Linux patch 4.9.624.9-64

2 files changed, 2938 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 664ecce7..d127ff48 100644
--- a/0000_README
+++ b/0000_README
@@ -287,6 +287,10 @@ Patch:  1060_linux-4.9.61.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.61
 
+Patch:  1061_linux-4.9.62.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.62
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1061_linux-4.9.62.patch b/1061_linux-4.9.62.patch
new file mode 100644
index 00000000..2283bf92
--- /dev/null
+++ b/1061_linux-4.9.62.patch
@@ -0,0 +1,2934 @@
+diff --git a/Documentation/devicetree/bindings/arm/davinci.txt b/Documentation/devicetree/bindings/arm/davinci.txt
+index f0841ce725b5..715622c36260 100644
+--- a/Documentation/devicetree/bindings/arm/davinci.txt
++++ b/Documentation/devicetree/bindings/arm/davinci.txt
+@@ -13,6 +13,10 @@ EnBW AM1808 based CMC board
+ Required root node properties:
+     - compatible = "enbw,cmc", "ti,da850;
+ 
++LEGO MINDSTORMS EV3 (AM1808 based)
++Required root node properties:
++    - compatible = "lego,ev3", "ti,da850";
++
+ Generic DaVinci Boards
+ ----------------------
+ 
+diff --git a/Documentation/devicetree/bindings/clock/qoriq-clock.txt b/Documentation/devicetree/bindings/clock/qoriq-clock.txt
+index 16a3ec433119..1bd2c76396f4 100644
+--- a/Documentation/devicetree/bindings/clock/qoriq-clock.txt
++++ b/Documentation/devicetree/bindings/clock/qoriq-clock.txt
+@@ -31,6 +31,7 @@ Required properties:
+ 	* "fsl,t4240-clockgen"
+ 	* "fsl,b4420-clockgen"
+ 	* "fsl,b4860-clockgen"
++	* "fsl,ls1012a-clockgen"
+ 	* "fsl,ls1021a-clockgen"
+ 	Chassis-version clock strings include:
+ 	* "fsl,qoriq-clockgen-1.0": for chassis 1.0 clocks
+diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
+index bceffffb7502..f949a22bcd74 100644
+--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
++++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
+@@ -154,6 +154,7 @@ kosagi	Sutajio Ko-Usagi PTE Ltd.
+ kyo	Kyocera Corporation
+ lacie	LaCie
+ lantiq	Lantiq Semiconductor
++lego	LEGO Systems A/S
+ lenovo	Lenovo Group Ltd.
+ lg	LG Corporation
+ linux	Linux-specific binding
+diff --git a/Makefile b/Makefile
+index b56b99e20b30..8ab48891d088 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 61
++SUBLEVEL = 62
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi b/arch/arm/boot/dts/imx53-qsb-common.dtsi
+index c05e7cfd0cbc..40b3e31935d0 100644
+--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi
++++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi
+@@ -215,16 +215,16 @@
+ 
+ 		pinctrl_fec: fecgrp {
+ 			fsl,pins = <
+-				MX53_PAD_FEC_MDC__FEC_MDC		0x80000000
+-				MX53_PAD_FEC_MDIO__FEC_MDIO		0x80000000
+-				MX53_PAD_FEC_REF_CLK__FEC_TX_CLK	0x80000000
+-				MX53_PAD_FEC_RX_ER__FEC_RX_ER		0x80000000
+-				MX53_PAD_FEC_CRS_DV__FEC_RX_DV		0x80000000
+-				MX53_PAD_FEC_RXD1__FEC_RDATA_1		0x80000000
+-				MX53_PAD_FEC_RXD0__FEC_RDATA_0		0x80000000
+-				MX53_PAD_FEC_TX_EN__FEC_TX_EN		0x80000000
+-				MX53_PAD_FEC_TXD1__FEC_TDATA_1		0x80000000
+-				MX53_PAD_FEC_TXD0__FEC_TDATA_0		0x80000000
++				MX53_PAD_FEC_MDC__FEC_MDC		0x4
++				MX53_PAD_FEC_MDIO__FEC_MDIO		0x1fc
++				MX53_PAD_FEC_REF_CLK__FEC_TX_CLK	0x180
++				MX53_PAD_FEC_RX_ER__FEC_RX_ER		0x180
++				MX53_PAD_FEC_CRS_DV__FEC_RX_DV		0x180
++				MX53_PAD_FEC_RXD1__FEC_RDATA_1		0x180
++				MX53_PAD_FEC_RXD0__FEC_RDATA_0		0x180
++				MX53_PAD_FEC_TX_EN__FEC_TX_EN		0x4
++				MX53_PAD_FEC_TXD1__FEC_TDATA_1		0x4
++				MX53_PAD_FEC_TXD0__FEC_TDATA_0		0x4
+ 			>;
+ 		};
+ 
+diff --git a/arch/arm/boot/dts/stih410.dtsi b/arch/arm/boot/dts/stih410.dtsi
+index a3ef7341c051..4d329b2908be 100644
+--- a/arch/arm/boot/dts/stih410.dtsi
++++ b/arch/arm/boot/dts/stih410.dtsi
+@@ -131,7 +131,7 @@
+ 						 <&clk_s_d2_quadfs 0>;
+ 
+ 			assigned-clock-rates = <297000000>,
+-					       <108000000>,
++					       <297000000>,
+ 					       <0>,
+ 					       <400000000>,
+ 					       <400000000>;
+diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
+index 53e1a884a1ea..66d71963761d 100644
+--- a/arch/arm/configs/omap2plus_defconfig
++++ b/arch/arm/configs/omap2plus_defconfig
+@@ -216,6 +216,7 @@ CONFIG_SERIO=m
+ CONFIG_SERIAL_8250=y
+ CONFIG_SERIAL_8250_CONSOLE=y
+ CONFIG_SERIAL_8250_NR_UARTS=32
++CONFIG_SERIAL_8250_RUNTIME_UARTS=6
+ CONFIG_SERIAL_8250_EXTENDED=y
+ CONFIG_SERIAL_8250_MANY_PORTS=y
+ CONFIG_SERIAL_8250_SHARE_IRQ=y
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index 9688ec0c6ef4..1b304897aa12 100644
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -152,30 +152,26 @@ static void dump_mem(const char *lvl, const char *str, unsigned long bottom,
+ 	set_fs(fs);
+ }
+ 
+-static void dump_instr(const char *lvl, struct pt_regs *regs)
++static void __dump_instr(const char *lvl, struct pt_regs *regs)
+ {
+ 	unsigned long addr = instruction_pointer(regs);
+ 	const int thumb = thumb_mode(regs);
+ 	const int width = thumb ? 4 : 8;
+-	mm_segment_t fs;
+ 	char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str;
+ 	int i;
+ 
+ 	/*
+-	 * We need to switch to kernel mode so that we can use __get_user
+-	 * to safely read from kernel space.  Note that we now dump the
+-	 * code first, just in case the backtrace kills us.
++	 * Note that we now dump the code first, just in case the backtrace
++	 * kills us.
+ 	 */
+-	fs = get_fs();
+-	set_fs(KERNEL_DS);
+ 
+ 	for (i = -4; i < 1 + !!thumb; i++) {
+ 		unsigned int val, bad;
+ 
+ 		if (thumb)
+-			bad = __get_user(val, &((u16 *)addr)[i]);
++			bad = get_user(val, &((u16 *)addr)[i]);
+ 		else
+-			bad = __get_user(val, &((u32 *)addr)[i]);
++			bad = get_user(val, &((u32 *)addr)[i]);
+ 
+ 		if (!bad)
+ 			p += sprintf(p, i == 0 ? "(%0*x) " : "%0*x ",
+@@ -186,8 +182,20 @@ static void dump_instr(const char *lvl, struct pt_regs *regs)
+ 		}
+ 	}
+ 	printk("%sCode: %s\n", lvl, str);
++}
+ 
+-	set_fs(fs);
++static void dump_instr(const char *lvl, struct pt_regs *regs)
++{
++	mm_segment_t fs;
++
++	if (!user_mode(regs)) {
++		fs = get_fs();
++		set_fs(KERNEL_DS);
++		__dump_instr(lvl, regs);
++		set_fs(fs);
++	} else {
++		__dump_instr(lvl, regs);
++	}
+ }
+ 
+ #ifdef CONFIG_ARM_UNWIND
+diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
+index b5bf46ce873b..cab3574ab7d9 100644
+--- a/arch/arm64/mm/dma-mapping.c
++++ b/arch/arm64/mm/dma-mapping.c
+@@ -836,14 +836,21 @@ static bool do_iommu_attach(struct device *dev, const struct iommu_ops *ops,
+ 	 * then the IOMMU core will have already configured a group for this
+ 	 * device, and allocated the default domain for that group.
+ 	 */
+-	if (!domain || iommu_dma_init_domain(domain, dma_base, size, dev)) {
+-		pr_warn("Failed to set up IOMMU for device %s; retaining platform DMA ops\n",
+-			dev_name(dev));
+-		return false;
++	if (!domain)
++		goto out_err;
++
++	if (domain->type == IOMMU_DOMAIN_DMA) {
++		if (iommu_dma_init_domain(domain, dma_base, size, dev))
++			goto out_err;
++
++		dev->archdata.dma_ops = &iommu_dma_ops;
+ 	}
+ 
+-	dev->archdata.dma_ops = &iommu_dma_ops;
+ 	return true;
++out_err:
++	pr_warn("Failed to set up IOMMU for device %s; retaining platform DMA ops\n",
++		 dev_name(dev));
++	return false;
+ }
+ 
+ static void queue_iommu_attach(struct device *dev, const struct iommu_ops *ops,
+diff --git a/arch/mips/ar7/platform.c b/arch/mips/ar7/platform.c
+index 58fca9ad5fcc..3446b6fb3acb 100644
+--- a/arch/mips/ar7/platform.c
++++ b/arch/mips/ar7/platform.c
+@@ -576,6 +576,7 @@ static int __init ar7_register_uarts(void)
+ 	uart_port.type		= PORT_AR7;
+ 	uart_port.uartclk	= clk_get_rate(bus_clk) / 2;
+ 	uart_port.iotype	= UPIO_MEM32;
++	uart_port.flags		= UPF_FIXED_TYPE;
+ 	uart_port.regshift	= 2;
+ 
+ 	uart_port.line		= 0;
+@@ -654,6 +655,10 @@ static int __init ar7_register_devices(void)
+ 	u32 val;
+ 	int res;
+ 
++	res = ar7_gpio_init();
++	if (res)
++		pr_warn("unable to register gpios: %d\n", res);
++
+ 	res = ar7_register_uarts();
+ 	if (res)
+ 		pr_err("unable to setup uart(s): %d\n", res);
+diff --git a/arch/mips/ar7/prom.c b/arch/mips/ar7/prom.c
+index a23adc49d50f..36aabee9cba4 100644
+--- a/arch/mips/ar7/prom.c
++++ b/arch/mips/ar7/prom.c
+@@ -246,8 +246,6 @@ void __init prom_init(void)
+ 	ar7_init_cmdline(fw_arg0, (char **)fw_arg1);
+ 	ar7_init_env((struct env_var *)fw_arg2);
+ 	console_config();
+-
+-	ar7_gpio_init();
+ }
+ 
+ #define PORT(offset) (KSEG1ADDR(AR7_REGS_UART0 + (offset * 4)))
+diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h
+index 2e4180797b21..b6845db453a3 100644
+--- a/arch/mips/include/asm/mips-cm.h
++++ b/arch/mips/include/asm/mips-cm.h
+@@ -239,8 +239,8 @@ BUILD_CM_Cx_R_(tcid_8_priority,	0x80)
+ #define CM_GCR_BASE_GCRBASE_MSK			(_ULCAST_(0x1ffff) << 15)
+ #define CM_GCR_BASE_CMDEFTGT_SHF		0
+ #define CM_GCR_BASE_CMDEFTGT_MSK		(_ULCAST_(0x3) << 0)
+-#define  CM_GCR_BASE_CMDEFTGT_DISABLED		0
+-#define  CM_GCR_BASE_CMDEFTGT_MEM		1
++#define  CM_GCR_BASE_CMDEFTGT_MEM		0
++#define  CM_GCR_BASE_CMDEFTGT_RESERVED		1
+ #define  CM_GCR_BASE_CMDEFTGT_IOCU0		2
+ #define  CM_GCR_BASE_CMDEFTGT_IOCU1		3
+ 
+diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
+index 1b50958a1373..c558bce989cd 100644
+--- a/arch/mips/kernel/process.c
++++ b/arch/mips/kernel/process.c
+@@ -50,9 +50,7 @@
+ #ifdef CONFIG_HOTPLUG_CPU
+ void arch_cpu_idle_dead(void)
+ {
+-	/* What the heck is this check doing ? */
+-	if (!cpumask_test_cpu(smp_processor_id(), &cpu_callin_map))
+-		play_dead();
++	play_dead();
+ }
+ #endif
+ 
+diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
+index 6d0f1321e084..47c9646f93b3 100644
+--- a/arch/mips/kernel/smp-bmips.c
++++ b/arch/mips/kernel/smp-bmips.c
+@@ -587,11 +587,11 @@ void __init bmips_cpu_setup(void)
+ 
+ 		/* Flush and enable RAC */
+ 		cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG);
+-		__raw_writel(cfg | 0x100, BMIPS_RAC_CONFIG);
++		__raw_writel(cfg | 0x100, cbr + BMIPS_RAC_CONFIG);
+ 		__raw_readl(cbr + BMIPS_RAC_CONFIG);
+ 
+ 		cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG);
+-		__raw_writel(cfg | 0xf, BMIPS_RAC_CONFIG);
++		__raw_writel(cfg | 0xf, cbr + BMIPS_RAC_CONFIG);
+ 		__raw_readl(cbr + BMIPS_RAC_CONFIG);
+ 
+ 		cfg = __raw_readl(cbr + BMIPS_RAC_ADDRESS_RANGE);
+diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
+index 7ebb1918e2ac..95ba4271af6a 100644
+--- a/arch/mips/kernel/smp.c
++++ b/arch/mips/kernel/smp.c
+@@ -68,6 +68,9 @@ EXPORT_SYMBOL(cpu_sibling_map);
+ cpumask_t cpu_core_map[NR_CPUS] __read_mostly;
+ EXPORT_SYMBOL(cpu_core_map);
+ 
++static DECLARE_COMPLETION(cpu_starting);
++static DECLARE_COMPLETION(cpu_running);
++
+ /*
+  * A logcal cpu mask containing only one VPE per core to
+  * reduce the number of IPIs on large MT systems.
+@@ -369,9 +372,12 @@ asmlinkage void start_secondary(void)
+ 	cpumask_set_cpu(cpu, &cpu_coherent_mask);
+ 	notify_cpu_starting(cpu);
+ 
+-	cpumask_set_cpu(cpu, &cpu_callin_map);
++	/* Notify boot CPU that we're starting & ready to sync counters */
++	complete(&cpu_starting);
++
+ 	synchronise_count_slave(cpu);
+ 
++	/* The CPU is running and counters synchronised, now mark it online */
+ 	set_cpu_online(cpu, true);
+ 
+ 	set_cpu_sibling_map(cpu);
+@@ -379,6 +385,12 @@ asmlinkage void start_secondary(void)
+ 
+ 	calculate_cpu_foreign_map();
+ 
++	/*
++	 * Notify boot CPU that we're up & online and it can safely return
++	 * from __cpu_up
++	 */
++	complete(&cpu_running);
++
+ 	/*
+ 	 * irq will be enabled in ->smp_finish(), enabling it too early
+ 	 * is dangerous.
+@@ -430,22 +442,23 @@ void smp_prepare_boot_cpu(void)
+ {
+ 	set_cpu_possible(0, true);
+ 	set_cpu_online(0, true);
+-	cpumask_set_cpu(0, &cpu_callin_map);
+ }
+ 
+ int __cpu_up(unsigned int cpu, struct task_struct *tidle)
+ {
+ 	mp_ops->boot_secondary(cpu, tidle);
+ 
+-	/*
+-	 * Trust is futile.  We should really have timeouts ...
