Merge android-4.9.191 (9ca8608) into msm-4.9

* refs/heads/tmp-9ca8608:
  Linux 4.9.191
  mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n
  x86/ptrace: fix up botched merge of spectrev1 fix
  i2c: piix4: Fix port selection for AMD Family 16h Model 30h
  KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI
  KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long
  mac80211: fix possible sta leak
  Revert "cfg80211: fix processing world regdomain when non modular"
  VMCI: Release resource if the work is already queued
  stm class: Fix a double free of stm_source_device
  mmc: core: Fix init of SD cards reporting an invalid VDD range
  mmc: sdhci-of-at91: add quirk for broken HS200
  uprobes/x86: Fix detection of 32-bit user mode
  ptrace,x86: Make user_64bit_mode() available to 32-bit builds
  USB: storage: ums-realtek: Whitelist auto-delink support
  USB: storage: ums-realtek: Update module parameter description for auto_delink_en
  usb: host: xhci: rcar: Fix typo in compatible string matching
  usb: host: ohci: fix a race condition between shutdown and irq
  usb: chipidea: udc: don't do hardware access if gadget has stopped
  USB: cdc-wdm: fix race between write and disconnect due to flag abuse
  usb-storage: Add new JMS567 revision to unusual_devs
  mm/zsmalloc.c: fix race condition in zs_destroy_pool
  x86/apic: Include the LDR when clearing out APIC registers
  x86/apic: Do not initialize LDR and DFR for bigsmp
  KVM: x86: Don't update RIP or do single-step on faulting emulation
  ALSA: seq: Fix potential concurrent access to the deleted pool
  ALSA: line6: Fix memory leak at line6_init_pcm() error path
  tcp: make sure EPOLLOUT wont be missed
  ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
  ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
  tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue
  scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value
  watchdog: bcm2835_wdt: Fix module autoload
  tools: hv: fix KVP and VSS daemons exit code
  usb: host: fotg2: restart hcd after port reset
  i2c: emev2: avoid race when unregistering slave client
  xen/blkback: fix memory leaks
  usb: gadget: composite: Clear "suspended" on reset/disconnect
  iommu/dma: Handle SG length overflow better
  dmaengine: ste_dma40: fix unneeded variable warning
  x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h
  Revert "perf test 6: Fix missing kvm module load for s390"
  xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT
  mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely
  mm, page_owner: handle THP splits correctly
  genirq: Properly pair kobject_del() with kobject_add()
  dm table: fix invalid memory accesses with too high sector number
  dm space map metadata: fix missing store of apply_bops() return value
  dm btree: fix order of block initialization in btree_split_beneath
  x86/boot: Fix boot regression caused by bootparam sanitizing
  x86/boot: Save fields explicitly, zero out everything else
  x86/apic: Handle missing global clockevent gracefully
  x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386
  userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx
  gpiolib: never report open-drain/source lines as 'input' to user-space
  Revert "dm bufio: fix deadlock with loop device"
  HID: wacom: Correct distance scale for 2nd-gen Intuos devices
  HID: wacom: correct misreported EKR ring values
  selftests: kvm: Adding config fragments
  perf pmu-events: Fix missing "cpu_clk_unhalted.core" event
  drm/vmwgfx: fix memory leak when too many retries have occurred
  x86/lib/cpu: Address missing prototypes warning
  libata: add SG safety checks in SFF pio transfers
  net: hisilicon: Fix dma_map_single failed on arm64
  net: hisilicon: fix hip04-xmit never return TX_BUSY
  net: hisilicon: make hip04_tx_reclaim non-reentrant
  net: cxgb3_main: Fix a resource leak in a error path in 'init_one()'
  HID: input: fix a4tech horizontal wheel custom usage
  NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()
  can: peak_usb: force the string buffer NULL-terminated
  can: sja1000: force the string buffer NULL-terminated
  perf bench numa: Fix cpu0 binding
  isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack
  isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain()
  net: usb: qmi_wwan: Add the BroadMobi BM818 card
  ASoC: ti: davinci-mcasp: Correct slot_width posed constraint
  st_nci_hci_connectivity_event_received: null check the allocation
  st21nfca_connectivity_event_received: null check the allocation
  can: dev: call netif_carrier_off() in register_candev()
  bonding: Force slave speed check after link state recovery for 802.3ad
  ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks
  netfilter: ebtables: fix a memory leak bug in compat
  MIPS: kernel: only use i8253 clocksource with periodic clockevent
  HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT
  ANDROID: sched: Disallow WALT with CFS bandwidth control
  ANDROID: fiq_debugger: remove
  ANDROID: Add a tracepoint for mapping inode to full path

Conflicts:
	drivers/staging/android/fiq_debugger/fiq_debugger.c
	drivers/usb/gadget/composite.c
	fs/userfaultfd.c
	sound/usb/mixer.c

Change-Id: I1731d5df58f9f2679bfcfa4ecbfaa9a9c273ed77
Signed-off-by: jianzhou <jianzhou@codeaurora.org>
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 4af13bb..194ec2d 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -3855,6 +3855,13 @@
 			Run specified binary instead of /init from the ramdisk,
 			used for early userspace startup. See initrd.
 
+	rdrand=		[X86]
+			force - Override the decision by the kernel to hide the
+				advertisement of RDRAND support (this affects
+				certain AMD processors because of buggy BIOS
+				support, specifically around the suspend/resume
+				path).
+
 	reboot=		[KNL]
 			Format (x86 or x86_64):
 				[w[arm] | c[old] | h[ard] | s[oft] | g[pio]] \
diff --git a/Makefile b/Makefile
index 936a32b..79053f1 100755
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 9
-SUBLEVEL = 190
+SUBLEVEL = 191
 EXTRAVERSION =
 NAME = Roaring Lionus
 
diff --git a/arch/arm/common/Kconfig b/arch/arm/common/Kconfig
index ce01364..9353184 100644
--- a/arch/arm/common/Kconfig
+++ b/arch/arm/common/Kconfig
@@ -17,7 +17,3 @@
 
 config SHARP_SCOOP
 	bool
-
-config FIQ_GLUE
-	bool
-	select FIQ
diff --git a/arch/arm/common/Makefile b/arch/arm/common/Makefile
index 04aca89..27f23b1 100644
--- a/arch/arm/common/Makefile
+++ b/arch/arm/common/Makefile
@@ -4,7 +4,6 @@
 
 obj-y				+= firmware.o
 
-obj-$(CONFIG_FIQ_GLUE)		+= fiq_glue.o fiq_glue_setup.o
 obj-$(CONFIG_ICST)		+= icst.o
 obj-$(CONFIG_SA1111)		+= sa1111.o
 obj-$(CONFIG_DMABOUNCE)		+= dmabounce.o
diff --git a/arch/arm/common/fiq_glue.S b/arch/arm/common/fiq_glue.S
deleted file mode 100644
index 24b42ce..0000000
--- a/arch/arm/common/fiq_glue.S
+++ /dev/null
@@ -1,118 +0,0 @@
-/*
- * Copyright (C) 2008 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#include <linux/linkage.h>
-#include <asm/assembler.h>
-
-		.text
-
-		.global fiq_glue_end
-
-		/* fiq stack: r0-r15,cpsr,spsr of interrupted mode */
-
-ENTRY(fiq_glue)
-		/* store pc, cpsr from previous mode, reserve space for spsr */
-		mrs	r12, spsr
-		sub	lr, lr, #4
-		subs	r10, #1
-		bne	nested_fiq
-
-		str	r12, [sp, #-8]!
-		str	lr, [sp, #-4]!
-
-		/* store r8-r14 from previous mode */
-		sub	sp, sp, #(7 * 4)
-		stmia	sp, {r8-r14}^
-		nop
-
-		/* store r0-r7 from previous mode */
-		stmfd	sp!, {r0-r7}
-
-		/* setup func(data,regs) arguments */
-		mov	r0, r9
-		mov	r1, sp
-		mov	r3, r8
-
-		mov	r7, sp
-
-		/* Get sp and lr from non-user modes */
-		and	r4, r12, #MODE_MASK
-		cmp	r4, #USR_MODE
-		beq	fiq_from_usr_mode
-
-		mov	r7, sp
-		orr	r4, r4, #(PSR_I_BIT | PSR_F_BIT)
-		msr	cpsr_c, r4
-		str	sp, [r7, #(4 * 13)]
-		str	lr, [r7, #(4 * 14)]
-		mrs	r5, spsr
-		str	r5, [r7, #(4 * 17)]
-
-		cmp	r4, #(SVC_MODE | PSR_I_BIT | PSR_F_BIT)
-		/* use fiq stack if we reenter this mode */
-		subne	sp, r7, #(4 * 3)
-
-fiq_from_usr_mode:
-		msr	cpsr_c, #(SVC_MODE | PSR_I_BIT | PSR_F_BIT)
-		mov	r2, sp
-		sub	sp, r7, #12
-		stmfd	sp!, {r2, ip, lr}
-		/* call func(data,regs) */
-		blx	r3
-		ldmfd	sp, {r2, ip, lr}
-		mov	sp, r2
-
-		/* restore/discard saved state */
-		cmp	r4, #USR_MODE
-		beq	fiq_from_usr_mode_exit
-
-		msr	cpsr_c, r4
-		ldr	sp, [r7, #(4 * 13)]
-		ldr	lr, [r7, #(4 * 14)]
-		msr	spsr_cxsf, r5
-
-fiq_from_usr_mode_exit:
-		msr	cpsr_c, #(FIQ_MODE | PSR_I_BIT | PSR_F_BIT)
-
-		ldmfd	sp!, {r0-r7}
-		ldr	lr, [sp, #(4 * 7)]
-		ldr	r12, [sp, #(4 * 8)]
-		add	sp, sp, #(10 * 4)
-exit_fiq:
-		msr	spsr_cxsf, r12
-		add	r10, #1
-		cmp	r11, #0
-		moveqs	pc, lr
-		bx	r11 /* jump to custom fiq return function */
-
-nested_fiq:
-		orr	r12, r12, #(PSR_F_BIT)
-		b	exit_fiq
-
-fiq_glue_end:
-
-ENTRY(fiq_glue_setup) /* func, data, sp, smc call number */
-		stmfd		sp!, {r4}
-		mrs		r4, cpsr
-		msr		cpsr_c, #(FIQ_MODE | PSR_I_BIT | PSR_F_BIT)
-		movs		r8, r0
-		mov		r9, r1
-		mov		sp, r2
-		mov		r11, r3
-		moveq		r10, #0
-		movne		r10, #1
-		msr		cpsr_c, r4
-		ldmfd		sp!, {r4}
-		bx		lr
-
diff --git a/arch/arm/common/fiq_glue_setup.c b/arch/arm/common/fiq_glue_setup.c
deleted file mode 100644
index 8cb1b61..0000000
--- a/arch/arm/common/fiq_glue_setup.c
+++ /dev/null
@@ -1,147 +0,0 @@
-/*
- * Copyright (C) 2010 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/kernel.h>
-#include <linux/percpu.h>
-#include <linux/slab.h>
-#include <asm/fiq.h>
-#include <asm/fiq_glue.h>
-
-extern unsigned char fiq_glue, fiq_glue_end;
-extern void fiq_glue_setup(void *func, void *data, void *sp,
-			   fiq_return_handler_t fiq_return_handler);
-
-static struct fiq_handler fiq_debbuger_fiq_handler = {
-	.name = "fiq_glue",
-};
-DEFINE_PER_CPU(void *, fiq_stack);
-static struct fiq_glue_handler *current_handler;
-static fiq_return_handler_t fiq_return_handler;
-static DEFINE_MUTEX(fiq_glue_lock);
-
-static void fiq_glue_setup_helper(void *info)
-{
-	struct fiq_glue_handler *handler = info;
-	fiq_glue_setup(handler->fiq, handler,
-		__get_cpu_var(fiq_stack) + THREAD_START_SP,
-		fiq_return_handler);
-}
-
-int fiq_glue_register_handler(struct fiq_glue_handler *handler)
-{
-	int ret;
-	int cpu;
-
-	if (!handler || !handler->fiq)
-		return -EINVAL;
-
-	mutex_lock(&fiq_glue_lock);
-	if (fiq_stack) {
-		ret = -EBUSY;
-		goto err_busy;
-	}
-
-	for_each_possible_cpu(cpu) {
-		void *stack;
-		stack = (void *)__get_free_pages(GFP_KERNEL, THREAD_SIZE_ORDER);
-		if (WARN_ON(!stack)) {
-			ret = -ENOMEM;
-			goto err_alloc_fiq_stack;
-		}
-		per_cpu(fiq_stack, cpu) = stack;
-	}
-
-	ret = claim_fiq(&fiq_debbuger_fiq_handler);
-	if (WARN_ON(ret))
-		goto err_claim_fiq;
-
-	current_handler = handler;
-	on_each_cpu(fiq_glue_setup_helper, handler, true);
-	set_fiq_handler(&fiq_glue, &fiq_glue_end - &fiq_glue);
-
-	mutex_unlock(&fiq_glue_lock);
-	return 0;
-
-err_claim_fiq:
-err_alloc_fiq_stack:
-	for_each_possible_cpu(cpu) {
-		__free_pages(per_cpu(fiq_stack, cpu), THREAD_SIZE_ORDER);
-		per_cpu(fiq_stack, cpu) = NULL;
-	}
-err_busy:
-	mutex_unlock(&fiq_glue_lock);
-	return ret;
-}
-
-static void fiq_glue_update_return_handler(void (*fiq_return)(void))
-{
-	fiq_return_handler = fiq_return;
-	if (current_handler)
-		on_each_cpu(fiq_glue_setup_helper, current_handler, true);
-}
-
-int fiq_glue_set_return_handler(void (*fiq_return)(void))
-{
-	int ret;
-
-	mutex_lock(&fiq_glue_lock);
-	if (fiq_return_handler) {
-		ret = -EBUSY;
-		goto err_busy;
-	}
-	fiq_glue_update_return_handler(fiq_return);
-	ret = 0;
-err_busy:
-	mutex_unlock(&fiq_glue_lock);
-
-	return ret;
-}
-EXPORT_SYMBOL(fiq_glue_set_return_handler);
-
-int fiq_glue_clear_return_handler(void (*fiq_return)(void))
-{
-	int ret;
-
-	mutex_lock(&fiq_glue_lock);
-	if (WARN_ON(fiq_return_handler != fiq_return)) {
-		ret = -EINVAL;
-		goto err_inval;
-	}
-	fiq_glue_update_return_handler(NULL);
-	ret = 0;
-err_inval:
-	mutex_unlock(&fiq_glue_lock);
-
-	return ret;
-}
-EXPORT_SYMBOL(fiq_glue_clear_return_handler);
-
-/**
- * fiq_glue_resume - Restore fiqs after suspend or low power idle states
- *
- * This must be called before calling local_fiq_enable after returning from a
- * power state where the fiq mode registers were lost. If a driver provided
- * a resume hook when it registered the handler it will be called.
- */
-
-void fiq_glue_resume(void)
-{
-	if (!current_handler)
-		return;
-	fiq_glue_setup(current_handler->fiq, current_handler,
-		__get_cpu_var(fiq_stack) + THREAD_START_SP,
-		fiq_return_handler);
-	if (current_handler->resume)
-		current_handler->resume(current_handler);
-}
-
diff --git a/arch/mips/kernel/i8253.c b/arch/mips/kernel/i8253.c
index c5bc344..7303974 100644
--- a/arch/mips/kernel/i8253.c
+++ b/arch/mips/kernel/i8253.c
@@ -31,7 +31,8 @@
 
 static int __init init_pit_clocksource(void)
 {
-	if (num_possible_cpus() > 1) /* PIT does not scale! */
+	if (num_possible_cpus() > 1 || /* PIT does not scale! */
+	    !clockevent_state_periodic(&i8253_clockevent))
 		return 0;
 
 	return clocksource_i8253_init();
diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h
index 4a8cb8d..0232b5a 100644
--- a/arch/x86/include/asm/bootparam_utils.h
+++ b/arch/x86/include/asm/bootparam_utils.h
@@ -17,6 +17,20 @@
  * Note: efi_info is commonly left uninitialized, but that field has a
  * private magic, so it is better to leave it unchanged.
  */
+
+#define sizeof_mbr(type, member) ({ sizeof(((type *)0)->member); })
+
+#define BOOT_PARAM_PRESERVE(struct_member)				\
+	{								\
+		.start = offsetof(struct boot_params, struct_member),	\
+		.len   = sizeof_mbr(struct boot_params, struct_member),	\
+	}
+
+struct boot_params_to_save {
+	unsigned int start;
+	unsigned int len;
+};
+
 static void sanitize_boot_params(struct boot_params *boot_params)
 {
 	/* 
@@ -35,19 +49,39 @@
 	 */
 	if (boot_params->sentinel) {
 		/* fields in boot_params are left uninitialized, clear them */
-		memset(&boot_params->ext_ramdisk_image, 0,
-		       (char *)&boot_params->efi_info -
-			(char *)&boot_params->ext_ramdisk_image);
-		memset(&boot_params->kbd_status, 0,
-		       (char *)&boot_params->hdr -
-		       (char *)&boot_params->kbd_status);
-		memset(&boot_params->_pad7[0], 0,
-		       (char *)&boot_params->edd_mbr_sig_buffer[0] -
-			(char *)&boot_params->_pad7[0]);
-		memset(&boot_params->_pad8[0], 0,
-		       (char *)&boot_params->eddbuf[0] -
-			(char *)&boot_params->_pad8[0]);
-		memset(&boot_params->_pad9[0], 0, sizeof(boot_params->_pad9));
+		static struct boot_params scratch;
+		char *bp_base = (char *)boot_params;
+		char *save_base = (char *)&scratch;
+		int i;
+
+		const struct boot_params_to_save to_save[] = {
+			BOOT_PARAM_PRESERVE(screen_info),
+			BOOT_PARAM_PRESERVE(apm_bios_info),
+			BOOT_PARAM_PRESERVE(tboot_addr),
+			BOOT_PARAM_PRESERVE(ist_info),
+			BOOT_PARAM_PRESERVE(hd0_info),
+			BOOT_PARAM_PRESERVE(hd1_info),
+			BOOT_PARAM_PRESERVE(sys_desc_table),
+			BOOT_PARAM_PRESERVE(olpc_ofw_header),
+			BOOT_PARAM_PRESERVE(efi_info),
+			BOOT_PARAM_PRESERVE(alt_mem_k),
+			BOOT_PARAM_PRESERVE(scratch),
+			BOOT_PARAM_PRESERVE(e820_entries),
+			BOOT_PARAM_PRESERVE(eddbuf_entries),
+			BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries),
+			BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer),
+			BOOT_PARAM_PRESERVE(hdr),
+			BOOT_PARAM_PRESERVE(eddbuf),
+		};
+
+		memset(&scratch, 0, sizeof(scratch));
+
+		for (i = 0; i < ARRAY_SIZE(to_save); i++) {
+			memcpy(save_base + to_save[i].start,
+			       bp_base + to_save[i].start, to_save[i].len);
+		}
+
+		memcpy(boot_params, save_base, sizeof(*boot_params));
 	}
 }
 
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 38f94d0..8616686 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -313,6 +313,7 @@
 #define MSR_AMD64_PATCH_LEVEL		0x0000008b
 #define MSR_AMD64_TSC_RATIO		0xc0000104
 #define MSR_AMD64_NB_CFG		0xc001001f
+#define MSR_AMD64_CPUID_FN_1		0xc0011004
 #define MSR_AMD64_PATCH_LOADER		0xc0010020
 #define MSR_AMD64_OSVW_ID_LENGTH	0xc0010140
 #define MSR_AMD64_OSVW_STATUS		0xc0010141
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index 031a58e..10a4850 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -196,7 +196,7 @@
 	"    	lfence;\n"					\
 	"       jmp    902b;\n"					\
 	"       .align 16\n"					\
-	"903:	addl   $4, %%esp;\n"				\
+	"903:	lea    4(%%esp), %%esp;\n"			\
 	"       pushl  %[thunk_target];\n"			\
 	"       ret;\n"						\
 	"       .align 16\n"					\
diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
index 2b5d686..ea78a84 100644
--- a/arch/x86/include/asm/ptrace.h
+++ b/arch/x86/include/asm/ptrace.h
@@ -115,9 +115,9 @@
 #endif
 }
 
-#ifdef CONFIG_X86_64
 static inline bool user_64bit_mode(struct pt_regs *regs)
 {
+#ifdef CONFIG_X86_64
 #ifndef CONFIG_PARAVIRT
 	/*
 	 * On non-paravirt systems, this is the only long mode CPL 3
@@ -128,8 +128,12 @@
 	/* Headers are too twisted for this to go in paravirt.h. */
 	return regs->cs == __USER_CS || regs->cs == pv_info.extra_user_64bit_cs;
 #endif
+#else /* !CONFIG_X86_64 */
+	return false;
+#endif
 }
 
+#ifdef CONFIG_X86_64
 #define current_user_stack_pointer()	current_pt_regs()->sp
 #define compat_user_stack_pointer()	current_pt_regs()->sp
 #endif
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index cc9a6f6..37666c5 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -629,7 +629,7 @@
 static __initdata unsigned long lapic_cal_j1, lapic_cal_j2;
 
 /*
- * Temporary interrupt handler.
+ * Temporary interrupt handler and polled calibration function.
  */
 static void __init lapic_cal_handler(struct clock_event_device *dev)
 {
@@ -713,7 +713,8 @@
 static int __init calibrate_APIC_clock(void)
 {
 	struct clock_event_device *levt = this_cpu_ptr(&lapic_events);
-	void (*real_handler)(struct clock_event_device *dev);
+	u64 tsc_perj = 0, tsc_start = 0;
+	unsigned long jif_start;
 	unsigned long deltaj;
 	long delta, deltatsc;
 	int pm_referenced = 0;
@@ -742,29 +743,65 @@
 	apic_printk(APIC_VERBOSE, "Using local APIC timer interrupts.\n"
 		    "calibrating APIC timer ...\n");
 
+	/*
+	 * There are platforms w/o global clockevent devices. Instead of
+	 * making the calibration conditional on that, use a polling based
+	 * approach everywhere.
+	 */
 	local_irq_disable();
 
-	/* Replace the global interrupt handler */
-	real_handler = global_clock_event->event_handler;
-	global_clock_event->event_handler = lapic_cal_handler;
-
 	/*
 	 * Setup the APIC counter to maximum. There is no way the lapic
 	 * can underflow in the 100ms detection time frame
 	 */
 	__setup_APIC_LVTT(0xffffffff, 0, 0);
 
-	/* Let the interrupts run */
+	/*
+	 * Methods to terminate the calibration loop:
+	 *  1) Global clockevent if available (jiffies)
+	 *  2) TSC if available and frequency is known
+	 */
+	jif_start = READ_ONCE(jiffies);
+
+	if (tsc_khz) {
+		tsc_start = rdtsc();
+		tsc_perj = div_u64((u64)tsc_khz * 1000, HZ);
+	}
+
+	/*
+	 * Enable interrupts so the tick can fire, if a global
+	 * clockevent device is available
+	 */
 	local_irq_enable();
 
-	while (lapic_cal_loops <= LAPIC_CAL_LOOPS)
-		cpu_relax();
+	while (lapic_cal_loops <= LAPIC_CAL_LOOPS) {
+		/* Wait for a tick to elapse */
+		while (1) {
+			if (tsc_khz) {
+				u64 tsc_now = rdtsc();
+				if ((tsc_now - tsc_start) >= tsc_perj) {
+					tsc_start += tsc_perj;
+					break;
+				}
+			} else {
+				unsigned long jif_now = READ_ONCE(jiffies);
+
+				if (time_after(jif_now, jif_start)) {
+					jif_start = jif_now;
+					break;
+				}
+			}
+			cpu_relax();
+		}
+
+		/* Invoke the calibration routine */
+		local_irq_disable();
+		lapic_cal_handler(NULL);
+		local_irq_enable();
+	}
 
 	local_irq_disable();
 
