Merge tag 'lsk-v4.4-17.02-android' into branch 'msm-4.4'

* refs/heads/tmp-26c8156:
  Linux 4.4.49
  drm/i915: fix use-after-free in page_flip_completed()
  ALSA: seq: Don't handle loop timeout at snd_seq_pool_done()
  ALSA: seq: Fix race at creating a queue
  xen-netfront: Delete rx_refill_timer in xennet_disconnect_backend()
  scsi: mpt3sas: disable ASPM for MPI2 controllers
  scsi: aacraid: Fix INTx/MSI-x issue with older controllers
  scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send
  netvsc: Set maximum GSO size in the right place
  mac80211: Fix adding of mesh vendor IEs
  ARM: 8642/1: LPAE: catch pending imprecise abort on unmask
  target: Fix COMPARE_AND_WRITE ref leak for non GOOD status
  target: Fix early transport_generic_handle_tmr abort scenario
  target: Use correct SCSI status during EXTENDED_COPY exception
  target: Don't BUG_ON during NodeACL dynamic -> explicit conversion
  ARM: 8643/3: arm/ptrace: Preserve previous registers for short regset write
  hns: avoid stack overflow with CONFIG_KASAN
  cpumask: use nr_cpumask_bits for parsing functions
  Revert "x86/ioapic: Restore IO-APIC irq_chip retrigger callback"
  selinux: fix off-by-one in setprocattr
  ARC: [arcompact] brown paper bag bug in unaligned access delay slot fixup
  Linux 4.4.48
  base/memory, hotplug: fix a kernel oops in show_valid_zones()
  x86/irq: Make irq activate operations symmetric
  USB: serial: option: add device ID for HP lt2523 (Novatel E371)
  usb: gadget: f_fs: Assorted buffer overflow checks.
  USB: Add quirk for WORLDE easykey.25 MIDI keyboard
  USB: serial: pl2303: add ATEN device ID
  USB: serial: qcserial: add Dell DW5570 QDL
  KVM: x86: do not save guest-unsupported XSAVE state
  HID: wacom: Fix poor prox handling in 'wacom_pl_irq'
  percpu-refcount: fix reference leak during percpu-atomic transition
  mmc: sdhci: Ignore unexpected CARD_INT interrupts
  can: bcm: fix hrtimer/tasklet termination in bcm op removal
  mm, fs: check for fatal signals in do_generic_file_read()
  mm/memory_hotplug.c: check start_pfn in test_pages_in_a_zone()
  cifs: initialize file_info_lock
  zswap: disable changing params if init fails
  svcrpc: fix oops in absence of krb5 module
  NFSD: Fix a null reference case in find_or_create_lock_stateid()
  powerpc: Add missing error check to prom_find_boot_cpu()
  powerpc/eeh: Fix wrong flag passed to eeh_unfreeze_pe()
  libata: apply MAX_SEC_1024 to all CX1-JB*-HP devices
  ata: sata_mv:- Handle return value of devm_ioremap.
  perf/core: Fix PERF_RECORD_MMAP2 prot/flags for anonymous memory
  crypto: arm64/aes-blk - honour iv_out requirement in CBC and CTR modes
  crypto: api - Clear CRYPTO_ALG_DEAD bit before registering an alg
  drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval
  drm/nouveau/disp/gt215: Fix HDA ELD handling (thus, HDMI audio) on gt215
  ext4: validate s_first_meta_bg at mount time
  PCI/ASPM: Handle PCI-to-PCIe bridges as roots of PCIe hierarchies
  ANDROID: security: export security_path_chown()
  Linux 4.4.47
  net: dsa: Bring back device detaching in dsa_slave_suspend()
  qmi_wwan/cdc_ether: add device ID for HP lt2523 (Novatel E371) WWAN card
  af_unix: move unix_mknod() out of bindlock
  r8152: don't execute runtime suspend if the tx is not empty
  bridge: netlink: call br_changelink() during br_dev_newlink()
  tcp: initialize max window for a new fastopen socket
  ipv6: addrconf: Avoid addrconf_disable_change() using RCU read-side lock
  net: phy: bcm63xx: Utilize correct config_intr function
  net: fix harmonize_features() vs NETIF_F_HIGHDMA
  ax25: Fix segfault after sock connection timeout
  ravb: do not use zero-length alignment DMA descriptor
  openvswitch: maintain correct checksum state in conntrack actions
  tcp: fix tcp_fastopen unaligned access complaints on sparc
  net: systemport: Decouple flow control from __bcm_sysport_tx_reclaim
  net: ipv4: fix table id in getroute response
  net: lwtunnel: Handle lwtunnel_fill_encap failure
  mlxsw: pci: Fix EQE structure definition
  mlxsw: switchx2: Fix memory leak at skb reallocation
  mlxsw: spectrum: Fix memory leak at skb reallocation
  r8152: fix the sw rx checksum is unavailable
  ANDROID: sdcardfs: Switch strcasecmp for internal call
  ANDROID: sdcardfs: switch to full_name_hash and qstr
  ANDROID: sdcardfs: Add GID Derivation to sdcardfs
  ANDROID: sdcardfs: Remove redundant operation
  ANDROID: sdcardfs: add support for user permission isolation
  ANDROID: sdcardfs: Refactor configfs interface
  ANDROID: sdcardfs: Allow non-owners to touch
  ANDROID: binder: fix format specifier for type binder_size_t
  ANDROID: fs: Export vfs_rmdir2
  ANDROID: fs: Export free_fs_struct and set_fs_pwd
  ANDROID: mnt: remount should propagate to slaves of slaves
  ANDROID: sdcardfs: Switch ->d_inode to d_inode()
  ANDROID: sdcardfs: Fix locking issue with permision fix up
  ANDROID: sdcardfs: Change magic value
  ANDROID: sdcardfs: Use per mount permissions
  ANDROID: sdcardfs: Add gid and mask to private mount data
  ANDROID: sdcardfs: User new permission2 functions
  ANDROID: vfs: Add setattr2 for filesystems with per mount permissions
  ANDROID: vfs: Add permission2 for filesystems with per mount permissions
  ANDROID: vfs: Allow filesystems to access their private mount data
  ANDROID: mnt: Add filesystem private data to mount points
  ANDROID: sdcardfs: Move directory unlock before touch
  ANDROID: sdcardfs: fix external storage exporting incorrect uid
  ANDROID: sdcardfs: Added top to sdcardfs_inode_info
  ANDROID: sdcardfs: Switch package list to RCU
  ANDROID: sdcardfs: Fix locking for permission fix up
  ANDROID: sdcardfs: Check for other cases on path lookup
  ANDROID: sdcardfs: override umask on mkdir and create
  Linux 4.4.46
  mm, memcg: do not retry precharge charges
  platform/x86: intel_mid_powerbtn: Set IRQ_ONESHOT
  pinctrl: broxton: Use correct PADCFGLOCK offset
  s5k4ecgx: select CRC32 helper
