Linux patch 4.4.1074.4-110

2 files changed, 3194 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 84960c9b..66f2735d 100644
--- a/0000_README
+++ b/0000_README
@@ -467,6 +467,10 @@ Patch:  1105_linux-4.4.106.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.4.106
 
+Patch:  1106_linux-4.4.107.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.4.107
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1106_linux-4.4.107.patch b/1106_linux-4.4.107.patch
new file mode 100644
index 00000000..7176fc37
--- /dev/null
+++ b/1106_linux-4.4.107.patch
@@ -0,0 +1,3190 @@
+diff --git a/Makefile b/Makefile
+index 8225da6b520f..f7997b15d055 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 106
++SUBLEVEL = 107
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/blackfin/Kconfig b/arch/blackfin/Kconfig
+index af76634f8d98..934573cc1134 100644
+--- a/arch/blackfin/Kconfig
++++ b/arch/blackfin/Kconfig
+@@ -318,11 +318,14 @@ config BF53x
+ 
+ config GPIO_ADI
+ 	def_bool y
++	depends on !PINCTRL
+ 	depends on (BF51x || BF52x || BF53x || BF538 || BF539 || BF561)
+ 
+-config PINCTRL
++config PINCTRL_BLACKFIN_ADI2
+ 	def_bool y
+-	depends on BF54x || BF60x
++	depends on (BF54x || BF60x)
++	select PINCTRL
++	select PINCTRL_ADI2
+ 
+ config MEM_MT48LC64M4A2FB_7E
+ 	bool
+diff --git a/arch/blackfin/Kconfig.debug b/arch/blackfin/Kconfig.debug
+index f3337ee03621..a93cf06a4d6f 100644
+--- a/arch/blackfin/Kconfig.debug
++++ b/arch/blackfin/Kconfig.debug
+@@ -17,6 +17,7 @@ config DEBUG_VERBOSE
+ 
+ config DEBUG_MMRS
+ 	tristate "Generate Blackfin MMR tree"
++	depends on !PINCTRL
+ 	select DEBUG_FS
+ 	help
+ 	  Create a tree of Blackfin MMRs via the debugfs tree.  If
+diff --git a/arch/openrisc/include/asm/uaccess.h b/arch/openrisc/include/asm/uaccess.h
+index 5cc6b4f1b795..1a836afb636d 100644
+--- a/arch/openrisc/include/asm/uaccess.h
++++ b/arch/openrisc/include/asm/uaccess.h
+@@ -215,7 +215,7 @@ do {									\
+ 	case 1: __get_user_asm(x, ptr, retval, "l.lbz"); break;		\
+ 	case 2: __get_user_asm(x, ptr, retval, "l.lhz"); break;		\
+ 	case 4: __get_user_asm(x, ptr, retval, "l.lwz"); break;		\
+-	case 8: __get_user_asm2(x, ptr, retval);			\
++	case 8: __get_user_asm2(x, ptr, retval); break;			\
+ 	default: (x) = __get_user_bad();				\
+ 	}								\
+ } while (0)
+diff --git a/arch/powerpc/perf/hv-24x7.c b/arch/powerpc/perf/hv-24x7.c
+index 9f9dfda9ed2c..e8ca0fad2e69 100644
+--- a/arch/powerpc/perf/hv-24x7.c
++++ b/arch/powerpc/perf/hv-24x7.c
+@@ -514,7 +514,7 @@ static int memord(const void *d1, size_t s1, const void *d2, size_t s2)
+ {
+ 	if (s1 < s2)
+ 		return 1;
+-	if (s2 > s1)
++	if (s1 > s2)
+ 		return -1;
+ 
+ 	return memcmp(d1, d2, s1);
+diff --git a/arch/powerpc/platforms/powernv/opal-async.c b/arch/powerpc/platforms/powernv/opal-async.c
+index bdc8c0c71d15..4c00b37b09bc 100644
+--- a/arch/powerpc/platforms/powernv/opal-async.c
++++ b/arch/powerpc/platforms/powernv/opal-async.c
+@@ -39,18 +39,18 @@ int __opal_async_get_token(void)
+ 	int token;
+ 
+ 	spin_lock_irqsave(&opal_async_comp_lock, flags);
+-	token = find_first_bit(opal_async_complete_map, opal_max_async_tokens);
++	token = find_first_zero_bit(opal_async_token_map, opal_max_async_tokens);
+ 	if (token >= opal_max_async_tokens) {
+ 		token = -EBUSY;
+ 		goto out;
+ 	}
+ 
+-	if (__test_and_set_bit(token, opal_async_token_map)) {
++	if (!__test_and_clear_bit(token, opal_async_complete_map)) {
+ 		token = -EBUSY;
+ 		goto out;
+ 	}
+ 
+-	__clear_bit(token, opal_async_complete_map);
++	__set_bit(token, opal_async_token_map);
+ 
+ out:
+ 	spin_unlock_irqrestore(&opal_async_comp_lock, flags);
+diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
+index a9a8fa37a555..f48afc06ba14 100644
+--- a/arch/powerpc/platforms/powernv/setup.c
++++ b/arch/powerpc/platforms/powernv/setup.c
+@@ -295,7 +295,7 @@ static unsigned long pnv_get_proc_freq(unsigned int cpu)
+ {
+ 	unsigned long ret_freq;
+ 
+-	ret_freq = cpufreq_quick_get(cpu) * 1000ul;
++	ret_freq = cpufreq_get(cpu) * 1000ul;
+ 
+ 	/*
+ 	 * If the backend cpufreq driver does not exist,
+diff --git a/arch/powerpc/sysdev/ipic.c b/arch/powerpc/sysdev/ipic.c
+index f76ee39cb337..800a591695c0 100644
+--- a/arch/powerpc/sysdev/ipic.c
++++ b/arch/powerpc/sysdev/ipic.c
+@@ -845,12 +845,12 @@ void ipic_disable_mcp(enum ipic_mcp_irq mcp_irq)
+ 
+ u32 ipic_get_mcp_status(void)
+ {
+-	return ipic_read(primary_ipic->regs, IPIC_SERMR);
++	return ipic_read(primary_ipic->regs, IPIC_SERSR);
+ }
+ 
+ void ipic_clear_mcp_status(u32 mask)
+ {
+-	ipic_write(primary_ipic->regs, IPIC_SERMR, mask);
++	ipic_write(primary_ipic->regs, IPIC_SERSR, mask);
+ }
+ 
+ /* Return an interrupt vector or NO_IRQ if no interrupt is pending. */
+diff --git a/arch/x86/crypto/salsa20_glue.c b/arch/x86/crypto/salsa20_glue.c
+index 399a29d067d6..cb91a64a99e7 100644
+--- a/arch/x86/crypto/salsa20_glue.c
++++ b/arch/x86/crypto/salsa20_glue.c
+@@ -59,13 +59,6 @@ static int encrypt(struct blkcipher_desc *desc,
+ 
+ 	salsa20_ivsetup(ctx, walk.iv);
+ 
+-	if (likely(walk.nbytes == nbytes))
+-	{
+-		salsa20_encrypt_bytes(ctx, walk.src.virt.addr,
+-				      walk.dst.virt.addr, nbytes);
+-		return blkcipher_walk_done(desc, &walk, 0);
+-	}
+-
+ 	while (walk.nbytes >= 64) {
+ 		salsa20_encrypt_bytes(ctx, walk.src.virt.addr,
+ 				      walk.dst.virt.addr,
+diff --git a/crypto/hmac.c b/crypto/hmac.c
+index 72e38c098bb3..ba07fb6221ae 100644
+--- a/crypto/hmac.c
++++ b/crypto/hmac.c
+@@ -194,11 +194,15 @@ static int hmac_create(struct crypto_template *tmpl, struct rtattr **tb)
+ 	salg = shash_attr_alg(tb[1], 0, 0);
+ 	if (IS_ERR(salg))
+ 		return PTR_ERR(salg);
++	alg = &salg->base;
+ 
++	/* The underlying hash algorithm must be unkeyed */
+ 	err = -EINVAL;
++	if (crypto_shash_alg_has_setkey(salg))
++		goto out_put_alg;
++
+ 	ds = salg->digestsize;
+ 	ss = salg->statesize;
+-	alg = &salg->base;
+ 	if (ds > alg->cra_blocksize ||
+ 	    ss < alg->cra_blocksize)
+ 		goto out_put_alg;
+diff --git a/crypto/salsa20_generic.c b/crypto/salsa20_generic.c
+index f550b5d94630..d7da0eea5622 100644
+--- a/crypto/salsa20_generic.c
++++ b/crypto/salsa20_generic.c
+@@ -188,13 +188,6 @@ static int encrypt(struct blkcipher_desc *desc,
+ 
+ 	salsa20_ivsetup(ctx, walk.iv);
+ 
+-	if (likely(walk.nbytes == nbytes))
+-	{
+-		salsa20_encrypt_bytes(ctx, walk.dst.virt.addr,
+-				      walk.src.virt.addr, nbytes);
+-		return blkcipher_walk_done(desc, &walk, 0);
+-	}
+-
+ 	while (walk.nbytes >= 64) {
+ 		salsa20_encrypt_bytes(ctx, walk.dst.virt.addr,
+ 				      walk.src.virt.addr,
+diff --git a/crypto/shash.c b/crypto/shash.c
+index b2cd109d9171..5444b429e35d 100644
+--- a/crypto/shash.c
++++ b/crypto/shash.c
+@@ -24,11 +24,12 @@
+ 
+ static const struct crypto_type crypto_shash_type;
+ 
+-static int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
+-			   unsigned int keylen)
++int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
++		    unsigned int keylen)
+ {
+ 	return -ENOSYS;
+ }
++EXPORT_SYMBOL_GPL(shash_no_setkey);
+ 
+ static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key,
+ 				  unsigned int keylen)
+diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
+index 46a4a757d478..f522828d45c9 100644
+--- a/crypto/tcrypt.c
++++ b/crypto/tcrypt.c
+@@ -410,7 +410,7 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs,
+ 			}
+ 
+ 			sg_init_aead(sg, xbuf,
+-				    *b_size + (enc ? authsize : 0));
++				    *b_size + (enc ? 0 : authsize));
+ 
+ 			sg_init_aead(sgout, xoutbuf,
+ 				    *b_size + (enc ? authsize : 0));
+@@ -418,7 +418,9 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs,
+ 			sg_set_buf(&sg[0], assoc, aad_size);
+ 			sg_set_buf(&sgout[0], assoc, aad_size);
+ 
+-			aead_request_set_crypt(req, sg, sgout, *b_size, iv);
++			aead_request_set_crypt(req, sg, sgout,
++					       *b_size + (enc ? 0 : authsize),
++					       iv);
+ 			aead_request_set_ad(req, aad_size);
+ 
+ 			if (secs)
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 1ccad79ce77c..ce120fbe229e 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1050,6 +1050,10 @@ static int btusb_open(struct hci_dev *hdev)
+ 		return err;
+ 
+ 	data->intf->needs_remote_wakeup = 1;
++	/* device specific wakeup source enabled and required for USB
++	 * remote wakeup while host is suspended
++	 */
++	device_wakeup_enable(&data->udev->dev);
+ 
+ 	if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
+ 		goto done;
+@@ -1113,6 +1117,7 @@ static int btusb_close(struct hci_dev *hdev)
+ 		goto failed;
+ 
+ 	data->intf->needs_remote_wakeup = 0;
++	device_wakeup_disable(&data->udev->dev);
+ 	usb_autopm_put_interface(data->intf);
+ 
+ failed:
+diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
+index 0f54cb7ddcbb..e764e8ebb86b 100644
+--- a/drivers/bus/arm-ccn.c
++++ b/drivers/bus/arm-ccn.c
+@@ -1260,6 +1260,7 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn)
+ 
+ 	/* Perf driver registration */
+ 	ccn->dt.pmu = (struct pmu) {
++		.module = THIS_MODULE,
+ 		.attr_groups = arm_ccn_pmu_attr_groups,
+ 		.task_ctx_nr = perf_invalid_context,
+ 		.event_init = arm_ccn_pmu_event_init,
+diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c
+index aab64205d866..a0df83e6b84b 100644
+--- a/drivers/clk/imx/clk-imx6q.c
++++ b/drivers/clk/imx/clk-imx6q.c
+@@ -419,7 +419,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ 		clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu2d_core_podf", base + 0x6c, 24);
+ 	clk[IMX6QDL_CLK_GPU3D_CORE]   = imx_clk_gate2("gpu3d_core",    "gpu3d_core_podf",   base + 0x6c, 26);
+ 	clk[IMX6QDL_CLK_HDMI_IAHB]    = imx_clk_gate2("hdmi_iahb",     "ahb",               base + 0x70, 0);
+-	clk[IMX6QDL_CLK_HDMI_ISFR]    = imx_clk_gate2("hdmi_isfr",     "video_27m",         base + 0x70, 4);
++	clk[IMX6QDL_CLK_HDMI_ISFR]    = imx_clk_gate2("hdmi_isfr",     "mipi_core_cfg",     base + 0x70, 4);
+ 	clk[IMX6QDL_CLK_I2C1]         = imx_clk_gate2("i2c1",          "ipg_per",           base + 0x70, 6);
+ 	clk[IMX6QDL_CLK_I2C2]         = imx_clk_gate2("i2c2",          "ipg_per",           base + 0x70, 8);
+ 	clk[IMX6QDL_CLK_I2C3]         = imx_clk_gate2("i2c3",          "ipg_per",           base + 0x70, 10);
+diff --git a/drivers/clk/mediatek/clk-mtk.h b/drivers/clk/mediatek/clk-mtk.h
+index 32d2e455eb3f..8e501c219946 100644
+--- a/drivers/clk/mediatek/clk-mtk.h
++++ b/drivers/clk/mediatek/clk-mtk.h
+@@ -174,6 +174,7 @@ struct mtk_pll_data {
+ 	uint32_t pcw_reg;
+ 	int pcw_shift;
+ 	const struct mtk_pll_div_table *div_table;
++	const char *parent_name;
+ };
+ 
+ void mtk_clk_register_plls(struct device_node *node,
+diff --git a/drivers/clk/mediatek/clk-pll.c b/drivers/clk/mediatek/clk-pll.c
+index 966cab1348da..1c5b081ad5a1 100644
+--- a/drivers/clk/mediatek/clk-pll.c
++++ b/drivers/clk/mediatek/clk-pll.c
+@@ -302,7 +302,10 @@ static struct clk *mtk_clk_register_pll(const struct mtk_pll_data *data,
+ 
+ 	init.name = data->name;
+ 	init.ops = &mtk_pll_ops;
+-	init.parent_names = &parent_name;
++	if (data->parent_name)
++		init.parent_names = &data->parent_name;
++	else
++		init.parent_names = &parent_name;
+ 	init.num_parents = 1;
+ 
+ 	clk = clk_register(NULL, &pll->hw);
+diff --git a/drivers/clk/tegra/clk-tegra30.c b/drivers/clk/tegra/clk-tegra30.c
+index b90db615c29e..8c41c6fcb9ee 100644
+--- a/drivers/clk/tegra/clk-tegra30.c
++++ b/drivers/clk/tegra/clk-tegra30.c
+@@ -1063,7 +1063,7 @@ static void __init tegra30_super_clk_init(void)
+ 	 * U71 divider of cclk_lp.
