[gentoo-commits] proj/linux-patches:4.18 commit in: /

[Mike Pagano]

commit:     54ae6ee8b5bae9dc320080c834184ead5030ce4c
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Sep 26 10:40:05 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Sep 26 10:40:05 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=54ae6ee8

Linux patch 4.18.10

 0000_README              |    4 +
 1009_linux-4.18.10.patch | 6974 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 6978 insertions(+)

diff --git a/0000_README b/0000_README
index 6534d27..a9e2bd7 100644
--- a/0000_README
+++ b/0000_README
@@ -79,6 +79,10 @@ Patch:  1008_linux-4.18.9.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.18.9
 
+Patch:  1009_linux-4.18.10.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.18.10
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1009_linux-4.18.10.patch b/1009_linux-4.18.10.patch
new file mode 100644
index 0000000..16ee162
--- /dev/null
+++ b/1009_linux-4.18.10.patch
@@ -0,0 +1,6974 @@
+diff --git a/Makefile b/Makefile
+index 1178348fb9ca..ffab15235ff0 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 18
+-SUBLEVEL = 9
++SUBLEVEL = 10
+ EXTRAVERSION =
+ NAME = Merciless Moray
+ 
+@@ -225,10 +225,12 @@ no-dot-config-targets := $(clean-targets) \
+ 			 cscope gtags TAGS tags help% %docs check% coccicheck \
+ 			 $(version_h) headers_% archheaders archscripts \
+ 			 kernelversion %src-pkg
++no-sync-config-targets := $(no-dot-config-targets) install %install
+ 
+-config-targets := 0
+-mixed-targets  := 0
+-dot-config     := 1
++config-targets  := 0
++mixed-targets   := 0
++dot-config      := 1
++may-sync-config := 1
+ 
+ ifneq ($(filter $(no-dot-config-targets), $(MAKECMDGOALS)),)
+ 	ifeq ($(filter-out $(no-dot-config-targets), $(MAKECMDGOALS)),)
+@@ -236,6 +238,16 @@ ifneq ($(filter $(no-dot-config-targets), $(MAKECMDGOALS)),)
+ 	endif
+ endif
+ 
++ifneq ($(filter $(no-sync-config-targets), $(MAKECMDGOALS)),)
++	ifeq ($(filter-out $(no-sync-config-targets), $(MAKECMDGOALS)),)
++		may-sync-config := 0
++	endif
++endif
++
++ifneq ($(KBUILD_EXTMOD),)
++	may-sync-config := 0
++endif
++
+ ifeq ($(KBUILD_EXTMOD),)
+         ifneq ($(filter config %config,$(MAKECMDGOALS)),)
+                 config-targets := 1
+@@ -610,7 +622,7 @@ ARCH_CFLAGS :=
+ include arch/$(SRCARCH)/Makefile
+ 
+ ifeq ($(dot-config),1)
+-ifeq ($(KBUILD_EXTMOD),)
++ifeq ($(may-sync-config),1)
+ # Read in dependencies to all Kconfig* files, make sure to run syncconfig if
+ # changes are detected. This should be included after arch/$(SRCARCH)/Makefile
+ # because some architectures define CROSS_COMPILE there.
+@@ -625,8 +637,9 @@ $(KCONFIG_CONFIG) include/config/auto.conf.cmd: ;
+ include/config/%.conf: $(KCONFIG_CONFIG) include/config/auto.conf.cmd
+ 	$(Q)$(MAKE) -f $(srctree)/Makefile syncconfig
+ else
+-# external modules needs include/generated/autoconf.h and include/config/auto.conf
+-# but do not care if they are up-to-date. Use auto.conf to trigger the test
++# External modules and some install targets need include/generated/autoconf.h
++# and include/config/auto.conf but do not care if they are up-to-date.
++# Use auto.conf to trigger the test
+ PHONY += include/config/auto.conf
+ 
+ include/config/auto.conf:
+@@ -638,7 +651,7 @@ include/config/auto.conf:
+ 	echo >&2 ;							\
+ 	/bin/false)
+ 
+-endif # KBUILD_EXTMOD
++endif # may-sync-config
+ 
+ else
+ # Dummy target needed, because used as prerequisite
+diff --git a/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts b/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts
+index 4dc0b347b1ee..c2dc9d09484a 100644
+--- a/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts
++++ b/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts
+@@ -189,6 +189,8 @@
+ 						regulator-max-microvolt = <2950000>;
+ 
+ 						regulator-boot-on;
++						regulator-system-load = <200000>;
++						regulator-allow-set-load;
+ 					};
+ 
+ 					l21 {
+diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c
+index d3db306a5a70..941b0ffd9806 100644
+--- a/arch/arm/mach-exynos/suspend.c
++++ b/arch/arm/mach-exynos/suspend.c
+@@ -203,6 +203,7 @@ static int __init exynos_pmu_irq_init(struct device_node *node,
+ 					  NULL);
+ 	if (!domain) {
+ 		iounmap(pmu_base_addr);
++		pmu_base_addr = NULL;
+ 		return -ENOMEM;
+ 	}
+ 
+diff --git a/arch/arm/mach-hisi/hotplug.c b/arch/arm/mach-hisi/hotplug.c
+index a129aae72602..909bb2493781 100644
+--- a/arch/arm/mach-hisi/hotplug.c
++++ b/arch/arm/mach-hisi/hotplug.c
+@@ -148,13 +148,20 @@ static int hi3xxx_hotplug_init(void)
+ 	struct device_node *node;
+ 
+ 	node = of_find_compatible_node(NULL, NULL, "hisilicon,sysctrl");
+-	if (node) {
+-		ctrl_base = of_iomap(node, 0);
+-		id = HI3620_CTRL;
+-		return 0;
++	if (!node) {
++		id = ERROR_CTRL;
++		return -ENOENT;
+ 	}
+-	id = ERROR_CTRL;
+-	return -ENOENT;
++
++	ctrl_base = of_iomap(node, 0);
++	of_node_put(node);
++	if (!ctrl_base) {
++		id = ERROR_CTRL;
++		return -ENOMEM;
++	}
++
++	id = HI3620_CTRL;
++	return 0;
+ }
+ 
+ void hi3xxx_set_cpu(int cpu, bool enable)
+@@ -173,11 +180,15 @@ static bool hix5hd2_hotplug_init(void)
+ 	struct device_node *np;
+ 
+ 	np = of_find_compatible_node(NULL, NULL, "hisilicon,cpuctrl");
+-	if (np) {
+-		ctrl_base = of_iomap(np, 0);
+-		return true;
+-	}
+-	return false;
++	if (!np)
++		return false;
++
++	ctrl_base = of_iomap(np, 0);
++	of_node_put(np);
++	if (!ctrl_base)
++		return false;
++
++	return true;
+ }
+ 
+ void hix5hd2_set_cpu(int cpu, bool enable)
+@@ -219,10 +230,10 @@ void hip01_set_cpu(int cpu, bool enable)
+ 
+ 	if (!ctrl_base) {
+ 		np = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl");
+-		if (np)
+-			ctrl_base = of_iomap(np, 0);
+-		else
+-			BUG();
++		BUG_ON(!np);
++		ctrl_base = of_iomap(np, 0);
++		of_node_put(np);
++		BUG_ON(!ctrl_base);
+ 	}
+ 
+ 	if (enable) {
+diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+index 9213c966c224..ec7ea8dca777 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -331,7 +331,7 @@
+ 		reg = <0 0x11002000 0 0x400>;
+ 		interrupts = <GIC_SPI 91 IRQ_TYPE_LEVEL_LOW>;
+ 		clocks = <&topckgen CLK_TOP_UART_SEL>,
+-			 <&pericfg CLK_PERI_UART1_PD>;
++			 <&pericfg CLK_PERI_UART0_PD>;
+ 		clock-names = "baud", "bus";
+ 		status = "disabled";
+ 	};
+diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+index 9ff848792712..78ce3979ef09 100644
+--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+@@ -338,7 +338,7 @@
+ 			led@6 {
+ 				label = "apq8016-sbc:blue:bt";
+ 				gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>;
+-				linux,default-trigger = "bt";
++				linux,default-trigger = "bluetooth-power";
+ 				default-state = "off";
+ 			};
+ 		};
+diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi
+index 0298bd0d0e1a..caf112629caa 100644
+--- a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi
++++ b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi
+@@ -58,6 +58,7 @@
+ 			clocks = <&sys_clk 32>;
+ 			enable-method = "psci";
+ 			operating-points-v2 = <&cluster0_opp>;
++			#cooling-cells = <2>;
+ 		};
+ 
+ 		cpu2: cpu@100 {
+@@ -77,6 +78,7 @@
+ 			clocks = <&sys_clk 33>;
+ 			enable-method = "psci";
+ 			operating-points-v2 = <&cluster1_opp>;
++			#cooling-cells = <2>;
+ 		};
+ 	};
+ 
+diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
+index 33147aacdafd..dd5b4fab114f 100644
+--- a/arch/arm64/kernel/perf_event.c
++++ b/arch/arm64/kernel/perf_event.c
+@@ -670,6 +670,28 @@ static void armv8pmu_disable_event(struct perf_event *event)
+ 	raw_spin_unlock_irqrestore(&events->pmu_lock, flags);
+ }
+ 
++static void armv8pmu_start(struct arm_pmu *cpu_pmu)
++{
++	unsigned long flags;
++	struct pmu_hw_events *events = this_cpu_ptr(cpu_pmu->hw_events);
++
++	raw_spin_lock_irqsave(&events->pmu_lock, flags);
++	/* Enable all counters */
++	armv8pmu_pmcr_write(armv8pmu_pmcr_read() | ARMV8_PMU_PMCR_E);
++	raw_spin_unlock_irqrestore(&events->pmu_lock, flags);
++}
++
++static void armv8pmu_stop(struct arm_pmu *cpu_pmu)
++{
++	unsigned long flags;
++	struct pmu_hw_events *events = this_cpu_ptr(cpu_pmu->hw_events);
++
++	raw_spin_lock_irqsave(&events->pmu_lock, flags);
++	/* Disable all counters */
++	armv8pmu_pmcr_write(armv8pmu_pmcr_read() & ~ARMV8_PMU_PMCR_E);
++	raw_spin_unlock_irqrestore(&events->pmu_lock, flags);
++}
++
+ static irqreturn_t armv8pmu_handle_irq(struct arm_pmu *cpu_pmu)
+ {
+ 	u32 pmovsr;
+@@ -694,6 +716,11 @@ static irqreturn_t armv8pmu_handle_irq(struct arm_pmu *cpu_pmu)
+ 	 */
+ 	regs = get_irq_regs();
+ 
++	/*
++	 * Stop the PMU while processing the counter overflows
++	 * to prevent skews in group events.
++	 */
++	armv8pmu_stop(cpu_pmu);
+ 	for (idx = 0; idx < cpu_pmu->num_events; ++idx) {
+ 		struct perf_event *event = cpuc->events[idx];
+ 		struct hw_perf_event *hwc;
+@@ -718,6 +745,7 @@ static irqreturn_t armv8pmu_handle_irq(struct arm_pmu *cpu_pmu)
+ 		if (perf_event_overflow(event, &data, regs))
+ 			cpu_pmu->disable(event);
+ 	}
++	armv8pmu_start(cpu_pmu);
+ 
+ 	/*
+ 	 * Handle the pending perf events.
+@@ -731,28 +759,6 @@ static irqreturn_t armv8pmu_handle_irq(struct arm_pmu *cpu_pmu)
+ 	return IRQ_HANDLED;
+ }
+ 
+-static void armv8pmu_start(struct arm_pmu *cpu_pmu)
+-{
+-	unsigned long flags;
+-	struct pmu_hw_events *events = this_cpu_ptr(cpu_pmu->hw_events);
+-
+-	raw_spin_lock_irqsave(&events->pmu_lock, flags);
+-	/* Enable all counters */
+-	armv8pmu_pmcr_write(armv8pmu_pmcr_read() | ARMV8_PMU_PMCR_E);
+-	raw_spin_unlock_irqrestore(&events->pmu_lock, flags);
+-}
+-
+-static void armv8pmu_stop(struct arm_pmu *cpu_pmu)
+-{
+-	unsigned long flags;
+-	struct pmu_hw_events *events = this_cpu_ptr(cpu_pmu->hw_events);
+-
+-	raw_spin_lock_irqsave(&events->pmu_lock, flags);
+-	/* Disable all counters */
+-	armv8pmu_pmcr_write(armv8pmu_pmcr_read() & ~ARMV8_PMU_PMCR_E);
+-	raw_spin_unlock_irqrestore(&events->pmu_lock, flags);
+-}
+-
+ static int armv8pmu_get_event_idx(struct pmu_hw_events *cpuc,
+ 				  struct perf_event *event)
+ {
+diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
+index 5c338ce5a7fa..db5440339ab3 100644
+--- a/arch/arm64/kernel/ptrace.c
++++ b/arch/arm64/kernel/ptrace.c
+@@ -277,19 +277,22 @@ static int ptrace_hbp_set_event(unsigned int note_type,
+ 
+ 	switch (note_type) {
+ 	case NT_ARM_HW_BREAK:
+-		if (idx < ARM_MAX_BRP) {
+-			tsk->thread.debug.hbp_break[idx] = bp;
+-			err = 0;
+-		}
++		if (idx >= ARM_MAX_BRP)
++			goto out;
++		idx = array_index_nospec(idx, ARM_MAX_BRP);
++		tsk->thread.debug.hbp_break[idx] = bp;
++		err = 0;
+ 		break;
+ 	case NT_ARM_HW_WATCH:
+-		if (idx < ARM_MAX_WRP) {
+-			tsk->thread.debug.hbp_watch[idx] = bp;
+-			err = 0;
+-		}
++		if (idx >= ARM_MAX_WRP)
++			goto out;
++		idx = array_index_nospec(idx, ARM_MAX_WRP);
++		tsk->thread.debug.hbp_watch[idx] = bp;
++		err = 0;
+ 		break;
+ 	}
+ 
++out:
+ 	return err;
+ }
+ 
+diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c
+index f206dafbb0a3..26a058d58d37 100644
+--- a/arch/mips/ath79/setup.c
++++ b/arch/mips/ath79/setup.c
+@@ -40,6 +40,7 @@ static char ath79_sys_type[ATH79_SYS_TYPE_LEN];
+ 
+ static void ath79_restart(char *command)
+ {
++	local_irq_disable();
+ 	ath79_device_reset_set(AR71XX_RESET_FULL_CHIP);
+ 	for (;;)
+ 		if (cpu_wait)
+diff --git a/arch/mips/include/asm/mach-ath79/ath79.h b/arch/mips/include/asm/mach-ath79/ath79.h
+index 441faa92c3cd..6e6c0fead776 100644
+--- a/arch/mips/include/asm/mach-ath79/ath79.h
++++ b/arch/mips/include/asm/mach-ath79/ath79.h
+@@ -134,6 +134,7 @@ static inline u32 ath79_pll_rr(unsigned reg)
+ static inline void ath79_reset_wr(unsigned reg, u32 val)
+ {
+ 	__raw_writel(val, ath79_reset_base + reg);
++	(void) __raw_readl(ath79_reset_base + reg); /* flush */
+ }
+ 
+ static inline u32 ath79_reset_rr(unsigned reg)
+diff --git a/arch/mips/jz4740/Platform b/arch/mips/jz4740/Platform
+index 28448d358c10..a2a5a85ea1f9 100644
+--- a/arch/mips/jz4740/Platform
++++ b/arch/mips/jz4740/Platform
+@@ -1,4 +1,4 @@
+ platform-$(CONFIG_MACH_INGENIC)	+= jz4740/
+ cflags-$(CONFIG_MACH_INGENIC)	+= -I$(srctree)/arch/mips/include/asm/mach-jz4740
+ load-$(CONFIG_MACH_INGENIC)	+= 0xffffffff80010000
+-zload-$(CONFIG_MACH_INGENIC)	+= 0xffffffff80600000
++zload-$(CONFIG_MACH_INGENIC)	+= 0xffffffff81000000
+diff --git a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c
+index f7c905e50dc4..92dc6bafc127 100644
+--- a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c
++++ b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c
+@@ -138,7 +138,7 @@ u32 pci_ohci_read_reg(int reg)
+ 		break;
+ 	case PCI_OHCI_INT_REG:
+ 		_rdmsr(DIVIL_MSR_REG(PIC_YSEL_LOW), &hi, &lo);
+-		if ((lo & 0x00000f00) == CS5536_USB_INTR)
++		if (((lo >> PIC_YSEL_LOW_USB_SHIFT) & 0xf) == CS5536_USB_INTR)
+ 			conf_data = 1;
+ 		break;
+ 	default:
+diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
+index 8c456fa691a5..8167ce8e0cdd 100644
+--- a/arch/powerpc/kvm/book3s_64_vio.c
++++ b/arch/powerpc/kvm/book3s_64_vio.c
+@@ -180,7 +180,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd,
+ 		if ((tbltmp->it_page_shift <= stt->page_shift) &&
+ 				(tbltmp->it_offset << tbltmp->it_page_shift ==
+ 				 stt->offset << stt->page_shift) &&
+-				(tbltmp->it_size << tbltmp->it_page_shift ==
++				(tbltmp->it_size << tbltmp->it_page_shift >=
+ 				 stt->size << stt->page_shift)) {
+ 			/*
+ 			 * Reference the table to avoid races with
+@@ -296,7 +296,7 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,
+ {
+ 	struct kvmppc_spapr_tce_table *stt = NULL;
+ 	struct kvmppc_spapr_tce_table *siter;
+-	unsigned long npages, size;
++	unsigned long npages, size = args->size;
+ 	int ret = -ENOMEM;
+ 	int i;
+ 
+@@ -304,7 +304,6 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,
+ 		(args->offset + args->size > (ULLONG_MAX >> args->page_shift)))
+ 		return -EINVAL;
+ 
+-	size = _ALIGN_UP(args->size, PAGE_SIZE >> 3);
+ 	npages = kvmppc_tce_pages(size);
+ 	ret = kvmppc_account_memlimit(kvmppc_stt_pages(npages), true);
+ 	if (ret)
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index a995513573c2..2ebd5132a29f 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -4562,6 +4562,8 @@ static int kvmppc_book3s_init_hv(void)
+ 			pr_err("KVM-HV: Cannot determine method for accessing XICS\n");
+ 			return -ENODEV;
+ 		}
++		/* presence of intc confirmed - node can be dropped again */
++		of_node_put(np);
+ 	}
+ #endif
+ 
+diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
+index 0d539c661748..371e33ecc547 100644
+--- a/arch/powerpc/platforms/powernv/opal.c
++++ b/arch/powerpc/platforms/powernv/opal.c
+@@ -388,7 +388,7 @@ int opal_put_chars(uint32_t vtermno, const char *data, int total_len)
+ 		/* Closed or other error drop */
+ 		if (rc != OPAL_SUCCESS && rc != OPAL_BUSY &&
+ 		    rc != OPAL_BUSY_EVENT) {
+-			written = total_len;
++			written += total_len;
+ 			break;
+ 		}
+ 		if (rc == OPAL_SUCCESS) {
+diff --git a/arch/s390/crypto/paes_s390.c b/arch/s390/crypto/paes_s390.c
+index 80b27294c1de..ab9a0ebecc19 100644
+--- a/arch/s390/crypto/paes_s390.c
++++ b/arch/s390/crypto/paes_s390.c
+@@ -208,7 +208,7 @@ static int cbc_paes_crypt(struct blkcipher_desc *desc, unsigned long modifier,
+ 			      walk->dst.virt.addr, walk->src.virt.addr, n);
+ 		if (k)
+ 			ret = blkcipher_walk_done(desc, walk, nbytes - k);
+-		if (n < k) {
++		if (k < n) {
+ 			if (__cbc_paes_set_key(ctx) != 0)
+ 				return blkcipher_walk_done(desc, walk, -EIO);
+ 			memcpy(param.key, ctx->pk.protkey, MAXPROTKEYSIZE);
+diff --git a/arch/x86/kernel/eisa.c b/arch/x86/kernel/eisa.c
+index f260e452e4f8..e8c8c5d78dbd 100644
+--- a/arch/x86/kernel/eisa.c
++++ b/arch/x86/kernel/eisa.c
+@@ -7,11 +7,17 @@
+ #include <linux/eisa.h>
+ #include <linux/io.h>
+ 
++#include <xen/xen.h>
++
+ static __init int eisa_bus_probe(void)
+ {
+-	void __iomem *p = ioremap(0x0FFFD9, 4);
++	void __iomem *p;
++
++	if (xen_pv_domain() && !xen_initial_domain())
++		return 0;
+ 
+-	if (readl(p) == 'E' + ('I'<<8) + ('S'<<16) + ('A'<<24))
++	p = ioremap(0x0FFFD9, 4);
++	if (p && readl(p) == 'E' + ('I' << 8) + ('S' << 16) + ('A' << 24))
+ 		EISA_bus = 1;
+ 	iounmap(p);
+ 	return 0;
+diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
+index 946455e9cfef..1d2106d83b4e 100644
+--- a/arch/x86/mm/pti.c
++++ b/arch/x86/mm/pti.c
+@@ -177,7 +177,7 @@ static p4d_t *pti_user_pagetable_walk_p4d(unsigned long address)
+ 
+ 	if (pgd_none(*pgd)) {
+ 		unsigned long new_p4d_page = __get_free_page(gfp);
+-		if (!new_p4d_page)
++		if (WARN_ON_ONCE(!new_p4d_page))
+ 			return NULL;
+ 
+ 		set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(new_p4d_page)));
+@@ -196,13 +196,17 @@ static p4d_t *pti_user_pagetable_walk_p4d(unsigned long address)
+ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
+ {
+ 	gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
+-	p4d_t *p4d = pti_user_pagetable_walk_p4d(address);
++	p4d_t *p4d;
+ 	pud_t *pud;
+ 
++	p4d = pti_user_pagetable_walk_p4d(address);
++	if (!p4d)
++		return NULL;
++
+ 	BUILD_BUG_ON(p4d_large(*p4d) != 0);
+ 	if (p4d_none(*p4d)) {
+ 		unsigned long new_pud_page = __get_free_page(gfp);
+-		if (!new_pud_page)
++		if (WARN_ON_ONCE(!new_pud_page))
+ 			return NULL;
+ 
+ 		set_p4d(p4d, __p4d(_KERNPG_TABLE | __pa(new_pud_page)));
+@@ -216,7 +220,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
+ 	}
+ 	if (pud_none(*pud)) {
+ 		unsigned long new_pmd_page = __get_free_page(gfp);
+-		if (!new_pmd_page)
++		if (WARN_ON_ONCE(!new_pmd_page))
+ 			return NULL;
+ 
+ 		set_pud(pud, __pud(_KERNPG_TABLE | __pa(new_pmd_page)));
+@@ -238,9 +242,13 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
+ static __init pte_t *pti_user_pagetable_walk_pte(unsigned long address)
+ {
+ 	gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
+-	pmd_t *pmd = pti_user_pagetable_walk_pmd(address);
++	pmd_t *pmd;
+ 	pte_t *pte;
+ 
++	pmd = pti_user_pagetable_walk_pmd(address);
++	if (!pmd)
++		return NULL;
++
+ 	/* We can't do anything sensible if we hit a large mapping. */
+ 	if (pmd_large(*pmd)) {
+ 		WARN_ON(1);
+@@ -298,6 +306,10 @@ pti_clone_pmds(unsigned long start, unsigned long end, pmdval_t clear)
+ 		p4d_t *p4d;
+ 		pud_t *pud;
+ 
++		/* Overflow check */
++		if (addr < start)
++			break;
++
+ 		pgd = pgd_offset_k(addr);
+ 		if (WARN_ON(pgd_none(*pgd)))
+ 			return;
+@@ -355,6 +367,9 @@ static void __init pti_clone_p4d(unsigned long addr)
+ 	pgd_t *kernel_pgd;
+ 
+ 	user_p4d = pti_user_pagetable_walk_p4d(addr);
++	if (!user_p4d)
++		return;
++
+ 	kernel_pgd = pgd_offset_k(addr);
+ 	kernel_p4d = p4d_offset(kernel_pgd, addr);
+ 	*user_p4d = *kernel_p4d;
+diff --git a/arch/xtensa/platforms/iss/setup.c b/arch/xtensa/platforms/iss/setup.c
+index f4bbb28026f8..58709e89a8ed 100644
+--- a/arch/xtensa/platforms/iss/setup.c
++++ b/arch/xtensa/platforms/iss/setup.c
+@@ -78,23 +78,28 @@ static struct notifier_block iss_panic_block = {
+ 
+ void __init platform_setup(char **p_cmdline)
+ {
++	static void *argv[COMMAND_LINE_SIZE / sizeof(void *)] __initdata;
++	static char cmdline[COMMAND_LINE_SIZE] __initdata;
+ 	int argc = simc_argc();
+ 	int argv_size = simc_argv_size();
+ 
+ 	if (argc > 1) {
+-		void **argv = alloc_bootmem(argv_size);
+-		char *cmdline = alloc_bootmem(argv_size);
+-		int i;
++		if (argv_size > sizeof(argv)) {
++			pr_err("%s: command line too long: argv_size = %d\n",
++			       __func__, argv_size);
++		} else {
++			int i;
+ 
+-		cmdline[0] = 0;
+-		simc_argv((void *)argv);
++			cmdline[0] = 0;
++			simc_argv((void *)argv);
+ 
+-		for (i = 1; i < argc; ++i) {
+-			if (i > 1)
+-				strcat(cmdline, " ");
+-			strcat(cmdline, argv[i]);
++			for (i = 1; i < argc; ++i) {
++				if (i > 1)
++					strcat(cmdline, " ");
++				strcat(cmdline, argv[i]);
++			}
++			*p_cmdline = cmdline;
+ 		}
+-		*p_cmdline = cmdline;
+ 	}
+ 
+ 	atomic_notifier_chain_register(&panic_notifier_list, &iss_panic_block);
+diff --git a/block/blk-core.c b/block/blk-core.c
+index cbaca5a73f2e..f9d2e1b66e05 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -791,9 +791,13 @@ void blk_cleanup_queue(struct request_queue *q)
+ 	 * make sure all in-progress dispatch are completed because
+ 	 * blk_freeze_queue() can only complete all requests, and
+ 	 * dispatch may still be in-progress since we dispatch requests
+-	 * from more than one contexts
++	 * from more than one contexts.
++	 *
++	 * No need to quiesce queue if it isn't initialized yet since
++	 * blk_freeze_queue() should be enough for cases of passthrough
++	 * request.
+ 	 */
+-	if (q->mq_ops)
++	if (q->mq_ops && blk_queue_init_done(q))
+ 		blk_mq_quiesce_queue(q);
+ 
+ 	/* for synchronous bio-based driver finish in-flight integrity i/o */
+diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
+index 56c493c6cd90..f5745acc2d98 100644
+--- a/block/blk-mq-sched.c
++++ b/block/blk-mq-sched.c
+@@ -339,7 +339,8 @@ bool __blk_mq_sched_bio_merge(struct request_queue *q, struct bio *bio)
+ 		return e->type->ops.mq.bio_merge(hctx, bio);
+ 	}
+ 
+-	if (hctx->flags & BLK_MQ_F_SHOULD_MERGE) {
++	if ((hctx->flags & BLK_MQ_F_SHOULD_MERGE) &&
++			!list_empty_careful(&ctx->rq_list)) {
+ 		/* default per sw-queue merge */
+ 		spin_lock(&ctx->lock);
+ 		ret = blk_mq_attempt_merge(q, ctx, bio);
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index d1de71124656..24fff4a3d08a 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -128,7 +128,7 @@ void blk_set_stacking_limits(struct queue_limits *lim)
+ 
+ 	/* Inherit limits from component devices */
+ 	lim->max_segments = USHRT_MAX;
+-	lim->max_discard_segments = 1;
++	lim->max_discard_segments = USHRT_MAX;
+ 	lim->max_hw_sectors = UINT_MAX;
+ 	lim->max_segment_size = UINT_MAX;
+ 	lim->max_sectors = UINT_MAX;
+diff --git a/crypto/api.c b/crypto/api.c
+index 0ee632bba064..7aca9f86c5f3 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -229,7 +229,7 @@ static struct crypto_alg *crypto_larval_lookup(const char *name, u32 type,
+ 	mask &= ~(CRYPTO_ALG_LARVAL | CRYPTO_ALG_DEAD);
+ 
+ 	alg = crypto_alg_lookup(name, type, mask);
+-	if (!alg) {
++	if (!alg && !(mask & CRYPTO_NOLOAD)) {
+ 		request_module("crypto-%s", name);
+ 
+ 		if (!((type ^ CRYPTO_ALG_NEED_FALLBACK) & mask &
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index df3e1a44707a..3aba4ad8af5c 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -2809,6 +2809,9 @@ void device_shutdown(void)
+ {
+ 	struct device *dev, *parent;
+ 
++	wait_for_device_probe();
++	device_block_probing();
++
+ 	spin_lock(&devices_kset->list_lock);
+ 	/*
+ 	 * Walk the devices list backward, shutting down each in turn.
+diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
+index f6518067aa7d..f99e5c883368 100644
+--- a/drivers/block/DAC960.c
++++ b/drivers/block/DAC960.c
+@@ -21,6 +21,7 @@
+ #define DAC960_DriverDate			"21 Aug 2007"
+ 
+ 
++#include <linux/compiler.h>
+ #include <linux/module.h>
+ #include <linux/types.h>
+ #include <linux/miscdevice.h>
+@@ -6426,7 +6427,7 @@ static bool DAC960_V2_ExecuteUserCommand(DAC960_Controller_T *Controller,
+   return true;
+ }
+ 
+-static int dac960_proc_show(struct seq_file *m, void *v)
++static int __maybe_unused dac960_proc_show(struct seq_file *m, void *v)
+ {
+   unsigned char *StatusMessage = "OK\n";
+   int ControllerNumber;
+@@ -6446,14 +6447,16 @@ static int dac960_proc_show(struct seq_file *m, void *v)
+   return 0;
+ }
+ 
+-static int dac960_initial_status_proc_show(struct seq_file *m, void *v)
++static int __maybe_unused dac960_initial_status_proc_show(struct seq_file *m,
++							  void *v)
+ {
+ 	DAC960_Controller_T *Controller = (DAC960_Controller_T *)m->private;
+ 	seq_printf(m, "%.*s", Controller->InitialStatusLength, Controller->CombinedStatusBuffer);
+ 	return 0;
+ }
+ 
+-static int dac960_current_status_proc_show(struct seq_file *m, void *v)
++static int __maybe_unused dac960_current_status_proc_show(struct seq_file *m,
++							  void *v)
+ {
+   DAC960_Controller_T *Controller = (DAC960_Controller_T *) m->private;
+   unsigned char *StatusMessage =
+diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
+index a3397664f800..97d6856c9c0f 100644
+--- a/drivers/char/ipmi/ipmi_bt_sm.c
++++ b/drivers/char/ipmi/ipmi_bt_sm.c
+@@ -59,8 +59,6 @@ enum bt_states {
+ 	BT_STATE_RESET3,
+ 	BT_STATE_RESTART,
+ 	BT_STATE_PRINTME,
+-	BT_STATE_CAPABILITIES_BEGIN,
+-	BT_STATE_CAPABILITIES_END,
+ 	BT_STATE_LONG_BUSY	/* BT doesn't get hosed :-) */
+ };
+ 
+@@ -86,7 +84,6 @@ struct si_sm_data {
+ 	int		error_retries;	/* end of "common" fields */
+ 	int		nonzero_status;	/* hung BMCs stay all 0 */
+ 	enum bt_states	complete;	/* to divert the state machine */
+-	int		BT_CAP_outreqs;
+ 	long		BT_CAP_req2rsp;
+ 	int		BT_CAP_retries;	/* Recommended retries */
+ };
+@@ -137,8 +134,6 @@ static char *state2txt(unsigned char state)
+ 	case BT_STATE_RESET3:		return("RESET3");
+ 	case BT_STATE_RESTART:		return("RESTART");
+ 	case BT_STATE_LONG_BUSY:	return("LONG_BUSY");
+-	case BT_STATE_CAPABILITIES_BEGIN: return("CAP_BEGIN");
+-	case BT_STATE_CAPABILITIES_END:	return("CAP_END");
+ 	}
+ 	return("BAD STATE");
+ }
+@@ -185,7 +180,6 @@ static unsigned int bt_init_data(struct si_sm_data *bt, struct si_sm_io *io)
+ 	bt->complete = BT_STATE_IDLE;	/* end here */
+ 	bt->BT_CAP_req2rsp = BT_NORMAL_TIMEOUT * USEC_PER_SEC;
+ 	bt->BT_CAP_retries = BT_NORMAL_RETRY_LIMIT;
+-	/* BT_CAP_outreqs == zero is a flag to read BT Capabilities */
+ 	return 3; /* We claim 3 bytes of space; ought to check SPMI table */
+ }
+ 
+@@ -451,7 +445,7 @@ static enum si_sm_result error_recovery(struct si_sm_data *bt,
+ 
+ static enum si_sm_result bt_event(struct si_sm_data *bt, long time)
+ {
+-	unsigned char status, BT_CAP[8];
++	unsigned char status;
+ 	static enum bt_states last_printed = BT_STATE_PRINTME;
+ 	int i;
+ 
+@@ -504,12 +498,6 @@ static enum si_sm_result bt_event(struct si_sm_data *bt, long time)
+ 		if (status & BT_H_BUSY)		/* clear a leftover H_BUSY */
+ 			BT_CONTROL(BT_H_BUSY);
+ 
+-		bt->timeout = bt->BT_CAP_req2rsp;
+-
+-		/* Read BT capabilities if it hasn't been done yet */
+-		if (!bt->BT_CAP_outreqs)
+-			BT_STATE_CHANGE(BT_STATE_CAPABILITIES_BEGIN,
+-					SI_SM_CALL_WITHOUT_DELAY);
+ 		BT_SI_SM_RETURN(SI_SM_IDLE);
+ 
+ 	case BT_STATE_XACTION_START:
+@@ -614,37 +602,6 @@ static enum si_sm_result bt_event(struct si_sm_data *bt, long time)
+ 		BT_STATE_CHANGE(BT_STATE_XACTION_START,
+ 				SI_SM_CALL_WITH_DELAY);
+ 
+-	/*
+-	 * Get BT Capabilities, using timing of upper level state machine.
+-	 * Set outreqs to prevent infinite loop on timeout.
+-	 */
+-	case BT_STATE_CAPABILITIES_BEGIN:
+-		bt->BT_CAP_outreqs = 1;
+-		{
+-			unsigned char GetBT_CAP[] = { 0x18, 0x36 };
+-			bt->state = BT_STATE_IDLE;
+-			bt_start_transaction(bt, GetBT_CAP, sizeof(GetBT_CAP));
+-		}
+-		bt->complete = BT_STATE_CAPABILITIES_END;
+-		BT_STATE_CHANGE(BT_STATE_XACTION_START,
+-				SI_SM_CALL_WITH_DELAY);
+-
+-	case BT_STATE_CAPABILITIES_END:
+-		i = bt_get_result(bt, BT_CAP, sizeof(BT_CAP));
+-		bt_init_data(bt, bt->io);
+-		if ((i == 8) && !BT_CAP[2]) {
+-			bt->BT_CAP_outreqs = BT_CAP[3];
+-			bt->BT_CAP_req2rsp = BT_CAP[6] * USEC_PER_SEC;
+-			bt->BT_CAP_retries = BT_CAP[7];
+-		} else
+-			printk(KERN_WARNING "IPMI BT: using default values\n");
+-		if (!bt->BT_CAP_outreqs)
+-			bt->BT_CAP_outreqs = 1;
+-		printk(KERN_WARNING "IPMI BT: req2rsp=%ld secs retries=%d\n",
+-			bt->BT_CAP_req2rsp / USEC_PER_SEC, bt->BT_CAP_retries);
+-		bt->timeout = bt->BT_CAP_req2rsp;
+-		return SI_SM_CALL_WITHOUT_DELAY;
+-
+ 	default:	/* should never occur */
+ 		return error_recovery(bt,
+ 				      status,
+@@ -655,6 +612,11 @@ static enum si_sm_result bt_event(struct si_sm_data *bt, long time)
+ 
+ static int bt_detect(struct si_sm_data *bt)
+ {
++	unsigned char GetBT_CAP[] = { 0x18, 0x36 };
++	unsigned char BT_CAP[8];
++	enum si_sm_result smi_result;
++	int rv;
++
+ 	/*
+ 	 * It's impossible for the BT status and interrupt registers to be
+ 	 * all 1's, (assuming a properly functioning, self-initialized BMC)
+@@ -665,6 +627,48 @@ static int bt_detect(struct si_sm_data *bt)
+ 	if ((BT_STATUS == 0xFF) && (BT_INTMASK_R == 0xFF))
+ 		return 1;
+ 	reset_flags(bt);
++
++	/*
++	 * Try getting the BT capabilities here.
