Linux patch 4.4.224.4-24

2 files changed, 3667 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 71b358f8..d60af0ee 100644
--- a/0000_README
+++ b/0000_README
@@ -127,6 +127,10 @@ Patch:  1020_linux-4.4.21.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.4.21
 
+Patch:  1021_linux-4.4.22.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.4.22
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1021_linux-4.4.22.patch b/1021_linux-4.4.22.patch
new file mode 100644
index 00000000..8381b8de
--- /dev/null
+++ b/1021_linux-4.4.22.patch
@@ -0,0 +1,3663 @@
+diff --git a/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt b/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt
+index a9a5fe19ff2a..ec9d65682702 100644
+--- a/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt
++++ b/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt
+@@ -12,6 +12,11 @@ Required properties:
+ - vref-supply: The regulator supply ADC reference voltage.
+ - #io-channel-cells: Should be 1, see ../iio-bindings.txt
+ 
++Optional properties:
++- resets: Must contain an entry for each entry in reset-names if need support
++	  this option. See ../reset/reset.txt for details.
++- reset-names: Must include the name "saradc-apb".
++
+ Example:
+ 	saradc: saradc@2006c000 {
+ 		compatible = "rockchip,saradc";
+@@ -19,6 +24,8 @@ Example:
+ 		interrupts = <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>;
+ 		clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
+ 		clock-names = "saradc", "apb_pclk";
++		resets = <&cru SRST_SARADC>;
++		reset-names = "saradc-apb";
+ 		#io-channel-cells = <1>;
+ 		vref-supply = <&vcc18>;
+ 	};
+diff --git a/Documentation/mic/mpssd/mpssd.c b/Documentation/mic/mpssd/mpssd.c
+index aaeafa18d99b..c99a75968c01 100644
+--- a/Documentation/mic/mpssd/mpssd.c
++++ b/Documentation/mic/mpssd/mpssd.c
+@@ -1538,9 +1538,9 @@ set_cmdline(struct mic_info *mic)
+ 
+ 	len = snprintf(buffer, PATH_MAX,
+ 		"clocksource=tsc highres=off nohz=off ");
+-	len += snprintf(buffer + len, PATH_MAX,
++	len += snprintf(buffer + len, PATH_MAX - len,
+ 		"cpufreq_on;corec6_off;pc3_off;pc6_off ");
+-	len += snprintf(buffer + len, PATH_MAX,
++	len += snprintf(buffer + len, PATH_MAX - len,
+ 		"ifcfg=static;address,172.31.%d.1;netmask,255.255.255.0",
+ 		mic->id + 1);
+ 
+diff --git a/Makefile b/Makefile
+index d1cc9e0b7473..a6512f4eec9f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 21
++SUBLEVEL = 22
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/alpha/include/asm/uaccess.h b/arch/alpha/include/asm/uaccess.h
+index 9b0d40093c9a..c0ddbbf73400 100644
+--- a/arch/alpha/include/asm/uaccess.h
++++ b/arch/alpha/include/asm/uaccess.h
+@@ -371,14 +371,6 @@ __copy_tofrom_user_nocheck(void *to, const void *from, long len)
+ 	return __cu_len;
+ }
+ 
+-extern inline long
+-__copy_tofrom_user(void *to, const void *from, long len, const void __user *validate)
+-{
+-	if (__access_ok((unsigned long)validate, len, get_fs()))
+-		len = __copy_tofrom_user_nocheck(to, from, len);
+-	return len;
+-}
+-
+ #define __copy_to_user(to, from, n)					\
+ ({									\
+ 	__chk_user_ptr(to);						\
+@@ -393,17 +385,22 @@ __copy_tofrom_user(void *to, const void *from, long len, const void __user *vali
+ #define __copy_to_user_inatomic __copy_to_user
+ #define __copy_from_user_inatomic __copy_from_user
+ 
+-
+ extern inline long
+ copy_to_user(void __user *to, const void *from, long n)
+ {
+-	return __copy_tofrom_user((__force void *)to, from, n, to);
++	if (likely(__access_ok((unsigned long)to, n, get_fs())))
++		n = __copy_tofrom_user_nocheck((__force void *)to, from, n);
++	return n;
+ }
+ 
+ extern inline long
+ copy_from_user(void *to, const void __user *from, long n)
+ {
+-	return __copy_tofrom_user(to, (__force void *)from, n, from);
++	if (likely(__access_ok((unsigned long)from, n, get_fs())))
++		n = __copy_tofrom_user_nocheck(to, (__force void *)from, n);
++	else
++		memset(to, 0, n);
++	return n;
+ }
+ 
+ extern void __do_clear_user(void);
+diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
+index 3cab04255ae0..e5fec320f158 100644
+--- a/arch/arc/include/asm/pgtable.h
++++ b/arch/arc/include/asm/pgtable.h
+@@ -277,8 +277,7 @@ static inline void pmd_set(pmd_t *pmdp, pte_t *ptep)
+ 
+ #define mk_pte(page, prot)	pfn_pte(page_to_pfn(page), prot)
+ #define pte_pfn(pte)		(pte_val(pte) >> PAGE_SHIFT)
+-#define pfn_pte(pfn, prot)	(__pte(((pte_t)(pfn) << PAGE_SHIFT) | \
+-				 pgprot_val(prot)))
++#define pfn_pte(pfn, prot)	(__pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot)))
+ #define __pte_index(addr)	(((addr) >> PAGE_SHIFT) & (PTRS_PER_PTE - 1))
+ 
+ /*
+diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h
+index d1da6032b715..d4d8df706efa 100644
+--- a/arch/arc/include/asm/uaccess.h
++++ b/arch/arc/include/asm/uaccess.h
+@@ -83,7 +83,10 @@
+ 	"2:	;nop\n"				\
+ 	"	.section .fixup, \"ax\"\n"	\
+ 	"	.align 4\n"			\
+-	"3:	mov %0, %3\n"			\
++	"3:	# return -EFAULT\n"		\
++	"	mov %0, %3\n"			\
++	"	# zero out dst ptr\n"		\
++	"	mov %1,  0\n"			\
+ 	"	j   2b\n"			\
+ 	"	.previous\n"			\
+ 	"	.section __ex_table, \"a\"\n"	\
+@@ -101,7 +104,11 @@
+ 	"2:	;nop\n"				\
+ 	"	.section .fixup, \"ax\"\n"	\
+ 	"	.align 4\n"			\
+-	"3:	mov %0, %3\n"			\
++	"3:	# return -EFAULT\n"		\
++	"	mov %0, %3\n"			\
++	"	# zero out dst ptr\n"		\
++	"	mov %1,  0\n"			\
++	"	mov %R1, 0\n"			\
+ 	"	j   2b\n"			\
+ 	"	.previous\n"			\
+ 	"	.section __ex_table, \"a\"\n"	\
+diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
+index 2b6cc8bf3c5c..e6af41c4bbc1 100644
+--- a/arch/arm/boot/dts/imx6qdl.dtsi
++++ b/arch/arm/boot/dts/imx6qdl.dtsi
+@@ -221,7 +221,7 @@
+ 					clocks = <&clks IMX6QDL_CLK_SPDIF_GCLK>, <&clks IMX6QDL_CLK_OSC>,
+ 						 <&clks IMX6QDL_CLK_SPDIF>, <&clks IMX6QDL_CLK_ASRC>,
+ 						 <&clks IMX6QDL_CLK_DUMMY>, <&clks IMX6QDL_CLK_ESAI_EXTAL>,
+-						 <&clks IMX6QDL_CLK_IPG>, <&clks IMX6QDL_CLK_MLB>,
++						 <&clks IMX6QDL_CLK_IPG>, <&clks IMX6QDL_CLK_DUMMY>,
+ 						 <&clks IMX6QDL_CLK_DUMMY>, <&clks IMX6QDL_CLK_SPBA>;
+ 					clock-names = "core",  "rxtx0",
+ 						      "rxtx1", "rxtx2",
+diff --git a/arch/arm/boot/dts/kirkwood-ib62x0.dts b/arch/arm/boot/dts/kirkwood-ib62x0.dts
+index bfa5edde179c..2c1e7f09205f 100644
+--- a/arch/arm/boot/dts/kirkwood-ib62x0.dts
++++ b/arch/arm/boot/dts/kirkwood-ib62x0.dts
+@@ -113,7 +113,7 @@
+ 
+ 	partition@e0000 {
+ 		label = "u-boot environment";
+-		reg = <0xe0000 0x100000>;
++		reg = <0xe0000 0x20000>;
+ 	};
+ 
+ 	partition@100000 {
+diff --git a/arch/arm/boot/dts/omap3-overo-base.dtsi b/arch/arm/boot/dts/omap3-overo-base.dtsi
+index a29ad16cc9bb..64c5af30c1d0 100644
+--- a/arch/arm/boot/dts/omap3-overo-base.dtsi
++++ b/arch/arm/boot/dts/omap3-overo-base.dtsi
+@@ -223,7 +223,9 @@
+ };
+ 
+ &gpmc {
+-	ranges = <0 0 0x00000000 0x20000000>;
++	ranges = <0 0 0x30000000 0x1000000>,	/* CS0 */
++		 <4 0 0x2b000000 0x1000000>,	/* CS4 */
++		 <5 0 0x2c000000 0x1000000>;	/* CS5 */
+ 
+ 	nand@0,0 {
+ 		linux,mtd-name= "micron,mt29c4g96maz";
+diff --git a/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi b/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
+index 17b82f82638a..64047788216b 100644
+--- a/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
++++ b/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
+@@ -55,8 +55,6 @@
+ #include "omap-gpmc-smsc9221.dtsi"
+ 
+ &gpmc {
+-	ranges = <5 0 0x2c000000 0x1000000>;	/* CS5 */
+-
+ 	ethernet@gpmc {
+ 		reg = <5 0 0xff>;
+ 		interrupt-parent = <&gpio6>;
+diff --git a/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
+index 9e24b6a1d07b..1b304e2f1bd2 100644
+--- a/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
++++ b/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
+@@ -27,8 +27,6 @@
+ #include "omap-gpmc-smsc9221.dtsi"
+ 
+ &gpmc {
+-	ranges = <5 0 0x2c000000 0x1000000>;	/* CS5 */
+-
+ 	ethernet@gpmc {
+ 		reg = <5 0 0xff>;
+ 		interrupt-parent = <&gpio6>;
+diff --git a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
+index 334109e14613..82e98ee3023a 100644
+--- a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
++++ b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
+@@ -15,9 +15,6 @@
+ #include "omap-gpmc-smsc9221.dtsi"
+ 
+ &gpmc {
+-	ranges = <4 0 0x2b000000 0x1000000>,	/* CS4 */
+-		 <5 0 0x2c000000 0x1000000>;	/* CS5 */
+-
+ 	smsc1: ethernet@gpmc {
+ 		reg = <5 0 0xff>;
+ 		interrupt-parent = <&gpio6>;
+diff --git a/arch/arm/boot/dts/stih407-family.dtsi b/arch/arm/boot/dts/stih407-family.dtsi
+index 81f81214cdf9..bbf95375cf99 100644
+--- a/arch/arm/boot/dts/stih407-family.dtsi
++++ b/arch/arm/boot/dts/stih407-family.dtsi
+@@ -497,8 +497,9 @@
+ 			interrupt-names = "mmcirq";
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&pinctrl_mmc0>;
+-			clock-names = "mmc";
+-			clocks = <&clk_s_c0_flexgen CLK_MMC_0>;
++			clock-names = "mmc", "icn";
++			clocks = <&clk_s_c0_flexgen CLK_MMC_0>,
++				 <&clk_s_c0_flexgen CLK_RX_ICN_HVA>;
+ 			bus-width = <8>;
+ 			non-removable;
+ 		};
+@@ -512,8 +513,9 @@
+ 			interrupt-names = "mmcirq";
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&pinctrl_sd1>;
+-			clock-names = "mmc";
+-			clocks = <&clk_s_c0_flexgen CLK_MMC_1>;
++			clock-names = "mmc", "icn";
++			clocks = <&clk_s_c0_flexgen CLK_MMC_1>,
++				 <&clk_s_c0_flexgen CLK_RX_ICN_HVA>;
+ 			resets = <&softreset STIH407_MMC1_SOFTRESET>;
+ 			bus-width = <4>;
+ 		};
+diff --git a/arch/arm/boot/dts/stih410.dtsi b/arch/arm/boot/dts/stih410.dtsi
+index 18ed1ad10d32..40318869c733 100644
+--- a/arch/arm/boot/dts/stih410.dtsi
++++ b/arch/arm/boot/dts/stih410.dtsi
+@@ -41,7 +41,8 @@
+ 			compatible = "st,st-ohci-300x";
+ 			reg = <0x9a03c00 0x100>;
+ 			interrupts = <GIC_SPI 180 IRQ_TYPE_NONE>;
+-			clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
++			clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
++				 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
+ 			resets = <&powerdown STIH407_USB2_PORT0_POWERDOWN>,
+ 				 <&softreset STIH407_USB2_PORT0_SOFTRESET>;
+ 			reset-names = "power", "softreset";
+@@ -57,7 +58,8 @@
+ 			interrupts = <GIC_SPI 151 IRQ_TYPE_NONE>;
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&pinctrl_usb0>;
+-			clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
++			clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
++				 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
+ 			resets = <&powerdown STIH407_USB2_PORT0_POWERDOWN>,
+ 				 <&softreset STIH407_USB2_PORT0_SOFTRESET>;
+ 			reset-names = "power", "softreset";
+@@ -71,7 +73,8 @@
+ 			compatible = "st,st-ohci-300x";
+ 			reg = <0x9a83c00 0x100>;
+ 			interrupts = <GIC_SPI 181 IRQ_TYPE_NONE>;
+-			clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
++			clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
++				 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
+ 			resets = <&powerdown STIH407_USB2_PORT1_POWERDOWN>,
+ 				 <&softreset STIH407_USB2_PORT1_SOFTRESET>;
+ 			reset-names = "power", "softreset";
+@@ -87,7 +90,8 @@
+ 			interrupts = <GIC_SPI 153 IRQ_TYPE_NONE>;
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&pinctrl_usb1>;
+-			clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
++			clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
++				 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
+ 			resets = <&powerdown STIH407_USB2_PORT1_POWERDOWN>,
+ 				 <&softreset STIH407_USB2_PORT1_SOFTRESET>;
+ 			reset-names = "power", "softreset";
+diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
+index e06fd299de08..d7bef2144760 100644
+--- a/arch/arm/kvm/arm.c
++++ b/arch/arm/kvm/arm.c
+@@ -155,8 +155,6 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
+ {
+ 	int i;
+ 
+-	kvm_free_stage2_pgd(kvm);
+-
+ 	for (i = 0; i < KVM_MAX_VCPUS; ++i) {
+ 		if (kvm->vcpus[i]) {
+ 			kvm_arch_vcpu_free(kvm->vcpus[i]);
+diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
+index 12d727fae0a7..11b6595c2672 100644
+--- a/arch/arm/kvm/mmu.c
++++ b/arch/arm/kvm/mmu.c
+@@ -1852,6 +1852,7 @@ void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots)
+ 
+ void kvm_arch_flush_shadow_all(struct kvm *kvm)
+ {
++	kvm_free_stage2_pgd(kvm);
+ }
+ 
+ void kvm_arch_flush_shadow_memslot(struct kvm *kvm,
+diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
+index 4470376af5f8..a19d20f23e71 100644
+--- a/arch/arm/mach-imx/pm-imx6.c
++++ b/arch/arm/mach-imx/pm-imx6.c
+@@ -295,7 +295,7 @@ int imx6_set_lpm(enum mxc_cpu_pwr_mode mode)
+ 		val &= ~BM_CLPCR_SBYOS;
+ 		if (cpu_is_imx6sl())
+ 			val |= BM_CLPCR_BYPASS_PMIC_READY;
+-		if (cpu_is_imx6sl() || cpu_is_imx6sx())
++		if (cpu_is_imx6sl() || cpu_is_imx6sx() || cpu_is_imx6ul())
+ 			val |= BM_CLPCR_BYP_MMDC_CH0_LPM_HS;
+ 		else
+ 			val |= BM_CLPCR_BYP_MMDC_CH1_LPM_HS;
+@@ -310,7 +310,7 @@ int imx6_set_lpm(enum mxc_cpu_pwr_mode mode)
+ 		val |= 0x3 << BP_CLPCR_STBY_COUNT;
+ 		val |= BM_CLPCR_VSTBY;
+ 		val |= BM_CLPCR_SBYOS;
+-		if (cpu_is_imx6sl())
++		if (cpu_is_imx6sl() || cpu_is_imx6sx())
+ 			val |= BM_CLPCR_BYPASS_PMIC_READY;
+ 		if (cpu_is_imx6sl() || cpu_is_imx6sx() || cpu_is_imx6ul())
+ 			val |= BM_CLPCR_BYP_MMDC_CH0_LPM_HS;
+diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
+index 907a452b78ea..b31ad596be79 100644
+--- a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
++++ b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
+@@ -1474,6 +1474,7 @@ static void omap_hwmod_am43xx_rst(void)
+ {
+ 	RSTCTRL(am33xx_pruss_hwmod, AM43XX_RM_PER_RSTCTRL_OFFSET);
+ 	RSTCTRL(am33xx_gfx_hwmod, AM43XX_RM_GFX_RSTCTRL_OFFSET);
++	RSTST(am33xx_pruss_hwmod, AM43XX_RM_PER_RSTST_OFFSET);
+ 	RSTST(am33xx_gfx_hwmod, AM43XX_RM_GFX_RSTST_OFFSET);
+ }
+ 
+diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+index aff78d5198d2..131f8967589b 100644
+--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
++++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+@@ -723,8 +723,20 @@ static struct omap_hwmod omap3xxx_dss_dispc_hwmod = {
+  * display serial interface controller
+  */
+ 
++static struct omap_hwmod_class_sysconfig omap3xxx_dsi_sysc = {
++	.rev_offs	= 0x0000,
++	.sysc_offs	= 0x0010,
++	.syss_offs	= 0x0014,
++	.sysc_flags	= (SYSC_HAS_AUTOIDLE | SYSC_HAS_CLOCKACTIVITY |
++			   SYSC_HAS_ENAWAKEUP | SYSC_HAS_SIDLEMODE |
++			   SYSC_HAS_SOFTRESET | SYSS_HAS_RESET_STATUS),
++	.idlemodes	= (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
++	.sysc_fields	= &omap_hwmod_sysc_type1,
++};
++
+ static struct omap_hwmod_class omap3xxx_dsi_hwmod_class = {
+ 	.name = "dsi",
++	.sysc	= &omap3xxx_dsi_sysc,
+ };
+ 
+ static struct omap_hwmod_irq_info omap3xxx_dsi1_irqs[] = {
+diff --git a/arch/arm/mach-omap2/prcm43xx.h b/arch/arm/mach-omap2/prcm43xx.h
+index 7c34c44eb0ae..babb5db5a3a4 100644
+--- a/arch/arm/mach-omap2/prcm43xx.h
++++ b/arch/arm/mach-omap2/prcm43xx.h
+@@ -39,6 +39,7 @@
+ 
+ /* RM RSTST offsets */
+ #define AM43XX_RM_GFX_RSTST_OFFSET			0x0014
++#define AM43XX_RM_PER_RSTST_OFFSET			0x0014
+ #define AM43XX_RM_WKUP_RSTST_OFFSET			0x0014
+ 
+ /* CM instances */
+diff --git a/arch/arm64/include/asm/spinlock.h b/arch/arm64/include/asm/spinlock.h
+index c85e96d174a5..499e8de33a00 100644
+--- a/arch/arm64/include/asm/spinlock.h
++++ b/arch/arm64/include/asm/spinlock.h
+@@ -312,4 +312,14 @@ static inline int arch_read_trylock(arch_rwlock_t *rw)
+ #define arch_read_relax(lock)	cpu_relax()
+ #define arch_write_relax(lock)	cpu_relax()
+ 
++/*
++ * Accesses appearing in program order before a spin_lock() operation
++ * can be reordered with accesses inside the critical section, by virtue
++ * of arch_spin_lock being constructed using acquire semantics.
