74 files changed, 581 insertions, 472 deletions
diff --git a/Documentation/devicetree/bindings/usb/dwc2.txt b/Documentation/devicetree/bindings/usb/dwc2.txt
index e64d903bcbe8..46da5f184460 100644
--- a/Documentation/devicetree/bindings/usb/dwc2.txt
+++ b/Documentation/devicetree/bindings/usb/dwc2.txt
@@ -19,7 +19,7 @@ Required properties:
  configured in FS mode;
  - "st,stm32f4x9-hsotg": The DWC2 USB HS controller instance in STM32F4x9 SoCs
  configured in HS mode;
-  - "st,stm32f7xx-hsotg": The DWC2 USB HS controller instance in STM32F7xx SoCs
+  - "st,stm32f7-hsotg": The DWC2 USB HS controller instance in STM32F7 SoCs
    configured in HS mode;
 - reg : Should contain 1 register range (address and length)
 - interrupts : Should contain 1 interrupt
diff --git a/Documentation/devicetree/bindings/usb/renesas_usb3.txt b/Documentation/devicetree/bindings/usb/renesas_usb3.txt
index 87a45e2f9b7f..2c071bb5801e 100644
--- a/Documentation/devicetree/bindings/usb/renesas_usb3.txt
+++ b/Documentation/devicetree/bindings/usb/renesas_usb3.txt
@@ -4,6 +4,7 @@ Required properties:
  - compatible: Must contain one of the following:
        - "renesas,r8a7795-usb3-peri"
        - "renesas,r8a7796-usb3-peri"
+        - "renesas,r8a77965-usb3-peri"
        - "renesas,rcar-gen3-usb3-peri" for a generic R-Car Gen3 compatible
          device
diff --git a/Documentation/devicetree/bindings/usb/renesas_usbhs.txt b/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
index d060172f1529..43960faf5a88 100644
--- a/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
+++ b/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
@@ -12,6 +12,7 @@ Required properties:
        - "renesas,usbhs-r8a7794" for r8a7794 (R-Car E2) compatible device
        - "renesas,usbhs-r8a7795" for r8a7795 (R-Car H3) compatible device
        - "renesas,usbhs-r8a7796" for r8a7796 (R-Car M3-W) compatible device
+        - "renesas,usbhs-r8a77965" for r8a77965 (R-Car M3-N) compatible device
        - "renesas,usbhs-r8a77995" for r8a77995 (R-Car D3) compatible device
        - "renesas,usbhs-r7s72100" for r7s72100 (RZ/A1) compatible device
        - "renesas,rcar-gen2-usbhs" for R-Car Gen2 or RZ/G1 compatible devices
diff --git a/Documentation/devicetree/bindings/usb/usb-xhci.txt b/Documentation/devicetree/bindings/usb/usb-xhci.txt
index e2ea59bbca93..1651483a7048 100644
--- a/Documentation/devicetree/bindings/usb/usb-xhci.txt
+++ b/Documentation/devicetree/bindings/usb/usb-xhci.txt
@@ -13,6 +13,7 @@ Required properties:
    - "renesas,xhci-r8a7793" for r8a7793 SoC
    - "renesas,xhci-r8a7795" for r8a7795 SoC
    - "renesas,xhci-r8a7796" for r8a7796 SoC
+    - "renesas,xhci-r8a77965" for r8a77965 SoC
    - "renesas,rcar-gen2-xhci" for a generic R-Car Gen2 or RZ/G1 compatible
      device
    - "renesas,rcar-gen3-xhci" for a generic R-Car Gen3 compatible device
diff --git a/MAINTAINERS b/MAINTAINERS
index 4623caf8d72d..205c8fc12a9c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -9925,6 +9925,13 @@ F:	Documentation/ABI/stable/sysfs-bus-nvmem
 F:      include/linux/nvmem-consumer.h
 F:      include/linux/nvmem-provider.h
+NXP SGTL5000 DRIVER
+M:      Fabio Estevam <fabio.estevam@nxp.com>
+L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
+S:      Maintained
+F:      Documentation/devicetree/bindings/sound/sgtl5000.txt
+F:      sound/soc/codecs/sgtl5000*
 NXP TDA998X DRM DRIVER
 M:      Russell King <linux@armlinux.org.uk>
 S:      Supported
@@ -12107,6 +12114,7 @@ M:	Sylwester Nawrocki <s.nawrocki@samsung.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Supported
 F:      sound/soc/samsung/
+F:      Documentation/devicetree/bindings/sound/samsung*
 SAMSUNG EXYNOS PSEUDO RANDOM NUMBER GENERATOR (RNG) DRIVER
 M:      Krzysztof Kozlowski <krzk@kernel.org>
diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
index 847ddffbf38a..b5cfab711651 100644
--- a/arch/sparc/mm/tlb.c
+++ b/arch/sparc/mm/tlb.c
@@ -163,13 +163,10 @@ static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr,
        pte_unmap(pte);
 }
-void set_pmd_at(struct mm_struct *mm, unsigned long addr,
-                pmd_t *pmdp, pmd_t pmd)
-{
-        pmd_t orig = *pmdp;
-        *pmdp = pmd;
+static void __set_pmd_acct(struct mm_struct *mm, unsigned long addr,
+                           pmd_t orig, pmd_t pmd)
+{
        if (mm == &init_mm)
                return;
@@ -219,6 +216,15 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr,
        }
 }
+void set_pmd_at(struct mm_struct *mm, unsigned long addr,
+                pmd_t *pmdp, pmd_t pmd)
+{
+        pmd_t orig = *pmdp;
+        *pmdp = pmd;
+        __set_pmd_acct(mm, addr, orig, pmd);
+}
 static inline pmd_t pmdp_establish(struct vm_area_struct *vma,
                unsigned long address, pmd_t *pmdp, pmd_t pmd)
 {
@@ -227,6 +233,7 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma,
        do {
                old = *pmdp;
        } while (cmpxchg64(&pmdp->pmd, old.pmd, pmd.pmd) != old.pmd);
+        __set_pmd_acct(vma->vm_mm, address, old, pmd);
        return old;
 }
diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c
index 9180b9bd5821..834509506ef6 100644
--- a/drivers/auxdisplay/img-ascii-lcd.c
+++ b/drivers/auxdisplay/img-ascii-lcd.c
@@ -97,7 +97,7 @@ static struct img_ascii_lcd_config boston_config = {
 static void malta_update(struct img_ascii_lcd_ctx *ctx)
 {
        unsigned int i;
-        int err;
+        int err = 0;
        for (i = 0; i < ctx->cfg->num_chars; i++) {
                err = regmap_write(ctx->regmap,
@@ -180,7 +180,7 @@ static int sead3_wait_lcd_idle(struct img_ascii_lcd_ctx *ctx)
 static void sead3_update(struct img_ascii_lcd_ctx *ctx)
 {
        unsigned int i;
-        int err;
+        int err = 0;
        for (i = 0; i < ctx->cfg->num_chars; i++) {
                err = sead3_wait_lcd_idle(ctx);
@@ -224,7 +224,7 @@ MODULE_DEVICE_TABLE(of, img_ascii_lcd_matches);
 /**
 * img_ascii_lcd_scroll() - scroll the display by a character
- * @arg: really a pointer to the private data structure
+ * @t: really a pointer to the private data structure
 *
 * Scroll the current message along the LCD by one character, rearming the
 * timer if required.
diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
index ea7869c0d7f9..ec5e8800f8ad 100644
--- a/drivers/auxdisplay/panel.c
+++ b/drivers/auxdisplay/panel.c
@@ -1372,7 +1372,7 @@ static void panel_process_inputs(void)
                                break;
                        input->rise_timer = 0;
                        input->state = INPUT_ST_RISING;
-                        /* no break here, fall through */
+                        /* fall through */
                case INPUT_ST_RISING:
                        if ((phys_curr & input->mask) != input->value) {
                                input->state = INPUT_ST_LOW;
@@ -1385,11 +1385,11 @@ static void panel_process_inputs(void)
                        }
                        input->high_timer = 0;
                        input->state = INPUT_ST_HIGH;
-                        /* no break here, fall through */
+                        /* fall through */
                case INPUT_ST_HIGH:
                        if (input_state_high(input))
                                break;
-                        /* no break here, fall through */
+                        /* fall through */
                case INPUT_ST_FALLING:
                        input_state_falling(input);
                }
diff --git a/drivers/firmware/dcdbas.c b/drivers/firmware/dcdbas.c
index c16600f30611..0bdea60c65dd 100644
--- a/drivers/firmware/dcdbas.c
+++ b/drivers/firmware/dcdbas.c
@@ -639,7 +639,7 @@ static void __exit dcdbas_exit(void)
        platform_driver_unregister(&dcdbas_driver);
 }
-module_init(dcdbas_init);
+subsys_initcall_sync(dcdbas_init);
 module_exit(dcdbas_exit);
 MODULE_DESCRIPTION(DRIVER_DESCRIPTION " (version " DRIVER_VERSION ")");
diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c
index 1b2e5362a3ff..cc429b567d0a 100644
--- a/drivers/infiniband/sw/rdmavt/mr.c
+++ b/drivers/infiniband/sw/rdmavt/mr.c
@@ -489,11 +489,13 @@ static int rvt_check_refs(struct rvt_mregion *mr, const char *t)
        unsigned long timeout;
        struct rvt_dev_info *rdi = ib_to_rvt(mr->pd->device);
-        if (percpu_ref_is_zero(&mr->refcount))
+        if (mr->lkey) {
-                return 0;
+                /* avoid dma mr */
-        /* avoid dma mr */
-        if (mr->lkey)
                rvt_dereg_clean_qps(mr);
+                /* @mr was indexed on rcu protected @lkey_table */
+                synchronize_rcu();
+        }
        timeout = wait_for_completion_timeout(&mr->comp, 5 * HZ);
        if (!timeout) {
                rvt_pr_err(rdi,
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 3fde9e9faddd..a05a560d3cba 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -22,7 +22,6 @@
 #include <linux/time.h>
 #include <linux/workqueue.h>
 #include <linux/delay.h>
-#include <scsi/scsi_device.h>
 #include <scsi/scsi_dh.h>
 #include <linux/atomic.h>
 #include <linux/blk-mq.h>
@@ -223,6 +222,16 @@ static int alloc_multipath_stage2(struct dm_target *ti, struct multipath *m)
        dm_table_set_type(ti->table, m->queue_mode);
+        /*
+         * Init fields that are only used when a scsi_dh is attached
+         * - must do this unconditionally (really doesn't hurt non-SCSI uses)
+         */
+        set_bit(MPATHF_QUEUE_IO, &m->flags);
+        atomic_set(&m->pg_init_in_progress, 0);
+        atomic_set(&m->pg_init_count, 0);
+        m->pg_init_delay_msecs = DM_PG_INIT_DELAY_DEFAULT;
+        init_waitqueue_head(&m->pg_init_wait);
        return 0;
 }
@@ -331,7 +340,6 @@ static void __switch_pg(struct multipath *m, struct priority_group *pg)
                set_bit(MPATHF_PG_INIT_REQUIRED, &m->flags);
                set_bit(MPATHF_QUEUE_IO, &m->flags);
        } else {
-                /* FIXME: not needed if no scsi_dh is attached */
                clear_bit(MPATHF_PG_INIT_REQUIRED, &m->flags);
                clear_bit(MPATHF_QUEUE_IO, &m->flags);
        }
@@ -796,15 +804,14 @@ static int parse_path_selector(struct dm_arg_set *as, struct priority_group *pg,
        return 0;
 }
-static int setup_scsi_dh(struct block_device *bdev, struct multipath *m, char **error)
+static int setup_scsi_dh(struct block_device *bdev, struct multipath *m,
+                         const char *attached_handler_name, char **error)
 {
        struct request_queue *q = bdev_get_queue(bdev);
-        const char *attached_handler_name;
        int r;
        if (test_bit(MPATHF_RETAIN_ATTACHED_HW_HANDLER, &m->flags)) {
 retain:
-                attached_handler_name = scsi_dh_attached_handler_name(q, GFP_KERNEL);
                if (attached_handler_name) {
                        /*
                         * Clear any hw_handler_params associated with a
@@ -823,16 +830,6 @@ retain:
                         */
                        kfree(m->hw_handler_name);
                        m->hw_handler_name = attached_handler_name;
-                        /*
-                         * Init fields that are only used when a scsi_dh is attached
-                         */
-                        if (!test_and_set_bit(MPATHF_QUEUE_IO, &m->flags)) {
-                                atomic_set(&m->pg_init_in_progress, 0);
-                                atomic_set(&m->pg_init_count, 0);
-                                m->pg_init_delay_msecs = DM_PG_INIT_DELAY_DEFAULT;
-                                init_waitqueue_head(&m->pg_init_wait);
-                        }
                }
        }
@@ -868,7 +865,8 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
        int r;
        struct pgpath *p;
        struct multipath *m = ti->private;
-        struct scsi_device *sdev;
+        struct request_queue *q;
+        const char *attached_handler_name;
        /* we need at least a path arg */
        if (as->argc < 1) {
@@ -887,11 +885,11 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
                goto bad;
        }
-        sdev = scsi_device_from_queue(bdev_get_queue(p->path.dev->bdev));
+        q = bdev_get_queue(p->path.dev->bdev);
-        if (sdev) {
+        attached_handler_name = scsi_dh_attached_handler_name(q, GFP_KERNEL);
-                put_device(&sdev->sdev_gendev);
+        if (attached_handler_name) {
                INIT_DELAYED_WORK(&p->activate_path, activate_path_work);
-                r = setup_scsi_dh(p->path.dev->bdev, m, &ti->error);
+                r = setup_scsi_dh(p->path.dev->bdev, m, attached_handler_name, &ti->error);
                if (r) {
                        dm_put_device(ti, p->path.dev);
                        goto bad;
@@ -2022,8 +2020,9 @@ static int multipath_busy(struct dm_target *ti)
 *---------------------------------------------------------------*/
 static struct target_type multipath_target = {
        .name = "multipath",
-        .version = {1, 12, 0},
+        .version = {1, 13, 0},
-        .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE,
+        .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE |
+                    DM_TARGET_PASSES_INTEGRITY,
        .module = THIS_MODULE,
        .ctr = multipath_ctr,
        .dtr = multipath_dtr,
diff --git a/drivers/phy/qualcomm/phy-qcom-ufs.c b/drivers/phy/qualcomm/phy-qcom-ufs.c
index c5ff4525edef..c5493ea51282 100644
--- a/drivers/phy/qualcomm/phy-qcom-ufs.c
+++ b/drivers/phy/qualcomm/phy-qcom-ufs.c
@@ -675,3 +675,8 @@ int ufs_qcom_phy_power_off(struct phy *generic_phy)
        return 0;
 }
 EXPORT_SYMBOL_GPL(ufs_qcom_phy_power_off);
+MODULE_AUTHOR("Yaniv Gardi <ygardi@codeaurora.org>");
+MODULE_AUTHOR("Vivek Gautam <vivek.gautam@codeaurora.org>");
+MODULE_DESCRIPTION("Universal Flash Storage (UFS) QCOM PHY");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index d10ffe51da24..51ebc5a6053f 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -106,13 +106,14 @@ config ASUS_LAPTOP
          If you have an ACPI-compatible ASUS laptop, say Y or M here.
