[gentoo-commits] proj/linux-patches:4.15 commit in: /

[Mike Pagano]

commit:     dfca21c3d8cf051f97cc37a7e27b7640b98e0472
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 28 17:03:40 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Mar 28 17:03:40 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=dfca21c3

Linux patch 4.15.14

 0000_README              |    4 +
 1013_linux-4.15.14.patch | 3891 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 3895 insertions(+)

diff --git a/0000_README b/0000_README
index 2b51c4d..f4d8a80 100644
--- a/0000_README
+++ b/0000_README
@@ -95,6 +95,10 @@ Patch:  1012_linux-4.15.13.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.15.13
 
+Patch:  1013_linux-4.15.14.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.15.14
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1013_linux-4.15.14.patch b/1013_linux-4.15.14.patch
new file mode 100644
index 0000000..9227e36
--- /dev/null
+++ b/1013_linux-4.15.14.patch
@@ -0,0 +1,3891 @@
+diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
+index 2e3f919485f4..fdec308a5041 100644
+--- a/Documentation/ABI/testing/sysfs-bus-iio
++++ b/Documentation/ABI/testing/sysfs-bus-iio
+@@ -32,7 +32,7 @@ Description:
+ 		Description of the physical chip / device for device X.
+ 		Typically a part number.
+ 
+-What:		/sys/bus/iio/devices/iio:deviceX/timestamp_clock
++What:		/sys/bus/iio/devices/iio:deviceX/current_timestamp_clock
+ KernelVersion:	4.5
+ Contact:	linux-iio@×××××××××××.org
+ Description:
+diff --git a/Makefile b/Makefile
+index 82245e654d10..a5e561900daf 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 15
+-SUBLEVEL = 13
++SUBLEVEL = 14
+ EXTRAVERSION =
+ NAME = Fearless Coyote
+ 
+@@ -798,6 +798,15 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign)
+ # disable invalid "can't wrap" optimizations for signed / pointers
+ KBUILD_CFLAGS	+= $(call cc-option,-fno-strict-overflow)
+ 
++# clang sets -fmerge-all-constants by default as optimization, but this
++# is non-conforming behavior for C and in fact breaks the kernel, so we
++# need to disable it here generally.
++KBUILD_CFLAGS	+= $(call cc-option,-fno-merge-all-constants)
++
++# for gcc -fno-merge-all-constants disables everything, but it is fine
++# to have actual conforming behavior enabled.
++KBUILD_CFLAGS	+= $(call cc-option,-fmerge-constants)
++
+ # Make sure -fstack-check isn't enabled (like gentoo apparently did)
+ KBUILD_CFLAGS  += $(call cc-option,-fno-stack-check,)
+ 
+diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
+index 5bdc2c4db9ad..f15dc3dfecf8 100644
+--- a/arch/arm64/mm/mmu.c
++++ b/arch/arm64/mm/mmu.c
+@@ -941,3 +941,13 @@ int pmd_clear_huge(pmd_t *pmd)
+ 	pmd_clear(pmd);
+ 	return 1;
+ }
++
++int pud_free_pmd_page(pud_t *pud)
++{
++	return pud_none(*pud);
++}
++
++int pmd_free_pte_page(pmd_t *pmd)
++{
++	return pmd_none(*pmd);
++}
+diff --git a/arch/h8300/include/asm/byteorder.h b/arch/h8300/include/asm/byteorder.h
+index ecff2d1ca5a3..6eaa7ad5fc2c 100644
+--- a/arch/h8300/include/asm/byteorder.h
++++ b/arch/h8300/include/asm/byteorder.h
+@@ -2,7 +2,6 @@
+ #ifndef __H8300_BYTEORDER_H__
+ #define __H8300_BYTEORDER_H__
+ 
+-#define __BIG_ENDIAN __ORDER_BIG_ENDIAN__
+ #include <linux/byteorder/big_endian.h>
+ 
+ #endif
+diff --git a/arch/mips/lantiq/Kconfig b/arch/mips/lantiq/Kconfig
+index 692ae85a3e3d..8e3a1fc2bc39 100644
+--- a/arch/mips/lantiq/Kconfig
++++ b/arch/mips/lantiq/Kconfig
+@@ -13,6 +13,8 @@ choice
+ config SOC_AMAZON_SE
+ 	bool "Amazon SE"
+ 	select SOC_TYPE_XWAY
++	select MFD_SYSCON
++	select MFD_CORE
+ 
+ config SOC_XWAY
+ 	bool "XWAY"
+diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
+index 52500d3b7004..e0af39b33e28 100644
+--- a/arch/mips/lantiq/xway/sysctrl.c
++++ b/arch/mips/lantiq/xway/sysctrl.c
+@@ -549,9 +549,9 @@ void __init ltq_soc_init(void)
+ 		clkdev_add_static(ltq_ar9_cpu_hz(), ltq_ar9_fpi_hz(),
+ 				ltq_ar9_fpi_hz(), CLOCK_250M);
+ 		clkdev_add_pmu("1f203018.usb2-phy", "phy", 1, 0, PMU_USB0_P);
+-		clkdev_add_pmu("1e101000.usb", "otg", 1, 0, PMU_USB0);
++		clkdev_add_pmu("1e101000.usb", "otg", 1, 0, PMU_USB0 | PMU_AHBM);
+ 		clkdev_add_pmu("1f203034.usb2-phy", "phy", 1, 0, PMU_USB1_P);
+-		clkdev_add_pmu("1e106000.usb", "otg", 1, 0, PMU_USB1);
++		clkdev_add_pmu("1e106000.usb", "otg", 1, 0, PMU_USB1 | PMU_AHBM);
+ 		clkdev_add_pmu("1e180000.etop", "switch", 1, 0, PMU_SWITCH);
+ 		clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO);
+ 		clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU);
+@@ -560,7 +560,7 @@ void __init ltq_soc_init(void)
+ 	} else {
+ 		clkdev_add_static(ltq_danube_cpu_hz(), ltq_danube_fpi_hz(),
+ 				ltq_danube_fpi_hz(), ltq_danube_pp32_hz());
+-		clkdev_add_pmu("1f203018.usb2-phy", "ctrl", 1, 0, PMU_USB0);
++		clkdev_add_pmu("1e101000.usb", "otg", 1, 0, PMU_USB0 | PMU_AHBM);
+ 		clkdev_add_pmu("1f203018.usb2-phy", "phy", 1, 0, PMU_USB0_P);
+ 		clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO);
+ 		clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU);
+diff --git a/arch/mips/ralink/mt7621.c b/arch/mips/ralink/mt7621.c
+index 1b274742077d..d2718de60b9b 100644
+--- a/arch/mips/ralink/mt7621.c
++++ b/arch/mips/ralink/mt7621.c
+@@ -170,6 +170,28 @@ void prom_soc_init(struct ralink_soc_info *soc_info)
+ 	u32 n1;
+ 	u32 rev;
+ 
++	/* Early detection of CMP support */
++	mips_cm_probe();
++	mips_cpc_probe();
++
++	if (mips_cps_numiocu(0)) {
++		/*
++		 * mips_cm_probe() wipes out bootloader
++		 * config for CM regions and we have to configure them
++		 * again. This SoC cannot talk to pamlbus devices
++		 * witout proper iocu region set up.
++		 *
++		 * FIXME: it would be better to do this with values
++		 * from DT, but we need this very early because
++		 * without this we cannot talk to pretty much anything
++		 * including serial.
++		 */
++		write_gcr_reg0_base(MT7621_PALMBUS_BASE);
++		write_gcr_reg0_mask(~MT7621_PALMBUS_SIZE |
++				    CM_GCR_REGn_MASK_CMTGT_IOCU0);
++		__sync();
++	}
++
+ 	n0 = __raw_readl(sysc + SYSC_REG_CHIP_NAME0);
+ 	n1 = __raw_readl(sysc + SYSC_REG_CHIP_NAME1);
+ 
+@@ -194,26 +216,6 @@ void prom_soc_init(struct ralink_soc_info *soc_info)
+ 
+ 	rt2880_pinmux_data = mt7621_pinmux_data;
+ 
+-	/* Early detection of CMP support */
+-	mips_cm_probe();
+-	mips_cpc_probe();
+-
+-	if (mips_cps_numiocu(0)) {
+-		/*
+-		 * mips_cm_probe() wipes out bootloader
+-		 * config for CM regions and we have to configure them
+-		 * again. This SoC cannot talk to pamlbus devices
+-		 * witout proper iocu region set up.
+-		 *
+-		 * FIXME: it would be better to do this with values
+-		 * from DT, but we need this very early because
+-		 * without this we cannot talk to pretty much anything
+-		 * including serial.
+-		 */
+-		write_gcr_reg0_base(MT7621_PALMBUS_BASE);
+-		write_gcr_reg0_mask(~MT7621_PALMBUS_SIZE |
+-				    CM_GCR_REGn_MASK_CMTGT_IOCU0);
+-	}
+ 
+ 	if (!register_cps_smp_ops())
+ 		return;
+diff --git a/arch/mips/ralink/reset.c b/arch/mips/ralink/reset.c
+index 64543d66e76b..e9531fea23a2 100644
+--- a/arch/mips/ralink/reset.c
++++ b/arch/mips/ralink/reset.c
+@@ -96,16 +96,9 @@ static void ralink_restart(char *command)
+ 	unreachable();
+ }
+ 
+-static void ralink_halt(void)
+-{
+-	local_irq_disable();
+-	unreachable();
+-}
+-
+ static int __init mips_reboot_setup(void)
+ {
+ 	_machine_restart = ralink_restart;
+-	_machine_halt = ralink_halt;
+ 
+ 	return 0;
+ }
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index 498c1b812300..1c4d012550ec 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -223,6 +223,15 @@ KBUILD_CFLAGS += $(cfi) $(cfi-sigframe) $(cfi-sections) $(asinstr) $(avx_instr)
+ 
+ LDFLAGS := -m elf_$(UTS_MACHINE)
+ 
++#
++# The 64-bit kernel must be aligned to 2MB.  Pass -z max-page-size=0x200000 to
++# the linker to force 2MB page size regardless of the default page size used
++# by the linker.
++#
++ifdef CONFIG_X86_64
++LDFLAGS += $(call ld-option, -z max-page-size=0x200000)
++endif
++
+ # Speed up the build
+ KBUILD_CFLAGS += -pipe
+ # Workaround for a gcc prelease that unfortunately was shipped in a suse release
+diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
+index 98761a1576ce..252fee320816 100644
+--- a/arch/x86/boot/compressed/misc.c
++++ b/arch/x86/boot/compressed/misc.c
+@@ -309,6 +309,10 @@ static void parse_elf(void *output)
+ 
+ 		switch (phdr->p_type) {
+ 		case PT_LOAD:
++#ifdef CONFIG_X86_64
++			if ((phdr->p_align % 0x200000) != 0)
++				error("Alignment of LOAD segment isn't multiple of 2MB");
++#endif
+ #ifdef CONFIG_RELOCATABLE
+ 			dest = output;
+ 			dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index 50dcbf640850..3a7d58384479 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -1097,7 +1097,7 @@ apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
+ #endif /* CONFIG_HYPERV */
+ 
+ idtentry debug			do_debug		has_error_code=0	paranoid=1 shift_ist=DEBUG_STACK
+-idtentry int3			do_int3			has_error_code=0	paranoid=1 shift_ist=DEBUG_STACK
++idtentry int3			do_int3			has_error_code=0
+ idtentry stack_segment		do_stack_segment	has_error_code=1
+ 
+ #ifdef CONFIG_XEN
+diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
+index 577fa8adb785..542392b6aab6 100644
+--- a/arch/x86/entry/vsyscall/vsyscall_64.c
++++ b/arch/x86/entry/vsyscall/vsyscall_64.c
+@@ -355,7 +355,7 @@ void __init set_vsyscall_pgtable_user_bits(pgd_t *root)
+ 	set_pgd(pgd, __pgd(pgd_val(*pgd) | _PAGE_USER));
+ 	p4d = p4d_offset(pgd, VSYSCALL_ADDR);
+ #if CONFIG_PGTABLE_LEVELS >= 5
+-	p4d->p4d |= _PAGE_USER;
++	set_p4d(p4d, __p4d(p4d_val(*p4d) | _PAGE_USER));
+ #endif
+ 	pud = pud_offset(p4d, VSYSCALL_ADDR);
+ 	set_pud(pud, __pud(pud_val(*pud) | _PAGE_USER));
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 56457cb73448..9b18a227fff7 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3194,7 +3194,7 @@ static unsigned bdw_limit_period(struct perf_event *event, unsigned left)
+ 			X86_CONFIG(.event=0xc0, .umask=0x01)) {
+ 		if (left < 128)
+ 			left = 128;
+-		left &= ~0x3fu;
++		left &= ~0x3fULL;
+ 	}
+ 	return left;
+ }
+diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
+index 6d8044ab1060..7da7a79eba53 100644
+--- a/arch/x86/events/intel/uncore_snbep.c
++++ b/arch/x86/events/intel/uncore_snbep.c
+@@ -3562,24 +3562,27 @@ static struct intel_uncore_type *skx_msr_uncores[] = {
+ 	NULL,
+ };
+ 
++/*
++ * To determine the number of CHAs, it should read bits 27:0 in the CAPID6
++ * register which located at Device 30, Function 3, Offset 0x9C. PCI ID 0x2083.
++ */
++#define SKX_CAPID6		0x9c
++#define SKX_CHA_BIT_MASK	GENMASK(27, 0)
++
+ static int skx_count_chabox(void)
+ {
+-	struct pci_dev *chabox_dev = NULL;
+-	int bus, count = 0;
++	struct pci_dev *dev = NULL;
++	u32 val = 0;
+ 
+-	while (1) {
+-		chabox_dev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x208d, chabox_dev);
+-		if (!chabox_dev)
+-			break;
+-		if (count == 0)
+-			bus = chabox_dev->bus->number;
+-		if (bus != chabox_dev->bus->number)
+-			break;
+-		count++;
+-	}
++	dev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x2083, dev);
++	if (!dev)
++		goto out;
+ 
+-	pci_dev_put(chabox_dev);
+-	return count;
++	pci_read_config_dword(dev, SKX_CAPID6, &val);
++	val &= SKX_CHA_BIT_MASK;
++out:
++	pci_dev_put(dev);
++	return hweight32(val);
+ }
+ 
+ void skx_uncore_cpu_init(void)
+@@ -3606,7 +3609,7 @@ static struct intel_uncore_type skx_uncore_imc = {
+ };
+ 
+ static struct attribute *skx_upi_uncore_formats_attr[] = {
+-	&format_attr_event_ext.attr,
++	&format_attr_event.attr,
+ 	&format_attr_umask_ext.attr,
+ 	&format_attr_edge.attr,
+ 	&format_attr_inv.attr,
+diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h
+index 8b6780751132..5db8b0b10766 100644
+--- a/arch/x86/include/asm/vmx.h
++++ b/arch/x86/include/asm/vmx.h
+@@ -352,6 +352,7 @@ enum vmcs_field {
+ #define INTR_TYPE_NMI_INTR		(2 << 8) /* NMI */
+ #define INTR_TYPE_HARD_EXCEPTION	(3 << 8) /* processor exception */
+ #define INTR_TYPE_SOFT_INTR             (4 << 8) /* software interrupt */
++#define INTR_TYPE_PRIV_SW_EXCEPTION	(5 << 8) /* ICE breakpoint - undocumented */
+ #define INTR_TYPE_SOFT_EXCEPTION	(6 << 8) /* software exception */
+ 
+ /* GUEST_INTERRUPTIBILITY_INFO flags. */
+diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c
+index 56d99be3706a..50bee5fe1140 100644
+--- a/arch/x86/kernel/idt.c
++++ b/arch/x86/kernel/idt.c
+@@ -160,7 +160,6 @@ static const __initconst struct idt_data early_pf_idts[] = {
+  */
+ static const __initconst struct idt_data dbg_idts[] = {
+ 	INTG(X86_TRAP_DB,	debug),
+-	INTG(X86_TRAP_BP,	int3),
+ };
+ #endif
+ 
+@@ -183,7 +182,6 @@ gate_desc debug_idt_table[IDT_ENTRIES] __page_aligned_bss;
+ static const __initconst struct idt_data ist_idts[] = {
+ 	ISTG(X86_TRAP_DB,	debug,		DEBUG_STACK),
+ 	ISTG(X86_TRAP_NMI,	nmi,		NMI_STACK),
+-	SISTG(X86_TRAP_BP,	int3,		DEBUG_STACK),
+ 	ISTG(X86_TRAP_DF,	double_fault,	DOUBLEFAULT_STACK),
+ #ifdef CONFIG_X86_MCE
+ 	ISTG(X86_TRAP_MC,	&machine_check,	MCE_STACK),
+diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
+index 3d9b2308e7fa..03f3d7695dac 100644
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -577,7 +577,6 @@ do_general_protection(struct pt_regs *regs, long error_code)
+ }
+ NOKPROBE_SYMBOL(do_general_protection);
+ 
+-/* May run on IST stack. */
+ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code)
+ {
+ #ifdef CONFIG_DYNAMIC_FTRACE
+@@ -592,6 +591,13 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code)
+ 	if (poke_int3_handler(regs))
+ 		return;
+ 
++	/*
++	 * Use ist_enter despite the fact that we don't use an IST stack.
++	 * We can be called from a kprobe in non-CONTEXT_KERNEL kernel
++	 * mode or even during context tracking state changes.
++	 *
++	 * This means that we can't schedule.  That's okay.
++	 */
+ 	ist_enter(regs);
+ 	RCU_LOCKDEP_WARN(!rcu_is_watching(), "entry code didn't wake RCU");
+ #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP
+@@ -609,15 +615,10 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code)
+ 			SIGTRAP) == NOTIFY_STOP)
+ 		goto exit;
+ 
+-	/*
+-	 * Let others (NMI) know that the debug stack is in use
+-	 * as we may switch to the interrupt stack.
+-	 */
+-	debug_stack_usage_inc();
+ 	cond_local_irq_enable(regs);
+ 	do_trap(X86_TRAP_BP, SIGTRAP, "int3", regs, error_code, NULL);
+ 	cond_local_irq_disable(regs);
+-	debug_stack_usage_dec();
++
+ exit:
+ 	ist_exit(regs);
+ }
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 87b453eeae40..2beb77c319e8 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -1079,6 +1079,13 @@ static inline bool is_machine_check(u32 intr_info)
+ 		(INTR_TYPE_HARD_EXCEPTION | MC_VECTOR | INTR_INFO_VALID_MASK);
+ }
+ 
++/* Undocumented: icebp/int1 */
++static inline bool is_icebp(u32 intr_info)
++{
++	return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
++		== (INTR_TYPE_PRIV_SW_EXCEPTION | INTR_INFO_VALID_MASK);
++}
++
+ static inline bool cpu_has_vmx_msr_bitmap(void)
+ {
+ 	return vmcs_config.cpu_based_exec_ctrl & CPU_BASED_USE_MSR_BITMAPS;
+@@ -6173,7 +6180,7 @@ static int handle_exception(struct kvm_vcpu *vcpu)
+ 		      (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))) {
+ 			vcpu->arch.dr6 &= ~15;
+ 			vcpu->arch.dr6 |= dr6 | DR6_RTM;
+-			if (!(dr6 & ~DR6_RESERVED)) /* icebp */
++			if (is_icebp(intr_info))
+ 				skip_emulated_instruction(vcpu);
+ 
+ 			kvm_queue_exception(vcpu, DB_VECTOR);
+diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
+index 004abf9ebf12..34cda7e0551b 100644
+--- a/arch/x86/mm/pgtable.c
++++ b/arch/x86/mm/pgtable.c
+@@ -702,4 +702,52 @@ int pmd_clear_huge(pmd_t *pmd)
+ 
+ 	return 0;
+ }
++
++/**
++ * pud_free_pmd_page - Clear pud entry and free pmd page.
++ * @pud: Pointer to a PUD.
++ *
++ * Context: The pud range has been unmaped and TLB purged.
++ * Return: 1 if clearing the entry succeeded. 0 otherwise.
++ */
++int pud_free_pmd_page(pud_t *pud)
++{
++	pmd_t *pmd;
++	int i;
++
++	if (pud_none(*pud))
++		return 1;
++
++	pmd = (pmd_t *)pud_page_vaddr(*pud);
++
++	for (i = 0; i < PTRS_PER_PMD; i++)
++		if (!pmd_free_pte_page(&pmd[i]))
++			return 0;
++
++	pud_clear(pud);
++	free_page((unsigned long)pmd);
++
++	return 1;
++}
++
++/**
++ * pmd_free_pte_page - Clear pmd entry and free pte page.
++ * @pmd: Pointer to a PMD.
++ *
++ * Context: The pmd range has been unmaped and TLB purged.
++ * Return: 1 if clearing the entry succeeded. 0 otherwise.
