Merge 5.3-rc5 into usb-next

We need the usb fixes in here as well for other patches to build on.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

173 files changed, 1441 insertions, 814 deletions

diff --git a/Documentation/devicetree/bindings/Makefile b/Documentation/devicetree/bindings/Makefile
index 6b0dfd5c17ba..5138a2f6232a 100644
--- a/Documentation/devicetree/bindings/Makefile
+++ b/Documentation/devicetree/bindings/Makefile
@@ -19,7 +19,9 @@ quiet_cmd_mk_schema = SCHEMA  $@
 
 DT_DOCS = $(shell \
         cd $(srctree)/$(src) && \
-        find * \( -name '*.yaml' ! -name $(DT_TMP_SCHEMA) \) \
+        find * \( -name '*.yaml' ! \
+                -name $(DT_TMP_SCHEMA) ! \
+                -name '*.example.dt.yaml' \) \
         )
 
 DT_SCHEMA_FILES ?= $(addprefix $(src)/,$(DT_DOCS))
diff --git a/Documentation/devicetree/bindings/net/fsl-fec.txt b/Documentation/devicetree/bindings/net/fsl-fec.txt
index 2d41fb96ce0a..5b88fae0307d 100644
--- a/Documentation/devicetree/bindings/net/fsl-fec.txt
+++ b/Documentation/devicetree/bindings/net/fsl-fec.txt
@@ -7,18 +7,6 @@ Required properties:
 - phy-mode : See ethernet.txt file in the same directory
 
 Optional properties:
-- phy-reset-gpios : Should specify the gpio for phy reset
-- phy-reset-duration : Reset duration in milliseconds.  Should present
-  only if property "phy-reset-gpios" is available.  Missing the property
-  will have the duration be 1 millisecond.  Numbers greater than 1000 are
-  invalid and 1 millisecond will be used instead.
-- phy-reset-active-high : If present then the reset sequence using the GPIO
-  specified in the "phy-reset-gpios" property is reversed (H=reset state,
-  L=operation state).
-- phy-reset-post-delay : Post reset delay in milliseconds. If present then
-  a delay of phy-reset-post-delay milliseconds will be observed after the
-  phy-reset-gpios has been toggled. Can be omitted thus no delay is
-  observed. Delay is in range of 1ms to 1000ms. Other delays are invalid.
 - phy-supply : regulator that powers the Ethernet PHY.
 - phy-handle : phandle to the PHY device connected to this device.
 - fixed-link : Assume a fixed link. See fixed-link.txt in the same directory.
@@ -47,11 +35,27 @@ Optional properties:
   For imx6sx, "int0" handles all 3 queues and ENET_MII. "pps" is for the pulse
   per second interrupt associated with 1588 precision time protocol(PTP).
 
-
 Optional subnodes:
 - mdio : specifies the mdio bus in the FEC, used as a container for phy nodes
   according to phy.txt in the same directory
 
+Deprecated optional properties:
+        To avoid these, create a phy node according to phy.txt in the same
+        directory, and point the fec's "phy-handle" property to it. Then use
+        the phy's reset binding, again described by phy.txt.
+- phy-reset-gpios : Should specify the gpio for phy reset
+- phy-reset-duration : Reset duration in milliseconds.  Should present
+  only if property "phy-reset-gpios" is available.  Missing the property
+  will have the duration be 1 millisecond.  Numbers greater than 1000 are
+  invalid and 1 millisecond will be used instead.
+- phy-reset-active-high : If present then the reset sequence using the GPIO
+  specified in the "phy-reset-gpios" property is reversed (H=reset state,
+  L=operation state).
+- phy-reset-post-delay : Post reset delay in milliseconds. If present then
+  a delay of phy-reset-post-delay milliseconds will be observed after the
+  phy-reset-gpios has been toggled. Can be omitted thus no delay is
+  observed. Delay is in range of 1ms to 1000ms. Other delays are invalid.
+
 Example:
 
 ethernet@83fec000 {
diff --git a/Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.yaml b/Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.yaml
index 91d3e78b3395..400df2da018a 100644
--- a/Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.yaml
+++ b/Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.yaml
@@ -37,7 +37,8 @@ properties:
   hwlocks: true
 
   st,syscfg:
-    $ref: "/schemas/types.yaml#/definitions/phandle-array"
+    allOf:
+      - $ref: "/schemas/types.yaml#/definitions/phandle-array"
     description: Should be phandle/offset/mask
     items:
       - description: Phandle to the syscon node which includes IRQ mux selection.
diff --git a/MAINTAINERS b/MAINTAINERS
index 01e101d28a43..8c343c2f4ce1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -6436,6 +6436,14 @@ S:	Maintained
 F:      drivers/perf/fsl_imx8_ddr_perf.c
 F:      Documentation/devicetree/bindings/perf/fsl-imx-ddr.txt
 
+FREESCALE IMX I2C DRIVER
+M:      Oleksij Rempel <o.rempel@pengutronix.de>
+R:      Pengutronix Kernel Team <kernel@pengutronix.de>
+L:      linux-i2c@vger.kernel.org
+S:      Maintained
+F:      drivers/i2c/busses/i2c-imx.c
+F:      Documentation/devicetree/bindings/i2c/i2c-imx.txt
+
 FREESCALE IMX LPI2C DRIVER
 M:      Dong Aisheng <aisheng.dong@nxp.com>
 L:      linux-i2c@vger.kernel.org
@@ -7447,7 +7455,7 @@ F:	drivers/net/hyperv/
 F:      drivers/scsi/storvsc_drv.c
 F:      drivers/uio/uio_hv_generic.c
 F:      drivers/video/fbdev/hyperv_fb.c
-F:      drivers/iommu/hyperv_iommu.c
+F:      drivers/iommu/hyperv-iommu.c
 F:      net/vmw_vsock/hyperv_transport.c
 F:      include/clocksource/hyperv_timer.h
 F:      include/linux/hyperv.h
@@ -8059,6 +8067,13 @@ T:	git git://git.code.sf.net/p/intel-sas/isci
 S:      Supported
 F:      drivers/scsi/isci/
 
+INTEL CPU family model numbers
+M:      Tony Luck <tony.luck@intel.com>
+M:      x86@kernel.org
+L:      linux-kernel@vger.kernel.org
+S:      Supported
+F:      arch/x86/include/asm/intel-family.h
+
 INTEL DRM DRIVERS (excluding Poulsbo, Moorestown and derivative chipsets)
 M:      Jani Nikula <jani.nikula@linux.intel.com>
 M:      Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
@@ -8410,7 +8425,6 @@ L:	linux-xfs@vger.kernel.org
 L:      linux-fsdevel@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/fs/xfs/xfs-linux.git
 S:      Supported
-F:      fs/iomap.c
 F:      fs/iomap/
 F:      include/linux/iomap.h
 
diff --git a/Makefile b/Makefile
index 1b23f95db176..9fa18613566f 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 3
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME = Bobtail Squid
 
 # *DOCUMENTATION*
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 6774b03aa405..d42557ee69c2 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -2405,9 +2405,7 @@ long arch_dma_coherent_to_pfn(struct device *dev, void *cpu_addr,
 pgprot_t arch_dma_mmap_pgprot(struct device *dev, pgprot_t prot,
                 unsigned long attrs)
 {
-        if (!dev_is_dma_coherent(dev))
-                return __get_dma_pgprot(attrs, prot);
-        return prot;
+        return __get_dma_pgprot(attrs, prot);
 }
 
 void *arch_dma_alloc(struct device *dev, size_t size, dma_addr_t *dma_handle,
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index d19d14ba9ae4..b1fdc486aed8 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -184,9 +184,17 @@ static const struct arm64_ftr_bits ftr_id_aa64zfr0[] = {
 };
 
 static const struct arm64_ftr_bits ftr_id_aa64mmfr0[] = {
-        S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN4_SHIFT, 4, ID_AA64MMFR0_TGRAN4_NI),
-        S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN64_SHIFT, 4, ID_AA64MMFR0_TGRAN64_NI),
-        ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN16_SHIFT, 4, ID_AA64MMFR0_TGRAN16_NI),
+        /*
+         * We already refuse to boot CPUs that don't support our configured
+         * page size, so we can only detect mismatches for a page size other
+         * than the one we're currently using. Unfortunately, SoCs like this
+         * exist in the wild so, even though we don't like it, we'll have to go
+         * along with it and treat them as non-strict.
+         */
+        S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN4_SHIFT, 4, ID_AA64MMFR0_TGRAN4_NI),
+        S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN64_SHIFT, 4, ID_AA64MMFR0_TGRAN64_NI),
+        ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN16_SHIFT, 4, ID_AA64MMFR0_TGRAN16_NI),
+
         ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_BIGENDEL0_SHIFT, 4, 0),
         /* Linux shouldn't care about secure memory */
         ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_SNSMEM_SHIFT, 4, 0),
diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
index 1285c7b2947f..171773257974 100644
--- a/arch/arm64/kernel/ftrace.c
+++ b/arch/arm64/kernel/ftrace.c
@@ -73,7 +73,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
 
         if (offset < -SZ_128M || offset >= SZ_128M) {
 #ifdef CONFIG_ARM64_MODULE_PLTS
-                struct plt_entry trampoline;
+                struct plt_entry trampoline, *dst;
                 struct module *mod;
 
                 /*
@@ -106,23 +106,27 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
                  * to check if the actual opcodes are in fact identical,
                  * regardless of the offset in memory so use memcmp() instead.
                  */
-                trampoline = get_plt_entry(addr, mod->arch.ftrace_trampoline);
-                if (memcmp(mod->arch.ftrace_trampoline, &trampoline,
-                           sizeof(trampoline))) {
-                        if (plt_entry_is_initialized(mod->arch.ftrace_trampoline)) {
+                dst = mod->arch.ftrace_trampoline;
+                trampoline = get_plt_entry(addr, dst);
+                if (memcmp(dst, &trampoline, sizeof(trampoline))) {
+                        if (plt_entry_is_initialized(dst)) {
                                 pr_err("ftrace: far branches to multiple entry points unsupported inside a single module\n");
                                 return -EINVAL;
                         }
 
                         /* point the trampoline to our ftrace entry point */
                         module_disable_ro(mod);
-                        *mod->arch.ftrace_trampoline = trampoline;
+                        *dst = trampoline;
                         module_enable_ro(mod, true);
 
-                        /* update trampoline before patching in the branch */
-                        smp_wmb();
+                        /*
+                         * Ensure updated trampoline is visible to instruction
+                         * fetch before we patch in the branch.
+                         */
+                        __flush_icache_range((unsigned long)&dst[0],
+                                             (unsigned long)&dst[1]);
                 }
-                addr = (unsigned long)(void *)mod->arch.ftrace_trampoline;
+                addr = (unsigned long)dst;
 #else /* CONFIG_ARM64_MODULE_PLTS */
                 return -EINVAL;
 #endif /* CONFIG_ARM64_MODULE_PLTS */
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 1d3f0b5a9940..bd2b039f43a6 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -14,9 +14,7 @@
 pgprot_t arch_dma_mmap_pgprot(struct device *dev, pgprot_t prot,
                 unsigned long attrs)
 {
-        if (!dev_is_dma_coherent(dev) || (attrs & DMA_ATTR_WRITE_COMBINE))
-                return pgprot_writecombine(prot);
-        return prot;
+        return pgprot_writecombine(prot);
 }
 
 void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr,
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 77f6ebf97113..d8dcd8820369 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -121,7 +121,6 @@ config PPC
         select ARCH_32BIT_OFF_T if PPC32
         select ARCH_HAS_DEBUG_VIRTUAL
         select ARCH_HAS_DEVMEM_IS_ALLOWED
-        select ARCH_HAS_DMA_MMAP_PGPROT
         select ARCH_HAS_ELF_RANDOMIZE
         select ARCH_HAS_FORTIFY_SOURCE
         select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index ea0c69236789..56dfa7a2a6f2 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -49,8 +49,7 @@ obj-y				:= cputable.o ptrace.o syscalls.o \
                                    signal.o sysfs.o cacheinfo.o time.o \
                                    prom.o traps.o setup-common.o \
                                    udbg.o misc.o io.o misc_$(BITS).o \
-                                   of_platform.o prom_parse.o \
-                                   dma-common.o
+                                   of_platform.o prom_parse.o
 obj-$(CONFIG_PPC64)             += setup_64.o sys_ppc32.o \
                                    signal_64.o ptrace32.o \
                                    paca.o nvram_64.o firmware.o
diff --git a/arch/powerpc/kernel/dma-common.c b/arch/powerpc/kernel/dma-common.c
deleted file mode 100644
index dc7ef6b17b69..000000000000
--- a/arch/powerpc/kernel/dma-common.c
+++ /dev/null
@@ -1,17 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-/*
- * Contains common dma routines for all powerpc platforms.
- *
- * Copyright (C) 2019 Shawn Anastasio.
- */
-
-#include <linux/mm.h>
-#include <linux/dma-noncoherent.h>
-
-pgprot_t arch_dma_mmap_pgprot(struct device *dev, pgprot_t prot,
-                unsigned long attrs)
-{
-        if (!dev_is_dma_coherent(dev))
-                return pgprot_noncached(prot);
-        return prot;
-}
diff --git a/arch/riscv/configs/defconfig b/arch/riscv/configs/defconfig
index 93205c0bf71d..3efff552a261 100644
--- a/arch/riscv/configs/defconfig
+++ b/arch/riscv/configs/defconfig
@@ -54,6 +54,8 @@ CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_SERIAL_EARLYCON_RISCV_SBI=y
 CONFIG_HVC_RISCV_SBI=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_VIRTIO=y
 CONFIG_SPI=y
 CONFIG_SPI_SIFIVE=y
 # CONFIG_PTP_1588_CLOCK is not set
diff --git a/arch/riscv/configs/rv32_defconfig b/arch/riscv/configs/rv32_defconfig
index d5449ef805a3..7da93e494445 100644
--- a/arch/riscv/configs/rv32_defconfig
+++ b/arch/riscv/configs/rv32_defconfig
@@ -34,6 +34,7 @@ CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_HOST_GENERIC=y
 CONFIG_PCIE_XILINX=y
 CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_BLK_DEV_SD=y
@@ -53,6 +54,8 @@ CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_SERIAL_EARLYCON_RISCV_SBI=y
 CONFIG_HVC_RISCV_SBI=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_VIRTIO=y
 # CONFIG_PTP_1588_CLOCK is not set
 CONFIG_DRM=y
 CONFIG_DRM_RADEON=y
diff --git a/arch/riscv/include/asm/switch_to.h b/arch/riscv/include/asm/switch_to.h
index 853b65ef656d..f0227bdce0f0 100644
--- a/arch/riscv/include/asm/switch_to.h
+++ b/arch/riscv/include/asm/switch_to.h
@@ -16,7 +16,13 @@ extern void __fstate_restore(struct task_struct *restore_from);
 
 static inline void __fstate_clean(struct pt_regs *regs)
 {
-        regs->sstatus |= (regs->sstatus & ~(SR_FS)) | SR_FS_CLEAN;
+        regs->sstatus = (regs->sstatus & ~SR_FS) | SR_FS_CLEAN;
+}
+
+static inline void fstate_off(struct task_struct *task,
+                              struct pt_regs *regs)
+{
+        regs->sstatus = (regs->sstatus & ~SR_FS) | SR_FS_OFF;
 }
 
 static inline void fstate_save(struct task_struct *task,
diff --git a/arch/riscv/include/asm/tlbflush.h b/arch/riscv/include/asm/tlbflush.h
index 687dd19735a7..4d9bbe8438bf 100644
--- a/arch/riscv/include/asm/tlbflush.h
+++ b/arch/riscv/include/asm/tlbflush.h
@@ -53,10 +53,17 @@ static inline void remote_sfence_vma(struct cpumask *cmask, unsigned long start,
 }
 
 #define flush_tlb_all() sbi_remote_sfence_vma(NULL, 0, -1)
-#define flush_tlb_page(vma, addr) flush_tlb_range(vma, addr, 0)
+
 #define flush_tlb_range(vma, start, end) \
         remote_sfence_vma(mm_cpumask((vma)->vm_mm), start, (end) - (start))
-#define flush_tlb_mm(mm) \
+
+static inline void flush_tlb_page(struct vm_area_struct *vma,
+                                  unsigned long addr)
+{
+        flush_tlb_range(vma, addr, addr + PAGE_SIZE);
+}
+
+#define flush_tlb_mm(mm)                                \
         remote_sfence_vma(mm_cpumask(mm), 0, -1)
 
 #endif /* CONFIG_SMP */
diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
index f23794bd1e90..fb3a082362eb 100644
--- a/arch/riscv/kernel/process.c
+++ b/arch/riscv/kernel/process.c
@@ -64,8 +64,14 @@ void start_thread(struct pt_regs *regs, unsigned long pc,
         unsigned long sp)
 {
         regs->sstatus = SR_SPIE;
-        if (has_fpu)
+        if (has_fpu) {
                 regs->sstatus |= SR_FS_INITIAL;
+                /*
+                 * Restore the initial value to the FP register
+                 * before starting the user program.
+                 */
+                fstate_restore(current, regs);
+        }
         regs->sepc = pc;
         regs->sp = sp;
         set_fs(USER_DS);
@@ -75,10 +81,11 @@ void flush_thread(void)
 {
 #ifdef CONFIG_FPU
         /*
-         * Reset FPU context
+         * Reset FPU state and context
          *      frm: round to nearest, ties to even (IEEE default)
          *      fflags: accrued exceptions cleared
          */
+        fstate_off(current, task_pt_regs(current));
         memset(&current->thread.fstate, 0, sizeof(current->thread.fstate));
 #endif
 }
diff --git a/arch/sh/kernel/disassemble.c b/arch/sh/kernel/disassemble.c
index defebf1a9c8a..845543780cc5 100644
--- a/arch/sh/kernel/disassemble.c
+++ b/arch/sh/kernel/disassemble.c
@@ -475,8 +475,6 @@ static void print_sh_insn(u32 memaddr, u16 insn)
                                 printk("dbr");
                                 break;
                         case FD_REG_N:
-                                if (0)
-                                        goto d_reg_n;
                         case F_REG_N:
                                 printk("fr%d", rn);
                                 break;
@@ -488,7 +486,7 @@ static void print_sh_insn(u32 memaddr, u16 insn)
                                         printk("xd%d", rn & ~1);
                                         break;
                                 }
-                        d_reg_n:
+                                /* else, fall through */
                         case D_REG_N:
                                 printk("dr%d", rn);
                                 break;
@@ -497,6 +495,7 @@ static void print_sh_insn(u32 memaddr, u16 insn)
                                         printk("xd%d", rm & ~1);
                                         break;
                                 }
+                                /* else, fall through */
                         case D_REG_M:
                                 printk("dr%d", rm);
                                 break;
diff --git a/arch/sh/kernel/hw_breakpoint.c b/arch/sh/kernel/hw_breakpoint.c
index 3bd010b4c55f..f10d64311127 100644
--- a/arch/sh/kernel/hw_breakpoint.c
+++ b/arch/sh/kernel/hw_breakpoint.c
@@ -157,6 +157,7 @@ int arch_bp_generic_fields(int sh_len, int sh_type,
         switch (sh_type) {
         case SH_BREAKPOINT_READ:
                 *gen_type = HW_BREAKPOINT_R;
+                break;
         case SH_BREAKPOINT_WRITE:
                 *gen_type = HW_BREAKPOINT_W;
                 break;
diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h
index 101eb944f13c..f5e90a849bca 100644
--- a/arch/x86/include/asm/bootparam_utils.h
+++ b/arch/x86/include/asm/bootparam_utils.h
@@ -18,6 +18,20 @@
  * Note: efi_info is commonly left uninitialized, but that field has a
  * private magic, so it is better to leave it unchanged.
  */
+
+#define sizeof_mbr(type, member) ({ sizeof(((type *)0)->member); })
+
+#define BOOT_PARAM_PRESERVE(struct_member)                              \
+        {                                                               \
+                .start = offsetof(struct boot_params, struct_member),   \
+                .len   = sizeof_mbr(struct boot_params, struct_member), \
+        }
+
+struct boot_params_to_save {
+        unsigned int start;
+        unsigned int len;
+};
+
 static void sanitize_boot_params(struct boot_params *boot_params)
 {
         /* 
@@ -35,21 +49,40 @@ static void sanitize_boot_params(struct boot_params *boot_params)
          * problems again.
          */
         if (boot_params->sentinel) {
-                /* fields in boot_params are left uninitialized, clear them */
-                boot_params->acpi_rsdp_addr = 0;
-                memset(&boot_params->ext_ramdisk_image, 0,
-                       (char *)&boot_params->efi_info -
-                        (char *)&boot_params->ext_ramdisk_image);
-                memset(&boot_params->kbd_status, 0,
-                       (char *)&boot_params->hdr -
-                       (char *)&boot_params->kbd_status);
-                memset(&boot_params->_pad7[0], 0,
-                       (char *)&boot_params->edd_mbr_sig_buffer[0] -
-                        (char *)&boot_params->_pad7[0]);
-                memset(&boot_params->_pad8[0], 0,
-                       (char *)&boot_params->eddbuf[0] -
-                        (char *)&boot_params->_pad8[0]);
-                memset(&boot_params->_pad9[0], 0, sizeof(boot_params->_pad9));
+                static struct boot_params scratch;
+                char *bp_base = (char *)boot_params;
+                char *save_base = (char *)&scratch;
+                int i;
+
+                const struct boot_params_to_save to_save[] = {
+                        BOOT_PARAM_PRESERVE(screen_info),
+                        BOOT_PARAM_PRESERVE(apm_bios_info),
+                        BOOT_PARAM_PRESERVE(tboot_addr),
+                        BOOT_PARAM_PRESERVE(ist_info),
+                        BOOT_PARAM_PRESERVE(acpi_rsdp_addr),
+                        BOOT_PARAM_PRESERVE(hd0_info),
+                        BOOT_PARAM_PRESERVE(hd1_info),
+                        BOOT_PARAM_PRESERVE(sys_desc_table),
+                        BOOT_PARAM_PRESERVE(olpc_ofw_header),
+                        BOOT_PARAM_PRESERVE(efi_info),
+                        BOOT_PARAM_PRESERVE(alt_mem_k),
+                        BOOT_PARAM_PRESERVE(scratch),
+                        BOOT_PARAM_PRESERVE(e820_entries),
+                        BOOT_PARAM_PRESERVE(eddbuf_entries),
+                        BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries),
+                        BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer),
+                        BOOT_PARAM_PRESERVE(e820_table),
+                        BOOT_PARAM_PRESERVE(eddbuf),
+                };
+
+                memset(&scratch, 0, sizeof(scratch));
+
+                for (i = 0; i < ARRAY_SIZE(to_save); i++) {
+                        memcpy(save_base + to_save[i].start,
+                               bp_base + to_save[i].start, to_save[i].len);
+                }
+
+                memcpy(boot_params, save_base, sizeof(*boot_params));
         }
 }
 
diff --git a/arch/x86/kernel/apic/probe_32.c b/arch/x86/kernel/apic/probe_32.c
index 1492799b8f43..ee2d91e382f1 100644
--- a/arch/x86/kernel/apic/probe_32.c
+++ b/arch/x86/kernel/apic/probe_32.c
@@ -184,7 +184,8 @@ void __init default_setup_apic_routing(void)
                                 def_to_bigsmp = 0;
                                 break;
                         }
-                        /* If P4 and above fall through */
+                        /* P4 and above */
+                        /* fall through */
                 case X86_VENDOR_HYGON:
                 case X86_VENDOR_AMD:
                         def_to_bigsmp = 1;
diff --git a/arch/x86/kernel/cpu/umwait.c b/arch/x86/kernel/cpu/umwait.c
index 6a204e7336c1..32b4dc9030aa 100644
--- a/arch/x86/kernel/cpu/umwait.c
+++ b/arch/x86/kernel/cpu/umwait.c
@@ -18,6 +18,12 @@
 static u32 umwait_control_cached = UMWAIT_CTRL_VAL(100000, UMWAIT_C02_ENABLE);
 
 /*
+ * Cache the original IA32_UMWAIT_CONTROL MSR value which is configured by
+ * hardware or BIOS before kernel boot.
+ */
+static u32 orig_umwait_control_cached __ro_after_init;
+
+/*
  * Serialize access to umwait_control_cached and IA32_UMWAIT_CONTROL MSR in
  * the sysfs write functions.
  */
@@ -53,6 +59,23 @@ static int umwait_cpu_online(unsigned int cpu)
 }
 
 /*
+ * The CPU hotplug callback sets the control MSR to the original control
+ * value.
+ */
+static int umwait_cpu_offline(unsigned int cpu)
+{
+        /*
+         * This code is protected by the CPU hotplug already and
+         * orig_umwait_control_cached is never changed after it caches
+         * the original control MSR value in umwait_init(). So there
+         * is no race condition here.
+         */
+        wrmsr(MSR_IA32_UMWAIT_CONTROL, orig_umwait_control_cached, 0);
+
+        return 0;
+}
+
+/*
  * On resume, restore IA32_UMWAIT_CONTROL MSR on the boot processor which
  * is the only active CPU at this time. The MSR is set up on the APs via the
  * CPU hotplug callback.
@@ -185,8 +208,22 @@ static int __init umwait_init(void)
         if (!boot_cpu_has(X86_FEATURE_WAITPKG))
                 return -ENODEV;
 
+        /*
+         * Cache the original control MSR value before the control MSR is
+         * changed. This is the only place where orig_umwait_control_cached
+         * is modified.
+         */
+        rdmsrl(MSR_IA32_UMWAIT_CONTROL, orig_umwait_control_cached);
+
         ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "umwait:online",
-                                umwait_cpu_online, NULL);
+                                umwait_cpu_online, umwait_cpu_offline);
+        if (ret < 0) {
+                /*
+                 * On failure, the control MSR on all CPUs has the
+                 * original control value.
+                 */
+                return ret;
+        }
 
         register_syscore_ops(&umwait_syscore_ops);
 
diff --git a/arch/x86/math-emu/errors.c b/arch/x86/math-emu/errors.c
index 6b468517ab71..73dc66d887f3 100644
--- a/arch/x86/math-emu/errors.c
+++ b/arch/x86/math-emu/errors.c
@@ -178,13 +178,15 @@ void FPU_printall(void)
         for (i = 0; i < 8; i++) {
                 FPU_REG *r = &st(i);
                 u_char tagi = FPU_gettagi(i);
+
                 switch (tagi) {
                 case TAG_Empty:
                         continue;
-                        break;
                 case TAG_Zero:
                 case TAG_Special:
+                        /* Update tagi for the printk below */
                         tagi = FPU_Special(r);
+                        /* fall through */
                 case TAG_Valid:
                         printk("st(%d)  %c .%04lx %04lx %04lx %04lx e%+-6d ", i,
                                getsign(r) ? '-' : '+',
@@ -198,7 +200,6 @@ void FPU_printall(void)
                         printk("Whoops! Error in errors.c: tag%d is %d ", i,
                                tagi);
                         continue;
-                        break;
                 }
                 printk("%s\n", tag_desc[(int)(unsigned)tagi]);
         }
diff --git a/arch/x86/math-emu/fpu_trig.c b/arch/x86/math-emu/fpu_trig.c
index 783c509f957a..127ea54122d7 100644
--- a/arch/x86/math-emu/fpu_trig.c
+++ b/arch/x86/math-emu/fpu_trig.c
@@ -1352,7 +1352,7 @@ static void fyl2xp1(FPU_REG *st0_ptr, u_char st0_tag)
                 case TW_Denormal:
                         if (denormal_operand() < 0)
                                 return;
-
+                        /* fall through */
                 case TAG_Zero:
                 case TAG_Valid:
                         setsign(st0_ptr, getsign(st0_ptr) ^ getsign(st1_ptr));
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 5cb8a62e091c..7c3106093c75 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -511,6 +511,7 @@ void cpu_reset(void)
                                       "add      %2, %2, %7\n\t"
                                       "addi     %0, %0, -1\n\t"
                                       "bnez     %0, 1b\n\t"
+                                      "isync\n\t"
                                       /* Jump to identity mapping */
                                       "jx       %3\n"
                                       "2:\n\t"
diff --git a/block/blk-mq.c b/block/blk-mq.c
index f78d3287dd82..0835f4d8d42e 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1958,13 +1958,9 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
         rq = blk_mq_get_request(q, bio, &data);
         if (unlikely(!rq)) {
                 rq_qos_cleanup(q, bio);
-
-                cookie = BLK_QC_T_NONE;
-                if (bio->bi_opf & REQ_NOWAIT_INLINE)
-                        cookie = BLK_QC_T_EAGAIN;
-                else if (bio->bi_opf & REQ_NOWAIT)
+                if (bio->bi_opf & REQ_NOWAIT)
                         bio_wouldblock_error(bio);
-                return cookie;
+                return BLK_QC_T_NONE;
         }
 
         trace_block_getrq(q, bio, bio->bi_opf);
@@ -2666,8 +2662,6 @@ void blk_mq_release(struct request_queue *q)
         struct blk_mq_hw_ctx *hctx, *next;
         int i;
 
-        cancel_delayed_work_sync(&q->requeue_work);
-
         queue_for_each_hw_ctx(q, hctx, i)
                 WARN_ON_ONCE(hctx && list_empty(&hctx->hctx_list));
 
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 977c659dcd18..9bfa3ea4ed63 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -892,6 +892,9 @@ static void __blk_release_queue(struct work_struct *work)
 
         blk_free_queue_stats(q->stats);
 
+        if (queue_is_mq(q))
+                cancel_delayed_work_sync(&q->requeue_work);
+
         blk_exit_queue(q);
 
         blk_queue_free_zone_bitmaps(q);
diff --git a/drivers/auxdisplay/Kconfig b/drivers/auxdisplay/Kconfig
index dd61fdd400f0..68489d1f00bb 100644
--- a/drivers/auxdisplay/Kconfig
+++ b/drivers/auxdisplay/Kconfig
@@ -448,6 +448,11 @@ config PANEL_BOOT_MESSAGE
 choice
         prompt "Backlight initial state"
         default CHARLCD_BL_FLASH
+        ---help---
+          Select the initial backlight state on boot or module load.
+
+          Previously, there was no option for this: the backlight flashed
+          briefly on init. Now you can also turn it off/on.
 
         config CHARLCD_BL_OFF
                 bool "Off"
diff --git a/drivers/auxdisplay/charlcd.c b/drivers/auxdisplay/charlcd.c
index 92745efefb54..bef6b85778b6 100644
--- a/drivers/auxdisplay/charlcd.c
+++ b/drivers/auxdisplay/charlcd.c
@@ -20,7 +20,7 @@
 
 #include <generated/utsrelease.h>
 
-#include <misc/charlcd.h>
+#include "charlcd.h"
 
 #define LCD_MINOR               156
 
diff --git a/include/misc/charlcd.h b/drivers/auxdisplay/charlcd.h
index 8cf6c18b0adb..00911ad0f3de 100644
--- a/include/misc/charlcd.h
+++ b/drivers/auxdisplay/charlcd.h
@@ -6,6 +6,9 @@
  * Copyright (C) 2016-2017 Glider bvba
  */
 
