Linux patch 4.9.2114.9-215

Signed-off-by: Mike Pagano <mpagano@gentoo.org>

2 files changed, 3299 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 98a33c2f..abe93da9 100644
--- a/0000_README
+++ b/0000_README
@@ -883,6 +883,10 @@ Patch:  1209_linux-4.9.210.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.210
 
+Patch:  1210_linux-4.9.211.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.211
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1210_linux-4.9.211.patch b/1210_linux-4.9.211.patch
new file mode 100644
index 00000000..658a62df
--- /dev/null
+++ b/1210_linux-4.9.211.patch
@@ -0,0 +1,3295 @@
+diff --git a/Documentation/ABI/testing/sysfs-bus-mei b/Documentation/ABI/testing/sysfs-bus-mei
+index 6bd45346ac7e..3f8701e8fa24 100644
+--- a/Documentation/ABI/testing/sysfs-bus-mei
++++ b/Documentation/ABI/testing/sysfs-bus-mei
+@@ -4,7 +4,7 @@ KernelVersion:	3.10
+ Contact:	Samuel Ortiz <sameo@linux.intel.com>
+ 		linux-mei@linux.intel.com
+ Description:	Stores the same MODALIAS value emitted by uevent
+-		Format: mei:<mei device name>:<device uuid>:
++		Format: mei:<mei device name>:<device uuid>:<protocol version>
+ 
+ What:		/sys/bus/mei/devices/.../name
+ Date:		May 2015
+diff --git a/Makefile b/Makefile
+index aa871ec44dd9..7fd68e080fe4 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 210
++SUBLEVEL = 211
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+index e79f3defe002..c2ad4f97cef0 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+@@ -56,10 +56,10 @@
+ 
+ 	pmu {
+ 		compatible = "arm,armv8-pmuv3";
+-		interrupts = <0 120 8>,
+-			     <0 121 8>,
+-			     <0 122 8>,
+-			     <0 123 8>;
++		interrupts = <0 170 4>,
++			     <0 171 4>,
++			     <0 172 4>,
++			     <0 173 4>;
+ 		interrupt-affinity = <&cpu0>,
+ 				     <&cpu1>,
+ 				     <&cpu2>,
+diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
+index 547519abc751..ff721659eb94 100644
+--- a/arch/arm64/include/asm/kvm_mmu.h
++++ b/arch/arm64/include/asm/kvm_mmu.h
+@@ -300,6 +300,11 @@ static inline bool __kvm_cpu_uses_extended_idmap(void)
+ 	return __cpu_uses_extended_idmap();
+ }
+ 
++/*
++ * Can't use pgd_populate here, because the extended idmap adds an extra level
++ * above CONFIG_PGTABLE_LEVELS (which is 2 or 3 if we're using the extended
++ * idmap), and pgd_populate is only available if CONFIG_PGTABLE_LEVELS = 4.
++ */
+ static inline void __kvm_extend_hypmap(pgd_t *boot_hyp_pgd,
+ 				       pgd_t *hyp_pgd,
+ 				       pgd_t *merged_hyp_pgd,
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 56ba1389a95a..199f434f99a4 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -353,6 +353,7 @@ static inline int pmd_protnone(pmd_t pmd)
+ 
+ #define pud_write(pud)		pte_write(pud_pte(pud))
+ #define pud_pfn(pud)		(((pud_val(pud) & PUD_MASK) & PHYS_MASK) >> PAGE_SHIFT)
++#define pfn_pud(pfn,prot)	(__pud(((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)))
+ 
+ #define set_pmd_at(mm, addr, pmdp, pmd)	set_pte_at(mm, addr, (pte_t *)pmdp, pmd_pte(pmd))
+ 
+diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
+index 76c9b51fa7f1..c4aec129ed20 100644
+--- a/arch/arm64/kernel/hibernate.c
++++ b/arch/arm64/kernel/hibernate.c
+@@ -247,8 +247,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
+ 	}
+ 
+ 	pte = pte_offset_kernel(pmd, dst_addr);
+-	set_pte(pte, __pte(virt_to_phys((void *)dst) |
+-			 pgprot_val(PAGE_KERNEL_EXEC)));
++	set_pte(pte, pfn_pte(virt_to_pfn(dst), PAGE_KERNEL_EXEC));
+ 
+ 	/*
+ 	 * Load our new page tables. A strict BBM approach requires that we
+diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
+index efd65fc85238..60be5bc0984a 100644
+--- a/arch/arm64/mm/mmu.c
++++ b/arch/arm64/mm/mmu.c
+@@ -28,8 +28,6 @@
+ #include <linux/memblock.h>
+ #include <linux/fs.h>
+ #include <linux/io.h>
+-#include <linux/slab.h>
+-#include <linux/stop_machine.h>
+ 
+ #include <asm/barrier.h>
+ #include <asm/cputype.h>
+@@ -95,6 +93,17 @@ static phys_addr_t __init early_pgtable_alloc(void)
+ 	return phys;
+ }
+ 
++static bool pgattr_change_is_safe(u64 old, u64 new)
++{
++	/*
++	 * The following mapping attributes may be updated in live
++	 * kernel mappings without the need for break-before-make.
++	 */
++	static const pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE;
++
++	return old  == 0 || new  == 0 || ((old ^ new) & ~mask) == 0;
++}
++
+ static void alloc_init_pte(pmd_t *pmd, unsigned long addr,
+ 				  unsigned long end, unsigned long pfn,
+ 				  pgprot_t prot,
+@@ -115,8 +124,17 @@ static void alloc_init_pte(pmd_t *pmd, unsigned long addr,
+ 
+ 	pte = pte_set_fixmap_offset(pmd, addr);
+ 	do {
++		pte_t old_pte = *pte;
++
+ 		set_pte(pte, pfn_pte(pfn, prot));
+ 		pfn++;
++
++		/*
++		 * After the PTE entry has been populated once, we
++		 * only allow updates to the permission attributes.
++		 */
++		BUG_ON(!pgattr_change_is_safe(pte_val(old_pte), pte_val(*pte)));
++
+ 	} while (pte++, addr += PAGE_SIZE, addr != end);
+ 
+ 	pte_clear_fixmap();
+@@ -146,27 +164,27 @@ static void alloc_init_pmd(pud_t *pud, unsigned long addr, unsigned long end,
+ 
+ 	pmd = pmd_set_fixmap_offset(pud, addr);
+ 	do {
++		pmd_t old_pmd = *pmd;
++
+ 		next = pmd_addr_end(addr, end);
++
+ 		/* try section mapping first */
+ 		if (((addr | next | phys) & ~SECTION_MASK) == 0 &&
+ 		      allow_block_mappings) {
+-			pmd_t old_pmd =*pmd;
+ 			pmd_set_huge(pmd, phys, prot);
++
+ 			/*
+-			 * Check for previous table entries created during
+-			 * boot (__create_page_tables) and flush them.
++			 * After the PMD entry has been populated once, we
++			 * only allow updates to the permission attributes.
+ 			 */
+-			if (!pmd_none(old_pmd)) {
+-				flush_tlb_all();
+-				if (pmd_table(old_pmd)) {
+-					phys_addr_t table = pmd_page_paddr(old_pmd);
+-					if (!WARN_ON_ONCE(slab_is_available()))
+-						memblock_free(table, PAGE_SIZE);
+-				}
+-			}
++			BUG_ON(!pgattr_change_is_safe(pmd_val(old_pmd),
++						      pmd_val(*pmd)));
+ 		} else {
+ 			alloc_init_pte(pmd, addr, next, __phys_to_pfn(phys),
+ 				       prot, pgtable_alloc);
++
++			BUG_ON(pmd_val(old_pmd) != 0 &&
++			       pmd_val(old_pmd) != pmd_val(*pmd));
+ 		}
+ 		phys += next - addr;
+ 	} while (pmd++, addr = next, addr != end);
+@@ -204,33 +222,28 @@ static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
+ 
+ 	pud = pud_set_fixmap_offset(pgd, addr);
+ 	do {
++		pud_t old_pud = *pud;
++
+ 		next = pud_addr_end(addr, end);
+ 
+ 		/*
+ 		 * For 4K granule only, attempt to put down a 1GB block
+ 		 */
+ 		if (use_1G_block(addr, next, phys) && allow_block_mappings) {
+-			pud_t old_pud = *pud;
+ 			pud_set_huge(pud, phys, prot);
+ 
+ 			/*
+-			 * If we have an old value for a pud, it will
+-			 * be pointing to a pmd table that we no longer
+-			 * need (from swapper_pg_dir).
+-			 *
+-			 * Look up the old pmd table and free it.
++			 * After the PUD entry has been populated once, we
++			 * only allow updates to the permission attributes.
+ 			 */
+-			if (!pud_none(old_pud)) {
+-				flush_tlb_all();
+-				if (pud_table(old_pud)) {
+-					phys_addr_t table = pud_page_paddr(old_pud);
+-					if (!WARN_ON_ONCE(slab_is_available()))
+-						memblock_free(table, PAGE_SIZE);
+-				}
+-			}
++			BUG_ON(!pgattr_change_is_safe(pud_val(old_pud),
++						      pud_val(*pud)));
+ 		} else {
+ 			alloc_init_pmd(pud, addr, next, phys, prot,
+ 				       pgtable_alloc, allow_block_mappings);
++
++			BUG_ON(pud_val(old_pud) != 0 &&
++			       pud_val(old_pud) != pud_val(*pud));
+ 		}
+ 		phys += next - addr;
+ 	} while (pud++, addr = next, addr != end);
+@@ -396,6 +409,9 @@ void mark_rodata_ro(void)
+ 	section_size = (unsigned long)__init_begin - (unsigned long)__start_rodata;
+ 	create_mapping_late(__pa(__start_rodata), (unsigned long)__start_rodata,
+ 			    section_size, PAGE_KERNEL_RO);
++
++	/* flush the TLBs after updating live kernel mappings */
++	flush_tlb_all();
+ }
+ 
+ static void __init map_kernel_segment(pgd_t *pgd, void *va_start, void *va_end,
+@@ -479,8 +495,8 @@ static void __init map_kernel(pgd_t *pgd)
+ 		 * entry instead.
+ 		 */
+ 		BUG_ON(!IS_ENABLED(CONFIG_ARM64_16K_PAGES));
+-		set_pud(pud_set_fixmap_offset(pgd, FIXADDR_START),
+-			__pud(__pa(bm_pmd) | PUD_TYPE_TABLE));
++		pud_populate(&init_mm, pud_set_fixmap_offset(pgd, FIXADDR_START),
++			     lm_alias(bm_pmd));
+ 		pud_clear_fixmap();
+ 	} else {
+ 		BUG();
+@@ -595,7 +611,7 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node)
+ 			if (!p)
+ 				return -ENOMEM;
+ 
+-			set_pmd(pmd, __pmd(__pa(p) | PROT_SECT_NORMAL));
++			pmd_set_huge(pmd, __pa(p), __pgprot(PROT_SECT_NORMAL));
+ 		} else
+ 			vmemmap_verify((pte_t *)pmd, node, addr, next);
+ 	} while (addr = next, addr != end);
+@@ -779,17 +795,35 @@ int __init arch_ioremap_pmd_supported(void)
+ 	return !IS_ENABLED(CONFIG_ARM64_PTDUMP_DEBUGFS);
+ }
+ 
+-int pud_set_huge(pud_t *pud, phys_addr_t phys, pgprot_t prot)
++int pud_set_huge(pud_t *pudp, phys_addr_t phys, pgprot_t prot)
+ {
++	pgprot_t sect_prot = __pgprot(PUD_TYPE_SECT |
++					pgprot_val(mk_sect_prot(prot)));
++	pud_t new_pud = pfn_pud(__phys_to_pfn(phys), sect_prot);
++
++	/* Only allow permission changes for now */
++	if (!pgattr_change_is_safe(READ_ONCE(pud_val(*pudp)),
++				   pud_val(new_pud)))
++		return 0;
++
+ 	BUG_ON(phys & ~PUD_MASK);
+-	set_pud(pud, __pud(phys | PUD_TYPE_SECT | pgprot_val(mk_sect_prot(prot))));
++	set_pud(pudp, new_pud);
+ 	return 1;
+ }
+ 
+-int pmd_set_huge(pmd_t *pmd, phys_addr_t phys, pgprot_t prot)
++int pmd_set_huge(pmd_t *pmdp, phys_addr_t phys, pgprot_t prot)
+ {
++	pgprot_t sect_prot = __pgprot(PMD_TYPE_SECT |
++					pgprot_val(mk_sect_prot(prot)));
++	pmd_t new_pmd = pfn_pmd(__phys_to_pfn(phys), sect_prot);
++
++	/* Only allow permission changes for now */
++	if (!pgattr_change_is_safe(READ_ONCE(pmd_val(*pmdp)),
++				   pmd_val(new_pmd)))
++		return 0;
++
+ 	BUG_ON(phys & ~PMD_MASK);
+-	set_pmd(pmd, __pmd(phys | PMD_TYPE_SECT | pgprot_val(mk_sect_prot(prot))));
++	set_pmd(pmdp, new_pmd);
+ 	return 1;
+ }
+ 
+diff --git a/arch/hexagon/include/asm/atomic.h b/arch/hexagon/include/asm/atomic.h
+index a62ba368b27d..1ae06190b68f 100644
+--- a/arch/hexagon/include/asm/atomic.h
++++ b/arch/hexagon/include/asm/atomic.h
+@@ -103,7 +103,7 @@ static inline void atomic_##op(int i, atomic_t *v)			\
+ 		"1:	%0 = memw_locked(%1);\n"			\
+ 		"	%0 = "#op "(%0,%2);\n"				\
+ 		"	memw_locked(%1,P3)=%0;\n"			\
+-		"	if !P3 jump 1b;\n"				\
++		"	if (!P3) jump 1b;\n"				\
+ 		: "=&r" (output)					\
+ 		: "r" (&v->counter), "r" (i)				\
+ 		: "memory", "p3"					\
+@@ -119,7 +119,7 @@ static inline int atomic_##op##_return(int i, atomic_t *v)		\
+ 		"1:	%0 = memw_locked(%1);\n"			\
+ 		"	%0 = "#op "(%0,%2);\n"				\
+ 		"	memw_locked(%1,P3)=%0;\n"			\
+-		"	if !P3 jump 1b;\n"				\
++		"	if (!P3) jump 1b;\n"				\
+ 		: "=&r" (output)					\
+ 		: "r" (&v->counter), "r" (i)				\
+ 		: "memory", "p3"					\
+@@ -136,7 +136,7 @@ static inline int atomic_fetch_##op(int i, atomic_t *v)			\
+ 		"1:	%0 = memw_locked(%2);\n"			\
+ 		"	%1 = "#op "(%0,%3);\n"				\
+ 		"	memw_locked(%2,P3)=%1;\n"			\
+-		"	if !P3 jump 1b;\n"				\
++		"	if (!P3) jump 1b;\n"				\
+ 		: "=&r" (output), "=&r" (val)				\
+ 		: "r" (&v->counter), "r" (i)				\
+ 		: "memory", "p3"					\
+@@ -185,7 +185,7 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
+ 		"	}"
+ 		"	memw_locked(%2, p3) = %1;"
+ 		"	{"
+-		"		if !p3 jump 1b;"
++		"		if (!p3) jump 1b;"
+ 		"	}"
+ 		"2:"
+ 		: "=&r" (__oldval), "=&r" (tmp)
+diff --git a/arch/hexagon/include/asm/bitops.h b/arch/hexagon/include/asm/bitops.h
+index 2691a1857d20..634306cda006 100644
+--- a/arch/hexagon/include/asm/bitops.h
++++ b/arch/hexagon/include/asm/bitops.h
+@@ -52,7 +52,7 @@ static inline int test_and_clear_bit(int nr, volatile void *addr)
+ 	"1:	R12 = memw_locked(R10);\n"
+ 	"	{ P0 = tstbit(R12,R11); R12 = clrbit(R12,R11); }\n"
+ 	"	memw_locked(R10,P1) = R12;\n"
+-	"	{if !P1 jump 1b; %0 = mux(P0,#1,#0);}\n"
++	"	{if (!P1) jump 1b; %0 = mux(P0,#1,#0);}\n"
+ 	: "=&r" (oldval)
+ 	: "r" (addr), "r" (nr)
+ 	: "r10", "r11", "r12", "p0", "p1", "memory"
+@@ -76,7 +76,7 @@ static inline int test_and_set_bit(int nr, volatile void *addr)
+ 	"1:	R12 = memw_locked(R10);\n"
+ 	"	{ P0 = tstbit(R12,R11); R12 = setbit(R12,R11); }\n"
+ 	"	memw_locked(R10,P1) = R12;\n"
+-	"	{if !P1 jump 1b; %0 = mux(P0,#1,#0);}\n"
++	"	{if (!P1) jump 1b; %0 = mux(P0,#1,#0);}\n"
+ 	: "=&r" (oldval)
+ 	: "r" (addr), "r" (nr)
+ 	: "r10", "r11", "r12", "p0", "p1", "memory"
+@@ -102,7 +102,7 @@ static inline int test_and_change_bit(int nr, volatile void *addr)
+ 	"1:	R12 = memw_locked(R10);\n"
+ 	"	{ P0 = tstbit(R12,R11); R12 = togglebit(R12,R11); }\n"
+ 	"	memw_locked(R10,P1) = R12;\n"
+-	"	{if !P1 jump 1b; %0 = mux(P0,#1,#0);}\n"
++	"	{if (!P1) jump 1b; %0 = mux(P0,#1,#0);}\n"
+ 	: "=&r" (oldval)
+ 	: "r" (addr), "r" (nr)
+ 	: "r10", "r11", "r12", "p0", "p1", "memory"
+@@ -237,7 +237,7 @@ static inline int ffs(int x)
+ 	int r;
+ 
+ 	asm("{ P0 = cmp.eq(%1,#0); %0 = ct0(%1);}\n"
+-		"{ if P0 %0 = #0; if !P0 %0 = add(%0,#1);}\n"
++		"{ if (P0) %0 = #0; if (!P0) %0 = add(%0,#1);}\n"
+ 		: "=&r" (r)
+ 		: "r" (x)
+ 		: "p0");
+diff --git a/arch/hexagon/include/asm/cmpxchg.h b/arch/hexagon/include/asm/cmpxchg.h
+index a6e34e2acbba..db258424059f 100644
+--- a/arch/hexagon/include/asm/cmpxchg.h
++++ b/arch/hexagon/include/asm/cmpxchg.h
+@@ -44,7 +44,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr,
+ 	__asm__ __volatile__ (
+ 	"1:	%0 = memw_locked(%1);\n"    /*  load into retval */
+ 	"	memw_locked(%1,P0) = %2;\n" /*  store into memory */
+-	"	if !P0 jump 1b;\n"
++	"	if (!P0) jump 1b;\n"
+ 	: "=&r" (retval)
+ 	: "r" (ptr), "r" (x)
+ 	: "memory", "p0"
+diff --git a/arch/hexagon/include/asm/futex.h b/arch/hexagon/include/asm/futex.h
+index c607b77c8215..12bd92f3ea41 100644
+--- a/arch/hexagon/include/asm/futex.h
++++ b/arch/hexagon/include/asm/futex.h
+@@ -15,7 +15,7 @@
+ 	    /* For example: %1 = %4 */ \
+ 	    insn \
+ 	"2: memw_locked(%3,p2) = %1;\n" \
+-	"   if !p2 jump 1b;\n" \
++	"   if (!p2) jump 1b;\n" \
+ 	"   %1 = #0;\n" \
+ 	"3:\n" \
+ 	".section .fixup,\"ax\"\n" \
+@@ -83,10 +83,10 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, u32 oldval,
+ 	"1: %1 = memw_locked(%3)\n"
+ 	"   {\n"
+ 	"      p2 = cmp.eq(%1,%4)\n"
+-	"      if !p2.new jump:NT 3f\n"
++	"      if (!p2.new) jump:NT 3f\n"
+ 	"   }\n"
+ 	"2: memw_locked(%3,p2) = %5\n"
+-	"   if !p2 jump 1b\n"
++	"   if (!p2) jump 1b\n"
+ 	"3:\n"
+ 	".section .fixup,\"ax\"\n"
+ 	"4: %0 = #%6\n"
+diff --git a/arch/hexagon/include/asm/spinlock.h b/arch/hexagon/include/asm/spinlock.h
+index a1c55788c5d6..f61bb3185305 100644
+--- a/arch/hexagon/include/asm/spinlock.h
++++ b/arch/hexagon/include/asm/spinlock.h
+@@ -44,9 +44,9 @@ static inline void arch_read_lock(arch_rwlock_t *lock)
+ 	__asm__ __volatile__(
+ 		"1:	R6 = memw_locked(%0);\n"
+ 		"	{ P3 = cmp.ge(R6,#0); R6 = add(R6,#1);}\n"
+-		"	{ if !P3 jump 1b; }\n"
++		"	{ if (!P3) jump 1b; }\n"
+ 		"	memw_locked(%0,P3) = R6;\n"
+-		"	{ if !P3 jump 1b; }\n"
++		"	{ if (!P3) jump 1b; }\n"
+ 		:
+ 		: "r" (&lock->lock)
+ 		: "memory", "r6", "p3"
+@@ -60,7 +60,7 @@ static inline void arch_read_unlock(arch_rwlock_t *lock)
+ 		"1:	R6 = memw_locked(%0);\n"
+ 		"	R6 = add(R6,#-1);\n"
+ 		"	memw_locked(%0,P3) = R6\n"
+-		"	if !P3 jump 1b;\n"
++		"	if (!P3) jump 1b;\n"
+ 		:
+ 		: "r" (&lock->lock)
+ 		: "memory", "r6", "p3"
+@@ -75,7 +75,7 @@ static inline int arch_read_trylock(arch_rwlock_t *lock)
+ 	__asm__ __volatile__(
+ 		"	R6 = memw_locked(%1);\n"
+ 		"	{ %0 = #0; P3 = cmp.ge(R6,#0); R6 = add(R6,#1);}\n"
+-		"	{ if !P3 jump 1f; }\n"
++		"	{ if (!P3) jump 1f; }\n"
+ 		"	memw_locked(%1,P3) = R6;\n"
