
3841 +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
3842 +index 63108343124a..4bde8acca455 100644
3843 +--- a/fs/cifs/connect.c
3844 ++++ b/fs/cifs/connect.c
3845 +@@ -939,6 +939,7 @@ cifs_demultiplex_thread(void *p)
3846 + mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
3847 +
3848 + set_freezable();
3849 ++ allow_kernel_signal(SIGKILL);
3850 + while (server->tcpStatus != CifsExiting) {
3851 + if (try_to_freeze())
3852 + continue;
3853 +@@ -2246,7 +2247,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
3854 +
3855 + task = xchg(&server->tsk, NULL);
3856 + if (task)
3857 +- force_sig(SIGKILL, task);
3858 ++ send_sig(SIGKILL, task, 1);
3859 + }
3860 +
3861 + static struct TCP_Server_Info *
3862 +diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
3863 +index 6599c6124552..01cbdd0987c0 100644
3864 +--- a/fs/exportfs/expfs.c
3865 ++++ b/fs/exportfs/expfs.c
3866 +@@ -148,6 +148,7 @@ static struct dentry *reconnect_one(struct vfsmount *mnt,
3867 + mutex_unlock(&parent->d_inode->i_mutex);
3868 + if (IS_ERR(tmp)) {
3869 + dprintk("%s: lookup failed: %d\n", __func__, PTR_ERR(tmp));
3870 ++ err = PTR_ERR(tmp);
3871 + goto out_err;
3872 + }
3873 + if (tmp != dentry) {
3874 +diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
3875 +index 0dcd33f62637..00f9433eea23 100644
3876 +--- a/fs/ext4/inline.c
3877 ++++ b/fs/ext4/inline.c
3878 +@@ -1418,7 +1418,7 @@ int htree_inlinedir_to_tree(struct file *dir_file,
3879 + err = ext4_htree_store_dirent(dir_file, hinfo->hash,
3880 + hinfo->minor_hash, de, &tmp_str);
3881 + if (err) {
3882 +- count = err;
3883 ++ ret = err;
3884 + goto out;
3885 + }
3886 + count++;
3887 +diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
3888 +index d595856453b2..de6351c1c8db 100644
3889 +--- a/fs/jfs/jfs_txnmgr.c
3890 ++++ b/fs/jfs/jfs_txnmgr.c
3891 +@@ -1928,8 +1928,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
3892 + * header ?
3893 + */
3894 + if (tlck->type & tlckTRUNCATE) {
3895 +- /* This odd declaration suppresses a bogus gcc warning */
3896 +- pxd_t pxd = pxd; /* truncated extent of xad */
3897 ++ pxd_t pxd; /* truncated extent of xad */
3898 + int twm;
3899 +
3900 + /*
3901 +diff --git a/fs/namei.c b/fs/namei.c
3902 +index 40049d61ef37..a4ed9c337c21 100644
3903 +--- a/fs/namei.c
3904 ++++ b/fs/namei.c
3905 +@@ -988,7 +988,8 @@ static int may_linkat(struct path *link)
3906 + * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory
3907 + * should be allowed, or not, on files that already
3908 + * exist.
3909 +- * @dir: the sticky parent directory
3910 ++ * @dir_mode: mode bits of directory
3911 ++ * @dir_uid: owner of directory
3912 + * @inode: the inode of the file to open
3913 + *
3914 + * Block an O_CREAT open of a FIFO (or a regular file) when:
3915 +@@ -1004,18 +1005,18 @@ static int may_linkat(struct path *link)
3916 + *
3917 + * Returns 0 if the open is allowed, -ve on error.
3918 + */
3919 +-static int may_create_in_sticky(struct dentry * const dir,
3920 ++static int may_create_in_sticky(umode_t dir_mode, kuid_t dir_uid,
3921 + struct inode * const inode)
3922 + {
3923 + if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
3924 + (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
3925 +- likely(!(dir->d_inode->i_mode & S_ISVTX)) ||
3926 +- uid_eq(inode->i_uid, dir->d_inode->i_uid) ||
3927 ++ likely(!(dir_mode & S_ISVTX)) ||
3928 ++ uid_eq(inode->i_uid, dir_uid) ||
3929 + uid_eq(current_fsuid(), inode->i_uid))
3930 + return 0;
3931 +
3932 +- if (likely(dir->d_inode->i_mode & 0002) ||
3933 +- (dir->d_inode->i_mode & 0020 &&
3934 ++ if (likely(dir_mode & 0002) ||
3935 ++ (dir_mode & 0020 &&
3936 + ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
3937 + (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
3938 + return -EACCES;
3939 +@@ -3059,6 +3060,8 @@ static int do_last(struct nameidata *nd,
3940 + int *opened)
3941 + {
3942 + struct dentry *dir = nd->path.dentry;
3943 ++ kuid_t dir_uid = dir->d_inode->i_uid;
3944 ++ umode_t dir_mode = dir->d_inode->i_mode;
3945 + int open_flag = op->open_flag;
3946 + bool will_truncate = (open_flag & O_TRUNC) != 0;
3947 + bool got_write = false;
3948 +@@ -3211,7 +3214,7 @@ finish_open:
3949 + error = -EISDIR;
3950 + if (d_is_dir(nd->path.dentry))
3951 + goto out;
3952 +- error = may_create_in_sticky(dir,
3953 ++ error = may_create_in_sticky(dir_mode, dir_uid,
3954 + d_backing_inode(nd->path.dentry));
3955 + if (unlikely(error))
3956 + goto out;
3957 +diff --git a/fs/nfs/super.c b/fs/nfs/super.c
3958 +index dced329a8584..47a7751146cf 100644
3959 +--- a/fs/nfs/super.c
3960 ++++ b/fs/nfs/super.c
3961 +@@ -1901,7 +1901,7 @@ static int nfs_parse_devname(const char *dev_name,
3962 + /* kill possible hostname list: not supported */
3963 + comma = strchr(dev_name, ',');
3964 + if (comma != NULL && comma < end)
3965 +- *comma = 0;
3966 ++ len = comma - dev_name;
3967 + }
3968 +
3969 + if (len > maxnamlen)
3970 +diff --git a/fs/xfs/xfs_quotaops.c b/fs/xfs/xfs_quotaops.c
3971 +index 7795e0d01382..4b94db85b2a0 100644
3972 +--- a/fs/xfs/xfs_quotaops.c
3973 ++++ b/fs/xfs/xfs_quotaops.c
3974 +@@ -214,6 +214,9 @@ xfs_fs_rm_xquota(
3975 + if (XFS_IS_QUOTA_ON(mp))
3976 + return -EINVAL;
3977 +
3978 ++ if (uflags & ~(FS_USER_QUOTA | FS_GROUP_QUOTA | FS_PROJ_QUOTA))
3979 ++ return -EINVAL;
3980 ++
3981 + if (uflags & FS_USER_QUOTA)
3982 + flags |= XFS_DQ_USER;
3983 + if (uflags & FS_GROUP_QUOTA)
3984 +diff --git a/include/asm-generic/rtc.h b/include/asm-generic/rtc.h
3985 +index 4e3b6558331e..3e457ae2d571 100644
3986 +--- a/include/asm-generic/rtc.h
3987 ++++ b/include/asm-generic/rtc.h
3988 +@@ -106,7 +106,7 @@ static inline unsigned int __get_rtc_time(struct rtc_time *time)
3989 + time->tm_year += real_year - 72;
3990 + #endif
3991 +
3992 +- if (century)
3993 ++ if (century > 20)
3994 + time->tm_year += (century - 19) * 100;
3995 +
3996 + /*
3997 +diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h
3998 +index 714ce4a5e31f..39d47af6ca7b 100644
3999 +--- a/include/linux/bitmap.h
4000 ++++ b/include/linux/bitmap.h
4001 +@@ -83,6 +83,14 @@
4002 + * contain all bit positions from 0 to 'bits' - 1.