+#ifndef _CHARLCD_H
+#define _CHARLCD_H
+
 struct charlcd {
         const struct charlcd_ops *ops;
         const unsigned char *char_conv; /* Optional */
@@ -37,3 +40,5 @@ int charlcd_register(struct charlcd *lcd);
 int charlcd_unregister(struct charlcd *lcd);
 
 void charlcd_poke(struct charlcd *lcd);
+
+#endif /* CHARLCD_H */
diff --git a/drivers/auxdisplay/hd44780.c b/drivers/auxdisplay/hd44780.c
index ab15b64707ad..bcbe13092327 100644
--- a/drivers/auxdisplay/hd44780.c
+++ b/drivers/auxdisplay/hd44780.c
@@ -14,8 +14,7 @@
 #include <linux/property.h>
 #include <linux/slab.h>
 
-#include <misc/charlcd.h>
-
+#include "charlcd.h"
 
 enum hd44780_pin {
         /* Order does matter due to writing to GPIO array subsets! */
diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
index e06de63497cf..85965953683e 100644
--- a/drivers/auxdisplay/panel.c
+++ b/drivers/auxdisplay/panel.c
@@ -55,7 +55,7 @@
 #include <linux/io.h>
 #include <linux/uaccess.h>
 
-#include <misc/charlcd.h>
+#include "charlcd.h"
 
 #define KEYPAD_MINOR            185
 
@@ -1617,6 +1617,8 @@ static void panel_attach(struct parport *port)
         return;
 
 err_lcd_unreg:
+        if (scan_timer.function)
+                del_timer_sync(&scan_timer);
         if (lcd.enabled)
                 charlcd_unregister(lcd.charlcd);
 err_unreg_device:
diff --git a/drivers/base/regmap/Kconfig b/drivers/base/regmap/Kconfig
index a4984136c19d..0fd6f97ee523 100644
--- a/drivers/base/regmap/Kconfig
+++ b/drivers/base/regmap/Kconfig
@@ -44,7 +44,7 @@ config REGMAP_IRQ
 
 config REGMAP_SOUNDWIRE
         tristate
-        depends on SOUNDWIRE_BUS
+        depends on SOUNDWIRE
 
 config REGMAP_SCCB
         tristate
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 3ac6a5d18071..b90dbcd99c03 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -965,6 +965,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
                 }
         }
 
+        err = -ENOMEM;
         for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) {
                 req = kzalloc(sizeof(*req), GFP_KERNEL);
                 if (!req)
@@ -987,7 +988,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
         err = xen_blkif_map(ring, ring_ref, nr_grefs, evtchn);
         if (err) {
                 xenbus_dev_fatal(dev, err, "mapping ring-ref port %u", evtchn);
-                return err;
+                goto fail;
         }
 
         return 0;
@@ -1007,8 +1008,7 @@ fail:
                 }
                 kfree(req);
         }
-        return -ENOMEM;
-
+        return err;
 }
 
 static int connect_ring(struct backend_info *be)
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 8dda62367816..c28ebf2810f1 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -2528,7 +2528,7 @@ static int cpufreq_boost_set_sw(int state)
                 }
 
                 ret = dev_pm_qos_update_request(policy->max_freq_req, policy->max);
-                if (ret)
+                if (ret < 0)
                         break;
         }
 
diff --git a/drivers/dma/dw-edma/dw-edma-core.h b/drivers/dma/dw-edma/dw-edma-core.h
index b6cc90cbc9dc..4e5f9f6e901b 100644
--- a/drivers/dma/dw-edma/dw-edma-core.h
+++ b/drivers/dma/dw-edma/dw-edma-core.h
@@ -50,7 +50,7 @@ struct dw_edma_burst {
 
 struct dw_edma_region {
         phys_addr_t                     paddr;
-        dma_addr_t                      vaddr;
+        void                            __iomem *vaddr;
         size_t                          sz;
 };
 
diff --git a/drivers/dma/dw-edma/dw-edma-pcie.c b/drivers/dma/dw-edma/dw-edma-pcie.c
index 4c96e1c948f2..dc85f55e1bb8 100644
--- a/drivers/dma/dw-edma/dw-edma-pcie.c
+++ b/drivers/dma/dw-edma/dw-edma-pcie.c
@@ -130,19 +130,19 @@ static int dw_edma_pcie_probe(struct pci_dev *pdev,
         chip->id = pdev->devfn;
         chip->irq = pdev->irq;
 
-        dw->rg_region.vaddr = (dma_addr_t)pcim_iomap_table(pdev)[pdata->rg_bar];
+        dw->rg_region.vaddr = pcim_iomap_table(pdev)[pdata->rg_bar];
         dw->rg_region.vaddr += pdata->rg_off;
         dw->rg_region.paddr = pdev->resource[pdata->rg_bar].start;
         dw->rg_region.paddr += pdata->rg_off;
         dw->rg_region.sz = pdata->rg_sz;
 
-        dw->ll_region.vaddr = (dma_addr_t)pcim_iomap_table(pdev)[pdata->ll_bar];
+        dw->ll_region.vaddr = pcim_iomap_table(pdev)[pdata->ll_bar];
         dw->ll_region.vaddr += pdata->ll_off;
         dw->ll_region.paddr = pdev->resource[pdata->ll_bar].start;
         dw->ll_region.paddr += pdata->ll_off;
         dw->ll_region.sz = pdata->ll_sz;
 
-        dw->dt_region.vaddr = (dma_addr_t)pcim_iomap_table(pdev)[pdata->dt_bar];
+        dw->dt_region.vaddr = pcim_iomap_table(pdev)[pdata->dt_bar];
         dw->dt_region.vaddr += pdata->dt_off;
         dw->dt_region.paddr = pdev->resource[pdata->dt_bar].start;
         dw->dt_region.paddr += pdata->dt_off;
@@ -158,17 +158,17 @@ static int dw_edma_pcie_probe(struct pci_dev *pdev,
         pci_dbg(pdev, "Mode:\t%s\n",
                 dw->mode == EDMA_MODE_LEGACY ? "Legacy" : "Unroll");
 
-        pci_dbg(pdev, "Registers:\tBAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%pa, p=%pa)\n",
+        pci_dbg(pdev, "Registers:\tBAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%p, p=%pa)\n",
                 pdata->rg_bar, pdata->rg_off, pdata->rg_sz,
-                &dw->rg_region.vaddr, &dw->rg_region.paddr);
+                dw->rg_region.vaddr, &dw->rg_region.paddr);
 
-        pci_dbg(pdev, "L. List:\tBAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%pa, p=%pa)\n",
+        pci_dbg(pdev, "L. List:\tBAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%p, p=%pa)\n",
                 pdata->ll_bar, pdata->ll_off, pdata->ll_sz,
-                &dw->ll_region.vaddr, &dw->ll_region.paddr);
+                dw->ll_region.vaddr, &dw->ll_region.paddr);
 
-        pci_dbg(pdev, "Data:\tBAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%pa, p=%pa)\n",
+        pci_dbg(pdev, "Data:\tBAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%p, p=%pa)\n",
                 pdata->dt_bar, pdata->dt_off, pdata->dt_sz,
-                &dw->dt_region.vaddr, &dw->dt_region.paddr);
+                dw->dt_region.vaddr, &dw->dt_region.paddr);
 
         pci_dbg(pdev, "Nr. IRQs:\t%u\n", dw->nr_irqs);
 
diff --git a/drivers/dma/dw-edma/dw-edma-v0-core.c b/drivers/dma/dw-edma/dw-edma-v0-core.c
index 8a3180ed49a6..692de47b1670 100644
--- a/drivers/dma/dw-edma/dw-edma-v0-core.c
+++ b/drivers/dma/dw-edma/dw-edma-v0-core.c
@@ -25,7 +25,7 @@ enum dw_edma_control {
 
 static inline struct dw_edma_v0_regs __iomem *__dw_regs(struct dw_edma *dw)
 {
-        return (struct dw_edma_v0_regs __iomem *)dw->rg_region.vaddr;
+        return dw->rg_region.vaddr;
 }
 
 #define SET(dw, name, value)                            \
@@ -192,13 +192,12 @@ u32 dw_edma_v0_core_status_abort_int(struct dw_edma *dw, enum dw_edma_dir dir)
 static void dw_edma_v0_core_write_chunk(struct dw_edma_chunk *chunk)
 {
         struct dw_edma_burst *child;
-        struct dw_edma_v0_lli *lli;
-        struct dw_edma_v0_llp *llp;
+        struct dw_edma_v0_lli __iomem *lli;
+        struct dw_edma_v0_llp __iomem *llp;
         u32 control = 0, i = 0;
-        u64 sar, dar, addr;
         int j;
 
-        lli = (struct dw_edma_v0_lli *)chunk->ll_region.vaddr;
+        lli = chunk->ll_region.vaddr;
 
         if (chunk->cb)
                 control = DW_EDMA_V0_CB;
@@ -214,17 +213,15 @@ static void dw_edma_v0_core_write_chunk(struct dw_edma_chunk *chunk)
                 /* Transfer size */
                 SET_LL(&lli[i].transfer_size, child->sz);
                 /* SAR - low, high */
-                sar = cpu_to_le64(child->sar);
-                SET_LL(&lli[i].sar_low, lower_32_bits(sar));
-                SET_LL(&lli[i].sar_high, upper_32_bits(sar));
+                SET_LL(&lli[i].sar_low, lower_32_bits(child->sar));
+                SET_LL(&lli[i].sar_high, upper_32_bits(child->sar));
                 /* DAR - low, high */
-                dar = cpu_to_le64(child->dar);
-                SET_LL(&lli[i].dar_low, lower_32_bits(dar));
-                SET_LL(&lli[i].dar_high, upper_32_bits(dar));
+                SET_LL(&lli[i].dar_low, lower_32_bits(child->dar));
+                SET_LL(&lli[i].dar_high, upper_32_bits(child->dar));
                 i++;
         }
 
-        llp = (struct dw_edma_v0_llp *)&lli[i];
+        llp = (void __iomem *)&lli[i];
         control = DW_EDMA_V0_LLP | DW_EDMA_V0_TCB;
         if (!chunk->cb)
                 control |= DW_EDMA_V0_CB;
@@ -232,9 +229,8 @@ static void dw_edma_v0_core_write_chunk(struct dw_edma_chunk *chunk)
         /* Channel control */
         SET_LL(&llp->control, control);
         /* Linked list  - low, high */
-        addr = cpu_to_le64(chunk->ll_region.paddr);
-        SET_LL(&llp->llp_low, lower_32_bits(addr));
-        SET_LL(&llp->llp_high, upper_32_bits(addr));
+        SET_LL(&llp->llp_low, lower_32_bits(chunk->ll_region.paddr));
+        SET_LL(&llp->llp_high, upper_32_bits(chunk->ll_region.paddr));
 }
 
 void dw_edma_v0_core_start(struct dw_edma_chunk *chunk, bool first)
@@ -242,7 +238,6 @@ void dw_edma_v0_core_start(struct dw_edma_chunk *chunk, bool first)
         struct dw_edma_chan *chan = chunk->chan;
         struct dw_edma *dw = chan->chip->dw;
         u32 tmp;
-        u64 llp;
 
         dw_edma_v0_core_write_chunk(chunk);
 
@@ -262,9 +257,10 @@ void dw_edma_v0_core_start(struct dw_edma_chunk *chunk, bool first)
                 SET_CH(dw, chan->dir, chan->id, ch_control1,
                        (DW_EDMA_V0_CCS | DW_EDMA_V0_LLE));
                 /* Linked list - low, high */
-                llp = cpu_to_le64(chunk->ll_region.paddr);
-                SET_CH(dw, chan->dir, chan->id, llp_low, lower_32_bits(llp));
-                SET_CH(dw, chan->dir, chan->id, llp_high, upper_32_bits(llp));
+                SET_CH(dw, chan->dir, chan->id, llp_low,
+                       lower_32_bits(chunk->ll_region.paddr));
+                SET_CH(dw, chan->dir, chan->id, llp_high,
+                       upper_32_bits(chunk->ll_region.paddr));
         }
         /* Doorbell */
         SET_RW(dw, chan->dir, doorbell,
diff --git a/drivers/dma/dw-edma/dw-edma-v0-debugfs.c b/drivers/dma/dw-edma/dw-edma-v0-debugfs.c
index 3226f528cc11..42739508c0d8 100644
--- a/drivers/dma/dw-edma/dw-edma-v0-debugfs.c
+++ b/drivers/dma/dw-edma/dw-edma-v0-debugfs.c
@@ -14,7 +14,7 @@
 #include "dw-edma-core.h"
 
 #define REGS_ADDR(name) \
-        ((dma_addr_t *)&regs->name)
+        ((void __force *)&regs->name)
 #define REGISTER(name) \
         { #name, REGS_ADDR(name) }
 
@@ -40,36 +40,37 @@
 
 static struct dentry                            *base_dir;
 static struct dw_edma                           *dw;
-static struct dw_edma_v0_regs                   *regs;
+static struct dw_edma_v0_regs                   __iomem *regs;
 
 static struct {
-        void                                    *start;
-        void                                    *end;
+        void                                    __iomem *start;
+        void                                    __iomem *end;
 } lim[2][EDMA_V0_MAX_NR_CH];
 
 struct debugfs_entries {
-        char                                    name[24];
+        const char                              *name;
         dma_addr_t                              *reg;
 };
 
 static int dw_edma_debugfs_u32_get(void *data, u64 *val)
 {
+        void __iomem *reg = (void __force __iomem *)data;
         if (dw->mode == EDMA_MODE_LEGACY &&
-            data >= (void *)&regs->type.legacy.ch) {
-                void *ptr = (void *)&regs->type.legacy.ch;
+            reg >= (void __iomem *)&regs->type.legacy.ch) {
+                void __iomem *ptr = &regs->type.legacy.ch;
                 u32 viewport_sel = 0;
                 unsigned long flags;
                 u16 ch;
 
                 for (ch = 0; ch < dw->wr_ch_cnt; ch++)
-                        if (lim[0][ch].start >= data && data < lim[0][ch].end) {
-                                ptr += (data - lim[0][ch].start);
+                        if (lim[0][ch].start >= reg && reg < lim[0][ch].end) {
+                                ptr += (reg - lim[0][ch].start);
                                 goto legacy_sel_wr;
                         }
 
                 for (ch = 0; ch < dw->rd_ch_cnt; ch++)
-                        if (lim[1][ch].start >= data && data < lim[1][ch].end) {
-                                ptr += (data - lim[1][ch].start);
+                        if (lim[1][ch].start >= reg && reg < lim[1][ch].end) {
+                                ptr += (reg - lim[1][ch].start);
                                 goto legacy_sel_rd;
                         }
 
@@ -86,7 +87,7 @@ legacy_sel_wr:
 
                 raw_spin_unlock_irqrestore(&dw->lock, flags);
         } else {
-                *val = readl(data);
+                *val = readl(reg);
         }
 
         return 0;
@@ -105,7 +106,7 @@ static void dw_edma_debugfs_create_x32(const struct debugfs_entries entries[],
         }
 }
 
-static void dw_edma_debugfs_regs_ch(struct dw_edma_v0_ch_regs *regs,
+static void dw_edma_debugfs_regs_ch(struct dw_edma_v0_ch_regs __iomem *regs,
                                     struct dentry *dir)
 {
         int nr_entries;
@@ -288,7 +289,7 @@ void dw_edma_v0_debugfs_on(struct dw_edma_chip *chip)
         if (!dw)
                 return;
 
-        regs = (struct dw_edma_v0_regs *)dw->rg_region.vaddr;
+        regs = dw->rg_region.vaddr;
         if (!regs)
                 return;
 
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index 89d710899010..de8bfd9a76e9 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -142,7 +142,7 @@ enum d40_events {
  * when the DMA hw is powered off.
  * TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works.
  */
-static u32 d40_backup_regs[] = {
+static __maybe_unused u32 d40_backup_regs[] = {
         D40_DREG_LCPA,
         D40_DREG_LCLA,
         D40_DREG_PRMSE,
@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = {
 
 #define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b)
 
-static u32 d40_backup_regs_chan[] = {
+static __maybe_unused u32 d40_backup_regs_chan[] = {
         D40_CHAN_REG_SSCFG,
         D40_CHAN_REG_SSELT,
         D40_CHAN_REG_SSPTR,
diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c
index d6e919d3936a..1311de74bfdd 100644
--- a/drivers/dma/stm32-mdma.c
+++ b/drivers/dma/stm32-mdma.c
@@ -1366,7 +1366,7 @@ static irqreturn_t stm32_mdma_irq_handler(int irq, void *devid)
 
         chan = &dmadev->chan[id];
         if (!chan) {
-                dev_err(chan2dev(chan), "MDMA channel not initialized\n");
+                dev_dbg(mdma2dev(dmadev), "MDMA channel not initialized\n");
                 goto exit;
         }
 
diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
index 2805853e963f..b33cf6e8ab8e 100644
--- a/drivers/dma/tegra210-adma.c
+++ b/drivers/dma/tegra210-adma.c
@@ -712,7 +712,7 @@ static struct dma_chan *tegra_dma_of_xlate(struct of_phandle_args *dma_spec,
         return chan;
 }
 
-static int tegra_adma_runtime_suspend(struct device *dev)
+static int __maybe_unused tegra_adma_runtime_suspend(struct device *dev)
 {
         struct tegra_adma *tdma = dev_get_drvdata(dev);
         struct tegra_adma_chan_regs *ch_reg;
@@ -744,7 +744,7 @@ clk_disable:
         return 0;
 }
 
-static int tegra_adma_runtime_resume(struct device *dev)
+static int __maybe_unused tegra_adma_runtime_resume(struct device *dev)
 {
         struct tegra_adma *tdma = dev_get_drvdata(dev);
         struct tegra_adma_chan_regs *ch_reg;
diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c
index ba2489d4ea24..ba27802efcd0 100644
--- a/drivers/dma/ti/omap-dma.c
+++ b/drivers/dma/ti/omap-dma.c
@@ -1234,7 +1234,7 @@ static struct dma_async_tx_descriptor *omap_dma_prep_dma_interleaved(
         if (src_icg) {
                 d->ccr |= CCR_SRC_AMODE_DBLIDX;
                 d->ei = 1;
-                d->fi = src_icg;
+                d->fi = src_icg + 1;
         } else if (xt->src_inc) {
                 d->ccr |= CCR_SRC_AMODE_POSTINC;
                 d->fi = 0;
@@ -1249,7 +1249,7 @@ static struct dma_async_tx_descriptor *omap_dma_prep_dma_interleaved(
         if (dst_icg) {
                 d->ccr |= CCR_DST_AMODE_DBLIDX;
                 sg->ei = 1;
-                sg->fi = dst_icg;
+                sg->fi = dst_icg + 1;
         } else if (xt->dst_inc) {
                 d->ccr |= CCR_DST_AMODE_POSTINC;
                 sg->fi = 0;
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 1db780c0f07b..3caae7f2cf56 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -927,17 +927,33 @@ fail:
         return status;
 }
 
+#define GET_EFI_CONFIG_TABLE(bits)                                      \
+static void *get_efi_config_table##bits(efi_system_table_t *_sys_table, \
+                                        efi_guid_t guid)                \
+{                                                                       \
+        efi_system_table_##bits##_t *sys_table;                         \
+        efi_config_table_##bits##_t *tables;                            \
+        int i;                                                          \
+                                                                        \
+        sys_table = (typeof(sys_table))_sys_table;                      \
+        tables = (typeof(tables))(unsigned long)sys_table->tables;      \
+                                                                        \
+        for (i = 0; i < sys_table->nr_tables; i++) {                    \
+                if (efi_guidcmp(tables[i].guid, guid) != 0)             \
+                        continue;                                       \
+                                                                        \
+                return (void *)(unsigned long)tables[i].table;          \
+        }                                                               \
+                                                                        \
+        return NULL;                                                    \
+}
+GET_EFI_CONFIG_TABLE(32)
+GET_EFI_CONFIG_TABLE(64)
+
 void *get_efi_config_table(efi_system_table_t *sys_table, efi_guid_t guid)
 {
-        efi_config_table_t *tables = (efi_config_table_t *)sys_table->tables;
-        int i;
-
-        for (i = 0; i < sys_table->nr_tables; i++) {
-                if (efi_guidcmp(tables[i].guid, guid) != 0)
-                        continue;
-
-                return (void *)tables[i].table;
-        }
-
-        return NULL;
+        if (efi_is_64bit())
+                return get_efi_config_table64(sys_table, guid);
+        else
+                return get_efi_config_table32(sys_table, guid);
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index 1cf639a51178..04b8ac4432c7 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -4869,7 +4869,7 @@ static void gfx_v9_0_ring_soft_recovery(struct amdgpu_ring *ring, unsigned vmid)
         value = REG_SET_FIELD(value, SQ_CMD, MODE, 0x01);
         value = REG_SET_FIELD(value, SQ_CMD, CHECK_VMID, 1);
         value = REG_SET_FIELD(value, SQ_CMD, VM_ID, vmid);
-        WREG32(mmSQ_CMD, value);
+        WREG32_SOC15(GC, 0, mmSQ_CMD, value);
 }
 
 static void gfx_v9_0_set_gfx_eop_interrupt_state(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index fa20201eef3a..cbc480a33376 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -23,6 +23,7 @@
  */
 
 #include <linux/slab.h>
+#include <linux/mm.h>
 
 #include "dm_services.h"
 
@@ -1171,8 +1172,8 @@ bool dc_post_update_surfaces_to_stream(struct dc *dc)
 
 struct dc_state *dc_create_state(struct dc *dc)
 {
-        struct dc_state *context = kzalloc(sizeof(struct dc_state),
-                                           GFP_KERNEL);
+        struct dc_state *context = kvzalloc(sizeof(struct dc_state),
+                                            GFP_KERNEL);
 
         if (!context)
                 return NULL;
@@ -1192,11 +1193,11 @@ struct dc_state *dc_create_state(struct dc *dc)
 struct dc_state *dc_copy_state(struct dc_state *src_ctx)
 {
         int i, j;
-        struct dc_state *new_ctx = kmemdup(src_ctx,
-                        sizeof(struct dc_state), GFP_KERNEL);
+        struct dc_state *new_ctx = kvmalloc(sizeof(struct dc_state), GFP_KERNEL);
 
         if (!new_ctx)
                 return NULL;
+        memcpy(new_ctx, src_ctx, sizeof(struct dc_state));
 
         for (i = 0; i < MAX_PIPES; i++) {
                         struct pipe_ctx *cur_pipe = &new_ctx->res_ctx.pipe_ctx[i];
@@ -1230,7 +1231,7 @@ static void dc_state_free(struct kref *kref)
 {
         struct dc_state *context = container_of(kref, struct dc_state, refcount);
         dc_resource_state_destruct(context);
-        kfree(context);
+        kvfree(context);
 }
 
 void dc_release_state(struct dc_state *context)
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index 4c7e31cb45ff..a5d1494a3dc4 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -131,8 +131,8 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post)
 
 
         /* Enable extended register access */
-        ast_enable_mmio(dev);
         ast_open_key(ast);
+        ast_enable_mmio(dev);
 
         /* Find out whether P2A works or whether to use device-tree */
         ast_detect_config_mode(dev, &scu_rev);
@@ -576,6 +576,9 @@ void ast_driver_unload(struct drm_device *dev)
 {
         struct ast_private *ast = dev->dev_private;
 
+        /* enable standard VGA decode */
+        ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x04);
+
         ast_release_firmware(dev);
         kfree(ast->dp501_fw_addr);
         ast_mode_fini(dev);
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
index ffccbef962a4..a1cb020e07e5 100644
--- a/drivers/gpu/drm/ast/ast_mode.c
+++ b/drivers/gpu/drm/ast/ast_mode.c
@@ -604,7 +604,7 @@ static int ast_crtc_mode_set(struct drm_crtc *crtc,
                 return -EINVAL;
         ast_open_key(ast);
 
-        ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04);
+        ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06);
 
         ast_set_std_reg(crtc, adjusted_mode, &vbios_mode);
         ast_set_crtc_reg(crtc, adjusted_mode, &vbios_mode);
diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
index f7d421359d56..c1d1ac51d1c2 100644
--- a/drivers/gpu/drm/ast/ast_post.c
+++ b/drivers/gpu/drm/ast/ast_post.c
@@ -46,7 +46,7 @@ void ast_enable_mmio(struct drm_device *dev)
 {
         struct ast_private *ast = dev->dev_private;
 
-        ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04);
+        ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06);
 }
 
 
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 9f3fd7d96a69..75baff657e43 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -1528,9 +1528,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
                         if (!intel_gvt_ggtt_validate_range(vgpu,
                                 workload->wa_ctx.indirect_ctx.guest_gma,
                                 workload->wa_ctx.indirect_ctx.size)) {
-                                kmem_cache_free(s->workloads, workload);
                                 gvt_vgpu_err("invalid wa_ctx at: 0x%lx\n",
                                     workload->wa_ctx.indirect_ctx.guest_gma);
+                                kmem_cache_free(s->workloads, workload);
                                 return ERR_PTR(-EINVAL);
                         }
                 }
@@ -1542,9 +1542,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
                         if (!intel_gvt_ggtt_validate_range(vgpu,
                                 workload->wa_ctx.per_ctx.guest_gma,
                                 CACHELINE_BYTES)) {
-                                kmem_cache_free(s->workloads, workload);
                                 gvt_vgpu_err("invalid per_ctx at: 0x%lx\n",
                                         workload->wa_ctx.per_ctx.guest_gma);
+                                kmem_cache_free(s->workloads, workload);
                                 return ERR_PTR(-EINVAL);
                         }
                 }
diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index 126703816794..5c36c75232e6 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -771,16 +771,20 @@ nv50_msto_atomic_check(struct drm_encoder *encoder,
         struct nv50_head_atom *asyh = nv50_head_atom(crtc_state);
         int slots;
 
-        /* When restoring duplicated states, we need to make sure that the
-         * bw remains the same and avoid recalculating it, as the connector's
-         * bpc may have changed after the state was duplicated
-         */
-        if (!state->duplicated)
-                asyh->dp.pbn =
-                        drm_dp_calc_pbn_mode(crtc_state->adjusted_mode.clock,
-                                             connector->display_info.bpc * 3);
+        if (crtc_state->mode_changed || crtc_state->connectors_changed) {
+                /*
+                 * When restoring duplicated states, we need to make sure that
+                 * the bw remains the same and avoid recalculating it, as the
+                 * connector's bpc may have changed after the state was
+                 * duplicated
+                 */
+                if (!state->duplicated) {
+                        const int bpp = connector->display_info.bpc * 3;
+                        const int clock = crtc_state->adjusted_mode.clock;
+
+                        asyh->dp.pbn = drm_dp_calc_pbn_mode(clock, bpp);
+                }
 
-        if (crtc_state->mode_changed) {
                 slots = drm_dp_atomic_find_vcpi_slots(state, &mstm->mgr,
                                                       mstc->port,
                                                       asyh->dp.pbn);
diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c
index 35ddbec1375a..671c90f34ede 100644
--- a/drivers/gpu/drm/scheduler/sched_entity.c
+++ b/drivers/gpu/drm/scheduler/sched_entity.c
@@ -95,7 +95,7 @@ static bool drm_sched_entity_is_idle(struct drm_sched_entity *entity)
         rmb(); /* for list_empty to work without lock */
 
         if (list_empty(&entity->list) ||
-            spsc_queue_peek(&entity->job_queue) == NULL)
+            spsc_queue_count(&entity->job_queue) == 0)
                 return true;
 
         return false;
@@ -281,7 +281,7 @@ void drm_sched_entity_fini(struct drm_sched_entity *entity)
         /* Consumption of existing IBs wasn't completed. Forcefully
          * remove them here.
          */
-        if (spsc_queue_peek(&entity->job_queue)) {
+        if (spsc_queue_count(&entity->job_queue)) {
                 if (sched) {
                         /* Park the kernel for a moment to make sure it isn't processing
                          * our enity.
diff --git a/drivers/hv/hv_trace.h b/drivers/hv/hv_trace.h
index 999f80a63bff..e70783e33680 100644
--- a/drivers/hv/hv_trace.h
+++ b/drivers/hv/hv_trace.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM hyperv
diff --git a/drivers/hwtracing/intel_th/msu.h b/drivers/hwtracing/intel_th/msu.h
index 574c16004cb2..13d9b141daaa 100644
--- a/drivers/hwtracing/intel_th/msu.h
+++ b/drivers/hwtracing/intel_th/msu.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Intel(R) Trace Hub Memory Storage Unit (MSU) data structures
  *
diff --git a/drivers/hwtracing/intel_th/pti.h b/drivers/hwtracing/intel_th/pti.h
index e9381babc84c..7dfc0431333b 100644
--- a/drivers/hwtracing/intel_th/pti.h
+++ b/drivers/hwtracing/intel_th/pti.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Intel(R) Trace Hub PTI output data structures
  *
diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c
index 35b302d983e0..959d4912ec0d 100644
--- a/drivers/i2c/busses/i2c-emev2.c
+++ b/drivers/i2c/busses/i2c-emev2.c
@@ -69,6 +69,7 @@ struct em_i2c_device {
         struct completion msg_done;
         struct clk *sclk;
         struct i2c_client *slave;
+        int irq;
 };
 
 static inline void em_clear_set_bit(struct em_i2c_device *priv, u8 clear, u8 set, u8 reg)
@@ -339,6 +340,12 @@ static int em_i2c_unreg_slave(struct i2c_client *slave)
 
         writeb(0, priv->base + I2C_OFS_SVA0);
 
+        /*
+         * Wait for interrupt to finish. New slave irqs cannot happen because we
+         * cleared the slave address and, thus, only extension codes will be
+         * detected which do not use the slave ptr.
+         */
+        synchronize_irq(priv->irq);
         priv->slave = NULL;
 
         return 0;
@@ -355,7 +362,7 @@ static int em_i2c_probe(struct platform_device *pdev)
 {
         struct em_i2c_device *priv;
         struct resource *r;
-        int irq, ret;
+        int ret;
 
         priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
         if (!priv)
@@ -390,8 +397,8 @@ static int em_i2c_probe(struct platform_device *pdev)
 
         em_i2c_reset(&priv->adap);
 
-        irq = platform_get_irq(pdev, 0);
-        ret = devm_request_irq(&pdev->dev, irq, em_i2c_irq_handler, 0,
+        priv->irq = platform_get_irq(pdev, 0);
+        ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0,
                                 "em_i2c", priv);
         if (ret)
                 goto err_clk;
@@ -401,7 +408,8 @@ static int em_i2c_probe(struct platform_device *pdev)
         if (ret)
                 goto err_clk;
 
-        dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr, irq);
+        dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr,
+                 priv->irq);
 
         return 0;
 
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index b1b8b938d7f4..15f6cde6452f 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -273,8 +273,8 @@ static inline unsigned char imx_i2c_read_reg(struct imx_i2c_struct *i2c_imx,
 }
 
