[gentoo-commits] proj/linux-patches:4.14 commit in: /

[Mike Pagano]

commit:     7619187f72986c8c9bc60d3df750c0ae0dca67ea
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 31 10:23:08 2019 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul 31 10:23:08 2019 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7619187f

Linux patch 4.14.135

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README               |     4 +
 1134_linux-4.14.135.patch | 13831 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 13835 insertions(+)

diff --git a/0000_README b/0000_README
index befc228..675e99c 100644
--- a/0000_README
+++ b/0000_README
@@ -579,6 +579,10 @@ Patch:  1133_linux-4.14.134.patch
 From:   https://www.kernel.org
 Desc:   Linux 4.14.134
 
+Patch:  1134_linux-4.14.135.patch
+From:   https://www.kernel.org
+Desc:   Linux 4.14.135
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1134_linux-4.14.135.patch b/1134_linux-4.14.135.patch
new file mode 100644
index 0000000..74f80ff
--- /dev/null
+++ b/1134_linux-4.14.135.patch
@@ -0,0 +1,13831 @@
+diff --git a/Documentation/atomic_t.txt b/Documentation/atomic_t.txt
+index 913396ac5824..ed0d814df7e0 100644
+--- a/Documentation/atomic_t.txt
++++ b/Documentation/atomic_t.txt
+@@ -177,6 +177,9 @@ These helper barriers exist because architectures have varying implicit
+ ordering on their SMP atomic primitives. For example our TSO architectures
+ provide full ordered atomics and these barriers are no-ops.
+ 
++NOTE: when the atomic RmW ops are fully ordered, they should also imply a
++compiler barrier.
++
+ Thus:
+ 
+   atomic_fetch_add();
+diff --git a/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt b/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt
+index 42cd81090a2c..3f3cfc1d8d4d 100644
+--- a/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt
++++ b/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt
+@@ -16,7 +16,7 @@ Required properties:
+ 
+ Optional properties:
+ - interrupts: interrupt line number for the SMI error/done interrupt
+-- clocks: phandle for up to three required clocks for the MDIO instance
++- clocks: phandle for up to four required clocks for the MDIO instance
+ 
+ The child nodes of the MDIO driver are the individual PHY devices
+ connected to this MDIO bus. They must have a "reg" property given the
+diff --git a/Makefile b/Makefile
+index 97c744513af0..57825473c031 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 134
++SUBLEVEL = 135
+ EXTRAVERSION =
+ NAME = Petit Gorille
+ 
+@@ -488,6 +488,7 @@ ifneq ($(GCC_TOOLCHAIN),)
+ CLANG_FLAGS	+= --gcc-toolchain=$(GCC_TOOLCHAIN)
+ endif
+ CLANG_FLAGS	+= -no-integrated-as
++CLANG_FLAGS	+= -Werror=unknown-warning-option
+ KBUILD_CFLAGS	+= $(CLANG_FLAGS)
+ KBUILD_AFLAGS	+= $(CLANG_FLAGS)
+ export CLANG_FLAGS
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+index d10d4430537a..f6e6f1e83ba8 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+@@ -307,7 +307,8 @@
+ 			regulator-max-microvolt = <1320000>;
+ 			enable-gpios = <&pmic 6 GPIO_ACTIVE_HIGH>;
+ 			regulator-ramp-delay = <80>;
+-			regulator-enable-ramp-delay = <1000>;
++			regulator-enable-ramp-delay = <2000>;
++			regulator-settling-time-us = <160>;
+ 		};
+ 	};
+ };
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210.dtsi b/arch/arm64/boot/dts/nvidia/tegra210.dtsi
+index 9bdf19f2cca7..466199766848 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210.dtsi
+@@ -1103,7 +1103,7 @@
+ 			compatible = "nvidia,tegra210-agic";
+ 			#interrupt-cells = <3>;
+ 			interrupt-controller;
+-			reg = <0x702f9000 0x2000>,
++			reg = <0x702f9000 0x1000>,
+ 			      <0x702fa000 0x2000>;
+ 			interrupts = <GIC_SPI 102 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
+ 			clocks = <&tegra_car TEGRA210_CLK_APE>;
+diff --git a/arch/arm64/crypto/sha1-ce-glue.c b/arch/arm64/crypto/sha1-ce-glue.c
+index efbeb3e0dcfb..70568e6db77b 100644
+--- a/arch/arm64/crypto/sha1-ce-glue.c
++++ b/arch/arm64/crypto/sha1-ce-glue.c
+@@ -54,7 +54,7 @@ static int sha1_ce_finup(struct shash_desc *desc, const u8 *data,
+ 			 unsigned int len, u8 *out)
+ {
+ 	struct sha1_ce_state *sctx = shash_desc_ctx(desc);
+-	bool finalize = !sctx->sst.count && !(len % SHA1_BLOCK_SIZE);
++	bool finalize = !sctx->sst.count && !(len % SHA1_BLOCK_SIZE) && len;
+ 
+ 	if (!may_use_simd())
+ 		return crypto_sha1_finup(desc, data, len, out);
+diff --git a/arch/arm64/crypto/sha2-ce-glue.c b/arch/arm64/crypto/sha2-ce-glue.c
+index fd1ff2b13dfa..af8472aded42 100644
+--- a/arch/arm64/crypto/sha2-ce-glue.c
++++ b/arch/arm64/crypto/sha2-ce-glue.c
+@@ -59,7 +59,7 @@ static int sha256_ce_finup(struct shash_desc *desc, const u8 *data,
+ 			   unsigned int len, u8 *out)
+ {
+ 	struct sha256_ce_state *sctx = shash_desc_ctx(desc);
+-	bool finalize = !sctx->sst.count && !(len % SHA256_BLOCK_SIZE);
++	bool finalize = !sctx->sst.count && !(len % SHA256_BLOCK_SIZE) && len;
+ 
+ 	if (!may_use_simd()) {
+ 		if (len)
+diff --git a/arch/arm64/kernel/acpi.c b/arch/arm64/kernel/acpi.c
+index b3162715ed78..285f0b4851fc 100644
+--- a/arch/arm64/kernel/acpi.c
++++ b/arch/arm64/kernel/acpi.c
+@@ -157,10 +157,14 @@ static int __init acpi_fadt_sanity_check(void)
+ 	 */
+ 	if (table->revision < 5 ||
+ 	   (table->revision == 5 && fadt->minor_revision < 1)) {
+-		pr_err("Unsupported FADT revision %d.%d, should be 5.1+\n",
++		pr_err(FW_BUG "Unsupported FADT revision %d.%d, should be 5.1+\n",
+ 		       table->revision, fadt->minor_revision);
+-		ret = -EINVAL;
+-		goto out;
++
++		if (!fadt->arm_boot_flags) {
++			ret = -EINVAL;
++			goto out;
++		}
++		pr_err("FADT has ARM boot flags set, assuming 5.1\n");
+ 	}
+ 
+ 	if (!(fadt->flags & ACPI_FADT_HW_REDUCED)) {
+diff --git a/arch/arm64/kernel/image.h b/arch/arm64/kernel/image.h
+index 40f9f0b078a4..12af2ba8d558 100644
+--- a/arch/arm64/kernel/image.h
++++ b/arch/arm64/kernel/image.h
+@@ -73,7 +73,11 @@
+ 
+ #ifdef CONFIG_EFI
+ 
+-__efistub_stext_offset = stext - _text;
++/*
++ * Use ABSOLUTE() to avoid ld.lld treating this as a relative symbol:
++ * https://github.com/ClangBuiltLinux/linux/issues/561
++ */
++__efistub_stext_offset = ABSOLUTE(stext - _text);
+ 
+ /*
+  * The EFI stub has its own symbol namespace prefixed by __efistub_, to
+diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile
+index adce180f3ee4..331b9e0a8072 100644
+--- a/arch/mips/boot/compressed/Makefile
++++ b/arch/mips/boot/compressed/Makefile
+@@ -75,6 +75,8 @@ OBJCOPYFLAGS_piggy.o := --add-section=.image=$(obj)/vmlinux.bin.z \
+ $(obj)/piggy.o: $(obj)/dummy.o $(obj)/vmlinux.bin.z FORCE
+ 	$(call if_changed,objcopy)
+ 
++HOSTCFLAGS_calc_vmlinuz_load_addr.o += $(LINUXINCLUDE)
++
+ # Calculate the load address of the compressed kernel image
+ hostprogs-y := calc_vmlinuz_load_addr
+ 
+diff --git a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
+index 542c3ede9722..d14f75ec8273 100644
+--- a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
++++ b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
+@@ -13,7 +13,7 @@
+ #include <stdint.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+-#include "../../../../include/linux/sizes.h"
++#include <linux/sizes.h>
+ 
+ int main(int argc, char *argv[])
+ {
+diff --git a/arch/mips/include/asm/mach-ath79/ar933x_uart.h b/arch/mips/include/asm/mach-ath79/ar933x_uart.h
+index c2917b39966b..bba2c8837951 100644
+--- a/arch/mips/include/asm/mach-ath79/ar933x_uart.h
++++ b/arch/mips/include/asm/mach-ath79/ar933x_uart.h
+@@ -27,8 +27,8 @@
+ #define AR933X_UART_CS_PARITY_S		0
+ #define AR933X_UART_CS_PARITY_M		0x3
+ #define	  AR933X_UART_CS_PARITY_NONE	0
+-#define	  AR933X_UART_CS_PARITY_ODD	1
+-#define	  AR933X_UART_CS_PARITY_EVEN	2
++#define	  AR933X_UART_CS_PARITY_ODD	2
++#define	  AR933X_UART_CS_PARITY_EVEN	3
+ #define AR933X_UART_CS_IF_MODE_S	2
+ #define AR933X_UART_CS_IF_MODE_M	0x3
+ #define	  AR933X_UART_CS_IF_MODE_NONE	0
+diff --git a/arch/mips/jz4740/board-qi_lb60.c b/arch/mips/jz4740/board-qi_lb60.c
+index 6d7f97552200..e1a905515283 100644
+--- a/arch/mips/jz4740/board-qi_lb60.c
++++ b/arch/mips/jz4740/board-qi_lb60.c
+@@ -456,27 +456,27 @@ static unsigned long pin_cfg_bias_disable[] = {
+ static struct pinctrl_map pin_map[] __initdata = {
+ 	/* NAND pin configuration */
+ 	PIN_MAP_MUX_GROUP_DEFAULT("jz4740-nand",
+-			"10010000.jz4740-pinctrl", "nand", "nand-cs1"),
++			"10010000.pin-controller", "nand-cs1", "nand"),
+ 
+ 	/* fbdev pin configuration */
+ 	PIN_MAP_MUX_GROUP("jz4740-fb", PINCTRL_STATE_DEFAULT,
+-			"10010000.jz4740-pinctrl", "lcd", "lcd-8bit"),
++			"10010000.pin-controller", "lcd-8bit", "lcd"),
+ 	PIN_MAP_MUX_GROUP("jz4740-fb", PINCTRL_STATE_SLEEP,
+-			"10010000.jz4740-pinctrl", "lcd", "lcd-no-pins"),
++			"10010000.pin-controller", "lcd-no-pins", "lcd"),
+ 
+ 	/* MMC pin configuration */
+ 	PIN_MAP_MUX_GROUP_DEFAULT("jz4740-mmc.0",
+-			"10010000.jz4740-pinctrl", "mmc", "mmc-1bit"),
++			"10010000.pin-controller", "mmc-1bit", "mmc"),
+ 	PIN_MAP_MUX_GROUP_DEFAULT("jz4740-mmc.0",
+-			"10010000.jz4740-pinctrl", "mmc", "mmc-4bit"),
++			"10010000.pin-controller", "mmc-4bit", "mmc"),
+ 	PIN_MAP_CONFIGS_PIN_DEFAULT("jz4740-mmc.0",
+-			"10010000.jz4740-pinctrl", "PD0", pin_cfg_bias_disable),
++			"10010000.pin-controller", "PD0", pin_cfg_bias_disable),
+ 	PIN_MAP_CONFIGS_PIN_DEFAULT("jz4740-mmc.0",
+-			"10010000.jz4740-pinctrl", "PD2", pin_cfg_bias_disable),
++			"10010000.pin-controller", "PD2", pin_cfg_bias_disable),
+ 
+ 	/* PWM pin configuration */
+ 	PIN_MAP_MUX_GROUP_DEFAULT("jz4740-pwm",
+-			"10010000.jz4740-pinctrl", "pwm4", "pwm4"),
++			"10010000.pin-controller", "pwm4", "pwm4"),
+ };
+ 
+ 
+diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
+index eca5b2a1c7e1..f468a5b44508 100644
+--- a/arch/parisc/kernel/ptrace.c
++++ b/arch/parisc/kernel/ptrace.c
+@@ -171,6 +171,9 @@ long arch_ptrace(struct task_struct *child, long request,
+ 		if ((addr & (sizeof(unsigned long)-1)) ||
+ 		     addr >= sizeof(struct pt_regs))
+ 			break;
++		if (addr == PT_IAOQ0 || addr == PT_IAOQ1) {
++			data |= 3; /* ensure userspace privilege */
++		}
+ 		if ((addr >= PT_GR1 && addr <= PT_GR31) ||
+ 				addr == PT_IAOQ0 || addr == PT_IAOQ1 ||
+ 				(addr >= PT_FR0 && addr <= PT_FR31 + 4) ||
+@@ -232,16 +235,18 @@ long arch_ptrace(struct task_struct *child, long request,
+ 
+ static compat_ulong_t translate_usr_offset(compat_ulong_t offset)
+ {
+-	if (offset < 0)
+-		return sizeof(struct pt_regs);
+-	else if (offset <= 32*4)	/* gr[0..31] */
+-		return offset * 2 + 4;
+-	else if (offset <= 32*4+32*8)	/* gr[0..31] + fr[0..31] */
+-		return offset + 32*4;
+-	else if (offset < sizeof(struct pt_regs)/2 + 32*4)
+-		return offset * 2 + 4 - 32*8;
++	compat_ulong_t pos;
++
++	if (offset < 32*4)	/* gr[0..31] */
++		pos = offset * 2 + 4;
++	else if (offset < 32*4+32*8)	/* fr[0] ... fr[31] */
++		pos = (offset - 32*4) + PT_FR0;
++	else if (offset < sizeof(struct pt_regs)/2 + 32*4) /* sr[0] ... ipsw */
++		pos = (offset - 32*4 - 32*8) * 2 + PT_SR0 + 4;
+ 	else
+-		return sizeof(struct pt_regs);
++		pos = sizeof(struct pt_regs);
++
++	return pos;
+ }
+ 
+ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
+@@ -285,9 +290,12 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
+ 			addr = translate_usr_offset(addr);
+ 			if (addr >= sizeof(struct pt_regs))
+ 				break;
++			if (addr == PT_IAOQ0+4 || addr == PT_IAOQ1+4) {
++				data |= 3; /* ensure userspace privilege */
++			}
+ 			if (addr >= PT_FR0 && addr <= PT_FR31 + 4) {
+ 				/* Special case, fp regs are 64 bits anyway */
+-				*(__u64 *) ((char *) task_regs(child) + addr) = data;
++				*(__u32 *) ((char *) task_regs(child) + addr) = data;
+ 				ret = 0;
+ 			}
+ 			else if ((addr >= PT_GR1+4 && addr <= PT_GR31+4) ||
+@@ -500,7 +508,8 @@ static void set_reg(struct pt_regs *regs, int num, unsigned long val)
+ 			return;
+ 	case RI(iaoq[0]):
+ 	case RI(iaoq[1]):
+-			regs->iaoq[num - RI(iaoq[0])] = val;
++			/* set 2 lowest bits to ensure userspace privilege: */
++			regs->iaoq[num - RI(iaoq[0])] = val | 3;
+ 			return;
+ 	case RI(sar):	regs->sar = val;
+ 			return;
+diff --git a/arch/powerpc/boot/xz_config.h b/arch/powerpc/boot/xz_config.h
+index e22e5b3770dd..ebfadd39e192 100644
+--- a/arch/powerpc/boot/xz_config.h
++++ b/arch/powerpc/boot/xz_config.h
+@@ -20,10 +20,30 @@ static inline uint32_t swab32p(void *p)
+ 
+ #ifdef __LITTLE_ENDIAN__
+ #define get_le32(p) (*((uint32_t *) (p)))
++#define cpu_to_be32(x) swab32(x)
++static inline u32 be32_to_cpup(const u32 *p)
++{
++	return swab32p((u32 *)p);
++}
+ #else
+ #define get_le32(p) swab32p(p)
++#define cpu_to_be32(x) (x)
++static inline u32 be32_to_cpup(const u32 *p)
++{
++	return *p;
++}
+ #endif
+ 
++static inline uint32_t get_unaligned_be32(const void *p)
++{
++	return be32_to_cpup(p);
++}
++
++static inline void put_unaligned_be32(u32 val, void *p)
++{
++	*((u32 *)p) = cpu_to_be32(val);
++}
++
+ #define memeq(a, b, size) (memcmp(a, b, size) == 0)
+ #define memzero(buf, size) memset(buf, 0, size)
+ 
+diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
+index 45322b37669a..d2ba7936d0d3 100644
+--- a/arch/powerpc/kernel/eeh.c
++++ b/arch/powerpc/kernel/eeh.c
+@@ -361,10 +361,19 @@ static inline unsigned long eeh_token_to_phys(unsigned long token)
+ 	ptep = find_init_mm_pte(token, &hugepage_shift);
+ 	if (!ptep)
+ 		return token;
+-	WARN_ON(hugepage_shift);
+-	pa = pte_pfn(*ptep) << PAGE_SHIFT;
+ 
+-	return pa | (token & (PAGE_SIZE-1));
++	pa = pte_pfn(*ptep);
++
++	/* On radix we can do hugepage mappings for io, so handle that */
++	if (hugepage_shift) {
++		pa <<= hugepage_shift;
++		pa |= token & ((1ul << hugepage_shift) - 1);
++	} else {
++		pa <<= PAGE_SHIFT;
++		pa |= token & (PAGE_SIZE - 1);
++	}
++
++	return pa;
+ }
+ 
+ /*
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index f65bb53df43b..43cde6c60279 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -1675,7 +1675,7 @@ handle_page_fault:
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
+ 	bl	do_page_fault
+ 	cmpdi	r3,0
+-	beq+	12f
++	beq+	ret_from_except_lite
+ 	bl	save_nvgprs
+ 	mr	r5,r3
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
+@@ -1690,7 +1690,12 @@ handle_dabr_fault:
+ 	ld      r5,_DSISR(r1)
+ 	addi    r3,r1,STACK_FRAME_OVERHEAD
+ 	bl      do_break
+-12:	b       ret_from_except_lite
++	/*
++	 * do_break() may have changed the NV GPRS while handling a breakpoint.
++	 * If so, we need to restore them with their updated values. Don't use
++	 * ret_from_except_lite here.
++	 */
++	b       ret_from_except
+ 
+ 
+ #ifdef CONFIG_PPC_STD_MMU_64
+diff --git a/arch/powerpc/kernel/pci_of_scan.c b/arch/powerpc/kernel/pci_of_scan.c
+index 0d790f8432d2..6ca1b3a1e196 100644
+--- a/arch/powerpc/kernel/pci_of_scan.c
++++ b/arch/powerpc/kernel/pci_of_scan.c
+@@ -45,6 +45,8 @@ static unsigned int pci_parse_of_flags(u32 addr0, int bridge)
+ 	if (addr0 & 0x02000000) {
+ 		flags = IORESOURCE_MEM | PCI_BASE_ADDRESS_SPACE_MEMORY;
+ 		flags |= (addr0 >> 22) & PCI_BASE_ADDRESS_MEM_TYPE_64;
++		if (flags & PCI_BASE_ADDRESS_MEM_TYPE_64)
++			flags |= IORESOURCE_MEM_64;
+ 		flags |= (addr0 >> 28) & PCI_BASE_ADDRESS_MEM_TYPE_1M;
+ 		if (addr0 & 0x40000000)
+ 			flags |= IORESOURCE_PREFETCH
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
+index 636ea854808e..a03fc3109fa5 100644
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -1279,6 +1279,9 @@ long sys_rt_sigreturn(int r3, int r4, int r5, int r6, int r7, int r8,
+ 			goto bad;
+ 
+ 		if (MSR_TM_ACTIVE(msr_hi<<32)) {
++			/* Trying to start TM on non TM system */
++			if (!cpu_has_feature(CPU_FTR_TM))
++				goto bad;
+ 			/* We only recheckpoint on return if we're
+ 			 * transaction.
+ 			 */
+diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
+index 927384d85faf..b75bf6e74209 100644
+--- a/arch/powerpc/kernel/signal_64.c
++++ b/arch/powerpc/kernel/signal_64.c
+@@ -741,6 +741,11 @@ int sys_rt_sigreturn(unsigned long r3, unsigned long r4, unsigned long r5,
+ 	if (MSR_TM_ACTIVE(msr)) {
+ 		/* We recheckpoint on return. */
+ 		struct ucontext __user *uc_transact;
++
++		/* Trying to start TM on non TM system */
++		if (!cpu_has_feature(CPU_FTR_TM))
++			goto badframe;
++
+ 		if (__get_user(uc_transact, &uc->uc_link))
+ 			goto badframe;
+ 		if (restore_tm_sigcontexts(current, &uc->uc_mcontext,
+diff --git a/arch/powerpc/kernel/swsusp_32.S b/arch/powerpc/kernel/swsusp_32.S
+index 34b73a262709..5307cb7e12de 100644
+--- a/arch/powerpc/kernel/swsusp_32.S
++++ b/arch/powerpc/kernel/swsusp_32.S
+@@ -24,11 +24,19 @@
+ #define SL_IBAT2	0x48
+ #define SL_DBAT3	0x50
+ #define SL_IBAT3	0x58
+-#define SL_TB		0x60
+-#define SL_R2		0x68
+-#define SL_CR		0x6c
+-#define SL_LR		0x70
+-#define SL_R12		0x74	/* r12 to r31 */
++#define SL_DBAT4	0x60
++#define SL_IBAT4	0x68
++#define SL_DBAT5	0x70
++#define SL_IBAT5	0x78
++#define SL_DBAT6	0x80
++#define SL_IBAT6	0x88
++#define SL_DBAT7	0x90
++#define SL_IBAT7	0x98
++#define SL_TB		0xa0
++#define SL_R2		0xa8
++#define SL_CR		0xac
++#define SL_LR		0xb0
++#define SL_R12		0xb4	/* r12 to r31 */
+ #define SL_SIZE		(SL_R12 + 80)
+ 
+ 	.section .data
+@@ -113,6 +121,41 @@ _GLOBAL(swsusp_arch_suspend)
+ 	mfibatl	r4,3
+ 	stw	r4,SL_IBAT3+4(r11)
+ 
++BEGIN_MMU_FTR_SECTION
++	mfspr	r4,SPRN_DBAT4U
++	stw	r4,SL_DBAT4(r11)
++	mfspr	r4,SPRN_DBAT4L
++	stw	r4,SL_DBAT4+4(r11)
++	mfspr	r4,SPRN_DBAT5U
++	stw	r4,SL_DBAT5(r11)
++	mfspr	r4,SPRN_DBAT5L
++	stw	r4,SL_DBAT5+4(r11)
++	mfspr	r4,SPRN_DBAT6U
++	stw	r4,SL_DBAT6(r11)
++	mfspr	r4,SPRN_DBAT6L
++	stw	r4,SL_DBAT6+4(r11)
++	mfspr	r4,SPRN_DBAT7U
++	stw	r4,SL_DBAT7(r11)
++	mfspr	r4,SPRN_DBAT7L
++	stw	r4,SL_DBAT7+4(r11)
++	mfspr	r4,SPRN_IBAT4U
++	stw	r4,SL_IBAT4(r11)
++	mfspr	r4,SPRN_IBAT4L
++	stw	r4,SL_IBAT4+4(r11)
++	mfspr	r4,SPRN_IBAT5U
++	stw	r4,SL_IBAT5(r11)
++	mfspr	r4,SPRN_IBAT5L
++	stw	r4,SL_IBAT5+4(r11)
++	mfspr	r4,SPRN_IBAT6U
++	stw	r4,SL_IBAT6(r11)
++	mfspr	r4,SPRN_IBAT6L
++	stw	r4,SL_IBAT6+4(r11)
++	mfspr	r4,SPRN_IBAT7U
++	stw	r4,SL_IBAT7(r11)
++	mfspr	r4,SPRN_IBAT7L
++	stw	r4,SL_IBAT7+4(r11)
++END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
++
+ #if  0
+ 	/* Backup various CPU config stuffs */
+ 	bl	__save_cpu_setup
+@@ -278,27 +321,41 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
+ 	mtibatu	3,r4
+ 	lwz	r4,SL_IBAT3+4(r11)
+ 	mtibatl	3,r4
+-#endif
+-
+ BEGIN_MMU_FTR_SECTION
+-	li	r4,0
++	lwz	r4,SL_DBAT4(r11)
+ 	mtspr	SPRN_DBAT4U,r4
++	lwz	r4,SL_DBAT4+4(r11)
+ 	mtspr	SPRN_DBAT4L,r4
++	lwz	r4,SL_DBAT5(r11)
+ 	mtspr	SPRN_DBAT5U,r4
++	lwz	r4,SL_DBAT5+4(r11)
+ 	mtspr	SPRN_DBAT5L,r4
++	lwz	r4,SL_DBAT6(r11)
+ 	mtspr	SPRN_DBAT6U,r4
++	lwz	r4,SL_DBAT6+4(r11)
+ 	mtspr	SPRN_DBAT6L,r4
++	lwz	r4,SL_DBAT7(r11)
+ 	mtspr	SPRN_DBAT7U,r4
++	lwz	r4,SL_DBAT7+4(r11)
+ 	mtspr	SPRN_DBAT7L,r4
++	lwz	r4,SL_IBAT4(r11)
+ 	mtspr	SPRN_IBAT4U,r4
++	lwz	r4,SL_IBAT4+4(r11)
+ 	mtspr	SPRN_IBAT4L,r4
++	lwz	r4,SL_IBAT5(r11)
+ 	mtspr	SPRN_IBAT5U,r4
++	lwz	r4,SL_IBAT5+4(r11)
+ 	mtspr	SPRN_IBAT5L,r4
++	lwz	r4,SL_IBAT6(r11)
+ 	mtspr	SPRN_IBAT6U,r4
++	lwz	r4,SL_IBAT6+4(r11)
+ 	mtspr	SPRN_IBAT6L,r4
++	lwz	r4,SL_IBAT7(r11)
+ 	mtspr	SPRN_IBAT7U,r4
++	lwz	r4,SL_IBAT7+4(r11)
+ 	mtspr	SPRN_IBAT7L,r4
+ END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
++#endif
+ 
+ 	/* Flush all TLBs */
+ 	lis	r4,0x1000
+diff --git a/arch/powerpc/platforms/4xx/uic.c b/arch/powerpc/platforms/4xx/uic.c
+index 8b4dd0da0839..9e27cfe27026 100644
+--- a/arch/powerpc/platforms/4xx/uic.c
++++ b/arch/powerpc/platforms/4xx/uic.c
+@@ -158,6 +158,7 @@ static int uic_set_irq_type(struct irq_data *d, unsigned int flow_type)
+ 
+ 	mtdcr(uic->dcrbase + UIC_PR, pr);
+ 	mtdcr(uic->dcrbase + UIC_TR, tr);
++	mtdcr(uic->dcrbase + UIC_SR, ~mask);
+ 
+ 	raw_spin_unlock_irqrestore(&uic->lock, flags);
+ 
+diff --git a/arch/powerpc/platforms/powermac/sleep.S b/arch/powerpc/platforms/powermac/sleep.S
+index 1c2802fabd57..c856cd7fcdc4 100644
+--- a/arch/powerpc/platforms/powermac/sleep.S
++++ b/arch/powerpc/platforms/powermac/sleep.S
+@@ -37,10 +37,18 @@
+ #define SL_IBAT2	0x48
+ #define SL_DBAT3	0x50
+ #define SL_IBAT3	0x58
+-#define SL_TB		0x60
+-#define SL_R2		0x68
+-#define SL_CR		0x6c
+-#define SL_R12		0x70	/* r12 to r31 */
++#define SL_DBAT4	0x60
++#define SL_IBAT4	0x68
++#define SL_DBAT5	0x70
++#define SL_IBAT5	0x78
++#define SL_DBAT6	0x80
++#define SL_IBAT6	0x88
++#define SL_DBAT7	0x90
++#define SL_IBAT7	0x98
++#define SL_TB		0xa0
++#define SL_R2		0xa8
++#define SL_CR		0xac
++#define SL_R12		0xb0	/* r12 to r31 */
+ #define SL_SIZE		(SL_R12 + 80)
+ 
+ 	.section .text
+@@ -125,6 +133,41 @@ _GLOBAL(low_sleep_handler)
+ 	mfibatl	r4,3
+ 	stw	r4,SL_IBAT3+4(r1)
+ 
++BEGIN_MMU_FTR_SECTION
++	mfspr	r4,SPRN_DBAT4U
++	stw	r4,SL_DBAT4(r1)
++	mfspr	r4,SPRN_DBAT4L
++	stw	r4,SL_DBAT4+4(r1)
++	mfspr	r4,SPRN_DBAT5U
++	stw	r4,SL_DBAT5(r1)
++	mfspr	r4,SPRN_DBAT5L
++	stw	r4,SL_DBAT5+4(r1)
++	mfspr	r4,SPRN_DBAT6U
++	stw	r4,SL_DBAT6(r1)
++	mfspr	r4,SPRN_DBAT6L
++	stw	r4,SL_DBAT6+4(r1)
++	mfspr	r4,SPRN_DBAT7U
++	stw	r4,SL_DBAT7(r1)
++	mfspr	r4,SPRN_DBAT7L
++	stw	r4,SL_DBAT7+4(r1)
++	mfspr	r4,SPRN_IBAT4U
++	stw	r4,SL_IBAT4(r1)
++	mfspr	r4,SPRN_IBAT4L
++	stw	r4,SL_IBAT4+4(r1)
++	mfspr	r4,SPRN_IBAT5U
++	stw	r4,SL_IBAT5(r1)
++	mfspr	r4,SPRN_IBAT5L
++	stw	r4,SL_IBAT5+4(r1)
++	mfspr	r4,SPRN_IBAT6U
++	stw	r4,SL_IBAT6(r1)
++	mfspr	r4,SPRN_IBAT6L
++	stw	r4,SL_IBAT6+4(r1)
++	mfspr	r4,SPRN_IBAT7U
++	stw	r4,SL_IBAT7(r1)
++	mfspr	r4,SPRN_IBAT7L
++	stw	r4,SL_IBAT7+4(r1)
++END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
++
+ 	/* Backup various CPU config stuffs */
+ 	bl	__save_cpu_setup
+ 
+@@ -325,22 +368,37 @@ grackle_wake_up:
+ 	mtibatl	3,r4
+ 
+ BEGIN_MMU_FTR_SECTION
+-	li	r4,0
++	lwz	r4,SL_DBAT4(r1)
+ 	mtspr	SPRN_DBAT4U,r4
++	lwz	r4,SL_DBAT4+4(r1)
+ 	mtspr	SPRN_DBAT4L,r4
++	lwz	r4,SL_DBAT5(r1)
+ 	mtspr	SPRN_DBAT5U,r4
++	lwz	r4,SL_DBAT5+4(r1)
+ 	mtspr	SPRN_DBAT5L,r4
++	lwz	r4,SL_DBAT6(r1)
+ 	mtspr	SPRN_DBAT6U,r4
++	lwz	r4,SL_DBAT6+4(r1)
+ 	mtspr	SPRN_DBAT6L,r4
++	lwz	r4,SL_DBAT7(r1)
+ 	mtspr	SPRN_DBAT7U,r4
++	lwz	r4,SL_DBAT7+4(r1)
+ 	mtspr	SPRN_DBAT7L,r4
++	lwz	r4,SL_IBAT4(r1)
+ 	mtspr	SPRN_IBAT4U,r4
++	lwz	r4,SL_IBAT4+4(r1)
+ 	mtspr	SPRN_IBAT4L,r4
++	lwz	r4,SL_IBAT5(r1)
+ 	mtspr	SPRN_IBAT5U,r4
++	lwz	r4,SL_IBAT5+4(r1)
+ 	mtspr	SPRN_IBAT5L,r4
++	lwz	r4,SL_IBAT6(r1)
+ 	mtspr	SPRN_IBAT6U,r4
++	lwz	r4,SL_IBAT6+4(r1)
+ 	mtspr	SPRN_IBAT6L,r4
++	lwz	r4,SL_IBAT7(r1)
+ 	mtspr	SPRN_IBAT7U,r4
++	lwz	r4,SL_IBAT7+4(r1)
+ 	mtspr	SPRN_IBAT7L,r4
+ END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
+ 
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index fbea7db043fa..4addc552eb33 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -9,6 +9,7 @@
+  * 2 as published by the Free Software Foundation.
+  */
+ 
++#include <linux/cpu.h>
+ #include <linux/kernel.h>
+ #include <linux/kobject.h>
+ #include <linux/smp.h>
+@@ -343,11 +344,19 @@ void post_mobility_fixup(void)
+ 	if (rc)
+ 		printk(KERN_ERR "Post-mobility activate-fw failed: %d\n", rc);
+ 
++	/*
++	 * We don't want CPUs to go online/offline while the device
++	 * tree is being updated.
++	 */
++	cpus_read_lock();
++
+ 	rc = pseries_devicetree_update(MIGRATION_SCOPE);
+ 	if (rc)
+ 		printk(KERN_ERR "Post-mobility device tree update "
+ 			"failed: %d\n", rc);
+ 
++	cpus_read_unlock();
++
+ 	/* Possibly switch to a new RFI flush type */
+ 	pseries_setup_rfi_flush();
+ 
+diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
+index a3b8d7d1316e..818fc5351591 100644
+--- a/arch/powerpc/sysdev/xive/common.c
++++ b/arch/powerpc/sysdev/xive/common.c
+@@ -482,7 +482,7 @@ static int xive_find_target_in_mask(const struct cpumask *mask,
+ 	 * Now go through the entire mask until we find a valid
+ 	 * target.
+ 	 */
+-	for (;;) {
++	do {
+ 		/*
+ 		 * We re-check online as the fallback case passes us
+ 		 * an untested affinity mask
+@@ -490,12 +490,11 @@ static int xive_find_target_in_mask(const struct cpumask *mask,
+ 		if (cpu_online(cpu) && xive_try_pick_target(cpu))
+ 			return cpu;
+ 		cpu = cpumask_next(cpu, mask);
+-		if (cpu == first)
+-			break;
+ 		/* Wrap around */
+ 		if (cpu >= nr_cpu_ids)
+ 			cpu = cpumask_first(mask);
+-	}
++	} while (cpu != first);
++
+ 	return -1;
+ }
+ 
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index f752f771f29d..6b9038a3e79f 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -465,8 +465,10 @@ static int xmon_core(struct pt_regs *regs, int fromipi)
+ 	local_irq_save(flags);
+ 	hard_irq_disable();
+ 
+-	tracing_enabled = tracing_is_on();
+-	tracing_off();
++	if (!fromipi) {
++		tracing_enabled = tracing_is_on();
++		tracing_off();
++	}
+ 
+ 	bp = in_breakpoint_table(regs->nip, &offset);
+ 	if (bp != NULL) {
+diff --git a/arch/sh/include/asm/io.h b/arch/sh/include/asm/io.h
+index 98cb8c802b1a..0ae60d680000 100644
+--- a/arch/sh/include/asm/io.h
++++ b/arch/sh/include/asm/io.h
+@@ -371,7 +371,11 @@ static inline int iounmap_fixed(void __iomem *addr) { return -EINVAL; }
+ 
+ #define ioremap_nocache	ioremap
+ #define ioremap_uc	ioremap
+-#define iounmap		__iounmap
++
++static inline void iounmap(void __iomem *addr)
++{
++	__iounmap(addr);
++}
+ 
+ /*
+  * Convert a physical pointer to a virtual kernel pointer for /dev/mem
+diff --git a/arch/um/include/asm/mmu_context.h b/arch/um/include/asm/mmu_context.h
+index fca34b2177e2..129fb1d1f1c5 100644
+--- a/arch/um/include/asm/mmu_context.h
++++ b/arch/um/include/asm/mmu_context.h
+@@ -53,7 +53,7 @@ static inline void activate_mm(struct mm_struct *old, struct mm_struct *new)
+ 	 * when the new ->mm is used for the first time.
+ 	 */
+ 	__switch_mm(&new->context.id);
+-	down_write(&new->mmap_sem);
++	down_write_nested(&new->mmap_sem, 1);
+ 	uml_setup_stubs(new);
+ 	up_write(&new->mmap_sem);
+ }
+diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c
+index 4e1d7483b78c..baa7e36073f9 100644
+--- a/arch/x86/events/amd/uncore.c
++++ b/arch/x86/events/amd/uncore.c
+@@ -19,6 +19,7 @@
+ #include <asm/cpufeature.h>
+ #include <asm/perf_event.h>
+ #include <asm/msr.h>
++#include <asm/smp.h>
+ 
+ #define NUM_COUNTERS_NB		4
+ #define NUM_COUNTERS_L2		4
+@@ -209,15 +210,22 @@ static int amd_uncore_event_init(struct perf_event *event)
+ 	hwc->config = event->attr.config & AMD64_RAW_EVENT_MASK_NB;
+ 	hwc->idx = -1;
+ 
++	if (event->cpu < 0)
++		return -EINVAL;
++
+ 	/*
+ 	 * SliceMask and ThreadMask need to be set for certain L3 events in
+ 	 * Family 17h. For other events, the two fields do not affect the count.
+ 	 */
+-	if (l3_mask)
+-		hwc->config |= (AMD64_L3_SLICE_MASK | AMD64_L3_THREAD_MASK);
++	if (l3_mask && is_llc_event(event)) {
++		int thread = 2 * (cpu_data(event->cpu).cpu_core_id % 4);
+ 
+-	if (event->cpu < 0)
+-		return -EINVAL;
++		if (smp_num_siblings > 1)
++			thread += cpu_data(event->cpu).apicid & 1;
++
++		hwc->config |= (1ULL << (AMD64_L3_THREAD_SHIFT + thread) &
++				AMD64_L3_THREAD_MASK) | AMD64_L3_SLICE_MASK;
++	}
+ 
+ 	uncore = event_to_amd_uncore(event);
+ 	if (!uncore)
+@@ -407,26 +415,8 @@ static int amd_uncore_cpu_starting(unsigned int cpu)
+ 	}
+ 
+ 	if (amd_uncore_llc) {
+-		unsigned int apicid = cpu_data(cpu).apicid;
+-		unsigned int nshared, subleaf, prev_eax = 0;
+-
+ 		uncore = *per_cpu_ptr(amd_uncore_llc, cpu);
+-		/*
+-		 * Iterate over Cache Topology Definition leaves until no
+-		 * more cache descriptions are available.
+-		 */
+-		for (subleaf = 0; subleaf < 5; subleaf++) {
+-			cpuid_count(0x8000001d, subleaf, &eax, &ebx, &ecx, &edx);
+-
+-			/* EAX[0:4] gives type of cache */
+-			if (!(eax & 0x1f))
+-				break;
+-
+-			prev_eax = eax;
+-		}
+-		nshared = ((prev_eax >> 14) & 0xfff) + 1;
+-
+-		uncore->id = apicid - (apicid % nshared);
++		uncore->id = per_cpu(cpu_llc_id, cpu);
+ 
+ 		uncore = amd_uncore_find_online_sibling(uncore, amd_uncore_llc);
+ 		*per_cpu_ptr(amd_uncore_llc, cpu) = uncore;
+diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
+index 72759f131cc5..d09dd91dd0b6 100644
+--- a/arch/x86/include/asm/atomic.h
++++ b/arch/x86/include/asm/atomic.h
+@@ -50,7 +50,7 @@ static __always_inline void atomic_add(int i, atomic_t *v)
+ {
+ 	asm volatile(LOCK_PREFIX "addl %1,%0"
+ 		     : "+m" (v->counter)
+-		     : "ir" (i));
++		     : "ir" (i) : "memory");
+ }
+ 
+ /**
+@@ -64,7 +64,7 @@ static __always_inline void atomic_sub(int i, atomic_t *v)
+ {
+ 	asm volatile(LOCK_PREFIX "subl %1,%0"
+ 		     : "+m" (v->counter)
+-		     : "ir" (i));
++		     : "ir" (i) : "memory");
+ }
+ 
+ /**
+@@ -90,7 +90,7 @@ static __always_inline bool atomic_sub_and_test(int i, atomic_t *v)
+ static __always_inline void atomic_inc(atomic_t *v)
+ {
+ 	asm volatile(LOCK_PREFIX "incl %0"
+-		     : "+m" (v->counter));
++		     : "+m" (v->counter) :: "memory");
+ }
+ 
+ /**
+@@ -102,7 +102,7 @@ static __always_inline void atomic_inc(atomic_t *v)
+ static __always_inline void atomic_dec(atomic_t *v)
+ {
+ 	asm volatile(LOCK_PREFIX "decl %0"
+-		     : "+m" (v->counter));
++		     : "+m" (v->counter) :: "memory");
+ }
+ 
+ /**
+diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
+index 738495caf05f..e6fad6bbb2ee 100644
+--- a/arch/x86/include/asm/atomic64_64.h
++++ b/arch/x86/include/asm/atomic64_64.h
+@@ -45,7 +45,7 @@ static __always_inline void atomic64_add(long i, atomic64_t *v)
+ {
+ 	asm volatile(LOCK_PREFIX "addq %1,%0"
+ 		     : "=m" (v->counter)
+-		     : "er" (i), "m" (v->counter));
++		     : "er" (i), "m" (v->counter) : "memory");
+ }
+ 
+ /**
+@@ -59,7 +59,7 @@ static inline void atomic64_sub(long i, atomic64_t *v)
+ {
+ 	asm volatile(LOCK_PREFIX "subq %1,%0"
+ 		     : "=m" (v->counter)
+-		     : "er" (i), "m" (v->counter));
++		     : "er" (i), "m" (v->counter) : "memory");
+ }
+ 
+ /**
+@@ -86,7 +86,7 @@ static __always_inline void atomic64_inc(atomic64_t *v)
+ {
+ 	asm volatile(LOCK_PREFIX "incq %0"
+ 		     : "=m" (v->counter)
+-		     : "m" (v->counter));
++		     : "m" (v->counter) : "memory");
+ }
+ 
+ /**
+@@ -99,7 +99,7 @@ static __always_inline void atomic64_dec(atomic64_t *v)
+ {
+ 	asm volatile(LOCK_PREFIX "decq %0"
+ 		     : "=m" (v->counter)
+-		     : "m" (v->counter));
++		     : "m" (v->counter) : "memory");
+ }
+ 
+ /**
+diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
+index a04f0c242a28..bc88797cfa61 100644
+--- a/arch/x86/include/asm/barrier.h
++++ b/arch/x86/include/asm/barrier.h
+@@ -106,8 +106,8 @@ do {									\
+ #endif
+ 
+ /* Atomic operations are already serializing on x86 */
+-#define __smp_mb__before_atomic()	barrier()
+-#define __smp_mb__after_atomic()	barrier()
++#define __smp_mb__before_atomic()	do { } while (0)
++#define __smp_mb__after_atomic()	do { } while (0)
+ 
+ #include <asm-generic/barrier.h>
+ 
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index 48ef9ed8226d..4cb8315c521f 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -239,12 +239,14 @@
+ #define X86_FEATURE_BMI1		( 9*32+ 3) /* 1st group bit manipulation extensions */
+ #define X86_FEATURE_HLE			( 9*32+ 4) /* Hardware Lock Elision */
+ #define X86_FEATURE_AVX2		( 9*32+ 5) /* AVX2 instructions */
++#define X86_FEATURE_FDP_EXCPTN_ONLY	( 9*32+ 6) /* "" FPU data pointer updated only on x87 exceptions */
+ #define X86_FEATURE_SMEP		( 9*32+ 7) /* Supervisor Mode Execution Protection */
+ #define X86_FEATURE_BMI2		( 9*32+ 8) /* 2nd group bit manipulation extensions */
+ #define X86_FEATURE_ERMS		( 9*32+ 9) /* Enhanced REP MOVSB/STOSB instructions */
+ #define X86_FEATURE_INVPCID		( 9*32+10) /* Invalidate Processor Context ID */
+ #define X86_FEATURE_RTM			( 9*32+11) /* Restricted Transactional Memory */
+ #define X86_FEATURE_CQM			( 9*32+12) /* Cache QoS Monitoring */
++#define X86_FEATURE_ZERO_FCS_FDS	( 9*32+13) /* "" Zero out FPU CS and FPU DS */
+ #define X86_FEATURE_MPX			( 9*32+14) /* Memory Protection Extension */
+ #define X86_FEATURE_RDT_A		( 9*32+15) /* Resource Director Technology Allocation */
+ #define X86_FEATURE_AVX512F		( 9*32+16) /* AVX-512 Foundation */
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 3b44d39aca1d..64b6180ce162 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -1196,7 +1196,7 @@ static ssize_t l1tf_show_state(char *buf)
+ 
+ static ssize_t mds_show_state(char *buf)
+ {
+-	if (!hypervisor_is_type(X86_HYPER_NATIVE)) {
++	if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) {
+ 		return sprintf(buf, "%s; SMT Host state unknown\n",
+ 			       mds_strings[mds_mitigation]);
+ 	}
+diff --git a/arch/x86/kernel/cpu/mkcapflags.sh b/arch/x86/kernel/cpu/mkcapflags.sh
+index d0dfb892c72f..aed45b8895d5 100644
+--- a/arch/x86/kernel/cpu/mkcapflags.sh
++++ b/arch/x86/kernel/cpu/mkcapflags.sh
+@@ -4,6 +4,8 @@
+ # Generate the x86_cap/bug_flags[] arrays from include/asm/cpufeatures.h
+ #
+ 
++set -e
++
+ IN=$1
+ OUT=$2
+ 
+diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
+index 1c52acaa5bec..236abf77994b 100644
+--- a/arch/x86/kernel/mpparse.c
++++ b/arch/x86/kernel/mpparse.c
+@@ -544,17 +544,15 @@ void __init default_get_smp_config(unsigned int early)
+ 			 * local APIC has default address
+ 			 */
+ 			mp_lapic_addr = APIC_DEFAULT_PHYS_BASE;
+-			return;
++			goto out;
+ 		}
+ 
+ 		pr_info("Default MP configuration #%d\n", mpf->feature1);
+ 		construct_default_ISA_mptable(mpf->feature1);
+ 
+ 	} else if (mpf->physptr) {
+-		if (check_physptr(mpf, early)) {
+-			early_memunmap(mpf, sizeof(*mpf));
+-			return;
+-		}
++		if (check_physptr(mpf, early))
++			goto out;
+ 	} else
+ 		BUG();
+ 
+@@ -563,7 +561,7 @@ void __init default_get_smp_config(unsigned int early)
+ 	/*
+ 	 * Only use the first configuration found.
+ 	 */
+-
++out:
+ 	early_memunmap(mpf, sizeof(*mpf));
+ }
+ 
+diff --git a/arch/x86/kernel/sysfb_efi.c b/arch/x86/kernel/sysfb_efi.c
+index 623965e86b65..897da526e40e 100644
+--- a/arch/x86/kernel/sysfb_efi.c
++++ b/arch/x86/kernel/sysfb_efi.c
+@@ -231,9 +231,55 @@ static const struct dmi_system_id efifb_dmi_system_table[] __initconst = {
+ 	{},
+ };
+ 
++/*
++ * Some devices have a portrait LCD but advertise a landscape resolution (and
++ * pitch). We simply swap width and height for these devices so that we can
++ * correctly deal with some of them coming with multiple resolutions.
++ */
++static const struct dmi_system_id efifb_dmi_swap_width_height[] __initconst = {
++	{
++		/*
++		 * Lenovo MIIX310-10ICR, only some batches have the troublesome
++		 * 800x1280 portrait screen. Luckily the portrait version has
++		 * its own BIOS version, so we match on that.
++		 */
++		.matches = {
++			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "MIIX 310-10ICR"),
++			DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1HCN44WW"),
++		},
++	},
++	{
++		/* Lenovo MIIX 320-10ICR with 800x1280 portrait screen */
++		.matches = {
++			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_VERSION,
++					"Lenovo MIIX 320-10ICR"),
++		},
++	},
++	{
++		/* Lenovo D330 with 800x1280 or 1200x1920 portrait screen */
++		.matches = {
++			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_VERSION,
++					"Lenovo ideapad D330-10IGM"),
++		},
++	},
++	{},
++};
++
+ __init void sysfb_apply_efi_quirks(void)
+ {
+ 	if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI ||
+ 	    !(screen_info.capabilities & VIDEO_CAPABILITY_SKIP_QUIRKS))
+ 		dmi_check_system(efifb_dmi_system_table);
++
++	if (screen_info.orig_video_isVGA == VIDEO_TYPE_EFI &&
++	    dmi_check_system(efifb_dmi_swap_width_height)) {
++		u16 temp = screen_info.lfb_width;
++
++		screen_info.lfb_width = screen_info.lfb_height;
++		screen_info.lfb_height = temp;
++		screen_info.lfb_linelength = 4 * screen_info.lfb_width;
++	}
+ }
+diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
+index 026db42a86c3..1bca8016ee8a 100644
+--- a/arch/x86/kvm/pmu.c
++++ b/arch/x86/kvm/pmu.c
+@@ -131,8 +131,8 @@ static void pmc_reprogram_counter(struct kvm_pmc *pmc, u32 type,
+ 						 intr ? kvm_perf_overflow_intr :
+ 						 kvm_perf_overflow, pmc);
+ 	if (IS_ERR(event)) {
+-		printk_once("kvm_pmu: event creation failed %ld\n",
+-			    PTR_ERR(event));
++		pr_debug_ratelimited("kvm_pmu: event creation failed %ld for pmc->idx = %d\n",
++			    PTR_ERR(event), pmc->idx);
+ 		return;
+ 	}
+ 
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 9b2486e8ec00..ae484edcf7a3 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -7694,6 +7694,7 @@ static void vmx_disable_shadow_vmcs(struct vcpu_vmx *vmx)
+ {
+ 	vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL, SECONDARY_EXEC_SHADOW_VMCS);
+ 	vmcs_write64(VMCS_LINK_POINTER, -1ull);
++	vmx->nested.sync_shadow_vmcs = false;
+ }
+ 
+ static inline void nested_release_vmcs12(struct vcpu_vmx *vmx)
+@@ -7705,7 +7706,6 @@ static inline void nested_release_vmcs12(struct vcpu_vmx *vmx)
+ 		/* copy to memory all shadowed fields in case
+ 		   they were modified */
+ 		copy_shadow_to_vmcs12(vmx);
+-		vmx->nested.sync_shadow_vmcs = false;
+ 		vmx_disable_shadow_vmcs(vmx);
+ 	}
+ 	vmx->nested.posted_intr_nv = -1;
+@@ -7891,6 +7891,9 @@ static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx)
+ 	const unsigned long *fields = shadow_read_write_fields;
+ 	const int num_fields = max_shadow_read_write_fields;
+ 
++	if (WARN_ON(!shadow_vmcs))
++		return;
++
+ 	preempt_disable();
+ 
+ 	vmcs_load(shadow_vmcs);
+@@ -7938,6 +7941,9 @@ static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)
+ 	u64 field_value = 0;
+ 	struct vmcs *shadow_vmcs = vmx->vmcs01.shadow_vmcs;
+ 
++	if (WARN_ON(!shadow_vmcs))
++		return;
++
+ 	vmcs_load(shadow_vmcs);
+ 
+ 	for (q = 0; q < ARRAY_SIZE(fields); q++) {
+diff --git a/block/bio-integrity.c b/block/bio-integrity.c
+index 5df32907ff3b..7f8010662437 100644
+--- a/block/bio-integrity.c
++++ b/block/bio-integrity.c
+@@ -313,8 +313,12 @@ bool bio_integrity_prep(struct bio *bio)
+ 		ret = bio_integrity_add_page(bio, virt_to_page(buf),
+ 					     bytes, offset);
+ 
+-		if (ret == 0)
+-			return false;
++		if (ret == 0) {
++			printk(KERN_ERR "could not attach integrity payload\n");
++			kfree(buf);
++			status = BLK_STS_RESOURCE;
++			goto err_end_io;
++		}
+ 
+ 		if (ret < bytes)
+ 			break;
+diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
+index f3702e533ff4..d8a73d94bb30 100644
+--- a/crypto/asymmetric_keys/Kconfig
++++ b/crypto/asymmetric_keys/Kconfig
+@@ -15,6 +15,7 @@ config ASYMMETRIC_PUBLIC_KEY_SUBTYPE
+ 	select MPILIB
+ 	select CRYPTO_HASH_INFO
+ 	select CRYPTO_AKCIPHER
++	select CRYPTO_HASH
+ 	help
+ 	  This option provides support for asymmetric public key type handling.
+ 	  If signature generation and/or verification are to be used,
+@@ -34,6 +35,7 @@ config X509_CERTIFICATE_PARSER
+ config PKCS7_MESSAGE_PARSER
+ 	tristate "PKCS#7 message parser"
+ 	depends on X509_CERTIFICATE_PARSER
++	select CRYPTO_HASH
+ 	select ASN1
+ 	select OID_REGISTRY
+ 	help
+@@ -56,6 +58,7 @@ config SIGNED_PE_FILE_VERIFICATION
+ 	bool "Support for PE file signature verification"
+ 	depends on PKCS7_MESSAGE_PARSER=y
+ 	depends on SYSTEM_DATA_VERIFICATION
++	select CRYPTO_HASH
+ 	select ASN1
+ 	select OID_REGISTRY
+ 	help
+diff --git a/crypto/chacha20poly1305.c b/crypto/chacha20poly1305.c
+index 4d6f51bcdfab..af8afe5c06ea 100644
+--- a/crypto/chacha20poly1305.c
++++ b/crypto/chacha20poly1305.c
+@@ -67,6 +67,8 @@ struct chachapoly_req_ctx {
+ 	unsigned int cryptlen;
+ 	/* Actual AD, excluding IV */
+ 	unsigned int assoclen;
++	/* request flags, with MAY_SLEEP cleared if needed */
++	u32 flags;
+ 	union {
+ 		struct poly_req poly;
+ 		struct chacha_req chacha;
+@@ -76,8 +78,12 @@ struct chachapoly_req_ctx {
+ static inline void async_done_continue(struct aead_request *req, int err,
+ 				       int (*cont)(struct aead_request *))
+ {
+-	if (!err)
++	if (!err) {
++		struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
++
++		rctx->flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
+ 		err = cont(req);
++	}
+ 
+ 	if (err != -EINPROGRESS && err != -EBUSY)
+ 		aead_request_complete(req, err);
+@@ -144,7 +150,7 @@ static int chacha_decrypt(struct aead_request *req)
+ 		dst = scatterwalk_ffwd(rctx->dst, req->dst, req->assoclen);
+ 	}
+ 
+-	skcipher_request_set_callback(&creq->req, aead_request_flags(req),
++	skcipher_request_set_callback(&creq->req, rctx->flags,
+ 				      chacha_decrypt_done, req);
+ 	skcipher_request_set_tfm(&creq->req, ctx->chacha);
+ 	skcipher_request_set_crypt(&creq->req, src, dst,
+@@ -188,7 +194,7 @@ static int poly_tail(struct aead_request *req)
+ 	memcpy(&preq->tail.cryptlen, &len, sizeof(len));
+ 	sg_set_buf(preq->src, &preq->tail, sizeof(preq->tail));
+ 
+-	ahash_request_set_callback(&preq->req, aead_request_flags(req),
++	ahash_request_set_callback(&preq->req, rctx->flags,
+ 				   poly_tail_done, req);
+ 	ahash_request_set_tfm(&preq->req, ctx->poly);
+ 	ahash_request_set_crypt(&preq->req, preq->src,
+@@ -219,7 +225,7 @@ static int poly_cipherpad(struct aead_request *req)
+ 	sg_init_table(preq->src, 1);
+ 	sg_set_buf(preq->src, &preq->pad, padlen);
+ 
+-	ahash_request_set_callback(&preq->req, aead_request_flags(req),
++	ahash_request_set_callback(&preq->req, rctx->flags,
+ 				   poly_cipherpad_done, req);
+ 	ahash_request_set_tfm(&preq->req, ctx->poly);
+ 	ahash_request_set_crypt(&preq->req, preq->src, NULL, padlen);
+@@ -250,7 +256,7 @@ static int poly_cipher(struct aead_request *req)
+ 	sg_init_table(rctx->src, 2);
+ 	crypt = scatterwalk_ffwd(rctx->src, crypt, req->assoclen);
+ 
+-	ahash_request_set_callback(&preq->req, aead_request_flags(req),
++	ahash_request_set_callback(&preq->req, rctx->flags,
+ 				   poly_cipher_done, req);
+ 	ahash_request_set_tfm(&preq->req, ctx->poly);
+ 	ahash_request_set_crypt(&preq->req, crypt, NULL, rctx->cryptlen);
+@@ -280,7 +286,7 @@ static int poly_adpad(struct aead_request *req)
+ 	sg_init_table(preq->src, 1);
+ 	sg_set_buf(preq->src, preq->pad, padlen);
+ 
+-	ahash_request_set_callback(&preq->req, aead_request_flags(req),
++	ahash_request_set_callback(&preq->req, rctx->flags,
+ 				   poly_adpad_done, req);
+ 	ahash_request_set_tfm(&preq->req, ctx->poly);
+ 	ahash_request_set_crypt(&preq->req, preq->src, NULL, padlen);
+@@ -304,7 +310,7 @@ static int poly_ad(struct aead_request *req)
+ 	struct poly_req *preq = &rctx->u.poly;
+ 	int err;
+ 
+-	ahash_request_set_callback(&preq->req, aead_request_flags(req),
++	ahash_request_set_callback(&preq->req, rctx->flags,
+ 				   poly_ad_done, req);
+ 	ahash_request_set_tfm(&preq->req, ctx->poly);
+ 	ahash_request_set_crypt(&preq->req, req->src, NULL, rctx->assoclen);
+@@ -331,7 +337,7 @@ static int poly_setkey(struct aead_request *req)
+ 	sg_init_table(preq->src, 1);
+ 	sg_set_buf(preq->src, rctx->key, sizeof(rctx->key));
+ 
+-	ahash_request_set_callback(&preq->req, aead_request_flags(req),
++	ahash_request_set_callback(&preq->req, rctx->flags,
+ 				   poly_setkey_done, req);
+ 	ahash_request_set_tfm(&preq->req, ctx->poly);
+ 	ahash_request_set_crypt(&preq->req, preq->src, NULL, sizeof(rctx->key));
+@@ -355,7 +361,7 @@ static int poly_init(struct aead_request *req)
+ 	struct poly_req *preq = &rctx->u.poly;
+ 	int err;
+ 
+-	ahash_request_set_callback(&preq->req, aead_request_flags(req),
++	ahash_request_set_callback(&preq->req, rctx->flags,
+ 				   poly_init_done, req);
+ 	ahash_request_set_tfm(&preq->req, ctx->poly);
+ 
+@@ -393,7 +399,7 @@ static int poly_genkey(struct aead_request *req)
+ 
+ 	chacha_iv(creq->iv, req, 0);
+ 
+-	skcipher_request_set_callback(&creq->req, aead_request_flags(req),
++	skcipher_request_set_callback(&creq->req, rctx->flags,
+ 				      poly_genkey_done, req);
+ 	skcipher_request_set_tfm(&creq->req, ctx->chacha);
+ 	skcipher_request_set_crypt(&creq->req, creq->src, creq->src,
+@@ -433,7 +439,7 @@ static int chacha_encrypt(struct aead_request *req)
+ 		dst = scatterwalk_ffwd(rctx->dst, req->dst, req->assoclen);
+ 	}
+ 
+-	skcipher_request_set_callback(&creq->req, aead_request_flags(req),
++	skcipher_request_set_callback(&creq->req, rctx->flags,
+ 				      chacha_encrypt_done, req);
+ 	skcipher_request_set_tfm(&creq->req, ctx->chacha);
+ 	skcipher_request_set_crypt(&creq->req, src, dst,
+@@ -451,6 +457,7 @@ static int chachapoly_encrypt(struct aead_request *req)
+ 	struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
+ 
+ 	rctx->cryptlen = req->cryptlen;
++	rctx->flags = aead_request_flags(req);
+ 
+ 	/* encrypt call chain:
+ 	 * - chacha_encrypt/done()
+@@ -472,6 +479,7 @@ static int chachapoly_decrypt(struct aead_request *req)
+ 	struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
+ 
+ 	rctx->cryptlen = req->cryptlen - POLY1305_DIGEST_SIZE;
++	rctx->flags = aead_request_flags(req);
+ 
+ 	/* decrypt call chain:
+ 	 * - poly_genkey/done()
+diff --git a/crypto/ghash-generic.c b/crypto/ghash-generic.c
+index 12ad3e3a84e3..73b56f2f44f1 100644
+--- a/crypto/ghash-generic.c
++++ b/crypto/ghash-generic.c
+@@ -34,6 +34,7 @@ static int ghash_setkey(struct crypto_shash *tfm,
+ 			const u8 *key, unsigned int keylen)
+ {
+ 	struct ghash_ctx *ctx = crypto_shash_ctx(tfm);
++	be128 k;
+ 
+ 	if (keylen != GHASH_BLOCK_SIZE) {
+ 		crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
+@@ -42,7 +43,12 @@ static int ghash_setkey(struct crypto_shash *tfm,
+ 
+ 	if (ctx->gf128)
+ 		gf128mul_free_4k(ctx->gf128);
+-	ctx->gf128 = gf128mul_init_4k_lle((be128 *)key);
++
++	BUILD_BUG_ON(sizeof(k) != GHASH_BLOCK_SIZE);
++	memcpy(&k, key, GHASH_BLOCK_SIZE); /* avoid violating alignment rules */
++	ctx->gf128 = gf128mul_init_4k_lle(&k);
++	memzero_explicit(&k, GHASH_BLOCK_SIZE);
++
+ 	if (!ctx->gf128)
+ 		return -ENOMEM;
+ 
+diff --git a/crypto/serpent_generic.c b/crypto/serpent_generic.c
+index 7c3382facc82..600bd288881d 100644
+--- a/crypto/serpent_generic.c
++++ b/crypto/serpent_generic.c
+@@ -229,7 +229,13 @@
+ 	x4 ^= x2;					\
+ 	})
+ 
+-static void __serpent_setkey_sbox(u32 r0, u32 r1, u32 r2, u32 r3, u32 r4, u32 *k)
++/*
++ * both gcc and clang have misoptimized this function in the past,
++ * producing horrible object code from spilling temporary variables
++ * on the stack. Forcing this part out of line avoids that.
++ */
++static noinline void __serpent_setkey_sbox(u32 r0, u32 r1, u32 r2,
++					   u32 r3, u32 r4, u32 *k)
+ {
+ 	k += 100;
+ 	S3(r3, r4, r0, r1, r2); store_and_load_keys(r1, r2, r4, r3, 28, 24);
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 1af9f36f89cf..e694fd2c4ed0 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -2785,7 +2785,7 @@ static void binder_transaction(struct binder_proc *proc,
+ 			else
+ 				return_error = BR_DEAD_REPLY;
+ 			mutex_unlock(&context->context_mgr_node_lock);
+-			if (target_node && target_proc == proc) {
++			if (target_node && target_proc->pid == proc->pid) {
+ 				binder_user_error("%d:%d got transaction to context manager from process owning it\n",
+ 						  proc->pid, thread->pid);
+ 				return_error = BR_FAILED_REPLY;
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 2651c81d1edf..c398be4b1797 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -1535,7 +1535,7 @@ static int ata_eh_read_log_10h(struct ata_device *dev,
+ 	tf->hob_lbah = buf[10];
+ 	tf->nsect = buf[12];
+ 	tf->hob_nsect = buf[13];
+-	if (ata_id_has_ncq_autosense(dev->id))
++	if (dev->class == ATA_DEV_ZAC && ata_id_has_ncq_autosense(dev->id))
+ 		tf->auxiliary = buf[14] << 16 | buf[15] << 8 | buf[16];
+ 
+ 	return 0;
+@@ -1784,7 +1784,8 @@ void ata_eh_analyze_ncq_error(struct ata_link *link)
+ 	memcpy(&qc->result_tf, &tf, sizeof(tf));
+ 	qc->result_tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_LBA | ATA_TFLAG_LBA48;
+ 	qc->err_mask |= AC_ERR_DEV | AC_ERR_NCQ;
+-	if ((qc->result_tf.command & ATA_SENSE) || qc->result_tf.auxiliary) {
++	if (dev->class == ATA_DEV_ZAC &&
++	    ((qc->result_tf.command & ATA_SENSE) || qc->result_tf.auxiliary)) {
+ 		char sense_key, asc, ascq;
+ 
+ 		sense_key = (qc->result_tf.auxiliary >> 16) & 0xff;
+@@ -1838,10 +1839,11 @@ static unsigned int ata_eh_analyze_tf(struct ata_queued_cmd *qc,
+ 	}
+ 
+ 	switch (qc->dev->class) {
+-	case ATA_DEV_ATA:
+ 	case ATA_DEV_ZAC:
+ 		if (stat & ATA_SENSE)
+ 			ata_eh_request_sense(qc, qc->scsicmd);
++		/* fall through */
++	case ATA_DEV_ATA:
+ 		if (err & ATA_ICRC)
+ 			qc->err_mask |= AC_ERR_ATA_BUS;
+ 		if (err & (ATA_UNC | ATA_AMNF))
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 8fd08023c0f5..013d0a2b3ba0 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1509,6 +1509,8 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
+ 					     map->format.reg_bytes +
+ 					     map->format.pad_bytes,
+ 					     val, val_len);
++	else
++		ret = -ENOTSUPP;
+ 
+ 	/* If that didn't work fall back on linearising by hand. */
+ 	if (ret == -ENOTSUPP) {
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index 3ea9c3e9acb3..a9d1430fc5ee 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -2114,6 +2114,9 @@ static void setup_format_params(int track)
+ 	raw_cmd->kernel_data = floppy_track_buffer;
+ 	raw_cmd->length = 4 * F_SECT_PER_TRACK;
+ 
++	if (!F_SECT_PER_TRACK)
++		return;
++
+ 	/* allow for about 30ms for data transport per track */
+ 	head_shift = (F_SECT_PER_TRACK + 5) / 6;
+ 
+@@ -3236,8 +3239,12 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
+ 	int cnt;
+ 
+ 	/* sanity checking for parameters. */
+-	if (g->sect <= 0 ||
+-	    g->head <= 0 ||
++	if ((int)g->sect <= 0 ||
++	    (int)g->head <= 0 ||
++	    /* check for overflow in max_sector */
++	    (int)(g->sect * g->head) <= 0 ||
++	    /* check for zero in F_SECT_PER_TRACK */
++	    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
+ 	    g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||
+ 	    /* check if reserved bits are set */
+ 	    (g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0)
+@@ -3381,6 +3388,24 @@ static int fd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
+ 	return 0;
+ }
+ 
++static bool valid_floppy_drive_params(const short autodetect[8],
++		int native_format)
++{
++	size_t floppy_type_size = ARRAY_SIZE(floppy_type);
++	size_t i = 0;
++
++	for (i = 0; i < 8; ++i) {
++		if (autodetect[i] < 0 ||
++		    autodetect[i] >= floppy_type_size)
++			return false;
++	}
++
++	if (native_format < 0 || native_format >= floppy_type_size)
++		return false;
++
++	return true;
++}
++
+ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd,
+ 		    unsigned long param)
+ {
+@@ -3507,6 +3532,9 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
+ 		SUPBOUND(size, strlen((const char *)outparam) + 1);
+ 		break;
+ 	case FDSETDRVPRM:
++		if (!valid_floppy_drive_params(inparam.dp.autodetect,
++				inparam.dp.native_format))
++			return -EINVAL;
+ 		*UDP = inparam.dp;
+ 		break;
+ 	case FDGETDRVPRM:
+@@ -3704,6 +3732,8 @@ static int compat_setdrvprm(int drive,
+ 		return -EPERM;
+ 	if (copy_from_user(&v, arg, sizeof(struct compat_floppy_drive_params)))
+ 		return -EFAULT;
++	if (!valid_floppy_drive_params(v.autodetect, v.native_format))
++		return -EINVAL;
+ 	mutex_lock(&floppy_mutex);
+ 	UDP->cmos = v.cmos;
+ 	UDP->max_dtr = v.max_dtr;
+diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
+index d880f4e33c75..57a7f4255ac0 100644
+--- a/drivers/bluetooth/hci_bcsp.c
++++ b/drivers/bluetooth/hci_bcsp.c
+@@ -757,6 +757,11 @@ static int bcsp_close(struct hci_uart *hu)
+ 	skb_queue_purge(&bcsp->rel);
+ 	skb_queue_purge(&bcsp->unrel);
+ 
++	if (bcsp->rx_skb) {
++		kfree_skb(bcsp->rx_skb);
++		bcsp->rx_skb = NULL;
++	}
++
+ 	kfree(bcsp);
+ 	return 0;
+ }
+diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
+index 9dfb28b04559..05ca269ddd05 100644
+--- a/drivers/char/hpet.c
++++ b/drivers/char/hpet.c
+@@ -570,8 +570,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
+ 	unsigned long long m;
+ 
+ 	m = hpets->hp_tick_freq + (dis >> 1);
+-	do_div(m, dis);
+-	return (unsigned long)m;
++	return div64_ul(m, dis);
+ }
+ 
+ static int
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index d55c30f6981d..aaf5bfa9bd9c 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -211,7 +211,7 @@ static void exynos4_frc_resume(struct clocksource *cs)
+ 
+ static struct clocksource mct_frc = {
+ 	.name		= "mct-frc",
+-	.rating		= 400,
++	.rating		= 450,	/* use value higher than ARM arch timer */
+ 	.read		= exynos4_frc_read,
+ 	.mask		= CLOCKSOURCE_MASK(32),
+ 	.flags		= CLOCK_SOURCE_IS_CONTINUOUS,
+@@ -466,7 +466,7 @@ static int exynos4_mct_starting_cpu(unsigned int cpu)
+ 	evt->set_state_oneshot_stopped = set_state_shutdown;
+ 	evt->tick_resume = set_state_shutdown;
+ 	evt->features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
+-	evt->rating = 450;
++	evt->rating = 500;	/* use value higher than ARM arch timer */
+ 
+ 	exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
+ 
+diff --git a/drivers/crypto/amcc/crypto4xx_trng.c b/drivers/crypto/amcc/crypto4xx_trng.c
+index 368c5599515e..a194ee0ddbb6 100644
+--- a/drivers/crypto/amcc/crypto4xx_trng.c
++++ b/drivers/crypto/amcc/crypto4xx_trng.c
+@@ -111,7 +111,6 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev)
+ 	return;
+ 
+ err_out:
+-	of_node_put(trng);
+ 	iounmap(dev->trng_base);
+ 	kfree(rng);
+ 	dev->trng_base = NULL;
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index 63a21a6fc6cf..78feafcb7083 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -853,6 +853,7 @@ static void ablkcipher_encrypt_done(struct device *jrdev, u32 *desc, u32 err,
+ 	struct ablkcipher_request *req = context;
+ 	struct ablkcipher_edesc *edesc;
+ 	struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req);
++	struct caam_ctx *ctx = crypto_ablkcipher_ctx(ablkcipher);
+ 	int ivsize = crypto_ablkcipher_ivsize(ablkcipher);
+ 
+ #ifdef DEBUG
+@@ -877,10 +878,11 @@ static void ablkcipher_encrypt_done(struct device *jrdev, u32 *desc, u32 err,
+ 
+ 	/*
+ 	 * The crypto API expects us to set the IV (req->info) to the last
+-	 * ciphertext block. This is used e.g. by the CTS mode.
