diff --git a/Documentation/devicetree/bindings/arm/davinci.txt 
b/Documentation/devicetree/bindings/arm/davinci.txt
index f0841ce725b5..715622c36260 100644
--- a/Documentation/devicetree/bindings/arm/davinci.txt
+++ b/Documentation/devicetree/bindings/arm/davinci.txt
@@ -13,6 +13,10 @@ EnBW AM1808 based CMC board
 Required root node properties:
     - compatible = "enbw,cmc", "ti,da850;
 
+LEGO MINDSTORMS EV3 (AM1808 based)
+Required root node properties:
+    - compatible = "lego,ev3", "ti,da850";
+
 Generic DaVinci Boards
 ----------------------
 
diff --git a/Documentation/devicetree/bindings/clock/qoriq-clock.txt 
b/Documentation/devicetree/bindings/clock/qoriq-clock.txt
index 16a3ec433119..1bd2c76396f4 100644
--- a/Documentation/devicetree/bindings/clock/qoriq-clock.txt
+++ b/Documentation/devicetree/bindings/clock/qoriq-clock.txt
@@ -31,6 +31,7 @@ Required properties:
        * "fsl,t4240-clockgen"
        * "fsl,b4420-clockgen"
        * "fsl,b4860-clockgen"
+       * "fsl,ls1012a-clockgen"
        * "fsl,ls1021a-clockgen"
        Chassis-version clock strings include:
        * "fsl,qoriq-clockgen-1.0": for chassis 1.0 clocks
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt 
b/Documentation/devicetree/bindings/vendor-prefixes.txt
index bceffffb7502..f949a22bcd74 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -154,6 +154,7 @@ kosagi      Sutajio Ko-Usagi PTE Ltd.
 kyo    Kyocera Corporation
 lacie  LaCie
 lantiq Lantiq Semiconductor
+lego   LEGO Systems A/S
 lenovo Lenovo Group Ltd.
 lg     LG Corporation
 linux  Linux-specific binding
diff --git a/Makefile b/Makefile
index b56b99e20b30..8ab48891d088 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 9
-SUBLEVEL = 61
+SUBLEVEL = 62
 EXTRAVERSION =
 NAME = Roaring Lionus
 
diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi 
b/arch/arm/boot/dts/imx53-qsb-common.dtsi
index c05e7cfd0cbc..40b3e31935d0 100644
--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi
+++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi
@@ -215,16 +215,16 @@
 
                pinctrl_fec: fecgrp {
                        fsl,pins = <
-                               MX53_PAD_FEC_MDC__FEC_MDC               
0x80000000
-                               MX53_PAD_FEC_MDIO__FEC_MDIO             
0x80000000
-                               MX53_PAD_FEC_REF_CLK__FEC_TX_CLK        
0x80000000
-                               MX53_PAD_FEC_RX_ER__FEC_RX_ER           
0x80000000
-                               MX53_PAD_FEC_CRS_DV__FEC_RX_DV          
0x80000000
-                               MX53_PAD_FEC_RXD1__FEC_RDATA_1          
0x80000000
-                               MX53_PAD_FEC_RXD0__FEC_RDATA_0          
0x80000000
-                               MX53_PAD_FEC_TX_EN__FEC_TX_EN           
0x80000000
-                               MX53_PAD_FEC_TXD1__FEC_TDATA_1          
0x80000000
-                               MX53_PAD_FEC_TXD0__FEC_TDATA_0          
0x80000000
+                               MX53_PAD_FEC_MDC__FEC_MDC               0x4
+                               MX53_PAD_FEC_MDIO__FEC_MDIO             0x1fc
+                               MX53_PAD_FEC_REF_CLK__FEC_TX_CLK        0x180
+                               MX53_PAD_FEC_RX_ER__FEC_RX_ER           0x180
+                               MX53_PAD_FEC_CRS_DV__FEC_RX_DV          0x180
+                               MX53_PAD_FEC_RXD1__FEC_RDATA_1          0x180
+                               MX53_PAD_FEC_RXD0__FEC_RDATA_0          0x180
+                               MX53_PAD_FEC_TX_EN__FEC_TX_EN           0x4
+                               MX53_PAD_FEC_TXD1__FEC_TDATA_1          0x4
+                               MX53_PAD_FEC_TXD0__FEC_TDATA_0          0x4
                        >;
                };
 
diff --git a/arch/arm/boot/dts/stih410.dtsi b/arch/arm/boot/dts/stih410.dtsi
index a3ef7341c051..4d329b2908be 100644
--- a/arch/arm/boot/dts/stih410.dtsi
+++ b/arch/arm/boot/dts/stih410.dtsi
@@ -131,7 +131,7 @@
                                                 <&clk_s_d2_quadfs 0>;
 
                        assigned-clock-rates = <297000000>,
-                                              <108000000>,
+                                              <297000000>,
                                               <0>,
                                               <400000000>,
                                               <400000000>;
diff --git a/arch/arm/configs/omap2plus_defconfig 
b/arch/arm/configs/omap2plus_defconfig
index 53e1a884a1ea..66d71963761d 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -216,6 +216,7 @@ CONFIG_SERIO=m
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=32
+CONFIG_SERIAL_8250_RUNTIME_UARTS=6
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 9688ec0c6ef4..1b304897aa12 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -152,30 +152,26 @@ static void dump_mem(const char *lvl, const char *str, 
unsigned long bottom,
        set_fs(fs);
 }
 
-static void dump_instr(const char *lvl, struct pt_regs *regs)
+static void __dump_instr(const char *lvl, struct pt_regs *regs)
 {
        unsigned long addr = instruction_pointer(regs);
        const int thumb = thumb_mode(regs);
        const int width = thumb ? 4 : 8;
-       mm_segment_t fs;
        char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str;
        int i;
 
        /*
-        * We need to switch to kernel mode so that we can use __get_user
-        * to safely read from kernel space.  Note that we now dump the
-        * code first, just in case the backtrace kills us.
+        * Note that we now dump the code first, just in case the backtrace
+        * kills us.
         */
-       fs = get_fs();
-       set_fs(KERNEL_DS);
 
        for (i = -4; i < 1 + !!thumb; i++) {
                unsigned int val, bad;
 
                if (thumb)
-                       bad = __get_user(val, &((u16 *)addr)[i]);
+                       bad = get_user(val, &((u16 *)addr)[i]);
                else
-                       bad = __get_user(val, &((u32 *)addr)[i]);
+                       bad = get_user(val, &((u32 *)addr)[i]);
 
                if (!bad)
                        p += sprintf(p, i == 0 ? "(%0*x) " : "%0*x ",
@@ -186,8 +182,20 @@ static void dump_instr(const char *lvl, struct pt_regs 
*regs)
                }
        }
        printk("%sCode: %s\n", lvl, str);
+}
 
-       set_fs(fs);
+static void dump_instr(const char *lvl, struct pt_regs *regs)
+{
+       mm_segment_t fs;
+
+       if (!user_mode(regs)) {
+               fs = get_fs();
+               set_fs(KERNEL_DS);
+               __dump_instr(lvl, regs);
+               set_fs(fs);
+       } else {
+               __dump_instr(lvl, regs);
+       }
 }
 
 #ifdef CONFIG_ARM_UNWIND
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index b5bf46ce873b..cab3574ab7d9 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -836,14 +836,21 @@ static bool do_iommu_attach(struct device *dev, const 
struct iommu_ops *ops,
         * then the IOMMU core will have already configured a group for this
         * device, and allocated the default domain for that group.
         */
-       if (!domain || iommu_dma_init_domain(domain, dma_base, size, dev)) {
-               pr_warn("Failed to set up IOMMU for device %s; retaining 
platform DMA ops\n",
-                       dev_name(dev));
-               return false;
+       if (!domain)
+               goto out_err;
+
+       if (domain->type == IOMMU_DOMAIN_DMA) {
+               if (iommu_dma_init_domain(domain, dma_base, size, dev))
+                       goto out_err;
+
+               dev->archdata.dma_ops = &iommu_dma_ops;
        }
 
-       dev->archdata.dma_ops = &iommu_dma_ops;
        return true;
+out_err:
+       pr_warn("Failed to set up IOMMU for device %s; retaining platform DMA 
ops\n",
+                dev_name(dev));
+       return false;
 }
 
 static void queue_iommu_attach(struct device *dev, const struct iommu_ops *ops,
diff --git a/arch/mips/ar7/platform.c b/arch/mips/ar7/platform.c
index 58fca9ad5fcc..3446b6fb3acb 100644
--- a/arch/mips/ar7/platform.c
+++ b/arch/mips/ar7/platform.c
@@ -576,6 +576,7 @@ static int __init ar7_register_uarts(void)
        uart_port.type          = PORT_AR7;
        uart_port.uartclk       = clk_get_rate(bus_clk) / 2;
        uart_port.iotype        = UPIO_MEM32;
+       uart_port.flags         = UPF_FIXED_TYPE;
        uart_port.regshift      = 2;
 
        uart_port.line          = 0;
@@ -654,6 +655,10 @@ static int __init ar7_register_devices(void)
        u32 val;
        int res;
 
+       res = ar7_gpio_init();
+       if (res)
+               pr_warn("unable to register gpios: %d\n", res);
+
        res = ar7_register_uarts();
        if (res)
                pr_err("unable to setup uart(s): %d\n", res);
diff --git a/arch/mips/ar7/prom.c b/arch/mips/ar7/prom.c
index a23adc49d50f..36aabee9cba4 100644
--- a/arch/mips/ar7/prom.c
+++ b/arch/mips/ar7/prom.c
@@ -246,8 +246,6 @@ void __init prom_init(void)
        ar7_init_cmdline(fw_arg0, (char **)fw_arg1);
        ar7_init_env((struct env_var *)fw_arg2);
        console_config();
-
-       ar7_gpio_init();
 }
 
 #define PORT(offset) (KSEG1ADDR(AR7_REGS_UART0 + (offset * 4)))
diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h
index 2e4180797b21..b6845db453a3 100644
--- a/arch/mips/include/asm/mips-cm.h
+++ b/arch/mips/include/asm/mips-cm.h
@@ -239,8 +239,8 @@ BUILD_CM_Cx_R_(tcid_8_priority,     0x80)
 #define CM_GCR_BASE_GCRBASE_MSK                        (_ULCAST_(0x1ffff) << 
15)
 #define CM_GCR_BASE_CMDEFTGT_SHF               0
 #define CM_GCR_BASE_CMDEFTGT_MSK               (_ULCAST_(0x3) << 0)
-#define  CM_GCR_BASE_CMDEFTGT_DISABLED         0
-#define  CM_GCR_BASE_CMDEFTGT_MEM              1
+#define  CM_GCR_BASE_CMDEFTGT_MEM              0
+#define  CM_GCR_BASE_CMDEFTGT_RESERVED         1
 #define  CM_GCR_BASE_CMDEFTGT_IOCU0            2
 #define  CM_GCR_BASE_CMDEFTGT_IOCU1            3
 
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 1b50958a1373..c558bce989cd 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -50,9 +50,7 @@
 #ifdef CONFIG_HOTPLUG_CPU
 void arch_cpu_idle_dead(void)
 {
-       /* What the heck is this check doing ? */
-       if (!cpumask_test_cpu(smp_processor_id(), &cpu_callin_map))
-               play_dead();
+       play_dead();
 }
 #endif
 
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 6d0f1321e084..47c9646f93b3 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -587,11 +587,11 @@ void __init bmips_cpu_setup(void)
 
                /* Flush and enable RAC */
                cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG);
-               __raw_writel(cfg | 0x100, BMIPS_RAC_CONFIG);
+               __raw_writel(cfg | 0x100, cbr + BMIPS_RAC_CONFIG);
                __raw_readl(cbr + BMIPS_RAC_CONFIG);
 
                cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG);
-               __raw_writel(cfg | 0xf, BMIPS_RAC_CONFIG);
+               __raw_writel(cfg | 0xf, cbr + BMIPS_RAC_CONFIG);
                __raw_readl(cbr + BMIPS_RAC_CONFIG);
 
                cfg = __raw_readl(cbr + BMIPS_RAC_ADDRESS_RANGE);
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index 7ebb1918e2ac..95ba4271af6a 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -68,6 +68,9 @@ EXPORT_SYMBOL(cpu_sibling_map);
 cpumask_t cpu_core_map[NR_CPUS] __read_mostly;
 EXPORT_SYMBOL(cpu_core_map);
 
+static DECLARE_COMPLETION(cpu_starting);
+static DECLARE_COMPLETION(cpu_running);
+
 /*
  * A logcal cpu mask containing only one VPE per core to
  * reduce the number of IPIs on large MT systems.
@@ -369,9 +372,12 @@ asmlinkage void start_secondary(void)
        cpumask_set_cpu(cpu, &cpu_coherent_mask);
        notify_cpu_starting(cpu);
 
-       cpumask_set_cpu(cpu, &cpu_callin_map);
+       /* Notify boot CPU that we're starting & ready to sync counters */
+       complete(&cpu_starting);
+
        synchronise_count_slave(cpu);
 
+       /* The CPU is running and counters synchronised, now mark it online */
        set_cpu_online(cpu, true);
 
        set_cpu_sibling_map(cpu);
@@ -379,6 +385,12 @@ asmlinkage void start_secondary(void)
 
        calculate_cpu_foreign_map();
 
+       /*
+        * Notify boot CPU that we're up & online and it can safely return
+        * from __cpu_up
+        */
+       complete(&cpu_running);
+
        /*
         * irq will be enabled in ->smp_finish(), enabling it too early
         * is dangerous.
@@ -430,22 +442,23 @@ void smp_prepare_boot_cpu(void)
 {
        set_cpu_possible(0, true);
        set_cpu_online(0, true);
-       cpumask_set_cpu(0, &cpu_callin_map);
 }
 
 int __cpu_up(unsigned int cpu, struct task_struct *tidle)
 {
        mp_ops->boot_secondary(cpu, tidle);
 
-       /*
-        * Trust is futile.  We should really have timeouts ...
-        */
-       while (!cpumask_test_cpu(cpu, &cpu_callin_map)) {
-               udelay(100);
-               schedule();
+       /* Wait for CPU to start and be ready to sync counters */
+       if (!wait_for_completion_timeout(&cpu_starting,
+                                        msecs_to_jiffies(1000))) {
+               pr_crit("CPU%u: failed to start\n", cpu);
+               return -EIO;
        }
 
        synchronise_count_master(cpu);
+
+       /* Wait for CPU to finish startup & mark itself online before return */
+       wait_for_completion(&cpu_running);
        return 0;
 }
 
diff --git a/arch/mips/mm/uasm-micromips.c b/arch/mips/mm/uasm-micromips.c
index 277cf52d80e1..6c17cba7f383 100644
--- a/arch/mips/mm/uasm-micromips.c
+++ b/arch/mips/mm/uasm-micromips.c
@@ -80,7 +80,7 @@ static struct insn insn_table_MM[] = {
        { insn_jr, M(mm_pool32a_op, 0, 0, 0, mm_jalr_op, mm_pool32axf_op), RS },
        { insn_lb, M(mm_lb32_op, 0, 0, 0, 0, 0), RT | RS | SIMM },
        { insn_ld, 0, 0 },
-       { insn_lh, M(mm_lh32_op, 0, 0, 0, 0, 0), RS | RS | SIMM },
+       { insn_lh, M(mm_lh32_op, 0, 0, 0, 0, 0), RT | RS | SIMM },
        { insn_ll, M(mm_pool32c_op, 0, 0, (mm_ll_func << 1), 0, 0), RS | RT | 
SIMM },
        { insn_lld, 0, 0 },
        { insn_lui, M(mm_pool32i_op, mm_lui_op, 0, 0, 0, 0), RS | SIMM },
diff --git a/arch/powerpc/boot/dts/fsl/kmcoge4.dts 
b/arch/powerpc/boot/dts/fsl/kmcoge4.dts
index ae70a24094b0..e103c0f3f650 100644
--- a/arch/powerpc/boot/dts/fsl/kmcoge4.dts
+++ b/arch/powerpc/boot/dts/fsl/kmcoge4.dts
@@ -83,6 +83,10 @@
                        };
                };
 
