diff --git a/Documentation/arm/kernel_mode_neon.txt 
b/Documentation/arm/kernel_mode_neon.txt
index 525452726d31..b9e060c5b61e 100644
--- a/Documentation/arm/kernel_mode_neon.txt
+++ b/Documentation/arm/kernel_mode_neon.txt
@@ -6,7 +6,7 @@ TL;DR summary
 * Use only NEON instructions, or VFP instructions that don't rely on support
   code
 * Isolate your NEON code in a separate compilation unit, and compile it with
-  '-mfpu=neon -mfloat-abi=softfp'
+  '-march=armv7-a -mfpu=neon -mfloat-abi=softfp'
 * Put kernel_neon_begin() and kernel_neon_end() calls around the calls into 
your
   NEON code
 * Don't sleep in your NEON code, and be aware that it will be executed with
@@ -87,7 +87,7 @@ instructions appearing in unexpected places if no special 
care is taken.
 Therefore, the recommended and only supported way of using NEON/VFP in the
 kernel is by adhering to the following rules:
 * isolate the NEON code in a separate compilation unit and compile it with
-  '-mfpu=neon -mfloat-abi=softfp';
+  '-march=armv7-a -mfpu=neon -mfloat-abi=softfp';
 * issue the calls to kernel_neon_begin(), kernel_neon_end() as well as the 
calls
   into the unit containing the NEON code from a compilation unit which is *not*
   built with the GCC flag '-mfpu=neon' set.
diff --git a/Makefile b/Makefile
index 37bd0b40876d..da223c660c9a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 14
-SUBLEVEL = 110
+SUBLEVEL = 111
 EXTRAVERSION =
 NAME = Petit Gorille
 
diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
index d81fe433e3c8..f22a33a01819 100644
--- a/arch/arm/boot/dts/lpc32xx.dtsi
+++ b/arch/arm/boot/dts/lpc32xx.dtsi
@@ -230,7 +230,7 @@
                                status = "disabled";
                        };
 
-                       i2s1: i2s@2009C000 {
+                       i2s1: i2s@2009c000 {
                                compatible = "nxp,lpc3220-i2s";
                                reg = <0x2009C000 0x1000>;
                        };
@@ -273,7 +273,7 @@
                                status = "disabled";
                        };
 
-                       i2c1: i2c@400A0000 {
+                       i2c1: i2c@400a0000 {
                                compatible = "nxp,pnx-i2c";
                                reg = <0x400A0000 0x100>;
                                interrupt-parent = <&sic1>;
@@ -284,7 +284,7 @@
                                clocks = <&clk LPC32XX_CLK_I2C1>;
                        };
 
-                       i2c2: i2c@400A8000 {
+                       i2c2: i2c@400a8000 {
                                compatible = "nxp,pnx-i2c";
                                reg = <0x400A8000 0x100>;
                                interrupt-parent = <&sic1>;
@@ -295,7 +295,7 @@
                                clocks = <&clk LPC32XX_CLK_I2C2>;
                        };
 
-                       mpwm: mpwm@400E8000 {
+                       mpwm: mpwm@400e8000 {
                                compatible = "nxp,lpc3220-motor-pwm";
                                reg = <0x400E8000 0x78>;
                                status = "disabled";
@@ -394,7 +394,7 @@
                                #gpio-cells = <3>; /* bank, pin, flags */
                        };
 
-                       timer4: timer@4002C000 {
+                       timer4: timer@4002c000 {
                                compatible = "nxp,lpc3220-timer";
                                reg = <0x4002C000 0x1000>;
                                interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
@@ -412,7 +412,7 @@
                                status = "disabled";
                        };
 
-                       watchdog: watchdog@4003C000 {
+                       watchdog: watchdog@4003c000 {
                                compatible = "nxp,pnx4008-wdt";
                                reg = <0x4003C000 0x1000>;
                                clocks = <&clk LPC32XX_CLK_WDOG>;
@@ -451,7 +451,7 @@
                                status = "disabled";
                        };
 
-                       timer1: timer@4004C000 {
+                       timer1: timer@4004c000 {
                                compatible = "nxp,lpc3220-timer";
                                reg = <0x4004C000 0x1000>;
                                interrupts = <17 IRQ_TYPE_LEVEL_LOW>;
@@ -475,7 +475,7 @@
                                status = "disabled";
                        };
 
-                       pwm1: pwm@4005C000 {
+                       pwm1: pwm@4005c000 {
                                compatible = "nxp,lpc3220-pwm";
                                reg = <0x4005C000 0x4>;
                                clocks = <&clk LPC32XX_CLK_PWM1>;
@@ -484,7 +484,7 @@
                                status = "disabled";
                        };
 
-                       pwm2: pwm@4005C004 {
+                       pwm2: pwm@4005c004 {
                                compatible = "nxp,lpc3220-pwm";
                                reg = <0x4005C004 0x4>;
                                clocks = <&clk LPC32XX_CLK_PWM2>;
diff --git a/arch/arm/include/asm/barrier.h b/arch/arm/include/asm/barrier.h
index 69772e742a0a..83ae97c049d9 100644
--- a/arch/arm/include/asm/barrier.h
+++ b/arch/arm/include/asm/barrier.h
@@ -11,6 +11,8 @@
 #define sev()  __asm__ __volatile__ ("sev" : : : "memory")
 #define wfe()  __asm__ __volatile__ ("wfe" : : : "memory")
 #define wfi()  __asm__ __volatile__ ("wfi" : : : "memory")
+#else
+#define wfe()  do { } while (0)
 #endif
 
 #if __LINUX_ARM_ARCH__ >= 7
diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
index c3d5fc124a05..768b6fe7640e 100644
--- a/arch/arm/include/asm/processor.h
+++ b/arch/arm/include/asm/processor.h
@@ -77,7 +77,11 @@ extern void release_thread(struct task_struct *);
 unsigned long get_wchan(struct task_struct *p);
 
 #if __LINUX_ARM_ARCH__ == 6 || defined(CONFIG_ARM_ERRATA_754327)
-#define cpu_relax()                    smp_mb()
+#define cpu_relax()                                            \
+       do {                                                    \
+               smp_mb();                                       \
+               __asm__ __volatile__("nop; nop; nop; nop; nop; nop; nop; nop; 
nop; nop;");      \
+       } while (0)
 #else
 #define cpu_relax()                    barrier()
 #endif
diff --git a/arch/arm/include/asm/v7m.h b/arch/arm/include/asm/v7m.h
index e6d9e29fcae4..6416fd3a3894 100644
--- a/arch/arm/include/asm/v7m.h
+++ b/arch/arm/include/asm/v7m.h
@@ -49,7 +49,7 @@
  * (0 -> msp; 1 -> psp). Bits [1:0] are fixed to 0b01.
  */
 #define EXC_RET_STACK_MASK                     0x00000004
-#define EXC_RET_THREADMODE_PROCESSSTACK                0xfffffffd
+#define EXC_RET_THREADMODE_PROCESSSTACK                (3 << 2)
 
 /* Cache related definitions */
 
diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
index 773424843d6e..62db1c9746cb 100644
--- a/arch/arm/kernel/entry-header.S
+++ b/arch/arm/kernel/entry-header.S
@@ -127,7 +127,8 @@
          */
        .macro  v7m_exception_slow_exit ret_r0
        cpsid   i
-       ldr     lr, =EXC_RET_THREADMODE_PROCESSSTACK
+       ldr     lr, =exc_ret
+       ldr     lr, [lr]
 
        @ read original r12, sp, lr, pc and xPSR
        add     r12, sp, #S_IP
diff --git a/arch/arm/kernel/entry-v7m.S b/arch/arm/kernel/entry-v7m.S
index abcf47848525..19d2dcd6530d 100644
--- a/arch/arm/kernel/entry-v7m.S
+++ b/arch/arm/kernel/entry-v7m.S
@@ -146,3 +146,7 @@ ENTRY(vector_table)
        .rept   CONFIG_CPU_V7M_NUM_IRQ
        .long   __irq_entry             @ External Interrupts
        .endr
+       .align  2
+       .globl  exc_ret
+exc_ret:
+       .space  4
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index c15318431986..6f77f52baf02 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -91,8 +91,11 @@ void machine_crash_nonpanic_core(void *unused)
 
        set_cpu_online(smp_processor_id(), false);
        atomic_dec(&waiting_for_crash_ipi);
-       while (1)
+
+       while (1) {
                cpu_relax();
+               wfe();
+       }
 }
 
 void crash_smp_send_stop(void)
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 65f85737c6a2..844bb2f1ddef 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -602,8 +602,10 @@ static void ipi_cpu_stop(unsigned int cpu)
        local_fiq_disable();
        local_irq_disable();
 
-       while (1)
+       while (1) {
                cpu_relax();
+               wfe();
+       }
 }
 
 static DEFINE_PER_CPU(struct completion *, cpu_completion);
diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c
index 0bee233fef9a..314cfb232a63 100644
--- a/arch/arm/kernel/unwind.c
+++ b/arch/arm/kernel/unwind.c
@@ -93,7 +93,7 @@ extern const struct unwind_idx __start_unwind_idx[];
 static const struct unwind_idx *__origin_unwind_idx;
 extern const struct unwind_idx __stop_unwind_idx[];
 
-static DEFINE_SPINLOCK(unwind_lock);
+static DEFINE_RAW_SPINLOCK(unwind_lock);
 static LIST_HEAD(unwind_tables);
 
 /* Convert a prel31 symbol to an absolute address */
@@ -201,7 +201,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned 
long addr)
                /* module unwind tables */
                struct unwind_table *table;
 
-               spin_lock_irqsave(&unwind_lock, flags);
+               raw_spin_lock_irqsave(&unwind_lock, flags);
                list_for_each_entry(table, &unwind_tables, list) {
                        if (addr >= table->begin_addr &&
                            addr < table->end_addr) {
@@ -213,7 +213,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned 
long addr)
                                break;
                        }
                }
-               spin_unlock_irqrestore(&unwind_lock, flags);
+               raw_spin_unlock_irqrestore(&unwind_lock, flags);
        }
 
        pr_debug("%s: idx = %p\n", __func__, idx);
@@ -529,9 +529,9 @@ struct unwind_table *unwind_table_add(unsigned long start, 
unsigned long size,
        tab->begin_addr = text_addr;
        tab->end_addr = text_addr + text_size;
 
-       spin_lock_irqsave(&unwind_lock, flags);
+       raw_spin_lock_irqsave(&unwind_lock, flags);
        list_add_tail(&tab->list, &unwind_tables);
-       spin_unlock_irqrestore(&unwind_lock, flags);
+       raw_spin_unlock_irqrestore(&unwind_lock, flags);
 
        return tab;
 }
@@ -543,9 +543,9 @@ void unwind_table_del(struct unwind_table *tab)
        if (!tab)
                return;
 
-       spin_lock_irqsave(&unwind_lock, flags);
+       raw_spin_lock_irqsave(&unwind_lock, flags);
        list_del(&tab->list);
-       spin_unlock_irqrestore(&unwind_lock, flags);
+       raw_spin_unlock_irqrestore(&unwind_lock, flags);
 
        kfree(tab);
 }
diff --git a/arch/arm/lib/Makefile b/arch/arm/lib/Makefile
index 4cb0b9624d8f..4cf026f3f00d 100644
--- a/arch/arm/lib/Makefile
+++ b/arch/arm/lib/Makefile
@@ -39,7 +39,7 @@ $(obj)/csumpartialcopy.o:     $(obj)/csumpartialcopygeneric.S
 $(obj)/csumpartialcopyuser.o:  $(obj)/csumpartialcopygeneric.S
 
 ifeq ($(CONFIG_KERNEL_MODE_NEON),y)
-  NEON_FLAGS                   := -mfloat-abi=softfp -mfpu=neon
+  NEON_FLAGS                   := -march=armv7-a -mfloat-abi=softfp -mfpu=neon
   CFLAGS_xor-neon.o            += $(NEON_FLAGS)
   obj-$(CONFIG_XOR_BLOCKS)     += xor-neon.o
 endif
diff --git a/arch/arm/lib/xor-neon.c b/arch/arm/lib/xor-neon.c
index 2c40aeab3eaa..c691b901092f 100644
--- a/arch/arm/lib/xor-neon.c
+++ b/arch/arm/lib/xor-neon.c
@@ -14,7 +14,7 @@
 MODULE_LICENSE("GPL");
 
 #ifndef __ARM_NEON__
-#error You should compile this file with '-mfloat-abi=softfp -mfpu=neon'
+#error You should compile this file with '-march=armv7-a -mfloat-abi=softfp 
-mfpu=neon'
 #endif
 
 /*
diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c
index 09180a59b1c9..2f215facba10 100644
--- a/arch/arm/mach-omap2/prm_common.c
+++ b/arch/arm/mach-omap2/prm_common.c
@@ -528,8 +528,10 @@ void omap_prm_reset_system(void)
 
        prm_ll_data->reset_system();
 
-       while (1)
+       while (1) {
                cpu_relax();
+               wfe();
+       }
 }
 
 /**
diff --git a/arch/arm/mm/proc-v7m.S b/arch/arm/mm/proc-v7m.S
index 47a5acc64433..92e84181933a 100644
--- a/arch/arm/mm/proc-v7m.S
+++ b/arch/arm/mm/proc-v7m.S
@@ -139,6 +139,9 @@ __v7m_setup_cont:
        cpsie   i
        svc     #0
 1:     cpsid   i
+       ldr     r0, =exc_ret
+       orr     lr, lr, #EXC_RET_THREADMODE_PROCESSSTACK
+       str     lr, [r0]
        ldmia   sp, {r0-r3, r12}
        str     r5, [r12, #11 * 4]      @ restore the original SVC vector entry
        mov     lr, r6                  @ restore LR
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 5edb706aacb0..465b90d7abf2 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -834,11 +834,12 @@ void __init hook_debug_fault_code(int nr,
        debug_fault_info[nr].name       = name;
 }
 
-asmlinkage int __exception do_debug_exception(unsigned long addr,
+asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint,
                                              unsigned int esr,
                                              struct pt_regs *regs)
 {
        const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr);
+       unsigned long pc = instruction_pointer(regs);
        struct siginfo info;
        int rv;
 
@@ -849,19 +850,19 @@ asmlinkage int __exception do_debug_exception(unsigned 
long addr,
        if (interrupts_enabled(regs))
                trace_hardirqs_off();
 
-       if (user_mode(regs) && instruction_pointer(regs) > TASK_SIZE)
+       if (user_mode(regs) && pc > TASK_SIZE)
                arm64_apply_bp_hardening();
 
-       if (!inf->fn(addr, esr, regs)) {
+       if (!inf->fn(addr_if_watchpoint, esr, regs)) {
                rv = 1;
        } else {
                pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n",
-                        inf->name, esr, addr);
+                        inf->name, esr, pc);
 
                info.si_signo = inf->sig;
                info.si_errno = 0;
                info.si_code  = inf->code;
-               info.si_addr  = (void __user *)addr;
+               info.si_addr  = (void __user *)pc;
                arm64_notify_die("", regs, &info, 0);
                rv = 0;
        }
diff --git a/arch/h8300/Makefile b/arch/h8300/Makefile
index e1c02ca230cb..073bba6f9f60 100644
--- a/arch/h8300/Makefile
+++ b/arch/h8300/Makefile
@@ -23,7 +23,7 @@ KBUILD_AFLAGS += $(aflags-y)
 LDFLAGS += $(ldflags-y)
 
 ifeq ($(CROSS_COMPILE),)
-CROSS_COMPILE := h8300-unknown-linux-
+CROSS_COMPILE := $(call cc-cross-prefix, h8300-unknown-linux- h8300-linux-)
 endif
 
 core-y += arch/$(ARCH)/kernel/ arch/$(ARCH)/mm/
diff --git a/arch/powerpc/include/asm/topology.h 
b/arch/powerpc/include/asm/topology.h
index 66c72b356ac0..e6b185b4b3b1 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -117,6 +117,8 @@ static inline int prrn_is_enabled(void)
 #define topology_sibling_cpumask(cpu)  (per_cpu(cpu_sibling_map, cpu))
 #define topology_core_cpumask(cpu)     (per_cpu(cpu_core_map, cpu))
 #define topology_core_id(cpu)          (cpu_to_core_id(cpu))
+
+int dlpar_cpu_readd(int cpu);
 #endif
 #endif
 
diff --git a/arch/powerpc/mm/hugetlbpage-radix.c 
b/arch/powerpc/mm/hugetlbpage-radix.c
index bd022d16745c..a31bad29b55d 100644
--- a/arch/powerpc/mm/hugetlbpage-radix.c
+++ b/arch/powerpc/mm/hugetlbpage-radix.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <linux/mm.h>
 #include <linux/hugetlb.h>
+#include <linux/security.h>
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
 #include <asm/cacheflush.h>
@@ -79,7 +80,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned 
long addr,
        if (addr) {
                addr = ALIGN(addr, huge_page_size(h));
                vma = find_vma(mm, addr);
-               if (high_limit - len >= addr &&
+               if (high_limit - len >= addr && addr >= mmap_min_addr &&
                    (!vma || addr + len <= vm_start_gap(vma)))
                        return addr;
        }
@@ -89,7 +90,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned 
long addr,
         */
        info.flags = VM_UNMAPPED_AREA_TOPDOWN;
        info.length = len;
-       info.low_limit = PAGE_SIZE;
+       info.low_limit = max(PAGE_SIZE, mmap_min_addr);
        info.high_limit = mm->mmap_base + (high_limit - DEFAULT_MAP_WINDOW);
        info.align_mask = PAGE_MASK & ~huge_page_mask(h);
        info.align_offset = 0;
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 40fb9a8835fe..0a02c73a27b3 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -1527,13 +1527,6 @@ static void reset_topology_timer(void)
 
 #ifdef CONFIG_SMP
 
-static void stage_topology_update(int core_id)
-{
-       cpumask_or(&cpu_associativity_changes_mask,
-               &cpu_associativity_changes_mask, cpu_sibling_mask(core_id));
-       reset_topology_timer();
-}
-
 static int dt_update_callback(struct notifier_block *nb,
                                unsigned long action, void *data)
 {
@@ -1546,7 +1539,7 @@ static int dt_update_callback(struct notifier_block *nb,
                    !of_prop_cmp(update->prop->name, "ibm,associativity")) {
                        u32 core_id;
                        of_property_read_u32(update->dn, "reg", &core_id);
-                       stage_topology_update(core_id);
+                       rc = dlpar_cpu_readd(core_id);
                        rc = NOTIFY_OK;
                }
                break;
diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c 
b/arch/powerpc/platforms/pseries/hotplug-cpu.c
index b1ac8ac38434..0baaaa6b0929 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
@@ -799,6 +799,25 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
        return rc;
 }
 
+int dlpar_cpu_readd(int cpu)
+{
+       struct device_node *dn;
+       struct device *dev;
+       u32 drc_index;
+       int rc;
+
+       dev = get_cpu_device(cpu);
+       dn = dev->of_node;
+
+       rc = of_property_read_u32(dn, "ibm,my-drc-index", &drc_index);
+
+       rc = dlpar_cpu_remove_by_index(drc_index);
+       if (!rc)
+               rc = dlpar_cpu_add(drc_index);
+
+       return rc;
+}
+
 int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
 {
        u32 count, drc_index;
diff --git a/arch/powerpc/xmon/ppc-dis.c b/arch/powerpc/xmon/ppc-dis.c
index 31db8c072acd..006c7f864f65 100644
--- a/arch/powerpc/xmon/ppc-dis.c
+++ b/arch/powerpc/xmon/ppc-dis.c
@@ -162,7 +162,7 @@ int print_insn_powerpc (unsigned long insn, unsigned long 
memaddr)
     dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7
                | PPC_OPCODE_POWER8 | PPC_OPCODE_POWER9 | PPC_OPCODE_HTM
                | PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2
-               | PPC_OPCODE_VSX | PPC_OPCODE_VSX3),
+               | PPC_OPCODE_VSX | PPC_OPCODE_VSX3);
 
   /* Get the major opcode of the insn.  */
   opcode = NULL;
diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
index d88a2fddba8c..1c060748c813 100644
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -100,7 +100,7 @@ $(obj)/zoffset.h: $(obj)/compressed/vmlinux FORCE
 AFLAGS_header.o += -I$(objtree)/$(obj)
 $(obj)/header.o: $(obj)/zoffset.h
 