  IB/umem: Release pid in error and ODP flow
  IB/ipoib: move back IB LL address into the hard header
  drm/i915: Don't leak edid in intel_crt_detect_ddc()
  SUNRPC: cleanup ida information when removing sunrpc module
  NFSv4.0: always send mode in SETATTR after EXCLUSIVE4
  nfs: Don't increment lock sequence ID after NFS4ERR_MOVED
  parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header
  ARC: [arcompact] handle unaligned access delay slot corner case
  ARC: udelay: fix inline assembler by adding LP_COUNT to clobber list
  can: ti_hecc: add missing prepare and unprepare of the clock
  can: c_can_pci: fix null-pointer-deref in c_can_start() - set device pointer
  s390/ptrace: Preserve previous registers for short regset write
  RDMA/cma: Fix unknown symbol when CONFIG_IPV6 is not enabled
  ISDN: eicon: silence misleading array-bounds warning
  sysctl: fix proc_doulongvec_ms_jiffies_minmax()
  mm/mempolicy.c: do not put mempolicy before using its nodemask
  drm: Fix broken VT switch with video=1366x768 option
  tile/ptrace: Preserve previous registers for short regset write
  fbdev: color map copying bounds checking
  Linux 4.4.45
  arm64: avoid returning from bad_mode
  selftest/powerpc: Wrong PMC initialized in pmc56_overflow test
  dmaengine: pl330: Fix runtime PM support for terminated transfers
  ite-cir: initialize use_demodulator before using it
  blackfin: check devm_pinctrl_get() for errors
  ARM: 8613/1: Fix the uaccess crash on PB11MPCore
  ARM: ux500: fix prcmu_is_cpu_in_wfi() calculation
  ARM: dts: imx6qdl-nitrogen6_max: fix sgtl5000 pinctrl init
  arm64/ptrace: Reject attempts to set incomplete hardware breakpoint fields
  arm64/ptrace: Avoid uninitialised struct padding in fpr_set()
  arm64/ptrace: Preserve previous registers for short regset write - 3
  arm64/ptrace: Preserve previous registers for short regset write - 2
  arm64/ptrace: Preserve previous registers for short regset write
  ARM: dts: da850-evm: fix read access to SPI flash
  ceph: fix bad endianness handling in parse_reply_info_extra
  ARM: 8634/1: hw_breakpoint: blacklist Scorpion CPUs
  svcrdma: avoid duplicate dma unmapping during error recovery
  clocksource/exynos_mct: Clear interrupt when cpu is shut down
  ubifs: Fix journal replay wrt. xattr nodes
  qla2xxx: Fix crash due to null pointer access
  x86/ioapic: Restore IO-APIC irq_chip retrigger callback
  mtd: nand: xway: disable module support
  ieee802154: atusb: do not use the stack for buffers to make them DMA able
  mmc: mxs-mmc: Fix additional cycles after transmission stop
  HID: corsair: fix control-transfer error handling
  HID: corsair: fix DMA buffers on stack
  PCI: Enumerate switches below PCI-to-PCIe bridges
  fuse: clear FR_PENDING flag when moving requests out of pending queue
  svcrpc: don't leak contexts on PROC_DESTROY
  x86/PCI: Ignore _CRS on Supermicro X8DTH-i/6/iF/6F
  tmpfs: clear S_ISGID when setting posix ACLs
  ARM: dts: imx31: fix AVIC base address
  ARM: dts: imx31: move CCM device node to AIPS2 bus devices
  ARM: dts: imx31: fix clock control module interrupts description
  perf scripting: Avoid leaking the scripting_context variable
  IB/IPoIB: Remove can't use GFP_NOIO warning
  IB/mlx4: When no DMFS for IPoIB, don't allow NET_IF QPs
  IB/mlx4: Fix port query for 56Gb Ethernet links
  IB/mlx4: Fix out-of-range array index in destroy qp flow
  IB/mlx4: Set traffic class in AH
  IB/mlx5: Wait for all async command completions to complete
  ftrace/x86: Set ftrace_stub to weak to prevent gcc from using short jumps to it
  Linux 4.4.44
  pinctrl: sh-pfc: Do not unconditionally support PIN_CONFIG_BIAS_DISABLE
  powerpc/ibmebus: Fix device reference leaks in sysfs interface
  powerpc/ibmebus: Fix further device reference leaks
  bus: vexpress-config: fix device reference leak
  blk-mq: Always schedule hctx->next_cpu
  ACPI / APEI: Fix NMI notification handling
  block: cfq_cpd_alloc() should use @gfp
  cpufreq: powernv: Disable preemption while checking CPU throttling state
  NFSv4.1: nfs4_fl_prepare_ds must be careful about reporting success.
  NFS: Fix a performance regression in readdir
  pNFS: Fix race in pnfs_wait_on_layoutreturn
  pinctrl: meson: fix gpio request disabling other modes
  btrfs: fix error handling when run_delayed_extent_op fails
  btrfs: fix locking when we put back a delayed ref that's too new
  x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option
  USB: serial: ch341: fix modem-control and B0 handling
  USB: serial: ch341: fix resume after reset
  drm/radeon: drop verde dpm quirks
  sysctl: Drop reference added by grab_header in proc_sys_readdir
  sysrq: attach sysrq handler correctly for 32-bit kernel
  tty/serial: atmel_serial: BUG: stop DMA from transmitting in stop_tx
  mnt: Protect the mountpoint hashtable with mount_lock
  vme: Fix wrong pointer utilization in ca91cx42_slave_get
  xhci: fix deadlock at host remove by running watchdog correctly
  i2c: fix kernel memory disclosure in dev interface
  i2c: print correct device invalid address
  Input: elants_i2c - avoid divide by 0 errors on bad touchscreen data
  USB: serial: ch341: fix open and resume after B0
  USB: serial: ch341: fix control-message error handling
  USB: serial: ch341: fix open error handling
  USB: serial: ch341: fix initial modem-control state
  USB: serial: kl5kusb105: fix line-state error handling
  nl80211: fix sched scan netlink socket owner destruction
  KVM: x86: Introduce segmented_write_std
  KVM: x86: emulate FXSAVE and FXRSTOR
  KVM: x86: add asm_safe wrapper
  KVM: x86: add Align16 instruction flag
  KVM: x86: flush pending lapic jump label updates on module unload
  jump_labels: API for flushing deferred jump label updates
  KVM: eventfd: fix NULL deref irqbypass consumer
  KVM: x86: fix emulation of "MOV SS, null selector"
  mm/hugetlb.c: fix reservation race when freeing surplus pages
  ocfs2: fix crash caused by stale lvb with fsdlm plugin