+ 	 */
+ 	clk = tegra_clk_register_divider("pll_p_out3_cclklp", "pll_p_out3",
+-				clk_base + SUPER_CCLKG_DIVIDER, 0,
++				clk_base + SUPER_CCLKLP_DIVIDER, 0,
+ 				TEGRA_DIVIDER_INT, 16, 8, 1, NULL);
+ 	clk_register_clkdev(clk, "pll_p_out3_cclklp", NULL);
+ 
+diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
+index 3ecec1445adf..8b9e28f1e3f5 100644
+--- a/drivers/dma/dmaengine.c
++++ b/drivers/dma/dmaengine.c
+@@ -1023,12 +1023,14 @@ static struct dmaengine_unmap_pool *__get_unmap_pool(int nr)
+ 	switch (order) {
+ 	case 0 ... 1:
+ 		return &unmap_pool[0];
++#if IS_ENABLED(CONFIG_DMA_ENGINE_RAID)
+ 	case 2 ... 4:
+ 		return &unmap_pool[1];
+ 	case 5 ... 7:
+ 		return &unmap_pool[2];
+ 	case 8:
+ 		return &unmap_pool[3];
++#endif
+ 	default:
+ 		BUG();
+ 		return NULL;
+diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
+index 1c7568c0055a..7254c20007f8 100644
+--- a/drivers/dma/dmatest.c
++++ b/drivers/dma/dmatest.c
+@@ -148,6 +148,12 @@ MODULE_PARM_DESC(run, "Run the test (default: false)");
+ #define PATTERN_OVERWRITE	0x20
+ #define PATTERN_COUNT_MASK	0x1f
+ 
++/* poor man's completion - we want to use wait_event_freezable() on it */
++struct dmatest_done {
++	bool			done;
++	wait_queue_head_t	*wait;
++};
++
+ struct dmatest_thread {
+ 	struct list_head	node;
+ 	struct dmatest_info	*info;
+@@ -156,6 +162,8 @@ struct dmatest_thread {
+ 	u8			**srcs;
+ 	u8			**dsts;
+ 	enum dma_transaction_type type;
++	wait_queue_head_t done_wait;
++	struct dmatest_done test_done;
+ 	bool			done;
+ };
+ 
+@@ -316,18 +324,25 @@ static unsigned int dmatest_verify(u8 **bufs, unsigned int start,
+ 	return error_count;
+ }
+ 
+-/* poor man's completion - we want to use wait_event_freezable() on it */
+-struct dmatest_done {
+-	bool			done;
+-	wait_queue_head_t	*wait;
+-};
+ 
+ static void dmatest_callback(void *arg)
+ {
+ 	struct dmatest_done *done = arg;
+-
+-	done->done = true;
+-	wake_up_all(done->wait);
++	struct dmatest_thread *thread =
++		container_of(arg, struct dmatest_thread, done_wait);
++	if (!thread->done) {
++		done->done = true;
++		wake_up_all(done->wait);
++	} else {
++		/*
++		 * If thread->done, it means that this callback occurred
++		 * after the parent thread has cleaned up. This can
++		 * happen in the case that driver doesn't implement
++		 * the terminate_all() functionality and a dma operation
++		 * did not occur within the timeout period
++		 */
++		WARN(1, "dmatest: Kernel memory may be corrupted!!\n");
++	}
+ }
+ 
+ static unsigned int min_odd(unsigned int x, unsigned int y)
+@@ -398,9 +413,8 @@ static unsigned long long dmatest_KBs(s64 runtime, unsigned long long len)
+  */
+ static int dmatest_func(void *data)
+ {
+-	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(done_wait);
+ 	struct dmatest_thread	*thread = data;
+-	struct dmatest_done	done = { .wait = &done_wait };
++	struct dmatest_done	*done = &thread->test_done;
+ 	struct dmatest_info	*info;
+ 	struct dmatest_params	*params;
+ 	struct dma_chan		*chan;
+@@ -605,9 +619,9 @@ static int dmatest_func(void *data)
+ 			continue;
+ 		}
+ 
+-		done.done = false;
++		done->done = false;
+ 		tx->callback = dmatest_callback;
+-		tx->callback_param = &done;
++		tx->callback_param = done;
+ 		cookie = tx->tx_submit(tx);
+ 
+ 		if (dma_submit_error(cookie)) {
+@@ -620,21 +634,12 @@ static int dmatest_func(void *data)
+ 		}
+ 		dma_async_issue_pending(chan);
+ 
+-		wait_event_freezable_timeout(done_wait, done.done,
++		wait_event_freezable_timeout(thread->done_wait, done->done,
+ 					     msecs_to_jiffies(params->timeout));
+ 
+ 		status = dma_async_is_tx_complete(chan, cookie, NULL, NULL);
+ 
+-		if (!done.done) {
+-			/*
+-			 * We're leaving the timed out dma operation with
+-			 * dangling pointer to done_wait.  To make this
+-			 * correct, we'll need to allocate wait_done for
+-			 * each test iteration and perform "who's gonna
+-			 * free it this time?" dancing.  For now, just
+-			 * leave it dangling.
+-			 */
+-			WARN(1, "dmatest: Kernel stack may be corrupted!!\n");
++		if (!done->done) {
+ 			dmaengine_unmap_put(um);
+ 			result("test timed out", total_tests, src_off, dst_off,
+ 			       len, 0);
+@@ -708,7 +713,7 @@ err_thread_type:
+ 		dmatest_KBs(runtime, total_len), ret);
+ 
+ 	/* terminate all transfers on specified channels */
+-	if (ret)
++	if (ret || failed_tests)
+ 		dmaengine_terminate_all(chan);
+ 
+ 	thread->done = true;
+@@ -766,6 +771,8 @@ static int dmatest_add_threads(struct dmatest_info *info,
+ 		thread->info = info;
+ 		thread->chan = dtc->chan;
+ 		thread->type = type;
++		thread->test_done.wait = &thread->done_wait;
++		init_waitqueue_head(&thread->done_wait);
+ 		smp_wmb();
+ 		thread->task = kthread_create(dmatest_func, thread, "%s-%s%u",
+ 				dma_chan_name(chan), op, i);
+diff --git a/drivers/dma/ti-dma-crossbar.c b/drivers/dma/ti-dma-crossbar.c
+index 149ec2bd9bc6..8100ede095d5 100644
+--- a/drivers/dma/ti-dma-crossbar.c
++++ b/drivers/dma/ti-dma-crossbar.c
+@@ -46,12 +46,12 @@ struct ti_am335x_xbar_data {
+ 
+ struct ti_am335x_xbar_map {
+ 	u16 dma_line;
+-	u16 mux_val;
++	u8 mux_val;
+ };
+ 
+-static inline void ti_am335x_xbar_write(void __iomem *iomem, int event, u16 val)
++static inline void ti_am335x_xbar_write(void __iomem *iomem, int event, u8 val)
+ {
+-	writeb_relaxed(val & 0x1f, iomem + event);
++	writeb_relaxed(val, iomem + event);
+ }
+ 
+ static void ti_am335x_xbar_free(struct device *dev, void *route_data)
+@@ -102,7 +102,7 @@ static void *ti_am335x_xbar_route_allocate(struct of_phandle_args *dma_spec,
+ 	}
+ 
+ 	map->dma_line = (u16)dma_spec->args[0];
+-	map->mux_val = (u16)dma_spec->args[2];
++	map->mux_val = (u8)dma_spec->args[2];
+ 
+ 	dma_spec->args[2] = 0;
+ 	dma_spec->args_count = 2;
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index 78fe416126d1..ef467ae6dc40 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -310,7 +310,6 @@ int __init efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md)
+ 
+ 		early_memunmap(md, sizeof (*md));
+ 	}
+-	pr_err_once("requested map not found.\n");
+ 	return -ENOENT;
+ }
+ 
+diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c
+index 0ca4c34f9441..341b8c686ec7 100644
+--- a/drivers/firmware/efi/esrt.c
++++ b/drivers/firmware/efi/esrt.c
+@@ -253,7 +253,7 @@ void __init efi_esrt_init(void)
+ 
+ 	rc = efi_mem_desc_lookup(efi.esrt, &md);
+ 	if (rc < 0) {
+-		pr_err("ESRT header is not in the memory map.\n");
++		pr_warn("ESRT header is not in the memory map.\n");
+ 		return;
+ 	}
+ 
+diff --git a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
+index 27c297672076..d2d1c9a34da1 100644
+--- a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
++++ b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
+@@ -142,9 +142,6 @@ static int omap_gem_dmabuf_mmap(struct dma_buf *buffer,
+ 	struct drm_gem_object *obj = buffer->priv;
+ 	int ret = 0;
+ 
+-	if (WARN_ON(!obj->filp))
+-		return -EINVAL;
+-
+ 	ret = drm_gem_mmap_obj(obj, omap_gem_mmap_size(obj), vma);
+ 	if (ret < 0)
+ 		return ret;
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index b6f16804e73b..d9007cc37be1 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -3029,6 +3029,16 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ 			max_sclk = 75000;
+ 			max_mclk = 80000;
+ 		}
++	} else if (rdev->family == CHIP_OLAND) {
++		if ((rdev->pdev->revision == 0xC7) ||
++		    (rdev->pdev->revision == 0x80) ||
++		    (rdev->pdev->revision == 0x81) ||
++		    (rdev->pdev->revision == 0x83) ||
++		    (rdev->pdev->revision == 0x87) ||
++		    (rdev->pdev->device == 0x6604) ||
++		    (rdev->pdev->device == 0x6605)) {
++			max_sclk = 75000;
++		}
+ 	}
+ 	/* Apply dpm quirks */
+ 	while (p && p->chip_device != 0) {
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index 32c6a40a408f..ea85330603b2 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -82,6 +82,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ 		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9da6),
+ 		.driver_data = (kernel_ulong_t)0,
+ 	},
++	{
++		/* Gemini Lake */
++		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e),
++		.driver_data = (kernel_ulong_t)0,
++	},
+ 	{ 0 },
+ };
+ 
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 43d5166db4c6..e354358db77b 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -1353,7 +1353,7 @@ static struct rdma_id_private *cma_id_from_event(struct ib_cm_id *cm_id,
+ 	return id_priv;
+ }
+ 
+-static inline int cma_user_data_offset(struct rdma_id_private *id_priv)
++static inline u8 cma_user_data_offset(struct rdma_id_private *id_priv)
+ {
+ 	return cma_family(id_priv) == AF_IB ? 0 : sizeof(struct cma_hdr);
+ }
+@@ -1731,7 +1731,8 @@ static int cma_req_handler(struct ib_cm_id *cm_id, struct ib_cm_event *ib_event)
+ 	struct rdma_id_private *listen_id, *conn_id;
+ 	struct rdma_cm_event event;
+ 	struct net_device *net_dev;
+-	int offset, ret;
++	u8 offset;
++	int ret;
+ 
+ 	listen_id = cma_id_from_event(cm_id, ib_event, &net_dev);
+ 	if (IS_ERR(listen_id))
+@@ -3118,7 +3119,8 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
+ 	struct ib_cm_sidr_req_param req;
+ 	struct ib_cm_id	*id;
+ 	void *private_data;
+-	int offset, ret;
++	u8 offset;
++	int ret;
+ 
+ 	memset(&req, 0, sizeof req);
+ 	offset = cma_user_data_offset(id_priv);
+@@ -3175,7 +3177,8 @@ static int cma_connect_ib(struct rdma_id_private *id_priv,
+ 	struct rdma_route *route;
+ 	void *private_data;
+ 	struct ib_cm_id	*id;
+-	int offset, ret;
++	u8 offset;
++	int ret;
+ 
+ 	memset(&req, 0, sizeof req);
+ 	offset = cma_user_data_offset(id_priv);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+index 8f8c3af9f4e8..d3f0a384faad 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+@@ -1044,10 +1044,15 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
+ 		ipoib_ib_dev_down(dev);
+ 
+ 	if (level == IPOIB_FLUSH_HEAVY) {
++		rtnl_lock();
+ 		if (test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags))
+ 			ipoib_ib_dev_stop(dev);
+-		if (ipoib_ib_dev_open(dev) != 0)
++
++		result = ipoib_ib_dev_open(dev);
++		rtnl_unlock();
++		if (result)
+ 			return;
++
+ 		if (netif_queue_stopped(dev))
+ 			netif_start_queue(dev);
+ 	}
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index dbf09836ff30..d1051e3ce819 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -520,6 +520,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"),
+ 		},
+ 	},
++	{
++		/* TUXEDO BU1406 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"),
++		},
++	},
+ 	{ }
+ };
+ 
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index 525ce56524ba..e73aeb0e892c 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -468,6 +468,7 @@ struct search {
+ 	unsigned		recoverable:1;
+ 	unsigned		write:1;
+ 	unsigned		read_dirty_data:1;
++	unsigned		cache_missed:1;
+ 
+ 	unsigned long		start_time;
+ 
+@@ -653,6 +654,7 @@ static inline struct search *search_alloc(struct bio *bio,
+ 
+ 	s->orig_bio		= bio;
+ 	s->cache_miss		= NULL;
++	s->cache_missed		= 0;
+ 	s->d			= d;
+ 	s->recoverable		= 1;
+ 	s->write		= (bio->bi_rw & REQ_WRITE) != 0;
+@@ -776,7 +778,7 @@ static void cached_dev_read_done_bh(struct closure *cl)
+ 	struct cached_dev *dc = container_of(s->d, struct cached_dev, disk);
+ 
+ 	bch_mark_cache_accounting(s->iop.c, s->d,
+-				  !s->cache_miss, s->iop.bypass);
++				  !s->cache_missed, s->iop.bypass);
+ 	trace_bcache_read(s->orig_bio, !s->cache_miss, s->iop.bypass);
+ 
+ 	if (s->iop.error)
+@@ -795,6 +797,8 @@ static int cached_dev_cache_miss(struct btree *b, struct search *s,
+ 	struct cached_dev *dc = container_of(s->d, struct cached_dev, disk);
+ 	struct bio *miss, *cache_bio;
+ 
++	s->cache_missed = 1;
++
+ 	if (s->cache_miss || s->iop.bypass) {
+ 		miss = bio_next_split(bio, sectors, GFP_NOIO, s->d->bio_split);
+ 		ret = miss == bio ? MAP_DONE : MAP_CONTINUE;
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index c5ceea9222ff..8eaadd9869bc 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -2083,6 +2083,7 @@ static void bcache_exit(void)
+ 	if (bcache_major)
+ 		unregister_blkdev(bcache_major, "bcache");
+ 	unregister_reboot_notifier(&reboot);
++	mutex_destroy(&bch_register_lock);
+ }
+ 
+ static int __init bcache_init(void)
+@@ -2101,14 +2102,15 @@ static int __init bcache_init(void)
+ 	bcache_major = register_blkdev(0, "bcache");
+ 	if (bcache_major < 0) {
+ 		unregister_reboot_notifier(&reboot);
++		mutex_destroy(&bch_register_lock);
+ 		return bcache_major;
+ 	}
+ 
+ 	if (!(bcache_wq = create_workqueue("bcache")) ||
+ 	    !(bcache_kobj = kobject_create_and_add("bcache", fs_kobj)) ||
+-	    sysfs_create_files(bcache_kobj, files) ||
+ 	    bch_request_init() ||
+-	    bch_debug_init(bcache_kobj))
++	    bch_debug_init(bcache_kobj) ||
++	    sysfs_create_files(bcache_kobj, files))
+ 		goto err;
+ 
+ 	return 0;
+diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
+index d6a1126d85ce..494d01d0e92a 100644
+--- a/drivers/md/md-cluster.c
++++ b/drivers/md/md-cluster.c
+@@ -821,6 +821,7 @@ static int leave(struct mddev *mddev)
+ 	lockres_free(cinfo->no_new_dev_lockres);
+ 	lockres_free(cinfo->bitmap_lockres);
+ 	dlm_release_lockspace(cinfo->lockspace, 2);
++	kfree(cinfo);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index d55bf85b76ce..86ab6d14d782 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -1681,8 +1681,11 @@ static void ops_complete_reconstruct(void *stripe_head_ref)
+ 		struct r5dev *dev = &sh->dev[i];
+ 
+ 		if (dev->written || i == pd_idx || i == qd_idx) {
+-			if (!discard && !test_bit(R5_SkipCopy, &dev->flags))