 #
-# If the DELL_SMBIOS_SMM feature is enabled, the DELL_SMBIOS driver
+# The DELL_SMBIOS driver depends on ACPI_WMI and/or DCDBAS if those
-# becomes dependent on the DCDBAS driver. The "depends" line prevents a
+# backends are selected. The "depends" line prevents a configuration
-# configuration where DELL_SMBIOS=y while DCDBAS=m.
+# where DELL_SMBIOS=y while either of those dependencies =m.
 #
 config DELL_SMBIOS
        tristate "Dell SMBIOS driver"
        depends on DCDBAS || DCDBAS=n
+        depends on ACPI_WMI || ACPI_WMI=n
        ---help---
        This provides support for the Dell SMBIOS calling interface.
        If you have a Dell computer you should enable this option.
diff --git a/drivers/platform/x86/dell-smbios-base.c b/drivers/platform/x86/dell-smbios-base.c
index 5bcf8a18f785..2485c80a9fdd 100644
--- a/drivers/platform/x86/dell-smbios-base.c
+++ b/drivers/platform/x86/dell-smbios-base.c
@@ -637,7 +637,7 @@ static void __exit dell_smbios_exit(void)
        mutex_unlock(&smbios_mutex);
 }
-subsys_initcall(dell_smbios_init);
+module_init(dell_smbios_init);
 module_exit(dell_smbios_exit);
 MODULE_AUTHOR("Matthew Garrett <mjg@redhat.com>");
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 2c9927430d85..8d102195a392 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -714,7 +714,7 @@ static int __init dell_wmi_init(void)
        return wmi_driver_register(&dell_wmi_driver);
 }
-module_init(dell_wmi_init);
+late_initcall(dell_wmi_init);
 static void __exit dell_wmi_exit(void)
 {
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index c2ea13c7e37e..a1cb0236c550 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -10558,7 +10558,7 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        snprintf(ioc->firmware_event_name, sizeof(ioc->firmware_event_name),
            "fw_event_%s%d", ioc->driver_name, ioc->id);
        ioc->firmware_event_thread = alloc_ordered_workqueue(
-            ioc->firmware_event_name, WQ_MEM_RECLAIM);
+            ioc->firmware_event_name, 0);
        if (!ioc->firmware_event_thread) {
                pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n",
                    ioc->name, __FILE__, __LINE__, __func__);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 285911e81728..5c5dcca4d1da 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -454,7 +454,7 @@ static int qla2x00_alloc_queues(struct qla_hw_data *ha, struct req_que *req,
        ha->req_q_map[0] = req;
        set_bit(0, ha->rsp_qid_map);
        set_bit(0, ha->req_qid_map);
-        return 1;
+        return 0;
 fail_qpair_map:
        kfree(ha->base_qpair);
@@ -471,6 +471,9 @@ fail_req_map:
 static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req)
 {
+        if (!ha->req_q_map)
+                return;
        if (IS_QLAFX00(ha)) {
                if (req && req->ring_fx00)
                        dma_free_coherent(&ha->pdev->dev,
@@ -481,14 +484,17 @@ static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req)
                (req->length + 1) * sizeof(request_t),
                req->ring, req->dma);
-        if (req)
+        if (req) {
                kfree(req->outstanding_cmds);
+                kfree(req);
-        kfree(req);
+        }
 }
 static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp)
 {
+        if (!ha->rsp_q_map)
+                return;
        if (IS_QLAFX00(ha)) {
                if (rsp && rsp->ring)
                        dma_free_coherent(&ha->pdev->dev,
@@ -499,7 +505,8 @@ static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp)
                (rsp->length + 1) * sizeof(response_t),
                rsp->ring, rsp->dma);
        }
-        kfree(rsp);
+        if (rsp)
+                kfree(rsp);
 }
 static void qla2x00_free_queues(struct qla_hw_data *ha)
@@ -1723,6 +1730,8 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)
        struct qla_tgt_cmd *cmd;
        uint8_t trace = 0;
+        if (!ha->req_q_map)
+                return;
        spin_lock_irqsave(qp->qp_lock_ptr, flags);
        req = qp->req;
        for (cnt = 1; cnt < req->num_outstanding_cmds; cnt++) {
@@ -3095,14 +3104,14 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
        /* Set up the irqs */
        ret = qla2x00_request_irqs(ha, rsp);
        if (ret)
-                goto probe_hw_failed;
+                goto probe_failed;
        /* Alloc arrays of request and response ring ptrs */
-        if (!qla2x00_alloc_queues(ha, req, rsp)) {
+        if (qla2x00_alloc_queues(ha, req, rsp)) {
                ql_log(ql_log_fatal, base_vha, 0x003d,
                    "Failed to allocate memory for queue pointers..."
                    "aborting.\n");
-                goto probe_init_failed;
+                goto probe_failed;
        }
        if (ha->mqenable && shost_use_blk_mq(host)) {
@@ -3387,15 +3396,6 @@ skip_dpc:
        return 0;
-probe_init_failed:
-        qla2x00_free_req_que(ha, req);
-        ha->req_q_map[0] = NULL;
-        clear_bit(0, ha->req_qid_map);
-        qla2x00_free_rsp_que(ha, rsp);
-        ha->rsp_q_map[0] = NULL;
-        clear_bit(0, ha->rsp_qid_map);
-        ha->max_req_queues = ha->max_rsp_queues = 0;
 probe_failed:
        if (base_vha->timer_active)
                qla2x00_stop_timer(base_vha);
@@ -4508,11 +4508,17 @@ qla2x00_mem_free(struct qla_hw_data *ha)
        if (ha->init_cb)
                dma_free_coherent(&ha->pdev->dev, ha->init_cb_size,
                        ha->init_cb, ha->init_cb_dma);
-        vfree(ha->optrom_buffer);
-        kfree(ha->nvram);
+        if (ha->optrom_buffer)
-        kfree(ha->npiv_info);
+                vfree(ha->optrom_buffer);
-        kfree(ha->swl);
+        if (ha->nvram)
-        kfree(ha->loop_id_map);
+                kfree(ha->nvram);
+        if (ha->npiv_info)
+                kfree(ha->npiv_info);
+        if (ha->swl)
+                kfree(ha->swl);
+        if (ha->loop_id_map)
+                kfree(ha->loop_id_map);
        ha->srb_mempool = NULL;
        ha->ctx_mempool = NULL;
@@ -4528,6 +4534,15 @@ qla2x00_mem_free(struct qla_hw_data *ha)
        ha->ex_init_cb_dma = 0;
        ha->async_pd = NULL;
        ha->async_pd_dma = 0;
+        ha->loop_id_map = NULL;
+        ha->npiv_info = NULL;
+        ha->optrom_buffer = NULL;
+        ha->swl = NULL;
+        ha->nvram = NULL;
+        ha->mctp_dump = NULL;
+        ha->dcbx_tlv = NULL;
+        ha->xgmac_data = NULL;
+        ha->sfp_data = NULL;
        ha->s_dma_pool = NULL;
        ha->dl_dma_pool = NULL;
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index bff21e636ddd..3541caf3fceb 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2595,6 +2595,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, unsigned char *buffer)
        int res;
        struct scsi_device *sdp = sdkp->device;
        struct scsi_mode_data data;
+        int disk_ro = get_disk_ro(sdkp->disk);
        int old_wp = sdkp->write_prot;
        set_disk_ro(sdkp->disk, 0);
@@ -2635,7 +2636,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, unsigned char *buffer)
                          "Test WP failed, assume Write Enabled\n");
        } else {
                sdkp->write_prot = ((data.device_specific & 0x80) != 0);
-                set_disk_ro(sdkp->disk, sdkp->write_prot);
+                set_disk_ro(sdkp->disk, sdkp->write_prot || disk_ro);
                if (sdkp->first_scan || old_wp != sdkp->write_prot) {
                        sd_printk(KERN_NOTICE, sdkp, "Write Protect is %s\n",
                                  sdkp->write_prot ? "on" : "off");
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 6c348a211ebb..89cf4498f535 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -403,7 +403,7 @@ static int sd_zbc_check_capacity(struct scsi_disk *sdkp, unsigned char *buf)
 */
 static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 {
-        u64 zone_blocks;
+        u64 zone_blocks = 0;
        sector_t block = 0;
        unsigned char *buf;
        unsigned char *rec;
@@ -421,10 +421,8 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
        /* Do a report zone to get the same field */
        ret = sd_zbc_report_zones(sdkp, buf, SD_ZBC_BUF_SIZE, 0);
-        if (ret) {
+        if (ret)
-                zone_blocks = 0;
+                goto out_free;
-                goto out;
-        }
        same = buf[4] & 0x0f;
        if (same > 0) {
@@ -464,7 +462,7 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
                        ret = sd_zbc_report_zones(sdkp, buf,
                                                  SD_ZBC_BUF_SIZE, block);
                        if (ret)
-                                return ret;
+                                goto out_free;
                }
        } while (block < sdkp->capacity);
@@ -472,35 +470,32 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
        zone_blocks = sdkp->zone_blocks;
 out:
-        kfree(buf);
        if (!zone_blocks) {
                if (sdkp->first_scan)
                        sd_printk(KERN_NOTICE, sdkp,
                                  "Devices with non constant zone "
                                  "size are not supported\n");
-                return -ENODEV;
+                ret = -ENODEV;
-        }
+        } else if (!is_power_of_2(zone_blocks)) {
-        if (!is_power_of_2(zone_blocks)) {
                if (sdkp->first_scan)
                        sd_printk(KERN_NOTICE, sdkp,
                                  "Devices with non power of 2 zone "
                                  "size are not supported\n");
-                return -ENODEV;
+                ret = -ENODEV;
-        }
+        } else if (logical_to_sectors(sdkp->device, zone_blocks) > UINT_MAX) {
-        if (logical_to_sectors(sdkp->device, zone_blocks) > UINT_MAX) {
                if (sdkp->first_scan)
                        sd_printk(KERN_NOTICE, sdkp,
                                  "Zone size too large\n");
-                return -ENODEV;
+                ret = -ENODEV;
+        } else {
+                sdkp->zone_blocks = zone_blocks;
+                sdkp->zone_shift = ilog2(zone_blocks);
        }
-        sdkp->zone_blocks = zone_blocks;
+out_free:
-        sdkp->zone_shift = ilog2(zone_blocks);
+        kfree(buf);
-        return 0;
+        return ret;
 }
 /**
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index 6dbba5aff191..86580b6df33d 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -326,24 +326,23 @@ static loff_t ashmem_llseek(struct file *file, loff_t offset, int origin)
        mutex_lock(&ashmem_mutex);
        if (asma->size == 0) {
-                ret = -EINVAL;
+                mutex_unlock(&ashmem_mutex);
-                goto out;
+                return -EINVAL;
        }
        if (!asma->file) {
-                ret = -EBADF;
+                mutex_unlock(&ashmem_mutex);
-                goto out;
+                return -EBADF;
        }
+        mutex_unlock(&ashmem_mutex);
        ret = vfs_llseek(asma->file, offset, origin);
        if (ret < 0)
-                goto out;
+                return ret;
        /** Copy f_pos from backing file, since f_ops->llseek() sets it */
        file->f_pos = asma->file->f_pos;
-out:
-        mutex_unlock(&ashmem_mutex);
        return ret;
 }
@@ -702,16 +701,14 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
        size_t pgstart, pgend;
        int ret = -EINVAL;
+        if (unlikely(copy_from_user(&pin, p, sizeof(pin))))
+                return -EFAULT;
        mutex_lock(&ashmem_mutex);
        if (unlikely(!asma->file))
                goto out_unlock;
-        if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) {
-                ret = -EFAULT;
-                goto out_unlock;
-        }
        /* per custom, you can pass zero for len to mean "everything onward" */
        if (!pin.len)
                pin.len = PAGE_ALIGN(asma->size) - pin.offset;
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index e618a87521a3..9d733471ca2e 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -475,8 +475,7 @@ unsigned int comedi_nsamples_left(struct comedi_subdevice *s,
        struct comedi_cmd *cmd = &async->cmd;
        if (cmd->stop_src == TRIG_COUNT) {
-                unsigned int nscans = nsamples / cmd->scan_end_arg;
+                unsigned int scans_left = __comedi_nscans_left(s, cmd->stop_arg);
-                unsigned int scans_left = __comedi_nscans_left(s, nscans);
                unsigned int scan_pos =
                    comedi_bytes_to_samples(s, async->scan_progress);
                unsigned long long samples_left = 0;
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 5c0e59e8fe46..cbe98bc2b998 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2180,6 +2180,12 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
                                }
                                if (tty_hung_up_p(file))
                                        break;
+                                /*
+                                 * Abort readers for ttys which never actually
+                                 * get hung up.  See __tty_hangup().