++ */
++int pmd_free_pte_page(pmd_t *pmd)
++{
++	pte_t *pte;
++
++	if (pmd_none(*pmd))
++		return 1;
++
++	pte = (pte_t *)pmd_page_vaddr(*pmd);
++	pmd_clear(pmd);
++	free_page((unsigned long)pte);
++
++	return 1;
++}
+ #endif	/* CONFIG_HAVE_ARCH_HUGE_VMAP */
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 940aac70b4da..bb77606d04e0 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -1156,7 +1156,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
+ 	 * may converge on the last pass. In such case do one more
+ 	 * pass to emit the final image
+ 	 */
+-	for (pass = 0; pass < 10 || image; pass++) {
++	for (pass = 0; pass < 20 || image; pass++) {
+ 		proglen = do_jit(prog, addrs, image, oldproglen, &ctx);
+ 		if (proglen <= 0) {
+ 			image = NULL;
+@@ -1183,6 +1183,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
+ 			}
+ 		}
+ 		oldproglen = proglen;
++		cond_resched();
+ 	}
+ 
+ 	if (bpf_jit_enable > 1)
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index 2dd15e967c3f..0167e526b04f 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -228,7 +228,7 @@ int __init efi_alloc_page_tables(void)
+ 	if (!pud) {
+ 		if (CONFIG_PGTABLE_LEVELS > 4)
+ 			free_page((unsigned long) pgd_page_vaddr(*pgd));
+-		free_page((unsigned long)efi_pgd);
++		free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER);
+ 		return -ENOMEM;
+ 	}
+ 
+diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c
+index 11b113f8e367..ebb626ffb5fa 100644
+--- a/drivers/acpi/acpi_watchdog.c
++++ b/drivers/acpi/acpi_watchdog.c
+@@ -74,10 +74,10 @@ void __init acpi_watchdog_init(void)
+ 		res.start = gas->address;
+ 		if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
+ 			res.flags = IORESOURCE_MEM;
+-			res.end = res.start + ALIGN(gas->access_width, 4);
++			res.end = res.start + ALIGN(gas->access_width, 4) - 1;
+ 		} else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO) {
+ 			res.flags = IORESOURCE_IO;
+-			res.end = res.start + gas->access_width;
++			res.end = res.start + gas->access_width - 1;
+ 		} else {
+ 			pr_warn("Unsupported address space: %u\n",
+ 				gas->space_id);
+diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
+index 917f1cc0fda4..8fb74d9011da 100644
+--- a/drivers/acpi/numa.c
++++ b/drivers/acpi/numa.c
+@@ -103,25 +103,27 @@ int acpi_map_pxm_to_node(int pxm)
+  */
+ int acpi_map_pxm_to_online_node(int pxm)
+ {
+-	int node, n, dist, min_dist;
++	int node, min_node;
+ 
+ 	node = acpi_map_pxm_to_node(pxm);
+ 
+ 	if (node == NUMA_NO_NODE)
+ 		node = 0;
+ 
++	min_node = node;
+ 	if (!node_online(node)) {
+-		min_dist = INT_MAX;
++		int min_dist = INT_MAX, dist, n;
++
+ 		for_each_online_node(n) {
+ 			dist = node_distance(node, n);
+ 			if (dist < min_dist) {
+ 				min_dist = dist;
+-				node = n;
++				min_node = n;
+ 			}
+ 		}
+ 	}
+ 
+-	return node;
++	return min_node;
+ }
+ EXPORT_SYMBOL(acpi_map_pxm_to_online_node);
+ 
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 44a9d630b7ac..2badef1271fd 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -542,7 +542,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	  .driver_data = board_ahci_yes_fbs },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230),
+ 	  .driver_data = board_ahci_yes_fbs },
+-	{ PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642),
++	{ PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642), /* highpoint rocketraid 642L */
++	  .driver_data = board_ahci_yes_fbs },
++	{ PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0645), /* highpoint rocketraid 644L */
+ 	  .driver_data = board_ahci_yes_fbs },
+ 
+ 	/* Promise */
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 3c09122bf038..7431ccd03316 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4530,6 +4530,25 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ 	{ "PIONEER DVD-RW  DVR-212D",	NULL,	ATA_HORKAGE_NOSETXFER },
+ 	{ "PIONEER DVD-RW  DVR-216D",	NULL,	ATA_HORKAGE_NOSETXFER },
+ 
++	/* Crucial BX100 SSD 500GB has broken LPM support */
++	{ "CT500BX100SSD1",		NULL,	ATA_HORKAGE_NOLPM },
++
++	/* 512GB MX100 with MU01 firmware has both queued TRIM and LPM issues */
++	{ "Crucial_CT512MX100*",	"MU01",	ATA_HORKAGE_NO_NCQ_TRIM |
++						ATA_HORKAGE_ZERO_AFTER_TRIM |
++						ATA_HORKAGE_NOLPM, },
++	/* 512GB MX100 with newer firmware has only LPM issues */
++	{ "Crucial_CT512MX100*",	NULL,	ATA_HORKAGE_ZERO_AFTER_TRIM |
++						ATA_HORKAGE_NOLPM, },
++
++	/* 480GB+ M500 SSDs have both queued TRIM and LPM issues */
++	{ "Crucial_CT480M500*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
++						ATA_HORKAGE_ZERO_AFTER_TRIM |
++						ATA_HORKAGE_NOLPM, },
++	{ "Crucial_CT960M500*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
++						ATA_HORKAGE_ZERO_AFTER_TRIM |
++						ATA_HORKAGE_NOLPM, },
++
+ 	/* devices that don't properly handle queued TRIM commands */
+ 	{ "Micron_M500_*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
+ 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
+@@ -4541,7 +4560,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ 	{ "Crucial_CT*MX100*",		"MU01",	ATA_HORKAGE_NO_NCQ_TRIM |
+ 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
+-	{ "Samsung SSD 8*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
++	{ "Samsung SSD 840*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
++						ATA_HORKAGE_ZERO_AFTER_TRIM, },
++	{ "Samsung SSD 850*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
+ 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ 	{ "FCCT*M500*",			NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
+ 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
+@@ -5401,8 +5422,7 @@ void ata_qc_issue(struct ata_queued_cmd *qc)
+ 	 * We guarantee to LLDs that they will have at least one
+ 	 * non-zero sg if the command is a data command.
+ 	 */
+-	if (WARN_ON_ONCE(ata_is_data(prot) &&
+-			 (!qc->sg || !qc->n_elem || !qc->nbytes)))
++	if (ata_is_data(prot) && (!qc->sg || !qc->n_elem || !qc->nbytes))
+ 		goto sys_err;
+ 
+ 	if (ata_is_dma(prot) || (ata_is_pio(prot) &&
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 66be961c93a4..197e110f8ac7 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -3316,6 +3316,12 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
+ 		goto invalid_fld;
+ 	}
+ 
++	/* We may not issue NCQ commands to devices not supporting NCQ */
++	if (ata_is_ncq(tf->protocol) && !ata_ncq_enabled(dev)) {
++		fp = 1;
++		goto invalid_fld;
++	}
++
+ 	/* sanity check for pio multi commands */
+ 	if ((cdb[1] & 0xe0) && !is_multi_taskfile(tf)) {
+ 		fp = 1;
+@@ -4309,7 +4315,9 @@ static inline int __ata_scsi_queuecmd(struct scsi_cmnd *scmd,
+ 		if (likely((scsi_op != ATA_16) || !atapi_passthru16)) {
+ 			/* relay SCSI command to ATAPI device */
+ 			int len = COMMAND_SIZE(scsi_op);
+-			if (unlikely(len > scmd->cmd_len || len > dev->cdb_len))
++			if (unlikely(len > scmd->cmd_len ||
++				     len > dev->cdb_len ||
++				     scmd->cmd_len > ATAPI_CDB_LEN))
+ 				goto bad_cdb_len;
+ 
+ 			xlat_func = atapi_xlat;
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index e71e54c478da..2f57e8b88a7a 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -230,7 +230,6 @@ static const struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
+@@ -263,6 +262,7 @@ static const struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
+ 
+ 	/* QCA ROME chipset */
++	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_QCA_ROME },
+ 	{ USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME },
+ 	{ USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME },
+ 	{ USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME },
+@@ -383,10 +383,10 @@ static const struct usb_device_id blacklist_table[] = {
+  */
+ static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
+ 	{
+-		/* Lenovo Yoga 920 (QCA Rome device 0cf3:e300) */
++		/* Dell OptiPlex 3060 (QCA ROME device 0cf3:e007) */
+ 		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 920"),
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"),
+ 		},
+ 	},
+ 	{}
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
+index 44301a3d9963..a07f6451694a 100644
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -449,17 +449,17 @@ struct bcm2835_pll_ana_bits {
+ static const struct bcm2835_pll_ana_bits bcm2835_ana_default = {
+ 	.mask0 = 0,
+ 	.set0 = 0,
+-	.mask1 = (u32)~(A2W_PLL_KI_MASK | A2W_PLL_KP_MASK),
++	.mask1 = A2W_PLL_KI_MASK | A2W_PLL_KP_MASK,
+ 	.set1 = (2 << A2W_PLL_KI_SHIFT) | (8 << A2W_PLL_KP_SHIFT),
+-	.mask3 = (u32)~A2W_PLL_KA_MASK,
++	.mask3 = A2W_PLL_KA_MASK,
+ 	.set3 = (2 << A2W_PLL_KA_SHIFT),
+ 	.fb_prediv_mask = BIT(14),
+ };
+ 
+ static const struct bcm2835_pll_ana_bits bcm2835_ana_pllh = {
+-	.mask0 = (u32)~(A2W_PLLH_KA_MASK | A2W_PLLH_KI_LOW_MASK),
++	.mask0 = A2W_PLLH_KA_MASK | A2W_PLLH_KI_LOW_MASK,
+ 	.set0 = (2 << A2W_PLLH_KA_SHIFT) | (2 << A2W_PLLH_KI_LOW_SHIFT),
+-	.mask1 = (u32)~(A2W_PLLH_KI_HIGH_MASK | A2W_PLLH_KP_MASK),
++	.mask1 = A2W_PLLH_KI_HIGH_MASK | A2W_PLLH_KP_MASK,
+ 	.set1 = (6 << A2W_PLLH_KP_SHIFT),
+ 	.mask3 = 0,
+ 	.set3 = 0,
+@@ -623,8 +623,10 @@ static int bcm2835_pll_on(struct clk_hw *hw)
+ 		     ~A2W_PLL_CTRL_PWRDN);
+ 
+ 	/* Take the PLL out of reset. */
++	spin_lock(&cprman->regs_lock);
+ 	cprman_write(cprman, data->cm_ctrl_reg,
+ 		     cprman_read(cprman, data->cm_ctrl_reg) & ~CM_PLL_ANARST);
++	spin_unlock(&cprman->regs_lock);
+ 
+ 	/* Wait for the PLL to lock. */
+ 	timeout = ktime_add_ns(ktime_get(), LOCK_TIMEOUT_NS);
+@@ -701,9 +703,11 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw,
+ 	}
+ 
+ 	/* Unmask the reference clock from the oscillator. */
++	spin_lock(&cprman->regs_lock);
+ 	cprman_write(cprman, A2W_XOSC_CTRL,
+ 		     cprman_read(cprman, A2W_XOSC_CTRL) |
+ 		     data->reference_enable_mask);
++	spin_unlock(&cprman->regs_lock);
+ 
+ 	if (do_ana_setup_first)
+ 		bcm2835_pll_write_ana(cprman, data->ana_reg_base, ana);
+diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+index 72b16ed1012b..3b97f60540ad 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
++++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+@@ -762,7 +762,7 @@ static struct ccu_mp out_a_clk = {
+ 		.features	= CCU_FEATURE_FIXED_PREDIV,
+ 		.hw.init	= CLK_HW_INIT_PARENTS("out-a",
+ 						      clk_out_parents,
+-						      &ccu_div_ops,
++						      &ccu_mp_ops,
+ 						      0),
+ 	},
+ };
+@@ -783,7 +783,7 @@ static struct ccu_mp out_b_clk = {
+ 		.features	= CCU_FEATURE_FIXED_PREDIV,
+ 		.hw.init	= CLK_HW_INIT_PARENTS("out-b",
+ 						      clk_out_parents,
+-						      &ccu_div_ops,
++						      &ccu_mp_ops,
+ 						      0),
+ 	},
+ };
+@@ -804,7 +804,7 @@ static struct ccu_mp out_c_clk = {
+ 		.features	= CCU_FEATURE_FIXED_PREDIV,
+ 		.hw.init	= CLK_HW_INIT_PARENTS("out-c",
+ 						      clk_out_parents,
+-						      &ccu_div_ops,
++						      &ccu_mp_ops,
+ 						      0),
+ 	},
+ };
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index bb5fa895fb64..97ecfd16ee82 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3090,8 +3090,6 @@ static int amdgpu_dm_plane_init(struct amdgpu_display_manager *dm,
+ 
+ 	switch (aplane->base.type) {
+ 	case DRM_PLANE_TYPE_PRIMARY:
+-		aplane->base.format_default = true;
+-
+ 		res = drm_universal_plane_init(
+ 				dm->adev->ddev,
+ 				&aplane->base,
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+index 9bd142f65f9b..e1acc10e35a2 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+@@ -109,7 +109,7 @@ enum dc_edid_status dm_helpers_parse_edid_caps(
+ 		struct cea_sad *sad = &sads[i];
+ 
+ 		edid_caps->audio_modes[i].format_code = sad->format;
+-		edid_caps->audio_modes[i].channel_count = sad->channels;
++		edid_caps->audio_modes[i].channel_count = sad->channels + 1;
+ 		edid_caps->audio_modes[i].sample_rate = sad->freq;
+ 		edid_caps->audio_modes[i].sample_size = sad->byte2;
+ 	}
+diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
+index 5e1f1e2deb52..343cb5fa9b03 100644
+--- a/drivers/gpu/drm/drm_framebuffer.c
++++ b/drivers/gpu/drm/drm_framebuffer.c
+@@ -458,6 +458,12 @@ int drm_mode_getfb(struct drm_device *dev,
+ 	if (!fb)
+ 		return -ENOENT;
+ 
++	/* Multi-planar framebuffers need getfb2. */
++	if (fb->format->num_planes > 1) {
++		ret = -EINVAL;
++		goto out;
++	}
++
+ 	r->height = fb->height;
+ 	r->width = fb->width;
+ 	r->depth = fb->format->depth;
+@@ -481,6 +487,7 @@ int drm_mode_getfb(struct drm_device *dev,
+ 		ret = -ENODEV;
+ 	}
+ 
++out:
+ 	drm_framebuffer_put(fb);
+ 
+ 	return ret;
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index 30e129684c7c..fd0d0c758a94 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -90,25 +90,18 @@ void radeon_connector_hotplug(struct drm_connector *connector)
+ 		/* don't do anything if sink is not display port, i.e.,
+ 		 * passive dp->(dvi|hdmi) adaptor
+ 		 */
+-		if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) {
+-			int saved_dpms = connector->dpms;
+-			/* Only turn off the display if it's physically disconnected */
+-			if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) {
+-				drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+-			} else if (radeon_dp_needs_link_train(radeon_connector)) {
+-				/* Don't try to start link training before we
+-				 * have the dpcd */
+-				if (!radeon_dp_getdpcd(radeon_connector))
+-					return;
+-
+-				/* set it to OFF so that drm_helper_connector_dpms()
+-				 * won't return immediately since the current state
+-				 * is ON at this point.
+-				 */
+-				connector->dpms = DRM_MODE_DPMS_OFF;
+-				drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
+-			}
+-			connector->dpms = saved_dpms;
++		if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT &&
++		    radeon_hpd_sense(rdev, radeon_connector->hpd.hpd) &&
++		    radeon_dp_needs_link_train(radeon_connector)) {
++			/* Don't start link training before we have the DPCD */
++			if (!radeon_dp_getdpcd(radeon_connector))
++				return;
++
++			/* Turn the connector off and back on immediately, which
++			 * will trigger link training
++			 */
++			drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
++			drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
+ 		}
+ 	}
+ }
+diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
+index b5b335c9b2bb..2ebdc6d5a76e 100644
+--- a/drivers/gpu/drm/udl/udl_fb.c
++++ b/drivers/gpu/drm/udl/udl_fb.c
+@@ -159,10 +159,15 @@ static int udl_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
+ {
+ 	unsigned long start = vma->vm_start;
+ 	unsigned long size = vma->vm_end - vma->vm_start;
+-	unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
++	unsigned long offset;
+ 	unsigned long page, pos;
+ 
+-	if (offset + size > info->fix.smem_len)
++	if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
++		return -EINVAL;
++
++	offset = vma->vm_pgoff << PAGE_SHIFT;
++
++	if (offset > info->fix.smem_len || size > info->fix.smem_len - offset)
+ 		return -EINVAL;
+ 
+ 	pos = (unsigned long)info->fix.smem_start + offset;
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index 184340d486c3..86d25f18aa99 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -1337,6 +1337,19 @@ static void __vmw_svga_disable(struct vmw_private *dev_priv)
+  */
+ void vmw_svga_disable(struct vmw_private *dev_priv)
+ {
++	/*
++	 * Disabling SVGA will turn off device modesetting capabilities, so
++	 * notify KMS about that so that it doesn't cache atomic state that
++	 * isn't valid anymore, for example crtcs turned on.
++	 * Strictly we'd want to do this under the SVGA lock (or an SVGA mutex),
++	 * but vmw_kms_lost_device() takes the reservation sem and thus we'll
++	 * end up with lock order reversal. Thus, a master may actually perform
++	 * a new modeset just after we call vmw_kms_lost_device() and race with
++	 * vmw_svga_disable(), but that should at worst cause atomic KMS state
++	 * to be inconsistent with the device, causing modesetting problems.
++	 *
++	 */
++	vmw_kms_lost_device(dev_priv->dev);
+ 	ttm_write_lock(&dev_priv->reservation_sem, false);
+ 	spin_lock(&dev_priv->svga_lock);
+ 	if (dev_priv->bdev.man[TTM_PL_VRAM].use_type) {
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+index 7e5f30e234b1..8c65cc3b0dda 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+@@ -938,6 +938,7 @@ int vmw_kms_present(struct vmw_private *dev_priv,
+ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
+ 				struct drm_file *file_priv);
+ void vmw_kms_legacy_hotspot_clear(struct vmw_private *dev_priv);
++void vmw_kms_lost_device(struct drm_device *dev);
+ 
+ int vmw_dumb_create(struct drm_file *file_priv,
+ 		    struct drm_device *dev,
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+index fcd58145d0da..dfaaf9a2d81e 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -31,7 +31,6 @@
+ #include <drm/drm_atomic_helper.h>
+ #include <drm/drm_rect.h>
+ 
+-
+ /* Might need a hrtimer here? */
+ #define VMWGFX_PRESENT_RATE ((HZ / 60 > 0) ? HZ / 60 : 1)
+ 
+@@ -2531,9 +2530,12 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv,
+  * Helper to be used if an error forces the caller to undo the actions of
+  * vmw_kms_helper_resource_prepare.
+  */
+-void vmw_kms_helper_resource_revert(struct vmw_resource *res)
++void vmw_kms_helper_resource_revert(struct vmw_validation_ctx *ctx)
+ {
+-	vmw_kms_helper_buffer_revert(res->backup);
++	struct vmw_resource *res = ctx->res;
++
++	vmw_kms_helper_buffer_revert(ctx->buf);
++	vmw_dmabuf_unreference(&ctx->buf);
+ 	vmw_resource_unreserve(res, false, NULL, 0);
+ 	mutex_unlock(&res->dev_priv->cmdbuf_mutex);
+ }
+@@ -2550,10 +2552,14 @@ void vmw_kms_helper_resource_revert(struct vmw_resource *res)
+  * interrupted by a signal.
+  */
+ int vmw_kms_helper_resource_prepare(struct vmw_resource *res,
+-				    bool interruptible)
++				    bool interruptible,
++				    struct vmw_validation_ctx *ctx)
+ {
+ 	int ret = 0;
+ 
++	ctx->buf = NULL;
++	ctx->res = res;
++
+ 	if (interruptible)
+ 		ret = mutex_lock_interruptible(&res->dev_priv->cmdbuf_mutex);
+ 	else
+@@ -2572,6 +2578,8 @@ int vmw_kms_helper_resource_prepare(struct vmw_resource *res,
+ 						    res->dev_priv->has_mob);
+ 		if (ret)
+ 			goto out_unreserve;
++
++		ctx->buf = vmw_dmabuf_reference(res->backup);
+ 	}
+ 	ret = vmw_resource_validate(res);
+ 	if (ret)
+@@ -2579,7 +2587,7 @@ int vmw_kms_helper_resource_prepare(struct vmw_resource *res,
+ 	return 0;
+ 
+ out_revert:
+-	vmw_kms_helper_buffer_revert(res->backup);
++	vmw_kms_helper_buffer_revert(ctx->buf);
+ out_unreserve:
+ 	vmw_resource_unreserve(res, false, NULL, 0);
+ out_unlock:
+@@ -2595,11 +2603,13 @@ int vmw_kms_helper_resource_prepare(struct vmw_resource *res,
+  * @out_fence: Optional pointer to a fence pointer. If non-NULL, a
+  * ref-counted fence pointer is returned here.