4003 + */
4004 +
4005 ++/*
4006 ++ * Allocation and deallocation of bitmap.
4007 ++ * Provided in lib/bitmap.c to avoid circular dependency.
4008 ++ */
4009 ++extern unsigned long *bitmap_alloc(unsigned int nbits, gfp_t flags);
4010 ++extern unsigned long *bitmap_zalloc(unsigned int nbits, gfp_t flags);
4011 ++extern void bitmap_free(const unsigned long *bitmap);
4012 ++
4013 + /*
4014 + * lib/bitmap.c provides these functions:
4015 + */
4016 +diff --git a/include/linux/device.h b/include/linux/device.h
4017 +index 834000903525..eb891c9c4b62 100644
4018 +--- a/include/linux/device.h
4019 ++++ b/include/linux/device.h
4020 +@@ -677,7 +677,8 @@ extern unsigned long devm_get_free_pages(struct device *dev,
4021 + gfp_t gfp_mask, unsigned int order);
4022 + extern void devm_free_pages(struct device *dev, unsigned long addr);
4023 +
4024 +-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res);
4025 ++void __iomem *devm_ioremap_resource(struct device *dev,
4026 ++ const struct resource *res);
4027 +
4028 + /* allows to add/remove a custom action to devres stack */
4029 + int devm_add_action(struct device *dev, void (*action)(void *), void *data);
4030 +diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
4031 +index 0e1f433cc4b7..378c234ba3e4 100644
4032 +--- a/include/linux/netfilter/ipset/ip_set.h
4033 ++++ b/include/linux/netfilter/ipset/ip_set.h
4034 +@@ -530,13 +530,6 @@ ip6addrptr(const struct sk_buff *skb, bool src, struct in6_addr *addr)
4035 + sizeof(*addr));
4036 + }
4037 +
4038 +-/* Calculate the bytes required to store the inclusive range of a-b */
4039 +-static inline int
4040 +-bitmap_bytes(u32 a, u32 b)
4041 +-{
4042 +- return 4 * ((((b - a + 8) / 8) + 3) / 4);
4043 +-}
4044 +-
4045 + #include <linux/netfilter/ipset/ip_set_timeout.h>
4046 + #include <linux/netfilter/ipset/ip_set_comment.h>
4047 +
4048 +diff --git a/include/linux/platform_data/dma-imx-sdma.h b/include/linux/platform_data/dma-imx-sdma.h
4049 +index 2d08816720f6..5bb0a119f39a 100644
4050 +--- a/include/linux/platform_data/dma-imx-sdma.h
4051 ++++ b/include/linux/platform_data/dma-imx-sdma.h
4052 +@@ -50,7 +50,10 @@ struct sdma_script_start_addrs {
4053 + /* End of v2 array */
4054 + s32 zcanfd_2_mcu_addr;
4055 + s32 zqspi_2_mcu_addr;
4056 ++ s32 mcu_2_ecspi_addr;
4057 + /* End of v3 array */
4058 ++ s32 mcu_2_zqspi_addr;
4059 ++ /* End of v4 array */
4060 + };
4061 +
4062 + /**
4063 +diff --git a/include/linux/signal.h b/include/linux/signal.h
4064 +index bcc094cb697c..649cd9fc63ca 100644
4065 +--- a/include/linux/signal.h
4066 ++++ b/include/linux/signal.h
4067 +@@ -313,6 +313,9 @@ extern void signal_setup_done(int failed, struct ksignal *ksig, int stepping);
4068 + extern void exit_signals(struct task_struct *tsk);
4069 + extern void kernel_sigaction(int, __sighandler_t);
4070 +
4071 ++#define SIG_KTHREAD ((__force __sighandler_t)2)
4072 ++#define SIG_KTHREAD_KERNEL ((__force __sighandler_t)3)
4073 ++
4074 + static inline void allow_signal(int sig)
4075 + {
4076 + /*
4077 +@@ -320,7 +323,17 @@ static inline void allow_signal(int sig)
4078 + * know it'll be handled, so that they don't get converted to
4079 + * SIGKILL or just silently dropped.
4080 + */
4081 +- kernel_sigaction(sig, (__force __sighandler_t)2);
4082 ++ kernel_sigaction(sig, SIG_KTHREAD);
4083 ++}
4084 ++
4085 ++static inline void allow_kernel_signal(int sig)
4086 ++{
4087 ++ /*
4088 ++ * Kernel threads handle their own signals. Let the signal code
4089 ++ * know signals sent by the kernel will be handled, so that they
4090 ++ * don't get silently dropped.
4091 ++ */
4092 ++ kernel_sigaction(sig, SIG_KTHREAD_KERNEL);
4093 + }
4094 +
4095 + static inline void disallow_signal(int sig)
4096 +diff --git a/include/media/davinci/vpbe.h b/include/media/davinci/vpbe.h
4097 +index 4376beeb28c2..5d8ceeddc797 100644
4098 +--- a/include/media/davinci/vpbe.h
4099 ++++ b/include/media/davinci/vpbe.h
4100 +@@ -96,7 +96,7 @@ struct vpbe_config {
4101 + struct encoder_config_info *ext_encoders;
4102 + /* amplifier information goes here */
4103 + struct amp_config_info *amp;
4104 +- int num_outputs;
4105 ++ unsigned int num_outputs;
4106 + /* Order is venc outputs followed by LCD and then external encoders */
4107 + struct vpbe_output *outputs;
4108 + };
4109 +diff --git a/include/trace/events/xen.h b/include/trace/events/xen.h
4110 +index d6be935caa50..ecd1a0f7bd3e 100644
4111 +--- a/include/trace/events/xen.h
4112 ++++ b/include/trace/events/xen.h
4113 +@@ -63,7 +63,11 @@ TRACE_EVENT(xen_mc_callback,
4114 + TP_PROTO(xen_mc_callback_fn_t fn, void *data),
4115 + TP_ARGS(fn, data),
4116 + TP_STRUCT__entry(
4117 +- __field(xen_mc_callback_fn_t, fn)
4118 ++ /*
4119 ++ * Use field_struct to avoid is_signed_type()
4120 ++ * comparison of a function pointer.
