Linux patch 4.5.34.5-5

2 files changed, 7460 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 0fa777fd..0147ad91 100644
--- a/0000_README
+++ b/0000_README
@@ -51,6 +51,10 @@ Patch:  1001_linux-4.5.2.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.5.2
 
+Patch:  1002_linux-4.5.3.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.5.3
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1002_linux-4.5.3.patch b/1002_linux-4.5.3.patch
new file mode 100644
index 00000000..6401e8fa
--- /dev/null
+++ b/1002_linux-4.5.3.patch
@@ -0,0 +1,7456 @@
+diff --git a/Makefile b/Makefile
+index 1ecaaeb7791d..9b56a6c5e36f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 5
+-SUBLEVEL = 2
++SUBLEVEL = 3
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi
+index 1fafaad516ba..97471d62d5e4 100644
+--- a/arch/arm/boot/dts/am33xx.dtsi
++++ b/arch/arm/boot/dts/am33xx.dtsi
+@@ -860,7 +860,7 @@
+ 			ti,no-idle-on-init;
+ 			reg = <0x50000000 0x2000>;
+ 			interrupts = <100>;
+-			dmas = <&edma 52>;
++			dmas = <&edma 52 0>;
+ 			dma-names = "rxtx";
+ 			gpmc,num-cs = <7>;
+ 			gpmc,num-waitpins = <2>;
+diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
+index 92068fbf8b57..6bd38a28e26c 100644
+--- a/arch/arm/boot/dts/am4372.dtsi
++++ b/arch/arm/boot/dts/am4372.dtsi
+@@ -207,7 +207,7 @@
+ 			ti,tptcs = <&edma_tptc0 7>, <&edma_tptc1 5>,
+ 				   <&edma_tptc2 0>;
+ 
+-			ti,edma-memcpy-channels = <32 33>;
++			ti,edma-memcpy-channels = <58 59>;
+ 		};
+ 
+ 		edma_tptc0: tptc@49800000 {
+@@ -884,7 +884,7 @@
+ 		gpmc: gpmc@50000000 {
+ 			compatible = "ti,am3352-gpmc";
+ 			ti,hwmods = "gpmc";
+-			dmas = <&edma 52>;
++			dmas = <&edma 52 0>;
+ 			dma-names = "rxtx";
+ 			clocks = <&l3s_gclk>;
+ 			clock-names = "fck";
+diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
+index d580e2b70f9a..637dc5dbc8ac 100644
+--- a/arch/arm/boot/dts/am43x-epos-evm.dts
++++ b/arch/arm/boot/dts/am43x-epos-evm.dts
+@@ -792,3 +792,8 @@
+ 	tx-num-evt = <32>;
+ 	rx-num-evt = <32>;
+ };
++
++&synctimer_32kclk {
++	assigned-clocks = <&mux_synctimer32k_ck>;
++	assigned-clock-parents = <&clkdiv32k_ick>;
++};
+diff --git a/arch/arm/boot/dts/armada-375.dtsi b/arch/arm/boot/dts/armada-375.dtsi
+index 7ccce7529b0c..cc952cf8ec30 100644
+--- a/arch/arm/boot/dts/armada-375.dtsi
++++ b/arch/arm/boot/dts/armada-375.dtsi
+@@ -529,7 +529,7 @@
+ 			};
+ 
+ 			sata@a0000 {
+-				compatible = "marvell,orion-sata";
++				compatible = "marvell,armada-370-sata";
+ 				reg = <0xa0000 0x5000>;
+ 				interrupts = <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>;
+ 				clocks = <&gateclk 14>, <&gateclk 20>;
+diff --git a/arch/arm/boot/dts/armada-385-linksys.dtsi b/arch/arm/boot/dts/armada-385-linksys.dtsi
+index 3710755c6d76..85d2c377c332 100644
+--- a/arch/arm/boot/dts/armada-385-linksys.dtsi
++++ b/arch/arm/boot/dts/armada-385-linksys.dtsi
+@@ -117,7 +117,7 @@
+ 			};
+ 
+ 			/* USB part of the eSATA/USB 2.0 port */
+-			usb@50000 {
++			usb@58000 {
+ 				status = "okay";
+ 			};
+ 
+diff --git a/arch/arm/boot/dts/pxa3xx.dtsi b/arch/arm/boot/dts/pxa3xx.dtsi
+index cf6998a0804d..564341af7e97 100644
+--- a/arch/arm/boot/dts/pxa3xx.dtsi
++++ b/arch/arm/boot/dts/pxa3xx.dtsi
+@@ -30,7 +30,7 @@
+ 			reg = <0x43100000 90>;
+ 			interrupts = <45>;
+ 			clocks = <&clks CLK_NAND>;
+-			dmas = <&pdma 97>;
++			dmas = <&pdma 97 3>;
+ 			dma-names = "data";
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;	
+diff --git a/arch/arm/mach-exynos/Kconfig b/arch/arm/mach-exynos/Kconfig
+index 652a0bb11578..5189bcecad12 100644
+--- a/arch/arm/mach-exynos/Kconfig
++++ b/arch/arm/mach-exynos/Kconfig
+@@ -27,6 +27,7 @@ menuconfig ARCH_EXYNOS
+ 	select S5P_DEV_MFC
+ 	select SRAM
+ 	select THERMAL
++	select THERMAL_OF
+ 	select MFD_SYSCON
+ 	select CLKSRC_EXYNOS_MCT
+ 	select POWER_RESET
+diff --git a/arch/arm/mach-omap2/cpuidle34xx.c b/arch/arm/mach-omap2/cpuidle34xx.c
+index aa7b379e2661..2a3db0bd9e15 100644
+--- a/arch/arm/mach-omap2/cpuidle34xx.c
++++ b/arch/arm/mach-omap2/cpuidle34xx.c
+@@ -34,6 +34,7 @@
+ #include "pm.h"
+ #include "control.h"
+ #include "common.h"
++#include "soc.h"
+ 
+ /* Mach specific information to be recorded in the C-state driver_data */
+ struct omap3_idle_statedata {
+@@ -315,6 +316,69 @@ static struct cpuidle_driver omap3_idle_driver = {
+ 	.safe_state_index = 0,
+ };
+ 
++/*
++ * Numbers based on measurements made in October 2009 for PM optimized kernel
++ * with CPU freq enabled on device Nokia N900. Assumes OPP2 (main idle OPP,
++ * and worst case latencies).
++ */
++static struct cpuidle_driver omap3430_idle_driver = {
++	.name             = "omap3430_idle",
++	.owner            = THIS_MODULE,
++	.states = {
++		{
++			.enter		  = omap3_enter_idle_bm,
++			.exit_latency	  = 110 + 162,
++			.target_residency = 5,
++			.name		  = "C1",
++			.desc		  = "MPU ON + CORE ON",
++		},
++		{
++			.enter		  = omap3_enter_idle_bm,
++			.exit_latency	  = 106 + 180,
++			.target_residency = 309,
++			.name		  = "C2",
++			.desc		  = "MPU ON + CORE ON",
++		},
++		{
++			.enter		  = omap3_enter_idle_bm,
++			.exit_latency	  = 107 + 410,
++			.target_residency = 46057,
++			.name		  = "C3",
++			.desc		  = "MPU RET + CORE ON",
++		},
++		{
++			.enter		  = omap3_enter_idle_bm,
++			.exit_latency	  = 121 + 3374,
++			.target_residency = 46057,
++			.name		  = "C4",
++			.desc		  = "MPU OFF + CORE ON",
++		},
++		{
++			.enter		  = omap3_enter_idle_bm,
++			.exit_latency	  = 855 + 1146,
++			.target_residency = 46057,
++			.name		  = "C5",
++			.desc		  = "MPU RET + CORE RET",
++		},
++		{
++			.enter		  = omap3_enter_idle_bm,
++			.exit_latency	  = 7580 + 4134,
++			.target_residency = 484329,
++			.name		  = "C6",
++			.desc		  = "MPU OFF + CORE RET",
++		},
++		{
++			.enter		  = omap3_enter_idle_bm,
++			.exit_latency	  = 7505 + 15274,
++			.target_residency = 484329,
++			.name		  = "C7",
++			.desc		  = "MPU OFF + CORE OFF",
++		},
++	},
++	.state_count = ARRAY_SIZE(omap3_idle_data),
++	.safe_state_index = 0,
++};
++
+ /* Public functions */
+ 
+ /**
+@@ -333,5 +397,8 @@ int __init omap3_idle_init(void)
+ 	if (!mpu_pd || !core_pd || !per_pd || !cam_pd)
+ 		return -ENODEV;
+ 
+-	return cpuidle_register(&omap3_idle_driver, NULL);
++	if (cpu_is_omap3430())
++		return cpuidle_register(&omap3430_idle_driver, NULL);
++	else
++		return cpuidle_register(&omap3_idle_driver, NULL);
+ }
+diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c
+index 3c87e40650cf..9821be6dfd5e 100644
+--- a/arch/arm/mach-omap2/io.c
++++ b/arch/arm/mach-omap2/io.c
+@@ -368,6 +368,7 @@ void __init omap5_map_io(void)
+ void __init dra7xx_map_io(void)
+ {
+ 	iotable_init(dra7xx_io_desc, ARRAY_SIZE(dra7xx_io_desc));
++	omap_barriers_init();
+ }
+ #endif
+ /*
+diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
+index b6d62e4cdfdd..2af6ff63e3b4 100644
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -1416,9 +1416,7 @@ static void _enable_sysc(struct omap_hwmod *oh)
+ 	    (sf & SYSC_HAS_CLOCKACTIVITY))
+ 		_set_clockactivity(oh, oh->class->sysc->clockact, &v);
+ 
+-	/* If the cached value is the same as the new value, skip the write */
+-	if (oh->_sysc_cache != v)
+-		_write_sysconfig(v, oh);
++	_write_sysconfig(v, oh);
+ 
+ 	/*
+ 	 * Set the autoidle bit only after setting the smartidle bit
+@@ -1481,7 +1479,9 @@ static void _idle_sysc(struct omap_hwmod *oh)
+ 		_set_master_standbymode(oh, idlemode, &v);
+ 	}
+ 
+-	_write_sysconfig(v, oh);
++	/* If the cached value is the same as the new value, skip the write */
++	if (oh->_sysc_cache != v)
++		_write_sysconfig(v, oh);
+ }
+ 
+ /**
+diff --git a/arch/arm/mach-prima2/Kconfig b/arch/arm/mach-prima2/Kconfig
+index f998eb1c698e..0cf4426183cf 100644
+--- a/arch/arm/mach-prima2/Kconfig
++++ b/arch/arm/mach-prima2/Kconfig
+@@ -2,6 +2,7 @@ menuconfig ARCH_SIRF
+ 	bool "CSR SiRF"
+ 	depends on ARCH_MULTI_V7
+ 	select ARCH_HAS_RESET_CONTROLLER
++	select RESET_CONTROLLER
+ 	select ARCH_REQUIRE_GPIOLIB
+ 	select GENERIC_IRQ_CHIP
+ 	select NO_IOPORT_MAP
+diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h
+index 8dde19962a5b..f63c96cd3608 100644
+--- a/arch/powerpc/include/uapi/asm/cputable.h
++++ b/arch/powerpc/include/uapi/asm/cputable.h
+@@ -31,6 +31,7 @@
+ #define PPC_FEATURE_PSERIES_PERFMON_COMPAT \
+ 					0x00000040
+ 
++/* Reserved - do not use		0x00000004 */
+ #define PPC_FEATURE_TRUE_LE		0x00000002
+ #define PPC_FEATURE_PPC_LE		0x00000001
+ 
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index 7030b035905d..a15fe1d4e84a 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -148,23 +148,25 @@ static struct ibm_pa_feature {
+ 	unsigned long	cpu_features;	/* CPU_FTR_xxx bit */
+ 	unsigned long	mmu_features;	/* MMU_FTR_xxx bit */
+ 	unsigned int	cpu_user_ftrs;	/* PPC_FEATURE_xxx bit */
++	unsigned int	cpu_user_ftrs2;	/* PPC_FEATURE2_xxx bit */
+ 	unsigned char	pabyte;		/* byte number in ibm,pa-features */
+ 	unsigned char	pabit;		/* bit number (big-endian) */
+ 	unsigned char	invert;		/* if 1, pa bit set => clear feature */
+ } ibm_pa_features[] __initdata = {
+-	{0, 0, PPC_FEATURE_HAS_MMU,	0, 0, 0},
+-	{0, 0, PPC_FEATURE_HAS_FPU,	0, 1, 0},
+-	{CPU_FTR_CTRL, 0, 0,		0, 3, 0},
+-	{CPU_FTR_NOEXECUTE, 0, 0,	0, 6, 0},
+-	{CPU_FTR_NODSISRALIGN, 0, 0,	1, 1, 1},
+-	{0, MMU_FTR_CI_LARGE_PAGE, 0,	1, 2, 0},
+-	{CPU_FTR_REAL_LE, PPC_FEATURE_TRUE_LE, 5, 0, 0},
++	{0, 0, PPC_FEATURE_HAS_MMU, 0,		0, 0, 0},
++	{0, 0, PPC_FEATURE_HAS_FPU, 0,		0, 1, 0},
++	{CPU_FTR_CTRL, 0, 0, 0,			0, 3, 0},
++	{CPU_FTR_NOEXECUTE, 0, 0, 0,		0, 6, 0},
++	{CPU_FTR_NODSISRALIGN, 0, 0, 0,		1, 1, 1},
++	{0, MMU_FTR_CI_LARGE_PAGE, 0, 0,		1, 2, 0},
++	{CPU_FTR_REAL_LE, 0, PPC_FEATURE_TRUE_LE, 0, 5, 0, 0},
+ 	/*
+-	 * If the kernel doesn't support TM (ie. CONFIG_PPC_TRANSACTIONAL_MEM=n),
+-	 * we don't want to turn on CPU_FTR_TM here, so we use CPU_FTR_TM_COMP
+-	 * which is 0 if the kernel doesn't support TM.
++	 * If the kernel doesn't support TM (ie CONFIG_PPC_TRANSACTIONAL_MEM=n),
++	 * we don't want to turn on TM here, so we use the *_COMP versions
++	 * which are 0 if the kernel doesn't support TM.
+ 	 */
+-	{CPU_FTR_TM_COMP, 0, 0,		22, 0, 0},
++	{CPU_FTR_TM_COMP, 0, 0,
++	 PPC_FEATURE2_HTM_COMP|PPC_FEATURE2_HTM_NOSC_COMP, 22, 0, 0},
+ };
+ 
+ static void __init scan_features(unsigned long node, const unsigned char *ftrs,
+@@ -195,10 +197,12 @@ static void __init scan_features(unsigned long node, const unsigned char *ftrs,
+ 		if (bit ^ fp->invert) {
+ 			cur_cpu_spec->cpu_features |= fp->cpu_features;
+ 			cur_cpu_spec->cpu_user_features |= fp->cpu_user_ftrs;
++			cur_cpu_spec->cpu_user_features2 |= fp->cpu_user_ftrs2;
+ 			cur_cpu_spec->mmu_features |= fp->mmu_features;
+ 		} else {
+ 			cur_cpu_spec->cpu_features &= ~fp->cpu_features;
+ 			cur_cpu_spec->cpu_user_features &= ~fp->cpu_user_ftrs;
++			cur_cpu_spec->cpu_user_features2 &= ~fp->cpu_user_ftrs2;
+ 			cur_cpu_spec->mmu_features &= ~fp->mmu_features;
+ 		}
+ 	}
+diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
+index 2b2ced9dc00a..6dafabb6ae1a 100644
+--- a/arch/s390/include/asm/pci.h
++++ b/arch/s390/include/asm/pci.h
+@@ -45,7 +45,8 @@ struct zpci_fmb {
+ 	u64 rpcit_ops;
+ 	u64 dma_rbytes;
+ 	u64 dma_wbytes;
+-} __packed __aligned(64);
++	u64 pad[2];
++} __packed __aligned(128);
+ 
+ enum zpci_state {
+ 	ZPCI_FN_STATE_RESERVED,
+diff --git a/arch/x86/crypto/sha-mb/sha1_mb.c b/arch/x86/crypto/sha-mb/sha1_mb.c
+index a841e9765bd6..8381c09d2870 100644
+--- a/arch/x86/crypto/sha-mb/sha1_mb.c
++++ b/arch/x86/crypto/sha-mb/sha1_mb.c
+@@ -453,10 +453,10 @@ static int sha_complete_job(struct mcryptd_hash_request_ctx *rctx,
+ 
+ 			req = cast_mcryptd_ctx_to_req(req_ctx);
+ 			if (irqs_disabled())
+-				rctx->complete(&req->base, ret);
++				req_ctx->complete(&req->base, ret);
+ 			else {
+ 				local_bh_disable();
+-				rctx->complete(&req->base, ret);
++				req_ctx->complete(&req->base, ret);
+ 				local_bh_enable();
+ 			}
+ 		}
+diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h
+index f8a29d2c97b0..e6a8613fbfb0 100644
+--- a/arch/x86/include/asm/hugetlb.h
++++ b/arch/x86/include/asm/hugetlb.h
+@@ -4,6 +4,7 @@
+ #include <asm/page.h>
+ #include <asm-generic/hugetlb.h>
+ 
++#define hugepages_supported() cpu_has_pse
+ 
+ static inline int is_hugepage_only_range(struct mm_struct *mm,
+ 					 unsigned long addr,
+diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
+index ad59d70bcb1a..ef495511f019 100644
+--- a/arch/x86/kernel/apic/vector.c
++++ b/arch/x86/kernel/apic/vector.c
+@@ -256,7 +256,8 @@ static void clear_irq_vector(int irq, struct apic_chip_data *data)
+ 	struct irq_desc *desc;
+ 	int cpu, vector;
+ 
+-	BUG_ON(!data->cfg.vector);
++	if (!data->cfg.vector)
++		return;
+ 
+ 	vector = data->cfg.vector;
+ 	for_each_cpu_and(cpu, data->domain, cpu_online_mask)
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-genpool.c b/arch/x86/kernel/cpu/mcheck/mce-genpool.c
+index 0a850100c594..2658e2af74ec 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-genpool.c
++++ b/arch/x86/kernel/cpu/mcheck/mce-genpool.c
+@@ -29,7 +29,7 @@ static char gen_pool_buf[MCE_POOLSZ];
+ void mce_gen_pool_process(void)
+ {
+ 	struct llist_node *head;
+-	struct mce_evt_llist *node;
++	struct mce_evt_llist *node, *tmp;
+ 	struct mce *mce;
+ 
+ 	head = llist_del_all(&mce_event_llist);
+@@ -37,7 +37,7 @@ void mce_gen_pool_process(void)
+ 		return;
+ 
+ 	head = llist_reverse_order(head);
+-	llist_for_each_entry(node, head, llnode) {
++	llist_for_each_entry_safe(node, tmp, head, llnode) {
+ 		mce = &node->mce;
+ 		atomic_notifier_call_chain(&x86_mce_decoder_chain, 0, mce);
+ 		gen_pool_free(mce_evt_pool, (unsigned long)node, sizeof(*node));
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index eca5bd9f0e47..ac4963c38aa3 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -697,7 +697,6 @@ static int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
+ 		if ((xcr0 & XFEATURE_MASK_AVX512) != XFEATURE_MASK_AVX512)
+ 			return 1;
+ 	}
+-	kvm_put_guest_xcr0(vcpu);
+ 	vcpu->arch.xcr0 = xcr0;
+ 
+ 	if ((xcr0 ^ old_xcr0) & XFEATURE_MASK_EXTEND)
+@@ -6569,8 +6568,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
+ 	kvm_x86_ops->prepare_guest_switch(vcpu);
+ 	if (vcpu->fpu_active)
+ 		kvm_load_guest_fpu(vcpu);
+-	kvm_load_guest_xcr0(vcpu);
+-
+ 	vcpu->mode = IN_GUEST_MODE;
+ 
+ 	srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
+@@ -6593,6 +6590,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
+ 		goto cancel_injection;
+ 	}
+ 
++	kvm_load_guest_xcr0(vcpu);
++
+ 	if (req_immediate_exit)
+ 		smp_send_reschedule(vcpu->cpu);
+ 
+@@ -6642,6 +6641,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
+ 	vcpu->mode = OUTSIDE_GUEST_MODE;
+ 	smp_wmb();
+ 
++	kvm_put_guest_xcr0(vcpu);
++
+ 	/* Interrupt is enabled by handle_external_intr() */
+ 	kvm_x86_ops->handle_external_intr(vcpu);
+ 
+@@ -7289,7 +7290,6 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
+ 	 * and assume host would use all available bits.
+ 	 * Guest xcr0 would be loaded later.
+ 	 */
+-	kvm_put_guest_xcr0(vcpu);
+ 	vcpu->guest_fpu_loaded = 1;
+ 	__kernel_fpu_begin();
+ 	__copy_kernel_to_fpregs(&vcpu->arch.guest_fpu.state);
+@@ -7298,8 +7298,6 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
+ 
+ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)
+ {
+-	kvm_put_guest_xcr0(vcpu);
+-
+ 	if (!vcpu->guest_fpu_loaded) {
+ 		vcpu->fpu_counter = 0;
+ 		return;
+diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c
+index 637ab34ed632..ddb2244b06a1 100644
+--- a/arch/x86/mm/kmmio.c
++++ b/arch/x86/mm/kmmio.c
+@@ -33,7 +33,7 @@
+ struct kmmio_fault_page {
+ 	struct list_head list;
+ 	struct kmmio_fault_page *release_next;
+-	unsigned long page; /* location of the fault page */
++	unsigned long addr; /* the requested address */
+ 	pteval_t old_presence; /* page presence prior to arming */
+ 	bool armed;
+ 
+@@ -70,9 +70,16 @@ unsigned int kmmio_count;
+ static struct list_head kmmio_page_table[KMMIO_PAGE_TABLE_SIZE];
+ static LIST_HEAD(kmmio_probes);
+ 
+-static struct list_head *kmmio_page_list(unsigned long page)
++static struct list_head *kmmio_page_list(unsigned long addr)
+ {
+-	return &kmmio_page_table[hash_long(page, KMMIO_PAGE_HASH_BITS)];
++	unsigned int l;
++	pte_t *pte = lookup_address(addr, &l);
++
++	if (!pte)
++		return NULL;
++	addr &= page_level_mask(l);
++
++	return &kmmio_page_table[hash_long(addr, KMMIO_PAGE_HASH_BITS)];
+ }
+ 
+ /* Accessed per-cpu */
+@@ -98,15 +105,19 @@ static struct kmmio_probe *get_kmmio_probe(unsigned long addr)
+ }
+ 
+ /* You must be holding RCU read lock. */
+-static struct kmmio_fault_page *get_kmmio_fault_page(unsigned long page)
++static struct kmmio_fault_page *get_kmmio_fault_page(unsigned long addr)
+ {
+ 	struct list_head *head;
+ 	struct kmmio_fault_page *f;
++	unsigned int l;
++	pte_t *pte = lookup_address(addr, &l);
+ 
+-	page &= PAGE_MASK;
+-	head = kmmio_page_list(page);
++	if (!pte)
++		return NULL;
++	addr &= page_level_mask(l);
++	head = kmmio_page_list(addr);
+ 	list_for_each_entry_rcu(f, head, list) {
+-		if (f->page == page)
++		if (f->addr == addr)
+ 			return f;
+ 	}
+ 	return NULL;
+@@ -137,10 +148,10 @@ static void clear_pte_presence(pte_t *pte, bool clear, pteval_t *old)
+ static int clear_page_presence(struct kmmio_fault_page *f, bool clear)
+ {
+ 	unsigned int level;
+-	pte_t *pte = lookup_address(f->page, &level);
++	pte_t *pte = lookup_address(f->addr, &level);
+ 
+ 	if (!pte) {
+-		pr_err("no pte for page 0x%08lx\n", f->page);
++		pr_err("no pte for addr 0x%08lx\n", f->addr);
+ 		return -1;
+ 	}
+ 
+@@ -156,7 +167,7 @@ static int clear_page_presence(struct kmmio_fault_page *f, bool clear)
+ 		return -1;
+ 	}
+ 
+-	__flush_tlb_one(f->page);
++	__flush_tlb_one(f->addr);
+ 	return 0;
+ }
+ 
+@@ -176,12 +187,12 @@ static int arm_kmmio_fault_page(struct kmmio_fault_page *f)
+ 	int ret;
+ 	WARN_ONCE(f->armed, KERN_ERR pr_fmt("kmmio page already armed.\n"));
+ 	if (f->armed) {
+-		pr_warning("double-arm: page 0x%08lx, ref %d, old %d\n",
+-			   f->page, f->count, !!f->old_presence);
++		pr_warning("double-arm: addr 0x%08lx, ref %d, old %d\n",
++			   f->addr, f->count, !!f->old_presence);
+ 	}
+ 	ret = clear_page_presence(f, true);
+-	WARN_ONCE(ret < 0, KERN_ERR pr_fmt("arming 0x%08lx failed.\n"),
+-		  f->page);
++	WARN_ONCE(ret < 0, KERN_ERR pr_fmt("arming at 0x%08lx failed.\n"),
++		  f->addr);
+ 	f->armed = true;
+ 	return ret;
+ }
+@@ -191,7 +202,7 @@ static void disarm_kmmio_fault_page(struct kmmio_fault_page *f)
+ {
+ 	int ret = clear_page_presence(f, false);
+ 	WARN_ONCE(ret < 0,
+-			KERN_ERR "kmmio disarming 0x%08lx failed.\n", f->page);
++			KERN_ERR "kmmio disarming at 0x%08lx failed.\n", f->addr);
+ 	f->armed = false;
+ }
+ 
+@@ -215,6 +226,12 @@ int kmmio_handler(struct pt_regs *regs, unsigned long addr)
+ 	struct kmmio_context *ctx;
+ 	struct kmmio_fault_page *faultpage;
+ 	int ret = 0; /* default to fault not handled */
++	unsigned long page_base = addr;
++	unsigned int l;
++	pte_t *pte = lookup_address(addr, &l);
++	if (!pte)
++		return -EINVAL;
++	page_base &= page_level_mask(l);
+ 
+ 	/*
+ 	 * Preemption is now disabled to prevent process switch during
+@@ -227,7 +244,7 @@ int kmmio_handler(struct pt_regs *regs, unsigned long addr)
+ 	preempt_disable();
+ 	rcu_read_lock();
+ 
+-	faultpage = get_kmmio_fault_page(addr);
++	faultpage = get_kmmio_fault_page(page_base);
+ 	if (!faultpage) {
+ 		/*
+ 		 * Either this page fault is not caused by kmmio, or
+@@ -239,7 +256,7 @@ int kmmio_handler(struct pt_regs *regs, unsigned long addr)
+ 
+ 	ctx = &get_cpu_var(kmmio_ctx);
+ 	if (ctx->active) {
+-		if (addr == ctx->addr) {
++		if (page_base == ctx->addr) {
+ 			/*
+ 			 * A second fault on the same page means some other
+ 			 * condition needs handling by do_page_fault(), the
+@@ -267,9 +284,9 @@ int kmmio_handler(struct pt_regs *regs, unsigned long addr)
+ 	ctx->active++;
+ 
+ 	ctx->fpage = faultpage;
+-	ctx->probe = get_kmmio_probe(addr);
++	ctx->probe = get_kmmio_probe(page_base);
+ 	ctx->saved_flags = (regs->flags & (X86_EFLAGS_TF | X86_EFLAGS_IF));
+-	ctx->addr = addr;
++	ctx->addr = page_base;
+ 
+ 	if (ctx->probe && ctx->probe->pre_handler)
+ 		ctx->probe->pre_handler(ctx->probe, regs, addr);
+@@ -354,12 +371,11 @@ out:
+ }
+ 
+ /* You must be holding kmmio_lock. */
+-static int add_kmmio_fault_page(unsigned long page)
++static int add_kmmio_fault_page(unsigned long addr)
+ {
+ 	struct kmmio_fault_page *f;
+ 
+-	page &= PAGE_MASK;
+-	f = get_kmmio_fault_page(page);
++	f = get_kmmio_fault_page(addr);
+ 	if (f) {
+ 		if (!f->count)
+ 			arm_kmmio_fault_page(f);
+@@ -372,26 +388,25 @@ static int add_kmmio_fault_page(unsigned long page)
+ 		return -1;
+ 
+ 	f->count = 1;
+-	f->page = page;
++	f->addr = addr;
+ 
+ 	if (arm_kmmio_fault_page(f)) {
+ 		kfree(f);
+ 		return -1;
+ 	}
+ 
+-	list_add_rcu(&f->list, kmmio_page_list(f->page));
++	list_add_rcu(&f->list, kmmio_page_list(f->addr));
+ 
+ 	return 0;
+ }
+ 
+ /* You must be holding kmmio_lock. */
+-static void release_kmmio_fault_page(unsigned long page,
++static void release_kmmio_fault_page(unsigned long addr,
+ 				struct kmmio_fault_page **release_list)
+ {
+ 	struct kmmio_fault_page *f;
+ 
+-	page &= PAGE_MASK;
+-	f = get_kmmio_fault_page(page);
++	f = get_kmmio_fault_page(addr);
+ 	if (!f)
+ 		return;
+ 
+@@ -420,18 +435,27 @@ int register_kmmio_probe(struct kmmio_probe *p)
+ 	int ret = 0;
+ 	unsigned long size = 0;
+ 	const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
++	unsigned int l;
++	pte_t *pte;
+ 
+ 	spin_lock_irqsave(&kmmio_lock, flags);
+ 	if (get_kmmio_probe(p->addr)) {
+ 		ret = -EEXIST;
+ 		goto out;
+ 	}
++
++	pte = lookup_address(p->addr, &l);
++	if (!pte) {
++		ret = -EINVAL;
++		goto out;
++	}
++
+ 	kmmio_count++;
+ 	list_add_rcu(&p->list, &kmmio_probes);
+ 	while (size < size_lim) {
+ 		if (add_kmmio_fault_page(p->addr + size))
+ 			pr_err("Unable to set page fault.\n");
+-		size += PAGE_SIZE;
++		size += page_level_size(l);
+ 	}
+ out:
+ 	spin_unlock_irqrestore(&kmmio_lock, flags);
+@@ -506,11 +530,17 @@ void unregister_kmmio_probe(struct kmmio_probe *p)
+ 	const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
+ 	struct kmmio_fault_page *release_list = NULL;
+ 	struct kmmio_delayed_release *drelease;
++	unsigned int l;
++	pte_t *pte;
++
++	pte = lookup_address(p->addr, &l);
++	if (!pte)
++		return;
+ 
+ 	spin_lock_irqsave(&kmmio_lock, flags);
+ 	while (size < size_lim) {
+ 		release_kmmio_fault_page(p->addr + size, &release_list);
+-		size += PAGE_SIZE;
++		size += page_level_size(l);
+ 	}
+ 	list_del_rcu(&p->list);
+ 	kmmio_count--;
+diff --git a/block/partition-generic.c b/block/partition-generic.c
+index fefd01b496a0..cfcfe1b0ecbc 100644
+--- a/block/partition-generic.c
++++ b/block/partition-generic.c
+@@ -350,15 +350,20 @@ struct hd_struct *add_partition(struct gendisk *disk, int partno,
+ 			goto out_del;
+ 	}
+ 
++	err = hd_ref_init(p);
++	if (err) {
++		if (flags & ADDPART_FLAG_WHOLEDISK)
++			goto out_remove_file;
++		goto out_del;
++	}
++
+ 	/* everything is up and running, commence */
+ 	rcu_assign_pointer(ptbl->part[partno], p);
+ 
+ 	/* suppress uevent if the disk suppresses it */
+ 	if (!dev_get_uevent_suppress(ddev))
+ 		kobject_uevent(&pdev->kobj, KOBJ_ADD);
+-
+-	if (!hd_ref_init(p))
+-		return p;
++	return p;
+ 
+ out_free_info:
+ 	free_part_info(p);
+@@ -367,6 +372,8 @@ out_free_stats:
+ out_free:
+ 	kfree(p);
+ 	return ERR_PTR(err);
++out_remove_file:
++	device_remove_file(pdev, &dev_attr_whole_disk);
+ out_del:
+ 	kobject_put(p->holder_dir);
+ 	device_del(pdev);
+diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c
+index 50f5c97e1087..0cbc5a5025c2 100644
+--- a/crypto/rsa-pkcs1pad.c
++++ b/crypto/rsa-pkcs1pad.c
+@@ -310,16 +310,16 @@ static int pkcs1pad_decrypt(struct akcipher_request *req)
+ 	req_ctx->child_req.src = req->src;
+ 	req_ctx->child_req.src_len = req->src_len;
+ 	req_ctx->child_req.dst = req_ctx->out_sg;
+-	req_ctx->child_req.dst_len = ctx->key_size - 1;
++	req_ctx->child_req.dst_len = ctx->key_size ;
+ 
+-	req_ctx->out_buf = kmalloc(ctx->key_size - 1,
++	req_ctx->out_buf = kmalloc(ctx->key_size,
+ 			(req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) ?
+ 			GFP_KERNEL : GFP_ATOMIC);
+ 	if (!req_ctx->out_buf)
+ 		return -ENOMEM;
+ 
+ 	pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,
+-			ctx->key_size - 1, NULL);
++			    ctx->key_size, NULL);
+ 
+ 	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
+ 	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
+@@ -491,16 +491,16 @@ static int pkcs1pad_verify(struct akcipher_request *req)
+ 	req_ctx->child_req.src = req->src;
+ 	req_ctx->child_req.src_len = req->src_len;
+ 	req_ctx->child_req.dst = req_ctx->out_sg;
+-	req_ctx->child_req.dst_len = ctx->key_size - 1;
++	req_ctx->child_req.dst_len = ctx->key_size;
+ 
+-	req_ctx->out_buf = kmalloc(ctx->key_size - 1,
++	req_ctx->out_buf = kmalloc(ctx->key_size,
+ 			(req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) ?
+ 			GFP_KERNEL : GFP_ATOMIC);
+ 	if (!req_ctx->out_buf)
+ 		return -ENOMEM;
+ 
+ 	pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,
+-			ctx->key_size - 1, NULL);
++			    ctx->key_size, NULL);
+ 
+ 	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
+ 	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
+diff --git a/drivers/acpi/acpica/nsinit.c b/drivers/acpi/acpica/nsinit.c
+index bd75d46234a4..ddb436f86415 100644
+--- a/drivers/acpi/acpica/nsinit.c
++++ b/drivers/acpi/acpica/nsinit.c
+@@ -83,6 +83,8 @@ acpi_status acpi_ns_initialize_objects(void)
+ 
+ 	ACPI_FUNCTION_TRACE(ns_initialize_objects);
+ 
++	ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
++			  "[Init] Completing Initialization of ACPI Objects\n"));
+ 	ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ 			  "**** Starting initialization of namespace objects ****\n"));
+ 	ACPI_DEBUG_PRINT_RAW((ACPI_DB_INIT,
+diff --git a/drivers/acpi/acpica/tbxfload.c b/drivers/acpi/acpica/tbxfload.c
+index 278666e39563..c37d47982fbe 100644
+--- a/drivers/acpi/acpica/tbxfload.c
++++ b/drivers/acpi/acpica/tbxfload.c
+@@ -83,6 +83,20 @@ acpi_status __init acpi_load_tables(void)
+ 				"While loading namespace from ACPI tables"));
+ 	}
+ 
++	if (!acpi_gbl_group_module_level_code) {
++		/*
++		 * Initialize the objects that remain uninitialized. This
++		 * runs the executable AML that may be part of the
++		 * declaration of these objects:
++		 * operation_regions, buffer_fields, Buffers, and Packages.
++		 */
++		status = acpi_ns_initialize_objects();
++		if (ACPI_FAILURE(status)) {
++			return_ACPI_STATUS(status);
++		}
++	}
++
++	acpi_gbl_reg_methods_enabled = TRUE;
+ 	return_ACPI_STATUS(status);
+ }
+ 
+diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c
+index 721b87cce908..638fbd4ad72b 100644
+--- a/drivers/acpi/acpica/utxfinit.c
++++ b/drivers/acpi/acpica/utxfinit.c
+@@ -267,7 +267,6 @@ acpi_status __init acpi_initialize_objects(u32 flags)
+ 	 * initialized, even if they contain executable AML (see the call to
+ 	 * acpi_ns_initialize_objects below).
+ 	 */
+-	acpi_gbl_reg_methods_enabled = TRUE;
+ 	if (!(flags & ACPI_NO_ADDRESS_SPACE_INIT)) {
+ 		ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
+ 				  "[Init] Executing _REG OpRegion methods\n"));
+@@ -299,20 +298,18 @@ acpi_status __init acpi_initialize_objects(u32 flags)
+ 	 */
+ 	if (acpi_gbl_group_module_level_code) {
+ 		acpi_ns_exec_module_code_list();
+-	}
+ 
+-	/*
+-	 * Initialize the objects that remain uninitialized. This runs the
+-	 * executable AML that may be part of the declaration of these objects:
+-	 * operation_regions, buffer_fields, Buffers, and Packages.
+-	 */
+-	if (!(flags & ACPI_NO_OBJECT_INIT)) {
+-		ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
+-				  "[Init] Completing Initialization of ACPI Objects\n"));
+-
+-		status = acpi_ns_initialize_objects();
+-		if (ACPI_FAILURE(status)) {
+-			return_ACPI_STATUS(status);
++		/*
++		 * Initialize the objects that remain uninitialized. This
++		 * runs the executable AML that may be part of the
++		 * declaration of these objects:
++		 * operation_regions, buffer_fields, Buffers, and Packages.
