124 files changed, 946 insertions, 559 deletions

diff --git a/Documentation/ABI/testing/sysfs-kernel-mm-swap b/Documentation/ABI/testing/sysfs-kernel-mm-swap
index 587db52084c7..94672016c268 100644
--- a/Documentation/ABI/testing/sysfs-kernel-mm-swap
+++ b/Documentation/ABI/testing/sysfs-kernel-mm-swap
@@ -14,13 +14,3 @@ Description:	Enable/disable VMA based swap readahead.
                 still used for tmpfs etc. other users.  If set to
                 false, the global swap readahead algorithm will be
                 used for all swappable pages.
-
-What:           /sys/kernel/mm/swap/vma_ra_max_order
-Date:           August 2017
-Contact:        Linux memory management mailing list <linux-mm@kvack.org>
-Description:    The max readahead size in order for VMA based swap readahead
-
-                VMA based swap readahead algorithm will readahead at
-                most 1 << max_order pages for each readahead.  The
-                real readahead size for each readahead will be scaled
-                according to the estimation algorithm.
diff --git a/MAINTAINERS b/MAINTAINERS
index 2d3d750b19c0..a74227ad082e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5346,9 +5346,7 @@ M:	"J. Bruce Fields" <bfields@fieldses.org>
 L:      linux-fsdevel@vger.kernel.org
 S:      Maintained
 F:      include/linux/fcntl.h
-F:      include/linux/fs.h
 F:      include/uapi/linux/fcntl.h
-F:      include/uapi/linux/fs.h
 F:      fs/fcntl.c
 F:      fs/locks.c
 
@@ -5357,6 +5355,8 @@ M:	Alexander Viro <viro@zeniv.linux.org.uk>
 L:      linux-fsdevel@vger.kernel.org
 S:      Maintained
 F:      fs/*
+F:      include/linux/fs.h
+F:      include/uapi/linux/fs.h
 
 FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER
 M:      Riku Voipio <riku.voipio@iki.fi>
@@ -7571,7 +7571,7 @@ F:	arch/mips/include/asm/kvm*
 F:      arch/mips/kvm/
 
 KERNEL VIRTUAL MACHINE FOR POWERPC (KVM/powerpc)
-M:      Alexander Graf <agraf@suse.com>
+M:      Paul Mackerras <paulus@ozlabs.org>
 L:      kvm-ppc@vger.kernel.org
 W:      http://www.linux-kvm.org/
 T:      git git://github.com/agraf/linux-2.6.git
diff --git a/Makefile b/Makefile
index 2835863bdd5a..5bf6fa4d62d8 100644
--- a/Makefile
+++ b/Makefile
@@ -933,7 +933,11 @@ ifdef CONFIG_STACK_VALIDATION
   ifeq ($(has_libelf),1)
     objtool_target := tools/objtool FORCE
   else
-    $(warning "Cannot use CONFIG_STACK_VALIDATION, please install libelf-dev, libelf-devel or elfutils-libelf-devel")
+    ifdef CONFIG_ORC_UNWINDER
+      $(error "Cannot generate ORC metadata for CONFIG_ORC_UNWINDER=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel")
+    else
+      $(warning "Cannot use CONFIG_STACK_VALIDATION=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel")
+    endif
     SKIP_STACK_VALIDATION := 1
     export SKIP_STACK_VALIDATION
   endif
diff --git a/arch/mips/include/asm/cmpxchg.h b/arch/mips/include/asm/cmpxchg.h
index 903f3bf48419..7e25c5cc353a 100644
--- a/arch/mips/include/asm/cmpxchg.h
+++ b/arch/mips/include/asm/cmpxchg.h
@@ -155,14 +155,16 @@ static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old,
                 return __cmpxchg_small(ptr, old, new, size);
 
         case 4:
-                return __cmpxchg_asm("ll", "sc", (volatile u32 *)ptr, old, new);
+                return __cmpxchg_asm("ll", "sc", (volatile u32 *)ptr,
+                                     (u32)old, new);
 
         case 8:
                 /* lld/scd are only available for MIPS64 */
                 if (!IS_ENABLED(CONFIG_64BIT))
                         return __cmpxchg_called_with_bad_pointer();
 
-                return __cmpxchg_asm("lld", "scd", (volatile u64 *)ptr, old, new);
+                return __cmpxchg_asm("lld", "scd", (volatile u64 *)ptr,
+                                     (u64)old, new);
 
         default:
                 return __cmpxchg_called_with_bad_pointer();
diff --git a/arch/mips/loongson32/common/platform.c b/arch/mips/loongson32/common/platform.c
index 100f23dfa438..ac584c5823d0 100644
--- a/arch/mips/loongson32/common/platform.c
+++ b/arch/mips/loongson32/common/platform.c
@@ -183,18 +183,20 @@ int ls1x_eth_mux_init(struct platform_device *pdev, void *priv)
 }
 
 static struct plat_stmmacenet_data ls1x_eth0_pdata = {
-        .bus_id         = 0,
-        .phy_addr       = -1,
+        .bus_id                 = 0,
+        .phy_addr               = -1,
 #if defined(CONFIG_LOONGSON1_LS1B)
-        .interface      = PHY_INTERFACE_MODE_MII,
+        .interface              = PHY_INTERFACE_MODE_MII,
 #elif defined(CONFIG_LOONGSON1_LS1C)
-        .interface      = PHY_INTERFACE_MODE_RMII,
+        .interface              = PHY_INTERFACE_MODE_RMII,
 #endif
-        .mdio_bus_data  = &ls1x_mdio_bus_data,
-        .dma_cfg        = &ls1x_eth_dma_cfg,
-        .has_gmac       = 1,
-        .tx_coe         = 1,
-        .init           = ls1x_eth_mux_init,
+        .mdio_bus_data          = &ls1x_mdio_bus_data,
+        .dma_cfg                = &ls1x_eth_dma_cfg,
+        .has_gmac               = 1,
+        .tx_coe                 = 1,
+        .rx_queues_to_use       = 1,
+        .tx_queues_to_use       = 1,
+        .init                   = ls1x_eth_mux_init,
 };
 
 static struct resource ls1x_eth0_resources[] = {
@@ -222,14 +224,16 @@ struct platform_device ls1x_eth0_pdev = {
 
 #ifdef CONFIG_LOONGSON1_LS1B
 static struct plat_stmmacenet_data ls1x_eth1_pdata = {
-        .bus_id         = 1,
-        .phy_addr       = -1,
-        .interface      = PHY_INTERFACE_MODE_MII,
-        .mdio_bus_data  = &ls1x_mdio_bus_data,
-        .dma_cfg        = &ls1x_eth_dma_cfg,
-        .has_gmac       = 1,
-        .tx_coe         = 1,
-        .init           = ls1x_eth_mux_init,
+        .bus_id                 = 1,
+        .phy_addr               = -1,
+        .interface              = PHY_INTERFACE_MODE_MII,
+        .mdio_bus_data          = &ls1x_mdio_bus_data,
+        .dma_cfg                = &ls1x_eth_dma_cfg,
+        .has_gmac               = 1,
+        .tx_coe                 = 1,
+        .rx_queues_to_use       = 1,
+        .tx_queues_to_use       = 1,
+        .init                   = ls1x_eth_mux_init,
 };
 
 static struct resource ls1x_eth1_resources[] = {
diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index 192542dbd972..16d9ef5a78c5 100644
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -2558,7 +2558,6 @@ dcopuop:
                                         break;
                                 default:
                                         /* Reserved R6 ops */
-                                        pr_err("Reserved MIPS R6 CMP.condn.S operation\n");
                                         return SIGILL;
                                 }
                         }
@@ -2719,7 +2718,6 @@ dcopuop:
                                         break;
                                 default:
                                         /* Reserved R6 ops */
-                                        pr_err("Reserved MIPS R6 CMP.condn.D operation\n");
                                         return SIGILL;
                                 }
                         }
diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c
index 7646891c4e9b..01b7a87ea678 100644
--- a/arch/mips/net/ebpf_jit.c
+++ b/arch/mips/net/ebpf_jit.c
@@ -667,7 +667,7 @@ static int build_one_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
 {
         int src, dst, r, td, ts, mem_off, b_off;
         bool need_swap, did_move, cmp_eq;
-        unsigned int target;
+        unsigned int target = 0;
         u64 t64;
         s64 t64s;
         int bpf_op = BPF_OP(insn->code);
diff --git a/arch/mips/tools/generic-board-config.sh b/arch/mips/tools/generic-board-config.sh
index 5c4f93687039..654d652d7fa1 100755
--- a/arch/mips/tools/generic-board-config.sh
+++ b/arch/mips/tools/generic-board-config.sh
@@ -30,8 +30,6 @@ cfg="$4"
 boards_origin="$5"
 shift 5
 
-cd "${srctree}"
-
 # Only print Skipping... lines if the user explicitly specified BOARDS=. In the
 # general case it only serves to obscure the useful output about what actually
 # was included.
@@ -48,7 +46,7 @@ environment*)
 esac
 
 for board in $@; do
-        board_cfg="arch/mips/configs/generic/board-${board}.config"
+        board_cfg="${srctree}/arch/mips/configs/generic/board-${board}.config"
         if [ ! -f "${board_cfg}" ]; then
                 echo "WARNING: Board config '${board_cfg}' not found"
                 continue
@@ -84,7 +82,7 @@ for board in $@; do
         done || continue
 
         # Merge this board config fragment into our final config file
-        ./scripts/kconfig/merge_config.sh \
+        ${srctree}/scripts/kconfig/merge_config.sh \
                 -m -O ${objtree} ${cfg} ${board_cfg} \
                 | grep -Ev '^(#|Using)'
 done
diff --git a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
index c98e90b4ea7b..b4e2b7165f79 100644
--- a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
+++ b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
@@ -181,34 +181,25 @@ _GLOBAL(ftrace_stub)
          *  - we have no stack frame and can not allocate one
          *  - LR points back to the original caller (in A)
          *  - CTR holds the new NIP in C
-         *  - r0 & r12 are free
-         *
-         * r0 can't be used as the base register for a DS-form load or store, so
-         * we temporarily shuffle r1 (stack pointer) into r0 and then put it back.
+         *  - r0, r11 & r12 are free
          */
 livepatch_handler:
         CURRENT_THREAD_INFO(r12, r1)
 
-        /* Save stack pointer into r0 */
-        mr      r0, r1
-
         /* Allocate 3 x 8 bytes */
-        ld      r1, TI_livepatch_sp(r12)
-        addi    r1, r1, 24
-        std     r1, TI_livepatch_sp(r12)
+        ld      r11, TI_livepatch_sp(r12)
+        addi    r11, r11, 24
+        std     r11, TI_livepatch_sp(r12)
 
         /* Save toc & real LR on livepatch stack */
-        std     r2,  -24(r1)
+        std     r2,  -24(r11)
         mflr    r12
-        std     r12, -16(r1)
+        std     r12, -16(r11)
 
         /* Store stack end marker */
         lis     r12, STACK_END_MAGIC@h
         ori     r12, r12, STACK_END_MAGIC@l
-        std     r12, -8(r1)
-
-        /* Restore real stack pointer */
-        mr      r1, r0
+        std     r12, -8(r11)
 
         /* Put ctr in r12 for global entry and branch there */
         mfctr   r12
@@ -216,36 +207,30 @@ livepatch_handler:
 
         /*
          * Now we are returning from the patched function to the original
-         * caller A. We are free to use r0 and r12, and we can use r2 until we
+         * caller A. We are free to use r11, r12 and we can use r2 until we
          * restore it.
          */
 
         CURRENT_THREAD_INFO(r12, r1)
 
-        /* Save stack pointer into r0 */
-        mr      r0, r1
-
-        ld      r1, TI_livepatch_sp(r12)
+        ld      r11, TI_livepatch_sp(r12)
 
         /* Check stack marker hasn't been trashed */
         lis     r2,  STACK_END_MAGIC@h
         ori     r2,  r2, STACK_END_MAGIC@l
-        ld      r12, -8(r1)
+        ld      r12, -8(r11)
 1:      tdne    r12, r2
         EMIT_BUG_ENTRY 1b, __FILE__, __LINE__ - 1, 0
 
         /* Restore LR & toc from livepatch stack */
-        ld      r12, -16(r1)
+        ld      r12, -16(r11)
         mtlr    r12
-        ld      r2,  -24(r1)
+        ld      r2,  -24(r11)
 
         /* Pop livepatch stack frame */
-        CURRENT_THREAD_INFO(r12, r0)
-        subi    r1, r1, 24
-        std     r1, TI_livepatch_sp(r12)
-
-        /* Restore real stack pointer */
-        mr      r1, r0
+        CURRENT_THREAD_INFO(r12, r1)
+        subi    r11, r11, 24
+        std     r11, TI_livepatch_sp(r12)
 
         /* Return to original caller of live patched function */
         blr
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index 5e8418c28bd8..f208f560aecd 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -1684,11 +1684,13 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
  * Logical instructions
  */
                 case 26:        /* cntlzw */
-                        op->val = __builtin_clz((unsigned int) regs->gpr[rd]);
+                        val = (unsigned int) regs->gpr[rd];
+                        op->val = ( val ? __builtin_clz(val) : 32 );
                         goto logical_done;
 #ifdef __powerpc64__
                 case 58:        /* cntlzd */
-                        op->val = __builtin_clzl(regs->gpr[rd]);
+                        val = regs->gpr[rd];
+                        op->val = ( val ? __builtin_clzl(val) : 64 );
                         goto logical_done;
 #endif
                 case 28:        /* and */
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index b95c584ce19d..a51df9ef529d 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -1438,7 +1438,6 @@ out:
 
 int arch_update_cpu_topology(void)
 {
-        lockdep_assert_cpus_held();
         return numa_update_cpu_topology(true);
 }
 
diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
index 9ccac86f3463..88126245881b 100644
--- a/arch/powerpc/perf/imc-pmu.c
+++ b/arch/powerpc/perf/imc-pmu.c
@@ -399,6 +399,20 @@ static void nest_imc_counters_release(struct perf_event *event)
 
         /* Take the mutex lock for this node and then decrement the reference count */
         mutex_lock(&ref->lock);
+        if (ref->refc == 0) {
+                /*
+                 * The scenario where this is true is, when perf session is
+                 * started, followed by offlining of all cpus in a given node.
+                 *
+                 * In the cpuhotplug offline path, ppc_nest_imc_cpu_offline()
+                 * function set the ref->count to zero, if the cpu which is
+                 * about to offline is the last cpu in a given node and make
+                 * an OPAL call to disable the engine in that node.
+                 *
+                 */
+                mutex_unlock(&ref->lock);
+                return;
+        }
         ref->refc--;
         if (ref->refc == 0) {
                 rc = opal_imc_counters_stop(OPAL_IMC_COUNTERS_NEST,
@@ -523,8 +537,8 @@ static int core_imc_mem_init(int cpu, int size)
 
         /* We need only vbase for core counters */
         mem_info->vbase = page_address(alloc_pages_node(phys_id,
-                                          GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
-                                          get_order(size)));
+                                          GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
+                                          __GFP_NOWARN, get_order(size)));
         if (!mem_info->vbase)
                 return -ENOMEM;
 
@@ -646,6 +660,20 @@ static void core_imc_counters_release(struct perf_event *event)
                 return;
 
         mutex_lock(&ref->lock);
+        if (ref->refc == 0) {
+                /*
+                 * The scenario where this is true is, when perf session is
+                 * started, followed by offlining of all cpus in a given core.
+                 *
+                 * In the cpuhotplug offline path, ppc_core_imc_cpu_offline()
+                 * function set the ref->count to zero, if the cpu which is
+                 * about to offline is the last cpu in a given core and make
+                 * an OPAL call to disable the engine in that core.
+                 *
+                 */
+                mutex_unlock(&ref->lock);
+                return;
+        }
         ref->refc--;
         if (ref->refc == 0) {
                 rc = opal_imc_counters_stop(OPAL_IMC_COUNTERS_CORE,
@@ -763,8 +791,8 @@ static int thread_imc_mem_alloc(int cpu_id, int size)
                  * free the memory in cpu offline path.
                  */
                 local_mem = page_address(alloc_pages_node(phys_id,
-                                  GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
-                                  get_order(size)));
+                                  GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
+                                  __GFP_NOWARN, get_order(size)));
                 if (!local_mem)
                         return -ENOMEM;
 
@@ -1148,7 +1176,8 @@ static void imc_common_cpuhp_mem_free(struct imc_pmu *pmu_ptr)
         }
 
         /* Only free the attr_groups which are dynamically allocated  */
-        kfree(pmu_ptr->attr_groups[IMC_EVENT_ATTR]->attrs);
+        if (pmu_ptr->attr_groups[IMC_EVENT_ATTR])
+                kfree(pmu_ptr->attr_groups[IMC_EVENT_ATTR]->attrs);
         kfree(pmu_ptr->attr_groups[IMC_EVENT_ATTR]);
         kfree(pmu_ptr);
         return;
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 106d4a029a8a..7a69cf053711 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3974,19 +3974,19 @@ static inline bool is_last_gpte(struct kvm_mmu *mmu,
                                 unsigned level, unsigned gpte)
 {
         /*
-         * PT_PAGE_TABLE_LEVEL always terminates.  The RHS has bit 7 set
-         * iff level <= PT_PAGE_TABLE_LEVEL, which for our purpose means
-         * level == PT_PAGE_TABLE_LEVEL; set PT_PAGE_SIZE_MASK in gpte then.
-         */
-        gpte |= level - PT_PAGE_TABLE_LEVEL - 1;
-
-        /*
          * The RHS has bit 7 set iff level < mmu->last_nonleaf_level.
          * If it is clear, there are no large pages at this level, so clear
          * PT_PAGE_SIZE_MASK in gpte if that is the case.
          */
         gpte &= level - mmu->last_nonleaf_level;
 
+        /*
+         * PT_PAGE_TABLE_LEVEL always terminates.  The RHS has bit 7 set
+         * iff level <= PT_PAGE_TABLE_LEVEL, which for our purpose means
+         * level == PT_PAGE_TABLE_LEVEL; set PT_PAGE_SIZE_MASK in gpte then.
+         */
+        gpte |= level - PT_PAGE_TABLE_LEVEL - 1;
+
         return gpte & PT_PAGE_SIZE_MASK;
 }
 
@@ -4555,6 +4555,7 @@ void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly,
 
         update_permission_bitmask(vcpu, context, true);
         update_pkru_bitmask(vcpu, context, true);
+        update_last_nonleaf_level(vcpu, context);
         reset_rsvds_bits_mask_ept(vcpu, context, execonly);
         reset_ept_shadow_zero_bits_mask(vcpu, context, execonly);
 }
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 86b68dc5a649..f18d1f8d332b 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -334,10 +334,11 @@ retry_walk:
                 --walker->level;
 
                 index = PT_INDEX(addr, walker->level);
-
                 table_gfn = gpte_to_gfn(pte);
                 offset    = index * sizeof(pt_element_t);
                 pte_gpa   = gfn_to_gpa(table_gfn) + offset;
+
+                BUG_ON(walker->level < 1);
                 walker->table_gfn[walker->level - 1] = table_gfn;
                 walker->pte_gpa[walker->level - 1] = pte_gpa;
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index a2b804e10c95..95a01609d7ee 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -11297,7 +11297,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
 
         /* Same as above - no reason to call set_cr4_guest_host_mask().  */
         vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
-        kvm_set_cr4(vcpu, vmcs12->host_cr4);
+        vmx_set_cr4(vcpu, vmcs12->host_cr4);
 
         nested_ept_uninit_mmu_context(vcpu);
 
