[gentoo-commits] proj/linux-patches:4.9 commit in: /

[Mike Pagano]

commit:     5952a88ca812123bc877a705a09eca931b0da0be
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Sep 26 10:42:40 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Sep 26 10:42:40 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5952a88c

Linux patch 4.9.129

 0000_README              |    4 +
 1128_linux-4.9.129.patch | 2979 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 2983 insertions(+)

diff --git a/0000_README b/0000_README
index 582011b..cf72302 100644
--- a/0000_README
+++ b/0000_README
@@ -555,6 +555,10 @@ Patch:  1127_linux-4.9.128.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.128
 
+Patch:  1128_linux-4.9.129.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.129
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1128_linux-4.9.129.patch b/1128_linux-4.9.129.patch
new file mode 100644
index 0000000..4815392
--- /dev/null
+++ b/1128_linux-4.9.129.patch
@@ -0,0 +1,2979 @@
+diff --git a/Makefile b/Makefile
+index 1892bdb6a760..3f3c340374c5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 128
++SUBLEVEL = 129
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts b/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts
+index c0fb4a698c56..386b93c06a8c 100644
+--- a/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts
++++ b/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts
+@@ -188,6 +188,8 @@
+ 						regulator-max-microvolt = <2950000>;
+ 
+ 						regulator-boot-on;
++						regulator-system-load = <200000>;
++						regulator-allow-set-load;
+ 					};
+ 
+ 					l21 {
+diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c
+index 06332f626565..3e1430a886b2 100644
+--- a/arch/arm/mach-exynos/suspend.c
++++ b/arch/arm/mach-exynos/suspend.c
+@@ -252,6 +252,7 @@ static int __init exynos_pmu_irq_init(struct device_node *node,
+ 					  NULL);
+ 	if (!domain) {
+ 		iounmap(pmu_base_addr);
++		pmu_base_addr = NULL;
+ 		return -ENOMEM;
+ 	}
+ 
+diff --git a/arch/arm/mach-hisi/hotplug.c b/arch/arm/mach-hisi/hotplug.c
+index a129aae72602..909bb2493781 100644
+--- a/arch/arm/mach-hisi/hotplug.c
++++ b/arch/arm/mach-hisi/hotplug.c
+@@ -148,13 +148,20 @@ static int hi3xxx_hotplug_init(void)
+ 	struct device_node *node;
+ 
+ 	node = of_find_compatible_node(NULL, NULL, "hisilicon,sysctrl");
+-	if (node) {
+-		ctrl_base = of_iomap(node, 0);
+-		id = HI3620_CTRL;
+-		return 0;
++	if (!node) {
++		id = ERROR_CTRL;
++		return -ENOENT;
+ 	}
+-	id = ERROR_CTRL;
+-	return -ENOENT;
++
++	ctrl_base = of_iomap(node, 0);
++	of_node_put(node);
++	if (!ctrl_base) {
++		id = ERROR_CTRL;
++		return -ENOMEM;
++	}
++
++	id = HI3620_CTRL;
++	return 0;
+ }
+ 
+ void hi3xxx_set_cpu(int cpu, bool enable)
+@@ -173,11 +180,15 @@ static bool hix5hd2_hotplug_init(void)
+ 	struct device_node *np;
+ 
+ 	np = of_find_compatible_node(NULL, NULL, "hisilicon,cpuctrl");
+-	if (np) {
+-		ctrl_base = of_iomap(np, 0);
+-		return true;
+-	}
+-	return false;
++	if (!np)
++		return false;
++
++	ctrl_base = of_iomap(np, 0);
++	of_node_put(np);
++	if (!ctrl_base)
++		return false;
++
++	return true;
+ }
+ 
+ void hix5hd2_set_cpu(int cpu, bool enable)
+@@ -219,10 +230,10 @@ void hip01_set_cpu(int cpu, bool enable)
+ 
+ 	if (!ctrl_base) {
+ 		np = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl");
+-		if (np)
+-			ctrl_base = of_iomap(np, 0);
+-		else
+-			BUG();
++		BUG_ON(!np);
++		ctrl_base = of_iomap(np, 0);
++		of_node_put(np);
++		BUG_ON(!ctrl_base);
+ 	}
+ 
+ 	if (enable) {
+diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+index bb062b547110..601be6127628 100644
+--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+@@ -170,7 +170,7 @@
+ 			led@6 {
+ 				label = "apq8016-sbc:blue:bt";
+ 				gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>;
+-				linux,default-trigger = "bt";
++				linux,default-trigger = "bluetooth-power";
+ 				default-state = "off";
+ 			};
+ 		};
+diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c
+index f206dafbb0a3..26a058d58d37 100644
+--- a/arch/mips/ath79/setup.c
++++ b/arch/mips/ath79/setup.c
+@@ -40,6 +40,7 @@ static char ath79_sys_type[ATH79_SYS_TYPE_LEN];
+ 
+ static void ath79_restart(char *command)
+ {
++	local_irq_disable();
+ 	ath79_device_reset_set(AR71XX_RESET_FULL_CHIP);
+ 	for (;;)
+ 		if (cpu_wait)
+diff --git a/arch/mips/include/asm/mach-ath79/ath79.h b/arch/mips/include/asm/mach-ath79/ath79.h
+index 441faa92c3cd..6e6c0fead776 100644
+--- a/arch/mips/include/asm/mach-ath79/ath79.h
++++ b/arch/mips/include/asm/mach-ath79/ath79.h
+@@ -134,6 +134,7 @@ static inline u32 ath79_pll_rr(unsigned reg)
+ static inline void ath79_reset_wr(unsigned reg, u32 val)
+ {
+ 	__raw_writel(val, ath79_reset_base + reg);
++	(void) __raw_readl(ath79_reset_base + reg); /* flush */
+ }
+ 
+ static inline u32 ath79_reset_rr(unsigned reg)
+diff --git a/arch/mips/jz4740/Platform b/arch/mips/jz4740/Platform
+index 28448d358c10..a2a5a85ea1f9 100644
+--- a/arch/mips/jz4740/Platform
++++ b/arch/mips/jz4740/Platform
+@@ -1,4 +1,4 @@
+ platform-$(CONFIG_MACH_INGENIC)	+= jz4740/
+ cflags-$(CONFIG_MACH_INGENIC)	+= -I$(srctree)/arch/mips/include/asm/mach-jz4740
+ load-$(CONFIG_MACH_INGENIC)	+= 0xffffffff80010000
+-zload-$(CONFIG_MACH_INGENIC)	+= 0xffffffff80600000
++zload-$(CONFIG_MACH_INGENIC)	+= 0xffffffff81000000
+diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c
+index f9dbfb14af33..e88344e3d508 100644
+--- a/arch/mips/kernel/vdso.c
++++ b/arch/mips/kernel/vdso.c
+@@ -14,12 +14,14 @@
+ #include <linux/init.h>
+ #include <linux/ioport.h>
+ #include <linux/irqchip/mips-gic.h>
++#include <linux/kernel.h>
+ #include <linux/mm.h>
+ #include <linux/sched.h>
+ #include <linux/slab.h>
+ #include <linux/timekeeper_internal.h>
+ 
+ #include <asm/abi.h>
++#include <asm/page.h>
+ #include <asm/vdso.h>
+ 
+ /* Kernel-provided data used by the VDSO. */
+@@ -129,12 +131,30 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+ 	vvar_size = gic_size + PAGE_SIZE;
+ 	size = vvar_size + image->size;
+ 
++	/*
++	 * Find a region that's large enough for us to perform the
++	 * colour-matching alignment below.
++	 */
++	if (cpu_has_dc_aliases)
++		size += shm_align_mask + 1;
++
+ 	base = get_unmapped_area(NULL, 0, size, 0, 0);
+ 	if (IS_ERR_VALUE(base)) {
+ 		ret = base;
+ 		goto out;
+ 	}
+ 
++	/*
++	 * If we suffer from dcache aliasing, ensure that the VDSO data page
++	 * mapping is coloured the same as the kernel's mapping of that memory.
++	 * This ensures that when the kernel updates the VDSO data userland
++	 * will observe it without requiring cache invalidations.
++	 */
++	if (cpu_has_dc_aliases) {
++		base = __ALIGN_MASK(base, shm_align_mask);
++		base += ((unsigned long)&vdso_data - gic_size) & shm_align_mask;
++	}
++
+ 	data_addr = base + gic_size;
+ 	vdso_addr = data_addr + PAGE_SIZE;
+ 
+diff --git a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c
+index f7c905e50dc4..92dc6bafc127 100644
+--- a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c
++++ b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c
+@@ -138,7 +138,7 @@ u32 pci_ohci_read_reg(int reg)
+ 		break;
+ 	case PCI_OHCI_INT_REG:
+ 		_rdmsr(DIVIL_MSR_REG(PIC_YSEL_LOW), &hi, &lo);
+-		if ((lo & 0x00000f00) == CS5536_USB_INTR)
++		if (((lo >> PIC_YSEL_LOW_USB_SHIFT) & 0xf) == CS5536_USB_INTR)
+ 			conf_data = 1;
+ 		break;
+ 	default:
+diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
+index 6c9a65b52e63..7fb61ebc99a2 100644
+--- a/arch/powerpc/platforms/powernv/opal.c
++++ b/arch/powerpc/platforms/powernv/opal.c
+@@ -369,7 +369,7 @@ int opal_put_chars(uint32_t vtermno, const char *data, int total_len)
+ 		/* Closed or other error drop */
+ 		if (rc != OPAL_SUCCESS && rc != OPAL_BUSY &&
+ 		    rc != OPAL_BUSY_EVENT) {
+-			written = total_len;
++			written += total_len;
+ 			break;
+ 		}
+ 		if (rc == OPAL_SUCCESS) {
+diff --git a/crypto/api.c b/crypto/api.c
+index bbc147cb5dec..abf53e67e3d8 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -215,7 +215,7 @@ struct crypto_alg *crypto_larval_lookup(const char *name, u32 type, u32 mask)
+ 	type &= mask;
+ 
+ 	alg = crypto_alg_lookup(name, type, mask);
+-	if (!alg) {
++	if (!alg && !(mask & CRYPTO_NOLOAD)) {
+ 		request_module("crypto-%s", name);
+ 
+ 		if (!((type ^ CRYPTO_ALG_NEED_FALLBACK) & mask &
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index a0ed957d738f..f43caad30e1e 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -2072,6 +2072,9 @@ void device_shutdown(void)
+ {
+ 	struct device *dev, *parent;
+ 
++	wait_for_device_probe();
++	device_block_probing();
++
+ 	spin_lock(&devices_kset->list_lock);
+ 	/*
+ 	 * Walk the devices list backward, shutting down each in turn.
+diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c
+index a5d402de5584..20724abd38bd 100644
+--- a/drivers/clk/clk-fixed-factor.c
++++ b/drivers/clk/clk-fixed-factor.c
+@@ -177,8 +177,15 @@ static struct clk *_of_fixed_factor_clk_setup(struct device_node *node)
+ 
+ 	clk = clk_register_fixed_factor(NULL, clk_name, parent_name, flags,
+ 					mult, div);
+-	if (IS_ERR(clk))
++	if (IS_ERR(clk)) {
++		/*
++		 * If parent clock is not registered, registration would fail.
++		 * Clear OF_POPULATED flag so that clock registration can be
++		 * attempted again from probe function.