++	 * ciphertext block when running in CBC mode.
+ 	 */
+-	scatterwalk_map_and_copy(req->info, req->dst, req->nbytes - ivsize,
+-				 ivsize, 0);
++	if ((ctx->cdata.algtype & OP_ALG_AAI_MASK) == OP_ALG_AAI_CBC)
++		scatterwalk_map_and_copy(req->info, req->dst, req->nbytes -
++					 ivsize, ivsize, 0);
+ 
+ 	/* In case initial IV was generated, copy it in GIVCIPHER request */
+ 	if (edesc->iv_dir == DMA_FROM_DEVICE) {
+@@ -1609,10 +1611,11 @@ static int ablkcipher_decrypt(struct ablkcipher_request *req)
+ 
+ 	/*
+ 	 * The crypto API expects us to set the IV (req->info) to the last
+-	 * ciphertext block.
++	 * ciphertext block when running in CBC mode.
+ 	 */
+-	scatterwalk_map_and_copy(req->info, req->src, req->nbytes - ivsize,
+-				 ivsize, 0);
++	if ((ctx->cdata.algtype & OP_ALG_AAI_MASK) == OP_ALG_AAI_CBC)
++		scatterwalk_map_and_copy(req->info, req->src, req->nbytes -
++					 ivsize, ivsize, 0);
+ 
+ 	/* Create and submit job descriptor*/
+ 	init_ablkcipher_job(ctx->sh_desc_dec, ctx->sh_desc_dec_dma, edesc, req);
+diff --git a/drivers/crypto/ccp/ccp-dev.c b/drivers/crypto/ccp/ccp-dev.c
+index 4e029b176641..18d10694dd2a 100644
+--- a/drivers/crypto/ccp/ccp-dev.c
++++ b/drivers/crypto/ccp/ccp-dev.c
+@@ -35,56 +35,62 @@ struct ccp_tasklet_data {
+ };
+ 
+ /* Human-readable error strings */
++#define CCP_MAX_ERROR_CODE	64
+ static char *ccp_error_codes[] = {
+ 	"",
+-	"ERR 01: ILLEGAL_ENGINE",
+-	"ERR 02: ILLEGAL_KEY_ID",
+-	"ERR 03: ILLEGAL_FUNCTION_TYPE",
+-	"ERR 04: ILLEGAL_FUNCTION_MODE",
+-	"ERR 05: ILLEGAL_FUNCTION_ENCRYPT",
+-	"ERR 06: ILLEGAL_FUNCTION_SIZE",
+-	"ERR 07: Zlib_MISSING_INIT_EOM",
+-	"ERR 08: ILLEGAL_FUNCTION_RSVD",
+-	"ERR 09: ILLEGAL_BUFFER_LENGTH",
+-	"ERR 10: VLSB_FAULT",
+-	"ERR 11: ILLEGAL_MEM_ADDR",
+-	"ERR 12: ILLEGAL_MEM_SEL",
+-	"ERR 13: ILLEGAL_CONTEXT_ID",
+-	"ERR 14: ILLEGAL_KEY_ADDR",
+-	"ERR 15: 0xF Reserved",
+-	"ERR 16: Zlib_ILLEGAL_MULTI_QUEUE",
+-	"ERR 17: Zlib_ILLEGAL_JOBID_CHANGE",
+-	"ERR 18: CMD_TIMEOUT",
+-	"ERR 19: IDMA0_AXI_SLVERR",
+-	"ERR 20: IDMA0_AXI_DECERR",
+-	"ERR 21: 0x15 Reserved",
+-	"ERR 22: IDMA1_AXI_SLAVE_FAULT",
+-	"ERR 23: IDMA1_AIXI_DECERR",
+-	"ERR 24: 0x18 Reserved",
+-	"ERR 25: ZLIBVHB_AXI_SLVERR",
+-	"ERR 26: ZLIBVHB_AXI_DECERR",
+-	"ERR 27: 0x1B Reserved",
+-	"ERR 27: ZLIB_UNEXPECTED_EOM",
+-	"ERR 27: ZLIB_EXTRA_DATA",
+-	"ERR 30: ZLIB_BTYPE",
+-	"ERR 31: ZLIB_UNDEFINED_SYMBOL",
+-	"ERR 32: ZLIB_UNDEFINED_DISTANCE_S",
+-	"ERR 33: ZLIB_CODE_LENGTH_SYMBOL",
+-	"ERR 34: ZLIB _VHB_ILLEGAL_FETCH",
+-	"ERR 35: ZLIB_UNCOMPRESSED_LEN",
+-	"ERR 36: ZLIB_LIMIT_REACHED",
+-	"ERR 37: ZLIB_CHECKSUM_MISMATCH0",
+-	"ERR 38: ODMA0_AXI_SLVERR",
+-	"ERR 39: ODMA0_AXI_DECERR",
+-	"ERR 40: 0x28 Reserved",
+-	"ERR 41: ODMA1_AXI_SLVERR",
+-	"ERR 42: ODMA1_AXI_DECERR",
+-	"ERR 43: LSB_PARITY_ERR",
++	"ILLEGAL_ENGINE",
++	"ILLEGAL_KEY_ID",
++	"ILLEGAL_FUNCTION_TYPE",
++	"ILLEGAL_FUNCTION_MODE",
++	"ILLEGAL_FUNCTION_ENCRYPT",
++	"ILLEGAL_FUNCTION_SIZE",
++	"Zlib_MISSING_INIT_EOM",
++	"ILLEGAL_FUNCTION_RSVD",
++	"ILLEGAL_BUFFER_LENGTH",
++	"VLSB_FAULT",
++	"ILLEGAL_MEM_ADDR",
++	"ILLEGAL_MEM_SEL",
++	"ILLEGAL_CONTEXT_ID",
++	"ILLEGAL_KEY_ADDR",
++	"0xF Reserved",
++	"Zlib_ILLEGAL_MULTI_QUEUE",
++	"Zlib_ILLEGAL_JOBID_CHANGE",
++	"CMD_TIMEOUT",
++	"IDMA0_AXI_SLVERR",
++	"IDMA0_AXI_DECERR",
++	"0x15 Reserved",
++	"IDMA1_AXI_SLAVE_FAULT",
++	"IDMA1_AIXI_DECERR",
++	"0x18 Reserved",
++	"ZLIBVHB_AXI_SLVERR",
++	"ZLIBVHB_AXI_DECERR",
++	"0x1B Reserved",
++	"ZLIB_UNEXPECTED_EOM",
++	"ZLIB_EXTRA_DATA",
++	"ZLIB_BTYPE",
++	"ZLIB_UNDEFINED_SYMBOL",
++	"ZLIB_UNDEFINED_DISTANCE_S",
++	"ZLIB_CODE_LENGTH_SYMBOL",
++	"ZLIB _VHB_ILLEGAL_FETCH",
++	"ZLIB_UNCOMPRESSED_LEN",
++	"ZLIB_LIMIT_REACHED",
++	"ZLIB_CHECKSUM_MISMATCH0",
++	"ODMA0_AXI_SLVERR",
++	"ODMA0_AXI_DECERR",
++	"0x28 Reserved",
++	"ODMA1_AXI_SLVERR",
++	"ODMA1_AXI_DECERR",
+ };
+ 
+-void ccp_log_error(struct ccp_device *d, int e)
++void ccp_log_error(struct ccp_device *d, unsigned int e)
+ {
+-	dev_err(d->dev, "CCP error: %s (0x%x)\n", ccp_error_codes[e], e);
++	if (WARN_ON(e >= CCP_MAX_ERROR_CODE))
++		return;
++
++	if (e < ARRAY_SIZE(ccp_error_codes))
++		dev_err(d->dev, "CCP error %d: %s\n", e, ccp_error_codes[e]);
++	else
++		dev_err(d->dev, "CCP error %d: Unknown Error\n", e);
+ }
+ 
+ /* List of CCPs, CCP count, read-write access lock, and access functions
+diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
+index 6810b65c1939..7442b0422f8a 100644
+--- a/drivers/crypto/ccp/ccp-dev.h
++++ b/drivers/crypto/ccp/ccp-dev.h
+@@ -632,7 +632,7 @@ struct ccp5_desc {
+ void ccp_add_device(struct ccp_device *ccp);
+ void ccp_del_device(struct ccp_device *ccp);
+ 
+-extern void ccp_log_error(struct ccp_device *, int);
++extern void ccp_log_error(struct ccp_device *, unsigned int);
+ 
+ struct ccp_device *ccp_alloc_struct(struct sp_device *sp);
+ bool ccp_queues_suspended(struct ccp_device *ccp);
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index 406b95329b3d..73e49840305b 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -612,6 +612,7 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+ 
+ 	unsigned long long *final;
+ 	unsigned int dm_offset;
++	unsigned int jobid;
+ 	unsigned int ilen;
+ 	bool in_place = true; /* Default value */
+ 	int ret;
+@@ -650,9 +651,11 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+ 		p_tag = scatterwalk_ffwd(sg_tag, p_inp, ilen);
+ 	}
+ 
++	jobid = CCP_NEW_JOBID(cmd_q->ccp);
++
+ 	memset(&op, 0, sizeof(op));
+ 	op.cmd_q = cmd_q;
+-	op.jobid = CCP_NEW_JOBID(cmd_q->ccp);
++	op.jobid = jobid;
+ 	op.sb_key = cmd_q->sb_key; /* Pre-allocated */
+ 	op.sb_ctx = cmd_q->sb_ctx; /* Pre-allocated */
+ 	op.init = 1;
+@@ -797,6 +800,13 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+ 	final[0] = cpu_to_be64(aes->aad_len * 8);
+ 	final[1] = cpu_to_be64(ilen * 8);
+ 
++	memset(&op, 0, sizeof(op));
++	op.cmd_q = cmd_q;
++	op.jobid = jobid;
++	op.sb_key = cmd_q->sb_key; /* Pre-allocated */
++	op.sb_ctx = cmd_q->sb_ctx; /* Pre-allocated */
++	op.init = 1;
++	op.u.aes.type = aes->type;
+ 	op.u.aes.mode = CCP_AES_MODE_GHASH;
+ 	op.u.aes.action = CCP_AES_GHASHFINAL;
+ 	op.src.type = CCP_MEMTYPE_SYSTEM;
+@@ -822,7 +832,8 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+ 			goto e_tag;
+ 		ccp_set_dm_area(&tag, 0, p_tag, 0, AES_BLOCK_SIZE);
+ 
+-		ret = memcmp(tag.address, final_wa.address, AES_BLOCK_SIZE);
++		ret = crypto_memneq(tag.address, final_wa.address,
++				    AES_BLOCK_SIZE) ? -EBADMSG : 0;
+ 		ccp_dm_free(&tag);
+ 	}
+ 
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 1f8fe1795964..a0cd4f6085d0 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -984,7 +984,6 @@ static void ipsec_esp_encrypt_done(struct device *dev,
+ 	struct crypto_aead *authenc = crypto_aead_reqtfm(areq);
+ 	unsigned int authsize = crypto_aead_authsize(authenc);
+ 	struct talitos_edesc *edesc;
+-	struct scatterlist *sg;
+ 	void *icvdata;
+ 
+ 	edesc = container_of(desc, struct talitos_edesc, desc);
+@@ -998,9 +997,8 @@ static void ipsec_esp_encrypt_done(struct device *dev,
+ 		else
+ 			icvdata = &edesc->link_tbl[edesc->src_nents +
+ 						   edesc->dst_nents + 2];
+-		sg = sg_last(areq->dst, edesc->dst_nents);
+-		memcpy((char *)sg_virt(sg) + sg->length - authsize,
+-		       icvdata, authsize);
++		sg_pcopy_from_buffer(areq->dst, edesc->dst_nents ? : 1, icvdata,
++				     authsize, areq->assoclen + areq->cryptlen);
+ 	}
+ 
+ 	kfree(edesc);
+@@ -1016,7 +1014,6 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev,
+ 	struct crypto_aead *authenc = crypto_aead_reqtfm(req);
+ 	unsigned int authsize = crypto_aead_authsize(authenc);
+ 	struct talitos_edesc *edesc;
+-	struct scatterlist *sg;
+ 	char *oicv, *icv;
+ 	struct talitos_private *priv = dev_get_drvdata(dev);
+ 	bool is_sec1 = has_ftr_sec1(priv);
+@@ -1026,9 +1023,18 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev,
+ 	ipsec_esp_unmap(dev, edesc, req);
+ 
+ 	if (!err) {
++		char icvdata[SHA512_DIGEST_SIZE];
++		int nents = edesc->dst_nents ? : 1;
++		unsigned int len = req->assoclen + req->cryptlen;
++
+ 		/* auth check */
+-		sg = sg_last(req->dst, edesc->dst_nents ? : 1);
+-		icv = (char *)sg_virt(sg) + sg->length - authsize;
++		if (nents > 1) {
++			sg_pcopy_to_buffer(req->dst, nents, icvdata, authsize,
++					   len - authsize);
++			icv = icvdata;
++		} else {
++			icv = (char *)sg_virt(req->dst) + len - authsize;
++		}
+ 
+ 		if (edesc->dma_len) {
+ 			if (is_sec1)
+@@ -1458,7 +1464,6 @@ static int aead_decrypt(struct aead_request *req)
+ 	struct talitos_ctx *ctx = crypto_aead_ctx(authenc);
+ 	struct talitos_private *priv = dev_get_drvdata(ctx->dev);
+ 	struct talitos_edesc *edesc;
+-	struct scatterlist *sg;
+ 	void *icvdata;
+ 
+ 	req->cryptlen -= authsize;
+@@ -1493,9 +1498,8 @@ static int aead_decrypt(struct aead_request *req)
+ 	else
+ 		icvdata = &edesc->link_tbl[0];
+ 
+-	sg = sg_last(req->src, edesc->src_nents ? : 1);
+-
+-	memcpy(icvdata, (char *)sg_virt(sg) + sg->length - authsize, authsize);
++	sg_pcopy_to_buffer(req->src, edesc->src_nents ? : 1, icvdata, authsize,
++			   req->assoclen + req->cryptlen - authsize);
+ 
+ 	return ipsec_esp(edesc, req, ipsec_esp_decrypt_swauth_done);
+ }
+@@ -1544,11 +1548,15 @@ static void ablkcipher_done(struct device *dev,
+ 			    int err)
+ {
+ 	struct ablkcipher_request *areq = context;
++	struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(areq);
++	struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher);
++	unsigned int ivsize = crypto_ablkcipher_ivsize(cipher);
+ 	struct talitos_edesc *edesc;
+ 
+ 	edesc = container_of(desc, struct talitos_edesc, desc);
+ 
+ 	common_nonsnoop_unmap(dev, edesc, areq);
++	memcpy(areq->info, ctx->iv, ivsize);
+ 
+ 	kfree(edesc);
+ 
+@@ -3111,7 +3119,10 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
+ 		alg->cra_priority = t_alg->algt.priority;
+ 	else
+ 		alg->cra_priority = TALITOS_CRA_PRIORITY;
+-	alg->cra_alignmask = 0;
++	if (has_ftr_sec1(priv))
++		alg->cra_alignmask = 3;
++	else
++		alg->cra_alignmask = 0;
+ 	alg->cra_ctxsize = sizeof(struct talitos_ctx);
+ 	alg->cra_flags |= CRYPTO_ALG_KERN_DRIVER_ONLY;
+ 
+diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
+index bc1cb284111c..1195a3d2e67c 100644
+--- a/drivers/dma-buf/dma-buf.c
++++ b/drivers/dma-buf/dma-buf.c
+@@ -1115,6 +1115,7 @@ static int dma_buf_debug_show(struct seq_file *s, void *unused)
+ 				   fence->ops->get_driver_name(fence),
+ 				   fence->ops->get_timeline_name(fence),
+ 				   dma_fence_is_signaled(fence) ? "" : "un");
++			dma_fence_put(fence);
+ 		}
+ 		rcu_read_unlock();
+ 
+diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c
+index 012fa3d1f407..afc66141066d 100644
+--- a/drivers/dma-buf/reservation.c
++++ b/drivers/dma-buf/reservation.c
+@@ -394,6 +394,10 @@ int reservation_object_get_fences_rcu(struct reservation_object *obj,
+ 					   GFP_NOWAIT | __GFP_NOWARN);
+ 			if (!nshared) {
+ 				rcu_read_unlock();
++
++				dma_fence_put(fence_excl);
++				fence_excl = NULL;
++
+ 				nshared = krealloc(shared, sz, GFP_KERNEL);
+ 				if (nshared) {
+ 					shared = nshared;
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index b8e7c2d8915e..0fc12a8783e3 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -1821,27 +1821,6 @@ static int sdma_probe(struct platform_device *pdev)
+ 	if (pdata && pdata->script_addrs)
+ 		sdma_add_scripts(sdma, pdata->script_addrs);
+ 
+-	if (pdata) {
+-		ret = sdma_get_firmware(sdma, pdata->fw_name);
+-		if (ret)
+-			dev_warn(&pdev->dev, "failed to get firmware from platform data\n");
+-	} else {
+-		/*
+-		 * Because that device tree does not encode ROM script address,
+-		 * the RAM script in firmware is mandatory for device tree
+-		 * probe, otherwise it fails.
+-		 */
+-		ret = of_property_read_string(np, "fsl,sdma-ram-script-name",
+-					      &fw_name);
+-		if (ret)
+-			dev_warn(&pdev->dev, "failed to get firmware name\n");
+-		else {
+-			ret = sdma_get_firmware(sdma, fw_name);
+-			if (ret)
+-				dev_warn(&pdev->dev, "failed to get firmware from device tree\n");
+-		}
+-	}
+-
+ 	sdma->dma_device.dev = &pdev->dev;
+ 
+ 	sdma->dma_device.device_alloc_chan_resources = sdma_alloc_chan_resources;
+@@ -1883,6 +1862,33 @@ static int sdma_probe(struct platform_device *pdev)
+ 		of_node_put(spba_bus);
+ 	}
+ 
++	/*
++	 * Kick off firmware loading as the very last step:
++	 * attempt to load firmware only if we're not on the error path, because
++	 * the firmware callback requires a fully functional and allocated sdma
++	 * instance.
++	 */
++	if (pdata) {
++		ret = sdma_get_firmware(sdma, pdata->fw_name);
++		if (ret)
++			dev_warn(&pdev->dev, "failed to get firmware from platform data\n");
++	} else {
++		/*
++		 * Because that device tree does not encode ROM script address,
++		 * the RAM script in firmware is mandatory for device tree
++		 * probe, otherwise it fails.
++		 */
++		ret = of_property_read_string(np, "fsl,sdma-ram-script-name",
++					      &fw_name);
++		if (ret) {
++			dev_warn(&pdev->dev, "failed to get firmware name\n");
++		} else {
++			ret = sdma_get_firmware(sdma, fw_name);
++			if (ret)
++				dev_warn(&pdev->dev, "failed to get firmware from device tree\n");
++		}
++	}
++
+ 	return 0;
+ 
+ err_register:
+diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
+index 79c13301bf41..a4acfa81dfe0 100644
+--- a/drivers/edac/edac_mc_sysfs.c
++++ b/drivers/edac/edac_mc_sysfs.c
+@@ -26,7 +26,7 @@
+ static int edac_mc_log_ue = 1;
+ static int edac_mc_log_ce = 1;
+ static int edac_mc_panic_on_ue;
+-static int edac_mc_poll_msec = 1000;
++static unsigned int edac_mc_poll_msec = 1000;
+ 
+ /* Getter functions for above */
+ int edac_mc_get_log_ue(void)
+@@ -45,30 +45,30 @@ int edac_mc_get_panic_on_ue(void)
+ }
+ 
+ /* this is temporary */
+-int edac_mc_get_poll_msec(void)
++unsigned int edac_mc_get_poll_msec(void)
+ {
+ 	return edac_mc_poll_msec;
+ }
+ 
+ static int edac_set_poll_msec(const char *val, struct kernel_param *kp)
+ {
+-	unsigned long l;
++	unsigned int i;
+ 	int ret;
+ 
+ 	if (!val)
+ 		return -EINVAL;
+ 
+-	ret = kstrtoul(val, 0, &l);
++	ret = kstrtouint(val, 0, &i);
+ 	if (ret)
+ 		return ret;
+ 
+-	if (l < 1000)
++	if (i < 1000)
+ 		return -EINVAL;
+ 
+-	*((unsigned long *)kp->arg) = l;
++	*((unsigned int *)kp->arg) = i;
+ 
+ 	/* notify edac_mc engine to reset the poll period */
+-	edac_mc_reset_delay_period(l);
++	edac_mc_reset_delay_period(i);
+ 
+ 	return 0;
+ }
+@@ -82,7 +82,7 @@ MODULE_PARM_DESC(edac_mc_log_ue,
+ module_param(edac_mc_log_ce, int, 0644);
+ MODULE_PARM_DESC(edac_mc_log_ce,
+ 		 "Log correctable error to console: 0=off 1=on");
+-module_param_call(edac_mc_poll_msec, edac_set_poll_msec, param_get_int,
++module_param_call(edac_mc_poll_msec, edac_set_poll_msec, param_get_uint,
+ 		  &edac_mc_poll_msec, 0644);
+ MODULE_PARM_DESC(edac_mc_poll_msec, "Polling period in milliseconds");
+ 
+@@ -426,6 +426,8 @@ static inline int nr_pages_per_csrow(struct csrow_info *csrow)
+ static int edac_create_csrow_object(struct mem_ctl_info *mci,
+ 				    struct csrow_info *csrow, int index)
+ {
++	int err;
++
+ 	csrow->dev.type = &csrow_attr_type;
+ 	csrow->dev.bus = mci->bus;
+ 	csrow->dev.groups = csrow_dev_groups;
+@@ -438,7 +440,11 @@ static int edac_create_csrow_object(struct mem_ctl_info *mci,
+ 	edac_dbg(0, "creating (virtual) csrow node %s\n",
+ 		 dev_name(&csrow->dev));
+ 
+-	return device_add(&csrow->dev);
++	err = device_add(&csrow->dev);
++	if (err)
++		put_device(&csrow->dev);
++
++	return err;
+ }
+ 
+ /* Create a CSROW object under specifed edac_mc_device */
+diff --git a/drivers/edac/edac_module.h b/drivers/edac/edac_module.h
+index dec88dcea036..c9f0e73872a6 100644
+--- a/drivers/edac/edac_module.h
++++ b/drivers/edac/edac_module.h
+@@ -36,7 +36,7 @@ extern int edac_mc_get_log_ue(void);
+ extern int edac_mc_get_log_ce(void);
+ extern int edac_mc_get_panic_on_ue(void);
+ extern int edac_get_poll_msec(void);
+-extern int edac_mc_get_poll_msec(void);
++extern unsigned int edac_mc_get_poll_msec(void);
+ 
+ unsigned edac_dimm_info_location(struct dimm_info *dimm, char *buf,
+ 				 unsigned len);
+diff --git a/drivers/fpga/Kconfig b/drivers/fpga/Kconfig
+index ad5448f718b3..57c41cefd454 100644
+--- a/drivers/fpga/Kconfig
++++ b/drivers/fpga/Kconfig
+@@ -34,6 +34,7 @@ config FPGA_MGR_ALTERA_CVP
+ config FPGA_MGR_ALTERA_PS_SPI
+ 	tristate "Altera FPGA Passive Serial over SPI"
+ 	depends on SPI
++	select BITREVERSE
+ 	help
+ 	  FPGA manager driver support for Altera Arria/Cyclone/Stratix
+ 	  using the passive serial interface over SPI.
+diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
+index 83c6843db50c..47e537a91dd8 100644
+--- a/drivers/gpio/gpio-omap.c
++++ b/drivers/gpio/gpio-omap.c
+@@ -790,9 +790,9 @@ static void omap_gpio_irq_shutdown(struct irq_data *d)
+ 
+ 	raw_spin_lock_irqsave(&bank->lock, flags);
+ 	bank->irq_usage &= ~(BIT(offset));
+-	omap_set_gpio_irqenable(bank, offset, 0);
+-	omap_clear_gpio_irqstatus(bank, offset);
+ 	omap_set_gpio_triggering(bank, offset, IRQ_TYPE_NONE);
++	omap_clear_gpio_irqstatus(bank, offset);
++	omap_set_gpio_irqenable(bank, offset, 0);
+ 	if (!LINE_USED(bank->mod_usage, offset))
+ 		omap_clear_gpio_debounce(bank, offset);
+ 	omap_disable_gpio_module(bank, offset);
+@@ -834,8 +834,8 @@ static void omap_gpio_mask_irq(struct irq_data *d)
+ 	unsigned long flags;
+ 
+ 	raw_spin_lock_irqsave(&bank->lock, flags);
+-	omap_set_gpio_irqenable(bank, offset, 0);
+ 	omap_set_gpio_triggering(bank, offset, IRQ_TYPE_NONE);
++	omap_set_gpio_irqenable(bank, offset, 0);
+ 	raw_spin_unlock_irqrestore(&bank->lock, flags);
+ }
+ 
+@@ -847,9 +847,6 @@ static void omap_gpio_unmask_irq(struct irq_data *d)
+ 	unsigned long flags;
+ 
+ 	raw_spin_lock_irqsave(&bank->lock, flags);
+-	if (trigger)
+-		omap_set_gpio_triggering(bank, offset, trigger);
+-
+ 	omap_set_gpio_irqenable(bank, offset, 1);
+ 
+ 	/*
+@@ -857,9 +854,13 @@ static void omap_gpio_unmask_irq(struct irq_data *d)
+ 	 * is cleared, thus after the handler has run. OMAP4 needs this done
+ 	 * after enabing the interrupt to clear the wakeup status.
+ 	 */
+-	if (bank->level_mask & BIT(offset))
++	if (bank->regs->leveldetect0 && bank->regs->wkup_en &&
++	    trigger & (IRQ_TYPE_LEVEL_HIGH | IRQ_TYPE_LEVEL_LOW))
+ 		omap_clear_gpio_irqstatus(bank, offset);
+ 
++	if (trigger)
++		omap_set_gpio_triggering(bank, offset, trigger);
++
+ 	raw_spin_unlock_irqrestore(&bank->lock, flags);
+ }
+ 
+@@ -1604,6 +1605,8 @@ static struct omap_gpio_reg_offs omap4_gpio_regs = {
+ 	.clr_dataout =		OMAP4_GPIO_CLEARDATAOUT,
+ 	.irqstatus =		OMAP4_GPIO_IRQSTATUS0,
+ 	.irqstatus2 =		OMAP4_GPIO_IRQSTATUS1,
++	.irqstatus_raw0 =	OMAP4_GPIO_IRQSTATUSRAW0,
++	.irqstatus_raw1 =	OMAP4_GPIO_IRQSTATUSRAW1,
+ 	.irqenable =		OMAP4_GPIO_IRQSTATUSSET0,
+ 	.irqenable2 =		OMAP4_GPIO_IRQSTATUSSET1,
+ 	.set_irqenable =	OMAP4_GPIO_IRQSTATUSSET0,
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 21062cb6b85f..3db0a9b0d259 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2480,7 +2480,7 @@ static int _gpiod_get_raw_value(const struct gpio_desc *desc)
+ int gpiod_get_raw_value(const struct gpio_desc *desc)
+ {
+ 	VALIDATE_DESC(desc);
+-	/* Should be using gpio_get_value_cansleep() */
++	/* Should be using gpiod_get_raw_value_cansleep() */
+ 	WARN_ON(desc->gdev->chip->can_sleep);
+ 	return _gpiod_get_raw_value(desc);
+ }
+@@ -2501,7 +2501,7 @@ int gpiod_get_value(const struct gpio_desc *desc)
+ 	int value;
+ 
+ 	VALIDATE_DESC(desc);
+-	/* Should be using gpio_get_value_cansleep() */
++	/* Should be using gpiod_get_value_cansleep() */
+ 	WARN_ON(desc->gdev->chip->can_sleep);
+ 
+ 	value = _gpiod_get_raw_value(desc);
+@@ -2670,7 +2670,7 @@ void gpiod_set_array_value_complex(bool raw, bool can_sleep,
+ void gpiod_set_raw_value(struct gpio_desc *desc, int value)
+ {
+ 	VALIDATE_DESC_VOID(desc);
+-	/* Should be using gpiod_set_value_cansleep() */
++	/* Should be using gpiod_set_raw_value_cansleep() */
+ 	WARN_ON(desc->gdev->chip->can_sleep);
+ 	_gpiod_set_raw_value(desc, value);
+ }
+diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c
+index 60373d7eb220..109ab4c3df50 100644
+--- a/drivers/gpu/drm/bridge/sii902x.c
++++ b/drivers/gpu/drm/bridge/sii902x.c
+@@ -261,10 +261,11 @@ static void sii902x_bridge_mode_set(struct drm_bridge *bridge,
+ 	struct regmap *regmap = sii902x->regmap;
+ 	u8 buf[HDMI_INFOFRAME_SIZE(AVI)];
+ 	struct hdmi_avi_infoframe frame;
++	u16 pixel_clock_10kHz = adj->clock / 10;
+ 	int ret;
+ 
+-	buf[0] = adj->clock;
+-	buf[1] = adj->clock >> 8;
++	buf[0] = pixel_clock_10kHz & 0xff;
++	buf[1] = pixel_clock_10kHz >> 8;
+ 	buf[2] = adj->vrefresh;
+ 	buf[3] = 0x00;
+ 	buf[4] = adj->hdisplay;
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index 6eebd8ad0c52..9705ca197b90 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -1147,6 +1147,13 @@ static int tc_connector_get_modes(struct drm_connector *connector)
+ 	struct tc_data *tc = connector_to_tc(connector);
+ 	struct edid *edid;
+ 	unsigned int count;
++	int ret;
++
++	ret = tc_get_display_props(tc);
++	if (ret < 0) {
++		dev_err(tc->dev, "failed to read display props: %d\n", ret);
++		return 0;
++	}
+ 
+ 	if (tc->panel && tc->panel->funcs && tc->panel->funcs->get_modes) {
+ 		count = tc->panel->funcs->get_modes(tc->panel);
+diff --git a/drivers/gpu/drm/drm_debugfs_crc.c b/drivers/gpu/drm/drm_debugfs_crc.c
+index f9e26dda56d6..2901b7944068 100644
+--- a/drivers/gpu/drm/drm_debugfs_crc.c
++++ b/drivers/gpu/drm/drm_debugfs_crc.c
+@@ -139,6 +139,7 @@ static int crtc_crc_data_count(struct drm_crtc_crc *crc)
+ static void crtc_crc_cleanup(struct drm_crtc_crc *crc)
+ {
+ 	kfree(crc->entries);
++	crc->overflow = false;
+ 	crc->entries = NULL;
+ 	crc->head = 0;
+ 	crc->tail = 0;
+@@ -359,12 +360,13 @@ int drm_crtc_add_crc_entry(struct drm_crtc *crtc, bool has_frame,
+ 	struct drm_crtc_crc *crc = &crtc->crc;
+ 	struct drm_crtc_crc_entry *entry;
+ 	int head, tail;
++	unsigned long flags;
+ 
+-	spin_lock(&crc->lock);
++	spin_lock_irqsave(&crc->lock, flags);
+ 
+ 	/* Caller may not have noticed yet that userspace has stopped reading */
+ 	if (!crc->entries) {
+-		spin_unlock(&crc->lock);
++		spin_unlock_irqrestore(&crc->lock, flags);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -372,8 +374,14 @@ int drm_crtc_add_crc_entry(struct drm_crtc *crtc, bool has_frame,
+ 	tail = crc->tail;
+ 
+ 	if (CIRC_SPACE(head, tail, DRM_CRC_ENTRIES_NR) < 1) {
+-		spin_unlock(&crc->lock);
+-		DRM_ERROR("Overflow of CRC buffer, userspace reads too slow.\n");
++		bool was_overflow = crc->overflow;
++
++		crc->overflow = true;
++		spin_unlock_irqrestore(&crc->lock, flags);
++
++		if (!was_overflow)
++			DRM_ERROR("Overflow of CRC buffer, userspace reads too slow.\n");
++
+ 		return -ENOBUFS;
+ 	}
+ 
+@@ -385,7 +393,7 @@ int drm_crtc_add_crc_entry(struct drm_crtc *crtc, bool has_frame,
+ 	head = (head + 1) & (DRM_CRC_ENTRIES_NR - 1);
+ 	crc->head = head;
+ 
+-	spin_unlock(&crc->lock);
++	spin_unlock_irqrestore(&crc->lock, flags);
+ 
+ 	wake_up_interruptible(&crc->wq);
+ 
+diff --git a/drivers/gpu/drm/drm_edid_load.c b/drivers/gpu/drm/drm_edid_load.c
+index 1c0495acf341..06656acea420 100644
+--- a/drivers/gpu/drm/drm_edid_load.c
++++ b/drivers/gpu/drm/drm_edid_load.c
+@@ -274,6 +274,8 @@ struct edid *drm_load_edid_firmware(struct drm_connector *connector)
+ 	 * the last one found one as a fallback.
+ 	 */
+ 	fwstr = kstrdup(edid_firmware, GFP_KERNEL);
++	if (!fwstr)
++		return ERR_PTR(-ENOMEM);
+ 	edidstr = fwstr;
+ 
+ 	while ((edidname = strsep(&edidstr, ","))) {
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index 606df7bea97b..b970427e53a7 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -1097,16 +1097,24 @@ static int msm_pdev_probe(struct platform_device *pdev)
+ 
+ 	ret = add_gpu_components(&pdev->dev, &match);
+ 	if (ret)
+-		return ret;
++		goto fail;
+ 
+ 	/* on all devices that I am aware of, iommu's which can map
+ 	 * any address the cpu can see are used:
+ 	 */
+ 	ret = dma_set_mask_and_coherent(&pdev->dev, ~0);
+ 	if (ret)
+-		return ret;
++		goto fail;
++
++	ret = component_master_add_with_match(&pdev->dev, &msm_drm_ops, match);
++	if (ret)
++		goto fail;
++
++	return 0;
+ 
+-	return component_master_add_with_match(&pdev->dev, &msm_drm_ops, match);
++fail:
++	of_platform_depopulate(&pdev->dev);
++	return ret;
+ }
+ 
+ static int msm_pdev_remove(struct platform_device *pdev)
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c
+index ecacb22834d7..719345074711 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c
+@@ -184,6 +184,25 @@ nvkm_i2c_fini(struct nvkm_subdev *subdev, bool suspend)
+ 	return 0;
+ }
+ 
++static int
++nvkm_i2c_preinit(struct nvkm_subdev *subdev)
++{
++	struct nvkm_i2c *i2c = nvkm_i2c(subdev);
++	struct nvkm_i2c_bus *bus;
++	struct nvkm_i2c_pad *pad;
++
++	/*
++	 * We init our i2c busses as early as possible, since they may be
++	 * needed by the vbios init scripts on some cards
++	 */
++	list_for_each_entry(pad, &i2c->pad, head)
++		nvkm_i2c_pad_init(pad);
++	list_for_each_entry(bus, &i2c->bus, head)
++		nvkm_i2c_bus_init(bus);
++
++	return 0;
++}
++
+ static int
+ nvkm_i2c_init(struct nvkm_subdev *subdev)
+ {
+@@ -238,6 +257,7 @@ nvkm_i2c_dtor(struct nvkm_subdev *subdev)
+ static const struct nvkm_subdev_func
+ nvkm_i2c = {
+ 	.dtor = nvkm_i2c_dtor,
++	.preinit = nvkm_i2c_preinit,
+ 	.init = nvkm_i2c_init,
+ 	.fini = nvkm_i2c_fini,
+ 	.intr = nvkm_i2c_intr,
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index fc56d033febe..7a0fd4e4e78d 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -2371,7 +2371,14 @@ static int panel_simple_dsi_probe(struct mipi_dsi_device *dsi)
+ 	dsi->format = desc->format;
+ 	dsi->lanes = desc->lanes;
+ 
+-	return mipi_dsi_attach(dsi);
++	err = mipi_dsi_attach(dsi);
++	if (err) {
++		struct panel_simple *panel = dev_get_drvdata(&dsi->dev);
++
++		drm_panel_remove(&panel->base);
++	}
++
++	return err;
+ }
+ 
+ static int panel_simple_dsi_remove(struct mipi_dsi_device *dsi)
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+index f1fa8d5c9b52..7010424b2f89 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+@@ -861,7 +861,8 @@ static bool vop_crtc_mode_fixup(struct drm_crtc *crtc,
+ 	struct vop *vop = to_vop(crtc);
+ 
+ 	adjusted_mode->clock =
+-		clk_round_rate(vop->dclk, mode->clock * 1000) / 1000;
++		DIV_ROUND_UP(clk_round_rate(vop->dclk, mode->clock * 1000),
++			     1000);
+ 
+ 	return true;
+ }
+diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+index ed9c443bb8a1..40cc2f6707cf 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
++++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+@@ -523,6 +523,9 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
+ 	ret = wait_event_timeout(vgdev->resp_wq,
+ 				 atomic_read(&cache_ent->is_valid), 5 * HZ);
+ 
++	/* is_valid check must proceed before copy of the cache entry. */
++	smp_rmb();
++
+ 	ptr = cache_ent->caps_cache;
+ 
+ copy_exit:
+diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
+index 26a2da1f712d..21c2de81f3e3 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -585,6 +585,8 @@ static void virtio_gpu_cmd_capset_cb(struct virtio_gpu_device *vgdev,
+ 		    cache_ent->id == le32_to_cpu(cmd->capset_id)) {
+ 			memcpy(cache_ent->caps_cache, resp->capset_data,
+ 			       cache_ent->size);
++			/* Copy must occur before is_valid is signalled. */
++			smp_wmb();
+ 			atomic_set(&cache_ent->is_valid, 1);
+ 			break;
+ 		}
+diff --git a/drivers/gpu/ipu-v3/ipu-ic.c b/drivers/gpu/ipu-v3/ipu-ic.c
+index 321eb983c2f5..65d7daf944b0 100644
+--- a/drivers/gpu/ipu-v3/ipu-ic.c
++++ b/drivers/gpu/ipu-v3/ipu-ic.c
+@@ -256,7 +256,7 @@ static int init_csc(struct ipu_ic *ic,
+ 	writel(param, base++);
+ 
+ 	param = ((a[0] & 0x1fe0) >> 5) | (params->scale << 8) |
+-		(params->sat << 9);
++		(params->sat << 10);
+ 	writel(param, base++);
+ 
+ 	param = ((a[1] & 0x1f) << 27) | ((c[0][1] & 0x1ff) << 18) |
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index 18d5b99d13f1..ee87f11e8cd5 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -118,6 +118,9 @@ static void wacom_feature_mapping(struct hid_device *hdev,
+ 	u32 n;
+ 
+ 	switch (equivalent_usage) {
++	case WACOM_HID_WD_TOUCH_RING_SETTING:
++		wacom->generic_has_leds = true;
++		break;
+ 	case HID_DG_CONTACTMAX:
+ 		/* leave touch_max as is if predefined */
+ 		if (!features->touch_max) {
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index b42bb955f22d..c2fb08bba296 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -1871,8 +1871,6 @@ static void wacom_wac_pad_usage_mapping(struct hid_device *hdev,
+ 		features->device_type |= WACOM_DEVICETYPE_PAD;
+ 		break;
+ 	case WACOM_HID_WD_BUTTONCENTER:
+-		wacom->generic_has_leds = true;
+-		/* fall through */
+ 	case WACOM_HID_WD_BUTTONHOME:
+ 	case WACOM_HID_WD_BUTTONUP:
+ 	case WACOM_HID_WD_BUTTONDOWN:
+@@ -3552,7 +3550,7 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev,
+ 					     0, 5920, 4, 0);
+ 		}
+ 		input_abs_set_res(input_dev, ABS_MT_POSITION_X, 40);
+-		input_abs_set_res(input_dev, ABS_MT_POSITION_X, 40);
++		input_abs_set_res(input_dev, ABS_MT_POSITION_Y, 40);
+ 
+ 		/* fall through */
+ 
+diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
+index feb62fd4dfc3..d2fe7af2c152 100644
+--- a/drivers/hid/wacom_wac.h
++++ b/drivers/hid/wacom_wac.h
+@@ -140,6 +140,7 @@
+ #define WACOM_HID_WD_OFFSETBOTTOM       (WACOM_HID_UP_WACOMDIGITIZER | 0x0d33)
+ #define WACOM_HID_WD_DATAMODE           (WACOM_HID_UP_WACOMDIGITIZER | 0x1002)
+ #define WACOM_HID_WD_DIGITIZERINFO      (WACOM_HID_UP_WACOMDIGITIZER | 0x1013)
++#define WACOM_HID_WD_TOUCH_RING_SETTING (WACOM_HID_UP_WACOMDIGITIZER | 0x1032)
+ #define WACOM_HID_UP_G9                 0xff090000
+ #define WACOM_HID_G9_PEN                (WACOM_HID_UP_G9 | 0x02)
+ #define WACOM_HID_G9_TOUCHSCREEN        (WACOM_HID_UP_G9 | 0x11)
+diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
+index 36016c09dd96..6ebf6a2edb33 100644
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -640,7 +640,7 @@ static int msc_buffer_contig_alloc(struct msc *msc, unsigned long size)
+ 		goto err_out;
+ 
+ 	ret = -ENOMEM;
+-	page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
++	page = alloc_pages(GFP_KERNEL | __GFP_ZERO | GFP_DMA32, order);
+ 	if (!page)
+ 		goto err_free_sgt;
+ 
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index eb8444faa14e..c001a37b7055 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -178,6 +178,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ 		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x02a6),
+ 		.driver_data = (kernel_ulong_t)&intel_th_2x,
+ 	},
++	{
++		/* Ice Lake NNPI */
++		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5),
++		.driver_data = (kernel_ulong_t)&intel_th_2x,
++	},
+ 	{ 0 },
+ };
+ 
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+index c1021b4afb41..57bfe4808247 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+@@ -821,6 +821,8 @@ static int i40iw_query_qp(struct ib_qp *ibqp,
+ 	struct i40iw_qp *iwqp = to_iwqp(ibqp);
+ 	struct i40iw_sc_qp *qp = &iwqp->sc_qp;
+ 
++	attr->qp_state = iwqp->ibqp_state;
++	attr->cur_qp_state = attr->qp_state;
+ 	attr->qp_access_flags = 0;
+ 	attr->cap.max_send_wr = qp->qp_uk.sq_size;
+ 	attr->cap.max_recv_wr = qp->qp_uk.rq_size;
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index 74328561bee2..9207682b7a2e 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -435,6 +435,7 @@ static enum resp_states check_rkey(struct rxe_qp *qp,
+ 			qp->resp.va = reth_va(pkt);
+ 			qp->resp.rkey = reth_rkey(pkt);
+ 			qp->resp.resid = reth_len(pkt);
++			qp->resp.length = reth_len(pkt);
+ 		}
+ 		access = (pkt->mask & RXE_READ_MASK) ? IB_ACCESS_REMOTE_READ
+ 						     : IB_ACCESS_REMOTE_WRITE;
+@@ -860,7 +861,9 @@ static enum resp_states do_complete(struct rxe_qp *qp,
+ 				pkt->mask & RXE_WRITE_MASK) ?
+ 					IB_WC_RECV_RDMA_WITH_IMM : IB_WC_RECV;
+ 		wc->vendor_err = 0;
+-		wc->byte_len = wqe->dma.length - wqe->dma.resid;
++		wc->byte_len = (pkt->mask & RXE_IMMDT_MASK &&
++				pkt->mask & RXE_WRITE_MASK) ?
++					qp->resp.length : wqe->dma.length - wqe->dma.resid;
+ 
+ 		/* fields after byte_len are different between kernel and user
+ 		 * space
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index 59f6a24db064..b2b76a316eba 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -214,6 +214,7 @@ struct rxe_resp_info {
+ 	struct rxe_mem		*mr;
+ 	u32			resid;
+ 	u32			rkey;
++	u32			length;
+ 	u64			atomic_orig;
+ 
+ 	/* SRQ only */
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index e6ff16b27acd..1a93d3d58c8a 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1833,6 +1833,7 @@ static int ipoib_get_vf_config(struct net_device *dev, int vf,
+ 		return err;
+ 
+ 	ivf->vf = vf;
++	memcpy(ivf->mac, dev->dev_addr, dev->addr_len);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
+index 9a234da8cac2..21bb1ed97f9f 100644
+--- a/drivers/input/mouse/alps.c
++++ b/drivers/input/mouse/alps.c
+@@ -24,6 +24,7 @@
+ 
+ #include "psmouse.h"
+ #include "alps.h"
++#include "trackpoint.h"
+ 
+ /*
+  * Definitions for ALPS version 3 and 4 command mode protocol
+@@ -2860,6 +2861,23 @@ static const struct alps_protocol_info *alps_match_table(unsigned char *e7,
+ 	return NULL;
+ }
+ 
++static bool alps_is_cs19_trackpoint(struct psmouse *psmouse)
++{
++	u8 param[2] = { 0 };
++
++	if (ps2_command(&psmouse->ps2dev,
++			param, MAKE_PS2_CMD(0, 2, TP_READ_ID)))
++		return false;
++
++	/*
++	 * param[0] contains the trackpoint device variant_id while
++	 * param[1] contains the firmware_id. So far all alps
++	 * trackpoint-only devices have their variant_ids equal
++	 * TP_VARIANT_ALPS and their firmware_ids are in 0x20~0x2f range.
++	 */
++	return param[0] == TP_VARIANT_ALPS && ((param[1] & 0xf0) == 0x20);
++}
++
+ static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
+ {
+ 	const struct alps_protocol_info *protocol;
+@@ -3160,6 +3178,20 @@ int alps_detect(struct psmouse *psmouse, bool set_properties)
+ 	if (error)
+ 		return error;
+ 
++	/*
++	 * ALPS cs19 is a trackpoint-only device, and uses different
++	 * protocol than DualPoint ones, so we return -EINVAL here and let
++	 * trackpoint.c drive this device. If the trackpoint driver is not
++	 * enabled, the device will fall back to a bare PS/2 mouse.
++	 * If ps2_command() fails here, we depend on the immediately
++	 * followed psmouse_reset() to reset the device to normal state.
++	 */
++	if (alps_is_cs19_trackpoint(psmouse)) {
++		psmouse_dbg(psmouse,
++			    "ALPS CS19 trackpoint-only device detected, ignoring\n");
++		return -EINVAL;
++	}
++
+ 	/*
+ 	 * Reset the device to make sure it is fully operational:
+ 	 * on some laptops, like certain Dell Latitudes, we may
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 1a6a05c45ee7..7c8d4baf647b 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -179,6 +179,7 @@ static const char * const smbus_pnp_ids[] = {
+ 	"LEN0093", /* T480 */
+ 	"LEN0096", /* X280 */
+ 	"LEN0097", /* X280 -> ALPS trackpoint */
++	"LEN009b", /* T580 */
+ 	"LEN200f", /* T450s */
+ 	"LEN2054", /* E480 */
+ 	"LEN2055", /* E580 */
+diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
+index 4b8b9d7aa75e..35031228a6d0 100644
+--- a/drivers/input/tablet/gtco.c
++++ b/drivers/input/tablet/gtco.c
+@@ -78,6 +78,7 @@ Scott Hill shill@×××××××××××.com
+ 
+ /* Max size of a single report */
+ #define REPORT_MAX_SIZE       10
++#define MAX_COLLECTION_LEVELS  10
+ 
+ 
+ /* Bitmask whether pen is in range */
+@@ -223,8 +224,7 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
+ 	char  maintype = 'x';
+ 	char  globtype[12];
+ 	int   indent = 0;
+-	char  indentstr[10] = "";
+-
++	char  indentstr[MAX_COLLECTION_LEVELS + 1] = { 0 };
+ 
+ 	dev_dbg(ddev, "======>>>>>>PARSE<<<<<<======\n");
+ 
+@@ -350,6 +350,13 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
+ 			case TAG_MAIN_COL_START:
+ 				maintype = 'S';
+ 
++				if (indent == MAX_COLLECTION_LEVELS) {
++					dev_err(ddev, "Collection level %d would exceed limit of %d\n",
++						indent + 1,
++						MAX_COLLECTION_LEVELS);
++					break;
++				}
++
+ 				if (data == 0) {
+ 					dev_dbg(ddev, "======>>>>>> Physical\n");
+ 					strcpy(globtype, "Physical");
+@@ -369,8 +376,15 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
+ 				break;
+ 
+ 			case TAG_MAIN_COL_END:
+-				dev_dbg(ddev, "<<<<<<======\n");
+ 				maintype = 'E';
++
++				if (indent == 0) {
++					dev_err(ddev, "Collection level already at zero\n");
++					break;
++				}
++
++				dev_dbg(ddev, "<<<<<<======\n");
++
+ 				indent--;
+ 				for (x = 0; x < indent; x++)
+ 					indentstr[x] = '-';
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 3de5c0bcb5cc..1620a6f49989 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -205,18 +205,21 @@ static int iommu_insert_resv_region(struct iommu_resv_region *new,
+ 			pos = pos->next;
+ 		} else if ((start >= a) && (end <= b)) {
+ 			if (new->type == type)
+-				goto done;
++				return 0;
+ 			else
+ 				pos = pos->next;
+ 		} else {
+ 			if (new->type == type) {
+ 				phys_addr_t new_start = min(a, start);
+ 				phys_addr_t new_end = max(b, end);
++				int ret;
+ 
+ 				list_del(&entry->list);
+ 				entry->start = new_start;
+ 				entry->length = new_end - new_start + 1;
+-				iommu_insert_resv_region(entry, regions);
++				ret = iommu_insert_resv_region(entry, regions);
++				kfree(entry);
++				return ret;
+ 			} else {
+ 				pos = pos->next;
+ 			}
+@@ -229,7 +232,6 @@ insert:
+ 		return -ENOMEM;
+ 
+ 	list_add_tail(&region->list, pos);
+-done:
+ 	return 0;
+ }
+ 
+diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
+index 537f4f6d009b..44b49a2676f0 100644
+--- a/drivers/mailbox/mailbox.c
++++ b/drivers/mailbox/mailbox.c
+@@ -391,11 +391,13 @@ struct mbox_chan *mbox_request_channel_byname(struct mbox_client *cl,
+ 
+ 	of_property_for_each_string(np, "mbox-names", prop, mbox_name) {
+ 		if (!strncmp(name, mbox_name, strlen(name)))
+-			break;
++			return mbox_request_channel(cl, index);
+ 		index++;
+ 	}
+ 
+-	return mbox_request_channel(cl, index);
++	dev_err(cl->dev, "%s() could not locate channel named \"%s\"\n",
++		__func__, name);
++	return ERR_PTR(-EINVAL);
+ }
+ EXPORT_SYMBOL_GPL(mbox_request_channel_byname);
+ 
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 85a5afe01d39..1a270e2262f5 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1402,7 +1402,7 @@ static void cache_set_flush(struct closure *cl)
+ 	kobject_put(&c->internal);
+ 	kobject_del(&c->kobj);
+ 
+-	if (c->gc_thread)
++	if (!IS_ERR_OR_NULL(c->gc_thread))
+ 		kthread_stop(c->gc_thread);
+ 
+ 	if (!IS_ERR_OR_NULL(c->root))
+diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
+index 1e17e6421da3..b7d3b62dae7f 100644
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -1630,9 +1630,7 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ 	unsigned long freed;
+ 
+ 	c = container_of(shrink, struct dm_bufio_client, shrinker);
+-	if (sc->gfp_mask & __GFP_FS)
+-		dm_bufio_lock(c);
+-	else if (!dm_bufio_trylock(c))
++	if (!dm_bufio_trylock(c))
+ 		return SHRINK_STOP;
+ 
+ 	freed  = __scan(c, sc->nr_to_scan, sc->gfp_mask);
+diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
+index 167686189fd2..597098a43aba 100644
+--- a/drivers/md/dm-zoned-metadata.c
++++ b/drivers/md/dm-zoned-metadata.c
+@@ -1593,30 +1593,6 @@ struct dm_zone *dmz_get_zone_for_reclaim(struct dmz_metadata *zmd)
+ 	return zone;
+ }
+ 
+-/*
+- * Activate a zone (increment its reference count).
+- */
+-void dmz_activate_zone(struct dm_zone *zone)
+-{
+-	set_bit(DMZ_ACTIVE, &zone->flags);
+-	atomic_inc(&zone->refcount);
+-}
+-
+-/*
+- * Deactivate a zone. This decrement the zone reference counter
+- * and clears the active state of the zone once the count reaches 0,
+- * indicating that all BIOs to the zone have completed. Returns
+- * true if the zone was deactivated.
+- */
+-void dmz_deactivate_zone(struct dm_zone *zone)
+-{
+-	if (atomic_dec_and_test(&zone->refcount)) {
+-		WARN_ON(!test_bit(DMZ_ACTIVE, &zone->flags));
+-		clear_bit_unlock(DMZ_ACTIVE, &zone->flags);
+-		smp_mb__after_atomic();
+-	}
+-}
+-
+ /*
+  * Get the zone mapping a chunk, if the chunk is mapped already.
+  * If no mapping exist and the operation is WRITE, a zone is
+diff --git a/drivers/md/dm-zoned.h b/drivers/md/dm-zoned.h
+index 12419f0bfe78..ed8de49c9a08 100644
+--- a/drivers/md/dm-zoned.h
++++ b/drivers/md/dm-zoned.h
+@@ -115,7 +115,6 @@ enum {
+ 	DMZ_BUF,
+ 
+ 	/* Zone internal state */
+-	DMZ_ACTIVE,
+ 	DMZ_RECLAIM,
+ 	DMZ_SEQ_WRITE_ERR,
+ };
+@@ -128,7 +127,6 @@ enum {
+ #define dmz_is_empty(z)		((z)->wp_block == 0)
+ #define dmz_is_offline(z)	test_bit(DMZ_OFFLINE, &(z)->flags)
+ #define dmz_is_readonly(z)	test_bit(DMZ_READ_ONLY, &(z)->flags)
+-#define dmz_is_active(z)	test_bit(DMZ_ACTIVE, &(z)->flags)
+ #define dmz_in_reclaim(z)	test_bit(DMZ_RECLAIM, &(z)->flags)
+ #define dmz_seq_write_err(z)	test_bit(DMZ_SEQ_WRITE_ERR, &(z)->flags)
+ 
+@@ -188,8 +186,30 @@ void dmz_unmap_zone(struct dmz_metadata *zmd, struct dm_zone *zone);
+ unsigned int dmz_nr_rnd_zones(struct dmz_metadata *zmd);
+ unsigned int dmz_nr_unmap_rnd_zones(struct dmz_metadata *zmd);
+ 
+-void dmz_activate_zone(struct dm_zone *zone);
+-void dmz_deactivate_zone(struct dm_zone *zone);
++/*
++ * Activate a zone (increment its reference count).
++ */
++static inline void dmz_activate_zone(struct dm_zone *zone)
++{
++	atomic_inc(&zone->refcount);
++}
++
++/*
++ * Deactivate a zone. This decrement the zone reference counter
++ * indicating that all BIOs to the zone have completed when the count is 0.
++ */
++static inline void dmz_deactivate_zone(struct dm_zone *zone)
++{
++	atomic_dec(&zone->refcount);
++}
++
++/*
++ * Test if a zone is active, that is, has a refcount > 0.
++ */
++static inline bool dmz_is_active(struct dm_zone *zone)
++{
++	return atomic_read(&zone->refcount);
++}
+ 
+ int dmz_lock_zone_reclaim(struct dm_zone *zone);
+ void dmz_unlock_zone_reclaim(struct dm_zone *zone);
+diff --git a/drivers/media/dvb-frontends/tua6100.c b/drivers/media/dvb-frontends/tua6100.c
+index 18e6d4c5be21..859fa14b319c 100644
+--- a/drivers/media/dvb-frontends/tua6100.c
++++ b/drivers/media/dvb-frontends/tua6100.c
+@@ -75,8 +75,8 @@ static int tua6100_set_params(struct dvb_frontend *fe)
+ 	struct i2c_msg msg1 = { .addr = priv->i2c_address, .flags = 0, .buf = reg1, .len = 4 };
+ 	struct i2c_msg msg2 = { .addr = priv->i2c_address, .flags = 0, .buf = reg2, .len = 3 };
+ 
+-#define _R 4
+-#define _P 32
++#define _R_VAL 4
++#define _P_VAL 32
+ #define _ri 4000000
+ 
+ 	// setup register 0
+@@ -91,14 +91,14 @@ static int tua6100_set_params(struct dvb_frontend *fe)
+ 	else
+ 		reg1[1] = 0x0c;
+ 
+-	if (_P == 64)
++	if (_P_VAL == 64)
+ 		reg1[1] |= 0x40;
+ 	if (c->frequency >= 1525000)
+ 		reg1[1] |= 0x80;
+ 
+ 	// register 2
+-	reg2[1] = (_R >> 8) & 0x03;
+-	reg2[2] = _R;
++	reg2[1] = (_R_VAL >> 8) & 0x03;
++	reg2[2] = _R_VAL;
+ 	if (c->frequency < 1455000)
+ 		reg2[1] |= 0x1c;
+ 	else if (c->frequency < 1630000)
+@@ -110,18 +110,18 @@ static int tua6100_set_params(struct dvb_frontend *fe)
+ 	 * The N divisor ratio (note: c->frequency is in kHz, but we
+ 	 * need it in Hz)
+ 	 */
+-	prediv = (c->frequency * _R) / (_ri / 1000);
+-	div = prediv / _P;
++	prediv = (c->frequency * _R_VAL) / (_ri / 1000);
++	div = prediv / _P_VAL;
+ 	reg1[1] |= (div >> 9) & 0x03;
+ 	reg1[2] = div >> 1;
+ 	reg1[3] = (div << 7);
+-	priv->frequency = ((div * _P) * (_ri / 1000)) / _R;
++	priv->frequency = ((div * _P_VAL) * (_ri / 1000)) / _R_VAL;
+ 
+ 	// Finally, calculate and store the value for A
+-	reg1[3] |= (prediv - (div*_P)) & 0x7f;
++	reg1[3] |= (prediv - (div*_P_VAL)) & 0x7f;
+ 
+-#undef _R
+-#undef _P
++#undef _R_VAL
++#undef _P_VAL
+ #undef _ri
+ 
+ 	if (fe->ops.i2c_gate_ctrl)
+diff --git a/drivers/media/i2c/Makefile b/drivers/media/i2c/Makefile
+index f104650d6000..0f5c5a3cdca3 100644
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -33,7 +33,7 @@ obj-$(CONFIG_VIDEO_ADV748X) += adv748x/
+ obj-$(CONFIG_VIDEO_ADV7604) += adv7604.o
+ obj-$(CONFIG_VIDEO_ADV7842) += adv7842.o
+ obj-$(CONFIG_VIDEO_AD9389B) += ad9389b.o
+-obj-$(CONFIG_VIDEO_ADV7511) += adv7511.o
++obj-$(CONFIG_VIDEO_ADV7511) += adv7511-v4l2.o
+ obj-$(CONFIG_VIDEO_VPX3220) += vpx3220.o
+ obj-$(CONFIG_VIDEO_VS6624)  += vs6624.o
+ obj-$(CONFIG_VIDEO_BT819) += bt819.o
+diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c
+new file mode 100644
+index 000000000000..ef1144668809
+--- /dev/null
++++ b/drivers/media/i2c/adv7511-v4l2.c
+@@ -0,0 +1,2008 @@
++/*
++ * Analog Devices ADV7511 HDMI Transmitter Device Driver
++ *
++ * Copyright 2013 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
++ *
++ * This program is free software; you may redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; version 2 of the License.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
++ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
++ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
++ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
++ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
++ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
++ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
++ * SOFTWARE.
++ */
++
++/*
++ * This file is named adv7511-v4l2.c so it doesn't conflict with the Analog
++ * Device ADV7511 (config fragment CONFIG_DRM_I2C_ADV7511).
++ */
++
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/i2c.h>
++#include <linux/delay.h>
++#include <linux/videodev2.h>
++#include <linux/gpio.h>
++#include <linux/workqueue.h>
++#include <linux/hdmi.h>
++#include <linux/v4l2-dv-timings.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-common.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-dv-timings.h>
++#include <media/i2c/adv7511.h>
++#include <media/cec.h>
++
++static int debug;
++module_param(debug, int, 0644);
++MODULE_PARM_DESC(debug, "debug level (0-2)");
++
++MODULE_DESCRIPTION("Analog Devices ADV7511 HDMI Transmitter Device Driver");
++MODULE_AUTHOR("Hans Verkuil");
++MODULE_LICENSE("GPL v2");
++
++#define MASK_ADV7511_EDID_RDY_INT   0x04
++#define MASK_ADV7511_MSEN_INT       0x40
++#define MASK_ADV7511_HPD_INT        0x80
++
++#define MASK_ADV7511_HPD_DETECT     0x40
++#define MASK_ADV7511_MSEN_DETECT    0x20
++#define MASK_ADV7511_EDID_RDY       0x10
++
++#define EDID_MAX_RETRIES (8)
++#define EDID_DELAY 250
++#define EDID_MAX_SEGM 8
++
++#define ADV7511_MAX_WIDTH 1920
++#define ADV7511_MAX_HEIGHT 1200
++#define ADV7511_MIN_PIXELCLOCK 20000000
++#define ADV7511_MAX_PIXELCLOCK 225000000
++
++#define ADV7511_MAX_ADDRS (3)
++
++/*
++**********************************************************************
++*
++*  Arrays with configuration parameters for the ADV7511
++*
++**********************************************************************
++*/
++
++struct i2c_reg_value {
++	unsigned char reg;
++	unsigned char value;
++};
++
++struct adv7511_state_edid {
++	/* total number of blocks */
++	u32 blocks;
++	/* Number of segments read */
++	u32 segments;
++	u8 data[EDID_MAX_SEGM * 256];
++	/* Number of EDID read retries left */
++	unsigned read_retries;
++	bool complete;
++};
++
++struct adv7511_state {
++	struct adv7511_platform_data pdata;
++	struct v4l2_subdev sd;
++	struct media_pad pad;
++	struct v4l2_ctrl_handler hdl;
++	int chip_revision;
++	u8 i2c_edid_addr;
++	u8 i2c_pktmem_addr;
++	u8 i2c_cec_addr;
++
++	struct i2c_client *i2c_cec;
++	struct cec_adapter *cec_adap;
++	u8   cec_addr[ADV7511_MAX_ADDRS];
++	u8   cec_valid_addrs;
++	bool cec_enabled_adap;
++
++	/* Is the adv7511 powered on? */
++	bool power_on;
++	/* Did we receive hotplug and rx-sense signals? */
++	bool have_monitor;
++	bool enabled_irq;
++	/* timings from s_dv_timings */
++	struct v4l2_dv_timings dv_timings;
++	u32 fmt_code;
++	u32 colorspace;
++	u32 ycbcr_enc;
++	u32 quantization;
++	u32 xfer_func;
++	u32 content_type;
++	/* controls */
++	struct v4l2_ctrl *hdmi_mode_ctrl;
++	struct v4l2_ctrl *hotplug_ctrl;
++	struct v4l2_ctrl *rx_sense_ctrl;
++	struct v4l2_ctrl *have_edid0_ctrl;
++	struct v4l2_ctrl *rgb_quantization_range_ctrl;
++	struct v4l2_ctrl *content_type_ctrl;
++	struct i2c_client *i2c_edid;
++	struct i2c_client *i2c_pktmem;
++	struct adv7511_state_edid edid;
++	/* Running counter of the number of detected EDIDs (for debugging) */
++	unsigned edid_detect_counter;
++	struct workqueue_struct *work_queue;
++	struct delayed_work edid_handler; /* work entry */
++};
++
++static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd);
++static bool adv7511_check_edid_status(struct v4l2_subdev *sd);
++static void adv7511_setup(struct v4l2_subdev *sd);
++static int adv7511_s_i2s_clock_freq(struct v4l2_subdev *sd, u32 freq);
++static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq);
++
++
++static const struct v4l2_dv_timings_cap adv7511_timings_cap = {
++	.type = V4L2_DV_BT_656_1120,
++	/* keep this initialization for compatibility with GCC < 4.4.6 */
++	.reserved = { 0 },
++	V4L2_INIT_BT_TIMINGS(640, ADV7511_MAX_WIDTH, 350, ADV7511_MAX_HEIGHT,
++		ADV7511_MIN_PIXELCLOCK, ADV7511_MAX_PIXELCLOCK,
++		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
++			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
++		V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
++			V4L2_DV_BT_CAP_CUSTOM)
++};
++
++static inline struct adv7511_state *get_adv7511_state(struct v4l2_subdev *sd)
++{
++	return container_of(sd, struct adv7511_state, sd);
++}
++
++static inline struct v4l2_subdev *to_sd(struct v4l2_ctrl *ctrl)
++{
++	return &container_of(ctrl->handler, struct adv7511_state, hdl)->sd;
++}
++
++/* ------------------------ I2C ----------------------------------------------- */
++
++static s32 adv_smbus_read_byte_data_check(struct i2c_client *client,
++					  u8 command, bool check)
++{
++	union i2c_smbus_data data;
++
++	if (!i2c_smbus_xfer(client->adapter, client->addr, client->flags,
++			    I2C_SMBUS_READ, command,
++			    I2C_SMBUS_BYTE_DATA, &data))
++		return data.byte;
++	if (check)
++		v4l_err(client, "error reading %02x, %02x\n",
++			client->addr, command);
++	return -1;
++}
++
++static s32 adv_smbus_read_byte_data(struct i2c_client *client, u8 command)
++{
++	int i;
++	for (i = 0; i < 3; i++) {
++		int ret = adv_smbus_read_byte_data_check(client, command, true);
++		if (ret >= 0) {
++			if (i)
++				v4l_err(client, "read ok after %d retries\n", i);
++			return ret;
++		}
++	}
++	v4l_err(client, "read failed\n");
++	return -1;
++}
++
++static int adv7511_rd(struct v4l2_subdev *sd, u8 reg)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++
++	return adv_smbus_read_byte_data(client, reg);
++}
++
++static int adv7511_wr(struct v4l2_subdev *sd, u8 reg, u8 val)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int ret;
++	int i;
++
++	for (i = 0; i < 3; i++) {
++		ret = i2c_smbus_write_byte_data(client, reg, val);
++		if (ret == 0)
++			return 0;
++	}
++	v4l2_err(sd, "%s: i2c write error\n", __func__);
++	return ret;
++}
++
++/* To set specific bits in the register, a clear-mask is given (to be AND-ed),
++   and then the value-mask (to be OR-ed). */
++static inline void adv7511_wr_and_or(struct v4l2_subdev *sd, u8 reg, u8 clr_mask, u8 val_mask)
++{
++	adv7511_wr(sd, reg, (adv7511_rd(sd, reg) & clr_mask) | val_mask);
++}
++
++static int adv_smbus_read_i2c_block_data(struct i2c_client *client,
++					 u8 command, unsigned length, u8 *values)
++{
++	union i2c_smbus_data data;
++	int ret;
++
++	if (length > I2C_SMBUS_BLOCK_MAX)
++		length = I2C_SMBUS_BLOCK_MAX;
++	data.block[0] = length;
++
++	ret = i2c_smbus_xfer(client->adapter, client->addr, client->flags,
++			     I2C_SMBUS_READ, command,
++			     I2C_SMBUS_I2C_BLOCK_DATA, &data);
++	memcpy(values, data.block + 1, length);
++	return ret;
++}
++
++static void adv7511_edid_rd(struct v4l2_subdev *sd, uint16_t len, uint8_t *buf)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	int i;
++	int err = 0;
++
++	v4l2_dbg(1, debug, sd, "%s:\n", __func__);
++
++	for (i = 0; !err && i < len; i += I2C_SMBUS_BLOCK_MAX)
++		err = adv_smbus_read_i2c_block_data(state->i2c_edid, i,
++						    I2C_SMBUS_BLOCK_MAX, buf + i);
++	if (err)
++		v4l2_err(sd, "%s: i2c read error\n", __func__);
++}
++
++static inline int adv7511_cec_read(struct v4l2_subdev *sd, u8 reg)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	return i2c_smbus_read_byte_data(state->i2c_cec, reg);
++}
++
++static int adv7511_cec_write(struct v4l2_subdev *sd, u8 reg, u8 val)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	int ret;
++	int i;
++
++	for (i = 0; i < 3; i++) {
++		ret = i2c_smbus_write_byte_data(state->i2c_cec, reg, val);
++		if (ret == 0)
++			return 0;
++	}
++	v4l2_err(sd, "%s: I2C Write Problem\n", __func__);
++	return ret;
++}
++
++static inline int adv7511_cec_write_and_or(struct v4l2_subdev *sd, u8 reg, u8 mask,
++				   u8 val)
++{
++	return adv7511_cec_write(sd, reg, (adv7511_cec_read(sd, reg) & mask) | val);
++}
++
++static int adv7511_pktmem_rd(struct v4l2_subdev *sd, u8 reg)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	return adv_smbus_read_byte_data(state->i2c_pktmem, reg);
++}
++
++static int adv7511_pktmem_wr(struct v4l2_subdev *sd, u8 reg, u8 val)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	int ret;
++	int i;
++
++	for (i = 0; i < 3; i++) {
++		ret = i2c_smbus_write_byte_data(state->i2c_pktmem, reg, val);
++		if (ret == 0)
++			return 0;
++	}
++	v4l2_err(sd, "%s: i2c write error\n", __func__);
++	return ret;
++}
++
++/* To set specific bits in the register, a clear-mask is given (to be AND-ed),
++   and then the value-mask (to be OR-ed). */
++static inline void adv7511_pktmem_wr_and_or(struct v4l2_subdev *sd, u8 reg, u8 clr_mask, u8 val_mask)
++{
++	adv7511_pktmem_wr(sd, reg, (adv7511_pktmem_rd(sd, reg) & clr_mask) | val_mask);
++}
++
++static inline bool adv7511_have_hotplug(struct v4l2_subdev *sd)
++{
++	return adv7511_rd(sd, 0x42) & MASK_ADV7511_HPD_DETECT;
++}
++
++static inline bool adv7511_have_rx_sense(struct v4l2_subdev *sd)
++{
++	return adv7511_rd(sd, 0x42) & MASK_ADV7511_MSEN_DETECT;
++}
++
++static void adv7511_csc_conversion_mode(struct v4l2_subdev *sd, u8 mode)
++{
++	adv7511_wr_and_or(sd, 0x18, 0x9f, (mode & 0x3)<<5);
++}
++
++static void adv7511_csc_coeff(struct v4l2_subdev *sd,
++			      u16 A1, u16 A2, u16 A3, u16 A4,
++			      u16 B1, u16 B2, u16 B3, u16 B4,
++			      u16 C1, u16 C2, u16 C3, u16 C4)
++{
++	/* A */
++	adv7511_wr_and_or(sd, 0x18, 0xe0, A1>>8);
++	adv7511_wr(sd, 0x19, A1);
++	adv7511_wr_and_or(sd, 0x1A, 0xe0, A2>>8);
++	adv7511_wr(sd, 0x1B, A2);
++	adv7511_wr_and_or(sd, 0x1c, 0xe0, A3>>8);
++	adv7511_wr(sd, 0x1d, A3);
++	adv7511_wr_and_or(sd, 0x1e, 0xe0, A4>>8);
++	adv7511_wr(sd, 0x1f, A4);
++
++	/* B */
++	adv7511_wr_and_or(sd, 0x20, 0xe0, B1>>8);
++	adv7511_wr(sd, 0x21, B1);
++	adv7511_wr_and_or(sd, 0x22, 0xe0, B2>>8);
++	adv7511_wr(sd, 0x23, B2);
++	adv7511_wr_and_or(sd, 0x24, 0xe0, B3>>8);
++	adv7511_wr(sd, 0x25, B3);
++	adv7511_wr_and_or(sd, 0x26, 0xe0, B4>>8);
++	adv7511_wr(sd, 0x27, B4);
++
++	/* C */
++	adv7511_wr_and_or(sd, 0x28, 0xe0, C1>>8);
++	adv7511_wr(sd, 0x29, C1);
++	adv7511_wr_and_or(sd, 0x2A, 0xe0, C2>>8);
++	adv7511_wr(sd, 0x2B, C2);
++	adv7511_wr_and_or(sd, 0x2C, 0xe0, C3>>8);
++	adv7511_wr(sd, 0x2D, C3);
++	adv7511_wr_and_or(sd, 0x2E, 0xe0, C4>>8);
++	adv7511_wr(sd, 0x2F, C4);
++}
++
++static void adv7511_csc_rgb_full2limit(struct v4l2_subdev *sd, bool enable)
++{
++	if (enable) {
++		u8 csc_mode = 0;
++		adv7511_csc_conversion_mode(sd, csc_mode);
++		adv7511_csc_coeff(sd,
++				  4096-564, 0, 0, 256,
++				  0, 4096-564, 0, 256,
++				  0, 0, 4096-564, 256);
++		/* enable CSC */
++		adv7511_wr_and_or(sd, 0x18, 0x7f, 0x80);
++		/* AVI infoframe: Limited range RGB (16-235) */
++		adv7511_wr_and_or(sd, 0x57, 0xf3, 0x04);
++	} else {
++		/* disable CSC */
++		adv7511_wr_and_or(sd, 0x18, 0x7f, 0x0);
++		/* AVI infoframe: Full range RGB (0-255) */
++		adv7511_wr_and_or(sd, 0x57, 0xf3, 0x08);
++	}
++}
++
++static void adv7511_set_rgb_quantization_mode(struct v4l2_subdev *sd, struct v4l2_ctrl *ctrl)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	/* Only makes sense for RGB formats */
++	if (state->fmt_code != MEDIA_BUS_FMT_RGB888_1X24) {
++		/* so just keep quantization */
++		adv7511_csc_rgb_full2limit(sd, false);
++		return;
++	}
++
++	switch (ctrl->val) {
++	case V4L2_DV_RGB_RANGE_AUTO:
++		/* automatic */
++		if (state->dv_timings.bt.flags & V4L2_DV_FL_IS_CE_VIDEO) {
++			/* CE format, RGB limited range (16-235) */
++			adv7511_csc_rgb_full2limit(sd, true);
++		} else {
++			/* not CE format, RGB full range (0-255) */
++			adv7511_csc_rgb_full2limit(sd, false);
++		}
++		break;
++	case V4L2_DV_RGB_RANGE_LIMITED:
++		/* RGB limited range (16-235) */
++		adv7511_csc_rgb_full2limit(sd, true);
++		break;
++	case V4L2_DV_RGB_RANGE_FULL:
++		/* RGB full range (0-255) */
++		adv7511_csc_rgb_full2limit(sd, false);
++		break;
++	}
++}
++
++/* ------------------------------ CTRL OPS ------------------------------ */
++
++static int adv7511_s_ctrl(struct v4l2_ctrl *ctrl)
++{
++	struct v4l2_subdev *sd = to_sd(ctrl);
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	v4l2_dbg(1, debug, sd, "%s: ctrl id: %d, ctrl->val %d\n", __func__, ctrl->id, ctrl->val);
++
++	if (state->hdmi_mode_ctrl == ctrl) {
++		/* Set HDMI or DVI-D */
++		adv7511_wr_and_or(sd, 0xaf, 0xfd, ctrl->val == V4L2_DV_TX_MODE_HDMI ? 0x02 : 0x00);
++		return 0;
++	}
++	if (state->rgb_quantization_range_ctrl == ctrl) {
++		adv7511_set_rgb_quantization_mode(sd, ctrl);
++		return 0;
++	}
++	if (state->content_type_ctrl == ctrl) {
++		u8 itc, cn;
++
++		state->content_type = ctrl->val;
++		itc = state->content_type != V4L2_DV_IT_CONTENT_TYPE_NO_ITC;
++		cn = itc ? state->content_type : V4L2_DV_IT_CONTENT_TYPE_GRAPHICS;
++		adv7511_wr_and_or(sd, 0x57, 0x7f, itc << 7);
++		adv7511_wr_and_or(sd, 0x59, 0xcf, cn << 4);
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++static const struct v4l2_ctrl_ops adv7511_ctrl_ops = {
++	.s_ctrl = adv7511_s_ctrl,
++};
++
++/* ---------------------------- CORE OPS ------------------------------------------- */
++
++#ifdef CONFIG_VIDEO_ADV_DEBUG
++static void adv7511_inv_register(struct v4l2_subdev *sd)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	v4l2_info(sd, "0x000-0x0ff: Main Map\n");
++	if (state->i2c_cec)
++		v4l2_info(sd, "0x100-0x1ff: CEC Map\n");
++}
++
++static int adv7511_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	reg->size = 1;
++	switch (reg->reg >> 8) {
++	case 0:
++		reg->val = adv7511_rd(sd, reg->reg & 0xff);
++		break;
++	case 1:
++		if (state->i2c_cec) {
++			reg->val = adv7511_cec_read(sd, reg->reg & 0xff);
++			break;
++		}
++		/* fall through */
++	default:
++		v4l2_info(sd, "Register %03llx not supported\n", reg->reg);
++		adv7511_inv_register(sd);
++		break;
++	}
++	return 0;
++}
++
++static int adv7511_s_register(struct v4l2_subdev *sd, const struct v4l2_dbg_register *reg)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	switch (reg->reg >> 8) {
++	case 0:
++		adv7511_wr(sd, reg->reg & 0xff, reg->val & 0xff);
++		break;
++	case 1:
++		if (state->i2c_cec) {
++			adv7511_cec_write(sd, reg->reg & 0xff, reg->val & 0xff);
++			break;
++		}
++		/* fall through */
++	default:
++		v4l2_info(sd, "Register %03llx not supported\n", reg->reg);
++		adv7511_inv_register(sd);
++		break;
++	}
++	return 0;
++}
++#endif
++
++struct adv7511_cfg_read_infoframe {
++	const char *desc;
++	u8 present_reg;
++	u8 present_mask;
++	u8 header[3];
++	u16 payload_addr;
++};
++
++static u8 hdmi_infoframe_checksum(u8 *ptr, size_t size)
++{
++	u8 csum = 0;
++	size_t i;
++
++	/* compute checksum */
++	for (i = 0; i < size; i++)
++		csum += ptr[i];
++
++	return 256 - csum;
++}
++
++static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_infoframe *cri)
++{
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	struct device *dev = &client->dev;
++	union hdmi_infoframe frame;
++	u8 buffer[32];
++	u8 len;
++	int i;
++
++	if (!(adv7511_rd(sd, cri->present_reg) & cri->present_mask)) {
++		v4l2_info(sd, "%s infoframe not transmitted\n", cri->desc);
++		return;
++	}
++
++	memcpy(buffer, cri->header, sizeof(cri->header));
++
++	len = buffer[2];
++
++	if (len + 4 > sizeof(buffer)) {
++		v4l2_err(sd, "%s: invalid %s infoframe length %d\n", __func__, cri->desc, len);
++		return;
++	}
++
++	if (cri->payload_addr >= 0x100) {
++		for (i = 0; i < len; i++)
++			buffer[i + 4] = adv7511_pktmem_rd(sd, cri->payload_addr + i - 0x100);
++	} else {
++		for (i = 0; i < len; i++)
++			buffer[i + 4] = adv7511_rd(sd, cri->payload_addr + i);
++	}
++	buffer[3] = 0;
++	buffer[3] = hdmi_infoframe_checksum(buffer, len + 4);
++
++	if (hdmi_infoframe_unpack(&frame, buffer) < 0) {
++		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);
++		return;
++	}
++
++	hdmi_infoframe_log(KERN_INFO, dev, &frame);
++}
++
++static void adv7511_log_infoframes(struct v4l2_subdev *sd)
++{
++	static const struct adv7511_cfg_read_infoframe cri[] = {
++		{ "AVI", 0x44, 0x10, { 0x82, 2, 13 }, 0x55 },
++		{ "Audio", 0x44, 0x08, { 0x84, 1, 10 }, 0x73 },
++		{ "SDP", 0x40, 0x40, { 0x83, 1, 25 }, 0x103 },
++	};
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(cri); i++)
++		log_infoframe(sd, &cri[i]);
++}
++
++static int adv7511_log_status(struct v4l2_subdev *sd)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	struct adv7511_state_edid *edid = &state->edid;
++	int i;
++
++	static const char * const states[] = {
++		"in reset",
++		"reading EDID",
++		"idle",
++		"initializing HDCP",
++		"HDCP enabled",
++		"initializing HDCP repeater",
++		"6", "7", "8", "9", "A", "B", "C", "D", "E", "F"
++	};
++	static const char * const errors[] = {
++		"no error",
++		"bad receiver BKSV",
++		"Ri mismatch",
++		"Pj mismatch",
++		"i2c error",
++		"timed out",
++		"max repeater cascade exceeded",
++		"hash check failed",
++		"too many devices",
++		"9", "A", "B", "C", "D", "E", "F"
++	};
++
++	v4l2_info(sd, "power %s\n", state->power_on ? "on" : "off");
++	v4l2_info(sd, "%s hotplug, %s Rx Sense, %s EDID (%d block(s))\n",
++		  (adv7511_rd(sd, 0x42) & MASK_ADV7511_HPD_DETECT) ? "detected" : "no",
++		  (adv7511_rd(sd, 0x42) & MASK_ADV7511_MSEN_DETECT) ? "detected" : "no",
++		  edid->segments ? "found" : "no",
++		  edid->blocks);
++	v4l2_info(sd, "%s output %s\n",
++		  (adv7511_rd(sd, 0xaf) & 0x02) ?
