linux kernel 4.15.7

2 files changed, 1988 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 8e1b91f1..2454462c 100644
--- a/0000_README
+++ b/0000_README
@@ -67,6 +67,10 @@ Patch:  1005_linux-4.15.6.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.15.6
 
+Patch:  1006_linux-4.15.7.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.15.7
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1006_linux-4.15.7.patch b/1006_linux-4.15.7.patch
new file mode 100644
index 00000000..b68c91ad
--- /dev/null
+++ b/1006_linux-4.15.7.patch
@@ -0,0 +1,1984 @@
+diff --git a/Makefile b/Makefile
+index 51563c76bdf6..49f524444050 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 15
+-SUBLEVEL = 6
++SUBLEVEL = 7
+ EXTRAVERSION =
+ NAME = Fearless Coyote
+ 
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index 46dee071bab1..1bcf03b5cd04 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -197,9 +197,11 @@ static const struct arm64_ftr_bits ftr_id_aa64mmfr2[] = {
+ };
+ 
+ static const struct arm64_ftr_bits ftr_ctr[] = {
+-	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_EXACT, 31, 1, 1),	/* RAO */
++	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_EXACT, 31, 1, 1),		/* RES1 */
++	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, 29, 1, 1),	/* DIC */
++	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, 28, 1, 1),	/* IDC */
+ 	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_SAFE, 24, 4, 0),	/* CWG */
+-	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, 20, 4, 0),	/* ERG */
++	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_SAFE, 20, 4, 0),	/* ERG */
+ 	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, 16, 4, 1),	/* DminLine */
+ 	/*
+ 	 * Linux can handle differing I-cache policies. Userspace JITs will
+diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
+index 583fd8154695..d6ca5fccb229 100644
+--- a/arch/arm64/kernel/process.c
++++ b/arch/arm64/kernel/process.c
+@@ -221,8 +221,15 @@ void __show_regs(struct pt_regs *regs)
+ 
+ 	show_regs_print_info(KERN_DEFAULT);
+ 	print_pstate(regs);
+-	print_symbol("pc : %s\n", regs->pc);
+-	print_symbol("lr : %s\n", lr);
++
++	if (!user_mode(regs)) {
++		print_symbol("pc : %s\n", regs->pc);
++		print_symbol("lr : %s\n", lr);
++	} else {
++		printk("pc : %016llx\n", regs->pc);
++		printk("lr : %016llx\n", lr);
++	}
++
+ 	printk("sp : %016llx\n", sp);
+ 
+ 	i = top_reg;
+diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
+index 3d3588fcd1c7..c759d9ca0e5a 100644
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -57,7 +57,7 @@ static const char *handler[]= {
+ 	"Error"
+ };
+ 
+-int show_unhandled_signals = 1;
++int show_unhandled_signals = 0;
+ 
+ static void dump_backtrace_entry(unsigned long where)
+ {
+@@ -526,14 +526,6 @@ asmlinkage long do_ni_syscall(struct pt_regs *regs)
+ 	}
+ #endif
+ 
+-	if (show_unhandled_signals_ratelimited()) {
+-		pr_info("%s[%d]: syscall %d\n", current->comm,
+-			task_pid_nr(current), regs->syscallno);
+-		dump_instr("", regs);
+-		if (user_mode(regs))
+-			__show_regs(regs);
+-	}
+-
+ 	return sys_ni_syscall();
+ }
+ 
+diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
+index 248f2e7b24ab..a233975848cc 100644
+--- a/arch/arm64/mm/proc.S
++++ b/arch/arm64/mm/proc.S
+@@ -155,7 +155,7 @@ ENDPROC(cpu_do_switch_mm)
+ 
+ .macro	__idmap_cpu_set_reserved_ttbr1, tmp1, tmp2
+ 	adrp	\tmp1, empty_zero_page
+-	msr	ttbr1_el1, \tmp2
++	msr	ttbr1_el1, \tmp1
+ 	isb
+ 	tlbi	vmalle1
+ 	dsb	nsh
+diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
+index 830ee7d42fa0..d269dd4b8279 100644
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -36,16 +36,21 @@ endif
+ CPUFLAGS-$(CONFIG_XILINX_MICROBLAZE0_USE_DIV) += -mno-xl-soft-div
+ CPUFLAGS-$(CONFIG_XILINX_MICROBLAZE0_USE_BARREL) += -mxl-barrel-shift
+ CPUFLAGS-$(CONFIG_XILINX_MICROBLAZE0_USE_PCMP_INSTR) += -mxl-pattern-compare
+-CPUFLAGS-$(CONFIG_BIG_ENDIAN) += -mbig-endian
+-CPUFLAGS-$(CONFIG_LITTLE_ENDIAN) += -mlittle-endian
++
++ifdef CONFIG_CPU_BIG_ENDIAN
++KBUILD_CFLAGS += -mbig-endian
++KBUILD_AFLAGS += -mbig-endian
++LD += -EB
++else
++KBUILD_CFLAGS += -mlittle-endian
++KBUILD_AFLAGS += -mlittle-endian
++LD += -EL
++endif
+ 
+ CPUFLAGS-1 += $(call cc-option,-mcpu=v$(CPU_VER))
+ 
+ # r31 holds current when in kernel mode
+-KBUILD_CFLAGS += -ffixed-r31 $(CPUFLAGS-1) $(CPUFLAGS-2)
+-
+-LDFLAGS		:=
+-LDFLAGS_vmlinux	:=
++KBUILD_CFLAGS += -ffixed-r31 $(CPUFLAGS-y) $(CPUFLAGS-1) $(CPUFLAGS-2)
+ 
+ head-y := arch/microblaze/kernel/head.o
+ libs-y += arch/microblaze/lib/
+diff --git a/arch/mips/boot/Makefile b/arch/mips/boot/Makefile
+index 1bd5c4f00d19..c22da16d67b8 100644
+--- a/arch/mips/boot/Makefile
++++ b/arch/mips/boot/Makefile
+@@ -126,6 +126,7 @@ $(obj)/vmlinux.its.S: $(addprefix $(srctree)/arch/mips/$(PLATFORM)/,$(ITS_INPUTS
+ 
+ quiet_cmd_cpp_its_S = ITS     $@
+       cmd_cpp_its_S = $(CPP) $(cpp_flags) -P -C -o $@ $< \
++			-D__ASSEMBLY__ \
+ 		        -DKERNEL_NAME="\"Linux $(KERNELRELEASE)\"" \
+ 			-DVMLINUX_BINARY="\"$(3)\"" \
+ 			-DVMLINUX_COMPRESSION="\"$(2)\"" \
+diff --git a/arch/mips/include/asm/compat.h b/arch/mips/include/asm/compat.h
+index 49691331ada4..08ec0762ca50 100644
+--- a/arch/mips/include/asm/compat.h
++++ b/arch/mips/include/asm/compat.h
+@@ -86,7 +86,6 @@ struct compat_flock {
+ 	compat_off_t	l_len;
+ 	s32		l_sysid;
+ 	compat_pid_t	l_pid;
+-	short		__unused;
+ 	s32		pad[4];
+ };
+ 
+diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
+index 3cc471beb50b..bb6f7a2148d7 100644
+--- a/arch/x86/kernel/apic/vector.c
++++ b/arch/x86/kernel/apic/vector.c
+@@ -134,21 +134,40 @@ static void apic_update_vector(struct irq_data *irqd, unsigned int newvec,
+ {
+ 	struct apic_chip_data *apicd = apic_chip_data(irqd);
+ 	struct irq_desc *desc = irq_data_to_desc(irqd);
++	bool managed = irqd_affinity_is_managed(irqd);
+ 
+ 	lockdep_assert_held(&vector_lock);
+ 
+ 	trace_vector_update(irqd->irq, newvec, newcpu, apicd->vector,
+ 			    apicd->cpu);
+ 
+-	/* Setup the vector move, if required  */
+-	if (apicd->vector && cpu_online(apicd->cpu)) {
++	/*
++	 * If there is no vector associated or if the associated vector is
++	 * the shutdown vector, which is associated to make PCI/MSI
++	 * shutdown mode work, then there is nothing to release. Clear out
++	 * prev_vector for this and the offlined target case.
++	 */
++	apicd->prev_vector = 0;
++	if (!apicd->vector || apicd->vector == MANAGED_IRQ_SHUTDOWN_VECTOR)
++		goto setnew;
++	/*
++	 * If the target CPU of the previous vector is online, then mark
++	 * the vector as move in progress and store it for cleanup when the
++	 * first interrupt on the new vector arrives. If the target CPU is
++	 * offline then the regular release mechanism via the cleanup
++	 * vector is not possible and the vector can be immediately freed
++	 * in the underlying matrix allocator.
++	 */
++	if (cpu_online(apicd->cpu)) {
+ 		apicd->move_in_progress = true;
+ 		apicd->prev_vector = apicd->vector;
+ 		apicd->prev_cpu = apicd->cpu;
+ 	} else {
+-		apicd->prev_vector = 0;
++		irq_matrix_free(vector_matrix, apicd->cpu, apicd->vector,
++				managed);
+ 	}
+ 
++setnew:
+ 	apicd->vector = newvec;
+ 	apicd->cpu = newcpu;
+ 	BUG_ON(!IS_ERR_OR_NULL(per_cpu(vector_irq, newcpu)[newvec]));
+diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
+index 174c59774cc9..a7a7677265b6 100644
+--- a/arch/x86/oprofile/nmi_int.c
++++ b/arch/x86/oprofile/nmi_int.c
+@@ -460,7 +460,7 @@ static int nmi_setup(void)
+ 		goto fail;
+ 
+ 	for_each_possible_cpu(cpu) {
+-		if (!cpu)
++		if (!IS_ENABLED(CONFIG_SMP) || !cpu)
+ 			continue;
+ 
+ 		memcpy(per_cpu(cpu_msrs, cpu).counters,
+diff --git a/arch/xtensa/mm/init.c b/arch/xtensa/mm/init.c
+index 720fe4e8b497..8dad076661fc 100644
+--- a/arch/xtensa/mm/init.c
++++ b/arch/xtensa/mm/init.c
+@@ -79,19 +79,75 @@ void __init zones_init(void)
+ 	free_area_init_node(0, zones_size, ARCH_PFN_OFFSET, NULL);
+ }
+ 
++#ifdef CONFIG_HIGHMEM
++static void __init free_area_high(unsigned long pfn, unsigned long end)
++{
++	for (; pfn < end; pfn++)
++		free_highmem_page(pfn_to_page(pfn));
++}
++
++static void __init free_highpages(void)
++{
++	unsigned long max_low = max_low_pfn;
++	struct memblock_region *mem, *res;
++
++	reset_all_zones_managed_pages();
++	/* set highmem page free */
++	for_each_memblock(memory, mem) {
++		unsigned long start = memblock_region_memory_base_pfn(mem);
++		unsigned long end = memblock_region_memory_end_pfn(mem);
++
++		/* Ignore complete lowmem entries */
++		if (end <= max_low)
++			continue;
++
++		if (memblock_is_nomap(mem))
++			continue;
++
++		/* Truncate partial highmem entries */
++		if (start < max_low)
++			start = max_low;
++
++		/* Find and exclude any reserved regions */
++		for_each_memblock(reserved, res) {
++			unsigned long res_start, res_end;
++
++			res_start = memblock_region_reserved_base_pfn(res);
++			res_end = memblock_region_reserved_end_pfn(res);
++
++			if (res_end < start)
++				continue;
++			if (res_start < start)
++				res_start = start;
++			if (res_start > end)
++				res_start = end;
++			if (res_end > end)
++				res_end = end;
++			if (res_start != start)
++				free_area_high(start, res_start);
++			start = res_end;
++			if (start == end)
++				break;
++		}
++
++		/* And now free anything which remains */
++		if (start < end)
++			free_area_high(start, end);
++	}
++}
++#else
++static void __init free_highpages(void)
++{
++}
++#endif
++
+ /*
+  * Initialize memory pages.