-LDFLAGS_setup.elf      := -T
+LDFLAGS_setup.elf      := -m elf_i386 -T
 $(obj)/setup.elf: $(src)/setup.ld $(SETUP_OBJS) FORCE
        $(call if_changed,ld)
 
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index b854ebf5851b..2384a2ae5ec3 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -390,7 +390,7 @@ SECTIONS
  * Per-cpu symbols which need to be offset from __per_cpu_load
  * for the boot processor.
  */
-#define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
+#define INIT_PER_CPU(x) init_per_cpu__##x = ABSOLUTE(x) + __per_cpu_load
 INIT_PER_CPU(gdt_page);
 INIT_PER_CPU(irq_stack_union);
 
diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile
index 4463fa72db94..96cb20de08af 100644
--- a/arch/x86/realmode/rm/Makefile
+++ b/arch/x86/realmode/rm/Makefile
@@ -47,7 +47,7 @@ $(obj)/pasyms.h: $(REALMODE_OBJS) FORCE
 targets += realmode.lds
 $(obj)/realmode.lds: $(obj)/pasyms.h
 
-LDFLAGS_realmode.elf := --emit-relocs -T
+LDFLAGS_realmode.elf := -m elf_i386 --emit-relocs -T
 CPPFLAGS_realmode.lds += -P -C -I$(objtree)/$(obj)
 
 targets += realmode.elf
diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
index dbdd460a9958..e39a1489cc72 100644
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -2123,21 +2123,29 @@ static int __init intel_opregion_present(void)
        return opregion;
 }
 
+/* Check if the chassis-type indicates there is no builtin LCD panel */
 static bool dmi_is_desktop(void)
 {
        const char *chassis_type;
+       unsigned long type;
 
        chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
        if (!chassis_type)
                return false;
 
-       if (!strcmp(chassis_type, "3") || /*  3: Desktop */
-           !strcmp(chassis_type, "4") || /*  4: Low Profile Desktop */
-           !strcmp(chassis_type, "5") || /*  5: Pizza Box */
-           !strcmp(chassis_type, "6") || /*  6: Mini Tower */
-           !strcmp(chassis_type, "7") || /*  7: Tower */
-           !strcmp(chassis_type, "11"))  /* 11: Main Server Chassis */
+       if (kstrtoul(chassis_type, 10, &type) != 0)
+               return false;
+
+       switch (type) {
+       case 0x03: /* Desktop */
+       case 0x04: /* Low Profile Desktop */
+       case 0x05: /* Pizza Box */
+       case 0x06: /* Mini Tower */
+       case 0x07: /* Tower */
+       case 0x10: /* Lunch Box */
+       case 0x11: /* Main Server Chassis */
                return true;
+       }
 
        return false;
 }
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 930b49606a8c..ea6558d4864c 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -265,6 +265,7 @@
 /* #define ERRLOGMASK (CD_WARNING|CD_OPEN|CD_COUNT_TRACKS|CD_CLOSE) */
 /* #define ERRLOGMASK 
(CD_WARNING|CD_REG_UNREG|CD_DO_IOCTL|CD_OPEN|CD_CLOSE|CD_COUNT_TRACKS) */
 
+#include <linux/atomic.h>
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/major.h>
@@ -3689,9 +3690,9 @@ static struct ctl_table_header *cdrom_sysctl_header;
 
 static void cdrom_sysctl_register(void)
 {
-       static int initialized;
+       static atomic_t initialized = ATOMIC_INIT(0);
 
-       if (initialized == 1)
+       if (!atomic_add_unless(&initialized, 1, 1))
                return;
 
        cdrom_sysctl_header = register_sysctl_table(cdrom_root_table);
@@ -3702,8 +3703,6 @@ static void cdrom_sysctl_register(void)
        cdrom_sysctl_settings.debug = debug;
        cdrom_sysctl_settings.lock = lockdoor;
        cdrom_sysctl_settings.check = check_media_type;
-
-       initialized = 1;
 }
 
 static void cdrom_sysctl_unregister(void)
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index b941e6d59fd6..9dfb28b04559 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -377,7 +377,7 @@ static __init int hpet_mmap_enable(char *str)
        pr_info("HPET mmap %s\n", hpet_mmap_enabled ? "enabled" : "disabled");
        return 1;
 }
-__setup("hpet_mmap", hpet_mmap_enable);
+__setup("hpet_mmap=", hpet_mmap_enable);
 
 static int hpet_mmap(struct file *file, struct vm_area_struct *vma)
 {
diff --git a/drivers/char/hw_random/virtio-rng.c 
b/drivers/char/hw_random/virtio-rng.c
index 3fa2f8a009b3..1c5c4314c6b5 100644
--- a/drivers/char/hw_random/virtio-rng.c
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -73,7 +73,7 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t 
size, bool wait)
 
        if (!vi->busy) {
                vi->busy = true;
-               init_completion(&vi->have_data);
+               reinit_completion(&vi->have_data);
                register_buffer(vi, buf, size);
        }
 
diff --git a/drivers/clk/clk-fractional-divider.c 
b/drivers/clk/clk-fractional-divider.c
index fdf625fb10fa..083daa293280 100644
--- a/drivers/clk/clk-fractional-divider.c
+++ b/drivers/clk/clk-fractional-divider.c
@@ -77,7 +77,7 @@ static long clk_fd_round_rate(struct clk_hw *hw, unsigned 
long rate,
        unsigned long m, n;
        u64 ret;
 
-       if (!rate || rate >= *parent_rate)
+       if (!rate || (!clk_hw_can_set_rate_parent(hw) && rate >= *parent_rate))
                return *parent_rate;
 
        if (fd->approximation)
diff --git a/drivers/clk/rockchip/clk-rk3328.c 
b/drivers/clk/rockchip/clk-rk3328.c
index b04f29774ee7..559abf76891e 100644
--- a/drivers/clk/rockchip/clk-rk3328.c
+++ b/drivers/clk/rockchip/clk-rk3328.c
@@ -78,17 +78,17 @@ static struct rockchip_pll_rate_table rk3328_pll_rates[] = {
 
 static struct rockchip_pll_rate_table rk3328_pll_frac_rates[] = {
        /* _mhz, _refdiv, _fbdiv, _postdiv1, _postdiv2, _dsmpd, _frac */
-       RK3036_PLL_RATE(1016064000, 3, 127, 1, 1, 0, 134217),
+       RK3036_PLL_RATE(1016064000, 3, 127, 1, 1, 0, 134218),
        /* vco = 1016064000 */
-       RK3036_PLL_RATE(983040000, 24, 983, 1, 1, 0, 671088),
+       RK3036_PLL_RATE(983040000, 24, 983, 1, 1, 0, 671089),
        /* vco = 983040000 */
-       RK3036_PLL_RATE(491520000, 24, 983, 2, 1, 0, 671088),
+       RK3036_PLL_RATE(491520000, 24, 983, 2, 1, 0, 671089),
        /* vco = 983040000 */
-       RK3036_PLL_RATE(61440000, 6, 215, 7, 2, 0, 671088),
+       RK3036_PLL_RATE(61440000, 6, 215, 7, 2, 0, 671089),
        /* vco = 860156000 */
-       RK3036_PLL_RATE(56448000, 12, 451, 4, 4, 0, 9797894),
+       RK3036_PLL_RATE(56448000, 12, 451, 4, 4, 0, 9797895),
        /* vco = 903168000 */
-       RK3036_PLL_RATE(40960000, 12, 409, 4, 5, 0, 10066329),
+       RK3036_PLL_RATE(40960000, 12, 409, 4, 5, 0, 10066330),
        /* vco = 819200000 */
        { /* sentinel */ },
 };
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index d0c34df0529c..51a3c15ace09 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -909,8 +909,10 @@ static void __init acpi_cpufreq_boost_init(void)
 {
        int ret;
 
-       if (!(boot_cpu_has(X86_FEATURE_CPB) || boot_cpu_has(X86_FEATURE_IDA)))
+       if (!(boot_cpu_has(X86_FEATURE_CPB) || boot_cpu_has(X86_FEATURE_IDA))) {
+               pr_debug("Boost capabilities not present in the processor\n");
                return;
+       }
 
        acpi_cpufreq_driver.set_boost = set_boost;
        acpi_cpufreq_driver.boost_enabled = boost_state(0);
diff --git a/drivers/crypto/amcc/crypto4xx_trng.c 
b/drivers/crypto/amcc/crypto4xx_trng.c
index 677ca17fd223..368c5599515e 100644
--- a/drivers/crypto/amcc/crypto4xx_trng.c
+++ b/drivers/crypto/amcc/crypto4xx_trng.c
@@ -80,8 +80,10 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device 
*core_dev)
 
        /* Find the TRNG device node and map it */
        trng = of_find_matching_node(NULL, ppc4xx_trng_match);
-       if (!trng || !of_device_is_available(trng))
+       if (!trng || !of_device_is_available(trng)) {
+               of_node_put(trng);
                return;
+       }
 
        dev->trng_base = of_iomap(trng, 0);
        of_node_put(trng);
diff --git a/drivers/crypto/cavium/zip/zip_main.c 
b/drivers/crypto/cavium/zip/zip_main.c
index 1cd8aa488185..a6425a7afa7b 100644
--- a/drivers/crypto/cavium/zip/zip_main.c
+++ b/drivers/crypto/cavium/zip/zip_main.c
@@ -351,6 +351,7 @@ static struct pci_driver zip_driver = {
 
 static struct crypto_alg zip_comp_deflate = {
        .cra_name               = "deflate",
+       .cra_driver_name        = "deflate-cavium",
        .cra_flags              = CRYPTO_ALG_TYPE_COMPRESS,
        .cra_ctxsize            = sizeof(struct zip_kernel_ctx),
        .cra_priority           = 300,
@@ -365,6 +366,7 @@ static struct crypto_alg zip_comp_deflate = {
 
 static struct crypto_alg zip_comp_lzs = {
        .cra_name               = "lzs",
+       .cra_driver_name        = "lzs-cavium",
        .cra_flags              = CRYPTO_ALG_TYPE_COMPRESS,
        .cra_ctxsize            = sizeof(struct zip_kernel_ctx),
        .cra_priority           = 300,
@@ -384,7 +386,7 @@ static struct scomp_alg zip_scomp_deflate = {
        .decompress             = zip_scomp_decompress,
        .base                   = {
                .cra_name               = "deflate",
-               .cra_driver_name        = "deflate-scomp",
+               .cra_driver_name        = "deflate-scomp-cavium",
                .cra_module             = THIS_MODULE,
                .cra_priority           = 300,
        }
@@ -397,7 +399,7 @@ static struct scomp_alg zip_scomp_lzs = {
        .decompress             = zip_scomp_decompress,
        .base                   = {
                .cra_name               = "lzs",
-               .cra_driver_name        = "lzs-scomp",
+               .cra_driver_name        = "lzs-scomp-cavium",
                .cra_module             = THIS_MODULE,
                .cra_priority           = 300,
        }
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index cb37730f9272..6eb1f05f7c3c 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -290,7 +290,7 @@ static inline int imxdma_sg_next(struct imxdma_desc *d)
        struct scatterlist *sg = d->sg;
        unsigned long now;
 
-       now = min(d->len, sg_dma_len(sg));
+       now = min_t(size_t, d->len, sg_dma_len(sg));
        if (d->len != IMX_DMA_LENGTH_LOOP)
                d->len -= now;
 
diff --git a/drivers/dma/qcom/hidma.c b/drivers/dma/qcom/hidma.c
index e3669850aef4..dd15a829e792 100644
--- a/drivers/dma/qcom/hidma.c
+++ b/drivers/dma/qcom/hidma.c
@@ -133,24 +133,25 @@ static void hidma_process_completed(struct hidma_chan 
*mchan)
                desc = &mdesc->desc;
                last_cookie = desc->cookie;
 
+               llstat = hidma_ll_status(mdma->lldev, mdesc->tre_ch);
+
                spin_lock_irqsave(&mchan->lock, irqflags);
+               if (llstat == DMA_COMPLETE) {
+                       mchan->last_success = last_cookie;
+                       result.result = DMA_TRANS_NOERROR;
+               } else {
+                       result.result = DMA_TRANS_ABORTED;
+               }
+
                dma_cookie_complete(desc);
                spin_unlock_irqrestore(&mchan->lock, irqflags);
 
-               llstat = hidma_ll_status(mdma->lldev, mdesc->tre_ch);
                dmaengine_desc_get_callback(desc, &cb);
 
                dma_run_dependencies(desc);
 
                spin_lock_irqsave(&mchan->lock, irqflags);
                list_move(&mdesc->node, &mchan->free);
-
-               if (llstat == DMA_COMPLETE) {
-                       mchan->last_success = last_cookie;
-                       result.result = DMA_TRANS_NOERROR;
-               } else
-                       result.result = DMA_TRANS_ABORTED;
-
                spin_unlock_irqrestore(&mchan->lock, irqflags);
 
                dmaengine_desc_callback_invoke(&cb, &result);
@@ -410,6 +411,7 @@ hidma_prep_dma_memcpy(struct dma_chan *dmach, dma_addr_t 
dest, dma_addr_t src,
        if (!mdesc)
                return NULL;
 
+       mdesc->desc.flags = flags;
        hidma_ll_set_transfer_params(mdma->lldev, mdesc->tre_ch,
                                     src, dest, len, flags,
                                     HIDMA_TRE_MEMCPY);
@@ -442,6 +444,7 @@ hidma_prep_dma_memset(struct dma_chan *dmach, dma_addr_t 
dest, int value,
        if (!mdesc)
                return NULL;
 
+       mdesc->desc.flags = flags;
        hidma_ll_set_transfer_params(mdma->lldev, mdesc->tre_ch,
                                     value, dest, len, flags,
                                     HIDMA_TRE_MEMSET);
diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
index b9d75a54c896..7db2766b5fe9 100644
--- a/drivers/dma/tegra20-apb-dma.c
+++ b/drivers/dma/tegra20-apb-dma.c
@@ -635,7 +635,10 @@ static void handle_cont_sngl_cycle_dma_done(struct 
tegra_dma_channel *tdc,
 
        sgreq = list_first_entry(&tdc->pending_sg_req, typeof(*sgreq), node);
        dma_desc = sgreq->dma_desc;
-       dma_desc->bytes_transferred += sgreq->req_len;
+       /* if we dma for long enough the transfer count will wrap */
+       dma_desc->bytes_transferred =
+               (dma_desc->bytes_transferred + sgreq->req_len) %
+               dma_desc->bytes_requested;
 
        /* Callback need to be call */
        if (!dma_desc->cb_count)
diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
index d2fcafcea07e..ce23d5402bd6 100644
--- a/drivers/firmware/efi/cper.c
+++ b/drivers/firmware/efi/cper.c
@@ -641,19 +641,24 @@ EXPORT_SYMBOL_GPL(cper_estatus_check_header);
 int cper_estatus_check(const struct acpi_hest_generic_status *estatus)
 {
        struct acpi_hest_generic_data *gdata;
-       unsigned int data_len, gedata_len;
+       unsigned int data_len, record_size;
        int rc;
 
        rc = cper_estatus_check_header(estatus);
        if (rc)
                return rc;
+
        data_len = estatus->data_length;
 
        apei_estatus_for_each_section(estatus, gdata) {
-               gedata_len = acpi_hest_get_error_length(gdata);
-               if (gedata_len > data_len - acpi_hest_get_size(gdata))
+               if (sizeof(struct acpi_hest_generic_data) > data_len)
+                       return -EINVAL;
+
+               record_size = acpi_hest_get_record_size(gdata);
+               if (record_size > data_len)
                        return -EINVAL;
-               data_len -= acpi_hest_get_record_size(gdata);
+
+               data_len -= record_size;
        }
        if (data_len)
                return -EINVAL;
diff --git a/drivers/firmware/efi/libstub/arm-stub.c 
b/drivers/firmware/efi/libstub/arm-stub.c
index 01a9d78ee415..3b1e1dc3fb46 100644
--- a/drivers/firmware/efi/libstub/arm-stub.c
+++ b/drivers/firmware/efi/libstub/arm-stub.c
@@ -364,6 +364,11 @@ void efi_get_virtmap(efi_memory_desc_t *memory_map, 
unsigned long map_size,
                paddr = in->phys_addr;
                size = in->num_pages * EFI_PAGE_SIZE;
 
+               if (novamap()) {
+                       in->virt_addr = in->phys_addr;
+                       continue;
+               }
+
                /*
                 * Make the mapping compatible with 64k pages: this allows
                 * a 4k page size kernel to kexec a 64k page size kernel and
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c 
b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 50a9cab5a834..39f87e6dac5c 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -34,6 +34,7 @@ static unsigned long __chunk_size = EFI_READ_CHUNK_SIZE;
 
 static int __section(.data) __nokaslr;
 static int __section(.data) __quiet;
+static int __section(.data) __novamap;
 
 int __pure nokaslr(void)
 {
@@ -43,6 +44,10 @@ int __pure is_quiet(void)
 {
        return __quiet;
 }
+int __pure novamap(void)
+{
+       return __novamap;
+}
 
 #define EFI_MMAP_NR_SLACK_SLOTS        8
 
@@ -454,6 +459,11 @@ efi_status_t efi_parse_options(char const *cmdline)
                        __chunk_size = -1UL;
                }
 
+               if (!strncmp(str, "novamap", 7)) {
+                       str += strlen("novamap");
+                       __novamap = 1;
+               }
+
                /* Group words together, delimited by "," */
                while (*str && *str != ' ' && *str != ',')
                        str++;
diff --git a/drivers/firmware/efi/libstub/efistub.h 
b/drivers/firmware/efi/libstub/efistub.h
index f59564b72ddc..2adde22b4a9f 100644
--- a/drivers/firmware/efi/libstub/efistub.h
+++ b/drivers/firmware/efi/libstub/efistub.h
@@ -27,6 +27,7 @@
 
 extern int __pure nokaslr(void);
 extern int __pure is_quiet(void);
+extern int __pure novamap(void);
 
 #define pr_efi(sys_table, msg)         do {                            \
        if (!is_quiet()) efi_printk(sys_table, "EFI stub: "msg);        \
diff --git a/drivers/firmware/efi/libstub/fdt.c 
b/drivers/firmware/efi/libstub/fdt.c
index 0c0d2312f4a8..dba296a44f4e 100644
--- a/drivers/firmware/efi/libstub/fdt.c
+++ b/drivers/firmware/efi/libstub/fdt.c
@@ -327,6 +327,9 @@ efi_status_t 
allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
        if (status == EFI_SUCCESS) {
                efi_set_virtual_address_map_t *svam;
 
+               if (novamap())
+                       return EFI_SUCCESS;
+
                /* Install the new virtual address map */
                svam = sys_table->runtime->set_virtual_address_map;
                status = svam(runtime_entry_count * desc_size, desc_size,
diff --git a/drivers/firmware/efi/memattr.c b/drivers/firmware/efi/memattr.c
index 8986757eafaf..aac972b056d9 100644
--- a/drivers/firmware/efi/memattr.c
+++ b/drivers/firmware/efi/memattr.c
@@ -94,7 +94,7 @@ static bool entry_is_valid(const efi_memory_desc_t *in, 
efi_memory_desc_t *out)
 
                if (!(md->attribute & EFI_MEMORY_RUNTIME))
                        continue;
-               if (md->virt_addr == 0) {
+               if (md->virt_addr == 0 && md->phys_addr != 0) {
                        /* no virtual mapping has been installed by the stub */
                        break;
                }
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index 3233b72b6828..148e81eea35a 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -841,14 +841,16 @@ static void omap_gpio_unmask_irq(struct irq_data *d)
        if (trigger)
                omap_set_gpio_triggering(bank, offset, trigger);
 
-       /* For level-triggered GPIOs, the clearing must be done after
-        * the HW source is cleared, thus after the handler has run */
-       if (bank->level_mask & BIT(offset)) {
-               omap_set_gpio_irqenable(bank, offset, 0);
+       omap_set_gpio_irqenable(bank, offset, 1);
+
+       /*
+        * For level-triggered GPIOs, clearing must be done after the source
+        * is cleared, thus after the handler has run. OMAP4 needs this done
+        * after enabing the interrupt to clear the wakeup status.
+        */
+       if (bank->level_mask & BIT(offset))
                omap_clear_gpio_irqstatus(bank, offset);
-       }
 
