216 files changed, 1236 insertions, 831 deletions
diff --git a/.clang-format b/.clang-format
index e6080f5834a3..bc2ffb2a0b53 100644
--- a/.clang-format
+++ b/.clang-format
@@ -72,6 +72,10 @@ ForEachMacros:
  - 'apei_estatus_for_each_section'
  - 'ata_for_each_dev'
  - 'ata_for_each_link'
+  - '__ata_qc_for_each'
+  - 'ata_qc_for_each'
+  - 'ata_qc_for_each_raw'
+  - 'ata_qc_for_each_with_internal'
  - 'ax25_for_each'
  - 'ax25_uid_for_each'
  - 'bio_for_each_integrity_vec'
@@ -85,6 +89,7 @@ ForEachMacros:
  - 'blk_queue_for_each_rl'
  - 'bond_for_each_slave'
  - 'bond_for_each_slave_rcu'
+  - 'bpf_for_each_spilled_reg'
  - 'btree_for_each_safe128'
  - 'btree_for_each_safe32'
  - 'btree_for_each_safe64'
@@ -103,6 +108,8 @@ ForEachMacros:
  - 'drm_atomic_crtc_for_each_plane'
  - 'drm_atomic_crtc_state_for_each_plane'
  - 'drm_atomic_crtc_state_for_each_plane_state'
+  - 'drm_atomic_for_each_plane_damage'
+  - 'drm_connector_for_each_possible_encoder'
  - 'drm_for_each_connector_iter'
  - 'drm_for_each_crtc'
  - 'drm_for_each_encoder'
@@ -121,11 +128,21 @@ ForEachMacros:
  - 'for_each_bio'
  - 'for_each_board_func_rsrc'
  - 'for_each_bvec'
+  - 'for_each_card_components'
+  - 'for_each_card_links'
+  - 'for_each_card_links_safe'
+  - 'for_each_card_prelinks'
+  - 'for_each_card_rtds'
+  - 'for_each_card_rtds_safe'
+  - 'for_each_cgroup_storage_type'
  - 'for_each_child_of_node'
  - 'for_each_clear_bit'
  - 'for_each_clear_bit_from'
  - 'for_each_cmsghdr'
  - 'for_each_compatible_node'
+  - 'for_each_component_dais'
+  - 'for_each_component_dais_safe'
+  - 'for_each_comp_order'
  - 'for_each_console'
  - 'for_each_cpu'
  - 'for_each_cpu_and'
@@ -133,6 +150,10 @@ ForEachMacros:
  - 'for_each_cpu_wrap'
  - 'for_each_dev_addr'
  - 'for_each_dma_cap_mask'
+  - 'for_each_dpcm_be'
+  - 'for_each_dpcm_be_rollback'
+  - 'for_each_dpcm_be_safe'
+  - 'for_each_dpcm_fe'
  - 'for_each_drhd_unit'
  - 'for_each_dss_dev'
  - 'for_each_efi_memory_desc'
@@ -149,6 +170,7 @@ ForEachMacros:
  - 'for_each_iommu'
  - 'for_each_ip_tunnel_rcu'
  - 'for_each_irq_nr'
+  - 'for_each_link_codecs'
  - 'for_each_lru'
  - 'for_each_matching_node'
  - 'for_each_matching_node_and_match'
@@ -160,6 +182,7 @@ ForEachMacros:
  - 'for_each_mem_range_rev'
  - 'for_each_migratetype_order'
  - 'for_each_msi_entry'
+  - 'for_each_msi_entry_safe'
  - 'for_each_net'
  - 'for_each_netdev'
  - 'for_each_netdev_continue'
@@ -183,12 +206,14 @@ ForEachMacros:
  - 'for_each_node_with_property'
  - 'for_each_of_allnodes'
  - 'for_each_of_allnodes_from'
+  - 'for_each_of_cpu_node'
  - 'for_each_of_pci_range'
  - 'for_each_old_connector_in_state'
  - 'for_each_old_crtc_in_state'
  - 'for_each_oldnew_connector_in_state'
  - 'for_each_oldnew_crtc_in_state'
  - 'for_each_oldnew_plane_in_state'
+  - 'for_each_oldnew_plane_in_state_reverse'
  - 'for_each_oldnew_private_obj_in_state'
  - 'for_each_old_plane_in_state'
  - 'for_each_old_private_obj_in_state'
@@ -206,14 +231,17 @@ ForEachMacros:
  - 'for_each_process'
  - 'for_each_process_thread'
  - 'for_each_property_of_node'
+  - 'for_each_registered_fb'
  - 'for_each_reserved_mem_region'
-  - 'for_each_resv_unavail_range'
+  - 'for_each_rtd_codec_dai'
+  - 'for_each_rtd_codec_dai_rollback'
  - 'for_each_rtdcom'
  - 'for_each_rtdcom_safe'
  - 'for_each_set_bit'
  - 'for_each_set_bit_from'
  - 'for_each_sg'
  - 'for_each_sg_page'
+  - 'for_each_sibling_event'
  - '__for_each_thread'
  - 'for_each_thread'
  - 'for_each_zone'
@@ -251,6 +279,8 @@ ForEachMacros:
  - 'hlist_nulls_for_each_entry_from'
  - 'hlist_nulls_for_each_entry_rcu'
  - 'hlist_nulls_for_each_entry_safe'
+  - 'i3c_bus_for_each_i2cdev'
+  - 'i3c_bus_for_each_i3cdev'
  - 'ide_host_for_each_port'
  - 'ide_port_for_each_dev'
  - 'ide_port_for_each_present_dev'
@@ -267,11 +297,14 @@ ForEachMacros:
  - 'kvm_for_each_memslot'
  - 'kvm_for_each_vcpu'
  - 'list_for_each'
+  - 'list_for_each_codec'
+  - 'list_for_each_codec_safe'
  - 'list_for_each_entry'
  - 'list_for_each_entry_continue'
  - 'list_for_each_entry_continue_rcu'
  - 'list_for_each_entry_continue_reverse'
  - 'list_for_each_entry_from'
+  - 'list_for_each_entry_from_rcu'
  - 'list_for_each_entry_from_reverse'
  - 'list_for_each_entry_lockless'
  - 'list_for_each_entry_rcu'
@@ -291,6 +324,7 @@ ForEachMacros:
  - 'media_device_for_each_intf'
  - 'media_device_for_each_link'
  - 'media_device_for_each_pad'
+  - 'nanddev_io_for_each_page'
  - 'netdev_for_each_lower_dev'
  - 'netdev_for_each_lower_private'
  - 'netdev_for_each_lower_private_rcu'
@@ -357,12 +391,14 @@ ForEachMacros:
  - 'sk_nulls_for_each'
  - 'sk_nulls_for_each_from'
  - 'sk_nulls_for_each_rcu'
+  - 'snd_array_for_each'
  - 'snd_pcm_group_for_each_entry'
  - 'snd_soc_dapm_widget_for_each_path'
  - 'snd_soc_dapm_widget_for_each_path_safe'
  - 'snd_soc_dapm_widget_for_each_sink_path'
  - 'snd_soc_dapm_widget_for_each_source_path'
  - 'tb_property_for_each'
+  - 'tcf_exts_for_each_action'
  - 'udp_portaddr_for_each_entry'
  - 'udp_portaddr_for_each_entry_rcu'
  - 'usb_hub_for_each_child'
@@ -371,6 +407,11 @@ ForEachMacros:
  - 'v4l2_m2m_for_each_dst_buf_safe'
  - 'v4l2_m2m_for_each_src_buf'
  - 'v4l2_m2m_for_each_src_buf_safe'
+  - 'virtio_device_for_each_vq'
+  - 'xa_for_each'
+  - 'xas_for_each'
+  - 'xas_for_each_conflict'
+  - 'xas_for_each_marked'
  - 'zorro_for_each_dev'
 #IncludeBlocks: Preserve # Unknown to clang-format-5.0
diff --git a/Documentation/devicetree/bindings/arm/cpu-capacity.txt b/Documentation/devicetree/bindings/arm/cpu-capacity.txt
index 84262cdb8d29..96fa46cb133c 100644
--- a/Documentation/devicetree/bindings/arm/cpu-capacity.txt
+++ b/Documentation/devicetree/bindings/arm/cpu-capacity.txt
@@ -235,4 +235,4 @@ cpus {
 ===========================================
 [1] ARM Linux Kernel documentation - CPUs bindings
-    Documentation/devicetree/bindings/arm/cpus.txt
+    Documentation/devicetree/bindings/arm/cpus.yaml
diff --git a/Documentation/devicetree/bindings/arm/idle-states.txt b/Documentation/devicetree/bindings/arm/idle-states.txt
index 8f0937db55c5..45730ba60af5 100644
--- a/Documentation/devicetree/bindings/arm/idle-states.txt
+++ b/Documentation/devicetree/bindings/arm/idle-states.txt
@@ -684,7 +684,7 @@ cpus {
 ===========================================
 [1] ARM Linux Kernel documentation - CPUs bindings
-    Documentation/devicetree/bindings/arm/cpus.txt
+    Documentation/devicetree/bindings/arm/cpus.yaml
 [2] ARM Linux Kernel documentation - PSCI bindings
    Documentation/devicetree/bindings/arm/psci.txt
diff --git a/Documentation/devicetree/bindings/arm/sp810.txt b/Documentation/devicetree/bindings/arm/sp810.txt
index 1b2ab1ff5587..46652bf65147 100644
--- a/Documentation/devicetree/bindings/arm/sp810.txt
+++ b/Documentation/devicetree/bindings/arm/sp810.txt
@@ -4,7 +4,7 @@ SP810 System Controller
 Required properties:
 - compatible:   standard compatible string for a Primecell peripheral,
-                see Documentation/devicetree/bindings/arm/primecell.txt
+                see Documentation/devicetree/bindings/arm/primecell.yaml
                for more details
                should be: "arm,sp810", "arm,primecell"
diff --git a/Documentation/devicetree/bindings/arm/topology.txt b/Documentation/devicetree/bindings/arm/topology.txt
index de9eb0486630..b0d80c0fb265 100644
--- a/Documentation/devicetree/bindings/arm/topology.txt
+++ b/Documentation/devicetree/bindings/arm/topology.txt
@@ -472,4 +472,4 @@ cpus {
 ===============================================================================
 [1] ARM Linux kernel documentation
-    Documentation/devicetree/bindings/arm/cpus.txt
+    Documentation/devicetree/bindings/arm/cpus.yaml
diff --git a/Documentation/devicetree/bindings/clock/marvell,mmp2.txt b/Documentation/devicetree/bindings/clock/marvell,mmp2.txt
index af376a01f2b7..23b52dc02266 100644
--- a/Documentation/devicetree/bindings/clock/marvell,mmp2.txt
+++ b/Documentation/devicetree/bindings/clock/marvell,mmp2.txt
@@ -18,4 +18,4 @@ Required Properties:
 Each clock is assigned an identifier and client nodes use this identifier
 to specify the clock which they consume.
-All these identifier could be found in <dt-bindings/clock/marvell-mmp2.h>.
+All these identifiers could be found in <dt-bindings/clock/marvell,mmp2.h>.
diff --git a/Documentation/devicetree/bindings/display/arm,pl11x.txt b/Documentation/devicetree/bindings/display/arm,pl11x.txt
index ef89ab46b2c9..572fa2773ec4 100644
--- a/Documentation/devicetree/bindings/display/arm,pl11x.txt
+++ b/Documentation/devicetree/bindings/display/arm,pl11x.txt
@@ -1,6 +1,6 @@
 * ARM PrimeCell Color LCD Controller PL110/PL111
-See also Documentation/devicetree/bindings/arm/primecell.txt
+See also Documentation/devicetree/bindings/arm/primecell.yaml
 Required properties:
diff --git a/Documentation/devicetree/bindings/gpio/gpio-mvebu.txt b/Documentation/devicetree/bindings/gpio/gpio-mvebu.txt
index 38ca2201e8ae..2e097b57f170 100644
--- a/Documentation/devicetree/bindings/gpio/gpio-mvebu.txt
+++ b/Documentation/devicetree/bindings/gpio/gpio-mvebu.txt
@@ -14,8 +14,6 @@ Required properties:
    "marvell,armada-8k-gpio" should be used for the Armada 7K and 8K
    SoCs (either from AP or CP), see
-    Documentation/devicetree/bindings/arm/marvell/cp110-system-controller0.txt
-    and
    Documentation/devicetree/bindings/arm/marvell/ap806-system-controller.txt
    for specific details about the offset property.
diff --git a/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt b/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt
index b83bb8249074..a3be5298a5eb 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt
@@ -78,7 +78,7 @@ Sub-nodes:
 PPI affinity can be expressed as a single "ppi-partitions" node,
 containing a set of sub-nodes, each with the following property:
 - affinity: Should be a list of phandles to CPU nodes (as described in
-Documentation/devicetree/bindings/arm/cpus.txt).
+  Documentation/devicetree/bindings/arm/cpus.yaml).
 GICv3 has one or more Interrupt Translation Services (ITS) that are
 used to route Message Signalled Interrupts (MSI) to the CPUs.
diff --git a/Documentation/devicetree/bindings/soc/qcom/qcom,glink.txt b/Documentation/devicetree/bindings/soc/qcom/qcom,glink.txt
index 0b8cc533ca83..cf759e5f9b10 100644
--- a/Documentation/devicetree/bindings/soc/qcom/qcom,glink.txt
+++ b/Documentation/devicetree/bindings/soc/qcom/qcom,glink.txt
@@ -55,7 +55,7 @@ of these nodes are defined by the individual bindings for the specific function
 = EXAMPLE
 The following example represents the GLINK RPM node on a MSM8996 device, with
 the function for the "rpm_request" channel defined, which is used for
-regualtors and root clocks.
+regulators and root clocks.
        apcs_glb: mailbox@9820000 {
                compatible = "qcom,msm8996-apcs-hmss-global";
diff --git a/Documentation/devicetree/bindings/soc/qcom/qcom,smp2p.txt b/Documentation/devicetree/bindings/soc/qcom/qcom,smp2p.txt
index a35af2dafdad..49e1d72d3648 100644
--- a/Documentation/devicetree/bindings/soc/qcom/qcom,smp2p.txt
+++ b/Documentation/devicetree/bindings/soc/qcom/qcom,smp2p.txt
@@ -41,12 +41,12 @@ processor ID) and a string identifier.
 - qcom,local-pid:
        Usage: required
        Value type: <u32>
-        Definition: specifies the identfier of the local endpoint of this edge
+        Definition: specifies the identifier of the local endpoint of this edge
 - qcom,remote-pid:
        Usage: required
        Value type: <u32>
-        Definition: specifies the identfier of the remote endpoint of this edge
+        Definition: specifies the identifier of the remote endpoint of this edge
 = SUBNODES
 Each SMP2P pair contain a set of inbound and outbound entries, these are
diff --git a/Documentation/fb/fbcon.txt b/Documentation/fb/fbcon.txt
index 62af30511a95..60a5ec04e8f0 100644
--- a/Documentation/fb/fbcon.txt
+++ b/Documentation/fb/fbcon.txt
@@ -163,6 +163,14 @@ C. Boot options
        be preserved until there actually is some text is output to the console.
        This option causes fbcon to bind immediately to the fbdev device.
+7. fbcon=logo-pos:<location>
+        The only possible 'location' is 'center' (without quotes), and when
+        given, the bootup logo is moved from the default top-left corner
+        location to the center of the framebuffer. If more than one logo is
+        displayed due to multiple CPUs, the collected line of logos is moved
+        as a whole.
 C. Attaching, Detaching and Unloading
 Before going on to how to attach, detach and unload the framebuffer console, an
diff --git a/Makefile b/Makefile
index 499b96810995..a189ceadcd08 100644
--- a/Makefile
+++ b/Makefile
@@ -955,6 +955,7 @@ ifdef CONFIG_STACK_VALIDATION
  endif
 endif
+PHONY += prepare0
 ifeq ($(KBUILD_EXTMOD),)
 core-y          += kernel/ certs/ mm/ fs/ ipc/ security/ crypto/ block/
@@ -1061,8 +1062,7 @@ scripts: scripts_basic scripts_dtc
 # archprepare is used in arch Makefiles and when processed asm symlink,
 # version.h and scripts_basic is processed / created.
-# Listed in dependency order
+PHONY += prepare archprepare prepare1 prepare2 prepare3
-PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3
 # prepare3 is used to check if we are building in a separate output directory,
 # and if so do:
@@ -1360,11 +1360,11 @@ mrproper: rm-dirs  := $(wildcard $(MRPROPER_DIRS))
 mrproper: rm-files := $(wildcard $(MRPROPER_FILES))
 mrproper-dirs      := $(addprefix _mrproper_,scripts)
-PHONY += $(mrproper-dirs) mrproper archmrproper
+PHONY += $(mrproper-dirs) mrproper
 $(mrproper-dirs):
        $(Q)$(MAKE) $(clean)=$(patsubst _mrproper_%,%,$@)
-mrproper: clean archmrproper $(mrproper-dirs)
+mrproper: clean $(mrproper-dirs)
        $(call cmd,rmdirs)
        $(call cmd,rmfiles)
diff --git a/arch/arm64/include/asm/cache.h b/arch/arm64/include/asm/cache.h
index eb43e09c1980..926434f413fa 100644
--- a/arch/arm64/include/asm/cache.h
+++ b/arch/arm64/include/asm/cache.h
@@ -60,8 +60,6 @@
 #ifdef CONFIG_KASAN_SW_TAGS
 #define ARCH_SLAB_MINALIGN      (1ULL << KASAN_SHADOW_SCALE_SHIFT)
-#else
-#define ARCH_SLAB_MINALIGN      __alignof__(unsigned long long)
 #endif
 #ifndef __ASSEMBLY__
diff --git a/arch/arm64/include/asm/mmu.h b/arch/arm64/include/asm/mmu.h
index ac352accb3d9..3e8063f4f9d3 100644
--- a/arch/arm64/include/asm/mmu.h
+++ b/arch/arm64/include/asm/mmu.h
@@ -60,8 +60,11 @@ static inline bool arm64_kernel_use_ng_mappings(void)
         * later determine that kpti is required, then
         * kpti_install_ng_mappings() will make them non-global.
         */
+        if (arm64_kernel_unmapped_at_el0())
+                return true;
        if (!IS_ENABLED(CONFIG_RANDOMIZE_BASE))
-                return arm64_kernel_unmapped_at_el0();
+                return false;
        /*
         * KASLR is enabled so we're going to be enabling kpti on non-broken
diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
index f0e6ab8abe9c..ba6b41790fcd 100644
--- a/arch/arm64/kernel/kaslr.c
+++ b/arch/arm64/kernel/kaslr.c
@@ -14,6 +14,7 @@
 #include <linux/sched.h>
 #include <linux/types.h>
+#include <asm/cacheflush.h>
 #include <asm/fixmap.h>
 #include <asm/kernel-pgtable.h>
 #include <asm/memory.h>
@@ -43,7 +44,7 @@ static __init u64 get_kaslr_seed(void *fdt)
        return ret;
 }
-static __init const u8 *get_cmdline(void *fdt)
+static __init const u8 *kaslr_get_cmdline(void *fdt)
 {
        static __initconst const u8 default_cmdline[] = CONFIG_CMDLINE;
@@ -109,7 +110,7 @@ u64 __init kaslr_early_init(u64 dt_phys)
         * Check if 'nokaslr' appears on the command line, and
         * return 0 if that is the case.
