[gentoo-commits] proj/linux-patches:4.13 commit in: /

[Mike Pagano]

commit:     6dd097e14861a422f31161e9738304b9f8c46e42
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Sep 10 14:14:56 2017 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Sep 10 14:14:56 2017 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6dd097e1

Linux patch 4.13.1

 0000_README             |    5 +
 1000_linux-4.13.1.patch | 1735 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1740 insertions(+)

diff --git a/0000_README b/0000_README
index b6b8110..6a8a687 100644
--- a/0000_README
+++ b/0000_README
@@ -43,6 +43,10 @@ EXPERIMENTAL
 Individual Patch Descriptions:
 --------------------------------------------------------------------------
 
+Patch:  1000_linux-4.13.1.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.13.1
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
@@ -78,3 +82,4 @@ Desc:   Add Gentoo Linux support config settings and defaults.
 Patch:  5010_enable-additional-cpu-optimizations-for-gcc.patch
 From:   https://github.com/graysky2/kernel_gcc_patch/
 Desc:   Kernel patch enables gcc >= v4.9 optimizations for additional CPUs.
+

diff --git a/1000_linux-4.13.1.patch b/1000_linux-4.13.1.patch
new file mode 100644
index 0000000..6c6a08e
--- /dev/null
+++ b/1000_linux-4.13.1.patch
@@ -0,0 +1,1735 @@
+diff --git a/Makefile b/Makefile
+index ed65d7278bb3..41a976854cad 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 13
+-SUBLEVEL = 0
++SUBLEVEL = 1
+ EXTRAVERSION =
+ NAME = Fearless Coyote
+ 
+diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
+index 57057fb1cc07..65ab11d654e1 100644
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@ -505,7 +505,7 @@ static inline int mm_alloc_pgste(struct mm_struct *mm)
+  * In the case that a guest uses storage keys
+  * faults should no longer be backed by zero pages
+  */
+-#define mm_forbids_zeropage mm_use_skey
++#define mm_forbids_zeropage mm_has_pgste
+ static inline int mm_use_skey(struct mm_struct *mm)
+ {
+ #ifdef CONFIG_PGSTE
+diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
+index 4fb3d3cdb370..ff84fb214bf9 100644
+--- a/arch/s390/mm/gmap.c
++++ b/arch/s390/mm/gmap.c
+@@ -2120,6 +2120,37 @@ static inline void thp_split_mm(struct mm_struct *mm)
+ #endif
+ }
+ 
++/*
++ * Remove all empty zero pages from the mapping for lazy refaulting
++ * - This must be called after mm->context.has_pgste is set, to avoid
++ *   future creation of zero pages
++ * - This must be called after THP was enabled
++ */
++static int __zap_zero_pages(pmd_t *pmd, unsigned long start,
++			   unsigned long end, struct mm_walk *walk)
++{
++	unsigned long addr;
++
++	for (addr = start; addr != end; addr += PAGE_SIZE) {
++		pte_t *ptep;
++		spinlock_t *ptl;
++
++		ptep = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
++		if (is_zero_pfn(pte_pfn(*ptep)))
++			ptep_xchg_direct(walk->mm, addr, ptep, __pte(_PAGE_INVALID));
++		pte_unmap_unlock(ptep, ptl);
++	}
++	return 0;
++}
++
++static inline void zap_zero_pages(struct mm_struct *mm)
++{
++	struct mm_walk walk = { .pmd_entry = __zap_zero_pages };
++
++	walk.mm = mm;
++	walk_page_range(0, TASK_SIZE, &walk);
++}
++
+ /*
+  * switch on pgstes for its userspace process (for kvm)
+  */
+@@ -2137,6 +2168,7 @@ int s390_enable_sie(void)
+ 	mm->context.has_pgste = 1;
+ 	/* split thp mappings and disable thp for future mappings */
+ 	thp_split_mm(mm);
++	zap_zero_pages(mm);
+ 	up_write(&mm->mmap_sem);
+ 	return 0;
+ }
+@@ -2149,13 +2181,6 @@ EXPORT_SYMBOL_GPL(s390_enable_sie);
+ static int __s390_enable_skey(pte_t *pte, unsigned long addr,
+ 			      unsigned long next, struct mm_walk *walk)
+ {
+-	/*
+-	 * Remove all zero page mappings,
+-	 * after establishing a policy to forbid zero page mappings
+-	 * following faults for that page will get fresh anonymous pages
+-	 */
+-	if (is_zero_pfn(pte_pfn(*pte)))
+-		ptep_xchg_direct(walk->mm, addr, pte, __pte(_PAGE_INVALID));
+ 	/* Clear storage key */
+ 	ptep_zap_key(walk->mm, addr, pte);
+ 	return 0;
+diff --git a/drivers/android/Kconfig b/drivers/android/Kconfig
+index 832e885349b1..4d4cdc1a6e25 100644
+--- a/drivers/android/Kconfig
++++ b/drivers/android/Kconfig
+@@ -22,7 +22,7 @@ config ANDROID_BINDER_IPC
+ config ANDROID_BINDER_DEVICES
+ 	string "Android Binder devices"
+ 	depends on ANDROID_BINDER_IPC
+-	default "binder,hwbinder"
++	default "binder,hwbinder,vndbinder"
+ 	---help---
+ 	  Default value for the binder.devices parameter.
+ 
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 831cdd7d197d..3db96b79d122 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -4215,7 +4215,7 @@ static int __init init_binder_device(const char *name)
+ static int __init binder_init(void)
+ {
+ 	int ret;
+-	char *device_name, *device_names;
++	char *device_name, *device_names, *device_tmp;
+ 	struct binder_device *device;
+ 	struct hlist_node *tmp;
+ 
+@@ -4263,7 +4263,8 @@ static int __init binder_init(void)
+ 	}
+ 	strcpy(device_names, binder_devices_param);
+ 
+-	while ((device_name = strsep(&device_names, ","))) {
++	device_tmp = device_names;
++	while ((device_name = strsep(&device_tmp, ","))) {
+ 		ret = init_binder_device(device_name);
+ 		if (ret)
+ 			goto err_init_binder_device_failed;
+@@ -4277,6 +4278,9 @@ static int __init binder_init(void)
+ 		hlist_del(&device->hlist);
+ 		kfree(device);
+ 	}
++
++	kfree(device_names);
++
+ err_alloc_device_names_failed:
+ 	debugfs_remove_recursive(binder_debugfs_dir_entry_root);
+ 
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 5a5fd0b404eb..cb9b0e9090e3 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -1469,7 +1469,14 @@ static void ahci_remap_check(struct pci_dev *pdev, int bar,
+ 		return;
+ 
+ 	dev_warn(&pdev->dev, "Found %d remapped NVMe devices.\n", count);
+-	dev_warn(&pdev->dev, "Switch your BIOS from RAID to AHCI mode to use them.\n");
++	dev_warn(&pdev->dev,
++		 "Switch your BIOS from RAID to AHCI mode to use them.\n");
++
++	/*
++	 * Don't rely on the msi-x capability in the remap case,
++	 * share the legacy interrupt across ahci and remapped devices.
++	 */
++	hpriv->flags |= AHCI_HFLAG_NO_MSI;
+ }
+ 
+ static int ahci_get_irq_vector(struct ata_host *host, int port)
+diff --git a/drivers/ata/pata_amd.c b/drivers/ata/pata_amd.c
+index 8d4d959a821c..8706533db57b 100644
+--- a/drivers/ata/pata_amd.c
++++ b/drivers/ata/pata_amd.c
+@@ -616,6 +616,7 @@ static const struct pci_device_id amd[] = {
+ 	{ PCI_VDEVICE(NVIDIA,	PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_IDE),	8 },
+ 	{ PCI_VDEVICE(NVIDIA,	PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE),	8 },
+ 	{ PCI_VDEVICE(AMD,	PCI_DEVICE_ID_AMD_CS5536_IDE),		9 },
++	{ PCI_VDEVICE(AMD,	PCI_DEVICE_ID_AMD_CS5536_DEV_IDE),	9 },
+ 
+ 	{ },
+ };
+diff --git a/drivers/ata/pata_cs5536.c b/drivers/ata/pata_cs5536.c
+index 6c15a554efbe..dc1255294628 100644
+--- a/drivers/ata/pata_cs5536.c
++++ b/drivers/ata/pata_cs5536.c
+@@ -289,6 +289,7 @@ static int cs5536_init_one(struct pci_dev *dev, const struct pci_device_id *id)
+ 
+ static const struct pci_device_id cs5536[] = {
+ 	{ PCI_VDEVICE(AMD,	PCI_DEVICE_ID_AMD_CS5536_IDE), },
++	{ PCI_VDEVICE(AMD,	PCI_DEVICE_ID_AMD_CS5536_DEV_IDE), },
+ 	{ },
+ };
+ 
+diff --git a/drivers/base/bus.c b/drivers/base/bus.c
+index e162c9a789ba..22a64fd3309b 100644
+--- a/drivers/base/bus.c
++++ b/drivers/base/bus.c
+@@ -698,7 +698,7 @@ int bus_add_driver(struct device_driver *drv)
+ 
+ out_unregister:
+ 	kobject_put(&priv->kobj);
+-	kfree(drv->p);
++	/* drv->p is freed in driver_release()  */
+ 	drv->p = NULL;
+ out_put_bus:
+ 	bus_put(bus);
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index fa24d693af24..e331e212f5fc 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -357,6 +357,7 @@ static const struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
+ 	{ USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
+ 	{ USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
++	{ USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
+ 
+ 	/* Additional Realtek 8821AE Bluetooth devices */
+ 	{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index 0488b7f81dcf..54f3b375a453 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -81,40 +81,6 @@
+ #define debug(format, arg...)