+-	 */
+-	while (!cpumask_test_cpu(cpu, &cpu_callin_map)) {
+-		udelay(100);
+-		schedule();
++	/* Wait for CPU to start and be ready to sync counters */
++	if (!wait_for_completion_timeout(&cpu_starting,
++					 msecs_to_jiffies(1000))) {
++		pr_crit("CPU%u: failed to start\n", cpu);
++		return -EIO;
+ 	}
+ 
+ 	synchronise_count_master(cpu);
++
++	/* Wait for CPU to finish startup & mark itself online before return */
++	wait_for_completion(&cpu_running);
+ 	return 0;
+ }
+ 
+diff --git a/arch/mips/mm/uasm-micromips.c b/arch/mips/mm/uasm-micromips.c
+index 277cf52d80e1..6c17cba7f383 100644
+--- a/arch/mips/mm/uasm-micromips.c
++++ b/arch/mips/mm/uasm-micromips.c
+@@ -80,7 +80,7 @@ static struct insn insn_table_MM[] = {
+ 	{ insn_jr, M(mm_pool32a_op, 0, 0, 0, mm_jalr_op, mm_pool32axf_op), RS },
+ 	{ insn_lb, M(mm_lb32_op, 0, 0, 0, 0, 0), RT | RS | SIMM },
+ 	{ insn_ld, 0, 0 },
+-	{ insn_lh, M(mm_lh32_op, 0, 0, 0, 0, 0), RS | RS | SIMM },
++	{ insn_lh, M(mm_lh32_op, 0, 0, 0, 0, 0), RT | RS | SIMM },
+ 	{ insn_ll, M(mm_pool32c_op, 0, 0, (mm_ll_func << 1), 0, 0), RS | RT | SIMM },
+ 	{ insn_lld, 0, 0 },
+ 	{ insn_lui, M(mm_pool32i_op, mm_lui_op, 0, 0, 0, 0), RS | SIMM },
+diff --git a/arch/powerpc/boot/dts/fsl/kmcoge4.dts b/arch/powerpc/boot/dts/fsl/kmcoge4.dts
+index ae70a24094b0..e103c0f3f650 100644
+--- a/arch/powerpc/boot/dts/fsl/kmcoge4.dts
++++ b/arch/powerpc/boot/dts/fsl/kmcoge4.dts
+@@ -83,6 +83,10 @@
+ 			};
+ 		};
+ 
++		sdhc@114000 {
++			status = "disabled";
++		};
++
+ 		i2c@119000 {
+ 			status = "disabled";
+ 		};
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index bc3f7d0d7b79..f1d7e996e673 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -407,6 +407,7 @@ void arch_vtime_task_switch(struct task_struct *prev)
+ 	struct cpu_accounting_data *acct = get_accounting(current);
+ 
+ 	acct->starttime = get_accounting(prev)->starttime;
++	acct->startspurr = get_accounting(prev)->startspurr;
+ 	acct->system_time = 0;
+ 	acct->user_time = 0;
+ }
+diff --git a/arch/powerpc/kvm/book3s_hv_rm_xics.c b/arch/powerpc/kvm/book3s_hv_rm_xics.c
+index a0ea63ac2b52..a8e3498a853f 100644
+--- a/arch/powerpc/kvm/book3s_hv_rm_xics.c
++++ b/arch/powerpc/kvm/book3s_hv_rm_xics.c
+@@ -376,6 +376,7 @@ static void icp_rm_deliver_irq(struct kvmppc_xics *xics, struct kvmppc_icp *icp,
+ 		 */
+ 		if (reject && reject != XICS_IPI) {
+ 			arch_spin_unlock(&ics->lock);
++			icp->n_reject++;
+ 			new_irq = reject;
+ 			goto again;
+ 		}
+@@ -707,10 +708,8 @@ int kvmppc_rm_h_eoi(struct kvm_vcpu *vcpu, unsigned long xirr)
+ 	state = &ics->irq_state[src];
+ 
+ 	/* Still asserted, resend it */
+-	if (state->asserted) {
+-		icp->n_reject++;
++	if (state->asserted)
+ 		icp_rm_deliver_irq(xics, icp, irq);
+-	}
+ 
+ 	if (!hlist_empty(&vcpu->kvm->irq_ack_notifier_list)) {
+ 		icp->rm_action |= XICS_RM_NOTIFY_EOI;
+diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
+index 2374c5b46bbc..0c196861bc38 100644
+--- a/arch/s390/kernel/early.c
++++ b/arch/s390/kernel/early.c
+@@ -363,6 +363,18 @@ static inline void save_vector_registers(void)
+ #endif
+ }
+ 
++static int __init topology_setup(char *str)
++{
++	bool enabled;
++	int rc;
++
++	rc = kstrtobool(str, &enabled);
++	if (!rc && !enabled)
++		S390_lowcore.machine_flags &= ~MACHINE_HAS_TOPOLOGY;
++	return rc;
++}
++early_param("topology", topology_setup);
++
+ static int __init disable_vector_extension(char *str)
+ {
+ 	S390_lowcore.machine_flags &= ~MACHINE_FLAG_VX;
+diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
+index 8705ee66c087..239f29508f0b 100644
+--- a/arch/s390/kernel/topology.c
++++ b/arch/s390/kernel/topology.c
+@@ -37,7 +37,6 @@ static void set_topology_timer(void);
+ static void topology_work_fn(struct work_struct *work);
+ static struct sysinfo_15_1_x *tl_info;
+ 
+-static bool topology_enabled = true;
+ static DECLARE_WORK(topology_work, topology_work_fn);
+ 
+ /*
+@@ -56,7 +55,7 @@ static cpumask_t cpu_group_map(struct mask_info *info, unsigned int cpu)
+ 	cpumask_t mask;
+ 
+ 	cpumask_copy(&mask, cpumask_of(cpu));
+-	if (!topology_enabled || !MACHINE_HAS_TOPOLOGY)
++	if (!MACHINE_HAS_TOPOLOGY)
+ 		return mask;
+ 	for (; info; info = info->next) {
+ 		if (cpumask_test_cpu(cpu, &info->mask))
+@@ -71,7 +70,7 @@ static cpumask_t cpu_thread_map(unsigned int cpu)
+ 	int i;
+ 
+ 	cpumask_copy(&mask, cpumask_of(cpu));
+-	if (!topology_enabled || !MACHINE_HAS_TOPOLOGY)
++	if (!MACHINE_HAS_TOPOLOGY)
+ 		return mask;
+ 	cpu -= cpu % (smp_cpu_mtid + 1);
+ 	for (i = 0; i <= smp_cpu_mtid; i++)
+@@ -413,12 +412,6 @@ static const struct cpumask *cpu_drawer_mask(int cpu)
+ 	return &per_cpu(cpu_topology, cpu).drawer_mask;
+ }
+ 
+-static int __init early_parse_topology(char *p)
+-{
+-	return kstrtobool(p, &topology_enabled);
+-}
+-early_param("topology", early_parse_topology);
+-
+ static struct sched_domain_topology_level s390_topology[] = {
+ 	{ cpu_thread_mask, cpu_smt_flags, SD_INIT_NAME(SMT) },
+ 	{ cpu_coregroup_mask, cpu_core_flags, SD_INIT_NAME(MC) },
+diff --git a/arch/sh/kernel/cpu/sh3/setup-sh770x.c b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
+index 538c10db3537..8dc315b212c2 100644
+--- a/arch/sh/kernel/cpu/sh3/setup-sh770x.c
++++ b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
+@@ -165,7 +165,6 @@ static struct plat_sci_port scif2_platform_data = {
+ 	.scscr		= SCSCR_TE | SCSCR_RE,
+ 	.type		= PORT_IRDA,
+ 	.ops		= &sh770x_sci_port_ops,
+-	.regshift	= 1,
+ };
+ 
+ static struct resource scif2_resources[] = {
+diff --git a/arch/x86/crypto/sha1-mb/sha1_mb_mgr_flush_avx2.S b/arch/x86/crypto/sha1-mb/sha1_mb_mgr_flush_avx2.S
+index 96df6a39d7e2..a2ae6891e1fc 100644
+--- a/arch/x86/crypto/sha1-mb/sha1_mb_mgr_flush_avx2.S
++++ b/arch/x86/crypto/sha1-mb/sha1_mb_mgr_flush_avx2.S
+@@ -157,8 +157,8 @@ LABEL skip_ %I
+ .endr
+ 
+ 	# Find min length
+-	vmovdqa _lens+0*16(state), %xmm0
+-	vmovdqa _lens+1*16(state), %xmm1
++	vmovdqu _lens+0*16(state), %xmm0
++	vmovdqu _lens+1*16(state), %xmm1
+ 
+ 	vpminud %xmm1, %xmm0, %xmm2     # xmm2 has {D,C,B,A}
+ 	vpalignr $8, %xmm2, %xmm3, %xmm3   # xmm3 has {x,x,D,C}
+@@ -178,8 +178,8 @@ LABEL skip_ %I
+ 	vpsubd  %xmm2, %xmm0, %xmm0
+ 	vpsubd  %xmm2, %xmm1, %xmm1
+ 
+-	vmovdqa %xmm0, _lens+0*16(state)
+-	vmovdqa %xmm1, _lens+1*16(state)
++	vmovdqu %xmm0, _lens+0*16(state)
++	vmovdqu %xmm1, _lens+1*16(state)
+ 
+ 	# "state" and "args" are the same address, arg1
+ 	# len is arg2
+@@ -235,8 +235,8 @@ ENTRY(sha1_mb_mgr_get_comp_job_avx2)
+ 	jc      .return_null
+ 
+ 	# Find min length
+-	vmovdqa _lens(state), %xmm0
+-	vmovdqa _lens+1*16(state), %xmm1
++	vmovdqu _lens(state), %xmm0
++	vmovdqu _lens+1*16(state), %xmm1
+ 
+ 	vpminud %xmm1, %xmm0, %xmm2        # xmm2 has {D,C,B,A}
+ 	vpalignr $8, %xmm2, %xmm3, %xmm3   # xmm3 has {x,x,D,C}
+diff --git a/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S b/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
+index a78a0694ddef..ec9bee661d50 100644
+--- a/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
++++ b/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
+@@ -155,8 +155,8 @@ LABEL skip_ %I
+ .endr
+ 
+ 	# Find min length
+-	vmovdqa _lens+0*16(state), %xmm0
+-	vmovdqa _lens+1*16(state), %xmm1
++	vmovdqu _lens+0*16(state), %xmm0
++	vmovdqu _lens+1*16(state), %xmm1
+ 
+ 	vpminud %xmm1, %xmm0, %xmm2		# xmm2 has {D,C,B,A}
+ 	vpalignr $8, %xmm2, %xmm3, %xmm3	# xmm3 has {x,x,D,C}
+@@ -176,8 +176,8 @@ LABEL skip_ %I
+ 	vpsubd	%xmm2, %xmm0, %xmm0
+ 	vpsubd	%xmm2, %xmm1, %xmm1
+ 
+-	vmovdqa	%xmm0, _lens+0*16(state)
+-	vmovdqa	%xmm1, _lens+1*16(state)
++	vmovdqu	%xmm0, _lens+0*16(state)
++	vmovdqu	%xmm1, _lens+1*16(state)
+ 
+ 	# "state" and "args" are the same address, arg1
+ 	# len is arg2
+@@ -234,8 +234,8 @@ ENTRY(sha256_mb_mgr_get_comp_job_avx2)
+ 	jc	.return_null
+ 
+ 	# Find min length
+-	vmovdqa	_lens(state), %xmm0
+-	vmovdqa	_lens+1*16(state), %xmm1
++	vmovdqu	_lens(state), %xmm0
++	vmovdqu	_lens+1*16(state), %xmm1
+ 
+ 	vpminud	%xmm1, %xmm0, %xmm2		# xmm2 has {D,C,B,A}
+ 	vpalignr $8, %xmm2, %xmm3, %xmm3	# xmm3 has {x,x,D,C}
+diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
+index a300aa10ebc5..dead0f3921f3 100644
+--- a/arch/x86/include/asm/uaccess.h
++++ b/arch/x86/include/asm/uaccess.h
+@@ -68,6 +68,12 @@ static inline bool __chk_range_not_ok(unsigned long addr, unsigned long size, un
+ 	__chk_range_not_ok((unsigned long __force)(addr), size, limit); \
+ })
+ 
++#ifdef CONFIG_DEBUG_ATOMIC_SLEEP
++# define WARN_ON_IN_IRQ()	WARN_ON_ONCE(!in_task())
++#else
++# define WARN_ON_IN_IRQ()
++#endif
++
+ /**
+  * access_ok: - Checks if a user space pointer is valid
+  * @type: Type of access: %VERIFY_READ or %VERIFY_WRITE.  Note that
+@@ -88,8 +94,11 @@ static inline bool __chk_range_not_ok(unsigned long addr, unsigned long size, un
+  * checks that the pointer is in the user space range - after calling
+  * this function, memory access functions may still return -EFAULT.
+  */
+-#define access_ok(type, addr, size) \
+-	likely(!__range_not_ok(addr, size, user_addr_max()))
++#define access_ok(type, addr, size)					\
++({									\
++	WARN_ON_IN_IRQ();						\
++	likely(!__range_not_ok(addr, size, user_addr_max()));		\
++})
+ 
+ /*
+  * These are the main single-value transfer routines.  They automatically
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 36171bcd91f8..9fe7b9e1ae30 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -180,6 +180,12 @@ static void smp_callin(void)
+ 	 */
+ 	smp_store_cpu_info(cpuid);
+ 
++	/*
++	 * The topology information must be up to date before
++	 * calibrate_delay() and notify_cpu_starting().
++	 */
++	set_cpu_sibling_map(raw_smp_processor_id());
++
+ 	/*
+ 	 * Get our bogomips.
+ 	 * Update loops_per_jiffy in cpu_data. Previous call to
+@@ -190,11 +196,6 @@ static void smp_callin(void)
+ 	cpu_data(cpuid).loops_per_jiffy = loops_per_jiffy;
+ 	pr_debug("Stack at about %p\n", &cpuid);
+ 
+-	/*
+-	 * This must be done before setting cpu_online_mask
+-	 * or calling notify_cpu_starting.