++		  "HDMI" : "DVI-D",
++		  (adv7511_rd(sd, 0xa1) & 0x3c) ?
++		  "disabled" : "enabled");
++	v4l2_info(sd, "state: %s, error: %s, detect count: %u, msk/irq: %02x/%02x\n",
++			  states[adv7511_rd(sd, 0xc8) & 0xf],
++			  errors[adv7511_rd(sd, 0xc8) >> 4], state->edid_detect_counter,
++			  adv7511_rd(sd, 0x94), adv7511_rd(sd, 0x96));
++	v4l2_info(sd, "RGB quantization: %s range\n", adv7511_rd(sd, 0x18) & 0x80 ? "limited" : "full");
++	if (adv7511_rd(sd, 0xaf) & 0x02) {
++		/* HDMI only */
++		u8 manual_cts = adv7511_rd(sd, 0x0a) & 0x80;
++		u32 N = (adv7511_rd(sd, 0x01) & 0xf) << 16 |
++			adv7511_rd(sd, 0x02) << 8 |
++			adv7511_rd(sd, 0x03);
++		u8 vic_detect = adv7511_rd(sd, 0x3e) >> 2;
++		u8 vic_sent = adv7511_rd(sd, 0x3d) & 0x3f;
++		u32 CTS;
++
++		if (manual_cts)
++			CTS = (adv7511_rd(sd, 0x07) & 0xf) << 16 |
++			      adv7511_rd(sd, 0x08) << 8 |
++			      adv7511_rd(sd, 0x09);
++		else
++			CTS = (adv7511_rd(sd, 0x04) & 0xf) << 16 |
++			      adv7511_rd(sd, 0x05) << 8 |
++			      adv7511_rd(sd, 0x06);
++		v4l2_info(sd, "CTS %s mode: N %d, CTS %d\n",
++			  manual_cts ? "manual" : "automatic", N, CTS);
++		v4l2_info(sd, "VIC: detected %d, sent %d\n",
++			  vic_detect, vic_sent);
++		adv7511_log_infoframes(sd);
++	}
++	if (state->dv_timings.type == V4L2_DV_BT_656_1120)
++		v4l2_print_dv_timings(sd->name, "timings: ",
++				&state->dv_timings, false);
++	else
++		v4l2_info(sd, "no timings set\n");
++	v4l2_info(sd, "i2c edid addr: 0x%x\n", state->i2c_edid_addr);
++
++	if (state->i2c_cec == NULL)
++		return 0;
++
++	v4l2_info(sd, "i2c cec addr: 0x%x\n", state->i2c_cec_addr);
++
++	v4l2_info(sd, "CEC: %s\n", state->cec_enabled_adap ?
++			"enabled" : "disabled");
++	if (state->cec_enabled_adap) {
++		for (i = 0; i < ADV7511_MAX_ADDRS; i++) {
++			bool is_valid = state->cec_valid_addrs & (1 << i);
++
++			if (is_valid)
++				v4l2_info(sd, "CEC Logical Address: 0x%x\n",
++					  state->cec_addr[i]);
++		}
++	}
++	v4l2_info(sd, "i2c pktmem addr: 0x%x\n", state->i2c_pktmem_addr);
++	return 0;
++}
++
++/* Power up/down adv7511 */
++static int adv7511_s_power(struct v4l2_subdev *sd, int on)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	const int retries = 20;
++	int i;
++
++	v4l2_dbg(1, debug, sd, "%s: power %s\n", __func__, on ? "on" : "off");
++
++	state->power_on = on;
++
++	if (!on) {
++		/* Power down */
++		adv7511_wr_and_or(sd, 0x41, 0xbf, 0x40);
++		return true;
++	}
++
++	/* Power up */
++	/* The adv7511 does not always come up immediately.
++	   Retry multiple times. */
++	for (i = 0; i < retries; i++) {
++		adv7511_wr_and_or(sd, 0x41, 0xbf, 0x0);
++		if ((adv7511_rd(sd, 0x41) & 0x40) == 0)
++			break;
++		adv7511_wr_and_or(sd, 0x41, 0xbf, 0x40);
++		msleep(10);
++	}
++	if (i == retries) {
++		v4l2_dbg(1, debug, sd, "%s: failed to powerup the adv7511!\n", __func__);
++		adv7511_s_power(sd, 0);
++		return false;
++	}
++	if (i > 1)
++		v4l2_dbg(1, debug, sd, "%s: needed %d retries to powerup the adv7511\n", __func__, i);
++
++	/* Reserved registers that must be set */
++	adv7511_wr(sd, 0x98, 0x03);
++	adv7511_wr_and_or(sd, 0x9a, 0xfe, 0x70);
++	adv7511_wr(sd, 0x9c, 0x30);
++	adv7511_wr_and_or(sd, 0x9d, 0xfc, 0x01);
++	adv7511_wr(sd, 0xa2, 0xa4);
++	adv7511_wr(sd, 0xa3, 0xa4);
++	adv7511_wr(sd, 0xe0, 0xd0);
++	adv7511_wr(sd, 0xf9, 0x00);
++
++	adv7511_wr(sd, 0x43, state->i2c_edid_addr);
++	adv7511_wr(sd, 0x45, state->i2c_pktmem_addr);
++
++	/* Set number of attempts to read the EDID */
++	adv7511_wr(sd, 0xc9, 0xf);
++	return true;
++}
++
++#if IS_ENABLED(CONFIG_VIDEO_ADV7511_CEC)
++static int adv7511_cec_adap_enable(struct cec_adapter *adap, bool enable)
++{
++	struct adv7511_state *state = cec_get_drvdata(adap);
++	struct v4l2_subdev *sd = &state->sd;
++
++	if (state->i2c_cec == NULL)
++		return -EIO;
++
++	if (!state->cec_enabled_adap && enable) {
++		/* power up cec section */
++		adv7511_cec_write_and_or(sd, 0x4e, 0xfc, 0x01);
++		/* legacy mode and clear all rx buffers */
++		adv7511_cec_write(sd, 0x4a, 0x07);
++		adv7511_cec_write(sd, 0x4a, 0);
++		adv7511_cec_write_and_or(sd, 0x11, 0xfe, 0); /* initially disable tx */
++		/* enabled irqs: */
++		/* tx: ready */
++		/* tx: arbitration lost */
++		/* tx: retry timeout */
++		/* rx: ready 1 */
++		if (state->enabled_irq)
++			adv7511_wr_and_or(sd, 0x95, 0xc0, 0x39);
++	} else if (state->cec_enabled_adap && !enable) {
++		if (state->enabled_irq)
++			adv7511_wr_and_or(sd, 0x95, 0xc0, 0x00);
++		/* disable address mask 1-3 */
++		adv7511_cec_write_and_or(sd, 0x4b, 0x8f, 0x00);
++		/* power down cec section */
++		adv7511_cec_write_and_or(sd, 0x4e, 0xfc, 0x00);
++		state->cec_valid_addrs = 0;
++	}
++	state->cec_enabled_adap = enable;
++	return 0;
++}
++
++static int adv7511_cec_adap_log_addr(struct cec_adapter *adap, u8 addr)
++{
++	struct adv7511_state *state = cec_get_drvdata(adap);
++	struct v4l2_subdev *sd = &state->sd;
++	unsigned int i, free_idx = ADV7511_MAX_ADDRS;
++
++	if (!state->cec_enabled_adap)
++		return addr == CEC_LOG_ADDR_INVALID ? 0 : -EIO;
++
++	if (addr == CEC_LOG_ADDR_INVALID) {
++		adv7511_cec_write_and_or(sd, 0x4b, 0x8f, 0);
++		state->cec_valid_addrs = 0;
++		return 0;
++	}
++
++	for (i = 0; i < ADV7511_MAX_ADDRS; i++) {
++		bool is_valid = state->cec_valid_addrs & (1 << i);
++
++		if (free_idx == ADV7511_MAX_ADDRS && !is_valid)
++			free_idx = i;
++		if (is_valid && state->cec_addr[i] == addr)
++			return 0;
++	}
++	if (i == ADV7511_MAX_ADDRS) {
++		i = free_idx;
++		if (i == ADV7511_MAX_ADDRS)
++			return -ENXIO;
++	}
++	state->cec_addr[i] = addr;
++	state->cec_valid_addrs |= 1 << i;
++
++	switch (i) {
++	case 0:
++		/* enable address mask 0 */
++		adv7511_cec_write_and_or(sd, 0x4b, 0xef, 0x10);
++		/* set address for mask 0 */
++		adv7511_cec_write_and_or(sd, 0x4c, 0xf0, addr);
++		break;
++	case 1:
++		/* enable address mask 1 */
++		adv7511_cec_write_and_or(sd, 0x4b, 0xdf, 0x20);
++		/* set address for mask 1 */
++		adv7511_cec_write_and_or(sd, 0x4c, 0x0f, addr << 4);
++		break;
++	case 2:
++		/* enable address mask 2 */
++		adv7511_cec_write_and_or(sd, 0x4b, 0xbf, 0x40);
++		/* set address for mask 1 */
++		adv7511_cec_write_and_or(sd, 0x4d, 0xf0, addr);
++		break;
++	}
++	return 0;
++}
++
++static int adv7511_cec_adap_transmit(struct cec_adapter *adap, u8 attempts,
++				     u32 signal_free_time, struct cec_msg *msg)
++{
++	struct adv7511_state *state = cec_get_drvdata(adap);
++	struct v4l2_subdev *sd = &state->sd;
++	u8 len = msg->len;
++	unsigned int i;
++
++	v4l2_dbg(1, debug, sd, "%s: len %d\n", __func__, len);
++
++	if (len > 16) {
++		v4l2_err(sd, "%s: len exceeded 16 (%d)\n", __func__, len);
++		return -EINVAL;
++	}
++
++	/*
++	 * The number of retries is the number of attempts - 1, but retry
++	 * at least once. It's not clear if a value of 0 is allowed, so
++	 * let's do at least one retry.
++	 */
++	adv7511_cec_write_and_or(sd, 0x12, ~0x70, max(1, attempts - 1) << 4);
++
++	/* blocking, clear cec tx irq status */
++	adv7511_wr_and_or(sd, 0x97, 0xc7, 0x38);
++
++	/* write data */
++	for (i = 0; i < len; i++)
++		adv7511_cec_write(sd, i, msg->msg[i]);
++
++	/* set length (data + header) */
++	adv7511_cec_write(sd, 0x10, len);
++	/* start transmit, enable tx */
++	adv7511_cec_write(sd, 0x11, 0x01);
++	return 0;
++}
++
++static void adv_cec_tx_raw_status(struct v4l2_subdev *sd, u8 tx_raw_status)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	if ((adv7511_cec_read(sd, 0x11) & 0x01) == 0) {
++		v4l2_dbg(1, debug, sd, "%s: tx raw: tx disabled\n", __func__);
++		return;
++	}
++
++	if (tx_raw_status & 0x10) {
++		v4l2_dbg(1, debug, sd,
++			 "%s: tx raw: arbitration lost\n", __func__);
++		cec_transmit_done(state->cec_adap, CEC_TX_STATUS_ARB_LOST,
++				  1, 0, 0, 0);
++		return;
++	}
++	if (tx_raw_status & 0x08) {
++		u8 status;
++		u8 nack_cnt;
++		u8 low_drive_cnt;
++
++		v4l2_dbg(1, debug, sd, "%s: tx raw: retry failed\n", __func__);
++		/*
++		 * We set this status bit since this hardware performs
++		 * retransmissions.
++		 */
++		status = CEC_TX_STATUS_MAX_RETRIES;
++		nack_cnt = adv7511_cec_read(sd, 0x14) & 0xf;
++		if (nack_cnt)
++			status |= CEC_TX_STATUS_NACK;
++		low_drive_cnt = adv7511_cec_read(sd, 0x14) >> 4;
++		if (low_drive_cnt)
++			status |= CEC_TX_STATUS_LOW_DRIVE;
++		cec_transmit_done(state->cec_adap, status,
++				  0, nack_cnt, low_drive_cnt, 0);
++		return;
++	}
++	if (tx_raw_status & 0x20) {
++		v4l2_dbg(1, debug, sd, "%s: tx raw: ready ok\n", __func__);
++		cec_transmit_done(state->cec_adap, CEC_TX_STATUS_OK, 0, 0, 0, 0);
++		return;
++	}
++}
++
++static const struct cec_adap_ops adv7511_cec_adap_ops = {
++	.adap_enable = adv7511_cec_adap_enable,
++	.adap_log_addr = adv7511_cec_adap_log_addr,
++	.adap_transmit = adv7511_cec_adap_transmit,
++};
++#endif
++
++/* Enable interrupts */
++static void adv7511_set_isr(struct v4l2_subdev *sd, bool enable)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	u8 irqs = MASK_ADV7511_HPD_INT | MASK_ADV7511_MSEN_INT;
++	u8 irqs_rd;
++	int retries = 100;
++
++	v4l2_dbg(2, debug, sd, "%s: %s\n", __func__, enable ? "enable" : "disable");
++
++	if (state->enabled_irq == enable)
++		return;
++	state->enabled_irq = enable;
++
++	/* The datasheet says that the EDID ready interrupt should be
++	   disabled if there is no hotplug. */
++	if (!enable)
++		irqs = 0;
++	else if (adv7511_have_hotplug(sd))
++		irqs |= MASK_ADV7511_EDID_RDY_INT;
++
++	adv7511_wr_and_or(sd, 0x95, 0xc0,
++			  (state->cec_enabled_adap && enable) ? 0x39 : 0x00);
++
++	/*
++	 * This i2c write can fail (approx. 1 in 1000 writes). But it
++	 * is essential that this register is correct, so retry it
++	 * multiple times.
++	 *
++	 * Note that the i2c write does not report an error, but the readback
++	 * clearly shows the wrong value.
++	 */
++	do {
++		adv7511_wr(sd, 0x94, irqs);
++		irqs_rd = adv7511_rd(sd, 0x94);
++	} while (retries-- && irqs_rd != irqs);
++
++	if (irqs_rd == irqs)
++		return;
++	v4l2_err(sd, "Could not set interrupts: hw failure?\n");
++}
++
++/* Interrupt handler */
++static int adv7511_isr(struct v4l2_subdev *sd, u32 status, bool *handled)
++{
++	u8 irq_status;
++	u8 cec_irq;
++
++	/* disable interrupts to prevent a race condition */
++	adv7511_set_isr(sd, false);
++	irq_status = adv7511_rd(sd, 0x96);
++	cec_irq = adv7511_rd(sd, 0x97);
++	/* clear detected interrupts */
++	adv7511_wr(sd, 0x96, irq_status);
++	adv7511_wr(sd, 0x97, cec_irq);
++
++	v4l2_dbg(1, debug, sd, "%s: irq 0x%x, cec-irq 0x%x\n", __func__,
++		 irq_status, cec_irq);
++
++	if (irq_status & (MASK_ADV7511_HPD_INT | MASK_ADV7511_MSEN_INT))
++		adv7511_check_monitor_present_status(sd);
++	if (irq_status & MASK_ADV7511_EDID_RDY_INT)
++		adv7511_check_edid_status(sd);
++
++#if IS_ENABLED(CONFIG_VIDEO_ADV7511_CEC)
++	if (cec_irq & 0x38)
++		adv_cec_tx_raw_status(sd, cec_irq);
++
++	if (cec_irq & 1) {
++		struct adv7511_state *state = get_adv7511_state(sd);
++		struct cec_msg msg;
++
++		msg.len = adv7511_cec_read(sd, 0x25) & 0x1f;
++
++		v4l2_dbg(1, debug, sd, "%s: cec msg len %d\n", __func__,
++			 msg.len);
++
++		if (msg.len > 16)
++			msg.len = 16;
++
++		if (msg.len) {
++			u8 i;
++
++			for (i = 0; i < msg.len; i++)
++				msg.msg[i] = adv7511_cec_read(sd, i + 0x15);
++
++			adv7511_cec_write(sd, 0x4a, 1); /* toggle to re-enable rx 1 */
++			adv7511_cec_write(sd, 0x4a, 0);
++			cec_received_msg(state->cec_adap, &msg);
++		}
++	}
++#endif
++
++	/* enable interrupts */
++	adv7511_set_isr(sd, true);
++
++	if (handled)
++		*handled = true;
++	return 0;
++}
++
++static const struct v4l2_subdev_core_ops adv7511_core_ops = {
++	.log_status = adv7511_log_status,
++#ifdef CONFIG_VIDEO_ADV_DEBUG
++	.g_register = adv7511_g_register,
++	.s_register = adv7511_s_register,
++#endif
++	.s_power = adv7511_s_power,
++	.interrupt_service_routine = adv7511_isr,
++};
++
++/* ------------------------------ VIDEO OPS ------------------------------ */
++
++/* Enable/disable adv7511 output */
++static int adv7511_s_stream(struct v4l2_subdev *sd, int enable)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	v4l2_dbg(1, debug, sd, "%s: %sable\n", __func__, (enable ? "en" : "dis"));
++	adv7511_wr_and_or(sd, 0xa1, ~0x3c, (enable ? 0 : 0x3c));
++	if (enable) {
++		adv7511_check_monitor_present_status(sd);
++	} else {
++		adv7511_s_power(sd, 0);
++		state->have_monitor = false;
++	}
++	return 0;
++}
++
++static int adv7511_s_dv_timings(struct v4l2_subdev *sd,
++			       struct v4l2_dv_timings *timings)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	struct v4l2_bt_timings *bt = &timings->bt;
++	u32 fps;
++
++	v4l2_dbg(1, debug, sd, "%s:\n", __func__);
++
++	/* quick sanity check */
++	if (!v4l2_valid_dv_timings(timings, &adv7511_timings_cap, NULL, NULL))
++		return -EINVAL;
++
++	/* Fill the optional fields .standards and .flags in struct v4l2_dv_timings
++	   if the format is one of the CEA or DMT timings. */
++	v4l2_find_dv_timings_cap(timings, &adv7511_timings_cap, 0, NULL, NULL);
++
++	/* save timings */
++	state->dv_timings = *timings;
++
++	/* set h/vsync polarities */
++	adv7511_wr_and_or(sd, 0x17, 0x9f,
++		((bt->polarities & V4L2_DV_VSYNC_POS_POL) ? 0 : 0x40) |
++		((bt->polarities & V4L2_DV_HSYNC_POS_POL) ? 0 : 0x20));
++
++	fps = (u32)bt->pixelclock / (V4L2_DV_BT_FRAME_WIDTH(bt) * V4L2_DV_BT_FRAME_HEIGHT(bt));
++	switch (fps) {
++	case 24:
++		adv7511_wr_and_or(sd, 0xfb, 0xf9, 1 << 1);
++		break;
++	case 25:
++		adv7511_wr_and_or(sd, 0xfb, 0xf9, 2 << 1);
++		break;
++	case 30:
++		adv7511_wr_and_or(sd, 0xfb, 0xf9, 3 << 1);
++		break;
++	default:
++		adv7511_wr_and_or(sd, 0xfb, 0xf9, 0);
++		break;
++	}
++
++	/* update quantization range based on new dv_timings */
++	adv7511_set_rgb_quantization_mode(sd, state->rgb_quantization_range_ctrl);
++
++	return 0;
++}
++
++static int adv7511_g_dv_timings(struct v4l2_subdev *sd,
++				struct v4l2_dv_timings *timings)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	v4l2_dbg(1, debug, sd, "%s:\n", __func__);
++
++	if (!timings)
++		return -EINVAL;
++
++	*timings = state->dv_timings;
++
++	return 0;
++}
++
++static int adv7511_enum_dv_timings(struct v4l2_subdev *sd,
++				   struct v4l2_enum_dv_timings *timings)
++{
++	if (timings->pad != 0)
++		return -EINVAL;
++
++	return v4l2_enum_dv_timings_cap(timings, &adv7511_timings_cap, NULL, NULL);
++}
++
++static int adv7511_dv_timings_cap(struct v4l2_subdev *sd,
++				  struct v4l2_dv_timings_cap *cap)
++{
++	if (cap->pad != 0)
++		return -EINVAL;
++
++	*cap = adv7511_timings_cap;
++	return 0;
++}
++
++static const struct v4l2_subdev_video_ops adv7511_video_ops = {
++	.s_stream = adv7511_s_stream,
++	.s_dv_timings = adv7511_s_dv_timings,
++	.g_dv_timings = adv7511_g_dv_timings,
++};
++
++/* ------------------------------ AUDIO OPS ------------------------------ */
++static int adv7511_s_audio_stream(struct v4l2_subdev *sd, int enable)
++{
++	v4l2_dbg(1, debug, sd, "%s: %sable\n", __func__, (enable ? "en" : "dis"));
++
++	if (enable)
++		adv7511_wr_and_or(sd, 0x4b, 0x3f, 0x80);
++	else
++		adv7511_wr_and_or(sd, 0x4b, 0x3f, 0x40);
++
++	return 0;
++}
++
++static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq)
++{
++	u32 N;
++
++	switch (freq) {
++	case 32000:  N = 4096;  break;
++	case 44100:  N = 6272;  break;
++	case 48000:  N = 6144;  break;
++	case 88200:  N = 12544; break;
++	case 96000:  N = 12288; break;
++	case 176400: N = 25088; break;
++	case 192000: N = 24576; break;
++	default:
++		return -EINVAL;
++	}
++
++	/* Set N (used with CTS to regenerate the audio clock) */
++	adv7511_wr(sd, 0x01, (N >> 16) & 0xf);
++	adv7511_wr(sd, 0x02, (N >> 8) & 0xff);
++	adv7511_wr(sd, 0x03, N & 0xff);
++
++	return 0;
++}
++
++static int adv7511_s_i2s_clock_freq(struct v4l2_subdev *sd, u32 freq)
++{
++	u32 i2s_sf;
++
++	switch (freq) {
++	case 32000:  i2s_sf = 0x30; break;
++	case 44100:  i2s_sf = 0x00; break;
++	case 48000:  i2s_sf = 0x20; break;
++	case 88200:  i2s_sf = 0x80; break;
++	case 96000:  i2s_sf = 0xa0; break;
++	case 176400: i2s_sf = 0xc0; break;
++	case 192000: i2s_sf = 0xe0; break;
++	default:
++		return -EINVAL;
++	}
++
++	/* Set sampling frequency for I2S audio to 48 kHz */
++	adv7511_wr_and_or(sd, 0x15, 0xf, i2s_sf);
++
++	return 0;
++}
++
++static int adv7511_s_routing(struct v4l2_subdev *sd, u32 input, u32 output, u32 config)
++{
++	/* Only 2 channels in use for application */
++	adv7511_wr_and_or(sd, 0x73, 0xf8, 0x1);
++	/* Speaker mapping */
++	adv7511_wr(sd, 0x76, 0x00);
++
++	/* 16 bit audio word length */
++	adv7511_wr_and_or(sd, 0x14, 0xf0, 0x02);
++
++	return 0;
++}
++
++static const struct v4l2_subdev_audio_ops adv7511_audio_ops = {
++	.s_stream = adv7511_s_audio_stream,
++	.s_clock_freq = adv7511_s_clock_freq,
++	.s_i2s_clock_freq = adv7511_s_i2s_clock_freq,
++	.s_routing = adv7511_s_routing,
++};
++
++/* ---------------------------- PAD OPS ------------------------------------- */
++
++static int adv7511_get_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	memset(edid->reserved, 0, sizeof(edid->reserved));
++
++	if (edid->pad != 0)
++		return -EINVAL;
++
++	if (edid->start_block == 0 && edid->blocks == 0) {
++		edid->blocks = state->edid.segments * 2;
++		return 0;
++	}
++
++	if (state->edid.segments == 0)
++		return -ENODATA;
++
++	if (edid->start_block >= state->edid.segments * 2)
++		return -EINVAL;
++
++	if (edid->start_block + edid->blocks > state->edid.segments * 2)
++		edid->blocks = state->edid.segments * 2 - edid->start_block;
++
++	memcpy(edid->edid, &state->edid.data[edid->start_block * 128],
++			128 * edid->blocks);
++
++	return 0;
++}
++
++static int adv7511_enum_mbus_code(struct v4l2_subdev *sd,
++				  struct v4l2_subdev_pad_config *cfg,
++				  struct v4l2_subdev_mbus_code_enum *code)
++{
++	if (code->pad != 0)
++		return -EINVAL;
++
++	switch (code->index) {
++	case 0:
++		code->code = MEDIA_BUS_FMT_RGB888_1X24;
++		break;
++	case 1:
++		code->code = MEDIA_BUS_FMT_YUYV8_1X16;
++		break;
++	case 2:
++		code->code = MEDIA_BUS_FMT_UYVY8_1X16;
++		break;
++	default:
++		return -EINVAL;
++	}
++	return 0;
++}
++
++static void adv7511_fill_format(struct adv7511_state *state,
++				struct v4l2_mbus_framefmt *format)
++{
++	format->width = state->dv_timings.bt.width;
++	format->height = state->dv_timings.bt.height;
++	format->field = V4L2_FIELD_NONE;
++}
++
++static int adv7511_get_fmt(struct v4l2_subdev *sd,
++			   struct v4l2_subdev_pad_config *cfg,
++			   struct v4l2_subdev_format *format)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	if (format->pad != 0)
++		return -EINVAL;
++
++	memset(&format->format, 0, sizeof(format->format));
++	adv7511_fill_format(state, &format->format);
++
++	if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
++		struct v4l2_mbus_framefmt *fmt;
++
++		fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad);
++		format->format.code = fmt->code;
++		format->format.colorspace = fmt->colorspace;
++		format->format.ycbcr_enc = fmt->ycbcr_enc;
++		format->format.quantization = fmt->quantization;
++		format->format.xfer_func = fmt->xfer_func;
++	} else {
++		format->format.code = state->fmt_code;
++		format->format.colorspace = state->colorspace;
++		format->format.ycbcr_enc = state->ycbcr_enc;
++		format->format.quantization = state->quantization;
++		format->format.xfer_func = state->xfer_func;
++	}
++
++	return 0;
++}
++
++static int adv7511_set_fmt(struct v4l2_subdev *sd,
++			   struct v4l2_subdev_pad_config *cfg,
++			   struct v4l2_subdev_format *format)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	/*
++	 * Bitfield namings come the CEA-861-F standard, table 8 "Auxiliary
++	 * Video Information (AVI) InfoFrame Format"
++	 *
++	 * c = Colorimetry
++	 * ec = Extended Colorimetry
++	 * y = RGB or YCbCr
++	 * q = RGB Quantization Range
++	 * yq = YCC Quantization Range
++	 */
++	u8 c = HDMI_COLORIMETRY_NONE;
++	u8 ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
++	u8 y = HDMI_COLORSPACE_RGB;
++	u8 q = HDMI_QUANTIZATION_RANGE_DEFAULT;
++	u8 yq = HDMI_YCC_QUANTIZATION_RANGE_LIMITED;
++	u8 itc = state->content_type != V4L2_DV_IT_CONTENT_TYPE_NO_ITC;
++	u8 cn = itc ? state->content_type : V4L2_DV_IT_CONTENT_TYPE_GRAPHICS;
++
++	if (format->pad != 0)
++		return -EINVAL;
++	switch (format->format.code) {
++	case MEDIA_BUS_FMT_UYVY8_1X16:
++	case MEDIA_BUS_FMT_YUYV8_1X16:
++	case MEDIA_BUS_FMT_RGB888_1X24:
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	adv7511_fill_format(state, &format->format);
++	if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
++		struct v4l2_mbus_framefmt *fmt;
++
++		fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad);
++		fmt->code = format->format.code;
++		fmt->colorspace = format->format.colorspace;
++		fmt->ycbcr_enc = format->format.ycbcr_enc;
++		fmt->quantization = format->format.quantization;
++		fmt->xfer_func = format->format.xfer_func;
++		return 0;
++	}
++
++	switch (format->format.code) {
++	case MEDIA_BUS_FMT_UYVY8_1X16:
++		adv7511_wr_and_or(sd, 0x15, 0xf0, 0x01);
++		adv7511_wr_and_or(sd, 0x16, 0x03, 0xb8);
++		y = HDMI_COLORSPACE_YUV422;
++		break;
++	case MEDIA_BUS_FMT_YUYV8_1X16:
++		adv7511_wr_and_or(sd, 0x15, 0xf0, 0x01);
++		adv7511_wr_and_or(sd, 0x16, 0x03, 0xbc);
++		y = HDMI_COLORSPACE_YUV422;
++		break;
++	case MEDIA_BUS_FMT_RGB888_1X24:
++	default:
++		adv7511_wr_and_or(sd, 0x15, 0xf0, 0x00);
++		adv7511_wr_and_or(sd, 0x16, 0x03, 0x00);
++		break;
++	}
++	state->fmt_code = format->format.code;
++	state->colorspace = format->format.colorspace;
++	state->ycbcr_enc = format->format.ycbcr_enc;
++	state->quantization = format->format.quantization;
++	state->xfer_func = format->format.xfer_func;
++
++	switch (format->format.colorspace) {
++	case V4L2_COLORSPACE_ADOBERGB:
++		c = HDMI_COLORIMETRY_EXTENDED;
++		ec = y ? HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601 :
++			 HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB;
++		break;
++	case V4L2_COLORSPACE_SMPTE170M:
++		c = y ? HDMI_COLORIMETRY_ITU_601 : HDMI_COLORIMETRY_NONE;
++		if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_XV601) {
++			c = HDMI_COLORIMETRY_EXTENDED;
++			ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
++		}
++		break;
++	case V4L2_COLORSPACE_REC709:
++		c = y ? HDMI_COLORIMETRY_ITU_709 : HDMI_COLORIMETRY_NONE;
++		if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_XV709) {
++			c = HDMI_COLORIMETRY_EXTENDED;
++			ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_709;
++		}
++		break;
++	case V4L2_COLORSPACE_SRGB:
++		c = y ? HDMI_COLORIMETRY_EXTENDED : HDMI_COLORIMETRY_NONE;
++		ec = y ? HDMI_EXTENDED_COLORIMETRY_S_YCC_601 :
++			 HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
++		break;
++	case V4L2_COLORSPACE_BT2020:
++		c = HDMI_COLORIMETRY_EXTENDED;
++		if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_BT2020_CONST_LUM)
++			ec = 5; /* Not yet available in hdmi.h */
++		else
++			ec = 6; /* Not yet available in hdmi.h */
++		break;
++	default:
++		break;
++	}
++
++	/*
++	 * CEA-861-F says that for RGB formats the YCC range must match the
++	 * RGB range, although sources should ignore the YCC range.
++	 *
++	 * The RGB quantization range shouldn't be non-zero if the EDID doesn't
++	 * have the Q bit set in the Video Capabilities Data Block, however this
++	 * isn't checked at the moment. The assumption is that the application
++	 * knows the EDID and can detect this.
++	 *
++	 * The same is true for the YCC quantization range: non-standard YCC
++	 * quantization ranges should only be sent if the EDID has the YQ bit
++	 * set in the Video Capabilities Data Block.
++	 */
++	switch (format->format.quantization) {
++	case V4L2_QUANTIZATION_FULL_RANGE:
++		q = y ? HDMI_QUANTIZATION_RANGE_DEFAULT :
++			HDMI_QUANTIZATION_RANGE_FULL;
++		yq = q ? q - 1 : HDMI_YCC_QUANTIZATION_RANGE_FULL;
++		break;
++	case V4L2_QUANTIZATION_LIM_RANGE:
++		q = y ? HDMI_QUANTIZATION_RANGE_DEFAULT :
++			HDMI_QUANTIZATION_RANGE_LIMITED;
++		yq = q ? q - 1 : HDMI_YCC_QUANTIZATION_RANGE_LIMITED;
++		break;
++	}
++
++	adv7511_wr_and_or(sd, 0x4a, 0xbf, 0);
++	adv7511_wr_and_or(sd, 0x55, 0x9f, y << 5);
++	adv7511_wr_and_or(sd, 0x56, 0x3f, c << 6);
++	adv7511_wr_and_or(sd, 0x57, 0x83, (ec << 4) | (q << 2) | (itc << 7));
++	adv7511_wr_and_or(sd, 0x59, 0x0f, (yq << 6) | (cn << 4));
++	adv7511_wr_and_or(sd, 0x4a, 0xff, 1);
++	adv7511_set_rgb_quantization_mode(sd, state->rgb_quantization_range_ctrl);
++
++	return 0;
++}
++
++static const struct v4l2_subdev_pad_ops adv7511_pad_ops = {
++	.get_edid = adv7511_get_edid,
++	.enum_mbus_code = adv7511_enum_mbus_code,
++	.get_fmt = adv7511_get_fmt,
++	.set_fmt = adv7511_set_fmt,
++	.enum_dv_timings = adv7511_enum_dv_timings,
++	.dv_timings_cap = adv7511_dv_timings_cap,
++};
++
++/* --------------------- SUBDEV OPS --------------------------------------- */
++
++static const struct v4l2_subdev_ops adv7511_ops = {
++	.core  = &adv7511_core_ops,
++	.pad  = &adv7511_pad_ops,
++	.video = &adv7511_video_ops,
++	.audio = &adv7511_audio_ops,
++};
++
++/* ----------------------------------------------------------------------- */
++static void adv7511_dbg_dump_edid(int lvl, int debug, struct v4l2_subdev *sd, int segment, u8 *buf)
++{
++	if (debug >= lvl) {
++		int i, j;
++		v4l2_dbg(lvl, debug, sd, "edid segment %d\n", segment);
++		for (i = 0; i < 256; i += 16) {
++			u8 b[128];
++			u8 *bp = b;
++			if (i == 128)
++				v4l2_dbg(lvl, debug, sd, "\n");
++			for (j = i; j < i + 16; j++) {
++				sprintf(bp, "0x%02x, ", buf[j]);
++				bp += 6;
++			}
++			bp[0] = '\0';
++			v4l2_dbg(lvl, debug, sd, "%s\n", b);
++		}
++	}
++}
++
++static void adv7511_notify_no_edid(struct v4l2_subdev *sd)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	struct adv7511_edid_detect ed;
++
++	/* We failed to read the EDID, so send an event for this. */
++	ed.present = false;
++	ed.segment = adv7511_rd(sd, 0xc4);
++	ed.phys_addr = CEC_PHYS_ADDR_INVALID;
++	cec_s_phys_addr(state->cec_adap, ed.phys_addr, false);
++	v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
++	v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x0);
++}
++
++static void adv7511_edid_handler(struct work_struct *work)
++{
++	struct delayed_work *dwork = to_delayed_work(work);
++	struct adv7511_state *state = container_of(dwork, struct adv7511_state, edid_handler);
++	struct v4l2_subdev *sd = &state->sd;
++
++	v4l2_dbg(1, debug, sd, "%s:\n", __func__);
++
++	if (adv7511_check_edid_status(sd)) {
++		/* Return if we received the EDID. */
++		return;
++	}
++
++	if (adv7511_have_hotplug(sd)) {
++		/* We must retry reading the EDID several times, it is possible
++		 * that initially the EDID couldn't be read due to i2c errors
++		 * (DVI connectors are particularly prone to this problem). */
++		if (state->edid.read_retries) {
++			state->edid.read_retries--;
++			v4l2_dbg(1, debug, sd, "%s: edid read failed\n", __func__);
++			state->have_monitor = false;
++			adv7511_s_power(sd, false);
++			adv7511_s_power(sd, true);
++			queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
++			return;
++		}
++	}
++
++	/* We failed to read the EDID, so send an event for this. */
++	adv7511_notify_no_edid(sd);
++	v4l2_dbg(1, debug, sd, "%s: no edid found\n", __func__);
++}
++
++static void adv7511_audio_setup(struct v4l2_subdev *sd)
++{
++	v4l2_dbg(1, debug, sd, "%s\n", __func__);
++
++	adv7511_s_i2s_clock_freq(sd, 48000);
++	adv7511_s_clock_freq(sd, 48000);
++	adv7511_s_routing(sd, 0, 0, 0);
++}
++
++/* Configure hdmi transmitter. */
++static void adv7511_setup(struct v4l2_subdev *sd)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	v4l2_dbg(1, debug, sd, "%s\n", __func__);
++
++	/* Input format: RGB 4:4:4 */
++	adv7511_wr_and_or(sd, 0x15, 0xf0, 0x0);
++	/* Output format: RGB 4:4:4 */
++	adv7511_wr_and_or(sd, 0x16, 0x7f, 0x0);
++	/* 1st order interpolation 4:2:2 -> 4:4:4 up conversion, Aspect ratio: 16:9 */
++	adv7511_wr_and_or(sd, 0x17, 0xf9, 0x06);
++	/* Disable pixel repetition */
++	adv7511_wr_and_or(sd, 0x3b, 0x9f, 0x0);
++	/* Disable CSC */
++	adv7511_wr_and_or(sd, 0x18, 0x7f, 0x0);
++	/* Output format: RGB 4:4:4, Active Format Information is valid,
++	 * underscanned */
++	adv7511_wr_and_or(sd, 0x55, 0x9c, 0x12);
++	/* AVI Info frame packet enable, Audio Info frame disable */
++	adv7511_wr_and_or(sd, 0x44, 0xe7, 0x10);
++	/* Colorimetry, Active format aspect ratio: same as picure. */
++	adv7511_wr(sd, 0x56, 0xa8);
++	/* No encryption */
++	adv7511_wr_and_or(sd, 0xaf, 0xed, 0x0);
++
++	/* Positive clk edge capture for input video clock */
++	adv7511_wr_and_or(sd, 0xba, 0x1f, 0x60);
++
++	adv7511_audio_setup(sd);
++
++	v4l2_ctrl_handler_setup(&state->hdl);
++}
++
++static void adv7511_notify_monitor_detect(struct v4l2_subdev *sd)
++{
++	struct adv7511_monitor_detect mdt;
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	mdt.present = state->have_monitor;
++	v4l2_subdev_notify(sd, ADV7511_MONITOR_DETECT, (void *)&mdt);
++}
++
++static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	/* read hotplug and rx-sense state */
++	u8 status = adv7511_rd(sd, 0x42);
++
++	v4l2_dbg(1, debug, sd, "%s: status: 0x%x%s%s\n",
++			 __func__,
++			 status,
++			 status & MASK_ADV7511_HPD_DETECT ? ", hotplug" : "",
++			 status & MASK_ADV7511_MSEN_DETECT ? ", rx-sense" : "");
++
++	/* update read only ctrls */
++	v4l2_ctrl_s_ctrl(state->hotplug_ctrl, adv7511_have_hotplug(sd) ? 0x1 : 0x0);
++	v4l2_ctrl_s_ctrl(state->rx_sense_ctrl, adv7511_have_rx_sense(sd) ? 0x1 : 0x0);
++
++	if ((status & MASK_ADV7511_HPD_DETECT) && ((status & MASK_ADV7511_MSEN_DETECT) || state->edid.segments)) {
++		v4l2_dbg(1, debug, sd, "%s: hotplug and (rx-sense or edid)\n", __func__);
++		if (!state->have_monitor) {
++			v4l2_dbg(1, debug, sd, "%s: monitor detected\n", __func__);
++			state->have_monitor = true;
++			adv7511_set_isr(sd, true);
++			if (!adv7511_s_power(sd, true)) {
++				v4l2_dbg(1, debug, sd, "%s: monitor detected, powerup failed\n", __func__);
++				return;
++			}
++			adv7511_setup(sd);
++			adv7511_notify_monitor_detect(sd);
++			state->edid.read_retries = EDID_MAX_RETRIES;
++			queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
++		}
++	} else if (status & MASK_ADV7511_HPD_DETECT) {
++		v4l2_dbg(1, debug, sd, "%s: hotplug detected\n", __func__);
++		state->edid.read_retries = EDID_MAX_RETRIES;
++		queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
++	} else if (!(status & MASK_ADV7511_HPD_DETECT)) {
++		v4l2_dbg(1, debug, sd, "%s: hotplug not detected\n", __func__);
++		if (state->have_monitor) {
++			v4l2_dbg(1, debug, sd, "%s: monitor not detected\n", __func__);
++			state->have_monitor = false;
++			adv7511_notify_monitor_detect(sd);
++		}
++		adv7511_s_power(sd, false);
++		memset(&state->edid, 0, sizeof(struct adv7511_state_edid));
++		adv7511_notify_no_edid(sd);
++	}
++}
++
++static bool edid_block_verify_crc(u8 *edid_block)
++{
++	u8 sum = 0;
++	int i;
++
++	for (i = 0; i < 128; i++)
++		sum += edid_block[i];
++	return sum == 0;
++}
++
++static bool edid_verify_crc(struct v4l2_subdev *sd, u32 segment)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	u32 blocks = state->edid.blocks;
++	u8 *data = state->edid.data;
++
++	if (!edid_block_verify_crc(&data[segment * 256]))
++		return false;
++	if ((segment + 1) * 2 <= blocks)
++		return edid_block_verify_crc(&data[segment * 256 + 128]);
++	return true;
++}
++
++static bool edid_verify_header(struct v4l2_subdev *sd, u32 segment)
++{
++	static const u8 hdmi_header[] = {
++		0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00
++	};
++	struct adv7511_state *state = get_adv7511_state(sd);
++	u8 *data = state->edid.data;
++
++	if (segment != 0)
++		return true;
++	return !memcmp(data, hdmi_header, sizeof(hdmi_header));
++}
++
++static bool adv7511_check_edid_status(struct v4l2_subdev *sd)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	u8 edidRdy = adv7511_rd(sd, 0xc5);
++
++	v4l2_dbg(1, debug, sd, "%s: edid ready (retries: %d)\n",
++			 __func__, EDID_MAX_RETRIES - state->edid.read_retries);
++
++	if (state->edid.complete)
++		return true;
++
++	if (edidRdy & MASK_ADV7511_EDID_RDY) {
++		int segment = adv7511_rd(sd, 0xc4);
++		struct adv7511_edid_detect ed;
++
++		if (segment >= EDID_MAX_SEGM) {
++			v4l2_err(sd, "edid segment number too big\n");
++			return false;
++		}
++		v4l2_dbg(1, debug, sd, "%s: got segment %d\n", __func__, segment);
++		adv7511_edid_rd(sd, 256, &state->edid.data[segment * 256]);
++		adv7511_dbg_dump_edid(2, debug, sd, segment, &state->edid.data[segment * 256]);
++		if (segment == 0) {
++			state->edid.blocks = state->edid.data[0x7e] + 1;
++			v4l2_dbg(1, debug, sd, "%s: %d blocks in total\n", __func__, state->edid.blocks);
++		}
++		if (!edid_verify_crc(sd, segment) ||
++		    !edid_verify_header(sd, segment)) {
++			/* edid crc error, force reread of edid segment */
++			v4l2_err(sd, "%s: edid crc or header error\n", __func__);
++			state->have_monitor = false;
++			adv7511_s_power(sd, false);
++			adv7511_s_power(sd, true);
++			return false;
++		}
++		/* one more segment read ok */
++		state->edid.segments = segment + 1;
++		v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x1);
++		if (((state->edid.data[0x7e] >> 1) + 1) > state->edid.segments) {
++			/* Request next EDID segment */
++			v4l2_dbg(1, debug, sd, "%s: request segment %d\n", __func__, state->edid.segments);
++			adv7511_wr(sd, 0xc9, 0xf);
++			adv7511_wr(sd, 0xc4, state->edid.segments);
++			state->edid.read_retries = EDID_MAX_RETRIES;
++			queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
++			return false;
++		}
++
++		v4l2_dbg(1, debug, sd, "%s: edid complete with %d segment(s)\n", __func__, state->edid.segments);
++		state->edid.complete = true;
++		ed.phys_addr = cec_get_edid_phys_addr(state->edid.data,
++						      state->edid.segments * 256,
++						      NULL);
++		/* report when we have all segments
++		   but report only for segment 0
++		 */
++		ed.present = true;
++		ed.segment = 0;
++		state->edid_detect_counter++;
++		cec_s_phys_addr(state->cec_adap, ed.phys_addr, false);
++		v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
++		return ed.present;
++	}
++
++	return false;
++}
++
++static int adv7511_registered(struct v4l2_subdev *sd)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	struct i2c_client *client = v4l2_get_subdevdata(sd);
++	int err;
++
++	err = cec_register_adapter(state->cec_adap, &client->dev);
++	if (err)
++		cec_delete_adapter(state->cec_adap);
++	return err;
++}
++
++static void adv7511_unregistered(struct v4l2_subdev *sd)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	cec_unregister_adapter(state->cec_adap);
++}
++
++static const struct v4l2_subdev_internal_ops adv7511_int_ops = {
++	.registered = adv7511_registered,
++	.unregistered = adv7511_unregistered,
++};
++
++/* ----------------------------------------------------------------------- */
++/* Setup ADV7511 */
++static void adv7511_init_setup(struct v4l2_subdev *sd)
++{
++	struct adv7511_state *state = get_adv7511_state(sd);
++	struct adv7511_state_edid *edid = &state->edid;
++	u32 cec_clk = state->pdata.cec_clk;
++	u8 ratio;
++
++	v4l2_dbg(1, debug, sd, "%s\n", __func__);
++
++	/* clear all interrupts */
++	adv7511_wr(sd, 0x96, 0xff);
++	adv7511_wr(sd, 0x97, 0xff);
++	/*
++	 * Stop HPD from resetting a lot of registers.
++	 * It might leave the chip in a partly un-initialized state,
++	 * in particular with regards to hotplug bounces.
++	 */
++	adv7511_wr_and_or(sd, 0xd6, 0x3f, 0xc0);
++	memset(edid, 0, sizeof(struct adv7511_state_edid));
++	state->have_monitor = false;
++	adv7511_set_isr(sd, false);
++	adv7511_s_stream(sd, false);
++	adv7511_s_audio_stream(sd, false);
++
++	if (state->i2c_cec == NULL)
++		return;
++
++	v4l2_dbg(1, debug, sd, "%s: cec_clk %d\n", __func__, cec_clk);
++
++	/* cec soft reset */
++	adv7511_cec_write(sd, 0x50, 0x01);
++	adv7511_cec_write(sd, 0x50, 0x00);
++
++	/* legacy mode */
++	adv7511_cec_write(sd, 0x4a, 0x00);
++
++	if (cec_clk % 750000 != 0)
++		v4l2_err(sd, "%s: cec_clk %d, not multiple of 750 Khz\n",
++			 __func__, cec_clk);
++
++	ratio = (cec_clk / 750000) - 1;
++	adv7511_cec_write(sd, 0x4e, ratio << 2);
++}
++
++static int adv7511_probe(struct i2c_client *client, const struct i2c_device_id *id)
++{
++	struct adv7511_state *state;
++	struct adv7511_platform_data *pdata = client->dev.platform_data;
++	struct v4l2_ctrl_handler *hdl;
++	struct v4l2_subdev *sd;
++	u8 chip_id[2];
++	int err = -EIO;
++
++	/* Check if the adapter supports the needed features */
++	if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA))
++		return -EIO;
++
++	state = devm_kzalloc(&client->dev, sizeof(struct adv7511_state), GFP_KERNEL);
++	if (!state)
++		return -ENOMEM;
++
++	/* Platform data */
++	if (!pdata) {
++		v4l_err(client, "No platform data!\n");
++		return -ENODEV;
++	}
++	memcpy(&state->pdata, pdata, sizeof(state->pdata));
++	state->fmt_code = MEDIA_BUS_FMT_RGB888_1X24;
++	state->colorspace = V4L2_COLORSPACE_SRGB;
++
++	sd = &state->sd;
++
++	v4l2_dbg(1, debug, sd, "detecting adv7511 client on address 0x%x\n",
++			 client->addr << 1);
++
++	v4l2_i2c_subdev_init(sd, client, &adv7511_ops);
++	sd->internal_ops = &adv7511_int_ops;
++
++	hdl = &state->hdl;
++	v4l2_ctrl_handler_init(hdl, 10);
++	/* add in ascending ID order */
++	state->hdmi_mode_ctrl = v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops,
++			V4L2_CID_DV_TX_MODE, V4L2_DV_TX_MODE_HDMI,
++			0, V4L2_DV_TX_MODE_DVI_D);
++	state->hotplug_ctrl = v4l2_ctrl_new_std(hdl, NULL,
++			V4L2_CID_DV_TX_HOTPLUG, 0, 1, 0, 0);
++	state->rx_sense_ctrl = v4l2_ctrl_new_std(hdl, NULL,
++			V4L2_CID_DV_TX_RXSENSE, 0, 1, 0, 0);
++	state->have_edid0_ctrl = v4l2_ctrl_new_std(hdl, NULL,
++			V4L2_CID_DV_TX_EDID_PRESENT, 0, 1, 0, 0);
++	state->rgb_quantization_range_ctrl =
++		v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops,
++			V4L2_CID_DV_TX_RGB_RANGE, V4L2_DV_RGB_RANGE_FULL,
++			0, V4L2_DV_RGB_RANGE_AUTO);
++	state->content_type_ctrl =
++		v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops,
++			V4L2_CID_DV_TX_IT_CONTENT_TYPE, V4L2_DV_IT_CONTENT_TYPE_NO_ITC,
++			0, V4L2_DV_IT_CONTENT_TYPE_NO_ITC);
++	sd->ctrl_handler = hdl;
++	if (hdl->error) {
++		err = hdl->error;
++		goto err_hdl;
++	}
++	state->pad.flags = MEDIA_PAD_FL_SINK;
++	err = media_entity_pads_init(&sd->entity, 1, &state->pad);
++	if (err)
++		goto err_hdl;
++
++	/* EDID and CEC i2c addr */
++	state->i2c_edid_addr = state->pdata.i2c_edid << 1;
++	state->i2c_cec_addr = state->pdata.i2c_cec << 1;
++	state->i2c_pktmem_addr = state->pdata.i2c_pktmem << 1;
++
++	state->chip_revision = adv7511_rd(sd, 0x0);
++	chip_id[0] = adv7511_rd(sd, 0xf5);
++	chip_id[1] = adv7511_rd(sd, 0xf6);
++	if (chip_id[0] != 0x75 || chip_id[1] != 0x11) {
++		v4l2_err(sd, "chip_id != 0x7511, read 0x%02x%02x\n", chip_id[0],
++			 chip_id[1]);
++		err = -EIO;
++		goto err_entity;
++	}
++
++	state->i2c_edid = i2c_new_dummy(client->adapter,
++					state->i2c_edid_addr >> 1);
++	if (state->i2c_edid == NULL) {
++		v4l2_err(sd, "failed to register edid i2c client\n");
++		err = -ENOMEM;
++		goto err_entity;
++	}
++
++	adv7511_wr(sd, 0xe1, state->i2c_cec_addr);
++	if (state->pdata.cec_clk < 3000000 ||
++	    state->pdata.cec_clk > 100000000) {
++		v4l2_err(sd, "%s: cec_clk %u outside range, disabling cec\n",
++				__func__, state->pdata.cec_clk);
++		state->pdata.cec_clk = 0;
++	}
++
++	if (state->pdata.cec_clk) {
++		state->i2c_cec = i2c_new_dummy(client->adapter,
++					       state->i2c_cec_addr >> 1);
++		if (state->i2c_cec == NULL) {
++			v4l2_err(sd, "failed to register cec i2c client\n");
++			err = -ENOMEM;
++			goto err_unreg_edid;
++		}
++		adv7511_wr(sd, 0xe2, 0x00); /* power up cec section */
++	} else {
++		adv7511_wr(sd, 0xe2, 0x01); /* power down cec section */
++	}
++
++	state->i2c_pktmem = i2c_new_dummy(client->adapter, state->i2c_pktmem_addr >> 1);
++	if (state->i2c_pktmem == NULL) {
++		v4l2_err(sd, "failed to register pktmem i2c client\n");
++		err = -ENOMEM;
++		goto err_unreg_cec;
++	}
++
++	state->work_queue = create_singlethread_workqueue(sd->name);
++	if (state->work_queue == NULL) {
++		v4l2_err(sd, "could not create workqueue\n");
++		err = -ENOMEM;
++		goto err_unreg_pktmem;
++	}
++
++	INIT_DELAYED_WORK(&state->edid_handler, adv7511_edid_handler);
++
++	adv7511_init_setup(sd);
++
++#if IS_ENABLED(CONFIG_VIDEO_ADV7511_CEC)
++	state->cec_adap = cec_allocate_adapter(&adv7511_cec_adap_ops,
++		state, dev_name(&client->dev), CEC_CAP_DEFAULTS,
++		ADV7511_MAX_ADDRS);
++	err = PTR_ERR_OR_ZERO(state->cec_adap);
++	if (err) {
++		destroy_workqueue(state->work_queue);
++		goto err_unreg_pktmem;
++	}
++#endif
++
++	adv7511_set_isr(sd, true);
++	adv7511_check_monitor_present_status(sd);
++
++	v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name,
++			  client->addr << 1, client->adapter->name);
++	return 0;
++
++err_unreg_pktmem:
++	i2c_unregister_device(state->i2c_pktmem);
++err_unreg_cec:
++	if (state->i2c_cec)
++		i2c_unregister_device(state->i2c_cec);
++err_unreg_edid:
++	i2c_unregister_device(state->i2c_edid);
++err_entity:
++	media_entity_cleanup(&sd->entity);
++err_hdl:
++	v4l2_ctrl_handler_free(&state->hdl);
++	return err;
++}
++
++/* ----------------------------------------------------------------------- */
++
++static int adv7511_remove(struct i2c_client *client)
++{
++	struct v4l2_subdev *sd = i2c_get_clientdata(client);
++	struct adv7511_state *state = get_adv7511_state(sd);
++
++	state->chip_revision = -1;
++
++	v4l2_dbg(1, debug, sd, "%s removed @ 0x%x (%s)\n", client->name,
++		 client->addr << 1, client->adapter->name);
++
++	adv7511_set_isr(sd, false);
++	adv7511_init_setup(sd);
++	cancel_delayed_work(&state->edid_handler);
++	i2c_unregister_device(state->i2c_edid);
++	if (state->i2c_cec)
++		i2c_unregister_device(state->i2c_cec);
++	i2c_unregister_device(state->i2c_pktmem);
++	destroy_workqueue(state->work_queue);
++	v4l2_device_unregister_subdev(sd);
++	media_entity_cleanup(&sd->entity);
++	v4l2_ctrl_handler_free(sd->ctrl_handler);
++	return 0;
++}
++
++/* ----------------------------------------------------------------------- */
++
++static const struct i2c_device_id adv7511_id[] = {
++	{ "adv7511", 0 },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, adv7511_id);
++
++static struct i2c_driver adv7511_driver = {
++	.driver = {
++		.name = "adv7511",
++	},
++	.probe = adv7511_probe,
++	.remove = adv7511_remove,
++	.id_table = adv7511_id,
++};
++
++module_i2c_driver(adv7511_driver);
+diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c
+deleted file mode 100644
+index 80c20404334a..000000000000
+--- a/drivers/media/i2c/adv7511.c
++++ /dev/null
+@@ -1,2003 +0,0 @@
+-/*
+- * Analog Devices ADV7511 HDMI Transmitter Device Driver
+- *
+- * Copyright 2013 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
+- *
+- * This program is free software; you may redistribute it and/or modify
+- * it under the terms of the GNU General Public License as published by
+- * the Free Software Foundation; version 2 of the License.
+- *
+- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+- * SOFTWARE.