++			if (!discard && !test_bit(R5_SkipCopy, &dev->flags)) {
+ 				set_bit(R5_UPTODATE, &dev->flags);
++				if (test_bit(STRIPE_EXPAND_READY, &sh->state))
++					set_bit(R5_Expanded, &dev->flags);
++			}
+ 			if (fua)
+ 				set_bit(R5_WantFUA, &dev->flags);
+ 			if (sync)
+diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
+index 33dfd7e72516..0bf0d0e9dbdb 100644
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -570,7 +570,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz)
+ 		}
+ 	}
+ 	sdr_set_field(host->base + MSDC_CFG, MSDC_CFG_CKMOD | MSDC_CFG_CKDIV,
+-			(mode << 8) | (div % 0xff));
++		      (mode << 8) | div);
+ 	sdr_set_bits(host->base + MSDC_CFG, MSDC_CFG_CKPDN);
+ 	while (!(readl(host->base + MSDC_CFG) & MSDC_CFG_CKSTB))
+ 		cpu_relax();
+@@ -1540,7 +1540,7 @@ static int msdc_drv_probe(struct platform_device *pdev)
+ 	host->src_clk_freq = clk_get_rate(host->src_clk);
+ 	/* Set host parameters to mmc */
+ 	mmc->ops = &mt_msdc_ops;
+-	mmc->f_min = host->src_clk_freq / (4 * 255);
++	mmc->f_min = DIV_ROUND_UP(host->src_clk_freq, 4 * 255);
+ 
+ 	mmc->caps |= MMC_CAP_ERASE | MMC_CAP_CMD23;
+ 	mmc->caps |= MMC_CAP_RUNTIME_RESUME;
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index f971d92f7b41..74dd48f2bd89 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1,7 +1,7 @@
+ /*
+  * Broadcom GENET (Gigabit Ethernet) controller driver
+  *
+- * Copyright (c) 2014 Broadcom Corporation
++ * Copyright (c) 2014-2017 Broadcom
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License version 2 as
+@@ -778,8 +778,9 @@ static const struct bcmgenet_stats bcmgenet_gstrings_stats[] = {
+ 	STAT_GENET_RUNT("rx_runt_bytes", mib.rx_runt_bytes),
+ 	/* Misc UniMAC counters */
+ 	STAT_GENET_MISC("rbuf_ovflow_cnt", mib.rbuf_ovflow_cnt,
+-			UMAC_RBUF_OVFL_CNT),
+-	STAT_GENET_MISC("rbuf_err_cnt", mib.rbuf_err_cnt, UMAC_RBUF_ERR_CNT),
++			UMAC_RBUF_OVFL_CNT_V1),
++	STAT_GENET_MISC("rbuf_err_cnt", mib.rbuf_err_cnt,
++			UMAC_RBUF_ERR_CNT_V1),
+ 	STAT_GENET_MISC("mdf_err_cnt", mib.mdf_err_cnt, UMAC_MDF_ERR_CNT),
+ 	STAT_GENET_SOFT_MIB("alloc_rx_buff_failed", mib.alloc_rx_buff_failed),
+ 	STAT_GENET_SOFT_MIB("rx_dma_failed", mib.rx_dma_failed),
+@@ -821,6 +822,45 @@ static void bcmgenet_get_strings(struct net_device *dev, u32 stringset,
+ 	}
+ }
+ 
++static u32 bcmgenet_update_stat_misc(struct bcmgenet_priv *priv, u16 offset)
++{
++	u16 new_offset;
++	u32 val;
++
++	switch (offset) {
++	case UMAC_RBUF_OVFL_CNT_V1:
++		if (GENET_IS_V2(priv))
++			new_offset = RBUF_OVFL_CNT_V2;
++		else
++			new_offset = RBUF_OVFL_CNT_V3PLUS;
++
++		val = bcmgenet_rbuf_readl(priv,	new_offset);
++		/* clear if overflowed */
++		if (val == ~0)
++			bcmgenet_rbuf_writel(priv, 0, new_offset);
++		break;
++	case UMAC_RBUF_ERR_CNT_V1:
++		if (GENET_IS_V2(priv))
++			new_offset = RBUF_ERR_CNT_V2;
++		else
++			new_offset = RBUF_ERR_CNT_V3PLUS;
++
++		val = bcmgenet_rbuf_readl(priv,	new_offset);
++		/* clear if overflowed */
++		if (val == ~0)
++			bcmgenet_rbuf_writel(priv, 0, new_offset);
++		break;
++	default:
++		val = bcmgenet_umac_readl(priv, offset);
++		/* clear if overflowed */
++		if (val == ~0)
++			bcmgenet_umac_writel(priv, 0, offset);
++		break;
++	}
++
++	return val;
++}
++
+ static void bcmgenet_update_mib_counters(struct bcmgenet_priv *priv)
+ {
+ 	int i, j = 0;
+@@ -836,19 +876,28 @@ static void bcmgenet_update_mib_counters(struct bcmgenet_priv *priv)
+ 		case BCMGENET_STAT_NETDEV:
+ 		case BCMGENET_STAT_SOFT:
+ 			continue;
+-		case BCMGENET_STAT_MIB_RX:
+-		case BCMGENET_STAT_MIB_TX:
+ 		case BCMGENET_STAT_RUNT:
+-			if (s->type != BCMGENET_STAT_MIB_RX)
+-				offset = BCMGENET_STAT_OFFSET;
++			offset += BCMGENET_STAT_OFFSET;
++			/* fall through */
++		case BCMGENET_STAT_MIB_TX:
++			offset += BCMGENET_STAT_OFFSET;
++			/* fall through */
++		case BCMGENET_STAT_MIB_RX:
+ 			val = bcmgenet_umac_readl(priv,
+ 						  UMAC_MIB_START + j + offset);
++			offset = 0;	/* Reset Offset */
+ 			break;
+ 		case BCMGENET_STAT_MISC:
+-			val = bcmgenet_umac_readl(priv, s->reg_offset);
+-			/* clear if overflowed */
+-			if (val == ~0)
+-				bcmgenet_umac_writel(priv, 0, s->reg_offset);
++			if (GENET_IS_V1(priv)) {
++				val = bcmgenet_umac_readl(priv, s->reg_offset);
++				/* clear if overflowed */
++				if (val == ~0)
++					bcmgenet_umac_writel(priv, 0,
++							     s->reg_offset);
++			} else {
++				val = bcmgenet_update_stat_misc(priv,
++								s->reg_offset);
++			}
+ 			break;
+ 		}
+ 
+@@ -2901,6 +2950,8 @@ err_irq0:
+ err_fini_dma:
+ 	bcmgenet_fini_dma(priv);
+ err_clk_disable:
++	if (priv->internal_phy)
++		bcmgenet_power_down(priv, GENET_POWER_PASSIVE);
+ 	clk_disable_unprepare(priv->clk);
+ 	return ret;
+ }
+@@ -3277,6 +3328,12 @@ static void bcmgenet_set_hw_params(struct bcmgenet_priv *priv)
+ 	 */
+ 	gphy_rev = reg & 0xffff;
+ 
++	/* This is reserved so should require special treatment */
++	if (gphy_rev == 0 || gphy_rev == 0x01ff) {
++		pr_warn("Invalid GPHY revision detected: 0x%04x\n", gphy_rev);
++		return;
++	}
++
+ 	/* This is the good old scheme, just GPHY major, no minor nor patch */
+ 	if ((gphy_rev & 0xf0) != 0)
+ 		priv->gphy_rev = gphy_rev << 8;
+@@ -3285,12 +3342,6 @@ static void bcmgenet_set_hw_params(struct bcmgenet_priv *priv)
+ 	else if ((gphy_rev & 0xff00) != 0)
+ 		priv->gphy_rev = gphy_rev;
+ 
+-	/* This is reserved so should require special treatment */
+-	else if (gphy_rev == 0 || gphy_rev == 0x01ff) {
+-		pr_warn("Invalid GPHY revision detected: 0x%04x\n", gphy_rev);
+-		return;
+-	}
+-
+ #ifdef CONFIG_PHYS_ADDR_T_64BIT
+ 	if (!(params->flags & GENET_HAS_40BITS))
+ 		pr_warn("GENET does not support 40-bits PA\n");
+@@ -3333,6 +3384,7 @@ static int bcmgenet_probe(struct platform_device *pdev)
+ 	const void *macaddr;
+ 	struct resource *r;
+ 	int err = -EIO;
++	const char *phy_mode_str;
+ 
+ 	/* Up to GENET_MAX_MQ_CNT + 1 TX queues and RX queues */
+ 	dev = alloc_etherdev_mqs(sizeof(*priv), GENET_MAX_MQ_CNT + 1,
+@@ -3438,6 +3490,13 @@ static int bcmgenet_probe(struct platform_device *pdev)
+ 		priv->clk_eee = NULL;
+ 	}
+ 
++	/* If this is an internal GPHY, power it on now, before UniMAC is
++	 * brought out of reset as absolutely no UniMAC activity is allowed
++	 */
++	if (dn && !of_property_read_string(dn, "phy-mode", &phy_mode_str) &&
++	    !strcasecmp(phy_mode_str, "internal"))
++		bcmgenet_power_up(priv, GENET_POWER_PASSIVE);
++
+ 	err = reset_umac(priv);
+ 	if (err)
+ 		goto err_clk_disable;
+@@ -3604,6 +3663,8 @@ static int bcmgenet_resume(struct device *d)
+ 	return 0;
+ 
+ out_clk_disable:
++	if (priv->internal_phy)
++		bcmgenet_power_down(priv, GENET_POWER_PASSIVE);
+ 	clk_disable_unprepare(priv->clk);
+ 	return ret;
+ }
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+index 967367557309..cef53f2d9854 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2014 Broadcom Corporation
++ * Copyright (c) 2014-2017 Broadcom
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License version 2 as
+@@ -214,7 +214,9 @@ struct bcmgenet_mib_counters {
+ #define  MDIO_REG_SHIFT			16
+ #define  MDIO_REG_MASK			0x1F
+ 
+-#define UMAC_RBUF_OVFL_CNT		0x61C
++#define UMAC_RBUF_OVFL_CNT_V1		0x61C
++#define RBUF_OVFL_CNT_V2		0x80
++#define RBUF_OVFL_CNT_V3PLUS		0x94
+ 
+ #define UMAC_MPD_CTRL			0x620
+ #define  MPD_EN				(1 << 0)
+@@ -224,7 +226,9 @@ struct bcmgenet_mib_counters {
+ 
+ #define UMAC_MPD_PW_MS			0x624
+ #define UMAC_MPD_PW_LS			0x628
+-#define UMAC_RBUF_ERR_CNT		0x634
++#define UMAC_RBUF_ERR_CNT_V1		0x634
++#define RBUF_ERR_CNT_V2			0x84
++#define RBUF_ERR_CNT_V3PLUS		0x98
+ #define UMAC_MDF_ERR_CNT		0x638
+ #define UMAC_MDF_CTRL			0x650
+ #define UMAC_MDF_ADDR			0x654
+diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+index d48d5793407d..fc222df47aa9 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+@@ -2278,6 +2278,17 @@ static int sync_toggles(struct mlx4_dev *dev)
+ 		rd_toggle = swab32(readl(&priv->mfunc.comm->slave_read));
+ 		if (wr_toggle == 0xffffffff || rd_toggle == 0xffffffff) {
+ 			/* PCI might be offline */
++
++			/* If device removal has been requested,
++			 * do not continue retrying.
++			 */
++			if (dev->persist->interface_state &
++			    MLX4_INTERFACE_STATE_NOWAIT) {
++				mlx4_warn(dev,
++					  "communication channel is offline\n");
++				return -EIO;
++			}
++
+ 			msleep(100);
+ 			wr_toggle = swab32(readl(&priv->mfunc.comm->
+ 					   slave_write));
+diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
+index 99361352ed0d..a7d3144c2388 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -1763,6 +1763,14 @@ static int mlx4_comm_check_offline(struct mlx4_dev *dev)
+ 			       (u32)(1 << COMM_CHAN_OFFLINE_OFFSET));
+ 		if (!offline_bit)
+ 			return 0;
++
++		/* If device removal has been requested,
++		 * do not continue retrying.
++		 */
++		if (dev->persist->interface_state &
++		    MLX4_INTERFACE_STATE_NOWAIT)
++			break;
++
+ 		/* There are cases as part of AER/Reset flow that PF needs
+ 		 * around 100 msec to load. We therefore sleep for 100 msec
+ 		 * to allow other tasks to make use of that CPU during this
+@@ -3690,6 +3698,9 @@ static void mlx4_remove_one(struct pci_dev *pdev)
+ 	struct mlx4_priv *priv = mlx4_priv(dev);
+ 	int active_vfs = 0;
+ 
++	if (mlx4_is_slave(dev))
++		persist->interface_state |= MLX4_INTERFACE_STATE_NOWAIT;
++
+ 	mutex_lock(&persist->interface_state_mutex);
+ 	persist->interface_state |= MLX4_INTERFACE_STATE_DELETION;
+ 	mutex_unlock(&persist->interface_state_mutex);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
+index 236fb5d2ad69..c7fe61f1f89f 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
+@@ -599,7 +599,7 @@ static inline void mlxsw_reg_spvid_pack(char *payload, u8 local_port, u16 pvid)
+ #define MLXSW_REG_SPVM_ID 0x200F
+ #define MLXSW_REG_SPVM_BASE_LEN 0x04 /* base length, without records */
+ #define MLXSW_REG_SPVM_REC_LEN 0x04 /* record length */
+-#define MLXSW_REG_SPVM_REC_MAX_COUNT 256
++#define MLXSW_REG_SPVM_REC_MAX_COUNT 255
+ #define MLXSW_REG_SPVM_LEN (MLXSW_REG_SPVM_BASE_LEN +	\
+ 		    MLXSW_REG_SPVM_REC_LEN * MLXSW_REG_SPVM_REC_MAX_COUNT)
+ 
+@@ -1139,7 +1139,7 @@ static inline void mlxsw_reg_sfmr_pack(char *payload,
+ #define MLXSW_REG_SPVMLR_ID 0x2020
+ #define MLXSW_REG_SPVMLR_BASE_LEN 0x04 /* base length, without records */
+ #define MLXSW_REG_SPVMLR_REC_LEN 0x04 /* record length */
+-#define MLXSW_REG_SPVMLR_REC_MAX_COUNT 256
++#define MLXSW_REG_SPVMLR_REC_MAX_COUNT 255
+ #define MLXSW_REG_SPVMLR_LEN (MLXSW_REG_SPVMLR_BASE_LEN + \
+ 			      MLXSW_REG_SPVMLR_REC_LEN * \
+ 			      MLXSW_REG_SPVMLR_REC_MAX_COUNT)
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index cbe9a330117a..063aca17e698 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -4307,7 +4307,7 @@ static int efx_ef10_set_mac_address(struct efx_nic *efx)
+ 		 * MCFW do not support VFs.
+ 		 */
+ 		rc = efx_ef10_vport_set_mac_address(efx);
+-	} else {
++	} else if (rc) {
+ 		efx_mcdi_display_error(efx, MC_CMD_VADAPTOR_SET_MAC,
+ 				       sizeof(inbuf), NULL, 0, rc);
+ 	}
+diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
+index 0ddb54fe3d91..a539e831b4b1 100644
+--- a/drivers/net/fjes/fjes_main.c
++++ b/drivers/net/fjes/fjes_main.c
+@@ -1205,7 +1205,7 @@ static void fjes_netdev_setup(struct net_device *netdev)
+ 	fjes_set_ethtool_ops(netdev);
+ 	netdev->mtu = fjes_support_mtu[0];
+ 	netdev->flags |= IFF_BROADCAST;
+-	netdev->features |= NETIF_F_HW_CSUM | NETIF_F_HW_VLAN_CTAG_FILTER;
++	netdev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
+ }
+ 
+ static void fjes_irq_watch_task(struct work_struct *work)
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 40cd86614677..9897cabec371 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -441,7 +441,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
+ 					      struct macvlan_dev, list);
+ 	else
+ 		vlan = macvlan_hash_lookup(port, eth->h_dest);
+-	if (vlan == NULL)
++	if (!vlan || vlan->mode == MACVLAN_MODE_SOURCE)
+ 		return RX_HANDLER_PASS;
+ 
+ 	dev = vlan->dev;
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index dc454138d600..e2decf71c6d1 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -942,6 +942,7 @@ static __net_exit void ppp_exit_net(struct net *net)
+ 	unregister_netdevice_many(&list);
+ 	rtnl_unlock();
+ 
++	mutex_destroy(&pn->all_ppp_mutex);
+ 	idr_destroy(&pn->units_idr);
+ }
+ 
+diff --git a/drivers/net/wimax/i2400m/usb.c b/drivers/net/wimax/i2400m/usb.c
+index e7f5910a6519..f8eb66ef2944 100644
+--- a/drivers/net/wimax/i2400m/usb.c
++++ b/drivers/net/wimax/i2400m/usb.c
+@@ -467,6 +467,9 @@ int i2400mu_probe(struct usb_interface *iface,
+ 	struct i2400mu *i2400mu;
+ 	struct usb_device *usb_dev = interface_to_usbdev(iface);
+ 
++	if (iface->cur_altsetting->desc.bNumEndpoints < 4)
++		return -ENODEV;
++
+ 	if (usb_dev->speed != USB_SPEED_HIGH)
+ 		dev_err(dev, "device not connected as high speed\n");
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c
+index b4e6304afd40..7ee1a3183a06 100644
+--- a/drivers/net/wireless/ath/ath9k/tx99.c
++++ b/drivers/net/wireless/ath/ath9k/tx99.c
+@@ -180,6 +180,9 @@ static ssize_t write_file_tx99(struct file *file, const char __user *user_buf,
+ 	ssize_t len;
+ 	int r;
+ 
++	if (count < 1)
++		return -EINVAL;
++
+ 	if (sc->cur_chan->nvifs > 1)
+ 		return -EOPNOTSUPP;
+ 
+@@ -187,6 +190,8 @@ static ssize_t write_file_tx99(struct file *file, const char __user *user_buf,
+ 	if (copy_from_user(buf, user_buf, len))
+ 		return -EFAULT;
+ 
++	buf[len] = '\0';
++