-       omap_set_gpio_irqenable(bank, offset, 1);
        raw_spin_unlock_irqrestore(&bank->lock, flags);
 }
 
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c 
b/drivers/gpu/drm/drm_dp_mst_topology.c
index 2a4cf6837324..bb9a9852ec22 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -3199,6 +3199,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter 
*adapter, struct i2c_msg *msgs
                msg.u.i2c_read.transactions[i].i2c_dev_id = msgs[i].addr;
                msg.u.i2c_read.transactions[i].num_bytes = msgs[i].len;
                msg.u.i2c_read.transactions[i].bytes = msgs[i].buf;
+               msg.u.i2c_read.transactions[i].no_stop_bit = !(msgs[i].flags & 
I2C_M_STOP);
        }
        msg.u.i2c_read.read_i2c_device_id = msgs[num - 1].addr;
        msg.u.i2c_read.num_bytes_read = msgs[num - 1].len;
diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index 7a00351d5b5d..71186bf90760 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -203,6 +203,9 @@ int drm_universal_plane_init(struct drm_device *dev, struct 
drm_plane *plane,
                        format_modifier_count++;
        }
 
+       if (format_modifier_count)
+               config->allow_fb_modifiers = true;
+
        plane->modifier_count = format_modifier_count;
        plane->modifiers = kmalloc_array(format_modifier_count,
                                         sizeof(format_modifiers[0]),
diff --git a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c 
b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c
index 6d99f11fee4e..4bc8e9fe3095 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c
@@ -750,7 +750,9 @@ static int nv17_tv_set_property(struct drm_encoder *encoder,
                /* Disable the crtc to ensure a full modeset is
                 * performed whenever it's turned on again. */
                if (crtc)
-                       drm_crtc_force_disable(crtc);
+                       drm_crtc_helper_set_mode(crtc, &crtc->mode,
+                                                crtc->x, crtc->y,
+                                                crtc->primary->fb);
        }
 
        return 0;
diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c 
b/drivers/hid/intel-ish-hid/ipc/ipc.c
index 9a60ec13cb10..a3106fcc2253 100644
--- a/drivers/hid/intel-ish-hid/ipc/ipc.c
+++ b/drivers/hid/intel-ish-hid/ipc/ipc.c
@@ -91,7 +91,10 @@ static bool check_generated_interrupt(struct ishtp_device 
*dev)
                        IPC_INT_FROM_ISH_TO_HOST_CHV_AB(pisr_val);
        } else {
                pisr_val = ish_reg_read(dev, IPC_REG_PISR_BXT);
-               interrupt_generated = IPC_INT_FROM_ISH_TO_HOST_BXT(pisr_val);
+               interrupt_generated = !!pisr_val;
+               /* only busy-clear bit is RW, others are RO */
+               if (pisr_val)
+                       ish_reg_write(dev, IPC_REG_PISR_BXT, pisr_val);
        }
 
        return interrupt_generated;
@@ -843,11 +846,11 @@ int ish_hw_start(struct ishtp_device *dev)
 {
        ish_set_host_rdy(dev);
 
+       set_host_ready(dev);
+
        /* After that we can enable ISH DMA operation and wakeup ISHFW */
        ish_wakeup(dev);
 
-       set_host_ready(dev);
-
        /* wait for FW-initiated reset flow */
        if (!dev->recvd_hw_ready)
                wait_event_interruptible_timeout(dev->wait_hw_ready,
diff --git a/drivers/hid/intel-ish-hid/ishtp/bus.c 
b/drivers/hid/intel-ish-hid/ishtp/bus.c
index 2623a567ffba..f546635e9ac9 100644
--- a/drivers/hid/intel-ish-hid/ishtp/bus.c
+++ b/drivers/hid/intel-ish-hid/ishtp/bus.c
@@ -623,7 +623,8 @@ int ishtp_cl_device_bind(struct ishtp_cl *cl)
        spin_lock_irqsave(&cl->dev->device_list_lock, flags);
        list_for_each_entry(cl_device, &cl->dev->device_list,
                        device_link) {
-               if (cl_device->fw_client->client_id == cl->fw_client_id) {
+               if (cl_device->fw_client &&
+                   cl_device->fw_client->client_id == cl->fw_client_id) {
                        cl->device = cl_device;
                        rv = 0;
                        break;
@@ -683,6 +684,7 @@ void ishtp_bus_remove_all_clients(struct ishtp_device 
*ishtp_dev,
        spin_lock_irqsave(&ishtp_dev->device_list_lock, flags);
        list_for_each_entry_safe(cl_device, n, &ishtp_dev->device_list,
                                 device_link) {
+               cl_device->fw_client = NULL;
                if (warm_reset && cl_device->reference_count)
                        continue;
 
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c 
b/drivers/hwtracing/coresight/coresight-etm4x.c
index 5a1a14bcae72..78cb3b8881fa 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x.c
@@ -61,7 +61,8 @@ static void etm4_os_unlock(struct etmv4_drvdata *drvdata)
 
 static bool etm4_arch_supported(u8 arch)
 {
-       switch (arch) {
+       /* Mask out the minor version number */
+       switch (arch & 0xf0) {
        case ETM_ARCH_V4:
                break;
        default:
diff --git a/drivers/iio/adc/qcom-pm8xxx-xoadc.c 
b/drivers/iio/adc/qcom-pm8xxx-xoadc.c
index cea8f1fb444a..7e8da418a7b7 100644
--- a/drivers/iio/adc/qcom-pm8xxx-xoadc.c
+++ b/drivers/iio/adc/qcom-pm8xxx-xoadc.c
@@ -423,18 +423,14 @@ static irqreturn_t pm8xxx_eoc_irq(int irq, void *d)
 static struct pm8xxx_chan_info *
 pm8xxx_get_channel(struct pm8xxx_xoadc *adc, u8 chan)
 {
-       struct pm8xxx_chan_info *ch;
        int i;
 
        for (i = 0; i < adc->nchans; i++) {
-               ch = &adc->chans[i];
+               struct pm8xxx_chan_info *ch = &adc->chans[i];
                if (ch->hwchan->amux_channel == chan)
-                       break;
+                       return ch;
        }
-       if (i == adc->nchans)
-               return NULL;
-
-       return ch;
+       return NULL;
 }
 
 static int pm8xxx_read_channel_rsv(struct pm8xxx_xoadc *adc,
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index daf7a56e5d7e..e17f11782821 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1884,8 +1884,10 @@ static int abort_rpl(struct c4iw_dev *dev, struct 
sk_buff *skb)
        }
        mutex_unlock(&ep->com.mutex);
 
-       if (release)
+       if (release) {
+               close_complete_upcall(ep, -ECONNRESET);
                release_ep_resources(ep);
+       }
        c4iw_put_ep(&ep->com);
        return 0;
 }
@@ -3584,7 +3586,6 @@ int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, 
gfp_t gfp)
        if (close) {
                if (abrupt) {
                        set_bit(EP_DISC_ABORT, &ep->com.history);
-                       close_complete_upcall(ep, -ECONNRESET);
                        ret = send_abort(ep);
                } else {
                        set_bit(EP_DISC_CLOSE, &ep->com.history);
diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c
index fedaf8260105..8c79a480f2b7 100644
--- a/drivers/infiniband/hw/mlx4/cm.c
+++ b/drivers/infiniband/hw/mlx4/cm.c
@@ -39,7 +39,7 @@
 
 #include "mlx4_ib.h"
 
-#define CM_CLEANUP_CACHE_TIMEOUT  (5 * HZ)
+#define CM_CLEANUP_CACHE_TIMEOUT  (30 * HZ)
 
 struct id_map_entry {
        struct rb_node node;
diff --git a/drivers/iommu/io-pgtable-arm-v7s.c 
b/drivers/iommu/io-pgtable-arm-v7s.c
index 29b7a6755fcd..56368c8bd791 100644
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -217,7 +217,8 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,
                if (dma != phys)
                        goto out_unmap;
        }
-       kmemleak_ignore(table);
+       if (lvl == 2)
+               kmemleak_ignore(table);
        return table;
 
 out_unmap:
diff --git a/drivers/leds/leds-lp55xx-common.c 
b/drivers/leds/leds-lp55xx-common.c
index 5377f22ff994..e2655953667c 100644
--- a/drivers/leds/leds-lp55xx-common.c
+++ b/drivers/leds/leds-lp55xx-common.c
@@ -201,7 +201,7 @@ static void lp55xx_firmware_loaded(const struct firmware 
*fw, void *context)
 
        if (!fw) {
                dev_err(dev, "firmware request failed\n");
-               goto out;
+               return;
        }
 
        /* handling firmware data is chip dependent */
@@ -214,9 +214,9 @@ static void lp55xx_firmware_loaded(const struct firmware 
*fw, void *context)
 
        mutex_unlock(&chip->lock);
 
-out:
        /* firmware should be released for other channel use */
        release_firmware(chip->fw);
+       chip->fw = NULL;
 }
 
 static int lp55xx_request_firmware(struct lp55xx_chip *chip)
diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index 5d81cd06af00..def9c3478b89 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -217,7 +217,9 @@ STORE(__cached_dev)
        d_strtoul(writeback_rate_d_term);
        d_strtoul_nonzero(writeback_rate_p_term_inverse);
 
-       d_strtoi_h(sequential_cutoff);
+       sysfs_strtoul_clamp(sequential_cutoff,
+                           dc->sequential_cutoff,
+                           0, UINT_MAX);
        d_strtoi_h(readahead);
 
        if (attr == &sysfs_clear_stats)
@@ -660,8 +662,17 @@ STORE(__bch_cache_set)
                c->error_limit = strtoul_or_return(buf) << IO_ERROR_SHIFT;
 
        /* See count_io_errors() for why 88 */
-       if (attr == &sysfs_io_error_halflife)
-               c->error_decay = strtoul_or_return(buf) / 88;
+       if (attr == &sysfs_io_error_halflife) {
+               unsigned long v = 0;
+               ssize_t ret;
+
+               ret = strtoul_safe_clamp(buf, v, 0, UINT_MAX);
+               if (!ret) {
+                       c->error_decay = v / 88;
+                       return size;
+               }
+               return ret;
+       }
 
        sysfs_strtoul(journal_delay_ms,         c->journal_delay_ms);
        sysfs_strtoul(verify,                   c->verify);
diff --git a/drivers/md/bcache/sysfs.h b/drivers/md/bcache/sysfs.h
index b54fe9602529..e6e258f897ca 100644
--- a/drivers/md/bcache/sysfs.h
+++ b/drivers/md/bcache/sysfs.h
@@ -81,9 +81,16 @@ do {                                                         
        \
 
 #define sysfs_strtoul_clamp(file, var, min, max)                       \
 do {                                                                   \
-       if (attr == &sysfs_ ## file)                                    \
-               return strtoul_safe_clamp(buf, var, min, max)           \
-                       ?: (ssize_t) size;                              \
+       if (attr == &sysfs_ ## file) {                                  \
+               unsigned long v = 0;                                    \
+               ssize_t ret;                                            \
+               ret = strtoul_safe_clamp(buf, v, min, max);             \
+               if (!ret) {                                             \
+                       var = v;                                        \
+                       return size;                                    \
+               }                                                       \
+               return ret;                                             \
+       }                                                               \
 } while (0)
 
 #define strtoul_or_return(cp)                                          \
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 18d6a8a10d5d..aa7795990989 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -3292,6 +3292,13 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, 
char **argv)
        as.argc = argc;
        as.argv = argv;
 
+       /* make sure metadata and data are different devices */
+       if (!strcmp(argv[0], argv[1])) {
+               ti->error = "Error setting metadata or data device";
+               r = -EINVAL;
+               goto out_unlock;
+       }
+
        /*
         * Set default pool features.
         */
@@ -4173,6 +4180,12 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, 
char **argv)
        tc->sort_bio_list = RB_ROOT;
 
        if (argc == 3) {
+               if (!strcmp(argv[0], argv[2])) {
+                       ti->error = "Error setting origin device";
+                       r = -EINVAL;
+                       goto bad_origin_dev;
+               }
+
                r = dm_get_device(ti, argv[2], FMODE_READ, &origin_dev);
                if (r) {
                        ti->error = "Error opening origin device";
diff --git a/drivers/media/i2c/mt9m111.c b/drivers/media/i2c/mt9m111.c
index 99b992e46702..5b10f74fcc32 100644
--- a/drivers/media/i2c/mt9m111.c
+++ b/drivers/media/i2c/mt9m111.c
@@ -974,6 +974,8 @@ static int mt9m111_probe(struct i2c_client *client,
        mt9m111->rect.top       = MT9M111_MIN_DARK_ROWS;
        mt9m111->rect.width     = MT9M111_MAX_WIDTH;
        mt9m111->rect.height    = MT9M111_MAX_HEIGHT;
+       mt9m111->width          = mt9m111->rect.width;
+       mt9m111->height         = mt9m111->rect.height;
        mt9m111->fmt            = &mt9m111_colour_fmts[0];
        mt9m111->lastpage       = -1;
        mutex_init(&mt9m111->power_lock);
diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c 
b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
index 226f90886484..46c996936798 100644
--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
@@ -702,7 +702,7 @@ static void mtk_jpeg_buf_queue(struct vb2_buffer *vb)
        v4l2_m2m_buf_queue(ctx->fh.m2m_ctx, to_vb2_v4l2_buffer(vb));
 }
 
-static void *mtk_jpeg_buf_remove(struct mtk_jpeg_ctx *ctx,
+static struct vb2_v4l2_buffer *mtk_jpeg_buf_remove(struct mtk_jpeg_ctx *ctx,
                                 enum v4l2_buf_type type)
 {
        if (V4L2_TYPE_IS_OUTPUT(type))
@@ -714,7 +714,7 @@ static void *mtk_jpeg_buf_remove(struct mtk_jpeg_ctx *ctx,
 static int mtk_jpeg_start_streaming(struct vb2_queue *q, unsigned int count)
 {
        struct mtk_jpeg_ctx *ctx = vb2_get_drv_priv(q);
-       struct vb2_buffer *vb;
+       struct vb2_v4l2_buffer *vb;
        int ret = 0;
 
        ret = pm_runtime_get_sync(ctx->jpeg->dev);
@@ -724,14 +724,14 @@ static int mtk_jpeg_start_streaming(struct vb2_queue *q, 
unsigned int count)
        return 0;
 err:
        while ((vb = mtk_jpeg_buf_remove(ctx, q->type)))
-               v4l2_m2m_buf_done(to_vb2_v4l2_buffer(vb), VB2_BUF_STATE_QUEUED);
+               v4l2_m2m_buf_done(vb, VB2_BUF_STATE_QUEUED);
        return ret;
 }
 
 static void mtk_jpeg_stop_streaming(struct vb2_queue *q)
 {
        struct mtk_jpeg_ctx *ctx = vb2_get_drv_priv(q);
-       struct vb2_buffer *vb;
+       struct vb2_v4l2_buffer *vb;
 
        /*
         * STREAMOFF is an acknowledgment for source change event.
@@ -743,7 +743,7 @@ static void mtk_jpeg_stop_streaming(struct vb2_queue *q)
                struct mtk_jpeg_src_buf *src_buf;
 
                vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
-               src_buf = mtk_jpeg_vb2_to_srcbuf(vb);
+               src_buf = mtk_jpeg_vb2_to_srcbuf(&vb->vb2_buf);
                mtk_jpeg_set_queue_data(ctx, &src_buf->dec_param);
                ctx->state = MTK_JPEG_RUNNING;
        } else if (V4L2_TYPE_IS_OUTPUT(q->type)) {
@@ -751,7 +751,7 @@ static void mtk_jpeg_stop_streaming(struct vb2_queue *q)
        }
 
        while ((vb = mtk_jpeg_buf_remove(ctx, q->type)))
-               v4l2_m2m_buf_done(to_vb2_v4l2_buffer(vb), VB2_BUF_STATE_ERROR);
+               v4l2_m2m_buf_done(vb, VB2_BUF_STATE_ERROR);
 
        pm_runtime_put_sync(ctx->jpeg->dev);
 }
@@ -807,7 +807,7 @@ static void mtk_jpeg_device_run(void *priv)
 {
        struct mtk_jpeg_ctx *ctx = priv;
        struct mtk_jpeg_dev *jpeg = ctx->jpeg;
-       struct vb2_buffer *src_buf, *dst_buf;
+       struct vb2_v4l2_buffer *src_buf, *dst_buf;
        enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR;
        unsigned long flags;
        struct mtk_jpeg_src_buf *jpeg_src_buf;
@@ -817,11 +817,11 @@ static void mtk_jpeg_device_run(void *priv)
 
        src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
        dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
-       jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(src_buf);
+       jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf);
 
        if (jpeg_src_buf->flags & MTK_JPEG_BUF_FLAGS_LAST_FRAME) {
-               for (i = 0; i < dst_buf->num_planes; i++)
-                       vb2_set_plane_payload(dst_buf, i, 0);
+               for (i = 0; i < dst_buf->vb2_buf.num_planes; i++)
+                       vb2_set_plane_payload(&dst_buf->vb2_buf, i, 0);
                buf_state = VB2_BUF_STATE_DONE;
                goto dec_end;
        }
@@ -833,8 +833,8 @@ static void mtk_jpeg_device_run(void *priv)
                return;
        }
 
-       mtk_jpeg_set_dec_src(ctx, src_buf, &bs);
-       if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, dst_buf, &fb))
+       mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs);
+       if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, 
&dst_buf->vb2_buf, &fb))
                goto dec_end;
 
        spin_lock_irqsave(&jpeg->hw_lock, flags);
@@ -849,8 +849,8 @@ static void mtk_jpeg_device_run(void *priv)
 dec_end:
        v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
        v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
-       v4l2_m2m_buf_done(to_vb2_v4l2_buffer(src_buf), buf_state);
-       v4l2_m2m_buf_done(to_vb2_v4l2_buffer(dst_buf), buf_state);
+       v4l2_m2m_buf_done(src_buf, buf_state);
+       v4l2_m2m_buf_done(dst_buf, buf_state);
        v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
 }
 
@@ -926,7 +926,7 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv)
 {
        struct mtk_jpeg_dev *jpeg = priv;
        struct mtk_jpeg_ctx *ctx;
-       struct vb2_buffer *src_buf, *dst_buf;
+       struct vb2_v4l2_buffer *src_buf, *dst_buf;
        struct mtk_jpeg_src_buf *jpeg_src_buf;
        enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR;
        u32     dec_irq_ret;
@@ -943,7 +943,7 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv)
 
        src_buf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
        dst_buf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
-       jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(src_buf);
+       jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf);
 
        if (dec_irq_ret >= MTK_JPEG_DEC_RESULT_UNDERFLOW)
                mtk_jpeg_dec_reset(jpeg->dec_reg_base);
@@ -953,15 +953,15 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv)
                goto dec_end;
        }
 
-       for (i = 0; i < dst_buf->num_planes; i++)
-               vb2_set_plane_payload(dst_buf, i,
+       for (i = 0; i < dst_buf->vb2_buf.num_planes; i++)
+               vb2_set_plane_payload(&dst_buf->vb2_buf, i,
                                      jpeg_src_buf->dec_param.comp_size[i]);
 
        buf_state = VB2_BUF_STATE_DONE;
 
 dec_end:
-       v4l2_m2m_buf_done(to_vb2_v4l2_buffer(src_buf), buf_state);
-       v4l2_m2m_buf_done(to_vb2_v4l2_buffer(dst_buf), buf_state);
+       v4l2_m2m_buf_done(src_buf, buf_state);
+       v4l2_m2m_buf_done(dst_buf, buf_state);
        v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
        return IRQ_HANDLED;
 }
diff --git a/drivers/media/platform/mx2_emmaprp.c 
b/drivers/media/platform/mx2_emmaprp.c
index 4a2b1afa19c4..951f2fd415b0 100644
--- a/drivers/media/platform/mx2_emmaprp.c
+++ b/drivers/media/platform/mx2_emmaprp.c
@@ -288,7 +288,7 @@ static void emmaprp_device_run(void *priv)
 {
        struct emmaprp_ctx *ctx = priv;
        struct emmaprp_q_data *s_q_data, *d_q_data;
-       struct vb2_buffer *src_buf, *dst_buf;
+       struct vb2_v4l2_buffer *src_buf, *dst_buf;
        struct emmaprp_dev *pcdev = ctx->dev;
        unsigned int s_width, s_height;
        unsigned int d_width, d_height;
@@ -308,8 +308,8 @@ static void emmaprp_device_run(void *priv)
        d_height = d_q_data->height;
        d_size = d_width * d_height;
 