+                                 */
+                                if (test_bit(TTY_HUPPING, &tty->flags))
+                                        break;
                                if (!timeout)
                                        break;
                                if (file->f_flags & O_NONBLOCK) {
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 54adf8d56350..a93f77ab3da0 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -3387,11 +3387,9 @@ static int serial_pci_is_class_communication(struct pci_dev *dev)
        /*
         * If it is not a communications device or the programming
         * interface is greater than 6, give up.
-         *
-         * (Should we try to make guesses for multiport serial devices
-         * later?)
         */
        if ((((dev->class >> 8) != PCI_CLASS_COMMUNICATION_SERIAL) &&
+             ((dev->class >> 8) != PCI_CLASS_COMMUNICATION_MULTISERIAL) &&
             ((dev->class >> 8) != PCI_CLASS_COMMUNICATION_MODEM)) ||
            (dev->class & 0xff) > 6)
                return -ENODEV;
@@ -3428,6 +3426,12 @@ serial_pci_guess_board(struct pci_dev *dev, struct pciserial_board *board)
 {
        int num_iomem, num_port, first_port = -1, i;
+        /*
+         * Should we try to make guesses for multiport serial devices later?
+         */
+        if ((dev->class >> 8) == PCI_CLASS_COMMUNICATION_MULTISERIAL)
+                return -ENODEV;
        num_iomem = num_port = 0;
        for (i = 0; i < PCI_NUM_BAR_RESOURCES; i++) {
                if (pci_resource_flags(dev, i) & IORESOURCE_IO) {
@@ -4699,6 +4703,17 @@ static const struct pci_device_id serial_pci_tbl[] = {
                PCI_ANY_ID, PCI_ANY_ID, 0, 0,    /* 135a.0dc0 */
                pbn_b2_4_115200 },
        /*
+         * BrainBoxes UC-260
+         */
+        {       PCI_VENDOR_ID_INTASHIELD, 0x0D21,
+                PCI_ANY_ID, PCI_ANY_ID,
+                PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00,
+                pbn_b2_4_115200 },
+        {       PCI_VENDOR_ID_INTASHIELD, 0x0E34,
+                PCI_ANY_ID, PCI_ANY_ID,
+                 PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00,
+                pbn_b2_4_115200 },
+        /*
         * Perle PCI-RAS cards
         */
        {       PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_9030,
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index df46a9e88c34..e287fe8f10fc 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -1734,6 +1734,7 @@ static void atmel_get_ip_name(struct uart_port *port)
                switch (version) {
                case 0x302:
                case 0x10213:
+                case 0x10302:
                        dev_dbg(port->dev, "This version is usart\n");
                        atmel_port->has_frac_baudrate = true;
                        atmel_port->has_hw_timer = true;
diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c
index 870e84fb6e39..a24278380fec 100644
--- a/drivers/tty/serial/earlycon.c
+++ b/drivers/tty/serial/earlycon.c
@@ -245,11 +245,12 @@ int __init of_setup_earlycon(const struct earlycon_id *match,
        }
        port->mapbase = addr;
        port->uartclk = BASE_BAUD * 16;
-        port->membase = earlycon_map(port->mapbase, SZ_4K);
        val = of_get_flat_dt_prop(node, "reg-offset", NULL);
        if (val)
                port->mapbase += be32_to_cpu(*val);
+        port->membase = earlycon_map(port->mapbase, SZ_4K);
        val = of_get_flat_dt_prop(node, "reg-shift", NULL);
        if (val)
                port->regshift = be32_to_cpu(*val);
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 1d7ca382bc12..a33c685af990 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2093,7 +2093,7 @@ static int serial_imx_probe(struct platform_device *pdev)
        uart_get_rs485_mode(&pdev->dev, &sport->port.rs485);
        if (sport->port.rs485.flags & SER_RS485_ENABLED &&
-            (!sport->have_rtscts || !sport->have_rtsgpio))
+            (!sport->have_rtscts && !sport->have_rtsgpio))
                dev_err(&pdev->dev, "no RTS control, disabling rs485\n");
        imx_rs485_config(&sport->port, &sport->port.rs485);
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index c8dde56b532b..35b9201db3b4 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1144,6 +1144,8 @@ static int uart_do_autoconfig(struct tty_struct *tty,struct uart_state *state)
                uport->ops->config_port(uport, flags);
                ret = uart_startup(tty, state, 1);
+                if (ret == 0)
+                        tty_port_set_initialized(port, true);
                if (ret > 0)
                        ret = 0;
        }
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 7257c078e155..44adf9db38f8 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -885,6 +885,8 @@ static void sci_receive_chars(struct uart_port *port)
                /* Tell the rest of the system the news. New characters! */
                tty_flip_buffer_push(tport);
        } else {
+                /* TTY buffers full; read from RX reg to prevent lockup */
+                serial_port_in(port, SCxRDR);
                serial_port_in(port, SCxSR); /* dummy read */
                sci_clear_SCxSR(port, SCxSR_RDxF_CLEAR(port));
        }
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index eb9133b472f4..63114ea35ec1 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -586,6 +586,14 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session)
                return;
        }
+        /*
+         * Some console devices aren't actually hung up for technical and
+         * historical reasons, which can lead to indefinite interruptible
+         * sleep in n_tty_read().  The following explicitly tells
+         * n_tty_read() to abort readers.
+         */
+        set_bit(TTY_HUPPING, &tty->flags);
        /* inuse_filps is protected by the single tty lock,
           this really needs to change if we want to flush the
           workqueue with the lock held */
@@ -640,6 +648,7 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session)
         * from the ldisc side, which is now guaranteed.
         */
        set_bit(TTY_HUPPED, &tty->flags);
+        clear_bit(TTY_HUPPING, &tty->flags);
        tty_unlock(tty);
        if (f)
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index c64cf6c4a83d..0c11d40a12bc 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -151,6 +151,10 @@ int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request,
        ret = usb_internal_control_msg(dev, pipe, dr, data, size, timeout);
+        /* Linger a bit, prior to the next control message. */
+        if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG)
+                msleep(200);
        kfree(dr);
        return ret;
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index f4a548471f0f..54b019e267c5 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -230,7 +230,8 @@ static const struct usb_device_id usb_quirk_list[] = {
        { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
        /* Corsair Strafe RGB */
-        { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
+        { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT |
+          USB_QUIRK_DELAY_CTRL_MSG },
        /* Corsair K70 LUX */
        { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
index 03fd20f0b496..c4a47496d2fb 100644
--- a/drivers/usb/dwc2/params.c
+++ b/drivers/usb/dwc2/params.c
@@ -137,7 +137,7 @@ static void dwc2_set_stm32f4x9_fsotg_params(struct dwc2_hsotg *hsotg)
        p->activate_stm_fs_transceiver = true;
 }
-static void dwc2_set_stm32f7xx_hsotg_params(struct dwc2_hsotg *hsotg)
+static void dwc2_set_stm32f7_hsotg_params(struct dwc2_hsotg *hsotg)
 {
        struct dwc2_core_params *p = &hsotg->params;
@@ -164,8 +164,8 @@ const struct of_device_id dwc2_of_match_table[] = {
        { .compatible = "st,stm32f4x9-fsotg",
          .data = dwc2_set_stm32f4x9_fsotg_params },
        { .compatible = "st,stm32f4x9-hsotg" },
-        { .compatible = "st,stm32f7xx-hsotg",
+        { .compatible = "st,stm32f7-hsotg",
-          .data = dwc2_set_stm32f7xx_hsotg_params },
+          .data = dwc2_set_stm32f7_hsotg_params },
        {},
 };
 MODULE_DEVICE_TABLE(of, dwc2_of_match_table);
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index f1d838a4acd6..e94bf91cc58a 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -175,7 +175,7 @@ void dwc3_set_mode(struct dwc3 *dwc, u32 mode)
        dwc->desired_dr_role = mode;
        spin_unlock_irqrestore(&dwc->lock, flags);
-        queue_work(system_power_efficient_wq, &dwc->drd_work);
+        queue_work(system_freezable_wq, &dwc->drd_work);
 }
 u32 dwc3_core_fifo_space(struct dwc3_ep *dep, u8 type)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index c2592d883f67..d2428a9e8900 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1538,7 +1538,6 @@ ffs_fs_kill_sb(struct super_block *sb)
        if (sb->s_fs_info) {
                ffs_release_dev(sb->s_fs_info);
                ffs_data_closed(sb->s_fs_info);
-                ffs_data_put(sb->s_fs_info);
        }
 }
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 84f88fa411cd..d088c340e4d0 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -447,7 +447,8 @@ static int ohci_init (struct ohci_hcd *ohci)
        struct usb_hcd *hcd = ohci_to_hcd(ohci);
        /* Accept arbitrarily long scatter-gather lists */
-        hcd->self.sg_tablesize = ~0;
+        if (!(hcd->driver->flags & HCD_LOCAL_MEM))
+                hcd->self.sg_tablesize = ~0;
        if (distrust_firmware)
                ohci->flags |= OHCI_QUIRK_HUB_POWER;
diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c
index a1ab8acf39ba..c359bae7b754 100644
--- a/drivers/usb/host/xhci-dbgcap.c
+++ b/drivers/usb/host/xhci-dbgcap.c
@@ -328,13 +328,14 @@ dbc_ep_do_queue(struct dbc_ep *dep, struct dbc_request *req)
 int dbc_ep_queue(struct dbc_ep *dep, struct dbc_request *req,
                 gfp_t gfp_flags)
 {
+        unsigned long           flags;
        struct xhci_dbc         *dbc = dep->dbc;
        int                     ret = -ESHUTDOWN;
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
        if (dbc->state == DS_CONFIGURED)
                ret = dbc_ep_do_queue(dep, req);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
        mod_delayed_work(system_wq, &dbc->event_work, 0);
@@ -521,15 +522,16 @@ static void xhci_do_dbc_stop(struct xhci_hcd *xhci)