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 0e7ef69e8531..d669e9d89001 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -93,11 +93,11 @@ int xen_cpuhp_setup(int (*cpu_up_prepare_cb)(unsigned int),
         int rc;
 
         rc = cpuhp_setup_state_nocalls(CPUHP_XEN_PREPARE,
-                                       "x86/xen/hvm_guest:prepare",
+                                       "x86/xen/guest:prepare",
                                        cpu_up_prepare_cb, cpu_dead_cb);
         if (rc >= 0) {
                 rc = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN,
-                                               "x86/xen/hvm_guest:online",
+                                               "x86/xen/guest:online",
                                                xen_cpu_up_online, NULL);
                 if (rc < 0)
                         cpuhp_remove_state_nocalls(CPUHP_XEN_PREPARE);
diff --git a/block/bio.c b/block/bio.c
index b38e962fa83e..101c2a9b5481 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1239,8 +1239,8 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
          */
         bmd->is_our_pages = map_data ? 0 : 1;
         memcpy(bmd->iov, iter->iov, sizeof(struct iovec) * iter->nr_segs);
-        iov_iter_init(&bmd->iter, iter->type, bmd->iov,
-                        iter->nr_segs, iter->count);
+        bmd->iter = *iter;
+        bmd->iter.iov = bmd->iov;
 
         ret = -ENOMEM;
         bio = bio_kmalloc(gfp_mask, nr_pages);
@@ -1331,6 +1331,7 @@ struct bio *bio_map_user_iov(struct request_queue *q,
         int ret, offset;
         struct iov_iter i;
         struct iovec iov;
+        struct bio_vec *bvec;
 
         iov_for_each(iov, i, *iter) {
                 unsigned long uaddr = (unsigned long) iov.iov_base;
@@ -1375,7 +1376,12 @@ struct bio *bio_map_user_iov(struct request_queue *q,
                 ret = get_user_pages_fast(uaddr, local_nr_pages,
                                 (iter->type & WRITE) != WRITE,
                                 &pages[cur_page]);
-                if (ret < local_nr_pages) {
+                if (unlikely(ret < local_nr_pages)) {
+                        for (j = cur_page; j < page_limit; j++) {
+                                if (!pages[j])
+                                        break;
+                                put_page(pages[j]);
+                        }
                         ret = -EFAULT;
                         goto out_unmap;
                 }
@@ -1383,6 +1389,7 @@ struct bio *bio_map_user_iov(struct request_queue *q,
                 offset = offset_in_page(uaddr);
                 for (j = cur_page; j < page_limit; j++) {
                         unsigned int bytes = PAGE_SIZE - offset;
+                        unsigned short prev_bi_vcnt = bio->bi_vcnt;
 
                         if (len <= 0)
                                 break;
@@ -1397,6 +1404,13 @@ struct bio *bio_map_user_iov(struct request_queue *q,
                                             bytes)
                                 break;
 
+                        /*
+                         * check if vector was merged with previous
+                         * drop page reference if needed
+                         */
+                        if (bio->bi_vcnt == prev_bi_vcnt)
+                                put_page(pages[j]);
+
                         len -= bytes;
                         offset = 0;
                 }
@@ -1423,10 +1437,8 @@ struct bio *bio_map_user_iov(struct request_queue *q,
         return bio;
 
  out_unmap:
-        for (j = 0; j < nr_pages; j++) {
-                if (!pages[j])
-                        break;
-                put_page(pages[j]);
+        bio_for_each_segment_all(bvec, bio, j) {
+                put_page(bvec->bv_page);
         }
  out:
         kfree(pages);
diff --git a/crypto/shash.c b/crypto/shash.c
index 5e31c8d776df..325a14da5827 100644
--- a/crypto/shash.c
+++ b/crypto/shash.c
@@ -41,7 +41,7 @@ static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key,
         int err;
 
         absize = keylen + (alignmask & ~(crypto_tfm_ctx_alignment() - 1));
-        buffer = kmalloc(absize, GFP_KERNEL);
+        buffer = kmalloc(absize, GFP_ATOMIC);
         if (!buffer)
                 return -ENOMEM;
 
@@ -275,12 +275,14 @@ static int shash_async_finup(struct ahash_request *req)
 
 int shash_ahash_digest(struct ahash_request *req, struct shash_desc *desc)
 {
-        struct scatterlist *sg = req->src;
-        unsigned int offset = sg->offset;
         unsigned int nbytes = req->nbytes;
+        struct scatterlist *sg;
+        unsigned int offset;
         int err;
 
-        if (nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset)) {
+        if (nbytes &&
+            (sg = req->src, offset = sg->offset,
+             nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset))) {
                 void *data;
 
                 data = kmap_atomic(sg_page(sg));
diff --git a/crypto/skcipher.c b/crypto/skcipher.c
index 4faa0fd53b0c..d5692e35fab1 100644
--- a/crypto/skcipher.c
+++ b/crypto/skcipher.c
@@ -426,14 +426,9 @@ static int skcipher_copy_iv(struct skcipher_walk *walk)
 
 static int skcipher_walk_first(struct skcipher_walk *walk)
 {
-        walk->nbytes = 0;
-
         if (WARN_ON_ONCE(in_irq()))
                 return -EDEADLK;
 
-        if (unlikely(!walk->total))
-                return 0;
-
         walk->buffer = NULL;
         if (unlikely(((unsigned long)walk->iv & walk->alignmask))) {
                 int err = skcipher_copy_iv(walk);
@@ -452,10 +447,15 @@ static int skcipher_walk_skcipher(struct skcipher_walk *walk,
 {
         struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 
+        walk->total = req->cryptlen;
+        walk->nbytes = 0;
+
+        if (unlikely(!walk->total))
+                return 0;
+
         scatterwalk_start(&walk->in, req->src);
         scatterwalk_start(&walk->out, req->dst);
 
-        walk->total = req->cryptlen;
         walk->iv = req->iv;
         walk->oiv = req->iv;
 
@@ -509,6 +509,11 @@ static int skcipher_walk_aead_common(struct skcipher_walk *walk,
         struct crypto_aead *tfm = crypto_aead_reqtfm(req);
         int err;
 
+        walk->nbytes = 0;
+
+        if (unlikely(!walk->total))
+                return 0;
+
         walk->flags &= ~SKCIPHER_WALK_PHYS;
 
         scatterwalk_start(&walk->in, req->src);
diff --git a/crypto/xts.c b/crypto/xts.c
index d86c11a8c882..e31828ed0046 100644
--- a/crypto/xts.c
+++ b/crypto/xts.c
@@ -554,8 +554,10 @@ static int create(struct crypto_template *tmpl, struct rtattr **tb)
                 ctx->name[len - 1] = 0;
 
                 if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
-                             "xts(%s)", ctx->name) >= CRYPTO_MAX_ALG_NAME)
-                        return -ENAMETOOLONG;
+                             "xts(%s)", ctx->name) >= CRYPTO_MAX_ALG_NAME) {
+                        err = -ENAMETOOLONG;
+                        goto err_drop_spawn;
+                }
         } else
                 goto err_drop_spawn;
 
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 3fb8ff513461..e26ea209b63e 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -571,10 +571,9 @@ static int acpi_data_get_property_array(const struct acpi_device_data *data,
  *     }
  * }
  *
- * Calling this function with index %2 return %-ENOENT and with index %3
- * returns the last entry. If the property does not contain any more values
- * %-ENODATA is returned. The NULL entry must be single integer and
- * preferably contain value %0.
+ * Calling this function with index %2 or index %3 return %-ENOENT. If the
+ * property does not contain any more values %-ENOENT is returned. The NULL
+ * entry must be single integer and preferably contain value %0.
  *
  * Return: %0 on success, negative error code on failure.
  */
@@ -590,11 +589,11 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
 
         data = acpi_device_data_of_node(fwnode);
         if (!data)
-                return -EINVAL;
+                return -ENOENT;
 
         ret = acpi_data_get_property(data, propname, ACPI_TYPE_ANY, &obj);
         if (ret)
-                return ret;
+                return ret == -EINVAL ? -ENOENT : -EINVAL;
 
         /*
          * The simplest case is when the value is a single reference.  Just
@@ -606,7 +605,7 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
 
                 ret = acpi_bus_get_device(obj->reference.handle, &device);
                 if (ret)
-                        return ret;
+                        return ret == -ENODEV ? -EINVAL : ret;
 
                 args->adev = device;
                 args->nargs = 0;
@@ -622,8 +621,10 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
          * The index argument is then used to determine which reference
          * the caller wants (along with the arguments).
          */
-        if (obj->type != ACPI_TYPE_PACKAGE || index >= obj->package.count)
-                return -EPROTO;
+        if (obj->type != ACPI_TYPE_PACKAGE)
+                return -EINVAL;
+        if (index >= obj->package.count)
+                return -ENOENT;
 
         element = obj->package.elements;
         end = element + obj->package.count;
@@ -635,7 +636,7 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
                         ret = acpi_bus_get_device(element->reference.handle,
                                                   &device);
                         if (ret)
-                                return -ENODEV;
+                                return -EINVAL;
 
                         nargs = 0;
                         element++;
@@ -649,11 +650,11 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
                                 else if (type == ACPI_TYPE_LOCAL_REFERENCE)
                                         break;
                                 else
-                                        return -EPROTO;
+                                        return -EINVAL;
                         }
 
                         if (nargs > MAX_ACPI_REFERENCE_ARGS)
-                                return -EPROTO;
+                                return -EINVAL;
 
                         if (idx == index) {
                                 args->adev = device;
@@ -670,13 +671,13 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
                                 return -ENOENT;
                         element++;
                 } else {
-                        return -EPROTO;
+                        return -EINVAL;
                 }
 
                 idx++;
         }
 
-        return -ENODATA;
+        return -ENOENT;
 }
 EXPORT_SYMBOL_GPL(__acpi_node_get_property_reference);
 
diff --git a/drivers/base/node.c b/drivers/base/node.c
index 3855902f2c5b..aae2402f3791 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -27,13 +27,21 @@ static struct bus_type node_subsys = {
 
 static ssize_t node_read_cpumap(struct device *dev, bool list, char *buf)
 {
+        ssize_t n;
+        cpumask_var_t mask;
         struct node *node_dev = to_node(dev);
-        const struct cpumask *mask = cpumask_of_node(node_dev->dev.id);
 
         /* 2008/04/07: buf currently PAGE_SIZE, need 9 chars per 32 bits. */
         BUILD_BUG_ON((NR_CPUS/32 * 9) > (PAGE_SIZE-1));
 
-        return cpumap_print_to_pagebuf(list, buf, mask);
+        if (!alloc_cpumask_var(&mask, GFP_KERNEL))
+                return 0;
+
+        cpumask_and(mask, cpumask_of_node(node_dev->dev.id), cpu_online_mask);
+        n = cpumap_print_to_pagebuf(list, buf, mask);
+        free_cpumask_var(mask);
+
+        return n;
 }
 
 static inline ssize_t node_read_cpumask(struct device *dev,
diff --git a/drivers/base/property.c b/drivers/base/property.c
index d0b65bbe7e15..7ed99c1b2a8b 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -21,6 +21,7 @@
 #include <linux/phy.h>
 
 struct property_set {
+        struct device *dev;
         struct fwnode_handle fwnode;
         const struct property_entry *properties;
 };
@@ -682,6 +683,10 @@ EXPORT_SYMBOL_GPL(fwnode_property_match_string);
  * Caller is responsible to call fwnode_handle_put() on the returned
  * args->fwnode pointer.
  *
+ * Returns: %0 on success
+ *          %-ENOENT when the index is out of bounds, the index has an empty
+ *                   reference or the property was not found
+ *          %-EINVAL on parse error
  */
 int fwnode_property_get_reference_args(const struct fwnode_handle *fwnode,
                                        const char *prop, const char *nargs_prop,
@@ -891,6 +896,7 @@ static struct property_set *pset_copy_set(const struct property_set *pset)
 void device_remove_properties(struct device *dev)
 {
         struct fwnode_handle *fwnode;
+        struct property_set *pset;
 
         fwnode = dev_fwnode(dev);
         if (!fwnode)
@@ -900,16 +906,16 @@ void device_remove_properties(struct device *dev)
          * the pset. If there is no real firmware node (ACPI/DT) primary
          * will hold the pset.
          */
-        if (is_pset_node(fwnode)) {
+        pset = to_pset_node(fwnode);
+        if (pset) {
                 set_primary_fwnode(dev, NULL);
-                pset_free_set(to_pset_node(fwnode));
         } else {
-                fwnode = fwnode->secondary;
-                if (!IS_ERR(fwnode) && is_pset_node(fwnode)) {
+                pset = to_pset_node(fwnode->secondary);
+                if (pset && dev == pset->dev)
                         set_secondary_fwnode(dev, NULL);
-                        pset_free_set(to_pset_node(fwnode));
-                }
         }
+        if (pset && dev == pset->dev)
+                pset_free_set(pset);
 }
 EXPORT_SYMBOL_GPL(device_remove_properties);
 
@@ -938,6 +944,7 @@ int device_add_properties(struct device *dev,
 
         p->fwnode.ops = &pset_fwnode_ops;
         set_secondary_fwnode(dev, &p->fwnode);
+        p->dev = dev;
         return 0;
 }
 EXPORT_SYMBOL_GPL(device_add_properties);
diff --git a/drivers/crypto/axis/artpec6_crypto.c b/drivers/crypto/axis/artpec6_crypto.c
index d9fbbf01062b..0f9754e07719 100644
--- a/drivers/crypto/axis/artpec6_crypto.c
+++ b/drivers/crypto/axis/artpec6_crypto.c
@@ -349,8 +349,6 @@ struct artpec6_crypto_aead_req_ctx {
 /* The crypto framework makes it hard to avoid this global. */
 static struct device *artpec6_crypto_dev;
 
-static struct dentry *dbgfs_root;
-
 #ifdef CONFIG_FAULT_INJECTION
 static DECLARE_FAULT_ATTR(artpec6_crypto_fail_status_read);
 static DECLARE_FAULT_ATTR(artpec6_crypto_fail_dma_array_full);
@@ -2984,6 +2982,8 @@ struct dbgfs_u32 {
         char *desc;
 };
 
+static struct dentry *dbgfs_root;
+
 static void artpec6_crypto_init_debugfs(void)
 {
         dbgfs_root = debugfs_create_dir("artpec6_crypto", NULL);
diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c
index b585ce54a802..4835dd4a9e50 100644
--- a/drivers/crypto/stm32/stm32-hash.c
+++ b/drivers/crypto/stm32/stm32-hash.c
@@ -553,9 +553,9 @@ static int stm32_hash_dma_send(struct stm32_hash_dev *hdev)
 {
         struct stm32_hash_request_ctx *rctx = ahash_request_ctx(hdev->req);
         struct scatterlist sg[1], *tsg;
-        int err = 0, len = 0, reg, ncp;
+        int err = 0, len = 0, reg, ncp = 0;
         unsigned int i;
-        const u32 *buffer = (const u32 *)rctx->buffer;
+        u32 *buffer = (void *)rctx->buffer;
 
         rctx->sg = hdev->req->src;
         rctx->total = hdev->req->nbytes;
@@ -620,10 +620,13 @@ static int stm32_hash_dma_send(struct stm32_hash_dev *hdev)
                 reg |= HASH_CR_DMAA;
                 stm32_hash_write(hdev, HASH_CR, reg);
 
-                for (i = 0; i < DIV_ROUND_UP(ncp, sizeof(u32)); i++)
-                        stm32_hash_write(hdev, HASH_DIN, buffer[i]);
-
-                stm32_hash_set_nblw(hdev, ncp);
+                if (ncp) {
+                        memset(buffer + ncp, 0,
+                               DIV_ROUND_UP(ncp, sizeof(u32)) - ncp);
+                        writesl(hdev->io_base + HASH_DIN, buffer,
+                                DIV_ROUND_UP(ncp, sizeof(u32)));
+                }
+                stm32_hash_set_nblw(hdev, DIV_ROUND_UP(ncp, sizeof(u32)));
                 reg = stm32_hash_read(hdev, HASH_STR);
                 reg |= HASH_STR_DCAL;
                 stm32_hash_write(hdev, HASH_STR, reg);
diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
index 66fb40d0ebdb..03830634e141 100644
--- a/drivers/dma-buf/sync_file.c
+++ b/drivers/dma-buf/sync_file.c
@@ -383,7 +383,7 @@ err_put_fd:
         return err;
 }
 
-static void sync_fill_fence_info(struct dma_fence *fence,
+static int sync_fill_fence_info(struct dma_fence *fence,
                                  struct sync_fence_info *info)
 {
         strlcpy(info->obj_name, fence->ops->get_timeline_name(fence),
@@ -399,6 +399,8 @@ static void sync_fill_fence_info(struct dma_fence *fence,
                 test_bit(DMA_FENCE_FLAG_TIMESTAMP_BIT, &fence->flags) ?
                 ktime_to_ns(fence->timestamp) :
                 ktime_set(0, 0);
+
+        return info->status;
 }
 
 static long sync_file_ioctl_fence_info(struct sync_file *sync_file,
@@ -424,8 +426,12 @@ static long sync_file_ioctl_fence_info(struct sync_file *sync_file,
          * sync_fence_info and return the actual number of fences on
          * info->num_fences.
          */
-        if (!info.num_fences)
+        if (!info.num_fences) {
+                info.status = dma_fence_is_signaled(sync_file->fence);
                 goto no_fences;
+        } else {
+                info.status = 1;
+        }
 
         if (info.num_fences < num_fences)
                 return -EINVAL;
@@ -435,8 +441,10 @@ static long sync_file_ioctl_fence_info(struct sync_file *sync_file,
         if (!fence_info)
                 return -ENOMEM;
 
-        for (i = 0; i < num_fences; i++)
-                sync_fill_fence_info(fences[i], &fence_info[i]);
+        for (i = 0; i < num_fences; i++) {
+                int status = sync_fill_fence_info(fences[i], &fence_info[i]);
+                info.status = info.status <= 0 ? info.status : status;
+        }
 
         if (copy_to_user(u64_to_user_ptr(info.sync_fence_info), fence_info,
                          size)) {
@@ -446,7 +454,6 @@ static long sync_file_ioctl_fence_info(struct sync_file *sync_file,
 
 no_fences:
         sync_file_get_name(sync_file, info.name, sizeof(info.name));
-        info.status = dma_fence_is_signaled(sync_file->fence);
         info.num_fences = num_fences;
 
         if (copy_to_user((void __user *)arg, &info, sizeof(info)))
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 3388d54ba114..3f80f167ed56 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -453,7 +453,8 @@ config GPIO_TS4800
 config GPIO_THUNDERX
         tristate "Cavium ThunderX/OCTEON-TX GPIO"
         depends on ARCH_THUNDER || (64BIT && COMPILE_TEST)
-        depends on PCI_MSI && IRQ_DOMAIN_HIERARCHY
+        depends on PCI_MSI
+        select IRQ_DOMAIN_HIERARCHY
         select IRQ_FASTEOI_HIERARCHY_HANDLERS
         help
           Say yes here to support the on-chip GPIO lines on the ThunderX
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index dbf869fb63ce..3233b72b6828 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -518,7 +518,13 @@ static int omap_gpio_irq_type(struct irq_data *d, unsigned type)
         if (type & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH))
                 irq_set_handler_locked(d, handle_level_irq);
         else if (type & (IRQ_TYPE_EDGE_FALLING | IRQ_TYPE_EDGE_RISING))
-                irq_set_handler_locked(d, handle_edge_irq);
+                /*
+                 * Edge IRQs are already cleared/acked in irq_handler and
+                 * not need to be masked, as result handle_edge_irq()
+                 * logic is excessed here and may cause lose of interrupts.
+                 * So just use handle_simple_irq.
+                 */
+                irq_set_handler_locked(d, handle_simple_irq);
 
         return 0;
 