++		 */
++		if (!(flags & ACPI_NO_OBJECT_INIT)) {
++			status = acpi_ns_initialize_objects();
++			if (ACPI_FAILURE(status)) {
++				return_ACPI_STATUS(status);
++			}
+ 		}
+ 	}
+ 
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index 301b785f9f56..0caf92ae25f3 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -1378,7 +1378,7 @@ int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd,
+ 	mutex_lock(&subdomain->lock);
+ 	mutex_lock_nested(&genpd->lock, SINGLE_DEPTH_NESTING);
+ 
+-	if (!list_empty(&subdomain->slave_links) || subdomain->device_count) {
++	if (!list_empty(&subdomain->master_links) || subdomain->device_count) {
+ 		pr_warn("%s: unable to remove subdomain %s\n", genpd->name,
+ 			subdomain->name);
+ 		ret = -EBUSY;
+diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c
+index cf351d3dab1c..0708f301ad97 100644
+--- a/drivers/base/power/opp/core.c
++++ b/drivers/base/power/opp/core.c
+@@ -844,8 +844,14 @@ static int opp_parse_supplies(struct dev_pm_opp *opp, struct device *dev,
+ 	}
+ 
+ 	opp->u_volt = microvolt[0];
+-	opp->u_volt_min = microvolt[1];
+-	opp->u_volt_max = microvolt[2];
++
++	if (count == 1) {
++		opp->u_volt_min = opp->u_volt;
++		opp->u_volt_max = opp->u_volt;
++	} else {
++		opp->u_volt_min = microvolt[1];
++		opp->u_volt_max = microvolt[2];
++	}
+ 
+ 	/* Search for "opp-microamp-<name>" */
+ 	prop = NULL;
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 423f4ca7d712..80cf8add46ff 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -488,6 +488,12 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,
+ 	bvec = __bvec_iter_bvec(bio->bi_io_vec, bio->bi_iter);
+ 	iov_iter_bvec(&iter, ITER_BVEC | rw, bvec,
+ 		      bio_segments(bio), blk_rq_bytes(cmd->rq));
++	/*
++	 * This bio may be started from the middle of the 'bvec'
++	 * because of bio splitting, so offset from the bvec must
++	 * be passed to iov iterator
++	 */
++	iter.iov_offset = bio->bi_iter.bi_bvec_done;
+ 
+ 	cmd->iocb.ki_pos = pos;
+ 	cmd->iocb.ki_filp = file;
+diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c
+index 562b5a4ca7b7..78a39f736c64 100644
+--- a/drivers/block/paride/pd.c
++++ b/drivers/block/paride/pd.c
+@@ -126,7 +126,7 @@
+ */
+ #include <linux/types.h>
+ 
+-static bool verbose = 0;
++static int verbose = 0;
+ static int major = PD_MAJOR;
+ static char *name = PD_NAME;
+ static int cluster = 64;
+@@ -161,7 +161,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_GEO, D_SBY, D_DLY, D_SLV};
+ static DEFINE_MUTEX(pd_mutex);
+ static DEFINE_SPINLOCK(pd_lock);
+ 
+-module_param(verbose, bool, 0);
++module_param(verbose, int, 0);
+ module_param(major, int, 0);
+ module_param(name, charp, 0);
+ module_param(cluster, int, 0);
+diff --git a/drivers/block/paride/pt.c b/drivers/block/paride/pt.c
+index 1740d75e8a32..216a94fed5b4 100644
+--- a/drivers/block/paride/pt.c
++++ b/drivers/block/paride/pt.c
+@@ -117,7 +117,7 @@
+ 
+ */
+ 
+-static bool verbose = 0;
++static int verbose = 0;
+ static int major = PT_MAJOR;
+ static char *name = PT_NAME;
+ static int disable = 0;
+@@ -152,7 +152,7 @@ static int (*drives[4])[6] = {&drive0, &drive1, &drive2, &drive3};
+ 
+ #include <asm/uaccess.h>
+ 
+-module_param(verbose, bool, 0);
++module_param(verbose, int, 0);
+ module_param(major, int, 0);
+ module_param(name, charp, 0);
+ module_param_array(drive0, int, NULL, 0);
+diff --git a/drivers/bus/imx-weim.c b/drivers/bus/imx-weim.c
+index e98d15eaa799..1827fc4d15c1 100644
+--- a/drivers/bus/imx-weim.c
++++ b/drivers/bus/imx-weim.c
+@@ -150,7 +150,7 @@ static int __init weim_parse_dt(struct platform_device *pdev,
+ 			return ret;
+ 	}
+ 
+-	for_each_child_of_node(pdev->dev.of_node, child) {
++	for_each_available_child_of_node(pdev->dev.of_node, child) {
+ 		if (!child->name)
+ 			continue;
+ 
+diff --git a/drivers/bus/uniphier-system-bus.c b/drivers/bus/uniphier-system-bus.c
+index 834a2aeaf27a..350b7309c26d 100644
+--- a/drivers/bus/uniphier-system-bus.c
++++ b/drivers/bus/uniphier-system-bus.c
+@@ -108,7 +108,7 @@ static int uniphier_system_bus_check_overlap(
+ 
+ 	for (i = 0; i < ARRAY_SIZE(priv->bank); i++) {
+ 		for (j = i + 1; j < ARRAY_SIZE(priv->bank); j++) {
+-			if (priv->bank[i].end > priv->bank[j].base ||
++			if (priv->bank[i].end > priv->bank[j].base &&
+ 			    priv->bank[i].base < priv->bank[j].end) {
+ 				dev_err(priv->dev,
+ 					"region overlap between bank%d and bank%d\n",
+diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
+index 45a634016f95..b28e4da3d2cf 100644
+--- a/drivers/char/tpm/tpm2-cmd.c
++++ b/drivers/char/tpm/tpm2-cmd.c
+@@ -20,7 +20,11 @@
+ #include <keys/trusted-type.h>
+ 
+ enum tpm2_object_attributes {
+-	TPM2_ATTR_USER_WITH_AUTH	= BIT(6),
++	TPM2_OA_USER_WITH_AUTH		= BIT(6),
++};
++
++enum tpm2_session_attributes {
++	TPM2_SA_CONTINUE_SESSION	= BIT(0),
+ };
+ 
+ struct tpm2_startup_in {
+@@ -478,22 +482,18 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
+ 	tpm_buf_append_u8(&buf, payload->migratable);
+ 
+ 	/* public */
+-	if (options->policydigest)
+-		tpm_buf_append_u16(&buf, 14 + options->digest_len);
+-	else
+-		tpm_buf_append_u16(&buf, 14);
+-
++	tpm_buf_append_u16(&buf, 14 + options->policydigest_len);
+ 	tpm_buf_append_u16(&buf, TPM2_ALG_KEYEDHASH);
+ 	tpm_buf_append_u16(&buf, hash);
+ 
+ 	/* policy */
+-	if (options->policydigest) {
++	if (options->policydigest_len) {
+ 		tpm_buf_append_u32(&buf, 0);
+-		tpm_buf_append_u16(&buf, options->digest_len);
++		tpm_buf_append_u16(&buf, options->policydigest_len);
+ 		tpm_buf_append(&buf, options->policydigest,
+-			       options->digest_len);
++			       options->policydigest_len);
+ 	} else {
+-		tpm_buf_append_u32(&buf, TPM2_ATTR_USER_WITH_AUTH);
++		tpm_buf_append_u32(&buf, TPM2_OA_USER_WITH_AUTH);
+ 		tpm_buf_append_u16(&buf, 0);
+ 	}
+ 
+@@ -631,7 +631,7 @@ static int tpm2_unseal(struct tpm_chip *chip,
+ 			     options->policyhandle ?
+ 			     options->policyhandle : TPM2_RS_PW,
+ 			     NULL /* nonce */, 0,
+-			     0 /* session_attributes */,
++			     TPM2_SA_CONTINUE_SESSION,
+ 			     options->blobauth /* hmac */,
+ 			     TPM_DIGEST_SIZE);
+ 
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index cd83d477e32d..e89512383c3c 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -673,6 +673,11 @@ static int core_get_max_pstate(void)
+ 			if (err)
+ 				goto skip_tar;
+ 
++			/* For level 1 and 2, bits[23:16] contain the ratio */
++			if (tdp_ctrl)
++				tdp_ratio >>= 16;
++
++			tdp_ratio &= 0xff; /* ratios are only 8 bits long */
+ 			if (tdp_ratio - 1 == tar) {
+ 				max_pstate = tar;
+ 				pr_debug("max_pstate=TAC %x\n", max_pstate);
+diff --git a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
+index 3d9acc53d247..60fc0fa26fd3 100644
+--- a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
++++ b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
+@@ -225,6 +225,9 @@ static int ccp_aes_cmac_export(struct ahash_request *req, void *out)
+ 	struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req);
+ 	struct ccp_aes_cmac_exp_ctx state;
+ 
++	/* Don't let anything leak to 'out' */
++	memset(&state, 0, sizeof(state));
++
+ 	state.null_msg = rctx->null_msg;
+ 	memcpy(state.iv, rctx->iv, sizeof(state.iv));
+ 	state.buf_count = rctx->buf_count;
+diff --git a/drivers/crypto/ccp/ccp-crypto-sha.c b/drivers/crypto/ccp/ccp-crypto-sha.c
+index 8ef06fad8b14..ab9945f2cb7a 100644
+--- a/drivers/crypto/ccp/ccp-crypto-sha.c
++++ b/drivers/crypto/ccp/ccp-crypto-sha.c
+@@ -212,6 +212,9 @@ static int ccp_sha_export(struct ahash_request *req, void *out)
+ 	struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req);
+ 	struct ccp_sha_exp_ctx state;
+ 
++	/* Don't let anything leak to 'out' */
++	memset(&state, 0, sizeof(state));
++
+ 	state.type = rctx->type;
+ 	state.msg_bits = rctx->msg_bits;
+ 	state.first = rctx->first;
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index a0d4a08313ae..aae05547b924 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -63,6 +63,14 @@ static void to_talitos_ptr(struct talitos_ptr *ptr, dma_addr_t dma_addr,
+ 		ptr->eptr = upper_32_bits(dma_addr);
+ }
+ 
++static void copy_talitos_ptr(struct talitos_ptr *dst_ptr,
++			     struct talitos_ptr *src_ptr, bool is_sec1)
++{
++	dst_ptr->ptr = src_ptr->ptr;
++	if (!is_sec1)
++		dst_ptr->eptr = src_ptr->eptr;
++}
++
+ static void to_talitos_ptr_len(struct talitos_ptr *ptr, unsigned int len,
+ 			       bool is_sec1)
+ {
+@@ -1083,21 +1091,20 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 	sg_count = dma_map_sg(dev, areq->src, edesc->src_nents ?: 1,
+ 			      (areq->src == areq->dst) ? DMA_BIDIRECTIONAL
+ 							   : DMA_TO_DEVICE);
+-
+ 	/* hmac data */
+ 	desc->ptr[1].len = cpu_to_be16(areq->assoclen);
+ 	if (sg_count > 1 &&
+ 	    (ret = sg_to_link_tbl_offset(areq->src, sg_count, 0,
+ 					 areq->assoclen,
+ 					 &edesc->link_tbl[tbl_off])) > 1) {
+-		tbl_off += ret;
+-
+ 		to_talitos_ptr(&desc->ptr[1], edesc->dma_link_tbl + tbl_off *
+ 			       sizeof(struct talitos_ptr), 0);
+ 		desc->ptr[1].j_extent = DESC_PTR_LNKTBL_JUMP;
+ 
+ 		dma_sync_single_for_device(dev, edesc->dma_link_tbl,
+ 					   edesc->dma_len, DMA_BIDIRECTIONAL);
++
++		tbl_off += ret;
+ 	} else {
+ 		to_talitos_ptr(&desc->ptr[1], sg_dma_address(areq->src), 0);
+ 		desc->ptr[1].j_extent = 0;
+@@ -1126,11 +1133,13 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 	if (edesc->desc.hdr & DESC_HDR_MODE1_MDEU_CICV)
+ 		sg_link_tbl_len += authsize;
+ 
+-	if (sg_count > 1 &&
+-	    (ret = sg_to_link_tbl_offset(areq->src, sg_count, areq->assoclen,
+-					 sg_link_tbl_len,
+-					 &edesc->link_tbl[tbl_off])) > 1) {
+-		tbl_off += ret;
++	if (sg_count == 1) {
++		to_talitos_ptr(&desc->ptr[4], sg_dma_address(areq->src) +
++			       areq->assoclen, 0);
++	} else if ((ret = sg_to_link_tbl_offset(areq->src, sg_count,
++						areq->assoclen, sg_link_tbl_len,
++						&edesc->link_tbl[tbl_off])) >
++		   1) {
+ 		desc->ptr[4].j_extent |= DESC_PTR_LNKTBL_JUMP;
+ 		to_talitos_ptr(&desc->ptr[4], edesc->dma_link_tbl +
+ 					      tbl_off *
+@@ -1138,8 +1147,10 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 		dma_sync_single_for_device(dev, edesc->dma_link_tbl,
+ 					   edesc->dma_len,
+ 					   DMA_BIDIRECTIONAL);
+-	} else
+-		to_talitos_ptr(&desc->ptr[4], sg_dma_address(areq->src), 0);
++		tbl_off += ret;
++	} else {
++		copy_talitos_ptr(&desc->ptr[4], &edesc->link_tbl[tbl_off], 0);
++	}
+ 
+ 	/* cipher out */
+ 	desc->ptr[5].len = cpu_to_be16(cryptlen);
+@@ -1151,11 +1162,13 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 
+ 	edesc->icv_ool = false;
+ 
+-	if (sg_count > 1 &&
+-	    (sg_count = sg_to_link_tbl_offset(areq->dst, sg_count,
++	if (sg_count == 1) {
++		to_talitos_ptr(&desc->ptr[5], sg_dma_address(areq->dst) +
++			       areq->assoclen, 0);
++	} else if ((sg_count =
++			sg_to_link_tbl_offset(areq->dst, sg_count,
+ 					      areq->assoclen, cryptlen,
+-					      &edesc->link_tbl[tbl_off])) >
+-	    1) {
++					      &edesc->link_tbl[tbl_off])) > 1) {
+ 		struct talitos_ptr *tbl_ptr = &edesc->link_tbl[tbl_off];
+ 
+ 		to_talitos_ptr(&desc->ptr[5], edesc->dma_link_tbl +
+@@ -1178,8 +1191,9 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 					   edesc->dma_len, DMA_BIDIRECTIONAL);
+ 
+ 		edesc->icv_ool = true;
+-	} else
+-		to_talitos_ptr(&desc->ptr[5], sg_dma_address(areq->dst), 0);
++	} else {
++		copy_talitos_ptr(&desc->ptr[5], &edesc->link_tbl[tbl_off], 0);
++	}
+ 
+ 	/* iv out */
+ 	map_single_talitos_ptr(dev, &desc->ptr[6], ivsize, ctx->iv,
+@@ -2629,21 +2643,11 @@ struct talitos_crypto_alg {
+ 	struct talitos_alg_template algt;
+ };
+ 
+-static int talitos_cra_init(struct crypto_tfm *tfm)
++static int talitos_init_common(struct talitos_ctx *ctx,
++			       struct talitos_crypto_alg *talitos_alg)
+ {
+-	struct crypto_alg *alg = tfm->__crt_alg;
+-	struct talitos_crypto_alg *talitos_alg;
+-	struct talitos_ctx *ctx = crypto_tfm_ctx(tfm);
+ 	struct talitos_private *priv;
+ 
+-	if ((alg->cra_flags & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_AHASH)
+-		talitos_alg = container_of(__crypto_ahash_alg(alg),
+-					   struct talitos_crypto_alg,
+-					   algt.alg.hash);
+-	else
+-		talitos_alg = container_of(alg, struct talitos_crypto_alg,
+-					   algt.alg.crypto);
+-
+ 	/* update context with ptr to dev */
+ 	ctx->dev = talitos_alg->dev;
+ 
+@@ -2661,10 +2665,33 @@ static int talitos_cra_init(struct crypto_tfm *tfm)
+ 	return 0;
+ }
+ 
++static int talitos_cra_init(struct crypto_tfm *tfm)
++{
++	struct crypto_alg *alg = tfm->__crt_alg;
++	struct talitos_crypto_alg *talitos_alg;
++	struct talitos_ctx *ctx = crypto_tfm_ctx(tfm);
++
++	if ((alg->cra_flags & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_AHASH)
++		talitos_alg = container_of(__crypto_ahash_alg(alg),
++					   struct talitos_crypto_alg,
++					   algt.alg.hash);
++	else
++		talitos_alg = container_of(alg, struct talitos_crypto_alg,
++					   algt.alg.crypto);
++
++	return talitos_init_common(ctx, talitos_alg);
++}
++
+ static int talitos_cra_init_aead(struct crypto_aead *tfm)
+ {
+-	talitos_cra_init(crypto_aead_tfm(tfm));
+-	return 0;
++	struct aead_alg *alg = crypto_aead_alg(tfm);
++	struct talitos_crypto_alg *talitos_alg;
++	struct talitos_ctx *ctx = crypto_aead_ctx(tfm);
++
++	talitos_alg = container_of(alg, struct talitos_crypto_alg,
++				   algt.alg.aead);
++
++	return talitos_init_common(ctx, talitos_alg);
+ }
+ 
+ static int talitos_cra_init_ahash(struct crypto_tfm *tfm)
+diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
+index 5ad0ec1f0e29..97199b3c25a2 100644
+--- a/drivers/dma/dw/core.c
++++ b/drivers/dma/dw/core.c
+@@ -130,26 +130,14 @@ static void dwc_desc_put(struct dw_dma_chan *dwc, struct dw_desc *desc)
+ static void dwc_initialize(struct dw_dma_chan *dwc)
+ {
+ 	struct dw_dma *dw = to_dw_dma(dwc->chan.device);
+-	struct dw_dma_slave *dws = dwc->chan.private;
+ 	u32 cfghi = DWC_CFGH_FIFO_MODE;
+ 	u32 cfglo = DWC_CFGL_CH_PRIOR(dwc->priority);
+ 
+ 	if (dwc->initialized == true)
+ 		return;
+ 
+-	if (dws) {
+-		/*
+-		 * We need controller-specific data to set up slave
+-		 * transfers.
+-		 */
+-		BUG_ON(!dws->dma_dev || dws->dma_dev != dw->dma.dev);
+-
+-		cfghi |= DWC_CFGH_DST_PER(dws->dst_id);
+-		cfghi |= DWC_CFGH_SRC_PER(dws->src_id);
+-	} else {
+-		cfghi |= DWC_CFGH_DST_PER(dwc->dst_id);
+-		cfghi |= DWC_CFGH_SRC_PER(dwc->src_id);
+-	}
++	cfghi |= DWC_CFGH_DST_PER(dwc->dst_id);
++	cfghi |= DWC_CFGH_SRC_PER(dwc->src_id);
+ 
+ 	channel_writel(dwc, CFG_LO, cfglo);
+ 	channel_writel(dwc, CFG_HI, cfghi);
+@@ -941,7 +929,7 @@ bool dw_dma_filter(struct dma_chan *chan, void *param)
+ 	struct dw_dma_chan *dwc = to_dw_dma_chan(chan);
+ 	struct dw_dma_slave *dws = param;
+ 
+-	if (!dws || dws->dma_dev != chan->device->dev)
++	if (dws->dma_dev != chan->device->dev)
+ 		return false;
+ 
+ 	/* We have to copy data since dws can be temporary storage */
+@@ -1165,6 +1153,14 @@ static int dwc_alloc_chan_resources(struct dma_chan *chan)
+ 	 * doesn't mean what you think it means), and status writeback.
+ 	 */
+ 
++	/*
++	 * We need controller-specific data to set up slave transfers.
++	 */
++	if (chan->private && !dw_dma_filter(chan, chan->private)) {
++		dev_warn(chan2dev(chan), "Wrong controller-specific data\n");
++		return -EINVAL;
++	}
++
+ 	/* Enable controller here if needed */
+ 	if (!dw->in_use)
+ 		dw_dma_on(dw);
+@@ -1226,6 +1222,14 @@ static void dwc_free_chan_resources(struct dma_chan *chan)
+ 	spin_lock_irqsave(&dwc->lock, flags);
+ 	list_splice_init(&dwc->free_list, &list);
+ 	dwc->descs_allocated = 0;
++
++	/* Clear custom channel configuration */
++	dwc->src_id = 0;
++	dwc->dst_id = 0;
++
++	dwc->src_master = 0;
++	dwc->dst_master = 0;
++
+ 	dwc->initialized = false;
+ 
+ 	/* Disable interrupts */
+diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
+index e3d7fcb69b4c..2dac314a2d7a 100644
+--- a/drivers/dma/edma.c
++++ b/drivers/dma/edma.c
+@@ -1563,32 +1563,6 @@ static irqreturn_t dma_ccerr_handler(int irq, void *data)
+ 	return IRQ_HANDLED;
+ }
+ 
+-static void edma_tc_set_pm_state(struct edma_tc *tc, bool enable)
+-{
+-	struct platform_device *tc_pdev;
+-	int ret;
+-
+-	if (!IS_ENABLED(CONFIG_OF) || !tc)
+-		return;
+-
+-	tc_pdev = of_find_device_by_node(tc->node);
+-	if (!tc_pdev) {
+-		pr_err("%s: TPTC device is not found\n", __func__);
+-		return;
+-	}
+-	if (!pm_runtime_enabled(&tc_pdev->dev))
+-		pm_runtime_enable(&tc_pdev->dev);
+-
+-	if (enable)
+-		ret = pm_runtime_get_sync(&tc_pdev->dev);
+-	else
+-		ret = pm_runtime_put_sync(&tc_pdev->dev);
+-
+-	if (ret < 0)
+-		pr_err("%s: pm_runtime_%s_sync() failed for %s\n", __func__,
+-		       enable ? "get" : "put", dev_name(&tc_pdev->dev));
+-}
+-
+ /* Alloc channel resources */
+ static int edma_alloc_chan_resources(struct dma_chan *chan)
+ {
+@@ -1625,8 +1599,6 @@ static int edma_alloc_chan_resources(struct dma_chan *chan)
+ 		EDMA_CHAN_SLOT(echan->ch_num), chan->chan_id,
+ 		echan->hw_triggered ? "HW" : "SW");
+ 
+-	edma_tc_set_pm_state(echan->tc, true);
+-
+ 	return 0;
+ 
+ err_slot:
+@@ -1663,7 +1635,6 @@ static void edma_free_chan_resources(struct dma_chan *chan)
+ 		echan->alloced = false;
+ 	}
+ 
+-	edma_tc_set_pm_state(echan->tc, false);
+ 	echan->tc = NULL;
+ 	echan->hw_triggered = false;
+ 
+@@ -2408,10 +2379,8 @@ static int edma_pm_suspend(struct device *dev)
+ 	int i;
+ 
+ 	for (i = 0; i < ecc->num_channels; i++) {
+-		if (echan[i].alloced) {
++		if (echan[i].alloced)
+ 			edma_setup_interrupt(&echan[i], false);
+-			edma_tc_set_pm_state(echan[i].tc, false);
+-		}
+ 	}
+ 
+ 	return 0;
+@@ -2441,8 +2410,6 @@ static int edma_pm_resume(struct device *dev)
+ 
+ 			/* Set up channel -> slot mapping for the entry slot */
+ 			edma_set_chmap(&echan[i], echan[i].slot[0]);
+-
+-			edma_tc_set_pm_state(echan[i].tc, true);
+ 		}
+ 	}
+ 
+@@ -2466,7 +2433,8 @@ static struct platform_driver edma_driver = {
+ 
+ static int edma_tptc_probe(struct platform_device *pdev)
+ {
+-	return 0;
++	pm_runtime_enable(&pdev->dev);
++	return pm_runtime_get_sync(&pdev->dev);
+ }
+ 
+ static struct platform_driver edma_tptc_driver = {
+diff --git a/drivers/dma/hsu/hsu.c b/drivers/dma/hsu/hsu.c
+index eef145edb936..025d375fc3d7 100644
+--- a/drivers/dma/hsu/hsu.c
++++ b/drivers/dma/hsu/hsu.c
+@@ -135,7 +135,7 @@ static u32 hsu_dma_chan_get_sr(struct hsu_dma_chan *hsuc)
+ 	sr = hsu_chan_readl(hsuc, HSU_CH_SR);
+ 	spin_unlock_irqrestore(&hsuc->vchan.lock, flags);
+ 
+-	return sr;
++	return sr & ~(HSU_CH_SR_DESCE_ANY | HSU_CH_SR_CDESC_ANY);
+ }
+ 
+ irqreturn_t hsu_dma_irq(struct hsu_dma_chip *chip, unsigned short nr)
+@@ -254,10 +254,13 @@ static void hsu_dma_issue_pending(struct dma_chan *chan)
+ static size_t hsu_dma_active_desc_size(struct hsu_dma_chan *hsuc)
+ {
+ 	struct hsu_dma_desc *desc = hsuc->desc;
+-	size_t bytes = desc->length;
++	size_t bytes = 0;
+ 	int i;
+ 
+-	i = desc->active % HSU_DMA_CHAN_NR_DESC;
++	for (i = desc->active; i < desc->nents; i++)
++		bytes += desc->sg[i].len;
++
++	i = HSU_DMA_CHAN_NR_DESC - 1;
+ 	do {
+ 		bytes += hsu_chan_readl(hsuc, HSU_CH_DxTSR(i));
+ 	} while (--i >= 0);
+diff --git a/drivers/dma/hsu/hsu.h b/drivers/dma/hsu/hsu.h
+index 578a8ee8cd05..6b070c22b1df 100644
+--- a/drivers/dma/hsu/hsu.h
++++ b/drivers/dma/hsu/hsu.h
+@@ -41,6 +41,9 @@
+ #define HSU_CH_SR_DESCTO(x)	BIT(8 + (x))
+ #define HSU_CH_SR_DESCTO_ANY	(BIT(11) | BIT(10) | BIT(9) | BIT(8))
+ #define HSU_CH_SR_CHE		BIT(15)
++#define HSU_CH_SR_DESCE(x)	BIT(16 + (x))
++#define HSU_CH_SR_DESCE_ANY	(BIT(19) | BIT(18) | BIT(17) | BIT(16))
++#define HSU_CH_SR_CDESC_ANY	(BIT(31) | BIT(30))
+ 
+ /* Bits in HSU_CH_CR */
+ #define HSU_CH_CR_CHA		BIT(0)
+diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c
+index 9794b073d7d7..a5ed9407c51b 100644
+--- a/drivers/dma/omap-dma.c
++++ b/drivers/dma/omap-dma.c
+@@ -48,6 +48,7 @@ struct omap_chan {
+ 	unsigned dma_sig;
+ 	bool cyclic;
+ 	bool paused;
++	bool running;
+ 
+ 	int dma_ch;
+ 	struct omap_desc *desc;
+@@ -294,6 +295,8 @@ static void omap_dma_start(struct omap_chan *c, struct omap_desc *d)
+ 
+ 	/* Enable channel */
+ 	omap_dma_chan_write(c, CCR, d->ccr | CCR_ENABLE);
++
++	c->running = true;
+ }
+ 
+ static void omap_dma_stop(struct omap_chan *c)
+@@ -355,6 +358,8 @@ static void omap_dma_stop(struct omap_chan *c)
+ 
+ 		omap_dma_chan_write(c, CLNK_CTRL, val);
+ 	}
++
++	c->running = false;
+ }
+ 
+ static void omap_dma_start_sg(struct omap_chan *c, struct omap_desc *d,
+@@ -673,15 +678,20 @@ static enum dma_status omap_dma_tx_status(struct dma_chan *chan,
+ 	struct omap_chan *c = to_omap_dma_chan(chan);
+ 	struct virt_dma_desc *vd;
+ 	enum dma_status ret;
+-	uint32_t ccr;
+ 	unsigned long flags;
+ 
+-	ccr = omap_dma_chan_read(c, CCR);
+-	/* The channel is no longer active, handle the completion right away */
+-	if (!(ccr & CCR_ENABLE))
+-		omap_dma_callback(c->dma_ch, 0, c);
+-
+ 	ret = dma_cookie_status(chan, cookie, txstate);
++
++	if (!c->paused && c->running) {
++		uint32_t ccr = omap_dma_chan_read(c, CCR);
++		/*
++		 * The channel is no longer active, set the return value
++		 * accordingly
++		 */
++		if (!(ccr & CCR_ENABLE))
++			ret = DMA_COMPLETE;
++	}
++
+ 	if (ret == DMA_COMPLETE || !txstate)
+ 		return ret;
+ 
+diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c
+index debca824bed6..77c1c44009d8 100644
+--- a/drivers/dma/pxa_dma.c
++++ b/drivers/dma/pxa_dma.c
+@@ -122,6 +122,7 @@ struct pxad_chan {
+ struct pxad_device {
+ 	struct dma_device		slave;
+ 	int				nr_chans;
++	int				nr_requestors;
+ 	void __iomem			*base;
+ 	struct pxad_phy			*phys;
+ 	spinlock_t			phy_lock;	/* Phy association */
+@@ -473,7 +474,7 @@ static void pxad_free_phy(struct pxad_chan *chan)
+ 		return;
+ 
+ 	/* clear the channel mapping in DRCMR */
+-	if (chan->drcmr <= DRCMR_CHLNUM) {
++	if (chan->drcmr <= pdev->nr_requestors) {
+ 		reg = pxad_drcmr(chan->drcmr);
+ 		writel_relaxed(0, chan->phy->base + reg);
+ 	}
+@@ -509,6 +510,7 @@ static bool is_running_chan_misaligned(struct pxad_chan *chan)
+ 
+ static void phy_enable(struct pxad_phy *phy, bool misaligned)
+ {
++	struct pxad_device *pdev;
+ 	u32 reg, dalgn;
+ 
+ 	if (!phy->vchan)
+@@ -518,7 +520,8 @@ static void phy_enable(struct pxad_phy *phy, bool misaligned)
+ 		"%s(); phy=%p(%d) misaligned=%d\n", __func__,
+ 		phy, phy->idx, misaligned);
+ 
+-	if (phy->vchan->drcmr <= DRCMR_CHLNUM) {
++	pdev = to_pxad_dev(phy->vchan->vc.chan.device);
++	if (phy->vchan->drcmr <= pdev->nr_requestors) {
+ 		reg = pxad_drcmr(phy->vchan->drcmr);
+ 		writel_relaxed(DRCMR_MAPVLD | phy->idx, phy->base + reg);
+ 	}
+@@ -914,6 +917,7 @@ static void pxad_get_config(struct pxad_chan *chan,
+ {
+ 	u32 maxburst = 0, dev_addr = 0;
+ 	enum dma_slave_buswidth width = DMA_SLAVE_BUSWIDTH_UNDEFINED;
++	struct pxad_device *pdev = to_pxad_dev(chan->vc.chan.device);
+ 
+ 	*dcmd = 0;
+ 	if (dir == DMA_DEV_TO_MEM) {
+@@ -922,7 +926,7 @@ static void pxad_get_config(struct pxad_chan *chan,
+ 		dev_addr = chan->cfg.src_addr;
+ 		*dev_src = dev_addr;
+ 		*dcmd |= PXA_DCMD_INCTRGADDR;
+-		if (chan->drcmr <= DRCMR_CHLNUM)
++		if (chan->drcmr <= pdev->nr_requestors)
+ 			*dcmd |= PXA_DCMD_FLOWSRC;
+ 	}
+ 	if (dir == DMA_MEM_TO_DEV) {
+@@ -931,7 +935,7 @@ static void pxad_get_config(struct pxad_chan *chan,
+ 		dev_addr = chan->cfg.dst_addr;
+ 		*dev_dst = dev_addr;
+ 		*dcmd |= PXA_DCMD_INCSRCADDR;
+-		if (chan->drcmr <= DRCMR_CHLNUM)
++		if (chan->drcmr <= pdev->nr_requestors)
+ 			*dcmd |= PXA_DCMD_FLOWTRG;
+ 	}
+ 	if (dir == DMA_MEM_TO_MEM)
+@@ -1341,13 +1345,15 @@ static struct dma_chan *pxad_dma_xlate(struct of_phandle_args *dma_spec,
+ 
+ static int pxad_init_dmadev(struct platform_device *op,
+ 			    struct pxad_device *pdev,
+-			    unsigned int nr_phy_chans)
++			    unsigned int nr_phy_chans,
++			    unsigned int nr_requestors)
+ {
+ 	int ret;
+ 	unsigned int i;
+ 	struct pxad_chan *c;
+ 
+ 	pdev->nr_chans = nr_phy_chans;
++	pdev->nr_requestors = nr_requestors;
+ 	INIT_LIST_HEAD(&pdev->slave.channels);
+ 	pdev->slave.device_alloc_chan_resources = pxad_alloc_chan_resources;
+ 	pdev->slave.device_free_chan_resources = pxad_free_chan_resources;
+@@ -1382,7 +1388,7 @@ static int pxad_probe(struct platform_device *op)
+ 	const struct of_device_id *of_id;
+ 	struct mmp_dma_platdata *pdata = dev_get_platdata(&op->dev);
+ 	struct resource *iores;
+-	int ret, dma_channels = 0;
++	int ret, dma_channels = 0, nb_requestors = 0;
+ 	const enum dma_slave_buswidth widths =
+ 		DMA_SLAVE_BUSWIDTH_1_BYTE   | DMA_SLAVE_BUSWIDTH_2_BYTES |
+ 		DMA_SLAVE_BUSWIDTH_4_BYTES;
+@@ -1399,13 +1405,23 @@ static int pxad_probe(struct platform_device *op)
+ 		return PTR_ERR(pdev->base);
+ 
+ 	of_id = of_match_device(pxad_dt_ids, &op->dev);
+-	if (of_id)
++	if (of_id) {
+ 		of_property_read_u32(op->dev.of_node, "#dma-channels",
+ 				     &dma_channels);
+-	else if (pdata && pdata->dma_channels)
++		ret = of_property_read_u32(op->dev.of_node, "#dma-requests",
++					   &nb_requestors);
++		if (ret) {
++			dev_warn(pdev->slave.dev,
++				 "#dma-requests set to default 32 as missing in OF: %d",
++				 ret);
++			nb_requestors = 32;
++		};
++	} else if (pdata && pdata->dma_channels) {
+ 		dma_channels = pdata->dma_channels;
+-	else
++		nb_requestors = pdata->nb_requestors;
++	} else {
+ 		dma_channels = 32;	/* default 32 channel */
++	}
+ 
+ 	dma_cap_set(DMA_SLAVE, pdev->slave.cap_mask);
+ 	dma_cap_set(DMA_MEMCPY, pdev->slave.cap_mask);
+@@ -1423,7 +1439,7 @@ static int pxad_probe(struct platform_device *op)
+ 	pdev->slave.descriptor_reuse = true;
+ 
+ 	pdev->slave.dev = &op->dev;
+-	ret = pxad_init_dmadev(op, pdev, dma_channels);
++	ret = pxad_init_dmadev(op, pdev, dma_channels, nb_requestors);
+ 	if (ret) {
+ 		dev_err(pdev->slave.dev, "unable to register\n");
+ 		return ret;
+@@ -1442,7 +1458,8 @@ static int pxad_probe(struct platform_device *op)
+ 
+ 	platform_set_drvdata(op, pdev);
+ 	pxad_init_debugfs(pdev);
+-	dev_info(pdev->slave.dev, "initialized %d channels\n", dma_channels);
++	dev_info(pdev->slave.dev, "initialized %d channels on %d requestors\n",
++		 dma_channels, nb_requestors);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
+index 01087a38da22..792bdae2b91d 100644
+--- a/drivers/edac/i7core_edac.c
++++ b/drivers/edac/i7core_edac.c
+@@ -1866,7 +1866,7 @@ static int i7core_mce_check_error(struct notifier_block *nb, unsigned long val,
+ 
+ 	i7_dev = get_i7core_dev(mce->socketid);
+ 	if (!i7_dev)
+-		return NOTIFY_BAD;
++		return NOTIFY_DONE;
+ 
+ 	mci = i7_dev->mci;
+ 	pvt = mci->pvt_info;
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 93f0d4120289..8bf745d2da7e 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -362,6 +362,7 @@ struct sbridge_pvt {
+ 
+ 	/* Memory type detection */
+ 	bool			is_mirrored, is_lockstep, is_close_pg;
++	bool			is_chan_hash;
+ 
+ 	/* Fifo double buffers */
+ 	struct mce		mce_entry[MCE_LOG_LEN];
+@@ -1060,6 +1061,20 @@ static inline u8 sad_pkg_ha(u8 pkg)
+ 	return (pkg >> 2) & 0x1;
+ }
+ 
++static int haswell_chan_hash(int idx, u64 addr)
++{
++	int i;
++
++	/*
++	 * XOR even bits from 12:26 to bit0 of idx,
++	 *     odd bits from 13:27 to bit1
++	 */
++	for (i = 12; i < 28; i += 2)
++		idx ^= (addr >> i) & 3;
++
++	return idx;
++}
++
+ /****************************************************************************
+ 			Memory check routines
+  ****************************************************************************/
+@@ -1616,6 +1631,10 @@ static int get_dimm_config(struct mem_ctl_info *mci)
+ 		KNL_MAX_CHANNELS : NUM_CHANNELS;
+ 	u64 knl_mc_sizes[KNL_MAX_CHANNELS];
+ 
++	if (pvt->info.type == HASWELL || pvt->info.type == BROADWELL) {
++		pci_read_config_dword(pvt->pci_ha0, HASWELL_HASYSDEFEATURE2, &reg);
++		pvt->is_chan_hash = GET_BITFIELD(reg, 21, 21);
++	}
+ 	if (pvt->info.type == HASWELL || pvt->info.type == BROADWELL ||
+ 			pvt->info.type == KNIGHTS_LANDING)
+ 		pci_read_config_dword(pvt->pci_sad1, SAD_TARGET, &reg);
+@@ -2118,12 +2137,15 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ 	}
+ 
+ 	ch_way = TAD_CH(reg) + 1;
+-	sck_way = 1 << TAD_SOCK(reg);
++	sck_way = TAD_SOCK(reg);
+ 
+ 	if (ch_way == 3)
+ 		idx = addr >> 6;
+-	else
++	else {
+ 		idx = (addr >> (6 + sck_way + shiftup)) & 0x3;
++		if (pvt->is_chan_hash)
++			idx = haswell_chan_hash(idx, addr);
++	}
+ 	idx = idx % ch_way;
+ 
+ 	/*
+@@ -2157,7 +2179,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ 		switch(ch_way) {
+ 		case 2:
+ 		case 4:
+-			sck_xch = 1 << sck_way * (ch_way >> 1);
++			sck_xch = (1 << sck_way) * (ch_way >> 1);
+ 			break;
+ 		default:
+ 			sprintf(msg, "Invalid mirror set. Can't decode addr");
+@@ -2193,7 +2215,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ 
+ 	ch_addr = addr - offset;
+ 	ch_addr >>= (6 + shiftup);
+-	ch_addr /= ch_way * sck_way;
++	ch_addr /= sck_xch;
+ 	ch_addr <<= (6 + shiftup);
+ 	ch_addr |= addr & ((1 << (6 + shiftup)) - 1);
+ 
+@@ -3146,7 +3168,7 @@ static int sbridge_mce_check_error(struct notifier_block *nb, unsigned long val,
+ 
+ 	mci = get_mci_for_node_id(mce->socketid);
+ 	if (!mci)
+-		return NOTIFY_BAD;
++		return NOTIFY_DONE;
+ 	pvt = mci->pvt_info;
+ 
+ 	/*
+diff --git a/drivers/extcon/extcon-max77843.c b/drivers/extcon/extcon-max77843.c
+index 74dfb7f4f277..d8cac4661cfe 100644
+--- a/drivers/extcon/extcon-max77843.c
++++ b/drivers/extcon/extcon-max77843.c
+@@ -803,7 +803,7 @@ static int max77843_muic_probe(struct platform_device *pdev)
+ 	/* Clear IRQ bits before request IRQs */
+ 	ret = regmap_bulk_read(max77843->regmap_muic,
+ 			MAX77843_MUIC_REG_INT1, info->status,
+-			MAX77843_MUIC_IRQ_NUM);
++			MAX77843_MUIC_STATUS_NUM);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "Failed to Clear IRQ bits\n");
+ 		goto err_muic_irq;
+diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c
+index 9e15d571b53c..a76c35fc0b92 100644
+--- a/drivers/firmware/efi/arm-init.c
++++ b/drivers/firmware/efi/arm-init.c
+@@ -203,7 +203,19 @@ void __init efi_init(void)
+ 
+ 	reserve_regions();
+ 	early_memunmap(memmap.map, params.mmap_size);
+-	memblock_mark_nomap(params.mmap & PAGE_MASK,
+-			    PAGE_ALIGN(params.mmap_size +
+-				       (params.mmap & ~PAGE_MASK)));
++
++	if (IS_ENABLED(CONFIG_ARM)) {
++		/*
++		 * ARM currently does not allow ioremap_cache() to be called on
++		 * memory regions that are covered by struct page. So remove the
++		 * UEFI memory map from the linear mapping.
++		 */
++		memblock_mark_nomap(params.mmap & PAGE_MASK,
++				    PAGE_ALIGN(params.mmap_size +
++					       (params.mmap & ~PAGE_MASK)));
++	} else {
++		memblock_reserve(params.mmap & PAGE_MASK,
++				 PAGE_ALIGN(params.mmap_size +
++					    (params.mmap & ~PAGE_MASK)));
++	}
+ }
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index 2cd37dad67a6..c51f3b2fe3c0 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -182,6 +182,7 @@ static int generic_ops_register(void)
+ {
+ 	generic_ops.get_variable = efi.get_variable;
+ 	generic_ops.set_variable = efi.set_variable;
++	generic_ops.set_variable_nonblocking = efi.set_variable_nonblocking;
+ 	generic_ops.get_next_variable = efi.get_next_variable;
+ 	generic_ops.query_variable_store = efi_query_variable_store;
+ 
+diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
+index 7f2ea21c730d..6f182fd91a6d 100644
+--- a/drivers/firmware/efi/vars.c
++++ b/drivers/firmware/efi/vars.c
+@@ -202,29 +202,44 @@ static const struct variable_validate variable_validate[] = {
+ 	{ NULL_GUID, "", NULL },
+ };
+ 
++/*
++ * Check if @var_name matches the pattern given in @match_name.
++ *
++ * @var_name: an array of @len non-NUL characters.
++ * @match_name: a NUL-terminated pattern string, optionally ending in "*". A
++ *              final "*" character matches any trailing characters @var_name,
++ *              including the case when there are none left in @var_name.
++ * @match: on output, the number of non-wildcard characters in @match_name
++ *         that @var_name matches, regardless of the return value.