 static int xhci_dbc_start(struct xhci_hcd *xhci)
 {
        int                     ret;
+        unsigned long           flags;
        struct xhci_dbc         *dbc = xhci->dbc;
        WARN_ON(!dbc);
        pm_runtime_get_sync(xhci_to_hcd(xhci)->self.controller);
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
        ret = xhci_do_dbc_start(xhci);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
        if (ret) {
                pm_runtime_put(xhci_to_hcd(xhci)->self.controller);
@@ -541,6 +543,7 @@ static int xhci_dbc_start(struct xhci_hcd *xhci)
 static void xhci_dbc_stop(struct xhci_hcd *xhci)
 {
+        unsigned long           flags;
        struct xhci_dbc         *dbc = xhci->dbc;
        struct dbc_port         *port = &dbc->port;
@@ -551,9 +554,9 @@ static void xhci_dbc_stop(struct xhci_hcd *xhci)
        if (port->registered)
                xhci_dbc_tty_unregister_device(xhci);
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
        xhci_do_dbc_stop(xhci);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
        pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller);
 }
@@ -779,14 +782,15 @@ static void xhci_dbc_handle_events(struct work_struct *work)
        int                     ret;
        enum evtreturn          evtr;
        struct xhci_dbc         *dbc;
+        unsigned long           flags;
        struct xhci_hcd         *xhci;
        dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work);
        xhci = dbc->xhci;
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
        evtr = xhci_dbc_do_handle_events(dbc);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
        switch (evtr) {
        case EVT_GSER:
diff --git a/drivers/usb/host/xhci-dbgtty.c b/drivers/usb/host/xhci-dbgtty.c
index 8d47b6fbf973..75f0b92694ba 100644
--- a/drivers/usb/host/xhci-dbgtty.c
+++ b/drivers/usb/host/xhci-dbgtty.c
@@ -92,21 +92,23 @@ static void dbc_start_rx(struct dbc_port *port)
 static void
 dbc_read_complete(struct xhci_hcd *xhci, struct dbc_request *req)
 {
+        unsigned long           flags;
        struct xhci_dbc         *dbc = xhci->dbc;
        struct dbc_port         *port = &dbc->port;
-        spin_lock(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
        list_add_tail(&req->list_pool, &port->read_queue);
        tasklet_schedule(&port->push);
-        spin_unlock(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
 }
 static void dbc_write_complete(struct xhci_hcd *xhci, struct dbc_request *req)
 {
+        unsigned long           flags;
        struct xhci_dbc         *dbc = xhci->dbc;
        struct dbc_port         *port = &dbc->port;
-        spin_lock(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
        list_add(&req->list_pool, &port->write_pool);
        switch (req->status) {
        case 0:
@@ -119,7 +121,7 @@ static void dbc_write_complete(struct xhci_hcd *xhci, struct dbc_request *req)
                          req->status);
                break;
        }
-        spin_unlock(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
 }
 static void xhci_dbc_free_req(struct dbc_ep *dep, struct dbc_request *req)
@@ -327,12 +329,13 @@ static void dbc_rx_push(unsigned long _port)
 {
        struct dbc_request      *req;
        struct tty_struct       *tty;
+        unsigned long           flags;
        bool                    do_push = false;
        bool                    disconnect = false;
        struct dbc_port         *port = (void *)_port;
        struct list_head        *queue = &port->read_queue;
-        spin_lock_irq(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
        tty = port->port.tty;
        while (!list_empty(queue)) {
                req = list_first_entry(queue, struct dbc_request, list_pool);
@@ -392,16 +395,17 @@ static void dbc_rx_push(unsigned long _port)
        if (!disconnect)
                dbc_start_rx(port);
-        spin_unlock_irq(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
 }
 static int dbc_port_activate(struct tty_port *_port, struct tty_struct *tty)
 {
+        unsigned long   flags;
        struct dbc_port *port = container_of(_port, struct dbc_port, port);
-        spin_lock_irq(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
        dbc_start_rx(port);
-        spin_unlock_irq(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
        return 0;
 }
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 5262fa571a5d..d9f831b67e57 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -126,6 +126,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
        if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
                xhci->quirks |= XHCI_AMD_PLL_FIX;
+        if (pdev->vendor == PCI_VENDOR_ID_AMD && pdev->device == 0x43bb)
+                xhci->quirks |= XHCI_SUSPEND_DELAY;
        if (pdev->vendor == PCI_VENDOR_ID_AMD)
                xhci->quirks |= XHCI_TRUST_TX_LENGTH;
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 6f038306c14d..6652e2d5bd2e 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -360,7 +360,6 @@ static int __maybe_unused xhci_plat_suspend(struct device *dev)
 {
        struct usb_hcd  *hcd = dev_get_drvdata(dev);
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
-        int ret;
        /*
         * xhci_suspend() needs `do_wakeup` to know whether host is allowed
@@ -370,12 +369,7 @@ static int __maybe_unused xhci_plat_suspend(struct device *dev)
         * reconsider this when xhci_plat_suspend enlarges its scope, e.g.,
         * also applies to runtime suspend.
         */
-        ret = xhci_suspend(xhci, device_may_wakeup(dev));
+        return xhci_suspend(xhci, device_may_wakeup(dev));
-        if (!device_may_wakeup(dev) && !IS_ERR(xhci->clk))
-                clk_disable_unprepare(xhci->clk);
-        return ret;
 }
 static int __maybe_unused xhci_plat_resume(struct device *dev)
@@ -384,9 +378,6 @@ static int __maybe_unused xhci_plat_resume(struct device *dev)
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
        int ret;
-        if (!device_may_wakeup(dev) && !IS_ERR(xhci->clk))
-                clk_prepare_enable(xhci->clk);
        ret = xhci_priv_resume_quirk(hcd);
        if (ret)
                return ret;
diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
index f0b559660007..f33ffc2bc4ed 100644
--- a/drivers/usb/host/xhci-rcar.c
+++ b/drivers/usb/host/xhci-rcar.c
@@ -83,6 +83,10 @@ static const struct soc_device_attribute rcar_quirks_match[]  = {
                .soc_id = "r8a7796",
                .data = (void *)RCAR_XHCI_FIRMWARE_V3,
        },
+        {
+                .soc_id = "r8a77965",
+                .data = (void *)RCAR_XHCI_FIRMWARE_V3,
+        },
        { /* sentinel */ },
 };
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 25d4b748a56f..5d37700ae4b0 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -877,6 +877,9 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
        clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
        del_timer_sync(&xhci->shared_hcd->rh_timer);
+        if (xhci->quirks & XHCI_SUSPEND_DELAY)
+                usleep_range(1000, 1500);
        spin_lock_irq(&xhci->lock);
        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index e4d7d3d06a75..866e141d4972 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -718,11 +718,12 @@ struct xhci_ep_ctx {
 /* bits 10:14 are Max Primary Streams */
 /* bit 15 is Linear Stream Array */
 /* Interval - period between requests to an endpoint - 125u increments. */
-#define EP_INTERVAL(p)          (((p) & 0xff) << 16)
+#define EP_INTERVAL(p)                  (((p) & 0xff) << 16)
-#define EP_INTERVAL_TO_UFRAMES(p)               (1 << (((p) >> 16) & 0xff))
+#define EP_INTERVAL_TO_UFRAMES(p)       (1 << (((p) >> 16) & 0xff))
-#define CTX_TO_EP_INTERVAL(p)   (((p) >> 16) & 0xff)
+#define CTX_TO_EP_INTERVAL(p)           (((p) >> 16) & 0xff)
-#define EP_MAXPSTREAMS_MASK     (0x1f << 10)
+#define EP_MAXPSTREAMS_MASK             (0x1f << 10)
-#define EP_MAXPSTREAMS(p)       (((p) << 10) & EP_MAXPSTREAMS_MASK)
+#define EP_MAXPSTREAMS(p)               (((p) << 10) & EP_MAXPSTREAMS_MASK)
+#define CTX_TO_EP_MAXPSTREAMS(p)        (((p) & EP_MAXPSTREAMS_MASK) >> 10)
 /* Endpoint is set up with a Linear Stream Array (vs. Secondary Stream Array) */
 #define EP_HAS_LSA              (1 << 15)
 /* hosts with LEC=1 use bits 31:24 as ESIT high bits. */
@@ -1825,6 +1826,7 @@ struct xhci_hcd {
 #define XHCI_U2_DISABLE_WAKE    (1 << 27)
 #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28)
 #define XHCI_HW_LPM_DISABLE     (1 << 29)
+#define XHCI_SUSPEND_DELAY      (1 << 30)
        unsigned int            num_active_eps;
        unsigned int            limit_active_eps;
@@ -2549,21 +2551,22 @@ static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq,
        u8 burst;
        u8 cerr;
        u8 mult;
-        u8 lsa;
-        u8 hid;
+        bool lsa;
+        bool hid;
        esit = CTX_TO_MAX_ESIT_PAYLOAD_HI(info) << 16 |
                CTX_TO_MAX_ESIT_PAYLOAD(tx_info);
        ep_state = info & EP_STATE_MASK;
-        max_pstr = info & EP_MAXPSTREAMS_MASK;
+        max_pstr = CTX_TO_EP_MAXPSTREAMS(info);
        interval = CTX_TO_EP_INTERVAL(info);
        mult = CTX_TO_EP_MULT(info) + 1;
-        lsa = info & EP_HAS_LSA;
+        lsa = !!(info & EP_HAS_LSA);
        cerr = (info2 & (3 << 1)) >> 1;
        ep_type = CTX_TO_EP_TYPE(info2);
-        hid = info2 & (1 << 7);
+        hid = !!(info2 & (1 << 7));
        burst = CTX_TO_MAX_BURST(info2);
        maxp = MAX_PACKET_DECODED(info2);
diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c
index f5e1bb5e5217..984f7e12a6a5 100644
--- a/drivers/usb/mon/mon_text.c
+++ b/drivers/usb/mon/mon_text.c
@@ -85,6 +85,8 @@ struct mon_reader_text {
        wait_queue_head_t wait;
        int printf_size;
+        size_t printf_offset;
+        size_t printf_togo;
        char *printf_buf;
        struct mutex printf_lock;
@@ -376,75 +378,103 @@ err_alloc:
        return rc;
 }
-/*
+static ssize_t mon_text_copy_to_user(struct mon_reader_text *rp,
- * For simplicity, we read one record in one system call and throw out
+    char __user * const buf, const size_t nbytes)
- * what does not fit. This means that the following does not work:
+{
- *   dd if=/dbg/usbmon/0t bs=10
+        const size_t togo = min(nbytes, rp->printf_togo);
- * Also, we do not allow seeks and do not bother advancing the offset.