++ *
++ * In cases where this is problematic (e.g. try_to_wake_up), an
++ * smp_mb__before_spinlock() can restore the required ordering.
++ */
++#define smp_mb__before_spinlock()	smp_mb()
++
+ #endif /* __ASM_SPINLOCK_H */
+diff --git a/arch/avr32/include/asm/uaccess.h b/arch/avr32/include/asm/uaccess.h
+index 68cf638faf48..b1ec1fa06463 100644
+--- a/arch/avr32/include/asm/uaccess.h
++++ b/arch/avr32/include/asm/uaccess.h
+@@ -74,7 +74,7 @@ extern __kernel_size_t __copy_user(void *to, const void *from,
+ 
+ extern __kernel_size_t copy_to_user(void __user *to, const void *from,
+ 				    __kernel_size_t n);
+-extern __kernel_size_t copy_from_user(void *to, const void __user *from,
++extern __kernel_size_t ___copy_from_user(void *to, const void __user *from,
+ 				      __kernel_size_t n);
+ 
+ static inline __kernel_size_t __copy_to_user(void __user *to, const void *from,
+@@ -88,6 +88,15 @@ static inline __kernel_size_t __copy_from_user(void *to,
+ {
+ 	return __copy_user(to, (const void __force *)from, n);
+ }
++static inline __kernel_size_t copy_from_user(void *to,
++					       const void __user *from,
++					       __kernel_size_t n)
++{
++	size_t res = ___copy_from_user(to, from, n);
++	if (unlikely(res))
++		memset(to + (n - res), 0, res);
++	return res;
++}
+ 
+ #define __copy_to_user_inatomic __copy_to_user
+ #define __copy_from_user_inatomic __copy_from_user
+diff --git a/arch/avr32/kernel/avr32_ksyms.c b/arch/avr32/kernel/avr32_ksyms.c
+index d93ead02daed..7c6cf14f0985 100644
+--- a/arch/avr32/kernel/avr32_ksyms.c
++++ b/arch/avr32/kernel/avr32_ksyms.c
+@@ -36,7 +36,7 @@ EXPORT_SYMBOL(copy_page);
+ /*
+  * Userspace access stuff.
+  */
+-EXPORT_SYMBOL(copy_from_user);
++EXPORT_SYMBOL(___copy_from_user);
+ EXPORT_SYMBOL(copy_to_user);
+ EXPORT_SYMBOL(__copy_user);
+ EXPORT_SYMBOL(strncpy_from_user);
+diff --git a/arch/avr32/lib/copy_user.S b/arch/avr32/lib/copy_user.S
+index ea59c04b07de..075373471da1 100644
+--- a/arch/avr32/lib/copy_user.S
++++ b/arch/avr32/lib/copy_user.S
+@@ -23,13 +23,13 @@
+ 	 */
+ 	.text
+ 	.align	1
+-	.global	copy_from_user
+-	.type	copy_from_user, @function
+-copy_from_user:
++	.global	___copy_from_user
++	.type	___copy_from_user, @function
++___copy_from_user:
+ 	branch_if_kernel r8, __copy_user
+ 	ret_if_privileged r8, r11, r10, r10
+ 	rjmp	__copy_user
+-	.size	copy_from_user, . - copy_from_user
++	.size	___copy_from_user, . - ___copy_from_user
+ 
+ 	.global	copy_to_user
+ 	.type	copy_to_user, @function
+diff --git a/arch/blackfin/include/asm/uaccess.h b/arch/blackfin/include/asm/uaccess.h
+index 90612a7f2cf3..8cd0184ea9ef 100644
+--- a/arch/blackfin/include/asm/uaccess.h
++++ b/arch/blackfin/include/asm/uaccess.h
+@@ -177,11 +177,12 @@ static inline int bad_user_access_length(void)
+ static inline unsigned long __must_check
+ copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+-	if (access_ok(VERIFY_READ, from, n))
++	if (likely(access_ok(VERIFY_READ, from, n))) {
+ 		memcpy(to, (const void __force *)from, n);
+-	else
+-		return n;
+-	return 0;
++		return 0;
++	}
++	memset(to, 0, n);
++	return n;
+ }
+ 
+ static inline unsigned long __must_check
+diff --git a/arch/cris/include/asm/uaccess.h b/arch/cris/include/asm/uaccess.h
+index e3530d0f13ee..56c7d5750abd 100644
+--- a/arch/cris/include/asm/uaccess.h
++++ b/arch/cris/include/asm/uaccess.h
+@@ -194,30 +194,6 @@ extern unsigned long __copy_user(void __user *to, const void *from, unsigned lon
+ extern unsigned long __copy_user_zeroing(void *to, const void __user *from, unsigned long n);
+ extern unsigned long __do_clear_user(void __user *to, unsigned long n);
+ 
+-static inline unsigned long
+-__generic_copy_to_user(void __user *to, const void *from, unsigned long n)
+-{
+-	if (access_ok(VERIFY_WRITE, to, n))
+-		return __copy_user(to, from, n);
+-	return n;
+-}
+-
+-static inline unsigned long
+-__generic_copy_from_user(void *to, const void __user *from, unsigned long n)
+-{
+-	if (access_ok(VERIFY_READ, from, n))
+-		return __copy_user_zeroing(to, from, n);
+-	return n;
+-}
+-
+-static inline unsigned long
+-__generic_clear_user(void __user *to, unsigned long n)
+-{
+-	if (access_ok(VERIFY_WRITE, to, n))
+-		return __do_clear_user(to, n);
+-	return n;
+-}
+-
+ static inline long
+ __strncpy_from_user(char *dst, const char __user *src, long count)
+ {
+@@ -282,7 +258,7 @@ __constant_copy_from_user(void *to, const void __user *from, unsigned long n)
+ 	else if (n == 24)
+ 		__asm_copy_from_user_24(to, from, ret);
+ 	else
+-		ret = __generic_copy_from_user(to, from, n);
++		ret = __copy_user_zeroing(to, from, n);
+ 
+ 	return ret;
+ }
+@@ -333,7 +309,7 @@ __constant_copy_to_user(void __user *to, const void *from, unsigned long n)
+ 	else if (n == 24)
+ 		__asm_copy_to_user_24(to, from, ret);
+ 	else
+-		ret = __generic_copy_to_user(to, from, n);
++		ret = __copy_user(to, from, n);
+ 
+ 	return ret;
+ }
+@@ -366,26 +342,43 @@ __constant_clear_user(void __user *to, unsigned long n)
+ 	else if (n == 24)
+ 		__asm_clear_24(to, ret);
+ 	else
+-		ret = __generic_clear_user(to, n);
++		ret = __do_clear_user(to, n);
+ 
+ 	return ret;
+ }
+ 
+ 
+-#define clear_user(to, n)				\
+-	(__builtin_constant_p(n) ?			\
+-	 __constant_clear_user(to, n) :			\
+-	 __generic_clear_user(to, n))
++static inline size_t clear_user(void __user *to, size_t n)
++{
++	if (unlikely(!access_ok(VERIFY_WRITE, to, n)))
++		return n;
++	if (__builtin_constant_p(n))
++		return __constant_clear_user(to, n);
++	else
++		return __do_clear_user(to, n);
++}
+ 
+-#define copy_from_user(to, from, n)			\
+-	(__builtin_constant_p(n) ?			\
+-	 __constant_copy_from_user(to, from, n) :	\
+-	 __generic_copy_from_user(to, from, n))
++static inline size_t copy_from_user(void *to, const void __user *from, size_t n)
++{
++	if (unlikely(!access_ok(VERIFY_READ, from, n))) {
++		memset(to, 0, n);
++		return n;
++	}
++	if (__builtin_constant_p(n))
++		return __constant_copy_from_user(to, from, n);
++	else
++		return __copy_user_zeroing(to, from, n);
++}
+ 
+-#define copy_to_user(to, from, n)			\
+-	(__builtin_constant_p(n) ?			\
+-	 __constant_copy_to_user(to, from, n) :		\
+-	 __generic_copy_to_user(to, from, n))
++static inline size_t copy_to_user(void __user *to, const void *from, size_t n)
++{
++	if (unlikely(!access_ok(VERIFY_WRITE, to, n)))
++		return n;
++	if (__builtin_constant_p(n))
++		return __constant_copy_to_user(to, from, n);
++	else
++		return __copy_user(to, from, n);
++}
+ 
+ /* We let the __ versions of copy_from/to_user inline, because they're often
+  * used in fast paths and have only a small space overhead.
+diff --git a/arch/frv/include/asm/uaccess.h b/arch/frv/include/asm/uaccess.h
+index 3ac9a59d65d4..87d9e34c5df8 100644
+--- a/arch/frv/include/asm/uaccess.h
++++ b/arch/frv/include/asm/uaccess.h
+@@ -263,19 +263,25 @@ do {							\
+ extern long __memset_user(void *dst, unsigned long count);
+ extern long __memcpy_user(void *dst, const void *src, unsigned long count);
+ 
+-#define clear_user(dst,count)			__memset_user(____force(dst), (count))
++#define __clear_user(dst,count)			__memset_user(____force(dst), (count))
+ #define __copy_from_user_inatomic(to, from, n)	__memcpy_user((to), ____force(from), (n))
+ #define __copy_to_user_inatomic(to, from, n)	__memcpy_user(____force(to), (from), (n))
+ 
+ #else
+ 
+-#define clear_user(dst,count)			(memset(____force(dst), 0, (count)), 0)
++#define __clear_user(dst,count)			(memset(____force(dst), 0, (count)), 0)
+ #define __copy_from_user_inatomic(to, from, n)	(memcpy((to), ____force(from), (n)), 0)
+ #define __copy_to_user_inatomic(to, from, n)	(memcpy(____force(to), (from), (n)), 0)
+ 
+ #endif
+ 
+-#define __clear_user clear_user
++static inline unsigned long __must_check
++clear_user(void __user *to, unsigned long n)
++{
++	if (likely(__access_ok(to, n)))
++		n = __clear_user(to, n);
++	return n;
++}
+ 
+ static inline unsigned long __must_check
+ __copy_to_user(void __user *to, const void *from, unsigned long n)
+diff --git a/arch/hexagon/include/asm/uaccess.h b/arch/hexagon/include/asm/uaccess.h
+index f000a382bc7f..f61cfb28e9f2 100644
+--- a/arch/hexagon/include/asm/uaccess.h
++++ b/arch/hexagon/include/asm/uaccess.h
+@@ -103,7 +103,8 @@ static inline long hexagon_strncpy_from_user(char *dst, const char __user *src,
+ {
+ 	long res = __strnlen_user(src, n);
+ 
+-	/* return from strnlen can't be zero -- that would be rubbish. */
++	if (unlikely(!res))
++		return -EFAULT;
+ 
+ 	if (res > n) {
+ 		copy_from_user(dst, src, n);
+diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
+index 4f3fb6ccbf21..40c2027a2bf4 100644
+--- a/arch/ia64/include/asm/uaccess.h
++++ b/arch/ia64/include/asm/uaccess.h
+@@ -263,17 +263,15 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
+ 	__cu_len;									\
+ })
+ 
+-#define copy_from_user(to, from, n)							\
+-({											\
+-	void *__cu_to = (to);								\
+-	const void __user *__cu_from = (from);						\
+-	long __cu_len = (n);								\
+-											\
+-	__chk_user_ptr(__cu_from);							\
+-	if (__access_ok(__cu_from, __cu_len, get_fs()))					\
+-		__cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);	\
+-	__cu_len;									\
+-})
++static inline unsigned long
++copy_from_user(void *to, const void __user *from, unsigned long n)
++{
++	if (likely(__access_ok(from, n, get_fs())))
++		n = __copy_user((__force void __user *) to, from, n);
++	else
++		memset(to, 0, n);
++	return n;
++}
+ 
+ #define __copy_in_user(to, from, size)	__copy_user((to), (from), (size))
+ 
+diff --git a/arch/m32r/include/asm/uaccess.h b/arch/m32r/include/asm/uaccess.h
+index cac7014daef3..6f8982157a75 100644
+--- a/arch/m32r/include/asm/uaccess.h
++++ b/arch/m32r/include/asm/uaccess.h
+@@ -219,7 +219,7 @@ extern int fixup_exception(struct pt_regs *regs);
+ #define __get_user_nocheck(x, ptr, size)				\
+ ({									\
+ 	long __gu_err = 0;						\
+-	unsigned long __gu_val;						\
++	unsigned long __gu_val = 0;					\
+ 	might_fault();							\
+ 	__get_user_size(__gu_val, (ptr), (size), __gu_err);		\
+ 	(x) = (__force __typeof__(*(ptr)))__gu_val;			\
+diff --git a/arch/metag/include/asm/uaccess.h b/arch/metag/include/asm/uaccess.h
+index 8282cbce7e39..273e61225c27 100644
+--- a/arch/metag/include/asm/uaccess.h
++++ b/arch/metag/include/asm/uaccess.h
+@@ -204,8 +204,9 @@ extern unsigned long __must_check __copy_user_zeroing(void *to,
+ static inline unsigned long
+ copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+-	if (access_ok(VERIFY_READ, from, n))
++	if (likely(access_ok(VERIFY_READ, from, n)))
+ 		return __copy_user_zeroing(to, from, n);
++	memset(to, 0, n);
+ 	return n;
+ }
+ 
+diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h
+index 331b0d35f89c..826676778094 100644
+--- a/arch/microblaze/include/asm/uaccess.h
++++ b/arch/microblaze/include/asm/uaccess.h
+@@ -227,7 +227,7 @@ extern long __user_bad(void);
+ 
+ #define __get_user(x, ptr)						\
+ ({									\
+-	unsigned long __gu_val;						\
++	unsigned long __gu_val = 0;					\
+ 	/*unsigned long __gu_ptr = (unsigned long)(ptr);*/		\
+ 	long __gu_err;							\
+ 	switch (sizeof(*(ptr))) {					\
+@@ -373,10 +373,13 @@ extern long __user_bad(void);
+ static inline long copy_from_user(void *to,
+ 		const void __user *from, unsigned long n)
+ {
++	unsigned long res = n;
+ 	might_fault();
+-	if (access_ok(VERIFY_READ, from, n))
+-		return __copy_from_user(to, from, n);
+-	return n;
++	if (likely(access_ok(VERIFY_READ, from, n)))
++		res = __copy_from_user(to, from, n);
++	if (unlikely(res))
++		memset(to + (n - res), 0, res);
++	return res;
+ }
+ 
+ #define __copy_to_user(to, from, n)	\
+diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
+index 095ecafe6bd3..c74c32ccc647 100644
+--- a/arch/mips/include/asm/uaccess.h
++++ b/arch/mips/include/asm/uaccess.h
+@@ -14,6 +14,7 @@
+ #include <linux/kernel.h>
+ #include <linux/errno.h>
+ #include <linux/thread_info.h>
++#include <linux/string.h>
+ #include <asm/asm-eva.h>
+ 
+ /*
+@@ -1170,6 +1171,8 @@ extern size_t __copy_in_user_eva(void *__to, const void *__from, size_t __n);
+ 			__cu_len = __invoke_copy_from_user(__cu_to,	\
+ 							   __cu_from,	\
+ 							   __cu_len);   \
++		} else {						\
++			memset(__cu_to, 0, __cu_len);			\
+ 		}							\
+ 	}								\
+ 	__cu_len;							\
+diff --git a/arch/mips/kvm/tlb.c b/arch/mips/kvm/tlb.c
+index 7a7ed9ca01bb..eff71c75dc27 100644
+--- a/arch/mips/kvm/tlb.c
++++ b/arch/mips/kvm/tlb.c
+@@ -152,7 +152,7 @@ static int kvm_mips_map_page(struct kvm *kvm, gfn_t gfn)
+ 	srcu_idx = srcu_read_lock(&kvm->srcu);
+ 	pfn = kvm_mips_gfn_to_pfn(kvm, gfn);
+ 
+-	if (kvm_mips_is_error_pfn(pfn)) {
++	if (is_error_noslot_pfn(pfn)) {
+ 		kvm_err("Couldn't get pfn for gfn %#" PRIx64 "!\n", gfn);
+ 		err = -EFAULT;
+ 		goto out;
+diff --git a/arch/mn10300/include/asm/uaccess.h b/arch/mn10300/include/asm/uaccess.h
+index 537278746a15..4af43d9ba495 100644
+--- a/arch/mn10300/include/asm/uaccess.h
++++ b/arch/mn10300/include/asm/uaccess.h
+@@ -181,6 +181,7 @@ struct __large_struct { unsigned long buf[100]; };
+ 		"2:\n"						\
+ 		"	.section	.fixup,\"ax\"\n"	\
+ 		"3:\n\t"					\
++		"	mov		0,%1\n"			\
+ 		"	mov		%3,%0\n"		\
+ 		"	jmp		2b\n"			\
+ 		"	.previous\n"				\
+diff --git a/arch/mn10300/lib/usercopy.c b/arch/mn10300/lib/usercopy.c
+index 7826e6c364e7..ce8899e5e171 100644
+--- a/arch/mn10300/lib/usercopy.c
++++ b/arch/mn10300/lib/usercopy.c
+@@ -9,7 +9,7 @@
+  * as published by the Free Software Foundation; either version
+  * 2 of the Licence, or (at your option) any later version.