++ * @return: whether @var_name fully matches @match_name.
++ */
+ static bool
+ variable_matches(const char *var_name, size_t len, const char *match_name,
+ 		 int *match)
+ {
+ 	for (*match = 0; ; (*match)++) {
+ 		char c = match_name[*match];
+-		char u = var_name[*match];
+ 
+-		/* Wildcard in the matching name means we've matched */
+-		if (c == '*')
++		switch (c) {
++		case '*':
++			/* Wildcard in @match_name means we've matched. */
+ 			return true;
+ 
+-		/* Case sensitive match */
+-		if (!c && *match == len)
+-			return true;
++		case '\0':
++			/* @match_name has ended. Has @var_name too? */
++			return (*match == len);
+ 
+-		if (c != u)
++		default:
++			/*
++			 * We've reached a non-wildcard char in @match_name.
++			 * Continue only if there's an identical character in
++			 * @var_name.
++			 */
++			if (*match < len && c == var_name[*match])
++				continue;
+ 			return false;
+-
+-		if (!c)
+-			return true;
++		}
+ 	}
+-	return true;
+ }
+ 
+ bool
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+index 5e7770f9a415..ff299752d5e6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -1619,6 +1619,7 @@ struct amdgpu_uvd {
+ 	struct amdgpu_bo	*vcpu_bo;
+ 	void			*cpu_addr;
+ 	uint64_t		gpu_addr;
++	unsigned		fw_version;
+ 	atomic_t		handles[AMDGPU_MAX_UVD_HANDLES];
+ 	struct drm_file		*filp[AMDGPU_MAX_UVD_HANDLES];
+ 	struct delayed_work	idle_work;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+index 81dc6b65436f..3c895863fcf5 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+@@ -63,10 +63,6 @@ bool amdgpu_has_atpx(void) {
+ 	return amdgpu_atpx_priv.atpx_detected;
+ }
+ 
+-bool amdgpu_has_atpx_dgpu_power_cntl(void) {
+-	return amdgpu_atpx_priv.atpx.functions.power_cntl;
+-}
+-
+ /**
+  * amdgpu_atpx_call - call an ATPX method
+  *
+@@ -146,6 +142,10 @@ static void amdgpu_atpx_parse_functions(struct amdgpu_atpx_functions *f, u32 mas
+  */
+ static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx)
+ {
++	/* make sure required functions are enabled */
++	/* dGPU power control is required */
++	atpx->functions.power_cntl = true;
++
+ 	if (atpx->functions.px_params) {
+ 		union acpi_object *info;
+ 		struct atpx_px_params output;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index d6c68d00cbb0..51bfc114584e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -62,12 +62,6 @@ static const char *amdgpu_asic_name[] = {
+ 	"LAST",
+ };
+ 
+-#if defined(CONFIG_VGA_SWITCHEROO)
+-bool amdgpu_has_atpx_dgpu_power_cntl(void);
+-#else
+-static inline bool amdgpu_has_atpx_dgpu_power_cntl(void) { return false; }
+-#endif
+-
+ bool amdgpu_device_is_px(struct drm_device *dev)
+ {
+ 	struct amdgpu_device *adev = dev->dev_private;
+@@ -1517,7 +1511,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
+ 
+ 	if (amdgpu_runtime_pm == 1)
+ 		runtime = true;
+-	if (amdgpu_device_is_px(ddev) && amdgpu_has_atpx_dgpu_power_cntl())
++	if (amdgpu_device_is_px(ddev))
+ 		runtime = true;
+ 	vga_switcheroo_register_client(adev->pdev, &amdgpu_switcheroo_ops, runtime);
+ 	if (runtime)
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index e23843f4d877..4488e82f87b0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -303,7 +303,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
+ 			fw_info.feature = adev->vce.fb_version;
+ 			break;
+ 		case AMDGPU_INFO_FW_UVD:
+-			fw_info.ver = 0;
++			fw_info.ver = adev->uvd.fw_version;
+ 			fw_info.feature = 0;
+ 			break;
+ 		case AMDGPU_INFO_FW_GMC:
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
+index fdc1be8550da..3b2d75d96ea0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
+@@ -53,7 +53,7 @@ struct amdgpu_hpd;
+ 
+ #define AMDGPU_MAX_HPD_PINS 6
+ #define AMDGPU_MAX_CRTCS 6
+-#define AMDGPU_MAX_AFMT_BLOCKS 7
++#define AMDGPU_MAX_AFMT_BLOCKS 9
+ 
+ enum amdgpu_rmx_type {
+ 	RMX_OFF,
+@@ -309,8 +309,8 @@ struct amdgpu_mode_info {
+ 	struct atom_context *atom_context;
+ 	struct card_info *atom_card_info;
+ 	bool mode_config_initialized;
+-	struct amdgpu_crtc *crtcs[6];
+-	struct amdgpu_afmt *afmt[7];
++	struct amdgpu_crtc *crtcs[AMDGPU_MAX_CRTCS];
++	struct amdgpu_afmt *afmt[AMDGPU_MAX_AFMT_BLOCKS];
+ 	/* DVI-I properties */
+ 	struct drm_property *coherent_mode_property;
+ 	/* DAC enable load detect */
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+index 53f987aeeacf..3b35ad83867c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+@@ -156,6 +156,9 @@ int amdgpu_uvd_sw_init(struct amdgpu_device *adev)
+ 	DRM_INFO("Found UVD firmware Version: %hu.%hu Family ID: %hu\n",
+ 		version_major, version_minor, family_id);
+ 
++	adev->uvd.fw_version = ((version_major << 24) | (version_minor << 16) |
++				(family_id << 8));
++
+ 	bo_size = AMDGPU_GPU_PAGE_ALIGN(le32_to_cpu(hdr->ucode_size_bytes) + 8)
+ 		 +  AMDGPU_UVD_STACK_SIZE + AMDGPU_UVD_HEAP_SIZE;
+ 	r = amdgpu_bo_create(adev, bo_size, PAGE_SIZE, true,
+@@ -273,6 +276,8 @@ int amdgpu_uvd_resume(struct amdgpu_device *adev)
+ 	memcpy(adev->uvd.cpu_addr, (adev->uvd.fw->data) + offset,
+ 		(adev->uvd.fw->size) - offset);
+ 
++	cancel_delayed_work_sync(&adev->uvd.idle_work);
++
+ 	size = amdgpu_bo_size(adev->uvd.vcpu_bo);
+ 	size -= le32_to_cpu(hdr->ucode_size_bytes);
+ 	ptr = adev->uvd.cpu_addr;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+index a745eeeb5d82..bb0da76051a1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+@@ -220,6 +220,7 @@ int amdgpu_vce_suspend(struct amdgpu_device *adev)
+ 	if (i == AMDGPU_MAX_VCE_HANDLES)
+ 		return 0;
+ 
++	cancel_delayed_work_sync(&adev->vce.idle_work);
+ 	/* TODO: suspending running encoding sessions isn't supported */
+ 	return -EINVAL;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+index 06602df707f8..9b1c43005c80 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+@@ -3628,7 +3628,7 @@ static void gfx_v7_0_ring_emit_vm_flush(struct amdgpu_ring *ring,
+ 					unsigned vm_id, uint64_t pd_addr)
+ {
+ 	int usepfp = (ring->type == AMDGPU_RING_TYPE_GFX);
+-	uint32_t seq = ring->fence_drv.sync_seq;
++	uint32_t seq = ring->fence_drv.sync_seq[ring->idx];
+ 	uint64_t addr = ring->fence_drv.gpu_addr;
+ 
+ 	amdgpu_ring_write(ring, PACKET3(PACKET3_WAIT_REG_MEM, 5));
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c b/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c
+index c34c393e9aea..d5e19b5fbbfb 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_dbgdev.c
+@@ -513,7 +513,7 @@ static int dbgdev_wave_control_set_registers(
+ 				union SQ_CMD_BITS *in_reg_sq_cmd,
+ 				union GRBM_GFX_INDEX_BITS *in_reg_gfx_index)
+ {
+-	int status;
++	int status = 0;
+ 	union SQ_CMD_BITS reg_sq_cmd;
+ 	union GRBM_GFX_INDEX_BITS reg_gfx_index;
+ 	struct HsaDbgWaveMsgAMDGen2 *pMsg;
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 27fbd79d0daf..71ea0521ea96 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1672,13 +1672,19 @@ static int drm_dp_payload_send_msg(struct drm_dp_mst_topology_mgr *mgr,
+ 	u8 sinks[DRM_DP_MAX_SDP_STREAMS];
+ 	int i;
+ 
++	port = drm_dp_get_validated_port_ref(mgr, port);
++	if (!port)
++		return -EINVAL;
++
+ 	port_num = port->port_num;
+ 	mstb = drm_dp_get_validated_mstb_ref(mgr, port->parent);
+ 	if (!mstb) {
+ 		mstb = drm_dp_get_last_connected_port_and_mstb(mgr, port->parent, &port_num);
+ 
+-		if (!mstb)
++		if (!mstb) {
++			drm_dp_put_port(port);
+ 			return -EINVAL;
++		}
+ 	}
+ 
+ 	txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL);
+@@ -1707,6 +1713,7 @@ static int drm_dp_payload_send_msg(struct drm_dp_mst_topology_mgr *mgr,
+ 	kfree(txmsg);
+ fail_put:
+ 	drm_dp_put_mst_branch_device(mstb);
++	drm_dp_put_port(port);
+ 	return ret;
+ }
+ 
+@@ -1789,6 +1796,11 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr)
+ 		req_payload.start_slot = cur_slots;
+ 		if (mgr->proposed_vcpis[i]) {
+ 			port = container_of(mgr->proposed_vcpis[i], struct drm_dp_mst_port, vcpi);
++			port = drm_dp_get_validated_port_ref(mgr, port);
++			if (!port) {
++				mutex_unlock(&mgr->payload_lock);
++				return -EINVAL;
++			}
+ 			req_payload.num_slots = mgr->proposed_vcpis[i]->num_slots;
+ 			req_payload.vcpi = mgr->proposed_vcpis[i]->vcpi;
+ 		} else {
+@@ -1816,6 +1828,9 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr)
+ 			mgr->payloads[i].payload_state = req_payload.payload_state;
+ 		}
+ 		cur_slots += req_payload.num_slots;
++
++		if (port)
++			drm_dp_put_port(port);
+ 	}
+ 
+ 	for (i = 0; i < mgr->max_payloads; i++) {
+@@ -2121,6 +2136,8 @@ int drm_dp_mst_topology_mgr_resume(struct drm_dp_mst_topology_mgr *mgr)
+ 
+ 	if (mgr->mst_primary) {
+ 		int sret;
++		u8 guid[16];
++
+ 		sret = drm_dp_dpcd_read(mgr->aux, DP_DPCD_REV, mgr->dpcd, DP_RECEIVER_CAP_SIZE);
+ 		if (sret != DP_RECEIVER_CAP_SIZE) {
+ 			DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n");
+@@ -2135,6 +2152,16 @@ int drm_dp_mst_topology_mgr_resume(struct drm_dp_mst_topology_mgr *mgr)
+ 			ret = -1;
+ 			goto out_unlock;
+ 		}
++
++		/* Some hubs forget their guids after they resume */
++		sret = drm_dp_dpcd_read(mgr->aux, DP_GUID, guid, 16);
++		if (sret != 16) {
++			DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n");
++			ret = -1;
++			goto out_unlock;
++		}
++		drm_dp_check_mstb_guid(mgr->mst_primary, guid);
++
+ 		ret = 0;
+ 	} else
+ 		ret = -1;
+diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
+index 647d85e77c2f..597cfb5ca847 100644
+--- a/drivers/gpu/drm/i915/intel_csr.c
++++ b/drivers/gpu/drm/i915/intel_csr.c
+@@ -177,7 +177,8 @@ static const struct stepping_info kbl_stepping_info[] = {
+ static const struct stepping_info skl_stepping_info[] = {
+ 	{'A', '0'}, {'B', '0'}, {'C', '0'},
+ 	{'D', '0'}, {'E', '0'}, {'F', '0'},
+-	{'G', '0'}, {'H', '0'}, {'I', '0'}
++	{'G', '0'}, {'H', '0'}, {'I', '0'},
++	{'J', '0'}, {'K', '0'}
+ };
+ 
+ static const struct stepping_info bxt_stepping_info[] = {
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 46947fffd599..a9c35134f2e2 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4455,7 +4455,7 @@ int skl_update_scaler_crtc(struct intel_crtc_state *state)
+ 		      intel_crtc->base.base.id, intel_crtc->pipe, SKL_CRTC_INDEX);
+ 
+ 	return skl_update_scaler(state, !state->base.active, SKL_CRTC_INDEX,
+-		&state->scaler_state.scaler_id, DRM_ROTATE_0,
++		&state->scaler_state.scaler_id, BIT(DRM_ROTATE_0),
+ 		state->pipe_src_w, state->pipe_src_h,
+ 		adjusted_mode->crtc_hdisplay, adjusted_mode->crtc_vdisplay);
+ }
+diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
+index fa0dabf578dc..db6361b5a6ab 100644
+--- a/drivers/gpu/drm/i915/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/intel_dp_mst.c
+@@ -184,7 +184,7 @@ static void intel_mst_pre_enable_dp(struct intel_encoder *encoder)
+ 	intel_mst->port = found->port;
+ 
+ 	if (intel_dp->active_mst_links == 0) {
+-		intel_ddi_clk_select(encoder, intel_crtc->config);
++		intel_ddi_clk_select(&intel_dig_port->base, intel_crtc->config);
+ 
+ 		intel_dp_set_link_params(intel_dp, intel_crtc->config);
+ 
+@@ -499,6 +499,8 @@ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ 	struct intel_connector *intel_connector = to_intel_connector(connector);
+ 	struct drm_device *dev = connector->dev;
+ 
++	intel_connector->unregister(intel_connector);
++
+ 	/* need to nuke the connector */
+ 	drm_modeset_lock_all(dev);
+ 	if (connector->state->crtc) {
+@@ -512,11 +514,7 @@ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ 
+ 		WARN(ret, "Disabling mst crtc failed with %i\n", ret);
+ 	}
+-	drm_modeset_unlock_all(dev);
+ 
+-	intel_connector->unregister(intel_connector);
+-
+-	drm_modeset_lock_all(dev);
+ 	intel_connector_remove_from_fbdev(intel_connector);
+ 	drm_connector_cleanup(connector);
+ 	drm_modeset_unlock_all(dev);
+diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
+index f1fa756c5d5d..cfd5f9fff2f4 100644
+--- a/drivers/gpu/drm/i915/intel_lrc.c
++++ b/drivers/gpu/drm/i915/intel_lrc.c
+@@ -781,11 +781,11 @@ static int logical_ring_prepare(struct drm_i915_gem_request *req, int bytes)
+ 		if (unlikely(total_bytes > remain_usable)) {
+ 			/*
+ 			 * The base request will fit but the reserved space
+-			 * falls off the end. So only need to to wait for the
+-			 * reserved size after flushing out the remainder.
++			 * falls off the end. So don't need an immediate wrap
++			 * and only need to effectively wait for the reserved
++			 * size space from the start of ringbuffer.
+ 			 */
+ 			wait_bytes = remain_actual + ringbuf->reserved_size;
+-			need_wrap = true;
+ 		} else if (total_bytes > ringbuf->space) {
+ 			/* No wrapping required, just waiting. */
+ 			wait_bytes = total_bytes;
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index b28c29f20e75..7e4a9842b9ea 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2281,6 +2281,7 @@ static int ilk_compute_pipe_wm(struct intel_crtc *intel_crtc,
+ 		return PTR_ERR(cstate);
+ 
+ 	pipe_wm = &cstate->wm.optimal.ilk;
++	memset(pipe_wm, 0, sizeof(*pipe_wm));
+ 
+ 	for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
+ 		ps = drm_atomic_get_plane_state(state,
+@@ -3606,23 +3607,43 @@ static void skl_update_wm(struct drm_crtc *crtc)
+ 	dev_priv->wm.skl_hw = *results;
+ }
+ 
++static void ilk_compute_wm_config(struct drm_device *dev,
++				  struct intel_wm_config *config)
++{
++	struct intel_crtc *crtc;
++
++	/* Compute the currently _active_ config */
++	for_each_intel_crtc(dev, crtc) {
++		const struct intel_pipe_wm *wm = &crtc->wm.active.ilk;
++
++		if (!wm->pipe_enabled)
++			continue;
++
++		config->sprites_enabled |= wm->sprites_enabled;
++		config->sprites_scaled |= wm->sprites_scaled;
++		config->num_pipes_active++;
++	}
++}
++
+ static void ilk_program_watermarks(struct drm_i915_private *dev_priv)
+ {
+ 	struct drm_device *dev = dev_priv->dev;
+ 	struct intel_pipe_wm lp_wm_1_2 = {}, lp_wm_5_6 = {}, *best_lp_wm;
+ 	struct ilk_wm_maximums max;
+-	struct intel_wm_config *config = &dev_priv->wm.config;
++	struct intel_wm_config config = {};
+ 	struct ilk_wm_values results = {};
+ 	enum intel_ddb_partitioning partitioning;
+ 
+-	ilk_compute_wm_maximums(dev, 1, config, INTEL_DDB_PART_1_2, &max);
+-	ilk_wm_merge(dev, config, &max, &lp_wm_1_2);
++	ilk_compute_wm_config(dev, &config);
++
++	ilk_compute_wm_maximums(dev, 1, &config, INTEL_DDB_PART_1_2, &max);
++	ilk_wm_merge(dev, &config, &max, &lp_wm_1_2);
+ 
+ 	/* 5/6 split only in single pipe config on IVB+ */
+ 	if (INTEL_INFO(dev)->gen >= 7 &&
+-	    config->num_pipes_active == 1 && config->sprites_enabled) {
+-		ilk_compute_wm_maximums(dev, 1, config, INTEL_DDB_PART_5_6, &max);
+-		ilk_wm_merge(dev, config, &max, &lp_wm_5_6);
++	    config.num_pipes_active == 1 && config.sprites_enabled) {
++		ilk_compute_wm_maximums(dev, 1, &config, INTEL_DDB_PART_5_6, &max);
++		ilk_wm_merge(dev, &config, &max, &lp_wm_5_6);
+ 
+ 		best_lp_wm = ilk_find_best_result(dev, &lp_wm_1_2, &lp_wm_5_6);
+ 	} else {
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index 40c6aff57256..549afa7bc75f 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -951,7 +951,7 @@ static int gen9_init_workarounds(struct intel_engine_cs *ring)
+ 
+ 	/* WaForceContextSaveRestoreNonCoherent:skl,bxt */
+ 	tmp = HDC_FORCE_CONTEXT_SAVE_RESTORE_NON_COHERENT;
+-	if (IS_SKL_REVID(dev, SKL_REVID_F0, SKL_REVID_F0) ||
++	if (IS_SKL_REVID(dev, SKL_REVID_F0, REVID_FOREVER) ||
+ 	    IS_BXT_REVID(dev, BXT_REVID_B0, REVID_FOREVER))
+ 		tmp |= HDC_FORCE_CSR_NON_COHERENT_OVR_DISABLE;
+ 	WA_SET_BIT_MASKED(HDC_CHICKEN0, tmp);
+@@ -1044,7 +1044,8 @@ static int skl_init_workarounds(struct intel_engine_cs *ring)
+ 		WA_SET_BIT_MASKED(HIZ_CHICKEN,
+ 				  BDW_HIZ_POWER_COMPILER_CLOCK_GATING_DISABLE);
+ 
+-	if (IS_SKL_REVID(dev, 0, SKL_REVID_F0)) {
++	/* This is tied to WaForceContextSaveRestoreNonCoherent */
++	if (IS_SKL_REVID(dev, 0, REVID_FOREVER)) {
+ 		/*
+ 		 *Use Force Non-Coherent whenever executing a 3D context. This
+ 		 * is a workaround for a possible hang in the unlikely event
+@@ -1901,6 +1902,17 @@ i915_dispatch_execbuffer(struct drm_i915_gem_request *req,
+ 	return 0;
+ }
+ 
++static void cleanup_phys_status_page(struct intel_engine_cs *ring)
++{
++	struct drm_i915_private *dev_priv = to_i915(ring->dev);
++
++	if (!dev_priv->status_page_dmah)
++		return;
++
++	drm_pci_free(ring->dev, dev_priv->status_page_dmah);
++	ring->status_page.page_addr = NULL;
++}
++
+ static void cleanup_status_page(struct intel_engine_cs *ring)
+ {
+ 	struct drm_i915_gem_object *obj;
+@@ -1917,9 +1929,9 @@ static void cleanup_status_page(struct intel_engine_cs *ring)
+ 
+ static int init_status_page(struct intel_engine_cs *ring)
+ {
+-	struct drm_i915_gem_object *obj;
++	struct drm_i915_gem_object *obj = ring->status_page.obj;
+ 
+-	if ((obj = ring->status_page.obj) == NULL) {
++	if (obj == NULL) {
+ 		unsigned flags;
+ 		int ret;
+ 
+@@ -2019,10 +2031,12 @@ int intel_pin_and_map_ringbuffer_obj(struct drm_device *dev,
+ {
+ 	struct drm_i915_private *dev_priv = to_i915(dev);
+ 	struct drm_i915_gem_object *obj = ringbuf->obj;
++	/* Ring wraparound at offset 0 sometimes hangs. No idea why. */
++	unsigned flags = PIN_OFFSET_BIAS | 4096;
+ 	int ret;
+ 
+ 	if (HAS_LLC(dev_priv) && !obj->stolen) {
+-		ret = i915_gem_obj_ggtt_pin(obj, PAGE_SIZE, 0);
++		ret = i915_gem_obj_ggtt_pin(obj, PAGE_SIZE, flags);
+ 		if (ret)
+ 			return ret;
+ 
+@@ -2038,7 +2052,8 @@ int intel_pin_and_map_ringbuffer_obj(struct drm_device *dev,
+ 			return -ENOMEM;
+ 		}
+ 	} else {
+-		ret = i915_gem_obj_ggtt_pin(obj, PAGE_SIZE, PIN_MAPPABLE);
++		ret = i915_gem_obj_ggtt_pin(obj, PAGE_SIZE,
++					    flags | PIN_MAPPABLE);
+ 		if (ret)
+ 			return ret;
+ 
+@@ -2164,7 +2179,7 @@ static int intel_init_ring_buffer(struct drm_device *dev,
+ 		if (ret)
+ 			goto error;
+ 	} else {
+-		BUG_ON(ring->id != RCS);
++		WARN_ON(ring->id != RCS);
+ 		ret = init_phys_status_page(ring);
+ 		if (ret)
+ 			goto error;
+@@ -2210,7 +2225,12 @@ void intel_cleanup_ring_buffer(struct intel_engine_cs *ring)
+ 	if (ring->cleanup)
+ 		ring->cleanup(ring);
+ 
+-	cleanup_status_page(ring);
++	if (I915_NEED_GFX_HWS(ring->dev)) {
++		cleanup_status_page(ring);
++	} else {
++		WARN_ON(ring->id != RCS);
++		cleanup_phys_status_page(ring);
++	}
+ 
+ 	i915_cmd_parser_fini_ring(ring);
+ 	i915_gem_batch_pool_fini(&ring->batch_pool);
+@@ -2373,11 +2393,11 @@ static int __intel_ring_prepare(struct intel_engine_cs *ring, int bytes)
+ 		if (unlikely(total_bytes > remain_usable)) {
+ 			/*
+ 			 * The base request will fit but the reserved space
+-			 * falls off the end. So only need to to wait for the
+-			 * reserved size after flushing out the remainder.
++			 * falls off the end. So don't need an immediate wrap
++			 * and only need to effectively wait for the reserved
++			 * size space from the start of ringbuffer.
+ 			 */
+ 			wait_bytes = remain_actual + ringbuf->reserved_size;
+-			need_wrap = true;
+ 		} else if (total_bytes > ringbuf->space) {
+ 			/* No wrapping required, just waiting. */
+ 			wait_bytes = total_bytes;
+diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
+index 277e60ae0e47..08961f7d151c 100644
+--- a/drivers/gpu/drm/i915/intel_uncore.c
++++ b/drivers/gpu/drm/i915/intel_uncore.c
+@@ -1155,7 +1155,11 @@ static void intel_uncore_fw_domains_init(struct drm_device *dev)
+ 	} else if (IS_HASWELL(dev) || IS_BROADWELL(dev)) {
+ 		dev_priv->uncore.funcs.force_wake_get =
+ 			fw_domains_get_with_thread_status;
+-		dev_priv->uncore.funcs.force_wake_put = fw_domains_put;
++		if (IS_HASWELL(dev))
++			dev_priv->uncore.funcs.force_wake_put =
++				fw_domains_put_with_fifo;
++		else
++			dev_priv->uncore.funcs.force_wake_put = fw_domains_put;
+ 		fw_domain_init(dev_priv, FW_DOMAIN_ID_RENDER,
+ 			       FORCEWAKE_MT, FORCEWAKE_ACK_HSW);
+ 	} else if (IS_IVYBRIDGE(dev)) {
+diff --git a/drivers/gpu/drm/nouveau/nvkm/core/ramht.c b/drivers/gpu/drm/nouveau/nvkm/core/ramht.c
+index 3216e157a8a0..89da47234016 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/core/ramht.c
++++ b/drivers/gpu/drm/nouveau/nvkm/core/ramht.c
+@@ -131,7 +131,7 @@ nvkm_ramht_del(struct nvkm_ramht **pramht)
+ 	struct nvkm_ramht *ramht = *pramht;
+ 	if (ramht) {
+ 		nvkm_gpuobj_del(&ramht->gpuobj);
+-		kfree(*pramht);
++		vfree(*pramht);
+ 		*pramht = NULL;
+ 	}
+ }
+@@ -143,8 +143,8 @@ nvkm_ramht_new(struct nvkm_device *device, u32 size, u32 align,
+ 	struct nvkm_ramht *ramht;
+ 	int ret, i;
+ 
+-	if (!(ramht = *pramht = kzalloc(sizeof(*ramht) + (size >> 3) *
+-					sizeof(*ramht->data), GFP_KERNEL)))
++	if (!(ramht = *pramht = vzalloc(sizeof(*ramht) +
++					(size >> 3) * sizeof(*ramht->data))))
+ 		return -ENOMEM;
+ 
+ 	ramht->device = device;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+index 1f81069edc58..332b5fe687fe 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+@@ -1807,6 +1807,8 @@ gf100_gr_init(struct gf100_gr *gr)
+ 
+ 	gf100_gr_mmio(gr, gr->func->mmio);
+ 
++	nvkm_mask(device, TPC_UNIT(0, 0, 0x05c), 0x00000001, 0x00000001);
++
+ 	memcpy(tpcnr, gr->tpc_nr, sizeof(gr->tpc_nr));
+ 	for (i = 0, gpc = -1; i < gr->tpc_total; i++) {
+ 		do {
+diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
+index 86276519b2ef..47e52647c9e5 100644
+--- a/drivers/gpu/drm/qxl/qxl_display.c
++++ b/drivers/gpu/drm/qxl/qxl_display.c
+@@ -375,10 +375,15 @@ static int qxl_crtc_cursor_set2(struct drm_crtc *crtc,
+ 
+ 	qxl_bo_kunmap(user_bo);
+ 
++	qcrtc->cur_x += qcrtc->hot_spot_x - hot_x;
++	qcrtc->cur_y += qcrtc->hot_spot_y - hot_y;
++	qcrtc->hot_spot_x = hot_x;
++	qcrtc->hot_spot_y = hot_y;
++
+ 	cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release);
+ 	cmd->type = QXL_CURSOR_SET;
+-	cmd->u.set.position.x = qcrtc->cur_x;
+-	cmd->u.set.position.y = qcrtc->cur_y;
++	cmd->u.set.position.x = qcrtc->cur_x + qcrtc->hot_spot_x;
++	cmd->u.set.position.y = qcrtc->cur_y + qcrtc->hot_spot_y;
+ 
+ 	cmd->u.set.shape = qxl_bo_physical_address(qdev, cursor_bo, 0);
+ 
+@@ -441,8 +446,8 @@ static int qxl_crtc_cursor_move(struct drm_crtc *crtc,
+ 
+ 	cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release);
+ 	cmd->type = QXL_CURSOR_MOVE;
+-	cmd->u.position.x = qcrtc->cur_x;
+-	cmd->u.position.y = qcrtc->cur_y;
++	cmd->u.position.x = qcrtc->cur_x + qcrtc->hot_spot_x;
++	cmd->u.position.y = qcrtc->cur_y + qcrtc->hot_spot_y;
+ 	qxl_release_unmap(qdev, release, &cmd->release_info);
+ 
+ 	qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
+diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
+index 6e6b9b1519b8..3f3897eb458c 100644
+--- a/drivers/gpu/drm/qxl/qxl_drv.h
++++ b/drivers/gpu/drm/qxl/qxl_drv.h
+@@ -135,6 +135,8 @@ struct qxl_crtc {
+ 	int index;
+ 	int cur_x;
+ 	int cur_y;
++	int hot_spot_x;
++	int hot_spot_y;
+ };
+ 
+ struct qxl_output {
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index 2ad462896896..32491355a1d4 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -2608,10 +2608,152 @@ static void evergreen_agp_enable(struct radeon_device *rdev)
+ 	WREG32(VM_CONTEXT1_CNTL, 0);
+ }
+ 
++static const unsigned ni_dig_offsets[] =
++{
++	NI_DIG0_REGISTER_OFFSET,
++	NI_DIG1_REGISTER_OFFSET,
++	NI_DIG2_REGISTER_OFFSET,
++	NI_DIG3_REGISTER_OFFSET,
++	NI_DIG4_REGISTER_OFFSET,
++	NI_DIG5_REGISTER_OFFSET
++};
++
++static const unsigned ni_tx_offsets[] =
++{
++	NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1,
++	NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1,
++	NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1,
++	NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1,
++	NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1,
++	NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1
++};
++
++static const unsigned evergreen_dp_offsets[] =
++{
++	EVERGREEN_DP0_REGISTER_OFFSET,
++	EVERGREEN_DP1_REGISTER_OFFSET,
++	EVERGREEN_DP2_REGISTER_OFFSET,
++	EVERGREEN_DP3_REGISTER_OFFSET,
++	EVERGREEN_DP4_REGISTER_OFFSET,
++	EVERGREEN_DP5_REGISTER_OFFSET
++};
++
++
++/*
++ * Assumption is that EVERGREEN_CRTC_MASTER_EN enable for requested crtc
++ * We go from crtc to connector and it is not relible  since it
++ * should be an opposite direction .If crtc is enable then
++ * find the dig_fe which selects this crtc and insure that it enable.
++ * if such dig_fe is found then find dig_be which selects found dig_be and
++ * insure that it enable and in DP_SST mode.
++ * if UNIPHY_PLL_CONTROL1.enable then we should disconnect timing
++ * from dp symbols clocks .
++ */
++static bool evergreen_is_dp_sst_stream_enabled(struct radeon_device *rdev,
++					       unsigned crtc_id, unsigned *ret_dig_fe)
++{
++	unsigned i;
++	unsigned dig_fe;
++	unsigned dig_be;
++	unsigned dig_en_be;
++	unsigned uniphy_pll;
++	unsigned digs_fe_selected;
++	unsigned dig_be_mode;
++	unsigned dig_fe_mask;
++	bool is_enabled = false;
++	bool found_crtc = false;
++
++	/* loop through all running dig_fe to find selected crtc */
++	for (i = 0; i < ARRAY_SIZE(ni_dig_offsets); i++) {
++		dig_fe = RREG32(NI_DIG_FE_CNTL + ni_dig_offsets[i]);
++		if (dig_fe & NI_DIG_FE_CNTL_SYMCLK_FE_ON &&
++		    crtc_id == NI_DIG_FE_CNTL_SOURCE_SELECT(dig_fe)) {
++			/* found running pipe */
++			found_crtc = true;
++			dig_fe_mask = 1 << i;
++			dig_fe = i;
++			break;
++		}
++	}
++
++	if (found_crtc) {
++		/* loop through all running dig_be to find selected dig_fe */
++		for (i = 0; i < ARRAY_SIZE(ni_dig_offsets); i++) {
++			dig_be = RREG32(NI_DIG_BE_CNTL + ni_dig_offsets[i]);
++			/* if dig_fe_selected by dig_be? */
++			digs_fe_selected = NI_DIG_BE_CNTL_FE_SOURCE_SELECT(dig_be);
++			dig_be_mode = NI_DIG_FE_CNTL_MODE(dig_be);
++			if (dig_fe_mask &  digs_fe_selected &&
++			    /* if dig_be in sst mode? */
++			    dig_be_mode == NI_DIG_BE_DPSST) {
++				dig_en_be = RREG32(NI_DIG_BE_EN_CNTL +
++						   ni_dig_offsets[i]);
++				uniphy_pll = RREG32(NI_DCIO_UNIPHY0_PLL_CONTROL1 +
++						    ni_tx_offsets[i]);
++				/* dig_be enable and tx is running */
++				if (dig_en_be & NI_DIG_BE_EN_CNTL_ENABLE &&
++				    dig_en_be & NI_DIG_BE_EN_CNTL_SYMBCLK_ON &&
++				    uniphy_pll & NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE) {
++					is_enabled = true;
++					*ret_dig_fe = dig_fe;
++					break;
++				}
++			}
++		}
++	}
++
++	return is_enabled;
++}
++
++/*
++ * Blank dig when in dp sst mode
++ * Dig ignores crtc timing
++ */
++static void evergreen_blank_dp_output(struct radeon_device *rdev,
++				      unsigned dig_fe)
++{
++	unsigned stream_ctrl;
++	unsigned fifo_ctrl;
++	unsigned counter = 0;
++
++	if (dig_fe >= ARRAY_SIZE(evergreen_dp_offsets)) {
++		DRM_ERROR("invalid dig_fe %d\n", dig_fe);
++		return;
++	}
++
++	stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
++			     evergreen_dp_offsets[dig_fe]);
++	if (!(stream_ctrl & EVERGREEN_DP_VID_STREAM_CNTL_ENABLE)) {
++		DRM_ERROR("dig %d , should be enable\n", dig_fe);
++		return;
++	}
++
++	stream_ctrl &=~EVERGREEN_DP_VID_STREAM_CNTL_ENABLE;
++	WREG32(EVERGREEN_DP_VID_STREAM_CNTL +
++	       evergreen_dp_offsets[dig_fe], stream_ctrl);
++
++	stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
++			     evergreen_dp_offsets[dig_fe]);
++	while (counter < 32 && stream_ctrl & EVERGREEN_DP_VID_STREAM_STATUS) {
++		msleep(1);
++		counter++;
++		stream_ctrl = RREG32(EVERGREEN_DP_VID_STREAM_CNTL +
++				     evergreen_dp_offsets[dig_fe]);
++	}
++	if (counter >= 32 )
++		DRM_ERROR("counter exceeds %d\n", counter);
++
++	fifo_ctrl = RREG32(EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe]);
++	fifo_ctrl |= EVERGREEN_DP_STEER_FIFO_RESET;
++	WREG32(EVERGREEN_DP_STEER_FIFO + evergreen_dp_offsets[dig_fe], fifo_ctrl);
++
++}
++
+ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *save)
+ {
+ 	u32 crtc_enabled, tmp, frame_count, blackout;
+ 	int i, j;
++	unsigned dig_fe;
+ 
+ 	if (!ASIC_IS_NODCE(rdev)) {
+ 		save->vga_render_control = RREG32(VGA_RENDER_CONTROL);
+@@ -2651,7 +2793,17 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
+ 					break;
+ 				udelay(1);
+ 			}
+-
++			/*we should disable dig if it drives dp sst*/
++			/*but we are in radeon_device_init and the topology is unknown*/
++			/*and it is available after radeon_modeset_init*/
++			/*the following method radeon_atom_encoder_dpms_dig*/
++			/*does the job if we initialize it properly*/
++			/*for now we do it this manually*/
++			/**/
++			if (ASIC_IS_DCE5(rdev) &&
++			    evergreen_is_dp_sst_stream_enabled(rdev, i ,&dig_fe))
++				evergreen_blank_dp_output(rdev, dig_fe);
++			/*we could remove 6 lines below*/
+ 			/* XXX this is a hack to avoid strange behavior with EFI on certain systems */
+ 			WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
+ 			tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
+diff --git a/drivers/gpu/drm/radeon/evergreen_reg.h b/drivers/gpu/drm/radeon/evergreen_reg.h
+index aa939dfed3a3..b436badf9efa 100644
+--- a/drivers/gpu/drm/radeon/evergreen_reg.h
++++ b/drivers/gpu/drm/radeon/evergreen_reg.h
+@@ -250,8 +250,43 @@
+ 
+ /* HDMI blocks at 0x7030, 0x7c30, 0x10830, 0x11430, 0x12030, 0x12c30 */
+ #define EVERGREEN_HDMI_BASE				0x7030
++/*DIG block*/
++#define NI_DIG0_REGISTER_OFFSET                 (0x7000  - 0x7000)
++#define NI_DIG1_REGISTER_OFFSET                 (0x7C00  - 0x7000)
++#define NI_DIG2_REGISTER_OFFSET                 (0x10800 - 0x7000)
++#define NI_DIG3_REGISTER_OFFSET                 (0x11400 - 0x7000)
++#define NI_DIG4_REGISTER_OFFSET                 (0x12000 - 0x7000)
++#define NI_DIG5_REGISTER_OFFSET                 (0x12C00 - 0x7000)
++
++
++#define NI_DIG_FE_CNTL                               0x7000
++#       define NI_DIG_FE_CNTL_SOURCE_SELECT(x)        ((x) & 0x3)
++#       define NI_DIG_FE_CNTL_SYMCLK_FE_ON            (1<<24)
++
++
++#define NI_DIG_BE_CNTL                    0x7140
++#       define NI_DIG_BE_CNTL_FE_SOURCE_SELECT(x)     (((x) >> 8 ) & 0x3F)
++#       define NI_DIG_FE_CNTL_MODE(x)                 (((x) >> 16) & 0x7 )
++
++#define NI_DIG_BE_EN_CNTL                              0x7144
++#       define NI_DIG_BE_EN_CNTL_ENABLE               (1 << 0)
++#       define NI_DIG_BE_EN_CNTL_SYMBCLK_ON           (1 << 8)
++#       define NI_DIG_BE_DPSST 0
+ 
+ /* Display Port block */
++#define EVERGREEN_DP0_REGISTER_OFFSET                 (0x730C  - 0x730C)
++#define EVERGREEN_DP1_REGISTER_OFFSET                 (0x7F0C  - 0x730C)
++#define EVERGREEN_DP2_REGISTER_OFFSET                 (0x10B0C - 0x730C)
++#define EVERGREEN_DP3_REGISTER_OFFSET                 (0x1170C - 0x730C)
++#define EVERGREEN_DP4_REGISTER_OFFSET                 (0x1230C - 0x730C)
++#define EVERGREEN_DP5_REGISTER_OFFSET                 (0x12F0C - 0x730C)
++
++
++#define EVERGREEN_DP_VID_STREAM_CNTL                    0x730C
++#       define EVERGREEN_DP_VID_STREAM_CNTL_ENABLE     (1 << 0)
++#       define EVERGREEN_DP_VID_STREAM_STATUS          (1 <<16)
++#define EVERGREEN_DP_STEER_FIFO                         0x7310
++#       define EVERGREEN_DP_STEER_FIFO_RESET           (1 << 0)
+ #define EVERGREEN_DP_SEC_CNTL                           0x7280
+ #       define EVERGREEN_DP_SEC_STREAM_ENABLE           (1 << 0)
+ #       define EVERGREEN_DP_SEC_ASP_ENABLE              (1 << 4)
+@@ -266,4 +301,15 @@
+ #       define EVERGREEN_DP_SEC_N_BASE_MULTIPLE(x)      (((x) & 0xf) << 24)
+ #       define EVERGREEN_DP_SEC_SS_EN                   (1 << 28)
+ 
++/*DCIO_UNIPHY block*/
++#define NI_DCIO_UNIPHY0_UNIPHY_TX_CONTROL1            (0x6600  -0x6600)
++#define NI_DCIO_UNIPHY1_UNIPHY_TX_CONTROL1            (0x6640  -0x6600)
++#define NI_DCIO_UNIPHY2_UNIPHY_TX_CONTROL1            (0x6680 - 0x6600)
++#define NI_DCIO_UNIPHY3_UNIPHY_TX_CONTROL1            (0x66C0 - 0x6600)
++#define NI_DCIO_UNIPHY4_UNIPHY_TX_CONTROL1            (0x6700 - 0x6600)
++#define NI_DCIO_UNIPHY5_UNIPHY_TX_CONTROL1            (0x6740 - 0x6600)
++
++#define NI_DCIO_UNIPHY0_PLL_CONTROL1                   0x6618
++#       define NI_DCIO_UNIPHY0_PLL_CONTROL1_ENABLE     (1 << 0)
++
+ #endif
+diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+index 9bc408c9f9f6..c4b4f298a283 100644
+--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
++++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+@@ -62,10 +62,6 @@ bool radeon_has_atpx(void) {
+ 	return radeon_atpx_priv.atpx_detected;
+ }
+ 
+-bool radeon_has_atpx_dgpu_power_cntl(void) {
+-	return radeon_atpx_priv.atpx.functions.power_cntl;
+-}
+-
+ /**
+  * radeon_atpx_call - call an ATPX method
+  *
+@@ -145,6 +141,10 @@ static void radeon_atpx_parse_functions(struct radeon_atpx_functions *f, u32 mas
+  */
+ static int radeon_atpx_validate(struct radeon_atpx *atpx)
+ {
++	/* make sure required functions are enabled */
++	/* dGPU power control is required */
++	atpx->functions.power_cntl = true;
++
+ 	if (atpx->functions.px_params) {
+ 		union acpi_object *info;
+ 		struct atpx_px_params output;
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index 340f3f549f29..9cfc1c3e1965 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -1996,10 +1996,12 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 						   rdev->mode_info.dither_property,
+ 						   RADEON_FMT_DITHER_DISABLE);
+ 
+-			if (radeon_audio != 0)
++			if (radeon_audio != 0) {
+ 				drm_object_attach_property(&radeon_connector->base.base,
+ 							   rdev->mode_info.audio_property,
+ 							   RADEON_AUDIO_AUTO);
++				radeon_connector->audio = RADEON_AUDIO_AUTO;
++			}
+ 			if (ASIC_IS_DCE5(rdev))
+ 				drm_object_attach_property(&radeon_connector->base.base,
+ 							   rdev->mode_info.output_csc_property,
+@@ -2124,6 +2126,7 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 				drm_object_attach_property(&radeon_connector->base.base,
+ 							   rdev->mode_info.audio_property,
+ 							   RADEON_AUDIO_AUTO);
++				radeon_connector->audio = RADEON_AUDIO_AUTO;
+ 			}
+ 			if (connector_type == DRM_MODE_CONNECTOR_DVII) {
+ 				radeon_connector->dac_load_detect = true;
+@@ -2179,6 +2182,7 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 				drm_object_attach_property(&radeon_connector->base.base,
+ 							   rdev->mode_info.audio_property,
+ 							   RADEON_AUDIO_AUTO);
++				radeon_connector->audio = RADEON_AUDIO_AUTO;
+ 			}
+ 			if (ASIC_IS_DCE5(rdev))
+ 				drm_object_attach_property(&radeon_connector->base.base,
+@@ -2231,6 +2235,7 @@ radeon_add_atom_connector(struct drm_device *dev,
+ 				drm_object_attach_property(&radeon_connector->base.base,
+ 							   rdev->mode_info.audio_property,
+ 							   RADEON_AUDIO_AUTO);
++				radeon_connector->audio = RADEON_AUDIO_AUTO;
+ 			}
+ 			if (ASIC_IS_DCE5(rdev))
+ 				drm_object_attach_property(&radeon_connector->base.base,
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index e2396336f9e8..4197ca1bb1e4 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -103,12 +103,6 @@ static const char radeon_family_name[][16] = {
+ 	"LAST",
+ };
+ 
+-#if defined(CONFIG_VGA_SWITCHEROO)
+-bool radeon_has_atpx_dgpu_power_cntl(void);
+-#else
+-static inline bool radeon_has_atpx_dgpu_power_cntl(void) { return false; }
+-#endif
+-
+ #define RADEON_PX_QUIRK_DISABLE_PX  (1 << 0)
+ #define RADEON_PX_QUIRK_LONG_WAKEUP (1 << 1)
+ 
+@@ -1439,7 +1433,7 @@ int radeon_device_init(struct radeon_device *rdev,
+ 	 * ignore it */
+ 	vga_client_register(rdev->pdev, rdev, NULL, radeon_vga_set_decode);
+ 
+-	if ((rdev->flags & RADEON_IS_PX) && radeon_has_atpx_dgpu_power_cntl())
++	if (rdev->flags & RADEON_IS_PX)
+ 		runtime = true;
+ 	vga_switcheroo_register_client(rdev->pdev, &radeon_switcheroo_ops, runtime);
+ 	if (runtime)
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index e06ac546a90f..f342aad79cc6 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -235,6 +235,8 @@ static int radeon_verify_access(struct ttm_buffer_object *bo, struct file *filp)
+ {
+ 	struct radeon_bo *rbo = container_of(bo, struct radeon_bo, tbo);
+ 
++	if (radeon_ttm_tt_has_userptr(bo->ttm))
++		return -EPERM;
+ 	return drm_vma_node_verify_access(&rbo->gem_base.vma_node, filp);
+ }
+ 
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index 7285adb27099..caa73de584a5 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2931,6 +2931,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
+ 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 },
+ 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 },
+ 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x148c, 0x2015, 0, 120000 },
++	{ PCI_VENDOR_ID_ATI, 0x6810, 0x1682, 0x9275, 0, 120000 },
+ 	{ 0, 0, 0, 0 },
+ };
+ 
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index 4cbf26555093..e3daafa1be13 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -230,22 +230,13 @@ EXPORT_SYMBOL(ttm_bo_del_sub_from_lru);
+ 
+ void ttm_bo_move_to_lru_tail(struct ttm_buffer_object *bo)
+ {
+-	struct ttm_bo_device *bdev = bo->bdev;
+-	struct ttm_mem_type_manager *man;
++	int put_count = 0;
+ 
+ 	lockdep_assert_held(&bo->resv->lock.base);
+ 
+-	if (bo->mem.placement & TTM_PL_FLAG_NO_EVICT) {
+-		list_del_init(&bo->swap);
+-		list_del_init(&bo->lru);
+-
+-	} else {
+-		if (bo->ttm && !(bo->ttm->page_flags & TTM_PAGE_FLAG_SG))
+-			list_move_tail(&bo->swap, &bo->glob->swap_lru);
+-
+-		man = &bdev->man[bo->mem.mem_type];
+-		list_move_tail(&bo->lru, &man->lru);
+-	}
++	put_count = ttm_bo_del_from_lru(bo);
++	ttm_bo_list_ref_sub(bo, put_count, true);
++	ttm_bo_add_to_lru(bo);
+ }
+ EXPORT_SYMBOL(ttm_bo_move_to_lru_tail);
+ 
+diff --git a/drivers/hwtracing/stm/Kconfig b/drivers/hwtracing/stm/Kconfig
+index 83e9f591a54b..e7a348807f0c 100644
+--- a/drivers/hwtracing/stm/Kconfig
++++ b/drivers/hwtracing/stm/Kconfig
+@@ -1,6 +1,7 @@
+ config STM
+ 	tristate "System Trace Module devices"
+ 	select CONFIGFS_FS
++	select SRCU
+ 	help
+ 	  A System Trace Module (STM) is a device exporting data in System
+ 	  Trace Protocol (STP) format as defined by MIPI STP standards.
+diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
+index 714bdc837769..b167ab25310a 100644
+--- a/drivers/i2c/busses/i2c-cpm.c
++++ b/drivers/i2c/busses/i2c-cpm.c
+@@ -116,8 +116,8 @@ struct cpm_i2c {
+ 	cbd_t __iomem *rbase;
+ 	u_char *txbuf[CPM_MAXBD];
+ 	u_char *rxbuf[CPM_MAXBD];
+-	u32 txdma[CPM_MAXBD];
+-	u32 rxdma[CPM_MAXBD];
++	dma_addr_t txdma[CPM_MAXBD];
++	dma_addr_t rxdma[CPM_MAXBD];
+ };
+ 
+ static irqreturn_t cpm_i2c_interrupt(int irq, void *dev_id)
+diff --git a/drivers/i2c/busses/i2c-exynos5.c b/drivers/i2c/busses/i2c-exynos5.c
+index b29c7500461a..f54ece8fce78 100644
+--- a/drivers/i2c/busses/i2c-exynos5.c
++++ b/drivers/i2c/busses/i2c-exynos5.c
+@@ -671,7 +671,9 @@ static int exynos5_i2c_xfer(struct i2c_adapter *adap,
+ 		return -EIO;
+ 	}
+ 
+-	clk_prepare_enable(i2c->clk);
++	ret = clk_enable(i2c->clk);
++	if (ret)
++		return ret;
+ 
+ 	for (i = 0; i < num; i++, msgs++) {
+ 		stop = (i == num - 1);
+@@ -695,7 +697,7 @@ static int exynos5_i2c_xfer(struct i2c_adapter *adap,
+ 	}
+ 
+  out:
+-	clk_disable_unprepare(i2c->clk);
++	clk_disable(i2c->clk);
+ 	return ret;
+ }
+ 
+@@ -747,7 +749,9 @@ static int exynos5_i2c_probe(struct platform_device *pdev)
+ 		return -ENOENT;
+ 	}
+ 
+-	clk_prepare_enable(i2c->clk);
++	ret = clk_prepare_enable(i2c->clk);
++	if (ret)
++		return ret;
+ 
+ 	mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	i2c->regs = devm_ioremap_resource(&pdev->dev, mem);
+@@ -799,6 +803,10 @@ static int exynos5_i2c_probe(struct platform_device *pdev)
+ 
+ 	platform_set_drvdata(pdev, i2c);
+ 
++	clk_disable(i2c->clk);
++
++	return 0;
++
+  err_clk:
+ 	clk_disable_unprepare(i2c->clk);
+ 	return ret;
+@@ -810,6 +818,8 @@ static int exynos5_i2c_remove(struct platform_device *pdev)
+ 
+ 	i2c_del_adapter(&i2c->adap);
+ 
++	clk_unprepare(i2c->clk);
++
+ 	return 0;
+ }
+ 
+@@ -821,6 +831,8 @@ static int exynos5_i2c_suspend_noirq(struct device *dev)
+ 
+ 	i2c->suspended = 1;
+ 
++	clk_unprepare(i2c->clk);
++
+ 	return 0;
+ }
+ 
+@@ -830,7 +842,9 @@ static int exynos5_i2c_resume_noirq(struct device *dev)
+ 	struct exynos5_i2c *i2c = platform_get_drvdata(pdev);
+ 	int ret = 0;
+ 
+-	clk_prepare_enable(i2c->clk);
++	ret = clk_prepare_enable(i2c->clk);
++	if (ret)
++		return ret;
+ 
+ 	ret = exynos5_hsi2c_clock_setup(i2c);
+ 	if (ret) {
+@@ -839,7 +853,7 @@ static int exynos5_i2c_resume_noirq(struct device *dev)
+ 	}
+ 
+ 	exynos5_i2c_init(i2c);
+-	clk_disable_unprepare(i2c->clk);
++	clk_disable(i2c->clk);
+ 	i2c->suspended = 0;
+ 
+ 	return 0;
+diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
+index 53343ffbff7a..1b109b2a235e 100644
+--- a/drivers/infiniband/core/cache.c
++++ b/drivers/infiniband/core/cache.c
+@@ -691,7 +691,8 @@ void ib_cache_gid_set_default_gid(struct ib_device *ib_dev, u8 port,
+ 			      NULL);
+ 
+ 		/* Coudn't find default GID location */
+-		WARN_ON(ix < 0);
++		if (WARN_ON(ix < 0))
++			goto release;
+ 
+ 		zattr_type.gid_type = gid_type;
+ 
+diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
+index 6b4e8a008bc0..564adf3116e8 100644
+--- a/drivers/infiniband/core/ucm.c
++++ b/drivers/infiniband/core/ucm.c
+@@ -48,6 +48,7 @@
+ 
+ #include <asm/uaccess.h>
+ 
++#include <rdma/ib.h>
+ #include <rdma/ib_cm.h>
+ #include <rdma/ib_user_cm.h>
+ #include <rdma/ib_marshall.h>
+@@ -1103,6 +1104,9 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf,
+ 	struct ib_ucm_cmd_hdr hdr;
+ 	ssize_t result;
+ 
++	if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
++		return -EACCES;
++
+ 	if (len < sizeof(hdr))
+ 		return -EINVAL;
+ 
+diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
+index 8b5a934e1133..886f61ea6cc7 100644
+--- a/drivers/infiniband/core/ucma.c
++++ b/drivers/infiniband/core/ucma.c
+@@ -1574,6 +1574,9 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf,
+ 	struct rdma_ucm_cmd_hdr hdr;
+ 	ssize_t ret;
+ 
++	if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
++		return -EACCES;
++
+ 	if (len < sizeof(hdr))
+ 		return -EINVAL;
+ 
+diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
+index 39680aed99dd..d3fb8aa46c59 100644
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -48,6 +48,8 @@
+ 
+ #include <asm/uaccess.h>
+ 
++#include <rdma/ib.h>
++
+ #include "uverbs.h"
+ 
+ MODULE_AUTHOR("Roland Dreier");
+@@ -693,6 +695,9 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
+ 	int srcu_key;
+ 	ssize_t ret;
+ 
++	if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
++		return -EACCES;
++
+ 	if (count < sizeof hdr)
+ 		return -EINVAL;
+ 
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 03c418ccbc98..ed9cefa1f6f1 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -517,7 +517,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ 		     sizeof(struct mlx5_wqe_ctrl_seg)) /
+ 		     sizeof(struct mlx5_wqe_data_seg);
+ 	props->max_sge = min(max_rq_sg, max_sq_sg);
+-	props->max_sge_rd = props->max_sge;
++	props->max_sge_rd	   = MLX5_MAX_SGE_RD;
+ 	props->max_cq		   = 1 << MLX5_CAP_GEN(mdev, log_max_cq);
+ 	props->max_cqe = (1 << MLX5_CAP_GEN(mdev, log_max_cq_sz)) - 1;
+ 	props->max_mr		   = 1 << MLX5_CAP_GEN(mdev, log_max_mkey);
+diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c
+index e449e394963f..24f4a782e0f4 100644
+--- a/drivers/infiniband/hw/qib/qib_file_ops.c
++++ b/drivers/infiniband/hw/qib/qib_file_ops.c
+@@ -45,6 +45,8 @@
+ #include <linux/export.h>
+ #include <linux/uio.h>
+ 
++#include <rdma/ib.h>
++
+ #include "qib.h"
+ #include "qib_common.h"
+ #include "qib_user_sdma.h"
+@@ -2067,6 +2069,9 @@ static ssize_t qib_write(struct file *fp, const char __user *data,
+ 	ssize_t ret = 0;
+ 	void *dest;
+ 
++	if (WARN_ON_ONCE(!ib_safe_file_access(fp)))
++		return -EACCES;
++
+ 	if (count < sizeof(cmd.type)) {
+ 		ret = -EINVAL;
+ 		goto bail;
+diff --git a/drivers/input/misc/pmic8xxx-pwrkey.c b/drivers/input/misc/pmic8xxx-pwrkey.c
+index 3f02e0e03d12..67aab86048ad 100644
+--- a/drivers/input/misc/pmic8xxx-pwrkey.c
++++ b/drivers/input/misc/pmic8xxx-pwrkey.c
+@@ -353,7 +353,8 @@ static int pmic8xxx_pwrkey_probe(struct platform_device *pdev)
+ 	if (of_property_read_u32(pdev->dev.of_node, "debounce", &kpd_delay))
+ 		kpd_delay = 15625;
+ 
+-	if (kpd_delay > 62500 || kpd_delay == 0) {
++	/* Valid range of pwr key trigger delay is 1/64 sec to 2 seconds. */
++	if (kpd_delay > USEC_PER_SEC * 2 || kpd_delay < USEC_PER_SEC / 64) {
+ 		dev_err(&pdev->dev, "invalid power key trigger delay\n");
+ 		return -EINVAL;
+ 	}
+@@ -385,8 +386,8 @@ static int pmic8xxx_pwrkey_probe(struct platform_device *pdev)
+ 	pwr->name = "pmic8xxx_pwrkey";
+ 	pwr->phys = "pmic8xxx_pwrkey/input0";
+ 
+-	delay = (kpd_delay << 10) / USEC_PER_SEC;
+-	delay = 1 + ilog2(delay);
++	delay = (kpd_delay << 6) / USEC_PER_SEC;
++	delay = ilog2(delay);
+ 
+ 	err = regmap_read(regmap, PON_CNTL_1, &pon_cntl);
+ 	if (err < 0) {
+diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
+index 3a7f3a4a4396..7c18249d6c8e 100644
+--- a/drivers/input/tablet/gtco.c
++++ b/drivers/input/tablet/gtco.c
+@@ -858,6 +858,14 @@ static int gtco_probe(struct usb_interface *usbinterface,
+ 		goto err_free_buf;
+ 	}
+ 
++	/* Sanity check that a device has an endpoint */
++	if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) {
++		dev_err(&usbinterface->dev,
++			"Invalid number of endpoints\n");
++		error = -EINVAL;
++		goto err_free_urb;
++	}
++
+ 	/*
+ 	 * The endpoint is always altsetting 0, we know this since we know
+ 	 * this device only has one interrupt endpoint
+@@ -879,7 +887,7 @@ static int gtco_probe(struct usb_interface *usbinterface,
+ 	 * HID report descriptor
+ 	 */
+ 	if (usb_get_extra_descriptor(usbinterface->cur_altsetting,
+-				     HID_DEVICE_TYPE, &hid_desc) != 0){
++				     HID_DEVICE_TYPE, &hid_desc) != 0) {
+ 		dev_err(&usbinterface->dev,
+ 			"Can't retrieve exta USB descriptor to get hid report descriptor length\n");
+ 		error = -EIO;
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 374c129219ef..5efadad4615b 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -92,6 +92,7 @@ struct iommu_dev_data {
+ 	struct list_head dev_data_list;	  /* For global dev_data_list */
+ 	struct protection_domain *domain; /* Domain the device is bound to */
+ 	u16 devid;			  /* PCI Device ID */
++	u16 alias;			  /* Alias Device ID */
+ 	bool iommu_v2;			  /* Device can make use of IOMMUv2 */
+ 	bool passthrough;		  /* Device is identity mapped */
+ 	struct {
+@@ -166,6 +167,13 @@ static struct protection_domain *to_pdomain(struct iommu_domain *dom)
+ 	return container_of(dom, struct protection_domain, domain);
+ }
+ 
++static inline u16 get_device_id(struct device *dev)
++{
++	struct pci_dev *pdev = to_pci_dev(dev);
++
++	return PCI_DEVID(pdev->bus->number, pdev->devfn);
++}
++
+ static struct iommu_dev_data *alloc_dev_data(u16 devid)
+ {
+ 	struct iommu_dev_data *dev_data;
+@@ -203,6 +211,68 @@ out_unlock:
+ 	return dev_data;
+ }
+ 
++static int __last_alias(struct pci_dev *pdev, u16 alias, void *data)
++{
++	*(u16 *)data = alias;
++	return 0;
++}
++
++static u16 get_alias(struct device *dev)
++{
++	struct pci_dev *pdev = to_pci_dev(dev);
++	u16 devid, ivrs_alias, pci_alias;
++
++	devid = get_device_id(dev);
++	ivrs_alias = amd_iommu_alias_table[devid];
++	pci_for_each_dma_alias(pdev, __last_alias, &pci_alias);
++
++	if (ivrs_alias == pci_alias)
++		return ivrs_alias;
++
++	/*
++	 * DMA alias showdown
++	 *
++	 * The IVRS is fairly reliable in telling us about aliases, but it
++	 * can't know about every screwy device.  If we don't have an IVRS
++	 * reported alias, use the PCI reported alias.  In that case we may
++	 * still need to initialize the rlookup and dev_table entries if the
++	 * alias is to a non-existent device.
++	 */
++	if (ivrs_alias == devid) {
++		if (!amd_iommu_rlookup_table[pci_alias]) {
++			amd_iommu_rlookup_table[pci_alias] =
++				amd_iommu_rlookup_table[devid];
++			memcpy(amd_iommu_dev_table[pci_alias].data,
++			       amd_iommu_dev_table[devid].data,
++			       sizeof(amd_iommu_dev_table[pci_alias].data));
++		}
++
++		return pci_alias;
++	}
++
++	pr_info("AMD-Vi: Using IVRS reported alias %02x:%02x.%d "
++		"for device %s[%04x:%04x], kernel reported alias "
++		"%02x:%02x.%d\n", PCI_BUS_NUM(ivrs_alias), PCI_SLOT(ivrs_alias),
++		PCI_FUNC(ivrs_alias), dev_name(dev), pdev->vendor, pdev->device,
++		PCI_BUS_NUM(pci_alias), PCI_SLOT(pci_alias),
++		PCI_FUNC(pci_alias));
++
++	/*
++	 * If we don't have a PCI DMA alias and the IVRS alias is on the same
++	 * bus, then the IVRS table may know about a quirk that we don't.
++	 */
++	if (pci_alias == devid &&
++	    PCI_BUS_NUM(ivrs_alias) == pdev->bus->number) {
++		pdev->dev_flags |= PCI_DEV_FLAGS_DMA_ALIAS_DEVFN;
++		pdev->dma_alias_devfn = ivrs_alias & 0xff;
++		pr_info("AMD-Vi: Added PCI DMA alias %02x.%d for %s\n",
++			PCI_SLOT(ivrs_alias), PCI_FUNC(ivrs_alias),
++			dev_name(dev));
++	}
++
++	return ivrs_alias;
++}
++
+ static struct iommu_dev_data *find_dev_data(u16 devid)
+ {
+ 	struct iommu_dev_data *dev_data;
+@@ -215,13 +285,6 @@ static struct iommu_dev_data *find_dev_data(u16 devid)
+ 	return dev_data;
+ }
+ 
+-static inline u16 get_device_id(struct device *dev)
+-{
+-	struct pci_dev *pdev = to_pci_dev(dev);
+-
+-	return PCI_DEVID(pdev->bus->number, pdev->devfn);
+-}
+-
+ static struct iommu_dev_data *get_dev_data(struct device *dev)
+ {
+ 	return dev->archdata.iommu;
+@@ -349,6 +412,8 @@ static int iommu_init_device(struct device *dev)
+ 	if (!dev_data)
+ 		return -ENOMEM;
+ 
++	dev_data->alias = get_alias(dev);
++
+ 	if (pci_iommuv2_capable(pdev)) {
+ 		struct amd_iommu *iommu;
+ 
+@@ -369,7 +434,7 @@ static void iommu_ignore_device(struct device *dev)
+ 	u16 devid, alias;
+ 
+ 	devid = get_device_id(dev);
+-	alias = amd_iommu_alias_table[devid];
++	alias = get_alias(dev);
+ 
+ 	memset(&amd_iommu_dev_table[devid], 0, sizeof(struct dev_table_entry));
+ 	memset(&amd_iommu_dev_table[alias], 0, sizeof(struct dev_table_entry));
+@@ -1061,7 +1126,7 @@ static int device_flush_dte(struct iommu_dev_data *dev_data)
+ 	int ret;
+ 
+ 	iommu = amd_iommu_rlookup_table[dev_data->devid];
+-	alias = amd_iommu_alias_table[dev_data->devid];
++	alias = dev_data->alias;
+ 
+ 	ret = iommu_flush_dte(iommu, dev_data->devid);
+ 	if (!ret && alias != dev_data->devid)
+@@ -2039,7 +2104,7 @@ static void do_attach(struct iommu_dev_data *dev_data,
+ 	bool ats;
+ 
+ 	iommu = amd_iommu_rlookup_table[dev_data->devid];
+-	alias = amd_iommu_alias_table[dev_data->devid];
++	alias = dev_data->alias;
+ 	ats   = dev_data->ats.enabled;
+ 
+ 	/* Update data structures */
+@@ -2073,7 +2138,7 @@ static void do_detach(struct iommu_dev_data *dev_data)
+ 		return;
+ 
+ 	iommu = amd_iommu_rlookup_table[dev_data->devid];
+-	alias = amd_iommu_alias_table[dev_data->devid];
++	alias = dev_data->alias;
+ 
+ 	/* decrease reference counters */
+ 	dev_data->domain->dev_iommu[iommu->index] -= 1;
+diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
+index 72d6182666cb..58f2fe687a24 100644
+--- a/drivers/iommu/dma-iommu.c
++++ b/drivers/iommu/dma-iommu.c
+@@ -403,7 +403,7 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents,
+ 		unsigned int s_length = sg_dma_len(s);
+ 		unsigned int s_dma_len = s->length;
+ 
+-		s->offset = s_offset;
++		s->offset += s_offset;
+ 		s->length = s_length;
+ 		sg_dma_address(s) = dma_addr + s_offset;
+ 		dma_addr += s_dma_len;
+@@ -422,7 +422,7 @@ static void __invalidate_sg(struct scatterlist *sg, int nents)
+ 
+ 	for_each_sg(sg, s, nents, i) {
+ 		if (sg_dma_address(s) != DMA_ERROR_CODE)
+-			s->offset = sg_dma_address(s);
++			s->offset += sg_dma_address(s);
+ 		if (sg_dma_len(s))
+ 			s->length = sg_dma_len(s);
+ 		sg_dma_address(s) = DMA_ERROR_CODE;
+diff --git a/drivers/irqchip/irq-mxs.c b/drivers/irqchip/irq-mxs.c
+index efe50845939d..17304705f2cf 100644
+--- a/drivers/irqchip/irq-mxs.c
++++ b/drivers/irqchip/irq-mxs.c
+@@ -183,7 +183,7 @@ static void __iomem * __init icoll_init_iobase(struct device_node *np)
+ 	void __iomem *icoll_base;
+ 
+ 	icoll_base = of_io_request_and_map(np, 0, np->name);
+-	if (!icoll_base)
++	if (IS_ERR(icoll_base))
+ 		panic("%s: unable to map resource", np->full_name);
+ 	return icoll_base;
+ }
+diff --git a/drivers/irqchip/irq-sunxi-nmi.c b/drivers/irqchip/irq-sunxi-nmi.c
+index 0820f67cc9a7..668730c5cb66 100644
+--- a/drivers/irqchip/irq-sunxi-nmi.c
++++ b/drivers/irqchip/irq-sunxi-nmi.c
+@@ -160,9 +160,9 @@ static int __init sunxi_sc_nmi_irq_init(struct device_node *node,
+ 
+ 	gc = irq_get_domain_generic_chip(domain, 0);
+ 	gc->reg_base = of_io_request_and_map(node, 0, of_node_full_name(node));
+-	if (!gc->reg_base) {
++	if (IS_ERR(gc->reg_base)) {
+ 		pr_err("unable to map resource\n");
+-		ret = -ENOMEM;
++		ret = PTR_ERR(gc->reg_base);
+ 		goto fail_irqd_remove;
+ 	}
+ 
+diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
+index 27f2ef300f8b..3970cda10080 100644
+--- a/drivers/md/dm-cache-metadata.c
++++ b/drivers/md/dm-cache-metadata.c
+@@ -867,39 +867,55 @@ static int blocks_are_unmapped_or_clean(struct dm_cache_metadata *cmd,
+ 	return 0;
+ }
+ 
+-#define WRITE_LOCK(cmd)	\
+-	down_write(&cmd->root_lock); \
+-	if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \
+-		up_write(&cmd->root_lock); \
+-		return -EINVAL; \
++static bool cmd_write_lock(struct dm_cache_metadata *cmd)
++{
++	down_write(&cmd->root_lock);
++	if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) {
++		up_write(&cmd->root_lock);
++		return false;
+ 	}
++	return true;
++}
+ 
+-#define WRITE_LOCK_VOID(cmd) \
+-	down_write(&cmd->root_lock); \
+-	if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \
+-		up_write(&cmd->root_lock); \
+-		return; \
+-	}
++#define WRITE_LOCK(cmd)				\
++	do {					\
++		if (!cmd_write_lock((cmd)))	\
++			return -EINVAL;		\
++	} while(0)
++
++#define WRITE_LOCK_VOID(cmd)			\
++	do {					\
++		if (!cmd_write_lock((cmd)))	\
++			return;			\
++	} while(0)
+ 
+ #define WRITE_UNLOCK(cmd) \
+-	up_write(&cmd->root_lock)
++	up_write(&(cmd)->root_lock)
+ 
+-#define READ_LOCK(cmd) \
+-	down_read(&cmd->root_lock); \
+-	if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \
+-		up_read(&cmd->root_lock); \
+-		return -EINVAL; \
++static bool cmd_read_lock(struct dm_cache_metadata *cmd)
++{
++	down_read(&cmd->root_lock);
++	if (cmd->fail_io) {
++		up_read(&cmd->root_lock);
++		return false;
+ 	}
++	return true;
++}
+ 
+-#define READ_LOCK_VOID(cmd)	\
+-	down_read(&cmd->root_lock); \
+-	if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \
+-		up_read(&cmd->root_lock); \
+-		return; \
+-	}
++#define READ_LOCK(cmd)				\
++	do {					\
++		if (!cmd_read_lock((cmd)))	\
++			return -EINVAL;		\
++	} while(0)
++
++#define READ_LOCK_VOID(cmd)			\
++	do {					\
++		if (!cmd_read_lock((cmd)))	\
++			return;			\
++	} while(0)
+ 
+ #define READ_UNLOCK(cmd) \
+-	up_read(&cmd->root_lock)
++	up_read(&(cmd)->root_lock)
+ 
+ int dm_cache_resize(struct dm_cache_metadata *cmd, dm_cblock_t new_cache_size)
+ {
+diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
+index de9ff3bb8edd..6996ab8db108 100644
+--- a/drivers/media/usb/usbvision/usbvision-video.c
++++ b/drivers/media/usb/usbvision/usbvision-video.c
+@@ -1461,13 +1461,6 @@ static int usbvision_probe(struct usb_interface *intf,
+ 	printk(KERN_INFO "%s: %s found\n", __func__,
+ 				usbvision_device_data[model].model_string);
+ 
+-	/*
+-	 * this is a security check.
+-	 * an exploit using an incorrect bInterfaceNumber is known
+-	 */
+-	if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum])
+-		return -ENODEV;
+-
+ 	if (usbvision_device_data[model].interface >= 0)
+ 		interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0];
+ 	else if (ifnum < dev->actconfig->desc.bNumInterfaces)
+diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
+index ff8953ae52d1..d7d7c52a3060 100644
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -1643,7 +1643,7 @@ static int __vb2_wait_for_done_vb(struct vb2_queue *q, int nonblocking)
+  * Will sleep if required for nonblocking == false.
+  */
+ static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb,
+-				int nonblocking)
++			     void *pb, int nonblocking)
+ {
+ 	unsigned long flags;
+ 	int ret;
+@@ -1664,10 +1664,10 @@ static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb,
+ 	/*
+ 	 * Only remove the buffer from done_list if v4l2_buffer can handle all
+ 	 * the planes.
+-	 * Verifying planes is NOT necessary since it already has been checked
+-	 * before the buffer is queued/prepared. So it can never fail.
+ 	 */
+-	list_del(&(*vb)->done_entry);
++	ret = call_bufop(q, verify_planes_array, *vb, pb);
++	if (!ret)
++		list_del(&(*vb)->done_entry);
+ 	spin_unlock_irqrestore(&q->done_lock, flags);
+ 
+ 	return ret;
+@@ -1746,7 +1746,7 @@ int vb2_core_dqbuf(struct vb2_queue *q, unsigned int *pindex, void *pb,
+ 	struct vb2_buffer *vb = NULL;
+ 	int ret;
+ 
+-	ret = __vb2_get_done_vb(q, &vb, nonblocking);
++	ret = __vb2_get_done_vb(q, &vb, pb, nonblocking);
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -2293,6 +2293,16 @@ unsigned int vb2_core_poll(struct vb2_queue *q, struct file *file,
+ 		return POLLERR;
+ 
+ 	/*
++	 * If this quirk is set and QBUF hasn't been called yet then
++	 * return POLLERR as well. This only affects capture queues, output
++	 * queues will always initialize waiting_for_buffers to false.
++	 * This quirk is set by V4L2 for backwards compatibility reasons.
++	 */
++	if (q->quirk_poll_must_check_waiting_for_buffers &&
++	    q->waiting_for_buffers && (req_events & (POLLIN | POLLRDNORM)))
++		return POLLERR;
++
++	/*
+ 	 * For output streams you can call write() as long as there are fewer
+ 	 * buffers queued than there are buffers available.
+ 	 */
+diff --git a/drivers/media/v4l2-core/videobuf2-memops.c b/drivers/media/v4l2-core/videobuf2-memops.c
+index dbec5923fcf0..3c3b517f1d1c 100644
+--- a/drivers/media/v4l2-core/videobuf2-memops.c
++++ b/drivers/media/v4l2-core/videobuf2-memops.c
+@@ -49,7 +49,7 @@ struct frame_vector *vb2_create_framevec(unsigned long start,
+ 	vec = frame_vector_create(nr);
+ 	if (!vec)
+ 		return ERR_PTR(-ENOMEM);
+-	ret = get_vaddr_frames(start, nr, write, 1, vec);
++	ret = get_vaddr_frames(start & PAGE_MASK, nr, write, true, vec);
+ 	if (ret < 0)
+ 		goto out_destroy;
+ 	/* We accept only complete set of PFNs */
+diff --git a/drivers/media/v4l2-core/videobuf2-v4l2.c b/drivers/media/v4l2-core/videobuf2-v4l2.c
+index 91f552124050..7f366f1b0377 100644
+--- a/drivers/media/v4l2-core/videobuf2-v4l2.c
++++ b/drivers/media/v4l2-core/videobuf2-v4l2.c
+@@ -74,6 +74,11 @@ static int __verify_planes_array(struct vb2_buffer *vb, const struct v4l2_buffer
+ 	return 0;
+ }
+ 
++static int __verify_planes_array_core(struct vb2_buffer *vb, const void *pb)
++{
++	return __verify_planes_array(vb, pb);
++}
++
+ /**
+  * __verify_length() - Verify that the bytesused value for each plane fits in
+  * the plane length and that the data offset doesn't exceed the bytesused value.
+@@ -437,6 +442,7 @@ static int __fill_vb2_buffer(struct vb2_buffer *vb,
+ }
+ 
+ static const struct vb2_buf_ops v4l2_buf_ops = {
++	.verify_planes_array	= __verify_planes_array_core,
+ 	.fill_user_buffer	= __fill_v4l2_buffer,
+ 	.fill_vb2_buffer	= __fill_vb2_buffer,
+ 	.copy_timestamp		= __copy_timestamp,
+@@ -765,6 +771,12 @@ int vb2_queue_init(struct vb2_queue *q)
+ 	q->is_output = V4L2_TYPE_IS_OUTPUT(q->type);
+ 	q->copy_timestamp = (q->timestamp_flags & V4L2_BUF_FLAG_TIMESTAMP_MASK)
+ 			== V4L2_BUF_FLAG_TIMESTAMP_COPY;
++	/*
++	 * For compatibility with vb1: if QBUF hasn't been called yet, then
++	 * return POLLERR as well. This only affects capture queues, output
++	 * queues will always initialize waiting_for_buffers to false.
++	 */
++	q->quirk_poll_must_check_waiting_for_buffers = true;
+ 
+ 	return vb2_core_queue_init(q);
+ }
+@@ -818,14 +830,6 @@ unsigned int vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait)
+ 			poll_wait(file, &fh->wait, wait);
+ 	}
+ 
+-	/*
+-	 * For compatibility with vb1: if QBUF hasn't been called yet, then
+-	 * return POLLERR as well. This only affects capture queues, output
+-	 * queues will always initialize waiting_for_buffers to false.
+-	 */
+-	if (q->waiting_for_buffers && (req_events & (POLLIN | POLLRDNORM)))
+-		return POLLERR;
+-
+ 	return res | vb2_core_poll(q, file, wait);
+ }
+ EXPORT_SYMBOL_GPL(vb2_poll);
+diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
+index 054fc10cb3b6..b22c03264270 100644
+--- a/drivers/misc/Kconfig
++++ b/drivers/misc/Kconfig
+@@ -440,7 +440,7 @@ config ARM_CHARLCD
+ 	  still useful.
+ 
+ config BMP085
+-	bool
++	tristate
+ 	depends on SYSFS
+ 
+ config BMP085_I2C
+diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c
+index 15e88078ba1e..f1a0b99f5a9a 100644
+--- a/drivers/misc/ad525x_dpot.c
++++ b/drivers/misc/ad525x_dpot.c
+@@ -216,7 +216,7 @@ static s32 dpot_read_i2c(struct dpot_data *dpot, u8 reg)
+ 			 */
+ 			value = swab16(value);
+ 
+-			if (dpot->uid == DPOT_UID(AD5271_ID))
++			if (dpot->uid == DPOT_UID(AD5274_ID))
+ 				value = value >> 2;
+ 		return value;
+ 	default:
+diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c
+index 09a406058c46..efbb6945eb18 100644
+--- a/drivers/misc/cxl/irq.c
++++ b/drivers/misc/cxl/irq.c
+@@ -288,7 +288,6 @@ unsigned int cxl_map_irq(struct cxl *adapter, irq_hw_number_t hwirq,
+ void cxl_unmap_irq(unsigned int virq, void *cookie)
+ {
+ 	free_irq(virq, cookie);
+-	irq_dispose_mapping(virq);
+ }
+ 
+ static int cxl_register_one_irq(struct cxl *adapter,
+diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c
+index 8310b4dbff06..6a451bd65bf3 100644
+--- a/drivers/misc/mic/scif/scif_rma.c
++++ b/drivers/misc/mic/scif/scif_rma.c
+@@ -1511,7 +1511,7 @@ off_t scif_register_pinned_pages(scif_epd_t epd,
+ 	if ((map_flags & SCIF_MAP_FIXED) &&
+ 	    ((ALIGN(offset, PAGE_SIZE) != offset) ||
+ 	    (offset < 0) ||
+-	    (offset + (off_t)len < offset)))
++	    (len > LONG_MAX - offset)))
+ 		return -EINVAL;
+ 
+ 	might_sleep();
+@@ -1614,7 +1614,7 @@ off_t scif_register(scif_epd_t epd, void *addr, size_t len, off_t offset,
+ 	if ((map_flags & SCIF_MAP_FIXED) &&
+ 	    ((ALIGN(offset, PAGE_SIZE) != offset) ||
+ 	    (offset < 0) ||
+-	    (offset + (off_t)len < offset)))
++	    (len > LONG_MAX - offset)))
+ 		return -EINVAL;
+ 
+ 	/* Unsupported protection requested */
+@@ -1732,7 +1732,8 @@ scif_unregister(scif_epd_t epd, off_t offset, size_t len)
+ 
+ 	/* Offset is not page aligned or offset+len wraps around */
+ 	if ((ALIGN(offset, PAGE_SIZE) != offset) ||
+-	    (offset + (off_t)len < offset))
++	    (offset < 0) ||
++	    (len > LONG_MAX - offset))
+ 		return -EINVAL;
+ 
+ 	err = scif_verify_epd(ep);
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index 5fbffdb6b854..c6f36f3ca5d2 100644
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -86,7 +86,6 @@ static int max_devices;
+ 
+ /* TODO: Replace these with struct ida */
+ static DECLARE_BITMAP(dev_use, MAX_DEVICES);
+-static DECLARE_BITMAP(name_use, MAX_DEVICES);
+ 
+ /*
+  * There is one mmc_blk_data per slot.