         */
-        cmdline = get_cmdline(fdt);
+        cmdline = kaslr_get_cmdline(fdt);
        str = strstr(cmdline, "nokaslr");
        if (str == cmdline || (str > cmdline && *(str - 1) == ' '))
                return 0;
@@ -169,5 +170,8 @@ u64 __init kaslr_early_init(u64 dt_phys)
        module_alloc_base += (module_range * (seed & ((1 << 21) - 1))) >> 21;
        module_alloc_base &= PAGE_MASK;
+        __flush_dcache_area(&module_alloc_base, sizeof(module_alloc_base));
+        __flush_dcache_area(&memstart_offset_seed, sizeof(memstart_offset_seed));
        return offset;
 }
diff --git a/arch/h8300/Makefile b/arch/h8300/Makefile
index 4003ddc616e1..f801f3708a89 100644
--- a/arch/h8300/Makefile
+++ b/arch/h8300/Makefile
@@ -37,8 +37,6 @@ libs-y	+= arch/$(ARCH)/lib/
 boot := arch/h8300/boot
-archmrproper:
 archclean:
        $(Q)$(MAKE) $(clean)=$(boot)
diff --git a/arch/ia64/Makefile b/arch/ia64/Makefile
index 320d86f192ee..171290f9f1de 100644
--- a/arch/ia64/Makefile
+++ b/arch/ia64/Makefile
@@ -16,8 +16,6 @@ KBUILD_DEFCONFIG := generic_defconfig
 NM := $(CROSS_COMPILE)nm -B
 READELF := $(CROSS_COMPILE)readelf
-export AWK
 CHECKFLAGS      += -D__ia64=1 -D__ia64__=1 -D_LP64 -D__LP64__
 OBJCOPYFLAGS    := --strip-all
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 787290781b8c..0d14f51d0002 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -3155,6 +3155,7 @@ config MIPS32_O32
 config MIPS32_N32
        bool "Kernel support for n32 binaries"
        depends on 64BIT
+        select ARCH_WANT_COMPAT_IPC_PARSE_VERSION
        select COMPAT
        select MIPS32_COMPAT
        select SYSVIPC_COMPAT if SYSVIPC
diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c
index 6054d49e608e..fe3773539eff 100644
--- a/arch/mips/bcm47xx/setup.c
+++ b/arch/mips/bcm47xx/setup.c
@@ -173,6 +173,31 @@ void __init plat_mem_setup(void)
        pm_power_off = bcm47xx_machine_halt;
 }
+#ifdef CONFIG_BCM47XX_BCMA
+static struct device * __init bcm47xx_setup_device(void)
+{
+        struct device *dev;
+        int err;
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (!dev)
+                return NULL;
+        err = dev_set_name(dev, "bcm47xx_soc");
+        if (err) {
+                pr_err("Failed to set SoC device name: %d\n", err);
+                kfree(dev);
+                return NULL;
+        }
+        err = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(32));
+        if (err)
+                pr_err("Failed to set SoC DMA mask: %d\n", err);
+        return dev;
+}
+#endif
 /*
 * This finishes bus initialization doing things that were not possible without
 * kmalloc. Make sure to call it late enough (after mm_init).
@@ -183,6 +208,10 @@ void __init bcm47xx_bus_setup(void)
        if (bcm47xx_bus_type == BCM47XX_BUS_TYPE_BCMA) {
                int err;
+                bcm47xx_bus.bcma.dev = bcm47xx_setup_device();
+                if (!bcm47xx_bus.bcma.dev)
+                        panic("Failed to setup SoC device\n");
                err = bcma_host_soc_init(&bcm47xx_bus.bcma);
                if (err)
                        panic("Failed to initialize BCMA bus (err %d)", err);
@@ -235,6 +264,8 @@ static int __init bcm47xx_register_bus_complete(void)
 #endif
 #ifdef CONFIG_BCM47XX_BCMA
        case BCM47XX_BUS_TYPE_BCMA:
+                if (device_register(bcm47xx_bus.bcma.dev))
+                        pr_err("Failed to register SoC device\n");
                bcma_bus_register(&bcm47xx_bus.bcma.bus);
                break;
 #endif
diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c
index 2c79ab52977a..8bf43c5a7bc7 100644
--- a/arch/mips/cavium-octeon/setup.c
+++ b/arch/mips/cavium-octeon/setup.c
@@ -98,7 +98,7 @@ static void octeon_kexec_smp_down(void *ignored)
        "       sync                                            \n"
        "       synci   ($0)                                    \n");
-        relocated_kexec_smp_wait(NULL);
+        kexec_reboot();
 }
 #endif
diff --git a/arch/mips/configs/ath79_defconfig b/arch/mips/configs/ath79_defconfig
index 4e4ec779f182..6f981af67826 100644
--- a/arch/mips/configs/ath79_defconfig
+++ b/arch/mips/configs/ath79_defconfig
@@ -66,6 +66,7 @@ CONFIG_SERIAL_8250_CONSOLE=y
 # CONFIG_SERIAL_8250_PCI is not set
 CONFIG_SERIAL_8250_NR_UARTS=1
 CONFIG_SERIAL_8250_RUNTIME_UARTS=1
+CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_SERIAL_AR933X=y
 CONFIG_SERIAL_AR933X_CONSOLE=y
 # CONFIG_HW_RANDOM is not set
diff --git a/arch/mips/include/asm/mach-lantiq/falcon/falcon_irq.h b/arch/mips/include/asm/mach-lantiq/falcon/falcon_irq.h
index c6b63a409641..6dd8ad2409dc 100644
--- a/arch/mips/include/asm/mach-lantiq/falcon/falcon_irq.h
+++ b/arch/mips/include/asm/mach-lantiq/falcon/falcon_irq.h
@@ -18,8 +18,6 @@
 #define INT_NUM_EXTRA_START             (INT_NUM_IM4_IRL0 + 32)
 #define INT_NUM_IM_OFFSET               (INT_NUM_IM1_IRL0 - INT_NUM_IM0_IRL0)
-#define MIPS_CPU_TIMER_IRQ                      7
 #define MAX_IM                  5
 #endif /* _FALCON_IRQ__ */
diff --git a/arch/mips/include/asm/mach-lantiq/xway/lantiq_irq.h b/arch/mips/include/asm/mach-lantiq/xway/lantiq_irq.h
index 141076325307..0b424214a5e9 100644
--- a/arch/mips/include/asm/mach-lantiq/xway/lantiq_irq.h
+++ b/arch/mips/include/asm/mach-lantiq/xway/lantiq_irq.h
@@ -19,8 +19,6 @@
 #define LTQ_DMA_CH0_INT         (INT_NUM_IM2_IRL0)
-#define MIPS_CPU_TIMER_IRQ      7
 #define MAX_IM                  5
 #endif
diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c
index 6256d35dbf4d..bedb5047aff3 100644
--- a/arch/mips/jazz/jazzdma.c
+++ b/arch/mips/jazz/jazzdma.c
@@ -74,14 +74,15 @@ static int __init vdma_init(void)
                                                    get_order(VDMA_PGTBL_SIZE));
        BUG_ON(!pgtbl);
        dma_cache_wback_inv((unsigned long)pgtbl, VDMA_PGTBL_SIZE);
-        pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
+        pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR((unsigned long)pgtbl);
        /*
         * Clear the R4030 translation table
         */
        vdma_pgtbl_init();
-        r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl));
+        r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE,
+                          CPHYSADDR((unsigned long)pgtbl));
        r4030_write_reg32(JAZZ_R4030_TRSTBL_LIM, VDMA_PGTBL_SIZE);
        r4030_write_reg32(JAZZ_R4030_TRSTBL_INV, 0);
diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
index f0bc3312ed11..6549499eb202 100644
--- a/arch/mips/lantiq/irq.c
+++ b/arch/mips/lantiq/irq.c
@@ -224,9 +224,11 @@ static struct irq_chip ltq_eiu_type = {
        .irq_set_type = ltq_eiu_settype,
 };
-static void ltq_hw_irqdispatch(int module)
+static void ltq_hw_irq_handler(struct irq_desc *desc)
 {
+        int module = irq_desc_get_irq(desc) - 2;
        u32 irq;
+        int hwirq;
        irq = ltq_icu_r32(module, LTQ_ICU_IM0_IOSR);
        if (irq == 0)
@@ -237,7 +239,8 @@ static void ltq_hw_irqdispatch(int module)
         * other bits might be bogus
         */
        irq = __fls(irq);
-        do_IRQ((int)irq + MIPS_CPU_IRQ_CASCADE + (INT_NUM_IM_OFFSET * module));
+        hwirq = irq + MIPS_CPU_IRQ_CASCADE + (INT_NUM_IM_OFFSET * module);
+        generic_handle_irq(irq_linear_revmap(ltq_domain, hwirq));
        /* if this is a EBU irq, we need to ack it or get a deadlock */
        if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
@@ -245,49 +248,6 @@ static void ltq_hw_irqdispatch(int module)
                        LTQ_EBU_PCC_ISTAT);
 }
-#define DEFINE_HWx_IRQDISPATCH(x)                                       \
-        static void ltq_hw ## x ## _irqdispatch(void)                   \
-        {                                                               \
-                ltq_hw_irqdispatch(x);                                  \
-        }
-DEFINE_HWx_IRQDISPATCH(0)
-DEFINE_HWx_IRQDISPATCH(1)
-DEFINE_HWx_IRQDISPATCH(2)
-DEFINE_HWx_IRQDISPATCH(3)
-DEFINE_HWx_IRQDISPATCH(4)
-#if MIPS_CPU_TIMER_IRQ == 7
-static void ltq_hw5_irqdispatch(void)
-{
-        do_IRQ(MIPS_CPU_TIMER_IRQ);
-}
-#else
-DEFINE_HWx_IRQDISPATCH(5)
-#endif
-static void ltq_hw_irq_handler(struct irq_desc *desc)
-{
-        ltq_hw_irqdispatch(irq_desc_get_irq(desc) - 2);
-}
-asmlinkage void plat_irq_dispatch(void)
-{
-        unsigned int pending = read_c0_status() & read_c0_cause() & ST0_IM;
-        int irq;
-        if (!pending) {
-                spurious_interrupt();
-                return;
-        }
-        pending >>= CAUSEB_IP;
-        while (pending) {
-                irq = fls(pending) - 1;
-                do_IRQ(MIPS_CPU_IRQ_BASE + irq);
-                pending &= ~BIT(irq);
-        }
-}
 static int icu_map(struct irq_domain *d, unsigned int irq, irq_hw_number_t hw)
 {
        struct irq_chip *chip = &ltq_irq_type;
@@ -343,38 +303,13 @@ int __init icu_of_init(struct device_node *node, struct device_node *parent)
        for (i = 0; i < MAX_IM; i++)
                irq_set_chained_handler(i + 2, ltq_hw_irq_handler);
-        if (cpu_has_vint) {
-                pr_info("Setting up vectored interrupts\n");
-                set_vi_handler(2, ltq_hw0_irqdispatch);
-                set_vi_handler(3, ltq_hw1_irqdispatch);
-                set_vi_handler(4, ltq_hw2_irqdispatch);
-                set_vi_handler(5, ltq_hw3_irqdispatch);
-                set_vi_handler(6, ltq_hw4_irqdispatch);
-                set_vi_handler(7, ltq_hw5_irqdispatch);
-        }
        ltq_domain = irq_domain_add_linear(node,
                (MAX_IM * INT_NUM_IM_OFFSET) + MIPS_CPU_IRQ_CASCADE,
                &irq_domain_ops, 0);
-#ifndef CONFIG_MIPS_MT_SMP
-        set_c0_status(IE_IRQ0 | IE_IRQ1 | IE_IRQ2 |
-                IE_IRQ3 | IE_IRQ4 | IE_IRQ5);
-#else
-        set_c0_status(IE_SW0 | IE_SW1 | IE_IRQ0 | IE_IRQ1 |
-                IE_IRQ2 | IE_IRQ3 | IE_IRQ4 | IE_IRQ5);
-#endif
        /* tell oprofile which irq to use */
        ltq_perfcount_irq = irq_create_mapping(ltq_domain, LTQ_PERF_IRQ);
-        /*
-         * if the timer irq is not one of the mips irqs we need to
-         * create a mapping
-         */
-        if (MIPS_CPU_TIMER_IRQ != 7)
-                irq_create_mapping(ltq_domain, MIPS_CPU_TIMER_IRQ);
        /* the external interrupts are optional and xway only */
        eiu_node = of_find_compatible_node(NULL, NULL, "lantiq,eiu-xway");
        if (eiu_node && !of_address_to_resource(eiu_node, 0, &res)) {
@@ -411,7 +346,7 @@ EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
 unsigned int get_c0_compare_int(void)
 {
-        return MIPS_CPU_TIMER_IRQ;
+        return CP0_LEGACY_COMPARE_IRQ;
 }
 static struct of_device_id __initdata of_irq_ids[] = {
diff --git a/arch/mips/pci/msi-octeon.c b/arch/mips/pci/msi-octeon.c
index 2a5bb849b10e..288b58b00dc8 100644
--- a/arch/mips/pci/msi-octeon.c
+++ b/arch/mips/pci/msi-octeon.c
@@ -369,7 +369,9 @@ int __init octeon_msi_initialize(void)
        int irq;
        struct irq_chip *msi;
-        if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_PCIE) {
+        if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_INVALID) {
+                return 0;
+        } else if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_PCIE) {
                msi_rcv_reg[0] = CVMX_PEXP_NPEI_MSI_RCV0;
                msi_rcv_reg[1] = CVMX_PEXP_NPEI_MSI_RCV1;
                msi_rcv_reg[2] = CVMX_PEXP_NPEI_MSI_RCV2;
diff --git a/arch/nds32/Makefile b/arch/nds32/Makefile
index 0a935c136ec2..ac3482882cf9 100644
--- a/arch/nds32/Makefile
+++ b/arch/nds32/Makefile
@@ -3,9 +3,6 @@ OBJCOPYFLAGS	:= -O binary -R .note -R .note.gnu.build-id -R .comment -S
 KBUILD_DEFCONFIG := defconfig
-comma = ,
 ifdef CONFIG_FUNCTION_TRACER
 arch-y += -malways-save-lp -mno-relax
 endif
@@ -54,8 +51,6 @@ endif
 boot := arch/nds32/boot
 core-y += $(boot)/dts/
-.PHONY: FORCE
 Image: vmlinux
        $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
@@ -68,9 +63,6 @@ prepare: vdso_prepare
 vdso_prepare: prepare0
        $(Q)$(MAKE) $(build)=arch/nds32/kernel/vdso include/generated/vdso-offsets.h
-CLEAN_FILES += include/asm-nds32/constants.h*
-# We use MRPROPER_FILES and CLEAN_FILES now
 archclean:
        $(Q)$(MAKE) $(clean)=$(boot)
diff --git a/arch/openrisc/Makefile b/arch/openrisc/Makefile
index 70e06d34006c..bf10141c7426 100644
--- a/arch/openrisc/Makefile
+++ b/arch/openrisc/Makefile
@@ -20,7 +20,6 @@
 KBUILD_DEFCONFIG := or1ksim_defconfig
 OBJCOPYFLAGS    := -O binary -R .note -R .comment -S
-LDFLAGS_vmlinux :=
 LIBGCC          := $(shell $(CC) $(KBUILD_CFLAGS) -print-libgcc-file-name)
 KBUILD_CFLAGS   += -pipe -ffixed-r10 -D__linux__
@@ -50,5 +49,3 @@ else
 BUILTIN_DTB := n
 endif
 core-$(BUILTIN_DTB) += arch/openrisc/boot/dts/
-all: vmlinux
diff --git a/arch/powerpc/include/uapi/asm/perf_regs.h b/arch/powerpc/include/uapi/asm/perf_regs.h
index ff91192407d1..f599064dd8dc 100644
--- a/arch/powerpc/include/uapi/asm/perf_regs.h
+++ b/arch/powerpc/include/uapi/asm/perf_regs.h
@@ -47,6 +47,7 @@ enum perf_event_powerpc_regs {
        PERF_REG_POWERPC_DAR,
        PERF_REG_POWERPC_DSISR,
        PERF_REG_POWERPC_SIER,
+        PERF_REG_POWERPC_MMCRA,
        PERF_REG_POWERPC_MAX,
 };
 #endif /* _UAPI_ASM_POWERPC_PERF_REGS_H */
diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
index 57deb1e9ffea..20cc816b3508 100644
--- a/arch/powerpc/kernel/head_8xx.S
+++ b/arch/powerpc/kernel/head_8xx.S
@@ -852,11 +852,12 @@ start_here:
        /* set up the PTE pointers for the Abatron bdiGDB.
        */
-        tovirt(r6,r6)
        lis     r5, abatron_pteptrs@h
        ori     r5, r5, abatron_pteptrs@l
        stw     r5, 0xf0(0)     /* Must match your Abatron config file */
        tophys(r5,r5)
+        lis     r6, swapper_pg_dir@h
+        ori     r6, r6, swapper_pg_dir@l
        stw     r6, 0(r5)
 /* Now turn on the MMU for real! */
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index bd5e6834ca69..6794466f6420 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -755,11 +755,12 @@ SYSCALL_DEFINE0(rt_sigreturn)
                if (restore_tm_sigcontexts(current, &uc->uc_mcontext,
                                           &uc_transact->uc_mcontext))
                        goto badframe;
-        }
+        } else
 #endif
-        /* Fall through, for non-TM restore */
+        {
-        if (!MSR_TM_ACTIVE(msr)) {
                /*
+                 * Fall through, for non-TM restore
+                 *
                 * Unset MSR[TS] on the thread regs since MSR from user
                 * context does not have MSR active, and recheckpoint was
                 * not called since restore_tm_sigcontexts() was not called
diff --git a/arch/powerpc/kernel/trace/ftrace.c b/arch/powerpc/kernel/trace/ftrace.c
index 29746dc28df5..517662a56bdc 100644
--- a/arch/powerpc/kernel/trace/ftrace.c
+++ b/arch/powerpc/kernel/trace/ftrace.c
@@ -967,13 +967,6 @@ out:
 }
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
-#if defined(CONFIG_FTRACE_SYSCALLS) && defined(CONFIG_PPC64)
-unsigned long __init arch_syscall_addr(int nr)
-{
-        return sys_call_table[nr*2];
-}
-#endif /* CONFIG_FTRACE_SYSCALLS && CONFIG_PPC64 */
 #ifdef PPC64_ELF_ABI_v1
 char *arch_ftrace_match_adjust(char *str, const char *search)
 {
diff --git a/arch/powerpc/perf/perf_regs.c b/arch/powerpc/perf/perf_regs.c
index 5c36b3a8d47a..3349f3f8fe84 100644
--- a/arch/powerpc/perf/perf_regs.c
+++ b/arch/powerpc/perf/perf_regs.c
@@ -70,6 +70,7 @@ static unsigned int pt_regs_offset[PERF_REG_POWERPC_MAX] = {
        PT_REGS_OFFSET(PERF_REG_POWERPC_DAR, dar),
        PT_REGS_OFFSET(PERF_REG_POWERPC_DSISR, dsisr),
        PT_REGS_OFFSET(PERF_REG_POWERPC_SIER, dar),
+        PT_REGS_OFFSET(PERF_REG_POWERPC_MMCRA, dsisr),
 };
 u64 perf_reg_value(struct pt_regs *regs, int idx)
@@ -83,6 +84,11 @@ u64 perf_reg_value(struct pt_regs *regs, int idx)
            !is_sier_available()))
                return 0;
+        if (idx == PERF_REG_POWERPC_MMCRA &&
+           (IS_ENABLED(CONFIG_FSL_EMB_PERF_EVENT) ||
+            IS_ENABLED(CONFIG_PPC32)))
+                return 0;
        return regs_get_register(regs, pt_regs_offset[idx]);
 }
diff --git a/arch/powerpc/platforms/4xx/ocm.c b/arch/powerpc/platforms/4xx/ocm.c
index a1aaa1569d7c..f0e488d97567 100644
--- a/arch/powerpc/platforms/4xx/ocm.c
+++ b/arch/powerpc/platforms/4xx/ocm.c
@@ -237,12 +237,12 @@ static int ocm_debugfs_show(struct seq_file *m, void *v)
                        continue;
                seq_printf(m, "PPC4XX OCM   : %d\n", ocm->index);
-                seq_printf(m, "PhysAddr     : %pa[p]\n", &(ocm->phys));
+                seq_printf(m, "PhysAddr     : %pa\n", &(ocm->phys));
                seq_printf(m, "MemTotal     : %d Bytes\n", ocm->memtotal);
                seq_printf(m, "MemTotal(NC) : %d Bytes\n", ocm->nc.memtotal);
                seq_printf(m, "MemTotal(C)  : %d Bytes\n\n", ocm->c.memtotal);
-                seq_printf(m, "NC.PhysAddr  : %pa[p]\n", &(ocm->nc.phys));
+                seq_printf(m, "NC.PhysAddr  : %pa\n", &(ocm->nc.phys));
                seq_printf(m, "NC.VirtAddr  : 0x%p\n", ocm->nc.virt);
                seq_printf(m, "NC.MemTotal  : %d Bytes\n", ocm->nc.memtotal);
                seq_printf(m, "NC.MemFree   : %d Bytes\n", ocm->nc.memfree);
@@ -252,7 +252,7 @@ static int ocm_debugfs_show(struct seq_file *m, void *v)
                                                        blk->size, blk->owner);
                }
-                seq_printf(m, "\nC.PhysAddr   : %pa[p]\n", &(ocm->c.phys));
+                seq_printf(m, "\nC.PhysAddr   : %pa\n", &(ocm->c.phys));
                seq_printf(m, "C.VirtAddr   : 0x%p\n", ocm->c.virt);
                seq_printf(m, "C.MemTotal   : %d Bytes\n", ocm->c.memtotal);
                seq_printf(m, "C.MemFree    : %d Bytes\n", ocm->c.memfree);
diff --git a/arch/powerpc/platforms/chrp/setup.c b/arch/powerpc/platforms/chrp/setup.c
index e66644e0fb40..9438fa0fc355 100644
--- a/arch/powerpc/platforms/chrp/setup.c
+++ b/arch/powerpc/platforms/chrp/setup.c
@@ -538,8 +538,7 @@ static void __init chrp_init_IRQ(void)
        /* see if there is a keyboard in the device tree
           with a parent of type "adb" */
        for_each_node_by_name(kbd, "keyboard")
-                if (kbd->parent && kbd->parent->type
+                if (of_node_is_type(kbd->parent, "adb"))
-                    && strcmp(kbd->parent->type, "adb") == 0)
                        break;
        of_node_put(kbd);
        if (kbd)
diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c
index d7f742ed48ba..3f58c7dbd581 100644
--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -564,7 +564,7 @@ struct iommu_table_group *pnv_try_setup_npu_table_group(struct pnv_ioda_pe *pe)
                }
        } else {
                /* Create a group for 1 GPU and attached NPUs for POWER8 */
-                pe->npucomp = kzalloc(sizeof(pe->npucomp), GFP_KERNEL);
+                pe->npucomp = kzalloc(sizeof(*pe->npucomp), GFP_KERNEL);
                table_group = &pe->npucomp->table_group;
                table_group->ops = &pnv_npu_peers_ops;
                iommu_register_group(table_group, hose->global_number,
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 1d6406a051f1..7db3119f8a5b 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -2681,7 +2681,8 @@ static void pnv_pci_ioda_setup_iommu_api(void)
        list_for_each_entry(hose, &hose_list, list_node) {
                phb = hose->private_data;
-                if (phb->type == PNV_PHB_NPU_NVLINK)
+                if (phb->type == PNV_PHB_NPU_NVLINK ||
+                    phb->type == PNV_PHB_NPU_OCAPI)
                        continue;
                list_for_each_entry(pe, &phb->ioda.pe_list, list) {
diff --git a/arch/powerpc/platforms/pseries/pci.c b/arch/powerpc/platforms/pseries/pci.c
index 7725825d887d..37a77e57893e 100644
--- a/arch/powerpc/platforms/pseries/pci.c
+++ b/arch/powerpc/platforms/pseries/pci.c
@@ -264,7 +264,9 @@ void __init pSeries_final_fixup(void)
                        if (!of_device_is_compatible(nvdn->parent,
                                                "ibm,power9-npu"))
                                continue;
+#ifdef CONFIG_PPC_POWERNV
                        WARN_ON_ONCE(pnv_npu2_init(hose));
+#endif
                        break;
                }
        }
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 15af091611e2..4b4a7f32b68e 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -617,7 +617,7 @@ config X86_INTEL_QUARK
 config X86_INTEL_LPSS
        bool "Intel Low Power Subsystem Support"
-        depends on X86 && ACPI
+        depends on X86 && ACPI && PCI
        select COMMON_CLK
        select PINCTRL
        select IOSF_MBI
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index a77445d1b034..780f2b42c8ef 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -711,7 +711,7 @@ static __must_check inline bool user_access_begin(const void __user *ptr, size_t
 {
        if (unlikely(!access_ok(ptr,len)))
                return 0;
-        __uaccess_begin();
+        __uaccess_begin_nospec();
        return 1;
 }
 #define user_access_begin(a,b)  user_access_begin(a,b)
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index 2f6787fc7106..c54a493e139a 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -898,10 +898,7 @@ static u64 xen_read_msr_safe(unsigned int msr, int *err)
        val = native_read_msr_safe(msr, err);
        switch (msr) {
        case MSR_IA32_APICBASE:
-#ifdef CONFIG_X86_X2APIC
+                val &= ~X2APIC_ENABLE;
-                if (!(cpuid_ecx(1) & (1 << (X86_FEATURE_X2APIC & 31))))
-#endif
-                        val &= ~X2APIC_ENABLE;
                break;
        }
        return val;
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index 72bf446c3fee..6e29794573b7 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -361,8 +361,6 @@ void xen_timer_resume(void)
 {
        int cpu;
-        pvclock_resume();
        if (xen_clockevent != &xen_vcpuop_clockevent)
                return;
@@ -379,12 +377,15 @@ static const struct pv_time_ops xen_time_ops __initconst = {
 };
 static struct pvclock_vsyscall_time_info *xen_clock __read_mostly;
+static u64 xen_clock_value_saved;
 void xen_save_time_memory_area(void)
 {
        struct vcpu_register_time_memory_area t;
        int ret;
+        xen_clock_value_saved = xen_clocksource_read() - xen_sched_clock_offset;
        if (!xen_clock)
                return;
@@ -404,7 +405,7 @@ void xen_restore_time_memory_area(void)
        int ret;
        if (!xen_clock)
-                return;
+                goto out;
        t.addr.v = &xen_clock->pvti;
@@ -421,6 +422,11 @@ void xen_restore_time_memory_area(void)
        if (ret != 0)
                pr_notice("Cannot restore secondary vcpu_time_info (err %d)",
                          ret);
+out:
+        /* Need pvclock_resume() before using xen_clocksource_read(). */
+        pvclock_resume();
+        xen_sched_clock_offset = xen_clocksource_read() - xen_clock_value_saved;
 }
 static void xen_setup_vsyscall_time_info(void)
diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
index 63e0f12be7c9..72adbbe975d5 100644
--- a/block/bfq-wf2q.c
+++ b/block/bfq-wf2q.c
@@ -1154,15 +1154,14 @@ static void bfq_activate_requeue_entity(struct bfq_entity *entity,
 }
 /**
- * __bfq_deactivate_entity - deactivate an entity from its service tree.