-	/* Restore the real event handler */
-	global_clock_event->event_handler = real_handler;
-
 	/* Build delta t1-t2 as apic timer counts down */
 	delta = lapic_cal_t1 - lapic_cal_t2;
 	apic_printk(APIC_VERBOSE, "... lapic delta = %ld\n", delta);
@@ -814,10 +851,11 @@
 	levt->features &= ~CLOCK_EVT_FEAT_DUMMY;
 
 	/*
-	 * PM timer calibration failed or not turned on
-	 * so lets try APIC timer based calibration
+	 * PM timer calibration failed or not turned on so lets try APIC
+	 * timer based calibration, if a global clockevent device is
+	 * available.
 	 */
-	if (!pm_referenced) {
+	if (!pm_referenced && global_clock_event) {
 		apic_printk(APIC_VERBOSE, "... verify APIC timer\n");
 
 		/*
@@ -1029,6 +1067,10 @@
 	apic_write(APIC_LVT0, v | APIC_LVT_MASKED);
 	v = apic_read(APIC_LVT1);
 	apic_write(APIC_LVT1, v | APIC_LVT_MASKED);
+	if (!x2apic_enabled()) {
+		v = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
+		apic_write(APIC_LDR, v);
+	}
 	if (maxlvt >= 4) {
 		v = apic_read(APIC_LVTPC);
 		apic_write(APIC_LVTPC, v | APIC_LVT_MASKED);
diff --git a/arch/x86/kernel/apic/bigsmp_32.c b/arch/x86/kernel/apic/bigsmp_32.c
index 5601201..76fe153 100644
--- a/arch/x86/kernel/apic/bigsmp_32.c
+++ b/arch/x86/kernel/apic/bigsmp_32.c
@@ -37,32 +37,12 @@
 	return early_per_cpu(x86_cpu_to_apicid, cpu);
 }
 
-static inline unsigned long calculate_ldr(int cpu)
-{
-	unsigned long val, id;
-
-	val = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
-	id = per_cpu(x86_bios_cpu_apicid, cpu);
-	val |= SET_APIC_LOGICAL_ID(id);
-
-	return val;
-}
-
 /*
- * Set up the logical destination ID.
- *
- * Intel recommends to set DFR, LDR and TPR before enabling
- * an APIC.  See e.g. "AP-388 82489DX User's Manual" (Intel
- * document number 292116).  So here it goes...
+ * bigsmp enables physical destination mode
+ * and doesn't use LDR and DFR
  */
 static void bigsmp_init_apic_ldr(void)
 {
-	unsigned long val;
-	int cpu = smp_processor_id();
-
-	apic_write(APIC_DFR, APIC_DFR_FLAT);
-	val = calculate_ldr(cpu);
-	apic_write(APIC_LDR, val);
 }
 
 static void bigsmp_setup_apic_routing(void)
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 52a65f1..9428b54 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -746,6 +746,64 @@
 	msr_set_bit(MSR_AMD64_DE_CFG, 31);
 }
 
+static bool rdrand_force;
+
+static int __init rdrand_cmdline(char *str)
+{
+	if (!str)
+		return -EINVAL;
+
+	if (!strcmp(str, "force"))
+		rdrand_force = true;
+	else
+		return -EINVAL;
+
+	return 0;
+}
+early_param("rdrand", rdrand_cmdline);
+
+static void clear_rdrand_cpuid_bit(struct cpuinfo_x86 *c)
+{
+	/*
+	 * Saving of the MSR used to hide the RDRAND support during
+	 * suspend/resume is done by arch/x86/power/cpu.c, which is
+	 * dependent on CONFIG_PM_SLEEP.
+	 */
+	if (!IS_ENABLED(CONFIG_PM_SLEEP))
+		return;
+
+	/*
+	 * The nordrand option can clear X86_FEATURE_RDRAND, so check for
+	 * RDRAND support using the CPUID function directly.
+	 */
+	if (!(cpuid_ecx(1) & BIT(30)) || rdrand_force)
+		return;
+
+	msr_clear_bit(MSR_AMD64_CPUID_FN_1, 62);
+
+	/*
+	 * Verify that the CPUID change has occurred in case the kernel is
+	 * running virtualized and the hypervisor doesn't support the MSR.
+	 */
+	if (cpuid_ecx(1) & BIT(30)) {
+		pr_info_once("BIOS may not properly restore RDRAND after suspend, but hypervisor does not support hiding RDRAND via CPUID.\n");
+		return;
+	}
+
+	clear_cpu_cap(c, X86_FEATURE_RDRAND);
+	pr_info_once("BIOS may not properly restore RDRAND after suspend, hiding RDRAND via CPUID. Use rdrand=force to reenable.\n");
+}
+
+static void init_amd_jg(struct cpuinfo_x86 *c)
+{
+	/*
+	 * Some BIOS implementations do not restore proper RDRAND support
+	 * across suspend and resume. Check on whether to hide the RDRAND
+	 * instruction support via CPUID.
+	 */
+	clear_rdrand_cpuid_bit(c);
+}
+
 static void init_amd_bd(struct cpuinfo_x86 *c)
 {
 	u64 value;
@@ -760,6 +818,13 @@
 			wrmsrl_safe(MSR_F15H_IC_CFG, value);
 		}
 	}
+
+	/*
+	 * Some BIOS implementations do not restore proper RDRAND support
+	 * across suspend and resume. Check on whether to hide the RDRAND
+	 * instruction support via CPUID.
+	 */
+	clear_rdrand_cpuid_bit(c);
 }
 
 static void init_amd_zn(struct cpuinfo_x86 *c)
@@ -804,6 +869,7 @@
 	case 0x10: init_amd_gh(c); break;
 	case 0x12: init_amd_ln(c); break;
 	case 0x15: init_amd_bd(c); break;
+	case 0x16: init_amd_jg(c); break;
 	case 0x17: init_amd_zn(c); break;
 	}
 
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 8d20fb0..7f377f8 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -651,11 +651,10 @@
 {
 	struct thread_struct *thread = &tsk->thread;
 	unsigned long val = 0;
-	int index = n;
 
 	if (n < HBP_NUM) {
+		int index = array_index_nospec(n, HBP_NUM);
 		struct perf_event *bp = thread->ptrace_bps[index];
-		index = array_index_nospec(index, HBP_NUM);
 
 		if (bp)
 			val = bp->hw.info.address;
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index e78a6b1..e35466a 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -514,9 +514,12 @@
 	void	(*abort)(struct arch_uprobe *, struct pt_regs *);
 };
 
-static inline int sizeof_long(void)
+static inline int sizeof_long(struct pt_regs *regs)
 {
-	return in_ia32_syscall() ? 4 : 8;
+	/*
+	 * Check registers for mode as in_xxx_syscall() does not apply here.
+	 */
+	return user_64bit_mode(regs) ? 8 : 4;
 }
 
 static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
@@ -527,9 +530,9 @@
 
 static int push_ret_address(struct pt_regs *regs, unsigned long ip)
 {
-	unsigned long new_sp = regs->sp - sizeof_long();
+	unsigned long new_sp = regs->sp - sizeof_long(regs);
 
-	if (copy_to_user((void __user *)new_sp, &ip, sizeof_long()))
+	if (copy_to_user((void __user *)new_sp, &ip, sizeof_long(regs)))
 		return -EFAULT;
 
 	regs->sp = new_sp;
@@ -562,7 +565,7 @@
 		long correction = utask->vaddr - utask->xol_vaddr;
 		regs->ip += correction;
 	} else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) {
-		regs->sp += sizeof_long(); /* Pop incorrect return address */
+		regs->sp += sizeof_long(regs); /* Pop incorrect return address */
 		if (push_ret_address(regs, utask->vaddr + auprobe->defparam.ilen))
 			return -ERESTART;
 	}
@@ -671,7 +674,7 @@
 	 * "call" insn was executed out-of-line. Just restore ->sp and restart.
 	 * We could also restore ->ip and try to call branch_emulate_op() again.
 	 */
-	regs->sp += sizeof_long();
+	regs->sp += sizeof_long(regs);
 	return -ERESTART;
 }
 
@@ -962,7 +965,7 @@
 unsigned long
 arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs)
 {
-	int rasize = sizeof_long(), nleft;
+	int rasize = sizeof_long(regs), nleft;
 	unsigned long orig_ret_vaddr = 0; /* clear high bits for 32-bit apps */
 
 	if (copy_from_user(&orig_ret_vaddr, (void __user *)regs->sp, rasize))
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 8b06700..bbecbf2 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5823,12 +5823,13 @@
 		unsigned long rflags = kvm_x86_ops->get_rflags(vcpu);
 		toggle_interruptibility(vcpu, ctxt->interruptibility);
 		vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
-		kvm_rip_write(vcpu, ctxt->eip);
-		if (r == EMULATE_DONE && ctxt->tf)
-			kvm_vcpu_do_singlestep(vcpu, &r);
 		if (!ctxt->have_exception ||
-		    exception_type(ctxt->exception.vector) == EXCPT_TRAP)
+		    exception_type(ctxt->exception.vector) == EXCPT_TRAP) {
+			kvm_rip_write(vcpu, ctxt->eip);
+			if (r == EMULATE_DONE && ctxt->tf)
+				kvm_vcpu_do_singlestep(vcpu, &r);
 			__kvm_set_rflags(vcpu, ctxt->eflags);
+		}
 
 		/*
 		 * For STI, interrupts are shadowed; so KVM_REQ_EVENT will
diff --git a/arch/x86/lib/cpu.c b/arch/x86/lib/cpu.c
index 2dd1fe13..19f7079 100644
--- a/arch/x86/lib/cpu.c
+++ b/arch/x86/lib/cpu.c
@@ -1,5 +1,6 @@
 #include <linux/types.h>
 #include <linux/export.h>
+#include <asm/cpu.h>
 
 unsigned int x86_family(unsigned int sig)
 {
diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
index 29dc59b..c8f947a 100644
--- a/arch/x86/power/cpu.c
+++ b/arch/x86/power/cpu.c
@@ -13,6 +13,7 @@
 #include <linux/smp.h>
 #include <linux/perf_event.h>
 #include <linux/tboot.h>
+#include <linux/dmi.h>
 
 #include <asm/pgtable.h>
 #include <asm/proto.h>
@@ -24,7 +25,7 @@
 #include <asm/debugreg.h>
 #include <asm/cpu.h>
 #include <asm/mmu_context.h>
-#include <linux/dmi.h>
+#include <asm/cpu_device_id.h>
 
 #ifdef CONFIG_X86_32
 __visible unsigned long saved_context_ebx;
@@ -391,15 +392,14 @@
 
 core_initcall(bsp_pm_check_init);
 
-static int msr_init_context(const u32 *msr_id, const int total_num)
+static int msr_build_context(const u32 *msr_id, const int num)
 {
-	int i = 0;
+	struct saved_msrs *saved_msrs = &saved_context.saved_msrs;
 	struct saved_msr *msr_array;
+	int total_num;
+	int i, j;
 
-	if (saved_context.saved_msrs.array || saved_context.saved_msrs.num > 0) {
-		pr_err("x86/pm: MSR quirk already applied, please check your DMI match table.\n");
-		return -EINVAL;
-	}
+	total_num = saved_msrs->num + num;
 
 	msr_array = kmalloc_array(total_num, sizeof(struct saved_msr), GFP_KERNEL);
 	if (!msr_array) {
@@ -407,19 +407,30 @@
 		return -ENOMEM;
 	}
 
-	for (i = 0; i < total_num; i++) {
-		msr_array[i].info.msr_no	= msr_id[i];
+	if (saved_msrs->array) {
+		/*
+		 * Multiple callbacks can invoke this function, so copy any
+		 * MSR save requests from previous invocations.
+		 */
+		memcpy(msr_array, saved_msrs->array,
+		       sizeof(struct saved_msr) * saved_msrs->num);
+
+		kfree(saved_msrs->array);
+	}
+
+	for (i = saved_msrs->num, j = 0; i < total_num; i++, j++) {
+		msr_array[i].info.msr_no	= msr_id[j];
 		msr_array[i].valid		= false;
 		msr_array[i].info.reg.q		= 0;
 	}
-	saved_context.saved_msrs.num	= total_num;
-	saved_context.saved_msrs.array	= msr_array;
+	saved_msrs->num   = total_num;
+	saved_msrs->array = msr_array;
 
 	return 0;
 }
 
 /*
- * The following section is a quirk framework for problematic BIOSen:
+ * The following sections are a quirk framework for problematic BIOSen:
  * Sometimes MSRs are modified by the BIOSen after suspended to
  * RAM, this might cause unexpected behavior after wakeup.
  * Thus we save/restore these specified MSRs across suspend/resume
@@ -434,7 +445,7 @@
 	u32 bdw_msr_id[] = { MSR_IA32_THERM_CONTROL };
 
 	pr_info("x86/pm: %s detected, MSR saving is needed during suspending.\n", d->ident);
-	return msr_init_context(bdw_msr_id, ARRAY_SIZE(bdw_msr_id));
+	return msr_build_context(bdw_msr_id, ARRAY_SIZE(bdw_msr_id));
 }
 
 static struct dmi_system_id msr_save_dmi_table[] = {
@@ -449,9 +460,58 @@
 	{}
 };
 
+static int msr_save_cpuid_features(const struct x86_cpu_id *c)
+{
+	u32 cpuid_msr_id[] = {
+		MSR_AMD64_CPUID_FN_1,
+	};
+
+	pr_info("x86/pm: family %#hx cpu detected, MSR saving is needed during suspending.\n",
+		c->family);
+
+	return msr_build_context(cpuid_msr_id, ARRAY_SIZE(cpuid_msr_id));
+}
+
+static const struct x86_cpu_id msr_save_cpu_table[] = {
+	{
+		.vendor = X86_VENDOR_AMD,
+		.family = 0x15,
+		.model = X86_MODEL_ANY,
+		.feature = X86_FEATURE_ANY,
+		.driver_data = (kernel_ulong_t)msr_save_cpuid_features,
+	},
+	{
+		.vendor = X86_VENDOR_AMD,
+		.family = 0x16,
+		.model = X86_MODEL_ANY,
+		.feature = X86_FEATURE_ANY,
+		.driver_data = (kernel_ulong_t)msr_save_cpuid_features,
+	},
+	{}
+};
+
+typedef int (*pm_cpu_match_t)(const struct x86_cpu_id *);
+static int pm_cpu_check(const struct x86_cpu_id *c)
+{
+	const struct x86_cpu_id *m;
+	int ret = 0;
+
+	m = x86_match_cpu(msr_save_cpu_table);
+	if (m) {
+		pm_cpu_match_t fn;
+
+		fn = (pm_cpu_match_t)m->driver_data;
+		ret = fn(m);
+	}
+
+	return ret;
+}
+
 static int pm_check_save_msr(void)
 {
 	dmi_check_system(msr_save_dmi_table);
+	pm_cpu_check(msr_save_cpu_table);
+
 	return 0;
 }
 
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 8d22acd..0e2bc5b 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -703,6 +703,10 @@
 	unsigned int offset;
 	unsigned char *buf;
 
+	if (!qc->cursg) {
+		qc->curbytes = qc->nbytes;
+		return;
+	}
 	if (qc->curbytes == qc->nbytes - qc->sect_size)
 		ap->hsm_task_state = HSM_ST_LAST;
 
@@ -742,6 +746,8 @@
 
 	if (qc->cursg_ofs == qc->cursg->length) {
 		qc->cursg = sg_next(qc->cursg);
+		if (!qc->cursg)
+			ap->hsm_task_state = HSM_ST_LAST;
 		qc->cursg_ofs = 0;
 	}
 }
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 5dfe6e8..ad736d7 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -967,6 +967,7 @@
 	}
 	blkif->nr_ring_pages = nr_grefs;
 
+	err = -ENOMEM;
 	for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) {
 		req = kzalloc(sizeof(*req), GFP_KERNEL);
 		if (!req)
@@ -989,7 +990,7 @@
 	err = xen_blkif_map(ring, ring_ref, nr_grefs, evtchn);
 	if (err) {
 		xenbus_dev_fatal(dev, err, "mapping ring-ref port %u", evtchn);
-		return err;
+		goto fail;
 	}
 
 	return 0;
@@ -1009,8 +1010,7 @@
 		}
 		kfree(req);
 	}
-	return -ENOMEM;
-
+	return err;
 }
 
 static int connect_ring(struct backend_info *be)
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index 8684d11..68b41da 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -142,7 +142,7 @@
  * when the DMA hw is powered off.
  * TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works.
  */
-static u32 d40_backup_regs[] = {
+static __maybe_unused u32 d40_backup_regs[] = {
 	D40_DREG_LCPA,
 	D40_DREG_LCLA,
 	D40_DREG_PRMSE,
@@ -211,7 +211,7 @@
 
 #define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b)
 
-static u32 d40_backup_regs_chan[] = {
+static __maybe_unused u32 d40_backup_regs_chan[] = {
 	D40_CHAN_REG_SSCFG,
 	D40_CHAN_REG_SSELT,
 	D40_CHAN_REG_SSPTR,
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index d367581..3b0d77b 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -953,9 +953,11 @@
 		if (test_bit(FLAG_ACTIVE_LOW, &desc->flags))
 			lineinfo.flags |= GPIOLINE_FLAG_ACTIVE_LOW;
 		if (test_bit(FLAG_OPEN_DRAIN, &desc->flags))
-			lineinfo.flags |= GPIOLINE_FLAG_OPEN_DRAIN;
+			lineinfo.flags |= (GPIOLINE_FLAG_OPEN_DRAIN |
+					   GPIOLINE_FLAG_IS_OUT);
 		if (test_bit(FLAG_OPEN_SOURCE, &desc->flags))
-			lineinfo.flags |= GPIOLINE_FLAG_OPEN_SOURCE;
+			lineinfo.flags |= (GPIOLINE_FLAG_OPEN_SOURCE |
+					   GPIOLINE_FLAG_IS_OUT);
 
 		if (copy_to_user(ip, &lineinfo, sizeof(lineinfo)))
 			return -EFAULT;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
index e57a0ba..77df50dd 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
@@ -300,8 +300,10 @@
 		break;
 	}
 
-	if (retries == RETRIES)
+	if (retries == RETRIES) {
+		kfree(reply);
 		return -EINVAL;
+	}
 
 	*msg_len = reply_len;
 	*msg     = reply;
diff --git a/drivers/hid/hid-a4tech.c b/drivers/hid/hid-a4tech.c
index 9428ea7..c52bd16 100644
--- a/drivers/hid/hid-a4tech.c
+++ b/drivers/hid/hid-a4tech.c
@@ -26,12 +26,36 @@
 #define A4_2WHEEL_MOUSE_HACK_7	0x01
 #define A4_2WHEEL_MOUSE_HACK_B8	0x02
 
+#define A4_WHEEL_ORIENTATION	(HID_UP_GENDESK | 0x000000b8)
+
 struct a4tech_sc {
 	unsigned long quirks;
 	unsigned int hw_wheel;
 	__s32 delayed_value;
 };
 
+static int a4_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+			    struct hid_field *field, struct hid_usage *usage,
+			    unsigned long **bit, int *max)
+{
+	struct a4tech_sc *a4 = hid_get_drvdata(hdev);
+
+	if (a4->quirks & A4_2WHEEL_MOUSE_HACK_B8 &&
+	    usage->hid == A4_WHEEL_ORIENTATION) {
+		/*
+		 * We do not want to have this usage mapped to anything as it's
+		 * nonstandard and doesn't really behave like an HID report.
+		 * It's only selecting the orientation (vertical/horizontal) of
+		 * the previous mouse wheel report. The input_events will be
+		 * generated once both reports are recorded in a4_event().
+		 */
+		return -1;
+	}
+
+	return 0;
+
+}
+
 static int a4_input_mapped(struct hid_device *hdev, struct hid_input *hi,
 		struct hid_field *field, struct hid_usage *usage,
 		unsigned long **bit, int *max)
@@ -53,8 +77,7 @@
 	struct a4tech_sc *a4 = hid_get_drvdata(hdev);
 	struct input_dev *input;
 
-	if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput ||
-			!usage->type)
+	if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput)
 		return 0;
 
 	input = field->hidinput->input;
@@ -65,7 +88,7 @@
 			return 1;
 		}
 
-		if (usage->hid == 0x000100b8) {
+		if (usage->hid == A4_WHEEL_ORIENTATION) {
 			input_event(input, EV_REL, value ? REL_HWHEEL :
 					REL_WHEEL, a4->delayed_value);
 			return 1;
@@ -129,6 +152,7 @@
 static struct hid_driver a4_driver = {
 	.name = "a4tech",
 	.id_table = a4_devices,
+	.input_mapping = a4_input_mapping,
 	.input_mapped = a4_input_mapped,
 	.event = a4_event,
 	.probe = a4_probe,
diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c
index b833760..cfa0cb2 100644
--- a/drivers/hid/hid-tmff.c
+++ b/drivers/hid/hid-tmff.c
@@ -34,6 +34,8 @@
 
 #include "hid-ids.h"
 
+#define THRUSTMASTER_DEVICE_ID_2_IN_1_DT	0xb320
+
 static const signed short ff_rumble[] = {
 	FF_RUMBLE,
 	-1
@@ -88,6 +90,7 @@
 	struct hid_field *ff_field = tmff->ff_field;
 	int x, y;
 	int left, right;	/* Rumbling */
+	int motor_swap;
 
 	switch (effect->type) {
 	case FF_CONSTANT:
@@ -112,6 +115,13 @@
 					ff_field->logical_minimum,
 					ff_field->logical_maximum);
 
+		/* 2-in-1 strong motor is left */
+		if (hid->product == THRUSTMASTER_DEVICE_ID_2_IN_1_DT) {
+			motor_swap = left;
+			left = right;
+			right = motor_swap;
+		}
+
 		dbg_hid("(left,right)=(%08x, %08x)\n", left, right);
 		ff_field->value[0] = left;
 		ff_field->value[1] = right;
@@ -238,6 +248,8 @@
 		.driver_data = (unsigned long)ff_rumble },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304),   /* FireStorm Dual Power 2 (and 3) */
 		.driver_data = (unsigned long)ff_rumble },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, THRUSTMASTER_DEVICE_ID_2_IN_1_DT),   /* Dual Trigger 2-in-1 */
+		.driver_data = (unsigned long)ff_rumble },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb323),   /* Dual Trigger 3-in-1 (PC Mode) */
 		.driver_data = (unsigned long)ff_rumble },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb324),   /* Dual Trigger 3-in-1 (PS3 Mode) */
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 6c3bf88..fbf14a1 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -819,7 +819,7 @@
 	input_report_key(input, BTN_BASE2, (data[11] & 0x02));
 
 	if (data[12] & 0x80)
-		input_report_abs(input, ABS_WHEEL, (data[12] & 0x7f));
+		input_report_abs(input, ABS_WHEEL, (data[12] & 0x7f) - 1);
 	else
 		input_report_abs(input, ABS_WHEEL, 0);
 
@@ -949,6 +949,8 @@
 		y >>= 1;
 		distance >>= 1;
 	}
+	if (features->type == INTUOSHT2)
+		distance = features->distance_max - distance;
 	input_report_abs(input, ABS_X, x);
 	input_report_abs(input, ABS_Y, y);
 	input_report_abs(input, ABS_DISTANCE, distance);
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index beeb99c..77f2c6f 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -1114,7 +1114,6 @@
 
 err:
 	put_device(&src->dev);
-	kfree(src);
 
 	return err;
 }
diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c
index 96bb4e7..0218ba6 100644
--- a/drivers/i2c/busses/i2c-emev2.c
+++ b/drivers/i2c/busses/i2c-emev2.c
@@ -72,6 +72,7 @@
 	struct completion msg_done;
 	struct clk *sclk;
 	struct i2c_client *slave;
+	int irq;
 };
 
 static inline void em_clear_set_bit(struct em_i2c_device *priv, u8 clear, u8 set, u8 reg)
@@ -342,6 +343,12 @@
 
 	writeb(0, priv->base + I2C_OFS_SVA0);
 