-       p_in = vb2_dma_contig_plane_dma_addr(src_buf, 0);
-       p_out = vb2_dma_contig_plane_dma_addr(dst_buf, 0);
+       p_in = vb2_dma_contig_plane_dma_addr(&src_buf->vb2_buf, 0);
+       p_out = vb2_dma_contig_plane_dma_addr(&dst_buf->vb2_buf, 0);
        if (!p_in || !p_out) {
                v4l2_err(&pcdev->v4l2_dev,
                         "Acquiring kernel pointers to buffers failed\n");
diff --git a/drivers/media/platform/s5p-g2d/g2d.c 
b/drivers/media/platform/s5p-g2d/g2d.c
index 66aa8cf1d048..770100d40372 100644
--- a/drivers/media/platform/s5p-g2d/g2d.c
+++ b/drivers/media/platform/s5p-g2d/g2d.c
@@ -498,7 +498,7 @@ static void device_run(void *prv)
 {
        struct g2d_ctx *ctx = prv;
        struct g2d_dev *dev = ctx->dev;
-       struct vb2_buffer *src, *dst;
+       struct vb2_v4l2_buffer *src, *dst;
        unsigned long flags;
        u32 cmd = 0;
 
@@ -513,10 +513,10 @@ static void device_run(void *prv)
        spin_lock_irqsave(&dev->ctrl_lock, flags);
 
        g2d_set_src_size(dev, &ctx->in);
-       g2d_set_src_addr(dev, vb2_dma_contig_plane_dma_addr(src, 0));
+       g2d_set_src_addr(dev, vb2_dma_contig_plane_dma_addr(&src->vb2_buf, 0));
 
        g2d_set_dst_size(dev, &ctx->out);
-       g2d_set_dst_addr(dev, vb2_dma_contig_plane_dma_addr(dst, 0));
+       g2d_set_dst_addr(dev, vb2_dma_contig_plane_dma_addr(&dst->vb2_buf, 0));
 
        g2d_set_rop4(dev, ctx->rop);
        g2d_set_flip(dev, ctx->flip);
diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c 
b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index faac8161b683..4568e68e15fa 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -793,14 +793,14 @@ static void skip(struct s5p_jpeg_buffer *buf, long len);
 static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
-       struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+       struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
        struct s5p_jpeg_buffer jpeg_buffer;
        unsigned int word;
        int c, x, components;
 
        jpeg_buffer.size = 2; /* Ls */
        jpeg_buffer.data =
-               (unsigned long)vb2_plane_vaddr(vb, 0) + ctx->out_q.sos + 2;
+               (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + 
ctx->out_q.sos + 2;
        jpeg_buffer.curr = 0;
 
        word = 0;
@@ -830,14 +830,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct 
s5p_jpeg_ctx *ctx)
 static void exynos4_jpeg_parse_huff_tbl(struct s5p_jpeg_ctx *ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
-       struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+       struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
        struct s5p_jpeg_buffer jpeg_buffer;
        unsigned int word;
        int c, i, n, j;
 
        for (j = 0; j < ctx->out_q.dht.n; ++j) {
                jpeg_buffer.size = ctx->out_q.dht.len[j];
-               jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(vb, 0) +
+               jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 
0) +
                                   ctx->out_q.dht.marker[j];
                jpeg_buffer.curr = 0;
 
@@ -889,13 +889,13 @@ static void exynos4_jpeg_parse_huff_tbl(struct 
s5p_jpeg_ctx *ctx)
 static void exynos4_jpeg_parse_decode_q_tbl(struct s5p_jpeg_ctx *ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
-       struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+       struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
        struct s5p_jpeg_buffer jpeg_buffer;
        int c, x, components;
 
        jpeg_buffer.size = ctx->out_q.sof_len;
        jpeg_buffer.data =
-               (unsigned long)vb2_plane_vaddr(vb, 0) + ctx->out_q.sof;
+               (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + 
ctx->out_q.sof;
        jpeg_buffer.curr = 0;
 
        skip(&jpeg_buffer, 5); /* P, Y, X */
@@ -920,14 +920,14 @@ static void exynos4_jpeg_parse_decode_q_tbl(struct 
s5p_jpeg_ctx *ctx)
 static void exynos4_jpeg_parse_q_tbl(struct s5p_jpeg_ctx *ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
-       struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+       struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
        struct s5p_jpeg_buffer jpeg_buffer;
        unsigned int word;
        int c, i, j;
 
        for (j = 0; j < ctx->out_q.dqt.n; ++j) {
                jpeg_buffer.size = ctx->out_q.dqt.len[j];
-               jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(vb, 0) +
+               jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 
0) +
                                   ctx->out_q.dqt.marker[j];
                jpeg_buffer.curr = 0;
 
@@ -1293,13 +1293,16 @@ static int s5p_jpeg_querycap(struct file *file, void 
*priv,
        return 0;
 }
 
-static int enum_fmt(struct s5p_jpeg_fmt *sjpeg_formats, int n,
+static int enum_fmt(struct s5p_jpeg_ctx *ctx,
+                   struct s5p_jpeg_fmt *sjpeg_formats, int n,
                    struct v4l2_fmtdesc *f, u32 type)
 {
        int i, num = 0;
+       unsigned int fmt_ver_flag = ctx->jpeg->variant->fmt_ver_flag;
 
        for (i = 0; i < n; ++i) {
-               if (sjpeg_formats[i].flags & type) {
+               if (sjpeg_formats[i].flags & type &&
+                   sjpeg_formats[i].flags & fmt_ver_flag) {
                        /* index-th format of type type found ? */
                        if (num == f->index)
                                break;
@@ -1326,11 +1329,11 @@ static int s5p_jpeg_enum_fmt_vid_cap(struct file *file, 
void *priv,
        struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv);
 
        if (ctx->mode == S5P_JPEG_ENCODE)
-               return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
+               return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
                                SJPEG_FMT_FLAG_ENC_CAPTURE);
 
-       return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
-                                       SJPEG_FMT_FLAG_DEC_CAPTURE);
+       return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
+                       SJPEG_FMT_FLAG_DEC_CAPTURE);
 }
 
 static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv,
@@ -1339,11 +1342,11 @@ static int s5p_jpeg_enum_fmt_vid_out(struct file *file, 
void *priv,
        struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv);
 
        if (ctx->mode == S5P_JPEG_ENCODE)
-               return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
+               return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
                                SJPEG_FMT_FLAG_ENC_OUTPUT);
 
-       return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
-                                       SJPEG_FMT_FLAG_DEC_OUTPUT);
+       return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
+                       SJPEG_FMT_FLAG_DEC_OUTPUT);
 }
 
 static struct s5p_jpeg_q_data *get_q_data(struct s5p_jpeg_ctx *ctx,
@@ -2072,15 +2075,15 @@ static void s5p_jpeg_device_run(void *priv)
 {
        struct s5p_jpeg_ctx *ctx = priv;
        struct s5p_jpeg *jpeg = ctx->jpeg;
-       struct vb2_buffer *src_buf, *dst_buf;
+       struct vb2_v4l2_buffer *src_buf, *dst_buf;
        unsigned long src_addr, dst_addr, flags;
 
        spin_lock_irqsave(&ctx->jpeg->slock, flags);
 
        src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
        dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
-       src_addr = vb2_dma_contig_plane_dma_addr(src_buf, 0);
-       dst_addr = vb2_dma_contig_plane_dma_addr(dst_buf, 0);
+       src_addr = vb2_dma_contig_plane_dma_addr(&src_buf->vb2_buf, 0);
+       dst_addr = vb2_dma_contig_plane_dma_addr(&dst_buf->vb2_buf, 0);
 
        s5p_jpeg_reset(jpeg->regs);
        s5p_jpeg_poweron(jpeg->regs);
@@ -2153,7 +2156,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx 
*ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
        struct s5p_jpeg_fmt *fmt;
-       struct vb2_buffer *vb;
+       struct vb2_v4l2_buffer *vb;
        struct s5p_jpeg_addr jpeg_addr = {};
        u32 pix_size, padding_bytes = 0;
 
@@ -2172,7 +2175,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx 
*ctx)
                vb = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
        }
 
-       jpeg_addr.y = vb2_dma_contig_plane_dma_addr(vb, 0);
+       jpeg_addr.y = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0);
 
        if (fmt->colplanes == 2) {
                jpeg_addr.cb = jpeg_addr.y + pix_size - padding_bytes;
@@ -2190,7 +2193,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx 
*ctx)
 static void exynos4_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
-       struct vb2_buffer *vb;
+       struct vb2_v4l2_buffer *vb;
        unsigned int jpeg_addr = 0;
 
        if (ctx->mode == S5P_JPEG_ENCODE)
@@ -2198,7 +2201,7 @@ static void exynos4_jpeg_set_jpeg_addr(struct 
s5p_jpeg_ctx *ctx)
        else
                vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
 
-       jpeg_addr = vb2_dma_contig_plane_dma_addr(vb, 0);
+       jpeg_addr = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0);
        if (jpeg->variant->version == SJPEG_EXYNOS5433 &&
            ctx->mode == S5P_JPEG_DECODE)
                jpeg_addr += ctx->out_q.sos;
@@ -2314,7 +2317,7 @@ static void exynos3250_jpeg_set_img_addr(struct 
s5p_jpeg_ctx *ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
        struct s5p_jpeg_fmt *fmt;
-       struct vb2_buffer *vb;
+       struct vb2_v4l2_buffer *vb;
        struct s5p_jpeg_addr jpeg_addr = {};
        u32 pix_size;
 
@@ -2328,7 +2331,7 @@ static void exynos3250_jpeg_set_img_addr(struct 
s5p_jpeg_ctx *ctx)
                fmt = ctx->cap_q.fmt;
        }
 
-       jpeg_addr.y = vb2_dma_contig_plane_dma_addr(vb, 0);
+       jpeg_addr.y = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0);
 
        if (fmt->colplanes == 2) {
                jpeg_addr.cb = jpeg_addr.y + pix_size;
@@ -2346,7 +2349,7 @@ static void exynos3250_jpeg_set_img_addr(struct 
s5p_jpeg_ctx *ctx)
 static void exynos3250_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
-       struct vb2_buffer *vb;
+       struct vb2_v4l2_buffer *vb;
        unsigned int jpeg_addr = 0;
 
        if (ctx->mode == S5P_JPEG_ENCODE)
@@ -2354,7 +2357,7 @@ static void exynos3250_jpeg_set_jpeg_addr(struct 
s5p_jpeg_ctx *ctx)
        else
                vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
 
-       jpeg_addr = vb2_dma_contig_plane_dma_addr(vb, 0);
+       jpeg_addr = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0);
        exynos3250_jpeg_jpgadr(jpeg->regs, jpeg_addr);
 }
 
diff --git a/drivers/media/platform/sh_veu.c b/drivers/media/platform/sh_veu.c
index 15a562af13c7..a4f593220ef0 100644
--- a/drivers/media/platform/sh_veu.c
+++ b/drivers/media/platform/sh_veu.c
@@ -276,13 +276,13 @@ static void sh_veu_process(struct sh_veu_dev *veu,
 static void sh_veu_device_run(void *priv)
 {
        struct sh_veu_dev *veu = priv;
-       struct vb2_buffer *src_buf, *dst_buf;
+       struct vb2_v4l2_buffer *src_buf, *dst_buf;
 
        src_buf = v4l2_m2m_next_src_buf(veu->m2m_ctx);
        dst_buf = v4l2_m2m_next_dst_buf(veu->m2m_ctx);
 
        if (src_buf && dst_buf)
-               sh_veu_process(veu, src_buf, dst_buf);
+               sh_veu_process(veu, &src_buf->vb2_buf, &dst_buf->vb2_buf);
 }
 
                /* ========== video ioctls ========== */
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index c28c51ad650f..f11245a0521c 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -920,7 +920,7 @@ static inline void set_cmd_timeout(struct mmc_omap_host 
*host, struct mmc_reques
        reg &= ~(1 << 5);
        OMAP_MMC_WRITE(host, SDIO, reg);
        /* Set maximum timeout */
-       OMAP_MMC_WRITE(host, CTO, 0xff);
+       OMAP_MMC_WRITE(host, CTO, 0xfd);
 }
 
 static inline void set_data_timeout(struct mmc_omap_host *host, struct 
mmc_request *req)
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c 
b/drivers/net/ethernet/cisco/enic/enic_main.c
index ced348e15a63..19f374b180fc 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -119,7 +119,7 @@ static void enic_init_affinity_hint(struct enic *enic)
 
        for (i = 0; i < enic->intr_count; i++) {
                if (enic_is_err_intr(enic, i) || enic_is_notify_intr(enic, i) ||
-                   (enic->msix[i].affinity_mask &&
+                   (cpumask_available(enic->msix[i].affinity_mask) &&
                     !cpumask_empty(enic->msix[i].affinity_mask)))
                        continue;
                if (zalloc_cpumask_var(&enic->msix[i].affinity_mask,
@@ -148,7 +148,7 @@ static void enic_set_affinity_hint(struct enic *enic)
        for (i = 0; i < enic->intr_count; i++) {
                if (enic_is_err_intr(enic, i)           ||
                    enic_is_notify_intr(enic, i)        ||
-                   !enic->msix[i].affinity_mask        ||
+                   !cpumask_available(enic->msix[i].affinity_mask) ||
                    cpumask_empty(enic->msix[i].affinity_mask))
                        continue;
                err = irq_set_affinity_hint(enic->msix_entry[i].vector,
@@ -161,7 +161,7 @@ static void enic_set_affinity_hint(struct enic *enic)
        for (i = 0; i < enic->wq_count; i++) {
                int wq_intr = enic_msix_wq_intr(enic, i);
 
-               if (enic->msix[wq_intr].affinity_mask &&
+               if (cpumask_available(enic->msix[wq_intr].affinity_mask) &&
                    !cpumask_empty(enic->msix[wq_intr].affinity_mask))
                        netif_set_xps_queue(enic->netdev,
                                            enic->msix[wq_intr].affinity_mask,
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c 
b/drivers/net/ethernet/intel/e1000e/netdev.c
index a25dc581a903..3c214a47c1c4 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -2120,7 +2120,7 @@ static int e1000_request_msix(struct e1000_adapter 
*adapter)
        if (strlen(netdev->name) < (IFNAMSIZ - 5))
                snprintf(adapter->rx_ring->name,
                         sizeof(adapter->rx_ring->name) - 1,
-                        "%s-rx-0", netdev->name);
+                        "%.14s-rx-0", netdev->name);
        else
                memcpy(adapter->rx_ring->name, netdev->name, IFNAMSIZ);
        err = request_irq(adapter->msix_entries[vector].vector,
@@ -2136,7 +2136,7 @@ static int e1000_request_msix(struct e1000_adapter 
*adapter)
        if (strlen(netdev->name) < (IFNAMSIZ - 5))
                snprintf(adapter->tx_ring->name,
                         sizeof(adapter->tx_ring->name) - 1,
-                        "%s-tx-0", netdev->name);
+                        "%.14s-tx-0", netdev->name);
        else
                memcpy(adapter->tx_ring->name, netdev->name, IFNAMSIZ);
        err = request_irq(adapter->msix_entries[vector].vector,
@@ -5306,8 +5306,13 @@ static void e1000_watchdog_task(struct work_struct *work)
                        /* 8000ES2LAN requires a Rx packet buffer work-around
                         * on link down event; reset the controller to flush
                         * the Rx packet buffer.
+                        *
+                        * If the link is lost the controller stops DMA, but
+                        * if there is queued Tx work it cannot be done.  So
+                        * reset the controller to flush the Tx packet buffers.
                         */
-                       if (adapter->flags & FLAG_RX_NEEDS_RESTART)
+                       if ((adapter->flags & FLAG_RX_NEEDS_RESTART) ||
+                           e1000_desc_unused(tx_ring) + 1 < tx_ring->count)
                                adapter->flags |= FLAG_RESTART_NOW;
                        else
                                pm_schedule_suspend(netdev->dev.parent,
@@ -5330,14 +5335,6 @@ static void e1000_watchdog_task(struct work_struct *work)
        adapter->gotc_old = adapter->stats.gotc;
        spin_unlock(&adapter->stats64_lock);
 
-       /* If the link is lost the controller stops DMA, but
-        * if there is queued Tx work it cannot be done.  So
-        * reset the controller to flush the Tx packet buffers.
-        */
-       if (!netif_carrier_ok(netdev) &&
-           (e1000_desc_unused(tx_ring) + 1 < tx_ring->count))
-               adapter->flags |= FLAG_RESTART_NOW;
-
        /* If reset is necessary, do it outside of interrupt context. */
        if (adapter->flags & FLAG_RESTART_NOW) {
                schedule_work(&adapter->reset_task);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c 
b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index 2f93e6e9dc9e..d2914116af8e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1719,7 +1719,7 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
        u64 node_guid;
        int err = 0;
 
-       if (!MLX5_CAP_GEN(esw->dev, vport_group_manager))
+       if (!esw || !MLX5_CAP_GEN(esw->dev, vport_group_manager))
                return -EPERM;
        if (!LEGAL_VPORT(esw, vport) || is_multicast_ether_addr(mac))
                return -EINVAL;
@@ -1793,7 +1793,7 @@ int mlx5_eswitch_get_vport_config(struct mlx5_eswitch 
*esw,
 {
        struct mlx5_vport *evport;
 
-       if (!MLX5_CAP_GEN(esw->dev, vport_group_manager))
+       if (!esw || !MLX5_CAP_GEN(esw->dev, vport_group_manager))
                return -EPERM;
        if (!LEGAL_VPORT(esw, vport))
                return -EINVAL;
@@ -1966,19 +1966,24 @@ static int normalize_vports_min_rate(struct 
mlx5_eswitch *esw, u32 divider)
 int mlx5_eswitch_set_vport_rate(struct mlx5_eswitch *esw, int vport,
                                u32 max_rate, u32 min_rate)
 {
-       u32 fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share);
-       bool min_rate_supported = MLX5_CAP_QOS(esw->dev, esw_bw_share) &&
-                                       fw_max_bw_share >= MLX5_MIN_BW_SHARE;
-       bool max_rate_supported = MLX5_CAP_QOS(esw->dev, esw_rate_limit);
        struct mlx5_vport *evport;
+       u32 fw_max_bw_share;
        u32 previous_min_rate;
        u32 divider;
+       bool min_rate_supported;
+       bool max_rate_supported;
        int err = 0;
 
        if (!ESW_ALLOWED(esw))
                return -EPERM;
        if (!LEGAL_VPORT(esw, vport))
                return -EINVAL;
+
+       fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share);
+       min_rate_supported = MLX5_CAP_QOS(esw->dev, esw_bw_share) &&
+                               fw_max_bw_share >= MLX5_MIN_BW_SHARE;
+       max_rate_supported = MLX5_CAP_QOS(esw->dev, esw_rate_limit);
+
        if ((min_rate && !min_rate_supported) || (max_rate && 
!max_rate_supported))
                return -EOPNOTSUPP;
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c 
b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 8ff92649f9ce..29d37355d8c6 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -2019,7 +2019,7 @@ static void mlxsw_sp_port_get_prio_strings(u8 **p, int 
prio)
        int i;
 
        for (i = 0; i < MLXSW_SP_PORT_HW_PRIO_STATS_LEN; i++) {
-               snprintf(*p, ETH_GSTRING_LEN, "%s_%d",
+               snprintf(*p, ETH_GSTRING_LEN, "%.29s_%.1d",
                         mlxsw_sp_port_hw_prio_stats[i].str, prio);
                *p += ETH_GSTRING_LEN;
        }
@@ -2030,7 +2030,7 @@ static void mlxsw_sp_port_get_tc_strings(u8 **p, int tc)
        int i;
 
        for (i = 0; i < MLXSW_SP_PORT_HW_TC_STATS_LEN; i++) {
-               snprintf(*p, ETH_GSTRING_LEN, "%s_%d",
+               snprintf(*p, ETH_GSTRING_LEN, "%.29s_%.1d",
                         mlxsw_sp_port_hw_tc_stats[i].str, tc);
                *p += ETH_GSTRING_LEN;
        }
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c 
b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 85d5c04618eb..c374ed311520 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -1224,6 +1224,12 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, 
u16 ies1_len,
        u8 *buf, *dpos;
        const u8 *spos;
 