 /* Functions for DMA support */
-static int i2c_imx_dma_request(struct imx_i2c_struct *i2c_imx,
-                               dma_addr_t phy_addr)
+static void i2c_imx_dma_request(struct imx_i2c_struct *i2c_imx,
+                                                dma_addr_t phy_addr)
 {
         struct imx_i2c_dma *dma;
         struct dma_slave_config dma_sconfig;
@@ -283,7 +283,7 @@ static int i2c_imx_dma_request(struct imx_i2c_struct *i2c_imx,
 
         dma = devm_kzalloc(dev, sizeof(*dma), GFP_KERNEL);
         if (!dma)
-                return -ENOMEM;
+                return;
 
         dma->chan_tx = dma_request_chan(dev, "tx");
         if (IS_ERR(dma->chan_tx)) {
@@ -328,7 +328,7 @@ static int i2c_imx_dma_request(struct imx_i2c_struct *i2c_imx,
         dev_info(dev, "using %s (tx) and %s (rx) for DMA transfers\n",
                 dma_chan_name(dma->chan_tx), dma_chan_name(dma->chan_rx));
 
-        return 0;
+        return;
 
 fail_rx:
         dma_release_channel(dma->chan_rx);
@@ -336,8 +336,6 @@ fail_tx:
         dma_release_channel(dma->chan_tx);
 fail_al:
         devm_kfree(dev, dma);
-        /* return successfully if there is no dma support */
-        return ret == -ENODEV ? 0 : ret;
 }
 
 static void i2c_imx_dma_callback(void *arg)
@@ -1165,17 +1163,13 @@ static int i2c_imx_probe(struct platform_device *pdev)
         dev_dbg(&i2c_imx->adapter.dev, "device resources: %pR\n", res);
         dev_dbg(&i2c_imx->adapter.dev, "adapter name: \"%s\"\n",
                 i2c_imx->adapter.name);
+        dev_info(&i2c_imx->adapter.dev, "IMX I2C adapter registered\n");
 
         /* Init DMA config if supported */
-        ret = i2c_imx_dma_request(i2c_imx, phy_addr);
-        if (ret < 0)
-                goto del_adapter;
+        i2c_imx_dma_request(i2c_imx, phy_addr);
 
-        dev_info(&i2c_imx->adapter.dev, "IMX I2C adapter registered\n");
         return 0;   /* Return OK */
 
-del_adapter:
-        i2c_del_adapter(&i2c_imx->adapter);
 clk_notifier_unregister:
         clk_notifier_unregister(i2c_imx->clk, &i2c_imx->clk_change_nb);
 rpm_disable:
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index d39a4606f72d..531c01100b56 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -139,6 +139,7 @@ struct rcar_i2c_priv {
         enum dma_data_direction dma_direction;
 
         struct reset_control *rstc;
+        int irq;
 };
 
 #define rcar_i2c_priv_to_dev(p)         ((p)->adap.dev.parent)
@@ -861,9 +862,11 @@ static int rcar_unreg_slave(struct i2c_client *slave)
 
         WARN_ON(!priv->slave);
 
+        /* disable irqs and ensure none is running before clearing ptr */
         rcar_i2c_write(priv, ICSIER, 0);
         rcar_i2c_write(priv, ICSCR, 0);
 
+        synchronize_irq(priv->irq);
         priv->slave = NULL;
 
         pm_runtime_put(rcar_i2c_priv_to_dev(priv));
@@ -918,7 +921,7 @@ static int rcar_i2c_probe(struct platform_device *pdev)
         struct i2c_adapter *adap;
         struct device *dev = &pdev->dev;
         struct i2c_timings i2c_t;
-        int irq, ret;
+        int ret;
 
         /* Otherwise logic will break because some bytes must always use PIO */
         BUILD_BUG_ON_MSG(RCAR_MIN_DMA_LEN < 3, "Invalid min DMA length");
@@ -984,10 +987,10 @@ static int rcar_i2c_probe(struct platform_device *pdev)
                 pm_runtime_put(dev);
 
 
-        irq = platform_get_irq(pdev, 0);
-        ret = devm_request_irq(dev, irq, rcar_i2c_irq, 0, dev_name(dev), priv);
+        priv->irq = platform_get_irq(pdev, 0);
+        ret = devm_request_irq(dev, priv->irq, rcar_i2c_irq, 0, dev_name(dev), priv);
         if (ret < 0) {
-                dev_err(dev, "cannot get irq %d\n", irq);
+                dev_err(dev, "cannot get irq %d\n", priv->irq);
                 goto out_pm_disable;
         }
 
diff --git a/drivers/i2c/busses/i2c-stm32.h b/drivers/i2c/busses/i2c-stm32.h
index 868755f82f88..2c21893905a3 100644
--- a/drivers/i2c/busses/i2c-stm32.h
+++ b/drivers/i2c/busses/i2c-stm32.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * i2c-stm32.h
  *
diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
index 0e3c6529fc4c..da073d72f649 100644
--- a/drivers/iio/adc/max9611.c
+++ b/drivers/iio/adc/max9611.c
@@ -480,7 +480,7 @@ static int max9611_init(struct max9611_dev *max9611)
         if (ret)
                 return ret;
 
-        regval = ret & MAX9611_TEMP_MASK;
+        regval &= MAX9611_TEMP_MASK;
 
         if ((regval > MAX9611_TEMP_MAX_POS &&
              regval < MAX9611_TEMP_MIN_NEG) ||
diff --git a/drivers/iio/frequency/adf4371.c b/drivers/iio/frequency/adf4371.c
index e48f15cc9ab5..ff82863cbf42 100644
--- a/drivers/iio/frequency/adf4371.c
+++ b/drivers/iio/frequency/adf4371.c
@@ -276,11 +276,11 @@ static int adf4371_set_freq(struct adf4371_state *st, unsigned long long freq,
         st->buf[0] = st->integer >> 8;
         st->buf[1] = 0x40; /* REG12 default */
         st->buf[2] = 0x00;
-        st->buf[3] = st->fract2 & 0xFF;
-        st->buf[4] = st->fract2 >> 7;
-        st->buf[5] = st->fract2 >> 15;
+        st->buf[3] = st->fract1 & 0xFF;
+        st->buf[4] = st->fract1 >> 8;
+        st->buf[5] = st->fract1 >> 16;
         st->buf[6] = ADF4371_FRAC2WORD_L(st->fract2 & 0x7F) |
-                     ADF4371_FRAC1WORD(st->fract1 >> 23);
+                     ADF4371_FRAC1WORD(st->fract1 >> 24);
         st->buf[7] = ADF4371_FRAC2WORD_H(st->fract2 >> 7);
         st->buf[8] = st->mod2 & 0xFF;
         st->buf[9] = ADF4371_MOD2WORD(st->mod2 >> 8);
diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c
index 45d5164e9574..b79890739a2c 100644
--- a/drivers/infiniband/core/counters.c
+++ b/drivers/infiniband/core/counters.c
@@ -38,6 +38,9 @@ int rdma_counter_set_auto_mode(struct ib_device *dev, u8 port,
         int ret;
 
         port_counter = &dev->port_data[port].port_counter;
+        if (!port_counter->hstats)
+                return -EOPNOTSUPP;
+
         mutex_lock(&port_counter->lock);
         if (on) {
                 ret = __counter_set_mode(&port_counter->mode,
@@ -509,6 +512,9 @@ int rdma_counter_bind_qpn_alloc(struct ib_device *dev, u8 port,
         if (!rdma_is_port_valid(dev, port))
                 return -EINVAL;
 
+        if (!dev->port_data[port].port_counter.hstats)
+                return -EOPNOTSUPP;
+
         qp = rdma_counter_get_qp(dev, qp_num);
         if (!qp)
                 return -ENOENT;
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index 783e465e7c41..87d40d1ecdde 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -1952,12 +1952,16 @@ static int stat_get_doit_qp(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         if (fill_nldev_handle(msg, device) ||
             nla_put_u32(msg, RDMA_NLDEV_ATTR_PORT_INDEX, port) ||
-            nla_put_u32(msg, RDMA_NLDEV_ATTR_STAT_MODE, mode))
+            nla_put_u32(msg, RDMA_NLDEV_ATTR_STAT_MODE, mode)) {
+                ret = -EMSGSIZE;
                 goto err_msg;
+        }
 
         if ((mode == RDMA_COUNTER_MODE_AUTO) &&
-            nla_put_u32(msg, RDMA_NLDEV_ATTR_STAT_AUTO_MODE_MASK, mask))
+            nla_put_u32(msg, RDMA_NLDEV_ATTR_STAT_AUTO_MODE_MASK, mask)) {
+                ret = -EMSGSIZE;
                 goto err_msg;
+        }
 
         nlmsg_end(msg, nlh);
         ib_device_put(device);
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index 2a75c6f8d827..c0e15db34680 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -112,10 +112,6 @@ static int ib_umem_notifier_release_trampoline(struct ib_umem_odp *umem_odp,
          * prevent any further fault handling on this MR.
          */
         ib_umem_notifier_start_account(umem_odp);
-        umem_odp->dying = 1;
-        /* Make sure that the fact the umem is dying is out before we release
-         * all pending page faults. */
-        smp_wmb();
         complete_all(&umem_odp->notifier_completion);
         umem_odp->umem.context->invalidate_range(
                 umem_odp, ib_umem_start(umem_odp), ib_umem_end(umem_odp));
diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index ec4370f99381..af5bbb35c058 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -2026,7 +2026,7 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
                         event_sub->eventfd =
                                 eventfd_ctx_fdget(redirect_fd);
 
-                        if (IS_ERR(event_sub)) {
+                        if (IS_ERR(event_sub->eventfd)) {
                                 err = PTR_ERR(event_sub->eventfd);
                                 event_sub->eventfd = NULL;
                                 goto err;
@@ -2644,12 +2644,13 @@ static int devx_async_event_close(struct inode *inode, struct file *filp)
         struct devx_async_event_file *ev_file = filp->private_data;
         struct devx_event_subscription *event_sub, *event_sub_tmp;
         struct devx_async_event_data *entry, *tmp;
+        struct mlx5_ib_dev *dev = ev_file->dev;
 
-        mutex_lock(&ev_file->dev->devx_event_table.event_xa_lock);
+        mutex_lock(&dev->devx_event_table.event_xa_lock);
         /* delete the subscriptions which are related to this FD */
         list_for_each_entry_safe(event_sub, event_sub_tmp,
                                  &ev_file->subscribed_events_list, file_list) {
-                devx_cleanup_subscription(ev_file->dev, event_sub);
+                devx_cleanup_subscription(dev, event_sub);
                 if (event_sub->eventfd)
                         eventfd_ctx_put(event_sub->eventfd);
 
@@ -2658,7 +2659,7 @@ static int devx_async_event_close(struct inode *inode, struct file *filp)
                 kfree_rcu(event_sub, rcu);
         }
 
-        mutex_unlock(&ev_file->dev->devx_event_table.event_xa_lock);
+        mutex_unlock(&dev->devx_event_table.event_xa_lock);
 
         /* free the pending events allocation */
         if (!ev_file->omit_data) {
@@ -2670,7 +2671,7 @@ static int devx_async_event_close(struct inode *inode, struct file *filp)
         }
 
         uverbs_close_fd(filp);
-        put_device(&ev_file->dev->ib_dev.dev);
+        put_device(&dev->ib_dev.dev);
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index 81da82050d05..1d257d1b3b0d 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -579,7 +579,6 @@ static int pagefault_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr,
                         u32 flags)
 {
         int npages = 0, current_seq, page_shift, ret, np;
-        bool implicit = false;
         struct ib_umem_odp *odp_mr = to_ib_umem_odp(mr->umem);
         bool downgrade = flags & MLX5_PF_FLAGS_DOWNGRADE;
         bool prefetch = flags & MLX5_PF_FLAGS_PREFETCH;
@@ -594,7 +593,6 @@ static int pagefault_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr,
                 if (IS_ERR(odp))
                         return PTR_ERR(odp);
                 mr = odp->private;
-                implicit = true;
         } else {
                 odp = odp_mr;
         }
@@ -682,19 +680,15 @@ next_mr:
 
 out:
         if (ret == -EAGAIN) {
-                if (implicit || !odp->dying) {
-                        unsigned long timeout =
-                                msecs_to_jiffies(MMU_NOTIFIER_TIMEOUT);
-
-                        if (!wait_for_completion_timeout(
-                                        &odp->notifier_completion,
-                                        timeout)) {
-                                mlx5_ib_warn(dev, "timeout waiting for mmu notifier. seq %d against %d. notifiers_count=%d\n",
-                                             current_seq, odp->notifiers_seq, odp->notifiers_count);
-                        }
-                } else {
-                        /* The MR is being killed, kill the QP as well. */
-                        ret = -EFAULT;
+                unsigned long timeout = msecs_to_jiffies(MMU_NOTIFIER_TIMEOUT);
+
+                if (!wait_for_completion_timeout(&odp->notifier_completion,
+                                                 timeout)) {
+                        mlx5_ib_warn(
+                                dev,
+                                "timeout waiting for mmu notifier. seq %d against %d. notifiers_count=%d\n",
+                                current_seq, odp->notifiers_seq,
+                                odp->notifiers_count);
                 }
         }
 
diff --git a/drivers/infiniband/sw/siw/Kconfig b/drivers/infiniband/sw/siw/Kconfig
index dace276aea14..b622fc62f2cd 100644
--- a/drivers/infiniband/sw/siw/Kconfig
+++ b/drivers/infiniband/sw/siw/Kconfig
@@ -1,6 +1,6 @@
 config RDMA_SIW
         tristate "Software RDMA over TCP/IP (iWARP) driver"
-        depends on INET && INFINIBAND && LIBCRC32C && 64BIT
+        depends on INET && INFINIBAND && LIBCRC32C
         select DMA_VIRT_OPS
         help
         This driver implements the iWARP RDMA transport over
diff --git a/drivers/infiniband/sw/siw/siw.h b/drivers/infiniband/sw/siw/siw.h
index 03fd7b2f595f..77b1aabf6ff3 100644
--- a/drivers/infiniband/sw/siw/siw.h
+++ b/drivers/infiniband/sw/siw/siw.h
@@ -214,7 +214,7 @@ struct siw_wqe {
 struct siw_cq {
         struct ib_cq base_cq;
         spinlock_t lock;
-        u64 *notify;
+        struct siw_cq_ctrl *notify;
         struct siw_cqe *queue;
         u32 cq_put;
         u32 cq_get;
diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c
index d0f140daf659..05a92f997f60 100644
--- a/drivers/infiniband/sw/siw/siw_main.c
+++ b/drivers/infiniband/sw/siw/siw_main.c
@@ -160,10 +160,8 @@ static int siw_init_cpulist(void)
 
 out_err:
         siw_cpu_info.num_nodes = 0;
-        while (i) {
+        while (--i >= 0)
                 kfree(siw_cpu_info.tx_valid_cpus[i]);
-                siw_cpu_info.tx_valid_cpus[i--] = NULL;
-        }
         kfree(siw_cpu_info.tx_valid_cpus);
         siw_cpu_info.tx_valid_cpus = NULL;
 
diff --git a/drivers/infiniband/sw/siw/siw_qp.c b/drivers/infiniband/sw/siw/siw_qp.c
index e27bd5b35b96..0990307c5d2c 100644
--- a/drivers/infiniband/sw/siw/siw_qp.c
+++ b/drivers/infiniband/sw/siw/siw_qp.c
@@ -1013,18 +1013,24 @@ out:
  */
 static bool siw_cq_notify_now(struct siw_cq *cq, u32 flags)
 {
-        u64 cq_notify;
+        u32 cq_notify;
 
         if (!cq->base_cq.comp_handler)
                 return false;
 
-        cq_notify = READ_ONCE(*cq->notify);
+        /* Read application shared notification state */
+        cq_notify = READ_ONCE(cq->notify->flags);
 
         if ((cq_notify & SIW_NOTIFY_NEXT_COMPLETION) ||
             ((cq_notify & SIW_NOTIFY_SOLICITED) &&
              (flags & SIW_WQE_SOLICITED))) {
-                /* dis-arm CQ */
-                smp_store_mb(*cq->notify, SIW_NOTIFY_NOT);
+                /*
+                 * CQ notification is one-shot: Since the
+                 * current CQE causes user notification,
+                 * the CQ gets dis-aremd and must be re-aremd
+                 * by the user for a new notification.
+                 */
+                WRITE_ONCE(cq->notify->flags, SIW_NOTIFY_NOT);
 
                 return true;
         }
diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
index 32dc79d0e898..e7f3a2379d9d 100644
--- a/drivers/infiniband/sw/siw/siw_verbs.c
+++ b/drivers/infiniband/sw/siw/siw_verbs.c
@@ -1049,7 +1049,7 @@ int siw_create_cq(struct ib_cq *base_cq, const struct ib_cq_init_attr *attr,
 
         spin_lock_init(&cq->lock);
 
-        cq->notify = &((struct siw_cq_ctrl *)&cq->queue[size])->notify;
+        cq->notify = (struct siw_cq_ctrl *)&cq->queue[size];
 
         if (udata) {
                 struct siw_uresp_create_cq uresp = {};
@@ -1141,11 +1141,17 @@ int siw_req_notify_cq(struct ib_cq *base_cq, enum ib_cq_notify_flags flags)
         siw_dbg_cq(cq, "flags: 0x%02x\n", flags);
 
         if ((flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED)
-                /* CQ event for next solicited completion */
-                smp_store_mb(*cq->notify, SIW_NOTIFY_SOLICITED);
+                /*
+                 * Enable CQ event for next solicited completion.
+                 * and make it visible to all associated producers.
+                 */
+                smp_store_mb(cq->notify->flags, SIW_NOTIFY_SOLICITED);
         else
-                /* CQ event for any signalled completion */
-                smp_store_mb(*cq->notify, SIW_NOTIFY_ALL);
+                /*
+                 * Enable CQ event for any signalled completion.
+                 * and make it visible to all associated producers.
+                 */
+                smp_store_mb(cq->notify->flags, SIW_NOTIFY_ALL);
 
         if (flags & IB_CQ_REPORT_MISSED_EVENTS)
                 return cq->cq_put - cq->cq_get;
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index a9a9fabd3968..c5c93e48b4db 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -1186,8 +1186,8 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_master *master, u32 sid,
                         ste_live = true;
                         break;
                 case STRTAB_STE_0_CFG_ABORT:
-                        if (disable_bypass)
-                                break;
+                        BUG_ON(!disable_bypass);
+                        break;
                 default:
                         BUG(); /* STE corruption */
                 }
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index a7f9c3edbcb2..d991d40f797f 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -459,13 +459,11 @@ static dma_addr_t __iommu_dma_map(struct device *dev, phys_addr_t phys,
 {
         struct iommu_domain *domain = iommu_get_dma_domain(dev);
         struct iommu_dma_cookie *cookie = domain->iova_cookie;
-        size_t iova_off = 0;
+        struct iova_domain *iovad = &cookie->iovad;
+        size_t iova_off = iova_offset(iovad, phys);
         dma_addr_t iova;
 
-        if (cookie->type == IOMMU_DMA_IOVA_COOKIE) {
-                iova_off = iova_offset(&cookie->iovad, phys);
-                size = iova_align(&cookie->iovad, size + iova_off);
-        }
+        size = iova_align(iovad, size + iova_off);
 
         iova = iommu_dma_alloc_iova(domain, size, dma_get_mask(dev), dev);
         if (!iova)
@@ -574,7 +572,7 @@ static void *iommu_dma_alloc_remap(struct device *dev, size_t size,
         struct iova_domain *iovad = &cookie->iovad;
         bool coherent = dev_is_dma_coherent(dev);
         int ioprot = dma_info_to_prot(DMA_BIDIRECTIONAL, coherent, attrs);
-        pgprot_t prot = arch_dma_mmap_pgprot(dev, PAGE_KERNEL, attrs);
+        pgprot_t prot = dma_pgprot(dev, PAGE_KERNEL, attrs);
         unsigned int count, min_size, alloc_sizes = domain->pgsize_bitmap;
         struct page **pages;
         struct sg_table sgt;
@@ -764,7 +762,7 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents,
                  * - and wouldn't make the resulting output segment too long
                  */
                 if (cur_len && !s_iova_off && (dma_addr & seg_mask) &&
-                    (cur_len + s_length <= max_len)) {
+                    (max_len - cur_len >= s_length)) {
                         /* ...then concatenate it with the previous one */
                         cur_len += s_length;
                 } else {
@@ -975,7 +973,7 @@ static void *iommu_dma_alloc_pages(struct device *dev, size_t size,
                 return NULL;
 
         if (IS_ENABLED(CONFIG_DMA_REMAP) && (!coherent || PageHighMem(page))) {
-                pgprot_t prot = arch_dma_mmap_pgprot(dev, PAGE_KERNEL, attrs);
+                pgprot_t prot = dma_pgprot(dev, PAGE_KERNEL, attrs);
 
                 cpu_addr = dma_common_contiguous_remap(page, alloc_size,
                                 VM_USERMAP, prot, __builtin_return_address(0));
@@ -1035,7 +1033,7 @@ static int iommu_dma_mmap(struct device *dev, struct vm_area_struct *vma,
         unsigned long pfn, off = vma->vm_pgoff;
         int ret;
 
-        vma->vm_page_prot = arch_dma_mmap_pgprot(dev, vma->vm_page_prot, attrs);
+        vma->vm_page_prot = dma_pgprot(dev, vma->vm_page_prot, attrs);
 
         if (dma_mmap_from_dev_coherent(dev, vma, cpu_addr, size, &ret))
                 return ret;
@@ -1147,16 +1145,21 @@ static struct iommu_dma_msi_page *iommu_dma_get_msi_page(struct device *dev,
         if (!msi_page)
                 return NULL;
 
-        iova = __iommu_dma_map(dev, msi_addr, size, prot);
-        if (iova == DMA_MAPPING_ERROR)
+        iova = iommu_dma_alloc_iova(domain, size, dma_get_mask(dev), dev);
+        if (!iova)
                 goto out_free_page;
 
+        if (iommu_map(domain, iova, msi_addr, size, prot))
+                goto out_free_iova;
+
         INIT_LIST_HEAD(&msi_page->list);
         msi_page->phys = msi_addr;
         msi_page->iova = iova;
         list_add(&msi_page->list, &cookie->msi_page_list);
         return msi_page;
 
+out_free_iova:
+        iommu_dma_free_iova(cookie, iova, size);
 out_free_page:
         kfree(msi_page);
         return NULL;
diff --git a/drivers/iommu/intel-iommu-debugfs.c b/drivers/iommu/intel-iommu-debugfs.c
index 2b25d9c59336..471f05d452e0 100644
--- a/drivers/iommu/intel-iommu-debugfs.c
+++ b/drivers/iommu/intel-iommu-debugfs.c
@@ -235,7 +235,7 @@ static void ctx_tbl_walk(struct seq_file *m, struct intel_iommu *iommu, u16 bus)
                 tbl_wlk.ctx_entry = context;
                 m->private = &tbl_wlk;
 
-                if (pasid_supported(iommu) && is_pasid_enabled(context)) {
+                if (dmar_readq(iommu->reg + DMAR_RTADDR_REG) & DMA_RTADDR_SMT) {
                         pasid_dir_ptr = context->lo & VTD_PAGE_MASK;
                         pasid_dir_size = get_pasid_dir_size(context);
                         pasid_dir_walk(m, pasid_dir_ptr, pasid_dir_size);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index bdaed2da8a55..12d094d08c0a 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3449,6 +3449,7 @@ static bool iommu_need_mapping(struct device *dev)
                                 dmar_domain = to_dmar_domain(domain);
                                 dmar_domain->flags |= DOMAIN_FLAG_LOSE_CHILDREN;
                         }
+                        dmar_remove_one_dev_info(dev);
                         get_private_domain_for_dev(dev);
                 }
 
@@ -4790,7 +4791,8 @@ static void __dmar_remove_one_dev_info(struct device_domain_info *info)
 
         /* free the private domain */
         if (domain->flags & DOMAIN_FLAG_LOSE_CHILDREN &&
-            !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY))
+            !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
+            list_empty(&domain->devices))
                 domain_exit(info->domain);
 
         free_devinfo_mem(info);
@@ -4803,7 +4805,8 @@ static void dmar_remove_one_dev_info(struct device *dev)
 
         spin_lock_irqsave(&device_domain_lock, flags);
         info = dev->archdata.iommu;
-        __dmar_remove_one_dev_info(info);
+        if (info)
+                __dmar_remove_one_dev_info(info);
         spin_unlock_irqrestore(&device_domain_lock, flags);
 }
 
@@ -5281,6 +5284,7 @@ static int intel_iommu_add_device(struct device *dev)
                 if (device_def_domain_type(dev) == IOMMU_DOMAIN_IDENTITY) {
                         ret = iommu_request_dm_for_dev(dev);
                         if (ret) {
+                                dmar_remove_one_dev_info(dev);
                                 dmar_domain->flags |= DOMAIN_FLAG_LOSE_CHILDREN;
                                 domain_add_dev_info(si_domain, dev);
                                 dev_info(dev,
@@ -5291,6 +5295,7 @@ static int intel_iommu_add_device(struct device *dev)
                 if (device_def_domain_type(dev) == IOMMU_DOMAIN_DMA) {
                         ret = iommu_request_dma_domain_for_dev(dev);
                         if (ret) {
+                                dmar_remove_one_dev_info(dev);
                                 dmar_domain->flags |= DOMAIN_FLAG_LOSE_CHILDREN;
                                 if (!get_private_domain_for_dev(dev)) {
                                         dev_warn(dev,
@@ -5316,6 +5321,8 @@ static void intel_iommu_remove_device(struct device *dev)
         if (!iommu)
                 return;
 
+        dmar_remove_one_dev_info(dev);
+
         iommu_group_remove_device(dev);
 
         iommu_device_unlink(&iommu->iommu, dev);
diff --git a/drivers/media/platform/omap/omap_vout_vrfb.c b/drivers/media/platform/omap/omap_vout_vrfb.c
index 29e3f5da59c1..11ec048929e8 100644
--- a/drivers/media/platform/omap/omap_vout_vrfb.c
+++ b/drivers/media/platform/omap/omap_vout_vrfb.c
@@ -253,8 +253,7 @@ int omap_vout_prepare_vrfb(struct omap_vout_device *vout,
          */
 
         pixsize = vout->bpp * vout->vrfb_bpp;
-        dst_icg = ((MAX_PIXELS_PER_LINE * pixsize) -
-                  (vout->pix.width * vout->bpp)) + 1;
+        dst_icg = MAX_PIXELS_PER_LINE * pixsize - vout->pix.width * vout->bpp;
 
         xt->src_start = vout->buf_phy_addr[vb->i];
         xt->dst_start = vout->vrfb_context[vb->i].paddr[0];
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 6abfc8e92fcc..16900357afc2 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -465,6 +465,7 @@ config PCI_ENDPOINT_TEST
 
 config XILINX_SDFEC
         tristate "Xilinx SDFEC 16"
+        depends on HAS_IOMEM
         help
           This option enables support for the Xilinx SDFEC (Soft Decision
           Forward Error Correction) driver. This enables a char driver
diff --git a/drivers/misc/habanalabs/device.c b/drivers/misc/habanalabs/device.c
index 0c4894dd9c02..7a8f9d0b71b5 100644
--- a/drivers/misc/habanalabs/device.c
+++ b/drivers/misc/habanalabs/device.c
@@ -970,7 +970,8 @@ int hl_device_init(struct hl_device *hdev, struct class *hclass)
         rc = hl_ctx_init(hdev, hdev->kernel_ctx, true);
         if (rc) {
                 dev_err(hdev->dev, "failed to initialize kernel context\n");
-                goto free_ctx;
+                kfree(hdev->kernel_ctx);
+                goto mmu_fini;
         }
 
         rc = hl_cb_pool_init(hdev);
@@ -1053,8 +1054,6 @@ release_ctx:
         if (hl_ctx_put(hdev->kernel_ctx) != 1)
                 dev_err(hdev->dev,
                         "kernel ctx is still alive on initialization failure\n");
-free_ctx:
-        kfree(hdev->kernel_ctx);
 mmu_fini:
         hl_mmu_fini(hdev);
 eq_fini:
diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c
index a0e181714891..271c5c8f53b4 100644
--- a/drivers/misc/habanalabs/goya/goya.c
+++ b/drivers/misc/habanalabs/goya/goya.c
@@ -2729,9 +2729,10 @@ void goya_ring_doorbell(struct hl_device *hdev, u32 hw_queue_id, u32 pi)
                                 GOYA_ASYNC_EVENT_ID_PI_UPDATE);
 }
 
-void goya_flush_pq_write(struct hl_device *hdev, u64 *pq, u64 exp_val)
+void goya_pqe_write(struct hl_device *hdev, __le64 *pqe, struct hl_bd *bd)
 {
-        /* Not needed in Goya */
+        /* The QMANs are on the SRAM so need to copy to IO space */
+        memcpy_toio((void __iomem *) pqe, bd, sizeof(struct hl_bd));
 }
 
 static void *goya_dma_alloc_coherent(struct hl_device *hdev, size_t size,
@@ -3313,9 +3314,11 @@ static int goya_validate_dma_pkt_no_mmu(struct hl_device *hdev,
         int rc;
 
         dev_dbg(hdev->dev, "DMA packet details:\n");
-        dev_dbg(hdev->dev, "source == 0x%llx\n", user_dma_pkt->src_addr);
-        dev_dbg(hdev->dev, "destination == 0x%llx\n", user_dma_pkt->dst_addr);
-        dev_dbg(hdev->dev, "size == %u\n", user_dma_pkt->tsize);
+        dev_dbg(hdev->dev, "source == 0x%llx\n",
+                le64_to_cpu(user_dma_pkt->src_addr));
+        dev_dbg(hdev->dev, "destination == 0x%llx\n",
+                le64_to_cpu(user_dma_pkt->dst_addr));
+        dev_dbg(hdev->dev, "size == %u\n", le32_to_cpu(user_dma_pkt->tsize));
 
         ctl = le32_to_cpu(user_dma_pkt->ctl);
         user_dir = (ctl & GOYA_PKT_LIN_DMA_CTL_DMA_DIR_MASK) >>
@@ -3344,9 +3347,11 @@ static int goya_validate_dma_pkt_mmu(struct hl_device *hdev,
                                 struct packet_lin_dma *user_dma_pkt)
 {
         dev_dbg(hdev->dev, "DMA packet details:\n");
-        dev_dbg(hdev->dev, "source == 0x%llx\n", user_dma_pkt->src_addr);
-        dev_dbg(hdev->dev, "destination == 0x%llx\n", user_dma_pkt->dst_addr);
-        dev_dbg(hdev->dev, "size == %u\n", user_dma_pkt->tsize);
+        dev_dbg(hdev->dev, "source == 0x%llx\n",
+                le64_to_cpu(user_dma_pkt->src_addr));
+        dev_dbg(hdev->dev, "destination == 0x%llx\n",
+                le64_to_cpu(user_dma_pkt->dst_addr));
+        dev_dbg(hdev->dev, "size == %u\n", le32_to_cpu(user_dma_pkt->tsize));
 