+  */
+-void vmw_kms_helper_resource_finish(struct vmw_resource *res,
+-			     struct vmw_fence_obj **out_fence)
++void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx,
++				    struct vmw_fence_obj **out_fence)
+ {
+-	if (res->backup || out_fence)
+-		vmw_kms_helper_buffer_finish(res->dev_priv, NULL, res->backup,
++	struct vmw_resource *res = ctx->res;
++
++	if (ctx->buf || out_fence)
++		vmw_kms_helper_buffer_finish(res->dev_priv, NULL, ctx->buf,
+ 					     out_fence, NULL);
+ 
+ 	vmw_resource_unreserve(res, false, NULL, 0);
+@@ -2865,3 +2875,14 @@ int vmw_kms_set_config(struct drm_mode_set *set,
+ 
+ 	return drm_atomic_helper_set_config(set, ctx);
+ }
++
++
++/**
++ * vmw_kms_lost_device - Notify kms that modesetting capabilities will be lost
++ *
++ * @dev: Pointer to the drm device
++ */
++void vmw_kms_lost_device(struct drm_device *dev)
++{
++	drm_atomic_helper_shutdown(dev);
++}
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+index cd9da2dd79af..3d2ca280eaa7 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+@@ -240,6 +240,11 @@ struct vmw_display_unit {
+ 	int set_gui_y;
+ };
+ 
++struct vmw_validation_ctx {
++	struct vmw_resource *res;
++	struct vmw_dma_buffer *buf;
++};
++
+ #define vmw_crtc_to_du(x) \
+ 	container_of(x, struct vmw_display_unit, crtc)
+ #define vmw_connector_to_du(x) \
+@@ -296,9 +301,10 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv,
+ 				  struct drm_vmw_fence_rep __user *
+ 				  user_fence_rep);
+ int vmw_kms_helper_resource_prepare(struct vmw_resource *res,
+-				    bool interruptible);
+-void vmw_kms_helper_resource_revert(struct vmw_resource *res);
+-void vmw_kms_helper_resource_finish(struct vmw_resource *res,
++				    bool interruptible,
++				    struct vmw_validation_ctx *ctx);
++void vmw_kms_helper_resource_revert(struct vmw_validation_ctx *ctx);
++void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx,
+ 				    struct vmw_fence_obj **out_fence);
+ int vmw_kms_readback(struct vmw_private *dev_priv,
+ 		     struct drm_file *file_priv,
+@@ -439,5 +445,4 @@ int vmw_kms_stdu_dma(struct vmw_private *dev_priv,
+ 
+ int vmw_kms_set_config(struct drm_mode_set *set,
+ 		       struct drm_modeset_acquire_ctx *ctx);
+-
+ #endif
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+index 63a4cd794b73..3ec9eae831b8 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+@@ -909,12 +909,13 @@ int vmw_kms_sou_do_surface_dirty(struct vmw_private *dev_priv,
+ 	struct vmw_framebuffer_surface *vfbs =
+ 		container_of(framebuffer, typeof(*vfbs), base);
+ 	struct vmw_kms_sou_surface_dirty sdirty;
++	struct vmw_validation_ctx ctx;
+ 	int ret;
+ 
+ 	if (!srf)
+ 		srf = &vfbs->surface->res;
+ 
+-	ret = vmw_kms_helper_resource_prepare(srf, true);
++	ret = vmw_kms_helper_resource_prepare(srf, true, &ctx);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -933,7 +934,7 @@ int vmw_kms_sou_do_surface_dirty(struct vmw_private *dev_priv,
+ 	ret = vmw_kms_helper_dirty(dev_priv, framebuffer, clips, vclips,
+ 				   dest_x, dest_y, num_clips, inc,
+ 				   &sdirty.base);
+-	vmw_kms_helper_resource_finish(srf, out_fence);
++	vmw_kms_helper_resource_finish(&ctx, out_fence);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+index b68d74888ab1..6b969e5dea2a 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+@@ -980,12 +980,13 @@ int vmw_kms_stdu_surface_dirty(struct vmw_private *dev_priv,
+ 	struct vmw_framebuffer_surface *vfbs =
+ 		container_of(framebuffer, typeof(*vfbs), base);
+ 	struct vmw_stdu_dirty sdirty;
++	struct vmw_validation_ctx ctx;
+ 	int ret;
+ 
+ 	if (!srf)
+ 		srf = &vfbs->surface->res;
+ 
+-	ret = vmw_kms_helper_resource_prepare(srf, true);
++	ret = vmw_kms_helper_resource_prepare(srf, true, &ctx);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1008,7 +1009,7 @@ int vmw_kms_stdu_surface_dirty(struct vmw_private *dev_priv,
+ 				   dest_x, dest_y, num_clips, inc,
+ 				   &sdirty.base);
+ out_finish:
+-	vmw_kms_helper_resource_finish(srf, out_fence);
++	vmw_kms_helper_resource_finish(&ctx, out_fence);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
+index 12eb8caa4263..3f8dde8d59ba 100644
+--- a/drivers/hv/ring_buffer.c
++++ b/drivers/hv/ring_buffer.c
+@@ -394,13 +394,24 @@ __hv_pkt_iter_next(struct vmbus_channel *channel,
+ }
+ EXPORT_SYMBOL_GPL(__hv_pkt_iter_next);
+ 
++/* How many bytes were read in this iterator cycle */
++static u32 hv_pkt_iter_bytes_read(const struct hv_ring_buffer_info *rbi,
++					u32 start_read_index)
++{
++	if (rbi->priv_read_index >= start_read_index)
++		return rbi->priv_read_index - start_read_index;
++	else
++		return rbi->ring_datasize - start_read_index +
++			rbi->priv_read_index;
++}
++
+ /*
+  * Update host ring buffer after iterating over packets.
+  */
+ void hv_pkt_iter_close(struct vmbus_channel *channel)
+ {
+ 	struct hv_ring_buffer_info *rbi = &channel->inbound;
+-	u32 orig_write_sz = hv_get_bytes_to_write(rbi);
++	u32 curr_write_sz, pending_sz, bytes_read, start_read_index;
+ 
+ 	/*
+ 	 * Make sure all reads are done before we update the read index since
+@@ -408,8 +419,12 @@ void hv_pkt_iter_close(struct vmbus_channel *channel)
+ 	 * is updated.
+ 	 */
+ 	virt_rmb();
++	start_read_index = rbi->ring_buffer->read_index;
+ 	rbi->ring_buffer->read_index = rbi->priv_read_index;
+ 
++	if (!rbi->ring_buffer->feature_bits.feat_pending_send_sz)
++		return;
++
+ 	/*
+ 	 * Issue a full memory barrier before making the signaling decision.
+ 	 * Here is the reason for having this barrier:
+@@ -423,26 +438,29 @@ void hv_pkt_iter_close(struct vmbus_channel *channel)
+ 	 */
+ 	virt_mb();
+ 
+-	/* If host has disabled notifications then skip */
+-	if (rbi->ring_buffer->interrupt_mask)
++	pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);
++	if (!pending_sz)
+ 		return;
+ 
+-	if (rbi->ring_buffer->feature_bits.feat_pending_send_sz) {
+-		u32 pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);
++	/*
++	 * Ensure the read of write_index in hv_get_bytes_to_write()
++	 * happens after the read of pending_send_sz.
++	 */
++	virt_rmb();
++	curr_write_sz = hv_get_bytes_to_write(rbi);
++	bytes_read = hv_pkt_iter_bytes_read(rbi, start_read_index);
+ 
+-		/*
+-		 * If there was space before we began iteration,
+-		 * then host was not blocked. Also handles case where
+-		 * pending_sz is zero then host has nothing pending
+-		 * and does not need to be signaled.
+-		 */
+-		if (orig_write_sz > pending_sz)
+-			return;
++	/*
++	 * If there was space before we began iteration,
++	 * then host was not blocked.
++	 */
+ 
+-		/* If pending write will not fit, don't give false hope. */
+-		if (hv_get_bytes_to_write(rbi) < pending_sz)
+-			return;
+-	}
++	if (curr_write_sz - bytes_read > pending_sz)
++		return;
++
++	/* If pending write will not fit, don't give false hope. */
++	if (curr_write_sz <= pending_sz)
++		return;
+ 
+ 	vmbus_setevent(channel);
+ }
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index b960015cb073..051a72eecb24 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -86,6 +86,7 @@ static const struct tctl_offset tctl_offset_table[] = {
+ 	{ 0x17, "AMD Ryzen 7 1800X", 20000 },
+ 	{ 0x17, "AMD Ryzen Threadripper 1950X", 27000 },
+ 	{ 0x17, "AMD Ryzen Threadripper 1920X", 27000 },
++	{ 0x17, "AMD Ryzen Threadripper 1900X", 27000 },
+ 	{ 0x17, "AMD Ryzen Threadripper 1950", 10000 },
+ 	{ 0x17, "AMD Ryzen Threadripper 1920", 10000 },
+ 	{ 0x17, "AMD Ryzen Threadripper 1910", 10000 },
+@@ -128,7 +129,10 @@ static ssize_t temp1_input_show(struct device *dev,
+ 
+ 	data->read_tempreg(data->pdev, &regval);
+ 	temp = (regval >> 21) * 125;
+-	temp -= data->temp_offset;
++	if (temp > data->temp_offset)
++		temp -= data->temp_offset;
++	else
++		temp = 0;
+ 
+ 	return sprintf(buf, "%u\n", temp);
+ }
+diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
+index 460aa58e0159..3e6fd5a8ac5b 100644
+--- a/drivers/iio/accel/st_accel_core.c
++++ b/drivers/iio/accel/st_accel_core.c
+@@ -951,7 +951,7 @@ int st_accel_common_probe(struct iio_dev *indio_dev)
+ 	if (!pdata)
+ 		pdata = (struct st_sensors_platform_data *)&default_accel_pdata;
+ 
+-	err = st_sensors_init_sensor(indio_dev, adata->dev->platform_data);
++	err = st_sensors_init_sensor(indio_dev, pdata);
+ 	if (err < 0)
+ 		goto st_accel_power_off;
+ 
+diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
+index 36047147ce7c..0d237fd69769 100644
+--- a/drivers/iio/adc/meson_saradc.c
++++ b/drivers/iio/adc/meson_saradc.c
+@@ -462,8 +462,10 @@ static int meson_sar_adc_lock(struct iio_dev *indio_dev)
+ 			regmap_read(priv->regmap, MESON_SAR_ADC_DELAY, &val);
+ 		} while (val & MESON_SAR_ADC_DELAY_BL30_BUSY && timeout--);
+ 
+-		if (timeout < 0)
++		if (timeout < 0) {
++			mutex_unlock(&indio_dev->mlock);
+ 			return -ETIMEDOUT;
++		}
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/iio/chemical/ccs811.c b/drivers/iio/chemical/ccs811.c
+index fbe2431f5b81..1ea9f5513b02 100644
+--- a/drivers/iio/chemical/ccs811.c
++++ b/drivers/iio/chemical/ccs811.c
+@@ -133,6 +133,9 @@ static int ccs811_start_sensor_application(struct i2c_client *client)
+ 	if (ret < 0)
+ 		return ret;
+ 
++	if ((ret & CCS811_STATUS_FW_MODE_APPLICATION))
++		return 0;
++
+ 	if ((ret & CCS811_STATUS_APP_VALID_MASK) !=
+ 	    CCS811_STATUS_APP_VALID_LOADED)
+ 		return -EIO;
+diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
+index 4fdb7fcc3ea8..cebc6bd31b79 100644
+--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
+@@ -130,6 +130,7 @@ struct st_lsm6dsx_sensor {
+  * @irq: Device interrupt line (I2C or SPI).
+  * @lock: Mutex to protect read and write operations.
+  * @fifo_lock: Mutex to prevent concurrent access to the hw FIFO.
++ * @conf_lock: Mutex to prevent concurrent FIFO configuration update.
+  * @fifo_mode: FIFO operating mode supported by the device.
+  * @enable_mask: Enabled sensor bitmask.
+  * @sip: Total number of samples (acc/gyro) in a given pattern.
+@@ -144,6 +145,7 @@ struct st_lsm6dsx_hw {
+ 
+ 	struct mutex lock;
+ 	struct mutex fifo_lock;
++	struct mutex conf_lock;
+ 
+ 	enum st_lsm6dsx_fifo_mode fifo_mode;
+ 	u8 enable_mask;
+diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
+index 755c472e8a05..c899d658f6be 100644
+--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
+@@ -325,38 +325,40 @@ static int st_lsm6dsx_update_fifo(struct iio_dev *iio_dev, bool enable)
+ 	struct st_lsm6dsx_hw *hw = sensor->hw;
+ 	int err;
+ 
++	mutex_lock(&hw->conf_lock);
++
+ 	if (hw->fifo_mode != ST_LSM6DSX_FIFO_BYPASS) {
+ 		err = st_lsm6dsx_flush_fifo(hw);
+ 		if (err < 0)
+-			return err;
++			goto out;
+ 	}
+ 
+ 	if (enable) {
+ 		err = st_lsm6dsx_sensor_enable(sensor);
+ 		if (err < 0)
+-			return err;
++			goto out;
+ 	} else {
+ 		err = st_lsm6dsx_sensor_disable(sensor);
+ 		if (err < 0)
+-			return err;
++			goto out;
+ 	}
+ 
+ 	err = st_lsm6dsx_set_fifo_odr(sensor, enable);
+ 	if (err < 0)
+-		return err;
++		goto out;
+ 
+ 	err = st_lsm6dsx_update_decimators(hw);
+ 	if (err < 0)
+-		return err;
++		goto out;
+ 
+ 	err = st_lsm6dsx_update_watermark(sensor, sensor->watermark);
+ 	if (err < 0)
+-		return err;
++		goto out;
+ 
+ 	if (hw->enable_mask) {
+ 		err = st_lsm6dsx_set_fifo_mode(hw, ST_LSM6DSX_FIFO_CONT);
+ 		if (err < 0)
+-			return err;
++			goto out;
+ 
+ 		/*
+ 		 * store enable buffer timestamp as reference to compute
+@@ -365,7 +367,10 @@ static int st_lsm6dsx_update_fifo(struct iio_dev *iio_dev, bool enable)
+ 		sensor->ts = iio_get_time_ns(iio_dev);
+ 	}
+ 
+-	return 0;
++out:
++	mutex_unlock(&hw->conf_lock);
++
++	return err;
+ }
+ 
+ static irqreturn_t st_lsm6dsx_handler_irq(int irq, void *private)
+diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
+index 239c735242be..4d43c956d676 100644
+--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
+@@ -448,7 +448,7 @@ static int st_lsm6dsx_read_oneshot(struct st_lsm6dsx_sensor *sensor,
+ 
+ 	st_lsm6dsx_sensor_disable(sensor);
+ 
+-	*val = (s16)data;
++	*val = (s16)le16_to_cpu(data);
+ 
+ 	return IIO_VAL_INT;
+ }
+@@ -528,7 +528,12 @@ static int st_lsm6dsx_set_watermark(struct iio_dev *iio_dev, unsigned int val)
+ 	if (val < 1 || val > hw->settings->max_fifo_size)
+ 		return -EINVAL;
+ 
++	mutex_lock(&hw->conf_lock);
++
+ 	err = st_lsm6dsx_update_watermark(sensor, val);
++
++	mutex_unlock(&hw->conf_lock);
++
+ 	if (err < 0)
+ 		return err;
+ 
+@@ -739,6 +744,7 @@ int st_lsm6dsx_probe(struct device *dev, int irq, int hw_id, const char *name,
+ 
+ 	mutex_init(&hw->lock);
+ 	mutex_init(&hw->fifo_lock);
++	mutex_init(&hw->conf_lock);
+ 
+ 	hw->dev = dev;
+ 	hw->irq = irq;
+diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c
+index 349e5c713c03..4ddb6cf7d401 100644
+--- a/drivers/iio/pressure/st_pressure_core.c
++++ b/drivers/iio/pressure/st_pressure_core.c
+@@ -640,7 +640,7 @@ int st_press_common_probe(struct iio_dev *indio_dev)
+ 		       press_data->sensor_settings->drdy_irq.int2.addr))
+ 		pdata =	(struct st_sensors_platform_data *)&default_press_pdata;
+ 
+-	err = st_sensors_init_sensor(indio_dev, press_data->dev->platform_data);
++	err = st_sensors_init_sensor(indio_dev, pdata);
+ 	if (err < 0)
+ 		goto st_press_power_off;
+ 
+diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
+index 1961c6a45437..c51c602f06d6 100644
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -838,7 +838,8 @@ static int mr_umem_get(struct ib_pd *pd, u64 start, u64 length,
+ 	*umem = ib_umem_get(pd->uobject->context, start, length,
+ 			    access_flags, 0);
+ 	err = PTR_ERR_OR_ZERO(*umem);
+-	if (err < 0) {
++	if (err) {
++		*umem = NULL;
+ 		mlx5_ib_err(dev, "umem get failed (%d)\n", err);
+ 		return err;
+ 	}
+@@ -1415,6 +1416,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
+ 		if (err) {
+ 			mlx5_ib_warn(dev, "Failed to rereg UMR\n");
+ 			ib_umem_release(mr->umem);
++			mr->umem = NULL;
+ 			clean_mr(dev, mr);
+ 			return err;
+ 		}
+@@ -1498,14 +1500,11 @@ static int clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
+ 		u32 key = mr->mmkey.key;
+ 
+ 		err = destroy_mkey(dev, mr);
+-		kfree(mr);
+ 		if (err) {
+ 			mlx5_ib_warn(dev, "failed to destroy mkey 0x%x (%d)\n",
+ 				     key, err);
+ 			return err;
+ 		}
+-	} else {
+-		mlx5_mr_cache_free(dev, mr);
+ 	}
+ 
+ 	return 0;
+@@ -1548,6 +1547,11 @@ static int dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
+ 		atomic_sub(npages, &dev->mdev->priv.reg_pages);
+ 	}
+ 
++	if (!mr->allocated_from_cache)
++		kfree(mr);
++	else
++		mlx5_mr_cache_free(dev, mr);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/media/platform/tegra-cec/tegra_cec.c b/drivers/media/platform/tegra-cec/tegra_cec.c
+index 92f93a880015..aba488cd0e64 100644
+--- a/drivers/media/platform/tegra-cec/tegra_cec.c
++++ b/drivers/media/platform/tegra-cec/tegra_cec.c
+@@ -172,16 +172,13 @@ static irqreturn_t tegra_cec_irq_handler(int irq, void *data)
+ 		}
+ 	}
+ 
+-	if (status & (TEGRA_CEC_INT_STAT_RX_REGISTER_OVERRUN |
+-		      TEGRA_CEC_INT_STAT_RX_BUS_ANOMALY_DETECTED |
+-		      TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED |
+-		      TEGRA_CEC_INT_STAT_RX_BUS_ERROR_DETECTED)) {
++	if (status & TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED) {
+ 		cec_write(cec, TEGRA_CEC_INT_STAT,
+-			  (TEGRA_CEC_INT_STAT_RX_REGISTER_OVERRUN |
+-			   TEGRA_CEC_INT_STAT_RX_BUS_ANOMALY_DETECTED |
+-			   TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED |
+-			   TEGRA_CEC_INT_STAT_RX_BUS_ERROR_DETECTED));
+-	} else if (status & TEGRA_CEC_INT_STAT_RX_REGISTER_FULL) {
++			  TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED);
++		cec->rx_done = false;
++		cec->rx_buf_cnt = 0;
++	}
++	if (status & TEGRA_CEC_INT_STAT_RX_REGISTER_FULL) {
+ 		u32 v;
+ 
+ 		cec_write(cec, TEGRA_CEC_INT_STAT,
+@@ -255,7 +252,7 @@ static int tegra_cec_adap_enable(struct cec_adapter *adap, bool enable)
+ 		  TEGRA_CEC_INT_MASK_TX_BUS_ANOMALY_DETECTED |
+ 		  TEGRA_CEC_INT_MASK_TX_FRAME_TRANSMITTED |
+ 		  TEGRA_CEC_INT_MASK_RX_REGISTER_FULL |
+-		  TEGRA_CEC_INT_MASK_RX_REGISTER_OVERRUN);
++		  TEGRA_CEC_INT_MASK_RX_START_BIT_DETECTED);
+ 
+ 	cec_write(cec, TEGRA_CEC_HW_CONTROL, TEGRA_CEC_HWCTRL_TX_RX_MODE);
+ 	return 0;
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index b737a9540331..df5fe43072d6 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -66,6 +66,7 @@ MODULE_ALIAS("mmc:block");
+ #define MMC_BLK_TIMEOUT_MS  (10 * 60 * 1000)        /* 10 minute timeout */
+ #define MMC_SANITIZE_REQ_TIMEOUT 240000
+ #define MMC_EXTRACT_INDEX_FROM_ARG(x) ((x & 0x00FF0000) >> 16)
++#define MMC_EXTRACT_VALUE_FROM_ARG(x) ((x & 0x0000FF00) >> 8)
+ 
+ #define mmc_req_rel_wr(req)	((req->cmd_flags & REQ_FUA) && \
+ 				  (rq_data_dir(req) == WRITE))
+@@ -579,6 +580,24 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ 		return data.error;
+ 	}
+ 
++	/*
++	 * Make sure the cache of the PARTITION_CONFIG register and
++	 * PARTITION_ACCESS bits is updated in case the ioctl ext_csd write
++	 * changed it successfully.
++	 */
++	if ((MMC_EXTRACT_INDEX_FROM_ARG(cmd.arg) == EXT_CSD_PART_CONFIG) &&
++	    (cmd.opcode == MMC_SWITCH)) {
++		struct mmc_blk_data *main_md = dev_get_drvdata(&card->dev);
++		u8 value = MMC_EXTRACT_VALUE_FROM_ARG(cmd.arg);
++
++		/*
++		 * Update cache so the next mmc_blk_part_switch call operates
++		 * on up-to-date data.