+- */
+-
+-
+-#include <linux/kernel.h>
+-#include <linux/module.h>
+-#include <linux/slab.h>
+-#include <linux/i2c.h>
+-#include <linux/delay.h>
+-#include <linux/videodev2.h>
+-#include <linux/gpio.h>
+-#include <linux/workqueue.h>
+-#include <linux/hdmi.h>
+-#include <linux/v4l2-dv-timings.h>
+-#include <media/v4l2-device.h>
+-#include <media/v4l2-common.h>
+-#include <media/v4l2-ctrls.h>
+-#include <media/v4l2-dv-timings.h>
+-#include <media/i2c/adv7511.h>
+-#include <media/cec.h>
+-
+-static int debug;
+-module_param(debug, int, 0644);
+-MODULE_PARM_DESC(debug, "debug level (0-2)");
+-
+-MODULE_DESCRIPTION("Analog Devices ADV7511 HDMI Transmitter Device Driver");
+-MODULE_AUTHOR("Hans Verkuil");
+-MODULE_LICENSE("GPL v2");
+-
+-#define MASK_ADV7511_EDID_RDY_INT   0x04
+-#define MASK_ADV7511_MSEN_INT       0x40
+-#define MASK_ADV7511_HPD_INT        0x80
+-
+-#define MASK_ADV7511_HPD_DETECT     0x40
+-#define MASK_ADV7511_MSEN_DETECT    0x20
+-#define MASK_ADV7511_EDID_RDY       0x10
+-
+-#define EDID_MAX_RETRIES (8)
+-#define EDID_DELAY 250
+-#define EDID_MAX_SEGM 8
+-
+-#define ADV7511_MAX_WIDTH 1920
+-#define ADV7511_MAX_HEIGHT 1200
+-#define ADV7511_MIN_PIXELCLOCK 20000000
+-#define ADV7511_MAX_PIXELCLOCK 225000000
+-
+-#define ADV7511_MAX_ADDRS (3)
+-
+-/*
+-**********************************************************************
+-*
+-*  Arrays with configuration parameters for the ADV7511
+-*
+-**********************************************************************
+-*/
+-
+-struct i2c_reg_value {
+-	unsigned char reg;
+-	unsigned char value;
+-};
+-
+-struct adv7511_state_edid {
+-	/* total number of blocks */
+-	u32 blocks;
+-	/* Number of segments read */
+-	u32 segments;
+-	u8 data[EDID_MAX_SEGM * 256];
+-	/* Number of EDID read retries left */
+-	unsigned read_retries;
+-	bool complete;
+-};
+-
+-struct adv7511_state {
+-	struct adv7511_platform_data pdata;
+-	struct v4l2_subdev sd;
+-	struct media_pad pad;
+-	struct v4l2_ctrl_handler hdl;
+-	int chip_revision;
+-	u8 i2c_edid_addr;
+-	u8 i2c_pktmem_addr;
+-	u8 i2c_cec_addr;
+-
+-	struct i2c_client *i2c_cec;
+-	struct cec_adapter *cec_adap;
+-	u8   cec_addr[ADV7511_MAX_ADDRS];
+-	u8   cec_valid_addrs;
+-	bool cec_enabled_adap;
+-
+-	/* Is the adv7511 powered on? */
+-	bool power_on;
+-	/* Did we receive hotplug and rx-sense signals? */
+-	bool have_monitor;
+-	bool enabled_irq;
+-	/* timings from s_dv_timings */
+-	struct v4l2_dv_timings dv_timings;
+-	u32 fmt_code;
+-	u32 colorspace;
+-	u32 ycbcr_enc;
+-	u32 quantization;
+-	u32 xfer_func;
+-	u32 content_type;
+-	/* controls */
+-	struct v4l2_ctrl *hdmi_mode_ctrl;
+-	struct v4l2_ctrl *hotplug_ctrl;
+-	struct v4l2_ctrl *rx_sense_ctrl;
+-	struct v4l2_ctrl *have_edid0_ctrl;
+-	struct v4l2_ctrl *rgb_quantization_range_ctrl;
+-	struct v4l2_ctrl *content_type_ctrl;
+-	struct i2c_client *i2c_edid;
+-	struct i2c_client *i2c_pktmem;
+-	struct adv7511_state_edid edid;
+-	/* Running counter of the number of detected EDIDs (for debugging) */
+-	unsigned edid_detect_counter;
+-	struct workqueue_struct *work_queue;
+-	struct delayed_work edid_handler; /* work entry */
+-};
+-
+-static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd);
+-static bool adv7511_check_edid_status(struct v4l2_subdev *sd);
+-static void adv7511_setup(struct v4l2_subdev *sd);
+-static int adv7511_s_i2s_clock_freq(struct v4l2_subdev *sd, u32 freq);
+-static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq);
+-
+-
+-static const struct v4l2_dv_timings_cap adv7511_timings_cap = {
+-	.type = V4L2_DV_BT_656_1120,
+-	/* keep this initialization for compatibility with GCC < 4.4.6 */
+-	.reserved = { 0 },
+-	V4L2_INIT_BT_TIMINGS(640, ADV7511_MAX_WIDTH, 350, ADV7511_MAX_HEIGHT,
+-		ADV7511_MIN_PIXELCLOCK, ADV7511_MAX_PIXELCLOCK,
+-		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
+-			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
+-		V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
+-			V4L2_DV_BT_CAP_CUSTOM)
+-};
+-
+-static inline struct adv7511_state *get_adv7511_state(struct v4l2_subdev *sd)
+-{
+-	return container_of(sd, struct adv7511_state, sd);
+-}
+-
+-static inline struct v4l2_subdev *to_sd(struct v4l2_ctrl *ctrl)
+-{
+-	return &container_of(ctrl->handler, struct adv7511_state, hdl)->sd;
+-}
+-
+-/* ------------------------ I2C ----------------------------------------------- */
+-
+-static s32 adv_smbus_read_byte_data_check(struct i2c_client *client,
+-					  u8 command, bool check)
+-{
+-	union i2c_smbus_data data;
+-
+-	if (!i2c_smbus_xfer(client->adapter, client->addr, client->flags,
+-			    I2C_SMBUS_READ, command,
+-			    I2C_SMBUS_BYTE_DATA, &data))
+-		return data.byte;
+-	if (check)
+-		v4l_err(client, "error reading %02x, %02x\n",
+-			client->addr, command);
+-	return -1;
+-}
+-
+-static s32 adv_smbus_read_byte_data(struct i2c_client *client, u8 command)
+-{
+-	int i;
+-	for (i = 0; i < 3; i++) {
+-		int ret = adv_smbus_read_byte_data_check(client, command, true);
+-		if (ret >= 0) {
+-			if (i)
+-				v4l_err(client, "read ok after %d retries\n", i);
+-			return ret;
+-		}
+-	}
+-	v4l_err(client, "read failed\n");
+-	return -1;
+-}
+-
+-static int adv7511_rd(struct v4l2_subdev *sd, u8 reg)
+-{
+-	struct i2c_client *client = v4l2_get_subdevdata(sd);
+-
+-	return adv_smbus_read_byte_data(client, reg);
+-}
+-
+-static int adv7511_wr(struct v4l2_subdev *sd, u8 reg, u8 val)
+-{
+-	struct i2c_client *client = v4l2_get_subdevdata(sd);
+-	int ret;
+-	int i;
+-
+-	for (i = 0; i < 3; i++) {
+-		ret = i2c_smbus_write_byte_data(client, reg, val);
+-		if (ret == 0)
+-			return 0;
+-	}
+-	v4l2_err(sd, "%s: i2c write error\n", __func__);
+-	return ret;
+-}
+-
+-/* To set specific bits in the register, a clear-mask is given (to be AND-ed),
+-   and then the value-mask (to be OR-ed). */
+-static inline void adv7511_wr_and_or(struct v4l2_subdev *sd, u8 reg, u8 clr_mask, u8 val_mask)
+-{
+-	adv7511_wr(sd, reg, (adv7511_rd(sd, reg) & clr_mask) | val_mask);
+-}
+-
+-static int adv_smbus_read_i2c_block_data(struct i2c_client *client,
+-					 u8 command, unsigned length, u8 *values)
+-{
+-	union i2c_smbus_data data;
+-	int ret;
+-
+-	if (length > I2C_SMBUS_BLOCK_MAX)
+-		length = I2C_SMBUS_BLOCK_MAX;
+-	data.block[0] = length;
+-
+-	ret = i2c_smbus_xfer(client->adapter, client->addr, client->flags,
+-			     I2C_SMBUS_READ, command,
+-			     I2C_SMBUS_I2C_BLOCK_DATA, &data);
+-	memcpy(values, data.block + 1, length);
+-	return ret;
+-}
+-
+-static void adv7511_edid_rd(struct v4l2_subdev *sd, uint16_t len, uint8_t *buf)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	int i;
+-	int err = 0;
+-
+-	v4l2_dbg(1, debug, sd, "%s:\n", __func__);
+-
+-	for (i = 0; !err && i < len; i += I2C_SMBUS_BLOCK_MAX)
+-		err = adv_smbus_read_i2c_block_data(state->i2c_edid, i,
+-						    I2C_SMBUS_BLOCK_MAX, buf + i);
+-	if (err)
+-		v4l2_err(sd, "%s: i2c read error\n", __func__);
+-}
+-
+-static inline int adv7511_cec_read(struct v4l2_subdev *sd, u8 reg)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	return i2c_smbus_read_byte_data(state->i2c_cec, reg);
+-}
+-
+-static int adv7511_cec_write(struct v4l2_subdev *sd, u8 reg, u8 val)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	int ret;
+-	int i;
+-
+-	for (i = 0; i < 3; i++) {
+-		ret = i2c_smbus_write_byte_data(state->i2c_cec, reg, val);
+-		if (ret == 0)
+-			return 0;
+-	}
+-	v4l2_err(sd, "%s: I2C Write Problem\n", __func__);
+-	return ret;
+-}
+-
+-static inline int adv7511_cec_write_and_or(struct v4l2_subdev *sd, u8 reg, u8 mask,
+-				   u8 val)
+-{
+-	return adv7511_cec_write(sd, reg, (adv7511_cec_read(sd, reg) & mask) | val);
+-}
+-
+-static int adv7511_pktmem_rd(struct v4l2_subdev *sd, u8 reg)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	return adv_smbus_read_byte_data(state->i2c_pktmem, reg);
+-}
+-
+-static int adv7511_pktmem_wr(struct v4l2_subdev *sd, u8 reg, u8 val)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	int ret;
+-	int i;
+-
+-	for (i = 0; i < 3; i++) {
+-		ret = i2c_smbus_write_byte_data(state->i2c_pktmem, reg, val);
+-		if (ret == 0)
+-			return 0;
+-	}
+-	v4l2_err(sd, "%s: i2c write error\n", __func__);
+-	return ret;
+-}
+-
+-/* To set specific bits in the register, a clear-mask is given (to be AND-ed),
+-   and then the value-mask (to be OR-ed). */
+-static inline void adv7511_pktmem_wr_and_or(struct v4l2_subdev *sd, u8 reg, u8 clr_mask, u8 val_mask)
+-{
+-	adv7511_pktmem_wr(sd, reg, (adv7511_pktmem_rd(sd, reg) & clr_mask) | val_mask);
+-}
+-
+-static inline bool adv7511_have_hotplug(struct v4l2_subdev *sd)
+-{
+-	return adv7511_rd(sd, 0x42) & MASK_ADV7511_HPD_DETECT;
+-}
+-
+-static inline bool adv7511_have_rx_sense(struct v4l2_subdev *sd)
+-{
+-	return adv7511_rd(sd, 0x42) & MASK_ADV7511_MSEN_DETECT;
+-}
+-
+-static void adv7511_csc_conversion_mode(struct v4l2_subdev *sd, u8 mode)
+-{
+-	adv7511_wr_and_or(sd, 0x18, 0x9f, (mode & 0x3)<<5);
+-}
+-
+-static void adv7511_csc_coeff(struct v4l2_subdev *sd,
+-			      u16 A1, u16 A2, u16 A3, u16 A4,
+-			      u16 B1, u16 B2, u16 B3, u16 B4,
+-			      u16 C1, u16 C2, u16 C3, u16 C4)
+-{
+-	/* A */
+-	adv7511_wr_and_or(sd, 0x18, 0xe0, A1>>8);
+-	adv7511_wr(sd, 0x19, A1);
+-	adv7511_wr_and_or(sd, 0x1A, 0xe0, A2>>8);
+-	adv7511_wr(sd, 0x1B, A2);
+-	adv7511_wr_and_or(sd, 0x1c, 0xe0, A3>>8);
+-	adv7511_wr(sd, 0x1d, A3);
+-	adv7511_wr_and_or(sd, 0x1e, 0xe0, A4>>8);
+-	adv7511_wr(sd, 0x1f, A4);
+-
+-	/* B */
+-	adv7511_wr_and_or(sd, 0x20, 0xe0, B1>>8);
+-	adv7511_wr(sd, 0x21, B1);
+-	adv7511_wr_and_or(sd, 0x22, 0xe0, B2>>8);
+-	adv7511_wr(sd, 0x23, B2);
+-	adv7511_wr_and_or(sd, 0x24, 0xe0, B3>>8);
+-	adv7511_wr(sd, 0x25, B3);
+-	adv7511_wr_and_or(sd, 0x26, 0xe0, B4>>8);
+-	adv7511_wr(sd, 0x27, B4);
+-
+-	/* C */
+-	adv7511_wr_and_or(sd, 0x28, 0xe0, C1>>8);
+-	adv7511_wr(sd, 0x29, C1);
+-	adv7511_wr_and_or(sd, 0x2A, 0xe0, C2>>8);
+-	adv7511_wr(sd, 0x2B, C2);
+-	adv7511_wr_and_or(sd, 0x2C, 0xe0, C3>>8);
+-	adv7511_wr(sd, 0x2D, C3);
+-	adv7511_wr_and_or(sd, 0x2E, 0xe0, C4>>8);
+-	adv7511_wr(sd, 0x2F, C4);
+-}
+-
+-static void adv7511_csc_rgb_full2limit(struct v4l2_subdev *sd, bool enable)
+-{
+-	if (enable) {
+-		u8 csc_mode = 0;
+-		adv7511_csc_conversion_mode(sd, csc_mode);
+-		adv7511_csc_coeff(sd,
+-				  4096-564, 0, 0, 256,
+-				  0, 4096-564, 0, 256,
+-				  0, 0, 4096-564, 256);
+-		/* enable CSC */
+-		adv7511_wr_and_or(sd, 0x18, 0x7f, 0x80);
+-		/* AVI infoframe: Limited range RGB (16-235) */
+-		adv7511_wr_and_or(sd, 0x57, 0xf3, 0x04);
+-	} else {
+-		/* disable CSC */
+-		adv7511_wr_and_or(sd, 0x18, 0x7f, 0x0);
+-		/* AVI infoframe: Full range RGB (0-255) */
+-		adv7511_wr_and_or(sd, 0x57, 0xf3, 0x08);
+-	}
+-}
+-
+-static void adv7511_set_rgb_quantization_mode(struct v4l2_subdev *sd, struct v4l2_ctrl *ctrl)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	/* Only makes sense for RGB formats */
+-	if (state->fmt_code != MEDIA_BUS_FMT_RGB888_1X24) {
+-		/* so just keep quantization */
+-		adv7511_csc_rgb_full2limit(sd, false);
+-		return;
+-	}
+-
+-	switch (ctrl->val) {
+-	case V4L2_DV_RGB_RANGE_AUTO:
+-		/* automatic */
+-		if (state->dv_timings.bt.flags & V4L2_DV_FL_IS_CE_VIDEO) {
+-			/* CE format, RGB limited range (16-235) */
+-			adv7511_csc_rgb_full2limit(sd, true);
+-		} else {
+-			/* not CE format, RGB full range (0-255) */
+-			adv7511_csc_rgb_full2limit(sd, false);
+-		}
+-		break;
+-	case V4L2_DV_RGB_RANGE_LIMITED:
+-		/* RGB limited range (16-235) */
+-		adv7511_csc_rgb_full2limit(sd, true);
+-		break;
+-	case V4L2_DV_RGB_RANGE_FULL:
+-		/* RGB full range (0-255) */
+-		adv7511_csc_rgb_full2limit(sd, false);
+-		break;
+-	}
+-}
+-
+-/* ------------------------------ CTRL OPS ------------------------------ */
+-
+-static int adv7511_s_ctrl(struct v4l2_ctrl *ctrl)
+-{
+-	struct v4l2_subdev *sd = to_sd(ctrl);
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	v4l2_dbg(1, debug, sd, "%s: ctrl id: %d, ctrl->val %d\n", __func__, ctrl->id, ctrl->val);
+-
+-	if (state->hdmi_mode_ctrl == ctrl) {
+-		/* Set HDMI or DVI-D */
+-		adv7511_wr_and_or(sd, 0xaf, 0xfd, ctrl->val == V4L2_DV_TX_MODE_HDMI ? 0x02 : 0x00);
+-		return 0;
+-	}
+-	if (state->rgb_quantization_range_ctrl == ctrl) {
+-		adv7511_set_rgb_quantization_mode(sd, ctrl);
+-		return 0;
+-	}
+-	if (state->content_type_ctrl == ctrl) {
+-		u8 itc, cn;
+-
+-		state->content_type = ctrl->val;
+-		itc = state->content_type != V4L2_DV_IT_CONTENT_TYPE_NO_ITC;
+-		cn = itc ? state->content_type : V4L2_DV_IT_CONTENT_TYPE_GRAPHICS;
+-		adv7511_wr_and_or(sd, 0x57, 0x7f, itc << 7);
+-		adv7511_wr_and_or(sd, 0x59, 0xcf, cn << 4);
+-		return 0;
+-	}
+-
+-	return -EINVAL;
+-}
+-
+-static const struct v4l2_ctrl_ops adv7511_ctrl_ops = {
+-	.s_ctrl = adv7511_s_ctrl,
+-};
+-
+-/* ---------------------------- CORE OPS ------------------------------------------- */
+-
+-#ifdef CONFIG_VIDEO_ADV_DEBUG
+-static void adv7511_inv_register(struct v4l2_subdev *sd)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	v4l2_info(sd, "0x000-0x0ff: Main Map\n");
+-	if (state->i2c_cec)
+-		v4l2_info(sd, "0x100-0x1ff: CEC Map\n");
+-}
+-
+-static int adv7511_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	reg->size = 1;
+-	switch (reg->reg >> 8) {
+-	case 0:
+-		reg->val = adv7511_rd(sd, reg->reg & 0xff);
+-		break;
+-	case 1:
+-		if (state->i2c_cec) {
+-			reg->val = adv7511_cec_read(sd, reg->reg & 0xff);
+-			break;
+-		}
+-		/* fall through */
+-	default:
+-		v4l2_info(sd, "Register %03llx not supported\n", reg->reg);
+-		adv7511_inv_register(sd);
+-		break;
+-	}
+-	return 0;
+-}
+-
+-static int adv7511_s_register(struct v4l2_subdev *sd, const struct v4l2_dbg_register *reg)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	switch (reg->reg >> 8) {
+-	case 0:
+-		adv7511_wr(sd, reg->reg & 0xff, reg->val & 0xff);
+-		break;
+-	case 1:
+-		if (state->i2c_cec) {
+-			adv7511_cec_write(sd, reg->reg & 0xff, reg->val & 0xff);
+-			break;
+-		}
+-		/* fall through */
+-	default:
+-		v4l2_info(sd, "Register %03llx not supported\n", reg->reg);
+-		adv7511_inv_register(sd);
+-		break;
+-	}
+-	return 0;
+-}
+-#endif
+-
+-struct adv7511_cfg_read_infoframe {
+-	const char *desc;
+-	u8 present_reg;
+-	u8 present_mask;
+-	u8 header[3];
+-	u16 payload_addr;
+-};
+-
+-static u8 hdmi_infoframe_checksum(u8 *ptr, size_t size)
+-{
+-	u8 csum = 0;
+-	size_t i;
+-
+-	/* compute checksum */
+-	for (i = 0; i < size; i++)
+-		csum += ptr[i];
+-
+-	return 256 - csum;
+-}
+-
+-static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_infoframe *cri)
+-{
+-	struct i2c_client *client = v4l2_get_subdevdata(sd);
+-	struct device *dev = &client->dev;
+-	union hdmi_infoframe frame;
+-	u8 buffer[32];
+-	u8 len;
+-	int i;
+-
+-	if (!(adv7511_rd(sd, cri->present_reg) & cri->present_mask)) {
+-		v4l2_info(sd, "%s infoframe not transmitted\n", cri->desc);
+-		return;
+-	}
+-
+-	memcpy(buffer, cri->header, sizeof(cri->header));
+-
+-	len = buffer[2];
+-
+-	if (len + 4 > sizeof(buffer)) {
+-		v4l2_err(sd, "%s: invalid %s infoframe length %d\n", __func__, cri->desc, len);
+-		return;
+-	}
+-
+-	if (cri->payload_addr >= 0x100) {
+-		for (i = 0; i < len; i++)
+-			buffer[i + 4] = adv7511_pktmem_rd(sd, cri->payload_addr + i - 0x100);
+-	} else {
+-		for (i = 0; i < len; i++)
+-			buffer[i + 4] = adv7511_rd(sd, cri->payload_addr + i);
+-	}
+-	buffer[3] = 0;
+-	buffer[3] = hdmi_infoframe_checksum(buffer, len + 4);
+-
+-	if (hdmi_infoframe_unpack(&frame, buffer) < 0) {
+-		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);
+-		return;
+-	}
+-
+-	hdmi_infoframe_log(KERN_INFO, dev, &frame);
+-}
+-
+-static void adv7511_log_infoframes(struct v4l2_subdev *sd)
+-{
+-	static const struct adv7511_cfg_read_infoframe cri[] = {
+-		{ "AVI", 0x44, 0x10, { 0x82, 2, 13 }, 0x55 },
+-		{ "Audio", 0x44, 0x08, { 0x84, 1, 10 }, 0x73 },
+-		{ "SDP", 0x40, 0x40, { 0x83, 1, 25 }, 0x103 },
+-	};
+-	int i;
+-
+-	for (i = 0; i < ARRAY_SIZE(cri); i++)
+-		log_infoframe(sd, &cri[i]);
+-}
+-
+-static int adv7511_log_status(struct v4l2_subdev *sd)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	struct adv7511_state_edid *edid = &state->edid;
+-	int i;
+-
+-	static const char * const states[] = {
+-		"in reset",
+-		"reading EDID",
+-		"idle",
+-		"initializing HDCP",
+-		"HDCP enabled",
+-		"initializing HDCP repeater",
+-		"6", "7", "8", "9", "A", "B", "C", "D", "E", "F"
+-	};
+-	static const char * const errors[] = {
+-		"no error",
+-		"bad receiver BKSV",
+-		"Ri mismatch",
+-		"Pj mismatch",
+-		"i2c error",
+-		"timed out",
+-		"max repeater cascade exceeded",
+-		"hash check failed",
+-		"too many devices",
+-		"9", "A", "B", "C", "D", "E", "F"
+-	};
+-
+-	v4l2_info(sd, "power %s\n", state->power_on ? "on" : "off");
+-	v4l2_info(sd, "%s hotplug, %s Rx Sense, %s EDID (%d block(s))\n",
+-		  (adv7511_rd(sd, 0x42) & MASK_ADV7511_HPD_DETECT) ? "detected" : "no",
+-		  (adv7511_rd(sd, 0x42) & MASK_ADV7511_MSEN_DETECT) ? "detected" : "no",
+-		  edid->segments ? "found" : "no",
+-		  edid->blocks);
+-	v4l2_info(sd, "%s output %s\n",
+-		  (adv7511_rd(sd, 0xaf) & 0x02) ?
+-		  "HDMI" : "DVI-D",
+-		  (adv7511_rd(sd, 0xa1) & 0x3c) ?
+-		  "disabled" : "enabled");
+-	v4l2_info(sd, "state: %s, error: %s, detect count: %u, msk/irq: %02x/%02x\n",
+-			  states[adv7511_rd(sd, 0xc8) & 0xf],
+-			  errors[adv7511_rd(sd, 0xc8) >> 4], state->edid_detect_counter,
+-			  adv7511_rd(sd, 0x94), adv7511_rd(sd, 0x96));
+-	v4l2_info(sd, "RGB quantization: %s range\n", adv7511_rd(sd, 0x18) & 0x80 ? "limited" : "full");
+-	if (adv7511_rd(sd, 0xaf) & 0x02) {
+-		/* HDMI only */
+-		u8 manual_cts = adv7511_rd(sd, 0x0a) & 0x80;
+-		u32 N = (adv7511_rd(sd, 0x01) & 0xf) << 16 |
+-			adv7511_rd(sd, 0x02) << 8 |
+-			adv7511_rd(sd, 0x03);
+-		u8 vic_detect = adv7511_rd(sd, 0x3e) >> 2;
+-		u8 vic_sent = adv7511_rd(sd, 0x3d) & 0x3f;
+-		u32 CTS;
+-
+-		if (manual_cts)
+-			CTS = (adv7511_rd(sd, 0x07) & 0xf) << 16 |
+-			      adv7511_rd(sd, 0x08) << 8 |
+-			      adv7511_rd(sd, 0x09);
+-		else
+-			CTS = (adv7511_rd(sd, 0x04) & 0xf) << 16 |
+-			      adv7511_rd(sd, 0x05) << 8 |
+-			      adv7511_rd(sd, 0x06);
+-		v4l2_info(sd, "CTS %s mode: N %d, CTS %d\n",
+-			  manual_cts ? "manual" : "automatic", N, CTS);
+-		v4l2_info(sd, "VIC: detected %d, sent %d\n",
+-			  vic_detect, vic_sent);
+-		adv7511_log_infoframes(sd);
+-	}
+-	if (state->dv_timings.type == V4L2_DV_BT_656_1120)
+-		v4l2_print_dv_timings(sd->name, "timings: ",
+-				&state->dv_timings, false);
+-	else
+-		v4l2_info(sd, "no timings set\n");
+-	v4l2_info(sd, "i2c edid addr: 0x%x\n", state->i2c_edid_addr);
+-
+-	if (state->i2c_cec == NULL)
+-		return 0;
+-
+-	v4l2_info(sd, "i2c cec addr: 0x%x\n", state->i2c_cec_addr);
+-
+-	v4l2_info(sd, "CEC: %s\n", state->cec_enabled_adap ?
+-			"enabled" : "disabled");
+-	if (state->cec_enabled_adap) {
+-		for (i = 0; i < ADV7511_MAX_ADDRS; i++) {
+-			bool is_valid = state->cec_valid_addrs & (1 << i);
+-
+-			if (is_valid)
+-				v4l2_info(sd, "CEC Logical Address: 0x%x\n",
+-					  state->cec_addr[i]);
+-		}
+-	}
+-	v4l2_info(sd, "i2c pktmem addr: 0x%x\n", state->i2c_pktmem_addr);
+-	return 0;
+-}
+-
+-/* Power up/down adv7511 */
+-static int adv7511_s_power(struct v4l2_subdev *sd, int on)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	const int retries = 20;
+-	int i;
+-
+-	v4l2_dbg(1, debug, sd, "%s: power %s\n", __func__, on ? "on" : "off");
+-
+-	state->power_on = on;
+-
+-	if (!on) {
+-		/* Power down */
+-		adv7511_wr_and_or(sd, 0x41, 0xbf, 0x40);
+-		return true;
+-	}
+-
+-	/* Power up */
+-	/* The adv7511 does not always come up immediately.
+-	   Retry multiple times. */
+-	for (i = 0; i < retries; i++) {
+-		adv7511_wr_and_or(sd, 0x41, 0xbf, 0x0);
+-		if ((adv7511_rd(sd, 0x41) & 0x40) == 0)
+-			break;
+-		adv7511_wr_and_or(sd, 0x41, 0xbf, 0x40);
+-		msleep(10);
+-	}
+-	if (i == retries) {
+-		v4l2_dbg(1, debug, sd, "%s: failed to powerup the adv7511!\n", __func__);
+-		adv7511_s_power(sd, 0);
+-		return false;
+-	}
+-	if (i > 1)
+-		v4l2_dbg(1, debug, sd, "%s: needed %d retries to powerup the adv7511\n", __func__, i);
+-
+-	/* Reserved registers that must be set */
+-	adv7511_wr(sd, 0x98, 0x03);
+-	adv7511_wr_and_or(sd, 0x9a, 0xfe, 0x70);
+-	adv7511_wr(sd, 0x9c, 0x30);
+-	adv7511_wr_and_or(sd, 0x9d, 0xfc, 0x01);
+-	adv7511_wr(sd, 0xa2, 0xa4);
+-	adv7511_wr(sd, 0xa3, 0xa4);
+-	adv7511_wr(sd, 0xe0, 0xd0);
+-	adv7511_wr(sd, 0xf9, 0x00);
+-
+-	adv7511_wr(sd, 0x43, state->i2c_edid_addr);
+-	adv7511_wr(sd, 0x45, state->i2c_pktmem_addr);
+-
+-	/* Set number of attempts to read the EDID */
+-	adv7511_wr(sd, 0xc9, 0xf);
+-	return true;
+-}
+-
+-#if IS_ENABLED(CONFIG_VIDEO_ADV7511_CEC)
+-static int adv7511_cec_adap_enable(struct cec_adapter *adap, bool enable)
+-{
+-	struct adv7511_state *state = cec_get_drvdata(adap);
+-	struct v4l2_subdev *sd = &state->sd;
+-
+-	if (state->i2c_cec == NULL)
+-		return -EIO;
+-
+-	if (!state->cec_enabled_adap && enable) {
+-		/* power up cec section */
+-		adv7511_cec_write_and_or(sd, 0x4e, 0xfc, 0x01);
+-		/* legacy mode and clear all rx buffers */
+-		adv7511_cec_write(sd, 0x4a, 0x07);
+-		adv7511_cec_write(sd, 0x4a, 0);
+-		adv7511_cec_write_and_or(sd, 0x11, 0xfe, 0); /* initially disable tx */
+-		/* enabled irqs: */
+-		/* tx: ready */
+-		/* tx: arbitration lost */
+-		/* tx: retry timeout */
+-		/* rx: ready 1 */
+-		if (state->enabled_irq)
+-			adv7511_wr_and_or(sd, 0x95, 0xc0, 0x39);
+-	} else if (state->cec_enabled_adap && !enable) {
+-		if (state->enabled_irq)
+-			adv7511_wr_and_or(sd, 0x95, 0xc0, 0x00);
+-		/* disable address mask 1-3 */
+-		adv7511_cec_write_and_or(sd, 0x4b, 0x8f, 0x00);
+-		/* power down cec section */
+-		adv7511_cec_write_and_or(sd, 0x4e, 0xfc, 0x00);
+-		state->cec_valid_addrs = 0;
+-	}
+-	state->cec_enabled_adap = enable;
+-	return 0;
+-}
+-
+-static int adv7511_cec_adap_log_addr(struct cec_adapter *adap, u8 addr)
+-{
+-	struct adv7511_state *state = cec_get_drvdata(adap);
+-	struct v4l2_subdev *sd = &state->sd;
+-	unsigned int i, free_idx = ADV7511_MAX_ADDRS;
+-
+-	if (!state->cec_enabled_adap)
+-		return addr == CEC_LOG_ADDR_INVALID ? 0 : -EIO;
+-
+-	if (addr == CEC_LOG_ADDR_INVALID) {
+-		adv7511_cec_write_and_or(sd, 0x4b, 0x8f, 0);
+-		state->cec_valid_addrs = 0;
+-		return 0;
+-	}
+-
+-	for (i = 0; i < ADV7511_MAX_ADDRS; i++) {
+-		bool is_valid = state->cec_valid_addrs & (1 << i);
+-
+-		if (free_idx == ADV7511_MAX_ADDRS && !is_valid)
+-			free_idx = i;
+-		if (is_valid && state->cec_addr[i] == addr)
+-			return 0;
+-	}
+-	if (i == ADV7511_MAX_ADDRS) {
+-		i = free_idx;
+-		if (i == ADV7511_MAX_ADDRS)
+-			return -ENXIO;
+-	}
+-	state->cec_addr[i] = addr;
+-	state->cec_valid_addrs |= 1 << i;
+-
+-	switch (i) {
+-	case 0:
+-		/* enable address mask 0 */
+-		adv7511_cec_write_and_or(sd, 0x4b, 0xef, 0x10);
+-		/* set address for mask 0 */
+-		adv7511_cec_write_and_or(sd, 0x4c, 0xf0, addr);
+-		break;
+-	case 1:
+-		/* enable address mask 1 */
+-		adv7511_cec_write_and_or(sd, 0x4b, 0xdf, 0x20);
+-		/* set address for mask 1 */
+-		adv7511_cec_write_and_or(sd, 0x4c, 0x0f, addr << 4);
+-		break;
+-	case 2:
+-		/* enable address mask 2 */
+-		adv7511_cec_write_and_or(sd, 0x4b, 0xbf, 0x40);
+-		/* set address for mask 1 */
+-		adv7511_cec_write_and_or(sd, 0x4d, 0xf0, addr);
+-		break;
+-	}
+-	return 0;
+-}
+-
+-static int adv7511_cec_adap_transmit(struct cec_adapter *adap, u8 attempts,
+-				     u32 signal_free_time, struct cec_msg *msg)
+-{
+-	struct adv7511_state *state = cec_get_drvdata(adap);
+-	struct v4l2_subdev *sd = &state->sd;
+-	u8 len = msg->len;
+-	unsigned int i;
+-
+-	v4l2_dbg(1, debug, sd, "%s: len %d\n", __func__, len);
+-
+-	if (len > 16) {
+-		v4l2_err(sd, "%s: len exceeded 16 (%d)\n", __func__, len);
+-		return -EINVAL;
+-	}
+-
+-	/*
+-	 * The number of retries is the number of attempts - 1, but retry
+-	 * at least once. It's not clear if a value of 0 is allowed, so
+-	 * let's do at least one retry.
+-	 */
+-	adv7511_cec_write_and_or(sd, 0x12, ~0x70, max(1, attempts - 1) << 4);
+-
+-	/* blocking, clear cec tx irq status */
+-	adv7511_wr_and_or(sd, 0x97, 0xc7, 0x38);
+-
+-	/* write data */
+-	for (i = 0; i < len; i++)
+-		adv7511_cec_write(sd, i, msg->msg[i]);
+-
+-	/* set length (data + header) */
+-	adv7511_cec_write(sd, 0x10, len);
+-	/* start transmit, enable tx */
+-	adv7511_cec_write(sd, 0x11, 0x01);
+-	return 0;
+-}
+-
+-static void adv_cec_tx_raw_status(struct v4l2_subdev *sd, u8 tx_raw_status)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	if ((adv7511_cec_read(sd, 0x11) & 0x01) == 0) {
+-		v4l2_dbg(1, debug, sd, "%s: tx raw: tx disabled\n", __func__);
+-		return;
+-	}
+-
+-	if (tx_raw_status & 0x10) {
+-		v4l2_dbg(1, debug, sd,
+-			 "%s: tx raw: arbitration lost\n", __func__);
+-		cec_transmit_done(state->cec_adap, CEC_TX_STATUS_ARB_LOST,
+-				  1, 0, 0, 0);
+-		return;
+-	}
+-	if (tx_raw_status & 0x08) {
+-		u8 status;
+-		u8 nack_cnt;
+-		u8 low_drive_cnt;
+-
+-		v4l2_dbg(1, debug, sd, "%s: tx raw: retry failed\n", __func__);
+-		/*
+-		 * We set this status bit since this hardware performs
+-		 * retransmissions.
+-		 */
+-		status = CEC_TX_STATUS_MAX_RETRIES;
+-		nack_cnt = adv7511_cec_read(sd, 0x14) & 0xf;
+-		if (nack_cnt)
+-			status |= CEC_TX_STATUS_NACK;
+-		low_drive_cnt = adv7511_cec_read(sd, 0x14) >> 4;
+-		if (low_drive_cnt)
+-			status |= CEC_TX_STATUS_LOW_DRIVE;
+-		cec_transmit_done(state->cec_adap, status,
+-				  0, nack_cnt, low_drive_cnt, 0);
+-		return;
+-	}
+-	if (tx_raw_status & 0x20) {
+-		v4l2_dbg(1, debug, sd, "%s: tx raw: ready ok\n", __func__);
+-		cec_transmit_done(state->cec_adap, CEC_TX_STATUS_OK, 0, 0, 0, 0);
+-		return;
+-	}
+-}
+-
+-static const struct cec_adap_ops adv7511_cec_adap_ops = {
+-	.adap_enable = adv7511_cec_adap_enable,
+-	.adap_log_addr = adv7511_cec_adap_log_addr,
+-	.adap_transmit = adv7511_cec_adap_transmit,
+-};
+-#endif
+-
+-/* Enable interrupts */
+-static void adv7511_set_isr(struct v4l2_subdev *sd, bool enable)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	u8 irqs = MASK_ADV7511_HPD_INT | MASK_ADV7511_MSEN_INT;
+-	u8 irqs_rd;
+-	int retries = 100;
+-
+-	v4l2_dbg(2, debug, sd, "%s: %s\n", __func__, enable ? "enable" : "disable");
+-
+-	if (state->enabled_irq == enable)
+-		return;
+-	state->enabled_irq = enable;
+-
+-	/* The datasheet says that the EDID ready interrupt should be
+-	   disabled if there is no hotplug. */
+-	if (!enable)
+-		irqs = 0;
+-	else if (adv7511_have_hotplug(sd))
+-		irqs |= MASK_ADV7511_EDID_RDY_INT;
+-
+-	adv7511_wr_and_or(sd, 0x95, 0xc0,
+-			  (state->cec_enabled_adap && enable) ? 0x39 : 0x00);
+-
+-	/*
+-	 * This i2c write can fail (approx. 1 in 1000 writes). But it
+-	 * is essential that this register is correct, so retry it
+-	 * multiple times.
+-	 *
+-	 * Note that the i2c write does not report an error, but the readback
+-	 * clearly shows the wrong value.
+-	 */
+-	do {
+-		adv7511_wr(sd, 0x94, irqs);
+-		irqs_rd = adv7511_rd(sd, 0x94);
+-	} while (retries-- && irqs_rd != irqs);
+-
+-	if (irqs_rd == irqs)
+-		return;
+-	v4l2_err(sd, "Could not set interrupts: hw failure?\n");
+-}
+-
+-/* Interrupt handler */
+-static int adv7511_isr(struct v4l2_subdev *sd, u32 status, bool *handled)
+-{
+-	u8 irq_status;
+-	u8 cec_irq;
+-
+-	/* disable interrupts to prevent a race condition */
+-	adv7511_set_isr(sd, false);
+-	irq_status = adv7511_rd(sd, 0x96);
+-	cec_irq = adv7511_rd(sd, 0x97);
+-	/* clear detected interrupts */
+-	adv7511_wr(sd, 0x96, irq_status);
+-	adv7511_wr(sd, 0x97, cec_irq);
+-
+-	v4l2_dbg(1, debug, sd, "%s: irq 0x%x, cec-irq 0x%x\n", __func__,
+-		 irq_status, cec_irq);
+-
+-	if (irq_status & (MASK_ADV7511_HPD_INT | MASK_ADV7511_MSEN_INT))
+-		adv7511_check_monitor_present_status(sd);
+-	if (irq_status & MASK_ADV7511_EDID_RDY_INT)
+-		adv7511_check_edid_status(sd);
+-
+-#if IS_ENABLED(CONFIG_VIDEO_ADV7511_CEC)
+-	if (cec_irq & 0x38)
+-		adv_cec_tx_raw_status(sd, cec_irq);
+-
+-	if (cec_irq & 1) {
+-		struct adv7511_state *state = get_adv7511_state(sd);
+-		struct cec_msg msg;
+-
+-		msg.len = adv7511_cec_read(sd, 0x25) & 0x1f;
+-
+-		v4l2_dbg(1, debug, sd, "%s: cec msg len %d\n", __func__,
+-			 msg.len);
+-
+-		if (msg.len > 16)
+-			msg.len = 16;
+-
+-		if (msg.len) {
+-			u8 i;
+-
+-			for (i = 0; i < msg.len; i++)
+-				msg.msg[i] = adv7511_cec_read(sd, i + 0x15);
+-
+-			adv7511_cec_write(sd, 0x4a, 1); /* toggle to re-enable rx 1 */
+-			adv7511_cec_write(sd, 0x4a, 0);
+-			cec_received_msg(state->cec_adap, &msg);
+-		}
+-	}
+-#endif
+-
+-	/* enable interrupts */
+-	adv7511_set_isr(sd, true);
+-
+-	if (handled)
+-		*handled = true;
+-	return 0;
+-}
+-
+-static const struct v4l2_subdev_core_ops adv7511_core_ops = {
+-	.log_status = adv7511_log_status,
+-#ifdef CONFIG_VIDEO_ADV_DEBUG
+-	.g_register = adv7511_g_register,
+-	.s_register = adv7511_s_register,
+-#endif
+-	.s_power = adv7511_s_power,
+-	.interrupt_service_routine = adv7511_isr,
+-};
+-
+-/* ------------------------------ VIDEO OPS ------------------------------ */
+-
+-/* Enable/disable adv7511 output */
+-static int adv7511_s_stream(struct v4l2_subdev *sd, int enable)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	v4l2_dbg(1, debug, sd, "%s: %sable\n", __func__, (enable ? "en" : "dis"));
+-	adv7511_wr_and_or(sd, 0xa1, ~0x3c, (enable ? 0 : 0x3c));
+-	if (enable) {
+-		adv7511_check_monitor_present_status(sd);
+-	} else {
+-		adv7511_s_power(sd, 0);
+-		state->have_monitor = false;
+-	}
+-	return 0;
+-}
+-
+-static int adv7511_s_dv_timings(struct v4l2_subdev *sd,
+-			       struct v4l2_dv_timings *timings)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	struct v4l2_bt_timings *bt = &timings->bt;
+-	u32 fps;
+-
+-	v4l2_dbg(1, debug, sd, "%s:\n", __func__);
+-
+-	/* quick sanity check */
+-	if (!v4l2_valid_dv_timings(timings, &adv7511_timings_cap, NULL, NULL))
+-		return -EINVAL;
+-
+-	/* Fill the optional fields .standards and .flags in struct v4l2_dv_timings
+-	   if the format is one of the CEA or DMT timings. */
+-	v4l2_find_dv_timings_cap(timings, &adv7511_timings_cap, 0, NULL, NULL);
+-
+-	/* save timings */
+-	state->dv_timings = *timings;
+-
+-	/* set h/vsync polarities */
+-	adv7511_wr_and_or(sd, 0x17, 0x9f,
+-		((bt->polarities & V4L2_DV_VSYNC_POS_POL) ? 0 : 0x40) |
+-		((bt->polarities & V4L2_DV_HSYNC_POS_POL) ? 0 : 0x20));
+-
+-	fps = (u32)bt->pixelclock / (V4L2_DV_BT_FRAME_WIDTH(bt) * V4L2_DV_BT_FRAME_HEIGHT(bt));
+-	switch (fps) {
+-	case 24:
+-		adv7511_wr_and_or(sd, 0xfb, 0xf9, 1 << 1);
+-		break;
+-	case 25:
+-		adv7511_wr_and_or(sd, 0xfb, 0xf9, 2 << 1);
+-		break;
+-	case 30:
+-		adv7511_wr_and_or(sd, 0xfb, 0xf9, 3 << 1);
+-		break;
+-	default:
+-		adv7511_wr_and_or(sd, 0xfb, 0xf9, 0);
+-		break;
+-	}
+-
+-	/* update quantization range based on new dv_timings */
+-	adv7511_set_rgb_quantization_mode(sd, state->rgb_quantization_range_ctrl);
+-
+-	return 0;
+-}
+-
+-static int adv7511_g_dv_timings(struct v4l2_subdev *sd,
+-				struct v4l2_dv_timings *timings)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	v4l2_dbg(1, debug, sd, "%s:\n", __func__);
+-
+-	if (!timings)
+-		return -EINVAL;
+-
+-	*timings = state->dv_timings;
+-
+-	return 0;
+-}
+-
+-static int adv7511_enum_dv_timings(struct v4l2_subdev *sd,
+-				   struct v4l2_enum_dv_timings *timings)
+-{
+-	if (timings->pad != 0)
+-		return -EINVAL;
+-
+-	return v4l2_enum_dv_timings_cap(timings, &adv7511_timings_cap, NULL, NULL);
+-}
+-
+-static int adv7511_dv_timings_cap(struct v4l2_subdev *sd,
+-				  struct v4l2_dv_timings_cap *cap)
+-{
+-	if (cap->pad != 0)
+-		return -EINVAL;
+-
+-	*cap = adv7511_timings_cap;
+-	return 0;
+-}
+-
+-static const struct v4l2_subdev_video_ops adv7511_video_ops = {
+-	.s_stream = adv7511_s_stream,
+-	.s_dv_timings = adv7511_s_dv_timings,
+-	.g_dv_timings = adv7511_g_dv_timings,
+-};
+-
+-/* ------------------------------ AUDIO OPS ------------------------------ */
+-static int adv7511_s_audio_stream(struct v4l2_subdev *sd, int enable)
+-{
+-	v4l2_dbg(1, debug, sd, "%s: %sable\n", __func__, (enable ? "en" : "dis"));
+-
+-	if (enable)
+-		adv7511_wr_and_or(sd, 0x4b, 0x3f, 0x80);
+-	else
+-		adv7511_wr_and_or(sd, 0x4b, 0x3f, 0x40);
+-
+-	return 0;
+-}
+-
+-static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq)
+-{
+-	u32 N;
+-
+-	switch (freq) {
+-	case 32000:  N = 4096;  break;
+-	case 44100:  N = 6272;  break;
+-	case 48000:  N = 6144;  break;
+-	case 88200:  N = 12544; break;
+-	case 96000:  N = 12288; break;
+-	case 176400: N = 25088; break;
+-	case 192000: N = 24576; break;
+-	default:
+-		return -EINVAL;
+-	}
+-
+-	/* Set N (used with CTS to regenerate the audio clock) */
+-	adv7511_wr(sd, 0x01, (N >> 16) & 0xf);
+-	adv7511_wr(sd, 0x02, (N >> 8) & 0xff);
+-	adv7511_wr(sd, 0x03, N & 0xff);
+-
+-	return 0;
+-}
+-
+-static int adv7511_s_i2s_clock_freq(struct v4l2_subdev *sd, u32 freq)
+-{
+-	u32 i2s_sf;
+-
+-	switch (freq) {
+-	case 32000:  i2s_sf = 0x30; break;
+-	case 44100:  i2s_sf = 0x00; break;
+-	case 48000:  i2s_sf = 0x20; break;
+-	case 88200:  i2s_sf = 0x80; break;
+-	case 96000:  i2s_sf = 0xa0; break;
+-	case 176400: i2s_sf = 0xc0; break;
+-	case 192000: i2s_sf = 0xe0; break;
+-	default:
+-		return -EINVAL;
+-	}
+-
+-	/* Set sampling frequency for I2S audio to 48 kHz */
+-	adv7511_wr_and_or(sd, 0x15, 0xf, i2s_sf);
+-
+-	return 0;
+-}
+-
+-static int adv7511_s_routing(struct v4l2_subdev *sd, u32 input, u32 output, u32 config)
+-{
+-	/* Only 2 channels in use for application */
+-	adv7511_wr_and_or(sd, 0x73, 0xf8, 0x1);
+-	/* Speaker mapping */
+-	adv7511_wr(sd, 0x76, 0x00);
+-
+-	/* 16 bit audio word length */
+-	adv7511_wr_and_or(sd, 0x14, 0xf0, 0x02);
+-
+-	return 0;
+-}
+-
+-static const struct v4l2_subdev_audio_ops adv7511_audio_ops = {
+-	.s_stream = adv7511_s_audio_stream,
+-	.s_clock_freq = adv7511_s_clock_freq,
+-	.s_i2s_clock_freq = adv7511_s_i2s_clock_freq,
+-	.s_routing = adv7511_s_routing,
+-};
+-
+-/* ---------------------------- PAD OPS ------------------------------------- */
+-
+-static int adv7511_get_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	memset(edid->reserved, 0, sizeof(edid->reserved));
+-
+-	if (edid->pad != 0)
+-		return -EINVAL;
+-
+-	if (edid->start_block == 0 && edid->blocks == 0) {
+-		edid->blocks = state->edid.segments * 2;
+-		return 0;
+-	}
+-
+-	if (state->edid.segments == 0)
+-		return -ENODATA;
+-
+-	if (edid->start_block >= state->edid.segments * 2)
+-		return -EINVAL;
+-
+-	if (edid->start_block + edid->blocks > state->edid.segments * 2)
+-		edid->blocks = state->edid.segments * 2 - edid->start_block;
+-
+-	memcpy(edid->edid, &state->edid.data[edid->start_block * 128],
+-			128 * edid->blocks);
+-
+-	return 0;
+-}
+-
+-static int adv7511_enum_mbus_code(struct v4l2_subdev *sd,
+-				  struct v4l2_subdev_pad_config *cfg,
+-				  struct v4l2_subdev_mbus_code_enum *code)
+-{
+-	if (code->pad != 0)
+-		return -EINVAL;
+-
+-	switch (code->index) {
+-	case 0:
+-		code->code = MEDIA_BUS_FMT_RGB888_1X24;
+-		break;
+-	case 1:
+-		code->code = MEDIA_BUS_FMT_YUYV8_1X16;
+-		break;
+-	case 2:
+-		code->code = MEDIA_BUS_FMT_UYVY8_1X16;
+-		break;
+-	default:
+-		return -EINVAL;
+-	}
+-	return 0;
+-}
+-
+-static void adv7511_fill_format(struct adv7511_state *state,
+-				struct v4l2_mbus_framefmt *format)
+-{
+-	format->width = state->dv_timings.bt.width;
+-	format->height = state->dv_timings.bt.height;
+-	format->field = V4L2_FIELD_NONE;
+-}
+-
+-static int adv7511_get_fmt(struct v4l2_subdev *sd,
+-			   struct v4l2_subdev_pad_config *cfg,
+-			   struct v4l2_subdev_format *format)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	if (format->pad != 0)
+-		return -EINVAL;
+-
+-	memset(&format->format, 0, sizeof(format->format));
+-	adv7511_fill_format(state, &format->format);
+-
+-	if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
+-		struct v4l2_mbus_framefmt *fmt;
+-
+-		fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad);
+-		format->format.code = fmt->code;
+-		format->format.colorspace = fmt->colorspace;
+-		format->format.ycbcr_enc = fmt->ycbcr_enc;
+-		format->format.quantization = fmt->quantization;
+-		format->format.xfer_func = fmt->xfer_func;
+-	} else {
+-		format->format.code = state->fmt_code;
+-		format->format.colorspace = state->colorspace;
+-		format->format.ycbcr_enc = state->ycbcr_enc;
+-		format->format.quantization = state->quantization;
+-		format->format.xfer_func = state->xfer_func;
+-	}
+-
+-	return 0;
+-}
+-
+-static int adv7511_set_fmt(struct v4l2_subdev *sd,
+-			   struct v4l2_subdev_pad_config *cfg,
+-			   struct v4l2_subdev_format *format)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	/*
+-	 * Bitfield namings come the CEA-861-F standard, table 8 "Auxiliary
+-	 * Video Information (AVI) InfoFrame Format"
+-	 *
+-	 * c = Colorimetry
+-	 * ec = Extended Colorimetry
+-	 * y = RGB or YCbCr
+-	 * q = RGB Quantization Range
+-	 * yq = YCC Quantization Range
+-	 */
+-	u8 c = HDMI_COLORIMETRY_NONE;
+-	u8 ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
+-	u8 y = HDMI_COLORSPACE_RGB;
+-	u8 q = HDMI_QUANTIZATION_RANGE_DEFAULT;
+-	u8 yq = HDMI_YCC_QUANTIZATION_RANGE_LIMITED;
+-	u8 itc = state->content_type != V4L2_DV_IT_CONTENT_TYPE_NO_ITC;
+-	u8 cn = itc ? state->content_type : V4L2_DV_IT_CONTENT_TYPE_GRAPHICS;
+-
+-	if (format->pad != 0)
+-		return -EINVAL;
+-	switch (format->format.code) {
+-	case MEDIA_BUS_FMT_UYVY8_1X16:
+-	case MEDIA_BUS_FMT_YUYV8_1X16:
+-	case MEDIA_BUS_FMT_RGB888_1X24:
+-		break;
+-	default:
+-		return -EINVAL;
+-	}
+-
+-	adv7511_fill_format(state, &format->format);
+-	if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
+-		struct v4l2_mbus_framefmt *fmt;
+-
+-		fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad);
+-		fmt->code = format->format.code;
+-		fmt->colorspace = format->format.colorspace;
+-		fmt->ycbcr_enc = format->format.ycbcr_enc;
+-		fmt->quantization = format->format.quantization;
+-		fmt->xfer_func = format->format.xfer_func;
+-		return 0;
+-	}
+-
+-	switch (format->format.code) {
+-	case MEDIA_BUS_FMT_UYVY8_1X16:
+-		adv7511_wr_and_or(sd, 0x15, 0xf0, 0x01);
+-		adv7511_wr_and_or(sd, 0x16, 0x03, 0xb8);
+-		y = HDMI_COLORSPACE_YUV422;
+-		break;
+-	case MEDIA_BUS_FMT_YUYV8_1X16:
+-		adv7511_wr_and_or(sd, 0x15, 0xf0, 0x01);
+-		adv7511_wr_and_or(sd, 0x16, 0x03, 0xbc);
+-		y = HDMI_COLORSPACE_YUV422;
+-		break;
+-	case MEDIA_BUS_FMT_RGB888_1X24:
+-	default:
+-		adv7511_wr_and_or(sd, 0x15, 0xf0, 0x00);
+-		adv7511_wr_and_or(sd, 0x16, 0x03, 0x00);
+-		break;
+-	}
+-	state->fmt_code = format->format.code;
+-	state->colorspace = format->format.colorspace;
+-	state->ycbcr_enc = format->format.ycbcr_enc;
+-	state->quantization = format->format.quantization;
+-	state->xfer_func = format->format.xfer_func;
+-
+-	switch (format->format.colorspace) {
+-	case V4L2_COLORSPACE_ADOBERGB:
+-		c = HDMI_COLORIMETRY_EXTENDED;
+-		ec = y ? HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601 :
+-			 HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB;
+-		break;
+-	case V4L2_COLORSPACE_SMPTE170M:
+-		c = y ? HDMI_COLORIMETRY_ITU_601 : HDMI_COLORIMETRY_NONE;
+-		if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_XV601) {
+-			c = HDMI_COLORIMETRY_EXTENDED;
+-			ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
+-		}
+-		break;
+-	case V4L2_COLORSPACE_REC709:
+-		c = y ? HDMI_COLORIMETRY_ITU_709 : HDMI_COLORIMETRY_NONE;
+-		if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_XV709) {
+-			c = HDMI_COLORIMETRY_EXTENDED;
+-			ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_709;
+-		}
+-		break;
+-	case V4L2_COLORSPACE_SRGB:
+-		c = y ? HDMI_COLORIMETRY_EXTENDED : HDMI_COLORIMETRY_NONE;
+-		ec = y ? HDMI_EXTENDED_COLORIMETRY_S_YCC_601 :
+-			 HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
+-		break;
+-	case V4L2_COLORSPACE_BT2020:
+-		c = HDMI_COLORIMETRY_EXTENDED;
+-		if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_BT2020_CONST_LUM)
+-			ec = 5; /* Not yet available in hdmi.h */
+-		else
+-			ec = 6; /* Not yet available in hdmi.h */
+-		break;
+-	default:
+-		break;
+-	}
+-
+-	/*
+-	 * CEA-861-F says that for RGB formats the YCC range must match the
+-	 * RGB range, although sources should ignore the YCC range.
+-	 *
+-	 * The RGB quantization range shouldn't be non-zero if the EDID doesn't
+-	 * have the Q bit set in the Video Capabilities Data Block, however this
+-	 * isn't checked at the moment. The assumption is that the application
+-	 * knows the EDID and can detect this.
+-	 *
+-	 * The same is true for the YCC quantization range: non-standard YCC
+-	 * quantization ranges should only be sent if the EDID has the YQ bit
+-	 * set in the Video Capabilities Data Block.
+-	 */
+-	switch (format->format.quantization) {
+-	case V4L2_QUANTIZATION_FULL_RANGE:
+-		q = y ? HDMI_QUANTIZATION_RANGE_DEFAULT :
+-			HDMI_QUANTIZATION_RANGE_FULL;
+-		yq = q ? q - 1 : HDMI_YCC_QUANTIZATION_RANGE_FULL;
+-		break;
+-	case V4L2_QUANTIZATION_LIM_RANGE:
+-		q = y ? HDMI_QUANTIZATION_RANGE_DEFAULT :
+-			HDMI_QUANTIZATION_RANGE_LIMITED;
+-		yq = q ? q - 1 : HDMI_YCC_QUANTIZATION_RANGE_LIMITED;
+-		break;
+-	}
+-
+-	adv7511_wr_and_or(sd, 0x4a, 0xbf, 0);
+-	adv7511_wr_and_or(sd, 0x55, 0x9f, y << 5);
+-	adv7511_wr_and_or(sd, 0x56, 0x3f, c << 6);
+-	adv7511_wr_and_or(sd, 0x57, 0x83, (ec << 4) | (q << 2) | (itc << 7));
+-	adv7511_wr_and_or(sd, 0x59, 0x0f, (yq << 6) | (cn << 4));
+-	adv7511_wr_and_or(sd, 0x4a, 0xff, 1);
+-	adv7511_set_rgb_quantization_mode(sd, state->rgb_quantization_range_ctrl);
+-
+-	return 0;
+-}
+-
+-static const struct v4l2_subdev_pad_ops adv7511_pad_ops = {
+-	.get_edid = adv7511_get_edid,
+-	.enum_mbus_code = adv7511_enum_mbus_code,
+-	.get_fmt = adv7511_get_fmt,
+-	.set_fmt = adv7511_set_fmt,
+-	.enum_dv_timings = adv7511_enum_dv_timings,
+-	.dv_timings_cap = adv7511_dv_timings_cap,
+-};
+-
+-/* --------------------- SUBDEV OPS --------------------------------------- */
+-
+-static const struct v4l2_subdev_ops adv7511_ops = {
+-	.core  = &adv7511_core_ops,
+-	.pad  = &adv7511_pad_ops,
+-	.video = &adv7511_video_ops,
+-	.audio = &adv7511_audio_ops,
+-};
+-
+-/* ----------------------------------------------------------------------- */
+-static void adv7511_dbg_dump_edid(int lvl, int debug, struct v4l2_subdev *sd, int segment, u8 *buf)
+-{
+-	if (debug >= lvl) {
+-		int i, j;
+-		v4l2_dbg(lvl, debug, sd, "edid segment %d\n", segment);
+-		for (i = 0; i < 256; i += 16) {
+-			u8 b[128];
+-			u8 *bp = b;
+-			if (i == 128)
+-				v4l2_dbg(lvl, debug, sd, "\n");
+-			for (j = i; j < i + 16; j++) {
+-				sprintf(bp, "0x%02x, ", buf[j]);
+-				bp += 6;
+-			}
+-			bp[0] = '\0';
+-			v4l2_dbg(lvl, debug, sd, "%s\n", b);
+-		}
+-	}
+-}
+-
+-static void adv7511_notify_no_edid(struct v4l2_subdev *sd)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	struct adv7511_edid_detect ed;
+-
+-	/* We failed to read the EDID, so send an event for this. */
+-	ed.present = false;
+-	ed.segment = adv7511_rd(sd, 0xc4);
+-	ed.phys_addr = CEC_PHYS_ADDR_INVALID;
+-	cec_s_phys_addr(state->cec_adap, ed.phys_addr, false);
+-	v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
+-	v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x0);
+-}
+-
+-static void adv7511_edid_handler(struct work_struct *work)
+-{
+-	struct delayed_work *dwork = to_delayed_work(work);
+-	struct adv7511_state *state = container_of(dwork, struct adv7511_state, edid_handler);
+-	struct v4l2_subdev *sd = &state->sd;
+-
+-	v4l2_dbg(1, debug, sd, "%s:\n", __func__);
+-
+-	if (adv7511_check_edid_status(sd)) {
+-		/* Return if we received the EDID. */
+-		return;
+-	}
+-
+-	if (adv7511_have_hotplug(sd)) {
+-		/* We must retry reading the EDID several times, it is possible
+-		 * that initially the EDID couldn't be read due to i2c errors
+-		 * (DVI connectors are particularly prone to this problem). */
+-		if (state->edid.read_retries) {
+-			state->edid.read_retries--;
+-			v4l2_dbg(1, debug, sd, "%s: edid read failed\n", __func__);
+-			state->have_monitor = false;
+-			adv7511_s_power(sd, false);
+-			adv7511_s_power(sd, true);
+-			queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
+-			return;
+-		}
+-	}
+-
+-	/* We failed to read the EDID, so send an event for this. */
+-	adv7511_notify_no_edid(sd);
+-	v4l2_dbg(1, debug, sd, "%s: no edid found\n", __func__);
+-}
+-
+-static void adv7511_audio_setup(struct v4l2_subdev *sd)
+-{
+-	v4l2_dbg(1, debug, sd, "%s\n", __func__);
+-
+-	adv7511_s_i2s_clock_freq(sd, 48000);
+-	adv7511_s_clock_freq(sd, 48000);
+-	adv7511_s_routing(sd, 0, 0, 0);
+-}
+-
+-/* Configure hdmi transmitter. */
+-static void adv7511_setup(struct v4l2_subdev *sd)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	v4l2_dbg(1, debug, sd, "%s\n", __func__);
+-
+-	/* Input format: RGB 4:4:4 */
+-	adv7511_wr_and_or(sd, 0x15, 0xf0, 0x0);
+-	/* Output format: RGB 4:4:4 */
+-	adv7511_wr_and_or(sd, 0x16, 0x7f, 0x0);
+-	/* 1st order interpolation 4:2:2 -> 4:4:4 up conversion, Aspect ratio: 16:9 */
+-	adv7511_wr_and_or(sd, 0x17, 0xf9, 0x06);
+-	/* Disable pixel repetition */
+-	adv7511_wr_and_or(sd, 0x3b, 0x9f, 0x0);
+-	/* Disable CSC */
+-	adv7511_wr_and_or(sd, 0x18, 0x7f, 0x0);
+-	/* Output format: RGB 4:4:4, Active Format Information is valid,
+-	 * underscanned */
+-	adv7511_wr_and_or(sd, 0x55, 0x9c, 0x12);
+-	/* AVI Info frame packet enable, Audio Info frame disable */
+-	adv7511_wr_and_or(sd, 0x44, 0xe7, 0x10);
+-	/* Colorimetry, Active format aspect ratio: same as picure. */
+-	adv7511_wr(sd, 0x56, 0xa8);
+-	/* No encryption */
+-	adv7511_wr_and_or(sd, 0xaf, 0xed, 0x0);
+-
+-	/* Positive clk edge capture for input video clock */
+-	adv7511_wr_and_or(sd, 0xba, 0x1f, 0x60);
+-
+-	adv7511_audio_setup(sd);
+-
+-	v4l2_ctrl_handler_setup(&state->hdl);
+-}
+-
+-static void adv7511_notify_monitor_detect(struct v4l2_subdev *sd)
+-{
+-	struct adv7511_monitor_detect mdt;
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	mdt.present = state->have_monitor;
+-	v4l2_subdev_notify(sd, ADV7511_MONITOR_DETECT, (void *)&mdt);
+-}
+-
+-static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	/* read hotplug and rx-sense state */
+-	u8 status = adv7511_rd(sd, 0x42);
+-
+-	v4l2_dbg(1, debug, sd, "%s: status: 0x%x%s%s\n",
+-			 __func__,
+-			 status,
+-			 status & MASK_ADV7511_HPD_DETECT ? ", hotplug" : "",
+-			 status & MASK_ADV7511_MSEN_DETECT ? ", rx-sense" : "");
+-
+-	/* update read only ctrls */
+-	v4l2_ctrl_s_ctrl(state->hotplug_ctrl, adv7511_have_hotplug(sd) ? 0x1 : 0x0);
+-	v4l2_ctrl_s_ctrl(state->rx_sense_ctrl, adv7511_have_rx_sense(sd) ? 0x1 : 0x0);
+-
+-	if ((status & MASK_ADV7511_HPD_DETECT) && ((status & MASK_ADV7511_MSEN_DETECT) || state->edid.segments)) {
+-		v4l2_dbg(1, debug, sd, "%s: hotplug and (rx-sense or edid)\n", __func__);
+-		if (!state->have_monitor) {
+-			v4l2_dbg(1, debug, sd, "%s: monitor detected\n", __func__);
+-			state->have_monitor = true;
+-			adv7511_set_isr(sd, true);
+-			if (!adv7511_s_power(sd, true)) {
+-				v4l2_dbg(1, debug, sd, "%s: monitor detected, powerup failed\n", __func__);
+-				return;
+-			}
+-			adv7511_setup(sd);
+-			adv7511_notify_monitor_detect(sd);
+-			state->edid.read_retries = EDID_MAX_RETRIES;
+-			queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
+-		}
+-	} else if (status & MASK_ADV7511_HPD_DETECT) {
+-		v4l2_dbg(1, debug, sd, "%s: hotplug detected\n", __func__);
+-		state->edid.read_retries = EDID_MAX_RETRIES;
+-		queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
+-	} else if (!(status & MASK_ADV7511_HPD_DETECT)) {
+-		v4l2_dbg(1, debug, sd, "%s: hotplug not detected\n", __func__);
+-		if (state->have_monitor) {
+-			v4l2_dbg(1, debug, sd, "%s: monitor not detected\n", __func__);
+-			state->have_monitor = false;
+-			adv7511_notify_monitor_detect(sd);
+-		}
+-		adv7511_s_power(sd, false);
+-		memset(&state->edid, 0, sizeof(struct adv7511_state_edid));
+-		adv7511_notify_no_edid(sd);
+-	}
+-}
+-
+-static bool edid_block_verify_crc(u8 *edid_block)
+-{
+-	u8 sum = 0;
+-	int i;
+-
+-	for (i = 0; i < 128; i++)
+-		sum += edid_block[i];
+-	return sum == 0;
+-}
+-
+-static bool edid_verify_crc(struct v4l2_subdev *sd, u32 segment)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	u32 blocks = state->edid.blocks;
+-	u8 *data = state->edid.data;
+-
+-	if (!edid_block_verify_crc(&data[segment * 256]))
+-		return false;
+-	if ((segment + 1) * 2 <= blocks)
+-		return edid_block_verify_crc(&data[segment * 256 + 128]);
+-	return true;
+-}
+-
+-static bool edid_verify_header(struct v4l2_subdev *sd, u32 segment)
+-{
+-	static const u8 hdmi_header[] = {
+-		0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00
+-	};
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	u8 *data = state->edid.data;
+-
+-	if (segment != 0)
+-		return true;
+-	return !memcmp(data, hdmi_header, sizeof(hdmi_header));
+-}
+-
+-static bool adv7511_check_edid_status(struct v4l2_subdev *sd)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	u8 edidRdy = adv7511_rd(sd, 0xc5);
+-
+-	v4l2_dbg(1, debug, sd, "%s: edid ready (retries: %d)\n",
+-			 __func__, EDID_MAX_RETRIES - state->edid.read_retries);
+-
+-	if (state->edid.complete)
+-		return true;
+-
+-	if (edidRdy & MASK_ADV7511_EDID_RDY) {
+-		int segment = adv7511_rd(sd, 0xc4);
+-		struct adv7511_edid_detect ed;
+-
+-		if (segment >= EDID_MAX_SEGM) {
+-			v4l2_err(sd, "edid segment number too big\n");
+-			return false;
+-		}
+-		v4l2_dbg(1, debug, sd, "%s: got segment %d\n", __func__, segment);
+-		adv7511_edid_rd(sd, 256, &state->edid.data[segment * 256]);
+-		adv7511_dbg_dump_edid(2, debug, sd, segment, &state->edid.data[segment * 256]);
+-		if (segment == 0) {
+-			state->edid.blocks = state->edid.data[0x7e] + 1;
+-			v4l2_dbg(1, debug, sd, "%s: %d blocks in total\n", __func__, state->edid.blocks);
+-		}
+-		if (!edid_verify_crc(sd, segment) ||
+-		    !edid_verify_header(sd, segment)) {
+-			/* edid crc error, force reread of edid segment */
+-			v4l2_err(sd, "%s: edid crc or header error\n", __func__);
+-			state->have_monitor = false;
+-			adv7511_s_power(sd, false);
+-			adv7511_s_power(sd, true);
+-			return false;
+-		}
+-		/* one more segment read ok */
+-		state->edid.segments = segment + 1;
+-		v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x1);
+-		if (((state->edid.data[0x7e] >> 1) + 1) > state->edid.segments) {
+-			/* Request next EDID segment */
+-			v4l2_dbg(1, debug, sd, "%s: request segment %d\n", __func__, state->edid.segments);
+-			adv7511_wr(sd, 0xc9, 0xf);
+-			adv7511_wr(sd, 0xc4, state->edid.segments);
+-			state->edid.read_retries = EDID_MAX_RETRIES;
+-			queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
+-			return false;
+-		}
+-
+-		v4l2_dbg(1, debug, sd, "%s: edid complete with %d segment(s)\n", __func__, state->edid.segments);
+-		state->edid.complete = true;
+-		ed.phys_addr = cec_get_edid_phys_addr(state->edid.data,
+-						      state->edid.segments * 256,
+-						      NULL);
+-		/* report when we have all segments
+-		   but report only for segment 0
+-		 */
+-		ed.present = true;
+-		ed.segment = 0;
+-		state->edid_detect_counter++;
+-		cec_s_phys_addr(state->cec_adap, ed.phys_addr, false);
+-		v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
+-		return ed.present;
+-	}
+-
+-	return false;
+-}
+-
+-static int adv7511_registered(struct v4l2_subdev *sd)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	struct i2c_client *client = v4l2_get_subdevdata(sd);
+-	int err;
+-
+-	err = cec_register_adapter(state->cec_adap, &client->dev);
+-	if (err)
+-		cec_delete_adapter(state->cec_adap);
+-	return err;
+-}
+-
+-static void adv7511_unregistered(struct v4l2_subdev *sd)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	cec_unregister_adapter(state->cec_adap);
+-}
+-
+-static const struct v4l2_subdev_internal_ops adv7511_int_ops = {
+-	.registered = adv7511_registered,
+-	.unregistered = adv7511_unregistered,
+-};
+-
+-/* ----------------------------------------------------------------------- */
+-/* Setup ADV7511 */
+-static void adv7511_init_setup(struct v4l2_subdev *sd)
+-{
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-	struct adv7511_state_edid *edid = &state->edid;
+-	u32 cec_clk = state->pdata.cec_clk;
+-	u8 ratio;
+-
+-	v4l2_dbg(1, debug, sd, "%s\n", __func__);
+-
+-	/* clear all interrupts */
+-	adv7511_wr(sd, 0x96, 0xff);
+-	adv7511_wr(sd, 0x97, 0xff);
+-	/*
+-	 * Stop HPD from resetting a lot of registers.
+-	 * It might leave the chip in a partly un-initialized state,
+-	 * in particular with regards to hotplug bounces.
