Linux patch 5.4.545.4-54

Signed-off-by: Mike Pagano <mpagano@gentoo.org>

2 files changed, 4405 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 855b8b40..d3d15361 100644
--- a/0000_README
+++ b/0000_README
@@ -255,6 +255,10 @@ Patch:  1052_linux-5.4.53.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.4.53
 
+Patch:  1053_linux-5.4.54.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.4.54
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1053_linux-5.4.54.patch b/1053_linux-5.4.54.patch
new file mode 100644
index 00000000..9161916e
--- /dev/null
+++ b/1053_linux-5.4.54.patch
@@ -0,0 +1,4401 @@
+diff --git a/Makefile b/Makefile
+index d33b312a14e3..ea711f30de29 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 4
+-SUBLEVEL = 53
++SUBLEVEL = 54
+ EXTRAVERSION =
+ NAME = Kleptomaniac Octopus
+ 
+@@ -528,7 +528,7 @@ ifneq ($(shell $(CC) --version 2>&1 | head -n 1 | grep clang),)
+ ifneq ($(CROSS_COMPILE),)
+ CLANG_FLAGS	+= --target=$(notdir $(CROSS_COMPILE:%-=%))
+ GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)elfedit))
+-CLANG_FLAGS	+= --prefix=$(GCC_TOOLCHAIN_DIR)
++CLANG_FLAGS	+= --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE))
+ GCC_TOOLCHAIN	:= $(realpath $(GCC_TOOLCHAIN_DIR)/..)
+ endif
+ ifneq ($(GCC_TOOLCHAIN),)
+diff --git a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
+index c23ba229fd05..8c33510c9519 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
+@@ -105,19 +105,16 @@
+ 	sound-digital {
+ 		compatible = "simple-audio-card";
+ 		simple-audio-card,name = "tda1997x-audio";
++		simple-audio-card,format = "i2s";
++		simple-audio-card,bitclock-master = <&sound_codec>;
++		simple-audio-card,frame-master = <&sound_codec>;
+ 
+-		simple-audio-card,dai-link@0 {
+-			format = "i2s";
+-
+-			cpu {
+-				sound-dai = <&ssi2>;
+-			};
++		sound_cpu: simple-audio-card,cpu {
++			sound-dai = <&ssi1>;
++		};
+ 
+-			codec {
+-				bitclock-master;
+-				frame-master;
+-				sound-dai = <&hdmi_receiver>;
+-			};
++		sound_codec: simple-audio-card,codec {
++			sound-dai = <&hdmi_receiver>;
+ 		};
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
+index 7f2ddb78da5f..4227da71cc62 100644
+--- a/arch/arm/boot/dts/omap3-n900.dts
++++ b/arch/arm/boot/dts/omap3-n900.dts
+@@ -105,6 +105,14 @@
+ 			linux,code = <SW_FRONT_PROXIMITY>;
+ 			linux,can-disable;
+ 		};
++
++		machine_cover {
++			label = "Machine Cover";
++			gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* 160 */
++			linux,input-type = <EV_SW>;
++			linux,code = <SW_MACHINE_COVER>;
++			linux,can-disable;
++		};
+ 	};
+ 
+ 	isp1707: isp1707 {
+@@ -814,10 +822,6 @@
+ 	pinctrl-0 = <&mmc1_pins>;
+ 	vmmc-supply = <&vmmc1>;
+ 	bus-width = <4>;
+-	/* For debugging, it is often good idea to remove this GPIO.
+-	   It means you can remove back cover (to reboot by removing
+-	   battery) and still use the MMC card. */
+-	cd-gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* 160 */
+ };
+ 
+ /* most boards use vaux3, only some old versions use vmmc2 instead */
+diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
+index 7569deb1eac1..d64a3c1e1b6b 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -396,14 +396,14 @@ void user_rewind_single_step(struct task_struct *task)
+ 	 * If single step is active for this thread, then set SPSR.SS
+ 	 * to 1 to avoid returning to the active-pending state.
+ 	 */
+-	if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
++	if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
+ 		set_regs_spsr_ss(task_pt_regs(task));
+ }
+ NOKPROBE_SYMBOL(user_rewind_single_step);
+ 
+ void user_fastforward_single_step(struct task_struct *task)
+ {
+-	if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
++	if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
+ 		clear_regs_spsr_ss(task_pt_regs(task));
+ }
+ 
+diff --git a/arch/mips/pci/pci-xtalk-bridge.c b/arch/mips/pci/pci-xtalk-bridge.c
+index 30017d5945bc..6ce76b18186e 100644
+--- a/arch/mips/pci/pci-xtalk-bridge.c
++++ b/arch/mips/pci/pci-xtalk-bridge.c
+@@ -444,9 +444,10 @@ static int bridge_probe(struct platform_device *pdev)
+ 		return -ENOMEM;
+ 	domain = irq_domain_create_hierarchy(parent, 0, 8, fn,
+ 					     &bridge_domain_ops, NULL);
+-	irq_domain_free_fwnode(fn);
+-	if (!domain)
++	if (!domain) {
++		irq_domain_free_fwnode(fn);
+ 		return -ENOMEM;
++	}
+ 
+ 	pci_set_flags(PCI_PROBE_ONLY);
+ 
+diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
+index 118953d41763..6dd4171c9530 100644
+--- a/arch/parisc/include/asm/atomic.h
++++ b/arch/parisc/include/asm/atomic.h
+@@ -212,6 +212,8 @@ atomic64_set(atomic64_t *v, s64 i)
+ 	_atomic_spin_unlock_irqrestore(v, flags);
+ }
+ 
++#define atomic64_set_release(v, i)	atomic64_set((v), (i))
++
+ static __inline__ s64
+ atomic64_read(const atomic64_t *v)
+ {
+diff --git a/arch/riscv/include/asm/barrier.h b/arch/riscv/include/asm/barrier.h
+index 3f1737f301cc..d0e24aaa2aa0 100644
+--- a/arch/riscv/include/asm/barrier.h
++++ b/arch/riscv/include/asm/barrier.h
+@@ -58,8 +58,16 @@ do {									\
+  * The AQ/RL pair provides a RCpc critical section, but there's not really any
+  * way we can take advantage of that here because the ordering is only enforced
+  * on that one lock.  Thus, we're just doing a full fence.
++ *
++ * Since we allow writeX to be called from preemptive regions we need at least
++ * an "o" in the predecessor set to ensure device writes are visible before the
++ * task is marked as available for scheduling on a new hart.  While I don't see
++ * any concrete reason we need a full IO fence, it seems safer to just upgrade
++ * this in order to avoid any IO crossing a scheduling boundary.  In both
++ * instances the scheduler pairs this with an mb(), so nothing is necessary on
++ * the new hart.
+  */
+-#define smp_mb__after_spinlock()	RISCV_FENCE(rw,rw)
++#define smp_mb__after_spinlock()	RISCV_FENCE(iorw,iorw)
+ 
+ #include <asm-generic/barrier.h>
+ 
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index f0262cb5657a..16699101fd2f 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -2329,12 +2329,12 @@ static int mp_irqdomain_create(int ioapic)
+ 	ip->irqdomain = irq_domain_create_linear(fn, hwirqs, cfg->ops,
+ 						 (void *)(long)ioapic);
+ 
+-	/* Release fw handle if it was allocated above */
+-	if (!cfg->dev)
+-		irq_domain_free_fwnode(fn);
+-
+-	if (!ip->irqdomain)
++	if (!ip->irqdomain) {
++		/* Release fw handle if it was allocated above */
++		if (!cfg->dev)
++			irq_domain_free_fwnode(fn);
+ 		return -ENOMEM;
++	}
+ 
+ 	ip->irqdomain->parent = parent;
+ 
+diff --git a/arch/x86/kernel/apic/msi.c b/arch/x86/kernel/apic/msi.c
+index 159bd0cb8548..a20873bbbed6 100644
+--- a/arch/x86/kernel/apic/msi.c
++++ b/arch/x86/kernel/apic/msi.c
+@@ -262,12 +262,13 @@ void __init arch_init_msi_domain(struct irq_domain *parent)
+ 		msi_default_domain =
+ 			pci_msi_create_irq_domain(fn, &pci_msi_domain_info,
+ 						  parent);
+-		irq_domain_free_fwnode(fn);
+ 	}
+-	if (!msi_default_domain)
++	if (!msi_default_domain) {
++		irq_domain_free_fwnode(fn);
+ 		pr_warn("failed to initialize irqdomain for MSI/MSI-x.\n");
+-	else
++	} else {
+ 		msi_default_domain->flags |= IRQ_DOMAIN_MSI_NOMASK_QUIRK;
++	}
+ }
+ 
+ #ifdef CONFIG_IRQ_REMAP
+@@ -300,7 +301,8 @@ struct irq_domain *arch_create_remap_msi_irq_domain(struct irq_domain *parent,
+ 	if (!fn)
+ 		return NULL;
+ 	d = pci_msi_create_irq_domain(fn, &pci_msi_ir_domain_info, parent);
+-	irq_domain_free_fwnode(fn);
++	if (!d)
++		irq_domain_free_fwnode(fn);
+ 	return d;
+ }
+ #endif
+@@ -363,7 +365,8 @@ static struct irq_domain *dmar_get_irq_domain(void)
+ 	if (fn) {
+ 		dmar_domain = msi_create_irq_domain(fn, &dmar_msi_domain_info,
+ 						    x86_vector_domain);
+-		irq_domain_free_fwnode(fn);
++		if (!dmar_domain)
++			irq_domain_free_fwnode(fn);
+ 	}
+ out:
+ 	mutex_unlock(&dmar_lock);
+@@ -488,7 +491,10 @@ struct irq_domain *hpet_create_irq_domain(int hpet_id)
+ 	}
+ 
+ 	d = msi_create_irq_domain(fn, domain_info, parent);
+-	irq_domain_free_fwnode(fn);
++	if (!d) {
++		irq_domain_free_fwnode(fn);
++		kfree(domain_info);
++	}
+ 	return d;
+ }
+ 
+diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
+index 18c0dca08163..df4d5385e6dd 100644
+--- a/arch/x86/kernel/apic/vector.c
++++ b/arch/x86/kernel/apic/vector.c
+@@ -701,7 +701,6 @@ int __init arch_early_irq_init(void)
+ 	x86_vector_domain = irq_domain_create_tree(fn, &x86_vector_domain_ops,
+ 						   NULL);
+ 	BUG_ON(x86_vector_domain == NULL);
+-	irq_domain_free_fwnode(fn);
+ 	irq_set_default_host(x86_vector_domain);
+ 
+ 	arch_init_msi_domain(x86_vector_domain);
+diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
+index bac1a65a9d39..1afe211d7a7c 100644
+--- a/arch/x86/kernel/vmlinux.lds.S
++++ b/arch/x86/kernel/vmlinux.lds.S
+@@ -362,6 +362,7 @@ SECTIONS
+ 	.bss : AT(ADDR(.bss) - LOAD_OFFSET) {
+ 		__bss_start = .;
+ 		*(.bss..page_aligned)
++		. = ALIGN(PAGE_SIZE);
+ 		*(BSS_MAIN)
+ 		BSS_DECRYPTED
+ 		. = ALIGN(PAGE_SIZE);
+diff --git a/arch/x86/math-emu/wm_sqrt.S b/arch/x86/math-emu/wm_sqrt.S
+index f031c0e19356..515cdee90df7 100644
+--- a/arch/x86/math-emu/wm_sqrt.S
++++ b/arch/x86/math-emu/wm_sqrt.S
+@@ -209,7 +209,7 @@ sqrt_stage_2_finish:
+ 
+ #ifdef PARANOID
+ /* It should be possible to get here only if the arg is ffff....ffff */
+-	cmp	$0xffffffff,FPU_fsqrt_arg_1
++	cmpl	$0xffffffff,FPU_fsqrt_arg_1
+ 	jnz	sqrt_stage_2_error
+ #endif /* PARANOID */
+ 
+diff --git a/arch/x86/platform/uv/uv_irq.c b/arch/x86/platform/uv/uv_irq.c
+index fc13cbbb2dce..abb6075397f0 100644
+--- a/arch/x86/platform/uv/uv_irq.c
++++ b/arch/x86/platform/uv/uv_irq.c
+@@ -167,9 +167,10 @@ static struct irq_domain *uv_get_irq_domain(void)
+ 		goto out;
+ 
+ 	uv_domain = irq_domain_create_tree(fn, &uv_domain_ops, NULL);
+-	irq_domain_free_fwnode(fn);
+ 	if (uv_domain)
+ 		uv_domain->parent = x86_vector_domain;
++	else
++		irq_domain_free_fwnode(fn);
+ out:
+ 	mutex_unlock(&uv_lock);
+ 
+diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
+index e0e1e1892b86..d08172138369 100644
+--- a/arch/xtensa/kernel/setup.c
++++ b/arch/xtensa/kernel/setup.c
+@@ -716,7 +716,8 @@ c_start(struct seq_file *f, loff_t *pos)
+ static void *
+ c_next(struct seq_file *f, void *v, loff_t *pos)
+ {
+-	return NULL;
++	++*pos;
++	return c_start(f, pos);
+ }
+ 
+ static void
+diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
+index 4092555828b1..24cf6972eace 100644
+--- a/arch/xtensa/kernel/xtensa_ksyms.c
++++ b/arch/xtensa/kernel/xtensa_ksyms.c
+@@ -87,13 +87,13 @@ void __xtensa_libgcc_window_spill(void)
+ }
+ EXPORT_SYMBOL(__xtensa_libgcc_window_spill);
+ 
+-unsigned long __sync_fetch_and_and_4(unsigned long *p, unsigned long v)
++unsigned int __sync_fetch_and_and_4(volatile void *p, unsigned int v)
+ {
+ 	BUG();
+ }
+ EXPORT_SYMBOL(__sync_fetch_and_and_4);
+ 
+-unsigned long __sync_fetch_and_or_4(unsigned long *p, unsigned long v)
++unsigned int __sync_fetch_and_or_4(volatile void *p, unsigned int v)
+ {
+ 	BUG();
+ }
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index 7067d5542a82..2048ba6c8b08 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -948,7 +948,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
+ 		trace_binder_unmap_user_end(alloc, index);
+ 	}
+ 	up_read(&mm->mmap_sem);
+-	mmput(mm);
++	mmput_async(mm);
+ 
+ 	trace_binder_unmap_kernel_start(alloc, index);
+ 
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 320d23de02c2..927ebde1607b 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1363,7 +1363,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data)
+ 
+ 	/* If the user didn't specify a name match any */
+ 	if (data)
+-		return (*r)->name == data;
++		return !strcmp((*r)->name, data);
+ 	else
+ 		return 1;
+ }
+diff --git a/drivers/char/mem.c b/drivers/char/mem.c
+index 31cae88a730b..6b56bff9b68c 100644
+--- a/drivers/char/mem.c
++++ b/drivers/char/mem.c
+@@ -814,7 +814,8 @@ static struct inode *devmem_inode;
+ #ifdef CONFIG_IO_STRICT_DEVMEM
+ void revoke_devmem(struct resource *res)
+ {
+-	struct inode *inode = READ_ONCE(devmem_inode);
++	/* pairs with smp_store_release() in devmem_init_inode() */
++	struct inode *inode = smp_load_acquire(&devmem_inode);
+ 
+ 	/*
+ 	 * Check that the initialization has completed. Losing the race
+@@ -1028,8 +1029,11 @@ static int devmem_init_inode(void)
+ 		return rc;
+ 	}
+ 
+-	/* publish /dev/mem initialized */
+-	WRITE_ONCE(devmem_inode, inode);
++	/*
++	 * Publish /dev/mem initialized.
++	 * Pairs with smp_load_acquire() in revoke_devmem().
++	 */
++	smp_store_release(&devmem_inode, inode);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
+index cf65a47310c3..eba7e3fe769c 100644
+--- a/drivers/dma-buf/dma-buf.c
++++ b/drivers/dma-buf/dma-buf.c
+@@ -45,10 +45,10 @@ static char *dmabuffs_dname(struct dentry *dentry, char *buffer, int buflen)
+ 	size_t ret = 0;
+ 
+ 	dmabuf = dentry->d_fsdata;
+-	mutex_lock(&dmabuf->lock);
++	spin_lock(&dmabuf->name_lock);
+ 	if (dmabuf->name)
+ 		ret = strlcpy(name, dmabuf->name, DMA_BUF_NAME_LEN);
+-	mutex_unlock(&dmabuf->lock);
++	spin_unlock(&dmabuf->name_lock);
+ 
+ 	return dynamic_dname(dentry, buffer, buflen, "/%s:%s",
+ 			     dentry->d_name.name, ret > 0 ? name : "");
+@@ -338,8 +338,10 @@ static long dma_buf_set_name(struct dma_buf *dmabuf, const char __user *buf)
+ 		kfree(name);
+ 		goto out_unlock;
+ 	}
++	spin_lock(&dmabuf->name_lock);
+ 	kfree(dmabuf->name);
+ 	dmabuf->name = name;
++	spin_unlock(&dmabuf->name_lock);
+ 
+ out_unlock:
+ 	mutex_unlock(&dmabuf->lock);
+@@ -402,10 +404,10 @@ static void dma_buf_show_fdinfo(struct seq_file *m, struct file *file)
+ 	/* Don't count the temporary reference taken inside procfs seq_show */
+ 	seq_printf(m, "count:\t%ld\n", file_count(dmabuf->file) - 1);
+ 	seq_printf(m, "exp_name:\t%s\n", dmabuf->exp_name);
+-	mutex_lock(&dmabuf->lock);
++	spin_lock(&dmabuf->name_lock);
+ 	if (dmabuf->name)
+ 		seq_printf(m, "name:\t%s\n", dmabuf->name);
+-	mutex_unlock(&dmabuf->lock);
++	spin_unlock(&dmabuf->name_lock);
+ }
+ 
+ static const struct file_operations dma_buf_fops = {
+@@ -537,6 +539,7 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
+ 	dmabuf->size = exp_info->size;
+ 	dmabuf->exp_name = exp_info->exp_name;
+ 	dmabuf->owner = exp_info->owner;
++	spin_lock_init(&dmabuf->name_lock);
+ 	init_waitqueue_head(&dmabuf->poll);
+ 	dmabuf->cb_excl.poll = dmabuf->cb_shared.poll = &dmabuf->poll;
+ 	dmabuf->cb_excl.active = dmabuf->cb_shared.active = 0;
+diff --git a/drivers/dma/fsl-edma-common.c b/drivers/dma/fsl-edma-common.c
+index b1a7ca91701a..d6010486ee50 100644
+--- a/drivers/dma/fsl-edma-common.c
++++ b/drivers/dma/fsl-edma-common.c
+@@ -347,26 +347,28 @@ static void fsl_edma_set_tcd_regs(struct fsl_edma_chan *fsl_chan,
+ 	/*
+ 	 * TCD parameters are stored in struct fsl_edma_hw_tcd in little
+ 	 * endian format. However, we need to load the TCD registers in
+-	 * big- or little-endian obeying the eDMA engine model endian.
++	 * big- or little-endian obeying the eDMA engine model endian,
++	 * and this is performed from specific edma_write functions
+ 	 */
+ 	edma_writew(edma, 0,  &regs->tcd[ch].csr);
+-	edma_writel(edma, le32_to_cpu(tcd->saddr), &regs->tcd[ch].saddr);
+-	edma_writel(edma, le32_to_cpu(tcd->daddr), &regs->tcd[ch].daddr);
+ 
+-	edma_writew(edma, le16_to_cpu(tcd->attr), &regs->tcd[ch].attr);
+-	edma_writew(edma, le16_to_cpu(tcd->soff), &regs->tcd[ch].soff);
++	edma_writel(edma, (s32)tcd->saddr, &regs->tcd[ch].saddr);
++	edma_writel(edma, (s32)tcd->daddr, &regs->tcd[ch].daddr);
+ 
+-	edma_writel(edma, le32_to_cpu(tcd->nbytes), &regs->tcd[ch].nbytes);
+-	edma_writel(edma, le32_to_cpu(tcd->slast), &regs->tcd[ch].slast);
++	edma_writew(edma, (s16)tcd->attr, &regs->tcd[ch].attr);
++	edma_writew(edma, tcd->soff, &regs->tcd[ch].soff);
+ 
+-	edma_writew(edma, le16_to_cpu(tcd->citer), &regs->tcd[ch].citer);
+-	edma_writew(edma, le16_to_cpu(tcd->biter), &regs->tcd[ch].biter);
+-	edma_writew(edma, le16_to_cpu(tcd->doff), &regs->tcd[ch].doff);
++	edma_writel(edma, (s32)tcd->nbytes, &regs->tcd[ch].nbytes);
++	edma_writel(edma, (s32)tcd->slast, &regs->tcd[ch].slast);
+ 
+-	edma_writel(edma, le32_to_cpu(tcd->dlast_sga),
++	edma_writew(edma, (s16)tcd->citer, &regs->tcd[ch].citer);
++	edma_writew(edma, (s16)tcd->biter, &regs->tcd[ch].biter);
++	edma_writew(edma, (s16)tcd->doff, &regs->tcd[ch].doff);
++
++	edma_writel(edma, (s32)tcd->dlast_sga,
+ 			&regs->tcd[ch].dlast_sga);
+ 
+-	edma_writew(edma, le16_to_cpu(tcd->csr), &regs->tcd[ch].csr);
++	edma_writew(edma, (s16)tcd->csr, &regs->tcd[ch].csr);
+ }
+ 
+ static inline
+diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
+index 18c011e57592..8e2a4d1f0be5 100644
+--- a/drivers/dma/ioat/dma.c
++++ b/drivers/dma/ioat/dma.c
+@@ -26,6 +26,18 @@
+ 
+ #include "../dmaengine.h"
+ 
++int completion_timeout = 200;
++module_param(completion_timeout, int, 0644);
++MODULE_PARM_DESC(completion_timeout,
++		"set ioat completion timeout [msec] (default 200 [msec])");
++int idle_timeout = 2000;
++module_param(idle_timeout, int, 0644);
++MODULE_PARM_DESC(idle_timeout,
++		"set ioat idel timeout [msec] (default 2000 [msec])");
++
++#define IDLE_TIMEOUT msecs_to_jiffies(idle_timeout)
++#define COMPLETION_TIMEOUT msecs_to_jiffies(completion_timeout)
++
+ static char *chanerr_str[] = {
+ 	"DMA Transfer Source Address Error",
+ 	"DMA Transfer Destination Address Error",
+diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
+index b8e8e0b9693c..4ac9134962f3 100644
+--- a/drivers/dma/ioat/dma.h
++++ b/drivers/dma/ioat/dma.h
+@@ -99,8 +99,6 @@ struct ioatdma_chan {
+ 	#define IOAT_RUN 5
+ 	#define IOAT_CHAN_ACTIVE 6
+ 	struct timer_list timer;
+-	#define COMPLETION_TIMEOUT msecs_to_jiffies(100)
+-	#define IDLE_TIMEOUT msecs_to_jiffies(2000)
+ 	#define RESET_DELAY msecs_to_jiffies(100)
+ 	struct ioatdma_device *ioat_dma;
+ 	dma_addr_t completion_dma;
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index 914901a680c8..9068591bd684 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -658,6 +658,7 @@ static int tegra_adma_alloc_chan_resources(struct dma_chan *dc)
+ 
+ 	ret = pm_runtime_get_sync(tdc2dev(tdc));
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(tdc2dev(tdc));
+ 		free_irq(tdc->irq, tdc);
+ 		return ret;
+ 	}
+@@ -869,8 +870,10 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ 	pm_runtime_enable(&pdev->dev);
+ 
+ 	ret = pm_runtime_get_sync(&pdev->dev);
+-	if (ret < 0)
++	if (ret < 0) {
++		pm_runtime_put_noidle(&pdev->dev);
+ 		goto rpm_disable;
++	}
+ 
+ 	ret = tegra_adma_init(tdma);
+ 	if (ret)
+diff --git a/drivers/firmware/psci/psci_checker.c b/drivers/firmware/psci/psci_checker.c
+index 6a445397771c..03eb798ad3ed 100644
+--- a/drivers/firmware/psci/psci_checker.c
++++ b/drivers/firmware/psci/psci_checker.c
+@@ -157,8 +157,10 @@ static int alloc_init_cpu_groups(cpumask_var_t **pcpu_groups)
+ 
+ 	cpu_groups = kcalloc(nb_available_cpus, sizeof(cpu_groups),
+ 			     GFP_KERNEL);
+-	if (!cpu_groups)
++	if (!cpu_groups) {
++		free_cpumask_var(tmp);
+ 		return -ENOMEM;
++	}
+ 
+ 	cpumask_copy(tmp, cpu_online_mask);
+ 
+@@ -167,6 +169,7 @@ static int alloc_init_cpu_groups(cpumask_var_t **pcpu_groups)
+ 			topology_core_cpumask(cpumask_any(tmp));
+ 
+ 		if (!alloc_cpumask_var(&cpu_groups[num_groups], GFP_KERNEL)) {
++			free_cpumask_var(tmp);
+ 			free_cpu_groups(num_groups, &cpu_groups);
+ 			return -ENOMEM;
+ 		}
+diff --git a/drivers/fpga/dfl-afu-main.c b/drivers/fpga/dfl-afu-main.c
+index e4a34dc7947f..041d23469238 100644
+--- a/drivers/fpga/dfl-afu-main.c
++++ b/drivers/fpga/dfl-afu-main.c
+@@ -83,7 +83,8 @@ int __afu_port_disable(struct platform_device *pdev)
+ 	 * on this port and minimum soft reset pulse width has elapsed.