++		 */
++		card->ext_csd.part_config = value;
++		main_md->part_curr = value & EXT_CSD_PART_CONFIG_ACC_MASK;
++	}
++
+ 	/*
+ 	 * According to the SD specs, some commands require a delay after
+ 	 * issuing the command.
+diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h
+index 79a5b985ccf5..9c821eedd156 100644
+--- a/drivers/mmc/core/card.h
++++ b/drivers/mmc/core/card.h
+@@ -82,6 +82,7 @@ struct mmc_fixup {
+ #define CID_MANFID_APACER       0x27
+ #define CID_MANFID_KINGSTON     0x70
+ #define CID_MANFID_HYNIX	0x90
++#define CID_MANFID_NUMONYX	0xFE
+ 
+ #define END_FIXUP { NULL }
+ 
+diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
+index 75d317623852..5153577754f0 100644
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -109,6 +109,12 @@ static const struct mmc_fixup mmc_ext_csd_fixups[] = {
+ 	 */
+ 	MMC_FIXUP_EXT_CSD_REV(CID_NAME_ANY, CID_MANFID_HYNIX,
+ 			      0x014a, add_quirk, MMC_QUIRK_BROKEN_HPI, 5),
++	/*
++	 * Certain Micron (Numonyx) eMMC 4.5 cards might get broken when HPI
++	 * feature is used so disable the HPI feature for such buggy cards.
++	 */
++	MMC_FIXUP_EXT_CSD_REV(CID_NAME_ANY, CID_MANFID_NUMONYX,
++			      0x014e, add_quirk, MMC_QUIRK_BROKEN_HPI, 6),
+ 
+ 	END_FIXUP
+ };
+diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c
+index fa41d9422d57..a84aa3f1ae85 100644
+--- a/drivers/mmc/host/dw_mmc-exynos.c
++++ b/drivers/mmc/host/dw_mmc-exynos.c
+@@ -165,9 +165,15 @@ static void dw_mci_exynos_set_clksel_timing(struct dw_mci *host, u32 timing)
+ static int dw_mci_exynos_runtime_resume(struct device *dev)
+ {
+ 	struct dw_mci *host = dev_get_drvdata(dev);
++	int ret;
++
++	ret = dw_mci_runtime_resume(dev);
++	if (ret)
++		return ret;
+ 
+ 	dw_mci_exynos_config_smu(host);
+-	return dw_mci_runtime_resume(dev);
++
++	return ret;
+ }
+ 
+ /**
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
+index d9b4acefed31..06d47414d0c1 100644
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -413,7 +413,9 @@ static inline void dw_mci_set_cto(struct dw_mci *host)
+ 	cto_div = (mci_readl(host, CLKDIV) & 0xff) * 2;
+ 	if (cto_div == 0)
+ 		cto_div = 1;
+-	cto_ms = DIV_ROUND_UP(MSEC_PER_SEC * cto_clks * cto_div, host->bus_hz);
++
++	cto_ms = DIV_ROUND_UP_ULL((u64)MSEC_PER_SEC * cto_clks * cto_div,
++				  host->bus_hz);
+ 
+ 	/* add a bit spare time */
+ 	cto_ms += 10;
+@@ -562,6 +564,7 @@ static int dw_mci_idmac_init(struct dw_mci *host)
+ 					(sizeof(struct idmac_desc_64addr) *
+ 							(i + 1))) >> 32;
+ 			/* Initialize reserved and buffer size fields to "0" */
++			p->des0 = 0;
+ 			p->des1 = 0;
+ 			p->des2 = 0;
+ 			p->des3 = 0;
+@@ -584,6 +587,7 @@ static int dw_mci_idmac_init(struct dw_mci *host)
+ 		     i++, p++) {
+ 			p->des3 = cpu_to_le32(host->sg_dma +
+ 					(sizeof(struct idmac_desc) * (i + 1)));
++			p->des0 = 0;
+ 			p->des1 = 0;
+ 		}
+ 
+@@ -1799,8 +1803,8 @@ static bool dw_mci_reset(struct dw_mci *host)
+ 	}
+ 
+ 	if (host->use_dma == TRANS_MODE_IDMAC)
+-		/* It is also recommended that we reset and reprogram idmac */
+-		dw_mci_idmac_reset(host);
++		/* It is also required that we reinit idmac */
++		dw_mci_idmac_init(host);
+ 
+ 	ret = true;
+ 
+@@ -1948,8 +1952,9 @@ static void dw_mci_set_drto(struct dw_mci *host)
+ 	drto_div = (mci_readl(host, CLKDIV) & 0xff) * 2;
+ 	if (drto_div == 0)
+ 		drto_div = 1;
+-	drto_ms = DIV_ROUND_UP(MSEC_PER_SEC * drto_clks * drto_div,
+-			       host->bus_hz);
++
++	drto_ms = DIV_ROUND_UP_ULL((u64)MSEC_PER_SEC * drto_clks * drto_div,
++				   host->bus_hz);
+ 
+ 	/* add a bit spare time */
+ 	drto_ms += 10;
+diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
+index de8c902059b8..7d80a8bb96fe 100644
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -479,7 +479,7 @@ static int shrink_ecclayout(struct mtd_info *mtd,
+ 	for (i = 0; i < MTD_MAX_ECCPOS_ENTRIES;) {
+ 		u32 eccpos;
+ 
+-		ret = mtd_ooblayout_ecc(mtd, section, &oobregion);
++		ret = mtd_ooblayout_ecc(mtd, section++, &oobregion);
+ 		if (ret < 0) {
+ 			if (ret != -ERANGE)
+ 				return ret;
+@@ -526,7 +526,7 @@ static int get_oobinfo(struct mtd_info *mtd, struct nand_oobinfo *to)
+ 	for (i = 0; i < ARRAY_SIZE(to->eccpos);) {
+ 		u32 eccpos;
+ 
+-		ret = mtd_ooblayout_ecc(mtd, section, &oobregion);
++		ret = mtd_ooblayout_ecc(mtd, section++, &oobregion);
+ 		if (ret < 0) {
+ 			if (ret != -ERANGE)
+ 				return ret;
+diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c
+index bbdd68a54d68..4005b427023c 100644
+--- a/drivers/mtd/nand/fsl_ifc_nand.c
++++ b/drivers/mtd/nand/fsl_ifc_nand.c
+@@ -173,14 +173,9 @@ static void set_addr(struct mtd_info *mtd, int column, int page_addr, int oob)
+ 
+ /* returns nonzero if entire page is blank */
+ static int check_read_ecc(struct mtd_info *mtd, struct fsl_ifc_ctrl *ctrl,
+-			  u32 *eccstat, unsigned int bufnum)
++			  u32 eccstat, unsigned int bufnum)
+ {
+-	u32 reg = eccstat[bufnum / 4];
+-	int errors;
+-
+-	errors = (reg >> ((3 - bufnum % 4) * 8)) & 15;
+-
+-	return errors;
++	return  (eccstat >> ((3 - bufnum % 4) * 8)) & 15;
+ }
+ 
+ /*
+@@ -193,7 +188,7 @@ static void fsl_ifc_run_command(struct mtd_info *mtd)
+ 	struct fsl_ifc_ctrl *ctrl = priv->ctrl;
+ 	struct fsl_ifc_nand_ctrl *nctrl = ifc_nand_ctrl;
+ 	struct fsl_ifc_runtime __iomem *ifc = ctrl->rregs;
+-	u32 eccstat[4];
++	u32 eccstat;
+ 	int i;
+ 
+ 	/* set the chip select for NAND Transaction */
+@@ -228,19 +223,17 @@ static void fsl_ifc_run_command(struct mtd_info *mtd)
+ 	if (nctrl->eccread) {
+ 		int errors;
+ 		int bufnum = nctrl->page & priv->bufnum_mask;
+-		int sector = bufnum * chip->ecc.steps;
+-		int sector_end = sector + chip->ecc.steps - 1;
++		int sector_start = bufnum * chip->ecc.steps;
++		int sector_end = sector_start + chip->ecc.steps - 1;
+ 		__be32 *eccstat_regs;
+ 
+-		if (ctrl->version >= FSL_IFC_VERSION_2_0_0)
+-			eccstat_regs = ifc->ifc_nand.v2_nand_eccstat;
+-		else
+-			eccstat_regs = ifc->ifc_nand.v1_nand_eccstat;
++		eccstat_regs = ifc->ifc_nand.nand_eccstat;
++		eccstat = ifc_in32(&eccstat_regs[sector_start / 4]);
+ 
+-		for (i = sector / 4; i <= sector_end / 4; i++)
+-			eccstat[i] = ifc_in32(&eccstat_regs[i]);
++		for (i = sector_start; i <= sector_end; i++) {
++			if (i != sector_start && !(i % 4))
++				eccstat = ifc_in32(&eccstat_regs[i / 4]);
+ 
+-		for (i = sector; i <= sector_end; i++) {
+ 			errors = check_read_ecc(mtd, ctrl, eccstat, i);
+ 
+ 			if (errors == 15) {
+@@ -626,6 +619,7 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip)
+ 	struct fsl_ifc_ctrl *ctrl = priv->ctrl;
+ 	struct fsl_ifc_runtime __iomem *ifc = ctrl->rregs;
+ 	u32 nand_fsr;
++	int status;
+ 
+ 	/* Use READ_STATUS command, but wait for the device to be ready */
+ 	ifc_out32((IFC_FIR_OP_CW0 << IFC_NAND_FIR0_OP0_SHIFT) |
+@@ -640,12 +634,12 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip)
+ 	fsl_ifc_run_command(mtd);
+ 
+ 	nand_fsr = ifc_in32(&ifc->ifc_nand.nand_fsr);
+-
++	status = nand_fsr >> 24;
+ 	/*
+ 	 * The chip always seems to report that it is
+ 	 * write-protected, even when it is not.
+ 	 */
+-	return nand_fsr | NAND_STATUS_WP;
++	return status | NAND_STATUS_WP;
+ }
+ 
+ /*
+diff --git a/drivers/net/can/cc770/cc770.c b/drivers/net/can/cc770/cc770.c
+index 1e37313054f3..6da69af103e6 100644
+--- a/drivers/net/can/cc770/cc770.c
++++ b/drivers/net/can/cc770/cc770.c
+@@ -390,37 +390,23 @@ static int cc770_get_berr_counter(const struct net_device *dev,
+ 	return 0;
+ }
+ 
+-static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static void cc770_tx(struct net_device *dev, int mo)
+ {
+ 	struct cc770_priv *priv = netdev_priv(dev);
+-	struct net_device_stats *stats = &dev->stats;
+-	struct can_frame *cf = (struct can_frame *)skb->data;
+-	unsigned int mo = obj2msgobj(CC770_OBJ_TX);
++	struct can_frame *cf = (struct can_frame *)priv->tx_skb->data;
+ 	u8 dlc, rtr;
+ 	u32 id;
+ 	int i;
+ 
+-	if (can_dropped_invalid_skb(dev, skb))
+-		return NETDEV_TX_OK;
+-
+-	if ((cc770_read_reg(priv,
+-			    msgobj[mo].ctrl1) & TXRQST_UNC) == TXRQST_SET) {
+-		netdev_err(dev, "TX register is still occupied!\n");
+-		return NETDEV_TX_BUSY;
+-	}
+-
+-	netif_stop_queue(dev);
+-
+ 	dlc = cf->can_dlc;
+ 	id = cf->can_id;
+-	if (cf->can_id & CAN_RTR_FLAG)
+-		rtr = 0;
+-	else
+-		rtr = MSGCFG_DIR;
++	rtr = cf->can_id & CAN_RTR_FLAG ? 0 : MSGCFG_DIR;
++
++	cc770_write_reg(priv, msgobj[mo].ctrl0,
++			MSGVAL_RES | TXIE_RES | RXIE_RES | INTPND_RES);
+ 	cc770_write_reg(priv, msgobj[mo].ctrl1,
+ 			RMTPND_RES | TXRQST_RES | CPUUPD_SET | NEWDAT_RES);
+-	cc770_write_reg(priv, msgobj[mo].ctrl0,
+-			MSGVAL_SET | TXIE_SET | RXIE_RES | INTPND_RES);
++
+ 	if (id & CAN_EFF_FLAG) {
+ 		id &= CAN_EFF_MASK;
+ 		cc770_write_reg(priv, msgobj[mo].config,
+@@ -439,22 +425,30 @@ static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	for (i = 0; i < dlc; i++)
+ 		cc770_write_reg(priv, msgobj[mo].data[i], cf->data[i]);
+ 
+-	/* Store echo skb before starting the transfer */
+-	can_put_echo_skb(skb, dev, 0);
+-
+ 	cc770_write_reg(priv, msgobj[mo].ctrl1,
+-			RMTPND_RES | TXRQST_SET | CPUUPD_RES | NEWDAT_UNC);
++			RMTPND_UNC | TXRQST_SET | CPUUPD_RES | NEWDAT_UNC);
++	cc770_write_reg(priv, msgobj[mo].ctrl0,
++			MSGVAL_SET | TXIE_SET | RXIE_SET | INTPND_UNC);
++}
+ 
+-	stats->tx_bytes += dlc;
++static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev)
++{
++	struct cc770_priv *priv = netdev_priv(dev);
++	unsigned int mo = obj2msgobj(CC770_OBJ_TX);
+ 
++	if (can_dropped_invalid_skb(dev, skb))
++		return NETDEV_TX_OK;
+ 
+-	/*
+-	 * HM: We had some cases of repeated IRQs so make sure the
+-	 * INT is acknowledged I know it's already further up, but
+-	 * doing again fixed the issue
+-	 */
+-	cc770_write_reg(priv, msgobj[mo].ctrl0,
+-			MSGVAL_UNC | TXIE_UNC | RXIE_UNC | INTPND_RES);
++	netif_stop_queue(dev);
++
++	if ((cc770_read_reg(priv,
++			    msgobj[mo].ctrl1) & TXRQST_UNC) == TXRQST_SET) {
++		netdev_err(dev, "TX register is still occupied!\n");
++		return NETDEV_TX_BUSY;
++	}
++
++	priv->tx_skb = skb;
++	cc770_tx(dev, mo);
+ 
+ 	return NETDEV_TX_OK;
+ }
+@@ -680,19 +674,46 @@ static void cc770_tx_interrupt(struct net_device *dev, unsigned int o)
+ 	struct cc770_priv *priv = netdev_priv(dev);
+ 	struct net_device_stats *stats = &dev->stats;
+ 	unsigned int mo = obj2msgobj(o);
++	struct can_frame *cf;
++	u8 ctrl1;
++
++	ctrl1 = cc770_read_reg(priv, msgobj[mo].ctrl1);
+ 
+-	/* Nothing more to send, switch off interrupts */
+ 	cc770_write_reg(priv, msgobj[mo].ctrl0,
+ 			MSGVAL_RES | TXIE_RES | RXIE_RES | INTPND_RES);
+-	/*
+-	 * We had some cases of repeated IRQ so make sure the
+-	 * INT is acknowledged
++	cc770_write_reg(priv, msgobj[mo].ctrl1,
++			RMTPND_RES | TXRQST_RES | MSGLST_RES | NEWDAT_RES);
++
++	if (unlikely(!priv->tx_skb)) {
++		netdev_err(dev, "missing tx skb in tx interrupt\n");
++		return;
++	}
++
++	if (unlikely(ctrl1 & MSGLST_SET)) {
++		stats->rx_over_errors++;
++		stats->rx_errors++;
++	}
++
++	/* When the CC770 is sending an RTR message and it receives a regular
++	 * message that matches the id of the RTR message, it will overwrite the
++	 * outgoing message in the TX register. When this happens we must
++	 * process the received message and try to transmit the outgoing skb
++	 * again.
+ 	 */
+-	cc770_write_reg(priv, msgobj[mo].ctrl0,
+-			MSGVAL_UNC | TXIE_UNC | RXIE_UNC | INTPND_RES);
++	if (unlikely(ctrl1 & NEWDAT_SET)) {
++		cc770_rx(dev, mo, ctrl1);
++		cc770_tx(dev, mo);
++		return;
++	}
+ 
++	cf = (struct can_frame *)priv->tx_skb->data;
++	stats->tx_bytes += cf->can_dlc;
+ 	stats->tx_packets++;
++
++	can_put_echo_skb(priv->tx_skb, dev, 0);
+ 	can_get_echo_skb(dev, 0);
++	priv->tx_skb = NULL;
++
+ 	netif_wake_queue(dev);
+ }
+ 
+@@ -804,6 +825,7 @@ struct net_device *alloc_cc770dev(int sizeof_priv)
+ 	priv->can.do_set_bittiming = cc770_set_bittiming;
+ 	priv->can.do_set_mode = cc770_set_mode;
+ 	priv->can.ctrlmode_supported = CAN_CTRLMODE_3_SAMPLES;
++	priv->tx_skb = NULL;
+ 
+ 	memcpy(priv->obj_flags, cc770_obj_flags, sizeof(cc770_obj_flags));
+ 
+diff --git a/drivers/net/can/cc770/cc770.h b/drivers/net/can/cc770/cc770.h
+index a1739db98d91..95752e1d1283 100644
+--- a/drivers/net/can/cc770/cc770.h
++++ b/drivers/net/can/cc770/cc770.h
+@@ -193,6 +193,8 @@ struct cc770_priv {
+ 	u8 cpu_interface;	/* CPU interface register */
+ 	u8 clkout;		/* Clock out register */
+ 	u8 bus_config;		/* Bus conffiguration register */
++
++	struct sk_buff *tx_skb;
+ };
+ 
+ struct net_device *alloc_cc770dev(int sizeof_priv);
+diff --git a/drivers/net/can/ifi_canfd/ifi_canfd.c b/drivers/net/can/ifi_canfd/ifi_canfd.c
+index 2772d05ff11c..fedd927ba6ed 100644
+--- a/drivers/net/can/ifi_canfd/ifi_canfd.c
++++ b/drivers/net/can/ifi_canfd/ifi_canfd.c
+@@ -30,6 +30,7 @@
+ #define IFI_CANFD_STCMD_ERROR_ACTIVE		BIT(2)
+ #define IFI_CANFD_STCMD_ERROR_PASSIVE		BIT(3)
+ #define IFI_CANFD_STCMD_BUSOFF			BIT(4)
++#define IFI_CANFD_STCMD_ERROR_WARNING		BIT(5)
+ #define IFI_CANFD_STCMD_BUSMONITOR		BIT(16)
+ #define IFI_CANFD_STCMD_LOOPBACK		BIT(18)
+ #define IFI_CANFD_STCMD_DISABLE_CANFD		BIT(24)
+@@ -52,7 +53,10 @@
+ #define IFI_CANFD_TXSTCMD_OVERFLOW		BIT(13)
+ 
+ #define IFI_CANFD_INTERRUPT			0xc
++#define IFI_CANFD_INTERRUPT_ERROR_BUSOFF	BIT(0)
+ #define IFI_CANFD_INTERRUPT_ERROR_WARNING	BIT(1)
++#define IFI_CANFD_INTERRUPT_ERROR_STATE_CHG	BIT(2)
++#define IFI_CANFD_INTERRUPT_ERROR_REC_TEC_INC	BIT(3)
+ #define IFI_CANFD_INTERRUPT_ERROR_COUNTER	BIT(10)
+ #define IFI_CANFD_INTERRUPT_TXFIFO_EMPTY	BIT(16)
+ #define IFI_CANFD_INTERRUPT_TXFIFO_REMOVE	BIT(22)
+@@ -61,6 +65,10 @@
+ #define IFI_CANFD_INTERRUPT_SET_IRQ		((u32)BIT(31))
+ 
+ #define IFI_CANFD_IRQMASK			0x10
++#define IFI_CANFD_IRQMASK_ERROR_BUSOFF		BIT(0)
++#define IFI_CANFD_IRQMASK_ERROR_WARNING		BIT(1)
++#define IFI_CANFD_IRQMASK_ERROR_STATE_CHG	BIT(2)
++#define IFI_CANFD_IRQMASK_ERROR_REC_TEC_INC	BIT(3)
+ #define IFI_CANFD_IRQMASK_SET_ERR		BIT(7)
+ #define IFI_CANFD_IRQMASK_SET_TS		BIT(15)
+ #define IFI_CANFD_IRQMASK_TXFIFO_EMPTY		BIT(16)
+@@ -136,6 +144,8 @@
+ #define IFI_CANFD_SYSCLOCK			0x50
+ 
+ #define IFI_CANFD_VER				0x54
++#define IFI_CANFD_VER_REV_MASK			0xff
++#define IFI_CANFD_VER_REV_MIN_SUPPORTED		0x15
+ 
+ #define IFI_CANFD_IP_ID				0x58
+ #define IFI_CANFD_IP_ID_VALUE			0xD073CAFD
+@@ -220,7 +230,10 @@ static void ifi_canfd_irq_enable(struct net_device *ndev, bool enable)
+ 
+ 	if (enable) {
+ 		enirq = IFI_CANFD_IRQMASK_TXFIFO_EMPTY |
+-			IFI_CANFD_IRQMASK_RXFIFO_NEMPTY;
++			IFI_CANFD_IRQMASK_RXFIFO_NEMPTY |
++			IFI_CANFD_IRQMASK_ERROR_STATE_CHG |
++			IFI_CANFD_IRQMASK_ERROR_WARNING |
++			IFI_CANFD_IRQMASK_ERROR_BUSOFF;
+ 		if (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING)
+ 			enirq |= IFI_CANFD_INTERRUPT_ERROR_COUNTER;
+ 	}
+@@ -361,12 +374,13 @@ static int ifi_canfd_handle_lost_msg(struct net_device *ndev)
+ 	return 1;
+ }
+ 
+-static int ifi_canfd_handle_lec_err(struct net_device *ndev, const u32 errctr)
++static int ifi_canfd_handle_lec_err(struct net_device *ndev)
+ {
+ 	struct ifi_canfd_priv *priv = netdev_priv(ndev);
+ 	struct net_device_stats *stats = &ndev->stats;
+ 	struct can_frame *cf;
+ 	struct sk_buff *skb;
++	u32 errctr = readl(priv->base + IFI_CANFD_ERROR_CTR);
+ 	const u32 errmask = IFI_CANFD_ERROR_CTR_OVERLOAD_FIRST |
+ 			    IFI_CANFD_ERROR_CTR_ACK_ERROR_FIRST |
+ 			    IFI_CANFD_ERROR_CTR_BIT0_ERROR_FIRST |
+@@ -449,6 +463,11 @@ static int ifi_canfd_handle_state_change(struct net_device *ndev,
+ 
+ 	switch (new_state) {
+ 	case CAN_STATE_ERROR_ACTIVE:
++		/* error active state */
++		priv->can.can_stats.error_warning++;
++		priv->can.state = CAN_STATE_ERROR_ACTIVE;
++		break;
++	case CAN_STATE_ERROR_WARNING:
+ 		/* error warning state */
+ 		priv->can.can_stats.error_warning++;
+ 		priv->can.state = CAN_STATE_ERROR_WARNING;
+@@ -477,7 +496,7 @@ static int ifi_canfd_handle_state_change(struct net_device *ndev,
+ 	ifi_canfd_get_berr_counter(ndev, &bec);
+ 
+ 	switch (new_state) {
+-	case CAN_STATE_ERROR_ACTIVE:
++	case CAN_STATE_ERROR_WARNING:
+ 		/* error warning state */
+ 		cf->can_id |= CAN_ERR_CRTL;
+ 		cf->data[1] = (bec.txerr > bec.rxerr) ?