+ 		"	{ %0 = P3 }\n"
+ 		"1:\n"
+@@ -102,9 +102,9 @@ static inline void arch_write_lock(arch_rwlock_t *lock)
+ 	__asm__ __volatile__(
+ 		"1:	R6 = memw_locked(%0)\n"
+ 		"	{ P3 = cmp.eq(R6,#0);  R6 = #-1;}\n"
+-		"	{ if !P3 jump 1b; }\n"
++		"	{ if (!P3) jump 1b; }\n"
+ 		"	memw_locked(%0,P3) = R6;\n"
+-		"	{ if !P3 jump 1b; }\n"
++		"	{ if (!P3) jump 1b; }\n"
+ 		:
+ 		: "r" (&lock->lock)
+ 		: "memory", "r6", "p3"
+@@ -118,7 +118,7 @@ static inline int arch_write_trylock(arch_rwlock_t *lock)
+ 	__asm__ __volatile__(
+ 		"	R6 = memw_locked(%1)\n"
+ 		"	{ %0 = #0; P3 = cmp.eq(R6,#0);  R6 = #-1;}\n"
+-		"	{ if !P3 jump 1f; }\n"
++		"	{ if (!P3) jump 1f; }\n"
+ 		"	memw_locked(%1,P3) = R6;\n"
+ 		"	%0 = P3;\n"
+ 		"1:\n"
+@@ -141,9 +141,9 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
+ 	__asm__ __volatile__(
+ 		"1:	R6 = memw_locked(%0);\n"
+ 		"	P3 = cmp.eq(R6,#0);\n"
+-		"	{ if !P3 jump 1b; R6 = #1; }\n"
++		"	{ if (!P3) jump 1b; R6 = #1; }\n"
+ 		"	memw_locked(%0,P3) = R6;\n"
+-		"	{ if !P3 jump 1b; }\n"
++		"	{ if (!P3) jump 1b; }\n"
+ 		:
+ 		: "r" (&lock->lock)
+ 		: "memory", "r6", "p3"
+@@ -163,7 +163,7 @@ static inline unsigned int arch_spin_trylock(arch_spinlock_t *lock)
+ 	__asm__ __volatile__(
+ 		"	R6 = memw_locked(%1);\n"
+ 		"	P3 = cmp.eq(R6,#0);\n"
+-		"	{ if !P3 jump 1f; R6 = #1; %0 = #0; }\n"
++		"	{ if (!P3) jump 1f; R6 = #1; %0 = #0; }\n"
+ 		"	memw_locked(%1,P3) = R6;\n"
+ 		"	%0 = P3;\n"
+ 		"1:\n"
+diff --git a/arch/hexagon/kernel/stacktrace.c b/arch/hexagon/kernel/stacktrace.c
+index f94918b449a8..03a0e10ecdcc 100644
+--- a/arch/hexagon/kernel/stacktrace.c
++++ b/arch/hexagon/kernel/stacktrace.c
+@@ -23,8 +23,6 @@
+ #include <linux/thread_info.h>
+ #include <linux/module.h>
+ 
+-register unsigned long current_frame_pointer asm("r30");
+-
+ struct stackframe {
+ 	unsigned long fp;
+ 	unsigned long rets;
+@@ -42,7 +40,7 @@ void save_stack_trace(struct stack_trace *trace)
+ 
+ 	low = (unsigned long)task_stack_page(current);
+ 	high = low + THREAD_SIZE;
+-	fp = current_frame_pointer;
++	fp = (unsigned long)__builtin_frame_address(0);
+ 
+ 	while (fp >= low && fp <= (high - sizeof(*frame))) {
+ 		frame = (struct stackframe *)fp;
+diff --git a/arch/hexagon/kernel/vm_entry.S b/arch/hexagon/kernel/vm_entry.S
+index 67c6ccc14770..9f4a73ff7203 100644
+--- a/arch/hexagon/kernel/vm_entry.S
++++ b/arch/hexagon/kernel/vm_entry.S
+@@ -382,7 +382,7 @@ ret_from_fork:
+ 		R26.L = #LO(do_work_pending);
+ 		R0 = #VM_INT_DISABLE;
+ 	}
+-	if P0 jump check_work_pending
++	if (P0) jump check_work_pending
+ 	{
+ 		R0 = R25;
+ 		callr R24
+diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile
+index ad31c76c7a29..2f77e250b91d 100644
+--- a/arch/mips/boot/compressed/Makefile
++++ b/arch/mips/boot/compressed/Makefile
+@@ -29,6 +29,9 @@ KBUILD_AFLAGS := $(LINUXINCLUDE) $(KBUILD_AFLAGS) -D__ASSEMBLY__ \
+ 	-DBOOT_HEAP_SIZE=$(BOOT_HEAP_SIZE) \
+ 	-DKERNEL_ENTRY=$(VMLINUX_ENTRY_ADDRESS)
+ 
++# Prevents link failures: __sanitizer_cov_trace_pc() is not linked in.
++KCOV_INSTRUMENT		:= n
++
+ # decompressor objects (linked with vmlinuz)
+ vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o
+ 
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index 98cc8ba07c23..00dbf1e895a9 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -923,6 +923,23 @@ void __init pnv_pci_init(void)
+ 	if (!firmware_has_feature(FW_FEATURE_OPAL))
+ 		return;
+ 
++#ifdef CONFIG_PCIEPORTBUS
++	/*
++	 * On PowerNV PCIe devices are (currently) managed in cooperation
++	 * with firmware. This isn't *strictly* required, but there's enough
++	 * assumptions baked into both firmware and the platform code that
++	 * it's unwise to allow the portbus services to be used.
++	 *
++	 * We need to fix this eventually, but for now set this flag to disable
++	 * the portbus driver. The AER service isn't required since that AER
++	 * events are handled via EEH. The pciehp hotplug driver can't work
++	 * without kernel changes (and portbus binding breaks pnv_php). The
++	 * other services also require some thinking about how we're going
++	 * to integrate them.
++	 */
++	pcie_ports_disabled = true;
++#endif
++
+ 	/* Look for IODA IO-Hubs. */
+ 	for_each_compatible_node(np, NULL, "ibm,ioda-hub") {
+ 		pnv_pci_init_ioda_hub(np);
+diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
+index efdfba21a5b2..9e3a183561a9 100644
+--- a/arch/x86/boot/compressed/head_64.S
++++ b/arch/x86/boot/compressed/head_64.S
+@@ -227,6 +227,11 @@ ENTRY(efi32_stub_entry)
+ 	leal	efi32_config(%ebp), %eax
+ 	movl	%eax, efi_config(%ebp)
+ 
++	/* Disable paging */
++	movl	%cr0, %eax
++	btrl	$X86_CR0_PG_BIT, %eax
++	movl	%eax, %cr0
++
+ 	jmp	startup_32
+ ENDPROC(efi32_stub_entry)
+ #endif
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index f679ae122843..0d644f37e3c6 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -349,7 +349,7 @@ EXPORT_SYMBOL(blk_queue_max_segment_size);
+  *   storage device can address.  The default of 512 covers most
+  *   hardware.
+  **/
+-void blk_queue_logical_block_size(struct request_queue *q, unsigned short size)
++void blk_queue_logical_block_size(struct request_queue *q, unsigned int size)
+ {
+ 	q->limits.logical_block_size = size;
+ 
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index c08ee8cf1e29..6ee3e928ebf1 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1104,8 +1104,8 @@ static int xlvbd_alloc_gendisk(blkif_sector_t capacity,
+ 	if (!VDEV_IS_EXTENDED(info->vdevice)) {
+ 		err = xen_translate_vdev(info->vdevice, &minor, &offset);
+ 		if (err)
+-			return err;		
+- 		nr_parts = PARTS_PER_DISK;
++			return err;
++		nr_parts = PARTS_PER_DISK;
+ 	} else {
+ 		minor = BLKIF_MINOR_EXT(info->vdevice);
+ 		nr_parts = PARTS_PER_EXT_DISK;
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index c745dad7f85e..af4f2ffc4fc5 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -2448,11 +2448,17 @@ static int __clk_core_init(struct clk_core *core)
+ 	if (core->flags & CLK_IS_CRITICAL) {
+ 		unsigned long flags;
+ 
+-		clk_core_prepare(core);
++		ret = clk_core_prepare(core);
++		if (ret)
++			goto out;
+ 
+ 		flags = clk_enable_lock();
+-		clk_core_enable(core);
++		ret = clk_core_enable(core);
+ 		clk_enable_unlock(flags);
++		if (ret) {
++			clk_core_unprepare(core);
++			goto out;
++		}
+ 	}
+ 
+ 	/*
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index 2bb88d125113..7f8c7cf3c2ab 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -170,6 +170,8 @@ static const unsigned long exynos5x_clk_regs[] __initconst = {
+ 	GATE_BUS_CPU,
+ 	GATE_SCLK_CPU,
+ 	CLKOUT_CMU_CPU,
++	APLL_CON0,
++	KPLL_CON0,
+ 	CPLL_CON0,
+ 	DPLL_CON0,
+ 	EPLL_CON0,
+diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
+index 49386ce04bf5..1389f0582e29 100644
+--- a/drivers/dma/ioat/dma.c
++++ b/drivers/dma/ioat/dma.c
+@@ -394,10 +394,11 @@ ioat_alloc_ring(struct dma_chan *c, int order, gfp_t flags)
+ 
+ 		descs->virt = dma_alloc_coherent(to_dev(ioat_chan),
+ 						 SZ_2M, &descs->hw, flags);
+-		if (!descs->virt && (i > 0)) {
++		if (!descs->virt) {
+ 			int idx;
+ 
+ 			for (idx = 0; idx < i; idx++) {
++				descs = &ioat_chan->descs[idx];
+ 				dma_free_coherent(to_dev(ioat_chan), SZ_2M,
+ 						  descs->virt, descs->hw);
+ 				descs->virt = NULL;
+diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
+index bd777687233b..b67f61d31e25 100644
+--- a/drivers/gpio/gpio-mpc8xxx.c
++++ b/drivers/gpio/gpio-mpc8xxx.c
+@@ -306,6 +306,7 @@ static int mpc8xxx_probe(struct platform_device *pdev)
+ 		return -ENOMEM;
+ 
+ 	gc = &mpc8xxx_gc->gc;
++	gc->parent = &pdev->dev;
+ 
+ 	if (of_property_read_bool(np, "little-endian")) {
+ 		ret = bgpio_init(gc, &pdev->dev, 4,
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 58193c939691..505dead07619 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -3049,8 +3049,9 @@ static struct gpio_desc *gpiod_find(struct device *dev, const char *con_id,
+ 
+ 		if (chip->ngpio <= p->chip_hwnum) {
+ 			dev_err(dev,
+-				"requested GPIO %d is out of range [0..%d] for chip %s\n",
+-				idx, chip->ngpio, chip->label);
++				"requested GPIO %u (%u) is out of range [0..%u] for chip %s\n",
++				idx, p->chip_hwnum, chip->ngpio - 1,
++				chip->label);
+ 			return ERR_PTR(-EINVAL);
+ 		}
+ 
+diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
+index 750c16897130..ed6591f92f71 100644
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -257,13 +257,14 @@ out:
+ static unsigned int hidraw_poll(struct file *file, poll_table *wait)
+ {
+ 	struct hidraw_list *list = file->private_data;
++	unsigned int mask = POLLOUT | POLLWRNORM; /* hidraw is always writable */
+ 
+ 	poll_wait(file, &list->hidraw->wait, wait);
+ 	if (list->head != list->tail)
+-		return POLLIN | POLLRDNORM;
++		mask |= POLLIN | POLLRDNORM;
+ 	if (!list->hidraw->exist)
+-		return POLLERR | POLLHUP;
+-	return 0;
++		mask |= POLLERR | POLLHUP;
++	return mask;
+ }
+ 
+ static int hidraw_open(struct inode *inode, struct file *file)
+diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
+index d9b46da0e0aa..731a7b3e0187 100644
+--- a/drivers/hid/uhid.c
++++ b/drivers/hid/uhid.c
+@@ -769,13 +769,14 @@ unlock:
+ static unsigned int uhid_char_poll(struct file *file, poll_table *wait)
+ {
+ 	struct uhid_device *uhid = file->private_data;
++	unsigned int mask = POLLOUT | POLLWRNORM; /* uhid is always writable */
+ 
+ 	poll_wait(file, &uhid->waitq, wait);
+ 
+ 	if (uhid->head != uhid->tail)
+-		return POLLIN | POLLRDNORM;
++		mask |= POLLIN | POLLRDNORM;
+ 
+-	return EPOLLOUT | EPOLLWRNORM;
++	return mask;
+ }
+ 
+ static const struct file_operations uhid_fops = {
+diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
+index c950aa10d0ae..5abe095901c8 100644
+--- a/drivers/iio/imu/adis16480.c
++++ b/drivers/iio/imu/adis16480.c
+@@ -372,12 +372,14 @@ static int adis16480_get_calibbias(struct iio_dev *indio_dev,
+ 	case IIO_MAGN:
+ 	case IIO_PRESSURE:
+ 		ret = adis_read_reg_16(&st->adis, reg, &val16);
+-		*bias = sign_extend32(val16, 15);
++		if (ret == 0)
++			*bias = sign_extend32(val16, 15);
+ 		break;
+ 	case IIO_ANGL_VEL:
+ 	case IIO_ACCEL:
+ 		ret = adis_read_reg_32(&st->adis, reg, &val32);
+-		*bias = sign_extend32(val32, 31);
++		if (ret == 0)
++			*bias = sign_extend32(val32, 31);
+ 		break;
+ 	default:
+ 			ret = -EINVAL;
+diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
+index 5d05c38c4ba9..2f037cd59d53 100644
+--- a/drivers/iio/industrialio-buffer.c
++++ b/drivers/iio/industrialio-buffer.c
+@@ -546,7 +546,7 @@ static int iio_compute_scan_bytes(struct iio_dev *indio_dev,
+ 				const unsigned long *mask, bool timestamp)
+ {
+ 	unsigned bytes = 0;
+-	int length, i;
++	int length, i, largest = 0;
+ 
+ 	/* How much space will the demuxed element take? */
+ 	for_each_set_bit(i, mask,
+@@ -554,13 +554,17 @@ static int iio_compute_scan_bytes(struct iio_dev *indio_dev,
+ 		length = iio_storage_bytes_for_si(indio_dev, i);
+ 		bytes = ALIGN(bytes, length);
+ 		bytes += length;
++		largest = max(largest, length);
+ 	}
+ 
+ 	if (timestamp) {
+ 		length = iio_storage_bytes_for_timestamp(indio_dev);
+ 		bytes = ALIGN(bytes, length);
+ 		bytes += length;
++		largest = max(largest, length);
+ 	}
++
++	bytes = ALIGN(bytes, largest);
+ 	return bytes;
+ }
+ 
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index 6914cc18b4a1..8acf337c3691 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -1234,9 +1234,11 @@ static int srpt_build_cmd_rsp(struct srpt_rdma_ch *ch,
+ 			      struct srpt_send_ioctx *ioctx, u64 tag,
+ 			      int status)
+ {
++	struct se_cmd *cmd = &ioctx->cmd;
+ 	struct srp_rsp *srp_rsp;
+ 	const u8 *sense_data;
+ 	int sense_data_len, max_sense_len;
++	u32 resid = cmd->residual_count;
+ 
+ 	/*
+ 	 * The lowest bit of all SAM-3 status codes is zero (see also
+@@ -1258,6 +1260,28 @@ static int srpt_build_cmd_rsp(struct srpt_rdma_ch *ch,
+ 	srp_rsp->tag = tag;
+ 	srp_rsp->status = status;
+ 
++	if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) {
++		if (cmd->data_direction == DMA_TO_DEVICE) {
++			/* residual data from an underflow write */
++			srp_rsp->flags = SRP_RSP_FLAG_DOUNDER;
++			srp_rsp->data_out_res_cnt = cpu_to_be32(resid);
++		} else if (cmd->data_direction == DMA_FROM_DEVICE) {
++			/* residual data from an underflow read */
++			srp_rsp->flags = SRP_RSP_FLAG_DIUNDER;
++			srp_rsp->data_in_res_cnt = cpu_to_be32(resid);
++		}
++	} else if (cmd->se_cmd_flags & SCF_OVERFLOW_BIT) {
++		if (cmd->data_direction == DMA_TO_DEVICE) {
++			/* residual data from an overflow write */
++			srp_rsp->flags = SRP_RSP_FLAG_DOOVER;
++			srp_rsp->data_out_res_cnt = cpu_to_be32(resid);
++		} else if (cmd->data_direction == DMA_FROM_DEVICE) {
++			/* residual data from an overflow read */
++			srp_rsp->flags = SRP_RSP_FLAG_DIOVER;
++			srp_rsp->data_in_res_cnt = cpu_to_be32(resid);
++		}
++	}
++
+ 	if (sense_data_len) {
+ 		BUILD_BUG_ON(MIN_MAX_RSP_SIZE <= sizeof(*srp_rsp));
+ 		max_sense_len = ch->max_ti_iu_len - sizeof(*srp_rsp);
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 87d3060f8609..71b89e47e952 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -439,6 +439,7 @@ err_put_group:
+ 	mutex_unlock(&group->mutex);
+ 	dev->iommu_group = NULL;
+ 	kobject_put(group->devices_kobj);
++	sysfs_remove_link(group->devices_kobj, device->name);
+ err_free_name:
+ 	kfree(device->name);
+ err_remove_link:
+diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
+index b8cf956b577b..771ec28e87cb 100644
+--- a/drivers/md/dm-snap-persistent.c
++++ b/drivers/md/dm-snap-persistent.c
+@@ -17,7 +17,7 @@
+ #include "dm-bufio.h"
+ 
+ #define DM_MSG_PREFIX "persistent snapshot"
+-#define DM_CHUNK_SIZE_DEFAULT_SECTORS 32	/* 16KB */
++#define DM_CHUNK_SIZE_DEFAULT_SECTORS 32U	/* 16KB */
+ 
+ #define DM_PREFETCH_CHUNKS		12
+ 
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index 258986a2699d..cf745211799f 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -82,7 +82,7 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
+ 	char b[BDEVNAME_SIZE];
+ 	char b2[BDEVNAME_SIZE];
+ 	struct r0conf *conf = kzalloc(sizeof(*conf), GFP_KERNEL);
+-	unsigned short blksize = 512;
++	unsigned blksize = 512;
+ 
+ 	*private_conf = ERR_PTR(-ENOMEM);
+ 	if (!conf)
+diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.c b/drivers/media/platform/exynos4-is/fimc-isp-video.c
+index e00fa03ddc3e..0c0eec671d49 100644
+--- a/drivers/media/platform/exynos4-is/fimc-isp-video.c
++++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c
+@@ -316,7 +316,7 @@ static int isp_video_release(struct file *file)
+ 		ivc->streaming = 0;
+ 	}
+ 
+-	vb2_fop_release(file);
++	_vb2_fop_release(file, NULL);
+ 
+ 	if (v4l2_fh_is_singular_file(file)) {
+ 		fimc_pipeline_call(&ivc->ve, close);
+diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364xx/zr364xx.c
+index e3735bfcc02f..c5513f55e64e 100644
+--- a/drivers/media/usb/zr364xx/zr364xx.c
++++ b/drivers/media/usb/zr364xx/zr364xx.c
+@@ -711,7 +711,8 @@ static int zr364xx_vidioc_querycap(struct file *file, void *priv,
+ 	struct zr364xx_camera *cam = video_drvdata(file);
+ 
+ 	strlcpy(cap->driver, DRIVER_DESC, sizeof(cap->driver));
+-	strlcpy(cap->card, cam->udev->product, sizeof(cap->card));
++	if (cam->udev->product)
++		strlcpy(cap->card, cam->udev->product, sizeof(cap->card));
+ 	strlcpy(cap->bus_info, dev_name(&cam->udev->dev),
+ 		sizeof(cap->bus_info));
+ 	cap->device_caps = V4L2_CAP_VIDEO_CAPTURE |
+diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
+index 14cf6dfc3b14..4d837bcad5db 100644
+--- a/drivers/message/fusion/mptctl.c
++++ b/drivers/message/fusion/mptctl.c
+@@ -100,19 +100,19 @@ struct buflist {
+  * Function prototypes. Called from OS entry point mptctl_ioctl.
