[gentoo-commits] proj/linux-patches:4.4 commit in: /

["Mike Pagano" <mpagano@gentoo.org>]

commit:     f8b9c1891293dbf2375a9c0979514b815bdb234e
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 27 10:33:00 2017 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Oct 27 10:33:00 2017 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f8b9c189

Linux patch 4.4.95

 0000_README             |    4 +
 1094_linux-4.4.95.patch | 1587 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1591 insertions(+)

diff --git a/0000_README b/0000_README
index c847c5f..3de9efe 100644
--- a/0000_README
+++ b/0000_README
@@ -419,6 +419,10 @@ Patch:  1093_linux-4.4.94.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.4.94
 
+Patch:  1094_linux-4.4.95.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.4.95
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1094_linux-4.4.95.patch b/1094_linux-4.4.95.patch
new file mode 100644
index 0000000..d5f0692
--- /dev/null
+++ b/1094_linux-4.4.95.patch
@@ -0,0 +1,1587 @@
+diff --git a/Makefile b/Makefile
+index ff9d6bbf2210..57e1ea2a189a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 94
++SUBLEVEL = 95
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index a86b19fccb63..c6b855f7892c 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -479,11 +479,6 @@ lws_start:
+ 	comiclr,>>	__NR_lws_entries, %r20, %r0
+ 	b,n	lws_exit_nosys
+ 
+-	/* WARNING: Trashing sr2 and sr3 */
+-	mfsp	%sr7,%r1			/* get userspace into sr3 */
+-	mtsp	%r1,%sr3
+-	mtsp	%r0,%sr2			/* get kernel space into sr2 */
+-
+ 	/* Load table start */
+ 	ldil	L%lws_table, %r1
+ 	ldo	R%lws_table(%r1), %r28	/* Scratch use of r28 */
+@@ -632,9 +627,9 @@ cas_action:
+ 	stw	%r1, 4(%sr2,%r20)
+ #endif
+ 	/* The load and store could fail */
+-1:	ldw,ma	0(%sr3,%r26), %r28
++1:	ldw,ma	0(%r26), %r28
+ 	sub,<>	%r28, %r25, %r0
+-2:	stw,ma	%r24, 0(%sr3,%r26)
++2:	stw,ma	%r24, 0(%r26)
+ 	/* Free lock */
+ 	stw,ma	%r20, 0(%sr2,%r20)
+ #if ENABLE_LWS_DEBUG
+@@ -711,9 +706,9 @@ lws_compare_and_swap_2:
+ 	nop
+ 
+ 	/* 8bit load */
+-4:	ldb	0(%sr3,%r25), %r25
++4:	ldb	0(%r25), %r25
+ 	b	cas2_lock_start
+-5:	ldb	0(%sr3,%r24), %r24
++5:	ldb	0(%r24), %r24
+ 	nop
+ 	nop
+ 	nop
+@@ -721,9 +716,9 @@ lws_compare_and_swap_2:
+ 	nop
+ 
+ 	/* 16bit load */
+-6:	ldh	0(%sr3,%r25), %r25
++6:	ldh	0(%r25), %r25
+ 	b	cas2_lock_start
+-7:	ldh	0(%sr3,%r24), %r24
++7:	ldh	0(%r24), %r24
+ 	nop
+ 	nop
+ 	nop
+@@ -731,9 +726,9 @@ lws_compare_and_swap_2:
+ 	nop
+ 
+ 	/* 32bit load */
+-8:	ldw	0(%sr3,%r25), %r25
++8:	ldw	0(%r25), %r25
+ 	b	cas2_lock_start
+-9:	ldw	0(%sr3,%r24), %r24
++9:	ldw	0(%r24), %r24
+ 	nop
+ 	nop
+ 	nop
+@@ -742,14 +737,14 @@ lws_compare_and_swap_2:
+ 
+ 	/* 64bit load */
+ #ifdef CONFIG_64BIT
+-10:	ldd	0(%sr3,%r25), %r25
+-11:	ldd	0(%sr3,%r24), %r24
++10:	ldd	0(%r25), %r25
++11:	ldd	0(%r24), %r24
+ #else
+-	/* Load new value into r22/r23 - high/low */
+-10:	ldw	0(%sr3,%r25), %r22
+-11:	ldw	4(%sr3,%r25), %r23
++	/* Load old value into r22/r23 - high/low */
++10:	ldw	0(%r25), %r22
++11:	ldw	4(%r25), %r23
+ 	/* Load new value into fr4 for atomic store later */
+-12:	flddx	0(%sr3,%r24), %fr4
++12:	flddx	0(%r24), %fr4
+ #endif
+ 
+ cas2_lock_start:
+@@ -799,30 +794,30 @@ cas2_action:
+ 	ldo	1(%r0),%r28
+ 
+ 	/* 8bit CAS */
+-13:	ldb,ma	0(%sr3,%r26), %r29
++13:	ldb,ma	0(%r26), %r29
+ 	sub,=	%r29, %r25, %r0
+ 	b,n	cas2_end
+-14:	stb,ma	%r24, 0(%sr3,%r26)
++14:	stb,ma	%r24, 0(%r26)
+ 	b	cas2_end
+ 	copy	%r0, %r28
+ 	nop
+ 	nop
+ 
+ 	/* 16bit CAS */
+-15:	ldh,ma	0(%sr3,%r26), %r29
++15:	ldh,ma	0(%r26), %r29
+ 	sub,=	%r29, %r25, %r0
+ 	b,n	cas2_end
+-16:	sth,ma	%r24, 0(%sr3,%r26)
++16:	sth,ma	%r24, 0(%r26)
+ 	b	cas2_end
+ 	copy	%r0, %r28
+ 	nop
+ 	nop
+ 
+ 	/* 32bit CAS */
+-17:	ldw,ma	0(%sr3,%r26), %r29
++17:	ldw,ma	0(%r26), %r29
+ 	sub,=	%r29, %r25, %r0
+ 	b,n	cas2_end
+-18:	stw,ma	%r24, 0(%sr3,%r26)
++18:	stw,ma	%r24, 0(%r26)
+ 	b	cas2_end
+ 	copy	%r0, %r28
+ 	nop
+@@ -830,22 +825,22 @@ cas2_action:
+ 
+ 	/* 64bit CAS */
+ #ifdef CONFIG_64BIT
+-19:	ldd,ma	0(%sr3,%r26), %r29
++19:	ldd,ma	0(%r26), %r29
+ 	sub,*=	%r29, %r25, %r0
+ 	b,n	cas2_end
+-20:	std,ma	%r24, 0(%sr3,%r26)
++20:	std,ma	%r24, 0(%r26)
+ 	copy	%r0, %r28
+ #else
+ 	/* Compare first word */
+-19:	ldw,ma	0(%sr3,%r26), %r29
++19:	ldw	0(%r26), %r29
+ 	sub,=	%r29, %r22, %r0
+ 	b,n	cas2_end
+ 	/* Compare second word */
+-20:	ldw,ma	4(%sr3,%r26), %r29
++20:	ldw	4(%r26), %r29
+ 	sub,=	%r29, %r23, %r0
+ 	b,n	cas2_end
+ 	/* Perform the store */
+-21:	fstdx	%fr4, 0(%sr3,%r26)
++21:	fstdx	%fr4, 0(%r26)
+ 	copy	%r0, %r28
+ #endif
+ 
+diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c
+index 8f3056cd0399..2516e97c58f1 100644
+--- a/crypto/asymmetric_keys/pkcs7_parser.c
++++ b/crypto/asymmetric_keys/pkcs7_parser.c
+@@ -90,6 +90,9 @@ static int pkcs7_check_authattrs(struct pkcs7_message *msg)
+ 	bool want;
+ 
+ 	sinfo = msg->signed_infos;
++	if (!sinfo)
++		goto inconsistent;
++
+ 	if (sinfo->authattrs) {
+ 		want = true;
+ 		msg->have_authattrs = true;
+diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c
+index c43c3d2baf73..0d628becf37f 100644
+--- a/drivers/bus/mvebu-mbus.c
++++ b/drivers/bus/mvebu-mbus.c
+@@ -720,7 +720,7 @@ mvebu_mbus_default_setup_cpu_target(struct mvebu_mbus_state *mbus)
+ 			if (mbus->hw_io_coherency)
+ 				w->mbus_attr |= ATTR_HW_COHERENCY;
+ 			w->base = base & DDR_BASE_CS_LOW_MASK;
+-			w->size = (size | ~DDR_SIZE_MASK) + 1;
++			w->size = (u64)(size | ~DDR_SIZE_MASK) + 1;
+ 		}
+ 	}
+ 	mvebu_mbus_dram_info.num_cs = cs;
+diff --git a/drivers/clocksource/cs5535-clockevt.c b/drivers/clocksource/cs5535-clockevt.c
+index 9a7e37cf56b0..e1d7373e63e0 100644
+--- a/drivers/clocksource/cs5535-clockevt.c
++++ b/drivers/clocksource/cs5535-clockevt.c
+@@ -117,7 +117,8 @@ static irqreturn_t mfgpt_tick(int irq, void *dev_id)
+ 	/* Turn off the clock (and clear the event) */
+ 	disable_timer(cs5535_event_clock);
+ 
+-	if (clockevent_state_shutdown(&cs5535_clockevent))
++	if (clockevent_state_detached(&cs5535_clockevent) ||
++	    clockevent_state_shutdown(&cs5535_clockevent))
+ 		return IRQ_HANDLED;
+ 
+ 	/* Clear the counter */
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c b/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c
+index 3ef01071f073..103471ff4dc4 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c
+@@ -40,5 +40,5 @@ int
+ g84_bsp_new(struct nvkm_device *device, int index, struct nvkm_engine **pengine)
+ {
+ 	return nvkm_xtensa_new_(&g84_bsp, device, index,
+-				true, 0x103000, pengine);
++				device->chipset != 0x92, 0x103000, pengine);
+ }
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c
+index e04a2296ecd0..5bb7f7e0f11f 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c
+@@ -240,6 +240,8 @@ nvkm_vm_unmap_pgt(struct nvkm_vm *vm, int big, u32 fpde, u32 lpde)