- */
+        if (copy_to_user(buf, &rp->printf_buf[rp->printf_offset], togo))
+                return -EFAULT;
+        rp->printf_togo -= togo;
+        rp->printf_offset += togo;
+        return togo;
+}
+/* ppos is not advanced since the llseek operation is not permitted. */
 static ssize_t mon_text_read_t(struct file *file, char __user *buf,
-                                size_t nbytes, loff_t *ppos)
+    size_t nbytes, loff_t *ppos)
 {
        struct mon_reader_text *rp = file->private_data;
        struct mon_event_text *ep;
        struct mon_text_ptr ptr;
+        ssize_t ret;
-        ep = mon_text_read_wait(rp, file);
-        if (IS_ERR(ep))
-                return PTR_ERR(ep);
        mutex_lock(&rp->printf_lock);
-        ptr.cnt = 0;
-        ptr.pbuf = rp->printf_buf;
+        if (rp->printf_togo == 0) {
-        ptr.limit = rp->printf_size;
+                ep = mon_text_read_wait(rp, file);
-        mon_text_read_head_t(rp, &ptr, ep);
+                if (IS_ERR(ep)) {
-        mon_text_read_statset(rp, &ptr, ep);
+                        mutex_unlock(&rp->printf_lock);
-        ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+                        return PTR_ERR(ep);
-            " %d", ep->length);
+                }
-        mon_text_read_data(rp, &ptr, ep);
+                ptr.cnt = 0;
+                ptr.pbuf = rp->printf_buf;
-        if (copy_to_user(buf, rp->printf_buf, ptr.cnt))
+                ptr.limit = rp->printf_size;
-                ptr.cnt = -EFAULT;
+                mon_text_read_head_t(rp, &ptr, ep);
+                mon_text_read_statset(rp, &ptr, ep);
+                ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+                    " %d", ep->length);
+                mon_text_read_data(rp, &ptr, ep);
+                rp->printf_togo = ptr.cnt;
+                rp->printf_offset = 0;
+                kmem_cache_free(rp->e_slab, ep);
+        }
+        ret = mon_text_copy_to_user(rp, buf, nbytes);
        mutex_unlock(&rp->printf_lock);
-        kmem_cache_free(rp->e_slab, ep);
+        return ret;
-        return ptr.cnt;
 }
+/* ppos is not advanced since the llseek operation is not permitted. */
 static ssize_t mon_text_read_u(struct file *file, char __user *buf,
-                                size_t nbytes, loff_t *ppos)
+    size_t nbytes, loff_t *ppos)
 {
        struct mon_reader_text *rp = file->private_data;
        struct mon_event_text *ep;
        struct mon_text_ptr ptr;
+        ssize_t ret;
-        ep = mon_text_read_wait(rp, file);
-        if (IS_ERR(ep))
-                return PTR_ERR(ep);
        mutex_lock(&rp->printf_lock);
-        ptr.cnt = 0;
-        ptr.pbuf = rp->printf_buf;
-        ptr.limit = rp->printf_size;
-        mon_text_read_head_u(rp, &ptr, ep);
+        if (rp->printf_togo == 0) {
-        if (ep->type == 'E') {
-                mon_text_read_statset(rp, &ptr, ep);
+                ep = mon_text_read_wait(rp, file);
-        } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) {
+                if (IS_ERR(ep)) {
-                mon_text_read_isostat(rp, &ptr, ep);
+                        mutex_unlock(&rp->printf_lock);
-                mon_text_read_isodesc(rp, &ptr, ep);
+                        return PTR_ERR(ep);
-        } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) {
+                }
-                mon_text_read_intstat(rp, &ptr, ep);
+                ptr.cnt = 0;
-        } else {
+                ptr.pbuf = rp->printf_buf;
-                mon_text_read_statset(rp, &ptr, ep);
+                ptr.limit = rp->printf_size;
+                mon_text_read_head_u(rp, &ptr, ep);
+                if (ep->type == 'E') {
+                        mon_text_read_statset(rp, &ptr, ep);
+                } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) {
+                        mon_text_read_isostat(rp, &ptr, ep);
+                        mon_text_read_isodesc(rp, &ptr, ep);
+                } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) {
+                        mon_text_read_intstat(rp, &ptr, ep);
+                } else {
+                        mon_text_read_statset(rp, &ptr, ep);
+                }
+                ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+                    " %d", ep->length);
+                mon_text_read_data(rp, &ptr, ep);
+                rp->printf_togo = ptr.cnt;
+                rp->printf_offset = 0;
+                kmem_cache_free(rp->e_slab, ep);
        }
-        ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
-            " %d", ep->length);
-        mon_text_read_data(rp, &ptr, ep);
-        if (copy_to_user(buf, rp->printf_buf, ptr.cnt))
+        ret = mon_text_copy_to_user(rp, buf, nbytes);
-                ptr.cnt = -EFAULT;
        mutex_unlock(&rp->printf_lock);
-        kmem_cache_free(rp->e_slab, ep);
+        return ret;
-        return ptr.cnt;
 }
 static struct mon_event_text *mon_text_read_wait(struct mon_reader_text *rp,
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index eef4ad578b31..4d723077be2b 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1756,6 +1756,7 @@ vbus_show(struct device *dev, struct device_attribute *attr, char *buf)
        int             vbus;
        u8              devctl;
+        pm_runtime_get_sync(dev);
        spin_lock_irqsave(&musb->lock, flags);
        val = musb->a_wait_bcon;
        vbus = musb_platform_get_vbus_status(musb);
@@ -1769,6 +1770,7 @@ vbus_show(struct device *dev, struct device_attribute *attr, char *buf)
                        vbus = 0;
        }
        spin_unlock_irqrestore(&musb->lock, flags);
+        pm_runtime_put_sync(dev);
        return sprintf(buf, "Vbus %s, timeout %lu msec\n",
                        vbus ? "on" : "off", val);
@@ -2471,11 +2473,11 @@ static int musb_remove(struct platform_device *pdev)
        musb_disable_interrupts(musb);
        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
        spin_unlock_irqrestore(&musb->lock, flags);
+        musb_platform_exit(musb);
        pm_runtime_dont_use_autosuspend(musb->controller);
        pm_runtime_put_sync(musb->controller);
        pm_runtime_disable(musb->controller);
-        musb_platform_exit(musb);
        musb_phy_callback = NULL;
        if (musb->dma_controller)
                musb_dma_controller_destroy(musb->dma_controller);
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index 3b1b9695177a..6034c39b67d1 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -1076,7 +1076,7 @@ static int uas_post_reset(struct usb_interface *intf)
                return 0;
        err = uas_configure_endpoints(devinfo);
-        if (err && err != ENODEV)
+        if (err && err != -ENODEV)
                shost_printk(KERN_ERR, shost,
                             "%s: alloc streams error %d after reset",
                             __func__, err);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 264af199aec8..747d3a9596d9 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2118,6 +2118,13 @@ UNUSUAL_DEV(  0x152d, 0x2566, 0x0114, 0x0114,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_BROKEN_FUA ),
+/* Reported by Teijo Kinnunen <teijo.kinnunen@code-q.fi> */
+UNUSUAL_DEV(  0x152d, 0x2567, 0x0117, 0x0117,
+                "JMicron",
+                "USB to ATA/ATAPI Bridge",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_BROKEN_FUA ),
 /* Reported-by George Cherian <george.cherian@cavium.com> */
 UNUSUAL_DEV(0x152d, 0x9561, 0x0000, 0x9999,
                "JMicron",
diff --git a/drivers/usb/typec/fusb302/fusb302.c b/drivers/usb/typec/fusb302/fusb302.c
index 9ce4756adad6..dcd8ef085b30 100644
--- a/drivers/usb/typec/fusb302/fusb302.c
+++ b/drivers/usb/typec/fusb302/fusb302.c
@@ -1857,7 +1857,8 @@ static int fusb302_probe(struct i2c_client *client,
        chip->tcpm_port = tcpm_register_port(&client->dev, &chip->tcpc_dev);
        if (IS_ERR(chip->tcpm_port)) {
                ret = PTR_ERR(chip->tcpm_port);
-                dev_err(dev, "cannot register tcpm port, ret=%d", ret);
+                if (ret != -EPROBE_DEFER)
+                        dev_err(dev, "cannot register tcpm port, ret=%d", ret);
                goto destroy_workqueue;
        }
diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index f4d563ee7690..8b637a4b474b 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -252,9 +252,6 @@ struct tcpm_port {
        unsigned int nr_src_pdo;
        u32 snk_pdo[PDO_MAX_OBJECTS];
        unsigned int nr_snk_pdo;
-        unsigned int nr_fixed; /* number of fixed sink PDOs */
-        unsigned int nr_var; /* number of variable sink PDOs */
-        unsigned int nr_batt; /* number of battery sink PDOs */
        u32 snk_vdo[VDO_MAX_OBJECTS];
        unsigned int nr_snk_vdo;
@@ -1770,90 +1767,39 @@ static int tcpm_pd_check_request(struct tcpm_port *port)
        return 0;
 }
-#define min_power(x, y) min(pdo_max_power(x), pdo_max_power(y))
+static int tcpm_pd_select_pdo(struct tcpm_port *port)
-#define min_current(x, y) min(pdo_max_current(x), pdo_max_current(y))
-static int tcpm_pd_select_pdo(struct tcpm_port *port, int *sink_pdo,
-                              int *src_pdo)
 {
-        unsigned int i, j, max_mw = 0, max_mv = 0, mw = 0, mv = 0, ma = 0;
+        unsigned int i, max_mw = 0, max_mv = 0;
        int ret = -EINVAL;
        /*
-         * Select the source PDO providing the most power which has a
+         * Select the source PDO providing the most power while staying within
-         * matchig sink cap.
+         * the board's voltage limits. Prefer PDO providing exp
         */
        for (i = 0; i < port->nr_source_caps; i++) {
                u32 pdo = port->source_caps[i];
                enum pd_pdo_type type = pdo_type(pdo);
+                unsigned int mv, ma, mw;
-                if (type == PDO_TYPE_FIXED) {
+                if (type == PDO_TYPE_FIXED)
-                        for (j = 0; j < port->nr_fixed; j++) {
+                        mv = pdo_fixed_voltage(pdo);
-                                if (pdo_fixed_voltage(pdo) ==
+                else
-                                    pdo_fixed_voltage(port->snk_pdo[j])) {
+                        mv = pdo_min_voltage(pdo);
-                                        ma = min_current(pdo, port->snk_pdo[j]);
-                                        mv = pdo_fixed_voltage(pdo);
+                if (type == PDO_TYPE_BATT) {
-                                        mw = ma * mv / 1000;
+                        mw = pdo_max_power(pdo);
-                                        if (mw > max_mw ||
+                } else {
-                                            (mw == max_mw && mv > max_mv)) {
+                        ma = min(pdo_max_current(pdo),
-                                                ret = 0;
+                                 port->max_snk_ma);
-                                                *src_pdo = i;
+                        mw = ma * mv / 1000;
-                                                *sink_pdo = j;
+                }
-                                                max_mw = mw;
-                                                max_mv = mv;
+                /* Perfer higher voltages if available */
-                                        }
+                if ((mw > max_mw || (mw == max_mw && mv > max_mv)) &&
-                                        /* There could only be one fixed pdo
+                    mv <= port->max_snk_mv) {
-                                         * at a specific voltage level.
+                        ret = i;
-                                         * So breaking here.
+                        max_mw = mw;
-                                         */
+                        max_mv = mv;
-                                        break;
-                                }
-                        }
-                } else if (type == PDO_TYPE_BATT) {
-                        for (j = port->nr_fixed;
-                             j < port->nr_fixed +
-                                 port->nr_batt;
-                             j++) {
-                                if (pdo_min_voltage(pdo) >=
-                                     pdo_min_voltage(port->snk_pdo[j]) &&
-                                     pdo_max_voltage(pdo) <=
-                                     pdo_max_voltage(port->snk_pdo[j])) {
-                                        mw = min_power(pdo, port->snk_pdo[j]);
-                                        mv = pdo_min_voltage(pdo);
-                                        if (mw > max_mw ||
-                                            (mw == max_mw && mv > max_mv)) {
-                                                ret = 0;
-                                                *src_pdo = i;
-                                                *sink_pdo = j;
-                                                max_mw = mw;
-                                                max_mv = mv;
-                                        }
-                                }
-                        }
-                } else if (type == PDO_TYPE_VAR) {
-                        for (j = port->nr_fixed +
-                                 port->nr_batt;
-                             j < port->nr_fixed +
-                                 port->nr_batt +
-                                 port->nr_var;
-                             j++) {
-                                if (pdo_min_voltage(pdo) >=
-                                     pdo_min_voltage(port->snk_pdo[j]) &&
-                                     pdo_max_voltage(pdo) <=
-                                     pdo_max_voltage(port->snk_pdo[j])) {
-                                        ma = min_current(pdo, port->snk_pdo[j]);
-                                        mv = pdo_min_voltage(pdo);
-                                        mw = ma * mv / 1000;
-                                        if (mw > max_mw ||
-                                            (mw == max_mw && mv > max_mv)) {
-                                                ret = 0;
-                                                *src_pdo = i;
-                                                *sink_pdo = j;
-                                                max_mw = mw;
-                                                max_mv = mv;
-                                        }
-                                }
-                        }
                }
        }
@@ -1865,14 +1811,13 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
        unsigned int mv, ma, mw, flags;
        unsigned int max_ma, max_mw;
        enum pd_pdo_type type;
-        int src_pdo_index, snk_pdo_index;
+        int index;
-        u32 pdo, matching_snk_pdo;
+        u32 pdo;
-        if (tcpm_pd_select_pdo(port, &snk_pdo_index, &src_pdo_index) < 0)
+        index = tcpm_pd_select_pdo(port);
+        if (index < 0)
                return -EINVAL;
+        pdo = port->source_caps[index];
-        pdo = port->source_caps[src_pdo_index];
-        matching_snk_pdo = port->snk_pdo[snk_pdo_index];
        type = pdo_type(pdo);
        if (type == PDO_TYPE_FIXED)
@@ -1880,28 +1825,26 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
        else
                mv = pdo_min_voltage(pdo);
-        /* Select maximum available current within the sink pdo's limit */
+        /* Select maximum available current within the board's power limit */
        if (type == PDO_TYPE_BATT) {
-                mw = min_power(pdo, matching_snk_pdo);
+                mw = pdo_max_power(pdo);
-                ma = 1000 * mw / mv;
+                ma = 1000 * min(mw, port->max_snk_mw) / mv;
        } else {
-                ma = min_current(pdo, matching_snk_pdo);
+                ma = min(pdo_max_current(pdo),
-                mw = ma * mv / 1000;
+                         1000 * port->max_snk_mw / mv);
        }
+        ma = min(ma, port->max_snk_ma);
        flags = RDO_USB_COMM | RDO_NO_SUSPEND;
        /* Set mismatch bit if offered power is less than operating power */
