diff --git a/patches/1796-i2c-dev-mark-RDWR-buffers-as-DMA_SAFE.patch b/patches/1796-i2c-dev-mark-RDWR-buffers-as-DMA_SAFE.patch
new file mode 100644
index 0000000..2c59a43
--- /dev/null
+++ b/patches/1796-i2c-dev-mark-RDWR-buffers-as-DMA_SAFE.patch
@@ -0,0 +1,31 @@
+From ea90bb0932a3d794b6a0c544bda87ee8758d20f0 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Sat, 4 Nov 2017 21:20:03 +0100
+Subject: [PATCH 1796/1808] i2c: dev: mark RDWR buffers as DMA_SAFE
+
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+(cherry picked from commit 978336d48d887d6deb7793e0d20a4673f357fb8e)
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+---
+ drivers/i2c/i2c-dev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
+index 6f638bbc922d..bbc7aadb4c89 100644
+--- a/drivers/i2c/i2c-dev.c
++++ b/drivers/i2c/i2c-dev.c
+@@ -280,6 +280,8 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,
+ 			res = PTR_ERR(rdwr_pa[i].buf);
+ 			break;
+ 		}
++		/* memdup_user allocates with GFP_KERNEL, so DMA is ok */
++		rdwr_pa[i].flags |= I2C_M_DMA_SAFE;
+ 
+ 		/*
+ 		 * If the message length is received from the slave (similar
+-- 
+2.17.1
+
diff --git a/patches/1797-i2c-refactor-i2c_master_-send_recv.patch b/patches/1797-i2c-refactor-i2c_master_-send_recv.patch
new file mode 100644
index 0000000..d1f4c8c
--- /dev/null
+++ b/patches/1797-i2c-refactor-i2c_master_-send_recv.patch
@@ -0,0 +1,157 @@
+From 8c45d7790ba3fba2de5452e2da9f2a57cfc9cff5 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Sat, 4 Nov 2017 21:20:04 +0100
+Subject: [PATCH 1797/1808] i2c: refactor i2c_master_{send_recv}
+
+Those two functions are very similar, the only differences are that one
+needs the I2C_M_RD flag for its message while the other one needs the
+buffer casted to drop the const. Introduce a generic helper which allows
+to specify the flags (also needed later for DMA safe variants of these
+calls) and let the casting be done in the inlining functions which are
+now calling the new helper function.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+(cherry picked from commit 8a91732b3b33454d8034e7be5c8342f028ea772e)
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+---
+ drivers/i2c/i2c-core-base.c | 64 +++++++++++--------------------------
+ include/linux/i2c.h         | 34 +++++++++++++++++---
+ 2 files changed, 48 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 50b8c9cbd139..e83bcabc6923 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -2018,63 +2018,35 @@ int i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ EXPORT_SYMBOL(i2c_transfer);
+ 
+ /**
+- * i2c_master_send - issue a single I2C message in master transmit mode
++ * i2c_transfer_buffer_flags - issue a single I2C message transferring data
++ *			       to/from a buffer
+  * @client: Handle to slave device
+- * @buf: Data that will be written to the slave
+- * @count: How many bytes to write, must be less than 64k since msg.len is u16
++ * @buf: Where the data is stored
++ * @count: How many bytes to transfer, must be less than 64k since msg.len is u16
++ * @flags: The flags to be used for the message, e.g. I2C_M_RD for reads
+  *
+- * Returns negative errno, or else the number of bytes written.
++ * Returns negative errno, or else the number of bytes transferred.
+  */
+-int i2c_master_send(const struct i2c_client *client, const char *buf, int count)
++int i2c_transfer_buffer_flags(const struct i2c_client *client, char *buf,
++			      int count, u16 flags)
+ {
+ 	int ret;
+-	struct i2c_adapter *adap = client->adapter;
+-	struct i2c_msg msg;
+-
+-	msg.addr = client->addr;
+-	msg.flags = client->flags & I2C_M_TEN;
+-	msg.len = count;
+-	msg.buf = (char *)buf;
+-
+-	ret = i2c_transfer(adap, &msg, 1);
+-
+-	/*
+-	 * If everything went ok (i.e. 1 msg transmitted), return #bytes
+-	 * transmitted, else error code.
+-	 */
+-	return (ret == 1) ? count : ret;
+-}
+-EXPORT_SYMBOL(i2c_master_send);
+-
+-/**
+- * i2c_master_recv - issue a single I2C message in master receive mode
+- * @client: Handle to slave device
+- * @buf: Where to store data read from slave
+- * @count: How many bytes to read, must be less than 64k since msg.len is u16
+- *
+- * Returns negative errno, or else the number of bytes read.
+- */
+-int i2c_master_recv(const struct i2c_client *client, char *buf, int count)
+-{
+-	struct i2c_adapter *adap = client->adapter;
+-	struct i2c_msg msg;
+-	int ret;
+-
+-	msg.addr = client->addr;
+-	msg.flags = client->flags & I2C_M_TEN;
+-	msg.flags |= I2C_M_RD;
+-	msg.len = count;
+-	msg.buf = buf;
++	struct i2c_msg msg = {
++		.addr = client->addr,
++		.flags = flags | (client->flags & I2C_M_TEN),
++		.len = count,
++		.buf = buf,
++	};
+ 
+-	ret = i2c_transfer(adap, &msg, 1);
++	ret = i2c_transfer(client->adapter, &msg, 1);
+ 
+ 	/*
+-	 * If everything went ok (i.e. 1 msg received), return #bytes received,
+-	 * else error code.
++	 * If everything went ok (i.e. 1 msg transferred), return #bytes
++	 * transferred, else error code.
+ 	 */
+ 	return (ret == 1) ? count : ret;
+ }
+-EXPORT_SYMBOL(i2c_master_recv);
++EXPORT_SYMBOL(i2c_transfer_buffer_flags);
+ 
+ /* ----------------------------------------------------
+  * the i2c address scanning function
+diff --git a/include/linux/i2c.h b/include/linux/i2c.h
+index c3387435e55f..375392c3c2c0 100644
+--- a/include/linux/i2c.h
++++ b/include/linux/i2c.h
+@@ -63,10 +63,36 @@ struct property_entry;
+  * transmit an arbitrary number of messages without interruption.
+  * @count must be be less than 64k since msg.len is u16.