+ #endif
+ 
+-#ifdef DEBUG
+-#include <linux/highmem.h>
+-
+-static void dbg_dump_sg(const char *level, const char *prefix_str,
+-			int prefix_type, int rowsize, int groupsize,
+-			struct scatterlist *sg, size_t tlen, bool ascii)
+-{
+-	struct scatterlist *it;
+-	void *it_page;
+-	size_t len;
+-	void *buf;
+-
+-	for (it = sg; it != NULL && tlen > 0 ; it = sg_next(sg)) {
+-		/*
+-		 * make sure the scatterlist's page
+-		 * has a valid virtual memory mapping
+-		 */
+-		it_page = kmap_atomic(sg_page(it));
+-		if (unlikely(!it_page)) {
+-			printk(KERN_ERR "dbg_dump_sg: kmap failed\n");
+-			return;
+-		}
+-
+-		buf = it_page + it->offset;
+-		len = min_t(size_t, tlen, it->length);
+-		print_hex_dump(level, prefix_str, prefix_type, rowsize,
+-			       groupsize, buf, len, ascii);
+-		tlen -= len;
+-
+-		kunmap_atomic(it_page);
+-	}
+-}
+-#endif
+-
+ static struct list_head alg_list;
+ 
+ struct caam_alg_entry {
+@@ -898,10 +864,10 @@ static void ablkcipher_encrypt_done(struct device *jrdev, u32 *desc, u32 err,
+ 	print_hex_dump(KERN_ERR, "dstiv  @"__stringify(__LINE__)": ",
+ 		       DUMP_PREFIX_ADDRESS, 16, 4, req->info,
+ 		       edesc->src_nents > 1 ? 100 : ivsize, 1);
+-	dbg_dump_sg(KERN_ERR, "dst    @"__stringify(__LINE__)": ",
+-		    DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
+-		    edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
+ #endif
++	caam_dump_sg(KERN_ERR, "dst    @" __stringify(__LINE__)": ",
++		     DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
++		     edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
+ 
+ 	ablkcipher_unmap(jrdev, edesc, req);
+ 
+@@ -937,10 +903,10 @@ static void ablkcipher_decrypt_done(struct device *jrdev, u32 *desc, u32 err,
+ 	print_hex_dump(KERN_ERR, "dstiv  @"__stringify(__LINE__)": ",
+ 		       DUMP_PREFIX_ADDRESS, 16, 4, req->info,
+ 		       ivsize, 1);
+-	dbg_dump_sg(KERN_ERR, "dst    @"__stringify(__LINE__)": ",
+-		    DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
+-		    edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
+ #endif
++	caam_dump_sg(KERN_ERR, "dst    @" __stringify(__LINE__)": ",
++		     DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
++		     edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
+ 
+ 	ablkcipher_unmap(jrdev, edesc, req);
+ 
+@@ -1107,10 +1073,10 @@ static void init_ablkcipher_job(u32 *sh_desc, dma_addr_t ptr,
+ 		       ivsize, 1);
+ 	pr_err("asked=%d, nbytes%d\n",
+ 	       (int)edesc->src_nents > 1 ? 100 : req->nbytes, req->nbytes);
+-	dbg_dump_sg(KERN_ERR, "src    @"__stringify(__LINE__)": ",
+-		    DUMP_PREFIX_ADDRESS, 16, 4, req->src,
+-		    edesc->src_nents > 1 ? 100 : req->nbytes, 1);
+ #endif
++	caam_dump_sg(KERN_ERR, "src    @" __stringify(__LINE__)": ",
++		     DUMP_PREFIX_ADDRESS, 16, 4, req->src,
++		     edesc->src_nents > 1 ? 100 : req->nbytes, 1);
+ 
+ 	len = desc_len(sh_desc);
+ 	init_job_desc_shared(desc, ptr, len, HDR_SHARE_DEFER | HDR_REVERSE);
+@@ -1164,10 +1130,10 @@ static void init_ablkcipher_giv_job(u32 *sh_desc, dma_addr_t ptr,
+ 	print_hex_dump(KERN_ERR, "presciv@" __stringify(__LINE__) ": ",
+ 		       DUMP_PREFIX_ADDRESS, 16, 4, req->info,
+ 		       ivsize, 1);
+-	dbg_dump_sg(KERN_ERR, "src    @" __stringify(__LINE__) ": ",
+-		    DUMP_PREFIX_ADDRESS, 16, 4, req->src,
+-		    edesc->src_nents > 1 ? 100 : req->nbytes, 1);
+ #endif
++	caam_dump_sg(KERN_ERR, "src    @" __stringify(__LINE__) ": ",
++		     DUMP_PREFIX_ADDRESS, 16, 4, req->src,
++		     edesc->src_nents > 1 ? 100 : req->nbytes, 1);
+ 
+ 	len = desc_len(sh_desc);
+ 	init_job_desc_shared(desc, ptr, len, HDR_SHARE_DEFER | HDR_REVERSE);
+@@ -1449,11 +1415,9 @@ static int aead_decrypt(struct aead_request *req)
+ 	u32 *desc;
+ 	int ret = 0;
+ 
+-#ifdef DEBUG
+-	dbg_dump_sg(KERN_ERR, "dec src@"__stringify(__LINE__)": ",
+-		    DUMP_PREFIX_ADDRESS, 16, 4, req->src,
+-		    req->assoclen + req->cryptlen, 1);
+-#endif
++	caam_dump_sg(KERN_ERR, "dec src@" __stringify(__LINE__)": ",
++		     DUMP_PREFIX_ADDRESS, 16, 4, req->src,
++		     req->assoclen + req->cryptlen, 1);
+ 
+ 	/* allocate extended descriptor */
+ 	edesc = aead_edesc_alloc(req, AUTHENC_DESC_JOB_IO_LEN,
+diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c
+index 78c4c0485c58..3425f2d9a2a1 100644
+--- a/drivers/crypto/caam/caamalg_qi.c
++++ b/drivers/crypto/caam/caamalg_qi.c
+@@ -791,9 +791,9 @@ static void ablkcipher_done(struct caam_drv_req *drv_req, u32 status)
+ 	print_hex_dump(KERN_ERR, "dstiv  @" __stringify(__LINE__)": ",
+ 		       DUMP_PREFIX_ADDRESS, 16, 4, req->info,
+ 		       edesc->src_nents > 1 ? 100 : ivsize, 1);
+-	dbg_dump_sg(KERN_ERR, "dst    @" __stringify(__LINE__)": ",
+-		    DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
+-		    edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
++	caam_dump_sg(KERN_ERR, "dst    @" __stringify(__LINE__)": ",
++		     DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
++		     edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
+ #endif
+ 
+ 	ablkcipher_unmap(qidev, edesc, req);
+diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
+index 6f44ccb55c63..3d639f3b45aa 100644
+--- a/drivers/crypto/caam/error.c
++++ b/drivers/crypto/caam/error.c
+@@ -9,6 +9,46 @@
+ #include "desc.h"
+ #include "error.h"
+ 
++#ifdef DEBUG
++#include <linux/highmem.h>
++
++void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
++		  int rowsize, int groupsize, struct scatterlist *sg,
++		  size_t tlen, bool ascii)
++{
++	struct scatterlist *it;
++	void *it_page;
++	size_t len;
++	void *buf;
++
++	for (it = sg; it && tlen > 0 ; it = sg_next(sg)) {
++		/*
++		 * make sure the scatterlist's page
++		 * has a valid virtual memory mapping
++		 */
++		it_page = kmap_atomic(sg_page(it));
++		if (unlikely(!it_page)) {
++			pr_err("caam_dump_sg: kmap failed\n");
++			return;
++		}
++
++		buf = it_page + it->offset;
++		len = min_t(size_t, tlen, it->length);
++		print_hex_dump(level, prefix_str, prefix_type, rowsize,
++			       groupsize, buf, len, ascii);
++		tlen -= len;
++
++		kunmap_atomic(it_page);
++	}
++}
++#else
++void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
++		  int rowsize, int groupsize, struct scatterlist *sg,
++		  size_t tlen, bool ascii)
++{}
++#endif /* DEBUG */
++EXPORT_SYMBOL(caam_dump_sg);
++
+ static const struct {
+ 	u8 value;
+ 	const char *error_text;
+diff --git a/drivers/crypto/caam/error.h b/drivers/crypto/caam/error.h
+index b6350b0d9153..250e1a21c473 100644
+--- a/drivers/crypto/caam/error.h
++++ b/drivers/crypto/caam/error.h
+@@ -8,4 +8,8 @@
+ #define CAAM_ERROR_H
+ #define CAAM_ERROR_STR_MAX 302
+ void caam_jr_strstatus(struct device *jrdev, u32 status);
++
++void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
++		  int rowsize, int groupsize, struct scatterlist *sg,
++		  size_t tlen, bool ascii);
+ #endif /* CAAM_ERROR_H */
+diff --git a/drivers/crypto/caam/qi.c b/drivers/crypto/caam/qi.c