+  */
+-#include <asm/uaccess.h>
++#include <linux/uaccess.h>
+ 
+ unsigned long
+ __generic_copy_to_user(void *to, const void *from, unsigned long n)
+@@ -24,6 +24,8 @@ __generic_copy_from_user(void *to, const void *from, unsigned long n)
+ {
+ 	if (access_ok(VERIFY_READ, from, n))
+ 		__copy_user_zeroing(to, from, n);
++	else
++		memset(to, 0, n);
+ 	return n;
+ }
+ 
+diff --git a/arch/nios2/include/asm/uaccess.h b/arch/nios2/include/asm/uaccess.h
+index caa51ff85a3c..0ab82324c817 100644
+--- a/arch/nios2/include/asm/uaccess.h
++++ b/arch/nios2/include/asm/uaccess.h
+@@ -102,9 +102,12 @@ extern long __copy_to_user(void __user *to, const void *from, unsigned long n);
+ static inline long copy_from_user(void *to, const void __user *from,
+ 				unsigned long n)
+ {
+-	if (!access_ok(VERIFY_READ, from, n))
+-		return n;
+-	return __copy_from_user(to, from, n);
++	unsigned long res = n;
++	if (access_ok(VERIFY_READ, from, n))
++		res = __copy_from_user(to, from, n);
++	if (unlikely(res))
++		memset(to + (n - res), 0, res);
++	return res;
+ }
+ 
+ static inline long copy_to_user(void __user *to, const void *from,
+@@ -139,7 +142,7 @@ extern long strnlen_user(const char __user *s, long n);
+ 
+ #define __get_user_unknown(val, size, ptr, err) do {			\
+ 	err = 0;							\
+-	if (copy_from_user(&(val), ptr, size)) {			\
++	if (__copy_from_user(&(val), ptr, size)) {			\
+ 		err = -EFAULT;						\
+ 	}								\
+ 	} while (0)
+@@ -166,7 +169,7 @@ do {									\
+ 	({								\
+ 	long __gu_err = -EFAULT;					\
+ 	const __typeof__(*(ptr)) __user *__gu_ptr = (ptr);		\
+-	unsigned long __gu_val;						\
++	unsigned long __gu_val = 0;					\
+ 	__get_user_common(__gu_val, sizeof(*(ptr)), __gu_ptr, __gu_err);\
+ 	(x) = (__force __typeof__(x))__gu_val;				\
+ 	__gu_err;							\
+diff --git a/arch/openrisc/include/asm/uaccess.h b/arch/openrisc/include/asm/uaccess.h
+index a6bd07ca3d6c..5cc6b4f1b795 100644
+--- a/arch/openrisc/include/asm/uaccess.h
++++ b/arch/openrisc/include/asm/uaccess.h
+@@ -273,28 +273,20 @@ __copy_tofrom_user(void *to, const void *from, unsigned long size);
+ static inline unsigned long
+ copy_from_user(void *to, const void *from, unsigned long n)
+ {
+-	unsigned long over;
+-
+-	if (access_ok(VERIFY_READ, from, n))
+-		return __copy_tofrom_user(to, from, n);
+-	if ((unsigned long)from < TASK_SIZE) {
+-		over = (unsigned long)from + n - TASK_SIZE;
+-		return __copy_tofrom_user(to, from, n - over) + over;
+-	}
+-	return n;
++	unsigned long res = n;
++
++	if (likely(access_ok(VERIFY_READ, from, n)))
++		res = __copy_tofrom_user(to, from, n);
++	if (unlikely(res))
++		memset(to + (n - res), 0, res);
++	return res;
+ }
+ 
+ static inline unsigned long
+ copy_to_user(void *to, const void *from, unsigned long n)
+ {
+-	unsigned long over;
+-
+-	if (access_ok(VERIFY_WRITE, to, n))
+-		return __copy_tofrom_user(to, from, n);
+-	if ((unsigned long)to < TASK_SIZE) {
+-		over = (unsigned long)to + n - TASK_SIZE;
+-		return __copy_tofrom_user(to, from, n - over) + over;
+-	}
++	if (likely(access_ok(VERIFY_WRITE, to, n)))
++		n = __copy_tofrom_user(to, from, n);
+ 	return n;
+ }
+ 
+@@ -303,13 +295,8 @@ extern unsigned long __clear_user(void *addr, unsigned long size);
+ static inline __must_check unsigned long
+ clear_user(void *addr, unsigned long size)
+ {
+-
+-	if (access_ok(VERIFY_WRITE, addr, size))
+-		return __clear_user(addr, size);
+-	if ((unsigned long)addr < TASK_SIZE) {
+-		unsigned long over = (unsigned long)addr + size - TASK_SIZE;
+-		return __clear_user(addr, size - over) + over;
+-	}
++	if (likely(access_ok(VERIFY_WRITE, addr, size)))
++		size = __clear_user(addr, size);
+ 	return size;
+ }
+ 
+diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
+index 1960b87c1c8b..4ad51465890b 100644
+--- a/arch/parisc/include/asm/uaccess.h
++++ b/arch/parisc/include/asm/uaccess.h
+@@ -10,6 +10,7 @@
+ #include <asm-generic/uaccess-unaligned.h>
+ 
+ #include <linux/bug.h>
++#include <linux/string.h>
+ 
+ #define VERIFY_READ 0
+ #define VERIFY_WRITE 1
+@@ -245,13 +246,14 @@ static inline unsigned long __must_check copy_from_user(void *to,
+                                           unsigned long n)
+ {
+         int sz = __compiletime_object_size(to);
+-        int ret = -EFAULT;
++        unsigned long ret = n;
+ 
+         if (likely(sz == -1 || !__builtin_constant_p(n) || sz >= n))
+                 ret = __copy_from_user(to, from, n);
+         else
+                 copy_from_user_overflow();
+-
++	if (unlikely(ret))
++		memset(to + (n - ret), 0, ret);
+         return ret;
+ }
+ 
+diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
+index 2a8ebae0936b..a5ffe0207c16 100644
+--- a/arch/powerpc/include/asm/uaccess.h
++++ b/arch/powerpc/include/asm/uaccess.h
+@@ -323,30 +323,17 @@ extern unsigned long __copy_tofrom_user(void __user *to,
+ static inline unsigned long copy_from_user(void *to,
+ 		const void __user *from, unsigned long n)
+ {
+-	unsigned long over;
+-
+-	if (access_ok(VERIFY_READ, from, n))
++	if (likely(access_ok(VERIFY_READ, from, n)))
+ 		return __copy_tofrom_user((__force void __user *)to, from, n);
+-	if ((unsigned long)from < TASK_SIZE) {
+-		over = (unsigned long)from + n - TASK_SIZE;
+-		return __copy_tofrom_user((__force void __user *)to, from,
+-				n - over) + over;
+-	}
++	memset(to, 0, n);
+ 	return n;
+ }
+ 
+ static inline unsigned long copy_to_user(void __user *to,
+ 		const void *from, unsigned long n)
+ {
+-	unsigned long over;
+-
+ 	if (access_ok(VERIFY_WRITE, to, n))
+ 		return __copy_tofrom_user(to, (__force void __user *)from, n);
+-	if ((unsigned long)to < TASK_SIZE) {
+-		over = (unsigned long)to + n - TASK_SIZE;
+-		return __copy_tofrom_user(to, (__force void __user *)from,
+-				n - over) + over;
+-	}
+ 	return n;
+ }
+ 
+@@ -437,10 +424,6 @@ static inline unsigned long clear_user(void __user *addr, unsigned long size)
+ 	might_fault();
+ 	if (likely(access_ok(VERIFY_WRITE, addr, size)))
+ 		return __clear_user(addr, size);
+-	if ((unsigned long)addr < TASK_SIZE) {
+-		unsigned long over = (unsigned long)addr + size - TASK_SIZE;
+-		return __clear_user(addr, size - over) + over;
+-	}
+ 	return size;
+ }
+ 
+diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
+index a94f155db78e..edba294620db 100644
+--- a/arch/powerpc/kernel/entry_64.S
++++ b/arch/powerpc/kernel/entry_64.S
+@@ -334,13 +334,13 @@ syscall_exit_work:
+ tabort_syscall:
+ 	/* Firstly we need to enable TM in the kernel */
+ 	mfmsr	r10
+-	li	r13, 1
+-	rldimi	r10, r13, MSR_TM_LG, 63-MSR_TM_LG
++	li	r9, 1
++	rldimi	r10, r9, MSR_TM_LG, 63-MSR_TM_LG
+ 	mtmsrd	r10, 0
+ 
+ 	/* tabort, this dooms the transaction, nothing else */
+-	li	r13, (TM_CAUSE_SYSCALL|TM_CAUSE_PERSISTENT)
+-	TABORT(R13)
++	li	r9, (TM_CAUSE_SYSCALL|TM_CAUSE_PERSISTENT)
++	TABORT(R9)
+ 
+ 	/*
+ 	 * Return directly to userspace. We have corrupted user register state,
+@@ -348,8 +348,8 @@ tabort_syscall:
+ 	 * resume after the tbegin of the aborted transaction with the
+ 	 * checkpointed register state.
+ 	 */
+-	li	r13, MSR_RI
+-	andc	r10, r10, r13
++	li	r9, MSR_RI
++	andc	r10, r10, r9
+ 	mtmsrd	r10, 1
+ 	mtspr	SPRN_SRR0, r11
+ 	mtspr	SPRN_SRR1, r12
+diff --git a/arch/powerpc/mm/slb_low.S b/arch/powerpc/mm/slb_low.S
+index 736d18b3cefd..4c48b487698c 100644
+--- a/arch/powerpc/mm/slb_low.S
++++ b/arch/powerpc/mm/slb_low.S
+@@ -113,7 +113,12 @@ BEGIN_FTR_SECTION
+ END_MMU_FTR_SECTION_IFCLR(MMU_FTR_1T_SEGMENT)
+ 	b	slb_finish_load_1T
+ 
+-0:
++0:	/*
++	 * For userspace addresses, make sure this is region 0.
++	 */
++	cmpdi	r9, 0
++	bne	8f
++
+ 	/* when using slices, we extract the psize off the slice bitmaps
+ 	 * and then we need to get the sllp encoding off the mmu_psize_defs
+ 	 * array.
+diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c
+index 2ee96431f736..4c827826c05e 100644
+--- a/arch/powerpc/platforms/powernv/opal-dump.c
++++ b/arch/powerpc/platforms/powernv/opal-dump.c
+@@ -370,6 +370,7 @@ static irqreturn_t process_dump(int irq, void *data)
+ 	uint32_t dump_id, dump_size, dump_type;
+ 	struct dump_obj *dump;
+ 	char name[22];
++	struct kobject *kobj;
+ 
+ 	rc = dump_read_info(&dump_id, &dump_size, &dump_type);
+ 	if (rc != OPAL_SUCCESS)
+@@ -381,8 +382,12 @@ static irqreturn_t process_dump(int irq, void *data)
+ 	 * that gracefully and not create two conflicting
+ 	 * entries.
+ 	 */
+-	if (kset_find_obj(dump_kset, name))
++	kobj = kset_find_obj(dump_kset, name);
++	if (kobj) {
++		/* Drop reference added by kset_find_obj() */
++		kobject_put(kobj);
+ 		return 0;
++	}
+ 
+ 	dump = create_dump_obj(dump_id, dump_size, dump_type);
+ 	if (!dump)
+diff --git a/arch/powerpc/platforms/powernv/opal-elog.c b/arch/powerpc/platforms/powernv/opal-elog.c
+index 37f959bf392e..f2344cbd2f46 100644
+--- a/arch/powerpc/platforms/powernv/opal-elog.c
++++ b/arch/powerpc/platforms/powernv/opal-elog.c
+@@ -247,6 +247,7 @@ static irqreturn_t elog_event(int irq, void *data)
+ 	uint64_t elog_type;
+ 	int rc;
+ 	char name[2+16+1];
++	struct kobject *kobj;
+ 
+ 	rc = opal_get_elog_size(&id, &size, &type);
+ 	if (rc != OPAL_SUCCESS) {
+@@ -269,8 +270,12 @@ static irqreturn_t elog_event(int irq, void *data)
+ 	 * that gracefully and not create two conflicting
+ 	 * entries.
+ 	 */
+-	if (kset_find_obj(elog_kset, name))
++	kobj = kset_find_obj(elog_kset, name);
++	if (kobj) {
++		/* Drop reference added by kset_find_obj() */
++		kobject_put(kobj);
+ 		return IRQ_HANDLED;
++	}
+ 
+ 	create_elog_obj(log_id, elog_size, elog_type);
+ 
+diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
+index 9dd4cc47ddc7..5c7381c5ad7f 100644
+--- a/arch/s390/include/asm/uaccess.h
++++ b/arch/s390/include/asm/uaccess.h
+@@ -215,28 +215,28 @@ int __put_user_bad(void) __attribute__((noreturn));
+ 	__chk_user_ptr(ptr);					\
+ 	switch (sizeof(*(ptr))) {				\
+ 	case 1: {						\
+-		unsigned char __x;				\
++		unsigned char __x = 0;				\
+ 		__gu_err = __get_user_fn(&__x, ptr,		\
+ 					 sizeof(*(ptr)));	\
+ 		(x) = *(__force __typeof__(*(ptr)) *) &__x;	\
+ 		break;						\
+ 	};							\
+ 	case 2: {						\
+-		unsigned short __x;				\
++		unsigned short __x = 0;				\
+ 		__gu_err = __get_user_fn(&__x, ptr,		\
+ 					 sizeof(*(ptr)));	\
+ 		(x) = *(__force __typeof__(*(ptr)) *) &__x;	\
+ 		break;						\
+ 	};							\
+ 	case 4: {						\
+-		unsigned int __x;				\
++		unsigned int __x = 0;				\
+ 		__gu_err = __get_user_fn(&__x, ptr,		\
+ 					 sizeof(*(ptr)));	\
+ 		(x) = *(__force __typeof__(*(ptr)) *) &__x;	\
+ 		break;						\
+ 	};							\
+ 	case 8: {						\
+-		unsigned long long __x;				\
++		unsigned long long __x = 0;			\
+ 		__gu_err = __get_user_fn(&__x, ptr,		\
+ 					 sizeof(*(ptr)));	\
+ 		(x) = *(__force __typeof__(*(ptr)) *) &__x;	\
+diff --git a/arch/score/include/asm/uaccess.h b/arch/score/include/asm/uaccess.h
+index 20a3591225cc..01aec8ccde83 100644
+--- a/arch/score/include/asm/uaccess.h
++++ b/arch/score/include/asm/uaccess.h
+@@ -163,7 +163,7 @@ do {									\
+ 		__get_user_asm(val, "lw", ptr);				\
+ 		 break;							\
+ 	case 8: 							\
+-		if ((copy_from_user((void *)&val, ptr, 8)) == 0)	\
++		if (__copy_from_user((void *)&val, ptr, 8) == 0)	\
+ 			__gu_err = 0;					\
+ 		else							\
+ 			__gu_err = -EFAULT;				\
+@@ -188,6 +188,8 @@ do {									\
+ 									\
+ 	if (likely(access_ok(VERIFY_READ, __gu_ptr, size)))		\
+ 		__get_user_common((x), size, __gu_ptr);			\
++	else								\
++		(x) = 0;						\
+ 									\
+ 	__gu_err;							\
+ })
+@@ -201,6 +203,7 @@ do {									\
+ 		"2:\n"							\
+ 		".section .fixup,\"ax\"\n"				\
+ 		"3:li	%0, %4\n"					\
++		"li	%1, 0\n"					\
+ 		"j	2b\n"						\
+ 		".previous\n"						\
+ 		".section __ex_table,\"a\"\n"				\
+@@ -298,35 +301,34 @@ extern int __copy_tofrom_user(void *to, const void *from, unsigned long len);
+ static inline unsigned long
+ copy_from_user(void *to, const void *from, unsigned long len)
+ {
+-	unsigned long over;
++	unsigned long res = len;
+ 
+-	if (access_ok(VERIFY_READ, from, len))
+-		return __copy_tofrom_user(to, from, len);
++	if (likely(access_ok(VERIFY_READ, from, len)))
++		res = __copy_tofrom_user(to, from, len);
+ 
+-	if ((unsigned long)from < TASK_SIZE) {
+-		over = (unsigned long)from + len - TASK_SIZE;
+-		return __copy_tofrom_user(to, from, len - over) + over;
+-	}
+-	return len;
++	if (unlikely(res))
++		memset(to + (len - res), 0, res);
++
++	return res;
+ }
+ 
+ static inline unsigned long
+ copy_to_user(void *to, const void *from, unsigned long len)
+ {
+-	unsigned long over;
+-
+-	if (access_ok(VERIFY_WRITE, to, len))
+-		return __copy_tofrom_user(to, from, len);
++	if (likely(access_ok(VERIFY_WRITE, to, len)))
++		len = __copy_tofrom_user(to, from, len);
+ 
+-	if ((unsigned long)to < TASK_SIZE) {
+-		over = (unsigned long)to + len - TASK_SIZE;
+-		return __copy_tofrom_user(to, from, len - over) + over;
+-	}
+ 	return len;
+ }
+ 
+-#define __copy_from_user(to, from, len)	\
+-		__copy_tofrom_user((to), (from), (len))
++static inline unsigned long
++__copy_from_user(void *to, const void *from, unsigned long len)
++{
++	unsigned long left = __copy_tofrom_user(to, from, len);
++	if (unlikely(left))
++		memset(to + (len - left), 0, left);
++	return left;
++}
+ 
+ #define __copy_to_user(to, from, len)		\
+ 		__copy_tofrom_user((to), (from), (len))
+@@ -340,17 +342,17 @@ __copy_to_user_inatomic(void *to, const void *from, unsigned long len)
+ static inline unsigned long
+ __copy_from_user_inatomic(void *to, const void *from, unsigned long len)
+ {
+-	return __copy_from_user(to, from, len);
++	return __copy_tofrom_user(to, from, len);
+ }
+ 
+-#define __copy_in_user(to, from, len)	__copy_from_user(to, from, len)
++#define __copy_in_user(to, from, len)	__copy_tofrom_user(to, from, len)
+ 
+ static inline unsigned long
+ copy_in_user(void *to, const void *from, unsigned long len)
+ {
+ 	if (access_ok(VERIFY_READ, from, len) &&
+ 		      access_ok(VERFITY_WRITE, to, len))
+-		return copy_from_user(to, from, len);
++		return __copy_tofrom_user(to, from, len);
+ }
+ 
+ /*
+diff --git a/arch/sh/include/asm/uaccess.h b/arch/sh/include/asm/uaccess.h
+index a49635c51266..92ade79ac427 100644
+--- a/arch/sh/include/asm/uaccess.h
++++ b/arch/sh/include/asm/uaccess.h
+@@ -151,7 +151,10 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
+ 	__kernel_size_t __copy_size = (__kernel_size_t) n;
+ 
+ 	if (__copy_size && __access_ok(__copy_from, __copy_size))
+-		return __copy_user(to, from, __copy_size);
++		__copy_size = __copy_user(to, from, __copy_size);
++
++	if (unlikely(__copy_size))
++		memset(to + (n - __copy_size), 0, __copy_size);
+ 
+ 	return __copy_size;
+ }
+diff --git a/arch/sh/include/asm/uaccess_64.h b/arch/sh/include/asm/uaccess_64.h
+index c01376c76b86..ca5073dd4596 100644
+--- a/arch/sh/include/asm/uaccess_64.h
++++ b/arch/sh/include/asm/uaccess_64.h
+@@ -24,6 +24,7 @@
+ #define __get_user_size(x,ptr,size,retval)			\
+ do {								\
+ 	retval = 0;						\
++	x = 0;							\
+ 	switch (size) {						\
+ 	case 1:							\
+ 		retval = __get_user_asm_b((void *)&x,		\
+diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
+index 64ee103dc29d..dfb542c7cc71 100644
+--- a/arch/sparc/include/asm/uaccess_32.h
++++ b/arch/sparc/include/asm/uaccess_32.h
+@@ -328,8 +328,10 @@ static inline unsigned long copy_from_user(void *to, const void __user *from, un
+ {
+ 	if (n && __access_ok((unsigned long) from, n))
+ 		return __copy_user((__force void __user *) to, from, n);
+-	else
++	else {
++		memset(to, 0, n);
+ 		return n;
++	}
+ }
+ 
+ static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
+diff --git a/arch/x86/configs/tiny.config b/arch/x86/configs/tiny.config
+index 4e2ecfa23c15..4b429df40d7a 100644
+--- a/arch/x86/configs/tiny.config
++++ b/arch/x86/configs/tiny.config
+@@ -1 +1,3 @@
+ CONFIG_NOHIGHMEM=y
++# CONFIG_HIGHMEM4G is not set
++# CONFIG_HIGHMEM64G is not set
+diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
+index 09b1b0ab94b7..d42252ce9b4d 100644
+--- a/arch/x86/include/asm/uaccess.h
++++ b/arch/x86/include/asm/uaccess.h
+@@ -394,7 +394,11 @@ do {									\
+ #define __get_user_asm_ex(x, addr, itype, rtype, ltype)			\
+ 	asm volatile("1:	mov"itype" %1,%"rtype"0\n"		\
+ 		     "2:\n"						\
+-		     _ASM_EXTABLE_EX(1b, 2b)				\
++		     ".section .fixup,\"ax\"\n"				\
++                     "3:xor"itype" %"rtype"0,%"rtype"0\n"		\
++		     "  jmp 2b\n"					\
++		     ".previous\n"					\
++		     _ASM_EXTABLE_EX(1b, 3b)				\
+ 		     : ltype(x) : "m" (__m(addr)))
+ 
+ #define __put_user_nocheck(x, ptr, size)			\
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index a8816b325162..6cb5834062a3 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -656,6 +656,17 @@ static void init_amd_gh(struct cpuinfo_x86 *c)
+ 		set_cpu_bug(c, X86_BUG_AMD_TLB_MMATCH);
+ }
+ 
++#define MSR_AMD64_DE_CFG	0xC0011029
++
++static void init_amd_ln(struct cpuinfo_x86 *c)
++{
++	/*
++	 * Apply erratum 665 fix unconditionally so machines without a BIOS
++	 * fix work.