+@@ -105,7 +104,6 @@ struct mmc_blk_data {
+ 	unsigned int	usage;
+ 	unsigned int	read_only;
+ 	unsigned int	part_type;
+-	unsigned int	name_idx;
+ 	unsigned int	reset_done;
+ #define MMC_BLK_READ		BIT(0)
+ #define MMC_BLK_WRITE		BIT(1)
+@@ -2202,19 +2200,6 @@ static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card,
+ 		goto out;
+ 	}
+ 
+-	/*
+-	 * !subname implies we are creating main mmc_blk_data that will be
+-	 * associated with mmc_card with dev_set_drvdata. Due to device
+-	 * partitions, devidx will not coincide with a per-physical card
+-	 * index anymore so we keep track of a name index.
+-	 */
+-	if (!subname) {
+-		md->name_idx = find_first_zero_bit(name_use, max_devices);
+-		__set_bit(md->name_idx, name_use);
+-	} else
+-		md->name_idx = ((struct mmc_blk_data *)
+-				dev_to_disk(parent)->private_data)->name_idx;
+-
+ 	md->area_type = area_type;
+ 
+ 	/*
+@@ -2264,7 +2249,7 @@ static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card,
+ 	 */
+ 
+ 	snprintf(md->disk->disk_name, sizeof(md->disk->disk_name),
+-		 "mmcblk%u%s", md->name_idx, subname ? subname : "");
++		 "mmcblk%u%s", card->host->index, subname ? subname : "");
+ 
+ 	if (mmc_card_mmc(card))
+ 		blk_queue_logical_block_size(md->queue.queue,
+@@ -2418,7 +2403,6 @@ static void mmc_blk_remove_parts(struct mmc_card *card,
+ 	struct list_head *pos, *q;
+ 	struct mmc_blk_data *part_md;
+ 
+-	__clear_bit(md->name_idx, name_use);
+ 	list_for_each_safe(pos, q, &md->part) {
+ 		part_md = list_entry(pos, struct mmc_blk_data, part);
+ 		list_del(pos);
+diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
+index 1526b8a10b09..3b944fc70eec 100644
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -97,6 +97,7 @@ config MMC_RICOH_MMC
+ config MMC_SDHCI_ACPI
+ 	tristate "SDHCI support for ACPI enumerated SDHCI controllers"
+ 	depends on MMC_SDHCI && ACPI
++	select IOSF_MBI if X86
+ 	help
+ 	  This selects support for ACPI enumerated SDHCI controllers,
+ 	  identified by ACPI Compatibility ID PNP0D40 or specific
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index a5cda926d38e..975139f97498 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -41,6 +41,11 @@
+ #include <linux/mmc/pm.h>
+ #include <linux/mmc/slot-gpio.h>
+ 
++#ifdef CONFIG_X86
++#include <asm/cpu_device_id.h>
++#include <asm/iosf_mbi.h>
++#endif
++
+ #include "sdhci.h"
+ 
+ enum {
+@@ -146,6 +151,75 @@ static const struct sdhci_acpi_chip sdhci_acpi_chip_int = {
+ 	.ops = &sdhci_acpi_ops_int,
+ };
+ 
++#ifdef CONFIG_X86
++
++static bool sdhci_acpi_byt(void)
++{
++	static const struct x86_cpu_id byt[] = {
++		{ X86_VENDOR_INTEL, 6, 0x37 },
++		{}
++	};
++
++	return x86_match_cpu(byt);
++}
++
++#define BYT_IOSF_SCCEP			0x63
++#define BYT_IOSF_OCP_NETCTRL0		0x1078
++#define BYT_IOSF_OCP_TIMEOUT_BASE	GENMASK(10, 8)
++
++static void sdhci_acpi_byt_setting(struct device *dev)
++{
++	u32 val = 0;
++
++	if (!sdhci_acpi_byt())
++		return;
++
++	if (iosf_mbi_read(BYT_IOSF_SCCEP, MBI_CR_READ, BYT_IOSF_OCP_NETCTRL0,
++			  &val)) {
++		dev_err(dev, "%s read error\n", __func__);
++		return;
++	}
++
++	if (!(val & BYT_IOSF_OCP_TIMEOUT_BASE))
++		return;
++
++	val &= ~BYT_IOSF_OCP_TIMEOUT_BASE;
++
++	if (iosf_mbi_write(BYT_IOSF_SCCEP, MBI_CR_WRITE, BYT_IOSF_OCP_NETCTRL0,
++			   val)) {
++		dev_err(dev, "%s write error\n", __func__);
++		return;
++	}
++
++	dev_dbg(dev, "%s completed\n", __func__);
++}
++
++static bool sdhci_acpi_byt_defer(struct device *dev)
++{
++	if (!sdhci_acpi_byt())
++		return false;
++
++	if (!iosf_mbi_available())
++		return true;
++
++	sdhci_acpi_byt_setting(dev);
++
++	return false;
++}
++
++#else
++
++static inline void sdhci_acpi_byt_setting(struct device *dev)
++{
++}
++
++static inline bool sdhci_acpi_byt_defer(struct device *dev)
++{
++	return false;
++}
++
++#endif
++
+ static int bxt_get_cd(struct mmc_host *mmc)
+ {
+ 	int gpio_cd = mmc_gpio_get_cd(mmc);
+@@ -337,6 +411,9 @@ static int sdhci_acpi_probe(struct platform_device *pdev)
+ 	if (acpi_bus_get_status(device) || !device->status.present)
+ 		return -ENODEV;
+ 
++	if (sdhci_acpi_byt_defer(dev))
++		return -EPROBE_DEFER;
++
+ 	hid = acpi_device_hid(device);
+ 	uid = device->pnp.unique_id;
+ 
+@@ -460,6 +537,8 @@ static int sdhci_acpi_resume(struct device *dev)
+ {
+ 	struct sdhci_acpi_host *c = dev_get_drvdata(dev);
+ 
++	sdhci_acpi_byt_setting(&c->pdev->dev);
++
+ 	return sdhci_resume_host(c->host);
+ }
+ 
+@@ -483,6 +562,8 @@ static int sdhci_acpi_runtime_resume(struct device *dev)
+ {
+ 	struct sdhci_acpi_host *c = dev_get_drvdata(dev);
+ 
++	sdhci_acpi_byt_setting(&c->pdev->dev);
++
+ 	return sdhci_runtime_resume_host(c->host);
+ }
+ 
+diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
+index 844fc07d22cd..f7009c1cb90c 100644
+--- a/drivers/mtd/nand/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/brcmnand/brcmnand.c
+@@ -311,6 +311,36 @@ static const u16 brcmnand_regs_v60[] = {
+ 	[BRCMNAND_FC_BASE]		= 0x400,
+ };
+ 
++/* BRCMNAND v7.1 */
++static const u16 brcmnand_regs_v71[] = {
++	[BRCMNAND_CMD_START]		=  0x04,
++	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
++	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
++	[BRCMNAND_INTFC_STATUS]		=  0x14,
++	[BRCMNAND_CS_SELECT]		=  0x18,
++	[BRCMNAND_CS_XOR]		=  0x1c,
++	[BRCMNAND_LL_OP]		=  0x20,
++	[BRCMNAND_CS0_BASE]		=  0x50,
++	[BRCMNAND_CS1_BASE]		=     0,
++	[BRCMNAND_CORR_THRESHOLD]	=  0xdc,
++	[BRCMNAND_CORR_THRESHOLD_EXT]	=  0xe0,
++	[BRCMNAND_UNCORR_COUNT]		=  0xfc,
++	[BRCMNAND_CORR_COUNT]		= 0x100,
++	[BRCMNAND_CORR_EXT_ADDR]	= 0x10c,
++	[BRCMNAND_CORR_ADDR]		= 0x110,
++	[BRCMNAND_UNCORR_EXT_ADDR]	= 0x114,
++	[BRCMNAND_UNCORR_ADDR]		= 0x118,
++	[BRCMNAND_SEMAPHORE]		= 0x150,
++	[BRCMNAND_ID]			= 0x194,
++	[BRCMNAND_ID_EXT]		= 0x198,
++	[BRCMNAND_LL_RDATA]		= 0x19c,
++	[BRCMNAND_OOB_READ_BASE]	= 0x200,
++	[BRCMNAND_OOB_READ_10_BASE]	=     0,
++	[BRCMNAND_OOB_WRITE_BASE]	= 0x280,
++	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
++	[BRCMNAND_FC_BASE]		= 0x400,
++};
++
+ enum brcmnand_cs_reg {
+ 	BRCMNAND_CS_CFG_EXT = 0,
+ 	BRCMNAND_CS_CFG,
+@@ -406,7 +436,9 @@ static int brcmnand_revision_init(struct brcmnand_controller *ctrl)
+ 	}
+ 
+ 	/* Register offsets */
+-	if (ctrl->nand_version >= 0x0600)
++	if (ctrl->nand_version >= 0x0701)
++		ctrl->reg_offsets = brcmnand_regs_v71;
++	else if (ctrl->nand_version >= 0x0600)
+ 		ctrl->reg_offsets = brcmnand_regs_v60;
+ 	else if (ctrl->nand_version >= 0x0500)
+ 		ctrl->reg_offsets = brcmnand_regs_v50;
+diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
+index f2c8ff398d6c..171d146645ba 100644
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -4021,7 +4021,6 @@ static int nand_dt_init(struct nand_chip *chip)
+  * This is the first phase of the normal nand_scan() function. It reads the
+  * flash ID and sets up MTD fields accordingly.
+  *
+- * The mtd->owner field must be set to the module of the caller.
+  */
+ int nand_scan_ident(struct mtd_info *mtd, int maxchips,
+ 		    struct nand_flash_dev *table)
+@@ -4443,19 +4442,12 @@ EXPORT_SYMBOL(nand_scan_tail);
+  *
+  * This fills out all the uninitialized function pointers with the defaults.
+  * The flash ID is read and the mtd/chip structures are filled with the
+- * appropriate values. The mtd->owner field must be set to the module of the
+- * caller.
++ * appropriate values.
+  */
+ int nand_scan(struct mtd_info *mtd, int maxchips)
+ {
+ 	int ret;
+ 
+-	/* Many callers got this wrong, so check for it for a while... */
+-	if (!mtd->owner && caller_is_module()) {
+-		pr_crit("%s called with NULL mtd->owner!\n", __func__);
+-		BUG();
+-	}
+-
+ 	ret = nand_scan_ident(mtd, maxchips, NULL);
+ 	if (!ret)
+ 		ret = nand_scan_tail(mtd);
+diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
+index 86fc245dc71a..fd78644469fa 100644
+--- a/drivers/mtd/nand/pxa3xx_nand.c
++++ b/drivers/mtd/nand/pxa3xx_nand.c
+@@ -1738,7 +1738,7 @@ static int alloc_nand_resource(struct platform_device *pdev)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	if (use_dma) {
++	if (!np && use_dma) {
+ 		r = platform_get_resource(pdev, IORESOURCE_DMA, 0);
+ 		if (r == NULL) {
+ 			dev_err(&pdev->dev,
+diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
+index ed0c19c558b5..3028c06547c1 100644
+--- a/drivers/mtd/spi-nor/spi-nor.c
++++ b/drivers/mtd/spi-nor/spi-nor.c
+@@ -1100,45 +1100,6 @@ static int spansion_quad_enable(struct spi_nor *nor)
+ 	return 0;
+ }
+ 
+-static int micron_quad_enable(struct spi_nor *nor)
+-{
+-	int ret;
+-	u8 val;
+-
+-	ret = nor->read_reg(nor, SPINOR_OP_RD_EVCR, &val, 1);
+-	if (ret < 0) {
+-		dev_err(nor->dev, "error %d reading EVCR\n", ret);
+-		return ret;
+-	}
+-
+-	write_enable(nor);
+-
+-	/* set EVCR, enable quad I/O */
+-	nor->cmd_buf[0] = val & ~EVCR_QUAD_EN_MICRON;
+-	ret = nor->write_reg(nor, SPINOR_OP_WD_EVCR, nor->cmd_buf, 1);
+-	if (ret < 0) {
+-		dev_err(nor->dev, "error while writing EVCR register\n");
+-		return ret;
+-	}
+-
+-	ret = spi_nor_wait_till_ready(nor);
+-	if (ret)
+-		return ret;
+-
+-	/* read EVCR and check it */
+-	ret = nor->read_reg(nor, SPINOR_OP_RD_EVCR, &val, 1);
+-	if (ret < 0) {
+-		dev_err(nor->dev, "error %d reading EVCR\n", ret);
+-		return ret;
+-	}
+-	if (val & EVCR_QUAD_EN_MICRON) {
+-		dev_err(nor->dev, "Micron EVCR Quad bit not clear\n");
+-		return -EINVAL;
+-	}
+-
+-	return 0;
+-}
+-
+ static int set_quad_mode(struct spi_nor *nor, const struct flash_info *info)
+ {
+ 	int status;
+@@ -1152,12 +1113,7 @@ static int set_quad_mode(struct spi_nor *nor, const struct flash_info *info)
+ 		}
+ 		return status;
+ 	case SNOR_MFR_MICRON:
+-		status = micron_quad_enable(nor);
+-		if (status) {
+-			dev_err(nor->dev, "Micron quad-read not enabled\n");
+-			return -EINVAL;
+-		}
+-		return status;
++		return 0;
+ 	default:
+ 		status = spansion_quad_enable(nor);
+ 		if (status) {
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index d70a1716f3e0..1486f33a743e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -1143,6 +1143,8 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
+ 	/* the fw is stopped, the aux sta is dead: clean up driver state */
+ 	iwl_mvm_del_aux_sta(mvm);
+ 
++	iwl_free_fw_paging(mvm);
++
+ 	/*
+ 	 * Clear IN_HW_RESTART flag when stopping the hw (as restart_complete()
+ 	 * won't be called in this case).
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+index e80be9a59520..89ea70deeb84 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+@@ -684,8 +684,6 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
+ 	for (i = 0; i < NVM_MAX_NUM_SECTIONS; i++)
+ 		kfree(mvm->nvm_sections[i].data);
+ 
+-	iwl_free_fw_paging(mvm);
+-
+ 	iwl_mvm_tof_clean(mvm);
+ 
+ 	ieee80211_free_hw(mvm->hw);
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 5a854c609477..1198caac35c8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -731,8 +731,8 @@ static int iwl_pcie_rsa_race_bug_wa(struct iwl_trans *trans)
+ 	 */
+ 	val = iwl_read_prph(trans, PREG_AUX_BUS_WPROT_0);
+ 	if (val & (BIT(1) | BIT(17))) {
+-		IWL_INFO(trans,
+-			 "can't access the RSA semaphore it is write protected\n");
++		IWL_DEBUG_INFO(trans,
++			       "can't access the RSA semaphore it is write protected\n");
+ 		return 0;
+ 	}
+ 
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_event.c b/drivers/net/wireless/marvell/mwifiex/sta_event.c
+index ff3ee9dfbbd5..23bae87d4d3d 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_event.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c
+@@ -607,11 +607,13 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
+ 
+ 	case EVENT_PS_AWAKE:
+ 		mwifiex_dbg(adapter, EVENT, "info: EVENT: AWAKE\n");
+-		if (!adapter->pps_uapsd_mode && priv->port_open &&
++		if (!adapter->pps_uapsd_mode &&
++		    (priv->port_open ||
++		     (priv->bss_mode == NL80211_IFTYPE_ADHOC)) &&
+ 		    priv->media_connected && adapter->sleep_period.period) {
+-				adapter->pps_uapsd_mode = true;
+-				mwifiex_dbg(adapter, EVENT,
+-					    "event: PPS/UAPSD mode activated\n");
++			adapter->pps_uapsd_mode = true;
++			mwifiex_dbg(adapter, EVENT,
++				    "event: PPS/UAPSD mode activated\n");
+ 		}
+ 		adapter->tx_lock_flag = false;
+ 		if (adapter->pps_uapsd_mode && adapter->gen_null_pkt) {
+diff --git a/drivers/net/wireless/marvell/mwifiex/wmm.c b/drivers/net/wireless/marvell/mwifiex/wmm.c
+index acccd6734e3b..499e5a741c62 100644
+--- a/drivers/net/wireless/marvell/mwifiex/wmm.c
++++ b/drivers/net/wireless/marvell/mwifiex/wmm.c
+@@ -475,7 +475,8 @@ mwifiex_wmm_lists_empty(struct mwifiex_adapter *adapter)
+ 		priv = adapter->priv[i];
+ 		if (!priv)
+ 			continue;
+-		if (!priv->port_open)
++		if (!priv->port_open &&
++		    (priv->bss_mode != NL80211_IFTYPE_ADHOC))
+ 			continue;
+ 		if (adapter->if_ops.is_port_ready &&
+ 		    !adapter->if_ops.is_port_ready(priv))
+@@ -1099,7 +1100,8 @@ mwifiex_wmm_get_highest_priolist_ptr(struct mwifiex_adapter *adapter,
+ 
+ 			priv_tmp = adapter->bss_prio_tbl[j].bss_prio_cur->priv;
+ 
+-			if (!priv_tmp->port_open ||
++			if (((priv_tmp->bss_mode != NL80211_IFTYPE_ADHOC) &&
++			     !priv_tmp->port_open) ||
+ 			    (atomic_read(&priv_tmp->wmm.tx_pkts_queued) == 0))
+ 				continue;
+ 
+diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c
+index 588803ad6847..6ccba0d862df 100644
+--- a/drivers/ntb/hw/amd/ntb_hw_amd.c
++++ b/drivers/ntb/hw/amd/ntb_hw_amd.c
+@@ -357,20 +357,6 @@ static int amd_ntb_db_clear_mask(struct ntb_dev *ntb, u64 db_bits)
+ 	return 0;
+ }
+ 
+-static int amd_ntb_peer_db_addr(struct ntb_dev *ntb,
+-				phys_addr_t *db_addr,
+-				resource_size_t *db_size)
+-{
+-	struct amd_ntb_dev *ndev = ntb_ndev(ntb);
+-
+-	if (db_addr)
+-		*db_addr = (phys_addr_t)(ndev->peer_mmio + AMD_DBREQ_OFFSET);
+-	if (db_size)
+-		*db_size = sizeof(u32);
+-
+-	return 0;
+-}
+-
+ static int amd_ntb_peer_db_set(struct ntb_dev *ntb, u64 db_bits)
+ {
+ 	struct amd_ntb_dev *ndev = ntb_ndev(ntb);
+@@ -415,20 +401,6 @@ static int amd_ntb_spad_write(struct ntb_dev *ntb,
+ 	return 0;
+ }
+ 
+-static int amd_ntb_peer_spad_addr(struct ntb_dev *ntb, int idx,
+-				  phys_addr_t *spad_addr)
+-{
+-	struct amd_ntb_dev *ndev = ntb_ndev(ntb);
+-
+-	if (idx < 0 || idx >= ndev->spad_count)
+-		return -EINVAL;
+-
+-	if (spad_addr)
+-		*spad_addr = (phys_addr_t)(ndev->self_mmio + AMD_SPAD_OFFSET +
+-					   ndev->peer_spad + (idx << 2));
+-	return 0;
+-}
+-
+ static u32 amd_ntb_peer_spad_read(struct ntb_dev *ntb, int idx)
+ {
+ 	struct amd_ntb_dev *ndev = ntb_ndev(ntb);
+@@ -472,12 +444,10 @@ static const struct ntb_dev_ops amd_ntb_ops = {
+ 	.db_clear		= amd_ntb_db_clear,
+ 	.db_set_mask		= amd_ntb_db_set_mask,
+ 	.db_clear_mask		= amd_ntb_db_clear_mask,
+-	.peer_db_addr		= amd_ntb_peer_db_addr,
+ 	.peer_db_set		= amd_ntb_peer_db_set,
+ 	.spad_count		= amd_ntb_spad_count,
+ 	.spad_read		= amd_ntb_spad_read,
+ 	.spad_write		= amd_ntb_spad_write,
+-	.peer_spad_addr		= amd_ntb_peer_spad_addr,
+ 	.peer_spad_read		= amd_ntb_peer_spad_read,
+ 	.peer_spad_write	= amd_ntb_peer_spad_write,
+ };
+diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
+index c8a37ba4b4f9..6bdc1e7b7503 100644
+--- a/drivers/ntb/test/ntb_perf.c
++++ b/drivers/ntb/test/ntb_perf.c
+@@ -178,7 +178,7 @@ static void perf_copy_callback(void *data)
+ 	atomic_dec(&pctx->dma_sync);
+ }
+ 
+-static ssize_t perf_copy(struct pthr_ctx *pctx, char *dst,
++static ssize_t perf_copy(struct pthr_ctx *pctx, char __iomem *dst,
+ 			 char *src, size_t size)
+ {
+ 	struct perf_ctx *perf = pctx->perf;
+@@ -189,7 +189,8 @@ static ssize_t perf_copy(struct pthr_ctx *pctx, char *dst,
+ 	dma_cookie_t cookie;
+ 	size_t src_off, dst_off;
+ 	struct perf_mw *mw = &perf->mw;
+-	u64 vbase, dst_vaddr;
++	void __iomem *vbase;
++	void __iomem *dst_vaddr;
+ 	dma_addr_t dst_phys;
+ 	int retries = 0;
+ 
+@@ -204,14 +205,14 @@ static ssize_t perf_copy(struct pthr_ctx *pctx, char *dst,
+ 	}
+ 
+ 	device = chan->device;
+-	src_off = (size_t)src & ~PAGE_MASK;
+-	dst_off = (size_t)dst & ~PAGE_MASK;
++	src_off = (uintptr_t)src & ~PAGE_MASK;
++	dst_off = (uintptr_t __force)dst & ~PAGE_MASK;
+ 
+ 	if (!is_dma_copy_aligned(device, src_off, dst_off, size))
+ 		return -ENODEV;
+ 
+-	vbase = (u64)(u64 *)mw->vbase;
+-	dst_vaddr = (u64)(u64 *)dst;
++	vbase = mw->vbase;
++	dst_vaddr = dst;
+ 	dst_phys = mw->phys_addr + (dst_vaddr - vbase);
+ 
+ 	unmap = dmaengine_get_unmap_data(device->dev, 1, GFP_NOWAIT);
+@@ -261,13 +262,13 @@ err_get_unmap:
+ 	return 0;
+ }
+ 
+-static int perf_move_data(struct pthr_ctx *pctx, char *dst, char *src,
++static int perf_move_data(struct pthr_ctx *pctx, char __iomem *dst, char *src,
+ 			  u64 buf_size, u64 win_size, u64 total)
+ {
+ 	int chunks, total_chunks, i;
+ 	int copied_chunks = 0;
+ 	u64 copied = 0, result;
+-	char *tmp = dst;
++	char __iomem *tmp = dst;
+ 	u64 perf, diff_us;
+ 	ktime_t kstart, kstop, kdiff;
+ 
+@@ -324,7 +325,7 @@ static int ntb_perf_thread(void *data)
+ 	struct perf_ctx *perf = pctx->perf;
+ 	struct pci_dev *pdev = perf->ntb->pdev;
+ 	struct perf_mw *mw = &perf->mw;
+-	char *dst;
++	char __iomem *dst;
+ 	u64 win_size, buf_size, total;
+ 	void *src;
+ 	int rc, node, i;
+@@ -364,7 +365,7 @@ static int ntb_perf_thread(void *data)
+ 	if (buf_size > MAX_TEST_SIZE)
+ 		buf_size = MAX_TEST_SIZE;
+ 
+-	dst = (char *)mw->vbase;
++	dst = (char __iomem *)mw->vbase;
+ 
+ 	atomic_inc(&perf->tsync);
+ 	while (atomic_read(&perf->tsync) != perf->perf_threads)
+diff --git a/drivers/pci/host/pci-imx6.c b/drivers/pci/host/pci-imx6.c
+index fe600964fa50..88ccfeaa49c7 100644
+--- a/drivers/pci/host/pci-imx6.c
++++ b/drivers/pci/host/pci-imx6.c
+@@ -32,7 +32,7 @@
+ #define to_imx6_pcie(x)	container_of(x, struct imx6_pcie, pp)
+ 
+ struct imx6_pcie {
+-	struct gpio_desc	*reset_gpio;
++	int			reset_gpio;
+ 	struct clk		*pcie_bus;
+ 	struct clk		*pcie_phy;
+ 	struct clk		*pcie;
+@@ -287,10 +287,10 @@ static int imx6_pcie_deassert_core_reset(struct pcie_port *pp)
+ 	usleep_range(200, 500);
+ 
+ 	/* Some boards don't have PCIe reset GPIO. */
+-	if (imx6_pcie->reset_gpio) {
+-		gpiod_set_value_cansleep(imx6_pcie->reset_gpio, 0);
++	if (gpio_is_valid(imx6_pcie->reset_gpio)) {
++		gpio_set_value_cansleep(imx6_pcie->reset_gpio, 0);
+ 		msleep(100);
+-		gpiod_set_value_cansleep(imx6_pcie->reset_gpio, 1);
++		gpio_set_value_cansleep(imx6_pcie->reset_gpio, 1);
+ 	}
+ 	return 0;
+ 
+@@ -561,6 +561,7 @@ static int __init imx6_pcie_probe(struct platform_device *pdev)
+ {
+ 	struct imx6_pcie *imx6_pcie;
+ 	struct pcie_port *pp;
++	struct device_node *np = pdev->dev.of_node;
+ 	struct resource *dbi_base;
+ 	int ret;
+ 
+@@ -581,8 +582,15 @@ static int __init imx6_pcie_probe(struct platform_device *pdev)
+ 		return PTR_ERR(pp->dbi_base);
+ 
+ 	/* Fetch GPIOs */
+-	imx6_pcie->reset_gpio = devm_gpiod_get_optional(&pdev->dev, "reset",
+-							GPIOD_OUT_LOW);
++	imx6_pcie->reset_gpio = of_get_named_gpio(np, "reset-gpio", 0);
++	if (gpio_is_valid(imx6_pcie->reset_gpio)) {
++		ret = devm_gpio_request_one(&pdev->dev, imx6_pcie->reset_gpio,
++					    GPIOF_OUT_INIT_LOW, "PCIe reset");
++		if (ret) {
++			dev_err(&pdev->dev, "unable to get reset gpio\n");
++			return ret;
++		}
++	}
+ 
+ 	/* Fetch clocks */
+ 	imx6_pcie->pcie_phy = devm_clk_get(&pdev->dev, "pcie_phy");
+diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+index e96e86d2e745..3878d23ca7a8 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+@@ -949,7 +949,8 @@ static int mtk_gpio_set_debounce(struct gpio_chip *chip, unsigned offset,
+ 	struct mtk_pinctrl *pctl = dev_get_drvdata(chip->parent);
+ 	int eint_num, virq, eint_offset;
+ 	unsigned int set_offset, bit, clr_bit, clr_offset, rst, i, unmask, dbnc;
+-	static const unsigned int dbnc_arr[] = {0 , 1, 16, 32, 64, 128, 256};
++	static const unsigned int debounce_time[] = {500, 1000, 16000, 32000, 64000,
++						128000, 256000};
+ 	const struct mtk_desc_pin *pin;
+ 	struct irq_data *d;
+ 
+@@ -967,9 +968,9 @@ static int mtk_gpio_set_debounce(struct gpio_chip *chip, unsigned offset,
+ 	if (!mtk_eint_can_en_debounce(pctl, eint_num))
+ 		return -ENOSYS;
+ 
+-	dbnc = ARRAY_SIZE(dbnc_arr);
+-	for (i = 0; i < ARRAY_SIZE(dbnc_arr); i++) {
+-		if (debounce <= dbnc_arr[i]) {
++	dbnc = ARRAY_SIZE(debounce_time);
++	for (i = 0; i < ARRAY_SIZE(debounce_time); i++) {
++		if (debounce <= debounce_time[i]) {
+ 			dbnc = i;
+ 			break;
+ 		}
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index d24e5f1d1525..bd2e657163b8 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -1273,9 +1273,9 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs,
+ 
+ 		/* Parse pins in each row from LSB */
+ 		while (mask) {
+-			bit_pos = ffs(mask);
++			bit_pos = __ffs(mask);
+ 			pin_num_from_lsb = bit_pos / pcs->bits_per_pin;
+-			mask_pos = ((pcs->fmask) << (bit_pos - 1));
++			mask_pos = ((pcs->fmask) << bit_pos);
+ 			val_pos = val & mask_pos;
+ 			submask = mask & mask_pos;
+ 
+@@ -1844,7 +1844,7 @@ static int pcs_probe(struct platform_device *pdev)
+ 	ret = of_property_read_u32(np, "pinctrl-single,function-mask",
+ 				   &pcs->fmask);
+ 	if (!ret) {
+-		pcs->fshift = ffs(pcs->fmask) - 1;
++		pcs->fshift = __ffs(pcs->fmask);
+ 		pcs->fmax = pcs->fmask >> pcs->fshift;
+ 	} else {
+ 		/* If mask property doesn't exist, function mux is invalid. */
+diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
+index 73833079bac8..d6baea6a7544 100644
+--- a/drivers/platform/x86/toshiba_acpi.c
++++ b/drivers/platform/x86/toshiba_acpi.c
+@@ -133,7 +133,7 @@ MODULE_LICENSE("GPL");
+ /* Field definitions */
+ #define HCI_ACCEL_MASK			0x7fff
+ #define HCI_HOTKEY_DISABLE		0x0b
+-#define HCI_HOTKEY_ENABLE		0x01
++#define HCI_HOTKEY_ENABLE		0x09
+ #define HCI_HOTKEY_SPECIAL_FUNCTIONS	0x10
+ #define HCI_LCD_BRIGHTNESS_BITS		3
+ #define HCI_LCD_BRIGHTNESS_SHIFT	(16-HCI_LCD_BRIGHTNESS_BITS)
+diff --git a/drivers/pwm/pwm-brcmstb.c b/drivers/pwm/pwm-brcmstb.c
+index 423ce087cd9c..5d5adee16886 100644
+--- a/drivers/pwm/pwm-brcmstb.c
++++ b/drivers/pwm/pwm-brcmstb.c
+@@ -274,8 +274,8 @@ static int brcmstb_pwm_probe(struct platform_device *pdev)
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	p->base = devm_ioremap_resource(&pdev->dev, res);
+-	if (!p->base) {
+-		ret = -ENOMEM;
++	if (IS_ERR(p->base)) {
++		ret = PTR_ERR(p->base);
+ 		goto out_clk;
+ 	}
+ 
+diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
+index 58f5d3b8e981..27343e1c43ef 100644
+--- a/drivers/regulator/s5m8767.c
++++ b/drivers/regulator/s5m8767.c
+@@ -202,9 +202,10 @@ static int s5m8767_get_register(struct s5m8767_info *s5m8767, int reg_id,
+ 		}
+ 	}
+ 
+-	if (i < s5m8767->num_regulators)
+-		*enable_ctrl =
+-		s5m8767_opmode_reg[reg_id][mode] << S5M8767_ENCTRL_SHIFT;
++	if (i >= s5m8767->num_regulators)
++		return -EINVAL;
++
++	*enable_ctrl = s5m8767_opmode_reg[reg_id][mode] << S5M8767_ENCTRL_SHIFT;
+ 
+ 	return 0;
+ }
+@@ -937,8 +938,12 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
+ 			else
+ 				regulators[id].vsel_mask = 0xff;
+ 
+-			s5m8767_get_register(s5m8767, id, &enable_reg,
++			ret = s5m8767_get_register(s5m8767, id, &enable_reg,
+ 					     &enable_val);
++			if (ret) {
++				dev_err(s5m8767->dev, "error reading registers\n");
++				return ret;
++			}
+ 			regulators[id].enable_reg = enable_reg;
+ 			regulators[id].enable_mask = S5M8767_ENCTRL_MASK;
+ 			regulators[id].enable_val = enable_val;
+diff --git a/drivers/rtc/rtc-ds1685.c b/drivers/rtc/rtc-ds1685.c
+index 535050fc5e9f..08e0ff8c786a 100644
+--- a/drivers/rtc/rtc-ds1685.c
++++ b/drivers/rtc/rtc-ds1685.c
+@@ -187,9 +187,9 @@ ds1685_rtc_end_data_access(struct ds1685_priv *rtc)
+  * Only use this where you are certain another lock will not be held.
+  */
+ static inline void
+-ds1685_rtc_begin_ctrl_access(struct ds1685_priv *rtc, unsigned long flags)
++ds1685_rtc_begin_ctrl_access(struct ds1685_priv *rtc, unsigned long *flags)
+ {
+-	spin_lock_irqsave(&rtc->lock, flags);
++	spin_lock_irqsave(&rtc->lock, *flags);
+ 	ds1685_rtc_switch_to_bank1(rtc);
+ }
+ 
+@@ -1300,7 +1300,7 @@ ds1685_rtc_sysfs_ctrl_regs_store(struct device *dev,
+ {
+ 	struct ds1685_priv *rtc = dev_get_drvdata(dev);
+ 	u8 reg = 0, bit = 0, tmp;
+-	unsigned long flags = 0;
++	unsigned long flags;
+ 	long int val = 0;
+ 	const struct ds1685_rtc_ctrl_regs *reg_info =
+ 		ds1685_rtc_sysfs_ctrl_regs_lookup(attr->attr.name);
+@@ -1321,7 +1321,7 @@ ds1685_rtc_sysfs_ctrl_regs_store(struct device *dev,
+ 	bit = reg_info->bit;
+ 
+ 	/* Safe to spinlock during a write. */
+-	ds1685_rtc_begin_ctrl_access(rtc, flags);
++	ds1685_rtc_begin_ctrl_access(rtc, &flags);
+ 	tmp = rtc->read(rtc, reg);
+ 	rtc->write(rtc, reg, (val ? (tmp | bit) : (tmp & ~(bit))));
+ 	ds1685_rtc_end_ctrl_access(rtc, flags);
+diff --git a/drivers/rtc/rtc-hym8563.c b/drivers/rtc/rtc-hym8563.c
+index 097325d96db5..b1b4746a0eab 100644
+--- a/drivers/rtc/rtc-hym8563.c
++++ b/drivers/rtc/rtc-hym8563.c
+@@ -144,7 +144,7 @@ static int hym8563_rtc_set_time(struct device *dev, struct rtc_time *tm)
+ 	 * it does not seem to carry it over a subsequent write/read.
+ 	 * So we'll limit ourself to 100 years, starting at 2000 for now.
+ 	 */
+-	buf[6] = tm->tm_year - 100;
++	buf[6] = bin2bcd(tm->tm_year - 100);
+ 
+ 	/*
+ 	 * CTL1 only contains TEST-mode bits apart from stop,
+diff --git a/drivers/rtc/rtc-max77686.c b/drivers/rtc/rtc-max77686.c
+index 7184a0eda793..725dccae24e7 100644
+--- a/drivers/rtc/rtc-max77686.c
++++ b/drivers/rtc/rtc-max77686.c
+@@ -465,7 +465,7 @@ static int max77686_rtc_probe(struct platform_device *pdev)
+ 
+ 	info->virq = regmap_irq_get_virq(max77686->rtc_irq_data,
+ 					 MAX77686_RTCIRQ_RTCA1);
+-	if (!info->virq) {
++	if (info->virq <= 0) {
+ 		ret = -ENXIO;
+ 		goto err_rtc;
+ 	}
+diff --git a/drivers/rtc/rtc-rx8025.c b/drivers/rtc/rtc-rx8025.c
+index bd911bafb809..17341feadad1 100644
+--- a/drivers/rtc/rtc-rx8025.c
++++ b/drivers/rtc/rtc-rx8025.c
+@@ -65,7 +65,6 @@
+ 
+ static const struct i2c_device_id rx8025_id[] = {
+ 	{ "rx8025", 0 },
+-	{ "rv8803", 1 },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(i2c, rx8025_id);
+diff --git a/drivers/rtc/rtc-vr41xx.c b/drivers/rtc/rtc-vr41xx.c
+index f64c282275b3..e1b86bb01062 100644
+--- a/drivers/rtc/rtc-vr41xx.c
++++ b/drivers/rtc/rtc-vr41xx.c
+@@ -272,12 +272,13 @@ static irqreturn_t rtclong1_interrupt(int irq, void *dev_id)
+ }
+ 
+ static const struct rtc_class_ops vr41xx_rtc_ops = {
+-	.release	= vr41xx_rtc_release,
+-	.ioctl		= vr41xx_rtc_ioctl,
+-	.read_time	= vr41xx_rtc_read_time,
+-	.set_time	= vr41xx_rtc_set_time,
+-	.read_alarm	= vr41xx_rtc_read_alarm,
+-	.set_alarm	= vr41xx_rtc_set_alarm,
++	.release		= vr41xx_rtc_release,
++	.ioctl			= vr41xx_rtc_ioctl,
++	.read_time		= vr41xx_rtc_read_time,
++	.set_time		= vr41xx_rtc_set_time,
++	.read_alarm		= vr41xx_rtc_read_alarm,
++	.set_alarm		= vr41xx_rtc_set_alarm,
++	.alarm_irq_enable	= vr41xx_rtc_alarm_irq_enable,
+ };
+ 
+ static int rtc_probe(struct platform_device *pdev)
+diff --git a/drivers/scsi/device_handler/Kconfig b/drivers/scsi/device_handler/Kconfig
+index e5647d59224f..0b331c9c0a8f 100644
+--- a/drivers/scsi/device_handler/Kconfig
++++ b/drivers/scsi/device_handler/Kconfig
+@@ -13,13 +13,13 @@ menuconfig SCSI_DH
+ 
+ config SCSI_DH_RDAC
+ 	tristate "LSI RDAC Device Handler"
+-	depends on SCSI_DH
++	depends on SCSI_DH && SCSI
+ 	help
+ 	If you have a LSI RDAC select y. Otherwise, say N.
+ 
+ config SCSI_DH_HP_SW
+ 	tristate "HP/COMPAQ MSA Device Handler"
+-	depends on SCSI_DH
++	depends on SCSI_DH && SCSI
+ 	help
+ 	If you have a HP/COMPAQ MSA device that requires START_STOP to
+ 	be sent to start it and cannot upgrade the firmware then select y.
+@@ -27,13 +27,13 @@ config SCSI_DH_HP_SW
+ 
+ config SCSI_DH_EMC
+ 	tristate "EMC CLARiiON Device Handler"
+-	depends on SCSI_DH
++	depends on SCSI_DH && SCSI
+ 	help
+ 	If you have a EMC CLARiiON select y. Otherwise, say N.
+ 
+ config SCSI_DH_ALUA
+ 	tristate "SPC-3 ALUA Device Handler"
+-	depends on SCSI_DH
++	depends on SCSI_DH && SCSI
+ 	help
+ 	  SCSI Device handler for generic SPC-3 Asymmetric Logical Unit
+ 	  Access (ALUA).