4121 ++ */
4122 ++ __field_struct(xen_mc_callback_fn_t, fn)
4123 + __field(void *, data)
4124 + ),
4125 + TP_fast_assign(
4126 +diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
4127 +index ebc52c7bd8a6..cba287a5c976 100644
4128 +--- a/kernel/debug/kdb/kdb_main.c
4129 ++++ b/kernel/debug/kdb/kdb_main.c
4130 +@@ -2632,7 +2632,7 @@ static int kdb_per_cpu(int argc, const char **argv)
4131 + diag = kdbgetularg(argv[3], &whichcpu);
4132 + if (diag)
4133 + return diag;
4134 +- if (!cpu_online(whichcpu)) {
4135 ++ if (whichcpu >= nr_cpu_ids || !cpu_online(whichcpu)) {
4136 + kdb_printf("cpu %ld is not online\n", whichcpu);
4137 + return KDB_BADCPUNUM;
4138 + }
4139 +diff --git a/kernel/signal.c b/kernel/signal.c
4140 +index 3095b2309876..7e4a4b199a11 100644
4141 +--- a/kernel/signal.c
4142 ++++ b/kernel/signal.c
4143 +@@ -79,6 +79,11 @@ static int sig_task_ignored(struct task_struct *t, int sig, bool force)
4144 + handler == SIG_DFL && !(force && sig_kernel_only(sig)))
4145 + return 1;
4146 +
4147 ++ /* Only allow kernel generated signals to this kthread */
4148 ++ if (unlikely((t->flags & PF_KTHREAD) &&
4149 ++ (handler == SIG_KTHREAD_KERNEL) && !force))
4150 ++ return true;
4151 ++
4152 + return sig_handler_ignored(handler, sig);
4153 + }
4154 +
4155 +diff --git a/lib/bitmap.c b/lib/bitmap.c
4156 +index 814814397cce..bdf572d09b8f 100644
4157 +--- a/lib/bitmap.c
4158 ++++ b/lib/bitmap.c
4159 +@@ -12,6 +12,7 @@
4160 + #include <linux/bitmap.h>
4161 + #include <linux/bitops.h>
4162 + #include <linux/bug.h>
4163 ++#include <linux/slab.h>
4164 +
4165 + #include <asm/page.h>
4166 + #include <asm/uaccess.h>
4167 +@@ -1081,3 +1082,22 @@ void bitmap_copy_le(unsigned long *dst, const unsigned long *src, unsigned int n
4168 + }
4169 + EXPORT_SYMBOL(bitmap_copy_le);
4170 + #endif
4171 ++
4172 ++unsigned long *bitmap_alloc(unsigned int nbits, gfp_t flags)
4173 ++{
4174 ++ return kmalloc_array(BITS_TO_LONGS(nbits), sizeof(unsigned long),
4175 ++ flags);
4176 ++}
4177 ++EXPORT_SYMBOL(bitmap_alloc);
4178 ++
4179 ++unsigned long *bitmap_zalloc(unsigned int nbits, gfp_t flags)
4180 ++{
4181 ++ return bitmap_alloc(nbits, flags | __GFP_ZERO);
4182 ++}
4183 ++EXPORT_SYMBOL(bitmap_zalloc);
4184 ++
4185 ++void bitmap_free(const unsigned long *bitmap)
4186 ++{
4187 ++ kfree(bitmap);
4188 ++}
4189 ++EXPORT_SYMBOL(bitmap_free);
4190 +diff --git a/lib/devres.c b/lib/devres.c
4191 +index 8c85672639d3..9d18ccd00df5 100644
4192 +--- a/lib/devres.c
4193 ++++ b/lib/devres.c
4194 +@@ -131,7 +131,8 @@ EXPORT_SYMBOL(devm_iounmap);
4195 + * if (IS_ERR(base))
4196 + * return PTR_ERR(base);
4197 + */
4198 +-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res)
4199 ++void __iomem *devm_ioremap_resource(struct device *dev,
4200 ++ const struct resource *res)
4201 + {
4202 + resource_size_t size;
4203 + const char *name;
4204 +diff --git a/lib/kfifo.c b/lib/kfifo.c
4205 +index 90ba1eb1df06..a94227c55551 100644
4206 +--- a/lib/kfifo.c
4207 ++++ b/lib/kfifo.c
4208 +@@ -82,7 +82,8 @@ int __kfifo_init(struct __kfifo *fifo, void *buffer,
4209 + {
4210 + size /= esize;
4211 +
4212 +- size = roundup_pow_of_two(size);
4213 ++ if (!is_power_of_2(size))
4214 ++ size = rounddown_pow_of_two(size);
4215 +
4216 + fifo->in = 0;
4217 + fifo->out = 0;
4218 +diff --git a/net/6lowpan/nhc.c b/net/6lowpan/nhc.c
4219 +index 7008d53e455c..e61679bf0908 100644
4220 +--- a/net/6lowpan/nhc.c
4221 ++++ b/net/6lowpan/nhc.c
4222 +@@ -18,7 +18,7 @@
4223 + #include "nhc.h"
4224 +
4225 + static struct rb_root rb_root = RB_ROOT;
4226 +-static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX];
4227 ++static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX + 1];
4228 + static DEFINE_SPINLOCK(lowpan_nhc_lock);
4229 +
4230 + static int lowpan_nhc_insert(struct lowpan_nhc *nhc)
4231 +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
4232 +index fd1af7cb960d..e7c170949b21 100644
4233 +--- a/net/bridge/netfilter/ebtables.c
4234 ++++ b/net/bridge/netfilter/ebtables.c
4235 +@@ -2174,7 +2174,9 @@ static int compat_copy_entries(unsigned char *data, unsigned int size_user,
4236 + if (ret < 0)
4237 + return ret;
4238 +
4239 +- WARN_ON(size_remaining);
4240 ++ if (size_remaining)
4241 ++ return -EINVAL;
4242 ++
4243 + return state->buf_kern_offset;
4244 + }
4245 +
4246 +diff --git a/net/core/neighbour.c b/net/core/neighbour.c
4247 +index af1ecd0e7b07..9849f1f4cf4f 100644
4248 +--- a/net/core/neighbour.c
4249 ++++ b/net/core/neighbour.c
4250 +@@ -1837,8 +1837,8 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
4251 + goto nla_put_failure;
4252 + {
4253 + unsigned long now = jiffies;
4254 +- unsigned int flush_delta = now - tbl->last_flush;
4255 +- unsigned int rand_delta = now - tbl->last_rand;
4256 ++ long flush_delta = now - tbl->last_flush;
4257 ++ long rand_delta = now - tbl->last_rand;
4258 + struct neigh_hash_table *nht;
4259 + struct ndt_config ndc = {
4260 + .ndtc_key_len = tbl->key_len,
4261 +diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
4262 +index 6183730d38db..e728dae467c3 100644
4263 +--- a/net/ieee802154/6lowpan/reassembly.c
4264 ++++ b/net/ieee802154/6lowpan/reassembly.c
4265 +@@ -634,7 +634,7 @@ err_sysctl:
4266 +
4267 + void lowpan_net_frag_exit(void)
4268 + {
4269 +- inet_frags_fini(&lowpan_frags);
4270 + lowpan_frags_sysctl_unregister();
4271 + unregister_pernet_subsys(&lowpan_frags_ops);
4272 ++ inet_frags_fini(&lowpan_frags);
4273 + }
4274 +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
4275 +index 91ae061d46ac..e598aa14f167 100644
4276 +--- a/net/ipv4/ip_tunnel.c
4277 ++++ b/net/ipv4/ip_tunnel.c
4278 +@@ -1151,10 +1151,8 @@ int ip_tunnel_init(struct net_device *dev)
4279 + iph->version = 4;
4280 + iph->ihl = 5;
4281 +
4282 +- if (tunnel->collect_md) {
4283 +- dev->features |= NETIF_F_NETNS_LOCAL;
4284 ++ if (tunnel->collect_md)
4285 + netif_keep_dst(dev);
4286 +- }
4287 + return 0;
4288 + }
4289 + EXPORT_SYMBOL_GPL(ip_tunnel_init);
4290 +diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
4291 +index ec917f58d105..17e9ed2edb86 100644
4292 +--- a/net/ipv6/reassembly.c
4293 ++++ b/net/ipv6/reassembly.c
4294 +@@ -774,8 +774,8 @@ err_protocol:
4295 +
4296 + void ipv6_frag_exit(void)
4297 + {
4298 +- inet_frags_fini(&ip6_frags);
4299 + ip6_frags_sysctl_unregister();
4300 + unregister_pernet_subsys(&ip6_frags_ops);
4301 + inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
4302 ++ inet_frags_fini(&ip6_frags);
4303 + }
4304 +diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
4305 +index 5984cc35d508..3edffb7bf2a4 100644
4306 +--- a/net/iucv/af_iucv.c
4307 ++++ b/net/iucv/af_iucv.c
4308 +@@ -2392,6 +2392,13 @@ out:
4309 + return err;
4310 + }
4311 +
4312 ++static void afiucv_iucv_exit(void)
4313 ++{
4314 ++ device_unregister(af_iucv_dev);
4315 ++ driver_unregister(&af_iucv_driver);
4316 ++ pr_iucv->iucv_unregister(&af_iucv_handler, 0);
4317 ++}
4318 ++
4319 + static int __init afiucv_init(void)
4320 + {
4321 + int err;
4322 +@@ -2425,11 +2432,18 @@ static int __init afiucv_init(void)
4323 + err = afiucv_iucv_init();
4324 + if (err)
4325 + goto out_sock;
4326 +- } else
4327 +- register_netdevice_notifier(&afiucv_netdev_notifier);
4328 ++ }
4329 ++
4330 ++ err = register_netdevice_notifier(&afiucv_netdev_notifier);
4331 ++ if (err)
4332 ++ goto out_notifier;
4333 ++
4334 + dev_add_pack(&iucv_packet_type);
4335 + return 0;
4336 +
4337 ++out_notifier:
4338 ++ if (pr_iucv)
4339 ++ afiucv_iucv_exit();
4340 + out_sock:
4341 + sock_unregister(PF_IUCV);
4342 + out_proto:
4343 +@@ -2443,12 +2457,11 @@ out:
4344 + static void __exit afiucv_exit(void)
4345 + {
4346 + if (pr_iucv) {
4347 +- device_unregister(af_iucv_dev);
4348 +- driver_unregister(&af_iucv_driver);
4349 +- pr_iucv->iucv_unregister(&af_iucv_handler, 0);
4350 ++ afiucv_iucv_exit();
4351 + symbol_put(iucv_if);
4352 +- } else
4353 +- unregister_netdevice_notifier(&afiucv_netdev_notifier);
4354 ++ }
4355 ++
4356 ++ unregister_netdevice_notifier(&afiucv_netdev_notifier);
4357 + dev_remove_pack(&iucv_packet_type);
4358 + sock_unregister(PF_IUCV);
4359 + proto_unregister(&iucv_proto);
4360 +diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
4361 +index c153fc2883a8..69f1558dfcb7 100644
4362 +--- a/net/llc/af_llc.c
4363 ++++ b/net/llc/af_llc.c
4364 +@@ -111,22 +111,26 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr)
4365 + *
4366 + * Send data via reliable llc2 connection.