+-	 */
+-	adv7511_wr_and_or(sd, 0xd6, 0x3f, 0xc0);
+-	memset(edid, 0, sizeof(struct adv7511_state_edid));
+-	state->have_monitor = false;
+-	adv7511_set_isr(sd, false);
+-	adv7511_s_stream(sd, false);
+-	adv7511_s_audio_stream(sd, false);
+-
+-	if (state->i2c_cec == NULL)
+-		return;
+-
+-	v4l2_dbg(1, debug, sd, "%s: cec_clk %d\n", __func__, cec_clk);
+-
+-	/* cec soft reset */
+-	adv7511_cec_write(sd, 0x50, 0x01);
+-	adv7511_cec_write(sd, 0x50, 0x00);
+-
+-	/* legacy mode */
+-	adv7511_cec_write(sd, 0x4a, 0x00);
+-
+-	if (cec_clk % 750000 != 0)
+-		v4l2_err(sd, "%s: cec_clk %d, not multiple of 750 Khz\n",
+-			 __func__, cec_clk);
+-
+-	ratio = (cec_clk / 750000) - 1;
+-	adv7511_cec_write(sd, 0x4e, ratio << 2);
+-}
+-
+-static int adv7511_probe(struct i2c_client *client, const struct i2c_device_id *id)
+-{
+-	struct adv7511_state *state;
+-	struct adv7511_platform_data *pdata = client->dev.platform_data;
+-	struct v4l2_ctrl_handler *hdl;
+-	struct v4l2_subdev *sd;
+-	u8 chip_id[2];
+-	int err = -EIO;
+-
+-	/* Check if the adapter supports the needed features */
+-	if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA))
+-		return -EIO;
+-
+-	state = devm_kzalloc(&client->dev, sizeof(struct adv7511_state), GFP_KERNEL);
+-	if (!state)
+-		return -ENOMEM;
+-
+-	/* Platform data */
+-	if (!pdata) {
+-		v4l_err(client, "No platform data!\n");
+-		return -ENODEV;
+-	}
+-	memcpy(&state->pdata, pdata, sizeof(state->pdata));
+-	state->fmt_code = MEDIA_BUS_FMT_RGB888_1X24;
+-	state->colorspace = V4L2_COLORSPACE_SRGB;
+-
+-	sd = &state->sd;
+-
+-	v4l2_dbg(1, debug, sd, "detecting adv7511 client on address 0x%x\n",
+-			 client->addr << 1);
+-
+-	v4l2_i2c_subdev_init(sd, client, &adv7511_ops);
+-	sd->internal_ops = &adv7511_int_ops;
+-
+-	hdl = &state->hdl;
+-	v4l2_ctrl_handler_init(hdl, 10);
+-	/* add in ascending ID order */
+-	state->hdmi_mode_ctrl = v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops,
+-			V4L2_CID_DV_TX_MODE, V4L2_DV_TX_MODE_HDMI,
+-			0, V4L2_DV_TX_MODE_DVI_D);
+-	state->hotplug_ctrl = v4l2_ctrl_new_std(hdl, NULL,
+-			V4L2_CID_DV_TX_HOTPLUG, 0, 1, 0, 0);
+-	state->rx_sense_ctrl = v4l2_ctrl_new_std(hdl, NULL,
+-			V4L2_CID_DV_TX_RXSENSE, 0, 1, 0, 0);
+-	state->have_edid0_ctrl = v4l2_ctrl_new_std(hdl, NULL,
+-			V4L2_CID_DV_TX_EDID_PRESENT, 0, 1, 0, 0);
+-	state->rgb_quantization_range_ctrl =
+-		v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops,
+-			V4L2_CID_DV_TX_RGB_RANGE, V4L2_DV_RGB_RANGE_FULL,
+-			0, V4L2_DV_RGB_RANGE_AUTO);
+-	state->content_type_ctrl =
+-		v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops,
+-			V4L2_CID_DV_TX_IT_CONTENT_TYPE, V4L2_DV_IT_CONTENT_TYPE_NO_ITC,
+-			0, V4L2_DV_IT_CONTENT_TYPE_NO_ITC);
+-	sd->ctrl_handler = hdl;
+-	if (hdl->error) {
+-		err = hdl->error;
+-		goto err_hdl;
+-	}
+-	state->pad.flags = MEDIA_PAD_FL_SINK;
+-	err = media_entity_pads_init(&sd->entity, 1, &state->pad);
+-	if (err)
+-		goto err_hdl;
+-
+-	/* EDID and CEC i2c addr */
+-	state->i2c_edid_addr = state->pdata.i2c_edid << 1;
+-	state->i2c_cec_addr = state->pdata.i2c_cec << 1;
+-	state->i2c_pktmem_addr = state->pdata.i2c_pktmem << 1;
+-
+-	state->chip_revision = adv7511_rd(sd, 0x0);
+-	chip_id[0] = adv7511_rd(sd, 0xf5);
+-	chip_id[1] = adv7511_rd(sd, 0xf6);
+-	if (chip_id[0] != 0x75 || chip_id[1] != 0x11) {
+-		v4l2_err(sd, "chip_id != 0x7511, read 0x%02x%02x\n", chip_id[0],
+-			 chip_id[1]);
+-		err = -EIO;
+-		goto err_entity;
+-	}
+-
+-	state->i2c_edid = i2c_new_dummy(client->adapter,
+-					state->i2c_edid_addr >> 1);
+-	if (state->i2c_edid == NULL) {
+-		v4l2_err(sd, "failed to register edid i2c client\n");
+-		err = -ENOMEM;
+-		goto err_entity;
+-	}
+-
+-	adv7511_wr(sd, 0xe1, state->i2c_cec_addr);
+-	if (state->pdata.cec_clk < 3000000 ||
+-	    state->pdata.cec_clk > 100000000) {
+-		v4l2_err(sd, "%s: cec_clk %u outside range, disabling cec\n",
+-				__func__, state->pdata.cec_clk);
+-		state->pdata.cec_clk = 0;
+-	}
+-
+-	if (state->pdata.cec_clk) {
+-		state->i2c_cec = i2c_new_dummy(client->adapter,
+-					       state->i2c_cec_addr >> 1);
+-		if (state->i2c_cec == NULL) {
+-			v4l2_err(sd, "failed to register cec i2c client\n");
+-			err = -ENOMEM;
+-			goto err_unreg_edid;
+-		}
+-		adv7511_wr(sd, 0xe2, 0x00); /* power up cec section */
+-	} else {
+-		adv7511_wr(sd, 0xe2, 0x01); /* power down cec section */
+-	}
+-
+-	state->i2c_pktmem = i2c_new_dummy(client->adapter, state->i2c_pktmem_addr >> 1);
+-	if (state->i2c_pktmem == NULL) {
+-		v4l2_err(sd, "failed to register pktmem i2c client\n");
+-		err = -ENOMEM;
+-		goto err_unreg_cec;
+-	}
+-
+-	state->work_queue = create_singlethread_workqueue(sd->name);
+-	if (state->work_queue == NULL) {
+-		v4l2_err(sd, "could not create workqueue\n");
+-		err = -ENOMEM;
+-		goto err_unreg_pktmem;
+-	}
+-
+-	INIT_DELAYED_WORK(&state->edid_handler, adv7511_edid_handler);
+-
+-	adv7511_init_setup(sd);
+-
+-#if IS_ENABLED(CONFIG_VIDEO_ADV7511_CEC)
+-	state->cec_adap = cec_allocate_adapter(&adv7511_cec_adap_ops,
+-		state, dev_name(&client->dev), CEC_CAP_DEFAULTS,
+-		ADV7511_MAX_ADDRS);
+-	err = PTR_ERR_OR_ZERO(state->cec_adap);
+-	if (err) {
+-		destroy_workqueue(state->work_queue);
+-		goto err_unreg_pktmem;
+-	}
+-#endif
+-
+-	adv7511_set_isr(sd, true);
+-	adv7511_check_monitor_present_status(sd);
+-
+-	v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name,
+-			  client->addr << 1, client->adapter->name);
+-	return 0;
+-
+-err_unreg_pktmem:
+-	i2c_unregister_device(state->i2c_pktmem);
+-err_unreg_cec:
+-	if (state->i2c_cec)
+-		i2c_unregister_device(state->i2c_cec);
+-err_unreg_edid:
+-	i2c_unregister_device(state->i2c_edid);
+-err_entity:
+-	media_entity_cleanup(&sd->entity);
+-err_hdl:
+-	v4l2_ctrl_handler_free(&state->hdl);
+-	return err;
+-}
+-
+-/* ----------------------------------------------------------------------- */
+-
+-static int adv7511_remove(struct i2c_client *client)
+-{
+-	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+-	struct adv7511_state *state = get_adv7511_state(sd);
+-
+-	state->chip_revision = -1;
+-
+-	v4l2_dbg(1, debug, sd, "%s removed @ 0x%x (%s)\n", client->name,
+-		 client->addr << 1, client->adapter->name);
+-
+-	adv7511_set_isr(sd, false);
+-	adv7511_init_setup(sd);
+-	cancel_delayed_work(&state->edid_handler);
+-	i2c_unregister_device(state->i2c_edid);
+-	if (state->i2c_cec)
+-		i2c_unregister_device(state->i2c_cec);
+-	i2c_unregister_device(state->i2c_pktmem);
+-	destroy_workqueue(state->work_queue);
+-	v4l2_device_unregister_subdev(sd);
+-	media_entity_cleanup(&sd->entity);
+-	v4l2_ctrl_handler_free(sd->ctrl_handler);
+-	return 0;
+-}
+-
+-/* ----------------------------------------------------------------------- */
+-
+-static const struct i2c_device_id adv7511_id[] = {
+-	{ "adv7511", 0 },
+-	{ }
+-};
+-MODULE_DEVICE_TABLE(i2c, adv7511_id);
+-
+-static struct i2c_driver adv7511_driver = {
+-	.driver = {
+-		.name = "adv7511",
+-	},
+-	.probe = adv7511_probe,
+-	.remove = adv7511_remove,
+-	.id_table = adv7511_id,
+-};
+-
+-module_i2c_driver(adv7511_driver);
+diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
+index 62b2c5d9bdfb..4eb51a618fe1 100644
+--- a/drivers/media/media-device.c
++++ b/drivers/media/media-device.c
+@@ -470,6 +470,7 @@ static long media_device_enum_links32(struct media_device *mdev,
+ {
+ 	struct media_links_enum links;
+ 	compat_uptr_t pads_ptr, links_ptr;
++	int ret;
+ 
+ 	memset(&links, 0, sizeof(links));
+ 
+@@ -481,7 +482,14 @@ static long media_device_enum_links32(struct media_device *mdev,
+ 	links.pads = compat_ptr(pads_ptr);
+ 	links.links = compat_ptr(links_ptr);
+ 
+-	return media_device_enum_links(mdev, &links);
++	ret = media_device_enum_links(mdev, &links);
++	if (ret)
++		return ret;
++
++	if (copy_to_user(ulinks->reserved, links.reserved,
++			 sizeof(ulinks->reserved)))
++		return -EFAULT;
++	return 0;
+ }
+ 
+ #define MEDIA_IOC_ENUM_LINKS32		_IOWR('|', 0x02, struct media_links_enum32)
+diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
+index 6eee55430d46..d538cd49a3ba 100644
+--- a/drivers/media/platform/coda/coda-bit.c
++++ b/drivers/media/platform/coda/coda-bit.c
+@@ -1679,6 +1679,7 @@ static int __coda_start_decoding(struct coda_ctx *ctx)
+ 		v4l2_err(&dev->v4l2_dev, "CODA_COMMAND_SEQ_INIT timeout\n");
+ 		return ret;
+ 	}
++	ctx->sequence_offset = ~0U;
+ 	ctx->initialized = 1;
+ 
+ 	/* Update kfifo out pointer from coda bitstream read pointer */
+@@ -2090,12 +2091,17 @@ static void coda_finish_decode(struct coda_ctx *ctx)
+ 		else if (ctx->display_idx < 0)
+ 			ctx->hold = true;
+ 	} else if (decoded_idx == -2) {
++		if (ctx->display_idx >= 0 &&
++		    ctx->display_idx < ctx->num_internal_frames)
++			ctx->sequence_offset++;
+ 		/* no frame was decoded, we still return remaining buffers */
+ 	} else if (decoded_idx < 0 || decoded_idx >= ctx->num_internal_frames) {
+ 		v4l2_err(&dev->v4l2_dev,
+ 			 "decoded frame index out of range: %d\n", decoded_idx);
+ 	} else {
+-		val = coda_read(dev, CODA_RET_DEC_PIC_FRAME_NUM) - 1;
++		val = coda_read(dev, CODA_RET_DEC_PIC_FRAME_NUM);
++		if (ctx->sequence_offset == -1)
++			ctx->sequence_offset = val;
+ 		val -= ctx->sequence_offset;
+ 		spin_lock_irqsave(&ctx->buffer_meta_lock, flags);
+ 		if (!list_empty(&ctx->buffer_meta_list)) {
+@@ -2251,7 +2257,6 @@ irqreturn_t coda_irq_handler(int irq, void *data)
+ 	if (ctx == NULL) {
+ 		v4l2_err(&dev->v4l2_dev,
+ 			 "Instance released before the end of transaction\n");
+-		mutex_unlock(&dev->coda_mutex);
+ 		return IRQ_HANDLED;
+ 	}
+ 
+diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
+index 2e1472fadc2c..5b87c488ee11 100644
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -932,6 +932,8 @@ static int coda_encoder_cmd(struct file *file, void *fh,
+ 	/* Set the stream-end flag on this context */
+ 	ctx->bit_stream_param |= CODA_BIT_STREAM_END_FLAG;
+ 
++	flush_work(&ctx->pic_run_work);
++
+ 	/* If there is no buffer in flight, wake up */
+ 	if (!ctx->streamon_out || ctx->qsequence == ctx->osequence) {
+ 		dst_vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx,
+diff --git a/drivers/media/platform/davinci/vpss.c b/drivers/media/platform/davinci/vpss.c
+index f2d27b932999..2ee4cd9e6d80 100644
+--- a/drivers/media/platform/davinci/vpss.c
++++ b/drivers/media/platform/davinci/vpss.c
+@@ -518,6 +518,11 @@ static int __init vpss_init(void)
+ 		return -EBUSY;
+ 
+ 	oper_cfg.vpss_regs_base2 = ioremap(VPSS_CLK_CTRL, 4);
++	if (unlikely(!oper_cfg.vpss_regs_base2)) {
++		release_mem_region(VPSS_CLK_CTRL, 4);
++		return -ENOMEM;
++	}
++
+ 	writel(VPSS_CLK_CTRL_VENCCLKEN |
+ 		     VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2);
+ 
+diff --git a/drivers/media/platform/marvell-ccic/mcam-core.c b/drivers/media/platform/marvell-ccic/mcam-core.c
+index 7b7250b1cff8..4ecb94860aa4 100644
+--- a/drivers/media/platform/marvell-ccic/mcam-core.c
++++ b/drivers/media/platform/marvell-ccic/mcam-core.c
+@@ -200,7 +200,6 @@ struct mcam_vb_buffer {
+ 	struct list_head queue;
+ 	struct mcam_dma_desc *dma_desc;	/* Descriptor virtual address */
+ 	dma_addr_t dma_desc_pa;		/* Descriptor physical address */
+-	int dma_desc_nent;		/* Number of mapped descriptors */
+ };
+ 
+ static inline struct mcam_vb_buffer *vb_to_mvb(struct vb2_v4l2_buffer *vb)
+@@ -608,9 +607,11 @@ static void mcam_dma_contig_done(struct mcam_camera *cam, int frame)
+ static void mcam_sg_next_buffer(struct mcam_camera *cam)
+ {
+ 	struct mcam_vb_buffer *buf;
++	struct sg_table *sg_table;
+ 
+ 	buf = list_first_entry(&cam->buffers, struct mcam_vb_buffer, queue);
+ 	list_del_init(&buf->queue);
++	sg_table = vb2_dma_sg_plane_desc(&buf->vb_buf.vb2_buf, 0);
+ 	/*
+ 	 * Very Bad Not Good Things happen if you don't clear
+ 	 * C1_DESC_ENA before making any descriptor changes.
+@@ -618,7 +619,7 @@ static void mcam_sg_next_buffer(struct mcam_camera *cam)
+ 	mcam_reg_clear_bit(cam, REG_CTRL1, C1_DESC_ENA);
+ 	mcam_reg_write(cam, REG_DMA_DESC_Y, buf->dma_desc_pa);
+ 	mcam_reg_write(cam, REG_DESC_LEN_Y,
+-			buf->dma_desc_nent*sizeof(struct mcam_dma_desc));
++			sg_table->nents * sizeof(struct mcam_dma_desc));
+ 	mcam_reg_write(cam, REG_DESC_LEN_U, 0);
+ 	mcam_reg_write(cam, REG_DESC_LEN_V, 0);
+ 	mcam_reg_set_bit(cam, REG_CTRL1, C1_DESC_ENA);
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index 3245bc45f4a0..a889332d5d30 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -261,6 +261,8 @@ MODULE_PARM_DESC(debug, "activate debug info");
+ #define FD1_IP_H3_ES1			0x02010101
+ #define FD1_IP_M3W			0x02010202
+ #define FD1_IP_H3			0x02010203
++#define FD1_IP_M3N			0x02010204
++#define FD1_IP_E3			0x02010205
+ 
+ /* LUTs */
+ #define FD1_LUT_DIF_ADJ			0x1000
+@@ -2369,6 +2371,12 @@ static int fdp1_probe(struct platform_device *pdev)
+ 	case FD1_IP_H3:
+ 		dprintk(fdp1, "FDP1 Version R-Car H3\n");
+ 		break;
++	case FD1_IP_M3N:
++		dprintk(fdp1, "FDP1 Version R-Car M3N\n");
++		break;
++	case FD1_IP_E3:
++		dprintk(fdp1, "FDP1 Version R-Car E3\n");
++		break;
+ 	default:
+ 		dev_err(fdp1->dev, "FDP1 Unidentifiable (0x%08x)\n",
+ 				hw_version);
+diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
+index eb85cedc5ef3..5e080f32b0e8 100644
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
+@@ -38,6 +38,11 @@ int s5p_mfc_init_pm(struct s5p_mfc_dev *dev)
+ 	for (i = 0; i < pm->num_clocks; i++) {
+ 		pm->clocks[i] = devm_clk_get(pm->device, pm->clk_names[i]);
+ 		if (IS_ERR(pm->clocks[i])) {
++			/* additional clocks are optional */
++			if (i && PTR_ERR(pm->clocks[i]) == -ENOENT) {
++				pm->clocks[i] = NULL;
++				continue;
++			}
+ 			mfc_err("Failed to get clock: %s\n",
+ 				pm->clk_names[i]);
+ 			return PTR_ERR(pm->clocks[i]);
+diff --git a/drivers/media/platform/vimc/vimc-capture.c b/drivers/media/platform/vimc/vimc-capture.c
+index a078ad18909a..091921ed09dd 100644
+--- a/drivers/media/platform/vimc/vimc-capture.c
++++ b/drivers/media/platform/vimc/vimc-capture.c
+@@ -131,12 +131,15 @@ static int vimc_cap_s_fmt_vid_cap(struct file *file, void *priv,
+ 				  struct v4l2_format *f)
+ {
+ 	struct vimc_cap_device *vcap = video_drvdata(file);
++	int ret;
+ 
+ 	/* Do not change the format while stream is on */
+ 	if (vb2_is_busy(&vcap->queue))
+ 		return -EBUSY;
+ 
+-	vimc_cap_try_fmt_vid_cap(file, priv, f);
++	ret = vimc_cap_try_fmt_vid_cap(file, priv, f);
++	if (ret)
++		return ret;
+ 
+ 	dev_dbg(vcap->dev, "%s: format update: "
+ 		"old:%dx%d (0x%x, %d, %d, %d, %d) "
+diff --git a/drivers/media/radio/wl128x/fmdrv_v4l2.c b/drivers/media/radio/wl128x/fmdrv_v4l2.c
+index fc5a7abc83d2..77778c86e04d 100644
+--- a/drivers/media/radio/wl128x/fmdrv_v4l2.c
++++ b/drivers/media/radio/wl128x/fmdrv_v4l2.c
+@@ -549,6 +549,7 @@ int fm_v4l2_init_video_device(struct fmdev *fmdev, int radio_nr)
+ 
+ 	/* Register with V4L2 subsystem as RADIO device */
+ 	if (video_register_device(&gradio_dev, VFL_TYPE_RADIO, radio_nr)) {
++		v4l2_device_unregister(&fmdev->v4l2_dev);
+ 		fmerr("Could not register video device\n");
+ 		return -ENOMEM;
+ 	}
+@@ -562,6 +563,8 @@ int fm_v4l2_init_video_device(struct fmdev *fmdev, int radio_nr)
+ 	if (ret < 0) {
+ 		fmerr("(fmdev): Can't init ctrl handler\n");
+ 		v4l2_ctrl_handler_free(&fmdev->ctrl_handler);
++		video_unregister_device(fmdev->radio_dev);
++		v4l2_device_unregister(&fmdev->v4l2_dev);
+ 		return -EBUSY;
+ 	}
+ 
+diff --git a/drivers/media/rc/ir-spi.c b/drivers/media/rc/ir-spi.c
+index 29ed0638cb74..cbe585f95715 100644
+--- a/drivers/media/rc/ir-spi.c
++++ b/drivers/media/rc/ir-spi.c
+@@ -186,6 +186,7 @@ static const struct of_device_id ir_spi_of_match[] = {
+ 	{ .compatible = "ir-spi-led" },
+ 	{},
+ };
++MODULE_DEVICE_TABLE(of, ir_spi_of_match);
+ 
+ static struct spi_driver ir_spi_driver = {
+ 	.probe = ir_spi_probe,
+diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c
+index 84308569e7dc..b3413404f91a 100644
+--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c
++++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c
+@@ -287,12 +287,15 @@ EXPORT_SYMBOL(dvb_usb_device_init);
+ void dvb_usb_device_exit(struct usb_interface *intf)
+ {
+ 	struct dvb_usb_device *d = usb_get_intfdata(intf);
+-	const char *name = "generic DVB-USB module";
++	const char *default_name = "generic DVB-USB module";
++	char name[40];
+ 
+ 	usb_set_intfdata(intf, NULL);
+ 	if (d != NULL && d->desc != NULL) {
+-		name = d->desc->name;
++		strscpy(name, d->desc->name, sizeof(name));
+ 		dvb_usb_exit(d);
++	} else {
++		strscpy(name, default_name, sizeof(name));
+ 	}
+ 	info("%s successfully deinitialized and disconnected.", name);
+ 
+diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c
+index 7fb036d6a86e..991f820a4530 100644
+--- a/drivers/media/usb/hdpvr/hdpvr-video.c
++++ b/drivers/media/usb/hdpvr/hdpvr-video.c
+@@ -439,7 +439,7 @@ static ssize_t hdpvr_read(struct file *file, char __user *buffer, size_t count,
+ 	/* wait for the first buffer */
+ 	if (!(file->f_flags & O_NONBLOCK)) {
+ 		if (wait_event_interruptible(dev->wait_data,
+-					     hdpvr_get_next_buffer(dev)))
++					     !list_empty_careful(&dev->rec_buff_list)))
+ 			return -ERESTARTSYS;
+ 	}
+ 
+@@ -465,10 +465,17 @@ static ssize_t hdpvr_read(struct file *file, char __user *buffer, size_t count,
+ 				goto err;
+ 			}
+ 			if (!err) {
+-				v4l2_dbg(MSG_INFO, hdpvr_debug, &dev->v4l2_dev,
+-					"timeout: restart streaming\n");
++				v4l2_info(&dev->v4l2_dev,
++					  "timeout: restart streaming\n");
++				mutex_lock(&dev->io_mutex);
+ 				hdpvr_stop_streaming(dev);
+-				msecs_to_jiffies(4000);
++				mutex_unlock(&dev->io_mutex);
++				/*
++				 * The FW needs about 4 seconds after streaming
++				 * stopped before it is ready to restart
++				 * streaming.
++				 */
++				msleep(4000);
+ 				err = hdpvr_start_streaming(dev);
+ 				if (err) {
+ 					ret = err;
+@@ -1133,9 +1140,7 @@ static void hdpvr_device_release(struct video_device *vdev)
+ 	struct hdpvr_device *dev = video_get_drvdata(vdev);
+ 
+ 	hdpvr_delete(dev);
+-	mutex_lock(&dev->io_mutex);
+ 	flush_work(&dev->worker);
+-	mutex_unlock(&dev->io_mutex);
+ 
+ 	v4l2_device_unregister(&dev->v4l2_dev);
+ 	v4l2_ctrl_handler_free(&dev->hdl);
+diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
+index 07bd2008ae4b..1ee072e939e4 100644
+--- a/drivers/media/v4l2-core/v4l2-ctrls.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls.c
+@@ -2113,16 +2113,15 @@ struct v4l2_ctrl *v4l2_ctrl_new_custom(struct v4l2_ctrl_handler *hdl,
+ 		v4l2_ctrl_fill(cfg->id, &name, &type, &min, &max, &step,
+ 								&def, &flags);
+ 
+-	is_menu = (cfg->type == V4L2_CTRL_TYPE_MENU ||
+-		   cfg->type == V4L2_CTRL_TYPE_INTEGER_MENU);
++	is_menu = (type == V4L2_CTRL_TYPE_MENU ||
++		   type == V4L2_CTRL_TYPE_INTEGER_MENU);
+ 	if (is_menu)
+ 		WARN_ON(step);
+ 	else
+ 		WARN_ON(cfg->menu_skip_mask);
+-	if (cfg->type == V4L2_CTRL_TYPE_MENU && qmenu == NULL)
++	if (type == V4L2_CTRL_TYPE_MENU && !qmenu) {
+ 		qmenu = v4l2_ctrl_get_menu(cfg->id);
+-	else if (cfg->type == V4L2_CTRL_TYPE_INTEGER_MENU &&
+-		 qmenu_int == NULL) {
++	} else if (type == V4L2_CTRL_TYPE_INTEGER_MENU && !qmenu_int) {
+ 		handler_set_err(hdl, -EINVAL);
+ 		return NULL;
+ 	}
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index 1246d69ba187..b1564cacd19e 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -629,13 +629,18 @@ static int __init memstick_init(void)
+ 		return -ENOMEM;
+ 
+ 	rc = bus_register(&memstick_bus_type);
+-	if (!rc)
+-		rc = class_register(&memstick_host_class);
++	if (rc)
++		goto error_destroy_workqueue;
+ 
+-	if (!rc)
+-		return 0;
++	rc = class_register(&memstick_host_class);
++	if (rc)
++		goto error_bus_unregister;
++
++	return 0;
+ 
++error_bus_unregister:
+ 	bus_unregister(&memstick_bus_type);
++error_destroy_workqueue:
+ 	destroy_workqueue(workqueue);
+ 
+ 	return rc;
+diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
+index 8d46e3ad9529..d8e3184bd27c 100644
+--- a/drivers/mfd/arizona-core.c
++++ b/drivers/mfd/arizona-core.c
+@@ -1029,7 +1029,7 @@ int arizona_dev_init(struct arizona *arizona)
+ 	unsigned int reg, val, mask;
+ 	int (*apply_patch)(struct arizona *) = NULL;
+ 	const struct mfd_cell *subdevs = NULL;
+-	int n_subdevs, ret, i;
++	int n_subdevs = 0, ret, i;
+ 
+ 	dev_set_drvdata(arizona->dev, arizona);
+ 	mutex_init(&arizona->clk_lock);
+diff --git a/drivers/mfd/hi655x-pmic.c b/drivers/mfd/hi655x-pmic.c
+index 96c07fa1802a..6693f74aa6ab 100644
+--- a/drivers/mfd/hi655x-pmic.c
++++ b/drivers/mfd/hi655x-pmic.c
+@@ -112,6 +112,8 @@ static int hi655x_pmic_probe(struct platform_device *pdev)
+ 
+ 	pmic->regmap = devm_regmap_init_mmio_clk(dev, NULL, base,
+ 						 &hi655x_regmap_config);
++	if (IS_ERR(pmic->regmap))
++		return PTR_ERR(pmic->regmap);
+ 
+ 	regmap_read(pmic->regmap, HI655X_BUS_ADDR(HI655X_VER_REG), &pmic->ver);
+ 	if ((pmic->ver < PMU_VER_START) || (pmic->ver > PMU_VER_END)) {
+diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
+index c57e407020f1..5c8ed2150c8b 100644
+--- a/drivers/mfd/mfd-core.c
++++ b/drivers/mfd/mfd-core.c
+@@ -179,6 +179,7 @@ static int mfd_add_device(struct device *parent, int id,
+ 		for_each_child_of_node(parent->of_node, np) {
+ 			if (of_device_is_compatible(np, cell->of_compatible)) {
+ 				pdev->dev.of_node = np;
++				pdev->dev.fwnode = &np->fwnode;
+ 				break;
+ 			}
+ 		}
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 8536a75f32e3..11a0e84d3d7c 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3817,8 +3817,8 @@ static u32 bond_rr_gen_slave_id(struct bonding *bond)
+ static int bond_xmit_roundrobin(struct sk_buff *skb, struct net_device *bond_dev)
+ {
+ 	struct bonding *bond = netdev_priv(bond_dev);
+-	struct iphdr *iph = ip_hdr(skb);
+ 	struct slave *slave;
++	int slave_cnt;
+ 	u32 slave_id;
+ 
+ 	/* Start with the curr_active_slave that joined the bond as the
+@@ -3827,23 +3827,32 @@ static int bond_xmit_roundrobin(struct sk_buff *skb, struct net_device *bond_dev
+ 	 * send the join/membership reports.  The curr_active_slave found
+ 	 * will send all of this type of traffic.
+ 	 */
+-	if (iph->protocol == IPPROTO_IGMP && skb->protocol == htons(ETH_P_IP)) {
+-		slave = rcu_dereference(bond->curr_active_slave);
+-		if (slave)
+-			bond_dev_queue_xmit(bond, skb, slave->dev);
+-		else
+-			bond_xmit_slave_id(bond, skb, 0);
+-	} else {
+-		int slave_cnt = ACCESS_ONCE(bond->slave_cnt);
++	if (skb->protocol == htons(ETH_P_IP)) {
++		int noff = skb_network_offset(skb);
++		struct iphdr *iph;
+ 
+-		if (likely(slave_cnt)) {
+-			slave_id = bond_rr_gen_slave_id(bond);
+-			bond_xmit_slave_id(bond, skb, slave_id % slave_cnt);
+-		} else {
+-			bond_tx_drop(bond_dev, skb);
++		if (unlikely(!pskb_may_pull(skb, noff + sizeof(*iph))))
++			goto non_igmp;
++
++		iph = ip_hdr(skb);
++		if (iph->protocol == IPPROTO_IGMP) {
++			slave = rcu_dereference(bond->curr_active_slave);
++			if (slave)
++				bond_dev_queue_xmit(bond, skb, slave->dev);
++			else
++				bond_xmit_slave_id(bond, skb, 0);
++			return NETDEV_TX_OK;
+ 		}
+ 	}
+ 
++non_igmp:
++	slave_cnt = ACCESS_ONCE(bond->slave_cnt);
++	if (likely(slave_cnt)) {
++		slave_id = bond_rr_gen_slave_id(bond);
++		bond_xmit_slave_id(bond, skb, slave_id % slave_cnt);
++	} else {
++		bond_tx_drop(bond_dev, skb);
++	}
+ 	return NETDEV_TX_OK;
+ }
+ 
+diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c
+index 438966bf51c2..60c6a60da7c4 100644
+--- a/drivers/net/caif/caif_hsi.c
++++ b/drivers/net/caif/caif_hsi.c
+@@ -1462,7 +1462,7 @@ static void __exit cfhsi_exit_module(void)
+ 	rtnl_lock();
+ 	list_for_each_safe(list_node, n, &cfhsi_list) {
+ 		cfhsi = list_entry(list_node, struct cfhsi, list);
+-		unregister_netdev(cfhsi->ndev);
++		unregister_netdevice(cfhsi->ndev);
+ 	}
+ 	rtnl_unlock();
+ }
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 086603de1859..0fff1502267a 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -4044,6 +4044,8 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev)
+ 				goto out_g1_irq;
+ 		}
+ 	}
++	if (chip->reset)
++		usleep_range(1000, 2000);
+ 
+ 	err = mv88e6xxx_mdios_register(chip, np);
+ 	if (err)
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index 8498a357d389..64828d1438ab 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -286,6 +286,9 @@ int bnx2x_tx_int(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata)
+ 	hw_cons = le16_to_cpu(*txdata->tx_cons_sb);
+ 	sw_cons = txdata->tx_pkt_cons;
+ 
++	/* Ensure subsequent loads occur after hw_cons */
++	smp_rmb();
++
+ 	while (sw_cons != hw_cons) {
+ 		u16 pkt_cons;
+ 
+@@ -3856,9 +3859,12 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 
+ 	if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)) {
+ 		if (!(bp->flags & TX_TIMESTAMPING_EN)) {
++			bp->eth_stats.ptp_skip_tx_ts++;
+ 			BNX2X_ERR("Tx timestamping was not enabled, this packet will not be timestamped\n");
+ 		} else if (bp->ptp_tx_skb) {
+-			BNX2X_ERR("The device supports only a single outstanding packet to timestamp, this packet will not be timestamped\n");
++			bp->eth_stats.ptp_skip_tx_ts++;
++			dev_err_once(&bp->dev->dev,
++					"Device supports only a single outstanding packet to timestamp, this packet won't be timestamped\n");
+ 		} else {
+ 			skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+ 			/* schedule check for Tx timestamp */
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+index 65bc1929d1a8..8edac67130ff 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+@@ -182,7 +182,9 @@ static const struct {
+ 	{ STATS_OFFSET32(driver_filtered_tx_pkt),
+ 				4, false, "driver_filtered_tx_pkt" },
+ 	{ STATS_OFFSET32(eee_tx_lpi),
+-				4, true, "Tx LPI entry count"}
++				4, true, "Tx LPI entry count"},
++	{ STATS_OFFSET32(ptp_skip_tx_ts),
++				4, false, "ptp_skipped_tx_tstamp" },
+ };
+ 
+ #define BNX2X_NUM_STATS		ARRAY_SIZE(bnx2x_stats_arr)
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 41ac9a2bc153..53fa4f88ed4d 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -15264,11 +15264,24 @@ static void bnx2x_ptp_task(struct work_struct *work)
+ 	u32 val_seq;
+ 	u64 timestamp, ns;
+ 	struct skb_shared_hwtstamps shhwtstamps;
++	bool bail = true;
++	int i;
++
++	/* FW may take a while to complete timestamping; try a bit and if it's
++	 * still not complete, may indicate an error state - bail out then.
++	 */
++	for (i = 0; i < 10; i++) {
++		/* Read Tx timestamp registers */
++		val_seq = REG_RD(bp, port ? NIG_REG_P1_TLLH_PTP_BUF_SEQID :
++				 NIG_REG_P0_TLLH_PTP_BUF_SEQID);
++		if (val_seq & 0x10000) {
++			bail = false;
++			break;
++		}
++		msleep(1 << i);
++	}
+ 
+-	/* Read Tx timestamp registers */
+-	val_seq = REG_RD(bp, port ? NIG_REG_P1_TLLH_PTP_BUF_SEQID :
+-			 NIG_REG_P0_TLLH_PTP_BUF_SEQID);
+-	if (val_seq & 0x10000) {
++	if (!bail) {
+ 		/* There is a valid timestamp value */
+ 		timestamp = REG_RD(bp, port ? NIG_REG_P1_TLLH_PTP_BUF_TS_MSB :
+ 				   NIG_REG_P0_TLLH_PTP_BUF_TS_MSB);
+@@ -15283,16 +15296,18 @@ static void bnx2x_ptp_task(struct work_struct *work)
+ 		memset(&shhwtstamps, 0, sizeof(shhwtstamps));
+ 		shhwtstamps.hwtstamp = ns_to_ktime(ns);
+ 		skb_tstamp_tx(bp->ptp_tx_skb, &shhwtstamps);
+-		dev_kfree_skb_any(bp->ptp_tx_skb);
+-		bp->ptp_tx_skb = NULL;
+ 
+ 		DP(BNX2X_MSG_PTP, "Tx timestamp, timestamp cycles = %llu, ns = %llu\n",
+ 		   timestamp, ns);
+ 	} else {
+-		DP(BNX2X_MSG_PTP, "There is no valid Tx timestamp yet\n");
+-		/* Reschedule to keep checking for a valid timestamp value */
+-		schedule_work(&bp->ptp_task);
++		DP(BNX2X_MSG_PTP,
++		   "Tx timestamp is not recorded (register read=%u)\n",
++		   val_seq);
++		bp->eth_stats.ptp_skip_tx_ts++;
+ 	}
++
++	dev_kfree_skb_any(bp->ptp_tx_skb);
++	bp->ptp_tx_skb = NULL;
+ }
+ 
+ void bnx2x_set_rx_ts(struct bnx2x *bp, struct sk_buff *skb)
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
+index b2644ed13d06..d55e63692cf3 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
+@@ -207,6 +207,9 @@ struct bnx2x_eth_stats {
+ 	u32 driver_filtered_tx_pkt;
+ 	/* src: Clear-on-Read register; Will not survive PMF Migration */
+ 	u32 eee_tx_lpi;
++
++	/* PTP */
++	u32 ptp_skip_tx_ts;
+ };
+ 
+ struct bnx2x_eth_q_stats {
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 9cebca896913..d857df8ebdb4 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -3088,39 +3088,42 @@ static void bcmgenet_timeout(struct net_device *dev)
+ 	netif_tx_wake_all_queues(dev);
+ }
+ 
+-#define MAX_MC_COUNT	16
++#define MAX_MDF_FILTER	17
+ 
+ static inline void bcmgenet_set_mdf_addr(struct bcmgenet_priv *priv,
+ 					 unsigned char *addr,
+-					 int *i,
+-					 int *mc)
++					 int *i)
+ {
+-	u32 reg;
+-
+ 	bcmgenet_umac_writel(priv, addr[0] << 8 | addr[1],
+ 			     UMAC_MDF_ADDR + (*i * 4));
+ 	bcmgenet_umac_writel(priv, addr[2] << 24 | addr[3] << 16 |
+ 			     addr[4] << 8 | addr[5],
+ 			     UMAC_MDF_ADDR + ((*i + 1) * 4));
+-	reg = bcmgenet_umac_readl(priv, UMAC_MDF_CTRL);
+-	reg |= (1 << (MAX_MC_COUNT - *mc));
+-	bcmgenet_umac_writel(priv, reg, UMAC_MDF_CTRL);
+ 	*i += 2;
+-	(*mc)++;
+ }
+ 
+ static void bcmgenet_set_rx_mode(struct net_device *dev)
+ {
+ 	struct bcmgenet_priv *priv = netdev_priv(dev);
+ 	struct netdev_hw_addr *ha;
+-	int i, mc;
++	int i, nfilter;
+ 	u32 reg;
+ 
+ 	netif_dbg(priv, hw, dev, "%s: %08X\n", __func__, dev->flags);
+ 
+-	/* Promiscuous mode */
++	/* Number of filters needed */
++	nfilter = netdev_uc_count(dev) + netdev_mc_count(dev) + 2;
++
++	/*
++	 * Turn on promicuous mode for three scenarios
++	 * 1. IFF_PROMISC flag is set
++	 * 2. IFF_ALLMULTI flag is set
++	 * 3. The number of filters needed exceeds the number filters
++	 *    supported by the hardware.
++	*/
+ 	reg = bcmgenet_umac_readl(priv, UMAC_CMD);
+-	if (dev->flags & IFF_PROMISC) {
++	if ((dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) ||
++	    (nfilter > MAX_MDF_FILTER)) {
+ 		reg |= CMD_PROMISC;
+ 		bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+ 		bcmgenet_umac_writel(priv, 0, UMAC_MDF_CTRL);
+@@ -3130,32 +3133,24 @@ static void bcmgenet_set_rx_mode(struct net_device *dev)
+ 		bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+ 	}
+ 
+-	/* UniMac doesn't support ALLMULTI */
+-	if (dev->flags & IFF_ALLMULTI) {
+-		netdev_warn(dev, "ALLMULTI is not supported\n");
+-		return;
+-	}
+-
+ 	/* update MDF filter */
+ 	i = 0;
+-	mc = 0;
+ 	/* Broadcast */
+-	bcmgenet_set_mdf_addr(priv, dev->broadcast, &i, &mc);
++	bcmgenet_set_mdf_addr(priv, dev->broadcast, &i);
+ 	/* my own address.*/
+-	bcmgenet_set_mdf_addr(priv, dev->dev_addr, &i, &mc);
+-	/* Unicast list*/
+-	if (netdev_uc_count(dev) > (MAX_MC_COUNT - mc))
+-		return;
++	bcmgenet_set_mdf_addr(priv, dev->dev_addr, &i);
+ 
+-	if (!netdev_uc_empty(dev))
+-		netdev_for_each_uc_addr(ha, dev)
+-			bcmgenet_set_mdf_addr(priv, ha->addr, &i, &mc);
+-	/* Multicast */
+-	if (netdev_mc_empty(dev) || netdev_mc_count(dev) >= (MAX_MC_COUNT - mc))
+-		return;
++	/* Unicast */
++	netdev_for_each_uc_addr(ha, dev)
++		bcmgenet_set_mdf_addr(priv, ha->addr, &i);
+ 
++	/* Multicast */
+ 	netdev_for_each_mc_addr(ha, dev)
+-		bcmgenet_set_mdf_addr(priv, ha->addr, &i, &mc);
++		bcmgenet_set_mdf_addr(priv, ha->addr, &i);
++
++	/* Enable filters */
++	reg = GENMASK(MAX_MDF_FILTER - 1, MAX_MDF_FILTER - nfilter);
++	bcmgenet_umac_writel(priv, reg, UMAC_MDF_CTRL);
+ }
+ 
+ /* Set the hardware MAC address. */
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 98cd53d380f7..0ae6532b02e0 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -1690,10 +1690,10 @@ static void fec_get_mac(struct net_device *ndev)
+ 	 */
+ 	if (!is_valid_ether_addr(iap)) {
+ 		/* Report it and use a random ethernet address instead */
+-		netdev_err(ndev, "Invalid MAC address: %pM\n", iap);
++		dev_err(&fep->pdev->dev, "Invalid MAC address: %pM\n", iap);
+ 		eth_hw_addr_random(ndev);
+-		netdev_info(ndev, "Using random MAC address: %pM\n",
+-			    ndev->dev_addr);
++		dev_info(&fep->pdev->dev, "Using random MAC address: %pM\n",
++			 ndev->dev_addr);
+ 		return;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 654aad6e748b..86523e8993cb 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -619,8 +619,7 @@ static u8 *hclge_comm_get_strings(u32 stringset,
+ 		return buff;
+ 
+ 	for (i = 0; i < size; i++) {
+-		snprintf(buff, ETH_GSTRING_LEN,
+-			 strs[i].desc);
++		snprintf(buff, ETH_GSTRING_LEN, "%s", strs[i].desc);
+ 		buff = buff + ETH_GSTRING_LEN;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index 73a75d7cc551..55228b91d80b 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -57,7 +57,8 @@ static int hclge_shaper_para_calc(u32 ir, u8 shaper_level,
+ 	u32 tick;
+ 
+ 	/* Calc tick */
+-	if (shaper_level >= HCLGE_SHAPER_LVL_CNT)
++	if (shaper_level >= HCLGE_SHAPER_LVL_CNT ||
++	    ir > HCLGE_ETHER_MAX_RATE)
+ 		return -EINVAL;
+ 
+ 	tick = tick_array[shaper_level];
+@@ -893,6 +894,9 @@ static int hclge_tm_schd_mode_vnet_base_cfg(struct hclge_vport *vport)
+ 	int ret;
+ 	u8 i;
+ 
++	if (vport->vport_id >= HNAE3_MAX_TC)
++		return -EINVAL;
++
+ 	ret = hclge_tm_pri_schd_mode_cfg(hdev, vport->vport_id);
+ 	if (ret)
+ 		return ret;
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+index 7368b0dc3af8..4afdabbe95e8 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+@@ -1117,7 +1117,7 @@ static struct sk_buff *i40e_construct_skb(struct i40e_ring *rx_ring,
+ 					  struct i40e_rx_buffer *rx_buffer,
+ 					  unsigned int size)
+ {
+-	void *va = page_address(rx_buffer->page) + rx_buffer->page_offset;
++	void *va;
+ #if (PAGE_SIZE < 8192)
+ 	unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
+ #else
+@@ -1127,6 +1127,7 @@ static struct sk_buff *i40e_construct_skb(struct i40e_ring *rx_ring,
+ 	struct sk_buff *skb;
+ 
+ 	/* prefetch first cache line of first page */
++	va = page_address(rx_buffer->page) + rx_buffer->page_offset;
+ 	prefetch(va);
+ #if L1_CACHE_BYTES < 128
+ 	prefetch(va + L1_CACHE_BYTES);
+@@ -1181,7 +1182,7 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
+ 				      struct i40e_rx_buffer *rx_buffer,
+ 				      unsigned int size)
+ {
+-	void *va = page_address(rx_buffer->page) + rx_buffer->page_offset;
++	void *va;
+ #if (PAGE_SIZE < 8192)
+ 	unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
+ #else
+@@ -1191,6 +1192,7 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
+ 	struct sk_buff *skb;
+ 
+ 	/* prefetch first cache line of first page */
++	va = page_address(rx_buffer->page) + rx_buffer->page_offset;
+ 	prefetch(va);
+ #if L1_CACHE_BYTES < 128
+ 	prefetch(va + L1_CACHE_BYTES);
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+index c3e7a8191128..f7e68083200c 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+@@ -3237,7 +3237,8 @@ static int ixgbe_get_module_info(struct net_device *dev,
+ 		page_swap = true;
+ 	}
+ 
+-	if (sff8472_rev == IXGBE_SFF_SFF_8472_UNSUP || page_swap) {
++	if (sff8472_rev == IXGBE_SFF_SFF_8472_UNSUP || page_swap ||
++	    !(addr_mode & IXGBE_SFF_DDM_IMPLEMENTED)) {
+ 		/* We have a SFP, but it does not support SFF-8472 */
+ 		modinfo->type = ETH_MODULE_SFF_8079;
+ 		modinfo->eeprom_len = ETH_MODULE_SFF_8079_LEN;
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
+index b0cac961df3b..94df1d99be95 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
+@@ -70,6 +70,7 @@
+ #define IXGBE_SFF_SOFT_RS_SELECT_10G		0x8
+ #define IXGBE_SFF_SOFT_RS_SELECT_1G		0x0
+ #define IXGBE_SFF_ADDRESSING_MODE		0x4
++#define IXGBE_SFF_DDM_IMPLEMENTED		0x40
+ #define IXGBE_SFF_QSFP_DA_ACTIVE_CABLE		0x1
+ #define IXGBE_SFF_QSFP_DA_PASSIVE_CABLE		0x8
+ #define IXGBE_SFF_QSFP_CONNECTOR_NOT_SEPARABLE	0x23
+diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
+index 0495487f7b42..b6ff143c9cff 100644
+--- a/drivers/net/ethernet/marvell/mvmdio.c
++++ b/drivers/net/ethernet/marvell/mvmdio.c
+@@ -64,7 +64,7 @@
+ 
+ struct orion_mdio_dev {
+ 	void __iomem *regs;
+-	struct clk *clk[3];
++	struct clk *clk[4];
+ 	/*
+ 	 * If we have access to the error interrupt pin (which is
+ 	 * somewhat misnamed as it not only reflects internal errors
+@@ -321,6 +321,10 @@ static int orion_mdio_probe(struct platform_device *pdev)
+ 
+ 	for (i = 0; i < ARRAY_SIZE(dev->clk); i++) {
+ 		dev->clk[i] = of_clk_get(pdev->dev.of_node, i);
++		if (PTR_ERR(dev->clk[i]) == -EPROBE_DEFER) {
++			ret = -EPROBE_DEFER;
++			goto out_clk;
++		}
+ 		if (IS_ERR(dev->clk[i]))
+ 			break;
+ 		clk_prepare_enable(dev->clk[i]);
+@@ -365,6 +369,7 @@ out_mdio:
+ 	if (dev->err_interrupt > 0)
+ 		writel(0, dev->regs + MVMDIO_ERR_INT_MASK);
+ 
++out_clk:
+ 	for (i = 0; i < ARRAY_SIZE(dev->clk); i++) {
+ 		if (IS_ERR(dev->clk[i]))
+ 			break;
+diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
+index cf6f58889038..7b239af6cc04 100644
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -4947,6 +4947,13 @@ static const struct dmi_system_id msi_blacklist[] = {
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "P-79"),
+ 		},
+ 	},
++	{
++		.ident = "ASUS P6T",
++		.matches = {
++			DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
++			DMI_MATCH(DMI_BOARD_NAME, "P6T"),
++		},
++	},
+ 	{}
+ };
+ 
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+index 410528e7d927..c4e8bf0773fe 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -2947,6 +2947,7 @@ static int qed_get_dev_info(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
+ static int qed_hw_prepare_single(struct qed_hwfn *p_hwfn,
+ 				 void __iomem *p_regview,
+ 				 void __iomem *p_doorbells,
++				 u64 db_phys_addr,
+ 				 enum qed_pci_personality personality)
+ {
+ 	int rc = 0;
+@@ -2954,6 +2955,7 @@ static int qed_hw_prepare_single(struct qed_hwfn *p_hwfn,
+ 	/* Split PCI bars evenly between hwfns */
+ 	p_hwfn->regview = p_regview;
+ 	p_hwfn->doorbells = p_doorbells;
++	p_hwfn->db_phys_addr = db_phys_addr;
+ 
+ 	if (IS_VF(p_hwfn->cdev))
+ 		return qed_vf_hw_prepare(p_hwfn);
+@@ -3036,7 +3038,9 @@ int qed_hw_prepare(struct qed_dev *cdev,
+ 	/* Initialize the first hwfn - will learn number of hwfns */
+ 	rc = qed_hw_prepare_single(p_hwfn,
+ 				   cdev->regview,
+-				   cdev->doorbells, personality);
++				   cdev->doorbells,
++				   cdev->db_phys_addr,
++				   personality);
+ 	if (rc)
+ 		return rc;
+ 
+@@ -3045,22 +3049,25 @@ int qed_hw_prepare(struct qed_dev *cdev,
+ 	/* Initialize the rest of the hwfns */
+ 	if (cdev->num_hwfns > 1) {
+ 		void __iomem *p_regview, *p_doorbell;
+-		u8 __iomem *addr;
++		u64 db_phys_addr;
++		u32 offset;
+ 
+ 		/* adjust bar offset for second engine */
+-		addr = cdev->regview +
+-		       qed_hw_bar_size(p_hwfn, p_hwfn->p_main_ptt,
+-				       BAR_ID_0) / 2;
+-		p_regview = addr;
++		offset = qed_hw_bar_size(p_hwfn, p_hwfn->p_main_ptt,
++					 BAR_ID_0) / 2;
++		p_regview = cdev->regview + offset;
+ 
+-		addr = cdev->doorbells +
+-		       qed_hw_bar_size(p_hwfn, p_hwfn->p_main_ptt,
+-				       BAR_ID_1) / 2;
+-		p_doorbell = addr;
++		offset = qed_hw_bar_size(p_hwfn, p_hwfn->p_main_ptt,
++					 BAR_ID_1) / 2;
++
++		p_doorbell = cdev->doorbells + offset;
++
++		db_phys_addr = cdev->db_phys_addr + offset;
+ 
+ 		/* prepare second hw function */
+ 		rc = qed_hw_prepare_single(&cdev->hwfns[1], p_regview,
+-					   p_doorbell, personality);
++					   p_doorbell, db_phys_addr,
++					   personality);
+ 
+ 		/* in case of error, need to free the previously
+ 		 * initiliazed hwfn 0.
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+index 1b6554866138..1e13dea66989 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+@@ -753,7 +753,7 @@ static int qed_rdma_add_user(void *rdma_cxt,
+ 				     dpi_start_offset +
+ 				     ((out_params->dpi) * p_hwfn->dpi_size));
+ 
+-	out_params->dpi_phys_addr = p_hwfn->cdev->db_phys_addr +
++	out_params->dpi_phys_addr = p_hwfn->db_phys_addr +
+ 				    dpi_start_offset +
+ 				    ((out_params->dpi) * p_hwfn->dpi_size);
+ 
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+index 540d21786a43..08dd6a06ac58 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+@@ -217,6 +217,12 @@ static void dwmac1000_set_filter(struct mac_device_info *hw,
+ 					    GMAC_ADDR_LOW(reg));
+ 			reg++;
+ 		}
++
++		while (reg <= perfect_addr_number) {
++			writel(0, ioaddr + GMAC_ADDR_HIGH(reg));
++			writel(0, ioaddr + GMAC_ADDR_LOW(reg));
++			reg++;
++		}
+ 	}
+ 
+ #ifdef FRAME_FILTER_DEBUG
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index 55ae14a6bb8c..8445af580cb6 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -443,14 +443,20 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ 		 * are required
+ 		 */
+ 		value |= GMAC_PACKET_FILTER_PR;
+-	} else if (!netdev_uc_empty(dev)) {
+-		int reg = 1;
++	} else {
+ 		struct netdev_hw_addr *ha;
++		int reg = 1;
+ 
+ 		netdev_for_each_uc_addr(ha, dev) {
+ 			dwmac4_set_umac_addr(hw, ha->addr, reg);
+ 			reg++;
+ 		}
++
++		while (reg <= GMAC_MAX_PERFECT_ADDRESSES) {
++			writel(0, ioaddr + GMAC_ADDR_HIGH(reg));
++			writel(0, ioaddr + GMAC_ADDR_LOW(reg));
++			reg++;
++		}
+ 	}
+ 
+ 	writel(value, ioaddr + GMAC_PACKET_FILTER);
+@@ -468,8 +474,9 @@ static void dwmac4_flow_ctrl(struct mac_device_info *hw, unsigned int duplex,
+ 	if (fc & FLOW_RX) {
+ 		pr_debug("\tReceive Flow-Control ON\n");
+ 		flow |= GMAC_RX_FLOW_CTRL_RFE;
+-		writel(flow, ioaddr + GMAC_RX_FLOW_CTRL);
+ 	}
++	writel(flow, ioaddr + GMAC_RX_FLOW_CTRL);
++
+ 	if (fc & FLOW_TX) {
+ 		pr_debug("\tTransmit Flow-Control ON\n");
+ 
+@@ -477,7 +484,7 @@ static void dwmac4_flow_ctrl(struct mac_device_info *hw, unsigned int duplex,
+ 			pr_debug("\tduplex mode: PAUSE %d\n", pause_time);
+ 
+ 		for (queue = 0; queue < tx_cnt; queue++) {
+-			flow |= GMAC_TX_FLOW_CTRL_TFE;
++			flow = GMAC_TX_FLOW_CTRL_TFE;
+ 
+ 			if (duplex)
+ 				flow |=
+@@ -485,6 +492,9 @@ static void dwmac4_flow_ctrl(struct mac_device_info *hw, unsigned int duplex,
+ 
+ 			writel(flow, ioaddr + GMAC_QX_TX_FLOW_CTRL(queue));
+ 		}
++	} else {
++		for (queue = 0; queue < tx_cnt; queue++)
++			writel(0, ioaddr + GMAC_QX_TX_FLOW_CTRL(queue));
+ 	}
+ }
+ 
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index d46dc8cd1670..b481cb174b23 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -614,6 +614,10 @@ static void axienet_start_xmit_done(struct net_device *ndev)
+ 
+ 	ndev->stats.tx_packets += packets;
+ 	ndev->stats.tx_bytes += size;
++
++	/* Matches barrier in axienet_start_xmit */
++	smp_mb();
++
+ 	netif_wake_queue(ndev);
+ }
+ 
+@@ -668,9 +672,19 @@ static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ 	cur_p = &lp->tx_bd_v[lp->tx_bd_tail];
+ 
+ 	if (axienet_check_tx_bd_space(lp, num_frag)) {
+-		if (!netif_queue_stopped(ndev))
+-			netif_stop_queue(ndev);
+-		return NETDEV_TX_BUSY;
++		if (netif_queue_stopped(ndev))
++			return NETDEV_TX_BUSY;
++
++		netif_stop_queue(ndev);
++
++		/* Matches barrier in axienet_start_xmit_done */
++		smp_mb();
++
++		/* Space might have just been freed - check again */
++		if (axienet_check_tx_bd_space(lp, num_frag))
++			return NETDEV_TX_BUSY;
++
++		netif_wake_queue(ndev);
+ 	}
+ 
+ 	if (skb->ip_summed == CHECKSUM_PARTIAL) {
+diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
+index f38e32a7ec9c..5de4053774b8 100644
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -289,16 +289,29 @@ static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
+ 	return gtp_rx(pctx, skb, hdrlen, gtp->role);
+ }
+ 
+-static void gtp_encap_destroy(struct sock *sk)
++static void __gtp_encap_destroy(struct sock *sk)
+ {
+ 	struct gtp_dev *gtp;
+ 
+-	gtp = rcu_dereference_sk_user_data(sk);
++	lock_sock(sk);
++	gtp = sk->sk_user_data;
+ 	if (gtp) {
++		if (gtp->sk0 == sk)
++			gtp->sk0 = NULL;
++		else
++			gtp->sk1u = NULL;
+ 		udp_sk(sk)->encap_type = 0;
+ 		rcu_assign_sk_user_data(sk, NULL);
+ 		sock_put(sk);
+ 	}
++	release_sock(sk);
++}
++
++static void gtp_encap_destroy(struct sock *sk)
++{
++	rtnl_lock();
++	__gtp_encap_destroy(sk);
++	rtnl_unlock();
+ }
+ 
+ static void gtp_encap_disable_sock(struct sock *sk)
+@@ -306,7 +319,7 @@ static void gtp_encap_disable_sock(struct sock *sk)
+ 	if (!sk)
+ 		return;
+ 
+-	gtp_encap_destroy(sk);
++	__gtp_encap_destroy(sk);
+ }
+ 
+ static void gtp_encap_disable(struct gtp_dev *gtp)
+@@ -798,7 +811,8 @@ static struct sock *gtp_encap_enable_socket(int fd, int type,
+ 		goto out_sock;
+ 	}
+ 
+-	if (rcu_dereference_sk_user_data(sock->sk)) {
++	lock_sock(sock->sk);
++	if (sock->sk->sk_user_data) {
+ 		sk = ERR_PTR(-EBUSY);
+ 		goto out_sock;
+ 	}
+@@ -814,6 +828,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type,
+ 	setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg);
+ 
+ out_sock:
++	release_sock(sock->sk);
+ 	sockfd_put(sock);
+ 	return sk;
+ }
+@@ -845,8 +860,13 @@ static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[])
+ 
+ 	if (data[IFLA_GTP_ROLE]) {
+ 		role = nla_get_u32(data[IFLA_GTP_ROLE]);
+-		if (role > GTP_ROLE_SGSN)
++		if (role > GTP_ROLE_SGSN) {
++			if (sk0)
++				gtp_encap_disable_sock(sk0);
++			if (sk1u)
++				gtp_encap_disable_sock(sk1u);
+ 			return -EINVAL;
++		}
+ 	}
+ 
+ 	gtp->sk0 = sk0;
+@@ -947,7 +967,7 @@ static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk,
+ 
+ 	}
+ 
+-	pctx = kmalloc(sizeof(struct pdp_ctx), GFP_KERNEL);
++	pctx = kmalloc(sizeof(*pctx), GFP_ATOMIC);
+ 	if (pctx == NULL)
+ 		return -ENOMEM;
+ 
+@@ -1036,6 +1056,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info)
+ 		return -EINVAL;
+ 	}
+ 
++	rtnl_lock();
+ 	rcu_read_lock();
+ 
+ 	gtp = gtp_find_dev(sock_net(skb->sk), info->attrs);
+@@ -1060,6 +1081,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info)
+ 
+ out_unlock:
+ 	rcu_read_unlock();
++	rtnl_unlock();
+ 	return err;
+ }
+ 
+@@ -1361,9 +1383,9 @@ late_initcall(gtp_init);
+ 
+ static void __exit gtp_fini(void)
+ {
+-	unregister_pernet_subsys(&gtp_net_ops);
+ 	genl_unregister_family(&gtp_genl_family);
+ 	rtnl_link_unregister(&gtp_link_ops);
++	unregister_pernet_subsys(&gtp_net_ops);
+ 
+ 	pr_info("GTP module unloaded\n");
+ }
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 5ab1b8849c30..0c69dfbd28ef 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -865,6 +865,7 @@ static void macsec_reset_skb(struct sk_buff *skb, struct net_device *dev)
+ 
+ static void macsec_finalize_skb(struct sk_buff *skb, u8 icv_len, u8 hdr_len)
+ {
++	skb->ip_summed = CHECKSUM_NONE;
+ 	memmove(skb->data + hdr_len, skb->data, 2 * ETH_ALEN);
+ 	skb_pull(skb, hdr_len);
+ 	pskb_trim_unique(skb, skb->len - icv_len);
+@@ -1099,10 +1100,9 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
+ 	}
+ 
+ 	skb = skb_unshare(skb, GFP_ATOMIC);
+-	if (!skb) {
+-		*pskb = NULL;
++	*pskb = skb;
++	if (!skb)
+ 		return RX_HANDLER_CONSUMED;
+-	}
+ 
+ 	pulled_sci = pskb_may_pull(skb, macsec_extra_len(true));
+ 	if (!pulled_sci) {
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index c433be573e0d..ed7e3c70b511 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -729,6 +729,9 @@ int phy_connect_direct(struct net_device *dev, struct phy_device *phydev,
+ {
+ 	int rc;
+ 
++	if (!dev)
++		return -EINVAL;
++
+ 	rc = phy_attach_direct(dev, phydev, phydev->dev_flags, interface);
+ 	if (rc)
+ 		return rc;
+@@ -1067,6 +1070,9 @@ struct phy_device *phy_attach(struct net_device *dev, const char *bus_id,
+ 	struct device *d;
+ 	int rc;
+ 
++	if (!dev)
++		return ERR_PTR(-EINVAL);
++
+ 	/* Search the list of PHY devices on the mdio bus for the
+ 	 * PHY with the requested name
+ 	 */
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 2dcb25aa0452..9cef89fe410d 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -115,10 +115,11 @@ struct sfp {
+ 	struct gpio_desc *gpio[GPIO_MAX];
+ 
+ 	bool attached;
++	struct mutex st_mutex;			/* Protects state */
+ 	unsigned int state;
+ 	struct delayed_work poll;
+ 	struct delayed_work timeout;
+-	struct mutex sm_mutex;
++	struct mutex sm_mutex;			/* Protects state machine */
+ 	unsigned char sm_mod_state;
+ 	unsigned char sm_dev_state;
+ 	unsigned short sm_state;
+@@ -738,6 +739,7 @@ static void sfp_check_state(struct sfp *sfp)
+ {
+ 	unsigned int state, i, changed;
+ 
++	mutex_lock(&sfp->st_mutex);
+ 	state = sfp_get_state(sfp);
+ 	changed = state ^ sfp->state;
+ 	changed &= SFP_F_PRESENT | SFP_F_LOS | SFP_F_TX_FAULT;
+@@ -763,6 +765,7 @@ static void sfp_check_state(struct sfp *sfp)
+ 		sfp_sm_event(sfp, state & SFP_F_LOS ?
+ 				SFP_E_LOS_HIGH : SFP_E_LOS_LOW);
+ 	rtnl_unlock();
++	mutex_unlock(&sfp->st_mutex);
+ }
+ 
+ static irqreturn_t sfp_irq(int irq, void *data)
+@@ -793,6 +796,7 @@ static struct sfp *sfp_alloc(struct device *dev)
+ 	sfp->dev = dev;
+ 
+ 	mutex_init(&sfp->sm_mutex);
++	mutex_init(&sfp->st_mutex);
+ 	INIT_DELAYED_WORK(&sfp->poll, sfp_poll);
+ 	INIT_DELAYED_WORK(&sfp->timeout, sfp_timeout);
+ 
+diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
+index d0c0ac0c3519..9b751d4bd327 100644
+--- a/drivers/net/usb/asix_devices.c
++++ b/drivers/net/usb/asix_devices.c
+@@ -238,7 +238,7 @@ static void asix_phy_reset(struct usbnet *dev, unsigned int reset_bits)
+ static int ax88172_bind(struct usbnet *dev, struct usb_interface *intf)
+ {
+ 	int ret = 0;
+-	u8 buf[ETH_ALEN];
++	u8 buf[ETH_ALEN] = {0};
+ 	int i;
+ 	unsigned long gpio_bits = dev->driver_info->data;
+ 
+@@ -689,7 +689,7 @@ static int asix_resume(struct usb_interface *intf)
+ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
+ {
+ 	int ret, i;
+-	u8 buf[ETH_ALEN], chipcode = 0;
++	u8 buf[ETH_ALEN] = {0}, chipcode = 0;
+ 	u32 phyid;
+ 	struct asix_common_private *priv;
+ 
+@@ -1065,7 +1065,7 @@ static const struct net_device_ops ax88178_netdev_ops = {
+ static int ax88178_bind(struct usbnet *dev, struct usb_interface *intf)
+ {
+ 	int ret;
+-	u8 buf[ETH_ALEN];
++	u8 buf[ETH_ALEN] = {0};
+ 
+ 	usbnet_get_endpoints(dev,intf);
+ 
+diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
+index 5c6a8ef54aec..03e4fcdfeab7 100644
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -167,23 +167,29 @@ static int vrf_ip6_local_out(struct net *net, struct sock *sk,
+ static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
+ 					   struct net_device *dev)
+ {
+-	const struct ipv6hdr *iph = ipv6_hdr(skb);
++	const struct ipv6hdr *iph;
+ 	struct net *net = dev_net(skb->dev);
+-	struct flowi6 fl6 = {
+-		/* needed to match OIF rule */
+-		.flowi6_oif = dev->ifindex,
+-		.flowi6_iif = LOOPBACK_IFINDEX,
+-		.daddr = iph->daddr,
+-		.saddr = iph->saddr,
+-		.flowlabel = ip6_flowinfo(iph),
+-		.flowi6_mark = skb->mark,
+-		.flowi6_proto = iph->nexthdr,
+-		.flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF,
+-	};
++	struct flowi6 fl6;
+ 	int ret = NET_XMIT_DROP;
+ 	struct dst_entry *dst;
+ 	struct dst_entry *dst_null = &net->ipv6.ip6_null_entry->dst;
+ 
++	if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct ipv6hdr)))
++		goto err;
++
++	iph = ipv6_hdr(skb);
++
++	memset(&fl6, 0, sizeof(fl6));
++	/* needed to match OIF rule */
++	fl6.flowi6_oif = dev->ifindex;
++	fl6.flowi6_iif = LOOPBACK_IFINDEX;
++	fl6.daddr = iph->daddr;
++	fl6.saddr = iph->saddr;
++	fl6.flowlabel = ip6_flowinfo(iph);
++	fl6.flowi6_mark = skb->mark;
++	fl6.flowi6_proto = iph->nexthdr;
++	fl6.flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF;
++
+ 	dst = ip6_route_output(net, NULL, &fl6);
+ 	if (dst == dst_null)
+ 		goto err;
+@@ -239,21 +245,27 @@ static int vrf_ip_local_out(struct net *net, struct sock *sk,
+ static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb,
+ 					   struct net_device *vrf_dev)
+ {
+-	struct iphdr *ip4h = ip_hdr(skb);
++	struct iphdr *ip4h;
+ 	int ret = NET_XMIT_DROP;
+-	struct flowi4 fl4 = {
+-		/* needed to match OIF rule */
+-		.flowi4_oif = vrf_dev->ifindex,
+-		.flowi4_iif = LOOPBACK_IFINDEX,
+-		.flowi4_tos = RT_TOS(ip4h->tos),
+-		.flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_SKIP_NH_OIF,
+-		.flowi4_proto = ip4h->protocol,
+-		.daddr = ip4h->daddr,
+-		.saddr = ip4h->saddr,
+-	};
++	struct flowi4 fl4;
+ 	struct net *net = dev_net(vrf_dev);
+ 	struct rtable *rt;
+ 
++	if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct iphdr)))
++		goto err;
++
++	ip4h = ip_hdr(skb);
++
++	memset(&fl4, 0, sizeof(fl4));
++	/* needed to match OIF rule */
++	fl4.flowi4_oif = vrf_dev->ifindex;
++	fl4.flowi4_iif = LOOPBACK_IFINDEX;
++	fl4.flowi4_tos = RT_TOS(ip4h->tos);
++	fl4.flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_SKIP_NH_OIF;
++	fl4.flowi4_proto = ip4h->protocol;
++	fl4.daddr = ip4h->daddr;
++	fl4.saddr = ip4h->saddr;
++
+ 	rt = ip_route_output_flow(net, &fl4, NULL);
+ 	if (IS_ERR(rt))
+ 		goto err;
+diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c
+index a860691d635d..e96534cd3d8b 100644
+--- a/drivers/net/wireless/ath/ath10k/hw.c
++++ b/drivers/net/wireless/ath/ath10k/hw.c
+@@ -168,7 +168,7 @@ const struct ath10k_hw_values qca6174_values = {
+ };
+ 
+ const struct ath10k_hw_values qca99x0_values = {
+-	.rtc_state_val_on		= 5,
++	.rtc_state_val_on		= 7,
+ 	.ce_count			= 12,
+ 	.msi_assign_ce_max		= 12,
+ 	.num_target_ce_config_wlan	= 10,
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index cdcfb175ad9b..58a3c42c4aed 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -1611,6 +1611,10 @@ static int ath10k_mac_setup_prb_tmpl(struct ath10k_vif *arvif)
+ 	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
+ 		return 0;
+ 
++	 /* For mesh, probe response and beacon share the same template */
++	if (ieee80211_vif_is_mesh(vif))
++		return 0;
++
+ 	prb = ieee80211_proberesp_get(hw, vif);
+ 	if (!prb) {
+ 		ath10k_warn(ar, "failed to get probe resp template from mac80211\n");
+diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
+index da9dbf3ddaa5..0a1248ebccf5 100644
+--- a/drivers/net/wireless/ath/ath10k/sdio.c
++++ b/drivers/net/wireless/ath/ath10k/sdio.c
+@@ -610,6 +610,10 @@ static int ath10k_sdio_mbox_rx_alloc(struct ath10k *ar,
+ 						    full_len,
+ 						    last_in_bundle,
+ 						    last_in_bundle);
++		if (ret) {
++			ath10k_warn(ar, "alloc_rx_pkt error %d\n", ret);
++			goto err;
++		}
+ 	}
+ 
+ 	ar_sdio->n_rx_pkts = i;
+@@ -2072,6 +2076,9 @@ static void ath10k_sdio_remove(struct sdio_func *func)
+ 	cancel_work_sync(&ar_sdio->wr_async_work);
+ 	ath10k_core_unregister(ar);
+ 	ath10k_core_destroy(ar);
++
++	flush_workqueue(ar_sdio->workqueue);
++	destroy_workqueue(ar_sdio->workqueue);
+ }
+ 
+ static const struct sdio_device_id ath10k_sdio_devices[] = {
+diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
+index bfc20b45b806..d79c2bccf582 100644
+--- a/drivers/net/wireless/ath/ath6kl/wmi.c
++++ b/drivers/net/wireless/ath/ath6kl/wmi.c
+@@ -1178,6 +1178,10 @@ static int ath6kl_wmi_pstream_timeout_event_rx(struct wmi *wmi, u8 *datap,
+ 		return -EINVAL;
+ 
+ 	ev = (struct wmi_pstream_timeout_event *) datap;
++	if (ev->traffic_class >= WMM_NUM_AC) {
++		ath6kl_err("invalid traffic class: %d\n", ev->traffic_class);
++		return -EINVAL;
++	}
+ 
+ 	/*
+ 	 * When the pstream (fat pipe == AC) timesout, it means there were
+@@ -1519,6 +1523,10 @@ static int ath6kl_wmi_cac_event_rx(struct wmi *wmi, u8 *datap, int len,
+ 		return -EINVAL;
+ 
+ 	reply = (struct wmi_cac_event *) datap;
++	if (reply->ac >= WMM_NUM_AC) {
++		ath6kl_err("invalid AC: %d\n", reply->ac);
++		return -EINVAL;
++	}
+ 
+ 	if ((reply->cac_indication == CAC_INDICATION_ADMISSION_RESP) &&
+ 	    (reply->status_code != IEEE80211_TSPEC_STATUS_ADMISS_ACCEPTED)) {
+@@ -2635,7 +2643,7 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class,
+ 	u16 active_tsids = 0;
+ 	int ret;
+ 
+-	if (traffic_class > 3) {
++	if (traffic_class >= WMM_NUM_AC) {
+ 		ath6kl_err("invalid traffic class: %d\n", traffic_class);
+ 		return -EINVAL;
+ 	}
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index a7f506eb7b36..406b52f114f0 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -250,8 +250,9 @@ void ath9k_hw_get_channel_centers(struct ath_hw *ah,
+ /* Chip Revisions */
+ /******************/
+ 
+-static void ath9k_hw_read_revisions(struct ath_hw *ah)
++static bool ath9k_hw_read_revisions(struct ath_hw *ah)
+ {
++	u32 srev;
+ 	u32 val;
+ 
+ 	if (ah->get_mac_revision)
+@@ -267,25 +268,33 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
+ 			val = REG_READ(ah, AR_SREV);
+ 			ah->hw_version.macRev = MS(val, AR_SREV_REVISION2);
+ 		}
+-		return;
++		return true;
+ 	case AR9300_DEVID_AR9340:
+ 		ah->hw_version.macVersion = AR_SREV_VERSION_9340;
+-		return;
++		return true;
+ 	case AR9300_DEVID_QCA955X:
+ 		ah->hw_version.macVersion = AR_SREV_VERSION_9550;
+-		return;
++		return true;
+ 	case AR9300_DEVID_AR953X:
+ 		ah->hw_version.macVersion = AR_SREV_VERSION_9531;
+-		return;
++		return true;
+ 	case AR9300_DEVID_QCA956X:
+ 		ah->hw_version.macVersion = AR_SREV_VERSION_9561;
+-		return;
++		return true;
+ 	}
+ 
+-	val = REG_READ(ah, AR_SREV) & AR_SREV_ID;
++	srev = REG_READ(ah, AR_SREV);
++
++	if (srev == -EIO) {
++		ath_err(ath9k_hw_common(ah),
++			"Failed to read SREV register");
++		return false;
++	}
++
++	val = srev & AR_SREV_ID;
+ 
+ 	if (val == 0xFF) {
+-		val = REG_READ(ah, AR_SREV);
++		val = srev;
+ 		ah->hw_version.macVersion =
+ 			(val & AR_SREV_VERSION2) >> AR_SREV_TYPE2_S;
+ 		ah->hw_version.macRev = MS(val, AR_SREV_REVISION2);
+@@ -304,6 +313,8 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
+ 		if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCIE)
+ 			ah->is_pciexpress = true;
+ 	}
++
++	return true;
+ }
+ 
+ /************************************/
+@@ -557,7 +568,10 @@ static int __ath9k_hw_init(struct ath_hw *ah)
+ 	struct ath_common *common = ath9k_hw_common(ah);
+ 	int r = 0;
+ 
+-	ath9k_hw_read_revisions(ah);
++	if (!ath9k_hw_read_revisions(ah)) {
++		ath_err(common, "Could not read hardware revisions");
++		return -EOPNOTSUPP;
++	}
+ 
+ 	switch (ah->hw_version.macVersion) {
+ 	case AR_SREV_VERSION_5416_PCI:
+diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c
+index 4100ffd42a43..78146607f16e 100644
+--- a/drivers/net/wireless/ath/dfs_pattern_detector.c
++++ b/drivers/net/wireless/ath/dfs_pattern_detector.c
+@@ -111,7 +111,7 @@ static const struct radar_detector_specs jp_radar_ref_types[] = {
+ 	JP_PATTERN(0, 0, 1, 1428, 1428, 1, 18, 29, false),
+ 	JP_PATTERN(1, 2, 3, 3846, 3846, 1, 18, 29, false),
+ 	JP_PATTERN(2, 0, 1, 1388, 1388, 1, 18, 50, false),
+-	JP_PATTERN(3, 1, 2, 4000, 4000, 1, 18, 50, false),
++	JP_PATTERN(3, 0, 4, 4000, 4000, 1, 18, 50, false),
+ 	JP_PATTERN(4, 0, 5, 150, 230, 1, 23, 50, false),
+ 	JP_PATTERN(5, 6, 10, 200, 500, 1, 16, 50, false),
+ 	JP_PATTERN(6, 11, 20, 200, 500, 1, 12, 50, false),
+diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
+index 389c718cd257..16750056b8b5 100644
+--- a/drivers/net/wireless/ath/wil6210/txrx.c
++++ b/drivers/net/wireless/ath/wil6210/txrx.c
+@@ -732,6 +732,7 @@ void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
+ 		[GRO_HELD]		= "GRO_HELD",
+ 		[GRO_NORMAL]		= "GRO_NORMAL",
+ 		[GRO_DROP]		= "GRO_DROP",
++		[GRO_CONSUMED]		= "GRO_CONSUMED",
+ 	};
+ 
+ 	if (ndev->features & NETIF_F_RXHASH)
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index 62a6e293cf12..f0f2be432d20 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -621,6 +621,9 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
+ 
+ 	memcpy(&info, skb->cb, sizeof(info));
+ 
++	if (WARN_ON_ONCE(skb->len > IEEE80211_MAX_DATA_LEN + hdrlen))
++		return -1;
++
+ 	if (WARN_ON_ONCE(info.flags & IEEE80211_TX_CTL_AMPDU))
+ 		return -1;
+ 
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index 953e0254a94c..3ebab48f6980 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -1674,25 +1674,23 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
+ 		goto out;
+ 	}
+ 
+-	if (iwl_have_debug_level(IWL_DL_ISR)) {
+-		/* NIC fires this, but we don't use it, redundant with WAKEUP */
+-		if (inta & CSR_INT_BIT_SCD) {
+-			IWL_DEBUG_ISR(trans,
+-				      "Scheduler finished to transmit the frame/frames.\n");
+-			isr_stats->sch++;
+-		}
++	/* NIC fires this, but we don't use it, redundant with WAKEUP */
++	if (inta & CSR_INT_BIT_SCD) {
++		IWL_DEBUG_ISR(trans,
++			      "Scheduler finished to transmit the frame/frames.\n");
++		isr_stats->sch++;
++	}
+ 
+-		/* Alive notification via Rx interrupt will do the real work */
+-		if (inta & CSR_INT_BIT_ALIVE) {
+-			IWL_DEBUG_ISR(trans, "Alive interrupt\n");
+-			isr_stats->alive++;
+-			if (trans->cfg->gen2) {
+-				/*
+-				 * We can restock, since firmware configured
+-				 * the RFH
+-				 */
+-				iwl_pcie_rxmq_restock(trans, trans_pcie->rxq);
+-			}
++	/* Alive notification via Rx interrupt will do the real work */
++	if (inta & CSR_INT_BIT_ALIVE) {
++		IWL_DEBUG_ISR(trans, "Alive interrupt\n");
++		isr_stats->alive++;
++		if (trans->cfg->gen2) {
++			/*
++			 * We can restock, since firmware configured
++			 * the RFH
++			 */
++			iwl_pcie_rxmq_restock(trans, trans_pcie->rxq);
+ 		}
+ 	}
+ 
+@@ -1956,10 +1954,18 @@ irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id)
+ 		return IRQ_NONE;
+ 	}
+ 
+-	if (iwl_have_debug_level(IWL_DL_ISR))
+-		IWL_DEBUG_ISR(trans, "ISR inta_fh 0x%08x, enabled 0x%08x\n",
+-			      inta_fh,
++	if (iwl_have_debug_level(IWL_DL_ISR)) {
++		IWL_DEBUG_ISR(trans,
++			      "ISR inta_fh 0x%08x, enabled (sw) 0x%08x (hw) 0x%08x\n",
++			      inta_fh, trans_pcie->fh_mask,
+ 			      iwl_read32(trans, CSR_MSIX_FH_INT_MASK_AD));
++		if (inta_fh & ~trans_pcie->fh_mask)
++			IWL_DEBUG_ISR(trans,
++				      "We got a masked interrupt (0x%08x)\n",
++				      inta_fh & ~trans_pcie->fh_mask);
++	}
++
++	inta_fh &= trans_pcie->fh_mask;
+ 
+ 	if ((trans_pcie->shared_vec_mask & IWL_SHARED_IRQ_NON_RX) &&
+ 	    inta_fh & MSIX_FH_INT_CAUSES_Q0) {
+@@ -1998,11 +2004,18 @@ irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id)
+ 	}
+ 
+ 	/* After checking FH register check HW register */
+-	if (iwl_have_debug_level(IWL_DL_ISR))
++	if (iwl_have_debug_level(IWL_DL_ISR)) {
+ 		IWL_DEBUG_ISR(trans,
+-			      "ISR inta_hw 0x%08x, enabled 0x%08x\n",
+-			      inta_hw,
++			      "ISR inta_hw 0x%08x, enabled (sw) 0x%08x (hw) 0x%08x\n",
++			      inta_hw, trans_pcie->hw_mask,
+ 			      iwl_read32(trans, CSR_MSIX_HW_INT_MASK_AD));
++		if (inta_hw & ~trans_pcie->hw_mask)
++			IWL_DEBUG_ISR(trans,
++				      "We got a masked interrupt 0x%08x\n",
++				      inta_hw & ~trans_pcie->hw_mask);
++	}
++
++	inta_hw &= trans_pcie->hw_mask;
+ 
+ 	/* Alive notification via Rx interrupt will do the real work */
+ 	if (inta_hw & MSIX_HW_INT_CAUSES_REG_ALIVE) {
+diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c
+index 7f3e3983b781..47cebb2ec05c 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/dma.c
++++ b/drivers/net/wireless/mediatek/mt7601u/dma.c
+@@ -193,10 +193,23 @@ static void mt7601u_complete_rx(struct urb *urb)
+ 	struct mt7601u_rx_queue *q = &dev->rx_q;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&dev->rx_lock, flags);
++	/* do no schedule rx tasklet if urb has been unlinked
++	 * or the device has been removed
++	 */
++	switch (urb->status) {
++	case -ECONNRESET:
++	case -ESHUTDOWN:
++	case -ENOENT:
++		return;
++	default:
++		dev_err_ratelimited(dev->dev, "rx urb failed: %d\n",
++				    urb->status);
++		/* fall through */
++	case 0:
++		break;
++	}
+ 
+-	if (mt7601u_urb_has_error(urb))
+-		dev_err(dev->dev, "Error: RX urb failed:%d\n", urb->status);
++	spin_lock_irqsave(&dev->rx_lock, flags);
+ 	if (WARN_ONCE(q->e[q->end].urb != urb, "RX urb mismatch"))
+ 		goto out;
+ 
+@@ -228,14 +241,25 @@ static void mt7601u_complete_tx(struct urb *urb)
+ 	struct sk_buff *skb;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&dev->tx_lock, flags);
++	switch (urb->status) {
++	case -ECONNRESET:
++	case -ESHUTDOWN:
++	case -ENOENT:
++		return;
++	default:
++		dev_err_ratelimited(dev->dev, "tx urb failed: %d\n",
++				    urb->status);
++		/* fall through */
++	case 0:
++		break;
++	}
+ 
+-	if (mt7601u_urb_has_error(urb))
+-		dev_err(dev->dev, "Error: TX urb failed:%d\n", urb->status);
++	spin_lock_irqsave(&dev->tx_lock, flags);
+ 	if (WARN_ONCE(q->e[q->start].urb != urb, "TX urb mismatch"))
+ 		goto out;
+ 
+ 	skb = q->e[q->start].skb;
++	q->e[q->start].skb = NULL;
+ 	trace_mt_tx_dma_done(dev, skb);
+ 
+ 	__skb_queue_tail(&dev->tx_skb_done, skb);
+@@ -363,19 +387,9 @@ int mt7601u_dma_enqueue_tx(struct mt7601u_dev *dev, struct sk_buff *skb,
+ static void mt7601u_kill_rx(struct mt7601u_dev *dev)
+ {
+ 	int i;
+-	unsigned long flags;
+-
+-	spin_lock_irqsave(&dev->rx_lock, flags);
+-
+-	for (i = 0; i < dev->rx_q.entries; i++) {
+-		int next = dev->rx_q.end;
+ 
+-		spin_unlock_irqrestore(&dev->rx_lock, flags);
+-		usb_poison_urb(dev->rx_q.e[next].urb);
+-		spin_lock_irqsave(&dev->rx_lock, flags);
+-	}
+-
+-	spin_unlock_irqrestore(&dev->rx_lock, flags);
++	for (i = 0; i < dev->rx_q.entries; i++)
++		usb_poison_urb(dev->rx_q.e[i].urb);
+ }
+ 
+ static int mt7601u_submit_rx_buf(struct mt7601u_dev *dev,
+@@ -445,10 +459,10 @@ static void mt7601u_free_tx_queue(struct mt7601u_tx_queue *q)
+ {
+ 	int i;
+ 
+-	WARN_ON(q->used);
+-
+ 	for (i = 0; i < q->entries; i++)  {
+ 		usb_poison_urb(q->e[i].urb);
++		if (q->e[i].skb)
++			mt7601u_tx_status(q->dev, q->e[i].skb);
+ 		usb_free_urb(q->e[i].urb);
+ 	}
+ }
+diff --git a/drivers/net/wireless/mediatek/mt7601u/tx.c b/drivers/net/wireless/mediatek/mt7601u/tx.c
+index 3600e911a63e..4d81c45722fb 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/tx.c
++++ b/drivers/net/wireless/mediatek/mt7601u/tx.c
+@@ -117,9 +117,9 @@ void mt7601u_tx_status(struct mt7601u_dev *dev, struct sk_buff *skb)
+ 	info->status.rates[0].idx = -1;
+ 	info->flags |= IEEE80211_TX_STAT_ACK;
+ 
+-	spin_lock(&dev->mac_lock);
++	spin_lock_bh(&dev->mac_lock);
+ 	ieee80211_tx_status(dev->hw, skb);
+-	spin_unlock(&dev->mac_lock);
++	spin_unlock_bh(&dev->mac_lock);
+ }
+ 
+ static int mt7601u_skb_rooms(struct mt7601u_dev *dev, struct sk_buff *skb)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index 820c42ff5384..2401c8bdb211 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -1099,13 +1099,13 @@ int rtl_usb_probe(struct usb_interface *intf,
+ 	rtlpriv->cfg->ops->read_eeprom_info(hw);
+ 	err = _rtl_usb_init(hw);
+ 	if (err)
+-		goto error_out;
++		goto error_out2;
+ 	rtl_usb_init_sw(hw);
+ 	/* Init mac80211 sw */
+ 	err = rtl_init_core(hw);
+ 	if (err) {
+ 		pr_err("Can't allocate sw for mac80211\n");
+-		goto error_out;
++		goto error_out2;
+ 	}
+ 	if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
+ 		pr_err("Can't init_sw_vars\n");
+@@ -1126,6 +1126,7 @@ int rtl_usb_probe(struct usb_interface *intf,
+ 
+ error_out:
+ 	rtl_deinit_core(hw);
++error_out2:
+ 	_rtl_usb_io_handler_release(hw);
+ 	usb_put_dev(udev);
+ 	complete(&rtlpriv->firmware_loading_complete);
+diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c
+index 1bf2bd318371..0e9e37410c58 100644
+--- a/drivers/nvdimm/dax_devs.c
++++ b/drivers/nvdimm/dax_devs.c
+@@ -126,7 +126,7 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns)
+ 	nvdimm_bus_unlock(&ndns->dev);
+ 	if (!dax_dev)
+ 		return -ENOMEM;
+-	pfn_sb = devm_kzalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
++	pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
+ 	nd_pfn->pfn_sb = pfn_sb;
+ 	rc = nd_pfn_validate(nd_pfn, DAX_SIG);
+ 	dev_dbg(dev, "%s: dax: %s\n", __func__,
+diff --git a/drivers/nvdimm/pfn.h b/drivers/nvdimm/pfn.h
+index dde9853453d3..e901e3a3b04c 100644
+--- a/drivers/nvdimm/pfn.h
++++ b/drivers/nvdimm/pfn.h
+@@ -36,6 +36,7 @@ struct nd_pfn_sb {
+ 	__le32 end_trunc;
+ 	/* minor-version-2 record the base alignment of the mapping */
+ 	__le32 align;
++	/* minor-version-3 guarantee the padding and flags are zero */
+ 	u8 padding[4000];
+ 	__le64 checksum;
+ };
+diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
+index b9dad88b8ea3..e2af91a91c22 100644
+--- a/drivers/nvdimm/pfn_devs.c
++++ b/drivers/nvdimm/pfn_devs.c
+@@ -361,6 +361,15 @@ struct device *nd_pfn_create(struct nd_region *nd_region)
+ 	return dev;
+ }
+ 
++/**
++ * nd_pfn_validate - read and validate info-block
++ * @nd_pfn: fsdax namespace runtime state / properties
++ * @sig: 'devdax' or 'fsdax' signature
++ *
++ * Upon return the info-block buffer contents (->pfn_sb) are
++ * indeterminate when validation fails, and a coherent info-block
++ * otherwise.