         /*
          * WA for HW-23.
@@ -3386,7 +3391,8 @@ static int goya_validate_wreg32(struct hl_device *hdev,
 
         dev_dbg(hdev->dev, "WREG32 packet details:\n");
         dev_dbg(hdev->dev, "reg_offset == 0x%x\n", reg_offset);
-        dev_dbg(hdev->dev, "value      == 0x%x\n", wreg_pkt->value);
+        dev_dbg(hdev->dev, "value      == 0x%x\n",
+                le32_to_cpu(wreg_pkt->value));
 
         if (reg_offset != (mmDMA_CH_0_WR_COMP_ADDR_LO & 0x1FFF)) {
                 dev_err(hdev->dev, "WREG32 packet with illegal address 0x%x\n",
@@ -3428,12 +3434,13 @@ static int goya_validate_cb(struct hl_device *hdev,
         while (cb_parsed_length < parser->user_cb_size) {
                 enum packet_id pkt_id;
                 u16 pkt_size;
-                void *user_pkt;
+                struct goya_packet *user_pkt;
 
-                user_pkt = (void *) (uintptr_t)
+                user_pkt = (struct goya_packet *) (uintptr_t)
                         (parser->user_cb->kernel_address + cb_parsed_length);
 
-                pkt_id = (enum packet_id) (((*(u64 *) user_pkt) &
+                pkt_id = (enum packet_id) (
+                                (le64_to_cpu(user_pkt->header) &
                                 PACKET_HEADER_PACKET_ID_MASK) >>
                                         PACKET_HEADER_PACKET_ID_SHIFT);
 
@@ -3453,7 +3460,8 @@ static int goya_validate_cb(struct hl_device *hdev,
                          * need to validate here as well because patch_cb() is
                          * not called in MMU path while this function is called
                          */
-                        rc = goya_validate_wreg32(hdev, parser, user_pkt);
+                        rc = goya_validate_wreg32(hdev,
+                                parser, (struct packet_wreg32 *) user_pkt);
                         break;
 
                 case PACKET_WREG_BULK:
@@ -3481,10 +3489,10 @@ static int goya_validate_cb(struct hl_device *hdev,
                 case PACKET_LIN_DMA:
                         if (is_mmu)
                                 rc = goya_validate_dma_pkt_mmu(hdev, parser,
-                                                user_pkt);
+                                        (struct packet_lin_dma *) user_pkt);
                         else
                                 rc = goya_validate_dma_pkt_no_mmu(hdev, parser,
-                                                user_pkt);
+                                        (struct packet_lin_dma *) user_pkt);
                         break;
 
                 case PACKET_MSG_LONG:
@@ -3657,15 +3665,16 @@ static int goya_patch_cb(struct hl_device *hdev,
                 enum packet_id pkt_id;
                 u16 pkt_size;
                 u32 new_pkt_size = 0;
-                void *user_pkt, *kernel_pkt;
+                struct goya_packet *user_pkt, *kernel_pkt;
 
-                user_pkt = (void *) (uintptr_t)
+                user_pkt = (struct goya_packet *) (uintptr_t)
                         (parser->user_cb->kernel_address + cb_parsed_length);
-                kernel_pkt = (void *) (uintptr_t)
+                kernel_pkt = (struct goya_packet *) (uintptr_t)
                         (parser->patched_cb->kernel_address +
                                         cb_patched_cur_length);
 
-                pkt_id = (enum packet_id) (((*(u64 *) user_pkt) &
+                pkt_id = (enum packet_id) (
+                                (le64_to_cpu(user_pkt->header) &
                                 PACKET_HEADER_PACKET_ID_MASK) >>
                                         PACKET_HEADER_PACKET_ID_SHIFT);
 
@@ -3680,15 +3689,18 @@ static int goya_patch_cb(struct hl_device *hdev,
 
                 switch (pkt_id) {
                 case PACKET_LIN_DMA:
-                        rc = goya_patch_dma_packet(hdev, parser, user_pkt,
-                                                kernel_pkt, &new_pkt_size);
+                        rc = goya_patch_dma_packet(hdev, parser,
+                                        (struct packet_lin_dma *) user_pkt,
+                                        (struct packet_lin_dma *) kernel_pkt,
+                                        &new_pkt_size);
                         cb_patched_cur_length += new_pkt_size;
                         break;
 
                 case PACKET_WREG_32:
                         memcpy(kernel_pkt, user_pkt, pkt_size);
                         cb_patched_cur_length += pkt_size;
-                        rc = goya_validate_wreg32(hdev, parser, kernel_pkt);
+                        rc = goya_validate_wreg32(hdev, parser,
+                                        (struct packet_wreg32 *) kernel_pkt);
                         break;
 
                 case PACKET_WREG_BULK:
@@ -4352,6 +4364,8 @@ static int goya_unmask_irq_arr(struct hl_device *hdev, u32 *irq_arr,
         size_t total_pkt_size;
         long result;
         int rc;
+        int irq_num_entries, irq_arr_index;
+        __le32 *goya_irq_arr;
 
         total_pkt_size = sizeof(struct armcp_unmask_irq_arr_packet) +
                         irq_arr_size;
@@ -4369,8 +4383,16 @@ static int goya_unmask_irq_arr(struct hl_device *hdev, u32 *irq_arr,
         if (!pkt)
                 return -ENOMEM;
 
-        pkt->length = cpu_to_le32(irq_arr_size / sizeof(irq_arr[0]));
-        memcpy(&pkt->irqs, irq_arr, irq_arr_size);
+        irq_num_entries = irq_arr_size / sizeof(irq_arr[0]);
+        pkt->length = cpu_to_le32(irq_num_entries);
+
+        /* We must perform any necessary endianness conversation on the irq
+         * array being passed to the goya hardware
+         */
+        for (irq_arr_index = 0, goya_irq_arr = (__le32 *) &pkt->irqs;
+                        irq_arr_index < irq_num_entries ; irq_arr_index++)
+                goya_irq_arr[irq_arr_index] =
+                                cpu_to_le32(irq_arr[irq_arr_index]);
 
         pkt->armcp_pkt.ctl = cpu_to_le32(ARMCP_PACKET_UNMASK_RAZWI_IRQ_ARRAY <<
                                                 ARMCP_PKT_CTL_OPCODE_SHIFT);
@@ -5042,7 +5064,7 @@ static const struct hl_asic_funcs goya_funcs = {
         .resume = goya_resume,
         .cb_mmap = goya_cb_mmap,
         .ring_doorbell = goya_ring_doorbell,
-        .flush_pq_write = goya_flush_pq_write,
+        .pqe_write = goya_pqe_write,
         .asic_dma_alloc_coherent = goya_dma_alloc_coherent,
         .asic_dma_free_coherent = goya_dma_free_coherent,
         .get_int_queue_base = goya_get_int_queue_base,
diff --git a/drivers/misc/habanalabs/goya/goyaP.h b/drivers/misc/habanalabs/goya/goyaP.h
index f8c611883dc1..d7f48c9c41cd 100644
--- a/drivers/misc/habanalabs/goya/goyaP.h
+++ b/drivers/misc/habanalabs/goya/goyaP.h
@@ -177,7 +177,7 @@ int goya_late_init(struct hl_device *hdev);
 void goya_late_fini(struct hl_device *hdev);
 
 void goya_ring_doorbell(struct hl_device *hdev, u32 hw_queue_id, u32 pi);
-void goya_flush_pq_write(struct hl_device *hdev, u64 *pq, u64 exp_val);
+void goya_pqe_write(struct hl_device *hdev, __le64 *pqe, struct hl_bd *bd);
 void goya_update_eq_ci(struct hl_device *hdev, u32 val);
 void goya_restore_phase_topology(struct hl_device *hdev);
 int goya_context_switch(struct hl_device *hdev, u32 asid);
diff --git a/drivers/misc/habanalabs/habanalabs.h b/drivers/misc/habanalabs/habanalabs.h
index 6a4c64b97f38..ce83adafcf2d 100644
--- a/drivers/misc/habanalabs/habanalabs.h
+++ b/drivers/misc/habanalabs/habanalabs.h
@@ -441,7 +441,11 @@ enum hl_pll_frequency {
  * @resume: handles IP specific H/W or SW changes for resume.
  * @cb_mmap: maps a CB.
  * @ring_doorbell: increment PI on a given QMAN.
- * @flush_pq_write: flush PQ entry write if necessary, WARN if flushing failed.
+ * @pqe_write: Write the PQ entry to the PQ. This is ASIC-specific
+ *             function because the PQs are located in different memory areas
+ *             per ASIC (SRAM, DRAM, Host memory) and therefore, the method of
+ *             writing the PQE must match the destination memory area
+ *             properties.
  * @asic_dma_alloc_coherent: Allocate coherent DMA memory by calling
  *                           dma_alloc_coherent(). This is ASIC function because
  *                           its implementation is not trivial when the driver
@@ -510,7 +514,8 @@ struct hl_asic_funcs {
         int (*cb_mmap)(struct hl_device *hdev, struct vm_area_struct *vma,
                         u64 kaddress, phys_addr_t paddress, u32 size);
         void (*ring_doorbell)(struct hl_device *hdev, u32 hw_queue_id, u32 pi);
-        void (*flush_pq_write)(struct hl_device *hdev, u64 *pq, u64 exp_val);
+        void (*pqe_write)(struct hl_device *hdev, __le64 *pqe,
+                        struct hl_bd *bd);
         void* (*asic_dma_alloc_coherent)(struct hl_device *hdev, size_t size,
                                         dma_addr_t *dma_handle, gfp_t flag);
         void (*asic_dma_free_coherent)(struct hl_device *hdev, size_t size,
diff --git a/drivers/misc/habanalabs/hw_queue.c b/drivers/misc/habanalabs/hw_queue.c
index e3b5517897ea..5f5673b74985 100644
--- a/drivers/misc/habanalabs/hw_queue.c
+++ b/drivers/misc/habanalabs/hw_queue.c
@@ -290,23 +290,19 @@ static void int_hw_queue_schedule_job(struct hl_cs_job *job)
         struct hl_device *hdev = job->cs->ctx->hdev;
         struct hl_hw_queue *q = &hdev->kernel_queues[job->hw_queue_id];
         struct hl_bd bd;
-        u64 *pi, *pbd = (u64 *) &bd;
+        __le64 *pi;
 
         bd.ctl = 0;
-        bd.len = __cpu_to_le32(job->job_cb_size);
-        bd.ptr = __cpu_to_le64((u64) (uintptr_t) job->user_cb);
+        bd.len = cpu_to_le32(job->job_cb_size);
+        bd.ptr = cpu_to_le64((u64) (uintptr_t) job->user_cb);
 
-        pi = (u64 *) (uintptr_t) (q->kernel_address +
+        pi = (__le64 *) (uintptr_t) (q->kernel_address +
                 ((q->pi & (q->int_queue_len - 1)) * sizeof(bd)));
 
-        pi[0] = pbd[0];
-        pi[1] = pbd[1];
-
         q->pi++;
         q->pi &= ((q->int_queue_len << 1) - 1);
 
-        /* Flush PQ entry write. Relevant only for specific ASICs */
-        hdev->asic_funcs->flush_pq_write(hdev, pi, pbd[0]);
+        hdev->asic_funcs->pqe_write(hdev, pi, &bd);
 
         hdev->asic_funcs->ring_doorbell(hdev, q->hw_queue_id, q->pi);
 }
diff --git a/drivers/misc/habanalabs/include/goya/goya_packets.h b/drivers/misc/habanalabs/include/goya/goya_packets.h
index a14407b975e4..ef54bad20509 100644
--- a/drivers/misc/habanalabs/include/goya/goya_packets.h
+++ b/drivers/misc/habanalabs/include/goya/goya_packets.h
@@ -52,6 +52,19 @@ enum goya_dma_direction {
 #define GOYA_PKT_CTL_MB_SHIFT           31
 #define GOYA_PKT_CTL_MB_MASK            0x80000000
 
+/* All packets have, at least, an 8-byte header, which contains
+ * the packet type. The kernel driver uses the packet header for packet
+ * validation and to perform any necessary required preparation before
+ * sending them off to the hardware.
+ */
+struct goya_packet {
+        __le64 header;
+        /* The rest of the packet data follows. Use the corresponding
+         * packet_XXX struct to deference the data, based on packet type
+         */
+        u8 contents[0];
+};
+
 struct packet_nop {
         __le32 reserved;
         __le32 ctl;
diff --git a/drivers/misc/habanalabs/irq.c b/drivers/misc/habanalabs/irq.c
index ea9f72ff456c..199791b57caf 100644
--- a/drivers/misc/habanalabs/irq.c
+++ b/drivers/misc/habanalabs/irq.c
@@ -80,8 +80,7 @@ irqreturn_t hl_irq_handler_cq(int irq, void *arg)
         struct hl_cs_job *job;
         bool shadow_index_valid;
         u16 shadow_index;
-        u32 *cq_entry;
-        u32 *cq_base;
+        struct hl_cq_entry *cq_entry, *cq_base;
 
         if (hdev->disabled) {
                 dev_dbg(hdev->dev,
@@ -90,29 +89,29 @@ irqreturn_t hl_irq_handler_cq(int irq, void *arg)
                 return IRQ_HANDLED;
         }
 
-        cq_base = (u32 *) (uintptr_t) cq->kernel_address;
+        cq_base = (struct hl_cq_entry *) (uintptr_t) cq->kernel_address;
 
         while (1) {
-                bool entry_ready = ((cq_base[cq->ci] & CQ_ENTRY_READY_MASK)
+                bool entry_ready = ((le32_to_cpu(cq_base[cq->ci].data) &
+                                        CQ_ENTRY_READY_MASK)
                                                 >> CQ_ENTRY_READY_SHIFT);
 
                 if (!entry_ready)
                         break;
 
-                cq_entry = (u32 *) &cq_base[cq->ci];
+                cq_entry = (struct hl_cq_entry *) &cq_base[cq->ci];
 
-                /*
-                 * Make sure we read CQ entry contents after we've
+                /* Make sure we read CQ entry contents after we've
                  * checked the ownership bit.
                  */
                 dma_rmb();
 
-                shadow_index_valid =
-                        ((*cq_entry & CQ_ENTRY_SHADOW_INDEX_VALID_MASK)
+                shadow_index_valid = ((le32_to_cpu(cq_entry->data) &
+                                        CQ_ENTRY_SHADOW_INDEX_VALID_MASK)
                                         >> CQ_ENTRY_SHADOW_INDEX_VALID_SHIFT);
 
-                shadow_index = (u16)
-                        ((*cq_entry & CQ_ENTRY_SHADOW_INDEX_MASK)
+                shadow_index = (u16) ((le32_to_cpu(cq_entry->data) &
+                                        CQ_ENTRY_SHADOW_INDEX_MASK)
                                         >> CQ_ENTRY_SHADOW_INDEX_SHIFT);
 
                 queue = &hdev->kernel_queues[cq->hw_queue_id];
@@ -122,8 +121,7 @@ irqreturn_t hl_irq_handler_cq(int irq, void *arg)
                         queue_work(hdev->cq_wq, &job->finish_work);
                 }
 
-                /*
-                 * Update ci of the context's queue. There is no
+                /* Update ci of the context's queue. There is no
                  * need to protect it with spinlock because this update is
                  * done only inside IRQ and there is a different IRQ per
                  * queue
@@ -131,7 +129,8 @@ irqreturn_t hl_irq_handler_cq(int irq, void *arg)
                 queue->ci = hl_queue_inc_ptr(queue->ci);
 
                 /* Clear CQ entry ready bit */
-                cq_base[cq->ci] &= ~CQ_ENTRY_READY_MASK;
+                cq_entry->data = cpu_to_le32(le32_to_cpu(cq_entry->data) &
+                                                ~CQ_ENTRY_READY_MASK);
 
                 cq->ci = hl_cq_inc_ptr(cq->ci);
 
diff --git a/drivers/misc/habanalabs/memory.c b/drivers/misc/habanalabs/memory.c
index 42d237cae1dc..365fb0cb8dff 100644
--- a/drivers/misc/habanalabs/memory.c
+++ b/drivers/misc/habanalabs/memory.c
@@ -1629,6 +1629,8 @@ void hl_vm_ctx_fini(struct hl_ctx *ctx)
                         dev_dbg(hdev->dev,
                                 "page list 0x%p of asid %d is still alive\n",
                                 phys_pg_list, ctx->asid);
+                        atomic64_sub(phys_pg_list->total_size,
+                                        &hdev->dram_used_mem);
                         free_phys_pg_pack(hdev, phys_pg_list);
                         idr_remove(&vm->phys_pg_pack_handles, i);
                 }
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index 03cc788511d5..654bdc41fc99 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -3780,8 +3780,6 @@ static int spi_nor_init_params(struct spi_nor *nor,
                 default:
                         /* Kept only for backward compatibility purpose. */
                         params->quad_enable = spansion_quad_enable;
-                        if (nor->clear_sr_bp)
-                                nor->clear_sr_bp = spi_nor_spansion_clear_sr_bp;
                         break;
                 }
 
@@ -4035,6 +4033,9 @@ static int spi_nor_init(struct spi_nor *nor)
         int err;
 
         if (nor->clear_sr_bp) {
+                if (nor->quad_enable == spansion_quad_enable)
+                        nor->clear_sr_bp = spi_nor_spansion_clear_sr_bp;
+
                 err = nor->clear_sr_bp(nor);
                 if (err) {
                         dev_err(nor->dev,
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 8f3fbe5ca937..c258a1ce4b28 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1286,6 +1286,9 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
          */
         if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
                 mutex_lock(&ctrl->scan_lock);
+                mutex_lock(&ctrl->subsys->lock);
+                nvme_mpath_start_freeze(ctrl->subsys);
+                nvme_mpath_wait_freeze(ctrl->subsys);
                 nvme_start_freeze(ctrl);
                 nvme_wait_freeze(ctrl);
         }
@@ -1316,6 +1319,8 @@ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
                 nvme_update_formats(ctrl);
         if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
                 nvme_unfreeze(ctrl);
+                nvme_mpath_unfreeze(ctrl->subsys);
+                mutex_unlock(&ctrl->subsys->lock);
                 mutex_unlock(&ctrl->scan_lock);
         }
         if (effects & NVME_CMD_EFFECTS_CCC)
@@ -1715,6 +1720,7 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
         if (ns->head->disk) {
                 nvme_update_disk_info(ns->head->disk, ns, id);
                 blk_queue_stack_limits(ns->head->disk->queue, ns->queue);
+                revalidate_disk(ns->head->disk);
         }
 #endif
 }
@@ -2487,6 +2493,7 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
                 if (ret) {
                         dev_err(ctrl->device,
                                 "failed to register subsystem device.\n");
+                        put_device(&subsys->dev);
                         goto out_unlock;
                 }
                 ida_init(&subsys->ns_ida);
@@ -2509,7 +2516,6 @@ out_put_subsystem:
         nvme_put_subsystem(subsys);
 out_unlock:
         mutex_unlock(&nvme_subsystems_lock);
-        put_device(&subsys->dev);
         return ret;
 }
 
@@ -3571,6 +3577,13 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl)
         struct nvme_ns *ns, *next;
         LIST_HEAD(ns_list);
 
+        /*
+         * make sure to requeue I/O to all namespaces as these
+         * might result from the scan itself and must complete
+         * for the scan_work to make progress
+         */
+        nvme_mpath_clear_ctrl_paths(ctrl);
+
         /* prevent racing with ns scanning */
         flush_work(&ctrl->scan_work);
 
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 4f0d0d12744e..888d4543894e 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -12,6 +12,36 @@ module_param(multipath, bool, 0444);
 MODULE_PARM_DESC(multipath,
         "turn on native support for multiple controllers per subsystem");
 
+void nvme_mpath_unfreeze(struct nvme_subsystem *subsys)
+{
+        struct nvme_ns_head *h;
+
+        lockdep_assert_held(&subsys->lock);
+        list_for_each_entry(h, &subsys->nsheads, entry)
+                if (h->disk)
+                        blk_mq_unfreeze_queue(h->disk->queue);
+}
+
+void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys)
+{
+        struct nvme_ns_head *h;
+
+        lockdep_assert_held(&subsys->lock);
+        list_for_each_entry(h, &subsys->nsheads, entry)
+                if (h->disk)
+                        blk_mq_freeze_queue_wait(h->disk->queue);
+}
+
+void nvme_mpath_start_freeze(struct nvme_subsystem *subsys)
+{
+        struct nvme_ns_head *h;
+
+        lockdep_assert_held(&subsys->lock);
+        list_for_each_entry(h, &subsys->nsheads, entry)
+                if (h->disk)
+                        blk_freeze_queue_start(h->disk->queue);
+}
+
 /*
  * If multipathing is enabled we need to always use the subsystem instance
  * number for numbering our devices to avoid conflicts between subsystems that
@@ -104,18 +134,34 @@ static const char *nvme_ana_state_names[] = {
         [NVME_ANA_CHANGE]               = "change",
 };
 
-void nvme_mpath_clear_current_path(struct nvme_ns *ns)
+bool nvme_mpath_clear_current_path(struct nvme_ns *ns)
 {
         struct nvme_ns_head *head = ns->head;
+        bool changed = false;
         int node;
 
         if (!head)
-                return;
+                goto out;
 
         for_each_node(node) {
-                if (ns == rcu_access_pointer(head->current_path[node]))
+                if (ns == rcu_access_pointer(head->current_path[node])) {
                         rcu_assign_pointer(head->current_path[node], NULL);
+                        changed = true;
+                }
         }
+out:
+        return changed;
+}
+
+void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl)
+{
+        struct nvme_ns *ns;
+
+        mutex_lock(&ctrl->scan_lock);
+        list_for_each_entry(ns, &ctrl->namespaces, list)
+                if (nvme_mpath_clear_current_path(ns))
+                        kblockd_schedule_work(&ns->head->requeue_work);
+        mutex_unlock(&ctrl->scan_lock);
 }
 
 static bool nvme_path_is_disabled(struct nvme_ns *ns)
@@ -226,6 +272,24 @@ inline struct nvme_ns *nvme_find_path(struct nvme_ns_head *head)
         return ns;
 }
 
+static bool nvme_available_path(struct nvme_ns_head *head)
+{
+        struct nvme_ns *ns;
+
+        list_for_each_entry_rcu(ns, &head->list, siblings) {
+                switch (ns->ctrl->state) {
+                case NVME_CTRL_LIVE:
+                case NVME_CTRL_RESETTING:
+                case NVME_CTRL_CONNECTING:
+                        /* fallthru */
+                        return true;
+                default:
+                        break;
+                }
+        }
+        return false;
+}
+
 static blk_qc_t nvme_ns_head_make_request(struct request_queue *q,
                 struct bio *bio)
 {
@@ -252,14 +316,14 @@ static blk_qc_t nvme_ns_head_make_request(struct request_queue *q,
                                       disk_devt(ns->head->disk),
                                       bio->bi_iter.bi_sector);
                 ret = direct_make_request(bio);
-        } else if (!list_empty_careful(&head->list)) {
-                dev_warn_ratelimited(dev, "no path available - requeuing I/O\n");
+        } else if (nvme_available_path(head)) {
+                dev_warn_ratelimited(dev, "no usable path - requeuing I/O\n");
 
                 spin_lock_irq(&head->requeue_lock);
                 bio_list_add(&head->requeue_list, bio);
                 spin_unlock_irq(&head->requeue_lock);
         } else {
-                dev_warn_ratelimited(dev, "no path - failing I/O\n");
+                dev_warn_ratelimited(dev, "no available path - failing I/O\n");
 
                 bio->bi_status = BLK_STS_IOERR;
                 bio_endio(bio);
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 26b563f9985b..778b3a0b6adb 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -490,6 +490,9 @@ static inline bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl)
         return ctrl->ana_log_buf != NULL;
 }
 
+void nvme_mpath_unfreeze(struct nvme_subsystem *subsys);
+void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys);
+void nvme_mpath_start_freeze(struct nvme_subsystem *subsys);
 void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
                         struct nvme_ctrl *ctrl, int *flags);
 void nvme_failover_req(struct request *req);
@@ -500,7 +503,8 @@ void nvme_mpath_remove_disk(struct nvme_ns_head *head);
 int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id);
 void nvme_mpath_uninit(struct nvme_ctrl *ctrl);
 void nvme_mpath_stop(struct nvme_ctrl *ctrl);
-void nvme_mpath_clear_current_path(struct nvme_ns *ns);
+bool nvme_mpath_clear_current_path(struct nvme_ns *ns);
+void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl);
 struct nvme_ns *nvme_find_path(struct nvme_ns_head *head);
 
 static inline void nvme_mpath_check_last_path(struct nvme_ns *ns)
@@ -548,7 +552,11 @@ static inline void nvme_mpath_add_disk(struct nvme_ns *ns,
 static inline void nvme_mpath_remove_disk(struct nvme_ns_head *head)
 {
 }
-static inline void nvme_mpath_clear_current_path(struct nvme_ns *ns)
+static inline bool nvme_mpath_clear_current_path(struct nvme_ns *ns)
+{
+        return false;
+}
+static inline void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl)
 {
 }
 static inline void nvme_mpath_check_last_path(struct nvme_ns *ns)
@@ -568,6 +576,15 @@ static inline void nvme_mpath_uninit(struct nvme_ctrl *ctrl)
 static inline void nvme_mpath_stop(struct nvme_ctrl *ctrl)
 {
 }
+static inline void nvme_mpath_unfreeze(struct nvme_subsystem *subsys)
+{
+}
+static inline void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys)
+{
+}
+static inline void nvme_mpath_start_freeze(struct nvme_subsystem *subsys)
+{
+}
 #endif /* CONFIG_NVME_MULTIPATH */
 
 #ifdef CONFIG_NVM
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index db160cee42ad..6bd9b1033965 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2695,7 +2695,7 @@ static void nvme_async_probe(void *data, async_cookie_t cookie)
 {
         struct nvme_dev *dev = data;
 
-        nvme_reset_ctrl_sync(&dev->ctrl);
+        flush_work(&dev->ctrl.reset_work);
         flush_work(&dev->ctrl.scan_work);
         nvme_put_ctrl(&dev->ctrl);
 }
@@ -2761,6 +2761,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
 
+        nvme_reset_ctrl(&dev->ctrl);
         nvme_get_ctrl(&dev->ctrl);
         async_schedule(nvme_async_probe, dev);
 
@@ -2846,7 +2847,7 @@ static int nvme_resume(struct device *dev)
         struct nvme_dev *ndev = pci_get_drvdata(to_pci_dev(dev));
         struct nvme_ctrl *ctrl = &ndev->ctrl;
 
-        if (pm_resume_via_firmware() || !ctrl->npss ||
+        if (ndev->last_ps == U32_MAX ||
             nvme_set_power_state(ctrl, ndev->last_ps) != 0)
                 nvme_reset_ctrl(ctrl);
         return 0;
@@ -2859,6 +2860,8 @@ static int nvme_suspend(struct device *dev)
         struct nvme_ctrl *ctrl = &ndev->ctrl;
         int ret = -EBUSY;
 
+        ndev->last_ps = U32_MAX;
+
         /*
          * The platform does not remove power for a kernel managed suspend so
          * use host managed nvme power settings for lowest idle power if
@@ -2866,8 +2869,14 @@ static int nvme_suspend(struct device *dev)
          * shutdown.  But if the firmware is involved after the suspend or the
          * device does not support any non-default power states, shut down the
          * device fully.
+         *
+         * If ASPM is not enabled for the device, shut down the device and allow
+         * the PCI bus layer to put it into D3 in order to take the PCIe link
+         * down, so as to allow the platform to achieve its minimum low-power
+         * state (which may not be possible if the link is up).
          */
-        if (pm_suspend_via_firmware() || !ctrl->npss) {
+        if (pm_suspend_via_firmware() || !ctrl->npss ||
+            !pcie_aspm_enabled(pdev)) {
                 nvme_dev_disable(ndev, true);
                 return 0;
         }
@@ -2880,7 +2889,6 @@ static int nvme_suspend(struct device *dev)
             ctrl->state != NVME_CTRL_ADMIN_ONLY)
                 goto unfreeze;
 
-        ndev->last_ps = 0;
         ret = nvme_get_power_state(ctrl, &ndev->last_ps);
         if (ret < 0)
                 goto unfreeze;
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index a249db528d54..1a6449bc547b 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -562,13 +562,17 @@ out_destroy_cm_id:
         return ret;
 }
 
+static void __nvme_rdma_stop_queue(struct nvme_rdma_queue *queue)
+{
+        rdma_disconnect(queue->cm_id);
+        ib_drain_qp(queue->qp);
+}
+
 static void nvme_rdma_stop_queue(struct nvme_rdma_queue *queue)
 {
         if (!test_and_clear_bit(NVME_RDMA_Q_LIVE, &queue->flags))
                 return;
-
-        rdma_disconnect(queue->cm_id);
-        ib_drain_qp(queue->qp);
+        __nvme_rdma_stop_queue(queue);
 }
 
 static void nvme_rdma_free_queue(struct nvme_rdma_queue *queue)
@@ -607,11 +611,13 @@ static int nvme_rdma_start_queue(struct nvme_rdma_ctrl *ctrl, int idx)
         else
                 ret = nvmf_connect_admin_queue(&ctrl->ctrl);
 
-        if (!ret)
+        if (!ret) {
                 set_bit(NVME_RDMA_Q_LIVE, &queue->flags);
-        else
+        } else {
+                __nvme_rdma_stop_queue(queue);
                 dev_info(ctrl->ctrl.device,
                         "failed to connect queue: %d ret=%d\n", idx, ret);
+        }
         return ret;
 }
 
diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index cd52b9f15376..98613a45bd3b 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -675,6 +675,7 @@ static void nvmet_port_subsys_drop_link(struct config_item *parent,
 
 found:
         list_del(&p->entry);
+        nvmet_port_del_ctrls(port, subsys);
         nvmet_port_disc_changed(port, subsys);
 
         if (list_empty(&port->subsystems))
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index dad0243c7c96..3a67e244e568 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -46,6 +46,9 @@ inline u16 errno_to_nvme_status(struct nvmet_req *req, int errno)
         u16 status;
 
         switch (errno) {
+        case 0:
+                status = NVME_SC_SUCCESS;
+                break;
         case -ENOSPC:
                 req->error_loc = offsetof(struct nvme_rw_command, length);
                 status = NVME_SC_CAP_EXCEEDED | NVME_SC_DNR;
@@ -280,6 +283,18 @@ void nvmet_unregister_transport(const struct nvmet_fabrics_ops *ops)
 }
 EXPORT_SYMBOL_GPL(nvmet_unregister_transport);
 
+void nvmet_port_del_ctrls(struct nvmet_port *port, struct nvmet_subsys *subsys)
+{
+        struct nvmet_ctrl *ctrl;
+
+        mutex_lock(&subsys->lock);
+        list_for_each_entry(ctrl, &subsys->ctrls, subsys_entry) {
+                if (ctrl->port == port)
+                        ctrl->ops->delete_ctrl(ctrl);
+        }
+        mutex_unlock(&subsys->lock);
+}
+
 int nvmet_enable_port(struct nvmet_port *port)
 {
         const struct nvmet_fabrics_ops *ops;
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index b16dc3981c69..0940c5024a34 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -654,6 +654,14 @@ static void nvme_loop_remove_port(struct nvmet_port *port)
         mutex_lock(&nvme_loop_ports_mutex);
         list_del_init(&port->entry);
         mutex_unlock(&nvme_loop_ports_mutex);
+
+        /*
+         * Ensure any ctrls that are in the process of being
+         * deleted are in fact deleted before we return
+         * and free the port. This is to prevent active
+         * ctrls from using a port after it's freed.
+         */
+        flush_workqueue(nvme_delete_wq);
 }
 
 static const struct nvmet_fabrics_ops nvme_loop_ops = {
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 6ee66c610739..c51f8dd01dc4 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -418,6 +418,9 @@ void nvmet_port_send_ana_event(struct nvmet_port *port);
 int nvmet_register_transport(const struct nvmet_fabrics_ops *ops);
 void nvmet_unregister_transport(const struct nvmet_fabrics_ops *ops);
 