4367 + * Returns 0 upon success, non-zero if action did not succeed.
4368 ++ *
4369 ++ * This function always consumes a reference to the skb.
4370 + */
4371 + static int llc_ui_send_data(struct sock* sk, struct sk_buff *skb, int noblock)
4372 + {
4373 + struct llc_sock* llc = llc_sk(sk);
4374 +- int rc = 0;
4375 +
4376 + if (unlikely(llc_data_accept_state(llc->state) ||
4377 + llc->remote_busy_flag ||
4378 + llc->p_flag)) {
4379 + long timeout = sock_sndtimeo(sk, noblock);
4380 ++ int rc;
4381 +
4382 + rc = llc_ui_wait_for_busy_core(sk, timeout);
4383 ++ if (rc) {
4384 ++ kfree_skb(skb);
4385 ++ return rc;
4386 ++ }
4387 + }
4388 +- if (unlikely(!rc))
4389 +- rc = llc_build_and_send_pkt(sk, skb);
4390 +- return rc;
4391 ++ return llc_build_and_send_pkt(sk, skb);
4392 + }
4393 +
4394 + static void llc_ui_sk_init(struct socket *sock, struct sock *sk)
4395 +@@ -896,7 +900,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
4396 + DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name);
4397 + int flags = msg->msg_flags;
4398 + int noblock = flags & MSG_DONTWAIT;
4399 +- struct sk_buff *skb;
4400 ++ struct sk_buff *skb = NULL;
4401 + size_t size = 0;
4402 + int rc = -EINVAL, copied = 0, hdrlen;
4403 +
4404 +@@ -905,10 +909,10 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
4405 + lock_sock(sk);
4406 + if (addr) {
4407 + if (msg->msg_namelen < sizeof(*addr))
4408 +- goto release;
4409 ++ goto out;
4410 + } else {
4411 + if (llc_ui_addr_null(&llc->addr))
4412 +- goto release;
4413 ++ goto out;
4414 + addr = &llc->addr;
4415 + }
4416 + /* must bind connection to sap if user hasn't done it. */
4417 +@@ -916,7 +920,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
4418 + /* bind to sap with null dev, exclusive. */
4419 + rc = llc_ui_autobind(sock, addr);
4420 + if (rc)
4421 +- goto release;
4422 ++ goto out;
4423 + }
4424 + hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr);
4425 + size = hdrlen + len;
4426 +@@ -925,12 +929,12 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
4427 + copied = size - hdrlen;
4428 + rc = -EINVAL;
4429 + if (copied < 0)
4430 +- goto release;
4431 ++ goto out;
4432 + release_sock(sk);
4433 + skb = sock_alloc_send_skb(sk, size, noblock, &rc);
4434 + lock_sock(sk);
4435 + if (!skb)
4436 +- goto release;
4437 ++ goto out;
4438 + skb->dev = llc->dev;
4439 + skb->protocol = llc_proto_type(addr->sllc_arphrd);
4440 + skb_reserve(skb, hdrlen);
4441 +@@ -940,29 +944,31 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
4442 + if (sk->sk_type == SOCK_DGRAM || addr->sllc_ua) {
4443 + llc_build_and_send_ui_pkt(llc->sap, skb, addr->sllc_mac,
4444 + addr->sllc_sap);
4445 ++ skb = NULL;
4446 + goto out;
4447 + }
4448 + if (addr->sllc_test) {
4449 + llc_build_and_send_test_pkt(llc->sap, skb, addr->sllc_mac,
4450 + addr->sllc_sap);
4451 ++ skb = NULL;
4452 + goto out;
4453 + }
4454 + if (addr->sllc_xid) {
4455 + llc_build_and_send_xid_pkt(llc->sap, skb, addr->sllc_mac,
4456 + addr->sllc_sap);
4457 ++ skb = NULL;
4458 + goto out;
4459 + }
4460 + rc = -ENOPROTOOPT;
4461 + if (!(sk->sk_type == SOCK_STREAM && !addr->sllc_ua))
4462 + goto out;
4463 + rc = llc_ui_send_data(sk, skb, noblock);
4464 ++ skb = NULL;
4465 + out:
4466 +- if (rc) {
4467 +- kfree_skb(skb);
4468 +-release:
4469 ++ kfree_skb(skb);
4470 ++ if (rc)
4471 + dprintk("%s: failed sending from %02X to %02X: %d\n",
4472 + __func__, llc->laddr.lsap, llc->daddr.lsap, rc);
4473 +- }
4474 + release_sock(sk);
4475 + return rc ? : copied;
4476 + }
4477 +diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
4478 +index d861b74ad068..3b002ab68b29 100644
4479 +--- a/net/llc/llc_conn.c
4480 ++++ b/net/llc/llc_conn.c
4481 +@@ -55,6 +55,8 @@ int sysctl_llc2_busy_timeout = LLC2_BUSY_TIME * HZ;
4482 + * (executing it's actions and changing state), upper layer will be
4483 + * indicated or confirmed, if needed. Returns 0 for success, 1 for
4484 + * failure. The socket lock has to be held before calling this function.
4485 ++ *
4486 ++ * This function always consumes a reference to the skb.
4487 + */
4488 + int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
4489 + {
4490 +@@ -62,12 +64,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
4491 + struct llc_sock *llc = llc_sk(skb->sk);
4492 + struct llc_conn_state_ev *ev = llc_conn_ev(skb);
4493 +
4494 +- /*
4495 +- * We have to hold the skb, because llc_conn_service will kfree it in
4496 +- * the sending path and we need to look at the skb->cb, where we encode
4497 +- * llc_conn_state_ev.