+ 			mmu->func->map_pgt(vpgd->obj, pde, vpgt->mem);
+ 		}
+ 
++		mmu->func->flush(vm);
++
+ 		nvkm_memory_del(&pgt);
+ 	}
+ }
+diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
+index 639d1a9c8793..1111cb966a44 100644
+--- a/drivers/i2c/busses/i2c-ismt.c
++++ b/drivers/i2c/busses/i2c-ismt.c
+@@ -338,12 +338,15 @@ static int ismt_process_desc(const struct ismt_desc *desc,
+ 			data->word = dma_buffer[0] | (dma_buffer[1] << 8);
+ 			break;
+ 		case I2C_SMBUS_BLOCK_DATA:
+-		case I2C_SMBUS_I2C_BLOCK_DATA:
+ 			if (desc->rxbytes != dma_buffer[0] + 1)
+ 				return -EMSGSIZE;
+ 
+ 			memcpy(data->block, dma_buffer, desc->rxbytes);
+ 			break;
++		case I2C_SMBUS_I2C_BLOCK_DATA:
++			memcpy(&data->block[1], dma_buffer, desc->rxbytes);
++			data->block[0] = desc->rxbytes;
++			break;
+ 		}
+ 		return 0;
+ 	}
+diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
+index 113e64fcd73b..4c6707ecc619 100644
+--- a/drivers/net/can/usb/esd_usb2.c
++++ b/drivers/net/can/usb/esd_usb2.c
+@@ -333,7 +333,7 @@ static void esd_usb2_rx_can_msg(struct esd_usb2_net_priv *priv,
+ 		}
+ 
+ 		cf->can_id = id & ESD_IDMASK;
+-		cf->can_dlc = get_can_dlc(msg->msg.rx.dlc);
++		cf->can_dlc = get_can_dlc(msg->msg.rx.dlc & ~ESD_RTR);
+ 
+ 		if (id & ESD_EXTID)
+ 			cf->can_id |= CAN_EFF_FLAG;
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index ae5709354546..27e2352fcc42 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -356,6 +356,8 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
+ 
+ 		gs_free_tx_context(txc);
+ 
++		atomic_dec(&dev->active_tx_urbs);
++
+ 		netif_wake_queue(netdev);
+ 	}
+ 
+@@ -444,14 +446,6 @@ static void gs_usb_xmit_callback(struct urb *urb)
+ 			  urb->transfer_buffer_length,
+ 			  urb->transfer_buffer,
+ 			  urb->transfer_dma);
+-
+-	atomic_dec(&dev->active_tx_urbs);
+-
+-	if (!netif_device_present(netdev))
+-		return;
+-
+-	if (netif_queue_stopped(netdev))
+-		netif_wake_queue(netdev);
+ }
+ 
+ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
+index 99dac9b8a082..c75bfd3f8cb3 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
+@@ -14764,8 +14764,8 @@ static void wlc_phy_ipa_restore_tx_digi_filts_nphy(struct brcms_phy *pi)
+ }
+ 
+ static void
+-wlc_phy_set_rfseq_nphy(struct brcms_phy *pi, u8 cmd, u8 *events, u8 *dlys,
+-		       u8 len)
++wlc_phy_set_rfseq_nphy(struct brcms_phy *pi, u8 cmd, const u8 *events,
++		       const u8 *dlys, u8 len)
+ {
+ 	u32 t1_offset, t2_offset;
+ 	u8 ctr;
+@@ -15240,16 +15240,16 @@ static void wlc_phy_workarounds_nphy_gainctrl_2057_rev5(struct brcms_phy *pi)
+ static void wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi)
+ {
+ 	u16 currband;
+-	s8 lna1G_gain_db_rev7[] = { 9, 14, 19, 24 };
+-	s8 *lna1_gain_db = NULL;
+-	s8 *lna1_gain_db_2 = NULL;
+-	s8 *lna2_gain_db = NULL;
+-	s8 tiaA_gain_db_rev7[] = { -9, -6, -3, 0, 3, 3, 3, 3, 3, 3 };
+-	s8 *tia_gain_db;
+-	s8 tiaA_gainbits_rev7[] = { 0, 1, 2, 3, 4, 4, 4, 4, 4, 4 };
+-	s8 *tia_gainbits;
+-	u16 rfseqA_init_gain_rev7[] = { 0x624f, 0x624f };
+-	u16 *rfseq_init_gain;
++	static const s8 lna1G_gain_db_rev7[] = { 9, 14, 19, 24 };
++	const s8 *lna1_gain_db = NULL;
++	const s8 *lna1_gain_db_2 = NULL;
++	const s8 *lna2_gain_db = NULL;
++	static const s8 tiaA_gain_db_rev7[] = { -9, -6, -3, 0, 3, 3, 3, 3, 3, 3 };
++	const s8 *tia_gain_db;
++	static const s8 tiaA_gainbits_rev7[] = { 0, 1, 2, 3, 4, 4, 4, 4, 4, 4 };
++	const s8 *tia_gainbits;
++	static const u16 rfseqA_init_gain_rev7[] = { 0x624f, 0x624f };
++	const u16 *rfseq_init_gain;
+ 	u16 init_gaincode;
+ 	u16 clip1hi_gaincode;
+ 	u16 clip1md_gaincode = 0;
+@@ -15310,10 +15310,9 @@ static void wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi)
+ 
+ 			if ((freq <= 5080) || (freq == 5825)) {
+ 
+-				s8 lna1A_gain_db_rev7[] = { 11, 16, 20, 24 };
+-				s8 lna1A_gain_db_2_rev7[] = {
+-					11, 17, 22, 25};
+-				s8 lna2A_gain_db_rev7[] = { -1, 6, 10, 14 };
++				static const s8 lna1A_gain_db_rev7[] = { 11, 16, 20, 24 };
++				static const s8 lna1A_gain_db_2_rev7[] = { 11, 17, 22, 25};
++				static const s8 lna2A_gain_db_rev7[] = { -1, 6, 10, 14 };
+ 
+ 				crsminu_th = 0x3e;
+ 				lna1_gain_db = lna1A_gain_db_rev7;
+@@ -15321,10 +15320,9 @@ static void wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi)
+ 				lna2_gain_db = lna2A_gain_db_rev7;
+ 			} else if ((freq >= 5500) && (freq <= 5700)) {
+ 
+-				s8 lna1A_gain_db_rev7[] = { 11, 17, 21, 25 };
+-				s8 lna1A_gain_db_2_rev7[] = {
+-					12, 18, 22, 26};
+-				s8 lna2A_gain_db_rev7[] = { 1, 8, 12, 16 };
++				static const s8 lna1A_gain_db_rev7[] = { 11, 17, 21, 25 };
++				static const s8 lna1A_gain_db_2_rev7[] = { 12, 18, 22, 26};
++				static const s8 lna2A_gain_db_rev7[] = { 1, 8, 12, 16 };
+ 
+ 				crsminu_th = 0x45;
+ 				clip1md_gaincode_B = 0x14;
+@@ -15335,10 +15333,9 @@ static void wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi)
+ 				lna2_gain_db = lna2A_gain_db_rev7;
+ 			} else {
+ 
+-				s8 lna1A_gain_db_rev7[] = { 12, 18, 22, 26 };
+-				s8 lna1A_gain_db_2_rev7[] = {
+-					12, 18, 22, 26};
+-				s8 lna2A_gain_db_rev7[] = { -1, 6, 10, 14 };
++				static const s8 lna1A_gain_db_rev7[] = { 12, 18, 22, 26 };
++				static const s8 lna1A_gain_db_2_rev7[] = { 12, 18, 22, 26};
++				static const s8 lna2A_gain_db_rev7[] = { -1, 6, 10, 14 };
+ 
+ 				crsminu_th = 0x41;
+ 				lna1_gain_db = lna1A_gain_db_rev7;
+@@ -15450,65 +15447,65 @@ static void wlc_phy_workarounds_nphy_gainctrl(struct brcms_phy *pi)
+ 		NPHY_RFSEQ_CMD_CLR_HIQ_DIS,
+ 		NPHY_RFSEQ_CMD_SET_HPF_BW
+ 	};
+-	u8 rfseq_updategainu_dlys[] = { 10, 30, 1 };
+-	s8 lna1G_gain_db[] = { 7, 11, 16, 23 };
+-	s8 lna1G_gain_db_rev4[] = { 8, 12, 17, 25 };
+-	s8 lna1G_gain_db_rev5[] = { 9, 13, 18, 26 };
+-	s8 lna1G_gain_db_rev6[] = { 8, 13, 18, 25 };
+-	s8 lna1G_gain_db_rev6_224B0[] = { 10, 14, 19, 27 };
+-	s8 lna1A_gain_db[] = { 7, 11, 17, 23 };
+-	s8 lna1A_gain_db_rev4[] = { 8, 12, 18, 23 };
+-	s8 lna1A_gain_db_rev5[] = { 6, 10, 16, 21 };
+-	s8 lna1A_gain_db_rev6[] = { 6, 10, 16, 21 };
+-	s8 *lna1_gain_db = NULL;
+-	s8 lna2G_gain_db[] = { -5, 6, 10, 14 };
+-	s8 lna2G_gain_db_rev5[] = { -3, 7, 11, 16 };
+-	s8 lna2G_gain_db_rev6[] = { -5, 6, 10, 14 };
+-	s8 lna2G_gain_db_rev6_224B0[] = { -5, 6, 10, 15 };
+-	s8 lna2A_gain_db[] = { -6, 2, 6, 10 };
+-	s8 lna2A_gain_db_rev4[] = { -5, 2, 6, 10 };
+-	s8 lna2A_gain_db_rev5[] = { -7, 0, 4, 8 };
+-	s8 lna2A_gain_db_rev6[] = { -7, 0, 4, 8 };
+-	s8 *lna2_gain_db = NULL;
+-	s8 tiaG_gain_db[] = {
++	static const u8 rfseq_updategainu_dlys[] = { 10, 30, 1 };
++	static const s8 lna1G_gain_db[] = { 7, 11, 16, 23 };
++	static const s8 lna1G_gain_db_rev4[] = { 8, 12, 17, 25 };
++	static const s8 lna1G_gain_db_rev5[] = { 9, 13, 18, 26 };
++	static const s8 lna1G_gain_db_rev6[] = { 8, 13, 18, 25 };