+  */
+ 
+ void __init mem_init(void)
+ {
+-#ifdef CONFIG_HIGHMEM
+-	unsigned long tmp;
+-
+-	reset_all_zones_managed_pages();
+-	for (tmp = max_low_pfn; tmp < max_pfn; tmp++)
+-		free_highmem_page(pfn_to_page(tmp));
+-#endif
++	free_highpages();
+ 
+ 	max_mapnr = max_pfn - ARCH_PFN_OFFSET;
+ 	high_memory = (void *)__va(max_low_pfn << PAGE_SHIFT);
+diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
+index 39e6de0c2761..97c77f66b20d 100644
+--- a/crypto/asymmetric_keys/pkcs7_verify.c
++++ b/crypto/asymmetric_keys/pkcs7_verify.c
+@@ -270,7 +270,7 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
+ 				sinfo->index);
+ 			return 0;
+ 		}
+-		ret = public_key_verify_signature(p->pub, p->sig);
++		ret = public_key_verify_signature(p->pub, x509->sig);
+ 		if (ret < 0)
+ 			return ret;
+ 		x509->signer = p;
+@@ -366,8 +366,7 @@ static int pkcs7_verify_one(struct pkcs7_message *pkcs7,
+  *
+  *  (*) -EBADMSG if some part of the message was invalid, or:
+  *
+- *  (*) 0 if no signature chains were found to be blacklisted or to contain
+- *	unsupported crypto, or:
++ *  (*) 0 if a signature chain passed verification, or:
+  *
+  *  (*) -EKEYREJECTED if a blacklisted key was encountered, or:
+  *
+@@ -423,8 +422,11 @@ int pkcs7_verify(struct pkcs7_message *pkcs7,
+ 
+ 	for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
+ 		ret = pkcs7_verify_one(pkcs7, sinfo);
+-		if (sinfo->blacklisted && actual_ret == -ENOPKG)
+-			actual_ret = -EKEYREJECTED;
++		if (sinfo->blacklisted) {
++			if (actual_ret == -ENOPKG)
++				actual_ret = -EKEYREJECTED;
++			continue;
++		}
+ 		if (ret < 0) {
+ 			if (ret == -ENOPKG) {
+ 				sinfo->unsupported_crypto = true;
+diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
+index de996586762a..e929fe1e4106 100644
+--- a/crypto/asymmetric_keys/public_key.c
++++ b/crypto/asymmetric_keys/public_key.c
+@@ -79,9 +79,11 @@ int public_key_verify_signature(const struct public_key *pkey,
+ 
+ 	BUG_ON(!pkey);
+ 	BUG_ON(!sig);
+-	BUG_ON(!sig->digest);
+ 	BUG_ON(!sig->s);
+ 
++	if (!sig->digest)
++		return -ENOPKG;
++
+ 	alg_name = sig->pkey_algo;
+ 	if (strcmp(sig->pkey_algo, "rsa") == 0) {
+ 		/* The data wangled by the RSA algorithm is typically padded
+diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c
+index 86fb68508952..7c93c7728454 100644
+--- a/crypto/asymmetric_keys/restrict.c
++++ b/crypto/asymmetric_keys/restrict.c
+@@ -67,8 +67,9 @@ __setup("ca_keys=", ca_keys_setup);
+  *
+  * Returns 0 if the new certificate was accepted, -ENOKEY if we couldn't find a
+  * matching parent certificate in the trusted list, -EKEYREJECTED if the
+- * signature check fails or the key is blacklisted and some other error if
+- * there is a matching certificate but the signature check cannot be performed.
++ * signature check fails or the key is blacklisted, -ENOPKG if the signature
++ * uses unsupported crypto, or some other error if there is a matching
++ * certificate but the signature check cannot be performed.
+  */
+ int restrict_link_by_signature(struct key *dest_keyring,
+ 			       const struct key_type *type,
+@@ -88,6 +89,8 @@ int restrict_link_by_signature(struct key *dest_keyring,
+ 		return -EOPNOTSUPP;
+ 
+ 	sig = payload->data[asym_auth];
++	if (!sig)
++		return -ENOPKG;
+ 	if (!sig->auth_ids[0] && !sig->auth_ids[1])
+ 		return -ENOKEY;
+ 
+@@ -139,6 +142,8 @@ static int key_or_keyring_common(struct key *dest_keyring,
+ 		return -EOPNOTSUPP;
+ 
+ 	sig = payload->data[asym_auth];
++	if (!sig)
++		return -ENOPKG;
+ 	if (!sig->auth_ids[0] && !sig->auth_ids[1])
+ 		return -ENOKEY;
+ 
+@@ -222,9 +227,9 @@ static int key_or_keyring_common(struct key *dest_keyring,
+  *
+  * Returns 0 if the new certificate was accepted, -ENOKEY if we
+  * couldn't find a matching parent certificate in the trusted list,
+- * -EKEYREJECTED if the signature check fails, and some other error if
+- * there is a matching certificate but the signature check cannot be
+- * performed.
++ * -EKEYREJECTED if the signature check fails, -ENOPKG if the signature uses
++ * unsupported crypto, or some other error if there is a matching certificate
++ * but the signature check cannot be performed.
+  */
+ int restrict_link_by_key_or_keyring(struct key *dest_keyring,
+ 				    const struct key_type *type,
+@@ -249,9 +254,9 @@ int restrict_link_by_key_or_keyring(struct key *dest_keyring,
+  *
+  * Returns 0 if the new certificate was accepted, -ENOKEY if we
+  * couldn't find a matching parent certificate in the trusted list,
+- * -EKEYREJECTED if the signature check fails, and some other error if
+- * there is a matching certificate but the signature check cannot be
+- * performed.
++ * -EKEYREJECTED if the signature check fails, -ENOPKG if the signature uses
++ * unsupported crypto, or some other error if there is a matching certificate
++ * but the signature check cannot be performed.
+  */
+ int restrict_link_by_key_or_keyring_chain(struct key *dest_keyring,
+ 					  const struct key_type *type,
+diff --git a/drivers/extcon/extcon-intel-int3496.c b/drivers/extcon/extcon-intel-int3496.c
+index c8691b5a9cb0..191e99f06a9a 100644
+--- a/drivers/extcon/extcon-intel-int3496.c
++++ b/drivers/extcon/extcon-intel-int3496.c
+@@ -153,8 +153,9 @@ static int int3496_probe(struct platform_device *pdev)
+ 		return ret;
+ 	}
+ 
+-	/* queue initial processing of id-pin */
++	/* process id-pin so that we start with the right status */
+ 	queue_delayed_work(system_wq, &data->work, 0);
++	flush_delayed_work(&data->work);
+ 
+ 	platform_set_drvdata(pdev, data);
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+index c13c51af0b68..c53095b3b0fb 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+@@ -14,6 +14,16 @@
+ 
+ #include "amd_acpi.h"
+ 
++#define AMDGPU_PX_QUIRK_FORCE_ATPX  (1 << 0)
++
++struct amdgpu_px_quirk {
++	u32 chip_vendor;
++	u32 chip_device;
++	u32 subsys_vendor;
++	u32 subsys_device;
++	u32 px_quirk_flags;
++};
++
+ struct amdgpu_atpx_functions {
+ 	bool px_params;
+ 	bool power_cntl;
+@@ -35,6 +45,7 @@ struct amdgpu_atpx {
+ static struct amdgpu_atpx_priv {
+ 	bool atpx_detected;
+ 	bool bridge_pm_usable;
++	unsigned int quirks;
+ 	/* handle for device - and atpx */
+ 	acpi_handle dhandle;
+ 	acpi_handle other_handle;
+@@ -205,13 +216,19 @@ static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx)
+ 
+ 	atpx->is_hybrid = false;
+ 	if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
+-		printk("ATPX Hybrid Graphics\n");
+-		/*
+-		 * Disable legacy PM methods only when pcie port PM is usable,
+-		 * otherwise the device might fail to power off or power on.
+-		 */
+-		atpx->functions.power_cntl = !amdgpu_atpx_priv.bridge_pm_usable;
+-		atpx->is_hybrid = true;
++		if (amdgpu_atpx_priv.quirks & AMDGPU_PX_QUIRK_FORCE_ATPX) {
++			printk("ATPX Hybrid Graphics, forcing to ATPX\n");
++			atpx->functions.power_cntl = true;
++			atpx->is_hybrid = false;
++		} else {
++			printk("ATPX Hybrid Graphics\n");
++			/*
++			 * Disable legacy PM methods only when pcie port PM is usable,
++			 * otherwise the device might fail to power off or power on.