+               sdhc@114000 {
+                       status = "disabled";
+               };
+
                i2c@119000 {
                        status = "disabled";
                };
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index bc3f7d0d7b79..f1d7e996e673 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -407,6 +407,7 @@ void arch_vtime_task_switch(struct task_struct *prev)
        struct cpu_accounting_data *acct = get_accounting(current);
 
        acct->starttime = get_accounting(prev)->starttime;
+       acct->startspurr = get_accounting(prev)->startspurr;
        acct->system_time = 0;
        acct->user_time = 0;
 }
diff --git a/arch/powerpc/kvm/book3s_hv_rm_xics.c 
b/arch/powerpc/kvm/book3s_hv_rm_xics.c
index a0ea63ac2b52..a8e3498a853f 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_xics.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_xics.c
@@ -376,6 +376,7 @@ static void icp_rm_deliver_irq(struct kvmppc_xics *xics, 
struct kvmppc_icp *icp,
                 */
                if (reject && reject != XICS_IPI) {
                        arch_spin_unlock(&ics->lock);
+                       icp->n_reject++;
                        new_irq = reject;
                        goto again;
                }
@@ -707,10 +708,8 @@ int kvmppc_rm_h_eoi(struct kvm_vcpu *vcpu, unsigned long 
xirr)
        state = &ics->irq_state[src];
 
        /* Still asserted, resend it */
-       if (state->asserted) {
-               icp->n_reject++;
+       if (state->asserted)
                icp_rm_deliver_irq(xics, icp, irq);
-       }
 
        if (!hlist_empty(&vcpu->kvm->irq_ack_notifier_list)) {
                icp->rm_action |= XICS_RM_NOTIFY_EOI;
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index 2374c5b46bbc..0c196861bc38 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -363,6 +363,18 @@ static inline void save_vector_registers(void)
 #endif
 }
 
+static int __init topology_setup(char *str)
+{
+       bool enabled;
+       int rc;
+
+       rc = kstrtobool(str, &enabled);
+       if (!rc && !enabled)
+               S390_lowcore.machine_flags &= ~MACHINE_HAS_TOPOLOGY;
+       return rc;
+}
+early_param("topology", topology_setup);
+
 static int __init disable_vector_extension(char *str)
 {
        S390_lowcore.machine_flags &= ~MACHINE_FLAG_VX;
diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
index 8705ee66c087..239f29508f0b 100644
--- a/arch/s390/kernel/topology.c
+++ b/arch/s390/kernel/topology.c
@@ -37,7 +37,6 @@ static void set_topology_timer(void);
 static void topology_work_fn(struct work_struct *work);
 static struct sysinfo_15_1_x *tl_info;
 
-static bool topology_enabled = true;
 static DECLARE_WORK(topology_work, topology_work_fn);
 
 /*
@@ -56,7 +55,7 @@ static cpumask_t cpu_group_map(struct mask_info *info, 
unsigned int cpu)
        cpumask_t mask;
 
        cpumask_copy(&mask, cpumask_of(cpu));
-       if (!topology_enabled || !MACHINE_HAS_TOPOLOGY)
+       if (!MACHINE_HAS_TOPOLOGY)
                return mask;
        for (; info; info = info->next) {
                if (cpumask_test_cpu(cpu, &info->mask))
@@ -71,7 +70,7 @@ static cpumask_t cpu_thread_map(unsigned int cpu)
        int i;
 
        cpumask_copy(&mask, cpumask_of(cpu));
-       if (!topology_enabled || !MACHINE_HAS_TOPOLOGY)
+       if (!MACHINE_HAS_TOPOLOGY)
                return mask;
        cpu -= cpu % (smp_cpu_mtid + 1);
        for (i = 0; i <= smp_cpu_mtid; i++)
@@ -413,12 +412,6 @@ static const struct cpumask *cpu_drawer_mask(int cpu)
        return &per_cpu(cpu_topology, cpu).drawer_mask;
 }
 
-static int __init early_parse_topology(char *p)
-{
-       return kstrtobool(p, &topology_enabled);
-}
-early_param("topology", early_parse_topology);
-
 static struct sched_domain_topology_level s390_topology[] = {
        { cpu_thread_mask, cpu_smt_flags, SD_INIT_NAME(SMT) },
        { cpu_coregroup_mask, cpu_core_flags, SD_INIT_NAME(MC) },
diff --git a/arch/sh/kernel/cpu/sh3/setup-sh770x.c 
b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
index 538c10db3537..8dc315b212c2 100644
--- a/arch/sh/kernel/cpu/sh3/setup-sh770x.c
+++ b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
@@ -165,7 +165,6 @@ static struct plat_sci_port scif2_platform_data = {
        .scscr          = SCSCR_TE | SCSCR_RE,
        .type           = PORT_IRDA,
        .ops            = &sh770x_sci_port_ops,
-       .regshift       = 1,
 };
 
 static struct resource scif2_resources[] = {
diff --git a/arch/x86/crypto/sha1-mb/sha1_mb_mgr_flush_avx2.S 
b/arch/x86/crypto/sha1-mb/sha1_mb_mgr_flush_avx2.S
index 96df6a39d7e2..a2ae6891e1fc 100644
--- a/arch/x86/crypto/sha1-mb/sha1_mb_mgr_flush_avx2.S
+++ b/arch/x86/crypto/sha1-mb/sha1_mb_mgr_flush_avx2.S
@@ -157,8 +157,8 @@ LABEL skip_ %I
 .endr
 
        # Find min length
-       vmovdqa _lens+0*16(state), %xmm0
-       vmovdqa _lens+1*16(state), %xmm1
+       vmovdqu _lens+0*16(state), %xmm0
+       vmovdqu _lens+1*16(state), %xmm1
 
        vpminud %xmm1, %xmm0, %xmm2     # xmm2 has {D,C,B,A}
        vpalignr $8, %xmm2, %xmm3, %xmm3   # xmm3 has {x,x,D,C}
@@ -178,8 +178,8 @@ LABEL skip_ %I
        vpsubd  %xmm2, %xmm0, %xmm0
        vpsubd  %xmm2, %xmm1, %xmm1
 
-       vmovdqa %xmm0, _lens+0*16(state)
-       vmovdqa %xmm1, _lens+1*16(state)
+       vmovdqu %xmm0, _lens+0*16(state)
+       vmovdqu %xmm1, _lens+1*16(state)
 
        # "state" and "args" are the same address, arg1
        # len is arg2
@@ -235,8 +235,8 @@ ENTRY(sha1_mb_mgr_get_comp_job_avx2)
        jc      .return_null
 
        # Find min length
-       vmovdqa _lens(state), %xmm0
-       vmovdqa _lens+1*16(state), %xmm1
+       vmovdqu _lens(state), %xmm0
+       vmovdqu _lens+1*16(state), %xmm1
 
        vpminud %xmm1, %xmm0, %xmm2        # xmm2 has {D,C,B,A}
        vpalignr $8, %xmm2, %xmm3, %xmm3   # xmm3 has {x,x,D,C}
diff --git a/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S 
b/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
index a78a0694ddef..ec9bee661d50 100644
--- a/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
+++ b/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
@@ -155,8 +155,8 @@ LABEL skip_ %I
 .endr
 
        # Find min length
-       vmovdqa _lens+0*16(state), %xmm0
-       vmovdqa _lens+1*16(state), %xmm1
+       vmovdqu _lens+0*16(state), %xmm0
+       vmovdqu _lens+1*16(state), %xmm1
 
        vpminud %xmm1, %xmm0, %xmm2             # xmm2 has {D,C,B,A}
        vpalignr $8, %xmm2, %xmm3, %xmm3        # xmm3 has {x,x,D,C}
@@ -176,8 +176,8 @@ LABEL skip_ %I
        vpsubd  %xmm2, %xmm0, %xmm0
        vpsubd  %xmm2, %xmm1, %xmm1
 
-       vmovdqa %xmm0, _lens+0*16(state)
-       vmovdqa %xmm1, _lens+1*16(state)
+       vmovdqu %xmm0, _lens+0*16(state)
+       vmovdqu %xmm1, _lens+1*16(state)
 
        # "state" and "args" are the same address, arg1
        # len is arg2
@@ -234,8 +234,8 @@ ENTRY(sha256_mb_mgr_get_comp_job_avx2)
        jc      .return_null
 
        # Find min length
-       vmovdqa _lens(state), %xmm0
-       vmovdqa _lens+1*16(state), %xmm1
+       vmovdqu _lens(state), %xmm0
+       vmovdqu _lens+1*16(state), %xmm1
 
        vpminud %xmm1, %xmm0, %xmm2             # xmm2 has {D,C,B,A}
        vpalignr $8, %xmm2, %xmm3, %xmm3        # xmm3 has {x,x,D,C}
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index a300aa10ebc5..dead0f3921f3 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -68,6 +68,12 @@ static inline bool __chk_range_not_ok(unsigned long addr, 
unsigned long size, un
        __chk_range_not_ok((unsigned long __force)(addr), size, limit); \
 })
 
+#ifdef CONFIG_DEBUG_ATOMIC_SLEEP
+# define WARN_ON_IN_IRQ()      WARN_ON_ONCE(!in_task())
+#else
+# define WARN_ON_IN_IRQ()
+#endif
+
 /**
  * access_ok: - Checks if a user space pointer is valid
  * @type: Type of access: %VERIFY_READ or %VERIFY_WRITE.  Note that
@@ -88,8 +94,11 @@ static inline bool __chk_range_not_ok(unsigned long addr, 
unsigned long size, un
  * checks that the pointer is in the user space range - after calling
  * this function, memory access functions may still return -EFAULT.
  */
-#define access_ok(type, addr, size) \
-       likely(!__range_not_ok(addr, size, user_addr_max()))
+#define access_ok(type, addr, size)                                    \
+({                                                                     \
+       WARN_ON_IN_IRQ();                                               \
+       likely(!__range_not_ok(addr, size, user_addr_max()));           \
+})
 
 /*
  * These are the main single-value transfer routines.  They automatically
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 36171bcd91f8..9fe7b9e1ae30 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -180,6 +180,12 @@ static void smp_callin(void)
         */
        smp_store_cpu_info(cpuid);
 
+       /*
+        * The topology information must be up to date before
+        * calibrate_delay() and notify_cpu_starting().
+        */
+       set_cpu_sibling_map(raw_smp_processor_id());
+
        /*
         * Get our bogomips.
         * Update loops_per_jiffy in cpu_data. Previous call to
@@ -190,11 +196,6 @@ static void smp_callin(void)
        cpu_data(cpuid).loops_per_jiffy = loops_per_jiffy;
        pr_debug("Stack at about %p\n", &cpuid);
 
-       /*
-        * This must be done before setting cpu_online_mask
-        * or calling notify_cpu_starting.
-        */
-       set_cpu_sibling_map(raw_smp_processor_id());
        wmb();
 
        notify_cpu_starting(cpuid);
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 6e57edf33d75..44bf5cf417d3 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -1382,12 +1382,10 @@ void __init tsc_init(void)
 unsigned long calibrate_delay_is_known(void)
 {
        int sibling, cpu = smp_processor_id();
-       struct cpumask *mask = topology_core_cpumask(cpu);
+       int constant_tsc = cpu_has(&cpu_data(cpu), X86_FEATURE_CONSTANT_TSC);
+       const struct cpumask *mask = topology_core_cpumask(cpu);
 
-       if (!tsc_disabled && !cpu_has(&cpu_data(cpu), X86_FEATURE_CONSTANT_TSC))
-               return 0;
-
-       if (!mask)
+       if (tsc_disabled || !constant_tsc || !mask)
                return 0;
 
        sibling = cpumask_any_but(mask, cpu);
diff --git a/arch/x86/oprofile/op_model_ppro.c 
b/arch/x86/oprofile/op_model_ppro.c
index 350f7096baac..7913b6921959 100644
--- a/arch/x86/oprofile/op_model_ppro.c
+++ b/arch/x86/oprofile/op_model_ppro.c
@@ -212,8 +212,8 @@ static void arch_perfmon_setup_counters(void)
        eax.full = cpuid_eax(0xa);
 
        /* Workaround for BIOS bugs in 6/15. Taken from perfmon2 */
-       if (eax.split.version_id == 0 && __this_cpu_read(cpu_info.x86) == 6 &&
-               __this_cpu_read(cpu_info.x86_model) == 15) {
+       if (eax.split.version_id == 0 && boot_cpu_data.x86 == 6 &&
+           boot_cpu_data.x86_model == 15) {
                eax.split.version_id = 2;
                eax.split.num_counters = 2;
                eax.split.bit_width = 40;
diff --git a/crypto/ccm.c b/crypto/ccm.c
index 006d8575ef5c..b3ace633fae9 100644
--- a/crypto/ccm.c
+++ b/crypto/ccm.c
@@ -413,7 +413,7 @@ static int crypto_ccm_decrypt(struct aead_request *req)
        unsigned int cryptlen = req->cryptlen;
        u8 *authtag = pctx->auth_tag;
        u8 *odata = pctx->odata;
-       u8 *iv = req->iv;
+       u8 *iv = pctx->idata;
        int err;
 
        cryptlen -= authsize;
@@ -429,6 +429,8 @@ static int crypto_ccm_decrypt(struct aead_request *req)
        if (req->src != req->dst)
                dst = pctx->dst;
 
+       memcpy(iv, req->iv, 16);
+
        skcipher_request_set_tfm(skreq, ctx->ctr);
        skcipher_request_set_callback(skreq, pctx->flags,
                                      crypto_ccm_decrypt_done, req);
diff --git a/drivers/base/power/opp/of.c b/drivers/base/power/opp/of.c
index 5552211e6fcd..b52c617947ad 100644
--- a/drivers/base/power/opp/of.c
+++ b/drivers/base/power/opp/of.c
@@ -386,7 +386,7 @@ static int _of_add_opp_table_v1(struct device *dev)
 {
        const struct property *prop;
        const __be32 *val;
-       int nr;
+       int nr, ret;
 
        prop = of_find_property(dev->of_node, "operating-points", NULL);
        if (!prop)
@@ -409,9 +409,13 @@ static int _of_add_opp_table_v1(struct device *dev)
                unsigned long freq = be32_to_cpup(val++) * 1000;
                unsigned long volt = be32_to_cpup(val++);
 