+  */
+-extern int i2c_master_send(const struct i2c_client *client, const char *buf,
+-			   int count);
+-extern int i2c_master_recv(const struct i2c_client *client, char *buf,
+-			   int count);
++extern int i2c_transfer_buffer_flags(const struct i2c_client *client,
++				     char *buf, int count, u16 flags);
++
++/**
++ * i2c_master_recv - issue a single I2C message in master receive mode
++ * @client: Handle to slave device
++ * @buf: Where to store data read from slave
++ * @count: How many bytes to read, must be less than 64k since msg.len is u16
++ *
++ * Returns negative errno, or else the number of bytes read.
++ */
++static inline int i2c_master_recv(const struct i2c_client *client,
++				  char *buf, int count)
++{
++	return i2c_transfer_buffer_flags(client, buf, count, I2C_M_RD);
++};
++
++/**
++ * i2c_master_send - issue a single I2C message in master transmit mode
++ * @client: Handle to slave device
++ * @buf: Data that will be written to the slave
++ * @count: How many bytes to write, must be less than 64k since msg.len is u16
++ *
++ * Returns negative errno, or else the number of bytes written.
++ */
++static inline int i2c_master_send(const struct i2c_client *client,
++				  const char *buf, int count)
++{
++	return i2c_transfer_buffer_flags(client, (char *)buf, count, 0);
++};
+ 
+ /* Transfer num messages.
+  */
+-- 
+2.17.1
+
diff --git a/patches/1798-i2c-add-i2c_master_-send-recv-_dmasafe.patch b/patches/1798-i2c-add-i2c_master_-send-recv-_dmasafe.patch
new file mode 100644
index 0000000..193b5b7
--- /dev/null
+++ b/patches/1798-i2c-add-i2c_master_-send-recv-_dmasafe.patch
@@ -0,0 +1,71 @@
+From e25f98864b047a55098b572bc606c5908cb0d3ef Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Sat, 4 Nov 2017 21:20:05 +0100
+Subject: [PATCH 1798/1808] i2c: add i2c_master_{send|recv}_dmasafe
+
+Use the new helper to create variants of i2c_master_{send|recv} which
+mark their buffers as DMA safe.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+(cherry picked from commit ba98645c7d54640f163096cda3609d4d55c6ae54)
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+---
+ include/linux/i2c.h | 32 ++++++++++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+diff --git a/include/linux/i2c.h b/include/linux/i2c.h
+index 375392c3c2c0..a099c3af7721 100644
+--- a/include/linux/i2c.h
++++ b/include/linux/i2c.h
+@@ -80,6 +80,22 @@ static inline int i2c_master_recv(const struct i2c_client *client,
+ 	return i2c_transfer_buffer_flags(client, buf, count, I2C_M_RD);
+ };
+ 
++/**
++ * i2c_master_recv_dmasafe - issue a single I2C message in master receive mode
++ *			     using a DMA safe buffer
++ * @client: Handle to slave device
++ * @buf: Where to store data read from slave, must be safe to use with DMA
++ * @count: How many bytes to read, must be less than 64k since msg.len is u16
++ *
++ * Returns negative errno, or else the number of bytes read.
++ */
++static inline int i2c_master_recv_dmasafe(const struct i2c_client *client,
++					  char *buf, int count)
++{
++	return i2c_transfer_buffer_flags(client, buf, count,
++					 I2C_M_RD | I2C_M_DMA_SAFE);
++};
++
+ /**
+  * i2c_master_send - issue a single I2C message in master transmit mode
+  * @client: Handle to slave device
+@@ -94,6 +110,22 @@ static inline int i2c_master_send(const struct i2c_client *client,
+ 	return i2c_transfer_buffer_flags(client, (char *)buf, count, 0);
+ };
+ 
++/**
++ * i2c_master_send_dmasafe - issue a single I2C message in master transmit mode
++ *			     using a DMA safe buffer
++ * @client: Handle to slave device
++ * @buf: Data that will be written to the slave, must be safe to use with DMA
++ * @count: How many bytes to write, must be less than 64k since msg.len is u16
++ *
++ * Returns negative errno, or else the number of bytes written.
++ */
++static inline int i2c_master_send_dmasafe(const struct i2c_client *client,
++					  const char *buf, int count)
++{
++	return i2c_transfer_buffer_flags(client, (char *)buf, count,
++					 I2C_M_DMA_SAFE);
++};
++
+ /* Transfer num messages.
+  */
+ extern int i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
+-- 
+2.17.1
+
diff --git a/patches/1799-i2c-smbus-use-DMA-safe-buffers-for-emulated-SMBus-tr.patch b/patches/1799-i2c-smbus-use-DMA-safe-buffers-for-emulated-SMBus-tr.patch
new file mode 100644
index 0000000..57a49d8
--- /dev/null
+++ b/patches/1799-i2c-smbus-use-DMA-safe-buffers-for-emulated-SMBus-tr.patch
@@ -0,0 +1,134 @@
+From 14e196f1a1c977e8d4a46b4cef3bf48db312f285 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Sat, 4 Nov 2017 21:20:06 +0100
+Subject: [PATCH 1799/1808] i2c: smbus: use DMA safe buffers for emulated SMBus
+ transactions
+
+For all block commands, try to allocate a DMA safe buffer and mark it
+accordingly. Only use the stack, if the buffers cannot be allocated.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+(cherry picked from commit 8a77821e74d6d5ba2eacd4b450684ae6cbe012a0)
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+---
+ drivers/i2c/i2c-core-smbus.c | 45 +++++++++++++++++++++++++++++++-----
+ 1 file changed, 39 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c
+index e54a9b835b62..9acb643798eb 100644
+--- a/drivers/i2c/i2c-core-smbus.c
++++ b/drivers/i2c/i2c-core-smbus.c
+@@ -17,6 +17,7 @@
+ #include <linux/device.h>
+ #include <linux/err.h>
+ #include <linux/i2c.h>
++#include <linux/slab.h>
+ 
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/smbus.h>
+@@ -290,6 +291,22 @@ s32 i2c_smbus_write_i2c_block_data(const struct i2c_client *client, u8 command,
+ }
+ EXPORT_SYMBOL(i2c_smbus_write_i2c_block_data);
+ 
++static void i2c_smbus_try_get_dmabuf(struct i2c_msg *msg, u8 init_val)
++{
++	bool is_read = msg->flags & I2C_M_RD;
++	unsigned char *dma_buf;
++
++	dma_buf = kzalloc(I2C_SMBUS_BLOCK_MAX + (is_read ? 2 : 3), GFP_KERNEL);
++	if (!dma_buf)
++		return;
++
++	msg->buf = dma_buf;