  mm: fix devm_memremap_pages crash, use mem_hotplug_{begin, done}
  selftests: do not require bash for the generated test
  selftests: do not require bash to run netsocktests testcase
  Input: i8042 - add Pegatron touchpad to noloop table
  Input: xpad - use correct product id for x360w controllers
  DEBUG: sched/fair: Fix sched_load_avg_cpu events for task_groups
  DEBUG: sched/fair: Fix missing sched_load_avg_cpu events
  net: socket: don't set sk_uid to garbage value in ->setattr()
  ANDROID: configs: CONFIG_ARM64_SW_TTBR0_PAN=y
  UPSTREAM: arm64: Disable PAN on uaccess_enable()
  UPSTREAM: arm64: Enable CONFIG_ARM64_SW_TTBR0_PAN
  UPSTREAM: arm64: xen: Enable user access before a privcmd hvc call
  UPSTREAM: arm64: Handle faults caused by inadvertent user access with PAN enabled
  BACKPORT: arm64: Disable TTBR0_EL1 during normal kernel execution
  BACKPORT: arm64: Introduce uaccess_{disable,enable} functionality based on TTBR0_EL1
  BACKPORT: arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro
  BACKPORT: arm64: Factor out PAN enabling/disabling into separate uaccess_* macros
  UPSTREAM: arm64: alternative: add auto-nop infrastructure
  UPSTREAM: arm64: barriers: introduce nops and __nops macros for NOP sequences
  Revert "FROMLIST: arm64: Factor out PAN enabling/disabling into separate uaccess_* macros"
  Revert "FROMLIST: arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro"
  Revert "FROMLIST: arm64: Introduce uaccess_{disable,enable} functionality based on TTBR0_EL1"
  Revert "FROMLIST: arm64: Disable TTBR0_EL1 during normal kernel execution"
  Revert "FROMLIST: arm64: Handle faults caused by inadvertent user access with PAN enabled"
  Revert "FROMLIST: arm64: xen: Enable user access before a privcmd hvc call"
  Revert "FROMLIST: arm64: Enable CONFIG_ARM64_SW_TTBR0_PAN"
  ANDROID: sched/walt: fix build failure if FAIR_GROUP_SCHED=n
  Linux 4.4.43
  mm/init: fix zone boundary creation
  ALSA: usb-audio: Add a quirk for Plantronics BT600
  spi: mvebu: fix baudrate calculation for armada variant
  ARM: OMAP4+: Fix bad fallthrough for cpuidle
  ARM: zynq: Reserve correct amount of non-DMA RAM
  powerpc: Fix build warning on 32-bit PPC
  ALSA: firewire-tascam: Fix to handle error from initialization of stream data
  HID: hid-cypress: validate length of report
  net: vrf: do not allow table id 0
  net: ipv4: Fix multipath selection with vrf
  gro: Disable frag0 optimization on IPv6 ext headers
  gro: use min_t() in skb_gro_reset_offset()
  gro: Enter slow-path if there is no tailroom
  r8152: fix rx issue for runtime suspend
  r8152: split rtl8152_suspend function
  ipv4: Do not allow MAIN to be alias for new LOCAL w/ custom rules
  igmp: Make igmp group member RFC 3376 compliant
  drop_monitor: consider inserted data in genlmsg_end
  drop_monitor: add missing call to genlmsg_end
  net/mlx5: Avoid shadowing numa_node
  net/mlx5: Check FW limitations on log_max_qp before setting it
  net: stmmac: Fix race between stmmac_drv_probe and stmmac_open
  net, sched: fix soft lockup in tc_classify
  ipv6: handle -EFAULT from skb_copy_bits
  net: vrf: Drop conntrack data after pass through VRF device on Tx
  ser_gigaset: return -ENOMEM on error instead of success
  netvsc: reduce maximum GSO size
  Linux 4.4.42
  usb: gadget: composite: always set ep->mult to a sensible value
  Revert "usb: gadget: composite: always set ep->mult to a sensible value"
  tick/broadcast: Prevent NULL pointer dereference
  drm/radeon: Always store CRTC relative radeon_crtc->cursor_x/y values
  cx23885-dvb: move initialization of a8293_pdata
  net: vxge: avoid unused function warnings
  net: ti: cpmac: Fix compiler warning due to type confusion
  cred/userns: define current_user_ns() as a function
  staging: comedi: dt282x: tidy up register bit defines
  powerpc/pci/rpadlpar: Fix device reference leaks
  md: MD_RECOVERY_NEEDED is set for mddev->recovery
  crypto: arm64/aes-ce - fix for big endian
  crypto: arm64/aes-xts-ce: fix for big endian
  crypto: arm64/sha1-ce - fix for big endian
  crypto: arm64/aes-neon - fix for big endian
  crypto: arm64/aes-ccm-ce: fix for big endian
  crypto: arm/aes-ce - fix for big endian
  crypto: arm64/ghash-ce - fix for big endian
  crypto: arm64/sha2-ce - fix for big endian
  s390/crypto: unlock on error in prng_tdes_read()
  mmc: mmc_test: Uninitialized return value
  PM / wakeirq: Fix dedicated wakeirq for drivers not using autosuspend
  irqchip/bcm7038-l1: Implement irq_cpu_offline() callback
  target/iscsi: Fix double free in lio_target_tiqn_addtpg()
  scsi: mvsas: fix command_active typo
  ASoC: samsung: i2s: Fixup last IRQ unsafe spin lock call
  iommu/vt-d: Flush old iommu caches for kdump when the device gets context mapped
  iommu/vt-d: Fix pasid table size encoding
  iommu/amd: Fix the left value check of cmd buffer
  iommu/amd: Missing error code in amd_iommu_init_device()
  clk: imx31: fix rewritten input argument of mx31_clocks_init()
  clk: clk-wm831x: fix a logic error
  hwmon: (g762) Fix overflows and crash seen when writing limit attributes
  hwmon: (nct7802) Fix overflows seen when writing into limit attributes
  hwmon: (ds620) Fix overflows seen when writing temperature limits
  hwmon: (amc6821) sign extension temperature
  hwmon: (scpi) Fix module autoload
  cris: Only build flash rescue image if CONFIG_ETRAX_AXISFLASHMAP is selected
  ath10k: use the right length of "background"
  stable-fixup: hotplug: fix unused function warning
  usb: dwc3: ep0: explicitly call dwc3_ep0_prepare_one_trb()
  usb: dwc3: ep0: add dwc3_ep0_prepare_one_trb()
  usb: dwc3: gadget: always unmap EP0 requests
  staging: iio: ad7606: fix improper setting of oversampling pins
  mei: bus: fix mei_cldev_enable KDoc
  USB: serial: io_ti: bind to interface after fw download
  USB: phy: am335x-control: fix device and of_node leaks
  ARM: dts: r8a7794: Correct hsusb parent clock
  USB: serial: kl5kusb105: abort on open exception path