-               if (_opp_add_v1(dev, freq, volt, false))
-                       dev_warn(dev, "%s: Failed to add OPP %ld\n",
-                                __func__, freq);
+               ret = _opp_add_v1(dev, freq, volt, false);
+               if (ret) {
+                       dev_err(dev, "%s: Failed to add OPP %ld (%d)\n",
+                               __func__, freq, ret);
+                       dev_pm_opp_of_remove_table(dev);
+                       return ret;
+               }
                nr -= 2;
        }
 
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 7b274ff4632c..24f4b544d270 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -2788,7 +2788,7 @@ static int rbd_img_obj_parent_read_full(struct 
rbd_obj_request *obj_request)
         * from the parent.
         */
        page_count = (u32)calc_pages_for(0, length);
-       pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
+       pages = ceph_alloc_page_vector(page_count, GFP_NOIO);
        if (IS_ERR(pages)) {
                result = PTR_ERR(pages);
                pages = NULL;
@@ -2922,7 +2922,7 @@ static int rbd_img_obj_exists_submit(struct 
rbd_obj_request *obj_request)
         */
        size = sizeof (__le64) + sizeof (__le32) + sizeof (__le32);
        page_count = (u32)calc_pages_for(0, size);
-       pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
+       pages = ceph_alloc_page_vector(page_count, GFP_NOIO);
        if (IS_ERR(pages)) {
                ret = PTR_ERR(pages);
                goto fail_stat_request;
diff --git a/drivers/clk/mvebu/ap806-system-controller.c 
b/drivers/clk/mvebu/ap806-system-controller.c
index 02023baf86c9..962e0c5f6f4d 100644
--- a/drivers/clk/mvebu/ap806-system-controller.c
+++ b/drivers/clk/mvebu/ap806-system-controller.c
@@ -55,21 +55,39 @@ static int ap806_syscon_clk_probe(struct platform_device 
*pdev)
 
        freq_mode = reg & AP806_SAR_CLKFREQ_MODE_MASK;
        switch (freq_mode) {
-       case 0x0 ... 0x5:
+       case 0x0:
+       case 0x1:
                cpuclk_freq = 2000;
                break;
-       case 0x6 ... 0xB:
+       case 0x6:
+       case 0x7:
                cpuclk_freq = 1800;
                break;
-       case 0xC ... 0x11:
+       case 0x4:
+       case 0xB:
+       case 0xD:
                cpuclk_freq = 1600;
                break;
-       case 0x12 ... 0x16:
+       case 0x1a:
                cpuclk_freq = 1400;
                break;
-       case 0x17 ... 0x19:
+       case 0x14:
+       case 0x17:
                cpuclk_freq = 1300;
                break;
+       case 0x19:
+               cpuclk_freq = 1200;
+               break;
+       case 0x13:
+       case 0x1d:
+               cpuclk_freq = 1000;
+               break;
+       case 0x1c:
+               cpuclk_freq = 800;
+               break;
+       case 0x1b:
+               cpuclk_freq = 600;
+               break;
        default:
                dev_err(&pdev->dev, "invalid SAR value\n");
                return -EINVAL;
diff --git a/drivers/clk/samsung/clk-exynos5433.c 
b/drivers/clk/samsung/clk-exynos5433.c
index ea1608682d7f..2fe057326552 100644
--- a/drivers/clk/samsung/clk-exynos5433.c
+++ b/drivers/clk/samsung/clk-exynos5433.c
@@ -2559,8 +2559,10 @@ static const struct samsung_fixed_rate_clock 
disp_fixed_clks[] __initconst = {
        FRATE(0, "phyclk_mipidphy1_bitclkdiv8_phy", NULL, 0, 188000000),
        FRATE(0, "phyclk_mipidphy1_rxclkesc0_phy", NULL, 0, 100000000),
        /* PHY clocks from MIPI_DPHY0 */
-       FRATE(0, "phyclk_mipidphy0_bitclkdiv8_phy", NULL, 0, 188000000),
-       FRATE(0, "phyclk_mipidphy0_rxclkesc0_phy", NULL, 0, 100000000),
+       FRATE(CLK_PHYCLK_MIPIDPHY0_BITCLKDIV8_PHY, 
"phyclk_mipidphy0_bitclkdiv8_phy",
+                       NULL, 0, 188000000),
+       FRATE(CLK_PHYCLK_MIPIDPHY0_RXCLKESC0_PHY, 
"phyclk_mipidphy0_rxclkesc0_phy",
+                       NULL, 0, 100000000),
        /* PHY clocks from HDMI_PHY */
        FRATE(CLK_PHYCLK_HDMIPHY_TMDS_CLKO_PHY, "phyclk_hdmiphy_tmds_clko_phy",
                        NULL, 0, 300000000),
diff --git a/drivers/crypto/vmx/aes_ctr.c b/drivers/crypto/vmx/aes_ctr.c
index 38ed10d761d0..7cf6d31c1123 100644
--- a/drivers/crypto/vmx/aes_ctr.c
+++ b/drivers/crypto/vmx/aes_ctr.c
@@ -80,11 +80,13 @@ static int p8_aes_ctr_setkey(struct crypto_tfm *tfm, const 
u8 *key,
        int ret;
        struct p8_aes_ctr_ctx *ctx = crypto_tfm_ctx(tfm);
 
+       preempt_disable();
        pagefault_disable();
        enable_kernel_vsx();
        ret = aes_p8_set_encrypt_key(key, keylen * 8, &ctx->enc_key);
        disable_kernel_vsx();
        pagefault_enable();
+       preempt_enable();
 
        ret += crypto_blkcipher_setkey(ctx->fallback, key, keylen);
        return ret;
@@ -99,11 +101,13 @@ static void p8_aes_ctr_final(struct p8_aes_ctr_ctx *ctx,
        u8 *dst = walk->dst.virt.addr;
        unsigned int nbytes = walk->nbytes;
 
+       preempt_disable();
        pagefault_disable();
        enable_kernel_vsx();
        aes_p8_encrypt(ctrblk, keystream, &ctx->enc_key);
        disable_kernel_vsx();
        pagefault_enable();
+       preempt_enable();
 
        crypto_xor(keystream, src, nbytes);
        memcpy(dst, keystream, nbytes);
@@ -132,6 +136,7 @@ static int p8_aes_ctr_crypt(struct blkcipher_desc *desc,
                blkcipher_walk_init(&walk, dst, src, nbytes);
                ret = blkcipher_walk_virt_block(desc, &walk, AES_BLOCK_SIZE);
                while ((nbytes = walk.nbytes) >= AES_BLOCK_SIZE) {
+                       preempt_disable();
                        pagefault_disable();
                        enable_kernel_vsx();
                        aes_p8_ctr32_encrypt_blocks(walk.src.virt.addr,
@@ -143,6 +148,7 @@ static int p8_aes_ctr_crypt(struct blkcipher_desc *desc,
                                                    walk.iv);
                        disable_kernel_vsx();
                        pagefault_enable();
+                       preempt_enable();
 
                        /* We need to update IV mostly for last bytes/round */
                        inc = (nbytes & AES_BLOCK_MASK) / AES_BLOCK_SIZE;
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index ee181c53626f..6e197c1c213d 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -2984,8 +2984,11 @@ static int __init amd64_edac_init(void)
        int err = -ENODEV;
        int i;
 
+       if (!x86_match_cpu(amd64_cpuids))
+               return -ENODEV;
+
        if (amd_cache_northbridges() < 0)
-               goto err_ret;
+               return -ENODEV;
 
        opstate_init();
 
@@ -2998,14 +3001,16 @@ static int __init amd64_edac_init(void)
        if (!msrs)
                goto err_free;
 
-       for (i = 0; i < amd_nb_num(); i++)
-               if (probe_one_instance(i)) {
+       for (i = 0; i < amd_nb_num(); i++) {
+               err = probe_one_instance(i);
+               if (err) {
                        /* unwind properly */
                        while (--i >= 0)
                                remove_one_instance(i);
 
                        goto err_pci;
                }
+       }
 
        setup_pci_device();
 
@@ -3025,7 +3030,6 @@ static int __init amd64_edac_init(void)
        kfree(ecc_stngs);
        ecc_stngs = NULL;
 
-err_ret:
        return err;
 }
 
diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
index c08870479054..dcb5f9481735 100644
--- a/drivers/edac/amd64_edac.h
+++ b/drivers/edac/amd64_edac.h
@@ -16,6 +16,7 @@
 #include <linux/slab.h>
 #include <linux/mmzone.h>
 #include <linux/edac.h>
+#include <asm/cpu_device_id.h>
 #include <asm/msr.h>
 #include "edac_core.h"
 #include "mce_amd.h"
diff --git a/drivers/gpu/drm/arm/malidp_planes.c 
b/drivers/gpu/drm/arm/malidp_planes.c
index afe0480d95c9..8b009b549e45 100644
--- a/drivers/gpu/drm/arm/malidp_planes.c
+++ b/drivers/gpu/drm/arm/malidp_planes.c
@@ -182,7 +182,8 @@ static void malidp_de_plane_update(struct drm_plane *plane,
 
        /* setup the rotation and axis flip bits */
        if (plane->state->rotation & DRM_ROTATE_MASK)
-               val = ilog2(plane->state->rotation & DRM_ROTATE_MASK) << 
LAYER_ROT_OFFSET;
+               val |= ilog2(plane->state->rotation & DRM_ROTATE_MASK) <<
+                      LAYER_ROT_OFFSET;
        if (plane->state->rotation & DRM_REFLECT_X)
                val |= LAYER_H_FLIP;
        if (plane->state->rotation & DRM_REFLECT_Y)
diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c 
b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
index 213d892b6fa3..a68f94daf9b6 100644
--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
@@ -325,7 +325,7 @@ static void adv7511_set_link_config(struct adv7511 *adv7511,
        adv7511->rgb = config->input_colorspace == HDMI_COLORSPACE_RGB;
 }
 
-static void adv7511_power_on(struct adv7511 *adv7511)
+static void __adv7511_power_on(struct adv7511 *adv7511)
 {
        adv7511->current_edid_segment = -1;
 
@@ -354,6 +354,11 @@ static void adv7511_power_on(struct adv7511 *adv7511)
        regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2,
                           ADV7511_REG_POWER2_HPD_SRC_MASK,
                           ADV7511_REG_POWER2_HPD_SRC_NONE);
+}
+
+static void adv7511_power_on(struct adv7511 *adv7511)
+{
+       __adv7511_power_on(adv7511);
 
        /*
         * Most of the registers are reset during power down or when HPD is low.
@@ -362,21 +367,23 @@ static void adv7511_power_on(struct adv7511 *adv7511)
 
        if (adv7511->type == ADV7533)
                adv7533_dsi_power_on(adv7511);
-
        adv7511->powered = true;
 }
 
-static void adv7511_power_off(struct adv7511 *adv7511)
+static void __adv7511_power_off(struct adv7511 *adv7511)
 {
        /* TODO: setup additional power down modes */
        regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER,
                           ADV7511_POWER_POWER_DOWN,
                           ADV7511_POWER_POWER_DOWN);
        regcache_mark_dirty(adv7511->regmap);
+}
 
+static void adv7511_power_off(struct adv7511 *adv7511)
+{
+       __adv7511_power_off(adv7511);
        if (adv7511->type == ADV7533)
                adv7533_dsi_power_off(adv7511);
-
        adv7511->powered = false;
 }
 
@@ -567,23 +574,20 @@ static int adv7511_get_modes(struct adv7511 *adv7511,
 
        /* Reading the EDID only works if the device is powered */
        if (!adv7511->powered) {
-               regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER,
-                                  ADV7511_POWER_POWER_DOWN, 0);
-               if (adv7511->i2c_main->irq) {
-                       regmap_write(adv7511->regmap, ADV7511_REG_INT_ENABLE(0),
-                                    ADV7511_INT0_EDID_READY);
-                       regmap_write(adv7511->regmap, ADV7511_REG_INT_ENABLE(1),
-                                    ADV7511_INT1_DDC_ERROR);
-               }
-               adv7511->current_edid_segment = -1;
+               unsigned int edid_i2c_addr =
+                                       (adv7511->i2c_main->addr << 1) + 4;
+
+               __adv7511_power_on(adv7511);
+
+               /* Reset the EDID_I2C_ADDR register as it might be cleared */
+               regmap_write(adv7511->regmap, ADV7511_REG_EDID_I2C_ADDR,
+                            edid_i2c_addr);
        }
 
        edid = drm_do_get_edid(connector, adv7511_get_edid_block, adv7511);
 
        if (!adv7511->powered)
-               regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER,
-                                  ADV7511_POWER_POWER_DOWN,
-                                  ADV7511_POWER_POWER_DOWN);
+               __adv7511_power_off(adv7511);
 
        kfree(adv7511->edid);
        adv7511->edid = edid;
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 362b8cd68a24..80a903bd317d 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -218,7 +218,7 @@ static int drm_minor_register(struct drm_device *dev, 
unsigned int type)
        ret = drm_debugfs_init(minor, minor->index, drm_debugfs_root);
        if (ret) {
                DRM_ERROR("DRM: Failed to initialize /sys/kernel/debug/dri.\n");
-               return ret;
+               goto err_debugfs;
        }
 
        ret = device_add(minor->kdev);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index a19ec06f9e42..3ce9ba30d827 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -457,7 +457,6 @@ struct intel_crtc_scaler_state {
 
 struct intel_pipe_wm {
        struct intel_wm_level wm[5];
-       struct intel_wm_level raw_wm[5];
        uint32_t linetime;
        bool fbc_wm_enabled;
        bool pipe_enabled;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 49de4760cc16..277a8026460b 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -27,6 +27,7 @@
 
 #include <linux/cpufreq.h>
 #include <drm/drm_plane_helper.h>
+#include <drm/drm_atomic_helper.h>
 #include "i915_drv.h"
 #include "intel_drv.h"
 #include "../../../platform/x86/intel_ips.h"
@@ -2017,9 +2018,9 @@ static void ilk_compute_wm_level(const struct 
drm_i915_private *dev_priv,
                                 const struct intel_crtc *intel_crtc,
                                 int level,
                                 struct intel_crtc_state *cstate,
-                                struct intel_plane_state *pristate,
-                                struct intel_plane_state *sprstate,
-                                struct intel_plane_state *curstate,
+                                const struct intel_plane_state *pristate,
+                                const struct intel_plane_state *sprstate,
+                                const struct intel_plane_state *curstate,
                                 struct intel_wm_level *result)
 {
        uint16_t pri_latency = dev_priv->wm.pri_latency[level];
@@ -2341,28 +2342,24 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state 
*cstate)
        struct intel_pipe_wm *pipe_wm;
        struct drm_device *dev = state->dev;
        const struct drm_i915_private *dev_priv = to_i915(dev);
-       struct intel_plane *intel_plane;
-       struct intel_plane_state *pristate = NULL;
-       struct intel_plane_state *sprstate = NULL;
-       struct intel_plane_state *curstate = NULL;
+       struct drm_plane *plane;
+       const struct drm_plane_state *plane_state;
+       const struct intel_plane_state *pristate = NULL;
+       const struct intel_plane_state *sprstate = NULL;
+       const struct intel_plane_state *curstate = NULL;
        int level, max_level = ilk_wm_max_level(dev), usable_level;
        struct ilk_wm_maximums max;
 
        pipe_wm = &cstate->wm.ilk.optimal;
 