++	 */
++	rv = bt_start_transaction(bt, GetBT_CAP, sizeof(GetBT_CAP));
++	if (rv) {
++		dev_warn(bt->io->dev,
++			 "Can't start capabilities transaction: %d\n", rv);
++		goto out_no_bt_cap;
++	}
++
++	smi_result = SI_SM_CALL_WITHOUT_DELAY;
++	for (;;) {
++		if (smi_result == SI_SM_CALL_WITH_DELAY ||
++		    smi_result == SI_SM_CALL_WITH_TICK_DELAY) {
++			schedule_timeout_uninterruptible(1);
++			smi_result = bt_event(bt, jiffies_to_usecs(1));
++		} else if (smi_result == SI_SM_CALL_WITHOUT_DELAY) {
++			smi_result = bt_event(bt, 0);
++		} else
++			break;
++	}
++
++	rv = bt_get_result(bt, BT_CAP, sizeof(BT_CAP));
++	bt_init_data(bt, bt->io);
++	if (rv < 8) {
++		dev_warn(bt->io->dev, "bt cap response too short: %d\n", rv);
++		goto out_no_bt_cap;
++	}
++
++	if (BT_CAP[2]) {
++		dev_warn(bt->io->dev, "Error fetching bt cap: %x\n", BT_CAP[2]);
++out_no_bt_cap:
++		dev_warn(bt->io->dev, "using default values\n");
++	} else {
++		bt->BT_CAP_req2rsp = BT_CAP[6] * USEC_PER_SEC;
++		bt->BT_CAP_retries = BT_CAP[7];
++	}
++
++	dev_info(bt->io->dev, "req2rsp=%ld secs retries=%d\n",
++		 bt->BT_CAP_req2rsp / USEC_PER_SEC, bt->BT_CAP_retries);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 51832b8a2c62..7fc9612070a1 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -3381,39 +3381,45 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
+ 
+ 	rv = handlers->start_processing(send_info, intf);
+ 	if (rv)
+-		goto out;
++		goto out_err;
+ 
+ 	rv = __bmc_get_device_id(intf, NULL, &id, NULL, NULL, i);
+ 	if (rv) {
+ 		dev_err(si_dev, "Unable to get the device id: %d\n", rv);
+-		goto out;
++		goto out_err_started;
+ 	}
+ 
+ 	mutex_lock(&intf->bmc_reg_mutex);
+ 	rv = __scan_channels(intf, &id);
+ 	mutex_unlock(&intf->bmc_reg_mutex);
++	if (rv)
++		goto out_err_bmc_reg;
+ 
+- out:
+-	if (rv) {
+-		ipmi_bmc_unregister(intf);
+-		list_del_rcu(&intf->link);
+-		mutex_unlock(&ipmi_interfaces_mutex);
+-		synchronize_srcu(&ipmi_interfaces_srcu);
+-		cleanup_srcu_struct(&intf->users_srcu);
+-		kref_put(&intf->refcount, intf_free);
+-	} else {
+-		/*
+-		 * Keep memory order straight for RCU readers.  Make
+-		 * sure everything else is committed to memory before
+-		 * setting intf_num to mark the interface valid.
+-		 */
+-		smp_wmb();
+-		intf->intf_num = i;
+-		mutex_unlock(&ipmi_interfaces_mutex);
++	/*
++	 * Keep memory order straight for RCU readers.  Make
++	 * sure everything else is committed to memory before
++	 * setting intf_num to mark the interface valid.
++	 */
++	smp_wmb();
++	intf->intf_num = i;
++	mutex_unlock(&ipmi_interfaces_mutex);
+ 
+-		/* After this point the interface is legal to use. */
+-		call_smi_watchers(i, intf->si_dev);
+-	}
++	/* After this point the interface is legal to use. */
++	call_smi_watchers(i, intf->si_dev);
++
++	return 0;
++
++ out_err_bmc_reg:
++	ipmi_bmc_unregister(intf);
++ out_err_started:
++	if (intf->handlers->shutdown)
++		intf->handlers->shutdown(intf->send_info);
++ out_err:
++	list_del_rcu(&intf->link);
++	mutex_unlock(&ipmi_interfaces_mutex);
++	synchronize_srcu(&ipmi_interfaces_srcu);
++	cleanup_srcu_struct(&intf->users_srcu);
++	kref_put(&intf->refcount, intf_free);
+ 
+ 	return rv;
+ }
+@@ -3504,7 +3510,8 @@ void ipmi_unregister_smi(struct ipmi_smi *intf)
+ 	}
+ 	srcu_read_unlock(&intf->users_srcu, index);
+ 
+-	intf->handlers->shutdown(intf->send_info);
++	if (intf->handlers->shutdown)
++		intf->handlers->shutdown(intf->send_info);
+ 
+ 	cleanup_smi_msgs(intf);
+ 
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index 90ec010bffbd..5faa917df1b6 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -2083,18 +2083,9 @@ static int try_smi_init(struct smi_info *new_smi)
+ 		 si_to_str[new_smi->io.si_type]);
+ 
+ 	WARN_ON(new_smi->io.dev->init_name != NULL);
+-	kfree(init_name);
+-
+-	return 0;
+-
+-out_err:
+-	if (new_smi->intf) {
+-		ipmi_unregister_smi(new_smi->intf);
+-		new_smi->intf = NULL;
+-	}
+ 
++ out_err:
+ 	kfree(init_name);
+-
+ 	return rv;
+ }
+ 
+@@ -2227,6 +2218,8 @@ static void shutdown_smi(void *send_info)
+ 
+ 	kfree(smi_info->si_sm);
+ 	smi_info->si_sm = NULL;
++
++	smi_info->intf = NULL;
+ }
+ 
+ /*
+@@ -2240,10 +2233,8 @@ static void cleanup_one_si(struct smi_info *smi_info)
+ 
+ 	list_del(&smi_info->link);
+ 
+-	if (smi_info->intf) {
++	if (smi_info->intf)
+ 		ipmi_unregister_smi(smi_info->intf);
+-		smi_info->intf = NULL;
+-	}
+ 
+ 	if (smi_info->pdev) {
+ 		if (smi_info->pdev_registered)
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index 18e4650c233b..265d6a6583bc 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -181,6 +181,8 @@ struct ssif_addr_info {
+ 	struct device *dev;
+ 	struct i2c_client *client;
+ 
++	struct i2c_client *added_client;
++
+ 	struct mutex clients_mutex;
+ 	struct list_head clients;
+ 
+@@ -1214,18 +1216,11 @@ static void shutdown_ssif(void *send_info)
+ 		complete(&ssif_info->wake_thread);
+ 		kthread_stop(ssif_info->thread);
+ 	}
+-
+-	/*
+-	 * No message can be outstanding now, we have removed the
+-	 * upper layer and it permitted us to do so.
+-	 */
+-	kfree(ssif_info);
+ }
+ 
+ static int ssif_remove(struct i2c_client *client)
+ {
+ 	struct ssif_info *ssif_info = i2c_get_clientdata(client);
+-	struct ipmi_smi *intf;
+ 	struct ssif_addr_info *addr_info;
+ 
+ 	if (!ssif_info)
+@@ -1235,9 +1230,7 @@ static int ssif_remove(struct i2c_client *client)
+ 	 * After this point, we won't deliver anything asychronously
+ 	 * to the message handler.  We can unregister ourself.
+ 	 */
+-	intf = ssif_info->intf;
+-	ssif_info->intf = NULL;
+-	ipmi_unregister_smi(intf);
++	ipmi_unregister_smi(ssif_info->intf);
+ 
+ 	list_for_each_entry(addr_info, &ssif_infos, link) {
+ 		if (addr_info->client == client) {
+@@ -1246,6 +1239,8 @@ static int ssif_remove(struct i2c_client *client)
+ 		}
+ 	}
+ 
++	kfree(ssif_info);
++
+ 	return 0;
+ }
+ 
+@@ -1648,15 +1643,7 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ 
+  out:
+ 	if (rv) {
+-		/*
+-		 * Note that if addr_info->client is assigned, we
+-		 * leave it.  The i2c client hangs around even if we
+-		 * return a failure here, and the failure here is not
+-		 * propagated back to the i2c code.  This seems to be
+-		 * design intent, strange as it may be.  But if we
+-		 * don't leave it, ssif_platform_remove will not remove
+-		 * the client like it should.
+-		 */
++		addr_info->client = NULL;
+ 		dev_err(&client->dev, "Unable to start IPMI SSIF: %d\n", rv);
+ 		kfree(ssif_info);
+ 	}
+@@ -1676,7 +1663,8 @@ static int ssif_adapter_handler(struct device *adev, void *opaque)
+ 	if (adev->type != &i2c_adapter_type)
+ 		return 0;
+ 
+-	i2c_new_device(to_i2c_adapter(adev), &addr_info->binfo);
++	addr_info->added_client = i2c_new_device(to_i2c_adapter(adev),
++						 &addr_info->binfo);
+ 
+ 	if (!addr_info->adapter_name)
+ 		return 1; /* Only try the first I2C adapter by default. */
+@@ -1849,7 +1837,7 @@ static int ssif_platform_remove(struct platform_device *dev)
+ 		return 0;
+ 
+ 	mutex_lock(&ssif_infos_mutex);
+-	i2c_unregister_device(addr_info->client);
++	i2c_unregister_device(addr_info->added_client);
+ 
+ 	list_del(&addr_info->link);
+ 	kfree(addr_info);
+diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c
+index a5d402de5584..20724abd38bd 100644
+--- a/drivers/clk/clk-fixed-factor.c
++++ b/drivers/clk/clk-fixed-factor.c
+@@ -177,8 +177,15 @@ static struct clk *_of_fixed_factor_clk_setup(struct device_node *node)
+ 
+ 	clk = clk_register_fixed_factor(NULL, clk_name, parent_name, flags,
+ 					mult, div);
+-	if (IS_ERR(clk))
++	if (IS_ERR(clk)) {
++		/*
++		 * If parent clock is not registered, registration would fail.
++		 * Clear OF_POPULATED flag so that clock registration can be
++		 * attempted again from probe function.
++		 */
++		of_node_clear_flag(node, OF_POPULATED);
+ 		return clk;
++	}
+ 
+ 	ret = of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ 	if (ret) {
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index e2ed078abd90..2d96e7966e94 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -2933,6 +2933,7 @@ struct clk *__clk_create_clk(struct clk_hw *hw, const char *dev_id,
+ 	return clk;
+ }
+ 
++/* keep in sync with __clk_put */
+ void __clk_free_clk(struct clk *clk)
+ {
+ 	clk_prepare_lock();
+@@ -3312,6 +3313,7 @@ int __clk_get(struct clk *clk)
+ 	return 1;
+ }
+ 
++/* keep in sync with __clk_free_clk */
+ void __clk_put(struct clk *clk)
+ {
+ 	struct module *owner;
+@@ -3345,6 +3347,7 @@ void __clk_put(struct clk *clk)
+ 
+ 	module_put(owner);
+ 
++	kfree_const(clk->con_id);
+ 	kfree(clk);
+ }
+ 
+diff --git a/drivers/clk/imx/clk-imx6sll.c b/drivers/clk/imx/clk-imx6sll.c
+index 3651c77fbabe..645d8a42007c 100644
+--- a/drivers/clk/imx/clk-imx6sll.c
++++ b/drivers/clk/imx/clk-imx6sll.c
+@@ -92,6 +92,7 @@ static void __init imx6sll_clocks_init(struct device_node *ccm_node)
+ 
+ 	np = of_find_compatible_node(NULL, NULL, "fsl,imx6sll-anatop");
+ 	base = of_iomap(np, 0);
++	of_node_put(np);
+ 	WARN_ON(!base);
+ 
+ 	/* Do not bypass PLLs initially */
+diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c
+index ba563ba50b40..9f1a40498642 100644
+--- a/drivers/clk/imx/clk-imx6ul.c
++++ b/drivers/clk/imx/clk-imx6ul.c
+@@ -142,6 +142,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node)
+ 
+ 	np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-anatop");
+ 	base = of_iomap(np, 0);
++	of_node_put(np);
+ 	WARN_ON(!base);
+ 
+ 	clks[IMX6UL_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c
+index 44e4e27eddad..6f7637b19738 100644
+--- a/drivers/clk/mvebu/armada-37xx-periph.c
++++ b/drivers/clk/mvebu/armada-37xx-periph.c
+@@ -429,9 +429,6 @@ static u8 clk_pm_cpu_get_parent(struct clk_hw *hw)
+ 		val &= pm_cpu->mask_mux;
+ 	}
+ 
+-	if (val >= num_parents)
+-		return -EINVAL;
+-
+ 	return val;
+ }
+ 
+diff --git a/drivers/clk/tegra/clk-bpmp.c b/drivers/clk/tegra/clk-bpmp.c
+index a896692b74ec..01dada561c10 100644
+--- a/drivers/clk/tegra/clk-bpmp.c
++++ b/drivers/clk/tegra/clk-bpmp.c
+@@ -586,9 +586,15 @@ static struct clk_hw *tegra_bpmp_clk_of_xlate(struct of_phandle_args *clkspec,
+ 	unsigned int id = clkspec->args[0], i;
+ 	struct tegra_bpmp *bpmp = data;
+ 
+-	for (i = 0; i < bpmp->num_clocks; i++)
+-		if (bpmp->clocks[i]->id == id)
+-			return &bpmp->clocks[i]->hw;
++	for (i = 0; i < bpmp->num_clocks; i++) {
++		struct tegra_bpmp_clk *clk = bpmp->clocks[i];
++
++		if (!clk)
++			continue;
++
++		if (clk->id == id)
++			return &clk->hw;
++	}
+ 
+ 	return NULL;
+ }
+diff --git a/drivers/crypto/ccp/psp-dev.c b/drivers/crypto/ccp/psp-dev.c
+index 051b8c6bae64..a9c85095bd56 100644
+--- a/drivers/crypto/ccp/psp-dev.c
++++ b/drivers/crypto/ccp/psp-dev.c
+@@ -38,6 +38,17 @@ static DEFINE_MUTEX(sev_cmd_mutex);
+ static struct sev_misc_dev *misc_dev;
+ static struct psp_device *psp_master;
+ 
++static int psp_cmd_timeout = 100;
++module_param(psp_cmd_timeout, int, 0644);
++MODULE_PARM_DESC(psp_cmd_timeout, " default timeout value, in seconds, for PSP commands");
++
++static int psp_probe_timeout = 5;
++module_param(psp_probe_timeout, int, 0644);
++MODULE_PARM_DESC(psp_probe_timeout, " default timeout value, in seconds, during PSP device probe");
++
++static bool psp_dead;
++static int psp_timeout;
++
+ static struct psp_device *psp_alloc_struct(struct sp_device *sp)
+ {
+ 	struct device *dev = sp->dev;
+@@ -82,10 +93,19 @@ done:
+ 	return IRQ_HANDLED;
+ }
+ 
+-static void sev_wait_cmd_ioc(struct psp_device *psp, unsigned int *reg)
++static int sev_wait_cmd_ioc(struct psp_device *psp,
++			    unsigned int *reg, unsigned int timeout)
+ {
+-	wait_event(psp->sev_int_queue, psp->sev_int_rcvd);
++	int ret;
++
++	ret = wait_event_timeout(psp->sev_int_queue,
++			psp->sev_int_rcvd, timeout * HZ);
++	if (!ret)
++		return -ETIMEDOUT;
++
+ 	*reg = ioread32(psp->io_regs + PSP_CMDRESP);
++
++	return 0;
+ }
+ 
+ static int sev_cmd_buffer_len(int cmd)
+@@ -133,12 +153,15 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret)
+ 	if (!psp)
+ 		return -ENODEV;
+ 
++	if (psp_dead)
++		return -EBUSY;
++
+ 	/* Get the physical address of the command buffer */
+ 	phys_lsb = data ? lower_32_bits(__psp_pa(data)) : 0;
+ 	phys_msb = data ? upper_32_bits(__psp_pa(data)) : 0;
+ 
+-	dev_dbg(psp->dev, "sev command id %#x buffer 0x%08x%08x\n",
+-		cmd, phys_msb, phys_lsb);
++	dev_dbg(psp->dev, "sev command id %#x buffer 0x%08x%08x timeout %us\n",
++		cmd, phys_msb, phys_lsb, psp_timeout);
+ 
+ 	print_hex_dump_debug("(in):  ", DUMP_PREFIX_OFFSET, 16, 2, data,
+ 			     sev_cmd_buffer_len(cmd), false);
+@@ -154,7 +177,18 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret)
+ 	iowrite32(reg, psp->io_regs + PSP_CMDRESP);
+ 
+ 	/* wait for command completion */
+-	sev_wait_cmd_ioc(psp, &reg);
++	ret = sev_wait_cmd_ioc(psp, &reg, psp_timeout);
++	if (ret) {
++		if (psp_ret)
++			*psp_ret = 0;
++
++		dev_err(psp->dev, "sev command %#x timed out, disabling PSP \n", cmd);
++		psp_dead = true;
++
++		return ret;
++	}
++
++	psp_timeout = psp_cmd_timeout;
+ 
+ 	if (psp_ret)
+ 		*psp_ret = reg & PSP_CMDRESP_ERR_MASK;
+@@ -886,6 +920,8 @@ void psp_pci_init(void)
+ 
+ 	psp_master = sp->psp_data;
+ 
++	psp_timeout = psp_probe_timeout;
++
+ 	if (sev_get_api_version())
+ 		goto err;
+ 
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 0f2245e1af2b..97d86dca7e85 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -1351,7 +1351,7 @@ err_sha_v4_algs:
+ 
+ err_sha_v3_algs:
+ 	for (j = 0; j < k; j++)
+-		crypto_unregister_ahash(&sha_v4_algs[j]);
++		crypto_unregister_ahash(&sha_v3_algs[j]);
+ 
+ err_aes_algs:
+ 	for (j = 0; j < i; j++)
+@@ -1367,7 +1367,7 @@ static void sahara_unregister_algs(struct sahara_dev *dev)
+ 	for (i = 0; i < ARRAY_SIZE(aes_algs); i++)
+ 		crypto_unregister_alg(&aes_algs[i]);
+ 
+-	for (i = 0; i < ARRAY_SIZE(sha_v4_algs); i++)
++	for (i = 0; i < ARRAY_SIZE(sha_v3_algs); i++)
+ 		crypto_unregister_ahash(&sha_v3_algs[i]);
+ 
+ 	if (dev->version > SAHARA_VERSION_3)
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index 0b5b3abe054e..e26adf67e218 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -625,7 +625,8 @@ struct devfreq *devfreq_add_device(struct device *dev,
+ 	err = device_register(&devfreq->dev);
+ 	if (err) {
+ 		mutex_unlock(&devfreq->lock);
+-		goto err_dev;
++		put_device(&devfreq->dev);
++		goto err_out;
+ 	}
+ 
+ 	devfreq->trans_table =
+@@ -672,6 +673,7 @@ err_init:
+ 	mutex_unlock(&devfreq_list_lock);
+ 
+ 	device_unregister(&devfreq->dev);
++	devfreq = NULL;
+ err_dev:
+ 	if (devfreq)
+ 		kfree(devfreq);
+diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
+index c6589ccf1b9a..d349fedf4ab2 100644
+--- a/drivers/dma/mv_xor_v2.c
++++ b/drivers/dma/mv_xor_v2.c
+@@ -899,6 +899,8 @@ static int mv_xor_v2_remove(struct platform_device *pdev)
+ 
+ 	platform_msi_domain_free_irqs(&pdev->dev);
+ 
++	tasklet_kill(&xor_dev->irq_tasklet);
++
+ 	clk_disable_unprepare(xor_dev->clk);
+ 
+ 	return 0;
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index de0957fe9668..bb6dfa2e1e8a 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2257,13 +2257,14 @@ static int pl330_terminate_all(struct dma_chan *chan)
+ 
+ 	pm_runtime_get_sync(pl330->ddma.dev);
+ 	spin_lock_irqsave(&pch->lock, flags);
++
+ 	spin_lock(&pl330->lock);
+ 	_stop(pch->thread);
+-	spin_unlock(&pl330->lock);
+-
+ 	pch->thread->req[0].desc = NULL;
+ 	pch->thread->req[1].desc = NULL;
+ 	pch->thread->req_running = -1;
++	spin_unlock(&pl330->lock);
++
+ 	power_down = pch->active;
+ 	pch->active = false;
+ 
+diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
+index 2a2ccd9c78e4..8305a1ce8a9b 100644
+--- a/drivers/dma/sh/rcar-dmac.c
++++ b/drivers/dma/sh/rcar-dmac.c
+@@ -774,8 +774,9 @@ static void rcar_dmac_sync_tcr(struct rcar_dmac_chan *chan)
+ 	/* make sure all remaining data was flushed */
+ 	rcar_dmac_chcr_de_barrier(chan);
+ 
+-	/* back DE */
+-	rcar_dmac_chan_write(chan, RCAR_DMACHCR, chcr);
++	/* back DE if remain data exists */
++	if (rcar_dmac_chan_read(chan, RCAR_DMATCR))
++		rcar_dmac_chan_write(chan, RCAR_DMACHCR, chcr);
+ }
+ 
+ static void rcar_dmac_chan_halt(struct rcar_dmac_chan *chan)
+diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c
+index b5214c143fee..388a929baf95 100644
+--- a/drivers/firmware/efi/arm-init.c
++++ b/drivers/firmware/efi/arm-init.c
+@@ -259,7 +259,6 @@ void __init efi_init(void)
+ 
+ 	reserve_regions();
+ 	efi_esrt_init();
+-	efi_memmap_unmap();
+ 
+ 	memblock_reserve(params.mmap & PAGE_MASK,
+ 			 PAGE_ALIGN(params.mmap_size +
+diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
+index 5889cbea60b8..4712445c3213 100644
+--- a/drivers/firmware/efi/arm-runtime.c
++++ b/drivers/firmware/efi/arm-runtime.c
+@@ -110,11 +110,13 @@ static int __init arm_enable_runtime_services(void)
+ {
+ 	u64 mapsize;
+ 
+-	if (!efi_enabled(EFI_BOOT)) {
++	if (!efi_enabled(EFI_BOOT) || !efi_enabled(EFI_MEMMAP)) {
+ 		pr_info("EFI services will not be available.\n");
+ 		return 0;
+ 	}
+ 
++	efi_memmap_unmap();
++
+ 	if (efi_runtime_disabled()) {
+ 		pr_info("EFI runtime services will be disabled.\n");
+ 		return 0;
+diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c
+index 1ab80e06e7c5..e5d80ebd72b6 100644
+--- a/drivers/firmware/efi/esrt.c
++++ b/drivers/firmware/efi/esrt.c
+@@ -326,7 +326,8 @@ void __init efi_esrt_init(void)
+ 
+ 	end = esrt_data + size;
+ 	pr_info("Reserving ESRT space from %pa to %pa.\n", &esrt_data, &end);
+-	efi_mem_reserve(esrt_data, esrt_data_size);
++	if (md.type == EFI_BOOT_SERVICES_DATA)
++		efi_mem_reserve(esrt_data, esrt_data_size);
+ 
+ 	pr_debug("esrt-init: loaded.\n");
+ }
+diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
+index 2e33fd552899..99070e2ac3cd 100644
+--- a/drivers/gpio/gpio-pxa.c
++++ b/drivers/gpio/gpio-pxa.c
+@@ -665,6 +665,8 @@ static int pxa_gpio_probe(struct platform_device *pdev)
+ 	pchip->irq0 = irq0;
+ 	pchip->irq1 = irq1;
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (!res)
++		return -EINVAL;
+ 	gpio_reg_base = devm_ioremap(&pdev->dev, res->start,
+ 				     resource_size(res));
+ 	if (!gpio_reg_base)
+diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h
+index 1a8e20363861..a7e49fef73d4 100644
+--- a/drivers/gpio/gpiolib.h
++++ b/drivers/gpio/gpiolib.h
+@@ -92,7 +92,7 @@ struct acpi_gpio_info {
+ };
+ 
+ /* gpio suffixes used for ACPI and device tree lookup */
+-static const char * const gpio_suffixes[] = { "gpios", "gpio" };
++static __maybe_unused const char * const gpio_suffixes[] = { "gpios", "gpio" };
+ 
+ #ifdef CONFIG_OF_GPIO
+ struct gpio_desc *of_find_gpio(struct device *dev,
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
+index c3744d89352c..ebe79bf00145 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
+@@ -188,9 +188,9 @@ void __iomem *kfd_get_kernel_doorbell(struct kfd_dev *kfd,
+ 	*doorbell_off = kfd->doorbell_id_offset + inx;
+ 
+ 	pr_debug("Get kernel queue doorbell\n"
+-			 "     doorbell offset   == 0x%08X\n"
+-			 "     kernel address    == %p\n",
+-		*doorbell_off, (kfd->doorbell_kernel_ptr + inx));
++			"     doorbell offset   == 0x%08X\n"
++			"     doorbell index    == 0x%x\n",
++		*doorbell_off, inx);
+ 
+ 	return kfd->doorbell_kernel_ptr + inx;
+ }
+@@ -199,7 +199,8 @@ void kfd_release_kernel_doorbell(struct kfd_dev *kfd, u32 __iomem *db_addr)
+ {
+ 	unsigned int inx;
+ 
+-	inx = (unsigned int)(db_addr - kfd->doorbell_kernel_ptr);
++	inx = (unsigned int)(db_addr - kfd->doorbell_kernel_ptr)
++		* sizeof(u32) / kfd->device_info->doorbell_size;
+ 
+ 	mutex_lock(&kfd->doorbell_mutex);
+ 	__clear_bit(inx, kfd->doorbell_available_index);
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+index 1d80b4f7c681..4694386cc623 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+@@ -244,6 +244,8 @@ struct kfd_process *kfd_get_process(const struct task_struct *thread)
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	process = find_process(thread);
++	if (!process)
++		return ERR_PTR(-EINVAL);
+ 
+ 	return process;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index 8a7890b03d97..6ccd59b87403 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -497,6 +497,10 @@ static bool detect_dp(
+ 			sink_caps->signal = SIGNAL_TYPE_DISPLAY_PORT_MST;
+ 			link->type = dc_connection_mst_branch;
+ 
++			dal_ddc_service_set_transaction_type(
++							link->ddc,
++							sink_caps->transaction_type);
++
+ 			/*
+ 			 * This call will initiate MST topology discovery. Which
+ 			 * will detect MST ports and add new DRM connector DRM
+diff --git a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
+index d567be49c31b..b487774d8041 100644
+--- a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
++++ b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
+@@ -1020,7 +1020,7 @@ static int pp_get_display_power_level(void *handle,
+ static int pp_get_current_clocks(void *handle,
+ 		struct amd_pp_clock_info *clocks)
+ {
+-	struct amd_pp_simple_clock_info simple_clocks;
++	struct amd_pp_simple_clock_info simple_clocks = { 0 };
+ 	struct pp_clock_info hw_clocks;
+ 	struct pp_hwmgr *hwmgr = handle;
+ 	int ret = 0;
+@@ -1056,7 +1056,10 @@ static int pp_get_current_clocks(void *handle,
+ 	clocks->max_engine_clock_in_sr = hw_clocks.max_eng_clk;
+ 	clocks->min_engine_clock_in_sr = hw_clocks.min_eng_clk;
+ 
+-	clocks->max_clocks_state = simple_clocks.level;
++	if (simple_clocks.level == 0)
++		clocks->max_clocks_state = PP_DAL_POWERLEVEL_7;
++	else
++		clocks->max_clocks_state = simple_clocks.level;
+ 
+ 	if (0 == phm_get_current_shallow_sleep_clocks(hwmgr, &hwmgr->current_ps->hardware, &hw_clocks)) {
+ 		clocks->max_engine_clock_in_sr = hw_clocks.max_eng_clk;
+@@ -1159,6 +1162,8 @@ static int pp_get_display_mode_validation_clocks(void *handle,
+ 	if (!hwmgr || !hwmgr->pm_en ||!clocks)
+ 		return -EINVAL;
+ 
++	clocks->level = PP_DAL_POWERLEVEL_7;
++
+ 	mutex_lock(&hwmgr->smu_lock);
+ 
+ 	if (phm_cap_enabled(hwmgr->platform_descriptor.platformCaps, PHM_PlatformCaps_DynamicPatchPowerState))
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+index f8e866ceda02..77779adeef28 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -4555,12 +4555,12 @@ static int smu7_get_sclks(struct pp_hwmgr *hwmgr, struct amd_pp_clocks *clocks)
+ 			return -EINVAL;
+ 		dep_sclk_table = table_info->vdd_dep_on_sclk;
+ 		for (i = 0; i < dep_sclk_table->count; i++)
+-			clocks->clock[i] = dep_sclk_table->entries[i].clk;
++			clocks->clock[i] = dep_sclk_table->entries[i].clk * 10;
+ 		clocks->count = dep_sclk_table->count;
+ 	} else if (hwmgr->pp_table_version == PP_TABLE_V0) {
+ 		sclk_table = hwmgr->dyn_state.vddc_dependency_on_sclk;
+ 		for (i = 0; i < sclk_table->count; i++)
+-			clocks->clock[i] = sclk_table->entries[i].clk;
++			clocks->clock[i] = sclk_table->entries[i].clk * 10;
+ 		clocks->count = sclk_table->count;
+ 	}
+ 
+@@ -4592,7 +4592,7 @@ static int smu7_get_mclks(struct pp_hwmgr *hwmgr, struct amd_pp_clocks *clocks)
+ 			return -EINVAL;
+ 		dep_mclk_table = table_info->vdd_dep_on_mclk;
+ 		for (i = 0; i < dep_mclk_table->count; i++) {
+-			clocks->clock[i] = dep_mclk_table->entries[i].clk;
++			clocks->clock[i] = dep_mclk_table->entries[i].clk * 10;
+ 			clocks->latency[i] = smu7_get_mem_latency(hwmgr,
+ 						dep_mclk_table->entries[i].clk);
+ 		}
+@@ -4600,7 +4600,7 @@ static int smu7_get_mclks(struct pp_hwmgr *hwmgr, struct amd_pp_clocks *clocks)
+ 	} else if (hwmgr->pp_table_version == PP_TABLE_V0) {
+ 		mclk_table = hwmgr->dyn_state.vddc_dependency_on_mclk;
+ 		for (i = 0; i < mclk_table->count; i++)
+-			clocks->clock[i] = mclk_table->entries[i].clk;
++			clocks->clock[i] = mclk_table->entries[i].clk * 10;
+ 		clocks->count = mclk_table->count;
+ 	}
+ 	return 0;
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
+index 617557bd8c24..0adfc5392cd3 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
+@@ -1605,17 +1605,17 @@ static int smu8_get_clock_by_type(struct pp_hwmgr *hwmgr, enum amd_pp_clock_type
+ 	switch (type) {
+ 	case amd_pp_disp_clock:
+ 		for (i = 0; i < clocks->count; i++)
+-			clocks->clock[i] = data->sys_info.display_clock[i];
++			clocks->clock[i] = data->sys_info.display_clock[i] * 10;
+ 		break;
+ 	case amd_pp_sys_clock:
+ 		table = hwmgr->dyn_state.vddc_dependency_on_sclk;
+ 		for (i = 0; i < clocks->count; i++)
+-			clocks->clock[i] = table->entries[i].clk;
++			clocks->clock[i] = table->entries[i].clk * 10;
+ 		break;
+ 	case amd_pp_mem_clock:
+ 		clocks->count = SMU8_NUM_NBPMEMORYCLOCK;
+ 		for (i = 0; i < clocks->count; i++)
+-			clocks->clock[i] = data->sys_info.nbp_memory_clock[clocks->count - 1 - i];
++			clocks->clock[i] = data->sys_info.nbp_memory_clock[clocks->count - 1 - i] * 10;
+ 		break;
+ 	default:
+ 		return -1;
+diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+index 963a4dba8213..9109b69cd052 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c
++++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+@@ -160,7 +160,11 @@ nouveau_debugfs_pstate_set(struct file *file, const char __user *ubuf,
+ 		args.ustate = value;
+ 	}
+ 
++	ret = pm_runtime_get_sync(drm->dev);
++	if (IS_ERR_VALUE(ret) && ret != -EACCES)
++		return ret;
+ 	ret = nvif_mthd(ctrl, NVIF_CONTROL_PSTATE_USER, &args, sizeof(args));
++	pm_runtime_put_autosuspend(drm->dev);
+ 	if (ret < 0)
+ 		return ret;
+ 
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
+index f5d3158f0378..c7ec86d6c3c9 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -908,8 +908,10 @@ nouveau_drm_open(struct drm_device *dev, struct drm_file *fpriv)
+ 	get_task_comm(tmpname, current);
+ 	snprintf(name, sizeof(name), "%s[%d]", tmpname, pid_nr(fpriv->pid));
+ 
+-	if (!(cli = kzalloc(sizeof(*cli), GFP_KERNEL)))
+-		return ret;
++	if (!(cli = kzalloc(sizeof(*cli), GFP_KERNEL))) {
++		ret = -ENOMEM;
++		goto done;
++	}
+ 
+ 	ret = nouveau_cli_init(drm, name, cli);
+ 	if (ret)
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c
+index 78597da6313a..0e372a190d3f 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c
+@@ -23,6 +23,10 @@
+ #ifdef CONFIG_NOUVEAU_PLATFORM_DRIVER
+ #include "priv.h"
+ 
++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)
++#include <asm/dma-iommu.h>
++#endif
++
+ static int
+ nvkm_device_tegra_power_up(struct nvkm_device_tegra *tdev)
+ {
+@@ -105,6 +109,15 @@ nvkm_device_tegra_probe_iommu(struct nvkm_device_tegra *tdev)
+ 	unsigned long pgsize_bitmap;
+ 	int ret;
+ 
++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)
++	if (dev->archdata.mapping) {
++		struct dma_iommu_mapping *mapping = to_dma_iommu_mapping(dev);
++
++		arm_iommu_detach_device(dev);
++		arm_iommu_release_mapping(mapping);
++	}
++#endif
++
+ 	if (!tdev->func->iommu_bit)
+ 		return;
+ 
+diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
+index a188a3959f1a..6ad827b93ae1 100644
+--- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
++++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
+@@ -823,7 +823,7 @@ static void s6e8aa0_read_mtp_id(struct s6e8aa0 *ctx)
+ 	int ret, i;
+ 
+ 	ret = s6e8aa0_dcs_read(ctx, 0xd1, id, ARRAY_SIZE(id));
+-	if (ret < ARRAY_SIZE(id) || id[0] == 0x00) {
++	if (ret < 0 || ret < ARRAY_SIZE(id) || id[0] == 0x00) {
+ 		dev_err(ctx->dev, "read id failed\n");
+ 		ctx->error = -EIO;
+ 		return;
+diff --git a/drivers/gpu/ipu-v3/ipu-csi.c b/drivers/gpu/ipu-v3/ipu-csi.c
+index 5450a2db1219..2beadb3f79c2 100644
+--- a/drivers/gpu/ipu-v3/ipu-csi.c
++++ b/drivers/gpu/ipu-v3/ipu-csi.c
+@@ -318,13 +318,17 @@ static int mbus_code_to_bus_cfg(struct ipu_csi_bus_config *cfg, u32 mbus_code)
+ /*
+  * Fill a CSI bus config struct from mbus_config and mbus_framefmt.