++		 */
++		of_node_clear_flag(node, OF_POPULATED);
+ 		return clk;
++	}
+ 
+ 	ret = of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ 	if (ret) {
+diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c
+index d1d7787ce211..db2901646403 100644
+--- a/drivers/clk/imx/clk-imx6ul.c
++++ b/drivers/clk/imx/clk-imx6ul.c
+@@ -120,6 +120,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node)
+ 
+ 	np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-anatop");
+ 	base = of_iomap(np, 0);
++	of_node_put(np);
+ 	WARN_ON(!base);
+ 
+ 	clks[IMX6UL_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 0c49956ee0ce..4d0ec7bb3bc9 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -1352,7 +1352,7 @@ err_sha_v4_algs:
+ 
+ err_sha_v3_algs:
+ 	for (j = 0; j < k; j++)
+-		crypto_unregister_ahash(&sha_v4_algs[j]);
++		crypto_unregister_ahash(&sha_v3_algs[j]);
+ 
+ err_aes_algs:
+ 	for (j = 0; j < i; j++)
+@@ -1368,7 +1368,7 @@ static void sahara_unregister_algs(struct sahara_dev *dev)
+ 	for (i = 0; i < ARRAY_SIZE(aes_algs); i++)
+ 		crypto_unregister_alg(&aes_algs[i]);
+ 
+-	for (i = 0; i < ARRAY_SIZE(sha_v4_algs); i++)
++	for (i = 0; i < ARRAY_SIZE(sha_v3_algs); i++)
+ 		crypto_unregister_ahash(&sha_v3_algs[i]);
+ 
+ 	if (dev->version > SAHARA_VERSION_3)
+diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
+index 71866646ffef..be1f5c26fae8 100644
+--- a/drivers/dma/mv_xor_v2.c
++++ b/drivers/dma/mv_xor_v2.c
+@@ -844,6 +844,8 @@ static int mv_xor_v2_remove(struct platform_device *pdev)
+ 
+ 	platform_msi_domain_free_irqs(&pdev->dev);
+ 
++	tasklet_kill(&xor_dev->irq_tasklet);
++
+ 	clk_disable_unprepare(xor_dev->clk);
+ 
+ 	return 0;
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index b9dad4e40bb8..6d7e3cd4aba4 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2167,13 +2167,14 @@ static int pl330_terminate_all(struct dma_chan *chan)
+ 
+ 	pm_runtime_get_sync(pl330->ddma.dev);
+ 	spin_lock_irqsave(&pch->lock, flags);
++
+ 	spin_lock(&pl330->lock);
+ 	_stop(pch->thread);
+-	spin_unlock(&pl330->lock);
+-
+ 	pch->thread->req[0].desc = NULL;
+ 	pch->thread->req[1].desc = NULL;
+ 	pch->thread->req_running = -1;
++	spin_unlock(&pl330->lock);
++
+ 	power_down = pch->active;
+ 	pch->active = false;
+ 
+diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c
+index 8efe13075c92..1d1c9693ebfb 100644
+--- a/drivers/firmware/efi/arm-init.c
++++ b/drivers/firmware/efi/arm-init.c
+@@ -250,7 +250,6 @@ void __init efi_init(void)
+ 	reserve_regions();
+ 	efi_memattr_init();
+ 	efi_esrt_init();
+-	efi_memmap_unmap();
+ 
+ 	memblock_reserve(params.mmap & PAGE_MASK,
+ 			 PAGE_ALIGN(params.mmap_size +
+diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
+index 6bdf39e1e385..4d788e0debfe 100644
+--- a/drivers/firmware/efi/arm-runtime.c
++++ b/drivers/firmware/efi/arm-runtime.c
+@@ -118,11 +118,13 @@ static int __init arm_enable_runtime_services(void)
+ {
+ 	u64 mapsize;
+ 
+-	if (!efi_enabled(EFI_BOOT)) {
++	if (!efi_enabled(EFI_BOOT) || !efi_enabled(EFI_MEMMAP)) {
+ 		pr_info("EFI services will not be available.\n");
+ 		return 0;
+ 	}
+ 
++	efi_memmap_unmap();
++
+ 	if (efi_runtime_disabled()) {
+ 		pr_info("EFI runtime services will be disabled.\n");
+ 		return 0;
+diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c
+index 311c9d0e8cbb..241dd7c63d2c 100644
+--- a/drivers/firmware/efi/esrt.c
++++ b/drivers/firmware/efi/esrt.c
+@@ -333,7 +333,8 @@ void __init efi_esrt_init(void)
+ 
+ 	end = esrt_data + size;
+ 	pr_info("Reserving ESRT space from %pa to %pa.\n", &esrt_data, &end);
+-	efi_mem_reserve(esrt_data, esrt_data_size);
++	if (md.type == EFI_BOOT_SERVICES_DATA)
++		efi_mem_reserve(esrt_data, esrt_data_size);
+ 
+ 	pr_debug("esrt-init: loaded.\n");
+ err_memunmap:
+diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
+index 76ac906b4d78..7a6305884f97 100644
+--- a/drivers/gpio/gpio-pxa.c
++++ b/drivers/gpio/gpio-pxa.c
+@@ -660,6 +660,8 @@ static int pxa_gpio_probe(struct platform_device *pdev)
+ 	pchip->irq0 = irq0;
+ 	pchip->irq1 = irq1;
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (!res)
++		return -EINVAL;
+ 	gpio_reg_base = devm_ioremap(&pdev->dev, res->start,
+ 				     resource_size(res));
+ 	if (!gpio_reg_base)
+diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h
+index 346fbda39220..6c4d72872309 100644
+--- a/drivers/gpio/gpiolib.h
++++ b/drivers/gpio/gpiolib.h
+@@ -85,7 +85,7 @@ struct acpi_gpio_info {
+ };
+ 
+ /* gpio suffixes used for ACPI and device tree lookup */
+-static const char * const gpio_suffixes[] = { "gpios", "gpio" };
++static __maybe_unused const char * const gpio_suffixes[] = { "gpios", "gpio" };
+ 
+ #ifdef CONFIG_OF_GPIO
+ struct gpio_desc *of_find_gpio(struct device *dev,
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+index 171480bb95d0..6e7eb76189f9 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+@@ -124,6 +124,8 @@ struct kfd_process *kfd_get_process(const struct task_struct *thread)
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	process = find_process(thread);
++	if (!process)
++		return ERR_PTR(-EINVAL);
+ 
+ 	return process;
+ }
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c
+index 9b638bd905ff..d370bf8bc409 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c
+@@ -23,6 +23,10 @@
+ #ifdef CONFIG_NOUVEAU_PLATFORM_DRIVER
+ #include "priv.h"
+ 
++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)
++#include <asm/dma-iommu.h>
++#endif
++
+ static int
+ nvkm_device_tegra_power_up(struct nvkm_device_tegra *tdev)
+ {
+@@ -95,6 +99,15 @@ nvkm_device_tegra_probe_iommu(struct nvkm_device_tegra *tdev)
+ 	unsigned long pgsize_bitmap;
+ 	int ret;
+ 
++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)
++	if (dev->archdata.mapping) {
++		struct dma_iommu_mapping *mapping = to_dma_iommu_mapping(dev);
++
++		arm_iommu_detach_device(dev);
++		arm_iommu_release_mapping(mapping);
++	}
++#endif
++
+ 	if (!tdev->func->iommu_bit)
+ 		return;
+ 
+diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
+index a188a3959f1a..6ad827b93ae1 100644
+--- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
++++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
+@@ -823,7 +823,7 @@ static void s6e8aa0_read_mtp_id(struct s6e8aa0 *ctx)
+ 	int ret, i;
+ 
+ 	ret = s6e8aa0_dcs_read(ctx, 0xd1, id, ARRAY_SIZE(id));
+-	if (ret < ARRAY_SIZE(id) || id[0] == 0x00) {
++	if (ret < 0 || ret < ARRAY_SIZE(id) || id[0] == 0x00) {
+ 		dev_err(ctx->dev, "read id failed\n");
+ 		ctx->error = -EIO;
+ 		return;
+diff --git a/drivers/gpu/ipu-v3/ipu-csi.c b/drivers/gpu/ipu-v3/ipu-csi.c
+index d6e5ded24418..8774bf17c853 100644
+--- a/drivers/gpu/ipu-v3/ipu-csi.c
++++ b/drivers/gpu/ipu-v3/ipu-csi.c
+@@ -316,13 +316,17 @@ static int mbus_code_to_bus_cfg(struct ipu_csi_bus_config *cfg, u32 mbus_code)
+ /*
+  * Fill a CSI bus config struct from mbus_config and mbus_framefmt.
+  */
+-static void fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg,
++static int fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg,
+ 				 struct v4l2_mbus_config *mbus_cfg,
+ 				 struct v4l2_mbus_framefmt *mbus_fmt)
+ {
++	int ret;
++
+ 	memset(csicfg, 0, sizeof(*csicfg));
+ 
+-	mbus_code_to_bus_cfg(csicfg, mbus_fmt->code);
++	ret = mbus_code_to_bus_cfg(csicfg, mbus_fmt->code);
++	if (ret < 0)
++		return ret;
+ 
+ 	switch (mbus_cfg->type) {
+ 	case V4L2_MBUS_PARALLEL:
+@@ -353,6 +357,8 @@ static void fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg,
+ 		/* will never get here, keep compiler quiet */
+ 		break;
+ 	}
++
++	return 0;
+ }
+ 
+ int ipu_csi_init_interface(struct ipu_csi *csi,
+@@ -362,8 +368,11 @@ int ipu_csi_init_interface(struct ipu_csi *csi,
+ 	struct ipu_csi_bus_config cfg;
+ 	unsigned long flags;
+ 	u32 width, height, data = 0;
++	int ret;
+ 
+-	fill_csi_bus_cfg(&cfg, mbus_cfg, mbus_fmt);
++	ret = fill_csi_bus_cfg(&cfg, mbus_cfg, mbus_fmt);
++	if (ret < 0)
++		return ret;
+ 
+ 	/* set default sensor frame width and height */
+ 	width = mbus_fmt->width;
+@@ -567,11 +576,14 @@ int ipu_csi_set_mipi_datatype(struct ipu_csi *csi, u32 vc,
+ 	struct ipu_csi_bus_config cfg;
+ 	unsigned long flags;
+ 	u32 temp;
++	int ret;
+ 
+ 	if (vc > 3)
+ 		return -EINVAL;
+ 
+-	mbus_code_to_bus_cfg(&cfg, mbus_fmt->code);
++	ret = mbus_code_to_bus_cfg(&cfg, mbus_fmt->code);
++	if (ret < 0)
++		return ret;
+ 
+ 	spin_lock_irqsave(&csi->lock, flags);
+ 
+diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
+index ff579a7c6d00..7473c6ea99e9 100644
+--- a/drivers/hwtracing/coresight/coresight-tpiu.c
++++ b/drivers/hwtracing/coresight/coresight-tpiu.c
+@@ -47,8 +47,9 @@
+ 
+ /** register definition **/
+ /* FFSR - 0x300 */
+-#define FFSR_FT_STOPPED		BIT(1)
++#define FFSR_FT_STOPPED_BIT	1
+ /* FFCR - 0x304 */
++#define FFCR_FON_MAN_BIT	6
+ #define FFCR_FON_MAN		BIT(6)
+ #define FFCR_STOP_FI		BIT(12)
+ 
+@@ -93,9 +94,9 @@ static void tpiu_disable_hw(struct tpiu_drvdata *drvdata)
+ 	/* Generate manual flush */
+ 	writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR);
+ 	/* Wait for flush to complete */
+-	coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0);
++	coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN_BIT, 0);
+ 	/* Wait for formatter to stop */
+-	coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1);
++	coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED_BIT, 1);
+ 
+ 	CS_LOCK(drvdata->base);
+ }
+diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c
+index 4383324ec01c..398e44a9ec45 100644
+--- a/drivers/hwtracing/coresight/coresight.c
++++ b/drivers/hwtracing/coresight/coresight.c
+@@ -107,7 +107,7 @@ static int coresight_find_link_inport(struct coresight_device *csdev,
+ 	dev_err(&csdev->dev, "couldn't find inport, parent: %s, child: %s\n",
+ 		dev_name(&parent->dev), dev_name(&csdev->dev));
+ 
+-	return 0;
++	return -ENODEV;
+ }
+ 
+ static int coresight_find_link_outport(struct coresight_device *csdev,
+@@ -125,7 +125,7 @@ static int coresight_find_link_outport(struct coresight_device *csdev,
+ 	dev_err(&csdev->dev, "couldn't find outport, parent: %s, child: %s\n",
+ 		dev_name(&csdev->dev), dev_name(&child->dev));
+ 
+-	return 0;
++	return -ENODEV;
+ }
+ 
+ static int coresight_enable_sink(struct coresight_device *csdev, u32 mode)
+@@ -178,6 +178,9 @@ static int coresight_enable_link(struct coresight_device *csdev,
+ 	else
+ 		refport = 0;
+ 
++	if (refport < 0)
++		return refport;
++
+ 	if (atomic_inc_return(&csdev->refcnt[refport]) == 1) {
+ 		if (link_ops(csdev)->enable) {
+ 			ret = link_ops(csdev)->enable(csdev, inport, outport);
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 575afba1056a..85d4ef319c90 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -673,6 +673,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
+ 	dgid = (union ib_gid *) &addr->sib_addr;
+ 	pkey = ntohs(addr->sib_pkey);
+ 
++	mutex_lock(&lock);
+ 	list_for_each_entry(cur_dev, &dev_list, list) {
+ 		for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) {
+ 			if (!rdma_cap_af_ib(cur_dev->device, p))
+@@ -696,18 +697,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
+ 					cma_dev = cur_dev;
+ 					sgid = gid;
+ 					id_priv->id.port_num = p;
++					goto found;
+ 				}
+ 			}
+ 		}
+ 	}
+-
+-	if (!cma_dev)
+-		return -ENODEV;
++	mutex_unlock(&lock);
++	return -ENODEV;
+ 
+ found:
+ 	cma_attach_to_dev(id_priv, cma_dev);
+-	addr = (struct sockaddr_ib *) cma_src_addr(id_priv);
+-	memcpy(&addr->sib_addr, &sgid, sizeof sgid);
++	mutex_unlock(&lock);
++	addr = (struct sockaddr_ib *)cma_src_addr(id_priv);
++	memcpy(&addr->sib_addr, &sgid, sizeof(sgid));
+ 	cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr);
+ 	return 0;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
+index 46f062842a9a..db6bb026ae90 100644
+--- a/drivers/infiniband/sw/rxe/rxe_recv.c
++++ b/drivers/infiniband/sw/rxe/rxe_recv.c
+@@ -225,9 +225,14 @@ static int hdr_check(struct rxe_pkt_info *pkt)
+ 		goto err1;
+ 	}
+ 
++	if (unlikely(qpn == 0)) {
++		pr_warn_once("QP 0 not supported");
++		goto err1;
++	}
++
+ 	if (qpn != IB_MULTICAST_QPN) {
+-		index = (qpn == 0) ? port->qp_smi_index :
+-			((qpn == 1) ? port->qp_gsi_index : qpn);
++		index = (qpn == 1) ? port->qp_gsi_index : qpn;
++
+ 		qp = rxe_pool_get_index(&rxe->qp_pool, index);
+ 		if (unlikely(!qp)) {
+ 			pr_warn_ratelimited("no qp matches qpn 0x%x\n", qpn);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index 75761667be59..ad9b486ca7ea 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -1009,12 +1009,14 @@ static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id, struct ib_cm_event *even
+ 
+ 	skb_queue_head_init(&skqueue);
+ 
++	netif_tx_lock_bh(p->dev);
+ 	spin_lock_irq(&priv->lock);
+ 	set_bit(IPOIB_FLAG_OPER_UP, &p->flags);
+ 	if (p->neigh)
+ 		while ((skb = __skb_dequeue(&p->neigh->queue)))
+ 			__skb_queue_tail(&skqueue, skb);
+ 	spin_unlock_irq(&priv->lock);
++	netif_tx_unlock_bh(p->dev);
+ 
+ 	while ((skb = __skb_dequeue(&skqueue))) {
+ 		skb->dev = p->dev;
+diff --git a/drivers/input/touchscreen/rohm_bu21023.c b/drivers/input/touchscreen/rohm_bu21023.c
+index 611156a2ef80..be29984c0e4c 100644
+--- a/drivers/input/touchscreen/rohm_bu21023.c