+ 	 * Driver polls port_soft_reset_ack to determine if reset done by HW.
+ 	 */
+-	if (readq_poll_timeout(base + PORT_HDR_CTRL, v, v & PORT_CTRL_SFTRST,
++	if (readq_poll_timeout(base + PORT_HDR_CTRL, v,
++			       v & PORT_CTRL_SFTRST_ACK,
+ 			       RST_POLL_INVL, RST_POLL_TIMEOUT)) {
+ 		dev_err(&pdev->dev, "timeout, fail to reset device\n");
+ 		return -ETIMEDOUT;
+diff --git a/drivers/fpga/dfl-pci.c b/drivers/fpga/dfl-pci.c
+index 538755062ab7..a78c409bf2c4 100644
+--- a/drivers/fpga/dfl-pci.c
++++ b/drivers/fpga/dfl-pci.c
+@@ -227,7 +227,6 @@ static int cci_pci_sriov_configure(struct pci_dev *pcidev, int num_vfs)
+ {
+ 	struct cci_drvdata *drvdata = pci_get_drvdata(pcidev);
+ 	struct dfl_fpga_cdev *cdev = drvdata->cdev;
+-	int ret = 0;
+ 
+ 	if (!num_vfs) {
+ 		/*
+@@ -239,6 +238,8 @@ static int cci_pci_sriov_configure(struct pci_dev *pcidev, int num_vfs)
+ 		dfl_fpga_cdev_config_ports_pf(cdev);
+ 
+ 	} else {
++		int ret;
++
+ 		/*
+ 		 * before enable SRIOV, put released ports into VF access mode
+ 		 * first of all.
+diff --git a/drivers/gpio/gpio-arizona.c b/drivers/gpio/gpio-arizona.c
+index 5640efe5e750..5bda38e0780f 100644
+--- a/drivers/gpio/gpio-arizona.c
++++ b/drivers/gpio/gpio-arizona.c
+@@ -64,6 +64,7 @@ static int arizona_gpio_get(struct gpio_chip *chip, unsigned offset)
+ 		ret = pm_runtime_get_sync(chip->parent);
+ 		if (ret < 0) {
+ 			dev_err(chip->parent, "Failed to resume: %d\n", ret);
++			pm_runtime_put_autosuspend(chip->parent);
+ 			return ret;
+ 		}
+ 
+@@ -72,12 +73,15 @@ static int arizona_gpio_get(struct gpio_chip *chip, unsigned offset)
+ 		if (ret < 0) {
+ 			dev_err(chip->parent, "Failed to drop cache: %d\n",
+ 				ret);
++			pm_runtime_put_autosuspend(chip->parent);
+ 			return ret;
+ 		}
+ 
+ 		ret = regmap_read(arizona->regmap, reg, &val);
+-		if (ret < 0)
++		if (ret < 0) {
++			pm_runtime_put_autosuspend(chip->parent);
+ 			return ret;
++		}
+ 
+ 		pm_runtime_mark_last_busy(chip->parent);
+ 		pm_runtime_put_autosuspend(chip->parent);
+@@ -106,6 +110,7 @@ static int arizona_gpio_direction_out(struct gpio_chip *chip,
+ 		ret = pm_runtime_get_sync(chip->parent);
+ 		if (ret < 0) {
+ 			dev_err(chip->parent, "Failed to resume: %d\n", ret);
++			pm_runtime_put(chip->parent);
+ 			return ret;
+ 		}
+ 	}
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+index 1e25ca34d876..700e26b69abc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+@@ -990,27 +990,37 @@ static void amdgpu_ib_preempt_job_recovery(struct drm_gpu_scheduler *sched)
+ static void amdgpu_ib_preempt_mark_partial_job(struct amdgpu_ring *ring)
+ {
+ 	struct amdgpu_job *job;
+-	struct drm_sched_job *s_job;
++	struct drm_sched_job *s_job, *tmp;
+ 	uint32_t preempt_seq;
+ 	struct dma_fence *fence, **ptr;
+ 	struct amdgpu_fence_driver *drv = &ring->fence_drv;
+ 	struct drm_gpu_scheduler *sched = &ring->sched;
++	bool preempted = true;
+ 
+ 	if (ring->funcs->type != AMDGPU_RING_TYPE_GFX)
+ 		return;
+ 
+ 	preempt_seq = le32_to_cpu(*(drv->cpu_addr + 2));
+-	if (preempt_seq <= atomic_read(&drv->last_seq))
+-		return;
++	if (preempt_seq <= atomic_read(&drv->last_seq)) {
++		preempted = false;
++		goto no_preempt;
++	}
+ 
+ 	preempt_seq &= drv->num_fences_mask;
+ 	ptr = &drv->fences[preempt_seq];
+ 	fence = rcu_dereference_protected(*ptr, 1);
+ 
++no_preempt:
+ 	spin_lock(&sched->job_list_lock);
+-	list_for_each_entry(s_job, &sched->ring_mirror_list, node) {
++	list_for_each_entry_safe(s_job, tmp, &sched->ring_mirror_list, node) {
++		if (dma_fence_is_signaled(&s_job->s_fence->finished)) {
++			/* remove job from ring_mirror_list */
++			list_del_init(&s_job->node);
++			sched->ops->free_job(s_job);
++			continue;
++		}
+ 		job = to_amdgpu_job(s_job);
+-		if (job->fence == fence)
++		if (preempted && job->fence == fence)
+ 			/* mark the job as preempted */
+ 			job->preemption_status |= AMDGPU_IB_PREEMPTED;
+ 	}
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+index 3f744e72912f..b66554b40db4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+@@ -691,8 +691,7 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
+ 		tmp_str++;
+ 	while (isspace(*++tmp_str));
+ 
+-	while (tmp_str[0]) {
+-		sub_str = strsep(&tmp_str, delimiter);
++	while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
+ 		ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
+ 		if (ret)
+ 			return -EINVAL;
+@@ -883,8 +882,7 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
+ 	memcpy(buf_cpy, buf, bytes);
+ 	buf_cpy[bytes] = '\0';
+ 	tmp = buf_cpy;
+-	while (tmp[0]) {
+-		sub_str = strsep(&tmp, delimiter);
++	while ((sub_str = strsep(&tmp, delimiter)) != NULL) {
+ 		if (strlen(sub_str)) {
+ 			ret = kstrtol(sub_str, 0, &level);
+ 			if (ret)
+@@ -1300,8 +1298,7 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev,
+ 			i++;
+ 		memcpy(buf_cpy, buf, count-i);
+ 		tmp_str = buf_cpy;
+-		while (tmp_str[0]) {
+-			sub_str = strsep(&tmp_str, delimiter);
++		while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
+ 			ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
+ 			if (ret) {
+ 				count = -EINVAL;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+index 6f118292e40f..64d96eb0a233 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -4683,12 +4683,17 @@ static int gfx_v10_0_ring_preempt_ib(struct amdgpu_ring *ring)
+ 	struct amdgpu_device *adev = ring->adev;
+ 	struct amdgpu_kiq *kiq = &adev->gfx.kiq;
+ 	struct amdgpu_ring *kiq_ring = &kiq->ring;
++	unsigned long flags;
+ 
+ 	if (!kiq->pmf || !kiq->pmf->kiq_unmap_queues)
+ 		return -EINVAL;
+ 
+-	if (amdgpu_ring_alloc(kiq_ring, kiq->pmf->unmap_queues_size))
++	spin_lock_irqsave(&kiq->ring_lock, flags);
++
++	if (amdgpu_ring_alloc(kiq_ring, kiq->pmf->unmap_queues_size)) {
++		spin_unlock_irqrestore(&kiq->ring_lock, flags);
+ 		return -ENOMEM;
++	}
+ 
+ 	/* assert preemption condition */
+ 	amdgpu_ring_set_preempt_cond_exec(ring, false);
+@@ -4699,6 +4704,8 @@ static int gfx_v10_0_ring_preempt_ib(struct amdgpu_ring *ring)
+ 				   ++ring->trail_seq);
+ 	amdgpu_ring_commit(kiq_ring);
+ 
++	spin_unlock_irqrestore(&kiq->ring_lock, flags);
++
+ 	/* poll the trailing fence */
+ 	for (i = 0; i < adev->usec_timeout; i++) {
+ 		if (ring->trail_seq ==
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 4fad0b603b3a..c7d8edf450d3 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -928,9 +928,14 @@ static int dm_late_init(void *handle)
+ 	struct dmcu_iram_parameters params;
+ 	unsigned int linear_lut[16];
+ 	int i;
+-	struct dmcu *dmcu = adev->dm.dc->res_pool->dmcu;
++	struct dmcu *dmcu = NULL;
+ 	bool ret;
+ 
++	if (!adev->dm.fw_dmcu)
++		return detect_mst_link_for_all_connectors(adev->ddev);
++
++	dmcu = adev->dm.dc->res_pool->dmcu;
++
+ 	for (i = 0; i < 16; i++)
+ 		linear_lut[i] = 0xFFFF * i / 15;
+ 
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c
+index ae18fbcb26fb..86bdb0194493 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c
+@@ -642,9 +642,6 @@ static int vegam_get_dependency_volt_by_clk(struct pp_hwmgr *hwmgr,
+ 
+ 	/* sclk is bigger than max sclk in the dependence table */
+ 	*voltage |= (dep_table->entries[i - 1].vddc * VOLTAGE_SCALE) << VDDC_SHIFT;
+-	vddci = phm_find_closest_vddci(&(data->vddci_voltage_table),
+-			(dep_table->entries[i - 1].vddc -
+-					(uint16_t)VDDC_VDDCI_DELTA));
+ 
+ 	if (SMU7_VOLTAGE_CONTROL_NONE == data->vddci_control)
+ 		*voltage |= (data->vbios_boot_state.vddci_bootup_value *
+@@ -652,8 +649,13 @@ static int vegam_get_dependency_volt_by_clk(struct pp_hwmgr *hwmgr,
+ 	else if (dep_table->entries[i - 1].vddci)
+ 		*voltage |= (dep_table->entries[i - 1].vddci *
+ 				VOLTAGE_SCALE) << VDDC_SHIFT;
+-	else
++	else {
++		vddci = phm_find_closest_vddci(&(data->vddci_voltage_table),
++				(dep_table->entries[i - 1].vddc -
++						(uint16_t)VDDC_VDDCI_DELTA));
++
+ 		*voltage |= (vddci * VOLTAGE_SCALE) << VDDCI_SHIFT;
++	}
+ 
+ 	if (SMU7_VOLTAGE_CONTROL_NONE == data->mvdd_control)
+ 		*mvdd = data->vbios_boot_state.mvdd_bootup_value * VOLTAGE_SCALE;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
+index c8ab1b5741a3..db7769cb33eb 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
+@@ -118,10 +118,10 @@ g94_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,
+ 		if (retries)
+ 			udelay(400);
+ 
+-		/* transaction request, wait up to 1ms for it to complete */
++		/* transaction request, wait up to 2ms for it to complete */
+ 		nvkm_wr32(device, 0x00e4e4 + base, 0x00010000 | ctrl);
+ 
+-		timeout = 1000;
++		timeout = 2000;
+ 		do {
+ 			ctrl = nvkm_rd32(device, 0x00e4e4 + base);
+ 			udelay(1);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
+index 7ef60895f43a..edb6148cbca0 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
+@@ -118,10 +118,10 @@ gm200_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,
+ 		if (retries)
+ 			udelay(400);
+ 
+-		/* transaction request, wait up to 1ms for it to complete */
++		/* transaction request, wait up to 2ms for it to complete */
+ 		nvkm_wr32(device, 0x00d954 + base, 0x00010000 | ctrl);
+ 
+-		timeout = 1000;
++		timeout = 2000;
+ 		do {
+ 			ctrl = nvkm_rd32(device, 0x00d954 + base);
+ 			udelay(1);
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+index 63b4de81686a..4acdfa608775 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+@@ -263,7 +263,7 @@ sun4i_hdmi_connector_detect(struct drm_connector *connector, bool force)
+ 	unsigned long reg;
+ 
+ 	reg = readl(hdmi->base + SUN4I_HDMI_HPD_REG);
+-	if (reg & SUN4I_HDMI_HPD_HIGH) {
++	if (!(reg & SUN4I_HDMI_HPD_HIGH)) {
+ 		cec_phys_addr_invalidate(hdmi->cec_adap);
+ 		return connector_status_disconnected;
+ 	}
+diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
+index b2ad319a74b9..d33f5abc8f64 100644
+--- a/drivers/hid/hid-alps.c
++++ b/drivers/hid/hid-alps.c
+@@ -25,6 +25,7 @@
+ 
+ #define U1_MOUSE_REPORT_ID			0x01 /* Mouse data ReportID */
+ #define U1_ABSOLUTE_REPORT_ID		0x03 /* Absolute data ReportID */
++#define U1_ABSOLUTE_REPORT_ID_SECD  0x02 /* FW-PTP Absolute data ReportID */
+ #define U1_FEATURE_REPORT_ID		0x05 /* Feature ReportID */
+ #define U1_SP_ABSOLUTE_REPORT_ID	0x06 /* Feature ReportID */
+ 
+@@ -368,6 +369,7 @@ static int u1_raw_event(struct alps_dev *hdata, u8 *data, int size)
+ 	case U1_FEATURE_REPORT_ID:
+ 		break;
+ 	case U1_ABSOLUTE_REPORT_ID:
++	case U1_ABSOLUTE_REPORT_ID_SECD:
+ 		for (i = 0; i < hdata->max_fingers; i++) {
+ 			u8 *contact = &data[i * 5];
+ 
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index d732d1d10caf..6909c045fece 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -54,6 +54,7 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\")
+ struct apple_sc {
+ 	unsigned long quirks;
+ 	unsigned int fn_on;
++	unsigned int fn_found;
+ 	DECLARE_BITMAP(pressed_numlock, KEY_CNT);
+ };
+ 
+@@ -339,12 +340,15 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ 		struct hid_field *field, struct hid_usage *usage,
+ 		unsigned long **bit, int *max)
+ {
++	struct apple_sc *asc = hid_get_drvdata(hdev);
++
+ 	if (usage->hid == (HID_UP_CUSTOM | 0x0003) ||
+ 			usage->hid == (HID_UP_MSVENDOR | 0x0003) ||
+ 			usage->hid == (HID_UP_HPVENDOR2 | 0x0003)) {
+ 		/* The fn key on Apple USB keyboards */
+ 		set_bit(EV_REP, hi->input->evbit);
+ 		hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN);
++		asc->fn_found = true;
+ 		apple_setup_input(hi->input);
+ 		return 1;
+ 	}
+@@ -371,6 +375,19 @@ static int apple_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ 	return 0;
+ }
+ 
++static int apple_input_configured(struct hid_device *hdev,
++		struct hid_input *hidinput)
++{
++	struct apple_sc *asc = hid_get_drvdata(hdev);
++
++	if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) {
++		hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n");
++		asc->quirks = 0;
++	}
++
++	return 0;
++}
++
+ static int apple_probe(struct hid_device *hdev,
+ 		const struct hid_device_id *id)
+ {
+@@ -585,6 +602,7 @@ static struct hid_driver apple_driver = {
+ 	.event = apple_event,
+ 	.input_mapping = apple_input_mapping,
+ 	.input_mapped = apple_input_mapped,
++	.input_configured = apple_input_configured,
+ };
+ module_hid_driver(apple_driver);
+ 
+diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
+index 6286204d4c56..a3b151b29bd7 100644
+--- a/drivers/hid/hid-steam.c
++++ b/drivers/hid/hid-steam.c
+@@ -526,7 +526,8 @@ static int steam_register(struct steam_device *steam)
+ 			steam_battery_register(steam);
+ 
+ 		mutex_lock(&steam_devices_lock);
+-		list_add(&steam->list, &steam_devices);
++		if (list_empty(&steam->list))
++			list_add(&steam->list, &steam_devices);
+ 		mutex_unlock(&steam_devices_lock);
+ 	}
+ 
+@@ -552,7 +553,7 @@ static void steam_unregister(struct steam_device *steam)
+ 		hid_info(steam->hdev, "Steam Controller '%s' disconnected",
+ 				steam->serial_no);
+ 		mutex_lock(&steam_devices_lock);
+-		list_del(&steam->list);
++		list_del_init(&steam->list);
+ 		mutex_unlock(&steam_devices_lock);
+ 		steam->serial_no[0] = 0;
+ 	}
+@@ -738,6 +739,7 @@ static int steam_probe(struct hid_device *hdev,
+ 	mutex_init(&steam->mutex);
+ 	steam->quirks = id->driver_data;
+ 	INIT_WORK(&steam->work_connect, steam_work_connect_cb);
++	INIT_LIST_HEAD(&steam->list);
+ 
+ 	steam->client_hdev = steam_create_client_hid(hdev);
+ 	if (IS_ERR(steam->client_hdev)) {
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index ec142bc8c1da..35f3bfc3e6f5 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -373,6 +373,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ 		},
+ 		.driver_data = (void *)&sipodev_desc
+ 	},
++	{
++		.ident = "Mediacom FlexBook edge 13",
++		.matches = {
++			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "MEDIACOM"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook_edge13-M-FBE13"),
++		},
++		.driver_data = (void *)&sipodev_desc
++	},
+ 	{
+ 		.ident = "Odys Winbook 13",
+ 		.matches = {
+diff --git a/drivers/hwmon/aspeed-pwm-tacho.c b/drivers/hwmon/aspeed-pwm-tacho.c
+index 40c489be62ea..40f3139f1e02 100644
+--- a/drivers/hwmon/aspeed-pwm-tacho.c
++++ b/drivers/hwmon/aspeed-pwm-tacho.c
+@@ -851,6 +851,8 @@ static int aspeed_create_fan(struct device *dev,
+ 	ret = of_property_read_u32(child, "reg", &pwm_port);
+ 	if (ret)
+ 		return ret;
++	if (pwm_port >= ARRAY_SIZE(pwm_port_params))
++		return -EINVAL;
+ 	aspeed_create_pwm_port(priv, (u8)pwm_port);
+ 
+ 	ret = of_property_count_u8_elems(child, "cooling-levels");
+diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
+index 7efa6bfef060..ba9b96973e80 100644
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -786,13 +786,13 @@ static const char *const nct6798_temp_label[] = {
+ 	"Agent1 Dimm1",
+ 	"BYTE_TEMP0",
+ 	"BYTE_TEMP1",
+-	"",
+-	"",
++	"PECI Agent 0 Calibration",	/* undocumented */
++	"PECI Agent 1 Calibration",	/* undocumented */
+ 	"",
+ 	"Virtual_TEMP"
+ };
+ 
+-#define NCT6798_TEMP_MASK	0x8fff0ffe
++#define NCT6798_TEMP_MASK	0xbfff0ffe
+ #define NCT6798_VIRT_TEMP_MASK	0x80000c00
+ 
+ /* NCT6102D/NCT6106D specific data */
+diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c
+index 5caa37fbfc18..66b12e5ccbc6 100644
+--- a/drivers/hwmon/pmbus/adm1275.c
++++ b/drivers/hwmon/pmbus/adm1275.c
+@@ -454,6 +454,7 @@ MODULE_DEVICE_TABLE(i2c, adm1275_id);
+ static int adm1275_probe(struct i2c_client *client,
+ 			 const struct i2c_device_id *id)
+ {
++	s32 (*config_read_fn)(const struct i2c_client *client, u8 reg);
+ 	u8 block_buffer[I2C_SMBUS_BLOCK_MAX + 1];
+ 	int config, device_config;
+ 	int ret;
+@@ -499,11 +500,16 @@ static int adm1275_probe(struct i2c_client *client,
+ 			   "Device mismatch: Configured %s, detected %s\n",
+ 			   id->name, mid->name);
+ 
+-	config = i2c_smbus_read_byte_data(client, ADM1275_PMON_CONFIG);
++	if (mid->driver_data == adm1272 || mid->driver_data == adm1278 ||
++	    mid->driver_data == adm1293 || mid->driver_data == adm1294)
++		config_read_fn = i2c_smbus_read_word_data;
++	else
++		config_read_fn = i2c_smbus_read_byte_data;
++	config = config_read_fn(client, ADM1275_PMON_CONFIG);
+ 	if (config < 0)
+ 		return config;
+ 
+-	device_config = i2c_smbus_read_byte_data(client, ADM1275_DEVICE_CONFIG);
++	device_config = config_read_fn(client, ADM1275_DEVICE_CONFIG);
+ 	if (device_config < 0)
+ 		return device_config;
+ 
+diff --git a/drivers/hwmon/scmi-hwmon.c b/drivers/hwmon/scmi-hwmon.c
+index 8a7732c0bef3..7cd13a217c61 100644
+--- a/drivers/hwmon/scmi-hwmon.c
++++ b/drivers/hwmon/scmi-hwmon.c
+@@ -147,7 +147,7 @@ static enum hwmon_sensor_types scmi_types[] = {
+ 	[ENERGY] = hwmon_energy,
+ };
+ 
+-static u32 hwmon_attributes[] = {
++static u32 hwmon_attributes[hwmon_max] = {
+ 	[hwmon_chip] = HWMON_C_REGISTER_TZ,
+ 	[hwmon_temp] = HWMON_T_INPUT | HWMON_T_LABEL,
+ 	[hwmon_in] = HWMON_I_INPUT | HWMON_I_LABEL,
+diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