++	msg->flags |= I2C_M_DMA_SAFE;
++
++	if (init_val)
++		msg->buf[0] = init_val;
++}
++
+ /* Simulate a SMBus command using the i2c protocol
+    No checking of parameters is done!  */
+ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
+@@ -367,6 +384,7 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
+ 			msg[1].flags |= I2C_M_RECV_LEN;
+ 			msg[1].len = 1; /* block length will be added by
+ 					   the underlying bus driver */
++			i2c_smbus_try_get_dmabuf(&msg[1], 0);
+ 		} else {
+ 			msg[0].len = data->block[0] + 2;
+ 			if (msg[0].len > I2C_SMBUS_BLOCK_MAX + 2) {
+@@ -375,8 +393,10 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
+ 					data->block[0]);
+ 				return -EINVAL;
+ 			}
++
++			i2c_smbus_try_get_dmabuf(&msg[0], command);
+ 			for (i = 1; i < msg[0].len; i++)
+-				msgbuf0[i] = data->block[i-1];
++				msg[0].buf[i] = data->block[i - 1];
+ 		}
+ 		break;
+ 	case I2C_SMBUS_BLOCK_PROC_CALL:
+@@ -388,12 +408,16 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
+ 				data->block[0]);
+ 			return -EINVAL;
+ 		}
++
+ 		msg[0].len = data->block[0] + 2;
++		i2c_smbus_try_get_dmabuf(&msg[0], command);
+ 		for (i = 1; i < msg[0].len; i++)
+-			msgbuf0[i] = data->block[i-1];
++			msg[0].buf[i] = data->block[i - 1];
++
+ 		msg[1].flags |= I2C_M_RECV_LEN;
+ 		msg[1].len = 1; /* block length will be added by
+ 				   the underlying bus driver */
++		i2c_smbus_try_get_dmabuf(&msg[1], 0);
+ 		break;
+ 	case I2C_SMBUS_I2C_BLOCK_DATA:
+ 		if (data->block[0] > I2C_SMBUS_BLOCK_MAX) {
+@@ -405,10 +429,13 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
+ 
+ 		if (read_write == I2C_SMBUS_READ) {
+ 			msg[1].len = data->block[0];
++			i2c_smbus_try_get_dmabuf(&msg[1], 0);
+ 		} else {
+ 			msg[0].len = data->block[0] + 1;
++
++			i2c_smbus_try_get_dmabuf(&msg[0], command);
+ 			for (i = 1; i <= data->block[0]; i++)
+-				msgbuf0[i] = data->block[i];
++				msg[0].buf[i] = data->block[i];
+ 		}
+ 		break;
+ 	default:
+@@ -456,14 +483,20 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
+ 			break;
+ 		case I2C_SMBUS_I2C_BLOCK_DATA:
+ 			for (i = 0; i < data->block[0]; i++)
+-				data->block[i+1] = msgbuf1[i];
++				data->block[i + 1] = msg[1].buf[i];
+ 			break;
+ 		case I2C_SMBUS_BLOCK_DATA:
+ 		case I2C_SMBUS_BLOCK_PROC_CALL:
+-			for (i = 0; i < msgbuf1[0] + 1; i++)
+-				data->block[i] = msgbuf1[i];
++			for (i = 0; i < msg[1].buf[0] + 1; i++)
++				data->block[i] = msg[1].buf[i];
+ 			break;
+ 		}
++
++	if (msg[0].flags & I2C_M_DMA_SAFE)
++		kfree(msg[0].buf);
++	if (msg[1].flags & I2C_M_DMA_SAFE)
++		kfree(msg[1].buf);
++
+ 	return 0;
+ }
+ 
+-- 
+2.17.1
+
diff --git a/patches/1800-i2c-add-docs-to-clarify-DMA-handling.patch b/patches/1800-i2c-add-docs-to-clarify-DMA-handling.patch
new file mode 100644
index 0000000..c48a009
--- /dev/null
+++ b/patches/1800-i2c-add-docs-to-clarify-DMA-handling.patch
@@ -0,0 +1,93 @@
+From 384888707323e7ffcfff10dccf5dbf64cd21e2a7 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Sat, 4 Nov 2017 21:20:07 +0100
+Subject: [PATCH 1800/1808] i2c: add docs to clarify DMA handling
+
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Reviewed-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+(cherry picked from commit d4e01186ae1c6045b5a508741f2446dffec7511c)
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+---
+ Documentation/i2c/DMA-considerations | 67 ++++++++++++++++++++++++++++
+ 1 file changed, 67 insertions(+)
+ create mode 100644 Documentation/i2c/DMA-considerations
+
+diff --git a/Documentation/i2c/DMA-considerations b/Documentation/i2c/DMA-considerations
+new file mode 100644
+index 000000000000..966610aa4620
+--- /dev/null
++++ b/Documentation/i2c/DMA-considerations
+@@ -0,0 +1,67 @@
++=================
++Linux I2C and DMA
++=================
++
++Given that i2c is a low-speed bus, over which the majority of messages
++transferred are small, it is not considered a prime user of DMA access. At this
++time of writing, only 10% of I2C bus master drivers have DMA support
++implemented. And the vast majority of transactions are so small that setting up
++DMA for it will likely add more overhead than a plain PIO transfer.
++
++Therefore, it is *not* mandatory that the buffer of an I2C message is DMA safe.
++It does not seem reasonable to apply additional burdens when the feature is so
++rarely used. However, it is recommended to use a DMA-safe buffer if your
++message size is likely applicable for DMA. Most drivers have this threshold
++around 8 bytes (as of today, this is mostly an educated guess, however). For
++any message of 16 byte or larger, it is probably a really good idea. Please
++note that other subsystems you use might add requirements. E.g., if your
++I2C bus master driver is using USB as a bridge, then you need to have DMA
++safe buffers always, because USB requires it.
++
++Clients
++-------
++
++For clients, if you use a DMA safe buffer in i2c_msg, set the I2C_M_DMA_SAFE
++flag with it. Then, the I2C core and drivers know they can safely operate DMA
++on it. Note that using this flag is optional. I2C host drivers which are not
++updated to use this flag will work like before. And like before, they risk
++using an unsafe DMA buffer. To improve this situation, using I2C_M_DMA_SAFE in
++more and more clients and host drivers is the planned way forward. Note also
++that setting this flag makes only sense in kernel space. User space data is
++copied into kernel space anyhow. The I2C core makes sure the destination
++buffers in kernel space are always DMA capable. Also, when the core emulates
++SMBus transactions via I2C, the buffers for block transfers are DMA safe. Users
++of i2c_master_send() and i2c_master_recv() functions can now use DMA safe
++variants (i2c_master_send_dmasafe() and i2c_master_recv_dmasafe()) once they
++know their buffers are DMA safe. Users of i2c_transfer() must set the
++I2C_M_DMA_SAFE flag manually.