++	 */
++	msr_set_bit(MSR_AMD64_DE_CFG, 31);
++}
++
+ static void init_amd_bd(struct cpuinfo_x86 *c)
+ {
+ 	u64 value;
+@@ -713,6 +724,7 @@ static void init_amd(struct cpuinfo_x86 *c)
+ 	case 6:	   init_amd_k7(c); break;
+ 	case 0xf:  init_amd_k8(c); break;
+ 	case 0x10: init_amd_gh(c); break;
++	case 0x12: init_amd_ln(c); break;
+ 	case 0x15: init_amd_bd(c); break;
+ 	}
+ 
+diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
+index c2130aef3f9d..f534a0e3af53 100644
+--- a/arch/x86/kernel/paravirt.c
++++ b/arch/x86/kernel/paravirt.c
+@@ -55,12 +55,12 @@ asm (".pushsection .entry.text, \"ax\"\n"
+      ".popsection");
+ 
+ /* identity function, which can be inlined */
+-u32 _paravirt_ident_32(u32 x)
++u32 notrace _paravirt_ident_32(u32 x)
+ {
+ 	return x;
+ }
+ 
+-u64 _paravirt_ident_64(u64 x)
++u64 notrace _paravirt_ident_64(u64 x)
+ {
+ 	return x;
+ }
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index be222666b1c2..d7cb9577fa31 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2735,7 +2735,6 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+ 	}
+ 
+ 	kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);
+-	vcpu->arch.switch_db_regs |= KVM_DEBUGREG_RELOAD;
+ }
+ 
+ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
+diff --git a/crypto/cryptd.c b/crypto/cryptd.c
+index c81861b1350b..e7aa904cb20b 100644
+--- a/crypto/cryptd.c
++++ b/crypto/cryptd.c
+@@ -594,9 +594,14 @@ static int cryptd_hash_export(struct ahash_request *req, void *out)
+ 
+ static int cryptd_hash_import(struct ahash_request *req, const void *in)
+ {
+-	struct cryptd_hash_request_ctx *rctx = ahash_request_ctx(req);
++	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
++	struct cryptd_hash_ctx *ctx = crypto_ahash_ctx(tfm);
++	struct shash_desc *desc = cryptd_shash_desc(req);
++
++	desc->tfm = ctx->child;
++	desc->flags = req->base.flags;
+ 
+-	return crypto_shash_import(&rctx->desc, in);
++	return crypto_shash_import(desc, in);
+ }
+ 
+ static int cryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,
+diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
+index 7082c7268845..0f54cb7ddcbb 100644
+--- a/drivers/bus/arm-ccn.c
++++ b/drivers/bus/arm-ccn.c
+@@ -187,6 +187,7 @@ struct arm_ccn {
+ 	struct arm_ccn_component *xp;
+ 
+ 	struct arm_ccn_dt dt;
++	int mn_id;
+ };
+ 
+ 
+@@ -326,6 +327,7 @@ struct arm_ccn_pmu_event {
+ static ssize_t arm_ccn_pmu_event_show(struct device *dev,
+ 		struct device_attribute *attr, char *buf)
+ {
++	struct arm_ccn *ccn = pmu_to_arm_ccn(dev_get_drvdata(dev));
+ 	struct arm_ccn_pmu_event *event = container_of(attr,
+ 			struct arm_ccn_pmu_event, attr);
+ 	ssize_t res;
+@@ -352,6 +354,9 @@ static ssize_t arm_ccn_pmu_event_show(struct device *dev,
+ 			res += snprintf(buf + res, PAGE_SIZE - res,
+ 					",cmp_l=?,cmp_h=?,mask=?");
+ 		break;
++	case CCN_TYPE_MN:
++		res += snprintf(buf + res, PAGE_SIZE - res, ",node=%d", ccn->mn_id);
++		break;
+ 	default:
+ 		res += snprintf(buf + res, PAGE_SIZE - res, ",node=?");
+ 		break;
+@@ -381,9 +386,9 @@ static umode_t arm_ccn_pmu_events_is_visible(struct kobject *kobj,
+ }
+ 
+ static struct arm_ccn_pmu_event arm_ccn_pmu_events[] = {
+-	CCN_EVENT_MN(eobarrier, "dir=0,vc=0,cmp_h=0x1c00", CCN_IDX_MASK_OPCODE),
+-	CCN_EVENT_MN(ecbarrier, "dir=0,vc=0,cmp_h=0x1e00", CCN_IDX_MASK_OPCODE),
+-	CCN_EVENT_MN(dvmop, "dir=0,vc=0,cmp_h=0x2800", CCN_IDX_MASK_OPCODE),
++	CCN_EVENT_MN(eobarrier, "dir=1,vc=0,cmp_h=0x1c00", CCN_IDX_MASK_OPCODE),
++	CCN_EVENT_MN(ecbarrier, "dir=1,vc=0,cmp_h=0x1e00", CCN_IDX_MASK_OPCODE),
++	CCN_EVENT_MN(dvmop, "dir=1,vc=0,cmp_h=0x2800", CCN_IDX_MASK_OPCODE),
+ 	CCN_EVENT_HNI(txdatflits, "dir=1,vc=3", CCN_IDX_MASK_ANY),
+ 	CCN_EVENT_HNI(rxdatflits, "dir=0,vc=3", CCN_IDX_MASK_ANY),
+ 	CCN_EVENT_HNI(txreqflits, "dir=1,vc=0", CCN_IDX_MASK_ANY),
+@@ -757,6 +762,12 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
+ 
+ 	/* Validate node/xp vs topology */
+ 	switch (type) {
++	case CCN_TYPE_MN:
++		if (node_xp != ccn->mn_id) {
++			dev_warn(ccn->dev, "Invalid MN ID %d!\n", node_xp);
++			return -EINVAL;
++		}
++		break;
+ 	case CCN_TYPE_XP:
+ 		if (node_xp >= ccn->num_xps) {
+ 			dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp);
+@@ -884,6 +895,10 @@ static void arm_ccn_pmu_xp_dt_config(struct perf_event *event, int enable)
+ 	struct arm_ccn_component *xp;
+ 	u32 val, dt_cfg;
+ 
++	/* Nothing to do for cycle counter */
++	if (hw->idx == CCN_IDX_PMU_CYCLE_COUNTER)
++		return;
++
+ 	if (CCN_CONFIG_TYPE(event->attr.config) == CCN_TYPE_XP)
+ 		xp = &ccn->xp[CCN_CONFIG_XP(event->attr.config)];
+ 	else
+@@ -986,7 +1001,7 @@ static void arm_ccn_pmu_xp_watchpoint_config(struct perf_event *event)
+ 
+ 	/* Comparison values */
+ 	writel(cmp_l & 0xffffffff, source->base + CCN_XP_DT_CMP_VAL_L(wp));
+-	writel((cmp_l >> 32) & 0xefffffff,
++	writel((cmp_l >> 32) & 0x7fffffff,
+ 			source->base + CCN_XP_DT_CMP_VAL_L(wp) + 4);
+ 	writel(cmp_h & 0xffffffff, source->base + CCN_XP_DT_CMP_VAL_H(wp));
+ 	writel((cmp_h >> 32) & 0x0fffffff,
+@@ -994,7 +1009,7 @@ static void arm_ccn_pmu_xp_watchpoint_config(struct perf_event *event)
+ 
+ 	/* Mask */
+ 	writel(mask_l & 0xffffffff, source->base + CCN_XP_DT_CMP_MASK_L(wp));
+-	writel((mask_l >> 32) & 0xefffffff,
++	writel((mask_l >> 32) & 0x7fffffff,
+ 			source->base + CCN_XP_DT_CMP_MASK_L(wp) + 4);
+ 	writel(mask_h & 0xffffffff, source->base + CCN_XP_DT_CMP_MASK_H(wp));
+ 	writel((mask_h >> 32) & 0x0fffffff,
+@@ -1368,6 +1383,8 @@ static int arm_ccn_init_nodes(struct arm_ccn *ccn, int region,
+ 
+ 	switch (type) {
+ 	case CCN_TYPE_MN:
++		ccn->mn_id = id;
++		return 0;
+ 	case CCN_TYPE_DT:
+ 		return 0;
+ 	case CCN_TYPE_XP:
+diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c
+index 6f3719d73390..e84877a2cacc 100644
+--- a/drivers/clocksource/sun4i_timer.c
++++ b/drivers/clocksource/sun4i_timer.c
+@@ -123,12 +123,16 @@ static struct clock_event_device sun4i_clockevent = {
+ 	.set_next_event = sun4i_clkevt_next_event,
+ };
+ 
++static void sun4i_timer_clear_interrupt(void)
++{
++	writel(TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_ST_REG);
++}
+ 
+ static irqreturn_t sun4i_timer_interrupt(int irq, void *dev_id)
+ {
+ 	struct clock_event_device *evt = (struct clock_event_device *)dev_id;
+ 
+-	writel(0x1, timer_base + TIMER_IRQ_ST_REG);
++	sun4i_timer_clear_interrupt();
+ 	evt->event_handler(evt);
+ 
+ 	return IRQ_HANDLED;
+@@ -193,6 +197,9 @@ static void __init sun4i_timer_init(struct device_node *node)
+ 	/* Make sure timer is stopped before playing with interrupts */
+ 	sun4i_clkevt_time_stop(0);
+ 
++	/* clear timer0 interrupt */
++	sun4i_timer_clear_interrupt();
++
+ 	sun4i_clockevent.cpumask = cpu_possible_mask;
+ 	sun4i_clockevent.irq = irq;
+ 
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index 59d1269626b1..e231176cb66b 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -316,19 +316,19 @@ atmel_hlcdc_plane_update_pos_and_size(struct atmel_hlcdc_plane *plane,
+ 			u32 *coeff_tab = heo_upscaling_ycoef;
+ 			u32 max_memsize;
+ 
+-			if (state->crtc_w < state->src_w)
++			if (state->crtc_h < state->src_h)
+ 				coeff_tab = heo_downscaling_ycoef;
+ 			for (i = 0; i < ARRAY_SIZE(heo_upscaling_ycoef); i++)
+ 				atmel_hlcdc_layer_update_cfg(&plane->layer,
+ 							     33 + i,
+ 							     0xffffffff,
+ 							     coeff_tab[i]);
+-			factor = ((8 * 256 * state->src_w) - (256 * 4)) /
+-				 state->crtc_w;
++			factor = ((8 * 256 * state->src_h) - (256 * 4)) /
++				 state->crtc_h;
+ 			factor++;
+-			max_memsize = ((factor * state->crtc_w) + (256 * 4)) /
++			max_memsize = ((factor * state->crtc_h) + (256 * 4)) /
+ 				      2048;
+-			if (max_memsize > state->src_w)
++			if (max_memsize > state->src_h)
+ 				factor--;
+ 			factor_reg |= (factor << 16) | 0x80000000;
+ 		}
+diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
+index 57676f8d7ecf..a6289752be16 100644
+--- a/drivers/gpu/drm/drm_ioc32.c
++++ b/drivers/gpu/drm/drm_ioc32.c
+@@ -1015,6 +1015,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
+ 	return 0;
+ }
+ 
++#if defined(CONFIG_X86) || defined(CONFIG_IA64)
+ typedef struct drm_mode_fb_cmd232 {
+ 	u32 fb_id;
+ 	u32 width;
+@@ -1071,6 +1072,7 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
+ 
+ 	return 0;
+ }
++#endif
+ 
+ static drm_ioctl_compat_t *drm_compat_ioctls[] = {
+ 	[DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version,
+@@ -1104,7 +1106,9 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = {
+ 	[DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)] = compat_drm_update_draw,
+ #endif
+ 	[DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)] = compat_drm_wait_vblank,
++#if defined(CONFIG_X86) || defined(CONFIG_IA64)
+ 	[DRM_IOCTL_NR(DRM_IOCTL_MODE_ADDFB232)] = compat_drm_mode_addfb2,
++#endif
+ };
+ 
+ /**
+diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c
+index 17cea400ae32..d3de377dc857 100644
+--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c
++++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c
+@@ -220,7 +220,7 @@ i2c_dp_aux_prepare_bus(struct i2c_adapter *adapter)
+  * FIXME: This is the old dp aux helper, gma500 is the last driver that needs to
+  * be ported over to the new helper code in drm_dp_helper.c like i915 or radeon.
+  */
+-static int __deprecated
++static int
+ i2c_dp_aux_add_bus(struct i2c_adapter *adapter)
+ {
+ 	int error;
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index a3254c3bcc7c..909d1d71d130 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2950,13 +2950,13 @@ u32 intel_fb_stride_alignment(struct drm_device *dev, uint64_t fb_modifier,
+ 	}
+ }
+ 
+-unsigned long intel_plane_obj_offset(struct intel_plane *intel_plane,
+-				     struct drm_i915_gem_object *obj,
+-				     unsigned int plane)
++u32 intel_plane_obj_offset(struct intel_plane *intel_plane,
++			   struct drm_i915_gem_object *obj,
++			   unsigned int plane)
+ {
+ 	const struct i915_ggtt_view *view = &i915_ggtt_view_normal;
+ 	struct i915_vma *vma;
+-	unsigned char *offset;
++	u64 offset;
+ 
+ 	if (intel_rotation_90_or_270(intel_plane->base.state->rotation))
+ 		view = &i915_ggtt_view_rotated;
+@@ -2966,14 +2966,16 @@ unsigned long intel_plane_obj_offset(struct intel_plane *intel_plane,
+ 		view->type))
+ 		return -1;
+ 
+-	offset = (unsigned char *)vma->node.start;
++	offset = vma->node.start;
+ 
+ 	if (plane == 1) {
+ 		offset += vma->ggtt_view.rotation_info.uv_start_page *
+ 			  PAGE_SIZE;
+ 	}
+ 
+-	return (unsigned long)offset;
++	WARN_ON(upper_32_bits(offset));
++
++	return lower_32_bits(offset);
+ }
+ 
+ static void skl_detach_scaler(struct intel_crtc *intel_crtc, int id)
+@@ -3099,7 +3101,7 @@ static void skylake_update_primary_plane(struct drm_crtc *crtc,
+ 	u32 tile_height, plane_offset, plane_size;
+ 	unsigned int rotation;
+ 	int x_offset, y_offset;
+-	unsigned long surf_addr;
++	u32 surf_addr;
+ 	struct intel_crtc_state *crtc_state = intel_crtc->config;
+ 	struct intel_plane_state *plane_state;
+ 	int src_x = 0, src_y = 0, src_w = 0, src_h = 0;
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index 67f72a7ee7cb..41442e619595 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -1177,9 +1177,9 @@ void intel_modeset_preclose(struct drm_device *dev, struct drm_file *file);
+ int skl_update_scaler_crtc(struct intel_crtc_state *crtc_state);
+ int skl_max_scale(struct intel_crtc *crtc, struct intel_crtc_state *crtc_state);
+ 
+-unsigned long intel_plane_obj_offset(struct intel_plane *intel_plane,
+-				     struct drm_i915_gem_object *obj,
+-				     unsigned int plane);
++u32 intel_plane_obj_offset(struct intel_plane *intel_plane,
++			   struct drm_i915_gem_object *obj,
++			   unsigned int plane);
+ 
+ u32 skl_plane_ctl_format(uint32_t pixel_format);
+ u32 skl_plane_ctl_tiling(uint64_t fb_modifier);
+diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
+index 56dc132e8e20..2cc6aa072f4c 100644
+--- a/drivers/gpu/drm/i915/intel_sprite.c
++++ b/drivers/gpu/drm/i915/intel_sprite.c
+@@ -195,7 +195,7 @@ skl_update_plane(struct drm_plane *drm_plane, struct drm_crtc *crtc,
+ 	int pixel_size = drm_format_plane_cpp(fb->pixel_format, 0);
+ 	const struct drm_intel_sprite_colorkey *key =
+ 		&to_intel_plane_state(drm_plane->state)->ckey;
+-	unsigned long surf_addr;
++	u32 surf_addr;
+ 	u32 tile_height, plane_offset, plane_size;
+ 	unsigned int rotation;
+ 	int x_offset, y_offset;
+diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
+index 291c61a41c9a..fa24d5196615 100644
+--- a/drivers/iio/accel/bmc150-accel-core.c
++++ b/drivers/iio/accel/bmc150-accel-core.c
+@@ -68,6 +68,9 @@
+ #define BMC150_ACCEL_REG_PMU_BW		0x10
+ #define BMC150_ACCEL_DEF_BW			125
+ 
++#define BMC150_ACCEL_REG_RESET			0x14
++#define BMC150_ACCEL_RESET_VAL			0xB6
++
+ #define BMC150_ACCEL_REG_INT_MAP_0		0x19
+ #define BMC150_ACCEL_INT_MAP_0_BIT_SLOPE	BIT(2)
+ 
+@@ -1487,6 +1490,14 @@ static int bmc150_accel_chip_init(struct bmc150_accel_data *data)
+ 	int ret, i;
+ 	unsigned int val;
+ 
++	/*
++	 * Reset chip to get it in a known good state. A delay of 1.8ms after
++	 * reset is required according to the data sheets of supported chips.
++	 */
++	regmap_write(data->regmap, BMC150_ACCEL_REG_RESET,
++		     BMC150_ACCEL_RESET_VAL);
++	usleep_range(1800, 2500);
++
+ 	ret = regmap_read(data->regmap, BMC150_ACCEL_REG_CHIP_ID, &val);
+ 	if (ret < 0) {
+ 		dev_err(data->dev,
+diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
+index 3a9f106787d2..9d72d4bcf5e9 100644
+--- a/drivers/iio/accel/kxsd9.c
++++ b/drivers/iio/accel/kxsd9.c
+@@ -160,11 +160,13 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev,
+ 		if (ret < 0)
+ 			goto error_ret;
+ 		*val = ret;
++		ret = IIO_VAL_INT;
+ 		break;
+ 	case IIO_CHAN_INFO_SCALE:
+ 		ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C));
+ 		if (ret < 0)
+ 			goto error_ret;
++		*val = 0;
+ 		*val2 = kxsd9_micro_scales[ret & KXSD9_FS_MASK];
+ 		ret = IIO_VAL_INT_PLUS_MICRO;
+ 		break;
+diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
+index 1e7aded53117..bda6bbe4479c 100644
+--- a/drivers/iio/adc/Kconfig
++++ b/drivers/iio/adc/Kconfig
+@@ -306,6 +306,7 @@ config QCOM_SPMI_VADC
+ config ROCKCHIP_SARADC
+ 	tristate "Rockchip SARADC driver"
+ 	depends on ARCH_ROCKCHIP || (ARM && COMPILE_TEST)
++	depends on RESET_CONTROLLER
+ 	help
+ 	  Say yes here to build support for the SARADC found in SoCs from
+ 	  Rockchip.