+  * arg contents specific to function.
+  */
+-static int mptctl_fw_download(unsigned long arg);
+-static int mptctl_getiocinfo(unsigned long arg, unsigned int cmd);
+-static int mptctl_gettargetinfo(unsigned long arg);
+-static int mptctl_readtest(unsigned long arg);
+-static int mptctl_mpt_command(unsigned long arg);
+-static int mptctl_eventquery(unsigned long arg);
+-static int mptctl_eventenable(unsigned long arg);
+-static int mptctl_eventreport(unsigned long arg);
+-static int mptctl_replace_fw(unsigned long arg);
+-
+-static int mptctl_do_reset(unsigned long arg);
+-static int mptctl_hp_hostinfo(unsigned long arg, unsigned int cmd);
+-static int mptctl_hp_targetinfo(unsigned long arg);
++static int mptctl_fw_download(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_getiocinfo(MPT_ADAPTER *iocp, unsigned long arg, unsigned int cmd);
++static int mptctl_gettargetinfo(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_readtest(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_mpt_command(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_eventquery(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_eventenable(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_eventreport(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_replace_fw(MPT_ADAPTER *iocp, unsigned long arg);
++
++static int mptctl_do_reset(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_hp_hostinfo(MPT_ADAPTER *iocp, unsigned long arg, unsigned int cmd);
++static int mptctl_hp_targetinfo(MPT_ADAPTER *iocp, unsigned long arg);
+ 
+ static int  mptctl_probe(struct pci_dev *, const struct pci_device_id *);
+ static void mptctl_remove(struct pci_dev *);
+@@ -123,8 +123,8 @@ static long compat_mpctl_ioctl(struct file *f, unsigned cmd, unsigned long arg);
+ /*
+  * Private function calls.
+  */
+-static int mptctl_do_mpt_command(struct mpt_ioctl_command karg, void __user *mfPtr);
+-static int mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen);
++static int mptctl_do_mpt_command(MPT_ADAPTER *iocp, struct mpt_ioctl_command karg, void __user *mfPtr);
++static int mptctl_do_fw_download(MPT_ADAPTER *iocp, char __user *ufwbuf, size_t fwlen);
+ static MptSge_t *kbuf_alloc_2_sgl(int bytes, u32 dir, int sge_offset, int *frags,
+ 		struct buflist **blp, dma_addr_t *sglbuf_dma, MPT_ADAPTER *ioc);
+ static void kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma,
+@@ -656,19 +656,19 @@ __mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 	 * by TM and FW reloads.
+ 	 */
+ 	if ((cmd & ~IOCSIZE_MASK) == (MPTIOCINFO & ~IOCSIZE_MASK)) {
+-		return mptctl_getiocinfo(arg, _IOC_SIZE(cmd));
++		return mptctl_getiocinfo(iocp, arg, _IOC_SIZE(cmd));
+ 	} else if (cmd == MPTTARGETINFO) {
+-		return mptctl_gettargetinfo(arg);
++		return mptctl_gettargetinfo(iocp, arg);
+ 	} else if (cmd == MPTTEST) {
+-		return mptctl_readtest(arg);
++		return mptctl_readtest(iocp, arg);
+ 	} else if (cmd == MPTEVENTQUERY) {
+-		return mptctl_eventquery(arg);
++		return mptctl_eventquery(iocp, arg);
+ 	} else if (cmd == MPTEVENTENABLE) {
+-		return mptctl_eventenable(arg);
++		return mptctl_eventenable(iocp, arg);
+ 	} else if (cmd == MPTEVENTREPORT) {
+-		return mptctl_eventreport(arg);
++		return mptctl_eventreport(iocp, arg);
+ 	} else if (cmd == MPTFWREPLACE) {
+-		return mptctl_replace_fw(arg);
++		return mptctl_replace_fw(iocp, arg);
+ 	}
+ 
+ 	/* All of these commands require an interrupt or
+@@ -678,15 +678,15 @@ __mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 		return ret;
+ 
+ 	if (cmd == MPTFWDOWNLOAD)
+-		ret = mptctl_fw_download(arg);
++		ret = mptctl_fw_download(iocp, arg);
+ 	else if (cmd == MPTCOMMAND)
+-		ret = mptctl_mpt_command(arg);
++		ret = mptctl_mpt_command(iocp, arg);
+ 	else if (cmd == MPTHARDRESET)
+-		ret = mptctl_do_reset(arg);
++		ret = mptctl_do_reset(iocp, arg);
+ 	else if ((cmd & ~IOCSIZE_MASK) == (HP_GETHOSTINFO & ~IOCSIZE_MASK))
+-		ret = mptctl_hp_hostinfo(arg, _IOC_SIZE(cmd));
++		ret = mptctl_hp_hostinfo(iocp, arg, _IOC_SIZE(cmd));
+ 	else if (cmd == HP_GETTARGETINFO)
+-		ret = mptctl_hp_targetinfo(arg);
++		ret = mptctl_hp_targetinfo(iocp, arg);
+ 	else
+ 		ret = -EINVAL;
+ 
+@@ -705,11 +705,10 @@ mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 	return ret;
+ }
+ 
+-static int mptctl_do_reset(unsigned long arg)
++static int mptctl_do_reset(MPT_ADAPTER *iocp, unsigned long arg)
+ {
+ 	struct mpt_ioctl_diag_reset __user *urinfo = (void __user *) arg;
+ 	struct mpt_ioctl_diag_reset krinfo;
+-	MPT_ADAPTER		*iocp;
+ 
+ 	if (copy_from_user(&krinfo, urinfo, sizeof(struct mpt_ioctl_diag_reset))) {
+ 		printk(KERN_ERR MYNAM "%s@%d::mptctl_do_reset - "
+@@ -718,12 +717,6 @@ static int mptctl_do_reset(unsigned long arg)
+ 		return -EFAULT;
+ 	}
+ 
+-	if (mpt_verify_adapter(krinfo.hdr.iocnum, &iocp) < 0) {
+-		printk(KERN_DEBUG MYNAM "%s@%d::mptctl_do_reset - ioc%d not found!\n",
+-				__FILE__, __LINE__, krinfo.hdr.iocnum);
+-		return -ENODEV; /* (-6) No such device or address */
+-	}
+-
+ 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "mptctl_do_reset called.\n",
+ 	    iocp->name));
+ 
+@@ -754,7 +747,7 @@ static int mptctl_do_reset(unsigned long arg)
+  *		-ENOMSG if FW upload returned bad status
+  */
+ static int
+-mptctl_fw_download(unsigned long arg)
++mptctl_fw_download(MPT_ADAPTER *iocp, unsigned long arg)
+ {
+ 	struct mpt_fw_xfer __user *ufwdl = (void __user *) arg;
+ 	struct mpt_fw_xfer	 kfwdl;
+@@ -766,7 +759,7 @@ mptctl_fw_download(unsigned long arg)
+ 		return -EFAULT;
+ 	}
+ 
+-	return mptctl_do_fw_download(kfwdl.iocnum, kfwdl.bufp, kfwdl.fwlen);
++	return mptctl_do_fw_download(iocp, kfwdl.bufp, kfwdl.fwlen);
+ }
+ 
+ /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+@@ -784,11 +777,10 @@ mptctl_fw_download(unsigned long arg)
+  *		-ENOMSG if FW upload returned bad status
+  */
+ static int
+-mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen)
++mptctl_do_fw_download(MPT_ADAPTER *iocp, char __user *ufwbuf, size_t fwlen)
+ {
+ 	FWDownload_t		*dlmsg;
+ 	MPT_FRAME_HDR		*mf;
+-	MPT_ADAPTER		*iocp;
+ 	FWDownloadTCSGE_t	*ptsge;
+ 	MptSge_t		*sgl, *sgIn;
+ 	char			*sgOut;
+@@ -808,17 +800,10 @@ mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen)
+ 	pFWDownloadReply_t	 ReplyMsg = NULL;
+ 	unsigned long		 timeleft;
+ 
+-	if (mpt_verify_adapter(ioc, &iocp) < 0) {
+-		printk(KERN_DEBUG MYNAM "ioctl_fwdl - ioc%d not found!\n",
+-				 ioc);
+-		return -ENODEV; /* (-6) No such device or address */
+-	} else {
+-
+-		/*  Valid device. Get a message frame and construct the FW download message.
+-	 	*/
+-		if ((mf = mpt_get_msg_frame(mptctl_id, iocp)) == NULL)
+-			return -EAGAIN;
+-	}
++	/*  Valid device. Get a message frame and construct the FW download message.