+index 17abf60c94ae..aafc76ee93e0 100644
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -368,7 +368,6 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ 		geni_se_select_mode(se, GENI_SE_FIFO);
+ 
+ 	writel_relaxed(len, se->base + SE_I2C_RX_TRANS_LEN);
+-	geni_se_setup_m_cmd(se, I2C_READ, m_param);
+ 
+ 	if (dma_buf && geni_se_rx_dma_prep(se, dma_buf, len, &rx_dma)) {
+ 		geni_se_select_mode(se, GENI_SE_FIFO);
+@@ -376,6 +375,8 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ 		dma_buf = NULL;
+ 	}
+ 
++	geni_se_setup_m_cmd(se, I2C_READ, m_param);
++
+ 	time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT);
+ 	if (!time_left)
+ 		geni_i2c_abort_xfer(gi2c);
+@@ -409,7 +410,6 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ 		geni_se_select_mode(se, GENI_SE_FIFO);
+ 
+ 	writel_relaxed(len, se->base + SE_I2C_TX_TRANS_LEN);
+-	geni_se_setup_m_cmd(se, I2C_WRITE, m_param);
+ 
+ 	if (dma_buf && geni_se_tx_dma_prep(se, dma_buf, len, &tx_dma)) {
+ 		geni_se_select_mode(se, GENI_SE_FIFO);
+@@ -417,6 +417,8 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ 		dma_buf = NULL;
+ 	}
+ 
++	geni_se_setup_m_cmd(se, I2C_WRITE, m_param);
++
+ 	if (!dma_buf) /* Get FIFO IRQ */
+ 		writel_relaxed(1, se->base + SE_GENI_TX_WATERMARK_REG);
+ 
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 531c01100b56..36af8fdb6658 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -865,6 +865,7 @@ static int rcar_unreg_slave(struct i2c_client *slave)
+ 	/* disable irqs and ensure none is running before clearing ptr */
+ 	rcar_i2c_write(priv, ICSIER, 0);
+ 	rcar_i2c_write(priv, ICSCR, 0);
++	rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
+ 
+ 	synchronize_irq(priv->irq);
+ 	priv->slave = NULL;
+@@ -971,6 +972,8 @@ static int rcar_i2c_probe(struct platform_device *pdev)
+ 	if (ret < 0)
+ 		goto out_pm_put;
+ 
++	rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
++
+ 	if (priv->devtype == I2C_RCAR_GEN3) {
+ 		priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
+ 		if (!IS_ERR(priv->rstc)) {
+diff --git a/drivers/infiniband/hw/mlx5/srq_cmd.c b/drivers/infiniband/hw/mlx5/srq_cmd.c
+index 8fc3630a9d4c..0224231a2e6f 100644
+--- a/drivers/infiniband/hw/mlx5/srq_cmd.c
++++ b/drivers/infiniband/hw/mlx5/srq_cmd.c
+@@ -83,11 +83,11 @@ struct mlx5_core_srq *mlx5_cmd_get_srq(struct mlx5_ib_dev *dev, u32 srqn)
+ 	struct mlx5_srq_table *table = &dev->srq_table;
+ 	struct mlx5_core_srq *srq;
+ 
+-	xa_lock(&table->array);
++	xa_lock_irq(&table->array);
+ 	srq = xa_load(&table->array, srqn);
+ 	if (srq)
+ 		refcount_inc(&srq->common.refcount);
+-	xa_unlock(&table->array);
++	xa_unlock_irq(&table->array);
+ 
+ 	return srq;
+ }
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index 8719da540383..196e8505dd8d 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -951,6 +951,8 @@ static void elan_report_absolute(struct elan_tp_data *data, u8 *packet)
+ 	u8 hover_info = packet[ETP_HOVER_INFO_OFFSET];
+ 	bool contact_valid, hover_event;
+ 
++	pm_wakeup_event(&data->client->dev, 0);
++
+ 	hover_event = hover_info & 0x40;
+ 	for (i = 0; i < ETP_MAX_FINGERS; i++) {
+ 		contact_valid = tp_info & (1U << (3 + i));
+@@ -974,6 +976,8 @@ static void elan_report_trackpoint(struct elan_tp_data *data, u8 *report)
+ 	u8 *packet = &report[ETP_REPORT_ID_OFFSET + 1];
+ 	int x, y;
+ 
++	pm_wakeup_event(&data->client->dev, 0);
++
+ 	if (!data->tp_input) {
+ 		dev_warn_once(&data->client->dev,
+ 			      "received a trackpoint report while no trackpoint device has been created. Please report upstream.\n");
+@@ -998,7 +1002,6 @@ static void elan_report_trackpoint(struct elan_tp_data *data, u8 *report)
+ static irqreturn_t elan_isr(int irq, void *dev_id)
+ {
+ 	struct elan_tp_data *data = dev_id;
+-	struct device *dev = &data->client->dev;
+ 	int error;
+ 	u8 report[ETP_MAX_REPORT_LEN];
+ 
+@@ -1016,8 +1019,6 @@ static irqreturn_t elan_isr(int irq, void *dev_id)
+ 	if (error)
+ 		goto out;
+ 
+-	pm_wakeup_event(dev, 0);
+-
+ 	switch (report[ETP_REPORT_ID_OFFSET]) {
+ 	case ETP_REPORT_ID:
+ 		elan_report_absolute(data, report);
+@@ -1026,7 +1027,7 @@ static irqreturn_t elan_isr(int irq, void *dev_id)
+ 		elan_report_trackpoint(data, report);
+ 		break;
+ 	default:
+-		dev_err(dev, "invalid report id data (%x)\n",
++		dev_err(&data->client->dev, "invalid report id data (%x)\n",
+ 			report[ETP_REPORT_ID_OFFSET]);
+ 	}
+ 
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 758dae8d6500..4b81b2d0fe06 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -179,6 +179,7 @@ static const char * const smbus_pnp_ids[] = {
+ 	"LEN0093", /* T480 */
+ 	"LEN0096", /* X280 */
+ 	"LEN0097", /* X280 -> ALPS trackpoint */
++	"LEN0099", /* X1 Extreme 1st */
+ 	"LEN009b", /* T580 */
+ 	"LEN200f", /* T450s */
+ 	"LEN2044", /* L470  */
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 32de8e7bb8b4..3a7094f4813f 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -4575,9 +4575,10 @@ int amd_iommu_create_irq_domain(struct amd_iommu *iommu)
+ 	if (!fn)
+ 		return -ENOMEM;
+ 	iommu->ir_domain = irq_domain_create_tree(fn, &amd_ir_domain_ops, iommu);
+-	irq_domain_free_fwnode(fn);
+-	if (!iommu->ir_domain)
++	if (!iommu->ir_domain) {
++		irq_domain_free_fwnode(fn);
+ 		return -ENOMEM;
++	}
+ 
+ 	iommu->ir_domain->parent = arch_get_ir_parent_domain();
+ 	iommu->msi_domain = arch_create_remap_msi_irq_domain(iommu->ir_domain,
+diff --git a/drivers/iommu/hyperv-iommu.c b/drivers/iommu/hyperv-iommu.c
+index a386b83e0e34..f0fe5030acd3 100644
+--- a/drivers/iommu/hyperv-iommu.c
++++ b/drivers/iommu/hyperv-iommu.c
+@@ -155,7 +155,10 @@ static int __init hyperv_prepare_irq_remapping(void)
+ 				0, IOAPIC_REMAPPING_ENTRY, fn,
+ 				&hyperv_ir_domain_ops, NULL);
+ 
+-	irq_domain_free_fwnode(fn);
++	if (!ioapic_ir_domain) {
++		irq_domain_free_fwnode(fn);
++		return -ENOMEM;
++	}
+ 
+ 	/*
+ 	 * Hyper-V doesn't provide irq remapping function for
+diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
+index 81e43c1df7ec..982d796b686b 100644
+--- a/drivers/iommu/intel_irq_remapping.c
++++ b/drivers/iommu/intel_irq_remapping.c
+@@ -563,8 +563,8 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu)
+ 					    0, INTR_REMAP_TABLE_ENTRIES,
+ 					    fn, &intel_ir_domain_ops,
+ 					    iommu);
+-	irq_domain_free_fwnode(fn);
+ 	if (!iommu->ir_domain) {
++		irq_domain_free_fwnode(fn);
+ 		pr_err("IR%d: failed to allocate irqdomain\n", iommu->seq_id);
+ 		goto out_free_bitmap;
+ 	}
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 56248773a9e0..1f63084ef329 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -2298,7 +2298,7 @@ static void integrity_writer(struct work_struct *w)
+ 	unsigned prev_free_sectors;
+ 
+ 	/* the following test is not needed, but it tests the replay code */
+-	if (unlikely(dm_suspended(ic->ti)) && !ic->meta_dev)
++	if (unlikely(dm_post_suspending(ic->ti)) && !ic->meta_dev)
+ 		return;
+ 
+ 	spin_lock_irq(&ic->endio_wait.lock);
+@@ -2359,7 +2359,7 @@ static void integrity_recalc(struct work_struct *w)
+ 
+ next_chunk:
+ 
+-	if (unlikely(dm_suspended(ic->ti)))
++	if (unlikely(dm_post_suspending(ic->ti)))
+ 		goto unlock_ret;
+ 
+ 	range.logical_sector = le64_to_cpu(ic->sb->recalc_sector);
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 915019ec0e25..67da442cbab1 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -141,6 +141,7 @@ EXPORT_SYMBOL_GPL(dm_bio_get_target_bio_nr);
+ #define DMF_NOFLUSH_SUSPENDING 5
+ #define DMF_DEFERRED_REMOVE 6
+ #define DMF_SUSPENDED_INTERNALLY 7
++#define DMF_POST_SUSPENDING 8
+ 
+ #define DM_NUMA_NODE NUMA_NO_NODE
+ static int dm_numa_node = DM_NUMA_NODE;
+@@ -1437,9 +1438,6 @@ static int __send_empty_flush(struct clone_info *ci)
+ 	BUG_ON(bio_has_data(ci->bio));
+ 	while ((ti = dm_table_get_target(ci->map, target_nr++)))
+ 		__send_duplicate_bios(ci, ti, ti->num_flush_bios, NULL);
+-
+-	bio_disassociate_blkg(ci->bio);
+-
+ 	return 0;
+ }
+ 
+@@ -1627,6 +1625,7 @@ static blk_qc_t __split_and_process_bio(struct mapped_device *md,
+ 		ci.bio = &flush_bio;
+ 		ci.sector_count = 0;
+ 		error = __send_empty_flush(&ci);
++		bio_uninit(ci.bio);
+ 		/* dec_pending submits any data associated with flush */
+ 	} else if (bio_op(bio) == REQ_OP_ZONE_RESET) {
+ 		ci.bio = bio;
+@@ -1701,6 +1700,7 @@ static blk_qc_t __process_bio(struct mapped_device *md, struct dm_table *map,
+ 		ci.bio = &flush_bio;
+ 		ci.sector_count = 0;
+ 		error = __send_empty_flush(&ci);
++		bio_uninit(ci.bio);
+ 		/* dec_pending submits any data associated with flush */
+ 	} else {
+ 		struct dm_target_io *tio;
+@@ -2391,6 +2391,7 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
+ 	if (!dm_suspended_md(md)) {
+ 		dm_table_presuspend_targets(map);
+ 		set_bit(DMF_SUSPENDED, &md->flags);
++		set_bit(DMF_POST_SUSPENDING, &md->flags);
+ 		dm_table_postsuspend_targets(map);
+ 	}
+ 	/* dm_put_live_table must be before msleep, otherwise deadlock is possible */
+@@ -2713,7 +2714,9 @@ retry:
+ 	if (r)
+ 		goto out_unlock;
+ 
++	set_bit(DMF_POST_SUSPENDING, &md->flags);
+ 	dm_table_postsuspend_targets(map);
++	clear_bit(DMF_POST_SUSPENDING, &md->flags);
+ 
+ out_unlock:
+ 	mutex_unlock(&md->suspend_lock);
+@@ -2810,7 +2813,9 @@ static void __dm_internal_suspend(struct mapped_device *md, unsigned suspend_fla
+ 	(void) __dm_suspend(md, map, suspend_flags, TASK_UNINTERRUPTIBLE,
+ 			    DMF_SUSPENDED_INTERNALLY);
+ 
++	set_bit(DMF_POST_SUSPENDING, &md->flags);
+ 	dm_table_postsuspend_targets(map);
++	clear_bit(DMF_POST_SUSPENDING, &md->flags);
+ }
+ 
+ static void __dm_internal_resume(struct mapped_device *md)
+@@ -2971,6 +2976,11 @@ int dm_suspended_md(struct mapped_device *md)
+ 	return test_bit(DMF_SUSPENDED, &md->flags);
+ }
+ 
++static int dm_post_suspending_md(struct mapped_device *md)
++{
++	return test_bit(DMF_POST_SUSPENDING, &md->flags);
++}
++
+ int dm_suspended_internally_md(struct mapped_device *md)
+ {
+ 	return test_bit(DMF_SUSPENDED_INTERNALLY, &md->flags);
+@@ -2987,6 +2997,12 @@ int dm_suspended(struct dm_target *ti)
+ }
+ EXPORT_SYMBOL_GPL(dm_suspended);
+ 
++int dm_post_suspending(struct dm_target *ti)
++{
++	return dm_post_suspending_md(dm_table_get_md(ti->table));
++}
++EXPORT_SYMBOL_GPL(dm_post_suspending);
++
+ int dm_noflush_suspending(struct dm_target *ti)
+ {
+ 	return __noflush_suspending(dm_table_get_md(ti->table));
+diff --git a/drivers/mmc/host/sdhci-of-aspeed.c b/drivers/mmc/host/sdhci-of-aspeed.c
+index 8962f6664381..47ddded57000 100644
+--- a/drivers/mmc/host/sdhci-of-aspeed.c
++++ b/drivers/mmc/host/sdhci-of-aspeed.c
+@@ -68,7 +68,7 @@ static void aspeed_sdhci_set_clock(struct sdhci_host *host, unsigned int clock)
+ 	if (WARN_ON(clock > host->max_clk))
+ 		clock = host->max_clk;
+ 
+-	for (div = 1; div < 256; div *= 2) {
++	for (div = 2; div < 256; div *= 2) {
+ 		if ((parent / div) <= clock)
+ 			break;
+ 	}
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 703c5c2c80e5..499845c32b1b 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4864,15 +4864,19 @@ int bond_create(struct net *net, const char *name)
+ 	bond_dev->rtnl_link_ops = &bond_link_ops;
+ 
+ 	res = register_netdevice(bond_dev);
++	if (res < 0) {
++		free_netdev(bond_dev);
++		rtnl_unlock();
++
++		return res;
++	}
+ 
+ 	netif_carrier_off(bond_dev);
+ 
+ 	bond_work_init_all(bond);
+ 
+ 	rtnl_unlock();
+-	if (res < 0)
+-		free_netdev(bond_dev);
+-	return res;
++	return 0;
+ }
+ 
+ static int __net_init bond_net_init(struct net *net)
+diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
+index b43b51646b11..f0f9138e967f 100644
+--- a/drivers/net/bonding/bond_netlink.c
++++ b/drivers/net/bonding/bond_netlink.c
+@@ -456,11 +456,10 @@ static int bond_newlink(struct net *src_net, struct net_device *bond_dev,
+ 		return err;
+ 
+ 	err = register_netdevice(bond_dev);
+-
+-	netif_carrier_off(bond_dev);
+ 	if (!err) {
+ 		struct bonding *bond = netdev_priv(bond_dev);
+ 
++		netif_carrier_off(bond_dev);
+ 		bond_work_init_all(bond);
+ 	}
+ 
+diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c
+index f600874e2476..b15da9a8e3bb 100644
+--- a/drivers/net/dsa/microchip/ksz9477.c
++++ b/drivers/net/dsa/microchip/ksz9477.c
+@@ -976,23 +976,6 @@ static void ksz9477_port_mirror_del(struct dsa_switch *ds, int port,
+ 			     PORT_MIRROR_SNIFFER, false);
+ }
+ 
+-static void ksz9477_phy_setup(struct ksz_device *dev, int port,
+-			      struct phy_device *phy)
+-{
+-	/* Only apply to port with PHY. */
+-	if (port >= dev->phy_port_cnt)
+-		return;
+-
+-	/* The MAC actually cannot run in 1000 half-duplex mode. */
+-	phy_remove_link_mode(phy,
+-			     ETHTOOL_LINK_MODE_1000baseT_Half_BIT);
+-
+-	/* PHY does not support gigabit. */
+-	if (!(dev->features & GBIT_SUPPORT))
+-		phy_remove_link_mode(phy,
+-				     ETHTOOL_LINK_MODE_1000baseT_Full_BIT);
+-}
+-
+ static bool ksz9477_get_gbit(struct ksz_device *dev, u8 data)
+ {
+ 	bool gbit;
+@@ -1605,7 +1588,6 @@ static const struct ksz_dev_ops ksz9477_dev_ops = {
+ 	.get_port_addr = ksz9477_get_port_addr,
+ 	.cfg_port_member = ksz9477_cfg_port_member,
+ 	.flush_dyn_mac_table = ksz9477_flush_dyn_mac_table,
+-	.phy_setup = ksz9477_phy_setup,
+ 	.port_setup = ksz9477_port_setup,
+ 	.r_mib_cnt = ksz9477_r_mib_cnt,
+ 	.r_mib_pkt = ksz9477_r_mib_pkt,
+@@ -1619,7 +1601,29 @@ static const struct ksz_dev_ops ksz9477_dev_ops = {
+ 
+ int ksz9477_switch_register(struct ksz_device *dev)
+ {
+-	return ksz_switch_register(dev, &ksz9477_dev_ops);
++	int ret, i;
++	struct phy_device *phydev;
++
++	ret = ksz_switch_register(dev, &ksz9477_dev_ops);
++	if (ret)
++		return ret;
++
++	for (i = 0; i < dev->phy_port_cnt; ++i) {
++		if (!dsa_is_user_port(dev->ds, i))
++			continue;
++
++		phydev = dsa_to_port(dev->ds, i)->slave->phydev;
++
++		/* The MAC actually cannot run in 1000 half-duplex mode. */
++		phy_remove_link_mode(phydev,
++				     ETHTOOL_LINK_MODE_1000baseT_Half_BIT);
++
++		/* PHY does not support gigabit. */
++		if (!(dev->features & GBIT_SUPPORT))
++			phy_remove_link_mode(phydev,
++					     ETHTOOL_LINK_MODE_1000baseT_Full_BIT);
++	}
++	return ret;
+ }
+ EXPORT_SYMBOL(ksz9477_switch_register);
+ 
+diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
+index fe47180c908b..7fabc0e3d807 100644
+--- a/drivers/net/dsa/microchip/ksz_common.c
++++ b/drivers/net/dsa/microchip/ksz_common.c
+@@ -366,8 +366,6 @@ int ksz_enable_port(struct dsa_switch *ds, int port, struct phy_device *phy)
+ 
+ 	/* setup slave port */
+ 	dev->dev_ops->port_setup(dev, port, false);
+-	if (dev->dev_ops->phy_setup)
+-		dev->dev_ops->phy_setup(dev, port, phy);
+ 
+ 	/* port_stp_state_set() will be called after to enable the port so
+ 	 * there is no need to do anything.
+diff --git a/drivers/net/dsa/microchip/ksz_common.h b/drivers/net/dsa/microchip/ksz_common.h
+index a20ebb749377..061142b183cb 100644
+--- a/drivers/net/dsa/microchip/ksz_common.h
++++ b/drivers/net/dsa/microchip/ksz_common.h
+@@ -120,8 +120,6 @@ struct ksz_dev_ops {
+ 	u32 (*get_port_addr)(int port, int offset);
+ 	void (*cfg_port_member)(struct ksz_device *dev, int port, u8 member);
+ 	void (*flush_dyn_mac_table)(struct ksz_device *dev, int port);
+-	void (*phy_setup)(struct ksz_device *dev, int port,
+-			  struct phy_device *phy);
+ 	void (*port_cleanup)(struct ksz_device *dev, int port);
+ 	void (*port_setup)(struct ksz_device *dev, int port, bool cpu_port);
+ 	void (*r_phy)(struct ksz_device *dev, u16 phy, u16 reg, u16 *val);
+diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c
+index 1b1a09095c0d..78e20f53677d 100644
+--- a/drivers/net/ethernet/atheros/ag71xx.c
++++ b/drivers/net/ethernet/atheros/ag71xx.c
+@@ -553,7 +553,8 @@ static int ag71xx_mdio_probe(struct ag71xx *ag)
+ 	ag->mdio_reset = of_reset_control_get_exclusive(np, "mdio");
+ 	if (IS_ERR(ag->mdio_reset)) {
+ 		netif_err(ag, probe, ndev, "Failed to get reset mdio.\n");
+-		return PTR_ERR(ag->mdio_reset);
++		err = PTR_ERR(ag->mdio_reset);
++		goto mdio_err_put_clk;
+ 	}
+ 
+ 	mii_bus->name = "ag71xx_mdio";
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index b5147bd6cba6..2cbfe0cd7eef 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -3423,7 +3423,7 @@ void bnxt_set_tpa_flags(struct bnxt *bp)
+  */
+ void bnxt_set_ring_params(struct bnxt *bp)
+ {
+-	u32 ring_size, rx_size, rx_space;
++	u32 ring_size, rx_size, rx_space, max_rx_cmpl;
+ 	u32 agg_factor = 0, agg_ring_size = 0;
+ 
+ 	/* 8 for CRC and VLAN */
+@@ -3479,7 +3479,15 @@ void bnxt_set_ring_params(struct bnxt *bp)
+ 	bp->tx_nr_pages = bnxt_calc_nr_ring_pages(ring_size, TX_DESC_CNT);
+ 	bp->tx_ring_mask = (bp->tx_nr_pages * TX_DESC_CNT) - 1;
+ 
+-	ring_size = bp->rx_ring_size * (2 + agg_factor) + bp->tx_ring_size;
++	max_rx_cmpl = bp->rx_ring_size;
++	/* MAX TPA needs to be added because TPA_START completions are
++	 * immediately recycled, so the TPA completions are not bound by
++	 * the RX ring size.