@@ -678,7 +684,7 @@ static void omap_gpio_free(struct gpio_chip *chip, unsigned offset)
 static irqreturn_t omap_gpio_irq_handler(int irq, void *gpiobank)
 {
         void __iomem *isr_reg = NULL;
-        u32 isr;
+        u32 enabled, isr, level_mask;
         unsigned int bit;
         struct gpio_bank *bank = gpiobank;
         unsigned long wa_lock_flags;
@@ -691,23 +697,21 @@ static irqreturn_t omap_gpio_irq_handler(int irq, void *gpiobank)
         pm_runtime_get_sync(bank->chip.parent);
 
         while (1) {
-                u32 isr_saved, level_mask = 0;
-                u32 enabled;
-
                 raw_spin_lock_irqsave(&bank->lock, lock_flags);
 
                 enabled = omap_get_gpio_irqbank_mask(bank);
-                isr_saved = isr = readl_relaxed(isr_reg) & enabled;
+                isr = readl_relaxed(isr_reg) & enabled;
 
                 if (bank->level_mask)
                         level_mask = bank->level_mask & enabled;
+                else
+                        level_mask = 0;
 
                 /* clear edge sensitive interrupts before handler(s) are
                 called so that we don't miss any interrupt occurred while
                 executing them */
-                omap_disable_gpio_irqbank(bank, isr_saved & ~level_mask);
-                omap_clear_gpio_irqbank(bank, isr_saved & ~level_mask);
-                omap_enable_gpio_irqbank(bank, isr_saved & ~level_mask);
+                if (isr & ~level_mask)
+                        omap_clear_gpio_irqbank(bank, isr & ~level_mask);
 
                 raw_spin_unlock_irqrestore(&bank->lock, lock_flags);
 
@@ -1010,7 +1014,7 @@ static void omap_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
 
 /*---------------------------------------------------------------------*/
 
-static void __init omap_gpio_show_rev(struct gpio_bank *bank)
+static void omap_gpio_show_rev(struct gpio_bank *bank)
 {
         static bool called;
         u32 rev;
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index 4d2113530735..eb4528c87c0b 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -203,7 +203,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
 
         if (pin <= 255) {
                 char ev_name[5];
-                sprintf(ev_name, "_%c%02X",
+                sprintf(ev_name, "_%c%02hhX",
                         agpio->triggering == ACPI_EDGE_SENSITIVE ? 'E' : 'L',
                         pin);
                 if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle)))
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 7ef6c28a34d9..bc746131987f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -834,7 +834,7 @@ int amdgpu_ttm_bind(struct ttm_buffer_object *bo, struct ttm_mem_reg *bo_mem)
         placement.busy_placement = &placements;
         placements.fpfn = 0;
         placements.lpfn = adev->mc.gart_size >> PAGE_SHIFT;
-        placements.flags = TTM_PL_MASK_CACHING | TTM_PL_FLAG_TT;
+        placements.flags = bo->mem.placement | TTM_PL_FLAG_TT;
 
         r = ttm_bo_mem_space(bo, &placement, &tmp, true, false);
         if (unlikely(r))
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 4e53aae9a1fb..0028591f3f95 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -2960,6 +2960,7 @@ out:
                 drm_modeset_backoff(&ctx);
         }
 
+        drm_atomic_state_put(state);
         drm_modeset_drop_locks(&ctx);
         drm_modeset_acquire_fini(&ctx);
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 19404c96eeb1..af289d35b77a 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3013,10 +3013,15 @@ void i915_gem_reset_finish(struct drm_i915_private *dev_priv)
 
 static void nop_submit_request(struct drm_i915_gem_request *request)
 {
+        unsigned long flags;
+
         GEM_BUG_ON(!i915_terminally_wedged(&request->i915->gpu_error));
         dma_fence_set_error(&request->fence, -EIO);
-        i915_gem_request_submit(request);
+
+        spin_lock_irqsave(&request->engine->timeline->lock, flags);
+        __i915_gem_request_submit(request);
         intel_engine_init_global_seqno(request->engine, request->global_seqno);
+        spin_unlock_irqrestore(&request->engine->timeline->lock, flags);
 }
 
 static void engine_set_wedged(struct intel_engine_cs *engine)
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 00c6aee0a9a1..5d4cd3d00564 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -1240,7 +1240,7 @@ static void parse_ddi_ports(struct drm_i915_private *dev_priv,
 {
         enum port port;
 
-        if (!HAS_DDI(dev_priv))
+        if (!HAS_DDI(dev_priv) && !IS_CHERRYVIEW(dev_priv))
                 return;
 
         if (!dev_priv->vbt.child_dev_num)
diff --git a/drivers/gpu/drm/i915/intel_color.c b/drivers/gpu/drm/i915/intel_color.c
index ff9ecd211abb..b8315bca852b 100644
--- a/drivers/gpu/drm/i915/intel_color.c
+++ b/drivers/gpu/drm/i915/intel_color.c
@@ -74,7 +74,7 @@
 #define I9XX_CSC_COEFF_1_0              \
         ((7 << 12) | I9XX_CSC_COEFF_FP(CTM_COEFF_1_0, 8))
 
-static bool crtc_state_is_legacy(struct drm_crtc_state *state)
+static bool crtc_state_is_legacy_gamma(struct drm_crtc_state *state)
 {
         return !state->degamma_lut &&
                 !state->ctm &&
@@ -288,7 +288,7 @@ static void cherryview_load_csc_matrix(struct drm_crtc_state *state)
         }
 
         mode = (state->ctm ? CGM_PIPE_MODE_CSC : 0);
-        if (!crtc_state_is_legacy(state)) {
+        if (!crtc_state_is_legacy_gamma(state)) {
                 mode |= (state->degamma_lut ? CGM_PIPE_MODE_DEGAMMA : 0) |
                         (state->gamma_lut ? CGM_PIPE_MODE_GAMMA : 0);
         }
@@ -469,7 +469,7 @@ static void broadwell_load_luts(struct drm_crtc_state *state)
         struct intel_crtc_state *intel_state = to_intel_crtc_state(state);
         enum pipe pipe = to_intel_crtc(state->crtc)->pipe;
 
-        if (crtc_state_is_legacy(state)) {
+        if (crtc_state_is_legacy_gamma(state)) {
                 haswell_load_luts(state);
                 return;
         }
@@ -529,7 +529,7 @@ static void glk_load_luts(struct drm_crtc_state *state)
 
         glk_load_degamma_lut(state);
 
-        if (crtc_state_is_legacy(state)) {
+        if (crtc_state_is_legacy_gamma(state)) {
                 haswell_load_luts(state);
                 return;
         }
@@ -551,7 +551,7 @@ static void cherryview_load_luts(struct drm_crtc_state *state)
         uint32_t i, lut_size;
         uint32_t word0, word1;
 
-        if (crtc_state_is_legacy(state)) {
+        if (crtc_state_is_legacy_gamma(state)) {
                 /* Turn off degamma/gamma on CGM block. */
                 I915_WRITE(CGM_PIPE_MODE(pipe),
                            (state->ctm ? CGM_PIPE_MODE_CSC : 0));
@@ -632,12 +632,10 @@ int intel_color_check(struct drm_crtc *crtc,
                 return 0;
 
         /*
-         * We also allow no degamma lut and a gamma lut at the legacy
+         * We also allow no degamma lut/ctm and a gamma lut at the legacy
          * size (256 entries).
          */
-        if (!crtc_state->degamma_lut &&
-            crtc_state->gamma_lut &&
-            crtc_state->gamma_lut->length == LEGACY_LUT_LENGTH)
+        if (crtc_state_is_legacy_gamma(crtc_state))
                 return 0;
 
         return -EINVAL;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 64f7b51ed97c..5c7828c52d12 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -10245,13 +10245,10 @@ struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
 {
         struct drm_i915_private *dev_priv = to_i915(dev);
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        enum transcoder cpu_transcoder = intel_crtc->config->cpu_transcoder;
+        enum transcoder cpu_transcoder;
         struct drm_display_mode *mode;
         struct intel_crtc_state *pipe_config;
-        int htot = I915_READ(HTOTAL(cpu_transcoder));
-        int hsync = I915_READ(HSYNC(cpu_transcoder));
-        int vtot = I915_READ(VTOTAL(cpu_transcoder));
-        int vsync = I915_READ(VSYNC(cpu_transcoder));
+        u32 htot, hsync, vtot, vsync;
         enum pipe pipe = intel_crtc->pipe;
 
         mode = kzalloc(sizeof(*mode), GFP_KERNEL);
@@ -10279,6 +10276,13 @@ struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
         i9xx_crtc_clock_get(intel_crtc, pipe_config);
 
         mode->clock = pipe_config->port_clock / pipe_config->pixel_multiplier;
+
+        cpu_transcoder = pipe_config->cpu_transcoder;
+        htot = I915_READ(HTOTAL(cpu_transcoder));
+        hsync = I915_READ(HSYNC(cpu_transcoder));
+        vtot = I915_READ(VTOTAL(cpu_transcoder));
+        vsync = I915_READ(VSYNC(cpu_transcoder));
+
         mode->hdisplay = (htot & 0xffff) + 1;
         mode->htotal = ((htot & 0xffff0000) >> 16) + 1;
         mode->hsync_start = (hsync & 0xffff) + 1;
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 64134947c0aa..203198659ab2 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -2307,8 +2307,8 @@ static void edp_panel_off(struct intel_dp *intel_dp)
         I915_WRITE(pp_ctrl_reg, pp);
         POSTING_READ(pp_ctrl_reg);
 
-        intel_dp->panel_power_off_time = ktime_get_boottime();
         wait_panel_off(intel_dp);
+        intel_dp->panel_power_off_time = ktime_get_boottime();
 
         /* We got a reference when we enabled the VDD. */
         intel_display_power_put(dev_priv, intel_dp->aux_power_domain);
@@ -5273,7 +5273,7 @@ intel_dp_init_panel_power_sequencer(struct drm_device *dev,
          * seems sufficient to avoid this problem.
          */
         if (dev_priv->quirks & QUIRK_INCREASE_T12_DELAY) {
-                vbt.t11_t12 = max_t(u16, vbt.t11_t12, 900 * 10);
+                vbt.t11_t12 = max_t(u16, vbt.t11_t12, 1300 * 10);
                 DRM_DEBUG_KMS("Increasing T12 panel delay as per the quirk to %d\n",
                               vbt.t11_t12);
         }
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index b3a087cb0860..49577eba8e7e 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -368,7 +368,7 @@ static void hsw_power_well_enable(struct drm_i915_private *dev_priv,
 {
         enum i915_power_well_id id = power_well->id;
         bool wait_fuses = power_well->hsw.has_fuses;
-        enum skl_power_gate pg;
+        enum skl_power_gate uninitialized_var(pg);
         u32 val;
 
         if (wait_fuses) {
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index dbb31a014419..deaf869374ea 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -248,7 +248,7 @@ disable_clks:
         clk_disable_unprepare(ahb_clk);
 disable_gdsc:
         regulator_disable(gdsc_reg);
-        pm_runtime_put_autosuspend(dev);
+        pm_runtime_put_sync(dev);
 put_clk:
         clk_put(ahb_clk);
 put_gdsc:
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
index c2bdad88447e..824067d2d427 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
@@ -83,6 +83,8 @@ const struct mdp5_cfg_hw msm8x74v1_config = {
                                   .caps = MDP_LM_CAP_WB },
                              },
                 .nb_stages = 5,
+                .max_width = 2048,
+                .max_height = 0xFFFF,
         },
         .dspp = {
                 .count = 3,
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index 6fcb58ab718c..440977677001 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -804,8 +804,6 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
 
         spin_unlock_irqrestore(&mdp5_crtc->cursor.lock, flags);
 
-        pm_runtime_put_autosuspend(&pdev->dev);
-
 set_cursor:
         ret = mdp5_ctl_set_cursor(ctl, pipeline, 0, cursor_enable);
         if (ret) {
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index f15821a0d900..ea5bb0e1632c 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -610,17 +610,6 @@ int msm_gem_sync_object(struct drm_gem_object *obj,
         struct dma_fence *fence;
         int i, ret;
 
-        if (!exclusive) {
-                /* NOTE: _reserve_shared() must happen before _add_shared_fence(),
-                 * which makes this a slightly strange place to call it.  OTOH this
-                 * is a convenient can-fail point to hook it in.  (And similar to
-                 * how etnaviv and nouveau handle this.)
-                 */
-                ret = reservation_object_reserve_shared(msm_obj->resv);
-                if (ret)
-                        return ret;
-        }
-
         fobj = reservation_object_get_list(msm_obj->resv);
         if (!fobj || (fobj->shared_count == 0)) {
                 fence = reservation_object_get_excl(msm_obj->resv);
@@ -1045,10 +1034,10 @@ static void *_msm_gem_kernel_new(struct drm_device *dev, uint32_t size,
         }
 
         vaddr = msm_gem_get_vaddr(obj);
-        if (!vaddr) {
+        if (IS_ERR(vaddr)) {
                 msm_gem_put_iova(obj, aspace);
                 drm_gem_object_unreference(obj);
-                return ERR_PTR(-ENOMEM);
+                return ERR_CAST(vaddr);
         }
 
         if (bo)
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 5d0a75d4b249..93535cac0676 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -221,7 +221,7 @@ fail:
         return ret;
 }
 
-static int submit_fence_sync(struct msm_gem_submit *submit)
+static int submit_fence_sync(struct msm_gem_submit *submit, bool no_implicit)
 {
         int i, ret = 0;
 
@@ -229,6 +229,20 @@ static int submit_fence_sync(struct msm_gem_submit *submit)
                 struct msm_gem_object *msm_obj = submit->bos[i].obj;
                 bool write = submit->bos[i].flags & MSM_SUBMIT_BO_WRITE;
 
+                if (!write) {
+                        /* NOTE: _reserve_shared() must happen before
+                         * _add_shared_fence(), which makes this a slightly
+                         * strange place to call it.  OTOH this is a
+                         * convenient can-fail point to hook it in.
+                         */
+                        ret = reservation_object_reserve_shared(msm_obj->resv);
+                        if (ret)
+                                return ret;
+                }
+
+                if (no_implicit)
+                        continue;
+
                 ret = msm_gem_sync_object(&msm_obj->base, submit->gpu->fctx, write);
                 if (ret)
                         break;
@@ -451,11 +465,9 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
         if (ret)
                 goto out;
 
-        if (!(args->flags & MSM_SUBMIT_NO_IMPLICIT)) {
-                ret = submit_fence_sync(submit);
-                if (ret)
-                        goto out;
-        }
+        ret = submit_fence_sync(submit, !!(args->flags & MSM_SUBMIT_NO_IMPLICIT));
+        if (ret)
+                goto out;
 
         ret = submit_pin_objects(submit);
         if (ret)
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index ffbff27600e0..6a887032c66a 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -718,7 +718,8 @@ void msm_gpu_cleanup(struct msm_gpu *gpu)
                         msm_gem_put_iova(gpu->rb->bo, gpu->aspace);
                 msm_ringbuffer_destroy(gpu->rb);
         }
-        if (gpu->aspace) {
+
+        if (!IS_ERR_OR_NULL(gpu->aspace)) {
                 gpu->aspace->mmu->funcs->detach(gpu->aspace->mmu,
                         NULL, 0);
                 msm_gem_address_space_put(gpu->aspace);
diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
index 0366b8092f97..ec56794ad039 100644
--- a/drivers/gpu/drm/msm/msm_rd.c
+++ b/drivers/gpu/drm/msm/msm_rd.c
@@ -111,10 +111,14 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz)
 
                 wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0);
 
+                /* Note that smp_load_acquire() is not strictly required
+                 * as CIRC_SPACE_TO_END() does not access the tail more
+                 * than once.
+                 */
                 n = min(sz, circ_space_to_end(&rd->fifo));
                 memcpy(fptr, ptr, n);
 
-                fifo->head = (fifo->head + n) & (BUF_SZ - 1);
+                smp_store_release(&fifo->head, (fifo->head + n) & (BUF_SZ - 1));
                 sz  -= n;
                 ptr += n;
 
@@ -145,13 +149,17 @@ static ssize_t rd_read(struct file *file, char __user *buf,
         if (ret)
                 goto out;
 
+        /* Note that smp_load_acquire() is not strictly required
+         * as CIRC_CNT_TO_END() does not access the head more than
+         * once.
+         */
         n = min_t(int, sz, circ_count_to_end(&rd->fifo));
         if (copy_to_user(buf, fptr, n)) {
                 ret = -EFAULT;
                 goto out;
         }
 
-        fifo->tail = (fifo->tail + n) & (BUF_SZ - 1);
+        smp_store_release(&fifo->tail, (fifo->tail + n) & (BUF_SZ - 1));
         *ppos += n;
 
         wake_up_all(&rd->fifo_event);
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 6a573d21d3cc..658fa2d3e40c 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -405,6 +405,14 @@ int ipu_idmac_lock_enable(struct ipuv3_channel *channel, int num_bursts)
                 return -EINVAL;
         }
 
+        /*
+         * IPUv3EX / i.MX51 has a different register layout, and on IPUv3M /
+         * i.MX53 channel arbitration locking doesn't seem to work properly.
+         * Allow enabling the lock feature on IPUv3H / i.MX6 only.
+         */
+        if (bursts && ipu->ipu_type != IPUV3H)
+                return -EINVAL;
+
         for (i = 0; i < ARRAY_SIZE(idmac_lock_en_info); i++) {
                 if (channel->num == idmac_lock_en_info[i].chnum)
                         break;
diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
index c35f74c83065..c860a7997cb5 100644
--- a/drivers/gpu/ipu-v3/ipu-pre.c
+++ b/drivers/gpu/ipu-v3/ipu-pre.c
@@ -73,6 +73,14 @@
 #define  IPU_PRE_STORE_ENG_CTRL_WR_NUM_BYTES(v)         ((v & 0x7) << 1)
 #define  IPU_PRE_STORE_ENG_CTRL_OUTPUT_ACTIVE_BPP(v)    ((v & 0x3) << 4)
 
+#define IPU_PRE_STORE_ENG_STATUS                        0x120
+#define  IPU_PRE_STORE_ENG_STATUS_STORE_BLOCK_X_MASK    0xffff
+#define  IPU_PRE_STORE_ENG_STATUS_STORE_BLOCK_X_SHIFT   0
+#define  IPU_PRE_STORE_ENG_STATUS_STORE_BLOCK_Y_MASK    0x3fff
+#define  IPU_PRE_STORE_ENG_STATUS_STORE_BLOCK_Y_SHIFT   16
+#define  IPU_PRE_STORE_ENG_STATUS_STORE_FIFO_FULL       (1 << 30)
+#define  IPU_PRE_STORE_ENG_STATUS_STORE_FIELD           (1 << 31)
+
 #define IPU_PRE_STORE_ENG_SIZE                          0x130
 #define  IPU_PRE_STORE_ENG_SIZE_INPUT_WIDTH(v)          ((v & 0xffff) << 0)
 #define  IPU_PRE_STORE_ENG_SIZE_INPUT_HEIGHT(v)         ((v & 0xffff) << 16)
@@ -93,6 +101,7 @@ struct ipu_pre {
         dma_addr_t              buffer_paddr;
         void                    *buffer_virt;
         bool                    in_use;
+        unsigned int            safe_window_end;
 };
 
 static DEFINE_MUTEX(ipu_pre_list_mutex);
@@ -160,6 +169,9 @@ void ipu_pre_configure(struct ipu_pre *pre, unsigned int width,
         u32 active_bpp = info->cpp[0] >> 1;
         u32 val;
 
+        /* calculate safe window for ctrl register updates */
+        pre->safe_window_end = height - 2;
+
         writel(bufaddr, pre->regs + IPU_PRE_CUR_BUF);
         writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
 