++++ b/drivers/input/touchscreen/rohm_bu21023.c
+@@ -304,7 +304,7 @@ static int rohm_i2c_burst_read(struct i2c_client *client, u8 start, void *buf,
+ 	msg[1].len = len;
+ 	msg[1].buf = buf;
+ 
+-	i2c_lock_adapter(adap);
++	i2c_lock_bus(adap, I2C_LOCK_SEGMENT);
+ 
+ 	for (i = 0; i < 2; i++) {
+ 		if (__i2c_transfer(adap, &msg[i], 1) < 0) {
+@@ -313,7 +313,7 @@ static int rohm_i2c_burst_read(struct i2c_client *client, u8 start, void *buf,
+ 		}
+ 	}
+ 
+-	i2c_unlock_adapter(adap);
++	i2c_unlock_bus(adap, I2C_LOCK_SEGMENT);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
+index 7f294f785ce6..ff4be1174ff0 100644
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -1233,6 +1233,7 @@ static irqreturn_t arm_smmu_priq_thread(int irq, void *dev)
+ 
+ 	/* Sync our overflow flag, as we believe we're up to speed */
+ 	q->cons = Q_OVF(q, q->prod) | Q_WRP(q, q->cons) | Q_IDX(q, q->cons);
++	writel(q->cons, q->cons_reg);
+ 	return IRQ_HANDLED;
+ }
+ 
+diff --git a/drivers/media/pci/tw686x/tw686x-video.c b/drivers/media/pci/tw686x/tw686x-video.c
+index 0ea8dd44026c..3a06c000f97b 100644
+--- a/drivers/media/pci/tw686x/tw686x-video.c
++++ b/drivers/media/pci/tw686x/tw686x-video.c
+@@ -1190,6 +1190,14 @@ int tw686x_video_init(struct tw686x_dev *dev)
+ 			return err;
+ 	}
+ 
++	/* Initialize vc->dev and vc->ch for the error path */
++	for (ch = 0; ch < max_channels(dev); ch++) {
++		struct tw686x_video_channel *vc = &dev->video_channels[ch];
++
++		vc->dev = dev;
++		vc->ch = ch;
++	}
++
+ 	for (ch = 0; ch < max_channels(dev); ch++) {
+ 		struct tw686x_video_channel *vc = &dev->video_channels[ch];
+ 		struct video_device *vdev;
+@@ -1198,9 +1206,6 @@ int tw686x_video_init(struct tw686x_dev *dev)
+ 		spin_lock_init(&vc->qlock);
+ 		INIT_LIST_HEAD(&vc->vidq_queued);
+ 
+-		vc->dev = dev;
+-		vc->ch = ch;
+-
+ 		/* default settings */
+ 		err = tw686x_set_standard(vc, V4L2_STD_NTSC);
+ 		if (err)
+diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
+index b3a9fa75e8e7..f7ca1fab4808 100644
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -1375,6 +1375,11 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb)
+ 	struct vb2_buffer *vb;
+ 	int ret;
+ 
++	if (q->error) {
++		dprintk(1, "fatal error occurred on queue\n");
++		return -EIO;
++	}
++
+ 	vb = q->bufs[index];
+ 
+ 	switch (vb->state) {
+diff --git a/drivers/mfd/88pm860x-i2c.c b/drivers/mfd/88pm860x-i2c.c
+index 84e313107233..7b9052ea7413 100644
+--- a/drivers/mfd/88pm860x-i2c.c
++++ b/drivers/mfd/88pm860x-i2c.c
+@@ -146,14 +146,14 @@ int pm860x_page_reg_write(struct i2c_client *i2c, int reg,
+ 	unsigned char zero;
+ 	int ret;
+ 
+-	i2c_lock_adapter(i2c->adapter);
++	i2c_lock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ 	read_device(i2c, 0xFA, 0, &zero);
+ 	read_device(i2c, 0xFB, 0, &zero);
+ 	read_device(i2c, 0xFF, 0, &zero);
+ 	ret = write_device(i2c, reg, 1, &data);
+ 	read_device(i2c, 0xFE, 0, &zero);
+ 	read_device(i2c, 0xFC, 0, &zero);
+-	i2c_unlock_adapter(i2c->adapter);
++	i2c_unlock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ 	return ret;
+ }
+ EXPORT_SYMBOL(pm860x_page_reg_write);
+@@ -164,14 +164,14 @@ int pm860x_page_bulk_read(struct i2c_client *i2c, int reg,
+ 	unsigned char zero = 0;
+ 	int ret;
+ 
+-	i2c_lock_adapter(i2c->adapter);
++	i2c_lock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ 	read_device(i2c, 0xfa, 0, &zero);
+ 	read_device(i2c, 0xfb, 0, &zero);
+ 	read_device(i2c, 0xff, 0, &zero);
+ 	ret = read_device(i2c, reg, count, buf);
+ 	read_device(i2c, 0xFE, 0, &zero);
+ 	read_device(i2c, 0xFC, 0, &zero);
+-	i2c_unlock_adapter(i2c->adapter);
++	i2c_unlock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ 	return ret;
+ }
+ EXPORT_SYMBOL(pm860x_page_bulk_read);
+diff --git a/drivers/misc/hmc6352.c b/drivers/misc/hmc6352.c
+index 90520d76633f..9cde4c5bfba4 100644
+--- a/drivers/misc/hmc6352.c
++++ b/drivers/misc/hmc6352.c
+@@ -27,6 +27,7 @@
+ #include <linux/err.h>
+ #include <linux/delay.h>
+ #include <linux/sysfs.h>
++#include <linux/nospec.h>
+ 
+ static DEFINE_MUTEX(compass_mutex);
+ 
+@@ -50,6 +51,7 @@ static int compass_store(struct device *dev, const char *buf, size_t count,
+ 		return ret;
+ 	if (val >= strlen(map))
+ 		return -EINVAL;
++	val = array_index_nospec(val, strlen(map));
+ 	mutex_lock(&compass_mutex);
+ 	ret = compass_command(c, map[val]);
+ 	mutex_unlock(&compass_mutex);
+diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c
+index 75b9d4ac8b1e..371f5f66a9d6 100644
+--- a/drivers/misc/mei/bus-fixup.c
++++ b/drivers/misc/mei/bus-fixup.c
+@@ -178,7 +178,7 @@ static int mei_nfc_if_version(struct mei_cl *cl,
+ 
+ 	ret = 0;
+ 	bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length);
+-	if (bytes_recv < if_version_length) {
++	if (bytes_recv < 0 || bytes_recv < if_version_length) {
+ 		dev_err(bus->dev, "Could not read IF version\n");
+ 		ret = -EIO;
+ 		goto err;
+diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
+index dd7f15a65eed..ae4a570abae3 100644
+--- a/drivers/misc/mei/hbm.c
++++ b/drivers/misc/mei/hbm.c
+@@ -1137,15 +1137,18 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
+ 
+ 		props_res = (struct hbm_props_response *)mei_msg;
+ 
+-		if (props_res->status) {
++		if (props_res->status == MEI_HBMS_CLIENT_NOT_FOUND) {
++			dev_dbg(dev->dev, "hbm: properties response: %d CLIENT_NOT_FOUND\n",
++				props_res->me_addr);
++		} else if (props_res->status) {
+ 			dev_err(dev->dev, "hbm: properties response: wrong status = %d %s\n",
+ 				props_res->status,
+ 				mei_hbm_status_str(props_res->status));
+ 			return -EPROTO;
++		} else {
++			mei_hbm_me_cl_add(dev, props_res);
+ 		}
+ 
+-		mei_hbm_me_cl_add(dev, props_res);
+-
+ 		/* request property for the next client */
+ 		if (mei_hbm_prop_req(dev, props_res->me_addr + 1))
+ 			return -EIO;
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index a082aa330f47..f7d1c8c4e5ad 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -2215,6 +2215,7 @@ static int omap_hsmmc_remove(struct platform_device *pdev)
+ 	dma_release_channel(host->tx_chan);
+ 	dma_release_channel(host->rx_chan);
+ 
++	dev_pm_clear_wake_irq(host->dev);
+ 	pm_runtime_dont_use_autosuspend(host->dev);
+ 	pm_runtime_put_sync(host->dev);
+ 	pm_runtime_disable(host->dev);
+diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
+index 20b6ff5b4af1..088a3ae0dff0 100644
+--- a/drivers/mmc/host/sdhci-tegra.c
++++ b/drivers/mmc/host/sdhci-tegra.c
+@@ -350,7 +350,8 @@ static const struct sdhci_pltfm_data sdhci_tegra30_pdata = {
+ 		  SDHCI_QUIRK_NO_HISPD_BIT |
+ 		  SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC |
+ 		  SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN,
+-	.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
++	.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
++		   SDHCI_QUIRK2_BROKEN_HS200,
+ 	.ops  = &tegra_sdhci_ops,
+ };
+ 
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 44ea9d88651f..6bf58d27b6fc 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -3328,14 +3328,21 @@ int sdhci_setup_host(struct sdhci_host *host)
+ 	    mmc_gpio_get_cd(host->mmc) < 0)
+ 		mmc->caps |= MMC_CAP_NEEDS_POLL;
+ 
+-	/* If vqmmc regulator and no 1.8V signalling, then there's no UHS */
+ 	if (!IS_ERR(mmc->supply.vqmmc)) {
+ 		ret = regulator_enable(mmc->supply.vqmmc);
++
++		/* If vqmmc provides no 1.8V signalling, then there's no UHS */
+ 		if (!regulator_is_supported_voltage(mmc->supply.vqmmc, 1700000,
+ 						    1950000))
+ 			host->caps1 &= ~(SDHCI_SUPPORT_SDR104 |
+ 					 SDHCI_SUPPORT_SDR50 |
+ 					 SDHCI_SUPPORT_DDR50);
++
++		/* In eMMC case vqmmc might be a fixed 1.8V regulator */
++		if (!regulator_is_supported_voltage(mmc->supply.vqmmc, 2700000,
++						    3600000))
++			host->flags &= ~SDHCI_SIGNALING_330;
++
+ 		if (ret) {
+ 			pr_warn("%s: Failed to enable vqmmc regulator: %d\n",
+ 				mmc_hostname(mmc), ret);
+diff --git a/drivers/mtd/maps/solutionengine.c b/drivers/mtd/maps/solutionengine.c
+index bb580bc16445..c07f21b20463 100644
+--- a/drivers/mtd/maps/solutionengine.c
++++ b/drivers/mtd/maps/solutionengine.c
+@@ -59,9 +59,9 @@ static int __init init_soleng_maps(void)
+ 			return -ENXIO;
+ 		}
+ 	}
+-	printk(KERN_NOTICE "Solution Engine: Flash at 0x%08lx, EPROM at 0x%08lx\n",
+-	       soleng_flash_map.phys & 0x1fffffff,
+-	       soleng_eprom_map.phys & 0x1fffffff);
++	printk(KERN_NOTICE "Solution Engine: Flash at 0x%pap, EPROM at 0x%pap\n",
++	       &soleng_flash_map.phys,
++	       &soleng_eprom_map.phys);
+ 	flash_mtd->owner = THIS_MODULE;
+ 
+ 	eprom_mtd = do_map_probe("map_rom", &soleng_eprom_map);
+diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
+index b4092eab53ac..95b6a6640bca 100644
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -160,8 +160,12 @@ static ssize_t mtdchar_read(struct file *file, char __user *buf, size_t count,
+ 
+ 	pr_debug("MTD_read\n");
+ 
+-	if (*ppos + count > mtd->size)
+-		count = mtd->size - *ppos;
++	if (*ppos + count > mtd->size) {
++		if (*ppos < mtd->size)
++			count = mtd->size - *ppos;
++		else
++			count = 0;
++	}
+ 
+ 	if (!count)
+ 		return 0;
+@@ -246,7 +250,7 @@ static ssize_t mtdchar_write(struct file *file, const char __user *buf, size_t c
+ 
+ 	pr_debug("MTD_write\n");
+ 
+-	if (*ppos == mtd->size)
++	if (*ppos >= mtd->size)
+ 		return -ENOSPC;
+ 
+ 	if (*ppos + count > mtd->size)
+diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
+index 30e855004c57..8887dd3abed7 100644
+--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
+@@ -4500,7 +4500,7 @@ int be_cmd_get_profile_config(struct be_adapter *adapter,
+ 				port_res->max_vfs += le16_to_cpu(pcie->num_vfs);
+ 			}
+ 		}
+-		return status;
++		goto err;
+ 	}
+ 
+ 	pcie = be_get_pcie_desc(resp->func_param, desc_count,
+diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h
+index afb7ebe20b24..824fd44e25f0 100644
+--- a/drivers/net/ethernet/intel/e1000e/defines.h
++++ b/drivers/net/ethernet/intel/e1000e/defines.h
+@@ -400,6 +400,10 @@
+ #define E1000_ICR_RXDMT0        0x00000010 /* Rx desc min. threshold (0) */
+ #define E1000_ICR_RXO           0x00000040 /* Receiver Overrun */
+ #define E1000_ICR_RXT0          0x00000080 /* Rx timer intr (ring 0) */
++#define E1000_ICR_MDAC          0x00000200 /* MDIO Access Complete */
++#define E1000_ICR_SRPD          0x00010000 /* Small Receive Packet Detected */
++#define E1000_ICR_ACK           0x00020000 /* Receive ACK Frame Detected */
++#define E1000_ICR_MNG           0x00040000 /* Manageability Event Detected */
+ #define E1000_ICR_ECCER         0x00400000 /* Uncorrectable ECC Error */
+ /* If this bit asserted, the driver should claim the interrupt */
+ #define E1000_ICR_INT_ASSERTED	0x80000000
+@@ -407,7 +411,7 @@
+ #define E1000_ICR_RXQ1          0x00200000 /* Rx Queue 1 Interrupt */
+ #define E1000_ICR_TXQ0          0x00400000 /* Tx Queue 0 Interrupt */
+ #define E1000_ICR_TXQ1          0x00800000 /* Tx Queue 1 Interrupt */
+-#define E1000_ICR_OTHER         0x01000000 /* Other Interrupts */
++#define E1000_ICR_OTHER         0x01000000 /* Other Interrupt */
+ 
+ /* PBA ECC Register */
+ #define E1000_PBA_ECC_COUNTER_MASK  0xFFF00000 /* ECC counter mask */
+@@ -431,12 +435,27 @@
+ 	E1000_IMS_RXSEQ  |    \
+ 	E1000_IMS_LSC)
+ 
++/* These are all of the events related to the OTHER interrupt.
++ */
++#define IMS_OTHER_MASK ( \
++	E1000_IMS_LSC  | \
++	E1000_IMS_RXO  | \
++	E1000_IMS_MDAC | \
++	E1000_IMS_SRPD | \
++	E1000_IMS_ACK  | \
++	E1000_IMS_MNG)
++
+ /* Interrupt Mask Set */
+ #define E1000_IMS_TXDW      E1000_ICR_TXDW      /* Transmit desc written back */
+ #define E1000_IMS_LSC       E1000_ICR_LSC       /* Link Status Change */
+ #define E1000_IMS_RXSEQ     E1000_ICR_RXSEQ     /* Rx sequence error */
+ #define E1000_IMS_RXDMT0    E1000_ICR_RXDMT0    /* Rx desc min. threshold */
++#define E1000_IMS_RXO       E1000_ICR_RXO       /* Receiver Overrun */
+ #define E1000_IMS_RXT0      E1000_ICR_RXT0      /* Rx timer intr */
++#define E1000_IMS_MDAC      E1000_ICR_MDAC      /* MDIO Access Complete */
++#define E1000_IMS_SRPD      E1000_ICR_SRPD      /* Small Receive Packet */
++#define E1000_IMS_ACK       E1000_ICR_ACK       /* Receive ACK Frame Detected */
++#define E1000_IMS_MNG       E1000_ICR_MNG       /* Manageability Event */
+ #define E1000_IMS_ECCER     E1000_ICR_ECCER     /* Uncorrectable ECC Error */
+ #define E1000_IMS_RXQ0      E1000_ICR_RXQ0      /* Rx Queue 0 Interrupt */
+ #define E1000_IMS_RXQ1      E1000_ICR_RXQ1      /* Rx Queue 1 Interrupt */
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+index 7ddac956ffb5..dc7d671b903c 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -1364,9 +1364,6 @@ out:
+  *  Checks to see of the link status of the hardware has changed.  If a
+  *  change in link status has been detected, then we read the PHY registers
+  *  to get the current speed/duplex if link exists.
+- *
+- *  Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
+- *  up).
+  **/
+ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
+ {
+@@ -1382,7 +1379,8 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
+ 	 * Change or Rx Sequence Error interrupt.