++	 */
++	if (bp->flags & BNXT_FLAG_TPA)
++		max_rx_cmpl += bp->max_tpa;
++	/* RX and TPA completions are 32-byte, all others are 16-byte */
++	ring_size = max_rx_cmpl * 2 + agg_ring_size + bp->tx_ring_size;
+ 	bp->cp_ring_size = ring_size;
+ 
+ 	bp->cp_nr_pages = bnxt_calc_nr_ring_pages(ring_size, CP_DESC_CNT);
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index fb1ab58da9fa..1f512e7c3d43 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1688,8 +1688,11 @@ static int bnxt_set_pauseparam(struct net_device *dev,
+ 	if (epause->tx_pause)
+ 		link_info->req_flow_ctrl |= BNXT_LINK_PAUSE_TX;
+ 
+-	if (netif_running(dev))
++	if (netif_running(dev)) {
++		mutex_lock(&bp->link_lock);
+ 		rc = bnxt_hwrm_set_pause(bp);
++		mutex_unlock(&bp->link_lock);
++	}
+ 	return rc;
+ }
+ 
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+index b73421c3e25b..74847aa644f1 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+@@ -885,6 +885,7 @@ static int enetc_pf_probe(struct pci_dev *pdev,
+ 	return 0;
+ 
+ err_reg_netdev:
++	enetc_mdio_remove(pf);
+ 	enetc_of_put_phy(priv);
+ 	enetc_free_msix(priv);
+ err_alloc_msix:
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+index a0998937727d..0db835d87d09 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -77,6 +77,7 @@
+ 	((ring)->p = ((ring)->p - 1 + (ring)->desc_num) % (ring)->desc_num)
+ 
+ enum hns_desc_type {
++	DESC_TYPE_UNKNOWN,
+ 	DESC_TYPE_SKB,
+ 	DESC_TYPE_PAGE,
+ };
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 37537c302080..506381224559 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -1292,6 +1292,10 @@ static void hns3_clear_desc(struct hns3_enet_ring *ring, int next_to_use_orig)
+ 	unsigned int i;
+ 
+ 	for (i = 0; i < ring->desc_num; i++) {
++		struct hns3_desc *desc = &ring->desc[ring->next_to_use];
++
++		memset(desc, 0, sizeof(*desc));
++
+ 		/* check if this is where we started */
+ 		if (ring->next_to_use == next_to_use_orig)
+ 			break;
+@@ -1299,6 +1303,9 @@ static void hns3_clear_desc(struct hns3_enet_ring *ring, int next_to_use_orig)
+ 		/* rollback one */
+ 		ring_ptr_move_bw(ring, next_to_use);
+ 
++		if (!ring->desc_cb[ring->next_to_use].dma)
++			continue;
++
+ 		/* unmap the descriptor dma address */
+ 		if (ring->desc_cb[ring->next_to_use].type == DESC_TYPE_SKB)
+ 			dma_unmap_single(dev,
+@@ -1313,6 +1320,7 @@ static void hns3_clear_desc(struct hns3_enet_ring *ring, int next_to_use_orig)
+ 
+ 		ring->desc_cb[ring->next_to_use].length = 0;
+ 		ring->desc_cb[ring->next_to_use].dma = 0;
++		ring->desc_cb[ring->next_to_use].type = DESC_TYPE_UNKNOWN;
+ 	}
+ }
+ 
+diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
+index 5f56ee83e3b1..df7c23cd3360 100644
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -203,7 +203,7 @@ io_error:
+ 
+ static inline u16 gm_phy_read(struct sky2_hw *hw, unsigned port, u16 reg)
+ {
+-	u16 v;
++	u16 v = 0;
+ 	__gm_phy_read(hw, port, reg, &v);
+ 	return v;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
+index 0a0884d86d44..1b204ce30ee4 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -592,7 +592,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core)
+ 	err = mlxsw_core_trap_register(mlxsw_core, &mlxsw_emad_rx_listener,
+ 				       mlxsw_core);
+ 	if (err)
+-		return err;
++		goto err_trap_register;
+ 
+ 	err = mlxsw_core->driver->basic_trap_groups_set(mlxsw_core);
+ 	if (err)
+@@ -604,6 +604,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core)
+ err_emad_trap_set:
+ 	mlxsw_core_trap_unregister(mlxsw_core, &mlxsw_emad_rx_listener,
+ 				   mlxsw_core);
++err_trap_register:
+ 	destroy_workqueue(mlxsw_core->emad_wq);
+ 	return err;
+ }
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
+index 7d10265f782a..5aacc00962df 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
+@@ -102,15 +102,18 @@ static void ionic_get_regs(struct net_device *netdev, struct ethtool_regs *regs,
+ 			   void *p)
+ {
+ 	struct ionic_lif *lif = netdev_priv(netdev);
++	unsigned int offset;
+ 	unsigned int size;
+ 
+ 	regs->version = IONIC_DEV_CMD_REG_VERSION;
+ 
++	offset = 0;
+ 	size = IONIC_DEV_INFO_REG_COUNT * sizeof(u32);
+-	memcpy_fromio(p, lif->ionic->idev.dev_info_regs->words, size);
++	memcpy_fromio(p + offset, lif->ionic->idev.dev_info_regs->words, size);
+ 
++	offset += size;
+ 	size = IONIC_DEV_CMD_REG_COUNT * sizeof(u32);
+-	memcpy_fromio(p, lif->ionic->idev.dev_cmd_regs->words, size);
++	memcpy_fromio(p + offset, lif->ionic->idev.dev_cmd_regs->words, size);
+ }
+ 
+ static int ionic_get_link_ksettings(struct net_device *netdev,
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+index d5b0bf54f961..c00ec9a02097 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -809,8 +809,7 @@ static int ionic_lif_addr_add(struct ionic_lif *lif, const u8 *addr)
+ 	if (f)
+ 		return 0;
+ 
+-	netdev_dbg(lif->netdev, "rx_filter add ADDR %pM (id %d)\n", addr,
+-		   ctx.comp.rx_filter_add.filter_id);
++	netdev_dbg(lif->netdev, "rx_filter add ADDR %pM\n", addr);
+ 
+ 	memcpy(ctx.cmd.rx_filter_add.mac.addr, addr, ETH_ALEN);
+ 	err = ionic_adminq_post_wait(lif, &ctx);
+@@ -839,6 +838,9 @@ static int ionic_lif_addr_del(struct ionic_lif *lif, const u8 *addr)
+ 		return -ENOENT;
+ 	}
+ 
++	netdev_dbg(lif->netdev, "rx_filter del ADDR %pM (id %d)\n",
++		   addr, f->filter_id);
++
+ 	ctx.cmd.rx_filter_del.filter_id = cpu_to_le32(f->filter_id);
+ 	ionic_rx_filter_free(lif, f);
+ 	spin_unlock_bh(&lif->rx_filters.lock);
+@@ -847,9 +849,6 @@ static int ionic_lif_addr_del(struct ionic_lif *lif, const u8 *addr)
+ 	if (err)
+ 		return err;
+ 
+-	netdev_dbg(lif->netdev, "rx_filter del ADDR %pM (id %d)\n", addr,
+-		   ctx.cmd.rx_filter_del.filter_id);
+-
+ 	return 0;
+ }
+ 
+@@ -1291,13 +1290,11 @@ static int ionic_vlan_rx_add_vid(struct net_device *netdev, __be16 proto,
+ 	};
+ 	int err;
+ 
++	netdev_dbg(netdev, "rx_filter add VLAN %d\n", vid);
+ 	err = ionic_adminq_post_wait(lif, &ctx);
+ 	if (err)
+ 		return err;
+ 
+-	netdev_dbg(netdev, "rx_filter add VLAN %d (id %d)\n", vid,
+-		   ctx.comp.rx_filter_add.filter_id);
+-
+ 	return ionic_rx_filter_save(lif, 0, IONIC_RXQ_INDEX_ANY, 0, &ctx);
+ }
+ 
+@@ -1322,8 +1319,8 @@ static int ionic_vlan_rx_kill_vid(struct net_device *netdev, __be16 proto,
+ 		return -ENOENT;
+ 	}
+ 
+-	netdev_dbg(netdev, "rx_filter del VLAN %d (id %d)\n", vid,
+-		   le32_to_cpu(ctx.cmd.rx_filter_del.filter_id));
++	netdev_dbg(netdev, "rx_filter del VLAN %d (id %d)\n",
++		   vid, f->filter_id);
+ 
+ 	ctx.cmd.rx_filter_del.filter_id = cpu_to_le32(f->filter_id);
+ 	ionic_rx_filter_free(lif, f);
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c b/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c
+index 7a093f148ee5..60cb77e2bab4 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c
+@@ -36,10 +36,12 @@ int ionic_rx_filters_init(struct ionic_lif *lif)
+ 
+ 	spin_lock_init(&lif->rx_filters.lock);
+ 
++	spin_lock_bh(&lif->rx_filters.lock);
+ 	for (i = 0; i < IONIC_RX_FILTER_HLISTS; i++) {
+ 		INIT_HLIST_HEAD(&lif->rx_filters.by_hash[i]);
+ 		INIT_HLIST_HEAD(&lif->rx_filters.by_id[i]);
+ 	}
++	spin_unlock_bh(&lif->rx_filters.lock);
+ 
+ 	return 0;
+ }
+@@ -51,11 +53,13 @@ void ionic_rx_filters_deinit(struct ionic_lif *lif)
+ 	struct hlist_node *tmp;
+ 	unsigned int i;
+ 
++	spin_lock_bh(&lif->rx_filters.lock);
+ 	for (i = 0; i < IONIC_RX_FILTER_HLISTS; i++) {
+ 		head = &lif->rx_filters.by_id[i];
+ 		hlist_for_each_entry_safe(f, tmp, head, by_id)
+ 			ionic_rx_filter_free(lif, f);
+ 	}
++	spin_unlock_bh(&lif->rx_filters.lock);
+ }
+ 
+ int ionic_rx_filter_save(struct ionic_lif *lif, u32 flow_id, u16 rxq_index,
+@@ -91,6 +95,7 @@ int ionic_rx_filter_save(struct ionic_lif *lif, u32 flow_id, u16 rxq_index,
+ 	f->filter_id = le32_to_cpu(ctx->comp.rx_filter_add.filter_id);
+ 	f->rxq_index = rxq_index;
+ 	memcpy(&f->cmd, ac, sizeof(f->cmd));
++	netdev_dbg(lif->netdev, "rx_filter add filter_id %d\n", f->filter_id);
+ 
+ 	INIT_HLIST_NODE(&f->by_hash);
+ 	INIT_HLIST_NODE(&f->by_id);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+index 1d6dfba0c034..8ea46b81b739 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+@@ -2073,8 +2073,8 @@ static void qed_rdma_set_pf_params(struct qed_hwfn *p_hwfn,
+ 	num_srqs = min_t(u32, QED_RDMA_MAX_SRQS, p_params->num_srqs);
+ 
+ 	if (p_hwfn->mcp_info->func_info.protocol == QED_PCI_ETH_RDMA) {
+-		DP_NOTICE(p_hwfn,
+-			  "Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only\n");
++		DP_VERBOSE(p_hwfn, QED_MSG_SP,
++			   "Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only\n");
+ 		p_hwfn->hw_info.personality = QED_PCI_ETH_ROCE;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+index 638047b937c6..4456ce5325a7 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -3092,7 +3092,7 @@ int qed_hw_init(struct qed_dev *cdev, struct qed_hw_init_params *p_params)
+ 		}
+ 
+ 		/* Log and clear previous pglue_b errors if such exist */
+-		qed_pglueb_rbc_attn_handler(p_hwfn, p_hwfn->p_main_ptt);
++		qed_pglueb_rbc_attn_handler(p_hwfn, p_hwfn->p_main_ptt, true);
+ 
+ 		/* Enable the PF's internal FID_enable in the PXP */
+ 		rc = qed_pglueb_set_pfid_enable(p_hwfn, p_hwfn->p_main_ptt,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
+index 9f5113639eaf..8d106063e927 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
+@@ -256,9 +256,10 @@ out:
+ #define PGLUE_ATTENTION_ZLR_VALID		(1 << 25)
+ #define PGLUE_ATTENTION_ILT_VALID		(1 << 23)
+ 
+-int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn,
+-				struct qed_ptt *p_ptt)
++int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++				bool hw_init)
+ {
++	char msg[256];
+ 	u32 tmp;
+ 
+ 	tmp = qed_rd(p_hwfn, p_ptt, PGLUE_B_REG_TX_ERR_WR_DETAILS2);
+@@ -272,22 +273,23 @@ int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn,
+ 		details = qed_rd(p_hwfn, p_ptt,
+ 				 PGLUE_B_REG_TX_ERR_WR_DETAILS);
+ 
+-		DP_NOTICE(p_hwfn,
+-			  "Illegal write by chip to [%08x:%08x] blocked.\n"
+-			  "Details: %08x [PFID %02x, VFID %02x, VF_VALID %02x]\n"
+-			  "Details2 %08x [Was_error %02x BME deassert %02x FID_enable deassert %02x]\n",
+-			  addr_hi, addr_lo, details,
+-			  (u8)GET_FIELD(details, PGLUE_ATTENTION_DETAILS_PFID),
+-			  (u8)GET_FIELD(details, PGLUE_ATTENTION_DETAILS_VFID),
+-			  GET_FIELD(details,
+-				    PGLUE_ATTENTION_DETAILS_VF_VALID) ? 1 : 0,
+-			  tmp,
+-			  GET_FIELD(tmp,
+-				    PGLUE_ATTENTION_DETAILS2_WAS_ERR) ? 1 : 0,
+-			  GET_FIELD(tmp,
+-				    PGLUE_ATTENTION_DETAILS2_BME) ? 1 : 0,
+-			  GET_FIELD(tmp,
+-				    PGLUE_ATTENTION_DETAILS2_FID_EN) ? 1 : 0);
++		snprintf(msg, sizeof(msg),
++			 "Illegal write by chip to [%08x:%08x] blocked.\n"
++			 "Details: %08x [PFID %02x, VFID %02x, VF_VALID %02x]\n"
++			 "Details2 %08x [Was_error %02x BME deassert %02x FID_enable deassert %02x]",
++			 addr_hi, addr_lo, details,
++			 (u8)GET_FIELD(details, PGLUE_ATTENTION_DETAILS_PFID),
++			 (u8)GET_FIELD(details, PGLUE_ATTENTION_DETAILS_VFID),
++			 !!GET_FIELD(details, PGLUE_ATTENTION_DETAILS_VF_VALID),
++			 tmp,
++			 !!GET_FIELD(tmp, PGLUE_ATTENTION_DETAILS2_WAS_ERR),
++			 !!GET_FIELD(tmp, PGLUE_ATTENTION_DETAILS2_BME),
++			 !!GET_FIELD(tmp, PGLUE_ATTENTION_DETAILS2_FID_EN));
++
++		if (hw_init)
++			DP_VERBOSE(p_hwfn, NETIF_MSG_INTR, "%s\n", msg);
++		else
++			DP_NOTICE(p_hwfn, "%s\n", msg);
+ 	}
+ 
+ 	tmp = qed_rd(p_hwfn, p_ptt, PGLUE_B_REG_TX_ERR_RD_DETAILS2);
+@@ -320,8 +322,14 @@ int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn,
+ 	}
+ 
+ 	tmp = qed_rd(p_hwfn, p_ptt, PGLUE_B_REG_TX_ERR_WR_DETAILS_ICPL);
+-	if (tmp & PGLUE_ATTENTION_ICPL_VALID)
+-		DP_NOTICE(p_hwfn, "ICPL error - %08x\n", tmp);
++	if (tmp & PGLUE_ATTENTION_ICPL_VALID) {
++		snprintf(msg, sizeof(msg), "ICPL error - %08x", tmp);
++
++		if (hw_init)
++			DP_VERBOSE(p_hwfn, NETIF_MSG_INTR, "%s\n", msg);
++		else
++			DP_NOTICE(p_hwfn, "%s\n", msg);
++	}
+ 
+ 	tmp = qed_rd(p_hwfn, p_ptt, PGLUE_B_REG_MASTER_ZLR_ERR_DETAILS);
+ 	if (tmp & PGLUE_ATTENTION_ZLR_VALID) {
+@@ -360,7 +368,7 @@ int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn,
+ 
+ static int qed_pglueb_rbc_attn_cb(struct qed_hwfn *p_hwfn)
+ {
+-	return qed_pglueb_rbc_attn_handler(p_hwfn, p_hwfn->p_dpc_ptt);
++	return qed_pglueb_rbc_attn_handler(p_hwfn, p_hwfn->p_dpc_ptt, false);
+ }
+ 
+ #define QED_DORQ_ATTENTION_REASON_MASK  (0xfffff)
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.h b/drivers/net/ethernet/qlogic/qed/qed_int.h
+index d473b522afc5..ba5cfebf2d0d 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_int.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_int.h
+@@ -431,7 +431,7 @@ int qed_int_set_timer_res(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+ 
+ #define QED_MAPPING_MEMORY_SIZE(dev)	(NUM_OF_SBS(dev))
+ 
+-int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn,
+-				struct qed_ptt *p_ptt);
++int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++				bool hw_init);
+ 
+ #endif
+diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
+index 3a6761131f4c..2248d2674612 100644
+--- a/drivers/net/ethernet/smsc/smc91x.c
++++ b/drivers/net/ethernet/smsc/smc91x.c
+@@ -2274,7 +2274,7 @@ static int smc_drv_probe(struct platform_device *pdev)
+ 		ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio,
+ 					      "power", 0, 0, 100);
+ 		if (ret)
+-			return ret;
++			goto out_free_netdev;
+ 
+ 		/*
+ 		 * Optional reset GPIO configured? Minimum 100 ns reset needed
+@@ -2283,7 +2283,7 @@ static int smc_drv_probe(struct platform_device *pdev)
+ 		ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio,
+ 					      "reset", 0, 0, 100);
+ 		if (ret)
+-			return ret;
++			goto out_free_netdev;
+ 
+ 		/*
+ 		 * Need to wait for optional EEPROM to load, max 750 us according
+diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c
+index 38d39c4b5ac8..603d54f83399 100644
+--- a/drivers/net/ethernet/socionext/sni_ave.c
++++ b/drivers/net/ethernet/socionext/sni_ave.c
+@@ -1191,7 +1191,7 @@ static int ave_init(struct net_device *ndev)
+ 	ret = regmap_update_bits(priv->regmap, SG_ETPINMODE,
+ 				 priv->pinmode_mask, priv->pinmode_val);
+ 	if (ret)
+-		return ret;
++		goto out_reset_assert;
+ 
+ 	ave_global_reset(ndev);
+ 
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 19d9d78a6df2..adfdf6260b26 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -1615,11 +1615,11 @@ static int geneve_changelink(struct net_device *dev, struct nlattr *tb[],
+ 			     struct netlink_ext_ack *extack)
+ {
+ 	struct geneve_dev *geneve = netdev_priv(dev);
++	enum ifla_geneve_df df = geneve->df;
+ 	struct geneve_sock *gs4, *gs6;
+ 	struct ip_tunnel_info info;
+ 	bool metadata;
+ 	bool use_udp6_rx_checksums;
+-	enum ifla_geneve_df df;
+ 	bool ttl_inherit;
+ 	int err;
+ 
+diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
+index 2a6ec5394966..a4b3fce69ecd 100644
+--- a/drivers/net/hippi/rrunner.c
++++ b/drivers/net/hippi/rrunner.c
+@@ -1242,7 +1242,7 @@ static int rr_open(struct net_device *dev)
+ 		rrpriv->info = NULL;
+ 	}
+ 	if (rrpriv->rx_ctrl) {
+-		pci_free_consistent(pdev, sizeof(struct ring_ctrl),
++		pci_free_consistent(pdev, 256 * sizeof(struct ring_ctrl),
+ 				    rrpriv->rx_ctrl, rrpriv->rx_ctrl_dma);
+ 		rrpriv->rx_ctrl = NULL;
+ 	}
+diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
+index 5a37514e4234..8dbccec6ac86 100644
+--- a/drivers/net/ieee802154/adf7242.c
++++ b/drivers/net/ieee802154/adf7242.c
+@@ -1262,7 +1262,7 @@ static int adf7242_probe(struct spi_device *spi)
+ 					     WQ_MEM_RECLAIM);
+ 	if (unlikely(!lp->wqueue)) {
+ 		ret = -ENOMEM;
+-		goto err_hw_init;
++		goto err_alloc_wq;
+ 	}
+ 
+ 	ret = adf7242_hw_init(lp);
+@@ -1294,6 +1294,8 @@ static int adf7242_probe(struct spi_device *spi)
+ 	return ret;
+ 
+ err_hw_init:
++	destroy_workqueue(lp->wqueue);
++err_alloc_wq:
+ 	mutex_destroy(&lp->bmux);
+ 	ieee802154_free_hw(lp->hw);
+ 
+diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
+index 55f57f76d01b..a6bbe93f29ef 100644
+--- a/drivers/net/netdevsim/netdev.c
++++ b/drivers/net/netdevsim/netdev.c
+@@ -301,7 +301,7 @@ nsim_create(struct nsim_dev *nsim_dev, struct nsim_dev_port *nsim_dev_port)
+ 	rtnl_lock();
+ 	err = nsim_bpf_init(ns);
+ 	if (err)
+-		goto err_free_netdev;
++		goto err_rtnl_unlock;
+ 
+ 	nsim_ipsec_init(ns);
+ 
+@@ -315,8 +315,8 @@ nsim_create(struct nsim_dev *nsim_dev, struct nsim_dev_port *nsim_dev_port)
+ err_ipsec_teardown:
+ 	nsim_ipsec_teardown(ns);
+ 	nsim_bpf_uninit(ns);
++err_rtnl_unlock:
+ 	rtnl_unlock();
+-err_free_netdev:
+ 	free_netdev(dev);
+ 	return ERR_PTR(err);
+ }
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index 1c75b2627ca8..7d845117abb0 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -1348,6 +1348,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ 		dp83640->hwts_rx_en = 1;
+ 		dp83640->layer = PTP_CLASS_L4;
+ 		dp83640->version = PTP_CLASS_V1;
++		cfg.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT;
+ 		break;
+ 	case HWTSTAMP_FILTER_PTP_V2_L4_EVENT:
+ 	case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
+@@ -1355,6 +1356,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ 		dp83640->hwts_rx_en = 1;
+ 		dp83640->layer = PTP_CLASS_L4;
+ 		dp83640->version = PTP_CLASS_V2;
++		cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
+ 		break;
+ 	case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
+ 	case HWTSTAMP_FILTER_PTP_V2_L2_SYNC:
+@@ -1362,6 +1364,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ 		dp83640->hwts_rx_en = 1;
+ 		dp83640->layer = PTP_CLASS_L2;
+ 		dp83640->version = PTP_CLASS_V2;
++		cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
+ 		break;
+ 	case HWTSTAMP_FILTER_PTP_V2_EVENT:
+ 	case HWTSTAMP_FILTER_PTP_V2_SYNC:
+@@ -1369,6 +1372,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ 		dp83640->hwts_rx_en = 1;
+ 		dp83640->layer = PTP_CLASS_L4 | PTP_CLASS_L2;
+ 		dp83640->version = PTP_CLASS_V2;
++		cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+ 		break;
+ 	default:
+ 		return -ERANGE;
+diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c
+index af3994e0853b..6101d82102e7 100644
+--- a/drivers/net/usb/ax88172a.c
++++ b/drivers/net/usb/ax88172a.c
+@@ -198,6 +198,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf)
+ 	ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0);
+ 	if (ret < ETH_ALEN) {
+ 		netdev_err(dev->net, "Failed to read MAC address: %d\n", ret);
++		ret = -EIO;
+ 		goto free;
+ 	}
+ 	memcpy(dev->net->dev_addr, buf, ETH_ALEN);
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index 0f1217b506ad..5a6f27298b90 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -303,7 +303,6 @@ static void lapbeth_setup(struct net_device *dev)
+ 	dev->netdev_ops	     = &lapbeth_netdev_ops;
+ 	dev->needs_free_netdev = true;
+ 	dev->type            = ARPHRD_X25;
+-	dev->hard_header_len = 3;
+ 	dev->mtu             = 1000;
+ 	dev->addr_len        = 0;
+ }
+@@ -324,6 +323,14 @@ static int lapbeth_new_device(struct net_device *dev)
+ 	if (!ndev)
+ 		goto out;
+ 
++	/* When transmitting data:
++	 * first this driver removes a pseudo header of 1 byte,
++	 * then the lapb module prepends an LAPB header of at most 3 bytes,
++	 * then this driver prepends a length field of 2 bytes,
++	 * then the underlying Ethernet device prepends its own header.