+@@ -510,22 +529,21 @@ static int ifi_canfd_handle_state_change(struct net_device *ndev,
+ 	return 1;
+ }
+ 
+-static int ifi_canfd_handle_state_errors(struct net_device *ndev, u32 stcmd)
++static int ifi_canfd_handle_state_errors(struct net_device *ndev)
+ {
+ 	struct ifi_canfd_priv *priv = netdev_priv(ndev);
++	u32 stcmd = readl(priv->base + IFI_CANFD_STCMD);
+ 	int work_done = 0;
+-	u32 isr;
+ 
+-	/*
+-	 * The ErrWarn condition is a little special, since the bit is
+-	 * located in the INTERRUPT register instead of STCMD register.
+-	 */
+-	isr = readl(priv->base + IFI_CANFD_INTERRUPT);
+-	if ((isr & IFI_CANFD_INTERRUPT_ERROR_WARNING) &&
++	if ((stcmd & IFI_CANFD_STCMD_ERROR_ACTIVE) &&
++	    (priv->can.state != CAN_STATE_ERROR_ACTIVE)) {
++		netdev_dbg(ndev, "Error, entered active state\n");
++		work_done += ifi_canfd_handle_state_change(ndev,
++						CAN_STATE_ERROR_ACTIVE);
++	}
++
++	if ((stcmd & IFI_CANFD_STCMD_ERROR_WARNING) &&
+ 	    (priv->can.state != CAN_STATE_ERROR_WARNING)) {
+-		/* Clear the interrupt */
+-		writel(IFI_CANFD_INTERRUPT_ERROR_WARNING,
+-		       priv->base + IFI_CANFD_INTERRUPT);
+ 		netdev_dbg(ndev, "Error, entered warning state\n");
+ 		work_done += ifi_canfd_handle_state_change(ndev,
+ 						CAN_STATE_ERROR_WARNING);
+@@ -552,18 +570,11 @@ static int ifi_canfd_poll(struct napi_struct *napi, int quota)
+ {
+ 	struct net_device *ndev = napi->dev;
+ 	struct ifi_canfd_priv *priv = netdev_priv(ndev);
+-	const u32 stcmd_state_mask = IFI_CANFD_STCMD_ERROR_PASSIVE |
+-				     IFI_CANFD_STCMD_BUSOFF;
+-	int work_done = 0;
+-
+-	u32 stcmd = readl(priv->base + IFI_CANFD_STCMD);
+ 	u32 rxstcmd = readl(priv->base + IFI_CANFD_RXSTCMD);
+-	u32 errctr = readl(priv->base + IFI_CANFD_ERROR_CTR);
++	int work_done = 0;
+ 
+ 	/* Handle bus state changes */
+-	if ((stcmd & stcmd_state_mask) ||
+-	    ((stcmd & IFI_CANFD_STCMD_ERROR_ACTIVE) == 0))
+-		work_done += ifi_canfd_handle_state_errors(ndev, stcmd);
++	work_done += ifi_canfd_handle_state_errors(ndev);
+ 
+ 	/* Handle lost messages on RX */
+ 	if (rxstcmd & IFI_CANFD_RXSTCMD_OVERFLOW)
+@@ -571,7 +582,7 @@ static int ifi_canfd_poll(struct napi_struct *napi, int quota)
+ 
+ 	/* Handle lec errors on the bus */
+ 	if (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING)
+-		work_done += ifi_canfd_handle_lec_err(ndev, errctr);
++		work_done += ifi_canfd_handle_lec_err(ndev);
+ 
+ 	/* Handle normal messages on RX */
+ 	if (!(rxstcmd & IFI_CANFD_RXSTCMD_EMPTY))
+@@ -592,12 +603,13 @@ static irqreturn_t ifi_canfd_isr(int irq, void *dev_id)
+ 	struct net_device_stats *stats = &ndev->stats;
+ 	const u32 rx_irq_mask = IFI_CANFD_INTERRUPT_RXFIFO_NEMPTY |
+ 				IFI_CANFD_INTERRUPT_RXFIFO_NEMPTY_PER |
++				IFI_CANFD_INTERRUPT_ERROR_COUNTER |
++				IFI_CANFD_INTERRUPT_ERROR_STATE_CHG |
+ 				IFI_CANFD_INTERRUPT_ERROR_WARNING |
+-				IFI_CANFD_INTERRUPT_ERROR_COUNTER;
++				IFI_CANFD_INTERRUPT_ERROR_BUSOFF;
+ 	const u32 tx_irq_mask = IFI_CANFD_INTERRUPT_TXFIFO_EMPTY |
+ 				IFI_CANFD_INTERRUPT_TXFIFO_REMOVE;
+-	const u32 clr_irq_mask = ~((u32)(IFI_CANFD_INTERRUPT_SET_IRQ |
+-					 IFI_CANFD_INTERRUPT_ERROR_WARNING));
++	const u32 clr_irq_mask = ~((u32)IFI_CANFD_INTERRUPT_SET_IRQ);
+ 	u32 isr;
+ 
+ 	isr = readl(priv->base + IFI_CANFD_INTERRUPT);
+@@ -933,7 +945,7 @@ static int ifi_canfd_plat_probe(struct platform_device *pdev)
+ 	struct resource *res;
+ 	void __iomem *addr;
+ 	int irq, ret;
+-	u32 id;
++	u32 id, rev;
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	addr = devm_ioremap_resource(dev, res);
+@@ -947,6 +959,13 @@ static int ifi_canfd_plat_probe(struct platform_device *pdev)
+ 		return -EINVAL;
+ 	}
+ 
++	rev = readl(addr + IFI_CANFD_VER) & IFI_CANFD_VER_REV_MASK;
++	if (rev < IFI_CANFD_VER_REV_MIN_SUPPORTED) {
++		dev_err(dev, "This block is too old (rev %i), minimum supported is rev %i\n",
++			rev, IFI_CANFD_VER_REV_MIN_SUPPORTED);
++		return -EINVAL;
++	}
++
+ 	ndev = alloc_candev(sizeof(*priv), 1);
+ 	if (!ndev)
+ 		return -ENOMEM;
+diff --git a/drivers/net/can/peak_canfd/peak_canfd.c b/drivers/net/can/peak_canfd/peak_canfd.c
+index 55513411a82e..ed8561d4a90f 100644
+--- a/drivers/net/can/peak_canfd/peak_canfd.c
++++ b/drivers/net/can/peak_canfd/peak_canfd.c
+@@ -262,7 +262,6 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv,
+ 
+ 		spin_lock_irqsave(&priv->echo_lock, flags);
+ 		can_get_echo_skb(priv->ndev, msg->client);
+-		spin_unlock_irqrestore(&priv->echo_lock, flags);
+ 
+ 		/* count bytes of the echo instead of skb */
+ 		stats->tx_bytes += cf_len;
+@@ -271,6 +270,7 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv,
+ 		/* restart tx queue (a slot is free) */
+ 		netif_wake_queue(priv->ndev);
+ 
++		spin_unlock_irqrestore(&priv->echo_lock, flags);
+ 		return 0;
+ 	}
+ 
+@@ -333,7 +333,6 @@ static int pucan_handle_status(struct peak_canfd_priv *priv,
+ 
+ 	/* this STATUS is the CNF of the RX_BARRIER: Tx path can be setup */
+ 	if (pucan_status_is_rx_barrier(msg)) {
+-		unsigned long flags;
+ 
+ 		if (priv->enable_tx_path) {
+ 			int err = priv->enable_tx_path(priv);
+@@ -342,16 +341,8 @@ static int pucan_handle_status(struct peak_canfd_priv *priv,
+ 				return err;
+ 		}
+ 
+-		/* restart network queue only if echo skb array is free */
+-		spin_lock_irqsave(&priv->echo_lock, flags);
+-
+-		if (!priv->can.echo_skb[priv->echo_idx]) {
+-			spin_unlock_irqrestore(&priv->echo_lock, flags);
+-
+-			netif_wake_queue(ndev);
+-		} else {
+-			spin_unlock_irqrestore(&priv->echo_lock, flags);
+-		}
++		/* start network queue (echo_skb array is empty) */
++		netif_start_queue(ndev);
+ 
+ 		return 0;
+ 	}
+@@ -726,11 +717,6 @@ static netdev_tx_t peak_canfd_start_xmit(struct sk_buff *skb,
+ 	 */
+ 	should_stop_tx_queue = !!(priv->can.echo_skb[priv->echo_idx]);
+ 
+-	spin_unlock_irqrestore(&priv->echo_lock, flags);
+-
+-	/* write the skb on the interface */
+-	priv->write_tx_msg(priv, msg);
+-
+ 	/* stop network tx queue if not enough room to save one more msg too */
+ 	if (priv->can.ctrlmode & CAN_CTRLMODE_FD)
+ 		should_stop_tx_queue |= (room_left <
+@@ -742,6 +728,11 @@ static netdev_tx_t peak_canfd_start_xmit(struct sk_buff *skb,
+ 	if (should_stop_tx_queue)
+ 		netif_stop_queue(ndev);
+ 
++	spin_unlock_irqrestore(&priv->echo_lock, flags);
++
++	/* write the skb on the interface */
++	priv->write_tx_msg(priv, msg);
++
+ 	return NETDEV_TX_OK;
+ }
+ 
+diff --git a/drivers/net/can/peak_canfd/peak_pciefd_main.c b/drivers/net/can/peak_canfd/peak_pciefd_main.c
+index 788c3464a3b0..3c51a884db87 100644
+--- a/drivers/net/can/peak_canfd/peak_pciefd_main.c
++++ b/drivers/net/can/peak_canfd/peak_pciefd_main.c
+@@ -349,8 +349,12 @@ static irqreturn_t pciefd_irq_handler(int irq, void *arg)
+ 		priv->tx_pages_free++;
+ 		spin_unlock_irqrestore(&priv->tx_lock, flags);
+ 
+-		/* wake producer up */
+-		netif_wake_queue(priv->ucan.ndev);
++		/* wake producer up (only if enough room in echo_skb array) */
++		spin_lock_irqsave(&priv->ucan.echo_lock, flags);
++		if (!priv->ucan.can.echo_skb[priv->ucan.echo_idx])
++			netif_wake_queue(priv->ucan.ndev);
++
++		spin_unlock_irqrestore(&priv->ucan.echo_lock, flags);
+ 	}
+ 
+ 	/* re-enable Rx DMA transfer for this CAN */
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+index 2ee54133efa1..82064e909784 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -462,25 +462,23 @@ static int brcmf_p2p_set_firmware(struct brcmf_if *ifp, u8 *p2p_mac)
+  * @dev_addr: optional device address.
+  *
+  * P2P needs mac addresses for P2P device and interface. If no device
+- * address it specified, these are derived from the primary net device, ie.
+- * the permanent ethernet address of the device.
++ * address it specified, these are derived from a random ethernet
++ * address.
+  */
+ static void brcmf_p2p_generate_bss_mac(struct brcmf_p2p_info *p2p, u8 *dev_addr)
+ {
+-	struct brcmf_if *pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
+-	bool local_admin = false;
++	bool random_addr = false;
+ 
+-	if (!dev_addr || is_zero_ether_addr(dev_addr)) {
+-		dev_addr = pri_ifp->mac_addr;
+-		local_admin = true;
+-	}
++	if (!dev_addr || is_zero_ether_addr(dev_addr))
++		random_addr = true;
+ 
+-	/* Generate the P2P Device Address.  This consists of the device's
+-	 * primary MAC address with the locally administered bit set.
++	/* Generate the P2P Device Address obtaining a random ethernet
++	 * address with the locally administered bit set.
+ 	 */
+-	memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
+-	if (local_admin)
+-		p2p->dev_addr[0] |= 0x02;
++	if (random_addr)
++		eth_random_addr(p2p->dev_addr);
++	else
++		memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
+ 
+ 	/* Generate the P2P Interface Address.  If the discovery and connection
+ 	 * BSSCFGs need to simultaneously co-exist, then this address must be
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
+index 7cd1ffa7d4a7..7df0a02f9b34 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
+@@ -1124,7 +1124,8 @@ static void _rtl8723be_enable_aspm_back_door(struct ieee80211_hw *hw)
+ 
+ 	/* Configuration Space offset 0x70f BIT7 is used to control L0S */
+ 	tmp8 = _rtl8723be_dbi_read(rtlpriv, 0x70f);
+-	_rtl8723be_dbi_write(rtlpriv, 0x70f, tmp8 | BIT(7));
++	_rtl8723be_dbi_write(rtlpriv, 0x70f, tmp8 | BIT(7) |
++			     ASPM_L1_LATENCY << 3);
+ 
+ 	/* Configuration Space offset 0x719 Bit3 is for L1
+ 	 * BIT4 is for clock request
+diff --git a/drivers/nvdimm/blk.c b/drivers/nvdimm/blk.c
+index 345acca576b3..1bd7b3734751 100644
+--- a/drivers/nvdimm/blk.c
++++ b/drivers/nvdimm/blk.c
+@@ -278,8 +278,6 @@ static int nsblk_attach_disk(struct nd_namespace_blk *nsblk)
+ 	disk->queue		= q;
+ 	disk->flags		= GENHD_FL_EXT_DEVT;
+ 	nvdimm_namespace_disk_name(&nsblk->common, disk->disk_name);
+-	set_capacity(disk, 0);
+-	device_add_disk(dev, disk);
+ 
+ 	if (devm_add_action_or_reset(dev, nd_blk_release_disk, disk))
+ 		return -ENOMEM;
+@@ -292,6 +290,7 @@ static int nsblk_attach_disk(struct nd_namespace_blk *nsblk)
+ 	}
+ 
+ 	set_capacity(disk, available_disk_size >> SECTOR_SHIFT);
++	device_add_disk(dev, disk);
+ 	revalidate_disk(disk);
+ 	return 0;
+ }
+diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
+index c586bcdb5190..c625df951fa1 100644
+--- a/drivers/nvdimm/btt.c
++++ b/drivers/nvdimm/btt.c
+@@ -1545,8 +1545,6 @@ static int btt_blk_init(struct btt *btt)
+ 	queue_flag_set_unlocked(QUEUE_FLAG_NONROT, btt->btt_queue);
+ 	btt->btt_queue->queuedata = btt;
+ 
+-	set_capacity(btt->btt_disk, 0);
+-	device_add_disk(&btt->nd_btt->dev, btt->btt_disk);
+ 	if (btt_meta_size(btt)) {
+ 		int rc = nd_integrity_init(btt->btt_disk, btt_meta_size(btt));
+ 
+@@ -1558,6 +1556,7 @@ static int btt_blk_init(struct btt *btt)
+ 		}
+ 	}
+ 	set_capacity(btt->btt_disk, btt->nlba * btt->sector_size >> 9);
++	device_add_disk(&btt->nd_btt->dev, btt->btt_disk);
+ 	btt->nd_btt->size = btt->nlba * (u64)btt->sector_size;
+ 	revalidate_disk(btt->btt_disk);
+ 
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index d7135140bf40..a2f18c4a0346 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3906,6 +3906,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9230,
+ 			 quirk_dma_func1_alias);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0642,
+ 			 quirk_dma_func1_alias);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0645,
++			 quirk_dma_func1_alias);
+ /* https://bugs.gentoo.org/show_bug.cgi?id=497630 */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_JMICRON,
+ 			 PCI_DEVICE_ID_JMICRON_JMB388_ESD,
+diff --git a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
+index 071084d3ee9c..92aeea174a56 100644
+--- a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
++++ b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
+@@ -129,7 +129,7 @@ static const struct samsung_pin_bank_data s5pv210_pin_bank[] __initconst = {
+ 	EXYNOS_PIN_BANK_EINTW(8, 0xc60, "gph3", 0x0c),
+ };
+ 
+-const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = {
+ 	{
+ 		/* pin-controller instance 0 data */
+ 		.pin_banks	= s5pv210_pin_bank,
+@@ -142,6 +142,11 @@ const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = {
+ 	},
+ };
+ 
++const struct samsung_pinctrl_of_match_data s5pv210_of_data __initconst = {
++	.ctrl		= s5pv210_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(s5pv210_pin_ctrl),
++};
++
+ /* Pad retention control code for accessing PMU regmap */
+ static atomic_t exynos_shared_retention_refcnt;
+ 
+@@ -204,7 +209,7 @@ static const struct samsung_retention_data exynos3250_retention_data __initconst
+  * Samsung pinctrl driver data for Exynos3250 SoC. Exynos3250 SoC includes
+  * two gpio/pin-mux/pinconfig controllers.
+  */
+-const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = {
+ 	{
+ 		/* pin-controller instance 0 data */
+ 		.pin_banks	= exynos3250_pin_banks0,
+@@ -225,6 +230,11 @@ const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = {
+ 	},
+ };
+ 
++const struct samsung_pinctrl_of_match_data exynos3250_of_data __initconst = {
++	.ctrl		= exynos3250_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(exynos3250_pin_ctrl),
++};
++
+ /* pin banks of exynos4210 pin-controller 0 */
+ static const struct samsung_pin_bank_data exynos4210_pin_banks0[] __initconst = {
+ 	EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
+@@ -308,7 +318,7 @@ static const struct samsung_retention_data exynos4_audio_retention_data __initco
+  * Samsung pinctrl driver data for Exynos4210 SoC. Exynos4210 SoC includes
+  * three gpio/pin-mux/pinconfig controllers.
+  */
+-const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = {
+ 	{
+ 		/* pin-controller instance 0 data */
+ 		.pin_banks	= exynos4210_pin_banks0,
+@@ -334,6 +344,11 @@ const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = {
+ 	},
+ };
+ 
++const struct samsung_pinctrl_of_match_data exynos4210_of_data __initconst = {
++	.ctrl		= exynos4210_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(exynos4210_pin_ctrl),
++};
++
+ /* pin banks of exynos4x12 pin-controller 0 */
+ static const struct samsung_pin_bank_data exynos4x12_pin_banks0[] __initconst = {
+ 	EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
+@@ -396,7 +411,7 @@ static const struct samsung_pin_bank_data exynos4x12_pin_banks3[] __initconst =
+  * Samsung pinctrl driver data for Exynos4x12 SoC. Exynos4x12 SoC includes
+  * four gpio/pin-mux/pinconfig controllers.
+  */
+-const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = {
+ 	{
+ 		/* pin-controller instance 0 data */
+ 		.pin_banks	= exynos4x12_pin_banks0,
+@@ -432,6 +447,11 @@ const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = {
+ 	},
+ };
+ 
++const struct samsung_pinctrl_of_match_data exynos4x12_of_data __initconst = {
++	.ctrl		= exynos4x12_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(exynos4x12_pin_ctrl),
++};
++
+ /* pin banks of exynos5250 pin-controller 0 */
+ static const struct samsung_pin_bank_data exynos5250_pin_banks0[] __initconst = {
+ 	EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
+@@ -492,7 +512,7 @@ static const struct samsung_pin_bank_data exynos5250_pin_banks3[] __initconst =
+  * Samsung pinctrl driver data for Exynos5250 SoC. Exynos5250 SoC includes
+  * four gpio/pin-mux/pinconfig controllers.