+ * __bfq_deactivate_entity - update sched_data and service trees for
- * @entity: the entity to deactivate.
+ * entity, so as to represent entity as inactive
+ * @entity: the entity being deactivated.
 * @ins_into_idle_tree: if false, the entity will not be put into the
 *                      idle tree.
 *
- * Deactivates an entity, independently of its previous state.  Must
+ * If necessary and allowed, puts entity into the idle tree. NOTE:
- * be invoked only if entity is on a service tree. Extracts the entity
+ * entity may be on no tree if in service.
- * from that tree, and if necessary and allowed, puts it into the idle
- * tree.
 */
 bool __bfq_deactivate_entity(struct bfq_entity *entity, bool ins_into_idle_tree)
 {
diff --git a/block/blk-mq-debugfs-zoned.c b/block/blk-mq-debugfs-zoned.c
index fb2c82c351e4..038cb627c868 100644
--- a/block/blk-mq-debugfs-zoned.c
+++ b/block/blk-mq-debugfs-zoned.c
@@ -1,8 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
 * Copyright (C) 2017 Western Digital Corporation or its affiliates.
- *
- * This file is released under the GPL.
 */
 #include <linux/blkdev.h>
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 3ba37b9e15e9..8f5b533764ca 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1906,7 +1906,7 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
 {
        const int is_sync = op_is_sync(bio->bi_opf);
        const int is_flush_fua = op_is_flush(bio->bi_opf);
-        struct blk_mq_alloc_data data = { .flags = 0, .cmd_flags = bio->bi_opf };
+        struct blk_mq_alloc_data data = { .flags = 0};
        struct request *rq;
        struct blk_plug *plug;
        struct request *same_queue_rq = NULL;
@@ -1928,6 +1928,7 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
        rq_qos_throttle(q, bio);
+        data.cmd_flags = bio->bi_opf;
        rq = blk_mq_get_request(q, bio, &data);
        if (unlikely(!rq)) {
                rq_qos_cleanup(q, bio);
diff --git a/crypto/adiantum.c b/crypto/adiantum.c
index 6651e713c45d..5564e73266a6 100644
--- a/crypto/adiantum.c
+++ b/crypto/adiantum.c
@@ -539,6 +539,8 @@ static int adiantum_create(struct crypto_template *tmpl, struct rtattr **tb)
        ictx = skcipher_instance_ctx(inst);
        /* Stream cipher, e.g. "xchacha12" */
+        crypto_set_skcipher_spawn(&ictx->streamcipher_spawn,
+                                  skcipher_crypto_instance(inst));
        err = crypto_grab_skcipher(&ictx->streamcipher_spawn, streamcipher_name,
                                   0, crypto_requires_sync(algt->type,
                                                           algt->mask));
@@ -547,6 +549,8 @@ static int adiantum_create(struct crypto_template *tmpl, struct rtattr **tb)
        streamcipher_alg = crypto_spawn_skcipher_alg(&ictx->streamcipher_spawn);
        /* Block cipher, e.g. "aes" */
+        crypto_set_spawn(&ictx->blockcipher_spawn,
+                         skcipher_crypto_instance(inst));
        err = crypto_grab_spawn(&ictx->blockcipher_spawn, blockcipher_name,
                                CRYPTO_ALG_TYPE_CIPHER, CRYPTO_ALG_TYPE_MASK);
        if (err)
diff --git a/crypto/authenc.c b/crypto/authenc.c
index 37f54d1b2f66..4be293a4b5f0 100644
--- a/crypto/authenc.c
+++ b/crypto/authenc.c
@@ -58,14 +58,22 @@ int crypto_authenc_extractkeys(struct crypto_authenc_keys *keys, const u8 *key,
                return -EINVAL;
        if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
                return -EINVAL;
-        if (RTA_PAYLOAD(rta) < sizeof(*param))
+        /*
+         * RTA_OK() didn't align the rtattr's payload when validating that it
+         * fits in the buffer.  Yet, the keys should start on the next 4-byte
+         * aligned boundary.  To avoid confusion, require that the rtattr
+         * payload be exactly the param struct, which has a 4-byte aligned size.
+         */
+        if (RTA_PAYLOAD(rta) != sizeof(*param))
                return -EINVAL;
+        BUILD_BUG_ON(sizeof(*param) % RTA_ALIGNTO);
        param = RTA_DATA(rta);
        keys->enckeylen = be32_to_cpu(param->enckeylen);
-        key += RTA_ALIGN(rta->rta_len);
+        key += rta->rta_len;
-        keylen -= RTA_ALIGN(rta->rta_len);
+        keylen -= rta->rta_len;
        if (keylen < keys->enckeylen)
                return -EINVAL;
diff --git a/crypto/authencesn.c b/crypto/authencesn.c
index 80a25cc04aec..4741fe89ba2c 100644
--- a/crypto/authencesn.c
+++ b/crypto/authencesn.c
@@ -279,7 +279,7 @@ static void authenc_esn_verify_ahash_done(struct crypto_async_request *areq,
        struct aead_request *req = areq->data;
        err = err ?: crypto_authenc_esn_decrypt_tail(req, 0);
-        aead_request_complete(req, err);
+        authenc_esn_request_complete(req, err);
 }
 static int crypto_authenc_esn_decrypt(struct aead_request *req)
diff --git a/crypto/sm3_generic.c b/crypto/sm3_generic.c
index 9a5c60f08aad..c0cf87ae7ef6 100644
--- a/crypto/sm3_generic.c
+++ b/crypto/sm3_generic.c
@@ -100,7 +100,7 @@ static void sm3_compress(u32 *w, u32 *wt, u32 *m)
        for (i = 0; i <= 63; i++) {
-                ss1 = rol32((rol32(a, 12) + e + rol32(t(i), i)), 7);
+                ss1 = rol32((rol32(a, 12) + e + rol32(t(i), i & 31)), 7);
                ss2 = ss1 ^ rol32(a, 12);
diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
index 7c6afc111d76..bb857421c2e8 100644
--- a/drivers/acpi/Makefile
+++ b/drivers/acpi/Makefile
@@ -41,7 +41,8 @@ acpi-y				+= ec.o
 acpi-$(CONFIG_ACPI_DOCK)        += dock.o
 acpi-$(CONFIG_PCI)              += pci_root.o pci_link.o pci_irq.o
 obj-$(CONFIG_ACPI_MCFG)         += pci_mcfg.o
-acpi-y                          += acpi_lpss.o acpi_apd.o
+acpi-$(CONFIG_PCI)              += acpi_lpss.o
+acpi-y                          += acpi_apd.o
 acpi-y                          += acpi_platform.o
 acpi-y                          += acpi_pnp.o
 acpi-$(CONFIG_ARM_AMBA) += acpi_amba.o
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 99d820a693a8..5c093ce01bcd 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -1054,18 +1054,6 @@ void __init acpi_early_init(void)
                goto error0;
        }
-        /*
-         * ACPI 2.0 requires the EC driver to be loaded and work before
-         * the EC device is found in the namespace (i.e. before
-         * acpi_load_tables() is called).
-         *
-         * This is accomplished by looking for the ECDT table, and getting
-         * the EC parameters out of that.
-         *
-         * Ignore the result. Not having an ECDT is not fatal.
-         */
-        status = acpi_ec_ecdt_probe();
 #ifdef CONFIG_X86
        if (!acpi_ioapic) {
                /* compatible (0) means level (3) */
@@ -1142,6 +1130,18 @@ static int __init acpi_bus_init(void)
                goto error1;
        }
+        /*
+         * ACPI 2.0 requires the EC driver to be loaded and work before the EC
+         * device is found in the namespace.
+         *
+         * This is accomplished by looking for the ECDT table and getting the EC
+         * parameters out of that.
+         *
+         * Do that before calling acpi_initialize_objects() which may trigger EC
+         * address space accesses.
+         */
+        acpi_ec_ecdt_probe();
        status = acpi_enable_subsystem(ACPI_NO_ACPI_ENABLE);
        if (ACPI_FAILURE(status)) {
                printk(KERN_ERR PREFIX
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 7e6952edb5b0..6a9e1fb8913a 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -81,7 +81,11 @@ void acpi_debugfs_init(void);
 #else
 static inline void acpi_debugfs_init(void) { return; }
 #endif
+#ifdef CONFIG_PCI
 void acpi_lpss_init(void);
+#else
+static inline void acpi_lpss_init(void) {}
+#endif
 void acpi_apd_init(void);
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 011d3db19c80..5143e11e3b0f 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -26,7 +26,6 @@
 #include <acpi/nfit.h>
 #include "intel.h"
 #include "nfit.h"
-#include "intel.h"
 /*
 * For readq() and writeq() on 32-bit builds, the hi-lo, lo-hi order is
@@ -78,12 +77,6 @@ const guid_t *to_nfit_uuid(enum nfit_uuids id)
 }
 EXPORT_SYMBOL(to_nfit_uuid);
-static struct acpi_nfit_desc *to_acpi_nfit_desc(
-                struct nvdimm_bus_descriptor *nd_desc)
-{
-        return container_of(nd_desc, struct acpi_nfit_desc, nd_desc);
-}
 static struct acpi_device *to_acpi_dev(struct acpi_nfit_desc *acpi_desc)
 {
        struct nvdimm_bus_descriptor *nd_desc = &acpi_desc->nd_desc;
@@ -419,7 +412,7 @@ static bool payload_dumpable(struct nvdimm *nvdimm, unsigned int func)
 int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
                unsigned int cmd, void *buf, unsigned int buf_len, int *cmd_rc)
 {
-        struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
+        struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
        struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
        union acpi_object in_obj, in_buf, *out_obj;
        const struct nd_cmd_desc *desc = NULL;
@@ -721,6 +714,7 @@ int nfit_get_smbios_id(u32 device_handle, u16 *flags)
        struct acpi_nfit_memory_map *memdev;
        struct acpi_nfit_desc *acpi_desc;
        struct nfit_mem *nfit_mem;
+        u16 physical_id;
        mutex_lock(&acpi_desc_lock);
        list_for_each_entry(acpi_desc, &acpi_descs, list) {
@@ -728,10 +722,11 @@ int nfit_get_smbios_id(u32 device_handle, u16 *flags)
                list_for_each_entry(nfit_mem, &acpi_desc->dimms, list) {
                        memdev = __to_nfit_memdev(nfit_mem);
                        if (memdev->device_handle == device_handle) {
+                                *flags = memdev->flags;
+                                physical_id = memdev->physical_id;
                                mutex_unlock(&acpi_desc->init_mutex);
                                mutex_unlock(&acpi_desc_lock);
-                                *flags = memdev->flags;
+                                return physical_id;
-                                return memdev->physical_id;
                        }
                }
                mutex_unlock(&acpi_desc->init_mutex);
@@ -2231,7 +2226,6 @@ static int acpi_nfit_init_interleave_set(struct acpi_nfit_desc *acpi_desc,
        nd_set = devm_kzalloc(dev, sizeof(*nd_set), GFP_KERNEL);
        if (!nd_set)
                return -ENOMEM;
-        ndr_desc->nd_set = nd_set;
        guid_copy(&nd_set->type_guid, (guid_t *) spa->range_guid);
        info = devm_kzalloc(dev, sizeof_nfit_set_info(nr), GFP_KERNEL);
@@ -3367,7 +3361,7 @@ EXPORT_SYMBOL_GPL(acpi_nfit_init);
 static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
 {
-        struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
+        struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
        struct device *dev = acpi_desc->dev;
        /* Bounce the device lock to flush acpi_nfit_add / acpi_nfit_notify */
@@ -3384,7 +3378,7 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
 static int __acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc,
                struct nvdimm *nvdimm, unsigned int cmd)
 {
-        struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
+        struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
        if (nvdimm)
                return 0;
diff --git a/drivers/acpi/nfit/intel.c b/drivers/acpi/nfit/intel.c
index 850b2927b4e7..f70de71f79d6 100644
--- a/drivers/acpi/nfit/intel.c
+++ b/drivers/acpi/nfit/intel.c
@@ -146,7 +146,7 @@ static int intel_security_change_key(struct nvdimm *nvdimm,
 static void nvdimm_invalidate_cache(void);
-static int intel_security_unlock(struct nvdimm *nvdimm,
+static int __maybe_unused intel_security_unlock(struct nvdimm *nvdimm,
                const struct nvdimm_key_data *key_data)
 {
        struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
@@ -227,7 +227,7 @@ static int intel_security_disable(struct nvdimm *nvdimm,
        return 0;
 }
-static int intel_security_erase(struct nvdimm *nvdimm,
+static int __maybe_unused intel_security_erase(struct nvdimm *nvdimm,
                const struct nvdimm_key_data *key,
                enum nvdimm_passphrase_type ptype)
 {
@@ -276,7 +276,7 @@ static int intel_security_erase(struct nvdimm *nvdimm,
        return 0;
 }
-static int intel_security_query_overwrite(struct nvdimm *nvdimm)
+static int __maybe_unused intel_security_query_overwrite(struct nvdimm *nvdimm)
 {
        int rc;
        struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
@@ -313,7 +313,7 @@ static int intel_security_query_overwrite(struct nvdimm *nvdimm)
        return 0;
 }
-static int intel_security_overwrite(struct nvdimm *nvdimm,
+static int __maybe_unused intel_security_overwrite(struct nvdimm *nvdimm,
                const struct nvdimm_key_data *nkey)
 {
        int rc;
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 4ca7a6b4eaae..8218db17ebdb 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -1091,7 +1091,7 @@ comment "Generic fallback / legacy drivers"
 config PATA_ACPI
        tristate "ACPI firmware driver for PATA"
-        depends on ATA_ACPI && ATA_BMDMA
+        depends on ATA_ACPI && ATA_BMDMA && PCI
        help
          This option enables an ACPI method driver which drives
          motherboard PATA controller interfaces through the ACPI
diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index 1bd1145ad8b5..330c1f7e9665 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -108,6 +108,9 @@ static void regmap_irq_sync_unlock(struct irq_data *data)
         * suppress pointless writes.