++	static const s8 lna1G_gain_db_rev6_224B0[] = { 10, 14, 19, 27 };
++	static const s8 lna1A_gain_db[] = { 7, 11, 17, 23 };
++	static const s8 lna1A_gain_db_rev4[] = { 8, 12, 18, 23 };
++	static const s8 lna1A_gain_db_rev5[] = { 6, 10, 16, 21 };
++	static const s8 lna1A_gain_db_rev6[] = { 6, 10, 16, 21 };
++	const s8 *lna1_gain_db = NULL;
++	static const s8 lna2G_gain_db[] = { -5, 6, 10, 14 };
++	static const s8 lna2G_gain_db_rev5[] = { -3, 7, 11, 16 };
++	static const s8 lna2G_gain_db_rev6[] = { -5, 6, 10, 14 };
++	static const s8 lna2G_gain_db_rev6_224B0[] = { -5, 6, 10, 15 };
++	static const s8 lna2A_gain_db[] = { -6, 2, 6, 10 };
++	static const s8 lna2A_gain_db_rev4[] = { -5, 2, 6, 10 };
++	static const s8 lna2A_gain_db_rev5[] = { -7, 0, 4, 8 };
++	static const s8 lna2A_gain_db_rev6[] = { -7, 0, 4, 8 };
++	const s8 *lna2_gain_db = NULL;
++	static const s8 tiaG_gain_db[] = {
+ 		0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A };
+-	s8 tiaA_gain_db[] = {
++	static const s8 tiaA_gain_db[] = {
+ 		0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13 };
+-	s8 tiaA_gain_db_rev4[] = {
++	static const s8 tiaA_gain_db_rev4[] = {
+ 		0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d };
+-	s8 tiaA_gain_db_rev5[] = {
++	static const s8 tiaA_gain_db_rev5[] = {
+ 		0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d };
+-	s8 tiaA_gain_db_rev6[] = {
++	static const s8 tiaA_gain_db_rev6[] = {
+ 		0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d };
+-	s8 *tia_gain_db;
+-	s8 tiaG_gainbits[] = {
++	const s8 *tia_gain_db;
++	static const s8 tiaG_gainbits[] = {
+ 		0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03 };
+-	s8 tiaA_gainbits[] = {
++	static const s8 tiaA_gainbits[] = {
+ 		0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06 };
+-	s8 tiaA_gainbits_rev4[] = {
++	static const s8 tiaA_gainbits_rev4[] = {
+ 		0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04 };
+-	s8 tiaA_gainbits_rev5[] = {
++	static const s8 tiaA_gainbits_rev5[] = {
+ 		0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04 };
+-	s8 tiaA_gainbits_rev6[] = {
++	static const s8 tiaA_gainbits_rev6[] = {
+ 		0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04 };
+-	s8 *tia_gainbits;
+-	s8 lpf_gain_db[] = { 0x00, 0x06, 0x0c, 0x12, 0x12, 0x12 };
+-	s8 lpf_gainbits[] = { 0x00, 0x01, 0x02, 0x03, 0x03, 0x03 };
+-	u16 rfseqG_init_gain[] = { 0x613f, 0x613f, 0x613f, 0x613f };
+-	u16 rfseqG_init_gain_rev4[] = { 0x513f, 0x513f, 0x513f, 0x513f };
+-	u16 rfseqG_init_gain_rev5[] = { 0x413f, 0x413f, 0x413f, 0x413f };
+-	u16 rfseqG_init_gain_rev5_elna[] = {
++	const s8 *tia_gainbits;
++	static const s8 lpf_gain_db[] = { 0x00, 0x06, 0x0c, 0x12, 0x12, 0x12 };
++	static const s8 lpf_gainbits[] = { 0x00, 0x01, 0x02, 0x03, 0x03, 0x03 };
++	static const u16 rfseqG_init_gain[] = { 0x613f, 0x613f, 0x613f, 0x613f };
++	static const u16 rfseqG_init_gain_rev4[] = { 0x513f, 0x513f, 0x513f, 0x513f };
++	static const u16 rfseqG_init_gain_rev5[] = { 0x413f, 0x413f, 0x413f, 0x413f };
++	static const u16 rfseqG_init_gain_rev5_elna[] = {
+ 		0x013f, 0x013f, 0x013f, 0x013f };
+-	u16 rfseqG_init_gain_rev6[] = { 0x513f, 0x513f };
+-	u16 rfseqG_init_gain_rev6_224B0[] = { 0x413f, 0x413f };
+-	u16 rfseqG_init_gain_rev6_elna[] = { 0x113f, 0x113f };
+-	u16 rfseqA_init_gain[] = { 0x516f, 0x516f, 0x516f, 0x516f };
+-	u16 rfseqA_init_gain_rev4[] = { 0x614f, 0x614f, 0x614f, 0x614f };
+-	u16 rfseqA_init_gain_rev4_elna[] = {
++	static const u16 rfseqG_init_gain_rev6[] = { 0x513f, 0x513f };
++	static const u16 rfseqG_init_gain_rev6_224B0[] = { 0x413f, 0x413f };
++	static const u16 rfseqG_init_gain_rev6_elna[] = { 0x113f, 0x113f };
++	static const u16 rfseqA_init_gain[] = { 0x516f, 0x516f, 0x516f, 0x516f };
++	static const u16 rfseqA_init_gain_rev4[] = { 0x614f, 0x614f, 0x614f, 0x614f };
++	static const u16 rfseqA_init_gain_rev4_elna[] = {
+ 		0x314f, 0x314f, 0x314f, 0x314f };
+-	u16 rfseqA_init_gain_rev5[] = { 0x714f, 0x714f, 0x714f, 0x714f };
+-	u16 rfseqA_init_gain_rev6[] = { 0x714f, 0x714f };
+-	u16 *rfseq_init_gain;
++	static const u16 rfseqA_init_gain_rev5[] = { 0x714f, 0x714f, 0x714f, 0x714f };
++	static const u16 rfseqA_init_gain_rev6[] = { 0x714f, 0x714f };
++	const u16 *rfseq_init_gain;
+ 	u16 initG_gaincode = 0x627e;
+ 	u16 initG_gaincode_rev4 = 0x527e;
+ 	u16 initG_gaincode_rev5 = 0x427e;
+@@ -15538,10 +15535,10 @@ static void wlc_phy_workarounds_nphy_gainctrl(struct brcms_phy *pi)
+ 	u16 clip1mdA_gaincode_rev6 = 0x2084;
+ 	u16 clip1md_gaincode = 0;
+ 	u16 clip1loG_gaincode = 0x0074;
+-	u16 clip1loG_gaincode_rev5[] = {
++	static const u16 clip1loG_gaincode_rev5[] = {
+ 		0x0062, 0x0064, 0x006a, 0x106a, 0x106c, 0x1074, 0x107c, 0x207c
+ 	};
+-	u16 clip1loG_gaincode_rev6[] = {
++	static const u16 clip1loG_gaincode_rev6[] = {
+ 		0x106a, 0x106c, 0x1074, 0x107c, 0x007e, 0x107e, 0x207e, 0x307e
+ 	};
+ 	u16 clip1loG_gaincode_rev6_224B0 = 0x1074;
+@@ -16066,7 +16063,7 @@ static void wlc_phy_workarounds_nphy_gainctrl(struct brcms_phy *pi)
+ 
+ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
+ {
+-	u8 rfseq_rx2tx_events[] = {
++	static const u8 rfseq_rx2tx_events[] = {
+ 		NPHY_RFSEQ_CMD_NOP,
+ 		NPHY_RFSEQ_CMD_RXG_FBW,
+ 		NPHY_RFSEQ_CMD_TR_SWITCH,
+@@ -16076,7 +16073,7 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
+ 		NPHY_RFSEQ_CMD_EXT_PA
+ 	};
+ 	u8 rfseq_rx2tx_dlys[] = { 8, 6, 6, 2, 4, 60, 1 };
+-	u8 rfseq_tx2rx_events[] = {
++	static const u8 rfseq_tx2rx_events[] = {
+ 		NPHY_RFSEQ_CMD_NOP,
+ 		NPHY_RFSEQ_CMD_EXT_PA,
+ 		NPHY_RFSEQ_CMD_TX_GAIN,
+@@ -16085,8 +16082,8 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
+ 		NPHY_RFSEQ_CMD_RXG_FBW,
+ 		NPHY_RFSEQ_CMD_CLR_HIQ_DIS
+ 	};
+-	u8 rfseq_tx2rx_dlys[] = { 8, 6, 2, 4, 4, 6, 1 };
+-	u8 rfseq_tx2rx_events_rev3[] = {
++	static const u8 rfseq_tx2rx_dlys[] = { 8, 6, 2, 4, 4, 6, 1 };
++	static const u8 rfseq_tx2rx_events_rev3[] = {
+ 		NPHY_REV3_RFSEQ_CMD_EXT_PA,
+ 		NPHY_REV3_RFSEQ_CMD_INT_PA_PU,
+ 		NPHY_REV3_RFSEQ_CMD_TX_GAIN,
+@@ -16096,7 +16093,7 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
+ 		NPHY_REV3_RFSEQ_CMD_CLR_HIQ_DIS,
+ 		NPHY_REV3_RFSEQ_CMD_END
+ 	};
+-	u8 rfseq_tx2rx_dlys_rev3[] = { 8, 4, 2, 2, 4, 4, 6, 1 };
++	static const u8 rfseq_tx2rx_dlys_rev3[] = { 8, 4, 2, 2, 4, 4, 6, 1 };
+ 	u8 rfseq_rx2tx_events_rev3[] = {
+ 		NPHY_REV3_RFSEQ_CMD_NOP,
+ 		NPHY_REV3_RFSEQ_CMD_RXG_FBW,
+@@ -16110,7 +16107,7 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
+ 	};
+ 	u8 rfseq_rx2tx_dlys_rev3[] = { 8, 6, 6, 4, 4, 18, 42, 1, 1 };
+ 
+-	u8 rfseq_rx2tx_events_rev3_ipa[] = {
++	static const u8 rfseq_rx2tx_events_rev3_ipa[] = {
+ 		NPHY_REV3_RFSEQ_CMD_NOP,
+ 		NPHY_REV3_RFSEQ_CMD_RXG_FBW,
+ 		NPHY_REV3_RFSEQ_CMD_TR_SWITCH,
+@@ -16121,15 +16118,15 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