++ */
+ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
+ {
+ 	u64 checksum, offset;
+@@ -506,7 +515,7 @@ int nd_pfn_probe(struct device *dev, struct nd_namespace_common *ndns)
+ 	nvdimm_bus_unlock(&ndns->dev);
+ 	if (!pfn_dev)
+ 		return -ENOMEM;
+-	pfn_sb = devm_kzalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
++	pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
+ 	nd_pfn = to_nd_pfn(pfn_dev);
+ 	nd_pfn->pfn_sb = pfn_sb;
+ 	rc = nd_pfn_validate(nd_pfn, PFN_SIG);
+@@ -637,7 +646,7 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
+ 	u64 checksum;
+ 	int rc;
+ 
+-	pfn_sb = devm_kzalloc(&nd_pfn->dev, sizeof(*pfn_sb), GFP_KERNEL);
++	pfn_sb = devm_kmalloc(&nd_pfn->dev, sizeof(*pfn_sb), GFP_KERNEL);
+ 	if (!pfn_sb)
+ 		return -ENOMEM;
+ 
+@@ -646,11 +655,14 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
+ 		sig = DAX_SIG;
+ 	else
+ 		sig = PFN_SIG;
++
+ 	rc = nd_pfn_validate(nd_pfn, sig);
+ 	if (rc != -ENODEV)
+ 		return rc;
+ 
+ 	/* no info block, do init */;
++	memset(pfn_sb, 0, sizeof(*pfn_sb));
++
+ 	nd_region = to_nd_region(nd_pfn->dev.parent);
+ 	if (nd_region->ro) {
+ 		dev_info(&nd_pfn->dev,
+@@ -704,7 +716,7 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
+ 	memcpy(pfn_sb->uuid, nd_pfn->uuid, 16);
+ 	memcpy(pfn_sb->parent_uuid, nd_dev_to_uuid(&ndns->dev), 16);
+ 	pfn_sb->version_major = cpu_to_le16(1);
+-	pfn_sb->version_minor = cpu_to_le16(2);
++	pfn_sb->version_minor = cpu_to_le16(3);
+ 	pfn_sb->start_pad = cpu_to_le32(start_pad);
+ 	pfn_sb->end_trunc = cpu_to_le32(end_trunc);
+ 	pfn_sb->align = cpu_to_le32(nd_pfn->align);
+diff --git a/drivers/pci/dwc/pci-dra7xx.c b/drivers/pci/dwc/pci-dra7xx.c
+index 06eae132aff7..63052c5e5f82 100644
+--- a/drivers/pci/dwc/pci-dra7xx.c
++++ b/drivers/pci/dwc/pci-dra7xx.c
+@@ -29,6 +29,7 @@
+ #include <linux/types.h>
+ #include <linux/mfd/syscon.h>
+ #include <linux/regmap.h>
++#include <linux/gpio/consumer.h>
+ 
+ #include "pcie-designware.h"
+ 
+diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c
+index f591de23f3d3..5a9d94512232 100644
+--- a/drivers/pci/host/pci-hyperv.c
++++ b/drivers/pci/host/pci-hyperv.c
+@@ -1912,6 +1912,7 @@ static void hv_pci_devices_present(struct hv_pcibus_device *hbus,
+ static void hv_eject_device_work(struct work_struct *work)
+ {
+ 	struct pci_eject_response *ejct_pkt;
++	struct hv_pcibus_device *hbus;
+ 	struct hv_pci_dev *hpdev;
+ 	struct pci_dev *pdev;
+ 	unsigned long flags;
+@@ -1922,6 +1923,7 @@ static void hv_eject_device_work(struct work_struct *work)
+ 	} ctxt;
+ 
+ 	hpdev = container_of(work, struct hv_pci_dev, wrk);
++	hbus = hpdev->hbus;
+ 
+ 	if (hpdev->state != hv_pcichild_ejecting) {
+ 		put_pcichild(hpdev, hv_pcidev_ref_pnp);
+@@ -1935,8 +1937,7 @@ static void hv_eject_device_work(struct work_struct *work)
+ 	 * because hbus->pci_bus may not exist yet.
+ 	 */
+ 	wslot = wslot_to_devfn(hpdev->desc.win_slot.slot);
+-	pdev = pci_get_domain_bus_and_slot(hpdev->hbus->sysdata.domain, 0,
+-					   wslot);
++	pdev = pci_get_domain_bus_and_slot(hbus->sysdata.domain, 0, wslot);
+ 	if (pdev) {
+ 		pci_lock_rescan_remove();
+ 		pci_stop_and_remove_bus_device(pdev);
+@@ -1944,9 +1945,9 @@ static void hv_eject_device_work(struct work_struct *work)
+ 		pci_unlock_rescan_remove();
+ 	}
+ 
+-	spin_lock_irqsave(&hpdev->hbus->device_list_lock, flags);
++	spin_lock_irqsave(&hbus->device_list_lock, flags);
+ 	list_del(&hpdev->list_entry);
+-	spin_unlock_irqrestore(&hpdev->hbus->device_list_lock, flags);
++	spin_unlock_irqrestore(&hbus->device_list_lock, flags);
+ 
+ 	if (hpdev->pci_slot)
+ 		pci_destroy_slot(hpdev->pci_slot);
+@@ -1955,14 +1956,16 @@ static void hv_eject_device_work(struct work_struct *work)
+ 	ejct_pkt = (struct pci_eject_response *)&ctxt.pkt.message;
+ 	ejct_pkt->message_type.type = PCI_EJECTION_COMPLETE;
+ 	ejct_pkt->wslot.slot = hpdev->desc.win_slot.slot;
+-	vmbus_sendpacket(hpdev->hbus->hdev->channel, ejct_pkt,
++	vmbus_sendpacket(hbus->hdev->channel, ejct_pkt,
+ 			 sizeof(*ejct_pkt), (unsigned long)&ctxt.pkt,
+ 			 VM_PKT_DATA_INBAND, 0);
+ 
+ 	put_pcichild(hpdev, hv_pcidev_ref_childlist);
+ 	put_pcichild(hpdev, hv_pcidev_ref_initial);
+ 	put_pcichild(hpdev, hv_pcidev_ref_pnp);
+-	put_hvpcibus(hpdev->hbus);
++
++	/* hpdev has been freed. Do not use it any more. */
++	put_hvpcibus(hbus);
+ }
+ 
+ /**
+diff --git a/drivers/pci/host/pcie-xilinx-nwl.c b/drivers/pci/host/pcie-xilinx-nwl.c
+index dd527ea558d7..981a5195686f 100644
+--- a/drivers/pci/host/pcie-xilinx-nwl.c
++++ b/drivers/pci/host/pcie-xilinx-nwl.c
+@@ -485,15 +485,13 @@ static int nwl_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ 	int i;
+ 
+ 	mutex_lock(&msi->lock);
+-	bit = bitmap_find_next_zero_area(msi->bitmap, INT_PCI_MSI_NR, 0,
+-					 nr_irqs, 0);
+-	if (bit >= INT_PCI_MSI_NR) {
++	bit = bitmap_find_free_region(msi->bitmap, INT_PCI_MSI_NR,
++				      get_count_order(nr_irqs));
++	if (bit < 0) {
+ 		mutex_unlock(&msi->lock);
+ 		return -ENOSPC;
+ 	}
+ 
+-	bitmap_set(msi->bitmap, bit, nr_irqs);
+-
+ 	for (i = 0; i < nr_irqs; i++) {
+ 		irq_domain_set_info(domain, virq + i, bit + i, &nwl_irq_chip,
+ 				domain->host_data, handle_simple_irq,
+@@ -511,7 +509,8 @@ static void nwl_irq_domain_free(struct irq_domain *domain, unsigned int virq,
+ 	struct nwl_msi *msi = &pcie->msi;
+ 
+ 	mutex_lock(&msi->lock);
+-	bitmap_clear(msi->bitmap, data->hwirq, nr_irqs);
++	bitmap_release_region(msi->bitmap, data->hwirq,
++			      get_count_order(nr_irqs));
+ 	mutex_unlock(&msi->lock);
+ }
+ 
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index ea69b4dbab66..e5a8bf2c9b37 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -415,6 +415,9 @@ static int pci_device_probe(struct device *dev)
+ 	struct pci_dev *pci_dev = to_pci_dev(dev);
+ 	struct pci_driver *drv = to_pci_driver(dev->driver);
+ 
++	if (!pci_device_can_probe(pci_dev))
++		return -ENODEV;
++
+ 	pci_assign_irq(pci_dev);
+ 
+ 	error = pcibios_alloc_irq(pci_dev);
+@@ -422,12 +425,10 @@ static int pci_device_probe(struct device *dev)
+ 		return error;
+ 
+ 	pci_dev_get(pci_dev);
+-	if (pci_device_can_probe(pci_dev)) {
+-		error = __pci_device_probe(drv, pci_dev);
+-		if (error) {
+-			pcibios_free_irq(pci_dev);
+-			pci_dev_put(pci_dev);
+-		}
++	error = __pci_device_probe(drv, pci_dev);
++	if (error) {
++		pcibios_free_irq(pci_dev);
++		pci_dev_put(pci_dev);
+ 	}
+ 
+ 	return error;
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index c3f0473d1afa..ee7dccab771d 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -496,7 +496,7 @@ static ssize_t remove_store(struct device *dev, struct device_attribute *attr,
+ 		pci_stop_and_remove_bus_device_locked(to_pci_dev(dev));
+ 	return count;
+ }
+-static struct device_attribute dev_remove_attr = __ATTR(remove,
++static struct device_attribute dev_remove_attr = __ATTR_IGNORE_LOCKDEP(remove,
+ 							(S_IWUSR|S_IWGRP),
+ 							NULL, remove_store);
+ 
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 1af30c881566..044b208f7f6a 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1786,6 +1786,13 @@ static void pci_pme_list_scan(struct work_struct *work)
+ 			 */
+ 			if (bridge && bridge->current_state != PCI_D0)
+ 				continue;
++			/*
++			 * If the device is in D3cold it should not be
++			 * polled either.
++			 */
++			if (pme_dev->dev->current_state == PCI_D3cold)
++				continue;
++
+ 			pci_pme_wakeup(pme_dev->dev, NULL);
+ 		} else {
+ 			list_del(&pme_dev->list);
+diff --git a/drivers/phy/renesas/phy-rcar-gen2.c b/drivers/phy/renesas/phy-rcar-gen2.c
+index 97d4dd6ea924..aa02b19b7e0e 100644
+--- a/drivers/phy/renesas/phy-rcar-gen2.c
++++ b/drivers/phy/renesas/phy-rcar-gen2.c
+@@ -288,6 +288,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev)
+ 		error = of_property_read_u32(np, "reg", &channel_num);
+ 		if (error || channel_num > 2) {
+ 			dev_err(dev, "Invalid \"reg\" property\n");
++			of_node_put(np);
+ 			return error;
+ 		}
+ 		channel->select_mask = select_mask[channel_num];
+@@ -303,6 +304,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev)
+ 						   &rcar_gen2_phy_ops);
+ 			if (IS_ERR(phy->phy)) {
+ 				dev_err(dev, "Failed to create PHY\n");
++				of_node_put(np);
+ 				return PTR_ERR(phy->phy);
+ 			}
+ 			phy_set_drvdata(phy->phy, phy);
+diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
+index a9bc1e01f982..5d6cf024ee9c 100644
+--- a/drivers/pinctrl/pinctrl-rockchip.c
++++ b/drivers/pinctrl/pinctrl-rockchip.c
+@@ -2941,6 +2941,7 @@ static int rockchip_get_bank_data(struct rockchip_pin_bank *bank,
+ 						    base,
+ 						    &rockchip_regmap_config);
+ 		}
++		of_node_put(node);
+ 	}
+ 
+ 	bank->irq = irq_of_parse_and_map(bank->of_node, 0);
+diff --git a/drivers/ras/cec.c b/drivers/ras/cec.c
+index c7205cdcc11a..97cf40a522be 100644
+--- a/drivers/ras/cec.c
++++ b/drivers/ras/cec.c
+@@ -373,7 +373,9 @@ static int pfn_set(void *data, u64 val)
+ {
+ 	*(u64 *)data = val;
+ 
+-	return cec_add_elem(val);
++	cec_add_elem(val);
++
++	return 0;
+ }
+ 
+ DEFINE_DEBUGFS_ATTRIBUTE(pfn_ops, u64_get, pfn_set, "0x%llx\n");
+diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
+index 17a816656b92..8f7c19901339 100644
+--- a/drivers/regulator/s2mps11.c
++++ b/drivers/regulator/s2mps11.c
+@@ -386,8 +386,8 @@ static const struct regulator_desc s2mps11_regulators[] = {
+ 	regulator_desc_s2mps11_buck1_4(4),
+ 	regulator_desc_s2mps11_buck5,
+ 	regulator_desc_s2mps11_buck67810(6, MIN_600_MV, STEP_6_25_MV),
+-	regulator_desc_s2mps11_buck67810(7, MIN_600_MV, STEP_12_5_MV),
+-	regulator_desc_s2mps11_buck67810(8, MIN_600_MV, STEP_12_5_MV),
++	regulator_desc_s2mps11_buck67810(7, MIN_750_MV, STEP_12_5_MV),
++	regulator_desc_s2mps11_buck67810(8, MIN_750_MV, STEP_12_5_MV),
+ 	regulator_desc_s2mps11_buck9,
+ 	regulator_desc_s2mps11_buck67810(10, MIN_750_MV, STEP_12_5_MV),
+ };
+diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
+index c7afdbded26b..ab8dd81fbc2b 100644
+--- a/drivers/s390/cio/qdio_main.c
++++ b/drivers/s390/cio/qdio_main.c
+@@ -759,6 +759,7 @@ static int get_outbound_buffer_frontier(struct qdio_q *q)
+ 
+ 	switch (state) {
+ 	case SLSB_P_OUTPUT_EMPTY:
++	case SLSB_P_OUTPUT_PENDING:
+ 		/* the adapter got it */
+ 		DBF_DEV_EVENT(DBF_INFO, q->irq_ptr,
+ 			"out empty:%1d %02x", q->nr, count);
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 777b0222d021..8caa51797511 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -710,6 +710,8 @@ static void NCR5380_main(struct work_struct *work)
+ 			NCR5380_information_transfer(instance);
+ 			done = 0;
+ 		}
++		if (!hostdata->connected)
++			NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
+ 		spin_unlock_irq(&hostdata->lock);
+ 		if (!done)
+ 			cond_resched();
+@@ -984,7 +986,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ 	if (!hostdata->selecting) {
+ 		/* Command was aborted */
+ 		NCR5380_write(MODE_REG, MR_BASE);
+-		goto out;
++		return NULL;
+ 	}
+ 	if (err < 0) {
+ 		NCR5380_write(MODE_REG, MR_BASE);
+@@ -1033,7 +1035,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ 	if (!hostdata->selecting) {
+ 		NCR5380_write(MODE_REG, MR_BASE);
+ 		NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+-		goto out;
++		return NULL;
+ 	}
+ 
+ 	dsprintk(NDEBUG_ARBITRATION, instance, "won arbitration\n");
+@@ -1106,8 +1108,6 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ 		spin_lock_irq(&hostdata->lock);
+ 		NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+ 		NCR5380_reselect(instance);
+-		if (!hostdata->connected)
+-			NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
+ 		shost_printk(KERN_ERR, instance, "reselection after won arbitration?\n");
+ 		goto out;
+ 	}
+@@ -1115,14 +1115,16 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ 	if (err < 0) {
+ 		spin_lock_irq(&hostdata->lock);
+ 		NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+-		NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
++
+ 		/* Can't touch cmd if it has been reclaimed by the scsi ML */
+-		if (hostdata->selecting) {
+-			cmd->result = DID_BAD_TARGET << 16;
+-			complete_cmd(instance, cmd);
+-			dsprintk(NDEBUG_SELECTION, instance, "target did not respond within 250ms\n");
+-			cmd = NULL;
+-		}
++		if (!hostdata->selecting)
++			return NULL;
++
++		cmd->result = DID_BAD_TARGET << 16;
++		complete_cmd(instance, cmd);
++		dsprintk(NDEBUG_SELECTION, instance,
++			"target did not respond within 250ms\n");
++		cmd = NULL;
+ 		goto out;
+ 	}
+ 
+@@ -1150,12 +1152,11 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ 	if (err < 0) {
+ 		shost_printk(KERN_ERR, instance, "select: REQ timeout\n");
+ 		NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+-		NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
+ 		goto out;
+ 	}
+ 	if (!hostdata->selecting) {
+ 		do_abort(instance);
+-		goto out;
++		return NULL;
+ 	}
+ 
+ 	dsprintk(NDEBUG_SELECTION, instance, "target %d selected, going into MESSAGE OUT phase.\n",
+@@ -1817,9 +1818,6 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ 					 */
+ 					NCR5380_write(TARGET_COMMAND_REG, 0);
+ 
+-					/* Enable reselect interrupts */
+-					NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
+-
+ 					maybe_release_dma_irq(instance);
+ 					return;
+ 				case MESSAGE_REJECT:
+@@ -1851,8 +1849,6 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ 					 */
+ 					NCR5380_write(TARGET_COMMAND_REG, 0);
+ 
+-					/* Enable reselect interrupts */
+-					NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
+ #ifdef SUN3_SCSI_VME
+ 					dregs->csr |= CSR_DMA_ENABLE;
+ #endif
+@@ -1960,7 +1956,6 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ 					cmd->result = DID_ERROR << 16;
+ 					complete_cmd(instance, cmd);
+ 					maybe_release_dma_irq(instance);
+-					NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
+ 					return;
+ 				}
+ 				msgout = NOP;
+diff --git a/drivers/scsi/NCR5380.h b/drivers/scsi/NCR5380.h
+index 31096a0b0fdd..8a6d002e6789 100644
+--- a/drivers/scsi/NCR5380.h
++++ b/drivers/scsi/NCR5380.h
+@@ -235,7 +235,7 @@ struct NCR5380_cmd {
+ #define NCR5380_PIO_CHUNK_SIZE		256
+ 
+ /* Time limit (ms) to poll registers when IRQs are disabled, e.g. during PDMA */
+-#define NCR5380_REG_POLL_TIME		15
++#define NCR5380_REG_POLL_TIME		10
+ 
+ static inline struct scsi_cmnd *NCR5380_to_scmd(struct NCR5380_cmd *ncmd_ptr)
+ {
+diff --git a/drivers/scsi/mac_scsi.c b/drivers/scsi/mac_scsi.c
+index dd6057359d7c..643321fc152d 100644
+--- a/drivers/scsi/mac_scsi.c
++++ b/drivers/scsi/mac_scsi.c
+@@ -3,6 +3,8 @@
+  *
+  * Copyright 1998, Michael Schmitz <mschmitz@×××.gov>
+  *
++ * Copyright 2019 Finn Thain
++ *
+  * derived in part from:
+  */
+ /*
+@@ -11,6 +13,7 @@
+  * Copyright 1995, Russell King
+  */
+ 
++#include <linux/delay.h>
+ #include <linux/types.h>
+ #include <linux/module.h>
+ #include <linux/ioport.h>
+@@ -52,7 +55,7 @@ static int setup_cmd_per_lun = -1;
+ module_param(setup_cmd_per_lun, int, 0);
+ static int setup_sg_tablesize = -1;
+ module_param(setup_sg_tablesize, int, 0);
+-static int setup_use_pdma = -1;
++static int setup_use_pdma = 512;
+ module_param(setup_use_pdma, int, 0);
+ static int setup_hostid = -1;
+ module_param(setup_hostid, int, 0);
+@@ -89,101 +92,217 @@ static int __init mac_scsi_setup(char *str)
+ __setup("mac5380=", mac_scsi_setup);
+ #endif /* !MODULE */
+ 
+-/* Pseudo DMA asm originally by Ove Edlund */
+-
+-#define CP_IO_TO_MEM(s,d,n)				\
+-__asm__ __volatile__					\
+-    ("    cmp.w  #4,%2\n"				\
+-     "    bls    8f\n"					\
+-     "    move.w %1,%%d0\n"				\
+-     "    neg.b  %%d0\n"				\
+-     "    and.w  #3,%%d0\n"				\
+-     "    sub.w  %%d0,%2\n"				\
+-     "    bra    2f\n"					\
+-     " 1: move.b (%0),(%1)+\n"				\
+-     " 2: dbf    %%d0,1b\n"				\
+-     "    move.w %2,%%d0\n"				\
+-     "    lsr.w  #5,%%d0\n"				\
+-     "    bra    4f\n"					\
+-     " 3: move.l (%0),(%1)+\n"				\
+-     "31: move.l (%0),(%1)+\n"				\
+-     "32: move.l (%0),(%1)+\n"				\
+-     "33: move.l (%0),(%1)+\n"				\
+-     "34: move.l (%0),(%1)+\n"				\
+-     "35: move.l (%0),(%1)+\n"				\
+-     "36: move.l (%0),(%1)+\n"				\
+-     "37: move.l (%0),(%1)+\n"				\
+-     " 4: dbf    %%d0,3b\n"				\
+-     "    move.w %2,%%d0\n"				\
+-     "    lsr.w  #2,%%d0\n"				\
+-     "    and.w  #7,%%d0\n"				\
+-     "    bra    6f\n"					\
+-     " 5: move.l (%0),(%1)+\n"				\
+-     " 6: dbf    %%d0,5b\n"				\
+-     "    and.w  #3,%2\n"				\
+-     "    bra    8f\n"					\
+-     " 7: move.b (%0),(%1)+\n"				\
+-     " 8: dbf    %2,7b\n"				\
+-     "    moveq.l #0, %2\n"				\
+-     " 9: \n"						\
+-     ".section .fixup,\"ax\"\n"				\
+-     "    .even\n"					\
+-     "91: moveq.l #1, %2\n"				\
+-     "    jra 9b\n"					\
+-     "94: moveq.l #4, %2\n"				\
+-     "    jra 9b\n"					\
+-     ".previous\n"					\
+-     ".section __ex_table,\"a\"\n"			\
+-     "   .align 4\n"					\
+-     "   .long  1b,91b\n"				\
+-     "   .long  3b,94b\n"				\
+-     "   .long 31b,94b\n"				\
+-     "   .long 32b,94b\n"				\
+-     "   .long 33b,94b\n"				\
+-     "   .long 34b,94b\n"				\
+-     "   .long 35b,94b\n"				\
+-     "   .long 36b,94b\n"				\
+-     "   .long 37b,94b\n"				\
+-     "   .long  5b,94b\n"				\
+-     "   .long  7b,91b\n"				\
+-     ".previous"					\
+-     : "=a"(s), "=a"(d), "=d"(n)			\
+-     : "0"(s), "1"(d), "2"(n)				\
+-     : "d0")
++/*
++ * According to "Inside Macintosh: Devices", Mac OS requires disk drivers to
++ * specify the number of bytes between the delays expected from a SCSI target.
++ * This allows the operating system to "prevent bus errors when a target fails
++ * to deliver the next byte within the processor bus error timeout period."
++ * Linux SCSI drivers lack knowledge of the timing behaviour of SCSI targets
++ * so bus errors are unavoidable.
++ *
++ * If a MOVE.B instruction faults, we assume that zero bytes were transferred
++ * and simply retry. That assumption probably depends on target behaviour but
++ * seems to hold up okay. The NOP provides synchronization: without it the
++ * fault can sometimes occur after the program counter has moved past the
++ * offending instruction. Post-increment addressing can't be used.
++ */
++
++#define MOVE_BYTE(operands) \
++	asm volatile ( \
++		"1:     moveb " operands "     \n" \
++		"11:    nop                    \n" \
++		"       addq #1,%0             \n" \
++		"       subq #1,%1             \n" \
++		"40:                           \n" \
++		"                              \n" \
++		".section .fixup,\"ax\"        \n" \
++		".even                         \n" \
++		"90:    movel #1, %2           \n" \
++		"       jra 40b                \n" \
++		".previous                     \n" \
++		"                              \n" \
++		".section __ex_table,\"a\"     \n" \
++		".align  4                     \n" \
++		".long   1b,90b                \n" \
++		".long  11b,90b                \n" \
++		".previous                     \n" \
++		: "+a" (addr), "+r" (n), "+r" (result) : "a" (io))
++
++/*
++ * If a MOVE.W (or MOVE.L) instruction faults, it cannot be retried because
++ * the residual byte count would be uncertain. In that situation the MOVE_WORD
++ * macro clears n in the fixup section to abort the transfer.
++ */
++
++#define MOVE_WORD(operands) \
++	asm volatile ( \
++		"1:     movew " operands "     \n" \
++		"11:    nop                    \n" \
++		"       subq #2,%1             \n" \
++		"40:                           \n" \
++		"                              \n" \
++		".section .fixup,\"ax\"        \n" \
++		".even                         \n" \
++		"90:    movel #0, %1           \n" \
++		"       movel #2, %2           \n" \
++		"       jra 40b                \n" \
++		".previous                     \n" \
++		"                              \n" \
++		".section __ex_table,\"a\"     \n" \
++		".align  4                     \n" \
++		".long   1b,90b                \n" \
++		".long  11b,90b                \n" \
++		".previous                     \n" \
++		: "+a" (addr), "+r" (n), "+r" (result) : "a" (io))
++
++#define MOVE_16_WORDS(operands) \
++	asm volatile ( \
++		"1:     movew " operands "     \n" \
++		"2:     movew " operands "     \n" \
++		"3:     movew " operands "     \n" \
++		"4:     movew " operands "     \n" \
++		"5:     movew " operands "     \n" \
++		"6:     movew " operands "     \n" \
++		"7:     movew " operands "     \n" \
++		"8:     movew " operands "     \n" \
++		"9:     movew " operands "     \n" \
++		"10:    movew " operands "     \n" \
++		"11:    movew " operands "     \n" \
++		"12:    movew " operands "     \n" \
++		"13:    movew " operands "     \n" \
++		"14:    movew " operands "     \n" \
++		"15:    movew " operands "     \n" \
++		"16:    movew " operands "     \n" \
++		"17:    nop                    \n" \
++		"       subl  #32,%1           \n" \
++		"40:                           \n" \
++		"                              \n" \
++		".section .fixup,\"ax\"        \n" \
++		".even                         \n" \
++		"90:    movel #0, %1           \n" \
++		"       movel #2, %2           \n" \
++		"       jra 40b                \n" \
++		".previous                     \n" \
++		"                              \n" \
++		".section __ex_table,\"a\"     \n" \
++		".align  4                     \n" \
++		".long   1b,90b                \n" \
++		".long   2b,90b                \n" \
++		".long   3b,90b                \n" \
++		".long   4b,90b                \n" \
++		".long   5b,90b                \n" \
++		".long   6b,90b                \n" \
++		".long   7b,90b                \n" \
++		".long   8b,90b                \n" \
++		".long   9b,90b                \n" \
++		".long  10b,90b                \n" \
++		".long  11b,90b                \n" \
++		".long  12b,90b                \n" \
++		".long  13b,90b                \n" \
++		".long  14b,90b                \n" \
++		".long  15b,90b                \n" \
++		".long  16b,90b                \n" \
++		".long  17b,90b                \n" \
++		".previous                     \n" \
++		: "+a" (addr), "+r" (n), "+r" (result) : "a" (io))
++
++#define MAC_PDMA_DELAY		32
++
++static inline int mac_pdma_recv(void __iomem *io, unsigned char *start, int n)
++{
++	unsigned char *addr = start;
++	int result = 0;
++
++	if (n >= 1) {
++		MOVE_BYTE("%3@,%0@");
++		if (result)
++			goto out;
++	}
++	if (n >= 1 && ((unsigned long)addr & 1)) {
++		MOVE_BYTE("%3@,%0@");
++		if (result)
++			goto out;
++	}
++	while (n >= 32)
++		MOVE_16_WORDS("%3@,%0@+");
++	while (n >= 2)
++		MOVE_WORD("%3@,%0@+");
++	if (result)
++		return start - addr; /* Negated to indicate uncertain length */
++	if (n == 1)
++		MOVE_BYTE("%3@,%0@");
++out:
++	return addr - start;
++}
++
++static inline int mac_pdma_send(unsigned char *start, void __iomem *io, int n)
++{
++	unsigned char *addr = start;
++	int result = 0;
++
++	if (n >= 1) {
++		MOVE_BYTE("%0@,%3@");
++		if (result)
++			goto out;
++	}
++	if (n >= 1 && ((unsigned long)addr & 1)) {
++		MOVE_BYTE("%0@,%3@");
++		if (result)
++			goto out;
++	}
++	while (n >= 32)
++		MOVE_16_WORDS("%0@+,%3@");
++	while (n >= 2)
++		MOVE_WORD("%0@+,%3@");
++	if (result)
++		return start - addr; /* Negated to indicate uncertain length */
++	if (n == 1)
++		MOVE_BYTE("%0@,%3@");
++out:
++	return addr - start;
++}
+ 
+ static inline int macscsi_pread(struct NCR5380_hostdata *hostdata,
+                                 unsigned char *dst, int len)
+ {
+ 	u8 __iomem *s = hostdata->pdma_io + (INPUT_DATA_REG << 4);
+ 	unsigned char *d = dst;
+-	int n = len;
+-	int transferred;
++
++	hostdata->pdma_residual = len;
+ 
+ 	while (!NCR5380_poll_politely(hostdata, BUS_AND_STATUS_REG,
+ 	                              BASR_DRQ | BASR_PHASE_MATCH,
+ 	                              BASR_DRQ | BASR_PHASE_MATCH, HZ / 64)) {
+-		CP_IO_TO_MEM(s, d, n);
++		int bytes;
+ 
+-		transferred = d - dst - n;
+-		hostdata->pdma_residual = len - transferred;
++		bytes = mac_pdma_recv(s, d, min(hostdata->pdma_residual, 512));
+ 
+-		/* No bus error. */
+-		if (n == 0)
++		if (bytes > 0) {
++			d += bytes;
++			hostdata->pdma_residual -= bytes;
++		}
++
++		if (hostdata->pdma_residual == 0)
+ 			return 0;
+ 
+-		/* Target changed phase early? */
+ 		if (NCR5380_poll_politely2(hostdata, STATUS_REG, SR_REQ, SR_REQ,
+-		                           BUS_AND_STATUS_REG, BASR_ACK, BASR_ACK, HZ / 64) < 0)
+-			scmd_printk(KERN_ERR, hostdata->connected,
++		                           BUS_AND_STATUS_REG, BASR_ACK,
++		                           BASR_ACK, HZ / 64) < 0)
++			scmd_printk(KERN_DEBUG, hostdata->connected,
+ 			            "%s: !REQ and !ACK\n", __func__);
+ 		if (!(NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH))
+ 			return 0;
+ 
++		if (bytes == 0)
++			udelay(MAC_PDMA_DELAY);
++
++		if (bytes >= 0)
++			continue;
++
+ 		dsprintk(NDEBUG_PSEUDO_DMA, hostdata->host,
+-		         "%s: bus error (%d/%d)\n", __func__, transferred, len);
++		         "%s: bus error (%d/%d)\n", __func__, d - dst, len);
+ 		NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
+-		d = dst + transferred;
+-		n = len - transferred;
++		return -1;
+ 	}
+ 
+ 	scmd_printk(KERN_ERR, hostdata->connected,
+@@ -192,93 +311,27 @@ static inline int macscsi_pread(struct NCR5380_hostdata *hostdata,
+ 	return -1;
+ }
+ 
+-
+-#define CP_MEM_TO_IO(s,d,n)				\
+-__asm__ __volatile__					\
+-    ("    cmp.w  #4,%2\n"				\
+-     "    bls    8f\n"					\
+-     "    move.w %0,%%d0\n"				\
+-     "    neg.b  %%d0\n"				\
+-     "    and.w  #3,%%d0\n"				\
+-     "    sub.w  %%d0,%2\n"				\
+-     "    bra    2f\n"					\
+-     " 1: move.b (%0)+,(%1)\n"				\
+-     " 2: dbf    %%d0,1b\n"				\
+-     "    move.w %2,%%d0\n"				\
+-     "    lsr.w  #5,%%d0\n"				\
+-     "    bra    4f\n"					\
+-     " 3: move.l (%0)+,(%1)\n"				\
+-     "31: move.l (%0)+,(%1)\n"				\
+-     "32: move.l (%0)+,(%1)\n"				\
+-     "33: move.l (%0)+,(%1)\n"				\
+-     "34: move.l (%0)+,(%1)\n"				\
+-     "35: move.l (%0)+,(%1)\n"				\
+-     "36: move.l (%0)+,(%1)\n"				\
+-     "37: move.l (%0)+,(%1)\n"				\
+-     " 4: dbf    %%d0,3b\n"				\
+-     "    move.w %2,%%d0\n"				\
+-     "    lsr.w  #2,%%d0\n"				\
+-     "    and.w  #7,%%d0\n"				\
+-     "    bra    6f\n"					\
+-     " 5: move.l (%0)+,(%1)\n"				\
+-     " 6: dbf    %%d0,5b\n"				\
+-     "    and.w  #3,%2\n"				\
+-     "    bra    8f\n"					\
+-     " 7: move.b (%0)+,(%1)\n"				\
+-     " 8: dbf    %2,7b\n"				\
+-     "    moveq.l #0, %2\n"				\
+-     " 9: \n"						\
+-     ".section .fixup,\"ax\"\n"				\
+-     "    .even\n"					\
+-     "91: moveq.l #1, %2\n"				\
+-     "    jra 9b\n"					\
+-     "94: moveq.l #4, %2\n"				\
+-     "    jra 9b\n"					\
+-     ".previous\n"					\
+-     ".section __ex_table,\"a\"\n"			\
+-     "   .align 4\n"					\
+-     "   .long  1b,91b\n"				\
+-     "   .long  3b,94b\n"				\
+-     "   .long 31b,94b\n"				\
+-     "   .long 32b,94b\n"				\
+-     "   .long 33b,94b\n"				\
+-     "   .long 34b,94b\n"				\
+-     "   .long 35b,94b\n"				\
+-     "   .long 36b,94b\n"				\
+-     "   .long 37b,94b\n"				\
+-     "   .long  5b,94b\n"				\
+-     "   .long  7b,91b\n"				\
+-     ".previous"					\
+-     : "=a"(s), "=a"(d), "=d"(n)			\
+-     : "0"(s), "1"(d), "2"(n)				\
+-     : "d0")
+-
+ static inline int macscsi_pwrite(struct NCR5380_hostdata *hostdata,
+                                  unsigned char *src, int len)
+ {
+ 	unsigned char *s = src;
+ 	u8 __iomem *d = hostdata->pdma_io + (OUTPUT_DATA_REG << 4);
+-	int n = len;
+-	int transferred;
++
++	hostdata->pdma_residual = len;
+ 
+ 	while (!NCR5380_poll_politely(hostdata, BUS_AND_STATUS_REG,
+ 	                              BASR_DRQ | BASR_PHASE_MATCH,
+ 	                              BASR_DRQ | BASR_PHASE_MATCH, HZ / 64)) {
+-		CP_MEM_TO_IO(s, d, n);
++		int bytes;
+ 
+-		transferred = s - src - n;
+-		hostdata->pdma_residual = len - transferred;
++		bytes = mac_pdma_send(s, d, min(hostdata->pdma_residual, 512));
+ 
+-		/* Target changed phase early? */
+-		if (NCR5380_poll_politely2(hostdata, STATUS_REG, SR_REQ, SR_REQ,
+-		                           BUS_AND_STATUS_REG, BASR_ACK, BASR_ACK, HZ / 64) < 0)
+-			scmd_printk(KERN_ERR, hostdata->connected,
+-			            "%s: !REQ and !ACK\n", __func__);
+-		if (!(NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH))
+-			return 0;
++		if (bytes > 0) {
++			s += bytes;
++			hostdata->pdma_residual -= bytes;
++		}
+ 
+-		/* No bus error. */
+-		if (n == 0) {
++		if (hostdata->pdma_residual == 0) {
+ 			if (NCR5380_poll_politely(hostdata, TARGET_COMMAND_REG,
+ 			                          TCR_LAST_BYTE_SENT,
+ 			                          TCR_LAST_BYTE_SENT, HZ / 64) < 0)
+@@ -287,17 +340,29 @@ static inline int macscsi_pwrite(struct NCR5380_hostdata *hostdata,
+ 			return 0;
+ 		}
+ 
++		if (NCR5380_poll_politely2(hostdata, STATUS_REG, SR_REQ, SR_REQ,
++		                           BUS_AND_STATUS_REG, BASR_ACK,
++		                           BASR_ACK, HZ / 64) < 0)
++			scmd_printk(KERN_DEBUG, hostdata->connected,
++			            "%s: !REQ and !ACK\n", __func__);
++		if (!(NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH))
++			return 0;
++
++		if (bytes == 0)
++			udelay(MAC_PDMA_DELAY);
++
++		if (bytes >= 0)
++			continue;
++
+ 		dsprintk(NDEBUG_PSEUDO_DMA, hostdata->host,
+-		         "%s: bus error (%d/%d)\n", __func__, transferred, len);
++		         "%s: bus error (%d/%d)\n", __func__, s - src, len);
+ 		NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
+-		s = src + transferred;
+-		n = len - transferred;
++		return -1;
+ 	}
+ 
+ 	scmd_printk(KERN_ERR, hostdata->connected,
+ 	            "%s: phase mismatch or !DRQ\n", __func__);
+ 	NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
+-
+ 	return -1;
+ }
+ 
+@@ -305,7 +370,7 @@ static int macscsi_dma_xfer_len(struct NCR5380_hostdata *hostdata,
+                                 struct scsi_cmnd *cmd)
+ {
+ 	if (hostdata->flags & FLAG_NO_PSEUDO_DMA ||
+-	    cmd->SCp.this_residual < 16)
++	    cmd->SCp.this_residual < setup_use_pdma)
+ 		return 0;
+ 
+ 	return cmd->SCp.this_residual;
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 7f1ecd264652..73acd3e9ded7 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -5806,7 +5806,8 @@ megasas_get_target_prop(struct megasas_instance *instance,
+ 	int ret;
+ 	struct megasas_cmd *cmd;
+ 	struct megasas_dcmd_frame *dcmd;
+-	u16 targetId = (sdev->channel % 2) + sdev->id;
++	u16 targetId = ((sdev->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) +
++			sdev->id;
+ 
+ 	cmd = megasas_get_cmd(instance);
+ 
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index c89f0e129f58..efb8af57dd9c 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -71,11 +71,11 @@ int scsi_init_sense_cache(struct Scsi_Host *shost)
+ 	struct kmem_cache *cache;
+ 	int ret = 0;
+ 
++	mutex_lock(&scsi_sense_cache_mutex);
+ 	cache = scsi_select_sense_cache(shost->unchecked_isa_dma);
+ 	if (cache)
+-		return 0;
++		goto exit;
+ 
+-	mutex_lock(&scsi_sense_cache_mutex);
+ 	if (shost->unchecked_isa_dma) {
+ 		scsi_sense_isadma_cache =
+ 			kmem_cache_create("scsi_sense_cache(DMA)",
+@@ -90,7 +90,7 @@ int scsi_init_sense_cache(struct Scsi_Host *shost)
+ 		if (!scsi_sense_cache)
+ 			ret = -ENOMEM;
+ 	}
+-
++ exit:
+ 	mutex_unlock(&scsi_sense_cache_mutex);
+ 	return ret;
+ }
+diff --git a/drivers/staging/media/davinci_vpfe/vpfe_video.c b/drivers/staging/media/davinci_vpfe/vpfe_video.c
+index 155e8c758e4b..346e60d230f3 100644
+--- a/drivers/staging/media/davinci_vpfe/vpfe_video.c
++++ b/drivers/staging/media/davinci_vpfe/vpfe_video.c
+@@ -422,6 +422,9 @@ static int vpfe_open(struct file *file)
+ 	/* If decoder is not initialized. initialize it */
+ 	if (!video->initialized && vpfe_update_pipe_state(video)) {
+ 		mutex_unlock(&video->lock);
++		v4l2_fh_del(&handle->vfh);
++		v4l2_fh_exit(&handle->vfh);
++		kfree(handle);
+ 		return -ENODEV;
+ 	}
+ 	/* Increment device users counter */
+diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
+index 4e680d753941..e2fa3a3bc81d 100644
+--- a/drivers/target/iscsi/iscsi_target_auth.c
++++ b/drivers/target/iscsi/iscsi_target_auth.c
+@@ -89,6 +89,12 @@ out:
+ 	return CHAP_DIGEST_UNKNOWN;
+ }
+ 
++static void chap_close(struct iscsi_conn *conn)
++{
++	kfree(conn->auth_protocol);
++	conn->auth_protocol = NULL;
++}
++
+ static struct iscsi_chap *chap_server_open(
+ 	struct iscsi_conn *conn,
+ 	struct iscsi_node_auth *auth,
+@@ -126,7 +132,7 @@ static struct iscsi_chap *chap_server_open(
+ 	case CHAP_DIGEST_UNKNOWN:
+ 	default:
+ 		pr_err("Unsupported CHAP_A value\n");
+-		kfree(conn->auth_protocol);
++		chap_close(conn);
+ 		return NULL;
+ 	}
+ 
+@@ -141,19 +147,13 @@ static struct iscsi_chap *chap_server_open(
+ 	 * Generate Challenge.
+ 	 */
+ 	if (chap_gen_challenge(conn, 1, aic_str, aic_len) < 0) {
+-		kfree(conn->auth_protocol);
++		chap_close(conn);
+ 		return NULL;
+ 	}
+ 
+ 	return chap;
+ }
+ 
+-static void chap_close(struct iscsi_conn *conn)
+-{
+-	kfree(conn->auth_protocol);
+-	conn->auth_protocol = NULL;
+-}
+-
+ static int chap_server_compute_md5(
+ 	struct iscsi_conn *conn,
+ 	struct iscsi_node_auth *auth,
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index ab0796d14ac1..a73d2bc4b685 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1878,7 +1878,8 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ 			status = serial8250_rx_chars(up, status);
+ 	}
+ 	serial8250_modem_status(up);
+-	if ((!up->dma || up->dma->tx_err) && (status & UART_LSR_THRE))
++	if ((!up->dma || up->dma->tx_err) && (status & UART_LSR_THRE) &&
++		(up->ier & UART_IER_THRI))
+ 		serial8250_tx_chars(up);
+ 
+ 	spin_unlock_irqrestore(&port->lock, flags);
+diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+index 8b2b694334ec..8f5a5a16cb3b 100644
+--- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c
++++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+@@ -421,7 +421,16 @@ static int cpm_uart_startup(struct uart_port *port)
+ 			clrbits16(&pinfo->sccp->scc_sccm, UART_SCCM_RX);
+ 		}
+ 		cpm_uart_initbd(pinfo);
+-		cpm_line_cr_cmd(pinfo, CPM_CR_INIT_TRX);
++		if (IS_SMC(pinfo)) {
++			out_be32(&pinfo->smcup->smc_rstate, 0);
++			out_be32(&pinfo->smcup->smc_tstate, 0);
++			out_be16(&pinfo->smcup->smc_rbptr,
++				 in_be16(&pinfo->smcup->smc_rbase));
++			out_be16(&pinfo->smcup->smc_tbptr,
++				 in_be16(&pinfo->smcup->smc_tbase));
++		} else {
++			cpm_line_cr_cmd(pinfo, CPM_CR_INIT_TRX);
++		}
+ 	}
+ 	/* Install interrupt handler. */
+ 	retval = request_irq(port->irq, cpm_uart_int, 0, "cpm_uart", port);
+@@ -875,16 +884,14 @@ static void cpm_uart_init_smc(struct uart_cpm_port *pinfo)
+ 	         (u8 __iomem *)pinfo->tx_bd_base - DPRAM_BASE);
+ 
+ /*
+- *  In case SMC1 is being relocated...
++ *  In case SMC is being relocated...
+  */
+-#if defined (CONFIG_I2C_SPI_SMC1_UCODE_PATCH)
+ 	out_be16(&up->smc_rbptr, in_be16(&pinfo->smcup->smc_rbase));
+ 	out_be16(&up->smc_tbptr, in_be16(&pinfo->smcup->smc_tbase));
+ 	out_be32(&up->smc_rstate, 0);
+ 	out_be32(&up->smc_tstate, 0);
+ 	out_be16(&up->smc_brkcr, 1);              /* number of break chars */
+ 	out_be16(&up->smc_brkec, 0);
+-#endif
+ 
+ 	/* Set up the uart parameters in the
+ 	 * parameter ram.
+@@ -898,8 +905,6 @@ static void cpm_uart_init_smc(struct uart_cpm_port *pinfo)
+ 	out_be16(&up->smc_brkec, 0);
+ 	out_be16(&up->smc_brkcr, 1);
+ 
+-	cpm_line_cr_cmd(pinfo, CPM_CR_INIT_TRX);
+-
+ 	/* Set UART mode, 8 bit, no parity, one stop.
+ 	 * Enable receive and transmit.
+ 	 */
+diff --git a/drivers/tty/serial/digicolor-usart.c b/drivers/tty/serial/digicolor-usart.c
+index 02ad6953b167..50ec5f1ac77f 100644
+--- a/drivers/tty/serial/digicolor-usart.c
++++ b/drivers/tty/serial/digicolor-usart.c
+@@ -545,7 +545,11 @@ static int __init digicolor_uart_init(void)
+ 	if (ret)
+ 		return ret;
+ 
+-	return platform_driver_register(&digicolor_uart_platform);
++	ret = platform_driver_register(&digicolor_uart_platform);
++	if (ret)
++		uart_unregister_driver(&digicolor_uart);
++
++	return ret;
+ }
+ module_init(digicolor_uart_init);
+ 
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index 1a98b6631e90..0969a0d97b2b 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -494,37 +494,48 @@ static bool max310x_reg_precious(struct device *dev, unsigned int reg)
+ 
+ static int max310x_set_baud(struct uart_port *port, int baud)
+ {
+-	unsigned int mode = 0, clk = port->uartclk, div = clk / baud;
++	unsigned int mode = 0, div = 0, frac = 0, c = 0, F = 0;
+ 
+-	/* Check for minimal value for divider */
+-	if (div < 16)
+-		div = 16;
+-
+-	if (clk % baud && (div / 16) < 0x8000) {
++	/*
++	 * Calculate the integer divisor first. Select a proper mode
++	 * in case if the requested baud is too high for the pre-defined
++	 * clocks frequency.
++	 */
++	div = port->uartclk / baud;
++	if (div < 8) {
++		/* Mode x4 */
++		c = 4;
++		mode = MAX310X_BRGCFG_4XMODE_BIT;
++	} else if (div < 16) {
+ 		/* Mode x2 */
++		c = 8;
+ 		mode = MAX310X_BRGCFG_2XMODE_BIT;
+-		clk = port->uartclk * 2;
+-		div = clk / baud;
+-
+-		if (clk % baud && (div / 16) < 0x8000) {
+-			/* Mode x4 */
+-			mode = MAX310X_BRGCFG_4XMODE_BIT;
+-			clk = port->uartclk * 4;
+-			div = clk / baud;
+-		}
++	} else {
++		c = 16;
+ 	}
+ 
+-	max310x_port_write(port, MAX310X_BRGDIVMSB_REG, (div / 16) >> 8);
+-	max310x_port_write(port, MAX310X_BRGDIVLSB_REG, div / 16);
+-	max310x_port_write(port, MAX310X_BRGCFG_REG, (div % 16) | mode);
++	/* Calculate the divisor in accordance with the fraction coefficient */
++	div /= c;
++	F = c*baud;
++
++	/* Calculate the baud rate fraction */
++	if (div > 0)
++		frac = (16*(port->uartclk % F)) / F;
++	else
++		div = 1;
++
++	max310x_port_write(port, MAX310X_BRGDIVMSB_REG, div >> 8);
++	max310x_port_write(port, MAX310X_BRGDIVLSB_REG, div);
++	max310x_port_write(port, MAX310X_BRGCFG_REG, frac | mode);
+ 
+-	return DIV_ROUND_CLOSEST(clk, div);
++	/* Return the actual baud rate we just programmed */
++	return (16*port->uartclk) / (c*(16*div + frac));
+ }
+ 
+ static int max310x_update_best_err(unsigned long f, long *besterr)
+ {
+ 	/* Use baudrate 115200 for calculate error */
+-	long err = f % (115200 * 16);
++	long err = f % (460800 * 16);
+ 
+ 	if ((*besterr < 0) || (*besterr > err)) {
+ 		*besterr = err;
+diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
+index 716aa76abdf9..0e0ccc132ab0 100644
+--- a/drivers/tty/serial/msm_serial.c
++++ b/drivers/tty/serial/msm_serial.c
+@@ -391,10 +391,14 @@ no_rx:
+ 
+ static inline void msm_wait_for_xmitr(struct uart_port *port)
+ {
++	unsigned int timeout = 500000;
++
+ 	while (!(msm_read(port, UART_SR) & UART_SR_TX_EMPTY)) {
+ 		if (msm_read(port, UART_ISR) & UART_ISR_TX_READY)
+ 			break;
+ 		udelay(1);
++		if (!timeout--)
++			break;
+ 	}
+ 	msm_write(port, UART_CR_CMD_RESET_TX_READY, UART_CR);
+ }
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index c39246b916af..17e2311f7b00 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1742,6 +1742,7 @@ static int uart_port_activate(struct tty_port *port, struct tty_struct *tty)
+ {
+ 	struct uart_state *state = container_of(port, struct uart_state, port);
+ 	struct uart_port *uport;
++	int ret;
+ 
+ 	uport = uart_port_check(state);
+ 	if (!uport || uport->flags & UPF_DEAD)
+@@ -1752,7 +1753,11 @@ static int uart_port_activate(struct tty_port *port, struct tty_struct *tty)
+ 	/*
+ 	 * Start up the serial port.
+ 	 */
+-	return uart_startup(tty, state, 0);
++	ret = uart_startup(tty, state, 0);
++	if (ret > 0)
++		tty_port_set_active(port, 1);
++
++	return ret;
+ }
+ 
+ static const char *uart_type(struct uart_port *port)
+diff --git a/drivers/tty/serial/serial_mctrl_gpio.c b/drivers/tty/serial/serial_mctrl_gpio.c
+index d2da6aa7f27d..42e42e3e7a6e 100644
+--- a/drivers/tty/serial/serial_mctrl_gpio.c
++++ b/drivers/tty/serial/serial_mctrl_gpio.c
+@@ -21,6 +21,7 @@
+ #include <linux/termios.h>
+ #include <linux/serial_core.h>
+ #include <linux/module.h>
++#include <linux/property.h>
+ 
+ #include "serial_mctrl_gpio.h"
+ 
+@@ -124,6 +125,19 @@ struct mctrl_gpios *mctrl_gpio_init_noauto(struct device *dev, unsigned int idx)
+ 
+ 	for (i = 0; i < UART_GPIO_MAX; i++) {
+ 		enum gpiod_flags flags;
++		char *gpio_str;
++		bool present;
++
++		/* Check if GPIO property exists and continue if not */
++		gpio_str = kasprintf(GFP_KERNEL, "%s-gpios",
++				     mctrl_gpios_desc[i].name);
++		if (!gpio_str)
++			continue;
++
++		present = device_property_present(dev, gpio_str);
++		kfree(gpio_str);
++		if (!present)
++			continue;
+ 
+ 		if (mctrl_gpios_desc[i].dir_out)
+ 			flags = GPIOD_OUT_LOW;
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 66c8bbea06c4..333de7d3fe86 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1319,6 +1319,7 @@ static void work_fn_tx(struct work_struct *work)
+ 	struct uart_port *port = &s->port;
+ 	struct circ_buf *xmit = &port->state->xmit;
+ 	dma_addr_t buf;
++	int head, tail;
+ 
+ 	/*
+ 	 * DMA is idle now.
+@@ -1328,16 +1329,23 @@ static void work_fn_tx(struct work_struct *work)
+ 	 * consistent xmit buffer state.
+ 	 */
+ 	spin_lock_irq(&port->lock);
+-	buf = s->tx_dma_addr + (xmit->tail & (UART_XMIT_SIZE - 1));
++	head = xmit->head;
++	tail = xmit->tail;
++	buf = s->tx_dma_addr + (tail & (UART_XMIT_SIZE - 1));
+ 	s->tx_dma_len = min_t(unsigned int,
+-		CIRC_CNT(xmit->head, xmit->tail, UART_XMIT_SIZE),
+-		CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE));
+-	spin_unlock_irq(&port->lock);
++		CIRC_CNT(head, tail, UART_XMIT_SIZE),
++		CIRC_CNT_TO_END(head, tail, UART_XMIT_SIZE));
++	if (!s->tx_dma_len) {
++		/* Transmit buffer has been flushed */
++		spin_unlock_irq(&port->lock);
++		return;
++	}
+ 
+ 	desc = dmaengine_prep_slave_single(chan, buf, s->tx_dma_len,
+ 					   DMA_MEM_TO_DEV,
+ 					   DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ 	if (!desc) {
++		spin_unlock_irq(&port->lock);
+ 		dev_warn(port->dev, "Failed preparing Tx DMA descriptor\n");
+ 		/* switch to PIO */
+ 		sci_tx_dma_release(s, true);
+@@ -1347,20 +1355,20 @@ static void work_fn_tx(struct work_struct *work)
+ 	dma_sync_single_for_device(chan->device->dev, buf, s->tx_dma_len,
+ 				   DMA_TO_DEVICE);
+ 
+-	spin_lock_irq(&port->lock);
+ 	desc->callback = sci_dma_tx_complete;
+ 	desc->callback_param = s;
+-	spin_unlock_irq(&port->lock);
+ 	s->cookie_tx = dmaengine_submit(desc);
+ 	if (dma_submit_error(s->cookie_tx)) {
++		spin_unlock_irq(&port->lock);
+ 		dev_warn(port->dev, "Failed submitting Tx DMA descriptor\n");
+ 		/* switch to PIO */
+ 		sci_tx_dma_release(s, true);
+ 		return;
+ 	}
+ 
++	spin_unlock_irq(&port->lock);
+ 	dev_dbg(port->dev, "%s: %p: %d...%d, cookie %d\n",
+-		__func__, xmit->buf, xmit->tail, xmit->head, s->cookie_tx);
++		__func__, xmit->buf, tail, head, s->cookie_tx);
+ 
+ 	dma_async_issue_pending(chan);
+ }
+@@ -1571,11 +1579,18 @@ static void sci_free_dma(struct uart_port *port)
+ 
+ static void sci_flush_buffer(struct uart_port *port)
+ {
++	struct sci_port *s = to_sci_port(port);
++
+ 	/*
+ 	 * In uart_flush_buffer(), the xmit circular buffer has just been
+-	 * cleared, so we have to reset tx_dma_len accordingly.
++	 * cleared, so we have to reset tx_dma_len accordingly, and stop any
++	 * pending transfers
+ 	 */
+-	to_sci_port(port)->tx_dma_len = 0;
++	s->tx_dma_len = 0;
++	if (s->chan_tx) {
++		dmaengine_terminate_async(s->chan_tx);
++		s->cookie_tx = -EINVAL;
++	}
+ }
+ #else /* !CONFIG_SERIAL_SH_SCI_DMA */
+ static inline void sci_request_dma(struct uart_port *port)
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index eddecaf1f0b2..b543a4730ef2 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3532,6 +3532,7 @@ static int hub_handle_remote_wakeup(struct usb_hub *hub, unsigned int port,
+ 	struct usb_device *hdev;
+ 	struct usb_device *udev;
+ 	int connect_change = 0;
++	u16 link_state;
+ 	int ret;
+ 
+ 	hdev = hub->hdev;
+@@ -3541,9 +3542,11 @@ static int hub_handle_remote_wakeup(struct usb_hub *hub, unsigned int port,
+ 			return 0;
+ 		usb_clear_port_feature(hdev, port, USB_PORT_FEAT_C_SUSPEND);
+ 	} else {
++		link_state = portstatus & USB_PORT_STAT_LINK_STATE;
+ 		if (!udev || udev->state != USB_STATE_SUSPENDED ||
+-				 (portstatus & USB_PORT_STAT_LINK_STATE) !=
+-				 USB_SS_PORT_LS_U0)
++				(link_state != USB_SS_PORT_LS_U0 &&
++				 link_state != USB_SS_PORT_LS_U1 &&
++				 link_state != USB_SS_PORT_LS_U2))
+ 			return 0;
+ 	}
+ 
+@@ -3873,6 +3876,9 @@ static int usb_set_lpm_timeout(struct usb_device *udev,
+  * control transfers to set the hub timeout or enable device-initiated U1/U2
+  * will be successful.
+  *
++ * If the control transfer to enable device-initiated U1/U2 entry fails, then
++ * hub-initiated U1/U2 will be disabled.
++ *
+  * If we cannot set the parent hub U1/U2 timeout, we attempt to let the xHCI
+  * driver know about it.  If that call fails, it should be harmless, and just
+  * take up more slightly more bus bandwidth for unnecessary U1/U2 exit latency.
+@@ -3927,23 +3933,24 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev,
+ 		 * host know that this link state won't be enabled.
+ 		 */
+ 		hcd->driver->disable_usb3_lpm_timeout(hcd, udev, state);
+-	} else {
+-		/* Only a configured device will accept the Set Feature
+-		 * U1/U2_ENABLE
+-		 */
+-		if (udev->actconfig)
+-			usb_set_device_initiated_lpm(udev, state, true);
++		return;
++	}
+ 
+-		/* As soon as usb_set_lpm_timeout(timeout) returns 0, the
+-		 * hub-initiated LPM is enabled. Thus, LPM is enabled no
+-		 * matter the result of usb_set_device_initiated_lpm().
+-		 * The only difference is whether device is able to initiate
+-		 * LPM.
+-		 */
++	/* Only a configured device will accept the Set Feature
++	 * U1/U2_ENABLE
++	 */
++	if (udev->actconfig &&
++	    usb_set_device_initiated_lpm(udev, state, true) == 0) {
+ 		if (state == USB3_LPM_U1)
+ 			udev->usb3_lpm_u1_enabled = 1;
+ 		else if (state == USB3_LPM_U2)
+ 			udev->usb3_lpm_u2_enabled = 1;
++	} else {
++		/* Don't request U1/U2 entry if the device
++		 * cannot transition to U1/U2.