+index 1990ed460c46..53aed5816416 100644
+--- a/drivers/crypto/caam/qi.c
++++ b/drivers/crypto/caam/qi.c
+@@ -55,6 +55,7 @@ struct caam_qi_pcpu_priv {
+ } ____cacheline_aligned;
+ 
+ static DEFINE_PER_CPU(struct caam_qi_pcpu_priv, pcpu_qipriv);
++static DEFINE_PER_CPU(int, last_cpu);
+ 
+ /*
+  * caam_qi_priv - CAAM QI backend private params
+@@ -392,7 +393,6 @@ struct caam_drv_ctx *caam_drv_ctx_init(struct device *qidev,
+ 	dma_addr_t hwdesc;
+ 	struct caam_drv_ctx *drv_ctx;
+ 	const cpumask_t *cpus = qman_affine_cpus();
+-	static DEFINE_PER_CPU(int, last_cpu);
+ 
+ 	num_words = desc_len(sh_desc);
+ 	if (num_words > MAX_SDLEN) {
+diff --git a/drivers/fpga/altera-hps2fpga.c b/drivers/fpga/altera-hps2fpga.c
+index 3066b805f2d0..08c0ecb7d109 100644
+--- a/drivers/fpga/altera-hps2fpga.c
++++ b/drivers/fpga/altera-hps2fpga.c
+@@ -66,7 +66,7 @@ static int alt_hps2fpga_enable_show(struct fpga_bridge *bridge)
+ 
+ /* The L3 REMAP register is write only, so keep a cached value. */
+ static unsigned int l3_remap_shadow;
+-static spinlock_t l3_remap_lock;
++static DEFINE_SPINLOCK(l3_remap_lock);
+ 
+ static int _alt_hps2fpga_enable_set(struct altera_hps2fpga_data *priv,
+ 				    bool enable)
+@@ -171,8 +171,6 @@ static int alt_fpga_bridge_probe(struct platform_device *pdev)
+ 		return -EBUSY;
+ 	}
+ 
+-	spin_lock_init(&l3_remap_lock);
+-
+ 	if (!of_property_read_u32(dev->of_node, "bridge-enable", &enable)) {
+ 		if (enable > 1) {
+ 			dev_warn(dev, "invalid bridge-enable %u > 1\n", enable);
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index ae5f06895562..da2745b3d0a7 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2540,8 +2540,8 @@ int drm_dp_atomic_find_vcpi_slots(struct drm_atomic_state *state,
+ 	int req_slots;
+ 
+ 	topology_state = drm_atomic_get_mst_topology_state(state, mgr);
+-	if (topology_state == NULL)
+-		return -ENOMEM;
++	if (IS_ERR(topology_state))
++		return PTR_ERR(topology_state);
+ 
+ 	port = drm_dp_get_validated_port_ref(mgr, port);
+ 	if (port == NULL)
+@@ -2580,8 +2580,8 @@ int drm_dp_atomic_release_vcpi_slots(struct drm_atomic_state *state,
+ 	struct drm_dp_mst_topology_state *topology_state;
+ 
+ 	topology_state = drm_atomic_get_mst_topology_state(state, mgr);
+-	if (topology_state == NULL)
+-		return -ENOMEM;
++	if (IS_ERR(topology_state))
++		return PTR_ERR(topology_state);
+ 
+ 	/* We cannot rely on port->vcpi.num_slots to update
+ 	 * topology_state->avail_slots as the port may not exist if the parent
+diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
+index 2bc0dc985214..3d35ea3e95db 100644
+--- a/drivers/gpu/drm/nouveau/nv50_display.c
++++ b/drivers/gpu/drm/nouveau/nv50_display.c
+@@ -4134,7 +4134,7 @@ nv50_disp_atomic_commit(struct drm_device *dev,
+ 	if (!nonblock) {
+ 		ret = drm_atomic_helper_wait_for_fences(dev, state, true);
+ 		if (ret)
+-			goto done;
++			goto err_cleanup;
+ 	}
+ 
+ 	for_each_plane_in_state(state, plane, plane_state, i) {
+@@ -4162,7 +4162,7 @@ nv50_disp_atomic_commit(struct drm_device *dev,
+ 		if (crtc->state->enable) {
+ 			if (!drm->have_disp_power_ref) {
+ 				drm->have_disp_power_ref = true;
+-				return ret;
++				return 0;
+ 			}
+ 			active = true;
+ 			break;
+@@ -4174,6 +4174,9 @@ nv50_disp_atomic_commit(struct drm_device *dev,
+ 		drm->have_disp_power_ref = false;
+ 	}
+ 
++err_cleanup:
++	if (ret)
++		drm_atomic_helper_cleanup_planes(dev, state);
+ done:
+ 	pm_runtime_put_autosuspend(dev->dev);
+ 	return ret;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
+index eb9b278198b2..a4cb82495cee 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
+@@ -192,6 +192,10 @@ nvkm_pci_new_(const struct nvkm_pci_func *func, struct nvkm_device *device,
+ 		}
+ 	}
+ 
++#ifdef __BIG_ENDIAN
++	pci->msi = false;
++#endif
++
+ 	pci->msi = nvkm_boolopt(device->cfgopt, "NvMSI", pci->msi);
+ 	if (pci->msi && func->msi_rearm) {
+ 		pci->msi = pci_enable_msi(pci->pdev) == 0;
+diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+index eeddc1e48409..871599826773 100644
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+@@ -615,7 +615,7 @@ static void ttm_page_pool_fill_locked(struct ttm_page_pool *pool,
+ 		} else {
+ 			pr_err("Failed to fill pool (%p)\n", pool);
+ 			/* If we have any pages left put them to the pool. */
+-			list_for_each_entry(p, &pool->list, lru) {
++			list_for_each_entry(p, &new_pages, lru) {
+ 				++cpages;
+ 			}
+ 			list_splice(&new_pages, &pool->list);
+diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
+index 18f401b442c2..c938af8c40cf 100644
+--- a/drivers/gpu/drm/vgem/vgem_drv.c
++++ b/drivers/gpu/drm/vgem/vgem_drv.c
+@@ -52,6 +52,7 @@ static void vgem_gem_free_object(struct drm_gem_object *obj)
+ 	struct drm_vgem_gem_object *vgem_obj = to_vgem_bo(obj);
+ 
+ 	kvfree(vgem_obj->pages);
++	mutex_destroy(&vgem_obj->pages_lock);
+ 
+ 	if (obj->import_attach)
+ 		drm_prime_gem_destroy(obj, vgem_obj->table);
+@@ -76,11 +77,15 @@ static int vgem_gem_fault(struct vm_fault *vmf)
+ 	if (page_offset > num_pages)
+ 		return VM_FAULT_SIGBUS;
+ 
++	ret = -ENOENT;
++	mutex_lock(&obj->pages_lock);
+ 	if (obj->pages) {
+ 		get_page(obj->pages[page_offset]);
+ 		vmf->page = obj->pages[page_offset];
+ 		ret = 0;
+-	} else {
++	}
++	mutex_unlock(&obj->pages_lock);
++	if (ret) {
+ 		struct page *page;
+ 
+ 		page = shmem_read_mapping_page(
+@@ -161,6 +166,8 @@ static struct drm_vgem_gem_object *__vgem_gem_create(struct drm_device *dev,
+ 		return ERR_PTR(ret);
+ 	}
+ 
++	mutex_init(&obj->pages_lock);
++
+ 	return obj;
+ }
+ 
+@@ -274,37 +281,66 @@ static const struct file_operations vgem_driver_fops = {
+ 	.release	= drm_release,
+ };
+ 
++static struct page **vgem_pin_pages(struct drm_vgem_gem_object *bo)
++{
++	mutex_lock(&bo->pages_lock);
++	if (bo->pages_pin_count++ == 0) {
++		struct page **pages;
++
++		pages = drm_gem_get_pages(&bo->base);
++		if (IS_ERR(pages)) {
++			bo->pages_pin_count--;
++			mutex_unlock(&bo->pages_lock);
++			return pages;
++		}
++
++		bo->pages = pages;
++	}
++	mutex_unlock(&bo->pages_lock);
++
++	return bo->pages;
++}
++
++static void vgem_unpin_pages(struct drm_vgem_gem_object *bo)
++{
++	mutex_lock(&bo->pages_lock);
++	if (--bo->pages_pin_count == 0) {
++		drm_gem_put_pages(&bo->base, bo->pages, true, true);
++		bo->pages = NULL;
++	}
++	mutex_unlock(&bo->pages_lock);
++}
++
+ static int vgem_prime_pin(struct drm_gem_object *obj)
+ {
++	struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
+ 	long n_pages = obj->size >> PAGE_SHIFT;
+ 	struct page **pages;
+ 
+-	/* Flush the object from the CPU cache so that importers can rely
+-	 * on coherent indirect access via the exported dma-address.
+-	 */
+-	pages = drm_gem_get_pages(obj);
++	pages = vgem_pin_pages(bo);
+ 	if (IS_ERR(pages))
+ 		return PTR_ERR(pages);
+ 
++	/* Flush the object from the CPU cache so that importers can rely
++	 * on coherent indirect access via the exported dma-address.