-       for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
-               struct intel_plane_state *ps;
+       drm_atomic_crtc_state_for_each_plane_state(plane, plane_state, 
&cstate->base) {
+               const struct intel_plane_state *ps = 
to_intel_plane_state(plane_state);
 
-               ps = intel_atomic_get_existing_plane_state(state,
-                                                          intel_plane);
-               if (!ps)
-                       continue;
-
-               if (intel_plane->base.type == DRM_PLANE_TYPE_PRIMARY)
+               if (plane->type == DRM_PLANE_TYPE_PRIMARY)
                        pristate = ps;
-               else if (intel_plane->base.type == DRM_PLANE_TYPE_OVERLAY)
+               else if (plane->type == DRM_PLANE_TYPE_OVERLAY)
                        sprstate = ps;
-               else if (intel_plane->base.type == DRM_PLANE_TYPE_CURSOR)
+               else if (plane->type == DRM_PLANE_TYPE_CURSOR)
                        curstate = ps;
        }
 
@@ -2384,11 +2381,9 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state 
*cstate)
        if (pipe_wm->sprites_scaled)
                usable_level = 0;
 
-       ilk_compute_wm_level(dev_priv, intel_crtc, 0, cstate,
-                            pristate, sprstate, curstate, &pipe_wm->raw_wm[0]);
-
        memset(&pipe_wm->wm, 0, sizeof(pipe_wm->wm));
-       pipe_wm->wm[0] = pipe_wm->raw_wm[0];
+       ilk_compute_wm_level(dev_priv, intel_crtc, 0, cstate,
+                            pristate, sprstate, curstate, &pipe_wm->wm[0]);
 
        if (IS_HASWELL(dev) || IS_BROADWELL(dev))
                pipe_wm->linetime = hsw_compute_linetime_wm(cstate);
@@ -2398,8 +2393,8 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state 
*cstate)
 
        ilk_compute_wm_reg_maximums(dev, 1, &max);
 
-       for (level = 1; level <= max_level; level++) {
-               struct intel_wm_level *wm = &pipe_wm->raw_wm[level];
+       for (level = 1; level <= usable_level; level++) {
+               struct intel_wm_level *wm = &pipe_wm->wm[level];
 
                ilk_compute_wm_level(dev_priv, intel_crtc, level, cstate,
                                     pristate, sprstate, curstate, wm);
@@ -2409,13 +2404,10 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state 
*cstate)
                 * register maximums since such watermarks are
                 * always invalid.
                 */
-               if (level > usable_level)
-                       continue;
-
-               if (ilk_validate_wm_level(level, &max, wm))
-                       pipe_wm->wm[level] = *wm;
-               else
-                       usable_level = level;
+               if (!ilk_validate_wm_level(level, &max, wm)) {
+                       memset(wm, 0, sizeof(*wm));
+                       break;
+               }
        }
 
        return 0;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 36005bdf3749..29abd28c19b3 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -721,7 +721,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned 
long chipset)
                 * allocation taken by fbdev
                 */
                if (!(dev_priv->capabilities & SVGA_CAP_3D))
-                       mem_size *= 2;
+                       mem_size *= 3;
 
                dev_priv->max_mob_pages = mem_size * 1024 / PAGE_SIZE;
                dev_priv->prim_bb_mem =
diff --git a/drivers/iio/magnetometer/mag3110.c 
b/drivers/iio/magnetometer/mag3110.c
index f2b3bd7bf862..b4f643fb3b1e 100644
--- a/drivers/iio/magnetometer/mag3110.c
+++ b/drivers/iio/magnetometer/mag3110.c
@@ -222,29 +222,39 @@ static int mag3110_write_raw(struct iio_dev *indio_dev,
                             int val, int val2, long mask)
 {
        struct mag3110_data *data = iio_priv(indio_dev);
-       int rate;
+       int rate, ret;
 
-       if (iio_buffer_enabled(indio_dev))
-               return -EBUSY;
+       ret = iio_device_claim_direct_mode(indio_dev);
+       if (ret)
+               return ret;
 
        switch (mask) {
        case IIO_CHAN_INFO_SAMP_FREQ:
                rate = mag3110_get_samp_freq_index(data, val, val2);
-               if (rate < 0)
-                       return -EINVAL;
+               if (rate < 0) {
+                       ret = -EINVAL;
+                       break;
+               }
 
                data->ctrl_reg1 &= ~MAG3110_CTRL_DR_MASK;
                data->ctrl_reg1 |= rate << MAG3110_CTRL_DR_SHIFT;
-               return i2c_smbus_write_byte_data(data->client,
+               ret = i2c_smbus_write_byte_data(data->client,
                        MAG3110_CTRL_REG1, data->ctrl_reg1);
+               break;
        case IIO_CHAN_INFO_CALIBBIAS:
-               if (val < -10000 || val > 10000)
-                       return -EINVAL;
-               return i2c_smbus_write_word_swapped(data->client,
+               if (val < -10000 || val > 10000) {
+                       ret = -EINVAL;
+                       break;
+               }
+               ret = i2c_smbus_write_word_swapped(data->client,
                        MAG3110_OFF_X + 2 * chan->scan_index, val << 1);
+               break;
        default:
-               return -EINVAL;
+               ret = -EINVAL;
+               break;
        }
+       iio_device_release_direct_mode(indio_dev);
+       return ret;
 }
 
 static irqreturn_t mag3110_trigger_handler(int irq, void *p)
diff --git a/drivers/iio/pressure/ms5611_core.c 
b/drivers/iio/pressure/ms5611_core.c
index a74ed1f0c880..8cc7156b5ace 100644
--- a/drivers/iio/pressure/ms5611_core.c
+++ b/drivers/iio/pressure/ms5611_core.c
@@ -308,6 +308,7 @@ static int ms5611_write_raw(struct iio_dev *indio_dev,
 {
        struct ms5611_state *st = iio_priv(indio_dev);
        const struct ms5611_osr *osr = NULL;
+       int ret;
 
        if (mask != IIO_CHAN_INFO_OVERSAMPLING_RATIO)
                return -EINVAL;
@@ -321,12 +322,11 @@ static int ms5611_write_raw(struct iio_dev *indio_dev,
        if (!osr)
                return -EINVAL;
 
-       mutex_lock(&st->lock);
+       ret = iio_device_claim_direct_mode(indio_dev);
+       if (ret)
+               return ret;
 
-       if (iio_buffer_enabled(indio_dev)) {
-               mutex_unlock(&st->lock);
-               return -EBUSY;
-       }
+       mutex_lock(&st->lock);
 
        if (chan->type == IIO_TEMP)
                st->temp_osr = osr;
@@ -334,6 +334,8 @@ static int ms5611_write_raw(struct iio_dev *indio_dev,
                st->pressure_osr = osr;
 
        mutex_unlock(&st->lock);
+       iio_device_release_direct_mode(indio_dev);
+
        return 0;
 }
 
diff --git a/drivers/iio/proximity/sx9500.c b/drivers/iio/proximity/sx9500.c
index 1f06282ec793..9ea147f1a50d 100644
--- a/drivers/iio/proximity/sx9500.c
+++ b/drivers/iio/proximity/sx9500.c
@@ -387,14 +387,18 @@ static int sx9500_read_raw(struct iio_dev *indio_dev,
                           int *val, int *val2, long mask)
 {
        struct sx9500_data *data = iio_priv(indio_dev);
+       int ret;
 
        switch (chan->type) {
        case IIO_PROXIMITY:
                switch (mask) {
                case IIO_CHAN_INFO_RAW:
-                       if (iio_buffer_enabled(indio_dev))
-                               return -EBUSY;
-                       return sx9500_read_proximity(data, chan, val);
+                       ret = iio_device_claim_direct_mode(indio_dev);
+                       if (ret)
+                               return ret;
+                       ret = sx9500_read_proximity(data, chan, val);
+                       iio_device_release_direct_mode(indio_dev);
+                       return ret;
                case IIO_CHAN_INFO_SAMP_FREQ:
                        return sx9500_read_samp_freq(data, val, val2);
                default:
diff --git a/drivers/iio/trigger/iio-trig-interrupt.c 
b/drivers/iio/trigger/iio-trig-interrupt.c
index 572bc6f02ca8..e18f12b74610 100644
--- a/drivers/iio/trigger/iio-trig-interrupt.c
+++ b/drivers/iio/trigger/iio-trig-interrupt.c
@@ -58,7 +58,7 @@ static int iio_interrupt_trigger_probe(struct platform_device 
*pdev)
        trig_info = kzalloc(sizeof(*trig_info), GFP_KERNEL);
        if (!trig_info) {
                ret = -ENOMEM;
-               goto error_put_trigger;
+               goto error_free_trigger;
        }
        iio_trigger_set_drvdata(trig, trig_info);
        trig_info->irq = irq;
@@ -83,8 +83,8 @@ static int iio_interrupt_trigger_probe(struct platform_device 
*pdev)
        free_irq(irq, trig);
 error_free_trig_info:
        kfree(trig_info);
-error_put_trigger:
-       iio_trigger_put(trig);
+error_free_trigger:
+       iio_trigger_free(trig);
 error_ret:
        return ret;
 }
@@ -99,7 +99,7 @@ static int iio_interrupt_trigger_remove(struct 
platform_device *pdev)
        iio_trigger_unregister(trig);
        free_irq(trig_info->irq, trig);
        kfree(trig_info);
-       iio_trigger_put(trig);
+       iio_trigger_free(trig);
 
        return 0;
 }
diff --git a/drivers/iio/trigger/iio-trig-sysfs.c 
b/drivers/iio/trigger/iio-trig-sysfs.c
index 3dfab2bc6d69..202e8b89caf2 100644
--- a/drivers/iio/trigger/iio-trig-sysfs.c
+++ b/drivers/iio/trigger/iio-trig-sysfs.c
@@ -174,7 +174,7 @@ static int iio_sysfs_trigger_probe(int id)
        return 0;
 
 out2:
-       iio_trigger_put(t->trig);
+       iio_trigger_free(t->trig);
 free_t:
        kfree(t);
 out1:
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c 
b/drivers/infiniband/sw/rxe/rxe_req.c
index 9f46be52335e..9d084780ac91 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -633,6 +633,7 @@ int rxe_requester(void *arg)
                                goto exit;
                        }
                        rmr->state = RXE_MEM_STATE_FREE;
+                       rxe_drop_ref(rmr);
                        wqe->state = wqe_state_done;
                        wqe->status = IB_WC_SUCCESS;
                } else if (wqe->wr.opcode == IB_WR_REG_MR) {
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c 
b/drivers/infiniband/sw/rxe/rxe_resp.c
index 69ed4e0d7a0d..7705820cdac6 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -893,6 +893,7 @@ static enum resp_states do_complete(struct rxe_qp *qp,
                                        return RESPST_ERROR;
                                }
                                rmr->state = RXE_MEM_STATE_FREE;
+                               rxe_drop_ref(rmr);
                        }
 
                        wc->qp                  = &qp->ibqp;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c 
b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 0616a65f0d78..75761667be59 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1392,7 +1392,7 @@ static void ipoib_cm_tx_reap(struct work_struct *work)
 
        while (!list_empty(&priv->cm.reap_list)) {
                p = list_entry(priv->cm.reap_list.next, typeof(*p), list);
-               list_del(&p->list);
+               list_del_init(&p->list);
                spin_unlock_irqrestore(&priv->lock, flags);
                netif_tx_unlock_bh(dev);
                ipoib_cm_tx_destroy(p);
diff --git a/drivers/input/keyboard/mpr121_touchkey.c 
b/drivers/input/keyboard/mpr121_touchkey.c
index 0fd612dd76ed..aaf43befffaa 100644
--- a/drivers/input/keyboard/mpr121_touchkey.c
+++ b/drivers/input/keyboard/mpr121_touchkey.c
@@ -87,7 +87,8 @@ static irqreturn_t mpr_touchkey_interrupt(int irq, void 
*dev_id)
        struct mpr121_touchkey *mpr121 = dev_id;
        struct i2c_client *client = mpr121->client;
        struct input_dev *input = mpr121->input_dev;
-       unsigned int key_num, key_val, pressed;
+       unsigned long bit_changed;
+       unsigned int key_num;
        int reg;
 
        reg = i2c_smbus_read_byte_data(client, ELE_TOUCH_STATUS_1_ADDR);
@@ -105,18 +106,22 @@ static irqreturn_t mpr_touchkey_interrupt(int irq, void 
*dev_id)
 
        reg &= TOUCH_STATUS_MASK;
        /* use old press bit to figure out which bit changed */
-       key_num = ffs(reg ^ mpr121->statusbits) - 1;
-       pressed = reg & (1 << key_num);
+       bit_changed = reg ^ mpr121->statusbits;
        mpr121->statusbits = reg;
+       for_each_set_bit(key_num, &bit_changed, mpr121->keycount) {
+               unsigned int key_val, pressed;
 
-       key_val = mpr121->keycodes[key_num];
+               pressed = reg & BIT(key_num);
+               key_val = mpr121->keycodes[key_num];
 
-       input_event(input, EV_MSC, MSC_SCAN, key_num);
-       input_report_key(input, key_val, pressed);
-       input_sync(input);
+               input_event(input, EV_MSC, MSC_SCAN, key_num);
+               input_report_key(input, key_val, pressed);
+
+               dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val,
+                       pressed ? "pressed" : "released");
 
-       dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val,
-               pressed ? "pressed" : "released");
+       }
+       input_sync(input);
 
 out:
        return IRQ_HANDLED;
@@ -231,6 +236,7 @@ static int mpr_touchkey_probe(struct i2c_client *client,
        input_dev->id.bustype = BUS_I2C;
        input_dev->dev.parent = &client->dev;
        input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP);
+       input_set_capability(input_dev, EV_MSC, MSC_SCAN);
 
        input_dev->keycode = mpr121->keycodes;
        input_dev->keycodesize = sizeof(mpr121->keycodes[0]);
diff --git a/drivers/input/mouse/elan_i2c_core.c 
b/drivers/input/mouse/elan_i2c_core.c
index b8c50d883b2c..c9d491bc85e0 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1240,6 +1240,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
        { "ELAN0605", 0 },
        { "ELAN0609", 0 },
        { "ELAN060B", 0 },
+       { "ELAN060C", 0 },
        { "ELAN0611", 0 },
        { "ELAN1000", 0 },
        { }
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index e6f9b2d745ca..d3d975ae24b7 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -1040,13 +1040,8 @@ static void arm_smmu_write_strtab_ent(struct 
arm_smmu_device *smmu, u32 sid,
                }
        }
 