+	/*
+	 * Wait for interrupt to finish. New slave irqs cannot happen because we
+	 * cleared the slave address and, thus, only extension codes will be
+	 * detected which do not use the slave ptr.
+	 */
+	synchronize_irq(priv->irq);
 	priv->slave = NULL;
 
 	return 0;
@@ -358,7 +365,7 @@
 {
 	struct em_i2c_device *priv;
 	struct resource *r;
-	int irq, ret;
+	int ret;
 
 	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
@@ -391,8 +398,8 @@
 
 	em_i2c_reset(&priv->adap);
 
-	irq = platform_get_irq(pdev, 0);
-	ret = devm_request_irq(&pdev->dev, irq, em_i2c_irq_handler, 0,
+	priv->irq = platform_get_irq(pdev, 0);
+	ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0,
 				"em_i2c", priv);
 	if (ret)
 		goto err_clk;
@@ -402,7 +409,8 @@
 	if (ret)
 		goto err_clk;
 
-	dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr, irq);
+	dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr,
+		 priv->irq);
 
 	return 0;
 
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index 8f1c5f2..62785aa 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -96,7 +96,7 @@
 #define SB800_PIIX4_PORT_IDX_MASK	0x06
 #define SB800_PIIX4_PORT_IDX_SHIFT	1
 
-/* On kerncz, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
+/* On kerncz and Hudson2, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
 #define SB800_PIIX4_PORT_IDX_KERNCZ		0x02
 #define SB800_PIIX4_PORT_IDX_MASK_KERNCZ	0x18
 #define SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ	3
@@ -355,18 +355,16 @@
 
 	/* Find which register is used for port selection */
 	if (PIIX4_dev->vendor == PCI_VENDOR_ID_AMD) {
-		switch (PIIX4_dev->device) {
-		case PCI_DEVICE_ID_AMD_KERNCZ_SMBUS:
+		if (PIIX4_dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS ||
+		    (PIIX4_dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS &&
+		     PIIX4_dev->revision >= 0x1F)) {
 			piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_KERNCZ;
 			piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK_KERNCZ;
 			piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ;
-			break;
-		case PCI_DEVICE_ID_AMD_HUDSON2_SMBUS:
-		default:
+		} else {
 			piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_ALT;
 			piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK;
 			piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT;
-			break;
 		}
 	} else {
 		mutex_lock(&piix4_mutex_sb800);
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 30815df..579e983 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -589,7 +589,7 @@
 		 * - and wouldn't make the resulting output segment too long
 		 */
 		if (cur_len && !s_iova_off && (dma_addr & seg_mask) &&
-		    (cur_len + s_length <= max_len)) {
+		    (max_len - cur_len >= s_length)) {
 			/* ...then concatenate it with the previous one */
 			cur_len += s_length;
 		} else {
diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
index c60c799..726fba4 100644
--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -1402,6 +1402,7 @@
 				printk(KERN_DEBUG
 				       "%s: %s: alloc urb for fifo %i failed",
 				       hw->name, __func__, fifo->fifonum);
+				continue;
 			}
 			fifo->iso[i].owner_fifo = (struct usb_fifo *) fifo;
 			fifo->iso[i].indx = i;
@@ -1700,13 +1701,23 @@
 static int
 setup_hfcsusb(struct hfcsusb *hw)
 {
+	void *dmabuf = kmalloc(sizeof(u_char), GFP_KERNEL);
 	u_char b;
+	int ret;
 
 	if (debug & DBG_HFC_CALL_TRACE)
 		printk(KERN_DEBUG "%s: %s\n", hw->name, __func__);
 
+	if (!dmabuf)
+		return -ENOMEM;
+
+	ret = read_reg_atomic(hw, HFCUSB_CHIP_ID, dmabuf);
+
+	memcpy(&b, dmabuf, sizeof(u_char));
+	kfree(dmabuf);
+
 	/* check the chip id */
-	if (read_reg_atomic(hw, HFCUSB_CHIP_ID, &b) != 1) {
+	if (ret != 1) {
 		printk(KERN_DEBUG "%s: %s: cannot read chip id\n",
 		       hw->name, __func__);
 		return 1;
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 673ce38..c837def 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1585,7 +1585,9 @@
 	unsigned long freed;
 
 	c = container_of(shrink, struct dm_bufio_client, shrinker);
-	if (!dm_bufio_trylock(c))
+	if (sc->gfp_mask & __GFP_FS)
+		dm_bufio_lock(c);
+	else if (!dm_bufio_trylock(c))
 		return SHRINK_STOP;
 
 	freed  = __scan(c, sc->nr_to_scan, sc->gfp_mask);
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 6b7b4dd..9da9a4c 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1264,7 +1264,7 @@
 }
 EXPORT_SYMBOL(dm_table_event);
 
-sector_t dm_table_get_size(struct dm_table *t)
+inline sector_t dm_table_get_size(struct dm_table *t)
 {
 	return t->num_targets ? (t->highs[t->num_targets - 1] + 1) : 0;
 }
@@ -1289,6 +1289,9 @@
 	unsigned int l, n = 0, k = 0;
 	sector_t *node;
 
+	if (unlikely(sector >= dm_table_get_size(t)))
+		return &t->targets[t->num_targets];
+
 	for (l = 0; l < t->depth; l++) {
 		n = get_child(n, k);
 		node = get_node(t, l, n);
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index e4ececd..3862152 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -623,39 +623,40 @@
 
 	new_parent = shadow_current(s);
 
+	pn = dm_block_data(new_parent);
+	size = le32_to_cpu(pn->header.flags) & INTERNAL_NODE ?
+		sizeof(__le64) : s->info->value_type.size;
+
+	/* create & init the left block */
 	r = new_block(s->info, &left);
 	if (r < 0)
 		return r;
 
+	ln = dm_block_data(left);
+	nr_left = le32_to_cpu(pn->header.nr_entries) / 2;
+
+	ln->header.flags = pn->header.flags;
+	ln->header.nr_entries = cpu_to_le32(nr_left);
+	ln->header.max_entries = pn->header.max_entries;
+	ln->header.value_size = pn->header.value_size;
+	memcpy(ln->keys, pn->keys, nr_left * sizeof(pn->keys[0]));
+	memcpy(value_ptr(ln, 0), value_ptr(pn, 0), nr_left * size);
+
+	/* create & init the right block */
 	r = new_block(s->info, &right);
 	if (r < 0) {
 		unlock_block(s->info, left);
 		return r;
 	}
 
-	pn = dm_block_data(new_parent);
-	ln = dm_block_data(left);
 	rn = dm_block_data(right);
-
-	nr_left = le32_to_cpu(pn->header.nr_entries) / 2;
 	nr_right = le32_to_cpu(pn->header.nr_entries) - nr_left;
 
-	ln->header.flags = pn->header.flags;
-	ln->header.nr_entries = cpu_to_le32(nr_left);
-	ln->header.max_entries = pn->header.max_entries;
-	ln->header.value_size = pn->header.value_size;
-
 	rn->header.flags = pn->header.flags;
 	rn->header.nr_entries = cpu_to_le32(nr_right);
 	rn->header.max_entries = pn->header.max_entries;
 	rn->header.value_size = pn->header.value_size;
-
-	memcpy(ln->keys, pn->keys, nr_left * sizeof(pn->keys[0]));
 	memcpy(rn->keys, pn->keys + nr_left, nr_right * sizeof(pn->keys[0]));
-
-	size = le32_to_cpu(pn->header.flags) & INTERNAL_NODE ?
-		sizeof(__le64) : s->info->value_type.size;
-	memcpy(value_ptr(ln, 0), value_ptr(pn, 0), nr_left * size);
 	memcpy(value_ptr(rn, 0), value_ptr(pn, nr_left),
 	       nr_right * size);
 
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index 20557e2..1d29771 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -248,7 +248,7 @@
 	}
 
 	if (smm->recursion_count == 1)
-		apply_bops(smm);
+		r = apply_bops(smm);
 
 	smm->recursion_count--;
 
diff --git a/drivers/misc/vmw_vmci/vmci_doorbell.c b/drivers/misc/vmw_vmci/vmci_doorbell.c
index b3fa738..f005206 100644
--- a/drivers/misc/vmw_vmci/vmci_doorbell.c
+++ b/drivers/misc/vmw_vmci/vmci_doorbell.c
@@ -318,7 +318,8 @@
 
 	entry = container_of(resource, struct dbell_entry, resource);
 	if (entry->run_delayed) {
-		schedule_work(&entry->work);
+		if (!schedule_work(&entry->work))
+			vmci_resource_put(resource);
 	} else {
 		entry->notify_cb(entry->client_data);
 		vmci_resource_put(resource);
@@ -366,7 +367,8 @@
 		    atomic_read(&dbell->active) == 1) {
 			if (dbell->run_delayed) {
 				vmci_resource_get(&dbell->resource);
-				schedule_work(&dbell->work);
+				if (!schedule_work(&dbell->work))
+					vmci_resource_put(&dbell->resource);
 			} else {
 				dbell->notify_cb(dbell->client_data);
 			}
diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
index 0e70922..2a6e083 100644
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -1492,6 +1492,12 @@
 			goto err;
 	}
 
+	/*
+	 * Some SD cards claims an out of spec VDD voltage range. Let's treat
+	 * these bits as being in-valid and especially also bit7.
+	 */
+	ocr &= ~0x7FFF;
+
 	rocr = mmc_select_voltage(host, ocr);
 
 	/*
diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
index 83b84ff..2ff6140 100644
--- a/drivers/mmc/host/sdhci-of-at91.c
+++ b/drivers/mmc/host/sdhci-of-at91.c
@@ -317,6 +317,9 @@
 	pm_runtime_set_autosuspend_delay(&pdev->dev, 50);
 	pm_runtime_use_autosuspend(&pdev->dev);
 
+	/* HS200 is broken at this moment */
+	host->quirks2 = SDHCI_QUIRK2_BROKEN_HS200;
+
 	ret = sdhci_add_host(host);
 	if (ret)
 		goto pm_runtime_disable;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index d338c31..8820fb1 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2131,6 +2131,15 @@
 	bond_for_each_slave(bond, slave, iter) {
 		switch (slave->new_link) {
 		case BOND_LINK_NOCHANGE:
+			/* For 802.3ad mode, check current slave speed and
+			 * duplex again in case its port was disabled after
+			 * invalid speed/duplex reporting but recovered before
+			 * link monitoring could make a decision on the actual
+			 * link status
+			 */
+			if (BOND_MODE(bond) == BOND_MODE_8023AD &&
+			    slave->link == BOND_LINK_UP)
+				bond_3ad_adapter_speed_duplex_changed(slave);
 			continue;
 
 		case BOND_LINK_UP:
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 214a487..ffc5467 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -1095,6 +1095,8 @@
 int register_candev(struct net_device *dev)
 {
 	dev->rtnl_link_ops = &can_link_ops;
+	netif_carrier_off(dev);
+
 	return register_netdev(dev);
 }
 EXPORT_SYMBOL_GPL(register_candev);
diff --git a/drivers/net/can/sja1000/peak_pcmcia.c b/drivers/net/can/sja1000/peak_pcmcia.c
index dd56133..fc9f8b01 100644
--- a/drivers/net/can/sja1000/peak_pcmcia.c
+++ b/drivers/net/can/sja1000/peak_pcmcia.c
@@ -487,7 +487,7 @@
 		if (!netdev)
 			continue;
 
-		strncpy(name, netdev->name, IFNAMSIZ);
+		strlcpy(name, netdev->name, IFNAMSIZ);
 
 		unregister_sja1000dev(netdev);
 
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 54c2354..ce0a352 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -879,7 +879,7 @@
 
 		dev_prev_siblings = dev->prev_siblings;
 		dev->state &= ~PCAN_USB_STATE_CONNECTED;
-		strncpy(name, netdev->name, IFNAMSIZ);
+		strlcpy(name, netdev->name, IFNAMSIZ);
 
 		unregister_netdev(netdev);
 
diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
index ddd1ec8..d1a2159 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
@@ -3263,7 +3263,7 @@
 	if (!adapter->regs) {
 		dev_err(&pdev->dev, "cannot map device registers\n");
 		err = -ENOMEM;
-		goto out_free_adapter;
+		goto out_free_adapter_nofail;
 	}
 
 	adapter->pdev = pdev;
@@ -3381,6 +3381,9 @@
 		if (adapter->port[i])
 			free_netdev(adapter->port[i]);
 
+out_free_adapter_nofail:
+	kfree_skb(adapter->nofail_skb);
+
 out_free_adapter:
 	kfree(adapter);
 
diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
index b5d18d9..f7882c1 100644
--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
@@ -157,6 +157,7 @@
 	unsigned int reg_inten;
 
 	struct napi_struct napi;
+	struct device *dev;
 	struct net_device *ndev;
 
 	struct tx_desc *tx_desc;
@@ -185,7 +186,7 @@
 
 static inline unsigned int tx_count(unsigned int head, unsigned int tail)
 {
-	return (head - tail) % (TX_DESC_NUM - 1);
+	return (head - tail) % TX_DESC_NUM;
 }
 
 static void hip04_config_port(struct net_device *ndev, u32 speed, u32 duplex)
@@ -387,7 +388,7 @@
 		}
 
 		if (priv->tx_phys[tx_tail]) {
-			dma_unmap_single(&ndev->dev, priv->tx_phys[tx_tail],
+			dma_unmap_single(priv->dev, priv->tx_phys[tx_tail],
 					 priv->tx_skb[tx_tail]->len,
 					 DMA_TO_DEVICE);
 			priv->tx_phys[tx_tail] = 0;
@@ -437,8 +438,8 @@
 		return NETDEV_TX_BUSY;
 	}
 
-	phys = dma_map_single(&ndev->dev, skb->data, skb->len, DMA_TO_DEVICE);
-	if (dma_mapping_error(&ndev->dev, phys)) {
+	phys = dma_map_single(priv->dev, skb->data, skb->len, DMA_TO_DEVICE);
+	if (dma_mapping_error(priv->dev, phys)) {
 		dev_kfree_skb(skb);
 		return NETDEV_TX_OK;
 	}
@@ -497,6 +498,9 @@
 	u16 len;
 	u32 err;
 
+	/* clean up tx descriptors */
+	tx_remaining = hip04_tx_reclaim(ndev, false);
+
 	while (cnt && !last) {
 		buf = priv->rx_buf[priv->rx_head];
 		skb = build_skb(buf, priv->rx_buf_size);
@@ -505,7 +509,7 @@
 			goto refill;
 		}
 
-		dma_unmap_single(&ndev->dev, priv->rx_phys[priv->rx_head],
+		dma_unmap_single(priv->dev, priv->rx_phys[priv->rx_head],
 				 RX_BUF_SIZE, DMA_FROM_DEVICE);
 		priv->rx_phys[priv->rx_head] = 0;
 
@@ -534,9 +538,9 @@
 		buf = netdev_alloc_frag(priv->rx_buf_size);
 		if (!buf)
 			goto done;
-		phys = dma_map_single(&ndev->dev, buf,
+		phys = dma_map_single(priv->dev, buf,
 				      RX_BUF_SIZE, DMA_FROM_DEVICE);
-		if (dma_mapping_error(&ndev->dev, phys))
+		if (dma_mapping_error(priv->dev, phys))
 			goto done;
 		priv->rx_buf[priv->rx_head] = buf;
 		priv->rx_phys[priv->rx_head] = phys;
@@ -557,8 +561,7 @@
 	}
 	napi_complete(napi);
 done:
-	/* clean up tx descriptors and start a new timer if necessary */
-	tx_remaining = hip04_tx_reclaim(ndev, false);
+	/* start a new timer if necessary */
 	if (rx < budget && tx_remaining)
 		hip04_start_tx_timer(priv);
 
@@ -640,9 +643,9 @@
 	for (i = 0; i < RX_DESC_NUM; i++) {
 		dma_addr_t phys;
 
-		phys = dma_map_single(&ndev->dev, priv->rx_buf[i],
+		phys = dma_map_single(priv->dev, priv->rx_buf[i],
 				      RX_BUF_SIZE, DMA_FROM_DEVICE);
-		if (dma_mapping_error(&ndev->dev, phys))
+		if (dma_mapping_error(priv->dev, phys))
 			return -EIO;
 
 		priv->rx_phys[i] = phys;
@@ -676,7 +679,7 @@
 
 	for (i = 0; i < RX_DESC_NUM; i++) {
 		if (priv->rx_phys[i]) {
-			dma_unmap_single(&ndev->dev, priv->rx_phys[i],
+			dma_unmap_single(priv->dev, priv->rx_phys[i],
 					 RX_BUF_SIZE, DMA_FROM_DEVICE);
 			priv->rx_phys[i] = 0;
 		}
@@ -827,6 +830,7 @@
 		return -ENOMEM;
 
 	priv = netdev_priv(ndev);
+	priv->dev = d;
 	priv->ndev = ndev;
 	platform_set_drvdata(pdev, ndev);
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index d51ad14..05953e1 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -892,6 +892,7 @@
 	{QMI_FIXED_INTF(0x2001, 0x7e35, 4)},	/* D-Link DWM-222 */
 	{QMI_FIXED_INTF(0x2020, 0x2031, 4)},	/* Olicard 600 */
 	{QMI_FIXED_INTF(0x2020, 0x2033, 4)},	/* BroadMobi BM806U */
+	{QMI_FIXED_INTF(0x2020, 0x2060, 4)},	/* BroadMobi BM818 */
 	{QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
 	{QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
 	{QMI_FIXED_INTF(0x1199, 0x68a2, 8)},	/* Sierra Wireless MC7710 in QMI mode */
diff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c
index 56f2112..85df2e0 100644
--- a/drivers/nfc/st-nci/se.c
+++ b/drivers/nfc/st-nci/se.c
@@ -344,6 +344,8 @@
 
 		transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
 					    skb->len - 2, GFP_KERNEL);
+		if (!transaction)
+			return -ENOMEM;
 
 		transaction->aid_len = skb->data[1];
 		memcpy(transaction->aid, &skb->data[2], transaction->aid_len);
diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c
index 6e84e12..9add5fe 100644
--- a/drivers/nfc/st21nfca/se.c
+++ b/drivers/nfc/st21nfca/se.c
@@ -333,6 +333,8 @@
 
 		transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
 						   skb->len - 2, GFP_KERNEL);
+		if (!transaction)
+			return -ENOMEM;
 
 		transaction->aid_len = skb->data[1];
 		memcpy(transaction->aid, &skb->data[2],
diff --git a/drivers/scsi/ufs/unipro.h b/drivers/scsi/ufs/unipro.h
index a8cfa5e..c728ca1 100644
--- a/drivers/scsi/ufs/unipro.h
+++ b/drivers/scsi/ufs/unipro.h
@@ -46,7 +46,7 @@
 #define RX_HS_UNTERMINATED_ENABLE		0x00A6
 #define RX_ENTER_HIBERN8			0x00A7
 #define RX_BYPASS_8B10B_ENABLE			0x00A8
-#define RX_TERMINATION_FORCE_ENABLE		0x0089
+#define RX_TERMINATION_FORCE_ENABLE		0x00A9
 #define RX_MIN_ACTIVATETIME_CAPABILITY		0x008F
 #define RX_HIBERN8TIME_CAPABILITY		0x0092
 
diff --git a/drivers/staging/android/Kconfig b/drivers/staging/android/Kconfig
index a17c483..8f548691 100644
--- a/drivers/staging/android/Kconfig
+++ b/drivers/staging/android/Kconfig
@@ -44,8 +44,6 @@
 
 source "drivers/staging/android/ion/Kconfig"
 
-source "drivers/staging/android/fiq_debugger/Kconfig"
-
 endif # if ANDROID
 
 endmenu
diff --git a/drivers/staging/android/Makefile b/drivers/staging/android/Makefile
index 93c5f5a..3482d43c 100644
--- a/drivers/staging/android/Makefile
+++ b/drivers/staging/android/Makefile
@@ -1,7 +1,6 @@
 ccflags-y += -I$(src)			# needed for trace events
 