+ 	if (strtobool(buf, &start))
+ 		return -EINVAL;
+ 
+diff --git a/drivers/pci/pcie/pme.c b/drivers/pci/pcie/pme.c
+index 63fc63911295..deb903112974 100644
+--- a/drivers/pci/pcie/pme.c
++++ b/drivers/pci/pcie/pme.c
+@@ -233,6 +233,9 @@ static void pcie_pme_work_fn(struct work_struct *work)
+ 			break;
+ 
+ 		pcie_capability_read_dword(port, PCI_EXP_RTSTA, &rtsta);
++		if (rtsta == (u32) ~0)
++			break;
++
+ 		if (rtsta & PCI_EXP_RTSTA_PME) {
+ 			/*
+ 			 * Clear PME status of the port.  If there are other
+@@ -280,7 +283,7 @@ static irqreturn_t pcie_pme_irq(int irq, void *context)
+ 	spin_lock_irqsave(&data->lock, flags);
+ 	pcie_capability_read_dword(port, PCI_EXP_RTSTA, &rtsta);
+ 
+-	if (!(rtsta & PCI_EXP_RTSTA_PME)) {
++	if (rtsta == (u32) ~0 || !(rtsta & PCI_EXP_RTSTA_PME)) {
+ 		spin_unlock_irqrestore(&data->lock, flags);
+ 		return IRQ_NONE;
+ 	}
+diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
+index 8a280e9c2ad1..7e67af2bb366 100644
+--- a/drivers/pci/remove.c
++++ b/drivers/pci/remove.c
+@@ -20,9 +20,9 @@ static void pci_stop_dev(struct pci_dev *dev)
+ 	pci_pme_active(dev, false);
+ 
+ 	if (dev->is_added) {
++		device_release_driver(&dev->dev);
+ 		pci_proc_detach_device(dev);
+ 		pci_remove_sysfs_dev_files(dev);
+-		device_release_driver(&dev->dev);
+ 		dev->is_added = 0;
+ 	}
+ 
+diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
+index 312c78b27a32..073b6d1e5efa 100644
+--- a/drivers/pinctrl/Kconfig
++++ b/drivers/pinctrl/Kconfig
+@@ -26,7 +26,8 @@ config DEBUG_PINCTRL
+ 
+ config PINCTRL_ADI2
+ 	bool "ADI pin controller driver"
+-	depends on BLACKFIN
++	depends on (BF54x || BF60x)
++	depends on !GPIO_ADI
+ 	select PINMUX
+ 	select IRQ_DOMAIN
+ 	help
+diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
+index c8f95b8e463a..45b5a3d47ccf 100644
+--- a/drivers/rtc/rtc-pcf8563.c
++++ b/drivers/rtc/rtc-pcf8563.c
+@@ -427,7 +427,7 @@ static unsigned long pcf8563_clkout_recalc_rate(struct clk_hw *hw,
+ 		return 0;
+ 
+ 	buf &= PCF8563_REG_CLKO_F_MASK;
+-	return clkout_rates[ret];
++	return clkout_rates[buf];
+ }
+ 
+ static long pcf8563_clkout_round_rate(struct clk_hw *hw, unsigned long rate,
+diff --git a/drivers/scsi/bfa/bfad_debugfs.c b/drivers/scsi/bfa/bfad_debugfs.c
+index 74a307c0a240..8f1c58d4d5b5 100644
+--- a/drivers/scsi/bfa/bfad_debugfs.c
++++ b/drivers/scsi/bfa/bfad_debugfs.c
+@@ -254,7 +254,8 @@ bfad_debugfs_write_regrd(struct file *file, const char __user *buf,
+ 	struct bfad_s *bfad = port->bfad;
+ 	struct bfa_s *bfa = &bfad->bfa;
+ 	struct bfa_ioc_s *ioc = &bfa->ioc;
+-	int addr, len, rc, i;
++	int addr, rc, i;
++	u32 len;
+ 	u32 *regbuf;
+ 	void __iomem *rb, *reg_addr;
+ 	unsigned long flags;
+@@ -265,7 +266,7 @@ bfad_debugfs_write_regrd(struct file *file, const char __user *buf,
+ 		return PTR_ERR(kern_buf);
+ 
+ 	rc = sscanf(kern_buf, "%x:%x", &addr, &len);
+-	if (rc < 2) {
++	if (rc < 2 || len > (UINT_MAX >> 2)) {
+ 		printk(KERN_INFO
+ 			"bfad[%d]: %s failed to read user buf\n",
+ 			bfad->inst_no, __func__);
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index e9ce74afd13f..0c87f341fed4 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -3466,7 +3466,7 @@ exit_failed:
+  *  # (integer code indicating one of several NOT READY states
+  *     describing why a volume is to be kept offline)
+  */
+-static int hpsa_volume_offline(struct ctlr_info *h,
++static unsigned char hpsa_volume_offline(struct ctlr_info *h,
+ 					unsigned char scsi3addr[])
+ {
+ 	struct CommandList *c;
+@@ -3486,7 +3486,7 @@ static int hpsa_volume_offline(struct ctlr_info *h,
+ 	rc = hpsa_scsi_do_simple_cmd(h, c, DEFAULT_REPLY_QUEUE, NO_TIMEOUT);
+ 	if (rc) {
+ 		cmd_free(h, c);
+-		return 0;
++		return HPSA_VPD_LV_STATUS_UNSUPPORTED;
+ 	}
+ 	sense = c->err_info->SenseInfo;
+ 	if (c->err_info->SenseLen > sizeof(c->err_info->SenseInfo))
+@@ -3497,19 +3497,13 @@ static int hpsa_volume_offline(struct ctlr_info *h,
+ 	cmd_status = c->err_info->CommandStatus;
+ 	scsi_status = c->err_info->ScsiStatus;
+ 	cmd_free(h, c);
+-	/* Is the volume 'not ready'? */
+-	if (cmd_status != CMD_TARGET_STATUS ||
+-		scsi_status != SAM_STAT_CHECK_CONDITION ||
+-		sense_key != NOT_READY ||
+-		asc != ASC_LUN_NOT_READY)  {
+-		return 0;
+-	}
+ 
+ 	/* Determine the reason for not ready state */
+ 	ldstat = hpsa_get_volume_status(h, scsi3addr);
+ 
+ 	/* Keep volume offline in certain cases: */
+ 	switch (ldstat) {
++	case HPSA_LV_FAILED:
+ 	case HPSA_LV_UNDERGOING_ERASE:
+ 	case HPSA_LV_NOT_AVAILABLE:
+ 	case HPSA_LV_UNDERGOING_RPI:
+@@ -3531,7 +3525,7 @@ static int hpsa_volume_offline(struct ctlr_info *h,
+ 	default:
+ 		break;
+ 	}
+-	return 0;
++	return HPSA_LV_OK;
+ }
+ 
+ /*
+@@ -3615,10 +3609,10 @@ static int hpsa_update_device_info(struct ctlr_info *h,
+ 	/* Do an inquiry to the device to see what it is. */
+ 	if (hpsa_scsi_do_inquiry(h, scsi3addr, 0, inq_buff,
+ 		(unsigned char) OBDR_TAPE_INQ_SIZE) != 0) {
+-		/* Inquiry failed (msg printed already) */
+ 		dev_err(&h->pdev->dev,
+-			"hpsa_update_device_info: inquiry failed\n");
+-		rc = -EIO;
++			"%s: inquiry failed, device will be skipped.\n",
++			__func__);
++		rc = HPSA_INQUIRY_FAILED;
+ 		goto bail_out;
+ 	}
+ 
+@@ -3638,15 +3632,19 @@ static int hpsa_update_device_info(struct ctlr_info *h,
+ 
+ 	if (this_device->devtype == TYPE_DISK &&
+ 		is_logical_dev_addr_mode(scsi3addr)) {
+-		int volume_offline;
++		unsigned char volume_offline;
+ 
+ 		hpsa_get_raid_level(h, scsi3addr, &this_device->raid_level);
+ 		if (h->fw_support & MISC_FW_RAID_OFFLOAD_BASIC)
+ 			hpsa_get_ioaccel_status(h, scsi3addr, this_device);
+ 		volume_offline = hpsa_volume_offline(h, scsi3addr);
+-		if (volume_offline < 0 || volume_offline > 0xff)
+-			volume_offline = HPSA_VPD_LV_STATUS_UNSUPPORTED;
+-		this_device->volume_offline = volume_offline & 0xff;
++		if (volume_offline == HPSA_LV_FAILED) {
++			rc = HPSA_LV_FAILED;
++			dev_err(&h->pdev->dev,
++				"%s: LV failed, device will be skipped.\n",
++				__func__);
++			goto bail_out;
++		}
+ 	} else {
+ 		this_device->raid_level = RAID_UNKNOWN;
+ 		this_device->offload_config = 0;
+@@ -4115,8 +4113,7 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h)
+ 			goto out;
+ 		}
+ 		if (rc) {
+-			dev_warn(&h->pdev->dev,
+-				"Inquiry failed, skipping device.\n");
++			h->drv_req_rescan = 1;
+ 			continue;
+ 		}
+ 
+@@ -5257,7 +5254,7 @@ static void hpsa_scan_complete(struct ctlr_info *h)
+ 
+ 	spin_lock_irqsave(&h->scan_lock, flags);
+ 	h->scan_finished = 1;
+-	wake_up_all(&h->scan_wait_queue);
++	wake_up(&h->scan_wait_queue);
+ 	spin_unlock_irqrestore(&h->scan_lock, flags);
+ }
+ 
+@@ -5275,11 +5272,23 @@ static void hpsa_scan_start(struct Scsi_Host *sh)
+ 	if (unlikely(lockup_detected(h)))
+ 		return hpsa_scan_complete(h);
+ 
++	/*
++	 * If a scan is already waiting to run, no need to add another
++	 */
++	spin_lock_irqsave(&h->scan_lock, flags);
++	if (h->scan_waiting) {
++		spin_unlock_irqrestore(&h->scan_lock, flags);
++		return;
++	}
++
++	spin_unlock_irqrestore(&h->scan_lock, flags);
++
+ 	/* wait until any scan already in progress is finished. */
+ 	while (1) {
+ 		spin_lock_irqsave(&h->scan_lock, flags);
+ 		if (h->scan_finished)
+ 			break;
++		h->scan_waiting = 1;
+ 		spin_unlock_irqrestore(&h->scan_lock, flags);
+ 		wait_event(h->scan_wait_queue, h->scan_finished);
+ 		/* Note: We don't need to worry about a race between this
+@@ -5289,6 +5298,7 @@ static void hpsa_scan_start(struct Scsi_Host *sh)
+ 		 */
+ 	}
+ 	h->scan_finished = 0; /* mark scan as in progress */
++	h->scan_waiting = 0;
+ 	spin_unlock_irqrestore(&h->scan_lock, flags);
+ 
+ 	if (unlikely(lockup_detected(h)))
+@@ -8505,6 +8515,7 @@ reinit_after_soft_reset:
+ 	init_waitqueue_head(&h->event_sync_wait_queue);
+ 	mutex_init(&h->reset_mutex);
+ 	h->scan_finished = 1; /* no scan currently in progress */
++	h->scan_waiting = 0;
+ 
+ 	pci_set_drvdata(pdev, h);
+ 	h->ndevices = 0;
+@@ -8797,6 +8808,8 @@ static void hpsa_remove_one(struct pci_dev *pdev)
+ 	destroy_workqueue(h->rescan_ctlr_wq);
+ 	destroy_workqueue(h->resubmit_wq);
+ 
++	hpsa_delete_sas_host(h);
++
+ 	/*
+ 	 * Call before disabling interrupts.
+ 	 * scsi_remove_host can trigger I/O operations especially
+@@ -8831,8 +8844,6 @@ static void hpsa_remove_one(struct pci_dev *pdev)
+ 	h->lockup_detected = NULL;			/* init_one 2 */
+ 	/* (void) pci_disable_pcie_error_reporting(pdev); */	/* init_one 1 */
+ 
+-	hpsa_delete_sas_host(h);
+-
+ 	kfree(h);					/* init_one 1 */
+ }
+ 
+@@ -9324,9 +9335,9 @@ static void hpsa_free_sas_phy(struct hpsa_sas_phy *hpsa_sas_phy)
+ 	struct sas_phy *phy = hpsa_sas_phy->phy;
+ 
+ 	sas_port_delete_phy(hpsa_sas_phy->parent_port->port, phy);
+-	sas_phy_free(phy);
+ 	if (hpsa_sas_phy->added_to_port)
+ 		list_del(&hpsa_sas_phy->phy_list_entry);
++	sas_phy_delete(phy);
+ 	kfree(hpsa_sas_phy);
+ }
+ 
+diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
+index ae5beda1bdb5..0e602750487a 100644
+--- a/drivers/scsi/hpsa.h
++++ b/drivers/scsi/hpsa.h
+@@ -200,6 +200,7 @@ struct ctlr_info {
+ 	dma_addr_t		errinfo_pool_dhandle;
+ 	unsigned long  		*cmd_pool_bits;
+ 	int			scan_finished;
++	u8			scan_waiting : 1;
+ 	spinlock_t		scan_lock;
+ 	wait_queue_head_t	scan_wait_queue;
+ 
+diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h
+index d92ef0d352b5..26488e2a7f02 100644
+--- a/drivers/scsi/hpsa_cmd.h
++++ b/drivers/scsi/hpsa_cmd.h
+@@ -155,6 +155,7 @@
+ #define CFGTBL_BusType_Fibre2G  0x00000200l
+ 
+ /* VPD Inquiry types */
++#define HPSA_INQUIRY_FAILED		0x02
+ #define HPSA_VPD_SUPPORTED_PAGES        0x00
+ #define HPSA_VPD_LV_DEVICE_GEOMETRY     0xC1
+ #define HPSA_VPD_LV_IOACCEL_STATUS      0xC2
+@@ -164,6 +165,7 @@
+ /* Logical volume states */
+ #define HPSA_VPD_LV_STATUS_UNSUPPORTED			0xff
+ #define HPSA_LV_OK                                      0x0
++#define HPSA_LV_FAILED					0x01
+ #define HPSA_LV_NOT_AVAILABLE				0x0b
+ #define HPSA_LV_UNDERGOING_ERASE			0x0F
+ #define HPSA_LV_UNDERGOING_RPI				0x12
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index 11cdb172cfaf..60720e5b1ebc 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -160,7 +160,7 @@ static struct {
+ 	{"DGC", "RAID", NULL, BLIST_SPARSELUN},	/* Dell PV 650F, storage on LUN 0 */
+ 	{"DGC", "DISK", NULL, BLIST_SPARSELUN},	/* Dell PV 650F, no storage on LUN 0 */
+ 	{"EMC",  "Invista", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
+-	{"EMC", "SYMMETRIX", NULL, BLIST_SPARSELUN | BLIST_LARGELUN | BLIST_FORCELUN},
++	{"EMC", "SYMMETRIX", NULL, BLIST_SPARSELUN | BLIST_LARGELUN | BLIST_REPORTLUN2},
+ 	{"EMULEX", "MD21/S2     ESDI", NULL, BLIST_SINGLELUN},
+ 	{"easyRAID", "16P", NULL, BLIST_NOREPORTLUN},
+ 	{"easyRAID", "X6P", NULL, BLIST_NOREPORTLUN},
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 7e1681cf287c..dd72205ba298 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -233,11 +233,15 @@ manage_start_stop_store(struct device *dev, struct device_attribute *attr,
+ {
+ 	struct scsi_disk *sdkp = to_scsi_disk(dev);
+ 	struct scsi_device *sdp = sdkp->device;
++	bool v;
+ 
+ 	if (!capable(CAP_SYS_ADMIN))
+ 		return -EACCES;
+ 
+-	sdp->manage_start_stop = simple_strtoul(buf, NULL, 10);
++	if (kstrtobool(buf, &v))
++		return -EINVAL;
++
++	sdp->manage_start_stop = v;
+ 
+ 	return count;
+ }
+@@ -255,6 +259,7 @@ static ssize_t
+ allow_restart_store(struct device *dev, struct device_attribute *attr,
+ 		    const char *buf, size_t count)
+ {
++	bool v;
+ 	struct scsi_disk *sdkp = to_scsi_disk(dev);
+ 	struct scsi_device *sdp = sdkp->device;
+ 
+@@ -264,7 +269,10 @@ allow_restart_store(struct device *dev, struct device_attribute *attr,
+ 	if (sdp->type != TYPE_DISK)
+ 		return -EINVAL;
+ 
+-	sdp->allow_restart = simple_strtoul(buf, NULL, 10);
++	if (kstrtobool(buf, &v))
++		return -EINVAL;
++
++	sdp->allow_restart = v;
+ 
+ 	return count;
+ }
+diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
+index fefbf826c622..8fd8f3a2d1bf 100644
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -1693,10 +1693,11 @@ static int vt6655_suspend(struct pci_dev *pcid, pm_message_t state)
+ 	MACbShutdown(priv->PortOffset);
+ 
+ 	pci_disable_device(pcid);
+-	pci_set_power_state(pcid, pci_choose_state(pcid, state));
+ 
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 
++	pci_set_power_state(pcid, pci_choose_state(pcid, state));
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index bb73401f5761..8a4092cd97ee 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -674,6 +674,7 @@ static int iscsit_add_reject_from_cmd(
+ 	unsigned char *buf)
+ {
+ 	struct iscsi_conn *conn;
++	const bool do_put = cmd->se_cmd.se_tfo != NULL;
+ 
+ 	if (!cmd->conn) {
+ 		pr_err("cmd->conn is NULL for ITT: 0x%08x\n",
+@@ -704,7 +705,7 @@ static int iscsit_add_reject_from_cmd(
+ 	 * Perform the kref_put now if se_cmd has already been setup by
+ 	 * scsit_setup_scsi_cmd()
+ 	 */
+-	if (cmd->se_cmd.se_tfo != NULL) {
++	if (do_put) {
+ 		pr_debug("iscsi reject: calling target_put_sess_cmd >>>>>>\n");
+ 		target_put_sess_cmd(&cmd->se_cmd);
+ 	}
+diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
+index 634ad3662ed6..8c49bc3dcc8c 100644
+--- a/drivers/target/iscsi/iscsi_target_configfs.c
++++ b/drivers/target/iscsi/iscsi_target_configfs.c
+@@ -1210,7 +1210,7 @@ static struct se_portal_group *lio_target_tiqn_addtpg(
+ 
+ 	ret = core_tpg_register(wwn, &tpg->tpg_se_tpg, SCSI_PROTOCOL_ISCSI);
+ 	if (ret < 0)
+-		return NULL;
++		goto free_out;
+ 
+ 	ret = iscsit_tpg_add_portal_group(tiqn, tpg);
+ 	if (ret != 0)
+@@ -1222,6 +1222,7 @@ static struct se_portal_group *lio_target_tiqn_addtpg(