++	 */
+ 	drm_clflush_pages(pages, n_pages);
+-	drm_gem_put_pages(obj, pages, true, false);
+ 
+ 	return 0;
+ }
+ 
+-static struct sg_table *vgem_prime_get_sg_table(struct drm_gem_object *obj)
++static void vgem_prime_unpin(struct drm_gem_object *obj)
+ {
+-	struct sg_table *st;
+-	struct page **pages;
++	struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
+ 
+-	pages = drm_gem_get_pages(obj);
+-	if (IS_ERR(pages))
+-		return ERR_CAST(pages);
++	vgem_unpin_pages(bo);
++}
+ 
+-	st = drm_prime_pages_to_sg(pages, obj->size >> PAGE_SHIFT);
+-	drm_gem_put_pages(obj, pages, false, false);
++static struct sg_table *vgem_prime_get_sg_table(struct drm_gem_object *obj)
++{
++	struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
+ 
+-	return st;
++	return drm_prime_pages_to_sg(bo->pages, bo->base.size >> PAGE_SHIFT);
+ }
+ 
+ static struct drm_gem_object* vgem_prime_import(struct drm_device *dev,
+@@ -333,6 +369,8 @@ static struct drm_gem_object *vgem_prime_import_sg_table(struct drm_device *dev,
+ 		__vgem_gem_destroy(obj);
+ 		return ERR_PTR(-ENOMEM);
+ 	}
++
++	obj->pages_pin_count++; /* perma-pinned */
+ 	drm_prime_sg_to_page_addr_arrays(obj->table, obj->pages, NULL,
+ 					npages);
+ 	return &obj->base;
+@@ -340,23 +378,23 @@ static struct drm_gem_object *vgem_prime_import_sg_table(struct drm_device *dev,
+ 
+ static void *vgem_prime_vmap(struct drm_gem_object *obj)
+ {
++	struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
+ 	long n_pages = obj->size >> PAGE_SHIFT;
+ 	struct page **pages;
+-	void *addr;
+ 
+-	pages = drm_gem_get_pages(obj);
++	pages = vgem_pin_pages(bo);
+ 	if (IS_ERR(pages))
+ 		return NULL;
+ 
+-	addr = vmap(pages, n_pages, 0, pgprot_writecombine(PAGE_KERNEL));
+-	drm_gem_put_pages(obj, pages, false, false);
+-
+-	return addr;
++	return vmap(pages, n_pages, 0, pgprot_writecombine(PAGE_KERNEL));
+ }
+ 
+ static void vgem_prime_vunmap(struct drm_gem_object *obj, void *vaddr)
+ {
++	struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
++
+ 	vunmap(vaddr);
++	vgem_unpin_pages(bo);
+ }
+ 
+ static int vgem_prime_mmap(struct drm_gem_object *obj,
+@@ -409,6 +447,7 @@ static struct drm_driver vgem_driver = {
+ 	.prime_handle_to_fd = drm_gem_prime_handle_to_fd,
+ 	.prime_fd_to_handle = drm_gem_prime_fd_to_handle,
+ 	.gem_prime_pin = vgem_prime_pin,
++	.gem_prime_unpin = vgem_prime_unpin,
+ 	.gem_prime_import = vgem_prime_import,
+ 	.gem_prime_export = drm_gem_prime_export,
+ 	.gem_prime_import_sg_table = vgem_prime_import_sg_table,
+diff --git a/drivers/gpu/drm/vgem/vgem_drv.h b/drivers/gpu/drm/vgem/vgem_drv.h
+index 1aae01419112..5c8f6d619ff3 100644
+--- a/drivers/gpu/drm/vgem/vgem_drv.h
++++ b/drivers/gpu/drm/vgem/vgem_drv.h
+@@ -43,7 +43,11 @@ struct vgem_file {
+ #define to_vgem_bo(x) container_of(x, struct drm_vgem_gem_object, base)
+ struct drm_vgem_gem_object {
+ 	struct drm_gem_object base;
++
+ 	struct page **pages;
++	unsigned int pages_pin_count;
++	struct mutex pages_lock;
++
+ 	struct sg_table *table;
+ };
+ 
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 9f940293ede4..bb17d7bbefd3 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -1846,7 +1846,13 @@ static void wacom_wac_pad_usage_mapping(struct hid_device *hdev,
+ 		features->device_type |= WACOM_DEVICETYPE_PAD;
+ 		break;
+ 	case WACOM_HID_WD_TOUCHRINGSTATUS:
+-		wacom_map_usage(input, usage, field, EV_ABS, ABS_WHEEL, 0);
++		/*
++		 * Only set up type/code association. Completely mapping
++		 * this usage may overwrite the axis resolution and range.
++		 */
++		usage->type = EV_ABS;
++		usage->code = ABS_WHEEL;
++		set_bit(EV_ABS, input->evbit);
+ 		features->device_type |= WACOM_DEVICETYPE_PAD;
+ 		break;
+ 	case WACOM_HID_WD_BUTTONCONFIG:
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index 590cf90dd21a..da40df2ff27d 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -95,6 +95,16 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ 		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e),
+ 		.driver_data = (kernel_ulong_t)0,
+ 	},
++	{
++		/* Cannon Lake H */
++		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa326),
++		.driver_data = (kernel_ulong_t)0,
++	},
++	{
++		/* Cannon Lake LP */
++		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9da6),
++		.driver_data = (kernel_ulong_t)0,
++	},
+ 	{ 0 },
+ };
+ 
+diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
+index 884b8e461b17..9c501e5042fb 100644
+--- a/drivers/iio/adc/ti-ads1015.c
++++ b/drivers/iio/adc/ti-ads1015.c
+@@ -81,18 +81,12 @@ static const unsigned int ads1115_data_rate[] = {
+ 	8, 16, 32, 64, 128, 250, 475, 860
+ };
+ 
+-static const struct {
+-	int scale;
+-	int uscale;
+-} ads1015_scale[] = {
+-	{3, 0},
+-	{2, 0},
+-	{1, 0},
+-	{0, 500000},
+-	{0, 250000},
+-	{0, 125000},
+-	{0, 125000},
+-	{0, 125000},
++/*
++ * Translation from PGA bits to full-scale positive and negative input voltage
++ * range in mV
++ */
++static int ads1015_fullscale_range[] = {
++	6144, 4096, 2048, 1024, 512, 256, 256, 256
+ };
+ 
+ #define ADS1015_V_CHAN(_chan, _addr) {				\
+@@ -183,6 +177,12 @@ struct ads1015_data {
+ 	struct ads1015_channel_data channel_data[ADS1015_CHANNELS];
+ 
+ 	unsigned int *data_rate;
++	/*
++	 * Set to true when the ADC is switched to the continuous-conversion
++	 * mode and exits from a power-down state.  This flag is used to avoid
++	 * getting the stale result from the conversion register.
++	 */
++	bool conv_invalid;
+ };
+ 
+ static bool ads1015_is_writeable_reg(struct device *dev, unsigned int reg)
+@@ -235,33 +235,43 @@ static int ads1015_set_power_state(struct ads1015_data *data, bool on)
+ 		ret = pm_runtime_put_autosuspend(dev);
+ 	}
+ 
+-	return ret;
++	return ret < 0 ? ret : 0;
+ }
+ 
+ static
+ int ads1015_get_adc_result(struct ads1015_data *data, int chan, int *val)
+ {
+ 	int ret, pga, dr, conv_time;
+-	bool change;
++	unsigned int old, mask, cfg;
+ 
+ 	if (chan < 0 || chan >= ADS1015_CHANNELS)
+ 		return -EINVAL;
+ 
++	ret = regmap_read(data->regmap, ADS1015_CFG_REG, &old);
++	if (ret)
++		return ret;
++
+ 	pga = data->channel_data[chan].pga;
+ 	dr = data->channel_data[chan].data_rate;
++	mask = ADS1015_CFG_MUX_MASK | ADS1015_CFG_PGA_MASK |
++		ADS1015_CFG_DR_MASK;
++	cfg = chan << ADS1015_CFG_MUX_SHIFT | pga << ADS1015_CFG_PGA_SHIFT |
++		dr << ADS1015_CFG_DR_SHIFT;
+ 
+-	ret = regmap_update_bits_check(data->regmap, ADS1015_CFG_REG,
+-				       ADS1015_CFG_MUX_MASK |
+-				       ADS1015_CFG_PGA_MASK,
+-				       chan << ADS1015_CFG_MUX_SHIFT |
+-				       pga << ADS1015_CFG_PGA_SHIFT,
+-				       &change);
+-	if (ret < 0)
++	cfg = (old & ~mask) | (cfg & mask);
++
++	ret = regmap_write(data->regmap, ADS1015_CFG_REG, cfg);
++	if (ret)
+ 		return ret;
+ 
+-	if (change) {
+-		conv_time = DIV_ROUND_UP(USEC_PER_SEC, data->data_rate[dr]);
++	if (old != cfg || data->conv_invalid) {
++		int dr_old = (old & ADS1015_CFG_DR_MASK) >>
++				ADS1015_CFG_DR_SHIFT;
++
++		conv_time = DIV_ROUND_UP(USEC_PER_SEC, data->data_rate[dr_old]);