  ALSA: usb-audio: Fix bogus error return in snd_usb_create_stream()
  usb: musb: blackfin: add bfin_fifo_offset in bfin_ops
  usb: hub: Move hub_port_disable() to fix warning if PM is disabled
  usb: musb: Fix trying to free already-free IRQ 4
  usb: dwc3: pci: add Intel Gemini Lake PCI ID
  xhci: Fix race related to abort operation
  xhci: Use delayed_work instead of timer for command timeout
  usb: xhci-mem: use passed in GFP flags instead of GFP_KERNEL
  USB: serial: mos7720: fix parallel probe
  USB: serial: mos7720: fix parport use-after-free on probe errors
  USB: serial: mos7720: fix use-after-free on probe errors
  USB: serial: mos7720: fix NULL-deref at open
  USB: serial: mos7840: fix NULL-deref at open
  USB: serial: kobil_sct: fix NULL-deref in write
  USB: serial: cyberjack: fix NULL-deref at open
  USB: serial: oti6858: fix NULL-deref at open
  USB: serial: io_edgeport: fix NULL-deref at open
  USB: serial: ti_usb_3410_5052: fix NULL-deref at open
  USB: serial: garmin_gps: fix memory leak on failed URB submit
  USB: serial: iuu_phoenix: fix NULL-deref at open
  USB: serial: io_ti: fix I/O after disconnect
  USB: serial: io_ti: fix another NULL-deref at open
  USB: serial: io_ti: fix NULL-deref at open
  USB: serial: spcp8x5: fix NULL-deref at open
  USB: serial: keyspan_pda: verify endpoints at probe
  USB: serial: pl2303: fix NULL-deref at open
  USB: serial: quatech2: fix sleep-while-atomic in close
  USB: serial: omninet: fix NULL-derefs at open and disconnect
  usb: xhci: hold lock over xhci_abort_cmd_ring()
  xhci: Handle command completion and timeout race
  usb: host: xhci: Fix possible wild pointer when handling abort command
  usb: xhci: fix return value of xhci_setup_device()
  xhci: free xhci virtual devices with leaf nodes first
  usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Apollo Lake
  xhci: workaround for hosts missing CAS bit
  usb: xhci: fix possible wild pointer
  usb: dwc3: core: avoid Overflow events
  usb: gadget: composite: Test get_alt() presence instead of set_alt()
  USB: dummy-hcd: fix bug in stop_activity (handle ep0)
  USB: fix problems with duplicate endpoint addresses
  USB: gadgetfs: fix checks of wTotalLength in config descriptors
  USB: gadgetfs: fix use-after-free bug
  USB: gadgetfs: fix unbounded memory allocation bug
  usb: gadgetfs: restrict upper bound on device configuration size
  usb: storage: unusual_uas: Add JMicron JMS56x to unusual device
  usb: musb: dsps: implement clear_ep_rxintr() callback
  usb: musb: core: add clear_ep_rxintr() to musb_platform_ops
  KVM: MIPS: Flush KVM entry code from icache globally
  KVM: x86: reset MMU on KVM_SET_VCPU_EVENTS
  mac80211: initialize fast-xmit 'info' later
  ARM: davinci: da850: don't add emac clock to lookup table twice
  ALSA: usb-audio: Fix irq/process data synchronization
  ALSA: hda - Apply asus-mode8 fixup to ASUS X71SL
  ALSA: hda - Fix up GPIO for ASUS ROG Ranger
  Linux 4.4.41
  net: mvpp2: fix dma unmapping of TX buffers for fragments
  sg_write()/bsg_write() is not fit to be called under KERNEL_DS
  kconfig/nconf: Fix hang when editing symbol with a long prompt
  target/user: Fix use-after-free of tcmu_cmds if they are expired
  powerpc: Convert cmp to cmpd in idle enter sequence
  powerpc/ps3: Fix system hang with GCC 5 builds
  nfs_write_end(): fix handling of short copies
  libceph: verify authorize reply on connect
  PCI: Check for PME in targeted sleep state
  Input: drv260x - fix input device's parent assignment
  media: solo6x10: fix lockup by avoiding delayed register write
  IB/cma: Fix a race condition in iboe_addr_get_sgid()
  IB/multicast: Check ib_find_pkey() return value
  IPoIB: Avoid reading an uninitialized member variable
  IB/mad: Fix an array index check
  fgraph: Handle a case where a tracer ignores set_graph_notrace
  platform/x86: asus-nb-wmi.c: Add X45U quirk
  ftrace/x86_32: Set ftrace_stub to weak to prevent gcc from using short jumps to it
  kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)
  KVM: PPC: Book3S HV: Don't lose hardware R/C bit updates in H_PROTECT
  KVM: PPC: Book3S HV: Save/restore XER in checkpointed register state
  md/raid5: limit request size according to implementation limits
  sc16is7xx: Drop bogus use of IRQF_ONESHOT
  s390/vmlogrdr: fix IUCV buffer allocation
  firmware: fix usermode helper fallback loading
  ARC: mm: arc700: Don't assume 2 colours for aliasing VIPT dcache
  scsi: avoid a permanent stop of the scsi device's request queue
  scsi: zfcp: fix rport unblock race with LUN recovery
  scsi: zfcp: do not trace pure benign residual HBA responses at default level
  scsi: zfcp: fix use-after-"free" in FC ingress path after TMF
  scsi: megaraid_sas: Do not set MPI2_TYPE_CUDA for JBOD FP path for FW which does not support JBOD sequence map
  scsi: megaraid_sas: For SRIOV enabled firmware, ensure VF driver waits for 30secs before reset
  vt: fix Scroll Lock LED trigger name
  block: protect iterate_bdevs() against concurrent close
  mei: request async autosuspend at the end of enumeration
  drivers/gpu/drm/ast: Fix infinite loop if read fails
  drm/gma500: Add compat ioctl
  drm/radeon: add additional pci revision to dpm workaround
  drm/radeon: Hide the HW cursor while it's out of bounds
  drm/radeon: Also call cursor_move_locked when the cursor size changes
  drm/nouveau/i2c/gk110b,gm10x: use the correct implementation
  drm/nouveau/fifo/gf100-: protect channel preempt with subdev mutex
  drm/nouveau/ltc: protect clearing of comptags with mutex
  drm/nouveau/bios: require checksum to match for fast acpi shadow method
  drm/nouveau/kms: lvds panel strap moved again on maxwell
  ACPI / video: Add force_native quirk for HP Pavilion dv6
  ACPI / video: Add force_native quirk for Dell XPS 17 L702X
  staging: comedi: ni_mio_common: fix E series ni_ai_insn_read() data
  staging: comedi: ni_mio_common: fix M Series ni_ai_insn_read() data mask