+ 	return &tpg->tpg_se_tpg;
+ out:
+ 	core_tpg_deregister(&tpg->tpg_se_tpg);
++free_out:
+ 	kfree(tpg);
+ 	return NULL;
+ }
+diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
+index 49aba4a31747..1fe782f9ee81 100644
+--- a/drivers/target/target_core_alua.c
++++ b/drivers/target/target_core_alua.c
+@@ -1010,7 +1010,7 @@ static void core_alua_queue_state_change_ua(struct t10_alua_tg_pt_gp *tg_pt_gp)
+ static void core_alua_do_transition_tg_pt_work(struct work_struct *work)
+ {
+ 	struct t10_alua_tg_pt_gp *tg_pt_gp = container_of(work,
+-		struct t10_alua_tg_pt_gp, tg_pt_gp_transition_work.work);
++		struct t10_alua_tg_pt_gp, tg_pt_gp_transition_work);
+ 	struct se_device *dev = tg_pt_gp->tg_pt_gp_dev;
+ 	bool explicit = (tg_pt_gp->tg_pt_gp_alua_access_status ==
+ 			 ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG);
+@@ -1073,17 +1073,8 @@ static int core_alua_do_transition_tg_pt(
+ 	/*
+ 	 * Flush any pending transitions
+ 	 */
+-	if (!explicit && tg_pt_gp->tg_pt_gp_implicit_trans_secs &&
+-	    atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state) ==
+-	    ALUA_ACCESS_STATE_TRANSITION) {
+-		/* Just in case */
+-		tg_pt_gp->tg_pt_gp_alua_pending_state = new_state;
+-		tg_pt_gp->tg_pt_gp_transition_complete = &wait;
+-		flush_delayed_work(&tg_pt_gp->tg_pt_gp_transition_work);
+-		wait_for_completion(&wait);
+-		tg_pt_gp->tg_pt_gp_transition_complete = NULL;
+-		return 0;
+-	}
++	if (!explicit)
++		flush_work(&tg_pt_gp->tg_pt_gp_transition_work);
+ 
+ 	/*
+ 	 * Save the old primary ALUA access state, and set the current state
+@@ -1114,17 +1105,9 @@ static int core_alua_do_transition_tg_pt(
+ 	atomic_inc(&tg_pt_gp->tg_pt_gp_ref_cnt);
+ 	spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
+ 
+-	if (!explicit && tg_pt_gp->tg_pt_gp_implicit_trans_secs) {
+-		unsigned long transition_tmo;
+-
+-		transition_tmo = tg_pt_gp->tg_pt_gp_implicit_trans_secs * HZ;
+-		queue_delayed_work(tg_pt_gp->tg_pt_gp_dev->tmr_wq,
+-				   &tg_pt_gp->tg_pt_gp_transition_work,
+-				   transition_tmo);
+-	} else {
++	schedule_work(&tg_pt_gp->tg_pt_gp_transition_work);
++	if (explicit) {
+ 		tg_pt_gp->tg_pt_gp_transition_complete = &wait;
+-		queue_delayed_work(tg_pt_gp->tg_pt_gp_dev->tmr_wq,
+-				   &tg_pt_gp->tg_pt_gp_transition_work, 0);
+ 		wait_for_completion(&wait);
+ 		tg_pt_gp->tg_pt_gp_transition_complete = NULL;
+ 	}
+@@ -1692,8 +1675,8 @@ struct t10_alua_tg_pt_gp *core_alua_allocate_tg_pt_gp(struct se_device *dev,
+ 	mutex_init(&tg_pt_gp->tg_pt_gp_md_mutex);
+ 	spin_lock_init(&tg_pt_gp->tg_pt_gp_lock);
+ 	atomic_set(&tg_pt_gp->tg_pt_gp_ref_cnt, 0);
+-	INIT_DELAYED_WORK(&tg_pt_gp->tg_pt_gp_transition_work,
+-			  core_alua_do_transition_tg_pt_work);
++	INIT_WORK(&tg_pt_gp->tg_pt_gp_transition_work,
++		  core_alua_do_transition_tg_pt_work);
+ 	tg_pt_gp->tg_pt_gp_dev = dev;
+ 	atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state,
+ 		ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED);
+@@ -1801,7 +1784,7 @@ void core_alua_free_tg_pt_gp(
+ 	dev->t10_alua.alua_tg_pt_gps_counter--;
+ 	spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
+ 
+-	flush_delayed_work(&tg_pt_gp->tg_pt_gp_transition_work);
++	flush_work(&tg_pt_gp->tg_pt_gp_transition_work);
+ 
+ 	/*
+ 	 * Allow a struct t10_alua_tg_pt_gp_member * referenced by
+diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
+index 041a56987845..2e35db7f4aac 100644
+--- a/drivers/target/target_core_file.c
++++ b/drivers/target/target_core_file.c
+@@ -466,6 +466,10 @@ fd_execute_unmap(struct se_cmd *cmd, sector_t lba, sector_t nolb)
+ 	struct inode *inode = file->f_mapping->host;
+ 	int ret;
+ 
++	if (!nolb) {
++		return 0;
++	}
++
+ 	if (cmd->se_dev->dev_attrib.pi_prot_type) {
+ 		ret = fd_do_prot_unmap(cmd, lba, nolb);
+ 		if (ret)
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index e7933115087a..e38b4582d43e 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -56,8 +56,10 @@ void core_pr_dump_initiator_port(
+ 	char *buf,
+ 	u32 size)
+ {
+-	if (!pr_reg->isid_present_at_reg)
++	if (!pr_reg->isid_present_at_reg) {
+ 		buf[0] = '\0';
++		return;
++	}
+ 
+ 	snprintf(buf, size, ",i,0x%s", pr_reg->pr_reg_isid);
+ }
+diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c
+index ea9366ad3e6b..7814d18e8940 100644
+--- a/drivers/thermal/step_wise.c
++++ b/drivers/thermal/step_wise.c
+@@ -31,8 +31,7 @@
+  * If the temperature is higher than a trip point,
+  *    a. if the trend is THERMAL_TREND_RAISING, use higher cooling
+  *       state for this trip point
+- *    b. if the trend is THERMAL_TREND_DROPPING, use lower cooling
+- *       state for this trip point
++ *    b. if the trend is THERMAL_TREND_DROPPING, do nothing
+  *    c. if the trend is THERMAL_TREND_RAISE_FULL, use upper limit
+  *       for this trip point
+  *    d. if the trend is THERMAL_TREND_DROP_FULL, use lower limit
+@@ -94,9 +93,11 @@ static unsigned long get_target_state(struct thermal_instance *instance,
+ 			if (!throttle)
+ 				next_target = THERMAL_NO_TARGET;
+ 		} else {
+-			next_target = cur_state - 1;
+-			if (next_target > instance->upper)
+-				next_target = instance->upper;
++			if (!throttle) {
++				next_target = cur_state - 1;
++				if (next_target > instance->upper)
++					next_target = instance->upper;
++			}
+ 		}
+ 		break;
+ 	case THERMAL_TREND_DROP_FULL:
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index b1ece1f618c8..f6fde903fcad 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -521,6 +521,9 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
+ 	unsigned iad_num = 0;
+ 
+ 	memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
++	nintf = nintf_orig = config->desc.bNumInterfaces;
++	config->desc.bNumInterfaces = 0;	// Adjusted later
++
+ 	if (config->desc.bDescriptorType != USB_DT_CONFIG ||
+ 	    config->desc.bLength < USB_DT_CONFIG_SIZE ||
+ 	    config->desc.bLength > size) {
+@@ -534,7 +537,6 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
+ 	buffer += config->desc.bLength;
+ 	size -= config->desc.bLength;
+ 
+-	nintf = nintf_orig = config->desc.bNumInterfaces;
+ 	if (nintf > USB_MAXINTERFACES) {
+ 		dev_warn(ddev, "config %d has too many interfaces: %d, "
+ 		    "using maximum allowed: %d\n",
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 6a07570a90e6..f7481c4e2bc9 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1017,10 +1017,9 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
+ 		return 0;
+ 	}
+ 
+-	xhci->devs[slot_id] = kzalloc(sizeof(*xhci->devs[slot_id]), flags);
+-	if (!xhci->devs[slot_id])
++	dev = kzalloc(sizeof(*dev), flags);
++	if (!dev)
+ 		return 0;
+-	dev = xhci->devs[slot_id];
+ 
+ 	/* Allocate the (output) device context that will be used in the HC. */
+ 	dev->out_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_DEVICE, flags);
+@@ -1068,9 +1067,17 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
+ 		 &xhci->dcbaa->dev_context_ptrs[slot_id],
+ 		 le64_to_cpu(xhci->dcbaa->dev_context_ptrs[slot_id]));
+ 
++	xhci->devs[slot_id] = dev;
++
+ 	return 1;
+ fail:
+-	xhci_free_virt_device(xhci, slot_id);
++
++	if (dev->in_ctx)
++		xhci_free_container_ctx(xhci, dev->in_ctx);
++	if (dev->out_ctx)
++		xhci_free_container_ctx(xhci, dev->out_ctx);
++	kfree(dev);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c
+index 9a9c82a4d35d..d6a8e325950c 100644
+--- a/drivers/usb/musb/da8xx.c
++++ b/drivers/usb/musb/da8xx.c
+@@ -350,7 +350,15 @@ static irqreturn_t da8xx_musb_interrupt(int irq, void *hci)
+ 			musb->xceiv->otg->state = OTG_STATE_A_WAIT_VRISE;
+ 			portstate(musb->port1_status |= USB_PORT_STAT_POWER);
+ 			del_timer(&otg_workaround);
+-		} else {
++		} else if (!(musb->int_usb & MUSB_INTR_BABBLE)){
++			/*
++			 * When babble condition happens, drvvbus interrupt
++			 * is also generated. Ignore this drvvbus interrupt
++			 * and let babble interrupt handler recovers the
++			 * controller; otherwise, the host-mode flag is lost
++			 * due to the MUSB_DEV_MODE() call below and babble
++			 * recovery logic will not called.
++			 */
+ 			musb->is_active = 0;
+ 			MUSB_DEV_MODE(musb);
+ 			otg->default_a = 0;
+diff --git a/drivers/usb/phy/phy-isp1301.c b/drivers/usb/phy/phy-isp1301.c
+index db68156568e6..b3b33cf7ddf6 100644
+--- a/drivers/usb/phy/phy-isp1301.c
++++ b/drivers/usb/phy/phy-isp1301.c
+@@ -33,6 +33,12 @@ static const struct i2c_device_id isp1301_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, isp1301_id);
+ 
++static const struct of_device_id isp1301_of_match[] = {
++	{.compatible = "nxp,isp1301" },
++	{ },
++};
++MODULE_DEVICE_TABLE(of, isp1301_of_match);
++
+ static struct i2c_client *isp1301_i2c_client;
+ 
+ static int __isp1301_write(struct isp1301 *isp, u8 reg, u8 value, u8 clear)
+@@ -130,6 +136,7 @@ static int isp1301_remove(struct i2c_client *client)
+ static struct i2c_driver isp1301_driver = {
+ 	.driver = {
+ 		.name = DRV_NAME,
++		.of_match_table = of_match_ptr(isp1301_of_match),
+ 	},
+ 	.probe = isp1301_probe,
+ 	.remove = isp1301_remove,
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index fb96755550ec..c10eceb76c39 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2149,6 +2149,13 @@ UNUSUAL_DEV(0x152d, 0x9561, 0x0000, 0x9999,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_NO_REPORT_OPCODES),
+ 
++/* Reported by David Kozub <zub@linux.fjfi.cvut.cz> */
++UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
++		"JMicron",
++		"JMS567",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_BROKEN_FUA),
++
+ /*
+  * Patch by Constantin Baranov <const@tltsu.ru>
+  * Report by Andreas Koenecke.
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index a37ed1e59e99..2f80163ffb94 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -141,6 +141,13 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_BROKEN_FUA | US_FL_NO_REPORT_OPCODES),
+ 
++/* Reported-by: David Kozub <zub@linux.fjfi.cvut.cz> */
++UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
++		"JMicron",
++		"JMS567",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_BROKEN_FUA),
++
+ /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+ UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
+ 		"VIA",
+diff --git a/drivers/usb/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c
+index 021003c4de53..af858d52608a 100644
+--- a/drivers/usb/usbip/stub_tx.c
++++ b/drivers/usb/usbip/stub_tx.c
+@@ -178,6 +178,13 @@ static int stub_send_ret_submit(struct stub_device *sdev)
+ 		memset(&pdu_header, 0, sizeof(pdu_header));
+ 		memset(&msg, 0, sizeof(msg));
+ 
++		if (urb->actual_length > 0 && !urb->transfer_buffer) {
++			dev_err(&sdev->udev->dev,
++				"urb: actual_length %d transfer_buffer null\n",
++				urb->actual_length);
++			return -1;
++		}
++
+ 		if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
+ 			iovnum = 2 + urb->number_of_packets;
+ 		else
+diff --git a/drivers/video/fbdev/au1200fb.c b/drivers/video/fbdev/au1200fb.c
+index f9507b1894df..789d3f16ff9f 100644
+--- a/drivers/video/fbdev/au1200fb.c
++++ b/drivers/video/fbdev/au1200fb.c
+@@ -1680,8 +1680,10 @@ static int au1200fb_drv_probe(struct platform_device *dev)
+ 
+ 		fbi = framebuffer_alloc(sizeof(struct au1200fb_device),
+ 					&dev->dev);
+-		if (!fbi)
++		if (!fbi) {
++			ret = -ENOMEM;
+ 			goto failed;
++		}
+ 
+ 		_au1200fb_infos[plane] = fbi;
+ 		fbdev = fbi->par;
+@@ -1699,7 +1701,8 @@ static int au1200fb_drv_probe(struct platform_device *dev)
+ 		if (!fbdev->fb_mem) {
+ 			print_err("fail to allocate frambuffer (size: %dK))",
+ 				  fbdev->fb_len / 1024);
+-			return -ENOMEM;
++			ret = -ENOMEM;
++			goto failed;
+ 		}
+ 
+ 		/*
+diff --git a/drivers/video/fbdev/controlfb.h b/drivers/video/fbdev/controlfb.h
+index 6026c60fc100..261522fabdac 100644
+--- a/drivers/video/fbdev/controlfb.h
++++ b/drivers/video/fbdev/controlfb.h
+@@ -141,5 +141,7 @@ static struct max_cmodes control_mac_modes[] = {
+ 	{{ 1, 2}},	/* 1152x870, 75Hz */
+ 	{{ 0, 1}},	/* 1280x960, 75Hz */
+ 	{{ 0, 1}},	/* 1280x1024, 75Hz */
++	{{ 1, 2}},	/* 1152x768, 60Hz */
++	{{ 0, 1}},	/* 1600x1024, 60Hz */
+ };
+ 
+diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
+index e9c2f7ba3c8e..53326badfb61 100644
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -769,11 +769,11 @@ static int dlfb_get_edid(struct dlfb_data *dev, char *edid, int len)
+ 
+ 	for (i = 0; i < len; i++) {
+ 		ret = usb_control_msg(dev->udev,
+-				    usb_rcvctrlpipe(dev->udev, 0), (0x02),
+-				    (0x80 | (0x02 << 5)), i << 8, 0xA1, rbuf, 2,
+-				    HZ);
+-		if (ret < 1) {
+-			pr_err("Read EDID byte %d failed err %x\n", i, ret);
++				      usb_rcvctrlpipe(dev->udev, 0), 0x02,
++				      (0x80 | (0x02 << 5)), i << 8, 0xA1,
++				      rbuf, 2, USB_CTRL_GET_TIMEOUT);
++		if (ret < 2) {
++			pr_err("Read EDID byte %d failed: %d\n", i, ret);
+ 			i--;
+ 			break;
+ 		}
+diff --git a/fs/afs/callback.c b/fs/afs/callback.c
+index 7ef637d7f3a5..7d54efd73519 100644
+--- a/fs/afs/callback.c
++++ b/fs/afs/callback.c
+@@ -362,7 +362,7 @@ static void afs_callback_updater(struct work_struct *work)
+ {
+ 	struct afs_server *server;
+ 	struct afs_vnode *vnode, *xvnode;
+-	time_t now;
++	time64_t now;
+ 	long timeout;
+ 	int ret;
+ 
+@@ -370,7 +370,7 @@ static void afs_callback_updater(struct work_struct *work)
+ 
+ 	_enter("");
+ 
+-	now = get_seconds();
++	now = ktime_get_real_seconds();
+ 
+ 	/* find the first vnode to update */
+ 	spin_lock(&server->cb_lock);
+@@ -424,7 +424,8 @@ static void afs_callback_updater(struct work_struct *work)
+ 