+diff --git a/drivers/iio/adc/ad799x.c b/drivers/iio/adc/ad799x.c
+index 01d71588d752..ba82de25a797 100644
+--- a/drivers/iio/adc/ad799x.c
++++ b/drivers/iio/adc/ad799x.c
+@@ -533,6 +533,7 @@ static struct attribute_group ad799x_event_attrs_group = {
+ static const struct iio_info ad7991_info = {
+ 	.read_raw = &ad799x_read_raw,
+ 	.driver_module = THIS_MODULE,
++	.update_scan_mode = ad799x_update_scan_mode,
+ };
+ 
+ static const struct iio_info ad7993_4_7_8_noirq_info = {
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index 7b40925dd4ff..93986f0590ef 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -381,8 +381,8 @@ static irqreturn_t at91_adc_rl_interrupt(int irq, void *private)
+ 		st->ts_bufferedmeasure = false;
+ 		input_report_key(st->ts_input, BTN_TOUCH, 0);
+ 		input_sync(st->ts_input);
+-	} else if (status & AT91_ADC_EOC(3)) {
+-		/* Conversion finished */
++	} else if (status & AT91_ADC_EOC(3) && st->ts_input) {
++		/* Conversion finished and we've a touchscreen */
+ 		if (st->ts_bufferedmeasure) {
+ 			/*
+ 			 * Last measurement is always discarded, since it can
+diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c
+index 9c311c1e1ac7..dffff64b5989 100644
+--- a/drivers/iio/adc/rockchip_saradc.c
++++ b/drivers/iio/adc/rockchip_saradc.c
+@@ -21,6 +21,8 @@
+ #include <linux/of_device.h>
+ #include <linux/clk.h>
+ #include <linux/completion.h>
++#include <linux/delay.h>
++#include <linux/reset.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/iio/iio.h>
+ 
+@@ -53,6 +55,7 @@ struct rockchip_saradc {
+ 	struct clk		*clk;
+ 	struct completion	completion;
+ 	struct regulator	*vref;
++	struct reset_control	*reset;
+ 	const struct rockchip_saradc_data *data;
+ 	u16			last_val;
+ };
+@@ -171,6 +174,16 @@ static const struct of_device_id rockchip_saradc_match[] = {
+ };
+ MODULE_DEVICE_TABLE(of, rockchip_saradc_match);
+ 
++/**
++ * Reset SARADC Controller.
++ */
++static void rockchip_saradc_reset_controller(struct reset_control *reset)
++{
++	reset_control_assert(reset);
++	usleep_range(10, 20);
++	reset_control_deassert(reset);
++}
++
+ static int rockchip_saradc_probe(struct platform_device *pdev)
+ {
+ 	struct rockchip_saradc *info = NULL;
+@@ -199,6 +212,20 @@ static int rockchip_saradc_probe(struct platform_device *pdev)
+ 	if (IS_ERR(info->regs))
+ 		return PTR_ERR(info->regs);
+ 
++	/*
++	 * The reset should be an optional property, as it should work
++	 * with old devicetrees as well
++	 */
++	info->reset = devm_reset_control_get(&pdev->dev, "saradc-apb");
++	if (IS_ERR(info->reset)) {
++		ret = PTR_ERR(info->reset);
++		if (ret != -ENOENT)
++			return ret;
++
++		dev_dbg(&pdev->dev, "no reset control found\n");
++		info->reset = NULL;
++	}
++
+ 	init_completion(&info->completion);
+ 
+ 	irq = platform_get_irq(pdev, 0);
+@@ -233,6 +260,9 @@ static int rockchip_saradc_probe(struct platform_device *pdev)
+ 		return PTR_ERR(info->vref);
+ 	}
+ 
++	if (info->reset)
++		rockchip_saradc_reset_controller(info->reset);
++
+ 	/*
+ 	 * Use a default value for the converter clock.
+ 	 * This may become user-configurable in the future.
+diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
+index c1e05532d437..0470fc843d4e 100644
+--- a/drivers/iio/adc/ti_am335x_adc.c
++++ b/drivers/iio/adc/ti_am335x_adc.c
+@@ -32,6 +32,7 @@
+ 
+ struct tiadc_device {
+ 	struct ti_tscadc_dev *mfd_tscadc;
++	struct mutex fifo1_lock; /* to protect fifo access */
+ 	int channels;
+ 	u8 channel_line[8];
+ 	u8 channel_step[8];
+@@ -360,6 +361,7 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
+ 		int *val, int *val2, long mask)
+ {
+ 	struct tiadc_device *adc_dev = iio_priv(indio_dev);
++	int ret = IIO_VAL_INT;
+ 	int i, map_val;
+ 	unsigned int fifo1count, read, stepid;
+ 	bool found = false;
+@@ -373,13 +375,14 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
+ 	if (!step_en)
+ 		return -EINVAL;
+ 
++	mutex_lock(&adc_dev->fifo1_lock);
+ 	fifo1count = tiadc_readl(adc_dev, REG_FIFO1CNT);
+ 	while (fifo1count--)
+ 		tiadc_readl(adc_dev, REG_FIFO1);
+ 
+ 	am335x_tsc_se_set_once(adc_dev->mfd_tscadc, step_en);
+ 
+-	timeout = jiffies + usecs_to_jiffies
++	timeout = jiffies + msecs_to_jiffies
+ 				(IDLE_TIMEOUT * adc_dev->channels);
+ 	/* Wait for Fifo threshold interrupt */
+ 	while (1) {
+@@ -389,7 +392,8 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
+ 
+ 		if (time_after(jiffies, timeout)) {
+ 			am335x_tsc_se_adc_done(adc_dev->mfd_tscadc);
+-			return -EAGAIN;
++			ret = -EAGAIN;
++			goto err_unlock;
+ 		}
+ 	}
+ 	map_val = adc_dev->channel_step[chan->scan_index];
+@@ -415,8 +419,11 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
+ 	am335x_tsc_se_adc_done(adc_dev->mfd_tscadc);
+ 
+ 	if (found == false)
+-		return -EBUSY;
+-	return IIO_VAL_INT;
++		ret =  -EBUSY;
++
++err_unlock:
++	mutex_unlock(&adc_dev->fifo1_lock);
++	return ret;
+ }
+ 
+ static const struct iio_info tiadc_info = {
+@@ -485,6 +492,7 @@ static int tiadc_probe(struct platform_device *pdev)
+ 
+ 	tiadc_step_config(indio_dev);
+ 	tiadc_writel(adc_dev, REG_FIFO1THR, FIFO1_THRESHOLD);
++	mutex_init(&adc_dev->fifo1_lock);
+ 
+ 	err = tiadc_channel_init(indio_dev, adc_dev->channels);
+ 	if (err < 0)
+diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
+index e81f434760f4..dc33c1dd5191 100644
+--- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
++++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
+@@ -56,8 +56,8 @@ static struct {
+ 	{HID_USAGE_SENSOR_ALS, 0, 1, 0},
+ 	{HID_USAGE_SENSOR_ALS, HID_USAGE_SENSOR_UNITS_LUX, 1, 0},
+ 
+-	{HID_USAGE_SENSOR_PRESSURE, 0, 100000, 0},
+-	{HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 1, 0},
++	{HID_USAGE_SENSOR_PRESSURE, 0, 100, 0},
++	{HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000},
+ };
+ 
+ static int pow_10(unsigned power)
+diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
+index 7afd226a3321..32bb036069eb 100644
+--- a/drivers/iio/industrialio-buffer.c
++++ b/drivers/iio/industrialio-buffer.c
+@@ -110,7 +110,7 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
+ 	DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ 	size_t datum_size;
+ 	size_t to_wait;
+-	int ret;
++	int ret = 0;
+ 
+ 	if (!indio_dev->info)
+ 		return -ENODEV;
+@@ -153,7 +153,7 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
+ 		ret = rb->access->read_first_n(rb, n, buf);
+ 		if (ret == 0 && (filp->f_flags & O_NONBLOCK))
+ 			ret = -EAGAIN;
+-	 } while (ret == 0);
++	} while (ret == 0);
+ 	remove_wait_queue(&rb->pollq, &wait);
+ 
+ 	return ret;
+diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
+index 159ede61f793..7ede941e9301 100644
+--- a/drivers/iio/industrialio-core.c
++++ b/drivers/iio/industrialio-core.c
+@@ -447,9 +447,8 @@ ssize_t iio_format_value(char *buf, unsigned int type, int size, int *vals)
+ 			return sprintf(buf, "%d.%09u\n", vals[0], vals[1]);
+ 	case IIO_VAL_FRACTIONAL:
+ 		tmp = div_s64((s64)vals[0] * 1000000000LL, vals[1]);
+-		vals[1] = do_div(tmp, 1000000000LL);
+-		vals[0] = tmp;
+-		return sprintf(buf, "%d.%09u\n", vals[0], vals[1]);
++		vals[0] = (int)div_s64_rem(tmp, 1000000000, &vals[1]);
++		return sprintf(buf, "%d.%09u\n", vals[0], abs(vals[1]));
+ 	case IIO_VAL_FRACTIONAL_LOG2:
+ 		tmp = (s64)vals[0] * 1000000000LL >> vals[1];
+ 		vals[1] = do_div(tmp, 1000000000LL);
+diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
+index e2f926cdcad2..a0aedda7dfd7 100644
+--- a/drivers/iio/proximity/as3935.c
++++ b/drivers/iio/proximity/as3935.c
+@@ -392,7 +392,7 @@ static int as3935_probe(struct spi_device *spi)
+ 		return ret;
+ 	}
+ 
+-	ret = iio_triggered_buffer_setup(indio_dev, NULL,
++	ret = iio_triggered_buffer_setup(indio_dev, iio_pollfunc_store_time,
+ 		&as3935_trigger_handler, NULL);
+ 
+ 	if (ret) {
+diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
+index 94bbd8c155fc..a2d19d136099 100644
+--- a/drivers/infiniband/core/uverbs.h
++++ b/drivers/infiniband/core/uverbs.h
+@@ -116,6 +116,7 @@ struct ib_uverbs_event_file {
+ struct ib_uverbs_file {
+ 	struct kref				ref;
+ 	struct mutex				mutex;
++	struct mutex                            cleanup_mutex; /* protect cleanup */
+ 	struct ib_uverbs_device		       *device;
+ 	struct ib_ucontext		       *ucontext;
+ 	struct ib_event_handler			event_handler;
+diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
+index 24f3ca2c4ad7..d625c82d6c82 100644
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -922,6 +922,7 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
+ 	file->async_file = NULL;
+ 	kref_init(&file->ref);
+ 	mutex_init(&file->mutex);
++	mutex_init(&file->cleanup_mutex);
+ 
+ 	filp->private_data = file;
+ 	kobject_get(&dev->kobj);
+@@ -947,18 +948,20 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
+ {
+ 	struct ib_uverbs_file *file = filp->private_data;
+ 	struct ib_uverbs_device *dev = file->device;
+-	struct ib_ucontext *ucontext = NULL;
++
++	mutex_lock(&file->cleanup_mutex);
++	if (file->ucontext) {
++		ib_uverbs_cleanup_ucontext(file, file->ucontext);
++		file->ucontext = NULL;
++	}
++	mutex_unlock(&file->cleanup_mutex);
+ 
+ 	mutex_lock(&file->device->lists_mutex);
+-	ucontext = file->ucontext;
+-	file->ucontext = NULL;
+ 	if (!file->is_closed) {
+ 		list_del(&file->list);
+ 		file->is_closed = 1;
+ 	}
+ 	mutex_unlock(&file->device->lists_mutex);
+-	if (ucontext)
+-		ib_uverbs_cleanup_ucontext(file, ucontext);
+ 
+ 	if (file->async_file)
+ 		kref_put(&file->async_file->ref, ib_uverbs_release_event_file);
+@@ -1172,22 +1175,30 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
+ 	mutex_lock(&uverbs_dev->lists_mutex);
+ 	while (!list_empty(&uverbs_dev->uverbs_file_list)) {
+ 		struct ib_ucontext *ucontext;
+-
+ 		file = list_first_entry(&uverbs_dev->uverbs_file_list,
+ 					struct ib_uverbs_file, list);
+ 		file->is_closed = 1;
+-		ucontext = file->ucontext;
+ 		list_del(&file->list);
+-		file->ucontext = NULL;
+ 		kref_get(&file->ref);
+ 		mutex_unlock(&uverbs_dev->lists_mutex);
+-		/* We must release the mutex before going ahead and calling
+-		 * disassociate_ucontext. disassociate_ucontext might end up
+-		 * indirectly calling uverbs_close, for example due to freeing
+-		 * the resources (e.g mmput).
+-		 */
++
+ 		ib_uverbs_event_handler(&file->event_handler, &event);
++
++		mutex_lock(&file->cleanup_mutex);
++		ucontext = file->ucontext;
++		file->ucontext = NULL;
++		mutex_unlock(&file->cleanup_mutex);
++
++		/* At this point ib_uverbs_close cannot be running
++		 * ib_uverbs_cleanup_ucontext
++		 */
+ 		if (ucontext) {
++			/* We must release the mutex before going ahead and
++			 * calling disassociate_ucontext. disassociate_ucontext
++			 * might end up indirectly calling uverbs_close,
++			 * for example due to freeing the resources
++			 * (e.g mmput).
++			 */
+ 			ib_dev->disassociate_ucontext(ucontext);
+ 			ib_uverbs_cleanup_ucontext(file, ucontext);
+ 		}
+diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
+index 8a0c7f288198..981c3959da59 100644
+--- a/drivers/irqchip/irq-atmel-aic.c
++++ b/drivers/irqchip/irq-atmel-aic.c
+@@ -176,6 +176,7 @@ static int aic_irq_domain_xlate(struct irq_domain *d,
+ {
+ 	struct irq_domain_chip_generic *dgc = d->gc;
+ 	struct irq_chip_generic *gc;
++	unsigned long flags;
+ 	unsigned smr;
+ 	int idx;
+ 	int ret;
+@@ -194,12 +195,12 @@ static int aic_irq_domain_xlate(struct irq_domain *d,
+ 
+ 	gc = dgc->gc[idx];
+ 
+-	irq_gc_lock(gc);
++	irq_gc_lock_irqsave(gc, flags);
+ 	smr = irq_reg_readl(gc, AT91_AIC_SMR(*out_hwirq));
+ 	ret = aic_common_set_priority(intspec[2], &smr);
+ 	if (!ret)
+ 		irq_reg_writel(gc, smr, AT91_AIC_SMR(*out_hwirq));
+-	irq_gc_unlock(gc);
++	irq_gc_unlock_irqrestore(gc, flags);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
+index 62bb840c613f..7dee71bde350 100644
+--- a/drivers/irqchip/irq-atmel-aic5.c
++++ b/drivers/irqchip/irq-atmel-aic5.c
+@@ -258,6 +258,7 @@ static int aic5_irq_domain_xlate(struct irq_domain *d,
+ 				 unsigned int *out_type)
+ {
+ 	struct irq_chip_generic *bgc = irq_get_domain_generic_chip(d, 0);
++	unsigned long flags;
+ 	unsigned smr;
+ 	int ret;
+ 
+@@ -269,13 +270,13 @@ static int aic5_irq_domain_xlate(struct irq_domain *d,
+ 	if (ret)
+ 		return ret;
+ 
+-	irq_gc_lock(bgc);
++	irq_gc_lock_irqsave(bgc, flags);
+ 	irq_reg_writel(bgc, *out_hwirq, AT91_AIC5_SSR);
+ 	smr = irq_reg_readl(bgc, AT91_AIC5_SMR);
+ 	ret = aic_common_set_priority(intspec[2], &smr);
+ 	if (!ret)
+ 		irq_reg_writel(bgc, intspec[2] | smr, AT91_AIC5_SMR);
+-	irq_gc_unlock(bgc);
++	irq_gc_unlock_irqrestore(bgc, flags);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/lightnvm/rrpc.c b/drivers/lightnvm/rrpc.c
+index a9859489acf6..596347f345db 100644
+--- a/drivers/lightnvm/rrpc.c
++++ b/drivers/lightnvm/rrpc.c
+@@ -287,8 +287,10 @@ static int rrpc_move_valid_pages(struct rrpc *rrpc, struct rrpc_block *rblk)
+ 	}
+ 
+ 	page = mempool_alloc(rrpc->page_pool, GFP_NOIO);
+-	if (!page)
++	if (!page) {
++		bio_put(bio);
+ 		return -ENOMEM;
++	}
+ 
+ 	while ((slot = find_first_zero_bit(rblk->invalid_pages,
+ 					    nr_pgs_per_blk)) < nr_pgs_per_blk) {
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 3147c8d09ea8..51eda7235e32 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1920,6 +1920,13 @@ static int crypt_map(struct dm_target *ti, struct bio *bio)
+ 		return DM_MAPIO_REMAPPED;
+ 	}
+ 
++	/*
++	 * Check if bio is too large, split as needed.
++	 */
++	if (unlikely(bio->bi_iter.bi_size > (BIO_MAX_PAGES << PAGE_SHIFT)) &&
++	    bio_data_dir(bio) == WRITE)
++		dm_accept_partial_bio(bio, ((BIO_MAX_PAGES << PAGE_SHIFT) >> SECTOR_SHIFT));
++
+ 	io = dm_per_bio_data(bio, cc->per_bio_data_size);
+ 	crypt_io_init(io, cc, bio, dm_target_offset(ti, bio->bi_iter.bi_sector));
+ 	io->ctx.req = (struct ablkcipher_request *)(io + 1);
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index cd0a93df4cb7..8e9e928dafba 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -289,15 +289,13 @@ static int flakey_map(struct dm_target *ti, struct bio *bio)
+ 		pb->bio_submitted = true;
+ 
+ 		/*
+-		 * Map reads as normal only if corrupt_bio_byte set.
++		 * Error reads if neither corrupt_bio_byte or drop_writes are set.
++		 * Otherwise, flakey_end_io() will decide if the reads should be modified.
+ 		 */
+ 		if (bio_data_dir(bio) == READ) {
+-			/* If flags were specified, only corrupt those that match. */
+-			if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
+-			    all_corrupt_bio_flags_match(bio, fc))
+-				goto map_bio;
+-			else
++			if (!fc->corrupt_bio_byte && !test_bit(DROP_WRITES, &fc->flags))
+ 				return -EIO;
++			goto map_bio;
+ 		}
+ 
+ 		/*
+@@ -334,14 +332,21 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, int error)
+ 	struct flakey_c *fc = ti->private;
+ 	struct per_bio_data *pb = dm_per_bio_data(bio, sizeof(struct per_bio_data));
+ 
+-	/*
+-	 * Corrupt successful READs while in down state.
+-	 */
+ 	if (!error && pb->bio_submitted && (bio_data_dir(bio) == READ)) {
+-		if (fc->corrupt_bio_byte)
++		if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
++		    all_corrupt_bio_flags_match(bio, fc)) {
++			/*
++			 * Corrupt successful matching READs while in down state.
++			 */
+ 			corrupt_bio_data(bio, fc);
+-		else
++
++		} else if (!test_bit(DROP_WRITES, &fc->flags)) {
++			/*
++			 * Error read during the down_interval if drop_writes
++			 * wasn't configured.