         */
        for (i = 0; i < d->chip->num_regs; i++) {
+                if (!d->chip->mask_base)
+                        continue;
                reg = d->chip->mask_base +
                        (i * map->reg_stride * d->irq_reg_stride);
                if (d->chip->mask_invert) {
@@ -258,7 +261,7 @@ static int regmap_irq_set_type(struct irq_data *data, unsigned int type)
        const struct regmap_irq_type *t = &irq_data->type;
        if ((t->types_supported & type) != type)
-                return -ENOTSUPP;
+                return 0;
        reg = t->type_reg_offset / map->reg_stride;
@@ -588,6 +591,9 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
        /* Mask all the interrupts by default */
        for (i = 0; i < chip->num_regs; i++) {
                d->mask_buf[i] = d->mask_buf_def[i];
+                if (!chip->mask_base)
+                        continue;
                reg = chip->mask_base +
                        (i * map->reg_stride * d->irq_reg_stride);
                if (chip->mask_invert)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 08696f5f00bb..7c9a949e876b 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -288,9 +288,10 @@ static void nbd_size_update(struct nbd_device *nbd)
        blk_queue_physical_block_size(nbd->disk->queue, config->blksize);
        set_capacity(nbd->disk, config->bytesize >> 9);
        if (bdev) {
-                if (bdev->bd_disk)
+                if (bdev->bd_disk) {
                        bd_set_size(bdev, config->bytesize);
-                else
+                        set_blocksize(bdev, config->blksize);
+                } else
                        bdev->bd_invalidated = 1;
                bdput(bdev);
        }
diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
index 5a90075f719d..0be55fcc19ba 100644
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -692,6 +692,7 @@ config CRYPTO_DEV_BCM_SPU
        depends on ARCH_BCM_IPROC
        depends on MAILBOX
        default m
+        select CRYPTO_AUTHENC
        select CRYPTO_DES
        select CRYPTO_MD5
        select CRYPTO_SHA1
diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
index c9393ffb70ed..5567cbda2798 100644
--- a/drivers/crypto/bcm/cipher.c
+++ b/drivers/crypto/bcm/cipher.c
@@ -2845,44 +2845,28 @@ static int aead_authenc_setkey(struct crypto_aead *cipher,
        struct spu_hw *spu = &iproc_priv.spu;
        struct iproc_ctx_s *ctx = crypto_aead_ctx(cipher);
        struct crypto_tfm *tfm = crypto_aead_tfm(cipher);
-        struct rtattr *rta = (void *)key;
+        struct crypto_authenc_keys keys;
-        struct crypto_authenc_key_param *param;
+        int ret;
-        const u8 *origkey = key;
-        const unsigned int origkeylen = keylen;
-        int ret = 0;
        flow_log("%s() aead:%p key:%p keylen:%u\n", __func__, cipher, key,
                 keylen);
        flow_dump("  key: ", key, keylen);
-        if (!RTA_OK(rta, keylen))
+        ret = crypto_authenc_extractkeys(&keys, key, keylen);
-                goto badkey;
+        if (ret)
-        if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
-                goto badkey;
-        if (RTA_PAYLOAD(rta) < sizeof(*param))
                goto badkey;
-        param = RTA_DATA(rta);
+        if (keys.enckeylen > MAX_KEY_SIZE ||
-        ctx->enckeylen = be32_to_cpu(param->enckeylen);
+            keys.authkeylen > MAX_KEY_SIZE)
-        key += RTA_ALIGN(rta->rta_len);
-        keylen -= RTA_ALIGN(rta->rta_len);
-        if (keylen < ctx->enckeylen)
-                goto badkey;
-        if (ctx->enckeylen > MAX_KEY_SIZE)
                goto badkey;
-        ctx->authkeylen = keylen - ctx->enckeylen;
+        ctx->enckeylen = keys.enckeylen;
+        ctx->authkeylen = keys.authkeylen;
-        if (ctx->authkeylen > MAX_KEY_SIZE)
-                goto badkey;
-        memcpy(ctx->enckey, key + ctx->authkeylen, ctx->enckeylen);
+        memcpy(ctx->enckey, keys.enckey, keys.enckeylen);
        /* May end up padding auth key. So make sure it's zeroed. */
        memset(ctx->authkey, 0, sizeof(ctx->authkey));
-        memcpy(ctx->authkey, key, ctx->authkeylen);
+        memcpy(ctx->authkey, keys.authkey, keys.authkeylen);
        switch (ctx->alg->cipher_info.alg) {
        case CIPHER_ALG_DES:
@@ -2890,7 +2874,7 @@ static int aead_authenc_setkey(struct crypto_aead *cipher,
                        u32 tmp[DES_EXPKEY_WORDS];
                        u32 flags = CRYPTO_TFM_RES_WEAK_KEY;
-                        if (des_ekey(tmp, key) == 0) {
+                        if (des_ekey(tmp, keys.enckey) == 0) {
                                if (crypto_aead_get_flags(cipher) &
                                    CRYPTO_TFM_REQ_WEAK_KEY) {
                                        crypto_aead_set_flags(cipher, flags);
@@ -2905,7 +2889,7 @@ static int aead_authenc_setkey(struct crypto_aead *cipher,
                break;
        case CIPHER_ALG_3DES:
                if (ctx->enckeylen == (DES_KEY_SIZE * 3)) {
-                        const u32 *K = (const u32 *)key;
+                        const u32 *K = (const u32 *)keys.enckey;
                        u32 flags = CRYPTO_TFM_RES_BAD_KEY_SCHED;
                        if (!((K[0] ^ K[2]) | (K[1] ^ K[3])) ||
@@ -2956,9 +2940,7 @@ static int aead_authenc_setkey(struct crypto_aead *cipher,
                ctx->fallback_cipher->base.crt_flags &= ~CRYPTO_TFM_REQ_MASK;
                ctx->fallback_cipher->base.crt_flags |=
                    tfm->crt_flags & CRYPTO_TFM_REQ_MASK;
-                ret =
+                ret = crypto_aead_setkey(ctx->fallback_cipher, key, keylen);
-                    crypto_aead_setkey(ctx->fallback_cipher, origkey,
-                                       origkeylen);
                if (ret) {
                        flow_log("  fallback setkey() returned:%d\n", ret);
                        tfm->crt_flags &= ~CRYPTO_TFM_RES_MASK;
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index 92e593e2069a..80ae69f906fb 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -3476,7 +3476,7 @@ static int __init caam_algapi_init(void)
                 * Skip algorithms requiring message digests
                 * if MD or MD size is not supported by device.
                 */
-                if ((c2_alg_sel & ~OP_ALG_ALGSEL_SUBMASK) == 0x40 &&
+                if (is_mdha(c2_alg_sel) &&
                    (!md_inst || t_alg->aead.maxauthsize > md_limit))
                        continue;
diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
index 81712aa5d0f2..bb1a2cdf1951 100644
--- a/drivers/crypto/caam/caamhash.c
+++ b/drivers/crypto/caam/caamhash.c
@@ -1072,13 +1072,16 @@ static int ahash_final_no_ctx(struct ahash_request *req)
        desc = edesc->hw_desc;
-        state->buf_dma = dma_map_single(jrdev, buf, buflen, DMA_TO_DEVICE);
+        if (buflen) {
-        if (dma_mapping_error(jrdev, state->buf_dma)) {
+                state->buf_dma = dma_map_single(jrdev, buf, buflen,
-                dev_err(jrdev, "unable to map src\n");
+                                                DMA_TO_DEVICE);
-                goto unmap;
+                if (dma_mapping_error(jrdev, state->buf_dma)) {
-        }
+                        dev_err(jrdev, "unable to map src\n");
+                        goto unmap;
+                }
-        append_seq_in_ptr(desc, state->buf_dma, buflen, 0);
+                append_seq_in_ptr(desc, state->buf_dma, buflen, 0);
+        }
        edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result,
                                                digestsize);
diff --git a/drivers/crypto/caam/desc.h b/drivers/crypto/caam/desc.h
index ec10230178c5..4b6854bf896a 100644
--- a/drivers/crypto/caam/desc.h
+++ b/drivers/crypto/caam/desc.h
@@ -1155,6 +1155,7 @@
 #define OP_ALG_ALGSEL_DES       (0x20 << OP_ALG_ALGSEL_SHIFT)
 #define OP_ALG_ALGSEL_3DES      (0x21 << OP_ALG_ALGSEL_SHIFT)
 #define OP_ALG_ALGSEL_ARC4      (0x30 << OP_ALG_ALGSEL_SHIFT)
+#define OP_ALG_CHA_MDHA         (0x40 << OP_ALG_ALGSEL_SHIFT)
 #define OP_ALG_ALGSEL_MD5       (0x40 << OP_ALG_ALGSEL_SHIFT)
 #define OP_ALG_ALGSEL_SHA1      (0x41 << OP_ALG_ALGSEL_SHIFT)
 #define OP_ALG_ALGSEL_SHA224    (0x42 << OP_ALG_ALGSEL_SHIFT)
diff --git a/drivers/crypto/caam/error.h b/drivers/crypto/caam/error.h
index 67ea94079837..8c6b83e02a70 100644
--- a/drivers/crypto/caam/error.h
+++ b/drivers/crypto/caam/error.h
@@ -7,6 +7,9 @@
 #ifndef CAAM_ERROR_H
 #define CAAM_ERROR_H
+#include "desc.h"
 #define CAAM_ERROR_STR_MAX 302
 void caam_strstatus(struct device *dev, u32 status, bool qi_v2);
@@ -17,4 +20,10 @@ void caam_strstatus(struct device *dev, u32 status, bool qi_v2);
 void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
                  int rowsize, int groupsize, struct scatterlist *sg,
                  size_t tlen, bool ascii);
+static inline bool is_mdha(u32 algtype)
+{
+        return (algtype & OP_ALG_ALGSEL_MASK & ~OP_ALG_ALGSEL_SUBMASK) ==
+               OP_ALG_CHA_MDHA;
+}
 #endif /* CAAM_ERROR_H */
diff --git a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
index e34e4df8fd24..fe070d75c842 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
@@ -567,10 +567,10 @@ static void process_response_list(struct nitrox_cmdq *cmdq)
                /* ORH error code */
                err = READ_ONCE(*sr->resp.orh) & 0xff;
-                softreq_destroy(sr);
                if (sr->callback)
                        sr->callback(sr->cb_arg, err);
+                softreq_destroy(sr);
                req_completed++;
        }
diff --git a/drivers/crypto/ccree/cc_aead.c b/drivers/crypto/ccree/cc_aead.c
index f2643cda45db..a3527c00b29a 100644
--- a/drivers/crypto/ccree/cc_aead.c
+++ b/drivers/crypto/ccree/cc_aead.c
@@ -549,13 +549,12 @@ static int cc_aead_setkey(struct crypto_aead *tfm, const u8 *key,
                          unsigned int keylen)
 {
        struct cc_aead_ctx *ctx = crypto_aead_ctx(tfm);
-        struct rtattr *rta = (struct rtattr *)key;
        struct cc_crypto_req cc_req = {};
-        struct crypto_authenc_key_param *param;
        struct cc_hw_desc desc[MAX_AEAD_SETKEY_SEQ];
-        int rc = -EINVAL;
        unsigned int seq_len = 0;
        struct device *dev = drvdata_to_dev(ctx->drvdata);
+        const u8 *enckey, *authkey;
+        int rc;
        dev_dbg(dev, "Setting key in context @%p for %s. key=%p keylen=%u\n",
                ctx, crypto_tfm_alg_name(crypto_aead_tfm(tfm)), key, keylen);
@@ -563,35 +562,33 @@ static int cc_aead_setkey(struct crypto_aead *tfm, const u8 *key,
        /* STAT_PHASE_0: Init and sanity checks */
        if (ctx->auth_mode != DRV_HASH_NULL) { /* authenc() alg. */
-                if (!RTA_OK(rta, keylen))
+                struct crypto_authenc_keys keys;
-                        goto badkey;
-                if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
+                rc = crypto_authenc_extractkeys(&keys, key, keylen);
-                        goto badkey;
+                if (rc)
-                if (RTA_PAYLOAD(rta) < sizeof(*param))
-                        goto badkey;
-                param = RTA_DATA(rta);
-                ctx->enc_keylen = be32_to_cpu(param->enckeylen);
-                key += RTA_ALIGN(rta->rta_len);
-                keylen -= RTA_ALIGN(rta->rta_len);
-                if (keylen < ctx->enc_keylen)
                        goto badkey;
-                ctx->auth_keylen = keylen - ctx->enc_keylen;
+                enckey = keys.enckey;
+                authkey = keys.authkey;
+                ctx->enc_keylen = keys.enckeylen;
+                ctx->auth_keylen = keys.authkeylen;
                if (ctx->cipher_mode == DRV_CIPHER_CTR) {
                        /* the nonce is stored in bytes at end of key */
+                        rc = -EINVAL;
                        if (ctx->enc_keylen <
                            (AES_MIN_KEY_SIZE + CTR_RFC3686_NONCE_SIZE))
                                goto badkey;
                        /* Copy nonce from last 4 bytes in CTR key to
                         *  first 4 bytes in CTR IV
                         */
-                        memcpy(ctx->ctr_nonce, key + ctx->auth_keylen +
+                        memcpy(ctx->ctr_nonce, enckey + ctx->enc_keylen -
-                               ctx->enc_keylen - CTR_RFC3686_NONCE_SIZE,
+                               CTR_RFC3686_NONCE_SIZE, CTR_RFC3686_NONCE_SIZE);
-                               CTR_RFC3686_NONCE_SIZE);
                        /* Set CTR key size */
                        ctx->enc_keylen -= CTR_RFC3686_NONCE_SIZE;
                }
        } else { /* non-authenc - has just one key */
+                enckey = key;
+                authkey = NULL;
                ctx->enc_keylen = keylen;
                ctx->auth_keylen = 0;
        }
@@ -603,13 +600,14 @@ static int cc_aead_setkey(struct crypto_aead *tfm, const u8 *key,
        /* STAT_PHASE_1: Copy key to ctx */
        /* Get key material */
-        memcpy(ctx->enckey, key + ctx->auth_keylen, ctx->enc_keylen);
+        memcpy(ctx->enckey, enckey, ctx->enc_keylen);
        if (ctx->enc_keylen == 24)
                memset(ctx->enckey + 24, 0, CC_AES_KEY_SIZE_MAX - 24);
        if (ctx->auth_mode == DRV_HASH_XCBC_MAC) {
-                memcpy(ctx->auth_state.xcbc.xcbc_keys, key, ctx->auth_keylen);
+                memcpy(ctx->auth_state.xcbc.xcbc_keys, authkey,
+                       ctx->auth_keylen);
        } else if (ctx->auth_mode != DRV_HASH_NULL) { /* HMAC */
-                rc = cc_get_plain_hmac_key(tfm, key, ctx->auth_keylen);
+                rc = cc_get_plain_hmac_key(tfm, authkey, ctx->auth_keylen);
                if (rc)
                        goto badkey;
        }
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 45e20707cef8..f8e2c5c3f4eb 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1361,23 +1361,18 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
        struct talitos_private *priv = dev_get_drvdata(dev);
        bool is_sec1 = has_ftr_sec1(priv);
        int max_len = is_sec1 ? TALITOS1_MAX_DATA_LEN : TALITOS2_MAX_DATA_LEN;
-        void *err;
        if (cryptlen + authsize > max_len) {
                dev_err(dev, "length exceeds h/w max limit\n");
                return ERR_PTR(-EINVAL);
        }
-        if (ivsize)
-                iv_dma = dma_map_single(dev, iv, ivsize, DMA_TO_DEVICE);
        if (!dst || dst == src) {
                src_len = assoclen + cryptlen + authsize;
                src_nents = sg_nents_for_len(src, src_len);
                if (src_nents < 0) {
                        dev_err(dev, "Invalid number of src SG.\n");
-                        err = ERR_PTR(-EINVAL);
+                        return ERR_PTR(-EINVAL);
-                        goto error_sg;
                }
                src_nents = (src_nents == 1) ? 0 : src_nents;
                dst_nents = dst ? src_nents : 0;
@@ -1387,16 +1382,14 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                src_nents = sg_nents_for_len(src, src_len);
                if (src_nents < 0) {
                        dev_err(dev, "Invalid number of src SG.\n");
-                        err = ERR_PTR(-EINVAL);
+                        return ERR_PTR(-EINVAL);
-                        goto error_sg;
                }
                src_nents = (src_nents == 1) ? 0 : src_nents;
                dst_len = assoclen + cryptlen + (encrypt ? authsize : 0);
                dst_nents = sg_nents_for_len(dst, dst_len);
                if (dst_nents < 0) {
                        dev_err(dev, "Invalid number of dst SG.\n");
-                        err = ERR_PTR(-EINVAL);
+                        return ERR_PTR(-EINVAL);
-                        goto error_sg;
                }
                dst_nents = (dst_nents == 1) ? 0 : dst_nents;
        }
@@ -1423,11 +1416,14 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
        /* if its a ahash, add space for a second desc next to the first one */
        if (is_sec1 && !dst)
                alloc_len += sizeof(struct talitos_desc);
+        alloc_len += ivsize;
        edesc = kmalloc(alloc_len, GFP_DMA | flags);
-        if (!edesc) {
+        if (!edesc)
-                err = ERR_PTR(-ENOMEM);
+                return ERR_PTR(-ENOMEM);
-                goto error_sg;
+        if (ivsize) {
+                iv = memcpy(((u8 *)edesc) + alloc_len - ivsize, iv, ivsize);
+                iv_dma = dma_map_single(dev, iv, ivsize, DMA_TO_DEVICE);
        }
        memset(&edesc->desc, 0, sizeof(edesc->desc));
@@ -1445,10 +1441,6 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                                                     DMA_BIDIRECTIONAL);
        }
        return edesc;
-error_sg:
-        if (iv_dma)
-                dma_unmap_single(dev, iv_dma, ivsize, DMA_TO_DEVICE);
-        return err;
 }
 static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index dafc645b2e4e..b083b219b1a9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -531,17 +531,6 @@ amdgpu_display_user_framebuffer_create(struct drm_device *dev,
        struct drm_gem_object *obj;
        struct amdgpu_framebuffer *amdgpu_fb;
        int ret;
-        int height;
-        struct amdgpu_device *adev = dev->dev_private;
-        int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
-        int pitch = mode_cmd->pitches[0] / cpp;
-        pitch = amdgpu_align_pitch(adev, pitch, cpp, false);
-        if (mode_cmd->pitches[0] != pitch) {
-                DRM_DEBUG_KMS("Invalid pitch: expecting %d but got %d\n",
-                              pitch, mode_cmd->pitches[0]);
-                return ERR_PTR(-EINVAL);
-        }
        obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[0]);
        if (obj ==  NULL) {
@@ -556,13 +545,6 @@ amdgpu_display_user_framebuffer_create(struct drm_device *dev,
                return ERR_PTR(-EINVAL);
        }
-        height = ALIGN(mode_cmd->height, 8);
-        if (obj->size < pitch * height) {
-                DRM_DEBUG_KMS("Invalid GEM size: expecting >= %d but got %zu\n",
-                              pitch * height, obj->size);
-                return ERR_PTR(-EINVAL);
-        }
        amdgpu_fb = kzalloc(sizeof(*amdgpu_fb), GFP_KERNEL);
        if (amdgpu_fb == NULL) {
                drm_gem_object_put_unlocked(obj);
diff --git a/drivers/gpu/drm/amd/amdkfd/Kconfig b/drivers/gpu/drm/amd/amdkfd/Kconfig
index fbf0ee5201c3..c3613604a4f8 100644
--- a/drivers/gpu/drm/amd/amdkfd/Kconfig
+++ b/drivers/gpu/drm/amd/amdkfd/Kconfig
@@ -4,8 +4,8 @@
 config HSA_AMD
        bool "HSA kernel driver for AMD GPU devices"
-        depends on DRM_AMDGPU && X86_64
+        depends on DRM_AMDGPU && (X86_64 || ARM64)
-        imply AMD_IOMMU_V2
+        imply AMD_IOMMU_V2 if X86_64
        select MMU_NOTIFIER
        help
          Enable this if you want to use HSA features on AMD GPU devices.
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
index b7bc7d7d048f..5d85ff341385 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
@@ -863,6 +863,7 @@ static int kfd_fill_mem_info_for_cpu(int numa_node_id, int *avail_size,
        return 0;
 }
+#if CONFIG_X86_64
 static int kfd_fill_iolink_info_for_cpu(int numa_node_id, int *avail_size,
                                uint32_t *num_entries,
                                struct crat_subtype_iolink *sub_type_hdr)
@@ -905,6 +906,7 @@ static int kfd_fill_iolink_info_for_cpu(int numa_node_id, int *avail_size,
        return 0;
 }
+#endif
 /* kfd_create_vcrat_image_cpu - Create Virtual CRAT for CPU
 *
@@ -920,7 +922,9 @@ static int kfd_create_vcrat_image_cpu(void *pcrat_image, size_t *size)
        struct crat_subtype_generic *sub_type_hdr;
        int avail_size = *size;
        int numa_node_id;
+#ifdef CONFIG_X86_64
        uint32_t entries = 0;
+#endif
        int ret = 0;
        if (!pcrat_image || avail_size < VCRAT_SIZE_FOR_CPU)
@@ -982,6 +986,7 @@ static int kfd_create_vcrat_image_cpu(void *pcrat_image, size_t *size)
                        sub_type_hdr->length);
                /* Fill in Subtype: IO Link */
+#ifdef CONFIG_X86_64
                ret = kfd_fill_iolink_info_for_cpu(numa_node_id, &avail_size,
                                &entries,
                                (struct crat_subtype_iolink *)sub_type_hdr);
@@ -992,6 +997,9 @@ static int kfd_create_vcrat_image_cpu(void *pcrat_image, size_t *size)
                sub_type_hdr = (typeof(sub_type_hdr))((char *)sub_type_hdr +
                                sub_type_hdr->length * entries);
+#else
+                pr_info("IO link not available for non x86 platforms\n");
+#endif
                crat_table->num_domains++;
        }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index 5f5b2acedbac..09da91644f9f 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -1093,8 +1093,6 @@ static uint32_t kfd_generate_gpu_id(struct kfd_dev *gpu)
 *              the GPU device is not already present in the topology device
 *              list then return NULL. This means a new topology device has to
 *              be created for this GPU.
- * TODO: Rather than assiging @gpu to first topology device withtout
- *              gpu attached, it will better to have more stringent check.
 */
 static struct kfd_topology_device *kfd_assign_gpu(struct kfd_dev *gpu)
 {
@@ -1102,12 +1100,20 @@ static struct kfd_topology_device *kfd_assign_gpu(struct kfd_dev *gpu)
        struct kfd_topology_device *out_dev = NULL;
        down_write(&topology_lock);
-        list_for_each_entry(dev, &topology_device_list, list)
+        list_for_each_entry(dev, &topology_device_list, list) {
+                /* Discrete GPUs need their own topology device list
+                 * entries. Don't assign them to CPU/APU nodes.