4498 +- */
4499 +- skb_get(skb);
4500 + ev->ind_prim = ev->cfm_prim = 0;
4501 + /*
4502 + * Send event to state machine
4503 +@@ -75,21 +71,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
4504 + rc = llc_conn_service(skb->sk, skb);
4505 + if (unlikely(rc != 0)) {
4506 + printk(KERN_ERR "%s: llc_conn_service failed\n", __func__);
4507 +- goto out_kfree_skb;
4508 +- }
4509 +-
4510 +- if (unlikely(!ev->ind_prim && !ev->cfm_prim)) {
4511 +- /* indicate or confirm not required */
4512 +- if (!skb->next)
4513 +- goto out_kfree_skb;
4514 + goto out_skb_put;
4515 + }
4516 +
4517 +- if (unlikely(ev->ind_prim && ev->cfm_prim)) /* Paranoia */
4518 +- skb_get(skb);
4519 +-
4520 + switch (ev->ind_prim) {
4521 + case LLC_DATA_PRIM:
4522 ++ skb_get(skb);
4523 + llc_save_primitive(sk, skb, LLC_DATA_PRIM);
4524 + if (unlikely(sock_queue_rcv_skb(sk, skb))) {
4525 + /*
4526 +@@ -106,6 +93,7 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
4527 + * skb->sk pointing to the newly created struct sock in
4528 + * llc_conn_handler. -acme
4529 + */
4530 ++ skb_get(skb);
4531 + skb_queue_tail(&sk->sk_receive_queue, skb);
4532 + sk->sk_state_change(sk);
4533 + break;
4534 +@@ -121,7 +109,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
4535 + sk->sk_state_change(sk);
4536 + }
4537 + }
4538 +- kfree_skb(skb);
4539 + sock_put(sk);
4540 + break;
4541 + case LLC_RESET_PRIM:
4542 +@@ -130,14 +117,11 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
4543 + * RESET is not being notified to upper layers for now
4544 + */
4545 + printk(KERN_INFO "%s: received a reset ind!\n", __func__);
4546 +- kfree_skb(skb);
4547 + break;
4548 + default:
4549 +- if (ev->ind_prim) {
4550 ++ if (ev->ind_prim)
4551 + printk(KERN_INFO "%s: received unknown %d prim!\n",
4552 + __func__, ev->ind_prim);
4553 +- kfree_skb(skb);
4554 +- }
4555 + /* No indication */
4556 + break;
4557 + }
4558 +@@ -179,15 +163,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
4559 + printk(KERN_INFO "%s: received a reset conf!\n", __func__);
4560 + break;
4561 + default:
4562 +- if (ev->cfm_prim) {
4563 ++ if (ev->cfm_prim)
4564 + printk(KERN_INFO "%s: received unknown %d prim!\n",
4565 + __func__, ev->cfm_prim);
4566 +- break;
4567 +- }
4568 +- goto out_skb_put; /* No confirmation */
4569 ++ /* No confirmation */
4570 ++ break;
4571 + }
4572 +-out_kfree_skb:
4573 +- kfree_skb(skb);
4574 + out_skb_put:
4575 + kfree_skb(skb);
4576 + return rc;
4577 +diff --git a/net/llc/llc_if.c b/net/llc/llc_if.c
4578 +index 6daf391b3e84..fc4d2bd8816f 100644
4579 +--- a/net/llc/llc_if.c
4580 ++++ b/net/llc/llc_if.c
4581 +@@ -38,6 +38,8 @@
4582 + * closed and -EBUSY when sending data is not permitted in this state or
4583 + * LLC has send an I pdu with p bit set to 1 and is waiting for it's
4584 + * response.
4585 ++ *
4586 ++ * This function always consumes a reference to the skb.
4587 + */
4588 + int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
4589 + {
4590 +@@ -46,20 +48,22 @@ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
4591 + struct llc_sock *llc = llc_sk(sk);
4592 +
4593 + if (unlikely(llc->state == LLC_CONN_STATE_ADM))
4594 +- goto out;
4595 ++ goto out_free;
4596 + rc = -EBUSY;
4597 + if (unlikely(llc_data_accept_state(llc->state) || /* data_conn_refuse */
4598 + llc->p_flag)) {
4599 + llc->failed_data_req = 1;
4600 +- goto out;
4601 ++ goto out_free;
4602 + }
4603 + ev = llc_conn_ev(skb);
4604 + ev->type = LLC_CONN_EV_TYPE_PRIM;
4605 + ev->prim = LLC_DATA_PRIM;
4606 + ev->prim_type = LLC_PRIM_TYPE_REQ;
4607 + skb->dev = llc->dev;
4608 +- rc = llc_conn_state_process(sk, skb);
4609 +-out:
4610 ++ return llc_conn_state_process(sk, skb);
4611 ++
4612 ++out_free:
4613 ++ kfree_skb(skb);
4614 + return rc;
4615 + }
4616 +
4617 +diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
4618 +index ff3b28e7dbce..fb44f0107da1 100644
4619 +--- a/net/mac80211/rc80211_minstrel_ht.c
4620 ++++ b/net/mac80211/rc80211_minstrel_ht.c
4621 +@@ -546,7 +546,7 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
4622 +
4623 + /* (re)Initialize group rate indexes */
4624 + for(j = 0; j < MAX_THR_RATES; j++)
4625 +- tmp_group_tp_rate[j] = group;
4626 ++ tmp_group_tp_rate[j] = MCS_GROUP_RATES * group;
4627 +
4628 + for (i = 0; i < MCS_GROUP_RATES; i++) {
4629 + if (!(mg->supported & BIT(i)))
4630 +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
4631 +index 3b8e2f97d815..2b7975c4dac7 100644
4632 +--- a/net/mac80211/rx.c
4633 ++++ b/net/mac80211/rx.c
4634 +@@ -3040,9 +3040,18 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
4635 + case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
4636 + /* process for all: mesh, mlme, ibss */
4637 + break;
4638 ++ case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
4639 ++ if (is_multicast_ether_addr(mgmt->da) &&
4640 ++ !is_broadcast_ether_addr(mgmt->da))
4641 ++ return RX_DROP_MONITOR;
4642 ++
4643 ++ /* process only for station/IBSS */
4644 ++ if (sdata->vif.type != NL80211_IFTYPE_STATION &&
4645 ++ sdata->vif.type != NL80211_IFTYPE_ADHOC)
4646 ++ return RX_DROP_MONITOR;
4647 ++ break;
4648 + case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
4649 + case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
4650 +- case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
4651 + case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
4652 + if (is_multicast_ether_addr(mgmt->da) &&
4653 + !is_broadcast_ether_addr(mgmt->da))
4654 +diff --git a/net/netfilter/ipset/ip_set_bitmap_gen.h b/net/netfilter/ipset/ip_set_bitmap_gen.h
4655 +index adc703ccd68b..7d08a170ac27 100644
4656 +--- a/net/netfilter/ipset/ip_set_bitmap_gen.h
4657 ++++ b/net/netfilter/ipset/ip_set_bitmap_gen.h
4658 +@@ -81,7 +81,7 @@ mtype_flush(struct ip_set *set)
4659 +
4660 + if (set->extensions & IPSET_EXT_DESTROY)
4661 + mtype_ext_cleanup(set);
4662 +- memset(map->members, 0, map->memsize);
4663 ++ bitmap_zero(map->members, map->elements);
4664 + }
4665 +
4666 + static int
4667 +diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
4668 +index 4783efff0bde..a4c104a4977f 100644
4669 +--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
4670 ++++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
4671 +@@ -40,7 +40,7 @@ MODULE_ALIAS("ip_set_bitmap:ip");
4672 +
4673 + /* Type structure */