++			 */
+ 			return -EIO;
++		}
+ 	}
+ 
+ 	return error;
+diff --git a/drivers/md/dm-log-writes.c b/drivers/md/dm-log-writes.c
+index 624589d51c2c..d8956b4a7b09 100644
+--- a/drivers/md/dm-log-writes.c
++++ b/drivers/md/dm-log-writes.c
+@@ -258,12 +258,12 @@ static int log_one_block(struct log_writes_c *lc,
+ 		goto out;
+ 	sector++;
+ 
++	atomic_inc(&lc->io_blocks);
+ 	bio = bio_alloc(GFP_KERNEL, block->vec_cnt);
+ 	if (!bio) {
+ 		DMERR("Couldn't alloc log bio");
+ 		goto error;
+ 	}
+-	atomic_inc(&lc->io_blocks);
+ 	bio->bi_iter.bi_size = 0;
+ 	bio->bi_iter.bi_sector = sector;
+ 	bio->bi_bdev = lc->logdev->bdev;
+@@ -456,9 +456,9 @@ static int log_writes_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ 		goto bad;
+ 	}
+ 
+-	ret = -EINVAL;
+ 	lc->log_kthread = kthread_run(log_writes_kthread, lc, "log-write");
+-	if (!lc->log_kthread) {
++	if (IS_ERR(lc->log_kthread)) {
++		ret = PTR_ERR(lc->log_kthread);
+ 		ti->error = "Couldn't alloc kthread";
+ 		dm_put_device(ti, lc->dev);
+ 		dm_put_device(ti, lc->logdev);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index c57fdf847b47..c1c7d4fb4b77 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -7572,16 +7572,12 @@ EXPORT_SYMBOL(unregister_md_cluster_operations);
+ 
+ int md_setup_cluster(struct mddev *mddev, int nodes)
+ {
+-	int err;
+-
+-	err = request_module("md-cluster");
+-	if (err) {
+-		pr_err("md-cluster module not found.\n");
+-		return -ENOENT;
+-	}
+-
++	if (!md_cluster_ops)
++		request_module("md-cluster");
+ 	spin_lock(&pers_lock);
++	/* ensure module won't be unloaded */
+ 	if (!md_cluster_ops || !try_module_get(md_cluster_mod)) {
++		pr_err("can't find md-cluster module or get it's reference.\n");
+ 		spin_unlock(&pers_lock);
+ 		return -ENOENT;
+ 	}
+diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
+index 7e1d13b68b06..81bdeeb05a4d 100644
+--- a/drivers/mmc/host/dw_mmc-pltfm.c
++++ b/drivers/mmc/host/dw_mmc-pltfm.c
+@@ -60,7 +60,7 @@ int dw_mci_pltfm_register(struct platform_device *pdev,
+ 
+ 	regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	/* Get registers' physical base address */
+-	host->phy_regs = (void *)(regs->start);
++	host->phy_regs = regs->start;
+ 	host->regs = devm_ioremap_resource(&pdev->dev, regs);
+ 	if (IS_ERR(host->regs))
+ 		return PTR_ERR(host->regs);
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
+index 7a6cedbe48a8..fb204ee6ff89 100644
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -699,7 +699,7 @@ static int dw_mci_edmac_start_dma(struct dw_mci *host,
+ 	int ret = 0;
+ 
+ 	/* Set external dma config: burst size, burst width */
+-	cfg.dst_addr = (dma_addr_t)(host->phy_regs + fifo_offset);
++	cfg.dst_addr = host->phy_regs + fifo_offset;
+ 	cfg.src_addr = cfg.dst_addr;
+ 	cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 	cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+diff --git a/drivers/net/ethernet/cavium/thunder/nic_reg.h b/drivers/net/ethernet/cavium/thunder/nic_reg.h
+index afb10e326b4f..fab35a593898 100644
+--- a/drivers/net/ethernet/cavium/thunder/nic_reg.h
++++ b/drivers/net/ethernet/cavium/thunder/nic_reg.h
+@@ -170,7 +170,6 @@
+ #define   NIC_QSET_SQ_0_7_DOOR			(0x010838)
+ #define   NIC_QSET_SQ_0_7_STATUS		(0x010840)
+ #define   NIC_QSET_SQ_0_7_DEBUG			(0x010848)
+-#define   NIC_QSET_SQ_0_7_CNM_CHG		(0x010860)
+ #define   NIC_QSET_SQ_0_7_STAT_0_1		(0x010900)
+ 
+ #define   NIC_QSET_RBDR_0_1_CFG			(0x010C00)
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
+index a12b2e38cf61..ff1d777f3ed9 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
+@@ -380,7 +380,10 @@ static void nicvf_get_regs(struct net_device *dev,
+ 		p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_DOOR, q);
+ 		p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_STATUS, q);
+ 		p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_DEBUG, q);
+-		p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_CNM_CHG, q);
++		/* Padding, was NIC_QSET_SQ_0_7_CNM_CHG, which
++		 * produces bus errors when read
++		 */
++		p[i++] = 0;
+ 		p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_STAT_0_1, q);
+ 		reg_offset = NIC_QSET_SQ_0_7_STAT_0_1 | (1 << 3);
+ 		p[i++] = nicvf_queue_reg_read(nic, reg_offset, q);
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index d184e682e636..8c5d2cf9c979 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1550,13 +1550,13 @@ static int ath9k_sta_state(struct ieee80211_hw *hw,
+ 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+ 	int ret = 0;
+ 
+-	if (old_state == IEEE80211_STA_AUTH &&
+-	    new_state == IEEE80211_STA_ASSOC) {
++	if (old_state == IEEE80211_STA_NOTEXIST &&
++	    new_state == IEEE80211_STA_NONE) {
+ 		ret = ath9k_sta_add(hw, vif, sta);
+ 		ath_dbg(common, CONFIG,
+ 			"Add station: %pM\n", sta->addr);
+-	} else if (old_state == IEEE80211_STA_ASSOC &&
+-		   new_state == IEEE80211_STA_AUTH) {
++	} else if (old_state == IEEE80211_STA_NONE &&
++		   new_state == IEEE80211_STA_NOTEXIST) {
+ 		ret = ath9k_sta_remove(hw, vif, sta);
+ 		ath_dbg(common, CONFIG,
+ 			"Remove station: %pM\n", sta->addr);
+diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
+index b3235fd2950c..271cca63e9bd 100644
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -1002,7 +1002,7 @@ static int atmel_pinctrl_probe(struct platform_device *pdev)
+ 		atmel_pioctrl->irqs[i] = res->start;
+ 		irq_set_chained_handler(res->start, atmel_gpio_irq_handler);
+ 		irq_set_handler_data(res->start, atmel_pioctrl);
+-		dev_dbg(dev, "bank %i: hwirq=%u\n", i, res->start);
++		dev_dbg(dev, "bank %i: irq=%pr\n", i, res);
+ 	}
+ 
+ 	atmel_pioctrl->irq_domain = irq_domain_add_linear(dev->of_node,
+diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c
+index 6b1a47f8c096..98a459b1c095 100644
+--- a/drivers/pinctrl/pinctrl-pistachio.c
++++ b/drivers/pinctrl/pinctrl-pistachio.c
+@@ -809,17 +809,17 @@ static const struct pistachio_pin_group pistachio_groups[] = {
+ 			   PADS_FUNCTION_SELECT2, 12, 0x3),
+ 	MFIO_MUX_PIN_GROUP(83, MIPS_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
+ 			   PADS_FUNCTION_SELECT2, 14, 0x3),
+-	MFIO_MUX_PIN_GROUP(84, SYS_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
++	MFIO_MUX_PIN_GROUP(84, AUDIO_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
+ 			   PADS_FUNCTION_SELECT2, 16, 0x3),
+-	MFIO_MUX_PIN_GROUP(85, WIFI_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
++	MFIO_MUX_PIN_GROUP(85, RPU_V_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
+ 			   PADS_FUNCTION_SELECT2, 18, 0x3),
+-	MFIO_MUX_PIN_GROUP(86, BT_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
++	MFIO_MUX_PIN_GROUP(86, RPU_L_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
+ 			   PADS_FUNCTION_SELECT2, 20, 0x3),
+-	MFIO_MUX_PIN_GROUP(87, RPU_V_PLL_LOCK, DREQ2, SOCIF_DEBUG,
++	MFIO_MUX_PIN_GROUP(87, SYS_PLL_LOCK, DREQ2, SOCIF_DEBUG,
+ 			   PADS_FUNCTION_SELECT2, 22, 0x3),
+-	MFIO_MUX_PIN_GROUP(88, RPU_L_PLL_LOCK, DREQ3, SOCIF_DEBUG,
++	MFIO_MUX_PIN_GROUP(88, WIFI_PLL_LOCK, DREQ3, SOCIF_DEBUG,
+ 			   PADS_FUNCTION_SELECT2, 24, 0x3),
+-	MFIO_MUX_PIN_GROUP(89, AUDIO_PLL_LOCK, DREQ4, DREQ5,
++	MFIO_MUX_PIN_GROUP(89, BT_PLL_LOCK, DREQ4, DREQ5,
+ 			   PADS_FUNCTION_SELECT2, 26, 0x3),
+ 	PIN_GROUP(TCK, "tck"),
+ 	PIN_GROUP(TRSTN, "trstn"),
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
+index 55083d278bb1..51fbf85301be 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
+@@ -485,12 +485,12 @@ static const struct sunxi_desc_pin sun8i_a23_pins[] = {
+ 	SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 8),
+ 		  SUNXI_FUNCTION(0x0, "gpio_in"),
+ 		  SUNXI_FUNCTION(0x1, "gpio_out"),
+-		  SUNXI_FUNCTION(0x2, "uart2"),		/* RTS */
++		  SUNXI_FUNCTION(0x2, "uart1"),		/* RTS */
+ 		  SUNXI_FUNCTION_IRQ_BANK(0x4, 2, 8)),	/* PG_EINT8 */
+ 	SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 9),
+ 		  SUNXI_FUNCTION(0x0, "gpio_in"),
+ 		  SUNXI_FUNCTION(0x1, "gpio_out"),
+-		  SUNXI_FUNCTION(0x2, "uart2"),		/* CTS */
++		  SUNXI_FUNCTION(0x2, "uart1"),		/* CTS */
+ 		  SUNXI_FUNCTION_IRQ_BANK(0x4, 2, 9)),	/* PG_EINT9 */
+ 	SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 10),
+ 		  SUNXI_FUNCTION(0x0, "gpio_in"),
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
+index 8b381d69df86..584cdedea7a4 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
+@@ -407,12 +407,12 @@ static const struct sunxi_desc_pin sun8i_a33_pins[] = {
+ 	SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 8),
+ 		  SUNXI_FUNCTION(0x0, "gpio_in"),
+ 		  SUNXI_FUNCTION(0x1, "gpio_out"),
+-		  SUNXI_FUNCTION(0x2, "uart2"),		/* RTS */
++		  SUNXI_FUNCTION(0x2, "uart1"),		/* RTS */
+ 		  SUNXI_FUNCTION_IRQ_BANK(0x4, 1, 8)),	/* PG_EINT8 */
+ 	SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 9),
+ 		  SUNXI_FUNCTION(0x0, "gpio_in"),
+ 		  SUNXI_FUNCTION(0x1, "gpio_out"),
+-		  SUNXI_FUNCTION(0x2, "uart2"),		/* CTS */
++		  SUNXI_FUNCTION(0x2, "uart1"),		/* CTS */
+ 		  SUNXI_FUNCTION_IRQ_BANK(0x4, 1, 9)),	/* PG_EINT9 */
+ 	SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 10),
+ 		  SUNXI_FUNCTION(0x0, "gpio_in"),
+diff --git a/drivers/soc/qcom/spm.c b/drivers/soc/qcom/spm.c
+index b04b05a0904e..65bce1eecaf8 100644
+--- a/drivers/soc/qcom/spm.c
++++ b/drivers/soc/qcom/spm.c
+@@ -288,7 +288,7 @@ static struct spm_driver_data *spm_get_drv(struct platform_device *pdev,
+ 	struct spm_driver_data *drv = NULL;
+ 	struct device_node *cpu_node, *saw_node;
+ 	int cpu;
+-	bool found;
++	bool found = 0;
+ 
+ 	for_each_possible_cpu(cpu) {
+ 		cpu_node = of_cpu_device_node_get(cpu);
+diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c
+index ed489880e62b..83b3988eb6b2 100644
+--- a/drivers/tty/serial/8250/8250_mid.c
++++ b/drivers/tty/serial/8250/8250_mid.c
+@@ -149,6 +149,9 @@ static void mid8250_set_termios(struct uart_port *p,
+ 	unsigned long w = BIT(24) - 1;
+ 	unsigned long mul, div;
+ 
++	/* Gracefully handle the B0 case: fall back to B9600 */
++	fuart = fuart ? fuart : 9600 * 16;
++
+ 	if (mid->board->freq < fuart) {
+ 		/* Find prescaler value that satisfies Fuart < Fref */
+ 		if (mid->board->freq > baud)
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index c1d4a8fa9be8..029de3f99752 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1952,6 +1952,43 @@ pci_wch_ch38x_setup(struct serial_private *priv,
+ #define PCI_DEVICE_ID_PERICOM_PI7C9X7954	0x7954
+ #define PCI_DEVICE_ID_PERICOM_PI7C9X7958	0x7958
+ 
++#define PCI_VENDOR_ID_ACCESIO			0x494f
++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB	0x1051
++#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S	0x1053
++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB	0x105C
++#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S	0x105E
++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB	0x1091
++#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2	0x1093
++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB	0x1099
++#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4	0x109B
++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB	0x10D1
++#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM	0x10D3
++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB	0x10DA
++#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM	0x10DC
++#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1	0x1108
++#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2	0x1110
++#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2	0x1111
++#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4	0x1118
++#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4	0x1119
++#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S	0x1152
++#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S	0x115A
++#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2	0x1190
++#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2	0x1191
++#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4	0x1198
++#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4	0x1199
++#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM	0x11D0
++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4	0x105A
++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4	0x105B
++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8	0x106A
++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM485_8	0x106B
++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4	0x1098
++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8	0x10A9
++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM	0x10D9
++#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM	0x10E9
++#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM	0x11D8
++
++
++
+ /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
+ #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584	0x1584
+ #define PCI_SUBDEVICE_ID_UNKNOWN_0x1588	0x1588
+@@ -5120,6 +5157,108 @@ static struct pci_device_id serial_pci_tbl[] = {
+ 		0,
+ 		0, pbn_pericom_PI7C9X7958 },
+ 	/*
++	 * ACCES I/O Products quad
++	 */
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7954 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7958 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7958 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7958 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_8,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7958 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7958 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7958 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7958 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7958 },
++	{	PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_pericom_PI7C9X7958 },
++	/*
+ 	 * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke)
+ 	 */
+ 	{	PCI_VENDOR_ID_TOPIC, PCI_DEVICE_ID_TOPIC_TP560,
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index ca367b05e440..68fc5fce4cc5 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -939,6 +939,15 @@ static int isr_setup_status_phase(struct ci_hdrc *ci)
+ 	int retval;
+ 	struct ci_hw_ep *hwep;
+ 
++	/*
++	 * Unexpected USB controller behavior, caused by bad signal integrity
++	 * or ground reference problems, can lead to isr_setup_status_phase
++	 * being called with ci->status equal to NULL.
++	 * If this situation occurs, you should review your USB hardware design.
++	 */
++	if (WARN_ON_ONCE(!ci->status))
++		return -EPIPE;
++
+ 	hwep = (ci->ep0_dir == TX) ? ci->ep0out : ci->ep0in;
+ 	ci->status->context = ci;
+ 	ci->status->complete = isr_setup_status_complete;
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 80c8d90d8b75..ff44cfa26af8 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -211,8 +211,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+ 	memcpy(&endpoint->desc, d, n);
+ 	INIT_LIST_HEAD(&endpoint->urb_list);
+ 
+-	/* Fix up bInterval values outside the legal range. Use 32 ms if no
+-	 * proper value can be guessed. */
++	/*
++	 * Fix up bInterval values outside the legal range.
++	 * Use 10 or 8 ms if no proper value can be guessed.
++	 */
+ 	i = 0;		/* i = min, j = max, n = default */
+ 	j = 255;
+ 	if (usb_endpoint_xfer_int(d)) {
+@@ -221,13 +223,15 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+ 		case USB_SPEED_SUPER_PLUS:
+ 		case USB_SPEED_SUPER:
+ 		case USB_SPEED_HIGH:
+-			/* Many device manufacturers are using full-speed
++			/*
++			 * Many device manufacturers are using full-speed
+ 			 * bInterval values in high-speed interrupt endpoint
+-			 * descriptors. Try to fix those and fall back to a
+-			 * 32 ms default value otherwise. */
++			 * descriptors. Try to fix those and fall back to an
++			 * 8-ms default value otherwise.
++			 */
+ 			n = fls(d->bInterval*8);
+ 			if (n == 0)
+-				n = 9;	/* 32 ms = 2^(9-1) uframes */
++				n = 7;	/* 8 ms = 2^(7-1) uframes */
+ 			j = 16;
+ 
+ 			/*
+@@ -242,10 +246,12 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+ 			}
+ 			break;
+ 		default:		/* USB_SPEED_FULL or _LOW */
+-			/* For low-speed, 10 ms is the official minimum.
++			/*
++			 * For low-speed, 10 ms is the official minimum.
+ 			 * But some "overclocked" devices might want faster
+-			 * polling so we'll allow it. */
+-			n = 32;
++			 * polling so we'll allow it.
++			 */
++			n = 10;
+ 			break;
+ 		}
+ 	} else if (usb_endpoint_xfer_isoc(d)) {
+@@ -253,10 +259,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+ 		j = 16;
+ 		switch (to_usb_device(ddev)->speed) {
+ 		case USB_SPEED_HIGH:
+-			n = 9;		/* 32 ms = 2^(9-1) uframes */
++			n = 7;		/* 8 ms = 2^(7-1) uframes */
+ 			break;
+ 		default:		/* USB_SPEED_FULL */
+-			n = 6;		/* 32 ms = 2^(6-1) frames */
++			n = 4;		/* 8 ms = 2^(4-1) frames */
+ 			break;
+ 		}
+ 	}
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 1f37b89e7267..62a5c8d5e028 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -846,6 +846,10 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
+ 	spin_lock_irqsave(&xhci->lock, flags);
+ 
+ 	ep->stop_cmds_pending--;
++	if (xhci->xhc_state & XHCI_STATE_REMOVING) {
++		spin_unlock_irqrestore(&xhci->lock, flags);
++		return;
++	}
+ 	if (xhci->xhc_state & XHCI_STATE_DYING) {
+ 		xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
+ 				"Stop EP timer ran, but another timer marked "
+@@ -899,7 +903,7 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
+ 	spin_unlock_irqrestore(&xhci->lock, flags);
+ 	xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
+ 			"Calling usb_hc_died()");
+-	usb_hc_died(xhci_to_hcd(xhci)->primary_hcd);
++	usb_hc_died(xhci_to_hcd(xhci));
+ 	xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
+ 			"xHCI host controller is dead.");
+ }
+diff --git a/drivers/usb/renesas_usbhs/mod.c b/drivers/usb/renesas_usbhs/mod.c
+index d4be5d594896..28965ef4f824 100644
+--- a/drivers/usb/renesas_usbhs/mod.c
++++ b/drivers/usb/renesas_usbhs/mod.c
+@@ -282,9 +282,16 @@ static irqreturn_t usbhs_interrupt(int irq, void *data)
+ 	if (usbhs_mod_is_host(priv))
+ 		usbhs_write(priv, INTSTS1, ~irq_state.intsts1 & INTSTS1_MAGIC);
+ 
+-	usbhs_write(priv, BRDYSTS, ~irq_state.brdysts);
++	/*
++	 * The driver should not clear the xxxSTS after the line of
++	 * "call irq callback functions" because each "if" statement is
++	 * possible to call the callback function for avoiding any side effects.