  thermal: hwmon: Properly report critical temperature in sysfs
  clk: bcm2835: Avoid overwriting the div info when disabling a pll_div clk
  timekeeping_Force_unsigned_clocksource_to_nanoseconds_conversion
  regulator: stw481x-vmmc: fix ages old enable error
  mmc: sdhci: Fix recovery from tuning timeout
  ath9k: Really fix LED polarity for some Mini PCI AR9220 MB92 cards.
  cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts
  rtlwifi: Fix enter/exit power_save
  ssb: Fix error routine when fallback SPROM fails
  Linux 4.4.40
  ppp: defer netns reference release for ppp channel
  driver core: fix race between creating/querying glue dir and its cleanup
  xfs: set AGI buffer type in xlog_recover_clear_agi_bucket
  arm/xen: Use alloc_percpu rather than __alloc_percpu
  xen/gntdev: Use VM_MIXEDMAP instead of VM_IO to avoid NUMA balancing
  tpm xen: Remove bogus tpm_chip_unregister
  kernel/debug/debug_core.c: more properly delay for secondary CPUs
  kernel/watchdog: use nmi registers snapshot in hardlockup handler
  CIFS: Fix a possible memory corruption in push locks
  CIFS: Fix missing nls unload in smb2_reconnect()
  CIFS: Fix a possible memory corruption during reconnect
  ASoC: intel: Fix crash at suspend/resume without card registration
  dm space map metadata: fix 'struct sm_metadata' leak on failed create
  dm crypt: mark key as invalid until properly loaded
  dm flakey: return -EINVAL on interval bounds error in flakey_ctr()
  blk-mq: Do not invoke .queue_rq() for a stopped queue
  usb: gadget: composite: always set ep->mult to a sensible value
  exec: Ensure mm->user_ns contains the execed files
  fs: exec: apply CLOEXEC before changing dumpable task flags
  mm/vmscan.c: set correct defer count for shrinker
  loop: return proper error from loop_queue_rq()
  f2fs: set ->owner for debugfs status file's file_operations
  ext4: do not perform data journaling when data is encrypted
  ext4: return -ENOMEM instead of success
  ext4: reject inodes with negative size
  ext4: add sanity checking to count_overhead()
  ext4: fix in-superblock mount options processing
  ext4: use more strict checks for inodes_per_block on mount
  ext4: fix stack memory corruption with 64k block size
  ext4: fix mballoc breakage with 64k block size
  crypto: caam - fix AEAD givenc descriptors
  ptrace: Capture the ptracer's creds not PT_PTRACE_CAP
  mm: Add a user_ns owner to mm_struct and fix ptrace permission checks
  block_dev: don't test bdev->bd_contains when it is not stable
  btrfs: make file clone aware of fatal signals
  Btrfs: don't BUG() during drop snapshot
  Btrfs: fix memory leak in do_walk_down
  Btrfs: don't leak reloc root nodes on error
  Btrfs: return gracefully from balance if fs tree is corrupted
  Btrfs: bail out if block group has different mixed flag
  Btrfs: fix memory leak in reading btree blocks
  clk: ti: omap36xx: Work around sprz319 advisory 2.1
  ALSA: hda: when comparing pin configurations, ignore assoc in addition to seq
  ALSA: hda - Gate the mic jack on HP Z1 Gen3 AiO
  ALSA: hda - fix headset-mic problem on a Dell laptop
  ALSA: hda - ignore the assoc and seq when comparing pin configurations
  ALSA: hda/ca0132 - Add quirk for Alienware 15 R2 2016
  ALSA: hiface: Fix M2Tech hiFace driver sampling rate change
  ALSA: usb-audio: Add QuickCam Communicate Deluxe/S7500 to volume_control_quirks
  USB: UHCI: report non-PME wakeup signalling for Intel hardware
  usb: gadget: composite: correctly initialize ep->maxpacket
  usb: gadget: f_uac2: fix error handling at afunc_bind
  usb: hub: Fix auto-remount of safely removed or ejected USB-3 devices
  USB: cdc-acm: add device id for GW Instek AFG-125
  USB: serial: kl5kusb105: fix open error path
  USB: serial: option: add dlink dwm-158
  USB: serial: option: add support for Telit LE922A PIDs 0x1040, 0x1041
  Btrfs: fix qgroup rescan worker initialization
  btrfs: store and load values of stripes_min/stripes_max in balance status item
  Btrfs: fix tree search logic when replaying directory entry deletes
  btrfs: limit async_work allocation and worker func duration
  ANDROID: trace: net: use %pK for kernel pointers
  ANDROID: android-base: Enable QUOTA related configs
  net: ipv4: Don't crash if passing a null sk to ip_rt_update_pmtu.
  net: inet: Support UID-based routing in IP protocols.
  Revert "net: ipv6: fix virtual tunneling build"
  net: core: add UID to flows, rules, and routes
  net: core: Add a UID field to struct sock.
  Revert "net: core: Support UID-based routing."
  Revert "net: core: Handle 'sk' being NULL in UID-based routing"
  Revert "ANDROID: net: fix 'const' warnings"
  Revert "ANDROID: net: fib: remove duplicate assignment"
  Revert "ANDROID: net: core: fix UID-based routing"
  UPSTREAM: efi/arm64: Don't apply MEMBLOCK_NOMAP to UEFI memory map mapping
  UPSTREAM: arm64: enable CONFIG_DEBUG_RODATA by default
  goldfish: enable CONFIG_INET_DIAG_DESTROY
  sched/walt: kill {min,max}_capacity
  sched: fix wrong truncation of walt_avg
  ANDROID: dm verity: add minimum prefetch size
  Linux 4.4.39
  crypto: rsa - Add Makefile dependencies to fix parallel builds
  hotplug: Make register and unregister notifier API symmetric
  batman-adv: Check for alloc errors when preparing TT local data
  m68k: Fix ndelay() macro
  arm64: futex.h: Add missing PAN toggling
  can: peak: fix bad memory access and free sequence
  can: raw: raw_setsockopt: limit number of can_filter that can be set
  crypto: mcryptd - Check mcryptd algorithm compatibility
  perf/x86: Fix full width counter, counter overflow
  locking/rtmutex: Use READ_ONCE() in rt_mutex_owner()
  locking/rtmutex: Prevent dequeue vs. unlock race
  zram: restrict add/remove attributes to root only
  parisc: Fix TLB related boot crash on SMP machines
  parisc: Remove unnecessary TLB purges from flush_dcache_page_asm and flush_icache_page_asm
  parisc: Purge TLB before setting PTE
  powerpc/eeh: Fix deadlock when PE frozen state can't be cleared