+ 	 */
+ 	if (!mac->get_link_status)
+-		return 1;
++		return 0;
++	mac->get_link_status = false;
+ 
+ 	/* First we want to see if the MII Status Register reports
+ 	 * link.  If so, then we want to get the current speed/duplex
+@@ -1390,12 +1388,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
+ 	 */
+ 	ret_val = e1000e_phy_has_link_generic(hw, 1, 0, &link);
+ 	if (ret_val)
+-		return ret_val;
++		goto out;
+ 
+ 	if (hw->mac.type == e1000_pchlan) {
+ 		ret_val = e1000_k1_gig_workaround_hv(hw, link);
+ 		if (ret_val)
+-			return ret_val;
++			goto out;
+ 	}
+ 
+ 	/* When connected at 10Mbps half-duplex, some parts are excessively
+@@ -1430,7 +1428,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
+ 
+ 		ret_val = hw->phy.ops.acquire(hw);
+ 		if (ret_val)
+-			return ret_val;
++			goto out;
+ 
+ 		if (hw->mac.type == e1000_pch2lan)
+ 			emi_addr = I82579_RX_CONFIG;
+@@ -1453,7 +1451,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
+ 		hw->phy.ops.release(hw);
+ 
+ 		if (ret_val)
+-			return ret_val;
++			goto out;
+ 
+ 		if (hw->mac.type == e1000_pch_spt) {
+ 			u16 data;
+@@ -1462,14 +1460,14 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
+ 			if (speed == SPEED_1000) {
+ 				ret_val = hw->phy.ops.acquire(hw);
+ 				if (ret_val)
+-					return ret_val;
++					goto out;
+ 
+ 				ret_val = e1e_rphy_locked(hw,
+ 							  PHY_REG(776, 20),
+ 							  &data);
+ 				if (ret_val) {
+ 					hw->phy.ops.release(hw);
+-					return ret_val;
++					goto out;
+ 				}
+ 
+ 				ptr_gap = (data & (0x3FF << 2)) >> 2;
+@@ -1483,18 +1481,18 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
+ 				}
+ 				hw->phy.ops.release(hw);
+ 				if (ret_val)
+-					return ret_val;
++					goto out;
+ 			} else {
+ 				ret_val = hw->phy.ops.acquire(hw);
+ 				if (ret_val)
+-					return ret_val;
++					goto out;
+ 
+ 				ret_val = e1e_wphy_locked(hw,
+ 							  PHY_REG(776, 20),
+ 							  0xC023);
+ 				hw->phy.ops.release(hw);
+ 				if (ret_val)
+-					return ret_val;
++					goto out;
+ 
+ 			}
+ 		}
+@@ -1521,7 +1519,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
+ 	    (hw->adapter->pdev->device == E1000_DEV_ID_PCH_I218_V3)) {
+ 		ret_val = e1000_k1_workaround_lpt_lp(hw, link);
+ 		if (ret_val)
+-			return ret_val;
++			goto out;
+ 	}
+ 	if ((hw->mac.type == e1000_pch_lpt) ||
+ 	    (hw->mac.type == e1000_pch_spt)) {
+@@ -1530,7 +1528,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
+ 		 */
+ 		ret_val = e1000_platform_pm_pch_lpt(hw, link);
+ 		if (ret_val)
+-			return ret_val;
++			goto out;
+ 	}
+ 
+ 	/* Clear link partner's EEE ability */
+@@ -1550,9 +1548,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
+ 	}
+ 
+ 	if (!link)
+-		return 0;	/* No link detected */
+-
+-	mac->get_link_status = false;
++		goto out;
+ 
+ 	switch (hw->mac.type) {
+ 	case e1000_pch2lan:
+@@ -1600,7 +1596,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
+ 	 * we have already determined whether we have link or not.
+ 	 */
+ 	if (!mac->autoneg)
+-		return 1;
++		return -E1000_ERR_CONFIG;
+ 
+ 	/* Auto-Neg is enabled.  Auto Speed Detection takes care
+ 	 * of MAC speed/duplex configuration.  So we only need to
+@@ -1614,12 +1610,14 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
+ 	 * different link partner.
+ 	 */
+ 	ret_val = e1000e_config_fc_after_link_up(hw);
+-	if (ret_val) {
++	if (ret_val)
+ 		e_dbg("Error configuring flow control\n");
+-		return ret_val;
+-	}
+ 
+-	return 1;
++	return ret_val;
++
++out:
++	mac->get_link_status = true;
++	return ret_val;
+ }
+ 
+ static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
+diff --git a/drivers/net/ethernet/intel/e1000e/mac.c b/drivers/net/ethernet/intel/e1000e/mac.c
+index db735644b312..5bdc3a2d4fd7 100644
+--- a/drivers/net/ethernet/intel/e1000e/mac.c
++++ b/drivers/net/ethernet/intel/e1000e/mac.c
+@@ -410,9 +410,6 @@ void e1000e_clear_hw_cntrs_base(struct e1000_hw *hw)
+  *  Checks to see of the link status of the hardware has changed.  If a
+  *  change in link status has been detected, then we read the PHY registers
+  *  to get the current speed/duplex if link exists.
+- *
+- *  Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
+- *  up).
+  **/
+ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
+ {
+@@ -426,20 +423,16 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
+ 	 * Change or Rx Sequence Error interrupt.
+ 	 */
+ 	if (!mac->get_link_status)
+-		return 1;
++		return 0;
++	mac->get_link_status = false;
+ 
+ 	/* First we want to see if the MII Status Register reports
+ 	 * link.  If so, then we want to get the current speed/duplex
+ 	 * of the PHY.
+ 	 */
+ 	ret_val = e1000e_phy_has_link_generic(hw, 1, 0, &link);
+-	if (ret_val)
+-		return ret_val;
+-
+-	if (!link)
+-		return 0;	/* No link detected */
+-
+-	mac->get_link_status = false;
++	if (ret_val || !link)
++		goto out;
+ 
+ 	/* Check if there was DownShift, must be checked
+ 	 * immediately after link-up
+@@ -450,7 +443,7 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
+ 	 * we have already determined whether we have link or not.
+ 	 */
+ 	if (!mac->autoneg)
+-		return 1;
++		return -E1000_ERR_CONFIG;
+ 
+ 	/* Auto-Neg is enabled.  Auto Speed Detection takes care
+ 	 * of MAC speed/duplex configuration.  So we only need to
+@@ -464,12 +457,14 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
+ 	 * different link partner.
+ 	 */
+ 	ret_val = e1000e_config_fc_after_link_up(hw);
+-	if (ret_val) {
++	if (ret_val)
+ 		e_dbg("Error configuring flow control\n");
+-		return ret_val;
+-	}
+ 
+-	return 1;
++	return ret_val;
++
++out:
++	mac->get_link_status = true;
++	return ret_val;
+ }
+ 
+ /**
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 9c95222e6536..6855b3380a83 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -1911,30 +1911,20 @@ static irqreturn_t e1000_msix_other(int __always_unused irq, void *data)
+ 	struct net_device *netdev = data;
+ 	struct e1000_adapter *adapter = netdev_priv(netdev);
+ 	struct e1000_hw *hw = &adapter->hw;
+-	u32 icr;
+-	bool enable = true;
+-
+-	icr = er32(ICR);
+-	if (icr & E1000_ICR_RXO) {
+-		ew32(ICR, E1000_ICR_RXO);
+-		enable = false;
+-		/* napi poll will re-enable Other, make sure it runs */
+-		if (napi_schedule_prep(&adapter->napi)) {
+-			adapter->total_rx_bytes = 0;
+-			adapter->total_rx_packets = 0;
+-			__napi_schedule(&adapter->napi);
+-		}
+-	}
++	u32 icr = er32(ICR);
++
++	if (icr & adapter->eiac_mask)
++		ew32(ICS, (icr & adapter->eiac_mask));
++
+ 	if (icr & E1000_ICR_LSC) {
+-		ew32(ICR, E1000_ICR_LSC);
+ 		hw->mac.get_link_status = true;
+ 		/* guard against interrupt when we're going down */
+ 		if (!test_bit(__E1000_DOWN, &adapter->state))
+ 			mod_timer(&adapter->watchdog_timer, jiffies + 1);
+ 	}
+ 
+-	if (enable && !test_bit(__E1000_DOWN, &adapter->state))
+-		ew32(IMS, E1000_IMS_OTHER);
++	if (!test_bit(__E1000_DOWN, &adapter->state))
++		ew32(IMS, E1000_IMS_OTHER | IMS_OTHER_MASK);
+ 
+ 	return IRQ_HANDLED;
+ }
+@@ -2037,7 +2027,6 @@ static void e1000_configure_msix(struct e1000_adapter *adapter)
+ 		       hw->hw_addr + E1000_EITR_82574(vector));
+ 	else
+ 		writel(1, hw->hw_addr + E1000_EITR_82574(vector));
+-	adapter->eiac_mask |= E1000_IMS_OTHER;
+ 
+ 	/* Cause Tx interrupts on every write back */
+ 	ivar |= BIT(31);
+@@ -2262,7 +2251,8 @@ static void e1000_irq_enable(struct e1000_adapter *adapter)
+ 
+ 	if (adapter->msix_entries) {
+ 		ew32(EIAC_82574, adapter->eiac_mask & E1000_EIAC_MASK_82574);
+-		ew32(IMS, adapter->eiac_mask | E1000_IMS_LSC);
++		ew32(IMS, adapter->eiac_mask | E1000_IMS_OTHER |
++		     IMS_OTHER_MASK);
+ 	} else if ((hw->mac.type == e1000_pch_lpt) ||
+ 		   (hw->mac.type == e1000_pch_spt)) {
+ 		ew32(IMS, IMS_ENABLE_MASK | E1000_IMS_ECCER);
+@@ -2705,8 +2695,7 @@ static int e1000e_poll(struct napi_struct *napi, int weight)
+ 		napi_complete_done(napi, work_done);
+ 		if (!test_bit(__E1000_DOWN, &adapter->state)) {
+ 			if (adapter->msix_entries)
+-				ew32(IMS, adapter->rx_ring->ims_val |
+-				     E1000_IMS_OTHER);
++				ew32(IMS, adapter->rx_ring->ims_val);
+ 			else
+ 				e1000_irq_enable(adapter);
+ 		}
+@@ -5085,7 +5074,7 @@ static bool e1000e_has_link(struct e1000_adapter *adapter)
+ 	case e1000_media_type_copper:
+ 		if (hw->mac.get_link_status) {
+ 			ret_val = hw->mac.ops.check_for_link(hw);
+-			link_active = ret_val > 0;
++			link_active = !hw->mac.get_link_status;
+ 		} else {
+ 			link_active = true;
+ 		}
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
+index 8beecd615a21..448e71e07668 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
+@@ -339,9 +339,17 @@ void mlx5_start_health_poll(struct mlx5_core_dev *dev)
+ 	add_timer(&health->timer);
+ }
+ 
+-void mlx5_stop_health_poll(struct mlx5_core_dev *dev)
++void mlx5_stop_health_poll(struct mlx5_core_dev *dev, bool disable_health)
+ {
+ 	struct mlx5_core_health *health = &dev->priv.health;
++	unsigned long flags;
++
++	if (disable_health) {
++		spin_lock_irqsave(&health->wq_lock, flags);
++		set_bit(MLX5_DROP_NEW_HEALTH_WORK, &health->flags);
++		set_bit(MLX5_DROP_NEW_RECOVERY_WORK, &health->flags);
++		spin_unlock_irqrestore(&health->wq_lock, flags);
++	}
+ 
+ 	del_timer_sync(&health->timer);
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index 3c183b8c083a..6698a3a07406 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -787,8 +787,10 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
+ 	priv->numa_node = dev_to_node(&dev->pdev->dev);
+ 
+ 	priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root);
+-	if (!priv->dbg_root)
++	if (!priv->dbg_root) {
++		dev_err(&pdev->dev, "Cannot create debugfs dir, aborting\n");
+ 		return -ENOMEM;
++	}
+ 
+ 	err = mlx5_pci_enable_device(dev);
+ 	if (err) {
+@@ -837,7 +839,7 @@ static void mlx5_pci_close(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
+ 	pci_clear_master(dev->pdev);
+ 	release_bar(dev->pdev);
+ 	mlx5_pci_disable_device(dev);
+-	debugfs_remove(priv->dbg_root);
++	debugfs_remove_recursive(priv->dbg_root);
+ }
+ 
+ static int mlx5_init_once(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
+@@ -1130,7 +1132,7 @@ err_cleanup_once:
+ 		mlx5_cleanup_once(dev);
+ 
+ err_stop_poll:
+-	mlx5_stop_health_poll(dev);
++	mlx5_stop_health_poll(dev, boot);
+ 	if (mlx5_cmd_teardown_hca(dev)) {
+ 		dev_err(&dev->pdev->dev, "tear_down_hca failed, skip cleanup\n");
+ 		goto out_err;
+@@ -1187,7 +1189,7 @@ static int mlx5_unload_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
+ 	mlx5_disable_msix(dev);
+ 	if (cleanup)
+ 		mlx5_cleanup_once(dev);
+-	mlx5_stop_health_poll(dev);
++	mlx5_stop_health_poll(dev, cleanup);
+ 	err = mlx5_cmd_teardown_hca(dev);
+ 	if (err) {
+ 		dev_err(&dev->pdev->dev, "tear_down_hca failed, skip cleanup\n");
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+index eee6e59e6cf3..2e8703da536d 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+@@ -990,7 +990,7 @@ static void nfp_net_tx_complete(struct nfp_net_tx_ring *tx_ring)
+  * @nn:		NFP Net device
+  * @tx_ring:	TX ring structure
+  *
+- * Assumes that the device is stopped
++ * Assumes that the device is stopped, must be idempotent.
+  */
+ static void
+ nfp_net_tx_ring_reset(struct nfp_net *nn, struct nfp_net_tx_ring *tx_ring)
+@@ -1144,13 +1144,18 @@ static void nfp_net_rx_give_one(struct nfp_net_rx_ring *rx_ring,
+  * nfp_net_rx_ring_reset() - Reflect in SW state of freelist after disable
+  * @rx_ring:	RX ring structure
+  *
+- * Warning: Do *not* call if ring buffers were never put on the FW freelist
+- *	    (i.e. device was not enabled)!
++ * Assumes that the device is stopped, must be idempotent.
+  */
+ static void nfp_net_rx_ring_reset(struct nfp_net_rx_ring *rx_ring)
+ {
+ 	unsigned int wr_idx, last_idx;
+ 
++	/* wr_p == rd_p means ring was never fed FL bufs.  RX rings are always
++	 * kept at cnt - 1 FL bufs.
++	 */
++	if (rx_ring->wr_p == 0 && rx_ring->rd_p == 0)
++		return;
++
+ 	/* Move the empty entry to the end of the list */
+ 	wr_idx = rx_ring->wr_p % rx_ring->cnt;
+ 	last_idx = rx_ring->cnt - 1;
+@@ -1919,6 +1924,8 @@ static void nfp_net_vec_clear_ring_data(struct nfp_net *nn, unsigned int idx)
+ /**
+  * nfp_net_clear_config_and_disable() - Clear control BAR and disable NFP
+  * @nn:      NFP Net device to reconfigure
++ *
++ * Warning: must be fully idempotent.