+-	 */
+-	set_cpu_sibling_map(raw_smp_processor_id());
+ 	wmb();
+ 
+ 	notify_cpu_starting(cpuid);
+diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
+index 6e57edf33d75..44bf5cf417d3 100644
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -1382,12 +1382,10 @@ void __init tsc_init(void)
+ unsigned long calibrate_delay_is_known(void)
+ {
+ 	int sibling, cpu = smp_processor_id();
+-	struct cpumask *mask = topology_core_cpumask(cpu);
++	int constant_tsc = cpu_has(&cpu_data(cpu), X86_FEATURE_CONSTANT_TSC);
++	const struct cpumask *mask = topology_core_cpumask(cpu);
+ 
+-	if (!tsc_disabled && !cpu_has(&cpu_data(cpu), X86_FEATURE_CONSTANT_TSC))
+-		return 0;
+-
+-	if (!mask)
++	if (tsc_disabled || !constant_tsc || !mask)
+ 		return 0;
+ 
+ 	sibling = cpumask_any_but(mask, cpu);
+diff --git a/arch/x86/oprofile/op_model_ppro.c b/arch/x86/oprofile/op_model_ppro.c
+index 350f7096baac..7913b6921959 100644
+--- a/arch/x86/oprofile/op_model_ppro.c
++++ b/arch/x86/oprofile/op_model_ppro.c
+@@ -212,8 +212,8 @@ static void arch_perfmon_setup_counters(void)
+ 	eax.full = cpuid_eax(0xa);
+ 
+ 	/* Workaround for BIOS bugs in 6/15. Taken from perfmon2 */
+-	if (eax.split.version_id == 0 && __this_cpu_read(cpu_info.x86) == 6 &&
+-		__this_cpu_read(cpu_info.x86_model) == 15) {
++	if (eax.split.version_id == 0 && boot_cpu_data.x86 == 6 &&
++	    boot_cpu_data.x86_model == 15) {
+ 		eax.split.version_id = 2;
+ 		eax.split.num_counters = 2;
+ 		eax.split.bit_width = 40;
+diff --git a/crypto/ccm.c b/crypto/ccm.c
+index 006d8575ef5c..b3ace633fae9 100644
+--- a/crypto/ccm.c
++++ b/crypto/ccm.c
+@@ -413,7 +413,7 @@ static int crypto_ccm_decrypt(struct aead_request *req)
+ 	unsigned int cryptlen = req->cryptlen;
+ 	u8 *authtag = pctx->auth_tag;
+ 	u8 *odata = pctx->odata;
+-	u8 *iv = req->iv;
++	u8 *iv = pctx->idata;
+ 	int err;
+ 
+ 	cryptlen -= authsize;
+@@ -429,6 +429,8 @@ static int crypto_ccm_decrypt(struct aead_request *req)
+ 	if (req->src != req->dst)
+ 		dst = pctx->dst;
+ 
++	memcpy(iv, req->iv, 16);
++
+ 	skcipher_request_set_tfm(skreq, ctx->ctr);
+ 	skcipher_request_set_callback(skreq, pctx->flags,
+ 				      crypto_ccm_decrypt_done, req);
+diff --git a/drivers/base/power/opp/of.c b/drivers/base/power/opp/of.c
+index 5552211e6fcd..b52c617947ad 100644
+--- a/drivers/base/power/opp/of.c
++++ b/drivers/base/power/opp/of.c
+@@ -386,7 +386,7 @@ static int _of_add_opp_table_v1(struct device *dev)
+ {
+ 	const struct property *prop;
+ 	const __be32 *val;
+-	int nr;
++	int nr, ret;
+ 
+ 	prop = of_find_property(dev->of_node, "operating-points", NULL);
+ 	if (!prop)
+@@ -409,9 +409,13 @@ static int _of_add_opp_table_v1(struct device *dev)
+ 		unsigned long freq = be32_to_cpup(val++) * 1000;
+ 		unsigned long volt = be32_to_cpup(val++);
+ 
+-		if (_opp_add_v1(dev, freq, volt, false))
+-			dev_warn(dev, "%s: Failed to add OPP %ld\n",
+-				 __func__, freq);
++		ret = _opp_add_v1(dev, freq, volt, false);
++		if (ret) {
++			dev_err(dev, "%s: Failed to add OPP %ld (%d)\n",
++				__func__, freq, ret);
++			dev_pm_opp_of_remove_table(dev);
++			return ret;
++		}
+ 		nr -= 2;
+ 	}
+ 
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 7b274ff4632c..24f4b544d270 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -2788,7 +2788,7 @@ static int rbd_img_obj_parent_read_full(struct rbd_obj_request *obj_request)
+ 	 * from the parent.
+ 	 */
+ 	page_count = (u32)calc_pages_for(0, length);
+-	pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
++	pages = ceph_alloc_page_vector(page_count, GFP_NOIO);
+ 	if (IS_ERR(pages)) {
+ 		result = PTR_ERR(pages);
+ 		pages = NULL;
+@@ -2922,7 +2922,7 @@ static int rbd_img_obj_exists_submit(struct rbd_obj_request *obj_request)
+ 	 */
+ 	size = sizeof (__le64) + sizeof (__le32) + sizeof (__le32);
+ 	page_count = (u32)calc_pages_for(0, size);
+-	pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
++	pages = ceph_alloc_page_vector(page_count, GFP_NOIO);
+ 	if (IS_ERR(pages)) {
+ 		ret = PTR_ERR(pages);
+ 		goto fail_stat_request;
+diff --git a/drivers/clk/mvebu/ap806-system-controller.c b/drivers/clk/mvebu/ap806-system-controller.c
+index 02023baf86c9..962e0c5f6f4d 100644
+--- a/drivers/clk/mvebu/ap806-system-controller.c
++++ b/drivers/clk/mvebu/ap806-system-controller.c
+@@ -55,21 +55,39 @@ static int ap806_syscon_clk_probe(struct platform_device *pdev)
+ 
+ 	freq_mode = reg & AP806_SAR_CLKFREQ_MODE_MASK;
+ 	switch (freq_mode) {
+-	case 0x0 ... 0x5:
++	case 0x0:
++	case 0x1:
+ 		cpuclk_freq = 2000;
+ 		break;
+-	case 0x6 ... 0xB:
++	case 0x6:
++	case 0x7:
+ 		cpuclk_freq = 1800;
+ 		break;
+-	case 0xC ... 0x11:
++	case 0x4:
++	case 0xB:
++	case 0xD:
+ 		cpuclk_freq = 1600;
+ 		break;
+-	case 0x12 ... 0x16:
++	case 0x1a:
+ 		cpuclk_freq = 1400;
+ 		break;
+-	case 0x17 ... 0x19:
++	case 0x14:
++	case 0x17:
+ 		cpuclk_freq = 1300;
+ 		break;
++	case 0x19:
++		cpuclk_freq = 1200;
++		break;
++	case 0x13:
++	case 0x1d:
++		cpuclk_freq = 1000;
++		break;
++	case 0x1c:
++		cpuclk_freq = 800;
++		break;
++	case 0x1b:
++		cpuclk_freq = 600;
++		break;
+ 	default:
+ 		dev_err(&pdev->dev, "invalid SAR value\n");
+ 		return -EINVAL;
+diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c
+index ea1608682d7f..2fe057326552 100644
+--- a/drivers/clk/samsung/clk-exynos5433.c
++++ b/drivers/clk/samsung/clk-exynos5433.c
+@@ -2559,8 +2559,10 @@ static const struct samsung_fixed_rate_clock disp_fixed_clks[] __initconst = {
+ 	FRATE(0, "phyclk_mipidphy1_bitclkdiv8_phy", NULL, 0, 188000000),
+ 	FRATE(0, "phyclk_mipidphy1_rxclkesc0_phy", NULL, 0, 100000000),
+ 	/* PHY clocks from MIPI_DPHY0 */
+-	FRATE(0, "phyclk_mipidphy0_bitclkdiv8_phy", NULL, 0, 188000000),
+-	FRATE(0, "phyclk_mipidphy0_rxclkesc0_phy", NULL, 0, 100000000),
++	FRATE(CLK_PHYCLK_MIPIDPHY0_BITCLKDIV8_PHY, "phyclk_mipidphy0_bitclkdiv8_phy",
++			NULL, 0, 188000000),
++	FRATE(CLK_PHYCLK_MIPIDPHY0_RXCLKESC0_PHY, "phyclk_mipidphy0_rxclkesc0_phy",
++			NULL, 0, 100000000),
+ 	/* PHY clocks from HDMI_PHY */
+ 	FRATE(CLK_PHYCLK_HDMIPHY_TMDS_CLKO_PHY, "phyclk_hdmiphy_tmds_clko_phy",
+ 			NULL, 0, 300000000),
+diff --git a/drivers/crypto/vmx/aes_ctr.c b/drivers/crypto/vmx/aes_ctr.c
+index 38ed10d761d0..7cf6d31c1123 100644
+--- a/drivers/crypto/vmx/aes_ctr.c
++++ b/drivers/crypto/vmx/aes_ctr.c
+@@ -80,11 +80,13 @@ static int p8_aes_ctr_setkey(struct crypto_tfm *tfm, const u8 *key,
+ 	int ret;
+ 	struct p8_aes_ctr_ctx *ctx = crypto_tfm_ctx(tfm);
+ 
++	preempt_disable();
+ 	pagefault_disable();
+ 	enable_kernel_vsx();
+ 	ret = aes_p8_set_encrypt_key(key, keylen * 8, &ctx->enc_key);
+ 	disable_kernel_vsx();
+ 	pagefault_enable();
++	preempt_enable();
+ 
+ 	ret += crypto_blkcipher_setkey(ctx->fallback, key, keylen);
+ 	return ret;
+@@ -99,11 +101,13 @@ static void p8_aes_ctr_final(struct p8_aes_ctr_ctx *ctx,
+ 	u8 *dst = walk->dst.virt.addr;
+ 	unsigned int nbytes = walk->nbytes;
+ 
++	preempt_disable();
+ 	pagefault_disable();
+ 	enable_kernel_vsx();
+ 	aes_p8_encrypt(ctrblk, keystream, &ctx->enc_key);
+ 	disable_kernel_vsx();
+ 	pagefault_enable();
++	preempt_enable();
+ 
+ 	crypto_xor(keystream, src, nbytes);
+ 	memcpy(dst, keystream, nbytes);
+@@ -132,6 +136,7 @@ static int p8_aes_ctr_crypt(struct blkcipher_desc *desc,
+ 		blkcipher_walk_init(&walk, dst, src, nbytes);
+ 		ret = blkcipher_walk_virt_block(desc, &walk, AES_BLOCK_SIZE);
+ 		while ((nbytes = walk.nbytes) >= AES_BLOCK_SIZE) {
++			preempt_disable();
+ 			pagefault_disable();
+ 			enable_kernel_vsx();
+ 			aes_p8_ctr32_encrypt_blocks(walk.src.virt.addr,
+@@ -143,6 +148,7 @@ static int p8_aes_ctr_crypt(struct blkcipher_desc *desc,
+ 						    walk.iv);
+ 			disable_kernel_vsx();
+ 			pagefault_enable();
++			preempt_enable();
+ 
+ 			/* We need to update IV mostly for last bytes/round */
+ 			inc = (nbytes & AES_BLOCK_MASK) / AES_BLOCK_SIZE;
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index ee181c53626f..6e197c1c213d 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -2984,8 +2984,11 @@ static int __init amd64_edac_init(void)
+ 	int err = -ENODEV;
+ 	int i;
+ 
++	if (!x86_match_cpu(amd64_cpuids))
++		return -ENODEV;
++
+ 	if (amd_cache_northbridges() < 0)
+-		goto err_ret;
++		return -ENODEV;
+ 
+ 	opstate_init();
+ 
+@@ -2998,14 +3001,16 @@ static int __init amd64_edac_init(void)
+ 	if (!msrs)
+ 		goto err_free;
+ 
+-	for (i = 0; i < amd_nb_num(); i++)
+-		if (probe_one_instance(i)) {
++	for (i = 0; i < amd_nb_num(); i++) {
++		err = probe_one_instance(i);
++		if (err) {
+ 			/* unwind properly */
+ 			while (--i >= 0)
+ 				remove_one_instance(i);
+ 
+ 			goto err_pci;
+ 		}
++	}
+ 
+ 	setup_pci_device();
+ 
+@@ -3025,7 +3030,6 @@ static int __init amd64_edac_init(void)
+ 	kfree(ecc_stngs);
+ 	ecc_stngs = NULL;
+ 
+-err_ret:
+ 	return err;
+ }
+ 
+diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
+index c08870479054..dcb5f9481735 100644
+--- a/drivers/edac/amd64_edac.h
++++ b/drivers/edac/amd64_edac.h
+@@ -16,6 +16,7 @@
+ #include <linux/slab.h>
+ #include <linux/mmzone.h>
+ #include <linux/edac.h>
++#include <asm/cpu_device_id.h>
+ #include <asm/msr.h>
+ #include "edac_core.h"
+ #include "mce_amd.h"
+diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
+index afe0480d95c9..8b009b549e45 100644
+--- a/drivers/gpu/drm/arm/malidp_planes.c
++++ b/drivers/gpu/drm/arm/malidp_planes.c
+@@ -182,7 +182,8 @@ static void malidp_de_plane_update(struct drm_plane *plane,
+ 
+ 	/* setup the rotation and axis flip bits */
+ 	if (plane->state->rotation & DRM_ROTATE_MASK)
+-		val = ilog2(plane->state->rotation & DRM_ROTATE_MASK) << LAYER_ROT_OFFSET;
++		val |= ilog2(plane->state->rotation & DRM_ROTATE_MASK) <<
++		       LAYER_ROT_OFFSET;
+ 	if (plane->state->rotation & DRM_REFLECT_X)
+ 		val |= LAYER_H_FLIP;
+ 	if (plane->state->rotation & DRM_REFLECT_Y)
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index 213d892b6fa3..a68f94daf9b6 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -325,7 +325,7 @@ static void adv7511_set_link_config(struct adv7511 *adv7511,
+ 	adv7511->rgb = config->input_colorspace == HDMI_COLORSPACE_RGB;
+ }
+ 
+-static void adv7511_power_on(struct adv7511 *adv7511)
++static void __adv7511_power_on(struct adv7511 *adv7511)
+ {
+ 	adv7511->current_edid_segment = -1;
+ 
+@@ -354,6 +354,11 @@ static void adv7511_power_on(struct adv7511 *adv7511)
+ 	regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2,
+ 			   ADV7511_REG_POWER2_HPD_SRC_MASK,
+ 			   ADV7511_REG_POWER2_HPD_SRC_NONE);
++}
++
++static void adv7511_power_on(struct adv7511 *adv7511)
++{
++	__adv7511_power_on(adv7511);
+ 
+ 	/*
+ 	 * Most of the registers are reset during power down or when HPD is low.