++		conv_time += DIV_ROUND_UP(USEC_PER_SEC, data->data_rate[dr]);
+ 		usleep_range(conv_time, conv_time + 1);
++		data->conv_invalid = false;
+ 	}
+ 
+ 	return regmap_read(data->regmap, ADS1015_CONV_REG, val);
+@@ -298,17 +308,20 @@ static irqreturn_t ads1015_trigger_handler(int irq, void *p)
+ 	return IRQ_HANDLED;
+ }
+ 
+-static int ads1015_set_scale(struct ads1015_data *data, int chan,
++static int ads1015_set_scale(struct ads1015_data *data,
++			     struct iio_chan_spec const *chan,
+ 			     int scale, int uscale)
+ {
+ 	int i, ret, rindex = -1;
++	int fullscale = div_s64((scale * 1000000LL + uscale) <<
++				(chan->scan_type.realbits - 1), 1000000);
+ 
+-	for (i = 0; i < ARRAY_SIZE(ads1015_scale); i++)
+-		if (ads1015_scale[i].scale == scale &&
+-		    ads1015_scale[i].uscale == uscale) {
++	for (i = 0; i < ARRAY_SIZE(ads1015_fullscale_range); i++) {
++		if (ads1015_fullscale_range[i] == fullscale) {
+ 			rindex = i;
+ 			break;
+ 		}
++	}
+ 	if (rindex < 0)
+ 		return -EINVAL;
+ 
+@@ -318,32 +331,23 @@ static int ads1015_set_scale(struct ads1015_data *data, int chan,
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	data->channel_data[chan].pga = rindex;
++	data->channel_data[chan->address].pga = rindex;
+ 
+ 	return 0;
+ }
+ 
+ static int ads1015_set_data_rate(struct ads1015_data *data, int chan, int rate)
+ {
+-	int i, ret, rindex = -1;
++	int i;
+ 
+-	for (i = 0; i < ARRAY_SIZE(ads1015_data_rate); i++)
++	for (i = 0; i < ARRAY_SIZE(ads1015_data_rate); i++) {
+ 		if (data->data_rate[i] == rate) {
+-			rindex = i;
+-			break;
++			data->channel_data[chan].data_rate = i;
++			return 0;
+ 		}
+-	if (rindex < 0)
+-		return -EINVAL;
+-
+-	ret = regmap_update_bits(data->regmap, ADS1015_CFG_REG,
+-				 ADS1015_CFG_DR_MASK,
+-				 rindex << ADS1015_CFG_DR_SHIFT);
+-	if (ret < 0)
+-		return ret;
+-
+-	data->channel_data[chan].data_rate = rindex;
++	}
+ 
+-	return 0;
++	return -EINVAL;
+ }
+ 
+ static int ads1015_read_raw(struct iio_dev *indio_dev,
+@@ -385,9 +389,9 @@ static int ads1015_read_raw(struct iio_dev *indio_dev,
+ 	}
+ 	case IIO_CHAN_INFO_SCALE:
+ 		idx = data->channel_data[chan->address].pga;
+-		*val = ads1015_scale[idx].scale;
+-		*val2 = ads1015_scale[idx].uscale;
+-		ret = IIO_VAL_INT_PLUS_MICRO;
++		*val = ads1015_fullscale_range[idx];
++		*val2 = chan->scan_type.realbits - 1;
++		ret = IIO_VAL_FRACTIONAL_LOG2;
+ 		break;
+ 	case IIO_CHAN_INFO_SAMP_FREQ:
+ 		idx = data->channel_data[chan->address].data_rate;
+@@ -414,7 +418,7 @@ static int ads1015_write_raw(struct iio_dev *indio_dev,
+ 	mutex_lock(&data->lock);
+ 	switch (mask) {
+ 	case IIO_CHAN_INFO_SCALE:
+-		ret = ads1015_set_scale(data, chan->address, val, val2);
++		ret = ads1015_set_scale(data, chan, val, val2);
+ 		break;
+ 	case IIO_CHAN_INFO_SAMP_FREQ:
+ 		ret = ads1015_set_data_rate(data, chan->address, val);
+@@ -446,7 +450,10 @@ static const struct iio_buffer_setup_ops ads1015_buffer_setup_ops = {
+ 	.validate_scan_mask = &iio_validate_scan_mask_onehot,
+ };
+ 
+-static IIO_CONST_ATTR(scale_available, "3 2 1 0.5 0.25 0.125");
++static IIO_CONST_ATTR_NAMED(ads1015_scale_available, scale_available,
++	"3 2 1 0.5 0.25 0.125");
++static IIO_CONST_ATTR_NAMED(ads1115_scale_available, scale_available,
++	"0.1875 0.125 0.0625 0.03125 0.015625 0.007813");
+ 
+ static IIO_CONST_ATTR_NAMED(ads1015_sampling_frequency_available,
+ 	sampling_frequency_available, "128 250 490 920 1600 2400 3300");
+@@ -454,7 +461,7 @@ static IIO_CONST_ATTR_NAMED(ads1115_sampling_frequency_available,
+ 	sampling_frequency_available, "8 16 32 64 128 250 475 860");
+ 
+ static struct attribute *ads1015_attributes[] = {
+-	&iio_const_attr_scale_available.dev_attr.attr,
++	&iio_const_attr_ads1015_scale_available.dev_attr.attr,
+ 	&iio_const_attr_ads1015_sampling_frequency_available.dev_attr.attr,
+ 	NULL,
+ };
+@@ -464,7 +471,7 @@ static const struct attribute_group ads1015_attribute_group = {
+ };
+ 
+ static struct attribute *ads1115_attributes[] = {
+-	&iio_const_attr_scale_available.dev_attr.attr,
++	&iio_const_attr_ads1115_scale_available.dev_attr.attr,
+ 	&iio_const_attr_ads1115_sampling_frequency_available.dev_attr.attr,
+ 	NULL,
+ };
+@@ -630,6 +637,15 @@ static int ads1015_probe(struct i2c_client *client,
+ 		dev_err(&client->dev, "iio triggered buffer setup failed\n");
+ 		return ret;
+ 	}
++
++	ret = regmap_update_bits(data->regmap, ADS1015_CFG_REG,
++				ADS1015_CFG_MOD_MASK,
++				ADS1015_CONTINUOUS << ADS1015_CFG_MOD_SHIFT);
++	if (ret)
++		return ret;
++
++	data->conv_invalid = true;
++
+ 	ret = pm_runtime_set_active(&client->dev);
+ 	if (ret)
+ 		goto err_buffer_cleanup;
+@@ -685,10 +701,15 @@ static int ads1015_runtime_resume(struct device *dev)
+ {
+ 	struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
+ 	struct ads1015_data *data = iio_priv(indio_dev);
++	int ret;
+ 
+-	return regmap_update_bits(data->regmap, ADS1015_CFG_REG,
++	ret = regmap_update_bits(data->regmap, ADS1015_CFG_REG,
+ 				  ADS1015_CFG_MOD_MASK,
+ 				  ADS1015_CONTINUOUS << ADS1015_CFG_MOD_SHIFT);
++	if (!ret)
++		data->conv_invalid = true;
++
++	return ret;
+ }
+ #endif
+ 
+diff --git a/drivers/mcb/mcb-lpc.c b/drivers/mcb/mcb-lpc.c
+index d072c088ce73..945091a88354 100644
+--- a/drivers/mcb/mcb-lpc.c
++++ b/drivers/mcb/mcb-lpc.c
+@@ -114,6 +114,12 @@ static struct resource sc24_fpga_resource = {
+ 	.flags = IORESOURCE_MEM,
+ };
+ 
++static struct resource sc31_fpga_resource = {
++	.start = 0xf000e000,
++	.end = 0xf000e000 + CHAM_HEADER_SIZE,
++	.flags = IORESOURCE_MEM,
++};
++
+ static struct platform_driver mcb_lpc_driver = {
+ 	.driver		= {
+ 		.name = "mcb-lpc",
+@@ -132,6 +138,15 @@ static const struct dmi_system_id mcb_lpc_dmi_table[] = {
+ 		.driver_data = (void *)&sc24_fpga_resource,
+ 		.callback = mcb_lpc_create_platform_device,
+ 	},
++	{
++		.ident = "SC31",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "MEN"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "14SC31"),
++		},
++		.driver_data = (void *)&sc31_fpga_resource,
++		.callback = mcb_lpc_create_platform_device,
++	},
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(dmi, mcb_lpc_dmi_table);
+diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
+index 75c5c903c8a6..53fa5b7380ff 100644
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -2055,6 +2055,12 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode,
+ 		goto err_wmi_detach;
+ 	}
+ 
++	/* If firmware indicates Full Rx Reorder support it must be used in a
++	 * slightly different manner. Let HTT code know.
++	 */
++	ar->htt.rx_ring.in_ord_rx = !!(test_bit(WMI_SERVICE_RX_FULL_REORDER,
++						ar->wmi.svc_map));
++
+ 	status = ath10k_htt_rx_alloc(&ar->htt);
+ 	if (status) {
+ 		ath10k_err(ar, "failed to alloc htt rx: %d\n", status);
+@@ -2167,12 +2173,6 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode,
+ 		}
+ 	}
+ 
+-	/* If firmware indicates Full Rx Reorder support it must be used in a
+-	 * slightly different manner. Let HTT code know.