+  */
+ static void nfp_net_clear_config_and_disable(struct nfp_net *nn)
+ {
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index a8bd68f252e9..7a62316c570d 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -161,7 +161,7 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ 	priv->ucc_pram_offset = qe_muram_alloc(sizeof(struct ucc_hdlc_param),
+ 				ALIGNMENT_OF_UCC_HDLC_PRAM);
+ 
+-	if (priv->ucc_pram_offset < 0) {
++	if (IS_ERR_VALUE(priv->ucc_pram_offset)) {
+ 		dev_err(priv->dev, "Can not allocate MURAM for hdlc parameter.\n");
+ 		ret = -ENOMEM;
+ 		goto free_tx_bd;
+@@ -197,14 +197,14 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ 
+ 	/* Alloc riptr, tiptr */
+ 	riptr = qe_muram_alloc(32, 32);
+-	if (riptr < 0) {
++	if (IS_ERR_VALUE(riptr)) {
+ 		dev_err(priv->dev, "Cannot allocate MURAM mem for Receive internal temp data pointer\n");
+ 		ret = -ENOMEM;
+ 		goto free_tx_skbuff;
+ 	}
+ 
+ 	tiptr = qe_muram_alloc(32, 32);
+-	if (tiptr < 0) {
++	if (IS_ERR_VALUE(tiptr)) {
+ 		dev_err(priv->dev, "Cannot allocate MURAM mem for Transmit internal temp data pointer\n");
+ 		ret = -ENOMEM;
+ 		goto free_riptr;
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index cd2c6ffdbdde..7f6af10f09ee 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -86,8 +86,7 @@ struct netfront_cb {
+ /* IRQ name is queue name with "-tx" or "-rx" appended */
+ #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3)
+ 
+-static DECLARE_WAIT_QUEUE_HEAD(module_load_q);
+-static DECLARE_WAIT_QUEUE_HEAD(module_unload_q);
++static DECLARE_WAIT_QUEUE_HEAD(module_wq);
+ 
+ struct netfront_stats {
+ 	u64			packets;
+@@ -1350,11 +1349,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
+ 	netif_carrier_off(netdev);
+ 
+ 	xenbus_switch_state(dev, XenbusStateInitialising);
+-	wait_event(module_load_q,
+-			   xenbus_read_driver_state(dev->otherend) !=
+-			   XenbusStateClosed &&
+-			   xenbus_read_driver_state(dev->otherend) !=
+-			   XenbusStateUnknown);
++	wait_event(module_wq,
++		   xenbus_read_driver_state(dev->otherend) !=
++		   XenbusStateClosed &&
++		   xenbus_read_driver_state(dev->otherend) !=
++		   XenbusStateUnknown);
+ 	return netdev;
+ 
+  exit:
+@@ -1622,6 +1621,7 @@ static int xennet_init_queue(struct netfront_queue *queue)
+ {
+ 	unsigned short i;
+ 	int err = 0;
++	char *devid;
+ 
+ 	spin_lock_init(&queue->tx_lock);
+ 	spin_lock_init(&queue->rx_lock);
+@@ -1629,8 +1629,9 @@ static int xennet_init_queue(struct netfront_queue *queue)
+ 	setup_timer(&queue->rx_refill_timer, rx_refill_timeout,
+ 		    (unsigned long)queue);
+ 
+-	snprintf(queue->name, sizeof(queue->name), "%s-q%u",
+-		 queue->info->netdev->name, queue->id);
++	devid = strrchr(queue->info->xbdev->nodename, '/') + 1;
++	snprintf(queue->name, sizeof(queue->name), "vif%s-q%u",
++		 devid, queue->id);
+ 
+ 	/* Initialise tx_skbs as a free chain containing every entry. */
+ 	queue->tx_skb_freelist = 0;
+@@ -2037,15 +2038,14 @@ static void netback_changed(struct xenbus_device *dev,
+ 
+ 	dev_dbg(&dev->dev, "%s\n", xenbus_strstate(backend_state));
+ 
++	wake_up_all(&module_wq);
++
+ 	switch (backend_state) {
+ 	case XenbusStateInitialising:
+ 	case XenbusStateInitialised:
+ 	case XenbusStateReconfiguring:
+ 	case XenbusStateReconfigured:
+-		break;
+-
+ 	case XenbusStateUnknown:
+-		wake_up_all(&module_unload_q);
+ 		break;
+ 
+ 	case XenbusStateInitWait:
+@@ -2061,12 +2061,10 @@ static void netback_changed(struct xenbus_device *dev,
+ 		break;
+ 
+ 	case XenbusStateClosed:
+-		wake_up_all(&module_unload_q);
+ 		if (dev->state == XenbusStateClosed)
+ 			break;
+ 		/* Missed the backend's CLOSING state -- fallthrough */
+ 	case XenbusStateClosing:
+-		wake_up_all(&module_unload_q);
+ 		xenbus_frontend_closed(dev);
+ 		break;
+ 	}
+@@ -2174,14 +2172,14 @@ static int xennet_remove(struct xenbus_device *dev)
+ 
+ 	if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) {
+ 		xenbus_switch_state(dev, XenbusStateClosing);
+-		wait_event(module_unload_q,
++		wait_event(module_wq,
+ 			   xenbus_read_driver_state(dev->otherend) ==
+ 			   XenbusStateClosing ||
+ 			   xenbus_read_driver_state(dev->otherend) ==
+ 			   XenbusStateUnknown);
+ 
+ 		xenbus_switch_state(dev, XenbusStateClosed);
+-		wait_event(module_unload_q,
++		wait_event(module_wq,
+ 			   xenbus_read_driver_state(dev->otherend) ==
+ 			   XenbusStateClosed ||
+ 			   xenbus_read_driver_state(dev->otherend) ==
+diff --git a/drivers/parport/parport_sunbpp.c b/drivers/parport/parport_sunbpp.c
+index 01cf1c1a841a..8de329546b82 100644
+--- a/drivers/parport/parport_sunbpp.c
++++ b/drivers/parport/parport_sunbpp.c
+@@ -286,12 +286,16 @@ static int bpp_probe(struct platform_device *op)
+ 
+ 	ops = kmemdup(&parport_sunbpp_ops, sizeof(struct parport_operations),
+ 		      GFP_KERNEL);
+-        if (!ops)
++	if (!ops) {
++		err = -ENOMEM;
+ 		goto out_unmap;
++	}
+ 
+ 	dprintk(("register_port\n"));
+-	if (!(p = parport_register_port((unsigned long)base, irq, dma, ops)))
++	if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) {
++		err = -ENOMEM;
+ 		goto out_free_ops;
++	}
+ 
+ 	p->size = size;
+ 	p->dev = &op->dev;
+diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+index 664b641fd776..8093afd17aa4 100644
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+@@ -287,31 +287,47 @@ static int pmic_gpio_config_get(struct pinctrl_dev *pctldev,
+ 
+ 	switch (param) {
+ 	case PIN_CONFIG_DRIVE_PUSH_PULL:
+-		arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_CMOS;
++		if (pad->buffer_type != PMIC_GPIO_OUT_BUF_CMOS)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_DRIVE_OPEN_DRAIN:
+-		arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS;
++		if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_DRIVE_OPEN_SOURCE:
+-		arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS;
++		if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_BIAS_PULL_DOWN:
+-		arg = pad->pullup == PMIC_GPIO_PULL_DOWN;
++		if (pad->pullup != PMIC_GPIO_PULL_DOWN)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_BIAS_DISABLE:
+-		arg = pad->pullup = PMIC_GPIO_PULL_DISABLE;
++		if (pad->pullup != PMIC_GPIO_PULL_DISABLE)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_BIAS_PULL_UP:
+-		arg = pad->pullup == PMIC_GPIO_PULL_UP_30;
++		if (pad->pullup != PMIC_GPIO_PULL_UP_30)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_BIAS_HIGH_IMPEDANCE:
+-		arg = !pad->is_enabled;
++		if (pad->is_enabled)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_POWER_SOURCE:
+ 		arg = pad->power_source;
+ 		break;
+ 	case PIN_CONFIG_INPUT_ENABLE:
+-		arg = pad->input_enabled;
++		if (!pad->input_enabled)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_OUTPUT:
+ 		arg = pad->out_value;
+diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
+index 074bf2fa1c55..79a228937072 100644
+--- a/drivers/platform/x86/toshiba_acpi.c
++++ b/drivers/platform/x86/toshiba_acpi.c
+@@ -34,6 +34,7 @@
+ #define TOSHIBA_ACPI_VERSION	"0.24"
+ #define PROC_INTERFACE_VERSION	1
+ 
++#include <linux/compiler.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
+@@ -1687,7 +1688,7 @@ static const struct file_operations keys_proc_fops = {
+ 	.write		= keys_proc_write,
+ };
+ 
+-static int version_proc_show(struct seq_file *m, void *v)
++static int __maybe_unused version_proc_show(struct seq_file *m, void *v)
+ {
+ 	seq_printf(m, "driver:                  %s\n", TOSHIBA_ACPI_VERSION);
+ 	seq_printf(m, "proc_interface:          %d\n", PROC_INTERFACE_VERSION);
+diff --git a/drivers/rtc/rtc-bq4802.c b/drivers/rtc/rtc-bq4802.c
+index bd170cb3361c..5747a54cbd42 100644
+--- a/drivers/rtc/rtc-bq4802.c
++++ b/drivers/rtc/rtc-bq4802.c
+@@ -164,6 +164,10 @@ static int bq4802_probe(struct platform_device *pdev)
+ 	} else if (p->r->flags & IORESOURCE_MEM) {
+ 		p->regs = devm_ioremap(&pdev->dev, p->r->start,
+ 					resource_size(p->r));
++		if (!p->regs){
++			err = -ENOMEM;
++			goto out;
++		}
+ 		p->read = bq4802_read_mem;
+ 		p->write = bq4802_write_mem;
+ 	} else {
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 283416aefa56..258a72869f57 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -3499,13 +3499,14 @@ static void qeth_flush_buffers(struct qeth_qdio_out_q *queue, int index,
+ 	qdio_flags = QDIO_FLAG_SYNC_OUTPUT;
+ 	if (atomic_read(&queue->set_pci_flags_count))
+ 		qdio_flags |= QDIO_FLAG_PCI_OUT;
++	atomic_add(count, &queue->used_buffers);
++
+ 	rc = do_QDIO(CARD_DDEV(queue->card), qdio_flags,
+ 		     queue->queue_no, index, count);
+ 	if (queue->card->options.performance_stats)
+ 		queue->card->perf_stats.outbound_do_qdio_time +=
+ 			qeth_get_micros() -
+ 			queue->card->perf_stats.outbound_do_qdio_start_time;
+-	atomic_add(count, &queue->used_buffers);
+ 	if (rc) {
+ 		queue->card->stats.tx_errors += count;
+ 		/* ignore temporary SIGA errors without busy condition */
+diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c
+index db6a285d41e0..0a7a6da36dfd 100644
+--- a/drivers/s390/net/qeth_core_sys.c
++++ b/drivers/s390/net/qeth_core_sys.c
+@@ -423,6 +423,7 @@ static ssize_t qeth_dev_layer2_store(struct device *dev,
+ 	if (card->discipline) {
+ 		card->discipline->remove(card->gdev);
+ 		qeth_core_free_discipline(card);
++		card->options.layer2 = -1;
+ 	}
+ 
+ 	rc = qeth_core_load_discipline(card, newdis);
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index a9c950d29ce2..25ae9b9895a9 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -705,20 +705,9 @@ static int acm_tty_write(struct tty_struct *tty,
+ 	}
+ 
+ 	if (acm->susp_count) {
+-		if (acm->putbuffer) {
+-			/* now to preserve order */
+-			usb_anchor_urb(acm->putbuffer->urb, &acm->delayed);
+-			acm->putbuffer = NULL;
+-		}
+ 		usb_anchor_urb(wb->urb, &acm->delayed);
+ 		spin_unlock_irqrestore(&acm->write_lock, flags);
+ 		return count;
+-	} else {
+-		if (acm->putbuffer) {
+-			/* at this point there is no good way to handle errors */
+-			acm_start_wb(acm, acm->putbuffer);
+-			acm->putbuffer = NULL;
+-		}
+ 	}
+ 
+ 	stat = acm_start_wb(acm, wb);
+@@ -729,66 +718,6 @@ static int acm_tty_write(struct tty_struct *tty,
+ 	return count;
+ }
+ 
+-static void acm_tty_flush_chars(struct tty_struct *tty)
+-{
+-	struct acm *acm = tty->driver_data;
+-	struct acm_wb *cur;
+-	int err;
+-	unsigned long flags;
+-
+-	spin_lock_irqsave(&acm->write_lock, flags);
+-
+-	cur = acm->putbuffer;
+-	if (!cur) /* nothing to do */
+-		goto out;
+-
+-	acm->putbuffer = NULL;
+-	err = usb_autopm_get_interface_async(acm->control);
+-	if (err < 0) {
+-		cur->use = 0;
+-		acm->putbuffer = cur;
+-		goto out;
+-	}
+-
+-	if (acm->susp_count)
+-		usb_anchor_urb(cur->urb, &acm->delayed);
+-	else
+-		acm_start_wb(acm, cur);
+-out:
+-	spin_unlock_irqrestore(&acm->write_lock, flags);
+-	return;
+-}
+-
+-static int acm_tty_put_char(struct tty_struct *tty, unsigned char ch)
+-{
+-	struct acm *acm = tty->driver_data;
+-	struct acm_wb *cur;
+-	int wbn;
+-	unsigned long flags;
+-
+-overflow:
+-	cur = acm->putbuffer;
+-	if (!cur) {
+-		spin_lock_irqsave(&acm->write_lock, flags);
+-		wbn = acm_wb_alloc(acm);
+-		if (wbn >= 0) {
+-			cur = &acm->wb[wbn];
+-			acm->putbuffer = cur;
+-		}
+-		spin_unlock_irqrestore(&acm->write_lock, flags);
+-		if (!cur)
+-			return 0;
+-	}
+-
+-	if (cur->len == acm->writesize) {
+-		acm_tty_flush_chars(tty);
+-		goto overflow;
+-	}
+-
+-	cur->buf[cur->len++] = ch;
+-	return 1;
+-}
+-
+ static int acm_tty_write_room(struct tty_struct *tty)
+ {
+ 	struct acm *acm = tty->driver_data;
+@@ -1940,8 +1869,6 @@ static const struct tty_operations acm_ops = {
+ 	.cleanup =		acm_tty_cleanup,
+ 	.hangup =		acm_tty_hangup,
+ 	.write =		acm_tty_write,
+-	.put_char =		acm_tty_put_char,
+-	.flush_chars =		acm_tty_flush_chars,
+ 	.write_room =		acm_tty_write_room,
+ 	.ioctl =		acm_tty_ioctl,
+ 	.throttle =		acm_tty_throttle,
+diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
+index 1f1eabfd8462..b30ac5fcde68 100644
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -94,7 +94,6 @@ struct acm {
+ 	unsigned long read_urbs_free;
+ 	struct urb *read_urbs[ACM_NR];
+ 	struct acm_rb read_buffers[ACM_NR];
+-	struct acm_wb *putbuffer;			/* for acm_tty_put_char() */
+ 	int rx_buflimit;
+ 	spinlock_t read_lock;
+ 	int write_used;					/* number of non-empty write buffers */
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 9f001659807a..adc0f78dc54d 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -470,7 +470,7 @@ static int service_outstanding_interrupt(struct wdm_device *desc)
+ 
+ 	set_bit(WDM_RESPONDING, &desc->flags);
+ 	spin_unlock_irq(&desc->iuspin);
+-	rv = usb_submit_urb(desc->response, GFP_KERNEL);
++	rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+ 	spin_lock_irq(&desc->iuspin);
+ 	if (rv) {
+ 		dev_err(&desc->intf->dev,
+diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
+index 7859d738df41..7af23b215254 100644
+--- a/drivers/usb/core/hcd-pci.c
++++ b/drivers/usb/core/hcd-pci.c
+@@ -528,8 +528,6 @@ static int resume_common(struct device *dev, int event)
+ 				event == PM_EVENT_RESTORE);
+ 		if (retval) {
+ 			dev_err(dev, "PCI post-resume error %d!\n", retval);
+-			if (hcd->shared_hcd)
+-				usb_hc_died(hcd->shared_hcd);
+ 			usb_hc_died(hcd);
+ 		}
+ 	}
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index 9cb66475c211..c0c5d5b3ec40 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1279,6 +1279,11 @@ void usb_enable_interface(struct usb_device *dev,
+  * is submitted that needs that bandwidth.  Some other operating systems
+  * allocate bandwidth early, when a configuration is chosen.