+@@ -362,21 +367,23 @@ static void adv7511_power_on(struct adv7511 *adv7511)
+ 
+ 	if (adv7511->type == ADV7533)
+ 		adv7533_dsi_power_on(adv7511);
+-
+ 	adv7511->powered = true;
+ }
+ 
+-static void adv7511_power_off(struct adv7511 *adv7511)
++static void __adv7511_power_off(struct adv7511 *adv7511)
+ {
+ 	/* TODO: setup additional power down modes */
+ 	regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER,
+ 			   ADV7511_POWER_POWER_DOWN,
+ 			   ADV7511_POWER_POWER_DOWN);
+ 	regcache_mark_dirty(adv7511->regmap);
++}
+ 
++static void adv7511_power_off(struct adv7511 *adv7511)
++{
++	__adv7511_power_off(adv7511);
+ 	if (adv7511->type == ADV7533)
+ 		adv7533_dsi_power_off(adv7511);
+-
+ 	adv7511->powered = false;
+ }
+ 
+@@ -567,23 +574,20 @@ static int adv7511_get_modes(struct adv7511 *adv7511,
+ 
+ 	/* Reading the EDID only works if the device is powered */
+ 	if (!adv7511->powered) {
+-		regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER,
+-				   ADV7511_POWER_POWER_DOWN, 0);
+-		if (adv7511->i2c_main->irq) {
+-			regmap_write(adv7511->regmap, ADV7511_REG_INT_ENABLE(0),
+-				     ADV7511_INT0_EDID_READY);
+-			regmap_write(adv7511->regmap, ADV7511_REG_INT_ENABLE(1),
+-				     ADV7511_INT1_DDC_ERROR);
+-		}
+-		adv7511->current_edid_segment = -1;
++		unsigned int edid_i2c_addr =
++					(adv7511->i2c_main->addr << 1) + 4;
++
++		__adv7511_power_on(adv7511);
++
++		/* Reset the EDID_I2C_ADDR register as it might be cleared */
++		regmap_write(adv7511->regmap, ADV7511_REG_EDID_I2C_ADDR,
++			     edid_i2c_addr);
+ 	}
+ 
+ 	edid = drm_do_get_edid(connector, adv7511_get_edid_block, adv7511);
+ 
+ 	if (!adv7511->powered)
+-		regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER,
+-				   ADV7511_POWER_POWER_DOWN,
+-				   ADV7511_POWER_POWER_DOWN);
++		__adv7511_power_off(adv7511);
+ 
+ 	kfree(adv7511->edid);
+ 	adv7511->edid = edid;
+diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
+index 362b8cd68a24..80a903bd317d 100644
+--- a/drivers/gpu/drm/drm_drv.c
++++ b/drivers/gpu/drm/drm_drv.c
+@@ -218,7 +218,7 @@ static int drm_minor_register(struct drm_device *dev, unsigned int type)
+ 	ret = drm_debugfs_init(minor, minor->index, drm_debugfs_root);
+ 	if (ret) {
+ 		DRM_ERROR("DRM: Failed to initialize /sys/kernel/debug/dri.\n");
+-		return ret;
++		goto err_debugfs;
+ 	}
+ 
+ 	ret = device_add(minor->kdev);
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index a19ec06f9e42..3ce9ba30d827 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -457,7 +457,6 @@ struct intel_crtc_scaler_state {
+ 
+ struct intel_pipe_wm {
+ 	struct intel_wm_level wm[5];
+-	struct intel_wm_level raw_wm[5];
+ 	uint32_t linetime;
+ 	bool fbc_wm_enabled;
+ 	bool pipe_enabled;
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 49de4760cc16..277a8026460b 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -27,6 +27,7 @@
+ 
+ #include <linux/cpufreq.h>
+ #include <drm/drm_plane_helper.h>
++#include <drm/drm_atomic_helper.h>
+ #include "i915_drv.h"
+ #include "intel_drv.h"
+ #include "../../../platform/x86/intel_ips.h"
+@@ -2017,9 +2018,9 @@ static void ilk_compute_wm_level(const struct drm_i915_private *dev_priv,
+ 				 const struct intel_crtc *intel_crtc,
+ 				 int level,
+ 				 struct intel_crtc_state *cstate,
+-				 struct intel_plane_state *pristate,
+-				 struct intel_plane_state *sprstate,
+-				 struct intel_plane_state *curstate,
++				 const struct intel_plane_state *pristate,
++				 const struct intel_plane_state *sprstate,
++				 const struct intel_plane_state *curstate,
+ 				 struct intel_wm_level *result)
+ {
+ 	uint16_t pri_latency = dev_priv->wm.pri_latency[level];
+@@ -2341,28 +2342,24 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
+ 	struct intel_pipe_wm *pipe_wm;
+ 	struct drm_device *dev = state->dev;
+ 	const struct drm_i915_private *dev_priv = to_i915(dev);
+-	struct intel_plane *intel_plane;
+-	struct intel_plane_state *pristate = NULL;
+-	struct intel_plane_state *sprstate = NULL;
+-	struct intel_plane_state *curstate = NULL;
++	struct drm_plane *plane;
++	const struct drm_plane_state *plane_state;
++	const struct intel_plane_state *pristate = NULL;
++	const struct intel_plane_state *sprstate = NULL;
++	const struct intel_plane_state *curstate = NULL;
+ 	int level, max_level = ilk_wm_max_level(dev), usable_level;
+ 	struct ilk_wm_maximums max;
+ 
+ 	pipe_wm = &cstate->wm.ilk.optimal;
+ 
+-	for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
+-		struct intel_plane_state *ps;
++	drm_atomic_crtc_state_for_each_plane_state(plane, plane_state, &cstate->base) {
++		const struct intel_plane_state *ps = to_intel_plane_state(plane_state);
+ 
+-		ps = intel_atomic_get_existing_plane_state(state,
+-							   intel_plane);
+-		if (!ps)
+-			continue;
+-
+-		if (intel_plane->base.type == DRM_PLANE_TYPE_PRIMARY)
++		if (plane->type == DRM_PLANE_TYPE_PRIMARY)
+ 			pristate = ps;
+-		else if (intel_plane->base.type == DRM_PLANE_TYPE_OVERLAY)
++		else if (plane->type == DRM_PLANE_TYPE_OVERLAY)
+ 			sprstate = ps;
+-		else if (intel_plane->base.type == DRM_PLANE_TYPE_CURSOR)
++		else if (plane->type == DRM_PLANE_TYPE_CURSOR)
+ 			curstate = ps;
+ 	}
+ 
+@@ -2384,11 +2381,9 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
+ 	if (pipe_wm->sprites_scaled)
+ 		usable_level = 0;
+ 
+-	ilk_compute_wm_level(dev_priv, intel_crtc, 0, cstate,
+-			     pristate, sprstate, curstate, &pipe_wm->raw_wm[0]);
+-
+ 	memset(&pipe_wm->wm, 0, sizeof(pipe_wm->wm));
+-	pipe_wm->wm[0] = pipe_wm->raw_wm[0];
++	ilk_compute_wm_level(dev_priv, intel_crtc, 0, cstate,
++			     pristate, sprstate, curstate, &pipe_wm->wm[0]);
+ 
+ 	if (IS_HASWELL(dev) || IS_BROADWELL(dev))
+ 		pipe_wm->linetime = hsw_compute_linetime_wm(cstate);
+@@ -2398,8 +2393,8 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
+ 
+ 	ilk_compute_wm_reg_maximums(dev, 1, &max);
+ 
+-	for (level = 1; level <= max_level; level++) {
+-		struct intel_wm_level *wm = &pipe_wm->raw_wm[level];
++	for (level = 1; level <= usable_level; level++) {
++		struct intel_wm_level *wm = &pipe_wm->wm[level];
+ 
+ 		ilk_compute_wm_level(dev_priv, intel_crtc, level, cstate,
+ 				     pristate, sprstate, curstate, wm);
+@@ -2409,13 +2404,10 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
+ 		 * register maximums since such watermarks are
+ 		 * always invalid.
+ 		 */
+-		if (level > usable_level)
+-			continue;
+-
+-		if (ilk_validate_wm_level(level, &max, wm))
+-			pipe_wm->wm[level] = *wm;
+-		else
+-			usable_level = level;
++		if (!ilk_validate_wm_level(level, &max, wm)) {
++			memset(wm, 0, sizeof(*wm));
++			break;
++		}
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index 36005bdf3749..29abd28c19b3 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -721,7 +721,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
+ 		 * allocation taken by fbdev
+ 		 */
+ 		if (!(dev_priv->capabilities & SVGA_CAP_3D))
+-			mem_size *= 2;
++			mem_size *= 3;
+ 
+ 		dev_priv->max_mob_pages = mem_size * 1024 / PAGE_SIZE;
+ 		dev_priv->prim_bb_mem =
+diff --git a/drivers/iio/magnetometer/mag3110.c b/drivers/iio/magnetometer/mag3110.c
+index f2b3bd7bf862..b4f643fb3b1e 100644
+--- a/drivers/iio/magnetometer/mag3110.c
++++ b/drivers/iio/magnetometer/mag3110.c
+@@ -222,29 +222,39 @@ static int mag3110_write_raw(struct iio_dev *indio_dev,
+ 			     int val, int val2, long mask)
+ {
+ 	struct mag3110_data *data = iio_priv(indio_dev);
+-	int rate;
++	int rate, ret;
+ 
+-	if (iio_buffer_enabled(indio_dev))
+-		return -EBUSY;
++	ret = iio_device_claim_direct_mode(indio_dev);
++	if (ret)
++		return ret;
+ 
+ 	switch (mask) {
+ 	case IIO_CHAN_INFO_SAMP_FREQ:
+ 		rate = mag3110_get_samp_freq_index(data, val, val2);
+-		if (rate < 0)
+-			return -EINVAL;
++		if (rate < 0) {
++			ret = -EINVAL;
++			break;
++		}
+ 
+ 		data->ctrl_reg1 &= ~MAG3110_CTRL_DR_MASK;
+ 		data->ctrl_reg1 |= rate << MAG3110_CTRL_DR_SHIFT;
+-		return i2c_smbus_write_byte_data(data->client,
++		ret = i2c_smbus_write_byte_data(data->client,
+ 			MAG3110_CTRL_REG1, data->ctrl_reg1);
++		break;
+ 	case IIO_CHAN_INFO_CALIBBIAS:
+-		if (val < -10000 || val > 10000)
+-			return -EINVAL;
+-		return i2c_smbus_write_word_swapped(data->client,
++		if (val < -10000 || val > 10000) {
++			ret = -EINVAL;
++			break;
++		}
++		ret = i2c_smbus_write_word_swapped(data->client,
+ 			MAG3110_OFF_X + 2 * chan->scan_index, val << 1);
++		break;
+ 	default:
+-		return -EINVAL;
++		ret = -EINVAL;
++		break;
+ 	}
++	iio_device_release_direct_mode(indio_dev);
++	return ret;
+ }
+ 
+ static irqreturn_t mag3110_trigger_handler(int irq, void *p)
+diff --git a/drivers/iio/pressure/ms5611_core.c b/drivers/iio/pressure/ms5611_core.c
+index a74ed1f0c880..8cc7156b5ace 100644
+--- a/drivers/iio/pressure/ms5611_core.c
++++ b/drivers/iio/pressure/ms5611_core.c
+@@ -308,6 +308,7 @@ static int ms5611_write_raw(struct iio_dev *indio_dev,
+ {
+ 	struct ms5611_state *st = iio_priv(indio_dev);
+ 	const struct ms5611_osr *osr = NULL;
++	int ret;
+ 
+ 	if (mask != IIO_CHAN_INFO_OVERSAMPLING_RATIO)
+ 		return -EINVAL;
+@@ -321,12 +322,11 @@ static int ms5611_write_raw(struct iio_dev *indio_dev,
+ 	if (!osr)
+ 		return -EINVAL;
+ 
+-	mutex_lock(&st->lock);
++	ret = iio_device_claim_direct_mode(indio_dev);
++	if (ret)
++		return ret;
+ 
+-	if (iio_buffer_enabled(indio_dev)) {
+-		mutex_unlock(&st->lock);
+-		return -EBUSY;
+-	}
++	mutex_lock(&st->lock);
+ 
+ 	if (chan->type == IIO_TEMP)
+ 		st->temp_osr = osr;
+@@ -334,6 +334,8 @@ static int ms5611_write_raw(struct iio_dev *indio_dev,
+ 		st->pressure_osr = osr;
+ 
+ 	mutex_unlock(&st->lock);
++	iio_device_release_direct_mode(indio_dev);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/iio/proximity/sx9500.c b/drivers/iio/proximity/sx9500.c
+index 1f06282ec793..9ea147f1a50d 100644
+--- a/drivers/iio/proximity/sx9500.c
++++ b/drivers/iio/proximity/sx9500.c
+@@ -387,14 +387,18 @@ static int sx9500_read_raw(struct iio_dev *indio_dev,
+ 			   int *val, int *val2, long mask)
+ {
+ 	struct sx9500_data *data = iio_priv(indio_dev);
++	int ret;
+ 
+ 	switch (chan->type) {
+ 	case IIO_PROXIMITY:
+ 		switch (mask) {
+ 		case IIO_CHAN_INFO_RAW:
+-			if (iio_buffer_enabled(indio_dev))
+-				return -EBUSY;
+-			return sx9500_read_proximity(data, chan, val);
++			ret = iio_device_claim_direct_mode(indio_dev);
++			if (ret)
++				return ret;
++			ret = sx9500_read_proximity(data, chan, val);
++			iio_device_release_direct_mode(indio_dev);
++			return ret;
+ 		case IIO_CHAN_INFO_SAMP_FREQ:
+ 			return sx9500_read_samp_freq(data, val, val2);
+ 		default:
+diff --git a/drivers/iio/trigger/iio-trig-interrupt.c b/drivers/iio/trigger/iio-trig-interrupt.c
+index 572bc6f02ca8..e18f12b74610 100644
+--- a/drivers/iio/trigger/iio-trig-interrupt.c
++++ b/drivers/iio/trigger/iio-trig-interrupt.c
+@@ -58,7 +58,7 @@ static int iio_interrupt_trigger_probe(struct platform_device *pdev)
+ 	trig_info = kzalloc(sizeof(*trig_info), GFP_KERNEL);
+ 	if (!trig_info) {
+ 		ret = -ENOMEM;
+-		goto error_put_trigger;
++		goto error_free_trigger;
+ 	}
+ 	iio_trigger_set_drvdata(trig, trig_info);
+ 	trig_info->irq = irq;
+@@ -83,8 +83,8 @@ static int iio_interrupt_trigger_probe(struct platform_device *pdev)
+ 	free_irq(irq, trig);
+ error_free_trig_info:
+ 	kfree(trig_info);
+-error_put_trigger:
+-	iio_trigger_put(trig);
++error_free_trigger:
++	iio_trigger_free(trig);
+ error_ret:
+ 	return ret;
+ }
+@@ -99,7 +99,7 @@ static int iio_interrupt_trigger_remove(struct platform_device *pdev)
+ 	iio_trigger_unregister(trig);
+ 	free_irq(trig_info->irq, trig);
+ 	kfree(trig_info);
+-	iio_trigger_put(trig);
++	iio_trigger_free(trig);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/iio/trigger/iio-trig-sysfs.c b/drivers/iio/trigger/iio-trig-sysfs.c
+index 3dfab2bc6d69..202e8b89caf2 100644
+--- a/drivers/iio/trigger/iio-trig-sysfs.c
++++ b/drivers/iio/trigger/iio-trig-sysfs.c
+@@ -174,7 +174,7 @@ static int iio_sysfs_trigger_probe(int id)
+ 	return 0;
+ 
+ out2:
+-	iio_trigger_put(t->trig);
++	iio_trigger_free(t->trig);
+ free_t:
+ 	kfree(t);
+ out1:
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index 9f46be52335e..9d084780ac91 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -633,6 +633,7 @@ int rxe_requester(void *arg)
+ 				goto exit;
+ 			}
+ 			rmr->state = RXE_MEM_STATE_FREE;
++			rxe_drop_ref(rmr);
+ 			wqe->state = wqe_state_done;
+ 			wqe->status = IB_WC_SUCCESS;
+ 		} else if (wqe->wr.opcode == IB_WR_REG_MR) {
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index 69ed4e0d7a0d..7705820cdac6 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -893,6 +893,7 @@ static enum resp_states do_complete(struct rxe_qp *qp,
+ 					return RESPST_ERROR;
+ 				}
+ 				rmr->state = RXE_MEM_STATE_FREE;
++				rxe_drop_ref(rmr);
+ 			}
+ 
+ 			wc->qp			= &qp->ibqp;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index 0616a65f0d78..75761667be59 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -1392,7 +1392,7 @@ static void ipoib_cm_tx_reap(struct work_struct *work)
+ 
+ 	while (!list_empty(&priv->cm.reap_list)) {
+ 		p = list_entry(priv->cm.reap_list.next, typeof(*p), list);
+-		list_del(&p->list);
++		list_del_init(&p->list);
+ 		spin_unlock_irqrestore(&priv->lock, flags);
+ 		netif_tx_unlock_bh(dev);
+ 		ipoib_cm_tx_destroy(p);
+diff --git a/drivers/input/keyboard/mpr121_touchkey.c b/drivers/input/keyboard/mpr121_touchkey.c
+index 0fd612dd76ed..aaf43befffaa 100644
+--- a/drivers/input/keyboard/mpr121_touchkey.c
++++ b/drivers/input/keyboard/mpr121_touchkey.c
+@@ -87,7 +87,8 @@ static irqreturn_t mpr_touchkey_interrupt(int irq, void *dev_id)
+ 	struct mpr121_touchkey *mpr121 = dev_id;
+ 	struct i2c_client *client = mpr121->client;
+ 	struct input_dev *input = mpr121->input_dev;
+-	unsigned int key_num, key_val, pressed;
++	unsigned long bit_changed;
++	unsigned int key_num;