 obj-y					+= ion/
-obj-$(CONFIG_FIQ_DEBUGGER)		+= fiq_debugger/
 
 obj-$(CONFIG_ASHMEM)			+= ashmem.o
 obj-$(CONFIG_ANDROID_LOW_MEMORY_KILLER)	+= lowmemorykiller.o
diff --git a/drivers/staging/android/fiq_debugger/Kconfig b/drivers/staging/android/fiq_debugger/Kconfig
deleted file mode 100644
index 60fc224..0000000
--- a/drivers/staging/android/fiq_debugger/Kconfig
+++ /dev/null
@@ -1,58 +0,0 @@
-config FIQ_DEBUGGER
-	bool "FIQ Mode Serial Debugger"
-	default n
-	depends on ARM || ARM64
-	help
-	  The FIQ serial debugger can accept commands even when the
-	  kernel is unresponsive due to being stuck with interrupts
-	  disabled.
-
-config FIQ_DEBUGGER_NO_SLEEP
-	bool "Keep serial debugger active"
-	depends on FIQ_DEBUGGER
-	default n
-	help
-	  Enables the serial debugger at boot. Passing
-	  fiq_debugger.no_sleep on the kernel commandline will
-	  override this config option.
-
-config FIQ_DEBUGGER_WAKEUP_IRQ_ALWAYS_ON
-	bool "Don't disable wakeup IRQ when debugger is active"
-	depends on FIQ_DEBUGGER
-	default n
-	help
-	  Don't disable the wakeup irq when enabling the uart clock.  This will
-	  cause extra interrupts, but it makes the serial debugger usable with
-	  on some MSM radio builds that ignore the uart clock request in power
-	  collapse.
-
-config FIQ_DEBUGGER_CONSOLE
-	bool "Console on FIQ Serial Debugger port"
-	depends on FIQ_DEBUGGER
-	default n
-	help
-	  Enables a console so that printk messages are displayed on
-	  the debugger serial port as the occur.
-
-config FIQ_DEBUGGER_CONSOLE_DEFAULT_ENABLE
-	bool "Put the FIQ debugger into console mode by default"
-	depends on FIQ_DEBUGGER_CONSOLE
-	default n
-	help
-	  If enabled, this puts the fiq debugger into console mode by default.
-	  Otherwise, the fiq debugger will start out in debug mode.
-
-config FIQ_DEBUGGER_UART_OVERLAY
-	bool "Install uart DT overlay"
-	depends on FIQ_DEBUGGER
-	select OF_OVERLAY
-	default n
-	help
-	  If enabled, fiq debugger is calling fiq_debugger_uart_overlay()
-	  that will apply overlay uart_overlay@0 to disable proper uart.
-
-config FIQ_WATCHDOG
-	bool
-	select FIQ_DEBUGGER
-	select PSTORE_RAM
-	default n
diff --git a/drivers/staging/android/fiq_debugger/Makefile b/drivers/staging/android/fiq_debugger/Makefile
deleted file mode 100644
index a7ca487..0000000
--- a/drivers/staging/android/fiq_debugger/Makefile
+++ /dev/null
@@ -1,4 +0,0 @@
-obj-y			+= fiq_debugger.o
-obj-$(CONFIG_ARM)	+= fiq_debugger_arm.o
-obj-$(CONFIG_ARM64)	+= fiq_debugger_arm64.o
-obj-$(CONFIG_FIQ_WATCHDOG)	+= fiq_watchdog.o
diff --git a/drivers/staging/android/fiq_debugger/fiq_debugger.c b/drivers/staging/android/fiq_debugger/fiq_debugger.c
deleted file mode 100644
index 192661b..0000000
--- a/drivers/staging/android/fiq_debugger/fiq_debugger.c
+++ /dev/null
@@ -1,1268 +0,0 @@
-/*
- * drivers/staging/android/fiq_debugger.c
- *
- * Serial Debugger Interface accessed through an FIQ interrupt.
- *
- * Copyright (C) 2008 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <stdarg.h>
-#include <linux/module.h>
-#include <linux/io.h>
-#include <linux/console.h>
-#include <linux/interrupt.h>
-#include <linux/clk.h>
-#include <linux/platform_device.h>
-#include <linux/kernel_stat.h>
-#include <linux/kmsg_dump.h>
-#include <linux/irq.h>
-#include <linux/delay.h>
-#include <linux/reboot.h>
-#include <linux/sched.h>
-#include <linux/slab.h>
-#include <linux/smp.h>
-#include <linux/sysrq.h>
-#include <linux/timer.h>
-#include <linux/tty.h>
-#include <linux/tty_flip.h>
-
-#ifdef CONFIG_FIQ_GLUE
-#include <asm/fiq_glue.h>
-#endif
-
-#ifdef CONFIG_FIQ_DEBUGGER_UART_OVERLAY
-#include <linux/of.h>
-#endif
-
-#include <linux/uaccess.h>
-
-#include "fiq_debugger.h"
-#include "fiq_debugger_priv.h"
-#include "fiq_debugger_ringbuf.h"
-
-#define DEBUG_MAX 64
-#define MAX_UNHANDLED_FIQ_COUNT 1000000
-
-#define MAX_FIQ_DEBUGGER_PORTS 4
-
-struct fiq_debugger_state {
-#ifdef CONFIG_FIQ_GLUE
-	struct fiq_glue_handler handler;
-#endif
-	struct fiq_debugger_output output;
-
-	int fiq;
-	int uart_irq;
-	int signal_irq;
-	int wakeup_irq;
-	bool wakeup_irq_no_set_wake;
-	struct clk *clk;
-	struct fiq_debugger_pdata *pdata;
-	struct platform_device *pdev;
-
-	char debug_cmd[DEBUG_MAX];
-	int debug_busy;
-	int debug_abort;
-
-	char debug_buf[DEBUG_MAX];
-	int debug_count;
-
-	bool no_sleep;
-	bool debug_enable;
-	bool ignore_next_wakeup_irq;
-	struct timer_list sleep_timer;
-	spinlock_t sleep_timer_lock;
-	bool uart_enabled;
-	struct wakeup_source debugger_wake_src;
-	bool console_enable;
-	int current_cpu;
-	atomic_t unhandled_fiq_count;
-	bool in_fiq;
-
-	struct work_struct work;
-	spinlock_t work_lock;
-	char work_cmd[DEBUG_MAX];
-
-#ifdef CONFIG_FIQ_DEBUGGER_CONSOLE
-	spinlock_t console_lock;
-	struct console console;
-	struct tty_port tty_port;
-	struct fiq_debugger_ringbuf *tty_rbuf;
-	bool syslog_dumping;
-#endif
-
-	unsigned int last_irqs[NR_IRQS];
-	unsigned int last_local_timer_irqs[NR_CPUS];
-};
-
-#ifdef CONFIG_FIQ_DEBUGGER_CONSOLE
-struct tty_driver *fiq_tty_driver;
-#endif
-
-#ifdef CONFIG_FIQ_DEBUGGER_NO_SLEEP
-static bool initial_no_sleep = true;
-#else
-static bool initial_no_sleep;
-#endif
-
-#ifdef CONFIG_FIQ_DEBUGGER_CONSOLE_DEFAULT_ENABLE
-static bool initial_debug_enable = true;
-static bool initial_console_enable = true;
-#else
-static bool initial_debug_enable;
-static bool initial_console_enable;
-#endif
-
-static bool fiq_kgdb_enable;
-static bool fiq_debugger_disable;
-
-module_param_named(no_sleep, initial_no_sleep, bool, 0644);
-module_param_named(debug_enable, initial_debug_enable, bool, 0644);
-module_param_named(console_enable, initial_console_enable, bool, 0644);
-module_param_named(kgdb_enable, fiq_kgdb_enable, bool, 0644);
-module_param_named(disable, fiq_debugger_disable, bool, 0644);
-
-#ifdef CONFIG_FIQ_DEBUGGER_WAKEUP_IRQ_ALWAYS_ON
-static inline
-void fiq_debugger_enable_wakeup_irq(struct fiq_debugger_state *state) {}
-static inline
-void fiq_debugger_disable_wakeup_irq(struct fiq_debugger_state *state) {}
-#else
-static inline
-void fiq_debugger_enable_wakeup_irq(struct fiq_debugger_state *state)
-{
-	if (state->wakeup_irq < 0)
-		return;
-	enable_irq(state->wakeup_irq);
-	if (!state->wakeup_irq_no_set_wake)
-		enable_irq_wake(state->wakeup_irq);
-}
-static inline
-void fiq_debugger_disable_wakeup_irq(struct fiq_debugger_state *state)
-{
-	if (state->wakeup_irq < 0)
-		return;
-	disable_irq_nosync(state->wakeup_irq);
-	if (!state->wakeup_irq_no_set_wake)
-		disable_irq_wake(state->wakeup_irq);
-}
-#endif
-
-static inline bool fiq_debugger_have_fiq(struct fiq_debugger_state *state)
-{
-	return (state->fiq >= 0);
-}
-
-#ifdef CONFIG_FIQ_GLUE
-static void fiq_debugger_force_irq(struct fiq_debugger_state *state)
-{
-	unsigned int irq = state->signal_irq;
-
-	if (WARN_ON(!fiq_debugger_have_fiq(state)))
-		return;
-	if (state->pdata->force_irq) {
-		state->pdata->force_irq(state->pdev, irq);
-	} else {
-		struct irq_chip *chip = irq_get_chip(irq);
-		if (chip && chip->irq_retrigger)
-			chip->irq_retrigger(irq_get_irq_data(irq));
-	}
-}
-#endif
-
-static void fiq_debugger_uart_enable(struct fiq_debugger_state *state)
-{
-	if (state->clk)
-		clk_enable(state->clk);
-	if (state->pdata->uart_enable)
-		state->pdata->uart_enable(state->pdev);
-}
-
-static void fiq_debugger_uart_disable(struct fiq_debugger_state *state)
-{
-	if (state->pdata->uart_disable)
-		state->pdata->uart_disable(state->pdev);
-	if (state->clk)
-		clk_disable(state->clk);
-}
-
-static void fiq_debugger_uart_flush(struct fiq_debugger_state *state)
-{
-	if (state->pdata->uart_flush)
-		state->pdata->uart_flush(state->pdev);
-}
-
-static void fiq_debugger_putc(struct fiq_debugger_state *state, char c)
-{
-	state->pdata->uart_putc(state->pdev, c);
-}
-
-static void fiq_debugger_puts(struct fiq_debugger_state *state, char *s)
-{
-	unsigned c;
-	while ((c = *s++)) {
-		if (c == '\n')
-			fiq_debugger_putc(state, '\r');
-		fiq_debugger_putc(state, c);
-	}
-}
-
-static void fiq_debugger_prompt(struct fiq_debugger_state *state)
-{
-	fiq_debugger_puts(state, "debug> ");
-}
-
-static void fiq_debugger_dump_kernel_log(struct fiq_debugger_state *state)
-{
-	char buf[512];
-	size_t len;
-	struct kmsg_dumper dumper = { .active = true };
-
-
-	kmsg_dump_rewind_nolock(&dumper);
-	while (kmsg_dump_get_line_nolock(&dumper, true, buf,
-					 sizeof(buf) - 1, &len)) {
-		buf[len] = 0;
-		fiq_debugger_puts(state, buf);
-	}
-}
-
-static void fiq_debugger_printf(struct fiq_debugger_output *output,
-			       const char *fmt, ...)
-{
-	struct fiq_debugger_state *state;
-	char buf[256];
-	va_list ap;
-
-	state = container_of(output, struct fiq_debugger_state, output);
-	va_start(ap, fmt);
-	vsnprintf(buf, sizeof(buf), fmt, ap);
-	va_end(ap);
-
-	fiq_debugger_puts(state, buf);
-}
-
-/* Safe outside fiq context */
-static int fiq_debugger_printf_nfiq(void *cookie, const char *fmt, ...)
-{
-	struct fiq_debugger_state *state = cookie;
-	char buf[256];
-	va_list ap;
-	unsigned long irq_flags;
-
-	va_start(ap, fmt);
-	vsnprintf(buf, 128, fmt, ap);
-	va_end(ap);
-
-	local_irq_save(irq_flags);
-	fiq_debugger_puts(state, buf);
-	fiq_debugger_uart_flush(state);
-	local_irq_restore(irq_flags);
-	return state->debug_abort;
-}
-
-static void fiq_debugger_dump_irqs(struct fiq_debugger_state *state)
-{
-	int n;
-	struct irq_desc *desc;
-
-	fiq_debugger_printf(&state->output,
-			"irqnr       total  since-last   status  name\n");
-	for_each_irq_desc(n, desc) {
-		struct irqaction *act = desc->action;
-		if (!act && !kstat_irqs(n))
-			continue;
-		fiq_debugger_printf(&state->output, "%5d: %10u %11u %8x  %s\n", n,
-			kstat_irqs(n),
-			kstat_irqs(n) - state->last_irqs[n],
-			desc->status_use_accessors,
-			(act && act->name) ? act->name : "???");
-		state->last_irqs[n] = kstat_irqs(n);
-	}
-}
-
-static void fiq_debugger_do_ps(struct fiq_debugger_state *state)
-{
-	struct task_struct *g;
-	struct task_struct *p;
-	unsigned task_state;
-	static const char stat_nam[] = "RSDTtZX";
-
-	fiq_debugger_printf(&state->output, "pid   ppid  prio task            pc\n");
-	read_lock(&tasklist_lock);
-	do_each_thread(g, p) {
-		task_state = p->state ? __ffs(p->state) + 1 : 0;
-		fiq_debugger_printf(&state->output,
-			     "%5d %5d %4d ", p->pid, p->parent->pid, p->prio);
-		fiq_debugger_printf(&state->output, "%-13.13s %c", p->comm,
-			     task_state >= sizeof(stat_nam) ? '?' : stat_nam[task_state]);
-		if (task_state == TASK_RUNNING)
-			fiq_debugger_printf(&state->output, " running\n");
-		else
-			fiq_debugger_printf(&state->output, " %08lx\n",
-					thread_saved_pc(p));
-	} while_each_thread(g, p);
-	read_unlock(&tasklist_lock);
-}
-
-#ifdef CONFIG_FIQ_DEBUGGER_CONSOLE
-static void fiq_debugger_begin_syslog_dump(struct fiq_debugger_state *state)
-{
-	state->syslog_dumping = true;
-}
-
-static void fiq_debugger_end_syslog_dump(struct fiq_debugger_state *state)
-{
-	state->syslog_dumping = false;
-}
-#else
-extern int do_syslog(int type, char __user *bug, int count);
-static void fiq_debugger_begin_syslog_dump(struct fiq_debugger_state *state)
-{
-	do_syslog(5 /* clear */, NULL, 0);
-}
-
-static void fiq_debugger_end_syslog_dump(struct fiq_debugger_state *state)
-{
-	fiq_debugger_dump_kernel_log(state);
-}
-#endif
-
-static void fiq_debugger_do_sysrq(struct fiq_debugger_state *state, char rq)
-{
-	if ((rq == 'g' || rq == 'G') && !fiq_kgdb_enable) {
-		fiq_debugger_printf(&state->output, "sysrq-g blocked\n");
-		return;
-	}
-	fiq_debugger_begin_syslog_dump(state);
-	handle_sysrq(rq);
-	fiq_debugger_end_syslog_dump(state);
-}
-
-#ifdef CONFIG_KGDB
-static void fiq_debugger_do_kgdb(struct fiq_debugger_state *state)
-{
-	if (!fiq_kgdb_enable) {
-		fiq_debugger_printf(&state->output, "kgdb through fiq debugger not enabled\n");
-		return;
-	}
-
-	fiq_debugger_printf(&state->output, "enabling console and triggering kgdb\n");
-	state->console_enable = true;
-	handle_sysrq('g');
-}
-#endif
-
-static void fiq_debugger_schedule_work(struct fiq_debugger_state *state,
-		char *cmd)
-{
-	unsigned long flags;
-
-	spin_lock_irqsave(&state->work_lock, flags);
-	if (state->work_cmd[0] != '\0') {
-		fiq_debugger_printf(&state->output, "work command processor busy\n");
-		spin_unlock_irqrestore(&state->work_lock, flags);
-		return;
-	}
-
-	strlcpy(state->work_cmd, cmd, sizeof(state->work_cmd));
-	spin_unlock_irqrestore(&state->work_lock, flags);
-
-	schedule_work(&state->work);
-}
-
-static void fiq_debugger_work(struct work_struct *work)
-{
-	struct fiq_debugger_state *state;
-	char work_cmd[DEBUG_MAX];
-	char *cmd;
-	unsigned long flags;
-
-	state = container_of(work, struct fiq_debugger_state, work);
-
-	spin_lock_irqsave(&state->work_lock, flags);
-
-	strlcpy(work_cmd, state->work_cmd, sizeof(work_cmd));
-	state->work_cmd[0] = '\0';
-
-	spin_unlock_irqrestore(&state->work_lock, flags);
-
-	cmd = work_cmd;
-	if (!strncmp(cmd, "reboot", 6)) {
-		cmd += 6;
-		while (*cmd == ' ')
-			cmd++;
-		if ((*cmd != '\0') && sysrq_on())
-			kernel_restart(cmd);
-		else
-			kernel_restart(NULL);
-	} else {
-		fiq_debugger_printf(&state->output, "unknown work command '%s'\n",
-				work_cmd);
-	}
-}
-
-/* This function CANNOT be called in FIQ context */
-static void fiq_debugger_irq_exec(struct fiq_debugger_state *state, char *cmd)
-{
-	if (!strcmp(cmd, "ps"))
-		fiq_debugger_do_ps(state);
-	if (!strcmp(cmd, "sysrq"))
-		fiq_debugger_do_sysrq(state, 'h');
-	if (!strncmp(cmd, "sysrq ", 6))
-		fiq_debugger_do_sysrq(state, cmd[6]);
-#ifdef CONFIG_KGDB
-	if (!strcmp(cmd, "kgdb"))
-		fiq_debugger_do_kgdb(state);
-#endif
-	if (!strncmp(cmd, "reboot", 6))
-		fiq_debugger_schedule_work(state, cmd);
-}
-
-static void fiq_debugger_help(struct fiq_debugger_state *state)
-{
-	fiq_debugger_printf(&state->output,
-			"FIQ Debugger commands:\n");
-	if (sysrq_on()) {
-		fiq_debugger_printf(&state->output,
-			" pc            PC status\n"
-			" regs          Register dump\n"
-			" allregs       Extended Register dump\n"
-			" bt            Stack trace\n");
-		fiq_debugger_printf(&state->output,
-			" reboot [<c>]  Reboot with command <c>\n"
-			" reset [<c>]   Hard reset with command <c>\n"
-			" irqs          Interrupt status\n"
-			" kmsg          Kernel log\n"
-			" version       Kernel version\n");
-		fiq_debugger_printf(&state->output,
-			" cpu           Current CPU\n"
-			" cpu <number>  Switch to CPU<number>\n"
-			" sysrq         sysrq options\n"
-			" sysrq <param> Execute sysrq with <param>\n");
-	} else {
-		fiq_debugger_printf(&state->output,
-			" reboot        Reboot\n"
-			" reset         Hard reset\n"
-			" irqs          Interrupt status\n");
-	}
-	fiq_debugger_printf(&state->output,
-			" sleep         Allow sleep while in FIQ\n"
-			" nosleep       Disable sleep while in FIQ\n"
-			" console       Switch terminal to console\n"
-			" ps            Process list\n");
-#ifdef CONFIG_KGDB
-	if (fiq_kgdb_enable) {
-		fiq_debugger_printf(&state->output,
-			" kgdb          Enter kernel debugger\n");
-#endif
-}
-
-static void fiq_debugger_take_affinity(void *info)
-{
-	struct fiq_debugger_state *state = info;
-	struct cpumask cpumask;
-
-	cpumask_clear(&cpumask);
-	cpumask_set_cpu(get_cpu(), &cpumask);
-
-	irq_set_affinity(state->uart_irq, &cpumask);
-}
-
-static void fiq_debugger_switch_cpu(struct fiq_debugger_state *state, int cpu)
-{
-	if (!fiq_debugger_have_fiq(state))
-		smp_call_function_single(cpu, fiq_debugger_take_affinity, state,
-				false);
-	state->current_cpu = cpu;
-}
-
-static bool fiq_debugger_fiq_exec(struct fiq_debugger_state *state,
-			const char *cmd, const struct pt_regs *regs,
-			void *svc_sp)
-{
-	bool signal_helper = false;
-
-	if (!strcmp(cmd, "help") || !strcmp(cmd, "?")) {
-		fiq_debugger_help(state);
-	} else if (!strcmp(cmd, "pc")) {
-		if (sysrq_on())
-			fiq_debugger_dump_pc(&state->output, regs);
-	} else if (!strcmp(cmd, "regs")) {
-		if (sysrq_on())
-			fiq_debugger_dump_regs(&state->output, regs);
-	} else if (!strcmp(cmd, "allregs")) {
-		if (sysrq_on())
-			fiq_debugger_dump_allregs(&state->output, regs);
-	} else if (!strcmp(cmd, "bt")) {
-		if (sysrq_on())
-			fiq_debugger_dump_stacktrace(&state->output, regs,
-						     100, svc_sp);
-	} else if (!strncmp(cmd, "reset", 5)) {
-		cmd += 5;
-		while (*cmd == ' ')
-			cmd++;
-		if (*cmd && sysrq_on()) {
-			char tmp_cmd[32];
-			strlcpy(tmp_cmd, cmd, sizeof(tmp_cmd));
-			machine_restart(tmp_cmd);
-		} else {
-			machine_restart(NULL);
-		}
-	} else if (!strcmp(cmd, "irqs")) {
-		fiq_debugger_dump_irqs(state);
-	} else if (!strcmp(cmd, "kmsg")) {
-		if (sysrq_on())
-			fiq_debugger_dump_kernel_log(state);
-	} else if (!strcmp(cmd, "version")) {
-		if (sysrq_on())
-			fiq_debugger_printf(&state->output, "%s\n",
-					    linux_banner);
-	} else if (!strcmp(cmd, "sleep")) {
-		state->no_sleep = false;
-		fiq_debugger_printf(&state->output, "enabling sleep\n");
-	} else if (!strcmp(cmd, "nosleep")) {
-		state->no_sleep = true;
-		fiq_debugger_printf(&state->output, "disabling sleep\n");
-	} else if (!strcmp(cmd, "console")) {
-		fiq_debugger_printf(&state->output, "console mode\n");
-		fiq_debugger_uart_flush(state);
-		state->console_enable = true;
-	} else if (!strcmp(cmd, "cpu")) {
-		if (sysrq_on())
-			fiq_debugger_printf(&state->output, "cpu %d\n",
-					    state->current_cpu);
-	} else if (!strncmp(cmd, "cpu ", 4) && sysrq_on()) {
-		unsigned long cpu = 0;
-		if (kstrtoul(cmd + 4, 10, &cpu) == 0)
-			fiq_debugger_switch_cpu(state, cpu);
-		else
-			fiq_debugger_printf(&state->output, "invalid cpu\n");
-		fiq_debugger_printf(&state->output, "cpu %d\n",
-				    state->current_cpu);
-	} else {
-		if (state->debug_busy) {
-			fiq_debugger_printf(&state->output,
-				"command processor busy. trying to abort.\n");
-			state->debug_abort = -1;
-		} else {
-			strcpy(state->debug_cmd, cmd);
-			state->debug_busy = 1;
-		}
-
-		return true;
-	}
-	if (!state->console_enable)
-		fiq_debugger_prompt(state);
-
-	return signal_helper;
-}
-
-static void fiq_debugger_sleep_timer_expired(unsigned long data)
-{
-	struct fiq_debugger_state *state = (struct fiq_debugger_state *)data;
-	unsigned long flags;
-
-	spin_lock_irqsave(&state->sleep_timer_lock, flags);
-	if (state->uart_enabled && !state->no_sleep) {
-		if (state->debug_enable && !state->console_enable) {
-			state->debug_enable = false;
-			fiq_debugger_printf_nfiq(state,
-					"suspending fiq debugger\n");
-		}
-		state->ignore_next_wakeup_irq = true;
-		fiq_debugger_uart_disable(state);
-		state->uart_enabled = false;
-		fiq_debugger_enable_wakeup_irq(state);
-	}
-	__pm_relax(&state->debugger_wake_src);
-	spin_unlock_irqrestore(&state->sleep_timer_lock, flags);
-}
-
-static void fiq_debugger_handle_wakeup(struct fiq_debugger_state *state)
-{
-	unsigned long flags;
-
-	spin_lock_irqsave(&state->sleep_timer_lock, flags);
-	if (state->wakeup_irq >= 0 && state->ignore_next_wakeup_irq) {
-		state->ignore_next_wakeup_irq = false;
-	} else if (!state->uart_enabled) {
-		__pm_stay_awake(&state->debugger_wake_src);
-		fiq_debugger_uart_enable(state);
-		state->uart_enabled = true;
-		fiq_debugger_disable_wakeup_irq(state);
-		mod_timer(&state->sleep_timer, jiffies + HZ / 2);
-	}
-	spin_unlock_irqrestore(&state->sleep_timer_lock, flags);
-}
-