+       if (!ies1)
+               ies1_len = 0;
+
+       if (!ies2)
+               ies2_len = 0;
+
        if (ies1_len == 0 && ies2_len == 0) {
                *merged_ies = NULL;
                *merged_len = 0;
@@ -1233,17 +1239,19 @@ static int _wil_cfg80211_merge_extra_ies(const u8 
*ies1, u16 ies1_len,
        buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL);
        if (!buf)
                return -ENOMEM;
-       memcpy(buf, ies1, ies1_len);
+       if (ies1)
+               memcpy(buf, ies1, ies1_len);
        dpos = buf + ies1_len;
        spos = ies2;
-       while (spos + 1 < ies2 + ies2_len) {
+       while (spos && (spos + 1 < ies2 + ies2_len)) {
                /* IE tag at offset 0, length at offset 1 */
                u16 ielen = 2 + spos[1];
 
                if (spos + ielen > ies2 + ies2_len)
                        break;
                if (spos[0] == WLAN_EID_VENDOR_SPECIFIC &&
-                   !_wil_cfg80211_find_ie(ies1, ies1_len, spos, ielen)) {
+                   (!ies1 || !_wil_cfg80211_find_ie(ies1, ies1_len,
+                                                    spos, ielen))) {
                        memcpy(dpos, spos, ielen);
                        dpos += ielen;
                }
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c 
b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
index 5a15362ef671..a40ad4675e19 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -475,7 +475,7 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        struct iwl_rb_allocator *rba = &trans_pcie->rba;
        struct list_head local_empty;
-       int pending = atomic_xchg(&rba->req_pending, 0);
+       int pending = atomic_read(&rba->req_pending);
 
        IWL_DEBUG_RX(trans, "Pending allocation requests = %d\n", pending);
 
@@ -530,11 +530,13 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
                        i++;
                }
 
+               atomic_dec(&rba->req_pending);
                pending--;
+
                if (!pending) {
-                       pending = atomic_xchg(&rba->req_pending, 0);
+                       pending = atomic_read(&rba->req_pending);
                        IWL_DEBUG_RX(trans,
-                                    "Pending allocation requests = %d\n",
+                                    "Got more pending allocation requests = 
%d\n",
                                     pending);
                }
 
@@ -546,12 +548,15 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
                spin_unlock(&rba->lock);
 
                atomic_inc(&rba->req_ready);
+
        }
 
        spin_lock(&rba->lock);
        /* return unused rbds to the allocator empty list */
        list_splice_tail(&local_empty, &rba->rbd_empty);
        spin_unlock(&rba->lock);
+
+       IWL_DEBUG_RX(trans, "%s, exit.\n", __func__);
 }
 
 /*
diff --git a/drivers/net/wireless/mediatek/mt7601u/eeprom.h 
b/drivers/net/wireless/mediatek/mt7601u/eeprom.h
index 662d12703b69..57b503ae63f1 100644
--- a/drivers/net/wireless/mediatek/mt7601u/eeprom.h
+++ b/drivers/net/wireless/mediatek/mt7601u/eeprom.h
@@ -17,7 +17,7 @@
 
 struct mt7601u_dev;
 
-#define MT7601U_EE_MAX_VER                     0x0c
+#define MT7601U_EE_MAX_VER                     0x0d
 #define MT7601U_EEPROM_SIZE                    256
 
 #define MT7601U_DEFAULT_TX_POWER               6
diff --git a/drivers/net/wireless/ti/wlcore/main.c 
b/drivers/net/wireless/ti/wlcore/main.c
index c346c021b999..eb3a7971c1d3 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -1058,8 +1058,11 @@ static int wl12xx_chip_wakeup(struct wl1271 *wl, bool 
plt)
                goto out;
 
        ret = wl12xx_fetch_firmware(wl, plt);
-       if (ret < 0)
-               goto out;
+       if (ret < 0) {
+               kfree(wl->fw_status);
+               kfree(wl->raw_fw_status);
+               kfree(wl->tx_res_if);
+       }
 
 out:
        return ret;
diff --git a/drivers/pci/pcie/pme.c b/drivers/pci/pcie/pme.c
index df290aa58dce..c2e6e3d1073f 100644
--- a/drivers/pci/pcie/pme.c
+++ b/drivers/pci/pcie/pme.c
@@ -367,6 +367,16 @@ static bool pcie_pme_check_wakeup(struct pci_bus *bus)
        return false;
 }
 
+static void pcie_pme_disable_interrupt(struct pci_dev *port,
+                                      struct pcie_pme_service_data *data)
+{
+       spin_lock_irq(&data->lock);
+       pcie_pme_interrupt_enable(port, false);
+       pcie_clear_root_pme_status(port);
+       data->noirq = true;
+       spin_unlock_irq(&data->lock);
+}
+
 /**
  * pcie_pme_suspend - Suspend PCIe PME service device.
  * @srv: PCIe service device to suspend.
@@ -391,11 +401,7 @@ static int pcie_pme_suspend(struct pcie_device *srv)
                        return 0;
        }
 
-       spin_lock_irq(&data->lock);
-       pcie_pme_interrupt_enable(port, false);
-       pcie_clear_root_pme_status(port);
-       data->noirq = true;
-       spin_unlock_irq(&data->lock);
+       pcie_pme_disable_interrupt(port, data);
 
        synchronize_irq(srv->irq);
 
@@ -431,9 +437,11 @@ static int pcie_pme_resume(struct pcie_device *srv)
  */
 static void pcie_pme_remove(struct pcie_device *srv)
 {
-       pcie_pme_suspend(srv);
+       struct pcie_pme_service_data *data = get_service_data(srv);
+
+       pcie_pme_disable_interrupt(srv->port, data);
        free_irq(srv->irq, srv);
-       kfree(get_service_data(srv));
+       kfree(data);
 }
 
 static struct pcie_port_service_driver pcie_pme_driver = {
diff --git a/drivers/platform/x86/intel_pmc_core.c 
b/drivers/platform/x86/intel_pmc_core.c
index 17e08b42b0a9..aaeb0242a99d 100644
--- a/drivers/platform/x86/intel_pmc_core.c
+++ b/drivers/platform/x86/intel_pmc_core.c
@@ -222,7 +222,8 @@ static int pmc_core_ppfear_sts_show(struct seq_file *s, 
void *unused)
             index < PPFEAR_MAX_NUM_ENTRIES; index++, iter++)
                pf_regs[index] = pmc_core_reg_read_byte(pmcdev, iter);
 
-       for (index = 0; map[index].name; index++)
+       for (index = 0; map[index].name &&
+            index < pmcdev->map->ppfear_buckets * 8; index++)
                pmc_core_display_map(s, index, pf_regs[index / 8], map);
 
        return 0;
diff --git a/drivers/platform/x86/intel_pmc_core.h 
b/drivers/platform/x86/intel_pmc_core.h
index 3d225a9cc09f..1f13426eb61a 100644
--- a/drivers/platform/x86/intel_pmc_core.h
+++ b/drivers/platform/x86/intel_pmc_core.h
@@ -38,7 +38,7 @@
 #define SPT_PMC_SLP_S0_RES_COUNTER_STEP                0x64
 #define PMC_BASE_ADDR_MASK                     ~(SPT_PMC_MMIO_REG_LEN - 1)
 #define MTPMC_MASK                             0xffff0000
-#define PPFEAR_MAX_NUM_ENTRIES                 5
+#define PPFEAR_MAX_NUM_ENTRIES                 12
 #define SPT_PPFEAR_NUM_ENTRIES                 5
 #define SPT_PMC_READ_DISABLE_BIT               0x16
 #define SPT_PMC_MSG_FULL_STS_BIT               0x18
diff --git a/drivers/regulator/act8865-regulator.c 
b/drivers/regulator/act8865-regulator.c
index 7652477e6a9d..39e8d60df060 100644
--- a/drivers/regulator/act8865-regulator.c
+++ b/drivers/regulator/act8865-regulator.c
@@ -131,7 +131,7 @@
  * ACT8865 voltage number
  */
 #define        ACT8865_VOLTAGE_NUM     64
-#define ACT8600_SUDCDC_VOLTAGE_NUM     255
+#define ACT8600_SUDCDC_VOLTAGE_NUM     256
 
 struct act8865 {
        struct regmap *regmap;
@@ -222,7 +222,8 @@ static const struct regulator_linear_range 
act8600_sudcdc_voltage_ranges[] = {
        REGULATOR_LINEAR_RANGE(3000000, 0, 63, 0),
        REGULATOR_LINEAR_RANGE(3000000, 64, 159, 100000),
        REGULATOR_LINEAR_RANGE(12600000, 160, 191, 200000),
-       REGULATOR_LINEAR_RANGE(19000000, 191, 255, 400000),
+       REGULATOR_LINEAR_RANGE(19000000, 192, 247, 400000),
+       REGULATOR_LINEAR_RANGE(41400000, 248, 255, 0),
 };
 
 static struct regulator_ops act8865_ops = {
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c 
b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index 89f09b122135..116a56f0af01 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -1445,7 +1445,7 @@ static struct bnx2fc_hba *bnx2fc_hba_create(struct 
cnic_dev *cnic)
 static struct bnx2fc_interface *
 bnx2fc_interface_create(struct bnx2fc_hba *hba,
                        struct net_device *netdev,
-                       enum fip_state fip_mode)
+                       enum fip_mode fip_mode)
 {
        struct fcoe_ctlr_device *ctlr_dev;
        struct bnx2fc_interface *interface;
diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
index 85f9a3eba387..99b46dc87a37 100644
--- a/drivers/scsi/fcoe/fcoe.c
+++ b/drivers/scsi/fcoe/fcoe.c
@@ -390,7 +390,7 @@ static int fcoe_interface_setup(struct fcoe_interface *fcoe,
  * Returns: pointer to a struct fcoe_interface or NULL on error
  */
 static struct fcoe_interface *fcoe_interface_create(struct net_device *netdev,
-                                                   enum fip_state fip_mode)
+                                                   enum fip_mode fip_mode)
 {
        struct fcoe_ctlr_device *ctlr_dev;
        struct fcoe_ctlr *ctlr;
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index 03019e07abb9..bd61bf4e2da2 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -147,7 +147,7 @@ static void fcoe_ctlr_map_dest(struct fcoe_ctlr *fip)
  * fcoe_ctlr_init() - Initialize the FCoE Controller instance
  * @fip: The FCoE controller to initialize
  */
-void fcoe_ctlr_init(struct fcoe_ctlr *fip, enum fip_state mode)
+void fcoe_ctlr_init(struct fcoe_ctlr *fip, enum fip_mode mode)
 {
        fcoe_ctlr_set_state(fip, FIP_ST_LINK_WAIT);
        fip->mode = mode;
@@ -454,7 +454,10 @@ void fcoe_ctlr_link_up(struct fcoe_ctlr *fip)
                mutex_unlock(&fip->ctlr_mutex);
                fc_linkup(fip->lp);
        } else if (fip->state == FIP_ST_LINK_WAIT) {
-               fcoe_ctlr_set_state(fip, fip->mode);
+               if (fip->mode == FIP_MODE_NON_FIP)
+                       fcoe_ctlr_set_state(fip, FIP_ST_NON_FIP);
+               else
+                       fcoe_ctlr_set_state(fip, FIP_ST_AUTO);
                switch (fip->mode) {
                default:
                        LIBFCOE_FIP_DBG(fip, "invalid mode %d\n", fip->mode);
diff --git a/drivers/scsi/fcoe/fcoe_transport.c 
b/drivers/scsi/fcoe/fcoe_transport.c
index 375c536cbc68..f5ed2d6cc70c 100644
--- a/drivers/scsi/fcoe/fcoe_transport.c
+++ b/drivers/scsi/fcoe/fcoe_transport.c
@@ -870,7 +870,7 @@ static int fcoe_transport_create(const char *buffer, struct 
kernel_param *kp)
        int rc = -ENODEV;
        struct net_device *netdev = NULL;
        struct fcoe_transport *ft = NULL;
-       enum fip_state fip_mode = (enum fip_state)(long)kp->arg;
+       enum fip_mode fip_mode = (enum fip_mode)kp->arg;
 
        mutex_lock(&ft_mutex);
 
diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c 
b/drivers/scsi/hisi_sas/hisi_sas_main.c
index 8fa9bb336ad4..b167411580ba 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
@@ -10,6 +10,7 @@
  */
 
 #include "hisi_sas.h"
+#include "../libsas/sas_internal.h"
 #define DRV_NAME "hisi_sas"
 
 #define DEV_IS_GONE(dev) \
@@ -1508,9 +1509,18 @@ static void hisi_sas_port_formed(struct asd_sas_phy 
*sas_phy)
 
 static void hisi_sas_phy_disconnected(struct hisi_sas_phy *phy)
 {
+       struct asd_sas_phy *sas_phy = &phy->sas_phy;
+       struct sas_phy *sphy = sas_phy->phy;
+       struct sas_phy_data *d = sphy->hostdata;
+
        phy->phy_attached = 0;
        phy->phy_type = 0;
        phy->port = NULL;
+
+       if (d->enable)
+               sphy->negotiated_linkrate = SAS_LINK_RATE_UNKNOWN;
+       else
+               sphy->negotiated_linkrate = SAS_PHY_DISABLED;
 }
 
 void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy)
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c 
b/drivers/scsi/megaraid/megaraid_sas_base.c
index d0abee3e6ed9..7f1ecd264652 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -4087,6 +4087,7 @@ int megasas_alloc_cmds(struct megasas_instance *instance)
        if (megasas_create_frame_pool(instance)) {
                dev_printk(KERN_DEBUG, &instance->pdev->dev, "Error creating 
frame DMA pool\n");
                megasas_free_cmds(instance);
+               return -ENOMEM;
        }
 
        return 0;
diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index 56bcdd412d26..7756901f99da 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -1382,7 +1382,7 @@ static struct libfc_function_template qedf_lport_template 
= {
 
 static void qedf_fcoe_ctlr_setup(struct qedf_ctx *qedf)
 {
-       fcoe_ctlr_init(&qedf->ctlr, FIP_ST_AUTO);
+       fcoe_ctlr_init(&qedf->ctlr, FIP_MODE_AUTO);
 
        qedf->ctlr.send = qedf_fip_send;
        qedf->ctlr.get_src_addr = qedf_get_src_mac;
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 40124648a07b..0b11405bfd7e 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -220,7 +220,7 @@ static struct scsi_device *scsi_alloc_sdev(struct 
scsi_target *starget,
        struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
 
        sdev = kzalloc(sizeof(*sdev) + shost->transportt->device_size,
-                      GFP_ATOMIC);
+                      GFP_KERNEL);
        if (!sdev)
                goto out;
 
@@ -796,7 +796,7 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned 
char *inq_result,
         */
        sdev->inquiry = kmemdup(inq_result,
                                max_t(size_t, sdev->inquiry_len, 36),
-                               GFP_ATOMIC);
+                               GFP_KERNEL);
        if (sdev->inquiry == NULL)
                return SCSI_SCAN_NO_RESPONSE;
 
@@ -1085,7 +1085,7 @@ static int scsi_probe_and_add_lun(struct scsi_target 
*starget,
        if (!sdev)
                goto out;
 
-       result = kmalloc(result_len, GFP_ATOMIC |
+       result = kmalloc(result_len, GFP_KERNEL |
                        ((shost->unchecked_isa_dma) ? __GFP_DMA : 0));
        if (!result)
                goto out_free_sdev;
diff --git a/drivers/soc/qcom/qcom_gsbi.c b/drivers/soc/qcom/qcom_gsbi.c
index 09c669e70d63..038abc377fdb 100644
--- a/drivers/soc/qcom/qcom_gsbi.c
+++ b/drivers/soc/qcom/qcom_gsbi.c
@@ -138,7 +138,7 @@ static int gsbi_probe(struct platform_device *pdev)
        struct resource *res;
        void __iomem *base;
        struct gsbi_info *gsbi;
-       int i;
+       int i, ret;
        u32 mask, gsbi_num;
        const struct crci_config *config = NULL;
 
@@ -221,7 +221,10 @@ static int gsbi_probe(struct platform_device *pdev)
 
        platform_set_drvdata(pdev, gsbi);
 
-       return of_platform_populate(node, NULL, NULL, &pdev->dev);
+       ret = of_platform_populate(node, NULL, NULL, &pdev->dev);
+       if (ret)
+               clk_disable_unprepare(gsbi->hclk);
+       return ret;
 }
 
 static int gsbi_remove(struct platform_device *pdev)
diff --git a/drivers/soc/tegra/fuse/fuse-tegra.c 
b/drivers/soc/tegra/fuse/fuse-tegra.c
index b7c552e3133c..37bde5c8268d 100644
--- a/drivers/soc/tegra/fuse/fuse-tegra.c
+++ b/drivers/soc/tegra/fuse/fuse-tegra.c
@@ -133,13 +133,17 @@ static int tegra_fuse_probe(struct platform_device *pdev)
        /* take over the memory region from the early initialization */
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        fuse->base = devm_ioremap_resource(&pdev->dev, res);
-       if (IS_ERR(fuse->base))
-               return PTR_ERR(fuse->base);
+       if (IS_ERR(fuse->base)) {
+               err = PTR_ERR(fuse->base);
+               fuse->base = base;
+               return err;
+       }
 
        fuse->clk = devm_clk_get(&pdev->dev, "fuse");
        if (IS_ERR(fuse->clk)) {
                dev_err(&pdev->dev, "failed to get FUSE clock: %ld",
                        PTR_ERR(fuse->clk));
+               fuse->base = base;
                return PTR_ERR(fuse->clk);
        }
 
@@ -148,8 +152,10 @@ static int tegra_fuse_probe(struct platform_device *pdev)
 
        if (fuse->soc->probe) {
                err = fuse->soc->probe(fuse);
-               if (err < 0)
+               if (err < 0) {
+                       fuse->base = base;
                        return err;
+               }
        }
 
        if (tegra_fuse_create_sysfs(&pdev->dev, fuse->soc->info->size,
diff --git a/drivers/tty/serial/8250/8250_pxa.c 
b/drivers/tty/serial/8250/8250_pxa.c
index 4d68731af534..de1372ba24b1 100644
--- a/drivers/tty/serial/8250/8250_pxa.c
+++ b/drivers/tty/serial/8250/8250_pxa.c
@@ -118,6 +118,10 @@ static int serial_pxa_probe(struct platform_device *pdev)
        if (ret)
                return ret;
 
+       ret = of_alias_get_id(pdev->dev.of_node, "serial");
+       if (ret >= 0)
+               uart.port.line = ret;
+
        uart.port.type = PORT_XSCALE;
        uart.port.iotype = UPIO_MEM32;
        uart.port.mapbase = mmres->start;
diff --git a/drivers/tty/serial/atmel_serial.c 
b/drivers/tty/serial/atmel_serial.c
index 9f1cef59fa28..f747f1a1780c 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -176,6 +176,8 @@ struct atmel_uart_port {
        unsigned int            pending_status;
        spinlock_t              lock_suspended;
 
+       bool                    hd_start_rx;    /* can start RX during 
half-duplex operation */
+
 #ifdef CONFIG_PM
        struct {
                u32             cr;
@@ -238,6 +240,12 @@ static inline void atmel_uart_write_char(struct uart_port 
*port, u8 value)
        __raw_writeb(value, port->membase + ATMEL_US_THR);
 }
 