+  */
+-const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = {
+ 	{
+ 		/* pin-controller instance 0 data */
+ 		.pin_banks	= exynos5250_pin_banks0,
+@@ -528,6 +548,11 @@ const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = {
+ 	},
+ };
+ 
++const struct samsung_pinctrl_of_match_data exynos5250_of_data __initconst = {
++	.ctrl		= exynos5250_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(exynos5250_pin_ctrl),
++};
++
+ /* pin banks of exynos5260 pin-controller 0 */
+ static const struct samsung_pin_bank_data exynos5260_pin_banks0[] __initconst = {
+ 	EXYNOS_PIN_BANK_EINTG(4, 0x000, "gpa0", 0x00),
+@@ -572,7 +597,7 @@ static const struct samsung_pin_bank_data exynos5260_pin_banks2[] __initconst =
+  * Samsung pinctrl driver data for Exynos5260 SoC. Exynos5260 SoC includes
+  * three gpio/pin-mux/pinconfig controllers.
+  */
+-const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = {
+ 	{
+ 		/* pin-controller instance 0 data */
+ 		.pin_banks	= exynos5260_pin_banks0,
+@@ -592,6 +617,11 @@ const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = {
+ 	},
+ };
+ 
++const struct samsung_pinctrl_of_match_data exynos5260_of_data __initconst = {
++	.ctrl		= exynos5260_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(exynos5260_pin_ctrl),
++};
++
+ /* pin banks of exynos5410 pin-controller 0 */
+ static const struct samsung_pin_bank_data exynos5410_pin_banks0[] __initconst = {
+ 	EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
+@@ -662,7 +692,7 @@ static const struct samsung_pin_bank_data exynos5410_pin_banks3[] __initconst =
+  * Samsung pinctrl driver data for Exynos5410 SoC. Exynos5410 SoC includes
+  * four gpio/pin-mux/pinconfig controllers.
+  */
+-const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = {
+ 	{
+ 		/* pin-controller instance 0 data */
+ 		.pin_banks	= exynos5410_pin_banks0,
+@@ -695,6 +725,11 @@ const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = {
+ 	},
+ };
+ 
++const struct samsung_pinctrl_of_match_data exynos5410_of_data __initconst = {
++	.ctrl		= exynos5410_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(exynos5410_pin_ctrl),
++};
++
+ /* pin banks of exynos5420 pin-controller 0 */
+ static const struct samsung_pin_bank_data exynos5420_pin_banks0[] __initconst = {
+ 	EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpy7", 0x00),
+@@ -779,7 +814,7 @@ static const struct samsung_retention_data exynos5420_retention_data __initconst
+  * Samsung pinctrl driver data for Exynos5420 SoC. Exynos5420 SoC includes
+  * four gpio/pin-mux/pinconfig controllers.
+  */
+-const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
+ 	{
+ 		/* pin-controller instance 0 data */
+ 		.pin_banks	= exynos5420_pin_banks0,
+@@ -813,3 +848,8 @@ const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
+ 		.retention_data	= &exynos4_audio_retention_data,
+ 	},
+ };
++
++const struct samsung_pinctrl_of_match_data exynos5420_of_data __initconst = {
++	.ctrl		= exynos5420_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(exynos5420_pin_ctrl),
++};
+diff --git a/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c b/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
+index 08e9fdb58fd2..0ab88fc268ea 100644
+--- a/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
++++ b/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
+@@ -180,7 +180,7 @@ static const struct samsung_retention_data exynos5433_fsys_retention_data __init
+  * Samsung pinctrl driver data for Exynos5433 SoC. Exynos5433 SoC includes
+  * ten gpio/pin-mux/pinconfig controllers.
+  */
+-const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = {
+ 	{
+ 		/* pin-controller instance 0 data */
+ 		.pin_banks	= exynos5433_pin_banks0,
+@@ -265,6 +265,11 @@ const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = {
+ 	},
+ };
+ 
++const struct samsung_pinctrl_of_match_data exynos5433_of_data __initconst = {
++	.ctrl		= exynos5433_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(exynos5433_pin_ctrl),
++};
++
+ /* pin banks of exynos7 pin-controller - ALIVE */
+ static const struct samsung_pin_bank_data exynos7_pin_banks0[] __initconst = {
+ 	EXYNOS_PIN_BANK_EINTW(8, 0x000, "gpa0", 0x00),
+@@ -344,7 +349,7 @@ static const struct samsung_pin_bank_data exynos7_pin_banks9[] __initconst = {
+ 	EXYNOS_PIN_BANK_EINTG(4, 0x020, "gpz1", 0x04),
+ };
+ 
+-const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = {
+ 	{
+ 		/* pin-controller instance 0 Alive data */
+ 		.pin_banks	= exynos7_pin_banks0,
+@@ -397,3 +402,8 @@ const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = {
+ 		.eint_gpio_init = exynos_eint_gpio_init,
+ 	},
+ };
++
++const struct samsung_pinctrl_of_match_data exynos7_of_data __initconst = {
++	.ctrl		= exynos7_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(exynos7_pin_ctrl),
++};
+diff --git a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
+index edf27264b603..67da1cf18b68 100644
+--- a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
++++ b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
+@@ -570,7 +570,7 @@ static const struct samsung_pin_bank_data s3c2412_pin_banks[] __initconst = {
+ 	PIN_BANK_2BIT(13, 0x080, "gpj"),
+ };
+ 
+-const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = {
+ 	{
+ 		.pin_banks	= s3c2412_pin_banks,
+ 		.nr_banks	= ARRAY_SIZE(s3c2412_pin_banks),
+@@ -578,6 +578,11 @@ const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = {
+ 	},
+ };
+ 
++const struct samsung_pinctrl_of_match_data s3c2412_of_data __initconst = {
++	.ctrl		= s3c2412_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(s3c2412_pin_ctrl),
++};
++
+ static const struct samsung_pin_bank_data s3c2416_pin_banks[] __initconst = {
+ 	PIN_BANK_A(27, 0x000, "gpa"),
+ 	PIN_BANK_2BIT(11, 0x010, "gpb"),
+@@ -592,7 +597,7 @@ static const struct samsung_pin_bank_data s3c2416_pin_banks[] __initconst = {
+ 	PIN_BANK_2BIT(2, 0x100, "gpm"),
+ };
+ 
+-const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = {
+ 	{
+ 		.pin_banks	= s3c2416_pin_banks,
+ 		.nr_banks	= ARRAY_SIZE(s3c2416_pin_banks),
+@@ -600,6 +605,11 @@ const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = {
+ 	},
+ };
+ 
++const struct samsung_pinctrl_of_match_data s3c2416_of_data __initconst = {
++	.ctrl		= s3c2416_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(s3c2416_pin_ctrl),
++};
++
+ static const struct samsung_pin_bank_data s3c2440_pin_banks[] __initconst = {
+ 	PIN_BANK_A(25, 0x000, "gpa"),
+ 	PIN_BANK_2BIT(11, 0x010, "gpb"),
+@@ -612,7 +622,7 @@ static const struct samsung_pin_bank_data s3c2440_pin_banks[] __initconst = {
+ 	PIN_BANK_2BIT(13, 0x0d0, "gpj"),
+ };
+ 
+-const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = {
+ 	{
+ 		.pin_banks	= s3c2440_pin_banks,
+ 		.nr_banks	= ARRAY_SIZE(s3c2440_pin_banks),
+@@ -620,6 +630,11 @@ const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = {
+ 	},
+ };
+ 
++const struct samsung_pinctrl_of_match_data s3c2440_of_data __initconst = {
++	.ctrl		= s3c2440_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(s3c2440_pin_ctrl),
++};
++
+ static const struct samsung_pin_bank_data s3c2450_pin_banks[] __initconst = {
+ 	PIN_BANK_A(28, 0x000, "gpa"),
+ 	PIN_BANK_2BIT(11, 0x010, "gpb"),
+@@ -635,10 +650,15 @@ static const struct samsung_pin_bank_data s3c2450_pin_banks[] __initconst = {
+ 	PIN_BANK_2BIT(2, 0x100, "gpm"),
+ };
+ 
+-const struct samsung_pin_ctrl s3c2450_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl s3c2450_pin_ctrl[] __initconst = {
+ 	{
+ 		.pin_banks	= s3c2450_pin_banks,
+ 		.nr_banks	= ARRAY_SIZE(s3c2450_pin_banks),
+ 		.eint_wkup_init = s3c24xx_eint_init,
+ 	},
+ };
++
++const struct samsung_pinctrl_of_match_data s3c2450_of_data __initconst = {
++	.ctrl		= s3c2450_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(s3c2450_pin_ctrl),
++};
+diff --git a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
+index e63663b32907..0bdc1e683181 100644
+--- a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
++++ b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
+@@ -794,7 +794,7 @@ static const struct samsung_pin_bank_data s3c64xx_pin_banks0[] __initconst = {
+  * Samsung pinctrl driver data for S3C64xx SoC. S3C64xx SoC includes
+  * one gpio/pin-mux/pinconfig controller.
+  */
+-const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = {
++static const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = {
+ 	{
+ 		/* pin-controller instance 1 data */
+ 		.pin_banks	= s3c64xx_pin_banks0,
+@@ -803,3 +803,8 @@ const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = {
+ 		.eint_wkup_init = s3c64xx_eint_eint0_init,
+ 	},
+ };
++
++const struct samsung_pinctrl_of_match_data s3c64xx_of_data __initconst = {
++	.ctrl		= s3c64xx_pin_ctrl,
++	.num_ctrl	= ARRAY_SIZE(s3c64xx_pin_ctrl),
++};
+diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
+index e04f7fe0a65d..26e8fab736f1 100644
+--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
++++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
+@@ -947,12 +947,33 @@ static int samsung_gpiolib_register(struct platform_device *pdev,
+ 	return 0;
+ }
+ 
++static const struct samsung_pin_ctrl *
++samsung_pinctrl_get_soc_data_for_of_alias(struct platform_device *pdev)
++{
++	struct device_node *node = pdev->dev.of_node;
++	const struct samsung_pinctrl_of_match_data *of_data;
++	int id;
++
++	id = of_alias_get_id(node, "pinctrl");
++	if (id < 0) {
++		dev_err(&pdev->dev, "failed to get alias id\n");
++		return NULL;
++	}
++
++	of_data = of_device_get_match_data(&pdev->dev);
++	if (id >= of_data->num_ctrl) {
++		dev_err(&pdev->dev, "invalid alias id %d\n", id);
++		return NULL;
++	}
++
++	return &(of_data->ctrl[id]);
++}
++
+ /* retrieve the soc specific data */
+ static const struct samsung_pin_ctrl *
+ samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d,
+ 			     struct platform_device *pdev)
+ {
+-	int id;
+ 	struct device_node *node = pdev->dev.of_node;
+ 	struct device_node *np;
+ 	const struct samsung_pin_bank_data *bdata;
+@@ -962,13 +983,9 @@ samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d,
+ 	void __iomem *virt_base[SAMSUNG_PINCTRL_NUM_RESOURCES];
+ 	unsigned int i;
+ 
+-	id = of_alias_get_id(node, "pinctrl");
+-	if (id < 0) {
+-		dev_err(&pdev->dev, "failed to get alias id\n");
++	ctrl = samsung_pinctrl_get_soc_data_for_of_alias(pdev);
++	if (!ctrl)
+ 		return ERR_PTR(-ENOENT);
+-	}
+-	ctrl = of_device_get_match_data(&pdev->dev);
+-	ctrl += id;
+ 
+ 	d->suspend = ctrl->suspend;
+ 	d->resume = ctrl->resume;
+@@ -1193,41 +1210,41 @@ static int __maybe_unused samsung_pinctrl_resume(struct device *dev)
+ static const struct of_device_id samsung_pinctrl_dt_match[] = {
+ #ifdef CONFIG_PINCTRL_EXYNOS_ARM
+ 	{ .compatible = "samsung,exynos3250-pinctrl",
+-		.data = exynos3250_pin_ctrl },
++		.data = &exynos3250_of_data },
+ 	{ .compatible = "samsung,exynos4210-pinctrl",
+-		.data = exynos4210_pin_ctrl },
++		.data = &exynos4210_of_data },
+ 	{ .compatible = "samsung,exynos4x12-pinctrl",
+-		.data = exynos4x12_pin_ctrl },
++		.data = &exynos4x12_of_data },
+ 	{ .compatible = "samsung,exynos5250-pinctrl",
+-		.data = exynos5250_pin_ctrl },
++		.data = &exynos5250_of_data },
+ 	{ .compatible = "samsung,exynos5260-pinctrl",
+-		.data = exynos5260_pin_ctrl },
++		.data = &exynos5260_of_data },
+ 	{ .compatible = "samsung,exynos5410-pinctrl",
+-		.data = exynos5410_pin_ctrl },
++		.data = &exynos5410_of_data },
+ 	{ .compatible = "samsung,exynos5420-pinctrl",
+-		.data = exynos5420_pin_ctrl },
++		.data = &exynos5420_of_data },
+ 	{ .compatible = "samsung,s5pv210-pinctrl",
+-		.data = s5pv210_pin_ctrl },
++		.data = &s5pv210_of_data },
+ #endif
+ #ifdef CONFIG_PINCTRL_EXYNOS_ARM64
+ 	{ .compatible = "samsung,exynos5433-pinctrl",
+-		.data = exynos5433_pin_ctrl },
++		.data = &exynos5433_of_data },
+ 	{ .compatible = "samsung,exynos7-pinctrl",
+-		.data = exynos7_pin_ctrl },
++		.data = &exynos7_of_data },
+ #endif
+ #ifdef CONFIG_PINCTRL_S3C64XX
+ 	{ .compatible = "samsung,s3c64xx-pinctrl",
+-		.data = s3c64xx_pin_ctrl },
++		.data = &s3c64xx_of_data },
+ #endif
+ #ifdef CONFIG_PINCTRL_S3C24XX
+ 	{ .compatible = "samsung,s3c2412-pinctrl",
+-		.data = s3c2412_pin_ctrl },
++		.data = &s3c2412_of_data },
+ 	{ .compatible = "samsung,s3c2416-pinctrl",
+-		.data = s3c2416_pin_ctrl },
++		.data = &s3c2416_of_data },
+ 	{ .compatible = "samsung,s3c2440-pinctrl",
+-		.data = s3c2440_pin_ctrl },
++		.data = &s3c2440_of_data },
+ 	{ .compatible = "samsung,s3c2450-pinctrl",
+-		.data = s3c2450_pin_ctrl },
++		.data = &s3c2450_of_data },
+ #endif
+ 	{},
+ };
+diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.h b/drivers/pinctrl/samsung/pinctrl-samsung.h
+index 9af07af6cad6..ae932e0c05f2 100644
+--- a/drivers/pinctrl/samsung/pinctrl-samsung.h
++++ b/drivers/pinctrl/samsung/pinctrl-samsung.h
+@@ -285,6 +285,16 @@ struct samsung_pinctrl_drv_data {
+ 	void (*resume)(struct samsung_pinctrl_drv_data *);
+ };
+ 
++/**
++ * struct samsung_pinctrl_of_match_data: OF match device specific configuration data.
++ * @ctrl: array of pin controller data.
++ * @num_ctrl: size of array @ctrl.
++ */
++struct samsung_pinctrl_of_match_data {
++	const struct samsung_pin_ctrl	*ctrl;
++	unsigned int			num_ctrl;
++};
++
+ /**
+  * struct samsung_pin_group: represent group of pins of a pinmux function.
+  * @name: name of the pin group, used to lookup the group.
+@@ -313,20 +323,20 @@ struct samsung_pmx_func {
+ };
+ 
+ /* list of all exported SoC specific data */
+-extern const struct samsung_pin_ctrl exynos3250_pin_ctrl[];
+-extern const struct samsung_pin_ctrl exynos4210_pin_ctrl[];
+-extern const struct samsung_pin_ctrl exynos4x12_pin_ctrl[];
+-extern const struct samsung_pin_ctrl exynos5250_pin_ctrl[];
+-extern const struct samsung_pin_ctrl exynos5260_pin_ctrl[];
+-extern const struct samsung_pin_ctrl exynos5410_pin_ctrl[];
+-extern const struct samsung_pin_ctrl exynos5420_pin_ctrl[];
+-extern const struct samsung_pin_ctrl exynos5433_pin_ctrl[];
+-extern const struct samsung_pin_ctrl exynos7_pin_ctrl[];
+-extern const struct samsung_pin_ctrl s3c64xx_pin_ctrl[];
+-extern const struct samsung_pin_ctrl s3c2412_pin_ctrl[];
+-extern const struct samsung_pin_ctrl s3c2416_pin_ctrl[];
+-extern const struct samsung_pin_ctrl s3c2440_pin_ctrl[];
+-extern const struct samsung_pin_ctrl s3c2450_pin_ctrl[];
+-extern const struct samsung_pin_ctrl s5pv210_pin_ctrl[];
++extern const struct samsung_pinctrl_of_match_data exynos3250_of_data;
++extern const struct samsung_pinctrl_of_match_data exynos4210_of_data;
++extern const struct samsung_pinctrl_of_match_data exynos4x12_of_data;
++extern const struct samsung_pinctrl_of_match_data exynos5250_of_data;
++extern const struct samsung_pinctrl_of_match_data exynos5260_of_data;
++extern const struct samsung_pinctrl_of_match_data exynos5410_of_data;
++extern const struct samsung_pinctrl_of_match_data exynos5420_of_data;
++extern const struct samsung_pinctrl_of_match_data exynos5433_of_data;
++extern const struct samsung_pinctrl_of_match_data exynos7_of_data;
++extern const struct samsung_pinctrl_of_match_data s3c64xx_of_data;
++extern const struct samsung_pinctrl_of_match_data s3c2412_of_data;
++extern const struct samsung_pinctrl_of_match_data s3c2416_of_data;
++extern const struct samsung_pinctrl_of_match_data s3c2440_of_data;
++extern const struct samsung_pinctrl_of_match_data s3c2450_of_data;
++extern const struct samsung_pinctrl_of_match_data s5pv210_of_data;
+ 
+ #endif /* __PINCTRL_SAMSUNG_H */
+diff --git a/drivers/staging/android/ion/ion_cma_heap.c b/drivers/staging/android/ion/ion_cma_heap.c
+index 86196ffd2faf..fa3e4b7e0c9f 100644
+--- a/drivers/staging/android/ion/ion_cma_heap.c
++++ b/drivers/staging/android/ion/ion_cma_heap.c
+@@ -21,6 +21,7 @@
+ #include <linux/err.h>
+ #include <linux/cma.h>
+ #include <linux/scatterlist.h>
++#include <linux/highmem.h>
+ 
+ #include "ion.h"
+ 
+@@ -51,6 +52,22 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer,
+ 	if (!pages)
+ 		return -ENOMEM;
+ 
++	if (PageHighMem(pages)) {
++		unsigned long nr_clear_pages = nr_pages;
++		struct page *page = pages;
++
++		while (nr_clear_pages > 0) {
++			void *vaddr = kmap_atomic(page);
++
++			memset(vaddr, 0, PAGE_SIZE);
++			kunmap_atomic(vaddr);
++			page++;
++			nr_clear_pages--;
++		}
++	} else {
++		memset(page_address(pages), 0, size);
++	}
++
+ 	table = kmalloc(sizeof(*table), GFP_KERNEL);
+ 	if (!table)
+ 		goto err;
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 88b902c525d7..b4e57c5a8bba 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1727,7 +1727,7 @@ static void reset_terminal(struct vc_data *vc, int do_clear)
+ 	default_attr(vc);
+ 	update_attr(vc);
+ 
+-	vc->vc_tab_stop[0]	= 0x01010100;
++	vc->vc_tab_stop[0]	=
+ 	vc->vc_tab_stop[1]	=
+ 	vc->vc_tab_stop[2]	=
+ 	vc->vc_tab_stop[3]	=
+@@ -1771,7 +1771,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
+ 		vc->vc_pos -= (vc->vc_x << 1);
+ 		while (vc->vc_x < vc->vc_cols - 1) {
+ 			vc->vc_x++;
+-			if (vc->vc_tab_stop[vc->vc_x >> 5] & (1 << (vc->vc_x & 31)))
++			if (vc->vc_tab_stop[7 & (vc->vc_x >> 5)] & (1 << (vc->vc_x & 31)))
+ 				break;
+ 		}
+ 		vc->vc_pos += (vc->vc_x << 1);
+@@ -1831,7 +1831,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
+ 			lf(vc);
+ 			return;
+ 		case 'H':
+-			vc->vc_tab_stop[vc->vc_x >> 5] |= (1 << (vc->vc_x & 31));
++			vc->vc_tab_stop[7 & (vc->vc_x >> 5)] |= (1 << (vc->vc_x & 31));
+ 			return;
+ 		case 'Z':
+ 			respond_ID(tty);
+@@ -2024,7 +2024,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
+ 			return;
+ 		case 'g':
+ 			if (!vc->vc_par[0])
+-				vc->vc_tab_stop[vc->vc_x >> 5] &= ~(1 << (vc->vc_x & 31));
++				vc->vc_tab_stop[7 & (vc->vc_x >> 5)] &= ~(1 << (vc->vc_x & 31));
+ 			else if (vc->vc_par[0] == 3) {
+ 				vc->vc_tab_stop[0] =
+ 					vc->vc_tab_stop[1] =
+diff --git a/drivers/watchdog/wdat_wdt.c b/drivers/watchdog/wdat_wdt.c
+index 6d1fbda0f461..0da9943d405f 100644
+--- a/drivers/watchdog/wdat_wdt.c
++++ b/drivers/watchdog/wdat_wdt.c
+@@ -392,7 +392,7 @@ static int wdat_wdt_probe(struct platform_device *pdev)
+ 
+ 		memset(&r, 0, sizeof(r));
+ 		r.start = gas->address;
+-		r.end = r.start + gas->access_width;
++		r.end = r.start + gas->access_width - 1;
+ 		if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
+ 			r.flags = IORESOURCE_MEM;
+ 		} else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO) {
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index 8a85f3f53446..8a5bde8b1444 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -118,6 +118,16 @@ static void huge_pagevec_release(struct pagevec *pvec)
+ 	pagevec_reinit(pvec);
+ }
+ 
++/*
++ * Mask used when checking the page offset value passed in via system
++ * calls.  This value will be converted to a loff_t which is signed.