4674 + struct bitmap_ip {
4675 +- void *members; /* the set members */
4676 ++ unsigned long *members; /* the set members */
4677 + u32 first_ip; /* host byte order, included in range */
4678 + u32 last_ip; /* host byte order, included in range */
4679 + u32 elements; /* number of max elements in the set */
4680 +@@ -222,7 +222,7 @@ init_map_ip(struct ip_set *set, struct bitmap_ip *map,
4681 + u32 first_ip, u32 last_ip,
4682 + u32 elements, u32 hosts, u8 netmask)
4683 + {
4684 +- map->members = ip_set_alloc(map->memsize);
4685 ++ map->members = bitmap_zalloc(elements, GFP_KERNEL | __GFP_NOWARN);
4686 + if (!map->members)
4687 + return false;
4688 + map->first_ip = first_ip;
4689 +@@ -315,7 +315,7 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
4690 + if (!map)
4691 + return -ENOMEM;
4692 +
4693 +- map->memsize = bitmap_bytes(0, elements - 1);
4694 ++ map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);
4695 + set->variant = &bitmap_ip;
4696 + if (!init_map_ip(set, map, first_ip, last_ip,
4697 + elements, hosts, netmask)) {
4698 +diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
4699 +index 29dde208381d..0e961690510d 100644
4700 +--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
4701 ++++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
4702 +@@ -46,7 +46,7 @@ enum {
4703 +
4704 + /* Type structure */
4705 + struct bitmap_ipmac {
4706 +- void *members; /* the set members */
4707 ++ unsigned long *members; /* the set members */
4708 + u32 first_ip; /* host byte order, included in range */
4709 + u32 last_ip; /* host byte order, included in range */
4710 + u32 elements; /* number of max elements in the set */
4711 +@@ -297,7 +297,7 @@ static bool
4712 + init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
4713 + u32 first_ip, u32 last_ip, u32 elements)
4714 + {
4715 +- map->members = ip_set_alloc(map->memsize);
4716 ++ map->members = bitmap_zalloc(elements, GFP_KERNEL | __GFP_NOWARN);
4717 + if (!map->members)
4718 + return false;
4719 + map->first_ip = first_ip;
4720 +@@ -361,7 +361,7 @@ bitmap_ipmac_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
4721 + if (!map)
4722 + return -ENOMEM;
4723 +
4724 +- map->memsize = bitmap_bytes(0, elements - 1);
4725 ++ map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);
4726 + set->variant = &bitmap_ipmac;
4727 + if (!init_map_ipmac(set, map, first_ip, last_ip, elements)) {
4728 + kfree(map);
4729 +diff --git a/net/netfilter/ipset/ip_set_bitmap_port.c b/net/netfilter/ipset/ip_set_bitmap_port.c
4730 +index 7f0c733358a4..6771b362a123 100644
4731 +--- a/net/netfilter/ipset/ip_set_bitmap_port.c
4732 ++++ b/net/netfilter/ipset/ip_set_bitmap_port.c
4733 +@@ -34,7 +34,7 @@ MODULE_ALIAS("ip_set_bitmap:port");
4734 +
4735 + /* Type structure */
4736 + struct bitmap_port {
4737 +- void *members; /* the set members */
4738 ++ unsigned long *members; /* the set members */
4739 + u16 first_port; /* host byte order, included in range */
4740 + u16 last_port; /* host byte order, included in range */
4741 + u32 elements; /* number of max elements in the set */
4742 +@@ -207,7 +207,7 @@ static bool
4743 + init_map_port(struct ip_set *set, struct bitmap_port *map,
4744 + u16 first_port, u16 last_port)
4745 + {
4746 +- map->members = ip_set_alloc(map->memsize);
4747 ++ map->members = bitmap_zalloc(map->elements, GFP_KERNEL | __GFP_NOWARN);
4748 + if (!map->members)
4749 + return false;
4750 + map->first_port = first_port;
4751 +@@ -250,7 +250,7 @@ bitmap_port_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
4752 + return -ENOMEM;
4753 +
4754 + map->elements = elements;
4755 +- map->memsize = bitmap_bytes(0, map->elements);
4756 ++ map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);
4757 + set->variant = &bitmap_port;
4758 + if (!init_map_port(set, map, first_port, last_port)) {
4759 + kfree(map);
4760 +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
4761 +index 8b277658905f..eac6f7eea7b5 100644
4762 +--- a/net/packet/af_packet.c
4763 ++++ b/net/packet/af_packet.c
4764 +@@ -1332,15 +1332,21 @@ static void packet_sock_destruct(struct sock *sk)
4765 +
4766 + static bool fanout_flow_is_huge(struct packet_sock *po, struct sk_buff *skb)
4767 + {
4768 +- u32 rxhash;
4769 ++ u32 *history = po->rollover->history;
4770 ++ u32 victim, rxhash;
4771 + int i, count = 0;
4772 +
4773 + rxhash = skb_get_hash(skb);
4774 + for (i = 0; i < ROLLOVER_HLEN; i++)
4775 +- if (po->rollover->history[i] == rxhash)
4776 ++ if (READ_ONCE(history[i]) == rxhash)
4777 + count++;
4778 +
4779 +- po->rollover->history[prandom_u32() % ROLLOVER_HLEN] = rxhash;
4780 ++ victim = prandom_u32() % ROLLOVER_HLEN;
4781 ++
4782 ++ /* Avoid dirtying the cache line if possible */
4783 ++ if (READ_ONCE(history[victim]) != rxhash)
4784 ++ WRITE_ONCE(history[victim], rxhash);
4785 ++
4786 + return count > (ROLLOVER_HLEN >> 1);
4787 + }
4788 +
4789 +@@ -3309,20 +3315,29 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
4790 + sock_recv_ts_and_drops(msg, sk, skb);
4791 +
4792 + if (msg->msg_name) {
4793 ++ int copy_len;
4794 ++
4795 + /* If the address length field is there to be filled
4796 + * in, we fill it in now.
4797 + */
4798 + if (sock->type == SOCK_PACKET) {
4799 + __sockaddr_check_size(sizeof(struct sockaddr_pkt));
4800 + msg->msg_namelen = sizeof(struct sockaddr_pkt);
4801 ++ copy_len = msg->msg_namelen;
4802 + } else {
4803 + struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
4804 +
4805 + msg->msg_namelen = sll->sll_halen +
4806 + offsetof(struct sockaddr_ll, sll_addr);
4807 ++ copy_len = msg->msg_namelen;
4808 ++ if (msg->msg_namelen < sizeof(struct sockaddr_ll)) {
4809 ++ memset(msg->msg_name +
4810 ++ offsetof(struct sockaddr_ll, sll_addr),
4811 ++ 0, sizeof(sll->sll_addr));
4812 ++ msg->msg_namelen = sizeof(struct sockaddr_ll);
4813 ++ }
4814 + }
4815 +- memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
4816 +- msg->msg_namelen);
4817 ++ memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
4818 + }
4819 +
4820 + if (pkt_sk(sk)->auxdata) {
4821 +diff --git a/net/rds/ib_stats.c b/net/rds/ib_stats.c
4822 +index d77e04473056..a88460058185 100644
4823 +--- a/net/rds/ib_stats.c
4824 ++++ b/net/rds/ib_stats.c
4825 +@@ -42,7 +42,7 @@ DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_ib_statistics, rds_ib_stats);