+void nvmet_port_del_ctrls(struct nvmet_port *port,
+                          struct nvmet_subsys *subsys);
+
 int nvmet_enable_port(struct nvmet_port *port);
 void nvmet_disable_port(struct nvmet_port *port);
 
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 7f84bb4903ca..a296eaf52a5b 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -277,7 +277,7 @@ EXPORT_SYMBOL_GPL(of_irq_parse_raw);
  * of_irq_parse_one - Resolve an interrupt for a device
  * @device: the device whose interrupt is to be resolved
  * @index: index of the interrupt to resolve
- * @out_irq: structure of_irq filled by this function
+ * @out_irq: structure of_phandle_args filled by this function
  *
  * This function resolves an interrupt for a node by walking the interrupt tree,
  * finding which interrupt controller node it is attached to, and returning the
diff --git a/drivers/of/resolver.c b/drivers/of/resolver.c
index c1b67dd7cd6e..83c766233181 100644
--- a/drivers/of/resolver.c
+++ b/drivers/of/resolver.c
@@ -206,16 +206,22 @@ static int adjust_local_phandle_references(struct device_node *local_fixups,
         for_each_child_of_node(local_fixups, child) {
 
                 for_each_child_of_node(overlay, overlay_child)
-                        if (!node_name_cmp(child, overlay_child))
+                        if (!node_name_cmp(child, overlay_child)) {
+                                of_node_put(overlay_child);
                                 break;
+                        }
 
-                if (!overlay_child)
+                if (!overlay_child) {
+                        of_node_put(child);
                         return -EINVAL;
+                }
 
                 err = adjust_local_phandle_references(child, overlay_child,
                                 phandle_delta);
-                if (err)
+                if (err) {
+                        of_node_put(child);
                         return err;
+                }
         }
 
         return 0;
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index e44af7f4d37f..464f8f92653f 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -1170,6 +1170,26 @@ static int pcie_aspm_get_policy(char *buffer, const struct kernel_param *kp)
 module_param_call(policy, pcie_aspm_set_policy, pcie_aspm_get_policy,
         NULL, 0644);
 
+/**
+ * pcie_aspm_enabled - Check if PCIe ASPM has been enabled for a device.
+ * @pdev: Target device.
+ */
+bool pcie_aspm_enabled(struct pci_dev *pdev)
+{
+        struct pci_dev *bridge = pci_upstream_bridge(pdev);
+        bool ret;
+
+        if (!bridge)
+                return false;
+
+        mutex_lock(&aspm_lock);
+        ret = bridge->link_state ? !!bridge->link_state->aspm_enabled : false;
+        mutex_unlock(&aspm_lock);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(pcie_aspm_enabled);
+
 #ifdef CONFIG_PCIEASPM_DEBUG
 static ssize_t link_state_show(struct device *dev,
                 struct device_attribute *attr,
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index faf43b1d3dbe..a7549ae32542 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -10776,12 +10776,31 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors)
         /* This loop sets up all CPUs that are affinitized with a
          * irq vector assigned to the driver. All affinitized CPUs
          * will get a link to that vectors IRQ and EQ.
+         *
+         * NULL affinity mask handling:
+         * If irq count is greater than one, log an error message.
+         * If the null mask is received for the first irq, find the
+         * first present cpu, and assign the eq index to ensure at
+         * least one EQ is assigned.
          */
         for (idx = 0; idx <  phba->cfg_irq_chann; idx++) {
                 /* Get a CPU mask for all CPUs affinitized to this vector */
                 maskp = pci_irq_get_affinity(phba->pcidev, idx);
-                if (!maskp)
-                        continue;
+                if (!maskp) {
+                        if (phba->cfg_irq_chann > 1)
+                                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                                "3329 No affinity mask found "
+                                                "for vector %d (%d)\n",
+                                                idx, phba->cfg_irq_chann);
+                        if (!idx) {
+                                cpu = cpumask_first(cpu_present_mask);
+                                cpup = &phba->sli4_hba.cpu_map[cpu];
+                                cpup->eq = idx;
+                                cpup->irq = pci_irq_vector(phba->pcidev, idx);
+                                cpup->flag |= LPFC_CPU_FIRST_IRQ;
+                        }
+                        break;
+                }
 
                 i = 0;
                 /* Loop through all CPUs associated with vector idx */
diff --git a/drivers/soundwire/Kconfig b/drivers/soundwire/Kconfig
index 3a01cfd70fdc..f518273cfbe3 100644
--- a/drivers/soundwire/Kconfig
+++ b/drivers/soundwire/Kconfig
@@ -4,7 +4,7 @@
 #
 
 menuconfig SOUNDWIRE
-        bool "SoundWire support"
+        tristate "SoundWire support"
         help
           SoundWire is a 2-Pin interface with data and clock line ratified
           by the MIPI Alliance. SoundWire is used for transporting data
@@ -17,17 +17,12 @@ if SOUNDWIRE
 
 comment "SoundWire Devices"
 
-config SOUNDWIRE_BUS
-        tristate
-        select REGMAP_SOUNDWIRE
-
 config SOUNDWIRE_CADENCE
         tristate
 
 config SOUNDWIRE_INTEL
         tristate "Intel SoundWire Master driver"
         select SOUNDWIRE_CADENCE
-        select SOUNDWIRE_BUS
         depends on X86 && ACPI && SND_SOC
         help
           SoundWire Intel Master driver.
diff --git a/drivers/soundwire/Makefile b/drivers/soundwire/Makefile
index fd99a831b92a..45b7e5001653 100644
--- a/drivers/soundwire/Makefile
+++ b/drivers/soundwire/Makefile
@@ -5,7 +5,7 @@
 
 #Bus Objs
 soundwire-bus-objs := bus_type.o bus.o slave.o mipi_disco.o stream.o
-obj-$(CONFIG_SOUNDWIRE_BUS) += soundwire-bus.o
+obj-$(CONFIG_SOUNDWIRE) += soundwire-bus.o
 
 #Cadence Objs
 soundwire-cadence-objs := cadence_master.o
diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c
index ff4badc9b3de..60e8bdee5c75 100644
--- a/drivers/soundwire/cadence_master.c
+++ b/drivers/soundwire/cadence_master.c
@@ -81,8 +81,8 @@
 
 #define CDNS_MCP_INTSET                         0x4C
 
-#define CDNS_SDW_SLAVE_STAT                     0x50
-#define CDNS_MCP_SLAVE_STAT_MASK                BIT(1, 0)
+#define CDNS_MCP_SLAVE_STAT                     0x50
+#define CDNS_MCP_SLAVE_STAT_MASK                GENMASK(1, 0)
 
 #define CDNS_MCP_SLAVE_INTSTAT0                 0x54
 #define CDNS_MCP_SLAVE_INTSTAT1                 0x58
@@ -96,8 +96,8 @@
 #define CDNS_MCP_SLAVE_INTMASK0                 0x5C
 #define CDNS_MCP_SLAVE_INTMASK1                 0x60
 
-#define CDNS_MCP_SLAVE_INTMASK0_MASK            GENMASK(30, 0)
-#define CDNS_MCP_SLAVE_INTMASK1_MASK            GENMASK(16, 0)
+#define CDNS_MCP_SLAVE_INTMASK0_MASK            GENMASK(31, 0)
+#define CDNS_MCP_SLAVE_INTMASK1_MASK            GENMASK(15, 0)
 
 #define CDNS_MCP_PORT_INTSTAT                   0x64
 #define CDNS_MCP_PDI_STAT                       0x6C
diff --git a/drivers/staging/comedi/drivers/dt3000.c b/drivers/staging/comedi/drivers/dt3000.c
index 2edf3ee91300..caf4d4df4bd3 100644
--- a/drivers/staging/comedi/drivers/dt3000.c
+++ b/drivers/staging/comedi/drivers/dt3000.c
@@ -342,9 +342,9 @@ static irqreturn_t dt3k_interrupt(int irq, void *d)
 static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec,
                             unsigned int flags)
 {
-        int divider, base, prescale;
+        unsigned int divider, base, prescale;
 
-        /* This function needs improvment */
+        /* This function needs improvement */
         /* Don't know if divider==0 works. */
 
         for (prescale = 0; prescale < 16; prescale++) {
@@ -358,7 +358,7 @@ static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec,
                         divider = (*nanosec) / base;
                         break;
                 case CMDF_ROUND_UP:
-                        divider = (*nanosec) / base;
+                        divider = DIV_ROUND_UP(*nanosec, base);
                         break;
                 }
                 if (divider < 65536) {
@@ -368,7 +368,7 @@ static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec,
         }
 
         prescale = 15;
-        base = timer_base * (1 << prescale);
+        base = timer_base * (prescale + 1);
         divider = 65535;
         *nanosec = divider * base;
         return (prescale << 16) | (divider);
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index b5abfe89190c..df8812c30640 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -454,9 +454,11 @@ err_clk:
         imx_disable_unprepare_clks(dev);
 disable_hsic_regulator:
         if (data->hsic_pad_regulator)
-                ret = regulator_disable(data->hsic_pad_regulator);
+                /* don't overwrite original ret (cf. EPROBE_DEFER) */
+                regulator_disable(data->hsic_pad_regulator);
         if (pdata.flags & CI_HDRC_PMQOS)
                 pm_qos_remove_request(&data->pm_qos_req);
+        data->ci_pdev = NULL;
         return ret;
 }
 
@@ -469,14 +471,17 @@ static int ci_hdrc_imx_remove(struct platform_device *pdev)
                 pm_runtime_disable(&pdev->dev);
                 pm_runtime_put_noidle(&pdev->dev);
         }
-        ci_hdrc_remove_device(data->ci_pdev);
+        if (data->ci_pdev)
+                ci_hdrc_remove_device(data->ci_pdev);
         if (data->override_phy_control)
                 usb_phy_shutdown(data->phy);
-        imx_disable_unprepare_clks(&pdev->dev);
-        if (data->plat_data->flags & CI_HDRC_PMQOS)
-                pm_qos_remove_request(&data->pm_qos_req);
-        if (data->hsic_pad_regulator)
-                regulator_disable(data->hsic_pad_regulator);
+        if (data->ci_pdev) {
+                imx_disable_unprepare_clks(&pdev->dev);
+                if (data->plat_data->flags & CI_HDRC_PMQOS)
+                        pm_qos_remove_request(&data->pm_qos_req);
+                if (data->hsic_pad_regulator)
+                        regulator_disable(data->hsic_pad_regulator);
+        }
 
         return 0;
 }
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 183b41753c98..62f4fb9b362f 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1301,10 +1301,6 @@ made_compressed_probe:
         tty_port_init(&acm->port);
         acm->port.ops = &acm_port_ops;
 
-        minor = acm_alloc_minor(acm);
-        if (minor < 0)
-                goto alloc_fail1;
-
         ctrlsize = usb_endpoint_maxp(epctrl);
         readsize = usb_endpoint_maxp(epread) *
                                 (quirks == SINGLE_RX_URB ? 1 : 2);
@@ -1312,6 +1308,13 @@ made_compressed_probe:
         acm->writesize = usb_endpoint_maxp(epwrite) * 20;
         acm->control = control_interface;
         acm->data = data_interface;
+
+        usb_get_intf(acm->control); /* undone in destruct() */
+
+        minor = acm_alloc_minor(acm);
+        if (minor < 0)
+                goto alloc_fail1;
+
         acm->minor = minor;
         acm->dev = usb_dev;
         if (h.usb_cdc_acm_descriptor)
@@ -1458,7 +1461,6 @@ skip_countries:
         usb_driver_claim_interface(&acm_driver, data_interface, acm);
         usb_set_intfdata(data_interface, acm);
 
-        usb_get_intf(control_interface);
         tty_dev = tty_port_register_device(&acm->port, acm_tty_driver, minor,
                         &control_interface->dev);
         if (IS_ERR(tty_dev)) {
diff --git a/drivers/usb/core/buffer.c b/drivers/usb/core/buffer.c
index 1359b78a624e..6cf22c27f2d2 100644
--- a/drivers/usb/core/buffer.c
+++ b/drivers/usb/core/buffer.c
@@ -66,9 +66,7 @@ int hcd_buffer_create(struct usb_hcd *hcd)
         char            name[16];
         int             i, size;
 
-        if (!IS_ENABLED(CONFIG_HAS_DMA) ||
-            (!is_device_dma_capable(hcd->self.sysdev) &&
-             !hcd->localmem_pool))
+        if (hcd->localmem_pool || !hcd_uses_dma(hcd))
                 return 0;
 
         for (i = 0; i < HCD_BUFFER_POOLS; i++) {
@@ -129,8 +127,7 @@ void *hcd_buffer_alloc(
                 return gen_pool_dma_alloc(hcd->localmem_pool, size, dma);
 
         /* some USB hosts just use PIO */
-        if (!IS_ENABLED(CONFIG_HAS_DMA) ||
-            !is_device_dma_capable(bus->sysdev)) {
+        if (!hcd_uses_dma(hcd)) {
                 *dma = ~(dma_addr_t) 0;
                 return kmalloc(size, mem_flags);
         }
@@ -160,8 +157,7 @@ void hcd_buffer_free(
                 return;
         }
 
-        if (!IS_ENABLED(CONFIG_HAS_DMA) ||
-            !is_device_dma_capable(bus->sysdev)) {
+        if (!hcd_uses_dma(hcd)) {
                 kfree(addr);
                 return;
         }
diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
index 65de6f73b672..558890ada0e5 100644
--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -193,9 +193,10 @@ int usb_register_dev(struct usb_interface *intf,
                 intf->minor = minor;
                 break;
         }
-        up_write(&minor_rwsem);
-        if (intf->minor < 0)
+        if (intf->minor < 0) {
+                up_write(&minor_rwsem);
                 return -EXFULL;
+        }
 
         /* create a usb class device for this usb interface */
         snprintf(name, sizeof(name), class_driver->name, minor - minor_base);
@@ -203,12 +204,11 @@ int usb_register_dev(struct usb_interface *intf,
                                       MKDEV(USB_MAJOR, minor), class_driver,
                                       "%s", kbasename(name));
         if (IS_ERR(intf->usb_dev)) {
-                down_write(&minor_rwsem);
                 usb_minors[minor] = NULL;
                 intf->minor = -1;
-                up_write(&minor_rwsem);
                 retval = PTR_ERR(intf->usb_dev);
         }
+        up_write(&minor_rwsem);
         return retval;
 }
 EXPORT_SYMBOL_GPL(usb_register_dev);
@@ -234,12 +234,12 @@ void usb_deregister_dev(struct usb_interface *intf,
                 return;
 
         dev_dbg(&intf->dev, "removing %d minor\n", intf->minor);
+        device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
 
         down_write(&minor_rwsem);
         usb_minors[intf->minor] = NULL;
         up_write(&minor_rwsem);
 
-        device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
         intf->usb_dev = NULL;
         intf->minor = -1;
         destroy_usb_class();
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 2ccbc2f83570..8592c0344fe8 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1412,7 +1412,7 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
         if (usb_endpoint_xfer_control(&urb->ep->desc)) {
                 if (hcd->self.uses_pio_for_control)
                         return ret;
-                if (IS_ENABLED(CONFIG_HAS_DMA) && hcd->self.uses_dma) {
+                if (hcd_uses_dma(hcd)) {
                         if (is_vmalloc_addr(urb->setup_packet)) {
                                 WARN_ONCE(1, "setup packet is not dma capable\n");
                                 return -EAGAIN;
@@ -1446,7 +1446,7 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
         dir = usb_urb_dir_in(urb) ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
         if (urb->transfer_buffer_length != 0
             && !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)) {
-                if (IS_ENABLED(CONFIG_HAS_DMA) && hcd->self.uses_dma) {
+                if (hcd_uses_dma(hcd)) {
                         if (urb->num_sgs) {
                                 int n;
 
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index e844bb7b5676..5adf489428aa 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2218,14 +2218,14 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,
                                 (struct usb_cdc_dmm_desc *)buffer;
                         break;
                 case USB_CDC_MDLM_TYPE:
-                        if (elength < sizeof(struct usb_cdc_mdlm_desc *))
+                        if (elength < sizeof(struct usb_cdc_mdlm_desc))
                                 goto next_desc;
                         if (desc)
                                 return -EINVAL;
                         desc = (struct usb_cdc_mdlm_desc *)buffer;
                         break;
                 case USB_CDC_MDLM_DETAIL_TYPE:
-                        if (elength < sizeof(struct usb_cdc_mdlm_detail_desc *))
+                        if (elength < sizeof(struct usb_cdc_mdlm_detail_desc))
                                 goto next_desc;
                         if (detail)
                                 return -EINVAL;
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index ee144ff8af5b..111787a137ee 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -4608,7 +4608,7 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
 
         buf = urb->transfer_buffer;
 
-        if (hcd->self.uses_dma) {
+        if (hcd_uses_dma(hcd)) {
                 if (!buf && (urb->transfer_dma & 3)) {
                         dev_err(hsotg->dev,
                                 "%s: unaligned transfer with no transfer_buffer",
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 9118b42c70b6..76883ff4f5bb 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1976,6 +1976,7 @@ void composite_disconnect(struct usb_gadget *gadget)
          * disconnect callbacks?
          */
         spin_lock_irqsave(&cdev->lock, flags);
+        cdev->suspended = 0;
         if (cdev->config)
                 reset_config(cdev);
         if (cdev->driver->disconnect)
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index 29cc5693e05c..7c96c4665178 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -261,7 +261,7 @@ struct fsg_common;
 struct fsg_common {
         struct usb_gadget       *gadget;
         struct usb_composite_dev *cdev;
-        struct fsg_dev          *fsg, *new_fsg;
+        struct fsg_dev          *fsg;
         wait_queue_head_t       io_wait;
         wait_queue_head_t       fsg_wait;
 
@@ -290,6 +290,7 @@ struct fsg_common {
         unsigned int            bulk_out_maxpacket;
         enum fsg_state          state;          /* For exception handling */
         unsigned int            exception_req_tag;
+        void                    *exception_arg;
 
         enum data_direction     data_dir;
         u32                     data_size;
@@ -391,7 +392,8 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
 
 /* These routines may be called in process context or in_irq */
 
-static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
+static void __raise_exception(struct fsg_common *common, enum fsg_state new_state,
+                              void *arg)
 {
         unsigned long           flags;
 
@@ -404,6 +406,7 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
         if (common->state <= new_state) {
                 common->exception_req_tag = common->ep0_req_tag;
                 common->state = new_state;
+                common->exception_arg = arg;
                 if (common->thread_task)
                         send_sig_info(SIGUSR1, SEND_SIG_PRIV,
                                       common->thread_task);
@@ -411,6 +414,10 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
         spin_unlock_irqrestore(&common->lock, flags);
 }
 
+static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
+{
+        __raise_exception(common, new_state, NULL);
+}
 
 /*-------------------------------------------------------------------------*/
 
@@ -2285,16 +2292,16 @@ reset:
 static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 {
         struct fsg_dev *fsg = fsg_from_func(f);
-        fsg->common->new_fsg = fsg;
-        raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+
+        __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, fsg);
         return USB_GADGET_DELAYED_STATUS;
 }
 
 static void fsg_disable(struct usb_function *f)
 {
         struct fsg_dev *fsg = fsg_from_func(f);
-        fsg->common->new_fsg = NULL;
-        raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+
+        __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL);
 }
 
 
@@ -2307,6 +2314,7 @@ static void handle_exception(struct fsg_common *common)
         enum fsg_state          old_state;
         struct fsg_lun          *curlun;
         unsigned int            exception_req_tag;
+        struct fsg_dev          *new_fsg;
 
         /*
          * Clear the existing signals.  Anything but SIGUSR1 is converted
@@ -2360,6 +2368,7 @@ static void handle_exception(struct fsg_common *common)
         common->next_buffhd_to_fill = &common->buffhds[0];
         common->next_buffhd_to_drain = &common->buffhds[0];
         exception_req_tag = common->exception_req_tag;
+        new_fsg = common->exception_arg;
         old_state = common->state;
         common->state = FSG_STATE_NORMAL;
 
@@ -2413,8 +2422,8 @@ static void handle_exception(struct fsg_common *common)
                 break;
 
         case FSG_STATE_CONFIG_CHANGE:
-                do_set_interface(common, common->new_fsg);
-                if (common->new_fsg)
+                do_set_interface(common, new_fsg);
+                if (new_fsg)
                         usb_composite_setup_continue(common->cdev);
                 break;
 
@@ -2989,8 +2998,7 @@ static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
 
         DBG(fsg, "unbind\n");
         if (fsg->common->fsg == fsg) {
-                fsg->common->new_fsg = NULL;
-                raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+                __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL);
                 /* FIXME: make interruptible or killable somehow? */
                 wait_event(common->fsg_wait, common->fsg != fsg);
         }
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 027a25694a68..e098f16c01cb 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -19,6 +19,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/sizes.h>
 #include <linux/slab.h>
+#include <linux/string.h>
 #include <linux/sys_soc.h>
 #include <linux/uaccess.h>
 #include <linux/usb/ch9.h>
@@ -2450,9 +2451,9 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr,
         if (usb3->forced_b_device)
                 return -EBUSY;
 
-        if (!strncmp(buf, "host", strlen("host")))
+        if (sysfs_streq(buf, "host"))
                 new_mode_is_host = true;
-        else if (!strncmp(buf, "peripheral", strlen("peripheral")))
+        else if (sysfs_streq(buf, "peripheral"))
                 new_mode_is_host = false;
         else
                 return -EINVAL;
diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
index 77cc36efae95..0dbfa5c10703 100644
--- a/drivers/usb/host/fotg210-hcd.c
+++ b/drivers/usb/host/fotg210-hcd.c
@@ -1629,6 +1629,10 @@ static int fotg210_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                         /* see what we found out */
                         temp = check_reset_complete(fotg210, wIndex, status_reg,
                                         fotg210_readl(fotg210, status_reg));
+
+                        /* restart schedule */
+                        fotg210->command |= CMD_RUN;
+                        fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
                 }
 
                 if (!(temp & (PORT_RESUME|PORT_RESET))) {
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index c1582fbd1150..38e920ac7f82 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -968,6 +968,11 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7B) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7C) },
 
+        /* Motorola devices */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x2a70, 0xff, 0xff, 0xff) },    /* mdm6600 */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x2e0a, 0xff, 0xff, 0xff) },    /* mdm9600 */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x4281, 0x0a, 0x00, 0xfc) },    /* mdm ram dl */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x900e, 0xff, 0xff, 0xff) },    /* mdm qc dl */
 
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) },
@@ -1549,6 +1554,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff),  /* Telewell TW-LTE 4G v2 */
           .driver_info = RSVD(2) },
         { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) },    /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0x00, 0x00) }, /* ZTE MF871A */
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
@@ -1952,11 +1958,15 @@ static const struct usb_device_id option_ids[] = {
           .driver_info = RSVD(4) },
         { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff),                     /* D-Link DWM-222 */
           .driver_info = RSVD(4) },
+        { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e3d, 0xff),                     /* D-Link DWM-222 A2 */
+          .driver_info = RSVD(4) },
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) },    /* D-Link DWM-152/C1 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) },    /* D-Link DWM-156/C1 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) },    /* D-Link DWM-156/A3 */
         { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff),                     /* Olicard 600 */
           .driver_info = RSVD(4) },
+        { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff),                     /* BroadMobi BM818 */
+          .driver_info = RSVD(4) },
         { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                   /* OLICARD300 - MT6225 */
         { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
         { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index 4f1b6f466ff5..b86195e4dc6c 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -505,18 +505,14 @@ static void SRXAFSCB_ProbeUuid(struct work_struct *work)
         struct afs_call *call = container_of(work, struct afs_call, work);
         struct afs_uuid *r = call->request;
 
-        struct {
-                __be32  match;
-        } reply;
-
         _enter("");
 
         if (memcmp(r, &call->net->uuid, sizeof(call->net->uuid)) == 0)
-                reply.match = htonl(0);
+                afs_send_empty_reply(call);
         else
-                reply.match = htonl(1);
+                rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
+                                        1, 1, "K-1");
 
-        afs_send_simple_reply(call, &reply, sizeof(reply));
         afs_put_call(call);
         _leave("");
 }
diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index e640d67274be..81207dc3c997 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -440,7 +440,7 @@ static int afs_dir_iterate_block(struct afs_vnode *dvnode,
  * iterate through the data blob that lists the contents of an AFS directory
  */
 static int afs_dir_iterate(struct inode *dir, struct dir_context *ctx,
-                           struct key *key)
+                           struct key *key, afs_dataversion_t *_dir_version)
 {
         struct afs_vnode *dvnode = AFS_FS_I(dir);
         struct afs_xdr_dir_page *dbuf;
@@ -460,6 +460,7 @@ static int afs_dir_iterate(struct inode *dir, struct dir_context *ctx,
         req = afs_read_dir(dvnode, key);
         if (IS_ERR(req))
                 return PTR_ERR(req);
+        *_dir_version = req->data_version;
 
         /* round the file position up to the next entry boundary */
         ctx->pos += sizeof(union afs_xdr_dirent) - 1;
@@ -514,7 +515,10 @@ out:
  */
 static int afs_readdir(struct file *file, struct dir_context *ctx)
 {
-        return afs_dir_iterate(file_inode(file), ctx, afs_file_key(file));
+        afs_dataversion_t dir_version;
+
+        return afs_dir_iterate(file_inode(file), ctx, afs_file_key(file),
+                               &dir_version);
 }
 
 /*
@@ -555,7 +559,8 @@ static int afs_lookup_one_filldir(struct dir_context *ctx, const char *name,
  * - just returns the FID the dentry name maps to if found
  */
 static int afs_do_lookup_one(struct inode *dir, struct dentry *dentry,
-                             struct afs_fid *fid, struct key *key)
+                             struct afs_fid *fid, struct key *key,
+                             afs_dataversion_t *_dir_version)
 {
         struct afs_super_info *as = dir->i_sb->s_fs_info;
         struct afs_lookup_one_cookie cookie = {
@@ -568,7 +573,7 @@ static int afs_do_lookup_one(struct inode *dir, struct dentry *dentry,
         _enter("{%lu},%p{%pd},", dir->i_ino, dentry, dentry);
 
         /* search the directory */
-        ret = afs_dir_iterate(dir, &cookie.ctx, key);
+        ret = afs_dir_iterate(dir, &cookie.ctx, key, _dir_version);
         if (ret < 0) {
                 _leave(" = %d [iter]", ret);
                 return ret;
@@ -642,6 +647,7 @@ static struct inode *afs_do_lookup(struct inode *dir, struct dentry *dentry,
         struct afs_server *server;
         struct afs_vnode *dvnode = AFS_FS_I(dir), *vnode;
         struct inode *inode = NULL, *ti;
+        afs_dataversion_t data_version = READ_ONCE(dvnode->status.data_version);
         int ret, i;
 
         _enter("{%lu},%p{%pd},", dir->i_ino, dentry, dentry);
@@ -669,12 +675,14 @@ static struct inode *afs_do_lookup(struct inode *dir, struct dentry *dentry,
                 cookie->fids[i].vid = as->volume->vid;
 
         /* search the directory */
-        ret = afs_dir_iterate(dir, &cookie->ctx, key);
+        ret = afs_dir_iterate(dir, &cookie->ctx, key, &data_version);
         if (ret < 0) {
                 inode = ERR_PTR(ret);
                 goto out;
         }
 
+        dentry->d_fsdata = (void *)(unsigned long)data_version;
+
         inode = ERR_PTR(-ENOENT);
         if (!cookie->found)
                 goto out;
@@ -968,7 +976,8 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
         struct dentry *parent;
         struct inode *inode;
         struct key *key;
-        long dir_version, de_version;
+        afs_dataversion_t dir_version;
+        long de_version;
         int ret;
 
         if (flags & LOOKUP_RCU)
@@ -1014,20 +1023,20 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
          * on a 32-bit system, we only have 32 bits in the dentry to store the
          * version.
          */
-        dir_version = (long)dir->status.data_version;
+        dir_version = dir->status.data_version;
         de_version = (long)dentry->d_fsdata;
-        if (de_version == dir_version)
-                goto out_valid;
+        if (de_version == (long)dir_version)
+                goto out_valid_noupdate;
 
-        dir_version = (long)dir->invalid_before;
-        if (de_version - dir_version >= 0)
+        dir_version = dir->invalid_before;
+        if (de_version - (long)dir_version >= 0)
                 goto out_valid;
 
         _debug("dir modified");
         afs_stat_v(dir, n_reval);
 
         /* search the directory for this vnode */
-        ret = afs_do_lookup_one(&dir->vfs_inode, dentry, &fid, key);
+        ret = afs_do_lookup_one(&dir->vfs_inode, dentry, &fid, key, &dir_version);
         switch (ret) {
         case 0:
                 /* the filename maps to something */
@@ -1080,7 +1089,8 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
         }
 
 out_valid:
-        dentry->d_fsdata = (void *)dir_version;
+        dentry->d_fsdata = (void *)(unsigned long)dir_version;
+out_valid_noupdate:
         dput(parent);
         key_put(key);
         _leave(" = 1 [valid]");
@@ -1186,6 +1196,20 @@ static void afs_prep_for_new_inode(struct afs_fs_cursor *fc,
 }
 