+ 	int reg;
+ 
+ 	reg = i2c_smbus_read_byte_data(client, ELE_TOUCH_STATUS_1_ADDR);
+@@ -105,18 +106,22 @@ static irqreturn_t mpr_touchkey_interrupt(int irq, void *dev_id)
+ 
+ 	reg &= TOUCH_STATUS_MASK;
+ 	/* use old press bit to figure out which bit changed */
+-	key_num = ffs(reg ^ mpr121->statusbits) - 1;
+-	pressed = reg & (1 << key_num);
++	bit_changed = reg ^ mpr121->statusbits;
+ 	mpr121->statusbits = reg;
++	for_each_set_bit(key_num, &bit_changed, mpr121->keycount) {
++		unsigned int key_val, pressed;
+ 
+-	key_val = mpr121->keycodes[key_num];
++		pressed = reg & BIT(key_num);
++		key_val = mpr121->keycodes[key_num];
+ 
+-	input_event(input, EV_MSC, MSC_SCAN, key_num);
+-	input_report_key(input, key_val, pressed);
+-	input_sync(input);
++		input_event(input, EV_MSC, MSC_SCAN, key_num);
++		input_report_key(input, key_val, pressed);
++
++		dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val,
++			pressed ? "pressed" : "released");
+ 
+-	dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val,
+-		pressed ? "pressed" : "released");
++	}
++	input_sync(input);
+ 
+ out:
+ 	return IRQ_HANDLED;
+@@ -231,6 +236,7 @@ static int mpr_touchkey_probe(struct i2c_client *client,
+ 	input_dev->id.bustype = BUS_I2C;
+ 	input_dev->dev.parent = &client->dev;
+ 	input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP);
++	input_set_capability(input_dev, EV_MSC, MSC_SCAN);
+ 
+ 	input_dev->keycode = mpr121->keycodes;
+ 	input_dev->keycodesize = sizeof(mpr121->keycodes[0]);
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index b8c50d883b2c..c9d491bc85e0 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1240,6 +1240,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
+ 	{ "ELAN0605", 0 },
+ 	{ "ELAN0609", 0 },
+ 	{ "ELAN060B", 0 },
++	{ "ELAN060C", 0 },
+ 	{ "ELAN0611", 0 },
+ 	{ "ELAN1000", 0 },
+ 	{ }
+diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
+index e6f9b2d745ca..d3d975ae24b7 100644
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -1040,13 +1040,8 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid,
+ 		}
+ 	}
+ 
+-	/* Nuke the existing Config, as we're going to rewrite it */
+-	val &= ~(STRTAB_STE_0_CFG_MASK << STRTAB_STE_0_CFG_SHIFT);
+-
+-	if (ste->valid)
+-		val |= STRTAB_STE_0_V;
+-	else
+-		val &= ~STRTAB_STE_0_V;
++	/* Nuke the existing STE_0 value, as we're going to rewrite it */
++	val = ste->valid ? STRTAB_STE_0_V : 0;
+ 
+ 	if (ste->bypass) {
+ 		val |= disable_bypass ? STRTAB_STE_0_CFG_ABORT
+@@ -1081,7 +1076,6 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid,
+ 		val |= (ste->s1_cfg->cdptr_dma & STRTAB_STE_0_S1CTXPTR_MASK
+ 		        << STRTAB_STE_0_S1CTXPTR_SHIFT) |
+ 			STRTAB_STE_0_CFG_S1_TRANS;
+-
+ 	}
+ 
+ 	if (ste->s2_cfg) {
+diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
+index 4003831de712..7b1935ab03c8 100644
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -3118,6 +3118,9 @@ static int adv76xx_parse_dt(struct adv76xx_state *state)
+ 	state->pdata.blank_data = 1;
+ 	state->pdata.op_format_mode_sel = ADV7604_OP_FORMAT_MODE0;
+ 	state->pdata.bus_order = ADV7604_BUS_ORDER_RGB;
++	state->pdata.dr_str_data = ADV76XX_DR_STR_MEDIUM_HIGH;
++	state->pdata.dr_str_clk = ADV76XX_DR_STR_MEDIUM_HIGH;
++	state->pdata.dr_str_sync = ADV76XX_DR_STR_MEDIUM_HIGH;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
+index fa4fe02cfef4..eef202d4399b 100644
+--- a/drivers/misc/cxl/pci.c
++++ b/drivers/misc/cxl/pci.c
+@@ -1620,6 +1620,9 @@ static void cxl_pci_remove_adapter(struct cxl *adapter)
+ 	cxl_sysfs_adapter_remove(adapter);
+ 	cxl_debugfs_adapter_remove(adapter);
+ 
++	/* Flush adapter datacache as its about to be removed */
++	cxl_data_cache_flush(adapter);
++
+ 	cxl_deconfigure_adapter(adapter);
+ 
+ 	device_unregister(&adapter->dev);
+diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c
+index cf7c18947189..d065c0e2d18e 100644
+--- a/drivers/net/can/c_can/c_can_pci.c
++++ b/drivers/net/can/c_can/c_can_pci.c
+@@ -178,7 +178,6 @@ static int c_can_pci_probe(struct pci_dev *pdev,
+ 		break;
+ 	case BOSCH_D_CAN:
+ 		priv->regs = reg_map_d_can;
+-		priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
+ 		break;
+ 	default:
+ 		ret = -EINVAL;
+diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
+index e36d10520e24..717530eac70c 100644
+--- a/drivers/net/can/c_can/c_can_platform.c
++++ b/drivers/net/can/c_can/c_can_platform.c
+@@ -320,7 +320,6 @@ static int c_can_plat_probe(struct platform_device *pdev)
+ 		break;
+ 	case BOSCH_D_CAN:
+ 		priv->regs = reg_map_d_can;
+-		priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
+ 		priv->read_reg = c_can_plat_read_reg_aligned_to_16bit;
+ 		priv->write_reg = c_can_plat_write_reg_aligned_to_16bit;
+ 		priv->read_reg32 = d_can_plat_read_reg32;
+diff --git a/drivers/net/can/ifi_canfd/ifi_canfd.c b/drivers/net/can/ifi_canfd/ifi_canfd.c
+index 481895b2f9f4..c06ef438f23f 100644
+--- a/drivers/net/can/ifi_canfd/ifi_canfd.c
++++ b/drivers/net/can/ifi_canfd/ifi_canfd.c
+@@ -670,9 +670,9 @@ static void ifi_canfd_set_bittiming(struct net_device *ndev)
+ 	       priv->base + IFI_CANFD_FTIME);
+ 
+ 	/* Configure transmitter delay */
+-	tdc = (dbt->brp * (dbt->phase_seg1 + 1)) & IFI_CANFD_TDELAY_MASK;
+-	writel(IFI_CANFD_TDELAY_EN | IFI_CANFD_TDELAY_ABS | tdc,
+-	       priv->base + IFI_CANFD_TDELAY);
++	tdc = dbt->brp * (dbt->prop_seg + dbt->phase_seg1);
++	tdc &= IFI_CANFD_TDELAY_MASK;
++	writel(IFI_CANFD_TDELAY_EN | tdc, priv->base + IFI_CANFD_TDELAY);
+ }
+ 
+ static void ifi_canfd_set_filter(struct net_device *ndev, const u32 id,
+diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c
+index b0c80859f746..1ac2090a1721 100644
+--- a/drivers/net/can/sun4i_can.c
++++ b/drivers/net/can/sun4i_can.c
+@@ -539,6 +539,13 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status)
+ 		}
+ 		stats->rx_over_errors++;
+ 		stats->rx_errors++;
++
++		/* reset the CAN IP by entering reset mode
++		 * ignoring timeout error
++		 */
++		set_reset_mode(dev);
++		set_normal_mode(dev);
++
+ 		/* clear bit */
+ 		sun4i_can_write_cmdreg(priv, SUN4I_CMD_CLEAR_OR_FLAG);
+ 	}
+@@ -653,8 +660,9 @@ static irqreturn_t sun4i_can_interrupt(int irq, void *dev_id)
+ 			netif_wake_queue(dev);
+ 			can_led_event(dev, CAN_LED_EVENT_TX);
+ 		}
+-		if (isrc & SUN4I_INT_RBUF_VLD) {
+-			/* receive interrupt */
++		if ((isrc & SUN4I_INT_RBUF_VLD) &&
++		    !(isrc & SUN4I_INT_DATA_OR)) {
++			/* receive interrupt - don't read if overrun occurred */
+ 			while (status & SUN4I_STA_RBUF_RDY) {
+ 				/* RX buffer is not empty */
+ 				sun4i_can_rx(dev);
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index afbfc0f656f3..dc6d3b0a0be8 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -769,8 +769,10 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
+ 	u8 *buf;
+ 	int len;
+ 	int temp;
++	int err;
+ 	u8 iface_no;
+ 	struct usb_cdc_parsed_header hdr;
++	u16 curr_ntb_format;
+ 
+ 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+ 	if (!ctx)
+@@ -875,6 +877,32 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
+ 		goto error2;
+ 	}
+ 
++	/*
++	 * Some Huawei devices have been observed to come out of reset in NDP32 mode.
++	 * Let's check if this is the case, and set the device to NDP16 mode again if
++	 * needed.
++	*/
++	if (ctx->drvflags & CDC_NCM_FLAG_RESET_NTB16) {
++		err = usbnet_read_cmd(dev, USB_CDC_GET_NTB_FORMAT,
++				      USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE,
++				      0, iface_no, &curr_ntb_format, 2);
++		if (err < 0) {
++			goto error2;
++		}
++
++		if (curr_ntb_format == USB_CDC_NCM_NTB32_FORMAT) {
++			dev_info(&intf->dev, "resetting NTB format to 16-bit");
++			err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_FORMAT,
++					       USB_TYPE_CLASS | USB_DIR_OUT
++					       | USB_RECIP_INTERFACE,
++					       USB_CDC_NCM_NTB16_FORMAT,
++					       iface_no, NULL, 0);
++
++			if (err < 0)
++				goto error2;
++		}
++	}
++
+ 	cdc_ncm_find_endpoints(dev, ctx->data);
+ 	cdc_ncm_find_endpoints(dev, ctx->control);
+ 	if (!dev->in || !dev->out || !dev->status) {
+diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c
+index 2680a65cd5e4..63f28908afda 100644
+--- a/drivers/net/usb/huawei_cdc_ncm.c
++++ b/drivers/net/usb/huawei_cdc_ncm.c
+@@ -80,6 +80,12 @@ static int huawei_cdc_ncm_bind(struct usbnet *usbnet_dev,
+ 	 * be at the end of the frame.
+ 	 */
+ 	drvflags |= CDC_NCM_FLAG_NDP_TO_END;
++
++	/* Additionally, it has been reported that some Huawei E3372H devices, with
++	 * firmware version 21.318.01.00.541, come out of reset in NTB32 format mode, hence
++	 * needing to be set to the NTB16 one again.
++	 */
++	drvflags |= CDC_NCM_FLAG_RESET_NTB16;
+ 	ret = cdc_ncm_bind_common(usbnet_dev, intf, 1, drvflags);
+ 	if (ret)
+ 		goto err;
+diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
+index e1d59da2ad20..ca8797c65312 100644
+--- a/drivers/net/wireless/ath/wcn36xx/main.c
++++ b/drivers/net/wireless/ath/wcn36xx/main.c
+@@ -1165,11 +1165,12 @@ static int wcn36xx_remove(struct platform_device *pdev)
+ 	wcn36xx_dbg(WCN36XX_DBG_MAC, "platform remove\n");
+ 
+ 	release_firmware(wcn->nv);
+-	mutex_destroy(&wcn->hal_mutex);
+ 
+ 	ieee80211_unregister_hw(hw);
+ 	iounmap(wcn->dxe_base);
+ 	iounmap(wcn->ccu_base);
++
++	mutex_destroy(&wcn->hal_mutex);
+ 	ieee80211_free_hw(hw);
+ 
+ 	return 0;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index 27960b0bfbcd..425a89c635d0 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6572,8 +6572,7 @@ static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
+ 			wiphy->bands[NL80211_BAND_5GHZ] = band;
+ 		}
+ 	}
+-	err = brcmf_setup_wiphybands(wiphy);
+-	return err;
++	return 0;
+ }
+ 
+ static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
+@@ -6938,6 +6937,12 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
+ 		goto priv_out;
+ 	}
+ 
++	err = brcmf_setup_wiphybands(wiphy);
++	if (err) {
++		brcmf_err("Setting wiphy bands failed (%d)\n", err);
++		goto wiphy_unreg_out;
++	}
++
+ 	/* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
+ 	 * setup 40MHz in 2GHz band and enable OBSS scanning.
+ 	 */
+diff --git a/drivers/net/wireless/marvell/libertas/cmd.c b/drivers/net/wireless/marvell/libertas/cmd.c
+index 301170cccfff..033ff881c751 100644
+--- a/drivers/net/wireless/marvell/libertas/cmd.c
++++ b/drivers/net/wireless/marvell/libertas/cmd.c
+@@ -305,7 +305,7 @@ int lbs_cmd_802_11_sleep_params(struct lbs_private *priv, uint16_t cmd_action,
+ 	}
+ 
+ 	lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
+-	return 0;
++	return ret;
+ }
+ 
+ static int lbs_wait_for_ds_awake(struct lbs_private *priv)
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+index 4b0bb6b4f6f1..c636e6065548 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+@@ -646,10 +646,9 @@ static void rt2800usb_txdone_nostatus(struct rt2x00_dev *rt2x00dev)
+ 			    !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
+ 				break;
+ 
+-			if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
++			if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags) ||
++			    rt2800usb_entry_txstatus_timeout(entry))
+ 				rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
+-			else if (rt2800usb_entry_txstatus_timeout(entry))
+-				rt2x00lib_txdone_noinfo(entry, TXDONE_UNKNOWN);
+ 			else
+ 				break;
+ 		}
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index d9b5b73c35a0..a7bdb1ffac2e 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -67,6 +67,7 @@ module_param(rx_drain_timeout_msecs, uint, 0444);
+ unsigned int rx_stall_timeout_msecs = 60000;
+ module_param(rx_stall_timeout_msecs, uint, 0444);
+ 
++#define MAX_QUEUES_DEFAULT 8
+ unsigned int xenvif_max_queues;
+ module_param_named(max_queues, xenvif_max_queues, uint, 0644);
+ MODULE_PARM_DESC(max_queues,
+@@ -1626,11 +1627,12 @@ static int __init netback_init(void)
+ 	if (!xen_domain())
+ 		return -ENODEV;
+ 
+-	/* Allow as many queues as there are CPUs if user has not
++	/* Allow as many queues as there are CPUs but max. 8 if user has not
+ 	 * specified a value.
+ 	 */
+ 	if (xenvif_max_queues == 0)
+-		xenvif_max_queues = num_online_cpus();
++		xenvif_max_queues = min_t(unsigned int, MAX_QUEUES_DEFAULT,
++					  num_online_cpus());
+ 
+ 	if (fatal_skb_slots < XEN_NETBK_LEGACY_SLOTS_MAX) {
+ 		pr_info("fatal_skb_slots too small (%d), bump it to XEN_NETBK_LEGACY_SLOTS_MAX (%d)\n",
+diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
+index 45a89d969700..90e0b6f134ad 100644
+--- a/drivers/pci/host/pci-mvebu.c
++++ b/drivers/pci/host/pci-mvebu.c
+@@ -133,6 +133,12 @@ struct mvebu_pcie {
+ 	int nports;
+ };
+ 
++struct mvebu_pcie_window {
++	phys_addr_t base;
++	phys_addr_t remap;
++	size_t size;
++};
++
+ /* Structure representing one PCIe interface */
+ struct mvebu_pcie_port {
+ 	char *name;
+@@ -150,10 +156,8 @@ struct mvebu_pcie_port {
+ 	struct mvebu_sw_pci_bridge bridge;
+ 	struct device_node *dn;
+ 	struct mvebu_pcie *pcie;
+-	phys_addr_t memwin_base;
+-	size_t memwin_size;
+-	phys_addr_t iowin_base;
+-	size_t iowin_size;
++	struct mvebu_pcie_window memwin;
++	struct mvebu_pcie_window iowin;
+ 	u32 saved_pcie_stat;
+ };
+ 
+@@ -379,23 +383,45 @@ static void mvebu_pcie_add_windows(struct mvebu_pcie_port *port,
+ 	}
+ }
+ 
++static void mvebu_pcie_set_window(struct mvebu_pcie_port *port,
++				  unsigned int target, unsigned int attribute,
++				  const struct mvebu_pcie_window *desired,
++				  struct mvebu_pcie_window *cur)
++{
++	if (desired->base == cur->base && desired->remap == cur->remap &&
++	    desired->size == cur->size)
++		return;
++
++	if (cur->size != 0) {
++		mvebu_pcie_del_windows(port, cur->base, cur->size);
++		cur->size = 0;
++		cur->base = 0;
++
++		/*
++		 * If something tries to change the window while it is enabled
++		 * the change will not be done atomically. That would be
++		 * difficult to do in the general case.