Conflicts:
	arch/arm64/kernel/traps.c
	drivers/usb/dwc3/core.h
	drivers/usb/dwc3/ep0.c
	drivers/usb/gadget/function/f_fs.c
	drivers/usb/host/xhci-mem.c
	drivers/usb/host/xhci-ring.c
	drivers/usb/host/xhci.c
	drivers/video/fbdev/core/fbcmap.c
	include/trace/events/sched.h
	mm/vmscan.c

Change-Id: I3faa0010ecb98972cd8e6470377a493b56d95f89
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Signed-off-by: Runmin Wang <runminw@codeaurora.org>

18 files changed, 101 insertions, 57 deletions

diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index e0b4586a26fd..9b8f0b975ca6 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -223,7 +223,8 @@ static int ast_get_dram_info(struct drm_device *dev)
 	ast_write32(ast, 0x10000, 0xfc600309);
 
 	do {
-		;
+		if (pci_channel_offline(dev->pdev))
+			return -EIO;
 	} while (ast_read32(ast, 0x10000) != 0x01);
 	data = ast_read32(ast, 0x10004);
 
@@ -429,7 +430,9 @@ int ast_driver_load(struct drm_device *dev, unsigned long flags)
 	ast_detect_chip(dev, &need_post);
 
 	if (ast->chip != AST1180) {
-		ast_get_dram_info(dev);
+		ret = ast_get_dram_info(dev);
+		if (ret)
+			goto out_free;
 		ast->vram_size = ast_get_vram_info(dev);
 		DRM_INFO("dram %d %d %d %08x\n", ast->mclk, ast->dram_type, ast->dram_bus_width, ast->vram_size);
 	}
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index 39e30abddf08..71a10f08522e 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1401,6 +1401,13 @@ drm_mode_create_from_cmdline_mode(struct drm_device *dev,
 		return NULL;
 
 	mode->type |= DRM_MODE_TYPE_USERDEF;
+	/* fix up 1368x768: GFT/CVT can't express 1366 width due to alignment */
+	if (cmd->xres == 1366 && mode->hdisplay == 1368) {
+		mode->hdisplay = 1366;
+		mode->hsync_start--;
+		mode->hsync_end--;
+		drm_mode_set_name(mode);
+	}
 	drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
 	return mode;
 }
diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
index 92e7e5795398..db98ab5cde3d 100644
--- a/drivers/gpu/drm/gma500/psb_drv.c
+++ b/drivers/gpu/drm/gma500/psb_drv.c
@@ -484,6 +484,9 @@ static const struct file_operations psb_gem_fops = {
 	.open = drm_open,
 	.release = drm_release,
 	.unlocked_ioctl = psb_unlocked_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl = drm_compat_ioctl,
+#endif
 	.mmap = drm_gem_mmap,
 	.poll = drm_poll,
 	.read = drm_read,
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 97d1ed20418b..63fea6a2869c 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -445,6 +445,7 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
 	struct drm_i915_private *dev_priv = crt->base.base.dev->dev_private;
 	struct edid *edid;
 	struct i2c_adapter *i2c;
+	bool ret = false;
 
 	BUG_ON(crt->base.type != INTEL_OUTPUT_ANALOG);
 
@@ -461,17 +462,17 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
 		 */
 		if (!is_digital) {
 			DRM_DEBUG_KMS("CRT detected via DDC:0x50 [EDID]\n");
-			return true;
+			ret = true;
+		} else {
+			DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
 		}
-
-		DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
 	} else {
 		DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [no valid EDID found]\n");
 	}
 
 	kfree(edid);
 
-	return false;
+	return ret;
 }
 
 static enum drm_connector_status
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 909d1d71d130..4f5d07bb3511 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3948,10 +3948,10 @@ static void page_flip_completed(struct intel_crtc *intel_crtc)
 	drm_crtc_vblank_put(&intel_crtc->base);
 
 	wake_up_all(&dev_priv->pending_flip_queue);
-	queue_work(dev_priv->wq, &work->work);
-
 	trace_i915_flip_complete(intel_crtc->plane,
 				 work->pending_flip_obj);
+
+	queue_work(dev_priv->wq, &work->work);
 }
 
 void intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc)
diff --git a/drivers/gpu/drm/nouveau/dispnv04/hw.c b/drivers/gpu/drm/nouveau/dispnv04/hw.c
index 956a833b8200..57c7389feee4 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/hw.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/hw.c
@@ -222,6 +222,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype)
 		uint32_t mpllP;
 
 		pci_read_config_dword(pci_get_bus_and_slot(0, 3), 0x6c, &mpllP);
+		mpllP = (mpllP >> 8) & 0xf;
 		if (!mpllP)
 			mpllP = 4;
 
@@ -232,7 +233,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype)
 		uint32_t clock;
 
 		pci_read_config_dword(pci_get_bus_and_slot(0, 5), 0x4c, &clock);
-		return clock;
+		return clock / 1000;
 	}
 
 	ret = nouveau_hw_get_pllvals(dev, plltype, &pllvals);
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index 4dca65a63b92..af224fafa21f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -333,6 +333,9 @@ get_fp_strap(struct drm_device *dev, struct nvbios *bios)
 	if (bios->major_version < 5 && bios->data[0x48] & 0x4)
 		return NVReadVgaCrtc5758(dev, 0, 0xf) & 0xf;
 