-       /* Nuke the existing Config, as we're going to rewrite it */
-       val &= ~(STRTAB_STE_0_CFG_MASK << STRTAB_STE_0_CFG_SHIFT);
-
-       if (ste->valid)
-               val |= STRTAB_STE_0_V;
-       else
-               val &= ~STRTAB_STE_0_V;
+       /* Nuke the existing STE_0 value, as we're going to rewrite it */
+       val = ste->valid ? STRTAB_STE_0_V : 0;
 
        if (ste->bypass) {
                val |= disable_bypass ? STRTAB_STE_0_CFG_ABORT
@@ -1081,7 +1076,6 @@ static void arm_smmu_write_strtab_ent(struct 
arm_smmu_device *smmu, u32 sid,
                val |= (ste->s1_cfg->cdptr_dma & STRTAB_STE_0_S1CTXPTR_MASK
                        << STRTAB_STE_0_S1CTXPTR_SHIFT) |
                        STRTAB_STE_0_CFG_S1_TRANS;
-
        }
 
        if (ste->s2_cfg) {
diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
index 4003831de712..7b1935ab03c8 100644
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -3118,6 +3118,9 @@ static int adv76xx_parse_dt(struct adv76xx_state *state)
        state->pdata.blank_data = 1;
        state->pdata.op_format_mode_sel = ADV7604_OP_FORMAT_MODE0;
        state->pdata.bus_order = ADV7604_BUS_ORDER_RGB;
+       state->pdata.dr_str_data = ADV76XX_DR_STR_MEDIUM_HIGH;
+       state->pdata.dr_str_clk = ADV76XX_DR_STR_MEDIUM_HIGH;
+       state->pdata.dr_str_sync = ADV76XX_DR_STR_MEDIUM_HIGH;
 
        return 0;
 }
diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index fa4fe02cfef4..eef202d4399b 100644
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -1620,6 +1620,9 @@ static void cxl_pci_remove_adapter(struct cxl *adapter)
        cxl_sysfs_adapter_remove(adapter);
        cxl_debugfs_adapter_remove(adapter);
 
+       /* Flush adapter datacache as its about to be removed */
+       cxl_data_cache_flush(adapter);
+
        cxl_deconfigure_adapter(adapter);
 
        device_unregister(&adapter->dev);
diff --git a/drivers/net/can/c_can/c_can_pci.c 
b/drivers/net/can/c_can/c_can_pci.c
index cf7c18947189..d065c0e2d18e 100644
--- a/drivers/net/can/c_can/c_can_pci.c
+++ b/drivers/net/can/c_can/c_can_pci.c
@@ -178,7 +178,6 @@ static int c_can_pci_probe(struct pci_dev *pdev,
                break;
        case BOSCH_D_CAN:
                priv->regs = reg_map_d_can;
-               priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
                break;
        default:
                ret = -EINVAL;
diff --git a/drivers/net/can/c_can/c_can_platform.c 
b/drivers/net/can/c_can/c_can_platform.c
index e36d10520e24..717530eac70c 100644
--- a/drivers/net/can/c_can/c_can_platform.c
+++ b/drivers/net/can/c_can/c_can_platform.c
@@ -320,7 +320,6 @@ static int c_can_plat_probe(struct platform_device *pdev)
                break;
        case BOSCH_D_CAN:
                priv->regs = reg_map_d_can;
-               priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
                priv->read_reg = c_can_plat_read_reg_aligned_to_16bit;
                priv->write_reg = c_can_plat_write_reg_aligned_to_16bit;
                priv->read_reg32 = d_can_plat_read_reg32;
diff --git a/drivers/net/can/ifi_canfd/ifi_canfd.c 
b/drivers/net/can/ifi_canfd/ifi_canfd.c
index 481895b2f9f4..c06ef438f23f 100644
--- a/drivers/net/can/ifi_canfd/ifi_canfd.c
+++ b/drivers/net/can/ifi_canfd/ifi_canfd.c
@@ -670,9 +670,9 @@ static void ifi_canfd_set_bittiming(struct net_device *ndev)
               priv->base + IFI_CANFD_FTIME);
 
        /* Configure transmitter delay */
-       tdc = (dbt->brp * (dbt->phase_seg1 + 1)) & IFI_CANFD_TDELAY_MASK;
-       writel(IFI_CANFD_TDELAY_EN | IFI_CANFD_TDELAY_ABS | tdc,
-              priv->base + IFI_CANFD_TDELAY);
+       tdc = dbt->brp * (dbt->prop_seg + dbt->phase_seg1);
+       tdc &= IFI_CANFD_TDELAY_MASK;
+       writel(IFI_CANFD_TDELAY_EN | tdc, priv->base + IFI_CANFD_TDELAY);
 }
 
 static void ifi_canfd_set_filter(struct net_device *ndev, const u32 id,
diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c
index b0c80859f746..1ac2090a1721 100644
--- a/drivers/net/can/sun4i_can.c
+++ b/drivers/net/can/sun4i_can.c
@@ -539,6 +539,13 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, 
u8 status)
                }
                stats->rx_over_errors++;
                stats->rx_errors++;
+
+               /* reset the CAN IP by entering reset mode
+                * ignoring timeout error
+                */
+               set_reset_mode(dev);
+               set_normal_mode(dev);
+
                /* clear bit */
                sun4i_can_write_cmdreg(priv, SUN4I_CMD_CLEAR_OR_FLAG);
        }
@@ -653,8 +660,9 @@ static irqreturn_t sun4i_can_interrupt(int irq, void 
*dev_id)
                        netif_wake_queue(dev);
                        can_led_event(dev, CAN_LED_EVENT_TX);
                }
-               if (isrc & SUN4I_INT_RBUF_VLD) {
-                       /* receive interrupt */
+               if ((isrc & SUN4I_INT_RBUF_VLD) &&
+                   !(isrc & SUN4I_INT_DATA_OR)) {
+                       /* receive interrupt - don't read if overrun occurred */
                        while (status & SUN4I_STA_RBUF_RDY) {
                                /* RX buffer is not empty */
                                sun4i_can_rx(dev);
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index afbfc0f656f3..dc6d3b0a0be8 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -769,8 +769,10 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct 
usb_interface *intf, u8 data_
        u8 *buf;
        int len;
        int temp;
+       int err;
        u8 iface_no;
        struct usb_cdc_parsed_header hdr;
+       u16 curr_ntb_format;
 
        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
        if (!ctx)
@@ -875,6 +877,32 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct 
usb_interface *intf, u8 data_
                goto error2;
        }
 
+       /*
+        * Some Huawei devices have been observed to come out of reset in NDP32 
mode.
+        * Let's check if this is the case, and set the device to NDP16 mode 
again if
+        * needed.
+       */
+       if (ctx->drvflags & CDC_NCM_FLAG_RESET_NTB16) {
+               err = usbnet_read_cmd(dev, USB_CDC_GET_NTB_FORMAT,
+                                     USB_TYPE_CLASS | USB_DIR_IN | 
USB_RECIP_INTERFACE,
+                                     0, iface_no, &curr_ntb_format, 2);
+               if (err < 0) {
+                       goto error2;
+               }
+
+               if (curr_ntb_format == USB_CDC_NCM_NTB32_FORMAT) {
+                       dev_info(&intf->dev, "resetting NTB format to 16-bit");
+                       err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_FORMAT,
+                                              USB_TYPE_CLASS | USB_DIR_OUT
+                                              | USB_RECIP_INTERFACE,
+                                              USB_CDC_NCM_NTB16_FORMAT,
+                                              iface_no, NULL, 0);
+
+                       if (err < 0)
+                               goto error2;
+               }
+       }
+
        cdc_ncm_find_endpoints(dev, ctx->data);
        cdc_ncm_find_endpoints(dev, ctx->control);
        if (!dev->in || !dev->out || !dev->status) {
diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c
index 2680a65cd5e4..63f28908afda 100644
--- a/drivers/net/usb/huawei_cdc_ncm.c
+++ b/drivers/net/usb/huawei_cdc_ncm.c
@@ -80,6 +80,12 @@ static int huawei_cdc_ncm_bind(struct usbnet *usbnet_dev,
         * be at the end of the frame.
         */
        drvflags |= CDC_NCM_FLAG_NDP_TO_END;
+
+       /* Additionally, it has been reported that some Huawei E3372H devices, 
with
+        * firmware version 21.318.01.00.541, come out of reset in NTB32 format 
mode, hence
+        * needing to be set to the NTB16 one again.
+        */
+       drvflags |= CDC_NCM_FLAG_RESET_NTB16;
        ret = cdc_ncm_bind_common(usbnet_dev, intf, 1, drvflags);
        if (ret)
                goto err;
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c 
b/drivers/net/wireless/ath/wcn36xx/main.c
index e1d59da2ad20..ca8797c65312 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -1165,11 +1165,12 @@ static int wcn36xx_remove(struct platform_device *pdev)
        wcn36xx_dbg(WCN36XX_DBG_MAC, "platform remove\n");
 
        release_firmware(wcn->nv);
-       mutex_destroy(&wcn->hal_mutex);
 
        ieee80211_unregister_hw(hw);
        iounmap(wcn->dxe_base);
        iounmap(wcn->ccu_base);
+
+       mutex_destroy(&wcn->hal_mutex);
        ieee80211_free_hw(hw);
 
        return 0;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 27960b0bfbcd..425a89c635d0 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -6572,8 +6572,7 @@ static int brcmf_setup_wiphy(struct wiphy *wiphy, struct 
brcmf_if *ifp)
                        wiphy->bands[NL80211_BAND_5GHZ] = band;
                }
        }
-       err = brcmf_setup_wiphybands(wiphy);
-       return err;
+       return 0;
 }
 
 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
@@ -6938,6 +6937,12 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct 
brcmf_pub *drvr,
                goto priv_out;
        }
 
+       err = brcmf_setup_wiphybands(wiphy);
+       if (err) {
+               brcmf_err("Setting wiphy bands failed (%d)\n", err);
+               goto wiphy_unreg_out;
+       }
+
        /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
         * setup 40MHz in 2GHz band and enable OBSS scanning.
         */
diff --git a/drivers/net/wireless/marvell/libertas/cmd.c 
b/drivers/net/wireless/marvell/libertas/cmd.c
index 301170cccfff..033ff881c751 100644
--- a/drivers/net/wireless/marvell/libertas/cmd.c
+++ b/drivers/net/wireless/marvell/libertas/cmd.c
@@ -305,7 +305,7 @@ int lbs_cmd_802_11_sleep_params(struct lbs_private *priv, 
uint16_t cmd_action,
        }
 
        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-       return 0;
+       return ret;
 }
 
 static int lbs_wait_for_ds_awake(struct lbs_private *priv)
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c 
b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
index 4b0bb6b4f6f1..c636e6065548 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
@@ -646,10 +646,9 @@ static void rt2800usb_txdone_nostatus(struct rt2x00_dev 
*rt2x00dev)
                            !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
                                break;
 
-                       if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
+                       if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags) ||
+                           rt2800usb_entry_txstatus_timeout(entry))
                                rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
-                       else if (rt2800usb_entry_txstatus_timeout(entry))
-                               rt2x00lib_txdone_noinfo(entry, TXDONE_UNKNOWN);
                        else
                                break;
                }
diff --git a/drivers/net/xen-netback/netback.c 
b/drivers/net/xen-netback/netback.c
index d9b5b73c35a0..a7bdb1ffac2e 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -67,6 +67,7 @@ module_param(rx_drain_timeout_msecs, uint, 0444);
 unsigned int rx_stall_timeout_msecs = 60000;
 module_param(rx_stall_timeout_msecs, uint, 0444);
 
+#define MAX_QUEUES_DEFAULT 8
 unsigned int xenvif_max_queues;
 module_param_named(max_queues, xenvif_max_queues, uint, 0644);
 MODULE_PARM_DESC(max_queues,
@@ -1626,11 +1627,12 @@ static int __init netback_init(void)
        if (!xen_domain())
                return -ENODEV;
 
-       /* Allow as many queues as there are CPUs if user has not
+       /* Allow as many queues as there are CPUs but max. 8 if user has not
         * specified a value.
         */
        if (xenvif_max_queues == 0)
-               xenvif_max_queues = num_online_cpus();
+               xenvif_max_queues = min_t(unsigned int, MAX_QUEUES_DEFAULT,
+                                         num_online_cpus());
 
        if (fatal_skb_slots < XEN_NETBK_LEGACY_SLOTS_MAX) {
                pr_info("fatal_skb_slots too small (%d), bump it to 
XEN_NETBK_LEGACY_SLOTS_MAX (%d)\n",
diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
index 45a89d969700..90e0b6f134ad 100644
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -133,6 +133,12 @@ struct mvebu_pcie {
        int nports;
 };
 
+struct mvebu_pcie_window {
+       phys_addr_t base;
+       phys_addr_t remap;
+       size_t size;
+};
+
 /* Structure representing one PCIe interface */
 struct mvebu_pcie_port {
        char *name;
@@ -150,10 +156,8 @@ struct mvebu_pcie_port {
        struct mvebu_sw_pci_bridge bridge;
        struct device_node *dn;
        struct mvebu_pcie *pcie;
-       phys_addr_t memwin_base;
-       size_t memwin_size;
-       phys_addr_t iowin_base;
-       size_t iowin_size;
+       struct mvebu_pcie_window memwin;
+       struct mvebu_pcie_window iowin;
        u32 saved_pcie_stat;
 };
 
@@ -379,23 +383,45 @@ static void mvebu_pcie_add_windows(struct mvebu_pcie_port 
*port,
        }
 }
 
+static void mvebu_pcie_set_window(struct mvebu_pcie_port *port,
+                                 unsigned int target, unsigned int attribute,
+                                 const struct mvebu_pcie_window *desired,
+                                 struct mvebu_pcie_window *cur)
+{
+       if (desired->base == cur->base && desired->remap == cur->remap &&
+           desired->size == cur->size)
+               return;
+
+       if (cur->size != 0) {
+               mvebu_pcie_del_windows(port, cur->base, cur->size);
+               cur->size = 0;
+               cur->base = 0;
+
+               /*
+                * If something tries to change the window while it is enabled
+                * the change will not be done atomically. That would be
+                * difficult to do in the general case.
+                */
+       }
+
+       if (desired->size == 0)
+               return;
+
+       mvebu_pcie_add_windows(port, target, attribute, desired->base,
+                              desired->size, desired->remap);
+       *cur = *desired;
+}
+
 static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
 {
-       phys_addr_t iobase;
+       struct mvebu_pcie_window desired = {};
 
        /* Are the new iobase/iolimit values invalid? */
        if (port->bridge.iolimit < port->bridge.iobase ||
            port->bridge.iolimitupper < port->bridge.iobaseupper ||
            !(port->bridge.command & PCI_COMMAND_IO)) {
-
-               /* If a window was configured, remove it */
-               if (port->iowin_base) {
-                       mvebu_pcie_del_windows(port, port->iowin_base,
-                                              port->iowin_size);
-                       port->iowin_base = 0;
-                       port->iowin_size = 0;
-               }
-
+               mvebu_pcie_set_window(port, port->io_target, port->io_attr,
+                                     &desired, &port->iowin);
                return;
        }
 