+  *
++ * xHCI reserves bandwidth and configures the alternate setting in
++ * usb_hcd_alloc_bandwidth(). If it fails the original interface altsetting
++ * may be disabled. Drivers cannot rely on any particular alternate
++ * setting being in effect after a failure.
++ *
+  * This call is synchronous, and may not be used in an interrupt context.
+  * Also, drivers must not change altsettings while urbs are scheduled for
+  * endpoints in that interface; all such urbs must first be completed
+@@ -1314,6 +1319,12 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate)
+ 			 alternate);
+ 		return -EINVAL;
+ 	}
++	/*
++	 * usb3 hosts configure the interface in usb_hcd_alloc_bandwidth,
++	 * including freeing dropped endpoint ring buffers.
++	 * Make sure the interface endpoints are flushed before that
++	 */
++	usb_disable_interface(dev, iface, false);
+ 
+ 	/* Make sure we have enough bandwidth for this alternate interface.
+ 	 * Remove the current alt setting and add the new alt setting.
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 99f67764765f..37a5e07b3488 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* CBM - Flash disk */
+ 	{ USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
++	/* WORLDE Controller KS49 or Prodipe MIDI 49C USB controller */
++	{ USB_DEVICE(0x0218, 0x0201), .driver_info =
++			USB_QUIRK_CONFIG_INTF_STRINGS },
++
+ 	/* WORLDE easy key (easykey.25) MIDI controller  */
+ 	{ USB_DEVICE(0x0218, 0x0401), .driver_info =
+ 			USB_QUIRK_CONFIG_INTF_STRINGS },
+@@ -259,6 +263,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	{ USB_DEVICE(0x2040, 0x7200), .driver_info =
+ 			USB_QUIRK_CONFIG_INTF_STRINGS },
+ 
++	/* DJI CineSSD */
++	{ USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
++
+ 	/* INTEL VALUE SSD */
+ 	{ USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
+index d133252ef2c3..7a8c36642293 100644
+--- a/drivers/usb/gadget/udc/net2280.c
++++ b/drivers/usb/gadget/udc/net2280.c
+@@ -1549,11 +1549,14 @@ static int net2280_pullup(struct usb_gadget *_gadget, int is_on)
+ 		writel(tmp | BIT(USB_DETECT_ENABLE), &dev->usb->usbctl);
+ 	} else {
+ 		writel(tmp & ~BIT(USB_DETECT_ENABLE), &dev->usb->usbctl);
+-		stop_activity(dev, dev->driver);
++		stop_activity(dev, NULL);
+ 	}
+ 
+ 	spin_unlock_irqrestore(&dev->lock, flags);
+ 
++	if (!is_on && dev->driver)
++		dev->driver->disconnect(&dev->gadget);
++
+ 	return 0;
+ }
+ 
+@@ -2470,8 +2473,11 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver)
+ 		nuke(&dev->ep[i]);
+ 
+ 	/* report disconnect; the driver is already quiesced */
+-	if (driver)
++	if (driver) {
++		spin_unlock(&dev->lock);
+ 		driver->disconnect(&dev->gadget);
++		spin_lock(&dev->lock);
++	}
+ 
+ 	usb_reinit(dev);
+ }
+@@ -3345,6 +3351,8 @@ next_endpoints:
+ 		BIT(PCI_RETRY_ABORT_INTERRUPT))
+ 
+ static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
++__releases(dev->lock)
++__acquires(dev->lock)
+ {
+ 	struct net2280_ep	*ep;
+ 	u32			tmp, num, mask, scratch;
+@@ -3385,12 +3393,14 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
+ 			if (disconnect || reset) {
+ 				stop_activity(dev, dev->driver);
+ 				ep0_start(dev);
++				spin_unlock(&dev->lock);
+ 				if (reset)
+ 					usb_gadget_udc_reset
+ 						(&dev->gadget, dev->driver);
+ 				else
+ 					(dev->driver->disconnect)
+ 						(&dev->gadget);
++				spin_lock(&dev->lock);
+ 				return;
+ 			}
+ 		}
+@@ -3409,6 +3419,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
+ 	tmp = BIT(SUSPEND_REQUEST_CHANGE_INTERRUPT);
+ 	if (stat & tmp) {
+ 		writel(tmp, &dev->regs->irqstat1);
++		spin_unlock(&dev->lock);
+ 		if (stat & BIT(SUSPEND_REQUEST_INTERRUPT)) {
+ 			if (dev->driver->suspend)
+ 				dev->driver->suspend(&dev->gadget);
+@@ -3419,6 +3430,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
+ 				dev->driver->resume(&dev->gadget);
+ 			/* at high speed, note erratum 0133 */
+ 		}
++		spin_lock(&dev->lock);
+ 		stat &= ~tmp;
+ 	}
+ 
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index b1ae944c83a9..924c08ab0724 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -628,12 +628,15 @@ static void usb3_irq_epc_int_1_speed(struct renesas_usb3 *usb3)
+ 	switch (speed) {
+ 	case USB_STA_SPEED_SS:
+ 		usb3->gadget.speed = USB_SPEED_SUPER;
++		usb3->gadget.ep0->maxpacket = USB3_EP0_SS_MAX_PACKET_SIZE;
+ 		break;
+ 	case USB_STA_SPEED_HS:
+ 		usb3->gadget.speed = USB_SPEED_HIGH;
++		usb3->gadget.ep0->maxpacket = USB3_EP0_HSFS_MAX_PACKET_SIZE;
+ 		break;
+ 	case USB_STA_SPEED_FS:
+ 		usb3->gadget.speed = USB_SPEED_FULL;
++		usb3->gadget.ep0->maxpacket = USB3_EP0_HSFS_MAX_PACKET_SIZE;
+ 		break;
+ 	default:
+ 		usb3->gadget.speed = USB_SPEED_UNKNOWN;
+@@ -1858,7 +1861,7 @@ static int renesas_usb3_init_ep(struct renesas_usb3 *usb3, struct device *dev,
+ 			/* for control pipe */
+ 			usb3->gadget.ep0 = &usb3_ep->ep;
+ 			usb_ep_set_maxpacket_limit(&usb3_ep->ep,
+-						USB3_EP0_HSFS_MAX_PACKET_SIZE);
++						USB3_EP0_SS_MAX_PACKET_SIZE);
+ 			usb3_ep->ep.caps.type_control = true;
+ 			usb3_ep->ep.caps.dir_in = true;
+ 			usb3_ep->ep.caps.dir_out = true;
+diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c
+index 43d52931b5bf..43618976d68a 100644
+--- a/drivers/usb/host/u132-hcd.c
++++ b/drivers/usb/host/u132-hcd.c
+@@ -2559,7 +2559,7 @@ static int u132_get_frame(struct usb_hcd *hcd)
+ 	} else {
+ 		int frame = 0;
+ 		dev_err(&u132->platform_dev->dev, "TODO: u132_get_frame\n");
+-		msleep(100);
++		mdelay(100);
+ 		return frame;
+ 	}
+ }
+diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
+index 9ff66525924e..e77465a30ac6 100644
+--- a/drivers/usb/misc/uss720.c
++++ b/drivers/usb/misc/uss720.c
+@@ -385,7 +385,7 @@ static unsigned char parport_uss720_frob_control(struct parport *pp, unsigned ch
+ 	mask &= 0x0f;
+ 	val &= 0x0f;
+ 	d = (priv->reg[1] & (~mask)) ^ val;
+-	if (set_1284_register(pp, 2, d, GFP_KERNEL))
++	if (set_1284_register(pp, 2, d, GFP_ATOMIC))
+ 		return 0;
+ 	priv->reg[1] = d;
+ 	return d & 0xf;
+@@ -395,7 +395,7 @@ static unsigned char parport_uss720_read_status(struct parport *pp)
+ {
+ 	unsigned char ret;
+ 
+-	if (get_1284_register(pp, 1, &ret, GFP_KERNEL))
++	if (get_1284_register(pp, 1, &ret, GFP_ATOMIC))
+ 		return 0;
+ 	return ret & 0xf8;
+ }
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index f36968ee2e70..e36c6c6452cd 100644
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -431,13 +431,13 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
+ {
+ 	struct usb_yurex *dev;
+ 	int i, set = 0, retval = 0;
+-	char buffer[16];
++	char buffer[16 + 1];
+ 	char *data = buffer;
+ 	unsigned long long c, c2 = 0;
+ 	signed long timeout = 0;
+ 	DEFINE_WAIT(wait);
+ 
+-	count = min(sizeof(buffer), count);
++	count = min(sizeof(buffer) - 1, count);
+ 	dev = file->private_data;
+ 
+ 	/* verify that we actually have some data to write */
+@@ -456,6 +456,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
+ 		retval = -EFAULT;
+ 		goto error;
+ 	}
++	buffer[count] = 0;
+ 	memset(dev->cntl_buffer, CMD_PADDING, YUREX_BUF_SIZE);
+ 
+ 	switch (buffer[0]) {
+diff --git a/drivers/usb/serial/io_ti.h b/drivers/usb/serial/io_ti.h
+index 1bd67b24f916..bc9ff5ebd67c 100644
+--- a/drivers/usb/serial/io_ti.h
++++ b/drivers/usb/serial/io_ti.h
+@@ -178,7 +178,7 @@ struct ump_interrupt {
+ }  __attribute__((packed));
+ 
+ 
+-#define TIUMP_GET_PORT_FROM_CODE(c)	(((c) >> 4) - 3)
++#define TIUMP_GET_PORT_FROM_CODE(c)	(((c) >> 6) & 0x01)
+ #define TIUMP_GET_FUNC_FROM_CODE(c)	((c) & 0x0f)
+ #define TIUMP_INTERRUPT_CODE_LSR	0x03
+ #define TIUMP_INTERRUPT_CODE_MSR	0x04
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index 6bcb874b4832..836cb93ba49e 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -1129,7 +1129,7 @@ static void ti_break(struct tty_struct *tty, int break_state)
+ 
+ static int ti_get_port_from_code(unsigned char code)
+ {
+-	return (code >> 4) - 3;
++	return (code >> 6) & 0x01;
+ }
+ 
+ static int ti_get_func_from_code(unsigned char code)
+diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
+index 8cd2926fb1fe..344ec8631481 100644
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -392,6 +392,15 @@ static int queuecommand_lck(struct scsi_cmnd *srb,
+ 		return 0;
+ 	}
+ 
++	if ((us->fflags & US_FL_NO_ATA_1X) &&
++			(srb->cmnd[0] == ATA_12 || srb->cmnd[0] == ATA_16)) {
++		memcpy(srb->sense_buffer, usb_stor_sense_invalidCDB,
++		       sizeof(usb_stor_sense_invalidCDB));
++		srb->result = SAM_STAT_CHECK_CONDITION;
++		done(srb);
++		return 0;
++	}
++
+ 	/* enqueue the command and wake up the control thread */
+ 	srb->scsi_done = done;
+ 	us->srb = srb;
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index 8dd200f92020..64af88977b03 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -842,6 +842,27 @@ static int uas_slave_configure(struct scsi_device *sdev)
+ 		sdev->skip_ms_page_8 = 1;
+ 		sdev->wce_default_on = 1;
+ 	}
++
++	/*
++	 * Some disks return the total number of blocks in response
++	 * to READ CAPACITY rather than the highest block number.
++	 * If this device makes that mistake, tell the sd driver.
++	 */
++	if (devinfo->flags & US_FL_FIX_CAPACITY)
++		sdev->fix_capacity = 1;
++
++	/*
++	 * Some devices don't like MODE SENSE with page=0x3f,
++	 * which is the command used for checking if a device
++	 * is write-protected.  Now that we tell the sd driver
++	 * to do a 192-byte transfer with this command the
++	 * majority of devices work fine, but a few still can't
++	 * handle it.  The sd driver will simply assume those
++	 * devices are write-enabled.
++	 */
++	if (devinfo->flags & US_FL_NO_WP_DETECT)
++		sdev->skip_ms_page_3f = 1;
++
+ 	scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
+ 	return 0;
+ }
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index fc5ed351defb..0a86b3f3638e 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2307,6 +2307,13 @@ UNUSUAL_DEV(  0x2735, 0x100b, 0x0000, 0x9999,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_GO_SLOW ),
+ 
++/* Reported-by: Tim Anderson <tsa@×××××××××××××××.com> */
++UNUSUAL_DEV(  0x2ca3, 0x0031, 0x0000, 0x9999,
++		"DJI",
++		"CineSSD",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_NO_ATA_1X),
++
+ /*
+  * Reported by Frederic Marchal <frederic.marchal@××××××××××.com>
+  * Mio Moov 330
+diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c
+index 2510fa728d77..de119f11b78f 100644
+--- a/drivers/video/fbdev/core/modedb.c
++++ b/drivers/video/fbdev/core/modedb.c
+@@ -644,7 +644,7 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info,
+  *
+  *     Valid mode specifiers for @mode_option:
+  *
+- *     <xres>x<yres>[M][R][-<bpp>][@<refresh>][i][m] or
++ *     <xres>x<yres>[M][R][-<bpp>][@<refresh>][i][p][m] or
+  *     <name>[-<bpp>][@<refresh>]
+  *
+  *     with <xres>, <yres>, <bpp> and <refresh> decimal numbers and
+@@ -653,10 +653,10 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info,
+  *      If 'M' is present after yres (and before refresh/bpp if present),
+  *      the function will compute the timings using VESA(tm) Coordinated
+  *      Video Timings (CVT).  If 'R' is present after 'M', will compute with
+- *      reduced blanking (for flatpanels).  If 'i' is present, compute
+- *      interlaced mode.  If 'm' is present, add margins equal to 1.8%
+- *      of xres rounded down to 8 pixels, and 1.8% of yres. The char
+- *      'i' and 'm' must be after 'M' and 'R'. Example:
++ *      reduced blanking (for flatpanels).  If 'i' or 'p' are present, compute
++ *      interlaced or progressive mode.  If 'm' is present, add margins equal
++ *      to 1.8% of xres rounded down to 8 pixels, and 1.8% of yres. The chars
++ *      'i', 'p' and 'm' must be after 'M' and 'R'. Example:
+  *
+  *      1024x768MR-8@60m - Reduced blank with margins at 60Hz.