4826 + static const char *const rds_ib_stat_names[] = {
4827 + "ib_connect_raced",
4828 + "ib_listen_closed_stale",
4829 +- "s_ib_evt_handler_call",
4830 ++ "ib_evt_handler_call",
4831 + "ib_tasklet_call",
4832 + "ib_tx_cq_event",
4833 + "ib_tx_ring_full",
4834 +diff --git a/net/sched/ematch.c b/net/sched/ematch.c
4835 +index fbb7ebfc58c6..b0b04b3c0896 100644
4836 +--- a/net/sched/ematch.c
4837 ++++ b/net/sched/ematch.c
4838 +@@ -267,12 +267,12 @@ static int tcf_em_validate(struct tcf_proto *tp,
4839 + }
4840 + em->data = (unsigned long) v;
4841 + }
4842 ++ em->datalen = data_len;
4843 + }
4844 + }
4845 +
4846 + em->matchid = em_hdr->matchid;
4847 + em->flags = em_hdr->flags;
4848 +- em->datalen = data_len;
4849 + em->net = net;
4850 +
4851 + err = 0;
4852 +diff --git a/net/tipc/sysctl.c b/net/tipc/sysctl.c
4853 +index 1a779b1e8510..40f6d82083d7 100644
4854 +--- a/net/tipc/sysctl.c
4855 ++++ b/net/tipc/sysctl.c
4856 +@@ -37,6 +37,8 @@
4857 +
4858 + #include <linux/sysctl.h>
4859 +
4860 ++static int zero;
4861 ++static int one = 1;
4862 + static struct ctl_table_header *tipc_ctl_hdr;
4863 +
4864 + static struct ctl_table tipc_table[] = {
4865 +@@ -45,14 +47,16 @@ static struct ctl_table tipc_table[] = {
4866 + .data = &sysctl_tipc_rmem,
4867 + .maxlen = sizeof(sysctl_tipc_rmem),
4868 + .mode = 0644,
4869 +- .proc_handler = proc_dointvec,
4870 ++ .proc_handler = proc_dointvec_minmax,
4871 ++ .extra1 = &one,
4872 + },
4873 + {
4874 + .procname = "named_timeout",
4875 + .data = &sysctl_tipc_named_timeout,
4876 + .maxlen = sizeof(sysctl_tipc_named_timeout),
4877 + .mode = 0644,
4878 +- .proc_handler = proc_dointvec,
4879 ++ .proc_handler = proc_dointvec_minmax,
4880 ++ .extra1 = &zero,
4881 + },
4882 + {}
4883 + };
4884 +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
4885 +index f330475a87ff..f9fb8613fb28 100644
4886 +--- a/net/x25/af_x25.c
4887 ++++ b/net/x25/af_x25.c
4888 +@@ -764,6 +764,10 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
4889 + if (sk->sk_state == TCP_ESTABLISHED)
4890 + goto out;
4891 +
4892 ++ rc = -EALREADY; /* Do nothing if call is already in progress */
4893 ++ if (sk->sk_state == TCP_SYN_SENT)
4894 ++ goto out;
4895 ++
4896 + sk->sk_state = TCP_CLOSE;
4897 + sock->state = SS_UNCONNECTED;
4898 +
4899 +@@ -810,7 +814,7 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
4900 + /* Now the loop */
4901 + rc = -EINPROGRESS;
4902 + if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK))
4903 +- goto out_put_neigh;
4904 ++ goto out;
4905 +
4906 + rc = x25_wait_for_connection_establishment(sk);
4907 + if (rc)
4908 +diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
4909 +index 42396a74405d..7250fb38350c 100644
4910 +--- a/scripts/recordmcount.c
4911 ++++ b/scripts/recordmcount.c
4912 +@@ -53,6 +53,10 @@
4913 + #define R_AARCH64_ABS64 257
4914 + #endif
4915 +
4916 ++#define R_ARM_PC24 1
4917 ++#define R_ARM_THM_CALL 10
4918 ++#define R_ARM_CALL 28
4919 ++
4920 + static int fd_map; /* File descriptor for file being modified. */
4921 + static int mmap_failed; /* Boolean flag. */
4922 + static char gpfx; /* prefix for global symbol name (sometimes '_') */
4923 +@@ -372,6 +376,18 @@ is_mcounted_section_name(char const *const txtname)
4924 + #define RECORD_MCOUNT_64
4925 + #include "recordmcount.h"
4926 +
4927 ++static int arm_is_fake_mcount(Elf32_Rel const *rp)
4928 ++{
4929 ++ switch (ELF32_R_TYPE(w(rp->r_info))) {
4930 ++ case R_ARM_THM_CALL:
4931 ++ case R_ARM_CALL:
4932 ++ case R_ARM_PC24:
4933 ++ return 0;
4934 ++ }
4935 ++
4936 ++ return 1;
4937 ++}
4938 ++
4939 + /* 64-bit EM_MIPS has weird ELF64_Rela.r_info.
4940 + * http://techpubs.sgi.com/library/manuals/4000/007-4658-001/pdf/007-4658-001.pdf
4941 + * We interpret Table 29 Relocation Operation (Elf64_Rel, Elf64_Rela) [p.40]
4942 +@@ -461,6 +477,7 @@ do_file(char const *const fname)
4943 + break;
4944 + case EM_ARM: reltype = R_ARM_ABS32;
4945 + altmcount = "__gnu_mcount_nc";
4946 ++ is_fake_mcount32 = arm_is_fake_mcount;
4947 + break;
4948 + case EM_AARCH64:
4949 + reltype = R_AARCH64_ABS64;
4950 +diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
4951 +index a04edff8b729..ae50d59fb810 100644
4952 +--- a/sound/aoa/codecs/onyx.c
4953 ++++ b/sound/aoa/codecs/onyx.c
4954 +@@ -74,8 +74,10 @@ static int onyx_read_register(struct onyx *onyx, u8 reg, u8 *value)
4955 + return 0;
4956 + }
4957 + v = i2c_smbus_read_byte_data(onyx->i2c, reg);
4958 +- if (v < 0)
4959 ++ if (v < 0) {
4960 ++ *value = 0;
4961 + return -1;
4962 ++ }
4963 + *value = (u8)v;
4964 + onyx->cache[ONYX_REG_CONTROL-FIRSTREGISTER] = *value;
4965 + return 0;
4966 +diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
4967 +index 55ec4470f6b6..499873d29cc1 100644
4968 +--- a/sound/pci/hda/hda_controller.h
4969 ++++ b/sound/pci/hda/hda_controller.h
4970 +@@ -164,11 +164,10 @@ struct azx {
4971 + #define azx_bus(chip) (&(chip)->bus.core)
4972 + #define bus_to_azx(_bus) container_of(_bus, struct azx, bus.core)
4973 +
4974 +-#ifdef CONFIG_X86
4975 +-#define azx_snoop(chip) ((chip)->snoop)
4976 +-#else
4977 +-#define azx_snoop(chip) true
4978 +-#endif
4979 ++static inline bool azx_snoop(struct azx *chip)
4980 ++{
4981 ++ return !IS_ENABLED(CONFIG_X86) || chip->snoop;
4982 ++}
4983 +
4984 + /*
4985 + * macros for easy use
4986 +diff --git a/sound/soc/codecs/cs4349.c b/sound/soc/codecs/cs4349.c
4987 +index 0ac8fc5ed4ae..9ebd500ecf38 100644
4988 +--- a/sound/soc/codecs/cs4349.c
4989 ++++ b/sound/soc/codecs/cs4349.c
4990 +@@ -379,6 +379,7 @@ static struct i2c_driver cs4349_i2c_driver = {
4991 + .driver = {
4992 + .name = "cs4349",
4993 + .of_match_table = cs4349_of_match,
4994 ++ .pm = &cs4349_runtime_pm,
4995 + },
4996 + .id_table = cs4349_i2c_id,
4997 + .probe = cs4349_i2c_probe,
4998 +diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
4999 +index afa6c5db9dcc..2bf30d0eb82f 100644
5000 +--- a/sound/soc/codecs/es8328.c
5001 ++++ b/sound/soc/codecs/es8328.c
5002 +@@ -210,7 +210,7 @@ static const struct soc_enum es8328_rline_enum =
5003 + ARRAY_SIZE(es8328_line_texts),
5004 + es8328_line_texts);
5005 + static const struct snd_kcontrol_new es8328_right_line_controls =
5006 +- SOC_DAPM_ENUM("Route", es8328_lline_enum);
5007 ++ SOC_DAPM_ENUM("Route", es8328_rline_enum);
5008 +
5009 + /* Left Mixer */