++
++Masters
++-------
++
++Bus master drivers wishing to implement safe DMA can use helper functions from
++the I2C core. One gives you a DMA-safe buffer for a given i2c_msg as long as a
++certain threshold is met::
++
++	dma_buf = i2c_get_dma_safe_msg_buf(msg, threshold_in_byte);
++
++If a buffer is returned, it is either msg->buf for the I2C_M_DMA_SAFE case or a
++bounce buffer. But you don't need to care about that detail, just use the
++returned buffer. If NULL is returned, the threshold was not met or a bounce
++buffer could not be allocated. Fall back to PIO in that case.
++
++In any case, a buffer obtained from above needs to be released. It ensures data
++is copied back to the message and a potentially used bounce buffer is freed::
++
++	i2c_release_dma_safe_msg_buf(msg, dma_buf);
++
++The bounce buffer handling from the core is generic and simple. It will always
++allocate a new bounce buffer. If you want a more sophisticated handling (e.g.
++reusing pre-allocated buffers), you are free to implement your own.
++
++Please also check the in-kernel documentation for details. The i2c-sh_mobile
++driver can be used as a reference example how to use the above helpers.
++
++Final note: If you plan to use DMA with I2C (or with anything else, actually)
++make sure you have CONFIG_DMA_API_DEBUG enabled during development. It can help
++you find various issues which can be complex to debug otherwise.
+-- 
+2.17.1
+
diff --git a/patches/1801-i2c-core-smbus-fix-a-potential-missing-check-bug.patch b/patches/1801-i2c-core-smbus-fix-a-potential-missing-check-bug.patch
new file mode 100644
index 0000000..6201fbc
--- /dev/null
+++ b/patches/1801-i2c-core-smbus-fix-a-potential-missing-check-bug.patch
@@ -0,0 +1,46 @@
+From 6a59f36557bdca43a93bfa3de8be6b984248d29e Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wang6495@umn.edu>
+Date: Sat, 5 May 2018 08:02:21 -0500
+Subject: [PATCH 1801/1808] i2c: core: smbus: fix a potential missing-check bug
+
+In i2c_smbus_xfer_emulated(), the function i2c_transfer() is invoked to
+transfer i2c messages. The number of actual transferred messages is
+returned and saved to 'status'. If 'status' is negative, that means an
+error occurred during the transfer process. In that case, the value of
+'status' is an error code to indicate the reason of the transfer failure.
+In most cases, i2c_transfer() can transfer 'num' messages with no error.
+And so 'status' == 'num'. However, due to unexpected errors, it is probable
+that only partial messages are transferred by i2c_transfer(). As a result,
+'status' != 'num'. This special case is not checked after the invocation of
+i2c_transfer() and can potentially lead to unexpected issues in the
+following execution since it is expected that 'status' == 'num'.
+
+This patch checks the return value of i2c_transfer() and returns an error
+code -EIO if the number of actual transferred messages 'status' is not
+equal to 'num'.
+
+Signed-off-by: Wenwen Wang <wang6495@umn.edu>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+(cherry picked from commit 8e03477cb709b73a2c1e1f4349ee3b7b33c50416)
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+---
+ drivers/i2c/i2c-core-smbus.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c
+index 9acb643798eb..60b1ee21709c 100644
+--- a/drivers/i2c/i2c-core-smbus.c
++++ b/drivers/i2c/i2c-core-smbus.c
+@@ -461,6 +461,8 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
+ 	status = i2c_transfer(adapter, msg, num);
+ 	if (status < 0)
+ 		return status;
++	if (status != num)
++		return -EIO;
+ 
+ 	/* Check PEC if last message is a read */
+ 	if (i && (msg[num-1].flags & I2C_M_RD)) {
+-- 
+2.17.1
+
diff --git a/patches/1802-i2c-smbus-kill-memory-leak-on-emulated-and-failed-DM.patch b/patches/1802-i2c-smbus-kill-memory-leak-on-emulated-and-failed-DM.patch
new file mode 100644
index 0000000..2b1c60d
--- /dev/null
+++ b/patches/1802-i2c-smbus-kill-memory-leak-on-emulated-and-failed-DM.patch
@@ -0,0 +1,65 @@
+From 38f5ca39c7a006988a77c6caadf341363aa6cbb4 Mon Sep 17 00:00:00 2001
+From: Peter Rosin <peda@axentia.se>
+Date: Wed, 20 Jun 2018 11:43:23 +0200
+Subject: [PATCH 1802/1808] i2c: smbus: kill memory leak on emulated and failed
+ DMA SMBus xfers
+
+If DMA safe memory was allocated, but the subsequent I2C transfer
+fails the memory is leaked. Plug this leak.
+
+Fixes: 8a77821e74d6 ("i2c: smbus: use DMA safe buffers for emulated SMBus transactions")
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Cc: stable@kernel.org
+(cherry picked from commit 9aa613674f89d01248ae2e4afe691b515ff8fbb6)
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+---
+ drivers/i2c/i2c-core-smbus.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c
+index 60b1ee21709c..663173d347cb 100644
+--- a/drivers/i2c/i2c-core-smbus.c
++++ b/drivers/i2c/i2c-core-smbus.c
+@@ -460,15 +460,18 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
+ 
+ 	status = i2c_transfer(adapter, msg, num);
+ 	if (status < 0)
+-		return status;
+-	if (status != num)
+-		return -EIO;
++		goto cleanup;
++	if (status != num) {
++		status = -EIO;
++		goto cleanup;
++	}
++	status = 0;
+ 
+ 	/* Check PEC if last message is a read */
+ 	if (i && (msg[num-1].flags & I2C_M_RD)) {
+ 		status = i2c_smbus_check_pec(partial_pec, &msg[num-1]);
+ 		if (status < 0)
+-			return status;
++			goto cleanup;
+ 	}
+ 
+ 	if (read_write == I2C_SMBUS_READ)
+@@ -494,12 +497,13 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
+ 			break;
+ 		}
+ 
++cleanup:
+ 	if (msg[0].flags & I2C_M_DMA_SAFE)
+ 		kfree(msg[0].buf);
+ 	if (msg[1].flags & I2C_M_DMA_SAFE)
+ 		kfree(msg[1].buf);
+ 
+-	return 0;
++	return status;
+ }
+ 
+ /**
+-- 
+2.17.1
+
diff --git a/patches/1803-i2c-refactor-function-to-release-a-DMA-safe-buffer.patch b/patches/1803-i2c-refactor-function-to-release-a-DMA-safe-buffer.patch
new file mode 100644
index 0000000..20465e7
--- /dev/null
+++ b/patches/1803-i2c-refactor-function-to-release-a-DMA-safe-buffer.patch
@@ -0,0 +1,114 @@
+From 831d029ef1d982b492e26d7d10e64d26f73cdc6b Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Fri, 24 Aug 2018 16:52:44 +0200
+Subject: [PATCH 1803/1808] i2c: refactor function to release a DMA safe buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+a) rename to 'put' instead of 'release' to match 'get' when obtaining
+   the buffer
+b) change the argument order to have the buffer as first argument
+c) add a new argument telling the function if the message was
+   transferred. This allows the function to be used also in cases
+   where setting up DMA failed, so the buffer needs to be freed without
+   syncing to the message buffer.