+  */
+-static void fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg,
++static int fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg,
+ 				 struct v4l2_mbus_config *mbus_cfg,
+ 				 struct v4l2_mbus_framefmt *mbus_fmt)
+ {
++	int ret;
++
+ 	memset(csicfg, 0, sizeof(*csicfg));
+ 
+-	mbus_code_to_bus_cfg(csicfg, mbus_fmt->code);
++	ret = mbus_code_to_bus_cfg(csicfg, mbus_fmt->code);
++	if (ret < 0)
++		return ret;
+ 
+ 	switch (mbus_cfg->type) {
+ 	case V4L2_MBUS_PARALLEL:
+@@ -356,6 +360,8 @@ static void fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg,
+ 		/* will never get here, keep compiler quiet */
+ 		break;
+ 	}
++
++	return 0;
+ }
+ 
+ int ipu_csi_init_interface(struct ipu_csi *csi,
+@@ -365,8 +371,11 @@ int ipu_csi_init_interface(struct ipu_csi *csi,
+ 	struct ipu_csi_bus_config cfg;
+ 	unsigned long flags;
+ 	u32 width, height, data = 0;
++	int ret;
+ 
+-	fill_csi_bus_cfg(&cfg, mbus_cfg, mbus_fmt);
++	ret = fill_csi_bus_cfg(&cfg, mbus_cfg, mbus_fmt);
++	if (ret < 0)
++		return ret;
+ 
+ 	/* set default sensor frame width and height */
+ 	width = mbus_fmt->width;
+@@ -587,11 +596,14 @@ int ipu_csi_set_mipi_datatype(struct ipu_csi *csi, u32 vc,
+ 	struct ipu_csi_bus_config cfg;
+ 	unsigned long flags;
+ 	u32 temp;
++	int ret;
+ 
+ 	if (vc > 3)
+ 		return -EINVAL;
+ 
+-	mbus_code_to_bus_cfg(&cfg, mbus_fmt->code);
++	ret = mbus_code_to_bus_cfg(&cfg, mbus_fmt->code);
++	if (ret < 0)
++		return ret;
+ 
+ 	spin_lock_irqsave(&csi->lock, flags);
+ 
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index b10fe26c4891..c9a466be7709 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -1178,6 +1178,9 @@ static ssize_t vmbus_chan_attr_show(struct kobject *kobj,
+ 	if (!attribute->show)
+ 		return -EIO;
+ 
++	if (chan->state != CHANNEL_OPENED_STATE)
++		return -EINVAL;
++
+ 	return attribute->show(chan, buf);
+ }
+ 
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c
+index 9bc04c50d45b..1d94ebec027b 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x.c
+@@ -1027,7 +1027,8 @@ static int etm4_probe(struct amba_device *adev, const struct amba_id *id)
+ 	}
+ 
+ 	pm_runtime_put(&adev->dev);
+-	dev_info(dev, "%s initialized\n", (char *)id->data);
++	dev_info(dev, "CPU%d: ETM v%d.%d initialized\n",
++		 drvdata->cpu, drvdata->arch >> 4, drvdata->arch & 0xf);
+ 
+ 	if (boot_enable) {
+ 		coresight_enable(drvdata->csdev);
+@@ -1045,23 +1046,19 @@ err_arch_supported:
+ 	return ret;
+ }
+ 
++#define ETM4x_AMBA_ID(pid)			\
++	{					\
++		.id	= pid,			\
++		.mask	= 0x000fffff,		\
++	}
++
+ static const struct amba_id etm4_ids[] = {
+-	{       /* ETM 4.0 - Cortex-A53  */
+-		.id	= 0x000bb95d,
+-		.mask	= 0x000fffff,
+-		.data	= "ETM 4.0",
+-	},
+-	{       /* ETM 4.0 - Cortex-A57 */
+-		.id	= 0x000bb95e,
+-		.mask	= 0x000fffff,
+-		.data	= "ETM 4.0",
+-	},
+-	{       /* ETM 4.0 - A72, Maia, HiSilicon */
+-		.id = 0x000bb95a,
+-		.mask = 0x000fffff,
+-		.data = "ETM 4.0",
+-	},
+-	{ 0, 0},
++	ETM4x_AMBA_ID(0x000bb95d),		/* Cortex-A53 */
++	ETM4x_AMBA_ID(0x000bb95e),		/* Cortex-A57 */
++	ETM4x_AMBA_ID(0x000bb95a),		/* Cortex-A72 */
++	ETM4x_AMBA_ID(0x000bb959),		/* Cortex-A73 */
++	ETM4x_AMBA_ID(0x000bb9da),		/* Cortex-A35 */
++	{},
+ };
+ 
+ static struct amba_driver etm4x_driver = {
+diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
+index 01b7457fe8fc..459ef930d98c 100644
+--- a/drivers/hwtracing/coresight/coresight-tpiu.c
++++ b/drivers/hwtracing/coresight/coresight-tpiu.c
+@@ -40,8 +40,9 @@
+ 
+ /** register definition **/
+ /* FFSR - 0x300 */
+-#define FFSR_FT_STOPPED		BIT(1)
++#define FFSR_FT_STOPPED_BIT	1
+ /* FFCR - 0x304 */
++#define FFCR_FON_MAN_BIT	6
+ #define FFCR_FON_MAN		BIT(6)
+ #define FFCR_STOP_FI		BIT(12)
+ 
+@@ -86,9 +87,9 @@ static void tpiu_disable_hw(struct tpiu_drvdata *drvdata)
+ 	/* Generate manual flush */
+ 	writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR);
+ 	/* Wait for flush to complete */
+-	coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0);
++	coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN_BIT, 0);
+ 	/* Wait for formatter to stop */
+-	coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1);
++	coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED_BIT, 1);
+ 
+ 	CS_LOCK(drvdata->base);
+ }
+diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c
+index 29e834aab539..b673718952f6 100644
+--- a/drivers/hwtracing/coresight/coresight.c
++++ b/drivers/hwtracing/coresight/coresight.c
+@@ -108,7 +108,7 @@ static int coresight_find_link_inport(struct coresight_device *csdev,
+ 	dev_err(&csdev->dev, "couldn't find inport, parent: %s, child: %s\n",
+ 		dev_name(&parent->dev), dev_name(&csdev->dev));
+ 
+-	return 0;
++	return -ENODEV;
+ }
+ 
+ static int coresight_find_link_outport(struct coresight_device *csdev,
+@@ -126,7 +126,7 @@ static int coresight_find_link_outport(struct coresight_device *csdev,
+ 	dev_err(&csdev->dev, "couldn't find outport, parent: %s, child: %s\n",
+ 		dev_name(&csdev->dev), dev_name(&child->dev));
+ 
+-	return 0;
++	return -ENODEV;
+ }
+ 
+ static int coresight_enable_sink(struct coresight_device *csdev, u32 mode)
+@@ -179,6 +179,9 @@ static int coresight_enable_link(struct coresight_device *csdev,
+ 	else
+ 		refport = 0;
+ 
++	if (refport < 0)
++		return refport;
++
+ 	if (atomic_inc_return(&csdev->refcnt[refport]) == 1) {
+ 		if (link_ops(csdev)->enable) {
+ 			ret = link_ops(csdev)->enable(csdev, inport, outport);
+diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c
+index 715b6fdb4989..5c8ea4e9203c 100644
+--- a/drivers/i2c/busses/i2c-aspeed.c
++++ b/drivers/i2c/busses/i2c-aspeed.c
+@@ -111,22 +111,22 @@
+ #define ASPEED_I2CD_DEV_ADDR_MASK			GENMASK(6, 0)
+ 
+ enum aspeed_i2c_master_state {
++	ASPEED_I2C_MASTER_INACTIVE,
+ 	ASPEED_I2C_MASTER_START,
+ 	ASPEED_I2C_MASTER_TX_FIRST,
+ 	ASPEED_I2C_MASTER_TX,
+ 	ASPEED_I2C_MASTER_RX_FIRST,
+ 	ASPEED_I2C_MASTER_RX,
+ 	ASPEED_I2C_MASTER_STOP,
+-	ASPEED_I2C_MASTER_INACTIVE,
+ };
+ 
+ enum aspeed_i2c_slave_state {
++	ASPEED_I2C_SLAVE_STOP,
+ 	ASPEED_I2C_SLAVE_START,
+ 	ASPEED_I2C_SLAVE_READ_REQUESTED,
+ 	ASPEED_I2C_SLAVE_READ_PROCESSED,
+ 	ASPEED_I2C_SLAVE_WRITE_REQUESTED,
+ 	ASPEED_I2C_SLAVE_WRITE_RECEIVED,
+-	ASPEED_I2C_SLAVE_STOP,
+ };
+ 
+ struct aspeed_i2c_bus {
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index dafcb6f019b3..2702ead01a03 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -722,6 +722,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
+ 	dgid = (union ib_gid *) &addr->sib_addr;
+ 	pkey = ntohs(addr->sib_pkey);
+ 
++	mutex_lock(&lock);
+ 	list_for_each_entry(cur_dev, &dev_list, list) {
+ 		for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) {
+ 			if (!rdma_cap_af_ib(cur_dev->device, p))
+@@ -748,18 +749,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
+ 					cma_dev = cur_dev;
+ 					sgid = gid;
+ 					id_priv->id.port_num = p;
++					goto found;
+ 				}
+ 			}
+ 		}
+ 	}
+-
+-	if (!cma_dev)
+-		return -ENODEV;
++	mutex_unlock(&lock);
++	return -ENODEV;
+ 
+ found:
+ 	cma_attach_to_dev(id_priv, cma_dev);
+-	addr = (struct sockaddr_ib *) cma_src_addr(id_priv);
+-	memcpy(&addr->sib_addr, &sgid, sizeof sgid);
++	mutex_unlock(&lock);
++	addr = (struct sockaddr_ib *)cma_src_addr(id_priv);
++	memcpy(&addr->sib_addr, &sgid, sizeof(sgid));
+ 	cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr);
+ 	return 0;
+ }
+diff --git a/drivers/infiniband/hw/mlx5/cong.c b/drivers/infiniband/hw/mlx5/cong.c
+index 985fa2637390..7e4e358a4fd8 100644
+--- a/drivers/infiniband/hw/mlx5/cong.c
++++ b/drivers/infiniband/hw/mlx5/cong.c
+@@ -359,9 +359,6 @@ static ssize_t get_param(struct file *filp, char __user *buf, size_t count,
+ 	int ret;
+ 	char lbuf[11];
+ 
+-	if (*pos)
+-		return 0;
+-
+ 	ret = mlx5_ib_get_cc_params(param->dev, param->port_num, offset, &var);
+ 	if (ret)
+ 		return ret;
+@@ -370,11 +367,7 @@ static ssize_t get_param(struct file *filp, char __user *buf, size_t count,
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	if (copy_to_user(buf, lbuf, ret))
+-		return -EFAULT;
+-
+-	*pos += ret;
+-	return ret;
++	return simple_read_from_buffer(buf, count, pos, lbuf, ret);
+ }
+ 
+ static const struct file_operations dbg_cc_fops = {
+diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
+index 90a9c461cedc..308456d28afb 100644
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -271,16 +271,16 @@ static ssize_t size_write(struct file *filp, const char __user *buf,
+ {
+ 	struct mlx5_cache_ent *ent = filp->private_data;
+ 	struct mlx5_ib_dev *dev = ent->dev;
+-	char lbuf[20];
++	char lbuf[20] = {0};
+ 	u32 var;
+ 	int err;
+ 	int c;
+ 
+-	if (copy_from_user(lbuf, buf, sizeof(lbuf)))
++	count = min(count, sizeof(lbuf) - 1);
++	if (copy_from_user(lbuf, buf, count))
+ 		return -EFAULT;
+ 
+ 	c = order2idx(dev, ent->order);
+-	lbuf[sizeof(lbuf) - 1] = 0;
+ 
+ 	if (sscanf(lbuf, "%u", &var) != 1)
+ 		return -EINVAL;
+@@ -310,19 +310,11 @@ static ssize_t size_read(struct file *filp, char __user *buf, size_t count,
+ 	char lbuf[20];
+ 	int err;
+ 
+-	if (*pos)
+-		return 0;
+-
+ 	err = snprintf(lbuf, sizeof(lbuf), "%d\n", ent->size);
+ 	if (err < 0)
+ 		return err;
+ 
+-	if (copy_to_user(buf, lbuf, err))
+-		return -EFAULT;
+-
+-	*pos += err;
+-
+-	return err;
++	return simple_read_from_buffer(buf, count, pos, lbuf, err);
+ }
+ 
+ static const struct file_operations size_fops = {
+@@ -337,16 +329,16 @@ static ssize_t limit_write(struct file *filp, const char __user *buf,
+ {
+ 	struct mlx5_cache_ent *ent = filp->private_data;
+ 	struct mlx5_ib_dev *dev = ent->dev;
+-	char lbuf[20];
++	char lbuf[20] = {0};
+ 	u32 var;
+ 	int err;
+ 	int c;
+ 
+-	if (copy_from_user(lbuf, buf, sizeof(lbuf)))
++	count = min(count, sizeof(lbuf) - 1);
++	if (copy_from_user(lbuf, buf, count))
+ 		return -EFAULT;
+ 
+ 	c = order2idx(dev, ent->order);
+-	lbuf[sizeof(lbuf) - 1] = 0;
+ 
+ 	if (sscanf(lbuf, "%u", &var) != 1)
+ 		return -EINVAL;
+@@ -372,19 +364,11 @@ static ssize_t limit_read(struct file *filp, char __user *buf, size_t count,
+ 	char lbuf[20];
+ 	int err;
+ 
+-	if (*pos)
+-		return 0;
+-
+ 	err = snprintf(lbuf, sizeof(lbuf), "%d\n", ent->limit);
+ 	if (err < 0)
+ 		return err;
+ 
+-	if (copy_to_user(buf, lbuf, err))
+-		return -EFAULT;
+-
+-	*pos += err;
+-
+-	return err;
++	return simple_read_from_buffer(buf, count, pos, lbuf, err);
+ }
+ 
+ static const struct file_operations limit_fops = {
+diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
+index dfba44a40f0b..fe45d6cad6cd 100644
+--- a/drivers/infiniband/sw/rxe/rxe_recv.c
++++ b/drivers/infiniband/sw/rxe/rxe_recv.c
+@@ -225,9 +225,14 @@ static int hdr_check(struct rxe_pkt_info *pkt)
+ 		goto err1;
+ 	}
+ 
++	if (unlikely(qpn == 0)) {
++		pr_warn_once("QP 0 not supported");
++		goto err1;
++	}
++
+ 	if (qpn != IB_MULTICAST_QPN) {
+-		index = (qpn == 0) ? port->qp_smi_index :
+-			((qpn == 1) ? port->qp_gsi_index : qpn);
++		index = (qpn == 1) ? port->qp_gsi_index : qpn;
++
+ 		qp = rxe_pool_get_index(&rxe->qp_pool, index);
+ 		if (unlikely(!qp)) {
+ 			pr_warn_ratelimited("no qp matches qpn 0x%x\n", qpn);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index 6535d9beb24d..a620701f9d41 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -1028,12 +1028,14 @@ static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id, struct ib_cm_event *even
+ 
+ 	skb_queue_head_init(&skqueue);
+ 
++	netif_tx_lock_bh(p->dev);
+ 	spin_lock_irq(&priv->lock);
+ 	set_bit(IPOIB_FLAG_OPER_UP, &p->flags);
+ 	if (p->neigh)
+ 		while ((skb = __skb_dequeue(&p->neigh->queue)))
+ 			__skb_queue_tail(&skqueue, skb);
+ 	spin_unlock_irq(&priv->lock);
++	netif_tx_unlock_bh(p->dev);
+ 
+ 	while ((skb = __skb_dequeue(&skqueue))) {
+ 		skb->dev = p->dev;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 26cde95bc0f3..7630d5ed2b41 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1787,7 +1787,8 @@ int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port)
+ 		goto out_free_pd;
+ 	}
+ 
+-	if (ipoib_neigh_hash_init(priv) < 0) {
++	ret = ipoib_neigh_hash_init(priv);
++	if (ret) {
+ 		pr_warn("%s failed to init neigh hash\n", dev->name);
+ 		goto out_dev_uninit;
+ 	}
+diff --git a/drivers/input/joystick/pxrc.c b/drivers/input/joystick/pxrc.c
+index 07a0dbd3ced2..cfb410cf0789 100644
+--- a/drivers/input/joystick/pxrc.c
++++ b/drivers/input/joystick/pxrc.c
+@@ -120,48 +120,51 @@ static void pxrc_close(struct input_dev *input)
+ 	mutex_unlock(&pxrc->pm_mutex);
+ }
+ 
++static void pxrc_free_urb(void *_pxrc)
++{
++	struct pxrc *pxrc = _pxrc;
++
++	usb_free_urb(pxrc->urb);
++}
++
+ static int pxrc_usb_init(struct pxrc *pxrc)
+ {
+ 	struct usb_endpoint_descriptor *epirq;
+ 	unsigned int pipe;
+-	int retval;
++	int error;
+ 
+ 	/* Set up the endpoint information */
+ 	/* This device only has an interrupt endpoint */
+-	retval = usb_find_common_endpoints(pxrc->intf->cur_altsetting,
+-			NULL, NULL, &epirq, NULL);
+-	if (retval) {
+-		dev_err(&pxrc->intf->dev,
+-			"Could not find endpoint\n");
+-		goto error;
++	error = usb_find_common_endpoints(pxrc->intf->cur_altsetting,
++					  NULL, NULL, &epirq, NULL);
++	if (error) {
++		dev_err(&pxrc->intf->dev, "Could not find endpoint\n");
++		return error;
+ 	}
+ 
+ 	pxrc->bsize = usb_endpoint_maxp(epirq);
+ 	pxrc->epaddr = epirq->bEndpointAddress;
+ 	pxrc->data = devm_kmalloc(&pxrc->intf->dev, pxrc->bsize, GFP_KERNEL);
+-	if (!pxrc->data) {
+-		retval = -ENOMEM;
+-		goto error;
+-	}
++	if (!pxrc->data)
++		return -ENOMEM;
+ 
+ 	usb_set_intfdata(pxrc->intf, pxrc);
+ 	usb_make_path(pxrc->udev, pxrc->phys, sizeof(pxrc->phys));
+ 	strlcat(pxrc->phys, "/input0", sizeof(pxrc->phys));
+ 
+ 	pxrc->urb = usb_alloc_urb(0, GFP_KERNEL);
+-	if (!pxrc->urb) {
+-		retval = -ENOMEM;
+-		goto error;
+-	}
++	if (!pxrc->urb)
++		return -ENOMEM;
++
++	error = devm_add_action_or_reset(&pxrc->intf->dev, pxrc_free_urb, pxrc);
++	if (error)
++		return error;
+ 
+ 	pipe = usb_rcvintpipe(pxrc->udev, pxrc->epaddr),
+ 	usb_fill_int_urb(pxrc->urb, pxrc->udev, pipe, pxrc->data, pxrc->bsize,
+ 						pxrc_usb_irq, pxrc, 1);
+ 
+-error:
+-	return retval;
+-
+-
++	return 0;
+ }
+ 
+ static int pxrc_input_init(struct pxrc *pxrc)
+@@ -197,7 +200,7 @@ static int pxrc_probe(struct usb_interface *intf,
+ 		      const struct usb_device_id *id)
+ {
+ 	struct pxrc *pxrc;
+-	int retval;
++	int error;
+ 
+ 	pxrc = devm_kzalloc(&intf->dev, sizeof(*pxrc), GFP_KERNEL);
+ 	if (!pxrc)
+@@ -207,29 +210,20 @@ static int pxrc_probe(struct usb_interface *intf,
+ 	pxrc->udev = usb_get_dev(interface_to_usbdev(intf));
+ 	pxrc->intf = intf;
+ 
+-	retval = pxrc_usb_init(pxrc);
+-	if (retval)
+-		goto error;
++	error = pxrc_usb_init(pxrc);
++	if (error)
++		return error;
+ 
+-	retval = pxrc_input_init(pxrc);
+-	if (retval)
+-		goto err_free_urb;
++	error = pxrc_input_init(pxrc);
++	if (error)
++		return error;
+ 
+ 	return 0;
+-
+-err_free_urb:
+-	usb_free_urb(pxrc->urb);
+-
+-error:
+-	return retval;
+ }
+ 
+ static void pxrc_disconnect(struct usb_interface *intf)
+ {
+-	struct pxrc *pxrc = usb_get_intfdata(intf);
+-
+-	usb_free_urb(pxrc->urb);
+-	usb_set_intfdata(intf, NULL);
++	/* All driver resources are devm-managed. */
+ }
+ 
+ static int pxrc_suspend(struct usb_interface *intf, pm_message_t message)
+diff --git a/drivers/input/touchscreen/rohm_bu21023.c b/drivers/input/touchscreen/rohm_bu21023.c
+index bda0500c9b57..714affdd742f 100644
+--- a/drivers/input/touchscreen/rohm_bu21023.c
++++ b/drivers/input/touchscreen/rohm_bu21023.c
+@@ -304,7 +304,7 @@ static int rohm_i2c_burst_read(struct i2c_client *client, u8 start, void *buf,
+ 	msg[1].len = len;
+ 	msg[1].buf = buf;
+ 
+-	i2c_lock_adapter(adap);
++	i2c_lock_bus(adap, I2C_LOCK_SEGMENT);
+ 
+ 	for (i = 0; i < 2; i++) {
+ 		if (__i2c_transfer(adap, &msg[i], 1) < 0) {
+@@ -313,7 +313,7 @@ static int rohm_i2c_burst_read(struct i2c_client *client, u8 start, void *buf,
+ 		}
+ 	}
+ 
+-	i2c_unlock_adapter(adap);
++	i2c_unlock_bus(adap, I2C_LOCK_SEGMENT);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
+index b73c6a7bf7f2..b7076aa24d6b 100644
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -1302,6 +1302,7 @@ static irqreturn_t arm_smmu_priq_thread(int irq, void *dev)
+ 
+ 	/* Sync our overflow flag, as we believe we're up to speed */
+ 	q->cons = Q_OVF(q, q->prod) | Q_WRP(q, q->cons) | Q_IDX(q, q->cons);
++	writel(q->cons, q->cons_reg);
+ 	return IRQ_HANDLED;
+ }
+ 
+diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
+index 50e3a9fcf43e..b5948ba6b3b3 100644
+--- a/drivers/iommu/io-pgtable-arm-v7s.c
++++ b/drivers/iommu/io-pgtable-arm-v7s.c
+@@ -192,6 +192,7 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,
+ {
+ 	struct io_pgtable_cfg *cfg = &data->iop.cfg;
+ 	struct device *dev = cfg->iommu_dev;
++	phys_addr_t phys;
+ 	dma_addr_t dma;
+ 	size_t size = ARM_V7S_TABLE_SIZE(lvl);
+ 	void *table = NULL;
+@@ -200,6 +201,10 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,
+ 		table = (void *)__get_dma_pages(__GFP_ZERO, get_order(size));
+ 	else if (lvl == 2)
+ 		table = kmem_cache_zalloc(data->l2_tables, gfp | GFP_DMA);
++	phys = virt_to_phys(table);
++	if (phys != (arm_v7s_iopte)phys)
++		/* Doesn't fit in PTE */
++		goto out_free;
+ 	if (table && !(cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA)) {
+ 		dma = dma_map_single(dev, table, size, DMA_TO_DEVICE);
+ 		if (dma_mapping_error(dev, dma))
+@@ -209,7 +214,7 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,
+ 		 * address directly, so if the DMA layer suggests otherwise by
+ 		 * translating or truncating them, that bodes very badly...
+ 		 */
+-		if (dma != virt_to_phys(table))
++		if (dma != phys)
+ 			goto out_unmap;
+ 	}
+ 	kmemleak_ignore(table);
+diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
+index 010a254305dd..88641b4560bc 100644
+--- a/drivers/iommu/io-pgtable-arm.c
++++ b/drivers/iommu/io-pgtable-arm.c
+@@ -237,7 +237,8 @@ static void *__arm_lpae_alloc_pages(size_t size, gfp_t gfp,
+ 	void *pages;
+ 
+ 	VM_BUG_ON((gfp & __GFP_HIGHMEM));
+-	p = alloc_pages_node(dev_to_node(dev), gfp | __GFP_ZERO, order);
++	p = alloc_pages_node(dev ? dev_to_node(dev) : NUMA_NO_NODE,
++			     gfp | __GFP_ZERO, order);
+ 	if (!p)
+ 		return NULL;
+ 
+diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
+index feb1664815b7..6e2882cda55d 100644
+--- a/drivers/iommu/ipmmu-vmsa.c
++++ b/drivers/iommu/ipmmu-vmsa.c
+@@ -47,6 +47,7 @@ struct ipmmu_features {
+ 	unsigned int number_of_contexts;
+ 	bool setup_imbuscr;
+ 	bool twobit_imttbcr_sl0;
++	bool reserved_context;
+ };
+ 
+ struct ipmmu_vmsa_device {
+@@ -916,6 +917,7 @@ static const struct ipmmu_features ipmmu_features_default = {
+ 	.number_of_contexts = 1, /* software only tested with one context */
+ 	.setup_imbuscr = true,
+ 	.twobit_imttbcr_sl0 = false,
++	.reserved_context = false,
+ };
+ 
+ static const struct ipmmu_features ipmmu_features_r8a7795 = {
+@@ -924,6 +926,7 @@ static const struct ipmmu_features ipmmu_features_r8a7795 = {
+ 	.number_of_contexts = 8,
+ 	.setup_imbuscr = false,
+ 	.twobit_imttbcr_sl0 = true,
++	.reserved_context = true,
+ };
+ 
+ static const struct of_device_id ipmmu_of_ids[] = {
+@@ -1017,6 +1020,11 @@ static int ipmmu_probe(struct platform_device *pdev)
+ 		}
+ 
+ 		ipmmu_device_reset(mmu);
++
++		if (mmu->features->reserved_context) {
++			dev_info(&pdev->dev, "IPMMU context 0 is reserved\n");
++			set_bit(0, mmu->ctx);
++		}
+ 	}
+ 
+ 	/*
+diff --git a/drivers/lightnvm/pblk-init.c b/drivers/lightnvm/pblk-init.c
+index b57f764d6a16..93ebba6dcc25 100644
+--- a/drivers/lightnvm/pblk-init.c
++++ b/drivers/lightnvm/pblk-init.c
+@@ -716,10 +716,11 @@ static int pblk_setup_line_meta_12(struct pblk *pblk, struct pblk_line *line,
+ 
+ 		/*
+ 		 * In 1.2 spec. chunk state is not persisted by the device. Thus
+-		 * some of the values are reset each time pblk is instantiated.
++		 * some of the values are reset each time pblk is instantiated,
++		 * so we have to assume that the block is closed.
+ 		 */
+ 		if (lun_bb_meta[line->id] == NVM_BLK_T_FREE)
+-			chunk->state =  NVM_CHK_ST_FREE;
++			chunk->state =  NVM_CHK_ST_CLOSED;
+ 		else
+ 			chunk->state = NVM_CHK_ST_OFFLINE;
+ 
+diff --git a/drivers/lightnvm/pblk-recovery.c b/drivers/lightnvm/pblk-recovery.c
+index 3a5069183859..d83466b3821b 100644
+--- a/drivers/lightnvm/pblk-recovery.c
++++ b/drivers/lightnvm/pblk-recovery.c
+@@ -742,9 +742,10 @@ static int pblk_recov_check_line_version(struct pblk *pblk,
+ 		return 1;
+ 	}
+ 
+-#ifdef NVM_DEBUG
++#ifdef CONFIG_NVM_PBLK_DEBUG
+ 	if (header->version_minor > EMETA_VERSION_MINOR)
+-		pr_info("pblk: newer line minor version found: %d\n", line_v);
++		pr_info("pblk: newer line minor version found: %d\n",
++				header->version_minor);
+ #endif
+ 
+ 	return 0;
+diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
+index 12decdbd722d..fc65f0dedf7f 100644
+--- a/drivers/md/dm-verity-target.c
++++ b/drivers/md/dm-verity-target.c
+@@ -99,10 +99,26 @@ static int verity_hash_update(struct dm_verity *v, struct ahash_request *req,
+ {
+ 	struct scatterlist sg;
+ 
+-	sg_init_one(&sg, data, len);
+-	ahash_request_set_crypt(req, &sg, NULL, len);
+-
+-	return crypto_wait_req(crypto_ahash_update(req), wait);
++	if (likely(!is_vmalloc_addr(data))) {
++		sg_init_one(&sg, data, len);
++		ahash_request_set_crypt(req, &sg, NULL, len);
++		return crypto_wait_req(crypto_ahash_update(req), wait);
++	} else {
++		do {
++			int r;
++			size_t this_step = min_t(size_t, len, PAGE_SIZE - offset_in_page(data));
++			flush_kernel_vmap_range((void *)data, this_step);
++			sg_init_table(&sg, 1);
++			sg_set_page(&sg, vmalloc_to_page(data), this_step, offset_in_page(data));
++			ahash_request_set_crypt(req, &sg, NULL, this_step);
++			r = crypto_wait_req(crypto_ahash_update(req), wait);
++			if (unlikely(r))
++				return r;
++			data += this_step;
++			len -= this_step;
++		} while (len);
++		return 0;
++	}
+ }
+ 
+ /*
+diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
+index f32ec7342ef0..5653e8eebe2b 100644
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -1377,6 +1377,11 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb)
+ 	struct vb2_buffer *vb;
+ 	int ret;
+ 
++	if (q->error) {
++		dprintk(1, "fatal error occurred on queue\n");
++		return -EIO;
++	}
++
+ 	vb = q->bufs[index];
+ 
+ 	switch (vb->state) {
+diff --git a/drivers/media/i2c/ov5645.c b/drivers/media/i2c/ov5645.c
+index b3f762578f7f..1722cdab0daf 100644
+--- a/drivers/media/i2c/ov5645.c
++++ b/drivers/media/i2c/ov5645.c
+@@ -510,8 +510,8 @@ static const struct reg_value ov5645_setting_full[] = {
+ };
+ 
+ static const s64 link_freq[] = {
+-	222880000,
+-	334320000
++	224000000,
++	336000000
+ };
+ 
+ static const struct ov5645_mode_info ov5645_mode_info_data[] = {
+@@ -520,7 +520,7 @@ static const struct ov5645_mode_info ov5645_mode_info_data[] = {
+ 		.height = 960,
+ 		.data = ov5645_setting_sxga,
+ 		.data_size = ARRAY_SIZE(ov5645_setting_sxga),
+-		.pixel_clock = 111440000,
++		.pixel_clock = 112000000,
+ 		.link_freq = 0 /* an index in link_freq[] */
+ 	},
+ 	{
+@@ -528,7 +528,7 @@ static const struct ov5645_mode_info ov5645_mode_info_data[] = {
+ 		.height = 1080,
+ 		.data = ov5645_setting_1080p,
+ 		.data_size = ARRAY_SIZE(ov5645_setting_1080p),
+-		.pixel_clock = 167160000,
++		.pixel_clock = 168000000,
+ 		.link_freq = 1 /* an index in link_freq[] */
+ 	},
+ 	{
+@@ -536,7 +536,7 @@ static const struct ov5645_mode_info ov5645_mode_info_data[] = {
+ 		.height = 1944,
+ 		.data = ov5645_setting_full,
+ 		.data_size = ARRAY_SIZE(ov5645_setting_full),
+-		.pixel_clock = 167160000,
++		.pixel_clock = 168000000,
+ 		.link_freq = 1 /* an index in link_freq[] */
+ 	},
+ };
+@@ -1145,7 +1145,8 @@ static int ov5645_probe(struct i2c_client *client,
+ 		return ret;
+ 	}
+ 
+-	if (xclk_freq != 23880000) {
++	/* external clock must be 24MHz, allow 1% tolerance */
++	if (xclk_freq < 23760000 || xclk_freq > 24240000) {
+ 		dev_err(dev, "external clock frequency %u is not supported\n",
+ 			xclk_freq);
+ 		return -EINVAL;
+diff --git a/drivers/media/pci/tw686x/tw686x-video.c b/drivers/media/pci/tw686x/tw686x-video.c
+index 0ea8dd44026c..3a06c000f97b 100644
+--- a/drivers/media/pci/tw686x/tw686x-video.c
++++ b/drivers/media/pci/tw686x/tw686x-video.c
+@@ -1190,6 +1190,14 @@ int tw686x_video_init(struct tw686x_dev *dev)
+ 			return err;
+ 	}
+ 
++	/* Initialize vc->dev and vc->ch for the error path */
++	for (ch = 0; ch < max_channels(dev); ch++) {
++		struct tw686x_video_channel *vc = &dev->video_channels[ch];
++
++		vc->dev = dev;
++		vc->ch = ch;
++	}
++
+ 	for (ch = 0; ch < max_channels(dev); ch++) {
+ 		struct tw686x_video_channel *vc = &dev->video_channels[ch];
+ 		struct video_device *vdev;
+@@ -1198,9 +1206,6 @@ int tw686x_video_init(struct tw686x_dev *dev)
+ 		spin_lock_init(&vc->qlock);
+ 		INIT_LIST_HEAD(&vc->vidq_queued);
+ 
+-		vc->dev = dev;
+-		vc->ch = ch;
+-
+ 		/* default settings */
+ 		err = tw686x_set_standard(vc, V4L2_STD_NTSC);
+ 		if (err)
+diff --git a/drivers/mfd/88pm860x-i2c.c b/drivers/mfd/88pm860x-i2c.c
+index 84e313107233..7b9052ea7413 100644
+--- a/drivers/mfd/88pm860x-i2c.c
++++ b/drivers/mfd/88pm860x-i2c.c
+@@ -146,14 +146,14 @@ int pm860x_page_reg_write(struct i2c_client *i2c, int reg,
+ 	unsigned char zero;
+ 	int ret;
+ 
+-	i2c_lock_adapter(i2c->adapter);
++	i2c_lock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ 	read_device(i2c, 0xFA, 0, &zero);
+ 	read_device(i2c, 0xFB, 0, &zero);
+ 	read_device(i2c, 0xFF, 0, &zero);
+ 	ret = write_device(i2c, reg, 1, &data);
+ 	read_device(i2c, 0xFE, 0, &zero);
+ 	read_device(i2c, 0xFC, 0, &zero);
+-	i2c_unlock_adapter(i2c->adapter);
++	i2c_unlock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ 	return ret;
+ }
+ EXPORT_SYMBOL(pm860x_page_reg_write);
+@@ -164,14 +164,14 @@ int pm860x_page_bulk_read(struct i2c_client *i2c, int reg,
+ 	unsigned char zero = 0;
+ 	int ret;
+ 
+-	i2c_lock_adapter(i2c->adapter);
++	i2c_lock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ 	read_device(i2c, 0xfa, 0, &zero);
+ 	read_device(i2c, 0xfb, 0, &zero);
+ 	read_device(i2c, 0xff, 0, &zero);
+ 	ret = read_device(i2c, reg, count, buf);
+ 	read_device(i2c, 0xFE, 0, &zero);
+ 	read_device(i2c, 0xFC, 0, &zero);
+-	i2c_unlock_adapter(i2c->adapter);
++	i2c_unlock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ 	return ret;
+ }
+ EXPORT_SYMBOL(pm860x_page_bulk_read);
+diff --git a/drivers/misc/hmc6352.c b/drivers/misc/hmc6352.c
+index eeb7eef62174..38f90e179927 100644
+--- a/drivers/misc/hmc6352.c
++++ b/drivers/misc/hmc6352.c
+@@ -27,6 +27,7 @@
+ #include <linux/err.h>
+ #include <linux/delay.h>
+ #include <linux/sysfs.h>
++#include <linux/nospec.h>
+ 
+ static DEFINE_MUTEX(compass_mutex);
+ 
+@@ -50,6 +51,7 @@ static int compass_store(struct device *dev, const char *buf, size_t count,
+ 		return ret;
+ 	if (val >= strlen(map))
+ 		return -EINVAL;
++	val = array_index_nospec(val, strlen(map));
+ 	mutex_lock(&compass_mutex);
+ 	ret = compass_command(c, map[val]);
+ 	mutex_unlock(&compass_mutex);
+diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