+ 	/* and then reschedule */
+ 	_debug("reschedule");
+-	vnode->update_at = get_seconds() + afs_vnode_update_timeout;
++	vnode->update_at = ktime_get_real_seconds() +
++			afs_vnode_update_timeout;
+ 
+ 	spin_lock(&server->cb_lock);
+ 
+diff --git a/fs/afs/file.c b/fs/afs/file.c
+index 999bc3caec92..cf8a07e282a6 100644
+--- a/fs/afs/file.c
++++ b/fs/afs/file.c
+@@ -29,6 +29,7 @@ static int afs_readpages(struct file *filp, struct address_space *mapping,
+ 
+ const struct file_operations afs_file_operations = {
+ 	.open		= afs_open,
++	.flush		= afs_flush,
+ 	.release	= afs_release,
+ 	.llseek		= generic_file_llseek,
+ 	.read_iter	= generic_file_read_iter,
+diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
+index c2e930ec2888..10ce44214005 100644
+--- a/fs/afs/fsclient.c
++++ b/fs/afs/fsclient.c
+@@ -105,7 +105,7 @@ static void xdr_decode_AFSFetchStatus(const __be32 **_bp,
+ 			vnode->vfs_inode.i_mode = mode;
+ 		}
+ 
+-		vnode->vfs_inode.i_ctime.tv_sec	= status->mtime_server;
++		vnode->vfs_inode.i_ctime.tv_sec	= status->mtime_client;
+ 		vnode->vfs_inode.i_mtime	= vnode->vfs_inode.i_ctime;
+ 		vnode->vfs_inode.i_atime	= vnode->vfs_inode.i_ctime;
+ 		vnode->vfs_inode.i_version	= data_version;
+@@ -139,7 +139,7 @@ static void xdr_decode_AFSCallBack(const __be32 **_bp, struct afs_vnode *vnode)
+ 	vnode->cb_version	= ntohl(*bp++);
+ 	vnode->cb_expiry	= ntohl(*bp++);
+ 	vnode->cb_type		= ntohl(*bp++);
+-	vnode->cb_expires	= vnode->cb_expiry + get_seconds();
++	vnode->cb_expires	= vnode->cb_expiry + ktime_get_real_seconds();
+ 	*_bp = bp;
+ }
+ 
+@@ -703,8 +703,8 @@ int afs_fs_create(struct afs_server *server,
+ 		memset(bp, 0, padsz);
+ 		bp = (void *) bp + padsz;
+ 	}
+-	*bp++ = htonl(AFS_SET_MODE);
+-	*bp++ = 0; /* mtime */
++	*bp++ = htonl(AFS_SET_MODE | AFS_SET_MTIME);
++	*bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */
+ 	*bp++ = 0; /* owner */
+ 	*bp++ = 0; /* group */
+ 	*bp++ = htonl(mode & S_IALLUGO); /* unix mode */
+@@ -981,8 +981,8 @@ int afs_fs_symlink(struct afs_server *server,
+ 		memset(bp, 0, c_padsz);
+ 		bp = (void *) bp + c_padsz;
+ 	}
+-	*bp++ = htonl(AFS_SET_MODE);
+-	*bp++ = 0; /* mtime */
++	*bp++ = htonl(AFS_SET_MODE | AFS_SET_MTIME);
++	*bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */
+ 	*bp++ = 0; /* owner */
+ 	*bp++ = 0; /* group */
+ 	*bp++ = htonl(S_IRWXUGO); /* unix mode */
+@@ -1192,8 +1192,8 @@ static int afs_fs_store_data64(struct afs_server *server,
+ 	*bp++ = htonl(vnode->fid.vnode);
+ 	*bp++ = htonl(vnode->fid.unique);
+ 
+-	*bp++ = 0; /* mask */
+-	*bp++ = 0; /* mtime */
++	*bp++ = htonl(AFS_SET_MTIME); /* mask */
++	*bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */
+ 	*bp++ = 0; /* owner */
+ 	*bp++ = 0; /* group */
+ 	*bp++ = 0; /* unix mode */
+@@ -1225,7 +1225,7 @@ int afs_fs_store_data(struct afs_server *server, struct afs_writeback *wb,
+ 	_enter(",%x,{%x:%u},,",
+ 	       key_serial(wb->key), vnode->fid.vid, vnode->fid.vnode);
+ 
+-	size = to - offset;
++	size = (loff_t)to - (loff_t)offset;
+ 	if (first != last)
+ 		size += (loff_t)(last - first) << PAGE_SHIFT;
+ 	pos = (loff_t)first << PAGE_SHIFT;
+@@ -1269,8 +1269,8 @@ int afs_fs_store_data(struct afs_server *server, struct afs_writeback *wb,
+ 	*bp++ = htonl(vnode->fid.vnode);
+ 	*bp++ = htonl(vnode->fid.unique);
+ 
+-	*bp++ = 0; /* mask */
+-	*bp++ = 0; /* mtime */
++	*bp++ = htonl(AFS_SET_MTIME); /* mask */
++	*bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */
+ 	*bp++ = 0; /* owner */
+ 	*bp++ = 0; /* group */
+ 	*bp++ = 0; /* unix mode */
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index e06f5a23352a..f8fa92b1d43c 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -69,9 +69,9 @@ static int afs_inode_map_status(struct afs_vnode *vnode, struct key *key)
+ 
+ 	set_nlink(inode, vnode->status.nlink);
+ 	inode->i_uid		= vnode->status.owner;
+-	inode->i_gid		= GLOBAL_ROOT_GID;
++	inode->i_gid            = vnode->status.group;
+ 	inode->i_size		= vnode->status.size;
+-	inode->i_ctime.tv_sec	= vnode->status.mtime_server;
++	inode->i_ctime.tv_sec	= vnode->status.mtime_client;
+ 	inode->i_ctime.tv_nsec	= 0;
+ 	inode->i_atime		= inode->i_mtime = inode->i_ctime;
+ 	inode->i_blocks		= 0;
+@@ -244,12 +244,13 @@ struct inode *afs_iget(struct super_block *sb, struct key *key,
+ 			vnode->cb_version = 0;
+ 			vnode->cb_expiry = 0;
+ 			vnode->cb_type = 0;
+-			vnode->cb_expires = get_seconds();
++			vnode->cb_expires = ktime_get_real_seconds();
+ 		} else {
+ 			vnode->cb_version = cb->version;
+ 			vnode->cb_expiry = cb->expiry;
+ 			vnode->cb_type = cb->type;
+-			vnode->cb_expires = vnode->cb_expiry + get_seconds();
++			vnode->cb_expires = vnode->cb_expiry +
++				ktime_get_real_seconds();
+ 		}
+ 	}
+ 
+@@ -322,7 +323,7 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
+ 	    !test_bit(AFS_VNODE_CB_BROKEN, &vnode->flags) &&
+ 	    !test_bit(AFS_VNODE_MODIFIED, &vnode->flags) &&
+ 	    !test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags)) {
+-		if (vnode->cb_expires < get_seconds() + 10) {
++		if (vnode->cb_expires < ktime_get_real_seconds() + 10) {
+ 			_debug("callback expired");
+ 			set_bit(AFS_VNODE_CB_BROKEN, &vnode->flags);
+ 		} else {
+diff --git a/fs/afs/internal.h b/fs/afs/internal.h
+index 71d5982312f3..1330b2a695ff 100644
+--- a/fs/afs/internal.h
++++ b/fs/afs/internal.h
+@@ -11,6 +11,7 @@
+ 
+ #include <linux/compiler.h>
+ #include <linux/kernel.h>
++#include <linux/ktime.h>
+ #include <linux/fs.h>
+ #include <linux/pagemap.h>
+ #include <linux/skbuff.h>
+@@ -247,7 +248,7 @@ struct afs_cache_vhash {
+  */
+ struct afs_vlocation {
+ 	atomic_t		usage;
+-	time_t			time_of_death;	/* time at which put reduced usage to 0 */
++	time64_t		time_of_death;	/* time at which put reduced usage to 0 */
+ 	struct list_head	link;		/* link in cell volume location list */
+ 	struct list_head	grave;		/* link in master graveyard list */
+ 	struct list_head	update;		/* link in master update list */
+@@ -258,7 +259,7 @@ struct afs_vlocation {
+ 	struct afs_cache_vlocation vldb;	/* volume information DB record */
+ 	struct afs_volume	*vols[3];	/* volume access record pointer (index by type) */
+ 	wait_queue_head_t	waitq;		/* status change waitqueue */
+-	time_t			update_at;	/* time at which record should be updated */
++	time64_t		update_at;	/* time at which record should be updated */
+ 	spinlock_t		lock;		/* access lock */
+ 	afs_vlocation_state_t	state;		/* volume location state */
+ 	unsigned short		upd_rej_cnt;	/* ENOMEDIUM count during update */
+@@ -271,7 +272,7 @@ struct afs_vlocation {
+  */
+ struct afs_server {
+ 	atomic_t		usage;
+-	time_t			time_of_death;	/* time at which put reduced usage to 0 */
++	time64_t		time_of_death;	/* time at which put reduced usage to 0 */
+ 	struct in_addr		addr;		/* server address */
+ 	struct afs_cell		*cell;		/* cell in which server resides */
+ 	struct list_head	link;		/* link in cell's server list */
+@@ -374,8 +375,8 @@ struct afs_vnode {
+ 	struct rb_node		server_rb;	/* link in server->fs_vnodes */
+ 	struct rb_node		cb_promise;	/* link in server->cb_promises */
+ 	struct work_struct	cb_broken_work;	/* work to be done on callback break */
+-	time_t			cb_expires;	/* time at which callback expires */
+-	time_t			cb_expires_at;	/* time used to order cb_promise */
++	time64_t		cb_expires;	/* time at which callback expires */
++	time64_t		cb_expires_at;	/* time used to order cb_promise */
+ 	unsigned		cb_version;	/* callback version */
+ 	unsigned		cb_expiry;	/* callback expiry time */
+ 	afs_callback_type_t	cb_type;	/* type of callback */
+@@ -749,6 +750,7 @@ extern int afs_writepages(struct address_space *, struct writeback_control *);
+ extern void afs_pages_written_back(struct afs_vnode *, struct afs_call *);
+ extern ssize_t afs_file_write(struct kiocb *, struct iov_iter *);
+ extern int afs_writeback_all(struct afs_vnode *);
++extern int afs_flush(struct file *, fl_owner_t);
+ extern int afs_fsync(struct file *, loff_t, loff_t, int);
+ 
+ 
+diff --git a/fs/afs/security.c b/fs/afs/security.c
+index 8d010422dc89..bfa9d3428383 100644
+--- a/fs/afs/security.c
++++ b/fs/afs/security.c
+@@ -340,17 +340,22 @@ int afs_permission(struct inode *inode, int mask)
+ 	} else {
+ 		if (!(access & AFS_ACE_LOOKUP))
+ 			goto permission_denied;
++		if ((mask & MAY_EXEC) && !(inode->i_mode & S_IXUSR))
++			goto permission_denied;
+ 		if (mask & (MAY_EXEC | MAY_READ)) {
+ 			if (!(access & AFS_ACE_READ))
+ 				goto permission_denied;
++			if (!(inode->i_mode & S_IRUSR))
++				goto permission_denied;
+ 		} else if (mask & MAY_WRITE) {
+ 			if (!(access & AFS_ACE_WRITE))
+ 				goto permission_denied;
++			if (!(inode->i_mode & S_IWUSR))
++				goto permission_denied;
+ 		}
+ 	}
+ 
+ 	key_put(key);
+-	ret = generic_permission(inode, mask);
+ 	_leave(" = %d", ret);
+ 	return ret;
+ 
+diff --git a/fs/afs/server.c b/fs/afs/server.c
+index f342acf3547d..3bc1a46f0bd6 100644
+--- a/fs/afs/server.c
++++ b/fs/afs/server.c
+@@ -237,7 +237,7 @@ void afs_put_server(struct afs_server *server)
+ 	spin_lock(&afs_server_graveyard_lock);
+ 	if (atomic_read(&server->usage) == 0) {
+ 		list_move_tail(&server->grave, &afs_server_graveyard);
+-		server->time_of_death = get_seconds();
++		server->time_of_death = ktime_get_real_seconds();
+ 		queue_delayed_work(afs_wq, &afs_server_reaper,
+ 				   afs_server_timeout * HZ);
+ 	}
+@@ -272,9 +272,9 @@ static void afs_reap_server(struct work_struct *work)
+ 	LIST_HEAD(corpses);
+ 	struct afs_server *server;
+ 	unsigned long delay, expiry;
+-	time_t now;
++	time64_t now;
+ 
+-	now = get_seconds();
++	now = ktime_get_real_seconds();
+ 	spin_lock(&afs_server_graveyard_lock);
+ 
+ 	while (!list_empty(&afs_server_graveyard)) {
+diff --git a/fs/afs/vlocation.c b/fs/afs/vlocation.c
+index 52976785a32c..ee9015c0db5a 100644
+--- a/fs/afs/vlocation.c
++++ b/fs/afs/vlocation.c
+@@ -340,7 +340,8 @@ static void afs_vlocation_queue_for_updates(struct afs_vlocation *vl)
+ 	struct afs_vlocation *xvl;
+ 
+ 	/* wait at least 10 minutes before updating... */
+-	vl->update_at = get_seconds() + afs_vlocation_update_timeout;
++	vl->update_at = ktime_get_real_seconds() +
++			afs_vlocation_update_timeout;
+ 
+ 	spin_lock(&afs_vlocation_updates_lock);
+ 
+@@ -506,7 +507,7 @@ void afs_put_vlocation(struct afs_vlocation *vl)
+ 	if (atomic_read(&vl->usage) == 0) {
+ 		_debug("buried");
+ 		list_move_tail(&vl->grave, &afs_vlocation_graveyard);
+-		vl->time_of_death = get_seconds();
++		vl->time_of_death = ktime_get_real_seconds();
+ 		queue_delayed_work(afs_wq, &afs_vlocation_reap,
+ 				   afs_vlocation_timeout * HZ);
+ 
+@@ -543,11 +544,11 @@ static void afs_vlocation_reaper(struct work_struct *work)
+ 	LIST_HEAD(corpses);
+ 	struct afs_vlocation *vl;
+ 	unsigned long delay, expiry;
+-	time_t now;
++	time64_t now;
+ 
+ 	_enter("");
+ 
+-	now = get_seconds();
++	now = ktime_get_real_seconds();
+ 	spin_lock(&afs_vlocation_graveyard_lock);
+ 
+ 	while (!list_empty(&afs_vlocation_graveyard)) {
+@@ -622,13 +623,13 @@ static void afs_vlocation_updater(struct work_struct *work)
+ {
+ 	struct afs_cache_vlocation vldb;
+ 	struct afs_vlocation *vl, *xvl;
+-	time_t now;
++	time64_t now;
+ 	long timeout;
+ 	int ret;
+ 
+ 	_enter("");
+ 
+-	now = get_seconds();
++	now = ktime_get_real_seconds();
+ 
+ 	/* find a record to update */
+ 	spin_lock(&afs_vlocation_updates_lock);
+@@ -684,7 +685,8 @@ static void afs_vlocation_updater(struct work_struct *work)
+ 
+ 	/* and then reschedule */
+ 	_debug("reschedule");
+-	vl->update_at = get_seconds() + afs_vlocation_update_timeout;
++	vl->update_at = ktime_get_real_seconds() +
++			afs_vlocation_update_timeout;
+ 
+ 	spin_lock(&afs_vlocation_updates_lock);
+ 
+diff --git a/fs/afs/write.c b/fs/afs/write.c
+index 0714abcd7f32..5cfc05ca184c 100644
+--- a/fs/afs/write.c
++++ b/fs/afs/write.c
+@@ -148,12 +148,12 @@ int afs_write_begin(struct file *file, struct address_space *mapping,
+ 		kfree(candidate);
+ 		return -ENOMEM;
+ 	}
+-	*pagep = page;
+-	/* page won't leak in error case: it eventually gets cleaned off LRU */
+ 
+ 	if (!PageUptodate(page) && len != PAGE_CACHE_SIZE) {
+ 		ret = afs_fill_page(vnode, key, index << PAGE_CACHE_SHIFT, page);
+ 		if (ret < 0) {
++			unlock_page(page);
++			put_page(page);
+ 			kfree(candidate);
+ 			_leave(" = %d [prep]", ret);
+ 			return ret;
+@@ -161,6 +161,9 @@ int afs_write_begin(struct file *file, struct address_space *mapping,
+ 		SetPageUptodate(page);
+ 	}
+ 
++	/* page won't leak in error case: it eventually gets cleaned off LRU */
++	*pagep = page;
++
+ try_again:
+ 	spin_lock(&vnode->writeback_lock);
+ 
+@@ -296,10 +299,14 @@ static void afs_kill_pages(struct afs_vnode *vnode, bool error,
+ 		ASSERTCMP(pv.nr, ==, count);
+ 
+ 		for (loop = 0; loop < count; loop++) {
+-			ClearPageUptodate(pv.pages[loop]);
++			struct page *page = pv.pages[loop];
++			ClearPageUptodate(page);
+ 			if (error)
+-				SetPageError(pv.pages[loop]);
+-			end_page_writeback(pv.pages[loop]);
++				SetPageError(page);
++			if (PageWriteback(page))
++				end_page_writeback(page);
++			if (page->index >= first)
++				first = page->index + 1;
+ 		}
+ 
+ 		__pagevec_release(&pv);
+@@ -503,6 +510,7 @@ static int afs_writepages_region(struct address_space *mapping,
+ 
+ 		if (PageWriteback(page) || !PageDirty(page)) {
+ 			unlock_page(page);
++			put_page(page);
+ 			continue;
+ 		}
+ 
+@@ -739,6 +747,20 @@ out:
+ 	return ret;
+ }
+ 
++/*
++ * Flush out all outstanding writes on a file opened for writing when it is
++ * closed.