+
+Also convert the only user.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+(cherry picked from commit 82fe39a6bc7b866fc3ffd838e3c5a4cadb328b04)
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+---
+ Documentation/i2c/DMA-considerations | 10 +++++++---
+ drivers/i2c/busses/i2c-sh_mobile.c   |  2 +-
+ drivers/i2c/i2c-core-base.c          | 11 ++++++-----
+ include/linux/i2c.h                  |  2 +-
+ 4 files changed, 15 insertions(+), 10 deletions(-)
+
+diff --git a/Documentation/i2c/DMA-considerations b/Documentation/i2c/DMA-considerations
+index 966610aa4620..203002054120 100644
+--- a/Documentation/i2c/DMA-considerations
++++ b/Documentation/i2c/DMA-considerations
+@@ -50,10 +50,14 @@ bounce buffer. But you don't need to care about that detail, just use the
+ returned buffer. If NULL is returned, the threshold was not met or a bounce
+ buffer could not be allocated. Fall back to PIO in that case.
+ 
+-In any case, a buffer obtained from above needs to be released. It ensures data
+-is copied back to the message and a potentially used bounce buffer is freed::
++In any case, a buffer obtained from above needs to be released. Another helper
++function ensures a potentially used bounce buffer is freed::
+ 
+-	i2c_release_dma_safe_msg_buf(msg, dma_buf);
++	i2c_put_dma_safe_msg_buf(dma_buf, msg, xferred);
++
++The last argument 'xferred' controls if the buffer is synced back to the
++message or not. No syncing is needed in cases setting up DMA had an error and
++there was no data transferred.
+ 
+ The bounce buffer handling from the core is generic and simple. It will always
+ allocate a new bounce buffer. If you want a more sophisticated handling (e.g.
+diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
+index 5fda4188a9e5..5e22d55ea57b 100644
+--- a/drivers/i2c/busses/i2c-sh_mobile.c
++++ b/drivers/i2c/busses/i2c-sh_mobile.c
+@@ -515,7 +515,7 @@ static void sh_mobile_i2c_dma_callback(void *data)
+ 	pd->pos = pd->msg->len;
+ 	pd->stop_after_dma = true;
+ 
+-	i2c_release_dma_safe_msg_buf(pd->msg, pd->dma_buf);
++	i2c_put_dma_safe_msg_buf(pd->dma_buf, pd->msg, true);
+ 
+ 	iic_set_clr(pd, ICIC, 0, ICIC_TDMAE | ICIC_RDMAE);
+ }
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index e83bcabc6923..8109170c30e1 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -2309,21 +2309,22 @@ u8 *i2c_get_dma_safe_msg_buf(struct i2c_msg *msg, unsigned int threshold)
+ EXPORT_SYMBOL_GPL(i2c_get_dma_safe_msg_buf);
+ 
+ /**
+- * i2c_release_dma_safe_msg_buf - release DMA safe buffer and sync with i2c_msg
+- * @msg: the message to be synced with
++ * i2c_put_dma_safe_msg_buf - release DMA safe buffer and sync with i2c_msg
+  * @buf: the buffer obtained from i2c_get_dma_safe_msg_buf(). May be NULL.
++ * @msg: the message which the buffer corresponds to
++ * @xferred: bool saying if the message was transferred
+  */
+-void i2c_release_dma_safe_msg_buf(struct i2c_msg *msg, u8 *buf)
++void i2c_put_dma_safe_msg_buf(u8 *buf, struct i2c_msg *msg, bool xferred)
+ {
+ 	if (!buf || buf == msg->buf)
+ 		return;
+ 
+-	if (msg->flags & I2C_M_RD)
++	if (xferred && msg->flags & I2C_M_RD)
+ 		memcpy(msg->buf, buf, msg->len);
+ 
+ 	kfree(buf);
+ }
+-EXPORT_SYMBOL_GPL(i2c_release_dma_safe_msg_buf);
++EXPORT_SYMBOL_GPL(i2c_put_dma_safe_msg_buf);
+ 
+ MODULE_AUTHOR("Simon G. Vogl <simon@tk.uni-linz.ac.at>");
+ MODULE_DESCRIPTION("I2C-Bus main module");
+diff --git a/include/linux/i2c.h b/include/linux/i2c.h
+index a099c3af7721..98a05179b1a5 100644
+--- a/include/linux/i2c.h
++++ b/include/linux/i2c.h
+@@ -837,7 +837,7 @@ static inline u8 i2c_8bit_addr_from_msg(const struct i2c_msg *msg)
+ }
+ 
+ u8 *i2c_get_dma_safe_msg_buf(struct i2c_msg *msg, unsigned int threshold);
+-void i2c_release_dma_safe_msg_buf(struct i2c_msg *msg, u8 *buf);
++void i2c_put_dma_safe_msg_buf(u8 *buf, struct i2c_msg *msg, bool xferred);
+ 
+ int i2c_handle_smbus_host_notify(struct i2c_adapter *adap, unsigned short addr);
+ /**
+-- 
+2.17.1
+
diff --git a/patches/1804-i2c-sh_mobile-fix-leak-when-using-DMA-bounce-buffer.patch b/patches/1804-i2c-sh_mobile-fix-leak-when-using-DMA-bounce-buffer.patch
new file mode 100644
index 0000000..0fdd46a
--- /dev/null
+++ b/patches/1804-i2c-sh_mobile-fix-leak-when-using-DMA-bounce-buffer.patch
@@ -0,0 +1,51 @@
+From 258dfd92f17d4454594169b9a85f1183ac77b051 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Fri, 24 Aug 2018 16:52:46 +0200
+Subject: [PATCH 1804/1808] i2c: sh_mobile: fix leak when using DMA bounce
+ buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We only freed the bounce buffer after successful DMA, missing the cases
+where DMA setup may have gone wrong. Use a better location which always
+gets called after each message and use 'stop_after_dma' as a flag for a
+successful transfer.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+(cherry picked from commit cebc07d84ad71bc58d6f59b770e4347da48a5a2b)
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+---
+ drivers/i2c/busses/i2c-sh_mobile.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
+index 5e22d55ea57b..1a9fbcd821d9 100644
+--- a/drivers/i2c/busses/i2c-sh_mobile.c