++	*/
++	if ((mf = mpt_get_msg_frame(mptctl_id, iocp)) == NULL)
++		return -EAGAIN;
+ 
+ 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT
+ 	    "mptctl_do_fwdl called. mptctl_id = %xh.\n", iocp->name, mptctl_id));
+@@ -826,8 +811,6 @@ mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen)
+ 	    iocp->name, ufwbuf));
+ 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.fwlen = %d\n",
+ 	    iocp->name, (int)fwlen));
+-	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.ioc   = %04xh\n",
+-	    iocp->name, ioc));
+ 
+ 	dlmsg = (FWDownload_t*) mf;
+ 	ptsge = (FWDownloadTCSGE_t *) &dlmsg->SGL;
+@@ -1238,13 +1221,11 @@ kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma, struct buflist *buflist, MPT_ADAPTE
+  *		-ENODEV  if no such device/adapter
+  */
+ static int
+-mptctl_getiocinfo (unsigned long arg, unsigned int data_size)
++mptctl_getiocinfo (MPT_ADAPTER *ioc, unsigned long arg, unsigned int data_size)
+ {
+ 	struct mpt_ioctl_iocinfo __user *uarg = (void __user *) arg;
+ 	struct mpt_ioctl_iocinfo *karg;
+-	MPT_ADAPTER		*ioc;
+ 	struct pci_dev		*pdev;
+-	int			iocnum;
+ 	unsigned int		port;
+ 	int			cim_rev;
+ 	struct scsi_device 	*sdev;
+@@ -1272,14 +1253,6 @@ mptctl_getiocinfo (unsigned long arg, unsigned int data_size)
+ 		return PTR_ERR(karg);
+ 	}
+ 
+-	if (((iocnum = mpt_verify_adapter(karg->hdr.iocnum, &ioc)) < 0) ||
+-	    (ioc == NULL)) {
+-		printk(KERN_DEBUG MYNAM "%s::mptctl_getiocinfo() @%d - ioc%d not found!\n",
+-				__FILE__, __LINE__, iocnum);
+-		kfree(karg);
+-		return -ENODEV;
+-	}
+-
+ 	/* Verify the data transfer size is correct. */
+ 	if (karg->hdr.maxDataSize != data_size) {
+ 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_getiocinfo - "
+@@ -1385,15 +1358,13 @@ mptctl_getiocinfo (unsigned long arg, unsigned int data_size)
+  *		-ENODEV  if no such device/adapter
+  */
+ static int
+-mptctl_gettargetinfo (unsigned long arg)
++mptctl_gettargetinfo (MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ 	struct mpt_ioctl_targetinfo __user *uarg = (void __user *) arg;
+ 	struct mpt_ioctl_targetinfo karg;
+-	MPT_ADAPTER		*ioc;
+ 	VirtDevice		*vdevice;
+ 	char			*pmem;
+ 	int			*pdata;
+-	int			iocnum;
+ 	int			numDevices = 0;
+ 	int			lun;
+ 	int			maxWordsLeft;
+@@ -1408,13 +1379,6 @@ mptctl_gettargetinfo (unsigned long arg)
+ 		return -EFAULT;
+ 	}
+ 
+-	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+-	    (ioc == NULL)) {
+-		printk(KERN_DEBUG MYNAM "%s::mptctl_gettargetinfo() @%d - ioc%d not found!\n",
+-				__FILE__, __LINE__, iocnum);
+-		return -ENODEV;
+-	}
+-
+ 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_gettargetinfo called.\n",
+ 	    ioc->name));
+ 	/* Get the port number and set the maximum number of bytes
+@@ -1510,12 +1474,10 @@ mptctl_gettargetinfo (unsigned long arg)
+  *		-ENODEV  if no such device/adapter
+  */
+ static int
+-mptctl_readtest (unsigned long arg)
++mptctl_readtest (MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ 	struct mpt_ioctl_test __user *uarg = (void __user *) arg;
+ 	struct mpt_ioctl_test	 karg;
+-	MPT_ADAPTER *ioc;
+-	int iocnum;
+ 
+ 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_test))) {
+ 		printk(KERN_ERR MYNAM "%s@%d::mptctl_readtest - "
+@@ -1524,13 +1486,6 @@ mptctl_readtest (unsigned long arg)
+ 		return -EFAULT;
+ 	}
+ 
+-	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+-	    (ioc == NULL)) {
+-		printk(KERN_DEBUG MYNAM "%s::mptctl_readtest() @%d - ioc%d not found!\n",
+-				__FILE__, __LINE__, iocnum);
+-		return -ENODEV;
+-	}
+-
+ 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_readtest called.\n",
+ 	    ioc->name));
+ 	/* Fill in the data and return the structure to the calling
+@@ -1571,12 +1526,10 @@ mptctl_readtest (unsigned long arg)
+  *		-ENODEV  if no such device/adapter
+  */
+ static int
+-mptctl_eventquery (unsigned long arg)
++mptctl_eventquery (MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ 	struct mpt_ioctl_eventquery __user *uarg = (void __user *) arg;
+ 	struct mpt_ioctl_eventquery	 karg;
+-	MPT_ADAPTER *ioc;
+-	int iocnum;
+ 
+ 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventquery))) {
+ 		printk(KERN_ERR MYNAM "%s@%d::mptctl_eventquery - "
+@@ -1585,13 +1538,6 @@ mptctl_eventquery (unsigned long arg)
+ 		return -EFAULT;
+ 	}
+ 
+-	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+-	    (ioc == NULL)) {
+-		printk(KERN_DEBUG MYNAM "%s::mptctl_eventquery() @%d - ioc%d not found!\n",
+-				__FILE__, __LINE__, iocnum);
+-		return -ENODEV;
+-	}
+-
+ 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventquery called.\n",
+ 	    ioc->name));
+ 	karg.eventEntries = MPTCTL_EVENT_LOG_SIZE;
+@@ -1610,12 +1556,10 @@ mptctl_eventquery (unsigned long arg)
+ 
+ /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+ static int
+-mptctl_eventenable (unsigned long arg)
++mptctl_eventenable (MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ 	struct mpt_ioctl_eventenable __user *uarg = (void __user *) arg;
+ 	struct mpt_ioctl_eventenable	 karg;
+-	MPT_ADAPTER *ioc;
+-	int iocnum;
+ 
+ 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventenable))) {
+ 		printk(KERN_ERR MYNAM "%s@%d::mptctl_eventenable - "
+@@ -1624,13 +1568,6 @@ mptctl_eventenable (unsigned long arg)
+ 		return -EFAULT;
+ 	}
+ 
+-	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+-	    (ioc == NULL)) {
+-		printk(KERN_DEBUG MYNAM "%s::mptctl_eventenable() @%d - ioc%d not found!\n",
+-				__FILE__, __LINE__, iocnum);
+-		return -ENODEV;
+-	}
+-
+ 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventenable called.\n",
+ 	    ioc->name));
+ 	if (ioc->events == NULL) {
+@@ -1658,12 +1595,10 @@ mptctl_eventenable (unsigned long arg)
+ 
+ /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+ static int
+-mptctl_eventreport (unsigned long arg)
++mptctl_eventreport (MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ 	struct mpt_ioctl_eventreport __user *uarg = (void __user *) arg;
+ 	struct mpt_ioctl_eventreport	 karg;
+-	MPT_ADAPTER		 *ioc;
+-	int			 iocnum;
+ 	int			 numBytes, maxEvents, max;
+ 
+ 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventreport))) {
+@@ -1673,12 +1608,6 @@ mptctl_eventreport (unsigned long arg)
+ 		return -EFAULT;
+ 	}
+ 
+-	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+-	    (ioc == NULL)) {
+-		printk(KERN_DEBUG MYNAM "%s::mptctl_eventreport() @%d - ioc%d not found!\n",
+-				__FILE__, __LINE__, iocnum);
+-		return -ENODEV;
+-	}
+ 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventreport called.\n",
+ 	    ioc->name));
+ 
+@@ -1712,12 +1641,10 @@ mptctl_eventreport (unsigned long arg)
+ 
+ /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+ static int
+-mptctl_replace_fw (unsigned long arg)
++mptctl_replace_fw (MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ 	struct mpt_ioctl_replace_fw __user *uarg = (void __user *) arg;
+ 	struct mpt_ioctl_replace_fw	 karg;
+-	MPT_ADAPTER		 *ioc;
+-	int			 iocnum;
+ 	int			 newFwSize;
+ 
+ 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_replace_fw))) {
+@@ -1727,13 +1654,6 @@ mptctl_replace_fw (unsigned long arg)
+ 		return -EFAULT;
+ 	}
+ 
+-	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+-	    (ioc == NULL)) {
+-		printk(KERN_DEBUG MYNAM "%s::mptctl_replace_fw() @%d - ioc%d not found!\n",
+-				__FILE__, __LINE__, iocnum);
+-		return -ENODEV;
+-	}
+-
+ 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_replace_fw called.\n",
+ 	    ioc->name));
+ 	/* If caching FW, Free the old FW image
+@@ -1780,12 +1700,10 @@ mptctl_replace_fw (unsigned long arg)
+  *		-ENOMEM if memory allocation error
+  */
+ static int
+-mptctl_mpt_command (unsigned long arg)
++mptctl_mpt_command (MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ 	struct mpt_ioctl_command __user *uarg = (void __user *) arg;
+ 	struct mpt_ioctl_command  karg;
+-	MPT_ADAPTER	*ioc;
+-	int		iocnum;
+ 	int		rc;
+ 
+ 
+@@ -1796,14 +1714,7 @@ mptctl_mpt_command (unsigned long arg)
+ 		return -EFAULT;
+ 	}
+ 
+-	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+-	    (ioc == NULL)) {
+-		printk(KERN_DEBUG MYNAM "%s::mptctl_mpt_command() @%d - ioc%d not found!\n",
+-				__FILE__, __LINE__, iocnum);
+-		return -ENODEV;
+-	}
+-
+-	rc = mptctl_do_mpt_command (karg, &uarg->MF);
++	rc = mptctl_do_mpt_command (ioc, karg, &uarg->MF);
+ 
+ 	return rc;
+ }
+@@ -1821,9 +1732,8 @@ mptctl_mpt_command (unsigned long arg)
+  *		-EPERM if SCSI I/O and target is untagged
+  */
+ static int
+-mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
++mptctl_do_mpt_command (MPT_ADAPTER *ioc, struct mpt_ioctl_command karg, void __user *mfPtr)
+ {
+-	MPT_ADAPTER	*ioc;
+ 	MPT_FRAME_HDR	*mf = NULL;
+ 	MPIHeader_t	*hdr;
+ 	char		*psge;
+@@ -1832,7 +1742,7 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
+ 	dma_addr_t	dma_addr_in;
+ 	dma_addr_t	dma_addr_out;
+ 	int		sgSize = 0;	/* Num SG elements */
+-	int		iocnum, flagsLength;
++	int		flagsLength;
+ 	int		sz, rc = 0;
+ 	int		msgContext;
+ 	u16		req_idx;
+@@ -1847,13 +1757,6 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
+ 	bufIn.kptr = bufOut.kptr = NULL;
+ 	bufIn.len = bufOut.len = 0;
+ 
+-	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+-	    (ioc == NULL)) {
+-		printk(KERN_DEBUG MYNAM "%s::mptctl_do_mpt_command() @%d - ioc%d not found!\n",
+-				__FILE__, __LINE__, iocnum);
+-		return -ENODEV;
+-	}
+-
+ 	spin_lock_irqsave(&ioc->taskmgmt_lock, flags);
+ 	if (ioc->ioc_reset_in_progress) {
+ 		spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
+@@ -2418,17 +2321,15 @@ done_free_mem:
+  *		-ENOMEM if memory allocation error
+  */
+ static int
+-mptctl_hp_hostinfo(unsigned long arg, unsigned int data_size)
++mptctl_hp_hostinfo(MPT_ADAPTER *ioc, unsigned long arg, unsigned int data_size)
+ {
+ 	hp_host_info_t	__user *uarg = (void __user *) arg;
+-	MPT_ADAPTER		*ioc;
+ 	struct pci_dev		*pdev;
+ 	char                    *pbuf=NULL;
+ 	dma_addr_t		buf_dma;
+ 	hp_host_info_t		karg;
+ 	CONFIGPARMS		cfg;
+ 	ConfigPageHeader_t	hdr;
+-	int			iocnum;
+ 	int			rc, cim_rev;
+ 	ToolboxIstwiReadWriteRequest_t	*IstwiRWRequest;
+ 	MPT_FRAME_HDR		*mf = NULL;
+@@ -2452,12 +2353,6 @@ mptctl_hp_hostinfo(unsigned long arg, unsigned int data_size)
+ 		return -EFAULT;
+ 	}
+ 
+-	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+-	    (ioc == NULL)) {
+-		printk(KERN_DEBUG MYNAM "%s::mptctl_hp_hostinfo() @%d - ioc%d not found!\n",
+-				__FILE__, __LINE__, iocnum);
+-		return -ENODEV;
+-	}
+ 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT ": mptctl_hp_hostinfo called.\n",
+ 	    ioc->name));
+ 
+@@ -2670,15 +2565,13 @@ retry_wait:
+  *		-ENOMEM if memory allocation error
+  */
+ static int
+-mptctl_hp_targetinfo(unsigned long arg)
++mptctl_hp_targetinfo(MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ 	hp_target_info_t __user *uarg = (void __user *) arg;
+ 	SCSIDevicePage0_t	*pg0_alloc;
+ 	SCSIDevicePage3_t	*pg3_alloc;
+-	MPT_ADAPTER		*ioc;
+ 	MPT_SCSI_HOST 		*hd = NULL;
+ 	hp_target_info_t	karg;
+-	int			iocnum;
+ 	int			data_sz;
+ 	dma_addr_t		page_dma;
+ 	CONFIGPARMS	 	cfg;
+@@ -2692,12 +2585,6 @@ mptctl_hp_targetinfo(unsigned long arg)
+ 		return -EFAULT;
+ 	}
+ 
+-	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+-		(ioc == NULL)) {
+-		printk(KERN_DEBUG MYNAM "%s::mptctl_hp_targetinfo() @%d - ioc%d not found!\n",
+-				__FILE__, __LINE__, iocnum);
+-		return -ENODEV;
+-	}
+ 	if (karg.hdr.id >= MPT_MAX_FC_DEVICES)
+ 		return -EINVAL;
+ 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo called.\n",
+@@ -2865,7 +2752,7 @@ compat_mptfwxfer_ioctl(struct file *filp, unsigned int cmd,
+ 	kfw.fwlen = kfw32.fwlen;
+ 	kfw.bufp = compat_ptr(kfw32.bufp);
+ 
+-	ret = mptctl_do_fw_download(kfw.iocnum, kfw.bufp, kfw.fwlen);
++	ret = mptctl_do_fw_download(iocp, kfw.bufp, kfw.fwlen);
+ 
+ 	mutex_unlock(&iocp->ioctl_cmds.mutex);
+ 
+@@ -2919,7 +2806,7 @@ compat_mpt_command(struct file *filp, unsigned int cmd,
+ 
+ 	/* Pass new structure to do_mpt_command
+ 	 */
+-	ret = mptctl_do_mpt_command (karg, &uarg->MF);
++	ret = mptctl_do_mpt_command (iocp, karg, &uarg->MF);
+ 
+ 	mutex_unlock(&iocp->ioctl_cmds.mutex);
+ 
+diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c
+index eb29113e0bac..b11737f7bdca 100644
+--- a/drivers/misc/enclosure.c
++++ b/drivers/misc/enclosure.c
+@@ -419,10 +419,9 @@ int enclosure_remove_device(struct enclosure_device *edev, struct device *dev)
+ 		cdev = &edev->component[i];
+ 		if (cdev->dev == dev) {
+ 			enclosure_remove_links(cdev);
+-			device_del(&cdev->cdev);
+ 			put_device(dev);
+ 			cdev->dev = NULL;
+-			return device_add(&cdev->cdev);
++			return 0;
+ 		}
+ 	}
+ 	return -ENODEV;
+diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
+index c42523b7d5ed..63a9b53a65ed 100644
+--- a/drivers/mtd/spi-nor/spi-nor.c
++++ b/drivers/mtd/spi-nor/spi-nor.c
+@@ -1046,7 +1046,7 @@ static int spi_nor_read(struct mtd_info *mtd, loff_t from, size_t len,
+ 			size_t *retlen, u_char *buf)
+ {
+ 	struct spi_nor *nor = mtd_to_spi_nor(mtd);
+-	int ret;
++	ssize_t ret;
+ 
+ 	dev_dbg(nor->dev, "from 0x%08x, len %zd\n", (u32)from, len);
+ 
+diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
+index e11920d12774..27c49d400bcd 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/common.h
++++ b/drivers/net/ethernet/stmicro/stmmac/common.h
+@@ -326,8 +326,8 @@ struct dma_features {
+ 	unsigned int enh_desc;
+ };
+ 
+-/* GMAC TX FIFO is 8K, Rx FIFO is 16K */
+-#define BUF_SIZE_16KiB 16384
++/* RX Buffer size must be multiple of 4/8/16 bytes */
++#define BUF_SIZE_16KiB 16368
+ #define BUF_SIZE_8KiB 8192
+ #define BUF_SIZE_4KiB 4096
+ #define BUF_SIZE_2KiB 2048
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index a2b7c685cbf1..8c1a5361f661 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -929,7 +929,9 @@ static int stmmac_set_bfsize(int mtu, int bufsize)
+ {
+ 	int ret = bufsize;
+ 
+-	if (mtu >= BUF_SIZE_4KiB)
++	if (mtu >= BUF_SIZE_8KiB)
++		ret = BUF_SIZE_16KiB;
++	else if (mtu >= BUF_SIZE_4KiB)
+ 		ret = BUF_SIZE_8KiB;
+ 	else if (mtu >= BUF_SIZE_2KiB)
+ 		ret = BUF_SIZE_4KiB;
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 854947b9db4e..e2b3d3c4d4df 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -234,7 +234,7 @@ static void macvlan_broadcast(struct sk_buff *skb,