@@ -199,7 +211,24 @@ void ipu_pre_configure(struct ipu_pre *pre, unsigned int width,
 
 void ipu_pre_update(struct ipu_pre *pre, unsigned int bufaddr)
 {
+        unsigned long timeout = jiffies + msecs_to_jiffies(5);
+        unsigned short current_yblock;
+        u32 val;
+
         writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
+
+        do {
+                if (time_after(jiffies, timeout)) {
+                        dev_warn(pre->dev, "timeout waiting for PRE safe window\n");
+                        return;
+                }
+
+                val = readl(pre->regs + IPU_PRE_STORE_ENG_STATUS);
+                current_yblock =
+                        (val >> IPU_PRE_STORE_ENG_STATUS_STORE_BLOCK_Y_SHIFT) &
+                        IPU_PRE_STORE_ENG_STATUS_STORE_BLOCK_Y_MASK;
+        } while (current_yblock == 0 || current_yblock >= pre->safe_window_end);
+
         writel(IPU_PRE_CTRL_SDW_UPDATE, pre->regs + IPU_PRE_CTRL_SET);
 }
 
diff --git a/drivers/gpu/ipu-v3/ipu-prg.c b/drivers/gpu/ipu-v3/ipu-prg.c
index ecc9ea44dc50..0013ca9f72c8 100644
--- a/drivers/gpu/ipu-v3/ipu-prg.c
+++ b/drivers/gpu/ipu-v3/ipu-prg.c
@@ -14,6 +14,7 @@
 #include <drm/drm_fourcc.h>
 #include <linux/clk.h>
 #include <linux/err.h>
+#include <linux/iopoll.h>
 #include <linux/mfd/syscon.h>
 #include <linux/mfd/syscon/imx6q-iomuxc-gpr.h>
 #include <linux/module.h>
@@ -329,6 +330,12 @@ int ipu_prg_channel_configure(struct ipuv3_channel *ipu_chan,
         val = IPU_PRG_REG_UPDATE_REG_UPDATE;
         writel(val, prg->regs + IPU_PRG_REG_UPDATE);
 
+        /* wait for both double buffers to be filled */
+        readl_poll_timeout(prg->regs + IPU_PRG_STATUS, val,
+                           (val & IPU_PRG_STATUS_BUFFER0_READY(prg_chan)) &&
+                           (val & IPU_PRG_STATUS_BUFFER1_READY(prg_chan)),
+                           5, 1000);
+
         clk_disable_unprepare(prg->clk_ipg);
 
         chan->enabled = true;
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 0a3117cc29e7..374301fcbc86 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -281,6 +281,7 @@ config HID_ELECOM
         Support for ELECOM devices:
           - BM084 Bluetooth Mouse
           - DEFT Trackball (Wired and wireless)
+          - HUGE Trackball (Wired and wireless)
 
 config HID_ELO
         tristate "ELO USB 4000/4500 touchscreen"
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 9bc91160819b..330ca983828b 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2032,6 +2032,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRED) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRELESS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_HUGE_WIRED) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_HUGE_WIRELESS) },
 #endif
 #if IS_ENABLED(CONFIG_HID_ELO)
         { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
index e2c7465df69f..54aeea57d209 100644
--- a/drivers/hid/hid-elecom.c
+++ b/drivers/hid/hid-elecom.c
@@ -3,6 +3,7 @@
  *  Copyright (c) 2010 Richard Nauber <Richard.Nauber@gmail.com>
  *  Copyright (c) 2016 Yuxuan Shui <yshuiv7@gmail.com>
  *  Copyright (c) 2017 Diego Elio Pettenò <flameeyes@flameeyes.eu>
+ *  Copyright (c) 2017 Alex Manoussakis <amanou@gnu.org>
  */
 
 /*
@@ -32,9 +33,11 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 break;
         case USB_DEVICE_ID_ELECOM_DEFT_WIRED:
         case USB_DEVICE_ID_ELECOM_DEFT_WIRELESS:
-                /* The DEFT trackball has eight buttons, but its descriptor only
-                 * reports five, disabling the three Fn buttons on the top of
-                 * the mouse.
+        case USB_DEVICE_ID_ELECOM_HUGE_WIRED:
+        case USB_DEVICE_ID_ELECOM_HUGE_WIRELESS:
+                /* The DEFT/HUGE trackball has eight buttons, but its descriptor
+                 * only reports five, disabling the three Fn buttons on the top
+                 * of the mouse.
                  *
                  * Apply the following diff to the descriptor:
                  *
@@ -62,7 +65,7 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                  * End Collection,                     End Collection,
                  */
                 if (*rsize == 213 && rdesc[13] == 5 && rdesc[21] == 5) {
-                        hid_info(hdev, "Fixing up Elecom DEFT Fn buttons\n");
+                        hid_info(hdev, "Fixing up Elecom DEFT/HUGE Fn buttons\n");
                         rdesc[13] = 8; /* Button/Variable Report Count */
                         rdesc[21] = 8; /* Button/Variable Usage Maximum */
                         rdesc[29] = 0; /* Button/Constant Report Count */
@@ -76,6 +79,8 @@ static const struct hid_device_id elecom_devices[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRED) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRELESS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_HUGE_WIRED) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_HUGE_WIRELESS) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, elecom_devices);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index a98919199858..be2e005c3c51 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -368,6 +368,8 @@
 #define USB_DEVICE_ID_ELECOM_BM084      0x0061
 #define USB_DEVICE_ID_ELECOM_DEFT_WIRED 0x00fe
 #define USB_DEVICE_ID_ELECOM_DEFT_WIRELESS      0x00ff
+#define USB_DEVICE_ID_ELECOM_HUGE_WIRED 0x010c
+#define USB_DEVICE_ID_ELECOM_HUGE_WIRELESS      0x010d
 
 #define USB_VENDOR_ID_DREAM_CHEEKY      0x1d34
 #define USB_DEVICE_ID_DREAM_CHEEKY_WN   0x0004
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 089bad8a9a21..045b5da9b992 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -975,6 +975,8 @@ static int usbhid_parse(struct hid_device *hid)
         unsigned int rsize = 0;
         char *rdesc;
         int ret, n;
+        int num_descriptors;
+        size_t offset = offsetof(struct hid_descriptor, desc);
 
         quirks = usbhid_lookup_quirk(le16_to_cpu(dev->descriptor.idVendor),
                         le16_to_cpu(dev->descriptor.idProduct));
@@ -997,10 +999,18 @@ static int usbhid_parse(struct hid_device *hid)
                 return -ENODEV;
         }
 
+        if (hdesc->bLength < sizeof(struct hid_descriptor)) {
+                dbg_hid("hid descriptor is too short\n");
+                return -EINVAL;
+        }
+
         hid->version = le16_to_cpu(hdesc->bcdHID);
         hid->country = hdesc->bCountryCode;
 
-        for (n = 0; n < hdesc->bNumDescriptors; n++)
+        num_descriptors = min_t(int, hdesc->bNumDescriptors,
+               (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));
+
+        for (n = 0; n < num_descriptors; n++)
                 if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
                         rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
 
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 51f8215877f5..8e8874d23717 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -2773,14 +2773,16 @@ int __init amd_iommu_init_api(void)
 
 int __init amd_iommu_init_dma_ops(void)
 {
-        swiotlb        = iommu_pass_through ? 1 : 0;
+        swiotlb        = (iommu_pass_through || sme_me_mask) ? 1 : 0;
         iommu_detected = 1;
 
         /*
          * In case we don't initialize SWIOTLB (actually the common case
-         * when AMD IOMMU is enabled), make sure there are global
-         * dma_ops set as a fall-back for devices not handled by this
-         * driver (for example non-PCI devices).
+         * when AMD IOMMU is enabled and SME is not active), make sure there
+         * are global dma_ops set as a fall-back for devices not handled by
+         * this driver (for example non-PCI devices). When SME is active,
+         * make sure that swiotlb variable remains set so the global dma_ops
+         * continue to be SWIOTLB.
          */
         if (!swiotlb)
                 dma_ops = &nommu_dma_ops;
@@ -3046,6 +3048,7 @@ static size_t amd_iommu_unmap(struct iommu_domain *dom, unsigned long iova,
         mutex_unlock(&domain->api_lock);
 
         domain_flush_tlb_pde(domain);
+        domain_flush_complete(domain);
 
         return unmap_size;
 }
diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
index f596fcc32898..25c2c75f5332 100644
--- a/drivers/iommu/exynos-iommu.c
+++ b/drivers/iommu/exynos-iommu.c
@@ -709,7 +709,7 @@ static const struct dev_pm_ops sysmmu_pm_ops = {
                                 pm_runtime_force_resume)
 };
 
-static const struct of_device_id sysmmu_of_match[] __initconst = {
+static const struct of_device_id sysmmu_of_match[] = {
         { .compatible   = "samsung,exynos-sysmmu", },
         { },
 };
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 260d33c0f26c..63897531cd75 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1781,8 +1781,12 @@ bool of_console_check(struct device_node *dn, char *name, int index)
 {
         if (!dn || dn != of_stdout || console_set_on_cmdline)
                 return false;
-        return !add_preferred_console(name, index,
-                                      kstrdup(of_stdout_options, GFP_KERNEL));
+
+        /*
+         * XXX: cast `options' to char pointer to suppress complication
+         * warnings: printk, UART and console drivers expect char pointer.
+         */
+        return !add_preferred_console(name, index, (char *)of_stdout_options);
 }
 EXPORT_SYMBOL_GPL(of_console_check);
 
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index d507c3569a88..32771c2ced7b 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -25,7 +25,7 @@
 #include <linux/sort.h>
 #include <linux/slab.h>
 
-#define MAX_RESERVED_REGIONS    16
+#define MAX_RESERVED_REGIONS    32
 static struct reserved_mem reserved_mem[MAX_RESERVED_REGIONS];
 static int reserved_mem_count;
 
diff --git a/drivers/of/property.c b/drivers/of/property.c
index fbb72116e9d4..264c355ba1ff 100644
--- a/drivers/of/property.c
+++ b/drivers/of/property.c
@@ -954,7 +954,7 @@ of_fwnode_graph_get_port_parent(struct fwnode_handle *fwnode)
         struct device_node *np;
 
         /* Get the parent of the port */
-        np = of_get_next_parent(to_of_node(fwnode));
+        np = of_get_parent(to_of_node(fwnode));
         if (!np)
                 return NULL;
 
diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
index 89f4e3d072d7..26ed0c08f209 100644
--- a/drivers/pci/host/pci-aardvark.c
+++ b/drivers/pci/host/pci-aardvark.c
@@ -935,6 +935,8 @@ static int advk_pcie_probe(struct platform_device *pdev)
         bridge->sysdata = pcie;
         bridge->busnr = 0;
         bridge->ops = &advk_pcie_ops;
+        bridge->map_irq = of_irq_parse_and_map_pci;
+        bridge->swizzle_irq = pci_common_swizzle;
 
         ret = pci_scan_root_bus_bridge(bridge);
         if (ret < 0) {
diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c
index 9c40da54f88a..1987fec1f126 100644
--- a/drivers/pci/host/pci-tegra.c
+++ b/drivers/pci/host/pci-tegra.c
@@ -233,6 +233,7 @@ struct tegra_msi {
         struct msi_controller chip;
         DECLARE_BITMAP(used, INT_PCI_MSI_NR);
         struct irq_domain *domain;
+        unsigned long pages;
         struct mutex lock;
         u64 phys;
         int irq;
@@ -1529,22 +1530,9 @@ static int tegra_pcie_enable_msi(struct tegra_pcie *pcie)
                 goto err;
         }
 
-        /*
-         * The PCI host bridge on Tegra contains some logic that intercepts
-         * MSI writes, which means that the MSI target address doesn't have
-         * to point to actual physical memory. Rather than allocating one 4
-         * KiB page of system memory that's never used, we can simply pick
-         * an arbitrary address within an area reserved for system memory
-         * in the FPCI address map.
-         *
-         * However, in order to avoid confusion, we pick an address that
-         * doesn't map to physical memory. The FPCI address map reserves a
-         * 1012 GiB region for system memory and memory-mapped I/O. Since
-         * none of the Tegra SoCs that contain this PCI host bridge can
-         * address more than 16 GiB of system memory, the last 4 KiB of
-         * these 1012 GiB is a good candidate.
-         */
-        msi->phys = 0xfcfffff000;
+        /* setup AFI/FPCI range */
+        msi->pages = __get_free_pages(GFP_KERNEL, 0);
+        msi->phys = virt_to_phys((void *)msi->pages);
 
         afi_writel(pcie, msi->phys >> soc->msi_base_shift, AFI_MSI_FPCI_BAR_ST);
         afi_writel(pcie, msi->phys, AFI_MSI_AXI_BAR_ST);
@@ -1596,6 +1584,8 @@ static int tegra_pcie_disable_msi(struct tegra_pcie *pcie)
         afi_writel(pcie, 0, AFI_MSI_EN_VEC6);
         afi_writel(pcie, 0, AFI_MSI_EN_VEC7);
 
+        free_pages(msi->pages, 0);
+
         if (msi->irq > 0)
                 free_irq(msi->irq, pcie);
 
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index 1778cf4f81c7..82cd8b08d71f 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -100,6 +100,7 @@ config PINCTRL_AMD
         tristate "AMD GPIO pin control"
         depends on GPIOLIB
         select GPIOLIB_IRQCHIP
+        select PINMUX
         select PINCONF
         select GENERIC_PINCONF
         help
diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index 0944310225db..ff782445dfb7 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -373,16 +373,12 @@ static void bcm2835_gpio_irq_handle_bank(struct bcm2835_pinctrl *pc,
         unsigned long events;
         unsigned offset;
         unsigned gpio;
-        unsigned int type;
 
         events = bcm2835_gpio_rd(pc, GPEDS0 + bank * 4);
         events &= mask;
         events &= pc->enabled_irq_map[bank];
         for_each_set_bit(offset, &events, 32) {
                 gpio = (32 * bank) + offset;
-                /* FIXME: no clue why the code looks up the type here */
-                type = pc->irq_type[gpio];
-
                 generic_handle_irq(irq_linear_revmap(pc->gpio_chip.irqdomain,
                                                      gpio));
         }
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 04e929fd0ffe..fadbca907c7c 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1577,6 +1577,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
         struct gpio_chip *chip = &pctrl->chip;
         bool need_valid_mask = !dmi_check_system(chv_no_valid_mask);
         int ret, i, offset;
+        int irq_base;
 
         *chip = chv_gpio_chip;
 
@@ -1622,7 +1623,18 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
         /* Clear all interrupts */
         chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
 
-        ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
+        if (!need_valid_mask) {
+                irq_base = devm_irq_alloc_descs(pctrl->dev, -1, 0,
+                                                chip->ngpio, NUMA_NO_NODE);
+                if (irq_base < 0) {
+                        dev_err(pctrl->dev, "Failed to allocate IRQ numbers\n");
+                        return irq_base;
+                }
+        } else {
+                irq_base = 0;
+        }
+
+        ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, irq_base,
                                    handle_bad_irq, IRQ_TYPE_NONE);
         if (ret) {
                 dev_err(pctrl->dev, "failed to add IRQ chip\n");
diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
index df63e44526ac..bf04479456a0 100644
--- a/drivers/remoteproc/Kconfig
+++ b/drivers/remoteproc/Kconfig
@@ -109,6 +109,7 @@ config QCOM_Q6V5_PIL
         depends on OF && ARCH_QCOM
         depends on QCOM_SMEM
         depends on RPMSG_QCOM_SMD || (COMPILE_TEST && RPMSG_QCOM_SMD=n)
+        depends on RPMSG_QCOM_GLINK_SMEM || RPMSG_QCOM_GLINK_SMEM=n
         select MFD_SYSCON
         select QCOM_RPROC_COMMON
         select QCOM_SCM
@@ -120,6 +121,7 @@ config QCOM_WCNSS_PIL
         tristate "Qualcomm WCNSS Peripheral Image Loader"
         depends on OF && ARCH_QCOM
         depends on RPMSG_QCOM_SMD || (COMPILE_TEST && RPMSG_QCOM_SMD=n)
+        depends on RPMSG_QCOM_GLINK_SMEM || RPMSG_QCOM_GLINK_SMEM=n
         depends on QCOM_SMEM
         select QCOM_MDT_LOADER
         select QCOM_RPROC_COMMON
diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c
index 612d91403341..633268e9d550 100644
--- a/drivers/remoteproc/imx_rproc.c
+++ b/drivers/remoteproc/imx_rproc.c
@@ -264,15 +264,14 @@ static int imx_rproc_addr_init(struct imx_rproc *priv,
                 if (!(att->flags & ATT_OWN))
                         continue;
 
-                if (b > IMX7D_RPROC_MEM_MAX)
+                if (b >= IMX7D_RPROC_MEM_MAX)
                         break;
 
                 priv->mem[b].cpu_addr = devm_ioremap(&pdev->dev,
                                                      att->sa, att->size);
-                if (IS_ERR(priv->mem[b].cpu_addr)) {
+                if (!priv->mem[b].cpu_addr) {
                         dev_err(dev, "devm_ioremap_resource failed\n");
-                        err = PTR_ERR(priv->mem[b].cpu_addr);
-                        return err;
+                        return -ENOMEM;
                 }
                 priv->mem[b].sys_addr = att->sa;
                 priv->mem[b].size = att->size;
@@ -296,7 +295,7 @@ static int imx_rproc_addr_init(struct imx_rproc *priv,
                         return err;
                 }
 
-                if (b > IMX7D_RPROC_MEM_MAX)
+                if (b >= IMX7D_RPROC_MEM_MAX)
                         break;
 
                 priv->mem[b].cpu_addr = devm_ioremap_resource(&pdev->dev, &res);
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index 5a5e927ea50f..5dcc9bf1c5bc 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -635,19 +635,18 @@ qcom_glink_alloc_intent(struct qcom_glink *glink,
         unsigned long flags;
 
         intent = kzalloc(sizeof(*intent), GFP_KERNEL);
-
         if (!intent)
                 return NULL;
 
         intent->data = kzalloc(size, GFP_KERNEL);
         if (!intent->data)
-                return NULL;
+                goto free_intent;
 
         spin_lock_irqsave(&channel->intent_lock, flags);
         ret = idr_alloc_cyclic(&channel->liids, intent, 1, -1, GFP_ATOMIC);
         if (ret < 0) {
                 spin_unlock_irqrestore(&channel->intent_lock, flags);
-                return NULL;
+                goto free_data;
         }
         spin_unlock_irqrestore(&channel->intent_lock, flags);
 
@@ -656,6 +655,12 @@ qcom_glink_alloc_intent(struct qcom_glink *glink,
         intent->reuse = reuseable;
 
         return intent;
+
+free_data:
+        kfree(intent->data);
+free_intent:
+        kfree(intent);
+        return NULL;
 }
 
 static void qcom_glink_handle_rx_done(struct qcom_glink *glink,
@@ -1197,7 +1202,7 @@ static int qcom_glink_request_intent(struct qcom_glink *glink,
 
         ret = qcom_glink_tx(glink, &cmd, sizeof(cmd), NULL, 0, true);
         if (ret)
-                return ret;
+                goto unlock;
 
         ret = wait_for_completion_timeout(&channel->intent_req_comp, 10 * HZ);
         if (!ret) {
@@ -1207,6 +1212,7 @@ static int qcom_glink_request_intent(struct qcom_glink *glink,
                 ret = channel->intent_req_result ? 0 : -ECANCELED;
         }
 
+unlock:
         mutex_unlock(&channel->intent_req_lock);
         return ret;
 }
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 2fe216b276e2..84a8ac2a779f 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -694,10 +694,8 @@ int tty_ldisc_reinit(struct tty_struct *tty, int disc)
         tty_set_termios_ldisc(tty, disc);
         retval = tty_ldisc_open(tty, tty->ldisc);
         if (retval) {
-                if (!WARN_ON(disc == N_TTY)) {
-                        tty_ldisc_put(tty->ldisc);
-                        tty->ldisc = NULL;
-                }
+                tty_ldisc_put(tty->ldisc);
+                tty->ldisc = NULL;
         }
         return retval;
 }
@@ -752,8 +750,9 @@ void tty_ldisc_hangup(struct tty_struct *tty, bool reinit)
 
         if (tty->ldisc) {
                 if (reinit) {
-                        if (tty_ldisc_reinit(tty, tty->termios.c_line) < 0)
-                                tty_ldisc_reinit(tty, N_TTY);
+                        if (tty_ldisc_reinit(tty, tty->termios.c_line) < 0 &&
+                            tty_ldisc_reinit(tty, N_TTY) < 0)
+                                WARN_ON(tty_ldisc_reinit(tty, N_NULL) < 0);
                 } else
                         tty_ldisc_kill(tty);
         }
diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
index adaf6f6dd858..e1cbdfdb7c68 100644
--- a/fs/9p/vfs_addr.c
+++ b/fs/9p/vfs_addr.c
@@ -310,9 +310,13 @@ static int v9fs_write_end(struct file *filp, struct address_space *mapping,
 
         p9_debug(P9_DEBUG_VFS, "filp %p, mapping %p\n", filp, mapping);
 