+-	 */
+-	ar->htt.rx_ring.in_ord_rx = !!(test_bit(WMI_SERVICE_RX_FULL_REORDER,
+-						ar->wmi.svc_map));
+-
+ 	status = ath10k_htt_rx_ring_refill(ar);
+ 	if (status) {
+ 		ath10k_err(ar, "failed to refill htt rx ring: %d\n", status);
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index 84f4ba01e14f..875374e4747d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -430,6 +430,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ 	{IWL_PCI_DEVICE(0x095B, 0x520A, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x9000, iwl7265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x095A, 0x9400, iwl7265_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x095A, 0x9E10, iwl7265_2ac_cfg)},
+ 
+ /* 8000 Series */
+ 	{IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)},
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index 06ad2d50f9b0..fdfdf2371986 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -4215,7 +4215,7 @@ int mwifiex_init_channel_scan_gap(struct mwifiex_adapter *adapter)
+ 	if (adapter->config_bands & BAND_A)
+ 		n_channels_a = mwifiex_band_5ghz.n_channels;
+ 
+-	adapter->num_in_chan_stats = max_t(u32, n_channels_bg, n_channels_a);
++	adapter->num_in_chan_stats = n_channels_bg + n_channels_a;
+ 	adapter->chan_stats = vmalloc(sizeof(*adapter->chan_stats) *
+ 				      adapter->num_in_chan_stats);
+ 
+diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
+index ae9630b49342..9900855746ac 100644
+--- a/drivers/net/wireless/marvell/mwifiex/scan.c
++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
+@@ -2492,6 +2492,12 @@ mwifiex_update_chan_statistics(struct mwifiex_private *priv,
+ 					      sizeof(struct mwifiex_chan_stats);
+ 
+ 	for (i = 0 ; i < num_chan; i++) {
++		if (adapter->survey_idx >= adapter->num_in_chan_stats) {
++			mwifiex_dbg(adapter, WARN,
++				    "FW reported too many channel results (max %d)\n",
++				    adapter->num_in_chan_stats);
++			return;
++		}
+ 		chan_stats.chan_num = fw_chan_stats->chan_num;
+ 		chan_stats.bandcfg = fw_chan_stats->bandcfg;
+ 		chan_stats.flags = fw_chan_stats->flags;
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 032b6317690d..08dc8919ef60 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -2257,7 +2257,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ 	/* find adapter */
+ 	if (!_rtl_pci_find_adapter(pdev, hw)) {
+ 		err = -ENODEV;
+-		goto fail3;
++		goto fail2;
+ 	}
+ 
+ 	/* Init IO handler */
+@@ -2318,10 +2318,10 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ 	pci_set_drvdata(pdev, NULL);
+ 	rtl_deinit_core(hw);
+ 
++fail2:
+ 	if (rtlpriv->io.pci_mem_start != 0)
+ 		pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start);
+ 
+-fail2:
+ 	pci_release_regions(pdev);
+ 	complete(&rtlpriv->firmware_loading_complete);
+ 
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c
+index 774e72058d24..bddd5a5ebe52 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c
+@@ -175,6 +175,8 @@ int rtl88e_init_sw_vars(struct ieee80211_hw *hw)
+ 				      rtl_fw_cb);
+ 	if (err) {
+ 		pr_info("Failed to request firmware!\n");
++		vfree(rtlpriv->rtlhal.pfirmware);
++		rtlpriv->rtlhal.pfirmware = NULL;
+ 		return 1;
+ 	}
+ 
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
+index bcbb0c60f1f1..38f85bfdf0c7 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
+@@ -176,6 +176,8 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
+ 				      rtl_fw_cb);
+ 	if (err) {
+ 		pr_err("Failed to request firmware!\n");
++		vfree(rtlpriv->rtlhal.pfirmware);
++		rtlpriv->rtlhal.pfirmware = NULL;
+ 		return 1;
+ 	}
+ 
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c
+index 96c923b3feb4..e3eb850bb1de 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c
+@@ -85,6 +85,10 @@ static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
+ 	err = request_firmware_nowait(THIS_MODULE, 1,
+ 				      fw_name, rtlpriv->io.dev,
+ 				      GFP_KERNEL, hw, rtl_fw_cb);
++	if (err) {
++		vfree(rtlpriv->rtlhal.pfirmware);
++		rtlpriv->rtlhal.pfirmware = NULL;
++	}
+ 	return err;
+ }
+ 
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
+index 16132c66e5e1..e38d6f7370aa 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
+@@ -183,6 +183,8 @@ static int rtl92d_init_sw_vars(struct ieee80211_hw *hw)
+ 				      rtl_fw_cb);
+ 	if (err) {
+ 		pr_err("Failed to request firmware!\n");
++		vfree(rtlpriv->rtlhal.pfirmware);
++		rtlpriv->rtlhal.pfirmware = NULL;
+ 		return 1;
+ 	}
+ 
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c
+index eaa503b7c4b4..745e9c32655c 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c
+@@ -177,6 +177,8 @@ int rtl92ee_init_sw_vars(struct ieee80211_hw *hw)
+ 				      rtl_fw_cb);
+ 	if (err) {
+ 		pr_err("Failed to request firmware!\n");
++		vfree(rtlpriv->rtlhal.pfirmware);
++		rtlpriv->rtlhal.pfirmware = NULL;
+ 		return 1;
+ 	}
+ 
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
+index 2006b09ea74f..1ec20efb9ce1 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
+@@ -216,6 +216,8 @@ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
+ 				      rtl92se_fw_cb);
+ 	if (err) {
+ 		pr_err("Failed to request firmware!\n");
++		vfree(rtlpriv->rtlhal.pfirmware);
++		rtlpriv->rtlhal.pfirmware = NULL;
+ 		return 1;
+ 	}
+ 
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c
+index 7bf9f2557920..aab86667a7f3 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c
+@@ -184,6 +184,8 @@ int rtl8723e_init_sw_vars(struct ieee80211_hw *hw)
+ 				      rtl_fw_cb);
+ 	if (err) {
+ 		pr_err("Failed to request firmware!\n");
++		vfree(rtlpriv->rtlhal.pfirmware);
++		rtlpriv->rtlhal.pfirmware = NULL;
+ 		return 1;
+ 	}
+ 	return 0;
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
+index f9d10f1e7cf8..f47d839f388d 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
+@@ -187,16 +187,10 @@ int rtl8723be_init_sw_vars(struct ieee80211_hw *hw)
+ 				      rtlpriv->io.dev, GFP_KERNEL, hw,
+ 				      rtl_fw_cb);
+ 	if (err) {
+-		/* Failed to get firmware. Check if old version available */
+-		fw_name = "rtlwifi/rtl8723befw.bin";
+-		pr_info("Using firmware %s\n", fw_name);
+-		err = request_firmware_nowait(THIS_MODULE, 1, fw_name,
+-					      rtlpriv->io.dev, GFP_KERNEL, hw,
+-					      rtl_fw_cb);
+-		if (err) {
+-			pr_err("Failed to request firmware!\n");
+-			return 1;
+-		}
++		pr_err("Failed to request firmware!\n");
++		vfree(rtlpriv->rtlhal.pfirmware);
++		rtlpriv->rtlhal.pfirmware = NULL;
++		return 1;
+ 	}
+ 	return 0;
+ }
+@@ -287,6 +281,7 @@ static const struct rtl_hal_cfg rtl8723be_hal_cfg = {
+ 	.bar_id = 2,
+ 	.write_readback = true,
+ 	.name = "rtl8723be_pci",
++	.alt_fw_name = "rtlwifi/rtl8723befw.bin",
+ 	.ops = &rtl8723be_hal_ops,
+ 	.mod_params = &rtl8723be_mod_params,
+ 	.maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
+index d71d2776ca03..5925edf7877f 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