+index fb83d1375638..50d82c3d032a 100644
+--- a/drivers/misc/ibmvmc.c
++++ b/drivers/misc/ibmvmc.c
+@@ -2131,7 +2131,7 @@ static int ibmvmc_init_crq_queue(struct crq_server_adapter *adapter)
+ 	retrc = plpar_hcall_norets(H_REG_CRQ,
+ 				   vdev->unit_address,
+ 				   queue->msg_token, PAGE_SIZE);
+-	retrc = rc;
++	rc = retrc;
+ 
+ 	if (rc == H_RESOURCE)
+ 		rc = ibmvmc_reset_crq_queue(adapter);
+diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c
+index 0208c4b027c5..fa0236a5e59a 100644
+--- a/drivers/misc/mei/bus-fixup.c
++++ b/drivers/misc/mei/bus-fixup.c
+@@ -267,7 +267,7 @@ static int mei_nfc_if_version(struct mei_cl *cl,
+ 
+ 	ret = 0;
+ 	bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length, 0);
+-	if (bytes_recv < if_version_length) {
++	if (bytes_recv < 0 || bytes_recv < if_version_length) {
+ 		dev_err(bus->dev, "Could not read IF version\n");
+ 		ret = -EIO;
+ 		goto err;
+diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
+index b1133739fb4b..692b2f9a18cb 100644
+--- a/drivers/misc/mei/bus.c
++++ b/drivers/misc/mei/bus.c
+@@ -505,17 +505,15 @@ int mei_cldev_enable(struct mei_cl_device *cldev)
+ 
+ 	cl = cldev->cl;
+ 
++	mutex_lock(&bus->device_lock);
+ 	if (cl->state == MEI_FILE_UNINITIALIZED) {
+-		mutex_lock(&bus->device_lock);
+ 		ret = mei_cl_link(cl);
+-		mutex_unlock(&bus->device_lock);
+ 		if (ret)
+-			return ret;
++			goto out;
+ 		/* update pointers */
+ 		cl->cldev = cldev;
+ 	}
+ 
+-	mutex_lock(&bus->device_lock);
+ 	if (mei_cl_is_connected(cl)) {
+ 		ret = 0;
+ 		goto out;
+@@ -600,9 +598,8 @@ int mei_cldev_disable(struct mei_cl_device *cldev)
+ 	if (err < 0)
+ 		dev_err(bus->dev, "Could not disconnect from the ME client\n");
+ 
+-out:
+ 	mei_cl_bus_module_put(cldev);
+-
++out:
+ 	/* Flush queues and remove any pending read */
+ 	mei_cl_flush_queues(cl, NULL);
+ 	mei_cl_unlink(cl);
+@@ -860,12 +857,13 @@ static void mei_cl_bus_dev_release(struct device *dev)
+ 
+ 	mei_me_cl_put(cldev->me_cl);
+ 	mei_dev_bus_put(cldev->bus);
++	mei_cl_unlink(cldev->cl);
+ 	kfree(cldev->cl);
+ 	kfree(cldev);
+ }
+ 
+ static const struct device_type mei_cl_device_type = {
+-	.release	= mei_cl_bus_dev_release,
++	.release = mei_cl_bus_dev_release,
+ };
+ 
+ /**
+diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
+index fe6595fe94f1..995ff1b7e7b5 100644
+--- a/drivers/misc/mei/hbm.c
++++ b/drivers/misc/mei/hbm.c
+@@ -1140,15 +1140,18 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
+ 
+ 		props_res = (struct hbm_props_response *)mei_msg;
+ 
+-		if (props_res->status) {
++		if (props_res->status == MEI_HBMS_CLIENT_NOT_FOUND) {
++			dev_dbg(dev->dev, "hbm: properties response: %d CLIENT_NOT_FOUND\n",
++				props_res->me_addr);
++		} else if (props_res->status) {
+ 			dev_err(dev->dev, "hbm: properties response: wrong status = %d %s\n",
+ 				props_res->status,
+ 				mei_hbm_status_str(props_res->status));
+ 			return -EPROTO;
++		} else {
++			mei_hbm_me_cl_add(dev, props_res);
+ 		}
+ 
+-		mei_hbm_me_cl_add(dev, props_res);
+-
+ 		/* request property for the next client */
+ 		if (mei_hbm_prop_req(dev, props_res->me_addr + 1))
+ 			return -EIO;
+diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c
+index 09cb89645d06..2cfec33178c1 100644
+--- a/drivers/mmc/host/meson-mx-sdio.c
++++ b/drivers/mmc/host/meson-mx-sdio.c
+@@ -517,19 +517,23 @@ static struct mmc_host_ops meson_mx_mmc_ops = {
+ static struct platform_device *meson_mx_mmc_slot_pdev(struct device *parent)
+ {
+ 	struct device_node *slot_node;
++	struct platform_device *pdev;
+ 
+ 	/*
+ 	 * TODO: the MMC core framework currently does not support
+ 	 * controllers with multiple slots properly. So we only register
+ 	 * the first slot for now
+ 	 */
+-	slot_node = of_find_compatible_node(parent->of_node, NULL, "mmc-slot");
++	slot_node = of_get_compatible_child(parent->of_node, "mmc-slot");
+ 	if (!slot_node) {
+ 		dev_warn(parent, "no 'mmc-slot' sub-node found\n");
+ 		return ERR_PTR(-ENOENT);
+ 	}
+ 
+-	return of_platform_device_create(slot_node, NULL, parent);
++	pdev = of_platform_device_create(slot_node, NULL, parent);
++	of_node_put(slot_node);
++
++	return pdev;
+ }
+ 
+ static int meson_mx_mmc_add_host(struct meson_mx_mmc_host *host)
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index 071693ebfe18..68760d4a5d3d 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -2177,6 +2177,7 @@ static int omap_hsmmc_remove(struct platform_device *pdev)
+ 	dma_release_channel(host->tx_chan);
+ 	dma_release_channel(host->rx_chan);
+ 
++	dev_pm_clear_wake_irq(host->dev);
+ 	pm_runtime_dont_use_autosuspend(host->dev);
+ 	pm_runtime_put_sync(host->dev);
+ 	pm_runtime_disable(host->dev);
+diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
+index 4ffa6b173a21..8332f56e6c0d 100644
+--- a/drivers/mmc/host/sdhci-of-esdhc.c
++++ b/drivers/mmc/host/sdhci-of-esdhc.c
+@@ -22,6 +22,7 @@
+ #include <linux/sys_soc.h>
+ #include <linux/clk.h>
+ #include <linux/ktime.h>
++#include <linux/dma-mapping.h>
+ #include <linux/mmc/host.h>
+ #include "sdhci-pltfm.h"
+ #include "sdhci-esdhc.h"
+@@ -427,6 +428,11 @@ static void esdhc_of_adma_workaround(struct sdhci_host *host, u32 intmask)
+ static int esdhc_of_enable_dma(struct sdhci_host *host)
+ {
+ 	u32 value;
++	struct device *dev = mmc_dev(host->mmc);
++
++	if (of_device_is_compatible(dev->of_node, "fsl,ls1043a-esdhc") ||
++	    of_device_is_compatible(dev->of_node, "fsl,ls1046a-esdhc"))
++		dma_set_mask_and_coherent(dev, DMA_BIT_MASK(40));
+ 
+ 	value = sdhci_readl(host, ESDHC_DMA_SYSCTL);
+ 	value |= ESDHC_DMA_SNOOP;
+diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
+index 970d38f68939..137df06b9b6e 100644
+--- a/drivers/mmc/host/sdhci-tegra.c
++++ b/drivers/mmc/host/sdhci-tegra.c
+@@ -334,7 +334,8 @@ static const struct sdhci_pltfm_data sdhci_tegra30_pdata = {
+ 		  SDHCI_QUIRK_NO_HISPD_BIT |
+ 		  SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC |
+ 		  SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN,
+-	.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
++	.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
++		   SDHCI_QUIRK2_BROKEN_HS200,
+ 	.ops  = &tegra_sdhci_ops,
+ };
+ 
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 1c828e0e9905..a7b5602ef6f7 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -3734,14 +3734,21 @@ int sdhci_setup_host(struct sdhci_host *host)
+ 	    mmc_gpio_get_cd(host->mmc) < 0)
+ 		mmc->caps |= MMC_CAP_NEEDS_POLL;
+ 
+-	/* If vqmmc regulator and no 1.8V signalling, then there's no UHS */
+ 	if (!IS_ERR(mmc->supply.vqmmc)) {
+ 		ret = regulator_enable(mmc->supply.vqmmc);
++
++		/* If vqmmc provides no 1.8V signalling, then there's no UHS */
+ 		if (!regulator_is_supported_voltage(mmc->supply.vqmmc, 1700000,
+ 						    1950000))
+ 			host->caps1 &= ~(SDHCI_SUPPORT_SDR104 |
+ 					 SDHCI_SUPPORT_SDR50 |
+ 					 SDHCI_SUPPORT_DDR50);
++
++		/* In eMMC case vqmmc might be a fixed 1.8V regulator */
++		if (!regulator_is_supported_voltage(mmc->supply.vqmmc, 2700000,
++						    3600000))
++			host->flags &= ~SDHCI_SIGNALING_330;
++
+ 		if (ret) {
+ 			pr_warn("%s: Failed to enable vqmmc regulator: %d\n",
+ 				mmc_hostname(mmc), ret);
+diff --git a/drivers/mtd/maps/solutionengine.c b/drivers/mtd/maps/solutionengine.c
+index bb580bc16445..c07f21b20463 100644
+--- a/drivers/mtd/maps/solutionengine.c
++++ b/drivers/mtd/maps/solutionengine.c
+@@ -59,9 +59,9 @@ static int __init init_soleng_maps(void)
+ 			return -ENXIO;
+ 		}
+ 	}
+-	printk(KERN_NOTICE "Solution Engine: Flash at 0x%08lx, EPROM at 0x%08lx\n",
+-	       soleng_flash_map.phys & 0x1fffffff,
+-	       soleng_eprom_map.phys & 0x1fffffff);
++	printk(KERN_NOTICE "Solution Engine: Flash at 0x%pap, EPROM at 0x%pap\n",
++	       &soleng_flash_map.phys,
++	       &soleng_eprom_map.phys);
+ 	flash_mtd->owner = THIS_MODULE;
+ 
+ 	eprom_mtd = do_map_probe("map_rom", &soleng_eprom_map);
+diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
+index cd67c85cc87d..02389528f622 100644
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -160,8 +160,12 @@ static ssize_t mtdchar_read(struct file *file, char __user *buf, size_t count,
+ 
+ 	pr_debug("MTD_read\n");
+ 
+-	if (*ppos + count > mtd->size)
+-		count = mtd->size - *ppos;
++	if (*ppos + count > mtd->size) {
++		if (*ppos < mtd->size)
++			count = mtd->size - *ppos;
++		else
++			count = 0;
++	}
+ 
+ 	if (!count)
+ 		return 0;
+@@ -246,7 +250,7 @@ static ssize_t mtdchar_write(struct file *file, const char __user *buf, size_t c
+ 
+ 	pr_debug("MTD_write\n");
+ 
+-	if (*ppos == mtd->size)
++	if (*ppos >= mtd->size)
+ 		return -ENOSPC;
+ 
+ 	if (*ppos + count > mtd->size)
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
+index cc1e4f820e64..533094233659 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
+@@ -289,7 +289,7 @@ static int xgbe_alloc_pages(struct xgbe_prv_data *pdata,
+ 	struct page *pages = NULL;
+ 	dma_addr_t pages_dma;
+ 	gfp_t gfp;
+-	int order, ret;
++	int order;
+ 
+ again:
+ 	order = alloc_order;
+@@ -316,10 +316,9 @@ again:
+ 	/* Map the pages */
+ 	pages_dma = dma_map_page(pdata->dev, pages, 0,
+ 				 PAGE_SIZE << order, DMA_FROM_DEVICE);
+-	ret = dma_mapping_error(pdata->dev, pages_dma);
+-	if (ret) {
++	if (dma_mapping_error(pdata->dev, pages_dma)) {
+ 		put_page(pages);
+-		return ret;
++		return -ENOMEM;
+ 	}
+ 
+ 	pa->pages = pages;
+diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+index 929d485a3a2f..e088dedc1747 100644
+--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+@@ -493,6 +493,9 @@ static void cn23xx_pf_setup_global_output_regs(struct octeon_device *oct)
+ 	for (q_no = srn; q_no < ern; q_no++) {
+ 		reg_val = octeon_read_csr(oct, CN23XX_SLI_OQ_PKT_CONTROL(q_no));
+ 
++		/* clear IPTR */
++		reg_val &= ~CN23XX_PKT_OUTPUT_CTL_IPTR;
++
+ 		/* set DPTR */
+ 		reg_val |= CN23XX_PKT_OUTPUT_CTL_DPTR;
+ 
+diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_vf_device.c b/drivers/net/ethernet/cavium/liquidio/cn23xx_vf_device.c
+index 9338a0008378..1f8b7f651254 100644
+--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_vf_device.c
++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_vf_device.c
+@@ -165,6 +165,9 @@ static void cn23xx_vf_setup_global_output_regs(struct octeon_device *oct)
+ 		reg_val =
+ 		    octeon_read_csr(oct, CN23XX_VF_SLI_OQ_PKT_CONTROL(q_no));
+ 
++		/* clear IPTR */
++		reg_val &= ~CN23XX_PKT_OUTPUT_CTL_IPTR;
++
+ 		/* set DPTR */
+ 		reg_val |= CN23XX_PKT_OUTPUT_CTL_DPTR;
+ 
+diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
+index 6d7404f66f84..c9a061e707c4 100644
+--- a/drivers/net/ethernet/cortina/gemini.c
++++ b/drivers/net/ethernet/cortina/gemini.c
+@@ -1753,7 +1753,10 @@ static int gmac_open(struct net_device *netdev)
+ 	phy_start(netdev->phydev);
+ 
+ 	err = geth_resize_freeq(port);
+-	if (err) {
++	/* It's fine if it's just busy, the other port has set up
++	 * the freeq in that case.
++	 */
++	if (err && (err != -EBUSY)) {
+ 		netdev_err(netdev, "could not resize freeq\n");
+ 		goto err_stop_phy;
+ 	}
+diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
+index ff92ab1daeb8..1e9d882c04ef 100644
+--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
+@@ -4500,7 +4500,7 @@ int be_cmd_get_profile_config(struct be_adapter *adapter,
+ 				port_res->max_vfs += le16_to_cpu(pcie->num_vfs);
+ 			}
+ 		}
+-		return status;
++		goto err;
+ 	}
+ 
+ 	pcie = be_get_pcie_desc(resp->func_param, desc_count,
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 25a73bb2e642..9d69621f5ab4 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -3081,7 +3081,6 @@ static int hns3_client_init(struct hnae3_handle *handle)
+ 	priv->dev = &pdev->dev;
+ 	priv->netdev = netdev;
+ 	priv->ae_handle = handle;
+-	priv->ae_handle->reset_level = HNAE3_NONE_RESET;
+ 	priv->ae_handle->last_reset_time = jiffies;
+ 	priv->tx_timeout_count = 0;
+ 
+@@ -3102,6 +3101,11 @@ static int hns3_client_init(struct hnae3_handle *handle)
+ 	/* Carrier off reporting is important to ethtool even BEFORE open */
+ 	netif_carrier_off(netdev);
+ 
++	if (handle->flags & HNAE3_SUPPORT_VF)
++		handle->reset_level = HNAE3_VF_RESET;
++	else
++		handle->reset_level = HNAE3_FUNC_RESET;
++
+ 	ret = hns3_get_ring_config(priv);
+ 	if (ret) {
+ 		ret = -ENOMEM;
+@@ -3418,7 +3422,7 @@ static int hns3_reset_notify_down_enet(struct hnae3_handle *handle)
+ 	struct net_device *ndev = kinfo->netdev;
+ 
+ 	if (!netif_running(ndev))
+-		return -EIO;
++		return 0;
+ 
+ 	return hns3_nic_net_stop(ndev);
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 6fd7ea8074b0..13f43b74fd6d 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -2825,15 +2825,13 @@ static void hclge_clear_reset_cause(struct hclge_dev *hdev)
+ static void hclge_reset(struct hclge_dev *hdev)
+ {
+ 	/* perform reset of the stack & ae device for a client */
+-
++	rtnl_lock();
+ 	hclge_notify_client(hdev, HNAE3_DOWN_CLIENT);
+ 
+ 	if (!hclge_reset_wait(hdev)) {
+-		rtnl_lock();
+ 		hclge_notify_client(hdev, HNAE3_UNINIT_CLIENT);
+ 		hclge_reset_ae_dev(hdev->ae_dev);
+ 		hclge_notify_client(hdev, HNAE3_INIT_CLIENT);
+-		rtnl_unlock();
+ 
+ 		hclge_clear_reset_cause(hdev);
+ 	} else {
+@@ -2843,6 +2841,7 @@ static void hclge_reset(struct hclge_dev *hdev)
+ 	}
+ 
+ 	hclge_notify_client(hdev, HNAE3_UP_CLIENT);
++	rtnl_unlock();
+ }
+ 
+ static void hclge_reset_event(struct hnae3_handle *handle)
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 0319ed9ef8b8..f7f08e3fa761 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -5011,6 +5011,12 @@ static int mvpp2_probe(struct platform_device *pdev)
+ 			(unsigned long)of_device_get_match_data(&pdev->dev);
+ 	}
+ 
++	/* multi queue mode isn't supported on PPV2.1, fallback to single
++	 * mode
++	 */
++	if (priv->hw_version == MVPP21)
++		queue_mode = MVPP2_QDIST_SINGLE_MODE;
++
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	base = devm_ioremap_resource(&pdev->dev, res);
+ 	if (IS_ERR(base))
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+index 384c1fa49081..f167f4eec3ff 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -452,6 +452,7 @@ const char *mlx5_command_str(int command)
+ 	MLX5_COMMAND_STR_CASE(SET_HCA_CAP);
+ 	MLX5_COMMAND_STR_CASE(QUERY_ISSI);
+ 	MLX5_COMMAND_STR_CASE(SET_ISSI);
++	MLX5_COMMAND_STR_CASE(SET_DRIVER_VERSION);
+ 	MLX5_COMMAND_STR_CASE(CREATE_MKEY);
+ 	MLX5_COMMAND_STR_CASE(QUERY_MKEY);
+ 	MLX5_COMMAND_STR_CASE(DESTROY_MKEY);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+index b994b80d5714..922811fb66e7 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+@@ -132,11 +132,11 @@ void mlx5_add_device(struct mlx5_interface *intf, struct mlx5_priv *priv)
+ 	delayed_event_start(priv);
+ 
+ 	dev_ctx->context = intf->add(dev);
+-	set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state);
+-	if (intf->attach)
+-		set_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state);
+-
+ 	if (dev_ctx->context) {
++		set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state);
++		if (intf->attach)
++			set_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state);
++
+ 		spin_lock_irq(&priv->ctx_lock);
+ 		list_add_tail(&dev_ctx->list, &priv->ctx_list);
+ 
+@@ -211,12 +211,17 @@ static void mlx5_attach_interface(struct mlx5_interface *intf, struct mlx5_priv
+ 	if (intf->attach) {
+ 		if (test_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state))
+ 			goto out;
+-		intf->attach(dev, dev_ctx->context);
++		if (intf->attach(dev, dev_ctx->context))
++			goto out;
++
+ 		set_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state);
+ 	} else {
+ 		if (test_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state))
+ 			goto out;
+ 		dev_ctx->context = intf->add(dev);
++		if (!dev_ctx->context)
++			goto out;
++
+ 		set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state);
+ 	}
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+index 91f1209886ff..4c53957c918c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+@@ -658,6 +658,7 @@ static int esw_create_offloads_fdb_tables(struct mlx5_eswitch *esw, int nvports)
+ 	if (err)
+ 		goto miss_rule_err;
+ 
++	kvfree(flow_group_in);
+ 	return 0;
+ 
+ miss_rule_err:
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index 6ddb2565884d..0031c510ab68 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -1649,6 +1649,33 @@ static u64 matched_fgs_get_version(struct list_head *match_head)
+ 	return version;
+ }
+ 
++static struct fs_fte *
++lookup_fte_locked(struct mlx5_flow_group *g,
++		  u32 *match_value,
++		  bool take_write)
++{
++	struct fs_fte *fte_tmp;
++
++	if (take_write)
++		nested_down_write_ref_node(&g->node, FS_LOCK_PARENT);
++	else
++		nested_down_read_ref_node(&g->node, FS_LOCK_PARENT);
++	fte_tmp = rhashtable_lookup_fast(&g->ftes_hash, match_value,
++					 rhash_fte);
++	if (!fte_tmp || !tree_get_node(&fte_tmp->node)) {
++		fte_tmp = NULL;
++		goto out;
++	}
++
++	nested_down_write_ref_node(&fte_tmp->node, FS_LOCK_CHILD);
++out:
++	if (take_write)
++		up_write_ref_node(&g->node);
++	else
++		up_read_ref_node(&g->node);
++	return fte_tmp;
++}
++
+ static struct mlx5_flow_handle *
+ try_add_to_existing_fg(struct mlx5_flow_table *ft,
+ 		       struct list_head *match_head,
+@@ -1671,10 +1698,6 @@ try_add_to_existing_fg(struct mlx5_flow_table *ft,
+ 	if (IS_ERR(fte))
+ 		return  ERR_PTR(-ENOMEM);
+ 
+-	list_for_each_entry(iter, match_head, list) {
+-		nested_down_read_ref_node(&iter->g->node, FS_LOCK_PARENT);
+-	}
+-
+ search_again_locked:
+ 	version = matched_fgs_get_version(match_head);
+ 	/* Try to find a fg that already contains a matching fte */
+@@ -1682,20 +1705,9 @@ search_again_locked:
+ 		struct fs_fte *fte_tmp;
+ 
+ 		g = iter->g;
+-		fte_tmp = rhashtable_lookup_fast(&g->ftes_hash, spec->match_value,
+-						 rhash_fte);
+-		if (!fte_tmp || !tree_get_node(&fte_tmp->node))
++		fte_tmp = lookup_fte_locked(g, spec->match_value, take_write);
++		if (!fte_tmp)
+ 			continue;
+-
+-		nested_down_write_ref_node(&fte_tmp->node, FS_LOCK_CHILD);
+-		if (!take_write) {
+-			list_for_each_entry(iter, match_head, list)
+-				up_read_ref_node(&iter->g->node);
+-		} else {
+-			list_for_each_entry(iter, match_head, list)
+-				up_write_ref_node(&iter->g->node);
+-		}
+-
+ 		rule = add_rule_fg(g, spec->match_value,
+ 				   flow_act, dest, dest_num, fte_tmp);
+ 		up_write_ref_node(&fte_tmp->node);
+@@ -1704,19 +1716,6 @@ search_again_locked:
+ 		return rule;
+ 	}
+ 
+-	/* No group with matching fte found. Try to add a new fte to any
+-	 * matching fg.
+-	 */
+-
+-	if (!take_write) {
+-		list_for_each_entry(iter, match_head, list)
+-			up_read_ref_node(&iter->g->node);
+-		list_for_each_entry(iter, match_head, list)
+-			nested_down_write_ref_node(&iter->g->node,
+-						   FS_LOCK_PARENT);
+-		take_write = true;
+-	}
+-
+ 	/* Check the ft version, for case that new flow group
+ 	 * was added while the fgs weren't locked
+ 	 */
+@@ -1728,27 +1727,30 @@ search_again_locked:
+ 	/* Check the fgs version, for case the new FTE with the
+ 	 * same values was added while the fgs weren't locked
+ 	 */
+-	if (version != matched_fgs_get_version(match_head))
++	if (version != matched_fgs_get_version(match_head)) {
++		take_write = true;
+ 		goto search_again_locked;
++	}
+ 
+ 	list_for_each_entry(iter, match_head, list) {
+ 		g = iter->g;
+ 
+ 		if (!g->node.active)
+ 			continue;
++
++		nested_down_write_ref_node(&g->node, FS_LOCK_PARENT);
++
+ 		err = insert_fte(g, fte);
+ 		if (err) {
++			up_write_ref_node(&g->node);
+ 			if (err == -ENOSPC)
+ 				continue;
+-			list_for_each_entry(iter, match_head, list)
+-				up_write_ref_node(&iter->g->node);
+ 			kmem_cache_free(steering->ftes_cache, fte);
+ 			return ERR_PTR(err);
+ 		}
+ 
+ 		nested_down_write_ref_node(&fte->node, FS_LOCK_CHILD);
+-		list_for_each_entry(iter, match_head, list)
+-			up_write_ref_node(&iter->g->node);
++		up_write_ref_node(&g->node);
+ 		rule = add_rule_fg(g, spec->match_value,
+ 				   flow_act, dest, dest_num, fte);
+ 		up_write_ref_node(&fte->node);
+@@ -1757,8 +1759,6 @@ search_again_locked:
+ 	}
+ 	rule = ERR_PTR(-ENOENT);
+ out:
+-	list_for_each_entry(iter, match_head, list)
+-		up_write_ref_node(&iter->g->node);
+ 	kmem_cache_free(steering->ftes_cache, fte);
+ 	return rule;
+ }
+@@ -1797,6 +1797,8 @@ search_again_locked:
+ 	if (err) {
+ 		if (take_write)
+ 			up_write_ref_node(&ft->node);
++		else
++			up_read_ref_node(&ft->node);
+ 		return ERR_PTR(err);
+ 	}
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
+index d39b0b7011b2..9f39aeca863f 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
+@@ -331,9 +331,17 @@ void mlx5_start_health_poll(struct mlx5_core_dev *dev)
+ 	add_timer(&health->timer);
+ }
+ 
+-void mlx5_stop_health_poll(struct mlx5_core_dev *dev)
++void mlx5_stop_health_poll(struct mlx5_core_dev *dev, bool disable_health)
+ {
+ 	struct mlx5_core_health *health = &dev->priv.health;
++	unsigned long flags;
++
++	if (disable_health) {
++		spin_lock_irqsave(&health->wq_lock, flags);
++		set_bit(MLX5_DROP_NEW_HEALTH_WORK, &health->flags);
++		set_bit(MLX5_DROP_NEW_RECOVERY_WORK, &health->flags);
++		spin_unlock_irqrestore(&health->wq_lock, flags);
++	}
+ 
+ 	del_timer_sync(&health->timer);
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index 615005e63819..76e6ca87db11 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -874,8 +874,10 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
+ 	priv->numa_node = dev_to_node(&dev->pdev->dev);
+ 
+ 	priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root);
+-	if (!priv->dbg_root)
++	if (!priv->dbg_root) {
++		dev_err(&pdev->dev, "Cannot create debugfs dir, aborting\n");
+ 		return -ENOMEM;
++	}
+ 
+ 	err = mlx5_pci_enable_device(dev);
+ 	if (err) {
+@@ -924,7 +926,7 @@ static void mlx5_pci_close(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
+ 	pci_clear_master(dev->pdev);
+ 	release_bar(dev->pdev);
+ 	mlx5_pci_disable_device(dev);
+-	debugfs_remove(priv->dbg_root);
++	debugfs_remove_recursive(priv->dbg_root);
+ }
+ 
+ static int mlx5_init_once(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
+@@ -1266,7 +1268,7 @@ err_cleanup_once:
+ 		mlx5_cleanup_once(dev);
+ 
+ err_stop_poll:
+-	mlx5_stop_health_poll(dev);
++	mlx5_stop_health_poll(dev, boot);
+ 	if (mlx5_cmd_teardown_hca(dev)) {
+ 		dev_err(&dev->pdev->dev, "tear_down_hca failed, skip cleanup\n");
+ 		goto out_err;
+@@ -1325,7 +1327,7 @@ static int mlx5_unload_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
+ 	mlx5_free_irq_vectors(dev);
+ 	if (cleanup)
+ 		mlx5_cleanup_once(dev);
+-	mlx5_stop_health_poll(dev);
++	mlx5_stop_health_poll(dev, cleanup);
+ 	err = mlx5_cmd_teardown_hca(dev);
+ 	if (err) {
+ 		dev_err(&dev->pdev->dev, "tear_down_hca failed, skip cleanup\n");
+@@ -1587,7 +1589,7 @@ static int mlx5_try_fast_unload(struct mlx5_core_dev *dev)
+ 	 * with the HCA, so the health polll is no longer needed.
+ 	 */
+ 	mlx5_drain_health_wq(dev);
+-	mlx5_stop_health_poll(dev);
++	mlx5_stop_health_poll(dev, false);
+ 
+ 	ret = mlx5_cmd_force_teardown_hca(dev);
+ 	if (ret) {
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.c b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+index c8c315eb5128..d838af9539b1 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+@@ -39,9 +39,9 @@ u32 mlx5_wq_cyc_get_size(struct mlx5_wq_cyc *wq)
+ 	return (u32)wq->fbc.sz_m1 + 1;
+ }
+ 
+-u32 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq)
++u16 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq)
+ {
+-	return (u32)wq->fbc.frag_sz_m1 + 1;
++	return wq->fbc.frag_sz_m1 + 1;
+ }
+ 
+ u32 mlx5_cqwq_get_size(struct mlx5_cqwq *wq)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.h b/drivers/net/ethernet/mellanox/mlx5/core/wq.h
+index 0b47126815b6..16476cc1a602 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.h
+@@ -80,7 +80,7 @@ int mlx5_wq_cyc_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
+ 		       void *wqc, struct mlx5_wq_cyc *wq,
+ 		       struct mlx5_wq_ctrl *wq_ctrl);
+ u32 mlx5_wq_cyc_get_size(struct mlx5_wq_cyc *wq);
+-u32 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq);
++u16 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq);
+ 
+ int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
+ 		      void *qpc, struct mlx5_wq_qp *wq,
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.c b/drivers/net/ethernet/netronome/nfp/nfp_main.c
+index 152283d7e59c..4a540c5e27fe 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_main.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_main.c
+@@ -236,16 +236,20 @@ static int nfp_pcie_sriov_read_nfd_limit(struct nfp_pf *pf)
+ 	int err;
+ 
+ 	pf->limit_vfs = nfp_rtsym_read_le(pf->rtbl, "nfd_vf_cfg_max_vfs", &err);
+-	if (!err)
+-		return pci_sriov_set_totalvfs(pf->pdev, pf->limit_vfs);
++	if (err) {
++		/* For backwards compatibility if symbol not found allow all */
++		pf->limit_vfs = ~0;
++		if (err == -ENOENT)
++			return 0;
+ 
+-	pf->limit_vfs = ~0;
+-	/* Allow any setting for backwards compatibility if symbol not found */
+-	if (err == -ENOENT)
+-		return 0;
++		nfp_warn(pf->cpp, "Warning: VF limit read failed: %d\n", err);
++		return err;
++	}
+ 
+-	nfp_warn(pf->cpp, "Warning: VF limit read failed: %d\n", err);
+-	return err;
++	err = pci_sriov_set_totalvfs(pf->pdev, pf->limit_vfs);
++	if (err)
++		nfp_warn(pf->cpp, "Failed to set VF count in sysfs: %d\n", err);
++	return 0;
+ }
+ 
+ static int nfp_pcie_sriov_enable(struct pci_dev *pdev, int num_vfs)
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+index c2a9e64bc57b..bfccc1955907 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+@@ -1093,7 +1093,7 @@ static bool nfp_net_xdp_complete(struct nfp_net_tx_ring *tx_ring)
+  * @dp:		NFP Net data path struct
+  * @tx_ring:	TX ring structure
+  *
+- * Assumes that the device is stopped
++ * Assumes that the device is stopped, must be idempotent.
+  */
+ static void
+ nfp_net_tx_ring_reset(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring)
+@@ -1295,13 +1295,18 @@ static void nfp_net_rx_give_one(const struct nfp_net_dp *dp,
+  * nfp_net_rx_ring_reset() - Reflect in SW state of freelist after disable
+  * @rx_ring:	RX ring structure
+  *
+- * Warning: Do *not* call if ring buffers were never put on the FW freelist
+- *	    (i.e. device was not enabled)!
++ * Assumes that the device is stopped, must be idempotent.
+  */
+ static void nfp_net_rx_ring_reset(struct nfp_net_rx_ring *rx_ring)
+ {
+ 	unsigned int wr_idx, last_idx;
+ 
++	/* wr_p == rd_p means ring was never fed FL bufs.  RX rings are always
++	 * kept at cnt - 1 FL bufs.
++	 */
++	if (rx_ring->wr_p == 0 && rx_ring->rd_p == 0)
++		return;
++
+ 	/* Move the empty entry to the end of the list */
+ 	wr_idx = D_IDX(rx_ring, rx_ring->wr_p);
+ 	last_idx = rx_ring->cnt - 1;
+@@ -2524,6 +2529,8 @@ static void nfp_net_vec_clear_ring_data(struct nfp_net *nn, unsigned int idx)
+ /**
+  * nfp_net_clear_config_and_disable() - Clear control BAR and disable NFP
+  * @nn:      NFP Net device to reconfigure
++ *
++ * Warning: must be fully idempotent.