++			 */
++			atpx->functions.power_cntl = !amdgpu_atpx_priv.bridge_pm_usable;
++			atpx->is_hybrid = true;
++		}
+ 	}
+ 
+ 	atpx->dgpu_req_power_for_displays = false;
+@@ -547,6 +564,31 @@ static const struct vga_switcheroo_handler amdgpu_atpx_handler = {
+ 	.get_client_id = amdgpu_atpx_get_client_id,
+ };
+ 
++static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
++	/* HG _PR3 doesn't seem to work on this A+A weston board */
++	{ 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX },
++	{ 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
++	{ 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
++	{ 0, 0, 0, 0, 0 },
++};
++
++static void amdgpu_atpx_get_quirks(struct pci_dev *pdev)
++{
++	const struct amdgpu_px_quirk *p = amdgpu_px_quirk_list;
++
++	/* Apply PX quirks */
++	while (p && p->chip_device != 0) {
++		if (pdev->vendor == p->chip_vendor &&
++		    pdev->device == p->chip_device &&
++		    pdev->subsystem_vendor == p->subsys_vendor &&
++		    pdev->subsystem_device == p->subsys_device) {
++			amdgpu_atpx_priv.quirks |= p->px_quirk_flags;
++			break;
++		}
++		++p;
++	}
++}
++
+ /**
+  * amdgpu_atpx_detect - detect whether we have PX
+  *
+@@ -570,6 +612,7 @@ static bool amdgpu_atpx_detect(void)
+ 
+ 		parent_pdev = pci_upstream_bridge(pdev);
+ 		d3_supported |= parent_pdev && parent_pdev->bridge_d3;
++		amdgpu_atpx_get_quirks(pdev);
+ 	}
+ 
+ 	while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
+@@ -579,6 +622,7 @@ static bool amdgpu_atpx_detect(void)
+ 
+ 		parent_pdev = pci_upstream_bridge(pdev);
+ 		d3_supported |= parent_pdev && parent_pdev->bridge_d3;
++		amdgpu_atpx_get_quirks(pdev);
+ 	}
+ 
+ 	if (has_atpx && vga_count == 2) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 57abf7abd7a9..b9cfcffbf80f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -865,8 +865,8 @@ static int amdgpu_cs_ib_vm_chunk(struct amdgpu_device *adev,
+ 			struct amdgpu_bo_va_mapping *m;
+ 			struct amdgpu_bo *aobj = NULL;
+ 			struct amdgpu_cs_chunk *chunk;
++			uint64_t offset, va_start;
+ 			struct amdgpu_ib *ib;
+-			uint64_t offset;
+ 			uint8_t *kptr;
+ 
+ 			chunk = &p->chunks[i];
+@@ -876,14 +876,14 @@ static int amdgpu_cs_ib_vm_chunk(struct amdgpu_device *adev,
+ 			if (chunk->chunk_id != AMDGPU_CHUNK_ID_IB)
+ 				continue;
+ 
+-			r = amdgpu_cs_find_mapping(p, chunk_ib->va_start,
+-						   &aobj, &m);
++			va_start = chunk_ib->va_start & AMDGPU_VA_HOLE_MASK;
++			r = amdgpu_cs_find_mapping(p, va_start, &aobj, &m);
+ 			if (r) {
+ 				DRM_ERROR("IB va_start is invalid\n");
+ 				return r;
+ 			}
+ 
+-			if ((chunk_ib->va_start + chunk_ib->ib_bytes) >
++			if ((va_start + chunk_ib->ib_bytes) >
+ 			    (m->last + 1) * AMDGPU_GPU_PAGE_SIZE) {
+ 				DRM_ERROR("IB va_start+ib_bytes is invalid\n");
+ 				return -EINVAL;
+@@ -896,7 +896,7 @@ static int amdgpu_cs_ib_vm_chunk(struct amdgpu_device *adev,
+ 			}
+ 
+ 			offset = m->start * AMDGPU_GPU_PAGE_SIZE;
+-			kptr += chunk_ib->va_start - offset;
++			kptr += va_start - offset;
+ 
+ 			memcpy(ib->ptr, kptr, chunk_ib->ib_bytes);
+ 			amdgpu_bo_kunmap(aobj);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 3573ecdb06ee..3288cbdd2df0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -2228,8 +2228,6 @@ int amdgpu_device_init(struct amdgpu_device *adev,
+ 	 * ignore it */
+ 	vga_client_register(adev->pdev, adev, NULL, amdgpu_vga_set_decode);
+ 
+-	if (amdgpu_runtime_pm == 1)
+-		runtime = true;
+ 	if (amdgpu_device_is_px(ddev))
+ 		runtime = true;
+ 	if (!pci_is_thunderbolt_attached(adev->pdev))
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+index e87eedcc0da9..1eac7c3c687b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+@@ -563,6 +563,17 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+ 		return -EINVAL;
+ 	}
+ 
++	if (args->va_address >= AMDGPU_VA_HOLE_START &&
++	    args->va_address < AMDGPU_VA_HOLE_END) {
++		dev_dbg(&dev->pdev->dev,
++			"va_address 0x%LX is in VA hole 0x%LX-0x%LX\n",
++			args->va_address, AMDGPU_VA_HOLE_START,
++			AMDGPU_VA_HOLE_END);
++		return -EINVAL;
++	}
++
++	args->va_address &= AMDGPU_VA_HOLE_MASK;
++
+ 	if ((args->flags & ~valid_flags) && (args->flags & ~prt_flags)) {
+ 		dev_err(&dev->pdev->dev, "invalid flags combination 0x%08X\n",
+ 			args->flags);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index 720139e182a3..c8b7abf887ed 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -586,7 +586,9 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
+ 		if (amdgpu_sriov_vf(adev))
+ 			dev_info.ids_flags |= AMDGPU_IDS_FLAGS_PREEMPTION;
+ 		dev_info.virtual_address_offset = AMDGPU_VA_RESERVED_SIZE;
+-		dev_info.virtual_address_max = (uint64_t)adev->vm_manager.max_pfn * AMDGPU_GPU_PAGE_SIZE;
++		dev_info.virtual_address_max =
++			min(adev->vm_manager.max_pfn * AMDGPU_GPU_PAGE_SIZE,
++			    AMDGPU_VA_HOLE_START);
+ 		dev_info.virtual_address_alignment = max((int)PAGE_SIZE, AMDGPU_GPU_PAGE_SIZE);
+ 		dev_info.pte_fragment_size = (1 << adev->vm_manager.fragment_size) * AMDGPU_GPU_PAGE_SIZE;
+ 		dev_info.gart_page_size = AMDGPU_GPU_PAGE_SIZE;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
+index bae77353447b..aef9ae5cec51 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
+@@ -96,6 +96,19 @@ struct amdgpu_bo_list_entry;
+ /* hardcode that limit for now */
+ #define AMDGPU_VA_RESERVED_SIZE			(8ULL << 20)
+ 
++/* VA hole for 48bit addresses on Vega10 */
++#define AMDGPU_VA_HOLE_START			0x0000800000000000ULL
++#define AMDGPU_VA_HOLE_END			0xffff800000000000ULL
++
++/*
++ * Hardware is programmed as if the hole doesn't exists with start and end
++ * address values.
++ *
++ * This mask is used to remove the upper 16bits of the VA and so come up with
++ * the linear addr value.
++ */
++#define AMDGPU_VA_HOLE_MASK			0x0000ffffffffffffULL
++
+ /* max vmids dedicated for process */
+ #define AMDGPU_VM_MAX_RESERVED_VMID	1
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+index 51fd0c9a20a5..3af322adae76 100644
+--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+@@ -3464,6 +3464,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ 		    (adev->pdev->device == 0x6667)) {
+ 			max_sclk = 75000;
+ 		}
++		if ((adev->pdev->revision == 0xC3) ||
++		    (adev->pdev->device == 0x6665)) {
++			max_sclk = 60000;
++			max_mclk = 80000;
++		}
+ 	} else if (adev->asic_type == CHIP_OLAND) {
+ 		if ((adev->pdev->revision == 0xC7) ||
+ 		    (adev->pdev->revision == 0x80) ||
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
+index 4e67fe1e7955..40767fdb6cd3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -659,8 +659,8 @@ static int soc15_common_early_init(void *handle)
+ 			AMD_CG_SUPPORT_MC_LS |
+ 			AMD_CG_SUPPORT_SDMA_MGCG |
+ 			AMD_CG_SUPPORT_SDMA_LS;
+-		adev->pg_flags = AMD_PG_SUPPORT_SDMA |
+-				 AMD_PG_SUPPORT_MMHUB;
++		adev->pg_flags = AMD_PG_SUPPORT_SDMA;
++
+ 		adev->external_rev_id = 0x1;
+ 		break;
+ 	default:
+diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
+index 3a4c2fa7e36d..d582964702ad 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vi.c
++++ b/drivers/gpu/drm/amd/amdgpu/vi.c
+@@ -449,14 +449,19 @@ static bool vi_read_bios_from_rom(struct amdgpu_device *adev,
+ 
+ static void vi_detect_hw_virtualization(struct amdgpu_device *adev)
+ {
+-	uint32_t reg = RREG32(mmBIF_IOV_FUNC_IDENTIFIER);
+-	/* bit0: 0 means pf and 1 means vf */
+-	/* bit31: 0 means disable IOV and 1 means enable */
+-	if (reg & 1)
+-		adev->virt.caps |= AMDGPU_SRIOV_CAPS_IS_VF;
+-
+-	if (reg & 0x80000000)
+-		adev->virt.caps |= AMDGPU_SRIOV_CAPS_ENABLE_IOV;
++	uint32_t reg = 0;
++
++	if (adev->asic_type == CHIP_TONGA ||
++	    adev->asic_type == CHIP_FIJI) {
++	       reg = RREG32(mmBIF_IOV_FUNC_IDENTIFIER);
++	       /* bit0: 0 means pf and 1 means vf */
++	       /* bit31: 0 means disable IOV and 1 means enable */
++	       if (reg & 1)
++		       adev->virt.caps |= AMDGPU_SRIOV_CAPS_IS_VF;
++
++	       if (reg & 0x80000000)
++		       adev->virt.caps |= AMDGPU_SRIOV_CAPS_ENABLE_IOV;
++	}
+ 
+ 	if (reg == 0) {
+ 		if (is_virtual_machine()) /* passthrough mode exclus sr-iov mode */
+diff --git a/drivers/gpu/drm/cirrus/cirrus_mode.c b/drivers/gpu/drm/cirrus/cirrus_mode.c
+index cd23b1b28259..c91b9b054e3f 100644
+--- a/drivers/gpu/drm/cirrus/cirrus_mode.c
++++ b/drivers/gpu/drm/cirrus/cirrus_mode.c
+@@ -294,22 +294,7 @@ static void cirrus_crtc_prepare(struct drm_crtc *crtc)
+ {
+ }
+ 
+-/*
+- * This is called after a mode is programmed. It should reverse anything done
+- * by the prepare function
+- */
+-static void cirrus_crtc_commit(struct drm_crtc *crtc)
+-{
+-}
+-
+-/*
+- * The core can pass us a set of gamma values to program. We actually only
+- * use this for 8-bit mode so can't perform smooth fades on deeper modes,
+- * but it's a requirement that we provide the function
+- */
+-static int cirrus_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
+-				 u16 *blue, uint32_t size,
+-				 struct drm_modeset_acquire_ctx *ctx)
++static void cirrus_crtc_load_lut(struct drm_crtc *crtc)
+ {
+ 	struct drm_device *dev = crtc->dev;
+ 	struct cirrus_device *cdev = dev->dev_private;
+@@ -317,7 +302,7 @@ static int cirrus_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
+ 	int i;
+ 
+ 	if (!crtc->enabled)
+-		return 0;
++		return;
+ 
+ 	r = crtc->gamma_store;
+ 	g = r + crtc->gamma_size;
+@@ -330,6 +315,27 @@ static int cirrus_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
+ 		WREG8(PALETTE_DATA, *g++ >> 8);
+ 		WREG8(PALETTE_DATA, *b++ >> 8);
+ 	}
++}
++
++/*
++ * This is called after a mode is programmed. It should reverse anything done
++ * by the prepare function
++ */
++static void cirrus_crtc_commit(struct drm_crtc *crtc)
++{
++	cirrus_crtc_load_lut(crtc);
++}
++
++/*
++ * The core can pass us a set of gamma values to program. We actually only
++ * use this for 8-bit mode so can't perform smooth fades on deeper modes,
++ * but it's a requirement that we provide the function
++ */
++static int cirrus_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
++				 u16 *blue, uint32_t size,
++				 struct drm_modeset_acquire_ctx *ctx)
++{
++	cirrus_crtc_load_lut(crtc);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
+index b16f1d69a0bb..e8c249361d7e 100644
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -1778,6 +1778,8 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state,
+ 		new_crtc_state->event->base.completion = &commit->flip_done;
+ 		new_crtc_state->event->base.completion_release = release_crtc_commit;
+ 		drm_crtc_commit_get(commit);
++
++		commit->abort_completion = true;
+ 	}
+ 
+ 	for_each_oldnew_connector_in_state(state, conn, old_conn_state, new_conn_state, i) {
+@@ -3327,8 +3329,21 @@ EXPORT_SYMBOL(drm_atomic_helper_crtc_duplicate_state);
+ void __drm_atomic_helper_crtc_destroy_state(struct drm_crtc_state *state)
+ {
+ 	if (state->commit) {
++		/*
++		 * In the event that a non-blocking commit returns
++		 * -ERESTARTSYS before the commit_tail work is queued, we will
++		 * have an extra reference to the commit object. Release it, if
++		 * the event has not been consumed by the worker.