+ 			      struct net_device *src,
+ 			      enum macvlan_mode mode)
+ {
+-	const struct ethhdr *eth = skb_eth_hdr(skb);
++	const struct ethhdr *eth = eth_hdr(skb);
+ 	const struct macvlan_dev *vlan;
+ 	struct sk_buff *nskb;
+ 	unsigned int i;
+@@ -487,10 +487,11 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	const struct macvlan_dev *dest;
+ 
+ 	if (vlan->mode == MACVLAN_MODE_BRIDGE) {
+-		const struct ethhdr *eth = (void *)skb->data;
++		const struct ethhdr *eth = skb_eth_hdr(skb);
+ 
+ 		/* send to other bridge ports directly */
+ 		if (is_multicast_ether_addr(eth->h_dest)) {
++			skb_reset_mac_header(skb);
+ 			macvlan_broadcast(skb, port, dev, MACVLAN_MODE_BRIDGE);
+ 			goto xmit_world;
+ 		}
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 8045cc401009..473dd79e167b 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -3375,6 +3375,7 @@ static int lan78xx_probe(struct usb_interface *intf,
+ 
+ 	if (netdev->mtu > (dev->hard_mtu - netdev->hard_header_len))
+ 		netdev->mtu = dev->hard_mtu - netdev->hard_header_len;
++	netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER);
+ 
+ 	dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0;
+ 	dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1;
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 15dc70c11857..3c037b76a0cc 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -4365,6 +4365,9 @@ static int rtl8152_probe(struct usb_interface *intf,
+ 		return -ENODEV;
+ 	}
+ 
++	if (intf->cur_altsetting->desc.bNumEndpoints < 3)
++		return -ENODEV;
++
+ 	usb_reset_device(udev);
+ 	netdev = alloc_etherdev(sizeof(struct r8152));
+ 	if (!netdev) {
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index b2c1e872d5ed..af85a1b3135e 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -77,7 +77,7 @@ static struct ucc_tdm_info utdm_primary_info = {
+ 	},
+ };
+ 
+-static struct ucc_tdm_info utdm_info[MAX_HDLC_NUM];
++static struct ucc_tdm_info utdm_info[UCC_MAX_NUM];
+ 
+ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ {
+diff --git a/drivers/net/wimax/i2400m/op-rfkill.c b/drivers/net/wimax/i2400m/op-rfkill.c
+index b0dba35a8ad2..dc6fe93ce71f 100644
+--- a/drivers/net/wimax/i2400m/op-rfkill.c
++++ b/drivers/net/wimax/i2400m/op-rfkill.c
+@@ -147,6 +147,7 @@ error_msg_to_dev:
+ error_alloc:
+ 	d_fnend(4, dev, "(wimax_dev %p state %d) = %d\n",
+ 		wimax_dev, state, result);
++	kfree(cmd);
+ 	return result;
+ }
+ 
+diff --git a/drivers/net/wireless/realtek/rtlwifi/regd.c b/drivers/net/wireless/realtek/rtlwifi/regd.c
+index 6ee6bf8e7eaf..ab53cf42cf42 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/regd.c
++++ b/drivers/net/wireless/realtek/rtlwifi/regd.c
+@@ -427,7 +427,7 @@ int rtl_regd_init(struct ieee80211_hw *hw,
+ 	struct wiphy *wiphy = hw->wiphy;
+ 	struct country_code_to_enum_rd *country = NULL;
+ 
+-	if (wiphy == NULL || &rtlpriv->regd == NULL)
++	if (!wiphy)
+ 		return -EINVAL;
+ 
+ 	/* init country_code from efuse channel plan */
+diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+index dbb23899ddcb..891295ebd875 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+@@ -199,6 +199,7 @@ void rsi_mac80211_detach(struct rsi_hw *adapter)
+ 		ieee80211_stop_queues(hw);
+ 		ieee80211_unregister_hw(hw);
+ 		ieee80211_free_hw(hw);
++		adapter->hw = NULL;
+ 	}
+ 
+ 	rsi_remove_dbgfs(adapter);
+diff --git a/drivers/net/wireless/st/cw1200/fwio.c b/drivers/net/wireless/st/cw1200/fwio.c
+index 30e7646d04af..16be7fa82a23 100644
+--- a/drivers/net/wireless/st/cw1200/fwio.c
++++ b/drivers/net/wireless/st/cw1200/fwio.c
+@@ -323,12 +323,12 @@ int cw1200_load_firmware(struct cw1200_common *priv)
+ 		goto out;
+ 	}
+ 
+-	priv->hw_type = cw1200_get_hw_type(val32, &major_revision);
+-	if (priv->hw_type < 0) {
++	ret = cw1200_get_hw_type(val32, &major_revision);
++	if (ret < 0) {
+ 		pr_err("Can't deduce hardware type.\n");
+-		ret = -ENOTSUPP;
+ 		goto out;
+ 	}
++	priv->hw_type = ret;
+ 
+ 	/* Set DPLL Reg value, and read back to confirm writes work */
+ 	ret = cw1200_reg_write_32(priv, ST90TDS_TSET_GEN_R_W_REG_ID,
+diff --git a/drivers/pci/pcie/ptm.c b/drivers/pci/pcie/ptm.c
+index bab8ac63c4f3..3008bba360f3 100644
+--- a/drivers/pci/pcie/ptm.c
++++ b/drivers/pci/pcie/ptm.c
+@@ -29,7 +29,7 @@ static void pci_ptm_info(struct pci_dev *dev)
+ 		snprintf(clock_desc, sizeof(clock_desc), ">254ns");
+ 		break;
+ 	default:
+-		snprintf(clock_desc, sizeof(clock_desc), "%udns",
++		snprintf(clock_desc, sizeof(clock_desc), "%uns",
+ 			 dev->ptm_granularity);
+ 		break;
+ 	}
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index aede41a92cac..4ae758c3d8ba 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -461,13 +461,7 @@ static void kbd_led_update(struct work_struct *work)
+ 
+ 	asus = container_of(work, struct asus_wmi, kbd_led_work);
+ 
+-	/*
+-	 * bits 0-2: level
+-	 * bit 7: light on/off
+-	 */
+-	if (asus->kbd_led_wk > 0)
+-		ctrl_param = 0x80 | (asus->kbd_led_wk & 0x7F);
+-
++	ctrl_param = 0x80 | (asus->kbd_led_wk & 0x7F);
+ 	asus_wmi_set_devstate(ASUS_WMI_DEVID_KBD_BACKLIGHT, ctrl_param, NULL);
+ }
+ 
+diff --git a/drivers/rtc/rtc-msm6242.c b/drivers/rtc/rtc-msm6242.c
+index c1c5c4e3b3b4..c981301efbe5 100644
+--- a/drivers/rtc/rtc-msm6242.c
++++ b/drivers/rtc/rtc-msm6242.c
+@@ -132,7 +132,8 @@ static int msm6242_read_time(struct device *dev, struct rtc_time *tm)
+ 		      msm6242_read(priv, MSM6242_SECOND1);
+ 	tm->tm_min  = msm6242_read(priv, MSM6242_MINUTE10) * 10 +
+ 		      msm6242_read(priv, MSM6242_MINUTE1);
+-	tm->tm_hour = (msm6242_read(priv, MSM6242_HOUR10 & 3)) * 10 +
++	tm->tm_hour = (msm6242_read(priv, MSM6242_HOUR10) &
++		       MSM6242_HOUR10_HR_MASK) * 10 +
+ 		      msm6242_read(priv, MSM6242_HOUR1);
+ 	tm->tm_mday = msm6242_read(priv, MSM6242_DAY10) * 10 +
+ 		      msm6242_read(priv, MSM6242_DAY1);
+diff --git a/drivers/rtc/rtc-mt6397.c b/drivers/rtc/rtc-mt6397.c
+index 1a61fa56f3ad..494a7fbd512b 100644
+--- a/drivers/rtc/rtc-mt6397.c
++++ b/drivers/rtc/rtc-mt6397.c
+@@ -55,6 +55,14 @@
+ 
+ #define RTC_AL_SEC		0x0018
+ 
++#define RTC_AL_SEC_MASK		0x003f
++#define RTC_AL_MIN_MASK		0x003f
++#define RTC_AL_HOU_MASK		0x001f
++#define RTC_AL_DOM_MASK		0x001f
++#define RTC_AL_DOW_MASK		0x0007
++#define RTC_AL_MTH_MASK		0x000f
++#define RTC_AL_YEA_MASK		0x007f
++
+ #define RTC_PDN2		0x002e
+ #define RTC_PDN2_PWRON_ALARM	BIT(4)
+ 
+@@ -111,7 +119,7 @@ static irqreturn_t mtk_rtc_irq_handler_thread(int irq, void *data)
+ 		irqen = irqsta & ~RTC_IRQ_EN_AL;
+ 		mutex_lock(&rtc->lock);
+ 		if (regmap_write(rtc->regmap, rtc->addr_base + RTC_IRQ_EN,
+-				 irqen) < 0)
++				 irqen) == 0)
+ 			mtk_rtc_write_trigger(rtc);
+ 		mutex_unlock(&rtc->lock);
+ 
+@@ -233,12 +241,12 @@ static int mtk_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alm)
+ 	alm->pending = !!(pdn2 & RTC_PDN2_PWRON_ALARM);
+ 	mutex_unlock(&rtc->lock);
+ 
+-	tm->tm_sec = data[RTC_OFFSET_SEC];
+-	tm->tm_min = data[RTC_OFFSET_MIN];
+-	tm->tm_hour = data[RTC_OFFSET_HOUR];
+-	tm->tm_mday = data[RTC_OFFSET_DOM];
+-	tm->tm_mon = data[RTC_OFFSET_MTH];
+-	tm->tm_year = data[RTC_OFFSET_YEAR];
++	tm->tm_sec = data[RTC_OFFSET_SEC] & RTC_AL_SEC_MASK;
++	tm->tm_min = data[RTC_OFFSET_MIN] & RTC_AL_MIN_MASK;
++	tm->tm_hour = data[RTC_OFFSET_HOUR] & RTC_AL_HOU_MASK;
++	tm->tm_mday = data[RTC_OFFSET_DOM] & RTC_AL_DOM_MASK;
++	tm->tm_mon = data[RTC_OFFSET_MTH] & RTC_AL_MTH_MASK;
++	tm->tm_year = data[RTC_OFFSET_YEAR] & RTC_AL_YEA_MASK;
+ 
+ 	tm->tm_year += RTC_MIN_YEAR_OFFSET;
+ 	tm->tm_mon--;
+@@ -259,14 +267,25 @@ static int mtk_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alm)
+ 	tm->tm_year -= RTC_MIN_YEAR_OFFSET;
+ 	tm->tm_mon++;
+ 
+-	data[RTC_OFFSET_SEC] = tm->tm_sec;
+-	data[RTC_OFFSET_MIN] = tm->tm_min;
+-	data[RTC_OFFSET_HOUR] = tm->tm_hour;
+-	data[RTC_OFFSET_DOM] = tm->tm_mday;
+-	data[RTC_OFFSET_MTH] = tm->tm_mon;
+-	data[RTC_OFFSET_YEAR] = tm->tm_year;
+-
+ 	mutex_lock(&rtc->lock);
++	ret = regmap_bulk_read(rtc->regmap, rtc->addr_base + RTC_AL_SEC,
++			       data, RTC_OFFSET_COUNT);
++	if (ret < 0)
++		goto exit;
++
++	data[RTC_OFFSET_SEC] = ((data[RTC_OFFSET_SEC] & ~(RTC_AL_SEC_MASK)) |
++				(tm->tm_sec & RTC_AL_SEC_MASK));
++	data[RTC_OFFSET_MIN] = ((data[RTC_OFFSET_MIN] & ~(RTC_AL_MIN_MASK)) |
++				(tm->tm_min & RTC_AL_MIN_MASK));
++	data[RTC_OFFSET_HOUR] = ((data[RTC_OFFSET_HOUR] & ~(RTC_AL_HOU_MASK)) |
++				(tm->tm_hour & RTC_AL_HOU_MASK));
++	data[RTC_OFFSET_DOM] = ((data[RTC_OFFSET_DOM] & ~(RTC_AL_DOM_MASK)) |
++				(tm->tm_mday & RTC_AL_DOM_MASK));
++	data[RTC_OFFSET_MTH] = ((data[RTC_OFFSET_MTH] & ~(RTC_AL_MTH_MASK)) |
++				(tm->tm_mon & RTC_AL_MTH_MASK));
++	data[RTC_OFFSET_YEAR] = ((data[RTC_OFFSET_YEAR] & ~(RTC_AL_YEA_MASK)) |
++				(tm->tm_year & RTC_AL_YEA_MASK));
++
+ 	if (alm->enabled) {
+ 		ret = regmap_bulk_write(rtc->regmap,
+ 					rtc->addr_base + RTC_AL_SEC,
+diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c
+index 133901fd3e35..6d1f8b22bd83 100644
+--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
+@@ -915,12 +915,12 @@ void bnx2i_free_hba(struct bnx2i_hba *hba)
+ 	INIT_LIST_HEAD(&hba->ep_ofld_list);
+ 	INIT_LIST_HEAD(&hba->ep_active_list);
+ 	INIT_LIST_HEAD(&hba->ep_destroy_list);
+-	pci_dev_put(hba->pcidev);
+ 
+ 	if (hba->regview) {
+ 		pci_iounmap(hba->pcidev, hba->regview);
+ 		hba->regview = NULL;
+ 	}
++	pci_dev_put(hba->pcidev);
+ 	bnx2i_free_mp_bdt(hba);
+ 	bnx2i_release_free_cid_que(hba);
+ 	iscsi_host_free(shost);
+diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
+index e974106f2bb5..3d6e653f5147 100644
+--- a/drivers/scsi/cxgbi/libcxgbi.c
++++ b/drivers/scsi/cxgbi/libcxgbi.c
+@@ -121,7 +121,8 @@ static inline void cxgbi_device_destroy(struct cxgbi_device *cdev)
+ 		"cdev 0x%p, p# %u.\n", cdev, cdev->nports);
+ 	cxgbi_hbas_remove(cdev);
+ 	cxgbi_device_portmap_cleanup(cdev);
+-	cxgbi_ppm_release(cdev->cdev2ppm(cdev));
++	if (cdev->cdev2ppm)
++		cxgbi_ppm_release(cdev->cdev2ppm(cdev));
+ 	if (cdev->pmap.max_connect)
+ 		cxgbi_free_big_mem(cdev->pmap.port_csk);
+ 	kfree(cdev);
+diff --git a/drivers/scsi/esas2r/esas2r_flash.c b/drivers/scsi/esas2r/esas2r_flash.c
+index 7bd376d95ed5..b02ac389e6c6 100644
+--- a/drivers/scsi/esas2r/esas2r_flash.c
++++ b/drivers/scsi/esas2r/esas2r_flash.c
+@@ -1197,6 +1197,7 @@ bool esas2r_nvram_read_direct(struct esas2r_adapter *a)
+ 	if (!esas2r_read_flash_block(a, a->nvram, FLS_OFFSET_NVR,
+ 				     sizeof(struct esas2r_sas_nvram))) {
+ 		esas2r_hdebug("NVRAM read failed, using defaults");
++		up(&a->nvram_semaphore);
+ 		return false;
+ 	}
+ 
+diff --git a/drivers/scsi/fnic/vnic_dev.c b/drivers/scsi/fnic/vnic_dev.c
+index 9795d6f3e197..c5b89a003d2a 100644
+--- a/drivers/scsi/fnic/vnic_dev.c
++++ b/drivers/scsi/fnic/vnic_dev.c
+@@ -445,26 +445,26 @@ int vnic_dev_soft_reset_done(struct vnic_dev *vdev, int *done)
+ 
+ int vnic_dev_hang_notify(struct vnic_dev *vdev)
+ {
+-	u64 a0, a1;
++	u64 a0 = 0, a1 = 0;
+ 	int wait = 1000;
+ 	return vnic_dev_cmd(vdev, CMD_HANG_NOTIFY, &a0, &a1, wait);
+ }
+ 
+ int vnic_dev_mac_addr(struct vnic_dev *vdev, u8 *mac_addr)
+ {
+-	u64 a0, a1;
++	u64 a[2] = {};
+ 	int wait = 1000;
+ 	int err, i;
+ 
+ 	for (i = 0; i < ETH_ALEN; i++)
+ 		mac_addr[i] = 0;
+ 
+-	err = vnic_dev_cmd(vdev, CMD_MAC_ADDR, &a0, &a1, wait);
++	err = vnic_dev_cmd(vdev, CMD_MAC_ADDR, &a[0], &a[1], wait);
+ 	if (err)
+ 		return err;
+ 
+ 	for (i = 0; i < ETH_ALEN; i++)
+-		mac_addr[i] = ((u8 *)&a0)[i];
++		mac_addr[i] = ((u8 *)&a)[i];
+ 
+ 	return 0;
+ }
+@@ -489,38 +489,32 @@ void vnic_dev_packet_filter(struct vnic_dev *vdev, int directed, int multicast,
+ 
+ void vnic_dev_add_addr(struct vnic_dev *vdev, u8 *addr)
+ {
+-	u64 a0 = 0, a1 = 0;
++	u64 a[2] = {};
+ 	int wait = 1000;
+ 	int err;
+ 	int i;
+ 
+ 	for (i = 0; i < ETH_ALEN; i++)
+-		((u8 *)&a0)[i] = addr[i];
++		((u8 *)&a)[i] = addr[i];
+ 
+-	err = vnic_dev_cmd(vdev, CMD_ADDR_ADD, &a0, &a1, wait);
++	err = vnic_dev_cmd(vdev, CMD_ADDR_ADD, &a[0], &a[1], wait);
+ 	if (err)
+-		printk(KERN_ERR
+-			"Can't add addr [%02x:%02x:%02x:%02x:%02x:%02x], %d\n",
+-			addr[0], addr[1], addr[2], addr[3], addr[4], addr[5],
+-			err);
++		pr_err("Can't add addr [%pM], %d\n", addr, err);
+ }
+ 
+ void vnic_dev_del_addr(struct vnic_dev *vdev, u8 *addr)
+ {
+-	u64 a0 = 0, a1 = 0;
++	u64 a[2] = {};
+ 	int wait = 1000;
+ 	int err;
+ 	int i;
+ 
+ 	for (i = 0; i < ETH_ALEN; i++)
+-		((u8 *)&a0)[i] = addr[i];
++		((u8 *)&a)[i] = addr[i];
+ 
+-	err = vnic_dev_cmd(vdev, CMD_ADDR_DEL, &a0, &a1, wait);
++	err = vnic_dev_cmd(vdev, CMD_ADDR_DEL, &a[0], &a[1], wait);
+ 	if (err)
+-		printk(KERN_ERR
+-			"Can't del addr [%02x:%02x:%02x:%02x:%02x:%02x], %d\n",
+-			addr[0], addr[1], addr[2], addr[3], addr[4], addr[5],
+-			err);
++		pr_err("Can't del addr [%pM], %d\n", addr, err);
+ }
+ 
+ int vnic_dev_notify_set(struct vnic_dev *vdev, u16 intr)
+diff --git a/drivers/scsi/qla4xxx/ql4_mbx.c b/drivers/scsi/qla4xxx/ql4_mbx.c
+index c291fdff1b33..ea3b77ba12a2 100644
+--- a/drivers/scsi/qla4xxx/ql4_mbx.c
++++ b/drivers/scsi/qla4xxx/ql4_mbx.c
+@@ -641,9 +641,6 @@ int qla4xxx_initialize_fw_cb(struct scsi_qla_host * ha)
+ 
+ 	if (qla4xxx_get_ifcb(ha, &mbox_cmd[0], &mbox_sts[0], init_fw_cb_dma) !=
+ 	    QLA_SUCCESS) {
+-		dma_free_coherent(&ha->pdev->dev,
+-				  sizeof(struct addr_ctrl_blk),
+-				  init_fw_cb, init_fw_cb_dma);
+ 		goto exit_init_fw_cb;
+ 	}
+ 
+diff --git a/drivers/scsi/scsi_trace.c b/drivers/scsi/scsi_trace.c
+index 617a60737590..22472d140ef7 100644
+--- a/drivers/scsi/scsi_trace.c
++++ b/drivers/scsi/scsi_trace.c
+@@ -21,7 +21,7 @@
+ #include <trace/events/scsi.h>
+ 
+ #define SERVICE_ACTION16(cdb) (cdb[1] & 0x1f)
+-#define SERVICE_ACTION32(cdb) ((cdb[8] << 8) | cdb[9])
++#define SERVICE_ACTION32(cdb) (get_unaligned_be16(&cdb[8]))
+ 
+ static const char *
+ scsi_trace_misc(struct trace_seq *, unsigned char *, int);
+@@ -51,17 +51,12 @@ static const char *
+ scsi_trace_rw10(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ 	const char *ret = trace_seq_buffer_ptr(p);
+-	sector_t lba = 0, txlen = 0;
++	u32 lba, txlen;
+ 
+-	lba |= (cdb[2] << 24);
+-	lba |= (cdb[3] << 16);
+-	lba |= (cdb[4] << 8);
+-	lba |=  cdb[5];
+-	txlen |= (cdb[7] << 8);
+-	txlen |=  cdb[8];
++	lba = get_unaligned_be32(&cdb[2]);