+                 */
+                if (!gpu->device_info->needs_iommu_device &&
+                    dev->node_props.cpu_cores_count)
+                        continue;
                if (!dev->gpu && (dev->node_props.simd_count > 0)) {
                        dev->gpu = gpu;
                        out_dev = dev;
                        break;
                }
+        }
        up_write(&topology_lock);
        return out_dev;
 }
@@ -1392,7 +1398,6 @@ int kfd_topology_enum_kfd_devices(uint8_t idx, struct kfd_dev **kdev)
 static int kfd_cpumask_to_apic_id(const struct cpumask *cpumask)
 {
-        const struct cpuinfo_x86 *cpuinfo;
        int first_cpu_of_numa_node;
        if (!cpumask || cpumask == cpu_none_mask)
@@ -1400,9 +1405,11 @@ static int kfd_cpumask_to_apic_id(const struct cpumask *cpumask)
        first_cpu_of_numa_node = cpumask_first(cpumask);
        if (first_cpu_of_numa_node >= nr_cpu_ids)
                return -1;
-        cpuinfo = &cpu_data(first_cpu_of_numa_node);
+#ifdef CONFIG_X86_64
+        return cpu_data(first_cpu_of_numa_node).apicid;
-        return cpuinfo->apicid;
+#else
+        return first_cpu_of_numa_node;
+#endif
 }
 /* kfd_numa_node_to_apic_id - Returns the APIC ID of the first logical processor
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 34f35e9a3c46..f4fa40c387d3 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1772,7 +1772,7 @@ static int amdgpu_dm_backlight_update_status(struct backlight_device *bd)
                + caps.min_input_signal * 0x101;
        if (dc_link_set_backlight_level(dm->backlight_link,
-                        brightness, 0, 0))
+                        brightness, 0))
                return 0;
        else
                return 1;
@@ -5933,7 +5933,7 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
        for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
                if (!drm_atomic_crtc_needs_modeset(new_crtc_state) &&
                    !new_crtc_state->color_mgmt_changed &&
-                    !new_crtc_state->vrr_enabled)
+                    old_crtc_state->vrr_enabled == new_crtc_state->vrr_enabled)
                        continue;
                if (!new_crtc_state->enable)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 52deacf39841..b0265dbebd4c 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -2190,8 +2190,7 @@ int dc_link_get_backlight_level(const struct dc_link *link)
 bool dc_link_set_backlight_level(const struct dc_link *link,
                uint32_t backlight_pwm_u16_16,
-                uint32_t frame_ramp,
+                uint32_t frame_ramp)
-                const struct dc_stream_state *stream)
 {
        struct dc  *core_dc = link->ctx->dc;
        struct abm *abm = core_dc->res_pool->abm;
@@ -2206,10 +2205,6 @@ bool dc_link_set_backlight_level(const struct dc_link *link,
                (abm->funcs->set_backlight_level_pwm == NULL))
                return false;
-        if (stream)
-                ((struct dc_stream_state *)stream)->bl_pwm_level =
-                                backlight_pwm_u16_16;
        use_smooth_brightness = dmcu->funcs->is_dmcu_initialized(dmcu);
        DC_LOG_BACKLIGHT("New Backlight level: %d (0x%X)\n",
@@ -2637,11 +2632,6 @@ void core_link_enable_stream(
                if (dc_is_dp_signal(pipe_ctx->stream->signal))
                        enable_stream_features(pipe_ctx);
-                dc_link_set_backlight_level(pipe_ctx->stream->sink->link,
-                                pipe_ctx->stream->bl_pwm_level,
-                                0,
-                                pipe_ctx->stream);
        }
 }
diff --git a/drivers/gpu/drm/amd/display/dc/dc_link.h b/drivers/gpu/drm/amd/display/dc/dc_link.h
index 29f19d57ff7a..b2243e0dad1f 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_link.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_link.h
@@ -146,8 +146,7 @@ static inline struct dc_link *dc_get_link_at_index(struct dc *dc, uint32_t link_
 */
 bool dc_link_set_backlight_level(const struct dc_link *dc_link,
                uint32_t backlight_pwm_u16_16,
-                uint32_t frame_ramp,
+                uint32_t frame_ramp);
-                const struct dc_stream_state *stream);
 int dc_link_get_backlight_level(const struct dc_link *dc_link);
diff --git a/drivers/gpu/drm/amd/display/dc/dc_stream.h b/drivers/gpu/drm/amd/display/dc/dc_stream.h
index be34d638e15d..d70c9e1cda3d 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_stream.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_stream.h
@@ -91,7 +91,6 @@ struct dc_stream_state {
        /* DMCU info */
        unsigned int abm_level;
-        unsigned int bl_pwm_level;
        /* from core_stream struct */
        struct dc_context *ctx;
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index 4bf24758217f..8f09b8625c5d 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -1000,7 +1000,7 @@ void dce110_enable_audio_stream(struct pipe_ctx *pipe_ctx)
                pipe_ctx->stream_res.audio->funcs->az_enable(pipe_ctx->stream_res.audio);
-                if (num_audio == 1 && pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
+                if (num_audio >= 1 && pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
                        /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/
                        pp_smu->set_pme_wa_enable(&pp_smu->pp_smu);
                /* un-mute audio */
@@ -1017,6 +1017,8 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option)
        pipe_ctx->stream_res.stream_enc->funcs->audio_mute_control(
                        pipe_ctx->stream_res.stream_enc, true);
        if (pipe_ctx->stream_res.audio) {
+                struct pp_smu_funcs_rv *pp_smu = dc->res_pool->pp_smu;
                if (option != KEEP_ACQUIRED_RESOURCE ||
                                !dc->debug.az_endpoint_mute_only) {
                        /*only disalbe az_endpoint if power down or free*/
@@ -1036,6 +1038,9 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option)
                        update_audio_usage(&dc->current_state->res_ctx, dc->res_pool, pipe_ctx->stream_res.audio, false);
                        pipe_ctx->stream_res.audio = NULL;
                }
+                if (pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
+                        /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/
+                        pp_smu->set_pme_wa_enable(&pp_smu->pp_smu);
                /* TODO: notify audio driver for if audio modes list changed
                 * add audio mode list change flag */
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
index dcb3c5530236..cd1ebe57ed59 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
@@ -463,7 +463,7 @@ void dpp1_set_cursor_position(
        if (src_y_offset >= (int)param->viewport.height)
                cur_en = 0;  /* not visible beyond bottom edge*/
-        if (src_y_offset < 0)
+        if (src_y_offset + (int)height <= 0)
                cur_en = 0;  /* not visible beyond top edge*/
        REG_UPDATE(CURSOR0_CONTROL,
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
index 345af015d061..d1acd7165bc8 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
@@ -1140,7 +1140,7 @@ void hubp1_cursor_set_position(
        if (src_y_offset >= (int)param->viewport.height)
                cur_en = 0;  /* not visible beyond bottom edge*/
-        if (src_y_offset < 0) //+ (int)hubp->curs_attr.height
+        if (src_y_offset + (int)hubp->curs_attr.height <= 0)
                cur_en = 0;  /* not visible beyond top edge*/
        if (cur_en && REG_READ(CURSOR_SURFACE_ADDRESS) == 0)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 91e015e14355..58a12ddf12f3 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -2355,29 +2355,22 @@ static void dcn10_apply_ctx_for_surface(
                        top_pipe_to_program->plane_state->update_flags.bits.full_update)
                for (i = 0; i < dc->res_pool->pipe_count; i++) {
                        struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
+                        tg = pipe_ctx->stream_res.tg;
                        /* Skip inactive pipes and ones already updated */
                        if (!pipe_ctx->stream || pipe_ctx->stream == stream
-                                        || !pipe_ctx->plane_state)
+                                        || !pipe_ctx->plane_state
+                                        || !tg->funcs->is_tg_enabled(tg))
                                continue;
-                        pipe_ctx->stream_res.tg->funcs->lock(pipe_ctx->stream_res.tg);
+                        tg->funcs->lock(tg);
                        pipe_ctx->plane_res.hubp->funcs->hubp_setup_interdependent(
                                pipe_ctx->plane_res.hubp,
                                &pipe_ctx->dlg_regs,
                                &pipe_ctx->ttu_regs);
-                }
-        for (i = 0; i < dc->res_pool->pipe_count; i++) {
-                struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
-                if (!pipe_ctx->stream || pipe_ctx->stream == stream
+                        tg->funcs->unlock(tg);
-                                || !pipe_ctx->plane_state)
+                }
-                        continue;
-                dcn10_pipe_control_lock(dc, pipe_ctx, false);
-        }
        if (num_planes == 0)
                false_optc_underflow_wa(dc, stream, tg);
diff --git a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c
index 00f63b7dd32f..c11a443dcbc8 100644
--- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c
+++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c
@@ -57,6 +57,7 @@ static const unsigned char abm_config[abm_defines_max_config][abm_defines_max_le
 #define NUM_POWER_FN_SEGS 8
 #define NUM_BL_CURVE_SEGS 16
+#pragma pack(push, 1)
 /* NOTE: iRAM is 256B in size */
 struct iram_table_v_2 {
        /* flags                      */
@@ -100,6 +101,7 @@ struct iram_table_v_2 {
        uint8_t dummy8;                                                 /* 0xfe       */
        uint8_t dummy9;                                                 /* 0xff       */
 };
+#pragma pack(pop)
 static uint16_t backlight_8_to_16(unsigned int backlight_8bit)
 {
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
index 54364444ecd1..0c8212902275 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
@@ -753,6 +753,22 @@ static int vega12_init_smc_table(struct pp_hwmgr *hwmgr)
        return 0;
 }
+static int vega12_run_acg_btc(struct pp_hwmgr *hwmgr)
+{
+        uint32_t result;
+        PP_ASSERT_WITH_CODE(
+                smum_send_msg_to_smc(hwmgr, PPSMC_MSG_RunAcgBtc) == 0,
+                "[Run_ACG_BTC] Attempt to run ACG BTC failed!",
+                return -EINVAL);
+        result = smum_get_argument(hwmgr);
+        PP_ASSERT_WITH_CODE(result == 1,
+                        "Failed to run ACG BTC!", return -EINVAL);
+        return 0;
+}
 static int vega12_set_allowed_featuresmask(struct pp_hwmgr *hwmgr)
 {
        struct vega12_hwmgr *data =
@@ -931,6 +947,11 @@ static int vega12_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
                        "Failed to initialize SMC table!",
                        result = tmp_result);
+        tmp_result = vega12_run_acg_btc(hwmgr);
+        PP_ASSERT_WITH_CODE(!tmp_result,
+                        "Failed to run ACG BTC!",
+                        result = tmp_result);
        result = vega12_enable_all_smu_features(hwmgr);
        PP_ASSERT_WITH_CODE(!result,
                        "Failed to enable all smu features!",
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index b5475c91e2ef..e9f343b124b0 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -2799,6 +2799,7 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
        MMIO_DFH(_MMIO(0xe2a0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
        MMIO_DFH(_MMIO(0xe2b0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
        MMIO_DFH(_MMIO(0xe2c0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(_MMIO(0x21f0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
        return 0;
 }
diff --git a/drivers/gpu/drm/i915/gvt/hypercall.h b/drivers/gpu/drm/i915/gvt/hypercall.h
index 5af11cf1b482..e1675a00df12 100644
--- a/drivers/gpu/drm/i915/gvt/hypercall.h
+++ b/drivers/gpu/drm/i915/gvt/hypercall.h
@@ -41,7 +41,7 @@ struct intel_gvt_mpt {
        int (*host_init)(struct device *dev, void *gvt, const void *ops);
        void (*host_exit)(struct device *dev, void *gvt);
        int (*attach_vgpu)(void *vgpu, unsigned long *handle);
-        void (*detach_vgpu)(unsigned long handle);
+        void (*detach_vgpu)(void *vgpu);
        int (*inject_msi)(unsigned long handle, u32 addr, u16 data);
        unsigned long (*from_virt_to_mfn)(void *p);
        int (*enable_page_track)(unsigned long handle, u64 gfn);
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index c1072143da1d..dd3dfd00f4e6 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -996,7 +996,7 @@ static int intel_vgpu_mmap(struct mdev_device *mdev, struct vm_area_struct *vma)
 {
        unsigned int index;
        u64 virtaddr;
-        unsigned long req_size, pgoff = 0;
+        unsigned long req_size, pgoff, req_start;
        pgprot_t pg_prot;
        struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
@@ -1014,7 +1014,17 @@ static int intel_vgpu_mmap(struct mdev_device *mdev, struct vm_area_struct *vma)
        pg_prot = vma->vm_page_prot;
        virtaddr = vma->vm_start;
        req_size = vma->vm_end - vma->vm_start;
-        pgoff = vgpu_aperture_pa_base(vgpu) >> PAGE_SHIFT;
+        pgoff = vma->vm_pgoff &
+                ((1U << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1);
+        req_start = pgoff << PAGE_SHIFT;
+        if (!intel_vgpu_in_aperture(vgpu, req_start))
+                return -EINVAL;
+        if (req_start + req_size >
+            vgpu_aperture_offset(vgpu) + vgpu_aperture_sz(vgpu))
+                return -EINVAL;
+        pgoff = (gvt_aperture_pa_base(vgpu->gvt) >> PAGE_SHIFT) + pgoff;
        return remap_pfn_range(vma, virtaddr, pgoff, req_size, pg_prot);
 }
@@ -1662,9 +1672,21 @@ static int kvmgt_attach_vgpu(void *vgpu, unsigned long *handle)
        return 0;
 }
-static void kvmgt_detach_vgpu(unsigned long handle)
+static void kvmgt_detach_vgpu(void *p_vgpu)
 {
-        /* nothing to do here */
+        int i;
+        struct intel_vgpu *vgpu = (struct intel_vgpu *)p_vgpu;
+        if (!vgpu->vdev.region)
+                return;
+        for (i = 0; i < vgpu->vdev.num_regions; i++)
+                if (vgpu->vdev.region[i].ops->release)
+                        vgpu->vdev.region[i].ops->release(vgpu,
+                                        &vgpu->vdev.region[i]);
+        vgpu->vdev.num_regions = 0;
+        kfree(vgpu->vdev.region);
+        vgpu->vdev.region = NULL;
 }
 static int kvmgt_inject_msi(unsigned long handle, u32 addr, u16 data)
diff --git a/drivers/gpu/drm/i915/gvt/mpt.h b/drivers/gpu/drm/i915/gvt/mpt.h
index 67f19992b226..3ed34123d8d1 100644
--- a/drivers/gpu/drm/i915/gvt/mpt.h
+++ b/drivers/gpu/drm/i915/gvt/mpt.h
@@ -101,7 +101,7 @@ static inline void intel_gvt_hypervisor_detach_vgpu(struct intel_vgpu *vgpu)
        if (!intel_gvt_host.mpt->detach_vgpu)
                return;
-        intel_gvt_host.mpt->detach_vgpu(vgpu->handle);
+        intel_gvt_host.mpt->detach_vgpu(vgpu);
 }
 #define MSI_CAP_CONTROL(offset) (offset + 2)
diff --git a/drivers/gpu/drm/meson/meson_crtc.c b/drivers/gpu/drm/meson/meson_crtc.c
index 75d97f1b2e8f..4f5c67f70c4d 100644
--- a/drivers/gpu/drm/meson/meson_crtc.c
+++ b/drivers/gpu/drm/meson/meson_crtc.c
@@ -46,7 +46,6 @@ struct meson_crtc {
        struct drm_crtc base;
        struct drm_pending_vblank_event *event;
        struct meson_drm *priv;
-        bool enabled;
 };
 #define to_meson_crtc(x) container_of(x, struct meson_crtc, base)
@@ -82,7 +81,8 @@ static const struct drm_crtc_funcs meson_crtc_funcs = {
 };
-static void meson_crtc_enable(struct drm_crtc *crtc)
+static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
+                                     struct drm_crtc_state *old_state)
 {
        struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
        struct drm_crtc_state *crtc_state = crtc->state;
@@ -108,20 +108,6 @@ static void meson_crtc_enable(struct drm_crtc *crtc)
        drm_crtc_vblank_on(crtc);
-        meson_crtc->enabled = true;
-}
-static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
-                                     struct drm_crtc_state *old_state)
-{
-        struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
-        struct meson_drm *priv = meson_crtc->priv;
-        DRM_DEBUG_DRIVER("\n");
-        if (!meson_crtc->enabled)
-                meson_crtc_enable(crtc);
        priv->viu.osd1_enabled = true;
 }
@@ -153,8 +139,6 @@ static void meson_crtc_atomic_disable(struct drm_crtc *crtc,
                crtc->state->event = NULL;
        }
-        meson_crtc->enabled = false;
 }
 static void meson_crtc_atomic_begin(struct drm_crtc *crtc,
@@ -163,9 +147,6 @@ static void meson_crtc_atomic_begin(struct drm_crtc *crtc,
        struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
        unsigned long flags;
-        if (crtc->state->enable && !meson_crtc->enabled)
-                meson_crtc_enable(crtc);
        if (crtc->state->event) {
                WARN_ON(drm_crtc_vblank_get(crtc) != 0);
diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
index 3ee4d4a4ecba..12ff47b13668 100644
--- a/drivers/gpu/drm/meson/meson_drv.c
+++ b/drivers/gpu/drm/meson/meson_drv.c
@@ -75,6 +75,10 @@ static const struct drm_mode_config_funcs meson_mode_config_funcs = {
        .fb_create           = drm_gem_fb_create,
 };
+static const struct drm_mode_config_helper_funcs meson_mode_config_helpers = {
+        .atomic_commit_tail = drm_atomic_helper_commit_tail_rpm,
+};
 static irqreturn_t meson_irq(int irq, void *arg)
 {
        struct drm_device *dev = arg;
@@ -266,6 +270,7 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
        drm->mode_config.max_width = 3840;
        drm->mode_config.max_height = 2160;
        drm->mode_config.funcs = &meson_mode_config_funcs;
+        drm->mode_config.helper_private = &meson_mode_config_helpers;
        /* Hardware Initialization */
@@ -388,8 +393,10 @@ static int meson_probe_remote(struct platform_device *pdev,
                remote_node = of_graph_get_remote_port_parent(ep);
                if (!remote_node ||
                    remote_node == parent || /* Ignore parent endpoint */
-                    !of_device_is_available(remote_node))
+                    !of_device_is_available(remote_node)) {
+                        of_node_put(remote_node);
                        continue;
+                }
                count += meson_probe_remote(pdev, match, remote, remote_node);
@@ -408,10 +415,13 @@ static int meson_drv_probe(struct platform_device *pdev)
        for_each_endpoint_of_node(np, ep) {
                remote = of_graph_get_remote_port_parent(ep);
-                if (!remote || !of_device_is_available(remote))
+                if (!remote || !of_device_is_available(remote)) {
+                        of_node_put(remote);
                        continue;
+                }
                count += meson_probe_remote(pdev, &match, np, remote);
+                of_node_put(remote);
        }
        if (count && !match)
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
index bfbc9341e0c2..d9edb5785813 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
@@ -2435,6 +2435,38 @@ nv140_chipset = {
 };
 static const struct nvkm_device_chip
+nv162_chipset = {
+        .name = "TU102",
+        .bar = tu104_bar_new,
+        .bios = nvkm_bios_new,
+        .bus = gf100_bus_new,
+        .devinit = tu104_devinit_new,
+        .fault = tu104_fault_new,
+        .fb = gv100_fb_new,
+        .fuse = gm107_fuse_new,
+        .gpio = gk104_gpio_new,
+        .i2c = gm200_i2c_new,
+        .ibus = gm200_ibus_new,
+        .imem = nv50_instmem_new,
+        .ltc = gp102_ltc_new,
+        .mc = tu104_mc_new,
+        .mmu = tu104_mmu_new,
+        .pci = gp100_pci_new,
+        .pmu = gp102_pmu_new,
+        .therm = gp100_therm_new,
+        .timer = gk20a_timer_new,
+        .top = gk104_top_new,
+        .ce[0] = tu104_ce_new,
+        .ce[1] = tu104_ce_new,
+        .ce[2] = tu104_ce_new,