-static irqreturn_t fiq_debugger_wakeup_irq_handler(int irq, void *dev)
-{
-	struct fiq_debugger_state *state = dev;
-
-	if (!state->no_sleep)
-		fiq_debugger_puts(state, "WAKEUP\n");
-	fiq_debugger_handle_wakeup(state);
-
-	return IRQ_HANDLED;
-}
-
-static
-void fiq_debugger_handle_console_irq_context(struct fiq_debugger_state *state)
-{
-#if defined(CONFIG_FIQ_DEBUGGER_CONSOLE)
-	if (state->tty_port.ops) {
-		int i;
-		int count = fiq_debugger_ringbuf_level(state->tty_rbuf);
-		for (i = 0; i < count; i++) {
-			int c = fiq_debugger_ringbuf_peek(state->tty_rbuf, 0);
-			tty_insert_flip_char(&state->tty_port, c, TTY_NORMAL);
-			if (!fiq_debugger_ringbuf_consume(state->tty_rbuf, 1))
-				pr_warn("fiq tty failed to consume byte\n");
-		}
-		tty_flip_buffer_push(&state->tty_port);
-	}
-#endif
-}
-
-static void fiq_debugger_handle_irq_context(struct fiq_debugger_state *state)
-{
-	if (!state->no_sleep) {
-		unsigned long flags;
-
-		spin_lock_irqsave(&state->sleep_timer_lock, flags);
-		__pm_stay_awake(&state->debugger_wake_src);
-		mod_timer(&state->sleep_timer, jiffies + HZ * 5);
-		spin_unlock_irqrestore(&state->sleep_timer_lock, flags);
-	}
-	fiq_debugger_handle_console_irq_context(state);
-	if (state->debug_busy) {
-		fiq_debugger_irq_exec(state, state->debug_cmd);
-		if (!state->console_enable)
-			fiq_debugger_prompt(state);
-		state->debug_busy = 0;
-	}
-}
-
-static int fiq_debugger_getc(struct fiq_debugger_state *state)
-{
-	return state->pdata->uart_getc(state->pdev);
-}
-
-static bool fiq_debugger_handle_uart_interrupt(struct fiq_debugger_state *state,
-			int this_cpu, const struct pt_regs *regs, void *svc_sp)
-{
-	int c;
-	static int last_c;
-	int count = 0;
-	bool signal_helper = false;
-
-	if (this_cpu != state->current_cpu) {
-		if (state->in_fiq)
-			return false;
-
-		if (atomic_inc_return(&state->unhandled_fiq_count) !=
-					MAX_UNHANDLED_FIQ_COUNT)
-			return false;
-
-		fiq_debugger_printf(&state->output,
-			"fiq_debugger: cpu %d not responding, "
-			"reverting to cpu %d\n", state->current_cpu,
-			this_cpu);
-
-		atomic_set(&state->unhandled_fiq_count, 0);
-		fiq_debugger_switch_cpu(state, this_cpu);
-		return false;
-	}
-
-	state->in_fiq = true;
-
-	while ((c = fiq_debugger_getc(state)) != FIQ_DEBUGGER_NO_CHAR) {
-		count++;
-		if (!state->debug_enable) {
-			if ((c == 13) || (c == 10)) {
-				state->debug_enable = true;
-				state->debug_count = 0;
-				fiq_debugger_prompt(state);
-			}
-		} else if (c == FIQ_DEBUGGER_BREAK) {
-			state->console_enable = false;
-			fiq_debugger_puts(state, "fiq debugger mode\n");
-			state->debug_count = 0;
-			fiq_debugger_prompt(state);
-#ifdef CONFIG_FIQ_DEBUGGER_CONSOLE
-		} else if (state->console_enable && state->tty_rbuf) {
-			fiq_debugger_ringbuf_push(state->tty_rbuf, c);
-			signal_helper = true;
-#endif
-		} else if ((c >= ' ') && (c < 127)) {
-			if (state->debug_count < (DEBUG_MAX - 1)) {
-				state->debug_buf[state->debug_count++] = c;
-				fiq_debugger_putc(state, c);
-			}
-		} else if ((c == 8) || (c == 127)) {
-			if (state->debug_count > 0) {
-				state->debug_count--;
-				fiq_debugger_putc(state, 8);
-				fiq_debugger_putc(state, ' ');
-				fiq_debugger_putc(state, 8);
-			}
-		} else if ((c == 13) || (c == 10)) {
-			if (c == '\r' || (c == '\n' && last_c != '\r')) {
-				fiq_debugger_putc(state, '\r');
-				fiq_debugger_putc(state, '\n');
-			}
-			if (state->debug_count) {
-				state->debug_buf[state->debug_count] = 0;
-				state->debug_count = 0;
-				signal_helper |=
-					fiq_debugger_fiq_exec(state,
-							state->debug_buf,
-							regs, svc_sp);
-			} else {
-				fiq_debugger_prompt(state);
-			}
-		}
-		last_c = c;
-	}
-	if (!state->console_enable)
-		fiq_debugger_uart_flush(state);
-	if (state->pdata->fiq_ack)
-		state->pdata->fiq_ack(state->pdev, state->fiq);
-
-	/* poke sleep timer if necessary */
-	if (state->debug_enable && !state->no_sleep)
-		signal_helper = true;
-
-	atomic_set(&state->unhandled_fiq_count, 0);
-	state->in_fiq = false;
-
-	return signal_helper;
-}
-
-#ifdef CONFIG_FIQ_GLUE
-static void fiq_debugger_fiq(struct fiq_glue_handler *h,
-		const struct pt_regs *regs, void *svc_sp)
-{
-	struct fiq_debugger_state *state =
-		container_of(h, struct fiq_debugger_state, handler);
-	unsigned int this_cpu = THREAD_INFO(svc_sp)->cpu;
-	bool need_irq;
-
-	need_irq = fiq_debugger_handle_uart_interrupt(state, this_cpu, regs,
-			svc_sp);
-	if (need_irq)
-		fiq_debugger_force_irq(state);
-}
-#endif
-
-/*
- * When not using FIQs, we only use this single interrupt as an entry point.
- * This just effectively takes over the UART interrupt and does all the work
- * in this context.
- */
-static irqreturn_t fiq_debugger_uart_irq(int irq, void *dev)
-{
-	struct fiq_debugger_state *state = dev;
-	bool not_done;
-
-	fiq_debugger_handle_wakeup(state);
-
-	/* handle the debugger irq in regular context */
-	not_done = fiq_debugger_handle_uart_interrupt(state, smp_processor_id(),
-					      get_irq_regs(),
-					      current_thread_info());
-	if (not_done)
-		fiq_debugger_handle_irq_context(state);
-
-	return IRQ_HANDLED;
-}
-
-/*
- * If FIQs are used, not everything can happen in fiq context.
- * FIQ handler does what it can and then signals this interrupt to finish the
- * job in irq context.
- */
-static irqreturn_t fiq_debugger_signal_irq(int irq, void *dev)
-{
-	struct fiq_debugger_state *state = dev;
-
-	if (state->pdata->force_irq_ack)
-		state->pdata->force_irq_ack(state->pdev, state->signal_irq);
-
-	fiq_debugger_handle_irq_context(state);
-
-	return IRQ_HANDLED;
-}
-
-#ifdef CONFIG_FIQ_GLUE
-static void fiq_debugger_resume(struct fiq_glue_handler *h)
-{
-	struct fiq_debugger_state *state =
-		container_of(h, struct fiq_debugger_state, handler);
-	if (state->pdata->uart_resume)
-		state->pdata->uart_resume(state->pdev);
-}
-#endif
-
-#if defined(CONFIG_FIQ_DEBUGGER_CONSOLE)
-struct tty_driver *fiq_debugger_console_device(struct console *co, int *index)
-{
-	*index = co->index;
-	return fiq_tty_driver;
-}
-
-static void fiq_debugger_console_write(struct console *co,
-				const char *s, unsigned int count)
-{
-	struct fiq_debugger_state *state;
-	unsigned long flags;
-
-	state = container_of(co, struct fiq_debugger_state, console);
-
-	if (!state->console_enable && !state->syslog_dumping)
-		return;
-
-	fiq_debugger_uart_enable(state);
-	spin_lock_irqsave(&state->console_lock, flags);
-	while (count--) {
-		if (*s == '\n')
-			fiq_debugger_putc(state, '\r');
-		fiq_debugger_putc(state, *s++);
-	}
-	fiq_debugger_uart_flush(state);
-	spin_unlock_irqrestore(&state->console_lock, flags);
-	fiq_debugger_uart_disable(state);
-}
-
-static struct console fiq_debugger_console = {
-	.name = "ttyFIQ",
-	.device = fiq_debugger_console_device,
-	.write = fiq_debugger_console_write,
-	.flags = CON_PRINTBUFFER | CON_ANYTIME | CON_ENABLED,
-};
-
-int fiq_tty_open(struct tty_struct *tty, struct file *filp)
-{
-	int line = tty->index;
-	struct fiq_debugger_state **states = tty->driver->driver_state;
-	struct fiq_debugger_state *state = states[line];
-
-	return tty_port_open(&state->tty_port, tty, filp);
-}
-
-void fiq_tty_close(struct tty_struct *tty, struct file *filp)
-{
-	tty_port_close(tty->port, tty, filp);
-}
-
-int  fiq_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
-{
-	int i;
-	int line = tty->index;
-	struct fiq_debugger_state **states = tty->driver->driver_state;
-	struct fiq_debugger_state *state = states[line];
-
-	if (!state->console_enable)
-		return count;
-
-	fiq_debugger_uart_enable(state);
-	spin_lock_irq(&state->console_lock);
-	for (i = 0; i < count; i++)
-		fiq_debugger_putc(state, *buf++);
-	spin_unlock_irq(&state->console_lock);
-	fiq_debugger_uart_disable(state);
-
-	return count;
-}
-
-int  fiq_tty_write_room(struct tty_struct *tty)
-{
-	return 16;
-}
-
-#ifdef CONFIG_CONSOLE_POLL
-static int fiq_tty_poll_init(struct tty_driver *driver, int line, char *options)
-{
-	return 0;
-}
-
-static int fiq_tty_poll_get_char(struct tty_driver *driver, int line)
-{
-	struct fiq_debugger_state **states = driver->driver_state;
-	struct fiq_debugger_state *state = states[line];
-	int c = NO_POLL_CHAR;
-
-	fiq_debugger_uart_enable(state);
-	if (fiq_debugger_have_fiq(state)) {
-		int count = fiq_debugger_ringbuf_level(state->tty_rbuf);
-		if (count > 0) {
-			c = fiq_debugger_ringbuf_peek(state->tty_rbuf, 0);
-			fiq_debugger_ringbuf_consume(state->tty_rbuf, 1);
-		}
-	} else {
-		c = fiq_debugger_getc(state);
-		if (c == FIQ_DEBUGGER_NO_CHAR)
-			c = NO_POLL_CHAR;
-	}
-	fiq_debugger_uart_disable(state);
-
-	return c;
-}
-
-static void fiq_tty_poll_put_char(struct tty_driver *driver, int line, char ch)
-{
-	struct fiq_debugger_state **states = driver->driver_state;
-	struct fiq_debugger_state *state = states[line];
-	fiq_debugger_uart_enable(state);
-	fiq_debugger_putc(state, ch);
-	fiq_debugger_uart_disable(state);
-}
-#endif
-
-static const struct tty_port_operations fiq_tty_port_ops;
-
-static const struct tty_operations fiq_tty_driver_ops = {
-	.write = fiq_tty_write,
-	.write_room = fiq_tty_write_room,
-	.open = fiq_tty_open,
-	.close = fiq_tty_close,
-#ifdef CONFIG_CONSOLE_POLL
-	.poll_init = fiq_tty_poll_init,
-	.poll_get_char = fiq_tty_poll_get_char,
-	.poll_put_char = fiq_tty_poll_put_char,
-#endif
-};
-
-static int fiq_debugger_tty_init(void)
-{
-	int ret;
-	struct fiq_debugger_state **states = NULL;
-
-	states = kzalloc(sizeof(*states) * MAX_FIQ_DEBUGGER_PORTS, GFP_KERNEL);
-	if (!states) {
-		pr_err("Failed to allocate fiq debugger state structres\n");
-		return -ENOMEM;
-	}
-
-	fiq_tty_driver = alloc_tty_driver(MAX_FIQ_DEBUGGER_PORTS);
-	if (!fiq_tty_driver) {
-		pr_err("Failed to allocate fiq debugger tty\n");
-		ret = -ENOMEM;
-		goto err_free_state;
-	}
-
-	fiq_tty_driver->owner		= THIS_MODULE;
-	fiq_tty_driver->driver_name	= "fiq-debugger";
-	fiq_tty_driver->name		= "ttyFIQ";
-	fiq_tty_driver->type		= TTY_DRIVER_TYPE_SERIAL;
-	fiq_tty_driver->subtype		= SERIAL_TYPE_NORMAL;
-	fiq_tty_driver->init_termios	= tty_std_termios;
-	fiq_tty_driver->flags		= TTY_DRIVER_REAL_RAW |
-					  TTY_DRIVER_DYNAMIC_DEV;
-	fiq_tty_driver->driver_state	= states;
-
-	fiq_tty_driver->init_termios.c_cflag =
-					B115200 | CS8 | CREAD | HUPCL | CLOCAL;
-	fiq_tty_driver->init_termios.c_ispeed = 115200;
-	fiq_tty_driver->init_termios.c_ospeed = 115200;
-
-	tty_set_operations(fiq_tty_driver, &fiq_tty_driver_ops);
-
-	ret = tty_register_driver(fiq_tty_driver);
-	if (ret) {
-		pr_err("Failed to register fiq tty: %d\n", ret);
-		goto err_free_tty;
-	}
-
-	pr_info("Registered FIQ tty driver\n");
-	return 0;
-
-err_free_tty:
-	put_tty_driver(fiq_tty_driver);
-	fiq_tty_driver = NULL;
-err_free_state:
-	kfree(states);
-	return ret;
-}
-
-static int fiq_debugger_tty_init_one(struct fiq_debugger_state *state)
-{
-	int ret;
-	struct device *tty_dev;
-	struct fiq_debugger_state **states = fiq_tty_driver->driver_state;
-
-	states[state->pdev->id] = state;
-
-	state->tty_rbuf = fiq_debugger_ringbuf_alloc(1024);
-	if (!state->tty_rbuf) {
-		pr_err("Failed to allocate fiq debugger ringbuf\n");
-		ret = -ENOMEM;
-		goto err;
-	}
-
-	tty_port_init(&state->tty_port);
-	state->tty_port.ops = &fiq_tty_port_ops;
-
-	tty_dev = tty_port_register_device(&state->tty_port, fiq_tty_driver,
-					   state->pdev->id, &state->pdev->dev);
-	if (IS_ERR(tty_dev)) {
-		pr_err("Failed to register fiq debugger tty device\n");
-		ret = PTR_ERR(tty_dev);
-		goto err;
-	}
-
-	device_set_wakeup_capable(tty_dev, 1);
-
-	pr_info("Registered fiq debugger ttyFIQ%d\n", state->pdev->id);
-
-	return 0;
-
-err:
-	fiq_debugger_ringbuf_free(state->tty_rbuf);
-	state->tty_rbuf = NULL;
-	return ret;
-}
-#endif
-
-static int fiq_debugger_dev_suspend(struct device *dev)
-{
-	struct platform_device *pdev = to_platform_device(dev);
-	struct fiq_debugger_state *state = platform_get_drvdata(pdev);
-
-	if (state->pdata->uart_dev_suspend)
-		return state->pdata->uart_dev_suspend(pdev);
-	return 0;
-}
-
-static int fiq_debugger_dev_resume(struct device *dev)
-{
-	struct platform_device *pdev = to_platform_device(dev);
-	struct fiq_debugger_state *state = platform_get_drvdata(pdev);
-
-	if (state->pdata->uart_dev_resume)
-		return state->pdata->uart_dev_resume(pdev);
-	return 0;
-}
-
-static int fiq_debugger_probe(struct platform_device *pdev)
-{
-	int ret;
-	struct fiq_debugger_pdata *pdata = dev_get_platdata(&pdev->dev);
-	struct fiq_debugger_state *state;
-	int fiq;
-	int uart_irq;
-
-	if (pdev->id >= MAX_FIQ_DEBUGGER_PORTS)
-		return -EINVAL;
-
-	if (!pdata->uart_getc || !pdata->uart_putc)
-		return -EINVAL;
-	if ((pdata->uart_enable && !pdata->uart_disable) ||
-	    (!pdata->uart_enable && pdata->uart_disable))
-		return -EINVAL;
-
-	fiq = platform_get_irq_byname(pdev, "fiq");
-	uart_irq = platform_get_irq_byname(pdev, "uart_irq");
-
-	/* uart_irq mode and fiq mode are mutually exclusive, but one of them
-	 * is required */
-	if ((uart_irq < 0 && fiq < 0) || (uart_irq >= 0 && fiq >= 0))
-		return -EINVAL;
-	if (fiq >= 0 && !pdata->fiq_enable)
-		return -EINVAL;
-
-	state = kzalloc(sizeof(*state), GFP_KERNEL);
-	state->output.printf = fiq_debugger_printf;
-	setup_timer(&state->sleep_timer, fiq_debugger_sleep_timer_expired,
-		    (unsigned long)state);
-	state->pdata = pdata;
-	state->pdev = pdev;
-	state->no_sleep = initial_no_sleep;
-	state->debug_enable = initial_debug_enable;
-	state->console_enable = initial_console_enable;
-
-	state->fiq = fiq;
-	state->uart_irq = uart_irq;
-	state->signal_irq = platform_get_irq_byname(pdev, "signal");
-	state->wakeup_irq = platform_get_irq_byname(pdev, "wakeup");
-
-	INIT_WORK(&state->work, fiq_debugger_work);
-	spin_lock_init(&state->work_lock);
-
-	platform_set_drvdata(pdev, state);
-
-	spin_lock_init(&state->sleep_timer_lock);
-
-	if (state->wakeup_irq < 0 && fiq_debugger_have_fiq(state))
-		state->no_sleep = true;
-	state->ignore_next_wakeup_irq = !state->no_sleep;
-
-	wakeup_source_init(&state->debugger_wake_src, "serial-debug");
-
-	state->clk = clk_get(&pdev->dev, NULL);
-	if (IS_ERR(state->clk))
-		state->clk = NULL;
-
-	/* do not call pdata->uart_enable here since uart_init may still
-	 * need to do some initialization before uart_enable can work.
-	 * So, only try to manage the clock during init.
-	 */
-	if (state->clk)
-		clk_enable(state->clk);
-
-	if (pdata->uart_init) {
-		ret = pdata->uart_init(pdev);
-		if (ret)
-			goto err_uart_init;
-	}
-
-	fiq_debugger_printf_nfiq(state,
-				"<hit enter %sto activate fiq debugger>\n",
-				state->no_sleep ? "" : "twice ");
-
-#ifdef CONFIG_FIQ_GLUE
-	if (fiq_debugger_have_fiq(state)) {
-		state->handler.fiq = fiq_debugger_fiq;
-		state->handler.resume = fiq_debugger_resume;
-		ret = fiq_glue_register_handler(&state->handler);
-		if (ret) {
-			pr_err("%s: could not install fiq handler\n", __func__);
-			goto err_register_irq;
-		}
-
-		pdata->fiq_enable(pdev, state->fiq, 1);
-	} else
-#endif
-	{
-		ret = request_irq(state->uart_irq, fiq_debugger_uart_irq,
-				  IRQF_NO_SUSPEND, "debug", state);
-		if (ret) {
-			pr_err("%s: could not install irq handler\n", __func__);
-			goto err_register_irq;
-		}
-
-		/* for irq-only mode, we want this irq to wake us up, if it
-		 * can.
-		 */
-		enable_irq_wake(state->uart_irq);
-	}
-
-	if (state->clk)
-		clk_disable(state->clk);
-
-	if (state->signal_irq >= 0) {
-		ret = request_irq(state->signal_irq, fiq_debugger_signal_irq,
-			  IRQF_TRIGGER_RISING, "debug-signal", state);
-		if (ret)
-			pr_err("serial_debugger: could not install signal_irq");
-	}
-
-	if (state->wakeup_irq >= 0) {
-		ret = request_irq(state->wakeup_irq,
-				  fiq_debugger_wakeup_irq_handler,
-				  IRQF_TRIGGER_FALLING,
-				  "debug-wakeup", state);
-		if (ret) {
-			pr_err("serial_debugger: "
-				"could not install wakeup irq\n");
-			state->wakeup_irq = -1;
-		} else {
-			ret = enable_irq_wake(state->wakeup_irq);
-			if (ret) {
-				pr_err("serial_debugger: "
-					"could not enable wakeup\n");
-				state->wakeup_irq_no_set_wake = true;
-			}
-		}
-	}
-	if (state->no_sleep)
-		fiq_debugger_handle_wakeup(state);
-
-#if defined(CONFIG_FIQ_DEBUGGER_CONSOLE)
-	spin_lock_init(&state->console_lock);
-	state->console = fiq_debugger_console;
-	state->console.index = pdev->id;
-	if (!console_set_on_cmdline)
-		add_preferred_console(state->console.name,
-			state->console.index, NULL);
-	register_console(&state->console);
-	fiq_debugger_tty_init_one(state);
-#endif
-	return 0;
-
-err_register_irq:
-	if (pdata->uart_free)
-		pdata->uart_free(pdev);
-err_uart_init:
-	if (state->clk)
-		clk_disable(state->clk);
-	if (state->clk)
-		clk_put(state->clk);
-	wakeup_source_trash(&state->debugger_wake_src);
-	platform_set_drvdata(pdev, NULL);
-	kfree(state);
-	return ret;
-}
-
-static const struct dev_pm_ops fiq_debugger_dev_pm_ops = {
-	.suspend	= fiq_debugger_dev_suspend,
-	.resume		= fiq_debugger_dev_resume,
-};
-
-static struct platform_driver fiq_debugger_driver = {
-	.probe	= fiq_debugger_probe,
-	.driver	= {
-		.name	= "fiq_debugger",
-		.pm	= &fiq_debugger_dev_pm_ops,
-	},
-};
-
-#if defined(CONFIG_FIQ_DEBUGGER_UART_OVERLAY)
-int fiq_debugger_uart_overlay(void)
-{
-	struct device_node *onp = of_find_node_by_path("/uart_overlay@0");
-	int ret;
-
-	if (!onp) {
-		pr_err("serial_debugger: uart overlay not found\n");
-		return -ENODEV;
-	}
-
-	ret = of_overlay_create(onp);
-	if (ret < 0) {
-		pr_err("serial_debugger: fail to create overlay: %d\n", ret);
-		of_node_put(onp);
-		return ret;
-	}
-
-	pr_info("serial_debugger: uart overlay applied\n");
-	return 0;
-}
-#endif
-
-static int __init fiq_debugger_init(void)
-{
-	if (fiq_debugger_disable) {
-		pr_err("serial_debugger: disabled\n");
-		return -ENODEV;
-	}
-#if defined(CONFIG_FIQ_DEBUGGER_CONSOLE)
-	fiq_debugger_tty_init();
-#endif
-#if defined(CONFIG_FIQ_DEBUGGER_UART_OVERLAY)
-	fiq_debugger_uart_overlay();
-#endif
-	return platform_driver_register(&fiq_debugger_driver);
-}
-
-postcore_initcall(fiq_debugger_init);
diff --git a/drivers/staging/android/fiq_debugger/fiq_debugger.h b/drivers/staging/android/fiq_debugger/fiq_debugger.h
deleted file mode 100644
index c9ec4f8..0000000
--- a/drivers/staging/android/fiq_debugger/fiq_debugger.h
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * drivers/staging/android/fiq_debugger/fiq_debugger.h
- *
- * Copyright (C) 2010 Google, Inc.
- * Author: Colin Cross <ccross@android.com>
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#ifndef _ARCH_ARM_MACH_TEGRA_FIQ_DEBUGGER_H_
-#define _ARCH_ARM_MACH_TEGRA_FIQ_DEBUGGER_H_
-
-#include <linux/serial_core.h>
-
-#define FIQ_DEBUGGER_NO_CHAR NO_POLL_CHAR
-#define FIQ_DEBUGGER_BREAK 0x00ff0100
-
-#define FIQ_DEBUGGER_FIQ_IRQ_NAME	"fiq"
-#define FIQ_DEBUGGER_SIGNAL_IRQ_NAME	"signal"
-#define FIQ_DEBUGGER_WAKEUP_IRQ_NAME	"wakeup"
-
-/**
- * struct fiq_debugger_pdata - fiq debugger platform data
- * @uart_resume:	used to restore uart state right before enabling
- *			the fiq.
- * @uart_enable:	Do the work necessary to communicate with the uart
- *			hw (enable clocks, etc.). This must be ref-counted.
- * @uart_disable:	Do the work necessary to disable the uart hw
- *			(disable clocks, etc.). This must be ref-counted.
- * @uart_dev_suspend:	called during PM suspend, generally not needed