 /*
+ * Note that a dentry got changed.  We need to set d_fsdata to the data version
+ * number derived from the result of the operation.  It doesn't matter if
+ * d_fsdata goes backwards as we'll just revalidate.
+ */
+static void afs_update_dentry_version(struct afs_fs_cursor *fc,
+                                      struct dentry *dentry,
+                                      struct afs_status_cb *scb)
+{
+        if (fc->ac.error == 0)
+                dentry->d_fsdata =
+                        (void *)(unsigned long)scb->status.data_version;
+}
+
+/*
  * create a directory on an AFS filesystem
  */
 static int afs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
@@ -1227,6 +1251,7 @@ static int afs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
                 afs_check_for_remote_deletion(&fc, dvnode);
                 afs_vnode_commit_status(&fc, dvnode, fc.cb_break,
                                         &data_version, &scb[0]);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                 afs_vnode_new_inode(&fc, dentry, &iget_data, &scb[1]);
                 ret = afs_end_vnode_operation(&fc);
                 if (ret < 0)
@@ -1319,6 +1344,7 @@ static int afs_rmdir(struct inode *dir, struct dentry *dentry)
 
                 afs_vnode_commit_status(&fc, dvnode, fc.cb_break,
                                         &data_version, scb);
+                afs_update_dentry_version(&fc, dentry, scb);
                 ret = afs_end_vnode_operation(&fc);
                 if (ret == 0) {
                         afs_dir_remove_subdir(dentry);
@@ -1458,6 +1484,7 @@ static int afs_unlink(struct inode *dir, struct dentry *dentry)
                                         &data_version, &scb[0]);
                 afs_vnode_commit_status(&fc, vnode, fc.cb_break_2,
                                         &data_version_2, &scb[1]);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                 ret = afs_end_vnode_operation(&fc);
                 if (ret == 0 && !(scb[1].have_status || scb[1].have_error))
                         ret = afs_dir_remove_link(dvnode, dentry, key);
@@ -1526,6 +1553,7 @@ static int afs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
                 afs_check_for_remote_deletion(&fc, dvnode);
                 afs_vnode_commit_status(&fc, dvnode, fc.cb_break,
                                         &data_version, &scb[0]);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                 afs_vnode_new_inode(&fc, dentry, &iget_data, &scb[1]);
                 ret = afs_end_vnode_operation(&fc);
                 if (ret < 0)
@@ -1607,6 +1635,7 @@ static int afs_link(struct dentry *from, struct inode *dir,
                 afs_vnode_commit_status(&fc, vnode, fc.cb_break_2,
                                         NULL, &scb[1]);
                 ihold(&vnode->vfs_inode);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                 d_instantiate(dentry, &vnode->vfs_inode);
 
                 mutex_unlock(&vnode->io_lock);
@@ -1686,6 +1715,7 @@ static int afs_symlink(struct inode *dir, struct dentry *dentry,
                 afs_check_for_remote_deletion(&fc, dvnode);
                 afs_vnode_commit_status(&fc, dvnode, fc.cb_break,
                                         &data_version, &scb[0]);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                 afs_vnode_new_inode(&fc, dentry, &iget_data, &scb[1]);
                 ret = afs_end_vnode_operation(&fc);
                 if (ret < 0)
@@ -1791,6 +1821,17 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 }
         }
 
+        /* This bit is potentially nasty as there's a potential race with
+         * afs_d_revalidate{,_rcu}().  We have to change d_fsdata on the dentry
+         * to reflect it's new parent's new data_version after the op, but
+         * d_revalidate may see old_dentry between the op having taken place
+         * and the version being updated.
+         *
+         * So drop the old_dentry for now to make other threads go through
+         * lookup instead - which we hold a lock against.
+         */
+        d_drop(old_dentry);
+
         ret = -ERESTARTSYS;
         if (afs_begin_vnode_operation(&fc, orig_dvnode, key, true)) {
                 afs_dataversion_t orig_data_version;
@@ -1802,9 +1843,9 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 if (orig_dvnode != new_dvnode) {
                         if (mutex_lock_interruptible_nested(&new_dvnode->io_lock, 1) < 0) {
                                 afs_end_vnode_operation(&fc);
-                                goto error_rehash;
+                                goto error_rehash_old;
                         }
-                        new_data_version = new_dvnode->status.data_version;
+                        new_data_version = new_dvnode->status.data_version + 1;
                 } else {
                         new_data_version = orig_data_version;
                         new_scb = &scb[0];
@@ -1827,7 +1868,7 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 }
                 ret = afs_end_vnode_operation(&fc);
                 if (ret < 0)
-                        goto error_rehash;
+                        goto error_rehash_old;
         }
 
         if (ret == 0) {
@@ -1853,10 +1894,26 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry,
                                 drop_nlink(new_inode);
                         spin_unlock(&new_inode->i_lock);
                 }
+
+                /* Now we can update d_fsdata on the dentries to reflect their
+                 * new parent's data_version.
+                 *
+                 * Note that if we ever implement RENAME_EXCHANGE, we'll have
+                 * to update both dentries with opposing dir versions.
+                 */
+                if (new_dvnode != orig_dvnode) {
+                        afs_update_dentry_version(&fc, old_dentry, &scb[1]);
+                        afs_update_dentry_version(&fc, new_dentry, &scb[1]);
+                } else {
+                        afs_update_dentry_version(&fc, old_dentry, &scb[0]);
+                        afs_update_dentry_version(&fc, new_dentry, &scb[0]);
+                }
                 d_move(old_dentry, new_dentry);
                 goto error_tmp;
         }
 
+error_rehash_old:
+        d_rehash(new_dentry);
 error_rehash:
         if (rehash)
                 d_rehash(rehash);
diff --git a/fs/afs/file.c b/fs/afs/file.c
index 56b69576274d..dd3c55c9101c 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -191,11 +191,13 @@ void afs_put_read(struct afs_read *req)
         int i;
 
         if (refcount_dec_and_test(&req->usage)) {
-                for (i = 0; i < req->nr_pages; i++)
-                        if (req->pages[i])
-                                put_page(req->pages[i]);
-                if (req->pages != req->array)
-                        kfree(req->pages);
+                if (req->pages) {
+                        for (i = 0; i < req->nr_pages; i++)
+                                if (req->pages[i])
+                                        put_page(req->pages[i]);
+                        if (req->pages != req->array)
+                                kfree(req->pages);
+                }
                 kfree(req);
         }
 }
diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c
index d7e0fd3c00df..cfb0ac4bd039 100644
--- a/fs/afs/vlclient.c
+++ b/fs/afs/vlclient.c
@@ -56,23 +56,24 @@ static int afs_deliver_vl_get_entry_by_name_u(struct afs_call *call)
                 struct afs_uuid__xdr *xdr;
                 struct afs_uuid *uuid;
                 int j;
+                int n = entry->nr_servers;
 
                 tmp = ntohl(uvldb->serverFlags[i]);
                 if (tmp & AFS_VLSF_DONTUSE ||
                     (new_only && !(tmp & AFS_VLSF_NEWREPSITE)))
                         continue;
                 if (tmp & AFS_VLSF_RWVOL) {
-                        entry->fs_mask[i] |= AFS_VOL_VTM_RW;
+                        entry->fs_mask[n] |= AFS_VOL_VTM_RW;
                         if (vlflags & AFS_VLF_BACKEXISTS)
-                                entry->fs_mask[i] |= AFS_VOL_VTM_BAK;
+                                entry->fs_mask[n] |= AFS_VOL_VTM_BAK;
                 }
                 if (tmp & AFS_VLSF_ROVOL)
-                        entry->fs_mask[i] |= AFS_VOL_VTM_RO;
-                if (!entry->fs_mask[i])
+                        entry->fs_mask[n] |= AFS_VOL_VTM_RO;
+                if (!entry->fs_mask[n])
                         continue;
 
                 xdr = &uvldb->serverNumber[i];
-                uuid = (struct afs_uuid *)&entry->fs_server[i];
+                uuid = (struct afs_uuid *)&entry->fs_server[n];
                 uuid->time_low                  = xdr->time_low;
                 uuid->time_mid                  = htons(ntohl(xdr->time_mid));
                 uuid->time_hi_and_version       = htons(ntohl(xdr->time_hi_and_version));
diff --git a/fs/block_dev.c b/fs/block_dev.c
index eb657ab94060..677cb364d33f 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -345,24 +345,15 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
         struct bio *bio;
         bool is_poll = (iocb->ki_flags & IOCB_HIPRI) != 0;
         bool is_read = (iov_iter_rw(iter) == READ), is_sync;
-        bool nowait = (iocb->ki_flags & IOCB_NOWAIT) != 0;
         loff_t pos = iocb->ki_pos;
         blk_qc_t qc = BLK_QC_T_NONE;
-        gfp_t gfp;
-        int ret;
+        int ret = 0;
 
         if ((pos | iov_iter_alignment(iter)) &
             (bdev_logical_block_size(bdev) - 1))
                 return -EINVAL;
 
-        if (nowait)
-                gfp = GFP_NOWAIT;
-        else
-                gfp = GFP_KERNEL;
-
-        bio = bio_alloc_bioset(gfp, nr_pages, &blkdev_dio_pool);
-        if (!bio)
-                return -EAGAIN;
+        bio = bio_alloc_bioset(GFP_KERNEL, nr_pages, &blkdev_dio_pool);
 
         dio = container_of(bio, struct blkdev_dio, bio);
         dio->is_sync = is_sync = is_sync_kiocb(iocb);
@@ -384,7 +375,6 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
         if (!is_poll)
                 blk_start_plug(&plug);
 
-        ret = 0;
         for (;;) {
                 bio_set_dev(bio, bdev);
                 bio->bi_iter.bi_sector = pos >> 9;
@@ -409,14 +399,7 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
                         task_io_account_write(bio->bi_iter.bi_size);
                 }
 
-                /*
-                 * Tell underlying layer to not block for resource shortage.
-                 * And if we would have blocked, return error inline instead
-                 * of through the bio->bi_end_io() callback.
-                 */
-                if (nowait)
-                        bio->bi_opf |= (REQ_NOWAIT | REQ_NOWAIT_INLINE);
-
+                dio->size += bio->bi_iter.bi_size;
                 pos += bio->bi_iter.bi_size;
 
                 nr_pages = iov_iter_npages(iter, BIO_MAX_PAGES);
@@ -428,13 +411,7 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
                                 polled = true;
                         }
 
-                        dio->size += bio->bi_iter.bi_size;
                         qc = submit_bio(bio);
-                        if (qc == BLK_QC_T_EAGAIN) {
-                                dio->size -= bio->bi_iter.bi_size;
-                                ret = -EAGAIN;
-                                goto error;
-                        }
 
                         if (polled)
                                 WRITE_ONCE(iocb->ki_cookie, qc);
@@ -455,19 +432,8 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
                         atomic_inc(&dio->ref);
                 }
 
-                dio->size += bio->bi_iter.bi_size;
-                qc = submit_bio(bio);
-                if (qc == BLK_QC_T_EAGAIN) {
-                        dio->size -= bio->bi_iter.bi_size;
-                        ret = -EAGAIN;
-                        goto error;
-                }
-
-                bio = bio_alloc(gfp, nr_pages);
-                if (!bio) {
-                        ret = -EAGAIN;
-                        goto error;
-                }
+                submit_bio(bio);
+                bio = bio_alloc(GFP_KERNEL, nr_pages);
         }
 
         if (!is_poll)
@@ -487,7 +453,6 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
         }
         __set_current_state(TASK_RUNNING);
 
-out:
         if (!ret)
                 ret = blk_status_to_errno(dio->bio.bi_status);
         if (likely(!ret))
@@ -495,10 +460,6 @@ out:
 
         bio_put(&dio->bio);
         return ret;
-error:
-        if (!is_poll)
-                blk_finish_plug(&plug);
-        goto out;
 }
 
 static ssize_t
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 299e11e6c554..94660063a162 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -401,7 +401,6 @@ struct btrfs_dev_replace {
 struct raid_kobject {
         u64 flags;
         struct kobject kobj;
-        struct list_head list;
 };
 
 /*
@@ -915,8 +914,6 @@ struct btrfs_fs_info {
         u32 thread_pool_size;
 
         struct kobject *space_info_kobj;
-        struct list_head pending_raid_kobjs;
-        spinlock_t pending_raid_kobjs_lock; /* uncontended */
 
         u64 total_pinned;
 
@@ -2698,7 +2695,6 @@ int btrfs_can_relocate(struct btrfs_fs_info *fs_info, u64 bytenr);
 int btrfs_make_block_group(struct btrfs_trans_handle *trans,
                            u64 bytes_used, u64 type, u64 chunk_offset,
                            u64 size);
-void btrfs_add_raid_kobjects(struct btrfs_fs_info *fs_info);
 struct btrfs_trans_handle *btrfs_start_trans_remove_block_group(
                                 struct btrfs_fs_info *fs_info,
                                 const u64 chunk_offset);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 5f7ee70b3d1a..97beb351a10c 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2683,8 +2683,6 @@ int open_ctree(struct super_block *sb,
         INIT_LIST_HEAD(&fs_info->delayed_iputs);
         INIT_LIST_HEAD(&fs_info->delalloc_roots);
         INIT_LIST_HEAD(&fs_info->caching_block_groups);
-        INIT_LIST_HEAD(&fs_info->pending_raid_kobjs);
-        spin_lock_init(&fs_info->pending_raid_kobjs_lock);
         spin_lock_init(&fs_info->delalloc_root_lock);
         spin_lock_init(&fs_info->trans_lock);
         spin_lock_init(&fs_info->fs_roots_radix_lock);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index d3b58e388535..8b7eb22d508a 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4,6 +4,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/sched/mm.h>
 #include <linux/sched/signal.h>
 #include <linux/pagemap.h>
 #include <linux/writeback.h>
@@ -7888,33 +7889,6 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
         return 0;
 }
 
-/* link_block_group will queue up kobjects to add when we're reclaim-safe */
-void btrfs_add_raid_kobjects(struct btrfs_fs_info *fs_info)
-{
-        struct btrfs_space_info *space_info;
-        struct raid_kobject *rkobj;
-        LIST_HEAD(list);
-        int ret = 0;
-
-        spin_lock(&fs_info->pending_raid_kobjs_lock);
-        list_splice_init(&fs_info->pending_raid_kobjs, &list);
-        spin_unlock(&fs_info->pending_raid_kobjs_lock);
-
-        list_for_each_entry(rkobj, &list, list) {
-                space_info = btrfs_find_space_info(fs_info, rkobj->flags);
-
-                ret = kobject_add(&rkobj->kobj, &space_info->kobj,
-                                "%s", btrfs_bg_type_to_raid_name(rkobj->flags));
-                if (ret) {
-                        kobject_put(&rkobj->kobj);
-                        break;
-                }
-        }
-        if (ret)
-                btrfs_warn(fs_info,
-                           "failed to add kobject for block cache, ignoring");
-}
-
 static void link_block_group(struct btrfs_block_group_cache *cache)
 {
         struct btrfs_space_info *space_info = cache->space_info;
@@ -7929,18 +7903,36 @@ static void link_block_group(struct btrfs_block_group_cache *cache)
         up_write(&space_info->groups_sem);
 
         if (first) {
-                struct raid_kobject *rkobj = kzalloc(sizeof(*rkobj), GFP_NOFS);
+                struct raid_kobject *rkobj;
+                unsigned int nofs_flag;
+                int ret;
+
+                /*
+                 * Setup a NOFS context because kobject_add(), deep in its call
+                 * chain, does GFP_KERNEL allocations, and we are often called
+                 * in a context where if reclaim is triggered we can deadlock
+                 * (we are either holding a transaction handle or some lock
+                 * required for a transaction commit).
+                 */
+                nofs_flag = memalloc_nofs_save();
+                rkobj = kzalloc(sizeof(*rkobj), GFP_KERNEL);
                 if (!rkobj) {
+                        memalloc_nofs_restore(nofs_flag);
                         btrfs_warn(cache->fs_info,
                                 "couldn't alloc memory for raid level kobject");
                         return;
                 }
                 rkobj->flags = cache->flags;
                 kobject_init(&rkobj->kobj, &btrfs_raid_ktype);
-
-                spin_lock(&fs_info->pending_raid_kobjs_lock);
-                list_add_tail(&rkobj->list, &fs_info->pending_raid_kobjs);
-                spin_unlock(&fs_info->pending_raid_kobjs_lock);
+                ret = kobject_add(&rkobj->kobj, &space_info->kobj, "%s",
+                                  btrfs_bg_type_to_raid_name(rkobj->flags));
+                memalloc_nofs_restore(nofs_flag);
+                if (ret) {
+                        kobject_put(&rkobj->kobj);
+                        btrfs_warn(fs_info,
+                           "failed to add kobject for block cache, ignoring");
+                        return;
+                }
                 space_info->block_group_kobjs[index] = &rkobj->kobj;
         }
 }
@@ -8206,7 +8198,6 @@ int btrfs_read_block_groups(struct btrfs_fs_info *info)
                         inc_block_group_ro(cache, 1);
         }
 
-        btrfs_add_raid_kobjects(info);
         btrfs_init_global_block_rsv(info);
         ret = check_chunk_block_group_mappings(info);
 error:
@@ -8975,6 +8966,7 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
         struct btrfs_device *device;
         struct list_head *devices;
         u64 group_trimmed;
+        u64 range_end = U64_MAX;
         u64 start;
         u64 end;
         u64 trimmed = 0;
@@ -8984,16 +8976,23 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
         int dev_ret = 0;
         int ret = 0;
 
+        /*
+         * Check range overflow if range->len is set.
+         * The default range->len is U64_MAX.
+         */
+        if (range->len != U64_MAX &&
+            check_add_overflow(range->start, range->len, &range_end))
+                return -EINVAL;
+
         cache = btrfs_lookup_first_block_group(fs_info, range->start);
         for (; cache; cache = next_block_group(cache)) {
-                if (cache->key.objectid >= (range->start + range->len)) {
+                if (cache->key.objectid >= range_end) {
                         btrfs_put_block_group(cache);
                         break;
                 }
 
                 start = max(range->start, cache->key.objectid);
-                end = min(range->start + range->len,
-                                cache->key.objectid + cache->key.offset);
+                end = min(range_end, cache->key.objectid + cache->key.offset);
 
                 if (end - start >= range->minlen) {
                         if (!block_group_cache_done(cache)) {
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index d74b74ca07af..a447d3ec48d5 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3087,16 +3087,6 @@ static int btrfs_relocate_chunk(struct btrfs_fs_info *fs_info, u64 chunk_offset)
         if (ret)
                 return ret;
 
-        /*
-         * We add the kobjects here (and after forcing data chunk creation)
-         * since relocation is the only place we'll create chunks of a new
-         * type at runtime.  The only place where we'll remove the last
-         * chunk of a type is the call immediately below this one.  Even
-         * so, we're protected against races with the cleaner thread since
-         * we're covered by the delete_unused_bgs_mutex.
-         */
-        btrfs_add_raid_kobjects(fs_info);
-
         trans = btrfs_start_trans_remove_block_group(root->fs_info,
                                                      chunk_offset);
         if (IS_ERR(trans)) {
@@ -3223,9 +3213,6 @@ static int btrfs_may_alloc_data_chunk(struct btrfs_fs_info *fs_info,
                         btrfs_end_transaction(trans);
                         if (ret < 0)
                                 return ret;
-
-                        btrfs_add_raid_kobjects(fs_info);
-
                         return 1;
                 }
         }
diff --git a/fs/io_uring.c b/fs/io_uring.c
index d542f1cf4428..24bbe3cb7ad4 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1097,10 +1097,8 @@ static int io_import_fixed(struct io_ring_ctx *ctx, int rw,
 
                         iter->bvec = bvec + seg_skip;
                         iter->nr_segs -= seg_skip;
-                        iter->count -= (seg_skip << PAGE_SHIFT);
+                        iter->count -= bvec->bv_len + offset;
                         iter->iov_offset = offset & ~PAGE_MASK;
-                        if (iter->iov_offset)
-                                iter->count -= iter->iov_offset;
                 }
         }
 
@@ -2025,6 +2023,15 @@ static int io_queue_sqe(struct io_ring_ctx *ctx, struct io_kiocb *req,
 {
         int ret;
 
+        ret = io_req_defer(ctx, req, s->sqe);
+        if (ret) {
+                if (ret != -EIOCBQUEUED) {
+                        io_free_req(req);
+                        io_cqring_add_event(ctx, s->sqe->user_data, ret);
+                }
+                return 0;
+        }
+
         ret = __io_submit_sqe(ctx, req, s, true);
         if (ret == -EAGAIN && !(req->flags & REQ_F_NOWAIT)) {
                 struct io_uring_sqe *sqe_copy;
@@ -2097,13 +2104,6 @@ err:
                 return;
         }
 
-        ret = io_req_defer(ctx, req, s->sqe);
-        if (ret) {
-                if (ret != -EIOCBQUEUED)
-                        goto err_req;
-                return;
-        }
-
         /*
          * If we already have a head request, queue this one for async
          * submittal once the head completes. If we don't have a head but
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 04f09689cd6d..1600034a929b 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -119,6 +119,7 @@ static int traverse(struct seq_file *m, loff_t offset)
                 }
                 if (seq_has_overflowed(m))
                         goto Eoverflow;
+                p = m->op->next(m, p, &m->index);
                 if (pos + m->count > offset) {
                         m->from = offset - pos;
                         m->count -= m->from;
@@ -126,7 +127,6 @@ static int traverse(struct seq_file *m, loff_t offset)
                 }
                 pos += m->count;
                 m->count = 0;
-                p = m->op->next(m, p, &m->index);
                 if (pos == offset)
                         break;
         }
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index baf0b72c0a37..07aad70f3931 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -3835,15 +3835,28 @@ xfs_bmapi_read(
         XFS_STATS_INC(mp, xs_blk_mapr);
 
         ifp = XFS_IFORK_PTR(ip, whichfork);
+        if (!ifp) {
+                /* No CoW fork?  Return a hole. */
+                if (whichfork == XFS_COW_FORK) {
+                        mval->br_startoff = bno;
+                        mval->br_startblock = HOLESTARTBLOCK;
+                        mval->br_blockcount = len;
+                        mval->br_state = XFS_EXT_NORM;
+                        *nmap = 1;
+                        return 0;
+                }
 
-        /* No CoW fork?  Return a hole. */
-        if (whichfork == XFS_COW_FORK && !ifp) {
-                mval->br_startoff = bno;
-                mval->br_startblock = HOLESTARTBLOCK;
-                mval->br_blockcount = len;
-                mval->br_state = XFS_EXT_NORM;
-                *nmap = 1;
-                return 0;
+                /*
+                 * A missing attr ifork implies that the inode says we're in
+                 * extents or btree format but failed to pass the inode fork
+                 * verifier while trying to load it.  Treat that as a file
+                 * corruption too.
+                 */
+#ifdef DEBUG
+                xfs_alert(mp, "%s: inode %llu missing fork %d",
+                                __func__, ip->i_ino, whichfork);
+#endif /* DEBUG */
+                return -EFSCORRUPTED;
         }
 
         if (!(ifp->if_flags & XFS_IFEXTENTS)) {
diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c
index d1c77fd0815d..0bf56e94bfe9 100644
--- a/fs/xfs/libxfs/xfs_da_btree.c
+++ b/fs/xfs/libxfs/xfs_da_btree.c
@@ -487,10 +487,8 @@ xfs_da3_split(
         ASSERT(state->path.active == 0);
         oldblk = &state->path.blk[0];
         error = xfs_da3_root_split(state, oldblk, addblk);
-        if (error) {
-                addblk->bp = NULL;
-                return error;   /* GROT: dir is inconsistent */
-        }
+        if (error)
+                goto out;
 
         /*
          * Update pointers to the node which used to be block 0 and just got
@@ -505,7 +503,10 @@ xfs_da3_split(
          */
         node = oldblk->bp->b_addr;
         if (node->hdr.info.forw) {
-                ASSERT(be32_to_cpu(node->hdr.info.forw) == addblk->blkno);
+                if (be32_to_cpu(node->hdr.info.forw) != addblk->blkno) {
+                        error = -EFSCORRUPTED;
+                        goto out;
+                }
                 node = addblk->bp->b_addr;
                 node->hdr.info.back = cpu_to_be32(oldblk->blkno);
                 xfs_trans_log_buf(state->args->trans, addblk->bp,
@@ -514,15 +515,19 @@ xfs_da3_split(
         }
         node = oldblk->bp->b_addr;
         if (node->hdr.info.back) {
-                ASSERT(be32_to_cpu(node->hdr.info.back) == addblk->blkno);
+                if (be32_to_cpu(node->hdr.info.back) != addblk->blkno) {
+                        error = -EFSCORRUPTED;
+                        goto out;
+                }
                 node = addblk->bp->b_addr;
                 node->hdr.info.forw = cpu_to_be32(oldblk->blkno);
                 xfs_trans_log_buf(state->args->trans, addblk->bp,
                                   XFS_DA_LOGRANGE(node, &node->hdr.info,
                                   sizeof(node->hdr.info)));
         }
+out:
         addblk->bp = NULL;
-        return 0;
+        return error;
 }
 
 /*
diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c
index afcc6642690a..1fc44efc344d 100644
--- a/fs/xfs/libxfs/xfs_dir2_node.c
+++ b/fs/xfs/libxfs/xfs_dir2_node.c
@@ -741,7 +741,8 @@ xfs_dir2_leafn_lookup_for_entry(
         ents = dp->d_ops->leaf_ents_p(leaf);
 
         xfs_dir3_leaf_check(dp, bp);
-        ASSERT(leafhdr.count > 0);
+        if (leafhdr.count <= 0)
+                return -EFSCORRUPTED;
 
         /*
          * Look up the hash value in the leaf entries.
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 00e9f5c388d3..7fc3c1ad36bc 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -429,10 +429,7 @@ xfs_log_reserve(
 
         ASSERT(*ticp == NULL);
         tic = xlog_ticket_alloc(log, unit_bytes, cnt, client, permanent,
-                                KM_SLEEP | KM_MAYFAIL);
-        if (!tic)
-                return -ENOMEM;
-
+                                KM_SLEEP);
         *ticp = tic;
 
         xlog_grant_push_ail(log, tic->t_cnt ? tic->t_unit_res * tic->t_cnt
diff --git a/include/asm-generic/5level-fixup.h b/include/asm-generic/5level-fixup.h
index bb6cb347018c..f6947da70d71 100644
--- a/include/asm-generic/5level-fixup.h
+++ b/include/asm-generic/5level-fixup.h
@@ -19,9 +19,24 @@
 
 #define p4d_alloc(mm, pgd, address)     (pgd)
 #define p4d_offset(pgd, start)          (pgd)
-#define p4d_none(p4d)                   0
-#define p4d_bad(p4d)                    0
-#define p4d_present(p4d)                1
+
+#ifndef __ASSEMBLY__
+static inline int p4d_none(p4d_t p4d)
+{
+        return 0;
+}
+
+static inline int p4d_bad(p4d_t p4d)
+{
+        return 0;
+}
+
+static inline int p4d_present(p4d_t p4d)
+{
+        return 1;
+}
+#endif
+
 #define p4d_ERROR(p4d)                  do { } while (0)
 #define p4d_clear(p4d)                  pgd_clear(p4d)
 #define p4d_val(p4d)                    pgd_val(p4d)
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 1b1fa1557e68..feff3fe4467e 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -311,7 +311,6 @@ enum req_flag_bits {
         __REQ_RAHEAD,           /* read ahead, can fail anytime */
         __REQ_BACKGROUND,       /* background IO */
         __REQ_NOWAIT,           /* Don't wait if request will block */
-        __REQ_NOWAIT_INLINE,    /* Return would-block error inline */
         /*
          * When a shared kthread needs to issue a bio for a cgroup, doing
          * so synchronously can lead to priority inversions as the kthread
@@ -346,7 +345,6 @@ enum req_flag_bits {
 #define REQ_RAHEAD              (1ULL << __REQ_RAHEAD)
 #define REQ_BACKGROUND          (1ULL << __REQ_BACKGROUND)
 #define REQ_NOWAIT              (1ULL << __REQ_NOWAIT)
-#define REQ_NOWAIT_INLINE       (1ULL << __REQ_NOWAIT_INLINE)
 #define REQ_CGROUP_PUNT         (1ULL << __REQ_CGROUP_PUNT)
 
 #define REQ_NOUNMAP             (1ULL << __REQ_NOUNMAP)
@@ -420,13 +418,12 @@ static inline int op_stat_group(unsigned int op)
 
 typedef unsigned int blk_qc_t;
 #define BLK_QC_T_NONE           -1U
-#define BLK_QC_T_EAGAIN         -2U
 #define BLK_QC_T_SHIFT          16
 #define BLK_QC_T_INTERNAL       (1U << 31)
 
 static inline bool blk_qc_t_valid(blk_qc_t cookie)
 {
-        return cookie != BLK_QC_T_NONE && cookie != BLK_QC_T_EAGAIN;
+        return cookie != BLK_QC_T_NONE;
 }
 
 static inline unsigned int blk_qc_t_to_queue_num(blk_qc_t cookie)
diff --git a/include/linux/dma-noncoherent.h b/include/linux/dma-noncoherent.h
index 3813211a9aad..0bff3d7fac92 100644
--- a/include/linux/dma-noncoherent.h
+++ b/include/linux/dma-noncoherent.h
@@ -42,13 +42,18 @@ void arch_dma_free(struct device *dev, size_t size, void *cpu_addr,
                 dma_addr_t dma_addr, unsigned long attrs);
 long arch_dma_coherent_to_pfn(struct device *dev, void *cpu_addr,
                 dma_addr_t dma_addr);
-
-#ifdef CONFIG_ARCH_HAS_DMA_MMAP_PGPROT
 pgprot_t arch_dma_mmap_pgprot(struct device *dev, pgprot_t prot,
                 unsigned long attrs);
+
+#ifdef CONFIG_MMU
+pgprot_t dma_pgprot(struct device *dev, pgprot_t prot, unsigned long attrs);
 #else
-# define arch_dma_mmap_pgprot(dev, prot, attrs) pgprot_noncached(prot)
-#endif
+static inline pgprot_t dma_pgprot(struct device *dev, pgprot_t prot,
+                unsigned long attrs)
+{
+        return prot;    /* no protection bits supported without page tables */
+}
+#endif /* CONFIG_MMU */
 
 #ifdef CONFIG_DMA_NONCOHERENT_CACHE_SYNC
 void arch_dma_cache_sync(struct device *dev, void *vaddr, size_t size,
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index fb07b503dc45..f33881688f42 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -510,22 +510,18 @@ alloc_pages(gfp_t gfp_mask, unsigned int order)
 }
 extern struct page *alloc_pages_vma(gfp_t gfp_mask, int order,
                         struct vm_area_struct *vma, unsigned long addr,
-                        int node, bool hugepage);
-#define alloc_hugepage_vma(gfp_mask, vma, addr, order) \
-        alloc_pages_vma(gfp_mask, order, vma, addr, numa_node_id(), true)
+                        int node);
 #else
 #define alloc_pages(gfp_mask, order) \
                 alloc_pages_node(numa_node_id(), gfp_mask, order)
-#define alloc_pages_vma(gfp_mask, order, vma, addr, node, false)\
-        alloc_pages(gfp_mask, order)
-#define alloc_hugepage_vma(gfp_mask, vma, addr, order) \
+#define alloc_pages_vma(gfp_mask, order, vma, addr, node)\
         alloc_pages(gfp_mask, order)
 #endif
 #define alloc_page(gfp_mask) alloc_pages(gfp_mask, 0)
 #define alloc_page_vma(gfp_mask, vma, addr)                     \
-        alloc_pages_vma(gfp_mask, 0, vma, addr, numa_node_id(), false)
+        alloc_pages_vma(gfp_mask, 0, vma, addr, numa_node_id())
 #define alloc_page_vma_node(gfp_mask, vma, addr, node)          \
-        alloc_pages_vma(gfp_mask, 0, vma, addr, node, false)
+        alloc_pages_vma(gfp_mask, 0, vma, addr, node)
 
 extern unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order);
 extern unsigned long get_zeroed_page(gfp_t gfp_mask);
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 44c41462be33..2cd4359cb38c 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -668,6 +668,7 @@ static inline unsigned long lruvec_page_state_local(struct lruvec *lruvec,
 
 void __mod_lruvec_state(struct lruvec *lruvec, enum node_stat_item idx,
                         int val);
+void __mod_lruvec_slab_state(void *p, enum node_stat_item idx, int val);
 
 static inline void mod_lruvec_state(struct lruvec *lruvec,
                                     enum node_stat_item idx, int val)
@@ -1072,6 +1073,14 @@ static inline void mod_lruvec_page_state(struct page *page,
         mod_node_page_state(page_pgdat(page), idx, val);
 }
 