+  */
+ static void nfp_net_clear_config_and_disable(struct nfp_net *nn)
+ {
+diff --git a/drivers/net/ethernet/qualcomm/qca_7k.c b/drivers/net/ethernet/qualcomm/qca_7k.c
+index ffe7a16bdfc8..6c8543fb90c0 100644
+--- a/drivers/net/ethernet/qualcomm/qca_7k.c
++++ b/drivers/net/ethernet/qualcomm/qca_7k.c
+@@ -45,34 +45,33 @@ qcaspi_read_register(struct qcaspi *qca, u16 reg, u16 *result)
+ {
+ 	__be16 rx_data;
+ 	__be16 tx_data;
+-	struct spi_transfer *transfer;
+-	struct spi_message *msg;
++	struct spi_transfer transfer[2];
++	struct spi_message msg;
+ 	int ret;
+ 
++	memset(transfer, 0, sizeof(transfer));
++
++	spi_message_init(&msg);
++
+ 	tx_data = cpu_to_be16(QCA7K_SPI_READ | QCA7K_SPI_INTERNAL | reg);
++	*result = 0;
++
++	transfer[0].tx_buf = &tx_data;
++	transfer[0].len = QCASPI_CMD_LEN;
++	transfer[1].rx_buf = &rx_data;
++	transfer[1].len = QCASPI_CMD_LEN;
++
++	spi_message_add_tail(&transfer[0], &msg);
+ 
+ 	if (qca->legacy_mode) {
+-		msg = &qca->spi_msg1;
+-		transfer = &qca->spi_xfer1;
+-		transfer->tx_buf = &tx_data;
+-		transfer->rx_buf = NULL;
+-		transfer->len = QCASPI_CMD_LEN;
+-		spi_sync(qca->spi_dev, msg);
+-	} else {
+-		msg = &qca->spi_msg2;
+-		transfer = &qca->spi_xfer2[0];
+-		transfer->tx_buf = &tx_data;
+-		transfer->rx_buf = NULL;
+-		transfer->len = QCASPI_CMD_LEN;
+-		transfer = &qca->spi_xfer2[1];
++		spi_sync(qca->spi_dev, &msg);
++		spi_message_init(&msg);
+ 	}
+-	transfer->tx_buf = NULL;
+-	transfer->rx_buf = &rx_data;
+-	transfer->len = QCASPI_CMD_LEN;
+-	ret = spi_sync(qca->spi_dev, msg);
++	spi_message_add_tail(&transfer[1], &msg);
++	ret = spi_sync(qca->spi_dev, &msg);
+ 
+ 	if (!ret)
+-		ret = msg->status;
++		ret = msg.status;
+ 
+ 	if (ret)
+ 		qcaspi_spi_error(qca);
+@@ -86,35 +85,32 @@ int
+ qcaspi_write_register(struct qcaspi *qca, u16 reg, u16 value)
+ {
+ 	__be16 tx_data[2];
+-	struct spi_transfer *transfer;
+-	struct spi_message *msg;
++	struct spi_transfer transfer[2];
++	struct spi_message msg;
+ 	int ret;
+ 
++	memset(&transfer, 0, sizeof(transfer));
++
++	spi_message_init(&msg);
++
+ 	tx_data[0] = cpu_to_be16(QCA7K_SPI_WRITE | QCA7K_SPI_INTERNAL | reg);
+ 	tx_data[1] = cpu_to_be16(value);
+ 
++	transfer[0].tx_buf = &tx_data[0];
++	transfer[0].len = QCASPI_CMD_LEN;
++	transfer[1].tx_buf = &tx_data[1];
++	transfer[1].len = QCASPI_CMD_LEN;
++
++	spi_message_add_tail(&transfer[0], &msg);
+ 	if (qca->legacy_mode) {
+-		msg = &qca->spi_msg1;
+-		transfer = &qca->spi_xfer1;
+-		transfer->tx_buf = &tx_data[0];
+-		transfer->rx_buf = NULL;
+-		transfer->len = QCASPI_CMD_LEN;
+-		spi_sync(qca->spi_dev, msg);
+-	} else {
+-		msg = &qca->spi_msg2;
+-		transfer = &qca->spi_xfer2[0];
+-		transfer->tx_buf = &tx_data[0];
+-		transfer->rx_buf = NULL;
+-		transfer->len = QCASPI_CMD_LEN;
+-		transfer = &qca->spi_xfer2[1];
++		spi_sync(qca->spi_dev, &msg);
++		spi_message_init(&msg);
+ 	}
+-	transfer->tx_buf = &tx_data[1];
+-	transfer->rx_buf = NULL;
+-	transfer->len = QCASPI_CMD_LEN;
+-	ret = spi_sync(qca->spi_dev, msg);
++	spi_message_add_tail(&transfer[1], &msg);
++	ret = spi_sync(qca->spi_dev, &msg);
+ 
+ 	if (!ret)
+-		ret = msg->status;
++		ret = msg.status;
+ 
+ 	if (ret)
+ 		qcaspi_spi_error(qca);
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index 206f0266463e..66b775d462fd 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -99,22 +99,24 @@ static u32
+ qcaspi_write_burst(struct qcaspi *qca, u8 *src, u32 len)
+ {
+ 	__be16 cmd;
+-	struct spi_message *msg = &qca->spi_msg2;
+-	struct spi_transfer *transfer = &qca->spi_xfer2[0];
++	struct spi_message msg;
++	struct spi_transfer transfer[2];
+ 	int ret;
+ 
++	memset(&transfer, 0, sizeof(transfer));
++	spi_message_init(&msg);
++
+ 	cmd = cpu_to_be16(QCA7K_SPI_WRITE | QCA7K_SPI_EXTERNAL);
+-	transfer->tx_buf = &cmd;
+-	transfer->rx_buf = NULL;
+-	transfer->len = QCASPI_CMD_LEN;
+-	transfer = &qca->spi_xfer2[1];
+-	transfer->tx_buf = src;
+-	transfer->rx_buf = NULL;
+-	transfer->len = len;
++	transfer[0].tx_buf = &cmd;
++	transfer[0].len = QCASPI_CMD_LEN;
++	transfer[1].tx_buf = src;
++	transfer[1].len = len;
+ 
+-	ret = spi_sync(qca->spi_dev, msg);
++	spi_message_add_tail(&transfer[0], &msg);
++	spi_message_add_tail(&transfer[1], &msg);
++	ret = spi_sync(qca->spi_dev, &msg);
+ 
+-	if (ret || (msg->actual_length != QCASPI_CMD_LEN + len)) {
++	if (ret || (msg.actual_length != QCASPI_CMD_LEN + len)) {
+ 		qcaspi_spi_error(qca);
+ 		return 0;
+ 	}
+@@ -125,17 +127,20 @@ qcaspi_write_burst(struct qcaspi *qca, u8 *src, u32 len)
+ static u32
+ qcaspi_write_legacy(struct qcaspi *qca, u8 *src, u32 len)
+ {
+-	struct spi_message *msg = &qca->spi_msg1;
+-	struct spi_transfer *transfer = &qca->spi_xfer1;
++	struct spi_message msg;
++	struct spi_transfer transfer;
+ 	int ret;
+ 
+-	transfer->tx_buf = src;
+-	transfer->rx_buf = NULL;
+-	transfer->len = len;
++	memset(&transfer, 0, sizeof(transfer));
++	spi_message_init(&msg);
++
++	transfer.tx_buf = src;
++	transfer.len = len;
+ 
+-	ret = spi_sync(qca->spi_dev, msg);
++	spi_message_add_tail(&transfer, &msg);
++	ret = spi_sync(qca->spi_dev, &msg);
+ 
+-	if (ret || (msg->actual_length != len)) {
++	if (ret || (msg.actual_length != len)) {
+ 		qcaspi_spi_error(qca);
+ 		return 0;
+ 	}
+@@ -146,23 +151,25 @@ qcaspi_write_legacy(struct qcaspi *qca, u8 *src, u32 len)
+ static u32
+ qcaspi_read_burst(struct qcaspi *qca, u8 *dst, u32 len)
+ {
+-	struct spi_message *msg = &qca->spi_msg2;
++	struct spi_message msg;
+ 	__be16 cmd;
+-	struct spi_transfer *transfer = &qca->spi_xfer2[0];
++	struct spi_transfer transfer[2];
+ 	int ret;
+ 
++	memset(&transfer, 0, sizeof(transfer));
++	spi_message_init(&msg);
++
+ 	cmd = cpu_to_be16(QCA7K_SPI_READ | QCA7K_SPI_EXTERNAL);
+-	transfer->tx_buf = &cmd;
+-	transfer->rx_buf = NULL;
+-	transfer->len = QCASPI_CMD_LEN;
+-	transfer = &qca->spi_xfer2[1];
+-	transfer->tx_buf = NULL;
+-	transfer->rx_buf = dst;
+-	transfer->len = len;
++	transfer[0].tx_buf = &cmd;
++	transfer[0].len = QCASPI_CMD_LEN;
++	transfer[1].rx_buf = dst;
++	transfer[1].len = len;
+ 
+-	ret = spi_sync(qca->spi_dev, msg);
++	spi_message_add_tail(&transfer[0], &msg);
++	spi_message_add_tail(&transfer[1], &msg);
++	ret = spi_sync(qca->spi_dev, &msg);
+ 
+-	if (ret || (msg->actual_length != QCASPI_CMD_LEN + len)) {
++	if (ret || (msg.actual_length != QCASPI_CMD_LEN + len)) {
+ 		qcaspi_spi_error(qca);
+ 		return 0;
+ 	}
+@@ -173,17 +180,20 @@ qcaspi_read_burst(struct qcaspi *qca, u8 *dst, u32 len)
+ static u32
+ qcaspi_read_legacy(struct qcaspi *qca, u8 *dst, u32 len)
+ {
+-	struct spi_message *msg = &qca->spi_msg1;
+-	struct spi_transfer *transfer = &qca->spi_xfer1;
++	struct spi_message msg;
++	struct spi_transfer transfer;
+ 	int ret;
+ 
+-	transfer->tx_buf = NULL;
+-	transfer->rx_buf = dst;
+-	transfer->len = len;
++	memset(&transfer, 0, sizeof(transfer));
++	spi_message_init(&msg);
+ 
+-	ret = spi_sync(qca->spi_dev, msg);
++	transfer.rx_buf = dst;
++	transfer.len = len;
+ 
+-	if (ret || (msg->actual_length != len)) {
++	spi_message_add_tail(&transfer, &msg);
++	ret = spi_sync(qca->spi_dev, &msg);
++
++	if (ret || (msg.actual_length != len)) {
+ 		qcaspi_spi_error(qca);
+ 		return 0;
+ 	}
+@@ -195,19 +205,23 @@ static int
+ qcaspi_tx_cmd(struct qcaspi *qca, u16 cmd)
+ {
+ 	__be16 tx_data;
+-	struct spi_message *msg = &qca->spi_msg1;
+-	struct spi_transfer *transfer = &qca->spi_xfer1;
++	struct spi_message msg;
++	struct spi_transfer transfer;
+ 	int ret;
+ 
++	memset(&transfer, 0, sizeof(transfer));
++
++	spi_message_init(&msg);
++
+ 	tx_data = cpu_to_be16(cmd);
+-	transfer->len = sizeof(tx_data);
+-	transfer->tx_buf = &tx_data;
+-	transfer->rx_buf = NULL;
++	transfer.len = sizeof(cmd);
++	transfer.tx_buf = &tx_data;
++	spi_message_add_tail(&transfer, &msg);
+ 
+-	ret = spi_sync(qca->spi_dev, msg);
++	ret = spi_sync(qca->spi_dev, &msg);
+ 
+ 	if (!ret)
+-		ret = msg->status;
++		ret = msg.status;
+ 
+ 	if (ret)
+ 		qcaspi_spi_error(qca);
+@@ -835,16 +849,6 @@ qcaspi_netdev_setup(struct net_device *dev)
+ 	qca = netdev_priv(dev);
+ 	memset(qca, 0, sizeof(struct qcaspi));
+ 
+-	memset(&qca->spi_xfer1, 0, sizeof(struct spi_transfer));
+-	memset(&qca->spi_xfer2, 0, sizeof(struct spi_transfer) * 2);
+-
+-	spi_message_init(&qca->spi_msg1);
+-	spi_message_add_tail(&qca->spi_xfer1, &qca->spi_msg1);
+-
+-	spi_message_init(&qca->spi_msg2);
+-	spi_message_add_tail(&qca->spi_xfer2[0], &qca->spi_msg2);
+-	spi_message_add_tail(&qca->spi_xfer2[1], &qca->spi_msg2);
+-
+ 	memset(&qca->txr, 0, sizeof(qca->txr));
+ 	qca->txr.count = TX_RING_MAX_LEN;
+ }
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.h b/drivers/net/ethernet/qualcomm/qca_spi.h
+index fc4beb1b32d1..fc0e98726b36 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.h
++++ b/drivers/net/ethernet/qualcomm/qca_spi.h
+@@ -83,11 +83,6 @@ struct qcaspi {
+ 	struct tx_ring txr;
+ 	struct qcaspi_stats stats;
+ 
+-	struct spi_message spi_msg1;
+-	struct spi_message spi_msg2;
+-	struct spi_transfer spi_xfer1;
+-	struct spi_transfer spi_xfer2[2];
+-
+ 	u8 *rx_buffer;
+ 	u32 buffer_size;
+ 	u8 sync;
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index 9b09c9d0d0fb..5f0366a125e2 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -192,7 +192,7 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ 	priv->ucc_pram_offset = qe_muram_alloc(sizeof(struct ucc_hdlc_param),
+ 				ALIGNMENT_OF_UCC_HDLC_PRAM);
+ 
+-	if (priv->ucc_pram_offset < 0) {
++	if (IS_ERR_VALUE(priv->ucc_pram_offset)) {
+ 		dev_err(priv->dev, "Can not allocate MURAM for hdlc parameter.\n");
+ 		ret = -ENOMEM;
+ 		goto free_tx_bd;
+@@ -230,14 +230,14 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ 
+ 	/* Alloc riptr, tiptr */
+ 	riptr = qe_muram_alloc(32, 32);
+-	if (riptr < 0) {
++	if (IS_ERR_VALUE(riptr)) {
+ 		dev_err(priv->dev, "Cannot allocate MURAM mem for Receive internal temp data pointer\n");
+ 		ret = -ENOMEM;
+ 		goto free_tx_skbuff;
+ 	}
+ 
+ 	tiptr = qe_muram_alloc(32, 32);
+-	if (tiptr < 0) {
++	if (IS_ERR_VALUE(tiptr)) {
+ 		dev_err(priv->dev, "Cannot allocate MURAM mem for Transmit internal temp data pointer\n");
+ 		ret = -ENOMEM;
+ 		goto free_riptr;
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+index 45ea32796cda..92b38a21cd10 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+@@ -660,7 +660,7 @@ static inline void iwl_enable_fw_load_int(struct iwl_trans *trans)
+ 	}
+ }
+ 
+-static inline u8 iwl_pcie_get_cmd_index(struct iwl_txq *q, u32 index)
++static inline u8 iwl_pcie_get_cmd_index(const struct iwl_txq *q, u32 index)
+ {
+ 	return index & (q->n_window - 1);
+ }
+@@ -730,9 +730,13 @@ static inline void iwl_stop_queue(struct iwl_trans *trans,
+ 
+ static inline bool iwl_queue_used(const struct iwl_txq *q, int i)
+ {
+-	return q->write_ptr >= q->read_ptr ?
+-		(i >= q->read_ptr && i < q->write_ptr) :
+-		!(i < q->read_ptr && i >= q->write_ptr);
++	int index = iwl_pcie_get_cmd_index(q, i);
++	int r = iwl_pcie_get_cmd_index(q, q->read_ptr);
++	int w = iwl_pcie_get_cmd_index(q, q->write_ptr);
++
++	return w >= r ?
++		(index >= r && index < w) :
++		!(index < r && index >= w);
+ }
+ 
+ static inline bool iwl_is_rfkill_set(struct iwl_trans *trans)
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+index 473fe7ccb07c..11bd7ce2be8e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -1225,9 +1225,13 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
+ 	struct iwl_txq *txq = trans_pcie->txq[txq_id];
+ 	unsigned long flags;
+ 	int nfreed = 0;
++	u16 r;
+ 
+ 	lockdep_assert_held(&txq->lock);
+ 
++	idx = iwl_pcie_get_cmd_index(txq, idx);
++	r = iwl_pcie_get_cmd_index(txq, txq->read_ptr);
++
+ 	if ((idx >= TFD_QUEUE_SIZE_MAX) || (!iwl_queue_used(txq, idx))) {
+ 		IWL_ERR(trans,
+ 			"%s: Read index for DMA queue txq id (%d), index %d is out of range [0-%d] %d %d.\n",
+@@ -1236,12 +1240,13 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
+ 		return;
+ 	}
+ 
+-	for (idx = iwl_queue_inc_wrap(idx); txq->read_ptr != idx;
+-	     txq->read_ptr = iwl_queue_inc_wrap(txq->read_ptr)) {
++	for (idx = iwl_queue_inc_wrap(idx); r != idx;
++	     r = iwl_queue_inc_wrap(r)) {
++		txq->read_ptr = iwl_queue_inc_wrap(txq->read_ptr);
+ 
+ 		if (nfreed++ > 0) {
+ 			IWL_ERR(trans, "HCMD skipped: index (%d) %d %d\n",
+-				idx, txq->write_ptr, txq->read_ptr);
++				idx, txq->write_ptr, r);
+ 			iwl_force_nmi(trans);
+ 		}
+ 	}
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 9dd2ca62d84a..c2b6aa1d485f 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -87,8 +87,7 @@ struct netfront_cb {
+ /* IRQ name is queue name with "-tx" or "-rx" appended */
+ #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3)
+ 
+-static DECLARE_WAIT_QUEUE_HEAD(module_load_q);
+-static DECLARE_WAIT_QUEUE_HEAD(module_unload_q);
++static DECLARE_WAIT_QUEUE_HEAD(module_wq);
+ 
+ struct netfront_stats {
+ 	u64			packets;
+@@ -1331,11 +1330,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
+ 	netif_carrier_off(netdev);
+ 
+ 	xenbus_switch_state(dev, XenbusStateInitialising);
+-	wait_event(module_load_q,
+-			   xenbus_read_driver_state(dev->otherend) !=
+-			   XenbusStateClosed &&
+-			   xenbus_read_driver_state(dev->otherend) !=
+-			   XenbusStateUnknown);
++	wait_event(module_wq,
++		   xenbus_read_driver_state(dev->otherend) !=
++		   XenbusStateClosed &&
++		   xenbus_read_driver_state(dev->otherend) !=
++		   XenbusStateUnknown);
+ 	return netdev;
+ 
+  exit:
+@@ -1603,14 +1602,16 @@ static int xennet_init_queue(struct netfront_queue *queue)
+ {
+ 	unsigned short i;
+ 	int err = 0;
++	char *devid;
+ 
+ 	spin_lock_init(&queue->tx_lock);
+ 	spin_lock_init(&queue->rx_lock);
+ 
+ 	timer_setup(&queue->rx_refill_timer, rx_refill_timeout, 0);
+ 
+-	snprintf(queue->name, sizeof(queue->name), "%s-q%u",
+-		 queue->info->netdev->name, queue->id);
++	devid = strrchr(queue->info->xbdev->nodename, '/') + 1;
++	snprintf(queue->name, sizeof(queue->name), "vif%s-q%u",
++		 devid, queue->id);
+ 
+ 	/* Initialise tx_skbs as a free chain containing every entry. */
+ 	queue->tx_skb_freelist = 0;
+@@ -2007,15 +2008,14 @@ static void netback_changed(struct xenbus_device *dev,
+ 
+ 	dev_dbg(&dev->dev, "%s\n", xenbus_strstate(backend_state));
+ 
++	wake_up_all(&module_wq);
++
+ 	switch (backend_state) {
+ 	case XenbusStateInitialising:
+ 	case XenbusStateInitialised:
+ 	case XenbusStateReconfiguring:
+ 	case XenbusStateReconfigured:
+-		break;
+-
+ 	case XenbusStateUnknown:
+-		wake_up_all(&module_unload_q);
+ 		break;
+ 
+ 	case XenbusStateInitWait:
+@@ -2031,12 +2031,10 @@ static void netback_changed(struct xenbus_device *dev,
+ 		break;
+ 
+ 	case XenbusStateClosed:
+-		wake_up_all(&module_unload_q);
+ 		if (dev->state == XenbusStateClosed)
+ 			break;
+ 		/* Missed the backend's CLOSING state -- fallthrough */
+ 	case XenbusStateClosing:
+-		wake_up_all(&module_unload_q);
+ 		xenbus_frontend_closed(dev);
+ 		break;
+ 	}
+@@ -2144,14 +2142,14 @@ static int xennet_remove(struct xenbus_device *dev)
+ 
+ 	if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) {
+ 		xenbus_switch_state(dev, XenbusStateClosing);
+-		wait_event(module_unload_q,
++		wait_event(module_wq,
+ 			   xenbus_read_driver_state(dev->otherend) ==
+ 			   XenbusStateClosing ||
+ 			   xenbus_read_driver_state(dev->otherend) ==
+ 			   XenbusStateUnknown);
+ 
+ 		xenbus_switch_state(dev, XenbusStateClosed);
+-		wait_event(module_unload_q,
++		wait_event(module_wq,
+ 			   xenbus_read_driver_state(dev->otherend) ==
+ 			   XenbusStateClosed ||
+ 			   xenbus_read_driver_state(dev->otherend) ==
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 66ec5985c9f3..69fb62feb833 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -1741,6 +1741,8 @@ static void nvme_rdma_shutdown_ctrl(struct nvme_rdma_ctrl *ctrl, bool shutdown)
+ 		nvme_rdma_stop_io_queues(ctrl);
+ 		blk_mq_tagset_busy_iter(&ctrl->tag_set,
+ 					nvme_cancel_request, &ctrl->ctrl);
++		if (shutdown)
++			nvme_start_queues(&ctrl->ctrl);
+ 		nvme_rdma_destroy_io_queues(ctrl, shutdown);
+ 	}
+ 
+diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c
+index 8c42b3a8c420..64c7596a46a1 100644
+--- a/drivers/nvme/target/io-cmd-file.c
++++ b/drivers/nvme/target/io-cmd-file.c
+@@ -209,22 +209,24 @@ static void nvmet_file_execute_discard(struct nvmet_req *req)
+ {
+ 	int mode = FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE;
+ 	struct nvme_dsm_range range;
+-	loff_t offset;
+-	loff_t len;
+-	int i, ret;
++	loff_t offset, len;
++	u16 ret;
++	int i;
+ 
+ 	for (i = 0; i <= le32_to_cpu(req->cmd->dsm.nr); i++) {
+-		if (nvmet_copy_from_sgl(req, i * sizeof(range), &range,
+-					sizeof(range)))
++		ret = nvmet_copy_from_sgl(req, i * sizeof(range), &range,
++					sizeof(range));
++		if (ret)
+ 			break;
+ 		offset = le64_to_cpu(range.slba) << req->ns->blksize_shift;
+ 		len = le32_to_cpu(range.nlb) << req->ns->blksize_shift;
+-		ret = vfs_fallocate(req->ns->file, mode, offset, len);
+-		if (ret)
++		if (vfs_fallocate(req->ns->file, mode, offset, len)) {
++			ret = NVME_SC_INTERNAL | NVME_SC_DNR;
+ 			break;
++		}
+ 	}
+ 
+-	nvmet_req_complete(req, ret < 0 ? NVME_SC_INTERNAL | NVME_SC_DNR : 0);
++	nvmet_req_complete(req, ret);
+ }
+ 
+ static void nvmet_file_dsm_work(struct work_struct *w)
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 466e3c8582f0..53a51c6911eb 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -118,6 +118,9 @@ void of_populate_phandle_cache(void)
+ 		if (np->phandle && np->phandle != OF_PHANDLE_ILLEGAL)
+ 			phandles++;
+ 
++	if (!phandles)
++		goto out;
++
+ 	cache_entries = roundup_pow_of_two(phandles);
+ 	phandle_cache_mask = cache_entries - 1;
+ 
+@@ -719,6 +722,31 @@ struct device_node *of_get_next_available_child(const struct device_node *node,
+ }
+ EXPORT_SYMBOL(of_get_next_available_child);
+ 
++/**
++ * of_get_compatible_child - Find compatible child node
++ * @parent:	parent node
++ * @compatible:	compatible string
++ *
++ * Lookup child node whose compatible property contains the given compatible
++ * string.
++ *
++ * Returns a node pointer with refcount incremented, use of_node_put() on it
++ * when done; or NULL if not found.
++ */
++struct device_node *of_get_compatible_child(const struct device_node *parent,
++				const char *compatible)
++{
++	struct device_node *child;
++
++	for_each_child_of_node(parent, child) {
++		if (of_device_is_compatible(child, compatible))
++			break;
++	}
++
++	return child;
++}
++EXPORT_SYMBOL(of_get_compatible_child);
++
+ /**
+  *	of_get_child_by_name - Find the child node by name for a given parent
+  *	@node:	parent node
+diff --git a/drivers/parport/parport_sunbpp.c b/drivers/parport/parport_sunbpp.c
+index 01cf1c1a841a..8de329546b82 100644
+--- a/drivers/parport/parport_sunbpp.c
++++ b/drivers/parport/parport_sunbpp.c
+@@ -286,12 +286,16 @@ static int bpp_probe(struct platform_device *op)
+ 
+ 	ops = kmemdup(&parport_sunbpp_ops, sizeof(struct parport_operations),
+ 		      GFP_KERNEL);
+-        if (!ops)
++	if (!ops) {
++		err = -ENOMEM;
+ 		goto out_unmap;
++	}
+ 
+ 	dprintk(("register_port\n"));
+-	if (!(p = parport_register_port((unsigned long)base, irq, dma, ops)))
++	if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) {
++		err = -ENOMEM;
+ 		goto out_free_ops;
++	}
+ 
+ 	p->size = size;
+ 	p->dev = &op->dev;
+diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
+index a2e88386af28..0fbf612b8ef2 100644
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -303,6 +303,9 @@ int pcie_aer_get_firmware_first(struct pci_dev *dev)
+ 	if (!pci_is_pcie(dev))
+ 		return 0;
+ 
++	if (pcie_ports_native)
++		return 0;
++
+ 	if (!dev->__aer_firmware_first_valid)
+ 		aer_set_firmware_first(dev);
+ 	return dev->__aer_firmware_first;
+@@ -323,6 +326,9 @@ bool aer_acpi_firmware_first(void)
+ 		.firmware_first	= 0,
+ 	};
+ 
++	if (pcie_ports_native)
++		return false;
++
+ 	if (!parsed) {
+ 		apei_hest_parse(aer_hest_parse, &info);
+ 		aer_firmware_first = info.firmware_first;
+diff --git a/drivers/pinctrl/mediatek/pinctrl-mt7622.c b/drivers/pinctrl/mediatek/pinctrl-mt7622.c
+index 4c4740ffeb9c..3ea685634b6c 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-mt7622.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt7622.c
+@@ -1537,7 +1537,7 @@ static int mtk_build_groups(struct mtk_pinctrl *hw)
+ 		err = pinctrl_generic_add_group(hw->pctrl, group->name,
+ 						group->pins, group->num_pins,
+ 						group->data);
+-		if (err) {
++		if (err < 0) {
+ 			dev_err(hw->dev, "Failed to register group %s\n",
+ 				group->name);
+ 			return err;
+@@ -1558,7 +1558,7 @@ static int mtk_build_functions(struct mtk_pinctrl *hw)
+ 						  func->group_names,
+ 						  func->num_group_names,
+ 						  func->data);
+-		if (err) {
++		if (err < 0) {
+ 			dev_err(hw->dev, "Failed to register function %s\n",
+ 				func->name);
+ 			return err;
+diff --git a/drivers/pinctrl/pinctrl-rza1.c b/drivers/pinctrl/pinctrl-rza1.c
+index 717c0f4449a0..f76edf664539 100644
+--- a/drivers/pinctrl/pinctrl-rza1.c
++++ b/drivers/pinctrl/pinctrl-rza1.c
+@@ -1006,6 +1006,7 @@ static int rza1_dt_node_to_map(struct pinctrl_dev *pctldev,
+ 	const char *grpname;
+ 	const char **fngrps;
+ 	int ret, npins;
++	int gsel, fsel;
+ 
+ 	npins = rza1_dt_node_pin_count(np);
+ 	if (npins < 0) {
+@@ -1055,18 +1056,19 @@ static int rza1_dt_node_to_map(struct pinctrl_dev *pctldev,
+ 	fngrps[0] = grpname;
+ 
+ 	mutex_lock(&rza1_pctl->mutex);
+-	ret = pinctrl_generic_add_group(pctldev, grpname, grpins, npins,
+-					NULL);
+-	if (ret) {
++	gsel = pinctrl_generic_add_group(pctldev, grpname, grpins, npins,
++					 NULL);
++	if (gsel < 0) {
+ 		mutex_unlock(&rza1_pctl->mutex);
+-		return ret;
++		return gsel;
+ 	}
+ 
+-	ret = pinmux_generic_add_function(pctldev, grpname, fngrps, 1,
+-					  mux_confs);
+-	if (ret)
++	fsel = pinmux_generic_add_function(pctldev, grpname, fngrps, 1,
++					   mux_confs);
++	if (fsel < 0) {
++		ret = fsel;
+ 		goto remove_group;
+-	mutex_unlock(&rza1_pctl->mutex);
++	}
+ 
+ 	dev_info(rza1_pctl->dev, "Parsed function and group %s with %d pins\n",
+ 				 grpname, npins);
+@@ -1083,15 +1085,15 @@ static int rza1_dt_node_to_map(struct pinctrl_dev *pctldev,
+ 	(*map)->data.mux.group = np->name;
+ 	(*map)->data.mux.function = np->name;
+ 	*num_maps = 1;
++	mutex_unlock(&rza1_pctl->mutex);
+ 
+ 	return 0;
+ 
+ remove_function:
+-	mutex_lock(&rza1_pctl->mutex);
+-	pinmux_generic_remove_last_function(pctldev);
++	pinmux_generic_remove_function(pctldev, fsel);
+ 
+ remove_group:
+-	pinctrl_generic_remove_last_group(pctldev);
++	pinctrl_generic_remove_group(pctldev, gsel);
+ 	mutex_unlock(&rza1_pctl->mutex);
+ 
+ 	dev_info(rza1_pctl->dev, "Unable to parse function and group %s\n",
+diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
+index 0e22f52b2a19..2155a30c282b 100644
+--- a/drivers/pinctrl/qcom/pinctrl-msm.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm.c
+@@ -250,22 +250,30 @@ static int msm_config_group_get(struct pinctrl_dev *pctldev,
+ 	/* Convert register value to pinconf value */
+ 	switch (param) {
+ 	case PIN_CONFIG_BIAS_DISABLE:
+-		arg = arg == MSM_NO_PULL;
++		if (arg != MSM_NO_PULL)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_BIAS_PULL_DOWN:
+-		arg = arg == MSM_PULL_DOWN;
++		if (arg != MSM_PULL_DOWN)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_BIAS_BUS_HOLD:
+ 		if (pctrl->soc->pull_no_keeper)
+ 			return -ENOTSUPP;
+ 
+-		arg = arg == MSM_KEEPER;
++		if (arg != MSM_KEEPER)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_BIAS_PULL_UP:
+ 		if (pctrl->soc->pull_no_keeper)
+ 			arg = arg == MSM_PULL_UP_NO_KEEPER;
+ 		else
+ 			arg = arg == MSM_PULL_UP;
++		if (!arg)
++			return -EINVAL;
+ 		break;
+ 	case PIN_CONFIG_DRIVE_STRENGTH:
+ 		arg = msm_regval_to_drive(arg);
+diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+index 3e66e0d10010..cf82db78e69e 100644
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+@@ -390,31 +390,47 @@ static int pmic_gpio_config_get(struct pinctrl_dev *pctldev,
+ 
+ 	switch (param) {
+ 	case PIN_CONFIG_DRIVE_PUSH_PULL:
+-		arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_CMOS;
++		if (pad->buffer_type != PMIC_GPIO_OUT_BUF_CMOS)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_DRIVE_OPEN_DRAIN:
+-		arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS;
++		if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_DRIVE_OPEN_SOURCE:
+-		arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS;
++		if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_BIAS_PULL_DOWN:
+-		arg = pad->pullup == PMIC_GPIO_PULL_DOWN;
++		if (pad->pullup != PMIC_GPIO_PULL_DOWN)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_BIAS_DISABLE:
+-		arg = pad->pullup = PMIC_GPIO_PULL_DISABLE;
++		if (pad->pullup != PMIC_GPIO_PULL_DISABLE)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_BIAS_PULL_UP:
+-		arg = pad->pullup == PMIC_GPIO_PULL_UP_30;
++		if (pad->pullup != PMIC_GPIO_PULL_UP_30)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_BIAS_HIGH_IMPEDANCE:
+-		arg = !pad->is_enabled;
++		if (pad->is_enabled)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_POWER_SOURCE:
+ 		arg = pad->power_source;
+ 		break;
+ 	case PIN_CONFIG_INPUT_ENABLE:
+-		arg = pad->input_enabled;
++		if (!pad->input_enabled)
++			return -EINVAL;
++		arg = 1;
+ 		break;
+ 	case PIN_CONFIG_OUTPUT:
+ 		arg = pad->out_value;
+diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
+index eef76bfa5d73..e50941c3ba54 100644
+--- a/drivers/platform/x86/toshiba_acpi.c
++++ b/drivers/platform/x86/toshiba_acpi.c
+@@ -34,6 +34,7 @@
+ #define TOSHIBA_ACPI_VERSION	"0.24"
+ #define PROC_INTERFACE_VERSION	1
+ 
++#include <linux/compiler.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
+@@ -1682,7 +1683,7 @@ static const struct file_operations keys_proc_fops = {
+ 	.write		= keys_proc_write,
+ };
+ 
+-static int version_proc_show(struct seq_file *m, void *v)
++static int __maybe_unused version_proc_show(struct seq_file *m, void *v)
+ {
+ 	seq_printf(m, "driver:                  %s\n", TOSHIBA_ACPI_VERSION);
+ 	seq_printf(m, "proc_interface:          %d\n", PROC_INTERFACE_VERSION);
+diff --git a/drivers/regulator/qcom_spmi-regulator.c b/drivers/regulator/qcom_spmi-regulator.c
+index 9817f1a75342..ba3d5e63ada6 100644
+--- a/drivers/regulator/qcom_spmi-regulator.c
++++ b/drivers/regulator/qcom_spmi-regulator.c
+@@ -1752,7 +1752,8 @@ static int qcom_spmi_regulator_probe(struct platform_device *pdev)
+ 	const char *name;
+ 	struct device *dev = &pdev->dev;
+ 	struct device_node *node = pdev->dev.of_node;
+-	struct device_node *syscon;
++	struct device_node *syscon, *reg_node;
++	struct property *reg_prop;
+ 	int ret, lenp;
+ 	struct list_head *vreg_list;
+ 
+@@ -1774,16 +1775,19 @@ static int qcom_spmi_regulator_probe(struct platform_device *pdev)
+ 		syscon = of_parse_phandle(node, "qcom,saw-reg", 0);
+ 		saw_regmap = syscon_node_to_regmap(syscon);
+ 		of_node_put(syscon);
+-		if (IS_ERR(regmap))
++		if (IS_ERR(saw_regmap))
+ 			dev_err(dev, "ERROR reading SAW regmap\n");
+ 	}
+ 
+ 	for (reg = match->data; reg->name; reg++) {
+ 
+-		if (saw_regmap && \
+-		    of_find_property(of_find_node_by_name(node, reg->name), \
+-				     "qcom,saw-slave", &lenp)) {
+-			continue;
++		if (saw_regmap) {
++			reg_node = of_get_child_by_name(node, reg->name);
++			reg_prop = of_find_property(reg_node, "qcom,saw-slave",
++						    &lenp);
++			of_node_put(reg_node);
++			if (reg_prop)
++				continue;
+ 		}
+ 
+ 		vreg = devm_kzalloc(dev, sizeof(*vreg), GFP_KERNEL);
+@@ -1816,13 +1820,17 @@ static int qcom_spmi_regulator_probe(struct platform_device *pdev)
+ 		if (ret)
+ 			continue;
+ 
+-		if (saw_regmap && \
+-		    of_find_property(of_find_node_by_name(node, reg->name), \
+-				     "qcom,saw-leader", &lenp)) {
+-			spmi_saw_ops = *(vreg->desc.ops);
+-			spmi_saw_ops.set_voltage_sel = \
+-				spmi_regulator_saw_set_voltage;
+-			vreg->desc.ops = &spmi_saw_ops;
++		if (saw_regmap) {
++			reg_node = of_get_child_by_name(node, reg->name);
++			reg_prop = of_find_property(reg_node, "qcom,saw-leader",
++						    &lenp);
++			of_node_put(reg_node);
++			if (reg_prop) {
++				spmi_saw_ops = *(vreg->desc.ops);
++				spmi_saw_ops.set_voltage_sel =
++					spmi_regulator_saw_set_voltage;
++				vreg->desc.ops = &spmi_saw_ops;
++			}
+ 		}
+ 
+ 		config.dev = dev;
+diff --git a/drivers/remoteproc/qcom_q6v5_pil.c b/drivers/remoteproc/qcom_q6v5_pil.c
+index 2bf8e7c49f2a..e5ec59102b01 100644
+--- a/drivers/remoteproc/qcom_q6v5_pil.c
++++ b/drivers/remoteproc/qcom_q6v5_pil.c
+@@ -1370,7 +1370,6 @@ static const struct rproc_hexagon_res sdm845_mss = {
+ 	.hexagon_mba_image = "mba.mbn",
+ 	.proxy_clk_names = (char*[]){
+ 			"xo",
+-			"axis2",
+ 			"prng",
+ 			NULL
+ 	},
+diff --git a/drivers/reset/reset-imx7.c b/drivers/reset/reset-imx7.c
+index 4db177bc89bc..fdeac1946429 100644
+--- a/drivers/reset/reset-imx7.c
++++ b/drivers/reset/reset-imx7.c
+@@ -80,7 +80,7 @@ static int imx7_reset_set(struct reset_controller_dev *rcdev,
+ {
+ 	struct imx7_src *imx7src = to_imx7_src(rcdev);
+ 	const struct imx7_src_signal *signal = &imx7_src_signals[id];
+-	unsigned int value = 0;
++	unsigned int value = assert ? signal->bit : 0;
+ 
+ 	switch (id) {
+ 	case IMX7_RESET_PCIEPHY:
+diff --git a/drivers/rtc/rtc-bq4802.c b/drivers/rtc/rtc-bq4802.c
+index d768f6747961..113493b52149 100644
+--- a/drivers/rtc/rtc-bq4802.c
++++ b/drivers/rtc/rtc-bq4802.c
+@@ -162,6 +162,10 @@ static int bq4802_probe(struct platform_device *pdev)
+ 	} else if (p->r->flags & IORESOURCE_MEM) {
+ 		p->regs = devm_ioremap(&pdev->dev, p->r->start,
+ 					resource_size(p->r));
++		if (!p->regs){
++			err = -ENOMEM;
++			goto out;
++		}
+ 		p->read = bq4802_read_mem;
+ 		p->write = bq4802_write_mem;
+ 	} else {
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index d01ac29fd986..ffdb78421a25 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -3530,13 +3530,14 @@ static void qeth_flush_buffers(struct qeth_qdio_out_q *queue, int index,
+ 	qdio_flags = QDIO_FLAG_SYNC_OUTPUT;
+ 	if (atomic_read(&queue->set_pci_flags_count))
+ 		qdio_flags |= QDIO_FLAG_PCI_OUT;
++	atomic_add(count, &queue->used_buffers);
++
+ 	rc = do_QDIO(CARD_DDEV(queue->card), qdio_flags,
+ 		     queue->queue_no, index, count);
+ 	if (queue->card->options.performance_stats)
+ 		queue->card->perf_stats.outbound_do_qdio_time +=
+ 			qeth_get_micros() -
+ 			queue->card->perf_stats.outbound_do_qdio_start_time;
+-	atomic_add(count, &queue->used_buffers);
+ 	if (rc) {
+ 		queue->card->stats.tx_errors += count;
+ 		/* ignore temporary SIGA errors without busy condition */
+diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c
+index c3f18afb368b..cfb659747693 100644
+--- a/drivers/s390/net/qeth_core_sys.c
++++ b/drivers/s390/net/qeth_core_sys.c
+@@ -426,6 +426,7 @@ static ssize_t qeth_dev_layer2_store(struct device *dev,
+ 	if (card->discipline) {
+ 		card->discipline->remove(card->gdev);
+ 		qeth_core_free_discipline(card);
++		card->options.layer2 = -1;
+ 	}
+ 
+ 	rc = qeth_core_load_discipline(card, newdis);
+diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c
+index 3f3569ec5ce3..ddc7921ae5da 100644
+--- a/drivers/scsi/libfc/fc_disc.c
++++ b/drivers/scsi/libfc/fc_disc.c
+@@ -294,9 +294,11 @@ static void fc_disc_done(struct fc_disc *disc, enum fc_disc_event event)
+ 	 * discovery, reverify or log them in.	Otherwise, log them out.
+ 	 * Skip ports which were never discovered.  These are the dNS port
+ 	 * and ports which were created by PLOGI.
++	 *
++	 * We don't need to use the _rcu variant here as the rport list
++	 * is protected by the disc mutex which is already held on entry.