++ * Therefore, we want to check the upper PAGE_SHIFT + 1 bits of the
++ * value.  The extra bit (- 1 in the shift value) is to take the sign
++ * bit into account.
++ */
++#define PGOFF_LOFFT_MAX \
++	(((1UL << (PAGE_SHIFT + 1)) - 1) <<  (BITS_PER_LONG - (PAGE_SHIFT + 1)))
++
+ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
+ {
+ 	struct inode *inode = file_inode(file);
+@@ -137,12 +147,13 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
+ 	vma->vm_ops = &hugetlb_vm_ops;
+ 
+ 	/*
+-	 * Offset passed to mmap (before page shift) could have been
+-	 * negative when represented as a (l)off_t.
++	 * page based offset in vm_pgoff could be sufficiently large to
++	 * overflow a (l)off_t when converted to byte offset.
+ 	 */
+-	if (((loff_t)vma->vm_pgoff << PAGE_SHIFT) < 0)
++	if (vma->vm_pgoff & PGOFF_LOFFT_MAX)
+ 		return -EINVAL;
+ 
++	/* must be huge page aligned */
+ 	if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))
+ 		return -EINVAL;
+ 
+diff --git a/fs/ncpfs/ncplib_kernel.c b/fs/ncpfs/ncplib_kernel.c
+index 804adfebba2f..3e047eb4cc7c 100644
+--- a/fs/ncpfs/ncplib_kernel.c
++++ b/fs/ncpfs/ncplib_kernel.c
+@@ -981,6 +981,10 @@ ncp_read_kernel(struct ncp_server *server, const char *file_id,
+ 		goto out;
+ 	}
+ 	*bytes_read = ncp_reply_be16(server, 0);
++	if (*bytes_read > to_read) {
++		result = -EINVAL;
++		goto out;
++	}
+ 	source = ncp_reply_data(server, 2 + (offset & 1));
+ 
+ 	memcpy(target, source, *bytes_read);
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 5a75135f5f53..974b1be7f148 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -268,6 +268,35 @@ free_blocked_lock(struct nfsd4_blocked_lock *nbl)
+ 	kfree(nbl);
+ }
+ 
++static void
++remove_blocked_locks(struct nfs4_lockowner *lo)
++{
++	struct nfs4_client *clp = lo->lo_owner.so_client;
++	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
++	struct nfsd4_blocked_lock *nbl;
++	LIST_HEAD(reaplist);
++
++	/* Dequeue all blocked locks */
++	spin_lock(&nn->blocked_locks_lock);
++	while (!list_empty(&lo->lo_blocked)) {
++		nbl = list_first_entry(&lo->lo_blocked,
++					struct nfsd4_blocked_lock,
++					nbl_list);
++		list_del_init(&nbl->nbl_list);
++		list_move(&nbl->nbl_lru, &reaplist);
++	}
++	spin_unlock(&nn->blocked_locks_lock);
++
++	/* Now free them */
++	while (!list_empty(&reaplist)) {
++		nbl = list_first_entry(&reaplist, struct nfsd4_blocked_lock,
++					nbl_lru);
++		list_del_init(&nbl->nbl_lru);
++		posix_unblock_lock(&nbl->nbl_lock);
++		free_blocked_lock(nbl);
++	}
++}
++
+ static int
+ nfsd4_cb_notify_lock_done(struct nfsd4_callback *cb, struct rpc_task *task)
+ {
+@@ -1866,6 +1895,7 @@ static __be32 mark_client_expired_locked(struct nfs4_client *clp)
+ static void
+ __destroy_client(struct nfs4_client *clp)
+ {
++	int i;
+ 	struct nfs4_openowner *oo;
+ 	struct nfs4_delegation *dp;
+ 	struct list_head reaplist;
+@@ -1895,6 +1925,16 @@ __destroy_client(struct nfs4_client *clp)
+ 		nfs4_get_stateowner(&oo->oo_owner);
+ 		release_openowner(oo);
+ 	}
++	for (i = 0; i < OWNER_HASH_SIZE; i++) {
++		struct nfs4_stateowner *so, *tmp;
++
++		list_for_each_entry_safe(so, tmp, &clp->cl_ownerstr_hashtbl[i],
++					 so_strhash) {
++			/* Should be no openowners at this point */
++			WARN_ON_ONCE(so->so_is_open_owner);
++			remove_blocked_locks(lockowner(so));
++		}
++	}
+ 	nfsd4_return_all_client_layouts(clp);
+ 	nfsd4_shutdown_callback(clp);
+ 	if (clp->cl_cb_conn.cb_xprt)
+@@ -6358,6 +6398,7 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp,
+ 	}
+ 	spin_unlock(&clp->cl_lock);
+ 	free_ol_stateid_reaplist(&reaplist);
++	remove_blocked_locks(lo);
+ 	nfs4_put_stateowner(&lo->lo_owner);
+ 
+ 	return status;
+@@ -7143,6 +7184,8 @@ nfs4_state_destroy_net(struct net *net)
+ 		}
+ 	}
+ 
++	WARN_ON(!list_empty(&nn->blocked_locks_lru));
++
+ 	for (i = 0; i < CLIENT_HASH_SIZE; i++) {
+ 		while (!list_empty(&nn->unconf_id_hashtbl[i])) {
+ 			clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
+@@ -7209,7 +7252,6 @@ nfs4_state_shutdown_net(struct net *net)
+ 	struct nfs4_delegation *dp = NULL;
+ 	struct list_head *pos, *next, reaplist;
+ 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
+-	struct nfsd4_blocked_lock *nbl;
+ 
+ 	cancel_delayed_work_sync(&nn->laundromat_work);
+ 	locks_end_grace(&nn->nfsd4_manager);
+@@ -7230,24 +7272,6 @@ nfs4_state_shutdown_net(struct net *net)
+ 		nfs4_put_stid(&dp->dl_stid);
+ 	}
+ 
+-	BUG_ON(!list_empty(&reaplist));
+-	spin_lock(&nn->blocked_locks_lock);
+-	while (!list_empty(&nn->blocked_locks_lru)) {
+-		nbl = list_first_entry(&nn->blocked_locks_lru,
+-					struct nfsd4_blocked_lock, nbl_lru);
+-		list_move(&nbl->nbl_lru, &reaplist);
+-		list_del_init(&nbl->nbl_list);
+-	}
+-	spin_unlock(&nn->blocked_locks_lock);
+-
+-	while (!list_empty(&reaplist)) {
+-		nbl = list_first_entry(&reaplist,
+-					struct nfsd4_blocked_lock, nbl_lru);
+-		list_del_init(&nbl->nbl_lru);
+-		posix_unblock_lock(&nbl->nbl_lock);
+-		free_blocked_lock(nbl);
+-	}
+-
+ 	nfsd4_client_tracking_exit(net);
+ 	nfs4_state_destroy_net(net);
+ }
+diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
+index 868e68561f91..dfc861caa478 100644
+--- a/include/asm-generic/pgtable.h
++++ b/include/asm-generic/pgtable.h
+@@ -976,6 +976,8 @@ int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot);
+ int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot);
+ int pud_clear_huge(pud_t *pud);
+ int pmd_clear_huge(pmd_t *pmd);
++int pud_free_pmd_page(pud_t *pud);
++int pmd_free_pte_page(pmd_t *pmd);
+ #else	/* !CONFIG_HAVE_ARCH_HUGE_VMAP */
+ static inline int p4d_set_huge(p4d_t *p4d, phys_addr_t addr, pgprot_t prot)
+ {
+@@ -1001,6 +1003,14 @@ static inline int pmd_clear_huge(pmd_t *pmd)
+ {
+ 	return 0;
+ }
++static inline int pud_free_pmd_page(pud_t *pud)
++{
++	return 0;
++}
++static inline int pmd_free_pte_page(pmd_t *pmd)
++{
++	return 0;
++}
+ #endif	/* CONFIG_HAVE_ARCH_HUGE_VMAP */
+ 
+ #ifndef __HAVE_ARCH_FLUSH_PMD_TLB_RANGE
+diff --git a/include/linux/fsl_ifc.h b/include/linux/fsl_ifc.h
+index c332f0a45607..3fdfede2f0f3 100644
+--- a/include/linux/fsl_ifc.h
++++ b/include/linux/fsl_ifc.h
+@@ -734,11 +734,7 @@ struct fsl_ifc_nand {
+ 	u32 res19[0x10];
+ 	__be32 nand_fsr;
+ 	u32 res20;
+-	/* The V1 nand_eccstat is actually 4 words that overlaps the
+-	 * V2 nand_eccstat.
+-	 */
+-	__be32 v1_nand_eccstat[2];
+-	__be32 v2_nand_eccstat[6];
++	__be32 nand_eccstat[8];
+ 	u32 res21[0x1c];
+ 	__be32 nanndcr;
+ 	u32 res22[0x2];
+diff --git a/include/linux/memblock.h b/include/linux/memblock.h
+index 7ed0f7782d16..9efd592c5da4 100644
+--- a/include/linux/memblock.h
++++ b/include/linux/memblock.h
+@@ -187,7 +187,6 @@ int memblock_search_pfn_nid(unsigned long pfn, unsigned long *start_pfn,
+ 			    unsigned long  *end_pfn);
+ void __next_mem_pfn_range(int *idx, int nid, unsigned long *out_start_pfn,
+ 			  unsigned long *out_end_pfn, int *out_nid);
+-unsigned long memblock_next_valid_pfn(unsigned long pfn, unsigned long max_pfn);
+ 
+ /**
+  * for_each_mem_pfn_range - early memory pfn range iterator
+diff --git a/include/trace/events/mmc.h b/include/trace/events/mmc.h
+index 200f731be557..7b706ff21335 100644
+--- a/include/trace/events/mmc.h
++++ b/include/trace/events/mmc.h
+@@ -86,8 +86,8 @@ TRACE_EVENT(mmc_request_start,
+ 		  __entry->stop_flags, __entry->stop_retries,
+ 		  __entry->sbc_opcode, __entry->sbc_arg,
+ 		  __entry->sbc_flags, __entry->sbc_retries,
+-		  __entry->blocks, __entry->blk_addr,
+-		  __entry->blksz, __entry->data_flags, __entry->tag,
++		  __entry->blocks, __entry->blksz,
++		  __entry->blk_addr, __entry->data_flags, __entry->tag,
+ 		  __entry->can_retune, __entry->doing_retune,
+ 		  __entry->retune_now, __entry->need_retune,
+ 		  __entry->hold_retune, __entry->retune_period)
+diff --git a/include/uapi/linux/usb/audio.h b/include/uapi/linux/usb/audio.h
+index 17a022c5b414..da3315ed1bcd 100644
+--- a/include/uapi/linux/usb/audio.h
++++ b/include/uapi/linux/usb/audio.h
+@@ -370,7 +370,7 @@ static inline __u8 uac_processing_unit_bControlSize(struct uac_processing_unit_d
+ {
+ 	return (protocol == UAC_VERSION_1) ?
+ 		desc->baSourceID[desc->bNrInPins + 4] :
+-		desc->baSourceID[desc->bNrInPins + 6];
++		2; /* in UAC2, this value is constant */
+ }
+ 
+ static inline __u8 *uac_processing_unit_bmControls(struct uac_processing_unit_descriptor *desc,
+@@ -378,7 +378,7 @@ static inline __u8 *uac_processing_unit_bmControls(struct uac_processing_unit_de
+ {
+ 	return (protocol == UAC_VERSION_1) ?
+ 		&desc->baSourceID[desc->bNrInPins + 5] :
+-		&desc->baSourceID[desc->bNrInPins + 7];
++		&desc->baSourceID[desc->bNrInPins + 6];
+ }
+ 
+ static inline __u8 uac_processing_unit_iProcessing(struct uac_processing_unit_descriptor *desc,
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 5cb783fc8224..b719351b48d2 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1687,7 +1687,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, siz
+ 	union bpf_attr attr = {};
+ 	int err;
+ 
+-	if (!capable(CAP_SYS_ADMIN) && sysctl_unprivileged_bpf_disabled)
++	if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN))
+ 		return -EPERM;
+ 
+ 	err = check_uarg_tail_zero(uattr, sizeof(attr), size);
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 7e4c44538119..2522fac782af 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -3183,6 +3183,16 @@ static int cgroup_enable_threaded(struct cgroup *cgrp)
+ 	if (cgroup_is_threaded(cgrp))
+ 		return 0;
+ 
++	/*
++	 * If @cgroup is populated or has domain controllers enabled, it
++	 * can't be switched.  While the below cgroup_can_be_thread_root()
++	 * test can catch the same conditions, that's only when @parent is
++	 * not mixable, so let's check it explicitly.
++	 */
++	if (cgroup_is_populated(cgrp) ||
++	    cgrp->subtree_control & ~cgrp_dfl_threaded_ss_mask)
++		return -EOPNOTSUPP;
++
+ 	/* we're joining the parent's domain, ensure its validity */
+ 	if (!cgroup_is_valid_domain(dom_cgrp) ||
+ 	    !cgroup_can_be_thread_root(dom_cgrp))
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 5d8f4031f8d5..385480a5aa45 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -2246,7 +2246,7 @@ static void ctx_resched(struct perf_cpu_context *cpuctx,
+ 			struct perf_event_context *task_ctx,
+ 			enum event_type_t event_type)
+ {
+-	enum event_type_t ctx_event_type = event_type & EVENT_ALL;
++	enum event_type_t ctx_event_type;
+ 	bool cpu_event = !!(event_type & EVENT_CPU);
+ 
+ 	/*
+@@ -2256,6 +2256,8 @@ static void ctx_resched(struct perf_cpu_context *cpuctx,
+ 	if (event_type & EVENT_PINNED)
+ 		event_type |= EVENT_FLEXIBLE;
+ 
++	ctx_event_type = event_type & EVENT_ALL;
++
+ 	perf_pmu_disable(cpuctx->ctx.pmu);
+ 	if (task_ctx)
+ 		task_ctx_sched_out(cpuctx, task_ctx, event_type);
+diff --git a/kernel/module.c b/kernel/module.c
+index 09e48eee4d55..0c4530763f02 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -4223,7 +4223,7 @@ static int modules_open(struct inode *inode, struct file *file)
+ 		m->private = kallsyms_show_value() ? NULL : (void *)8ul;
+ 	}
+ 
+-	return 0;
++	return err;
+ }
+ 
+ static const struct file_operations proc_modules_operations = {
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 5a31a85bbd84..b4f7f890c1b9 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -6611,13 +6611,18 @@ static int tg_cfs_schedulable_down(struct task_group *tg, void *data)
+ 		parent_quota = parent_b->hierarchical_quota;
+ 
+ 		/*
+-		 * Ensure max(child_quota) <= parent_quota, inherit when no
++		 * Ensure max(child_quota) <= parent_quota.  On cgroup2,
++		 * always take the min.  On cgroup1, only inherit when no
+ 		 * limit is set:
+ 		 */
+-		if (quota == RUNTIME_INF)
+-			quota = parent_quota;
+-		else if (parent_quota != RUNTIME_INF && quota > parent_quota)
+-			return -EINVAL;
++		if (cgroup_subsys_on_dfl(cpu_cgrp_subsys)) {
++			quota = min(quota, parent_quota);
++		} else {
++			if (quota == RUNTIME_INF)
++				quota = parent_quota;
++			else if (parent_quota != RUNTIME_INF && quota > parent_quota)
++				return -EINVAL;
++		}
+ 	}
+ 	cfs_b->hierarchical_quota = quota;
+ 
+diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
+index ec999f32c840..708992708332 100644
+--- a/kernel/time/posix-timers.c
++++ b/kernel/time/posix-timers.c
+@@ -50,6 +50,7 @@
+ #include <linux/export.h>
+ #include <linux/hashtable.h>
+ #include <linux/compat.h>
++#include <linux/nospec.h>
+ 
+ #include "timekeeping.h"
+ #include "posix-timers.h"
+@@ -1346,11 +1347,15 @@ static const struct k_clock * const posix_clocks[] = {
+ 
+ static const struct k_clock *clockid_to_kclock(const clockid_t id)
+ {
+-	if (id < 0)
++	clockid_t idx = id;
++
++	if (id < 0) {
+ 		return (id & CLOCKFD_MASK) == CLOCKFD ?