+static inline void __mod_lruvec_slab_state(void *p, enum node_stat_item idx,
+                                           int val)
+{
+        struct page *page = virt_to_head_page(p);
+
+        __mod_node_page_state(page_pgdat(page), idx, val);
+}
+
 static inline
 unsigned long mem_cgroup_soft_limit_reclaim(pg_data_t *pgdat, int order,
                                             gfp_t gfp_mask,
@@ -1159,6 +1168,16 @@ static inline void __dec_lruvec_page_state(struct page *page,
         __mod_lruvec_page_state(page, idx, -1);
 }
 
+static inline void __inc_lruvec_slab_state(void *p, enum node_stat_item idx)
+{
+        __mod_lruvec_slab_state(p, idx, 1);
+}
+
+static inline void __dec_lruvec_slab_state(void *p, enum node_stat_item idx)
+{
+        __mod_lruvec_slab_state(p, idx, -1);
+}
+
 /* idx can be of type enum memcg_stat_item or node_stat_item */
 static inline void inc_memcg_state(struct mem_cgroup *memcg,
                                    int idx)
diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
index 5228c62af416..bac395f1d00a 100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -139,6 +139,8 @@ struct mempolicy *mpol_shared_policy_lookup(struct shared_policy *sp,
 struct mempolicy *get_task_policy(struct task_struct *p);
 struct mempolicy *__get_vma_policy(struct vm_area_struct *vma,
                 unsigned long addr);
+struct mempolicy *get_vma_policy(struct vm_area_struct *vma,
+                                                unsigned long addr);
 bool vma_policy_mof(struct vm_area_struct *vma);
 
 extern void numa_default_policy(void);
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 3a37a89eb7a7..6a7a1083b6fb 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -159,7 +159,16 @@ struct page {
                         /** @pgmap: Points to the hosting device page map. */
                         struct dev_pagemap *pgmap;
                         void *zone_device_data;
-                        unsigned long _zd_pad_1;        /* uses mapping */
+                        /*
+                         * ZONE_DEVICE private pages are counted as being
+                         * mapped so the next 3 words hold the mapping, index,
+                         * and private fields from the source anonymous or
+                         * page cache page while the page is migrated to device
+                         * private memory.
+                         * ZONE_DEVICE MEMORY_DEVICE_FS_DAX pages also
+                         * use the mapping, index, and private fields when
+                         * pmem backed DAX files are mapped.
+                         */
                 };
 
                 /** @rcu_head: You can use this to free a page by RCU. */
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 9e700d9f9f28..82e4cd1b7ac3 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1567,8 +1567,10 @@ extern bool pcie_ports_native;
 
 #ifdef CONFIG_PCIEASPM
 bool pcie_aspm_support_enabled(void);
+bool pcie_aspm_enabled(struct pci_dev *pdev);
 #else
 static inline bool pcie_aspm_support_enabled(void) { return false; }
+static inline bool pcie_aspm_enabled(struct pci_dev *pdev) { return false; }
 #endif
 
 #ifdef CONFIG_PCIEAER
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 57f667cad3ec..b548c530f988 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1463,7 +1463,7 @@ typedef void (*usb_complete_t)(struct urb *);
  * field rather than determining a dma address themselves.
  *
  * Note that transfer_buffer must still be set if the controller
- * does not support DMA (as indicated by bus.uses_dma) and when talking
+ * does not support DMA (as indicated by hcd_uses_dma()) and when talking
  * to root hub. If you have to trasfer between highmem zone and the device
  * on such controller, create a bounce buffer or bail out with an error.
  * If transfer_buffer cannot be set (is in highmem) and the controller is DMA
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index bab27ccc8ff5..a20e7815d814 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -422,6 +422,9 @@ static inline bool hcd_periodic_completion_in_progress(struct usb_hcd *hcd,
         return hcd->high_prio_bh.completing_ep == ep;
 }
 
+#define hcd_uses_dma(hcd) \
+        (IS_ENABLED(CONFIG_HAS_DMA) && (hcd)->self.uses_dma)
+
 extern int usb_hcd_link_urb_to_ep(struct usb_hcd *hcd, struct urb *urb);
 extern int usb_hcd_check_unlink_urb(struct usb_hcd *hcd, struct urb *urb,
                 int status);
diff --git a/include/uapi/rdma/siw-abi.h b/include/uapi/rdma/siw-abi.h
index 7de68f1dc707..af735f55b291 100644
--- a/include/uapi/rdma/siw-abi.h
+++ b/include/uapi/rdma/siw-abi.h
@@ -180,6 +180,7 @@ struct siw_cqe {
  * to control CQ arming.
  */
 struct siw_cq_ctrl {
-        __aligned_u64 notify;
+        __u32 flags;
+        __u32 pad;
 };
 #endif
diff --git a/kernel/configs.c b/kernel/configs.c
index b062425ccf8d..c09ea4c995e1 100644
--- a/kernel/configs.c
+++ b/kernel/configs.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
 /*
  * kernel/configs.c
  * Echo the kernel .config file used to build the kernel
@@ -6,21 +7,6 @@
  * Copyright (C) 2002 Randy Dunlap <rdunlap@xenotime.net>
  * Copyright (C) 2002 Al Stone <ahs3@fc.hp.com>
  * Copyright (C) 2002 Hewlett-Packard Company
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
- * NON INFRINGEMENT.  See the GNU General Public License for more
- * details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 #include <linux/kernel.h>
diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c
index 59bdceea3737..795c9b095d75 100644
--- a/kernel/dma/direct.c
+++ b/kernel/dma/direct.c
@@ -47,9 +47,6 @@ u64 dma_direct_get_required_mask(struct device *dev)
 {
         u64 max_dma = phys_to_dma_direct(dev, (max_pfn - 1) << PAGE_SHIFT);
 
-        if (dev->bus_dma_mask && dev->bus_dma_mask < max_dma)
-                max_dma = dev->bus_dma_mask;
-
         return (1ULL << (fls64(max_dma) - 1)) * 2 - 1;
 }
 
@@ -130,10 +127,12 @@ void *dma_direct_alloc_pages(struct device *dev, size_t size,
         if (!page)
                 return NULL;
 
-        if (attrs & DMA_ATTR_NO_KERNEL_MAPPING) {
+        if ((attrs & DMA_ATTR_NO_KERNEL_MAPPING) &&
+            !force_dma_unencrypted(dev)) {
                 /* remove any dirty cache lines on the kernel alias */
                 if (!PageHighMem(page))
                         arch_dma_prep_coherent(page, size);
+                *dma_handle = phys_to_dma(dev, page_to_phys(page));
                 /* return the page pointer as the opaque cookie */
                 return page;
         }
@@ -178,7 +177,8 @@ void dma_direct_free_pages(struct device *dev, size_t size, void *cpu_addr,
 {
         unsigned int page_order = get_order(size);
 
-        if (attrs & DMA_ATTR_NO_KERNEL_MAPPING) {
+        if ((attrs & DMA_ATTR_NO_KERNEL_MAPPING) &&
+            !force_dma_unencrypted(dev)) {
                 /* cpu_addr is a struct page cookie, not a kernel address */
                 __dma_direct_free_pages(dev, size, cpu_addr);
                 return;
diff --git a/kernel/dma/mapping.c b/kernel/dma/mapping.c
index b945239621d8..b0038ca3aa92 100644
--- a/kernel/dma/mapping.c
+++ b/kernel/dma/mapping.c
@@ -150,6 +150,23 @@ int dma_get_sgtable_attrs(struct device *dev, struct sg_table *sgt,
 }
 EXPORT_SYMBOL(dma_get_sgtable_attrs);
 
+#ifdef CONFIG_MMU
+/*
+ * Return the page attributes used for mapping dma_alloc_* memory, either in
+ * kernel space if remapping is needed, or to userspace through dma_mmap_*.
+ */
+pgprot_t dma_pgprot(struct device *dev, pgprot_t prot, unsigned long attrs)
+{
+        if (dev_is_dma_coherent(dev) ||
+            (IS_ENABLED(CONFIG_DMA_NONCOHERENT_CACHE_SYNC) &&
+             (attrs & DMA_ATTR_NON_CONSISTENT)))
+                return prot;
+        if (IS_ENABLED(CONFIG_ARCH_HAS_DMA_MMAP_PGPROT))
+                return arch_dma_mmap_pgprot(dev, prot, attrs);
+        return pgprot_noncached(prot);
+}
+#endif /* CONFIG_MMU */
+
 /*
  * Create userspace mapping for the DMA-coherent memory.
  */
@@ -164,7 +181,7 @@ int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
         unsigned long pfn;
         int ret = -ENXIO;
 
-        vma->vm_page_prot = arch_dma_mmap_pgprot(dev, vma->vm_page_prot, attrs);
+        vma->vm_page_prot = dma_pgprot(dev, vma->vm_page_prot, attrs);
 
         if (dma_mmap_from_dev_coherent(dev, vma, cpu_addr, size, &ret))
                 return ret;
diff --git a/kernel/dma/remap.c b/kernel/dma/remap.c
index a594aec07882..ffe78f0b2fe4 100644
--- a/kernel/dma/remap.c
+++ b/kernel/dma/remap.c
@@ -218,7 +218,7 @@ void *arch_dma_alloc(struct device *dev, size_t size, dma_addr_t *dma_handle,
 
         /* create a coherent mapping */
         ret = dma_common_contiguous_remap(page, size, VM_USERMAP,
-                        arch_dma_mmap_pgprot(dev, PAGE_KERNEL, attrs),
+                        dma_pgprot(dev, PAGE_KERNEL, attrs),
                         __builtin_return_address(0));
         if (!ret) {
                 __dma_direct_free_pages(dev, size, page);
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 636ca6f88c8e..867b4bb6d4be 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -40,6 +40,7 @@ struct sugov_policy {
         struct task_struct      *thread;
         bool                    work_in_progress;
 
+        bool                    limits_changed;
         bool                    need_freq_update;
 };
 
@@ -89,8 +90,11 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)
             !cpufreq_this_cpu_can_update(sg_policy->policy))
                 return false;
 
-        if (unlikely(sg_policy->need_freq_update))
+        if (unlikely(sg_policy->limits_changed)) {
+                sg_policy->limits_changed = false;
+                sg_policy->need_freq_update = true;
                 return true;
+        }
 
         delta_ns = time - sg_policy->last_freq_update_time;
 
@@ -437,7 +441,7 @@ static inline bool sugov_cpu_is_busy(struct sugov_cpu *sg_cpu) { return false; }
 static inline void ignore_dl_rate_limit(struct sugov_cpu *sg_cpu, struct sugov_policy *sg_policy)
 {
         if (cpu_bw_dl(cpu_rq(sg_cpu->cpu)) > sg_cpu->bw_dl)
-                sg_policy->need_freq_update = true;
+                sg_policy->limits_changed = true;
 }
 
 static void sugov_update_single(struct update_util_data *hook, u64 time,
@@ -457,7 +461,8 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
         if (!sugov_should_update_freq(sg_policy, time))
                 return;
 
-        busy = sugov_cpu_is_busy(sg_cpu);
+        /* Limits may have changed, don't skip frequency update */
+        busy = !sg_policy->need_freq_update && sugov_cpu_is_busy(sg_cpu);
 
         util = sugov_get_util(sg_cpu);
         max = sg_cpu->max;
@@ -831,6 +836,7 @@ static int sugov_start(struct cpufreq_policy *policy)
         sg_policy->last_freq_update_time        = 0;
         sg_policy->next_freq                    = 0;
         sg_policy->work_in_progress             = false;
+        sg_policy->limits_changed               = false;
         sg_policy->need_freq_update             = false;
         sg_policy->cached_raw_freq              = 0;
 
@@ -879,7 +885,7 @@ static void sugov_limits(struct cpufreq_policy *policy)
                 mutex_unlock(&sg_policy->work_lock);
         }
 
-        sg_policy->need_freq_update = true;
+        sg_policy->limits_changed = true;
 }
 
 struct cpufreq_governor schedutil_gov = {
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 1334ede667a8..738065f765ab 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -644,30 +644,40 @@ release:
  *          available
  * never: never stall for any thp allocation
  */
-static inline gfp_t alloc_hugepage_direct_gfpmask(struct vm_area_struct *vma)
+static inline gfp_t alloc_hugepage_direct_gfpmask(struct vm_area_struct *vma, unsigned long addr)
 {
         const bool vma_madvised = !!(vma->vm_flags & VM_HUGEPAGE);
+        gfp_t this_node = 0;
+
+#ifdef CONFIG_NUMA
+        struct mempolicy *pol;
+        /*
+         * __GFP_THISNODE is used only when __GFP_DIRECT_RECLAIM is not
+         * specified, to express a general desire to stay on the current
+         * node for optimistic allocation attempts. If the defrag mode
+         * and/or madvise hint requires the direct reclaim then we prefer
+         * to fallback to other node rather than node reclaim because that
+         * can lead to excessive reclaim even though there is free memory
+         * on other nodes. We expect that NUMA preferences are specified
+         * by memory policies.
+         */
+        pol = get_vma_policy(vma, addr);
+        if (pol->mode != MPOL_BIND)
+                this_node = __GFP_THISNODE;
+        mpol_cond_put(pol);
+#endif
 
-        /* Always do synchronous compaction */
         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags))
                 return GFP_TRANSHUGE | (vma_madvised ? 0 : __GFP_NORETRY);
-
-        /* Kick kcompactd and fail quickly */
         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags))
-                return GFP_TRANSHUGE_LIGHT | __GFP_KSWAPD_RECLAIM;
-
-        /* Synchronous compaction if madvised, otherwise kick kcompactd */
+                return GFP_TRANSHUGE_LIGHT | __GFP_KSWAPD_RECLAIM | this_node;
         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags))
-                return GFP_TRANSHUGE_LIGHT |
-                        (vma_madvised ? __GFP_DIRECT_RECLAIM :
-                                        __GFP_KSWAPD_RECLAIM);
-
-        /* Only do synchronous compaction if madvised */
+                return GFP_TRANSHUGE_LIGHT | (vma_madvised ? __GFP_DIRECT_RECLAIM :
+                                                             __GFP_KSWAPD_RECLAIM | this_node);
         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags))
-                return GFP_TRANSHUGE_LIGHT |
-                       (vma_madvised ? __GFP_DIRECT_RECLAIM : 0);
-
-        return GFP_TRANSHUGE_LIGHT;
+                return GFP_TRANSHUGE_LIGHT | (vma_madvised ? __GFP_DIRECT_RECLAIM :
+                                                             this_node);
+        return GFP_TRANSHUGE_LIGHT | this_node;
 }
 
 /* Caller must hold page table lock. */
@@ -739,8 +749,8 @@ vm_fault_t do_huge_pmd_anonymous_page(struct vm_fault *vmf)
                         pte_free(vma->vm_mm, pgtable);
                 return ret;
         }
-        gfp = alloc_hugepage_direct_gfpmask(vma);
-        page = alloc_hugepage_vma(gfp, vma, haddr, HPAGE_PMD_ORDER);
+        gfp = alloc_hugepage_direct_gfpmask(vma, haddr);
+        page = alloc_pages_vma(gfp, HPAGE_PMD_ORDER, vma, haddr, numa_node_id());
         if (unlikely(!page)) {
                 count_vm_event(THP_FAULT_FALLBACK);
                 return VM_FAULT_FALLBACK;
@@ -1347,8 +1357,9 @@ vm_fault_t do_huge_pmd_wp_page(struct vm_fault *vmf, pmd_t orig_pmd)
 alloc:
         if (__transparent_hugepage_enabled(vma) &&
             !transparent_hugepage_debug_cow()) {
-                huge_gfp = alloc_hugepage_direct_gfpmask(vma);
-                new_page = alloc_hugepage_vma(huge_gfp, vma, haddr, HPAGE_PMD_ORDER);
+                huge_gfp = alloc_hugepage_direct_gfpmask(vma, haddr);
+                new_page = alloc_pages_vma(huge_gfp, HPAGE_PMD_ORDER, vma,
+                                haddr, numa_node_id());
         } else
                 new_page = NULL;
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ede7e7f5d1ab..6d7296dd11b8 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3856,6 +3856,25 @@ retry:
 
                 page = alloc_huge_page(vma, haddr, 0);
                 if (IS_ERR(page)) {
+                        /*
+                         * Returning error will result in faulting task being
+                         * sent SIGBUS.  The hugetlb fault mutex prevents two
+                         * tasks from racing to fault in the same page which
+                         * could result in false unable to allocate errors.
+                         * Page migration does not take the fault mutex, but
+                         * does a clear then write of pte's under page table
+                         * lock.  Page fault code could race with migration,
+                         * notice the clear pte and try to allocate a page
+                         * here.  Before returning error, get ptl and make
+                         * sure there really is no pte entry.
+                         */
+                        ptl = huge_pte_lock(h, mm, ptep);
+                        if (!huge_pte_none(huge_ptep_get(ptep))) {
+                                ret = 0;
+                                spin_unlock(ptl);
+                                goto out;
+                        }
+                        spin_unlock(ptl);
                         ret = vmf_error(PTR_ERR(page));
                         goto out;
                 }
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 6e9e8cca663e..f6e602918dac 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1966,6 +1966,7 @@ static void kmemleak_disable(void)
 
         /* stop any memory operation tracing */
         kmemleak_enabled = 0;
+        kmemleak_early_log = 0;
 
         /* check whether it is too early for a kernel thread */
         if (kmemleak_initialized)
@@ -2009,7 +2010,6 @@ void __init kmemleak_init(void)
 
 #ifdef CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF
         if (!kmemleak_skip_disable) {
-                kmemleak_early_log = 0;
                 kmemleak_disable();
                 return;
         }
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index cdbb7a84cb6e..6f5c0c517c49 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -768,6 +768,26 @@ void __mod_lruvec_state(struct lruvec *lruvec, enum node_stat_item idx,
         __this_cpu_write(pn->lruvec_stat_cpu->count[idx], x);
 }
 
+void __mod_lruvec_slab_state(void *p, enum node_stat_item idx, int val)
+{
+        struct page *page = virt_to_head_page(p);
+        pg_data_t *pgdat = page_pgdat(page);
+        struct mem_cgroup *memcg;
+        struct lruvec *lruvec;
+
+        rcu_read_lock();
+        memcg = memcg_from_slab_page(page);
+
+        /* Untracked pages have no memcg, no lruvec. Update only the node */
+        if (!memcg || memcg == root_mem_cgroup) {
+                __mod_node_page_state(pgdat, idx, val);
+        } else {
+                lruvec = mem_cgroup_lruvec(pgdat, memcg);
+                __mod_lruvec_state(lruvec, idx, val);
+        }
+        rcu_read_unlock();
+}
+
 /**
  * __count_memcg_events - account VM events in a cgroup
  * @memcg: the memory cgroup
@@ -1130,26 +1150,45 @@ void mem_cgroup_iter_break(struct mem_cgroup *root,
                 css_put(&prev->css);
 }
 
-static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
+static void __invalidate_reclaim_iterators(struct mem_cgroup *from,
+                                        struct mem_cgroup *dead_memcg)
 {
-        struct mem_cgroup *memcg = dead_memcg;
         struct mem_cgroup_reclaim_iter *iter;
         struct mem_cgroup_per_node *mz;
         int nid;
         int i;
 
-        for (; memcg; memcg = parent_mem_cgroup(memcg)) {
-                for_each_node(nid) {
-                        mz = mem_cgroup_nodeinfo(memcg, nid);
-                        for (i = 0; i <= DEF_PRIORITY; i++) {
-                                iter = &mz->iter[i];
-                                cmpxchg(&iter->position,
-                                        dead_memcg, NULL);
-                        }
+        for_each_node(nid) {
+                mz = mem_cgroup_nodeinfo(from, nid);
+                for (i = 0; i <= DEF_PRIORITY; i++) {
+                        iter = &mz->iter[i];
+                        cmpxchg(&iter->position,
+                                dead_memcg, NULL);
                 }
         }
 }
 
+static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
+{
+        struct mem_cgroup *memcg = dead_memcg;
+        struct mem_cgroup *last;
+
+        do {
+                __invalidate_reclaim_iterators(memcg, dead_memcg);
+                last = memcg;
+        } while ((memcg = parent_mem_cgroup(memcg)));
+
+        /*
+         * When cgruop1 non-hierarchy mode is used,
+         * parent_mem_cgroup() does not walk all the way up to the
+         * cgroup root (root_mem_cgroup). So we have to handle
+         * dead_memcg from cgroup root separately.
+         */
+        if (last != root_mem_cgroup)
+                __invalidate_reclaim_iterators(root_mem_cgroup,
+                                                dead_memcg);
+}
+
 /**
  * mem_cgroup_scan_tasks - iterate over tasks of a memory cgroup hierarchy
  * @memcg: hierarchy root
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index f48693f75b37..65e0874fce17 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -403,7 +403,7 @@ static const struct mempolicy_operations mpol_ops[MPOL_MAX] = {
         },
 };
 
-static void migrate_page_add(struct page *page, struct list_head *pagelist,
+static int migrate_page_add(struct page *page, struct list_head *pagelist,
                                 unsigned long flags);
 
 struct queue_pages {
@@ -429,11 +429,14 @@ static inline bool queue_pages_required(struct page *page,
 }
 
 /*
- * queue_pages_pmd() has three possible return values:
- * 1 - pages are placed on the right node or queued successfully.
- * 0 - THP was split.
- * -EIO - is migration entry or MPOL_MF_STRICT was specified and an existing
- *        page was already on a node that does not follow the policy.
+ * queue_pages_pmd() has four possible return values:
+ * 0 - pages are placed on the right node or queued successfully.
+ * 1 - there is unmovable page, and MPOL_MF_MOVE* & MPOL_MF_STRICT were
+ *     specified.
+ * 2 - THP was split.
+ * -EIO - is migration entry or only MPOL_MF_STRICT was specified and an
+ *        existing page was already on a node that does not follow the
+ *        policy.
  */
 static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
                                 unsigned long end, struct mm_walk *walk)
@@ -451,23 +454,20 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
         if (is_huge_zero_page(page)) {
                 spin_unlock(ptl);
                 __split_huge_pmd(walk->vma, pmd, addr, false, NULL);
+                ret = 2;
                 goto out;
         }
-        if (!queue_pages_required(page, qp)) {
-                ret = 1;
+        if (!queue_pages_required(page, qp))
                 goto unlock;
-        }
 
-        ret = 1;
         flags = qp->flags;
         /* go to thp migration */
         if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
-                if (!vma_migratable(walk->vma)) {
-                        ret = -EIO;
+                if (!vma_migratable(walk->vma) ||
+                    migrate_page_add(page, qp->pagelist, flags)) {
+                        ret = 1;
                         goto unlock;
                 }
-
-                migrate_page_add(page, qp->pagelist, flags);
         } else
                 ret = -EIO;
 unlock:
@@ -479,6 +479,13 @@ out:
 /*
  * Scan through pages checking if pages follow certain conditions,
  * and move them to the pagelist if they do.
+ *
+ * queue_pages_pte_range() has three possible return values:
+ * 0 - pages are placed on the right node or queued successfully.
+ * 1 - there is unmovable page, and MPOL_MF_MOVE* & MPOL_MF_STRICT were
+ *     specified.
+ * -EIO - only MPOL_MF_STRICT was specified and an existing page was already
+ *        on a node that does not follow the policy.
  */
 static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
                         unsigned long end, struct mm_walk *walk)
@@ -488,17 +495,17 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
         struct queue_pages *qp = walk->private;
         unsigned long flags = qp->flags;
         int ret;
+        bool has_unmovable = false;
         pte_t *pte;
         spinlock_t *ptl;
 
         ptl = pmd_trans_huge_lock(pmd, vma);
         if (ptl) {
                 ret = queue_pages_pmd(pmd, ptl, addr, end, walk);
-                if (ret > 0)
-                        return 0;
-                else if (ret < 0)
+                if (ret != 2)
                         return ret;
         }
+        /* THP was split, fall through to pte walk */
 
         if (pmd_trans_unstable(pmd))
                 return 0;
@@ -519,14 +526,28 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
                 if (!queue_pages_required(page, qp))
                         continue;
                 if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
-                        if (!vma_migratable(vma))
+                        /* MPOL_MF_STRICT must be specified if we get here */
+                        if (!vma_migratable(vma)) {
+                                has_unmovable = true;
                                 break;
-                        migrate_page_add(page, qp->pagelist, flags);
+                        }
+
+                        /*
+                         * Do not abort immediately since there may be
+                         * temporary off LRU pages in the range.  Still
+                         * need migrate other LRU pages.
+                         */
+                        if (migrate_page_add(page, qp->pagelist, flags))
+                                has_unmovable = true;
                 } else
                         break;
         }
         pte_unmap_unlock(pte - 1, ptl);
         cond_resched();
+
+        if (has_unmovable)
+                return 1;
+
         return addr != end ? -EIO : 0;
 }
 
@@ -639,7 +660,13 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end,
  *
  * If pages found in a given range are on a set of nodes (determined by
  * @nodes and @flags,) it's isolated and queued to the pagelist which is
- * passed via @private.)
+ * passed via @private.
+ *
+ * queue_pages_range() has three possible return values:
+ * 1 - there is unmovable page, but MPOL_MF_MOVE* & MPOL_MF_STRICT were
+ *     specified.
+ * 0 - queue pages successfully or no misplaced page.
+ * -EIO - there is misplaced page and only MPOL_MF_STRICT was specified.
  */
 static int
 queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
@@ -940,7 +967,7 @@ static long do_get_mempolicy(int *policy, nodemask_t *nmask,
 /*
  * page migration, thp tail pages can be passed.
  */
-static void migrate_page_add(struct page *page, struct list_head *pagelist,
+static int migrate_page_add(struct page *page, struct list_head *pagelist,
                                 unsigned long flags)
 {
         struct page *head = compound_head(page);
@@ -953,8 +980,19 @@ static void migrate_page_add(struct page *page, struct list_head *pagelist,
                         mod_node_page_state(page_pgdat(head),
                                 NR_ISOLATED_ANON + page_is_file_cache(head),
                                 hpage_nr_pages(head));
+                } else if (flags & MPOL_MF_STRICT) {
+                        /*
+                         * Non-movable page may reach here.  And, there may be
+                         * temporary off LRU pages or non-LRU movable pages.
+                         * Treat them as unmovable pages since they can't be
+                         * isolated, so they can't be moved at the moment.  It
+                         * should return -EIO for this case too.
+                         */
+                        return -EIO;
                 }
         }
+
+        return 0;
 }
 
 /* page allocation callback for NUMA node migration */
@@ -1142,8 +1180,8 @@ static struct page *new_page(struct page *page, unsigned long start)
         } else if (PageTransHuge(page)) {
                 struct page *thp;
 
-                thp = alloc_hugepage_vma(GFP_TRANSHUGE, vma, address,
-                                         HPAGE_PMD_ORDER);
+                thp = alloc_pages_vma(GFP_TRANSHUGE, HPAGE_PMD_ORDER, vma,
+                                address, numa_node_id());
                 if (!thp)
                         return NULL;
                 prep_transhuge_page(thp);
@@ -1157,9 +1195,10 @@ static struct page *new_page(struct page *page, unsigned long start)
 }
 #else
 
-static void migrate_page_add(struct page *page, struct list_head *pagelist,
+static int migrate_page_add(struct page *page, struct list_head *pagelist,
                                 unsigned long flags)
 {
+        return -EIO;
 }
 
 int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from,
@@ -1182,6 +1221,7 @@ static long do_mbind(unsigned long start, unsigned long len,
         struct mempolicy *new;
         unsigned long end;
         int err;
+        int ret;
         LIST_HEAD(pagelist);
 
         if (flags & ~(unsigned long)MPOL_MF_VALID)
@@ -1243,10 +1283,15 @@ static long do_mbind(unsigned long start, unsigned long len,
         if (err)
                 goto mpol_out;
 
-        err = queue_pages_range(mm, start, end, nmask,
+        ret = queue_pages_range(mm, start, end, nmask,
                           flags | MPOL_MF_INVERT, &pagelist);
-        if (!err)
-                err = mbind_range(mm, start, end, new);
+
+        if (ret < 0) {
+                err = -EIO;
+                goto up_out;
+        }
+
+        err = mbind_range(mm, start, end, new);
 
         if (!err) {
                 int nr_failed = 0;
@@ -1259,13 +1304,14 @@ static long do_mbind(unsigned long start, unsigned long len,
                                 putback_movable_pages(&pagelist);
                 }
 
-                if (nr_failed && (flags & MPOL_MF_STRICT))
+                if ((ret > 0) || (nr_failed && (flags & MPOL_MF_STRICT)))
                         err = -EIO;
         } else
                 putback_movable_pages(&pagelist);
 
+up_out:
         up_write(&mm->mmap_sem);
- mpol_out:
+mpol_out:
         mpol_put(new);
         return err;
 }
@@ -1688,7 +1734,7 @@ struct mempolicy *__get_vma_policy(struct vm_area_struct *vma,
  * freeing by another task.  It is the caller's responsibility to free the
  * extra reference for shared policies.
  */
-static struct mempolicy *get_vma_policy(struct vm_area_struct *vma,
+struct mempolicy *get_vma_policy(struct vm_area_struct *vma,
                                                 unsigned long addr)
 {
         struct mempolicy *pol = __get_vma_policy(vma, addr);
@@ -2037,7 +2083,6 @@ static struct page *alloc_page_interleave(gfp_t gfp, unsigned order,
  *      @vma:  Pointer to VMA or NULL if not available.
  *      @addr: Virtual Address of the allocation. Must be inside the VMA.
  *      @node: Which node to prefer for allocation (modulo policy).
- *      @hugepage: for hugepages try only the preferred node if possible
  *
  *      This function allocates a page from the kernel page pool and applies
  *      a NUMA policy associated with the VMA or the current process.
@@ -2048,7 +2093,7 @@ static struct page *alloc_page_interleave(gfp_t gfp, unsigned order,
  */
 struct page *
 alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
-                unsigned long addr, int node, bool hugepage)
+                unsigned long addr, int node)
 {
         struct mempolicy *pol;
         struct page *page;
@@ -2066,31 +2111,6 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
                 goto out;
         }
 
-        if (unlikely(IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && hugepage)) {
-                int hpage_node = node;
-
-                /*
-                 * For hugepage allocation and non-interleave policy which
-                 * allows the current node (or other explicitly preferred
-                 * node) we only try to allocate from the current/preferred
-                 * node and don't fall back to other nodes, as the cost of
-                 * remote accesses would likely offset THP benefits.
-                 *
-                 * If the policy is interleave, or does not allow the current
-                 * node in its nodemask, we allocate the standard way.
-                 */
-                if (pol->mode == MPOL_PREFERRED && !(pol->flags & MPOL_F_LOCAL))
-                        hpage_node = pol->v.preferred_node;
-
-                nmask = policy_nodemask(gfp, pol);
-                if (!nmask || node_isset(hpage_node, *nmask)) {
-                        mpol_cond_put(pol);
-                        page = __alloc_pages_node(hpage_node,
-                                                gfp | __GFP_THISNODE, order);
-                        goto out;
-                }
-        }
-
         nmask = policy_nodemask(gfp, pol);
         preferred_nid = policy_node(gfp, pol, node);
         page = __alloc_pages_nodemask(gfp, order, preferred_nid, nmask);
diff --git a/mm/memremap.c b/mm/memremap.c
index 86432650f829..ed70c4e8e52a 100644
--- a/mm/memremap.c
+++ b/mm/memremap.c
@@ -403,6 +403,30 @@ void __put_devmap_managed_page(struct page *page)
 
                 mem_cgroup_uncharge(page);
 