+        .ce[3] = tu104_ce_new,
+        .ce[4] = tu104_ce_new,
+        .disp = tu104_disp_new,
+        .dma = gv100_dma_new,
+        .fifo = tu104_fifo_new,
+};
+static const struct nvkm_device_chip
 nv164_chipset = {
        .name = "TU104",
        .bar = tu104_bar_new,
@@ -2950,6 +2982,7 @@ nvkm_device_ctor(const struct nvkm_device_func *func,
                case 0x138: device->chip = &nv138_chipset; break;
                case 0x13b: device->chip = &nv13b_chipset; break;
                case 0x140: device->chip = &nv140_chipset; break;
+                case 0x162: device->chip = &nv162_chipset; break;
                case 0x164: device->chip = &nv164_chipset; break;
                case 0x166: device->chip = &nv166_chipset; break;
                default:
diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c
index 13c8a662f9b4..ccb090f3ab30 100644
--- a/drivers/gpu/drm/qxl/qxl_drv.c
+++ b/drivers/gpu/drm/qxl/qxl_drv.c
@@ -250,14 +250,10 @@ static struct drm_driver qxl_driver = {
 #if defined(CONFIG_DEBUG_FS)
        .debugfs_init = qxl_debugfs_init,
 #endif
-        .prime_handle_to_fd = drm_gem_prime_handle_to_fd,
-        .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
        .gem_prime_export = drm_gem_prime_export,
        .gem_prime_import = drm_gem_prime_import,
        .gem_prime_pin = qxl_gem_prime_pin,
        .gem_prime_unpin = qxl_gem_prime_unpin,
-        .gem_prime_get_sg_table = qxl_gem_prime_get_sg_table,
-        .gem_prime_import_sg_table = qxl_gem_prime_import_sg_table,
        .gem_prime_vmap = qxl_gem_prime_vmap,
        .gem_prime_vunmap = qxl_gem_prime_vunmap,
        .gem_prime_mmap = qxl_gem_prime_mmap,
diff --git a/drivers/gpu/drm/qxl/qxl_prime.c b/drivers/gpu/drm/qxl/qxl_prime.c
index a55dece118b2..df65d3c1a7b8 100644
--- a/drivers/gpu/drm/qxl/qxl_prime.c
+++ b/drivers/gpu/drm/qxl/qxl_prime.c
@@ -38,20 +38,6 @@ void qxl_gem_prime_unpin(struct drm_gem_object *obj)
        WARN_ONCE(1, "not implemented");
 }
-struct sg_table *qxl_gem_prime_get_sg_table(struct drm_gem_object *obj)
-{
-        WARN_ONCE(1, "not implemented");
-        return ERR_PTR(-ENOSYS);
-}
-struct drm_gem_object *qxl_gem_prime_import_sg_table(
-        struct drm_device *dev, struct dma_buf_attachment *attach,
-        struct sg_table *table)
-{
-        WARN_ONCE(1, "not implemented");
-        return ERR_PTR(-ENOSYS);
-}
 void *qxl_gem_prime_vmap(struct drm_gem_object *obj)
 {
        WARN_ONCE(1, "not implemented");
diff --git a/drivers/gpu/drm/rockchip/rockchip_rgb.c b/drivers/gpu/drm/rockchip/rockchip_rgb.c
index 96ac1458a59c..37f93022a106 100644
--- a/drivers/gpu/drm/rockchip/rockchip_rgb.c
+++ b/drivers/gpu/drm/rockchip/rockchip_rgb.c
@@ -113,8 +113,10 @@ struct rockchip_rgb *rockchip_rgb_init(struct device *dev,
                child_count++;
                ret = drm_of_find_panel_or_bridge(dev->of_node, 0, endpoint_id,
                                                  &panel, &bridge);
-                if (!ret)
+                if (!ret) {
+                        of_node_put(endpoint);
                        break;
+                }
        }
        of_node_put(port);
diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
index 9e9255ee59cd..a021bab11a4f 100644
--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
+++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
@@ -786,17 +786,18 @@ static struct sun4i_frontend *sun4i_backend_find_frontend(struct sun4i_drv *drv,
                remote = of_graph_get_remote_port_parent(ep);
                if (!remote)
                        continue;
+                of_node_put(remote);
                /* does this node match any registered engines? */
                list_for_each_entry(frontend, &drv->frontend_list, list) {
                        if (remote == frontend->node) {
-                                of_node_put(remote);
                                of_node_put(port);
+                                of_node_put(ep);
                                return frontend;
                        }
                }
        }
+        of_node_put(port);
        return ERR_PTR(-EINVAL);
 }
diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c
index f7f32a885af7..2d1aaca49105 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.c
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.c
@@ -127,14 +127,10 @@ static struct drm_driver driver = {
 #if defined(CONFIG_DEBUG_FS)
        .debugfs_init = virtio_gpu_debugfs_init,
 #endif
-        .prime_handle_to_fd = drm_gem_prime_handle_to_fd,
-        .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
        .gem_prime_export = drm_gem_prime_export,
        .gem_prime_import = drm_gem_prime_import,
        .gem_prime_pin = virtgpu_gem_prime_pin,
        .gem_prime_unpin = virtgpu_gem_prime_unpin,
-        .gem_prime_get_sg_table = virtgpu_gem_prime_get_sg_table,
-        .gem_prime_import_sg_table = virtgpu_gem_prime_import_sg_table,
        .gem_prime_vmap = virtgpu_gem_prime_vmap,
        .gem_prime_vunmap = virtgpu_gem_prime_vunmap,
        .gem_prime_mmap = virtgpu_gem_prime_mmap,
diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
index 1deb41d42ea4..0c15000f926e 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.h
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
@@ -372,10 +372,6 @@ int virtio_gpu_object_wait(struct virtio_gpu_object *bo, bool no_wait);
 /* virtgpu_prime.c */
 int virtgpu_gem_prime_pin(struct drm_gem_object *obj);
 void virtgpu_gem_prime_unpin(struct drm_gem_object *obj);
-struct sg_table *virtgpu_gem_prime_get_sg_table(struct drm_gem_object *obj);
-struct drm_gem_object *virtgpu_gem_prime_import_sg_table(
-        struct drm_device *dev, struct dma_buf_attachment *attach,
-        struct sg_table *sgt);
 void *virtgpu_gem_prime_vmap(struct drm_gem_object *obj);
 void virtgpu_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr);
 int virtgpu_gem_prime_mmap(struct drm_gem_object *obj,
diff --git a/drivers/gpu/drm/virtio/virtgpu_prime.c b/drivers/gpu/drm/virtio/virtgpu_prime.c
index 86ce0ae93f59..c59ec34c80a5 100644
--- a/drivers/gpu/drm/virtio/virtgpu_prime.c
+++ b/drivers/gpu/drm/virtio/virtgpu_prime.c
@@ -39,20 +39,6 @@ void virtgpu_gem_prime_unpin(struct drm_gem_object *obj)
        WARN_ONCE(1, "not implemented");
 }
-struct sg_table *virtgpu_gem_prime_get_sg_table(struct drm_gem_object *obj)
-{
-        WARN_ONCE(1, "not implemented");
-        return ERR_PTR(-ENODEV);
-}
-struct drm_gem_object *virtgpu_gem_prime_import_sg_table(
-        struct drm_device *dev, struct dma_buf_attachment *attach,
-        struct sg_table *table)
-{
-        WARN_ONCE(1, "not implemented");
-        return ERR_PTR(-ENODEV);
-}
 void *virtgpu_gem_prime_vmap(struct drm_gem_object *obj)
 {
        struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(obj);
diff --git a/drivers/gpu/vga/Kconfig b/drivers/gpu/vga/Kconfig
index b677e5d524e6..d5f1d8e1c6f8 100644
--- a/drivers/gpu/vga/Kconfig
+++ b/drivers/gpu/vga/Kconfig
@@ -21,6 +21,7 @@ config VGA_SWITCHEROO
        bool "Laptop Hybrid Graphics - GPU switching support"
        depends on X86
        depends on ACPI
+        depends on PCI
        select VGA_ARB
        help
          Many laptops released in 2008/9/10 have two GPUs with a multiplexer
diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
index 0e30fa00204c..f9b8e3e23a8e 100644
--- a/drivers/hwmon/lm80.c
+++ b/drivers/hwmon/lm80.c
@@ -393,8 +393,10 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
        }
        rv = lm80_read_value(client, LM80_REG_FANDIV);
-        if (rv < 0)
+        if (rv < 0) {
+                mutex_unlock(&data->update_lock);
                return rv;
+        }
        reg = (rv & ~(3 << (2 * (nr + 1))))
            | (data->fan_div[nr] << (2 * (nr + 1)));
        lm80_write_value(client, LM80_REG_FANDIV, reg);
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index c3040079b1cb..4adec4ab7d06 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -44,8 +44,8 @@
 * nct6796d    14      7       7       2+6    0xd420 0xc1    0x5ca3
 * nct6797d    14      7       7       2+6    0xd450 0xc1    0x5ca3
 *                                           (0xd451)
- * nct6798d    14      7       7       2+6    0xd458 0xc1    0x5ca3
+ * nct6798d    14      7       7       2+6    0xd428 0xc1    0x5ca3
- *                                           (0xd459)
+ *                                           (0xd429)
 *
 * #temp lists the number of monitored temperature sources (first value) plus
 * the number of directly connectable temperature sensors (second value).
@@ -138,7 +138,7 @@ MODULE_PARM_DESC(fan_debounce, "Enable debouncing for fan RPM signal");
 #define SIO_NCT6795_ID          0xd350
 #define SIO_NCT6796_ID          0xd420
 #define SIO_NCT6797_ID          0xd450
-#define SIO_NCT6798_ID          0xd458
+#define SIO_NCT6798_ID          0xd428
 #define SIO_ID_MASK             0xFFF8
 enum pwm_enable { off, manual, thermal_cruise, speed_cruise, sf3, sf4 };
@@ -4508,7 +4508,8 @@ static int __maybe_unused nct6775_resume(struct device *dev)
        if (data->kind == nct6791 || data->kind == nct6792 ||
            data->kind == nct6793 || data->kind == nct6795 ||
-            data->kind == nct6796)
+            data->kind == nct6796 || data->kind == nct6797 ||
+            data->kind == nct6798)
                nct6791_enable_io_mapping(sioreg);
        superio_exit(sioreg);
@@ -4644,7 +4645,8 @@ static int __init nct6775_find(int sioaddr, struct nct6775_sio_data *sio_data)
        if (sio_data->kind == nct6791 || sio_data->kind == nct6792 ||
            sio_data->kind == nct6793 || sio_data->kind == nct6795 ||
-            sio_data->kind == nct6796)
+            sio_data->kind == nct6796 || sio_data->kind == nct6797 ||
+            sio_data->kind == nct6798)
                nct6791_enable_io_mapping(sioaddr);
        superio_exit(sioaddr);
diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
index 423903f87955..391118c8aae8 100644
--- a/drivers/hwmon/occ/common.c
+++ b/drivers/hwmon/occ/common.c
@@ -380,8 +380,8 @@ static ssize_t occ_show_power_1(struct device *dev,
                val *= 1000000ULL;
                break;
        case 2:
-                val = get_unaligned_be32(&power->update_tag) *
+                val = (u64)get_unaligned_be32(&power->update_tag) *
-                        occ->powr_sample_time_us;
+                           occ->powr_sample_time_us;
                break;
        case 3:
                val = get_unaligned_be16(&power->value) * 1000000ULL;
@@ -425,8 +425,8 @@ static ssize_t occ_show_power_2(struct device *dev,
                                       &power->update_tag);
                break;
        case 2:
-                val = get_unaligned_be32(&power->update_tag) *
+                val = (u64)get_unaligned_be32(&power->update_tag) *
-                        occ->powr_sample_time_us;
+                           occ->powr_sample_time_us;
                break;
        case 3:
                val = get_unaligned_be16(&power->value) * 1000000ULL;
@@ -463,8 +463,8 @@ static ssize_t occ_show_power_a0(struct device *dev,
                                       &power->system.update_tag);
                break;
        case 2:
-                val = get_unaligned_be32(&power->system.update_tag) *
+                val = (u64)get_unaligned_be32(&power->system.update_tag) *
-                        occ->powr_sample_time_us;
+                           occ->powr_sample_time_us;
                break;
        case 3:
                val = get_unaligned_be16(&power->system.value) * 1000000ULL;
@@ -477,8 +477,8 @@ static ssize_t occ_show_power_a0(struct device *dev,
                                       &power->proc.update_tag);
                break;
        case 6:
-                val = get_unaligned_be32(&power->proc.update_tag) *
+                val = (u64)get_unaligned_be32(&power->proc.update_tag) *
-                        occ->powr_sample_time_us;
+                           occ->powr_sample_time_us;
                break;
        case 7:
                val = get_unaligned_be16(&power->proc.value) * 1000000ULL;
@@ -491,8 +491,8 @@ static ssize_t occ_show_power_a0(struct device *dev,
                                       &power->vdd.update_tag);
                break;
        case 10:
-                val = get_unaligned_be32(&power->vdd.update_tag) *
+                val = (u64)get_unaligned_be32(&power->vdd.update_tag) *
-                        occ->powr_sample_time_us;
+                           occ->powr_sample_time_us;
                break;
        case 11:
                val = get_unaligned_be16(&power->vdd.value) * 1000000ULL;
@@ -505,8 +505,8 @@ static ssize_t occ_show_power_a0(struct device *dev,
                                       &power->vdn.update_tag);
                break;
        case 14:
-                val = get_unaligned_be32(&power->vdn.update_tag) *
+                val = (u64)get_unaligned_be32(&power->vdn.update_tag) *
-                        occ->powr_sample_time_us;
+                           occ->powr_sample_time_us;
                break;
        case 15:
                val = get_unaligned_be16(&power->vdn.value) * 1000000ULL;
diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c
index 8844c9565d2a..7053be59ad2e 100644
--- a/drivers/hwmon/tmp421.c
+++ b/drivers/hwmon/tmp421.c
@@ -88,7 +88,7 @@ static const struct of_device_id tmp421_of_match[] = {
                .data = (void *)2
        },
        {
-                .compatible = "ti,tmp422",
+                .compatible = "ti,tmp442",
                .data = (void *)3
        },
        { },
diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
index b532e2c9cf5c..f8c00b94817f 100644
--- a/drivers/i3c/master/dw-i3c-master.c
+++ b/drivers/i3c/master/dw-i3c-master.c
@@ -901,9 +901,6 @@ static int dw_i3c_master_reattach_i3c_dev(struct i3c_dev_desc *dev,
               master->regs +
               DEV_ADDR_TABLE_LOC(master->datstartaddr, data->index));
-        if (!old_dyn_addr)
-                return 0;
        master->addrs[data->index] = dev->info.dyn_addr;
        return 0;
@@ -925,11 +922,11 @@ static int dw_i3c_master_attach_i3c_dev(struct i3c_dev_desc *dev)
                return -ENOMEM;
        data->index = pos;
-        master->addrs[pos] = dev->info.dyn_addr;
+        master->addrs[pos] = dev->info.dyn_addr ? : dev->info.static_addr;
        master->free_pos &= ~BIT(pos);
        i3c_dev_set_master_data(dev, data);
-        writel(DEV_ADDR_TABLE_DYNAMIC_ADDR(dev->info.dyn_addr),
+        writel(DEV_ADDR_TABLE_DYNAMIC_ADDR(master->addrs[pos]),
               master->regs +
               DEV_ADDR_TABLE_LOC(master->datstartaddr, data->index));
diff --git a/drivers/i3c/master/i3c-master-cdns.c b/drivers/i3c/master/i3c-master-cdns.c
index bbd79b8b1a80..8889a4fdb454 100644
--- a/drivers/i3c/master/i3c-master-cdns.c
+++ b/drivers/i3c/master/i3c-master-cdns.c
@@ -1556,8 +1556,8 @@ static int cdns_i3c_master_probe(struct platform_device *pdev)
                return PTR_ERR(master->pclk);
        master->sysclk = devm_clk_get(&pdev->dev, "sysclk");
-        if (IS_ERR(master->pclk))
+        if (IS_ERR(master->sysclk))
-                return PTR_ERR(master->pclk);
+                return PTR_ERR(master->sysclk);
        irq = platform_get_irq(pdev, 0);
        if (irq < 0)
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 63a7cc00bae0..84f077b2b90a 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -494,7 +494,10 @@ static void _cma_attach_to_dev(struct rdma_id_private *id_priv,
        id_priv->id.route.addr.dev_addr.transport =
                rdma_node_get_transport(cma_dev->device->node_type);
        list_add_tail(&id_priv->list, &cma_dev->id_list);
-        rdma_restrack_kadd(&id_priv->res);
+        if (id_priv->res.kern_name)
+                rdma_restrack_kadd(&id_priv->res);
+        else
+                rdma_restrack_uadd(&id_priv->res);
 }
 static void cma_attach_to_dev(struct rdma_id_private *id_priv,
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index e600fc23ae62..3c97a8b6bf1e 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -584,10 +584,6 @@ static int fill_res_pd_entry(struct sk_buff *msg, struct netlink_callback *cb,
        if (nla_put_u64_64bit(msg, RDMA_NLDEV_ATTR_RES_USECNT,
                              atomic_read(&pd->usecnt), RDMA_NLDEV_ATTR_PAD))
                goto err;
-        if ((pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY) &&
-            nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_UNSAFE_GLOBAL_RKEY,
-                        pd->unsafe_global_rkey))
-                goto err;
        if (fill_res_name_pid(msg, res))
                goto err;
diff --git a/drivers/infiniband/core/rdma_core.h b/drivers/infiniband/core/rdma_core.h
index be6b8e1257d0..69f8db66925e 100644
--- a/drivers/infiniband/core/rdma_core.h
+++ b/drivers/infiniband/core/rdma_core.h
@@ -106,6 +106,8 @@ int uverbs_finalize_object(struct ib_uobject *uobj,
                           enum uverbs_obj_access access,
                           bool commit);
+int uverbs_output_written(const struct uverbs_attr_bundle *bundle, size_t idx);
 void setup_ufile_idr_uobject(struct ib_uverbs_file *ufile);
 void release_ufile_idr_uobject(struct ib_uverbs_file *ufile);
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 6b12cc5f97b2..3317300ab036 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -60,6 +60,10 @@ static int uverbs_response(struct uverbs_attr_bundle *attrs, const void *resp,
 {
        int ret;
+        if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CORE_OUT))
+                return uverbs_copy_to_struct_or_zero(
+                        attrs, UVERBS_ATTR_CORE_OUT, resp, resp_len);
        if (copy_to_user(attrs->ucore.outbuf, resp,
                         min(attrs->ucore.outlen, resp_len)))
                return -EFAULT;
@@ -1181,6 +1185,9 @@ static int ib_uverbs_poll_cq(struct uverbs_attr_bundle *attrs)
                goto out_put;
        }
+        if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CORE_OUT))
+                ret = uverbs_output_written(attrs, UVERBS_ATTR_CORE_OUT);
        ret = 0;
 out_put:
@@ -2012,8 +2019,10 @@ static int ib_uverbs_post_send(struct uverbs_attr_bundle *attrs)
                return -ENOMEM;
        qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs);
-        if (!qp)
+        if (!qp) {
+                ret = -EINVAL;
                goto out;
+        }
        is_ud = qp->qp_type == IB_QPT_UD;
        sg_ind = 0;
diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c
index 8c81ff698052..0ca04d224015 100644
--- a/drivers/infiniband/core/uverbs_ioctl.c
+++ b/drivers/infiniband/core/uverbs_ioctl.c
@@ -144,6 +144,21 @@ static bool uverbs_is_attr_cleared(const struct ib_uverbs_attr *uattr,
                           0, uattr->len - len);
 }
+static int uverbs_set_output(const struct uverbs_attr_bundle *bundle,
+                             const struct uverbs_attr *attr)
+{
+        struct bundle_priv *pbundle =
+                container_of(bundle, struct bundle_priv, bundle);
+        u16 flags;
+        flags = pbundle->uattrs[attr->ptr_attr.uattr_idx].flags |
+                UVERBS_ATTR_F_VALID_OUTPUT;
+        if (put_user(flags,
+                     &pbundle->user_attrs[attr->ptr_attr.uattr_idx].flags))
+                return -EFAULT;
+        return 0;
+}
 static int uverbs_process_idrs_array(struct bundle_priv *pbundle,
                                     const struct uverbs_api_attr *attr_uapi,
                                     struct uverbs_objs_arr_attr *attr,
@@ -456,6 +471,19 @@ static int ib_uverbs_run_method(struct bundle_priv *pbundle,
        }
        /*
+         * Until the drivers are revised to use the bundle directly we have to
+         * assume that the driver wrote to its UHW_OUT and flag userspace
+         * appropriately.
+         */
+        if (!ret && pbundle->method_elm->has_udata) {
+                const struct uverbs_attr *attr =
+                        uverbs_attr_get(&pbundle->bundle, UVERBS_ATTR_UHW_OUT);
+                if (!IS_ERR(attr))
+                        ret = uverbs_set_output(&pbundle->bundle, attr);
+        }
+        /*
         * EPROTONOSUPPORT is ONLY to be returned if the ioctl framework can
         * not invoke the method because the request is not supported.  No
         * other cases should return this code.