++	 */
++	ndev->hard_header_len = -1 + 3 + 2 + dev->hard_header_len;
++
+ 	lapbeth = netdev_priv(ndev);
+ 	lapbeth->axdev = ndev;
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index 6049d3766c64..3f563e02d17d 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -643,9 +643,9 @@ err:
+ 
+ static void ath9k_hif_usb_rx_cb(struct urb *urb)
+ {
+-	struct sk_buff *skb = (struct sk_buff *) urb->context;
+-	struct hif_device_usb *hif_dev =
+-		usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
++	struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
++	struct hif_device_usb *hif_dev = rx_buf->hif_dev;
++	struct sk_buff *skb = rx_buf->skb;
+ 	int ret;
+ 
+ 	if (!skb)
+@@ -685,14 +685,15 @@ resubmit:
+ 	return;
+ free:
+ 	kfree_skb(skb);
++	kfree(rx_buf);
+ }
+ 
+ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
+ {
+-	struct sk_buff *skb = (struct sk_buff *) urb->context;
++	struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
++	struct hif_device_usb *hif_dev = rx_buf->hif_dev;
++	struct sk_buff *skb = rx_buf->skb;
+ 	struct sk_buff *nskb;
+-	struct hif_device_usb *hif_dev =
+-		usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+ 	int ret;
+ 
+ 	if (!skb)
+@@ -732,11 +733,13 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
+ 			return;
+ 		}
+ 
++		rx_buf->skb = nskb;
++
+ 		usb_fill_int_urb(urb, hif_dev->udev,
+ 				 usb_rcvintpipe(hif_dev->udev,
+ 						 USB_REG_IN_PIPE),
+ 				 nskb->data, MAX_REG_IN_BUF_SIZE,
+-				 ath9k_hif_usb_reg_in_cb, nskb, 1);
++				 ath9k_hif_usb_reg_in_cb, rx_buf, 1);
+ 	}
+ 
+ resubmit:
+@@ -750,6 +753,7 @@ resubmit:
+ 	return;
+ free:
+ 	kfree_skb(skb);
++	kfree(rx_buf);
+ 	urb->context = NULL;
+ }
+ 
+@@ -795,7 +799,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
+ 	init_usb_anchor(&hif_dev->mgmt_submitted);
+ 
+ 	for (i = 0; i < MAX_TX_URB_NUM; i++) {
+-		tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL);
++		tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL);
+ 		if (!tx_buf)
+ 			goto err;
+ 
+@@ -832,8 +836,9 @@ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
+ 
+ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+ {
+-	struct urb *urb = NULL;
++	struct rx_buf *rx_buf = NULL;
+ 	struct sk_buff *skb = NULL;
++	struct urb *urb = NULL;
+ 	int i, ret;
+ 
+ 	init_usb_anchor(&hif_dev->rx_submitted);
+@@ -841,6 +846,12 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+ 
+ 	for (i = 0; i < MAX_RX_URB_NUM; i++) {
+ 
++		rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
++		if (!rx_buf) {
++			ret = -ENOMEM;
++			goto err_rxb;
++		}
++
+ 		/* Allocate URB */
+ 		urb = usb_alloc_urb(0, GFP_KERNEL);
+ 		if (urb == NULL) {
+@@ -855,11 +866,14 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+ 			goto err_skb;
+ 		}
+ 
++		rx_buf->hif_dev = hif_dev;
++		rx_buf->skb = skb;
++
+ 		usb_fill_bulk_urb(urb, hif_dev->udev,
+ 				  usb_rcvbulkpipe(hif_dev->udev,
+ 						  USB_WLAN_RX_PIPE),
+ 				  skb->data, MAX_RX_BUF_SIZE,
+-				  ath9k_hif_usb_rx_cb, skb);
++				  ath9k_hif_usb_rx_cb, rx_buf);
+ 
+ 		/* Anchor URB */
+ 		usb_anchor_urb(urb, &hif_dev->rx_submitted);
+@@ -885,6 +899,8 @@ err_submit:
+ err_skb:
+ 	usb_free_urb(urb);
+ err_urb:
++	kfree(rx_buf);
++err_rxb:
+ 	ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
+ 	return ret;
+ }
+@@ -896,14 +912,21 @@ static void ath9k_hif_usb_dealloc_reg_in_urbs(struct hif_device_usb *hif_dev)
+ 
+ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
+ {
+-	struct urb *urb = NULL;
++	struct rx_buf *rx_buf = NULL;
+ 	struct sk_buff *skb = NULL;
++	struct urb *urb = NULL;
+ 	int i, ret;
+ 
+ 	init_usb_anchor(&hif_dev->reg_in_submitted);
+ 
+ 	for (i = 0; i < MAX_REG_IN_URB_NUM; i++) {
+ 
++		rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
++		if (!rx_buf) {
++			ret = -ENOMEM;
++			goto err_rxb;
++		}
++
+ 		/* Allocate URB */
+ 		urb = usb_alloc_urb(0, GFP_KERNEL);
+ 		if (urb == NULL) {
+@@ -918,11 +941,14 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
+ 			goto err_skb;
+ 		}
+ 
++		rx_buf->hif_dev = hif_dev;
++		rx_buf->skb = skb;
++
+ 		usb_fill_int_urb(urb, hif_dev->udev,
+ 				  usb_rcvintpipe(hif_dev->udev,
+ 						  USB_REG_IN_PIPE),
+ 				  skb->data, MAX_REG_IN_BUF_SIZE,
+-				  ath9k_hif_usb_reg_in_cb, skb, 1);
++				  ath9k_hif_usb_reg_in_cb, rx_buf, 1);
+ 
+ 		/* Anchor URB */
+ 		usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
+@@ -948,6 +974,8 @@ err_submit:
+ err_skb:
+ 	usb_free_urb(urb);
+ err_urb:
++	kfree(rx_buf);
++err_rxb:
+ 	ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
+ 	return ret;
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h
+index a94e7e1c86e9..5985aa15ca93 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
+@@ -86,6 +86,11 @@ struct tx_buf {
+ 	struct list_head list;
+ };
+ 
++struct rx_buf {
++	struct sk_buff *skb;
++	struct hif_device_usb *hif_dev;
++};
++
+ #define HIF_USB_TX_STOP  BIT(0)
+ #define HIF_USB_TX_FLUSH BIT(1)
+ 
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index 41f62793a57c..a36aa9e85e0b 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -1184,17 +1184,15 @@ static int iwl_mvm_inactivity_check(struct iwl_mvm *mvm, u8 alloc_for_sta)
+ 	for_each_set_bit(i, &changetid_queues, IWL_MAX_HW_QUEUES)
+ 		iwl_mvm_change_queue_tid(mvm, i);
+ 
++	rcu_read_unlock();
++
+ 	if (free_queue >= 0 && alloc_for_sta != IWL_MVM_INVALID_STA) {
+ 		ret = iwl_mvm_free_inactive_queue(mvm, free_queue, queue_owner,
+ 						  alloc_for_sta);
+-		if (ret) {
+-			rcu_read_unlock();
++		if (ret)
+ 			return ret;
+-		}
+ 	}
+ 
+-	rcu_read_unlock();
+-
+ 	return free_queue;
+ }
+ 
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index 87348ecfe3fc..7c24c0aedad4 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -680,9 +680,10 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features)
+ 
+ 	vmd->irq_domain = pci_msi_create_irq_domain(fn, &vmd_msi_domain_info,
+ 						    x86_vector_domain);
+-	irq_domain_free_fwnode(fn);
+-	if (!vmd->irq_domain)
++	if (!vmd->irq_domain) {
++		irq_domain_free_fwnode(fn);
+ 		return -ENODEV;
++	}
+ 
+ 	pci_add_resource(&resources, &vmd->resources[0]);
+ 	pci_add_resource_offset(&resources, &vmd->resources[1], offset[0]);
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 08f7b1ed8c62..b1b2c8ddbc92 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -4610,8 +4610,7 @@ static int pci_pm_reset(struct pci_dev *dev, int probe)
+  * pcie_wait_for_link_delay - Wait until link is active or inactive
+  * @pdev: Bridge device
+  * @active: waiting for active or inactive?
+- * @delay: Delay to wait after link has become active (in ms). Specify %0
+- *	   for no delay.
++ * @delay: Delay to wait after link has become active (in ms)
+  *
+  * Use this to wait till link becomes active or inactive.
+  */
+@@ -4652,7 +4651,7 @@ static bool pcie_wait_for_link_delay(struct pci_dev *pdev, bool active,
+ 		msleep(10);
+ 		timeout -= 10;
+ 	}
+-	if (active && ret && delay)
++	if (active && ret)
+ 		msleep(delay);
+ 	else if (ret != active)
+ 		pci_info(pdev, "Data Link Layer Link Active not %s in 1000 msec\n",
+@@ -4773,28 +4772,17 @@ void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev)
+ 	if (!pcie_downstream_port(dev))
+ 		return;
+ 
+-	/*
+-	 * Per PCIe r5.0, sec 6.6.1, for downstream ports that support
+-	 * speeds > 5 GT/s, we must wait for link training to complete
+-	 * before the mandatory delay.
+-	 *
+-	 * We can only tell when link training completes via DLL Link
+-	 * Active, which is required for downstream ports that support
+-	 * speeds > 5 GT/s (sec 7.5.3.6).  Unfortunately some common
+-	 * devices do not implement Link Active reporting even when it's
+-	 * required, so we'll check for that directly instead of checking
+-	 * the supported link speed.  We assume devices without Link Active
+-	 * reporting can train in 100 ms regardless of speed.
+-	 */
+-	if (dev->link_active_reporting) {
+-		pci_dbg(dev, "waiting for link to train\n");
+-		if (!pcie_wait_for_link_delay(dev, true, 0)) {
++	if (pcie_get_speed_cap(dev) <= PCIE_SPEED_5_0GT) {
++		pci_dbg(dev, "waiting %d ms for downstream link\n", delay);
++		msleep(delay);
++	} else {
++		pci_dbg(dev, "waiting %d ms for downstream link, after activation\n",
++			delay);
++		if (!pcie_wait_for_link_delay(dev, true, delay)) {
+ 			/* Did not train, no need to wait any further */
+ 			return;
+ 		}
+ 	}
+-	pci_dbg(child, "waiting %d ms to become accessible\n", delay);
+-	msleep(delay);
+ 
+ 	if (!pci_device_is_present(child)) {
+ 		pci_dbg(child, "waiting additional %d ms to become accessible\n", delay);
+diff --git a/drivers/perf/arm-cci.c b/drivers/perf/arm-cci.c
+index 8f8606b9bc9e..aca4570f78a8 100644
+--- a/drivers/perf/arm-cci.c
++++ b/drivers/perf/arm-cci.c
+@@ -1720,6 +1720,7 @@ static struct platform_driver cci_pmu_driver = {
+ 	.driver = {
+ 		   .name = DRIVER_NAME,
+ 		   .of_match_table = arm_cci_pmu_matches,
++		   .suppress_bind_attrs = true,
+ 		  },
+ 	.probe = cci_pmu_probe,
+ 	.remove = cci_pmu_remove,
+diff --git a/drivers/perf/arm-ccn.c b/drivers/perf/arm-ccn.c
+index 6fc0273b6129..336948b41bd1 100644
+--- a/drivers/perf/arm-ccn.c
++++ b/drivers/perf/arm-ccn.c
+@@ -1545,6 +1545,7 @@ static struct platform_driver arm_ccn_driver = {
+ 	.driver = {
+ 		.name = "arm-ccn",
+ 		.of_match_table = arm_ccn_match,
++		.suppress_bind_attrs = true,
+ 	},
+ 	.probe = arm_ccn_probe,
+ 	.remove = arm_ccn_remove,
+diff --git a/drivers/perf/arm_dsu_pmu.c b/drivers/perf/arm_dsu_pmu.c
+index 70968c8c09d7..4594e2ed13d5 100644
+--- a/drivers/perf/arm_dsu_pmu.c
++++ b/drivers/perf/arm_dsu_pmu.c
+@@ -759,6 +759,7 @@ static struct platform_driver dsu_pmu_driver = {
+ 	.driver = {
+ 		.name	= DRVNAME,
+ 		.of_match_table = of_match_ptr(dsu_pmu_of_match),
++		.suppress_bind_attrs = true,
+ 	},
+ 	.probe = dsu_pmu_device_probe,
+ 	.remove = dsu_pmu_device_remove,
+diff --git a/drivers/perf/arm_smmuv3_pmu.c b/drivers/perf/arm_smmuv3_pmu.c
+index 3269232ff570..9cdd89b29334 100644
+--- a/drivers/perf/arm_smmuv3_pmu.c
++++ b/drivers/perf/arm_smmuv3_pmu.c
+@@ -742,6 +742,7 @@ static int smmu_pmu_probe(struct platform_device *pdev)
+ 	platform_set_drvdata(pdev, smmu_pmu);
+ 
+ 	smmu_pmu->pmu = (struct pmu) {
++		.module		= THIS_MODULE,
+ 		.task_ctx_nr    = perf_invalid_context,
+ 		.pmu_enable	= smmu_pmu_enable,
+ 		.pmu_disable	= smmu_pmu_disable,
+@@ -860,6 +861,7 @@ static void smmu_pmu_shutdown(struct platform_device *pdev)
+ static struct platform_driver smmu_pmu_driver = {
+ 	.driver = {
+ 		.name = "arm-smmu-v3-pmcg",
++		.suppress_bind_attrs = true,
+ 	},
+ 	.probe = smmu_pmu_probe,
+ 	.remove = smmu_pmu_remove,
+diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
+index 4e4984a55cd1..079701e8de18 100644
+--- a/drivers/perf/arm_spe_pmu.c
++++ b/drivers/perf/arm_spe_pmu.c
+@@ -1228,6 +1228,7 @@ static struct platform_driver arm_spe_pmu_driver = {
+ 	.driver	= {
+ 		.name		= DRVNAME,
+ 		.of_match_table	= of_match_ptr(arm_spe_pmu_of_match),
++		.suppress_bind_attrs = true,
+ 	},
+ 	.probe	= arm_spe_pmu_device_probe,
+ 	.remove	= arm_spe_pmu_device_remove,
+diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c
+index 6eef47de8fcc..09f44c6e2eaf 100644
+--- a/drivers/perf/fsl_imx8_ddr_perf.c
++++ b/drivers/perf/fsl_imx8_ddr_perf.c
+@@ -451,6 +451,7 @@ static int ddr_perf_init(struct ddr_pmu *pmu, void __iomem *base,
+ {
+ 	*pmu = (struct ddr_pmu) {
+ 		.pmu = (struct pmu) {
++			.module	      = THIS_MODULE,
+ 			.capabilities = PERF_PMU_CAP_NO_EXCLUDE,
+ 			.task_ctx_nr = perf_invalid_context,
+ 			.attr_groups = attr_groups,
+@@ -645,6 +646,7 @@ static struct platform_driver imx_ddr_pmu_driver = {
+ 	.driver         = {
+ 		.name   = "imx-ddr-pmu",
+ 		.of_match_table = imx_ddr_pmu_dt_ids,
++		.suppress_bind_attrs = true,
+ 	},
+ 	.probe          = ddr_perf_probe,
+ 	.remove         = ddr_perf_remove,
+diff --git a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c
+index e42d4464c2cf..b79c96b14328 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c
+@@ -381,6 +381,7 @@ static int hisi_ddrc_pmu_probe(struct platform_device *pdev)
+ 			      ddrc_pmu->sccl_id, ddrc_pmu->index_id);
+ 	ddrc_pmu->pmu = (struct pmu) {
+ 		.name		= name,
++		.module		= THIS_MODULE,
+ 		.task_ctx_nr	= perf_invalid_context,
+ 		.event_init	= hisi_uncore_pmu_event_init,
+ 		.pmu_enable	= hisi_uncore_pmu_enable,
+@@ -419,6 +420,7 @@ static struct platform_driver hisi_ddrc_pmu_driver = {
+ 	.driver = {
+ 		.name = "hisi_ddrc_pmu",
+ 		.acpi_match_table = ACPI_PTR(hisi_ddrc_pmu_acpi_match),
++		.suppress_bind_attrs = true,
+ 	},
+ 	.probe = hisi_ddrc_pmu_probe,
+ 	.remove = hisi_ddrc_pmu_remove,
+diff --git a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c
+index 0d6325d6a4ec..78865b4ac4a6 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c
+@@ -392,6 +392,7 @@ static int hisi_hha_pmu_probe(struct platform_device *pdev)
+ 			      hha_pmu->sccl_id, hha_pmu->index_id);
+ 	hha_pmu->pmu = (struct pmu) {
+ 		.name		= name,
++		.module		= THIS_MODULE,
+ 		.task_ctx_nr	= perf_invalid_context,
+ 		.event_init	= hisi_uncore_pmu_event_init,
+ 		.pmu_enable	= hisi_uncore_pmu_enable,
+@@ -430,6 +431,7 @@ static struct platform_driver hisi_hha_pmu_driver = {
+ 	.driver = {
+ 		.name = "hisi_hha_pmu",
+ 		.acpi_match_table = ACPI_PTR(hisi_hha_pmu_acpi_match),
++		.suppress_bind_attrs = true,
+ 	},
+ 	.probe = hisi_hha_pmu_probe,
+ 	.remove = hisi_hha_pmu_remove,
+diff --git a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
+index c5b0950c2a7a..9dd50c3bc74e 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
+@@ -382,6 +382,7 @@ static int hisi_l3c_pmu_probe(struct platform_device *pdev)
+ 			      l3c_pmu->sccl_id, l3c_pmu->index_id);
+ 	l3c_pmu->pmu = (struct pmu) {
+ 		.name		= name,
++		.module		= THIS_MODULE,
+ 		.task_ctx_nr	= perf_invalid_context,
+ 		.event_init	= hisi_uncore_pmu_event_init,
+ 		.pmu_enable	= hisi_uncore_pmu_enable,
+@@ -420,6 +421,7 @@ static struct platform_driver hisi_l3c_pmu_driver = {
+ 	.driver = {
+ 		.name = "hisi_l3c_pmu",
+ 		.acpi_match_table = ACPI_PTR(hisi_l3c_pmu_acpi_match),
++		.suppress_bind_attrs = true,
+ 	},
+ 	.probe = hisi_l3c_pmu_probe,
+ 	.remove = hisi_l3c_pmu_remove,
+diff --git a/drivers/perf/qcom_l2_pmu.c b/drivers/perf/qcom_l2_pmu.c
+index 21d6991dbe0b..4da37f650f98 100644
+--- a/drivers/perf/qcom_l2_pmu.c
++++ b/drivers/perf/qcom_l2_pmu.c
+@@ -1028,6 +1028,7 @@ static struct platform_driver l2_cache_pmu_driver = {
+ 	.driver = {
+ 		.name = "qcom-l2cache-pmu",
+ 		.acpi_match_table = ACPI_PTR(l2_cache_pmu_acpi_match),
++		.suppress_bind_attrs = true,
+ 	},
+ 	.probe = l2_cache_pmu_probe,
+ 	.remove = l2_cache_pmu_remove,
+diff --git a/drivers/perf/qcom_l3_pmu.c b/drivers/perf/qcom_l3_pmu.c
+index 656e830798d9..9ddb577c542b 100644
+--- a/drivers/perf/qcom_l3_pmu.c
++++ b/drivers/perf/qcom_l3_pmu.c
+@@ -814,6 +814,7 @@ static struct platform_driver qcom_l3_cache_pmu_driver = {
+ 	.driver = {
+ 		.name = "qcom-l3cache-pmu",
+ 		.acpi_match_table = ACPI_PTR(qcom_l3_cache_pmu_acpi_match),
++		.suppress_bind_attrs = true,
+ 	},
+ 	.probe = qcom_l3_cache_pmu_probe,
+ };
+diff --git a/drivers/perf/thunderx2_pmu.c b/drivers/perf/thunderx2_pmu.c
+index 43d76c85da56..9e1c3c7eeba9 100644
+--- a/drivers/perf/thunderx2_pmu.c
++++ b/drivers/perf/thunderx2_pmu.c
+@@ -816,6 +816,7 @@ static struct platform_driver tx2_uncore_driver = {
+ 	.driver = {
+ 		.name		= "tx2-uncore-pmu",
+ 		.acpi_match_table = ACPI_PTR(tx2_uncore_acpi_match),
++		.suppress_bind_attrs = true,
+ 	},
+ 	.probe = tx2_uncore_probe,
+ 	.remove = tx2_uncore_remove,
+diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c
+index 7e328d6385c3..328aea9f6be3 100644
+--- a/drivers/perf/xgene_pmu.c
++++ b/drivers/perf/xgene_pmu.c
+@@ -1981,6 +1981,7 @@ static struct platform_driver xgene_pmu_driver = {
+ 		.name		= "xgene-pmu",
+ 		.of_match_table = xgene_pmu_of_match,
+ 		.acpi_match_table = ACPI_PTR(xgene_pmu_acpi_match),
++		.suppress_bind_attrs = true,
+ 	},
+ };
+ 
+diff --git a/drivers/pinctrl/pinctrl-amd.h b/drivers/pinctrl/pinctrl-amd.h
+index 3e5760f1a715..d4a192df5fab 100644
+--- a/drivers/pinctrl/pinctrl-amd.h
++++ b/drivers/pinctrl/pinctrl-amd.h
+@@ -252,7 +252,7 @@ static const struct amd_pingroup kerncz_groups[] = {
+ 	{
+ 		.name = "uart0",
+ 		.pins = uart0_pins,
+-		.npins = 9,
++		.npins = 5,
+ 	},
+ 	{
+ 		.name = "uart1",
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index b1f4a31ba1ee..ed83fb135bab 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -424,6 +424,7 @@ static int asus_wmi_battery_add(struct power_supply *battery)
+ 	 * battery is named BATT.
+ 	 */
+ 	if (strcmp(battery->desc->name, "BAT0") != 0 &&
++	    strcmp(battery->desc->name, "BAT1") != 0 &&
+ 	    strcmp(battery->desc->name, "BATT") != 0)
+ 		return -ENODEV;
+ 
+diff --git a/drivers/platform/x86/intel_speed_select_if/isst_if_common.h b/drivers/platform/x86/intel_speed_select_if/isst_if_common.h
+index 1409a5bb5582..4f6f7f0761fc 100644
+--- a/drivers/platform/x86/intel_speed_select_if/isst_if_common.h
++++ b/drivers/platform/x86/intel_speed_select_if/isst_if_common.h
+@@ -13,6 +13,9 @@
+ #define INTEL_RAPL_PRIO_DEVID_0	0x3451
+ #define INTEL_CFG_MBOX_DEVID_0	0x3459
+ 
++#define INTEL_RAPL_PRIO_DEVID_1 0x3251
++#define INTEL_CFG_MBOX_DEVID_1  0x3259
++
+ /*
+  * Validate maximum commands in a single request.