- *			for real fiq mode debugger.
- * @uart_dev_resume:	called during PM resume, generally not needed
- *			for real fiq mode debugger.
- */
-struct fiq_debugger_pdata {
-	int (*uart_init)(struct platform_device *pdev);
-	void (*uart_free)(struct platform_device *pdev);
-	int (*uart_resume)(struct platform_device *pdev);
-	int (*uart_getc)(struct platform_device *pdev);
-	void (*uart_putc)(struct platform_device *pdev, unsigned int c);
-	void (*uart_flush)(struct platform_device *pdev);
-	void (*uart_enable)(struct platform_device *pdev);
-	void (*uart_disable)(struct platform_device *pdev);
-
-	int (*uart_dev_suspend)(struct platform_device *pdev);
-	int (*uart_dev_resume)(struct platform_device *pdev);
-
-	void (*fiq_enable)(struct platform_device *pdev, unsigned int fiq,
-								bool enable);
-	void (*fiq_ack)(struct platform_device *pdev, unsigned int fiq);
-
-	void (*force_irq)(struct platform_device *pdev, unsigned int irq);
-	void (*force_irq_ack)(struct platform_device *pdev, unsigned int irq);
-};
-
-#endif
diff --git a/drivers/staging/android/fiq_debugger/fiq_debugger_arm.c b/drivers/staging/android/fiq_debugger/fiq_debugger_arm.c
deleted file mode 100644
index 8b3e013..0000000
--- a/drivers/staging/android/fiq_debugger/fiq_debugger_arm.c
+++ /dev/null
@@ -1,240 +0,0 @@
-/*
- * Copyright (C) 2014 Google, Inc.
- * Author: Colin Cross <ccross@android.com>
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#include <linux/ptrace.h>
-#include <linux/uaccess.h>
-
-#include <asm/stacktrace.h>
-
-#include "fiq_debugger_priv.h"
-
-static char *mode_name(unsigned cpsr)
-{
-	switch (cpsr & MODE_MASK) {
-	case USR_MODE: return "USR";
-	case FIQ_MODE: return "FIQ";
-	case IRQ_MODE: return "IRQ";
-	case SVC_MODE: return "SVC";
-	case ABT_MODE: return "ABT";
-	case UND_MODE: return "UND";
-	case SYSTEM_MODE: return "SYS";
-	default: return "???";
-	}
-}
-
-void fiq_debugger_dump_pc(struct fiq_debugger_output *output,
-		const struct pt_regs *regs)
-{
-	output->printf(output, " pc %08x cpsr %08x mode %s\n",
-		regs->ARM_pc, regs->ARM_cpsr, mode_name(regs->ARM_cpsr));
-}
-
-void fiq_debugger_dump_regs(struct fiq_debugger_output *output,
-		const struct pt_regs *regs)
-{
-	output->printf(output,
-			" r0 %08x  r1 %08x  r2 %08x  r3 %08x\n",
-			regs->ARM_r0, regs->ARM_r1, regs->ARM_r2, regs->ARM_r3);
-	output->printf(output,
-			" r4 %08x  r5 %08x  r6 %08x  r7 %08x\n",
-			regs->ARM_r4, regs->ARM_r5, regs->ARM_r6, regs->ARM_r7);
-	output->printf(output,
-			" r8 %08x  r9 %08x r10 %08x r11 %08x  mode %s\n",
-			regs->ARM_r8, regs->ARM_r9, regs->ARM_r10, regs->ARM_fp,
-			mode_name(regs->ARM_cpsr));
-	output->printf(output,
-			" ip %08x  sp %08x  lr %08x  pc %08x cpsr %08x\n",
-			regs->ARM_ip, regs->ARM_sp, regs->ARM_lr, regs->ARM_pc,
-			regs->ARM_cpsr);
-}
-
-struct mode_regs {
-	unsigned long sp_svc;
-	unsigned long lr_svc;
-	unsigned long spsr_svc;
-
-	unsigned long sp_abt;
-	unsigned long lr_abt;
-	unsigned long spsr_abt;
-
-	unsigned long sp_und;
-	unsigned long lr_und;
-	unsigned long spsr_und;
-
-	unsigned long sp_irq;
-	unsigned long lr_irq;
-	unsigned long spsr_irq;
-
-	unsigned long r8_fiq;
-	unsigned long r9_fiq;
-	unsigned long r10_fiq;
-	unsigned long r11_fiq;
-	unsigned long r12_fiq;
-	unsigned long sp_fiq;
-	unsigned long lr_fiq;
-	unsigned long spsr_fiq;
-};
-
-static void __naked get_mode_regs(struct mode_regs *regs)
-{
-	asm volatile (
-	"mrs	r1, cpsr\n"
-	"msr	cpsr_c, #0xd3 @(SVC_MODE | PSR_I_BIT | PSR_F_BIT)\n"
-	"stmia	r0!, {r13 - r14}\n"
-	"mrs	r2, spsr\n"
-	"msr	cpsr_c, #0xd7 @(ABT_MODE | PSR_I_BIT | PSR_F_BIT)\n"
-	"stmia	r0!, {r2, r13 - r14}\n"
-	"mrs	r2, spsr\n"
-	"msr	cpsr_c, #0xdb @(UND_MODE | PSR_I_BIT | PSR_F_BIT)\n"
-	"stmia	r0!, {r2, r13 - r14}\n"
-	"mrs	r2, spsr\n"
-	"msr	cpsr_c, #0xd2 @(IRQ_MODE | PSR_I_BIT | PSR_F_BIT)\n"
-	"stmia	r0!, {r2, r13 - r14}\n"
-	"mrs	r2, spsr\n"
-	"msr	cpsr_c, #0xd1 @(FIQ_MODE | PSR_I_BIT | PSR_F_BIT)\n"
-	"stmia	r0!, {r2, r8 - r14}\n"
-	"mrs	r2, spsr\n"
-	"stmia	r0!, {r2}\n"
-	"msr	cpsr_c, r1\n"
-	"bx	lr\n");
-}
-
-
-void fiq_debugger_dump_allregs(struct fiq_debugger_output *output,
-		const struct pt_regs *regs)
-{
-	struct mode_regs mode_regs;
-	unsigned long mode = regs->ARM_cpsr & MODE_MASK;
-
-	fiq_debugger_dump_regs(output, regs);
-	get_mode_regs(&mode_regs);
-
-	output->printf(output,
-			"%csvc: sp %08x  lr %08x  spsr %08x\n",
-			mode == SVC_MODE ? '*' : ' ',
-			mode_regs.sp_svc, mode_regs.lr_svc, mode_regs.spsr_svc);
-	output->printf(output,
-			"%cabt: sp %08x  lr %08x  spsr %08x\n",
-			mode == ABT_MODE ? '*' : ' ',
-			mode_regs.sp_abt, mode_regs.lr_abt, mode_regs.spsr_abt);
-	output->printf(output,
-			"%cund: sp %08x  lr %08x  spsr %08x\n",
-			mode == UND_MODE ? '*' : ' ',
-			mode_regs.sp_und, mode_regs.lr_und, mode_regs.spsr_und);
-	output->printf(output,
-			"%cirq: sp %08x  lr %08x  spsr %08x\n",
-			mode == IRQ_MODE ? '*' : ' ',
-			mode_regs.sp_irq, mode_regs.lr_irq, mode_regs.spsr_irq);
-	output->printf(output,
-			"%cfiq: r8 %08x  r9 %08x  r10 %08x  r11 %08x  r12 %08x\n",
-			mode == FIQ_MODE ? '*' : ' ',
-			mode_regs.r8_fiq, mode_regs.r9_fiq, mode_regs.r10_fiq,
-			mode_regs.r11_fiq, mode_regs.r12_fiq);
-	output->printf(output,
-			" fiq: sp %08x  lr %08x  spsr %08x\n",
-			mode_regs.sp_fiq, mode_regs.lr_fiq, mode_regs.spsr_fiq);
-}
-
-struct stacktrace_state {
-	struct fiq_debugger_output *output;
-	unsigned int depth;
-};
-
-static int report_trace(struct stackframe *frame, void *d)
-{
-	struct stacktrace_state *sts = d;
-
-	if (sts->depth) {
-		sts->output->printf(sts->output,
-			"  pc: %p (%pF), lr %p (%pF), sp %p, fp %p\n",
-			frame->pc, frame->pc, frame->lr, frame->lr,
-			frame->sp, frame->fp);
-		sts->depth--;
-		return 0;
-	}
-	sts->output->printf(sts->output, "  ...\n");
-
-	return sts->depth == 0;
-}
-
-struct frame_tail {
-	struct frame_tail *fp;
-	unsigned long sp;
-	unsigned long lr;
-} __attribute__((packed));
-
-static struct frame_tail *user_backtrace(struct fiq_debugger_output *output,
-					struct frame_tail *tail)
-{
-	struct frame_tail buftail[2];
-
-	/* Also check accessibility of one struct frame_tail beyond */
-	if (!access_ok(VERIFY_READ, tail, sizeof(buftail))) {
-		output->printf(output, "  invalid frame pointer %p\n",
-				tail);
-		return NULL;
-	}
-	if (__copy_from_user_inatomic(buftail, tail, sizeof(buftail))) {
-		output->printf(output,
-			"  failed to copy frame pointer %p\n", tail);
-		return NULL;
-	}
-
-	output->printf(output, "  %p\n", buftail[0].lr);
-
-	/* frame pointers should strictly progress back up the stack
-	 * (towards higher addresses) */
-	if (tail >= buftail[0].fp)
-		return NULL;
-
-	return buftail[0].fp-1;
-}
-
-void fiq_debugger_dump_stacktrace(struct fiq_debugger_output *output,
-		const struct pt_regs *regs, unsigned int depth, void *ssp)
-{
-	struct frame_tail *tail;
-	struct thread_info *real_thread_info = THREAD_INFO(ssp);
-	struct stacktrace_state sts;
-
-	sts.depth = depth;
-	sts.output = output;
-	*current_thread_info() = *real_thread_info;
-
-	if (!current)
-		output->printf(output, "current NULL\n");
-	else
-		output->printf(output, "pid: %d  comm: %s\n",
-			current->pid, current->comm);
-	fiq_debugger_dump_regs(output, regs);
-
-	if (!user_mode(regs)) {
-		struct stackframe frame;
-		frame.fp = regs->ARM_fp;
-		frame.sp = regs->ARM_sp;
-		frame.lr = regs->ARM_lr;
-		frame.pc = regs->ARM_pc;
-		output->printf(output,
-			"  pc: %p (%pF), lr %p (%pF), sp %p, fp %p\n",
-			regs->ARM_pc, regs->ARM_pc, regs->ARM_lr, regs->ARM_lr,
-			regs->ARM_sp, regs->ARM_fp);
-		walk_stackframe(&frame, report_trace, &sts);
-		return;
-	}
-
-	tail = ((struct frame_tail *) regs->ARM_fp) - 1;
-	while (depth-- && tail && !((unsigned long) tail & 3))
-		tail = user_backtrace(output, tail);
-}
diff --git a/drivers/staging/android/fiq_debugger/fiq_debugger_arm64.c b/drivers/staging/android/fiq_debugger/fiq_debugger_arm64.c
deleted file mode 100644
index 97246bc..0000000
--- a/drivers/staging/android/fiq_debugger/fiq_debugger_arm64.c
+++ /dev/null
@@ -1,202 +0,0 @@
-/*
- * Copyright (C) 2014 Google, Inc.
- * Author: Colin Cross <ccross@android.com>
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#include <linux/ptrace.h>
-#include <asm/stacktrace.h>
-
-#include "fiq_debugger_priv.h"
-
-static char *mode_name(const struct pt_regs *regs)
-{
-	if (compat_user_mode(regs)) {
-		return "USR";
-	} else {
-		switch (processor_mode(regs)) {
-		case PSR_MODE_EL0t: return "EL0t";
-		case PSR_MODE_EL1t: return "EL1t";
-		case PSR_MODE_EL1h: return "EL1h";
-		case PSR_MODE_EL2t: return "EL2t";
-		case PSR_MODE_EL2h: return "EL2h";
-		default: return "???";
-		}
-	}
-}
-
-void fiq_debugger_dump_pc(struct fiq_debugger_output *output,
-		const struct pt_regs *regs)
-{
-	output->printf(output, " pc %016lx cpsr %08lx mode %s\n",
-		regs->pc, regs->pstate, mode_name(regs));
-}
-
-void fiq_debugger_dump_regs_aarch32(struct fiq_debugger_output *output,
-		const struct pt_regs *regs)
-{
-	output->printf(output, " r0 %08x  r1 %08x  r2 %08x  r3 %08x\n",
-			regs->compat_usr(0), regs->compat_usr(1),
-			regs->compat_usr(2), regs->compat_usr(3));
-	output->printf(output, " r4 %08x  r5 %08x  r6 %08x  r7 %08x\n",
-			regs->compat_usr(4), regs->compat_usr(5),
-			regs->compat_usr(6), regs->compat_usr(7));
-	output->printf(output, " r8 %08x  r9 %08x r10 %08x r11 %08x\n",
-			regs->compat_usr(8), regs->compat_usr(9),
-			regs->compat_usr(10), regs->compat_usr(11));
-	output->printf(output, " ip %08x  sp %08x  lr %08x  pc %08x\n",
-			regs->compat_usr(12), regs->compat_sp,
-			regs->compat_lr, regs->pc);
-	output->printf(output, " cpsr %08x (%s)\n",
-			regs->pstate, mode_name(regs));
-}
-
-void fiq_debugger_dump_regs_aarch64(struct fiq_debugger_output *output,
-		const struct pt_regs *regs)
-{
-
-	output->printf(output, "  x0 %016lx   x1 %016lx\n",
-			regs->regs[0], regs->regs[1]);
-	output->printf(output, "  x2 %016lx   x3 %016lx\n",
-			regs->regs[2], regs->regs[3]);
-	output->printf(output, "  x4 %016lx   x5 %016lx\n",
-			regs->regs[4], regs->regs[5]);
-	output->printf(output, "  x6 %016lx   x7 %016lx\n",
-			regs->regs[6], regs->regs[7]);
-	output->printf(output, "  x8 %016lx   x9 %016lx\n",
-			regs->regs[8], regs->regs[9]);
-	output->printf(output, " x10 %016lx  x11 %016lx\n",
-			regs->regs[10], regs->regs[11]);
-	output->printf(output, " x12 %016lx  x13 %016lx\n",
-			regs->regs[12], regs->regs[13]);
-	output->printf(output, " x14 %016lx  x15 %016lx\n",
-			regs->regs[14], regs->regs[15]);
-	output->printf(output, " x16 %016lx  x17 %016lx\n",
-			regs->regs[16], regs->regs[17]);
-	output->printf(output, " x18 %016lx  x19 %016lx\n",
-			regs->regs[18], regs->regs[19]);
-	output->printf(output, " x20 %016lx  x21 %016lx\n",
-			regs->regs[20], regs->regs[21]);
-	output->printf(output, " x22 %016lx  x23 %016lx\n",
-			regs->regs[22], regs->regs[23]);
-	output->printf(output, " x24 %016lx  x25 %016lx\n",
-			regs->regs[24], regs->regs[25]);
-	output->printf(output, " x26 %016lx  x27 %016lx\n",
-			regs->regs[26], regs->regs[27]);
-	output->printf(output, " x28 %016lx  x29 %016lx\n",
-			regs->regs[28], regs->regs[29]);
-	output->printf(output, " x30 %016lx   sp %016lx\n",
-			regs->regs[30], regs->sp);
-	output->printf(output, "  pc %016lx cpsr %08x (%s)\n",
-			regs->pc, regs->pstate, mode_name(regs));
-}
-
-void fiq_debugger_dump_regs(struct fiq_debugger_output *output,
-		const struct pt_regs *regs)
-{
-	if (compat_user_mode(regs))
-		fiq_debugger_dump_regs_aarch32(output, regs);
-	else
-		fiq_debugger_dump_regs_aarch64(output, regs);
-}
-
-#define READ_SPECIAL_REG(x) ({ \
-	u64 val; \
-	asm volatile ("mrs %0, " # x : "=r"(val)); \
-	val; \
-})
-
-void fiq_debugger_dump_allregs(struct fiq_debugger_output *output,
-		const struct pt_regs *regs)
-{
-	u32 pstate = READ_SPECIAL_REG(CurrentEl);
-	bool in_el2 = (pstate & PSR_MODE_MASK) >= PSR_MODE_EL2t;
-
-	fiq_debugger_dump_regs(output, regs);
-
-	output->printf(output, " sp_el0   %016lx\n",
-			READ_SPECIAL_REG(sp_el0));
-
-	if (in_el2)
-		output->printf(output, " sp_el1   %016lx\n",
-				READ_SPECIAL_REG(sp_el1));
-
-	output->printf(output, " elr_el1  %016lx\n",
-			READ_SPECIAL_REG(elr_el1));
-
-	output->printf(output, " spsr_el1 %08lx\n",
-			READ_SPECIAL_REG(spsr_el1));
-
-	if (in_el2) {
-		output->printf(output, " spsr_irq %08lx\n",
-				READ_SPECIAL_REG(spsr_irq));
-		output->printf(output, " spsr_abt %08lx\n",
-				READ_SPECIAL_REG(spsr_abt));
-		output->printf(output, " spsr_und %08lx\n",
-				READ_SPECIAL_REG(spsr_und));
-		output->printf(output, " spsr_fiq %08lx\n",
-				READ_SPECIAL_REG(spsr_fiq));
-		output->printf(output, " spsr_el2 %08lx\n",
-				READ_SPECIAL_REG(elr_el2));
-		output->printf(output, " spsr_el2 %08lx\n",
-				READ_SPECIAL_REG(spsr_el2));
-	}
-}
-
-struct stacktrace_state {
-	struct fiq_debugger_output *output;
-	unsigned int depth;
-};
-
-static int report_trace(struct stackframe *frame, void *d)
-{
-	struct stacktrace_state *sts = d;
-
-	if (sts->depth) {
-		sts->output->printf(sts->output, "%pF:\n", frame->pc);
-		sts->output->printf(sts->output,
-				"  pc %016lx   sp %016lx   fp %016lx\n",
-				frame->pc, frame->sp, frame->fp);
-		sts->depth--;
-		return 0;
-	}
-	sts->output->printf(sts->output, "  ...\n");
-
-	return sts->depth == 0;
-}
-
-void fiq_debugger_dump_stacktrace(struct fiq_debugger_output *output,
-		const struct pt_regs *regs, unsigned int depth, void *ssp)
-{
-	struct thread_info *real_thread_info = THREAD_INFO(ssp);
-	struct stacktrace_state sts;
-
-	sts.depth = depth;
-	sts.output = output;
-	*current_thread_info() = *real_thread_info;
-
-	if (!current)
-		output->printf(output, "current NULL\n");
-	else
-		output->printf(output, "pid: %d  comm: %s\n",
-			current->pid, current->comm);
-	fiq_debugger_dump_regs(output, regs);
-
-	if (!user_mode(regs)) {
-		struct stackframe frame;
-		frame.fp = regs->regs[29];
-		frame.sp = regs->sp;
-		frame.pc = regs->pc;
-		output->printf(output, "\n");
-		walk_stackframe(current, &frame, report_trace, &sts);
-	}
-}
diff --git a/drivers/staging/android/fiq_debugger/fiq_debugger_priv.h b/drivers/staging/android/fiq_debugger/fiq_debugger_priv.h
deleted file mode 100644
index d5d051f..0000000
--- a/drivers/staging/android/fiq_debugger/fiq_debugger_priv.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright (C) 2014 Google, Inc.
- * Author: Colin Cross <ccross@android.com>
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#ifndef _FIQ_DEBUGGER_PRIV_H_
-#define _FIQ_DEBUGGER_PRIV_H_
-
-#define THREAD_INFO(sp) ((struct thread_info *) \
-		((unsigned long)(sp) & ~(THREAD_SIZE - 1)))
-
-struct fiq_debugger_output {
-	void (*printf)(struct fiq_debugger_output *output, const char *fmt, ...);
-};
-
-struct pt_regs;
-
-void fiq_debugger_dump_pc(struct fiq_debugger_output *output,
-		const struct pt_regs *regs);
-void fiq_debugger_dump_regs(struct fiq_debugger_output *output,
-		const struct pt_regs *regs);
-void fiq_debugger_dump_allregs(struct fiq_debugger_output *output,
-		const struct pt_regs *regs);
-void fiq_debugger_dump_stacktrace(struct fiq_debugger_output *output,
-		const struct pt_regs *regs, unsigned int depth, void *ssp);
-
-#endif
diff --git a/drivers/staging/android/fiq_debugger/fiq_debugger_ringbuf.h b/drivers/staging/android/fiq_debugger/fiq_debugger_ringbuf.h
deleted file mode 100644
index 10c3c5d..0000000
--- a/drivers/staging/android/fiq_debugger/fiq_debugger_ringbuf.h
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * drivers/staging/android/fiq_debugger/fiq_debugger_ringbuf.h
- *
- * simple lockless ringbuffer
- *
- * Copyright (C) 2010 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/kernel.h>
-#include <linux/slab.h>
-
-struct fiq_debugger_ringbuf {
-	int len;
-	int head;
-	int tail;
-	u8 buf[];
-};
-
-
-static inline struct fiq_debugger_ringbuf *fiq_debugger_ringbuf_alloc(int len)
-{
-	struct fiq_debugger_ringbuf *rbuf;
-
-	rbuf = kzalloc(sizeof(*rbuf) + len, GFP_KERNEL);
-	if (rbuf == NULL)
-		return NULL;
-
-	rbuf->len = len;
-	rbuf->head = 0;
-	rbuf->tail = 0;
-	smp_mb();
-
-	return rbuf;
-}
-
-static inline void fiq_debugger_ringbuf_free(struct fiq_debugger_ringbuf *rbuf)
-{
-	kfree(rbuf);
-}
-
-static inline int fiq_debugger_ringbuf_level(struct fiq_debugger_ringbuf *rbuf)
-{
-	int level = rbuf->head - rbuf->tail;
-
-	if (level < 0)
-		level = rbuf->len + level;
-
-	return level;
-}
-
-static inline int fiq_debugger_ringbuf_room(struct fiq_debugger_ringbuf *rbuf)
-{
-	return rbuf->len - fiq_debugger_ringbuf_level(rbuf) - 1;
-}
-
-static inline u8
-fiq_debugger_ringbuf_peek(struct fiq_debugger_ringbuf *rbuf, int i)
-{
-	return rbuf->buf[(rbuf->tail + i) % rbuf->len];
-}
-
-static inline int
-fiq_debugger_ringbuf_consume(struct fiq_debugger_ringbuf *rbuf, int count)
-{
-	count = min(count, fiq_debugger_ringbuf_level(rbuf));
-
-	rbuf->tail = (rbuf->tail + count) % rbuf->len;
-	smp_mb();
-
-	return count;
-}
-
-static inline int
-fiq_debugger_ringbuf_push(struct fiq_debugger_ringbuf *rbuf, u8 datum)
-{
-	if (fiq_debugger_ringbuf_room(rbuf) == 0)
-		return 0;
-
-	rbuf->buf[rbuf->head] = datum;
-	smp_mb();
-	rbuf->head = (rbuf->head + 1) % rbuf->len;
-	smp_mb();
-
-	return 1;
-}
diff --git a/drivers/staging/android/fiq_debugger/fiq_watchdog.c b/drivers/staging/android/fiq_debugger/fiq_watchdog.c
deleted file mode 100644
index 194b541..0000000
--- a/drivers/staging/android/fiq_debugger/fiq_watchdog.c
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright (C) 2014 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#include <linux/kernel.h>
-#include <linux/spinlock.h>
-#include <linux/pstore_ram.h>
-
-#include "fiq_watchdog.h"
-#include "fiq_debugger_priv.h"
-
-static DEFINE_RAW_SPINLOCK(fiq_watchdog_lock);
-
-static void fiq_watchdog_printf(struct fiq_debugger_output *output,
-				const char *fmt, ...)
-{
-	char buf[256];
-	va_list ap;
-	int len;
-
-	va_start(ap, fmt);
-	len = vscnprintf(buf, sizeof(buf), fmt, ap);
-	va_end(ap);
-
-	ramoops_console_write_buf(buf, len);
-}
-
-struct fiq_debugger_output fiq_watchdog_output = {
-	.printf = fiq_watchdog_printf,
-};
-
-void fiq_watchdog_triggered(const struct pt_regs *regs, void *svc_sp)
-{
-	char msg[24];
-	int len;
-
-	raw_spin_lock(&fiq_watchdog_lock);
-
-	len = scnprintf(msg, sizeof(msg), "watchdog fiq cpu %d\n",
-			THREAD_INFO(svc_sp)->cpu);
-	ramoops_console_write_buf(msg, len);
-
-	fiq_debugger_dump_stacktrace(&fiq_watchdog_output, regs, 100, svc_sp);
-
-	raw_spin_unlock(&fiq_watchdog_lock);
-}
diff --git a/drivers/staging/android/fiq_debugger/fiq_watchdog.h b/drivers/staging/android/fiq_debugger/fiq_watchdog.h
deleted file mode 100644
index c6b507f..0000000
--- a/drivers/staging/android/fiq_debugger/fiq_watchdog.h
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright (C) 2014 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#ifndef _FIQ_WATCHDOG_H_
-#define _FIQ_WATCHDOG_H_
-
-void fiq_watchdog_triggered(const struct pt_regs *regs, void *svc_sp);
-
-#endif
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 0f98594..2fbc67c 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -709,12 +709,6 @@
 	struct ci_hdrc    *ci = container_of(gadget, struct ci_hdrc, gadget);
 	unsigned long flags;
 