+	if (drm->device.info.family >= NV_DEVICE_INFO_V0_MAXWELL)
+		return nvif_rd32(device, 0x001800) & 0x0000000f;
+	else
 	if (drm->device.info.family >= NV_DEVICE_INFO_V0_TESLA)
 		return (nvif_rd32(device, NV_PEXTDEV_BOOT_0) >> 24) & 0xf;
 	else
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
index bbc9824af6e0..ece9f4102c0e 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
@@ -1833,7 +1833,7 @@ nvf1_chipset = {
 	.fb = gk104_fb_new,
 	.fuse = gf100_fuse_new,
 	.gpio = gk104_gpio_new,
-	.i2c = gf119_i2c_new,
+	.i2c = gk104_i2c_new,
 	.ibus = gk104_ibus_new,
 	.imem = nv50_instmem_new,
 	.ltc = gk104_ltc_new,
@@ -1941,7 +1941,7 @@ nv117_chipset = {
 	.fb = gm107_fb_new,
 	.fuse = gm107_fuse_new,
 	.gpio = gk104_gpio_new,
-	.i2c = gf119_i2c_new,
+	.i2c = gk104_i2c_new,
 	.ibus = gk104_ibus_new,
 	.imem = nv50_instmem_new,
 	.ltc = gm107_ltc_new,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
index c1590b746f13..eb58cd7bfbc9 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
@@ -59,7 +59,7 @@ gt215_hda_eld(NV50_DISP_MTHD_V1)
 			);
 		}
 		for (i = 0; i < size; i++)
-			nvkm_wr32(device, 0x61c440 + soff, (i << 8) | args->v0.data[0]);
+			nvkm_wr32(device, 0x61c440 + soff, (i << 8) | args->v0.data[i]);
 		for (; i < 0x60; i++)
 			nvkm_wr32(device, 0x61c440 + soff, (i << 8));
 		nvkm_mask(device, 0x61c448 + soff, 0x80000003, 0x80000003);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c
index e7cbc139c1d4..89976ff4b305 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c
@@ -59,6 +59,7 @@ gf100_fifo_gpfifo_engine_fini(struct nvkm_fifo_chan *base,
 	struct nvkm_gpuobj *inst = chan->base.inst;
 	int ret = 0;
 
+	mutex_lock(&subdev->mutex);
 	nvkm_wr32(device, 0x002634, chan->base.chid);
 	if (nvkm_msec(device, 2000,
 		if (nvkm_rd32(device, 0x002634) == chan->base.chid)
@@ -66,10 +67,12 @@ gf100_fifo_gpfifo_engine_fini(struct nvkm_fifo_chan *base,
 	) < 0) {
 		nvkm_error(subdev, "channel %d [%s] kick timeout\n",
 			   chan->base.chid, chan->base.object.client->name);
-		ret = -EBUSY;
-		if (suspend)
-			return ret;
+		ret = -ETIMEDOUT;
 	}
+	mutex_unlock(&subdev->mutex);
+
+	if (ret && suspend)
+		return ret;
 
 	if (offset) {
 		nvkm_kmap(inst);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c
index 0b817540a9e4..aa1692e5669f 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c
@@ -39,7 +39,9 @@ gk104_fifo_gpfifo_kick(struct gk104_fifo_chan *chan)
 	struct nvkm_subdev *subdev = &fifo->base.engine.subdev;
 	struct nvkm_device *device = subdev->device;
 	struct nvkm_client *client = chan->base.object.client;
+	int ret = 0;
 
+	mutex_lock(&subdev->mutex);
 	nvkm_wr32(device, 0x002634, chan->base.chid);
 	if (nvkm_msec(device, 2000,
 		if (!(nvkm_rd32(device, 0x002634) & 0x00100000))
@@ -47,10 +49,10 @@ gk104_fifo_gpfifo_kick(struct gk104_fifo_chan *chan)
 	) < 0) {
 		nvkm_error(subdev, "channel %d [%s] kick timeout\n",
 			   chan->base.chid, client->name);
-		return -EBUSY;
+		ret = -ETIMEDOUT;
 	}
-
-	return 0;
+	mutex_unlock(&subdev->mutex);
+	return ret;
 }
 
 static u32
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h
index 212800ecdce9..7d1d3c6b4b72 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h
@@ -12,6 +12,7 @@ struct nvbios_source {
 	bool rw;
 	bool ignore_checksum;
 	bool no_pcir;
+	bool require_checksum;
 };
 
 int nvbios_extend(struct nvkm_bios *, u32 length);
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
index b2557e87afdd..7deb81b6dbac 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
@@ -86,9 +86,12 @@ shadow_image(struct nvkm_bios *bios, int idx, u32 offset, struct shadow *mthd)
 		    nvbios_checksum(&bios->data[image.base], image.size)) {
 			nvkm_debug(subdev, "%08x: checksum failed\n",
 				   image.base);
-			if (mthd->func->rw)
+			if (!mthd->func->require_checksum) {
+				if (mthd->func->rw)
+					score += 1;
 				score += 1;
-			score += 1;
+			} else
+				return 0;
 		} else {
 			score += 3;
 		}
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c
index 8fecb5ff22a0..06572f8ce914 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c
@@ -99,6 +99,7 @@ nvbios_acpi_fast = {
 	.init = acpi_init,
 	.read = acpi_read_fast,
 	.rw = false,
+	.require_checksum = true,
 };
 
 const struct nvbios_source
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c
index 85b1464c0194..587c52f08d3f 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c
@@ -47,8 +47,10 @@ nvkm_ltc_tags_clear(struct nvkm_ltc *ltc, u32 first, u32 count)
 
 	BUG_ON((first > limit) || (limit >= ltc->num_tags));
 
+	mutex_lock(&ltc->subdev.mutex);
 	ltc->func->cbc_clear(ltc, first, limit);
 	ltc->func->cbc_wait(ltc);
+	mutex_unlock(&ltc->subdev.mutex);
 }
 
 int
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index afaf346bd50e..04cec0da5d1e 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -90,6 +90,9 @@ static void radeon_show_cursor(struct drm_crtc *crtc)
 	struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
 	struct radeon_device *rdev = crtc->dev->dev_private;
 
+	if (radeon_crtc->cursor_out_of_bounds)
+		return;
+
 	if (ASIC_IS_DCE4(rdev)) {
 		WREG32(EVERGREEN_CUR_SURFACE_ADDRESS_HIGH + radeon_crtc->crtc_offset,
 		       upper_32_bits(radeon_crtc->cursor_addr));
@@ -143,21 +146,25 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
 	int xorigin = 0, yorigin = 0;
 	int w = radeon_crtc->cursor_width;
 