+ 		NPHY_REV3_RFSEQ_CMD_INT_PA_PU,
+ 		NPHY_REV3_RFSEQ_CMD_END
+ 	};
+-	u8 rfseq_rx2tx_dlys_rev3_ipa[] = { 8, 6, 6, 4, 4, 16, 43, 1, 1 };
+-	u16 rfseq_rx2tx_dacbufpu_rev7[] = { 0x10f, 0x10f };
++	static const u8 rfseq_rx2tx_dlys_rev3_ipa[] = { 8, 6, 6, 4, 4, 16, 43, 1, 1 };
++	static const u16 rfseq_rx2tx_dacbufpu_rev7[] = { 0x10f, 0x10f };
+ 
+ 	s16 alpha0, alpha1, alpha2;
+ 	s16 beta0, beta1, beta2;
+ 	u32 leg_data_weights, ht_data_weights, nss1_data_weights,
+ 	    stbc_data_weights;
+ 	u8 chan_freq_range = 0;
+-	u16 dac_control = 0x0002;
++	static const u16 dac_control = 0x0002;
+ 	u16 aux_adc_vmid_rev7_core0[] = { 0x8e, 0x96, 0x96, 0x96 };
+ 	u16 aux_adc_vmid_rev7_core1[] = { 0x8f, 0x9f, 0x9f, 0x96 };
+ 	u16 aux_adc_vmid_rev4[] = { 0xa2, 0xb4, 0xb4, 0x89 };
+@@ -16139,8 +16136,8 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
+ 	u16 aux_adc_gain_rev4[] = { 0x02, 0x02, 0x02, 0x00 };
+ 	u16 aux_adc_gain_rev3[] = { 0x02, 0x02, 0x02, 0x00 };
+ 	u16 *aux_adc_gain;
+-	u16 sk_adc_vmid[] = { 0xb4, 0xb4, 0xb4, 0x24 };
+-	u16 sk_adc_gain[] = { 0x02, 0x02, 0x02, 0x02 };
++	static const u16 sk_adc_vmid[] = { 0xb4, 0xb4, 0xb4, 0x24 };
++	static const u16 sk_adc_gain[] = { 0x02, 0x02, 0x02, 0x02 };
+ 	s32 min_nvar_val = 0x18d;
+ 	s32 min_nvar_offset_6mbps = 20;
+ 	u8 pdetrange;
+@@ -16151,9 +16148,9 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
+ 	u16 rfseq_rx2tx_lpf_h_hpc_rev7 = 0x77;
+ 	u16 rfseq_tx2rx_lpf_h_hpc_rev7 = 0x77;
+ 	u16 rfseq_pktgn_lpf_h_hpc_rev7 = 0x77;
+-	u16 rfseq_htpktgn_lpf_hpc_rev7[] = { 0x77, 0x11, 0x11 };
+-	u16 rfseq_pktgn_lpf_hpc_rev7[] = { 0x11, 0x11 };
+-	u16 rfseq_cckpktgn_lpf_hpc_rev7[] = { 0x11, 0x11 };
++	static const u16 rfseq_htpktgn_lpf_hpc_rev7[] = { 0x77, 0x11, 0x11 };
++	static const u16 rfseq_pktgn_lpf_hpc_rev7[] = { 0x11, 0x11 };
++	static const u16 rfseq_cckpktgn_lpf_hpc_rev7[] = { 0x11, 0x11 };
+ 	u16 ipalvlshift_3p3_war_en = 0;
+ 	u16 rccal_bcap_val, rccal_scap_val;
+ 	u16 rccal_tx20_11b_bcap = 0;
+@@ -24291,13 +24288,13 @@ static void wlc_phy_update_txcal_ladder_nphy(struct brcms_phy *pi, u16 core)
+ 	u16 bbmult;
+ 	u16 tblentry;
+ 
+-	struct nphy_txiqcal_ladder ladder_lo[] = {
++	static const struct nphy_txiqcal_ladder ladder_lo[] = {
+ 		{3, 0}, {4, 0}, {6, 0}, {9, 0}, {13, 0}, {18, 0},
+ 		{25, 0}, {25, 1}, {25, 2}, {25, 3}, {25, 4}, {25, 5},
+ 		{25, 6}, {25, 7}, {35, 7}, {50, 7}, {71, 7}, {100, 7}
+ 	};
+ 
+-	struct nphy_txiqcal_ladder ladder_iq[] = {
++	static const struct nphy_txiqcal_ladder ladder_iq[] = {
+ 		{3, 0}, {4, 0}, {6, 0}, {9, 0}, {13, 0}, {18, 0},
+ 		{25, 0}, {35, 0}, {50, 0}, {71, 0}, {100, 0}, {100, 1},
+ 		{100, 2}, {100, 3}, {100, 4}, {100, 5}, {100, 6}, {100, 7}
+@@ -25773,67 +25770,67 @@ wlc_phy_cal_txiqlo_nphy(struct brcms_phy *pi, struct nphy_txgains target_gain,
+ 	u16 cal_gain[2];
+ 	struct nphy_iqcal_params cal_params[2];
+ 	u32 tbl_len;
+-	void *tbl_ptr;
++	const void *tbl_ptr;
+ 	bool ladder_updated[2];
+ 	u8 mphase_cal_lastphase = 0;
+ 	int bcmerror = 0;
+ 	bool phyhang_avoid_state = false;
+ 
+-	u16 tbl_tx_iqlo_cal_loft_ladder_20[] = {
++	static const u16 tbl_tx_iqlo_cal_loft_ladder_20[] = {
+ 		0x0300, 0x0500, 0x0700, 0x0900, 0x0d00, 0x1100, 0x1900, 0x1901,
+ 		0x1902,
+ 		0x1903, 0x1904, 0x1905, 0x1906, 0x1907, 0x2407, 0x3207, 0x4607,
+ 		0x6407
+ 	};
+ 
+-	u16 tbl_tx_iqlo_cal_iqimb_ladder_20[] = {
++	static const u16 tbl_tx_iqlo_cal_iqimb_ladder_20[] = {
+ 		0x0200, 0x0300, 0x0600, 0x0900, 0x0d00, 0x1100, 0x1900, 0x2400,
+ 		0x3200,
+ 		0x4600, 0x6400, 0x6401, 0x6402, 0x6403, 0x6404, 0x6405, 0x6406,
+ 		0x6407
+ 	};
+ 
+-	u16 tbl_tx_iqlo_cal_loft_ladder_40[] = {
++	static const u16 tbl_tx_iqlo_cal_loft_ladder_40[] = {
+ 		0x0200, 0x0300, 0x0400, 0x0700, 0x0900, 0x0c00, 0x1200, 0x1201,
+ 		0x1202,
+ 		0x1203, 0x1204, 0x1205, 0x1206, 0x1207, 0x1907, 0x2307, 0x3207,
+ 		0x4707
+ 	};
+ 
+-	u16 tbl_tx_iqlo_cal_iqimb_ladder_40[] = {
++	static const u16 tbl_tx_iqlo_cal_iqimb_ladder_40[] = {
+ 		0x0100, 0x0200, 0x0400, 0x0700, 0x0900, 0x0c00, 0x1200, 0x1900,
+ 		0x2300,
+ 		0x3200, 0x4700, 0x4701, 0x4702, 0x4703, 0x4704, 0x4705, 0x4706,
+ 		0x4707
+ 	};
+ 
+-	u16 tbl_tx_iqlo_cal_startcoefs[] = {
++	static const u16 tbl_tx_iqlo_cal_startcoefs[] = {
+ 		0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+ 		0x0000
+ 	};
+ 
+-	u16 tbl_tx_iqlo_cal_cmds_fullcal[] = {
++	static const u16 tbl_tx_iqlo_cal_cmds_fullcal[] = {
+ 		0x8123, 0x8264, 0x8086, 0x8245, 0x8056,
+ 		0x9123, 0x9264, 0x9086, 0x9245, 0x9056
+ 	};
+ 
+-	u16 tbl_tx_iqlo_cal_cmds_recal[] = {
++	static const u16 tbl_tx_iqlo_cal_cmds_recal[] = {
+ 		0x8101, 0x8253, 0x8053, 0x8234, 0x8034,
+ 		0x9101, 0x9253, 0x9053, 0x9234, 0x9034
+ 	};
+ 
+-	u16 tbl_tx_iqlo_cal_startcoefs_nphyrev3[] = {
++	static const u16 tbl_tx_iqlo_cal_startcoefs_nphyrev3[] = {
+ 		0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+ 		0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+ 		0x0000
+ 	};
+ 
+-	u16 tbl_tx_iqlo_cal_cmds_fullcal_nphyrev3[] = {
++	static const u16 tbl_tx_iqlo_cal_cmds_fullcal_nphyrev3[] = {
+ 		0x8434, 0x8334, 0x8084, 0x8267, 0x8056, 0x8234,
+ 		0x9434, 0x9334, 0x9084, 0x9267, 0x9056, 0x9234
+ 	};
+ 
+-	u16 tbl_tx_iqlo_cal_cmds_recal_nphyrev3[] = {
++	static const u16 tbl_tx_iqlo_cal_cmds_recal_nphyrev3[] = {
+ 		0x8423, 0x8323, 0x8073, 0x8256, 0x8045, 0x8223,
+ 		0x9423, 0x9323, 0x9073, 0x9256, 0x9045, 0x9223
+ 	};
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+index c2103e7a8132..bbb789f8990b 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+@@ -1127,7 +1127,7 @@ static u8 _rtl8821ae_dbi_read(struct rtl_priv *rtlpriv, u16 addr)
+ 	}
+ 	if (0 == tmp) {
+ 		read_addr = REG_DBI_RDATA + addr % 4;
+-		ret = rtl_read_byte(rtlpriv, read_addr);
++		ret = rtl_read_word(rtlpriv, read_addr);
+ 	}
+ 	return ret;
+ }
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index df96f5f88c15..3f6bb3fff890 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1762,6 +1762,9 @@ static const struct usb_device_id acm_ids[] = {
+ 	{ USB_DEVICE(0xfff0, 0x0100), /* DATECS FP-2000 */
+ 	.driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+ 	},
++	{ USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */
++	.driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */
++	},
+ 
+ 	{ USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
+ 	.driver_info = CLEAR_HALT_CONDITIONS,
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index d9d048fc9082..5172bec612eb 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -926,10 +926,12 @@ int usb_get_bos_descriptor(struct usb_device *dev)
+ 	for (i = 0; i < num; i++) {
+ 		buffer += length;
+ 		cap = (struct usb_dev_cap_header *)buffer;
+-		length = cap->bLength;
+ 
+-		if (total_len < length)
++		if (total_len < sizeof(*cap) || total_len < cap->bLength) {