+  * This is enough to handle command to every core in one ioctl, or all
+diff --git a/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c b/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c
+index de4169d0796b..9a055fd54053 100644
+--- a/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c
++++ b/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c
+@@ -148,6 +148,7 @@ static long isst_if_mbox_proc_cmd(u8 *cmd_ptr, int *write_only, int resume)
+ 
+ static const struct pci_device_id isst_if_mbox_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, INTEL_CFG_MBOX_DEVID_0)},
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, INTEL_CFG_MBOX_DEVID_1)},
+ 	{ 0 },
+ };
+ MODULE_DEVICE_TABLE(pci, isst_if_mbox_ids);
+diff --git a/drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c b/drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c
+index ad8c7c0df4d9..e3778204b7a6 100644
+--- a/drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c
++++ b/drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c
+@@ -72,6 +72,7 @@ static long isst_if_mmio_rd_wr(u8 *cmd_ptr, int *write_only, int resume)
+ 
+ static const struct pci_device_id isst_if_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, INTEL_RAPL_PRIO_DEVID_0)},
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, INTEL_RAPL_PRIO_DEVID_1)},
+ 	{ 0 },
+ };
+ MODULE_DEVICE_TABLE(pci, isst_if_ids);
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
+index b95f7d062ea4..d5a62fea8fe3 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
+@@ -2921,19 +2921,18 @@ BRM_status_show(struct device *cdev, struct device_attribute *attr,
+ 	if (!ioc->is_warpdrive) {
+ 		ioc_err(ioc, "%s: BRM attribute is only for warpdrive\n",
+ 			__func__);
+-		goto out;
++		return 0;
+ 	}
+ 	/* pci_access_mutex lock acquired by sysfs show path */
+ 	mutex_lock(&ioc->pci_access_mutex);
+-	if (ioc->pci_error_recovery || ioc->remove_host) {
+-		mutex_unlock(&ioc->pci_access_mutex);
+-		return 0;
+-	}
++	if (ioc->pci_error_recovery || ioc->remove_host)
++		goto out;
+ 
+ 	/* allocate upto GPIOVal 36 entries */
+ 	sz = offsetof(Mpi2IOUnitPage3_t, GPIOVal) + (sizeof(u16) * 36);
+ 	io_unit_pg3 = kzalloc(sz, GFP_KERNEL);
+ 	if (!io_unit_pg3) {
++		rc = -ENOMEM;
+ 		ioc_err(ioc, "%s: failed allocating memory for iounit_pg3: (%d) bytes\n",
+ 			__func__, sz);
+ 		goto out;
+@@ -2943,6 +2942,7 @@ BRM_status_show(struct device *cdev, struct device_attribute *attr,
+ 	    0) {
+ 		ioc_err(ioc, "%s: failed reading iounit_pg3\n",
+ 			__func__);
++		rc = -EINVAL;
+ 		goto out;
+ 	}
+ 
+@@ -2950,12 +2950,14 @@ BRM_status_show(struct device *cdev, struct device_attribute *attr,
+ 	if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+ 		ioc_err(ioc, "%s: iounit_pg3 failed with ioc_status(0x%04x)\n",
+ 			__func__, ioc_status);
++		rc = -EINVAL;
+ 		goto out;
+ 	}
+ 
+ 	if (io_unit_pg3->GPIOCount < 25) {
+ 		ioc_err(ioc, "%s: iounit_pg3->GPIOCount less than 25 entries, detected (%d) entries\n",
+ 			__func__, io_unit_pg3->GPIOCount);
++		rc = -EINVAL;
+ 		goto out;
+ 	}
+ 
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index df14597752ec..fb5a7832353c 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -239,6 +239,7 @@ static struct {
+ 	{"LSI", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+ 	{"ENGENIO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+ 	{"LENOVO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
++	{"FUJITSU", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+ 	{"SanDisk", "Cruzer Blade", NULL, BLIST_TRY_VPD_PAGES |
+ 		BLIST_INQUIRY_36},
+ 	{"SMSC", "USB 2 HS-CF", NULL, BLIST_SPARSELUN | BLIST_INQUIRY_36},
+diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c
+index 42f0550d6b11..6f41e4b5a2b8 100644
+--- a/drivers/scsi/scsi_dh.c
++++ b/drivers/scsi/scsi_dh.c
+@@ -63,6 +63,7 @@ static const struct scsi_dh_blist scsi_dh_blist[] = {
+ 	{"LSI", "INF-01-00",		"rdac", },
+ 	{"ENGENIO", "INF-01-00",	"rdac", },
+ 	{"LENOVO", "DE_Series",		"rdac", },
++	{"FUJITSU", "ETERNUS_AHB",	"rdac", },
+ 	{NULL, NULL,			NULL },
+ };
+ 
+diff --git a/drivers/scsi/scsi_transport_spi.c b/drivers/scsi/scsi_transport_spi.c
+index f8661062ef95..f3d5b1bbd5aa 100644
+--- a/drivers/scsi/scsi_transport_spi.c
++++ b/drivers/scsi/scsi_transport_spi.c
+@@ -339,7 +339,7 @@ store_spi_transport_##field(struct device *dev, 			\
+ 	struct spi_transport_attrs *tp					\
+ 		= (struct spi_transport_attrs *)&starget->starget_data;	\
+ 									\
+-	if (i->f->set_##field)						\
++	if (!i->f->set_##field)						\
+ 		return -EINVAL;						\
+ 	val = simple_strtoul(buf, NULL, 0);				\
+ 	if (val > tp->max_##field)					\
+diff --git a/drivers/soc/qcom/rpmh.c b/drivers/soc/qcom/rpmh.c
+index ae2d1590a611..13e1b450f296 100644
+--- a/drivers/soc/qcom/rpmh.c
++++ b/drivers/soc/qcom/rpmh.c
+@@ -150,10 +150,10 @@ existing:
+ 		break;
+ 	}
+ 
+-	ctrlr->dirty = (req->sleep_val != old_sleep_val ||
+-			req->wake_val != old_wake_val) &&
+-			req->sleep_val != UINT_MAX &&
+-			req->wake_val != UINT_MAX;
++	ctrlr->dirty |= (req->sleep_val != old_sleep_val ||
++			 req->wake_val != old_wake_val) &&
++			 req->sleep_val != UINT_MAX &&
++			 req->wake_val != UINT_MAX;
+ 
+ unlock:
+ 	spin_unlock_irqrestore(&ctrlr->cache_lock, flags);
+diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
+index 6888a4dcff6d..8acf24f7c5d4 100644
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -36,7 +36,6 @@
+ #define SPI_CFG0_SCK_LOW_OFFSET           8
+ #define SPI_CFG0_CS_HOLD_OFFSET           16
+ #define SPI_CFG0_CS_SETUP_OFFSET          24
+-#define SPI_ADJUST_CFG0_SCK_LOW_OFFSET    16
+ #define SPI_ADJUST_CFG0_CS_HOLD_OFFSET    0
+ #define SPI_ADJUST_CFG0_CS_SETUP_OFFSET   16
+ 
+@@ -48,6 +47,8 @@
+ #define SPI_CFG1_CS_IDLE_MASK             0xff
+ #define SPI_CFG1_PACKET_LOOP_MASK         0xff00
+ #define SPI_CFG1_PACKET_LENGTH_MASK       0x3ff0000
++#define SPI_CFG2_SCK_HIGH_OFFSET          0
++#define SPI_CFG2_SCK_LOW_OFFSET           16
+ 
+ #define SPI_CMD_ACT                  BIT(0)
+ #define SPI_CMD_RESUME               BIT(1)
+@@ -279,7 +280,7 @@ static void mtk_spi_set_cs(struct spi_device *spi, bool enable)
+ static void mtk_spi_prepare_transfer(struct spi_master *master,
+ 				     struct spi_transfer *xfer)
+ {
+-	u32 spi_clk_hz, div, sck_time, cs_time, reg_val = 0;
++	u32 spi_clk_hz, div, sck_time, cs_time, reg_val;
+ 	struct mtk_spi *mdata = spi_master_get_devdata(master);
+ 
+ 	spi_clk_hz = clk_get_rate(mdata->spi_clk);
+@@ -292,18 +293,18 @@ static void mtk_spi_prepare_transfer(struct spi_master *master,
+ 	cs_time = sck_time * 2;
+ 
+ 	if (mdata->dev_comp->enhance_timing) {
++		reg_val = (((sck_time - 1) & 0xffff)
++			   << SPI_CFG2_SCK_HIGH_OFFSET);
+ 		reg_val |= (((sck_time - 1) & 0xffff)
+-			   << SPI_CFG0_SCK_HIGH_OFFSET);
+-		reg_val |= (((sck_time - 1) & 0xffff)
+-			   << SPI_ADJUST_CFG0_SCK_LOW_OFFSET);
++			   << SPI_CFG2_SCK_LOW_OFFSET);
+ 		writel(reg_val, mdata->base + SPI_CFG2_REG);
+-		reg_val |= (((cs_time - 1) & 0xffff)
++		reg_val = (((cs_time - 1) & 0xffff)
+ 			   << SPI_ADJUST_CFG0_CS_HOLD_OFFSET);
+ 		reg_val |= (((cs_time - 1) & 0xffff)
+ 			   << SPI_ADJUST_CFG0_CS_SETUP_OFFSET);
+ 		writel(reg_val, mdata->base + SPI_CFG0_REG);
+ 	} else {
+-		reg_val |= (((sck_time - 1) & 0xff)
++		reg_val = (((sck_time - 1) & 0xff)
+ 			   << SPI_CFG0_SCK_HIGH_OFFSET);
+ 		reg_val |= (((sck_time - 1) & 0xff) << SPI_CFG0_SCK_LOW_OFFSET);
+ 		reg_val |= (((cs_time - 1) & 0xff) << SPI_CFG0_CS_HOLD_OFFSET);
+diff --git a/drivers/staging/comedi/drivers/addi_apci_1032.c b/drivers/staging/comedi/drivers/addi_apci_1032.c
+index 560649be9d13..e035c9f757a1 100644
+--- a/drivers/staging/comedi/drivers/addi_apci_1032.c
++++ b/drivers/staging/comedi/drivers/addi_apci_1032.c
+@@ -106,14 +106,22 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
+ 				    unsigned int *data)
+ {
+ 	struct apci1032_private *devpriv = dev->private;
+-	unsigned int shift, oldmask;
++	unsigned int shift, oldmask, himask, lomask;
+ 
+ 	switch (data[0]) {
+ 	case INSN_CONFIG_DIGITAL_TRIG:
+ 		if (data[1] != 0)
+ 			return -EINVAL;
+ 		shift = data[3];
+-		oldmask = (1U << shift) - 1;
++		if (shift < 32) {
++			oldmask = (1U << shift) - 1;
++			himask = data[4] << shift;
++			lomask = data[5] << shift;
++		} else {
++			oldmask = 0xffffffffu;
++			himask = 0;
++			lomask = 0;
++		}
+ 		switch (data[2]) {
+ 		case COMEDI_DIGITAL_TRIG_DISABLE:
+ 			devpriv->ctrl = 0;
+@@ -136,8 +144,8 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
+ 				devpriv->mode2 &= oldmask;
+ 			}
+ 			/* configure specified channels */
+-			devpriv->mode1 |= data[4] << shift;
+-			devpriv->mode2 |= data[5] << shift;
++			devpriv->mode1 |= himask;
++			devpriv->mode2 |= lomask;
+ 			break;
+ 		case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS:
+ 			if (devpriv->ctrl != (APCI1032_CTRL_INT_ENA |
+@@ -154,8 +162,8 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
+ 				devpriv->mode2 &= oldmask;
+ 			}
+ 			/* configure specified channels */
+-			devpriv->mode1 |= data[4] << shift;
+-			devpriv->mode2 |= data[5] << shift;
++			devpriv->mode1 |= himask;
++			devpriv->mode2 |= lomask;
+ 			break;
+ 		default:
+ 			return -EINVAL;
+diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c
+index 689acd69a1b9..816dd25b9d0e 100644
+--- a/drivers/staging/comedi/drivers/addi_apci_1500.c
++++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
+@@ -452,13 +452,14 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
+ 	struct apci1500_private *devpriv = dev->private;
+ 	unsigned int trig = data[1];
+ 	unsigned int shift = data[3];
+-	unsigned int hi_mask = data[4] << shift;
+-	unsigned int lo_mask = data[5] << shift;
+-	unsigned int chan_mask = hi_mask | lo_mask;
+-	unsigned int old_mask = (1 << shift) - 1;
++	unsigned int hi_mask;
++	unsigned int lo_mask;
++	unsigned int chan_mask;
++	unsigned int old_mask;
+ 	unsigned int pm;
+ 	unsigned int pt;
+ 	unsigned int pp;
++	unsigned int invalid_chan;
+ 
+ 	if (trig > 1) {
+ 		dev_dbg(dev->class_dev,
+@@ -466,7 +467,20 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
+ 		return -EINVAL;
+ 	}
+ 
+-	if (chan_mask > 0xffff) {
++	if (shift <= 16) {
++		hi_mask = data[4] << shift;
++		lo_mask = data[5] << shift;
++		old_mask = (1U << shift) - 1;
++		invalid_chan = (data[4] | data[5]) >> (16 - shift);
++	} else {
++		hi_mask = 0;
++		lo_mask = 0;
++		old_mask = 0xffff;
++		invalid_chan = data[4] | data[5];
++	}
++	chan_mask = hi_mask | lo_mask;
++
++	if (invalid_chan) {
+ 		dev_dbg(dev->class_dev, "invalid digital trigger channel\n");
+ 		return -EINVAL;
+ 	}
+diff --git a/drivers/staging/comedi/drivers/addi_apci_1564.c b/drivers/staging/comedi/drivers/addi_apci_1564.c
+index 10501fe6bb25..1268ba34be5f 100644
+--- a/drivers/staging/comedi/drivers/addi_apci_1564.c
++++ b/drivers/staging/comedi/drivers/addi_apci_1564.c
+@@ -331,14 +331,22 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
+ 				    unsigned int *data)
+ {
+ 	struct apci1564_private *devpriv = dev->private;
+-	unsigned int shift, oldmask;
++	unsigned int shift, oldmask, himask, lomask;
+ 
+ 	switch (data[0]) {
+ 	case INSN_CONFIG_DIGITAL_TRIG:
+ 		if (data[1] != 0)
+ 			return -EINVAL;
+ 		shift = data[3];
+-		oldmask = (1U << shift) - 1;
++		if (shift < 32) {
++			oldmask = (1U << shift) - 1;
++			himask = data[4] << shift;
++			lomask = data[5] << shift;
++		} else {
++			oldmask = 0xffffffffu;
++			himask = 0;
++			lomask = 0;
++		}
+ 		switch (data[2]) {
+ 		case COMEDI_DIGITAL_TRIG_DISABLE:
+ 			devpriv->ctrl = 0;
+@@ -362,8 +370,8 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
+ 				devpriv->mode2 &= oldmask;
+ 			}
+ 			/* configure specified channels */
+-			devpriv->mode1 |= data[4] << shift;
+-			devpriv->mode2 |= data[5] << shift;
++			devpriv->mode1 |= himask;
++			devpriv->mode2 |= lomask;
+ 			break;
+ 		case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS:
+ 			if (devpriv->ctrl != (APCI1564_DI_IRQ_ENA |
+@@ -380,8 +388,8 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
+ 				devpriv->mode2 &= oldmask;
+ 			}
+ 			/* configure specified channels */
+-			devpriv->mode1 |= data[4] << shift;
+-			devpriv->mode2 |= data[5] << shift;
++			devpriv->mode1 |= himask;
++			devpriv->mode2 |= lomask;
+ 			break;
+ 		default:
+ 			return -EINVAL;
+diff --git a/drivers/staging/comedi/drivers/ni_6527.c b/drivers/staging/comedi/drivers/ni_6527.c
+index 4d1eccb5041d..4518c2680b7c 100644
+--- a/drivers/staging/comedi/drivers/ni_6527.c
++++ b/drivers/staging/comedi/drivers/ni_6527.c
+@@ -332,7 +332,7 @@ static int ni6527_intr_insn_config(struct comedi_device *dev,
+ 		case COMEDI_DIGITAL_TRIG_ENABLE_EDGES:
+ 			/* check shift amount */
+ 			shift = data[3];
+-			if (shift >= s->n_chan) {
++			if (shift >= 32) {
+ 				mask = 0;
+ 				rising = 0;
+ 				falling = 0;
+diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c
+index d8d86761b790..8d32b1603d10 100644
+--- a/drivers/staging/wlan-ng/prism2usb.c
++++ b/drivers/staging/wlan-ng/prism2usb.c
+@@ -61,11 +61,25 @@ static int prism2sta_probe_usb(struct usb_interface *interface,
+ 			       const struct usb_device_id *id)
+ {
+ 	struct usb_device *dev;
+-
++	const struct usb_endpoint_descriptor *epd;
++	const struct usb_host_interface *iface_desc = interface->cur_altsetting;
+ 	struct wlandevice *wlandev = NULL;
+ 	struct hfa384x *hw = NULL;
+ 	int result = 0;
+ 
++	if (iface_desc->desc.bNumEndpoints != 2) {
++		result = -ENODEV;
++		goto failed;
++	}
++
++	result = -EINVAL;
++	epd = &iface_desc->endpoint[1].desc;
++	if (!usb_endpoint_is_bulk_in(epd))
++		goto failed;
++	epd = &iface_desc->endpoint[2].desc;
++	if (!usb_endpoint_is_bulk_out(epd))
++		goto failed;
++
+ 	dev = interface_to_usbdev(interface);
+ 	wlandev = create_wlan();
+ 	if (!wlandev) {
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index f1d230c5a8ef..2675771a03a0 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -524,6 +524,7 @@ static void __init serial8250_isa_init_ports(void)
+ 		 */
+ 		up->mcr_mask = ~ALPHA_KLUDGE_MCR;
+ 		up->mcr_force = ALPHA_KLUDGE_MCR;
++		serial8250_set_defaults(up);
+ 	}
+ 
+ 	/* chain base port ops to support Remote Supervisor Adapter */
+@@ -547,7 +548,6 @@ static void __init serial8250_isa_init_ports(void)
+ 		port->membase  = old_serial_port[i].iomem_base;
+ 		port->iotype   = old_serial_port[i].io_type;
+ 		port->regshift = old_serial_port[i].iomem_reg_shift;
+-		serial8250_set_defaults(up);
+ 
+ 		port->irqflags |= irqflag;
+ 		if (serial8250_isa_config != NULL)
+diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
+index e1268646ee56..9e2dbe43667a 100644
+--- a/drivers/tty/serial/8250/8250_exar.c
++++ b/drivers/tty/serial/8250/8250_exar.c
+@@ -307,7 +307,17 @@ static void setup_gpio(struct pci_dev *pcidev, u8 __iomem *p)
+ 	 * devices will export them as GPIOs, so we pre-configure them safely
+ 	 * as inputs.
+ 	 */
+-	u8 dir = pcidev->vendor == PCI_VENDOR_ID_EXAR ? 0xff : 0x00;
++
++	u8 dir = 0x00;
++
++	if  ((pcidev->vendor == PCI_VENDOR_ID_EXAR) &&
++		(pcidev->subsystem_vendor != PCI_VENDOR_ID_SEALEVEL)) {
++		// Configure GPIO as inputs for Commtech adapters
++		dir = 0xff;
++	} else {
++		// Configure GPIO as outputs for SeaLevel adapters
++		dir = 0x00;
++	}
+ 
+ 	writeb(0x00, p + UART_EXAR_MPIOINT_7_0);
+ 	writeb(0x00, p + UART_EXAR_MPIOLVL_7_0);
+diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
+index 4d067f515f74..2b59a4305077 100644
+--- a/drivers/tty/serial/8250/8250_mtk.c
++++ b/drivers/tty/serial/8250/8250_mtk.c
+@@ -305,8 +305,21 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios,
+ 	}
+ #endif
+ 
++	/*
++	 * Store the requested baud rate before calling the generic 8250
++	 * set_termios method. Standard 8250 port expects bauds to be
++	 * no higher than (uartclk / 16) so the baud will be clamped if it
++	 * gets out of that bound. Mediatek 8250 port supports speed
++	 * higher than that, therefore we'll get original baud rate back
++	 * after calling the generic set_termios method and recalculate
++	 * the speed later in this method.
++	 */
++	baud = tty_termios_baud_rate(termios);
++
+ 	serial8250_do_set_termios(port, termios, old);
+ 
++	tty_termios_encode_baud_rate(termios, baud, baud);
++
+ 	/*
+ 	 * Mediatek UARTs use an extra highspeed register (MTK_UART_HIGHS)
+ 	 *
+@@ -338,6 +351,11 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios,
+ 	 */
+ 	spin_lock_irqsave(&port->lock, flags);
+ 
++	/*
++	 * Update the per-port timeout.
++	 */
++	uart_update_timeout(port, termios->c_cflag, baud);
++
+ 	/* set DLAB we have cval saved in up->lcr from the call to the core */
+ 	serial_port_out(port, UART_LCR, up->lcr | UART_LCR_DLAB);
+ 	serial_dl_write(up, quot);
+diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
+index 2f599515c133..51c3f579ccd0 100644
+--- a/drivers/tty/serial/serial-tegra.c
++++ b/drivers/tty/serial/serial-tegra.c
+@@ -651,11 +651,14 @@ static void tegra_uart_handle_rx_pio(struct tegra_uart_port *tup,
+ 		ch = (unsigned char) tegra_uart_read(tup, UART_RX);
+ 		tup->uport.icount.rx++;
+ 
+-		if (!uart_handle_sysrq_char(&tup->uport, ch) && tty)
+-			tty_insert_flip_char(tty, ch, flag);
++		if (uart_handle_sysrq_char(&tup->uport, ch))
++			continue;
+ 
+ 		if (tup->uport.ignore_status_mask & UART_LSR_DR)
+ 			continue;
++
++		if (tty)
++			tty_insert_flip_char(tty, ch, flag);
+ 	} while (1);
+ }
+ 
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index fe098cf14e6a..8948970f795e 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1559,8 +1559,10 @@ static int cdns_uart_probe(struct platform_device *pdev)
+ 	 * If register_console() don't assign value, then console_port pointer
+ 	 * is cleanup.