@@ -412,32 +438,27 @@ static void mvebu_pcie_handle_iobase_change(struct 
mvebu_pcie_port *port)
         * specifications. iobase is the bus address, port->iowin_base
         * is the CPU address.
         */
-       iobase = ((port->bridge.iobase & 0xF0) << 8) |
-               (port->bridge.iobaseupper << 16);
-       port->iowin_base = port->pcie->io.start + iobase;
-       port->iowin_size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) |
-                           (port->bridge.iolimitupper << 16)) -
-                           iobase) + 1;
-
-       mvebu_pcie_add_windows(port, port->io_target, port->io_attr,
-                              port->iowin_base, port->iowin_size,
-                              iobase);
+       desired.remap = ((port->bridge.iobase & 0xF0) << 8) |
+                       (port->bridge.iobaseupper << 16);
+       desired.base = port->pcie->io.start + desired.remap;
+       desired.size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) |
+                        (port->bridge.iolimitupper << 16)) -
+                       desired.remap) +
+                      1;
+
+       mvebu_pcie_set_window(port, port->io_target, port->io_attr, &desired,
+                             &port->iowin);
 }
 
 static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port)
 {
+       struct mvebu_pcie_window desired = {.remap = MVEBU_MBUS_NO_REMAP};
+
        /* Are the new membase/memlimit values invalid? */
        if (port->bridge.memlimit < port->bridge.membase ||
            !(port->bridge.command & PCI_COMMAND_MEMORY)) {
-
-               /* If a window was configured, remove it */
-               if (port->memwin_base) {
-                       mvebu_pcie_del_windows(port, port->memwin_base,
-                                              port->memwin_size);
-                       port->memwin_base = 0;
-                       port->memwin_size = 0;
-               }
-
+               mvebu_pcie_set_window(port, port->mem_target, port->mem_attr,
+                                     &desired, &port->memwin);
                return;
        }
 
@@ -447,14 +468,12 @@ static void mvebu_pcie_handle_membase_change(struct 
mvebu_pcie_port *port)
         * window to setup, according to the PCI-to-PCI bridge
         * specifications.
         */
-       port->memwin_base  = ((port->bridge.membase & 0xFFF0) << 16);
-       port->memwin_size  =
-               (((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) -
-               port->memwin_base + 1;
-
-       mvebu_pcie_add_windows(port, port->mem_target, port->mem_attr,
-                              port->memwin_base, port->memwin_size,
-                              MVEBU_MBUS_NO_REMAP);
+       desired.base = ((port->bridge.membase & 0xFFF0) << 16);
+       desired.size = (((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) -
+                      desired.base + 1;
+
+       mvebu_pcie_set_window(port, port->mem_target, port->mem_attr, &desired,
+                             &port->memwin);
 }
 
 /*
diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c 
b/drivers/pinctrl/intel/pinctrl-baytrail.c
index 5419de8e20b1..0a965026b134 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -1466,7 +1466,7 @@ static void byt_gpio_dbg_show(struct seq_file *s, struct 
gpio_chip *chip)
                           val & BYT_INPUT_EN ? "  " : "in",
                           val & BYT_OUTPUT_EN ? "   " : "out",
                           val & BYT_LEVEL ? "hi" : "lo",
-                          comm->pad_map[i], comm->pad_map[i] * 32,
+                          comm->pad_map[i], comm->pad_map[i] * 16,
                           conf0 & 0x7,
                           conf0 & BYT_TRIG_NEG ? " fall" : "     ",
                           conf0 & BYT_TRIG_POS ? " rise" : "     ",
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 96ffda493266..454cb2ee3cee 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -248,7 +248,7 @@ static int hp_wmi_display_state(void)
        int ret = hp_wmi_perform_query(HPWMI_DISPLAY_QUERY, 0, &state,
                                       sizeof(state), sizeof(state));
        if (ret)
-               return -EINVAL;
+               return ret < 0 ? ret : -EINVAL;
        return state;
 }
 
@@ -258,7 +258,7 @@ static int hp_wmi_hddtemp_state(void)
        int ret = hp_wmi_perform_query(HPWMI_HDDTEMP_QUERY, 0, &state,
                                       sizeof(state), sizeof(state));
        if (ret)
-               return -EINVAL;
+               return ret < 0 ? ret : -EINVAL;
        return state;
 }
 
@@ -268,7 +268,7 @@ static int hp_wmi_als_state(void)
        int ret = hp_wmi_perform_query(HPWMI_ALS_QUERY, 0, &state,
                                       sizeof(state), sizeof(state));
        if (ret)
-               return -EINVAL;
+               return ret < 0 ? ret : -EINVAL;
        return state;
 }
 
@@ -279,7 +279,7 @@ static int hp_wmi_dock_state(void)
                                       sizeof(state), sizeof(state));
 
        if (ret)
-               return -EINVAL;
+               return ret < 0 ? ret : -EINVAL;
 
        return state & 0x1;
 }
@@ -290,7 +290,7 @@ static int hp_wmi_tablet_state(void)
        int ret = hp_wmi_perform_query(HPWMI_HARDWARE_QUERY, 0, &state,
                                       sizeof(state), sizeof(state));
        if (ret)
-               return ret;
+               return ret < 0 ? ret : -EINVAL;
 
        return (state & 0x4) ? 1 : 0;
 }
@@ -323,7 +323,7 @@ static int __init hp_wmi_enable_hotkeys(void)
        int ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &value,
                                       sizeof(value), 0);
        if (ret)
-               return -EINVAL;
+               return ret < 0 ? ret : -EINVAL;
        return 0;
 }
 
@@ -336,7 +336,7 @@ static int hp_wmi_set_block(void *data, bool blocked)
        ret = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1,
                                   &query, sizeof(query), 0);
        if (ret)
-               return -EINVAL;
+               return ret < 0 ? ret : -EINVAL;
        return 0;
 }
 
@@ -428,7 +428,7 @@ static int hp_wmi_post_code_state(void)
        int ret = hp_wmi_perform_query(HPWMI_POSTCODEERROR_QUERY, 0, &state,
                                       sizeof(state), sizeof(state));
        if (ret)
-               return -EINVAL;
+               return ret < 0 ? ret : -EINVAL;
        return state;
 }
 
@@ -494,7 +494,7 @@ static ssize_t set_als(struct device *dev, struct 
device_attribute *attr,
        int ret = hp_wmi_perform_query(HPWMI_ALS_QUERY, 1, &tmp,
                                       sizeof(tmp), sizeof(tmp));
        if (ret)
-               return -EINVAL;
+               return ret < 0 ? ret : -EINVAL;
 
        return count;
 }
@@ -515,7 +515,7 @@ static ssize_t set_postcode(struct device *dev, struct 
device_attribute *attr,
        ret = hp_wmi_perform_query(HPWMI_POSTCODEERROR_QUERY, 1, &tmp,
                                       sizeof(tmp), sizeof(tmp));
        if (ret)
-               return -EINVAL;
+               return ret < 0 ? ret : -EINVAL;
 
        return count;
 }
@@ -572,10 +572,12 @@ static void hp_wmi_notify(u32 value, void *context)
 
        switch (event_id) {
        case HPWMI_DOCK_EVENT:
-               input_report_switch(hp_wmi_input_dev, SW_DOCK,
-                                   hp_wmi_dock_state());
-               input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
-                                   hp_wmi_tablet_state());
+               if (test_bit(SW_DOCK, hp_wmi_input_dev->swbit))
+                       input_report_switch(hp_wmi_input_dev, SW_DOCK,
+                                           hp_wmi_dock_state());
+               if (test_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit))
+                       input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
+                                           hp_wmi_tablet_state());
                input_sync(hp_wmi_input_dev);
                break;
        case HPWMI_PARK_HDD:
@@ -644,6 +646,7 @@ static int __init hp_wmi_input_setup(void)
 {
        acpi_status status;
        int err;
+       int val;
 
        hp_wmi_input_dev = input_allocate_device();
        if (!hp_wmi_input_dev)
@@ -654,17 +657,26 @@ static int __init hp_wmi_input_setup(void)
        hp_wmi_input_dev->id.bustype = BUS_HOST;
 
        __set_bit(EV_SW, hp_wmi_input_dev->evbit);
-       __set_bit(SW_DOCK, hp_wmi_input_dev->swbit);
-       __set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit);
+
+       /* Dock */
+       val = hp_wmi_dock_state();
+       if (!(val < 0)) {
+               __set_bit(SW_DOCK, hp_wmi_input_dev->swbit);
+               input_report_switch(hp_wmi_input_dev, SW_DOCK, val);
+       }
+
+       /* Tablet mode */
+       val = hp_wmi_tablet_state();
+       if (!(val < 0)) {
+               __set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit);
+               input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, val);
+       }
 
        err = sparse_keymap_setup(hp_wmi_input_dev, hp_wmi_keymap, NULL);
        if (err)
                goto err_free_dev;
 
        /* Set initial hardware state */
-       input_report_switch(hp_wmi_input_dev, SW_DOCK, hp_wmi_dock_state());
-       input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
-                           hp_wmi_tablet_state());
        input_sync(hp_wmi_input_dev);
 
        if (!hp_wmi_bios_2009_later() && hp_wmi_bios_2008_later())
@@ -950,10 +962,12 @@ static int hp_wmi_resume_handler(struct device *device)
         * changed.
         */
        if (hp_wmi_input_dev) {
-               input_report_switch(hp_wmi_input_dev, SW_DOCK,
-                                   hp_wmi_dock_state());
-               input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
-                                   hp_wmi_tablet_state());
+               if (test_bit(SW_DOCK, hp_wmi_input_dev->swbit))
+                       input_report_switch(hp_wmi_input_dev, SW_DOCK,
+                                           hp_wmi_dock_state());
+               if (test_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit))
+                       input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
+                                           hp_wmi_tablet_state());
                input_sync(hp_wmi_input_dev);
        }
 
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index f3756ca6f349..d55e6438bb5e 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -921,7 +921,6 @@ void qeth_clear_thread_running_bit(struct qeth_card *, 
unsigned long);
 int qeth_core_hardsetup_card(struct qeth_card *);
 void qeth_print_status_message(struct qeth_card *);
 int qeth_init_qdio_queues(struct qeth_card *);
-int qeth_send_startlan(struct qeth_card *);
 int qeth_send_ipa_cmd(struct qeth_card *, struct qeth_cmd_buffer *,
                  int (*reply_cb)
                  (struct qeth_card *, struct qeth_reply *, unsigned long),
diff --git a/drivers/s390/net/qeth_core_main.c 
b/drivers/s390/net/qeth_core_main.c
index e8c48309ebe9..21ef8023430f 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -2944,7 +2944,7 @@ int qeth_send_ipa_cmd(struct qeth_card *card, struct 
qeth_cmd_buffer *iob,
 }
 EXPORT_SYMBOL_GPL(qeth_send_ipa_cmd);
 
-int qeth_send_startlan(struct qeth_card *card)
+static int qeth_send_startlan(struct qeth_card *card)
 {
        int rc;
        struct qeth_cmd_buffer *iob;
@@ -2957,7 +2957,6 @@ int qeth_send_startlan(struct qeth_card *card)
        rc = qeth_send_ipa_cmd(card, iob, NULL, NULL);
        return rc;
 }
-EXPORT_SYMBOL_GPL(qeth_send_startlan);
 
 static int qeth_default_setadapterparms_cb(struct qeth_card *card,
                struct qeth_reply *reply, unsigned long data)
@@ -5091,6 +5090,20 @@ int qeth_core_hardsetup_card(struct qeth_card *card)
                goto out;
        }
 
+       rc = qeth_send_startlan(card);
+       if (rc) {
+               QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
+               if (rc == IPA_RC_LAN_OFFLINE) {
+                       dev_warn(&card->gdev->dev,
+                               "The LAN is offline\n");
+                       card->lan_online = 0;
+               } else {
+                       rc = -ENODEV;
+                       goto out;
+               }
+       } else
+               card->lan_online = 1;
+
        card->options.ipa4.supported_funcs = 0;
        card->options.ipa6.supported_funcs = 0;
        card->options.adp.supported_funcs = 0;
@@ -5102,14 +5115,14 @@ int qeth_core_hardsetup_card(struct qeth_card *card)
        if (qeth_is_supported(card, IPA_SETADAPTERPARMS)) {
                rc = qeth_query_setadapterparms(card);
                if (rc < 0) {
-                       QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
+                       QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc);
                        goto out;
                }
        }
        if (qeth_adp_supported(card, IPA_SETADP_SET_DIAG_ASSIST)) {
                rc = qeth_query_setdiagass(card);
                if (rc < 0) {
-                       QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc);
+                       QETH_DBF_TEXT_(SETUP, 2, "8err%d", rc);
                        goto out;
                }
        }
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 5d010aa89852..8530477caab8 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1204,21 +1204,6 @@ static int __qeth_l2_set_online(struct ccwgroup_device 
*gdev, int recovery_mode)
        /* softsetup */
        QETH_DBF_TEXT(SETUP, 2, "softsetp");
 
-       rc = qeth_send_startlan(card);
-       if (rc) {
-               QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
-               if (rc == 0xe080) {
-                       dev_warn(&card->gdev->dev,
-                               "The LAN is offline\n");
-                       card->lan_online = 0;
-                       goto contin;
-               }
-               rc = -ENODEV;
-               goto out_remove;
-       } else
-               card->lan_online = 1;
-
-contin:
        if ((card->info.type == QETH_CARD_TYPE_OSD) ||
            (card->info.type == QETH_CARD_TYPE_OSX)) {
                rc = qeth_l2_start_ipassists(card);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 171be5ec2ece..03a2619166ca 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3230,21 +3230,6 @@ static int __qeth_l3_set_online(struct ccwgroup_device 
*gdev, int recovery_mode)
        /* softsetup */
        QETH_DBF_TEXT(SETUP, 2, "softsetp");
 