+  *
+@@ -697,7 +697,8 @@ int fb_find_mode(struct fb_var_screeninfo *var,
+ 		unsigned int namelen = strlen(name);
+ 		int res_specified = 0, bpp_specified = 0, refresh_specified = 0;
+ 		unsigned int xres = 0, yres = 0, bpp = default_bpp, refresh = 0;
+-		int yres_specified = 0, cvt = 0, rb = 0, interlace = 0;
++		int yres_specified = 0, cvt = 0, rb = 0;
++		int interlace_specified = 0, interlace = 0;
+ 		int margins = 0;
+ 		u32 best, diff, tdiff;
+ 
+@@ -748,9 +749,17 @@ int fb_find_mode(struct fb_var_screeninfo *var,
+ 				if (!cvt)
+ 					margins = 1;
+ 				break;
++			case 'p':
++				if (!cvt) {
++					interlace = 0;
++					interlace_specified = 1;
++				}
++				break;
+ 			case 'i':
+-				if (!cvt)
++				if (!cvt) {
+ 					interlace = 1;
++					interlace_specified = 1;
++				}
+ 				break;
+ 			default:
+ 				goto done;
+@@ -819,11 +828,21 @@ done:
+ 			if ((name_matches(db[i], name, namelen) ||
+ 			     (res_specified && res_matches(db[i], xres, yres))) &&
+ 			    !fb_try_mode(var, info, &db[i], bpp)) {
+-				if (refresh_specified && db[i].refresh == refresh)
+-					return 1;
++				const int db_interlace = (db[i].vmode &
++					FB_VMODE_INTERLACED ? 1 : 0);
++				int score = abs(db[i].refresh - refresh);
++
++				if (interlace_specified)
++					score += abs(db_interlace - interlace);
++
++				if (!interlace_specified ||
++				    db_interlace == interlace)
++					if (refresh_specified &&
++					    db[i].refresh == refresh)
++						return 1;
+ 
+-				if (abs(db[i].refresh - refresh) < diff) {
+-					diff = abs(db[i].refresh - refresh);
++				if (score < diff) {
++					diff = score;
+ 					best = i;
+ 				}
+ 			}
+diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c
+index 7f6c9e6cfc6c..14a93cb21310 100644
+--- a/drivers/video/fbdev/goldfishfb.c
++++ b/drivers/video/fbdev/goldfishfb.c
+@@ -301,6 +301,7 @@ static int goldfish_fb_remove(struct platform_device *pdev)
+ 	dma_free_coherent(&pdev->dev, framesize, (void *)fb->fb.screen_base,
+ 						fb->fb.fix.smem_start);
+ 	iounmap(fb->reg_base);
++	kfree(fb);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c
+index 6429f33167f5..77c97c697fea 100644
+--- a/drivers/video/fbdev/omap/omapfb_main.c
++++ b/drivers/video/fbdev/omap/omapfb_main.c
+@@ -956,7 +956,7 @@ int omapfb_register_client(struct omapfb_notifier_block *omapfb_nb,
+ {
+ 	int r;
+ 
+-	if ((unsigned)omapfb_nb->plane_idx > OMAPFB_PLANE_NUM)
++	if ((unsigned)omapfb_nb->plane_idx >= OMAPFB_PLANE_NUM)
+ 		return -EINVAL;
+ 
+ 	if (!notifier_inited) {
+diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c
+index ef73f14d7ba0..8503310a3816 100644
+--- a/drivers/video/fbdev/pxafb.c
++++ b/drivers/video/fbdev/pxafb.c
+@@ -2128,8 +2128,8 @@ static int of_get_pxafb_display(struct device *dev, struct device_node *disp,
+ 		return -EINVAL;
+ 
+ 	ret = -ENOMEM;
+-	info->modes = kmalloc_array(timings->num_timings,
+-				    sizeof(info->modes[0]), GFP_KERNEL);
++	info->modes = kcalloc(timings->num_timings, sizeof(info->modes[0]),
++			      GFP_KERNEL);
+ 	if (!info->modes)
+ 		goto out;
+ 	info->num_modes = timings->num_timings;
+diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c
+index badee04ef496..71b5dca95bdb 100644
+--- a/drivers/video/fbdev/via/viafbdev.c
++++ b/drivers/video/fbdev/via/viafbdev.c
+@@ -19,6 +19,7 @@
+  * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+  */
+ 
++#include <linux/compiler.h>
+ #include <linux/module.h>
+ #include <linux/seq_file.h>
+ #include <linux/slab.h>
+@@ -1468,7 +1469,7 @@ static const struct file_operations viafb_vt1636_proc_fops = {
+ 
+ #endif /* CONFIG_FB_VIA_DIRECT_PROCFS */
+ 
+-static int viafb_sup_odev_proc_show(struct seq_file *m, void *v)
++static int __maybe_unused viafb_sup_odev_proc_show(struct seq_file *m, void *v)
+ {
+ 	via_odev_to_seq(m, supported_odev_map[
+ 		viaparinfo->shared->chip_info.gfx_chip_name]);
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index a4fabf60d5ee..e7e25a86bbff 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1706,7 +1706,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
+ 		const struct user_regset *regset = &view->regsets[i];
+ 		do_thread_regset_writeback(t->task, regset);
+ 		if (regset->core_note_type && regset->get &&
+-		    (!regset->active || regset->active(t->task, regset))) {
++		    (!regset->active || regset->active(t->task, regset) > 0)) {
+ 			int ret;
+ 			size_t size = regset->n * regset->size;
+ 			void *data = kmalloc(size, GFP_KERNEL);
+diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
+index a27fc8791551..ef24b4527459 100644
+--- a/fs/cifs/readdir.c
++++ b/fs/cifs/readdir.c
+@@ -376,8 +376,15 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level)
+ 
+ 		new_entry = old_entry + sizeof(FIND_FILE_STANDARD_INFO) +
+ 				pfData->FileNameLength;
+-	} else
+-		new_entry = old_entry + le32_to_cpu(pDirInfo->NextEntryOffset);
++	} else {
++		u32 next_offset = le32_to_cpu(pDirInfo->NextEntryOffset);
++
++		if (old_entry + next_offset < old_entry) {
++			cifs_dbg(VFS, "invalid offset %u\n", next_offset);
++			return NULL;
++		}
++		new_entry = old_entry + next_offset;
++	}
+ 	cifs_dbg(FYI, "new entry %p old entry %p\n", new_entry, old_entry);
+ 	/* validate that new_entry is not past end of SMB */
+ 	if (new_entry >= end_of_smb) {
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 383cf8148fe7..50251a8af0ce 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2565,33 +2565,38 @@ num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size)
+ 	int len;
+ 	unsigned int entrycount = 0;
+ 	unsigned int next_offset = 0;
+-	FILE_DIRECTORY_INFO *entryptr;
++	char *entryptr;
++	FILE_DIRECTORY_INFO *dir_info;
+ 
+ 	if (bufstart == NULL)
+ 		return 0;
+ 
+-	entryptr = (FILE_DIRECTORY_INFO *)bufstart;
++	entryptr = bufstart;
+ 
+ 	while (1) {
+-		entryptr = (FILE_DIRECTORY_INFO *)
+-					((char *)entryptr + next_offset);
+-
+-		if ((char *)entryptr + size > end_of_buf) {
++		if (entryptr + next_offset < entryptr ||
++		    entryptr + next_offset > end_of_buf ||
++		    entryptr + next_offset + size > end_of_buf) {
+ 			cifs_dbg(VFS, "malformed search entry would overflow\n");
+ 			break;
+ 		}
+ 
+-		len = le32_to_cpu(entryptr->FileNameLength);
+-		if ((char *)entryptr + len + size > end_of_buf) {
++		entryptr = entryptr + next_offset;
++		dir_info = (FILE_DIRECTORY_INFO *)entryptr;
++
++		len = le32_to_cpu(dir_info->FileNameLength);
++		if (entryptr + len < entryptr ||
++		    entryptr + len > end_of_buf ||
++		    entryptr + len + size > end_of_buf) {
+ 			cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n",
+ 				 end_of_buf);
+ 			break;
+ 		}
+ 
+-		*lastentry = (char *)entryptr;
++		*lastentry = entryptr;
+ 		entrycount++;
+ 
+-		next_offset = le32_to_cpu(entryptr->NextEntryOffset);
++		next_offset = le32_to_cpu(dir_info->NextEntryOffset);
+ 		if (!next_offset)
+ 			break;
+ 	}
+diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
+index 56fb26127fef..d2a1a79fa324 100644
+--- a/fs/configfs/dir.c
++++ b/fs/configfs/dir.c
+@@ -1777,6 +1777,16 @@ void configfs_unregister_group(struct config_group *group)
+ 	struct dentry *dentry = group->cg_item.ci_dentry;
+ 	struct dentry *parent = group->cg_item.ci_parent->ci_dentry;
+ 
++	mutex_lock(&subsys->su_mutex);
++	if (!group->cg_item.ci_parent->ci_group) {
++		/*
++		 * The parent has already been unlinked and detached
++		 * due to a rmdir.
++		 */
++		goto unlink_group;
++	}
++	mutex_unlock(&subsys->su_mutex);
++
+ 	inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
+ 	spin_lock(&configfs_dirent_lock);
+ 	configfs_detach_prep(dentry, NULL);
+@@ -1791,6 +1801,7 @@ void configfs_unregister_group(struct config_group *group)
+ 	dput(dentry);
+ 
+ 	mutex_lock(&subsys->su_mutex);
++unlink_group:
+ 	unlink_group(group);
+ 	mutex_unlock(&subsys->su_mutex);
+ }
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index fc5da4cbe88c..39af17b407f0 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -1472,7 +1472,7 @@ int gfs2_write_alloc_required(struct gfs2_inode *ip, u64 offset,
+ 	end_of_file = (i_size_read(&ip->i_inode) + sdp->sd_sb.sb_bsize - 1) >> shift;
+ 	lblock = offset >> shift;
+ 	lblock_stop = (offset + len + sdp->sd_sb.sb_bsize - 1) >> shift;
+-	if (lblock_stop > end_of_file)
++	if (lblock_stop > end_of_file && ip != GFS2_I(sdp->sd_rindex))
+ 		return 1;
+ 
+ 	size = (lblock_stop - lblock) << shift;
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 86ccc0159393..832824994aae 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1675,7 +1675,8 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext,
+ 
+ 	while(1) {
+ 		bi = rbm_bi(rbm);
+-		if (test_bit(GBF_FULL, &bi->bi_flags) &&
++		if ((ip == NULL || !gfs2_rs_active(&ip->i_res)) &&
++		    test_bit(GBF_FULL, &bi->bi_flags) &&
+ 		    (state == GFS2_BLKST_FREE))
+ 			goto next_bitmap;
+ 
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index e7ca62a86dab..eb55ab6930b5 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2539,14 +2539,18 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state)
+ 	}
+ 
+ 	nfs4_stateid_copy(&stateid, &delegation->stateid);
+-	if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags) ||
+-		!test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED,
+-			&delegation->flags)) {
++	if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags)) {
+ 		rcu_read_unlock();
+ 		nfs_finish_clear_delegation_stateid(state, &stateid);
+ 		return;
+ 	}
+ 
++	if (!test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED,
++				&delegation->flags)) {
++		rcu_read_unlock();
++		return;
++	}
++
+ 	cred = get_rpccred(delegation->cred);
+ 	rcu_read_unlock();
+ 	status = nfs41_test_and_free_expired_stateid(server, &stateid, cred);
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 353691366fca..857af951831f 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1336,6 +1336,8 @@ int nfs4_schedule_stateid_recovery(const struct nfs_server *server, struct nfs4_
+ 
+ 	if (!nfs4_state_mark_reclaim_nograce(clp, state))
+ 		return -EBADF;
++	nfs_inode_find_delegation_state_and_recover(state->inode,
++			&state->stateid);
+ 	dprintk("%s: scheduling stateid recovery for server %s\n", __func__,
+ 			clp->cl_hostname);
+ 	nfs4_schedule_state_manager(clp);
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index e11672aa4575..ecdb3baa1283 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -421,7 +421,12 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size,
+ 	vaddr = vmap(pages, page_count, VM_MAP, prot);
+ 	kfree(pages);
+ 
+-	return vaddr;
++	/*
++	 * Since vmap() uses page granularity, we must add the offset
++	 * into the page here, to get the byte granularity address
++	 * into the mapping to represent the actual "start" location.
++	 */
++	return vaddr + offset_in_page(start);
+ }
+ 
+ static void *persistent_ram_iomap(phys_addr_t start, size_t size,
+@@ -440,6 +445,11 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size,
+ 	else
+ 		va = ioremap_wc(start, size);
+ 
++	/*
++	 * Since request_mem_region() and ioremap() are byte-granularity
++	 * there is no need handle anything special like we do when the
++	 * vmap() case in persistent_ram_vmap() above.
++	 */
+ 	return va;
+ }
+ 
+@@ -460,7 +470,7 @@ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size,
+ 		return -ENOMEM;
+ 	}
+ 
+-	prz->buffer = prz->vaddr + offset_in_page(start);
++	prz->buffer = prz->vaddr;
+ 	prz->buffer_size = size - sizeof(struct persistent_ram_buffer);
+ 
+ 	return 0;
+@@ -507,7 +517,8 @@ void persistent_ram_free(struct persistent_ram_zone *prz)
+ 
+ 	if (prz->vaddr) {
+ 		if (pfn_valid(prz->paddr >> PAGE_SHIFT)) {
+-			vunmap(prz->vaddr);
++			/* We must vunmap() at page-granularity. */
++			vunmap(prz->vaddr - offset_in_page(prz->paddr));
+ 		} else {
+ 			iounmap(prz->vaddr);
+ 			release_mem_region(prz->paddr, prz->size);
+diff --git a/include/linux/crypto.h b/include/linux/crypto.h
+index 8edb3ba6f640..9de26962338e 100644
+--- a/include/linux/crypto.h
++++ b/include/linux/crypto.h
+@@ -108,6 +108,11 @@
+  */
+ #define CRYPTO_ALG_OPTIONAL_KEY		0x00004000
+ 
++/*
++ * Don't trigger module loading
++ */
++#define CRYPTO_NOLOAD			0x00008000
++
+ /*
+  * Transform masks and values (for crt_flags).
+  */
+diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
+index 7751d72a6a40..859fd209603a 100644
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -786,7 +786,7 @@ void mlx5_unmap_free_uar(struct mlx5_core_dev *mdev, struct mlx5_uar *uar);
+ void mlx5_health_cleanup(struct mlx5_core_dev *dev);
+ int mlx5_health_init(struct mlx5_core_dev *dev);
+ void mlx5_start_health_poll(struct mlx5_core_dev *dev);
+-void mlx5_stop_health_poll(struct mlx5_core_dev *dev);
++void mlx5_stop_health_poll(struct mlx5_core_dev *dev, bool disable_health);
+ void mlx5_drain_health_wq(struct mlx5_core_dev *dev);
+ void mlx5_drain_health_recovery(struct mlx5_core_dev *dev);
+ int mlx5_buf_alloc_node(struct mlx5_core_dev *dev, int size,
+diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
+index 690e1e3c59f7..f036b6ada6ef 100644
+--- a/kernel/audit_watch.c
++++ b/kernel/audit_watch.c
+@@ -419,6 +419,13 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list)
+ 	struct path parent_path;
+ 	int h, ret = 0;
+ 
++	/*
++	 * When we will be calling audit_add_to_parent, krule->watch might have
++	 * been updated and watch might have been freed.
++	 * So we need to keep a reference of watch.