+                /*
+                 * When a device_private page is freed, the page->mapping field
+                 * may still contain a (stale) mapping value. For example, the
+                 * lower bits of page->mapping may still identify the page as
+                 * an anonymous page. Ultimately, this entire field is just
+                 * stale and wrong, and it will cause errors if not cleared.
+                 * One example is:
+                 *
+                 *  migrate_vma_pages()
+                 *    migrate_vma_insert_page()
+                 *      page_add_new_anon_rmap()
+                 *        __page_set_anon_rmap()
+                 *          ...checks page->mapping, via PageAnon(page) call,
+                 *            and incorrectly concludes that the page is an
+                 *            anonymous page. Therefore, it incorrectly,
+                 *            silently fails to set up the new anon rmap.
+                 *
+                 * For other types of ZONE_DEVICE pages, migration is either
+                 * handled differently or not done at all, so there is no need
+                 * to clear page->mapping.
+                 */
+                if (is_device_private_page(page))
+                        page->mapping = NULL;
+
                 page->pgmap->ops->page_free(page);
         } else if (!count)
                 __put_page(page);
diff --git a/mm/rmap.c b/mm/rmap.c
index e5dfe2ae6b0d..003377e24232 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1475,7 +1475,15 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                         /*
                          * No need to invalidate here it will synchronize on
                          * against the special swap migration pte.
+                         *
+                         * The assignment to subpage above was computed from a
+                         * swap PTE which results in an invalid pointer.
+                         * Since only PAGE_SIZE pages can currently be
+                         * migrated, just set it to page. This will need to be
+                         * changed when hugepage migrations to device private
+                         * memory are supported.
                          */
+                        subpage = page;
                         goto discard;
                 }
 
diff --git a/mm/shmem.c b/mm/shmem.c
index 626d8c74b973..2bed4761f279 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1466,7 +1466,7 @@ static struct page *shmem_alloc_hugepage(gfp_t gfp,
 
         shmem_pseudo_vma_init(&pvma, info, hindex);
         page = alloc_pages_vma(gfp | __GFP_COMP | __GFP_NORETRY | __GFP_NOWARN,
-                        HPAGE_PMD_ORDER, &pvma, 0, numa_node_id(), true);
+                        HPAGE_PMD_ORDER, &pvma, 0, numa_node_id());
         shmem_pseudo_vma_destroy(&pvma);
         if (page)
                 prep_transhuge_page(page);
diff --git a/mm/usercopy.c b/mm/usercopy.c
index 2a09796edef8..98e924864554 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -147,7 +147,7 @@ static inline void check_bogus_address(const unsigned long ptr, unsigned long n,
                                        bool to_user)
 {
         /* Reject if object wraps past end of memory. */
-        if (ptr + n < ptr)
+        if (ptr + (n - 1) < ptr)
                 usercopy_abort("wrapped address", NULL, to_user, 0, ptr + n);
 
         /* Reject if NULL or ZERO-allocation. */
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index e0fc963acc41..7ba11e12a11f 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -3279,9 +3279,19 @@ retry:
                         goto overflow;
 
                 /*
+                 * If required width exeeds current VA block, move
+                 * base downwards and then recheck.
+                 */
+                if (base + end > va->va_end) {
+                        base = pvm_determine_end_from_reverse(&va, align) - end;
+                        term_area = area;
+                        continue;
+                }
+
+                /*
                  * If this VA does not fit, move base downwards and recheck.
                  */
-                if (base + start < va->va_start || base + end > va->va_end) {
+                if (base + start < va->va_start) {
                         va = node_to_va(rb_prev(&va->rb_node));
                         base = pvm_determine_end_from_reverse(&va, align) - end;
                         term_area = area;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index dbdc46a84f63..c77d1e3761a7 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -88,9 +88,6 @@ struct scan_control {
         /* Can pages be swapped as part of reclaim? */
         unsigned int may_swap:1;
 
-        /* e.g. boosted watermark reclaim leaves slabs alone */
-        unsigned int may_shrinkslab:1;
-
         /*
          * Cgroups are not reclaimed below their configured memory.low,
          * unless we threaten to OOM. If any cgroups are skipped due to
@@ -2714,10 +2711,8 @@ static bool shrink_node(pg_data_t *pgdat, struct scan_control *sc)
                         shrink_node_memcg(pgdat, memcg, sc, &lru_pages);
                         node_lru_pages += lru_pages;
 
-                        if (sc->may_shrinkslab) {
-                                shrink_slab(sc->gfp_mask, pgdat->node_id,
-                                    memcg, sc->priority);
-                        }
+                        shrink_slab(sc->gfp_mask, pgdat->node_id, memcg,
+                                        sc->priority);
 
                         /* Record the group's reclaim efficiency */
                         vmpressure(sc->gfp_mask, memcg, false,
@@ -3194,7 +3189,6 @@ unsigned long try_to_free_pages(struct zonelist *zonelist, int order,
                 .may_writepage = !laptop_mode,
                 .may_unmap = 1,
                 .may_swap = 1,
-                .may_shrinkslab = 1,
         };
 
         /*
@@ -3238,7 +3232,6 @@ unsigned long mem_cgroup_shrink_node(struct mem_cgroup *memcg,
                 .may_unmap = 1,
                 .reclaim_idx = MAX_NR_ZONES - 1,
                 .may_swap = !noswap,
-                .may_shrinkslab = 1,
         };
         unsigned long lru_pages;
 
@@ -3286,7 +3279,6 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg,
                 .may_writepage = !laptop_mode,
                 .may_unmap = 1,
                 .may_swap = may_swap,
-                .may_shrinkslab = 1,
         };
 
         set_task_reclaim_state(current, &sc.reclaim_state);
@@ -3598,7 +3590,6 @@ restart:
                  */
                 sc.may_writepage = !laptop_mode && !nr_boost_reclaim;
                 sc.may_swap = !nr_boost_reclaim;
-                sc.may_shrinkslab = !nr_boost_reclaim;
 
                 /*
                  * Do some background aging of the anon list, to give
diff --git a/mm/workingset.c b/mm/workingset.c
index e0b4edcb88c8..c963831d354f 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -380,14 +380,12 @@ void workingset_update_node(struct xa_node *node)
         if (node->count && node->count == node->nr_values) {
                 if (list_empty(&node->private_list)) {
                         list_lru_add(&shadow_nodes, &node->private_list);
-                        __inc_lruvec_page_state(virt_to_page(node),
-                                                WORKINGSET_NODES);
+                        __inc_lruvec_slab_state(node, WORKINGSET_NODES);
                 }
         } else {
                 if (!list_empty(&node->private_list)) {
                         list_lru_del(&shadow_nodes, &node->private_list);
-                        __dec_lruvec_page_state(virt_to_page(node),
-                                                WORKINGSET_NODES);
+                        __dec_lruvec_slab_state(node, WORKINGSET_NODES);
                 }
         }
 }
@@ -480,7 +478,7 @@ static enum lru_status shadow_lru_isolate(struct list_head *item,
         }
 
         list_lru_isolate(lru, item);
-        __dec_lruvec_page_state(virt_to_page(node), WORKINGSET_NODES);
+        __dec_lruvec_slab_state(node, WORKINGSET_NODES);
 
         spin_unlock(lru_lock);
 
@@ -503,7 +501,7 @@ static enum lru_status shadow_lru_isolate(struct list_head *item,
          * shadow entries we were tracking ...
          */
         xas_store(&xas, NULL);
-        __inc_lruvec_page_state(virt_to_page(node), WORKINGSET_NODERECLAIM);
+        __inc_lruvec_slab_state(node, WORKINGSET_NODERECLAIM);
 
 out_invalid:
         xa_unlock_irq(&mapping->i_pages);
diff --git a/mm/z3fold.c b/mm/z3fold.c
index 1a029a7432ee..ed19d98c9dcd 100644
--- a/mm/z3fold.c
+++ b/mm/z3fold.c
@@ -817,9 +817,19 @@ out:
 static void z3fold_destroy_pool(struct z3fold_pool *pool)
 {
         kmem_cache_destroy(pool->c_handle);
-        z3fold_unregister_migration(pool);
-        destroy_workqueue(pool->release_wq);
+
+        /*
+         * We need to destroy pool->compact_wq before pool->release_wq,
+         * as any pending work on pool->compact_wq will call
+         * queue_work(pool->release_wq, &pool->work).
+         *
+         * There are still outstanding pages until both workqueues are drained,
+         * so we cannot unregister migration until then.
+         */
+
         destroy_workqueue(pool->compact_wq);
+        destroy_workqueue(pool->release_wq);
+        z3fold_unregister_migration(pool);
         kfree(pool);
 }
 
diff --git a/samples/auxdisplay/cfag12864b-example.c b/samples/auxdisplay/cfag12864b-example.c
index 85571e90191f..bfeab44f81d0 100644
--- a/samples/auxdisplay/cfag12864b-example.c
+++ b/samples/auxdisplay/cfag12864b-example.c
@@ -245,7 +245,7 @@ int main(int argc, char *argv[])
 
         if (argc != 2) {
                 printf(
-                        "Sintax:  %s fbdev\n"
+                        "Syntax:  %s fbdev\n"
                         "Usually: /dev/fb0, /dev/fb1...\n", argv[0]);
                 return -1;
         }
diff --git a/scripts/coccinelle/api/atomic_as_refcounter.cocci b/scripts/coccinelle/api/atomic_as_refcounter.cocci
index 988120e0fd67..0f78d94abc35 100644
--- a/scripts/coccinelle/api/atomic_as_refcounter.cocci
+++ b/scripts/coccinelle/api/atomic_as_refcounter.cocci
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0-only
 // Check if refcount_t type and API should be used
 // instead of atomic_t type when dealing with refcounters
 //
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 9a94672e7adc..ade699131065 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -1228,24 +1228,11 @@ hashalg_fail:
 
 static int __init init_digests(void)
 {
-        u8 digest[TPM_MAX_DIGEST_SIZE];
-        int ret;
-        int i;
-
-        ret = tpm_get_random(chip, digest, TPM_MAX_DIGEST_SIZE);
-        if (ret < 0)
-                return ret;
-        if (ret < TPM_MAX_DIGEST_SIZE)
-                return -EFAULT;
-
         digests = kcalloc(chip->nr_allocated_banks, sizeof(*digests),
                           GFP_KERNEL);
         if (!digests)
                 return -ENOMEM;
 
-        for (i = 0; i < chip->nr_allocated_banks; i++)
-                memcpy(digests[i].digest, digest, TPM_MAX_DIGEST_SIZE);
-
         return 0;
 }
 
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 485edaba0037..5bf24fb819d2 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -6051,6 +6051,24 @@ void snd_hda_gen_free(struct hda_codec *codec)
 }
 EXPORT_SYMBOL_GPL(snd_hda_gen_free);
 
+/**
+ * snd_hda_gen_reboot_notify - Make codec enter D3 before rebooting
+ * @codec: the HDA codec
+ *
+ * This can be put as patch_ops reboot_notify function.
+ */
+void snd_hda_gen_reboot_notify(struct hda_codec *codec)
+{
+        /* Make the codec enter D3 to avoid spurious noises from the internal
+         * speaker during (and after) reboot
+         */
+        snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3);
+        snd_hda_codec_write(codec, codec->core.afg, 0,
+                            AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
+        msleep(10);
+}
+EXPORT_SYMBOL_GPL(snd_hda_gen_reboot_notify);
+
 #ifdef CONFIG_PM
 /**
  * snd_hda_gen_check_power_status - check the loopback power save state
@@ -6078,6 +6096,7 @@ static const struct hda_codec_ops generic_patch_ops = {
         .init = snd_hda_gen_init,
         .free = snd_hda_gen_free,
         .unsol_event = snd_hda_jack_unsol_event,
+        .reboot_notify = snd_hda_gen_reboot_notify,
 #ifdef CONFIG_PM
         .check_power_status = snd_hda_gen_check_power_status,
 #endif
@@ -6100,7 +6119,7 @@ static int snd_hda_parse_generic_codec(struct hda_codec *codec)
 
         err = snd_hda_parse_pin_defcfg(codec, &spec->autocfg, NULL, 0);
         if (err < 0)
-                return err;
+                goto error;
 
         err = snd_hda_gen_parse_auto_config(codec, &spec->autocfg);
         if (err < 0)
diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h
index 35a670a71c42..5f199dcb0d18 100644
--- a/sound/pci/hda/hda_generic.h
+++ b/sound/pci/hda/hda_generic.h
@@ -332,6 +332,7 @@ int snd_hda_gen_parse_auto_config(struct hda_codec *codec,
                                   struct auto_pin_cfg *cfg);
 int snd_hda_gen_build_controls(struct hda_codec *codec);
 int snd_hda_gen_build_pcms(struct hda_codec *codec);
+void snd_hda_gen_reboot_notify(struct hda_codec *codec);
 
 /* standard jack event callbacks */
 void snd_hda_gen_hp_automute(struct hda_codec *codec,
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index a6d8c0d77b84..99fc0917339b 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2508,6 +2508,9 @@ static const struct pci_device_id azx_ids[] = {
         /* AMD, X370 & co */
         { PCI_DEVICE(0x1022, 0x1457),
           .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_AMD_SB },
+        /* AMD, X570 & co */
+        { PCI_DEVICE(0x1022, 0x1487),
+          .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_AMD_SB },
         /* AMD Stoney */
         { PCI_DEVICE(0x1022, 0x157a),
           .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index f299f137eaea..14298ef45b21 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -163,23 +163,10 @@ static void cx_auto_reboot_notify(struct hda_codec *codec)
 {
         struct conexant_spec *spec = codec->spec;
 
-        switch (codec->core.vendor_id) {
-        case 0x14f12008: /* CX8200 */
-        case 0x14f150f2: /* CX20722 */
-        case 0x14f150f4: /* CX20724 */
-                break;
-        default:
-                return;
-        }
-
         /* Turn the problematic codec into D3 to avoid spurious noises
            from the internal speaker during (and after) reboot */
         cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, false);
-
-        snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3);
-        snd_hda_codec_write(codec, codec->core.afg, 0,
-                            AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
-        msleep(10);
+        snd_hda_gen_reboot_notify(codec);
 }
 
 static void cx_auto_free(struct hda_codec *codec)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index de224cbea7a0..e333b3e30e31 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -869,15 +869,6 @@ static void alc_reboot_notify(struct hda_codec *codec)
                 alc_shutup(codec);
 }
 
-/* power down codec to D3 at reboot/shutdown; set as reboot_notify ops */
-static void alc_d3_at_reboot(struct hda_codec *codec)
-{
-        snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3);
-        snd_hda_codec_write(codec, codec->core.afg, 0,
-                            AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
-        msleep(10);
-}
-
 #define alc_free        snd_hda_gen_free
 
 #ifdef CONFIG_PM
@@ -5152,7 +5143,7 @@ static void alc_fixup_tpt440_dock(struct hda_codec *codec,
         struct alc_spec *spec = codec->spec;
 
         if (action == HDA_FIXUP_ACT_PRE_PROBE) {
-                spec->reboot_notify = alc_d3_at_reboot; /* reduce noise */
+                spec->reboot_notify = snd_hda_gen_reboot_notify; /* reduce noise */
                 spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
                 codec->power_save_node = 0; /* avoid click noises */
                 snd_hda_apply_pincfgs(codec, pincfgs);
@@ -6987,6 +6978,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x82bf, "HP G3 mini", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+        SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
         SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
         SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
         SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 7498b5191b68..b5927c3d5bc0 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -68,6 +68,7 @@ struct mixer_build {
         unsigned char *buffer;
         unsigned int buflen;
         DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS);
+        DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS);
         struct usb_audio_term oterm;
         const struct usbmix_name_map *map;
         const struct usbmix_selector_map *selector_map;
@@ -744,6 +745,8 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
                 return -EINVAL;
         if (!desc->bNrInPins)
                 return -EINVAL;
+        if (desc->bLength < sizeof(*desc) + desc->bNrInPins)
+                return -EINVAL;
 
         switch (state->mixer->protocol) {
         case UAC_VERSION_1:
@@ -773,16 +776,25 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
  * parse the source unit recursively until it reaches to a terminal
  * or a branched unit.
  */
-static int check_input_term(struct mixer_build *state, int id,
+static int __check_input_term(struct mixer_build *state, int id,
                             struct usb_audio_term *term)
 {
         int protocol = state->mixer->protocol;
         int err;
         void *p1;
+        unsigned char *hdr;
 
         memset(term, 0, sizeof(*term));
-        while ((p1 = find_audio_control_unit(state, id)) != NULL) {
-                unsigned char *hdr = p1;
+        for (;;) {
+                /* a loop in the terminal chain? */
+                if (test_and_set_bit(id, state->termbitmap))
+                        return -EINVAL;
+
+                p1 = find_audio_control_unit(state, id);
+                if (!p1)
+                        break;
+
+                hdr = p1;
                 term->id = id;
 
                 if (protocol == UAC_VERSION_1 || protocol == UAC_VERSION_2) {
@@ -800,7 +812,7 @@ static int check_input_term(struct mixer_build *state, int id,
 
                                         /* call recursively to verify that the
                                          * referenced clock entity is valid */
-                                        err = check_input_term(state, d->bCSourceID, term);
+                                        err = __check_input_term(state, d->bCSourceID, term);
                                         if (err < 0)
                                                 return err;
 
@@ -834,7 +846,7 @@ static int check_input_term(struct mixer_build *state, int id,
                         case UAC2_CLOCK_SELECTOR: {
                                 struct uac_selector_unit_descriptor *d = p1;
                                 /* call recursively to retrieve the channel info */
-                                err = check_input_term(state, d->baSourceID[0], term);
+                                err = __check_input_term(state, d->baSourceID[0], term);
                                 if (err < 0)
                                         return err;
                                 term->type = UAC3_SELECTOR_UNIT << 16; /* virtual type */
@@ -897,7 +909,7 @@ static int check_input_term(struct mixer_build *state, int id,
 
                                 /* call recursively to verify that the
                                  * referenced clock entity is valid */
-                                err = check_input_term(state, d->bCSourceID, term);
+                                err = __check_input_term(state, d->bCSourceID, term);
                                 if (err < 0)
                                         return err;
 
@@ -948,7 +960,7 @@ static int check_input_term(struct mixer_build *state, int id,
                         case UAC3_CLOCK_SELECTOR: {
                                 struct uac_selector_unit_descriptor *d = p1;
                                 /* call recursively to retrieve the channel info */
-                                err = check_input_term(state, d->baSourceID[0], term);
+                                err = __check_input_term(state, d->baSourceID[0], term);
                                 if (err < 0)
                                         return err;
                                 term->type = UAC3_SELECTOR_UNIT << 16; /* virtual type */
@@ -964,7 +976,7 @@ static int check_input_term(struct mixer_build *state, int id,
                                         return -EINVAL;
 
                                 /* call recursively to retrieve the channel info */
-                                err = check_input_term(state, d->baSourceID[0], term);
+                                err = __check_input_term(state, d->baSourceID[0], term);
                                 if (err < 0)
                                         return err;
 
@@ -982,6 +994,15 @@ static int check_input_term(struct mixer_build *state, int id,
         return -ENODEV;
 }
 
+
+static int check_input_term(struct mixer_build *state, int id,
+                            struct usb_audio_term *term)
+{
+        memset(term, 0, sizeof(*term));
+        memset(state->termbitmap, 0, sizeof(state->termbitmap));
+        return __check_input_term(state, id, term);
+}
+
 /*
  * Feature Unit
  */
diff --git a/tools/hv/hv_get_dhcp_info.sh b/tools/hv/hv_get_dhcp_info.sh
index c38686c44656..2f2a3c7df3de 100755
--- a/tools/hv/hv_get_dhcp_info.sh
+++ b/tools/hv/hv_get_dhcp_info.sh
@@ -13,7 +13,7 @@
 #       the script prints the string "Disabled" to stdout.
 #
 # Each Distro is expected to implement this script in a distro specific
-# fashion. For instance on Distros that ship with Network Manager enabled,
+# fashion. For instance, on Distros that ship with Network Manager enabled,
 # this script can be based on the Network Manager APIs for retrieving DHCP
 # information.
 
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index d7e06fe0270e..f5597503c771 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -700,7 +700,7 @@ static void kvp_get_ipconfig_info(char *if_name,
 
 
         /*
-         * Gather the DNS  state.
+         * Gather the DNS state.
          * Since there is no standard way to get this information
          * across various distributions of interest; we just invoke
          * an external script that needs to be ported across distros
@@ -1051,7 +1051,7 @@ static int parse_ip_val_buffer(char *in_buf, int *offset,
         char *start;
 
         /*
-         * in_buf has sequence of characters that are seperated by
+         * in_buf has sequence of characters that are separated by
          * the character ';'. The last sequence does not have the
          * terminating ";" character.
          */
@@ -1386,6 +1386,8 @@ int main(int argc, char *argv[])
                         daemonize = 0;
                         break;
                 case 'h':
+                        print_usage(argv);
+                        exit(0);
                 default:
                         print_usage(argv);
                         exit(EXIT_FAILURE);
@@ -1490,7 +1492,7 @@ int main(int argc, char *argv[])
                 case KVP_OP_GET_IP_INFO:
                         kvp_ip_val = &hv_msg->body.kvp_ip_val;
 
-                        error =  kvp_mac_to_ip(kvp_ip_val);
+                        error = kvp_mac_to_ip(kvp_ip_val);
 
                         if (error)
                                 hv_msg->error = error;
diff --git a/tools/hv/hv_set_ifconfig.sh b/tools/hv/hv_set_ifconfig.sh
index 7ed9f85ef908..d10fe35b7f25 100755
--- a/tools/hv/hv_set_ifconfig.sh
+++ b/tools/hv/hv_set_ifconfig.sh
@@ -12,7 +12,7 @@
 # be used to configure the interface.
 #
 # Each Distro is expected to implement this script in a distro specific
-# fashion. For instance on Distros that ship with Network Manager enabled,
+# fashion. For instance, on Distros that ship with Network Manager enabled,
 # this script can be based on the Network Manager APIs for configuring the
 # interface.
 #
diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c
index efe1e34dd91b..92902a88f671 100644
--- a/tools/hv/hv_vss_daemon.c
+++ b/tools/hv/hv_vss_daemon.c
@@ -42,7 +42,7 @@ static int vss_do_freeze(char *dir, unsigned int cmd)
          * If a partition is mounted more than once, only the first
          * FREEZE/THAW can succeed and the later ones will get
          * EBUSY/EINVAL respectively: there could be 2 cases:
-         * 1) a user may mount the same partition to differnt directories
+         * 1) a user may mount the same partition to different directories
          *  by mistake or on purpose;
          * 2) The subvolume of btrfs appears to have the same partition
          * mounted more than once.
@@ -218,6 +218,8 @@ int main(int argc, char *argv[])
                         daemonize = 0;
                         break;
                 case 'h':
+                        print_usage(argv);
+                        exit(0);
                 default:
                         print_usage(argv);
                         exit(EXIT_FAILURE);
diff --git a/tools/hv/lsvmbus b/tools/hv/lsvmbus
index 55e7374bade0..099f2c44dbed 100644
--- a/tools/hv/lsvmbus
+++ b/tools/hv/lsvmbus
@@ -4,10 +4,10 @@
 import os
 from optparse import OptionParser
 
+help_msg = "print verbose messages. Try -vv, -vvv for  more verbose messages"
 parser = OptionParser()
-parser.add_option("-v", "--verbose", dest="verbose",
-                   help="print verbose messages. Try -vv, -vvv for \
-                        more verbose messages", action="count")
+parser.add_option(
+        "-v", "--verbose", dest="verbose", help=help_msg, action="count")
 
 (options, args) = parser.parse_args()
 
@@ -21,27 +21,28 @@ if not os.path.isdir(vmbus_sys_path):
         exit(-1)
 
 vmbus_dev_dict = {
-        '{0e0b6031-5213-4934-818b-38d90ced39db}' : '[Operating system shutdown]',
-        '{9527e630-d0ae-497b-adce-e80ab0175caf}' : '[Time Synchronization]',
-        '{57164f39-9115-4e78-ab55-382f3bd5422d}' : '[Heartbeat]',
-        '{a9a0f4e7-5a45-4d96-b827-8a841e8c03e6}' : '[Data Exchange]',
-        '{35fa2e29-ea23-4236-96ae-3a6ebacba440}' : '[Backup (volume checkpoint)]',
-        '{34d14be3-dee4-41c8-9ae7-6b174977c192}' : '[Guest services]',
-        '{525074dc-8985-46e2-8057-a307dc18a502}' : '[Dynamic Memory]',
-        '{cfa8b69e-5b4a-4cc0-b98b-8ba1a1f3f95a}' : 'Synthetic mouse',
-        '{f912ad6d-2b17-48ea-bd65-f927a61c7684}' : 'Synthetic keyboard',
-        '{da0a7802-e377-4aac-8e77-0558eb1073f8}' : 'Synthetic framebuffer adapter',
-        '{f8615163-df3e-46c5-913f-f2d2f965ed0e}' : 'Synthetic network adapter',
-        '{32412632-86cb-44a2-9b5c-50d1417354f5}' : 'Synthetic IDE Controller',
-        '{ba6163d9-04a1-4d29-b605-72e2ffb1dc7f}' : 'Synthetic SCSI Controller',
-        '{2f9bcc4a-0069-4af3-b76b-6fd0be528cda}' : 'Synthetic fiber channel adapter',
-        '{8c2eaf3d-32a7-4b09-ab99-bd1f1c86b501}' : 'Synthetic RDMA adapter',
-        '{44c4f61d-4444-4400-9d52-802e27ede19f}' : 'PCI Express pass-through',
-        '{276aacf4-ac15-426c-98dd-7521ad3f01fe}' : '[Reserved system device]',
-        '{f8e65716-3cb3-4a06-9a60-1889c5cccab5}' : '[Reserved system device]',
-        '{3375baf4-9e15-4b30-b765-67acb10d607b}' : '[Reserved system device]',
+        '{0e0b6031-5213-4934-818b-38d90ced39db}': '[Operating system shutdown]',
+        '{9527e630-d0ae-497b-adce-e80ab0175caf}': '[Time Synchronization]',
+        '{57164f39-9115-4e78-ab55-382f3bd5422d}': '[Heartbeat]',
+        '{a9a0f4e7-5a45-4d96-b827-8a841e8c03e6}': '[Data Exchange]',
+        '{35fa2e29-ea23-4236-96ae-3a6ebacba440}': '[Backup (volume checkpoint)]',
+        '{34d14be3-dee4-41c8-9ae7-6b174977c192}': '[Guest services]',
+        '{525074dc-8985-46e2-8057-a307dc18a502}': '[Dynamic Memory]',
+        '{cfa8b69e-5b4a-4cc0-b98b-8ba1a1f3f95a}': 'Synthetic mouse',
+        '{f912ad6d-2b17-48ea-bd65-f927a61c7684}': 'Synthetic keyboard',
+        '{da0a7802-e377-4aac-8e77-0558eb1073f8}': 'Synthetic framebuffer adapter',
+        '{f8615163-df3e-46c5-913f-f2d2f965ed0e}': 'Synthetic network adapter',
+        '{32412632-86cb-44a2-9b5c-50d1417354f5}': 'Synthetic IDE Controller',
+        '{ba6163d9-04a1-4d29-b605-72e2ffb1dc7f}': 'Synthetic SCSI Controller',
+        '{2f9bcc4a-0069-4af3-b76b-6fd0be528cda}': 'Synthetic fiber channel adapter',
+        '{8c2eaf3d-32a7-4b09-ab99-bd1f1c86b501}': 'Synthetic RDMA adapter',
+        '{44c4f61d-4444-4400-9d52-802e27ede19f}': 'PCI Express pass-through',
+        '{276aacf4-ac15-426c-98dd-7521ad3f01fe}': '[Reserved system device]',
+        '{f8e65716-3cb3-4a06-9a60-1889c5cccab5}': '[Reserved system device]',
+        '{3375baf4-9e15-4b30-b765-67acb10d607b}': '[Reserved system device]',
 }
 
+
 def get_vmbus_dev_attr(dev_name, attr):
         try:
                 f = open('%s/%s/%s' % (vmbus_sys_path, dev_name, attr), 'r')
@@ -52,6 +53,7 @@ def get_vmbus_dev_attr(dev_name, attr):
 
         return lines
 
+
 class VMBus_Dev:
         pass
 
@@ -66,12 +68,13 @@ for f in os.listdir(vmbus_sys_path):
 
         chn_vp_mapping = get_vmbus_dev_attr(f, 'channel_vp_mapping')
         chn_vp_mapping = [c.strip() for c in chn_vp_mapping]
-        chn_vp_mapping = sorted(chn_vp_mapping,
-                key = lambda c : int(c.split(':')[0]))
+        chn_vp_mapping = sorted(
+                chn_vp_mapping, key=lambda c: int(c.split(':')[0]))
 
-        chn_vp_mapping = ['\tRel_ID=%s, target_cpu=%s' %
-                                (c.split(':')[0], c.split(':')[1])
-                                        for c in chn_vp_mapping]
+        chn_vp_mapping = [
+                '\tRel_ID=%s, target_cpu=%s' %
+                (c.split(':')[0], c.split(':')[1]) for c in chn_vp_mapping
+        ]
         d = VMBus_Dev()
         d.sysfs_path = '%s/%s' % (vmbus_sys_path, f)
         d.vmbus_id = vmbus_id
@@ -85,7 +88,7 @@ for f in os.listdir(vmbus_sys_path):
         vmbus_dev_list.append(d)
 
 
-vmbus_dev_list  = sorted(vmbus_dev_list, key = lambda d : int(d.vmbus_id))
+vmbus_dev_list = sorted(vmbus_dev_list, key=lambda d: int(d.vmbus_id))
 
 format0 = '%2s: %s'
 format1 = '%2s: Class_ID = %s - %s\n%s'
@@ -95,9 +98,15 @@ for d in vmbus_dev_list:
         if verbose == 0:
                 print(('VMBUS ID ' + format0) % (d.vmbus_id, d.dev_desc))
         elif verbose == 1:
-                print (('VMBUS ID ' + format1) %        \
-                        (d.vmbus_id, d.class_id, d.dev_desc, d.chn_vp_mapping))
+                print(
+                        ('VMBUS ID ' + format1) %
+                        (d.vmbus_id, d.class_id, d.dev_desc, d.chn_vp_mapping)
+                )
         else:
-                print (('VMBUS ID ' + format2) % \
-                        (d.vmbus_id, d.class_id, d.dev_desc, \
-                        d.device_id, d.sysfs_path, d.chn_vp_mapping))
+                print(
+                        ('VMBUS ID ' + format2) %
+                        (
+                                d.vmbus_id, d.class_id, d.dev_desc,
+                                d.device_id, d.sysfs_path, d.chn_vp_mapping
+                        )
+                )