-	spin_lock_irqsave(&ci->lock, flags);
-	ci->gadget.speed = USB_SPEED_UNKNOWN;
-	ci->remote_wakeup = 0;
-	ci->suspended = 0;
-	spin_unlock_irqrestore(&ci->lock, flags);
-
 	/* flush all endpoints */
 	gadget_for_each_ep(ep, gadget) {
 		usb_ep_fifo_flush(ep);
@@ -732,6 +726,12 @@
 		ci->status = NULL;
 	}
 
+	spin_lock_irqsave(&ci->lock, flags);
+	ci->gadget.speed = USB_SPEED_UNKNOWN;
+	ci->remote_wakeup = 0;
+	ci->suspended = 0;
+	spin_unlock_irqrestore(&ci->lock, flags);
+
 	return 0;
 }
 
@@ -1306,6 +1306,10 @@
 		return -EBUSY;
 
 	spin_lock_irqsave(hwep->lock, flags);
+	if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
+		spin_unlock_irqrestore(hwep->lock, flags);
+		return 0;
+	}
 
 	/* only internal SW should disable ctrl endpts */
 
@@ -1395,6 +1399,10 @@
 		return -EINVAL;
 
 	spin_lock_irqsave(hwep->lock, flags);
+	if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
+		spin_unlock_irqrestore(hwep->lock, flags);
+		return 0;
+	}
 	retval = _ep_queue(ep, req, gfp_flags);
 	spin_unlock_irqrestore(hwep->lock, flags);
 	return retval;
@@ -1418,8 +1426,8 @@
 		return -EINVAL;
 
 	spin_lock_irqsave(hwep->lock, flags);
-
-	hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
+	if (hwep->ci->gadget.speed != USB_SPEED_UNKNOWN)
+		hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
 
 	list_for_each_entry_safe(node, tmpnode, &hwreq->tds, td) {
 		dma_pool_free(hwep->td_pool, node->ptr, node->dma);
@@ -1490,6 +1498,10 @@
 	}
 
 	spin_lock_irqsave(hwep->lock, flags);
+	if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
+		spin_unlock_irqrestore(hwep->lock, flags);
+		return;
+	}
 
 	hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
 
@@ -1558,6 +1570,10 @@
 	int ret = 0;
 
 	spin_lock_irqsave(&ci->lock, flags);
+	if (ci->gadget.speed == USB_SPEED_UNKNOWN) {
+		spin_unlock_irqrestore(&ci->lock, flags);
+		return 0;
+	}
 	if (!ci->remote_wakeup) {
 		ret = -EOPNOTSUPP;
 		goto out;
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 9f00165..217a479 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -597,10 +597,20 @@
 {
 	struct wdm_device *desc = file->private_data;
 
-	wait_event(desc->wait, !test_bit(WDM_IN_USE, &desc->flags));
+	wait_event(desc->wait,
+			/*
+			 * needs both flags. We cannot do with one
+			 * because resetting it would cause a race
+			 * with write() yet we need to signal
+			 * a disconnect
+			 */
+			!test_bit(WDM_IN_USE, &desc->flags) ||
+			test_bit(WDM_DISCONNECTING, &desc->flags));
 
 	/* cannot dereference desc->intf if WDM_DISCONNECTING */
-	if (desc->werr < 0 && !test_bit(WDM_DISCONNECTING, &desc->flags))
+	if (test_bit(WDM_DISCONNECTING, &desc->flags))
+		return -ENODEV;
+	if (desc->werr < 0)
 		dev_err(&desc->intf->dev, "Error in flush path: %d\n",
 			desc->werr);
 
@@ -968,8 +978,6 @@
 	spin_lock_irqsave(&desc->iuspin, flags);
 	set_bit(WDM_DISCONNECTING, &desc->flags);
 	set_bit(WDM_READ, &desc->flags);
-	/* to terminate pending flushes */
-	clear_bit(WDM_IN_USE, &desc->flags);
 	spin_unlock_irqrestore(&desc->iuspin, flags);
 	wake_up_all(&desc->wait);
 	mutex_lock(&desc->rlock);
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
old mode 100644
new mode 100755
index 923d4bb..9e3cfae
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -2197,6 +2197,7 @@
 	 * disconnect callbacks?
 	 */
 	spin_lock_irqsave(&cdev->lock, flags);
+	cdev->suspended = 0;
 	if (cdev->config) {
 		if (gadget->is_chipidea && !cdev->suspended) {
 			spin_unlock_irqrestore(&cdev->lock, flags);
diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
index 66efa9a..7285302 100644
--- a/drivers/usb/host/fotg210-hcd.c
+++ b/drivers/usb/host/fotg210-hcd.c
@@ -1653,6 +1653,10 @@
 			/* see what we found out */
 			temp = check_reset_complete(fotg210, wIndex, status_reg,
 					fotg210_readl(fotg210, status_reg));
+
+			/* restart schedule */
+			fotg210->command |= CMD_RUN;
+			fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
 		}
 
 		if (!(temp & (PORT_RESUME|PORT_RESET))) {
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 216ddee..76b893f 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -417,8 +417,7 @@
  * other cases where the next software may expect clean state from the
  * "firmware".  this is bus-neutral, unlike shutdown() methods.
  */
-static void
-ohci_shutdown (struct usb_hcd *hcd)
+static void _ohci_shutdown(struct usb_hcd *hcd)
 {
 	struct ohci_hcd *ohci;
 
@@ -434,6 +433,16 @@
 	ohci->rh_state = OHCI_RH_HALTED;
 }
 
+static void ohci_shutdown(struct usb_hcd *hcd)
+{
+	struct ohci_hcd	*ohci = hcd_to_ohci(hcd);
+	unsigned long flags;
+
+	spin_lock_irqsave(&ohci->lock, flags);
+	_ohci_shutdown(hcd);
+	spin_unlock_irqrestore(&ohci->lock, flags);
+}
+
 /*-------------------------------------------------------------------------*
  * HC functions
  *-------------------------------------------------------------------------*/
@@ -752,7 +761,7 @@
  died:
 			usb_hc_died(ohci_to_hcd(ohci));
 			ohci_dump(ohci);
-			ohci_shutdown(ohci_to_hcd(ohci));
+			_ohci_shutdown(ohci_to_hcd(ohci));
 			goto done;
 		} else {
 			/* No write back because the done queue was empty */
diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
index 64ee815..89ec9f0 100644
--- a/drivers/usb/host/xhci-rcar.c
+++ b/drivers/usb/host/xhci-rcar.c
@@ -84,7 +84,7 @@
 	return of_device_is_compatible(node, "renesas,xhci-r8a7790") ||
 		of_device_is_compatible(node, "renesas,xhci-r8a7791") ||
 		of_device_is_compatible(node, "renesas,xhci-r8a7793") ||
-		of_device_is_compatible(node, "renensas,rcar-gen2-xhci");
+		of_device_is_compatible(node, "renesas,rcar-gen2-xhci");
 }
 
 static int xhci_rcar_is_gen3(struct device *dev)
diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
index fac3447..d955761 100644
--- a/drivers/usb/storage/realtek_cr.c
+++ b/drivers/usb/storage/realtek_cr.c
@@ -51,7 +51,7 @@
 
 static int auto_delink_en = 1;
 module_param(auto_delink_en, int, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(auto_delink_en, "enable auto delink");
+MODULE_PARM_DESC(auto_delink_en, "auto delink mode (0=firmware, 1=software [default])");
 
 #ifdef CONFIG_REALTEK_AUTOPM
 static int ss_en = 1;
@@ -1010,12 +1010,15 @@
 			goto INIT_FAIL;
 	}
 
-	if (CHECK_FW_VER(chip, 0x5888) || CHECK_FW_VER(chip, 0x5889) ||
-	    CHECK_FW_VER(chip, 0x5901))
-		SET_AUTO_DELINK(chip);
-	if (STATUS_LEN(chip) == 16) {
-		if (SUPPORT_AUTO_DELINK(chip))
+	if (CHECK_PID(chip, 0x0138) || CHECK_PID(chip, 0x0158) ||
+	    CHECK_PID(chip, 0x0159)) {
+		if (CHECK_FW_VER(chip, 0x5888) || CHECK_FW_VER(chip, 0x5889) ||
+				CHECK_FW_VER(chip, 0x5901))
 			SET_AUTO_DELINK(chip);
+		if (STATUS_LEN(chip) == 16) {
+			if (SUPPORT_AUTO_DELINK(chip))
+				SET_AUTO_DELINK(chip);
+		}
 	}
 #ifdef CONFIG_REALTEK_AUTOPM
 	if (ss_en)
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index c802aab..3ebf6307 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2119,7 +2119,7 @@
 		US_FL_IGNORE_RESIDUE ),
 
 /* Reported by Michael Büsch <m@bues.ch> */
-UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0116,
+UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0117,
 		"JMicron",
 		"USB to ATA/ATAPI Bridge",
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
index 4dddd82..3e2e2e6 100644
--- a/drivers/watchdog/bcm2835_wdt.c
+++ b/drivers/watchdog/bcm2835_wdt.c
@@ -240,6 +240,7 @@
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
 				__MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
+MODULE_ALIAS("platform:bcm2835-wdt");
 MODULE_AUTHOR("Lubomir Rintel <lkundrak@v3.sk>");
 MODULE_DESCRIPTION("Driver for Broadcom BCM2835 watchdog timer");
 MODULE_LICENSE("GPL");
diff --git a/fs/namei.c b/fs/namei.c
index 098287b..8369bd0 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -42,6 +42,9 @@
 #include "internal.h"
 #include "mount.h"
 
+#define CREATE_TRACE_POINTS
+#include <trace/events/namei.h>
+
 /* [Feb-1997 T. Schoebel-Theuer]
  * Fundamental changes in the pathname lookup mechanisms (namei)
  * were necessary because of omirr.  The reason is that omirr needs
@@ -789,6 +792,81 @@
 	return dentry->d_op->d_revalidate(dentry, flags);
 }
 
+#define INIT_PATH_SIZE 64
+
+static void success_walk_trace(struct nameidata *nd)
+{
+	struct path *pt = &nd->path;
+	struct inode *i = nd->inode;
+	char buf[INIT_PATH_SIZE], *try_buf;
+	int cur_path_size;
+	char *p;
+
+	/* When eBPF/ tracepoint is disabled, keep overhead low. */
+	if (!trace_inodepath_enabled())
+		return;
+
+	/* First try stack allocated buffer. */
+	try_buf = buf;
+	cur_path_size = INIT_PATH_SIZE;
+
+	while (cur_path_size <= PATH_MAX) {
+		/* Free previous heap allocation if we are now trying
+		 * a second or later heap allocation.
+		 */
+		if (try_buf != buf)
+			kfree(try_buf);
+
+		/* All but the first alloc are on the heap. */
+		if (cur_path_size != INIT_PATH_SIZE) {
+			try_buf = kmalloc(cur_path_size, GFP_KERNEL);
+			if (!try_buf) {
+				try_buf = buf;
+				sprintf(try_buf, "error:buf_alloc_failed");
+				break;
+			}
+		}
+
+		p = d_path(pt, try_buf, cur_path_size);
+
+		if (!IS_ERR(p)) {
+			char *end = mangle_path(try_buf, p, "\n");
+
+			if (end) {
+				try_buf[end - try_buf] = 0;
+				break;
+			} else {
+				/* On mangle errors, double path size
+				 * till PATH_MAX.
+				 */
+				cur_path_size = cur_path_size << 1;
+				continue;
+			}
+		}
+
+		if (PTR_ERR(p) == -ENAMETOOLONG) {
+			/* If d_path complains that name is too long,
+			 * then double path size till PATH_MAX.
+			 */
+			cur_path_size = cur_path_size << 1;
+			continue;
+		}
+
+		sprintf(try_buf, "error:d_path_failed_%lu",
+			-1 * PTR_ERR(p));
+		break;
+	}
+
+	if (cur_path_size > PATH_MAX)
+		sprintf(try_buf, "error:d_path_name_too_long");
+
+	trace_inodepath(i, try_buf);
+
+	if (try_buf != buf)
+		kfree(try_buf);
+	return;
+}
+
 /**
  * complete_walk - successful completion of path walk
  * @nd:  pointer nameidata
@@ -811,15 +889,21 @@
 			return -ECHILD;
 	}
 
-	if (likely(!(nd->flags & LOOKUP_JUMPED)))
+	if (likely(!(nd->flags & LOOKUP_JUMPED))) {
+		success_walk_trace(nd);
 		return 0;
+	}
 
-	if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE)))
+	if (likely(!(dentry->d_flags & DCACHE_OP_WEAK_REVALIDATE))) {
+		success_walk_trace(nd);
 		return 0;
+	}
 
 	status = dentry->d_op->d_weak_revalidate(dentry, nd->flags);
-	if (status > 0)
+	if (status > 0) {
+		success_walk_trace(nd);
 		return 0;
+	}
 
 	if (!status)
 		status = -ESTALE;
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 1452177..c719389 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -434,7 +434,8 @@
 
 extern struct nfs4_state_owner *nfs4_get_state_owner(struct nfs_server *, struct rpc_cred *, gfp_t);
 extern void nfs4_put_state_owner(struct nfs4_state_owner *);
-extern void nfs4_purge_state_owners(struct nfs_server *);
+extern void nfs4_purge_state_owners(struct nfs_server *, struct list_head *);
+extern void nfs4_free_state_owners(struct list_head *head);
 extern struct nfs4_state * nfs4_get_open_state(struct inode *, struct nfs4_state_owner *);
 extern void nfs4_put_open_state(struct nfs4_state *);
 extern void nfs4_close_state(struct nfs4_state *, fmode_t);
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 43f42cc..1ec6dd4 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -781,9 +781,12 @@
 
 static void nfs4_destroy_server(struct nfs_server *server)
 {
+	LIST_HEAD(freeme);
+
 	nfs_server_return_all_delegations(server);
 	unset_pnfs_layoutdriver(server);
-	nfs4_purge_state_owners(server);
+	nfs4_purge_state_owners(server, &freeme);
+	nfs4_free_state_owners(&freeme);
 }
 
 /*
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 6f474b0..4e63dae 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -611,24 +611,39 @@
 /**
  * nfs4_purge_state_owners - Release all cached state owners
  * @server: nfs_server with cached state owners to release
+ * @head: resulting list of state owners
  *
  * Called at umount time.  Remaining state owners will be on
  * the LRU with ref count of zero.
+ * Note that the state owners are not freed, but are added
+ * to the list @head, which can later be used as an argument
+ * to nfs4_free_state_owners.
  */
-void nfs4_purge_state_owners(struct nfs_server *server)
+void nfs4_purge_state_owners(struct nfs_server *server, struct list_head *head)
 {
 	struct nfs_client *clp = server->nfs_client;
 	struct nfs4_state_owner *sp, *tmp;
-	LIST_HEAD(doomed);
 
 	spin_lock(&clp->cl_lock);
 	list_for_each_entry_safe(sp, tmp, &server->state_owners_lru, so_lru) {
-		list_move(&sp->so_lru, &doomed);
+		list_move(&sp->so_lru, head);
 		nfs4_remove_state_owner_locked(sp);
 	}
 	spin_unlock(&clp->cl_lock);
+}
 
-	list_for_each_entry_safe(sp, tmp, &doomed, so_lru) {
+/**
+ * nfs4_purge_state_owners - Release all cached state owners
+ * @head: resulting list of state owners
+ *
+ * Frees a list of state owners that was generated by
+ * nfs4_purge_state_owners
+ */
+void nfs4_free_state_owners(struct list_head *head)
+{
+	struct nfs4_state_owner *sp, *tmp;
+
+	list_for_each_entry_safe(sp, tmp, head, so_lru) {
 		list_del(&sp->so_lru);
 		nfs4_free_state_owner(sp);
 	}
@@ -1764,12 +1779,13 @@
 	struct nfs4_state_owner *sp;
 	struct nfs_server *server;
 	struct rb_node *pos;
+	LIST_HEAD(freeme);
 	int status = 0;
 
 restart:
 	rcu_read_lock();
 	list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
-		nfs4_purge_state_owners(server);
+		nfs4_purge_state_owners(server, &freeme);
 		spin_lock(&clp->cl_lock);
 		for (pos = rb_first(&server->state_owners);
 		     pos != NULL;
@@ -1798,6 +1814,7 @@
 		spin_unlock(&clp->cl_lock);
 	}
 	rcu_read_unlock();
+	nfs4_free_state_owners(&freeme);
 	return 0;
 }
 
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
old mode 100644
new mode 100755
index b4048b2..a79e64f
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -464,6 +464,7 @@
 	/* len == 0 means wake all */
 	struct userfaultfd_wake_range range = { .len = 0, };
 	unsigned long new_flags;
+	bool still_valid;
 
 	ACCESS_ONCE(ctx->released) = true;
 
@@ -479,8 +480,7 @@
 	 * taking the mmap_sem for writing.
 	 */
 	down_write(&mm->mmap_sem);
-	if (!mmget_still_valid(mm))
-		goto skip_mm;
+	still_valid = mmget_still_valid(mm);
 	prev = NULL;
 	for (vma = mm->mmap; vma; vma = vma->vm_next) {
 		cond_resched();
@@ -491,22 +491,23 @@
 			continue;
 		}
 		new_flags = vma->vm_flags & ~(VM_UFFD_MISSING | VM_UFFD_WP);
-		prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end,
-				 new_flags, vma->anon_vma,
-				 vma->vm_file, vma->vm_pgoff,
-				 vma_policy(vma),
-				 NULL_VM_UFFD_CTX,
-				 vma_get_anon_name(vma));
-		if (prev)
-			vma = prev;
-		else
-			prev = vma;
+		if (still_valid) {
+			prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end,
+					 new_flags, vma->anon_vma,
+					 vma->vm_file, vma->vm_pgoff,
+					 vma_policy(vma),
+					 NULL_VM_UFFD_CTX,
+					 vma_get_anon_name(vma));
+			if (prev)
+				vma = prev;
+			else
+				prev = vma;
+		}
 		vm_write_begin(vma);
 		WRITE_ONCE(vma->vm_flags, new_flags);
 		vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
 		vm_write_end(vma);
 	}
-skip_mm:
 	up_write(&mm->mmap_sem);
 	mmput(mm);
 wakeup:
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index 33c3899..7bfddcd 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -774,6 +774,7 @@
 
 out_cancel:
 	xfs_trans_cancel(tp);
+	xfs_iunlock(ip, XFS_ILOCK_EXCL);
 out_dqrele:
 	xfs_qm_dqrele(udqp);
 	xfs_qm_dqrele(gdqp);
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 8586ff3..709ec95 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1628,6 +1628,10 @@
 {
 	struct sk_buff *skb = tcp_send_head(sk);
 
+	/* empty retransmit queue, for example due to zero window */
+	if (skb == tcp_write_queue_head(sk))
+		return NULL;
+
 	return skb ? tcp_write_queue_prev(sk, skb) : tcp_write_queue_tail(sk);
 }
 
diff --git a/include/trace/events/namei.h b/include/trace/events/namei.h
new file mode 100644
index 0000000..e8c3e21
--- /dev/null
+++ b/include/trace/events/namei.h
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM namei
+
+#if !defined(_TRACE_INODEPATH_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_INODEPATH_H
+
+#include <linux/types.h>
+#include <linux/tracepoint.h>
+#include <linux/mm.h>
+#include <linux/memcontrol.h>
+#include <linux/device.h>
+#include <linux/kdev_t.h>
+
+TRACE_EVENT(inodepath,
+		TP_PROTO(struct inode *inode, char *path),
+
+		TP_ARGS(inode, path),
+
+		TP_STRUCT__entry(
+			/* dev_t and ino_t are arch dependent bit width
+			 * so just use 64-bit
+			 */
+			__field(unsigned long, ino)
+			__field(unsigned long, dev)
+			__string(path, path)
+		),
+
+		TP_fast_assign(
+			__entry->ino = inode->i_ino;
+			__entry->dev = inode->i_sb->s_dev;
+			__assign_str(path, path);
+		),
+
+		TP_printk("dev %d:%d ino=%lu path=%s",
+			MAJOR(__entry->dev), MINOR(__entry->dev),
+			__entry->ino, __get_str(path))
+);
+#endif /* _TRACE_INODEPATH_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
diff --git a/init/Kconfig b/init/Kconfig
index a318976..6b5e69a 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1188,6 +1188,7 @@
 config CFS_BANDWIDTH
 	bool "CPU bandwidth provisioning for FAIR_GROUP_SCHED"
 	depends on FAIR_GROUP_SCHED
+	depends on !SCHED_WALT
 	default n
 	help
 	  This option allows users to define CPU bandwidth rates (limits) for
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 5e0ea17..8847f27 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -267,6 +267,18 @@
 	}
 }
 
+static void irq_sysfs_del(struct irq_desc *desc)
+{
+	/*
+	 * If irq_sysfs_init() has not yet been invoked (early boot), then
+	 * irq_kobj_base is NULL and the descriptor was never added.
+	 * kobject_del() complains about a object with no parent, so make
+	 * it conditional.
+	 */
+	if (irq_kobj_base)
+		kobject_del(&desc->kobj);
+}
+
 static int __init irq_sysfs_init(void)
 {
 	struct irq_desc *desc;
@@ -297,6 +309,7 @@
 };
 
 static void irq_sysfs_add(int irq, struct irq_desc *desc) {}
+static void irq_sysfs_del(struct irq_desc *desc) {}
 
 #endif /* CONFIG_SYSFS */
 
@@ -406,7 +419,7 @@
 	 * The sysfs entry must be serialized against a concurrent
 	 * irq_sysfs_init() as well.
 	 */
-	kobject_del(&desc->kobj);
+	irq_sysfs_del(desc);
 	delete_irq_desc(irq);
 
 	/*
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index c24ff26..c319cd9 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -30,6 +30,7 @@
 #include <linux/userfaultfd_k.h>
 #include <linux/page_idle.h>
 #include <linux/shmem_fs.h>
+#include <linux/page_owner.h>
 
 #include <asm/tlb.h>
 #include <asm/pgalloc.h>
@@ -1951,6 +1952,9 @@
 	}
 
 	ClearPageCompound(head);
+
+	split_page_owner(head, HPAGE_PMD_ORDER);
+
 	/* See comment in __split_huge_page_tail() */
 	if (PageAnon(head)) {
 		page_ref_inc(head);
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index f7adb5d..b0ca307 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -52,6 +52,7 @@
 #include <linux/zpool.h>
 #include <linux/mount.h>
 #include <linux/migrate.h>
+#include <linux/wait.h>
 #include <linux/pagemap.h>
 