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 97a1c1c33b05..00ce3e269a43 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -6282,12 +6282,13 @@ out:
+ 	}
+ 
+ 	for (i = 0; i < ioc->sge_count; i++) {
+-		if (kbuff_arr[i])
++		if (kbuff_arr[i]) {
+ 			dma_free_coherent(&instance->pdev->dev,
+ 					  le32_to_cpu(kern_sge32[i].length),
+ 					  kbuff_arr[i],
+ 					  le32_to_cpu(kern_sge32[i].phys_addr));
+ 			kbuff_arr[i] = NULL;
++		}
+ 	}
+ 
+ 	megasas_return_cmd(instance, cmd);
+diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
+index 7cb1b2d710c1..475fb44c1883 100644
+--- a/drivers/spi/spi-rockchip.c
++++ b/drivers/spi/spi-rockchip.c
+@@ -265,7 +265,10 @@ static inline u32 rx_max(struct rockchip_spi *rs)
+ static void rockchip_spi_set_cs(struct spi_device *spi, bool enable)
+ {
+ 	u32 ser;
+-	struct rockchip_spi *rs = spi_master_get_devdata(spi->master);
++	struct spi_master *master = spi->master;
++	struct rockchip_spi *rs = spi_master_get_devdata(master);
++
++	pm_runtime_get_sync(rs->dev);
+ 
+ 	ser = readl_relaxed(rs->regs + ROCKCHIP_SPI_SER) & SER_MASK;
+ 
+@@ -290,6 +293,8 @@ static void rockchip_spi_set_cs(struct spi_device *spi, bool enable)
+ 		ser &= ~(1 << spi->chip_select);
+ 
+ 	writel_relaxed(ser, rs->regs + ROCKCHIP_SPI_SER);
++
++	pm_runtime_put_sync(rs->dev);
+ }
+ 
+ static int rockchip_spi_prepare_message(struct spi_master *master,
+diff --git a/drivers/staging/rdma/hfi1/TODO b/drivers/staging/rdma/hfi1/TODO
+index 05de0dad8762..4c6f1d7d2eaf 100644
+--- a/drivers/staging/rdma/hfi1/TODO
++++ b/drivers/staging/rdma/hfi1/TODO
+@@ -3,4 +3,4 @@ July, 2015
+ - Remove unneeded file entries in sysfs
+ - Remove software processing of IB protocol and place in library for use
+   by qib, ipath (if still present), hfi1, and eventually soft-roce
+-
++- Replace incorrect uAPI
+diff --git a/drivers/staging/rdma/hfi1/file_ops.c b/drivers/staging/rdma/hfi1/file_ops.c
+index d57d549052c8..29ae777556d2 100644
+--- a/drivers/staging/rdma/hfi1/file_ops.c
++++ b/drivers/staging/rdma/hfi1/file_ops.c
+@@ -52,6 +52,8 @@
+ #include <linux/vmalloc.h>
+ #include <linux/io.h>
+ 
++#include <rdma/ib.h>
++
+ #include "hfi.h"
+ #include "pio.h"
+ #include "device.h"
+@@ -194,6 +196,10 @@ static ssize_t hfi1_file_write(struct file *fp, const char __user *data,
+ 	int uctxt_required = 1;
+ 	int must_be_root = 0;
+ 
++	/* FIXME: This interface cannot continue out of staging */
++	if (WARN_ON_ONCE(!ib_safe_file_access(fp)))
++		return -EACCES;
++
+ 	if (count < sizeof(cmd)) {
+ 		ret = -EINVAL;
+ 		goto bail;
+diff --git a/drivers/thermal/rockchip_thermal.c b/drivers/thermal/rockchip_thermal.c
+index b58e3fb9b311..433085a97626 100644
+--- a/drivers/thermal/rockchip_thermal.c
++++ b/drivers/thermal/rockchip_thermal.c
+@@ -693,15 +693,14 @@ static int rockchip_configure_from_dt(struct device *dev,
+ 			 thermal->chip->tshut_temp);
+ 		thermal->tshut_temp = thermal->chip->tshut_temp;
+ 	} else {
++		if (shut_temp > INT_MAX) {
++			dev_err(dev, "Invalid tshut temperature specified: %d\n",
++				shut_temp);
++			return -ERANGE;
++		}
+ 		thermal->tshut_temp = shut_temp;
+ 	}
+ 
+-	if (thermal->tshut_temp > INT_MAX) {
+-		dev_err(dev, "Invalid tshut temperature specified: %d\n",
+-			thermal->tshut_temp);
+-		return -ERANGE;
+-	}
+-
+ 	if (of_property_read_u32(np, "rockchip,hw-tshut-mode", &tshut_mode)) {
+ 		dev_warn(dev,
+ 			 "Missing tshut mode property, using default (%s)\n",
+diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
+index 9eb1cff28bd4..b8b580e5ae6e 100644
+--- a/drivers/usb/core/hcd-pci.c
++++ b/drivers/usb/core/hcd-pci.c
+@@ -74,6 +74,15 @@ static void for_each_companion(struct pci_dev *pdev, struct usb_hcd *hcd,
+ 		if (companion->bus != pdev->bus ||
+ 				PCI_SLOT(companion->devfn) != slot)
+ 			continue;
++
++		/*
++		 * Companion device should be either UHCI,OHCI or EHCI host
++		 * controller, otherwise skip.
++		 */
++		if (companion->class != CL_UHCI && companion->class != CL_OHCI &&
++				companion->class != CL_EHCI)
++			continue;
++
+ 		companion_hcd = pci_get_drvdata(companion);
+ 		if (!companion_hcd || !companion_hcd->self.root_hub)
+ 			continue;
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index cf43e9e18368..79d895c2dd71 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -646,6 +646,7 @@ static void ffs_user_copy_worker(struct work_struct *work)
+ 						   work);
+ 	int ret = io_data->req->status ? io_data->req->status :
+ 					 io_data->req->actual;
++	bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD;
+ 
+ 	if (io_data->read && ret > 0) {
+ 		use_mm(io_data->mm);
+@@ -657,13 +658,11 @@ static void ffs_user_copy_worker(struct work_struct *work)
+ 
+ 	io_data->kiocb->ki_complete(io_data->kiocb, ret, ret);
+ 
+-	if (io_data->ffs->ffs_eventfd &&
+-	    !(io_data->kiocb->ki_flags & IOCB_EVENTFD))
++	if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd)
+ 		eventfd_signal(io_data->ffs->ffs_eventfd, 1);
+ 
+ 	usb_ep_free_request(io_data->ep, io_data->req);
+ 
+-	io_data->kiocb->private = NULL;
+ 	if (io_data->read)
+ 		kfree(io_data->to_free);
+ 	kfree(io_data->buf);
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 5cd080e0a685..743d9a20e248 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1873,6 +1873,12 @@ no_bw:
+ 	kfree(xhci->rh_bw);
+ 	kfree(xhci->ext_caps);
+ 
++	xhci->usb2_ports = NULL;
++	xhci->usb3_ports = NULL;
++	xhci->port_array = NULL;
++	xhci->rh_bw = NULL;
++	xhci->ext_caps = NULL;
++
+ 	xhci->page_size = 0;
+ 	xhci->page_shift = 0;
+ 	xhci->bus_state[0].bus_suspended = 0;
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index f0640b7a1c42..48672fac7ff3 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -48,6 +48,7 @@
+ #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI		0xa12f
+ #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI	0x9d2f
+ #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI		0x0aa8
++#define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI		0x1aa8
+ 
+ static const char hcd_name[] = "xhci_hcd";
+ 
+@@ -155,7 +156,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 		(pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
+ 		 pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
+ 		 pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
+-		 pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI)) {
++		 pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI ||
++		 pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI)) {
+ 		xhci->quirks |= XHCI_PME_STUCK_QUIRK;
+ 	}
+ 	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+@@ -302,6 +304,7 @@ static void xhci_pci_remove(struct pci_dev *dev)
+ 	struct xhci_hcd *xhci;
+ 
+ 	xhci = hcd_to_xhci(pci_get_drvdata(dev));
++	xhci->xhc_state |= XHCI_STATE_REMOVING;
+ 	if (xhci->shared_hcd) {
+ 		usb_remove_hcd(xhci->shared_hcd);
+ 		usb_put_hcd(xhci->shared_hcd);
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index d39d6bf1d090..d4962208be30 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -39,12 +39,25 @@ static const struct xhci_driver_overrides xhci_plat_overrides __initconst = {
+ 
+ static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci)
+ {
++	struct usb_hcd *hcd = xhci_to_hcd(xhci);
++
+ 	/*
+ 	 * As of now platform drivers don't provide MSI support so we ensure
+ 	 * here that the generic code does not try to make a pci_dev from our
+ 	 * dev struct in order to setup MSI
+ 	 */
+ 	xhci->quirks |= XHCI_PLAT;
++
++	/*
++	 * On R-Car Gen2 and Gen3, the AC64 bit (bit 0) of HCCPARAMS1 is set
++	 * to 1. However, these SoCs don't support 64-bit address memory
++	 * pointers. So, this driver clears the AC64 bit of xhci->hcc_params
++	 * to call dma_set_coherent_mask(dev, DMA_BIT_MASK(32)) in
++	 * xhci_gen_setup().
++	 */
++	if (xhci_plat_type_is(hcd, XHCI_PLAT_TYPE_RENESAS_RCAR_GEN2) ||
++	    xhci_plat_type_is(hcd, XHCI_PLAT_TYPE_RENESAS_RCAR_GEN3))
++		xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
+ }
+ 
+ /* called during probe() after chip reset completes */
+diff --git a/drivers/usb/host/xhci-plat.h b/drivers/usb/host/xhci-plat.h
+index 5a2e2e3936c4..529c3c40f901 100644
+--- a/drivers/usb/host/xhci-plat.h
++++ b/drivers/usb/host/xhci-plat.h
+@@ -14,7 +14,7 @@
+ #include "xhci.h"	/* for hcd_to_xhci() */
+ 
+ enum xhci_plat_type {
+-	XHCI_PLAT_TYPE_MARVELL_ARMADA,
++	XHCI_PLAT_TYPE_MARVELL_ARMADA = 1,
+ 	XHCI_PLAT_TYPE_RENESAS_RCAR_GEN2,
+ 	XHCI_PLAT_TYPE_RENESAS_RCAR_GEN3,
+ };
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 3915657e6078..a85a1c993d61 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -4014,7 +4014,8 @@ static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd,
+ 	int reserved_trbs = xhci->cmd_ring_reserved_trbs;
+ 	int ret;
+ 
+-	if (xhci->xhc_state) {
++	if ((xhci->xhc_state & XHCI_STATE_DYING) ||
++		(xhci->xhc_state & XHCI_STATE_HALTED)) {
+ 		xhci_dbg(xhci, "xHCI dying or halted, can't queue_command\n");
+ 		return -ESHUTDOWN;
+ 	}
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 0c8087d3c313..8e713cca58ed 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -147,7 +147,8 @@ static int xhci_start(struct xhci_hcd *xhci)
+ 				"waited %u microseconds.\n",
+ 				XHCI_MAX_HALT_USEC);
+ 	if (!ret)
+-		xhci->xhc_state &= ~(XHCI_STATE_HALTED | XHCI_STATE_DYING);
++		/* clear state flags. Including dying, halted or removing */
++		xhci->xhc_state = 0;
+ 
+ 	return ret;
+ }
+@@ -1108,8 +1109,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ 		/* Resume root hubs only when have pending events. */
+ 		status = readl(&xhci->op_regs->status);
+ 		if (status & STS_EINT) {
+-			usb_hcd_resume_root_hub(hcd);
+ 			usb_hcd_resume_root_hub(xhci->shared_hcd);
++			usb_hcd_resume_root_hub(hcd);
+ 		}
+ 	}
+ 
+@@ -1124,10 +1125,10 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ 
+ 	/* Re-enable port polling. */
+ 	xhci_dbg(xhci, "%s: starting port polling.\n", __func__);
+-	set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+-	usb_hcd_poll_rh_status(hcd);
+ 	set_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
+ 	usb_hcd_poll_rh_status(xhci->shared_hcd);
++	set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
++	usb_hcd_poll_rh_status(hcd);
+ 
+ 	return retval;
+ }
+@@ -2770,7 +2771,8 @@ int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
+ 	if (ret <= 0)
+ 		return ret;
+ 	xhci = hcd_to_xhci(hcd);
+-	if (xhci->xhc_state & XHCI_STATE_DYING)
++	if ((xhci->xhc_state & XHCI_STATE_DYING) ||
++		(xhci->xhc_state & XHCI_STATE_REMOVING))
+ 		return -ENODEV;
+ 
+ 	xhci_dbg(xhci, "%s called for udev %p\n", __func__, udev);
+@@ -3817,7 +3819,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
+ 
+ 	mutex_lock(&xhci->mutex);
+ 
+-	if (xhci->xhc_state)	/* dying or halted */
++	if (xhci->xhc_state)	/* dying, removing or halted */
+ 		goto out;
+ 
+ 	if (!udev->slot_id) {
+@@ -4944,6 +4946,16 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+ 		return retval;
+ 	xhci_dbg(xhci, "Reset complete\n");
+ 
++	/*
++	 * On some xHCI controllers (e.g. R-Car SoCs), the AC64 bit (bit 0)
++	 * of HCCPARAMS1 is set to 1. However, the xHCs don't support 64-bit
++	 * address memory pointers actually. So, this driver clears the AC64
++	 * bit of xhci->hcc_params to call dma_set_coherent_mask(dev,
++	 * DMA_BIT_MASK(32)) in this xhci_gen_setup().
++	 */
++	if (xhci->quirks & XHCI_NO_64BIT_SUPPORT)
++		xhci->hcc_params &= ~BIT(0);
++
+ 	/* Set dma_mask and coherent_dma_mask to 64-bits,
+ 	 * if xHC supports 64-bit addressing */
+ 	if (HCC_64BIT_ADDR(xhci->hcc_params) &&
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index cc651383ce5a..1cdea4a8c895 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1596,6 +1596,7 @@ struct xhci_hcd {
+  */
+ #define XHCI_STATE_DYING	(1 << 0)
+ #define XHCI_STATE_HALTED	(1 << 1)
++#define XHCI_STATE_REMOVING	(1 << 2)
+ 	/* Statistics */
+ 	int			error_bitmask;
+ 	unsigned int		quirks;
+@@ -1632,6 +1633,7 @@ struct xhci_hcd {
+ #define XHCI_PME_STUCK_QUIRK	(1 << 20)
+ #define XHCI_MTK_HOST		(1 << 21)
+ #define XHCI_SSIC_PORT_UNUSED	(1 << 22)
++#define XHCI_NO_64BIT_SUPPORT	(1 << 23)
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
+ 	/* There are two roothubs to keep track of bus suspend info for */
+diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
+index facaaf003f19..e40da7759a0e 100644
+--- a/drivers/usb/usbip/usbip_common.c
++++ b/drivers/usb/usbip/usbip_common.c
+@@ -741,6 +741,17 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
+ 	if (!(size > 0))
+ 		return 0;
+ 
++	if (size > urb->transfer_buffer_length) {
++		/* should not happen, probably malicious packet */
++		if (ud->side == USBIP_STUB) {
++			usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
++			return 0;
++		} else {
++			usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
++			return -EPIPE;
++		}
++	}
++
+ 	ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
+ 	if (ret != size) {
+ 		dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);
+diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
+index 8ea45a5cd806..d889ef2048df 100644
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -2246,7 +2246,6 @@ config XEN_FBDEV_FRONTEND
+ 	select FB_SYS_IMAGEBLIT
+ 	select FB_SYS_FOPS
+ 	select FB_DEFERRED_IO
+-	select INPUT_XEN_KBDDEV_FRONTEND if INPUT_MISC
+ 	select XEN_XENBUS_FRONTEND
+ 	default y
+ 	help
+diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c
+index 9362424c2340..f9ef06d0cd48 100644
+--- a/drivers/video/fbdev/amba-clcd.c
++++ b/drivers/video/fbdev/amba-clcd.c
+@@ -440,13 +440,14 @@ static int clcdfb_register(struct clcd_fb *fb)
+ 		fb->off_ienb = CLCD_PL111_IENB;
+ 		fb->off_cntl = CLCD_PL111_CNTL;
+ 	} else {
+-#ifdef CONFIG_ARCH_VERSATILE
+-		fb->off_ienb = CLCD_PL111_IENB;
+-		fb->off_cntl = CLCD_PL111_CNTL;
+-#else
+-		fb->off_ienb = CLCD_PL110_IENB;
+-		fb->off_cntl = CLCD_PL110_CNTL;
+-#endif
++		if (of_machine_is_compatible("arm,versatile-ab") ||
++		    of_machine_is_compatible("arm,versatile-pb")) {
++			fb->off_ienb = CLCD_PL111_IENB;
++			fb->off_cntl = CLCD_PL111_CNTL;
++		} else {
++			fb->off_ienb = CLCD_PL110_IENB;
++			fb->off_cntl = CLCD_PL110_CNTL;
++		}
+ 	}
+ 
+ 	fb->clk = clk_get(&fb->dev->dev, NULL);
+diff --git a/drivers/video/fbdev/da8xx-fb.c b/drivers/video/fbdev/da8xx-fb.c
+index 6b2a06d09f2b..d8d583d32a37 100644
+--- a/drivers/video/fbdev/da8xx-fb.c
++++ b/drivers/video/fbdev/da8xx-fb.c
+@@ -209,8 +209,7 @@ static struct fb_videomode known_lcd_panels[] = {
+ 		.lower_margin   = 2,
+ 		.hsync_len      = 0,
+ 		.vsync_len      = 0,
+-		.sync           = FB_SYNC_CLK_INVERT |
+-			FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
++		.sync           = FB_SYNC_CLK_INVERT,
+ 	},
+ 	/* Sharp LK043T1DG01 */
+ 	[1] = {
+@@ -224,7 +223,7 @@ static struct fb_videomode known_lcd_panels[] = {
+ 		.lower_margin   = 2,
+ 		.hsync_len      = 41,
+ 		.vsync_len      = 10,
+-		.sync           = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
++		.sync           = 0,
+ 		.flag           = 0,
+ 	},
+ 	[2] = {
+@@ -239,7 +238,7 @@ static struct fb_videomode known_lcd_panels[] = {
+ 		.lower_margin   = 10,
+ 		.hsync_len      = 10,
+ 		.vsync_len      = 10,
+-		.sync           = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
++		.sync           = 0,
+ 		.flag           = 0,
+ 	},
+ 	[3] = {
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 4545e2e2ad45..d8d68af5aef0 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -1830,7 +1830,7 @@ static int cleaner_kthread(void *arg)
+ 		 */
+ 		btrfs_delete_unused_bgs(root->fs_info);
+ sleep:
+-		if (!try_to_freeze() && !again) {
++		if (!again) {
+ 			set_current_state(TASK_INTERRUPTIBLE);
+ 			if (!kthread_should_stop())
+ 				schedule();
+diff --git a/fs/btrfs/tests/btrfs-tests.c b/fs/btrfs/tests/btrfs-tests.c
+index 0e1e61a7ec23..d39f714dabeb 100644
+--- a/fs/btrfs/tests/btrfs-tests.c
++++ b/fs/btrfs/tests/btrfs-tests.c
+@@ -189,12 +189,6 @@ btrfs_alloc_dummy_block_group(unsigned long length)
+ 		kfree(cache);
+ 		return NULL;
+ 	}
+-	cache->fs_info = btrfs_alloc_dummy_fs_info();
+-	if (!cache->fs_info) {
+-		kfree(cache->free_space_ctl);
+-		kfree(cache);
+-		return NULL;
+-	}
+ 
+ 	cache->key.objectid = 0;
+ 	cache->key.offset = length;
+diff --git a/fs/btrfs/tests/free-space-tree-tests.c b/fs/btrfs/tests/free-space-tree-tests.c
+index d05fe1ab4808..7cea4462acd5 100644
+--- a/fs/btrfs/tests/free-space-tree-tests.c
++++ b/fs/btrfs/tests/free-space-tree-tests.c
+@@ -485,6 +485,7 @@ static int run_test(test_func_t test_func, int bitmaps)
+ 	cache->bitmap_low_thresh = 0;
+ 	cache->bitmap_high_thresh = (u32)-1;
+ 	cache->needs_free_space = 1;
++	cache->fs_info = root->fs_info;
+ 
+ 	btrfs_init_dummy_trans(&trans);
+ 
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index bece948b363d..8580831ed237 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -457,7 +457,7 @@ struct dentry *debugfs_create_automount(const char *name,
+ 	if (unlikely(!inode))
+ 		return failed_creating(dentry);
+ 
+-	inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
++	make_empty_dir_inode(inode);
+ 	inode->i_flags |= S_AUTOMOUNT;
+ 	inode->i_private = data;
+ 	dentry->d_fsdata = (void *)f;
+diff --git a/fs/ext4/crypto.c b/fs/ext4/crypto.c
+index ecb54394492a..25634c353191 100644
+--- a/fs/ext4/crypto.c
++++ b/fs/ext4/crypto.c
+@@ -34,6 +34,7 @@
+ #include <linux/random.h>
+ #include <linux/scatterlist.h>
+ #include <linux/spinlock_types.h>
++#include <linux/namei.h>
+ 
+ #include "ext4_extents.h"
+ #include "xattr.h"
+@@ -479,6 +480,9 @@ static int ext4_d_revalidate(struct dentry *dentry, unsigned int flags)
+ 	struct ext4_crypt_info *ci;
+ 	int dir_has_key, cached_with_key;
+ 
++	if (flags & LOOKUP_RCU)
++		return -ECHILD;
++
+ 	dir = dget_parent(dentry);
+ 	if (!ext4_encrypted_inode(d_inode(dir))) {
+ 		dput(dir);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index aee960b1af34..e6218cbc8332 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5261,6 +5261,8 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
+ 	might_sleep();
+ 	trace_ext4_mark_inode_dirty(inode, _RET_IP_);
+ 	err = ext4_reserve_inode_write(handle, inode, &iloc);
++	if (err)
++		return err;
+ 	if (ext4_handle_valid(handle) &&
+ 	    EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize &&
+ 	    !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) {
+@@ -5291,9 +5293,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
+ 			}
+ 		}
+ 	}
+-	if (!err)
+-		err = ext4_mark_iloc_dirty(handle, inode, &iloc);
+-	return err;
++	return ext4_mark_iloc_dirty(handle, inode, &iloc);
+ }
+ 
+ /*
+diff --git a/fs/f2fs/crypto_policy.c b/fs/f2fs/crypto_policy.c
+index d4a96af513c2..596f02490f27 100644
+--- a/fs/f2fs/crypto_policy.c
++++ b/fs/f2fs/crypto_policy.c
+@@ -192,7 +192,8 @@ int f2fs_inherit_context(struct inode *parent, struct inode *child,
+ 		return res;
+ 
+ 	ci = F2FS_I(parent)->i_crypt_info;
+-	BUG_ON(ci == NULL);
++	if (ci == NULL)
++		return -ENOKEY;
+ 
+ 	ctx.format = F2FS_ENCRYPTION_CONTEXT_FORMAT_V1;
+ 
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 5c06db17e41f..44802599fa67 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -67,7 +67,6 @@ static void f2fs_write_end_io(struct bio *bio)
+ 		f2fs_restore_and_release_control_page(&page);
+ 
+ 		if (unlikely(bio->bi_error)) {
+-			set_page_dirty(page);
+ 			set_bit(AS_EIO, &page->mapping->flags);
+ 			f2fs_stop_checkpoint(sbi);
+ 		}
+@@ -504,7 +503,7 @@ static int __allocate_data_blocks(struct inode *inode, loff_t offset,
+ 	struct dnode_of_data dn;
+ 	u64 start = F2FS_BYTES_TO_BLK(offset);
+ 	u64 len = F2FS_BYTES_TO_BLK(count);
+-	bool allocated;
++	bool allocated = false;
+ 	u64 end_offset;
+ 	int err = 0;
+ 
+@@ -546,7 +545,7 @@ static int __allocate_data_blocks(struct inode *inode, loff_t offset,
+ 		f2fs_put_dnode(&dn);
+ 		f2fs_unlock_op(sbi);
+ 
+-		f2fs_balance_fs(sbi, dn.node_changed);
++		f2fs_balance_fs(sbi, allocated);
+ 	}
+ 	return err;
+ 
+@@ -556,7 +555,7 @@ sync_out:
+ 	f2fs_put_dnode(&dn);
+ out:
+ 	f2fs_unlock_op(sbi);
+-	f2fs_balance_fs(sbi, dn.node_changed);
++	f2fs_balance_fs(sbi, allocated);
+ 	return err;
+ }
+ 
+@@ -650,14 +649,14 @@ get_next:
+ 	if (dn.ofs_in_node >= end_offset) {
+ 		if (allocated)
+ 			sync_inode_page(&dn);
+-		allocated = false;
+ 		f2fs_put_dnode(&dn);
+ 
+ 		if (create) {
+ 			f2fs_unlock_op(sbi);
+-			f2fs_balance_fs(sbi, dn.node_changed);
++			f2fs_balance_fs(sbi, allocated);
+ 			f2fs_lock_op(sbi);
+ 		}
++		allocated = false;
+ 
+ 		set_new_dnode(&dn, inode, NULL, NULL, 0);
+ 		err = get_dnode_of_data(&dn, pgofs, mode);
+@@ -715,7 +714,7 @@ put_out:
+ unlock_out:
+ 	if (create) {
+ 		f2fs_unlock_op(sbi);
+-		f2fs_balance_fs(sbi, dn.node_changed);
++		f2fs_balance_fs(sbi, allocated);
+ 	}
+ out:
+ 	trace_f2fs_map_blocks(inode, map, err);
+diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
+index faa7495e2d7e..30e6b6563494 100644
+--- a/fs/f2fs/dir.c
++++ b/fs/f2fs/dir.c
+@@ -892,11 +892,19 @@ out:
+ 	return err;
+ }
+ 
++static int f2fs_dir_open(struct inode *inode, struct file *filp)
++{
++	if (f2fs_encrypted_inode(inode))
++		return f2fs_get_encryption_info(inode) ? -EACCES : 0;
++	return 0;
++}
++
+ const struct file_operations f2fs_dir_operations = {
+ 	.llseek		= generic_file_llseek,
+ 	.read		= generic_read_dir,
+ 	.iterate	= f2fs_readdir,
+ 	.fsync		= f2fs_sync_file,
++	.open		= f2fs_dir_open,
+ 	.unlocked_ioctl	= f2fs_ioctl,
+ #ifdef CONFIG_COMPAT
+ 	.compat_ioctl   = f2fs_compat_ioctl,
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index ea272be62677..5a322bc00ac4 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -425,6 +425,8 @@ static int f2fs_file_mmap(struct file *file, struct vm_area_struct *vma)
+ 		err = f2fs_get_encryption_info(inode);
+ 		if (err)
+ 			return 0;
++		if (!f2fs_encrypted_inode(inode))
++			return -ENOKEY;
+ 	}
+ 
+ 	/* we don't need to use inline_data strictly */
+@@ -444,7 +446,9 @@ static int f2fs_file_open(struct inode *inode, struct file *filp)
+ 	if (!ret && f2fs_encrypted_inode(inode)) {
+ 		ret = f2fs_get_encryption_info(inode);
+ 		if (ret)
+-			ret = -EACCES;
++			return -EACCES;
++		if (!f2fs_encrypted_inode(inode))
++			return -ENOKEY;
+ 	}
+ 	return ret;
+ }
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index 6f944e5eb76e..7e9e38769660 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -980,12 +980,6 @@ static const char *f2fs_encrypted_get_link(struct dentry *dentry,
+ 	}
+ 	memcpy(cstr.name, sd->encrypted_path, cstr.len);
+ 
+-	/* this is broken symlink case */
+-	if (unlikely(cstr.name[0] == 0)) {
+-		res = -ENOENT;
+-		goto errout;
+-	}
+-
+ 	if ((cstr.len + sizeof(struct f2fs_encrypted_symlink_data) - 1) >
+ 								max_size) {
+ 		/* Symlink data on the disk is corrupted */
+@@ -1002,6 +996,12 @@ static const char *f2fs_encrypted_get_link(struct dentry *dentry,
+ 
+ 	kfree(cstr.name);
+ 
++	/* this is broken symlink case */
++	if (unlikely(pstr.name[0] == 0)) {
++		res = -ENOENT;
++		goto errout;
++	}
++
+ 	paddr = pstr.name;
+ 
+ 	/* Null-terminate the name */
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 6134832baaaf..013a62b2f8ca 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -926,9 +926,25 @@ static loff_t max_file_blocks(void)
+ 	return result;
+ }
+ 
++static int __f2fs_commit_super(struct buffer_head *bh,
++			struct f2fs_super_block *super)
++{
++	lock_buffer(bh);
++	if (super)
++		memcpy(bh->b_data + F2FS_SUPER_OFFSET, super, sizeof(*super));
++	set_buffer_uptodate(bh);
++	set_buffer_dirty(bh);
++	unlock_buffer(bh);
++
++	/* it's rare case, we can do fua all the time */
++	return __sync_dirty_buffer(bh, WRITE_FLUSH_FUA);
++}
++
+ static inline bool sanity_check_area_boundary(struct super_block *sb,
+-					struct f2fs_super_block *raw_super)
++					struct buffer_head *bh)
+ {
++	struct f2fs_super_block *raw_super = (struct f2fs_super_block *)
++					(bh->b_data + F2FS_SUPER_OFFSET);
+ 	u32 segment0_blkaddr = le32_to_cpu(raw_super->segment0_blkaddr);
+ 	u32 cp_blkaddr = le32_to_cpu(raw_super->cp_blkaddr);
+ 	u32 sit_blkaddr = le32_to_cpu(raw_super->sit_blkaddr);
+@@ -942,6 +958,10 @@ static inline bool sanity_check_area_boundary(struct super_block *sb,
+ 	u32 segment_count_main = le32_to_cpu(raw_super->segment_count_main);
+ 	u32 segment_count = le32_to_cpu(raw_super->segment_count);
+ 	u32 log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg);
++	u64 main_end_blkaddr = main_blkaddr +
++				(segment_count_main << log_blocks_per_seg);
++	u64 seg_end_blkaddr = segment0_blkaddr +
++				(segment_count << log_blocks_per_seg);
+ 
+ 	if (segment0_blkaddr != cp_blkaddr) {
+ 		f2fs_msg(sb, KERN_INFO,
+@@ -986,22 +1006,45 @@ static inline bool sanity_check_area_boundary(struct super_block *sb,
+ 		return true;
+ 	}
+ 
+-	if (main_blkaddr + (segment_count_main << log_blocks_per_seg) !=
+-		segment0_blkaddr + (segment_count << log_blocks_per_seg)) {
++	if (main_end_blkaddr > seg_end_blkaddr) {
+ 		f2fs_msg(sb, KERN_INFO,
+-			"Wrong MAIN_AREA boundary, start(%u) end(%u) blocks(%u)",
++			"Wrong MAIN_AREA boundary, start(%u) end(%u) block(%u)",
+ 			main_blkaddr,
+-			segment0_blkaddr + (segment_count << log_blocks_per_seg),
++			segment0_blkaddr +
++				(segment_count << log_blocks_per_seg),
+ 			segment_count_main << log_blocks_per_seg);
+ 		return true;
++	} else if (main_end_blkaddr < seg_end_blkaddr) {
++		int err = 0;
++		char *res;
++
++		/* fix in-memory information all the time */
++		raw_super->segment_count = cpu_to_le32((main_end_blkaddr -
++				segment0_blkaddr) >> log_blocks_per_seg);
++
++		if (f2fs_readonly(sb) || bdev_read_only(sb->s_bdev)) {
++			res = "internally";
++		} else {
++			err = __f2fs_commit_super(bh, NULL);
++			res = err ? "failed" : "done";
++		}
++		f2fs_msg(sb, KERN_INFO,
++			"Fix alignment : %s, start(%u) end(%u) block(%u)",
++			res, main_blkaddr,
++			segment0_blkaddr +
++				(segment_count << log_blocks_per_seg),
++			segment_count_main << log_blocks_per_seg);
++		if (err)
++			return true;
+ 	}
+-
+ 	return false;
+ }
+ 
+ static int sanity_check_raw_super(struct super_block *sb,
+-			struct f2fs_super_block *raw_super)
++				struct buffer_head *bh)
+ {
++	struct f2fs_super_block *raw_super = (struct f2fs_super_block *)
++					(bh->b_data + F2FS_SUPER_OFFSET);
+ 	unsigned int blocksize;
+ 
+ 	if (F2FS_SUPER_MAGIC != le32_to_cpu(raw_super->magic)) {
+@@ -1068,7 +1111,7 @@ static int sanity_check_raw_super(struct super_block *sb,
+ 	}
+ 
+ 	/* check CP/SIT/NAT/SSA/MAIN_AREA area boundary */
+-	if (sanity_check_area_boundary(sb, raw_super))
++	if (sanity_check_area_boundary(sb, bh))
+ 		return 1;
+ 
+ 	return 0;
+@@ -1134,103 +1177,87 @@ static void init_sb_info(struct f2fs_sb_info *sbi)
+ 
+ /*
+  * Read f2fs raw super block.
+- * Because we have two copies of super block, so read the first one at first,
+- * if the first one is invalid, move to read the second one.
++ * Because we have two copies of super block, so read both of them
++ * to get the first valid one. If any one of them is broken, we pass
++ * them recovery flag back to the caller.
+  */
+ static int read_raw_super_block(struct super_block *sb,
+ 			struct f2fs_super_block **raw_super,
+ 			int *valid_super_block, int *recovery)
+ {
+-	int block = 0;
++	int block;
+ 	struct buffer_head *bh;
+-	struct f2fs_super_block *super, *buf;
++	struct f2fs_super_block *super;
+ 	int err = 0;
+ 
+ 	super = kzalloc(sizeof(struct f2fs_super_block), GFP_KERNEL);
+ 	if (!super)
+ 		return -ENOMEM;
+-retry:
+-	bh = sb_bread(sb, block);
+-	if (!bh) {
+-		*recovery = 1;
+-		f2fs_msg(sb, KERN_ERR, "Unable to read %dth superblock",
++
++	for (block = 0; block < 2; block++) {
++		bh = sb_bread(sb, block);
++		if (!bh) {
++			f2fs_msg(sb, KERN_ERR, "Unable to read %dth superblock",
+ 				block + 1);
+-		err = -EIO;
+-		goto next;
+-	}
++			err = -EIO;
++			continue;
++		}
+ 
+-	buf = (struct f2fs_super_block *)(bh->b_data + F2FS_SUPER_OFFSET);
++		/* sanity checking of raw super */
++		if (sanity_check_raw_super(sb, bh)) {
++			f2fs_msg(sb, KERN_ERR,
++				"Can't find valid F2FS filesystem in %dth superblock",
++				block + 1);
++			err = -EINVAL;
++			brelse(bh);
++			continue;
++		}
+ 
+-	/* sanity checking of raw super */
+-	if (sanity_check_raw_super(sb, buf)) {
++		if (!*raw_super) {
++			memcpy(super, bh->b_data + F2FS_SUPER_OFFSET,
++							sizeof(*super));
++			*valid_super_block = block;
++			*raw_super = super;
++		}
+ 		brelse(bh);
+-		*recovery = 1;
+-		f2fs_msg(sb, KERN_ERR,
+-			"Can't find valid F2FS filesystem in %dth superblock",
+-								block + 1);
+-		err = -EINVAL;
+-		goto next;
+ 	}
+ 
+-	if (!*raw_super) {
+-		memcpy(super, buf, sizeof(*super));
+-		*valid_super_block = block;
+-		*raw_super = super;
+-	}
+-	brelse(bh);
+-
+-next:
+-	/* check the validity of the second superblock */
+-	if (block == 0) {
+-		block++;
+-		goto retry;
+-	}
++	/* Fail to read any one of the superblocks*/
++	if (err < 0)
++		*recovery = 1;
+ 
+ 	/* No valid superblock */
+-	if (!*raw_super) {
++	if (!*raw_super)
+ 		kfree(super);
+-		return err;
+-	}
++	else
++		err = 0;
+ 
+-	return 0;
++	return err;
+ }
+ 
+-static int __f2fs_commit_super(struct f2fs_sb_info *sbi, int block)
++int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover)
+ {
+-	struct f2fs_super_block *super = F2FS_RAW_SUPER(sbi);
+ 	struct buffer_head *bh;
+ 	int err;
+ 
+-	bh = sb_getblk(sbi->sb, block);
++	/* write back-up superblock first */
++	bh = sb_getblk(sbi->sb, sbi->valid_super_block ? 0: 1);
+ 	if (!bh)
+ 		return -EIO;
+-
+-	lock_buffer(bh);
+-	memcpy(bh->b_data + F2FS_SUPER_OFFSET, super, sizeof(*super));
+-	set_buffer_uptodate(bh);
+-	set_buffer_dirty(bh);
+-	unlock_buffer(bh);
+-
+-	/* it's rare case, we can do fua all the time */
+-	err = __sync_dirty_buffer(bh, WRITE_FLUSH_FUA);
++	err = __f2fs_commit_super(bh, F2FS_RAW_SUPER(sbi));
+ 	brelse(bh);
+ 
+-	return err;
+-}
+-
+-int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover)
+-{
+-	int err;
+-
+-	/* write back-up superblock first */
+-	err = __f2fs_commit_super(sbi, sbi->valid_super_block ? 0 : 1);
+-
+ 	/* if we are in recovery path, skip writing valid superblock */
+ 	if (recover || err)
+ 		return err;
+ 
+ 	/* write current valid superblock */
+-	return __f2fs_commit_super(sbi, sbi->valid_super_block);
++	bh = sb_getblk(sbi->sb, sbi->valid_super_block);
++	if (!bh)
++		return -EIO;
++	err = __f2fs_commit_super(bh, F2FS_RAW_SUPER(sbi));
++	brelse(bh);
++	return err;
+ }
+ 
+ static int f2fs_fill_super(struct super_block *sb, void *data, int silent)
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index fa95ab2d3674..9d2f3e0a6360 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -1504,6 +1504,32 @@ static struct page *can_gather_numa_stats(pte_t pte, struct vm_area_struct *vma,
+ 	return page;
+ }
+ 
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
++static struct page *can_gather_numa_stats_pmd(pmd_t pmd,
++					      struct vm_area_struct *vma,
++					      unsigned long addr)
++{
++	struct page *page;
++	int nid;
++
++	if (!pmd_present(pmd))
++		return NULL;
++
++	page = vm_normal_page_pmd(vma, addr, pmd);
++	if (!page)
++		return NULL;
++
++	if (PageReserved(page))
++		return NULL;
++
++	nid = page_to_nid(page);
++	if (!node_isset(nid, node_states[N_MEMORY]))
++		return NULL;
++
++	return page;
++}
++#endif
++
+ static int gather_pte_stats(pmd_t *pmd, unsigned long addr,
+ 		unsigned long end, struct mm_walk *walk)
+ {
+@@ -1513,14 +1539,14 @@ static int gather_pte_stats(pmd_t *pmd, unsigned long addr,
+ 	pte_t *orig_pte;
+ 	pte_t *pte;
+ 
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+ 	ptl = pmd_trans_huge_lock(pmd, vma);
+ 	if (ptl) {
+-		pte_t huge_pte = *(pte_t *)pmd;
+ 		struct page *page;
+ 
+-		page = can_gather_numa_stats(huge_pte, vma, addr);
++		page = can_gather_numa_stats_pmd(*pmd, vma, addr);
+ 		if (page)
+-			gather_stats(page, md, pte_dirty(huge_pte),
++			gather_stats(page, md, pmd_dirty(*pmd),
+ 				     HPAGE_PMD_SIZE/PAGE_SIZE);
+ 		spin_unlock(ptl);
+ 		return 0;
+@@ -1528,6 +1554,7 @@ static int gather_pte_stats(pmd_t *pmd, unsigned long addr,
+ 
+ 	if (pmd_trans_unstable(pmd))
+ 		return 0;
++#endif
+ 	orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
+ 	do {
+ 		struct page *page = can_gather_numa_stats(*pte, vma, addr);
+diff --git a/include/asm-generic/futex.h b/include/asm-generic/futex.h
+index e56272c919b5..bf2d34c9d804 100644
+--- a/include/asm-generic/futex.h
++++ b/include/asm-generic/futex.h
+@@ -108,11 +108,15 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
+ 	u32 val;
+ 
+ 	preempt_disable();
+-	if (unlikely(get_user(val, uaddr) != 0))
++	if (unlikely(get_user(val, uaddr) != 0)) {
++		preempt_enable();
+ 		return -EFAULT;
++	}
+ 
+-	if (val == oldval && unlikely(put_user(newval, uaddr) != 0))
++	if (val == oldval && unlikely(put_user(newval, uaddr) != 0)) {
++		preempt_enable();
+ 		return -EFAULT;
++	}
+ 
+ 	*uval = val;
+ 	preempt_enable();
+diff --git a/include/drm/drm_cache.h b/include/drm/drm_cache.h
+index 461a0558bca4..cebecff536a3 100644
+--- a/include/drm/drm_cache.h
++++ b/include/drm/drm_cache.h
+@@ -39,6 +39,8 @@ static inline bool drm_arch_can_wc_memory(void)
+ {
+ #if defined(CONFIG_PPC) && !defined(CONFIG_NOT_COHERENT_CACHE)
+ 	return false;
++#elif defined(CONFIG_MIPS) && defined(CONFIG_CPU_LOONGSON3)
++	return false;
+ #else
+ 	return true;
+ #endif
+diff --git a/include/keys/trusted-type.h b/include/keys/trusted-type.h
+index 42cf2d991bf4..4ea7e55f20b0 100644
+--- a/include/keys/trusted-type.h
++++ b/include/keys/trusted-type.h
+@@ -38,7 +38,7 @@ struct trusted_key_options {
+ 	unsigned char pcrinfo[MAX_PCRINFO_SIZE];
+ 	int pcrlock;
+ 	uint32_t hash;
+-	uint32_t digest_len;
++	uint32_t policydigest_len;
+ 	unsigned char policydigest[MAX_DIGEST_SIZE];
+ 	uint32_t policyhandle;
+ };
+diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
+index 89d944b25d87..7fc7cb7872e3 100644
+--- a/include/linux/cgroup-defs.h
++++ b/include/linux/cgroup-defs.h
+@@ -442,6 +442,7 @@ struct cgroup_subsys {
+ 	int (*can_attach)(struct cgroup_taskset *tset);
+ 	void (*cancel_attach)(struct cgroup_taskset *tset);
+ 	void (*attach)(struct cgroup_taskset *tset);
++	void (*post_attach)(void);
+ 	int (*can_fork)(struct task_struct *task);
+ 	void (*cancel_fork)(struct task_struct *task);
+ 	void (*fork)(struct task_struct *task);
+diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
+index fea160ee5803..85a868ccb493 100644
+--- a/include/linux/cpuset.h
++++ b/include/linux/cpuset.h
+@@ -137,8 +137,6 @@ static inline void set_mems_allowed(nodemask_t nodemask)
+ 	task_unlock(current);
+ }
+ 
+-extern void cpuset_post_attach_flush(void);
+-
+ #else /* !CONFIG_CPUSETS */
+ 
+ static inline bool cpusets_enabled(void) { return false; }
+@@ -245,10 +243,6 @@ static inline bool read_mems_allowed_retry(unsigned int seq)
+ 	return false;
+ }
+ 
+-static inline void cpuset_post_attach_flush(void)
+-{
+-}
+-
+ #endif /* !CONFIG_CPUSETS */
+ 
+ #endif /* _LINUX_CPUSET_H */
+diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
+index 987764afa65c..f8b83792939b 100644
+--- a/include/linux/mlx5/device.h
++++ b/include/linux/mlx5/device.h
+@@ -363,6 +363,17 @@ enum {
+ 	MLX5_CAP_OFF_CMDIF_CSUM		= 46,
+ };
+ 
++enum {
++	/*
++	 * Max wqe size for rdma read is 512 bytes, so this
++	 * limits our max_sge_rd as the wqe needs to fit:
++	 * - ctrl segment (16 bytes)
++	 * - rdma segment (16 bytes)
++	 * - scatter elements (16 bytes each)
++	 */
++	MLX5_MAX_SGE_RD	= (512 - 16 - 16) / 16
++};
++
+ struct mlx5_inbox_hdr {
+ 	__be16		opcode;
+ 	u8		rsvd[4];
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 516e14944339..a6c240e885c0 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1010,6 +1010,8 @@ static inline bool page_mapped(struct page *page)
+ 	page = compound_head(page);
+ 	if (atomic_read(compound_mapcount_ptr(page)) >= 0)
+ 		return true;
++	if (PageHuge(page))
++		return false;
+ 	for (i = 0; i < hpage_nr_pages(page); i++) {
+ 		if (atomic_read(&page[i]._mapcount) >= 0)
+ 			return true;
+@@ -1117,6 +1119,8 @@ struct zap_details {
+ 
+ struct page *vm_normal_page(struct vm_area_struct *vma, unsigned long addr,
+ 		pte_t pte);
++struct page *vm_normal_page_pmd(struct vm_area_struct *vma, unsigned long addr,
++				pmd_t pmd);
+ 
+ int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address,
+ 		unsigned long size);
+diff --git a/include/linux/platform_data/mmp_dma.h b/include/linux/platform_data/mmp_dma.h
+index 2a330ec9e2af..d1397c8ed94e 100644
+--- a/include/linux/platform_data/mmp_dma.h
++++ b/include/linux/platform_data/mmp_dma.h
+@@ -14,6 +14,7 @@
+ 
+ struct mmp_dma_platdata {
+ 	int dma_channels;
++	int nb_requestors;
+ };
+ 
+ #endif /* MMP_DMA_H */
+diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h
+index 8a0f55b6c2ba..88e3ab496e8f 100644
+--- a/include/media/videobuf2-core.h
++++ b/include/media/videobuf2-core.h
+@@ -375,6 +375,9 @@ struct vb2_ops {
+ /**
+  * struct vb2_ops - driver-specific callbacks
+  *
++ * @verify_planes_array: Verify that a given user space structure contains
++ *			enough planes for the buffer. This is called
++ *			for each dequeued buffer.