+static inline int atmel_uart_is_half_duplex(struct uart_port *port)
+{
+       return (port->rs485.flags & SER_RS485_ENABLED) &&
+               !(port->rs485.flags & SER_RS485_RX_DURING_TX);
+}
+
 #ifdef CONFIG_SERIAL_ATMEL_PDC
 static bool atmel_use_pdc_rx(struct uart_port *port)
 {
@@ -489,9 +497,9 @@ static void atmel_stop_tx(struct uart_port *port)
        /* Disable interrupts */
        atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask);
 
-       if ((port->rs485.flags & SER_RS485_ENABLED) &&
-           !(port->rs485.flags & SER_RS485_RX_DURING_TX))
+       if (atmel_uart_is_half_duplex(port))
                atmel_start_rx(port);
+
 }
 
 /*
@@ -508,8 +516,7 @@ static void atmel_start_tx(struct uart_port *port)
                return;
 
        if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port))
-               if ((port->rs485.flags & SER_RS485_ENABLED) &&
-                   !(port->rs485.flags & SER_RS485_RX_DURING_TX))
+               if (atmel_uart_is_half_duplex(port))
                        atmel_stop_rx(port);
 
        if (atmel_use_pdc_tx(port))
@@ -806,10 +813,14 @@ static void atmel_complete_tx_dma(void *arg)
         */
        if (!uart_circ_empty(xmit))
                atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx);
-       else if ((port->rs485.flags & SER_RS485_ENABLED) &&
-                !(port->rs485.flags & SER_RS485_RX_DURING_TX)) {
-               /* DMA done, stop TX, start RX for RS485 */
-               atmel_start_rx(port);
+       else if (atmel_uart_is_half_duplex(port)) {
+               /*
+                * DMA done, re-enable TXEMPTY and signal that we can stop
+                * TX and start RX for RS485
+                */
+               atmel_port->hd_start_rx = true;
+               atmel_uart_writel(port, ATMEL_US_IER,
+                                 atmel_port->tx_done_mask);
        }
 
        spin_unlock_irqrestore(&port->lock, flags);
@@ -1254,9 +1265,20 @@ atmel_handle_transmit(struct uart_port *port, unsigned 
int pending)
        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
 
        if (pending & atmel_port->tx_done_mask) {
-               /* Either PDC or interrupt transmission */
                atmel_uart_writel(port, ATMEL_US_IDR,
                                  atmel_port->tx_done_mask);
+
+               /* Start RX if flag was set and FIFO is empty */
+               if (atmel_port->hd_start_rx) {
+                       if (!(atmel_uart_readl(port, ATMEL_US_CSR)
+                                       & ATMEL_US_TXEMPTY))
+                               dev_warn(port->dev, "Should start RX, but TX 
fifo is not empty\n");
+
+                       atmel_port->hd_start_rx = false;
+                       atmel_start_rx(port);
+                       return;
+               }
+
                atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx);
        }
 }
@@ -1383,8 +1405,7 @@ static void atmel_tx_pdc(struct uart_port *port)
                atmel_uart_writel(port, ATMEL_US_IER,
                                  atmel_port->tx_done_mask);
        } else {
-               if ((port->rs485.flags & SER_RS485_ENABLED) &&
-                   !(port->rs485.flags & SER_RS485_RX_DURING_TX)) {
+               if (atmel_uart_is_half_duplex(port)) {
                        /* DMA done, stop TX, start RX for RS485 */
                        atmel_start_rx(port);
                }
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 217114227f8d..cf11882d2602 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -25,7 +25,7 @@
  * Byte threshold to limit memory consumption for flip buffers.
  * The actual memory limit is > 2x this amount.
  */
-#define TTYB_DEFAULT_MEM_LIMIT 65536
+#define TTYB_DEFAULT_MEM_LIMIT (640 * 1024UL)
 
 /*
  * We default to dicing tty buffer allocations to this many characters
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 43ea5fb87b9a..70306ae039c0 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -938,8 +938,15 @@ static int ci_hdrc_probe(struct platform_device *pdev)
        } else if (ci->platdata->usb_phy) {
                ci->usb_phy = ci->platdata->usb_phy;
        } else {
+               ci->usb_phy = devm_usb_get_phy_by_phandle(dev->parent, "phys",
+                                                         0);
                ci->phy = devm_phy_get(dev->parent, "usb-phy");
-               ci->usb_phy = devm_usb_get_phy(dev->parent, USB_PHY_TYPE_USB2);
+
+               /* Fallback to grabbing any registered USB2 PHY */
+               if (IS_ERR(ci->usb_phy) &&
+                   PTR_ERR(ci->usb_phy) != -EPROBE_DEFER)
+                       ci->usb_phy = devm_usb_get_phy(dev->parent,
+                                                      USB_PHY_TYPE_USB2);
 
                /* if both generic PHY and USB PHY layers aren't enabled */
                if (PTR_ERR(ci->phy) == -ENOSYS &&
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 32dd0d3462da..1b99d44e52b9 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -3286,6 +3286,8 @@ int dwc3_gadget_init(struct dwc3 *dwc)
                goto err4;
        }
 
+       dwc3_gadget_set_speed(&dwc->gadget, dwc->maximum_speed);
+
        return 0;
 
 err4:
diff --git a/drivers/usb/gadget/function/f_fs.c 
b/drivers/usb/gadget/function/f_fs.c
index 52e6897fa35a..79900c0b4f3a 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1009,6 +1009,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct 
ffs_io_data *io_data)
                         * condition with req->complete callback.
                         */
                        usb_ep_dequeue(ep->ep, req);
+                       wait_for_completion(&done);
                        interrupted = ep->status < 0;
                }
 
diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
index 155153ecb894..2a0ce0c68302 100644
--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -212,7 +212,7 @@ static int pwm_backlight_initial_power_state(const struct 
pwm_bl_data *pb)
         */
 
        /* if the enable GPIO is disabled, do not enable the backlight */
-       if (pb->enable_gpio && gpiod_get_value(pb->enable_gpio) == 0)
+       if (pb->enable_gpio && gpiod_get_value_cansleep(pb->enable_gpio) == 0)
                return FB_BLANK_POWERDOWN;
 
        /* The regulator is disabled, do not enable the backlight */
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 302cce7185e3..83961a22bef1 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -427,6 +427,9 @@ static void fb_do_show_logo(struct fb_info *info, struct 
fb_image *image,
 {
        unsigned int x;
 
+       if (image->width > info->var.xres || image->height > info->var.yres)
+               return;
+
        if (rotate == FB_ROTATE_UR) {
                for (x = 0;
                     x < num && image->dx + image->width <= info->var.xres;
diff --git a/fs/buffer.c b/fs/buffer.c
index 8086cc8ff0bc..bdca7b10e239 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -3084,6 +3084,13 @@ void guard_bio_eod(int op, struct bio *bio)
        /* Uhhuh. We've got a bio that straddles the device size! */
        truncated_bytes = bio->bi_iter.bi_size - (maxsector << 9);
 
+       /*
+        * The bio contains more than one segment which spans EOD, just return
+        * and let IO layer turn it into an EIO
+        */
+       if (truncated_bytes > bvec->bv_len)
+               return;
+
        /* Truncate the bio.. */
        bio->bi_iter.bi_size -= truncated_bytes;
        bvec->bv_len -= truncated_bytes;
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index 6b61df117fd4..563e2f6268c3 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -271,9 +271,9 @@ static void dump_referral(const struct dfs_info3_param *ref)
 {
        cifs_dbg(FYI, "DFS: ref path: %s\n", ref->path_name);
        cifs_dbg(FYI, "DFS: node path: %s\n", ref->node_name);
-       cifs_dbg(FYI, "DFS: fl: %hd, srv_type: %hd\n",
+       cifs_dbg(FYI, "DFS: fl: %d, srv_type: %d\n",
                 ref->flags, ref->server_type);
-       cifs_dbg(FYI, "DFS: ref_flags: %hd, path_consumed: %hd\n",
+       cifs_dbg(FYI, "DFS: ref_flags: %d, path_consumed: %d\n",
                 ref->ref_flag, ref->path_consumed);
 }
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 48aa854c564a..33cd844579ae 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1265,6 +1265,11 @@ cifs_parse_devname(const char *devname, struct smb_vol 
*vol)
        const char *delims = "/\\";
        size_t len;
 
+       if (unlikely(!devname || !*devname)) {
+               cifs_dbg(VFS, "Device name not specified.\n");
+               return -EINVAL;
+       }
+
        /* make sure we have a valid UNC double delimiter prefix */
        len = strspn(devname, delims);
        if (len != 2)
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 72d6f4db9bdc..cd69c1e9750f 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1631,8 +1631,20 @@ cifs_setlk(struct file *file, struct file_lock *flock, 
__u32 type,
                rc = server->ops->mand_unlock_range(cfile, flock, xid);
 
 out:
-       if (flock->fl_flags & FL_POSIX && !rc)
+       if (flock->fl_flags & FL_POSIX) {
+               /*
+                * If this is a request to remove all locks because we
+                * are closing the file, it doesn't matter if the
+                * unlocking failed as both cifs.ko and the SMB server
+                * remove the lock on file close
+                */
+               if (rc) {
+                       cifs_dbg(VFS, "%s failed rc=%d\n", __func__, rc);
+                       if (!(flock->fl_flags & FL_CLOSE))
+                               return rc;
+               }
                rc = locks_lock_file_wait(file, flock);
+       }
        return rc;
 }
 
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index d8cd82001c1c..f50d3d0b9b87 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -306,7 +306,7 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr)
        remaining = tgt_total_cnt - total_in_tgt;
 
        if (remaining < 0) {
-               cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu 
total_in_tgt=%hu\n",
+               cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu 
total_in_tgt=%u\n",
                         tgt_total_cnt, total_in_tgt);
                return -EPROTO;
        }
diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
index 9e96a0bd08d9..e1801b288847 100644
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -1219,6 +1219,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
        ext4_lblk_t offsets[4], offsets2[4];
        Indirect chain[4], chain2[4];
        Indirect *partial, *partial2;
+       Indirect *p = NULL, *p2 = NULL;
        ext4_lblk_t max_block;
        __le32 nr = 0, nr2 = 0;
        int n = 0, n2 = 0;
@@ -1260,7 +1261,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
                }
 
 
-               partial = ext4_find_shared(inode, n, offsets, chain, &nr);
+               partial = p = ext4_find_shared(inode, n, offsets, chain, &nr);
                if (nr) {
                        if (partial == chain) {
                                /* Shared branch grows from the inode */
@@ -1285,13 +1286,11 @@ int ext4_ind_remove_space(handle_t *handle, struct 
inode *inode,
                                partial->p + 1,
                                (__le32 *)partial->bh->b_data+addr_per_block,
                                (chain+n-1) - partial);
-                       BUFFER_TRACE(partial->bh, "call brelse");
-                       brelse(partial->bh);
                        partial--;
                }
 
 end_range:
-               partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
+               partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, 
&nr2);
                if (nr2) {
                        if (partial2 == chain2) {
                                /*
@@ -1321,16 +1320,14 @@ int ext4_ind_remove_space(handle_t *handle, struct 
inode *inode,
                                           (__le32 *)partial2->bh->b_data,
                                           partial2->p,
                                           (chain2+n2-1) - partial2);
-                       BUFFER_TRACE(partial2->bh, "call brelse");
-                       brelse(partial2->bh);
                        partial2--;
                }
                goto do_indirects;
        }
 
        /* Punch happened within the same level (n == n2) */
-       partial = ext4_find_shared(inode, n, offsets, chain, &nr);
-       partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
+       partial = p = ext4_find_shared(inode, n, offsets, chain, &nr);
+       partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
 
        /* Free top, but only if partial2 isn't its subtree. */
        if (nr) {
@@ -1387,15 +1384,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
                                           partial->p + 1,
                                           partial2->p,
                                           (chain+n-1) - partial);
-                       while (partial > chain) {
-                               BUFFER_TRACE(partial->bh, "call brelse");
-                               brelse(partial->bh);
-                       }
-                       while (partial2 > chain2) {
-                               BUFFER_TRACE(partial2->bh, "call brelse");
-                               brelse(partial2->bh);
-                       }
-                       return 0;
+                       goto cleanup;
                }
 
                /*
@@ -1410,8 +1399,6 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
                                           partial->p + 1,
                                           (__le32 
*)partial->bh->b_data+addr_per_block,
                                           (chain+n-1) - partial);
-                       BUFFER_TRACE(partial->bh, "call brelse");
-                       brelse(partial->bh);
                        partial--;
                }
                if (partial2 > chain2 && depth2 <= depth) {
@@ -1419,11 +1406,21 @@ int ext4_ind_remove_space(handle_t *handle, struct 
inode *inode,
                                           (__le32 *)partial2->bh->b_data,
                                           partial2->p,
                                           (chain2+n2-1) - partial2);
-                       BUFFER_TRACE(partial2->bh, "call brelse");
-                       brelse(partial2->bh);
                        partial2--;
                }
        }
+
+cleanup:
+       while (p && p > chain) {
+               BUFFER_TRACE(p->bh, "call brelse");
+               brelse(p->bh);
+               p--;
+       }
+       while (p2 && p2 > chain2) {
+               BUFFER_TRACE(p2->bh, "call brelse");
+               brelse(p2->bh);
+               p2--;
+       }
        return 0;
 
 do_indirects:
@@ -1431,7 +1428,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
        switch (offsets[0]) {
        default:
                if (++n >= n2)
-                       return 0;
+                       break;
                nr = i_data[EXT4_IND_BLOCK];
                if (nr) {
                        ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 1);
@@ -1439,7 +1436,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
                }
        case EXT4_IND_BLOCK:
                if (++n >= n2)
-                       return 0;
+                       break;
                nr = i_data[EXT4_DIND_BLOCK];
                if (nr) {
                        ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 2);
@@ -1447,7 +1444,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
                }
        case EXT4_DIND_BLOCK:
                if (++n >= n2)
-                       return 0;
+                       break;
                nr = i_data[EXT4_TIND_BLOCK];
                if (nr) {
                        ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 3);
@@ -1456,5 +1453,5 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
        case EXT4_TIND_BLOCK:
                ;
        }
-       return 0;
+       goto cleanup;
 }
diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
index 888a9dc13677..506e365cf903 100644
--- a/fs/f2fs/inline.c
+++ b/fs/f2fs/inline.c
@@ -656,6 +656,12 @@ int f2fs_read_inline_dir(struct file *file, struct 
dir_context *ctx,
        if (IS_ERR(ipage))
                return PTR_ERR(ipage);
 
+       /*
+        * f2fs_readdir was protected by inode.i_rwsem, it is safe to access
+        * ipage without page's lock held.
+        */
+       unlock_page(ipage);
+
        inline_dentry = inline_data_addr(inode, ipage);
 
        make_dentry_ptr_inline(inode, &d, inline_dentry);
@@ -664,7 +670,7 @@ int f2fs_read_inline_dir(struct file *file, struct 
dir_context *ctx,
        if (!err)
                ctx->pos = d.max;
 
-       f2fs_put_page(ipage, 1);
+       f2fs_put_page(ipage, 0);
        return err < 0 ? err : 0;
 }
 
diff --git a/fs/f2fs/trace.c b/fs/f2fs/trace.c
index bccbbf2616d2..8ac1851a21c0 100644
--- a/fs/f2fs/trace.c
+++ b/fs/f2fs/trace.c
@@ -61,6 +61,7 @@ void f2fs_trace_pid(struct page *page)
 
        set_page_private(page, (unsigned long)pid);
 
+retry:
        if (radix_tree_preload(GFP_NOFS))
                return;
 
@@ -71,7 +72,12 @@ void f2fs_trace_pid(struct page *page)
        if (p)
                radix_tree_delete(&pids, pid);
 
-       f2fs_radix_tree_insert(&pids, pid, current);
+       if (radix_tree_insert(&pids, pid, current)) {
+               spin_unlock(&pids_lock);
+               radix_tree_preload_end();
+               cond_resched();
+               goto retry;
+       }
 
        trace_printk("%3x:%3x %4x %-16s\n",
                        MAJOR(inode->i_sb->s_dev), MINOR(inode->i_sb->s_dev),
diff --git a/fs/file.c b/fs/file.c
index 4eecbf4244a5..0c25b980affe 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -462,6 +462,7 @@ struct files_struct init_files = {
                .full_fds_bits  = init_files.full_fds_bits_init,
        },
        .file_lock      = __SPIN_LOCK_UNLOCKED(init_files.file_lock),
+       .resize_wait    = __WAIT_QUEUE_HEAD_INITIALIZER(init_files.resize_wait),
 };
 
 static unsigned int find_next_fd(struct fdtable *fdt, unsigned int start)
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 3c1c31321d9b..d11401afd52f 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -693,9 +693,11 @@ void jbd2_journal_commit_transaction(journal_t *journal)
                            the last tag we set up. */
 
                        tag->t_flags |= cpu_to_be16(JBD2_FLAG_LAST_TAG);
-
-                       jbd2_descriptor_block_csum_set(journal, descriptor);
 start_journal_io:
+                       if (descriptor)
+                               jbd2_descriptor_block_csum_set(journal,
+                                                       descriptor);
+
                        for (i = 0; i < bufs; i++) {
                                struct buffer_head *bh = wbuf[i];
                                /*
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 61d48f0c41a1..0c8f77db60e2 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1343,6 +1343,10 @@ static int journal_reset(journal_t *journal)
        return jbd2_journal_start_thread(journal);
 }
 
+/*
+ * This function expects that the caller will have locked the journal
+ * buffer head, and will return with it unlocked
+ */
 static int jbd2_write_superblock(journal_t *journal, int write_flags)
 {
        struct buffer_head *bh = journal->j_sb_buffer;
@@ -1352,7 +1356,6 @@ static int jbd2_write_superblock(journal_t *journal, int 
write_flags)
        trace_jbd2_write_superblock(journal, write_flags);
        if (!(journal->j_flags & JBD2_BARRIER))
                write_flags &= ~(REQ_FUA | REQ_PREFLUSH);
-       lock_buffer(bh);
        if (buffer_write_io_error(bh)) {
                /*
                 * Oh, dear.  A previous attempt to write the journal
@@ -1411,6 +1414,7 @@ int jbd2_journal_update_sb_log_tail(journal_t *journal, 
tid_t tail_tid,
        jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
                  tail_block, tail_tid);
 
+       lock_buffer(journal->j_sb_buffer);
        sb->s_sequence = cpu_to_be32(tail_tid);
        sb->s_start    = cpu_to_be32(tail_block);
 
@@ -1441,18 +1445,17 @@ static void jbd2_mark_journal_empty(journal_t *journal, 
int write_op)
        journal_superblock_t *sb = journal->j_superblock;
 
        BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
-       read_lock(&journal->j_state_lock);
-       /* Is it already empty? */
-       if (sb->s_start == 0) {
-               read_unlock(&journal->j_state_lock);
+       lock_buffer(journal->j_sb_buffer);
+       if (sb->s_start == 0) {         /* Is it already empty? */
+               unlock_buffer(journal->j_sb_buffer);
                return;
        }
+
        jbd_debug(1, "JBD2: Marking journal as empty (seq %d)\n",
                  journal->j_tail_sequence);
 
        sb->s_sequence = cpu_to_be32(journal->j_tail_sequence);
        sb->s_start    = cpu_to_be32(0);
-       read_unlock(&journal->j_state_lock);
 
        jbd2_write_superblock(journal, write_op);
 
@@ -1475,9 +1478,8 @@ void jbd2_journal_update_sb_errno(journal_t *journal)
        journal_superblock_t *sb = journal->j_superblock;
        int errcode;
 
-       read_lock(&journal->j_state_lock);
+       lock_buffer(journal->j_sb_buffer);
        errcode = journal->j_errno;
-       read_unlock(&journal->j_state_lock);
        if (errcode == -ESHUTDOWN)
                errcode = 0;
        jbd_debug(1, "JBD2: updating superblock error (errno %d)\n", errcode);
@@ -1881,28 +1883,27 @@ int jbd2_journal_set_features (journal_t *journal, 
unsigned long compat,
 
        sb = journal->j_superblock;
 