 #define ZSPAGE_MAGIC	0x58
@@ -266,6 +267,10 @@
 #ifdef CONFIG_COMPACTION
 	struct inode *inode;
 	struct work_struct free_work;
+	/* A wait queue for when migration races with async_free_zspage() */
+	wait_queue_head_t migration_wait;
+	atomic_long_t isolated_pages;
+	bool destroying;
 #endif
 };
 
@@ -1959,6 +1964,31 @@
 	zspage->isolated--;
 }
 
+static void putback_zspage_deferred(struct zs_pool *pool,
+				    struct size_class *class,
+				    struct zspage *zspage)
+{
+	enum fullness_group fg;
+
+	fg = putback_zspage(class, zspage);
+	if (fg == ZS_EMPTY)
+		schedule_work(&pool->free_work);
+
+}
+
+static inline void zs_pool_dec_isolated(struct zs_pool *pool)
+{
+	VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0);
+	atomic_long_dec(&pool->isolated_pages);
+	/*
+	 * There's no possibility of racing, since wait_for_isolated_drain()
+	 * checks the isolated count under &class->lock after enqueuing
+	 * on migration_wait.
+	 */
+	if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying)
+		wake_up_all(&pool->migration_wait);
+}
+
 static void replace_sub_page(struct size_class *class, struct zspage *zspage,
 				struct page *newpage, struct page *oldpage)
 {
@@ -2028,6 +2058,7 @@
 	 */
 	if (!list_empty(&zspage->list) && !is_zspage_isolated(zspage)) {
 		get_zspage_mapping(zspage, &class_idx, &fullness);
+		atomic_long_inc(&pool->isolated_pages);
 		remove_zspage(class, zspage, fullness);
 	}
 
@@ -2116,8 +2147,16 @@
 	 * Page migration is done so let's putback isolated zspage to
 	 * the list if @page is final isolated subpage in the zspage.
 	 */
-	if (!is_zspage_isolated(zspage))
-		putback_zspage(class, zspage);
+	if (!is_zspage_isolated(zspage)) {
+		/*
+		 * We cannot race with zs_destroy_pool() here because we wait
+		 * for isolation to hit zero before we start destroying.
+		 * Also, we ensure that everyone can see pool->destroying before
+		 * we start waiting.
+		 */
+		putback_zspage_deferred(pool, class, zspage);
+		zs_pool_dec_isolated(pool);
+	}
 
 	reset_page(page);
 	put_page(page);
@@ -2164,13 +2203,12 @@
 	spin_lock(&class->lock);
 	dec_zspage_isolation(zspage);
 	if (!is_zspage_isolated(zspage)) {
-		fg = putback_zspage(class, zspage);
 		/*
 		 * Due to page_lock, we cannot free zspage immediately
 		 * so let's defer.
 		 */
-		if (fg == ZS_EMPTY)
-			schedule_work(&pool->free_work);
+		putback_zspage_deferred(pool, class, zspage);
+		zs_pool_dec_isolated(pool);
 	}
 	spin_unlock(&class->lock);
 }
@@ -2194,8 +2232,36 @@
 	return 0;
 }
 
+static bool pool_isolated_are_drained(struct zs_pool *pool)
+{
+	return atomic_long_read(&pool->isolated_pages) == 0;
+}
+
+/* Function for resolving migration */
+static void wait_for_isolated_drain(struct zs_pool *pool)
+{
+
+	/*
+	 * We're in the process of destroying the pool, so there are no
+	 * active allocations. zs_page_isolate() fails for completely free
+	 * zspages, so we need only wait for the zs_pool's isolated
+	 * count to hit zero.
+	 */
+	wait_event(pool->migration_wait,
+		   pool_isolated_are_drained(pool));
+}
+
 static void zs_unregister_migration(struct zs_pool *pool)
 {
+	pool->destroying = true;
+	/*
+	 * We need a memory barrier here to ensure global visibility of
+	 * pool->destroying. Thus pool->isolated pages will either be 0 in which
+	 * case we don't care, or it will be > 0 and pool->destroying will
+	 * ensure that we wake up once isolation hits 0.
+	 */
+	smp_mb();
+	wait_for_isolated_drain(pool); /* This can block */
 	flush_work(&pool->free_work);
 	iput(pool->inode);
 }
@@ -2442,6 +2508,10 @@
 	if (!pool->name)
 		goto err;
 
+#ifdef CONFIG_COMPACTION
+	init_waitqueue_head(&pool->migration_wait);
+#endif
+
 	if (create_cache(pool))
 		goto err;
 
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 142ccaa..4a47918 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2288,8 +2288,10 @@
 	state.buf_kern_len = size64;
 
 	ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
-	if (WARN_ON(ret < 0))
+	if (WARN_ON(ret < 0)) {
+		vfree(entries_tmp);
 		goto out_unlock;
+	}
 
 	vfree(entries_tmp);
 	tmp.entries_size = size64;
diff --git a/net/core/stream.c b/net/core/stream.c
index 1086c8b..6e41b20 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -118,7 +118,6 @@
 	int err = 0;
 	long vm_wait = 0;
 	long current_timeo = *timeo_p;
-	bool noblock = (*timeo_p ? false : true);
 	DEFINE_WAIT(wait);
 
 	if (sk_stream_memory_free(sk))
@@ -131,11 +130,8 @@
 
 		if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
 			goto do_error;
-		if (!*timeo_p) {
-			if (noblock)
-				set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
-			goto do_nonblock;
-		}
+		if (!*timeo_p)
+			goto do_eagain;
 		if (signal_pending(current))
 			goto do_interrupted;
 		sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
@@ -167,7 +163,13 @@
 do_error:
 	err = -EPIPE;
 	goto out;
-do_nonblock:
+do_eagain:
+	/* Make sure that whenever EAGAIN is returned, EPOLLOUT event can
+	 * be generated later.
+	 * When TCP receives ACK packets that make room, tcp_check_space()
+	 * only calls tcp_new_space() if SOCK_NOSPACE is set.
+	 */
+	set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 	err = -EAGAIN;
 	goto out;
 do_interrupted:
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 954315e..3b2c469 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1418,6 +1418,11 @@
 	if (is_multicast_ether_addr(mac))
 		return -EINVAL;
 
+	if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER) &&
+	    sdata->vif.type == NL80211_IFTYPE_STATION &&
+	    !sdata->u.mgd.associated)
+		return -EINVAL;
+
 	sta = sta_info_alloc(sdata, mac, GFP_KERNEL);
 	if (!sta)
 		return -ENOMEM;
@@ -1425,10 +1430,6 @@
 	if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
 		sta->sta.tdls = true;
 
-	if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION &&
-	    !sdata->u.mgd.associated)
-		return -EINVAL;
-
 	err = sta_apply_parameters(local, sta, params);
 	if (err) {
 		sta_info_free(local, sta);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 4c4d884..73252d7 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2172,7 +2172,7 @@
 
 	/* When last_request->processed becomes true this will be rescheduled */
 	if (lr && !lr->processed) {
-		reg_process_hint(lr);
+		pr_debug("Pending regulatory request, waiting for it to be processed...\n");
 		return;
 	}
 
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 130e227..eee4ea1 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1822,8 +1822,7 @@
 	if (cptr->type == USER_CLIENT) {
 		info->input_pool = cptr->data.user.fifo_pool_size;
 		info->input_free = info->input_pool;
-		if (cptr->data.user.fifo)
-			info->input_free = snd_seq_unused_cells(cptr->data.user.fifo->pool);
+		info->input_free = snd_seq_fifo_unused_cells(cptr->data.user.fifo);
 	} else {
 		info->input_pool = 0;
 		info->input_free = 0;
diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
index 9acbed1..d9f5428 100644
--- a/sound/core/seq/seq_fifo.c
+++ b/sound/core/seq/seq_fifo.c
@@ -278,3 +278,20 @@
 
 	return 0;
 }
+
+/* get the number of unused cells safely */
+int snd_seq_fifo_unused_cells(struct snd_seq_fifo *f)
+{
+	unsigned long flags;
+	int cells;
+
+	if (!f)
+		return 0;
+
+	snd_use_lock_use(&f->use_lock);
+	spin_lock_irqsave(&f->lock, flags);
+	cells = snd_seq_unused_cells(f->pool);
+	spin_unlock_irqrestore(&f->lock, flags);
+	snd_use_lock_free(&f->use_lock);
+	return cells;
+}
diff --git a/sound/core/seq/seq_fifo.h b/sound/core/seq/seq_fifo.h
index 062c446..5d38a0d 100644
--- a/sound/core/seq/seq_fifo.h
+++ b/sound/core/seq/seq_fifo.h
@@ -68,5 +68,7 @@
 /* resize pool in fifo */
 int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize);
 
+/* get the number of unused cells safely */
+int snd_seq_fifo_unused_cells(struct snd_seq_fifo *f);
 
 #endif
diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
index 5a0b17e..624c209 100644
--- a/sound/soc/davinci/davinci-mcasp.c
+++ b/sound/soc/davinci/davinci-mcasp.c
@@ -1158,6 +1158,28 @@
 	return ret;
 }
 
+static int davinci_mcasp_hw_rule_slot_width(struct snd_pcm_hw_params *params,
+					    struct snd_pcm_hw_rule *rule)
+{
+	struct davinci_mcasp_ruledata *rd = rule->private;
+	struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
+	struct snd_mask nfmt;
+	int i, slot_width;
+
+	snd_mask_none(&nfmt);
+	slot_width = rd->mcasp->slot_width;
+
+	for (i = 0; i <= SNDRV_PCM_FORMAT_LAST; i++) {
+		if (snd_mask_test(fmt, i)) {
+			if (snd_pcm_format_width(i) <= slot_width) {
+				snd_mask_set(&nfmt, i);
+			}
+		}
+	}
+
+	return snd_mask_refine(fmt, &nfmt);
+}
+
 static const unsigned int davinci_mcasp_dai_rates[] = {
 	8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000,
 	88200, 96000, 176400, 192000,
@@ -1251,7 +1273,7 @@
 	struct davinci_mcasp_ruledata *ruledata =
 					&mcasp->ruledata[substream->stream];
 	u32 max_channels = 0;
-	int i, dir;
+	int i, dir, ret;
 	int tdm_slots = mcasp->tdm_slots;
 
 	/* Do not allow more then one stream per direction */
@@ -1280,6 +1302,7 @@
 			max_channels++;
 	}
 	ruledata->serializers = max_channels;
+	ruledata->mcasp = mcasp;
 	max_channels *= tdm_slots;
 	/*
 	 * If the already active stream has less channels than the calculated
@@ -1305,20 +1328,22 @@
 				   0, SNDRV_PCM_HW_PARAM_CHANNELS,
 				   &mcasp->chconstr[substream->stream]);
 
-	if (mcasp->slot_width)
-		snd_pcm_hw_constraint_minmax(substream->runtime,
-					     SNDRV_PCM_HW_PARAM_SAMPLE_BITS,
-					     8, mcasp->slot_width);
+	if (mcasp->slot_width) {
+		/* Only allow formats require <= slot_width bits on the bus */
+		ret = snd_pcm_hw_rule_add(substream->runtime, 0,
+					  SNDRV_PCM_HW_PARAM_FORMAT,
+					  davinci_mcasp_hw_rule_slot_width,
+					  ruledata,
+					  SNDRV_PCM_HW_PARAM_FORMAT, -1);
+		if (ret)
+			return ret;
+	}
 
 	/*
 	 * If we rely on implicit BCLK divider setting we should
 	 * set constraints based on what we can provide.
 	 */
 	if (mcasp->bclk_master && mcasp->bclk_div == 0 && mcasp->sysclk_freq) {
-		int ret;
-
-		ruledata->mcasp = mcasp;
-
 		ret = snd_pcm_hw_rule_add(substream->runtime, 0,
 					  SNDRV_PCM_HW_PARAM_RATE,
 					  davinci_mcasp_hw_rule_rate,
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index f8c86f2..1ed8c16 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -1106,8 +1106,8 @@
 		list_add_tail(&widget->work_list, list);
 
 	if (custom_stop_condition && custom_stop_condition(widget, dir)) {
-		widget->endpoints[dir] = 1;
-		return widget->endpoints[dir];
+		list = NULL;
+		custom_stop_condition = NULL;
 	}
 
 	if ((widget->is_ep & SND_SOC_DAPM_DIR_TO_EP(dir)) && widget->connected) {
@@ -1144,8 +1144,8 @@
  *
  * Optionally, can be supplied with a function acting as a stopping condition.
  * This function takes the dapm widget currently being examined and the walk
- * direction as an arguments, it should return true if the walk should be
- * stopped and false otherwise.
+ * direction as an arguments, it should return true if widgets from that point
+ * in the graph onwards should not be added to the widget list.
  */
 static int is_connected_output_ep(struct snd_soc_dapm_widget *widget,
 	struct list_head *list,
diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
index a9f99a6..74b3993 100644
--- a/sound/usb/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -552,6 +552,15 @@
 	line6pcm->volume_monitor = 255;
 	line6pcm->line6 = line6;
 
+	spin_lock_init(&line6pcm->out.lock);
+	spin_lock_init(&line6pcm->in.lock);
+	line6pcm->impulse_period = LINE6_IMPULSE_DEFAULT_PERIOD;
+
+	line6->line6pcm = line6pcm;
+
+	pcm->private_data = line6pcm;
+	pcm->private_free = line6_cleanup_pcm;
+
 	line6pcm->max_packet_size_in =
 		usb_maxpacket(line6->usbdev,
 			usb_rcvisocpipe(line6->usbdev, ep_read), 0);
@@ -564,15 +573,6 @@
 		return -EINVAL;
 	}
 
-	spin_lock_init(&line6pcm->out.lock);
-	spin_lock_init(&line6pcm->in.lock);
-	line6pcm->impulse_period = LINE6_IMPULSE_DEFAULT_PERIOD;
-
-	line6->line6pcm = line6pcm;
-
-	pcm->private_data = line6pcm;
-	pcm->private_free = line6_cleanup_pcm;
-
 	err = line6_create_audio_out_urbs(line6pcm);
 	if (err < 0)
 		return err;
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
old mode 100644
new mode 100755
index 089e085..63ed479
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -83,6 +83,7 @@
 	unsigned char *buffer;
 	unsigned int buflen;
 	DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS);
+	DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS);
 	struct usb_audio_term oterm;
 	const struct usbmix_name_map *map;
 	const struct usbmix_selector_map *selector_map;
@@ -722,15 +723,24 @@
  * parse the source unit recursively until it reaches to a terminal
  * or a branched unit.
  */
-static int check_input_term(struct mixer_build *state, int id,
+static int __check_input_term(struct mixer_build *state, int id,
 			    struct usb_audio_term *term)
 {
 	int err;
 	void *p1;
+	unsigned char *hdr;
 
 	memset(term, 0, sizeof(*term));
-	while ((p1 = find_audio_control_unit(state, id)) != NULL) {
-		unsigned char *hdr = p1;
+	for (;;) {
+		/* a loop in the terminal chain? */
+		if (test_and_set_bit(id, state->termbitmap))
+			return -EINVAL;
+
+		p1 = find_audio_control_unit(state, id);
+		if (!p1)
+			break;
+
+		hdr = p1;
 		term->id = id;
 		switch (hdr[2]) {
 		case UAC_INPUT_TERMINAL:
@@ -745,7 +755,7 @@
 
 				/* call recursively to verify that the
 				 * referenced clock entity is valid */
-				err = check_input_term(state, d->bCSourceID, term);
+				err = __check_input_term(state, d->bCSourceID, term);
 				if (err < 0)
 					return err;
 
@@ -760,7 +770,7 @@
 			} else { /* UAC_VERSION_3 */
 				struct uac3_input_terminal_descriptor *d = p1;
 
-				err = check_input_term(state,
+				err = __check_input_term(state,
 							d->bCSourceID, term);
 				if (err < 0)
 					return err;
@@ -791,7 +801,17 @@
 			term->name = uac_mixer_unit_iMixer(d);
 			return 0;
 		}
-		case UAC_SELECTOR_UNIT:
+		case UAC_SELECTOR_UNIT: {
+			struct uac_selector_unit_descriptor *d = p1;
+			/* call recursively to retrieve the channel info */
+			err = __check_input_term(state, d->baSourceID[0], term);
+			if (err < 0)
+				return err;
+			term->type = d->bDescriptorSubtype << 16; /* virtual type */
+			term->id = id;
+			term->name = uac_selector_unit_iSelector(d);
+			return 0;
+		}
 		/* UAC3_MIXER_UNIT_V3 */
 		case UAC2_CLOCK_SELECTOR:
 		/* UAC3_CLOCK_SOURCE */ {
@@ -818,7 +838,7 @@
 			} else {
 				struct uac_selector_unit_descriptor *d = p1;
 				/* call recursively to retrieve channel info */
-				err = check_input_term(state,
+				err = __check_input_term(state,
 							d->baSourceID[0], term);
 				if (err < 0)
 					return err;
@@ -882,6 +902,15 @@
 	return -ENODEV;
 }
 
+
+static int check_input_term(struct mixer_build *state, int id,
+			    struct usb_audio_term *term)
+{
+	memset(term, 0, sizeof(*term));
+	memset(state->termbitmap, 0, sizeof(state->termbitmap));
+	return __check_input_term(state, id, term);
+}
+
 /*
  * Feature Unit
  */
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index 1774800..fffc7c4 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -1379,6 +1379,8 @@
 			daemonize = 0;
 			break;
 		case 'h':
+			print_usage(argv);
+			exit(0);
 		default:
 			print_usage(argv);
 			exit(EXIT_FAILURE);
diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c
index e082980..bdc1891 100644
--- a/tools/hv/hv_vss_daemon.c
+++ b/tools/hv/hv_vss_daemon.c
@@ -164,6 +164,8 @@
 			daemonize = 0;
 			break;
 		case 'h':
+			print_usage(argv);
+			exit(0);
 		default:
 			print_usage(argv);
 			exit(EXIT_FAILURE);
diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
index e58be7e..7b364f2 100644
--- a/tools/perf/bench/numa.c
+++ b/tools/perf/bench/numa.c
@@ -373,8 +373,10 @@
 
 	/* Allocate and initialize all memory on CPU#0: */
 	if (init_cpu0) {
-		orig_mask = bind_to_node(0);
-		bind_to_memnode(0);
+		int node = numa_node_of_cpu(0);
+
+		orig_mask = bind_to_node(node);
+		bind_to_memnode(node);
 	}
 
 	bytes = bytes0 + HPSIZE;
diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
index 41611d7..016d12a 100644
--- a/tools/perf/pmu-events/jevents.c
+++ b/tools/perf/pmu-events/jevents.c
@@ -315,6 +315,7 @@
 	{ "inst_retired.any_p", "event=0xc0" },
 	{ "cpu_clk_unhalted.ref", "event=0x0,umask=0x03" },
 	{ "cpu_clk_unhalted.thread", "event=0x3c" },
+	{ "cpu_clk_unhalted.core", "event=0x3c" },
 	{ "cpu_clk_unhalted.thread_any", "event=0x3c,any=1" },
 	{ NULL, NULL},
 };
diff --git a/tools/perf/tests/parse-events.c b/tools/perf/tests/parse-events.c
index 9134a0c..aa9276b 100644
--- a/tools/perf/tests/parse-events.c
+++ b/tools/perf/tests/parse-events.c
@@ -12,32 +12,6 @@
 #define PERF_TP_SAMPLE_TYPE (PERF_SAMPLE_RAW | PERF_SAMPLE_TIME | \
 			     PERF_SAMPLE_CPU | PERF_SAMPLE_PERIOD)
 
-#if defined(__s390x__)
-/* Return true if kvm module is available and loaded. Test this
- * and retun success when trace point kvm_s390_create_vm
- * exists. Otherwise this test always fails.
- */
-static bool kvm_s390_create_vm_valid(void)
-{
-	char *eventfile;
-	bool rc = false;
-
-	eventfile = get_events_file("kvm-s390");
-
-	if (eventfile) {
-		DIR *mydir = opendir(eventfile);
-
-		if (mydir) {
-			rc = true;
-			closedir(mydir);
-		}
-		put_events_file(eventfile);
-	}
-
-	return rc;
-}
-#endif
-
 static int test__checkevent_tracepoint(struct perf_evlist *evlist)
 {
 	struct perf_evsel *evsel = perf_evlist__first(evlist);
@@ -1619,7 +1593,6 @@
 	{
 		.name  = "kvm-s390:kvm_s390_create_vm",
 		.check = test__checkevent_tracepoint,
-		.valid = kvm_s390_create_vm_valid,
 		.id    = 100,
 	},
 #endif
diff --git a/tools/testing/selftests/kvm/config b/tools/testing/selftests/kvm/config
new file mode 100644
index 0000000..63ed533
--- /dev/null
+++ b/tools/testing/selftests/kvm/config
@@ -0,0 +1,3 @@
+CONFIG_KVM=y
+CONFIG_KVM_INTEL=y
+CONFIG_KVM_AMD=y
diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
index 85814d1..87742c9 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.c
+++ b/virt/kvm/arm/vgic/vgic-mmio.c
@@ -120,6 +120,12 @@
 	return value;
 }
 
+static bool is_vgic_v2_sgi(struct kvm_vcpu *vcpu, struct vgic_irq *irq)
+{
+	return (vgic_irq_is_sgi(irq->intid) &&
+		vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V2);
+}
+
 void vgic_mmio_write_spending(struct kvm_vcpu *vcpu,
 			      gpa_t addr, unsigned int len,
 			      unsigned long val)
@@ -130,6 +136,12 @@
 	for_each_set_bit(i, &val, len * 8) {
 		struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
 
+		/* GICD_ISPENDR0 SGI bits are WI */
+		if (is_vgic_v2_sgi(vcpu, irq)) {
+			vgic_put_irq(vcpu->kvm, irq);
+			continue;
+		}
+
 		spin_lock(&irq->irq_lock);
 		irq->pending = true;
 		if (irq->config == VGIC_CONFIG_LEVEL)
@@ -150,6 +162,12 @@
 	for_each_set_bit(i, &val, len * 8) {
 		struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
 
+		/* GICD_ICPENDR0 SGI bits are WI */
+		if (is_vgic_v2_sgi(vcpu, irq)) {
+			vgic_put_irq(vcpu->kvm, irq);
+			continue;
+		}
+
 		spin_lock(&irq->irq_lock);
 
 		if (irq->config == VGIC_CONFIG_LEVEL) {
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index 1ab58f7..4c2919c 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -154,7 +154,10 @@
 		if (vgic_irq_is_sgi(irq->intid)) {
 			u32 src = ffs(irq->source);
 
-			BUG_ON(!src);
+			if (WARN_RATELIMIT(!src, "No SGI source for INTID %d\n",
+					   irq->intid))
+				return;
+
 			val |= (src - 1) << GICH_LR_PHYSID_CPUID_SHIFT;
 			irq->source &= ~(1 << (src - 1));
 			if (irq->source)
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index c792471..267b1cf 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -137,7 +137,10 @@
 		    model == KVM_DEV_TYPE_ARM_VGIC_V2) {
 			u32 src = ffs(irq->source);
 
-			BUG_ON(!src);
+			if (WARN_RATELIMIT(!src, "No SGI source for INTID %d\n",
+					   irq->intid))
+				return;
+
 			val |= (src - 1) << GICH_LR_PHYSID_CPUID_SHIFT;
 			irq->source &= ~(1 << (src - 1));
 			if (irq->source)
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index 6440b56..1934dc8 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -196,6 +196,13 @@
 	bool penda, pendb;
 	int ret;
 
+	/*
+	 * list_sort may call this function with the same element when
+	 * the list is fairly long.
+	 */
+	if (unlikely(irqa == irqb))
+		return 0;
+
 	spin_lock(&irqa->irq_lock);
 	spin_lock_nested(&irqb->irq_lock, SINGLE_DEPTH_NESTING);