+  * @fill_user_buffer:	given a vb2_buffer fill in the userspace structure.
+  *			For V4L2 this is a struct v4l2_buffer.
+  * @fill_vb2_buffer:	given a userspace structure, fill in the vb2_buffer.
+@@ -384,6 +387,7 @@ struct vb2_ops {
+  *			the vb2_buffer struct.
+  */
+ struct vb2_buf_ops {
++	int (*verify_planes_array)(struct vb2_buffer *vb, const void *pb);
+ 	void (*fill_user_buffer)(struct vb2_buffer *vb, void *pb);
+ 	int (*fill_vb2_buffer)(struct vb2_buffer *vb, const void *pb,
+ 				struct vb2_plane *planes);
+@@ -400,6 +404,9 @@ struct vb2_buf_ops {
+  * @fileio_read_once:		report EOF after reading the first buffer
+  * @fileio_write_immediately:	queue buffer after each write() call
+  * @allow_zero_bytesused:	allow bytesused == 0 to be passed to the driver
++ * @quirk_poll_must_check_waiting_for_buffers: Return POLLERR at poll when QBUF
++ *              has not been called. This is a vb1 idiom that has been adopted
++ *              also by vb2.
+  * @lock:	pointer to a mutex that protects the vb2_queue struct. The
+  *		driver can set this to a mutex to let the v4l2 core serialize
+  *		the queuing ioctls. If the driver wants to handle locking
+@@ -463,6 +470,7 @@ struct vb2_queue {
+ 	unsigned			fileio_read_once:1;
+ 	unsigned			fileio_write_immediately:1;
+ 	unsigned			allow_zero_bytesused:1;
++	unsigned		   quirk_poll_must_check_waiting_for_buffers:1;
+ 
+ 	struct mutex			*lock;
+ 	void				*owner;
+diff --git a/include/rdma/ib.h b/include/rdma/ib.h
+index cf8f9e700e48..a6b93706b0fc 100644
+--- a/include/rdma/ib.h
++++ b/include/rdma/ib.h
+@@ -34,6 +34,7 @@
+ #define _RDMA_IB_H
+ 
+ #include <linux/types.h>
++#include <linux/sched.h>
+ 
+ struct ib_addr {
+ 	union {
+@@ -86,4 +87,19 @@ struct sockaddr_ib {
+ 	__u64			sib_scope_id;
+ };
+ 
++/*
++ * The IB interfaces that use write() as bi-directional ioctl() are
++ * fundamentally unsafe, since there are lots of ways to trigger "write()"
++ * calls from various contexts with elevated privileges. That includes the
++ * traditional suid executable error message writes, but also various kernel
++ * interfaces that can write to file descriptors.
++ *
++ * This function provides protection for the legacy API by restricting the
++ * calling context.
++ */
++static inline bool ib_safe_file_access(struct file *filp)
++{
++	return filp->f_cred == current_cred() && segment_eq(get_fs(), USER_DS);
++}
++
+ #endif /* _RDMA_IB_H */
+diff --git a/include/sound/hda_i915.h b/include/sound/hda_i915.h
+index fa341fcb5829..f5842bcd9c94 100644
+--- a/include/sound/hda_i915.h
++++ b/include/sound/hda_i915.h
+@@ -9,7 +9,7 @@
+ #ifdef CONFIG_SND_HDA_I915
+ int snd_hdac_set_codec_wakeup(struct hdac_bus *bus, bool enable);
+ int snd_hdac_display_power(struct hdac_bus *bus, bool enable);
+-int snd_hdac_get_display_clk(struct hdac_bus *bus);
++void snd_hdac_i915_set_bclk(struct hdac_bus *bus);
+ int snd_hdac_sync_audio_rate(struct hdac_bus *bus, hda_nid_t nid, int rate);
+ int snd_hdac_acomp_get_eld(struct hdac_bus *bus, hda_nid_t nid,
+ 			   bool *audio_enabled, char *buffer, int max_bytes);
+@@ -25,9 +25,8 @@ static inline int snd_hdac_display_power(struct hdac_bus *bus, bool enable)
+ {
+ 	return 0;
+ }
+-static inline int snd_hdac_get_display_clk(struct hdac_bus *bus)
++static inline void snd_hdac_i915_set_bclk(struct hdac_bus *bus)
+ {
+-	return 0;
+ }
+ static inline int snd_hdac_sync_audio_rate(struct hdac_bus *bus, hda_nid_t nid,
+ 					   int rate)
+diff --git a/include/uapi/linux/v4l2-dv-timings.h b/include/uapi/linux/v4l2-dv-timings.h
+index c039f1d68a09..086168e18ca8 100644
+--- a/include/uapi/linux/v4l2-dv-timings.h
++++ b/include/uapi/linux/v4l2-dv-timings.h
+@@ -183,7 +183,8 @@
+ 
+ #define V4L2_DV_BT_CEA_3840X2160P24 { \
+ 	.type = V4L2_DV_BT_656_1120, \
+-	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
++		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 		297000000, 1276, 88, 296, 8, 10, 72, 0, 0, 0, \
+ 		V4L2_DV_BT_STD_CEA861, \
+ 		V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
+@@ -191,14 +192,16 @@
+ 
+ #define V4L2_DV_BT_CEA_3840X2160P25 { \
+ 	.type = V4L2_DV_BT_656_1120, \
+-	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
++		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 		297000000, 1056, 88, 296, 8, 10, 72, 0, 0, 0, \
+ 		V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \
+ }
+ 
+ #define V4L2_DV_BT_CEA_3840X2160P30 { \
+ 	.type = V4L2_DV_BT_656_1120, \
+-	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
++		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 		297000000, 176, 88, 296, 8, 10, 72, 0, 0, 0, \
+ 		V4L2_DV_BT_STD_CEA861, \
+ 		V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
+@@ -206,14 +209,16 @@
+ 
+ #define V4L2_DV_BT_CEA_3840X2160P50 { \
+ 	.type = V4L2_DV_BT_656_1120, \
+-	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
++		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 		594000000, 1056, 88, 296, 8, 10, 72, 0, 0, 0, \
+ 		V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \
+ }
+ 
+ #define V4L2_DV_BT_CEA_3840X2160P60 { \
+ 	.type = V4L2_DV_BT_656_1120, \
+-	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++	V4L2_INIT_BT_TIMINGS(3840, 2160, 0, \
++		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 		594000000, 176, 88, 296, 8, 10, 72, 0, 0, 0, \
+ 		V4L2_DV_BT_STD_CEA861, \
+ 		V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
+@@ -221,7 +226,8 @@
+ 
+ #define V4L2_DV_BT_CEA_4096X2160P24 { \
+ 	.type = V4L2_DV_BT_656_1120, \
+-	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
++		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 		297000000, 1020, 88, 296, 8, 10, 72, 0, 0, 0, \
+ 		V4L2_DV_BT_STD_CEA861, \
+ 		V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
+@@ -229,14 +235,16 @@
+ 
+ #define V4L2_DV_BT_CEA_4096X2160P25 { \
+ 	.type = V4L2_DV_BT_656_1120, \
+-	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
++		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 		297000000, 968, 88, 128, 8, 10, 72, 0, 0, 0, \
+ 		V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \
+ }
+ 
+ #define V4L2_DV_BT_CEA_4096X2160P30 { \
+ 	.type = V4L2_DV_BT_656_1120, \
+-	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
++		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 		297000000, 88, 88, 128, 8, 10, 72, 0, 0, 0, \
+ 		V4L2_DV_BT_STD_CEA861, \
+ 		V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
+@@ -244,14 +252,16 @@
+ 
+ #define V4L2_DV_BT_CEA_4096X2160P50 { \
+ 	.type = V4L2_DV_BT_656_1120, \
+-	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
++		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 		594000000, 968, 88, 128, 8, 10, 72, 0, 0, 0, \
+ 		V4L2_DV_BT_STD_CEA861, V4L2_DV_FL_IS_CE_VIDEO) \
+ }
+ 
+ #define V4L2_DV_BT_CEA_4096X2160P60 { \
+ 	.type = V4L2_DV_BT_656_1120, \
+-	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, V4L2_DV_HSYNC_POS_POL, \
++	V4L2_INIT_BT_TIMINGS(4096, 2160, 0, \
++		V4L2_DV_HSYNC_POS_POL | V4L2_DV_VSYNC_POS_POL, \
+ 		594000000, 88, 88, 128, 8, 10, 72, 0, 0, 0, \
+ 		V4L2_DV_BT_STD_CEA861, \
+ 		V4L2_DV_FL_CAN_REDUCE_FPS | V4L2_DV_FL_IS_CE_VIDEO) \
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index 6a498daf2eec..355cd5f2b416 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -2697,9 +2697,10 @@ static ssize_t __cgroup_procs_write(struct kernfs_open_file *of, char *buf,
+ 				    size_t nbytes, loff_t off, bool threadgroup)
+ {
+ 	struct task_struct *tsk;
++	struct cgroup_subsys *ss;
+ 	struct cgroup *cgrp;
+ 	pid_t pid;
+-	int ret;
++	int ssid, ret;
+ 
+ 	if (kstrtoint(strstrip(buf), 0, &pid) || pid < 0)
+ 		return -EINVAL;
+@@ -2747,8 +2748,10 @@ out_unlock_rcu:
+ 	rcu_read_unlock();
+ out_unlock_threadgroup:
+ 	percpu_up_write(&cgroup_threadgroup_rwsem);
++	for_each_subsys(ss, ssid)
++		if (ss->post_attach)
++			ss->post_attach();
+ 	cgroup_kn_unlock(of->kn);
+-	cpuset_post_attach_flush();
+ 	return ret ?: nbytes;
+ }
+ 
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index 41989ab4db57..df16d0c9349f 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -58,7 +58,6 @@
+ #include <asm/uaccess.h>
+ #include <linux/atomic.h>
+ #include <linux/mutex.h>
+-#include <linux/workqueue.h>
+ #include <linux/cgroup.h>
+ #include <linux/wait.h>
+ 
+@@ -1016,7 +1015,7 @@ static void cpuset_migrate_mm(struct mm_struct *mm, const nodemask_t *from,
+ 	}
+ }
+ 
+-void cpuset_post_attach_flush(void)
++static void cpuset_post_attach(void)
+ {
+ 	flush_workqueue(cpuset_migrate_mm_wq);
+ }
+@@ -2087,6 +2086,7 @@ struct cgroup_subsys cpuset_cgrp_subsys = {
+ 	.can_attach	= cpuset_can_attach,
+ 	.cancel_attach	= cpuset_cancel_attach,
+ 	.attach		= cpuset_attach,
++	.post_attach	= cpuset_post_attach,
+ 	.bind		= cpuset_bind,
+ 	.legacy_cftypes	= files,
+ 	.early_init	= 1,
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index f0b4b328d8f5..a0ef98b258d7 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -2402,14 +2402,24 @@ static void ctx_sched_out(struct perf_event_context *ctx,
+ 			cpuctx->task_ctx = NULL;
+ 	}
+ 
+-	is_active ^= ctx->is_active; /* changed bits */
+-
++	/*
++	 * Always update time if it was set; not only when it changes.
++	 * Otherwise we can 'forget' to update time for any but the last
++	 * context we sched out. For example:
++	 *
++	 *   ctx_sched_out(.event_type = EVENT_FLEXIBLE)
++	 *   ctx_sched_out(.event_type = EVENT_PINNED)
++	 *
++	 * would only update time for the pinned events.
++	 */
+ 	if (is_active & EVENT_TIME) {
+ 		/* update (and stop) ctx time */
+ 		update_context_time(ctx);
+ 		update_cgrp_time_from_cpuctx(cpuctx);
+ 	}
+ 
++	is_active ^= ctx->is_active; /* changed bits */
++
+ 	if (!ctx->nr_active || !(is_active & EVENT_ALL))
+ 		return;
+ 
+@@ -8479,6 +8489,7 @@ SYSCALL_DEFINE5(perf_event_open,
+ 					f_flags);
+ 	if (IS_ERR(event_file)) {
+ 		err = PTR_ERR(event_file);
++		event_file = NULL;
+ 		goto err_context;
+ 	}
+ 
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 5d6ce6413ef1..11b502159f3a 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1212,10 +1212,20 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this,
+ 	if (unlikely(should_fail_futex(true)))
+ 		ret = -EFAULT;
+ 
+-	if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
++	if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) {
+ 		ret = -EFAULT;
+-	else if (curval != uval)
+-		ret = -EINVAL;
++	} else if (curval != uval) {
++		/*
++		 * If a unconditional UNLOCK_PI operation (user space did not
++		 * try the TID->0 transition) raced with a waiter setting the
++		 * FUTEX_WAITERS flag between get_user() and locking the hash
++		 * bucket lock, retry the operation.
++		 */
++		if ((FUTEX_TID_MASK & curval) == uval)
++			ret = -EAGAIN;
++		else
++			ret = -EINVAL;
++	}
+ 	if (ret) {
+ 		raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
+ 		return ret;
+@@ -1442,8 +1452,8 @@ void requeue_futex(struct futex_q *q, struct futex_hash_bucket *hb1,
+ 	if (likely(&hb1->chain != &hb2->chain)) {
+ 		plist_del(&q->list, &hb1->chain);
+ 		hb_waiters_dec(hb1);
+-		plist_add(&q->list, &hb2->chain);
+ 		hb_waiters_inc(hb2);
++		plist_add(&q->list, &hb2->chain);
+ 		q->lock_ptr = &hb2->lock;
+ 	}
+ 	get_futex_key_refs(key2);
+@@ -2536,6 +2546,15 @@ retry:
+ 		if (ret == -EFAULT)
+ 			goto pi_faulted;
+ 		/*
++		 * A unconditional UNLOCK_PI op raced against a waiter
++		 * setting the FUTEX_WAITERS bit. Try again.
++		 */
++		if (ret == -EAGAIN) {
++			spin_unlock(&hb->lock);
++			put_futex_key(&key);
++			goto retry;
++		}
++		/*
+ 		 * wake_futex_pi has detected invalid state. Tell user
+ 		 * space.
+ 		 */
+diff --git a/kernel/locking/mcs_spinlock.h b/kernel/locking/mcs_spinlock.h
+index 5b9102a47ea5..c835270f0c2f 100644
+--- a/kernel/locking/mcs_spinlock.h
++++ b/kernel/locking/mcs_spinlock.h
+@@ -67,7 +67,13 @@ void mcs_spin_lock(struct mcs_spinlock **lock, struct mcs_spinlock *node)
+ 	node->locked = 0;
+ 	node->next   = NULL;
+ 
+-	prev = xchg_acquire(lock, node);
++	/*
++	 * We rely on the full barrier with global transitivity implied by the
++	 * below xchg() to order the initialization stores above against any
++	 * observation of @node. And to provide the ACQUIRE ordering associated
++	 * with a LOCK primitive.
++	 */
++	prev = xchg(lock, node);
+ 	if (likely(prev == NULL)) {
+ 		/*
+ 		 * Lock acquired, don't need to set node->locked to 1. Threads
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index a74073f8c08c..1c1d2a00ad95 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -7802,7 +7802,7 @@ void set_curr_task(int cpu, struct task_struct *p)
+ /* task_group_lock serializes the addition/removal of task groups */
+ static DEFINE_SPINLOCK(task_group_lock);
+ 
+-static void free_sched_group(struct task_group *tg)
++static void sched_free_group(struct task_group *tg)
+ {
+ 	free_fair_sched_group(tg);
+ 	free_rt_sched_group(tg);
+@@ -7828,7 +7828,7 @@ struct task_group *sched_create_group(struct task_group *parent)
+ 	return tg;
+ 
+ err:
+-	free_sched_group(tg);
++	sched_free_group(tg);
+ 	return ERR_PTR(-ENOMEM);
+ }
+ 
+@@ -7848,17 +7848,16 @@ void sched_online_group(struct task_group *tg, struct task_group *parent)
+ }
+ 
+ /* rcu callback to free various structures associated with a task group */
+-static void free_sched_group_rcu(struct rcu_head *rhp)
++static void sched_free_group_rcu(struct rcu_head *rhp)
+ {
+ 	/* now it should be safe to free those cfs_rqs */
+-	free_sched_group(container_of(rhp, struct task_group, rcu));
++	sched_free_group(container_of(rhp, struct task_group, rcu));
+ }
+ 
+-/* Destroy runqueue etc associated with a task group */
+ void sched_destroy_group(struct task_group *tg)
+ {
+ 	/* wait for possible concurrent references to cfs_rqs complete */
+-	call_rcu(&tg->rcu, free_sched_group_rcu);
++	call_rcu(&tg->rcu, sched_free_group_rcu);
+ }
+ 
+ void sched_offline_group(struct task_group *tg)
+@@ -8319,31 +8318,26 @@ cpu_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
+ 	if (IS_ERR(tg))
+ 		return ERR_PTR(-ENOMEM);
+ 
++	sched_online_group(tg, parent);
++
+ 	return &tg->css;
+ }
+ 
+-static int cpu_cgroup_css_online(struct cgroup_subsys_state *css)
++static void cpu_cgroup_css_released(struct cgroup_subsys_state *css)
+ {
+ 	struct task_group *tg = css_tg(css);
+-	struct task_group *parent = css_tg(css->parent);
+ 
+-	if (parent)
+-		sched_online_group(tg, parent);
+-	return 0;
++	sched_offline_group(tg);
+ }
+ 
+ static void cpu_cgroup_css_free(struct cgroup_subsys_state *css)
+ {
+ 	struct task_group *tg = css_tg(css);
+ 
+-	sched_destroy_group(tg);
+-}
+-
+-static void cpu_cgroup_css_offline(struct cgroup_subsys_state *css)
+-{
+-	struct task_group *tg = css_tg(css);
+-
+-	sched_offline_group(tg);
++	/*
++	 * Relies on the RCU grace period between css_released() and this.
++	 */
++	sched_free_group(tg);
+ }
+ 
+ static void cpu_cgroup_fork(struct task_struct *task)
+@@ -8703,9 +8697,8 @@ static struct cftype cpu_files[] = {
+ 
+ struct cgroup_subsys cpu_cgrp_subsys = {
+ 	.css_alloc	= cpu_cgroup_css_alloc,
++	.css_released	= cpu_cgroup_css_released,
+ 	.css_free	= cpu_cgroup_css_free,
+-	.css_online	= cpu_cgroup_css_online,
+-	.css_offline	= cpu_cgroup_css_offline,
+ 	.fork		= cpu_cgroup_fork,
+ 	.can_attach	= cpu_cgroup_can_attach,
+ 	.attach		= cpu_cgroup_attach,
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 7ff5dc7d2ac5..9e82d0450fad 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -667,6 +667,35 @@ static void set_work_pool_and_clear_pending(struct work_struct *work,
+ 	 */
+ 	smp_wmb();
+ 	set_work_data(work, (unsigned long)pool_id << WORK_OFFQ_POOL_SHIFT, 0);
++	/*
++	 * The following mb guarantees that previous clear of a PENDING bit
++	 * will not be reordered with any speculative LOADS or STORES from
++	 * work->current_func, which is executed afterwards.  This possible
++	 * reordering can lead to a missed execution on attempt to qeueue
++	 * the same @work.  E.g. consider this case:
++	 *
++	 *   CPU#0                         CPU#1
++	 *   ----------------------------  --------------------------------
++	 *
++	 * 1  STORE event_indicated
++	 * 2  queue_work_on() {
++	 * 3    test_and_set_bit(PENDING)
++	 * 4 }                             set_..._and_clear_pending() {
++	 * 5                                 set_work_data() # clear bit
++	 * 6                                 smp_mb()
++	 * 7                               work->current_func() {
++	 * 8				      LOAD event_indicated
++	 *				   }
++	 *
++	 * Without an explicit full barrier speculative LOAD on line 8 can
++	 * be executed before CPU#0 does STORE on line 1.  If that happens,
++	 * CPU#0 observes the PENDING bit is still set and new execution of
++	 * a @work is not queued in a hope, that CPU#1 will eventually
++	 * finish the queued @work.  Meanwhile CPU#1 does not see
++	 * event_indicated is set, because speculative LOAD was executed
++	 * before actual STORE.
++	 */
++	smp_mb();
+ }
+ 
+ static void clear_work_data(struct work_struct *work)
+diff --git a/lib/assoc_array.c b/lib/assoc_array.c
+index 03dd576e6773..59fd7c0b119c 100644
+--- a/lib/assoc_array.c
++++ b/lib/assoc_array.c
+@@ -524,7 +524,9 @@ static bool assoc_array_insert_into_terminal_node(struct assoc_array_edit *edit,
+ 			free_slot = i;
+ 			continue;
+ 		}
+-		if (ops->compare_object(assoc_array_ptr_to_leaf(ptr), index_key)) {
++		if (assoc_array_ptr_is_leaf(ptr) &&
++		    ops->compare_object(assoc_array_ptr_to_leaf(ptr),
++					index_key)) {
+ 			pr_devel("replace in slot %d\n", i);
+ 			edit->leaf_p = &node->slots[i];
+ 			edit->dead_leaf = node->slots[i];
+diff --git a/lib/lz4/lz4defs.h b/lib/lz4/lz4defs.h
+index abcecdc2d0f2..0710a62ad2f6 100644
+--- a/lib/lz4/lz4defs.h
++++ b/lib/lz4/lz4defs.h
+@@ -11,8 +11,7 @@
+ /*
+  * Detects 64 bits mode
+  */
+-#if (defined(__x86_64__) || defined(__x86_64) || defined(__amd64__) \
+-	|| defined(__ppc64__) || defined(__LP64__))
++#if defined(CONFIG_64BIT)
+ #define LZ4_ARCH64 1
+ #else
+ #define LZ4_ARCH64 0
+@@ -35,6 +34,10 @@ typedef struct _U64_S { u64 v; } U64_S;
+ 
+ #define PUT4(s, d) (A32(d) = A32(s))
+ #define PUT8(s, d) (A64(d) = A64(s))
++
++#define LZ4_READ_LITTLEENDIAN_16(d, s, p)	\
++	(d = s - A16(p))
++
+ #define LZ4_WRITE_LITTLEENDIAN_16(p, v)	\
+ 	do {	\
+ 		A16(p) = v; \
+@@ -51,10 +54,13 @@ typedef struct _U64_S { u64 v; } U64_S;
+ #define PUT8(s, d) \
+ 	put_unaligned(get_unaligned((const u64 *) s), (u64 *) d)
+ 
+-#define LZ4_WRITE_LITTLEENDIAN_16(p, v)	\
+-	do {	\
+-		put_unaligned(v, (u16 *)(p)); \
+-		p += 2; \
++#define LZ4_READ_LITTLEENDIAN_16(d, s, p)	\
++	(d = s - get_unaligned_le16(p))
++
++#define LZ4_WRITE_LITTLEENDIAN_16(p, v)			\
++	do {						\
++		put_unaligned_le16(v, (u16 *)(p));	\
++		p += 2;					\
+ 	} while (0)
+ #endif
+ 
+@@ -140,9 +146,6 @@ typedef struct _U64_S { u64 v; } U64_S;
+ 
+ #endif
+ 
+-#define LZ4_READ_LITTLEENDIAN_16(d, s, p) \
+-	(d = s - get_unaligned_le16(p))
+-
+ #define LZ4_WILDCOPY(s, d, e)		\
+ 	do {				\
+ 		LZ4_COPYPACKET(s, d);	\
+diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
+index ec533a6c77b5..eb15e7dc7b65 100644
+--- a/lib/mpi/mpicoder.c
++++ b/lib/mpi/mpicoder.c
+@@ -128,6 +128,23 @@ leave:
+ }
+ EXPORT_SYMBOL_GPL(mpi_read_from_buffer);
+ 
++static int count_lzeros(MPI a)
++{
++	mpi_limb_t alimb;
++	int i, lzeros = 0;
++
++	for (i = a->nlimbs - 1; i >= 0; i--) {
++		alimb = a->d[i];
++		if (alimb == 0) {
++			lzeros += sizeof(mpi_limb_t);
++		} else {
++			lzeros += count_leading_zeros(alimb) / 8;
++			break;
++		}
++	}
++	return lzeros;
++}
++
+ /**
+  * mpi_read_buffer() - read MPI to a bufer provided by user (msb first)
+  *
+@@ -148,7 +165,7 @@ int mpi_read_buffer(MPI a, uint8_t *buf, unsigned buf_len, unsigned *nbytes,
+ 	uint8_t *p;
+ 	mpi_limb_t alimb;
+ 	unsigned int n = mpi_get_size(a);
+-	int i, lzeros = 0;
++	int i, lzeros;
+ 
+ 	if (!buf || !nbytes)
+ 		return -EINVAL;
+@@ -156,14 +173,7 @@ int mpi_read_buffer(MPI a, uint8_t *buf, unsigned buf_len, unsigned *nbytes,
+ 	if (sign)
+ 		*sign = a->sign;
+ 
+-	p = (void *)&a->d[a->nlimbs] - 1;
+-
+-	for (i = a->nlimbs * sizeof(alimb) - 1; i >= 0; i--, p--) {
+-		if (!*p)
+-			lzeros++;
+-		else
+-			break;
+-	}
++	lzeros = count_lzeros(a);
+ 
+ 	if (buf_len < n - lzeros) {
+ 		*nbytes = n - lzeros;
+@@ -351,7 +361,7 @@ int mpi_write_to_sgl(MPI a, struct scatterlist *sgl, unsigned *nbytes,
+ 	u8 *p, *p2;
+ 	mpi_limb_t alimb, alimb2;
+ 	unsigned int n = mpi_get_size(a);
+-	int i, x, y = 0, lzeros = 0, buf_len;
++	int i, x, y = 0, lzeros, buf_len;
+ 
+ 	if (!nbytes)
+ 		return -EINVAL;
+@@ -359,14 +369,7 @@ int mpi_write_to_sgl(MPI a, struct scatterlist *sgl, unsigned *nbytes,
+ 	if (sign)
+ 		*sign = a->sign;
+ 
+-	p = (void *)&a->d[a->nlimbs] - 1;
+-
+-	for (i = a->nlimbs * sizeof(alimb) - 1; i >= 0; i--, p--) {
+-		if (!*p)
+-			lzeros++;
+-		else
+-			break;
+-	}
++	lzeros = count_lzeros(a);
+ 
+ 	if (*nbytes < n - lzeros) {
+ 		*nbytes = n - lzeros;
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index e10a4fee88d2..a7db0a2db1ab 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1919,10 +1919,9 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
+ 		 * page fault if needed.
+ 		 */
+ 		return 0;
+-	if (vma->vm_ops)
++	if (vma->vm_ops || (vm_flags & VM_NO_THP))
+ 		/* khugepaged not yet working on file or special mappings */
+ 		return 0;
+-	VM_BUG_ON_VMA(vm_flags & VM_NO_THP, vma);
+ 	hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ 	hend = vma->vm_end & HPAGE_PMD_MASK;
+ 	if (hstart < hend)
+@@ -2310,8 +2309,7 @@ static bool hugepage_vma_check(struct vm_area_struct *vma)
+ 		return false;
+ 	if (is_vma_temporary_stack(vma))
+ 		return false;
+-	VM_BUG_ON_VMA(vma->vm_flags & VM_NO_THP, vma);
+-	return true;
++	return !(vma->vm_flags & VM_NO_THP);
+ }
+ 
+ static void collapse_huge_page(struct mm_struct *mm,
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index caf3bf73b533..a65ad1d59232 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -207,6 +207,7 @@ static void mem_cgroup_oom_notify(struct mem_cgroup *memcg);
+ /* "mc" and its members are protected by cgroup_mutex */
+ static struct move_charge_struct {
+ 	spinlock_t	  lock; /* for from, to */
++	struct mm_struct  *mm;
+ 	struct mem_cgroup *from;
+ 	struct mem_cgroup *to;
+ 	unsigned long flags;
+@@ -4730,6 +4731,8 @@ static void __mem_cgroup_clear_mc(void)
+ 
+ static void mem_cgroup_clear_mc(void)
+ {
++	struct mm_struct *mm = mc.mm;
++
+ 	/*
+ 	 * we must clear moving_task before waking up waiters at the end of
+ 	 * task migration.
+@@ -4739,7 +4742,10 @@ static void mem_cgroup_clear_mc(void)
+ 	spin_lock(&mc.lock);
+ 	mc.from = NULL;
+ 	mc.to = NULL;
++	mc.mm = NULL;
+ 	spin_unlock(&mc.lock);
++
++	mmput(mm);
+ }
+ 
+ static int mem_cgroup_can_attach(struct cgroup_taskset *tset)
+@@ -4796,6 +4802,7 @@ static int mem_cgroup_can_attach(struct cgroup_taskset *tset)
+ 		VM_BUG_ON(mc.moved_swap);
+ 
+ 		spin_lock(&mc.lock);
++		mc.mm = mm;
+ 		mc.from = from;
+ 		mc.to = memcg;
+ 		mc.flags = move_flags;
+@@ -4805,8 +4812,9 @@ static int mem_cgroup_can_attach(struct cgroup_taskset *tset)
+ 		ret = mem_cgroup_precharge_mc(mm);
+ 		if (ret)
+ 			mem_cgroup_clear_mc();
++	} else {
++		mmput(mm);
+ 	}
+-	mmput(mm);
+ 	return ret;
+ }
+ 
+@@ -4915,11 +4923,11 @@ put:			/* get_mctgt_type() gets the page */
+ 	return ret;
+ }
+ 
+-static void mem_cgroup_move_charge(struct mm_struct *mm)
++static void mem_cgroup_move_charge(void)
+ {
+ 	struct mm_walk mem_cgroup_move_charge_walk = {
+ 		.pmd_entry = mem_cgroup_move_charge_pte_range,
+-		.mm = mm,
++		.mm = mc.mm,
+ 	};
+ 
+ 	lru_add_drain_all();
+@@ -4931,7 +4939,7 @@ static void mem_cgroup_move_charge(struct mm_struct *mm)
+ 	atomic_inc(&mc.from->moving_account);
+ 	synchronize_rcu();
+ retry:
+-	if (unlikely(!down_read_trylock(&mm->mmap_sem))) {
++	if (unlikely(!down_read_trylock(&mc.mm->mmap_sem))) {
+ 		/*
+ 		 * Someone who are holding the mmap_sem might be waiting in
+ 		 * waitq. So we cancel all extra charges, wake up all waiters,
+@@ -4948,23 +4956,16 @@ retry:
+ 	 * additional charge, the page walk just aborts.
+ 	 */
+ 	walk_page_range(0, ~0UL, &mem_cgroup_move_charge_walk);
+-	up_read(&mm->mmap_sem);
++	up_read(&mc.mm->mmap_sem);
+ 	atomic_dec(&mc.from->moving_account);
+ }
+ 
+-static void mem_cgroup_move_task(struct cgroup_taskset *tset)
++static void mem_cgroup_move_task(void)
+ {
+-	struct cgroup_subsys_state *css;
+-	struct task_struct *p = cgroup_taskset_first(tset, &css);
+-	struct mm_struct *mm = get_task_mm(p);
+-
+-	if (mm) {
+-		if (mc.to)
+-			mem_cgroup_move_charge(mm);
+-		mmput(mm);
+-	}
+-	if (mc.to)
++	if (mc.to) {
++		mem_cgroup_move_charge();
+ 		mem_cgroup_clear_mc();
++	}
+ }
+ #else	/* !CONFIG_MMU */
+ static int mem_cgroup_can_attach(struct cgroup_taskset *tset)
+@@ -4974,7 +4975,7 @@ static int mem_cgroup_can_attach(struct cgroup_taskset *tset)
+ static void mem_cgroup_cancel_attach(struct cgroup_taskset *tset)
+ {
+ }
+-static void mem_cgroup_move_task(struct cgroup_taskset *tset)
++static void mem_cgroup_move_task(void)
+ {
+ }
+ #endif
+@@ -5246,7 +5247,7 @@ struct cgroup_subsys memory_cgrp_subsys = {
+ 	.css_reset = mem_cgroup_css_reset,
+ 	.can_attach = mem_cgroup_can_attach,
+ 	.cancel_attach = mem_cgroup_cancel_attach,
+-	.attach = mem_cgroup_move_task,
++	.post_attach = mem_cgroup_move_task,
+ 	.bind = mem_cgroup_bind,
+ 	.dfl_cftypes = memory_files,
+ 	.legacy_cftypes = mem_cgroup_legacy_files,
+diff --git a/mm/memory.c b/mm/memory.c
+index 8132787ae4d5..3345dcf862cf 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -792,6 +792,46 @@ out:
+ 	return pfn_to_page(pfn);
+ }
+ 
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
++struct page *vm_normal_page_pmd(struct vm_area_struct *vma, unsigned long addr,
++				pmd_t pmd)
++{
++	unsigned long pfn = pmd_pfn(pmd);
++
++	/*
++	 * There is no pmd_special() but there may be special pmds, e.g.
++	 * in a direct-access (dax) mapping, so let's just replicate the
++	 * !HAVE_PTE_SPECIAL case from vm_normal_page() here.
++	 */
++	if (unlikely(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP))) {
++		if (vma->vm_flags & VM_MIXEDMAP) {
++			if (!pfn_valid(pfn))
++				return NULL;
++			goto out;
++		} else {
++			unsigned long off;
++			off = (addr - vma->vm_start) >> PAGE_SHIFT;
++			if (pfn == vma->vm_pgoff + off)
++				return NULL;
++			if (!is_cow_mapping(vma->vm_flags))
++				return NULL;
++		}
++	}
++
++	if (is_zero_pfn(pfn))
++		return NULL;
++	if (unlikely(pfn > highest_memmap_pfn))
++		return NULL;
++
++	/*
++	 * NOTE! We still have PageReserved() pages in the page tables.
++	 * eg. VDSO mappings can cause them to exist.
++	 */
++out:
++	return pfn_to_page(pfn);
++}
++#endif
++
+ /*
+  * copy one vm_area from one task to the other. Assumes the page tables
+  * already present in the new task to be cleared in the whole range
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 3ad0fea5c438..625741faa068 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -967,7 +967,13 @@ out:
+ 		dec_zone_page_state(page, NR_ISOLATED_ANON +
+ 				page_is_file_cache(page));
+ 		/* Soft-offlined page shouldn't go through lru cache list */
+-		if (reason == MR_MEMORY_FAILURE) {
++		if (reason == MR_MEMORY_FAILURE && rc == MIGRATEPAGE_SUCCESS) {
++			/*
++			 * With this release, we free successfully migrated
++			 * page and set PG_HWPoison on just freed page
++			 * intentionally. Although it's rather weird, it's how
++			 * HWPoison flag works at the moment.
++			 */
+ 			put_page(page);
+ 			if (!test_set_page_hwpoison(page))
+ 				num_poisoned_pages_inc();
+diff --git a/mm/slub.c b/mm/slub.c
+index d8fbd4a6ed59..2a722e141958 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -2815,6 +2815,7 @@ struct detached_freelist {
+ 	void *tail;
+ 	void *freelist;
+ 	int cnt;
++	struct kmem_cache *s;
+ };
+ 
+ /*
+@@ -2829,8 +2830,9 @@ struct detached_freelist {
+  * synchronization primitive.  Look ahead in the array is limited due
+  * to performance reasons.