++	txlen = get_unaligned_be16(&cdb[7]);
+ 
+-	trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u",
+-			 (unsigned long long)lba, (unsigned long long)txlen,
++	trace_seq_printf(p, "lba=%u txlen=%u protect=%u", lba, txlen,
+ 			 cdb[1] >> 5);
+ 
+ 	if (cdb[0] == WRITE_SAME)
+@@ -76,19 +71,12 @@ static const char *
+ scsi_trace_rw12(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ 	const char *ret = trace_seq_buffer_ptr(p);
+-	sector_t lba = 0, txlen = 0;
+-
+-	lba |= (cdb[2] << 24);
+-	lba |= (cdb[3] << 16);
+-	lba |= (cdb[4] << 8);
+-	lba |=  cdb[5];
+-	txlen |= (cdb[6] << 24);
+-	txlen |= (cdb[7] << 16);
+-	txlen |= (cdb[8] << 8);
+-	txlen |=  cdb[9];
+-
+-	trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u",
+-			 (unsigned long long)lba, (unsigned long long)txlen,
++	u32 lba, txlen;
++
++	lba = get_unaligned_be32(&cdb[2]);
++	txlen = get_unaligned_be32(&cdb[6]);
++
++	trace_seq_printf(p, "lba=%u txlen=%u protect=%u", lba, txlen,
+ 			 cdb[1] >> 5);
+ 	trace_seq_putc(p, 0);
+ 
+@@ -99,23 +87,13 @@ static const char *
+ scsi_trace_rw16(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ 	const char *ret = trace_seq_buffer_ptr(p);
+-	sector_t lba = 0, txlen = 0;
+-
+-	lba |= ((u64)cdb[2] << 56);
+-	lba |= ((u64)cdb[3] << 48);
+-	lba |= ((u64)cdb[4] << 40);
+-	lba |= ((u64)cdb[5] << 32);
+-	lba |= (cdb[6] << 24);
+-	lba |= (cdb[7] << 16);
+-	lba |= (cdb[8] << 8);
+-	lba |=  cdb[9];
+-	txlen |= (cdb[10] << 24);
+-	txlen |= (cdb[11] << 16);
+-	txlen |= (cdb[12] << 8);
+-	txlen |=  cdb[13];
+-
+-	trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u",
+-			 (unsigned long long)lba, (unsigned long long)txlen,
++	u64 lba;
++	u32 txlen;
++
++	lba = get_unaligned_be64(&cdb[2]);
++	txlen = get_unaligned_be32(&cdb[10]);
++
++	trace_seq_printf(p, "lba=%llu txlen=%u protect=%u", lba, txlen,
+ 			 cdb[1] >> 5);
+ 
+ 	if (cdb[0] == WRITE_SAME_16)
+@@ -130,8 +108,8 @@ static const char *
+ scsi_trace_rw32(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ 	const char *ret = trace_seq_buffer_ptr(p), *cmd;
+-	sector_t lba = 0, txlen = 0;
+-	u32 ei_lbrt = 0;
++	u64 lba;
++	u32 ei_lbrt, txlen;
+ 
+ 	switch (SERVICE_ACTION32(cdb)) {
+ 	case READ_32:
+@@ -151,26 +129,12 @@ scsi_trace_rw32(struct trace_seq *p, unsigned char *cdb, int len)
+ 		goto out;
+ 	}
+ 
+-	lba |= ((u64)cdb[12] << 56);
+-	lba |= ((u64)cdb[13] << 48);
+-	lba |= ((u64)cdb[14] << 40);
+-	lba |= ((u64)cdb[15] << 32);
+-	lba |= (cdb[16] << 24);
+-	lba |= (cdb[17] << 16);
+-	lba |= (cdb[18] << 8);
+-	lba |=  cdb[19];
+-	ei_lbrt |= (cdb[20] << 24);
+-	ei_lbrt |= (cdb[21] << 16);
+-	ei_lbrt |= (cdb[22] << 8);
+-	ei_lbrt |=  cdb[23];
+-	txlen |= (cdb[28] << 24);
+-	txlen |= (cdb[29] << 16);
+-	txlen |= (cdb[30] << 8);
+-	txlen |=  cdb[31];
+-
+-	trace_seq_printf(p, "%s_32 lba=%llu txlen=%llu protect=%u ei_lbrt=%u",
+-			 cmd, (unsigned long long)lba,
+-			 (unsigned long long)txlen, cdb[10] >> 5, ei_lbrt);
++	lba = get_unaligned_be64(&cdb[12]);
++	ei_lbrt = get_unaligned_be32(&cdb[20]);
++	txlen = get_unaligned_be32(&cdb[28]);
++
++	trace_seq_printf(p, "%s_32 lba=%llu txlen=%u protect=%u ei_lbrt=%u",
++			 cmd, lba, txlen, cdb[10] >> 5, ei_lbrt);
+ 
+ 	if (SERVICE_ACTION32(cdb) == WRITE_SAME_32)
+ 		trace_seq_printf(p, " unmap=%u", cdb[10] >> 3 & 1);
+@@ -185,7 +149,7 @@ static const char *
+ scsi_trace_unmap(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ 	const char *ret = trace_seq_buffer_ptr(p);
+-	unsigned int regions = cdb[7] << 8 | cdb[8];
++	unsigned int regions = get_unaligned_be16(&cdb[7]);
+ 
+ 	trace_seq_printf(p, "regions=%u", (regions - 8) / 16);
+ 	trace_seq_putc(p, 0);
+@@ -197,8 +161,8 @@ static const char *
+ scsi_trace_service_action_in(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ 	const char *ret = trace_seq_buffer_ptr(p), *cmd;
+-	sector_t lba = 0;
+-	u32 alloc_len = 0;
++	u64 lba;
++	u32 alloc_len;
+ 
+ 	switch (SERVICE_ACTION16(cdb)) {
+ 	case SAI_READ_CAPACITY_16:
+@@ -212,21 +176,10 @@ scsi_trace_service_action_in(struct trace_seq *p, unsigned char *cdb, int len)
+ 		goto out;
+ 	}
+ 
+-	lba |= ((u64)cdb[2] << 56);
+-	lba |= ((u64)cdb[3] << 48);
+-	lba |= ((u64)cdb[4] << 40);
+-	lba |= ((u64)cdb[5] << 32);
+-	lba |= (cdb[6] << 24);
+-	lba |= (cdb[7] << 16);
+-	lba |= (cdb[8] << 8);
+-	lba |=  cdb[9];
+-	alloc_len |= (cdb[10] << 24);
+-	alloc_len |= (cdb[11] << 16);
+-	alloc_len |= (cdb[12] << 8);
+-	alloc_len |=  cdb[13];
+-
+-	trace_seq_printf(p, "%s lba=%llu alloc_len=%u", cmd,
+-			 (unsigned long long)lba, alloc_len);
++	lba = get_unaligned_be64(&cdb[2]);
++	alloc_len = get_unaligned_be32(&cdb[10]);
++
++	trace_seq_printf(p, "%s lba=%llu alloc_len=%u", cmd, lba, alloc_len);
+ 
+ out:
+ 	trace_seq_putc(p, 0);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index b40fe8d583c0..62d6955ac69b 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2005,8 +2005,10 @@ static int sd_read_protection_type(struct scsi_disk *sdkp, unsigned char *buffer
+ 	u8 type;
+ 	int ret = 0;
+ 
+-	if (scsi_device_protection(sdp) == 0 || (buffer[12] & 1) == 0)
++	if (scsi_device_protection(sdp) == 0 || (buffer[12] & 1) == 0) {
++		sdkp->protection_type = 0;
+ 		return ret;
++	}
+ 
+ 	type = ((buffer[12] >> 1) & 7) + 1; /* P_TYPE 0 = Type 1 */
+ 
+diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
+index 691c04b3e5b6..938840af9c50 100644
+--- a/drivers/spi/spi-atmel.c
++++ b/drivers/spi/spi-atmel.c
+@@ -315,7 +315,6 @@ struct atmel_spi {
+ 	struct atmel_spi_dma	dma;
+ 
+ 	bool			keep_cs;
+-	bool			cs_active;
+ 
+ 	u32			fifo_size;
+ };
+@@ -1404,11 +1403,9 @@ static int atmel_spi_one_transfer(struct spi_master *master,
+ 				 &msg->transfers)) {
+ 			as->keep_cs = true;
+ 		} else {
+-			as->cs_active = !as->cs_active;
+-			if (as->cs_active)
+-				cs_activate(as, msg->spi);
+-			else
+-				cs_deactivate(as, msg->spi);
++			cs_deactivate(as, msg->spi);
++			udelay(10);
++			cs_activate(as, msg->spi);
+ 		}
+ 	}
+ 
+@@ -1431,7 +1428,6 @@ static int atmel_spi_transfer_one_message(struct spi_master *master,
+ 	atmel_spi_lock(as);
+ 	cs_activate(as, spi);
+ 
+-	as->cs_active = true;
+ 	as->keep_cs = false;
+ 
+ 	msg->status = 0;
+diff --git a/drivers/target/target_core_fabric_lib.c b/drivers/target/target_core_fabric_lib.c
+index cb6497ce4b61..6e75095af681 100644
+--- a/drivers/target/target_core_fabric_lib.c
++++ b/drivers/target/target_core_fabric_lib.c
+@@ -130,7 +130,7 @@ static int srp_get_pr_transport_id(
+ 	memset(buf + 8, 0, leading_zero_bytes);
+ 	rc = hex2bin(buf + 8 + leading_zero_bytes, p, count);
+ 	if (rc < 0) {
+-		pr_debug("hex2bin failed for %s: %d\n", __func__, rc);
++		pr_debug("hex2bin failed for %s: %d\n", p, rc);
+ 		return rc;
+ 	}
+ 
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 6d596c635159..e75bd8d7e6f6 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -548,7 +548,7 @@ static void imx_dma_tx(struct imx_port *sport)
+ 		dev_err(dev, "DMA mapping error for TX.\n");
+ 		return;
+ 	}
+-	desc = dmaengine_prep_slave_sg(chan, sgl, sport->dma_tx_nents,
++	desc = dmaengine_prep_slave_sg(chan, sgl, ret,
+ 					DMA_MEM_TO_DEV, DMA_PREP_INTERRUPT);
+ 	if (!desc) {
+ 		dma_unmap_sg(dev, sgl, sport->dma_tx_nents,
+diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
+index 42caccb5e87e..30b577384a1d 100644
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -252,6 +252,7 @@ struct eg20t_port {
+ 	struct dma_chan			*chan_rx;
+ 	struct scatterlist		*sg_tx_p;
+ 	int				nent;
++	int				orig_nent;
+ 	struct scatterlist		sg_rx;
+ 	int				tx_dma_use;
+ 	void				*rx_buf_virt;
+@@ -806,9 +807,10 @@ static void pch_dma_tx_complete(void *arg)
+ 	}
+ 	xmit->tail &= UART_XMIT_SIZE - 1;
+ 	async_tx_ack(priv->desc_tx);
+-	dma_unmap_sg(port->dev, sg, priv->nent, DMA_TO_DEVICE);
++	dma_unmap_sg(port->dev, sg, priv->orig_nent, DMA_TO_DEVICE);
+ 	priv->tx_dma_use = 0;
+ 	priv->nent = 0;
++	priv->orig_nent = 0;
+ 	kfree(priv->sg_tx_p);
+ 	pch_uart_hal_enable_interrupt(priv, PCH_UART_HAL_TX_INT);
+ }
+@@ -1033,6 +1035,7 @@ static unsigned int dma_handle_tx(struct eg20t_port *priv)
+ 		dev_err(priv->port.dev, "%s:dma_map_sg Failed\n", __func__);
+ 		return 0;
+ 	}
++	priv->orig_nent = num;
+ 	priv->nent = nent;
+ 
+ 	for (i = 0; i < nent; i++, sg++) {
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index acf4752302a6..9f05f9a81f69 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1162,6 +1162,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ 			 * PORT_OVER_CURRENT is not. So check for any of them.
+ 			 */
+ 			if (udev || (portstatus & USB_PORT_STAT_CONNECTION) ||
++			    (portchange & USB_PORT_STAT_C_CONNECTION) ||
+ 			    (portstatus & USB_PORT_STAT_OVERCURRENT) ||
+ 			    (portchange & USB_PORT_STAT_C_OVERCURRENT))
+ 				set_bit(port1, hub->change_bits);
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index 9a2c0c76d11b..0291dc7cd284 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -555,9 +555,13 @@ static int ch341_tiocmget(struct tty_struct *tty)
+ static int ch341_reset_resume(struct usb_serial *serial)
+ {
+ 	struct usb_serial_port *port = serial->port[0];
+-	struct ch341_private *priv = usb_get_serial_port_data(port);
++	struct ch341_private *priv;
+ 	int ret;
+ 
++	priv = usb_get_serial_port_data(port);
++	if (!priv)
++		return 0;
++
+ 	/* reconfigure ch341 serial port after bus-reset */
+ 	ch341_configure(serial->dev, priv);
+ 
+diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
+index e5649adcc84c..191588006e0e 100644
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -572,6 +572,7 @@ static void edge_interrupt_callback(struct urb *urb)
+ 	struct usb_serial_port *port;
+ 	unsigned char *data = urb->transfer_buffer;
+ 	int length = urb->actual_length;
++	unsigned long flags;
+ 	int bytes_avail;
+ 	int position;
+ 	int txCredits;
+@@ -603,7 +604,7 @@ static void edge_interrupt_callback(struct urb *urb)
+ 		if (length > 1) {
+ 			bytes_avail = data[0] | (data[1] << 8);
+ 			if (bytes_avail) {
+-				spin_lock(&edge_serial->es_lock);
++				spin_lock_irqsave(&edge_serial->es_lock, flags);
+ 				edge_serial->rxBytesAvail += bytes_avail;
+ 				dev_dbg(dev,
+ 					"%s - bytes_avail=%d, rxBytesAvail=%d, read_in_progress=%d\n",
+@@ -626,7 +627,8 @@ static void edge_interrupt_callback(struct urb *urb)
+ 						edge_serial->read_in_progress = false;
+ 					}
+ 				}
+-				spin_unlock(&edge_serial->es_lock);
++				spin_unlock_irqrestore(&edge_serial->es_lock,
++						       flags);
+ 			}
+ 		}
+ 		/* grab the txcredits for the ports if available */
+@@ -638,10 +640,12 @@ static void edge_interrupt_callback(struct urb *urb)
+ 			if (txCredits) {
+ 				port = edge_serial->serial->port[portNumber];
+ 				edge_port = usb_get_serial_port_data(port);
+-				if (edge_port->open) {
+-					spin_lock(&edge_port->ep_lock);
++				if (edge_port && edge_port->open) {
++					spin_lock_irqsave(&edge_port->ep_lock,
++							  flags);
+ 					edge_port->txCredits += txCredits;
+-					spin_unlock(&edge_port->ep_lock);
++					spin_unlock_irqrestore(&edge_port->ep_lock,
++							       flags);
+ 					dev_dbg(dev, "%s - txcredits for port%d = %d\n",
+ 						__func__, portNumber,
+ 						edge_port->txCredits);
+@@ -682,6 +686,7 @@ static void edge_bulk_in_callback(struct urb *urb)
+ 	int			retval;
+ 	__u16			raw_data_length;
+ 	int status = urb->status;
++	unsigned long flags;
+ 
+ 	if (status) {
+ 		dev_dbg(&urb->dev->dev, "%s - nonzero read bulk status received: %d\n",
+@@ -701,7 +706,7 @@ static void edge_bulk_in_callback(struct urb *urb)
+ 
+ 	usb_serial_debug_data(dev, __func__, raw_data_length, data);
+ 
+-	spin_lock(&edge_serial->es_lock);
++	spin_lock_irqsave(&edge_serial->es_lock, flags);
+ 
+ 	/* decrement our rxBytes available by the number that we just got */
+ 	edge_serial->rxBytesAvail -= raw_data_length;
+@@ -725,7 +730,7 @@ static void edge_bulk_in_callback(struct urb *urb)
+ 		edge_serial->read_in_progress = false;
+ 	}
+ 
+-	spin_unlock(&edge_serial->es_lock);
++	spin_unlock_irqrestore(&edge_serial->es_lock, flags);
+ }
+ 
+ 
+@@ -1662,7 +1667,8 @@ static void edge_break(struct tty_struct *tty, int break_state)
+ static void process_rcvd_data(struct edgeport_serial *edge_serial,
+ 				unsigned char *buffer, __u16 bufferLength)
+ {
+-	struct device *dev = &edge_serial->serial->dev->dev;
++	struct usb_serial *serial = edge_serial->serial;
++	struct device *dev = &serial->dev->dev;
+ 	struct usb_serial_port *port;
+ 	struct edgeport_port *edge_port;
+ 	__u16 lastBufferLength;
+@@ -1767,11 +1773,10 @@ static void process_rcvd_data(struct edgeport_serial *edge_serial,
+ 
+ 			/* spit this data back into the tty driver if this
+ 			   port is open */
+-			if (rxLen) {
+-				port = edge_serial->serial->port[
+-							edge_serial->rxPort];
++			if (rxLen && edge_serial->rxPort < serial->num_ports) {
++				port = serial->port[edge_serial->rxPort];
+ 				edge_port = usb_get_serial_port_data(port);
+-				if (edge_port->open) {
++				if (edge_port && edge_port->open) {
+ 					dev_dbg(dev, "%s - Sending %d bytes to TTY for port %d\n",
+ 						__func__, rxLen,
+ 						edge_serial->rxPort);
+@@ -1779,8 +1784,8 @@ static void process_rcvd_data(struct edgeport_serial *edge_serial,
+ 							rxLen);
+ 					edge_port->port->icount.rx += rxLen;
+ 				}
+-				buffer += rxLen;
+ 			}
++			buffer += rxLen;
+ 			break;
+ 
+ 		case EXPECT_HDR3:	/* Expect 3rd byte of status header */
+@@ -1815,6 +1820,8 @@ static void process_rcvd_status(struct edgeport_serial *edge_serial,
+ 	__u8 code = edge_serial->rxStatusCode;
+ 
+ 	/* switch the port pointer to the one being currently talked about */
++	if (edge_serial->rxPort >= edge_serial->serial->num_ports)
++		return;
+ 	port = edge_serial->serial->port[edge_serial->rxPort];
+ 	edge_port = usb_get_serial_port_data(port);
+ 	if (edge_port == NULL) {
+diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
+index 185ef1d8c6cd..e08755e9b612 100644
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -567,6 +567,8 @@ static void	usa49_glocont_callback(struct urb *urb)
+ 	for (i = 0; i < serial->num_ports; ++i) {
+ 		port = serial->port[i];
+ 		p_priv = usb_get_serial_port_data(port);
++		if (!p_priv)
++			continue;
+ 
+ 		if (p_priv->resend_cont) {
+ 			dev_dbg(&port->dev, "%s - sending setup\n", __func__);