++++ b/drivers/i2c/busses/i2c-sh_mobile.c
+@@ -515,8 +515,6 @@ static void sh_mobile_i2c_dma_callback(void *data)
+ 	pd->pos = pd->msg->len;
+ 	pd->stop_after_dma = true;
+ 
+-	i2c_put_dma_safe_msg_buf(pd->dma_buf, pd->msg, true);
+-
+ 	iic_set_clr(pd, ICIC, 0, ICIC_TDMAE | ICIC_RDMAE);
+ }
+ 
+@@ -722,6 +720,10 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,
+ 		timeout = wait_event_timeout(pd->wait,
+ 				       pd->sr & (ICSR_TACK | SW_DONE),
+ 				       adapter->timeout);
++
++		/* 'stop_after_dma' tells if DMA transfer was complete */
++		i2c_put_dma_safe_msg_buf(pd->dma_buf, pd->msg, pd->stop_after_dma);
++
+ 		if (!timeout) {
+ 			dev_err(pd->dev, "Transfer request timed out\n");
+ 			if (pd->dma_direction != DMA_NONE)
+-- 
+2.17.1
+
diff --git a/patches/1805-spi-sh-msiof-Make-sure-all-DMA-operations-have-compl.patch b/patches/1805-spi-sh-msiof-Make-sure-all-DMA-operations-have-compl.patch
new file mode 100644
index 0000000..71b626a
--- /dev/null
+++ b/patches/1805-spi-sh-msiof-Make-sure-all-DMA-operations-have-compl.patch
@@ -0,0 +1,162 @@
+From 86f6ce452cf5ef6c67994e8975f3bb306da816cf Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Wed, 13 Jun 2018 10:41:15 +0200
+Subject: [PATCH 1805/1808] spi: sh-msiof: Make sure all DMA operations have
+ completed
+
+In case of a bi-directional transfer, receive DMA may complete in the
+rcar-dmac driver before transmit DMA, due to scheduling latencies.
+As the MSIOF driver waits for completion of the receive DMA only, it may
+submit the next transmit DMA request before the previous one has
+completed.
+
+Make the driver more robust by waiting for the completion of both
+receive and transmit DMA, when applicable.
+
+Based on a patch in the BSP by Ryo Kataoka.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+(cherry picked from commit 08ba7ae35b15cd13b965d5fd5a835e0a0cb803e6)
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+---
+ drivers/spi/spi-sh-msiof.c | 53 +++++++++++++++++++++-----------------
+ 1 file changed, 29 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
+index d1c51b49c8ce..5cec432e04c0 100644
+--- a/drivers/spi/spi-sh-msiof.c
++++ b/drivers/spi/spi-sh-msiof.c
+@@ -48,6 +48,7 @@ struct sh_msiof_spi_priv {
+ 	struct platform_device *pdev;
+ 	struct sh_msiof_spi_info *info;
+ 	struct completion done;
++	struct completion done_txdma;
+ 	unsigned int tx_fifo_size;
+ 	unsigned int rx_fifo_size;
+ 	unsigned int min_div_pow;
+@@ -633,19 +634,21 @@ static int sh_msiof_slave_abort(struct spi_master *master)
+ 
+ 	p->slave_aborted = true;
+ 	complete(&p->done);
++	complete(&p->done_txdma);
+ 	return 0;
+ }
+ 
+-static int sh_msiof_wait_for_completion(struct sh_msiof_spi_priv *p)
++static int sh_msiof_wait_for_completion(struct sh_msiof_spi_priv *p,
++					struct completion *x)
+ {
+ 	if (spi_controller_is_slave(p->master)) {
+-		if (wait_for_completion_interruptible(&p->done) ||
++		if (wait_for_completion_interruptible(x) ||
+ 		    p->slave_aborted) {
+ 			dev_dbg(&p->pdev->dev, "interrupted\n");
+ 			return -EINTR;
+ 		}
+ 	} else {
+-		if (!wait_for_completion_timeout(&p->done, HZ)) {
++		if (!wait_for_completion_timeout(x, HZ)) {
+ 			dev_err(&p->pdev->dev, "timeout\n");
+ 			return -ETIMEDOUT;
+ 		}
+@@ -695,7 +698,7 @@ static int sh_msiof_spi_txrx_once(struct sh_msiof_spi_priv *p,
+ 	}
+ 
+ 	/* wait for tx fifo to be emptied / rx fifo to be filled */
+-	ret = sh_msiof_wait_for_completion(p);
++	ret = sh_msiof_wait_for_completion(p, &p->done);
+ 	if (ret)
+ 		goto stop_reset;
+ 
+@@ -724,10 +727,7 @@ static int sh_msiof_spi_txrx_once(struct sh_msiof_spi_priv *p,
+ 
+ static void sh_msiof_dma_complete(void *arg)
+ {
+-	struct sh_msiof_spi_priv *p = arg;
+-
+-	sh_msiof_write(p, IER, 0);
+-	complete(&p->done);
++	complete(arg);
+ }
+ 
+ static int sh_msiof_dma_once(struct sh_msiof_spi_priv *p, const void *tx,
+@@ -748,7 +748,7 @@ static int sh_msiof_dma_once(struct sh_msiof_spi_priv *p, const void *tx,
+ 			return -EAGAIN;
+ 
+ 		desc_rx->callback = sh_msiof_dma_complete;
+-		desc_rx->callback_param = p;
++		desc_rx->callback_param = &p->done;
+ 		cookie = dmaengine_submit(desc_rx);
+ 		if (dma_submit_error(cookie))
+ 			return cookie;
+@@ -766,13 +766,8 @@ static int sh_msiof_dma_once(struct sh_msiof_spi_priv *p, const void *tx,
+ 			goto no_dma_tx;
+ 		}
+ 
+-		if (rx) {
+-			/* No callback */
+-			desc_tx->callback = NULL;
+-		} else {
+-			desc_tx->callback = sh_msiof_dma_complete;
+-			desc_tx->callback_param = p;
+-		}
++		desc_tx->callback = sh_msiof_dma_complete;
++		desc_tx->callback_param = &p->done_txdma;
+ 		cookie = dmaengine_submit(desc_tx);
+ 		if (dma_submit_error(cookie)) {
+ 			ret = cookie;
+@@ -789,6 +784,8 @@ static int sh_msiof_dma_once(struct sh_msiof_spi_priv *p, const void *tx,
+ 	sh_msiof_write(p, IER, ier_bits);
+ 
+ 	reinit_completion(&p->done);
++	if (tx)
++		reinit_completion(&p->done_txdma);
+ 	p->slave_aborted = false;
+ 
+ 	/* Now start DMA */
+@@ -803,17 +800,24 @@ static int sh_msiof_dma_once(struct sh_msiof_spi_priv *p, const void *tx,
+ 		goto stop_dma;
+ 	}
+ 
+-	/* wait for tx/rx DMA completion */
+-	ret = sh_msiof_wait_for_completion(p);