@@ -706,10 +734,7 @@ void uverbs_fill_udata(struct uverbs_attr_bundle *bundle,
 int uverbs_copy_to(const struct uverbs_attr_bundle *bundle, size_t idx,
                   const void *from, size_t size)
 {
-        struct bundle_priv *pbundle =
-                container_of(bundle, struct bundle_priv, bundle);
        const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx);
-        u16 flags;
        size_t min_size;
        if (IS_ERR(attr))
@@ -719,16 +744,25 @@ int uverbs_copy_to(const struct uverbs_attr_bundle *bundle, size_t idx,
        if (copy_to_user(u64_to_user_ptr(attr->ptr_attr.data), from, min_size))
                return -EFAULT;
-        flags = pbundle->uattrs[attr->ptr_attr.uattr_idx].flags |
+        return uverbs_set_output(bundle, attr);
-                UVERBS_ATTR_F_VALID_OUTPUT;
-        if (put_user(flags,
-                     &pbundle->user_attrs[attr->ptr_attr.uattr_idx].flags))
-                return -EFAULT;
-        return 0;
 }
 EXPORT_SYMBOL(uverbs_copy_to);
+/*
+ * This is only used if the caller has directly used copy_to_use to write the
+ * data.  It signals to user space that the buffer is filled in.
+ */
+int uverbs_output_written(const struct uverbs_attr_bundle *bundle, size_t idx)
+{
+        const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx);
+        if (IS_ERR(attr))
+                return PTR_ERR(attr);
+        return uverbs_set_output(bundle, attr);
+}
 int _uverbs_get_const(s64 *to, const struct uverbs_attr_bundle *attrs_bundle,
                      size_t idx, s64 lower_bound, u64 upper_bound,
                      s64  *def_val)
@@ -757,8 +791,10 @@ int uverbs_copy_to_struct_or_zero(const struct uverbs_attr_bundle *bundle,
 {
        const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx);
-        if (clear_user(u64_to_user_ptr(attr->ptr_attr.data),
+        if (size < attr->ptr_attr.len) {
-                       attr->ptr_attr.len))
+                if (clear_user(u64_to_user_ptr(attr->ptr_attr.data) + size,
-                return -EFAULT;
+                               attr->ptr_attr.len - size))
+                        return -EFAULT;
+        }
        return uverbs_copy_to(bundle, idx, from, size);
 }
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index fb0007aa0c27..2890a77339e1 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -690,6 +690,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
        buf += sizeof(hdr);
+        memset(bundle.attr_present, 0, sizeof(bundle.attr_present));
        bundle.ufile = file;
        if (!method_elm->is_ex) {
                size_t in_len = hdr.in_words * 4 - sizeof(hdr);
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 82cb6b71ac7c..e3e9dd54caa2 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -534,7 +534,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
        {
                struct mthca_ucontext *context;
-                qp = kmalloc(sizeof *qp, GFP_KERNEL);
+                qp = kzalloc(sizeof(*qp), GFP_KERNEL);
                if (!qp)
                        return ERR_PTR(-ENOMEM);
@@ -600,7 +600,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
                if (udata)
                        return ERR_PTR(-EINVAL);
-                qp = kmalloc(sizeof (struct mthca_sqp), GFP_KERNEL);
+                qp = kzalloc(sizeof(struct mthca_sqp), GFP_KERNEL);
                if (!qp)
                        return ERR_PTR(-ENOMEM);
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
index 42b8685c997e..3c633ab58052 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
@@ -427,7 +427,40 @@ static inline enum ib_qp_state pvrdma_qp_state_to_ib(enum pvrdma_qp_state state)
 static inline enum pvrdma_wr_opcode ib_wr_opcode_to_pvrdma(enum ib_wr_opcode op)
 {
-        return (enum pvrdma_wr_opcode)op;
+        switch (op) {
+        case IB_WR_RDMA_WRITE:
+                return PVRDMA_WR_RDMA_WRITE;
+        case IB_WR_RDMA_WRITE_WITH_IMM:
+                return PVRDMA_WR_RDMA_WRITE_WITH_IMM;
+        case IB_WR_SEND:
+                return PVRDMA_WR_SEND;
+        case IB_WR_SEND_WITH_IMM:
+                return PVRDMA_WR_SEND_WITH_IMM;
+        case IB_WR_RDMA_READ:
+                return PVRDMA_WR_RDMA_READ;
+        case IB_WR_ATOMIC_CMP_AND_SWP:
+                return PVRDMA_WR_ATOMIC_CMP_AND_SWP;
+        case IB_WR_ATOMIC_FETCH_AND_ADD:
+                return PVRDMA_WR_ATOMIC_FETCH_AND_ADD;
+        case IB_WR_LSO:
+                return PVRDMA_WR_LSO;
+        case IB_WR_SEND_WITH_INV:
+                return PVRDMA_WR_SEND_WITH_INV;
+        case IB_WR_RDMA_READ_WITH_INV:
+                return PVRDMA_WR_RDMA_READ_WITH_INV;
+        case IB_WR_LOCAL_INV:
+                return PVRDMA_WR_LOCAL_INV;
+        case IB_WR_REG_MR:
+                return PVRDMA_WR_FAST_REG_MR;
+        case IB_WR_MASKED_ATOMIC_CMP_AND_SWP:
+                return PVRDMA_WR_MASKED_ATOMIC_CMP_AND_SWP;
+        case IB_WR_MASKED_ATOMIC_FETCH_AND_ADD:
+                return PVRDMA_WR_MASKED_ATOMIC_FETCH_AND_ADD;
+        case IB_WR_REG_SIG_MR:
+                return PVRDMA_WR_REG_SIG_MR;
+        default:
+                return PVRDMA_WR_ERROR;
+        }
 }
 static inline enum ib_wc_status pvrdma_wc_status_to_ib(
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
index 3acf74cbe266..1ec3646087ba 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
@@ -721,6 +721,12 @@ int pvrdma_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
                    wr->opcode == IB_WR_RDMA_WRITE_WITH_IMM)
                        wqe_hdr->ex.imm_data = wr->ex.imm_data;
+                if (unlikely(wqe_hdr->opcode == PVRDMA_WR_ERROR)) {
+                        *bad_wr = wr;
+                        ret = -EINVAL;
+                        goto out;
+                }
                switch (qp->ibqp.qp_type) {
                case IB_QPT_GSI:
                case IB_QPT_UD:
diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
index a2e74feee2b2..fd64df5a57a5 100644
--- a/drivers/leds/leds-lp5523.c
+++ b/drivers/leds/leds-lp5523.c
@@ -318,7 +318,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip)
        /* Let the programs run for couple of ms and check the engine status */
        usleep_range(3000, 6000);
-        lp55xx_read(chip, LP5523_REG_STATUS, &status);
+        ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
+        if (ret)
+                return ret;
        status &= LP5523_ENG_STATUS_MASK;
        if (status != LP5523_ENG_STATUS_MASK) {
diff --git a/drivers/md/md.c b/drivers/md/md.c
index fd4af4de03b4..05ffffb8b769 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -207,15 +207,10 @@ static bool create_on_open = true;
 struct bio *bio_alloc_mddev(gfp_t gfp_mask, int nr_iovecs,
                            struct mddev *mddev)
 {
-        struct bio *b;
        if (!mddev || !bioset_initialized(&mddev->bio_set))
                return bio_alloc(gfp_mask, nr_iovecs);
-        b = bio_alloc_bioset(gfp_mask, nr_iovecs, &mddev->bio_set);
+        return bio_alloc_bioset(gfp_mask, nr_iovecs, &mddev->bio_set);
-        if (!b)
-                return NULL;
-        return b;
 }
 EXPORT_SYMBOL_GPL(bio_alloc_mddev);
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
index d01821a6906a..89d9c4c21037 100644
--- a/drivers/media/platform/vim2m.c
+++ b/drivers/media/platform/vim2m.c
@@ -807,7 +807,9 @@ static void vim2m_stop_streaming(struct vb2_queue *q)
        struct vb2_v4l2_buffer *vbuf;
        unsigned long flags;
-        cancel_delayed_work_sync(&dev->work_run);
+        if (v4l2_m2m_get_curr_priv(dev->m2m_dev) == ctx)
+                cancel_delayed_work_sync(&dev->work_run);
        for (;;) {
                if (V4L2_TYPE_IS_OUTPUT(q->type))
                        vbuf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index 1441a73ce64c..90aad465f9ed 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -287,6 +287,7 @@ static void v4l_print_format(const void *arg, bool write_only)
        const struct v4l2_window *win;
        const struct v4l2_sdr_format *sdr;
        const struct v4l2_meta_format *meta;
+        u32 planes;
        unsigned i;
        pr_cont("type=%s", prt_names(p->type, v4l2_type_names));
@@ -317,7 +318,8 @@ static void v4l_print_format(const void *arg, bool write_only)
                        prt_names(mp->field, v4l2_field_names),
                        mp->colorspace, mp->num_planes, mp->flags,
                        mp->ycbcr_enc, mp->quantization, mp->xfer_func);
-                for (i = 0; i < mp->num_planes; i++)
+                planes = min_t(u32, mp->num_planes, VIDEO_MAX_PLANES);
+                for (i = 0; i < planes; i++)
                        printk(KERN_DEBUG "plane %u: bytesperline=%u sizeimage=%u\n", i,
                                        mp->plane_fmt[i].bytesperline,
                                        mp->plane_fmt[i].sizeimage);
@@ -1551,8 +1553,11 @@ static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops,
                if (unlikely(!ops->vidioc_s_fmt_vid_cap_mplane))
                        break;
                CLEAR_AFTER_FIELD(p, fmt.pix_mp.xfer_func);
+                if (p->fmt.pix_mp.num_planes > VIDEO_MAX_PLANES)
+                        break;
                for (i = 0; i < p->fmt.pix_mp.num_planes; i++)
-                        CLEAR_AFTER_FIELD(p, fmt.pix_mp.plane_fmt[i].bytesperline);
+                        CLEAR_AFTER_FIELD(&p->fmt.pix_mp.plane_fmt[i],
+                                          bytesperline);
                return ops->vidioc_s_fmt_vid_cap_mplane(file, fh, arg);
        case V4L2_BUF_TYPE_VIDEO_OVERLAY:
                if (unlikely(!ops->vidioc_s_fmt_vid_overlay))
@@ -1581,8 +1586,11 @@ static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops,
                if (unlikely(!ops->vidioc_s_fmt_vid_out_mplane))
                        break;
                CLEAR_AFTER_FIELD(p, fmt.pix_mp.xfer_func);
+                if (p->fmt.pix_mp.num_planes > VIDEO_MAX_PLANES)
+                        break;
                for (i = 0; i < p->fmt.pix_mp.num_planes; i++)
-                        CLEAR_AFTER_FIELD(p, fmt.pix_mp.plane_fmt[i].bytesperline);
+                        CLEAR_AFTER_FIELD(&p->fmt.pix_mp.plane_fmt[i],
+                                          bytesperline);
                return ops->vidioc_s_fmt_vid_out_mplane(file, fh, arg);
        case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
                if (unlikely(!ops->vidioc_s_fmt_vid_out_overlay))
@@ -1648,8 +1656,11 @@ static int v4l_try_fmt(const struct v4l2_ioctl_ops *ops,
                if (unlikely(!ops->vidioc_try_fmt_vid_cap_mplane))
                        break;
                CLEAR_AFTER_FIELD(p, fmt.pix_mp.xfer_func);
+                if (p->fmt.pix_mp.num_planes > VIDEO_MAX_PLANES)
+                        break;
                for (i = 0; i < p->fmt.pix_mp.num_planes; i++)
-                        CLEAR_AFTER_FIELD(p, fmt.pix_mp.plane_fmt[i].bytesperline);
+                        CLEAR_AFTER_FIELD(&p->fmt.pix_mp.plane_fmt[i],
+                                          bytesperline);
                return ops->vidioc_try_fmt_vid_cap_mplane(file, fh, arg);
        case V4L2_BUF_TYPE_VIDEO_OVERLAY:
                if (unlikely(!ops->vidioc_try_fmt_vid_overlay))
@@ -1678,8 +1689,11 @@ static int v4l_try_fmt(const struct v4l2_ioctl_ops *ops,
                if (unlikely(!ops->vidioc_try_fmt_vid_out_mplane))
                        break;
                CLEAR_AFTER_FIELD(p, fmt.pix_mp.xfer_func);
+                if (p->fmt.pix_mp.num_planes > VIDEO_MAX_PLANES)
+                        break;
                for (i = 0; i < p->fmt.pix_mp.num_planes; i++)
-                        CLEAR_AFTER_FIELD(p, fmt.pix_mp.plane_fmt[i].bytesperline);
+                        CLEAR_AFTER_FIELD(&p->fmt.pix_mp.plane_fmt[i],
+                                          bytesperline);
                return ops->vidioc_try_fmt_vid_out_mplane(file, fh, arg);
        case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
                if (unlikely(!ops->vidioc_try_fmt_vid_out_overlay))
diff --git a/drivers/misc/mic/vop/vop_main.c b/drivers/misc/mic/vop/vop_main.c
index 6b212c8b78e7..2bfa3a903bf9 100644
--- a/drivers/misc/mic/vop/vop_main.c
+++ b/drivers/misc/mic/vop/vop_main.c
@@ -394,16 +394,21 @@ static int vop_find_vqs(struct virtio_device *dev, unsigned nvqs,
        struct _vop_vdev *vdev = to_vopvdev(dev);
        struct vop_device *vpdev = vdev->vpdev;
        struct mic_device_ctrl __iomem *dc = vdev->dc;
-        int i, err, retry;
+        int i, err, retry, queue_idx = 0;
        /* We must have this many virtqueues. */
        if (nvqs > ioread8(&vdev->desc->num_vq))
                return -ENOENT;
        for (i = 0; i < nvqs; ++i) {
+                if (!names[i]) {
+                        vqs[i] = NULL;
+                        continue;
+                }
                dev_dbg(_vop_dev(vdev), "%s: %d: %s\n",
                        __func__, i, names[i]);
-                vqs[i] = vop_find_vq(dev, i, callbacks[i], names[i],
+                vqs[i] = vop_find_vq(dev, queue_idx++, callbacks[i], names[i],
                                     ctx ? ctx[i] : false);
                if (IS_ERR(vqs[i])) {
                        err = PTR_ERR(vqs[i]);
diff --git a/drivers/mtd/nand/raw/denali.c b/drivers/mtd/nand/raw/denali.c
index eebac35304c6..6e8edc9375dd 100644
--- a/drivers/mtd/nand/raw/denali.c
+++ b/drivers/mtd/nand/raw/denali.c
@@ -1322,7 +1322,7 @@ int denali_init(struct denali_nand_info *denali)
        }
        /* clk rate info is needed for setup_data_interface */
-        if (denali->clk_rate && denali->clk_x_rate)
+        if (!denali->clk_rate || !denali->clk_x_rate)
                chip->options |= NAND_KEEP_TIMINGS;
        chip->legacy.dummy_controller.ops = &denali_controller_ops;
diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c
index 325b4414dccc..c9149a37f8f0 100644
--- a/drivers/mtd/nand/raw/fsmc_nand.c
+++ b/drivers/mtd/nand/raw/fsmc_nand.c
@@ -593,23 +593,6 @@ static void fsmc_write_buf_dma(struct fsmc_nand_data *host, const u8 *buf,
        dma_xfer(host, (void *)buf, len, DMA_TO_DEVICE);
 }
-/* fsmc_select_chip - assert or deassert nCE */
-static void fsmc_ce_ctrl(struct fsmc_nand_data *host, bool assert)
-{
-        u32 pc = readl(host->regs_va + FSMC_PC);
-        if (!assert)
-                writel_relaxed(pc & ~FSMC_ENABLE, host->regs_va + FSMC_PC);
-        else
-                writel_relaxed(pc | FSMC_ENABLE, host->regs_va + FSMC_PC);
-        /*
-         * nCE line changes must be applied before returning from this
-         * function.
-         */
-        mb();
-}
 /*
 * fsmc_exec_op - hook called by the core to execute NAND operations
 *
@@ -627,8 +610,6 @@ static int fsmc_exec_op(struct nand_chip *chip, const struct nand_operation *op,
        pr_debug("Executing operation [%d instructions]:\n", op->ninstrs);
-        fsmc_ce_ctrl(host, true);
        for (op_id = 0; op_id < op->ninstrs; op_id++) {
                instr = &op->instrs[op_id];
@@ -686,8 +667,6 @@ static int fsmc_exec_op(struct nand_chip *chip, const struct nand_operation *op,
                }
        }
-        fsmc_ce_ctrl(host, false);
        return ret;
 }
diff --git a/drivers/mtd/nand/raw/jz4740_nand.c b/drivers/mtd/nand/raw/jz4740_nand.c
index f92ae5aa2a54..9526d5b23c80 100644
--- a/drivers/mtd/nand/raw/jz4740_nand.c
+++ b/drivers/mtd/nand/raw/jz4740_nand.c
@@ -260,7 +260,7 @@ static int jz_nand_correct_ecc_rs(struct nand_chip *chip, uint8_t *dat,
 }
 static int jz_nand_ioremap_resource(struct platform_device *pdev,
-        const char *name, struct resource **res, void *__iomem *base)
+        const char *name, struct resource **res, void __iomem **base)
 {
        int ret;
diff --git a/drivers/nvdimm/nd-core.h b/drivers/nvdimm/nd-core.h
index 2b2cf4e554d3..e5ffd5733540 100644
--- a/drivers/nvdimm/nd-core.h
+++ b/drivers/nvdimm/nd-core.h
@@ -54,12 +54,12 @@ struct nvdimm {
 };
 static inline enum nvdimm_security_state nvdimm_security_state(
-                struct nvdimm *nvdimm, bool master)
+                struct nvdimm *nvdimm, enum nvdimm_passphrase_type ptype)
 {
        if (!nvdimm->sec.ops)
                return -ENXIO;
-        return nvdimm->sec.ops->state(nvdimm, master);
+        return nvdimm->sec.ops->state(nvdimm, ptype);
 }
 int nvdimm_security_freeze(struct nvdimm *nvdimm);
 #if IS_ENABLED(CONFIG_NVDIMM_KEYS)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index deb1a66bf117..9bc585415d9b 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2041,14 +2041,18 @@ static int nvme_setup_host_mem(struct nvme_dev *dev)
        return ret;
 }
+/* irq_queues covers admin queue */
 static void nvme_calc_io_queues(struct nvme_dev *dev, unsigned int irq_queues)
 {
        unsigned int this_w_queues = write_queues;
+        WARN_ON(!irq_queues);
        /*
-         * Setup read/write queue split
+         * Setup read/write queue split, assign admin queue one independent
+         * irq vector if irq_queues is > 1.
         */
-        if (irq_queues == 1) {
+        if (irq_queues <= 2) {
                dev->io_queues[HCTX_TYPE_DEFAULT] = 1;
                dev->io_queues[HCTX_TYPE_READ] = 0;
                return;
@@ -2056,21 +2060,21 @@ static void nvme_calc_io_queues(struct nvme_dev *dev, unsigned int irq_queues)
        /*
         * If 'write_queues' is set, ensure it leaves room for at least
-         * one read queue
+         * one read queue and one admin queue
         */
        if (this_w_queues >= irq_queues)
-                this_w_queues = irq_queues - 1;
+                this_w_queues = irq_queues - 2;
        /*
         * If 'write_queues' is set to zero, reads and writes will share
         * a queue set.
         */
        if (!this_w_queues) {
-                dev->io_queues[HCTX_TYPE_DEFAULT] = irq_queues;
+                dev->io_queues[HCTX_TYPE_DEFAULT] = irq_queues - 1;
                dev->io_queues[HCTX_TYPE_READ] = 0;
        } else {
                dev->io_queues[HCTX_TYPE_DEFAULT] = this_w_queues;
-                dev->io_queues[HCTX_TYPE_READ] = irq_queues - this_w_queues;
+                dev->io_queues[HCTX_TYPE_READ] = irq_queues - this_w_queues - 1;
        }
 }
@@ -2095,7 +2099,7 @@ static int nvme_setup_irqs(struct nvme_dev *dev, unsigned int nr_io_queues)
                this_p_queues = nr_io_queues - 1;
                irq_queues = 1;
        } else {
-                irq_queues = nr_io_queues - this_p_queues;
+                irq_queues = nr_io_queues - this_p_queues + 1;
        }
        dev->io_queues[HCTX_TYPE_POLL] = this_p_queues;
@@ -2115,8 +2119,9 @@ static int nvme_setup_irqs(struct nvme_dev *dev, unsigned int nr_io_queues)
                 * If we got a failure and we're down to asking for just
                 * 1 + 1 queues, just ask for a single vector. We'll share
                 * that between the single IO queue and the admin queue.
+                 * Otherwise, we assign one independent vector to admin queue.