+	radeon_crtc->cursor_x = x;
+	radeon_crtc->cursor_y = y;
+
 	if (ASIC_IS_AVIVO(rdev)) {
 		/* avivo cursor are offset into the total surface */
 		x += crtc->x;
 		y += crtc->y;
 	}
-	DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
 
-	if (x < 0) {
+	if (x < 0)
 		xorigin = min(-x, radeon_crtc->max_cursor_width - 1);
-		x = 0;
-	}
-	if (y < 0) {
+	if (y < 0)
 		yorigin = min(-y, radeon_crtc->max_cursor_height - 1);
-		y = 0;
+
+	if (!ASIC_IS_AVIVO(rdev)) {
+		x += crtc->x;
+		y += crtc->y;
 	}
+	DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
 
 	/* fixed on DCE6 and newer */
 	if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE6(rdev)) {
@@ -180,27 +187,31 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
 		if (i > 1) {
 			int cursor_end, frame_end;
 
-			cursor_end = x - xorigin + w;
+			cursor_end = x + w;
 			frame_end = crtc->x + crtc->mode.crtc_hdisplay;
 			if (cursor_end >= frame_end) {
 				w = w - (cursor_end - frame_end);
 				if (!(frame_end & 0x7f))
 					w--;
-			} else {
-				if (!(cursor_end & 0x7f))
-					w--;
+			} else if (cursor_end <= 0) {
+				goto out_of_bounds;
+			} else if (!(cursor_end & 0x7f)) {
+				w--;
 			}
 			if (w <= 0) {
-				w = 1;
-				cursor_end = x - xorigin + w;
-				if (!(cursor_end & 0x7f)) {
-					x--;
-					WARN_ON_ONCE(x < 0);
-				}
+				goto out_of_bounds;
 			}
 		}
 	}
 
+	if (x <= (crtc->x - w) || y <= (crtc->y - radeon_crtc->cursor_height) ||
+	    x >= (crtc->x + crtc->mode.crtc_hdisplay) ||
+	    y >= (crtc->y + crtc->mode.crtc_vdisplay))
+		goto out_of_bounds;
+
+	x += xorigin;
+	y += yorigin;
+
 	if (ASIC_IS_DCE4(rdev)) {
 		WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset, (x << 16) | y);
 		WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin);
@@ -212,6 +223,9 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
 		WREG32(AVIVO_D1CUR_SIZE + radeon_crtc->crtc_offset,
 		       ((w - 1) << 16) | (radeon_crtc->cursor_height - 1));
 	} else {
+		x -= crtc->x;
+		y -= crtc->y;
+
 		if (crtc->mode.flags & DRM_MODE_FLAG_DBLSCAN)
 			y *= 2;
 
@@ -229,10 +243,20 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
 		       yorigin * 256);
 	}
 
-	radeon_crtc->cursor_x = x;
-	radeon_crtc->cursor_y = y;
+	if (radeon_crtc->cursor_out_of_bounds) {
+		radeon_crtc->cursor_out_of_bounds = false;
+		if (radeon_crtc->cursor_bo)
+			radeon_show_cursor(crtc);
+	}
 
 	return 0;
+
+ out_of_bounds:
+	if (!radeon_crtc->cursor_out_of_bounds) {
+		radeon_hide_cursor(crtc);
+		radeon_crtc->cursor_out_of_bounds = true;
+	}
+	return 0;
 }
 
 int radeon_crtc_cursor_move(struct drm_crtc *crtc,
@@ -297,22 +321,23 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
 		return ret;
 	}
 
-	radeon_crtc->cursor_width = width;
-	radeon_crtc->cursor_height = height;
-
 	radeon_lock_cursor(crtc, true);
 
-	if (hot_x != radeon_crtc->cursor_hot_x ||
+	if (width != radeon_crtc->cursor_width ||
+	    height != radeon_crtc->cursor_height ||
+	    hot_x != radeon_crtc->cursor_hot_x ||
 	    hot_y != radeon_crtc->cursor_hot_y) {
 		int x, y;
 
 		x = radeon_crtc->cursor_x + radeon_crtc->cursor_hot_x - hot_x;
 		y = radeon_crtc->cursor_y + radeon_crtc->cursor_hot_y - hot_y;
 
-		radeon_cursor_move_locked(crtc, x, y);
-
+		radeon_crtc->cursor_width = width;
+		radeon_crtc->cursor_height = height;
 		radeon_crtc->cursor_hot_x = hot_x;
 		radeon_crtc->cursor_hot_y = hot_y;
+
+		radeon_cursor_move_locked(crtc, x, y);
 	}
 
 	radeon_show_cursor(crtc);
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 7a0666ac4e23..d8f8be608c19 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -330,6 +330,7 @@ struct radeon_crtc {
 	u16 lut_r[256], lut_g[256], lut_b[256];
 	bool enabled;
 	bool can_tile;
+	bool cursor_out_of_bounds;
 	uint32_t crtc_offset;
 	struct drm_gem_object *cursor_bo;
 	uint64_t cursor_addr;
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 10191b935937..b6f16804e73b 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -3008,24 +3008,12 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
 		    (rdev->pdev->device == 0x6817) ||
 		    (rdev->pdev->device == 0x6806))
 			max_mclk = 120000;
-	} else if (rdev->family == CHIP_VERDE) {
-		if ((rdev->pdev->revision == 0x81) ||
-		    (rdev->pdev->revision == 0x83) ||
-		    (rdev->pdev->revision == 0x87) ||
-		    (rdev->pdev->device == 0x6820) ||
-		    (rdev->pdev->device == 0x6821) ||
-		    (rdev->pdev->device == 0x6822) ||
-		    (rdev->pdev->device == 0x6823) ||
-		    (rdev->pdev->device == 0x682A) ||
-		    (rdev->pdev->device == 0x682B)) {
-			max_sclk = 75000;
-			max_mclk = 80000;
-		}
 	} else if (rdev->family == CHIP_OLAND) {
 		if ((rdev->pdev->revision == 0xC7) ||
 		    (rdev->pdev->revision == 0x80) ||
 		    (rdev->pdev->revision == 0x81) ||
 		    (rdev->pdev->revision == 0x83) ||
+		    (rdev->pdev->revision == 0x87) ||
 		    (rdev->pdev->device == 0x6604) ||
 		    (rdev->pdev->device == 0x6605)) {
 			max_sclk = 75000;