+ 	 */
+-	rcu_read_lock();
+-	list_for_each_entry_rcu(rdata, &disc->rports, peers) {
++	list_for_each_entry(rdata, &disc->rports, peers) {
+ 		if (!kref_get_unless_zero(&rdata->kref))
+ 			continue;
+ 		if (rdata->disc_id) {
+@@ -307,7 +309,6 @@ static void fc_disc_done(struct fc_disc *disc, enum fc_disc_event event)
+ 		}
+ 		kref_put(&rdata->kref, fc_rport_destroy);
+ 	}
+-	rcu_read_unlock();
+ 	mutex_unlock(&disc->disc_mutex);
+ 	disc->disc_callback(lport, event);
+ 	mutex_lock(&disc->disc_mutex);
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index d723fd1d7b26..cab1fb087e6a 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -2976,7 +2976,7 @@ lpfc_nvme_wait_for_io_drain(struct lpfc_hba *phba)
+ 	struct lpfc_sli_ring  *pring;
+ 	u32 i, wait_cnt = 0;
+ 
+-	if (phba->sli_rev < LPFC_SLI_REV4)
++	if (phba->sli_rev < LPFC_SLI_REV4 || !phba->sli4_hba.nvme_wq)
+ 		return;
+ 
+ 	/* Cycle through all NVME rings and make sure all outstanding
+@@ -2985,6 +2985,9 @@ lpfc_nvme_wait_for_io_drain(struct lpfc_hba *phba)
+ 	for (i = 0; i < phba->cfg_nvme_io_channel; i++) {
+ 		pring = phba->sli4_hba.nvme_wq[i]->pring;
+ 
++		if (!pring)
++			continue;
++
+ 		/* Retrieve everything on the txcmplq */
+ 		while (!list_empty(&pring->txcmplq)) {
+ 			msleep(LPFC_XRI_EXCH_BUSY_WAIT_T1);
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
+index 7271c9d885dd..5e5ec3363b44 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.c
++++ b/drivers/scsi/lpfc/lpfc_nvmet.c
+@@ -402,6 +402,7 @@ lpfc_nvmet_ctxbuf_post(struct lpfc_hba *phba, struct lpfc_nvmet_ctxbuf *ctx_buf)
+ 
+ 		/* Process FCP command */
+ 		if (rc == 0) {
++			ctxp->rqb_buffer = NULL;
+ 			atomic_inc(&tgtp->rcv_fcp_cmd_out);
+ 			nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
+ 			return;
+@@ -1116,8 +1117,17 @@ lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport,
+ 	lpfc_nvmeio_data(phba, "NVMET DEFERRCV: xri x%x sz %d CPU %02x\n",
+ 			 ctxp->oxid, ctxp->size, smp_processor_id());
+ 
++	if (!nvmebuf) {
++		lpfc_printf_log(phba, KERN_INFO, LOG_NVME_IOERR,
++				"6425 Defer rcv: no buffer xri x%x: "
++				"flg %x ste %x\n",
++				ctxp->oxid, ctxp->flag, ctxp->state);
++		return;
++	}
++
+ 	tgtp = phba->targetport->private;
+-	atomic_inc(&tgtp->rcv_fcp_cmd_defer);
++	if (tgtp)
++		atomic_inc(&tgtp->rcv_fcp_cmd_defer);
+ 
+ 	/* Free the nvmebuf since a new buffer already replaced it */
+ 	nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index 70b2ee80d6bd..bf4bd71ab53f 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -364,11 +364,6 @@ static int qcom_smem_alloc_private(struct qcom_smem *smem,
+ 	end = phdr_to_last_uncached_entry(phdr);
+ 	cached = phdr_to_last_cached_entry(phdr);
+ 
+-	if (smem->global_partition) {
+-		dev_err(smem->dev, "Already found the global partition\n");
+-		return -EINVAL;
+-	}
+-
+ 	while (hdr < end) {
+ 		if (hdr->canary != SMEM_PRIVATE_CANARY)
+ 			goto bad_canary;
+@@ -736,6 +731,11 @@ static int qcom_smem_set_global_partition(struct qcom_smem *smem)
+ 	bool found = false;
+ 	int i;
+ 
++	if (smem->global_partition) {
++		dev_err(smem->dev, "Already found the global partition\n");
++		return -EINVAL;
++	}
++
+ 	ptable = qcom_smem_get_ptable(smem);
+ 	if (IS_ERR(ptable))
+ 		return PTR_ERR(ptable);
+diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
+index f693bfe95ab9..a087464efdd7 100644
+--- a/drivers/spi/spi-dw.c
++++ b/drivers/spi/spi-dw.c
+@@ -485,6 +485,8 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws)
+ 	dws->dma_inited = 0;
+ 	dws->dma_addr = (dma_addr_t)(dws->paddr + DW_SPI_DR);
+ 
++	spi_controller_set_devdata(master, dws);
++
+ 	ret = request_irq(dws->irq, dw_spi_irq, IRQF_SHARED, dev_name(dev),
+ 			  master);
+ 	if (ret < 0) {
+@@ -518,7 +520,6 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws)
+ 		}
+ 	}
+ 
+-	spi_controller_set_devdata(master, dws);
+ 	ret = devm_spi_register_controller(dev, master);
+ 	if (ret) {
+ 		dev_err(&master->dev, "problem registering spi master\n");
+diff --git a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c
+index 396371728aa1..537d5bb5e294 100644
+--- a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c
++++ b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c
+@@ -767,7 +767,7 @@ static void free_bufs(struct dpaa2_eth_priv *priv, u64 *buf_array, int count)
+ 	for (i = 0; i < count; i++) {
+ 		vaddr = dpaa2_iova_to_virt(priv->iommu_domain, buf_array[i]);
+ 		dma_unmap_single(dev, buf_array[i], DPAA2_ETH_RX_BUF_SIZE,
+-				 DMA_BIDIRECTIONAL);
++				 DMA_FROM_DEVICE);
+ 		skb_free_frag(vaddr);
+ 	}
+ }
+diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+index f0cefa1b7b0f..b20d34449ed4 100644
+--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+@@ -439,16 +439,16 @@ int bcm2835_audio_open(struct bcm2835_alsa_stream *alsa_stream)
+ 	my_workqueue_init(alsa_stream);
+ 
+ 	ret = bcm2835_audio_open_connection(alsa_stream);
+-	if (ret) {
+-		ret = -1;
+-		goto exit;
+-	}
++	if (ret)
++		goto free_wq;
++
+ 	instance = alsa_stream->instance;
+ 	LOG_DBG(" instance (%p)\n", instance);
+ 
+ 	if (mutex_lock_interruptible(&instance->vchi_mutex)) {
+ 		LOG_DBG("Interrupted whilst waiting for lock on (%d)\n", instance->num_connections);
+-		return -EINTR;
++		ret = -EINTR;
++		goto free_wq;
+ 	}
+ 	vchi_service_use(instance->vchi_handle[0]);
+ 
+@@ -471,7 +471,11 @@ int bcm2835_audio_open(struct bcm2835_alsa_stream *alsa_stream)
+ unlock:
+ 	vchi_service_release(instance->vchi_handle[0]);
+ 	mutex_unlock(&instance->vchi_mutex);
+-exit:
++
++free_wq:
++	if (ret)
++		destroy_workqueue(alsa_stream->my_wq);
++
+ 	return ret;
+ }
+ 
+diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+index ce26741ae9d9..3f61d04c47ab 100644
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -580,6 +580,7 @@ static int start_streaming(struct vb2_queue *vq, unsigned int count)
+ static void stop_streaming(struct vb2_queue *vq)
+ {
+ 	int ret;
++	unsigned long timeout;
+ 	struct bm2835_mmal_dev *dev = vb2_get_drv_priv(vq);
+ 
+ 	v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev, "%s: dev:%p\n",
+@@ -605,10 +606,10 @@ static void stop_streaming(struct vb2_queue *vq)
+ 				      sizeof(dev->capture.frame_count));
+ 
+ 	/* wait for last frame to complete */
+-	ret = wait_for_completion_timeout(&dev->capture.frame_cmplt, HZ);
+-	if (ret <= 0)
++	timeout = wait_for_completion_timeout(&dev->capture.frame_cmplt, HZ);
++	if (timeout == 0)
+ 		v4l2_err(&dev->v4l2_dev,
+-			 "error %d waiting for frame completion\n", ret);
++			 "timed out waiting for frame completion\n");
+ 
+ 	v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+ 		 "disabling connection\n");
+diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+index f5b5ead6347c..51e5b04ff0f5 100644
+--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+@@ -630,6 +630,7 @@ static int send_synchronous_mmal_msg(struct vchiq_mmal_instance *instance,
+ {
+ 	struct mmal_msg_context *msg_context;
+ 	int ret;
++	unsigned long timeout;
+ 
+ 	/* payload size must not cause message to exceed max size */
+ 	if (payload_len >
+@@ -668,11 +669,11 @@ static int send_synchronous_mmal_msg(struct vchiq_mmal_instance *instance,
+ 		return ret;
+ 	}
+ 
+-	ret = wait_for_completion_timeout(&msg_context->u.sync.cmplt, 3 * HZ);
+-	if (ret <= 0) {
+-		pr_err("error %d waiting for sync completion\n", ret);
+-		if (ret == 0)
+-			ret = -ETIME;
++	timeout = wait_for_completion_timeout(&msg_context->u.sync.cmplt,
++					      3 * HZ);
++	if (timeout == 0) {
++		pr_err("timed out waiting for sync completion\n");
++		ret = -ETIME;
+ 		/* todo: what happens if the message arrives after aborting */
+ 		release_msg_context(msg_context);
+ 		return ret;
+diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c
+index bfb37f0be22f..863e86b9a424 100644
+--- a/drivers/tty/serial/8250/8250_of.c
++++ b/drivers/tty/serial/8250/8250_of.c
+@@ -124,7 +124,7 @@ static int of_platform_serial_setup(struct platform_device *ofdev,
+ 				dev_warn(&ofdev->dev, "unsupported reg-io-width (%d)\n",
+ 					 prop);
+ 				ret = -EINVAL;
+-				goto err_dispose;
++				goto err_unprepare;
+ 			}
+ 		}
+ 		port->flags |= UPF_IOREMAP;
+diff --git a/drivers/tty/tty_baudrate.c b/drivers/tty/tty_baudrate.c
+index 6ff8cdfc9d2a..3e827a3d48d5 100644
+--- a/drivers/tty/tty_baudrate.c
++++ b/drivers/tty/tty_baudrate.c
+@@ -157,18 +157,25 @@ void tty_termios_encode_baud_rate(struct ktermios *termios,
+ 	termios->c_ospeed = obaud;
+ 
+ #ifdef BOTHER
++	if ((termios->c_cflag >> IBSHIFT) & CBAUD)
++		ibinput = 1;	/* An input speed was specified */
++
+ 	/* If the user asked for a precise weird speed give a precise weird
+ 	   answer. If they asked for a Bfoo speed they may have problems
+ 	   digesting non-exact replies so fuzz a bit */
+ 
+-	if ((termios->c_cflag & CBAUD) == BOTHER)
++	if ((termios->c_cflag & CBAUD) == BOTHER) {
+ 		oclose = 0;
++		if (!ibinput)
++			iclose = 0;
++	}
+ 	if (((termios->c_cflag >> IBSHIFT) & CBAUD) == BOTHER)
+ 		iclose = 0;
+-	if ((termios->c_cflag >> IBSHIFT) & CBAUD)
+-		ibinput = 1;	/* An input speed was specified */
+ #endif
+ 	termios->c_cflag &= ~CBAUD;
++#ifdef IBSHIFT
++	termios->c_cflag &= ~(CBAUD << IBSHIFT);
++#endif
+ 
+ 	/*
+ 	 *	Our goal is to find a close match to the standard baud rate
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 75c4623ad779..f8ee32d9843a 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -779,20 +779,9 @@ static int acm_tty_write(struct tty_struct *tty,
+ 	}
+ 
+ 	if (acm->susp_count) {
+-		if (acm->putbuffer) {
+-			/* now to preserve order */
+-			usb_anchor_urb(acm->putbuffer->urb, &acm->delayed);
+-			acm->putbuffer = NULL;
+-		}
+ 		usb_anchor_urb(wb->urb, &acm->delayed);
+ 		spin_unlock_irqrestore(&acm->write_lock, flags);
+ 		return count;
+-	} else {
+-		if (acm->putbuffer) {
+-			/* at this point there is no good way to handle errors */
+-			acm_start_wb(acm, acm->putbuffer);
+-			acm->putbuffer = NULL;
+-		}
+ 	}
+ 
+ 	stat = acm_start_wb(acm, wb);
+@@ -803,66 +792,6 @@ static int acm_tty_write(struct tty_struct *tty,
+ 	return count;
+ }
+ 
+-static void acm_tty_flush_chars(struct tty_struct *tty)
+-{
+-	struct acm *acm = tty->driver_data;
+-	struct acm_wb *cur;
+-	int err;
+-	unsigned long flags;
+-
+-	spin_lock_irqsave(&acm->write_lock, flags);
+-
+-	cur = acm->putbuffer;
+-	if (!cur) /* nothing to do */
+-		goto out;
+-
+-	acm->putbuffer = NULL;
+-	err = usb_autopm_get_interface_async(acm->control);
+-	if (err < 0) {
+-		cur->use = 0;
+-		acm->putbuffer = cur;
+-		goto out;
+-	}
+-
+-	if (acm->susp_count)
+-		usb_anchor_urb(cur->urb, &acm->delayed);
+-	else
+-		acm_start_wb(acm, cur);
+-out:
+-	spin_unlock_irqrestore(&acm->write_lock, flags);
+-	return;
+-}
+-
+-static int acm_tty_put_char(struct tty_struct *tty, unsigned char ch)
+-{
+-	struct acm *acm = tty->driver_data;
+-	struct acm_wb *cur;
+-	int wbn;
+-	unsigned long flags;
+-
+-overflow:
+-	cur = acm->putbuffer;
+-	if (!cur) {
+-		spin_lock_irqsave(&acm->write_lock, flags);
+-		wbn = acm_wb_alloc(acm);
+-		if (wbn >= 0) {
+-			cur = &acm->wb[wbn];
+-			acm->putbuffer = cur;
+-		}
+-		spin_unlock_irqrestore(&acm->write_lock, flags);
+-		if (!cur)
+-			return 0;
+-	}
+-
+-	if (cur->len == acm->writesize) {
+-		acm_tty_flush_chars(tty);
+-		goto overflow;
+-	}
+-
+-	cur->buf[cur->len++] = ch;
+-	return 1;
+-}
+-
+ static int acm_tty_write_room(struct tty_struct *tty)
+ {
+ 	struct acm *acm = tty->driver_data;
+@@ -1987,8 +1916,6 @@ static const struct tty_operations acm_ops = {
+ 	.cleanup =		acm_tty_cleanup,
+ 	.hangup =		acm_tty_hangup,
+ 	.write =		acm_tty_write,
+-	.put_char =		acm_tty_put_char,
+-	.flush_chars =		acm_tty_flush_chars,
+ 	.write_room =		acm_tty_write_room,
+ 	.ioctl =		acm_tty_ioctl,
+ 	.throttle =		acm_tty_throttle,
+diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
+index eacc116e83da..ca06b20d7af9 100644
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -96,7 +96,6 @@ struct acm {
+ 	unsigned long read_urbs_free;
+ 	struct urb *read_urbs[ACM_NR];
+ 	struct acm_rb read_buffers[ACM_NR];
+-	struct acm_wb *putbuffer;			/* for acm_tty_put_char() */
+ 	int rx_buflimit;
+ 	spinlock_t read_lock;
+ 	u8 *notification_buffer;			/* to reassemble fragmented notifications */
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index a0d284ef3f40..632a2bfabc08 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -458,7 +458,7 @@ static int service_outstanding_interrupt(struct wdm_device *desc)
+ 
+ 	set_bit(WDM_RESPONDING, &desc->flags);
+ 	spin_unlock_irq(&desc->iuspin);
+-	rv = usb_submit_urb(desc->response, GFP_KERNEL);
++	rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+ 	spin_lock_irq(&desc->iuspin);
+ 	if (rv) {
+ 		dev_err(&desc->intf->dev,
+diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
+index 66fe1b78d952..03432467b05f 100644
+--- a/drivers/usb/core/hcd-pci.c
++++ b/drivers/usb/core/hcd-pci.c
+@@ -515,8 +515,6 @@ static int resume_common(struct device *dev, int event)
+ 				event == PM_EVENT_RESTORE);
+ 		if (retval) {
+ 			dev_err(dev, "PCI post-resume error %d!\n", retval);
+-			if (hcd->shared_hcd)
+-				usb_hc_died(hcd->shared_hcd);
+ 			usb_hc_died(hcd);
+ 		}
+ 	}
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index 1a15392326fc..525ebd03cfe5 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1340,6 +1340,11 @@ void usb_enable_interface(struct usb_device *dev,
+  * is submitted that needs that bandwidth.  Some other operating systems
+  * allocate bandwidth early, when a configuration is chosen.
+  *
++ * xHCI reserves bandwidth and configures the alternate setting in
++ * usb_hcd_alloc_bandwidth(). If it fails the original interface altsetting
++ * may be disabled. Drivers cannot rely on any particular alternate
++ * setting being in effect after a failure.
++ *
+  * This call is synchronous, and may not be used in an interrupt context.
+  * Also, drivers must not change altsettings while urbs are scheduled for
+  * endpoints in that interface; all such urbs must first be completed
+@@ -1375,6 +1380,12 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate)
+ 			 alternate);
+ 		return -EINVAL;
+ 	}
++	/*
++	 * usb3 hosts configure the interface in usb_hcd_alloc_bandwidth,
++	 * including freeing dropped endpoint ring buffers.
++	 * Make sure the interface endpoints are flushed before that
++	 */
++	usb_disable_interface(dev, iface, false);
+ 
+ 	/* Make sure we have enough bandwidth for this alternate interface.
+ 	 * Remove the current alt setting and add the new alt setting.
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 097057d2eacf..e77dfe5ed5ec 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -178,6 +178,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* CBM - Flash disk */
+ 	{ USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
++	/* WORLDE Controller KS49 or Prodipe MIDI 49C USB controller */
++	{ USB_DEVICE(0x0218, 0x0201), .driver_info =
++			USB_QUIRK_CONFIG_INTF_STRINGS },
++
+ 	/* WORLDE easy key (easykey.25) MIDI controller  */
+ 	{ USB_DEVICE(0x0218, 0x0401), .driver_info =
+ 			USB_QUIRK_CONFIG_INTF_STRINGS },
+@@ -406,6 +410,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	{ USB_DEVICE(0x2040, 0x7200), .driver_info =
+ 			USB_QUIRK_CONFIG_INTF_STRINGS },
+ 
++	/* DJI CineSSD */
++	{ USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
++
+ 	/* INTEL VALUE SSD */
+ 	{ USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h
+index db610c56f1d6..2aacd1afd9ff 100644
+--- a/drivers/usb/dwc3/gadget.h
++++ b/drivers/usb/dwc3/gadget.h
+@@ -25,7 +25,7 @@ struct dwc3;
+ #define DWC3_DEPCFG_XFER_IN_PROGRESS_EN	BIT(9)
+ #define DWC3_DEPCFG_XFER_NOT_READY_EN	BIT(10)
+ #define DWC3_DEPCFG_FIFO_ERROR_EN	BIT(11)
+-#define DWC3_DEPCFG_STREAM_EVENT_EN	BIT(12)
++#define DWC3_DEPCFG_STREAM_EVENT_EN	BIT(13)
+ #define DWC3_DEPCFG_BINTERVAL_M1(n)	(((n) & 0xff) << 16)
+ #define DWC3_DEPCFG_STREAM_CAPABLE	BIT(24)
+ #define DWC3_DEPCFG_EP_NUMBER(n)	(((n) & 0x1f) << 25)
+diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
+index 318246d8b2e2..b02ab2a8d927 100644
+--- a/drivers/usb/gadget/udc/net2280.c
++++ b/drivers/usb/gadget/udc/net2280.c
+@@ -1545,11 +1545,14 @@ static int net2280_pullup(struct usb_gadget *_gadget, int is_on)
+ 		writel(tmp | BIT(USB_DETECT_ENABLE), &dev->usb->usbctl);
+ 	} else {
+ 		writel(tmp & ~BIT(USB_DETECT_ENABLE), &dev->usb->usbctl);
+-		stop_activity(dev, dev->driver);
++		stop_activity(dev, NULL);
+ 	}
+ 
+ 	spin_unlock_irqrestore(&dev->lock, flags);
+ 
++	if (!is_on && dev->driver)
++		dev->driver->disconnect(&dev->gadget);
++
+ 	return 0;
+ }
+ 
+@@ -2466,8 +2469,11 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver)
+ 		nuke(&dev->ep[i]);
+ 
+ 	/* report disconnect; the driver is already quiesced */
+-	if (driver)
++	if (driver) {
++		spin_unlock(&dev->lock);
+ 		driver->disconnect(&dev->gadget);
++		spin_lock(&dev->lock);
++	}
+ 
+ 	usb_reinit(dev);
+ }
+@@ -3341,6 +3347,8 @@ next_endpoints:
+ 		BIT(PCI_RETRY_ABORT_INTERRUPT))
+ 
+ static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
++__releases(dev->lock)
++__acquires(dev->lock)
+ {
+ 	struct net2280_ep	*ep;
+ 	u32			tmp, num, mask, scratch;
+@@ -3381,12 +3389,14 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
+ 			if (disconnect || reset) {
+ 				stop_activity(dev, dev->driver);
+ 				ep0_start(dev);
++				spin_unlock(&dev->lock);
+ 				if (reset)
+ 					usb_gadget_udc_reset
+ 						(&dev->gadget, dev->driver);
+ 				else
+ 					(dev->driver->disconnect)
+ 						(&dev->gadget);
++				spin_lock(&dev->lock);
+ 				return;
+ 			}
+ 		}
+@@ -3405,6 +3415,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
+ 	tmp = BIT(SUSPEND_REQUEST_CHANGE_INTERRUPT);
+ 	if (stat & tmp) {
+ 		writel(tmp, &dev->regs->irqstat1);
++		spin_unlock(&dev->lock);
+ 		if (stat & BIT(SUSPEND_REQUEST_INTERRUPT)) {
+ 			if (dev->driver->suspend)
+ 				dev->driver->suspend(&dev->gadget);
+@@ -3415,6 +3426,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
+ 				dev->driver->resume(&dev->gadget);
+ 			/* at high speed, note erratum 0133 */
+ 		}
++		spin_lock(&dev->lock);
+ 		stat &= ~tmp;
+ 	}
+ 
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index 7cf98c793e04..5b5f1c8b47c9 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -787,12 +787,15 @@ static void usb3_irq_epc_int_1_speed(struct renesas_usb3 *usb3)
+ 	switch (speed) {
+ 	case USB_STA_SPEED_SS:
+ 		usb3->gadget.speed = USB_SPEED_SUPER;
++		usb3->gadget.ep0->maxpacket = USB3_EP0_SS_MAX_PACKET_SIZE;
+ 		break;
+ 	case USB_STA_SPEED_HS:
+ 		usb3->gadget.speed = USB_SPEED_HIGH;
++		usb3->gadget.ep0->maxpacket = USB3_EP0_HSFS_MAX_PACKET_SIZE;
+ 		break;
+ 	case USB_STA_SPEED_FS:
+ 		usb3->gadget.speed = USB_SPEED_FULL;
++		usb3->gadget.ep0->maxpacket = USB3_EP0_HSFS_MAX_PACKET_SIZE;
+ 		break;
+ 	default:
+ 		usb3->gadget.speed = USB_SPEED_UNKNOWN;
+@@ -2451,7 +2454,7 @@ static int renesas_usb3_init_ep(struct renesas_usb3 *usb3, struct device *dev,
+ 			/* for control pipe */
+ 			usb3->gadget.ep0 = &usb3_ep->ep;
+ 			usb_ep_set_maxpacket_limit(&usb3_ep->ep,
+-						USB3_EP0_HSFS_MAX_PACKET_SIZE);
++						USB3_EP0_SS_MAX_PACKET_SIZE);
+ 			usb3_ep->ep.caps.type_control = true;
+ 			usb3_ep->ep.caps.dir_in = true;
+ 			usb3_ep->ep.caps.dir_out = true;
+diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c
+index 032b8652910a..02f8e08b3ee8 100644
+--- a/drivers/usb/host/u132-hcd.c
++++ b/drivers/usb/host/u132-hcd.c
+@@ -2555,7 +2555,7 @@ static int u132_get_frame(struct usb_hcd *hcd)
+ 	} else {
+ 		int frame = 0;
+ 		dev_err(&u132->platform_dev->dev, "TODO: u132_get_frame\n");
+-		msleep(100);
++		mdelay(100);
+ 		return frame;
+ 	}
+ }
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index ef350c33dc4a..b1f27aa38b10 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1613,6 +1613,10 @@ void xhci_endpoint_copy(struct xhci_hcd *xhci,
+ 	in_ep_ctx->ep_info2 = out_ep_ctx->ep_info2;
+ 	in_ep_ctx->deq = out_ep_ctx->deq;
+ 	in_ep_ctx->tx_info = out_ep_ctx->tx_info;
++	if (xhci->quirks & XHCI_MTK_HOST) {
++		in_ep_ctx->reserved[0] = out_ep_ctx->reserved[0];
++		in_ep_ctx->reserved[1] = out_ep_ctx->reserved[1];
++	}
+ }
+ 
+ /* Copy output xhci_slot_ctx to the input xhci_slot_ctx.
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 68e6132aa8b2..c2220a7fc758 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -37,6 +37,21 @@ static unsigned long long quirks;
+ module_param(quirks, ullong, S_IRUGO);
+ MODULE_PARM_DESC(quirks, "Bit flags for quirks to be enabled as default");
+ 
++static bool td_on_ring(struct xhci_td *td, struct xhci_ring *ring)
++{
++	struct xhci_segment *seg = ring->first_seg;
++
++	if (!td || !td->start_seg)
++		return false;
++	do {
++		if (seg == td->start_seg)
++			return true;
++		seg = seg->next;
++	} while (seg && seg != ring->first_seg);
++
++	return false;
++}
++
+ /* TODO: copied from ehci-hcd.c - can this be refactored? */
+ /*
+  * xhci_handshake - spin reading hc until handshake completes or fails
+@@ -1571,6 +1586,21 @@ static int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
+ 		goto done;
+ 	}
+ 
++	/*
++	 * check ring is not re-allocated since URB was enqueued. If it is, then
++	 * make sure none of the ring related pointers in this URB private data
++	 * are touched, such as td_list, otherwise we overwrite freed data
++	 */
++	if (!td_on_ring(&urb_priv->td[0], ep_ring)) {
++		xhci_err(xhci, "Canceled URB td not found on endpoint ring");
++		for (i = urb_priv->num_tds_done; i < urb_priv->num_tds; i++) {
++			td = &urb_priv->td[i];
++			if (!list_empty(&td->cancelled_td_list))
++				list_del_init(&td->cancelled_td_list);
++		}
++		goto err_giveback;
++	}
++
+ 	if (xhci->xhc_state & XHCI_STATE_HALTED) {
+ 		xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
+ 				"HC halted, freeing TD manually.");
+diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
+index de9a502491c2..69822852888a 100644
+--- a/drivers/usb/misc/uss720.c
++++ b/drivers/usb/misc/uss720.c
+@@ -369,7 +369,7 @@ static unsigned char parport_uss720_frob_control(struct parport *pp, unsigned ch
+ 	mask &= 0x0f;
+ 	val &= 0x0f;
+ 	d = (priv->reg[1] & (~mask)) ^ val;
+-	if (set_1284_register(pp, 2, d, GFP_KERNEL))
++	if (set_1284_register(pp, 2, d, GFP_ATOMIC))
+ 		return 0;
+ 	priv->reg[1] = d;
+ 	return d & 0xf;
+@@ -379,7 +379,7 @@ static unsigned char parport_uss720_read_status(struct parport *pp)
+ {
+ 	unsigned char ret;
+ 
+-	if (get_1284_register(pp, 1, &ret, GFP_KERNEL))
++	if (get_1284_register(pp, 1, &ret, GFP_ATOMIC))
+ 		return 0;
+ 	return ret & 0xf8;
+ }
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index 3be40eaa1ac9..1232dd49556d 100644
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -421,13 +421,13 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
+ {
+ 	struct usb_yurex *dev;
+ 	int i, set = 0, retval = 0;
+-	char buffer[16];
++	char buffer[16 + 1];
+ 	char *data = buffer;
+ 	unsigned long long c, c2 = 0;
+ 	signed long timeout = 0;
+ 	DEFINE_WAIT(wait);
+ 
+-	count = min(sizeof(buffer), count);
++	count = min(sizeof(buffer) - 1, count);
+ 	dev = file->private_data;
+ 
+ 	/* verify that we actually have some data to write */
+@@ -446,6 +446,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
+ 		retval = -EFAULT;
+ 		goto error;
+ 	}
++	buffer[count] = 0;
+ 	memset(dev->cntl_buffer, CMD_PADDING, YUREX_BUF_SIZE);
+ 
+ 	switch (buffer[0]) {
+diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
+index eecfd0671362..d045d8458f81 100644
+--- a/drivers/usb/mtu3/mtu3_core.c
++++ b/drivers/usb/mtu3/mtu3_core.c
+@@ -107,8 +107,12 @@ static int mtu3_device_enable(struct mtu3 *mtu)
+ 		(SSUSB_U2_PORT_DIS | SSUSB_U2_PORT_PDN |
+ 		SSUSB_U2_PORT_HOST_SEL));
+ 
+-	if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG)
++	if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG) {
+ 		mtu3_setbits(ibase, SSUSB_U2_CTRL(0), SSUSB_U2_PORT_OTG_SEL);
++		if (mtu->is_u3_ip)
++			mtu3_setbits(ibase, SSUSB_U3_CTRL(0),
++				     SSUSB_U3_PORT_DUAL_MODE);
++	}
+ 
+ 	return ssusb_check_clocks(mtu->ssusb, check_clk);
+ }
+diff --git a/drivers/usb/mtu3/mtu3_hw_regs.h b/drivers/usb/mtu3/mtu3_hw_regs.h
+index 6ee371478d89..a45bb253939f 100644
+--- a/drivers/usb/mtu3/mtu3_hw_regs.h
++++ b/drivers/usb/mtu3/mtu3_hw_regs.h
+@@ -459,6 +459,7 @@
+ 
+ /* U3D_SSUSB_U3_CTRL_0P */
+ #define SSUSB_U3_PORT_SSP_SPEED	BIT(9)
++#define SSUSB_U3_PORT_DUAL_MODE	BIT(7)
+ #define SSUSB_U3_PORT_HOST_SEL		BIT(2)
+ #define SSUSB_U3_PORT_PDN		BIT(1)
+ #define SSUSB_U3_PORT_DIS		BIT(0)
+diff --git a/drivers/usb/serial/io_ti.h b/drivers/usb/serial/io_ti.h
+index e53c68261017..9bbcee37524e 100644
+--- a/drivers/usb/serial/io_ti.h
++++ b/drivers/usb/serial/io_ti.h
+@@ -173,7 +173,7 @@ struct ump_interrupt {
+ }  __attribute__((packed));
+ 
+ 
+-#define TIUMP_GET_PORT_FROM_CODE(c)	(((c) >> 4) - 3)
++#define TIUMP_GET_PORT_FROM_CODE(c)	(((c) >> 6) & 0x01)
+ #define TIUMP_GET_FUNC_FROM_CODE(c)	((c) & 0x0f)
+ #define TIUMP_INTERRUPT_CODE_LSR	0x03
+ #define TIUMP_INTERRUPT_CODE_MSR	0x04
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index 6b22857f6e52..58fc7964ee6b 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -1119,7 +1119,7 @@ static void ti_break(struct tty_struct *tty, int break_state)
+ 
+ static int ti_get_port_from_code(unsigned char code)
+ {
+-	return (code >> 4) - 3;
++	return (code >> 6) & 0x01;
+ }
+ 
+ static int ti_get_func_from_code(unsigned char code)
+diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
+index c267f2812a04..e227bb5b794f 100644
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -376,6 +376,15 @@ static int queuecommand_lck(struct scsi_cmnd *srb,
+ 		return 0;
+ 	}
+ 
++	if ((us->fflags & US_FL_NO_ATA_1X) &&
++			(srb->cmnd[0] == ATA_12 || srb->cmnd[0] == ATA_16)) {
++		memcpy(srb->sense_buffer, usb_stor_sense_invalidCDB,
++		       sizeof(usb_stor_sense_invalidCDB));
++		srb->result = SAM_STAT_CHECK_CONDITION;
++		done(srb);
++		return 0;
++	}
++
+ 	/* enqueue the command and wake up the control thread */
+ 	srb->scsi_done = done;
+ 	us->srb = srb;
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index 9e9de5452860..1f7b401c4d04 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -842,6 +842,27 @@ static int uas_slave_configure(struct scsi_device *sdev)
+ 		sdev->skip_ms_page_8 = 1;
+ 		sdev->wce_default_on = 1;
+ 	}
++
++	/*
++	 * Some disks return the total number of blocks in response
++	 * to READ CAPACITY rather than the highest block number.
++	 * If this device makes that mistake, tell the sd driver.
++	 */
++	if (devinfo->flags & US_FL_FIX_CAPACITY)
++		sdev->fix_capacity = 1;
++
++	/*
++	 * Some devices don't like MODE SENSE with page=0x3f,
++	 * which is the command used for checking if a device
++	 * is write-protected.  Now that we tell the sd driver
++	 * to do a 192-byte transfer with this command the
++	 * majority of devices work fine, but a few still can't
++	 * handle it.  The sd driver will simply assume those
++	 * devices are write-enabled.
++	 */
++	if (devinfo->flags & US_FL_NO_WP_DETECT)
++		sdev->skip_ms_page_3f = 1;
++
+ 	scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
+ 	return 0;
+ }
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 22fcfccf453a..f7f83b21dc74 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2288,6 +2288,13 @@ UNUSUAL_DEV(  0x2735, 0x100b, 0x0000, 0x9999,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_GO_SLOW ),
+ 
++/* Reported-by: Tim Anderson <tsa@×××××××××××××××.com> */
++UNUSUAL_DEV(  0x2ca3, 0x0031, 0x0000, 0x9999,
++		"DJI",
++		"CineSSD",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_NO_ATA_1X),
++
+ /*
+  * Reported by Frederic Marchal <frederic.marchal@××××××××××.com>
+  * Mio Moov 330
+diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c
+index 2510fa728d77..de119f11b78f 100644
+--- a/drivers/video/fbdev/core/modedb.c
++++ b/drivers/video/fbdev/core/modedb.c
+@@ -644,7 +644,7 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info,
+  *
+  *     Valid mode specifiers for @mode_option:
+  *
+- *     <xres>x<yres>[M][R][-<bpp>][@<refresh>][i][m] or
++ *     <xres>x<yres>[M][R][-<bpp>][@<refresh>][i][p][m] or
+  *     <name>[-<bpp>][@<refresh>]
+  *
+  *     with <xres>, <yres>, <bpp> and <refresh> decimal numbers and
+@@ -653,10 +653,10 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info,
+  *      If 'M' is present after yres (and before refresh/bpp if present),
+  *      the function will compute the timings using VESA(tm) Coordinated
+  *      Video Timings (CVT).  If 'R' is present after 'M', will compute with
+- *      reduced blanking (for flatpanels).  If 'i' is present, compute
+- *      interlaced mode.  If 'm' is present, add margins equal to 1.8%
+- *      of xres rounded down to 8 pixels, and 1.8% of yres. The char
+- *      'i' and 'm' must be after 'M' and 'R'. Example:
++ *      reduced blanking (for flatpanels).  If 'i' or 'p' are present, compute
++ *      interlaced or progressive mode.  If 'm' is present, add margins equal
++ *      to 1.8% of xres rounded down to 8 pixels, and 1.8% of yres. The chars
++ *      'i', 'p' and 'm' must be after 'M' and 'R'. Example:
+  *
+  *      1024x768MR-8@60m - Reduced blank with margins at 60Hz.