++		 */
++		usb_set_lpm_timeout(udev, state, 0);
++		hcd->driver->disable_usb3_lpm_timeout(hcd, udev, state);
+ 	}
+ }
+ 
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 79900c0b4f3a..cdffbe999500 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1102,11 +1102,12 @@ static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
+ 	ENTER();
+ 
+ 	if (!is_sync_kiocb(kiocb)) {
+-		p = kmalloc(sizeof(io_data), GFP_KERNEL);
++		p = kzalloc(sizeof(io_data), GFP_KERNEL);
+ 		if (unlikely(!p))
+ 			return -ENOMEM;
+ 		p->aio = true;
+ 	} else {
++		memset(p, 0, sizeof(*p));
+ 		p->aio = false;
+ 	}
+ 
+@@ -1138,11 +1139,12 @@ static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
+ 	ENTER();
+ 
+ 	if (!is_sync_kiocb(kiocb)) {
+-		p = kmalloc(sizeof(io_data), GFP_KERNEL);
++		p = kzalloc(sizeof(io_data), GFP_KERNEL);
+ 		if (unlikely(!p))
+ 			return -ENOMEM;
+ 		p->aio = true;
+ 	} else {
++		memset(p, 0, sizeof(*p));
+ 		p->aio = false;
+ 	}
+ 
+diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
+index 216069c396a0..aa654b86993d 100644
+--- a/drivers/usb/host/hwa-hc.c
++++ b/drivers/usb/host/hwa-hc.c
+@@ -173,7 +173,7 @@ out:
+ 	return result;
+ 
+ error_set_cluster_id:
+-	wusb_cluster_id_put(wusbhc->cluster_id);
++	wusb_cluster_id_put(addr);
+ error_cluster_id_get:
+ 	goto out;
+ 
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index e1faee1f8602..f5f2c83a2c66 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -204,7 +204,7 @@ int usb_amd_find_chipset_info(void)
+ {
+ 	unsigned long flags;
+ 	struct amd_chipset_info info;
+-	int ret;
++	int need_pll_quirk = 0;
+ 
+ 	spin_lock_irqsave(&amd_lock, flags);
+ 
+@@ -218,21 +218,28 @@ int usb_amd_find_chipset_info(void)
+ 	spin_unlock_irqrestore(&amd_lock, flags);
+ 
+ 	if (!amd_chipset_sb_type_init(&info)) {
+-		ret = 0;
+ 		goto commit;
+ 	}
+ 
+-	/* Below chipset generations needn't enable AMD PLL quirk */
+-	if (info.sb_type.gen == AMD_CHIPSET_UNKNOWN ||
+-			info.sb_type.gen == AMD_CHIPSET_SB600 ||
+-			info.sb_type.gen == AMD_CHIPSET_YANGTZE ||
+-			(info.sb_type.gen == AMD_CHIPSET_SB700 &&
+-			info.sb_type.rev > 0x3b)) {
++	switch (info.sb_type.gen) {
++	case AMD_CHIPSET_SB700:
++		need_pll_quirk = info.sb_type.rev <= 0x3B;
++		break;
++	case AMD_CHIPSET_SB800:
++	case AMD_CHIPSET_HUDSON2:
++	case AMD_CHIPSET_BOLTON:
++		need_pll_quirk = 1;
++		break;
++	default:
++		need_pll_quirk = 0;
++		break;
++	}
++
++	if (!need_pll_quirk) {
+ 		if (info.smbus_dev) {
+ 			pci_dev_put(info.smbus_dev);
+ 			info.smbus_dev = NULL;
+ 		}
+-		ret = 0;
+ 		goto commit;
+ 	}
+ 
+@@ -251,7 +258,7 @@ int usb_amd_find_chipset_info(void)
+ 		}
+ 	}
+ 
+-	ret = info.probe_result = 1;
++	need_pll_quirk = info.probe_result = 1;
+ 	printk(KERN_DEBUG "QUIRK: Enable AMD PLL fix\n");
+ 
+ commit:
+@@ -262,7 +269,7 @@ commit:
+ 
+ 		/* Mark that we where here */
+ 		amd_chipset.probe_count++;
+-		ret = amd_chipset.probe_result;
++		need_pll_quirk = amd_chipset.probe_result;
+ 
+ 		spin_unlock_irqrestore(&amd_lock, flags);
+ 
+@@ -276,7 +283,7 @@ commit:
+ 		spin_unlock_irqrestore(&amd_lock, flags);
+ 	}
+ 
+-	return ret;
++	return need_pll_quirk;
+ }
+ EXPORT_SYMBOL_GPL(usb_amd_find_chipset_info);
+ 
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index b40e8ded49c6..4d11152e60c1 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -35,7 +35,7 @@
+ 
+ #include "vhost.h"
+ 
+-static int experimental_zcopytx = 1;
++static int experimental_zcopytx = 0;
+ module_param(experimental_zcopytx, int, 0444);
+ MODULE_PARM_DESC(experimental_zcopytx, "Enable Zero Copy TX;"
+ 		                       " 1 -Enable; 0 - Disable");
+diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
+index f77e499afddd..7d521babc020 100644
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -590,8 +590,15 @@ static void balloon_process(struct work_struct *work)
+ 				state = reserve_additional_memory();
+ 		}
+ 
+-		if (credit < 0)
+-			state = decrease_reservation(-credit, GFP_BALLOON);
++		if (credit < 0) {
++			long n_pages;
++
++			n_pages = min(-credit, si_mem_available());
++			state = decrease_reservation(n_pages, GFP_BALLOON);
++			if (state == BP_DONE && n_pages != -credit &&
++			    n_pages < totalreserve_pages)
++				state = BP_EAGAIN;
++		}
+ 
+ 		state = update_schedule(state);
+ 
+@@ -630,6 +637,9 @@ static int add_ballooned_pages(int nr_pages)
+ 		}
+ 	}
+ 
++	if (si_mem_available() < nr_pages)
++		return -ENOMEM;
++
+ 	st = decrease_reservation(nr_pages, GFP_USER);
+ 	if (st != BP_DONE)
+ 		return -ENOMEM;
+@@ -759,7 +769,7 @@ static int __init balloon_init(void)
+ 	balloon_stats.schedule_delay = 1;
+ 	balloon_stats.max_schedule_delay = 32;
+ 	balloon_stats.retry_count = 1;
+-	balloon_stats.max_retry_count = RETRY_UNLIMITED;
++	balloon_stats.max_retry_count = 4;
+ 
+ #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+ 	set_online_page_callback(&xen_online_page);
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index fe1f16351f94..8d49b91d92cd 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -1293,7 +1293,7 @@ void rebind_evtchn_irq(int evtchn, int irq)
+ }
+ 
+ /* Rebind an evtchn so that it gets delivered to a specific cpu */
+-int xen_rebind_evtchn_to_cpu(int evtchn, unsigned tcpu)
++static int xen_rebind_evtchn_to_cpu(int evtchn, unsigned int tcpu)
+ {
+ 	struct evtchn_bind_vcpu bind_vcpu;
+ 	int masked;
+@@ -1327,7 +1327,6 @@ int xen_rebind_evtchn_to_cpu(int evtchn, unsigned tcpu)
+ 
+ 	return 0;
+ }
+-EXPORT_SYMBOL_GPL(xen_rebind_evtchn_to_cpu);
+ 
+ static int set_affinity_irq(struct irq_data *data, const struct cpumask *dest,
+ 			    bool force)
+@@ -1341,6 +1340,15 @@ static int set_affinity_irq(struct irq_data *data, const struct cpumask *dest,
+ 	return ret;
+ }
+ 
++/* To be called with desc->lock held. */
++int xen_set_affinity_evtchn(struct irq_desc *desc, unsigned int tcpu)
++{
++	struct irq_data *d = irq_desc_get_irq_data(desc);
++
++	return set_affinity_irq(d, cpumask_of(tcpu), false);
++}
++EXPORT_SYMBOL_GPL(xen_set_affinity_evtchn);
++
+ static void enable_dynirq(struct irq_data *data)
+ {
+ 	int evtchn = evtchn_from_irq(data->irq);
+diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
+index 9729a64ea1a9..055123f48039 100644
+--- a/drivers/xen/evtchn.c
++++ b/drivers/xen/evtchn.c
+@@ -447,7 +447,7 @@ static void evtchn_bind_interdom_next_vcpu(int evtchn)
+ 	this_cpu_write(bind_last_selected_cpu, selected_cpu);
+ 
+ 	/* unmask expects irqs to be disabled */
+-	xen_rebind_evtchn_to_cpu(evtchn, selected_cpu);
++	xen_set_affinity_evtchn(desc, selected_cpu);
+ 	raw_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+ 
+diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
+index e1cbdfdb7c68..197069303510 100644
+--- a/fs/9p/vfs_addr.c
++++ b/fs/9p/vfs_addr.c
+@@ -50,8 +50,9 @@
+  * @page: structure to page
+  *
+  */
+-static int v9fs_fid_readpage(struct p9_fid *fid, struct page *page)
++static int v9fs_fid_readpage(void *data, struct page *page)
+ {
++	struct p9_fid *fid = data;
+ 	struct inode *inode = page->mapping->host;
+ 	struct bio_vec bvec = {.bv_page = page, .bv_len = PAGE_SIZE};
+ 	struct iov_iter to;
+@@ -122,7 +123,8 @@ static int v9fs_vfs_readpages(struct file *filp, struct address_space *mapping,
+ 	if (ret == 0)
+ 		return ret;
+ 
+-	ret = read_cache_pages(mapping, pages, (void *)v9fs_vfs_readpage, filp);
++	ret = read_cache_pages(mapping, pages, v9fs_fid_readpage,
++			filp->private_data);
+ 	p9_debug(P9_DEBUG_VFS, "  = %d\n", ret);
+ 	return ret;
+ }
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 97958ecaeed9..6fbae1357644 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -2784,6 +2784,11 @@ out_only_mutex:
+ 		 * for detecting, at fsync time, if the inode isn't yet in the
+ 		 * log tree or it's there but not up to date.
+ 		 */
++		struct timespec now = current_time(inode);
++
++		inode_inc_iversion(inode);
++		inode->i_mtime = now;
++		inode->i_ctime = now;
+ 		trans = btrfs_start_transaction(root, 1);
+ 		if (IS_ERR(trans)) {
+ 			err = PTR_ERR(trans);
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index ea7b65c025c2..ddc1d1d1a29f 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -405,10 +405,31 @@ static noinline int add_async_extent(struct async_cow *cow,
+ 	return 0;
+ }
+ 
++/*
++ * Check if the inode has flags compatible with compression
++ */
++static inline bool inode_can_compress(struct inode *inode)
++{
++	if (BTRFS_I(inode)->flags & BTRFS_INODE_NODATACOW ||
++	    BTRFS_I(inode)->flags & BTRFS_INODE_NODATASUM)
++		return false;
++	return true;
++}
++
++/*
++ * Check if the inode needs to be submitted to compression, based on mount
++ * options, defragmentation, properties or heuristics.
++ */
+ static inline int inode_need_compress(struct inode *inode, u64 start, u64 end)
+ {
+ 	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+ 
++	if (!inode_can_compress(inode)) {
++		WARN(IS_ENABLED(CONFIG_BTRFS_DEBUG),
++			KERN_ERR "BTRFS: unexpected compression for ino %llu\n",
++			btrfs_ino(BTRFS_I(inode)));
++		return 0;
++	}
+ 	/* force compress */
+ 	if (btrfs_test_opt(fs_info, FORCE_COMPRESS))
+ 		return 1;
+@@ -1626,7 +1647,8 @@ static int run_delalloc_range(void *private_data, struct page *locked_page,
+ 	} else if (BTRFS_I(inode)->flags & BTRFS_INODE_PREALLOC && !force_cow) {
+ 		ret = run_delalloc_nocow(inode, locked_page, start, end,
+ 					 page_started, 0, nr_written);
+-	} else if (!inode_need_compress(inode, start, end)) {
++	} else if (!inode_can_compress(inode) ||
++		   !inode_need_compress(inode, start, end)) {
+ 		ret = cow_file_range(inode, locked_page, start, end, end,
+ 				      page_started, nr_written, 1, NULL);
+ 	} else {
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 8ac6a64d0422..bfd7c89c8d92 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3152,6 +3152,30 @@ int btrfs_free_log_root_tree(struct btrfs_trans_handle *trans,
+ 	return 0;
+ }
+ 
++/*
++ * Check if an inode was logged in the current transaction. We can't always rely
++ * on an inode's logged_trans value, because it's an in-memory only field and
++ * therefore not persisted. This means that its value is lost if the inode gets
++ * evicted and loaded again from disk (in which case it has a value of 0, and
++ * certainly it is smaller then any possible transaction ID), when that happens
++ * the full_sync flag is set in the inode's runtime flags, so on that case we
++ * assume eviction happened and ignore the logged_trans value, assuming the
++ * worst case, that the inode was logged before in the current transaction.
++ */
++static bool inode_logged(struct btrfs_trans_handle *trans,
++			 struct btrfs_inode *inode)
++{
++	if (inode->logged_trans == trans->transid)
++		return true;
++
++	if (inode->last_trans == trans->transid &&
++	    test_bit(BTRFS_INODE_NEEDS_FULL_SYNC, &inode->runtime_flags) &&
++	    !test_bit(BTRFS_FS_LOG_RECOVERING, &trans->fs_info->flags))
++		return true;
++
++	return false;
++}
++
+ /*
+  * If both a file and directory are logged, and unlinks or renames are
+  * mixed in, we have a few interesting corners:
+@@ -3186,7 +3210,7 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
+ 	int bytes_del = 0;
+ 	u64 dir_ino = btrfs_ino(dir);
+ 
+-	if (dir->logged_trans < trans->transid)
++	if (!inode_logged(trans, dir))
+ 		return 0;
+ 
+ 	ret = join_running_log_trans(root);
+@@ -3291,7 +3315,7 @@ int btrfs_del_inode_ref_in_log(struct btrfs_trans_handle *trans,
+ 	u64 index;
+ 	int ret;
+ 
+-	if (inode->logged_trans < trans->transid)
++	if (!inode_logged(trans, inode))
+ 		return 0;
+ 
+ 	ret = join_running_log_trans(root);
+@@ -5266,9 +5290,19 @@ log_extents:
+ 		}
+ 	}
+ 
++	/*
++	 * Don't update last_log_commit if we logged that an inode exists after
++	 * it was loaded to memory (full_sync bit set).
++	 * This is to prevent data loss when we do a write to the inode, then
++	 * the inode gets evicted after all delalloc was flushed, then we log
++	 * it exists (due to a rename for example) and then fsync it. This last
++	 * fsync would do nothing (not logging the extents previously written).
++	 */
+ 	spin_lock(&inode->lock);
+ 	inode->logged_trans = trans->transid;
+-	inode->last_log_commit = inode->last_sub_trans;
++	if (inode_only != LOG_INODE_EXISTS ||
++	    !test_bit(BTRFS_INODE_NEEDS_FULL_SYNC, &inode->runtime_flags))
++		inode->last_log_commit = inode->last_sub_trans;
+ 	spin_unlock(&inode->lock);
+ out_unlock:
+ 	if (unlikely(err))
+diff --git a/fs/coda/file.c b/fs/coda/file.c
+index 1cbc1f2298ee..43d371551d2b 100644
+--- a/fs/coda/file.c
++++ b/fs/coda/file.c
+@@ -27,6 +27,13 @@
+ #include "coda_linux.h"
+ #include "coda_int.h"
+ 
++struct coda_vm_ops {
++	atomic_t refcnt;
++	struct file *coda_file;
++	const struct vm_operations_struct *host_vm_ops;
++	struct vm_operations_struct vm_ops;
++};
++
+ static ssize_t
+ coda_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ {
+@@ -61,6 +68,34 @@ coda_file_write_iter(struct kiocb *iocb, struct iov_iter *to)
+ 	return ret;
+ }
+ 
++static void
++coda_vm_open(struct vm_area_struct *vma)
++{
++	struct coda_vm_ops *cvm_ops =
++		container_of(vma->vm_ops, struct coda_vm_ops, vm_ops);
++
++	atomic_inc(&cvm_ops->refcnt);
++
++	if (cvm_ops->host_vm_ops && cvm_ops->host_vm_ops->open)
++		cvm_ops->host_vm_ops->open(vma);
++}
++
++static void
++coda_vm_close(struct vm_area_struct *vma)
++{
++	struct coda_vm_ops *cvm_ops =
++		container_of(vma->vm_ops, struct coda_vm_ops, vm_ops);
++
++	if (cvm_ops->host_vm_ops && cvm_ops->host_vm_ops->close)
++		cvm_ops->host_vm_ops->close(vma);
++
++	if (atomic_dec_and_test(&cvm_ops->refcnt)) {
++		vma->vm_ops = cvm_ops->host_vm_ops;
++		fput(cvm_ops->coda_file);
++		kfree(cvm_ops);
++	}
++}
++
+ static int
+ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
+ {
+@@ -68,6 +103,8 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
+ 	struct coda_inode_info *cii;
+ 	struct file *host_file;
+ 	struct inode *coda_inode, *host_inode;
++	struct coda_vm_ops *cvm_ops;
++	int ret;
+ 
+ 	cfi = CODA_FTOC(coda_file);
+ 	BUG_ON(!cfi || cfi->cfi_magic != CODA_MAGIC);
+@@ -76,6 +113,13 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
+ 	if (!host_file->f_op->mmap)
+ 		return -ENODEV;
+ 
++	if (WARN_ON(coda_file != vma->vm_file))
++		return -EIO;
++
++	cvm_ops = kmalloc(sizeof(struct coda_vm_ops), GFP_KERNEL);
++	if (!cvm_ops)
++		return -ENOMEM;
++
+ 	coda_inode = file_inode(coda_file);
+ 	host_inode = file_inode(host_file);
+ 
+@@ -89,6 +133,7 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
+ 	 * the container file on us! */
+ 	else if (coda_inode->i_mapping != host_inode->i_mapping) {
+ 		spin_unlock(&cii->c_lock);
++		kfree(cvm_ops);
+ 		return -EBUSY;
+ 	}
+ 
+@@ -97,7 +142,29 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
+ 	cfi->cfi_mapcount++;
+ 	spin_unlock(&cii->c_lock);
+ 
+-	return call_mmap(host_file, vma);
++	vma->vm_file = get_file(host_file);
++	ret = call_mmap(vma->vm_file, vma);
++
++	if (ret) {
++		/* if call_mmap fails, our caller will put coda_file so we
++		 * should drop the reference to the host_file that we got.
++		 */
++		fput(host_file);
++		kfree(cvm_ops);
++	} else {
++		/* here we add redirects for the open/close vm_operations */
++		cvm_ops->host_vm_ops = vma->vm_ops;
++		if (vma->vm_ops)
++			cvm_ops->vm_ops = *vma->vm_ops;
++
++		cvm_ops->vm_ops.open = coda_vm_open;
++		cvm_ops->vm_ops.close = coda_vm_close;
++		cvm_ops->coda_file = coda_file;
++		atomic_set(&cvm_ops->refcnt, 1);
++
++		vma->vm_ops = &cvm_ops->vm_ops;
++	}
++	return ret;
+ }
+ 
+ int coda_open(struct inode *coda_inode, struct file *coda_file)
+@@ -207,4 +274,3 @@ const struct file_operations coda_file_operations = {
+ 	.fsync		= coda_fsync,
+ 	.splice_read	= generic_file_splice_read,
+ };
+-
+diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c
+index daf2683f0655..f862ad19c714 100644
+--- a/fs/crypto/crypto.c
++++ b/fs/crypto/crypto.c
+@@ -157,7 +157,10 @@ int fscrypt_do_page_crypto(const struct inode *inode, fscrypt_direction_t rw,
+ 	struct crypto_skcipher *tfm = ci->ci_ctfm;
+ 	int res = 0;
+ 
+-	BUG_ON(len == 0);
++	if (WARN_ON_ONCE(len <= 0))
++		return -EINVAL;
++	if (WARN_ON_ONCE(len % FS_CRYPTO_BLOCK_SIZE != 0))
++		return -EINVAL;
+ 
+ 	BUILD_BUG_ON(sizeof(iv) != FS_IV_SIZE);
+ 	BUILD_BUG_ON(AES_BLOCK_SIZE != FS_IV_SIZE);
+@@ -257,8 +260,6 @@ struct page *fscrypt_encrypt_page(const struct inode *inode,
+ 	struct page *ciphertext_page = page;
+ 	int err;
+ 
+-	BUG_ON(len % FS_CRYPTO_BLOCK_SIZE != 0);
+-
+ 	if (inode->i_sb->s_cop->flags & FS_CFLG_OWN_PAGES) {
+ 		/* with inplace-encryption we just encrypt the page */
+ 		err = fscrypt_do_page_crypto(inode, FS_ENCRYPT, lblk_num, page,
+@@ -270,7 +271,8 @@ struct page *fscrypt_encrypt_page(const struct inode *inode,
+ 		return ciphertext_page;
+ 	}
+ 
+-	BUG_ON(!PageLocked(page));
++	if (WARN_ON_ONCE(!PageLocked(page)))
++		return ERR_PTR(-EINVAL);
+ 
+ 	ctx = fscrypt_get_ctx(inode, gfp_flags);
+ 	if (IS_ERR(ctx))
+@@ -318,8 +320,9 @@ EXPORT_SYMBOL(fscrypt_encrypt_page);
+ int fscrypt_decrypt_page(const struct inode *inode, struct page *page,
+ 			unsigned int len, unsigned int offs, u64 lblk_num)
+ {
+-	if (!(inode->i_sb->s_cop->flags & FS_CFLG_OWN_PAGES))
+-		BUG_ON(!PageLocked(page));
++	if (WARN_ON_ONCE(!PageLocked(page) &&
++			 !(inode->i_sb->s_cop->flags & FS_CFLG_OWN_PAGES)))
++		return -EINVAL;
+ 
+ 	return fscrypt_do_page_crypto(inode, FS_DECRYPT, lblk_num, page, page,
+ 				      len, offs, GFP_NOFS);
+diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
+index 9d1823efff34..bd25ab837011 100644
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -1034,8 +1034,10 @@ int ecryptfs_read_and_validate_header_region(struct inode *inode)
+ 
+ 	rc = ecryptfs_read_lower(file_size, 0, ECRYPTFS_SIZE_AND_MARKER_BYTES,
+ 				 inode);
+-	if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES)
+-		return rc >= 0 ? -EINVAL : rc;
++	if (rc < 0)
++		return rc;
++	else if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES)
++		return -EINVAL;
+ 	rc = ecryptfs_validate_marker(marker);
+ 	if (!rc)
+ 		ecryptfs_i_size_init(file_size, inode);
+@@ -1397,8 +1399,10 @@ int ecryptfs_read_and_validate_xattr_region(struct dentry *dentry,
+ 				     ecryptfs_inode_to_lower(inode),
+ 				     ECRYPTFS_XATTR_NAME, file_size,
+ 				     ECRYPTFS_SIZE_AND_MARKER_BYTES);
+-	if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES)
+-		return rc >= 0 ? -EINVAL : rc;
++	if (rc < 0)
++		return rc;
++	else if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES)
++		return -EINVAL;
+ 	rc = ecryptfs_validate_marker(marker);
+ 	if (!rc)
+ 		ecryptfs_i_size_init(file_size, inode);
+diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
+index dc676714454a..446b6c375b6f 100644
+--- a/fs/ext4/dir.c
++++ b/fs/ext4/dir.c
+@@ -107,7 +107,6 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
+ 	struct inode *inode = file_inode(file);
+ 	struct super_block *sb = inode->i_sb;
+ 	struct buffer_head *bh = NULL;
+-	int dir_has_error = 0;
+ 	struct fscrypt_str fstr = FSTR_INIT(NULL, 0);
+ 
+ 	if (ext4_encrypted_inode(inode)) {
+@@ -143,8 +142,6 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
+ 			return err;
+ 	}
+ 
+-	offset = ctx->pos & (sb->s_blocksize - 1);
+-
+ 	while (ctx->pos < inode->i_size) {
+ 		struct ext4_map_blocks map;
+ 
+@@ -153,9 +150,18 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
+ 			goto errout;
+ 		}
+ 		cond_resched();
++		offset = ctx->pos & (sb->s_blocksize - 1);
+ 		map.m_lblk = ctx->pos >> EXT4_BLOCK_SIZE_BITS(sb);
+ 		map.m_len = 1;
+ 		err = ext4_map_blocks(NULL, inode, &map, 0);
++		if (err == 0) {
++			/* m_len should never be zero but let's avoid
++			 * an infinite loop if it somehow is */
++			if (map.m_len == 0)
++				map.m_len = 1;
++			ctx->pos += map.m_len * sb->s_blocksize;
++			continue;
++		}
+ 		if (err > 0) {
+ 			pgoff_t index = map.m_pblk >>
+ 					(PAGE_SHIFT - inode->i_blkbits);
+@@ -174,13 +180,6 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
+ 		}
+ 
+ 		if (!bh) {
+-			if (!dir_has_error) {
+-				EXT4_ERROR_FILE(file, 0,
+-						"directory contains a "
+-						"hole at offset %llu",
+-					   (unsigned long long) ctx->pos);
+-				dir_has_error = 1;
+-			}
+ 			/* corrupt size?  Maybe no more blocks to read */
+ 			if (ctx->pos > inode->i_blocks << 9)
+ 				break;
+diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
+index 1437f62d068c..116401578401 100644
+--- a/fs/ext4/ext4_jbd2.h
++++ b/fs/ext4/ext4_jbd2.h
+@@ -364,20 +364,20 @@ static inline int ext4_journal_force_commit(journal_t *journal)
+ }
+ 
+ static inline int ext4_jbd2_inode_add_write(handle_t *handle,
+-					    struct inode *inode)
++		struct inode *inode, loff_t start_byte, loff_t length)
+ {
+ 	if (ext4_handle_valid(handle))
+-		return jbd2_journal_inode_add_write(handle,
+-						    EXT4_I(inode)->jinode);
++		return jbd2_journal_inode_ranged_write(handle,
++				EXT4_I(inode)->jinode, start_byte, length);
+ 	return 0;
+ }
+ 
+ static inline int ext4_jbd2_inode_add_wait(handle_t *handle,
+-					   struct inode *inode)
++		struct inode *inode, loff_t start_byte, loff_t length)
+ {
+ 	if (ext4_handle_valid(handle))
+-		return jbd2_journal_inode_add_wait(handle,
+-						   EXT4_I(inode)->jinode);
++		return jbd2_journal_inode_ranged_wait(handle,
++				EXT4_I(inode)->jinode, start_byte, length);
+ 	return 0;
+ }
+ 
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 44966b272216..4ede0af9d6fe 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -163,6 +163,10 @@ static ssize_t ext4_write_checks(struct kiocb *iocb, struct iov_iter *from)
+ 	ret = generic_write_checks(iocb, from);
+ 	if (ret <= 0)
+ 		return ret;
++
++	if (unlikely(IS_IMMUTABLE(inode)))
++		return -EPERM;
++
+ 	/*
+ 	 * If we have encountered a bitmap-format file, the size limit
+ 	 * is smaller than s_maxbytes, which is for extent-mapped files.
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 862766a1b080..ea85063e5dc2 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -728,10 +728,16 @@ out_sem:
+ 		    !(flags & EXT4_GET_BLOCKS_ZERO) &&
+ 		    !ext4_is_quota_file(inode) &&
+ 		    ext4_should_order_data(inode)) {
++			loff_t start_byte =
++				(loff_t)map->m_lblk << inode->i_blkbits;
++			loff_t length = (loff_t)map->m_len << inode->i_blkbits;
++
+ 			if (flags & EXT4_GET_BLOCKS_IO_SUBMIT)
+-				ret = ext4_jbd2_inode_add_wait(handle, inode);
++				ret = ext4_jbd2_inode_add_wait(handle, inode,
++						start_byte, length);
+ 			else
+-				ret = ext4_jbd2_inode_add_write(handle, inode);
++				ret = ext4_jbd2_inode_add_write(handle, inode,
++						start_byte, length);
+ 			if (ret)
+ 				return ret;
+ 		}
+@@ -4004,7 +4010,8 @@ static int __ext4_block_zero_page_range(handle_t *handle,
+ 		err = 0;
+ 		mark_buffer_dirty(bh);
+ 		if (ext4_should_order_data(inode))
+-			err = ext4_jbd2_inode_add_write(handle, inode);
++			err = ext4_jbd2_inode_add_write(handle, inode, from,
++					length);
+ 	}
+ 
+ unlock:
+@@ -5341,6 +5348,14 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ 	if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb))))
+ 		return -EIO;
+ 
++	if (unlikely(IS_IMMUTABLE(inode)))
++		return -EPERM;
++
++	if (unlikely(IS_APPEND(inode) &&
++		     (ia_valid & (ATTR_MODE | ATTR_UID |
++				  ATTR_GID | ATTR_TIMES_SET))))
++		return -EPERM;
++
+ 	error = setattr_prepare(dentry, attr);
+ 	if (error)
+ 		return error;
+@@ -6045,6 +6060,9 @@ int ext4_page_mkwrite(struct vm_fault *vmf)
+ 	get_block_t *get_block;
+ 	int retries = 0;
+ 
++	if (unlikely(IS_IMMUTABLE(inode)))
++		return VM_FAULT_SIGBUS;
++
+ 	sb_start_pagefault(inode->i_sb);
+ 	file_update_time(vma->vm_file);
+ 
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index d2efc0cb8f31..82e118e9e50b 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -210,6 +210,29 @@ static int uuid_is_zero(__u8 u[16])
+ }
+ #endif
+ 
++/*
++ * If immutable is set and we are not clearing it, we're not allowed to change
++ * anything else in the inode.  Don't error out if we're only trying to set
++ * immutable on an immutable file.
++ */
++static int ext4_ioctl_check_immutable(struct inode *inode, __u32 new_projid,
++				      unsigned int flags)
++{
++	struct ext4_inode_info *ei = EXT4_I(inode);
++	unsigned int oldflags = ei->i_flags;
++
++	if (!(oldflags & EXT4_IMMUTABLE_FL) || !(flags & EXT4_IMMUTABLE_FL))
++		return 0;
++
++	if ((oldflags & ~EXT4_IMMUTABLE_FL) != (flags & ~EXT4_IMMUTABLE_FL))
++		return -EPERM;
++	if (ext4_has_feature_project(inode->i_sb) &&
++	    __kprojid_val(ei->i_projid) != new_projid)
++		return -EPERM;
++
++	return 0;
++}
++
+ static int ext4_ioctl_setflags(struct inode *inode,
+ 			       unsigned int flags)
+ {
+@@ -263,6 +286,20 @@ static int ext4_ioctl_setflags(struct inode *inode,
+ 			goto flags_out;
+ 	}
+ 
++	/*
++	 * Wait for all pending directio and then flush all the dirty pages
++	 * for this file.  The flush marks all the pages readonly, so any
++	 * subsequent attempt to write to the file (particularly mmap pages)
++	 * will come through the filesystem and fail.
++	 */
++	if (S_ISREG(inode->i_mode) && !IS_IMMUTABLE(inode) &&
++	    (flags & EXT4_IMMUTABLE_FL)) {
++		inode_dio_wait(inode);
++		err = filemap_write_and_wait(inode->i_mapping);
++		if (err)
++			goto flags_out;
++	}
++
+ 	handle = ext4_journal_start(inode, EXT4_HT_INODE, 1);
+ 	if (IS_ERR(handle)) {
+ 		err = PTR_ERR(handle);
+@@ -653,7 +690,11 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ 			return err;
+ 
+ 		inode_lock(inode);
+-		err = ext4_ioctl_setflags(inode, flags);
++		err = ext4_ioctl_check_immutable(inode,
++				from_kprojid(&init_user_ns, ei->i_projid),
++				flags);
++		if (!err)
++			err = ext4_ioctl_setflags(inode, flags);
+ 		inode_unlock(inode);
+ 		mnt_drop_write_file(filp);
+ 		return err;
+@@ -1061,6 +1102,9 @@ resizefs_out:
+ 			goto out;
+ 		flags = (ei->i_flags & ~EXT4_FL_XFLAG_VISIBLE) |
+ 			 (flags & EXT4_FL_XFLAG_VISIBLE);
++		err = ext4_ioctl_check_immutable(inode, fa.fsx_projid, flags);
++		if (err)
++			goto out;
+ 		err = ext4_ioctl_setflags(inode, flags);
+ 		if (err)
+ 			goto out;
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index cd8d481e0c48..ef60f2e92da6 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -400,7 +400,8 @@ data_copy:
+ 
+ 	/* Even in case of data=writeback it is reasonable to pin
+ 	 * inode to transaction, to prevent unexpected data loss */
+-	*err = ext4_jbd2_inode_add_write(handle, orig_inode);
++	*err = ext4_jbd2_inode_add_write(handle, orig_inode,
++			(loff_t)orig_page_offset << PAGE_SHIFT, replaced_size);
+ 
+ unlock_pages:
+ 	unlock_page(pagep[0]);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 070660cb5b91..162e853dc5d6 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -80,8 +80,18 @@ static struct buffer_head *ext4_append(handle_t *handle,
+ static int ext4_dx_csum_verify(struct inode *inode,
+ 			       struct ext4_dir_entry *dirent);
+ 
++/*
++ * Hints to ext4_read_dirblock regarding whether we expect a directory
++ * block being read to be an index block, or a block containing
++ * directory entries (and if the latter, whether it was found via a
++ * logical block in an htree index block).  This is used to control
++ * what sort of sanity checkinig ext4_read_dirblock() will do on the
++ * directory block read from the storage device.  EITHER will means
++ * the caller doesn't know what kind of directory block will be read,
++ * so no specific verification will be done.
++ */
+ typedef enum {
+-	EITHER, INDEX, DIRENT
++	EITHER, INDEX, DIRENT, DIRENT_HTREE
+ } dirblock_type_t;
+ 
+ #define ext4_read_dirblock(inode, block, type) \
+@@ -107,11 +117,14 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode,
+ 
+ 		return bh;
+ 	}
+-	if (!bh) {
++	if (!bh && (type == INDEX || type == DIRENT_HTREE)) {
+ 		ext4_error_inode(inode, func, line, block,
+-				 "Directory hole found");
++				 "Directory hole found for htree %s block",
++				 (type == INDEX) ? "index" : "leaf");
+ 		return ERR_PTR(-EFSCORRUPTED);
+ 	}
++	if (!bh)
++		return NULL;
+ 	dirent = (struct ext4_dir_entry *) bh->b_data;
+ 	/* Determine whether or not we have an index block */
+ 	if (is_dx(inode)) {
+@@ -978,7 +991,7 @@ static int htree_dirblock_to_tree(struct file *dir_file,
+ 
+ 	dxtrace(printk(KERN_INFO "In htree dirblock_to_tree: block %lu\n",
+ 							(unsigned long)block));
+-	bh = ext4_read_dirblock(dir, block, DIRENT);
++	bh = ext4_read_dirblock(dir, block, DIRENT_HTREE);
+ 	if (IS_ERR(bh))
+ 		return PTR_ERR(bh);
+ 
+@@ -1508,7 +1521,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,
+ 		return (struct buffer_head *) frame;
+ 	do {
+ 		block = dx_get_block(frame->at);
+-		bh = ext4_read_dirblock(dir, block, DIRENT);
++		bh = ext4_read_dirblock(dir, block, DIRENT_HTREE);
+ 		if (IS_ERR(bh))
+ 			goto errout;
+ 
+@@ -2088,6 +2101,11 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ 	blocks = dir->i_size >> sb->s_blocksize_bits;
+ 	for (block = 0; block < blocks; block++) {
+ 		bh = ext4_read_dirblock(dir, block, DIRENT);
++		if (bh == NULL) {
++			bh = ext4_bread(handle, dir, block,
++					EXT4_GET_BLOCKS_CREATE);
++			goto add_to_new_block;
++		}
+ 		if (IS_ERR(bh)) {
+ 			retval = PTR_ERR(bh);
+ 			bh = NULL;
+@@ -2108,6 +2126,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ 		brelse(bh);
+ 	}
+ 	bh = ext4_append(handle, dir, &block);
++add_to_new_block:
+ 	if (IS_ERR(bh)) {
+ 		retval = PTR_ERR(bh);
+ 		bh = NULL;
+@@ -2152,7 +2171,7 @@ again:
+ 		return PTR_ERR(frame);
+ 	entries = frame->entries;
+ 	at = frame->at;
+-	bh = ext4_read_dirblock(dir, dx_get_block(frame->at), DIRENT);
++	bh = ext4_read_dirblock(dir, dx_get_block(frame->at), DIRENT_HTREE);
+ 	if (IS_ERR(bh)) {
+ 		err = PTR_ERR(bh);
+ 		bh = NULL;
+@@ -2700,7 +2719,10 @@ bool ext4_empty_dir(struct inode *inode)
+ 		EXT4_ERROR_INODE(inode, "invalid size");
+ 		return true;
+ 	}
+-	bh = ext4_read_dirblock(inode, 0, EITHER);
++	/* The first directory block must not be a hole,
++	 * so treat it as DIRENT_HTREE
++	 */
++	bh = ext4_read_dirblock(inode, 0, DIRENT_HTREE);
+ 	if (IS_ERR(bh))
+ 		return true;
+ 
+@@ -2722,6 +2744,10 @@ bool ext4_empty_dir(struct inode *inode)
+ 			brelse(bh);
+ 			lblock = offset >> EXT4_BLOCK_SIZE_BITS(sb);
+ 			bh = ext4_read_dirblock(inode, lblock, EITHER);
++			if (bh == NULL) {
++				offset += sb->s_blocksize;
++				continue;
++			}
+ 			if (IS_ERR(bh))
+ 				return true;
+ 			de = (struct ext4_dir_entry_2 *) bh->b_data;
+@@ -3292,7 +3318,10 @@ static struct buffer_head *ext4_get_first_dir_block(handle_t *handle,
+ 	struct buffer_head *bh;
+ 
+ 	if (!ext4_has_inline_data(inode)) {
+-		bh = ext4_read_dirblock(inode, 0, EITHER);
++		/* The first directory block must not be a hole, so
++		 * treat it as DIRENT_HTREE
++		 */
++		bh = ext4_read_dirblock(inode, 0, DIRENT_HTREE);
+ 		if (IS_ERR(bh)) {
+ 			*retval = PTR_ERR(bh);
+ 			return NULL;
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 70bd15cadb44..18d51c36a5e3 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -2612,6 +2612,11 @@ static int read_compacted_summaries(struct f2fs_sb_info *sbi)
+ 		seg_i = CURSEG_I(sbi, i);
+ 		segno = le32_to_cpu(ckpt->cur_data_segno[i]);
+ 		blk_off = le16_to_cpu(ckpt->cur_data_blkoff[i]);
++		if (blk_off > ENTRIES_IN_SUM) {
++			f2fs_bug_on(sbi, 1);
++			f2fs_put_page(page, 1);
++			return -EFAULT;
++		}
+ 		seg_i->next_segno = segno;
+ 		reset_curseg(sbi, i, 0);
+ 		seg_i->alloc_type = ckpt->alloc_type[i];
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 4d561ee08d05..9e8fde348d61 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -721,6 +721,7 @@ void wbc_detach_inode(struct writeback_control *wbc)
+ void wbc_account_io(struct writeback_control *wbc, struct page *page,
+ 		    size_t bytes)
+ {
++	struct cgroup_subsys_state *css;
+ 	int id;
+ 
+ 	/*
+@@ -732,7 +733,12 @@ void wbc_account_io(struct writeback_control *wbc, struct page *page,
+ 	if (!wbc->wb)
+ 		return;
+ 
+-	id = mem_cgroup_css_from_page(page)->id;
++	css = mem_cgroup_css_from_page(page);
++	/* dead cgroups shouldn't contribute to inode ownership arbitration */
++	if (!(css->flags & CSS_ONLINE))
++		return;
++
++	id = css->id;
+ 
+ 	if (id == wbc->wb_id) {
+ 		wbc->wb_bytes += bytes;
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index d11401afd52f..0567b17a970c 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -189,14 +189,15 @@ static int journal_wait_on_commit_record(journal_t *journal,
+  * use writepages() because with dealyed allocation we may be doing
+  * block allocation in writepages().
+  */
+-static int journal_submit_inode_data_buffers(struct address_space *mapping)
++static int journal_submit_inode_data_buffers(struct address_space *mapping,
++		loff_t dirty_start, loff_t dirty_end)
+ {
+ 	int ret;
+ 	struct writeback_control wbc = {
+ 		.sync_mode =  WB_SYNC_ALL,
+ 		.nr_to_write = mapping->nrpages * 2,
+-		.range_start = 0,
+-		.range_end = i_size_read(mapping->host),
++		.range_start = dirty_start,
++		.range_end = dirty_end,
+ 	};
+ 
+ 	ret = generic_writepages(mapping, &wbc);
+@@ -220,6 +221,9 @@ static int journal_submit_data_buffers(journal_t *journal,
+ 
+ 	spin_lock(&journal->j_list_lock);
+ 	list_for_each_entry(jinode, &commit_transaction->t_inode_list, i_list) {
++		loff_t dirty_start = jinode->i_dirty_start;
++		loff_t dirty_end = jinode->i_dirty_end;
++
+ 		if (!(jinode->i_flags & JI_WRITE_DATA))
+ 			continue;
+ 		mapping = jinode->i_vfs_inode->i_mapping;
+@@ -232,7 +236,8 @@ static int journal_submit_data_buffers(journal_t *journal,
+ 		 * only allocated blocks here.
+ 		 */
+ 		trace_jbd2_submit_inode_data(jinode->i_vfs_inode);
+-		err = journal_submit_inode_data_buffers(mapping);
++		err = journal_submit_inode_data_buffers(mapping, dirty_start,
++				dirty_end);
+ 		if (!ret)
+ 			ret = err;
+ 		spin_lock(&journal->j_list_lock);
+@@ -259,12 +264,16 @@ static int journal_finish_inode_data_buffers(journal_t *journal,
+ 	/* For locking, see the comment in journal_submit_data_buffers() */
+ 	spin_lock(&journal->j_list_lock);
+ 	list_for_each_entry(jinode, &commit_transaction->t_inode_list, i_list) {
++		loff_t dirty_start = jinode->i_dirty_start;
++		loff_t dirty_end = jinode->i_dirty_end;
++
+ 		if (!(jinode->i_flags & JI_WAIT_DATA))
+ 			continue;
+ 		jinode->i_flags |= JI_COMMIT_RUNNING;
+ 		spin_unlock(&journal->j_list_lock);
+-		err = filemap_fdatawait_keep_errors(
+-				jinode->i_vfs_inode->i_mapping);
++		err = filemap_fdatawait_range_keep_errors(
++				jinode->i_vfs_inode->i_mapping, dirty_start,
++				dirty_end);
+ 		if (!ret)
+ 			ret = err;
+ 		spin_lock(&journal->j_list_lock);
+@@ -284,6 +293,8 @@ static int journal_finish_inode_data_buffers(journal_t *journal,
+ 				&jinode->i_transaction->t_inode_list);
+ 		} else {
+ 			jinode->i_transaction = NULL;
++			jinode->i_dirty_start = 0;
++			jinode->i_dirty_end = 0;
+ 		}
+ 	}
+ 	spin_unlock(&journal->j_list_lock);
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 593f3e31fb21..d3cce5c86fd9 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -97,6 +97,8 @@ EXPORT_SYMBOL(jbd2_journal_try_to_free_buffers);
+ EXPORT_SYMBOL(jbd2_journal_force_commit);
+ EXPORT_SYMBOL(jbd2_journal_inode_add_write);
+ EXPORT_SYMBOL(jbd2_journal_inode_add_wait);
++EXPORT_SYMBOL(jbd2_journal_inode_ranged_write);
++EXPORT_SYMBOL(jbd2_journal_inode_ranged_wait);
+ EXPORT_SYMBOL(jbd2_journal_init_jbd_inode);
+ EXPORT_SYMBOL(jbd2_journal_release_jbd_inode);
+ EXPORT_SYMBOL(jbd2_journal_begin_ordered_truncate);
+@@ -2581,6 +2583,8 @@ void jbd2_journal_init_jbd_inode(struct jbd2_inode *jinode, struct inode *inode)
+ 	jinode->i_next_transaction = NULL;
+ 	jinode->i_vfs_inode = inode;
+ 	jinode->i_flags = 0;
++	jinode->i_dirty_start = 0;
++	jinode->i_dirty_end = 0;
+ 	INIT_LIST_HEAD(&jinode->i_list);
+ }
+ 
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 650927f0a2dc..7fe422eced89 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -2503,7 +2503,7 @@ void jbd2_journal_refile_buffer(journal_t *journal, struct journal_head *jh)
+  * File inode in the inode list of the handle's transaction
+  */
+ static int jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *jinode,
+-				   unsigned long flags)
++		unsigned long flags, loff_t start_byte, loff_t end_byte)
+ {
+ 	transaction_t *transaction = handle->h_transaction;
+ 	journal_t *journal;
+@@ -2515,26 +2515,17 @@ static int jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *jinode,
+ 	jbd_debug(4, "Adding inode %lu, tid:%d\n", jinode->i_vfs_inode->i_ino,
+ 			transaction->t_tid);
+ 
+-	/*
+-	 * First check whether inode isn't already on the transaction's
+-	 * lists without taking the lock. Note that this check is safe
+-	 * without the lock as we cannot race with somebody removing inode
+-	 * from the transaction. The reason is that we remove inode from the
+-	 * transaction only in journal_release_jbd_inode() and when we commit
+-	 * the transaction. We are guarded from the first case by holding
+-	 * a reference to the inode. We are safe against the second case
+-	 * because if jinode->i_transaction == transaction, commit code
+-	 * cannot touch the transaction because we hold reference to it,
+-	 * and if jinode->i_next_transaction == transaction, commit code
+-	 * will only file the inode where we want it.
+-	 */
+-	if ((jinode->i_transaction == transaction ||
+-	    jinode->i_next_transaction == transaction) &&
+-	    (jinode->i_flags & flags) == flags)
+-		return 0;
+-
+ 	spin_lock(&journal->j_list_lock);
+ 	jinode->i_flags |= flags;
++
++	if (jinode->i_dirty_end) {
++		jinode->i_dirty_start = min(jinode->i_dirty_start, start_byte);
++		jinode->i_dirty_end = max(jinode->i_dirty_end, end_byte);
++	} else {
++		jinode->i_dirty_start = start_byte;
++		jinode->i_dirty_end = end_byte;
++	}
++
+ 	/* Is inode already attached where we need it? */
+ 	if (jinode->i_transaction == transaction ||
+ 	    jinode->i_next_transaction == transaction)
+@@ -2569,12 +2560,28 @@ done:
+ int jbd2_journal_inode_add_write(handle_t *handle, struct jbd2_inode *jinode)
+ {
+ 	return jbd2_journal_file_inode(handle, jinode,
+-				       JI_WRITE_DATA | JI_WAIT_DATA);
++			JI_WRITE_DATA | JI_WAIT_DATA, 0, LLONG_MAX);
+ }
+ 
+ int jbd2_journal_inode_add_wait(handle_t *handle, struct jbd2_inode *jinode)
+ {
+-	return jbd2_journal_file_inode(handle, jinode, JI_WAIT_DATA);
++	return jbd2_journal_file_inode(handle, jinode, JI_WAIT_DATA, 0,
++			LLONG_MAX);
++}
++
++int jbd2_journal_inode_ranged_write(handle_t *handle,
++		struct jbd2_inode *jinode, loff_t start_byte, loff_t length)
++{
++	return jbd2_journal_file_inode(handle, jinode,
++			JI_WRITE_DATA | JI_WAIT_DATA, start_byte,
++			start_byte + length - 1);
++}
++
++int jbd2_journal_inode_ranged_wait(handle_t *handle, struct jbd2_inode *jinode,
++		loff_t start_byte, loff_t length)
++{
++	return jbd2_journal_file_inode(handle, jinode, JI_WAIT_DATA,
++			start_byte, start_byte + length - 1);
+ }
+ 
+ /*
+diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+index 2de6e87e5ee5..2464b9b80698 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+@@ -306,7 +306,7 @@ int ff_layout_track_ds_error(struct nfs4_flexfile_layout *flo,
+ 	if (status == 0)
+ 		return 0;
+ 
+-	if (mirror->mirror_ds == NULL)
++	if (IS_ERR_OR_NULL(mirror->mirror_ds))
+ 		return -EINVAL;
+ 
+ 	dserr = kmalloc(sizeof(*dserr), gfp_flags);
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index 134d9f560240..71a399f6805a 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -1034,6 +1034,7 @@ int nfs_open(struct inode *inode, struct file *filp)
+ 	nfs_fscache_open_file(inode, filp);
+ 	return 0;
+ }
++EXPORT_SYMBOL_GPL(nfs_open);
+ 
+ /*
+  * This function is called whenever some part of NFS notices that
+diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
+index 626d1382002e..2b3e0f1ca572 100644
+--- a/fs/nfs/nfs4file.c
++++ b/fs/nfs/nfs4file.c
+@@ -50,7 +50,7 @@ nfs4_file_open(struct inode *inode, struct file *filp)
+ 		return err;
+ 
+ 	if ((openflags & O_ACCMODE) == 3)
+-		openflags--;
++		return nfs_open(inode, filp);
+ 
+ 	/* We can't create new files here */
+ 	openflags &= ~(O_CREAT|O_EXCL);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index a225f98c9903..209a21ed5f97 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1099,6 +1099,12 @@ struct nfs4_opendata {
+ 	int rpc_status;
+ };
+ 
++struct nfs4_open_createattrs {
++	struct nfs4_label *label;
++	struct iattr *sattr;
++	const __u32 verf[2];
++};
++
+ static bool nfs4_clear_cap_atomic_open_v1(struct nfs_server *server,
+ 		int err, struct nfs4_exception *exception)
+ {
+@@ -1168,8 +1174,7 @@ static void nfs4_init_opendata_res(struct nfs4_opendata *p)
+ 
+ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
+ 		struct nfs4_state_owner *sp, fmode_t fmode, int flags,
+-		const struct iattr *attrs,
+-		struct nfs4_label *label,
++		const struct nfs4_open_createattrs *c,
+ 		enum open_claim_type4 claim,
+ 		gfp_t gfp_mask)
+ {
+@@ -1177,6 +1182,7 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
+ 	struct inode *dir = d_inode(parent);
+ 	struct nfs_server *server = NFS_SERVER(dir);
+ 	struct nfs_seqid *(*alloc_seqid)(struct nfs_seqid_counter *, gfp_t);
++	struct nfs4_label *label = (c != NULL) ? c->label : NULL;
+ 	struct nfs4_opendata *p;
+ 
+ 	p = kzalloc(sizeof(*p), gfp_mask);
+@@ -1242,15 +1248,11 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
+ 	case NFS4_OPEN_CLAIM_DELEG_PREV_FH:
+ 		p->o_arg.fh = NFS_FH(d_inode(dentry));
+ 	}
+-	if (attrs != NULL && attrs->ia_valid != 0) {
+-		__u32 verf[2];
+-
++	if (c != NULL && c->sattr != NULL && c->sattr->ia_valid != 0) {
+ 		p->o_arg.u.attrs = &p->attrs;
+-		memcpy(&p->attrs, attrs, sizeof(p->attrs));
++		memcpy(&p->attrs, c->sattr, sizeof(p->attrs));
+ 
+-		verf[0] = jiffies;
+-		verf[1] = current->pid;
+-		memcpy(p->o_arg.u.verifier.data, verf,
++		memcpy(p->o_arg.u.verifier.data, c->verf,
+ 				sizeof(p->o_arg.u.verifier.data));
+ 	}
+ 	p->c_arg.fh = &p->o_res.fh;
+@@ -1816,7 +1818,7 @@ static struct nfs4_opendata *nfs4_open_recoverdata_alloc(struct nfs_open_context
+ 	struct nfs4_opendata *opendata;
+ 
+ 	opendata = nfs4_opendata_alloc(ctx->dentry, state->owner, 0, 0,
+-			NULL, NULL, claim, GFP_NOFS);
++			NULL, claim, GFP_NOFS);
+ 	if (opendata == NULL)
+ 		return ERR_PTR(-ENOMEM);
+ 	opendata->state = state;
+@@ -2757,8 +2759,7 @@ out:
+ static int _nfs4_do_open(struct inode *dir,
+ 			struct nfs_open_context *ctx,
+ 			int flags,
+-			struct iattr *sattr,
+-			struct nfs4_label *label,
++			const struct nfs4_open_createattrs *c,
+ 			int *opened)
+ {
+ 	struct nfs4_state_owner  *sp;
+@@ -2770,6 +2771,8 @@ static int _nfs4_do_open(struct inode *dir,
+ 	struct nfs4_threshold **ctx_th = &ctx->mdsthreshold;
+ 	fmode_t fmode = ctx->mode & (FMODE_READ|FMODE_WRITE|FMODE_EXEC);
+ 	enum open_claim_type4 claim = NFS4_OPEN_CLAIM_NULL;
++	struct iattr *sattr = c->sattr;
++	struct nfs4_label *label = c->label;
+ 	struct nfs4_label *olabel = NULL;
+ 	int status;
+ 
+@@ -2788,8 +2791,8 @@ static int _nfs4_do_open(struct inode *dir,
+ 	status = -ENOMEM;
+ 	if (d_really_is_positive(dentry))
+ 		claim = NFS4_OPEN_CLAIM_FH;
+-	opendata = nfs4_opendata_alloc(dentry, sp, fmode, flags, sattr,
+-			label, claim, GFP_KERNEL);
++	opendata = nfs4_opendata_alloc(dentry, sp, fmode, flags,
++			c, claim, GFP_KERNEL);
+ 	if (opendata == NULL)
+ 		goto err_put_state_owner;
+ 
+@@ -2870,10 +2873,18 @@ static struct nfs4_state *nfs4_do_open(struct inode *dir,
+ 	struct nfs_server *server = NFS_SERVER(dir);
+ 	struct nfs4_exception exception = { };
+ 	struct nfs4_state *res;
++	struct nfs4_open_createattrs c = {
++		.label = label,
++		.sattr = sattr,
++		.verf = {
++			[0] = (__u32)jiffies,
++			[1] = (__u32)current->pid,
++		},
++	};
+ 	int status;
+ 
+ 	do {
+-		status = _nfs4_do_open(dir, ctx, flags, sattr, label, opened);
++		status = _nfs4_do_open(dir, ctx, flags, &c, opened);
+ 		res = ctx->state;
+ 		trace_nfs4_open_file(ctx, flags, status);
+ 		if (status == 0)
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 94128643ec1a..87ee9cbf7dcb 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -1502,11 +1502,16 @@ static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca)
+ {
+ 	u32 slotsize = slot_bytes(ca);
+ 	u32 num = ca->maxreqs;
+-	int avail;
++	unsigned long avail, total_avail;
+ 
+ 	spin_lock(&nfsd_drc_lock);
+-	avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION,
+-		    nfsd_drc_max_mem - nfsd_drc_mem_used);
++	total_avail = nfsd_drc_max_mem - nfsd_drc_mem_used;
++	avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION, total_avail);
++	/*
++	 * Never use more than a third of the remaining memory,
++	 * unless it's the only way to give this client a slot:
++	 */
++	avail = clamp_t(unsigned long, avail, slotsize, total_avail/3);
+ 	num = min_t(int, num, avail / slotsize);
+ 	nfsd_drc_mem_used += num * slotsize;
+ 	spin_unlock(&nfsd_drc_lock);
+diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
+index e02bd2783124..4a9e0fb634b6 100644
+--- a/fs/nfsd/nfssvc.c
++++ b/fs/nfsd/nfssvc.c
+@@ -447,7 +447,7 @@ void nfsd_reset_versions(void)
+  */
+ static void set_max_drc(void)
+ {
+-	#define NFSD_DRC_SIZE_SHIFT	10
++	#define NFSD_DRC_SIZE_SHIFT	7
+ 	nfsd_drc_max_mem = (nr_free_buffer_pages()
+ 					>> NFSD_DRC_SIZE_SHIFT) * PAGE_SIZE;
+ 	nfsd_drc_mem_used = 0;
+diff --git a/fs/open.c b/fs/open.c
+index f4ea0dc88823..29a2cdcbcb17 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -379,6 +379,25 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
+ 				override_cred->cap_permitted;
+ 	}
+ 
++	/*
++	 * The new set of credentials can *only* be used in
++	 * task-synchronous circumstances, and does not need
++	 * RCU freeing, unless somebody then takes a separate
++	 * reference to it.
++	 *
++	 * NOTE! This is _only_ true because this credential
++	 * is used purely for override_creds() that installs
++	 * it as the subjective cred. Other threads will be
++	 * accessing ->real_cred, not the subjective cred.
++	 *
++	 * If somebody _does_ make a copy of this (using the
++	 * 'get_current_cred()' function), that will clear the
++	 * non_rcu field, because now that other user may be
++	 * expecting RCU freeing. But normal thread-synchronous
++	 * cred accesses will keep things non-RCY.
++	 */
++	override_cred->non_rcu = 1;
++
+ 	old_cred = override_creds(override_cred);
+ retry:
+ 	res = user_path_at(dfd, filename, lookup_flags, &path);
+diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
+index 555698ddb943..12bac452738d 100644
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -498,6 +498,10 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
+ 
+ 	if (root->set_ownership)
+ 		root->set_ownership(head, table, &inode->i_uid, &inode->i_gid);
++	else {
++		inode->i_uid = GLOBAL_ROOT_UID;
++		inode->i_gid = GLOBAL_ROOT_GID;
++	}
+ 
+ 	return inode;
+ }
+diff --git a/include/drm/drm_debugfs_crc.h b/include/drm/drm_debugfs_crc.h
+index 7d63b1d4adb9..b225eeb30d05 100644
+--- a/include/drm/drm_debugfs_crc.h
++++ b/include/drm/drm_debugfs_crc.h
+@@ -43,6 +43,7 @@ struct drm_crtc_crc_entry {
+  * @lock: protects the fields in this struct
+  * @source: name of the currently configured source of CRCs
+  * @opened: whether userspace has opened the data file for reading
++ * @overflow: whether an overflow occured.
+  * @entries: array of entries, with size of %DRM_CRC_ENTRIES_NR
+  * @head: head of circular queue
+  * @tail: tail of circular queue
+@@ -52,7 +53,7 @@ struct drm_crtc_crc_entry {
+ struct drm_crtc_crc {
+ 	spinlock_t lock;
+ 	const char *source;
+-	bool opened;
++	bool opened, overflow;
+ 	struct drm_crtc_crc_entry *entries;
+ 	int head, tail;
+ 	size_t values_cnt;
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index a704d032713b..f84d332085c3 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -185,23 +185,21 @@ void __read_once_size(const volatile void *p, void *res, int size)
+ 
+ #ifdef CONFIG_KASAN
+ /*
+- * This function is not 'inline' because __no_sanitize_address confilcts
++ * We can't declare function 'inline' because __no_sanitize_address confilcts
+  * with inlining. Attempt to inline it may cause a build failure.
+  * 	https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67368
+  * '__maybe_unused' allows us to avoid defined-but-not-used warnings.
+  */
+-static __no_sanitize_address __maybe_unused
+-void __read_once_size_nocheck(const volatile void *p, void *res, int size)
+-{
+-	__READ_ONCE_SIZE;
+-}
++# define __no_kasan_or_inline __no_sanitize_address __maybe_unused
+ #else
+-static __always_inline
++# define __no_kasan_or_inline __always_inline
++#endif
++
++static __no_kasan_or_inline
+ void __read_once_size_nocheck(const volatile void *p, void *res, int size)
+ {
+ 	__READ_ONCE_SIZE;
+ }
+-#endif
+ 
+ static __always_inline void __write_once_size(volatile void *p, void *res, int size)
+ {
+@@ -240,6 +238,7 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
+  * required ordering.
+  */
+ #include <asm/barrier.h>
++#include <linux/kasan-checks.h>
+ 
+ #define __READ_ONCE(x, check)						\
+ ({									\
+@@ -259,6 +258,13 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
+  */
+ #define READ_ONCE_NOCHECK(x) __READ_ONCE(x, 0)
+ 
++static __no_kasan_or_inline
++unsigned long read_word_at_a_time(const void *addr)
++{
++	kasan_check_read(addr, 1);
++	return *(unsigned long *)addr;
++}
++
+ #define WRITE_ONCE(x, val) \
+ ({							\
+ 	union { typeof(x) __val; char __c[1]; } __u =	\
+diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
+index 0c78ad0cc515..0834eb5ea9e6 100644
+--- a/include/linux/cpuhotplug.h
++++ b/include/linux/cpuhotplug.h
+@@ -115,10 +115,10 @@ enum cpuhp_state {
+ 	CPUHP_AP_PERF_ARM_ACPI_STARTING,
+ 	CPUHP_AP_PERF_ARM_STARTING,
+ 	CPUHP_AP_ARM_L2X0_STARTING,
++	CPUHP_AP_EXYNOS4_MCT_TIMER_STARTING,
+ 	CPUHP_AP_ARM_ARCH_TIMER_STARTING,
+ 	CPUHP_AP_ARM_GLOBAL_TIMER_STARTING,
+ 	CPUHP_AP_JCORE_TIMER_STARTING,
+-	CPUHP_AP_EXYNOS4_MCT_TIMER_STARTING,
+ 	CPUHP_AP_ARM_TWD_STARTING,
+ 	CPUHP_AP_METAG_TIMER_STARTING,
+ 	CPUHP_AP_QCOM_TIMER_STARTING,
+diff --git a/include/linux/cred.h b/include/linux/cred.h
+index 631286535d0f..2a0d4674294e 100644
+--- a/include/linux/cred.h
++++ b/include/linux/cred.h
+@@ -145,7 +145,11 @@ struct cred {
+ 	struct user_struct *user;	/* real user ID subscription */
+ 	struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
+ 	struct group_info *group_info;	/* supplementary groups for euid/fsgid */
+-	struct rcu_head	rcu;		/* RCU deletion hook */
++	/* RCU deletion */
++	union {
++		int non_rcu;			/* Can we skip RCU deletion? */
++		struct rcu_head	rcu;		/* RCU deletion hook */
++	};
+ } __randomize_layout;
+ 
+ extern void __put_cred(struct cred *);
+@@ -243,6 +247,7 @@ static inline const struct cred *get_cred(const struct cred *cred)
+ {
+ 	struct cred *nonconst_cred = (struct cred *) cred;
+ 	validate_creds(cred);
++	nonconst_cred->non_rcu = 0;
+ 	return get_new_cred(nonconst_cred);
+ }
+ 
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index da56c796c5d8..f0fddf4ea828 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -2580,6 +2580,8 @@ extern int filemap_flush(struct address_space *);
+ extern int filemap_fdatawait_keep_errors(struct address_space *mapping);
+ extern int filemap_fdatawait_range(struct address_space *, loff_t lstart,
+ 				   loff_t lend);
++extern int filemap_fdatawait_range_keep_errors(struct address_space *mapping,
++		loff_t start_byte, loff_t end_byte);
+ 
+ static inline int filemap_fdatawait(struct address_space *mapping)
+ {
+diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
+index 29290bfb94a8..11b3ab68f6a7 100644
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -454,6 +454,22 @@ struct jbd2_inode {
+ 	 * @i_flags: Flags of inode [j_list_lock]
+ 	 */
+ 	unsigned long i_flags;
++
++	/**
++	 * @i_dirty_start:
++	 *
++	 * Offset in bytes where the dirty range for this inode starts.
++	 * [j_list_lock]
++	 */
++	loff_t i_dirty_start;
++
++	/**
++	 * @i_dirty_end:
++	 *
++	 * Inclusive offset in bytes where the dirty range for this inode
++	 * ends. [j_list_lock]
++	 */
++	loff_t i_dirty_end;
+ };
+ 
+ struct jbd2_revoke_table_s;
+@@ -1399,6 +1415,12 @@ extern int	   jbd2_journal_force_commit(journal_t *);
+ extern int	   jbd2_journal_force_commit_nested(journal_t *);
+ extern int	   jbd2_journal_inode_add_write(handle_t *handle, struct jbd2_inode *inode);
+ extern int	   jbd2_journal_inode_add_wait(handle_t *handle, struct jbd2_inode *inode);
++extern int	   jbd2_journal_inode_ranged_write(handle_t *handle,
++			struct jbd2_inode *inode, loff_t start_byte,
++			loff_t length);
++extern int	   jbd2_journal_inode_ranged_wait(handle_t *handle,
++			struct jbd2_inode *inode, loff_t start_byte,
++			loff_t length);
+ extern int	   jbd2_journal_begin_ordered_truncate(journal_t *journal,
+ 				struct jbd2_inode *inode, loff_t new_size);
+ extern void	   jbd2_journal_init_jbd_inode(struct jbd2_inode *jinode, struct inode *inode);
+diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
+index f960c85cd9ec..8d570190e9b4 100644
+--- a/include/linux/rcupdate.h
++++ b/include/linux/rcupdate.h
+@@ -622,7 +622,7 @@ static inline void rcu_preempt_sleep_check(void) { }
+  * read-side critical sections may be preempted and they may also block, but
+  * only when acquiring spinlocks that are subject to priority inheritance.
+  */
+-static inline void rcu_read_lock(void)
++static __always_inline void rcu_read_lock(void)
+ {
+ 	__rcu_read_lock();
+ 	__acquire(RCU);
+diff --git a/include/net/dst.h b/include/net/dst.h
+index ebfb4328fdb1..2acd670fc86b 100644
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -329,8 +329,9 @@ static inline bool dst_hold_safe(struct dst_entry *dst)
+  * @skb: buffer
+  *
+  * If dst is not yet refcounted and not destroyed, grab a ref on it.
++ * Returns true if dst is refcounted.
+  */
+-static inline void skb_dst_force(struct sk_buff *skb)
++static inline bool skb_dst_force(struct sk_buff *skb)
+ {
+ 	if (skb_dst_is_noref(skb)) {
+ 		struct dst_entry *dst = skb_dst(skb);
+@@ -341,6 +342,8 @@ static inline void skb_dst_force(struct sk_buff *skb)
+ 
+ 		skb->_skb_refdst = (unsigned long)dst;
+ 	}
++
++	return skb->_skb_refdst != 0UL;
+ }
+ 
+ 
+diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
+index 5d08c1950e7d..82bc9f0e8a76 100644
+--- a/include/net/ip_vs.h
++++ b/include/net/ip_vs.h
+@@ -812,11 +812,12 @@ struct ipvs_master_sync_state {
+ 	struct ip_vs_sync_buff	*sync_buff;
+ 	unsigned long		sync_queue_len;
+ 	unsigned int		sync_queue_delay;
+-	struct task_struct	*master_thread;
+ 	struct delayed_work	master_wakeup_work;
+ 	struct netns_ipvs	*ipvs;
+ };
+ 
++struct ip_vs_sync_thread_data;
++
+ /* How much time to keep dests in trash */
+ #define IP_VS_DEST_TRASH_PERIOD		(120 * HZ)
+ 
+@@ -947,7 +948,8 @@ struct netns_ipvs {
+ 	spinlock_t		sync_lock;
+ 	struct ipvs_master_sync_state *ms;
+ 	spinlock_t		sync_buff_lock;
+-	struct task_struct	**backup_threads;
++	struct ip_vs_sync_thread_data *master_tinfo;
++	struct ip_vs_sync_thread_data *backup_tinfo;
+ 	int			threads_mask;
+ 	volatile int		sync_state;
+ 	struct mutex		sync_mutex;
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 1179ef4f0768..0b477a1e1177 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1043,7 +1043,8 @@ void tcp_get_default_congestion_control(char *name);
+ void tcp_get_available_congestion_control(char *buf, size_t len);
+ void tcp_get_allowed_congestion_control(char *buf, size_t len);
+ int tcp_set_allowed_congestion_control(char *allowed);
+-int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, bool reinit);
++int tcp_set_congestion_control(struct sock *sk, const char *name, bool load,
++			       bool reinit, bool cap_net_admin);
+ u32 tcp_slow_start(struct tcp_sock *tp, u32 acked);
+ void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked);
+ 
+diff --git a/include/xen/events.h b/include/xen/events.h
+index c3e6bc643a7b..1650d39decae 100644
+--- a/include/xen/events.h
++++ b/include/xen/events.h
+@@ -3,6 +3,7 @@
+ #define _XEN_EVENTS_H
+ 
+ #include <linux/interrupt.h>
++#include <linux/irq.h>
+ #ifdef CONFIG_PCI_MSI
+ #include <linux/msi.h>
+ #endif
+@@ -59,7 +60,7 @@ void evtchn_put(unsigned int evtchn);
+ 
+ void xen_send_IPI_one(unsigned int cpu, enum ipi_vector vector);
+ void rebind_evtchn_irq(int evtchn, int irq);
+-int xen_rebind_evtchn_to_cpu(int evtchn, unsigned tcpu);
++int xen_set_affinity_evtchn(struct irq_desc *desc, unsigned int tcpu);
+ 
+ static inline void notify_remote_via_evtchn(int port)
+ {
+diff --git a/kernel/bpf/Makefile b/kernel/bpf/Makefile
+index af3ab6164ff5..be282c135a66 100644
+--- a/kernel/bpf/Makefile
++++ b/kernel/bpf/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ obj-y := core.o
++CFLAGS_core.o += $(call cc-disable-warning, override-init)
+ 
+ obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o
+ obj-$(CONFIG_BPF_SYSCALL) += hashtab.o arraymap.o percpu_freelist.o bpf_lru_list.o lpm_trie.o map_in_map.o
+diff --git a/kernel/cred.c b/kernel/cred.c
+index efd04b2ec84c..5ab1f7ec946e 100644
+--- a/kernel/cred.c
++++ b/kernel/cred.c
+@@ -147,7 +147,10 @@ void __put_cred(struct cred *cred)
+ 	BUG_ON(cred == current->cred);
+ 	BUG_ON(cred == current->real_cred);
+ 
+-	call_rcu(&cred->rcu, put_cred_rcu);
++	if (cred->non_rcu)
++		put_cred_rcu(&cred->rcu);
++	else
++		call_rcu(&cred->rcu, put_cred_rcu);
+ }
+ EXPORT_SYMBOL(__put_cred);
+ 
+@@ -258,6 +261,7 @@ struct cred *prepare_creds(void)
+ 	old = task->cred;
+ 	memcpy(new, old, sizeof(struct cred));
+ 
++	new->non_rcu = 0;
+ 	atomic_set(&new->usage, 1);
+ 	set_cred_subscribers(new, 0);
+ 	get_group_info(new->group_info);
+@@ -537,7 +541,19 @@ const struct cred *override_creds(const struct cred *new)
+ 
+ 	validate_creds(old);
+ 	validate_creds(new);
+-	get_cred(new);
++
++	/*
++	 * NOTE! This uses 'get_new_cred()' rather than 'get_cred()'.
++	 *
++	 * That means that we do not clear the 'non_rcu' flag, since
++	 * we are only installing the cred into the thread-synchronous
++	 * '->cred' pointer, not the '->real_cred' pointer that is
++	 * visible to other threads under RCU.
++	 *
++	 * Also note that we did validate_creds() manually, not depending
++	 * on the validation in 'get_cred()'.
++	 */
++	get_new_cred((struct cred *)new);
+ 	alter_cred_subscribers(new, 1);
+ 	rcu_assign_pointer(current->cred, new);
+ 	alter_cred_subscribers(old, -1);
+@@ -620,6 +636,7 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
+ 	validate_creds(old);
+ 
+ 	*new = *old;
++	new->non_rcu = 0;
+ 	atomic_set(&new->usage, 1);
+ 	set_cred_subscribers(new, 0);
+ 	get_uid(new->user);
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index bf694c709b96..565005a3b8f0 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -3402,17 +3402,17 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
+ 	if (depth && !cross_lock(lock)) {
+ 		hlock = curr->held_locks + depth - 1;
+ 		if (hlock->class_idx == class_idx && nest_lock) {
+-			if (hlock->references) {
+-				/*
+-				 * Check: unsigned int references:12, overflow.
+-				 */
+-				if (DEBUG_LOCKS_WARN_ON(hlock->references == (1 << 12)-1))
+-					return 0;
++			if (!references)
++				references++;
+ 
++			if (!hlock->references)
+ 				hlock->references++;
+-			} else {
+-				hlock->references = 2;
+-			}
++
++			hlock->references += references;
++
++			/* Overflow */
++			if (DEBUG_LOCKS_WARN_ON(hlock->references < references))
++				return 0;
+ 
+ 			return 1;
+ 		}
+diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c
+index ad69bbc9bd28..8b2ef15e3552 100644
+--- a/kernel/locking/lockdep_proc.c
++++ b/kernel/locking/lockdep_proc.c
+@@ -224,7 +224,6 @@ static void lockdep_stats_debug_show(struct seq_file *m)
+ 
+ static int lockdep_stats_show(struct seq_file *m, void *v)
+ {
+-	struct lock_class *class;
+ 	unsigned long nr_unused = 0, nr_uncategorized = 0,
+ 		      nr_irq_safe = 0, nr_irq_unsafe = 0,
+ 		      nr_softirq_safe = 0, nr_softirq_unsafe = 0,
+@@ -234,6 +233,9 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
+ 		      nr_hardirq_read_safe = 0, nr_hardirq_read_unsafe = 0,
+ 		      sum_forward_deps = 0;
+ 
++#ifdef CONFIG_PROVE_LOCKING
++	struct lock_class *class;
++
+ 	list_for_each_entry(class, &all_lock_classes, lock_entry) {
+ 
+ 		if (class->usage_mask == 0)
+@@ -265,12 +267,12 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
+ 		if (class->usage_mask & LOCKF_ENABLED_HARDIRQ_READ)
+ 			nr_hardirq_read_unsafe++;
+ 
+-#ifdef CONFIG_PROVE_LOCKING
+ 		sum_forward_deps += lockdep_count_forward_deps(class);
+-#endif
+ 	}
+ #ifdef CONFIG_DEBUG_LOCKDEP
+ 	DEBUG_LOCKS_WARN_ON(debug_atomic_read(nr_unused_locks) != nr_unused);
++#endif
++
+ #endif
+ 	seq_printf(m, " lock-classes:                  %11lu [max: %lu]\n",
+ 			nr_lock_classes, MAX_LOCKDEP_KEYS);
+diff --git a/kernel/padata.c b/kernel/padata.c
+index 868f947166d7..87540ce72aea 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -265,7 +265,12 @@ static void padata_reorder(struct parallel_data *pd)
+ 	 * The next object that needs serialization might have arrived to
+ 	 * the reorder queues in the meantime, we will be called again
+ 	 * from the timer function if no one else cares for it.
++	 *
++	 * Ensure reorder_objects is read after pd->lock is dropped so we see
++	 * an increment from another task in padata_do_serial.  Pairs with
++	 * smp_mb__after_atomic in padata_do_serial.
+ 	 */
++	smp_mb();
+ 	if (atomic_read(&pd->reorder_objects)
+ 			&& !(pinst->flags & PADATA_RESET))
+ 		mod_timer(&pd->timer, jiffies + HZ);
+@@ -334,6 +339,13 @@ void padata_do_serial(struct padata_priv *padata)
+ 	list_add_tail(&padata->list, &pqueue->reorder.list);
+ 	spin_unlock(&pqueue->reorder.lock);
+ 
++	/*
++	 * Ensure the atomic_inc of reorder_objects above is ordered correctly
++	 * with the trylock of pd->lock in padata_reorder.  Pairs with smp_mb
++	 * in padata_reorder.