++	 */
++	audit_get_watch(watch);
++
+ 	mutex_unlock(&audit_filter_mutex);
+ 
+ 	/* Avoid calling path_lookup under audit_filter_mutex. */
+@@ -427,8 +434,10 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list)
+ 	/* caller expects mutex locked */
+ 	mutex_lock(&audit_filter_mutex);
+ 
+-	if (ret)
++	if (ret) {
++		audit_put_watch(watch);
+ 		return ret;
++	}
+ 
+ 	/* either find an old parent or attach a new one */
+ 	parent = audit_find_parent(d_backing_inode(parent_path.dentry));
+@@ -446,6 +455,7 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list)
+ 	*list = &audit_inode_hash[h];
+ error:
+ 	path_put(&parent_path);
++	audit_put_watch(watch);
+ 	return ret;
+ }
+ 
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 6e6ec229c780..95bd00d9f2c3 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5563,6 +5563,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
+ 		unsigned long sp;
+ 		unsigned int rem;
+ 		u64 dyn_size;
++		mm_segment_t fs;
+ 
+ 		/*
+ 		 * We dump:
+@@ -5580,7 +5581,10 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
+ 
+ 		/* Data. */
+ 		sp = perf_user_stack_pointer(regs);
++		fs = get_fs();
++		set_fs(USER_DS);
+ 		rem = __output_copy_user(handle, (void *) sp, dump_size);
++		set_fs(fs);
+ 		dyn_size = dump_size - rem;
+ 
+ 		perf_output_skip(handle, rem);
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index d7801f6877af..e63fd12f923a 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -454,7 +454,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+ 		goto out_unlock;
+ 	}
+ 
+-	ieee80211_key_free(key, true);
++	ieee80211_key_free(key, sdata->vif.type == NL80211_IFTYPE_STATION);
+ 
+ 	ret = 0;
+  out_unlock:
+diff --git a/net/mac80211/key.c b/net/mac80211/key.c
+index 4c625a325ce2..6e02f8dfce2b 100644
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -648,11 +648,15 @@ int ieee80211_key_link(struct ieee80211_key *key,
+ {
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_key *old_key;
+-	int idx, ret;
+-	bool pairwise;
+-
+-	pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
+-	idx = key->conf.keyidx;
++	int idx = key->conf.keyidx;
++	bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
++	/*
++	 * We want to delay tailroom updates only for station - in that
++	 * case it helps roaming speed, but in other cases it hurts and
++	 * can cause warnings to appear.
++	 */
++	bool delay_tailroom = sdata->vif.type == NL80211_IFTYPE_STATION;
++	int ret;
+ 
+ 	mutex_lock(&sdata->local->key_mtx);
+ 
+@@ -680,14 +684,14 @@ int ieee80211_key_link(struct ieee80211_key *key,
+ 	increment_tailroom_need_count(sdata);
+ 
+ 	ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
+-	ieee80211_key_destroy(old_key, true);
++	ieee80211_key_destroy(old_key, delay_tailroom);
+ 
+ 	ieee80211_debugfs_key_add(key);
+ 
+ 	if (!local->wowlan) {
+ 		ret = ieee80211_key_enable_hw_accel(key);
+ 		if (ret)
+-			ieee80211_key_free(key, true);
++			ieee80211_key_free(key, delay_tailroom);
+ 	} else {
+ 		ret = 0;
+ 	}
+@@ -922,7 +926,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local,
+ 		ieee80211_key_replace(key->sdata, key->sta,
+ 				key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
+ 				key, NULL);
+-		__ieee80211_key_destroy(key, true);
++		__ieee80211_key_destroy(key, key->sdata->vif.type ==
++					NL80211_IFTYPE_STATION);
+ 	}
+ 
+ 	for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+@@ -932,7 +937,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local,
+ 		ieee80211_key_replace(key->sdata, key->sta,
+ 				key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
+ 				key, NULL);
+-		__ieee80211_key_destroy(key, true);
++		__ieee80211_key_destroy(key, key->sdata->vif.type ==
++					NL80211_IFTYPE_STATION);
+ 	}
+ 
+ 	mutex_unlock(&local->key_mtx);
+diff --git a/net/rds/bind.c b/net/rds/bind.c
+index adb53ae97a02..cc7e3a138598 100644
+--- a/net/rds/bind.c
++++ b/net/rds/bind.c
+@@ -60,11 +60,13 @@ struct rds_sock *rds_find_bound(__be32 addr, __be16 port)
+ 	u64 key = ((u64)addr << 32) | port;
+ 	struct rds_sock *rs;
+ 
+-	rs = rhashtable_lookup_fast(&bind_hash_table, &key, ht_parms);
++	rcu_read_lock();
++	rs = rhashtable_lookup(&bind_hash_table, &key, ht_parms);
+ 	if (rs && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD))
+ 		rds_sock_addref(rs);
+ 	else
+ 		rs = NULL;
++	rcu_read_unlock();
+ 
+ 	rdsdebug("returning rs %p for %pI4:%u\n", rs, &addr,
+ 		ntohs(port));
+@@ -157,6 +159,7 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ 		goto out;
+ 	}
+ 
++	sock_set_flag(sk, SOCK_RCU_FREE);
+ 	ret = rds_add_bound(rs, sin->sin_addr.s_addr, &sin->sin_port);
+ 	if (ret)
+ 		goto out;
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 1f943d97dc29..d0dcfc68c043 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1873,7 +1873,10 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
+ 	/* Try to instantiate a bundle */
+ 	err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family);
+ 	if (err <= 0) {
+-		if (err != 0 && err != -EAGAIN)
++		if (err == 0)
++			return NULL;
++
++		if (err != -EAGAIN)
+ 			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);
+ 		return ERR_PTR(err);
+ 	}
+diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
+index 63774307a751..8f8965608ee3 100644
+--- a/scripts/Kbuild.include
++++ b/scripts/Kbuild.include
+@@ -394,3 +394,6 @@ endif
+ endef
+ #
+ ###############################################################################
++
++# delete partially updated (i.e. corrupted) files on error
++.DELETE_ON_ERROR:
+diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
+index bf663915412e..6fcbd8e99baf 100644
+--- a/security/integrity/evm/evm_crypto.c
++++ b/security/integrity/evm/evm_crypto.c
+@@ -94,7 +94,8 @@ static struct shash_desc *init_desc(char type)
+ 		mutex_lock(&mutex);
+ 		if (*tfm)
+ 			goto out;
+-		*tfm = crypto_alloc_shash(algo, 0, CRYPTO_ALG_ASYNC);
++		*tfm = crypto_alloc_shash(algo, 0,
++					  CRYPTO_ALG_ASYNC | CRYPTO_NOLOAD);
+ 		if (IS_ERR(*tfm)) {
+ 			rc = PTR_ERR(*tfm);
+ 			pr_err("Can not allocate %s (reason: %ld)\n", algo, rc);
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index ca3ea985c100..fb7c534fb57d 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -3966,15 +3966,19 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
+ 	struct smack_known *skp = NULL;
+ 	int rc = 0;
+ 	struct smk_audit_info ad;
++	u16 family = sk->sk_family;
+ #ifdef CONFIG_AUDIT
+ 	struct lsm_network_audit net;
+ #endif
+ #if IS_ENABLED(CONFIG_IPV6)
+ 	struct sockaddr_in6 sadd;
+ 	int proto;
++
++	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
++		family = PF_INET;
+ #endif /* CONFIG_IPV6 */
+ 
+-	switch (sk->sk_family) {
++	switch (family) {
+ 	case PF_INET:
+ #ifdef CONFIG_SECURITY_SMACK_NETFILTER
+ 		/*
+@@ -3992,7 +3996,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
+ 		 */
+ 		netlbl_secattr_init(&secattr);
+ 
+-		rc = netlbl_skbuff_getattr(skb, sk->sk_family, &secattr);
++		rc = netlbl_skbuff_getattr(skb, family, &secattr);
+ 		if (rc == 0)
+ 			skp = smack_from_secattr(&secattr, ssp);
+ 		else
+@@ -4005,7 +4009,7 @@ access_check:
+ #endif
+ #ifdef CONFIG_AUDIT
+ 		smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+-		ad.a.u.net->family = sk->sk_family;
++		ad.a.u.net->family = family;
+ 		ad.a.u.net->netif = skb->skb_iif;
+ 		ipv4_skb_to_auditdata(skb, &ad.a, NULL);
+ #endif
+@@ -4019,7 +4023,7 @@ access_check:
+ 		rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in,
+ 					MAY_WRITE, rc);
+ 		if (rc != 0)
+-			netlbl_skbuff_err(skb, sk->sk_family, rc, 0);
++			netlbl_skbuff_err(skb, family, rc, 0);
+ 		break;
+ #if IS_ENABLED(CONFIG_IPV6)
+ 	case PF_INET6:
+@@ -4035,7 +4039,7 @@ access_check:
+ 			skp = smack_net_ambient;
+ #ifdef CONFIG_AUDIT
+ 		smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+-		ad.a.u.net->family = sk->sk_family;
++		ad.a.u.net->family = family;
+ 		ad.a.u.net->netif = skb->skb_iif;
+ 		ipv6_skb_to_auditdata(skb, &ad.a, NULL);
+ #endif /* CONFIG_AUDIT */
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 9306604f5070..f57a58ac7ae0 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -648,27 +648,33 @@ EXPORT_SYMBOL(snd_interval_refine);
+ 
+ static int snd_interval_refine_first(struct snd_interval *i)
+ {
++	const unsigned int last_max = i->max;
++
+ 	if (snd_BUG_ON(snd_interval_empty(i)))
+ 		return -EINVAL;
+ 	if (snd_interval_single(i))
+ 		return 0;
+ 	i->max = i->min;
+-	i->openmax = i->openmin;
+-	if (i->openmax)
++	if (i->openmin)
+ 		i->max++;
++	/* only exclude max value if also excluded before refine */
++	i->openmax = (i->openmax && i->max >= last_max);
+ 	return 1;
+ }
+ 
+ static int snd_interval_refine_last(struct snd_interval *i)
+ {
++	const unsigned int last_min = i->min;
++
+ 	if (snd_BUG_ON(snd_interval_empty(i)))
+ 		return -EINVAL;
+ 	if (snd_interval_single(i))
+ 		return 0;
+ 	i->min = i->max;
+-	i->openmin = i->openmax;
+-	if (i->openmin)
++	if (i->openmax)
+ 		i->min--;
++	/* only exclude min value if also excluded before refine */
++	i->openmin = (i->openmin && i->min <= last_min);
+ 	return 1;
+ }
+ 
+diff --git a/sound/isa/msnd/msnd_pinnacle.c b/sound/isa/msnd/msnd_pinnacle.c
+index a31ea6c22d19..2d7379dec1f0 100644
+--- a/sound/isa/msnd/msnd_pinnacle.c
++++ b/sound/isa/msnd/msnd_pinnacle.c
+@@ -82,10 +82,10 @@
+ 
+ static void set_default_audio_parameters(struct snd_msnd *chip)
+ {
+-	chip->play_sample_size = DEFSAMPLESIZE;
++	chip->play_sample_size = snd_pcm_format_width(DEFSAMPLESIZE);
+ 	chip->play_sample_rate = DEFSAMPLERATE;
+ 	chip->play_channels = DEFCHANNELS;
+-	chip->capture_sample_size = DEFSAMPLESIZE;
++	chip->capture_sample_size = snd_pcm_format_width(DEFSAMPLESIZE);
+ 	chip->capture_sample_rate = DEFSAMPLERATE;
+ 	chip->capture_channels = DEFCHANNELS;
+ }
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 69bf5cf1e91e..15cbe2565703 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2875,7 +2875,8 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+  */
+ 
+ #define AU0828_DEVICE(vid, pid, vname, pname) { \
+-	USB_DEVICE_VENDOR_SPEC(vid, pid), \
++	.idVendor = vid, \
++	.idProduct = pid, \
+ 	.match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
+ 		       USB_DEVICE_ID_MATCH_INT_CLASS | \
+ 		       USB_DEVICE_ID_MATCH_INT_SUBCLASS, \
+diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
+index 60a94b3e532e..177480066816 100644
+--- a/tools/hv/hv_kvp_daemon.c
++++ b/tools/hv/hv_kvp_daemon.c
+@@ -286,7 +286,7 @@ static int kvp_key_delete(int pool, const __u8 *key, int key_size)
+ 		 * Found a match; just move the remaining
+ 		 * entries up.
+ 		 */
+-		if (i == num_records) {
++		if (i == (num_records - 1)) {
+ 			kvp_file_info[pool].num_records--;
+ 			kvp_update_file(pool);
+ 			return 0;
+diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+index bd630c222e65..9a53f6e9ef43 100644
+--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c
++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+@@ -58,9 +58,13 @@ static int check_return_reg(int ra_regno, Dwarf_Frame *frame)
+ 	}
+ 
+ 	/*
+-	 * Check if return address is on the stack.
++	 * Check if return address is on the stack. If return address
++	 * is in a register (typically R0), it is yet to be saved on
++	 * the stack.
+ 	 */
+-	if (nops != 0 || ops != NULL)
++	if ((nops != 0 || ops != NULL) &&
++		!(nops == 1 && ops[0].atom == DW_OP_regx &&
++			ops[0].number2 == 0 && ops[0].offset == 0))
+ 		return 0;
+ 
+ 	/*
+@@ -246,7 +250,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain)
+ 	if (!chain || chain->nr < 3)
+ 		return skip_slot;
+ 
+-	ip = chain->ips[2];
++	ip = chain->ips[1];
+ 
+ 	thread__find_addr_location(thread, PERF_RECORD_MISC_USER,
+ 			MAP__FUNCTION, ip, &al);
+diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c
+index 778668a2a966..ade7213943ad 100644
+--- a/tools/perf/tests/builtin-test.c
++++ b/tools/perf/tests/builtin-test.c
+@@ -413,7 +413,7 @@ static int __cmd_test(int argc, const char *argv[], struct intlist *skiplist)
+ 			for (subi = 0; subi < subn; subi++) {
+ 				pr_info("%2d.%1d: %-*s:", i, subi + 1, subw,
+ 					t->subtest.get_desc(subi));
+-				err = test_and_print(t, skip, subi);
++				err = test_and_print(t, skip, subi + 1);
+ 				if (err != TEST_OK && t->subtest.skip_if_fail)
+ 					skip = true;
+ 			}
+diff --git a/tools/testing/selftests/timers/raw_skew.c b/tools/testing/selftests/timers/raw_skew.c
+index 30906bfd9c1b..0ab937a17ebb 100644
+--- a/tools/testing/selftests/timers/raw_skew.c
++++ b/tools/testing/selftests/timers/raw_skew.c
+@@ -146,6 +146,11 @@ int main(int argv, char **argc)
+ 	printf(" %lld.%i(act)", ppm/1000, abs((int)(ppm%1000)));
+ 
+ 	if (llabs(eppm - ppm) > 1000) {
++		if (tx1.offset || tx2.offset ||
++		    tx1.freq != tx2.freq || tx1.tick != tx2.tick) {
++			printf("	[SKIP]\n");
++			return ksft_exit_skip("The clock was adjusted externally. Shutdown NTPd or other time sync daemons\n");
++		}
+ 		printf("	[FAILED]\n");
+ 		return ksft_exit_fail();
+ 	}
+diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
+index 539d3f5cb619..80d8888549ee 100644
+--- a/virt/kvm/arm/vgic/vgic-init.c
++++ b/virt/kvm/arm/vgic/vgic-init.c
+@@ -241,6 +241,10 @@ int vgic_init(struct kvm *kvm)
+ 	if (vgic_initialized(kvm))
+ 		return 0;
+ 
++	/* Are we also in the middle of creating a VCPU? */
++	if (kvm->created_vcpus != atomic_read(&kvm->online_vcpus))
++		return -EBUSY;
++
+ 	/* freeze the number of spis */
+ 	if (!dist->nr_spis)
+ 		dist->nr_spis = VGIC_NR_IRQS_LEGACY - VGIC_NR_PRIVATE_IRQS;