-        if (unlikely(copied < len && !PageUptodate(page))) {
-                copied = 0;
-                goto out;
+        if (!PageUptodate(page)) {
+                if (unlikely(copied < len)) {
+                        copied = 0;
+                        goto out;
+                } else if (len == PAGE_SIZE) {
+                        SetPageUptodate(page);
+                }
         }
         /*
          * No need to use i_size_read() here, the i_size
diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
index 2a46762def31..a7c5a9861bef 100644
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -596,7 +596,7 @@ static void bm_evict_inode(struct inode *inode)
 {
         Node *e = inode->i_private;
 
-        if (e->flags & MISC_FMT_OPEN_FILE)
+        if (e && e->flags & MISC_FMT_OPEN_FILE)
                 filp_close(e->interp_file, NULL);
 
         clear_inode(inode);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 93d088ffc05c..789f55e851ae 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -716,10 +716,12 @@ int bdev_write_page(struct block_device *bdev, sector_t sector,
 
         set_page_writeback(page);
         result = ops->rw_page(bdev, sector + get_start_sect(bdev), page, true);
-        if (result)
+        if (result) {
                 end_page_writeback(page);
-        else
+        } else {
+                clean_page_buffers(page);
                 unlock_page(page);
+        }
         blk_queue_exit(bdev->bd_queue);
         return result;
 }
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 62cf812ed0e5..96415c65bbdc 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -866,7 +866,8 @@ out:
          */
         if (sdio->boundary) {
                 ret = dio_send_cur_page(dio, sdio, map_bh);
-                dio_bio_submit(dio, sdio);
+                if (sdio->bio)
+                        dio_bio_submit(dio, sdio);
                 put_page(sdio->cur_page);
                 sdio->cur_page = NULL;
         }
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 9a7c90386947..4b4a72f392be 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -2525,7 +2525,7 @@ void invalidate_blocks(struct f2fs_sb_info *sbi, block_t addr);
 bool is_checkpointed_data(struct f2fs_sb_info *sbi, block_t blkaddr);
 void refresh_sit_entry(struct f2fs_sb_info *sbi, block_t old, block_t new);
 void stop_discard_thread(struct f2fs_sb_info *sbi);
-void f2fs_wait_discard_bios(struct f2fs_sb_info *sbi);
+void f2fs_wait_discard_bios(struct f2fs_sb_info *sbi, bool umount);
 void clear_prefree_segments(struct f2fs_sb_info *sbi, struct cp_control *cpc);
 void release_discard_addrs(struct f2fs_sb_info *sbi);
 int npages_for_summary_flush(struct f2fs_sb_info *sbi, bool for_ra);
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 621b9b3d320b..c695ff462ee6 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -1210,11 +1210,11 @@ void stop_discard_thread(struct f2fs_sb_info *sbi)
 }
 
 /* This comes from f2fs_put_super and f2fs_trim_fs */
-void f2fs_wait_discard_bios(struct f2fs_sb_info *sbi)
+void f2fs_wait_discard_bios(struct f2fs_sb_info *sbi, bool umount)
 {
         __issue_discard_cmd(sbi, false);
         __drop_discard_cmd(sbi);
-        __wait_discard_cmd(sbi, false);
+        __wait_discard_cmd(sbi, !umount);
 }
 
 static void mark_discard_range_all(struct f2fs_sb_info *sbi)
@@ -2244,7 +2244,7 @@ int f2fs_trim_fs(struct f2fs_sb_info *sbi, struct fstrim_range *range)
         }
         /* It's time to issue all the filed discards */
         mark_discard_range_all(sbi);
-        f2fs_wait_discard_bios(sbi);
+        f2fs_wait_discard_bios(sbi, false);
 out:
         range->len = F2FS_BLK_TO_BYTES(cpc.trimmed);
         return err;
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 89f61eb3d167..933c3d529e65 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -801,7 +801,7 @@ static void f2fs_put_super(struct super_block *sb)
         }
 
         /* be sure to wait for any on-going discard commands */
-        f2fs_wait_discard_bios(sbi);
+        f2fs_wait_discard_bios(sbi, true);
 
         if (f2fs_discard_en(sbi) && !sbi->discard_blks) {
                 struct cp_control cpc = {
diff --git a/fs/mpage.c b/fs/mpage.c
index 37bb77c1302c..c991faec70b9 100644
--- a/fs/mpage.c
+++ b/fs/mpage.c
@@ -468,6 +468,16 @@ static void clean_buffers(struct page *page, unsigned first_unmapped)
                 try_to_free_buffers(page);
 }
 
+/*
+ * For situations where we want to clean all buffers attached to a page.
+ * We don't need to calculate how many buffers are attached to the page,
+ * we just need to specify a number larger than the maximum number of buffers.
+ */
+void clean_page_buffers(struct page *page)
+{
+        clean_buffers(page, ~0U);
+}
+
 static int __mpage_writepage(struct page *page, struct writeback_control *wbc,
                       void *data)
 {
@@ -605,10 +615,8 @@ alloc_new:
         if (bio == NULL) {
                 if (first_unmapped == blocks_per_page) {
                         if (!bdev_write_page(bdev, blocks[0] << (blkbits - 9),
-                                                                page, wbc)) {
-                                clean_buffers(page, first_unmapped);
+                                                                page, wbc))
                                 goto out;
-                        }
                 }
                 bio = mpage_alloc(bdev, blocks[0] << (blkbits - 9),
                                 BIO_MAX_PAGES, GFP_NOFS|__GFP_HIGH);
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 3c69db7d4905..8487486ec496 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -927,6 +927,13 @@ nfsd4_secinfo_release(union nfsd4_op_u *u)
                 exp_put(u->secinfo.si_exp);
 }
 
+static void
+nfsd4_secinfo_no_name_release(union nfsd4_op_u *u)
+{
+        if (u->secinfo_no_name.sin_exp)
+                exp_put(u->secinfo_no_name.sin_exp);
+}
+
 static __be32
 nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
               union nfsd4_op_u *u)
@@ -2375,7 +2382,7 @@ static const struct nfsd4_operation nfsd4_ops[] = {
         },
         [OP_SECINFO_NO_NAME] = {
                 .op_func = nfsd4_secinfo_no_name,
-                .op_release = nfsd4_secinfo_release,
+                .op_release = nfsd4_secinfo_no_name_release,
                 .op_flags = OP_HANDLES_WRONGSEC,
                 .op_name = "OP_SECINFO_NO_NAME",
                 .op_rsize_bop = nfsd4_secinfo_rsize,
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 50b0556a124f..52ad15192e72 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1297,21 +1297,18 @@ static int dquot_add_space(struct dquot *dquot, qsize_t space,
         spin_lock(&dquot->dq_dqb_lock);
         if (!sb_has_quota_limits_enabled(sb, dquot->dq_id.type) ||
             test_bit(DQ_FAKE_B, &dquot->dq_flags))
-                goto add;
+                goto finish;
 
         tspace = dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace
                 + space + rsv_space;
 
-        if (flags & DQUOT_SPACE_NOFAIL)
-                goto add;
-
         if (dquot->dq_dqb.dqb_bhardlimit &&
             tspace > dquot->dq_dqb.dqb_bhardlimit &&
             !ignore_hardlimit(dquot)) {
                 if (flags & DQUOT_SPACE_WARN)
                         prepare_warning(warn, dquot, QUOTA_NL_BHARDWARN);
                 ret = -EDQUOT;
-                goto out;
+                goto finish;
         }
 
         if (dquot->dq_dqb.dqb_bsoftlimit &&
@@ -1322,7 +1319,7 @@ static int dquot_add_space(struct dquot *dquot, qsize_t space,
                 if (flags & DQUOT_SPACE_WARN)
                         prepare_warning(warn, dquot, QUOTA_NL_BSOFTLONGWARN);
                 ret = -EDQUOT;
-                goto out;
+                goto finish;
         }
 
         if (dquot->dq_dqb.dqb_bsoftlimit &&
@@ -1338,13 +1335,21 @@ static int dquot_add_space(struct dquot *dquot, qsize_t space,
                          * be always printed
                          */
                         ret = -EDQUOT;
-                        goto out;
+                        goto finish;
                 }
         }
-add:
-        dquot->dq_dqb.dqb_rsvspace += rsv_space;
-        dquot->dq_dqb.dqb_curspace += space;
-out:
+finish:
+        /*
+         * We have to be careful and go through warning generation & grace time
+         * setting even if DQUOT_SPACE_NOFAIL is set. That's why we check it
+         * only here...
+         */
+        if (flags & DQUOT_SPACE_NOFAIL)
+                ret = 0;
+        if (!ret) {
+                dquot->dq_dqb.dqb_rsvspace += rsv_space;
+                dquot->dq_dqb.dqb_curspace += space;
+        }
         spin_unlock(&dquot->dq_dqb_lock);
         return ret;
 }
diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
index 744dcaec34cc..f965ce832bc0 100644
--- a/fs/xfs/libxfs/xfs_alloc.c
+++ b/fs/xfs/libxfs/xfs_alloc.c
@@ -1584,6 +1584,10 @@ xfs_alloc_ag_vextent_small(
 
                                 bp = xfs_btree_get_bufs(args->mp, args->tp,
                                         args->agno, fbno, 0);
+                                if (!bp) {
+                                        error = -EFSCORRUPTED;
+                                        goto error0;
+                                }
                                 xfs_trans_binval(args->tp, bp);
                         }
                         args->len = 1;
@@ -2141,6 +2145,10 @@ xfs_alloc_fix_freelist(
                 if (error)
                         goto out_agbp_relse;
                 bp = xfs_btree_get_bufs(mp, tp, args->agno, bno, 0);
+                if (!bp) {
+                        error = -EFSCORRUPTED;
+                        goto out_agbp_relse;
+                }
                 xfs_trans_binval(tp, bp);
         }
 
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 044a363119be..def32fa1c225 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -1477,14 +1477,14 @@ xfs_bmap_isaeof(
         int                     is_empty;
         int                     error;
 
-        bma->aeof = 0;
+        bma->aeof = false;
         error = xfs_bmap_last_extent(NULL, bma->ip, whichfork, &rec,
                                      &is_empty);
         if (error)
                 return error;
 
         if (is_empty) {
-                bma->aeof = 1;
+                bma->aeof = true;
                 return 0;
         }
 
diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
index 988bb3f31446..dfd643909f85 100644
--- a/fs/xfs/libxfs/xfs_ialloc.c
+++ b/fs/xfs/libxfs/xfs_ialloc.c
@@ -1962,7 +1962,7 @@ xfs_difree_inobt(
         if (!(mp->m_flags & XFS_MOUNT_IKEEP) &&
             rec.ir_free == XFS_INOBT_ALL_FREE &&
             mp->m_sb.sb_inopblock <= XFS_INODES_PER_CHUNK) {
-                xic->deleted = 1;
+                xic->deleted = true;
                 xic->first_ino = XFS_AGINO_TO_INO(mp, agno, rec.ir_startino);
                 xic->alloc = xfs_inobt_irec_to_allocmask(&rec);
 
@@ -1989,7 +1989,7 @@ xfs_difree_inobt(
 
                 xfs_difree_inode_chunk(mp, agno, &rec, dfops);
         } else {
-                xic->deleted = 0;
+                xic->deleted = false;
 
                 error = xfs_inobt_update(cur, &rec);
                 if (error) {
diff --git a/fs/xfs/libxfs/xfs_log_format.h b/fs/xfs/libxfs/xfs_log_format.h
index 8372e9bcd7b6..71de185735e0 100644
--- a/fs/xfs/libxfs/xfs_log_format.h
+++ b/fs/xfs/libxfs/xfs_log_format.h
@@ -270,6 +270,7 @@ typedef struct xfs_inode_log_format {
         uint32_t                ilf_fields;     /* flags for fields logged */
         uint16_t                ilf_asize;      /* size of attr d/ext/root */
         uint16_t                ilf_dsize;      /* size of data/ext/root */
+        uint32_t                ilf_pad;        /* pad for 64 bit boundary */
         uint64_t                ilf_ino;        /* inode number */
         union {
                 uint32_t        ilfu_rdev;      /* rdev value for dev inode*/
@@ -280,29 +281,17 @@ typedef struct xfs_inode_log_format {
         int32_t                 ilf_boffset;    /* off of inode in buffer */
 } xfs_inode_log_format_t;
 
-typedef struct xfs_inode_log_format_32 {
-        uint16_t                ilf_type;       /* inode log item type */
-        uint16_t                ilf_size;       /* size of this item */
-        uint32_t                ilf_fields;     /* flags for fields logged */
-        uint16_t                ilf_asize;      /* size of attr d/ext/root */
-        uint16_t                ilf_dsize;      /* size of data/ext/root */
-        uint64_t                ilf_ino;        /* inode number */
-        union {
-                uint32_t        ilfu_rdev;      /* rdev value for dev inode*/
-                uuid_t          ilfu_uuid;      /* mount point value */
-        } ilf_u;
-        int64_t                 ilf_blkno;      /* blkno of inode buffer */
-        int32_t                 ilf_len;        /* len of inode buffer */
-        int32_t                 ilf_boffset;    /* off of inode in buffer */
-} __attribute__((packed)) xfs_inode_log_format_32_t;
-
-typedef struct xfs_inode_log_format_64 {
+/*
+ * Old 32 bit systems will log in this format without the 64 bit
+ * alignment padding. Recovery will detect this and convert it to the
+ * correct format.
+ */
+struct xfs_inode_log_format_32 {
         uint16_t                ilf_type;       /* inode log item type */
         uint16_t                ilf_size;       /* size of this item */
         uint32_t                ilf_fields;     /* flags for fields logged */
         uint16_t                ilf_asize;      /* size of attr d/ext/root */
         uint16_t                ilf_dsize;      /* size of data/ext/root */
-        uint32_t                ilf_pad;        /* pad for 64 bit boundary */
         uint64_t                ilf_ino;        /* inode number */
         union {
                 uint32_t        ilfu_rdev;      /* rdev value for dev inode*/
@@ -311,7 +300,7 @@ typedef struct xfs_inode_log_format_64 {
         int64_t                 ilf_blkno;      /* blkno of inode buffer */
         int32_t                 ilf_len;        /* len of inode buffer */
         int32_t                 ilf_boffset;    /* off of inode in buffer */
-} xfs_inode_log_format_64_t;
+} __attribute__((packed));
 
 
 /*
diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c
index 7034e17535de..3354140de07e 100644
--- a/fs/xfs/xfs_acl.c
+++ b/fs/xfs/xfs_acl.c
@@ -247,6 +247,8 @@ xfs_set_mode(struct inode *inode, umode_t mode)
 int
 xfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
 {
+        umode_t mode;
+        bool set_mode = false;
         int error = 0;
 
         if (!acl)
@@ -257,16 +259,24 @@ xfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
                 return error;
 
         if (type == ACL_TYPE_ACCESS) {
-                umode_t mode;
-
                 error = posix_acl_update_mode(inode, &mode, &acl);
                 if (error)
                         return error;
-                error = xfs_set_mode(inode, mode);
-                if (error)
-                        return error;
+                set_mode = true;
         }
 
  set_acl:
-        return __xfs_set_acl(inode, acl, type);
+        error =  __xfs_set_acl(inode, acl, type);
+        if (error)
+                return error;
+
+        /*
+         * We set the mode after successfully updating the ACL xattr because the
+         * xattr update can fail at ENOSPC and we don't want to change the mode
+         * if the ACL update hasn't been applied.
+         */
+        if (set_mode)
+                error = xfs_set_mode(inode, mode);
+
+        return error;
 }
diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
index ebd66b19fbfc..e3a950ed35a8 100644
--- a/fs/xfs/xfs_attr_inactive.c
+++ b/fs/xfs/xfs_attr_inactive.c
@@ -302,6 +302,8 @@ xfs_attr3_node_inactive(
                                                  &bp, XFS_ATTR_FORK);
                         if (error)
                                 return error;
+                        node = bp->b_addr;
+                        btree = dp->d_ops->node_tree_p(node);
                         child_fsb = be32_to_cpu(btree[i + 1].before);
                         xfs_trans_brelse(*trans, bp);
                 }
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index e9db7fc95b70..6503cfa44262 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -84,6 +84,7 @@ xfs_zero_extent(
                 GFP_NOFS, 0);
 }
 
+#ifdef CONFIG_XFS_RT
 int
 xfs_bmap_rtalloc(
         struct xfs_bmalloca     *ap)    /* bmap alloc argument struct */
@@ -190,6 +191,7 @@ xfs_bmap_rtalloc(
         }
         return 0;
 }
+#endif /* CONFIG_XFS_RT */
 
 /*
  * Check if the endoff is outside the last extent. If so the caller will grow
diff --git a/fs/xfs/xfs_bmap_util.h b/fs/xfs/xfs_bmap_util.h
index 0eaa81dc49be..7d330b3c77c3 100644
--- a/fs/xfs/xfs_bmap_util.h
+++ b/fs/xfs/xfs_bmap_util.h
@@ -28,7 +28,20 @@ struct xfs_mount;
 struct xfs_trans;
 struct xfs_bmalloca;
 
+#ifdef CONFIG_XFS_RT
 int     xfs_bmap_rtalloc(struct xfs_bmalloca *ap);
+#else /* !CONFIG_XFS_RT */
+/*
+ * Attempts to allocate RT extents when RT is disable indicates corruption and
+ * should trigger a shutdown.
+ */
+static inline int
+xfs_bmap_rtalloc(struct xfs_bmalloca *ap)
+{
+        return -EFSCORRUPTED;
+}
+#endif /* CONFIG_XFS_RT */
+
 int     xfs_bmap_eof(struct xfs_inode *ip, xfs_fileoff_t endoff,
                      int whichfork, int *eof);
 int     xfs_bmap_punch_delalloc_range(struct xfs_inode *ip,
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 309e26c9dddb..56d0e526870c 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -764,7 +764,7 @@ xfs_file_fallocate(
         enum xfs_prealloc_flags flags = 0;
         uint                    iolock = XFS_IOLOCK_EXCL;
         loff_t                  new_size = 0;
-        bool                    do_file_insert = 0;
+        bool                    do_file_insert = false;
 
         if (!S_ISREG(inode->i_mode))
                 return -EINVAL;
@@ -825,7 +825,7 @@ xfs_file_fallocate(
                         error = -EINVAL;
                         goto out_unlock;
                 }
-                do_file_insert = 1;
+                do_file_insert = true;
         } else {
                 flags |= XFS_PREALLOC_SET;
 
diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c
index 814ed729881d..560e0b40ac1b 100644
--- a/fs/xfs/xfs_fsmap.c
+++ b/fs/xfs/xfs_fsmap.c
@@ -521,6 +521,7 @@ __xfs_getfsmap_rtdev(
         return query_fn(tp, info);
 }
 
+#ifdef CONFIG_XFS_RT
 /* Actually query the realtime bitmap. */
 STATIC int
 xfs_getfsmap_rtdev_rtbitmap_query(
@@ -561,6 +562,7 @@ xfs_getfsmap_rtdev_rtbitmap(
         return __xfs_getfsmap_rtdev(tp, keys, xfs_getfsmap_rtdev_rtbitmap_query,
                         info);
 }
+#endif /* CONFIG_XFS_RT */
 