+ 	 */
+-	if (!console_port)
++	if (!console_port) {
++		cdns_uart_console.index = id;
+ 		console_port = port;
++	}
+ #endif
+ 
+ 	rc = uart_add_one_port(&cdns_uart_uart_driver, port);
+@@ -1573,8 +1575,10 @@ static int cdns_uart_probe(struct platform_device *pdev)
+ #ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE
+ 	/* This is not port which is used for console that's why clean it up */
+ 	if (console_port == port &&
+-	    !(cdns_uart_uart_driver.cons->flags & CON_ENABLED))
++	    !(cdns_uart_uart_driver.cons->flags & CON_ENABLED)) {
+ 		console_port = NULL;
++		cdns_uart_console.index = -1;
++	}
+ #endif
+ 
+ 	cdns_uart_data->cts_override = of_property_read_bool(pdev->dev.of_node,
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index fd0361d72738..8051c7032627 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1092,10 +1092,19 @@ static const struct tty_port_operations vc_port_ops = {
+ 	.destruct = vc_port_destruct,
+ };
+ 
++/*
++ * Change # of rows and columns (0 means unchanged/the size of fg_console)
++ * [this is to be used together with some user program
++ * like resize that changes the hardware videomode]
++ */
++#define VC_MAXCOL (32767)
++#define VC_MAXROW (32767)
++
+ int vc_allocate(unsigned int currcons)	/* return 0 on success */
+ {
+ 	struct vt_notifier_param param;
+ 	struct vc_data *vc;
++	int err;
+ 
+ 	WARN_CONSOLE_UNLOCKED();
+ 
+@@ -1125,6 +1134,11 @@ int vc_allocate(unsigned int currcons)	/* return 0 on success */
+ 	if (!*vc->vc_uni_pagedir_loc)
+ 		con_set_default_unimap(vc);
+ 
++	err = -EINVAL;
++	if (vc->vc_cols > VC_MAXCOL || vc->vc_rows > VC_MAXROW ||
++	    vc->vc_screenbuf_size > KMALLOC_MAX_SIZE || !vc->vc_screenbuf_size)
++		goto err_free;
++	err = -ENOMEM;
+ 	vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_KERNEL);
+ 	if (!vc->vc_screenbuf)
+ 		goto err_free;
+@@ -1143,7 +1157,7 @@ err_free:
+ 	visual_deinit(vc);
+ 	kfree(vc);
+ 	vc_cons[currcons].d = NULL;
+-	return -ENOMEM;
++	return err;
+ }
+ 
+ static inline int resize_screen(struct vc_data *vc, int width, int height,
+@@ -1158,14 +1172,6 @@ static inline int resize_screen(struct vc_data *vc, int width, int height,
+ 	return err;
+ }
+ 
+-/*
+- * Change # of rows and columns (0 means unchanged/the size of fg_console)
+- * [this is to be used together with some user program
+- * like resize that changes the hardware videomode]
+- */
+-#define VC_RESIZE_MAXCOL (32767)
+-#define VC_RESIZE_MAXROW (32767)
+-
+ /**
+  *	vc_do_resize	-	resizing method for the tty
+  *	@tty: tty being resized
+@@ -1201,7 +1207,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
+ 	user = vc->vc_resize_user;
+ 	vc->vc_resize_user = 0;
+ 
+-	if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW)
++	if (cols > VC_MAXCOL || lines > VC_MAXROW)
+ 		return -EINVAL;
+ 
+ 	new_cols = (cols ? cols : vc->vc_cols);
+@@ -1212,7 +1218,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
+ 	if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
+ 		return 0;
+ 
+-	if (new_screen_size > KMALLOC_MAX_SIZE)
++	if (new_screen_size > KMALLOC_MAX_SIZE || !new_screen_size)
+ 		return -EINVAL;
+ 	newscreen = kzalloc(new_screen_size, GFP_USER);
+ 	if (!newscreen)
+@@ -3396,6 +3402,7 @@ static int __init con_init(void)
+ 		INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
+ 		tty_port_init(&vc->port);
+ 		visual_init(vc, currcons, 1);
++		/* Assuming vc->vc_{cols,rows,screenbuf_size} are sane here. */
+ 		vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT);
+ 		vc_init(vc, vc->vc_rows, vc->vc_cols,
+ 			currcons || !vc->vc_sw->con_save_screen);
+diff --git a/drivers/usb/cdns3/ep0.c b/drivers/usb/cdns3/ep0.c
+index da4c5eb03d7e..666cebd9c5f2 100644
+--- a/drivers/usb/cdns3/ep0.c
++++ b/drivers/usb/cdns3/ep0.c
+@@ -37,18 +37,18 @@ static void cdns3_ep0_run_transfer(struct cdns3_device *priv_dev,
+ 	struct cdns3_usb_regs __iomem *regs = priv_dev->regs;
+ 	struct cdns3_endpoint *priv_ep = priv_dev->eps[0];
+ 
+-	priv_ep->trb_pool[0].buffer = TRB_BUFFER(dma_addr);
+-	priv_ep->trb_pool[0].length = TRB_LEN(length);
++	priv_ep->trb_pool[0].buffer = cpu_to_le32(TRB_BUFFER(dma_addr));
++	priv_ep->trb_pool[0].length = cpu_to_le32(TRB_LEN(length));
+ 
+ 	if (zlp) {
+-		priv_ep->trb_pool[0].control = TRB_CYCLE | TRB_TYPE(TRB_NORMAL);
+-		priv_ep->trb_pool[1].buffer = TRB_BUFFER(dma_addr);
+-		priv_ep->trb_pool[1].length = TRB_LEN(0);
+-		priv_ep->trb_pool[1].control = TRB_CYCLE | TRB_IOC |
+-		    TRB_TYPE(TRB_NORMAL);
++		priv_ep->trb_pool[0].control = cpu_to_le32(TRB_CYCLE | TRB_TYPE(TRB_NORMAL));
++		priv_ep->trb_pool[1].buffer = cpu_to_le32(TRB_BUFFER(dma_addr));
++		priv_ep->trb_pool[1].length = cpu_to_le32(TRB_LEN(0));
++		priv_ep->trb_pool[1].control = cpu_to_le32(TRB_CYCLE | TRB_IOC |
++		    TRB_TYPE(TRB_NORMAL));
+ 	} else {
+-		priv_ep->trb_pool[0].control = TRB_CYCLE | TRB_IOC |
+-		    TRB_TYPE(TRB_NORMAL);
++		priv_ep->trb_pool[0].control = cpu_to_le32(TRB_CYCLE | TRB_IOC |
++		    TRB_TYPE(TRB_NORMAL));
+ 		priv_ep->trb_pool[1].control = 0;
+ 	}
+ 
+@@ -264,11 +264,11 @@ static int cdns3_req_ep0_get_status(struct cdns3_device *priv_dev,
+ 	case USB_RECIP_INTERFACE:
+ 		return cdns3_ep0_delegate_req(priv_dev, ctrl);
+ 	case USB_RECIP_ENDPOINT:
+-		index = cdns3_ep_addr_to_index(ctrl->wIndex);
++		index = cdns3_ep_addr_to_index(le16_to_cpu(ctrl->wIndex));
+ 		priv_ep = priv_dev->eps[index];
+ 
+ 		/* check if endpoint is stalled or stall is pending */
+-		cdns3_select_ep(priv_dev, ctrl->wIndex);
++		cdns3_select_ep(priv_dev, le16_to_cpu(ctrl->wIndex));
+ 		if (EP_STS_STALL(readl(&priv_dev->regs->ep_sts)) ||
+ 		    (priv_ep->flags & EP_STALL_PENDING))
+ 			usb_status =  BIT(USB_ENDPOINT_HALT);
+@@ -388,10 +388,10 @@ static int cdns3_ep0_feature_handle_endpoint(struct cdns3_device *priv_dev,
+ 	if (!(ctrl->wIndex & ~USB_DIR_IN))
+ 		return 0;
+ 
+-	index = cdns3_ep_addr_to_index(ctrl->wIndex);
++	index = cdns3_ep_addr_to_index(le16_to_cpu(ctrl->wIndex));
+ 	priv_ep = priv_dev->eps[index];
+ 
+-	cdns3_select_ep(priv_dev, ctrl->wIndex);
++	cdns3_select_ep(priv_dev, le16_to_cpu(ctrl->wIndex));
+ 
+ 	if (set)
+ 		__cdns3_gadget_ep_set_halt(priv_ep);
+@@ -452,7 +452,7 @@ static int cdns3_req_ep0_set_sel(struct cdns3_device *priv_dev,
+ 	if (priv_dev->gadget.state < USB_STATE_ADDRESS)
+ 		return -EINVAL;
+ 
+-	if (ctrl_req->wLength != 6) {
++	if (le16_to_cpu(ctrl_req->wLength) != 6) {
+ 		dev_err(priv_dev->dev, "Set SEL should be 6 bytes, got %d\n",
+ 			ctrl_req->wLength);
+ 		return -EINVAL;
+@@ -476,7 +476,7 @@ static int cdns3_req_ep0_set_isoch_delay(struct cdns3_device *priv_dev,
+ 	if (ctrl_req->wIndex || ctrl_req->wLength)
+ 		return -EINVAL;
+ 
+-	priv_dev->isoch_delay = ctrl_req->wValue;
++	priv_dev->isoch_delay = le16_to_cpu(ctrl_req->wValue);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/usb/cdns3/trace.h b/drivers/usb/cdns3/trace.h
+index 7cc8bebaa07d..f8482456116e 100644
+--- a/drivers/usb/cdns3/trace.h
++++ b/drivers/usb/cdns3/trace.h
+@@ -333,9 +333,9 @@ DECLARE_EVENT_CLASS(cdns3_log_trb,
+ 	TP_fast_assign(
+ 		__assign_str(name, priv_ep->name);
+ 		__entry->trb = trb;
+-		__entry->buffer = trb->buffer;
+-		__entry->length = trb->length;
+-		__entry->control = trb->control;
++		__entry->buffer = le32_to_cpu(trb->buffer);
++		__entry->length = le32_to_cpu(trb->length);
++		__entry->control = le32_to_cpu(trb->control);
+ 		__entry->type = usb_endpoint_type(priv_ep->endpoint.desc);
+ 	),
+ 	TP_printk("%s: trb %p, dma buf: 0x%08x, size: %ld, burst: %d ctrl: 0x%08x (%s%s%s%s%s%s%s)",
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 96c05b121fac..139474c3e77b 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -38,6 +38,8 @@
+ #define PCI_DEVICE_ID_INTEL_ICLLP		0x34ee
+ #define PCI_DEVICE_ID_INTEL_EHLLP		0x4b7e
+ #define PCI_DEVICE_ID_INTEL_TGPLP		0xa0ee
++#define PCI_DEVICE_ID_INTEL_TGPH		0x43ee
++#define PCI_DEVICE_ID_INTEL_JSP			0x4dee
+ 
+ #define PCI_INTEL_BXT_DSM_GUID		"732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
+ #define PCI_INTEL_BXT_FUNC_PMU_PWR	4
+@@ -358,6 +360,12 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPLP),
+ 	  (kernel_ulong_t) &dwc3_pci_intel_properties, },
+ 
++	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPH),
++	  (kernel_ulong_t) &dwc3_pci_intel_properties, },
++
++	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_JSP),
++	  (kernel_ulong_t) &dwc3_pci_intel_properties, },
++
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB),
+ 	  (kernel_ulong_t) &dwc3_pci_amd_properties, },
+ 	{  }	/* Terminating Entry */
+diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c
+index 116d386472ef..da73a06c20a3 100644
+--- a/drivers/usb/gadget/udc/gr_udc.c
++++ b/drivers/usb/gadget/udc/gr_udc.c
+@@ -1980,9 +1980,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit)
+ 
+ 	if (num == 0) {
+ 		_req = gr_alloc_request(&ep->ep, GFP_ATOMIC);
++		if (!_req)
++			return -ENOMEM;
++
+ 		buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC);
+-		if (!_req || !buf) {
+-			/* possible _req freed by gr_probe via gr_remove */
++		if (!buf) {
++			gr_free_request(&ep->ep, _req);
+ 			return -ENOMEM;
+ 		}
+ 
+diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c
+index fea555570ad4..45c54d56ecbd 100644
+--- a/drivers/usb/host/xhci-mtk-sch.c
++++ b/drivers/usb/host/xhci-mtk-sch.c
+@@ -557,6 +557,10 @@ static bool need_bw_sch(struct usb_host_endpoint *ep,
+ 	if (is_fs_or_ls(speed) && !has_tt)
+ 		return false;
+ 
++	/* skip endpoint with zero maxpkt */
++	if (usb_endpoint_maxp(&ep->desc) == 0)
++		return false;
++
+ 	return true;
+ }
+ 
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 1fddc41fa1f3..07741ab9a46a 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -250,6 +250,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+ 			pdev->device == 0x1142)
+ 		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
++	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
++			pdev->device == 0x2142)
++		xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+ 		pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI)
+diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
+index ca935c09a261..35ebeeccde4d 100644
+--- a/drivers/video/fbdev/core/bitblit.c
++++ b/drivers/video/fbdev/core/bitblit.c
+@@ -216,7 +216,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,
+ 	region.color = color;
+ 	region.rop = ROP_COPY;
+ 
+-	if (rw && !bottom_only) {
++	if ((int) rw > 0 && !bottom_only) {
+ 		region.dx = info->var.xoffset + rs;
+ 		region.dy = 0;
+ 		region.width = rw;
+@@ -224,7 +224,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,
+ 		info->fbops->fb_fillrect(info, &region);
+ 	}
+ 
+-	if (bh) {
++	if ((int) bh > 0) {
+ 		region.dx = info->var.xoffset;
+ 		region.dy = info->var.yoffset + bs;
+ 		region.width = rs;
+diff --git a/drivers/video/fbdev/core/fbcon_ccw.c b/drivers/video/fbdev/core/fbcon_ccw.c
+index dfa9a8aa4509..78f3a5621478 100644
+--- a/drivers/video/fbdev/core/fbcon_ccw.c
++++ b/drivers/video/fbdev/core/fbcon_ccw.c
+@@ -201,7 +201,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info,
+ 	region.color = color;
+ 	region.rop = ROP_COPY;
+ 
+-	if (rw && !bottom_only) {
++	if ((int) rw > 0 && !bottom_only) {
+ 		region.dx = 0;
+ 		region.dy = info->var.yoffset;
+ 		region.height = rw;
+@@ -209,7 +209,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info,
+ 		info->fbops->fb_fillrect(info, &region);
+ 	}
+ 
+-	if (bh) {
++	if ((int) bh > 0) {
+ 		region.dx = info->var.xoffset + bs;
+ 		region.dy = 0;
+                 region.height = info->var.yres_virtual;
+diff --git a/drivers/video/fbdev/core/fbcon_cw.c b/drivers/video/fbdev/core/fbcon_cw.c
+index ce08251bfd38..fd098ff17574 100644
+--- a/drivers/video/fbdev/core/fbcon_cw.c
++++ b/drivers/video/fbdev/core/fbcon_cw.c
+@@ -184,7 +184,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info,
+ 	region.color = color;
+ 	region.rop = ROP_COPY;
+ 
+-	if (rw && !bottom_only) {
++	if ((int) rw > 0 && !bottom_only) {
+ 		region.dx = 0;
+ 		region.dy = info->var.yoffset + rs;
+ 		region.height = rw;
+@@ -192,7 +192,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info,
+ 		info->fbops->fb_fillrect(info, &region);
+ 	}
+ 
+-	if (bh) {
++	if ((int) bh > 0) {
+ 		region.dx = info->var.xoffset;
+ 		region.dy = info->var.yoffset;
+                 region.height = info->var.yres;
+diff --git a/drivers/video/fbdev/core/fbcon_ud.c b/drivers/video/fbdev/core/fbcon_ud.c
+index 1936afc78fec..e165a3fad29a 100644
+--- a/drivers/video/fbdev/core/fbcon_ud.c
++++ b/drivers/video/fbdev/core/fbcon_ud.c
+@@ -231,7 +231,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info,
+ 	region.color = color;
+ 	region.rop = ROP_COPY;
+ 
+-	if (rw && !bottom_only) {
++	if ((int) rw > 0 && !bottom_only) {
+ 		region.dy = 0;
+ 		region.dx = info->var.xoffset;
+ 		region.width  = rw;
+@@ -239,7 +239,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info,
+ 		info->fbops->fb_fillrect(info, &region);
+ 	}
+ 
+-	if (bh) {
++	if ((int) bh > 0) {
+ 		region.dy = info->var.yoffset;
+ 		region.dx = info->var.xoffset;
+                 region.height  = bh;
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index e5d85311d5d5..86e280edf804 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -1422,6 +1422,7 @@ static int btrfs_find_all_roots_safe(struct btrfs_trans_handle *trans,
+ 		if (ret < 0 && ret != -ENOENT) {
+ 			ulist_free(tmp);
+ 			ulist_free(*roots);
++			*roots = NULL;
+ 			return ret;
+ 		}
+ 		node = ulist_next(tmp, &uiter);
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 9b214b14a3aa..1a089a642422 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -1923,7 +1923,8 @@ static int __process_pages_contig(struct address_space *mapping,
+ 				if (!PageDirty(pages[i]) ||
+ 				    pages[i]->mapping != mapping) {
+ 					unlock_page(pages[i]);
+-					put_page(pages[i]);
++					for (; i < ret; i++)
++						put_page(pages[i]);
+ 					err = -EAGAIN;
+ 					goto out;
+ 				}
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index e890f09e2073..1b087ee338cc 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -2525,12 +2525,10 @@ again:
+ 		reloc_root = list_entry(reloc_roots.next,
+ 					struct btrfs_root, root_list);
+ 
++		root = read_fs_root(fs_info, reloc_root->root_key.offset);
+ 		if (btrfs_root_refs(&reloc_root->root_item) > 0) {
+-			root = read_fs_root(fs_info,
+-					    reloc_root->root_key.offset);
+ 			BUG_ON(IS_ERR(root));
+ 			BUG_ON(root->reloc_root != reloc_root);
+-
+ 			ret = merge_reloc_root(rc, root);
+ 			if (ret) {
+ 				if (list_empty(&reloc_root->root_list))
+@@ -2539,6 +2537,13 @@ again:
+ 				goto out;
+ 			}
+ 		} else {
++			if (!IS_ERR(root)) {
++				if (root->reloc_root == reloc_root)
++					root->reloc_root = NULL;
++				clear_bit(BTRFS_ROOT_DEAD_RELOC_TREE,
++					  &root->state);
++			}
++
+ 			list_del_init(&reloc_root->root_list);
+ 			/* Don't forget to queue this reloc root for cleanup */
+ 			list_add_tail(&reloc_root->reloc_dirty_list,
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index c8b0e5005f02..1e6e3c1d97df 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -7269,6 +7269,14 @@ int btrfs_read_chunk_tree(struct btrfs_fs_info *fs_info)
+ 	mutex_lock(&uuid_mutex);
+ 	mutex_lock(&fs_info->chunk_mutex);
+ 
++	/*
++	 * It is possible for mount and umount to race in such a way that
++	 * we execute this code path, but open_fs_devices failed to clear
++	 * total_rw_bytes. We certainly want it cleared before reading the
++	 * device items, so clear it here.
++	 */
++	fs_info->fs_devices->total_rw_bytes = 0;
++
+ 	/*
+ 	 * Read all device items, and then all the chunk items. All
+ 	 * device items are found before any chunk item (their object id
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 5ae458505f63..eb2e3db3916f 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -1791,7 +1791,6 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
+ 	FILE_UNIX_BASIC_INFO *info_buf_target;
+ 	unsigned int xid;
+ 	int rc, tmprc;
+-	bool new_target = d_really_is_negative(target_dentry);
+ 
+ 	if (flags & ~RENAME_NOREPLACE)
+ 		return -EINVAL;
+@@ -1868,13 +1867,8 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
+ 	 */
+ 
+ unlink_target:
+-	/*
+-	 * If the target dentry was created during the rename, try
+-	 * unlinking it if it's not negative
+-	 */
+-	if (new_target &&
+-	    d_really_is_positive(target_dentry) &&
+-	    (rc == -EACCES || rc == -EEXIST)) {
++	/* Try unlinking the target dentry if it's not negative */
++	if (d_really_is_positive(target_dentry) && (rc == -EACCES || rc == -EEXIST)) {
+ 		if (d_is_dir(target_dentry))
+ 			tmprc = cifs_rmdir(target_dir, target_dentry);
+ 		else
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index 4f2e4f38feb8..06dd38e76c62 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -771,7 +771,8 @@ static int fuse_check_page(struct page *page)
+ 	       1 << PG_uptodate |
+ 	       1 << PG_lru |
+ 	       1 << PG_active |
+-	       1 << PG_reclaim))) {
++	       1 << PG_reclaim |
++	       1 << PG_waiters))) {
+ 		pr_warn("trying to steal weird page\n");
+ 		pr_warn("  page=%p index=%li flags=%08lx, count=%i, mapcount=%i, mapping=%p\n", page, page->index, page->flags, page_count(page), page_mapcount(page), page->mapping);
+ 		return 1;
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index 70cf8c5760c7..6b0bf4ebd812 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -367,6 +367,8 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq)
+ {
+ 	struct inode *inode = dreq->inode;
+ 
++	inode_dio_end(inode);
++
+ 	if (dreq->iocb) {
+ 		long res = (long) dreq->error;
+ 		if (dreq->count != 0) {
+@@ -378,10 +380,7 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq)
+ 
+ 	complete(&dreq->completion);
+ 
+-	igrab(inode);
+ 	nfs_direct_req_release(dreq);
+-	inode_dio_end(inode);
+-	iput(inode);
+ }
+ 
+ static void nfs_direct_read_completion(struct nfs_pgio_header *hdr)
+@@ -511,10 +510,8 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq,
+ 	 * generic layer handle the completion.
+ 	 */
+ 	if (requested_bytes == 0) {
+-		igrab(inode);
+-		nfs_direct_req_release(dreq);
+ 		inode_dio_end(inode);
+-		iput(inode);
++		nfs_direct_req_release(dreq);
+ 		return result < 0 ? result : -EIO;
+ 	}
+ 
+@@ -926,10 +923,8 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
+ 	 * generic layer handle the completion.
+ 	 */
+ 	if (requested_bytes == 0) {
+-		igrab(inode);
+-		nfs_direct_req_release(dreq);
+ 		inode_dio_end(inode);
+-		iput(inode);
++		nfs_direct_req_release(dreq);
+ 		return result < 0 ? result : -EIO;
+ 	}
+ 
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index 7b3136753205..95dc90570786 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -83,7 +83,6 @@ nfs_file_release(struct inode *inode, struct file *filp)
+ 	dprintk("NFS: release(%pD2)\n", filp);
+ 
+ 	nfs_inc_stats(inode, NFSIOS_VFSRELEASE);
+-	inode_dio_wait(inode);
+ 	nfs_file_clear_open_context(filp);
+ 	return 0;
+ }
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 9af9b673f292..68cf11660764 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -506,6 +506,17 @@ find_any_file(struct nfs4_file *f)
+ 	return ret;
+ }
+ 
++static struct nfsd_file *find_deleg_file(struct nfs4_file *f)
++{
++	struct nfsd_file *ret = NULL;
++
++	spin_lock(&f->fi_lock);
++	if (f->fi_deleg_file)
++		ret = nfsd_file_get(f->fi_deleg_file);
++	spin_unlock(&f->fi_lock);
++	return ret;
++}
++
+ static atomic_long_t num_delegations;
+ unsigned long max_delegations;
+ 
+@@ -2378,6 +2389,8 @@ static int nfs4_show_open(struct seq_file *s, struct nfs4_stid *st)
+ 	oo = ols->st_stateowner;
+ 	nf = st->sc_file;
+ 	file = find_any_file(nf);
++	if (!file)
++		return 0;
+ 
+ 	seq_printf(s, "- 0x%16phN: { type: open, ", &st->sc_stateid);
+ 
+@@ -2411,6 +2424,8 @@ static int nfs4_show_lock(struct seq_file *s, struct nfs4_stid *st)
+ 	oo = ols->st_stateowner;
+ 	nf = st->sc_file;
+ 	file = find_any_file(nf);
++	if (!file)
++		return 0;
+ 
+ 	seq_printf(s, "- 0x%16phN: { type: lock, ", &st->sc_stateid);
+ 
+@@ -2439,7 +2454,9 @@ static int nfs4_show_deleg(struct seq_file *s, struct nfs4_stid *st)
+ 
+ 	ds = delegstateid(st);
+ 	nf = st->sc_file;
+-	file = nf->fi_deleg_file;
++	file = find_deleg_file(nf);
++	if (!file)
++		return 0;
+ 
+ 	seq_printf(s, "- 0x%16phN: { type: deleg, ", &st->sc_stateid);
+ 
+@@ -2451,6 +2468,7 @@ static int nfs4_show_deleg(struct seq_file *s, struct nfs4_stid *st)
+ 
+ 	nfs4_show_superblock(s, file);
+ 	seq_printf(s, " }\n");
++	nfsd_file_put(file);
+ 
+ 	return 0;
+ }
+diff --git a/include/asm-generic/mmiowb.h b/include/asm-generic/mmiowb.h
+index 9439ff037b2d..5698fca3bf56 100644
+--- a/include/asm-generic/mmiowb.h
++++ b/include/asm-generic/mmiowb.h
+@@ -27,7 +27,7 @@
+ #include <asm/smp.h>
+ 
+ DECLARE_PER_CPU(struct mmiowb_state, __mmiowb_state);
+-#define __mmiowb_state()	this_cpu_ptr(&__mmiowb_state)
++#define __mmiowb_state()	raw_cpu_ptr(&__mmiowb_state)
+ #else
+ #define __mmiowb_state()	arch_mmiowb_state()
+ #endif	/* arch_mmiowb_state */
+@@ -35,7 +35,9 @@ DECLARE_PER_CPU(struct mmiowb_state, __mmiowb_state);
+ static inline void mmiowb_set_pending(void)
+ {
+ 	struct mmiowb_state *ms = __mmiowb_state();
+-	ms->mmiowb_pending = ms->nesting_count;
++
++	if (likely(ms->nesting_count))
++		ms->mmiowb_pending = ms->nesting_count;
+ }
+ 
+ static inline void mmiowb_spin_lock(void)
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index b6d7347ccda7..d7616d08e863 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -306,7 +306,8 @@
+ 
+ #define PAGE_ALIGNED_DATA(page_align)					\
+ 	. = ALIGN(page_align);						\
+-	*(.data..page_aligned)
++	*(.data..page_aligned)						\
++	. = ALIGN(page_align);
+ 
+ #define READ_MOSTLY_DATA(align)						\
+ 	. = ALIGN(align);						\
+@@ -695,7 +696,9 @@
+ 	. = ALIGN(bss_align);						\
+ 	.bss : AT(ADDR(.bss) - LOAD_OFFSET) {				\
+ 		BSS_FIRST_SECTIONS					\
++		. = ALIGN(PAGE_SIZE);					\
+ 		*(.bss..page_aligned)					\
++		. = ALIGN(PAGE_SIZE);					\
+ 		*(.dynbss)						\
+ 		*(BSS_MAIN)						\
+ 		*(COMMON)						\
+diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
+index 399ad8632356..e4e1f5c1f492 100644
+--- a/include/linux/device-mapper.h
++++ b/include/linux/device-mapper.h
+@@ -420,6 +420,7 @@ const char *dm_device_name(struct mapped_device *md);
+ int dm_copy_name_and_uuid(struct mapped_device *md, char *name, char *uuid);
+ struct gendisk *dm_disk(struct mapped_device *md);
+ int dm_suspended(struct dm_target *ti);
++int dm_post_suspending(struct dm_target *ti);
+ int dm_noflush_suspending(struct dm_target *ti);
+ void dm_accept_partial_bio(struct bio *bio, unsigned n_sectors);
+ void dm_remap_zone_report(struct dm_target *ti, sector_t start,
+diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h
+index ec212cb27fdc..12eac4293af6 100644
+--- a/include/linux/dma-buf.h
++++ b/include/linux/dma-buf.h
+@@ -303,6 +303,7 @@ struct dma_buf {
+ 	void *vmap_ptr;
+ 	const char *exp_name;
+ 	const char *name;
++	spinlock_t name_lock; /* spinlock to protect name access */
+ 	struct module *owner;
+ 	struct list_head list_node;
+ 	void *priv;
+diff --git a/include/linux/io-mapping.h b/include/linux/io-mapping.h
+index 6e125e9b4187..b9c91d321240 100644
+--- a/include/linux/io-mapping.h
++++ b/include/linux/io-mapping.h
+@@ -108,9 +108,12 @@ io_mapping_init_wc(struct io_mapping *iomap,
+ 		   resource_size_t base,
+ 		   unsigned long size)
+ {
++	iomap->iomem = ioremap_wc(base, size);
++	if (!iomap->iomem)
++		return NULL;
++
+ 	iomap->base = base;
+ 	iomap->size = size;
+-	iomap->iomem = ioremap_wc(base, size);
+ #if defined(pgprot_noncached_wc) /* archs can't agree on a name ... */
+ 	iomap->prot = pgprot_noncached_wc(PAGE_KERNEL);
+ #elif defined(pgprot_writecombine)
+diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
+index 953d7ca01eb6..4c56404e53a7 100644
+--- a/include/linux/mod_devicetable.h
++++ b/include/linux/mod_devicetable.h
+@@ -318,7 +318,7 @@ struct pcmcia_device_id {
+ #define INPUT_DEVICE_ID_LED_MAX		0x0f
+ #define INPUT_DEVICE_ID_SND_MAX		0x07
+ #define INPUT_DEVICE_ID_FF_MAX		0x7f
+-#define INPUT_DEVICE_ID_SW_MAX		0x0f
++#define INPUT_DEVICE_ID_SW_MAX		0x10
+ #define INPUT_DEVICE_ID_PROP_MAX	0x1f
+ 
+ #define INPUT_DEVICE_ID_MATCH_BUS	1
+diff --git a/include/sound/rt5670.h b/include/sound/rt5670.h
+index f9024c7a1600..02e1d7778354 100644
+--- a/include/sound/rt5670.h
++++ b/include/sound/rt5670.h
+@@ -12,6 +12,7 @@ struct rt5670_platform_data {
+ 	int jd_mode;
+ 	bool in2_diff;
+ 	bool dev_gpio;
++	bool gpio1_is_ext_spk_en;
+ 
+ 	bool dmic_en;
+ 	unsigned int dmic1_data_pin;
+diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
+index 85387c76c24f..472cd5bc5567 100644
+--- a/include/uapi/linux/input-event-codes.h
++++ b/include/uapi/linux/input-event-codes.h
+@@ -808,7 +808,8 @@
+ #define SW_LINEIN_INSERT	0x0d  /* set = inserted */
+ #define SW_MUTE_DEVICE		0x0e  /* set = device disabled */
+ #define SW_PEN_INSERTED		0x0f  /* set = pen inserted */
+-#define SW_MAX			0x0f
++#define SW_MACHINE_COVER	0x10  /* set = cover closed */
++#define SW_MAX			0x10
+ #define SW_CNT			(SW_MAX+1)
+ 
+ /*
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 291680ba8504..aa83538efc23 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2205,7 +2205,7 @@ static void handle_swbp(struct pt_regs *regs)
+ 	if (!uprobe) {
+ 		if (is_swbp > 0) {
+ 			/* No matching uprobe; signal SIGTRAP. */
+-			send_sig(SIGTRAP, current, 0);
++			force_sig(SIGTRAP);
+ 		} else {
+ 			/*
+ 			 * Either we raced with uprobe_unregister() or we can't
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index f765475be359..5977f7824a9a 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -876,6 +876,9 @@ static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address,
+ 		return SCAN_ADDRESS_RANGE;
+ 	if (!hugepage_vma_check(vma, vma->vm_flags))
+ 		return SCAN_VMA_CHECK;
++	/* Anon VMA expected */
++	if (!vma->anon_vma || vma->vm_ops)
++		return SCAN_VMA_CHECK;
+ 	return 0;
+ }
+ 
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index a3f4c35bb5fa..402c8bc65e08 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -5770,7 +5770,6 @@ static void __mem_cgroup_clear_mc(void)
+ 		if (!mem_cgroup_is_root(mc.to))
+ 			page_counter_uncharge(&mc.to->memory, mc.moved_swap);
+ 
+-		mem_cgroup_id_get_many(mc.to, mc.moved_swap);
+ 		css_put_many(&mc.to->css, mc.moved_swap);
+ 
+ 		mc.moved_swap = 0;
+@@ -5961,7 +5960,8 @@ put:			/* get_mctgt_type() gets the page */
+ 			ent = target.ent;
+ 			if (!mem_cgroup_move_swap_account(ent, mc.from, mc.to)) {
+ 				mc.precharge--;
+-				/* we fixup refcnts and charges later. */
++				mem_cgroup_id_get_many(mc.to, 1);
++				/* we fixup other refcnts and charges later. */
+ 				mc.moved_swap++;
+ 			}
+ 			break;
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 514cc19c5916..ea1ba2db4f4f 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -2622,7 +2622,7 @@ static void unmap_region(struct mm_struct *mm,
+  * Create a list of vma's touched by the unmap, removing them from the mm's
+  * vma list as we go..