++		 *
++		 * state->event may be freed, so we can't directly look at
++		 * state->event->base.completion.
++		 */
++		if (state->event && state->commit->abort_completion)
++			drm_crtc_commit_put(state->commit);
++
+ 		kfree(state->commit->event);
+ 		state->commit->event = NULL;
++
+ 		drm_crtc_commit_put(state->commit);
+ 	}
+ 
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index cb487148359a..16fb76ba6509 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -113,6 +113,9 @@ static const struct edid_quirk {
+ 	/* AEO model 0 reports 8 bpc, but is a 6 bpc panel */
+ 	{ "AEO", 0, EDID_QUIRK_FORCE_6BPC },
+ 
++	/* CPT panel of Asus UX303LA reports 8 bpc, but is a 6 bpc panel */
++	{ "CPT", 0x17df, EDID_QUIRK_FORCE_6BPC },
++
+ 	/* Belinea 10 15 55 */
+ 	{ "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 },
+ 	{ "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 },
+diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
+index c3c79ee6119e..edab571dbc90 100644
+--- a/drivers/gpu/drm/drm_mm.c
++++ b/drivers/gpu/drm/drm_mm.c
+@@ -836,9 +836,24 @@ struct drm_mm_node *drm_mm_scan_color_evict(struct drm_mm_scan *scan)
+ 	if (!mm->color_adjust)
+ 		return NULL;
+ 
+-	hole = list_first_entry(&mm->hole_stack, typeof(*hole), hole_stack);
+-	hole_start = __drm_mm_hole_node_start(hole);
+-	hole_end = hole_start + hole->hole_size;
++	/*
++	 * The hole found during scanning should ideally be the first element
++	 * in the hole_stack list, but due to side-effects in the driver it
++	 * may not be.
++	 */
++	list_for_each_entry(hole, &mm->hole_stack, hole_stack) {
++		hole_start = __drm_mm_hole_node_start(hole);
++		hole_end = hole_start + hole->hole_size;
++
++		if (hole_start <= scan->hit_start &&
++		    hole_end >= scan->hit_end)
++			break;
++	}
++
++	/* We should only be called after we found the hole previously */
++	DRM_MM_BUG_ON(&hole->hole_stack == &mm->hole_stack);
++	if (unlikely(&hole->hole_stack == &mm->hole_stack))
++		return NULL;
+ 
+ 	DRM_MM_BUG_ON(hole_start > scan->hit_start);
+ 	DRM_MM_BUG_ON(hole_end < scan->hit_end);
+diff --git a/drivers/gpu/drm/i915/intel_breadcrumbs.c b/drivers/gpu/drm/i915/intel_breadcrumbs.c
+index bcbc7abe6693..5d0c6504efe8 100644
+--- a/drivers/gpu/drm/i915/intel_breadcrumbs.c
++++ b/drivers/gpu/drm/i915/intel_breadcrumbs.c
+@@ -552,29 +552,16 @@ void intel_engine_remove_wait(struct intel_engine_cs *engine,
+ 	spin_unlock_irq(&b->rb_lock);
+ }
+ 
+-static bool signal_valid(const struct drm_i915_gem_request *request)
+-{
+-	return intel_wait_check_request(&request->signaling.wait, request);
+-}
+-
+ static bool signal_complete(const struct drm_i915_gem_request *request)
+ {
+ 	if (!request)
+ 		return false;
+ 
+-	/* If another process served as the bottom-half it may have already
+-	 * signalled that this wait is already completed.
+-	 */
+-	if (intel_wait_complete(&request->signaling.wait))
+-		return signal_valid(request);
+-
+-	/* Carefully check if the request is complete, giving time for the
++	/*
++	 * Carefully check if the request is complete, giving time for the
+ 	 * seqno to be visible or if the GPU hung.
+ 	 */
+-	if (__i915_request_irq_complete(request))
+-		return true;
+-
+-	return false;
++	return __i915_request_irq_complete(request);
+ }
+ 
+ static struct drm_i915_gem_request *to_signaler(struct rb_node *rb)
+@@ -617,9 +604,13 @@ static int intel_breadcrumbs_signaler(void *arg)
+ 			request = i915_gem_request_get_rcu(request);
+ 		rcu_read_unlock();
+ 		if (signal_complete(request)) {
+-			local_bh_disable();
+-			dma_fence_signal(&request->fence);
+-			local_bh_enable(); /* kick start the tasklets */
++			if (!test_bit(DMA_FENCE_FLAG_SIGNALED_BIT,
++				      &request->fence.flags)) {
++				local_bh_disable();
++				dma_fence_signal(&request->fence);
++				GEM_BUG_ON(!i915_gem_request_completed(request));
++				local_bh_enable(); /* kick start the tasklets */
++			}
+ 
+ 			spin_lock_irq(&b->rb_lock);
+ 
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index b5f85d6f6bef..721633658544 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -2721,6 +2721,9 @@ static const struct hid_device_id hid_ignore_list[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTIME) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYPH) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERANALYSERCASSY) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETESTCASSY) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_JWM) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_DMMP) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIP) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 5da3d6256d25..a0baa5ba5b84 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -641,6 +641,9 @@
+ #define USB_DEVICE_ID_LD_MICROCASSYTIME		0x1033
+ #define USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE	0x1035
+ #define USB_DEVICE_ID_LD_MICROCASSYPH		0x1038
++#define USB_DEVICE_ID_LD_POWERANALYSERCASSY	0x1040
++#define USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY	0x1042
++#define USB_DEVICE_ID_LD_MACHINETESTCASSY	0x1043
+ #define USB_DEVICE_ID_LD_JWM		0x1080
+ #define USB_DEVICE_ID_LD_DMMP		0x1081
+ #define USB_DEVICE_ID_LD_UMIP		0x1090
+diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
+index cd07a69e2e93..44deae78913e 100644
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -50,6 +50,9 @@
+ #define BCM2835_I2C_S_CLKT	BIT(9)
+ #define BCM2835_I2C_S_LEN	BIT(10) /* Fake bit for SW error reporting */
+ 
++#define BCM2835_I2C_FEDL_SHIFT	16
++#define BCM2835_I2C_REDL_SHIFT	0
++
+ #define BCM2835_I2C_CDIV_MIN	0x0002
+ #define BCM2835_I2C_CDIV_MAX	0xFFFE
+ 
+@@ -81,7 +84,7 @@ static inline u32 bcm2835_i2c_readl(struct bcm2835_i2c_dev *i2c_dev, u32 reg)
+ 
+ static int bcm2835_i2c_set_divider(struct bcm2835_i2c_dev *i2c_dev)
+ {
+-	u32 divider;
++	u32 divider, redl, fedl;
+ 
+ 	divider = DIV_ROUND_UP(clk_get_rate(i2c_dev->clk),
+ 			       i2c_dev->bus_clk_rate);
+@@ -100,6 +103,22 @@ static int bcm2835_i2c_set_divider(struct bcm2835_i2c_dev *i2c_dev)
+ 
+ 	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DIV, divider);
+ 
++	/*
++	 * Number of core clocks to wait after falling edge before
++	 * outputting the next data bit.  Note that both FEDL and REDL
++	 * can't be greater than CDIV/2.
++	 */
++	fedl = max(divider / 16, 1u);
++
++	/*
++	 * Number of core clocks to wait after rising edge before
++	 * sampling the next incoming data bit.