-       rc = qeth_send_startlan(card);
-       if (rc) {
-               QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
-               if (rc == 0xe080) {
-                       dev_warn(&card->gdev->dev,
-                               "The LAN is offline\n");
-                       card->lan_online = 0;
-                       goto contin;
-               }
-               rc = -ENODEV;
-               goto out_remove;
-       } else
-               card->lan_online = 1;
-
-contin:
        rc = qeth_l3_setadapter_parms(card);
        if (rc)
                QETH_DBF_TEXT_(SETUP, 2, "2err%04x", rc);
diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
index 0e00a5ce0f00..cffe42f5775d 100644
--- a/drivers/s390/net/qeth_l3_sys.c
+++ b/drivers/s390/net/qeth_l3_sys.c
@@ -692,15 +692,15 @@ static ssize_t qeth_l3_dev_vipa_add_show(char *buf, 
struct qeth_card *card,
                        enum qeth_prot_versions proto)
 {
        struct qeth_ipaddr *ipaddr;
-       struct hlist_node  *tmp;
        char addr_str[40];
+       int str_len = 0;
        int entry_len; /* length of 1 entry string, differs between v4 and v6 */
-       int i = 0;
+       int i;
 
        entry_len = (proto == QETH_PROT_IPV4)? 12 : 40;
        entry_len += 2; /* \n + terminator */
        spin_lock_bh(&card->ip_lock);
-       hash_for_each_safe(card->ip_htable, i, tmp, ipaddr, hnode) {
+       hash_for_each(card->ip_htable, i, ipaddr, hnode) {
                if (ipaddr->proto != proto)
                        continue;
                if (ipaddr->type != QETH_IP_TYPE_VIPA)
@@ -708,16 +708,17 @@ static ssize_t qeth_l3_dev_vipa_add_show(char *buf, 
struct qeth_card *card,
                /* String must not be longer than PAGE_SIZE. So we check if
                 * string length gets near PAGE_SIZE. Then we can savely display
                 * the next IPv6 address (worst case, compared to IPv4) */
-               if ((PAGE_SIZE - i) <= entry_len)
+               if ((PAGE_SIZE - str_len) <= entry_len)
                        break;
                qeth_l3_ipaddr_to_string(proto, (const u8 *)&ipaddr->u,
                        addr_str);
-               i += snprintf(buf + i, PAGE_SIZE - i, "%s\n", addr_str);
+               str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "%s\n",
+                                   addr_str);
        }
        spin_unlock_bh(&card->ip_lock);
-       i += snprintf(buf + i, PAGE_SIZE - i, "\n");
+       str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "\n");
 
-       return i;
+       return str_len;
 }
 
 static ssize_t qeth_l3_dev_vipa_add4_show(struct device *dev,
@@ -854,15 +855,15 @@ static ssize_t qeth_l3_dev_rxip_add_show(char *buf, 
struct qeth_card *card,
                       enum qeth_prot_versions proto)
 {
        struct qeth_ipaddr *ipaddr;
-       struct hlist_node *tmp;
        char addr_str[40];
+       int str_len = 0;
        int entry_len; /* length of 1 entry string, differs between v4 and v6 */
-       int i = 0;
+       int i;
 
        entry_len = (proto == QETH_PROT_IPV4)? 12 : 40;
        entry_len += 2; /* \n + terminator */
        spin_lock_bh(&card->ip_lock);
-       hash_for_each_safe(card->ip_htable, i, tmp, ipaddr, hnode) {
+       hash_for_each(card->ip_htable, i, ipaddr, hnode) {
                if (ipaddr->proto != proto)
                        continue;
                if (ipaddr->type != QETH_IP_TYPE_RXIP)
@@ -870,16 +871,17 @@ static ssize_t qeth_l3_dev_rxip_add_show(char *buf, 
struct qeth_card *card,
                /* String must not be longer than PAGE_SIZE. So we check if
                 * string length gets near PAGE_SIZE. Then we can savely display
                 * the next IPv6 address (worst case, compared to IPv4) */
-               if ((PAGE_SIZE - i) <= entry_len)
+               if ((PAGE_SIZE - str_len) <= entry_len)
                        break;
                qeth_l3_ipaddr_to_string(proto, (const u8 *)&ipaddr->u,
                        addr_str);
-               i += snprintf(buf + i, PAGE_SIZE - i, "%s\n", addr_str);
+               str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "%s\n",
+                                   addr_str);
        }
        spin_unlock_bh(&card->ip_lock);
-       i += snprintf(buf + i, PAGE_SIZE - i, "\n");
+       str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "\n");
 
-       return i;
+       return str_len;
 }
 
 static ssize_t qeth_l3_dev_rxip_add4_show(struct device *dev,
diff --git a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c 
b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
index 38dca69a06eb..ce500a509aa2 100644
--- a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
+++ b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
@@ -260,7 +260,7 @@ static int iio_bfin_tmr_trigger_probe(struct 
platform_device *pdev)
 out1:
        iio_trigger_unregister(st->trig);
 out:
-       iio_trigger_put(st->trig);
+       iio_trigger_free(st->trig);
        return ret;
 }
 
@@ -273,7 +273,7 @@ static int iio_bfin_tmr_trigger_remove(struct 
platform_device *pdev)
                peripheral_free(st->t->pin);
        free_irq(st->irq, st);
        iio_trigger_unregister(st->trig);
-       iio_trigger_put(st->trig);
+       iio_trigger_free(st->trig);
 
        return 0;
 }
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 7e97a1ccab23..15eaea53b3df 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -193,18 +193,17 @@ static const struct plat_sci_reg 
sci_regmap[SCIx_NR_REGTYPES][SCIx_NR_REGS] = {
        },
 
        /*
-        * Common definitions for legacy IrDA ports, dependent on
-        * regshift value.
+        * Common definitions for legacy IrDA ports.
         */
        [SCIx_IRDA_REGTYPE] = {
                [SCSMR]         = { 0x00,  8 },
-               [SCBRR]         = { 0x01,  8 },
-               [SCSCR]         = { 0x02,  8 },
-               [SCxTDR]        = { 0x03,  8 },
-               [SCxSR]         = { 0x04,  8 },
-               [SCxRDR]        = { 0x05,  8 },
-               [SCFCR]         = { 0x06,  8 },
-               [SCFDR]         = { 0x07, 16 },
+               [SCBRR]         = { 0x02,  8 },
+               [SCSCR]         = { 0x04,  8 },
+               [SCxTDR]        = { 0x06,  8 },
+               [SCxSR]         = { 0x08, 16 },
+               [SCxRDR]        = { 0x0a,  8 },
+               [SCFCR]         = { 0x0c,  8 },
+               [SCFDR]         = { 0x0e, 16 },
                [SCTFDR]        = sci_reg_invalid,
                [SCRFDR]        = sci_reg_invalid,
                [SCSPTR]        = sci_reg_invalid,
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 882fc4e08284..fcc7aa248ce7 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -3023,6 +3023,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)
        }
 
        usb_put_invalidate_rhdev(hcd);
+       hcd->flags = 0;
 }
 EXPORT_SYMBOL_GPL(usb_remove_hcd);
 
diff --git a/drivers/video/fbdev/pmag-ba-fb.c b/drivers/video/fbdev/pmag-ba-fb.c
index 5872bc4af3ce..df02fb4b7fd1 100644
--- a/drivers/video/fbdev/pmag-ba-fb.c
+++ b/drivers/video/fbdev/pmag-ba-fb.c
@@ -129,7 +129,7 @@ static struct fb_ops pmagbafb_ops = {
 /*
  * Turn the hardware cursor off.
  */
-static void __init pmagbafb_erase_cursor(struct fb_info *info)
+static void pmagbafb_erase_cursor(struct fb_info *info)
 {
        struct pmagbafb_par *par = info->par;
 
diff --git a/include/dt-bindings/clock/exynos5433.h 
b/include/dt-bindings/clock/exynos5433.h
index 4fa6bb2136e3..be39d23e6a32 100644
--- a/include/dt-bindings/clock/exynos5433.h
+++ b/include/dt-bindings/clock/exynos5433.h
@@ -771,7 +771,10 @@
 
 #define CLK_PCLK_DECON                                 113
 
-#define DISP_NR_CLK                                    114
+#define CLK_PHYCLK_MIPIDPHY0_BITCLKDIV8_PHY            114
+#define CLK_PHYCLK_MIPIDPHY0_RXCLKESC0_PHY             115
+
+#define DISP_NR_CLK                                    116
 
 /* CMU_AUD */
 #define CLK_MOUT_AUD_PLL_USER                          1
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 8431c8c0c320..a04d69ab7c34 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -142,11 +142,7 @@ static inline const char *phy_modes(phy_interface_t 
interface)
 /* Used when trying to connect to a specific phy (mii bus id:phy device id) */
 #define PHY_ID_FMT "%s:%02x"
 
-/*
- * Need to be a little smaller than phydev->dev.bus_id to leave room
- * for the ":%02x"
- */
-#define MII_BUS_ID_SIZE        (20 - 3)
+#define MII_BUS_ID_SIZE        61
 
 /* Or MII_ADDR_C45 into regnum for read/write on mii_bus to enable the 21 bit
    IEEE 802.3ae clause 45 addressing mode used by 10GIGE phy chips. */
@@ -602,7 +598,7 @@ struct phy_driver {
 /* A Structure for boards to register fixups with the PHY Lib */
 struct phy_fixup {
        struct list_head list;
-       char bus_id[20];
+       char bus_id[MII_BUS_ID_SIZE + 3];
        u32 phy_uid;
        u32 phy_uid_mask;
        int (*run)(struct phy_device *phydev);
diff --git a/include/linux/preempt.h b/include/linux/preempt.h
index 75e4e30677f1..7eeceac52dea 100644
--- a/include/linux/preempt.h
+++ b/include/linux/preempt.h
@@ -65,19 +65,24 @@
 
 /*
  * Are we doing bottom half or hardware interrupt processing?
- * Are we in a softirq context? Interrupt context?
- * in_softirq - Are we currently processing softirq or have bh disabled?
- * in_serving_softirq - Are we currently processing softirq?
+ *
+ * in_irq()       - We're in (hard) IRQ context
+ * in_softirq()   - We have BH disabled, or are processing softirqs
+ * in_interrupt() - We're in NMI,IRQ,SoftIRQ context or have BH disabled
+ * in_serving_softirq() - We're in softirq context
+ * in_nmi()       - We're in NMI context
+ * in_task()     - We're in task context
+ *
+ * Note: due to the BH disabled confusion: in_softirq(),in_interrupt() really
+ *       should not be used in new code.
  */
 #define in_irq()               (hardirq_count())
 #define in_softirq()           (softirq_count())
 #define in_interrupt()         (irq_count())
 #define in_serving_softirq()   (softirq_count() & SOFTIRQ_OFFSET)
-
-/*
- * Are we in NMI context?
- */
-#define in_nmi()       (preempt_count() & NMI_MASK)
+#define in_nmi()               (preempt_count() & NMI_MASK)
+#define in_task()              (!(preempt_count() & \
+                                  (NMI_MASK | HARDIRQ_MASK | SOFTIRQ_OFFSET)))
 
 /*
  * The preempt_count offset after preempt_disable();
diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
index 00d232406f18..b0fad110817b 100644
--- a/include/linux/usb/cdc_ncm.h
+++ b/include/linux/usb/cdc_ncm.h
@@ -83,6 +83,7 @@
 /* Driver flags */
 #define CDC_NCM_FLAG_NDP_TO_END                        0x02    /* NDP is 
placed at end of frame */
 #define CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE  0x04    /* Avoid altsetting 
toggle during init */
+#define CDC_NCM_FLAG_RESET_NTB16 0x08  /* set NDP16 one more time after 
altsetting switch */
 
 #define cdc_ncm_comm_intf_is_mbim(x)  ((x)->desc.bInterfaceSubClass == 
USB_CDC_SUBCLASS_MBIM && \
                                       (x)->desc.bInterfaceProtocol == 
USB_CDC_PROTO_NONE)
diff --git a/include/sound/seq_kernel.h b/include/sound/seq_kernel.h
index feb58d455560..4b9ee3009aa0 100644
--- a/include/sound/seq_kernel.h
+++ b/include/sound/seq_kernel.h
@@ -49,7 +49,8 @@ typedef union snd_seq_timestamp snd_seq_timestamp_t;
 #define SNDRV_SEQ_DEFAULT_CLIENT_EVENTS        200
 
 /* max delivery path length */
-#define SNDRV_SEQ_MAX_HOPS             10
+/* NOTE: this shouldn't be greater than MAX_LOCKDEP_SUBCLASSES */
+#define SNDRV_SEQ_MAX_HOPS             8
 
 /* max size of event size */
 #define SNDRV_SEQ_MAX_EVENT_LEN                0x3fffffff
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 02e7ad860b52..78181c03d9c7 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -7961,6 +7961,7 @@ void sched_move_task(struct task_struct *tsk)
        struct rq *rq;
 
        rq = task_rq_lock(tsk, &rf);
+       update_rq_clock(rq);
 
        running = task_current(rq, tsk);
        queued = task_on_rq_queued(tsk);
diff --git a/kernel/workqueue_internal.h b/kernel/workqueue_internal.h
index 8635417c587b..29fa81f0f51a 100644
--- a/kernel/workqueue_internal.h
+++ b/kernel/workqueue_internal.h
@@ -9,6 +9,7 @@
 
 #include <linux/workqueue.h>
 #include <linux/kthread.h>
+#include <linux/preempt.h>
 
 struct worker_pool;
 
@@ -59,7 +60,7 @@ struct worker {
  */
 static inline struct worker *current_wq_worker(void)
 {
-       if (current->flags & PF_WQ_WORKER)
+       if (in_task() && (current->flags & PF_WQ_WORKER))
                return kthread_data(current);
        return NULL;
 }
diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c
index fef5d2e114be..1ef0cec38d78 100644
--- a/lib/asn1_decoder.c
+++ b/lib/asn1_decoder.c
@@ -228,7 +228,7 @@ int asn1_ber_decoder(const struct asn1_decoder *decoder,
                hdr = 2;
 
                /* Extract a tag from the data */
-               if (unlikely(dp >= datalen - 1))
+               if (unlikely(datalen - dp < 2))
                        goto data_overrun_error;
                tag = data[dp++];
                if (unlikely((tag & 0x1f) == ASN1_LONG_TAG))
@@ -274,7 +274,7 @@ int asn1_ber_decoder(const struct asn1_decoder *decoder,
                                int n = len - 0x80;
                                if (unlikely(n > 2))
                                        goto length_too_long;
-                               if (unlikely(dp >= datalen - n))
+                               if (unlikely(n > datalen - dp))
                                        goto data_overrun_error;
                                hdr += n;
                                for (len = 0; n > 0; n--) {
diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig
index 96e47c539bee..39bb5b3a82f2 100644
--- a/net/dsa/Kconfig
+++ b/net/dsa/Kconfig
@@ -1,12 +1,13 @@
 config HAVE_NET_DSA
        def_bool y
-       depends on NETDEVICES && !S390
+       depends on INET && NETDEVICES && !S390
 
 # Drivers must select NET_DSA and the appropriate tagging format
 
 config NET_DSA
        tristate "Distributed Switch Architecture"
-       depends on HAVE_NET_DSA && NET_SWITCHDEV
+       depends on HAVE_NET_DSA
+       select NET_SWITCHDEV
        select PHYLIB
        ---help---
          Say Y if you want to enable support for the hardware switches 
supported
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index f2a71025a770..22377c8ff14b 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -270,6 +270,9 @@ static void ah_input_done(struct crypto_async_request 
*base, int err)
        int ihl = ip_hdrlen(skb);
        int ah_hlen = (ah->hdrlen + 2) << 2;
 