+  *
+@@ -697,7 +697,8 @@ int fb_find_mode(struct fb_var_screeninfo *var,
+ 		unsigned int namelen = strlen(name);
+ 		int res_specified = 0, bpp_specified = 0, refresh_specified = 0;
+ 		unsigned int xres = 0, yres = 0, bpp = default_bpp, refresh = 0;
+-		int yres_specified = 0, cvt = 0, rb = 0, interlace = 0;
++		int yres_specified = 0, cvt = 0, rb = 0;
++		int interlace_specified = 0, interlace = 0;
+ 		int margins = 0;
+ 		u32 best, diff, tdiff;
+ 
+@@ -748,9 +749,17 @@ int fb_find_mode(struct fb_var_screeninfo *var,
+ 				if (!cvt)
+ 					margins = 1;
+ 				break;
++			case 'p':
++				if (!cvt) {
++					interlace = 0;
++					interlace_specified = 1;
++				}
++				break;
+ 			case 'i':
+-				if (!cvt)
++				if (!cvt) {
+ 					interlace = 1;
++					interlace_specified = 1;
++				}
+ 				break;
+ 			default:
+ 				goto done;
+@@ -819,11 +828,21 @@ done:
+ 			if ((name_matches(db[i], name, namelen) ||
+ 			     (res_specified && res_matches(db[i], xres, yres))) &&
+ 			    !fb_try_mode(var, info, &db[i], bpp)) {
+-				if (refresh_specified && db[i].refresh == refresh)
+-					return 1;
++				const int db_interlace = (db[i].vmode &
++					FB_VMODE_INTERLACED ? 1 : 0);
++				int score = abs(db[i].refresh - refresh);
++
++				if (interlace_specified)
++					score += abs(db_interlace - interlace);
++
++				if (!interlace_specified ||
++				    db_interlace == interlace)
++					if (refresh_specified &&
++					    db[i].refresh == refresh)
++						return 1;
+ 
+-				if (abs(db[i].refresh - refresh) < diff) {
+-					diff = abs(db[i].refresh - refresh);
++				if (score < diff) {
++					diff = score;
+ 					best = i;
+ 				}
+ 			}
+diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c
+index 3b70044773b6..9fe7edf725c6 100644
+--- a/drivers/video/fbdev/goldfishfb.c
++++ b/drivers/video/fbdev/goldfishfb.c
+@@ -301,6 +301,7 @@ static int goldfish_fb_remove(struct platform_device *pdev)
+ 	dma_free_coherent(&pdev->dev, framesize, (void *)fb->fb.screen_base,
+ 						fb->fb.fix.smem_start);
+ 	iounmap(fb->reg_base);
++	kfree(fb);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c
+index 585f39efcff6..1c75f4806ed3 100644
+--- a/drivers/video/fbdev/omap/omapfb_main.c
++++ b/drivers/video/fbdev/omap/omapfb_main.c
+@@ -958,7 +958,7 @@ int omapfb_register_client(struct omapfb_notifier_block *omapfb_nb,
+ {
+ 	int r;
+ 
+-	if ((unsigned)omapfb_nb->plane_idx > OMAPFB_PLANE_NUM)
++	if ((unsigned)omapfb_nb->plane_idx >= OMAPFB_PLANE_NUM)
+ 		return -EINVAL;
+ 
+ 	if (!notifier_inited) {
+diff --git a/drivers/video/fbdev/omap2/omapfb/Makefile b/drivers/video/fbdev/omap2/omapfb/Makefile
+index 602edfed09df..f54c3f56b641 100644
+--- a/drivers/video/fbdev/omap2/omapfb/Makefile
++++ b/drivers/video/fbdev/omap2/omapfb/Makefile
+@@ -2,5 +2,5 @@
+ obj-$(CONFIG_OMAP2_VRFB) += vrfb.o
+ obj-y += dss/
+ obj-y += displays/
+-obj-$(CONFIG_FB_OMAP2) += omapfb.o
+-omapfb-y := omapfb-main.o omapfb-sysfs.o omapfb-ioctl.o
++obj-$(CONFIG_FB_OMAP2) += omap2fb.o
++omap2fb-y := omapfb-main.o omapfb-sysfs.o omapfb-ioctl.o
+diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c
+index 76722a59f55e..dfe382e68287 100644
+--- a/drivers/video/fbdev/pxafb.c
++++ b/drivers/video/fbdev/pxafb.c
+@@ -2128,8 +2128,8 @@ static int of_get_pxafb_display(struct device *dev, struct device_node *disp,
+ 		return -EINVAL;
+ 
+ 	ret = -ENOMEM;
+-	info->modes = kmalloc_array(timings->num_timings,
+-				    sizeof(info->modes[0]), GFP_KERNEL);
++	info->modes = kcalloc(timings->num_timings, sizeof(info->modes[0]),
++			      GFP_KERNEL);
+ 	if (!info->modes)
+ 		goto out;
+ 	info->num_modes = timings->num_timings;
+diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c
+index d2f785068ef4..7bb7e90b8f00 100644
+--- a/drivers/video/fbdev/via/viafbdev.c
++++ b/drivers/video/fbdev/via/viafbdev.c
+@@ -19,6 +19,7 @@
+  * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+  */
+ 
++#include <linux/compiler.h>
+ #include <linux/module.h>
+ #include <linux/seq_file.h>
+ #include <linux/slab.h>
+@@ -1468,7 +1469,7 @@ static const struct file_operations viafb_vt1636_proc_fops = {
+ 
+ #endif /* CONFIG_FB_VIA_DIRECT_PROCFS */
+ 
+-static int viafb_sup_odev_proc_show(struct seq_file *m, void *v)
++static int __maybe_unused viafb_sup_odev_proc_show(struct seq_file *m, void *v)
+ {
+ 	via_odev_to_seq(m, supported_odev_map[
+ 		viaparinfo->shared->chip_info.gfx_chip_name]);
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index 816cc921cf36..efae2fb0930a 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1751,7 +1751,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
+ 		const struct user_regset *regset = &view->regsets[i];
+ 		do_thread_regset_writeback(t->task, regset);
+ 		if (regset->core_note_type && regset->get &&
+-		    (!regset->active || regset->active(t->task, regset))) {
++		    (!regset->active || regset->active(t->task, regset) > 0)) {
+ 			int ret;
+ 			size_t size = regset_size(t->task, regset);
+ 			void *data = kmalloc(size, GFP_KERNEL);
+diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
+index eeab81c9452f..e169e1a5fd35 100644
+--- a/fs/cifs/readdir.c
++++ b/fs/cifs/readdir.c
+@@ -376,8 +376,15 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level)
+ 
+ 		new_entry = old_entry + sizeof(FIND_FILE_STANDARD_INFO) +
+ 				pfData->FileNameLength;
+-	} else
+-		new_entry = old_entry + le32_to_cpu(pDirInfo->NextEntryOffset);
++	} else {
++		u32 next_offset = le32_to_cpu(pDirInfo->NextEntryOffset);
++
++		if (old_entry + next_offset < old_entry) {
++			cifs_dbg(VFS, "invalid offset %u\n", next_offset);
++			return NULL;
++		}
++		new_entry = old_entry + next_offset;
++	}
+ 	cifs_dbg(FYI, "new entry %p old entry %p\n", new_entry, old_entry);
+ 	/* validate that new_entry is not past end of SMB */
+ 	if (new_entry >= end_of_smb) {
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 82be1dfeca33..29cce842ed04 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2418,14 +2418,14 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
+ 	/* We check for obvious errors in the output buffer length and offset */
+ 	if (*plen == 0)
+ 		goto ioctl_exit; /* server returned no data */
+-	else if (*plen > 0xFF00) {
++	else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) {
+ 		cifs_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen);
+ 		*plen = 0;
+ 		rc = -EIO;
+ 		goto ioctl_exit;
+ 	}
+ 
+-	if (rsp_iov.iov_len < le32_to_cpu(rsp->OutputOffset) + *plen) {
++	if (rsp_iov.iov_len - *plen < le32_to_cpu(rsp->OutputOffset)) {
+ 		cifs_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen,
+ 			le32_to_cpu(rsp->OutputOffset));
+ 		*plen = 0;
+@@ -3492,33 +3492,38 @@ num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size)
+ 	int len;
+ 	unsigned int entrycount = 0;
+ 	unsigned int next_offset = 0;
+-	FILE_DIRECTORY_INFO *entryptr;
++	char *entryptr;
++	FILE_DIRECTORY_INFO *dir_info;
+ 
+ 	if (bufstart == NULL)
+ 		return 0;
+ 
+-	entryptr = (FILE_DIRECTORY_INFO *)bufstart;
++	entryptr = bufstart;
+ 
+ 	while (1) {
+-		entryptr = (FILE_DIRECTORY_INFO *)
+-					((char *)entryptr + next_offset);
+-
+-		if ((char *)entryptr + size > end_of_buf) {
++		if (entryptr + next_offset < entryptr ||
++		    entryptr + next_offset > end_of_buf ||
++		    entryptr + next_offset + size > end_of_buf) {
+ 			cifs_dbg(VFS, "malformed search entry would overflow\n");
+ 			break;
+ 		}
+ 
+-		len = le32_to_cpu(entryptr->FileNameLength);
+-		if ((char *)entryptr + len + size > end_of_buf) {
++		entryptr = entryptr + next_offset;
++		dir_info = (FILE_DIRECTORY_INFO *)entryptr;
++
++		len = le32_to_cpu(dir_info->FileNameLength);
++		if (entryptr + len < entryptr ||
++		    entryptr + len > end_of_buf ||
++		    entryptr + len + size > end_of_buf) {
+ 			cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n",
+ 				 end_of_buf);
+ 			break;
+ 		}
+ 
+-		*lastentry = (char *)entryptr;
++		*lastentry = entryptr;
+ 		entrycount++;
+ 
+-		next_offset = le32_to_cpu(entryptr->NextEntryOffset);
++		next_offset = le32_to_cpu(dir_info->NextEntryOffset);
+ 		if (!next_offset)
+ 			break;
+ 	}
+diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
+index 577cff24707b..39843fa7e11b 100644
+--- a/fs/configfs/dir.c
++++ b/fs/configfs/dir.c
+@@ -1777,6 +1777,16 @@ void configfs_unregister_group(struct config_group *group)
+ 	struct dentry *dentry = group->cg_item.ci_dentry;
+ 	struct dentry *parent = group->cg_item.ci_parent->ci_dentry;
+ 
++	mutex_lock(&subsys->su_mutex);
++	if (!group->cg_item.ci_parent->ci_group) {
++		/*
++		 * The parent has already been unlinked and detached
++		 * due to a rmdir.
++		 */
++		goto unlink_group;
++	}
++	mutex_unlock(&subsys->su_mutex);
++
+ 	inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
+ 	spin_lock(&configfs_dirent_lock);
+ 	configfs_detach_prep(dentry, NULL);
+@@ -1791,6 +1801,7 @@ void configfs_unregister_group(struct config_group *group)
+ 	dput(dentry);
+ 
+ 	mutex_lock(&subsys->su_mutex);
++unlink_group:
+ 	unlink_group(group);
+ 	mutex_unlock(&subsys->su_mutex);
+ }
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 128d489acebb..742147cbe759 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -3106,9 +3106,19 @@ static struct dentry *f2fs_mount(struct file_system_type *fs_type, int flags,
+ static void kill_f2fs_super(struct super_block *sb)
+ {
+ 	if (sb->s_root) {
+-		set_sbi_flag(F2FS_SB(sb), SBI_IS_CLOSE);
+-		f2fs_stop_gc_thread(F2FS_SB(sb));
+-		f2fs_stop_discard_thread(F2FS_SB(sb));
++		struct f2fs_sb_info *sbi = F2FS_SB(sb);
++
++		set_sbi_flag(sbi, SBI_IS_CLOSE);
++		f2fs_stop_gc_thread(sbi);
++		f2fs_stop_discard_thread(sbi);
++
++		if (is_sbi_flag_set(sbi, SBI_IS_DIRTY) ||
++				!is_set_ckpt_flags(sbi, CP_UMOUNT_FLAG)) {
++			struct cp_control cpc = {
++				.reason = CP_UMOUNT,
++			};
++			f2fs_write_checkpoint(sbi, &cpc);
++		}
+ 	}
+ 	kill_block_super(sb);
+ }
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index ed6699705c13..fd5bea55fd60 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -2060,7 +2060,7 @@ int gfs2_write_alloc_required(struct gfs2_inode *ip, u64 offset,
+ 	end_of_file = (i_size_read(&ip->i_inode) + sdp->sd_sb.sb_bsize - 1) >> shift;
+ 	lblock = offset >> shift;
+ 	lblock_stop = (offset + len + sdp->sd_sb.sb_bsize - 1) >> shift;
+-	if (lblock_stop > end_of_file)
++	if (lblock_stop > end_of_file && ip != GFS2_I(sdp->sd_rindex))
+ 		return 1;
+ 
+ 	size = (lblock_stop - lblock) << shift;
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 33abcf29bc05..b86249ebde11 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1686,7 +1686,8 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext,
+ 
+ 	while(1) {
+ 		bi = rbm_bi(rbm);
+-		if (test_bit(GBF_FULL, &bi->bi_flags) &&
++		if ((ip == NULL || !gfs2_rs_active(&ip->i_res)) &&
++		    test_bit(GBF_FULL, &bi->bi_flags) &&
+ 		    (state == GFS2_BLKST_FREE))
+ 			goto next_bitmap;
+ 
+diff --git a/fs/namespace.c b/fs/namespace.c
+index bd2f4c68506a..1949e0939d40 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -446,10 +446,10 @@ int mnt_want_write_file_path(struct file *file)
+ {
+ 	int ret;
+ 
+-	sb_start_write(file->f_path.mnt->mnt_sb);
++	sb_start_write(file_inode(file)->i_sb);
+ 	ret = __mnt_want_write_file(file);
+ 	if (ret)
+-		sb_end_write(file->f_path.mnt->mnt_sb);
++		sb_end_write(file_inode(file)->i_sb);
+ 	return ret;
+ }
+ 
+@@ -540,7 +540,8 @@ void __mnt_drop_write_file(struct file *file)
+ 
+ void mnt_drop_write_file_path(struct file *file)
+ {
+-	mnt_drop_write(file->f_path.mnt);
++	__mnt_drop_write_file(file);
++	sb_end_write(file_inode(file)->i_sb);
+ }
+ 
+ void mnt_drop_write_file(struct file *file)
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index ff98e2a3f3cc..f688338b0482 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2642,14 +2642,18 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state)
+ 	}
+ 
+ 	nfs4_stateid_copy(&stateid, &delegation->stateid);
+-	if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags) ||
+-		!test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED,
+-			&delegation->flags)) {
++	if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags)) {
+ 		rcu_read_unlock();
+ 		nfs_finish_clear_delegation_stateid(state, &stateid);
+ 		return;
+ 	}
+ 
++	if (!test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED,
++				&delegation->flags)) {
++		rcu_read_unlock();
++		return;
++	}
++
+ 	cred = get_rpccred(delegation->cred);
+ 	rcu_read_unlock();
+ 	status = nfs41_test_and_free_expired_stateid(server, &stateid, cred);
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 2bf2eaa08ca7..3c18c12a5c4c 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1390,6 +1390,8 @@ int nfs4_schedule_stateid_recovery(const struct nfs_server *server, struct nfs4_
+ 
+ 	if (!nfs4_state_mark_reclaim_nograce(clp, state))
+ 		return -EBADF;
++	nfs_inode_find_delegation_state_and_recover(state->inode,
++			&state->stateid);
+ 	dprintk("%s: scheduling stateid recovery for server %s\n", __func__,
+ 			clp->cl_hostname);
+ 	nfs4_schedule_state_manager(clp);
+diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h
+index a275fba93170..708342f4692f 100644
+--- a/fs/nfs/nfs4trace.h
++++ b/fs/nfs/nfs4trace.h
+@@ -1194,7 +1194,7 @@ DECLARE_EVENT_CLASS(nfs4_inode_stateid_callback_event,
+ 		TP_fast_assign(
+ 			__entry->error = error;
+ 			__entry->fhandle = nfs_fhandle_hash(fhandle);
+-			if (inode != NULL) {
++			if (!IS_ERR_OR_NULL(inode)) {
+ 				__entry->fileid = NFS_FILEID(inode);
+ 				__entry->dev = inode->i_sb->s_dev;
+ 			} else {
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 704b37311467..fa2121f877c1 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -970,16 +970,6 @@ static int ovl_get_upper(struct ovl_fs *ofs, struct path *upperpath)
+ 	if (err)
+ 		goto out;
+ 
+-	err = -EBUSY;
+-	if (ovl_inuse_trylock(upperpath->dentry)) {
+-		ofs->upperdir_locked = true;
+-	} else if (ofs->config.index) {
+-		pr_err("overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection.\n");
+-		goto out;
+-	} else {
+-		pr_warn("overlayfs: upperdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
+-	}
+-
+ 	upper_mnt = clone_private_mount(upperpath);
+ 	err = PTR_ERR(upper_mnt);
+ 	if (IS_ERR(upper_mnt)) {
+@@ -990,6 +980,17 @@ static int ovl_get_upper(struct ovl_fs *ofs, struct path *upperpath)
+ 	/* Don't inherit atime flags */
+ 	upper_mnt->mnt_flags &= ~(MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME);
+ 	ofs->upper_mnt = upper_mnt;
++
++	err = -EBUSY;
++	if (ovl_inuse_trylock(ofs->upper_mnt->mnt_root)) {
++		ofs->upperdir_locked = true;
++	} else if (ofs->config.index) {
++		pr_err("overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection.\n");
++		goto out;
++	} else {
++		pr_warn("overlayfs: upperdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
++	}
++
+ 	err = 0;
+ out:
+ 	return err;
+@@ -1089,8 +1090,10 @@ static int ovl_get_workdir(struct ovl_fs *ofs, struct path *upperpath)
+ 		goto out;
+ 	}
+ 
++	ofs->workbasedir = dget(workpath.dentry);
++
+ 	err = -EBUSY;
+-	if (ovl_inuse_trylock(workpath.dentry)) {
++	if (ovl_inuse_trylock(ofs->workbasedir)) {
+ 		ofs->workdir_locked = true;
+ 	} else if (ofs->config.index) {
+ 		pr_err("overlayfs: workdir is in-use by another mount, mount with '-o index=off' to override exclusive workdir protection.\n");
+@@ -1099,7 +1102,6 @@ static int ovl_get_workdir(struct ovl_fs *ofs, struct path *upperpath)
+ 		pr_warn("overlayfs: workdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
+ 	}
+ 
+-	ofs->workbasedir = dget(workpath.dentry);
+ 	err = ovl_make_workdir(ofs, &workpath);
+ 	if (err)
+ 		goto out;
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index 951a14edcf51..0792595ebcfb 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -429,7 +429,12 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size,
+ 	vaddr = vmap(pages, page_count, VM_MAP, prot);
+ 	kfree(pages);
+ 
+-	return vaddr;
++	/*
++	 * Since vmap() uses page granularity, we must add the offset
++	 * into the page here, to get the byte granularity address
++	 * into the mapping to represent the actual "start" location.
++	 */
++	return vaddr + offset_in_page(start);
+ }
+ 
+ static void *persistent_ram_iomap(phys_addr_t start, size_t size,
+@@ -448,6 +453,11 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size,
+ 	else
+ 		va = ioremap_wc(start, size);
+ 
++	/*
++	 * Since request_mem_region() and ioremap() are byte-granularity
++	 * there is no need handle anything special like we do when the
++	 * vmap() case in persistent_ram_vmap() above.
++	 */
+ 	return va;
+ }
+ 
+@@ -468,7 +478,7 @@ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size,
+ 		return -ENOMEM;
+ 	}
+ 
+-	prz->buffer = prz->vaddr + offset_in_page(start);
++	prz->buffer = prz->vaddr;
+ 	prz->buffer_size = size - sizeof(struct persistent_ram_buffer);
+ 
+ 	return 0;
+@@ -515,7 +525,8 @@ void persistent_ram_free(struct persistent_ram_zone *prz)
+ 
+ 	if (prz->vaddr) {
+ 		if (pfn_valid(prz->paddr >> PAGE_SHIFT)) {
+-			vunmap(prz->vaddr);
++			/* We must vunmap() at page-granularity. */
++			vunmap(prz->vaddr - offset_in_page(prz->paddr));
+ 		} else {
+ 			iounmap(prz->vaddr);
+ 			release_mem_region(prz->paddr, prz->size);
+diff --git a/include/linux/crypto.h b/include/linux/crypto.h
+index 6eb06101089f..e8839d3a7559 100644
+--- a/include/linux/crypto.h
++++ b/include/linux/crypto.h
+@@ -112,6 +112,11 @@
+  */
+ #define CRYPTO_ALG_OPTIONAL_KEY		0x00004000
+ 
++/*
++ * Don't trigger module loading
++ */
++#define CRYPTO_NOLOAD			0x00008000
++
+ /*
+  * Transform masks and values (for crt_flags).
+  */
+diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
+index 83957920653a..64f450593b54 100644
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -357,7 +357,7 @@ struct mlx5_frag_buf {
+ struct mlx5_frag_buf_ctrl {
+ 	struct mlx5_frag_buf	frag_buf;
+ 	u32			sz_m1;
+-	u32			frag_sz_m1;
++	u16			frag_sz_m1;
+ 	u32			strides_offset;
+ 	u8			log_sz;
+ 	u8			log_stride;
+@@ -1042,7 +1042,7 @@ int mlx5_cmd_free_uar(struct mlx5_core_dev *dev, u32 uarn);
+ void mlx5_health_cleanup(struct mlx5_core_dev *dev);
+ int mlx5_health_init(struct mlx5_core_dev *dev);
+ void mlx5_start_health_poll(struct mlx5_core_dev *dev);
+-void mlx5_stop_health_poll(struct mlx5_core_dev *dev);
++void mlx5_stop_health_poll(struct mlx5_core_dev *dev, bool disable_health);
+ void mlx5_drain_health_wq(struct mlx5_core_dev *dev);
+ void mlx5_trigger_health_work(struct mlx5_core_dev *dev);
+ void mlx5_drain_health_recovery(struct mlx5_core_dev *dev);
+diff --git a/include/linux/of.h b/include/linux/of.h
+index 4d25e4f952d9..b99a1a8c2952 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -290,6 +290,8 @@ extern struct device_node *of_get_next_child(const struct device_node *node,
+ extern struct device_node *of_get_next_available_child(
+ 	const struct device_node *node, struct device_node *prev);
+ 
++extern struct device_node *of_get_compatible_child(const struct device_node *parent,
++					const char *compatible);
+ extern struct device_node *of_get_child_by_name(const struct device_node *node,
+ 					const char *name);
+ 
+@@ -632,6 +634,12 @@ static inline bool of_have_populated_dt(void)
+ 	return false;
+ }
+ 
++static inline struct device_node *of_get_compatible_child(const struct device_node *parent,
++					const char *compatible)
++{
++	return NULL;
++}
++
+ static inline struct device_node *of_get_child_by_name(
+ 					const struct device_node *node,
+ 					const char *name)
+diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
+index c17c0c268436..dce35e16bff4 100644
+--- a/kernel/audit_watch.c
++++ b/kernel/audit_watch.c
+@@ -419,6 +419,13 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list)
+ 	struct path parent_path;
+ 	int h, ret = 0;
+ 
++	/*
++	 * When we will be calling audit_add_to_parent, krule->watch might have
++	 * been updated and watch might have been freed.
++	 * So we need to keep a reference of watch.
++	 */
++	audit_get_watch(watch);
++
+ 	mutex_unlock(&audit_filter_mutex);
+ 
+ 	/* Avoid calling path_lookup under audit_filter_mutex. */
+@@ -427,8 +434,10 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list)
+ 	/* caller expects mutex locked */
+ 	mutex_lock(&audit_filter_mutex);
+ 
+-	if (ret)
++	if (ret) {
++		audit_put_watch(watch);
+ 		return ret;
++	}
+ 
+ 	/* either find an old parent or attach a new one */
+ 	parent = audit_find_parent(d_backing_inode(parent_path.dentry));
+@@ -446,6 +455,7 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list)
+ 	*list = &audit_inode_hash[h];
+ error:
+ 	path_put(&parent_path);
++	audit_put_watch(watch);
+ 	return ret;
+ }
+ 
+diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
+index 3d83ee7df381..badabb0b435c 100644
+--- a/kernel/bpf/cgroup.c
++++ b/kernel/bpf/cgroup.c
+@@ -95,7 +95,7 @@ static int compute_effective_progs(struct cgroup *cgrp,
+ 				   enum bpf_attach_type type,
+ 				   struct bpf_prog_array __rcu **array)
+ {
+-	struct bpf_prog_array __rcu *progs;
++	struct bpf_prog_array *progs;
+ 	struct bpf_prog_list *pl;
+ 	struct cgroup *p = cgrp;
+ 	int cnt = 0;
+@@ -120,13 +120,12 @@ static int compute_effective_progs(struct cgroup *cgrp,
+ 					    &p->bpf.progs[type], node) {
+ 				if (!pl->prog)
+ 					continue;
+-				rcu_dereference_protected(progs, 1)->
+-					progs[cnt++] = pl->prog;
++				progs->progs[cnt++] = pl->prog;
+ 			}
+ 		p = cgroup_parent(p);
+ 	} while (p);
+ 
+-	*array = progs;
++	rcu_assign_pointer(*array, progs);
+ 	return 0;
+ }
+ 
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index eec2d5fb676b..c7b3e34811ec 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5948,6 +5948,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
+ 		unsigned long sp;
+ 		unsigned int rem;
+ 		u64 dyn_size;
++		mm_segment_t fs;
+ 
+ 		/*
+ 		 * We dump:
+@@ -5965,7 +5966,10 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
+ 
+ 		/* Data. */
+ 		sp = perf_user_stack_pointer(regs);
++		fs = get_fs();
++		set_fs(USER_DS);
+ 		rem = __output_copy_user(handle, (void *) sp, dump_size);
++		set_fs(fs);
+ 		dyn_size = dump_size - rem;
+ 
+ 		perf_output_skip(handle, rem);
+diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
+index 42fcb7f05fac..f42cf69ef539 100644
+--- a/kernel/rcu/rcutorture.c
++++ b/kernel/rcu/rcutorture.c
+@@ -1446,7 +1446,7 @@ static int rcu_torture_stall(void *args)
+ 		VERBOSE_TOROUT_STRING("rcu_torture_stall end holdoff");
+ 	}
+ 	if (!kthread_should_stop()) {
+-		stop_at = get_seconds() + stall_cpu;
++		stop_at = ktime_get_seconds() + stall_cpu;
+ 		/* RCU CPU stall is expected behavior in following code. */
+ 		rcu_read_lock();
+ 		if (stall_cpu_irqsoff)
+@@ -1455,7 +1455,8 @@ static int rcu_torture_stall(void *args)
+ 			preempt_disable();
+ 		pr_alert("rcu_torture_stall start on CPU %d.\n",
+ 			 smp_processor_id());
+-		while (ULONG_CMP_LT(get_seconds(), stop_at))
++		while (ULONG_CMP_LT((unsigned long)ktime_get_seconds(),
++				    stop_at))
+ 			continue;  /* Induce RCU CPU stall warning. */
+ 		if (stall_cpu_irqsoff)
+ 			local_irq_enable();
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 9c219f7b0970..478d9d3e6be9 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -735,11 +735,12 @@ static void attach_entity_cfs_rq(struct sched_entity *se);
+  * To solve this problem, we also cap the util_avg of successive tasks to
+  * only 1/2 of the left utilization budget:
+  *
+- *   util_avg_cap = (1024 - cfs_rq->avg.util_avg) / 2^n
++ *   util_avg_cap = (cpu_scale - cfs_rq->avg.util_avg) / 2^n
+  *
+- * where n denotes the nth task.
++ * where n denotes the nth task and cpu_scale the CPU capacity.
+  *
+- * For example, a simplest series from the beginning would be like:
++ * For example, for a CPU with 1024 of capacity, a simplest series from
++ * the beginning would be like:
+  *
+  *  task  util_avg: 512, 256, 128,  64,  32,   16,    8, ...
+  * cfs_rq util_avg: 512, 768, 896, 960, 992, 1008, 1016, ...
+@@ -751,7 +752,8 @@ void post_init_entity_util_avg(struct sched_entity *se)
+ {
+ 	struct cfs_rq *cfs_rq = cfs_rq_of(se);
+ 	struct sched_avg *sa = &se->avg;
+-	long cap = (long)(SCHED_CAPACITY_SCALE - cfs_rq->avg.util_avg) / 2;
++	long cpu_scale = arch_scale_cpu_capacity(NULL, cpu_of(rq_of(cfs_rq)));
++	long cap = (long)(cpu_scale - cfs_rq->avg.util_avg) / 2;
+ 
+ 	if (cap > 0) {
+ 		if (cfs_rq->avg.util_avg != 0) {
+diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
+index 928be527477e..a7a2aaa3026a 100644
+--- a/kernel/sched/wait.c
++++ b/kernel/sched/wait.c
+@@ -392,35 +392,36 @@ static inline bool is_kthread_should_stop(void)
+  *     if (condition)
+  *         break;
+  *
+- *     p->state = mode;				condition = true;
+- *     smp_mb(); // A				smp_wmb(); // C
+- *     if (!wq_entry->flags & WQ_FLAG_WOKEN)	wq_entry->flags |= WQ_FLAG_WOKEN;
+- *         schedule()				try_to_wake_up();
+- *     p->state = TASK_RUNNING;		    ~~~~~~~~~~~~~~~~~~
+- *     wq_entry->flags &= ~WQ_FLAG_WOKEN;		condition = true;
+- *     smp_mb() // B				smp_wmb(); // C
+- *						wq_entry->flags |= WQ_FLAG_WOKEN;
+- * }
+- * remove_wait_queue(&wq_head, &wait);
++ *     // in wait_woken()			// in woken_wake_function()
+  *
++ *     p->state = mode;				wq_entry->flags |= WQ_FLAG_WOKEN;
++ *     smp_mb(); // A				try_to_wake_up():
++ *     if (!(wq_entry->flags & WQ_FLAG_WOKEN))	   <full barrier>
++ *         schedule()				   if (p->state & mode)
++ *     p->state = TASK_RUNNING;			      p->state = TASK_RUNNING;
++ *     wq_entry->flags &= ~WQ_FLAG_WOKEN;	~~~~~~~~~~~~~~~~~~
++ *     smp_mb(); // B				condition = true;
++ * }						smp_mb(); // C
++ * remove_wait_queue(&wq_head, &wait);		wq_entry->flags |= WQ_FLAG_WOKEN;
+  */
+ long wait_woken(struct wait_queue_entry *wq_entry, unsigned mode, long timeout)
+ {
+-	set_current_state(mode); /* A */
+ 	/*
+-	 * The above implies an smp_mb(), which matches with the smp_wmb() from
+-	 * woken_wake_function() such that if we observe WQ_FLAG_WOKEN we must
+-	 * also observe all state before the wakeup.
++	 * The below executes an smp_mb(), which matches with the full barrier
++	 * executed by the try_to_wake_up() in woken_wake_function() such that
++	 * either we see the store to wq_entry->flags in woken_wake_function()
++	 * or woken_wake_function() sees our store to current->state.
+ 	 */
++	set_current_state(mode); /* A */
+ 	if (!(wq_entry->flags & WQ_FLAG_WOKEN) && !is_kthread_should_stop())
+ 		timeout = schedule_timeout(timeout);
+ 	__set_current_state(TASK_RUNNING);
+ 
+ 	/*
+-	 * The below implies an smp_mb(), it too pairs with the smp_wmb() from
+-	 * woken_wake_function() such that we must either observe the wait
+-	 * condition being true _OR_ WQ_FLAG_WOKEN such that we will not miss
+-	 * an event.
++	 * The below executes an smp_mb(), which matches with the smp_mb() (C)
++	 * in woken_wake_function() such that either we see the wait condition
++	 * being true or the store to wq_entry->flags in woken_wake_function()
++	 * follows ours in the coherence order.
+ 	 */
+ 	smp_store_mb(wq_entry->flags, wq_entry->flags & ~WQ_FLAG_WOKEN); /* B */
+ 
+@@ -430,14 +431,8 @@ EXPORT_SYMBOL(wait_woken);
+ 
+ int woken_wake_function(struct wait_queue_entry *wq_entry, unsigned mode, int sync, void *key)
+ {
+-	/*
+-	 * Although this function is called under waitqueue lock, LOCK
+-	 * doesn't imply write barrier and the users expects write
+-	 * barrier semantics on wakeup functions.  The following
+-	 * smp_wmb() is equivalent to smp_wmb() in try_to_wake_up()
+-	 * and is paired with smp_store_mb() in wait_woken().
+-	 */
+-	smp_wmb(); /* C */
++	/* Pairs with the smp_store_mb() in wait_woken(). */
++	smp_mb(); /* C */
+ 	wq_entry->flags |= WQ_FLAG_WOKEN;
+ 
+ 	return default_wake_function(wq_entry, mode, sync, key);
+diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
+index 3264e1873219..deacc52d7ff1 100644
+--- a/net/bluetooth/af_bluetooth.c
++++ b/net/bluetooth/af_bluetooth.c
+@@ -159,7 +159,7 @@ void bt_accept_enqueue(struct sock *parent, struct sock *sk)
+ 	BT_DBG("parent %p, sk %p", parent, sk);
+ 
+ 	sock_hold(sk);
+-	lock_sock(sk);
++	lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
+ 	list_add_tail(&bt_sk(sk)->accept_q, &bt_sk(parent)->accept_q);
+ 	bt_sk(sk)->parent = parent;
+ 	release_sock(sk);
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index fb35b62af272..3680912f056a 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -939,9 +939,6 @@ struct ubuf_info *sock_zerocopy_alloc(struct sock *sk, size_t size)
+ 
+ 	WARN_ON_ONCE(!in_task());
+ 
+-	if (!sock_flag(sk, SOCK_ZEROCOPY))
+-		return NULL;
+-
+ 	skb = sock_omalloc(sk, 0, GFP_KERNEL);
+ 	if (!skb)
+ 		return NULL;
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 055f4bbba86b..41883c34a385 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -178,6 +178,9 @@ static void ipgre_err(struct sk_buff *skb, u32 info,
+ 
+ 	if (tpi->proto == htons(ETH_P_TEB))
+ 		itn = net_generic(net, gre_tap_net_id);
++	else if (tpi->proto == htons(ETH_P_ERSPAN) ||
++		 tpi->proto == htons(ETH_P_ERSPAN2))
++		itn = net_generic(net, erspan_net_id);
+ 	else
+ 		itn = net_generic(net, ipgre_net_id);
+ 
+@@ -328,6 +331,8 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+ 		ip_tunnel_rcv(tunnel, skb, tpi, tun_dst, log_ecn_error);
+ 		return PACKET_RCVD;
+ 	}
++	return PACKET_REJECT;
++
+ drop:
+ 	kfree_skb(skb);
+ 	return PACKET_RCVD;
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 4491faf83f4f..086201d96d54 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -1186,7 +1186,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
+ 
+ 	flags = msg->msg_flags;
+ 
+-	if (flags & MSG_ZEROCOPY && size) {
++	if (flags & MSG_ZEROCOPY && size && sock_flag(sk, SOCK_ZEROCOPY)) {
+ 		if (sk->sk_state != TCP_ESTABLISHED) {
+ 			err = -EINVAL;
+ 			goto out_err;
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index bdf6fa78d0d2..aa082b71d2e4 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -495,7 +495,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+ 		goto out_unlock;
+ 	}
+ 
+-	ieee80211_key_free(key, true);
++	ieee80211_key_free(key, sdata->vif.type == NL80211_IFTYPE_STATION);
+ 
+ 	ret = 0;
+  out_unlock:
+diff --git a/net/mac80211/key.c b/net/mac80211/key.c
+index ee0d0cc8dc3b..c054ac85793c 100644
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -656,11 +656,15 @@ int ieee80211_key_link(struct ieee80211_key *key,
+ {
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_key *old_key;
+-	int idx, ret;
+-	bool pairwise;
+-
+-	pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
+-	idx = key->conf.keyidx;
++	int idx = key->conf.keyidx;
++	bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
++	/*
++	 * We want to delay tailroom updates only for station - in that
++	 * case it helps roaming speed, but in other cases it hurts and
++	 * can cause warnings to appear.