++ */
++int afs_flush(struct file *file, fl_owner_t id)
++{
++	_enter("");
++
++	if ((file->f_mode & FMODE_WRITE) == 0)
++		return 0;
++
++	return vfs_fsync(file, 0);
++}
++
+ /*
+  * notification that a previously read-only page is about to become writable
+  * - if it returns an error, the caller will deliver a bus error signal
+diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
+index fe6e7050fe50..98198c57370b 100644
+--- a/fs/autofs4/waitq.c
++++ b/fs/autofs4/waitq.c
+@@ -174,7 +174,6 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
+ 
+ 	mutex_unlock(&sbi->wq_mutex);
+ 
+-	if (autofs4_write(sbi, pipe, &pkt, pktsz))
+ 	switch (ret = autofs4_write(sbi, pipe, &pkt, pktsz)) {
+ 	case 0:
+ 		break;
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index bebd6517355d..af1da85da509 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -6735,6 +6735,20 @@ static noinline int uncompress_inline(struct btrfs_path *path,
+ 	max_size = min_t(unsigned long, PAGE_CACHE_SIZE, max_size);
+ 	ret = btrfs_decompress(compress_type, tmp, page,
+ 			       extent_offset, inline_size, max_size);
++
++	/*
++	 * decompression code contains a memset to fill in any space between the end
++	 * of the uncompressed data and the end of max_size in case the decompressed
++	 * data ends up shorter than ram_bytes.  That doesn't cover the hole between
++	 * the end of an inline extent and the beginning of the next block, so we
++	 * cover that region here.
++	 */
++
++	if (max_size + pg_offset < PAGE_SIZE) {
++		char *map = kmap(page);
++		memset(map + pg_offset + max_size, 0, PAGE_SIZE - max_size - pg_offset);
++		kunmap(page);
++	}
+ 	kfree(tmp);
+ 	return ret;
+ }
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index ead89489ae71..35e6e0b2cf34 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -1400,6 +1400,29 @@ static int __close_session(struct ceph_mds_client *mdsc,
+ 	return request_close_session(mdsc, session);
+ }
+ 
++static bool drop_negative_children(struct dentry *dentry)
++{
++	struct dentry *child;
++	bool all_negative = true;
++
++	if (!d_is_dir(dentry))
++		goto out;
++
++	spin_lock(&dentry->d_lock);
++	list_for_each_entry(child, &dentry->d_subdirs, d_child) {
++		if (d_really_is_positive(child)) {
++			all_negative = false;
++			break;
++		}
++	}
++	spin_unlock(&dentry->d_lock);
++
++	if (all_negative)
++		shrink_dcache_parent(dentry);
++out:
++	return all_negative;
++}
++
+ /*
+  * Trim old(er) caps.
+  *
+@@ -1445,16 +1468,27 @@ static int trim_caps_cb(struct inode *inode, struct ceph_cap *cap, void *arg)
+ 	if ((used | wanted) & ~oissued & mine)
+ 		goto out;   /* we need these caps */
+ 
+-	session->s_trim_caps--;
+ 	if (oissued) {
+ 		/* we aren't the only cap.. just remove us */
+ 		__ceph_remove_cap(cap, true);
++		session->s_trim_caps--;
+ 	} else {
++		struct dentry *dentry;
+ 		/* try dropping referring dentries */
+ 		spin_unlock(&ci->i_ceph_lock);
+-		d_prune_aliases(inode);
+-		dout("trim_caps_cb %p cap %p  pruned, count now %d\n",
+-		     inode, cap, atomic_read(&inode->i_count));
++		dentry = d_find_any_alias(inode);
++		if (dentry && drop_negative_children(dentry)) {
++			int count;
++			dput(dentry);
++			d_prune_aliases(inode);
++			count = atomic_read(&inode->i_count);
++			if (count == 1)
++				session->s_trim_caps--;
++			dout("trim_caps_cb %p cap %p pruned, count now %d\n",
++			     inode, cap, count);
++		} else {
++			dput(dentry);
++		}
+ 		return 0;
+ 	}
+ 
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 31a3e480d484..403c4bae3e18 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4746,6 +4746,7 @@ retry:
+ 						    EXT4_INODE_EOFBLOCKS);
+ 		}
+ 		ext4_mark_inode_dirty(handle, inode);
++		ext4_update_inode_fsync_trans(handle, inode, 1);
+ 		ret2 = ext4_journal_stop(handle);
+ 		if (ret2)
+ 			break;
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 6445d84266fa..4c36dca486cc 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1403,6 +1403,10 @@ static struct buffer_head * ext4_find_entry (struct inode *dir,
+ 			       "falling back\n"));
+ 	}
+ 	nblocks = dir->i_size >> EXT4_BLOCK_SIZE_BITS(sb);
++	if (!nblocks) {
++		ret = NULL;
++		goto cleanup_and_exit;
++	}
+ 	start = EXT4_I(dir)->i_dir_start_lookup;
+ 	if (start >= nblocks)
+ 		start = 0;
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 60d6fc2e0e4b..22b30249fbcb 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -173,19 +173,33 @@ static void wb_wakeup(struct bdi_writeback *wb)
+ 	spin_unlock_bh(&wb->work_lock);
+ }
+ 
++static void finish_writeback_work(struct bdi_writeback *wb,
++				  struct wb_writeback_work *work)
++{
++	struct wb_completion *done = work->done;
++
++	if (work->auto_free)
++		kfree(work);
++	if (done && atomic_dec_and_test(&done->cnt))
++		wake_up_all(&wb->bdi->wb_waitq);
++}
++
+ static void wb_queue_work(struct bdi_writeback *wb,
+ 			  struct wb_writeback_work *work)
+ {
+ 	trace_writeback_queue(wb, work);
+ 
+-	spin_lock_bh(&wb->work_lock);
+-	if (!test_bit(WB_registered, &wb->state))
+-		goto out_unlock;
+ 	if (work->done)
+ 		atomic_inc(&work->done->cnt);
+-	list_add_tail(&work->list, &wb->work_list);
+-	mod_delayed_work(bdi_wq, &wb->dwork, 0);
+-out_unlock:
++
++	spin_lock_bh(&wb->work_lock);
++
++	if (test_bit(WB_registered, &wb->state)) {
++		list_add_tail(&work->list, &wb->work_list);
++		mod_delayed_work(bdi_wq, &wb->dwork, 0);
++	} else
++		finish_writeback_work(wb, work);
++
+ 	spin_unlock_bh(&wb->work_lock);
+ }
+ 
+@@ -1839,16 +1853,9 @@ static long wb_do_writeback(struct bdi_writeback *wb)
+ 
+ 	set_bit(WB_writeback_running, &wb->state);
+ 	while ((work = get_next_work_item(wb)) != NULL) {
+-		struct wb_completion *done = work->done;
+-
+ 		trace_writeback_exec(wb, work);
+-
+ 		wrote += wb_writeback(wb, work);
+-
+-		if (work->auto_free)
+-			kfree(work);
+-		if (done && atomic_dec_and_test(&done->cnt))
+-			wake_up_all(&wb->bdi->wb_waitq);
++		finish_writeback_work(wb, work);
+ 	}
+ 
+ 	/*
+diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
+index 5e425469f0c2..1543aa1b2a93 100644
+--- a/fs/gfs2/file.c
++++ b/fs/gfs2/file.c
+@@ -255,7 +255,7 @@ static int do_gfs2_set_flags(struct file *filp, u32 reqflags, u32 mask)
+ 			goto out;
+ 	}
+ 	if ((flags ^ new_flags) & GFS2_DIF_JDATA) {
+-		if (flags & GFS2_DIF_JDATA)
++		if (new_flags & GFS2_DIF_JDATA)
+ 			gfs2_log_flush(sdp, ip->i_gl, NORMAL_FLUSH);
+ 		error = filemap_fdatawrite(inode->i_mapping);
+ 		if (error)
+@@ -263,6 +263,8 @@ static int do_gfs2_set_flags(struct file *filp, u32 reqflags, u32 mask)
+ 		error = filemap_fdatawait(inode->i_mapping);
+ 		if (error)
+ 			goto out;
++		if (new_flags & GFS2_DIF_JDATA)
++			gfs2_ordered_del_inode(ip);
+ 	}
+ 	error = gfs2_trans_begin(sdp, RES_DINODE, 0);
+ 	if (error)
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 10410e8b5853..63498e1a542a 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -895,9 +895,9 @@ static void nfs4_session_set_rwsize(struct nfs_server *server)
+ 	server_resp_sz = sess->fc_attrs.max_resp_sz - nfs41_maxread_overhead;
+ 	server_rqst_sz = sess->fc_attrs.max_rqst_sz - nfs41_maxwrite_overhead;
+ 
+-	if (server->rsize > server_resp_sz)
++	if (!server->rsize || server->rsize > server_resp_sz)
+ 		server->rsize = server_resp_sz;
+-	if (server->wsize > server_rqst_sz)
++	if (!server->wsize || server->wsize > server_rqst_sz)
+ 		server->wsize = server_rqst_sz;
+ #endif /* CONFIG_NFS_V4_1 */
+ }
+diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
+index 5be1fa6b676d..b6eb56d18568 100644
+--- a/fs/nfsd/nfssvc.c
++++ b/fs/nfsd/nfssvc.c
+@@ -151,7 +151,8 @@ int nfsd_vers(int vers, enum vers_op change)
+ 
+ int nfsd_minorversion(u32 minorversion, enum vers_op change)
+ {
+-	if (minorversion > NFSD_SUPPORTED_MINOR_VERSION)
++	if (minorversion > NFSD_SUPPORTED_MINOR_VERSION &&
++	    change != NFSD_AVAIL)
+ 		return -1;
+ 	switch(change) {
+ 	case NFSD_SET:
+@@ -329,23 +330,20 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
+ 
+ void nfsd_reset_versions(void)
+ {
+-	int found_one = 0;
+ 	int i;
+ 
+-	for (i = NFSD_MINVERS; i < NFSD_NRVERS; i++) {
+-		if (nfsd_program.pg_vers[i])
+-			found_one = 1;
+-	}
+-
+-	if (!found_one) {
+-		for (i = NFSD_MINVERS; i < NFSD_NRVERS; i++)
+-			nfsd_program.pg_vers[i] = nfsd_version[i];
+-#if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
+-		for (i = NFSD_ACL_MINVERS; i < NFSD_ACL_NRVERS; i++)
+-			nfsd_acl_program.pg_vers[i] =
+-				nfsd_acl_version[i];
+-#endif
+-	}
++	for (i = 0; i < NFSD_NRVERS; i++)
++		if (nfsd_vers(i, NFSD_TEST))
++			return;
++
++	for (i = 0; i < NFSD_NRVERS; i++)
++		if (i != 4)
++			nfsd_vers(i, NFSD_SET);
++		else {
++			int minor = 0;
++			while (nfsd_minorversion(minor, NFSD_SET) >= 0)
++				minor++;
++		}
+ }
+ 
+ /*
+diff --git a/fs/proc/proc_tty.c b/fs/proc/proc_tty.c
+index 15f327bed8c6..7340c36978a3 100644
+--- a/fs/proc/proc_tty.c
++++ b/fs/proc/proc_tty.c
+@@ -14,6 +14,7 @@
+ #include <linux/tty.h>
+ #include <linux/seq_file.h>
+ #include <linux/bitops.h>
++#include "internal.h"
+ 
+ /*
+  * The /proc/tty directory inodes...
+@@ -164,7 +165,7 @@ void proc_tty_unregister_driver(struct tty_driver *driver)
+ 	if (!ent)
+ 		return;
+ 		
+-	remove_proc_entry(driver->driver_name, proc_tty_driver);
++	remove_proc_entry(ent->name, proc_tty_driver);
+ 	
+ 	driver->proc_entry = NULL;
+ }
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 81155b9b445b..ee09c97f3ab2 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -705,7 +705,7 @@ static loff_t udf_check_vsd(struct super_block *sb)
+ 	else
+ 		sectorsize = sb->s_blocksize;
+ 
+-	sector += (sbi->s_session << sb->s_blocksize_bits);
++	sector += (((loff_t)sbi->s_session) << sb->s_blocksize_bits);
+ 
+ 	udf_debug("Starting at sector %u (%ld byte sectors)\n",
+ 		  (unsigned int)(sector >> sb->s_blocksize_bits),
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index 66cdb44616d5..59d58bdad7d3 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -386,7 +386,7 @@ int handle_userfault(struct vm_area_struct *vma, unsigned long address,
+ 			 * in such case.
+ 			 */
+ 			down_read(&mm->mmap_sem);
+-			ret = 0;
++			ret = VM_FAULT_NOPAGE;
+ 		}
+ 	}
+ 
+diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
+index 75884aecf920..d98ba57ef01a 100644
+--- a/fs/xfs/libxfs/xfs_bmap.c
++++ b/fs/xfs/libxfs/xfs_bmap.c
+@@ -2670,7 +2670,7 @@ xfs_bmap_add_extent_unwritten_real(
+ 					&i)))
+ 				goto done;
+ 			XFS_WANT_CORRUPTED_GOTO(mp, i == 0, done);
+-			cur->bc_rec.b.br_state = XFS_EXT_NORM;
++			cur->bc_rec.b.br_state = new->br_state;
+ 			if ((error = xfs_btree_insert(cur, &i)))
+ 				goto done;
+ 			XFS_WANT_CORRUPTED_GOTO(mp, i == 1, done);
+diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
+index 8cab78eeb0c2..b34d1685936d 100644
+--- a/fs/xfs/xfs_log_recover.c
++++ b/fs/xfs/xfs_log_recover.c
+@@ -738,7 +738,7 @@ xlog_find_head(
+ 	 * in the in-core log.  The following number can be made tighter if
+ 	 * we actually look at the block size of the filesystem.
+ 	 */
+-	num_scan_bblks = XLOG_TOTAL_REC_SHIFT(log);
++	num_scan_bblks = min_t(int, log_bbnum, XLOG_TOTAL_REC_SHIFT(log));
+ 	if (head_blk >= num_scan_bblks) {
+ 		/*
+ 		 * We are guaranteed that the entire check can be performed
+diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h
+index a25414ce2898..9779c35f8454 100644
+--- a/include/crypto/internal/hash.h
++++ b/include/crypto/internal/hash.h
+@@ -83,6 +83,14 @@ int ahash_register_instance(struct crypto_template *tmpl,
+ 			    struct ahash_instance *inst);
+ void ahash_free_instance(struct crypto_instance *inst);
+ 
++int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
++		    unsigned int keylen);
++
++static inline bool crypto_shash_alg_has_setkey(struct shash_alg *alg)
++{
++	return alg->setkey != shash_no_setkey;
++}
++
+ int crypto_init_ahash_spawn(struct crypto_ahash_spawn *spawn,
+ 			    struct hash_alg_common *alg,
+ 			    struct crypto_instance *inst);
+diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
+index d3133be12d92..7fde8af9b87e 100644
+--- a/include/linux/mlx4/device.h
++++ b/include/linux/mlx4/device.h
+@@ -460,6 +460,7 @@ enum {
+ enum {
+ 	MLX4_INTERFACE_STATE_UP		= 1 << 0,
+ 	MLX4_INTERFACE_STATE_DELETION	= 1 << 1,
++	MLX4_INTERFACE_STATE_NOWAIT	= 1 << 2,
+ };
+ 
+ #define MSTR_SM_CHANGE_MASK (MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK | \
+diff --git a/include/linux/mman.h b/include/linux/mman.h
+index 16373c8f5f57..369bc3405a6d 100644
+--- a/include/linux/mman.h
++++ b/include/linux/mman.h
+@@ -63,8 +63,9 @@ static inline int arch_validate_prot(unsigned long prot)
+  * ("bit1" and "bit2" must be single bits)
+  */
+ #define _calc_vm_trans(x, bit1, bit2) \
++  ((!(bit1) || !(bit2)) ? 0 : \
+   ((bit1) <= (bit2) ? ((x) & (bit1)) * ((bit2) / (bit1)) \
+-   : ((x) & (bit1)) / ((bit1) / (bit2)))
++   : ((x) & (bit1)) / ((bit1) / (bit2))))
+ 
+ /*
+  * Combine the mmap "prot" argument into "vm_flags" used internally.
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index 8555321306fb..9982a2bcb880 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -299,7 +299,7 @@ struct t10_alua_tg_pt_gp {
+ 	struct list_head tg_pt_gp_lun_list;
+ 	struct se_lun *tg_pt_gp_alua_lun;
+ 	struct se_node_acl *tg_pt_gp_alua_nacl;
+-	struct delayed_work tg_pt_gp_transition_work;
++	struct work_struct tg_pt_gp_transition_work;
+ 	struct completion *tg_pt_gp_transition_complete;
+ };
+ 
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index e984f059e5fc..a996f7356216 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -441,13 +441,13 @@ static void replenish_dl_entity(struct sched_dl_entity *dl_se,
+  *
+  * This function returns true if:
+  *
+- *   runtime / (deadline - t) > dl_runtime / dl_period ,
++ *   runtime / (deadline - t) > dl_runtime / dl_deadline ,
+  *
+  * IOW we can't recycle current parameters.
+  *
+- * Notice that the bandwidth check is done against the period. For
++ * Notice that the bandwidth check is done against the deadline. For
+  * task with deadline equal to period this is the same of using
+- * dl_deadline instead of dl_period in the equation above.