 /* Execute a getfsmap query against the regular data device. */
 STATIC int
@@ -795,7 +797,15 @@ xfs_getfsmap_check_keys(
         return false;
 }
 
+/*
+ * There are only two devices if we didn't configure RT devices at build time.
+ */
+#ifdef CONFIG_XFS_RT
 #define XFS_GETFSMAP_DEVS       3
+#else
+#define XFS_GETFSMAP_DEVS       2
+#endif /* CONFIG_XFS_RT */
+
 /*
  * Get filesystem's extents as described in head, and format for
  * output.  Calls formatter to fill the user's buffer until all
@@ -853,10 +863,12 @@ xfs_getfsmap(
                 handlers[1].dev = new_encode_dev(mp->m_logdev_targp->bt_dev);
                 handlers[1].fn = xfs_getfsmap_logdev;
         }
+#ifdef CONFIG_XFS_RT
         if (mp->m_rtdev_targp) {
                 handlers[2].dev = new_encode_dev(mp->m_rtdev_targp->bt_dev);
                 handlers[2].fn = xfs_getfsmap_rtdev_rtbitmap;
         }
+#endif /* CONFIG_XFS_RT */
 
         xfs_sort(handlers, XFS_GETFSMAP_DEVS, sizeof(struct xfs_getfsmap_dev),
                         xfs_getfsmap_dev_compare);
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index a705f34b58fa..9bbc2d7cc8cb 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -364,6 +364,9 @@ xfs_inode_to_log_dinode(
         to->di_dmstate = from->di_dmstate;
         to->di_flags = from->di_flags;
 
+        /* log a dummy value to ensure log structure is fully initialised */
+        to->di_next_unlinked = NULLAGINO;
+
         if (from->di_version == 3) {
                 to->di_changecount = inode->i_version;
                 to->di_crtime.t_sec = from->di_crtime.t_sec;
@@ -404,6 +407,11 @@ xfs_inode_item_format_core(
  * the second with the on-disk inode structure, and a possible third and/or
  * fourth with the inode data/extents/b-tree root and inode attributes
  * data/extents/b-tree root.
+ *
+ * Note: Always use the 64 bit inode log format structure so we don't
+ * leave an uninitialised hole in the format item on 64 bit systems. Log
+ * recovery on 32 bit systems handles this just fine, so there's no reason
+ * for not using an initialising the properly padded structure all the time.
  */
 STATIC void
 xfs_inode_item_format(
@@ -412,8 +420,8 @@ xfs_inode_item_format(
 {
         struct xfs_inode_log_item *iip = INODE_ITEM(lip);
         struct xfs_inode        *ip = iip->ili_inode;
-        struct xfs_inode_log_format *ilf;
         struct xfs_log_iovec    *vecp = NULL;
+        struct xfs_inode_log_format *ilf;
 
         ASSERT(ip->i_d.di_version > 1);
 
@@ -425,7 +433,17 @@ xfs_inode_item_format(
         ilf->ilf_boffset = ip->i_imap.im_boffset;
         ilf->ilf_fields = XFS_ILOG_CORE;
         ilf->ilf_size = 2; /* format + core */
-        xlog_finish_iovec(lv, vecp, sizeof(struct xfs_inode_log_format));
+
+        /*
+         * make sure we don't leak uninitialised data into the log in the case
+         * when we don't log every field in the inode.
+         */
+        ilf->ilf_dsize = 0;
+        ilf->ilf_asize = 0;
+        ilf->ilf_pad = 0;
+        uuid_copy(&ilf->ilf_u.ilfu_uuid, &uuid_null);
+
+        xlog_finish_iovec(lv, vecp, sizeof(*ilf));
 
         xfs_inode_item_format_core(ip, lv, &vecp);
         xfs_inode_item_format_data_fork(iip, ilf, lv, &vecp);
@@ -855,44 +873,29 @@ xfs_istale_done(
 }
 
 /*
- * convert an xfs_inode_log_format struct from either 32 or 64 bit versions
- * (which can have different field alignments) to the native version
+ * convert an xfs_inode_log_format struct from the old 32 bit version
+ * (which can have different field alignments) to the native 64 bit version
  */
 int
 xfs_inode_item_format_convert(
-        xfs_log_iovec_t         *buf,
-        xfs_inode_log_format_t  *in_f)
+        struct xfs_log_iovec            *buf,
+        struct xfs_inode_log_format     *in_f)
 {
-        if (buf->i_len == sizeof(xfs_inode_log_format_32_t)) {
-                xfs_inode_log_format_32_t *in_f32 = buf->i_addr;
-
-                in_f->ilf_type = in_f32->ilf_type;
-                in_f->ilf_size = in_f32->ilf_size;
-                in_f->ilf_fields = in_f32->ilf_fields;
-                in_f->ilf_asize = in_f32->ilf_asize;
-                in_f->ilf_dsize = in_f32->ilf_dsize;
-                in_f->ilf_ino = in_f32->ilf_ino;
-                /* copy biggest field of ilf_u */
-                uuid_copy(&in_f->ilf_u.ilfu_uuid, &in_f32->ilf_u.ilfu_uuid);
-                in_f->ilf_blkno = in_f32->ilf_blkno;
-                in_f->ilf_len = in_f32->ilf_len;
-                in_f->ilf_boffset = in_f32->ilf_boffset;
-                return 0;
-        } else if (buf->i_len == sizeof(xfs_inode_log_format_64_t)){
-                xfs_inode_log_format_64_t *in_f64 = buf->i_addr;
-
-                in_f->ilf_type = in_f64->ilf_type;
-                in_f->ilf_size = in_f64->ilf_size;
-                in_f->ilf_fields = in_f64->ilf_fields;
-                in_f->ilf_asize = in_f64->ilf_asize;
-                in_f->ilf_dsize = in_f64->ilf_dsize;
-                in_f->ilf_ino = in_f64->ilf_ino;
-                /* copy biggest field of ilf_u */
-                uuid_copy(&in_f->ilf_u.ilfu_uuid, &in_f64->ilf_u.ilfu_uuid);
-                in_f->ilf_blkno = in_f64->ilf_blkno;
-                in_f->ilf_len = in_f64->ilf_len;
-                in_f->ilf_boffset = in_f64->ilf_boffset;
-                return 0;
-        }
-        return -EFSCORRUPTED;
+        struct xfs_inode_log_format_32  *in_f32 = buf->i_addr;
+
+        if (buf->i_len != sizeof(*in_f32))
+                return -EFSCORRUPTED;
+
+        in_f->ilf_type = in_f32->ilf_type;
+        in_f->ilf_size = in_f32->ilf_size;
+        in_f->ilf_fields = in_f32->ilf_fields;
+        in_f->ilf_asize = in_f32->ilf_asize;
+        in_f->ilf_dsize = in_f32->ilf_dsize;
+        in_f->ilf_ino = in_f32->ilf_ino;
+        /* copy biggest field of ilf_u */
+        uuid_copy(&in_f->ilf_u.ilfu_uuid, &in_f32->ilf_u.ilfu_uuid);
+        in_f->ilf_blkno = in_f32->ilf_blkno;
+        in_f->ilf_len = in_f32->ilf_len;
+        in_f->ilf_boffset = in_f32->ilf_boffset;
+        return 0;
 }
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index c5107c7bc4bf..dc95a49d62e7 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -2515,7 +2515,7 @@ next_lv:
                                 if (lv)
                                         vecp = lv->lv_iovecp;
                         }
-                        if (record_cnt == 0 && ordered == false) {
+                        if (record_cnt == 0 && !ordered) {
                                 if (!lv)
                                         return 0;
                                 break;
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index ea7d4b4e50d0..e9727d0a541a 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -704,7 +704,7 @@ xfs_mountfs(
         xfs_set_maxicount(mp);
 
         /* enable fail_at_unmount as default */
-        mp->m_fail_unmount = 1;
+        mp->m_fail_unmount = true;
 
         error = xfs_sysfs_init(&mp->m_kobj, &xfs_mp_ktype, NULL, mp->m_fsname);
         if (error)
diff --git a/fs/xfs/xfs_ondisk.h b/fs/xfs/xfs_ondisk.h
index 0c381d71b242..0492436a053f 100644
--- a/fs/xfs/xfs_ondisk.h
+++ b/fs/xfs/xfs_ondisk.h
@@ -134,7 +134,7 @@ xfs_check_ondisk_structs(void)
         XFS_CHECK_STRUCT_SIZE(struct xfs_icreate_log,           28);
         XFS_CHECK_STRUCT_SIZE(struct xfs_ictimestamp,           8);
         XFS_CHECK_STRUCT_SIZE(struct xfs_inode_log_format_32,   52);
-        XFS_CHECK_STRUCT_SIZE(struct xfs_inode_log_format_64,   56);
+        XFS_CHECK_STRUCT_SIZE(struct xfs_inode_log_format,      56);
         XFS_CHECK_STRUCT_SIZE(struct xfs_qoff_logformat,        20);
         XFS_CHECK_STRUCT_SIZE(struct xfs_trans_header,          16);
 }
diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
index c8dae555eccf..446b24cac67d 100644
--- a/include/linux/buffer_head.h
+++ b/include/linux/buffer_head.h
@@ -232,6 +232,7 @@ int generic_write_end(struct file *, struct address_space *,
                                 loff_t, unsigned, unsigned,
                                 struct page *, void *);
 void page_zero_new_buffers(struct page *page, unsigned from, unsigned to);
+void clean_page_buffers(struct page *page);
 int cont_write_begin(struct file *, struct address_space *, loff_t,
                         unsigned, unsigned, struct page **, void **,
                         get_block_t *, loff_t *);
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 0ad4c3044cf9..91189bb0c818 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -44,6 +44,12 @@
 
 #define STACK_MAGIC     0xdeadbeef
 
+/**
+ * REPEAT_BYTE - repeat the value @x multiple times as an unsigned long value
+ * @x: value to repeat
+ *
+ * NOTE: @x is not checked for > 0xff; larger values produce odd results.
+ */
 #define REPEAT_BYTE(x)  ((~0ul / 0xff) * (x))
 
 /* @a is a power of 2 value */
@@ -57,6 +63,10 @@
 #define READ                    0
 #define WRITE                   1
 
+/**
+ * ARRAY_SIZE - get the number of elements in array @arr
+ * @arr: array to be sized
+ */
 #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
 
 #define u64_to_user_ptr(x) (            \
@@ -76,7 +86,15 @@
 #define round_up(x, y) ((((x)-1) | __round_mask(x, y))+1)
 #define round_down(x, y) ((x) & ~__round_mask(x, y))
 
+/**
+ * FIELD_SIZEOF - get the size of a struct's field
+ * @t: the target struct
+ * @f: the target struct's field
+ * Return: the size of @f in the struct definition without having a
+ * declared instance of @t.
+ */
 #define FIELD_SIZEOF(t, f) (sizeof(((t*)0)->f))
+
 #define DIV_ROUND_UP __KERNEL_DIV_ROUND_UP
 
 #define DIV_ROUND_DOWN_ULL(ll, d) \
@@ -107,7 +125,7 @@
 /*
  * Divide positive or negative dividend by positive or negative divisor
  * and round to closest integer. Result is undefined for negative
- * divisors if he dividend variable type is unsigned and for negative
+ * divisors if the dividend variable type is unsigned and for negative
  * dividends if the divisor variable type is unsigned.
  */
 #define DIV_ROUND_CLOSEST(x, divisor)(                  \
@@ -247,13 +265,13 @@ extern int _cond_resched(void);
  * @ep_ro: right open interval endpoint
  *
  * Perform a "reciprocal multiplication" in order to "scale" a value into
- * range [0, ep_ro), where the upper interval endpoint is right-open.
+ * range [0, @ep_ro), where the upper interval endpoint is right-open.
  * This is useful, e.g. for accessing a index of an array containing
- * ep_ro elements, for example. Think of it as sort of modulus, only that
+ * @ep_ro elements, for example. Think of it as sort of modulus, only that
  * the result isn't that of modulo. ;) Note that if initial input is a
  * small value, then result will return 0.
  *
- * Return: a result based on val in interval [0, ep_ro).
+ * Return: a result based on @val in interval [0, @ep_ro).
  */
 static inline u32 reciprocal_scale(u32 val, u32 ep_ro)
 {
@@ -618,8 +636,8 @@ do {									\
  * trace_printk - printf formatting in the ftrace buffer
  * @fmt: the printf format for printing
  *
- * Note: __trace_printk is an internal function for trace_printk and
- *       the @ip is passed in via the trace_printk macro.
+ * Note: __trace_printk is an internal function for trace_printk() and
+ *       the @ip is passed in via the trace_printk() macro.
  *
  * This function allows a kernel developer to debug fast path sections
  * that printk is not appropriate for. By scattering in various
@@ -629,7 +647,7 @@ do {									\
  * This is intended as a debugging tool for the developer only.
  * Please refrain from leaving trace_printks scattered around in
  * your code. (Extra memory is used for special buffers that are
- * allocated when trace_printk() is used)
+ * allocated when trace_printk() is used.)
  *
  * A little optization trick is done here. If there's only one
  * argument, there's no need to scan the string for printf formats.
@@ -681,7 +699,7 @@ int __trace_printk(unsigned long ip, const char *fmt, ...);
  *       the @ip is passed in via the trace_puts macro.
  *
  * This is similar to trace_printk() but is made for those really fast
- * paths that a developer wants the least amount of "Heisenbug" affects,
+ * paths that a developer wants the least amount of "Heisenbug" effects,
  * where the processing of the print format is still too much.
  *
  * This function allows a kernel developer to debug fast path sections
@@ -692,7 +710,7 @@ int __trace_printk(unsigned long ip, const char *fmt, ...);
  * This is intended as a debugging tool for the developer only.
  * Please refrain from leaving trace_puts scattered around in
  * your code. (Extra memory is used for special buffers that are
- * allocated when trace_puts() is used)
+ * allocated when trace_puts() is used.)
  *
  * Returns: 0 if nothing was written, positive # if string was.
  *  (1 when __trace_bputs is used, strlen(str) when __trace_puts is used)
@@ -771,6 +789,12 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
         t2 min2 = (y);                                  \
         (void) (&min1 == &min2);                        \
         min1 < min2 ? min1 : min2; })
+
+/**
+ * min - return minimum of two values of the same or compatible types
+ * @x: first value
+ * @y: second value
+ */
 #define min(x, y)                                       \
         __min(typeof(x), typeof(y),                     \
               __UNIQUE_ID(min1_), __UNIQUE_ID(min2_),   \
@@ -781,12 +805,31 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
         t2 max2 = (y);                                  \
         (void) (&max1 == &max2);                        \
         max1 > max2 ? max1 : max2; })
+
+/**
+ * max - return maximum of two values of the same or compatible types
+ * @x: first value
+ * @y: second value
+ */
 #define max(x, y)                                       \
         __max(typeof(x), typeof(y),                     \
               __UNIQUE_ID(max1_), __UNIQUE_ID(max2_),   \
               x, y)
 
+/**
+ * min3 - return minimum of three values
+ * @x: first value
+ * @y: second value
+ * @z: third value
+ */
 #define min3(x, y, z) min((typeof(x))min(x, y), z)
+
+/**
+ * max3 - return maximum of three values
+ * @x: first value
+ * @y: second value
+ * @z: third value
+ */
 #define max3(x, y, z) max((typeof(x))max(x, y), z)
 
 /**
@@ -805,8 +848,8 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
  * @lo: lowest allowable value
  * @hi: highest allowable value
  *
- * This macro does strict typechecking of lo/hi to make sure they are of the
- * same type as val.  See the unnecessary pointer comparisons.
+ * This macro does strict typechecking of @lo/@hi to make sure they are of the
+ * same type as @val.  See the unnecessary pointer comparisons.
  */
 #define clamp(val, lo, hi) min((typeof(val))max(val, lo), hi)
 
@@ -816,11 +859,24 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
  *
  * Or not use min/max/clamp at all, of course.
  */
+
+/**
+ * min_t - return minimum of two values, using the specified type
+ * @type: data type to use
+ * @x: first value
+ * @y: second value
+ */
 #define min_t(type, x, y)                               \
         __min(type, type,                               \
               __UNIQUE_ID(min1_), __UNIQUE_ID(min2_),   \
               x, y)
 
+/**
+ * max_t - return maximum of two values, using the specified type
+ * @type: data type to use
+ * @x: first value
+ * @y: second value
+ */
 #define max_t(type, x, y)                               \
         __max(type, type,                               \
               __UNIQUE_ID(min1_), __UNIQUE_ID(min2_),   \
@@ -834,7 +890,7 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
  * @hi: maximum allowable value
  *
  * This macro does no typechecking and uses temporary variables of type
- * 'type' to make all the comparisons.
+ * @type to make all the comparisons.
  */
 #define clamp_t(type, val, lo, hi) min_t(type, max_t(type, val, lo), hi)
 
@@ -845,15 +901,17 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
  * @hi: maximum allowable value
  *
  * This macro does no typechecking and uses temporary variables of whatever
- * type the input argument 'val' is.  This is useful when val is an unsigned
- * type and min and max are literals that will otherwise be assigned a signed
+ * type the input argument @val is.  This is useful when @val is an unsigned
+ * type and @lo and @hi are literals that will otherwise be assigned a signed
  * integer type.
  */
 #define clamp_val(val, lo, hi) clamp_t(typeof(val), val, lo, hi)
 
 
-/*
- * swap - swap value of @a and @b
+/**
+ * swap - swap values of @a and @b
+ * @a: first value
+ * @b: second value
  */
 #define swap(a, b) \
         do { typeof(a) __tmp = (a); (a) = (b); (b) = __tmp; } while (0)
diff --git a/include/linux/of.h b/include/linux/of.h
index cfc34117fc92..b240ed69dc96 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -734,6 +734,16 @@ static inline struct device_node *of_get_cpu_node(int cpu,
         return NULL;
 }
 
+static inline int of_n_addr_cells(struct device_node *np)
+{
+        return 0;
+
+}
+static inline int of_n_size_cells(struct device_node *np)
+{
+        return 0;
+}
+
 static inline int of_property_read_u64(const struct device_node *np,
                                        const char *propname, u64 *out_value)
 {
diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
index 905d769d8ddc..5f7eeab990fe 100644
--- a/include/linux/thread_info.h
+++ b/include/linux/thread_info.h
@@ -42,7 +42,7 @@ enum {
 #define THREAD_ALIGN    THREAD_SIZE
 #endif
 
-#ifdef CONFIG_DEBUG_STACK_USAGE
+#if IS_ENABLED(CONFIG_DEBUG_STACK_USAGE) || IS_ENABLED(CONFIG_DEBUG_KMEMLEAK)
 # define THREADINFO_GFP         (GFP_KERNEL_ACCOUNT | __GFP_NOTRACK | \
                                  __GFP_ZERO)
 #else
diff --git a/include/sound/seq_virmidi.h b/include/sound/seq_virmidi.h
index a03acd0d398a..695257ae64ac 100644
--- a/include/sound/seq_virmidi.h
+++ b/include/sound/seq_virmidi.h
@@ -60,6 +60,7 @@ struct snd_virmidi_dev {
         int port;                       /* created/attached port */
         unsigned int flags;             /* SNDRV_VIRMIDI_* */
         rwlock_t filelist_lock;
+        struct rw_semaphore filelist_sem;
         struct list_head filelist;
 };
 
diff --git a/kernel/exit.c b/kernel/exit.c
index f2cd53e92147..cf28528842bc 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1610,6 +1610,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
         if (!infop)
                 return err;
 
+        if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+                goto Efault;
+
         user_access_begin();
         unsafe_put_user(signo, &infop->si_signo, Efault);
         unsafe_put_user(0, &infop->si_errno, Efault);
@@ -1735,6 +1738,9 @@ COMPAT_SYSCALL_DEFINE5(waitid,
         if (!infop)
                 return err;
 