+@@ -968,6 +970,8 @@ static void usa67_glocont_callback(struct urb *urb)
+ 	for (i = 0; i < serial->num_ports; ++i) {
+ 		port = serial->port[i];
+ 		p_priv = usb_get_serial_port_data(port);
++		if (!p_priv)
++			continue;
+ 
+ 		if (p_priv->resend_cont) {
+ 			dev_dbg(&port->dev, "%s - sending setup\n", __func__);
+diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
+index 64bf258e7e00..9606dde3194c 100644
+--- a/drivers/usb/serial/opticon.c
++++ b/drivers/usb/serial/opticon.c
+@@ -116,7 +116,7 @@ static int send_control_msg(struct usb_serial_port *port, u8 requesttype,
+ 	retval = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
+ 				requesttype,
+ 				USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE,
+-				0, 0, buffer, 1, 0);
++				0, 0, buffer, 1, USB_CTRL_SET_TIMEOUT);
+ 	kfree(buffer);
+ 
+ 	if (retval < 0)
+diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c
+index 1d17779b2203..19952ccd028a 100644
+--- a/drivers/usb/serial/quatech2.c
++++ b/drivers/usb/serial/quatech2.c
+@@ -872,7 +872,10 @@ static void qt2_update_msr(struct usb_serial_port *port, unsigned char *ch)
+ 	u8 newMSR = (u8) *ch;
+ 	unsigned long flags;
+ 
++	/* May be called from qt2_process_read_urb() for an unbound port. */
+ 	port_priv = usb_get_serial_port_data(port);
++	if (!port_priv)
++		return;
+ 
+ 	spin_lock_irqsave(&port_priv->lock, flags);
+ 	port_priv->shadowMSR = newMSR;
+@@ -900,7 +903,10 @@ static void qt2_update_lsr(struct usb_serial_port *port, unsigned char *ch)
+ 	unsigned long flags;
+ 	u8 newLSR = (u8) *ch;
+ 
++	/* May be called from qt2_process_read_urb() for an unbound port. */
+ 	port_priv = usb_get_serial_port_data(port);
++	if (!port_priv)
++		return;
+ 
+ 	if (newLSR & UART_LSR_BI)
+ 		newLSR &= (u8) (UART_LSR_OE | UART_LSR_BI);
+diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
+index 511242111403..15e05ebf37ac 100644
+--- a/drivers/usb/serial/usb-serial-simple.c
++++ b/drivers/usb/serial/usb-serial-simple.c
+@@ -89,6 +89,8 @@ DEVICE(moto_modem, MOTO_IDS);
+ #define MOTOROLA_TETRA_IDS()			\
+ 	{ USB_DEVICE(0x0cad, 0x9011) },	/* Motorola Solutions TETRA PEI */ \
+ 	{ USB_DEVICE(0x0cad, 0x9012) },	/* MTP6550 */ \
++	{ USB_DEVICE(0x0cad, 0x9013) },	/* MTP3xxx */ \
++	{ USB_DEVICE(0x0cad, 0x9015) },	/* MTP85xx */ \
+ 	{ USB_DEVICE(0x0cad, 0x9016) }	/* TPG2200 */
+ DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS);
+ 
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index a894c0fdc04b..8a24a11b7ffc 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -1351,6 +1351,9 @@ static int usb_serial_register(struct usb_serial_driver *driver)
+ 		return -EINVAL;
+ 	}
+ 
++	/* Prevent individual ports from being unbound. */
++	driver->driver.suppress_bind_attrs = true;
++
+ 	usb_serial_operations_init(driver);
+ 
+ 	/* Add this device to our list of devices */
+diff --git a/firmware/Makefile b/firmware/Makefile
+index e297e1b52636..03232621cc08 100644
+--- a/firmware/Makefile
++++ b/firmware/Makefile
+@@ -156,7 +156,7 @@ quiet_cmd_fwbin = MK_FW   $@
+ 		  PROGBITS=$(if $(CONFIG_ARM),%,@)progbits;		     \
+ 		  echo "/* Generated by firmware/Makefile */"		> $@;\
+ 		  echo "    .section .rodata"				>>$@;\
+-		  echo "    .p2align $${ASM_ALIGN}"			>>$@;\
++		  echo "    .p2align 4"					>>$@;\
+ 		  echo "_fw_$${FWSTR}_bin:"				>>$@;\
+ 		  echo "    .incbin \"$(2)\""				>>$@;\
+ 		  echo "_fw_end:"					>>$@;\
+diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
+index 41f1a5dd33a5..4dcce3f034f4 100644
+--- a/fs/cifs/smb2file.c
++++ b/fs/cifs/smb2file.c
+@@ -69,7 +69,7 @@ smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms,
+ 		goto out;
+ 
+ 
+-	 if (oparms->tcon->use_resilient) {
++	if (oparms->tcon->use_resilient) {
+ 		nr_ioctl_req.Timeout = 0; /* use server default (120 seconds) */
+ 		nr_ioctl_req.Reserved = 0;
+ 		rc = SMB2_ioctl(xid, oparms->tcon, fid->persistent_fid,
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 00c320e2ba1e..8133e6529994 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5472,10 +5472,25 @@ static int ext4_expand_extra_isize(struct inode *inode,
+ {
+ 	struct ext4_inode *raw_inode;
+ 	struct ext4_xattr_ibody_header *header;
++	unsigned int inode_size = EXT4_INODE_SIZE(inode->i_sb);
++	struct ext4_inode_info *ei = EXT4_I(inode);
+ 
+ 	if (EXT4_I(inode)->i_extra_isize >= new_extra_isize)
+ 		return 0;
+ 
++	/* this was checked at iget time, but double check for good measure */
++	if ((EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize > inode_size) ||
++	    (ei->i_extra_isize & 3)) {
++		EXT4_ERROR_INODE(inode, "bad extra_isize %u (inode size %u)",
++				 ei->i_extra_isize,
++				 EXT4_INODE_SIZE(inode->i_sb));
++		return -EFSCORRUPTED;
++	}
++	if ((new_extra_isize < ei->i_extra_isize) ||
++	    (new_extra_isize < 4) ||
++	    (new_extra_isize > inode_size - EXT4_GOOD_OLD_INODE_SIZE))
++		return -EINVAL;	/* Should never happen */
++
+ 	raw_inode = ext4_raw_inode(&iloc);
+ 
+ 	header = IHDR(inode, raw_inode);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 3261478bfc32..391ab55808c9 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3342,6 +3342,40 @@ int ext4_calculate_overhead(struct super_block *sb)
+ 	return 0;
+ }
+ 
++static void ext4_clamp_want_extra_isize(struct super_block *sb)
++{
++	struct ext4_sb_info *sbi = EXT4_SB(sb);
++	struct ext4_super_block *es = sbi->s_es;
++	unsigned def_extra_isize = sizeof(struct ext4_inode) -
++						EXT4_GOOD_OLD_INODE_SIZE;
++
++	if (sbi->s_inode_size == EXT4_GOOD_OLD_INODE_SIZE) {
++		sbi->s_want_extra_isize = 0;
++		return;
++	}
++	if (sbi->s_want_extra_isize < 4) {
++		sbi->s_want_extra_isize = def_extra_isize;
++		if (ext4_has_feature_extra_isize(sb)) {
++			if (sbi->s_want_extra_isize <
++			    le16_to_cpu(es->s_want_extra_isize))
++				sbi->s_want_extra_isize =
++					le16_to_cpu(es->s_want_extra_isize);
++			if (sbi->s_want_extra_isize <
++			    le16_to_cpu(es->s_min_extra_isize))
++				sbi->s_want_extra_isize =
++					le16_to_cpu(es->s_min_extra_isize);
++		}
++	}
++	/* Check if enough inode space is available */
++	if ((sbi->s_want_extra_isize > sbi->s_inode_size) ||
++	    (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >
++							sbi->s_inode_size)) {
++		sbi->s_want_extra_isize = def_extra_isize;
++		ext4_msg(sb, KERN_INFO,
++			 "required extra inode space not available");
++	}
++}
++
+ static void ext4_set_resv_clusters(struct super_block *sb)
+ {
+ 	ext4_fsblk_t resv_clusters;
+@@ -4156,29 +4190,7 @@ no_journal:
+ 	if (ext4_setup_super(sb, es, sb->s_flags & MS_RDONLY))
+ 		sb->s_flags |= MS_RDONLY;
+ 
+-	/* determine the minimum size of new large inodes, if present */
+-	if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE) {
+-		sbi->s_want_extra_isize = sizeof(struct ext4_inode) -
+-						     EXT4_GOOD_OLD_INODE_SIZE;
+-		if (ext4_has_feature_extra_isize(sb)) {
+-			if (sbi->s_want_extra_isize <
+-			    le16_to_cpu(es->s_want_extra_isize))
+-				sbi->s_want_extra_isize =
+-					le16_to_cpu(es->s_want_extra_isize);
+-			if (sbi->s_want_extra_isize <
+-			    le16_to_cpu(es->s_min_extra_isize))
+-				sbi->s_want_extra_isize =
+-					le16_to_cpu(es->s_min_extra_isize);
+-		}
+-	}
+-	/* Check if enough inode space is available */
+-	if (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >
+-							sbi->s_inode_size) {
+-		sbi->s_want_extra_isize = sizeof(struct ext4_inode) -
+-						       EXT4_GOOD_OLD_INODE_SIZE;
+-		ext4_msg(sb, KERN_INFO, "required extra inode space not"
+-			 "available");
+-	}
++	ext4_clamp_want_extra_isize(sb);
+ 
+ 	ext4_set_resv_clusters(sb);
+ 
+@@ -4959,6 +4971,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ 		goto restore_opts;
+ 	}
+ 
++	ext4_clamp_want_extra_isize(sb);
++
+ 	if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^
+ 	    test_opt(sb, JOURNAL_CHECKSUM)) {
+ 		ext4_msg(sb, KERN_ERR, "changing journal_checksum "
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 0206c8c20784..b2cccd4083b8 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1267,7 +1267,7 @@ static int f2fs_write_data_page(struct page *page,
+ 	loff_t i_size = i_size_read(inode);
+ 	const pgoff_t end_index = ((unsigned long long) i_size)
+ 							>> PAGE_SHIFT;
+-	loff_t psize = (page->index + 1) << PAGE_SHIFT;
++	loff_t psize = (loff_t)(page->index + 1) << PAGE_SHIFT;
+ 	unsigned offset = 0;
+ 	bool need_balance_fs = false;
+ 	int err = 0;
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index f46ac1651bd5..e3c438c8b8ce 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -980,7 +980,7 @@ static int __clone_blkaddrs(struct inode *src_inode, struct inode *dst_inode,
+ 				}
+ 				dn.ofs_in_node++;
+ 				i++;
+-				new_size = (dst + i) << PAGE_SHIFT;
++				new_size = (loff_t)(dst + i) << PAGE_SHIFT;
+ 				if (dst_inode->i_size < new_size)
+ 					f2fs_i_size_write(dst_inode, new_size);
+ 			} while (--ilen && (do_replace[i] || blkaddr[i] == NULL_ADDR));
+diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
+index 13cf69aa4cae..733c05135305 100644
+--- a/fs/ocfs2/journal.c
++++ b/fs/ocfs2/journal.c
+@@ -1080,6 +1080,14 @@ int ocfs2_journal_load(struct ocfs2_journal *journal, int local, int replayed)
+ 
+ 	ocfs2_clear_journal_error(osb->sb, journal->j_journal, osb->slot_num);
+ 
++	if (replayed) {
++		jbd2_journal_lock_updates(journal->j_journal);
++		status = jbd2_journal_flush(journal->j_journal);
++		jbd2_journal_unlock_updates(journal->j_journal);
++		if (status < 0)
++			mlog_errno(status);
++	}
++
+ 	status = ocfs2_journal_toggle_dirty(osb, 1, replayed);
+ 	if (status < 0) {
+ 		mlog_errno(status);
+diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
+index dbc2ada9884f..07900105523f 100644
+--- a/fs/reiserfs/xattr.c
++++ b/fs/reiserfs/xattr.c
+@@ -318,8 +318,12 @@ static int reiserfs_for_each_xattr(struct inode *inode,
+ out_dir:
+ 	dput(dir);
+ out:
+-	/* -ENODATA isn't an error */
+-	if (err == -ENODATA)
++	/*
++	 * -ENODATA: this object doesn't have any xattrs
++	 * -EOPNOTSUPP: this file system doesn't have xattrs enabled on disk.
++	 * Neither are errors
++	 */
++	if (err == -ENODATA || err == -EOPNOTSUPP)
+ 		err = 0;
+ 	return err;
+ }
+diff --git a/include/dt-bindings/reset/amlogic,meson8b-reset.h b/include/dt-bindings/reset/amlogic,meson8b-reset.h
+index 614aff2c7aff..a03e86fe2c57 100644
+--- a/include/dt-bindings/reset/amlogic,meson8b-reset.h
++++ b/include/dt-bindings/reset/amlogic,meson8b-reset.h
+@@ -95,9 +95,9 @@
+ #define RESET_VD_RMEM			64
+ #define RESET_AUDIN			65
+ #define RESET_DBLK			66
+-#define RESET_PIC_DC			66
+-#define RESET_PSC			66
+-#define RESET_NAND			66
++#define RESET_PIC_DC			67
++#define RESET_PSC			68
++#define RESET_NAND			69
+ #define RESET_GE2D			70
+ #define RESET_PARSER_REG		71
+ #define RESET_PARSER_FETCH		72
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 7582a5712458..2fc4ba6fa07f 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -277,6 +277,7 @@ struct queue_limits {
+ 	unsigned int		max_sectors;
+ 	unsigned int		max_segment_size;
+ 	unsigned int		physical_block_size;
++	unsigned int		logical_block_size;
+ 	unsigned int		alignment_offset;
+ 	unsigned int		io_min;
+ 	unsigned int		io_opt;
+@@ -286,7 +287,6 @@ struct queue_limits {
+ 	unsigned int		discard_granularity;
+ 	unsigned int		discard_alignment;
+ 
+-	unsigned short		logical_block_size;
+ 	unsigned short		max_segments;
+ 	unsigned short		max_integrity_segments;
+ 
+@@ -996,7 +996,7 @@ extern void blk_queue_max_discard_sectors(struct request_queue *q,
+ 		unsigned int max_discard_sectors);
+ extern void blk_queue_max_write_same_sectors(struct request_queue *q,
+ 		unsigned int max_write_same_sectors);
+-extern void blk_queue_logical_block_size(struct request_queue *, unsigned short);
++extern void blk_queue_logical_block_size(struct request_queue *, unsigned int);
+ extern void blk_queue_physical_block_size(struct request_queue *, unsigned int);
+ extern void blk_queue_alignment_offset(struct request_queue *q,
+ 				       unsigned int alignment);
+@@ -1221,7 +1221,7 @@ static inline unsigned int queue_max_segment_size(struct request_queue *q)
+ 	return q->limits.max_segment_size;
+ }
+ 
+-static inline unsigned short queue_logical_block_size(struct request_queue *q)
++static inline unsigned queue_logical_block_size(struct request_queue *q)
+ {
+ 	int retval = 512;
+ 
+@@ -1231,7 +1231,7 @@ static inline unsigned short queue_logical_block_size(struct request_queue *q)
+ 	return retval;
+ }
+ 
+-static inline unsigned short bdev_logical_block_size(struct block_device *bdev)
++static inline unsigned int bdev_logical_block_size(struct block_device *bdev)
+ {
+ 	return queue_logical_block_size(bdev_get_queue(bdev));
+ }
+diff --git a/include/linux/poll.h b/include/linux/poll.h
+index 37b057b63b46..4bee398ed2fa 100644
+--- a/include/linux/poll.h
++++ b/include/linux/poll.h
+@@ -14,7 +14,11 @@
+ extern struct ctl_table epoll_table[]; /* for sysctl */
+ /* ~832 bytes of stack space used max in sys_select/sys_poll before allocating
+    additional memory. */
++#ifdef __clang__
++#define MAX_STACK_ALLOC 768
++#else
+ #define MAX_STACK_ALLOC 832
++#endif
+ #define FRONTEND_STACK_ALLOC	256
+ #define SELECT_STACK_ALLOC	FRONTEND_STACK_ALLOC
+ #define POLL_STACK_ALLOC	FRONTEND_STACK_ALLOC
+diff --git a/include/linux/regulator/ab8500.h b/include/linux/regulator/ab8500.h
+index 260c4aa1d976..3f6b8b9ef49d 100644
+--- a/include/linux/regulator/ab8500.h
++++ b/include/linux/regulator/ab8500.h
+@@ -43,8 +43,6 @@ enum ab8505_regulator_id {
+ 	AB8505_LDO_ANAMIC2,
+ 	AB8505_LDO_AUX8,
+ 	AB8505_LDO_ANA,
+-	AB8505_SYSCLKREQ_2,
+-	AB8505_SYSCLKREQ_4,
+ 	AB8505_NUM_REGULATORS,
+ };
+ 
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 9d57639223c3..28a0d7a8c142 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4181,6 +4181,17 @@ static inline const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
+ const u8 *cfg80211_find_vendor_ie(unsigned int oui, int oui_type,
+ 				  const u8 *ies, int len);
+ 
++/**
++ * cfg80211_send_layer2_update - send layer 2 update frame
++ *
++ * @dev: network device
++ * @addr: STA MAC address
++ *
++ * Wireless drivers can use this function to update forwarding tables in bridge
++ * devices upon STA association.