++		 */
++	}
++
++	if (desired->size == 0)
++		return;
++
++	mvebu_pcie_add_windows(port, target, attribute, desired->base,
++			       desired->size, desired->remap);
++	*cur = *desired;
++}
++
+ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
+ {
+-	phys_addr_t iobase;
++	struct mvebu_pcie_window desired = {};
+ 
+ 	/* Are the new iobase/iolimit values invalid? */
+ 	if (port->bridge.iolimit < port->bridge.iobase ||
+ 	    port->bridge.iolimitupper < port->bridge.iobaseupper ||
+ 	    !(port->bridge.command & PCI_COMMAND_IO)) {
+-
+-		/* If a window was configured, remove it */
+-		if (port->iowin_base) {
+-			mvebu_pcie_del_windows(port, port->iowin_base,
+-					       port->iowin_size);
+-			port->iowin_base = 0;
+-			port->iowin_size = 0;
+-		}
+-
++		mvebu_pcie_set_window(port, port->io_target, port->io_attr,
++				      &desired, &port->iowin);
+ 		return;
+ 	}
+ 
+@@ -412,32 +438,27 @@ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
+ 	 * specifications. iobase is the bus address, port->iowin_base
+ 	 * is the CPU address.
+ 	 */
+-	iobase = ((port->bridge.iobase & 0xF0) << 8) |
+-		(port->bridge.iobaseupper << 16);
+-	port->iowin_base = port->pcie->io.start + iobase;
+-	port->iowin_size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) |
+-			    (port->bridge.iolimitupper << 16)) -
+-			    iobase) + 1;
+-
+-	mvebu_pcie_add_windows(port, port->io_target, port->io_attr,
+-			       port->iowin_base, port->iowin_size,
+-			       iobase);
++	desired.remap = ((port->bridge.iobase & 0xF0) << 8) |
++			(port->bridge.iobaseupper << 16);
++	desired.base = port->pcie->io.start + desired.remap;
++	desired.size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) |
++			 (port->bridge.iolimitupper << 16)) -
++			desired.remap) +
++		       1;
++
++	mvebu_pcie_set_window(port, port->io_target, port->io_attr, &desired,
++			      &port->iowin);
+ }
+ 
+ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port)
+ {
++	struct mvebu_pcie_window desired = {.remap = MVEBU_MBUS_NO_REMAP};
++
+ 	/* Are the new membase/memlimit values invalid? */
+ 	if (port->bridge.memlimit < port->bridge.membase ||
+ 	    !(port->bridge.command & PCI_COMMAND_MEMORY)) {
+-
+-		/* If a window was configured, remove it */
+-		if (port->memwin_base) {
+-			mvebu_pcie_del_windows(port, port->memwin_base,
+-					       port->memwin_size);
+-			port->memwin_base = 0;
+-			port->memwin_size = 0;
+-		}
+-
++		mvebu_pcie_set_window(port, port->mem_target, port->mem_attr,
++				      &desired, &port->memwin);
+ 		return;
+ 	}
+ 
+@@ -447,14 +468,12 @@ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port)
+ 	 * window to setup, according to the PCI-to-PCI bridge
+ 	 * specifications.
+ 	 */
+-	port->memwin_base  = ((port->bridge.membase & 0xFFF0) << 16);
+-	port->memwin_size  =
+-		(((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) -
+-		port->memwin_base + 1;
+-
+-	mvebu_pcie_add_windows(port, port->mem_target, port->mem_attr,
+-			       port->memwin_base, port->memwin_size,
+-			       MVEBU_MBUS_NO_REMAP);
++	desired.base = ((port->bridge.membase & 0xFFF0) << 16);
++	desired.size = (((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) -
++		       desired.base + 1;
++
++	mvebu_pcie_set_window(port, port->mem_target, port->mem_attr, &desired,
++			      &port->memwin);
+ }
+ 
+ /*
+diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
+index 5419de8e20b1..0a965026b134 100644
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -1466,7 +1466,7 @@ static void byt_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip)
+ 			   val & BYT_INPUT_EN ? "  " : "in",
+ 			   val & BYT_OUTPUT_EN ? "   " : "out",
+ 			   val & BYT_LEVEL ? "hi" : "lo",
+-			   comm->pad_map[i], comm->pad_map[i] * 32,
++			   comm->pad_map[i], comm->pad_map[i] * 16,
+ 			   conf0 & 0x7,
+ 			   conf0 & BYT_TRIG_NEG ? " fall" : "     ",
+ 			   conf0 & BYT_TRIG_POS ? " rise" : "     ",
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index 96ffda493266..454cb2ee3cee 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -248,7 +248,7 @@ static int hp_wmi_display_state(void)
+ 	int ret = hp_wmi_perform_query(HPWMI_DISPLAY_QUERY, 0, &state,
+ 				       sizeof(state), sizeof(state));
+ 	if (ret)
+-		return -EINVAL;
++		return ret < 0 ? ret : -EINVAL;
+ 	return state;
+ }
+ 
+@@ -258,7 +258,7 @@ static int hp_wmi_hddtemp_state(void)
+ 	int ret = hp_wmi_perform_query(HPWMI_HDDTEMP_QUERY, 0, &state,
+ 				       sizeof(state), sizeof(state));
+ 	if (ret)
+-		return -EINVAL;
++		return ret < 0 ? ret : -EINVAL;
+ 	return state;
+ }
+ 
+@@ -268,7 +268,7 @@ static int hp_wmi_als_state(void)
+ 	int ret = hp_wmi_perform_query(HPWMI_ALS_QUERY, 0, &state,
+ 				       sizeof(state), sizeof(state));
+ 	if (ret)
+-		return -EINVAL;
++		return ret < 0 ? ret : -EINVAL;
+ 	return state;
+ }
+ 
+@@ -279,7 +279,7 @@ static int hp_wmi_dock_state(void)
+ 				       sizeof(state), sizeof(state));
+ 
+ 	if (ret)
+-		return -EINVAL;
++		return ret < 0 ? ret : -EINVAL;
+ 
+ 	return state & 0x1;
+ }
+@@ -290,7 +290,7 @@ static int hp_wmi_tablet_state(void)
+ 	int ret = hp_wmi_perform_query(HPWMI_HARDWARE_QUERY, 0, &state,
+ 				       sizeof(state), sizeof(state));
+ 	if (ret)
+-		return ret;
++		return ret < 0 ? ret : -EINVAL;
+ 
+ 	return (state & 0x4) ? 1 : 0;
+ }
+@@ -323,7 +323,7 @@ static int __init hp_wmi_enable_hotkeys(void)
+ 	int ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &value,
+ 				       sizeof(value), 0);
+ 	if (ret)
+-		return -EINVAL;
++		return ret < 0 ? ret : -EINVAL;
+ 	return 0;
+ }
+ 
+@@ -336,7 +336,7 @@ static int hp_wmi_set_block(void *data, bool blocked)
+ 	ret = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1,
+ 				   &query, sizeof(query), 0);
+ 	if (ret)
+-		return -EINVAL;
++		return ret < 0 ? ret : -EINVAL;
+ 	return 0;
+ }
+ 
+@@ -428,7 +428,7 @@ static int hp_wmi_post_code_state(void)
+ 	int ret = hp_wmi_perform_query(HPWMI_POSTCODEERROR_QUERY, 0, &state,
+ 				       sizeof(state), sizeof(state));
+ 	if (ret)
+-		return -EINVAL;
++		return ret < 0 ? ret : -EINVAL;
+ 	return state;
+ }
+ 
+@@ -494,7 +494,7 @@ static ssize_t set_als(struct device *dev, struct device_attribute *attr,
+ 	int ret = hp_wmi_perform_query(HPWMI_ALS_QUERY, 1, &tmp,
+ 				       sizeof(tmp), sizeof(tmp));
+ 	if (ret)
+-		return -EINVAL;
++		return ret < 0 ? ret : -EINVAL;
+ 
+ 	return count;
+ }
+@@ -515,7 +515,7 @@ static ssize_t set_postcode(struct device *dev, struct device_attribute *attr,
+ 	ret = hp_wmi_perform_query(HPWMI_POSTCODEERROR_QUERY, 1, &tmp,
+ 				       sizeof(tmp), sizeof(tmp));
+ 	if (ret)
+-		return -EINVAL;
++		return ret < 0 ? ret : -EINVAL;
+ 
+ 	return count;
+ }
+@@ -572,10 +572,12 @@ static void hp_wmi_notify(u32 value, void *context)
+ 
+ 	switch (event_id) {
+ 	case HPWMI_DOCK_EVENT:
+-		input_report_switch(hp_wmi_input_dev, SW_DOCK,
+-				    hp_wmi_dock_state());
+-		input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
+-				    hp_wmi_tablet_state());
++		if (test_bit(SW_DOCK, hp_wmi_input_dev->swbit))
++			input_report_switch(hp_wmi_input_dev, SW_DOCK,
++					    hp_wmi_dock_state());
++		if (test_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit))
++			input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
++					    hp_wmi_tablet_state());
+ 		input_sync(hp_wmi_input_dev);
+ 		break;
+ 	case HPWMI_PARK_HDD:
+@@ -644,6 +646,7 @@ static int __init hp_wmi_input_setup(void)
+ {
+ 	acpi_status status;
+ 	int err;
++	int val;
+ 
+ 	hp_wmi_input_dev = input_allocate_device();
+ 	if (!hp_wmi_input_dev)
+@@ -654,17 +657,26 @@ static int __init hp_wmi_input_setup(void)
+ 	hp_wmi_input_dev->id.bustype = BUS_HOST;
+ 
+ 	__set_bit(EV_SW, hp_wmi_input_dev->evbit);
+-	__set_bit(SW_DOCK, hp_wmi_input_dev->swbit);
+-	__set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit);
++
++	/* Dock */
++	val = hp_wmi_dock_state();
++	if (!(val < 0)) {
++		__set_bit(SW_DOCK, hp_wmi_input_dev->swbit);
++		input_report_switch(hp_wmi_input_dev, SW_DOCK, val);
++	}
++
++	/* Tablet mode */
++	val = hp_wmi_tablet_state();
++	if (!(val < 0)) {
++		__set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit);
++		input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, val);
++	}
+ 
+ 	err = sparse_keymap_setup(hp_wmi_input_dev, hp_wmi_keymap, NULL);
+ 	if (err)
+ 		goto err_free_dev;
+ 
+ 	/* Set initial hardware state */
+-	input_report_switch(hp_wmi_input_dev, SW_DOCK, hp_wmi_dock_state());
+-	input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
+-			    hp_wmi_tablet_state());
+ 	input_sync(hp_wmi_input_dev);
+ 
+ 	if (!hp_wmi_bios_2009_later() && hp_wmi_bios_2008_later())
+@@ -950,10 +962,12 @@ static int hp_wmi_resume_handler(struct device *device)
+ 	 * changed.
+ 	 */
+ 	if (hp_wmi_input_dev) {
+-		input_report_switch(hp_wmi_input_dev, SW_DOCK,
+-				    hp_wmi_dock_state());
+-		input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
+-				    hp_wmi_tablet_state());
++		if (test_bit(SW_DOCK, hp_wmi_input_dev->swbit))
++			input_report_switch(hp_wmi_input_dev, SW_DOCK,
++					    hp_wmi_dock_state());
++		if (test_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit))
++			input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
++					    hp_wmi_tablet_state());
+ 		input_sync(hp_wmi_input_dev);
+ 	}
+ 
+diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
+index f3756ca6f349..d55e6438bb5e 100644
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -921,7 +921,6 @@ void qeth_clear_thread_running_bit(struct qeth_card *, unsigned long);
+ int qeth_core_hardsetup_card(struct qeth_card *);
+ void qeth_print_status_message(struct qeth_card *);
+ int qeth_init_qdio_queues(struct qeth_card *);
+-int qeth_send_startlan(struct qeth_card *);
+ int qeth_send_ipa_cmd(struct qeth_card *, struct qeth_cmd_buffer *,
+ 		  int (*reply_cb)
+ 		  (struct qeth_card *, struct qeth_reply *, unsigned long),
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index e8c48309ebe9..21ef8023430f 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -2944,7 +2944,7 @@ int qeth_send_ipa_cmd(struct qeth_card *card, struct qeth_cmd_buffer *iob,
+ }
+ EXPORT_SYMBOL_GPL(qeth_send_ipa_cmd);
+ 
+-int qeth_send_startlan(struct qeth_card *card)
++static int qeth_send_startlan(struct qeth_card *card)
+ {
+ 	int rc;
+ 	struct qeth_cmd_buffer *iob;
+@@ -2957,7 +2957,6 @@ int qeth_send_startlan(struct qeth_card *card)
+ 	rc = qeth_send_ipa_cmd(card, iob, NULL, NULL);
+ 	return rc;
+ }
+-EXPORT_SYMBOL_GPL(qeth_send_startlan);
+ 
+ static int qeth_default_setadapterparms_cb(struct qeth_card *card,
+ 		struct qeth_reply *reply, unsigned long data)
+@@ -5091,6 +5090,20 @@ int qeth_core_hardsetup_card(struct qeth_card *card)
+ 		goto out;
+ 	}
+ 
++	rc = qeth_send_startlan(card);
++	if (rc) {
++		QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
++		if (rc == IPA_RC_LAN_OFFLINE) {
++			dev_warn(&card->gdev->dev,
++				"The LAN is offline\n");
++			card->lan_online = 0;
++		} else {
++			rc = -ENODEV;
++			goto out;
++		}
++	} else
++		card->lan_online = 1;
++
+ 	card->options.ipa4.supported_funcs = 0;
+ 	card->options.ipa6.supported_funcs = 0;
+ 	card->options.adp.supported_funcs = 0;
+@@ -5102,14 +5115,14 @@ int qeth_core_hardsetup_card(struct qeth_card *card)
+ 	if (qeth_is_supported(card, IPA_SETADAPTERPARMS)) {
+ 		rc = qeth_query_setadapterparms(card);
+ 		if (rc < 0) {
+-			QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
++			QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc);
+ 			goto out;
+ 		}
+ 	}
+ 	if (qeth_adp_supported(card, IPA_SETADP_SET_DIAG_ASSIST)) {
+ 		rc = qeth_query_setdiagass(card);
+ 		if (rc < 0) {
+-			QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc);
++			QETH_DBF_TEXT_(SETUP, 2, "8err%d", rc);
+ 			goto out;
+ 		}
+ 	}
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index 5d010aa89852..8530477caab8 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -1204,21 +1204,6 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
+ 	/* softsetup */
+ 	QETH_DBF_TEXT(SETUP, 2, "softsetp");
+ 
+-	rc = qeth_send_startlan(card);
+-	if (rc) {
+-		QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
+-		if (rc == 0xe080) {
+-			dev_warn(&card->gdev->dev,
+-				"The LAN is offline\n");
+-			card->lan_online = 0;
+-			goto contin;
+-		}
+-		rc = -ENODEV;
+-		goto out_remove;
+-	} else
+-		card->lan_online = 1;
+-
+-contin:
+ 	if ((card->info.type == QETH_CARD_TYPE_OSD) ||
+ 	    (card->info.type == QETH_CARD_TYPE_OSX)) {
+ 		rc = qeth_l2_start_ipassists(card);
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index 171be5ec2ece..03a2619166ca 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -3230,21 +3230,6 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
+ 	/* softsetup */
+ 	QETH_DBF_TEXT(SETUP, 2, "softsetp");
+ 
+-	rc = qeth_send_startlan(card);
+-	if (rc) {
+-		QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
+-		if (rc == 0xe080) {
+-			dev_warn(&card->gdev->dev,
+-				"The LAN is offline\n");
+-			card->lan_online = 0;
+-			goto contin;
+-		}
+-		rc = -ENODEV;
+-		goto out_remove;
+-	} else
+-		card->lan_online = 1;
+-
+-contin:
+ 	rc = qeth_l3_setadapter_parms(card);
+ 	if (rc)
+ 		QETH_DBF_TEXT_(SETUP, 2, "2err%04x", rc);
+diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
+index 0e00a5ce0f00..cffe42f5775d 100644
+--- a/drivers/s390/net/qeth_l3_sys.c
++++ b/drivers/s390/net/qeth_l3_sys.c
+@@ -692,15 +692,15 @@ static ssize_t qeth_l3_dev_vipa_add_show(char *buf, struct qeth_card *card,
+ 			enum qeth_prot_versions proto)
+ {
+ 	struct qeth_ipaddr *ipaddr;
+-	struct hlist_node  *tmp;
+ 	char addr_str[40];
++	int str_len = 0;
+ 	int entry_len; /* length of 1 entry string, differs between v4 and v6 */
+-	int i = 0;
++	int i;
+ 
+ 	entry_len = (proto == QETH_PROT_IPV4)? 12 : 40;
+ 	entry_len += 2; /* \n + terminator */
+ 	spin_lock_bh(&card->ip_lock);
+-	hash_for_each_safe(card->ip_htable, i, tmp, ipaddr, hnode) {
++	hash_for_each(card->ip_htable, i, ipaddr, hnode) {
+ 		if (ipaddr->proto != proto)
+ 			continue;
+ 		if (ipaddr->type != QETH_IP_TYPE_VIPA)
+@@ -708,16 +708,17 @@ static ssize_t qeth_l3_dev_vipa_add_show(char *buf, struct qeth_card *card,
+ 		/* String must not be longer than PAGE_SIZE. So we check if
+ 		 * string length gets near PAGE_SIZE. Then we can savely display
+ 		 * the next IPv6 address (worst case, compared to IPv4) */
+-		if ((PAGE_SIZE - i) <= entry_len)
++		if ((PAGE_SIZE - str_len) <= entry_len)
+ 			break;
+ 		qeth_l3_ipaddr_to_string(proto, (const u8 *)&ipaddr->u,
+ 			addr_str);
+-		i += snprintf(buf + i, PAGE_SIZE - i, "%s\n", addr_str);
++		str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "%s\n",
++				    addr_str);
+ 	}
+ 	spin_unlock_bh(&card->ip_lock);
+-	i += snprintf(buf + i, PAGE_SIZE - i, "\n");
++	str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "\n");
+ 
+-	return i;
++	return str_len;
+ }
+ 
+ static ssize_t qeth_l3_dev_vipa_add4_show(struct device *dev,
+@@ -854,15 +855,15 @@ static ssize_t qeth_l3_dev_rxip_add_show(char *buf, struct qeth_card *card,
+ 		       enum qeth_prot_versions proto)
+ {
+ 	struct qeth_ipaddr *ipaddr;
+-	struct hlist_node *tmp;
+ 	char addr_str[40];
++	int str_len = 0;
+ 	int entry_len; /* length of 1 entry string, differs between v4 and v6 */
+-	int i = 0;
++	int i;
+ 
+ 	entry_len = (proto == QETH_PROT_IPV4)? 12 : 40;
+ 	entry_len += 2; /* \n + terminator */
+ 	spin_lock_bh(&card->ip_lock);
+-	hash_for_each_safe(card->ip_htable, i, tmp, ipaddr, hnode) {
++	hash_for_each(card->ip_htable, i, ipaddr, hnode) {
+ 		if (ipaddr->proto != proto)
+ 			continue;
+ 		if (ipaddr->type != QETH_IP_TYPE_RXIP)
+@@ -870,16 +871,17 @@ static ssize_t qeth_l3_dev_rxip_add_show(char *buf, struct qeth_card *card,
+ 		/* String must not be longer than PAGE_SIZE. So we check if
+ 		 * string length gets near PAGE_SIZE. Then we can savely display
+ 		 * the next IPv6 address (worst case, compared to IPv4) */
+-		if ((PAGE_SIZE - i) <= entry_len)
++		if ((PAGE_SIZE - str_len) <= entry_len)
+ 			break;
+ 		qeth_l3_ipaddr_to_string(proto, (const u8 *)&ipaddr->u,
+ 			addr_str);
+-		i += snprintf(buf + i, PAGE_SIZE - i, "%s\n", addr_str);
++		str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "%s\n",
++				    addr_str);
+ 	}
+ 	spin_unlock_bh(&card->ip_lock);
+-	i += snprintf(buf + i, PAGE_SIZE - i, "\n");
++	str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "\n");
+ 
+-	return i;
++	return str_len;
+ }
+ 
+ static ssize_t qeth_l3_dev_rxip_add4_show(struct device *dev,
+diff --git a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
+index 38dca69a06eb..ce500a509aa2 100644
+--- a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
++++ b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
+@@ -260,7 +260,7 @@ static int iio_bfin_tmr_trigger_probe(struct platform_device *pdev)
+ out1:
+ 	iio_trigger_unregister(st->trig);
+ out:
+-	iio_trigger_put(st->trig);
++	iio_trigger_free(st->trig);
+ 	return ret;
+ }
+ 
+@@ -273,7 +273,7 @@ static int iio_bfin_tmr_trigger_remove(struct platform_device *pdev)
+ 		peripheral_free(st->t->pin);
+ 	free_irq(st->irq, st);
+ 	iio_trigger_unregister(st->trig);
+-	iio_trigger_put(st->trig);
++	iio_trigger_free(st->trig);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 7e97a1ccab23..15eaea53b3df 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -193,18 +193,17 @@ static const struct plat_sci_reg sci_regmap[SCIx_NR_REGTYPES][SCIx_NR_REGS] = {
+ 	},
+ 
+ 	/*
+-	 * Common definitions for legacy IrDA ports, dependent on
+-	 * regshift value.