++	 */
++	redl = max(divider / 4, 1u);
++
++	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DEL,
++			   (fedl << BCM2835_I2C_FEDL_SHIFT) |
++			   (redl << BCM2835_I2C_REDL_SHIFT));
+ 	return 0;
+ }
+ 
+diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
+index 418c233075d3..13e849bf9aa0 100644
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -207,7 +207,7 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
+ 	i2c_dw_disable_int(dev);
+ 
+ 	/* Enable the adapter */
+-	__i2c_dw_enable(dev, true);
++	__i2c_dw_enable_and_wait(dev, true);
+ 
+ 	/* Clear and enable interrupts */
+ 	dw_readl(dev, DW_IC_CLR_INTR);
+diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
+index cecf1e5b244c..b61b52f43179 100644
+--- a/drivers/iio/adc/stm32-adc.c
++++ b/drivers/iio/adc/stm32-adc.c
+@@ -765,8 +765,6 @@ static int stm32h7_adc_enable(struct stm32_adc *adc)
+ 	int ret;
+ 	u32 val;
+ 
+-	/* Clear ADRDY by writing one, then enable ADC */
+-	stm32_adc_set_bits(adc, STM32H7_ADC_ISR, STM32H7_ADRDY);
+ 	stm32_adc_set_bits(adc, STM32H7_ADC_CR, STM32H7_ADEN);
+ 
+ 	/* Poll for ADRDY to be set (after adc startup time) */
+@@ -774,8 +772,11 @@ static int stm32h7_adc_enable(struct stm32_adc *adc)
+ 					   val & STM32H7_ADRDY,
+ 					   100, STM32_ADC_TIMEOUT_US);
+ 	if (ret) {
+-		stm32_adc_clr_bits(adc, STM32H7_ADC_CR, STM32H7_ADEN);
++		stm32_adc_set_bits(adc, STM32H7_ADC_CR, STM32H7_ADDIS);
+ 		dev_err(&indio_dev->dev, "Failed to enable ADC\n");
++	} else {
++		/* Clear ADRDY by writing one */
++		stm32_adc_set_bits(adc, STM32H7_ADC_ISR, STM32H7_ADRDY);
+ 	}
+ 
+ 	return ret;
+diff --git a/drivers/iio/imu/adis_trigger.c b/drivers/iio/imu/adis_trigger.c
+index 0dd5a381be64..457372f36791 100644
+--- a/drivers/iio/imu/adis_trigger.c
++++ b/drivers/iio/imu/adis_trigger.c
+@@ -46,6 +46,10 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
+ 	if (adis->trig == NULL)
+ 		return -ENOMEM;
+ 
++	adis->trig->dev.parent = &adis->spi->dev;
++	adis->trig->ops = &adis_trigger_ops;
++	iio_trigger_set_drvdata(adis->trig, adis);
++
+ 	ret = request_irq(adis->spi->irq,
+ 			  &iio_trigger_generic_data_rdy_poll,
+ 			  IRQF_TRIGGER_RISING,
+@@ -54,9 +58,6 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
+ 	if (ret)
+ 		goto error_free_trig;
+ 
+-	adis->trig->dev.parent = &adis->spi->dev;
+-	adis->trig->ops = &adis_trigger_ops;
+-	iio_trigger_set_drvdata(adis->trig, adis);
+ 	ret = iio_trigger_register(adis->trig);
+ 
+ 	indio_dev->trig = iio_trigger_get(adis->trig);
+diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
+index d2b465140a6b..78482d456c3b 100644
+--- a/drivers/iio/industrialio-buffer.c
++++ b/drivers/iio/industrialio-buffer.c
+@@ -175,7 +175,7 @@ unsigned int iio_buffer_poll(struct file *filp,
+ 	struct iio_dev *indio_dev = filp->private_data;
+ 	struct iio_buffer *rb = indio_dev->buffer;
+ 
+-	if (!indio_dev->info)
++	if (!indio_dev->info || rb == NULL)
+ 		return 0;
+ 
+ 	poll_wait(filp, &rb->pollq, wait);
+diff --git a/drivers/iio/proximity/Kconfig b/drivers/iio/proximity/Kconfig
+index fcb1c4ba5e41..f726f9427602 100644
+--- a/drivers/iio/proximity/Kconfig
++++ b/drivers/iio/proximity/Kconfig
+@@ -68,6 +68,8 @@ config SX9500
+ 
+ config SRF08
+ 	tristate "Devantech SRF02/SRF08/SRF10 ultrasonic ranger sensor"
++	select IIO_BUFFER
++	select IIO_TRIGGERED_BUFFER
+ 	depends on I2C
+ 	help
+ 	  Say Y here to build a driver for Devantech SRF02/SRF08/SRF10
+diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
+index 85b5ee4defa4..4e1f76730855 100644
+--- a/drivers/infiniband/core/rdma_core.c
++++ b/drivers/infiniband/core/rdma_core.c
+@@ -196,7 +196,15 @@ static struct ib_uobject *lookup_get_idr_uobject(const struct uverbs_obj_type *t
+ 		goto free;
+ 	}
+ 
+-	uverbs_uobject_get(uobj);
++	/*
++	 * The idr_find is guaranteed to return a pointer to something that
++	 * isn't freed yet, or NULL, as the free after idr_remove goes through
++	 * kfree_rcu(). However the object may still have been released and
++	 * kfree() could be called at any time.
++	 */
++	if (!kref_get_unless_zero(&uobj->ref))
++		uobj = ERR_PTR(-ENOENT);
++
+ free:
+ 	rcu_read_unlock();
+ 	return uobj;
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index 840b24096690..df127c8b9a9f 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -560,9 +560,10 @@ ssize_t ib_uverbs_open_xrcd(struct ib_uverbs_file *file,
+ 	if (f.file)
+ 		fdput(f);
+ 
++	mutex_unlock(&file->device->xrcd_tree_mutex);
++
+ 	uobj_alloc_commit(&obj->uobject);
+ 
+-	mutex_unlock(&file->device->xrcd_tree_mutex);
+ 	return in_len;
+ 
+ err_copy:
+@@ -601,10 +602,8 @@ ssize_t ib_uverbs_close_xrcd(struct ib_uverbs_file *file,
+ 
+ 	uobj  = uobj_get_write(uobj_get_type(xrcd), cmd.xrcd_handle,
+ 			       file->ucontext);
+-	if (IS_ERR(uobj)) {
+-		mutex_unlock(&file->device->xrcd_tree_mutex);
++	if (IS_ERR(uobj))
+ 		return PTR_ERR(uobj);
+-	}
+ 
+ 	ret = uobj_remove_commit(uobj);
+ 	return ret ?: in_len;
+@@ -1971,8 +1970,15 @@ static int modify_qp(struct ib_uverbs_file *file,
+ 		goto release_qp;
+ 	}
+ 
++	if ((cmd->base.attr_mask & IB_QP_AV) &&
++	    !rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) {
++		ret = -EINVAL;
++		goto release_qp;
++	}
++
+ 	if ((cmd->base.attr_mask & IB_QP_ALT_PATH) &&
+-	    !rdma_is_port_valid(qp->device, cmd->base.alt_port_num)) {
++	    (!rdma_is_port_valid(qp->device, cmd->base.alt_port_num) ||
++	    !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num))) {
+ 		ret = -EINVAL;
+ 		goto release_qp;
+ 	}
+diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
+index 381fd9c096ae..0804239e43f0 100644
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -648,12 +648,21 @@ static int verify_command_mask(struct ib_device *ib_dev, __u32 command)
+ 	return -1;
+ }
+ 
++static bool verify_command_idx(u32 command, bool extended)
++{
++	if (extended)
++		return command < ARRAY_SIZE(uverbs_ex_cmd_table);
++
++	return command < ARRAY_SIZE(uverbs_cmd_table);
++}
++
+ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
+ 			     size_t count, loff_t *pos)
+ {
+ 	struct ib_uverbs_file *file = filp->private_data;
+ 	struct ib_device *ib_dev;
+ 	struct ib_uverbs_cmd_hdr hdr;
++	bool extended_command;
+ 	__u32 command;
+ 	__u32 flags;
+ 	int srcu_key;
+@@ -686,6 +695,15 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
+ 	}
+ 
+ 	command = hdr.command & IB_USER_VERBS_CMD_COMMAND_MASK;
++	flags = (hdr.command &
++		 IB_USER_VERBS_CMD_FLAGS_MASK) >> IB_USER_VERBS_CMD_FLAGS_SHIFT;
++
++	extended_command = flags & IB_USER_VERBS_CMD_FLAG_EXTENDED;
++	if (!verify_command_idx(command, extended_command)) {
++		ret = -EINVAL;
++		goto out;
++	}
++
+ 	if (verify_command_mask(ib_dev, command)) {
+ 		ret = -EOPNOTSUPP;
+ 		goto out;
+@@ -697,12 +715,8 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
+ 		goto out;
+ 	}
+ 
+-	flags = (hdr.command &
+-		 IB_USER_VERBS_CMD_FLAGS_MASK) >> IB_USER_VERBS_CMD_FLAGS_SHIFT;
+-
+ 	if (!flags) {
+-		if (command >= ARRAY_SIZE(uverbs_cmd_table) ||
+-		    !uverbs_cmd_table[command]) {
++		if (!uverbs_cmd_table[command]) {
+ 			ret = -EINVAL;
+ 			goto out;
+ 		}
+@@ -723,8 +737,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
+ 		struct ib_udata uhw;
+ 		size_t written_count = count;
+ 
+-		if (command >= ARRAY_SIZE(uverbs_ex_cmd_table) ||
+-		    !uverbs_ex_cmd_table[command]) {
++		if (!uverbs_ex_cmd_table[command]) {
+ 			ret = -ENOSYS;
+ 			goto out;
+ 		}
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index b56c3e23f0af..980ae8e7df30 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -688,7 +688,7 @@ static void gic_raise_softirq(const struct cpumask *mask, unsigned int irq)
+ 	 * Ensure that stores to Normal memory are visible to the
+ 	 * other CPUs before issuing the IPI.
+ 	 */
+-	smp_wmb();
++	wmb();
+ 
+ 	for_each_cpu(cpu, mask) {
+ 		u64 cluster_id = MPIDR_TO_SGI_CLUSTER_ID(cpu_logical_map(cpu));
+diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
+index ef92a4d2038e..d32268cc1174 100644
+--- a/drivers/irqchip/irq-mips-gic.c
++++ b/drivers/irqchip/irq-mips-gic.c
+@@ -424,8 +424,6 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
+ 	spin_lock_irqsave(&gic_lock, flags);
+ 	write_gic_map_pin(intr, GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin);
+ 	write_gic_map_vp(intr, BIT(mips_cm_vp_id(cpu)));
+-	gic_clear_pcpu_masks(intr);
+-	set_bit(intr, per_cpu_ptr(pcpu_masks, cpu));
+ 	irq_data_update_effective_affinity(data, cpumask_of(cpu));
+ 	spin_unlock_irqrestore(&gic_lock, flags);
+ 
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index 375ef86a84da..322671076c9c 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -2632,7 +2632,6 @@ void t4_get_regs(struct adapter *adap, void *buf, size_t buf_size)
+ }
+ 
+ #define EEPROM_STAT_ADDR   0x7bfc
+-#define VPD_SIZE           0x800
+ #define VPD_BASE           0x400
+ #define VPD_BASE_OLD       0
+ #define VPD_LEN            1024
+@@ -2699,15 +2698,6 @@ int t4_get_raw_vpd_params(struct adapter *adapter, struct vpd_params *p)
+ 	if (!vpd)
+ 		return -ENOMEM;
+ 
+-	/* We have two VPD data structures stored in the adapter VPD area.