++	 */
++	if (irq_state.intsts0 & BRDY)
++		usbhs_write(priv, BRDYSTS, ~irq_state.brdysts);
+ 	usbhs_write(priv, NRDYSTS, ~irq_state.nrdysts);
+-	usbhs_write(priv, BEMPSTS, ~irq_state.bempsts);
++	if (irq_state.intsts0 & BEMP)
++		usbhs_write(priv, BEMPSTS, ~irq_state.bempsts);
+ 
+ 	/*
+ 	 * call irq callback functions
+diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
+index a204782ae530..e98b6e57b703 100644
+--- a/drivers/usb/serial/usb-serial-simple.c
++++ b/drivers/usb/serial/usb-serial-simple.c
+@@ -54,7 +54,8 @@ DEVICE(funsoft, FUNSOFT_IDS);
+ /* Infineon Flashloader driver */
+ #define FLASHLOADER_IDS()		\
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
+-	{ USB_DEVICE(0x8087, 0x0716) }
++	{ USB_DEVICE(0x8087, 0x0716) }, \
++	{ USB_DEVICE(0x8087, 0x0801) }
+ DEVICE(flashloader, FLASHLOADER_IDS);
+ 
+ /* Google Serial USB SubClass */
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 0e044d7ee721..1415f6d58633 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -2850,6 +2850,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
+ 
+ 	if (log_root_tree->log_transid_committed >= root_log_ctx.log_transid) {
+ 		blk_finish_plug(&plug);
++		list_del_init(&root_log_ctx.list);
+ 		mutex_unlock(&log_root_tree->log_mutex);
+ 		ret = root_log_ctx.log_ret;
+ 		goto out;
+diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c
+index ad050698143f..8a9feb341f31 100644
+--- a/fs/ext4/crypto_policy.c
++++ b/fs/ext4/crypto_policy.c
+@@ -102,6 +102,9 @@ static int ext4_create_encryption_context_from_policy(
+ int ext4_process_policy(const struct ext4_encryption_policy *policy,
+ 			struct inode *inode)
+ {
++	if (!inode_owner_or_capable(inode))
++		return -EACCES;
++
+ 	if (policy->version != 0)
+ 		return -EINVAL;
+ 
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 5e872fd40e5e..1fb12f9c97a6 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -629,7 +629,13 @@ resizefs_out:
+ 			goto encryption_policy_out;
+ 		}
+ 
++		err = mnt_want_write_file(filp);
++		if (err)
++			goto encryption_policy_out;
++
+ 		err = ext4_process_policy(&policy, inode);
++
++		mnt_drop_write_file(filp);
+ encryption_policy_out:
+ 		return err;
+ #else
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index c4dcac8a018d..3c7f0c44cfb3 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -815,7 +815,7 @@ static void mb_regenerate_buddy(struct ext4_buddy *e4b)
+  * for this page; do not hold this lock when calling this routine!
+  */
+ 
+-static int ext4_mb_init_cache(struct page *page, char *incore)
++static int ext4_mb_init_cache(struct page *page, char *incore, gfp_t gfp)
+ {
+ 	ext4_group_t ngroups;
+ 	int blocksize;
+@@ -848,7 +848,7 @@ static int ext4_mb_init_cache(struct page *page, char *incore)
+ 	/* allocate buffer_heads to read bitmaps */
+ 	if (groups_per_page > 1) {
+ 		i = sizeof(struct buffer_head *) * groups_per_page;
+-		bh = kzalloc(i, GFP_NOFS);
++		bh = kzalloc(i, gfp);
+ 		if (bh == NULL) {
+ 			err = -ENOMEM;
+ 			goto out;
+@@ -983,7 +983,7 @@ out:
+  * are on the same page e4b->bd_buddy_page is NULL and return value is 0.
+  */
+ static int ext4_mb_get_buddy_page_lock(struct super_block *sb,
+-		ext4_group_t group, struct ext4_buddy *e4b)
++		ext4_group_t group, struct ext4_buddy *e4b, gfp_t gfp)
+ {
+ 	struct inode *inode = EXT4_SB(sb)->s_buddy_cache;
+ 	int block, pnum, poff;
+@@ -1002,7 +1002,7 @@ static int ext4_mb_get_buddy_page_lock(struct super_block *sb,
+ 	block = group * 2;
+ 	pnum = block / blocks_per_page;
+ 	poff = block % blocks_per_page;
+-	page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
++	page = find_or_create_page(inode->i_mapping, pnum, gfp);
+ 	if (!page)
+ 		return -ENOMEM;
+ 	BUG_ON(page->mapping != inode->i_mapping);
+@@ -1016,7 +1016,7 @@ static int ext4_mb_get_buddy_page_lock(struct super_block *sb,
+ 
+ 	block++;
+ 	pnum = block / blocks_per_page;
+-	page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
++	page = find_or_create_page(inode->i_mapping, pnum, gfp);
+ 	if (!page)
+ 		return -ENOMEM;
+ 	BUG_ON(page->mapping != inode->i_mapping);
+@@ -1042,7 +1042,7 @@ static void ext4_mb_put_buddy_page_lock(struct ext4_buddy *e4b)
+  * calling this routine!
+  */
+ static noinline_for_stack
+-int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
++int ext4_mb_init_group(struct super_block *sb, ext4_group_t group, gfp_t gfp)
+ {
+ 
+ 	struct ext4_group_info *this_grp;
+@@ -1062,7 +1062,7 @@ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
+ 	 * The call to ext4_mb_get_buddy_page_lock will mark the
+ 	 * page accessed.
+ 	 */
+-	ret = ext4_mb_get_buddy_page_lock(sb, group, &e4b);
++	ret = ext4_mb_get_buddy_page_lock(sb, group, &e4b, gfp);
+ 	if (ret || !EXT4_MB_GRP_NEED_INIT(this_grp)) {
+ 		/*
+ 		 * somebody initialized the group
+@@ -1072,7 +1072,7 @@ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
+ 	}
+ 
+ 	page = e4b.bd_bitmap_page;
+-	ret = ext4_mb_init_cache(page, NULL);
++	ret = ext4_mb_init_cache(page, NULL, gfp);
+ 	if (ret)
+ 		goto err;
+ 	if (!PageUptodate(page)) {
+@@ -1091,7 +1091,7 @@ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
+ 	}
+ 	/* init buddy cache */
+ 	page = e4b.bd_buddy_page;
+-	ret = ext4_mb_init_cache(page, e4b.bd_bitmap);
++	ret = ext4_mb_init_cache(page, e4b.bd_bitmap, gfp);
+ 	if (ret)
+ 		goto err;
+ 	if (!PageUptodate(page)) {
+@@ -1109,8 +1109,8 @@ err:
+  * calling this routine!
+  */
+ static noinline_for_stack int
+-ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,
+-					struct ext4_buddy *e4b)
++ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group,
++		       struct ext4_buddy *e4b, gfp_t gfp)
+ {
+ 	int blocks_per_page;
+ 	int block;
+@@ -1140,7 +1140,7 @@ ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,
+ 		 * we need full data about the group
+ 		 * to make a good selection
+ 		 */
+-		ret = ext4_mb_init_group(sb, group);
++		ret = ext4_mb_init_group(sb, group, gfp);
+ 		if (ret)
+ 			return ret;
+ 	}
+@@ -1168,11 +1168,11 @@ ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,
+ 			 * wait for it to initialize.
+ 			 */
+ 			page_cache_release(page);
+-		page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
++		page = find_or_create_page(inode->i_mapping, pnum, gfp);
+ 		if (page) {
+ 			BUG_ON(page->mapping != inode->i_mapping);
+ 			if (!PageUptodate(page)) {
+-				ret = ext4_mb_init_cache(page, NULL);
++				ret = ext4_mb_init_cache(page, NULL, gfp);
+ 				if (ret) {
+ 					unlock_page(page);
+ 					goto err;
+@@ -1204,11 +1204,12 @@ ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,
+ 	if (page == NULL || !PageUptodate(page)) {
+ 		if (page)
+ 			page_cache_release(page);
+-		page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
++		page = find_or_create_page(inode->i_mapping, pnum, gfp);
+ 		if (page) {
+ 			BUG_ON(page->mapping != inode->i_mapping);
+ 			if (!PageUptodate(page)) {
+-				ret = ext4_mb_init_cache(page, e4b->bd_bitmap);
++				ret = ext4_mb_init_cache(page, e4b->bd_bitmap,
++							 gfp);
+ 				if (ret) {
+ 					unlock_page(page);
+ 					goto err;
+@@ -1247,6 +1248,12 @@ err:
+ 	return ret;
+ }
+ 
++static int ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,
++			      struct ext4_buddy *e4b)
++{
++	return ext4_mb_load_buddy_gfp(sb, group, e4b, GFP_NOFS);
++}
++
+ static void ext4_mb_unload_buddy(struct ext4_buddy *e4b)
+ {
+ 	if (e4b->bd_bitmap_page)
+@@ -2047,7 +2054,7 @@ static int ext4_mb_good_group(struct ext4_allocation_context *ac,
+ 
+ 	/* We only do this if the grp has never been initialized */
+ 	if (unlikely(EXT4_MB_GRP_NEED_INIT(grp))) {
+-		int ret = ext4_mb_init_group(ac->ac_sb, group);
++		int ret = ext4_mb_init_group(ac->ac_sb, group, GFP_NOFS);
+ 		if (ret)
+ 			return ret;
+ 	}
+@@ -4808,7 +4815,9 @@ do_more:
+ #endif
+ 	trace_ext4_mballoc_free(sb, inode, block_group, bit, count_clusters);
+ 
+-	err = ext4_mb_load_buddy(sb, block_group, &e4b);
++	/* __GFP_NOFAIL: retry infinitely, ignore TIF_MEMDIE and memcg limit. */
++	err = ext4_mb_load_buddy_gfp(sb, block_group, &e4b,
++				     GFP_NOFS|__GFP_NOFAIL);
+ 	if (err)
+ 		goto error_return;
+ 
+@@ -5210,7 +5219,7 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)
+ 		grp = ext4_get_group_info(sb, group);
+ 		/* We only do this if the grp has never been initialized */
+ 		if (unlikely(EXT4_MB_GRP_NEED_INIT(grp))) {
+-			ret = ext4_mb_init_group(sb, group);
++			ret = ext4_mb_init_group(sb, group, GFP_NOFS);
+ 			if (ret)
+ 				break;
+ 		}
+diff --git a/fs/f2fs/crypto_policy.c b/fs/f2fs/crypto_policy.c
+index d4a96af513c2..e504f548b64e 100644
+--- a/fs/f2fs/crypto_policy.c
++++ b/fs/f2fs/crypto_policy.c
+@@ -89,6 +89,9 @@ static int f2fs_create_encryption_context_from_policy(
+ int f2fs_process_policy(const struct f2fs_encryption_policy *policy,
+ 			struct inode *inode)
+ {
++	if (!inode_owner_or_capable(inode))
++		return -EACCES;
++
+ 	if (policy->version != 0)
+ 		return -EINVAL;
+ 
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index d58d4c0af0ce..682e79965c16 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -540,13 +540,13 @@ void fuse_read_fill(struct fuse_req *req, struct file *file, loff_t pos,
+ 	req->out.args[0].size = count;
+ }
+ 
+-static void fuse_release_user_pages(struct fuse_req *req, int write)
++static void fuse_release_user_pages(struct fuse_req *req, bool should_dirty)
+ {
+ 	unsigned i;
+ 
+ 	for (i = 0; i < req->num_pages; i++) {
+ 		struct page *page = req->pages[i];
+-		if (write)
++		if (should_dirty)
+ 			set_page_dirty_lock(page);
+ 		put_page(page);
+ 	}
+@@ -1331,6 +1331,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
+ 		       loff_t *ppos, int flags)
+ {
+ 	int write = flags & FUSE_DIO_WRITE;
++	bool should_dirty = !write && iter_is_iovec(iter);
+ 	int cuse = flags & FUSE_DIO_CUSE;
+ 	struct file *file = io->file;
+ 	struct inode *inode = file->f_mapping->host;
+@@ -1375,7 +1376,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
+ 			nres = fuse_send_read(req, io, pos, nbytes, owner);
+ 
+ 		if (!io->async)
+-			fuse_release_user_pages(req, !write);
++			fuse_release_user_pages(req, should_dirty);
+ 		if (req->out.h.error) {
+ 			if (!res)
+ 				res = req->out.h.error;
+diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
+index 7247252ee9b1..6e9a912d394c 100644
+--- a/fs/kernfs/file.c
++++ b/fs/kernfs/file.c
+@@ -833,21 +833,35 @@ repeat:
+ 	mutex_lock(&kernfs_mutex);
+ 
+ 	list_for_each_entry(info, &kernfs_root(kn)->supers, node) {
++		struct kernfs_node *parent;
+ 		struct inode *inode;
+-		struct dentry *dentry;
+ 
++		/*
++		 * We want fsnotify_modify() on @kn but as the
++		 * modifications aren't originating from userland don't
++		 * have the matching @file available.  Look up the inodes
++		 * and generate the events manually.
++		 */
+ 		inode = ilookup(info->sb, kn->ino);
+ 		if (!inode)
+ 			continue;
+ 
+-		dentry = d_find_any_alias(inode);
+-		if (dentry) {
+-			fsnotify_parent(NULL, dentry, FS_MODIFY);
+-			fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE,
+-				 NULL, 0);
+-			dput(dentry);
++		parent = kernfs_get_parent(kn);
++		if (parent) {
++			struct inode *p_inode;
++
++			p_inode = ilookup(info->sb, parent->ino);
++			if (p_inode) {
++				fsnotify(p_inode, FS_MODIFY | FS_EVENT_ON_CHILD,
++					 inode, FSNOTIFY_EVENT_INODE, kn->name, 0);
++				iput(p_inode);
++			}
++
++			kernfs_put(parent);
+ 		}
+ 
++		fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE,
++			 kn->name, 0);
+ 		iput(inode);
+ 	}
+ 
+diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
+index a7f2e6e33305..52a28311e2a4 100644
+--- a/fs/nfs/callback.c
++++ b/fs/nfs/callback.c
+@@ -275,6 +275,7 @@ static int nfs_callback_up_net(int minorversion, struct svc_serv *serv,
+ err_socks:
+ 	svc_rpcb_cleanup(serv, net);
+ err_bind:
++	nn->cb_users[minorversion]--;
+ 	dprintk("NFS: Couldn't create callback socket: err = %d; "
+ 			"net = %p\n", ret, net);
+ 	return ret;
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index fc215ab4dcd5..3c69299c01ab 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7424,12 +7424,20 @@ static int _nfs4_proc_create_session(struct nfs_client *clp,
+ 	status = rpc_call_sync(session->clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
+ 	trace_nfs4_create_session(clp, status);
+ 
++	switch (status) {
++	case -NFS4ERR_STALE_CLIENTID:
++	case -NFS4ERR_DELAY:
++	case -ETIMEDOUT:
++	case -EACCES:
++	case -EAGAIN:
++		goto out;
++	};
++
++	clp->cl_seqid++;
+ 	if (!status) {
+ 		/* Verify the session's negotiated channel_attrs values */
+ 		status = nfs4_verify_channel_attrs(&args, &res);
+ 		/* Increment the clientid slot sequence id */
+-		if (clp->cl_seqid == res.seqid)
+-			clp->cl_seqid++;
+ 		if (status)
+ 			goto out;
+ 		nfs4_update_session(session, &res);
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index bec0384499f7..5cd3568eea06 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -365,6 +365,9 @@ pnfs_layout_need_return(struct pnfs_layout_hdr *lo,
+ static bool
+ pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo)
+ {
++	/* Serialise LAYOUTGET/LAYOUTRETURN */
++	if (atomic_read(&lo->plh_outstanding) != 0)
++		return false;
+ 	if (test_and_set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
+ 		return false;
+ 	lo->plh_return_iomode = 0;
+@@ -1530,6 +1533,7 @@ pnfs_update_layout(struct inode *ino,
+ 		goto out;
+ 
+ lookup_again:
++	nfs4_client_recover_expired_lease(clp);
+ 	first = false;
+ 	spin_lock(&ino->i_lock);
+ 	lo = pnfs_find_alloc_layout(ino, ctx, gfp_flags);
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index f7ea624780a7..55638110cb06 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -1200,27 +1200,6 @@ free_ol_stateid_reaplist(struct list_head *reaplist)
+ 	}
+ }
+ 
+-static void release_lockowner(struct nfs4_lockowner *lo)
+-{
+-	struct nfs4_client *clp = lo->lo_owner.so_client;
+-	struct nfs4_ol_stateid *stp;
+-	struct list_head reaplist;
+-
+-	INIT_LIST_HEAD(&reaplist);
+-
+-	spin_lock(&clp->cl_lock);
+-	unhash_lockowner_locked(lo);
+-	while (!list_empty(&lo->lo_owner.so_stateids)) {
+-		stp = list_first_entry(&lo->lo_owner.so_stateids,
+-				struct nfs4_ol_stateid, st_perstateowner);
+-		WARN_ON(!unhash_lock_stateid(stp));
+-		put_ol_stateid_locked(stp, &reaplist);
+-	}
+-	spin_unlock(&clp->cl_lock);
+-	free_ol_stateid_reaplist(&reaplist);
+-	nfs4_put_stateowner(&lo->lo_owner);
+-}
+-
+ static void release_open_stateid_locks(struct nfs4_ol_stateid *open_stp,
+ 				       struct list_head *reaplist)
+ {
+@@ -5952,6 +5931,7 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp,
+ 	__be32 status;
+ 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
+ 	struct nfs4_client *clp;
++	LIST_HEAD (reaplist);
+ 
+ 	dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
+ 		clid->cl_boot, clid->cl_id);
+@@ -5982,9 +5962,23 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp,
+ 		nfs4_get_stateowner(sop);
+ 		break;
+ 	}
++	if (!lo) {
++		spin_unlock(&clp->cl_lock);
++		return status;
++	}
++
++	unhash_lockowner_locked(lo);
++	while (!list_empty(&lo->lo_owner.so_stateids)) {
++		stp = list_first_entry(&lo->lo_owner.so_stateids,
++				       struct nfs4_ol_stateid,
++				       st_perstateowner);
++		WARN_ON(!unhash_lock_stateid(stp));
++		put_ol_stateid_locked(stp, &reaplist);
++	}
+ 	spin_unlock(&clp->cl_lock);
+-	if (lo)
+-		release_lockowner(lo);
++	free_ol_stateid_reaplist(&reaplist);
++	nfs4_put_stateowner(&lo->lo_owner);
++
+ 	return status;
+ }
+ 
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index e8bbf6cdb437..d2b8c754f627 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -1545,18 +1545,13 @@ static const struct file_operations proc_pid_set_comm_operations = {
+ static int proc_exe_link(struct dentry *dentry, struct path *exe_path)
+ {
+ 	struct task_struct *task;
+-	struct mm_struct *mm;
+ 	struct file *exe_file;
+ 
+ 	task = get_proc_task(d_inode(dentry));
+ 	if (!task)
+ 		return -ENOENT;
+-	mm = get_task_mm(task);
++	exe_file = get_task_exe_file(task);
+ 	put_task_struct(task);
+-	if (!mm)
+-		return -ENOENT;
+-	exe_file = get_mm_exe_file(mm);
+-	mmput(mm);
+ 	if (exe_file) {
+ 		*exe_path = exe_file->f_path;
+ 		path_get(&exe_file->f_path);
+diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h
+index 1bfa602958f2..32901d11f8c4 100644
+--- a/include/asm-generic/uaccess.h
++++ b/include/asm-generic/uaccess.h
+@@ -230,14 +230,18 @@ extern int __put_user_bad(void) __attribute__((noreturn));
+ 	might_fault();						\
+ 	access_ok(VERIFY_READ, __p, sizeof(*ptr)) ?		\
+ 		__get_user((x), (__typeof__(*(ptr)) *)__p) :	\
+-		-EFAULT;					\
++		((x) = (__typeof__(*(ptr)))0,-EFAULT);		\
+ })
+ 
+ #ifndef __get_user_fn
+ static inline int __get_user_fn(size_t size, const void __user *ptr, void *x)
+ {
+-	size = __copy_from_user(x, ptr, size);
+-	return size ? -EFAULT : size;
++	size_t n = __copy_from_user(x, ptr, size);
++	if (unlikely(n)) {
++		memset(x + (size - n), 0, n);
++		return -EFAULT;
++	}
++	return 0;
+ }
+ 
+ #define __get_user_fn(sz, u, k)	__get_user_fn(sz, u, k)
+@@ -257,11 +261,13 @@ extern int __get_user_bad(void) __attribute__((noreturn));
+ static inline long copy_from_user(void *to,
+ 		const void __user * from, unsigned long n)
+ {
++	unsigned long res = n;
+ 	might_fault();
+-	if (access_ok(VERIFY_READ, from, n))
+-		return __copy_from_user(to, from, n);
+-	else
+-		return n;
++	if (likely(access_ok(VERIFY_READ, from, n)))
++		res = __copy_from_user(to, from, n);
++	if (unlikely(res))
++		memset(to + (n - res), 0, res);
++	return res;
+ }
+ 
+ static inline long copy_to_user(void __user *to,
+diff --git a/include/linux/irq.h b/include/linux/irq.h
+index 3c1c96786248..f7cade00c525 100644
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -916,6 +916,16 @@ static inline void irq_gc_lock(struct irq_chip_generic *gc) { }
+ static inline void irq_gc_unlock(struct irq_chip_generic *gc) { }
+ #endif
+ 
++/*
++ * The irqsave variants are for usage in non interrupt code. Do not use
++ * them in irq_chip callbacks. Use irq_gc_lock() instead.