+  */
+-static void
++static bool
+ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+ 	struct vm_area_struct *prev, unsigned long end)
+ {
+@@ -2647,6 +2647,17 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+ 
+ 	/* Kill the cache */
+ 	vmacache_invalidate(mm);
++
++	/*
++	 * Do not downgrade mmap_lock if we are next to VM_GROWSDOWN or
++	 * VM_GROWSUP VMA. Such VMAs can change their size under
++	 * down_read(mmap_lock) and collide with the VMA we are about to unmap.
++	 */
++	if (vma && (vma->vm_flags & VM_GROWSDOWN))
++		return false;
++	if (prev && (prev->vm_flags & VM_GROWSUP))
++		return false;
++	return true;
+ }
+ 
+ /*
+@@ -2827,7 +2838,8 @@ int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len,
+ 	}
+ 
+ 	/* Detach vmas from rbtree */
+-	detach_vmas_to_be_unmapped(mm, vma, prev, end);
++	if (!detach_vmas_to_be_unmapped(mm, vma, prev, end))
++		downgrade = false;
+ 
+ 	if (downgrade)
+ 		downgrade_write(&mm->mmap_sem);
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index 8c1ffbf7de45..e36dd36c7076 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -326,6 +326,14 @@ int slab_unmergeable(struct kmem_cache *s)
+ 	if (s->refcount < 0)
+ 		return 1;
+ 
++#ifdef CONFIG_MEMCG_KMEM
++	/*
++	 * Skip the dying kmem_cache.
++	 */
++	if (s->memcg_params.dying)
++		return 1;
++#endif
++
+ 	return 0;
+ }
+ 
+@@ -886,12 +894,15 @@ static int shutdown_memcg_caches(struct kmem_cache *s)
+ 	return 0;
+ }
+ 
+-static void flush_memcg_workqueue(struct kmem_cache *s)
++static void memcg_set_kmem_cache_dying(struct kmem_cache *s)
+ {
+ 	spin_lock_irq(&memcg_kmem_wq_lock);
+ 	s->memcg_params.dying = true;
+ 	spin_unlock_irq(&memcg_kmem_wq_lock);
++}
+ 
++static void flush_memcg_workqueue(struct kmem_cache *s)
++{
+ 	/*
+ 	 * SLAB and SLUB deactivate the kmem_caches through call_rcu. Make
+ 	 * sure all registered rcu callbacks have been invoked.
+@@ -923,10 +934,6 @@ static inline int shutdown_memcg_caches(struct kmem_cache *s)
+ {
+ 	return 0;
+ }
+-
+-static inline void flush_memcg_workqueue(struct kmem_cache *s)
+-{
+-}
+ #endif /* CONFIG_MEMCG_KMEM */
+ 
+ void slab_kmem_cache_release(struct kmem_cache *s)
+@@ -944,8 +951,6 @@ void kmem_cache_destroy(struct kmem_cache *s)
+ 	if (unlikely(!s))
+ 		return;
+ 
+-	flush_memcg_workqueue(s);
+-
+ 	get_online_cpus();
+ 	get_online_mems();
+ 
+@@ -955,6 +960,22 @@ void kmem_cache_destroy(struct kmem_cache *s)
+ 	if (s->refcount)
+ 		goto out_unlock;
+ 
++#ifdef CONFIG_MEMCG_KMEM
++	memcg_set_kmem_cache_dying(s);
++
++	mutex_unlock(&slab_mutex);
++
++	put_online_mems();
++	put_online_cpus();
++
++	flush_memcg_workqueue(s);
++
++	get_online_cpus();
++	get_online_mems();
++
++	mutex_lock(&slab_mutex);
++#endif
++
+ 	err = shutdown_memcg_caches(s);
+ 	if (!err)
+ 		err = shutdown_cache(s);
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 69429c8df7b3..e5fb9002d314 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2305,6 +2305,7 @@ static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
+ 
+ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
+ {
++	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
+ 	struct sk_buff *skb = rx->skb;
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ 
+@@ -2315,6 +2316,31 @@ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
+ 	if (status->flag & RX_FLAG_DECRYPTED)
+ 		return 0;
+ 
++	/* check mesh EAPOL frames first */
++	if (unlikely(rx->sta && ieee80211_vif_is_mesh(&rx->sdata->vif) &&
++		     ieee80211_is_data(fc))) {
++		struct ieee80211s_hdr *mesh_hdr;
++		u16 hdr_len = ieee80211_hdrlen(fc);
++		u16 ethertype_offset;
++		__be16 ethertype;
++
++		if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr))
++			goto drop_check;
++
++		/* make sure fixed part of mesh header is there, also checks skb len */
++		if (!pskb_may_pull(rx->skb, hdr_len + 6))
++			goto drop_check;
++
++		mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len);
++		ethertype_offset = hdr_len + ieee80211_get_mesh_hdrlen(mesh_hdr) +
++				   sizeof(rfc1042_header);
++
++		if (skb_copy_bits(rx->skb, ethertype_offset, &ethertype, 2) == 0 &&
++		    ethertype == rx->sdata->control_port_protocol)
++			return 0;
++	}
++
++drop_check:
+ 	/* Drop unencrypted frames if key is set. */
+ 	if (unlikely(!ieee80211_has_protected(fc) &&
+ 		     !ieee80211_is_any_nullfunc(fc) &&
+diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
+index 8dc892a9dc91..0c1bc654245c 100644
+--- a/net/netfilter/ipvs/ip_vs_sync.c
++++ b/net/netfilter/ipvs/ip_vs_sync.c
+@@ -1717,6 +1717,8 @@ static int sync_thread_backup(void *data)
+ {
+ 	struct ip_vs_sync_thread_data *tinfo = data;
+ 	struct netns_ipvs *ipvs = tinfo->ipvs;
++	struct sock *sk = tinfo->sock->sk;
++	struct udp_sock *up = udp_sk(sk);
+ 	int len;
+ 
+ 	pr_info("sync thread started: state = BACKUP, mcast_ifn = %s, "
+@@ -1724,12 +1726,14 @@ static int sync_thread_backup(void *data)
+ 		ipvs->bcfg.mcast_ifn, ipvs->bcfg.syncid, tinfo->id);
+ 
+ 	while (!kthread_should_stop()) {
+-		wait_event_interruptible(*sk_sleep(tinfo->sock->sk),
+-			 !skb_queue_empty(&tinfo->sock->sk->sk_receive_queue)
+-			 || kthread_should_stop());
++		wait_event_interruptible(*sk_sleep(sk),
++					 !skb_queue_empty_lockless(&sk->sk_receive_queue) ||
++					 !skb_queue_empty_lockless(&up->reader_queue) ||
++					 kthread_should_stop());
+ 
+ 		/* do we have data now? */
+-		while (!skb_queue_empty(&(tinfo->sock->sk->sk_receive_queue))) {
++		while (!skb_queue_empty_lockless(&sk->sk_receive_queue) ||
++		       !skb_queue_empty_lockless(&up->reader_queue)) {
+ 			len = ip_vs_receive(tinfo->sock, tinfo->buf,
+ 					ipvs->bcfg.sync_maxlen);
+ 			if (len <= 0) {
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index 082a30936690..861ec9a671f9 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -22,7 +22,7 @@
+ #include <net/af_vsock.h>
+ 
+ static struct workqueue_struct *virtio_vsock_workqueue;
+-static struct virtio_vsock *the_virtio_vsock;
++static struct virtio_vsock __rcu *the_virtio_vsock;
+ static DEFINE_MUTEX(the_virtio_vsock_mutex); /* protects the_virtio_vsock */
+ 
+ struct virtio_vsock {
+diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
+index 13e5fbafdf2f..fe7076fdac8a 100755
+--- a/scripts/decode_stacktrace.sh
++++ b/scripts/decode_stacktrace.sh
+@@ -84,8 +84,8 @@ parse_symbol() {
+ 		return
+ 	fi
+ 
+-	# Strip out the base of the path
+-	code=${code#$basepath/}
++	# Strip out the base of the path on each line
++	code=$(while read -r line; do echo "${line#$basepath/}"; done <<< "$code")
+ 
+ 	# In the case of inlines, move everything to same line
+ 	code=${code//$'\n'/' '}
+diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
+index be984aa29b75..1be9763cf8bb 100644
+--- a/scripts/gdb/linux/symbols.py
++++ b/scripts/gdb/linux/symbols.py
+@@ -96,7 +96,7 @@ lx-symbols command."""
+             return ""
+         attrs = sect_attrs['attrs']
+         section_name_to_address = {
+-            attrs[n]['name'].string(): attrs[n]['address']
++            attrs[n]['battr']['attr']['name'].string(): attrs[n]['address']
+             for n in range(int(sect_attrs['nsections']))}
+         args = []
+         for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
+diff --git a/sound/core/info.c b/sound/core/info.c
+index e051a029ccfb..f18f4ef6661e 100644
+--- a/sound/core/info.c
++++ b/sound/core/info.c
+@@ -608,7 +608,9 @@ int snd_info_get_line(struct snd_info_buffer *buffer, char *line, int len)
+ {
+ 	int c = -1;
+ 
+-	if (snd_BUG_ON(!buffer || !buffer->buffer))
++	if (snd_BUG_ON(!buffer))
++		return 1;
++	if (!buffer->buffer)
+ 		return 1;
+ 	if (len <= 0 || buffer->stop || buffer->error)
+ 		return 1;
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index e78c4367b6c8..820f534a67b1 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1817,33 +1817,43 @@ static int hdmi_add_cvt(struct hda_codec *codec, hda_nid_t cvt_nid)
+ 
+ static int hdmi_parse_codec(struct hda_codec *codec)
+ {
+-	hda_nid_t nid;
++	hda_nid_t start_nid;
++	unsigned int caps;
+ 	int i, nodes;
+ 
+-	nodes = snd_hda_get_sub_nodes(codec, codec->core.afg, &nid);
+-	if (!nid || nodes < 0) {
++	nodes = snd_hda_get_sub_nodes(codec, codec->core.afg, &start_nid);
++	if (!start_nid || nodes < 0) {
+ 		codec_warn(codec, "HDMI: failed to get afg sub nodes\n");
+ 		return -EINVAL;
+ 	}
+ 
+-	for (i = 0; i < nodes; i++, nid++) {
+-		unsigned int caps;
+-		unsigned int type;
++	/*
++	 * hdmi_add_pin() assumes total amount of converters to
++	 * be known, so first discover all converters
++	 */
++	for (i = 0; i < nodes; i++) {
++		hda_nid_t nid = start_nid + i;
+ 
+ 		caps = get_wcaps(codec, nid);
+-		type = get_wcaps_type(caps);
+ 
+ 		if (!(caps & AC_WCAP_DIGITAL))
+ 			continue;
+ 
+-		switch (type) {
+-		case AC_WID_AUD_OUT:
++		if (get_wcaps_type(caps) == AC_WID_AUD_OUT)
+ 			hdmi_add_cvt(codec, nid);
+-			break;
+-		case AC_WID_PIN:
++	}
++
++	/* discover audio pins */
++	for (i = 0; i < nodes; i++) {
++		hda_nid_t nid = start_nid + i;
++
++		caps = get_wcaps(codec, nid);
++
++		if (!(caps & AC_WCAP_DIGITAL))
++			continue;
++
++		if (get_wcaps_type(caps) == AC_WID_PIN)
+ 			hdmi_add_pin(codec, nid);
+-			break;
+-		}
+ 	}
+ 
+ 	return 0;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 6ffdf3d2d526..bf205621d7ac 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7546,11 +7546,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
+ 	SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
++	SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC225_FIXUP_HEADSET_JACK),
+ 	SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE),
+ 	SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
+ 	SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+ 	SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro (NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+ 	SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
++	SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+ 	SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+diff --git a/sound/soc/codecs/rt5670.c b/sound/soc/codecs/rt5670.c
+index 70fee6849ab0..f21181734170 100644
+--- a/sound/soc/codecs/rt5670.c
++++ b/sound/soc/codecs/rt5670.c
+@@ -31,18 +31,19 @@
+ #include "rt5670.h"
+ #include "rt5670-dsp.h"
+ 
+-#define RT5670_DEV_GPIO     BIT(0)
+-#define RT5670_IN2_DIFF     BIT(1)
+-#define RT5670_DMIC_EN      BIT(2)
+-#define RT5670_DMIC1_IN2P   BIT(3)
+-#define RT5670_DMIC1_GPIO6  BIT(4)
+-#define RT5670_DMIC1_GPIO7  BIT(5)
+-#define RT5670_DMIC2_INR    BIT(6)
+-#define RT5670_DMIC2_GPIO8  BIT(7)
+-#define RT5670_DMIC3_GPIO5  BIT(8)
+-#define RT5670_JD_MODE1     BIT(9)
+-#define RT5670_JD_MODE2     BIT(10)
+-#define RT5670_JD_MODE3     BIT(11)
++#define RT5670_DEV_GPIO			BIT(0)
++#define RT5670_IN2_DIFF			BIT(1)
++#define RT5670_DMIC_EN			BIT(2)
++#define RT5670_DMIC1_IN2P		BIT(3)
++#define RT5670_DMIC1_GPIO6		BIT(4)
++#define RT5670_DMIC1_GPIO7		BIT(5)
++#define RT5670_DMIC2_INR		BIT(6)
++#define RT5670_DMIC2_GPIO8		BIT(7)
++#define RT5670_DMIC3_GPIO5		BIT(8)
++#define RT5670_JD_MODE1			BIT(9)
++#define RT5670_JD_MODE2			BIT(10)
++#define RT5670_JD_MODE3			BIT(11)
++#define RT5670_GPIO1_IS_EXT_SPK_EN	BIT(12)
+ 
+ static unsigned long rt5670_quirk;
+ static unsigned int quirk_override;
+@@ -1447,6 +1448,33 @@ static int rt5670_hp_event(struct snd_soc_dapm_widget *w,
+ 	return 0;
+ }
+ 
++static int rt5670_spk_event(struct snd_soc_dapm_widget *w,
++	struct snd_kcontrol *kcontrol, int event)
++{
++	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
++	struct rt5670_priv *rt5670 = snd_soc_component_get_drvdata(component);
++
++	if (!rt5670->pdata.gpio1_is_ext_spk_en)
++		return 0;
++
++	switch (event) {
++	case SND_SOC_DAPM_POST_PMU:
++		regmap_update_bits(rt5670->regmap, RT5670_GPIO_CTRL2,
++				   RT5670_GP1_OUT_MASK, RT5670_GP1_OUT_HI);
++		break;
++
++	case SND_SOC_DAPM_PRE_PMD:
++		regmap_update_bits(rt5670->regmap, RT5670_GPIO_CTRL2,
++				   RT5670_GP1_OUT_MASK, RT5670_GP1_OUT_LO);
++		break;
++
++	default:
++		return 0;
++	}
++
++	return 0;
++}
++
+ static int rt5670_bst1_event(struct snd_soc_dapm_widget *w,
+ 	struct snd_kcontrol *kcontrol, int event)
+ {
+@@ -1860,7 +1888,9 @@ static const struct snd_soc_dapm_widget rt5670_specific_dapm_widgets[] = {
+ };
+ 
+ static const struct snd_soc_dapm_widget rt5672_specific_dapm_widgets[] = {
+-	SND_SOC_DAPM_PGA("SPO Amp", SND_SOC_NOPM, 0, 0, NULL, 0),
++	SND_SOC_DAPM_PGA_E("SPO Amp", SND_SOC_NOPM, 0, 0, NULL, 0,
++			   rt5670_spk_event, SND_SOC_DAPM_PRE_PMD |
++			   SND_SOC_DAPM_POST_PMU),
+ 	SND_SOC_DAPM_OUTPUT("SPOLP"),
+ 	SND_SOC_DAPM_OUTPUT("SPOLN"),
+ 	SND_SOC_DAPM_OUTPUT("SPORP"),
+@@ -2857,14 +2887,14 @@ static const struct dmi_system_id dmi_platform_intel_quirks[] = {
+ 	},
+ 	{
+ 		.callback = rt5670_quirk_cb,
+-		.ident = "Lenovo Thinkpad Tablet 10",
++		.ident = "Lenovo Miix 2 10",
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Miix 2 10"),
+ 		},
+ 		.driver_data = (unsigned long *)(RT5670_DMIC_EN |
+ 						 RT5670_DMIC1_IN2P |
+-						 RT5670_DEV_GPIO |
++						 RT5670_GPIO1_IS_EXT_SPK_EN |
+ 						 RT5670_JD_MODE2),
+ 	},
+ 	{
+@@ -2924,6 +2954,10 @@ static int rt5670_i2c_probe(struct i2c_client *i2c,
+ 		rt5670->pdata.dev_gpio = true;
+ 		dev_info(&i2c->dev, "quirk dev_gpio\n");
+ 	}
++	if (rt5670_quirk & RT5670_GPIO1_IS_EXT_SPK_EN) {
++		rt5670->pdata.gpio1_is_ext_spk_en = true;
++		dev_info(&i2c->dev, "quirk GPIO1 is external speaker enable\n");
++	}
+ 	if (rt5670_quirk & RT5670_IN2_DIFF) {
+ 		rt5670->pdata.in2_diff = true;
+ 		dev_info(&i2c->dev, "quirk IN2_DIFF\n");
+@@ -3023,6 +3057,13 @@ static int rt5670_i2c_probe(struct i2c_client *i2c,
+ 				   RT5670_GP1_PF_MASK, RT5670_GP1_PF_OUT);
+ 	}
+ 
++	if (rt5670->pdata.gpio1_is_ext_spk_en) {
++		regmap_update_bits(rt5670->regmap, RT5670_GPIO_CTRL1,
++				   RT5670_GP1_PIN_MASK, RT5670_GP1_PIN_GPIO1);
++		regmap_update_bits(rt5670->regmap, RT5670_GPIO_CTRL2,
++				   RT5670_GP1_PF_MASK, RT5670_GP1_PF_OUT);
++	}
++
+ 	if (rt5670->pdata.jd_mode) {
+ 		regmap_update_bits(rt5670->regmap, RT5670_GLB_CLK,
+ 				   RT5670_SCLK_SRC_MASK, RT5670_SCLK_SRC_RCCLK);
+diff --git a/sound/soc/codecs/rt5670.h b/sound/soc/codecs/rt5670.h
+index a8c3e44770b8..de0203369b7c 100644
+--- a/sound/soc/codecs/rt5670.h
++++ b/sound/soc/codecs/rt5670.h
+@@ -757,7 +757,7 @@
+ #define RT5670_PWR_VREF2_BIT			4
+ #define RT5670_PWR_FV2				(0x1 << 3)
+ #define RT5670_PWR_FV2_BIT			3
+-#define RT5670_LDO_SEL_MASK			(0x3)
++#define RT5670_LDO_SEL_MASK			(0x7)
+ #define RT5670_LDO_SEL_SFT			0
+ 
+ /* Power Management for Analog 2 (0x64) */
+diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
+index 54e97455d7f6..ed332177b0f9 100644
+--- a/sound/soc/intel/boards/bytcht_es8316.c
++++ b/sound/soc/intel/boards/bytcht_es8316.c
+@@ -548,8 +548,10 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev)
+ 
+ 	if (cnt) {
+ 		ret = device_add_properties(codec_dev, props);
+-		if (ret)
++		if (ret) {
++			put_device(codec_dev);
+ 			return ret;
++		}
+ 	}
+ 
+ 	devm_acpi_dev_add_driver_gpios(codec_dev, byt_cht_es8316_gpios);
+diff --git a/sound/soc/qcom/Kconfig b/sound/soc/qcom/Kconfig
+index 60086858e920..b9d8fe9f996a 100644
+--- a/sound/soc/qcom/Kconfig
++++ b/sound/soc/qcom/Kconfig
+@@ -72,7 +72,7 @@ config SND_SOC_QDSP6_ASM_DAI
+ 
+ config SND_SOC_QDSP6
+ 	tristate "SoC ALSA audio driver for QDSP6"
+-	depends on QCOM_APR && HAS_DMA
++	depends on QCOM_APR
+ 	select SND_SOC_QDSP6_COMMON
+ 	select SND_SOC_QDSP6_CORE
+ 	select SND_SOC_QDSP6_AFE
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index 65c91abb9462..0100f123484e 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -1284,17 +1284,29 @@ static int soc_tplg_dapm_graph_elems_load(struct soc_tplg *tplg,
+ 		list_add(&routes[i]->dobj.list, &tplg->comp->dobj_list);
+ 
+ 		ret = soc_tplg_add_route(tplg, routes[i]);
+-		if (ret < 0)
++		if (ret < 0) {
++			/*
++			 * this route was added to the list, it will
++			 * be freed in remove_route() so increment the
++			 * counter to skip it in the error handling
++			 * below.
++			 */
++			i++;
+ 			break;
++		}
+ 
+ 		/* add route, but keep going if some fail */
+ 		snd_soc_dapm_add_routes(dapm, routes[i], 1);
+ 	}
+ 
+-	/* free memory allocated for all dapm routes in case of error */
+-	if (ret < 0)
+-		for (i = 0; i < count ; i++)
+-			kfree(routes[i]);
++	/*
++	 * free memory allocated for all dapm routes not added to the
++	 * list in case of error
++	 */
++	if (ret < 0) {
++		while (i < count)
++			kfree(routes[i++]);
++	}
+ 
+ 	/*
+ 	 * free pointer to array of dapm routes as this is no longer needed.
+@@ -1382,7 +1394,6 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dmixer_create(
+ 		if (err < 0) {
+ 			dev_err(tplg->dev, "ASoC: failed to init %s\n",
+ 				mc->hdr.name);
+-			soc_tplg_free_tlv(tplg, &kc[i]);
+ 			goto err_sm;
+ 		}
+ 	}
+@@ -1390,6 +1401,7 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dmixer_create(
+ 
+ err_sm:
+ 	for (; i >= 0; i--) {
++		soc_tplg_free_tlv(tplg, &kc[i]);
+ 		sm = (struct soc_mixer_control *)kc[i].private_value;
+ 		kfree(sm);
+ 		kfree(kc[i].name);