++			dev->bos->desc->bNumDeviceCaps = i;
+ 			break;
++		}
++		length = cap->bLength;
+ 		total_len -= length;
+ 
+ 		if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index bd9419213d06..873ba02d59e6 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1417,11 +1417,7 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
+ 			totlen += isopkt[u].length;
+ 		}
+ 		u *= sizeof(struct usb_iso_packet_descriptor);
+-		if (totlen <= uurb->buffer_length)
+-			uurb->buffer_length = totlen;
+-		else
+-			WARN_ONCE(1, "uurb->buffer_length is too short %d vs %d",
+-				  totlen, uurb->buffer_length);
++		uurb->buffer_length = totlen;
+ 		break;
+ 
+ 	default:
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 51bba58c0c3b..22e61786354a 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2656,13 +2656,16 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
+ 	if (!(portstatus & USB_PORT_STAT_CONNECTION))
+ 		return -ENOTCONN;
+ 
+-	/* bomb out completely if the connection bounced.  A USB 3.0
+-	 * connection may bounce if multiple warm resets were issued,
++	/* Retry if connect change is set but status is still connected.
++	 * A USB 3.0 connection may bounce if multiple warm resets were issued,
+ 	 * but the device may have successfully re-connected. Ignore it.
+ 	 */
+ 	if (!hub_is_superspeed(hub->hdev) &&
+-			(portchange & USB_PORT_STAT_C_CONNECTION))
+-		return -ENOTCONN;
++	    (portchange & USB_PORT_STAT_C_CONNECTION)) {
++		usb_clear_port_feature(hub->hdev, port1,
++				       USB_PORT_FEAT_C_CONNECTION);
++		return -EAGAIN;
++	}
+ 
+ 	if (!(portstatus & USB_PORT_STAT_ENABLE))
+ 		return -EBUSY;
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 82806e311202..a6aaf2f193a4 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -221,6 +221,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Corsair Strafe RGB */
+ 	{ USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
+ 
++	/* MIDI keyboard WORLDE MINI */
++	{ USB_DEVICE(0x1c75, 0x0204), .driver_info =
++			USB_QUIRK_CONFIG_INTF_STRINGS },
++
+ 	/* Acer C120 LED Projector */
+ 	{ USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM },
+ 
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index 00eed5d66fda..06d83825923a 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -877,7 +877,7 @@ b_host:
+ 	 */
+ 	if (int_usb & MUSB_INTR_RESET) {
+ 		handled = IRQ_HANDLED;
+-		if (devctl & MUSB_DEVCTL_HM) {
++		if (is_host_active(musb)) {
+ 			/*
+ 			 * When BABBLE happens what we can depends on which
+ 			 * platform MUSB is running, because some platforms
+@@ -887,9 +887,7 @@ b_host:
+ 			 * drop the session.
+ 			 */
+ 			dev_err(musb->controller, "Babble\n");
+-
+-			if (is_host_active(musb))
+-				musb_recover_from_babble(musb);
++			musb_recover_from_babble(musb);
+ 		} else {
+ 			dev_dbg(musb->controller, "BUS RESET as %s\n",
+ 				usb_otg_state_string(musb->xceiv->otg->state));
+diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c
+index d9b0dc461439..2d3be66fb563 100644
+--- a/drivers/usb/musb/sunxi.c
++++ b/drivers/usb/musb/sunxi.c
+@@ -320,6 +320,8 @@ static int sunxi_musb_exit(struct musb *musb)
+ 	if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags))
+ 		sunxi_sram_release(musb->controller->parent);
+ 
++	devm_usb_put_phy(glue->dev, glue->xceiv);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/serial/metro-usb.c b/drivers/usb/serial/metro-usb.c
+index 39e683096e94..45182c65fa1f 100644
+--- a/drivers/usb/serial/metro-usb.c
++++ b/drivers/usb/serial/metro-usb.c
+@@ -45,6 +45,7 @@ struct metrousb_private {
+ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_BI) },
+ 	{ USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_UNI) },
++	{ USB_DEVICE_INTERFACE_CLASS(0x0c2e, 0x0730, 0xff) },	/* MS7820 */
+ 	{ }, /* Terminating entry. */
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
+diff --git a/fs/ext4/crypto_key.c b/fs/ext4/crypto_key.c
+index 505f8afde57c..9a1bc638abce 100644
+--- a/fs/ext4/crypto_key.c
++++ b/fs/ext4/crypto_key.c
+@@ -204,6 +204,12 @@ int ext4_get_encryption_info(struct inode *inode)
+ 	}
+ 	down_read(&keyring_key->sem);
+ 	ukp = user_key_payload(keyring_key);
++	if (!ukp) {
++		/* key was revoked before we acquired its semaphore */
++		res = -EKEYREVOKED;
++		up_read(&keyring_key->sem);
++		goto out;
++	}
+ 	if (ukp->datalen != sizeof(struct ext4_encryption_key)) {
+ 		res = -EINVAL;
+ 		up_read(&keyring_key->sem);
+diff --git a/fs/f2fs/crypto.c b/fs/f2fs/crypto.c
+index 4a62ef14e932..d879c6c846b7 100644
+--- a/fs/f2fs/crypto.c
++++ b/fs/f2fs/crypto.c
+@@ -362,7 +362,6 @@ static int f2fs_page_crypto(struct f2fs_crypto_ctx *ctx,
+ 	else
+ 		res = crypto_ablkcipher_encrypt(req);
+ 	if (res == -EINPROGRESS || res == -EBUSY) {
+-		BUG_ON(req->base.data != &ecr);
+ 		wait_for_completion(&ecr.completion);
+ 		res = ecr.res;
+ 	}
+diff --git a/fs/f2fs/crypto_fname.c b/fs/f2fs/crypto_fname.c
+index 38349ed5ea51..0fce444dd5ae 100644
+--- a/fs/f2fs/crypto_fname.c
++++ b/fs/f2fs/crypto_fname.c
+@@ -124,7 +124,6 @@ static int f2fs_fname_encrypt(struct inode *inode,
+ 	ablkcipher_request_set_crypt(req, &src_sg, &dst_sg, ciphertext_len, iv);
+ 	res = crypto_ablkcipher_encrypt(req);
+ 	if (res == -EINPROGRESS || res == -EBUSY) {
+-		BUG_ON(req->base.data != &ecr);
+ 		wait_for_completion(&ecr.completion);
+ 		res = ecr.res;
+ 	}
+@@ -180,7 +179,6 @@ static int f2fs_fname_decrypt(struct inode *inode,
+ 	ablkcipher_request_set_crypt(req, &src_sg, &dst_sg, iname->len, iv);
+ 	res = crypto_ablkcipher_decrypt(req);
+ 	if (res == -EINPROGRESS || res == -EBUSY) {
+-		BUG_ON(req->base.data != &ecr);
+ 		wait_for_completion(&ecr.completion);
+ 		res = ecr.res;
+ 	}
+diff --git a/fs/f2fs/crypto_key.c b/fs/f2fs/crypto_key.c
+index 18595d7a0efc..7e62889a1d3d 100644
+--- a/fs/f2fs/crypto_key.c
++++ b/fs/f2fs/crypto_key.c
+@@ -75,7 +75,6 @@ static int f2fs_derive_key_aes(char deriving_key[F2FS_AES_128_ECB_KEY_SIZE],
+ 					F2FS_AES_256_XTS_KEY_SIZE, NULL);
+ 	res = crypto_ablkcipher_encrypt(req);
+ 	if (res == -EINPROGRESS || res == -EBUSY) {
+-		BUG_ON(req->base.data != &ecr);
+ 		wait_for_completion(&ecr.completion);
+ 		res = ecr.res;
+ 	}
+@@ -189,18 +188,38 @@ int f2fs_get_encryption_info(struct inode *inode)
+ 		keyring_key = NULL;
+ 		goto out;
+ 	}
+-	BUG_ON(keyring_key->type != &key_type_logon);
++	if (keyring_key->type != &key_type_logon) {
++		printk_once(KERN_WARNING "f2fs: key type must be logon\n");
++		res = -ENOKEY;
++		goto out;
++	}
++	down_read(&keyring_key->sem);
+ 	ukp = user_key_payload(keyring_key);
++	if (!ukp) {
++		/* key was revoked before we acquired its semaphore */
++		res = -EKEYREVOKED;
++		up_read(&keyring_key->sem);
++		goto out;
++	}
+ 	if (ukp->datalen != sizeof(struct f2fs_encryption_key)) {