+        mw = ma * mv / 1000;
        max_ma = ma;
        max_mw = mw;
        if (mw < port->operating_snk_mw) {
                flags |= RDO_CAP_MISMATCH;
-                if (type == PDO_TYPE_BATT &&
+                max_mw = port->operating_snk_mw;
-                    (pdo_max_power(matching_snk_pdo) > pdo_max_power(pdo)))
+                max_ma = max_mw * 1000 / mv;
-                        max_mw = pdo_max_power(matching_snk_pdo);
-                else if (pdo_max_current(matching_snk_pdo) >
-                         pdo_max_current(pdo))
-                        max_ma = pdo_max_current(matching_snk_pdo);
        }
        tcpm_log(port, "cc=%d cc1=%d cc2=%d vbus=%d vconn=%s polarity=%d",
@@ -1910,16 +1853,16 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
                 port->polarity);
        if (type == PDO_TYPE_BATT) {
-                *rdo = RDO_BATT(src_pdo_index + 1, mw, max_mw, flags);
+                *rdo = RDO_BATT(index + 1, mw, max_mw, flags);
                tcpm_log(port, "Requesting PDO %d: %u mV, %u mW%s",
-                         src_pdo_index, mv, mw,
+                         index, mv, mw,
                         flags & RDO_CAP_MISMATCH ? " [mismatch]" : "");
        } else {
-                *rdo = RDO_FIXED(src_pdo_index + 1, ma, max_ma, flags);
+                *rdo = RDO_FIXED(index + 1, ma, max_ma, flags);
                tcpm_log(port, "Requesting PDO %d: %u mV, %u mA%s",
-                         src_pdo_index, mv, ma,
+                         index, mv, ma,
                         flags & RDO_CAP_MISMATCH ? " [mismatch]" : "");
        }
@@ -3650,19 +3593,6 @@ int tcpm_update_sink_capabilities(struct tcpm_port *port, const u32 *pdo,
 }
 EXPORT_SYMBOL_GPL(tcpm_update_sink_capabilities);
-static int nr_type_pdos(const u32 *pdo, unsigned int nr_pdo,
-                        enum pd_pdo_type type)
-{
-        int count = 0;
-        int i;
-        for (i = 0; i < nr_pdo; i++) {
-                if (pdo_type(pdo[i]) == type)
-                        count++;
-        }
-        return count;
-}
 struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc)
 {
        struct tcpm_port *port;
@@ -3708,15 +3638,6 @@ struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc)
                                          tcpc->config->nr_src_pdo);
        port->nr_snk_pdo = tcpm_copy_pdos(port->snk_pdo, tcpc->config->snk_pdo,
                                          tcpc->config->nr_snk_pdo);
-        port->nr_fixed =  nr_type_pdos(port->snk_pdo,
-                                       port->nr_snk_pdo,
-                                       PDO_TYPE_FIXED);
-        port->nr_var = nr_type_pdos(port->snk_pdo,
-                                    port->nr_snk_pdo,
-                                    PDO_TYPE_VAR);
-        port->nr_batt = nr_type_pdos(port->snk_pdo,
-                                     port->nr_snk_pdo,
-                                     PDO_TYPE_BATT);
        port->nr_snk_vdo = tcpm_copy_vdos(port->snk_vdo, tcpc->config->snk_vdo,
                                          tcpc->config->nr_snk_vdo);
diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
index d86f72bbbb91..6dcd3ff655c3 100644
--- a/drivers/usb/usbip/vudc_sysfs.c
+++ b/drivers/usb/usbip/vudc_sysfs.c
@@ -105,10 +105,14 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
        if (rv != 0)
                return -EINVAL;
+        if (!udc) {
+                dev_err(dev, "no device");
+                return -ENODEV;
+        }
        spin_lock_irqsave(&udc->lock, flags);
        /* Don't export what we don't have */
-        if (!udc || !udc->driver || !udc->pullup) {
+        if (!udc->driver || !udc->pullup) {
-                dev_err(dev, "no device or gadget not bound");
+                dev_err(dev, "gadget not bound");
                ret = -ENODEV;
                goto unlock;
        }
diff --git a/fs/aio.c b/fs/aio.c
index a062d75109cb..6bcd3fb5265a 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -68,9 +68,9 @@ struct aio_ring {
 #define AIO_RING_PAGES  8
 struct kioctx_table {
-        struct rcu_head rcu;
+        struct rcu_head         rcu;
-        unsigned        nr;
+        unsigned                nr;
-        struct kioctx   *table[];
+        struct kioctx __rcu     *table[];
 };
 struct kioctx_cpu {
@@ -115,7 +115,8 @@ struct kioctx {
        struct page             **ring_pages;
        long                    nr_pages;
-        struct work_struct      free_work;
+        struct rcu_head         free_rcu;
+        struct work_struct      free_work;      /* see free_ioctx() */
        /*
         * signals when all in-flight requests are done
@@ -329,7 +330,7 @@ static int aio_ring_mremap(struct vm_area_struct *vma)
        for (i = 0; i < table->nr; i++) {
                struct kioctx *ctx;
-                ctx = table->table[i];
+                ctx = rcu_dereference(table->table[i]);
                if (ctx && ctx->aio_ring_file == file) {
                        if (!atomic_read(&ctx->dead)) {
                                ctx->user_id = ctx->mmap_base = vma->vm_start;
@@ -588,6 +589,12 @@ static int kiocb_cancel(struct aio_kiocb *kiocb)
        return cancel(&kiocb->common);
 }
+/*
+ * free_ioctx() should be RCU delayed to synchronize against the RCU
+ * protected lookup_ioctx() and also needs process context to call
+ * aio_free_ring(), so the double bouncing through kioctx->free_rcu and
+ * ->free_work.
+ */
 static void free_ioctx(struct work_struct *work)
 {
        struct kioctx *ctx = container_of(work, struct kioctx, free_work);
@@ -601,6 +608,14 @@ static void free_ioctx(struct work_struct *work)
        kmem_cache_free(kioctx_cachep, ctx);
 }
+static void free_ioctx_rcufn(struct rcu_head *head)
+{
+        struct kioctx *ctx = container_of(head, struct kioctx, free_rcu);
+        INIT_WORK(&ctx->free_work, free_ioctx);
+        schedule_work(&ctx->free_work);
+}
 static void free_ioctx_reqs(struct percpu_ref *ref)
 {
        struct kioctx *ctx = container_of(ref, struct kioctx, reqs);
@@ -609,8 +624,8 @@ static void free_ioctx_reqs(struct percpu_ref *ref)
        if (ctx->rq_wait && atomic_dec_and_test(&ctx->rq_wait->count))
                complete(&ctx->rq_wait->comp);
-        INIT_WORK(&ctx->free_work, free_ioctx);
+        /* Synchronize against RCU protected table->table[] dereferences */
-        schedule_work(&ctx->free_work);
+        call_rcu(&ctx->free_rcu, free_ioctx_rcufn);
 }
 /*
@@ -651,9 +666,9 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm)
        while (1) {
                if (table)
                        for (i = 0; i < table->nr; i++)
-                                if (!table->table[i]) {
+                                if (!rcu_access_pointer(table->table[i])) {
                                        ctx->id = i;
-                                        table->table[i] = ctx;
+                                        rcu_assign_pointer(table->table[i], ctx);
                                        spin_unlock(&mm->ioctx_lock);
                                        /* While kioctx setup is in progress,
@@ -834,11 +849,11 @@ static int kill_ioctx(struct mm_struct *mm, struct kioctx *ctx,
        }
        table = rcu_dereference_raw(mm->ioctx_table);
-        WARN_ON(ctx != table->table[ctx->id]);
+        WARN_ON(ctx != rcu_access_pointer(table->table[ctx->id]));
-        table->table[ctx->id] = NULL;
+        RCU_INIT_POINTER(table->table[ctx->id], NULL);
        spin_unlock(&mm->ioctx_lock);
-        /* percpu_ref_kill() will do the necessary call_rcu() */
+        /* free_ioctx_reqs() will do the necessary RCU synchronization */
        wake_up_all(&ctx->wait);
        /*
@@ -880,7 +895,8 @@ void exit_aio(struct mm_struct *mm)
        skipped = 0;
        for (i = 0; i < table->nr; ++i) {
-                struct kioctx *ctx = table->table[i];
+                struct kioctx *ctx =
+                        rcu_dereference_protected(table->table[i], true);
                if (!ctx) {
                        skipped++;
@@ -1069,7 +1085,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id)
        if (!table || id >= table->nr)
                goto out;
-        ctx = table->table[id];
+        ctx = rcu_dereference(table->table[id]);
        if (ctx && ctx->user_id == ctx_id) {
                percpu_ref_get(&ctx->users);
                ret = ctx;
diff --git a/fs/dcache.c b/fs/dcache.c
index 7c38f39958bc..8945e6cabd93 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -647,11 +647,16 @@ again:
                spin_unlock(&parent->d_lock);
                goto again;
        }
-        rcu_read_unlock();
+        if (parent != dentry) {
-        if (parent != dentry)
                spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
-        else
+                if (unlikely(dentry->d_lockref.count < 0)) {
+                        spin_unlock(&parent->d_lock);
+                        parent = NULL;
+                }
+        } else {
                parent = NULL;
+        }
+        rcu_read_unlock();
        return parent;
 }
@@ -2474,7 +2479,7 @@ struct dentry *d_alloc_parallel(struct dentry *parent,
 retry:
        rcu_read_lock();
-        seq = smp_load_acquire(&parent->d_inode->i_dir_seq) & ~1;
+        seq = smp_load_acquire(&parent->d_inode->i_dir_seq);
        r_seq = read_seqbegin(&rename_lock);
        dentry = __d_lookup_rcu(parent, name, &d_seq);
        if (unlikely(dentry)) {
@@ -2495,8 +2500,14 @@ retry:
                rcu_read_unlock();
                goto retry;
        }
+        if (unlikely(seq & 1)) {
+                rcu_read_unlock();
+                goto retry;
+        }
        hlist_bl_lock(b);
-        if (unlikely(parent->d_inode->i_dir_seq != seq)) {
+        if (unlikely(READ_ONCE(parent->d_inode->i_dir_seq) != seq)) {
                hlist_bl_unlock(b);
                rcu_read_unlock();
                goto retry;
diff --git a/fs/namei.c b/fs/namei.c
index 921ae32dbc80..cafa365eeb70 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -559,9 +559,10 @@ static int __nd_alloc_stack(struct nameidata *nd)
 static bool path_connected(const struct path *path)
 {
        struct vfsmount *mnt = path->mnt;
+        struct super_block *sb = mnt->mnt_sb;
-        /* Only bind mounts can have disconnected paths */
+        /* Bind mounts and multi-root filesystems can have disconnected paths */
-        if (mnt->mnt_root == mnt->mnt_sb->s_root)
+        if (!(sb->s_iflags & SB_I_MULTIROOT) && (mnt->mnt_root == sb->s_root))
                return true;
        return is_subdir(path->dentry, mnt->mnt_root);
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 8c10b0562e75..621c517b325c 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -86,10 +86,10 @@ struct nfs_direct_req {
        struct nfs_direct_mirror mirrors[NFS_PAGEIO_DESCRIPTOR_MIRROR_MAX];
        int                     mirror_count;
+        loff_t                  io_start;       /* Start offset for I/O */
        ssize_t                 count,          /* bytes actually processed */
                                max_count,      /* max expected count */
                                bytes_left,     /* bytes left to be sent */
-                                io_start,       /* start of IO */
                                error;          /* any reported error */
        struct completion       completion;     /* wait for i/o completion */
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index c13e826614b5..ee723aa153a3 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -292,8 +292,11 @@ pnfs_detach_layout_hdr(struct pnfs_layout_hdr *lo)
 void
 pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo)
 {
-        struct inode *inode = lo->plh_inode;
+        struct inode *inode;
+        if (!lo)
+                return;
+        inode = lo->plh_inode;
        pnfs_layoutreturn_before_put_layout_hdr(lo);
        if (refcount_dec_and_lock(&lo->plh_refcount, &inode->i_lock)) {
@@ -1241,10 +1244,12 @@ retry:
        spin_lock(&ino->i_lock);
        lo = nfsi->layout;
        if (!lo || !pnfs_layout_is_valid(lo) ||
-            test_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags))
+            test_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags)) {
+                lo = NULL;
                goto out_noroc;
+        }
+        pnfs_get_layout_hdr(lo);
        if (test_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags)) {
-                pnfs_get_layout_hdr(lo);
                spin_unlock(&ino->i_lock);
                wait_on_bit(&lo->plh_flags, NFS_LAYOUT_RETURN,
                                TASK_UNINTERRUPTIBLE);
@@ -1312,10 +1317,12 @@ out_noroc:
                struct pnfs_layoutdriver_type *ld = NFS_SERVER(ino)->pnfs_curr_ld;
                if (ld->prepare_layoutreturn)
                        ld->prepare_layoutreturn(args);
+                pnfs_put_layout_hdr(lo);
                return true;
        }
        if (layoutreturn)
                pnfs_send_layoutreturn(lo, &stateid, iomode, true);
+        pnfs_put_layout_hdr(lo);
        return false;
 }
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 29bacdc56f6a..5e470e233c83 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2631,6 +2631,8 @@ struct dentry *nfs_fs_mount_common(struct nfs_server *server,
                /* initial superblock/root creation */
                mount_info->fill_super(s, mount_info);
                nfs_get_cache_cookie(s, mount_info->parsed, mount_info->cloned);
+                if (!(server->flags & NFS_MOUNT_UNSHARED))
+                        s->s_iflags |= SB_I_MULTIROOT;
        }
        mntroot = nfs_get_root(s, mount_info->mntfh, dev_name);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 7428a669d7a7..e7d8ceae8f26 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1876,40 +1876,43 @@ int nfs_generic_commit_list(struct inode *inode, struct list_head *head,
        return status;
 }
-int nfs_commit_inode(struct inode *inode, int how)
+static int __nfs_commit_inode(struct inode *inode, int how,
+                struct writeback_control *wbc)
 {
        LIST_HEAD(head);
        struct nfs_commit_info cinfo;
        int may_wait = how & FLUSH_SYNC;
-        int error = 0;
+        int ret, nscan;
-        int res;
        nfs_init_cinfo_from_inode(&cinfo, inode);
        nfs_commit_begin(cinfo.mds);
-        res = nfs_scan_commit(inode, &head, &cinfo);
+        for (;;) {
-        if (res)
+                ret = nscan = nfs_scan_commit(inode, &head, &cinfo);
-                error = nfs_generic_commit_list(inode, &head, how, &cinfo);
+                if (ret <= 0)
+                        break;
+                ret = nfs_generic_commit_list(inode, &head, how, &cinfo);
+                if (ret < 0)
+                        break;
+                ret = 0;
+                if (wbc && wbc->sync_mode == WB_SYNC_NONE) {
+                        if (nscan < wbc->nr_to_write)
+                                wbc->nr_to_write -= nscan;
+                        else
+                                wbc->nr_to_write = 0;
+                }
+                if (nscan < INT_MAX)
+                        break;
+                cond_resched();
+        }
        nfs_commit_end(cinfo.mds);
-        if (res == 0)
+        if (ret || !may_wait)
-                return res;
+                return ret;
-        if (error < 0)
+        return wait_on_commit(cinfo.mds);
-                goto out_error;
+}
-        if (!may_wait)
-                goto out_mark_dirty;
+int nfs_commit_inode(struct inode *inode, int how)
-        error = wait_on_commit(cinfo.mds);
+{
-        if (error < 0)
+        return __nfs_commit_inode(inode, how, NULL);
-                return error;
-        return res;
-out_error:
-        res = error;
-        /* Note: If we exit without ensuring that the commit is complete,
-         * we must mark the inode as dirty. Otherwise, future calls to
-         * sync_inode() with the WB_SYNC_ALL flag set will fail to ensure
-         * that the data is on the disk.