+ 			&clock_posix_dynamic : &clock_posix_cpu;
++	}
+ 
+-	if (id >= ARRAY_SIZE(posix_clocks) || !posix_clocks[id])
++	if (id >= ARRAY_SIZE(posix_clocks))
+ 		return NULL;
+-	return posix_clocks[id];
++
++	return posix_clocks[array_index_nospec(idx, ARRAY_SIZE(posix_clocks))];
+ }
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 40207c2a4113..fe2429b382ca 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -636,7 +636,41 @@ static const struct bpf_func_proto bpf_get_stackid_proto_tp = {
+ 	.arg3_type	= ARG_ANYTHING,
+ };
+ 
+-BPF_CALL_3(bpf_perf_prog_read_value_tp, struct bpf_perf_event_data_kern *, ctx,
++static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
++{
++	switch (func_id) {
++	case BPF_FUNC_perf_event_output:
++		return &bpf_perf_event_output_proto_tp;
++	case BPF_FUNC_get_stackid:
++		return &bpf_get_stackid_proto_tp;
++	default:
++		return tracing_func_proto(func_id);
++	}
++}
++
++static bool tp_prog_is_valid_access(int off, int size, enum bpf_access_type type,
++				    struct bpf_insn_access_aux *info)
++{
++	if (off < sizeof(void *) || off >= PERF_MAX_TRACE_SIZE)
++		return false;
++	if (type != BPF_READ)
++		return false;
++	if (off % size != 0)
++		return false;
++
++	BUILD_BUG_ON(PERF_MAX_TRACE_SIZE % sizeof(__u64));
++	return true;
++}
++
++const struct bpf_verifier_ops tracepoint_verifier_ops = {
++	.get_func_proto  = tp_prog_func_proto,
++	.is_valid_access = tp_prog_is_valid_access,
++};
++
++const struct bpf_prog_ops tracepoint_prog_ops = {
++};
++
++BPF_CALL_3(bpf_perf_prog_read_value, struct bpf_perf_event_data_kern *, ctx,
+ 	   struct bpf_perf_event_value *, buf, u32, size)
+ {
+ 	int err = -EINVAL;
+@@ -653,8 +687,8 @@ BPF_CALL_3(bpf_perf_prog_read_value_tp, struct bpf_perf_event_data_kern *, ctx,
+ 	return err;
+ }
+ 
+-static const struct bpf_func_proto bpf_perf_prog_read_value_proto_tp = {
+-         .func           = bpf_perf_prog_read_value_tp,
++static const struct bpf_func_proto bpf_perf_prog_read_value_proto = {
++         .func           = bpf_perf_prog_read_value,
+          .gpl_only       = true,
+          .ret_type       = RET_INTEGER,
+          .arg1_type      = ARG_PTR_TO_CTX,
+@@ -662,7 +696,7 @@ static const struct bpf_func_proto bpf_perf_prog_read_value_proto_tp = {
+          .arg3_type      = ARG_CONST_SIZE,
+ };
+ 
+-static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
++static const struct bpf_func_proto *pe_prog_func_proto(enum bpf_func_id func_id)
+ {
+ 	switch (func_id) {
+ 	case BPF_FUNC_perf_event_output:
+@@ -670,34 +704,12 @@ static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
+ 	case BPF_FUNC_get_stackid:
+ 		return &bpf_get_stackid_proto_tp;
+ 	case BPF_FUNC_perf_prog_read_value:
+-		return &bpf_perf_prog_read_value_proto_tp;
++		return &bpf_perf_prog_read_value_proto;
+ 	default:
+ 		return tracing_func_proto(func_id);
+ 	}
+ }
+ 
+-static bool tp_prog_is_valid_access(int off, int size, enum bpf_access_type type,
+-				    struct bpf_insn_access_aux *info)
+-{
+-	if (off < sizeof(void *) || off >= PERF_MAX_TRACE_SIZE)
+-		return false;
+-	if (type != BPF_READ)
+-		return false;
+-	if (off % size != 0)
+-		return false;
+-
+-	BUILD_BUG_ON(PERF_MAX_TRACE_SIZE % sizeof(__u64));
+-	return true;
+-}
+-
+-const struct bpf_verifier_ops tracepoint_verifier_ops = {
+-	.get_func_proto  = tp_prog_func_proto,
+-	.is_valid_access = tp_prog_is_valid_access,
+-};
+-
+-const struct bpf_prog_ops tracepoint_prog_ops = {
+-};
+-
+ static bool pe_prog_is_valid_access(int off, int size, enum bpf_access_type type,
+ 				    struct bpf_insn_access_aux *info)
+ {
+@@ -754,7 +766,7 @@ static u32 pe_prog_convert_ctx_access(enum bpf_access_type type,
+ }
+ 
+ const struct bpf_verifier_ops perf_event_verifier_ops = {
+-	.get_func_proto		= tp_prog_func_proto,
++	.get_func_proto		= pe_prog_func_proto,
+ 	.is_valid_access	= pe_prog_is_valid_access,
+ 	.convert_ctx_access	= pe_prog_convert_ctx_access,
+ };
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index 492700c5fb4d..fccf00a66298 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -635,7 +635,7 @@ static int create_trace_kprobe(int argc, char **argv)
+ 	char *symbol = NULL, *event = NULL, *group = NULL;
+ 	int maxactive = 0;
+ 	char *arg;
+-	unsigned long offset = 0;
++	long offset = 0;
+ 	void *addr = NULL;
+ 	char buf[MAX_EVENT_NAME_LEN];
+ 
+@@ -723,7 +723,7 @@ static int create_trace_kprobe(int argc, char **argv)
+ 		symbol = argv[1];
+ 		/* TODO: support .init module functions */
+ 		ret = traceprobe_split_symbol_offset(symbol, &offset);
+-		if (ret) {
++		if (ret || offset < 0 || offset > UINT_MAX) {
+ 			pr_info("Failed to parse either an address or a symbol.\n");
+ 			return ret;
+ 		}
+diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
+index d59357308677..daf54bda4dc8 100644
+--- a/kernel/trace/trace_probe.c
++++ b/kernel/trace/trace_probe.c
+@@ -320,7 +320,7 @@ static fetch_func_t get_fetch_size_function(const struct fetch_type *type,
+ }
+ 
+ /* Split symbol and offset. */
+-int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset)
++int traceprobe_split_symbol_offset(char *symbol, long *offset)
+ {
+ 	char *tmp;
+ 	int ret;
+@@ -328,13 +328,11 @@ int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset)
+ 	if (!offset)
+ 		return -EINVAL;
+ 
+-	tmp = strchr(symbol, '+');
++	tmp = strpbrk(symbol, "+-");
+ 	if (tmp) {
+-		/* skip sign because kstrtoul doesn't accept '+' */
+-		ret = kstrtoul(tmp + 1, 0, offset);
++		ret = kstrtol(tmp, 0, offset);
+ 		if (ret)
+ 			return ret;
+-
+ 		*tmp = '\0';
+ 	} else
+ 		*offset = 0;
+diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
+index fb66e3eaa192..a0d750e3d17c 100644
+--- a/kernel/trace/trace_probe.h
++++ b/kernel/trace/trace_probe.h
+@@ -353,7 +353,7 @@ extern int traceprobe_conflict_field_name(const char *name,
+ extern void traceprobe_update_arg(struct probe_arg *arg);
+ extern void traceprobe_free_probe_arg(struct probe_arg *arg);
+ 
+-extern int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset);
++extern int traceprobe_split_symbol_offset(char *symbol, long *offset);
+ 
+ /* Sum up total data length for dynamic arraies (strings) */
+ static nokprobe_inline int
+diff --git a/lib/ioremap.c b/lib/ioremap.c
+index b808a390e4c3..54e5bbaa3200 100644
+--- a/lib/ioremap.c
++++ b/lib/ioremap.c
+@@ -91,7 +91,8 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr,
+ 
+ 		if (ioremap_pmd_enabled() &&
+ 		    ((next - addr) == PMD_SIZE) &&
+-		    IS_ALIGNED(phys_addr + addr, PMD_SIZE)) {
++		    IS_ALIGNED(phys_addr + addr, PMD_SIZE) &&
++		    pmd_free_pte_page(pmd)) {
+ 			if (pmd_set_huge(pmd, phys_addr + addr, prot))
+ 				continue;
+ 		}
+@@ -117,7 +118,8 @@ static inline int ioremap_pud_range(p4d_t *p4d, unsigned long addr,
+ 
+ 		if (ioremap_pud_enabled() &&
+ 		    ((next - addr) == PUD_SIZE) &&
+-		    IS_ALIGNED(phys_addr + addr, PUD_SIZE)) {
++		    IS_ALIGNED(phys_addr + addr, PUD_SIZE) &&
++		    pud_free_pmd_page(pud)) {
+ 			if (pud_set_huge(pud, phys_addr + addr, prot))
+ 				continue;
+ 		}
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 0e7ded98d114..4ed6c89e95c3 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2791,11 +2791,13 @@ static unsigned long deferred_split_scan(struct shrinker *shrink,
+ 
+ 	list_for_each_safe(pos, next, &list) {
+ 		page = list_entry((void *)pos, struct page, mapping);
+-		lock_page(page);
++		if (!trylock_page(page))
++			goto next;
+ 		/* split_huge_page() removes page from list on success */
+ 		if (!split_huge_page(page))
+ 			split++;
+ 		unlock_page(page);
++next:
+ 		put_page(page);
+ 	}
+ 
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 9a334f5fb730..d01912be98da 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -18,6 +18,7 @@
+ #include <linux/bootmem.h>
+ #include <linux/sysfs.h>
+ #include <linux/slab.h>
++#include <linux/mmdebug.h>
+ #include <linux/sched/signal.h>
+ #include <linux/rmap.h>
+ #include <linux/string_helpers.h>
+@@ -4354,6 +4355,12 @@ int hugetlb_reserve_pages(struct inode *inode,
+ 	struct resv_map *resv_map;
+ 	long gbl_reserve;
+ 
++	/* This should never happen */
++	if (from > to) {
++		VM_WARN(1, "%s called with a negative range\n", __func__);
++		return -EINVAL;
++	}
++
+ 	/*
+ 	 * Only apply hugepage reservation if asked. At fault time, an
+ 	 * attempt will be made for VM_NORESERVE to allocate a page
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index ea4ff259b671..33255bf91074 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -530,7 +530,12 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma,
+ 			goto out;
+ 		}
+ 
+-		VM_BUG_ON_PAGE(PageCompound(page), page);
++		/* TODO: teach khugepaged to collapse THP mapped with pte */
++		if (PageCompound(page)) {
++			result = SCAN_PAGE_COMPOUND;
++			goto out;
++		}
++
+ 		VM_BUG_ON_PAGE(!PageAnon(page), page);
+ 
+ 		/*
+diff --git a/mm/memblock.c b/mm/memblock.c
+index d25b5a456cca..028429d5bc38 100644
+--- a/mm/memblock.c
++++ b/mm/memblock.c
+@@ -1101,34 +1101,6 @@ void __init_memblock __next_mem_pfn_range(int *idx, int nid,
+ 		*out_nid = r->nid;
+ }
+ 
+-unsigned long __init_memblock memblock_next_valid_pfn(unsigned long pfn,
+-						      unsigned long max_pfn)
+-{
+-	struct memblock_type *type = &memblock.memory;
+-	unsigned int right = type->cnt;
+-	unsigned int mid, left = 0;
+-	phys_addr_t addr = PFN_PHYS(++pfn);
+-
+-	do {
+-		mid = (right + left) / 2;
+-
+-		if (addr < type->regions[mid].base)
+-			right = mid;
+-		else if (addr >= (type->regions[mid].base +
+-				  type->regions[mid].size))
+-			left = mid + 1;
+-		else {
+-			/* addr is within the region, so pfn is valid */
+-			return pfn;
+-		}
+-	} while (left < right);
+-
+-	if (right == type->cnt)
+-		return -1UL;
+-	else
+-		return PHYS_PFN(type->regions[right].base);
+-}
+-
+ /**
+  * memblock_set_node - set node ID on memblock regions
+  * @base: base of area to set node ID for
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 9f927497f2f5..d8ee1effa4a6 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -3588,7 +3588,7 @@ static bool __need_fs_reclaim(gfp_t gfp_mask)
+ 		return false;
+ 
+ 	/* this guy won't enter reclaim */
+-	if ((current->flags & PF_MEMALLOC) && !(gfp_mask & __GFP_NOMEMALLOC))
++	if (current->flags & PF_MEMALLOC)
+ 		return false;
+ 
+ 	/* We're only interested __GFP_FS allocations for now */
+@@ -5348,17 +5348,8 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
+ 		if (context != MEMMAP_EARLY)
+ 			goto not_early;
+ 
+-		if (!early_pfn_valid(pfn)) {
+-#ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP
+-			/*
+-			 * Skip to the pfn preceding the next valid one (or
+-			 * end_pfn), such that we hit a valid pfn (or end_pfn)
+-			 * on our next iteration of the loop.
+-			 */
+-			pfn = memblock_next_valid_pfn(pfn, end_pfn) - 1;
+-#endif
++		if (!early_pfn_valid(pfn))
+ 			continue;
+-		}
+ 		if (!early_pfn_in_nid(pfn, nid))
+ 			continue;
+ 		if (!update_defer_init(pgdat, pfn, end_pfn, &nr_initialised))
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 7fbe67be86fa..29a369c2067f 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -493,36 +493,45 @@ static unsigned long shmem_unused_huge_shrink(struct shmem_sb_info *sbinfo,
+ 		info = list_entry(pos, struct shmem_inode_info, shrinklist);
+ 		inode = &info->vfs_inode;
+ 
+-		if (nr_to_split && split >= nr_to_split) {
+-			iput(inode);
+-			continue;
+-		}
++		if (nr_to_split && split >= nr_to_split)
++			goto leave;
+ 
+-		page = find_lock_page(inode->i_mapping,
++		page = find_get_page(inode->i_mapping,
+ 				(inode->i_size & HPAGE_PMD_MASK) >> PAGE_SHIFT);
+ 		if (!page)
+ 			goto drop;
+ 
++		/* No huge page at the end of the file: nothing to split */
+ 		if (!PageTransHuge(page)) {
+-			unlock_page(page);
+ 			put_page(page);
+ 			goto drop;
+ 		}
+ 
++		/*
++		 * Leave the inode on the list if we failed to lock
++		 * the page at this time.
++		 *
++		 * Waiting for the lock may lead to deadlock in the
++		 * reclaim path.
++		 */
++		if (!trylock_page(page)) {
++			put_page(page);
++			goto leave;
++		}
++
+ 		ret = split_huge_page(page);
+ 		unlock_page(page);
+ 		put_page(page);
+ 
+-		if (ret) {
+-			/* split failed: leave it on the list */
+-			iput(inode);
+-			continue;
+-		}
++		/* If split failed leave the inode on the list */
++		if (ret)
++			goto leave;
+ 
+ 		split++;
+ drop:
+ 		list_del_init(&info->shrinklist);
+ 		removed++;
++leave:
+ 		iput(inode);
+ 	}
+ 
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index 47d5ced51f2d..503fa224c6b6 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -1846,6 +1846,20 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec,
+ 	if (stat.nr_writeback && stat.nr_writeback == nr_taken)
+ 		set_bit(PGDAT_WRITEBACK, &pgdat->flags);
+ 
++	/*
++	 * If dirty pages are scanned that are not queued for IO, it
++	 * implies that flushers are not doing their job. This can
++	 * happen when memory pressure pushes dirty pages to the end of
++	 * the LRU before the dirty limits are breached and the dirty
++	 * data has expired. It can also happen when the proportion of
++	 * dirty pages grows not through writes but through memory
++	 * pressure reclaiming all the clean cache. And in some cases,
++	 * the flushers simply cannot keep up with the allocation
++	 * rate. Nudge the flusher threads in case they are asleep.
++	 */
++	if (stat.nr_unqueued_dirty == nr_taken)
++		wakeup_flusher_threads(WB_REASON_VMSCAN);
++
+ 	/*
+ 	 * Legacy memcg will stall in page writeback so avoid forcibly
+ 	 * stalling here.
+@@ -1858,22 +1872,9 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec,
+ 		if (stat.nr_dirty && stat.nr_dirty == stat.nr_congested)
+ 			set_bit(PGDAT_CONGESTED, &pgdat->flags);
+ 
+-		/*
+-		 * If dirty pages are scanned that are not queued for IO, it
+-		 * implies that flushers are not doing their job. This can
+-		 * happen when memory pressure pushes dirty pages to the end of
+-		 * the LRU before the dirty limits are breached and the dirty
+-		 * data has expired. It can also happen when the proportion of
+-		 * dirty pages grows not through writes but through memory
+-		 * pressure reclaiming all the clean cache. And in some cases,
+-		 * the flushers simply cannot keep up with the allocation
+-		 * rate. Nudge the flusher threads in case they are asleep, but
+-		 * also allow kswapd to start writing pages during reclaim.
+-		 */
+-		if (stat.nr_unqueued_dirty == nr_taken) {
+-			wakeup_flusher_threads(WB_REASON_VMSCAN);
++		/* Allow kswapd to start writing pages during reclaim. */
++		if (stat.nr_unqueued_dirty == nr_taken)
+ 			set_bit(PGDAT_DIRTY, &pgdat->flags);
+-		}
+ 
+ 		/*
+ 		 * If kswapd scans pages marked marked for immediate
+diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
+index 0333143a1fa7..1063a4377502 100644
+--- a/sound/drivers/aloop.c
++++ b/sound/drivers/aloop.c
+@@ -192,6 +192,11 @@ static inline void loopback_timer_stop(struct loopback_pcm *dpcm)
+ 	dpcm->timer.expires = 0;
+ }
+ 
++static inline void loopback_timer_stop_sync(struct loopback_pcm *dpcm)
++{
++	del_timer_sync(&dpcm->timer);
++}
++
+ #define CABLE_VALID_PLAYBACK	(1 << SNDRV_PCM_STREAM_PLAYBACK)
+ #define CABLE_VALID_CAPTURE	(1 << SNDRV_PCM_STREAM_CAPTURE)
+ #define CABLE_VALID_BOTH	(CABLE_VALID_PLAYBACK|CABLE_VALID_CAPTURE)
+@@ -326,6 +331,8 @@ static int loopback_prepare(struct snd_pcm_substream *substream)
+ 	struct loopback_cable *cable = dpcm->cable;
+ 	int bps, salign;
+ 
++	loopback_timer_stop_sync(dpcm);
++
+ 	salign = (snd_pcm_format_width(runtime->format) *
+ 						runtime->channels) / 8;
+ 	bps = salign * runtime->rate;
+@@ -659,7 +666,9 @@ static void free_cable(struct snd_pcm_substream *substream)
+ 		return;
+ 	if (cable->streams[!substream->stream]) {
+ 		/* other stream is still alive */
++		spin_lock_irq(&cable->lock);
+ 		cable->streams[substream->stream] = NULL;
++		spin_unlock_irq(&cable->lock);
+ 	} else {
+ 		/* free the cable */
+ 		loopback->cables[substream->number][dev] = NULL;
+@@ -698,7 +707,6 @@ static int loopback_open(struct snd_pcm_substream *substream)
+ 		loopback->cables[substream->number][dev] = cable;
+ 	}
+ 	dpcm->cable = cable;
+-	cable->streams[substream->stream] = dpcm;
+ 
+ 	snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS);
+ 
+@@ -730,6 +738,11 @@ static int loopback_open(struct snd_pcm_substream *substream)
+ 		runtime->hw = loopback_pcm_hardware;
+ 	else
+ 		runtime->hw = cable->hw;
++
++	spin_lock_irq(&cable->lock);
++	cable->streams[substream->stream] = dpcm;
++	spin_unlock_irq(&cable->lock);
++
+  unlock:
+ 	if (err < 0) {
+ 		free_cable(substream);
+@@ -744,7 +757,7 @@ static int loopback_close(struct snd_pcm_substream *substream)
+ 	struct loopback *loopback = substream->private_data;
+ 	struct loopback_pcm *dpcm = substream->runtime->private_data;
+ 
+-	loopback_timer_stop(dpcm);
++	loopback_timer_stop_sync(dpcm);
+ 	mutex_lock(&loopback->cable_lock);
+ 	free_cable(substream);
+ 	mutex_unlock(&loopback->cable_lock);
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index d5017adf9feb..c507c69029e3 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -375,6 +375,7 @@ enum {
+ 					((pci)->device == 0x160c))
+ 
+ #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)
++#define IS_CFL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa348)
+ 
+ static char *driver_short_names[] = {
+ 	[AZX_DRIVER_ICH] = "HDA Intel",
+@@ -1744,6 +1745,10 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
+ 	else
+ 		chip->bdl_pos_adj = bdl_pos_adj[dev];
+ 
++	/* Workaround for a communication error on CFL (bko#199007) */
++	if (IS_CFL(pci))
++		chip->polling_mode = 1;
++
+ 	err = azx_bus_init(chip, model[dev], &pci_hda_io_ops);
+ 	if (err < 0) {
+ 		kfree(hda);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 18bab5ffbe4a..206774703a33 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3130,6 +3130,8 @@ static void alc256_init(struct hda_codec *codec)
+ 
+ 	alc_update_coef_idx(codec, 0x46, 3 << 12, 0);
+ 	alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */
++	alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 1 << 15); /* Clear bit */
++	alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 0 << 15);
+ }
+ 
+ static void alc256_shutup(struct hda_codec *codec)
+@@ -3509,8 +3511,12 @@ static void alc269_fixup_mic_mute_hook(void *private_data, int enabled)
+ 	pinval = snd_hda_codec_get_pin_target(codec, spec->mute_led_nid);
+ 	pinval &= ~AC_PINCTL_VREFEN;
+ 	pinval |= enabled ? AC_PINCTL_VREF_HIZ : AC_PINCTL_VREF_80;
+-	if (spec->mute_led_nid)
++	if (spec->mute_led_nid) {
++		/* temporarily power up/down for setting VREF */
++		snd_hda_power_up_pm(codec);
+ 		snd_hda_set_pin_ctl_cache(codec, spec->mute_led_nid, pinval);
++		snd_hda_power_down_pm(codec);
++	}
+ }
+ 
+ /* Make sure the led works even in runtime suspend */
+@@ -5375,6 +5381,7 @@ enum {
+ 	ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
+ 	ALC298_FIXUP_TPT470_DOCK,
+ 	ALC255_FIXUP_DUMMY_LINEOUT_VERB,
++	ALC255_FIXUP_DELL_HEADSET_MIC,
+ };
+ 
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6235,6 +6242,13 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+ 	},
++	[ALC255_FIXUP_DELL_HEADSET_MIC] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{ 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
++			{ }
++		},
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6289,6 +6303,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ 	SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ 	SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
++	SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
++	SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
+ 	SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+@@ -7032,6 +7048,8 @@ static int patch_alc269(struct hda_codec *codec)
+ 		break;
+ 	case 0x10ec0257:
+ 		spec->codec_variant = ALC269_TYPE_ALC257;
++		spec->shutup = alc256_shutup;
++		spec->init_hook = alc256_init;
+ 		spec->gen.mixer_nid = 0;
+ 		break;
+ 	case 0x10ec0215:
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index 59af5a8419e2..00be6e8c35a2 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -967,7 +967,7 @@ static void print_metric_csv(void *ctx,
+ 	char buf[64], *vals, *ends;
+ 
+ 	if (unit == NULL || fmt == NULL) {
+-		fprintf(out, "%s%s%s%s", csv_sep, csv_sep, csv_sep, csv_sep);
++		fprintf(out, "%s%s", csv_sep, csv_sep);
+ 		return;
+ 	}
+ 	snprintf(buf, sizeof(buf), fmt, val);
+diff --git a/tools/testing/selftests/x86/ptrace_syscall.c b/tools/testing/selftests/x86/ptrace_syscall.c
+index 1ae1c5a7392e..6f22238f3217 100644
+--- a/tools/testing/selftests/x86/ptrace_syscall.c
++++ b/tools/testing/selftests/x86/ptrace_syscall.c
+@@ -183,8 +183,10 @@ static void test_ptrace_syscall_restart(void)
+ 		if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
+ 			err(1, "PTRACE_TRACEME");
+ 
++		pid_t pid = getpid(), tid = syscall(SYS_gettid);
++
+ 		printf("\tChild will make one syscall\n");
+-		raise(SIGSTOP);
++		syscall(SYS_tgkill, pid, tid, SIGSTOP);
+ 
+ 		syscall(SYS_gettid, 10, 11, 12, 13, 14, 15);
+ 		_exit(0);
+@@ -301,9 +303,11 @@ static void test_restart_under_ptrace(void)
+ 		if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
+ 			err(1, "PTRACE_TRACEME");
+ 
++		pid_t pid = getpid(), tid = syscall(SYS_gettid);
++
+ 		printf("\tChild will take a nap until signaled\n");
+ 		setsigign(SIGUSR1, SA_RESTART);
+-		raise(SIGSTOP);
++		syscall(SYS_tgkill, pid, tid, SIGSTOP);
+ 
+ 		syscall(SYS_pause, 0, 0, 0, 0, 0, 0);
+ 		_exit(0);