+       /* Load the checksum driver if necessary */
+       if ((journal->j_chksum_driver == NULL) &&
+           INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V3)) {
+               journal->j_chksum_driver = crypto_alloc_shash("crc32c", 0, 0);
+               if (IS_ERR(journal->j_chksum_driver)) {
+                       printk(KERN_ERR "JBD2: Cannot load crc32c driver.\n");
+                       journal->j_chksum_driver = NULL;
+                       return 0;
+               }
+               /* Precompute checksum seed for all metadata */
+               journal->j_csum_seed = jbd2_chksum(journal, ~0, sb->s_uuid,
+                                                  sizeof(sb->s_uuid));
+       }
+
+       lock_buffer(journal->j_sb_buffer);
+
        /* If enabling v3 checksums, update superblock */
        if (INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V3)) {
                sb->s_checksum_type = JBD2_CRC32C_CHKSUM;
                sb->s_feature_compat &=
                        ~cpu_to_be32(JBD2_FEATURE_COMPAT_CHECKSUM);
-
-               /* Load the checksum driver */
-               if (journal->j_chksum_driver == NULL) {
-                       journal->j_chksum_driver = crypto_alloc_shash("crc32c",
-                                                                     0, 0);
-                       if (IS_ERR(journal->j_chksum_driver)) {
-                               printk(KERN_ERR "JBD2: Cannot load crc32c "
-                                      "driver.\n");
-                               journal->j_chksum_driver = NULL;
-                               return 0;
-                       }
-
-                       /* Precompute checksum seed for all metadata */
-                       journal->j_csum_seed = jbd2_chksum(journal, ~0,
-                                                          sb->s_uuid,
-                                                          sizeof(sb->s_uuid));
-               }
        }
 
        /* If enabling v1 checksums, downgrade superblock */
@@ -1914,6 +1915,7 @@ int jbd2_journal_set_features (journal_t *journal, 
unsigned long compat,
        sb->s_feature_compat    |= cpu_to_be32(compat);
        sb->s_feature_ro_compat |= cpu_to_be32(ro);
        sb->s_feature_incompat  |= cpu_to_be32(incompat);
+       unlock_buffer(journal->j_sb_buffer);
 
        return 1;
 #undef COMPAT_FEATURE_ON
diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
index c204ac9b49e5..81a0d5d82757 100644
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -621,13 +621,15 @@ static void o2nm_node_group_drop_item(struct config_group 
*group,
        struct o2nm_node *node = to_o2nm_node(item);
        struct o2nm_cluster *cluster = 
to_o2nm_cluster(group->cg_item.ci_parent);
 
-       o2net_disconnect_node(node);
+       if (cluster->cl_nodes[node->nd_num] == node) {
+               o2net_disconnect_node(node);
 
-       if (cluster->cl_has_local &&
-           (cluster->cl_local_node == node->nd_num)) {
-               cluster->cl_has_local = 0;
-               cluster->cl_local_node = O2NM_INVALID_NODE_NUM;
-               o2net_stop_listening(node);
+               if (cluster->cl_has_local &&
+                   (cluster->cl_local_node == node->nd_num)) {
+                       cluster->cl_has_local = 0;
+                       cluster->cl_local_node = O2NM_INVALID_NODE_NUM;
+                       o2net_stop_listening(node);
+               }
        }
 
        /* XXX call into net to stop this node from trading messages */
diff --git a/fs/read_write.c b/fs/read_write.c
index 57a00ef895b2..1c3eada2fe25 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -1235,6 +1235,9 @@ COMPAT_SYSCALL_DEFINE5(preadv64v2, unsigned long, fd,
                const struct compat_iovec __user *,vec,
                unsigned long, vlen, loff_t, pos, rwf_t, flags)
 {
+       if (pos == -1)
+               return do_compat_readv(fd, vec, vlen, flags);
+
        return do_compat_preadv64(fd, vec, vlen, pos, flags);
 }
 #endif
@@ -1341,6 +1344,9 @@ COMPAT_SYSCALL_DEFINE5(pwritev64v2, unsigned long, fd,
                const struct compat_iovec __user *,vec,
                unsigned long, vlen, loff_t, pos, rwf_t, flags)
 {
+       if (pos == -1)
+               return do_compat_writev(fd, vec, vlen, flags);
+
        return do_compat_pwritev64(fd, vec, vlen, pos, flags);
 }
 #endif
diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
index e7905d9353e8..93a2469a9130 100644
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -523,7 +523,7 @@ struct cgroup_subsys {
        void (*cancel_fork)(struct task_struct *task);
        void (*fork)(struct task_struct *task);
        void (*exit)(struct task_struct *task);
-       void (*free)(struct task_struct *task);
+       void (*release)(struct task_struct *task);
        void (*bind)(struct cgroup_subsys_state *root_css);
 
        bool early_init:1;
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index dddbc29e2009..8e83c9055ccb 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -118,6 +118,7 @@ extern int cgroup_can_fork(struct task_struct *p);
 extern void cgroup_cancel_fork(struct task_struct *p);
 extern void cgroup_post_fork(struct task_struct *p);
 void cgroup_exit(struct task_struct *p);
+void cgroup_release(struct task_struct *p);
 void cgroup_free(struct task_struct *p);
 
 int cgroup_init_early(void);
@@ -668,6 +669,7 @@ static inline int cgroup_can_fork(struct task_struct *p) { 
return 0; }
 static inline void cgroup_cancel_fork(struct task_struct *p) {}
 static inline void cgroup_post_fork(struct task_struct *p) {}
 static inline void cgroup_exit(struct task_struct *p) {}
+static inline void cgroup_release(struct task_struct *p) {}
 static inline void cgroup_free(struct task_struct *p) {}
 
 static inline int cgroup_init_early(void) { return 0; }
diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
index 2f4e79fe7b86..3eb3376f1cc8 100644
--- a/include/linux/clk-provider.h
+++ b/include/linux/clk-provider.h
@@ -743,6 +743,9 @@ unsigned int __clk_get_enable_count(struct clk *clk);
 unsigned long clk_hw_get_rate(const struct clk_hw *hw);
 unsigned long __clk_get_flags(struct clk *clk);
 unsigned long clk_hw_get_flags(const struct clk_hw *hw);
+#define clk_hw_can_set_rate_parent(hw) \
+       (clk_hw_get_flags((hw)) & CLK_SET_RATE_PARENT)
+
 bool clk_hw_is_prepared(const struct clk_hw *hw);
 bool clk_hw_is_enabled(const struct clk_hw *hw);
 bool __clk_is_enabled(struct clk *clk);
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 42197b16dd78..56d2cda9931b 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -741,7 +741,9 @@ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr,
                     unsigned int alignment,
                     bpf_jit_fill_hole_t bpf_fill_ill_insns);
 void bpf_jit_binary_free(struct bpf_binary_header *hdr);
-
+u64 bpf_jit_alloc_exec_limit(void);
+void *bpf_jit_alloc_exec(unsigned long size);
+void bpf_jit_free_exec(void *addr);
 void bpf_jit_free(struct bpf_prog *fp);
 
 struct bpf_prog *bpf_jit_blind_constants(struct bpf_prog *fp);
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index b6084898d330..234f0d1f8dca 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -65,6 +65,7 @@ struct irq_desc {
        unsigned int            core_internal_state__do_not_mess_with_it;
        unsigned int            depth;          /* nested irq disables */
        unsigned int            wake_depth;     /* nested wake enables */
+       unsigned int            tot_count;
        unsigned int            irq_count;      /* For detecting broken IRQs */
        unsigned long           last_unhandled; /* Aging timer for unhandled 
count */
        unsigned int            irqs_unhandled;
diff --git a/include/linux/relay.h b/include/linux/relay.h
index e1bdf01a86e2..c759f96e39c1 100644
--- a/include/linux/relay.h
+++ b/include/linux/relay.h
@@ -66,7 +66,7 @@ struct rchan
        struct kref kref;               /* channel refcount */
        void *private_data;             /* for user-defined data */
        size_t last_toobig;             /* tried to log event > subbuf size */
-       struct rchan_buf ** __percpu buf; /* per-cpu channel buffers */
+       struct rchan_buf * __percpu *buf; /* per-cpu channel buffers */
        int is_global;                  /* One global buffer ? */
        struct list_head list;          /* for channel list */
        struct dentry *parent;          /* parent dentry passed to open */
diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index 5caa062a02b2..ca52b82128df 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -123,7 +123,7 @@ ring_buffer_consume(struct ring_buffer *buffer, int cpu, 
u64 *ts,
                    unsigned long *lost_events);
 
 struct ring_buffer_iter *
-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu);
+ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags);
 void ring_buffer_read_prepare_sync(void);
 void ring_buffer_read_start(struct ring_buffer_iter *iter);
 void ring_buffer_read_finish(struct ring_buffer_iter *iter);
diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h
index cf257c2e728d..5a92baa91e0c 100644
--- a/include/linux/sched/topology.h
+++ b/include/linux/sched/topology.h
@@ -177,10 +177,10 @@ typedef int (*sched_domain_flags_f)(void);
 #define SDTL_OVERLAP   0x01
 
 struct sd_data {
-       struct sched_domain **__percpu sd;
-       struct sched_domain_shared **__percpu sds;
-       struct sched_group **__percpu sg;
-       struct sched_group_capacity **__percpu sgc;
+       struct sched_domain *__percpu *sd;
+       struct sched_domain_shared *__percpu *sds;
+       struct sched_group *__percpu *sg;
+       struct sched_group_capacity *__percpu *sgc;
 };
 
 struct sched_domain_topology_level {
diff --git a/include/net/netfilter/br_netfilter.h 
b/include/net/netfilter/br_netfilter.h
index 74af19c3a8f7..a4ba601b5d04 100644
--- a/include/net/netfilter/br_netfilter.h
+++ b/include/net/netfilter/br_netfilter.h
@@ -49,7 +49,6 @@ static inline struct rtable *bridge_parent_rtable(const 
struct net_device *dev)
 }
 
 struct net_device *setup_pre_routing(struct sk_buff *skb);
-void br_netfilter_enable(void);
 
 #if IS_ENABLED(CONFIG_IPV6)
 int br_validate_ipv6(struct net *net, struct sk_buff *skb);
diff --git a/include/scsi/libfcoe.h b/include/scsi/libfcoe.h
index 722d3264d3bf..a4e41444f5fe 100644
--- a/include/scsi/libfcoe.h
+++ b/include/scsi/libfcoe.h
@@ -79,7 +79,7 @@ enum fip_state {
  * It must not change after fcoe_ctlr_init() sets it.
  */
 enum fip_mode {
-       FIP_MODE_AUTO = FIP_ST_AUTO,
+       FIP_MODE_AUTO,
        FIP_MODE_NON_FIP,
        FIP_MODE_FABRIC,
        FIP_MODE_VN2VN,
@@ -250,7 +250,7 @@ struct fcoe_rport {
 };
 
 /* FIP API functions */
-void fcoe_ctlr_init(struct fcoe_ctlr *, enum fip_state);
+void fcoe_ctlr_init(struct fcoe_ctlr *, enum fip_mode);
 void fcoe_ctlr_destroy(struct fcoe_ctlr *);
 void fcoe_ctlr_link_up(struct fcoe_ctlr *);
 int fcoe_ctlr_link_down(struct fcoe_ctlr *);
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 7e79358b4473..694b1cc8d144 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -187,7 +187,7 @@ static u64 css_serial_nr_next = 1;
  */
 static u16 have_fork_callback __read_mostly;
 static u16 have_exit_callback __read_mostly;
-static u16 have_free_callback __read_mostly;
+static u16 have_release_callback __read_mostly;
 static u16 have_canfork_callback __read_mostly;
 
 /* cgroup namespace for init task */
@@ -5112,7 +5112,7 @@ static void __init cgroup_init_subsys(struct 
cgroup_subsys *ss, bool early)
 
        have_fork_callback |= (bool)ss->fork << ss->id;
        have_exit_callback |= (bool)ss->exit << ss->id;
-       have_free_callback |= (bool)ss->free << ss->id;
+       have_release_callback |= (bool)ss->release << ss->id;
        have_canfork_callback |= (bool)ss->can_fork << ss->id;
 
        /* At system boot, before all subsystems have been
@@ -5546,16 +5546,19 @@ void cgroup_exit(struct task_struct *tsk)
        } while_each_subsys_mask();
 }
 
-void cgroup_free(struct task_struct *task)
+void cgroup_release(struct task_struct *task)
 {
-       struct css_set *cset = task_css_set(task);
        struct cgroup_subsys *ss;
        int ssid;
 
-       do_each_subsys_mask(ss, ssid, have_free_callback) {
-               ss->free(task);
+       do_each_subsys_mask(ss, ssid, have_release_callback) {
+               ss->release(task);
        } while_each_subsys_mask();
+}
 
+void cgroup_free(struct task_struct *task)
+{
+       struct css_set *cset = task_css_set(task);
        put_css_set(cset);
 }
 
diff --git a/kernel/cgroup/pids.c b/kernel/cgroup/pids.c
index 9829c67ebc0a..c9960baaa14f 100644
--- a/kernel/cgroup/pids.c
+++ b/kernel/cgroup/pids.c
@@ -247,7 +247,7 @@ static void pids_cancel_fork(struct task_struct *task)
        pids_uncharge(pids, 1);
 }
 
-static void pids_free(struct task_struct *task)
+static void pids_release(struct task_struct *task)
 {
        struct pids_cgroup *pids = css_pids(task_css(task, pids_cgrp_id));
 
@@ -342,7 +342,7 @@ struct cgroup_subsys pids_cgrp_subsys = {
        .cancel_attach  = pids_cancel_attach,
        .can_fork       = pids_can_fork,
        .cancel_fork    = pids_cancel_fork,
-       .free           = pids_free,
+       .release        = pids_release,
        .legacy_cftypes = pids_files,
        .dfl_cftypes    = pids_files,
        .threaded       = true,
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 32f0432f0c26..8c350dd81581 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -314,6 +314,15 @@ void cpus_write_unlock(void)
 
 void lockdep_assert_cpus_held(void)
 {
+       /*
+        * We can't have hotplug operations before userspace starts running,
+        * and some init codepaths will knowingly not take the hotplug lock.
+        * This is all valid, so mute lockdep until it makes sense to report
+        * unheld locks.
+        */
+       if (system_state < SYSTEM_RUNNING)
+               return;
+
        percpu_rwsem_assert_held(&cpu_hotplug_lock);
 }
 
diff --git a/kernel/exit.c b/kernel/exit.c
index 5523fb0c20c8..95ce231ff5e2 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -218,6 +218,7 @@ void release_task(struct task_struct *p)
        }
 
        write_unlock_irq(&tasklist_lock);
+       cgroup_release(p);
        release_thread(p);
        call_rcu(&p->rcu, delayed_put_task_struct);
 
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 5a2ef92c2782..0fa7ef74303b 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -834,7 +834,11 @@ void handle_percpu_irq(struct irq_desc *desc)
 {
        struct irq_chip *chip = irq_desc_get_chip(desc);
 
-       kstat_incr_irqs_this_cpu(desc);
+       /*
+        * PER CPU interrupts are not serialized. Do not touch
+        * desc->tot_count.
+        */
+       __kstat_incr_irqs_this_cpu(desc);
 
        if (chip->irq_ack)
                chip->irq_ack(&desc->irq_data);
@@ -863,7 +867,11 @@ void handle_percpu_devid_irq(struct irq_desc *desc)
        unsigned int irq = irq_desc_get_irq(desc);
        irqreturn_t res;
 
-       kstat_incr_irqs_this_cpu(desc);
+       /*
+        * PER CPU interrupts are not serialized. Do not touch
+        * desc->tot_count.
+        */
+       __kstat_incr_irqs_this_cpu(desc);
 
        if (chip->irq_ack)
                chip->irq_ack(&desc->irq_data);
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 44ed5f8c8759..4ef7f3b820ce 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -240,12 +240,18 @@ static inline void irq_state_set_masked(struct irq_desc 
*desc)
 
 #undef __irqd_to_state
 
-static inline void kstat_incr_irqs_this_cpu(struct irq_desc *desc)
+static inline void __kstat_incr_irqs_this_cpu(struct irq_desc *desc)
 {
        __this_cpu_inc(*desc->kstat_irqs);
        __this_cpu_inc(kstat.irqs_sum);
 }
 
+static inline void kstat_incr_irqs_this_cpu(struct irq_desc *desc)
+{
+       __kstat_incr_irqs_this_cpu(desc);
+       desc->tot_count++;
+}
+
 static inline int irq_desc_get_node(struct irq_desc *desc)
 {
        return irq_common_data_get_node(&desc->irq_common_data);
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index e97bbae947f0..c2bfb11a9d05 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -119,6 +119,7 @@ static void desc_set_defaults(unsigned int irq, struct 
irq_desc *desc, int node,
        desc->depth = 1;
        desc->irq_count = 0;
        desc->irqs_unhandled = 0;
+       desc->tot_count = 0;
        desc->name = NULL;
        desc->owner = owner;
        for_each_possible_cpu(cpu)
@@ -895,11 +896,15 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
 unsigned int kstat_irqs(unsigned int irq)
 {
        struct irq_desc *desc = irq_to_desc(irq);
-       int cpu;
        unsigned int sum = 0;
+       int cpu;
 
        if (!desc || !desc->kstat_irqs)
                return 0;
+       if (!irq_settings_is_per_cpu_devid(desc) &&
+           !irq_settings_is_per_cpu(desc))
+           return desc->tot_count;
+
        for_each_possible_cpu(cpu)
                sum += *per_cpu_ptr(desc->kstat_irqs, cpu);
        return sum;
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index 2f93e4a2d9f6..187c04a34ba1 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -339,6 +339,7 @@ void register_sched_domain_sysctl(void)
 {
        static struct ctl_table *cpu_entries;
        static struct ctl_table **cpu_idx;
+       static bool init_done = false;
        char buf[32];
        int i;
 
@@ -368,7 +369,10 @@ void register_sched_domain_sysctl(void)
        if (!cpumask_available(sd_sysctl_cpus)) {
                if (!alloc_cpumask_var(&sd_sysctl_cpus, GFP_KERNEL))
                        return;
+       }
 
+       if (!init_done) {
+               init_done = true;
                /* init to possible to not have holes in @cpu_entries */
                cpumask_copy(sd_sysctl_cpus, cpu_possible_mask);
        }
diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index 659e075ef70b..9dcd80ed9d4c 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -499,7 +499,7 @@ static int __init isolated_cpu_setup(char *str)
 __setup("isolcpus=", isolated_cpu_setup);
 
 struct s_data {
-       struct sched_domain ** __percpu sd;
+       struct sched_domain * __percpu *sd;
        struct root_domain      *rd;
 };
 
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index a7acb058b776..34a3b8a262a9 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -125,6 +125,7 @@ static int __maybe_unused one = 1;
 static int __maybe_unused two = 2;
 static int __maybe_unused four = 4;
 static unsigned long one_ul = 1;
+static unsigned long long_max = LONG_MAX;
 static int one_hundred = 100;
 static int one_thousand = 1000;
 #ifdef CONFIG_PRINTK
@@ -1681,6 +1682,8 @@ static struct ctl_table fs_table[] = {
                .maxlen         = sizeof(files_stat.max_files),
                .mode           = 0644,
                .proc_handler   = proc_doulongvec_minmax,
+               .extra1         = &zero,
+               .extra2         = &long_max,
        },
        {
                .procname       = "nr_open",
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index a1d5e0949dcf..5f7f4f07499f 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -4010,6 +4010,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);
  * ring_buffer_read_prepare - Prepare for a non consuming read of the buffer
  * @buffer: The ring buffer to read from
  * @cpu: The cpu buffer to iterate over
+ * @flags: gfp flags to use for memory allocation
  *
  * This performs the initial preparations necessary to iterate
  * through the buffer.  Memory is allocated, buffer recording
@@ -4027,7 +4028,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);
  * This overall must be paired with ring_buffer_read_finish.
  */
 struct ring_buffer_iter *
-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu)
+ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags)
 {
        struct ring_buffer_per_cpu *cpu_buffer;
        struct ring_buffer_iter *iter;
@@ -4035,7 +4036,7 @@ ring_buffer_read_prepare(struct ring_buffer *buffer, int 
cpu)
        if (!cpumask_test_cpu(cpu, buffer->cpumask))
                return NULL;
 
-       iter = kmalloc(sizeof(*iter), GFP_KERNEL);
+       iter = kmalloc(sizeof(*iter), flags);
        if (!iter)
                return NULL;
 