+-	 * By default, Linux calculates the size of the VPD area by traversing
+-	 * the first VPD area at offset 0x0, so we need to tell the OS what
+-	 * our real VPD size is.
+-	 */
+-	ret = pci_set_vpd_size(adapter->pdev, VPD_SIZE);
+-	if (ret < 0)
+-		goto out;
+-
+ 	/* Card information normally starts at VPD_BASE but early cards had
+ 	 * it at 0.
+ 	 */
+diff --git a/drivers/net/thunderbolt.c b/drivers/net/thunderbolt.c
+index ca5e375de27c..e0d6760f3219 100644
+--- a/drivers/net/thunderbolt.c
++++ b/drivers/net/thunderbolt.c
+@@ -166,6 +166,8 @@ struct tbnet_ring {
+  * @connected_work: Worker that finalizes the ThunderboltIP connection
+  *		    setup and enables DMA paths for high speed data
+  *		    transfers
++ * @disconnect_work: Worker that handles tearing down the ThunderboltIP
++ *		     connection
+  * @rx_hdr: Copy of the currently processed Rx frame. Used when a
+  *	    network packet consists of multiple Thunderbolt frames.
+  *	    In host byte order.
+@@ -190,6 +192,7 @@ struct tbnet {
+ 	int login_retries;
+ 	struct delayed_work login_work;
+ 	struct work_struct connected_work;
++	struct work_struct disconnect_work;
+ 	struct thunderbolt_ip_frame_header rx_hdr;
+ 	struct tbnet_ring rx_ring;
+ 	atomic_t frame_id;
+@@ -445,7 +448,7 @@ static int tbnet_handle_packet(const void *buf, size_t size, void *data)
+ 	case TBIP_LOGOUT:
+ 		ret = tbnet_logout_response(net, route, sequence, command_id);
+ 		if (!ret)
+-			tbnet_tear_down(net, false);
++			queue_work(system_long_wq, &net->disconnect_work);
+ 		break;
+ 
+ 	default:
+@@ -659,6 +662,13 @@ static void tbnet_login_work(struct work_struct *work)
+ 	}
+ }
+ 
++static void tbnet_disconnect_work(struct work_struct *work)
++{
++	struct tbnet *net = container_of(work, typeof(*net), disconnect_work);
++
++	tbnet_tear_down(net, false);
++}
++
+ static bool tbnet_check_frame(struct tbnet *net, const struct tbnet_frame *tf,
+ 			      const struct thunderbolt_ip_frame_header *hdr)
+ {
+@@ -881,6 +891,7 @@ static int tbnet_stop(struct net_device *dev)
+ 
+ 	napi_disable(&net->napi);
+ 
++	cancel_work_sync(&net->disconnect_work);
+ 	tbnet_tear_down(net, true);
+ 
+ 	tb_ring_free(net->rx_ring.ring);
+@@ -1195,6 +1206,7 @@ static int tbnet_probe(struct tb_service *svc, const struct tb_service_id *id)
+ 	net = netdev_priv(dev);
+ 	INIT_DELAYED_WORK(&net->login_work, tbnet_login_work);
+ 	INIT_WORK(&net->connected_work, tbnet_connected_work);
++	INIT_WORK(&net->disconnect_work, tbnet_disconnect_work);
+ 	mutex_init(&net->connection_lock);
+ 	atomic_set(&net->command_id, 0);
+ 	atomic_set(&net->frame_id, 0);
+@@ -1270,10 +1282,7 @@ static int __maybe_unused tbnet_suspend(struct device *dev)
+ 	stop_login(net);
+ 	if (netif_running(net->dev)) {
+ 		netif_device_detach(net->dev);
+-		tb_ring_stop(net->rx_ring.ring);
+-		tb_ring_stop(net->tx_ring.ring);
+-		tbnet_free_buffers(&net->rx_ring);
+-		tbnet_free_buffers(&net->tx_ring);
++		tbnet_tear_down(net, true);
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index d22750ea7444..d7135140bf40 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3419,22 +3419,29 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PORT_RIDGE,
+ 
+ static void quirk_chelsio_extend_vpd(struct pci_dev *dev)
+ {
+-	pci_set_vpd_size(dev, 8192);
+-}
+-
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x20, quirk_chelsio_extend_vpd);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x21, quirk_chelsio_extend_vpd);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x22, quirk_chelsio_extend_vpd);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x23, quirk_chelsio_extend_vpd);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x24, quirk_chelsio_extend_vpd);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x25, quirk_chelsio_extend_vpd);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x26, quirk_chelsio_extend_vpd);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x30, quirk_chelsio_extend_vpd);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x31, quirk_chelsio_extend_vpd);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x32, quirk_chelsio_extend_vpd);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x35, quirk_chelsio_extend_vpd);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x36, quirk_chelsio_extend_vpd);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x37, quirk_chelsio_extend_vpd);
++	int chip = (dev->device & 0xf000) >> 12;
++	int func = (dev->device & 0x0f00) >>  8;
++	int prod = (dev->device & 0x00ff) >>  0;
++
++	/*
++	 * If this is a T3-based adapter, there's a 1KB VPD area at offset
++	 * 0xc00 which contains the preferred VPD values.  If this is a T4 or
++	 * later based adapter, the special VPD is at offset 0x400 for the
++	 * Physical Functions (the SR-IOV Virtual Functions have no VPD
++	 * Capabilities).  The PCI VPD Access core routines will normally
++	 * compute the size of the VPD by parsing the VPD Data Structure at
++	 * offset 0x000.  This will result in silent failures when attempting
++	 * to accesses these other VPD areas which are beyond those computed
++	 * limits.
++	 */
++	if (chip == 0x0 && prod >= 0x20)
++		pci_set_vpd_size(dev, 8192);
++	else if (chip >= 0x4 && func < 0x8)
++		pci_set_vpd_size(dev, 2048);
++}
++
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, PCI_ANY_ID,
++			quirk_chelsio_extend_vpd);
+ 
+ #ifdef CONFIG_ACPI
+ /*
+diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h
+index 9a0696f68f37..b81a53c4a9a8 100644
+--- a/drivers/scsi/ibmvscsi/ibmvfc.h
++++ b/drivers/scsi/ibmvscsi/ibmvfc.h
+@@ -367,7 +367,7 @@ enum ibmvfc_fcp_rsp_info_codes {
+ };
+ 
+ struct ibmvfc_fcp_rsp_info {
+-	__be16 reserved;
++	u8 reserved[3];
+ 	u8 rsp_code;
+ 	u8 reserved2[4];
+ }__attribute__((packed, aligned (2)));
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 4024926c1d68..f4a548471f0f 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -226,6 +226,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	{ USB_DEVICE(0x1a0a, 0x0200), .driver_info =
+ 			USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+ 
++	/* Corsair K70 RGB */
++	{ USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
++
+ 	/* Corsair Strafe RGB */
+ 	{ USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
+ 
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index fd3e7ad2eb0e..618b4260f0d9 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -858,7 +858,12 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
+ 		trb++;
+ 		trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+ 		trace_dwc3_complete_trb(ep0, trb);
+-		ep0->trb_enqueue = 0;
++
++		if (r->direction)
++			dwc->eps[1]->trb_enqueue = 0;
++		else
++			dwc->eps[0]->trb_enqueue = 0;
++
+ 		dwc->ep0_bounced = false;
+ 	}
+ 
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 639dd1b163a0..21abea0ac622 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2744,6 +2744,8 @@ static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc)
+ 		break;
+ 	}
+ 
++	dwc->eps[1]->endpoint.maxpacket = dwc->gadget.ep0->maxpacket;
++
+ 	/* Enable USB2 LPM Capability */
+ 
+ 	if ((dwc->revision > DWC3_REVISION_194A) &&
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index f9bd351637cd..0ef08a909ba6 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1852,44 +1852,20 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 
+ 	spin_lock_irqsave(&func->ffs->eps_lock, flags);
+ 	while(count--) {
+-		struct usb_endpoint_descriptor *ds;
+-		struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
+-		int needs_comp_desc = false;
+-		int desc_idx;
+-
+-		if (ffs->gadget->speed == USB_SPEED_SUPER) {
+-			desc_idx = 2;
+-			needs_comp_desc = true;
+-		} else if (ffs->gadget->speed == USB_SPEED_HIGH)
+-			desc_idx = 1;
+-		else
+-			desc_idx = 0;
+-
+-		/* fall-back to lower speed if desc missing for current speed */
+-		do {
+-			ds = ep->descs[desc_idx];
+-		} while (!ds && --desc_idx >= 0);
+-
+-		if (!ds) {
+-			ret = -EINVAL;
+-			break;
+-		}
+-
+ 		ep->ep->driver_data = ep;
+-		ep->ep->desc = ds;
+ 
+-		if (needs_comp_desc) {
+-			comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