+-	if (ret)
+-		goto stop_reset;
++	if (tx) {
++		/* wait for tx DMA completion */
++		ret = sh_msiof_wait_for_completion(p, &p->done_txdma);
++		if (ret)
++			goto stop_reset;
++	}
+ 
+-	if (!rx) {
+-		reinit_completion(&p->done);
+-		sh_msiof_write(p, IER, IER_TEOFE);
++	if (rx) {
++		/* wait for rx DMA completion */
++		ret = sh_msiof_wait_for_completion(p, &p->done);
++		if (ret)
++			goto stop_reset;
+ 
++		sh_msiof_write(p, IER, 0);
++	} else {
+ 		/* wait for tx fifo to be emptied */
+-		ret = sh_msiof_wait_for_completion(p);
++		sh_msiof_write(p, IER, IER_TEOFE);
++		ret = sh_msiof_wait_for_completion(p, &p->done);
+ 		if (ret)
+ 			goto stop_reset;
+ 	}
+@@ -1273,6 +1277,7 @@ static int sh_msiof_spi_probe(struct platform_device *pdev)
+ 	p->min_div_pow = chipdata->min_div_pow;
+ 
+ 	init_completion(&p->done);
++	init_completion(&p->done_txdma);
+ 
+ 	p->clk = devm_clk_get(&pdev->dev, NULL);
+ 	if (IS_ERR(p->clk)) {
+-- 
+2.17.1
+
diff --git a/patches/1806-mmc-tmio-Fix-tuning-flow.patch b/patches/1806-mmc-tmio-Fix-tuning-flow.patch
new file mode 100644
index 0000000..cfa5829
--- /dev/null
+++ b/patches/1806-mmc-tmio-Fix-tuning-flow.patch
@@ -0,0 +1,42 @@
+From 5ffe4b1ffb13d6d2bf4e1e81b40407c06ab80539 Mon Sep 17 00:00:00 2001
+From: Masaharu Hayakawa <masaharu.hayakawa.ry@renesas.com>
+Date: Tue, 24 Jul 2018 16:51:37 +0200
+Subject: [PATCH 1806/1808] mmc: tmio: Fix tuning flow
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If the return value of mmc_send_tuning() is error other than -EILSEQ,
+the tuning fails and process goes out of for_loop. The correct
+processing is to judge their TAP as not good (NG) and continue.
+
+Signed-off-by: Masaharu Hayakawa <masaharu.hayakawa.ry@renesas.com>
+[Niklas: update commit message]
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+(cherry picked from commit a8f399f624e1ae902828ad788f3601ff7b3e0eed)
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+---
+ drivers/mmc/host/tmio_mmc_core.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
+index 308029930304..f07fc698acd7 100644
+--- a/drivers/mmc/host/tmio_mmc_core.c
++++ b/drivers/mmc/host/tmio_mmc_core.c
+@@ -805,8 +805,6 @@ static int tmio_mmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 			host->prepare_tuning(host, i % host->tap_num);
+ 
+ 		ret = mmc_send_tuning(mmc, opcode, NULL);
+-		if (ret && ret != -EILSEQ)
+-			goto out;
+ 		if (ret == 0)
+ 			set_bit(i, host->taps);
+ 
+-- 
+2.17.1
+
diff --git a/patches/1807-mmc-renesas_sdhi-Fix-sampling-clock-position-selecti.patch b/patches/1807-mmc-renesas_sdhi-Fix-sampling-clock-position-selecti.patch
new file mode 100644
index 0000000..ec625d9
--- /dev/null
+++ b/patches/1807-mmc-renesas_sdhi-Fix-sampling-clock-position-selecti.patch
@@ -0,0 +1,54 @@
+From ad028d2f04f3d70abe1b63b1f64e3db8ed22a4be Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Niklas=20S=C3=B6derlund?=
+ <niklas.soderlund+renesas@ragnatech.se>
+Date: Tue, 24 Jul 2018 16:51:38 +0200
+Subject: [PATCH 1807/1808] mmc: renesas_sdhi: Fix sampling clock position
+ selecting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When tuning each tap is issued CMD19 twice and the result of both runs
+recorded in host->taps. If the result is different between the two runs
+the wrong sampling clock position was selected. Fix this by merging the
+two runs and only keep the result for each tap if it was good in both
+sets.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+(cherry picked from commit 5c99826b27d0afd4c05c2013385b17037f579cf9)
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 45c015da2e75..f087ac728e35 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -301,6 +301,18 @@ static int renesas_sdhi_select_tuning(struct tmio_mmc_host *host)
+ 	/* Clear SCC_RVSREQ */
+ 	sd_scc_write32(host, priv, SH_MOBILE_SDHI_SCC_RVSREQ, 0);
+ 
++	/*
++	 * When tuning CMD19 is issued twice for each tap, merge the
++	 * result requiring the tap to be good in both runs before
++	 * considering it for tuning selection.
++	 */
++	for (i = 0; i < host->tap_num * 2; i++) {
++		int offset = host->tap_num * (i < host->tap_num ? 1 : -1);
++
++		if (!test_bit(i, host->taps))
++			clear_bit(i + offset, host->taps);
++	}
++
+ 	/*
+ 	 * Find the longest consecutive run of successful probes.  If that
+ 	 * is more than SH_MOBILE_SDHI_MAX_TAP probes long then use the
+-- 
+2.17.1
+
diff --git a/patches/1808-eeprom-at24-Add-OF-device-ID-table.patch b/patches/1808-eeprom-at24-Add-OF-device-ID-table.patch
new file mode 100644
index 0000000..e6b405c
--- /dev/null
+++ b/patches/1808-eeprom-at24-Add-OF-device-ID-table.patch
@@ -0,0 +1,132 @@
+From b725346d24fb9121025caddd548c63ae2fc83448 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Sun, 1 Oct 2017 12:49:48 +0200
+Subject: [PATCH 1808/1808] eeprom: at24: Add OF device ID table
+
+The driver doesn't have a struct of_device_id table but supported devices
+are registered via Device Trees. This is working on the assumption that a
+I2C device registered via OF will always match a legacy I2C device ID and
+that the MODALIAS reported will always be of the form i2c:<device>.