+ 		res = -EINVAL;
++		up_read(&keyring_key->sem);
+ 		goto out;
+ 	}
+ 	master_key = (struct f2fs_encryption_key *)ukp->data;
+ 	BUILD_BUG_ON(F2FS_AES_128_ECB_KEY_SIZE !=
+ 				F2FS_KEY_DERIVATION_NONCE_SIZE);
+-	BUG_ON(master_key->size != F2FS_AES_256_XTS_KEY_SIZE);
++	if (master_key->size != F2FS_AES_256_XTS_KEY_SIZE) {
++		printk_once(KERN_WARNING
++				"f2fs: key size incorrect: %d\n",
++				master_key->size);
++		res = -ENOKEY;
++		up_read(&keyring_key->sem);
++		goto out;
++	}
+ 	res = f2fs_derive_key_aes(ctx.nonce, master_key->raw,
+ 				  raw_key);
++	up_read(&keyring_key->sem);
+ 	if (res)
+ 		goto out;
+ 
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 4b449d263333..01eed94b01ea 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1541,12 +1541,18 @@ static int f2fs_ioc_set_encryption_policy(struct file *filp, unsigned long arg)
+ 				sizeof(policy)))
+ 		return -EFAULT;
+ 
++	err = mnt_want_write_file(filp);
++	if (err)
++		return err;
++
+ 	mutex_lock(&inode->i_mutex);
+ 
+ 	err = f2fs_process_policy(&policy, inode);
+ 
+ 	mutex_unlock(&inode->i_mutex);
+ 
++	mnt_drop_write_file(filp);
++
+ 	return err;
+ #else
+ 	return -EOPNOTSUPP;
+diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c
+index 6b028b7c4250..926580a85153 100644
+--- a/fs/fscache/object-list.c
++++ b/fs/fscache/object-list.c
+@@ -330,6 +330,13 @@ static void fscache_objlist_config(struct fscache_objlist_data *data)
+ 	rcu_read_lock();
+ 
+ 	confkey = user_key_payload(key);
++	if (!confkey) {
++		/* key was revoked */
++		rcu_read_unlock();
++		key_put(key);
++		goto no_config;
++	}
++
+ 	buf = confkey->data;
+ 
+ 	for (len = confkey->datalen - 1; len >= 0; len--) {
+diff --git a/include/linux/key.h b/include/linux/key.h
+index dcc115e8dd03..af071ca73079 100644
+--- a/include/linux/key.h
++++ b/include/linux/key.h
+@@ -126,6 +126,11 @@ static inline bool is_key_possessed(const key_ref_t key_ref)
+ 	return (unsigned long) key_ref & 1UL;
+ }
+ 
++enum key_state {
++	KEY_IS_UNINSTANTIATED,
++	KEY_IS_POSITIVE,		/* Positively instantiated */
++};
++
+ /*****************************************************************************/
+ /*
+  * authentication token / access credential / keyring
+@@ -157,6 +162,7 @@ struct key {
+ 						 * - may not match RCU dereferenced payload
+ 						 * - payload should contain own length
+ 						 */
++	short			state;		/* Key state (+) or rejection error (-) */
+ 
+ #ifdef KEY_DEBUGGING
+ 	unsigned		magic;
+@@ -165,19 +171,17 @@ struct key {
+ #endif
+ 
+ 	unsigned long		flags;		/* status flags (change with bitops) */
+-#define KEY_FLAG_INSTANTIATED	0	/* set if key has been instantiated */
+-#define KEY_FLAG_DEAD		1	/* set if key type has been deleted */
+-#define KEY_FLAG_REVOKED	2	/* set if key had been revoked */
+-#define KEY_FLAG_IN_QUOTA	3	/* set if key consumes quota */
+-#define KEY_FLAG_USER_CONSTRUCT	4	/* set if key is being constructed in userspace */
+-#define KEY_FLAG_NEGATIVE	5	/* set if key is negative */
+-#define KEY_FLAG_ROOT_CAN_CLEAR	6	/* set if key can be cleared by root without permission */
+-#define KEY_FLAG_INVALIDATED	7	/* set if key has been invalidated */
+-#define KEY_FLAG_TRUSTED	8	/* set if key is trusted */
+-#define KEY_FLAG_TRUSTED_ONLY	9	/* set if keyring only accepts links to trusted keys */
+-#define KEY_FLAG_BUILTIN	10	/* set if key is builtin */
+-#define KEY_FLAG_ROOT_CAN_INVAL	11	/* set if key can be invalidated by root without permission */
+-#define KEY_FLAG_UID_KEYRING	12	/* set if key is a user or user session keyring */
++#define KEY_FLAG_DEAD		0	/* set if key type has been deleted */
++#define KEY_FLAG_REVOKED	1	/* set if key had been revoked */
++#define KEY_FLAG_IN_QUOTA	2	/* set if key consumes quota */
++#define KEY_FLAG_USER_CONSTRUCT	3	/* set if key is being constructed in userspace */
++#define KEY_FLAG_ROOT_CAN_CLEAR	4	/* set if key can be cleared by root without permission */
++#define KEY_FLAG_INVALIDATED	5	/* set if key has been invalidated */
++#define KEY_FLAG_TRUSTED	6	/* set if key is trusted */
++#define KEY_FLAG_TRUSTED_ONLY	7	/* set if keyring only accepts links to trusted keys */
++#define KEY_FLAG_BUILTIN	8	/* set if key is builtin */
++#define KEY_FLAG_ROOT_CAN_INVAL	9	/* set if key can be invalidated by root without permission */
++#define KEY_FLAG_UID_KEYRING	10	/* set if key is a user or user session keyring */
+ 
+ 	/* the key type and key description string
+ 	 * - the desc is used to match a key against search criteria
+@@ -203,7 +207,6 @@ struct key {
+ 			struct list_head name_link;
+ 			struct assoc_array keys;
+ 		};
+-		int reject_error;
+ 	};
+ };
+ 
+@@ -319,17 +322,27 @@ extern void key_set_timeout(struct key *, unsigned);
+ #define	KEY_NEED_SETATTR 0x20	/* Require permission to change attributes */
+ #define	KEY_NEED_ALL	0x3f	/* All the above permissions */
+ 
++static inline short key_read_state(const struct key *key)
++{
++	/* Barrier versus mark_key_instantiated(). */
++	return smp_load_acquire(&key->state);
++}
++
+ /**
+- * key_is_instantiated - Determine if a key has been positively instantiated
++ * key_is_positive - Determine if a key has been positively instantiated
+  * @key: The key to check.
+  *
+  * Return true if the specified key has been positively instantiated, false
+  * otherwise.
+  */
+-static inline bool key_is_instantiated(const struct key *key)
++static inline bool key_is_positive(const struct key *key)
++{
++	return key_read_state(key) == KEY_IS_POSITIVE;
++}
++
++static inline bool key_is_negative(const struct key *key)
+ {
+-	return test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
+-		!test_bit(KEY_FLAG_NEGATIVE, &key->flags);
++	return key_read_state(key) < 0;
+ }
+ 
+ #define rcu_dereference_key(KEY)					\
+diff --git a/include/linux/mbus.h b/include/linux/mbus.h
+index 1f7bc630d225..71a5a56b0bba 100644
+--- a/include/linux/mbus.h
++++ b/include/linux/mbus.h
+@@ -29,8 +29,8 @@ struct mbus_dram_target_info
+ 	struct mbus_dram_window {
+ 		u8	cs_index;
+ 		u8	mbus_attr;
+-		u32	base;
+-		u32	size;
++		u64	base;
++		u64	size;
+ 	} cs[4];
+ };
+ 
+diff --git a/kernel/sched/auto_group.c b/kernel/sched/auto_group.c
+index 750ed601ddf7..8620fd01b3d0 100644
+--- a/kernel/sched/auto_group.c
++++ b/kernel/sched/auto_group.c
+@@ -111,14 +111,11 @@ bool task_wants_autogroup(struct task_struct *p, struct task_group *tg)
+ {
+ 	if (tg != &root_task_group)
+ 		return false;
+-
+ 	/*
+-	 * We can only assume the task group can't go away on us if
+-	 * autogroup_move_group() can see us on ->thread_group list.
++	 * If we race with autogroup_move_group() the caller can use the old
++	 * value of signal->autogroup but in this case sched_move_task() will
++	 * be called again before autogroup_kref_put().