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 287e61aba57c..ffddb5ac255c 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3901,7 +3901,8 @@ __tracing_open(struct inode *inode, struct file *file, 
bool snapshot)
        if (iter->cpu_file == RING_BUFFER_ALL_CPUS) {
                for_each_tracing_cpu(cpu) {
                        iter->buffer_iter[cpu] =
-                               
ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu);
+                               
ring_buffer_read_prepare(iter->trace_buffer->buffer,
+                                                        cpu, GFP_KERNEL);
                }
                ring_buffer_read_prepare_sync();
                for_each_tracing_cpu(cpu) {
@@ -3911,7 +3912,8 @@ __tracing_open(struct inode *inode, struct file *file, 
bool snapshot)
        } else {
                cpu = iter->cpu_file;
                iter->buffer_iter[cpu] =
-                       ring_buffer_read_prepare(iter->trace_buffer->buffer, 
cpu);
+                       ring_buffer_read_prepare(iter->trace_buffer->buffer,
+                                                cpu, GFP_KERNEL);
                ring_buffer_read_prepare_sync();
                ring_buffer_read_start(iter->buffer_iter[cpu]);
                tracing_iter_reset(iter, cpu);
diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c
index d953c163a079..810d78a8d14c 100644
--- a/kernel/trace/trace_kdb.c
+++ b/kernel/trace/trace_kdb.c
@@ -51,14 +51,16 @@ static void ftrace_dump_buf(int skip_lines, long cpu_file)
        if (cpu_file == RING_BUFFER_ALL_CPUS) {
                for_each_tracing_cpu(cpu) {
                        iter.buffer_iter[cpu] =
-                       ring_buffer_read_prepare(iter.trace_buffer->buffer, 
cpu);
+                       ring_buffer_read_prepare(iter.trace_buffer->buffer,
+                                                cpu, GFP_ATOMIC);
                        ring_buffer_read_start(iter.buffer_iter[cpu]);
                        tracing_iter_reset(&iter, cpu);
                }
        } else {
                iter.cpu_file = cpu_file;
                iter.buffer_iter[cpu_file] =
-                       ring_buffer_read_prepare(iter.trace_buffer->buffer, 
cpu_file);
+                       ring_buffer_read_prepare(iter.trace_buffer->buffer,
+                                                cpu_file, GFP_ATOMIC);
                ring_buffer_read_start(iter.buffer_iter[cpu_file]);
                tracing_iter_reset(&iter, cpu_file);
        }
diff --git a/lib/bsearch.c b/lib/bsearch.c
index 18b445b010c3..82512fe7b33c 100644
--- a/lib/bsearch.c
+++ b/lib/bsearch.c
@@ -11,6 +11,7 @@
 
 #include <linux/export.h>
 #include <linux/bsearch.h>
+#include <linux/kprobes.h>
 
 /*
  * bsearch - binary search an array of elements
@@ -53,3 +54,4 @@ void *bsearch(const void *key, const void *base, size_t num, 
size_t size,
        return NULL;
 }
 EXPORT_SYMBOL(bsearch);
+NOKPROBE_SYMBOL(bsearch);
diff --git a/lib/int_sqrt.c b/lib/int_sqrt.c
index 036c96781ea8..67bb300b5b46 100644
--- a/lib/int_sqrt.c
+++ b/lib/int_sqrt.c
@@ -8,6 +8,7 @@
 
 #include <linux/kernel.h>
 #include <linux/export.h>
+#include <linux/bitops.h>
 
 /**
  * int_sqrt - rough approximation to sqrt
@@ -22,10 +23,7 @@ unsigned long int_sqrt(unsigned long x)
        if (x <= 1)
                return x;
 
-       m = 1UL << (BITS_PER_LONG - 2);
-       while (m > x)
-               m >>= 2;
-
+       m = 1UL << (__fls(x) & ~1UL);
        while (m != 0) {
                b = y + m;
                y >>= 1;
diff --git a/lib/raid6/Makefile b/lib/raid6/Makefile
index ad523be0313b..e0f3b38d6dcb 100644
--- a/lib/raid6/Makefile
+++ b/lib/raid6/Makefile
@@ -40,7 +40,7 @@ endif
 ifeq ($(CONFIG_KERNEL_MODE_NEON),y)
 NEON_FLAGS := -ffreestanding
 ifeq ($(ARCH),arm)
-NEON_FLAGS += -mfloat-abi=softfp -mfpu=neon
+NEON_FLAGS += -march=armv7-a -mfloat-abi=softfp -mfpu=neon
 endif
 CFLAGS_recov_neon_inner.o += $(NEON_FLAGS)
 ifeq ($(ARCH),arm64)
diff --git a/mm/cma.c b/mm/cma.c
index 022e52bd8370..5749c9b3b5d0 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -348,12 +348,14 @@ int __init cma_declare_contiguous(phys_addr_t base,
 
        ret = cma_init_reserved_mem(base, size, order_per_bit, name, res_cma);
        if (ret)
-               goto err;
+               goto free_mem;
 
        pr_info("Reserved %ld MiB at %pa\n", (unsigned long)size / SZ_1M,
                &base);
        return 0;
 
+free_mem:
+       memblock_free(base, size);
 err:
        pr_err("Failed to reserve %ld MiB\n", (unsigned long)size / SZ_1M);
        return ret;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 1331645a3794..6ca0225335eb 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -349,7 +349,7 @@ static void mpol_rebind_policy(struct mempolicy *pol, const 
nodemask_t *newmask)
 {
        if (!pol)
                return;
-       if (!mpol_store_user_nodemask(pol) &&
+       if (!mpol_store_user_nodemask(pol) && !(pol->flags & MPOL_F_LOCAL) &&
            nodes_equal(pol->w.cpuset_mems_allowed, *newmask))
                return;
 
@@ -427,6 +427,13 @@ static inline bool queue_pages_required(struct page *page,
        return node_isset(nid, *qp->nmask) == !(flags & MPOL_MF_INVERT);
 }
 
+/*
+ * queue_pages_pmd() has three possible return values:
+ * 1 - pages are placed on the right node or queued successfully.
+ * 0 - THP was split.
+ * -EIO - is migration entry or MPOL_MF_STRICT was specified and an existing
+ *        page was already on a node that does not follow the policy.
+ */
 static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
                                unsigned long end, struct mm_walk *walk)
 {
@@ -436,7 +443,7 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, 
unsigned long addr,
        unsigned long flags;
 
        if (unlikely(is_pmd_migration_entry(*pmd))) {
-               ret = 1;
+               ret = -EIO;
                goto unlock;
        }
        page = pmd_page(*pmd);
@@ -462,8 +469,15 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, 
unsigned long addr,
        ret = 1;
        flags = qp->flags;
        /* go to thp migration */
-       if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))
+       if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
+               if (!vma_migratable(walk->vma)) {
+                       ret = -EIO;
+                       goto unlock;
+               }
+
                migrate_page_add(page, qp->pagelist, flags);
+       } else
+               ret = -EIO;
 unlock:
        spin_unlock(ptl);
 out:
@@ -488,8 +502,10 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long 
addr,
        ptl = pmd_trans_huge_lock(pmd, vma);
        if (ptl) {
                ret = queue_pages_pmd(pmd, ptl, addr, end, walk);
-               if (ret)
+               if (ret > 0)
                        return 0;
+               else if (ret < 0)
+                       return ret;
        }
 
        if (pmd_trans_unstable(pmd))
@@ -526,11 +542,16 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned 
long addr,
                        goto retry;
                }
 
-               migrate_page_add(page, qp->pagelist, flags);
+               if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
+                       if (!vma_migratable(vma))
+                               break;
+                       migrate_page_add(page, qp->pagelist, flags);
+               } else
+                       break;
        }
        pte_unmap_unlock(pte - 1, ptl);
        cond_resched();
-       return 0;
+       return addr != end ? -EIO : 0;
 }
 
 static int queue_pages_hugetlb(pte_t *pte, unsigned long hmask,
@@ -600,7 +621,12 @@ static int queue_pages_test_walk(unsigned long start, 
unsigned long end,
        unsigned long endvma = vma->vm_end;
        unsigned long flags = qp->flags;
 
-       if (!vma_migratable(vma))
+       /*
+        * Need check MPOL_MF_STRICT to return -EIO if possible
+        * regardless of vma_migratable
+        */
+       if (!vma_migratable(vma) &&
+           !(flags & MPOL_MF_STRICT))
                return 1;
 
        if (endvma > end)
@@ -627,7 +653,7 @@ static int queue_pages_test_walk(unsigned long start, 
unsigned long end,
        }
 
        /* queue pages from current vma */
-       if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))
+       if (flags & MPOL_MF_VALID)
                return 0;
        return 1;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 40075c1946b3..923deb33bf34 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1764,8 +1764,8 @@ inline void post_alloc_hook(struct page *page, unsigned 
int order,
 
        arch_alloc_page(page, order);
        kernel_map_pages(page, 1 << order, 1);
-       kernel_poison_pages(page, 1 << order, 1);
        kasan_alloc_pages(page, order);
+       kernel_poison_pages(page, 1 << order, 1);
        set_page_owner(page, order, gfp_flags);
 }
 
diff --git a/mm/page_ext.c b/mm/page_ext.c
index 2c44f5b78435..dece2bdf86fe 100644
--- a/mm/page_ext.c
+++ b/mm/page_ext.c
@@ -271,6 +271,7 @@ static void free_page_ext(void *addr)
                table_size = get_entry_size() * PAGES_PER_SECTION;
 
                BUG_ON(PageReserved(page));
+               kmemleak_free(addr);
                free_pages_exact(addr, table_size);
        }
 }
diff --git a/mm/page_poison.c b/mm/page_poison.c
index e83fd44867de..a7ba9e315a12 100644
--- a/mm/page_poison.c
+++ b/mm/page_poison.c
@@ -6,6 +6,7 @@
 #include <linux/page_ext.h>
 #include <linux/poison.h>
 #include <linux/ratelimit.h>
+#include <linux/kasan.h>
 
 static bool want_page_poisoning __read_mostly;
 
@@ -34,7 +35,10 @@ static void poison_page(struct page *page)
 {
        void *addr = kmap_atomic(page);
 
+       /* KASAN still think the page is in-use, so skip it. */
+       kasan_disable_current();
        memset(addr, PAGE_POISON, PAGE_SIZE);
+       kasan_enable_current();
        kunmap_atomic(addr);
 }
 
diff --git a/mm/slab.c b/mm/slab.c
index 09df506ae830..f4658468b23e 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -563,14 +563,6 @@ static void start_cpu_timer(int cpu)
 
 static void init_arraycache(struct array_cache *ac, int limit, int batch)
 {
-       /*
-        * The array_cache structures contain pointers to free object.
-        * However, when such objects are allocated or transferred to another
-        * cache the pointers are not cleared and they could be counted as
-        * valid references during a kmemleak scan. Therefore, kmemleak must
-        * not scan such objects.
-        */
-       kmemleak_no_scan(ac);
        if (ac) {
                ac->avail = 0;
                ac->limit = limit;
@@ -586,6 +578,14 @@ static struct array_cache *alloc_arraycache(int node, int 
entries,
        struct array_cache *ac = NULL;
 
        ac = kmalloc_node(memsize, gfp, node);
+       /*
+        * The array_cache structures contain pointers to free object.
+        * However, when such objects are allocated or transferred to another
+        * cache the pointers are not cleared and they could be counted as
+        * valid references during a kmemleak scan. Therefore, kmemleak must
+        * not scan such objects.
+        */
+       kmemleak_no_scan(ac);
        init_arraycache(ac, entries, batchcount);
        return ac;
 }
@@ -680,6 +680,7 @@ static struct alien_cache *__alloc_alien_cache(int node, 
int entries,
 
        alc = kmalloc_node(memsize, gfp, node);
        if (alc) {
+               kmemleak_no_scan(alc);
                init_arraycache(&alc->ac, entries, batch);
                spin_lock_init(&alc->lock);
        }
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 8d9f636d0c98..6c906f6f16cc 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -498,7 +498,11 @@ static struct vmap_area *alloc_vmap_area(unsigned long 
size,
        }
 
 found:
-       if (addr + size > vend)
+       /*
+        * Check also calculated address against the vstart,
+        * because it can be 0 because of big align request.
+        */
+       if (addr + size > vend || addr < vstart)
                goto overflow;
 
        va->va_start = addr;
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 3f3859b8d49f..5fd283d9929e 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -881,11 +881,6 @@ static const struct nf_br_ops br_ops = {
        .br_dev_xmit_hook =     br_nf_dev_xmit,
 };
 
-void br_netfilter_enable(void)
-{
-}
-EXPORT_SYMBOL_GPL(br_netfilter_enable);
-
 /* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
  * br_dev_queue_push_xmit is called afterwards */
 static const struct nf_hook_ops br_nf_ops[] = {
diff --git a/net/netfilter/nf_conntrack_core.c 
b/net/netfilter/nf_conntrack_core.c
index f07357ba9629..06520bf30f29 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -763,10 +763,18 @@ __nf_conntrack_confirm(struct sk_buff *skb)
         * REJECT will give spurious warnings here.
         */
 
-       /* No external references means no one else could have
-        * confirmed us.
+       /* Another skb with the same unconfirmed conntrack may
+        * win the race. This may happen for bridge(br_flood)
+        * or broadcast/multicast packets do skb_clone with
+        * unconfirmed conntrack.
         */
-       WARN_ON(nf_ct_is_confirmed(ct));
+       if (unlikely(nf_ct_is_confirmed(ct))) {
+               WARN_ON_ONCE(1);
+               nf_conntrack_double_unlock(hash, reply_hash);
+               local_bh_enable();
+               return NF_DROP;
+       }
+
        pr_debug("Confirming conntrack %p\n", ct);
        /* We have to check the DYING flag after unlink to prevent
         * a race against nf_ct_get_next_corpse() possibly called from
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index bb33598e4530..ec247d8370e8 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -96,8 +96,7 @@ physdev_mt(const struct sk_buff *skb, struct xt_action_param 
*par)
 static int physdev_mt_check(const struct xt_mtchk_param *par)
 {
        const struct xt_physdev_info *info = par->matchinfo;
-
-       br_netfilter_enable();
+       static bool brnf_probed __read_mostly;
 
        if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
            info->bitmask & ~XT_PHYSDEV_OP_MASK)
@@ -113,6 +112,12 @@ static int physdev_mt_check(const struct xt_mtchk_param 
*par)
                if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
                        return -EINVAL;
        }
+
+       if (!brnf_probed) {
+               brnf_probed = true;
+               request_module("br_netfilter");
+       }
+
        return 0;
 }
 
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index a5d9c0146ac3..b72aa48f6478 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3339,12 +3339,16 @@ static int selinux_inode_setsecurity(struct inode 
*inode, const char *name,
                                     const void *value, size_t size, int flags)
 {
        struct inode_security_struct *isec = inode_security_novalidate(inode);
+       struct superblock_security_struct *sbsec = inode->i_sb->s_security;
        u32 newsid;
        int rc;
 
        if (strcmp(name, XATTR_SELINUX_SUFFIX))
                return -EOPNOTSUPP;
 
+       if (!(sbsec->flags & SBLABEL_MNT))
+               return -EOPNOTSUPP;
+
        if (!value || !size)
                return -EACCES;
 
@@ -6103,7 +6107,10 @@ static void selinux_inode_invalidate_secctx(struct inode 
*inode)
  */
 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 
ctxlen)
 {
-       return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, 
ctxlen, 0);
+       int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
+                                          ctx, ctxlen, 0);
+       /* Do not return error when suppressing label (SBLABEL_MNT not set). */
+       return rc == -EOPNOTSUPP ? 0 : rc;
 }
 
 /*
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 1a63d456a3dc..182e4afd21eb 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1482,6 +1482,14 @@ int snd_pcm_suspend_all(struct snd_pcm *pcm)
                        /* FIXME: the open/close code should lock this as well 
*/
                        if (substream->runtime == NULL)
                                continue;
+
+                       /*
+                        * Skip BE dai link PCM's that are internal and may
+                        * not have their substream ops set.
+                        */
+                       if (!substream->ops)
+                               continue;
+
                        err = snd_pcm_suspend(substream);
                        if (err < 0 && err != -EBUSY)
                                return err;
diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c
index 2db4d0c80d33..393100edd5fd 100644
--- a/sound/soc/fsl/fsl-asoc-card.c
+++ b/sound/soc/fsl/fsl-asoc-card.c
@@ -689,6 +689,7 @@ static int fsl_asoc_card_probe(struct platform_device *pdev)
 asrc_fail:
        of_node_put(asrc_np);
        of_node_put(codec_np);
+       put_device(&cpu_pdev->dev);
 fail:
        of_node_put(cpu_np);
 
diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
index b99e0b5e00e9..8e525f7ac08d 100644
--- a/sound/soc/fsl/imx-sgtl5000.c
+++ b/sound/soc/fsl/imx-sgtl5000.c
@@ -115,6 +115,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
                ret = -EPROBE_DEFER;
                goto fail;
        }
+       put_device(&ssi_pdev->dev);
        codec_dev = of_find_i2c_device_by_node(codec_np);
        if (!codec_dev) {
                dev_err(&pdev->dev, "failed to find codec platform device\n");
diff --git a/tools/lib/traceevent/event-parse.c 
b/tools/lib/traceevent/event-parse.c
index 9a17bc27296e..3955ba9e6fcb 100644
--- a/tools/lib/traceevent/event-parse.c
+++ b/tools/lib/traceevent/event-parse.c
@@ -2430,7 +2430,7 @@ static int arg_num_eval(struct print_arg *arg, long long 
*val)
 static char *arg_eval (struct print_arg *arg)
 {
        long long val;
-       static char buf[20];
+       static char buf[24];
 
        switch (arg->type) {
        case PRINT_ATOM:
diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
index fb76423022e8..32e64a8a6443 100644
--- a/tools/perf/builtin-c2c.c
+++ b/tools/perf/builtin-c2c.c
@@ -1935,6 +1935,12 @@ static int setup_nodes(struct perf_session *session)
                if (!set)
                        return -ENOMEM;
 
+               nodes[node] = set;
+
+               /* empty node, skip */
+               if (cpu_map__empty(map))
+                       continue;
+
                for (cpu = 0; cpu < map->nr; cpu++) {
                        set_bit(map->map[cpu], set);
 
@@ -1943,8 +1949,6 @@ static int setup_nodes(struct perf_session *session)
 
                        cpu2node[map->map[cpu]] = node;
                }
-
-               nodes[node] = set;
        }
 
        setup_nodes_header();
diff --git a/tools/perf/tests/evsel-tp-sched.c 
b/tools/perf/tests/evsel-tp-sched.c
index 67bcbf876776..d0406116c905 100644
--- a/tools/perf/tests/evsel-tp-sched.c
+++ b/tools/perf/tests/evsel-tp-sched.c
@@ -43,7 +43,7 @@ int test__perf_evsel__tp_sched_test(struct test *test 
__maybe_unused, int subtes
                return -1;
        }
 
-       if (perf_evsel__test_field(evsel, "prev_comm", 16, true))
+       if (perf_evsel__test_field(evsel, "prev_comm", 16, false))
                ret = -1;
 
        if (perf_evsel__test_field(evsel, "prev_pid", 4, true))
@@ -55,7 +55,7 @@ int test__perf_evsel__tp_sched_test(struct test *test 
__maybe_unused, int subtes
        if (perf_evsel__test_field(evsel, "prev_state", sizeof(long), true))
                ret = -1;
 
-       if (perf_evsel__test_field(evsel, "next_comm", 16, true))
+       if (perf_evsel__test_field(evsel, "next_comm", 16, false))
                ret = -1;
 
        if (perf_evsel__test_field(evsel, "next_pid", 4, true))
@@ -73,7 +73,7 @@ int test__perf_evsel__tp_sched_test(struct test *test 
__maybe_unused, int subtes
                return -1;
        }
 
-       if (perf_evsel__test_field(evsel, "comm", 16, true))
+       if (perf_evsel__test_field(evsel, "comm", 16, false))
                ret = -1;
 
        if (perf_evsel__test_field(evsel, "pid", 4, true))

Reply via email to