+
+But this could change in the future so the correct approach is to have an
+OF device ID table if the devices are registered via OF.
+
+To maintain backward compatibility with old Device Trees, only use the OF
+device ID table .data if the device was registered via OF and the OF node
+compatible matches an entry in the OF device ID table.
+
+Suggested-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+(cherry picked from commit 7f2a2f0d0d66b2d834c793df45af3277bb5f10f4)
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+---
+ drivers/misc/eeprom/at24.c | 71 +++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 70 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
+index 4cc0b42f2acc..87367efc8170 100644
+--- a/drivers/misc/eeprom/at24.c
++++ b/drivers/misc/eeprom/at24.c
+@@ -12,6 +12,7 @@
+ #include <linux/kernel.h>
+ #include <linux/init.h>
+ #include <linux/module.h>
++#include <linux/of_device.h>
+ #include <linux/slab.h>
+ #include <linux/delay.h>
+ #include <linux/mutex.h>
+@@ -175,6 +176,64 @@ static const struct i2c_device_id at24_ids[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, at24_ids);
+ 
++static const struct of_device_id at24_of_match[] = {
++	{
++		.compatible = "atmel,24c00",
++		.data = (void *)AT24_DEVICE_MAGIC(128 / 8, AT24_FLAG_TAKE8ADDR)
++	},
++	{
++		.compatible = "atmel,24c01",
++		.data = (void *)AT24_DEVICE_MAGIC(1024 / 8, 0)
++	},
++	{
++		.compatible = "atmel,24c02",
++		.data = (void *)AT24_DEVICE_MAGIC(2048 / 8, 0)
++	},
++	{
++		.compatible = "atmel,spd",
++		.data = (void *)AT24_DEVICE_MAGIC(2048 / 8,
++				AT24_FLAG_READONLY | AT24_FLAG_IRUGO)
++	},
++	{
++		.compatible = "atmel,24c04",
++		.data = (void *)AT24_DEVICE_MAGIC(4096 / 8, 0)
++	},
++	{
++		.compatible = "atmel,24c08",
++		.data = (void *)AT24_DEVICE_MAGIC(8192 / 8, 0)
++	},
++	{
++		.compatible = "atmel,24c16",
++		.data = (void *)AT24_DEVICE_MAGIC(16384 / 8, 0)
++	},
++	{
++		.compatible = "atmel,24c32",
++		.data = (void *)AT24_DEVICE_MAGIC(32768 / 8, AT24_FLAG_ADDR16)
++	},
++	{
++		.compatible = "atmel,24c64",
++		.data = (void *)AT24_DEVICE_MAGIC(65536 / 8, AT24_FLAG_ADDR16)
++	},
++	{
++		.compatible = "atmel,24c128",
++		.data = (void *)AT24_DEVICE_MAGIC(131072 / 8, AT24_FLAG_ADDR16)
++	},
++	{
++		.compatible = "atmel,24c256",
++		.data = (void *)AT24_DEVICE_MAGIC(262144 / 8, AT24_FLAG_ADDR16)
++	},
++	{
++		.compatible = "atmel,24c512",
++		.data = (void *)AT24_DEVICE_MAGIC(524288 / 8, AT24_FLAG_ADDR16)
++	},
++	{
++		.compatible = "atmel,24c1024",
++		.data = (void *)AT24_DEVICE_MAGIC(1048576 / 8, AT24_FLAG_ADDR16)
++	},
++	{ },
++};
++MODULE_DEVICE_TABLE(of, at24_of_match);
++
+ static const struct acpi_device_id at24_acpi_ids[] = {
+ 	{ "INT3499", AT24_DEVICE_MAGIC(8192 / 8, 0) },
+ 	{ }
+@@ -605,7 +664,16 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ 	if (client->dev.platform_data) {
+ 		chip = *(struct at24_platform_data *)client->dev.platform_data;
+ 	} else {
+-		if (id) {
++		/*
++		 * The I2C core allows OF nodes compatibles to match against the
++		 * I2C device ID table as a fallback, so check not only if an OF
++		 * node is present but also if it matches an OF device ID entry.
++		 */
++		if (client->dev.of_node &&
++		    of_match_device(at24_of_match, &client->dev)) {
++			magic = (kernel_ulong_t)
++				of_device_get_match_data(&client->dev);
++		} else if (id) {
+ 			magic = id->driver_data;
+ 		} else {
+ 			const struct acpi_device_id *aid;
+@@ -831,6 +899,7 @@ static int at24_remove(struct i2c_client *client)
+ static struct i2c_driver at24_driver = {
+ 	.driver = {
+ 		.name = "at24",
++		.of_match_table = at24_of_match,
+ 		.acpi_match_table = ACPI_PTR(at24_acpi_ids),
+ 	},
+ 	.probe = at24_probe,
+-- 
+2.17.1
+
diff --git a/series b/series
index db5a933..374956e 100644
--- a/series
+++ b/series
@@ -1818,5 +1818,16 @@
 patches/1793-tracing-Add-__find_event_file-to-find-event-files-wi.patch
 patches/1794-tracing-Allow-histogram-triggers-to-access-ftrace-in.patch
 patches/1795-tracing-Fix-code-comments-in-trace.c.patch
-
-
+patches/1796-i2c-dev-mark-RDWR-buffers-as-DMA_SAFE.patch
+patches/1797-i2c-refactor-i2c_master_-send_recv.patch
+patches/1798-i2c-add-i2c_master_-send-recv-_dmasafe.patch
+patches/1799-i2c-smbus-use-DMA-safe-buffers-for-emulated-SMBus-tr.patch
+patches/1800-i2c-add-docs-to-clarify-DMA-handling.patch
+patches/1801-i2c-core-smbus-fix-a-potential-missing-check-bug.patch
+patches/1802-i2c-smbus-kill-memory-leak-on-emulated-and-failed-DM.patch
+patches/1803-i2c-refactor-function-to-release-a-DMA-safe-buffer.patch
+patches/1804-i2c-sh_mobile-fix-leak-when-using-DMA-bounce-buffer.patch
+patches/1805-spi-sh-msiof-Make-sure-all-DMA-operations-have-compl.patch
+patches/1806-mmc-tmio-Fix-tuning-flow.patch
+patches/1807-mmc-renesas_sdhi-Fix-sampling-clock-position-selecti.patch
+patches/1808-eeprom-at24-Add-OF-device-ID-table.patch