+ 	 */
+-	if (p->flags & PF_EXITING)
+-		return false;
+-
+ 	return true;
+ }
+ 
+@@ -138,13 +135,17 @@ autogroup_move_group(struct task_struct *p, struct autogroup *ag)
+ 	}
+ 
+ 	p->signal->autogroup = autogroup_kref_get(ag);
+-
+-	if (!READ_ONCE(sysctl_sched_autogroup_enabled))
+-		goto out;
+-
++	/*
++	 * We can't avoid sched_move_task() after we changed signal->autogroup,
++	 * this process can already run with task_group() == prev->tg or we can
++	 * race with cgroup code which can read autogroup = prev under rq->lock.
++	 * In the latter case for_each_thread() can not miss a migrating thread,
++	 * cpu_cgroup_attach() must not be possible after cgroup_exit() and it
++	 * can't be removed from thread list, we hold ->siglock.
++	 */
+ 	for_each_thread(p, t)
+ 		sched_move_task(t);
+-out:
++
+ 	unlock_task_sighand(p, &flags);
+ 	autogroup_kref_put(prev);
+ }
+diff --git a/lib/digsig.c b/lib/digsig.c
+index 07be6c1ef4e2..00c5c8179393 100644
+--- a/lib/digsig.c
++++ b/lib/digsig.c
+@@ -87,6 +87,12 @@ static int digsig_verify_rsa(struct key *key,
+ 	down_read(&key->sem);
+ 	ukp = user_key_payload(key);
+ 
++	if (!ukp) {
++		/* key was revoked before we acquired its semaphore */
++		err = -EKEYREVOKED;
++		goto err1;
++	}
++
+ 	if (ukp->datalen < sizeof(*pkh))
+ 		goto err1;
+ 
+diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
+index c79b85eb4d4c..6abc5012200b 100644
+--- a/net/dns_resolver/dns_key.c
++++ b/net/dns_resolver/dns_key.c
+@@ -224,7 +224,7 @@ static int dns_resolver_match_preparse(struct key_match_data *match_data)
+ static void dns_resolver_describe(const struct key *key, struct seq_file *m)
+ {
+ 	seq_puts(m, key->description);
+-	if (key_is_instantiated(key)) {
++	if (key_is_positive(key)) {
+ 		int err = PTR_ERR(key->payload.data[dns_key_error]);
+ 
+ 		if (err)
+diff --git a/security/keys/big_key.c b/security/keys/big_key.c
+index 907c1522ee46..08c4cc5c2973 100644
+--- a/security/keys/big_key.c
++++ b/security/keys/big_key.c
+@@ -138,7 +138,7 @@ void big_key_revoke(struct key *key)
+ 
+ 	/* clear the quota */
+ 	key_payload_reserve(key, 0);
+-	if (key_is_instantiated(key) &&
++	if (key_is_positive(key) &&
+ 	    (size_t)key->payload.data[big_key_len] > BIG_KEY_FILE_THRESHOLD)
+ 		vfs_truncate(path, 0);
+ }
+@@ -170,7 +170,7 @@ void big_key_describe(const struct key *key, struct seq_file *m)
+ 
+ 	seq_puts(m, key->description);
+ 
+-	if (key_is_instantiated(key))
++	if (key_is_positive(key))
+ 		seq_printf(m, ": %zu [%s]",
+ 			   datalen,
+ 			   datalen > BIG_KEY_FILE_THRESHOLD ? "file" : "buff");
+diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
+index 31898856682e..ce295c0c1da0 100644
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -315,6 +315,13 @@ static struct key *request_user_key(const char *master_desc, const u8 **master_k
+ 
+ 	down_read(&ukey->sem);
+ 	upayload = user_key_payload(ukey);
++	if (!upayload) {
++		/* key was revoked before we acquired its semaphore */
++		up_read(&ukey->sem);
++		key_put(ukey);
++		ukey = ERR_PTR(-EKEYREVOKED);
++		goto error;
++	}
+ 	*master_key = upayload->data;
+ 	*master_keylen = upayload->datalen;
+ error:
+@@ -845,7 +852,7 @@ static int encrypted_update(struct key *key, struct key_preparsed_payload *prep)
+ 	size_t datalen = prep->datalen;
+ 	int ret = 0;
+ 
+-	if (test_bit(KEY_FLAG_NEGATIVE, &key->flags))
++	if (key_is_negative(key))
+ 		return -ENOKEY;
+ 	if (datalen <= 0 || datalen > 32767 || !prep->data)
+ 		return -EINVAL;
+diff --git a/security/keys/gc.c b/security/keys/gc.c
+index 9cb4fe4478a1..1659094d684d 100644
+--- a/security/keys/gc.c
++++ b/security/keys/gc.c
+@@ -129,15 +129,15 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
+ 	while (!list_empty(keys)) {
+ 		struct key *key =
+ 			list_entry(keys->next, struct key, graveyard_link);
++		short state = key->state;
++
+ 		list_del(&key->graveyard_link);
+ 
+ 		kdebug("- %u", key->serial);
+ 		key_check(key);
+ 
+ 		/* Throw away the key data if the key is instantiated */
+-		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
+-		    !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
+-		    key->type->destroy)
++		if (state == KEY_IS_POSITIVE && key->type->destroy)
+ 			key->type->destroy(key);
+ 
+ 		security_key_free(key);
+@@ -151,7 +151,7 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
+ 		}
+ 
+ 		atomic_dec(&key->user->nkeys);
+-		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
++		if (state != KEY_IS_UNINSTANTIATED)
+ 			atomic_dec(&key->user->nikeys);
+ 
+ 		key_user_put(key->user);
+diff --git a/security/keys/key.c b/security/keys/key.c
+index 51d23c623424..4d971bf88ac3 100644
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -395,6 +395,18 @@ int key_payload_reserve(struct key *key, size_t datalen)
+ }
+ EXPORT_SYMBOL(key_payload_reserve);
+ 
++/*
++ * Change the key state to being instantiated.
++ */
++static void mark_key_instantiated(struct key *key, int reject_error)
++{
++	/* Commit the payload before setting the state; barrier versus
++	 * key_read_state().
++	 */
++	smp_store_release(&key->state,
++			  (reject_error < 0) ? reject_error : KEY_IS_POSITIVE);
++}
++
+ /*
+  * Instantiate a key and link it into the target keyring atomically.  Must be
+  * called with the target keyring's semaphore writelocked.  The target key's
+@@ -418,14 +430,14 @@ static int __key_instantiate_and_link(struct key *key,
+ 	mutex_lock(&key_construction_mutex);
+ 
+ 	/* can't instantiate twice */
+-	if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
++	if (key->state == KEY_IS_UNINSTANTIATED) {
+ 		/* instantiate the key */
+ 		ret = key->type->instantiate(key, prep);
+ 
+ 		if (ret == 0) {
+ 			/* mark the key as being instantiated */
+ 			atomic_inc(&key->user->nikeys);
+-			set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
++			mark_key_instantiated(key, 0);
+ 
+ 			if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags))
+ 				awaken = 1;
+@@ -553,13 +565,10 @@ int key_reject_and_link(struct key *key,
+ 	mutex_lock(&key_construction_mutex);
+ 
+ 	/* can't instantiate twice */
+-	if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
++	if (key->state == KEY_IS_UNINSTANTIATED) {
+ 		/* mark the key as being negatively instantiated */
+ 		atomic_inc(&key->user->nikeys);
+-		key->reject_error = -error;
+-		smp_wmb();
+-		set_bit(KEY_FLAG_NEGATIVE, &key->flags);
+-		set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
++		mark_key_instantiated(key, -error);
+ 		now = current_kernel_time();
+ 		key->expiry = now.tv_sec + timeout;
+ 		key_schedule_gc(key->expiry + key_gc_delay);
+@@ -731,8 +740,8 @@ static inline key_ref_t __key_update(key_ref_t key_ref,
+ 
+ 	ret = key->type->update(key, prep);
+ 	if (ret == 0)
+-		/* updating a negative key instantiates it */
+-		clear_bit(KEY_FLAG_NEGATIVE, &key->flags);
++		/* Updating a negative key positively instantiates it */
++		mark_key_instantiated(key, 0);
+ 
+ 	up_write(&key->sem);
+ 
+@@ -907,6 +916,16 @@ error:
+ 	 */
+ 	__key_link_end(keyring, &index_key, edit);
+ 
++	key = key_ref_to_ptr(key_ref);
++	if (test_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags)) {
++		ret = wait_for_key_construction(key, true);
++		if (ret < 0) {
++			key_ref_put(key_ref);
++			key_ref = ERR_PTR(ret);
++			goto error_free_prep;
++		}
++	}
++
+ 	key_ref = __key_update(key_ref, &prep);
+ 	goto error_free_prep;
+ }
+@@ -957,8 +976,8 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen)
+ 
+ 	ret = key->type->update(key, &prep);
+ 	if (ret == 0)
+-		/* updating a negative key instantiates it */
+-		clear_bit(KEY_FLAG_NEGATIVE, &key->flags);
++		/* Updating a negative key positively instantiates it */
++		mark_key_instantiated(key, 0);
+ 
+ 	up_write(&key->sem);
+ 
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index a009dc66eb8f..2e741e1a8712 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -738,10 +738,9 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
+ 
+ 	key = key_ref_to_ptr(key_ref);
+ 
+-	if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
+-		ret = -ENOKEY;
+-		goto error2;
+-	}