+       if (err)
+               goto out;
+
        work_iph = AH_SKB_CB(skb)->tmp;
        auth_data = ah_tmp_auth(work_iph, ihl);
        icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 6c1e0246706e..7c3395513ff0 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -159,8 +159,34 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                        else
                                *dest = PACKET_BROADCAST;
                        break;
+               case NFPROTO_NETDEV:
+                       switch (skb->protocol) {
+                       case htons(ETH_P_IP): {
+                               int noff = skb_network_offset(skb);
+                               struct iphdr *iph, _iph;
+
+                               iph = skb_header_pointer(skb, noff,
+                                                        sizeof(_iph), &_iph);
+                               if (!iph)
+                                       goto err;
+
+                               if (ipv4_is_multicast(iph->daddr))
+                                       *dest = PACKET_MULTICAST;
+                               else
+                                       *dest = PACKET_BROADCAST;
+
+                               break;
+                       }
+                       case htons(ETH_P_IPV6):
+                               *dest = PACKET_MULTICAST;
+                               break;
+                       default:
+                               WARN_ON_ONCE(1);
+                               goto err;
+                       }
+                       break;
                default:
-                       WARN_ON(1);
+                       WARN_ON_ONCE(1);
                        goto err;
                }
                break;
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 41b8cb115801..7d3a98b2d55a 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -671,9 +671,9 @@ enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE;
 module_param_call(mode, param_set_mode, param_get_mode,
                  &aa_g_profile_mode, S_IRUSR | S_IWUSR);
 
-#ifdef CONFIG_SECURITY_APPARMOR_HASH
 /* whether policy verification hashing is enabled */
 bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT);
+#ifdef CONFIG_SECURITY_APPARMOR_HASH
 module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR);
 #endif
 
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index f4db42e669e9..4ba2f6b91242 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -70,7 +70,7 @@ static int TSS_sha1(const unsigned char *data, unsigned int 
datalen,
        }
 
        ret = crypto_shash_digest(&sdesc->shash, data, datalen, digest);
-       kfree(sdesc);
+       kzfree(sdesc);
        return ret;
 }
 
@@ -114,7 +114,7 @@ static int TSS_rawhmac(unsigned char *digest, const 
unsigned char *key,
        if (!ret)
                ret = crypto_shash_final(&sdesc->shash, digest);
 out:
-       kfree(sdesc);
+       kzfree(sdesc);
        return ret;
 }
 
@@ -165,7 +165,7 @@ static int TSS_authhmac(unsigned char *digest, const 
unsigned char *key,
                                  paramdigest, TPM_NONCE_SIZE, h1,
                                  TPM_NONCE_SIZE, h2, 1, &c, 0, 0);
 out:
-       kfree(sdesc);
+       kzfree(sdesc);
        return ret;
 }
 
@@ -246,7 +246,7 @@ static int TSS_checkhmac1(unsigned char *buffer,
        if (memcmp(testhmac, authdata, SHA1_DIGEST_SIZE))
                ret = -EINVAL;
 out:
-       kfree(sdesc);
+       kzfree(sdesc);
        return ret;
 }
 
@@ -347,7 +347,7 @@ static int TSS_checkhmac2(unsigned char *buffer,
        if (memcmp(testhmac2, authdata2, SHA1_DIGEST_SIZE))
                ret = -EINVAL;
 out:
-       kfree(sdesc);
+       kzfree(sdesc);
        return ret;
 }
 
@@ -564,7 +564,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
                *bloblen = storedsize;
        }
 out:
-       kfree(td);
+       kzfree(td);
        return ret;
 }
 
@@ -678,7 +678,7 @@ static int key_seal(struct trusted_key_payload *p,
        if (ret < 0)
                pr_info("trusted_key: srkseal failed (%d)\n", ret);
 
-       kfree(tb);
+       kzfree(tb);
        return ret;
 }
 
@@ -703,7 +703,7 @@ static int key_unseal(struct trusted_key_payload *p,
                /* pull migratable flag out of sealed key */
                p->migratable = p->key[--p->key_len];
 
-       kfree(tb);
+       kzfree(tb);
        return ret;
 }
 
@@ -1037,12 +1037,12 @@ static int trusted_instantiate(struct key *key,
        if (!ret && options->pcrlock)
                ret = pcrlock(options->pcrlock);
 out:
-       kfree(datablob);
-       kfree(options);
+       kzfree(datablob);
+       kzfree(options);
        if (!ret)
                rcu_assign_keypointer(key, payload);
        else
-               kfree(payload);
+               kzfree(payload);
        return ret;
 }
 
@@ -1051,8 +1051,7 @@ static void trusted_rcu_free(struct rcu_head *rcu)
        struct trusted_key_payload *p;
 
        p = container_of(rcu, struct trusted_key_payload, rcu);
-       memset(p->key, 0, p->key_len);
-       kfree(p);
+       kzfree(p);
 }
 
 /*
@@ -1094,13 +1093,13 @@ static int trusted_update(struct key *key, struct 
key_preparsed_payload *prep)
        ret = datablob_parse(datablob, new_p, new_o);
        if (ret != Opt_update) {
                ret = -EINVAL;
-               kfree(new_p);
+               kzfree(new_p);
                goto out;
        }
 
        if (!new_o->keyhandle) {
                ret = -EINVAL;
-               kfree(new_p);
+               kzfree(new_p);
                goto out;
        }
 
@@ -1114,22 +1113,22 @@ static int trusted_update(struct key *key, struct 
key_preparsed_payload *prep)
        ret = key_seal(new_p, new_o);
        if (ret < 0) {
                pr_info("trusted_key: key_seal failed (%d)\n", ret);
-               kfree(new_p);
+               kzfree(new_p);
                goto out;
        }
        if (new_o->pcrlock) {
                ret = pcrlock(new_o->pcrlock);
                if (ret < 0) {
                        pr_info("trusted_key: pcrlock failed (%d)\n", ret);
-                       kfree(new_p);
+                       kzfree(new_p);
                        goto out;
                }
        }
        rcu_assign_keypointer(key, new_p);
        call_rcu(&p->rcu, trusted_rcu_free);
 out:
-       kfree(datablob);
-       kfree(new_o);
+       kzfree(datablob);
+       kzfree(new_o);
        return ret;
 }
 
@@ -1148,34 +1147,30 @@ static long trusted_read(const struct key *key, char 
__user *buffer,
        p = rcu_dereference_key(key);
        if (!p)
                return -EINVAL;
-       if (!buffer || buflen <= 0)
-               return 2 * p->blob_len;
-       ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL);
-       if (!ascii_buf)
-               return -ENOMEM;
 
-       bufp = ascii_buf;
-       for (i = 0; i < p->blob_len; i++)
-               bufp = hex_byte_pack(bufp, p->blob[i]);
-       if ((copy_to_user(buffer, ascii_buf, 2 * p->blob_len)) != 0) {
-               kfree(ascii_buf);
-               return -EFAULT;
+       if (buffer && buflen >= 2 * p->blob_len) {
+               ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL);
+               if (!ascii_buf)
+                       return -ENOMEM;
+
+               bufp = ascii_buf;
+               for (i = 0; i < p->blob_len; i++)
+                       bufp = hex_byte_pack(bufp, p->blob[i]);
+               if (copy_to_user(buffer, ascii_buf, 2 * p->blob_len) != 0) {
+                       kzfree(ascii_buf);
+                       return -EFAULT;
+               }
+               kzfree(ascii_buf);
        }
-       kfree(ascii_buf);
        return 2 * p->blob_len;
 }
 
 /*
- * trusted_destroy - before freeing the key, clear the decrypted data
+ * trusted_destroy - clear and free the key's payload
  */
 static void trusted_destroy(struct key *key)
 {
-       struct trusted_key_payload *p = key->payload.data[0];
-
-       if (!p)
-               return;
-       memset(p->key, 0, p->key_len);
-       kfree(key->payload.data[0]);
+       kzfree(key->payload.data[0]);
 }
 
 struct key_type key_type_trusted = {
diff --git a/sound/core/seq/oss/seq_oss_midi.c 
b/sound/core/seq/oss/seq_oss_midi.c
index aaff9ee32695..b30b2139e3f0 100644
--- a/sound/core/seq/oss/seq_oss_midi.c
+++ b/sound/core/seq/oss/seq_oss_midi.c
@@ -612,9 +612,7 @@ send_midi_event(struct seq_oss_devinfo *dp, struct 
snd_seq_event *ev, struct seq
        if (!dp->timer->running)
                len = snd_seq_oss_timer_start(dp->timer);
        if (ev->type == SNDRV_SEQ_EVENT_SYSEX) {
-               if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) == 
SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
-                       snd_seq_oss_readq_puts(dp->readq, mdev->seq_device,
-                                              ev->data.ext.ptr, 
ev->data.ext.len);
+               snd_seq_oss_readq_sysex(dp->readq, mdev->seq_device, ev);
        } else {
                len = snd_midi_event_decode(mdev->coder, msg, sizeof(msg), ev);
                if (len > 0)
diff --git a/sound/core/seq/oss/seq_oss_readq.c 
b/sound/core/seq/oss/seq_oss_readq.c
index 046cb586fb2f..06b21226b4e7 100644
--- a/sound/core/seq/oss/seq_oss_readq.c
+++ b/sound/core/seq/oss/seq_oss_readq.c
@@ -117,6 +117,35 @@ snd_seq_oss_readq_puts(struct seq_oss_readq *q, int dev, 
unsigned char *data, in
        return 0;
 }
 
+/*
+ * put MIDI sysex bytes; the event buffer may be chained, thus it has
+ * to be expanded via snd_seq_dump_var_event().
+ */
+struct readq_sysex_ctx {
+       struct seq_oss_readq *readq;
+       int dev;
+};
+
+static int readq_dump_sysex(void *ptr, void *buf, int count)
+{
+       struct readq_sysex_ctx *ctx = ptr;
+
+       return snd_seq_oss_readq_puts(ctx->readq, ctx->dev, buf, count);
+}
+
+int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev,
+                           struct snd_seq_event *ev)
+{
+       struct readq_sysex_ctx ctx = {
+               .readq = q,
+               .dev = dev
+       };
+
+       if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != 
SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
+               return 0;
+       return snd_seq_dump_var_event(ev, readq_dump_sysex, &ctx);
+}
+
 /*
  * copy an event to input queue:
  * return zero if enqueued
diff --git a/sound/core/seq/oss/seq_oss_readq.h 
b/sound/core/seq/oss/seq_oss_readq.h
index f1463f1f449e..8d033ca2d23f 100644
--- a/sound/core/seq/oss/seq_oss_readq.h
+++ b/sound/core/seq/oss/seq_oss_readq.h
@@ -44,6 +44,8 @@ void snd_seq_oss_readq_delete(struct seq_oss_readq *q);
 void snd_seq_oss_readq_clear(struct seq_oss_readq *readq);
 unsigned int snd_seq_oss_readq_poll(struct seq_oss_readq *readq, struct file 
*file, poll_table *wait);
 int snd_seq_oss_readq_puts(struct seq_oss_readq *readq, int dev, unsigned char 
*data, int len);
+int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev,
+                           struct snd_seq_event *ev);
 int snd_seq_oss_readq_put_event(struct seq_oss_readq *readq, union evrec *ev);
 int snd_seq_oss_readq_put_timestamp(struct seq_oss_readq *readq, unsigned long 
curt, int seq_mode);
 int snd_seq_oss_readq_pick(struct seq_oss_readq *q, union evrec *rec);
diff --git a/sound/soc/sunxi/sun4i-spdif.c b/sound/soc/sunxi/sun4i-spdif.c
index 88fbb3a1e660..048de15d6937 100644
--- a/sound/soc/sunxi/sun4i-spdif.c
+++ b/sound/soc/sunxi/sun4i-spdif.c
@@ -403,14 +403,6 @@ static struct snd_soc_dai_driver sun4i_spdif_dai = {
        .name = "spdif",
 };
 
-static const struct snd_soc_dapm_widget dit_widgets[] = {
-       SND_SOC_DAPM_OUTPUT("spdif-out"),
-};
-
-static const struct snd_soc_dapm_route dit_routes[] = {
-       { "spdif-out", NULL, "Playback" },
-};
-
 static const struct of_device_id sun4i_spdif_of_match[] = {
        { .compatible = "allwinner,sun4i-a10-spdif", },
        { .compatible = "allwinner,sun6i-a31-spdif", },
diff --git a/tools/testing/selftests/firmware/fw_filesystem.sh 
b/tools/testing/selftests/firmware/fw_filesystem.sh
index 5c495ad7958a..d8ac9ba67688 100755
--- a/tools/testing/selftests/firmware/fw_filesystem.sh
+++ b/tools/testing/selftests/firmware/fw_filesystem.sh
@@ -48,18 +48,18 @@ echo "ABCD0123" >"$FW"
 
 NAME=$(basename "$FW")
 
-if printf '\000' >"$DIR"/trigger_request; then
+if printf '\000' >"$DIR"/trigger_request 2> /dev/null; then
        echo "$0: empty filename should not succeed" >&2
        exit 1
 fi
 
-if printf '\000' >"$DIR"/trigger_async_request; then
+if printf '\000' >"$DIR"/trigger_async_request 2> /dev/null; then
        echo "$0: empty filename should not succeed (async)" >&2
        exit 1
 fi
 
 # Request a firmware that doesn't exist, it should fail.
-if echo -n "nope-$NAME" >"$DIR"/trigger_request; then
+if echo -n "nope-$NAME" >"$DIR"/trigger_request 2> /dev/null; then
        echo "$0: firmware shouldn't have loaded" >&2
        exit 1
 fi
diff --git a/tools/testing/selftests/firmware/fw_userhelper.sh 
b/tools/testing/selftests/firmware/fw_userhelper.sh
index b9983f8e09f6..01c626a1f226 100755
--- a/tools/testing/selftests/firmware/fw_userhelper.sh
+++ b/tools/testing/selftests/firmware/fw_userhelper.sh
@@ -64,9 +64,33 @@ trap "test_finish" EXIT
 echo "ABCD0123" >"$FW"
 NAME=$(basename "$FW")
 
+DEVPATH="$DIR"/"nope-$NAME"/loading
+
 # Test failure when doing nothing (timeout works).
-echo 1 >/sys/class/firmware/timeout
-echo -n "$NAME" >"$DIR"/trigger_request
+echo -n 2 >/sys/class/firmware/timeout
+echo -n "nope-$NAME" >"$DIR"/trigger_request 2>/dev/null &
+
+# Give the kernel some time to load the loading file, must be less
+# than the timeout above.
+sleep 1
+if [ ! -f $DEVPATH ]; then
+       echo "$0: fallback mechanism immediately cancelled"
+       echo ""
+       echo "The file never appeared: $DEVPATH"
+       echo ""
+       echo "This might be a distribution udev rule setup by your distribution"
+       echo "to immediately cancel all fallback requests, this must be"
+       echo "removed before running these tests. To confirm look for"
+       echo "a firmware rule like /lib/udev/rules.d/50-firmware.rules"
+       echo "and see if you have something like this:"
+       echo ""
+       echo "SUBSYSTEM==\"firmware\", ACTION==\"add\", ATTR{loading}=\"-1\""
+       echo ""
+       echo "If you do remove this file or comment out this line before"
+       echo "proceeding with these tests."
+       exit 1
+fi
+
 if diff -q "$FW" /dev/test_firmware >/dev/null ; then
        echo "$0: firmware was not expected to match" >&2
        exit 1

Reply via email to