+        if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+                goto Efault;
+
         user_access_begin();
         unsafe_put_user(signo, &infop->si_signo, Efault);
         unsafe_put_user(0, &infop->si_errno, Efault);
diff --git a/kernel/fork.c b/kernel/fork.c
index e702cb9ffbd8..07cc743698d3 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -215,6 +215,10 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
                 if (!s)
                         continue;
 
+#ifdef CONFIG_DEBUG_KMEMLEAK
+                /* Clear stale pointers from reused stack. */
+                memset(s->addr, 0, THREAD_SIZE);
+#endif
                 tsk->stack_vm_area = s;
                 return s->addr;
         }
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 6fc89fd93824..5a2ef92c2782 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -265,8 +265,8 @@ int irq_startup(struct irq_desc *desc, bool resend, bool force)
                         irq_setup_affinity(desc);
                         break;
                 case IRQ_STARTUP_MANAGED:
+                        irq_do_set_affinity(d, aff, false);
                         ret = __irq_startup(desc);
-                        irq_set_affinity_locked(d, aff, false);
                         break;
                 case IRQ_STARTUP_ABORT:
                         return 0;
diff --git a/kernel/irq/cpuhotplug.c b/kernel/irq/cpuhotplug.c
index 638eb9c83d9f..9eb09aef0313 100644
--- a/kernel/irq/cpuhotplug.c
+++ b/kernel/irq/cpuhotplug.c
@@ -18,8 +18,34 @@
 static inline bool irq_needs_fixup(struct irq_data *d)
 {
         const struct cpumask *m = irq_data_get_effective_affinity_mask(d);
+        unsigned int cpu = smp_processor_id();
 
-        return cpumask_test_cpu(smp_processor_id(), m);
+#ifdef CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK
+        /*
+         * The cpumask_empty() check is a workaround for interrupt chips,
+         * which do not implement effective affinity, but the architecture has
+         * enabled the config switch. Use the general affinity mask instead.
+         */
+        if (cpumask_empty(m))
+                m = irq_data_get_affinity_mask(d);
+
+        /*
+         * Sanity check. If the mask is not empty when excluding the outgoing
+         * CPU then it must contain at least one online CPU. The outgoing CPU
+         * has been removed from the online mask already.
+         */
+        if (cpumask_any_but(m, cpu) < nr_cpu_ids &&
+            cpumask_any_and(m, cpu_online_mask) >= nr_cpu_ids) {
+                /*
+                 * If this happens then there was a missed IRQ fixup at some
+                 * point. Warn about it and enforce fixup.
+                 */
+                pr_warn("Eff. affinity %*pbl of IRQ %u contains only offline CPUs after offlining CPU %u\n",
+                        cpumask_pr_args(m), d->irq, cpu);
+                return true;
+        }
+#endif
+        return cpumask_test_cpu(cpu, m);
 }
 
 static bool migrate_one_irq(struct irq_desc *desc)
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index d00132b5c325..4bff6a10ae8e 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -168,6 +168,19 @@ void irq_set_thread_affinity(struct irq_desc *desc)
                         set_bit(IRQTF_AFFINITY, &action->thread_flags);
 }
 
+static void irq_validate_effective_affinity(struct irq_data *data)
+{
+#ifdef CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK
+        const struct cpumask *m = irq_data_get_effective_affinity_mask(data);
+        struct irq_chip *chip = irq_data_get_irq_chip(data);
+
+        if (!cpumask_empty(m))
+                return;
+        pr_warn_once("irq_chip %s did not update eff. affinity mask of irq %u\n",
+                     chip->name, data->irq);
+#endif
+}
+
 int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
                         bool force)
 {
@@ -175,12 +188,16 @@ int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
         struct irq_chip *chip = irq_data_get_irq_chip(data);
         int ret;
 
+        if (!chip || !chip->irq_set_affinity)
+                return -EINVAL;
+
         ret = chip->irq_set_affinity(data, mask, force);
         switch (ret) {
         case IRQ_SET_MASK_OK:
         case IRQ_SET_MASK_OK_DONE:
                 cpumask_copy(desc->irq_common_data.affinity, mask);
         case IRQ_SET_MASK_OK_NOCOPY:
+                irq_validate_effective_affinity(data);
                 irq_set_thread_affinity(desc);
                 ret = 0;
         }
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index b9628e43c78f..bf8c8fd72589 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -830,6 +830,41 @@ int klp_register_patch(struct klp_patch *patch)
 }
 EXPORT_SYMBOL_GPL(klp_register_patch);
 
+/*
+ * Remove parts of patches that touch a given kernel module. The list of
+ * patches processed might be limited. When limit is NULL, all patches
+ * will be handled.
+ */
+static void klp_cleanup_module_patches_limited(struct module *mod,
+                                               struct klp_patch *limit)
+{
+        struct klp_patch *patch;
+        struct klp_object *obj;
+
+        list_for_each_entry(patch, &klp_patches, list) {
+                if (patch == limit)
+                        break;
+
+                klp_for_each_object(patch, obj) {
+                        if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
+                                continue;
+
+                        /*
+                         * Only unpatch the module if the patch is enabled or
+                         * is in transition.
+                         */
+                        if (patch->enabled || patch == klp_transition_patch) {
+                                pr_notice("reverting patch '%s' on unloading module '%s'\n",
+                                          patch->mod->name, obj->mod->name);
+                                klp_unpatch_object(obj);
+                        }
+
+                        klp_free_object_loaded(obj);
+                        break;
+                }
+        }
+}
+
 int klp_module_coming(struct module *mod)
 {
         int ret;
@@ -894,7 +929,7 @@ err:
         pr_warn("patch '%s' failed for module '%s', refusing to load module '%s'\n",
                 patch->mod->name, obj->mod->name, obj->mod->name);
         mod->klp_alive = false;
-        klp_free_object_loaded(obj);
+        klp_cleanup_module_patches_limited(mod, patch);
         mutex_unlock(&klp_mutex);
 
         return ret;
@@ -902,9 +937,6 @@ err:
 
 void klp_module_going(struct module *mod)
 {
-        struct klp_patch *patch;
-        struct klp_object *obj;
-
         if (WARN_ON(mod->state != MODULE_STATE_GOING &&
                     mod->state != MODULE_STATE_COMING))
                 return;
@@ -917,25 +949,7 @@ void klp_module_going(struct module *mod)
          */
         mod->klp_alive = false;
 
-        list_for_each_entry(patch, &klp_patches, list) {
-                klp_for_each_object(patch, obj) {
-                        if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
-                                continue;
-
-                        /*
-                         * Only unpatch the module if the patch is enabled or
-                         * is in transition.
-                         */
-                        if (patch->enabled || patch == klp_transition_patch) {
-                                pr_notice("reverting patch '%s' on unloading module '%s'\n",
-                                          patch->mod->name, obj->mod->name);
-                                klp_unpatch_object(obj);
-                        }
-
-                        klp_free_object_loaded(obj);
-                        break;
-                }
-        }
+        klp_cleanup_module_patches_limited(mod, NULL);
 
         mutex_unlock(&klp_mutex);
 }
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index bb3a38005b9c..0ae832e13b97 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -473,7 +473,7 @@ static long seccomp_attach_filter(unsigned int flags,
         return 0;
 }
 
-void __get_seccomp_filter(struct seccomp_filter *filter)
+static void __get_seccomp_filter(struct seccomp_filter *filter)
 {
         /* Reference count is bounded by the number of total processes. */
         refcount_inc(&filter->usage);
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index e2705843c524..dfdad67d8f6c 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1590,6 +1590,54 @@ config LATENCYTOP
 
 source kernel/trace/Kconfig
 
+config PROVIDE_OHCI1394_DMA_INIT
+        bool "Remote debugging over FireWire early on boot"
+        depends on PCI && X86
+        help
+          If you want to debug problems which hang or crash the kernel early
+          on boot and the crashing machine has a FireWire port, you can use
+          this feature to remotely access the memory of the crashed machine
+          over FireWire. This employs remote DMA as part of the OHCI1394
+          specification which is now the standard for FireWire controllers.
+
+          With remote DMA, you can monitor the printk buffer remotely using
+          firescope and access all memory below 4GB using fireproxy from gdb.
+          Even controlling a kernel debugger is possible using remote DMA.
+
+          Usage:
+
+          If ohci1394_dma=early is used as boot parameter, it will initialize
+          all OHCI1394 controllers which are found in the PCI config space.
+
+          As all changes to the FireWire bus such as enabling and disabling
+          devices cause a bus reset and thereby disable remote DMA for all
+          devices, be sure to have the cable plugged and FireWire enabled on
+          the debugging host before booting the debug target for debugging.
+
+          This code (~1k) is freed after boot. By then, the firewire stack
+          in charge of the OHCI-1394 controllers should be used instead.
+
+          See Documentation/debugging-via-ohci1394.txt for more information.
+
+config DMA_API_DEBUG
+        bool "Enable debugging of DMA-API usage"
+        depends on HAVE_DMA_API_DEBUG
+        help
+          Enable this option to debug the use of the DMA API by device drivers.
+          With this option you will be able to detect common bugs in device
+          drivers like double-freeing of DMA mappings or freeing mappings that
+          were never allocated.
+
+          This also attempts to catch cases where a page owned by DMA is
+          accessed by the cpu in a way that could cause data corruption.  For
+          example, this enables cow_user_page() to check that the source page is
+          not undergoing DMA.
+
+          This option causes a performance degradation.  Use only if you want to
+          debug device drivers and dma interactions.
+
+          If unsure, say N.
+
 menu "Runtime Testing"
 
 config LKDTM
@@ -1749,56 +1797,6 @@ config TEST_PARMAN
 
           If unsure, say N.
 
-endmenu # runtime tests
-
-config PROVIDE_OHCI1394_DMA_INIT
-        bool "Remote debugging over FireWire early on boot"
-        depends on PCI && X86
-        help
-          If you want to debug problems which hang or crash the kernel early
-          on boot and the crashing machine has a FireWire port, you can use
-          this feature to remotely access the memory of the crashed machine
-          over FireWire. This employs remote DMA as part of the OHCI1394
-          specification which is now the standard for FireWire controllers.
-
-          With remote DMA, you can monitor the printk buffer remotely using
-          firescope and access all memory below 4GB using fireproxy from gdb.
-          Even controlling a kernel debugger is possible using remote DMA.
-
-          Usage:
-
-          If ohci1394_dma=early is used as boot parameter, it will initialize
-          all OHCI1394 controllers which are found in the PCI config space.
-
-          As all changes to the FireWire bus such as enabling and disabling
-          devices cause a bus reset and thereby disable remote DMA for all
-          devices, be sure to have the cable plugged and FireWire enabled on
-          the debugging host before booting the debug target for debugging.
-
-          This code (~1k) is freed after boot. By then, the firewire stack
-          in charge of the OHCI-1394 controllers should be used instead.
-
-          See Documentation/debugging-via-ohci1394.txt for more information.
-
-config DMA_API_DEBUG
-        bool "Enable debugging of DMA-API usage"
-        depends on HAVE_DMA_API_DEBUG
-        help
-          Enable this option to debug the use of the DMA API by device drivers.
-          With this option you will be able to detect common bugs in device
-          drivers like double-freeing of DMA mappings or freeing mappings that
-          were never allocated.
-
-          This also attempts to catch cases where a page owned by DMA is
-          accessed by the cpu in a way that could cause data corruption.  For
-          example, this enables cow_user_page() to check that the source page is
-          not undergoing DMA.
-
-          This option causes a performance degradation.  Use only if you want to
-          debug device drivers and dma interactions.
-
-          If unsure, say N.
-
 config TEST_LKM
         tristate "Test module loading with 'hello world' module"
         default n
@@ -1873,18 +1871,6 @@ config TEST_UDELAY
 
           If unsure, say N.
 
-config MEMTEST
-        bool "Memtest"
-        depends on HAVE_MEMBLOCK
-        ---help---
-          This option adds a kernel parameter 'memtest', which allows memtest
-          to be set.
-                memtest=0, mean disabled; -- default
-                memtest=1, mean do 1 test pattern;
-                ...
-                memtest=17, mean do 17 test patterns.
-          If you are unsure how to answer this question, answer N.
-
 config TEST_STATIC_KEYS
         tristate "Test static keys"
         default n
@@ -1894,16 +1880,6 @@ config TEST_STATIC_KEYS
 
           If unsure, say N.
 
-config BUG_ON_DATA_CORRUPTION
-        bool "Trigger a BUG when data corruption is detected"
-        select DEBUG_LIST
-        help
-          Select this option if the kernel should BUG when it encounters
-          data corruption in kernel memory structures when they get checked
-          for validity.
-
-          If unsure, say N.
-
 config TEST_KMOD
         tristate "kmod stress tester"
         default n
@@ -1941,6 +1917,29 @@ config TEST_DEBUG_VIRTUAL
 
           If unsure, say N.
 
+endmenu # runtime tests
+
+config MEMTEST
+        bool "Memtest"
+        depends on HAVE_MEMBLOCK
+        ---help---
+          This option adds a kernel parameter 'memtest', which allows memtest
+          to be set.
+                memtest=0, mean disabled; -- default
+                memtest=1, mean do 1 test pattern;
+                ...
+                memtest=17, mean do 17 test patterns.
+          If you are unsure how to answer this question, answer N.
+
+config BUG_ON_DATA_CORRUPTION
+        bool "Trigger a BUG when data corruption is detected"
+        select DEBUG_LIST
+        help
+          Select this option if the kernel should BUG when it encounters
+          data corruption in kernel memory structures when they get checked
+          for validity.
+
+          If unsure, say N.
 
 source "samples/Kconfig"
 
diff --git a/mm/cma.c b/mm/cma.c
index c0da318c020e..022e52bd8370 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -460,7 +460,7 @@ struct page *cma_alloc(struct cma *cma, size_t count, unsigned int align,
 
         trace_cma_alloc(pfn, page, count, align);
 
-        if (ret) {
+        if (ret && !(gfp_mask & __GFP_NOWARN)) {
                 pr_info("%s: alloc failed, req-size: %zu pages, ret: %d\n",
                         __func__, count, ret);
                 cma_debug_show_areas(cma);
diff --git a/mm/madvise.c b/mm/madvise.c
index 25bade36e9ca..fd70d6aabc3e 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -757,6 +757,9 @@ madvise_behavior_valid(int behavior)
  *  MADV_DONTFORK - omit this area from child's address space when forking:
  *              typically, to avoid COWing pages pinned by get_user_pages().
  *  MADV_DOFORK - cancel MADV_DONTFORK: no longer omit this area when forking.
+ *  MADV_WIPEONFORK - present the child process with zero-filled memory in this
+ *              range after a fork.
+ *  MADV_KEEPONFORK - undo the effect of MADV_WIPEONFORK
  *  MADV_HWPOISON - trigger memory error handler as if the given memory range
  *              were corrupted by unrecoverable hardware memory failure.
  *  MADV_SOFT_OFFLINE - try to soft-offline the given range of memory.
@@ -777,7 +780,9 @@ madvise_behavior_valid(int behavior)
  *  zero    - success
  *  -EINVAL - start + len < 0, start is not page-aligned,
  *              "behavior" is not a valid value, or application
- *              is attempting to release locked or shared pages.
+ *              is attempting to release locked or shared pages,
+ *              or the specified address range includes file, Huge TLB,
+ *              MAP_SHARED or VMPFNMAP range.
  *  -ENOMEM - addresses in the specified range are not currently
  *              mapped, or are outside the AS of the process.
  *  -EIO    - an I/O error occurred while paging in data.
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 006ba625c0b8..a2af6d58a68f 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1920,8 +1920,11 @@ static struct page *alloc_page_interleave(gfp_t gfp, unsigned order,
         struct page *page;
 
         page = __alloc_pages(gfp, order, nid);
-        if (page && page_to_nid(page) == nid)
-                inc_zone_page_state(page, NUMA_INTERLEAVE_HIT);
+        if (page && page_to_nid(page) == nid) {
+                preempt_disable();
+                __inc_numa_state(page_zone(page), NUMA_INTERLEAVE_HIT);
+                preempt_enable();
+        }
         return page;
 }
 
diff --git a/mm/migrate.c b/mm/migrate.c
index 6954c1435833..e00814ca390e 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -2146,8 +2146,9 @@ static int migrate_vma_collect_hole(unsigned long start,
         unsigned long addr;
 
         for (addr = start & PAGE_MASK; addr < end; addr += PAGE_SIZE) {
-                migrate->src[migrate->npages++] = MIGRATE_PFN_MIGRATE;
+                migrate->src[migrate->npages] = MIGRATE_PFN_MIGRATE;
                 migrate->dst[migrate->npages] = 0;
+                migrate->npages++;
                 migrate->cpages++;
         }
 
diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c
index 6a03946469a9..53afbb919a1c 100644
--- a/mm/page_vma_mapped.c
+++ b/mm/page_vma_mapped.c
@@ -6,17 +6,6 @@
 
 #include "internal.h"
 
-static inline bool check_pmd(struct page_vma_mapped_walk *pvmw)
-{
-        pmd_t pmde;
-        /*
-         * Make sure we don't re-load pmd between present and !trans_huge check.
-         * We need a consistent view.
-         */
-        pmde = READ_ONCE(*pvmw->pmd);
-        return pmd_present(pmde) && !pmd_trans_huge(pmde);
-}
-
 static inline bool not_found(struct page_vma_mapped_walk *pvmw)
 {
         page_vma_mapped_walk_done(pvmw);
@@ -116,6 +105,7 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw)
         pgd_t *pgd;
         p4d_t *p4d;
         pud_t *pud;
+        pmd_t pmde;
 
         /* The only possible pmd mapping has been handled on last iteration */
         if (pvmw->pmd && !pvmw->pte)
@@ -148,7 +138,13 @@ restart:
         if (!pud_present(*pud))
                 return false;
         pvmw->pmd = pmd_offset(pud, pvmw->address);
-        if (pmd_trans_huge(*pvmw->pmd) || is_pmd_migration_entry(*pvmw->pmd)) {
+        /*
+         * Make sure the pmd value isn't cached in a register by the
+         * compiler and used as a stale value after we've observed a
+         * subsequent update.
+         */
+        pmde = READ_ONCE(*pvmw->pmd);
+        if (pmd_trans_huge(pmde) || is_pmd_migration_entry(pmde)) {
                 pvmw->ptl = pmd_lock(mm, pvmw->pmd);
                 if (likely(pmd_trans_huge(*pvmw->pmd))) {
                         if (pvmw->flags & PVMW_MIGRATION)
@@ -167,17 +163,15 @@ restart:
                                                 return not_found(pvmw);
                                         return true;
                                 }
-                        } else
-                                WARN_ONCE(1, "Non present huge pmd without pmd migration enabled!");
+                        }
                         return not_found(pvmw);
                 } else {
                         /* THP pmd was split under us: handle on pte level */
                         spin_unlock(pvmw->ptl);
                         pvmw->ptl = NULL;
                 }
-        } else {
-                if (!check_pmd(pvmw))
-                        return false;
+        } else if (!pmd_present(pmde)) {
+                return false;
         }
         if (!map_pte(pvmw))
                 goto next_pte;
diff --git a/mm/swap_state.c b/mm/swap_state.c
index ed91091d1e68..05b6803f0cce 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -39,10 +39,6 @@ struct address_space *swapper_spaces[MAX_SWAPFILES];
 static unsigned int nr_swapper_spaces[MAX_SWAPFILES];
 bool swap_vma_readahead = true;
 
-#define SWAP_RA_MAX_ORDER_DEFAULT       3
-
-static int swap_ra_max_order = SWAP_RA_MAX_ORDER_DEFAULT;
-
 #define SWAP_RA_WIN_SHIFT       (PAGE_SHIFT / 2)
 #define SWAP_RA_HITS_MASK       ((1UL << SWAP_RA_WIN_SHIFT) - 1)
 #define SWAP_RA_HITS_MAX        SWAP_RA_HITS_MASK
@@ -664,6 +660,13 @@ struct page *swap_readahead_detect(struct vm_fault *vmf,
         pte_t *tpte;
 #endif
 