+@@ -196,6 +196,8 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
+ 	rtlpriv->rtlhal.wowlan_firmware = vzalloc(0x8000);
+ 	if (!rtlpriv->rtlhal.wowlan_firmware) {
+ 		pr_err("Can't alloc buffer for wowlan fw.\n");
++		vfree(rtlpriv->rtlhal.pfirmware);
++		rtlpriv->rtlhal.pfirmware = NULL;
+ 		return 1;
+ 	}
+ 
+@@ -214,16 +216,10 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
+ 				      rtlpriv->io.dev, GFP_KERNEL, hw,
+ 				      rtl_fw_cb);
+ 	if (err) {
+-		/* Failed to get firmware. Check if old version available */
+-		fw_name = "rtlwifi/rtl8821aefw.bin";
+-		pr_info("Using firmware %s\n", fw_name);
+-		err = request_firmware_nowait(THIS_MODULE, 1, fw_name,
+-					      rtlpriv->io.dev, GFP_KERNEL, hw,
+-					      rtl_fw_cb);
+-		if (err) {
+-			pr_err("Failed to request normal firmware!\n");
+-			return 1;
+-		}
++		pr_err("Failed to request normal firmware!\n");
++		vfree(rtlpriv->rtlhal.wowlan_firmware);
++		vfree(rtlpriv->rtlhal.pfirmware);
++		return 1;
+ 	}
+ 	/*load wowlan firmware*/
+ 	pr_info("Using firmware %s\n", wowlan_fw_name);
+@@ -233,6 +229,8 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
+ 				      rtl_wowlan_fw_cb);
+ 	if (err) {
+ 		pr_err("Failed to request wowlan firmware!\n");
++		vfree(rtlpriv->rtlhal.wowlan_firmware);
++		vfree(rtlpriv->rtlhal.pfirmware);
+ 		return 1;
+ 	}
+ 	return 0;
+@@ -325,6 +323,7 @@ static const struct rtl_hal_cfg rtl8821ae_hal_cfg = {
+ 	.bar_id = 2,
+ 	.write_readback = true,
+ 	.name = "rtl8821ae_pci",
++	.alt_fw_name = "rtlwifi/rtl8821aefw.bin",
+ 	.ops = &rtl8821ae_hal_ops,
+ 	.mod_params = &rtl8821ae_mod_params,
+ 	.maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index e0a28ea341fe..eabfa36383ce 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -274,6 +274,8 @@ ssize_t of_device_modalias(struct device *dev, char *str, ssize_t len)
+ 	ssize_t sl = of_device_get_modalias(dev, str, len - 2);
+ 	if (sl < 0)
+ 		return sl;
++	if (sl > len - 2)
++		return -ENOMEM;
+ 
+ 	str[sl++] = '\n';
+ 	str[sl] = 0;
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index 84e782d8e7c3..aad6ebb51735 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1233,6 +1233,7 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
+ 	unsigned long req_sz, len, sa;
+ 	Sg_scatter_hold *rsv_schp;
+ 	int k, length;
++	int ret = 0;
+ 
+ 	if ((!filp) || (!vma) || (!(sfp = (Sg_fd *) filp->private_data)))
+ 		return -ENXIO;
+@@ -1243,8 +1244,11 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
+ 	if (vma->vm_pgoff)
+ 		return -EINVAL;	/* want no offset */
+ 	rsv_schp = &sfp->reserve;
+-	if (req_sz > rsv_schp->bufflen)
+-		return -ENOMEM;	/* cannot map more than reserved buffer */
++	mutex_lock(&sfp->f_mutex);
++	if (req_sz > rsv_schp->bufflen) {
++		ret = -ENOMEM;	/* cannot map more than reserved buffer */
++		goto out;
++	}
+ 
+ 	sa = vma->vm_start;
+ 	length = 1 << (PAGE_SHIFT + rsv_schp->page_order);
+@@ -1258,7 +1262,9 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
+ 	vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
+ 	vma->vm_private_data = sfp;
+ 	vma->vm_ops = &sg_mmap_vm_ops;
+-	return 0;
++out:
++	mutex_unlock(&sfp->f_mutex);
++	return ret;
+ }
+ 
+ static void
+@@ -1735,9 +1741,12 @@ sg_start_req(Sg_request *srp, unsigned char *cmd)
+ 		    !sfp->res_in_use) {
+ 			sfp->res_in_use = 1;
+ 			sg_link_reserve(sfp, srp, dxfer_len);
+-		} else if ((hp->flags & SG_FLAG_MMAP_IO) && sfp->res_in_use) {
++		} else if (hp->flags & SG_FLAG_MMAP_IO) {
++			res = -EBUSY; /* sfp->res_in_use == 1 */
++			if (dxfer_len > rsv_schp->bufflen)
++				res = -ENOMEM;
+ 			mutex_unlock(&sfp->f_mutex);
+-			return -EBUSY;
++			return res;
+ 		} else {
+ 			res = sg_build_indirect(req_schp, sfp, dxfer_len);
+ 			if (res) {
+diff --git a/drivers/staging/ccree/ssi_cipher.c b/drivers/staging/ccree/ssi_cipher.c
+index cd2eafc04232..bdc68830389f 100644
+--- a/drivers/staging/ccree/ssi_cipher.c
++++ b/drivers/staging/ccree/ssi_cipher.c
+@@ -23,6 +23,7 @@
+ #include <crypto/aes.h>
+ #include <crypto/ctr.h>
+ #include <crypto/des.h>
++#include <crypto/scatterwalk.h>
+ 
+ #include "ssi_config.h"
+ #include "ssi_driver.h"
+@@ -716,6 +717,7 @@ static int ssi_blkcipher_complete(struct device *dev,
+ {
+ 	int completion_error = 0;
+ 	u32 inflight_counter;
++	struct ablkcipher_request *req = (struct ablkcipher_request *)areq;
+ 
+ 	ssi_buffer_mgr_unmap_blkcipher_request(dev, req_ctx, ivsize, src, dst);
+ 
+@@ -726,6 +728,22 @@ static int ssi_blkcipher_complete(struct device *dev,
+ 		ctx_p->drvdata->inflight_counter--;
+ 
+ 	if (areq) {
++		/*
++		 * The crypto API expects us to set the req->info to the last
++		 * ciphertext block. For encrypt, simply copy from the result.
++		 * For decrypt, we must copy from a saved buffer since this
++		 * could be an in-place decryption operation and the src is
++		 * lost by this point.
++		 */
++		if (req_ctx->gen_ctx.op_type == DRV_CRYPTO_DIRECTION_DECRYPT)  {
++			memcpy(req->info, req_ctx->backup_info, ivsize);
++			kfree(req_ctx->backup_info);
++		} else {
++			scatterwalk_map_and_copy(req->info, req->dst,
++						 (req->nbytes - ivsize),
++						 ivsize, 0);
++		}
++
+ 		ablkcipher_request_complete(areq, completion_error);
+ 		return 0;
+ 	}
+@@ -759,11 +777,13 @@ static int ssi_blkcipher_process(
+ 	if (unlikely(validate_data_size(ctx_p, nbytes))) {
+ 		SSI_LOG_ERR("Unsupported data size %d.\n", nbytes);
+ 		crypto_tfm_set_flags(tfm, CRYPTO_TFM_RES_BAD_BLOCK_LEN);
+-		return -EINVAL;
++		rc = -EINVAL;
++		goto exit_process;
+ 	}
+ 	if (nbytes == 0) {
+ 		/* No data to process is valid */
+-		return 0;
++		rc = 0;
++		goto exit_process;
+ 	}
+ 	/*For CTS in case of data size aligned to 16 use CBC mode*/
+ 	if (((nbytes % AES_BLOCK_SIZE) == 0) && (ctx_p->cipher_mode == DRV_CIPHER_CBC_CTS)) {
+@@ -842,6 +862,9 @@ static int ssi_blkcipher_process(
+ 	if (cts_restore_flag != 0)
+ 		ctx_p->cipher_mode = DRV_CIPHER_CBC_CTS;
+ 
++	if (rc != -EINPROGRESS)
++		kfree(req_ctx->backup_info);
++
+ 	return rc;
+ }
+ 
+@@ -884,7 +907,6 @@ static int ssi_ablkcipher_encrypt(struct ablkcipher_request *req)
+ 	struct blkcipher_req_ctx *req_ctx = ablkcipher_request_ctx(req);
+ 	unsigned int ivsize = crypto_ablkcipher_ivsize(ablk_tfm);
+ 
+-	req_ctx->backup_info = req->info;
+ 	req_ctx->is_giv = false;
+ 
+ 	return ssi_blkcipher_process(tfm, req_ctx, req->dst, req->src, req->nbytes, req->info, ivsize, (void *)req, DRV_CRYPTO_DIRECTION_ENCRYPT);
+@@ -897,8 +919,18 @@ static int ssi_ablkcipher_decrypt(struct ablkcipher_request *req)
+ 	struct blkcipher_req_ctx *req_ctx = ablkcipher_request_ctx(req);
+ 	unsigned int ivsize = crypto_ablkcipher_ivsize(ablk_tfm);
+ 
+-	req_ctx->backup_info = req->info;
++	/*
++	 * Allocate and save the last IV sized bytes of the source, which will
++	 * be lost in case of in-place decryption and might be needed for CTS.