++	 */
++	bool delay_tailroom = sdata->vif.type == NL80211_IFTYPE_STATION;
++	int ret;
+ 
+ 	mutex_lock(&sdata->local->key_mtx);
+ 
+@@ -688,14 +692,14 @@ int ieee80211_key_link(struct ieee80211_key *key,
+ 	increment_tailroom_need_count(sdata);
+ 
+ 	ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
+-	ieee80211_key_destroy(old_key, true);
++	ieee80211_key_destroy(old_key, delay_tailroom);
+ 
+ 	ieee80211_debugfs_key_add(key);
+ 
+ 	if (!local->wowlan) {
+ 		ret = ieee80211_key_enable_hw_accel(key);
+ 		if (ret)
+-			ieee80211_key_free(key, true);
++			ieee80211_key_free(key, delay_tailroom);
+ 	} else {
+ 		ret = 0;
+ 	}
+@@ -930,7 +934,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local,
+ 		ieee80211_key_replace(key->sdata, key->sta,
+ 				key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
+ 				key, NULL);
+-		__ieee80211_key_destroy(key, true);
++		__ieee80211_key_destroy(key, key->sdata->vif.type ==
++					NL80211_IFTYPE_STATION);
+ 	}
+ 
+ 	for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+@@ -940,7 +945,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local,
+ 		ieee80211_key_replace(key->sdata, key->sta,
+ 				key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
+ 				key, NULL);
+-		__ieee80211_key_destroy(key, true);
++		__ieee80211_key_destroy(key, key->sdata->vif.type ==
++					NL80211_IFTYPE_STATION);
+ 	}
+ 
+ 	mutex_unlock(&local->key_mtx);
+diff --git a/net/rds/bind.c b/net/rds/bind.c
+index 5aa3a64aa4f0..48257d3a4201 100644
+--- a/net/rds/bind.c
++++ b/net/rds/bind.c
+@@ -60,11 +60,13 @@ struct rds_sock *rds_find_bound(__be32 addr, __be16 port)
+ 	u64 key = ((u64)addr << 32) | port;
+ 	struct rds_sock *rs;
+ 
+-	rs = rhashtable_lookup_fast(&bind_hash_table, &key, ht_parms);
++	rcu_read_lock();
++	rs = rhashtable_lookup(&bind_hash_table, &key, ht_parms);
+ 	if (rs && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD))
+ 		rds_sock_addref(rs);
+ 	else
+ 		rs = NULL;
++	rcu_read_unlock();
+ 
+ 	rdsdebug("returning rs %p for %pI4:%u\n", rs, &addr,
+ 		ntohs(port));
+@@ -157,6 +159,7 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ 		goto out;
+ 	}
+ 
++	sock_set_flag(sk, SOCK_RCU_FREE);
+ 	ret = rds_add_bound(rs, sin->sin_addr.s_addr, &sin->sin_port);
+ 	if (ret)
+ 		goto out;
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 0a5fa347135e..ac8ca238c541 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -578,6 +578,7 @@ static int tipc_release(struct socket *sock)
+ 	sk_stop_timer(sk, &sk->sk_timer);
+ 	tipc_sk_remove(tsk);
+ 
++	sock_orphan(sk);
+ 	/* Reject any messages that accumulated in backlog queue */
+ 	release_sock(sk);
+ 	tipc_dest_list_purge(&tsk->cong_links);
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 1f3d9789af30..b3344bbe336b 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -149,6 +149,9 @@ static int alloc_encrypted_sg(struct sock *sk, int len)
+ 			 &ctx->sg_encrypted_num_elem,
+ 			 &ctx->sg_encrypted_size, 0);
+ 
++	if (rc == -ENOSPC)
++		ctx->sg_encrypted_num_elem = ARRAY_SIZE(ctx->sg_encrypted_data);
++
+ 	return rc;
+ }
+ 
+@@ -162,6 +165,9 @@ static int alloc_plaintext_sg(struct sock *sk, int len)
+ 			 &ctx->sg_plaintext_num_elem, &ctx->sg_plaintext_size,
+ 			 tls_ctx->pending_open_record_frags);
+ 
++	if (rc == -ENOSPC)
++		ctx->sg_plaintext_num_elem = ARRAY_SIZE(ctx->sg_plaintext_data);
++
+ 	return rc;
+ }
+ 
+@@ -280,7 +286,7 @@ static int zerocopy_from_iter(struct sock *sk, struct iov_iter *from,
+ 			      int length, int *pages_used,
+ 			      unsigned int *size_used,
+ 			      struct scatterlist *to, int to_max_pages,
+-			      bool charge)
++			      bool charge, bool revert)
+ {
+ 	struct page *pages[MAX_SKB_FRAGS];
+ 
+@@ -331,6 +337,8 @@ static int zerocopy_from_iter(struct sock *sk, struct iov_iter *from,
+ out:
+ 	*size_used = size;
+ 	*pages_used = num_elem;
++	if (revert)
++		iov_iter_revert(from, size);
+ 
+ 	return rc;
+ }
+@@ -432,7 +440,7 @@ alloc_encrypted:
+ 				&ctx->sg_plaintext_size,
+ 				ctx->sg_plaintext_data,
+ 				ARRAY_SIZE(ctx->sg_plaintext_data),
+-				true);
++				true, false);
+ 			if (ret)
+ 				goto fallback_to_reg_send;
+ 
+@@ -820,7 +828,7 @@ int tls_sw_recvmsg(struct sock *sk,
+ 				err = zerocopy_from_iter(sk, &msg->msg_iter,
+ 							 to_copy, &pages,
+ 							 &chunk, &sgin[1],
+-							 MAX_SKB_FRAGS,	false);
++							 MAX_SKB_FRAGS,	false, true);
+ 				if (err < 0)
+ 					goto fallback_to_reg_recv;
+ 
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 7c5e8978aeaa..a94983e03a8b 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1831,7 +1831,10 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
+ 	/* Try to instantiate a bundle */
+ 	err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family);
+ 	if (err <= 0) {
+-		if (err != 0 && err != -EAGAIN)
++		if (err == 0)
++			return NULL;
++
++		if (err != -EAGAIN)
+ 			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);
+ 		return ERR_PTR(err);
+ 	}
+diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
+index 86321f06461e..ed303f552f9d 100644
+--- a/scripts/Kbuild.include
++++ b/scripts/Kbuild.include
+@@ -400,3 +400,6 @@ endif
+ endef
+ #
+ ###############################################################################
++
++# delete partially updated (i.e. corrupted) files on error
++.DELETE_ON_ERROR:
+diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
+index b60524310855..c20e3142b541 100644
+--- a/security/integrity/evm/evm_crypto.c
++++ b/security/integrity/evm/evm_crypto.c
+@@ -97,7 +97,8 @@ static struct shash_desc *init_desc(char type)
+ 		mutex_lock(&mutex);
+ 		if (*tfm)
+ 			goto out;
+-		*tfm = crypto_alloc_shash(algo, 0, CRYPTO_ALG_ASYNC);
++		*tfm = crypto_alloc_shash(algo, 0,
++					  CRYPTO_ALG_ASYNC | CRYPTO_NOLOAD);
+ 		if (IS_ERR(*tfm)) {
+ 			rc = PTR_ERR(*tfm);
+ 			pr_err("Can not allocate %s (reason: %ld)\n", algo, rc);
+diff --git a/security/security.c b/security/security.c
+index 68f46d849abe..4e572b38937d 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -118,6 +118,8 @@ static int lsm_append(char *new, char **result)
+ 
+ 	if (*result == NULL) {
+ 		*result = kstrdup(new, GFP_KERNEL);
++		if (*result == NULL)
++			return -ENOMEM;
+ 	} else {
+ 		/* Check if it is the last registered name */
+ 		if (match_last_lsm(*result, new))
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 19de675d4504..8b6cd5a79bfa 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -3924,15 +3924,19 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
+ 	struct smack_known *skp = NULL;
+ 	int rc = 0;
+ 	struct smk_audit_info ad;
++	u16 family = sk->sk_family;
+ #ifdef CONFIG_AUDIT
+ 	struct lsm_network_audit net;
+ #endif
+ #if IS_ENABLED(CONFIG_IPV6)
+ 	struct sockaddr_in6 sadd;
+ 	int proto;
++
++	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
++		family = PF_INET;
+ #endif /* CONFIG_IPV6 */
+ 
+-	switch (sk->sk_family) {
++	switch (family) {
+ 	case PF_INET:
+ #ifdef CONFIG_SECURITY_SMACK_NETFILTER
+ 		/*
+@@ -3950,7 +3954,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
+ 		 */
+ 		netlbl_secattr_init(&secattr);
+ 
+-		rc = netlbl_skbuff_getattr(skb, sk->sk_family, &secattr);
++		rc = netlbl_skbuff_getattr(skb, family, &secattr);
+ 		if (rc == 0)
+ 			skp = smack_from_secattr(&secattr, ssp);
+ 		else
+@@ -3963,7 +3967,7 @@ access_check:
+ #endif
+ #ifdef CONFIG_AUDIT
+ 		smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+-		ad.a.u.net->family = sk->sk_family;
++		ad.a.u.net->family = family;
+ 		ad.a.u.net->netif = skb->skb_iif;
+ 		ipv4_skb_to_auditdata(skb, &ad.a, NULL);
+ #endif
+@@ -3977,7 +3981,7 @@ access_check:
+ 		rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in,
+ 					MAY_WRITE, rc);
+ 		if (rc != 0)
+-			netlbl_skbuff_err(skb, sk->sk_family, rc, 0);
++			netlbl_skbuff_err(skb, family, rc, 0);
+ 		break;
+ #if IS_ENABLED(CONFIG_IPV6)
+ 	case PF_INET6:
+@@ -3993,7 +3997,7 @@ access_check:
+ 			skp = smack_net_ambient;
+ #ifdef CONFIG_AUDIT
+ 		smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+-		ad.a.u.net->family = sk->sk_family;
++		ad.a.u.net->family = family;
+ 		ad.a.u.net->netif = skb->skb_iif;
+ 		ipv6_skb_to_auditdata(skb, &ad.a, NULL);
+ #endif /* CONFIG_AUDIT */
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 44b5ae833082..a4aac948ea49 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -626,27 +626,33 @@ EXPORT_SYMBOL(snd_interval_refine);
+ 
+ static int snd_interval_refine_first(struct snd_interval *i)
+ {
++	const unsigned int last_max = i->max;
++
+ 	if (snd_BUG_ON(snd_interval_empty(i)))
+ 		return -EINVAL;
+ 	if (snd_interval_single(i))
+ 		return 0;
+ 	i->max = i->min;
+-	i->openmax = i->openmin;
+-	if (i->openmax)
++	if (i->openmin)
+ 		i->max++;
++	/* only exclude max value if also excluded before refine */
++	i->openmax = (i->openmax && i->max >= last_max);
+ 	return 1;
+ }
+ 
+ static int snd_interval_refine_last(struct snd_interval *i)
+ {
++	const unsigned int last_min = i->min;
++
+ 	if (snd_BUG_ON(snd_interval_empty(i)))
+ 		return -EINVAL;
+ 	if (snd_interval_single(i))
+ 		return 0;
+ 	i->min = i->max;
+-	i->openmin = i->openmax;
+-	if (i->openmin)
++	if (i->openmax)
+ 		i->min--;
++	/* only exclude min value if also excluded before refine */
++	i->openmin = (i->openmin && i->min <= last_min);
+ 	return 1;
+ }
+ 
+diff --git a/sound/isa/msnd/msnd_pinnacle.c b/sound/isa/msnd/msnd_pinnacle.c
+index 6c584d9b6c42..a19f802b2071 100644
+--- a/sound/isa/msnd/msnd_pinnacle.c
++++ b/sound/isa/msnd/msnd_pinnacle.c
+@@ -82,10 +82,10 @@
+ 
+ static void set_default_audio_parameters(struct snd_msnd *chip)
+ {
+-	chip->play_sample_size = DEFSAMPLESIZE;
++	chip->play_sample_size = snd_pcm_format_width(DEFSAMPLESIZE);
+ 	chip->play_sample_rate = DEFSAMPLERATE;
+ 	chip->play_channels = DEFCHANNELS;
+-	chip->capture_sample_size = DEFSAMPLESIZE;
++	chip->capture_sample_size = snd_pcm_format_width(DEFSAMPLESIZE);
+ 	chip->capture_sample_rate = DEFSAMPLERATE;
+ 	chip->capture_channels = DEFCHANNELS;
+ }
+diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
+index 38e4a8515709..d00734d31e04 100644
+--- a/sound/soc/codecs/hdmi-codec.c
++++ b/sound/soc/codecs/hdmi-codec.c
+@@ -291,10 +291,6 @@ static const struct snd_soc_dapm_widget hdmi_widgets[] = {
+ 	SND_SOC_DAPM_OUTPUT("TX"),
+ };
+ 
+-static const struct snd_soc_dapm_route hdmi_routes[] = {
+-	{ "TX", NULL, "Playback" },
+-};
+-
+ enum {
+ 	DAI_ID_I2S = 0,
+ 	DAI_ID_SPDIF,
+@@ -689,9 +685,23 @@ static int hdmi_codec_pcm_new(struct snd_soc_pcm_runtime *rtd,
+ 	return snd_ctl_add(rtd->card->snd_card, kctl);
+ }
+ 
++static int hdmi_dai_probe(struct snd_soc_dai *dai)
++{
++	struct snd_soc_dapm_context *dapm;
++	struct snd_soc_dapm_route route = {
++		.sink = "TX",
++		.source = dai->driver->playback.stream_name,
++	};
++
++	dapm = snd_soc_component_get_dapm(dai->component);
++
++	return snd_soc_dapm_add_routes(dapm, &route, 1);
++}
++
+ static const struct snd_soc_dai_driver hdmi_i2s_dai = {
+ 	.name = "i2s-hifi",
+ 	.id = DAI_ID_I2S,
++	.probe = hdmi_dai_probe,
+ 	.playback = {
+ 		.stream_name = "I2S Playback",
+ 		.channels_min = 2,
+@@ -707,6 +717,7 @@ static const struct snd_soc_dai_driver hdmi_i2s_dai = {
+ static const struct snd_soc_dai_driver hdmi_spdif_dai = {
+ 	.name = "spdif-hifi",
+ 	.id = DAI_ID_SPDIF,
++	.probe = hdmi_dai_probe,
+ 	.playback = {
+ 		.stream_name = "SPDIF Playback",
+ 		.channels_min = 2,
+@@ -733,8 +744,6 @@ static int hdmi_of_xlate_dai_id(struct snd_soc_component *component,
+ static const struct snd_soc_component_driver hdmi_driver = {
+ 	.dapm_widgets		= hdmi_widgets,
+ 	.num_dapm_widgets	= ARRAY_SIZE(hdmi_widgets),
+-	.dapm_routes		= hdmi_routes,
+-	.num_dapm_routes	= ARRAY_SIZE(hdmi_routes),
+ 	.of_xlate_dai_id	= hdmi_of_xlate_dai_id,
+ 	.idle_bias_on		= 1,
+ 	.use_pmdown_time	= 1,
+diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c
+index 1570b91bf018..dca82dd6e3bf 100644
+--- a/sound/soc/codecs/rt5514.c
++++ b/sound/soc/codecs/rt5514.c
+@@ -64,8 +64,8 @@ static const struct reg_sequence rt5514_patch[] = {
+ 	{RT5514_ANA_CTRL_LDO10,		0x00028604},
+ 	{RT5514_ANA_CTRL_ADCFED,	0x00000800},
+ 	{RT5514_ASRC_IN_CTRL1,		0x00000003},
+-	{RT5514_DOWNFILTER0_CTRL3,	0x10000362},
+-	{RT5514_DOWNFILTER1_CTRL3,	0x10000362},
++	{RT5514_DOWNFILTER0_CTRL3,	0x10000352},
++	{RT5514_DOWNFILTER1_CTRL3,	0x10000352},
+ };
+ 
+ static const struct reg_default rt5514_reg[] = {
+@@ -92,10 +92,10 @@ static const struct reg_default rt5514_reg[] = {
+ 	{RT5514_ASRC_IN_CTRL1,		0x00000003},
+ 	{RT5514_DOWNFILTER0_CTRL1,	0x00020c2f},
+ 	{RT5514_DOWNFILTER0_CTRL2,	0x00020c2f},
+-	{RT5514_DOWNFILTER0_CTRL3,	0x10000362},
++	{RT5514_DOWNFILTER0_CTRL3,	0x10000352},
+ 	{RT5514_DOWNFILTER1_CTRL1,	0x00020c2f},
+ 	{RT5514_DOWNFILTER1_CTRL2,	0x00020c2f},
+-	{RT5514_DOWNFILTER1_CTRL3,	0x10000362},
++	{RT5514_DOWNFILTER1_CTRL3,	0x10000352},
+ 	{RT5514_ANA_CTRL_LDO10,		0x00028604},
+ 	{RT5514_ANA_CTRL_LDO18_16,	0x02000345},
+ 	{RT5514_ANA_CTRL_ADC12,		0x0000a2a8},
+diff --git a/sound/soc/codecs/rt5651.c b/sound/soc/codecs/rt5651.c
+index 6b5669f3e85d..39d2c67cd064 100644
+--- a/sound/soc/codecs/rt5651.c
++++ b/sound/soc/codecs/rt5651.c
+@@ -1696,6 +1696,13 @@ static irqreturn_t rt5651_irq(int irq, void *data)
+ 	return IRQ_HANDLED;
+ }
+ 
++static void rt5651_cancel_work(void *data)
++{
++	struct rt5651_priv *rt5651 = data;
++
++	cancel_work_sync(&rt5651->jack_detect_work);
++}
++
+ static int rt5651_set_jack(struct snd_soc_component *component,
+ 			   struct snd_soc_jack *hp_jack, void *data)
+ {
+@@ -2036,6 +2043,11 @@ static int rt5651_i2c_probe(struct i2c_client *i2c,
+ 
+ 	INIT_WORK(&rt5651->jack_detect_work, rt5651_jack_detect_work);
+ 
++	/* Make sure work is stopped on probe-error / remove */
++	ret = devm_add_action_or_reset(&i2c->dev, rt5651_cancel_work, rt5651);
++	if (ret)
++		return ret;
++
+ 	ret = devm_snd_soc_register_component(&i2c->dev,
+ 				&soc_component_dev_rt5651,
+ 				rt5651_dai, ARRAY_SIZE(rt5651_dai));
+@@ -2043,15 +2055,6 @@ static int rt5651_i2c_probe(struct i2c_client *i2c,
+ 	return ret;
+ }
+ 
+-static int rt5651_i2c_remove(struct i2c_client *i2c)
+-{
+-	struct rt5651_priv *rt5651 = i2c_get_clientdata(i2c);
+-
+-	cancel_work_sync(&rt5651->jack_detect_work);
+-
+-	return 0;
+-}
+-
+ static struct i2c_driver rt5651_i2c_driver = {
+ 	.driver = {
+ 		.name = "rt5651",
+@@ -2059,7 +2062,6 @@ static struct i2c_driver rt5651_i2c_driver = {
+ 		.of_match_table = of_match_ptr(rt5651_of_match),
+ 	},
+ 	.probe = rt5651_i2c_probe,
+-	.remove   = rt5651_i2c_remove,
+ 	.id_table = rt5651_i2c_id,
+ };
+ module_i2c_driver(rt5651_i2c_driver);
+diff --git a/sound/soc/qcom/qdsp6/q6afe-dai.c b/sound/soc/qcom/qdsp6/q6afe-dai.c
+index 5002dd05bf27..f8298be7038f 100644
+--- a/sound/soc/qcom/qdsp6/q6afe-dai.c
++++ b/sound/soc/qcom/qdsp6/q6afe-dai.c
+@@ -1180,7 +1180,7 @@ static void of_q6afe_parse_dai_data(struct device *dev,
+ 		int id, i, num_lines;
+ 
+ 		ret = of_property_read_u32(node, "reg", &id);
+-		if (ret || id > AFE_PORT_MAX) {
++		if (ret || id < 0 || id >= AFE_PORT_MAX) {
+ 			dev_err(dev, "valid dai id not found:%d\n", ret);
+ 			continue;
+ 		}
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 8aac48f9c322..08aa78007020 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2875,7 +2875,8 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+  */
+ 
+ #define AU0828_DEVICE(vid, pid, vname, pname) { \
+-	USB_DEVICE_VENDOR_SPEC(vid, pid), \
++	.idVendor = vid, \
++	.idProduct = pid, \
+ 	.match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
+ 		       USB_DEVICE_ID_MATCH_INT_CLASS | \
+ 		       USB_DEVICE_ID_MATCH_INT_SUBCLASS, \
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 02b6cc02767f..dde87d64bc32 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1373,6 +1373,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ 			return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ 		break;
+ 
++	case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
+ 	case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */
+ 	case USB_ID(0x16b0, 0x06b2): /* NuPrime DAC-10 */
+ 	case USB_ID(0x16d0, 0x0733): /* Furutech ADL Stratos */
+@@ -1443,6 +1444,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ 	 */
+ 	switch (USB_ID_VENDOR(chip->usb_id)) {
+ 	case 0x20b1:  /* XMOS based devices */
++	case 0x152a:  /* Thesycon devices */
+ 	case 0x25ce:  /* Mytek devices */
+ 		if (fp->dsd_raw)
+ 			return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
+index dbf6e8bd98ba..bbb2a8ef367c 100644
+--- a/tools/hv/hv_kvp_daemon.c
++++ b/tools/hv/hv_kvp_daemon.c
+@@ -286,7 +286,7 @@ static int kvp_key_delete(int pool, const __u8 *key, int key_size)
+ 		 * Found a match; just move the remaining
+ 		 * entries up.
+ 		 */
+-		if (i == num_records) {
++		if (i == (num_records - 1)) {
+ 			kvp_file_info[pool].num_records--;
+ 			kvp_update_file(pool);
+ 			return 0;
+diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+index ef5d59a5742e..7c6eeb4633fe 100644
+--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c
++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+@@ -58,9 +58,13 @@ static int check_return_reg(int ra_regno, Dwarf_Frame *frame)
+ 	}
+ 
+ 	/*
+-	 * Check if return address is on the stack.
++	 * Check if return address is on the stack. If return address
++	 * is in a register (typically R0), it is yet to be saved on
++	 * the stack.
+ 	 */
+-	if (nops != 0 || ops != NULL)
++	if ((nops != 0 || ops != NULL) &&
++		!(nops == 1 && ops[0].atom == DW_OP_regx &&
++			ops[0].number2 == 0 && ops[0].offset == 0))
+ 		return 0;
+ 
+ 	/*
+@@ -246,7 +250,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain)
+ 	if (!chain || chain->nr < 3)
+ 		return skip_slot;
+ 
+-	ip = chain->ips[2];
++	ip = chain->ips[1];
+ 
+ 	thread__find_symbol(thread, PERF_RECORD_MISC_USER, ip, &al);
+ 
+diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c
+index dd850a26d579..4f5de8245b32 100644
+--- a/tools/perf/tests/builtin-test.c
++++ b/tools/perf/tests/builtin-test.c
+@@ -599,7 +599,7 @@ static int __cmd_test(int argc, const char *argv[], struct intlist *skiplist)
+ 			for (subi = 0; subi < subn; subi++) {
+ 				pr_info("%2d.%1d: %-*s:", i, subi + 1, subw,
+ 					t->subtest.get_desc(subi));
+-				err = test_and_print(t, skip, subi);
++				err = test_and_print(t, skip, subi + 1);
+ 				if (err != TEST_OK && t->subtest.skip_if_fail)
+ 					skip = true;
+ 			}
+diff --git a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+index 94e513e62b34..3013ac8f83d0 100755
+--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
++++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+@@ -13,11 +13,24 @@
+ libc=$(grep -w libc /proc/self/maps | head -1 | sed -r 's/.*[[:space:]](\/.*)/\1/g')
+ nm -Dg $libc 2>/dev/null | fgrep -q inet_pton || exit 254
+ 
++event_pattern='probe_libc:inet_pton(\_[[:digit:]]+)?'
++
++add_libc_inet_pton_event() {
++
++	event_name=$(perf probe -f -x $libc -a inet_pton 2>&1 | tail -n +2 | head -n -5 | \
++			grep -P -o "$event_pattern(?=[[:space:]]\(on inet_pton in $libc\))")
++
++	if [ $? -ne 0 -o -z "$event_name" ] ; then
++		printf "FAIL: could not add event\n"
++		return 1
++	fi
++}
++
+ trace_libc_inet_pton_backtrace() {
+ 
+ 	expected=`mktemp -u /tmp/expected.XXX`
+ 
+-	echo "ping[][0-9 \.:]+probe_libc:inet_pton: \([[:xdigit:]]+\)" > $expected
++	echo "ping[][0-9 \.:]+$event_name: \([[:xdigit:]]+\)" > $expected
+ 	echo ".*inet_pton\+0x[[:xdigit:]]+[[:space:]]\($libc|inlined\)$" >> $expected
+ 	case "$(uname -m)" in
+ 	s390x)
+@@ -26,6 +39,12 @@ trace_libc_inet_pton_backtrace() {
+ 		echo "(__GI_)?getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc|inlined\)$" >> $expected
+ 		echo "main\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$" >> $expected
+ 		;;
++	ppc64|ppc64le)
++		eventattr='max-stack=4'
++		echo "gaih_inet.*\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected
++		echo "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected
++		echo ".*\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$" >> $expected
++		;;
+ 	*)
+ 		eventattr='max-stack=3'
+ 		echo "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected
+@@ -35,7 +54,7 @@ trace_libc_inet_pton_backtrace() {
+ 
+ 	perf_data=`mktemp -u /tmp/perf.data.XXX`
+ 	perf_script=`mktemp -u /tmp/perf.script.XXX`
+-	perf record -e probe_libc:inet_pton/$eventattr/ -o $perf_data ping -6 -c 1 ::1 > /dev/null 2>&1
++	perf record -e $event_name/$eventattr/ -o $perf_data ping -6 -c 1 ::1 > /dev/null 2>&1
+ 	perf script -i $perf_data > $perf_script
+ 
+ 	exec 3<$perf_script
+@@ -46,7 +65,7 @@ trace_libc_inet_pton_backtrace() {
+ 		echo "$line" | egrep -q "$pattern"
+ 		if [ $? -ne 0 ] ; then
+ 			printf "FAIL: expected backtrace entry \"%s\" got \"%s\"\n" "$pattern" "$line"
+-			exit 1
++			return 1
+ 		fi
+ 	done
+ 
+@@ -56,13 +75,20 @@ trace_libc_inet_pton_backtrace() {
+ 	# even if the perf script output does not match.
+ }
+ 
++delete_libc_inet_pton_event() {
++
++	if [ -n "$event_name" ] ; then
++		perf probe -q -d $event_name
++	fi
++}
++
+ # Check for IPv6 interface existence
+ ip a sh lo | fgrep -q inet6 || exit 2
+ 
+ skip_if_no_perf_probe && \
+-perf probe -q $libc inet_pton && \
++add_libc_inet_pton_event && \
+ trace_libc_inet_pton_backtrace
+ err=$?
+ rm -f ${perf_data} ${perf_script} ${expected}
+-perf probe -q -d probe_libc:inet_pton
++delete_libc_inet_pton_event
+ exit $err
+diff --git a/tools/perf/util/comm.c b/tools/perf/util/comm.c
+index 7798a2cc8a86..31279a7bd919 100644
+--- a/tools/perf/util/comm.c
++++ b/tools/perf/util/comm.c
+@@ -20,9 +20,10 @@ static struct rw_semaphore comm_str_lock = {.lock = PTHREAD_RWLOCK_INITIALIZER,}
+ 
+ static struct comm_str *comm_str__get(struct comm_str *cs)
+ {
+-	if (cs)
+-		refcount_inc(&cs->refcnt);
+-	return cs;
++	if (cs && refcount_inc_not_zero(&cs->refcnt))
++		return cs;
++
++	return NULL;
+ }
+ 
+ static void comm_str__put(struct comm_str *cs)
+@@ -67,9 +68,14 @@ struct comm_str *__comm_str__findnew(const char *str, struct rb_root *root)
+ 		parent = *p;
+ 		iter = rb_entry(parent, struct comm_str, rb_node);
+ 
++		/*
++		 * If we race with comm_str__put, iter->refcnt is 0
++		 * and it will be removed within comm_str__put call
++		 * shortly, ignore it in this search.
++		 */
+ 		cmp = strcmp(str, iter->str);
+-		if (!cmp)
+-			return comm_str__get(iter);
++		if (!cmp && comm_str__get(iter))
++			return iter;
+ 
+ 		if (cmp < 0)
+ 			p = &(*p)->rb_left;
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index 653ff65aa2c3..5af58aac91ad 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -2587,7 +2587,7 @@ static const struct feature_ops feat_ops[HEADER_LAST_FEATURE] = {
+ 	FEAT_OPR(NUMA_TOPOLOGY,	numa_topology,	true),
+ 	FEAT_OPN(BRANCH_STACK,	branch_stack,	false),
+ 	FEAT_OPR(PMU_MAPPINGS,	pmu_mappings,	false),
+-	FEAT_OPN(GROUP_DESC,	group_desc,	false),
++	FEAT_OPR(GROUP_DESC,	group_desc,	false),
+ 	FEAT_OPN(AUXTRACE,	auxtrace,	false),
+ 	FEAT_OPN(STAT,		stat,		false),
+ 	FEAT_OPN(CACHE,		cache,		true),
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index e7b4a8b513f2..22dbb6612b41 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -2272,6 +2272,7 @@ static int unwind_entry(struct unwind_entry *entry, void *arg)
+ {
+ 	struct callchain_cursor *cursor = arg;
+ 	const char *srcline = NULL;
++	u64 addr;
+ 
+ 	if (symbol_conf.hide_unresolved && entry->sym == NULL)
+ 		return 0;
+@@ -2279,7 +2280,13 @@ static int unwind_entry(struct unwind_entry *entry, void *arg)
+ 	if (append_inlines(cursor, entry->map, entry->sym, entry->ip) == 0)
+ 		return 0;
+ 
+-	srcline = callchain_srcline(entry->map, entry->sym, entry->ip);
++	/*
++	 * Convert entry->ip from a virtual address to an offset in
++	 * its corresponding binary.
++	 */
++	addr = map__map_ip(entry->map, entry->ip);
++
++	srcline = callchain_srcline(entry->map, entry->sym, addr);
+ 	return callchain_cursor_append(cursor, entry->ip,
+ 				       entry->map, entry->sym,
+ 				       false, NULL, 0, 0, 0, srcline);
+diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
+index 89ac5b5dc218..f5431092c6d1 100644
+--- a/tools/perf/util/map.c
++++ b/tools/perf/util/map.c
+@@ -590,6 +590,13 @@ struct symbol *map_groups__find_symbol(struct map_groups *mg,
+ 	return NULL;
+ }
+ 
++static bool map__contains_symbol(struct map *map, struct symbol *sym)
++{
++	u64 ip = map->unmap_ip(map, sym->start);
++
++	return ip >= map->start && ip < map->end;
++}
++
+ struct symbol *maps__find_symbol_by_name(struct maps *maps, const char *name,
+ 					 struct map **mapp)
+ {
+@@ -605,6 +612,10 @@ struct symbol *maps__find_symbol_by_name(struct maps *maps, const char *name,
+ 
+ 		if (sym == NULL)
+ 			continue;
++		if (!map__contains_symbol(pos, sym)) {
++			sym = NULL;
++			continue;
++		}
+ 		if (mapp != NULL)
+ 			*mapp = pos;
+ 		goto out;
+diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
+index 538db4e5d1e6..6f318b15950e 100644
+--- a/tools/perf/util/unwind-libdw.c
++++ b/tools/perf/util/unwind-libdw.c
+@@ -77,7 +77,7 @@ static int entry(u64 ip, struct unwind_info *ui)
+ 	if (__report_module(&al, ip, ui))
+ 		return -1;
+ 
+-	e->ip  = al.addr;
++	e->ip  = ip;
+ 	e->map = al.map;
+ 	e->sym = al.sym;
+ 
+diff --git a/tools/perf/util/unwind-libunwind-local.c b/tools/perf/util/unwind-libunwind-local.c
+index 6a11bc7e6b27..79f521a552cf 100644
+--- a/tools/perf/util/unwind-libunwind-local.c
++++ b/tools/perf/util/unwind-libunwind-local.c
+@@ -575,7 +575,7 @@ static int entry(u64 ip, struct thread *thread,
+ 	struct addr_location al;
+ 
+ 	e.sym = thread__find_symbol(thread, PERF_RECORD_MISC_USER, ip, &al);
+-	e.ip = al.addr;
++	e.ip  = ip;
+ 	e.map = al.map;
+ 
+ 	pr_debug("unwind: %s:ip = 0x%" PRIx64 " (0x%" PRIx64 ")\n",
+diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
+index e2926f72a821..94c3bdf82ff7 100644
+--- a/tools/testing/nvdimm/test/nfit.c
++++ b/tools/testing/nvdimm/test/nfit.c
+@@ -1308,7 +1308,8 @@ static void smart_init(struct nfit_test *t)
+ 			| ND_INTEL_SMART_ALARM_VALID
+ 			| ND_INTEL_SMART_USED_VALID
+ 			| ND_INTEL_SMART_SHUTDOWN_VALID
+-			| ND_INTEL_SMART_MTEMP_VALID,
++			| ND_INTEL_SMART_MTEMP_VALID
++			| ND_INTEL_SMART_CTEMP_VALID,
+ 		.health = ND_INTEL_SMART_NON_CRITICAL_HEALTH,
+ 		.media_temperature = 23 * 16,
+ 		.ctrl_temperature = 25 * 16,
+diff --git a/tools/testing/selftests/android/ion/ionapp_export.c b/tools/testing/selftests/android/ion/ionapp_export.c
+index a944e72621a9..b5fa0a2dc968 100644
+--- a/tools/testing/selftests/android/ion/ionapp_export.c
++++ b/tools/testing/selftests/android/ion/ionapp_export.c
+@@ -51,6 +51,7 @@ int main(int argc, char *argv[])
+ 
+ 	heap_size = 0;
+ 	flags = 0;
++	heap_type = ION_HEAP_TYPE_SYSTEM;
+ 
+ 	while ((opt = getopt(argc, argv, "hi:s:")) != -1) {
+ 		switch (opt) {
+diff --git a/tools/testing/selftests/timers/raw_skew.c b/tools/testing/selftests/timers/raw_skew.c
+index ca6cd146aafe..dcf73c5dab6e 100644
+--- a/tools/testing/selftests/timers/raw_skew.c
++++ b/tools/testing/selftests/timers/raw_skew.c
+@@ -134,6 +134,11 @@ int main(int argv, char **argc)
+ 	printf(" %lld.%i(act)", ppm/1000, abs((int)(ppm%1000)));
+ 
+ 	if (llabs(eppm - ppm) > 1000) {
++		if (tx1.offset || tx2.offset ||
++		    tx1.freq != tx2.freq || tx1.tick != tx2.tick) {
++			printf("	[SKIP]\n");
++			return ksft_exit_skip("The clock was adjusted externally. Shutdown NTPd or other time sync daemons\n");
++		}
+ 		printf("	[FAILED]\n");
+ 		return ksft_exit_fail();
+ 	}
+diff --git a/tools/testing/selftests/vDSO/vdso_test.c b/tools/testing/selftests/vDSO/vdso_test.c
+index 2df26bd0099c..eda53f833d8e 100644
+--- a/tools/testing/selftests/vDSO/vdso_test.c
++++ b/tools/testing/selftests/vDSO/vdso_test.c
+@@ -15,6 +15,8 @@
+ #include <sys/auxv.h>
+ #include <sys/time.h>
+ 
++#include "../kselftest.h"
++
+ extern void *vdso_sym(const char *version, const char *name);
+ extern void vdso_init_from_sysinfo_ehdr(uintptr_t base);
+ extern void vdso_init_from_auxv(void *auxv);
+@@ -37,7 +39,7 @@ int main(int argc, char **argv)
+ 	unsigned long sysinfo_ehdr = getauxval(AT_SYSINFO_EHDR);
+ 	if (!sysinfo_ehdr) {
+ 		printf("AT_SYSINFO_EHDR is not present!\n");
+-		return 0;
++		return KSFT_SKIP;
+ 	}
+ 
+ 	vdso_init_from_sysinfo_ehdr(getauxval(AT_SYSINFO_EHDR));
+@@ -48,7 +50,7 @@ int main(int argc, char **argv)
+ 
+ 	if (!gtod) {
+ 		printf("Could not find %s\n", name);
+-		return 1;
++		return KSFT_SKIP;
+ 	}
+ 
+ 	struct timeval tv;
+@@ -59,6 +61,7 @@ int main(int argc, char **argv)
+ 		       (long long)tv.tv_sec, (long long)tv.tv_usec);
+ 	} else {
+ 		printf("%s failed\n", name);
++		return KSFT_FAIL;
+ 	}
+ 
+ 	return 0;
+diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
+index 2673efce65f3..b71417913741 100644
+--- a/virt/kvm/arm/vgic/vgic-init.c
++++ b/virt/kvm/arm/vgic/vgic-init.c
+@@ -271,6 +271,10 @@ int vgic_init(struct kvm *kvm)
+ 	if (vgic_initialized(kvm))
+ 		return 0;
+ 
++	/* Are we also in the middle of creating a VCPU? */
++	if (kvm->created_vcpus != atomic_read(&kvm->online_vcpus))
++		return -EBUSY;
++
+ 	/* freeze the number of spis */
+ 	if (!dist->nr_spis)
+ 		dist->nr_spis = VGIC_NR_IRQS_LEGACY - VGIC_NR_PRIVATE_IRQS;
+diff --git a/virt/kvm/arm/vgic/vgic-mmio-v2.c b/virt/kvm/arm/vgic/vgic-mmio-v2.c
+index ffc587bf4742..64e571cc02df 100644
+--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c
++++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c
+@@ -352,6 +352,9 @@ static void vgic_mmio_write_apr(struct kvm_vcpu *vcpu,
+ 
+ 		if (n > vgic_v3_max_apr_idx(vcpu))
+ 			return;
++
++		n = array_index_nospec(n, 4);
++
+ 		/* GICv3 only uses ICH_AP1Rn for memory mapped (GICv2) guests */
+ 		vgicv3->vgic_ap1r[n] = val;
+ 	}