++	 * Common definitions for legacy IrDA ports.
+ 	 */
+ 	[SCIx_IRDA_REGTYPE] = {
+ 		[SCSMR]		= { 0x00,  8 },
+-		[SCBRR]		= { 0x01,  8 },
+-		[SCSCR]		= { 0x02,  8 },
+-		[SCxTDR]	= { 0x03,  8 },
+-		[SCxSR]		= { 0x04,  8 },
+-		[SCxRDR]	= { 0x05,  8 },
+-		[SCFCR]		= { 0x06,  8 },
+-		[SCFDR]		= { 0x07, 16 },
++		[SCBRR]		= { 0x02,  8 },
++		[SCSCR]		= { 0x04,  8 },
++		[SCxTDR]	= { 0x06,  8 },
++		[SCxSR]		= { 0x08, 16 },
++		[SCxRDR]	= { 0x0a,  8 },
++		[SCFCR]		= { 0x0c,  8 },
++		[SCFDR]		= { 0x0e, 16 },
+ 		[SCTFDR]	= sci_reg_invalid,
+ 		[SCRFDR]	= sci_reg_invalid,
+ 		[SCSPTR]	= sci_reg_invalid,
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index 882fc4e08284..fcc7aa248ce7 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -3023,6 +3023,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)
+ 	}
+ 
+ 	usb_put_invalidate_rhdev(hcd);
++	hcd->flags = 0;
+ }
+ EXPORT_SYMBOL_GPL(usb_remove_hcd);
+ 
+diff --git a/drivers/video/fbdev/pmag-ba-fb.c b/drivers/video/fbdev/pmag-ba-fb.c
+index 5872bc4af3ce..df02fb4b7fd1 100644
+--- a/drivers/video/fbdev/pmag-ba-fb.c
++++ b/drivers/video/fbdev/pmag-ba-fb.c
+@@ -129,7 +129,7 @@ static struct fb_ops pmagbafb_ops = {
+ /*
+  * Turn the hardware cursor off.
+  */
+-static void __init pmagbafb_erase_cursor(struct fb_info *info)
++static void pmagbafb_erase_cursor(struct fb_info *info)
+ {
+ 	struct pmagbafb_par *par = info->par;
+ 
+diff --git a/include/dt-bindings/clock/exynos5433.h b/include/dt-bindings/clock/exynos5433.h
+index 4fa6bb2136e3..be39d23e6a32 100644
+--- a/include/dt-bindings/clock/exynos5433.h
++++ b/include/dt-bindings/clock/exynos5433.h
+@@ -771,7 +771,10 @@
+ 
+ #define CLK_PCLK_DECON					113
+ 
+-#define DISP_NR_CLK					114
++#define CLK_PHYCLK_MIPIDPHY0_BITCLKDIV8_PHY		114
++#define CLK_PHYCLK_MIPIDPHY0_RXCLKESC0_PHY		115
++
++#define DISP_NR_CLK					116
+ 
+ /* CMU_AUD */
+ #define CLK_MOUT_AUD_PLL_USER				1
+diff --git a/include/linux/phy.h b/include/linux/phy.h
+index 8431c8c0c320..a04d69ab7c34 100644
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -142,11 +142,7 @@ static inline const char *phy_modes(phy_interface_t interface)
+ /* Used when trying to connect to a specific phy (mii bus id:phy device id) */
+ #define PHY_ID_FMT "%s:%02x"
+ 
+-/*
+- * Need to be a little smaller than phydev->dev.bus_id to leave room
+- * for the ":%02x"
+- */
+-#define MII_BUS_ID_SIZE	(20 - 3)
++#define MII_BUS_ID_SIZE	61
+ 
+ /* Or MII_ADDR_C45 into regnum for read/write on mii_bus to enable the 21 bit
+    IEEE 802.3ae clause 45 addressing mode used by 10GIGE phy chips. */
+@@ -602,7 +598,7 @@ struct phy_driver {
+ /* A Structure for boards to register fixups with the PHY Lib */
+ struct phy_fixup {
+ 	struct list_head list;
+-	char bus_id[20];
++	char bus_id[MII_BUS_ID_SIZE + 3];
+ 	u32 phy_uid;
+ 	u32 phy_uid_mask;
+ 	int (*run)(struct phy_device *phydev);
+diff --git a/include/linux/preempt.h b/include/linux/preempt.h
+index 75e4e30677f1..7eeceac52dea 100644
+--- a/include/linux/preempt.h
++++ b/include/linux/preempt.h
+@@ -65,19 +65,24 @@
+ 
+ /*
+  * Are we doing bottom half or hardware interrupt processing?
+- * Are we in a softirq context? Interrupt context?
+- * in_softirq - Are we currently processing softirq or have bh disabled?
+- * in_serving_softirq - Are we currently processing softirq?
++ *
++ * in_irq()       - We're in (hard) IRQ context
++ * in_softirq()   - We have BH disabled, or are processing softirqs
++ * in_interrupt() - We're in NMI,IRQ,SoftIRQ context or have BH disabled
++ * in_serving_softirq() - We're in softirq context
++ * in_nmi()       - We're in NMI context
++ * in_task()	  - We're in task context
++ *
++ * Note: due to the BH disabled confusion: in_softirq(),in_interrupt() really
++ *       should not be used in new code.
+  */
+ #define in_irq()		(hardirq_count())
+ #define in_softirq()		(softirq_count())
+ #define in_interrupt()		(irq_count())
+ #define in_serving_softirq()	(softirq_count() & SOFTIRQ_OFFSET)
+-
+-/*
+- * Are we in NMI context?
+- */
+-#define in_nmi()	(preempt_count() & NMI_MASK)
++#define in_nmi()		(preempt_count() & NMI_MASK)
++#define in_task()		(!(preempt_count() & \
++				   (NMI_MASK | HARDIRQ_MASK | SOFTIRQ_OFFSET)))
+ 
+ /*
+  * The preempt_count offset after preempt_disable();
+diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
+index 00d232406f18..b0fad110817b 100644
+--- a/include/linux/usb/cdc_ncm.h
++++ b/include/linux/usb/cdc_ncm.h
+@@ -83,6 +83,7 @@
+ /* Driver flags */
+ #define CDC_NCM_FLAG_NDP_TO_END			0x02	/* NDP is placed at end of frame */
+ #define CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE	0x04	/* Avoid altsetting toggle during init */
++#define CDC_NCM_FLAG_RESET_NTB16 0x08	/* set NDP16 one more time after altsetting switch */
+ 
+ #define cdc_ncm_comm_intf_is_mbim(x)  ((x)->desc.bInterfaceSubClass == USB_CDC_SUBCLASS_MBIM && \
+ 				       (x)->desc.bInterfaceProtocol == USB_CDC_PROTO_NONE)
+diff --git a/include/sound/seq_kernel.h b/include/sound/seq_kernel.h
+index feb58d455560..4b9ee3009aa0 100644
+--- a/include/sound/seq_kernel.h
++++ b/include/sound/seq_kernel.h
+@@ -49,7 +49,8 @@ typedef union snd_seq_timestamp snd_seq_timestamp_t;
+ #define SNDRV_SEQ_DEFAULT_CLIENT_EVENTS	200
+ 
+ /* max delivery path length */
+-#define SNDRV_SEQ_MAX_HOPS		10
++/* NOTE: this shouldn't be greater than MAX_LOCKDEP_SUBCLASSES */
++#define SNDRV_SEQ_MAX_HOPS		8
+ 
+ /* max size of event size */
+ #define SNDRV_SEQ_MAX_EVENT_LEN		0x3fffffff
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 02e7ad860b52..78181c03d9c7 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -7961,6 +7961,7 @@ void sched_move_task(struct task_struct *tsk)
+ 	struct rq *rq;
+ 
+ 	rq = task_rq_lock(tsk, &rf);
++	update_rq_clock(rq);
+ 
+ 	running = task_current(rq, tsk);
+ 	queued = task_on_rq_queued(tsk);
+diff --git a/kernel/workqueue_internal.h b/kernel/workqueue_internal.h
+index 8635417c587b..29fa81f0f51a 100644
+--- a/kernel/workqueue_internal.h
++++ b/kernel/workqueue_internal.h
+@@ -9,6 +9,7 @@
+ 
+ #include <linux/workqueue.h>
+ #include <linux/kthread.h>
++#include <linux/preempt.h>
+ 
+ struct worker_pool;
+ 
+@@ -59,7 +60,7 @@ struct worker {
+  */
+ static inline struct worker *current_wq_worker(void)
+ {
+-	if (current->flags & PF_WQ_WORKER)
++	if (in_task() && (current->flags & PF_WQ_WORKER))
+ 		return kthread_data(current);
+ 	return NULL;
+ }
+diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c
+index fef5d2e114be..1ef0cec38d78 100644
+--- a/lib/asn1_decoder.c
++++ b/lib/asn1_decoder.c
+@@ -228,7 +228,7 @@ int asn1_ber_decoder(const struct asn1_decoder *decoder,
+ 		hdr = 2;
+ 
+ 		/* Extract a tag from the data */
+-		if (unlikely(dp >= datalen - 1))
++		if (unlikely(datalen - dp < 2))
+ 			goto data_overrun_error;
+ 		tag = data[dp++];
+ 		if (unlikely((tag & 0x1f) == ASN1_LONG_TAG))
+@@ -274,7 +274,7 @@ int asn1_ber_decoder(const struct asn1_decoder *decoder,
+ 				int n = len - 0x80;
+ 				if (unlikely(n > 2))
+ 					goto length_too_long;
+-				if (unlikely(dp >= datalen - n))
++				if (unlikely(n > datalen - dp))
+ 					goto data_overrun_error;
+ 				hdr += n;
+ 				for (len = 0; n > 0; n--) {
+diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig
+index 96e47c539bee..39bb5b3a82f2 100644
+--- a/net/dsa/Kconfig
++++ b/net/dsa/Kconfig
+@@ -1,12 +1,13 @@
+ config HAVE_NET_DSA
+ 	def_bool y
+-	depends on NETDEVICES && !S390
++	depends on INET && NETDEVICES && !S390
+ 
+ # Drivers must select NET_DSA and the appropriate tagging format
+ 
+ config NET_DSA
+ 	tristate "Distributed Switch Architecture"
+-	depends on HAVE_NET_DSA && NET_SWITCHDEV
++	depends on HAVE_NET_DSA
++	select NET_SWITCHDEV
+ 	select PHYLIB
+ 	---help---
+ 	  Say Y if you want to enable support for the hardware switches supported
+diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
+index f2a71025a770..22377c8ff14b 100644
+--- a/net/ipv4/ah4.c
++++ b/net/ipv4/ah4.c
+@@ -270,6 +270,9 @@ static void ah_input_done(struct crypto_async_request *base, int err)
+ 	int ihl = ip_hdrlen(skb);
+ 	int ah_hlen = (ah->hdrlen + 2) << 2;
+ 
++	if (err)
++		goto out;
++
+ 	work_iph = AH_SKB_CB(skb)->tmp;
+ 	auth_data = ah_tmp_auth(work_iph, ihl);
+ 	icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
+diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
+index 6c1e0246706e..7c3395513ff0 100644
+--- a/net/netfilter/nft_meta.c
++++ b/net/netfilter/nft_meta.c
+@@ -159,8 +159,34 @@ void nft_meta_get_eval(const struct nft_expr *expr,
+ 			else
+ 				*dest = PACKET_BROADCAST;
+ 			break;
++		case NFPROTO_NETDEV:
++			switch (skb->protocol) {
++			case htons(ETH_P_IP): {
++				int noff = skb_network_offset(skb);
++				struct iphdr *iph, _iph;
++
++				iph = skb_header_pointer(skb, noff,
++							 sizeof(_iph), &_iph);
++				if (!iph)
++					goto err;
++
++				if (ipv4_is_multicast(iph->daddr))
++					*dest = PACKET_MULTICAST;
++				else
++					*dest = PACKET_BROADCAST;
++
++				break;
++			}
++			case htons(ETH_P_IPV6):
++				*dest = PACKET_MULTICAST;
++				break;
++			default:
++				WARN_ON_ONCE(1);
++				goto err;
++			}
++			break;
+ 		default:
+-			WARN_ON(1);
++			WARN_ON_ONCE(1);
+ 			goto err;
+ 		}
+ 		break;
+diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
+index 41b8cb115801..7d3a98b2d55a 100644
+--- a/security/apparmor/lsm.c
++++ b/security/apparmor/lsm.c
+@@ -671,9 +671,9 @@ enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE;
+ module_param_call(mode, param_set_mode, param_get_mode,
+ 		  &aa_g_profile_mode, S_IRUSR | S_IWUSR);
+ 
+-#ifdef CONFIG_SECURITY_APPARMOR_HASH
+ /* whether policy verification hashing is enabled */
+ bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT);
++#ifdef CONFIG_SECURITY_APPARMOR_HASH
+ module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR);
+ #endif
+ 
+diff --git a/security/keys/trusted.c b/security/keys/trusted.c
+index f4db42e669e9..4ba2f6b91242 100644
+--- a/security/keys/trusted.c
++++ b/security/keys/trusted.c
+@@ -70,7 +70,7 @@ static int TSS_sha1(const unsigned char *data, unsigned int datalen,
+ 	}
+ 
+ 	ret = crypto_shash_digest(&sdesc->shash, data, datalen, digest);
+-	kfree(sdesc);
++	kzfree(sdesc);
+ 	return ret;
+ }
+ 
+@@ -114,7 +114,7 @@ static int TSS_rawhmac(unsigned char *digest, const unsigned char *key,
+ 	if (!ret)