-         */
-out_mark_dirty:
-        __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
-        return res;
 }
 EXPORT_SYMBOL_GPL(nfs_commit_inode);
@@ -1919,11 +1922,11 @@ int nfs_write_inode(struct inode *inode, struct writeback_control *wbc)
        int flags = FLUSH_SYNC;
        int ret = 0;
-        /* no commits means nothing needs to be done */
-        if (!atomic_long_read(&nfsi->commit_info.ncommit))
-                return ret;
        if (wbc->sync_mode == WB_SYNC_NONE) {
+                /* no commits means nothing needs to be done */
+                if (!atomic_long_read(&nfsi->commit_info.ncommit))
+                        goto check_requests_outstanding;
                /* Don't commit yet if this is a non-blocking flush and there
                 * are a lot of outstanding writes for this mapping.
                 */
@@ -1934,16 +1937,16 @@ int nfs_write_inode(struct inode *inode, struct writeback_control *wbc)
                flags = 0;
        }
-        ret = nfs_commit_inode(inode, flags);
+        ret = __nfs_commit_inode(inode, flags, wbc);
-        if (ret >= 0) {
+        if (!ret) {
-                if (wbc->sync_mode == WB_SYNC_NONE) {
+                if (flags & FLUSH_SYNC)
-                        if (ret < wbc->nr_to_write)
+                        return 0;
-                                wbc->nr_to_write -= ret;
+        } else if (atomic_long_read(&nfsi->commit_info.ncommit))
-                        else
+                goto out_mark_dirty;
-                                wbc->nr_to_write = 0;
-                }
+check_requests_outstanding:
-                return 0;
+        if (!atomic_read(&nfsi->commit_info.rpcs_out))
-        }
+                return ret;
 out_mark_dirty:
        __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
        return ret;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 79c413985305..c6baf767619e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1317,6 +1317,7 @@ extern int send_sigurg(struct fown_struct *fown);
 #define SB_I_CGROUPWB   0x00000001      /* cgroup-aware writeback enabled */
 #define SB_I_NOEXEC     0x00000002      /* Ignore executables on this fs */
 #define SB_I_NODEV      0x00000004      /* Ignore devices on this fs */
+#define SB_I_MULTIROOT  0x00000008      /* Multiple roots to the dentry tree */
 /* sb->s_iflags to limit user namespace mounts */
 #define SB_I_USERNS_VISIBLE             0x00000010 /* fstype already mounted */
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 0a6c71e0ad01..47f8af22f216 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -364,6 +364,7 @@ struct tty_file_private {
 #define TTY_PTY_LOCK            16      /* pty private */
 #define TTY_NO_WRITE_SPLIT      17      /* Preserve write boundaries to driver */
 #define TTY_HUPPED              18      /* Post driver->hangup() */
+#define TTY_HUPPING             19      /* Hangup in progress */
 #define TTY_LDISC_HALTED        22      /* Line discipline is halted */
 /* Values for tty->flow_change */
diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
index f1fcec2fd5f8..b7a99ce56bc9 100644
--- a/include/linux/usb/quirks.h
+++ b/include/linux/usb/quirks.h
@@ -63,4 +63,7 @@
 */
 #define USB_QUIRK_DISCONNECT_SUSPEND            BIT(12)
+/* Device needs a pause after every control message. */
+#define USB_QUIRK_DELAY_CTRL_MSG                BIT(13)
 #endif /* __LINUX_USB_QUIRKS_H */
diff --git a/lib/btree.c b/lib/btree.c
index f93a945274af..590facba2c50 100644
--- a/lib/btree.c
+++ b/lib/btree.c
@@ -3,7 +3,7 @@
 *
 * As should be obvious for Linux kernel code, license is GPLv2
 *
- * Copyright (c) 2007-2008 Joern Engel <joern@logfs.org>
+ * Copyright (c) 2007-2008 Joern Engel <joern@purestorage.com>
 * Bits and pieces stolen from Peter Zijlstra's code, which is
 * Copyright 2007, Red Hat Inc. Peter Zijlstra
 * GPLv2
@@ -76,6 +76,8 @@ struct btree_geo btree_geo128 = {
 };
 EXPORT_SYMBOL_GPL(btree_geo128);
+#define MAX_KEYLEN      (2 * LONG_PER_U64)
 static struct kmem_cache *btree_cachep;
 void *btree_alloc(gfp_t gfp_mask, void *pool_data)
@@ -313,7 +315,7 @@ void *btree_get_prev(struct btree_head *head, struct btree_geo *geo,
 {
        int i, height;
        unsigned long *node, *oldnode;
-        unsigned long *retry_key = NULL, key[geo->keylen];
+        unsigned long *retry_key = NULL, key[MAX_KEYLEN];
        if (keyzero(geo, __key))
                return NULL;
@@ -639,8 +641,8 @@ EXPORT_SYMBOL_GPL(btree_remove);
 int btree_merge(struct btree_head *target, struct btree_head *victim,
                struct btree_geo *geo, gfp_t gfp)
 {
-        unsigned long key[geo->keylen];
+        unsigned long key[MAX_KEYLEN];
-        unsigned long dup[geo->keylen];
+        unsigned long dup[MAX_KEYLEN];
        void *val;
        int err;
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 3d974cb2a1a1..635d7dd29d7f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1910,7 +1910,9 @@ static int move_freepages(struct zone *zone,
         * Remove at a later date when no bug reports exist related to
         * grouping pages by mobility
         */
-        VM_BUG_ON(page_zone(start_page) != page_zone(end_page));
+        VM_BUG_ON(pfn_valid(page_to_pfn(start_page)) &&
+                  pfn_valid(page_to_pfn(end_page)) &&
+                  page_zone(start_page) != page_zone(end_page));
 #endif
        if (num_movable)
@@ -5359,14 +5361,9 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
                        /*
                         * Skip to the pfn preceding the next valid one (or
                         * end_pfn), such that we hit a valid pfn (or end_pfn)
-                         * on our next iteration of the loop. Note that it needs
+                         * on our next iteration of the loop.
-                         * to be pageblock aligned even when the region itself
-                         * is not. move_freepages_block() can shift ahead of
-                         * the valid region but still depends on correct page
-                         * metadata.
                         */
-                        pfn = (memblock_next_valid_pfn(pfn, end_pfn) &
+                        pfn = memblock_next_valid_pfn(pfn, end_pfn) - 1;
-                                        ~(pageblock_nr_pages-1)) - 1;
 #endif
                        continue;
                }
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index b044c0a5a674..02298c9c6020 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1762,10 +1762,9 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file)
                return -ENOMEM;
        _snd_pcm_hw_params_any(params);
        err = snd_pcm_hw_refine(substream, params);
-        format_mask = hw_param_mask_c(params, SNDRV_PCM_HW_PARAM_FORMAT);
-        kfree(params);
        if (err < 0)
-                return err;
+                goto error;
+        format_mask = hw_param_mask_c(params, SNDRV_PCM_HW_PARAM_FORMAT);
        for (fmt = 0; fmt < 32; ++fmt) {
                if (snd_mask_test(format_mask, fmt)) {
                        int f = snd_pcm_oss_format_to(fmt);
@@ -1773,7 +1772,10 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file)
                                formats |= f;
                }
        }
-        return formats;
+ error:
+        kfree(params);
+        return err < 0 ? err : formats;
 }
 static int snd_pcm_oss_set_format(struct snd_pcm_oss_file *pcm_oss_file, int format)
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 918338dea5b9..61a07fe34cd2 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -255,12 +255,12 @@ static int seq_free_client1(struct snd_seq_client *client)
        if (!client)
                return 0;
-        snd_seq_delete_all_ports(client);
-        snd_seq_queue_client_leave(client->number);
        spin_lock_irqsave(&clients_lock, flags);
        clienttablock[client->number] = 1;
        clienttab[client->number] = NULL;
        spin_unlock_irqrestore(&clients_lock, flags);
+        snd_seq_delete_all_ports(client);
+        snd_seq_queue_client_leave(client->number);
        snd_use_lock_sync(&client->use_lock);
        snd_seq_queue_client_termination(client->number);
        if (client->pool)
diff --git a/sound/core/seq/seq_prioq.c b/sound/core/seq/seq_prioq.c
index bc1c8488fc2a..2bc6759e4adc 100644
--- a/sound/core/seq/seq_prioq.c
+++ b/sound/core/seq/seq_prioq.c
@@ -87,7 +87,7 @@ void snd_seq_prioq_delete(struct snd_seq_prioq **fifo)
        if (f->cells > 0) {
                /* drain prioQ */
                while (f->cells > 0)
-                        snd_seq_cell_free(snd_seq_prioq_cell_out(f));
+                        snd_seq_cell_free(snd_seq_prioq_cell_out(f, NULL));
        }
        
        kfree(f);
@@ -214,8 +214,18 @@ int snd_seq_prioq_cell_in(struct snd_seq_prioq * f,
        return 0;
 }
+/* return 1 if the current time >= event timestamp */
+static int event_is_ready(struct snd_seq_event *ev, void *current_time)
+{
+        if ((ev->flags & SNDRV_SEQ_TIME_STAMP_MASK) == SNDRV_SEQ_TIME_STAMP_TICK)
+                return snd_seq_compare_tick_time(current_time, &ev->time.tick);
+        else
+                return snd_seq_compare_real_time(current_time, &ev->time.time);
+}
 /* dequeue cell from prioq */
-struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f)
+struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f,
+                                                  void *current_time)
 {
        struct snd_seq_event_cell *cell;
        unsigned long flags;
@@ -227,6 +237,8 @@ struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f)
        spin_lock_irqsave(&f->lock, flags);
        cell = f->head;
+        if (cell && current_time && !event_is_ready(&cell->event, current_time))
+                cell = NULL;
        if (cell) {
                f->head = cell->next;
@@ -252,18 +264,6 @@ int snd_seq_prioq_avail(struct snd_seq_prioq * f)
        return f->cells;
 }
-/* peek at cell at the head of the prioq */
-struct snd_seq_event_cell *snd_seq_prioq_cell_peek(struct snd_seq_prioq * f)
-{
-        if (f == NULL) {
-                pr_debug("ALSA: seq: snd_seq_prioq_cell_in() called with NULL prioq\n");
-                return NULL;
-        }
-        return f->head;
-}
 static inline int prioq_match(struct snd_seq_event_cell *cell,
                              int client, int timestamp)
 {
diff --git a/sound/core/seq/seq_prioq.h b/sound/core/seq/seq_prioq.h
index d38bb78d9345..2c315ca10fc4 100644
--- a/sound/core/seq/seq_prioq.h
+++ b/sound/core/seq/seq_prioq.h
@@ -44,14 +44,12 @@ void snd_seq_prioq_delete(struct snd_seq_prioq **fifo);
 int snd_seq_prioq_cell_in(struct snd_seq_prioq *f, struct snd_seq_event_cell *cell);
 /* dequeue cell from prioq */ 
-struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f);
+struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f,
+                                                  void *current_time);
 /* return number of events available in prioq */
 int snd_seq_prioq_avail(struct snd_seq_prioq *f);
-/* peek at cell at the head of the prioq */
-struct snd_seq_event_cell *snd_seq_prioq_cell_peek(struct snd_seq_prioq *f);
 /* client left queue */
 void snd_seq_prioq_leave(struct snd_seq_prioq *f, int client, int timestamp);        
diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
index 0428e9061b47..b377f5048352 100644
--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -277,30 +277,20 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop)
      __again:
        /* Process tick queue... */
-        while ((cell = snd_seq_prioq_cell_peek(q->tickq)) != NULL) {
+        for (;;) {
-                if (snd_seq_compare_tick_time(&q->timer->tick.cur_tick,
+                cell = snd_seq_prioq_cell_out(q->tickq,
-                                              &cell->event.time.tick)) {
+                                              &q->timer->tick.cur_tick);
-                        cell = snd_seq_prioq_cell_out(q->tickq);
+                if (!cell)
-                        if (cell)
-                                snd_seq_dispatch_event(cell, atomic, hop);
-                } else {
-                        /* event remains in the queue */
                        break;
-                }
+                snd_seq_dispatch_event(cell, atomic, hop);
        }
        /* Process time queue... */
-        while ((cell = snd_seq_prioq_cell_peek(q->timeq)) != NULL) {
+        for (;;) {
-                if (snd_seq_compare_real_time(&q->timer->cur_time,
+                cell = snd_seq_prioq_cell_out(q->timeq, &q->timer->cur_time);
-                                              &cell->event.time.time)) {
+                if (!cell)
-                        cell = snd_seq_prioq_cell_out(q->timeq);
-                        if (cell)
-                                snd_seq_dispatch_event(cell, atomic, hop);
-                } else {
-                        /* event remains in the queue */
                        break;
-                }
+                snd_seq_dispatch_event(cell, atomic, hop);
        }
        /* free lock */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 96143df19b21..d5017adf9feb 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -181,11 +181,15 @@ static const struct kernel_param_ops param_ops_xint = {
 };
 #define param_check_xint param_check_int
-static int power_save = -1;
+static int power_save = CONFIG_SND_HDA_POWER_SAVE_DEFAULT;
 module_param(power_save, xint, 0644);
 MODULE_PARM_DESC(power_save, "Automatic power-saving timeout "
                 "(in second, 0 = disable).");
+static bool pm_blacklist = true;
+module_param(pm_blacklist, bool, 0644);
+MODULE_PARM_DESC(pm_blacklist, "Enable power-management blacklist");
 /* reset the HD-audio controller in power save mode.