+  */
+-static int build_detached_freelist(struct kmem_cache *s, size_t size,
+-				   void **p, struct detached_freelist *df)
++static inline
++int build_detached_freelist(struct kmem_cache *s, size_t size,
++			    void **p, struct detached_freelist *df)
+ {
+ 	size_t first_skipped_index = 0;
+ 	int lookahead = 3;
+@@ -2846,8 +2848,11 @@ static int build_detached_freelist(struct kmem_cache *s, size_t size,
+ 	if (!object)
+ 		return 0;
+ 
++	/* Support for memcg, compiler can optimize this out */
++	df->s = cache_from_obj(s, object);
++
+ 	/* Start new detached freelist */
+-	set_freepointer(s, object, NULL);
++	set_freepointer(df->s, object, NULL);
+ 	df->page = virt_to_head_page(object);
+ 	df->tail = object;
+ 	df->freelist = object;
+@@ -2862,7 +2867,7 @@ static int build_detached_freelist(struct kmem_cache *s, size_t size,
+ 		/* df->page is always set at this point */
+ 		if (df->page == virt_to_head_page(object)) {
+ 			/* Opportunity build freelist */
+-			set_freepointer(s, object, df->freelist);
++			set_freepointer(df->s, object, df->freelist);
+ 			df->freelist = object;
+ 			df->cnt++;
+ 			p[size] = NULL; /* mark object processed */
+@@ -2881,25 +2886,20 @@ static int build_detached_freelist(struct kmem_cache *s, size_t size,
+ 	return first_skipped_index;
+ }
+ 
+-
+ /* Note that interrupts must be enabled when calling this function. */
+-void kmem_cache_free_bulk(struct kmem_cache *orig_s, size_t size, void **p)
++void kmem_cache_free_bulk(struct kmem_cache *s, size_t size, void **p)
+ {
+ 	if (WARN_ON(!size))
+ 		return;
+ 
+ 	do {
+ 		struct detached_freelist df;
+-		struct kmem_cache *s;
+-
+-		/* Support for memcg */
+-		s = cache_from_obj(orig_s, p[size - 1]);
+ 
+ 		size = build_detached_freelist(s, size, p, &df);
+ 		if (unlikely(!df.page))
+ 			continue;
+ 
+-		slab_free(s, df.page, df.freelist, df.tail, df.cnt, _RET_IP_);
++		slab_free(df.s, df.page, df.freelist, df.tail, df.cnt,_RET_IP_);
+ 	} while (likely(size));
+ }
+ EXPORT_SYMBOL(kmem_cache_free_bulk);
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index 71b1c29948db..c712b016e0ab 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2561,7 +2561,7 @@ static bool shrink_zones(struct zonelist *zonelist, struct scan_control *sc)
+ 		sc->gfp_mask |= __GFP_HIGHMEM;
+ 
+ 	for_each_zone_zonelist_nodemask(zone, z, zonelist,
+-					requested_highidx, sc->nodemask) {
++					gfp_zone(sc->gfp_mask), sc->nodemask) {
+ 		enum zone_type classzone_idx;
+ 
+ 		if (!populated_zone(zone))
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index f1ffb34e253f..d2bc03f0b4d7 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1305,7 +1305,7 @@ static int netlink_release(struct socket *sock)
+ 
+ 	skb_queue_purge(&sk->sk_write_queue);
+ 
+-	if (nlk->portid) {
++	if (nlk->portid && nlk->bound) {
+ 		struct netlink_notify n = {
+ 						.net = sock_net(sk),
+ 						.protocol = sk->sk_protocol,
+diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
+index 273bc3a35425..008c25d1b9f9 100644
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -1182,14 +1182,14 @@ int sunrpc_cache_pipe_upcall(struct cache_detail *detail, struct cache_head *h)
+ 	}
+ 
+ 	crq->q.reader = 0;
+-	crq->item = cache_get(h);
+ 	crq->buf = buf;
+ 	crq->len = 0;
+ 	crq->readers = 0;
+ 	spin_lock(&queue_lock);
+-	if (test_bit(CACHE_PENDING, &h->flags))
++	if (test_bit(CACHE_PENDING, &h->flags)) {
++		crq->item = cache_get(h);
+ 		list_add_tail(&crq->q.list, &detail->queue);
+-	else
++	} else
+ 		/* Lost a race, no longer PENDING, so don't enqueue */
+ 		ret = -EAGAIN;
+ 	spin_unlock(&queue_lock);
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 711cb7ad6ae0..ab62d305b48b 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -13201,7 +13201,7 @@ static int nl80211_netlink_notify(struct notifier_block * nb,
+ 	struct wireless_dev *wdev;
+ 	struct cfg80211_beacon_registration *reg, *tmp;
+ 
+-	if (state != NETLINK_URELEASE)
++	if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
+ 		return NOTIFY_DONE;
+ 
+ 	rcu_read_lock();
+diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
+index 0b7dc2fd7bac..dd243d2abd87 100644
+--- a/scripts/kconfig/confdata.c
++++ b/scripts/kconfig/confdata.c
+@@ -267,10 +267,8 @@ int conf_read_simple(const char *name, int def)
+ 		if (in)
+ 			goto load;
+ 		sym_add_change_count(1);
+-		if (!sym_defconfig_list) {
+-			sym_calc_value(modules_sym);
++		if (!sym_defconfig_list)
+ 			return 1;
+-		}
+ 
+ 		for_all_defaults(sym_defconfig_list, prop) {
+ 			if (expr_calc_value(prop->visible.expr) == no ||
+@@ -403,7 +401,6 @@ setsym:
+ 	}
+ 	free(line);
+ 	fclose(in);
+-	sym_calc_value(modules_sym);
+ 	return 0;
+ }
+ 
+@@ -414,8 +411,12 @@ int conf_read(const char *name)
+ 
+ 	sym_set_change_count(0);
+ 
+-	if (conf_read_simple(name, S_DEF_USER))
++	if (conf_read_simple(name, S_DEF_USER)) {
++		sym_calc_value(modules_sym);
+ 		return 1;
++	}
++
++	sym_calc_value(modules_sym);
+ 
+ 	for_all_symbols(i, sym) {
+ 		sym_calc_value(sym);
+@@ -846,6 +847,7 @@ static int conf_split_config(void)
+ 
+ 	name = conf_get_autoconfig_name();
+ 	conf_read_simple(name, S_DEF_AUTO);
++	sym_calc_value(modules_sym);
+ 
+ 	if (chdir("include/config"))
+ 		return 1;
+diff --git a/security/keys/trusted.c b/security/keys/trusted.c
+index 0dcab20cdacd..90d61751ff12 100644
+--- a/security/keys/trusted.c
++++ b/security/keys/trusted.c
+@@ -744,6 +744,7 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
+ 	unsigned long handle;
+ 	unsigned long lock;
+ 	unsigned long token_mask = 0;
++	unsigned int digest_len;
+ 	int i;
+ 	int tpm2;
+ 
+@@ -752,7 +753,6 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
+ 		return tpm2;
+ 
+ 	opt->hash = tpm2 ? HASH_ALGO_SHA256 : HASH_ALGO_SHA1;
+-	opt->digest_len = hash_digest_size[opt->hash];
+ 
+ 	while ((p = strsep(&c, " \t"))) {
+ 		if (*p == '\0' || *p == ' ' || *p == '\t')
+@@ -812,8 +812,6 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
+ 			for (i = 0; i < HASH_ALGO__LAST; i++) {
+ 				if (!strcmp(args[0].from, hash_algo_name[i])) {
+ 					opt->hash = i;
+-					opt->digest_len =
+-						hash_digest_size[opt->hash];
+ 					break;
+ 				}
+ 			}
+@@ -825,13 +823,14 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
+ 			}
+ 			break;
+ 		case Opt_policydigest:
+-			if (!tpm2 ||
+-			    strlen(args[0].from) != (2 * opt->digest_len))
++			digest_len = hash_digest_size[opt->hash];
++			if (!tpm2 || strlen(args[0].from) != (2 * digest_len))
+ 				return -EINVAL;
+ 			res = hex2bin(opt->policydigest, args[0].from,
+-				      opt->digest_len);
++				      digest_len);
+ 			if (res < 0)
+ 				return -EINVAL;
++			opt->policydigest_len = digest_len;
+ 			break;
+ 		case Opt_policyhandle:
+ 			if (!tpm2)
+diff --git a/sound/hda/hdac_i915.c b/sound/hda/hdac_i915.c
+index f6854dbd7d8d..69ead7150a5c 100644
+--- a/sound/hda/hdac_i915.c
++++ b/sound/hda/hdac_i915.c
+@@ -20,6 +20,7 @@
+ #include <sound/core.h>
+ #include <sound/hdaudio.h>
+ #include <sound/hda_i915.h>
++#include <sound/hda_register.h>
+ 
+ static struct i915_audio_component *hdac_acomp;
+ 
+@@ -97,26 +98,65 @@ int snd_hdac_display_power(struct hdac_bus *bus, bool enable)
+ }
+ EXPORT_SYMBOL_GPL(snd_hdac_display_power);
+ 
++#define CONTROLLER_IN_GPU(pci) (((pci)->device == 0x0a0c) || \
++				((pci)->device == 0x0c0c) || \
++				((pci)->device == 0x0d0c) || \
++				((pci)->device == 0x160c))
++
+ /**
+- * snd_hdac_get_display_clk - Get CDCLK in kHz
++ * snd_hdac_i915_set_bclk - Reprogram BCLK for HSW/BDW
+  * @bus: HDA core bus
+  *
+- * This function is supposed to be used only by a HD-audio controller
+- * driver that needs the interaction with i915 graphics.
++ * Intel HSW/BDW display HDA controller is in GPU. Both its power and link BCLK
++ * depends on GPU. Two Extended Mode registers EM4 (M value) and EM5 (N Value)
++ * are used to convert CDClk (Core Display Clock) to 24MHz BCLK:
++ * BCLK = CDCLK * M / N
++ * The values will be lost when the display power well is disabled and need to
++ * be restored to avoid abnormal playback speed.
+  *
+- * This function queries CDCLK value in kHz from the graphics driver and
+- * returns the value.  A negative code is returned in error.
++ * Call this function at initializing and changing power well, as well as
++ * at ELD notifier for the hotplug.
+  */
+-int snd_hdac_get_display_clk(struct hdac_bus *bus)
++void snd_hdac_i915_set_bclk(struct hdac_bus *bus)
+ {
+ 	struct i915_audio_component *acomp = bus->audio_component;
++	struct pci_dev *pci = to_pci_dev(bus->dev);
++	int cdclk_freq;
++	unsigned int bclk_m, bclk_n;
++
++	if (!acomp || !acomp->ops || !acomp->ops->get_cdclk_freq)
++		return; /* only for i915 binding */
++	if (!CONTROLLER_IN_GPU(pci))
++		return; /* only HSW/BDW */
++
++	cdclk_freq = acomp->ops->get_cdclk_freq(acomp->dev);
++	switch (cdclk_freq) {
++	case 337500:
++		bclk_m = 16;
++		bclk_n = 225;
++		break;
++
++	case 450000:
++	default: /* default CDCLK 450MHz */
++		bclk_m = 4;
++		bclk_n = 75;
++		break;
++
++	case 540000:
++		bclk_m = 4;
++		bclk_n = 90;
++		break;
++
++	case 675000:
++		bclk_m = 8;
++		bclk_n = 225;
++		break;
++	}
+ 
+-	if (!acomp || !acomp->ops)
+-		return -ENODEV;
+-
+-	return acomp->ops->get_cdclk_freq(acomp->dev);
++	snd_hdac_chip_writew(bus, HSW_EM4, bclk_m);
++	snd_hdac_chip_writew(bus, HSW_EM5, bclk_n);
+ }
+-EXPORT_SYMBOL_GPL(snd_hdac_get_display_clk);
++EXPORT_SYMBOL_GPL(snd_hdac_i915_set_bclk);
+ 
+ /* There is a fixed mapping between audio pin node and display port
+  * on current Intel platforms:
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 7ca5b89f088a..dfaf1a93fb8a 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -826,7 +826,7 @@ static hda_nid_t path_power_update(struct hda_codec *codec,
+ 				   bool allow_powerdown)
+ {
+ 	hda_nid_t nid, changed = 0;
+-	int i, state;
++	int i, state, power;
+ 
+ 	for (i = 0; i < path->depth; i++) {
+ 		nid = path->path[i];
+@@ -838,7 +838,9 @@ static hda_nid_t path_power_update(struct hda_codec *codec,
+ 			state = AC_PWRST_D0;
+ 		else
+ 			state = AC_PWRST_D3;
+-		if (!snd_hda_check_power_state(codec, nid, state)) {
++		power = snd_hda_codec_read(codec, nid, 0,
++					   AC_VERB_GET_POWER_STATE, 0);
++		if (power != (state | (state << 4))) {
+ 			snd_hda_codec_write(codec, nid, 0,
+ 					    AC_VERB_SET_POWER_STATE, state);
+ 			changed = nid;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index e5240cb3749f..c0b772bb49af 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -857,50 +857,6 @@ static int param_set_xint(const char *val, const struct kernel_param *kp)
+ #define azx_del_card_list(chip) /* NOP */
+ #endif /* CONFIG_PM */
+ 
+-/* Intel HSW/BDW display HDA controller is in GPU. Both its power and link BCLK
+- * depends on GPU. Two Extended Mode registers EM4 (M value) and EM5 (N Value)
+- * are used to convert CDClk (Core Display Clock) to 24MHz BCLK:
+- * BCLK = CDCLK * M / N
+- * The values will be lost when the display power well is disabled and need to
+- * be restored to avoid abnormal playback speed.
+- */
+-static void haswell_set_bclk(struct hda_intel *hda)
+-{
+-	struct azx *chip = &hda->chip;
+-	int cdclk_freq;
+-	unsigned int bclk_m, bclk_n;
+-
+-	if (!hda->need_i915_power)
+-		return;
+-
+-	cdclk_freq = snd_hdac_get_display_clk(azx_bus(chip));
+-	switch (cdclk_freq) {
+-	case 337500:
+-		bclk_m = 16;
+-		bclk_n = 225;
+-		break;
+-
+-	case 450000:
+-	default: /* default CDCLK 450MHz */
+-		bclk_m = 4;
+-		bclk_n = 75;
+-		break;
+-
+-	case 540000:
+-		bclk_m = 4;
+-		bclk_n = 90;
+-		break;
+-
+-	case 675000:
+-		bclk_m = 8;
+-		bclk_n = 225;
+-		break;
+-	}
+-
+-	azx_writew(chip, HSW_EM4, bclk_m);
+-	azx_writew(chip, HSW_EM5, bclk_n);
+-}
+-
+ #if defined(CONFIG_PM_SLEEP) || defined(SUPPORT_VGA_SWITCHEROO)
+ /*
+  * power management
+@@ -958,7 +914,7 @@ static int azx_resume(struct device *dev)
+ 	if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL
+ 		&& hda->need_i915_power) {
+ 		snd_hdac_display_power(azx_bus(chip), true);
+-		haswell_set_bclk(hda);
++		snd_hdac_i915_set_bclk(azx_bus(chip));
+ 	}
+ 	if (chip->msi)
+ 		if (pci_enable_msi(pci) < 0)
+@@ -1058,7 +1014,7 @@ static int azx_runtime_resume(struct device *dev)
+ 		bus = azx_bus(chip);
+ 		if (hda->need_i915_power) {
+ 			snd_hdac_display_power(bus, true);
+-			haswell_set_bclk(hda);
++			snd_hdac_i915_set_bclk(bus);
+ 		} else {
+ 			/* toggle codec wakeup bit for STATESTS read */
+ 			snd_hdac_set_codec_wakeup(bus, true);
+@@ -1796,12 +1752,8 @@ static int azx_first_init(struct azx *chip)
+ 	/* initialize chip */
+ 	azx_init_pci(chip);
+ 
+-	if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
+-		struct hda_intel *hda;
+-
+-		hda = container_of(chip, struct hda_intel, chip);
+-		haswell_set_bclk(hda);
+-	}
++	if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
++		snd_hdac_i915_set_bclk(bus);
+ 
+ 	hda_intel_init_chip(chip, (probe_only[dev] & 2) == 0);
+ 
+@@ -2232,6 +2184,9 @@ static const struct pci_device_id azx_ids[] = {
+ 	/* Broxton-P(Apollolake) */
+ 	{ PCI_DEVICE(0x8086, 0x5a98),
+ 	  .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON },
++	/* Broxton-T */
++	{ PCI_DEVICE(0x8086, 0x1a98),
++	  .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON },
+ 	/* Haswell */
+ 	{ PCI_DEVICE(0x8086, 0x0a0c),
+ 	  .driver_data = AZX_DRIVER_HDMI | AZX_DCAPS_INTEL_HASWELL },
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index a47e8ae0eb30..80bbadc83721 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -361,6 +361,7 @@ static int cs_parse_auto_config(struct hda_codec *codec)
+ {
+ 	struct cs_spec *spec = codec->spec;
+ 	int err;
++	int i;
+ 
+ 	err = snd_hda_parse_pin_defcfg(codec, &spec->gen.autocfg, NULL, 0);
+ 	if (err < 0)
+@@ -370,6 +371,19 @@ static int cs_parse_auto_config(struct hda_codec *codec)
+ 	if (err < 0)
+ 		return err;
+ 
++	/* keep the ADCs powered up when it's dynamically switchable */
++	if (spec->gen.dyn_adc_switch) {
++		unsigned int done = 0;
++		for (i = 0; i < spec->gen.input_mux.num_items; i++) {
++			int idx = spec->gen.dyn_adc_idx[i];
++			if (done & (1 << idx))
++				continue;
++			snd_hda_gen_fix_pin_power(codec,
++						  spec->gen.adc_nids[idx]);
++			done |= 1 << idx;
++		}
++	}
++
+ 	return 0;
+ }
+ 
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 0c9585602bf3..c98e404afbe0 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2452,6 +2452,7 @@ static void intel_pin_eld_notify(void *audio_ptr, int port)
+ 	if (atomic_read(&(codec)->core.in_pm))
+ 		return;
+ 
++	snd_hdac_i915_set_bclk(&codec->bus->core);
+ 	check_presence_and_report(codec, pin_nid);
+ }
+ 
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1402ba954b3d..ac4490a96863 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5449,6 +5449,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x0665, "Dell XPS 13", ALC288_FIXUP_DELL_XPS_13),
++	SND_PCI_QUIRK(0x1028, 0x0669, "Dell Optiplex 9020m", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x069a, "Dell Vostro 5480", ALC290_FIXUP_SUBWOOFER_HSJACK),
+ 	SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+@@ -5583,6 +5584,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x17aa, 0x5034, "Thinkpad T450", ALC292_FIXUP_TPT440_DOCK),
+ 	SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
+ 	SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK),
++	SND_PCI_QUIRK(0x17aa, 0x504a, "ThinkPad X260", ALC292_FIXUP_TPT440_DOCK),
+ 	SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
+ 	SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ 	SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
+diff --git a/sound/pci/pcxhr/pcxhr_core.c b/sound/pci/pcxhr/pcxhr_core.c
+index c5194f5b150a..d7e71f309299 100644
+--- a/sound/pci/pcxhr/pcxhr_core.c
++++ b/sound/pci/pcxhr/pcxhr_core.c
+@@ -1341,5 +1341,6 @@ irqreturn_t pcxhr_threaded_irq(int irq, void *dev_id)
+ 	}
+ 
+ 	pcxhr_msg_thread(mgr);
++	mutex_unlock(&mgr->lock);
+ 	return IRQ_HANDLED;
+ }
+diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
+index 11d032cdc658..48dbb2fdeb09 100644
+--- a/sound/soc/codecs/rt5640.c
++++ b/sound/soc/codecs/rt5640.c
+@@ -359,7 +359,7 @@ static const DECLARE_TLV_DB_RANGE(bst_tlv,
+ 
+ /* Interface data select */
+ static const char * const rt5640_data_select[] = {
+-	"Normal", "left copy to right", "right copy to left", "Swap"};
++	"Normal", "Swap", "left copy to right", "right copy to left"};
+ 
+ static SOC_ENUM_SINGLE_DECL(rt5640_if1_dac_enum, RT5640_DIG_INF_DATA,
+ 			    RT5640_IF1_DAC_SEL_SFT, rt5640_data_select);
+diff --git a/sound/soc/codecs/rt5640.h b/sound/soc/codecs/rt5640.h
+index 83a7150ddc24..f84231e7d1dd 100644
+--- a/sound/soc/codecs/rt5640.h
++++ b/sound/soc/codecs/rt5640.h
+@@ -442,39 +442,39 @@
+ #define RT5640_IF1_DAC_SEL_MASK			(0x3 << 14)
+ #define RT5640_IF1_DAC_SEL_SFT			14
+ #define RT5640_IF1_DAC_SEL_NOR			(0x0 << 14)
+-#define RT5640_IF1_DAC_SEL_L2R			(0x1 << 14)
+-#define RT5640_IF1_DAC_SEL_R2L			(0x2 << 14)
+-#define RT5640_IF1_DAC_SEL_SWAP			(0x3 << 14)
++#define RT5640_IF1_DAC_SEL_SWAP			(0x1 << 14)
++#define RT5640_IF1_DAC_SEL_L2R			(0x2 << 14)
++#define RT5640_IF1_DAC_SEL_R2L			(0x3 << 14)
+ #define RT5640_IF1_ADC_SEL_MASK			(0x3 << 12)
+ #define RT5640_IF1_ADC_SEL_SFT			12
+ #define RT5640_IF1_ADC_SEL_NOR			(0x0 << 12)
+-#define RT5640_IF1_ADC_SEL_L2R			(0x1 << 12)
+-#define RT5640_IF1_ADC_SEL_R2L			(0x2 << 12)
+-#define RT5640_IF1_ADC_SEL_SWAP			(0x3 << 12)
++#define RT5640_IF1_ADC_SEL_SWAP			(0x1 << 12)
++#define RT5640_IF1_ADC_SEL_L2R			(0x2 << 12)
++#define RT5640_IF1_ADC_SEL_R2L			(0x3 << 12)
+ #define RT5640_IF2_DAC_SEL_MASK			(0x3 << 10)
+ #define RT5640_IF2_DAC_SEL_SFT			10
+ #define RT5640_IF2_DAC_SEL_NOR			(0x0 << 10)
+-#define RT5640_IF2_DAC_SEL_L2R			(0x1 << 10)
+-#define RT5640_IF2_DAC_SEL_R2L			(0x2 << 10)
+-#define RT5640_IF2_DAC_SEL_SWAP			(0x3 << 10)
++#define RT5640_IF2_DAC_SEL_SWAP			(0x1 << 10)
++#define RT5640_IF2_DAC_SEL_L2R			(0x2 << 10)
++#define RT5640_IF2_DAC_SEL_R2L			(0x3 << 10)
+ #define RT5640_IF2_ADC_SEL_MASK			(0x3 << 8)
+ #define RT5640_IF2_ADC_SEL_SFT			8
+ #define RT5640_IF2_ADC_SEL_NOR			(0x0 << 8)
+-#define RT5640_IF2_ADC_SEL_L2R			(0x1 << 8)
+-#define RT5640_IF2_ADC_SEL_R2L			(0x2 << 8)
+-#define RT5640_IF2_ADC_SEL_SWAP			(0x3 << 8)
++#define RT5640_IF2_ADC_SEL_SWAP			(0x1 << 8)
++#define RT5640_IF2_ADC_SEL_L2R			(0x2 << 8)
++#define RT5640_IF2_ADC_SEL_R2L			(0x3 << 8)
+ #define RT5640_IF3_DAC_SEL_MASK			(0x3 << 6)
+ #define RT5640_IF3_DAC_SEL_SFT			6
+ #define RT5640_IF3_DAC_SEL_NOR			(0x0 << 6)
+-#define RT5640_IF3_DAC_SEL_L2R			(0x1 << 6)
+-#define RT5640_IF3_DAC_SEL_R2L			(0x2 << 6)
+-#define RT5640_IF3_DAC_SEL_SWAP			(0x3 << 6)
++#define RT5640_IF3_DAC_SEL_SWAP			(0x1 << 6)
++#define RT5640_IF3_DAC_SEL_L2R			(0x2 << 6)
++#define RT5640_IF3_DAC_SEL_R2L			(0x3 << 6)
+ #define RT5640_IF3_ADC_SEL_MASK			(0x3 << 4)
+ #define RT5640_IF3_ADC_SEL_SFT			4
+ #define RT5640_IF3_ADC_SEL_NOR			(0x0 << 4)
+-#define RT5640_IF3_ADC_SEL_L2R			(0x1 << 4)
+-#define RT5640_IF3_ADC_SEL_R2L			(0x2 << 4)
+-#define RT5640_IF3_ADC_SEL_SWAP			(0x3 << 4)
++#define RT5640_IF3_ADC_SEL_SWAP			(0x1 << 4)
++#define RT5640_IF3_ADC_SEL_L2R			(0x2 << 4)
++#define RT5640_IF3_ADC_SEL_R2L			(0x3 << 4)
+ 
+ /* REC Left Mixer Control 1 (0x3b) */
+ #define RT5640_G_HP_L_RM_L_MASK			(0x7 << 13)
+diff --git a/sound/soc/codecs/ssm4567.c b/sound/soc/codecs/ssm4567.c
+index e619d5651b09..080c78e88e10 100644
+--- a/sound/soc/codecs/ssm4567.c
++++ b/sound/soc/codecs/ssm4567.c
+@@ -352,6 +352,11 @@ static int ssm4567_set_power(struct ssm4567 *ssm4567, bool enable)
+ 	regcache_cache_only(ssm4567->regmap, !enable);
+ 
+ 	if (enable) {
++		ret = regmap_write(ssm4567->regmap, SSM4567_REG_SOFT_RESET,
++			0x00);
++		if (ret)
++			return ret;
++
+ 		ret = regmap_update_bits(ssm4567->regmap,
+ 			SSM4567_REG_POWER_CTRL,
+ 			SSM4567_POWER_SPWDN, 0x00);
+diff --git a/sound/soc/samsung/s3c-i2s-v2.c b/sound/soc/samsung/s3c-i2s-v2.c
+index df65c5b494b1..b6ab3fc5789e 100644
+--- a/sound/soc/samsung/s3c-i2s-v2.c
++++ b/sound/soc/samsung/s3c-i2s-v2.c
+@@ -709,7 +709,7 @@ static int s3c2412_i2s_resume(struct snd_soc_dai *dai)
+ #endif
+ 
+ int s3c_i2sv2_register_component(struct device *dev, int id,
+-			   struct snd_soc_component_driver *cmp_drv,
++			   const struct snd_soc_component_driver *cmp_drv,
+ 			   struct snd_soc_dai_driver *dai_drv)
+ {
+ 	struct snd_soc_dai_ops *ops = (struct snd_soc_dai_ops *)dai_drv->ops;
+diff --git a/sound/soc/samsung/s3c-i2s-v2.h b/sound/soc/samsung/s3c-i2s-v2.h
+index 90abab364b49..d0684145ed1f 100644
+--- a/sound/soc/samsung/s3c-i2s-v2.h
++++ b/sound/soc/samsung/s3c-i2s-v2.h
+@@ -101,7 +101,7 @@ extern int s3c_i2sv2_probe(struct snd_soc_dai *dai,
+  * soc core.
+  */
+ extern int s3c_i2sv2_register_component(struct device *dev, int id,
+-					struct snd_soc_component_driver *cmp_drv,
++					const struct snd_soc_component_driver *cmp_drv,
+ 					struct snd_soc_dai_driver *dai_drv);
+ 
+ #endif /* __SND_SOC_S3C24XX_S3C_I2SV2_I2S_H */
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 581175a51ecf..5e811dc02fb9 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2188,6 +2188,13 @@ static ssize_t dapm_widget_show_component(struct snd_soc_component *cmpnt,
+ 	int count = 0;
+ 	char *state = "not set";
+ 
++	/* card won't be set for the dummy component, as a spot fix
++	 * we're checking for that case specifically here but in future
++	 * we will ensure that the dummy component looks like others.
++	 */
++	if (!cmpnt->card)
++		return 0;
++
+ 	list_for_each_entry(w, &cmpnt->card->widgets, list) {
+ 		if (w->dapm != dapm)
+ 			continue;
+diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt
+index 52ef7a9d50aa..14d9e8ffaff7 100644
+--- a/tools/perf/Documentation/perf-stat.txt
++++ b/tools/perf/Documentation/perf-stat.txt
+@@ -69,6 +69,14 @@ report::
+ --scale::
+ 	scale/normalize counter values
+ 
++-d::
++--detailed::
++	print more detailed statistics, can be specified up to 3 times
++
++	   -d:          detailed events, L1 and LLC data cache
++        -d -d:     more detailed events, dTLB and iTLB events
++     -d -d -d:     very detailed events, adding prefetch events
++
+ -r::
+ --repeat=<n>::
+ 	repeat command and print average + stddev (max: 100). 0 means forever.
+diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
+index 08c09ad755d2..7bb47424bc49 100644
+--- a/tools/perf/ui/browsers/hists.c
++++ b/tools/perf/ui/browsers/hists.c
+@@ -302,7 +302,7 @@ static void callchain_node__init_have_children(struct callchain_node *node,
+ 	chain = list_entry(node->val.next, struct callchain_list, list);
+ 	chain->has_children = has_sibling;
+ 
+-	if (node->val.next != node->val.prev) {
++	if (!list_empty(&node->val)) {
+ 		chain = list_entry(node->val.prev, struct callchain_list, list);
+ 		chain->has_children = !RB_EMPTY_ROOT(&node->rb_root);
+ 	}
+@@ -844,7 +844,7 @@ next:
+ 	return row - first_row;
+ }
+ 
+-static int hist_browser__show_callchain(struct hist_browser *browser,
++static int hist_browser__show_callchain_graph(struct hist_browser *browser,
+ 					struct rb_root *root, int level,
+ 					unsigned short row, u64 total,
+ 					print_callchain_entry_fn print,
+@@ -898,7 +898,7 @@ static int hist_browser__show_callchain(struct hist_browser *browser,
+ 			else
+ 				new_total = total;
+ 
+-			row += hist_browser__show_callchain(browser, &child->rb_root,
++			row += hist_browser__show_callchain_graph(browser, &child->rb_root,
+ 							    new_level, row, new_total,
+ 							    print, arg, is_output_full);
+ 		}
+@@ -910,6 +910,43 @@ out:
+ 	return row - first_row;
+ }
+ 
++static int hist_browser__show_callchain(struct hist_browser *browser,
++					struct hist_entry *entry, int level,
++					unsigned short row,
++					print_callchain_entry_fn print,
++					struct callchain_print_arg *arg,
++					check_output_full_fn is_output_full)
++{
++	u64 total = hists__total_period(entry->hists);
++	int printed;
++
++	if (callchain_param.mode == CHAIN_GRAPH_REL) {
++		if (symbol_conf.cumulate_callchain)
++			total = entry->stat_acc->period;
++		else
++			total = entry->stat.period;
++	}
++
++	if (callchain_param.mode == CHAIN_FLAT) {
++		printed = hist_browser__show_callchain_flat(browser,
++						&entry->sorted_chain, row, total,
++						print, arg, is_output_full);
++	} else if (callchain_param.mode == CHAIN_FOLDED) {
++		printed = hist_browser__show_callchain_folded(browser,
++						&entry->sorted_chain, row, total,
++						print, arg, is_output_full);
++	} else {
++		printed = hist_browser__show_callchain_graph(browser,
++						&entry->sorted_chain, level, row, total,
++						print, arg, is_output_full);
++	}
++
++	if (arg->is_current_entry)
++		browser->he_selection = entry;
++
++	return printed;
++}
++
+ struct hpp_arg {
+ 	struct ui_browser *b;
+ 	char folded_sign;
+@@ -1084,38 +1121,14 @@ static int hist_browser__show_entry(struct hist_browser *browser,
+ 		--row_offset;
+ 
+ 	if (folded_sign == '-' && row != browser->b.rows) {
+-		u64 total = hists__total_period(entry->hists);
+ 		struct callchain_print_arg arg = {
+ 			.row_offset = row_offset,
+ 			.is_current_entry = current_entry,
+ 		};
+ 
+-		if (callchain_param.mode == CHAIN_GRAPH_REL) {
+-			if (symbol_conf.cumulate_callchain)
+-				total = entry->stat_acc->period;
+-			else
+-				total = entry->stat.period;
+-		}
+-
+-		if (callchain_param.mode == CHAIN_FLAT) {
+-			printed += hist_browser__show_callchain_flat(browser,
+-					&entry->sorted_chain, row, total,
++		printed += hist_browser__show_callchain(browser, entry, 1, row,
+ 					hist_browser__show_callchain_entry, &arg,
+ 					hist_browser__check_output_full);
+-		} else if (callchain_param.mode == CHAIN_FOLDED) {
+-			printed += hist_browser__show_callchain_folded(browser,
+-					&entry->sorted_chain, row, total,
+-					hist_browser__show_callchain_entry, &arg,
+-					hist_browser__check_output_full);
+-		} else {
+-			printed += hist_browser__show_callchain(browser,
+-					&entry->sorted_chain, 1, row, total,
+-					hist_browser__show_callchain_entry, &arg,
+-					hist_browser__check_output_full);
+-		}
+-
+-		if (arg.is_current_entry)
+-			browser->he_selection = entry;
+ 	}
+ 
+ 	return printed;
+@@ -1380,15 +1393,11 @@ do_offset:
+ static int hist_browser__fprintf_callchain(struct hist_browser *browser,
+ 					   struct hist_entry *he, FILE *fp)
+ {
+-	u64 total = hists__total_period(he->hists);
+ 	struct callchain_print_arg arg  = {
+ 		.fp = fp,
+ 	};
+ 
+-	if (symbol_conf.cumulate_callchain)
+-		total = he->stat_acc->period;
+-
+-	hist_browser__show_callchain(browser, &he->sorted_chain, 1, 0, total,
++	hist_browser__show_callchain(browser, he, 1, 0,
+ 				     hist_browser__fprintf_callchain_entry, &arg,
+ 				     hist_browser__check_dump_full);
+ 	return arg.printed;
+@@ -2320,10 +2329,12 @@ skip_annotation:
+ 			 *
+ 			 * See hist_browser__show_entry.
+ 			 */
+-			nr_options += add_script_opt(browser,
+-						     &actions[nr_options],
+-						     &options[nr_options],
+-						     NULL, browser->selection->sym);
++			if (sort__has_sym && browser->selection->sym) {
++				nr_options += add_script_opt(browser,
++							     &actions[nr_options],
++							     &options[nr_options],
++							     NULL, browser->selection->sym);
++			}
+ 		}
+ 		nr_options += add_script_opt(browser, &actions[nr_options],
+ 					     &options[nr_options], NULL, NULL);
+diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
+index 85155e91b61b..7bad5c3fa7b7 100644
+--- a/tools/perf/util/event.c
++++ b/tools/perf/util/event.c
+@@ -282,7 +282,7 @@ int perf_event__synthesize_mmap_events(struct perf_tool *tool,
+ 		strcpy(execname, "");
+ 
+ 		/* 00400000-0040c000 r-xp 00000000 fd:01 41038  /bin/cat */
+-		n = sscanf(bf, "%"PRIx64"-%"PRIx64" %s %"PRIx64" %x:%x %u %s\n",
++		n = sscanf(bf, "%"PRIx64"-%"PRIx64" %s %"PRIx64" %x:%x %u %[^\n]\n",
+ 		       &event->mmap2.start, &event->mmap2.len, prot,
+ 		       &event->mmap2.pgoff, &event->mmap2.maj,
+ 		       &event->mmap2.min,
+diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
+index d81f13de2476..a7eb0eae9938 100644
+--- a/tools/perf/util/evlist.c
++++ b/tools/perf/util/evlist.c
+@@ -1181,12 +1181,12 @@ void perf_evlist__set_maps(struct perf_evlist *evlist, struct cpu_map *cpus,
+ 	 */
+ 	if (cpus != evlist->cpus) {
+ 		cpu_map__put(evlist->cpus);
+-		evlist->cpus = cpus;
++		evlist->cpus = cpu_map__get(cpus);
+ 	}
+ 
+ 	if (threads != evlist->threads) {
+ 		thread_map__put(evlist->threads);
+-		evlist->threads = threads;
++		evlist->threads = thread_map__get(threads);
+ 	}
+ 
+ 	perf_evlist__propagate_maps(evlist);
+diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
+index 8e75434bd01c..4d8037a3d8a4 100644
+--- a/tools/perf/util/evsel.h
++++ b/tools/perf/util/evsel.h
+@@ -93,10 +93,8 @@ struct perf_evsel {
+ 	const char		*unit;
+ 	struct event_format	*tp_format;
+ 	off_t			id_offset;
+-	union {
+-		void		*priv;
+-		u64		db_id;
+-	};
++	void			*priv;
++	u64			db_id;
+ 	struct cgroup_sel	*cgrp;
+ 	void			*handler;
+ 	struct cpu_map		*cpus;
+diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
+index 05d815851be1..4e1590ba8902 100644
+--- a/tools/perf/util/intel-pt.c
++++ b/tools/perf/util/intel-pt.c
+@@ -1127,7 +1127,7 @@ static int intel_pt_synth_transaction_sample(struct intel_pt_queue *ptq)
+ 		pr_err("Intel Processor Trace: failed to deliver transaction event, error %d\n",
+ 		       ret);
+ 
+-	if (pt->synth_opts.callchain)
++	if (pt->synth_opts.last_branch)
+ 		intel_pt_reset_last_branch_rb(ptq);
+ 
+ 	return ret;
+diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
+index ea6064696fe4..a7b9022b5c8f 100644
+--- a/virt/kvm/arm/arch_timer.c
++++ b/virt/kvm/arm/arch_timer.c
+@@ -86,6 +86,8 @@ static void kvm_timer_inject_irq_work(struct work_struct *work)
+ 	vcpu = container_of(work, struct kvm_vcpu, arch.timer_cpu.expired);
+ 	vcpu->arch.timer_cpu.armed = false;
+ 
++	WARN_ON(!kvm_timer_should_fire(vcpu));
++
+ 	/*
+ 	 * If the vcpu is blocked we want to wake it up so that it will see
+ 	 * the timer has expired when entering the guest.
+@@ -93,10 +95,46 @@ static void kvm_timer_inject_irq_work(struct work_struct *work)
+ 	kvm_vcpu_kick(vcpu);
+ }
+ 
++static u64 kvm_timer_compute_delta(struct kvm_vcpu *vcpu)
++{
++	cycle_t cval, now;
++
++	cval = vcpu->arch.timer_cpu.cntv_cval;
++	now = kvm_phys_timer_read() - vcpu->kvm->arch.timer.cntvoff;
++
++	if (now < cval) {
++		u64 ns;
++
++		ns = cyclecounter_cyc2ns(timecounter->cc,
++					 cval - now,
++					 timecounter->mask,
++					 &timecounter->frac);
++		return ns;
++	}
++
++	return 0;
++}
++
+ static enum hrtimer_restart kvm_timer_expire(struct hrtimer *hrt)
+ {
+ 	struct arch_timer_cpu *timer;
++	struct kvm_vcpu *vcpu;
++	u64 ns;
++
+ 	timer = container_of(hrt, struct arch_timer_cpu, timer);
++	vcpu = container_of(timer, struct kvm_vcpu, arch.timer_cpu);
++
++	/*
++	 * Check that the timer has really expired from the guest's
++	 * PoV (NTP on the host may have forced it to expire
++	 * early). If we should have slept longer, restart it.
++	 */
++	ns = kvm_timer_compute_delta(vcpu);
++	if (unlikely(ns)) {
++		hrtimer_forward_now(hrt, ns_to_ktime(ns));
++		return HRTIMER_RESTART;
++	}
++
+ 	queue_work(wqueue, &timer->expired);
+ 	return HRTIMER_NORESTART;
+ }
+@@ -170,8 +208,6 @@ static int kvm_timer_update_state(struct kvm_vcpu *vcpu)
+ void kvm_timer_schedule(struct kvm_vcpu *vcpu)
+ {
+ 	struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
+-	u64 ns;
+-	cycle_t cval, now;
+ 
+ 	BUG_ON(timer_is_armed(timer));
+ 
+@@ -191,14 +227,7 @@ void kvm_timer_schedule(struct kvm_vcpu *vcpu)
+ 		return;
+ 
+ 	/*  The timer has not yet expired, schedule a background timer */
+-	cval = timer->cntv_cval;
+-	now = kvm_phys_timer_read() - vcpu->kvm->arch.timer.cntvoff;
+-
+-	ns = cyclecounter_cyc2ns(timecounter->cc,
+-				 cval - now,
+-				 timecounter->mask,
+-				 &timecounter->frac);
+-	timer_arm(timer, ns);
++	timer_arm(timer, kvm_timer_compute_delta(vcpu));
+ }
+ 
+ void kvm_timer_unschedule(struct kvm_vcpu *vcpu)