+        max_win = 1 << min_t(unsigned int, READ_ONCE(page_cluster),
+                             SWAP_RA_ORDER_CEILING);
+        if (max_win == 1) {
+                swap_ra->win = 1;
+                return NULL;
+        }
+
         faddr = vmf->address;
         entry = pte_to_swp_entry(vmf->orig_pte);
         if ((unlikely(non_swap_entry(entry))))
@@ -672,12 +675,6 @@ struct page *swap_readahead_detect(struct vm_fault *vmf,
         if (page)
                 return page;
 
-        max_win = 1 << READ_ONCE(swap_ra_max_order);
-        if (max_win == 1) {
-                swap_ra->win = 1;
-                return NULL;
-        }
-
         fpfn = PFN_DOWN(faddr);
         swap_ra_info = GET_SWAP_RA_VAL(vma);
         pfn = PFN_DOWN(SWAP_RA_ADDR(swap_ra_info));
@@ -786,32 +783,8 @@ static struct kobj_attribute vma_ra_enabled_attr =
         __ATTR(vma_ra_enabled, 0644, vma_ra_enabled_show,
                vma_ra_enabled_store);
 
-static ssize_t vma_ra_max_order_show(struct kobject *kobj,
-                                     struct kobj_attribute *attr, char *buf)
-{
-        return sprintf(buf, "%d\n", swap_ra_max_order);
-}
-static ssize_t vma_ra_max_order_store(struct kobject *kobj,
-                                      struct kobj_attribute *attr,
-                                      const char *buf, size_t count)
-{
-        int err, v;
-
-        err = kstrtoint(buf, 10, &v);
-        if (err || v > SWAP_RA_ORDER_CEILING || v <= 0)
-                return -EINVAL;
-
-        swap_ra_max_order = v;
-
-        return count;
-}
-static struct kobj_attribute vma_ra_max_order_attr =
-        __ATTR(vma_ra_max_order, 0644, vma_ra_max_order_show,
-               vma_ra_max_order_store);
-
 static struct attribute *swap_attrs[] = {
         &vma_ra_enabled_attr.attr,
-        &vma_ra_max_order_attr.attr,
         NULL,
 };
 
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 8a43db6284eb..673942094328 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1695,11 +1695,6 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
         for (i = 0; i < area->nr_pages; i++) {
                 struct page *page;
 
-                if (fatal_signal_pending(current)) {
-                        area->nr_pages = i;
-                        goto fail_no_warn;
-                }
-
                 if (node == NUMA_NO_NODE)
                         page = alloc_page(alloc_mask|highmem_mask);
                 else
@@ -1723,7 +1718,6 @@ fail:
         warn_alloc(gfp_mask, NULL,
                           "vmalloc: allocation failure, allocated %ld of %ld bytes",
                           (area->nr_pages*PAGE_SIZE), area->size);
-fail_no_warn:
         vfree(area->addr);
         return NULL;
 }
diff --git a/scripts/faddr2line b/scripts/faddr2line
index 29df825d375c..2f6ce802397d 100755
--- a/scripts/faddr2line
+++ b/scripts/faddr2line
@@ -103,11 +103,12 @@ __faddr2line() {
 
         # Go through each of the object's symbols which match the func name.
         # In rare cases there might be duplicates.
+        file_end=$(size -Ax $objfile | awk '$1 == ".text" {print $2}')
         while read symbol; do
                 local fields=($symbol)
                 local sym_base=0x${fields[0]}
                 local sym_type=${fields[1]}
-                local sym_end=0x${fields[3]}
+                local sym_end=${fields[3]}
 
                 # calculate the size
                 local sym_size=$(($sym_end - $sym_base))
@@ -157,7 +158,7 @@ __faddr2line() {
                 addr2line -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;"
                 DONE=1
 
-        done < <(nm -n $objfile | awk -v fn=$func '$3 == fn { found=1; line=$0; start=$1; next } found == 1 { found=0; print line, $1 }')
+        done < <(nm -n $objfile | awk -v fn=$func -v end=$file_end '$3 == fn { found=1; line=$0; start=$1; next } found == 1 { found=0; print line, "0x"$1 } END {if (found == 1) print line, end; }')
 }
 
 [[ $# -lt 2 ]] && usage
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 5d554419170b..9ee9bf7fd1a2 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -158,7 +158,7 @@ static int read_symbol(FILE *in, struct sym_entry *s)
         else if (str[0] == '$')
                 return -1;
         /* exclude debugging symbols */
-        else if (stype == 'N')
+        else if (stype == 'N' || stype == 'n')
                 return -1;
 
         /* include the type field in the symbol name, so that it gets
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index ea2d0ae85bd3..6c9cba2166d9 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1259,6 +1259,7 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg)
         struct snd_seq_port_info *info = arg;
         struct snd_seq_client_port *port;
         struct snd_seq_port_callback *callback;
+        int port_idx;
 
         /* it is not allowed to create the port for an another client */
         if (info->addr.client != client->number)
@@ -1269,7 +1270,9 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg)
                 return -ENOMEM;
 
         if (client->type == USER_CLIENT && info->kernel) {
-                snd_seq_delete_port(client, port->addr.port);
+                port_idx = port->addr.port;
+                snd_seq_port_unlock(port);
+                snd_seq_delete_port(client, port_idx);
                 return -EINVAL;
         }
         if (client->type == KERNEL_CLIENT) {
@@ -1290,6 +1293,7 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg)
 
         snd_seq_set_port_info(port, info);
         snd_seq_system_client_ev_port_start(port->addr.client, port->addr.port);
+        snd_seq_port_unlock(port);
 
         return 0;
 }
diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
index 0a7020c82bfc..d21ece9f8d73 100644
--- a/sound/core/seq/seq_ports.c
+++ b/sound/core/seq/seq_ports.c
@@ -122,7 +122,9 @@ static void port_subs_info_init(struct snd_seq_port_subs_info *grp)
 }
 
 
-/* create a port, port number is returned (-1 on failure) */
+/* create a port, port number is returned (-1 on failure);
+ * the caller needs to unref the port via snd_seq_port_unlock() appropriately
+ */
 struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
                                                 int port)
 {
@@ -151,6 +153,7 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
         snd_use_lock_init(&new_port->use_lock);
         port_subs_info_init(&new_port->c_src);
         port_subs_info_init(&new_port->c_dest);
+        snd_use_lock_use(&new_port->use_lock);
 
         num = port >= 0 ? port : 0;
         mutex_lock(&client->ports_mutex);
@@ -165,9 +168,9 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
         list_add_tail(&new_port->list, &p->list);
         client->num_ports++;
         new_port->addr.port = num;      /* store the port number in the port */
+        sprintf(new_port->name, "port-%d", num);
         write_unlock_irqrestore(&client->ports_lock, flags);
         mutex_unlock(&client->ports_mutex);
-        sprintf(new_port->name, "port-%d", num);
 
         return new_port;
 }
diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
index 8d93a4021c78..f48a4cd24ffc 100644
--- a/sound/core/seq/seq_virmidi.c
+++ b/sound/core/seq/seq_virmidi.c
@@ -77,13 +77,17 @@ static void snd_virmidi_init_event(struct snd_virmidi *vmidi,
  * decode input event and put to read buffer of each opened file
  */
 static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
-                                         struct snd_seq_event *ev)
+                                         struct snd_seq_event *ev,
+                                         bool atomic)
 {
         struct snd_virmidi *vmidi;
         unsigned char msg[4];
         int len;
 
-        read_lock(&rdev->filelist_lock);
+        if (atomic)
+                read_lock(&rdev->filelist_lock);
+        else
+                down_read(&rdev->filelist_sem);
         list_for_each_entry(vmidi, &rdev->filelist, list) {
                 if (!vmidi->trigger)
                         continue;
@@ -97,7 +101,10 @@ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
                                 snd_rawmidi_receive(vmidi->substream, msg, len);
                 }
         }
-        read_unlock(&rdev->filelist_lock);
+        if (atomic)
+                read_unlock(&rdev->filelist_lock);
+        else
+                up_read(&rdev->filelist_sem);
 
         return 0;
 }
@@ -115,7 +122,7 @@ int snd_virmidi_receive(struct snd_rawmidi *rmidi, struct snd_seq_event *ev)
         struct snd_virmidi_dev *rdev;
 
         rdev = rmidi->private_data;
-        return snd_virmidi_dev_receive_event(rdev, ev);
+        return snd_virmidi_dev_receive_event(rdev, ev, true);
 }
 #endif  /*  0  */
 
@@ -130,7 +137,7 @@ static int snd_virmidi_event_input(struct snd_seq_event *ev, int direct,
         rdev = private_data;
         if (!(rdev->flags & SNDRV_VIRMIDI_USE))
                 return 0; /* ignored */
-        return snd_virmidi_dev_receive_event(rdev, ev);
+        return snd_virmidi_dev_receive_event(rdev, ev, atomic);
 }
 
 /*
@@ -209,7 +216,6 @@ static int snd_virmidi_input_open(struct snd_rawmidi_substream *substream)
         struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
         struct snd_rawmidi_runtime *runtime = substream->runtime;
         struct snd_virmidi *vmidi;
-        unsigned long flags;
 
         vmidi = kzalloc(sizeof(*vmidi), GFP_KERNEL);
         if (vmidi == NULL)
@@ -223,9 +229,11 @@ static int snd_virmidi_input_open(struct snd_rawmidi_substream *substream)
         vmidi->client = rdev->client;
         vmidi->port = rdev->port;       
         runtime->private_data = vmidi;
-        write_lock_irqsave(&rdev->filelist_lock, flags);
+        down_write(&rdev->filelist_sem);
+        write_lock_irq(&rdev->filelist_lock);
         list_add_tail(&vmidi->list, &rdev->filelist);
-        write_unlock_irqrestore(&rdev->filelist_lock, flags);
+        write_unlock_irq(&rdev->filelist_lock);
+        up_write(&rdev->filelist_sem);
         vmidi->rdev = rdev;
         return 0;
 }
@@ -264,9 +272,11 @@ static int snd_virmidi_input_close(struct snd_rawmidi_substream *substream)
         struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
         struct snd_virmidi *vmidi = substream->runtime->private_data;
 
+        down_write(&rdev->filelist_sem);
         write_lock_irq(&rdev->filelist_lock);
         list_del(&vmidi->list);
         write_unlock_irq(&rdev->filelist_lock);
+        up_write(&rdev->filelist_sem);
         snd_midi_event_free(vmidi->parser);
         substream->runtime->private_data = NULL;
         kfree(vmidi);
@@ -520,6 +530,7 @@ int snd_virmidi_new(struct snd_card *card, int device, struct snd_rawmidi **rrmi
         rdev->rmidi = rmidi;
         rdev->device = device;
         rdev->client = -1;
+        init_rwsem(&rdev->filelist_sem);
         rwlock_init(&rdev->filelist_lock);
         INIT_LIST_HEAD(&rdev->filelist);
         rdev->seq_mode = SNDRV_VIRMIDI_SEQ_DISPATCH;
diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index 0fb6b1b79261..d8409d9ae55b 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -469,10 +469,12 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 
         err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
         if (err)
-                return err;
+                goto err_kill_urb;
 
-        if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ))
-                return -ENODEV;
+        if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) {
+                err = -ENODEV;
+                goto err_kill_urb;
+        }
 
         usb_string(usb_dev, usb_dev->descriptor.iManufacturer,
                    cdev->vendor_name, CAIAQ_USB_STR_LEN);
@@ -507,6 +509,10 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 
         setup_card(cdev);
         return 0;
+
+ err_kill_urb:
+        usb_kill_urb(&cdev->ep1_in_urb);
+        return err;
 }
 
 static int snd_probe(struct usb_interface *intf,
diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
index 0ff5a7d2e19f..c8f723c3a033 100644
--- a/sound/usb/line6/driver.c
+++ b/sound/usb/line6/driver.c
@@ -779,9 +779,10 @@ int line6_probe(struct usb_interface *interface,
         return 0;
 
  error:
-        if (line6->disconnect)
-                line6->disconnect(line6);
-        snd_card_free(card);
+        /* we can call disconnect callback here because no close-sync is
+         * needed yet at this point
+         */
+        line6_disconnect(interface);
         return ret;
 }
 EXPORT_SYMBOL_GPL(line6_probe);
diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c
index 956f847a96e4..451007c27743 100644
--- a/sound/usb/line6/podhd.c
+++ b/sound/usb/line6/podhd.c
@@ -301,7 +301,8 @@ static void podhd_disconnect(struct usb_line6 *line6)
 
                 intf = usb_ifnum_to_if(line6->usbdev,
                                         pod->line6.properties->ctrl_if);
-                usb_driver_release_interface(&podhd_driver, intf);
+                if (intf)
+                        usb_driver_release_interface(&podhd_driver, intf);
         }
 }
 
@@ -317,6 +318,9 @@ static int podhd_init(struct usb_line6 *line6,
 
         line6->disconnect = podhd_disconnect;
 
+        init_timer(&pod->startup_timer);
+        INIT_WORK(&pod->startup_work, podhd_startup_workqueue);
+
         if (pod->line6.properties->capabilities & LINE6_CAP_CONTROL) {
                 /* claim the data interface */
                 intf = usb_ifnum_to_if(line6->usbdev,
@@ -358,8 +362,6 @@ static int podhd_init(struct usb_line6 *line6,
         }
 
         /* init device and delay registering */
-        init_timer(&pod->startup_timer);
-        INIT_WORK(&pod->startup_work, podhd_startup_workqueue);
         podhd_startup(pod);
         return 0;
 }
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 9732edf77f86..91bc8f18791e 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2234,6 +2234,9 @@ static int parse_audio_unit(struct mixer_build *state, int unitid)
 
 static void snd_usb_mixer_free(struct usb_mixer_interface *mixer)
 {
+        /* kill pending URBs */
+        snd_usb_mixer_disconnect(mixer);
+
         kfree(mixer->id_elems);
         if (mixer->urb) {
                 kfree(mixer->urb->transfer_buffer);
@@ -2584,8 +2587,13 @@ _error:
 
 void snd_usb_mixer_disconnect(struct usb_mixer_interface *mixer)
 {
-        usb_kill_urb(mixer->urb);
-        usb_kill_urb(mixer->rc_urb);
+        if (mixer->disconnected)
+                return;
+        if (mixer->urb)
+                usb_kill_urb(mixer->urb);
+        if (mixer->rc_urb)
+                usb_kill_urb(mixer->rc_urb);
+        mixer->disconnected = true;
 }
 
 #ifdef CONFIG_PM
diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
index 2b4b067646ab..545d99b09706 100644
--- a/sound/usb/mixer.h
+++ b/sound/usb/mixer.h
@@ -22,6 +22,8 @@ struct usb_mixer_interface {
         struct urb *rc_urb;
         struct usb_ctrlrequest *rc_setup_packet;
         u8 rc_buffer[6];
+
+        bool disconnected;
 };
 
 #define MAX_CHANNELS    16      /* max logical channels */
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index b8cb57aeec77..9ddaae3784f5 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1138,6 +1138,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
         case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */
         case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
         case USB_ID(0x047F, 0xC022): /* Plantronics C310 */
+        case USB_ID(0x047F, 0xC02F): /* Plantronics P610 */
         case USB_ID(0x047F, 0xC036): /* Plantronics C520-M */
         case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
         case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
diff --git a/tools/testing/selftests/mqueue/Makefile b/tools/testing/selftests/mqueue/Makefile
index 0f5e347b068d..152823b6cb21 100644
--- a/tools/testing/selftests/mqueue/Makefile
+++ b/tools/testing/selftests/mqueue/Makefile
@@ -5,8 +5,8 @@ TEST_GEN_PROGS := mq_open_tests mq_perf_tests
 include ../lib.mk
 
 override define RUN_TESTS
-        $(OUTPUT)/mq_open_tests /test1 || echo "selftests: mq_open_tests [FAIL]"
-        $(OUTPUT)//mq_perf_tests || echo "selftests: mq_perf_tests [FAIL]"
+        @$(OUTPUT)/mq_open_tests /test1 || echo "selftests: mq_open_tests [FAIL]"
+        @$(OUTPUT)/mq_perf_tests || echo "selftests: mq_perf_tests [FAIL]"
 endef
 
 override define EMIT_TESTS
diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c
index a2c53a3d223d..de2f9ec8a87f 100644
--- a/tools/testing/selftests/vm/userfaultfd.c
+++ b/tools/testing/selftests/vm/userfaultfd.c
@@ -397,7 +397,7 @@ static void retry_copy_page(int ufd, struct uffdio_copy *uffdio_copy,
         }
 }
 
-static int copy_page(int ufd, unsigned long offset)
+static int __copy_page(int ufd, unsigned long offset, bool retry)
 {
         struct uffdio_copy uffdio_copy;
 
@@ -418,7 +418,7 @@ static int copy_page(int ufd, unsigned long offset)
                 fprintf(stderr, "UFFDIO_COPY unexpected copy %Ld\n",
                         uffdio_copy.copy), exit(1);
         } else {
-                if (test_uffdio_copy_eexist) {
+                if (test_uffdio_copy_eexist && retry) {
                         test_uffdio_copy_eexist = false;
                         retry_copy_page(ufd, &uffdio_copy, offset);
                 }
@@ -427,6 +427,16 @@ static int copy_page(int ufd, unsigned long offset)
         return 0;
 }
 
+static int copy_page_retry(int ufd, unsigned long offset)
+{
+        return __copy_page(ufd, offset, true);
+}
+
+static int copy_page(int ufd, unsigned long offset)
+{
+        return __copy_page(ufd, offset, false);
+}
+
 static void *uffd_poll_thread(void *arg)
 {
         unsigned long cpu = (unsigned long) arg;
@@ -544,7 +554,7 @@ static void *background_thread(void *arg)
         for (page_nr = cpu * nr_pages_per_cpu;
              page_nr < (cpu+1) * nr_pages_per_cpu;
              page_nr++)
-                copy_page(uffd, page_nr * page_size);
+                copy_page_retry(uffd, page_nr * page_size);
 
         return NULL;
 }
@@ -779,7 +789,7 @@ static void retry_uffdio_zeropage(int ufd,
         }
 }
 
-static int uffdio_zeropage(int ufd, unsigned long offset)
+static int __uffdio_zeropage(int ufd, unsigned long offset, bool retry)
 {
         struct uffdio_zeropage uffdio_zeropage;
         int ret;
@@ -814,7 +824,7 @@ static int uffdio_zeropage(int ufd, unsigned long offset)
                         fprintf(stderr, "UFFDIO_ZEROPAGE unexpected %Ld\n",
                                 uffdio_zeropage.zeropage), exit(1);
                 } else {
-                        if (test_uffdio_zeropage_eexist) {
+                        if (test_uffdio_zeropage_eexist && retry) {
                                 test_uffdio_zeropage_eexist = false;
                                 retry_uffdio_zeropage(ufd, &uffdio_zeropage,
                                                       offset);
@@ -830,6 +840,11 @@ static int uffdio_zeropage(int ufd, unsigned long offset)
         return 0;
 }
 
+static int uffdio_zeropage(int ufd, unsigned long offset)
+{
+        return __uffdio_zeropage(ufd, offset, false);
+}
+
 /* exercise UFFDIO_ZEROPAGE */
 static int userfaultfd_zeropage_test(void)
 {
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index 97f187e2663f..0a74a20ca32b 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -20,7 +20,7 @@ BINARIES_64 := $(TARGETS_C_64BIT_ALL:%=%_64)
 BINARIES_32 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_32))
 BINARIES_64 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_64))
 
-CFLAGS := -O2 -g -std=gnu99 -pthread -Wall
+CFLAGS := -O2 -g -std=gnu99 -pthread -Wall -no-pie
 
 UNAME_M := $(shell uname -m)
 CAN_BUILD_I386 := $(shell ./check_cc.sh $(CC) trivial_32bit_program.c -m32)