++	ret = key_read_state(key);
++	if (ret < 0)
++		goto error2; /* Negatively instantiated */
+ 
+ 	/* see if we can read it directly */
+ 	ret = key_permission(key_ref, KEY_NEED_READ);
+@@ -873,7 +872,7 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group)
+ 		atomic_dec(&key->user->nkeys);
+ 		atomic_inc(&newowner->nkeys);
+ 
+-		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
++		if (key->state != KEY_IS_UNINSTANTIATED) {
+ 			atomic_dec(&key->user->nikeys);
+ 			atomic_inc(&newowner->nikeys);
+ 		}
+diff --git a/security/keys/keyring.c b/security/keys/keyring.c
+index 0c8dd4fbe130..ef828238cdc0 100644
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -407,7 +407,7 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m)
+ 	else
+ 		seq_puts(m, "[anon]");
+ 
+-	if (key_is_instantiated(keyring)) {
++	if (key_is_positive(keyring)) {
+ 		if (keyring->keys.nr_leaves_on_tree != 0)
+ 			seq_printf(m, ": %lu", keyring->keys.nr_leaves_on_tree);
+ 		else
+@@ -522,7 +522,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
+ {
+ 	struct keyring_search_context *ctx = iterator_data;
+ 	const struct key *key = keyring_ptr_to_key(object);
+-	unsigned long kflags = key->flags;
++	unsigned long kflags = READ_ONCE(key->flags);
++	short state = READ_ONCE(key->state);
+ 
+ 	kenter("{%d}", key->serial);
+ 
+@@ -566,9 +567,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
+ 
+ 	if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
+ 		/* we set a different error code if we pass a negative key */
+-		if (kflags & (1 << KEY_FLAG_NEGATIVE)) {
+-			smp_rmb();
+-			ctx->result = ERR_PTR(key->reject_error);
++		if (state < 0) {
++			ctx->result = ERR_PTR(state);
+ 			kleave(" = %d [neg]", ctx->skipped_ret);
+ 			goto skipped;
+ 		}
+diff --git a/security/keys/proc.c b/security/keys/proc.c
+index b9f531c9e4fa..036128682463 100644
+--- a/security/keys/proc.c
++++ b/security/keys/proc.c
+@@ -182,6 +182,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
+ 	unsigned long timo;
+ 	key_ref_t key_ref, skey_ref;
+ 	char xbuf[16];
++	short state;
+ 	int rc;
+ 
+ 	struct keyring_search_context ctx = {
+@@ -240,17 +241,19 @@ static int proc_keys_show(struct seq_file *m, void *v)
+ 			sprintf(xbuf, "%luw", timo / (60*60*24*7));
+ 	}
+ 
++	state = key_read_state(key);
++
+ #define showflag(KEY, LETTER, FLAG) \
+ 	(test_bit(FLAG,	&(KEY)->flags) ? LETTER : '-')
+ 
+ 	seq_printf(m, "%08x %c%c%c%c%c%c%c %5d %4s %08x %5d %5d %-9.9s ",
+ 		   key->serial,
+-		   showflag(key, 'I', KEY_FLAG_INSTANTIATED),
++		   state != KEY_IS_UNINSTANTIATED ? 'I' : '-',
+ 		   showflag(key, 'R', KEY_FLAG_REVOKED),
+ 		   showflag(key, 'D', KEY_FLAG_DEAD),
+ 		   showflag(key, 'Q', KEY_FLAG_IN_QUOTA),
+ 		   showflag(key, 'U', KEY_FLAG_USER_CONSTRUCT),
+-		   showflag(key, 'N', KEY_FLAG_NEGATIVE),
++		   state < 0 ? 'N' : '-',
+ 		   showflag(key, 'i', KEY_FLAG_INVALIDATED),
+ 		   atomic_read(&key->usage),
+ 		   xbuf,
+diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
+index 7dd050f24261..ac1d5b2b1626 100644
+--- a/security/keys/process_keys.c
++++ b/security/keys/process_keys.c
+@@ -727,7 +727,7 @@ try_again:
+ 
+ 	ret = -EIO;
+ 	if (!(lflags & KEY_LOOKUP_PARTIAL) &&
+-	    !test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
++	    key_read_state(key) == KEY_IS_UNINSTANTIATED)
+ 		goto invalid_key;
+ 
+ 	/* check the permissions */
+diff --git a/security/keys/request_key.c b/security/keys/request_key.c
+index c7a117c9a8f3..2ce733342b5a 100644
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -594,10 +594,9 @@ int wait_for_key_construction(struct key *key, bool intr)
+ 			  intr ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
+ 	if (ret)
+ 		return -ERESTARTSYS;
+-	if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
+-		smp_rmb();
+-		return key->reject_error;
+-	}
++	ret = key_read_state(key);
++	if (ret < 0)
++		return ret;
+ 	return key_validate(key);
+ }
+ EXPORT_SYMBOL(wait_for_key_construction);
+diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
+index 4f0f112fe276..217775fcd0f3 100644
+--- a/security/keys/request_key_auth.c
++++ b/security/keys/request_key_auth.c
+@@ -73,7 +73,7 @@ static void request_key_auth_describe(const struct key *key,
+ 
+ 	seq_puts(m, "key:");
+ 	seq_puts(m, key->description);
+-	if (key_is_instantiated(key))
++	if (key_is_positive(key))
+ 		seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
+ }
+ 
+diff --git a/security/keys/trusted.c b/security/keys/trusted.c
+index 16dec53184b6..509aedcf8310 100644
+--- a/security/keys/trusted.c
++++ b/security/keys/trusted.c
+@@ -1014,7 +1014,7 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep)
+ 	char *datablob;
+ 	int ret = 0;
+ 
+-	if (test_bit(KEY_FLAG_NEGATIVE, &key->flags))
++	if (key_is_negative(key))
+ 		return -ENOKEY;
+ 	p = key->payload.data[0];
+ 	if (!p->migratable)
+diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
+index 8705d79b2c6f..eba8a516ee9e 100644
+--- a/security/keys/user_defined.c
++++ b/security/keys/user_defined.c
+@@ -120,7 +120,7 @@ int user_update(struct key *key, struct key_preparsed_payload *prep)
+ 
+ 	if (ret == 0) {
+ 		/* attach the new data, displacing the old */
+-		if (!test_bit(KEY_FLAG_NEGATIVE, &key->flags))
++		if (key_is_positive(key))
+ 			zap = key->payload.data[0];
+ 		else
+ 			zap = NULL;
+@@ -174,7 +174,7 @@ EXPORT_SYMBOL_GPL(user_destroy);
+ void user_describe(const struct key *key, struct seq_file *m)
+ {
+ 	seq_puts(m, key->description);
+-	if (key_is_instantiated(key))
++	if (key_is_positive(key))
+ 		seq_printf(m, ": %u", key->datalen);
+ }
+ 
+diff --git a/sound/core/seq/seq_lock.c b/sound/core/seq/seq_lock.c
+index 12ba83367b1b..ba5752ee9af3 100644
+--- a/sound/core/seq/seq_lock.c
++++ b/sound/core/seq/seq_lock.c
+@@ -23,8 +23,6 @@
+ #include <sound/core.h>
+ #include "seq_lock.h"
+ 
+-#if defined(CONFIG_SMP) || defined(CONFIG_SND_DEBUG)
+-
+ /* wait until all locks are released */
+ void snd_use_lock_sync_helper(snd_use_lock_t *lockp, const char *file, int line)
+ {
+@@ -42,5 +40,3 @@ void snd_use_lock_sync_helper(snd_use_lock_t *lockp, const char *file, int line)
+ }
+ 
+ EXPORT_SYMBOL(snd_use_lock_sync_helper);
+-
+-#endif
+diff --git a/sound/core/seq/seq_lock.h b/sound/core/seq/seq_lock.h
+index 54044bc2c9ef..ac38031c370e 100644
+--- a/sound/core/seq/seq_lock.h
++++ b/sound/core/seq/seq_lock.h
+@@ -3,8 +3,6 @@
+ 
+ #include <linux/sched.h>
+ 
+-#if defined(CONFIG_SMP) || defined(CONFIG_SND_DEBUG)
+-
+ typedef atomic_t snd_use_lock_t;
+ 
+ /* initialize lock */
+@@ -20,14 +18,4 @@ typedef atomic_t snd_use_lock_t;
+ void snd_use_lock_sync_helper(snd_use_lock_t *lock, const char *file, int line);
+ #define snd_use_lock_sync(lockp) snd_use_lock_sync_helper(lockp, __BASE_FILE__, __LINE__)
+ 
+-#else /* SMP || CONFIG_SND_DEBUG */
+-
+-typedef spinlock_t snd_use_lock_t;	/* dummy */
+-#define snd_use_lock_init(lockp) /**/
+-#define snd_use_lock_use(lockp) /**/
+-#define snd_use_lock_free(lockp) /**/
+-#define snd_use_lock_sync(lockp) /**/
+-
+-#endif /* SMP || CONFIG_SND_DEBUG */
+-
+ #endif /* __SND_SEQ_LOCK_H */
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 83741887faa1..3324f98c35f6 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -1755,7 +1755,7 @@ static int get_kctl_0dB_offset(struct hda_codec *codec,
+ 			return -1;
+ 		if (*step_to_check && *step_to_check != step) {
+ 			codec_err(codec, "Mismatching dB step for vmaster slave (%d!=%d)\n",
+--				   *step_to_check, step);
++				   *step_to_check, step);
+ 			return -1;
+ 		}
+ 		*step_to_check = step;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 1cc20d138dae..9c5368e7ee23 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1305,6 +1305,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ 	case USB_ID(0x20b1, 0x2008): /* Matrix Audio X-Sabre */
+ 	case USB_ID(0x20b1, 0x300a): /* Matrix Audio Mini-i Pro */
+ 	case USB_ID(0x22d9, 0x0416): /* OPPO HA-1 */
++	case USB_ID(0x2772, 0x0230): /* Pro-Ject Pre Box S2 Digital */
+ 		if (fp->altsetting == 2)
+ 			return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ 		break;