++	 */
++	smp_mb__after_atomic();
++
+ 	put_cpu();
+ 
+ 	padata_reorder(pd);
+diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
+index 4918314893bc..22091c88b3bb 100644
+--- a/kernel/pid_namespace.c
++++ b/kernel/pid_namespace.c
+@@ -351,7 +351,7 @@ int reboot_pid_ns(struct pid_namespace *pid_ns, int cmd)
+ 	}
+ 
+ 	read_lock(&tasklist_lock);
+-	force_sig(SIGKILL, pid_ns->child_reaper);
++	send_sig(SIGKILL, pid_ns->child_reaper, 1);
+ 	read_unlock(&tasklist_lock);
+ 
+ 	do_exit(0);
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index b3ff73d6a4c2..ff128e281d1c 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5026,7 +5026,7 @@ long __sched io_schedule_timeout(long timeout)
+ }
+ EXPORT_SYMBOL(io_schedule_timeout);
+ 
+-void io_schedule(void)
++void __sched io_schedule(void)
+ {
+ 	int token;
+ 
+diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
+index 4bb9b66338be..9288532f73c8 100644
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -43,6 +43,7 @@ static u64			tick_length_base;
+ #define MAX_TICKADJ		500LL		/* usecs */
+ #define MAX_TICKADJ_SCALED \
+ 	(((MAX_TICKADJ * NSEC_PER_USEC) << NTP_SCALE_SHIFT) / NTP_INTERVAL_FREQ)
++#define MAX_TAI_OFFSET		100000
+ 
+ /*
+  * phase-lock loop variables
+@@ -640,7 +641,8 @@ static inline void process_adjtimex_modes(struct timex *txc,
+ 		time_constant = max(time_constant, 0l);
+ 	}
+ 
+-	if (txc->modes & ADJ_TAI && txc->constant >= 0)
++	if (txc->modes & ADJ_TAI &&
++			txc->constant >= 0 && txc->constant <= MAX_TAI_OFFSET)
+ 		*time_tai = txc->constant;
+ 
+ 	if (txc->modes & ADJ_OFFSET)
+diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
+index 0ed768b56c60..7e9f149d34ea 100644
+--- a/kernel/time/timer_list.c
++++ b/kernel/time/timer_list.c
+@@ -289,23 +289,6 @@ static inline void timer_list_header(struct seq_file *m, u64 now)
+ 	SEQ_printf(m, "\n");
+ }
+ 
+-static int timer_list_show(struct seq_file *m, void *v)
+-{
+-	struct timer_list_iter *iter = v;
+-
+-	if (iter->cpu == -1 && !iter->second_pass)
+-		timer_list_header(m, iter->now);
+-	else if (!iter->second_pass)
+-		print_cpu(m, iter->cpu, iter->now);
+-#ifdef CONFIG_GENERIC_CLOCKEVENTS
+-	else if (iter->cpu == -1 && iter->second_pass)
+-		timer_list_show_tickdevices_header(m);
+-	else
+-		print_tickdevice(m, tick_get_device(iter->cpu), iter->cpu);
+-#endif
+-	return 0;
+-}
+-
+ void sysrq_timer_list_show(void)
+ {
+ 	u64 now = ktime_to_ns(ktime_get());
+@@ -324,6 +307,24 @@ void sysrq_timer_list_show(void)
+ 	return;
+ }
+ 
++#ifdef CONFIG_PROC_FS
++static int timer_list_show(struct seq_file *m, void *v)
++{
++	struct timer_list_iter *iter = v;
++
++	if (iter->cpu == -1 && !iter->second_pass)
++		timer_list_header(m, iter->now);
++	else if (!iter->second_pass)
++		print_cpu(m, iter->cpu, iter->now);
++#ifdef CONFIG_GENERIC_CLOCKEVENTS
++	else if (iter->cpu == -1 && iter->second_pass)
++		timer_list_show_tickdevices_header(m);
++	else
++		print_tickdevice(m, tick_get_device(iter->cpu), iter->cpu);
++#endif
++	return 0;
++}
++
+ static void *move_iter(struct timer_list_iter *iter, loff_t offset)
+ {
+ 	for (; offset; offset--) {
+@@ -395,3 +396,4 @@ static int __init init_timer_list_procfs(void)
+ 	return 0;
+ }
+ __initcall(init_timer_list_procfs);
++#endif
+diff --git a/lib/reed_solomon/decode_rs.c b/lib/reed_solomon/decode_rs.c
+index 0ec3f257ffdf..a5d313381539 100644
+--- a/lib/reed_solomon/decode_rs.c
++++ b/lib/reed_solomon/decode_rs.c
+@@ -42,8 +42,18 @@
+ 	BUG_ON(pad < 0 || pad >= nn);
+ 
+ 	/* Does the caller provide the syndrome ? */
+-	if (s != NULL)
+-		goto decode;
++	if (s != NULL) {
++		for (i = 0; i < nroots; i++) {
++			/* The syndrome is in index form,
++			 * so nn represents zero
++			 */
++			if (s[i] != nn)
++				goto decode;
++		}
++
++		/* syndrome is zero, no errors to correct  */
++		return 0;
++	}
+ 
+ 	/* form the syndromes; i.e., evaluate data(x) at roots of
+ 	 * g(x) */
+@@ -99,9 +109,9 @@
+ 	if (no_eras > 0) {
+ 		/* Init lambda to be the erasure locator polynomial */
+ 		lambda[1] = alpha_to[rs_modnn(rs,
+-					      prim * (nn - 1 - eras_pos[0]))];
++					prim * (nn - 1 - (eras_pos[0] + pad)))];
+ 		for (i = 1; i < no_eras; i++) {
+-			u = rs_modnn(rs, prim * (nn - 1 - eras_pos[i]));
++			u = rs_modnn(rs, prim * (nn - 1 - (eras_pos[i] + pad)));
+ 			for (j = i + 1; j > 0; j--) {
+ 				tmp = index_of[lambda[j - 1]];
+ 				if (tmp != nn) {
+diff --git a/lib/scatterlist.c b/lib/scatterlist.c
+index be7b4dd6b68d..355f2e90b72c 100644
+--- a/lib/scatterlist.c
++++ b/lib/scatterlist.c
+@@ -496,17 +496,18 @@ static bool sg_miter_get_next_page(struct sg_mapping_iter *miter)
+ {
+ 	if (!miter->__remaining) {
+ 		struct scatterlist *sg;
+-		unsigned long pgoffset;
+ 
+ 		if (!__sg_page_iter_next(&miter->piter))
+ 			return false;
+ 
+ 		sg = miter->piter.sg;
+-		pgoffset = miter->piter.sg_pgoffset;
+ 
+-		miter->__offset = pgoffset ? 0 : sg->offset;
++		miter->__offset = miter->piter.sg_pgoffset ? 0 : sg->offset;
++		miter->piter.sg_pgoffset += miter->__offset >> PAGE_SHIFT;
++		miter->__offset &= PAGE_SIZE - 1;
+ 		miter->__remaining = sg->offset + sg->length -
+-				(pgoffset << PAGE_SHIFT) - miter->__offset;
++				     (miter->piter.sg_pgoffset << PAGE_SHIFT) -
++				     miter->__offset;
+ 		miter->__remaining = min_t(unsigned long, miter->__remaining,
+ 					   PAGE_SIZE - miter->__offset);
+ 	}
+diff --git a/lib/string.c b/lib/string.c
+index 1530643edf00..33befc6ba3fa 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -203,7 +203,7 @@ ssize_t strscpy(char *dest, const char *src, size_t count)
+ 	while (max >= sizeof(unsigned long)) {
+ 		unsigned long c, data;
+ 
+-		c = *(unsigned long *)(src+res);
++		c = read_word_at_a_time(src+res);
+ 		if (has_zero(c, &data, &constants)) {
+ 			data = prep_zero_mask(c, data, &constants);
+ 			data = create_zero_mask(data);
+diff --git a/mm/filemap.c b/mm/filemap.c
+index e2e738cc08b1..938365ad7e99 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -463,6 +463,28 @@ int filemap_fdatawait_range(struct address_space *mapping, loff_t start_byte,
+ }
+ EXPORT_SYMBOL(filemap_fdatawait_range);
+ 
++/**
++ * filemap_fdatawait_range_keep_errors - wait for writeback to complete
++ * @mapping:		address space structure to wait for
++ * @start_byte:		offset in bytes where the range starts
++ * @end_byte:		offset in bytes where the range ends (inclusive)
++ *
++ * Walk the list of under-writeback pages of the given address space in the
++ * given range and wait for all of them.  Unlike filemap_fdatawait_range(),
++ * this function does not clear error status of the address space.
++ *
++ * Use this function if callers don't handle errors themselves.  Expected
++ * call sites are system-wide / filesystem-wide data flushers: e.g. sync(2),
++ * fsfreeze(8)
++ */
++int filemap_fdatawait_range_keep_errors(struct address_space *mapping,
++		loff_t start_byte, loff_t end_byte)
++{
++	__filemap_fdatawait_range(mapping, start_byte, end_byte);
++	return filemap_check_and_keep_errors(mapping);
++}
++EXPORT_SYMBOL(filemap_fdatawait_range_keep_errors);
++
+ /**
+  * file_fdatawait_range - wait for writeback to complete
+  * @file:		file pointing to address space structure to wait for
+diff --git a/mm/gup.c b/mm/gup.c
+index babcbd6d99c3..12b9626b1a9e 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -442,11 +442,14 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
+ 		pgd = pgd_offset_k(address);
+ 	else
+ 		pgd = pgd_offset_gate(mm, address);
+-	BUG_ON(pgd_none(*pgd));
++	if (pgd_none(*pgd))
++		return -EFAULT;
+ 	p4d = p4d_offset(pgd, address);
+-	BUG_ON(p4d_none(*p4d));
++	if (p4d_none(*p4d))
++		return -EFAULT;
+ 	pud = pud_offset(p4d, address);
+-	BUG_ON(pud_none(*pud));
++	if (pud_none(*pud))
++		return -EFAULT;
+ 	pmd = pmd_offset(pud, address);
+ 	if (!pmd_present(*pmd))
+ 		return -EFAULT;
+@@ -1364,7 +1367,8 @@ static inline pte_t gup_get_pte(pte_t *ptep)
+ }
+ #endif
+ 
+-static void undo_dev_pagemap(int *nr, int nr_start, struct page **pages)
++static void __maybe_unused undo_dev_pagemap(int *nr, int nr_start,
++					    struct page **pages)
+ {
+ 	while ((*nr) - nr_start) {
+ 		struct page *page = pages[--(*nr)];
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index 71ba1c7f8892..d779181bed4d 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -577,7 +577,7 @@ static struct kmemleak_object *create_object(unsigned long ptr, size_t size,
+ 	if (in_irq()) {
+ 		object->pid = 0;
+ 		strncpy(object->comm, "hardirq", sizeof(object->comm));
+-	} else if (in_softirq()) {
++	} else if (in_serving_softirq()) {
+ 		object->pid = 0;
+ 		strncpy(object->comm, "softirq", sizeof(object->comm));
+ 	} else {
+diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c
+index 314285284e6e..70d0efb06374 100644
+--- a/mm/mmu_notifier.c
++++ b/mm/mmu_notifier.c
+@@ -267,7 +267,7 @@ static int do_mmu_notifier_register(struct mmu_notifier *mn,
+ 	 * thanks to mm_take_all_locks().
+ 	 */
+ 	spin_lock(&mm->mmu_notifier_mm->lock);
+-	hlist_add_head(&mn->hlist, &mm->mmu_notifier_mm->list);
++	hlist_add_head_rcu(&mn->hlist, &mm->mmu_notifier_mm->list);
+ 	spin_unlock(&mm->mmu_notifier_mm->lock);
+ 
+ 	mm_drop_all_locks(mm);
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index 290078e8d4b1..0cc3c1eb15f5 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2120,7 +2120,7 @@ static void shrink_active_list(unsigned long nr_to_scan,
+  *   10TB     320        32GB
+  */
+ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
+-				 struct scan_control *sc, bool actual_reclaim)
++				 struct scan_control *sc, bool trace)
+ {
+ 	enum lru_list active_lru = file * LRU_FILE + LRU_ACTIVE;
+ 	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
+@@ -2146,7 +2146,7 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
+ 	 * rid of the stale workingset quickly.
+ 	 */
+ 	refaults = lruvec_page_state(lruvec, WORKINGSET_ACTIVATE);
+-	if (file && actual_reclaim && lruvec->refaults != refaults) {
++	if (file && lruvec->refaults != refaults) {
+ 		inactive_ratio = 0;
+ 	} else {
+ 		gb = (inactive + active) >> (30 - PAGE_SHIFT);
+@@ -2156,7 +2156,7 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
+ 			inactive_ratio = 1;
+ 	}
+ 
+-	if (actual_reclaim)
++	if (trace)
+ 		trace_mm_vmscan_inactive_list_is_low(pgdat->node_id, sc->reclaim_idx,
+ 			lruvec_lru_size(lruvec, inactive_lru, MAX_NR_ZONES), inactive,
+ 			lruvec_lru_size(lruvec, active_lru, MAX_NR_ZONES), active,
+diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
+index e73fd647065a..f88911cffa1a 100644
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -764,10 +764,16 @@ static struct p9_trans_module p9_virtio_trans = {
+ /* The standard init function */
+ static int __init p9_virtio_init(void)
+ {
++	int rc;
++
+ 	INIT_LIST_HEAD(&virtio_chan_list);
+ 
+ 	v9fs_register_trans(&p9_virtio_trans);
+-	return register_virtio_driver(&p9_virtio_drv);
++	rc = register_virtio_driver(&p9_virtio_drv);
++	if (rc)
++		v9fs_unregister_trans(&p9_virtio_trans);
++
++	return rc;
+ }
+ 
+ static void __exit p9_virtio_cleanup(void)
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index 389eb635ec2c..ea9f1773abc8 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -530,13 +530,19 @@ static struct xenbus_driver xen_9pfs_front_driver = {
+ 
+ static int p9_trans_xen_init(void)
+ {
++	int rc;
++
+ 	if (!xen_domain())
+ 		return -ENODEV;
+ 
+ 	pr_info("Initialising Xen transport for 9pfs\n");
+ 
+ 	v9fs_register_trans(&p9_xen_trans);
+-	return xenbus_register_frontend(&xen_9pfs_front_driver);
++	rc = xenbus_register_frontend(&xen_9pfs_front_driver);
++	if (rc)
++		v9fs_unregister_trans(&p9_xen_trans);
++
++	return rc;
+ }
+ module_init(p9_trans_xen_init);
+ 
+diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
+index 020a8adc4cce..2c2670b85fa9 100644
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -3750,6 +3750,8 @@ static void batadv_tt_purge(struct work_struct *work)
+ 
+ void batadv_tt_free(struct batadv_priv *bat_priv)
+ {
++	batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_ROAM, 1);
++
+ 	batadv_tvlv_container_unregister(bat_priv, BATADV_TVLV_TT, 1);
+ 	batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_TT, 1);
+ 
+diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
+index 4e2576fc0c59..357475cceec6 100644
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -187,10 +187,16 @@ static inline struct lowpan_peer *peer_lookup_dst(struct lowpan_btle_dev *dev,
+ 	}
+ 
+ 	if (!rt) {
+-		nexthop = &lowpan_cb(skb)->gw;
+-
+-		if (ipv6_addr_any(nexthop))
+-			return NULL;
++		if (ipv6_addr_any(&lowpan_cb(skb)->gw)) {
++			/* There is neither route nor gateway,
++			 * probably the destination is a direct peer.
++			 */
++			nexthop = daddr;
++		} else {
++			/* There is a known gateway
++			 */
++			nexthop = &lowpan_cb(skb)->gw;
++		}
+ 	} else {
+ 		nexthop = rt6_nexthop(rt, daddr);
+ 
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 363dc85bbc5c..3d2f64a6d623 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -5089,6 +5089,11 @@ static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
+ 		return send_conn_param_neg_reply(hdev, handle,
+ 						 HCI_ERROR_UNKNOWN_CONN_ID);
+ 
++	if (min < hcon->le_conn_min_interval ||
++	    max > hcon->le_conn_max_interval)
++		return send_conn_param_neg_reply(hdev, handle,
++						 HCI_ERROR_INVALID_LL_PARAMS);
++
+ 	if (hci_check_conn_params(min, max, latency, timeout))
+ 		return send_conn_param_neg_reply(hdev, handle,
+ 						 HCI_ERROR_INVALID_LL_PARAMS);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 0ee64f67300a..4dc1db85a9c2 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -4384,6 +4384,12 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
+ 
+ 	l2cap_chan_lock(chan);
+ 
++	if (chan->state != BT_DISCONN) {
++		l2cap_chan_unlock(chan);
++		mutex_unlock(&conn->chan_lock);
++		return 0;
++	}
++
+ 	l2cap_chan_hold(chan);
+ 	l2cap_chan_del(chan, 0);
+ 
+@@ -5281,7 +5287,14 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
+ 
+ 	memset(&rsp, 0, sizeof(rsp));
+ 
+-	err = hci_check_conn_params(min, max, latency, to_multiplier);
++	if (min < hcon->le_conn_min_interval ||
++	    max > hcon->le_conn_max_interval) {
++		BT_DBG("requested connection interval exceeds current bounds.");
++		err = -EINVAL;
++	} else {
++		err = hci_check_conn_params(min, max, latency, to_multiplier);
++	}
++
+ 	if (err)
+ 		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
+ 	else
+diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
+index dbcc439fc78b..6e9a247b15d7 100644
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -2571,6 +2571,19 @@ static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
+ 		goto distribute;
+ 	}
+ 
++	/* Drop IRK if peer is using identity address during pairing but is
++	 * providing different address as identity information.
++	 *
++	 * Microsoft Surface Precision Mouse is known to have this bug.
++	 */
++	if (hci_is_identity_address(&hcon->dst, hcon->dst_type) &&
++	    (bacmp(&info->bdaddr, &hcon->dst) ||
++	     info->addr_type != hcon->dst_type)) {
++		bt_dev_err(hcon->hdev,
++			   "ignoring IRK with invalid identity address");
++		goto distribute;
++	}
++
+ 	bacpy(&smp->id_addr, &info->bdaddr);
+ 	smp->id_addr_type = info->addr_type;
+ 
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index e83048cb53ce..5cd83145c7d8 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1120,6 +1120,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
+ 	int type;
+ 	int err = 0;
+ 	__be32 group;
++	u16 nsrcs;
+ 
+ 	ih = igmpv3_report_hdr(skb);
+ 	num = ntohs(ih->ngrec);
+@@ -1133,8 +1134,9 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
+ 		grec = (void *)(skb->data + len - sizeof(*grec));
+ 		group = grec->grec_mca;
+ 		type = grec->grec_type;
++		nsrcs = ntohs(grec->grec_nsrcs);
+ 
+-		len += ntohs(grec->grec_nsrcs) * 4;
++		len += nsrcs * 4;
+ 		if (!pskb_may_pull(skb, len))
+ 			return -EINVAL;
+ 
+@@ -1155,7 +1157,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
+ 		src = eth_hdr(skb)->h_source;
+ 		if ((type == IGMPV3_CHANGE_TO_INCLUDE ||
+ 		     type == IGMPV3_MODE_IS_INCLUDE) &&
+-		    ntohs(grec->grec_nsrcs) == 0) {
++		    nsrcs == 0) {
+ 			br_ip4_multicast_leave_group(br, port, group, vid, src);
+ 		} else {
+ 			err = br_ip4_multicast_add_group(br, port, group, vid,
+@@ -1190,23 +1192,26 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
+ 	len = skb_transport_offset(skb) + sizeof(*icmp6h);
+ 
+ 	for (i = 0; i < num; i++) {
+-		__be16 *nsrcs, _nsrcs;
+-
+-		nsrcs = skb_header_pointer(skb,
+-					   len + offsetof(struct mld2_grec,
+-							  grec_nsrcs),
+-					   sizeof(_nsrcs), &_nsrcs);
+-		if (!nsrcs)
++		__be16 *_nsrcs, __nsrcs;
++		u16 nsrcs;
++
++		_nsrcs = skb_header_pointer(skb,
++					    len + offsetof(struct mld2_grec,
++							   grec_nsrcs),
++					    sizeof(__nsrcs), &__nsrcs);
++		if (!_nsrcs)
+ 			return -EINVAL;
+ 
++		nsrcs = ntohs(*_nsrcs);
++
+ 		if (!pskb_may_pull(skb,
+ 				   len + sizeof(*grec) +
+-				   sizeof(struct in6_addr) * ntohs(*nsrcs)))
++				   sizeof(struct in6_addr) * nsrcs))
+ 			return -EINVAL;
+ 
+ 		grec = (struct mld2_grec *)(skb->data + len);
+ 		len += sizeof(*grec) +
+-		       sizeof(struct in6_addr) * ntohs(*nsrcs);
++		       sizeof(struct in6_addr) * nsrcs;
+ 
+ 		/* We treat these as MLDv1 reports for now. */
+ 		switch (grec->grec_type) {
+@@ -1225,7 +1230,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
+ 		src = eth_hdr(skb)->h_source;
+ 		if ((grec->grec_type == MLD2_CHANGE_TO_INCLUDE ||
+ 		     grec->grec_type == MLD2_MODE_IS_INCLUDE) &&
+-		    ntohs(*nsrcs) == 0) {
++		    nsrcs == 0) {
+ 			br_ip6_multicast_leave_group(br, port, &grec->grec_mca,
+ 						     vid, src);
+ 		} else {
+@@ -1477,7 +1482,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
+ 				  struct sk_buff *skb,
+ 				  u16 vid)
+ {
+-	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
+ 	struct mld_msg *mld;
+ 	struct net_bridge_mdb_entry *mp;
+ 	struct mld2_query *mld2q;
+@@ -1521,7 +1525,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
+ 
+ 	if (is_general_query) {
+ 		saddr.proto = htons(ETH_P_IPV6);
+-		saddr.u.ip6 = ip6h->saddr;
++		saddr.u.ip6 = ipv6_hdr(skb)->saddr;
+ 
+ 		br_multicast_query_received(br, port, &br->ip6_other_query,
+ 					    &saddr, max_delay);
+diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
+index 1b75d6bf12bd..37ddcea3fc96 100644
+--- a/net/bridge/br_stp_bpdu.c
++++ b/net/bridge/br_stp_bpdu.c
+@@ -147,7 +147,6 @@ void br_send_tcn_bpdu(struct net_bridge_port *p)
+ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
+ 		struct net_device *dev)
+ {
+-	const unsigned char *dest = eth_hdr(skb)->h_dest;
+ 	struct net_bridge_port *p;
+ 	struct net_bridge *br;
+ 	const unsigned char *buf;
+@@ -176,7 +175,7 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
+ 	if (p->state == BR_STATE_DISABLED)
+ 		goto out;
+ 
+-	if (!ether_addr_equal(dest, br->group_addr))
++	if (!ether_addr_equal(eth_hdr(skb)->h_dest, br->group_addr))
+ 		goto out;
+ 
+ 	if (p->flags & BR_BPDU_GUARD) {
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 61396648381e..a3646230fbee 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3122,7 +3122,8 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+ 			strncpy(name, optval, min_t(long, optlen,
+ 						    TCP_CA_NAME_MAX-1));
+ 			name[TCP_CA_NAME_MAX-1] = 0;
+-			ret = tcp_set_congestion_control(sk, name, false, reinit);
++			ret = tcp_set_congestion_control(sk, name, false,
++							 reinit, true);
+ 		} else {
+ 			struct tcp_sock *tp = tcp_sk(sk);
+ 
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 04b0e399361a..eb3efeabac91 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1018,6 +1018,7 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
+ 
+ 			atomic_set(&neigh->probes,
+ 				   NEIGH_VAR(neigh->parms, UCAST_PROBES));
++			neigh_del_timer(neigh);
+ 			neigh->nud_state     = NUD_INCOMPLETE;
+ 			neigh->updated = now;
+ 			next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
+@@ -1034,6 +1035,7 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
+ 		}
+ 	} else if (neigh->nud_state & NUD_STALE) {
+ 		neigh_dbg(2, "neigh %p is delayed\n", neigh);
++		neigh_del_timer(neigh);
+ 		neigh->nud_state = NUD_DELAY;
+ 		neigh->updated = jiffies;
+ 		neigh_add_timer(neigh, jiffies +
+diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
+index bffa88ecc534..5264510c9983 100644
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -66,6 +66,11 @@
+ #include <net/net_namespace.h>
+ #include <net/addrconf.h>
+ 
++#define IPV6ONLY_FLAGS	\
++		(IFA_F_NODAD | IFA_F_OPTIMISTIC | IFA_F_DADFAILED | \
++		 IFA_F_HOMEADDRESS | IFA_F_TENTATIVE | \
++		 IFA_F_MANAGETEMPADDR | IFA_F_STABLE_PRIVACY)
++
+ static struct ipv4_devconf ipv4_devconf = {
+ 	.data = {
+ 		[IPV4_DEVCONF_ACCEPT_REDIRECTS - 1] = 1,
+@@ -455,6 +460,9 @@ static int __inet_insert_ifa(struct in_ifaddr *ifa, struct nlmsghdr *nlh,
+ 	ifa->ifa_flags &= ~IFA_F_SECONDARY;
+ 	last_primary = &in_dev->ifa_list;
+ 
++	/* Don't set IPv6 only flags to IPv4 addresses */
++	ifa->ifa_flags &= ~IPV6ONLY_FLAGS;
++
+ 	for (ifap = &in_dev->ifa_list; (ifa1 = *ifap) != NULL;
+ 	     ifap = &ifa1->ifa_next) {
+ 		if (!(ifa1->ifa_flags & IFA_F_SECONDARY) &&
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index 94604f9bd0d7..b6f0ee01f2e0 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -1220,12 +1220,8 @@ static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im)
+ 		im->interface = pmc->interface;
+ 		im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
+ 		if (im->sfmode == MCAST_INCLUDE) {
+-			im->tomb = pmc->tomb;
+-			pmc->tomb = NULL;
+-
+-			im->sources = pmc->sources;
+-			pmc->sources = NULL;
+-
++			swap(im->tomb, pmc->tomb);
++			swap(im->sources, pmc->sources);
+ 			for (psf = im->sources; psf; psf = psf->sf_next)
+ 				psf->sf_crcount = im->crcount;
+ 		}
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index d51571be9eac..541686f3f835 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2366,6 +2366,8 @@ int tcp_disconnect(struct sock *sk, int flags)
+ 	dst_release(sk->sk_rx_dst);
+ 	sk->sk_rx_dst = NULL;
+ 	tcp_saved_syn_free(tp);
++	tp->bytes_acked = 0;
++	tp->bytes_received = 0;
+ 
+ 	/* Clean up fastopen related fields */
+ 	tcp_free_fastopen_req(tp);
+@@ -2500,7 +2502,9 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+ 		name[val] = 0;
+ 
+ 		lock_sock(sk);
+-		err = tcp_set_congestion_control(sk, name, true, true);
++		err = tcp_set_congestion_control(sk, name, true, true,
++						 ns_capable(sock_net(sk)->user_ns,
++							    CAP_NET_ADMIN));
+ 		release_sock(sk);
+ 		return err;
+ 	}
+diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
+index 2f26124fd160..494e3c3a21a1 100644
+--- a/net/ipv4/tcp_cong.c
++++ b/net/ipv4/tcp_cong.c
+@@ -338,7 +338,8 @@ out:
+  * tcp_reinit_congestion_control (if the current congestion control was
+  * already initialized.
+  */
+-int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, bool reinit)
++int tcp_set_congestion_control(struct sock *sk, const char *name, bool load,
++			       bool reinit, bool cap_net_admin)
+ {
+ 	struct inet_connection_sock *icsk = inet_csk(sk);
+ 	const struct tcp_congestion_ops *ca;
+@@ -372,8 +373,7 @@ int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, boo
+ 		} else {
+ 			err = -EBUSY;
+ 		}
+-	} else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) ||
+-		     ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))) {
++	} else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) || cap_net_admin)) {
+ 		err = -EPERM;
+ 	} else if (!try_module_get(ca->owner)) {
+ 		err = -EBUSY;
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index b095551a5773..ac38b47e9f86 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2438,8 +2438,10 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
+ 		goto out;
+ 	}
+ 	err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
+-	if (err < 0)
++	if (err < 0) {
++		kfree_skb(out_skb);
+ 		goto out;
++	}
+ 
+ 	out_hdr = (struct sadb_msg *) out_skb->data;
+ 	out_hdr->sadb_msg_version = hdr->sadb_msg_version;
+@@ -2690,8 +2692,10 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
+ 		return PTR_ERR(out_skb);
+ 
+ 	err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
+-	if (err < 0)
++	if (err < 0) {
++		kfree_skb(out_skb);
+ 		return err;
++	}
+ 
+ 	out_hdr = (struct sadb_msg *) out_skb->data;
+ 	out_hdr->sadb_msg_version = pfk->dump.msg_version;
+diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
+index dfd268166e42..42d9cd22447e 100644
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -624,7 +624,7 @@ retry:
+ 					goto cleanup;
+ 				}
+ 				m->size = AHASH_INIT_SIZE;
+-				extsize = ext_size(AHASH_INIT_SIZE, dsize);
++				extsize += ext_size(AHASH_INIT_SIZE, dsize);
+ 				RCU_INIT_POINTER(hbucket(t, key), m);
+ 			} else if (m->pos >= m->size) {
+ 				struct hbucket *ht;
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index ee97ce176b9a..2156571455db 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -2206,7 +2206,6 @@ static const struct nf_hook_ops ip_vs_ops[] = {
+ static int __net_init __ip_vs_init(struct net *net)
+ {
+ 	struct netns_ipvs *ipvs;
+-	int ret;
+ 
+ 	ipvs = net_generic(net, ip_vs_net_id);
+ 	if (ipvs == NULL)
+@@ -2238,17 +2237,11 @@ static int __net_init __ip_vs_init(struct net *net)
+ 	if (ip_vs_sync_net_init(ipvs) < 0)
+ 		goto sync_fail;
+ 
+-	ret = nf_register_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
+-	if (ret < 0)
+-		goto hook_fail;
+-
+ 	return 0;
+ /*
+  * Error handling
+  */
+ 
+-hook_fail:
+-	ip_vs_sync_net_cleanup(ipvs);
+ sync_fail:
+ 	ip_vs_conn_net_cleanup(ipvs);
+ conn_fail:
+@@ -2278,6 +2271,19 @@ static void __net_exit __ip_vs_cleanup(struct net *net)
+ 	net->ipvs = NULL;
+ }
+ 
++static int __net_init __ip_vs_dev_init(struct net *net)
++{
++	int ret;
++
++	ret = nf_register_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
++	if (ret < 0)
++		goto hook_fail;
++	return 0;
++
++hook_fail:
++	return ret;
++}
++
+ static void __net_exit __ip_vs_dev_cleanup(struct net *net)
+ {
+ 	struct netns_ipvs *ipvs = net_ipvs(net);
+@@ -2297,6 +2303,7 @@ static struct pernet_operations ipvs_core_ops = {
+ };
+ 
+ static struct pernet_operations ipvs_core_dev_ops = {
++	.init = __ip_vs_dev_init,
+ 	.exit = __ip_vs_dev_cleanup,
+ };
+ 
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 6d7608b88f66..4648dccebf59 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -2414,9 +2414,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
+ 			cfg.syncid = dm->syncid;
+ 			ret = start_sync_thread(ipvs, &cfg, dm->state);
+ 		} else {
+-			mutex_lock(&ipvs->sync_mutex);
+ 			ret = stop_sync_thread(ipvs, dm->state);
+-			mutex_unlock(&ipvs->sync_mutex);
+ 		}
+ 		goto out_dec;
+ 	}
+@@ -3524,10 +3522,8 @@ static int ip_vs_genl_del_daemon(struct netns_ipvs *ipvs, struct nlattr **attrs)
+ 	if (!attrs[IPVS_DAEMON_ATTR_STATE])
+ 		return -EINVAL;
+ 
+-	mutex_lock(&ipvs->sync_mutex);
+ 	ret = stop_sync_thread(ipvs,
+ 			       nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
+-	mutex_unlock(&ipvs->sync_mutex);
+ 	return ret;
+ }
+ 
+diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
+index 5e07f7a6794e..b578ebb3d7ef 100644
+--- a/net/netfilter/ipvs/ip_vs_sync.c
++++ b/net/netfilter/ipvs/ip_vs_sync.c
+@@ -195,6 +195,7 @@ union ip_vs_sync_conn {
+ #define IPVS_OPT_F_PARAM	(1 << (IPVS_OPT_PARAM-1))
+ 
+ struct ip_vs_sync_thread_data {
++	struct task_struct *task;
+ 	struct netns_ipvs *ipvs;
+ 	struct socket *sock;
+ 	char *buf;
+@@ -374,8 +375,11 @@ static inline void sb_queue_tail(struct netns_ipvs *ipvs,
+ 					      max(IPVS_SYNC_SEND_DELAY, 1));
+ 		ms->sync_queue_len++;
+ 		list_add_tail(&sb->list, &ms->sync_queue);
+-		if ((++ms->sync_queue_delay) == IPVS_SYNC_WAKEUP_RATE)
+-			wake_up_process(ms->master_thread);
++		if ((++ms->sync_queue_delay) == IPVS_SYNC_WAKEUP_RATE) {
++			int id = (int)(ms - ipvs->ms);
++
++			wake_up_process(ipvs->master_tinfo[id].task);
++		}
+ 	} else
+ 		ip_vs_sync_buff_release(sb);
+ 	spin_unlock(&ipvs->sync_lock);
+@@ -1645,8 +1649,10 @@ static void master_wakeup_work_handler(struct work_struct *work)
+ 	spin_lock_bh(&ipvs->sync_lock);
+ 	if (ms->sync_queue_len &&
+ 	    ms->sync_queue_delay < IPVS_SYNC_WAKEUP_RATE) {
++		int id = (int)(ms - ipvs->ms);
++
+ 		ms->sync_queue_delay = IPVS_SYNC_WAKEUP_RATE;
+-		wake_up_process(ms->master_thread);
++		wake_up_process(ipvs->master_tinfo[id].task);
+ 	}
+ 	spin_unlock_bh(&ipvs->sync_lock);
+ }
+@@ -1712,10 +1718,6 @@ done:
+ 	if (sb)
+ 		ip_vs_sync_buff_release(sb);
+ 
+-	/* release the sending multicast socket */
+-	sock_release(tinfo->sock);
+-	kfree(tinfo);
+-
+ 	return 0;
+ }
+ 
+@@ -1749,11 +1751,6 @@ static int sync_thread_backup(void *data)
+ 		}
+ 	}
+ 
+-	/* release the sending multicast socket */
+-	sock_release(tinfo->sock);
+-	kfree(tinfo->buf);
+-	kfree(tinfo);
+-
+ 	return 0;
+ }
+ 
+@@ -1761,8 +1758,8 @@ static int sync_thread_backup(void *data)
+ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
+ 		      int state)
+ {
+-	struct ip_vs_sync_thread_data *tinfo = NULL;
+-	struct task_struct **array = NULL, *task;
++	struct ip_vs_sync_thread_data *ti = NULL, *tinfo;
++	struct task_struct *task;
+ 	struct net_device *dev;
+ 	char *name;
+ 	int (*threadfn)(void *data);
+@@ -1831,7 +1828,7 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
+ 		threadfn = sync_thread_master;
+ 	} else if (state == IP_VS_STATE_BACKUP) {
+ 		result = -EEXIST;
+-		if (ipvs->backup_threads)
++		if (ipvs->backup_tinfo)
+ 			goto out_early;
+ 
+ 		ipvs->bcfg = *c;
+@@ -1858,28 +1855,22 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
+ 					  master_wakeup_work_handler);
+ 			ms->ipvs = ipvs;
+ 		}
+-	} else {
+-		array = kcalloc(count, sizeof(struct task_struct *),
+-				GFP_KERNEL);
+-		result = -ENOMEM;
+-		if (!array)
+-			goto out;
+ 	}
++	result = -ENOMEM;
++	ti = kcalloc(count, sizeof(struct ip_vs_sync_thread_data),
++		     GFP_KERNEL);
++	if (!ti)
++		goto out;
+ 
+ 	for (id = 0; id < count; id++) {
+-		result = -ENOMEM;
+-		tinfo = kmalloc(sizeof(*tinfo), GFP_KERNEL);
+-		if (!tinfo)
+-			goto out;
++		tinfo = &ti[id];
+ 		tinfo->ipvs = ipvs;
+-		tinfo->sock = NULL;
+ 		if (state == IP_VS_STATE_BACKUP) {
++			result = -ENOMEM;
+ 			tinfo->buf = kmalloc(ipvs->bcfg.sync_maxlen,
+ 					     GFP_KERNEL);
+ 			if (!tinfo->buf)
+ 				goto out;
+-		} else {
+-			tinfo->buf = NULL;
+ 		}
+ 		tinfo->id = id;
+ 		if (state == IP_VS_STATE_MASTER)
+@@ -1894,17 +1885,15 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
+ 			result = PTR_ERR(task);
+ 			goto out;
+ 		}
+-		tinfo = NULL;
+-		if (state == IP_VS_STATE_MASTER)
+-			ipvs->ms[id].master_thread = task;
+-		else
+-			array[id] = task;
++		tinfo->task = task;
+ 	}
+ 
+ 	/* mark as active */
+ 
+-	if (state == IP_VS_STATE_BACKUP)
+-		ipvs->backup_threads = array;
++	if (state == IP_VS_STATE_MASTER)
++		ipvs->master_tinfo = ti;
++	else
++		ipvs->backup_tinfo = ti;
+ 	spin_lock_bh(&ipvs->sync_buff_lock);
+ 	ipvs->sync_state |= state;
+ 	spin_unlock_bh(&ipvs->sync_buff_lock);
+@@ -1919,29 +1908,31 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
+ 
+ out:
+ 	/* We do not need RTNL lock anymore, release it here so that
+-	 * sock_release below and in the kthreads can use rtnl_lock
+-	 * to leave the mcast group.
++	 * sock_release below can use rtnl_lock to leave the mcast group.
+ 	 */
+ 	rtnl_unlock();
+-	count = id;
+-	while (count-- > 0) {
+-		if (state == IP_VS_STATE_MASTER)
+-			kthread_stop(ipvs->ms[count].master_thread);
+-		else
+-			kthread_stop(array[count]);
++	id = min(id, count - 1);
++	if (ti) {
++		for (tinfo = ti + id; tinfo >= ti; tinfo--) {
++			if (tinfo->task)
++				kthread_stop(tinfo->task);
++		}
+ 	}
+ 	if (!(ipvs->sync_state & IP_VS_STATE_MASTER)) {
+ 		kfree(ipvs->ms);
+ 		ipvs->ms = NULL;
+ 	}
+ 	mutex_unlock(&ipvs->sync_mutex);
+-	if (tinfo) {
+-		if (tinfo->sock)
+-			sock_release(tinfo->sock);
+-		kfree(tinfo->buf);
+-		kfree(tinfo);
++
++	/* No more mutexes, release socks */
++	if (ti) {
++		for (tinfo = ti + id; tinfo >= ti; tinfo--) {
++			if (tinfo->sock)
++				sock_release(tinfo->sock);
++			kfree(tinfo->buf);
++		}
++		kfree(ti);
+ 	}
+-	kfree(array);
+ 	return result;
+ 
+ out_early:
+@@ -1953,15 +1944,18 @@ out_early:
+ 
+ int stop_sync_thread(struct netns_ipvs *ipvs, int state)
+ {
+-	struct task_struct **array;
++	struct ip_vs_sync_thread_data *ti, *tinfo;
+ 	int id;
+ 	int retc = -EINVAL;
+ 
+ 	IP_VS_DBG(7, "%s(): pid %d\n", __func__, task_pid_nr(current));
+ 
++	mutex_lock(&ipvs->sync_mutex);
+ 	if (state == IP_VS_STATE_MASTER) {
++		retc = -ESRCH;
+ 		if (!ipvs->ms)
+-			return -ESRCH;
++			goto err;
++		ti = ipvs->master_tinfo;
+ 
+ 		/*
+ 		 * The lock synchronizes with sb_queue_tail(), so that we don't
+@@ -1980,38 +1974,56 @@ int stop_sync_thread(struct netns_ipvs *ipvs, int state)
+ 			struct ipvs_master_sync_state *ms = &ipvs->ms[id];
+ 			int ret;
+ 
++			tinfo = &ti[id];
+ 			pr_info("stopping master sync thread %d ...\n",
+-				task_pid_nr(ms->master_thread));
++				task_pid_nr(tinfo->task));
+ 			cancel_delayed_work_sync(&ms->master_wakeup_work);
+-			ret = kthread_stop(ms->master_thread);
++			ret = kthread_stop(tinfo->task);
+ 			if (retc >= 0)
+ 				retc = ret;
+ 		}
+ 		kfree(ipvs->ms);
+ 		ipvs->ms = NULL;
++		ipvs->master_tinfo = NULL;
+ 	} else if (state == IP_VS_STATE_BACKUP) {
+-		if (!ipvs->backup_threads)
+-			return -ESRCH;
++		retc = -ESRCH;
++		if (!ipvs->backup_tinfo)
++			goto err;
++		ti = ipvs->backup_tinfo;
+ 
+ 		ipvs->sync_state &= ~IP_VS_STATE_BACKUP;
+-		array = ipvs->backup_threads;
+ 		retc = 0;
+ 		for (id = ipvs->threads_mask; id >= 0; id--) {
+ 			int ret;
+ 
++			tinfo = &ti[id];
+ 			pr_info("stopping backup sync thread %d ...\n",
+-				task_pid_nr(array[id]));
+-			ret = kthread_stop(array[id]);
++				task_pid_nr(tinfo->task));
++			ret = kthread_stop(tinfo->task);
+ 			if (retc >= 0)
+ 				retc = ret;
+ 		}
+-		kfree(array);
+-		ipvs->backup_threads = NULL;
++		ipvs->backup_tinfo = NULL;
++	} else {
++		goto err;
+ 	}
++	id = ipvs->threads_mask;
++	mutex_unlock(&ipvs->sync_mutex);
++
++	/* No more mutexes, release socks */
++	for (tinfo = ti + id; tinfo >= ti; tinfo--) {
++		if (tinfo->sock)
++			sock_release(tinfo->sock);
++		kfree(tinfo->buf);
++	}
++	kfree(ti);
+ 
+ 	/* decrease the module use count */
+ 	ip_vs_use_count_dec();
++	return retc;
+ 
++err:
++	mutex_unlock(&ipvs->sync_mutex);
+ 	return retc;
+ }
+ 
+@@ -2030,7 +2042,6 @@ void ip_vs_sync_net_cleanup(struct netns_ipvs *ipvs)
+ {
+ 	int retc;
+ 
+-	mutex_lock(&ipvs->sync_mutex);
+ 	retc = stop_sync_thread(ipvs, IP_VS_STATE_MASTER);
+ 	if (retc && retc != -ESRCH)
+ 		pr_err("Failed to stop Master Daemon\n");
+@@ -2038,5 +2049,4 @@ void ip_vs_sync_net_cleanup(struct netns_ipvs *ipvs)
+ 	retc = stop_sync_thread(ipvs, IP_VS_STATE_BACKUP);
+ 	if (retc && retc != -ESRCH)
+ 		pr_err("Failed to stop Backup Daemon\n");
+-	mutex_unlock(&ipvs->sync_mutex);
+ }
+diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
+index 8260b1e73bbd..37efcc1c8887 100644
+--- a/net/netfilter/nf_queue.c
++++ b/net/netfilter/nf_queue.c
+@@ -138,6 +138,11 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
+ 		goto err;
+ 	}
+ 
++	if (!skb_dst_force(skb) && state->hook != NF_INET_PRE_ROUTING) {
++		status = -ENETDOWN;
++		goto err;
++	}
++
+ 	*entry = (struct nf_queue_entry) {
+ 		.skb	= skb,
+ 		.state	= *state,
+@@ -146,7 +151,6 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
+ 	};
+ 
+ 	nf_queue_entry_get_refs(entry);
+-	skb_dst_force(skb);
+ 	afinfo->saveroute(skb, entry);
+ 	status = qh->outfn(entry, queuenum);
+ 
+diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
+index fc876b0c3e06..aebc804c10aa 100644
+--- a/net/netrom/af_netrom.c
++++ b/net/netrom/af_netrom.c
+@@ -871,7 +871,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
+ 	unsigned short frametype, flags, window, timeout;
+ 	int ret;
+ 
+-	skb->sk = NULL;		/* Initially we don't know who it's for */
++	skb_orphan(skb);
+ 
+ 	/*
+ 	 *	skb->data points to the netrom frame start
+@@ -969,7 +969,9 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
+ 
+ 	window = skb->data[20];
+ 
++	sock_hold(make);
+ 	skb->sk             = make;
++	skb->destructor     = sock_efree;
+ 	make->sk_state	    = TCP_ESTABLISHED;
+ 
+ 	/* Fill in his circuit details */
+diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c
+index 908f25e3773e..5405d073804c 100644
+--- a/net/nfc/nci/data.c
++++ b/net/nfc/nci/data.c
+@@ -119,7 +119,7 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev,
+ 	conn_info = nci_get_conn_info_by_conn_id(ndev, conn_id);
+ 	if (!conn_info) {
+ 		rc = -EPROTO;
+-		goto free_exit;
++		goto exit;
+ 	}
+ 
+ 	__skb_queue_head_init(&frags_q);
+diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
+index a54a556fcdb5..5601e2c6ac05 100644
+--- a/net/openvswitch/actions.c
++++ b/net/openvswitch/actions.c
+@@ -174,8 +174,7 @@ static void update_ethertype(struct sk_buff *skb, struct ethhdr *hdr,
+ 	if (skb->ip_summed == CHECKSUM_COMPLETE) {
+ 		__be16 diff[] = { ~(hdr->h_proto), ethertype };
+ 
+-		skb->csum = ~csum_partial((char *)diff, sizeof(diff),
+-					~skb->csum);
++		skb->csum = csum_partial((char *)diff, sizeof(diff), skb->csum);
+ 	}
+ 
+ 	hdr->h_proto = ethertype;
+@@ -267,8 +266,7 @@ static int set_mpls(struct sk_buff *skb, struct sw_flow_key *flow_key,
+ 	if (skb->ip_summed == CHECKSUM_COMPLETE) {
+ 		__be32 diff[] = { ~(stack->label_stack_entry), lse };
+ 
+-		skb->csum = ~csum_partial((char *)diff, sizeof(diff),
+-					  ~skb->csum);
++		skb->csum = csum_partial((char *)diff, sizeof(diff), skb->csum);
+ 	}
+ 
+ 	stack->label_stack_entry = lse;
+diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
+index 2a32f60652d8..296b9efe6641 100644
+--- a/net/rxrpc/af_rxrpc.c
++++ b/net/rxrpc/af_rxrpc.c
+@@ -504,6 +504,7 @@ static int rxrpc_sendmsg(struct socket *sock, struct msghdr *m, size_t len)
+ 
+ 	switch (rx->sk.sk_state) {
+ 	case RXRPC_UNBOUND:
++	case RXRPC_CLIENT_UNBOUND:
+ 		rx->srx.srx_family = AF_RXRPC;
+ 		rx->srx.srx_service = 0;
+ 		rx->srx.transport_type = SOCK_DGRAM;
+@@ -528,10 +529,9 @@ static int rxrpc_sendmsg(struct socket *sock, struct msghdr *m, size_t len)
+ 		}
+ 
+ 		rx->local = local;
+-		rx->sk.sk_state = RXRPC_CLIENT_UNBOUND;
++		rx->sk.sk_state = RXRPC_CLIENT_BOUND;
+ 		/* Fall through */
+ 
+-	case RXRPC_CLIENT_UNBOUND:
+ 	case RXRPC_CLIENT_BOUND:
+ 		if (!m->msg_name &&
+ 		    test_bit(RXRPC_SOCK_CONNECTED, &rx->flags)) {
+diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
+index 2c63f7b169b5..3bee93bc5d11 100644
+--- a/net/vmw_vsock/hyperv_transport.c
++++ b/net/vmw_vsock/hyperv_transport.c
+@@ -217,18 +217,6 @@ static void hvs_set_channel_pending_send_size(struct vmbus_channel *chan)
+ 	set_channel_pending_send_size(chan,
+ 				      HVS_PKT_LEN(HVS_SEND_BUF_SIZE));
+ 
+-	/* See hvs_stream_has_space(): we must make sure the host has seen
+-	 * the new pending send size, before we can re-check the writable
+-	 * bytes.
+-	 */
+-	virt_mb();
+-}
+-
+-static void hvs_clear_channel_pending_send_size(struct vmbus_channel *chan)
+-{
+-	set_channel_pending_send_size(chan, 0);
+-
+-	/* Ditto */
+ 	virt_mb();
+ }
+ 
+@@ -298,9 +286,6 @@ static void hvs_channel_cb(void *ctx)
+ 	if (hvs_channel_readable(chan))
+ 		sk->sk_data_ready(sk);
+ 
+-	/* See hvs_stream_has_space(): when we reach here, the writable bytes
+-	 * may be already less than HVS_PKT_LEN(HVS_SEND_BUF_SIZE).
+-	 */
+ 	if (hv_get_bytes_to_write(&chan->outbound) > 0)
+ 		sk->sk_write_space(sk);
+ }
+@@ -328,8 +313,9 @@ static void hvs_open_connection(struct vmbus_channel *chan)
+ 
+ 	struct sockaddr_vm addr;
+ 	struct sock *sk, *new = NULL;
+-	struct vsock_sock *vnew;
+-	struct hvsock *hvs, *hvs_new;
++	struct vsock_sock *vnew = NULL;
++	struct hvsock *hvs = NULL;
++	struct hvsock *hvs_new = NULL;
+ 	int ret;
+ 
+ 	if_type = &chan->offermsg.offer.if_type;
+@@ -389,6 +375,13 @@ static void hvs_open_connection(struct vmbus_channel *chan)
+ 	set_per_channel_state(chan, conn_from_host ? new : sk);
+ 	vmbus_set_chn_rescind_callback(chan, hvs_close_connection);
+ 
++	/* Set the pending send size to max packet size to always get
++	 * notifications from the host when there is enough writable space.
++	 * The host is optimized to send notifications only when the pending
++	 * size boundary is crossed, and not always.
++	 */
++	hvs_set_channel_pending_send_size(chan);
++
+ 	if (conn_from_host) {
+ 		new->sk_state = SS_CONNECTED;
+ 		sk->sk_ack_backlog++;
+@@ -652,23 +645,8 @@ static s64 hvs_stream_has_data(struct vsock_sock *vsk)
+ static s64 hvs_stream_has_space(struct vsock_sock *vsk)
+ {
+ 	struct hvsock *hvs = vsk->trans;
+-	struct vmbus_channel *chan = hvs->chan;
+-	s64 ret;
+-
+-	ret = hvs_channel_writable_bytes(chan);
+-	if (ret > 0)  {
+-		hvs_clear_channel_pending_send_size(chan);
+-	} else {
+-		/* See hvs_channel_cb() */
+-		hvs_set_channel_pending_send_size(chan);
+-
+-		/* Re-check the writable bytes to avoid race */
+-		ret = hvs_channel_writable_bytes(chan);
+-		if (ret > 0)
+-			hvs_clear_channel_pending_send_size(chan);
+-	}
+ 
+-	return ret;
++	return hvs_channel_writable_bytes(hvs->chan);
+ }
+ 
+ static u64 hvs_stream_rcvhiwat(struct vsock_sock *vsk)
+diff --git a/net/xfrm/Kconfig b/net/xfrm/Kconfig
+index 286ed25c1a69..2e747ae7dc89 100644
+--- a/net/xfrm/Kconfig
++++ b/net/xfrm/Kconfig
+@@ -14,6 +14,8 @@ config XFRM_ALGO
+ 	tristate
+ 	select XFRM
+ 	select CRYPTO
++	select CRYPTO_HASH
++	select CRYPTO_BLKCIPHER
+ 
+ config XFRM_USER
+ 	tristate "Transformation user configuration interface"
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 919b8406028c..150c58dc8a7b 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -150,6 +150,25 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
+ 
+ 	err = -EINVAL;
+ 	switch (p->family) {
++	case AF_INET:
++		break;
++
++	case AF_INET6:
++#if IS_ENABLED(CONFIG_IPV6)
++		break;
++#else
++		err = -EAFNOSUPPORT;
++		goto out;
++#endif
++
++	default:
++		goto out;
++	}
++
++	switch (p->sel.family) {
++	case AF_UNSPEC:
++		break;
++
+ 	case AF_INET:
+ 		if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
+ 			goto out;
+diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
+index 1dd24c5b9b47..b471022c8162 100644
+--- a/scripts/kallsyms.c
++++ b/scripts/kallsyms.c
+@@ -160,6 +160,9 @@ static int read_symbol(FILE *in, struct sym_entry *s)
+ 	/* exclude debugging symbols */
+ 	else if (stype == 'N' || stype == 'n')
+ 		return -1;
++	/* exclude s390 kasan local symbols */
++	else if (!strncmp(sym, ".LASANPC", 8))
++		return -1;
+ 
+ 	/* include the type field in the symbol name, so that it gets
+ 	 * compressed together */
+diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
+index b9897e2be404..04151ede8043 100644
+--- a/scripts/recordmcount.h
++++ b/scripts/recordmcount.h
+@@ -326,7 +326,8 @@ static uint_t *sift_rel_mcount(uint_t *mlocp,
+ 		if (!mcountsym)
+ 			mcountsym = get_mcountsym(sym0, relp, str0);
+ 
+-		if (mcountsym == Elf_r_sym(relp) && !is_fake_mcount(relp)) {
++		if (mcountsym && mcountsym == Elf_r_sym(relp) &&
++				!is_fake_mcount(relp)) {
+ 			uint_t const addend =
+ 				_w(_w(relp->r_offset) - recval + mcount_adjust);
+ 			mrelp->r_offset = _w(offbase
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 7d2c07c1237c..cc5b4c25d6f1 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1001,7 +1001,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
+ {
+ 	struct snd_seq_client *client = file->private_data;
+ 	int written = 0, len;
+-	int err;
++	int err, handled;
+ 	struct snd_seq_event event;
+ 
+ 	if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT))
+@@ -1014,6 +1014,8 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
+ 	if (!client->accept_output || client->pool == NULL)
+ 		return -ENXIO;
+ 
++ repeat:
++	handled = 0;
+ 	/* allocate the pool now if the pool is not allocated yet */ 
+ 	mutex_lock(&client->ioctl_mutex);
+ 	if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
+@@ -1073,12 +1075,19 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
+ 						   0, 0, &client->ioctl_mutex);
+ 		if (err < 0)
+ 			break;
++		handled++;
+ 
+ 	__skip_event:
+ 		/* Update pointers and counts */
+ 		count -= len;
+ 		buf += len;
+ 		written += len;
++
++		/* let's have a coffee break if too many events are queued */
++		if (++handled >= 200) {
++			mutex_unlock(&client->ioctl_mutex);
++			goto repeat;
++		}
+ 	}
+ 
+  out:
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index d14516f31679..7bdf10e754f5 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1127,6 +1127,7 @@ static int patch_conexant_auto(struct hda_codec *codec)
+  */
+ 
+ static const struct hda_device_id snd_hda_id_conexant[] = {
++	HDA_CODEC_ENTRY(0x14f11f86, "CX8070", patch_conexant_auto),
+ 	HDA_CODEC_ENTRY(0x14f12008, "CX8200", patch_conexant_auto),
+ 	HDA_CODEC_ENTRY(0x14f15045, "CX20549 (Venice)", patch_conexant_auto),
+ 	HDA_CODEC_ENTRY(0x14f15047, "CX20551 (Waikiki)", patch_conexant_auto),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 20914a33ca5d..6d32c44cd0c8 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8149,6 +8149,11 @@ static const struct snd_hda_pin_quirk alc662_pin_fixup_tbl[] = {
+ 		{0x18, 0x01a19030},
+ 		{0x1a, 0x01813040},
+ 		{0x21, 0x01014020}),
++	SND_HDA_PIN_QUIRK(0x10ec0867, 0x1028, "Dell", ALC891_FIXUP_DELL_MIC_NO_PRESENCE,
++		{0x16, 0x01813030},
++		{0x17, 0x02211010},
++		{0x18, 0x01a19040},
++		{0x21, 0x01014020}),
+ 	SND_HDA_PIN_QUIRK(0x10ec0662, 0x1028, "Dell", ALC662_FIXUP_DELL_MIC_NO_PRESENCE,
+ 		{0x14, 0x01014010},
+ 		{0x18, 0x01a19020},
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index e9f7c6287376..b4c8ba412a5c 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2120,23 +2120,25 @@ void snd_soc_dapm_debugfs_init(struct snd_soc_dapm_context *dapm,
+ {
+ 	struct dentry *d;
+ 
+-	if (!parent)
++	if (!parent || IS_ERR(parent))
+ 		return;
+ 
+ 	dapm->debugfs_dapm = debugfs_create_dir("dapm", parent);
+ 
+-	if (!dapm->debugfs_dapm) {
++	if (IS_ERR(dapm->debugfs_dapm)) {
+ 		dev_warn(dapm->dev,
+-		       "ASoC: Failed to create DAPM debugfs directory\n");
++			 "ASoC: Failed to create DAPM debugfs directory %ld\n",
++			 PTR_ERR(dapm->debugfs_dapm));
+ 		return;
+ 	}
+ 
+ 	d = debugfs_create_file("bias_level", 0444,
+ 				dapm->debugfs_dapm, dapm,
+ 				&dapm_bias_fops);
+-	if (!d)
++	if (IS_ERR(d))
+ 		dev_warn(dapm->dev,
+-			 "ASoC: Failed to create bias level debugfs file\n");
++			 "ASoC: Failed to create bias level debugfs file: %ld\n",
++			 PTR_ERR(d));
+ }
+ 
+ static void dapm_debugfs_add_widget(struct snd_soc_dapm_widget *w)
+@@ -2150,10 +2152,10 @@ static void dapm_debugfs_add_widget(struct snd_soc_dapm_widget *w)
+ 	d = debugfs_create_file(w->name, 0444,
+ 				dapm->debugfs_dapm, w,
+ 				&dapm_widget_power_fops);
+-	if (!d)
++	if (IS_ERR(d))
+ 		dev_warn(w->dapm->dev,
+-			"ASoC: Failed to create %s debugfs file\n",
+-			w->name);
++			 "ASoC: Failed to create %s debugfs file: %ld\n",
++			 w->name, PTR_ERR(d));
+ }
+ 
+ static void dapm_debugfs_cleanup(struct snd_soc_dapm_context *dapm)
+diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c
+index ee6a68c6e1c1..1513fbaf70c2 100644
+--- a/sound/usb/line6/podhd.c
++++ b/sound/usb/line6/podhd.c
+@@ -415,7 +415,7 @@ static const struct line6_properties podhd_properties_table[] = {
+ 		.name = "POD HD500",
+ 		.capabilities	= LINE6_CAP_PCM
+ 				| LINE6_CAP_HWMON,
+-		.altsetting = 1,
++		.altsetting = 0,
+ 		.ep_ctrl_r = 0x81,
+ 		.ep_ctrl_w = 0x01,
+ 		.ep_audio_r = 0x86,
+diff --git a/tools/iio/iio_utils.c b/tools/iio/iio_utils.c
+index 7a6d61c6c012..55272fef3b50 100644
+--- a/tools/iio/iio_utils.c
++++ b/tools/iio/iio_utils.c
+@@ -159,9 +159,9 @@ int iioutils_get_type(unsigned *is_signed, unsigned *bytes, unsigned *bits_used,
+ 			*be = (endianchar == 'b');
+ 			*bytes = padint / 8;
+ 			if (*bits_used == 64)
+-				*mask = ~0;
++				*mask = ~(0ULL);
+ 			else
+-				*mask = (1ULL << *bits_used) - 1;
++				*mask = (1ULL << *bits_used) - 1ULL;
+ 
+ 			*is_signed = (signchar == 's');
+ 			if (fclose(sysfsfp)) {
+diff --git a/tools/perf/arch/arm/util/cs-etm.c b/tools/perf/arch/arm/util/cs-etm.c
+index fbfc055d3f4d..aec62e822bab 100644
+--- a/tools/perf/arch/arm/util/cs-etm.c
++++ b/tools/perf/arch/arm/util/cs-etm.c
+@@ -43,6 +43,8 @@ struct cs_etm_recording {
+ 	struct auxtrace_record	itr;
+ 	struct perf_pmu		*cs_etm_pmu;
+ 	struct perf_evlist	*evlist;
++	int			wrapped_cnt;
++	bool			*wrapped;
+ 	bool			snapshot_mode;
+ 	size_t			snapshot_size;
+ };
+@@ -485,16 +487,131 @@ static int cs_etm_info_fill(struct auxtrace_record *itr,
+ 	return 0;
+ }
+ 
+-static int cs_etm_find_snapshot(struct auxtrace_record *itr __maybe_unused,
++static int cs_etm_alloc_wrapped_array(struct cs_etm_recording *ptr, int idx)
++{
++	bool *wrapped;
++	int cnt = ptr->wrapped_cnt;
++
++	/* Make @ptr->wrapped as big as @idx */
++	while (cnt <= idx)
++		cnt++;
++
++	/*
++	 * Free'ed in cs_etm_recording_free().  Using realloc() to avoid
++	 * cross compilation problems where the host's system supports
++	 * reallocarray() but not the target.
++	 */
++	wrapped = realloc(ptr->wrapped, cnt * sizeof(bool));
++	if (!wrapped)
++		return -ENOMEM;
++
++	wrapped[cnt - 1] = false;
++	ptr->wrapped_cnt = cnt;
++	ptr->wrapped = wrapped;
++
++	return 0;
++}
++
++static bool cs_etm_buffer_has_wrapped(unsigned char *buffer,
++				      size_t buffer_size, u64 head)
++{
++	u64 i, watermark;
++	u64 *buf = (u64 *)buffer;
++	size_t buf_size = buffer_size;
++
++	/*
++	 * We want to look the very last 512 byte (chosen arbitrarily) in
++	 * the ring buffer.
++	 */
++	watermark = buf_size - 512;
++
++	/*
++	 * @head is continuously increasing - if its value is equal or greater
++	 * than the size of the ring buffer, it has wrapped around.
++	 */
++	if (head >= buffer_size)
++		return true;
++
++	/*
++	 * The value of @head is somewhere within the size of the ring buffer.
++	 * This can be that there hasn't been enough data to fill the ring
++	 * buffer yet or the trace time was so long that @head has numerically
++	 * wrapped around.  To find we need to check if we have data at the very
++	 * end of the ring buffer.  We can reliably do this because mmap'ed
++	 * pages are zeroed out and there is a fresh mapping with every new
++	 * session.
++	 */
++
++	/* @head is less than 512 byte from the end of the ring buffer */
++	if (head > watermark)
++		watermark = head;
++
++	/*
++	 * Speed things up by using 64 bit transactions (see "u64 *buf" above)
++	 */
++	watermark >>= 3;
++	buf_size >>= 3;
++
++	/*
++	 * If we find trace data at the end of the ring buffer, @head has
++	 * been there and has numerically wrapped around at least once.
++	 */
++	for (i = watermark; i < buf_size; i++)
++		if (buf[i])
++			return true;
++
++	return false;
++}
++
++static int cs_etm_find_snapshot(struct auxtrace_record *itr,
+ 				int idx, struct auxtrace_mmap *mm,
+-				unsigned char *data __maybe_unused,
++				unsigned char *data,
+ 				u64 *head, u64 *old)
+ {
++	int err;
++	bool wrapped;
++	struct cs_etm_recording *ptr =
++			container_of(itr, struct cs_etm_recording, itr);
++
++	/*
++	 * Allocate memory to keep track of wrapping if this is the first
++	 * time we deal with this *mm.
++	 */
++	if (idx >= ptr->wrapped_cnt) {
++		err = cs_etm_alloc_wrapped_array(ptr, idx);
++		if (err)
++			return err;
++	}
++
++	/*
++	 * Check to see if *head has wrapped around.  If it hasn't only the
++	 * amount of data between *head and *old is snapshot'ed to avoid
++	 * bloating the perf.data file with zeros.  But as soon as *head has
++	 * wrapped around the entire size of the AUX ring buffer it taken.
++	 */
++	wrapped = ptr->wrapped[idx];
++	if (!wrapped && cs_etm_buffer_has_wrapped(data, mm->len, *head)) {
++		wrapped = true;
++		ptr->wrapped[idx] = true;
++	}
++
+ 	pr_debug3("%s: mmap index %d old head %zu new head %zu size %zu\n",
+ 		  __func__, idx, (size_t)*old, (size_t)*head, mm->len);
+ 
+-	*old = *head;
+-	*head += mm->len;
++	/* No wrap has occurred, we can just use *head and *old. */
++	if (!wrapped)
++		return 0;
++
++	/*
++	 * *head has wrapped around - adjust *head and *old to pickup the
++	 * entire content of the AUX buffer.
++	 */
++	if (*head >= mm->len) {
++		*old = *head - mm->len;
++	} else {
++		*head += mm->len;
++		*old = *head - mm->len;
++	}
+ 
+ 	return 0;
+ }
+@@ -535,6 +652,8 @@ static void cs_etm_recording_free(struct auxtrace_record *itr)
+ {
+ 	struct cs_etm_recording *ptr =
+ 			container_of(itr, struct cs_etm_recording, itr);
++
++	zfree(&ptr->wrapped);
+ 	free(ptr);
+ }
+ 
+diff --git a/tools/perf/perf.h b/tools/perf/perf.h
+index 96f62dd7e3ed..d4ebd0956114 100644
+--- a/tools/perf/perf.h
++++ b/tools/perf/perf.h
+@@ -25,7 +25,7 @@ static inline unsigned long long rdclock(void)
+ }
+ 
+ #ifndef MAX_NR_CPUS
+-#define MAX_NR_CPUS			1024
++#define MAX_NR_CPUS			2048
+ #endif
+ 
+ extern const char *input_name;
+diff --git a/tools/perf/tests/mmap-thread-lookup.c b/tools/perf/tests/mmap-thread-lookup.c
+index 3c3f3e029e33..2ecb86876f10 100644
+--- a/tools/perf/tests/mmap-thread-lookup.c
++++ b/tools/perf/tests/mmap-thread-lookup.c
+@@ -52,7 +52,7 @@ static void *thread_fn(void *arg)
+ {
+ 	struct thread_data *td = arg;
+ 	ssize_t ret;
+-	int go;
++	int go = 0;
+ 
+ 	if (thread_init(td))
+ 		return NULL;
+diff --git a/tools/perf/tests/parse-events.c b/tools/perf/tests/parse-events.c
+index f0679613bd18..424b82a7d078 100644
+--- a/tools/perf/tests/parse-events.c
++++ b/tools/perf/tests/parse-events.c
+@@ -19,6 +19,32 @@
+ #define PERF_TP_SAMPLE_TYPE (PERF_SAMPLE_RAW | PERF_SAMPLE_TIME | \
+ 			     PERF_SAMPLE_CPU | PERF_SAMPLE_PERIOD)
+ 
++#if defined(__s390x__)
++/* Return true if kvm module is available and loaded. Test this
++ * and retun success when trace point kvm_s390_create_vm
++ * exists. Otherwise this test always fails.
++ */
++static bool kvm_s390_create_vm_valid(void)
++{
++	char *eventfile;
++	bool rc = false;
++
++	eventfile = get_events_file("kvm-s390");
++
++	if (eventfile) {
++		DIR *mydir = opendir(eventfile);
++
++		if (mydir) {
++			rc = true;
++			closedir(mydir);
++		}
++		put_events_file(eventfile);
++	}
++
++	return rc;
++}
++#endif
++
+ static int test__checkevent_tracepoint(struct perf_evlist *evlist)
+ {
+ 	struct perf_evsel *evsel = perf_evlist__first(evlist);
+@@ -1600,6 +1626,7 @@ static struct evlist_test test__events[] = {
+ 	{
+ 		.name  = "kvm-s390:kvm_s390_create_vm",
+ 		.check = test__checkevent_tracepoint,
++		.valid = kvm_s390_create_vm_valid,
+ 		.id    = 100,
+ 	},
+ #endif
+diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
+index 398d4cc2f0e4..2a8d2a6723f6 100644
+--- a/tools/perf/util/annotate.c
++++ b/tools/perf/util/annotate.c
+@@ -868,16 +868,14 @@ static int disasm_line__parse(char *line, const char **namep, char **rawp)
+ 	*namep = strdup(name);
+ 
+ 	if (*namep == NULL)
+-		goto out_free_name;
++		goto out;
+ 
+ 	(*rawp)[0] = tmp;
+ 	*rawp = ltrim(*rawp);
+ 
+ 	return 0;
+ 
+-out_free_name:
+-	free((void *)namep);
+-	*namep = NULL;
++out:
+ 	return -1;
+ }
+ 
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index 0cf6f537f980..3ab81e8e079e 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -587,6 +587,9 @@ const char *perf_evsel__name(struct perf_evsel *evsel)
+ {
+ 	char bf[128];
+ 
++	if (!evsel)
++		goto out_unknown;
++
+ 	if (evsel->name)
+ 		return evsel->name;
+ 
+@@ -623,7 +626,10 @@ const char *perf_evsel__name(struct perf_evsel *evsel)
+ 
+ 	evsel->name = strdup(bf);
+ 
+-	return evsel->name ?: "unknown";
++	if (evsel->name)
++		return evsel->name;
++out_unknown:
++	return "unknown";
+ }
+ 
+ const char *perf_evsel__group_name(struct perf_evsel *evsel)
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index f11cead6a151..26437143c940 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -1122,7 +1122,7 @@ static int build_caches(struct cpu_cache_level caches[], u32 size, u32 *cntp)
+ 	return 0;
+ }
+ 
+-#define MAX_CACHES 2000
++#define MAX_CACHES (MAX_NR_CPUS * 4)
+ 
+ static int write_cache(struct feat_fd *ff,
+ 		       struct perf_evlist *evlist __maybe_unused)
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index da55081aefc6..c49e8ea1a42c 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -1145,6 +1145,9 @@ static void dump_read(struct perf_evsel *evsel, union perf_event *event)
+ 	       evsel ? perf_evsel__name(evsel) : "FAIL",
+ 	       event->read.value);
+ 
++	if (!evsel)
++		return;
++
+ 	read_format = evsel->attr.read_format;
+ 
+ 	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
+diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c
+index 37363869c9a1..eadc9a2aef16 100644
+--- a/tools/perf/util/stat-shadow.c
++++ b/tools/perf/util/stat-shadow.c
+@@ -271,7 +271,7 @@ static struct perf_evsel *perf_stat__find_event(struct perf_evlist *evsel_list,
+ 	struct perf_evsel *c2;
+ 
+ 	evlist__for_each_entry (evsel_list, c2) {
+-		if (!strcasecmp(c2->name, name))
++		if (!strcasecmp(c2->name, name) && !c2->collect_stat)
+ 			return c2;
+ 	}
+ 	return NULL;
+@@ -310,7 +310,8 @@ void perf_stat__collect_metric_expr(struct perf_evlist *evsel_list)
+ 			if (leader) {
+ 				/* Search in group */
+ 				for_each_group_member (oc, leader) {
+-					if (!strcasecmp(oc->name, metric_names[i])) {
++					if (!strcasecmp(oc->name, metric_names[i]) &&
++						!oc->collect_stat) {
+ 						found = true;
+ 						break;
+ 					}
+diff --git a/tools/power/cpupower/utils/cpufreq-set.c b/tools/power/cpupower/utils/cpufreq-set.c
+index 1eef0aed6423..08a405593a79 100644
+--- a/tools/power/cpupower/utils/cpufreq-set.c
++++ b/tools/power/cpupower/utils/cpufreq-set.c
+@@ -306,6 +306,8 @@ int cmd_freq_set(int argc, char **argv)
+ 				bitmask_setbit(cpus_chosen, cpus->cpu);
+ 				cpus = cpus->next;
+ 			}
++			/* Set the last cpu in related cpus list */
++			bitmask_setbit(cpus_chosen, cpus->cpu);
+ 			cpufreq_put_related_cpus(cpus);
+ 		}
+ 	}