5010 + static const struct snd_kcontrol_new es8328_left_mixer_controls[] = {
5011 +diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
5012 +index e7807601e675..ae69cb790ac3 100644
5013 +--- a/sound/soc/codecs/wm8737.c
5014 ++++ b/sound/soc/codecs/wm8737.c
5015 +@@ -170,7 +170,7 @@ SOC_DOUBLE("Polarity Invert Switch", WM8737_ADC_CONTROL, 5, 6, 1, 0),
5016 + SOC_SINGLE("3D Switch", WM8737_3D_ENHANCE, 0, 1, 0),
5017 + SOC_SINGLE("3D Depth", WM8737_3D_ENHANCE, 1, 15, 0),
5018 + SOC_ENUM("3D Low Cut-off", low_3d),
5019 +-SOC_ENUM("3D High Cut-off", low_3d),
5020 ++SOC_ENUM("3D High Cut-off", high_3d),
5021 + SOC_SINGLE_TLV("3D ADC Volume", WM8737_3D_ENHANCE, 7, 1, 1, adc_tlv),
5022 +
5023 + SOC_SINGLE("Noise Gate Switch", WM8737_NOISE_GATE, 0, 1, 0),
5024 +diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
5025 +index 2f7be6cee98e..fc0a73227b02 100644
5026 +--- a/sound/soc/davinci/davinci-mcasp.c
5027 ++++ b/sound/soc/davinci/davinci-mcasp.c
5028 +@@ -875,14 +875,13 @@ static int mcasp_i2s_hw_param(struct davinci_mcasp *mcasp, int stream,
5029 + active_slots = hweight32(mcasp->tdm_mask[stream]);
5030 + active_serializers = (channels + active_slots - 1) /
5031 + active_slots;
5032 +- if (active_serializers == 1) {
5033 ++ if (active_serializers == 1)
5034 + active_slots = channels;
5035 +- for (i = 0; i < total_slots; i++) {
5036 +- if ((1 << i) & mcasp->tdm_mask[stream]) {
5037 +- mask |= (1 << i);
5038 +- if (--active_slots <= 0)
5039 +- break;
5040 +- }
5041 ++ for (i = 0; i < total_slots; i++) {
5042 ++ if ((1 << i) & mcasp->tdm_mask[stream]) {
5043 ++ mask |= (1 << i);
5044 ++ if (--active_slots <= 0)
5045 ++ break;
5046 + }
5047 + }
5048 + } else {
5049 +diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
5050 +index 8e525f7ac08d..3d99a8579c99 100644
5051 +--- a/sound/soc/fsl/imx-sgtl5000.c
5052 ++++ b/sound/soc/fsl/imx-sgtl5000.c
5053 +@@ -119,7 +119,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
5054 + codec_dev = of_find_i2c_device_by_node(codec_np);
5055 + if (!codec_dev) {
5056 + dev_err(&pdev->dev, "failed to find codec platform device\n");
5057 +- return -EPROBE_DEFER;
5058 ++ ret = -EPROBE_DEFER;
5059 ++ goto fail;
5060 + }
5061 +
5062 + data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
5063 +diff --git a/sound/soc/qcom/apq8016_sbc.c b/sound/soc/qcom/apq8016_sbc.c
5064 +index 1efdf0088ecd..886f2027e671 100644
5065 +--- a/sound/soc/qcom/apq8016_sbc.c
5066 ++++ b/sound/soc/qcom/apq8016_sbc.c
5067 +@@ -98,13 +98,15 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
5068 +
5069 + if (!cpu || !codec) {
5070 + dev_err(dev, "Can't find cpu/codec DT node\n");
5071 +- return ERR_PTR(-EINVAL);
5072 ++ ret = -EINVAL;
5073 ++ goto error;
5074 + }
5075 +
5076 + link->cpu_of_node = of_parse_phandle(cpu, "sound-dai", 0);
5077 + if (!link->cpu_of_node) {
5078 + dev_err(card->dev, "error getting cpu phandle\n");
5079 +- return ERR_PTR(-EINVAL);
5080 ++ ret = -EINVAL;
5081 ++ goto error;
5082 + }
5083 +
5084 + link->codec_of_node = of_parse_phandle(codec, "sound-dai", 0);
5085 +@@ -116,13 +118,13 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
5086 + ret = snd_soc_of_get_dai_name(cpu, &link->cpu_dai_name);
5087 + if (ret) {
5088 + dev_err(card->dev, "error getting cpu dai name\n");
5089 +- return ERR_PTR(ret);
5090 ++ goto error;
5091 + }
5092 +
5093 + ret = snd_soc_of_get_dai_name(codec, &link->codec_dai_name);
5094 + if (ret) {
5095 + dev_err(card->dev, "error getting codec dai name\n");
5096 +- return ERR_PTR(ret);
5097 ++ goto error;
5098 + }
5099 +
5100 + link->platform_of_node = link->cpu_of_node;
5101 +@@ -132,15 +134,24 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
5102 + ret = of_property_read_string(np, "link-name", &link->name);
5103 + if (ret) {
5104 + dev_err(card->dev, "error getting codec dai_link name\n");
5105 +- return ERR_PTR(ret);
5106 ++ goto error;
5107 + }
5108 +
5109 + link->stream_name = link->name;
5110 + link->init = apq8016_sbc_dai_init;
5111 + link++;
5112 ++
5113 ++ of_node_put(cpu);
5114 ++ of_node_put(codec);
5115 + }
5116 +
5117 + return data;
5118 ++
5119 ++ error:
5120 ++ of_node_put(np);
5121 ++ of_node_put(cpu);
5122 ++ of_node_put(codec);
5123 ++ return ERR_PTR(ret);
5124 + }
5125 +
5126 + static int apq8016_sbc_platform_probe(struct platform_device *pdev)
5127 +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
5128 +index 78813057167d..dbdea1975f90 100644
5129 +--- a/sound/soc/soc-pcm.c
5130 ++++ b/sound/soc/soc-pcm.c
5131 +@@ -48,8 +48,8 @@ static bool snd_soc_dai_stream_valid(struct snd_soc_dai *dai, int stream)
5132 + else
5133 + codec_stream = &dai->driver->capture;
5134 +
5135 +- /* If the codec specifies any rate at all, it supports the stream. */
5136 +- return codec_stream->rates;
5137 ++ /* If the codec specifies any channels at all, it supports the stream */
5138 ++ return codec_stream->channels_min;
5139 + }
5140 +
5141 + /**
5142 +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
5143 +index 1b81f18010d2..73149b9be29c 100644
5144 +--- a/sound/usb/mixer.c
5145 ++++ b/sound/usb/mixer.c
5146 +@@ -2552,7 +2552,9 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
5147 + (err = snd_usb_mixer_status_create(mixer)) < 0)
5148 + goto _error;
5149 +
5150 +- snd_usb_mixer_apply_create_quirk(mixer);
5151 ++ err = snd_usb_mixer_apply_create_quirk(mixer);
5152 ++ if (err < 0)
5153 ++ goto _error;
5154 +
5155 + err = snd_device_new(chip->card, SNDRV_DEV_CODEC, mixer, &dev_ops);
5156 + if (err < 0)
5157 +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
5158 +index d32727c74a16..c892b4d1e733 100644
5159 +--- a/sound/usb/quirks-table.h
5160 ++++ b/sound/usb/quirks-table.h
5161 +@@ -3293,19 +3293,14 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
5162 + .ifnum = 0,
5163 + .type = QUIRK_AUDIO_STANDARD_MIXER,
5164 + },
5165 +- /* Capture */
5166 +- {
5167 +- .ifnum = 1,
5168 +- .type = QUIRK_IGNORE_INTERFACE,
5169 +- },
5170 + /* Playback */
5171 + {
5172 +- .ifnum = 2,
5173 ++ .ifnum = 1,
5174 + .type = QUIRK_AUDIO_FIXED_ENDPOINT,
5175 + .data = &(const struct audioformat) {
5176 + .formats = SNDRV_PCM_FMTBIT_S16_LE,
5177 + .channels = 2,
5178 +- .iface = 2,
5179 ++ .iface = 1,
5180 + .altsetting = 1,
5181 + .altset_idx = 1,
5182 + .attributes = UAC_EP_CS_ATTR_FILL_MAX |