++ * dl_period instead of dl_deadline in the equation above.
+  */
+ static bool dl_entity_overflow(struct sched_dl_entity *dl_se,
+ 			       struct sched_dl_entity *pi_se, u64 t)
+@@ -472,7 +472,7 @@ static bool dl_entity_overflow(struct sched_dl_entity *dl_se,
+ 	 * of anything below microseconds resolution is actually fiction
+ 	 * (but still we want to give the user that illusion >;).
+ 	 */
+-	left = (pi_se->dl_period >> DL_SCALE) * (dl_se->runtime >> DL_SCALE);
++	left = (pi_se->dl_deadline >> DL_SCALE) * (dl_se->runtime >> DL_SCALE);
+ 	right = ((dl_se->deadline - t) >> DL_SCALE) *
+ 		(pi_se->dl_runtime >> DL_SCALE);
+ 
+@@ -510,10 +510,15 @@ static void update_dl_entity(struct sched_dl_entity *dl_se,
+ 	}
+ }
+ 
++static inline u64 dl_next_period(struct sched_dl_entity *dl_se)
++{
++	return dl_se->deadline - dl_se->dl_deadline + dl_se->dl_period;
++}
++
+ /*
+  * If the entity depleted all its runtime, and if we want it to sleep
+  * while waiting for some new execution time to become available, we
+- * set the bandwidth enforcement timer to the replenishment instant
++ * set the bandwidth replenishment timer to the replenishment instant
+  * and try to activate it.
+  *
+  * Notice that it is important for the caller to know if the timer
+@@ -535,7 +540,7 @@ static int start_dl_timer(struct task_struct *p)
+ 	 * that it is actually coming from rq->clock and not from
+ 	 * hrtimer's time base reading.
+ 	 */
+-	act = ns_to_ktime(dl_se->deadline);
++	act = ns_to_ktime(dl_next_period(dl_se));
+ 	now = hrtimer_cb_get_time(timer);
+ 	delta = ktime_to_ns(now) - rq_clock(rq);
+ 	act = ktime_add_ns(act, delta);
+@@ -699,6 +704,37 @@ void init_dl_task_timer(struct sched_dl_entity *dl_se)
+ 	timer->function = dl_task_timer;
+ }
+ 
++/*
++ * During the activation, CBS checks if it can reuse the current task's
++ * runtime and period. If the deadline of the task is in the past, CBS
++ * cannot use the runtime, and so it replenishes the task. This rule
++ * works fine for implicit deadline tasks (deadline == period), and the
++ * CBS was designed for implicit deadline tasks. However, a task with
++ * constrained deadline (deadine < period) might be awakened after the
++ * deadline, but before the next period. In this case, replenishing the
++ * task would allow it to run for runtime / deadline. As in this case
++ * deadline < period, CBS enables a task to run for more than the
++ * runtime / period. In a very loaded system, this can cause a domino
++ * effect, making other tasks miss their deadlines.
++ *
++ * To avoid this problem, in the activation of a constrained deadline
++ * task after the deadline but before the next period, throttle the
++ * task and set the replenishing timer to the begin of the next period,
++ * unless it is boosted.
++ */
++static inline void dl_check_constrained_dl(struct sched_dl_entity *dl_se)
++{
++	struct task_struct *p = dl_task_of(dl_se);
++	struct rq *rq = rq_of_dl_rq(dl_rq_of_se(dl_se));
++
++	if (dl_time_before(dl_se->deadline, rq_clock(rq)) &&
++	    dl_time_before(rq_clock(rq), dl_next_period(dl_se))) {
++		if (unlikely(dl_se->dl_boosted || !start_dl_timer(p)))
++			return;
++		dl_se->dl_throttled = 1;
++	}
++}
++
+ static
+ int dl_runtime_exceeded(struct sched_dl_entity *dl_se)
+ {
+@@ -953,6 +989,11 @@ static void dequeue_dl_entity(struct sched_dl_entity *dl_se)
+ 	__dequeue_dl_entity(dl_se);
+ }
+ 
++static inline bool dl_is_constrained(struct sched_dl_entity *dl_se)
++{
++	return dl_se->dl_deadline < dl_se->dl_period;
++}
++
+ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
+ {
+ 	struct task_struct *pi_task = rt_mutex_get_top_task(p);
+@@ -978,6 +1019,15 @@ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
+ 		return;
+ 	}
+ 
++	/*
++	 * Check if a constrained deadline task was activated
++	 * after the deadline but before the next period.
++	 * If that is the case, the task will be throttled and
++	 * the replenishment timer will be set to the next period.
++	 */
++	if (!p->dl.dl_throttled && dl_is_constrained(&p->dl))
++		dl_check_constrained_dl(&p->dl);
++
+ 	/*
+ 	 * If p is throttled, we do nothing. In fact, if it exhausted
+ 	 * its budget it needs a replenishment and, since it now is on
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index faa75afcb7fe..95fefb364dab 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -1960,8 +1960,9 @@ static void pull_rt_task(struct rq *this_rq)
+ 	bool resched = false;
+ 	struct task_struct *p;
+ 	struct rq *src_rq;
++	int rt_overload_count = rt_overloaded(this_rq);
+ 
+-	if (likely(!rt_overloaded(this_rq)))
++	if (likely(!rt_overload_count))
+ 		return;
+ 
+ 	/*
+@@ -1970,6 +1971,11 @@ static void pull_rt_task(struct rq *this_rq)
+ 	 */
+ 	smp_rmb();
+ 
++	/* If we are the only overloaded CPU do nothing */
++	if (rt_overload_count == 1 &&
++	    cpumask_test_cpu(this_rq->cpu, this_rq->rd->rto_mask))
++		return;
++
+ #ifdef HAVE_RT_PUSH_IPI
+ 	if (sched_feat(RT_PUSH_IPI)) {
+ 		tell_cpu_to_push(this_rq);
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index b64f35afee4e..61d0960559c8 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -3384,37 +3384,30 @@ static const struct file_operations show_traces_fops = {
+ 	.llseek		= seq_lseek,
+ };
+ 
+-/*
+- * The tracer itself will not take this lock, but still we want
+- * to provide a consistent cpumask to user-space:
+- */
+-static DEFINE_MUTEX(tracing_cpumask_update_lock);
+-
+-/*
+- * Temporary storage for the character representation of the
+- * CPU bitmask (and one more byte for the newline):
+- */
+-static char mask_str[NR_CPUS + 1];
+-
+ static ssize_t
+ tracing_cpumask_read(struct file *filp, char __user *ubuf,
+ 		     size_t count, loff_t *ppos)
+ {
+ 	struct trace_array *tr = file_inode(filp)->i_private;
++	char *mask_str;
+ 	int len;
+ 
+-	mutex_lock(&tracing_cpumask_update_lock);
++	len = snprintf(NULL, 0, "%*pb\n",
++		       cpumask_pr_args(tr->tracing_cpumask)) + 1;
++	mask_str = kmalloc(len, GFP_KERNEL);
++	if (!mask_str)
++		return -ENOMEM;
+ 
+-	len = snprintf(mask_str, count, "%*pb\n",
++	len = snprintf(mask_str, len, "%*pb\n",
+ 		       cpumask_pr_args(tr->tracing_cpumask));
+ 	if (len >= count) {
+ 		count = -EINVAL;
+ 		goto out_err;
+ 	}
+-	count = simple_read_from_buffer(ubuf, count, ppos, mask_str, NR_CPUS+1);
++	count = simple_read_from_buffer(ubuf, count, ppos, mask_str, len);
+ 
+ out_err:
+-	mutex_unlock(&tracing_cpumask_update_lock);
++	kfree(mask_str);
+ 
+ 	return count;
+ }
+@@ -3434,8 +3427,6 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf,
+ 	if (err)
+ 		goto err_unlock;
+ 
+-	mutex_lock(&tracing_cpumask_update_lock);
+-
+ 	local_irq_disable();
+ 	arch_spin_lock(&tr->max_lock);
+ 	for_each_tracing_cpu(cpu) {
+@@ -3458,8 +3449,6 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf,
+ 	local_irq_enable();
+ 
+ 	cpumask_copy(tr->tracing_cpumask, tracing_cpumask_new);
+-
+-	mutex_unlock(&tracing_cpumask_update_lock);
+ 	free_cpumask_var(tracing_cpumask_new);
+ 
+ 	return count;
+diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
+index 97fc19f001bf..55dcb2b20b59 100644
+--- a/net/bridge/br_netfilter_hooks.c
++++ b/net/bridge/br_netfilter_hooks.c
+@@ -701,18 +701,20 @@ static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb)
+ 
+ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
+-	struct nf_bridge_info *nf_bridge;
+-	unsigned int mtu_reserved;
++	struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
++	unsigned int mtu, mtu_reserved;
+ 
+ 	mtu_reserved = nf_bridge_mtu_reduction(skb);
++	mtu = skb->dev->mtu;
++
++	if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
++		mtu = nf_bridge->frag_max_size;
+ 
+-	if (skb_is_gso(skb) || skb->len + mtu_reserved <= skb->dev->mtu) {
++	if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) {
+ 		nf_bridge_info_free(skb);
+ 		return br_dev_queue_push_xmit(net, sk, skb);
+ 	}
+ 
+-	nf_bridge = nf_bridge_info_get(skb);
+-
+ 	/* This is wrong! We should preserve the original fragment
+ 	 * boundaries by preserving frag_list rather than refragmenting.
+ 	 */
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 630704d8d6a2..3b67c1e5756f 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1300,6 +1300,7 @@ void netdev_notify_peers(struct net_device *dev)
+ {
+ 	rtnl_lock();
+ 	call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, dev);
++	call_netdevice_notifiers(NETDEV_RESEND_IGMP, dev);
+ 	rtnl_unlock();
+ }
+ EXPORT_SYMBOL(netdev_notify_peers);
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index d48281ca9c72..ec8f6a6485e3 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -1856,7 +1856,7 @@ static __net_exit void l2tp_exit_net(struct net *net)
+ 
+ 	rcu_read_lock_bh();
+ 	list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
+-		(void)l2tp_tunnel_delete(tunnel);
++		l2tp_tunnel_delete(tunnel);
+ 	}
+ 	rcu_read_unlock_bh();
+ }
+diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
+index 665cc74df5c5..fb3248ff8b48 100644
+--- a/net/l2tp/l2tp_netlink.c
++++ b/net/l2tp/l2tp_netlink.c
+@@ -285,7 +285,7 @@ static int l2tp_nl_cmd_tunnel_delete(struct sk_buff *skb, struct genl_info *info
+ 	l2tp_tunnel_notify(&l2tp_nl_family, info,
+ 			   tunnel, L2TP_CMD_TUNNEL_DELETE);
+ 
+-	(void) l2tp_tunnel_delete(tunnel);
++	l2tp_tunnel_delete(tunnel);
+ 
+ out:
+ 	return ret;
+diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
+index 9e1ded80a992..1cbc7bd26de3 100644
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -295,8 +295,6 @@ int mesh_add_meshconf_ie(struct ieee80211_sub_if_data *sdata,
+ 	/* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */
+ 	*pos |= ifmsh->ps_peers_deep_sleep ?
+ 			IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL : 0x00;
+-	*pos++ = 0x00;
+-
+ 	return 0;
+ }
+ 
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index e7c1b052c2a3..2c937c16dc27 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -1999,12 +1999,16 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
+ 		seq_puts(seq,
+ 			 "  -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
+ 	} else {
++		struct net *net = seq_file_net(seq);
++		struct netns_ipvs *ipvs = net_ipvs(net);
+ 		const struct ip_vs_service *svc = v;
+ 		const struct ip_vs_iter *iter = seq->private;
+ 		const struct ip_vs_dest *dest;
+ 		struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);
+ 		char *sched_name = sched ? sched->name : "none";
+ 
++		if (svc->ipvs != ipvs)
++			return 0;
+ 		if (iter->table == ip_vs_svc_table) {
+ #ifdef CONFIG_IP_VS_IPV6
+ 			if (svc->af == AF_INET6)
+diff --git a/net/socket.c b/net/socket.c
+index fbfa9d2492cf..2cf4f25f5c2b 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1697,6 +1697,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
+ 	/* We assume all kernel code knows the size of sockaddr_storage */
+ 	msg.msg_namelen = 0;
+ 	msg.msg_iocb = NULL;
++	msg.msg_flags = 0;
+ 	if (sock->file->f_flags & O_NONBLOCK)
+ 		flags |= MSG_DONTWAIT;
+ 	err = sock_recvmsg(sock, &msg, iov_iter_count(&msg.msg_iter), flags);
+diff --git a/security/keys/request_key.c b/security/keys/request_key.c
+index 2ce733342b5a..3ae3acf473c8 100644
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -250,11 +250,12 @@ static int construct_key(struct key *key, const void *callout_info,
+  * The keyring selected is returned with an extra reference upon it which the
+  * caller must release.
+  */
+-static void construct_get_dest_keyring(struct key **_dest_keyring)
++static int construct_get_dest_keyring(struct key **_dest_keyring)
+ {
+ 	struct request_key_auth *rka;
+ 	const struct cred *cred = current_cred();
+ 	struct key *dest_keyring = *_dest_keyring, *authkey;
++	int ret;
+ 
+ 	kenter("%p", dest_keyring);
+ 
+@@ -263,6 +264,8 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
+ 		/* the caller supplied one */
+ 		key_get(dest_keyring);
+ 	} else {
++		bool do_perm_check = true;
++
+ 		/* use a default keyring; falling through the cases until we
+ 		 * find one that we actually have */
+ 		switch (cred->jit_keyring) {
+@@ -277,8 +280,10 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
+ 					dest_keyring =
+ 						key_get(rka->dest_keyring);
+ 				up_read(&authkey->sem);
+-				if (dest_keyring)
++				if (dest_keyring) {
++					do_perm_check = false;
+ 					break;
++				}
+ 			}
+ 
+ 		case KEY_REQKEY_DEFL_THREAD_KEYRING:
+@@ -313,11 +318,29 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
+ 		default:
+ 			BUG();
+ 		}
++
++		/*
++		 * Require Write permission on the keyring.  This is essential
++		 * because the default keyring may be the session keyring, and
++		 * joining a keyring only requires Search permission.
++		 *
++		 * However, this check is skipped for the "requestor keyring" so
++		 * that /sbin/request-key can itself use request_key() to add
++		 * keys to the original requestor's destination keyring.
++		 */
++		if (dest_keyring && do_perm_check) {
++			ret = key_permission(make_key_ref(dest_keyring, 1),
++					     KEY_NEED_WRITE);
++			if (ret) {
++				key_put(dest_keyring);
++				return ret;
++			}
++		}
+ 	}
+ 
+ 	*_dest_keyring = dest_keyring;
+ 	kleave(" [dk %d]", key_serial(dest_keyring));
+-	return;
++	return 0;
+ }
+ 
+ /*
+@@ -442,12 +465,16 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
+ 
+ 	if (ctx->index_key.type == &key_type_keyring)
+ 		return ERR_PTR(-EPERM);
+-	
+-	user = key_user_lookup(current_fsuid());
+-	if (!user)
+-		return ERR_PTR(-ENOMEM);
+ 
+-	construct_get_dest_keyring(&dest_keyring);
++	ret = construct_get_dest_keyring(&dest_keyring);
++	if (ret)
++		goto error;
++
++	user = key_user_lookup(current_fsuid());
++	if (!user) {
++		ret = -ENOMEM;
++		goto error_put_dest_keyring;
++	}
+ 
+ 	ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key);
+ 	key_user_put(user);
+@@ -462,7 +489,7 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
+ 	} else if (ret == -EINPROGRESS) {
+ 		ret = 0;
+ 	} else {
+-		goto couldnt_alloc_key;
++		goto error_put_dest_keyring;
+ 	}
+ 
+ 	key_put(dest_keyring);
+@@ -472,8 +499,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
+ construction_failed:
+ 	key_negate_and_link(key, key_negative_timeout, NULL, NULL);
+ 	key_put(key);
+-couldnt_alloc_key:
++error_put_dest_keyring:
+ 	key_put(dest_keyring);
++error:
+ 	kleave(" = %d", ret);
+ 	return ERR_PTR(ret);
+ }
+diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
+index 520a32a12f8a..415be561fad3 100644
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -200,7 +200,7 @@ void symbols__fixup_end(struct rb_root *symbols)
+ 
+ 	/* Last entry */
+ 	if (curr->end == curr->start)
+-		curr->end = roundup(curr->start, 4096);
++		curr->end = roundup(curr->start, 4096) + 4096;
+ }
+ 
+ void __map_groups__fixup_end(struct map_groups *mg, enum map_type type)
+diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
+index e4bb1de1d526..b5f08e8cab33 100644
+--- a/tools/testing/selftests/vm/Makefile
++++ b/tools/testing/selftests/vm/Makefile
+@@ -1,5 +1,9 @@
+ # Makefile for vm selftests
+ 
++ifndef OUTPUT
++  OUTPUT := $(shell pwd)
++endif
++
+ CFLAGS = -Wall -I ../../../../usr/include $(EXTRA_CFLAGS)
+ BINARIES = compaction_test
+ BINARIES += hugepage-mmap