+-					USB_DT_ENDPOINT_SIZE);
+-			ep->ep->maxburst = comp_desc->bMaxBurst + 1;
+-			ep->ep->comp_desc = comp_desc;
++		ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
++		if (ret) {
++			pr_err("%s: config_ep_by_speed(%s) returned %d\n",
++					__func__, ep->ep->name, ret);
++			break;
+ 		}
+ 
+ 		ret = usb_ep_enable(ep->ep);
+ 		if (likely(!ret)) {
+ 			epfile->ep = ep;
+-			epfile->in = usb_endpoint_dir_in(ds);
+-			epfile->isoc = usb_endpoint_xfer_isoc(ds);
++			epfile->in = usb_endpoint_dir_in(ep->ep->desc);
++			epfile->isoc = usb_endpoint_xfer_isoc(ep->ep->desc);
+ 		} else {
+ 			break;
+ 		}
+@@ -2976,10 +2952,8 @@ static int _ffs_func_bind(struct usb_configuration *c,
+ 	struct ffs_data *ffs = func->ffs;
+ 
+ 	const int full = !!func->ffs->fs_descs_count;
+-	const int high = gadget_is_dualspeed(func->gadget) &&
+-		func->ffs->hs_descs_count;
+-	const int super = gadget_is_superspeed(func->gadget) &&
+-		func->ffs->ss_descs_count;
++	const int high = !!func->ffs->hs_descs_count;
++	const int super = !!func->ffs->ss_descs_count;
+ 
+ 	int fs_len, hs_len, ss_len, ret, i;
+ 	struct ffs_ep *eps_ptr;
+diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
+index facafdf8fb95..d7641cbdee43 100644
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -774,12 +774,12 @@ static struct urb *request_single_step_set_feature_urb(
+ 	atomic_inc(&urb->use_count);
+ 	atomic_inc(&urb->dev->urbnum);
+ 	urb->setup_dma = dma_map_single(
+-			hcd->self.controller,
++			hcd->self.sysdev,
+ 			urb->setup_packet,
+ 			sizeof(struct usb_ctrlrequest),
+ 			DMA_TO_DEVICE);
+ 	urb->transfer_dma = dma_map_single(
+-			hcd->self.controller,
++			hcd->self.sysdev,
+ 			urb->transfer_buffer,
+ 			urb->transfer_buffer_length,
+ 			DMA_FROM_DEVICE);
+diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
+index ee9676349333..84f88fa411cd 100644
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -74,6 +74,7 @@ static const char	hcd_name [] = "ohci_hcd";
+ 
+ #define	STATECHANGE_DELAY	msecs_to_jiffies(300)
+ #define	IO_WATCHDOG_DELAY	msecs_to_jiffies(275)
++#define	IO_WATCHDOG_OFF		0xffffff00
+ 
+ #include "ohci.h"
+ #include "pci-quirks.h"
+@@ -231,7 +232,7 @@ static int ohci_urb_enqueue (
+ 		}
+ 
+ 		/* Start up the I/O watchdog timer, if it's not running */
+-		if (!timer_pending(&ohci->io_watchdog) &&
++		if (ohci->prev_frame_no == IO_WATCHDOG_OFF &&
+ 				list_empty(&ohci->eds_in_use) &&
+ 				!(ohci->flags & OHCI_QUIRK_QEMU)) {
+ 			ohci->prev_frame_no = ohci_frame_no(ohci);
+@@ -501,6 +502,7 @@ static int ohci_init (struct ohci_hcd *ohci)
+ 		return 0;
+ 
+ 	timer_setup(&ohci->io_watchdog, io_watchdog_func, 0);
++	ohci->prev_frame_no = IO_WATCHDOG_OFF;
+ 
+ 	ohci->hcca = dma_alloc_coherent (hcd->self.controller,
+ 			sizeof(*ohci->hcca), &ohci->hcca_dma, GFP_KERNEL);
+@@ -730,7 +732,7 @@ static void io_watchdog_func(struct timer_list *t)
+ 	u32		head;
+ 	struct ed	*ed;
+ 	struct td	*td, *td_start, *td_next;
+-	unsigned	frame_no;
++	unsigned	frame_no, prev_frame_no = IO_WATCHDOG_OFF;
+ 	unsigned long	flags;
+ 
+ 	spin_lock_irqsave(&ohci->lock, flags);
+@@ -835,7 +837,7 @@ static void io_watchdog_func(struct timer_list *t)
+ 			}
+ 		}
+ 		if (!list_empty(&ohci->eds_in_use)) {
+-			ohci->prev_frame_no = frame_no;
++			prev_frame_no = frame_no;
+ 			ohci->prev_wdh_cnt = ohci->wdh_cnt;
+ 			ohci->prev_donehead = ohci_readl(ohci,
+ 					&ohci->regs->donehead);
+@@ -845,6 +847,7 @@ static void io_watchdog_func(struct timer_list *t)
+ 	}
+ 
+  done:
++	ohci->prev_frame_no = prev_frame_no;
+ 	spin_unlock_irqrestore(&ohci->lock, flags);
+ }
+ 
+@@ -973,6 +976,7 @@ static void ohci_stop (struct usb_hcd *hcd)
+ 	if (quirk_nec(ohci))
+ 		flush_work(&ohci->nec_work);
+ 	del_timer_sync(&ohci->io_watchdog);
++	ohci->prev_frame_no = IO_WATCHDOG_OFF;
+ 
+ 	ohci_writel (ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);
+ 	ohci_usb_reset(ohci);
+diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
+index fb7aaa3b9d06..634f3c7bf774 100644
+--- a/drivers/usb/host/ohci-hub.c
++++ b/drivers/usb/host/ohci-hub.c
+@@ -311,8 +311,10 @@ static int ohci_bus_suspend (struct usb_hcd *hcd)
+ 		rc = ohci_rh_suspend (ohci, 0);
+ 	spin_unlock_irq (&ohci->lock);
+ 
+-	if (rc == 0)
++	if (rc == 0) {
+ 		del_timer_sync(&ohci->io_watchdog);
++		ohci->prev_frame_no = IO_WATCHDOG_OFF;
++	}
+ 	return rc;
+ }
+ 
+diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
+index b2ec8c399363..4ccb85a67bb3 100644
+--- a/drivers/usb/host/ohci-q.c
++++ b/drivers/usb/host/ohci-q.c
+@@ -1019,6 +1019,8 @@ static void finish_unlinks(struct ohci_hcd *ohci)
+ 		 * have modified this list.  normally it's just prepending
+ 		 * entries (which we'd ignore), but paranoia won't hurt.
+ 		 */
++		*last = ed->ed_next;
++		ed->ed_next = NULL;
+ 		modified = 0;
+ 
+ 		/* unlink urbs as requested, but rescan the list after
+@@ -1077,21 +1079,22 @@ static void finish_unlinks(struct ohci_hcd *ohci)
+ 			goto rescan_this;
+ 
+ 		/*
+-		 * If no TDs are queued, take ED off the ed_rm_list.
++		 * If no TDs are queued, ED is now idle.
+ 		 * Otherwise, if the HC is running, reschedule.
+-		 * If not, leave it on the list for further dequeues.
++		 * If the HC isn't running, add ED back to the
++		 * start of the list for later processing.
+ 		 */
+ 		if (list_empty(&ed->td_list)) {
+-			*last = ed->ed_next;
+-			ed->ed_next = NULL;
+ 			ed->state = ED_IDLE;
+ 			list_del(&ed->in_use_list);
+ 		} else if (ohci->rh_state == OHCI_RH_RUNNING) {
+-			*last = ed->ed_next;
+-			ed->ed_next = NULL;
+ 			ed_schedule(ohci, ed);
+ 		} else {
+-			last = &ed->ed_next;
++			ed->ed_next = ohci->ed_rm_list;
++			ohci->ed_rm_list = ed;
++			/* Don't loop on the same ED */
++			if (last == &ohci->ed_rm_list)
++				last = &ed->ed_next;
+ 		}
+ 
+ 		if (modified)
+diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
+index 5c1a3b852453..98ef7fcbda58 100644
+--- a/drivers/usb/misc/ldusb.c
++++ b/drivers/usb/misc/ldusb.c
+@@ -42,6 +42,9 @@
+ #define USB_DEVICE_ID_LD_MICROCASSYTIME		0x1033	/* USB Product ID of Micro-CASSY Time (reserved) */
+ #define USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE	0x1035	/* USB Product ID of Micro-CASSY Temperature */
+ #define USB_DEVICE_ID_LD_MICROCASSYPH		0x1038	/* USB Product ID of Micro-CASSY pH */
++#define USB_DEVICE_ID_LD_POWERANALYSERCASSY	0x1040	/* USB Product ID of Power Analyser CASSY */
++#define USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY	0x1042	/* USB Product ID of Converter Controller CASSY */
++#define USB_DEVICE_ID_LD_MACHINETESTCASSY	0x1043	/* USB Product ID of Machine Test CASSY */
+ #define USB_DEVICE_ID_LD_JWM		0x1080	/* USB Product ID of Joule and Wattmeter */
+ #define USB_DEVICE_ID_LD_DMMP		0x1081	/* USB Product ID of Digital Multimeter P (reserved) */
+ #define USB_DEVICE_ID_LD_UMIP		0x1090	/* USB Product ID of UMI P */
+@@ -84,6 +87,9 @@ static const struct usb_device_id ld_usb_table[] = {
+ 	{ USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTIME) },
+ 	{ USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE) },
+ 	{ USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYPH) },
++	{ USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERANALYSERCASSY) },
++	{ USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY) },
++	{ USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETESTCASSY) },
+ 	{ USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_JWM) },
+ 	{ USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_DMMP) },
+ 	{ USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIP) },
+diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
+index 2627363fb4fe..6f311212f3c5 100644
+--- a/drivers/usb/musb/musb_host.c
++++ b/drivers/usb/musb/musb_host.c
+@@ -393,13 +393,7 @@ static void musb_advance_schedule(struct musb *musb, struct urb *urb,
+ 		}
+ 	}
+ 
+-	/*
+-	 * The pipe must be broken if current urb->status is set, so don't
+-	 * start next urb.
+-	 * TODO: to minimize the risk of regression, only check urb->status
+-	 * for RX, until we have a test case to understand the behavior of TX.