++ */
++void cfg80211_send_layer2_update(struct net_device *dev, const u8 *addr);
++
+ /**
+  * DOC: Regulatory enforcement infrastructure
+  *
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index f6a376a51099..462c778b9fb5 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -200,11 +200,11 @@ static void wb_min_max_ratio(struct bdi_writeback *wb,
+ 	if (this_bw < tot_bw) {
+ 		if (min) {
+ 			min *= this_bw;
+-			do_div(min, tot_bw);
++			min = div64_ul(min, tot_bw);
+ 		}
+ 		if (max < 100) {
+ 			max *= this_bw;
+-			do_div(max, tot_bw);
++			max = div64_ul(max, tot_bw);
+ 		}
+ 	}
+ 
+diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
+index df7c6a080188..3b440b8d7c05 100644
+--- a/net/batman-adv/distributed-arp-table.c
++++ b/net/batman-adv/distributed-arp-table.c
+@@ -242,6 +242,7 @@ static u32 batadv_hash_dat(const void *data, u32 size)
+ 	u32 hash = 0;
+ 	const struct batadv_dat_entry *dat = data;
+ 	const unsigned char *key;
++	__be16 vid;
+ 	u32 i;
+ 
+ 	key = (const unsigned char *)&dat->ip;
+@@ -251,7 +252,8 @@ static u32 batadv_hash_dat(const void *data, u32 size)
+ 		hash ^= (hash >> 6);
+ 	}
+ 
+-	key = (const unsigned char *)&dat->vid;
++	vid = htons(dat->vid);
++	key = (__force const unsigned char *)&vid;
+ 	for (i = 0; i < sizeof(dat->vid); i++) {
+ 		hash += key[i];
+ 		hash += (hash << 10);
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index 454f73fcb3a6..476665f917a2 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -2332,9 +2332,10 @@ out:
+ 	return ret;
+ }
+ 
+-static int ethtool_get_per_queue_coalesce(struct net_device *dev,
+-					  void __user *useraddr,
+-					  struct ethtool_per_queue_op *per_queue_opt)
++static noinline_for_stack int
++ethtool_get_per_queue_coalesce(struct net_device *dev,
++			       void __user *useraddr,
++			       struct ethtool_per_queue_op *per_queue_opt)
+ {
+ 	u32 bit;
+ 	int ret;
+@@ -2364,9 +2365,10 @@ static int ethtool_get_per_queue_coalesce(struct net_device *dev,
+ 	return 0;
+ }
+ 
+-static int ethtool_set_per_queue_coalesce(struct net_device *dev,
+-					  void __user *useraddr,
+-					  struct ethtool_per_queue_op *per_queue_opt)
++static noinline_for_stack int
++ethtool_set_per_queue_coalesce(struct net_device *dev,
++			       void __user *useraddr,
++			       struct ethtool_per_queue_op *per_queue_opt)
+ {
+ 	u32 bit;
+ 	int i, ret = 0;
+@@ -2423,7 +2425,7 @@ roll_back:
+ 	return ret;
+ }
+ 
+-static int ethtool_set_per_queue(struct net_device *dev,
++static int noinline_for_stack ethtool_set_per_queue(struct net_device *dev,
+ 				 void __user *useraddr, u32 sub_cmd)
+ {
+ 	struct ethtool_per_queue_op per_queue_opt;
+diff --git a/net/dccp/feat.c b/net/dccp/feat.c
+index f227f002c73d..db87d9f58019 100644
+--- a/net/dccp/feat.c
++++ b/net/dccp/feat.c
+@@ -738,7 +738,12 @@ static int __feat_register_sp(struct list_head *fn, u8 feat, u8 is_local,
+ 	if (dccp_feat_clone_sp_val(&fval, sp_val, sp_len))
+ 		return -ENOMEM;
+ 
+-	return dccp_feat_push_change(fn, feat, is_local, mandatory, &fval);
++	if (dccp_feat_push_change(fn, feat, is_local, mandatory, &fval)) {
++		kfree(fval.sp.vec);
++		return -ENOMEM;
++	}
++
++	return 0;
+ }
+ 
+ /**
+diff --git a/net/dsa/tag_qca.c b/net/dsa/tag_qca.c
+index 0c90cacee7aa..8108741cf8fb 100644
+--- a/net/dsa/tag_qca.c
++++ b/net/dsa/tag_qca.c
+@@ -40,9 +40,6 @@ static struct sk_buff *qca_tag_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	struct dsa_slave_priv *p = netdev_priv(dev);
+ 	u16 *phdr, hdr;
+ 
+-	dev->stats.tx_packets++;
+-	dev->stats.tx_bytes += skb->len;
+-
+ 	if (skb_cow_head(skb, 0) < 0)
+ 		goto out_free;
+ 
+diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
+index 52694cb759b0..aead5ac4dbf6 100644
+--- a/net/hsr/hsr_device.c
++++ b/net/hsr/hsr_device.c
+@@ -281,6 +281,8 @@ static void send_hsr_supervision_frame(struct hsr_port *master,
+ 			    skb->dev->dev_addr, skb->len) <= 0)
+ 		goto out;
+ 	skb_reset_mac_header(skb);
++	skb_reset_network_header(skb);
++	skb_reset_transport_header(skb);
+ 
+ 	if (hsrVer > 0) {
+ 		hsr_tag = (typeof(hsr_tag)) skb_put(skb, sizeof(struct hsr_tag));
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index d819e91df90d..e02b86265194 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -515,12 +515,13 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
+ 	return 0;
+ }
+ 
+-static inline void cleanup_entry(struct arpt_entry *e)
++static void cleanup_entry(struct arpt_entry *e, struct net *net)
+ {
+ 	struct xt_tgdtor_param par;
+ 	struct xt_entry_target *t;
+ 
+ 	t = arpt_get_target(e);
++	par.net      = net;
+ 	par.target   = t->u.kernel.target;
+ 	par.targinfo = t->data;
+ 	par.family   = NFPROTO_ARP;
+@@ -612,7 +613,7 @@ static int translate_table(struct net *net,
+ 		xt_entry_foreach(iter, entry0, newinfo->size) {
+ 			if (i-- == 0)
+ 				break;
+-			cleanup_entry(iter);
++			cleanup_entry(iter, net);
+ 		}
+ 		return ret;
+ 	}
+@@ -939,7 +940,7 @@ static int __do_replace(struct net *net, const char *name,
+ 	/* Decrease module usage counts and free resource */
+ 	loc_cpu_old_entry = oldinfo->entries;
+ 	xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
+-		cleanup_entry(iter);
++		cleanup_entry(iter, net);
+ 
+ 	xt_free_table_info(oldinfo);
+ 	if (copy_to_user(counters_ptr, counters,
+@@ -1003,7 +1004,7 @@ static int do_replace(struct net *net, const void __user *user,
+ 
+  free_newinfo_untrans:
+ 	xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+-		cleanup_entry(iter);
++		cleanup_entry(iter, net);
+  free_newinfo:
+ 	xt_free_table_info(newinfo);
+ 	return ret;
+@@ -1300,7 +1301,7 @@ static int compat_do_replace(struct net *net, void __user *user,
+ 
+  free_newinfo_untrans:
+ 	xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+-		cleanup_entry(iter);
++		cleanup_entry(iter, net);
+  free_newinfo:
+ 	xt_free_table_info(newinfo);
+ 	return ret;
+@@ -1527,7 +1528,7 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
+ 	return ret;
+ }
+ 
+-static void __arpt_unregister_table(struct xt_table *table)
++static void __arpt_unregister_table(struct net *net, struct xt_table *table)
+ {
+ 	struct xt_table_info *private;
+ 	void *loc_cpu_entry;
+@@ -1539,7 +1540,7 @@ static void __arpt_unregister_table(struct xt_table *table)
+ 	/* Decrease module usage counts and free resources */
+ 	loc_cpu_entry = private->entries;
+ 	xt_entry_foreach(iter, loc_cpu_entry, private->size)
+-		cleanup_entry(iter);
++		cleanup_entry(iter, net);
+ 	if (private->number > private->initial_entries)
+ 		module_put(table_owner);
+ 	xt_free_table_info(private);
+@@ -1579,7 +1580,7 @@ int arpt_register_table(struct net *net,
+ 
+ 	ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
+ 	if (ret != 0) {
+-		__arpt_unregister_table(new_table);
++		__arpt_unregister_table(net, new_table);
+ 		*res = NULL;
+ 	}
+ 
+@@ -1594,7 +1595,7 @@ void arpt_unregister_table(struct net *net, struct xt_table *table,
+ 			   const struct nf_hook_ops *ops)
+ {
+ 	nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
+-	__arpt_unregister_table(table);
++	__arpt_unregister_table(net, table);
+ }
+ 
+ /* The built-in targets: standard (NULL) and error. */
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 9644dcef5a2b..52014c5312b9 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -923,9 +923,10 @@ static void tcp_update_reordering(struct sock *sk, const int metric,
+ /* This must be called before lost_out is incremented */
+ static void tcp_verify_retransmit_hint(struct tcp_sock *tp, struct sk_buff *skb)
+ {
+-	if (!tp->retransmit_skb_hint ||
+-	    before(TCP_SKB_CB(skb)->seq,
+-		   TCP_SKB_CB(tp->retransmit_skb_hint)->seq))
++	if ((!tp->retransmit_skb_hint && tp->retrans_out >= tp->lost_out) ||
++	    (tp->retransmit_skb_hint &&
++	     before(TCP_SKB_CB(skb)->seq,
++		    TCP_SKB_CB(tp->retransmit_skb_hint)->seq)))
+ 		tp->retransmit_skb_hint = skb;
+ 
+ 	if (!tp->lost_out ||
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 3b2c4692d966..88dd5d218fe3 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1048,50 +1048,6 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
+ 	return 0;
+ }
+ 
+-/* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
+-struct iapp_layer2_update {
+-	u8 da[ETH_ALEN];	/* broadcast */
+-	u8 sa[ETH_ALEN];	/* STA addr */
+-	__be16 len;		/* 6 */
+-	u8 dsap;		/* 0 */
+-	u8 ssap;		/* 0 */
+-	u8 control;
+-	u8 xid_info[3];
+-} __packed;
+-
+-static void ieee80211_send_layer2_update(struct sta_info *sta)
+-{
+-	struct iapp_layer2_update *msg;
+-	struct sk_buff *skb;
+-
+-	/* Send Level 2 Update Frame to update forwarding tables in layer 2
+-	 * bridge devices */
+-
+-	skb = dev_alloc_skb(sizeof(*msg));
+-	if (!skb)
+-		return;
+-	msg = (struct iapp_layer2_update *)skb_put(skb, sizeof(*msg));
+-
+-	/* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
+-	 * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
+-
+-	eth_broadcast_addr(msg->da);
+-	memcpy(msg->sa, sta->sta.addr, ETH_ALEN);
+-	msg->len = htons(6);
+-	msg->dsap = 0;
+-	msg->ssap = 0x01;	/* NULL LSAP, CR Bit: Response */
+-	msg->control = 0xaf;	/* XID response lsb.1111F101.
+-				 * F=0 (no poll command; unsolicited frame) */
+-	msg->xid_info[0] = 0x81;	/* XID format identifier */
+-	msg->xid_info[1] = 1;	/* LLC types/classes: Type 1 LLC */
+-	msg->xid_info[2] = 0;	/* XID sender's receive window size (RW) */
+-
+-	skb->dev = sta->sdata->dev;
+-	skb->protocol = eth_type_trans(skb, sta->sdata->dev);
+-	memset(skb->cb, 0, sizeof(skb->cb));
+-	netif_rx_ni(skb);
+-}
+-
+ static int sta_apply_auth_flags(struct ieee80211_local *local,
+ 				struct sta_info *sta,
+ 				u32 mask, u32 set)
+@@ -1401,7 +1357,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
+ 	struct sta_info *sta;
+ 	struct ieee80211_sub_if_data *sdata;
+ 	int err;
+-	int layer2_update;
+ 
+ 	if (params->vlan) {
+ 		sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
+@@ -1445,18 +1400,12 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
+ 	    test_sta_flag(sta, WLAN_STA_ASSOC))
+ 		rate_control_rate_init(sta);
+ 
+-	layer2_update = sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+-		sdata->vif.type == NL80211_IFTYPE_AP;
+-
+ 	err = sta_info_insert_rcu(sta);
+ 	if (err) {
+ 		rcu_read_unlock();
+ 		return err;
+ 	}
+ 
+-	if (layer2_update)
+-		ieee80211_send_layer2_update(sta);
+-
+ 	rcu_read_unlock();
+ 
+ 	return 0;
+@@ -1565,7 +1514,9 @@ static int ieee80211_change_station(struct wiphy *wiphy,
+ 				atomic_inc(&sta->sdata->bss->num_mcast_sta);
+ 		}
+ 
+-		ieee80211_send_layer2_update(sta);
++		if (sta->sta_state == IEEE80211_STA_AUTHORIZED)
++			cfg80211_send_layer2_update(sta->sdata->dev,
++						    sta->sta.addr);
+ 	}
+ 
+ 	err = sta_apply_parameters(local, sta, params);
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 8e8a185dbb9b..c800bc7c5176 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1896,6 +1896,10 @@ int sta_info_move_state(struct sta_info *sta,
+ 			ieee80211_check_fast_xmit(sta);
+ 			ieee80211_check_fast_rx(sta);
+ 		}
++		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
++		    sta->sdata->vif.type == NL80211_IFTYPE_AP)
++			cfg80211_send_layer2_update(sta->sdata->dev,
++						    sta->sta.addr);
+ 		break;
+ 	default:
+ 		break;
+diff --git a/net/netfilter/ipset/ip_set_bitmap_gen.h b/net/netfilter/ipset/ip_set_bitmap_gen.h
+index 2e8e7e5fb4a6..9b32059dee2d 100644
+--- a/net/netfilter/ipset/ip_set_bitmap_gen.h
++++ b/net/netfilter/ipset/ip_set_bitmap_gen.h
+@@ -66,9 +66,9 @@ mtype_destroy(struct ip_set *set)
+ 	if (SET_WITH_TIMEOUT(set))
+ 		del_timer_sync(&map->gc);
+ 
+-	ip_set_free(map->members);
+ 	if (set->dsize && set->extensions & IPSET_EXT_DESTROY)
+ 		mtype_ext_cleanup(set);
++	ip_set_free(map->members);
+ 	ip_set_free(map);
+ 
+ 	set->data = NULL;
+diff --git a/net/socket.c b/net/socket.c
+index bf99bc1fab2c..65afc8ec68d4 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -3160,6 +3160,7 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
+ 	case SIOCSARP:
+ 	case SIOCGARP:
+ 	case SIOCDARP:
++	case SIOCOUTQNSD:
+ 	case SIOCATMARK:
+ 		return sock_do_ioctl(net, sock, cmd, arg);
+ 	}
+diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
+index 11cf83c8ad4f..8cd56eaba7d6 100644
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -525,6 +525,10 @@ static inline int
+ rdev_set_wiphy_params(struct cfg80211_registered_device *rdev, u32 changed)
+ {
+ 	int ret;
++
++	if (!rdev->ops->set_wiphy_params)
++		return -EOPNOTSUPP;
++
+ 	trace_rdev_set_wiphy_params(&rdev->wiphy, changed);
+ 	ret = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
+ 	trace_rdev_return_int(&rdev->wiphy, ret);
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index c93f333c675b..262922cf6a0c 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -653,7 +653,7 @@ __frame_add_frag(struct sk_buff *skb, struct page *page,
+ 	struct skb_shared_info *sh = skb_shinfo(skb);
+ 	int page_offset;
+ 
+-	page_ref_inc(page);
++	get_page(page);
+ 	page_offset = ptr - page_address(page);
+ 	skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size);
+ }
+@@ -1794,3 +1794,48 @@ EXPORT_SYMBOL(rfc1042_header);
+ const unsigned char bridge_tunnel_header[] __aligned(2) =
+ 	{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
+ EXPORT_SYMBOL(bridge_tunnel_header);
++
++/* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
++struct iapp_layer2_update {
++	u8 da[ETH_ALEN];	/* broadcast */
++	u8 sa[ETH_ALEN];	/* STA addr */
++	__be16 len;		/* 6 */
++	u8 dsap;		/* 0 */
++	u8 ssap;		/* 0 */
++	u8 control;
++	u8 xid_info[3];
++} __packed;
++
++void cfg80211_send_layer2_update(struct net_device *dev, const u8 *addr)
++{
++	struct iapp_layer2_update *msg;
++	struct sk_buff *skb;
++
++	/* Send Level 2 Update Frame to update forwarding tables in layer 2
++	 * bridge devices */
++
++	skb = dev_alloc_skb(sizeof(*msg));
++	if (!skb)
++		return;
++	msg = (struct iapp_layer2_update *)skb_put(skb, sizeof(*msg));
++
++	/* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
++	 * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
++
++	eth_broadcast_addr(msg->da);
++	ether_addr_copy(msg->sa, addr);
++	msg->len = htons(6);
++	msg->dsap = 0;
++	msg->ssap = 0x01;	/* NULL LSAP, CR Bit: Response */
++	msg->control = 0xaf;	/* XID response lsb.1111F101.
++				 * F=0 (no poll command; unsolicited frame) */
++	msg->xid_info[0] = 0x81;	/* XID format identifier */
++	msg->xid_info[1] = 1;	/* LLC types/classes: Type 1 LLC */
++	msg->xid_info[2] = 0;	/* XID sender's receive window size (RW) */
++
++	skb->dev = dev;
++	skb->protocol = eth_type_trans(skb, dev);
++	memset(skb->cb, 0, sizeof(skb->cb));
++	netif_rx_ni(skb);
++}
++EXPORT_SYMBOL(cfg80211_send_layer2_update);
+diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
+index b80985fbc334..0e1feb597586 100644
+--- a/sound/core/seq/seq_timer.c
++++ b/sound/core/seq/seq_timer.c
+@@ -479,15 +479,19 @@ void snd_seq_info_timer_read(struct snd_info_entry *entry,
+ 		q = queueptr(idx);
+ 		if (q == NULL)
+ 			continue;
+-		if ((tmr = q->timer) == NULL ||
+-		    (ti = tmr->timeri) == NULL) {
+-			queuefree(q);
+-			continue;
+-		}
++		mutex_lock(&q->timer_mutex);
++		tmr = q->timer;
++		if (!tmr)
++			goto unlock;
++		ti = tmr->timeri;
++		if (!ti)
++			goto unlock;
+ 		snd_iprintf(buffer, "Timer for queue %i : %s\n", q->queue, ti->timer->name);
+ 		resolution = snd_timer_resolution(ti) * tmr->ticks;
+ 		snd_iprintf(buffer, "  Period time : %lu.%09lu\n", resolution / 1000000000, resolution % 1000000000);
+ 		snd_iprintf(buffer, "  Skew : %u / %u\n", tmr->skew, tmr->skew_base);
++unlock:
++		mutex_unlock(&q->timer_mutex);
+ 		queuefree(q);
+  	}
+ }
+diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
+index 6e88460cd13d..0abca8783bb3 100644
+--- a/tools/perf/builtin-report.c
++++ b/tools/perf/builtin-report.c
+@@ -671,6 +671,7 @@ int cmd_report(int argc, const char **argv, const char *prefix __maybe_unused)
+ 	struct stat st;
+ 	bool has_br_stack = false;
+ 	int branch_mode = -1;
++	int last_key = 0;
+ 	bool branch_call_mode = false;
+ 	char callchain_default_opt[] = CALLCHAIN_DEFAULT_OPT;
+ 	const char * const report_usage[] = {
+@@ -956,7 +957,8 @@ repeat:
+ 	else
+ 		use_browser = 0;
+ 
+-	if (setup_sorting(session->evlist) < 0) {
++	if ((last_key != K_SWITCH_INPUT_DATA) &&
++	    (setup_sorting(session->evlist) < 0)) {
+ 		if (sort_order)
+ 			parse_options_usage(report_usage, options, "s", 1);
+ 		if (field_order)
+@@ -1011,6 +1013,7 @@ repeat:
+ 	ret = __cmd_report(&report);
+ 	if (ret == K_SWITCH_INPUT_DATA) {
+ 		perf_session__delete(session);
++		last_key = K_SWITCH_INPUT_DATA;
+ 		goto repeat;
+ 	} else
+ 		ret = 0;
+diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
+index 159d616e170b..fdd7a1cb6be9 100644
+--- a/tools/perf/util/hist.h
++++ b/tools/perf/util/hist.h
+@@ -312,10 +312,10 @@ static inline void perf_hpp__prepend_sort_field(struct perf_hpp_fmt *format)
+ 	list_for_each_entry_safe(format, tmp, &(_list)->sorts, sort_list)
+ 
+ #define hists__for_each_format(hists, format) \
+-	perf_hpp_list__for_each_format((hists)->hpp_list, fmt)
++	perf_hpp_list__for_each_format((hists)->hpp_list, format)
+ 
+ #define hists__for_each_sort_list(hists, format) \
+-	perf_hpp_list__for_each_sort_list((hists)->hpp_list, fmt)
++	perf_hpp_list__for_each_sort_list((hists)->hpp_list, format)
+ 
+ extern struct perf_hpp_fmt perf_hpp__format[];
+ 
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index 6ca804a01cf9..ffaa798df75e 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -612,38 +612,26 @@ static int convert_to_trace_point(Dwarf_Die *sp_die, Dwfl_Module *mod,
+ 				  const char *function,
+ 				  struct probe_trace_point *tp)
+ {
+-	Dwarf_Addr eaddr, highaddr;
++	Dwarf_Addr eaddr;
+ 	GElf_Sym sym;
+ 	const char *symbol;
+ 
+ 	/* Verify the address is correct */
+-	if (dwarf_entrypc(sp_die, &eaddr) != 0) {
+-		pr_warning("Failed to get entry address of %s\n",
+-			   dwarf_diename(sp_die));
+-		return -ENOENT;
+-	}
+-	if (dwarf_highpc(sp_die, &highaddr) != 0) {
+-		pr_warning("Failed to get end address of %s\n",
+-			   dwarf_diename(sp_die));
+-		return -ENOENT;
+-	}
+-	if (paddr > highaddr) {
+-		pr_warning("Offset specified is greater than size of %s\n",
++	if (!dwarf_haspc(sp_die, paddr)) {
++		pr_warning("Specified offset is out of %s\n",
+ 			   dwarf_diename(sp_die));
+ 		return -EINVAL;
+ 	}
+ 
+-	symbol = dwarf_diename(sp_die);
++	/* Try to get actual symbol name from symtab */
++	symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL);
+ 	if (!symbol) {
+-		/* Try to get the symbol name from symtab */
+-		symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL);
+-		if (!symbol) {
+-			pr_warning("Failed to find symbol at 0x%lx\n",
+-				   (unsigned long)paddr);
+-			return -ENOENT;
+-		}
+-		eaddr = sym.st_value;
++		pr_warning("Failed to find symbol at 0x%lx\n",
++			   (unsigned long)paddr);
++		return -ENOENT;
+ 	}
++	eaddr = sym.st_value;
++
+ 	tp->offset = (unsigned long)(paddr - eaddr);
+ 	tp->address = (unsigned long)paddr;
+ 	tp->symbol = strdup(symbol);
+diff --git a/tools/testing/selftests/rseq/settings b/tools/testing/selftests/rseq/settings
+new file mode 100644
+index 000000000000..e7b9417537fb
+--- /dev/null
++++ b/tools/testing/selftests/rseq/settings
+@@ -0,0 +1 @@
++timeout=0