++ */
++#define irq_gc_lock_irqsave(gc, flags)	\
++	raw_spin_lock_irqsave(&(gc)->lock, flags)
++
++#define irq_gc_unlock_irqrestore(gc, flags)	\
++	raw_spin_unlock_irqrestore(&(gc)->lock, flags)
++
+ static inline void irq_reg_writel(struct irq_chip_generic *gc,
+ 				  u32 val, int reg_offset)
+ {
+diff --git a/include/linux/mfd/ti_am335x_tscadc.h b/include/linux/mfd/ti_am335x_tscadc.h
+index 1fd50dcfe47c..175c82699e9d 100644
+--- a/include/linux/mfd/ti_am335x_tscadc.h
++++ b/include/linux/mfd/ti_am335x_tscadc.h
+@@ -138,16 +138,16 @@
+ /*
+  * time in us for processing a single channel, calculated as follows:
+  *
+- * num cycles = open delay + (sample delay + conv time) * averaging
++ * max num cycles = open delay + (sample delay + conv time) * averaging
+  *
+- * num cycles: 152 + (1 + 13) * 16 = 376
++ * max num cycles: 262143 + (255 + 13) * 16 = 266431
+  *
+  * clock frequency: 26MHz / 8 = 3.25MHz
+  * clock period: 1 / 3.25MHz = 308ns
+  *
+- * processing time: 376 * 308ns = 116us
++ * max processing time: 266431 * 308ns = 83ms(approx)
+  */
+-#define IDLE_TIMEOUT 116 /* microsec */
++#define IDLE_TIMEOUT 83 /* milliseconds */
+ 
+ #define TSCADC_CELLS		2
+ 
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 8a761248d01e..cfebb742ee18 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1898,6 +1898,7 @@ extern void mm_drop_all_locks(struct mm_struct *mm);
+ 
+ extern void set_mm_exe_file(struct mm_struct *mm, struct file *new_exe_file);
+ extern struct file *get_mm_exe_file(struct mm_struct *mm);
++extern struct file *get_task_exe_file(struct task_struct *task);
+ 
+ extern int may_expand_vm(struct mm_struct *mm, unsigned long npages);
+ extern struct vm_area_struct *_install_special_mapping(struct mm_struct *mm,
+diff --git a/include/linux/mmc/dw_mmc.h b/include/linux/mmc/dw_mmc.h
+index f67b2ec18e6d..7776afb0ffa5 100644
+--- a/include/linux/mmc/dw_mmc.h
++++ b/include/linux/mmc/dw_mmc.h
+@@ -172,7 +172,7 @@ struct dw_mci {
+ 	/* For edmac */
+ 	struct dw_mci_dma_slave *dms;
+ 	/* Registers's physical base address */
+-	void                    *phy_regs;
++	resource_size_t		phy_regs;
+ 
+ 	u32			cmd_status;
+ 	u32			data_status;
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 04c068e55353..b97d6823ef3c 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -511,7 +511,6 @@ static inline void napi_enable(struct napi_struct *n)
+ 	clear_bit(NAPI_STATE_NPSVC, &n->state);
+ }
+ 
+-#ifdef CONFIG_SMP
+ /**
+  *	napi_synchronize - wait until NAPI is not running
+  *	@n: napi context
+@@ -522,12 +521,12 @@ static inline void napi_enable(struct napi_struct *n)
+  */
+ static inline void napi_synchronize(const struct napi_struct *n)
+ {
+-	while (test_bit(NAPI_STATE_SCHED, &n->state))
+-		msleep(1);
++	if (IS_ENABLED(CONFIG_SMP))
++		while (test_bit(NAPI_STATE_SCHED, &n->state))
++			msleep(1);
++	else
++		barrier();
+ }
+-#else
+-# define napi_synchronize(n)	barrier()
+-#endif
+ 
+ enum netdev_queue_state_t {
+ 	__QUEUE_STATE_DRV_XOFF,
+diff --git a/include/linux/uio.h b/include/linux/uio.h
+index 8b01e1c3c614..5f9c59da978b 100644
+--- a/include/linux/uio.h
++++ b/include/linux/uio.h
+@@ -76,7 +76,7 @@ size_t iov_iter_copy_from_user_atomic(struct page *page,
+ 		struct iov_iter *i, unsigned long offset, size_t bytes);
+ void iov_iter_advance(struct iov_iter *i, size_t bytes);
+ int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes);
+-int iov_iter_fault_in_multipages_readable(struct iov_iter *i, size_t bytes);
++#define iov_iter_fault_in_multipages_readable iov_iter_fault_in_readable
+ size_t iov_iter_single_seg_count(const struct iov_iter *i);
+ size_t copy_page_to_iter(struct page *page, size_t offset, size_t bytes,
+ 			 struct iov_iter *i);
+diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
+index 656c7e93ac0d..939945a5649c 100644
+--- a/kernel/audit_watch.c
++++ b/kernel/audit_watch.c
+@@ -19,6 +19,7 @@
+  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+  */
+ 
++#include <linux/file.h>
+ #include <linux/kernel.h>
+ #include <linux/audit.h>
+ #include <linux/kthread.h>
+@@ -544,10 +545,11 @@ int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
+ 	unsigned long ino;
+ 	dev_t dev;
+ 
+-	rcu_read_lock();
+-	exe_file = rcu_dereference(tsk->mm->exe_file);
++	exe_file = get_task_exe_file(tsk);
++	if (!exe_file)
++		return 0;
+ 	ino = exe_file->f_inode->i_ino;
+ 	dev = exe_file->f_inode->i_sb->s_dev;
+-	rcu_read_unlock();
++	fput(exe_file);
+ 	return audit_mark_compare(mark, ino, dev);
+ }
+diff --git a/kernel/configs/tiny.config b/kernel/configs/tiny.config
+index c2de56ab0fce..7fa0c4ae6394 100644
+--- a/kernel/configs/tiny.config
++++ b/kernel/configs/tiny.config
+@@ -1,4 +1,12 @@
++# CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE is not set
+ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
++# CONFIG_KERNEL_GZIP is not set
++# CONFIG_KERNEL_BZIP2 is not set
++# CONFIG_KERNEL_LZMA is not set
+ CONFIG_KERNEL_XZ=y
++# CONFIG_KERNEL_LZO is not set
++# CONFIG_KERNEL_LZ4 is not set
+ CONFIG_OPTIMIZE_INLINING=y
++# CONFIG_SLAB is not set
++# CONFIG_SLUB is not set
+ CONFIG_SLOB=y
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index 11eaf14b52c2..e120bd983ad0 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -2074,6 +2074,20 @@ static void cpuset_bind(struct cgroup_subsys_state *root_css)
+ 	mutex_unlock(&cpuset_mutex);
+ }
+ 
++/*
++ * Make sure the new task conform to the current state of its parent,
++ * which could have been changed by cpuset just after it inherits the
++ * state from the parent and before it sits on the cgroup's task list.
++ */
++void cpuset_fork(struct task_struct *task)
++{
++	if (task_css_is_root(task, cpuset_cgrp_id))
++		return;
++
++	set_cpus_allowed_ptr(task, &current->cpus_allowed);
++	task->mems_allowed = current->mems_allowed;
++}
++
+ struct cgroup_subsys cpuset_cgrp_subsys = {
+ 	.css_alloc	= cpuset_css_alloc,
+ 	.css_online	= cpuset_css_online,
+@@ -2084,6 +2098,7 @@ struct cgroup_subsys cpuset_cgrp_subsys = {
+ 	.attach		= cpuset_attach,
+ 	.post_attach	= cpuset_post_attach,
+ 	.bind		= cpuset_bind,
++	.fork		= cpuset_fork,
+ 	.legacy_cftypes	= files,
+ 	.early_init	= 1,
+ };
+diff --git a/kernel/fork.c b/kernel/fork.c
+index c485cb156772..8860d1f50d24 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -764,6 +764,29 @@ struct file *get_mm_exe_file(struct mm_struct *mm)
+ EXPORT_SYMBOL(get_mm_exe_file);
+ 
+ /**
++ * get_task_exe_file - acquire a reference to the task's executable file
++ *
++ * Returns %NULL if task's mm (if any) has no associated executable file or
++ * this is a kernel thread with borrowed mm (see the comment above get_task_mm).
++ * User must release file via fput().
++ */
++struct file *get_task_exe_file(struct task_struct *task)
++{
++	struct file *exe_file = NULL;
++	struct mm_struct *mm;
++
++	task_lock(task);
++	mm = task->mm;
++	if (mm) {
++		if (!(task->flags & PF_KTHREAD))
++			exe_file = get_mm_exe_file(mm);
++	}
++	task_unlock(task);
++	return exe_file;
++}
++EXPORT_SYMBOL(get_task_exe_file);
++
++/**
+  * get_task_mm - acquire a reference to the task's mm
+  *
+  * Returns %NULL if the task has no mm.  Checks PF_KTHREAD (meaning
+diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
+index 4b21779d5163..cd6009006510 100644
+--- a/kernel/irq/msi.c
++++ b/kernel/irq/msi.c
+@@ -298,6 +298,7 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
+ 		ops->msi_finish(&arg, 0);
+ 
+ 	for_each_msi_entry(desc, dev) {
++		virq = desc->irq;
+ 		if (desc->nvec_used == 1)
+ 			dev_dbg(dev, "irq %d for MSI\n", virq);
+ 		else
+diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
+index b70ada0028d2..6030efd4a188 100644
+--- a/kernel/kexec_file.c
++++ b/kernel/kexec_file.c
+@@ -934,7 +934,10 @@ int kexec_load_purgatory(struct kimage *image, unsigned long min,
+ 	return 0;
+ out:
+ 	vfree(pi->sechdrs);
++	pi->sechdrs = NULL;
++
+ 	vfree(pi->purgatory_buf);
++	pi->purgatory_buf = NULL;
+ 	return ret;
+ }
+ 
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index ea863bc22caf..20253dbc8610 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1945,6 +1945,28 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
+ 	success = 1; /* we're going to change ->state */
+ 	cpu = task_cpu(p);
+ 
++	/*
++	 * Ensure we load p->on_rq _after_ p->state, otherwise it would
++	 * be possible to, falsely, observe p->on_rq == 0 and get stuck
++	 * in smp_cond_load_acquire() below.
++	 *
++	 * sched_ttwu_pending()                 try_to_wake_up()
++	 *   [S] p->on_rq = 1;                  [L] P->state
++	 *       UNLOCK rq->lock  -----.
++	 *                              \
++	 *				 +---   RMB
++	 * schedule()                   /
++	 *       LOCK rq->lock    -----'
++	 *       UNLOCK rq->lock
++	 *
++	 * [task p]
++	 *   [S] p->state = UNINTERRUPTIBLE     [L] p->on_rq
++	 *
++	 * Pairs with the UNLOCK+LOCK on rq->lock from the
++	 * last wakeup of our task and the schedule that got our task
++	 * current.
++	 */
++	smp_rmb();
+ 	if (p->on_rq && ttwu_remote(p, wake_flags))
+ 		goto stat;
+ 
+diff --git a/lib/iov_iter.c b/lib/iov_iter.c
+index 75232ad0a5e7..daca582a8ed0 100644
+--- a/lib/iov_iter.c
++++ b/lib/iov_iter.c
+@@ -298,33 +298,13 @@ done:
+ }
+ 
+ /*
+- * Fault in the first iovec of the given iov_iter, to a maximum length
+- * of bytes. Returns 0 on success, or non-zero if the memory could not be
+- * accessed (ie. because it is an invalid address).
+- *
+- * writev-intensive code may want this to prefault several iovecs -- that
+- * would be possible (callers must not rely on the fact that _only_ the
+- * first iovec will be faulted with the current implementation).
+- */
+-int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
+-{
+-	if (!(i->type & (ITER_BVEC|ITER_KVEC))) {
+-		char __user *buf = i->iov->iov_base + i->iov_offset;
+-		bytes = min(bytes, i->iov->iov_len - i->iov_offset);
+-		return fault_in_pages_readable(buf, bytes);
+-	}
+-	return 0;
+-}
+-EXPORT_SYMBOL(iov_iter_fault_in_readable);
+-
+-/*
+  * Fault in one or more iovecs of the given iov_iter, to a maximum length of
+  * bytes.  For each iovec, fault in each page that constitutes the iovec.
+  *
+  * Return 0 on success, or non-zero if the memory could not be accessed (i.e.
+  * because it is an invalid address).
+  */
+-int iov_iter_fault_in_multipages_readable(struct iov_iter *i, size_t bytes)
++int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
+ {
+ 	size_t skip = i->iov_offset;
+ 	const struct iovec *iov;
+@@ -341,7 +321,7 @@ int iov_iter_fault_in_multipages_readable(struct iov_iter *i, size_t bytes)
+ 	}
+ 	return 0;
+ }
+-EXPORT_SYMBOL(iov_iter_fault_in_multipages_readable);
++EXPORT_SYMBOL(iov_iter_fault_in_readable);
+ 
+ void iov_iter_init(struct iov_iter *i, int direction,
+ 			const struct iovec *iov, unsigned long nr_segs,
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index e8d3da0817d3..036b39eb1220 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -1898,6 +1898,7 @@ errdad:
+ 	spin_unlock_bh(&ifp->lock);
+ 
+ 	addrconf_mod_dad_work(ifp, 0);
++	in6_ifa_put(ifp);
+ }
+ 
+ /* Join to solicited addr multicast group.
+@@ -3609,6 +3610,7 @@ static void addrconf_dad_work(struct work_struct *w)
+ 		addrconf_dad_begin(ifp);
+ 		goto out;
+ 	} else if (action == DAD_ABORT) {
++		in6_ifa_hold(ifp);
+ 		addrconf_dad_stop(ifp, 1);
+ 		goto out;
+ 	}
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index 91aea071ab27..72268eac4ec7 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -1262,6 +1262,8 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
+ 		/* fall thru' */
+ 
+ 	case ACTIVATE_MSG:
++		skb_linearize(skb);
++		hdr = buf_msg(skb);
+ 
+ 		/* Complete own link name with peer's interface name */
+ 		if_name =  strrchr(l->name, ':') + 1;
+diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
+index c07612bab95c..f51c8bdbea1c 100644
+--- a/net/tipc/name_distr.c
++++ b/net/tipc/name_distr.c
+@@ -397,6 +397,7 @@ void tipc_named_rcv(struct net *net, struct sk_buff_head *inputq)
+ 
+ 	spin_lock_bh(&tn->nametbl_lock);
+ 	for (skb = skb_dequeue(inputq); skb; skb = skb_dequeue(inputq)) {
++		skb_linearize(skb);
+ 		msg = buf_msg(skb);
+ 		mtype = msg_type(msg);
+ 		item = (struct distr_item *)msg_data(msg);
+diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
+index 70c03271b798..6af78c6276b4 100644
+--- a/net/tipc/udp_media.c
++++ b/net/tipc/udp_media.c
+@@ -48,7 +48,6 @@
+ #include <linux/tipc_netlink.h>
+ #include "core.h"
+ #include "bearer.h"
+-#include "msg.h"
+ 
+ /* IANA assigned UDP port */
+ #define UDP_PORT_DEFAULT	6118
+@@ -224,10 +223,6 @@ static int tipc_udp_recv(struct sock *sk, struct sk_buff *skb)
+ {
+ 	struct udp_bearer *ub;
+ 	struct tipc_bearer *b;
+-	int usr = msg_user(buf_msg(skb));
+-
+-	if ((usr == LINK_PROTOCOL) || (usr == NAME_DISTRIBUTOR))
+-		skb_linearize(skb);
+ 
+ 	ub = rcu_dereference_sk_user_data(sk);
+ 	if (!ub) {
+diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
+index c753211cb83f..b50ee5d622e1 100644
+--- a/net/wireless/wext-core.c
++++ b/net/wireless/wext-core.c
+@@ -955,29 +955,8 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
+ 			return private(dev, iwr, cmd, info, handler);
+ 	}
+ 	/* Old driver API : call driver ioctl handler */
+-	if (dev->netdev_ops->ndo_do_ioctl) {
+-#ifdef CONFIG_COMPAT
+-		if (info->flags & IW_REQUEST_FLAG_COMPAT) {
+-			int ret = 0;
+-			struct iwreq iwr_lcl;
+-			struct compat_iw_point *iwp_compat = (void *) &iwr->u.data;
+-
+-			memcpy(&iwr_lcl, iwr, sizeof(struct iwreq));
+-			iwr_lcl.u.data.pointer = compat_ptr(iwp_compat->pointer);
+-			iwr_lcl.u.data.length = iwp_compat->length;
+-			iwr_lcl.u.data.flags = iwp_compat->flags;
+-
+-			ret = dev->netdev_ops->ndo_do_ioctl(dev, (void *) &iwr_lcl, cmd);
+-
+-			iwp_compat->pointer = ptr_to_compat(iwr_lcl.u.data.pointer);
+-			iwp_compat->length = iwr_lcl.u.data.length;
+-			iwp_compat->flags = iwr_lcl.u.data.flags;
+-
+-			return ret;
+-		} else
+-#endif
+-			return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
+-	}
++	if (dev->netdev_ops->ndo_do_ioctl)
++		return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
+ 	return -EOPNOTSUPP;
+ }
+