 * this may give more power-saving, but will take longer time to
 * wake up.
@@ -2300,10 +2304,9 @@ static int azx_probe_continue(struct azx *chip)
        val = power_save;
 #ifdef CONFIG_PM
-        if (val == -1) {
+        if (pm_blacklist) {
                const struct snd_pci_quirk *q;
-                val = CONFIG_SND_HDA_POWER_SAVE_DEFAULT;
                q = snd_pci_quirk_lookup(chip->pci, power_save_blacklist);
                if (q && val) {
                        dev_info(chip->card->dev, "device %04x:%04x is on the power_save blacklist, forcing power_save to 0\n",
diff --git a/sound/soc/amd/acp-pcm-dma.c b/sound/soc/amd/acp-pcm-dma.c
index c33a512283a4..9fb356db3ab2 100644
--- a/sound/soc/amd/acp-pcm-dma.c
+++ b/sound/soc/amd/acp-pcm-dma.c
@@ -579,13 +579,6 @@ static int acp_init(void __iomem *acp_mmio, u32 asic_type)
                for (bank = 1; bank < 48; bank++)
                        acp_set_sram_bank_state(acp_mmio, bank, false);
        }
-        /* Stoney supports 16bit resolution */
-        if (asic_type == CHIP_STONEY) {
-                val = acp_reg_read(acp_mmio, mmACP_I2S_16BIT_RESOLUTION_EN);
-                val |= 0x03;
-                acp_reg_write(val, acp_mmio, mmACP_I2S_16BIT_RESOLUTION_EN);
-        }
        return 0;
 }
@@ -774,6 +767,7 @@ static int acp_dma_hw_params(struct snd_pcm_substream *substream,
 {
        int status;
        uint64_t size;
+        u32 val = 0;
        struct page *pg;
        struct snd_pcm_runtime *runtime;
        struct audio_substream_data *rtd;
@@ -786,6 +780,14 @@ static int acp_dma_hw_params(struct snd_pcm_substream *substream,
        if (WARN_ON(!rtd))
                return -EINVAL;
+        if (adata->asic_type == CHIP_STONEY) {
+                val = acp_reg_read(adata->acp_mmio, mmACP_I2S_16BIT_RESOLUTION_EN);
+                if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+                        val |= ACP_I2S_SP_16BIT_RESOLUTION_EN;
+                else
+                        val |= ACP_I2S_MIC_16BIT_RESOLUTION_EN;
+                acp_reg_write(val, adata->acp_mmio, mmACP_I2S_16BIT_RESOLUTION_EN);
+        }
        size = params_buffer_bytes(params);
        status = snd_pcm_lib_malloc_pages(substream, size);
        if (status < 0)
diff --git a/sound/soc/amd/acp.h b/sound/soc/amd/acp.h
index ecb458935d1e..9293f179f272 100644
--- a/sound/soc/amd/acp.h
+++ b/sound/soc/amd/acp.h
@@ -70,6 +70,8 @@
 #define CAPTURE_END_DMA_DESCR_CH15 7
 #define mmACP_I2S_16BIT_RESOLUTION_EN       0x5209
+#define ACP_I2S_MIC_16BIT_RESOLUTION_EN 0x01
+#define ACP_I2S_SP_16BIT_RESOLUTION_EN  0x02
 enum acp_dma_priority_level {
        /* 0x0 Specifies the DMA channel is given normal priority */
        ACP_DMA_PRIORITY_LEVEL_NORMAL = 0x0,
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
index 5672e516bec3..c1830ccd3bb8 100644
--- a/sound/soc/codecs/hdmi-codec.c
+++ b/sound/soc/codecs/hdmi-codec.c
@@ -798,12 +798,7 @@ static int hdmi_codec_probe(struct platform_device *pdev)
 static int hdmi_codec_remove(struct platform_device *pdev)
 {
-        struct device *dev = &pdev->dev;
+        snd_soc_unregister_codec(&pdev->dev);
-        struct hdmi_codec_priv *hcp;
-        hcp = dev_get_drvdata(dev);
-        kfree(hcp->chmap_info);
-        snd_soc_unregister_codec(dev);
        return 0;
 }
diff --git a/sound/soc/codecs/rt5651.c b/sound/soc/codecs/rt5651.c
index 831b297978a4..45a73049cf64 100644
--- a/sound/soc/codecs/rt5651.c
+++ b/sound/soc/codecs/rt5651.c
@@ -1722,6 +1722,7 @@ static const struct regmap_config rt5651_regmap = {
        .num_reg_defaults = ARRAY_SIZE(rt5651_reg),
        .ranges = rt5651_ranges,
        .num_ranges = ARRAY_SIZE(rt5651_ranges),
+        .use_single_rw = true,
 };
 #if defined(CONFIG_OF)
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index e1ab5537d27a..c5c76ab8ccf1 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -529,10 +529,15 @@ static const struct snd_kcontrol_new sgtl5000_snd_controls[] = {
 static int sgtl5000_digital_mute(struct snd_soc_dai *codec_dai, int mute)
 {
        struct snd_soc_codec *codec = codec_dai->codec;
-        u16 adcdac_ctrl = SGTL5000_DAC_MUTE_LEFT | SGTL5000_DAC_MUTE_RIGHT;
+        u16 i2s_pwr = SGTL5000_I2S_IN_POWERUP;
-        snd_soc_update_bits(codec, SGTL5000_CHIP_ADCDAC_CTRL,
+        /*
-                        adcdac_ctrl, mute ? adcdac_ctrl : 0);
+         * During 'digital mute' do not mute DAC
+         * because LINE_IN would be muted aswell. We want to mute
+         * only I2S block - this can be done by powering it off
+         */
+        snd_soc_update_bits(codec, SGTL5000_CHIP_DIG_POWER,
+                        i2s_pwr, mute ? 0 : i2s_pwr);
        return 0;
 }
@@ -871,15 +876,26 @@ static int sgtl5000_pcm_hw_params(struct snd_pcm_substream *substream,
 static int sgtl5000_set_bias_level(struct snd_soc_codec *codec,
                                   enum snd_soc_bias_level level)
 {
+        struct sgtl5000_priv *sgtl = snd_soc_codec_get_drvdata(codec);
+        int ret;
        switch (level) {
        case SND_SOC_BIAS_ON:
        case SND_SOC_BIAS_PREPARE:
        case SND_SOC_BIAS_STANDBY:
+                regcache_cache_only(sgtl->regmap, false);
+                ret = regcache_sync(sgtl->regmap);
+                if (ret) {
+                        regcache_cache_only(sgtl->regmap, true);
+                        return ret;
+                }
                snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
                                    SGTL5000_REFTOP_POWERUP,
                                    SGTL5000_REFTOP_POWERUP);
                break;
        case SND_SOC_BIAS_OFF:
+                regcache_cache_only(sgtl->regmap, true);
                snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
                                    SGTL5000_REFTOP_POWERUP, 0);
                break;
@@ -1237,6 +1253,10 @@ static int sgtl5000_probe(struct snd_soc_codec *codec)
         */
        snd_soc_write(codec, SGTL5000_DAP_CTRL, 0);
+        /* Unmute DAC after start */
+        snd_soc_update_bits(codec, SGTL5000_CHIP_ADCDAC_CTRL,
+                SGTL5000_DAC_MUTE_LEFT | SGTL5000_DAC_MUTE_RIGHT, 0);
        return 0;
 err:
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 66e32f5d2917..989d093abda7 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1204,12 +1204,14 @@ static int wmfw_add_ctl(struct wm_adsp *dsp, struct wm_coeff_ctl *ctl)
                kcontrol->put = wm_coeff_put_acked;
                break;
        default:
-                kcontrol->get = wm_coeff_get;
+                if (kcontrol->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
-                kcontrol->put = wm_coeff_put;
+                        ctl->bytes_ext.max = ctl->len;
+                        ctl->bytes_ext.get = wm_coeff_tlv_get;
-                ctl->bytes_ext.max = ctl->len;
+                        ctl->bytes_ext.put = wm_coeff_tlv_put;
-                ctl->bytes_ext.get = wm_coeff_tlv_get;
+                } else {
-                ctl->bytes_ext.put = wm_coeff_tlv_put;
+                        kcontrol->get = wm_coeff_get;
+                        kcontrol->put = wm_coeff_put;
+                }
                break;
        }
diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
index dca1143c1150..a4aa931ebfae 100644
--- a/sound/soc/sunxi/sun4i-i2s.c
+++ b/sound/soc/sunxi/sun4i-i2s.c
@@ -104,7 +104,7 @@
 #define SUN8I_I2S_CHAN_CFG_REG          0x30
 #define SUN8I_I2S_CHAN_CFG_RX_SLOT_NUM_MASK     GENMASK(6, 4)
-#define SUN8I_I2S_CHAN_CFG_RX_SLOT_NUM(chan)    (chan - 1)
+#define SUN8I_I2S_CHAN_CFG_RX_SLOT_NUM(chan)    ((chan - 1) << 4)
 #define SUN8I_I2S_CHAN_CFG_TX_SLOT_NUM_MASK     GENMASK(2, 0)
 #define SUN8I_I2S_CHAN_CFG_TX_SLOT_NUM(chan)    (chan - 1)