+-	 */
+-	if ((!status || !is_in) && qh && qh->is_ready) {
++	if (qh != NULL && qh->is_ready) {
+ 		musb_dbg(musb, "... next ep%d %cX urb %p",
+ 		    hw_ep->epnum, is_in ? 'R' : 'T', next_urb(qh));
+ 		musb_start_urb(musb, is_in, qh);
+diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
+index da031c45395a..fbec863350f6 100644
+--- a/drivers/usb/phy/phy-mxs-usb.c
++++ b/drivers/usb/phy/phy-mxs-usb.c
+@@ -602,6 +602,9 @@ static enum usb_charger_type mxs_phy_charger_detect(struct usb_phy *phy)
+ 	void __iomem *base = phy->io_priv;
+ 	enum usb_charger_type chgr_type = UNKNOWN_TYPE;
+ 
++	if (!regmap)
++		return UNKNOWN_TYPE;
++
+ 	if (mxs_charger_data_contact_detect(mxs_phy))
+ 		return chgr_type;
+ 
+diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
+index 2d24ef3076ef..b295e204a575 100644
+--- a/drivers/usb/renesas_usbhs/fifo.c
++++ b/drivers/usb/renesas_usbhs/fifo.c
+@@ -989,6 +989,10 @@ static int usbhsf_dma_prepare_pop_with_usb_dmac(struct usbhs_pkt *pkt,
+ 	if ((uintptr_t)pkt->buf & (USBHS_USB_DMAC_XFER_SIZE - 1))
+ 		goto usbhsf_pio_prepare_pop;
+ 
++	/* return at this time if the pipe is running */
++	if (usbhs_pipe_is_running(pipe))
++		return 0;
++
+ 	usbhs_pipe_config_change_bfre(pipe, 1);
+ 
+ 	ret = usbhsf_fifo_select(pipe, fifo, 0);
+@@ -1179,6 +1183,7 @@ static int usbhsf_dma_pop_done_with_usb_dmac(struct usbhs_pkt *pkt,
+ 	usbhsf_fifo_clear(pipe, fifo);
+ 	pkt->actual = usbhs_dma_calc_received_size(pkt, chan, rcv_len);
+ 
++	usbhs_pipe_running(pipe, 0);
+ 	usbhsf_dma_stop(pipe, fifo);
+ 	usbhsf_dma_unmap(pkt);
+ 	usbhsf_fifo_unselect(pipe, pipe->fifo);
+diff --git a/drivers/xen/tmem.c b/drivers/xen/tmem.c
+index bf13d1ec51f3..04e7b3b29bac 100644
+--- a/drivers/xen/tmem.c
++++ b/drivers/xen/tmem.c
+@@ -284,6 +284,10 @@ static int tmem_frontswap_store(unsigned type, pgoff_t offset,
+ 	int pool = tmem_frontswap_poolid;
+ 	int ret;
+ 
++	/* THP isn't supported */
++	if (PageTransHuge(page))
++		return -1;
++
+ 	if (pool < 0)
+ 		return -1;
+ 	if (ind64 != ind)
+diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h
+index 5afd6e364fb6..c63b0b48e884 100644
+--- a/include/drm/drm_atomic.h
++++ b/include/drm/drm_atomic.h
+@@ -134,6 +134,15 @@ struct drm_crtc_commit {
+ 	 * &drm_pending_vblank_event pointer to clean up private events.
+ 	 */
+ 	struct drm_pending_vblank_event *event;
++
++	/**
++	 * @abort_completion:
++	 *
++	 * A flag that's set after drm_atomic_helper_setup_commit takes a second
++	 * reference for the completion of $drm_crtc_state.event. It's used by
++	 * the free code to remove the second reference if commit fails.
++	 */
++	bool abort_completion;
+ };
+ 
+ struct __drm_planes_state {
+diff --git a/include/linux/kconfig.h b/include/linux/kconfig.h
+index fec5076eda91..dcde9471897d 100644
+--- a/include/linux/kconfig.h
++++ b/include/linux/kconfig.h
+@@ -4,6 +4,12 @@
+ 
+ #include <generated/autoconf.h>
+ 
++#ifdef CONFIG_CPU_BIG_ENDIAN
++#define __BIG_ENDIAN 4321
++#else
++#define __LITTLE_ENDIAN 1234
++#endif
++
+ #define __ARG_PLACEHOLDER_1 0,
+ #define __take_second_arg(__ignored, val, ...) val
+ 
+@@ -64,4 +70,7 @@
+  */
+ #define IS_ENABLED(option) __or(IS_BUILTIN(option), IS_MODULE(option))
+ 
++/* Make sure we always have all types and struct attributes defined. */
++#include <linux/compiler_types.h>
++
+ #endif /* __LINUX_KCONFIG_H */
+diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h
+index 144de4d2f385..153c9c2eaaa7 100644
+--- a/include/uapi/linux/if_ether.h
++++ b/include/uapi/linux/if_ether.h
+@@ -23,7 +23,6 @@
+ #define _UAPI_LINUX_IF_ETHER_H
+ 
+ #include <linux/types.h>
+-#include <linux/libc-compat.h>
+ 
+ /*
+  *	IEEE 802.3 Ethernet magic constants.  The frame sizes omit the preamble
+@@ -150,6 +149,11 @@
+  *	This is an Ethernet frame header.
+  */
+ 
++/* allow libcs like musl to deactivate this, glibc does not implement this. */
++#ifndef __UAPI_DEF_ETHHDR
++#define __UAPI_DEF_ETHHDR		1
++#endif
++
+ #if __UAPI_DEF_ETHHDR
+ struct ethhdr {
+ 	unsigned char	h_dest[ETH_ALEN];	/* destination eth addr	*/
+diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
+index fc29efaa918c..8254c937c9f4 100644
+--- a/include/uapi/linux/libc-compat.h
++++ b/include/uapi/linux/libc-compat.h
+@@ -264,10 +264,4 @@
+ 
+ #endif /* __GLIBC__ */
+ 
+-/* Definitions for if_ether.h */
+-/* allow libcs like musl to deactivate this, glibc does not implement this. */
+-#ifndef __UAPI_DEF_ETHHDR
+-#define __UAPI_DEF_ETHHDR		1
+-#endif
+-
+ #endif /* _UAPI_LIBC_COMPAT_H */
+diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c
+index 5187dfe809ac..4c5770407031 100644
+--- a/kernel/irq/matrix.c
++++ b/kernel/irq/matrix.c
+@@ -16,6 +16,7 @@ struct cpumap {
+ 	unsigned int		available;
+ 	unsigned int		allocated;
+ 	unsigned int		managed;
++	bool			initialized;
+ 	bool			online;
+ 	unsigned long		alloc_map[IRQ_MATRIX_SIZE];
+ 	unsigned long		managed_map[IRQ_MATRIX_SIZE];
+@@ -81,9 +82,11 @@ void irq_matrix_online(struct irq_matrix *m)
+ 
+ 	BUG_ON(cm->online);
+ 
+-	bitmap_zero(cm->alloc_map, m->matrix_bits);
+-	cm->available = m->alloc_size - (cm->managed + m->systembits_inalloc);
+-	cm->allocated = 0;
++	if (!cm->initialized) {
++		cm->available = m->alloc_size;
++		cm->available -= cm->managed + m->systembits_inalloc;
++		cm->initialized = true;
++	}
+ 	m->global_available += cm->available;
+ 	cm->online = true;
+ 	m->online_maps++;
+@@ -370,14 +373,16 @@ void irq_matrix_free(struct irq_matrix *m, unsigned int cpu,
+ 	if (WARN_ON_ONCE(bit < m->alloc_start || bit >= m->alloc_end))
+ 		return;
+ 
+-	if (cm->online) {
+-		clear_bit(bit, cm->alloc_map);
+-		cm->allocated--;
++	clear_bit(bit, cm->alloc_map);
++	cm->allocated--;
++
++	if (cm->online)
+ 		m->total_allocated--;
+-		if (!managed) {
+-			cm->available++;
++
++	if (!managed) {
++		cm->available++;
++		if (cm->online)
+ 			m->global_available++;
+-		}
+ 	}
+ 	trace_irq_matrix_free(bit, cpu, m, cm);
+ }
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index d23818c5465a..9f927497f2f5 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -46,6 +46,7 @@
+ #include <linux/stop_machine.h>
+ #include <linux/sort.h>
+ #include <linux/pfn.h>
++#include <xen/xen.h>
+ #include <linux/backing-dev.h>
+ #include <linux/fault-inject.h>
+ #include <linux/page-isolation.h>
+@@ -347,6 +348,9 @@ static inline bool update_defer_init(pg_data_t *pgdat,
+ 	/* Always populate low zones for address-contrained allocations */
+ 	if (zone_end < pgdat_end_pfn(pgdat))
+ 		return true;
++	/* Xen PV domains need page structures early */
++	if (xen_pv_domain())
++		return true;
+ 	(*nr_initialised)++;
+ 	if ((*nr_initialised > pgdat->static_init_pgcnt) &&
+ 	    (pfn & (PAGES_PER_SECTION - 1)) == 0) {
+diff --git a/mm/zswap.c b/mm/zswap.c
+index d39581a076c3..597008a44f70 100644
+--- a/mm/zswap.c
++++ b/mm/zswap.c
+@@ -970,6 +970,12 @@ static int zswap_frontswap_store(unsigned type, pgoff_t offset,
+ 	u8 *src, *dst;
+ 	struct zswap_header *zhdr;
+ 
++	/* THP isn't supported */
++	if (PageTransHuge(page)) {
++		ret = -EINVAL;
++		goto reject;
++	}
++
+ 	if (!zswap_enabled || !tree) {
+ 		ret = -ENODEV;
+ 		goto reject;
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index c7df4969f80a..f56aab54e0c8 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -1563,10 +1563,7 @@ int ip_getsockopt(struct sock *sk, int level,
+ 		if (get_user(len, optlen))
+ 			return -EFAULT;
+ 
+-		lock_sock(sk);
+-		err = nf_getsockopt(sk, PF_INET, optname, optval,
+-				&len);
+-		release_sock(sk);
++		err = nf_getsockopt(sk, PF_INET, optname, optval, &len);
+ 		if (err >= 0)
+ 			err = put_user(len, optlen);
+ 		return err;
+@@ -1598,9 +1595,7 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
+ 		if (get_user(len, optlen))
+ 			return -EFAULT;
+ 
+-		lock_sock(sk);
+ 		err = compat_nf_getsockopt(sk, PF_INET, optname, optval, &len);
+-		release_sock(sk);
+ 		if (err >= 0)
+ 			err = put_user(len, optlen);
+ 		return err;
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index d78d41fc4b1a..24535169663d 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -1367,10 +1367,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname,
+ 		if (get_user(len, optlen))
+ 			return -EFAULT;
+ 
+-		lock_sock(sk);
+-		err = nf_getsockopt(sk, PF_INET6, optname, optval,
+-				&len);
+-		release_sock(sk);
++		err = nf_getsockopt(sk, PF_INET6, optname, optval, &len);
+ 		if (err >= 0)
+ 			err = put_user(len, optlen);
+ 	}
+@@ -1409,10 +1406,7 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
+ 		if (get_user(len, optlen))
+ 			return -EFAULT;
+ 
+-		lock_sock(sk);
+-		err = compat_nf_getsockopt(sk, PF_INET6,
+-					   optname, optval, &len);
+-		release_sock(sk);
++		err = compat_nf_getsockopt(sk, PF_INET6, optname, optval, &len);
+ 		if (err >= 0)
+ 			err = put_user(len, optlen);
+ 	}
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index fb15d3b97cb2..84f757c5d91a 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2863,7 +2863,7 @@ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
+ 	}
+ 	if (beacon->probe_resp_len) {
+ 		new_beacon->probe_resp_len = beacon->probe_resp_len;
+-		beacon->probe_resp = pos;
++		new_beacon->probe_resp = pos;
+ 		memcpy(pos, beacon->probe_resp, beacon->probe_resp_len);
+ 		pos += beacon->probe_resp_len;
+ 	}