++	 */
++	req_ctx->backup_info = kmalloc(ivsize, GFP_KERNEL);
++	if (!req_ctx->backup_info)
++		return -ENOMEM;
++
++	scatterwalk_map_and_copy(req_ctx->backup_info, req->src,
++				 (req->nbytes - ivsize), ivsize, 0);
+ 	req_ctx->is_giv = false;
++
+ 	return ssi_blkcipher_process(tfm, req_ctx, req->dst, req->src, req->nbytes, req->info, ivsize, (void *)req, DRV_CRYPTO_DIRECTION_DECRYPT);
+ }
+ 
+diff --git a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h
+index e6d28a249fc1..bfbabae1aad8 100644
+--- a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h
++++ b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h
+@@ -123,8 +123,8 @@ struct dpaa2_eth_swa {
+ /* Error bits in FD CTRL */
+ #define DPAA2_FD_CTRL_UFD		0x00000004
+ #define DPAA2_FD_CTRL_SBE		0x00000008
+-#define DPAA2_FD_CTRL_FSE		0x00000010
+-#define DPAA2_FD_CTRL_FAERR		0x00000020
++#define DPAA2_FD_CTRL_FSE		0x00000020
++#define DPAA2_FD_CTRL_FAERR		0x00000040
+ 
+ #define DPAA2_FD_RX_ERR_MASK		(DPAA2_FD_CTRL_SBE	| \
+ 					 DPAA2_FD_CTRL_FAERR)
+diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c
+index 36b5a11f21d2..a401b13f5f5e 100644
+--- a/drivers/staging/rts5208/rtsx_scsi.c
++++ b/drivers/staging/rts5208/rtsx_scsi.c
+@@ -414,7 +414,7 @@ void set_sense_data(struct rtsx_chip *chip, unsigned int lun, u8 err_code,
+ 	sense->ascq = ascq;
+ 	if (sns_key_info0 != 0) {
+ 		sense->sns_key_info[0] = SKSV | sns_key_info0;
+-		sense->sns_key_info[1] = (sns_key_info1 & 0xf0) >> 8;
++		sense->sns_key_info[1] = (sns_key_info1 & 0xf0) >> 4;
+ 		sense->sns_key_info[2] = sns_key_info1 & 0x0f;
+ 	}
+ }
+diff --git a/drivers/thunderbolt/ctl.c b/drivers/thunderbolt/ctl.c
+index 69c0232a22f8..fb40dd0588b9 100644
+--- a/drivers/thunderbolt/ctl.c
++++ b/drivers/thunderbolt/ctl.c
+@@ -804,7 +804,7 @@ struct tb_cfg_result tb_cfg_reset(struct tb_ctl *ctl, u64 route,
+ 	req->request_type = TB_CFG_PKG_RESET;
+ 	req->response = &reply;
+ 	req->response_size = sizeof(reply);
+-	req->response_type = sizeof(TB_CFG_PKG_RESET);
++	req->response_type = TB_CFG_PKG_RESET;
+ 
+ 	res = tb_cfg_request_sync(ctl, req, timeout_msec);
+ 
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index ebe27595c4af..0ff0feddfd1f 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -623,6 +623,8 @@ static void async_completed(struct urb *urb)
+ 	if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
+ 			as->status != -ENOENT)
+ 		cancel_bulk_urbs(ps, as->bulk_addr);
++
++	wake_up(&ps->wait);
+ 	spin_unlock(&ps->lock);
+ 
+ 	if (signr) {
+@@ -630,8 +632,6 @@ static void async_completed(struct urb *urb)
+ 		put_pid(pid);
+ 		put_cred(cred);
+ 	}
+-
+-	wake_up(&ps->wait);
+ }
+ 
+ static void destroy_async(struct usb_dev_state *ps, struct list_head *list)
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 574da2b4529c..82806e311202 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -57,8 +57,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Microsoft LifeCam-VX700 v2.0 */
+ 	{ USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+-	/* Logitech HD Pro Webcams C920 and C930e */
++	/* Logitech HD Pro Webcams C920, C920-C and C930e */
+ 	{ USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
++	{ USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
+ 	{ USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
+ 
+ 	/* Logitech ConferenceCam CC3000e */
+@@ -217,6 +218,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	{ USB_DEVICE(0x1a0a, 0x0200), .driver_info =
+ 			USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+ 
++	/* Corsair Strafe RGB */
++	{ USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
++
+ 	/* Acer C120 LED Projector */
+ 	{ USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM },
+ 
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index c8f38649f749..658d9d1f9ea3 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -142,29 +142,30 @@ static int amd_chipset_sb_type_init(struct amd_chipset_info *pinfo)
+ 			pinfo->sb_type.gen = AMD_CHIPSET_SB700;
+ 		else if (rev >= 0x40 && rev <= 0x4f)
+ 			pinfo->sb_type.gen = AMD_CHIPSET_SB800;
+-	}
+-	pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+-					  0x145c, NULL);
+-	if (pinfo->smbus_dev) {
+-		pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
+ 	} else {
+ 		pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+ 				PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL);
+ 
+-		if (!pinfo->smbus_dev) {
+-			pinfo->sb_type.gen = NOT_AMD_CHIPSET;
+-			return 0;
++		if (pinfo->smbus_dev) {
++			rev = pinfo->smbus_dev->revision;
++			if (rev >= 0x11 && rev <= 0x14)
++				pinfo->sb_type.gen = AMD_CHIPSET_HUDSON2;
++			else if (rev >= 0x15 && rev <= 0x18)
++				pinfo->sb_type.gen = AMD_CHIPSET_BOLTON;
++			else if (rev >= 0x39 && rev <= 0x3a)
++				pinfo->sb_type.gen = AMD_CHIPSET_YANGTZE;
++		} else {
++			pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
++							  0x145c, NULL);
++			if (pinfo->smbus_dev) {
++				rev = pinfo->smbus_dev->revision;
++				pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
++			} else {
++				pinfo->sb_type.gen = NOT_AMD_CHIPSET;
++				return 0;
++			}
+ 		}
+-
+-		rev = pinfo->smbus_dev->revision;
+-		if (rev >= 0x11 && rev <= 0x14)
+-			pinfo->sb_type.gen = AMD_CHIPSET_HUDSON2;
+-		else if (rev >= 0x15 && rev <= 0x18)
+-			pinfo->sb_type.gen = AMD_CHIPSET_BOLTON;
+-		else if (rev >= 0x39 && rev <= 0x3a)
+-			pinfo->sb_type.gen = AMD_CHIPSET_YANGTZE;
+ 	}
+-
+ 	pinfo->sb_type.rev = rev;
+ 	return 1;
+ }
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index 87cbd56cc761..b67692857daf 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -2671,6 +2671,13 @@ static int musb_suspend(struct device *dev)
+ {
+ 	struct musb	*musb = dev_to_musb(dev);
+ 	unsigned long	flags;
++	int ret;
++
++	ret = pm_runtime_get_sync(dev);
++	if (ret < 0) {
++		pm_runtime_put_noidle(dev);
++		return ret;
++	}
+ 
+ 	musb_platform_disable(musb);
+ 	musb_disable_interrupts(musb);
+@@ -2721,14 +2728,6 @@ static int musb_resume(struct device *dev)
+ 	if ((devctl & mask) != (musb->context.devctl & mask))
+ 		musb->port1_status = 0;
+ 
+-	/*
+-	 * The USB HUB code expects the device to be in RPM_ACTIVE once it came
+-	 * out of suspend
+-	 */
+-	pm_runtime_disable(dev);
+-	pm_runtime_set_active(dev);
+-	pm_runtime_enable(dev);
+-
+ 	musb_start(musb);
+ 
+ 	spin_lock_irqsave(&musb->lock, flags);
+@@ -2738,6 +2737,9 @@ static int musb_resume(struct device *dev)
+ 			error);
+ 	spin_unlock_irqrestore(&musb->lock, flags);
+ 
++	pm_runtime_mark_last_busy(dev);
++	pm_runtime_put_autosuspend(dev);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index fe123153b1a5..2a9944326210 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -2023,6 +2023,7 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) },			/* D-Link DWM-158 */
++	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d0e, 0xff) },			/* D-Link DWM-157 C1 */
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff),			/* D-Link DWM-221 B1 */
+ 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff),			/* D-Link DWM-222 */
+diff --git a/fs/dlm/user.c b/fs/dlm/user.c
+index 23488f559cf9..84199151b64b 100644
+--- a/fs/dlm/user.c
++++ b/fs/dlm/user.c
+@@ -355,6 +355,10 @@ static int dlm_device_register(struct dlm_ls *ls, char *name)
+ 	error = misc_register(&ls->ls_device);
+ 	if (error) {
+ 		kfree(ls->ls_device.name);
++		/* this has to be set to NULL
++		 * to avoid a double-free in dlm_device_deregister
++		 */
++		ls->ls_device.name = NULL;
+ 	}
+ fail:
+ 	return error;
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index c71e532da458..4adf6161ec77 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -576,6 +576,7 @@
+ #define PCI_DEVICE_ID_AMD_CS5536_EHC    0x2095
+ #define PCI_DEVICE_ID_AMD_CS5536_UDC    0x2096
+ #define PCI_DEVICE_ID_AMD_CS5536_UOC    0x2097
++#define PCI_DEVICE_ID_AMD_CS5536_DEV_IDE    0x2092
+ #define PCI_DEVICE_ID_AMD_CS5536_IDE    0x209A
+ #define PCI_DEVICE_ID_AMD_LX_VIDEO  0x2081
+ #define PCI_DEVICE_ID_AMD_LX_AES    0x2082
+diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
+index db6dc9dc0482..1c49431f3121 100644
+--- a/include/linux/workqueue.h
++++ b/include/linux/workqueue.h
+@@ -323,8 +323,8 @@ enum {
+ 
+ 	__WQ_DRAINING		= 1 << 16, /* internal: workqueue is draining */
+ 	__WQ_ORDERED		= 1 << 17, /* internal: workqueue is ordered */
+-	__WQ_ORDERED_EXPLICIT	= 1 << 18, /* internal: alloc_ordered_workqueue() */
+ 	__WQ_LEGACY		= 1 << 18, /* internal: create*_workqueue() */
++	__WQ_ORDERED_EXPLICIT	= 1 << 19, /* internal: alloc_ordered_workqueue() */
+ 
+ 	WQ_MAX_ACTIVE		= 512,	  /* I like 512, better ideas? */
+ 	WQ_MAX_UNBOUND_PER_CPU	= 4,	  /* 4 * #cpus for unbound wq */
+diff --git a/include/uapi/linux/android/binder.h b/include/uapi/linux/android/binder.h
+index 51f891fb1b18..7668b5791c91 100644
+--- a/include/uapi/linux/android/binder.h
++++ b/include/uapi/linux/android/binder.h
+@@ -132,6 +132,7 @@ enum {
+ 
+ /* struct binder_fd_array_object - object describing an array of fds in a buffer
+  * @hdr:		common header structure
++ * @pad:		padding to ensure correct alignment
+  * @num_fds:		number of file descriptors in the buffer
+  * @parent:		index in offset array to buffer holding the fd array
+  * @parent_offset:	start offset of fd array in the buffer
+@@ -152,6 +153,7 @@ enum {
+  */
+ struct binder_fd_array_object {
+ 	struct binder_object_header	hdr;
++	__u32				pad;
+ 	binder_size_t			num_fds;
+ 	binder_size_t			parent;
+ 	binder_size_t			parent_offset;
+diff --git a/kernel/configs/android-base.config b/kernel/configs/android-base.config
+index d70829033bb7..d3fd428f4b92 100644
+--- a/kernel/configs/android-base.config
++++ b/kernel/configs/android-base.config
+@@ -10,6 +10,7 @@
+ # CONFIG_USELIB is not set
+ CONFIG_ANDROID=y
+ CONFIG_ANDROID_BINDER_IPC=y
++CONFIG_ANDROID_BINDER_DEVICES=binder,hwbinder,vndbinder
+ CONFIG_ANDROID_LOW_MEMORY_KILLER=y
+ CONFIG_ARMV8_DEPRECATED=y
+ CONFIG_ASHMEM=y