+ 		ret = crypto_shash_final(&sdesc->shash, digest);
+ out:
+-	kfree(sdesc);
++	kzfree(sdesc);
+ 	return ret;
+ }
+ 
+@@ -165,7 +165,7 @@ static int TSS_authhmac(unsigned char *digest, const unsigned char *key,
+ 				  paramdigest, TPM_NONCE_SIZE, h1,
+ 				  TPM_NONCE_SIZE, h2, 1, &c, 0, 0);
+ out:
+-	kfree(sdesc);
++	kzfree(sdesc);
+ 	return ret;
+ }
+ 
+@@ -246,7 +246,7 @@ static int TSS_checkhmac1(unsigned char *buffer,
+ 	if (memcmp(testhmac, authdata, SHA1_DIGEST_SIZE))
+ 		ret = -EINVAL;
+ out:
+-	kfree(sdesc);
++	kzfree(sdesc);
+ 	return ret;
+ }
+ 
+@@ -347,7 +347,7 @@ static int TSS_checkhmac2(unsigned char *buffer,
+ 	if (memcmp(testhmac2, authdata2, SHA1_DIGEST_SIZE))
+ 		ret = -EINVAL;
+ out:
+-	kfree(sdesc);
++	kzfree(sdesc);
+ 	return ret;
+ }
+ 
+@@ -564,7 +564,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
+ 		*bloblen = storedsize;
+ 	}
+ out:
+-	kfree(td);
++	kzfree(td);
+ 	return ret;
+ }
+ 
+@@ -678,7 +678,7 @@ static int key_seal(struct trusted_key_payload *p,
+ 	if (ret < 0)
+ 		pr_info("trusted_key: srkseal failed (%d)\n", ret);
+ 
+-	kfree(tb);
++	kzfree(tb);
+ 	return ret;
+ }
+ 
+@@ -703,7 +703,7 @@ static int key_unseal(struct trusted_key_payload *p,
+ 		/* pull migratable flag out of sealed key */
+ 		p->migratable = p->key[--p->key_len];
+ 
+-	kfree(tb);
++	kzfree(tb);
+ 	return ret;
+ }
+ 
+@@ -1037,12 +1037,12 @@ static int trusted_instantiate(struct key *key,
+ 	if (!ret && options->pcrlock)
+ 		ret = pcrlock(options->pcrlock);
+ out:
+-	kfree(datablob);
+-	kfree(options);
++	kzfree(datablob);
++	kzfree(options);
+ 	if (!ret)
+ 		rcu_assign_keypointer(key, payload);
+ 	else
+-		kfree(payload);
++		kzfree(payload);
+ 	return ret;
+ }
+ 
+@@ -1051,8 +1051,7 @@ static void trusted_rcu_free(struct rcu_head *rcu)
+ 	struct trusted_key_payload *p;
+ 
+ 	p = container_of(rcu, struct trusted_key_payload, rcu);
+-	memset(p->key, 0, p->key_len);
+-	kfree(p);
++	kzfree(p);
+ }
+ 
+ /*
+@@ -1094,13 +1093,13 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep)
+ 	ret = datablob_parse(datablob, new_p, new_o);
+ 	if (ret != Opt_update) {
+ 		ret = -EINVAL;
+-		kfree(new_p);
++		kzfree(new_p);
+ 		goto out;
+ 	}
+ 
+ 	if (!new_o->keyhandle) {
+ 		ret = -EINVAL;
+-		kfree(new_p);
++		kzfree(new_p);
+ 		goto out;
+ 	}
+ 
+@@ -1114,22 +1113,22 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep)
+ 	ret = key_seal(new_p, new_o);
+ 	if (ret < 0) {
+ 		pr_info("trusted_key: key_seal failed (%d)\n", ret);
+-		kfree(new_p);
++		kzfree(new_p);
+ 		goto out;
+ 	}
+ 	if (new_o->pcrlock) {
+ 		ret = pcrlock(new_o->pcrlock);
+ 		if (ret < 0) {
+ 			pr_info("trusted_key: pcrlock failed (%d)\n", ret);
+-			kfree(new_p);
++			kzfree(new_p);
+ 			goto out;
+ 		}
+ 	}
+ 	rcu_assign_keypointer(key, new_p);
+ 	call_rcu(&p->rcu, trusted_rcu_free);
+ out:
+-	kfree(datablob);
+-	kfree(new_o);
++	kzfree(datablob);
++	kzfree(new_o);
+ 	return ret;
+ }
+ 
+@@ -1148,34 +1147,30 @@ static long trusted_read(const struct key *key, char __user *buffer,
+ 	p = rcu_dereference_key(key);
+ 	if (!p)
+ 		return -EINVAL;
+-	if (!buffer || buflen <= 0)
+-		return 2 * p->blob_len;
+-	ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL);
+-	if (!ascii_buf)
+-		return -ENOMEM;
+ 
+-	bufp = ascii_buf;
+-	for (i = 0; i < p->blob_len; i++)
+-		bufp = hex_byte_pack(bufp, p->blob[i]);
+-	if ((copy_to_user(buffer, ascii_buf, 2 * p->blob_len)) != 0) {
+-		kfree(ascii_buf);
+-		return -EFAULT;
++	if (buffer && buflen >= 2 * p->blob_len) {
++		ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL);
++		if (!ascii_buf)
++			return -ENOMEM;
++
++		bufp = ascii_buf;
++		for (i = 0; i < p->blob_len; i++)
++			bufp = hex_byte_pack(bufp, p->blob[i]);
++		if (copy_to_user(buffer, ascii_buf, 2 * p->blob_len) != 0) {
++			kzfree(ascii_buf);
++			return -EFAULT;
++		}
++		kzfree(ascii_buf);
+ 	}
+-	kfree(ascii_buf);
+ 	return 2 * p->blob_len;
+ }
+ 
+ /*
+- * trusted_destroy - before freeing the key, clear the decrypted data
++ * trusted_destroy - clear and free the key's payload
+  */
+ static void trusted_destroy(struct key *key)
+ {
+-	struct trusted_key_payload *p = key->payload.data[0];
+-
+-	if (!p)
+-		return;
+-	memset(p->key, 0, p->key_len);
+-	kfree(key->payload.data[0]);
++	kzfree(key->payload.data[0]);
+ }
+ 
+ struct key_type key_type_trusted = {
+diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c
+index aaff9ee32695..b30b2139e3f0 100644
+--- a/sound/core/seq/oss/seq_oss_midi.c
++++ b/sound/core/seq/oss/seq_oss_midi.c
+@@ -612,9 +612,7 @@ send_midi_event(struct seq_oss_devinfo *dp, struct snd_seq_event *ev, struct seq
+ 	if (!dp->timer->running)
+ 		len = snd_seq_oss_timer_start(dp->timer);
+ 	if (ev->type == SNDRV_SEQ_EVENT_SYSEX) {
+-		if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) == SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
+-			snd_seq_oss_readq_puts(dp->readq, mdev->seq_device,
+-					       ev->data.ext.ptr, ev->data.ext.len);
++		snd_seq_oss_readq_sysex(dp->readq, mdev->seq_device, ev);
+ 	} else {
+ 		len = snd_midi_event_decode(mdev->coder, msg, sizeof(msg), ev);
+ 		if (len > 0)
+diff --git a/sound/core/seq/oss/seq_oss_readq.c b/sound/core/seq/oss/seq_oss_readq.c
+index 046cb586fb2f..06b21226b4e7 100644
+--- a/sound/core/seq/oss/seq_oss_readq.c
++++ b/sound/core/seq/oss/seq_oss_readq.c
+@@ -117,6 +117,35 @@ snd_seq_oss_readq_puts(struct seq_oss_readq *q, int dev, unsigned char *data, in
+ 	return 0;
+ }
+ 
++/*
++ * put MIDI sysex bytes; the event buffer may be chained, thus it has
++ * to be expanded via snd_seq_dump_var_event().
++ */
++struct readq_sysex_ctx {
++	struct seq_oss_readq *readq;
++	int dev;
++};
++
++static int readq_dump_sysex(void *ptr, void *buf, int count)
++{
++	struct readq_sysex_ctx *ctx = ptr;
++
++	return snd_seq_oss_readq_puts(ctx->readq, ctx->dev, buf, count);
++}
++
++int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev,
++			    struct snd_seq_event *ev)
++{
++	struct readq_sysex_ctx ctx = {
++		.readq = q,
++		.dev = dev
++	};
++
++	if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
++		return 0;
++	return snd_seq_dump_var_event(ev, readq_dump_sysex, &ctx);
++}
++
+ /*
+  * copy an event to input queue:
+  * return zero if enqueued
+diff --git a/sound/core/seq/oss/seq_oss_readq.h b/sound/core/seq/oss/seq_oss_readq.h
+index f1463f1f449e..8d033ca2d23f 100644
+--- a/sound/core/seq/oss/seq_oss_readq.h
++++ b/sound/core/seq/oss/seq_oss_readq.h
+@@ -44,6 +44,8 @@ void snd_seq_oss_readq_delete(struct seq_oss_readq *q);
+ void snd_seq_oss_readq_clear(struct seq_oss_readq *readq);
+ unsigned int snd_seq_oss_readq_poll(struct seq_oss_readq *readq, struct file *file, poll_table *wait);
+ int snd_seq_oss_readq_puts(struct seq_oss_readq *readq, int dev, unsigned char *data, int len);
++int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev,
++			    struct snd_seq_event *ev);
+ int snd_seq_oss_readq_put_event(struct seq_oss_readq *readq, union evrec *ev);
+ int snd_seq_oss_readq_put_timestamp(struct seq_oss_readq *readq, unsigned long curt, int seq_mode);
+ int snd_seq_oss_readq_pick(struct seq_oss_readq *q, union evrec *rec);
+diff --git a/sound/soc/sunxi/sun4i-spdif.c b/sound/soc/sunxi/sun4i-spdif.c
+index 88fbb3a1e660..048de15d6937 100644
+--- a/sound/soc/sunxi/sun4i-spdif.c
++++ b/sound/soc/sunxi/sun4i-spdif.c
+@@ -403,14 +403,6 @@ static struct snd_soc_dai_driver sun4i_spdif_dai = {
+ 	.name = "spdif",
+ };
+ 
+-static const struct snd_soc_dapm_widget dit_widgets[] = {
+-	SND_SOC_DAPM_OUTPUT("spdif-out"),
+-};
+-
+-static const struct snd_soc_dapm_route dit_routes[] = {
+-	{ "spdif-out", NULL, "Playback" },
+-};
+-
+ static const struct of_device_id sun4i_spdif_of_match[] = {
+ 	{ .compatible = "allwinner,sun4i-a10-spdif", },
+ 	{ .compatible = "allwinner,sun6i-a31-spdif", },
+diff --git a/tools/testing/selftests/firmware/fw_filesystem.sh b/tools/testing/selftests/firmware/fw_filesystem.sh
+index 5c495ad7958a..d8ac9ba67688 100755
+--- a/tools/testing/selftests/firmware/fw_filesystem.sh
++++ b/tools/testing/selftests/firmware/fw_filesystem.sh
+@@ -48,18 +48,18 @@ echo "ABCD0123" >"$FW"
+ 
+ NAME=$(basename "$FW")
+ 
+-if printf '\000' >"$DIR"/trigger_request; then
++if printf '\000' >"$DIR"/trigger_request 2> /dev/null; then
+ 	echo "$0: empty filename should not succeed" >&2
+ 	exit 1
+ fi
+ 
+-if printf '\000' >"$DIR"/trigger_async_request; then
++if printf '\000' >"$DIR"/trigger_async_request 2> /dev/null; then
+ 	echo "$0: empty filename should not succeed (async)" >&2
+ 	exit 1
+ fi
+ 
+ # Request a firmware that doesn't exist, it should fail.
+-if echo -n "nope-$NAME" >"$DIR"/trigger_request; then
++if echo -n "nope-$NAME" >"$DIR"/trigger_request 2> /dev/null; then
+ 	echo "$0: firmware shouldn't have loaded" >&2
+ 	exit 1
+ fi
+diff --git a/tools/testing/selftests/firmware/fw_userhelper.sh b/tools/testing/selftests/firmware/fw_userhelper.sh
+index b9983f8e09f6..01c626a1f226 100755
+--- a/tools/testing/selftests/firmware/fw_userhelper.sh
++++ b/tools/testing/selftests/firmware/fw_userhelper.sh
+@@ -64,9 +64,33 @@ trap "test_finish" EXIT
+ echo "ABCD0123" >"$FW"
+ NAME=$(basename "$FW")
+ 
++DEVPATH="$DIR"/"nope-$NAME"/loading
++
+ # Test failure when doing nothing (timeout works).
+-echo 1 >/sys/class/firmware/timeout
+-echo -n "$NAME" >"$DIR"/trigger_request
++echo -n 2 >/sys/class/firmware/timeout
++echo -n "nope-$NAME" >"$DIR"/trigger_request 2>/dev/null &
++
++# Give the kernel some time to load the loading file, must be less
++# than the timeout above.
++sleep 1
++if [ ! -f $DEVPATH ]; then
++	echo "$0: fallback mechanism immediately cancelled"
++	echo ""
++	echo "The file never appeared: $DEVPATH"
++	echo ""
++	echo "This might be a distribution udev rule setup by your distribution"
++	echo "to immediately cancel all fallback requests, this must be"
++	echo "removed before running these tests. To confirm look for"
++	echo "a firmware rule like /lib/udev/rules.d/50-firmware.rules"
++	echo "and see if you have something like this:"
++	echo ""
++	echo "SUBSYSTEM==\"firmware\", ACTION==\"add\", ATTR{loading}=\"-1\""
++	echo ""
++	echo "If you do remove this file or comment out this line before"
++	echo "proceeding with these tests."
++	exit 1
++fi
++
+ if diff -q "$FW" /dev/test_firmware >/dev/null ; then
+ 	echo "$0: firmware was not expected to match" >&2
+ 	exit 1