                 */
-                if (result >= 0 && irq_queues > 1)
+                if (irq_queues > 1)
                        irq_queues = irq_sets[0] + irq_sets[1] + 1;
                result = pci_alloc_irq_vectors_affinity(pdev, irq_queues,
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 44b37b202e39..ad0df786fe93 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -1089,7 +1089,7 @@ out:
 static int nvmet_tcp_try_recv_one(struct nvmet_tcp_queue *queue)
 {
-        int result;
+        int result = 0;
        if (unlikely(queue->rcv_state == NVMET_TCP_RECV_ERR))
                return 0;
diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index a09c1c3cf831..49b16f76d78e 100644
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -207,11 +207,8 @@ static void __of_attach_node(struct device_node *np)
        if (!of_node_check_flag(np, OF_OVERLAY)) {
                np->name = __of_get_property(np, "name", NULL);
-                np->type = __of_get_property(np, "device_type", NULL);
                if (!np->name)
                        np->name = "<NULL>";
-                if (!np->type)
-                        np->type = "<NULL>";
                phandle = __of_get_property(np, "phandle", &sz);
                if (!phandle)
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 7099c652c6a5..9cc1461aac7d 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -314,12 +314,8 @@ static bool populate_node(const void *blob,
        populate_properties(blob, offset, mem, np, pathp, dryrun);
        if (!dryrun) {
                np->name = of_get_property(np, "name", NULL);
-                np->type = of_get_property(np, "device_type", NULL);
                if (!np->name)
                        np->name = "<NULL>";
-                if (!np->type)
-                        np->type = "<NULL>";
        }
        *pnp = np;
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 2b5ac43a5690..c423e94baf0f 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -423,12 +423,9 @@ static int add_changeset_node(struct overlay_changeset *ovcs,
                tchild->parent = target->np;
                tchild->name = __of_get_property(node, "name", NULL);
-                tchild->type = __of_get_property(node, "device_type", NULL);
                if (!tchild->name)
                        tchild->name = "<NULL>";
-                if (!tchild->type)
-                        tchild->type = "<NULL>";
                /* ignore obsolete "linux,phandle" */
                phandle = __of_get_property(node, "phandle", &size);
diff --git a/drivers/of/pdt.c b/drivers/of/pdt.c
index d3185063d369..7eda43c66c91 100644
--- a/drivers/of/pdt.c
+++ b/drivers/of/pdt.c
@@ -155,7 +155,6 @@ static struct device_node * __init of_pdt_create_node(phandle node,
        dp->parent = parent;
        dp->name = of_pdt_get_one_property(node, "name");
-        dp->type = of_pdt_get_one_property(node, "device_type");
        dp->phandle = node;
        dp->properties = of_pdt_build_prop_list(node);
diff --git a/drivers/of/property.c b/drivers/of/property.c
index 08430031bd28..8631efa1daa1 100644
--- a/drivers/of/property.c
+++ b/drivers/of/property.c
@@ -806,6 +806,7 @@ struct device_node *of_graph_get_remote_node(const struct device_node *node,
        if (!of_device_is_available(remote)) {
                pr_debug("not available for remote node\n");
+                of_node_put(remote);
                return NULL;
        }
diff --git a/drivers/pci/Kconfig b/drivers/pci/Kconfig
index 4310c7a4212e..2ab92409210a 100644
--- a/drivers/pci/Kconfig
+++ b/drivers/pci/Kconfig
@@ -21,13 +21,14 @@ menuconfig PCI
          support for PCI-X and the foundations for PCI Express support.
          Say 'Y' here unless you know what you are doing.
+if PCI
 config PCI_DOMAINS
        bool
        depends on PCI
 config PCI_DOMAINS_GENERIC
        bool
-        depends on PCI
        select PCI_DOMAINS
 config PCI_SYSCALL
@@ -37,7 +38,6 @@ source "drivers/pci/pcie/Kconfig"
 config PCI_MSI
        bool "Message Signaled Interrupts (MSI and MSI-X)"
-        depends on PCI
        select GENERIC_MSI_IRQ
        help
           This allows device drivers to enable MSI (Message Signaled
@@ -59,7 +59,6 @@ config PCI_MSI_IRQ_DOMAIN
 config PCI_QUIRKS
        default y
        bool "Enable PCI quirk workarounds" if EXPERT
-        depends on PCI
        help
          This enables workarounds for various PCI chipset bugs/quirks.
          Disable this only if your target machine is unaffected by PCI
@@ -67,7 +66,7 @@ config PCI_QUIRKS
 config PCI_DEBUG
        bool "PCI Debugging"
-        depends on PCI && DEBUG_KERNEL
+        depends on DEBUG_KERNEL
        help
          Say Y here if you want the PCI core to produce a bunch of debug
          messages to the system log.  Select this if you are having a
@@ -77,7 +76,6 @@ config PCI_DEBUG
 config PCI_REALLOC_ENABLE_AUTO
        bool "Enable PCI resource re-allocation detection"
-        depends on PCI
        depends on PCI_IOV
        help
          Say Y here if you want the PCI core to detect if PCI resource
@@ -90,7 +88,6 @@ config PCI_REALLOC_ENABLE_AUTO
 config PCI_STUB
        tristate "PCI Stub driver"
-        depends on PCI
        help
          Say Y or M here if you want be able to reserve a PCI device
          when it is going to be assigned to a guest operating system.
@@ -99,7 +96,6 @@ config PCI_STUB
 config PCI_PF_STUB
        tristate "PCI PF Stub driver"
-        depends on PCI
        depends on PCI_IOV
        help
          Say Y or M here if you want to enable support for devices that
@@ -111,7 +107,7 @@ config PCI_PF_STUB
 config XEN_PCIDEV_FRONTEND
        tristate "Xen PCI Frontend"
-        depends on PCI && X86 && XEN
+        depends on X86 && XEN
        select PCI_XEN
        select XEN_XENBUS_FRONTEND
        default y
@@ -133,7 +129,6 @@ config PCI_BRIDGE_EMUL
 config PCI_IOV
        bool "PCI IOV support"
-        depends on PCI
        select PCI_ATS
        help
          I/O Virtualization is a PCI feature supported by some devices
@@ -144,7 +139,6 @@ config PCI_IOV
 config PCI_PRI
        bool "PCI PRI support"
-        depends on PCI
        select PCI_ATS
        help
          PRI is the PCI Page Request Interface. It allows PCI devices that are
@@ -154,7 +148,6 @@ config PCI_PRI
 config PCI_PASID
        bool "PCI PASID support"
-        depends on PCI
        select PCI_ATS
        help
          Process Address Space Identifiers (PASIDs) can be used by PCI devices
@@ -167,7 +160,7 @@ config PCI_PASID
 config PCI_P2PDMA
        bool "PCI peer-to-peer transfer support"
-        depends on PCI && ZONE_DEVICE
+        depends on ZONE_DEVICE
        select GENERIC_ALLOCATOR
        help
          Enableѕ drivers to do PCI peer-to-peer transactions to and from
@@ -184,12 +177,11 @@ config PCI_P2PDMA
 config PCI_LABEL
        def_bool y if (DMI || ACPI)
-        depends on PCI
        select NLS
 config PCI_HYPERV
        tristate "Hyper-V PCI Frontend"
-        depends on PCI && X86 && HYPERV && PCI_MSI && PCI_MSI_IRQ_DOMAIN && X86_64
+        depends on X86 && HYPERV && PCI_MSI && PCI_MSI_IRQ_DOMAIN && X86_64
        help
          The PCI device frontend driver allows the kernel to import arbitrary
          PCI devices from a PCI backend to support PCI driver domains.
@@ -198,3 +190,5 @@ source "drivers/pci/hotplug/Kconfig"
 source "drivers/pci/controller/Kconfig"
 source "drivers/pci/endpoint/Kconfig"
 source "drivers/pci/switch/Kconfig"
+endif
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 7a1c8a09efa5..4c0b47867258 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -1168,7 +1168,8 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
                                   const struct irq_affinity *affd)
 {
        static const struct irq_affinity msi_default_affd;
-        int vecs = -ENOSPC;
+        int msix_vecs = -ENOSPC;
+        int msi_vecs = -ENOSPC;
        if (flags & PCI_IRQ_AFFINITY) {
                if (!affd)
@@ -1179,16 +1180,17 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
        }
        if (flags & PCI_IRQ_MSIX) {
-                vecs = __pci_enable_msix_range(dev, NULL, min_vecs, max_vecs,
+                msix_vecs = __pci_enable_msix_range(dev, NULL, min_vecs,
-                                affd);
+                                                    max_vecs, affd);
-                if (vecs > 0)
+                if (msix_vecs > 0)
-                        return vecs;
+                        return msix_vecs;
        }
        if (flags & PCI_IRQ_MSI) {
-                vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, affd);
+                msi_vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs,
-                if (vecs > 0)
+                                                  affd);
-                        return vecs;
+                if (msi_vecs > 0)
+                        return msi_vecs;
        }
        /* use legacy irq if allowed */
@@ -1199,7 +1201,9 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
                }
        }
-        return vecs;
+        if (msix_vecs == -ENOSPC)
+                return -ENOSPC;
+        return msi_vecs;
 }
 EXPORT_SYMBOL(pci_alloc_irq_vectors_affinity);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index c9d8e3c837de..c25acace7d91 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -6195,7 +6195,8 @@ static int __init pci_setup(char *str)
                        } else if (!strncmp(str, "pcie_scan_all", 13)) {
                                pci_add_flags(PCI_SCAN_ALL_PCIE_DEVS);
                        } else if (!strncmp(str, "disable_acs_redir=", 18)) {
-                                disable_acs_redir_param = str + 18;
+                                disable_acs_redir_param =
+                                        kstrdup(str + 18, GFP_KERNEL);
                        } else {
                                printk(KERN_ERR "PCI: Unknown option `%s'\n",
                                                str);
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index e3b62c2ee8d1..5e2109c54c7c 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -1009,7 +1009,7 @@ config INTEL_MFLD_THERMAL
 config INTEL_IPS
        tristate "Intel Intelligent Power Sharing"
-        depends on ACPI
+        depends on ACPI && PCI
        ---help---
          Intel Calpella platforms support dynamic power sharing between the
          CPU and GPU, maximizing performance in a given TDP.  This driver,
@@ -1135,7 +1135,7 @@ config SAMSUNG_Q10
 config APPLE_GMUX
        tristate "Apple Gmux Driver"
-        depends on ACPI
+        depends on ACPI && PCI
        depends on PNP
        depends on BACKLIGHT_CLASS_DEVICE
        depends on BACKLIGHT_APPLE=n || BACKLIGHT_APPLE
@@ -1174,7 +1174,7 @@ config INTEL_SMARTCONNECT
 config INTEL_PMC_IPC
        tristate "Intel PMC IPC Driver"
-        depends on ACPI
+        depends on ACPI && PCI
        ---help---
        This driver provides support for PMC control on some Intel platforms.
        The PMC is an ARC processor which defines IPC commands for communication
diff --git a/drivers/remoteproc/remoteproc_virtio.c b/drivers/remoteproc/remoteproc_virtio.c
index 183fc42a510a..2d7cd344f3bf 100644
--- a/drivers/remoteproc/remoteproc_virtio.c
+++ b/drivers/remoteproc/remoteproc_virtio.c
@@ -153,10 +153,15 @@ static int rproc_virtio_find_vqs(struct virtio_device *vdev, unsigned int nvqs,
                                 const bool * ctx,
                                 struct irq_affinity *desc)
 {
-        int i, ret;
+        int i, ret, queue_idx = 0;
        for (i = 0; i < nvqs; ++i) {
-                vqs[i] = rp_find_vq(vdev, i, callbacks[i], names[i],
+                if (!names[i]) {
+                        vqs[i] = NULL;
+                        continue;
+                }
+                vqs[i] = rp_find_vq(vdev, queue_idx++, callbacks[i], names[i],
                                    ctx ? ctx[i] : false);
                if (IS_ERR(vqs[i])) {
                        ret = PTR_ERR(vqs[i]);
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index fc9dbad476c0..ae1d56da671d 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -635,7 +635,7 @@ static int virtio_ccw_find_vqs(struct virtio_device *vdev, unsigned nvqs,
 {
        struct virtio_ccw_device *vcdev = to_vc_device(vdev);
        unsigned long *indicatorp = NULL;
-        int ret, i;
+        int ret, i, queue_idx = 0;
        struct ccw1 *ccw;
        ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
@@ -643,8 +643,14 @@ static int virtio_ccw_find_vqs(struct virtio_device *vdev, unsigned nvqs,
                return -ENOMEM;
        for (i = 0; i < nvqs; ++i) {
-                vqs[i] = virtio_ccw_setup_vq(vdev, i, callbacks[i], names[i],
+                if (!names[i]) {
-                                             ctx ? ctx[i] : false, ccw);
+                        vqs[i] = NULL;
+                        continue;
+                }
+                vqs[i] = virtio_ccw_setup_vq(vdev, queue_idx++, callbacks[i],
+                                             names[i], ctx ? ctx[i] : false,
+                                             ccw);
                if (IS_ERR(vqs[i])) {
                        ret = PTR_ERR(vqs[i]);
                        vqs[i] = NULL;
diff --git a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
index 8a20411699d9..75e1273a44b3 100644
--- a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
+++ b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
@@ -1144,7 +1144,7 @@ static void ddp_clear_map(struct cxgbi_device *cdev, struct cxgbi_ppm *ppm,
 }
 static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
-                                       unsigned int tid, int pg_idx, bool reply)
+                                unsigned int tid, int pg_idx)
 {
        struct sk_buff *skb = alloc_wr(sizeof(struct cpl_set_tcb_field), 0,
                                        GFP_KERNEL);
@@ -1160,7 +1160,7 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
        req = (struct cpl_set_tcb_field *)skb->head;
        req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
-        req->reply = V_NO_REPLY(reply ? 0 : 1);
+        req->reply = V_NO_REPLY(1);
        req->cpu_idx = 0;
        req->word = htons(31);
        req->mask = cpu_to_be64(0xF0000000);
@@ -1177,11 +1177,10 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
 * @tid: connection id
 * @hcrc: header digest enabled
 * @dcrc: data digest enabled
- * @reply: request reply from h/w
 * set up the iscsi digest settings for a connection identified by tid
 */
 static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
-                             int hcrc, int dcrc, int reply)
+                                 int hcrc, int dcrc)
 {
        struct sk_buff *skb = alloc_wr(sizeof(struct cpl_set_tcb_field), 0,
                                        GFP_KERNEL);
@@ -1197,7 +1196,7 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
        req = (struct cpl_set_tcb_field *)skb->head;
        req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
-        req->reply = V_NO_REPLY(reply ? 0 : 1);
+        req->reply = V_NO_REPLY(1);
        req->cpu_idx = 0;
        req->word = htons(31);
        req->mask = cpu_to_be64(0x0F000000);
diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
index 49f8028ac524..d26f50af00ea 100644
--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
@@ -1548,16 +1548,22 @@ static void do_set_tcb_rpl(struct cxgbi_device *cdev, struct sk_buff *skb)
        struct cxgbi_sock *csk;
        csk = lookup_tid(t, tid);
-        if (!csk)
+        if (!csk) {
                pr_err("can't find conn. for tid %u.\n", tid);
+                return;
+        }
        log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
                "csk 0x%p,%u,%lx,%u, status 0x%x.\n",
                csk, csk->state, csk->flags, csk->tid, rpl->status);
-        if (rpl->status != CPL_ERR_NONE)
+        if (rpl->status != CPL_ERR_NONE) {
                pr_err("csk 0x%p,%u, SET_TCB_RPL status %u.\n",
                        csk, tid, rpl->status);
+                csk->err = -EINVAL;
+        }
+        complete(&csk->cmpl);
        __kfree_skb(skb);
 }
@@ -1983,7 +1989,7 @@ static int ddp_set_map(struct cxgbi_ppm *ppm, struct cxgbi_sock *csk,
 }
 static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
-                                int pg_idx, bool reply)
+                                int pg_idx)
 {
        struct sk_buff *skb;
        struct cpl_set_tcb_field *req;
@@ -1999,7 +2005,7 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
        req = (struct cpl_set_tcb_field *)skb->head;
        INIT_TP_WR(req, csk->tid);
        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, csk->tid));
-        req->reply_ctrl = htons(NO_REPLY_V(reply) | QUEUENO_V(csk->rss_qid));
+        req->reply_ctrl = htons(NO_REPLY_V(0) | QUEUENO_V(csk->rss_qid));
        req->word_cookie = htons(0);
        req->mask = cpu_to_be64(0x3 << 8);
        req->val = cpu_to_be64(pg_idx << 8);
@@ -2008,12 +2014,15 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
        log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
                "csk 0x%p, tid 0x%x, pg_idx %u.\n", csk, csk->tid, pg_idx);
+        reinit_completion(&csk->cmpl);
        cxgb4_ofld_send(csk->cdev->ports[csk->port_id], skb);
-        return 0;
+        wait_for_completion(&csk->cmpl);
+        return csk->err;
 }
 static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
-                                 int hcrc, int dcrc, int reply)
+                                 int hcrc, int dcrc)
 {
        struct sk_buff *skb;
        struct cpl_set_tcb_field *req;
@@ -2031,7 +2040,7 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
        req = (struct cpl_set_tcb_field *)skb->head;
        INIT_TP_WR(req, tid);
        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
-        req->reply_ctrl = htons(NO_REPLY_V(reply) | QUEUENO_V(csk->rss_qid));
+        req->reply_ctrl = htons(NO_REPLY_V(0) | QUEUENO_V(csk->rss_qid));
        req->word_cookie = htons(0);
        req->mask = cpu_to_be64(0x3 << 4);
        req->val = cpu_to_be64(((hcrc ? ULP_CRC_HEADER : 0) |
@@ -2041,8 +2050,11 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
        log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
                "csk 0x%p, tid 0x%x, crc %d,%d.\n", csk, csk->tid, hcrc, dcrc);
+        reinit_completion(&csk->cmpl);
        cxgb4_ofld_send(csk->cdev->ports[csk->port_id], skb);
-        return 0;
+        wait_for_completion(&csk->cmpl);
+        return csk->err;
 }
 static struct cxgbi_ppm *cdev2ppm(struct cxgbi_device *cdev)
diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index 75f876409fb9..245742557c03 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -573,6 +573,7 @@ static struct cxgbi_sock *cxgbi_sock_create(struct cxgbi_device *cdev)
        skb_queue_head_init(&csk->receive_queue);
        skb_queue_head_init(&csk->write_queue);
        timer_setup(&csk->retry_timer, NULL, 0);
+        init_completion(&csk->cmpl);
        rwlock_init(&csk->callback_lock);
        csk->cdev = cdev;
        csk->flags = 0;
@@ -2251,14 +2252,14 @@ int cxgbi_set_conn_param(struct iscsi_cls_conn *cls_conn,
                if (!err && conn->hdrdgst_en)
                        err = csk->cdev->csk_ddp_setup_digest(csk, csk->tid,
                                                        conn->hdrdgst_en,
-                                                        conn->datadgst_en, 0);
+                                                        conn->datadgst_en);
                break;
        case ISCSI_PARAM_DATADGST_EN:
                err = iscsi_set_param(cls_conn, param, buf, buflen);
                if (!err && conn->datadgst_en)
                        err = csk->cdev->csk_ddp_setup_digest(csk, csk->tid,
                                                        conn->hdrdgst_en,
-                                                        conn->datadgst_en, 0);
+                                                        conn->datadgst_en);
                break;
        case ISCSI_PARAM_MAX_R2T:
                return iscsi_tcp_set_max_r2t(conn, buf);
@@ -2384,7 +2385,7 @@ int cxgbi_bind_conn(struct iscsi_cls_session *cls_session,
        ppm = csk->cdev->cdev2ppm(csk->cdev);
        err = csk->cdev->csk_ddp_setup_pgidx(csk, csk->tid,
-                                             ppm->tformat.pgsz_idx_dflt, 0);
+                                             ppm->tformat.pgsz_idx_dflt);
        if (err < 0)
                return err;
diff --git a/drivers/scsi/cxgbi/libcxgbi.h b/drivers/scsi/cxgbi/libcxgbi.h
index 5d5d8b50d842..1917ff57651d 100644
--- a/drivers/scsi/cxgbi/libcxgbi.h
+++ b/drivers/scsi/cxgbi/libcxgbi.h
@@ -149,6 +149,7 @@ struct cxgbi_sock {
        struct sk_buff_head receive_queue;
        struct sk_buff_head write_queue;
        struct timer_list retry_timer;
+        struct completion cmpl;
        int err;
        rwlock_t callback_lock;
        void *user_data;
@@ -490,9 +491,9 @@ struct cxgbi_device {
                                  struct cxgbi_ppm *,
                                  struct cxgbi_task_tag_info *);
        int (*csk_ddp_setup_digest)(struct cxgbi_sock *,
-                                unsigned int, int, int, int);
+                                    unsigned int, int, int);
        int (*csk_ddp_setup_pgidx)(struct cxgbi_sock *,
-                                unsigned int, int, bool);
+                                   unsigned int, int);
        void (*csk_release_offload_resources)(struct cxgbi_sock *);
        int (*csk_rx_pdu_ready)(struct cxgbi_sock *, struct sk_buff *);
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index e2420a810e99..c92b3822c408 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -2507,6 +2507,12 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                sha->sas_port[i] = &hisi_hba->port[i].sas_port;
        }
+        if (hisi_hba->prot_mask) {
+                dev_info(dev, "Registering for DIF/DIX prot_mask=0x%x\n",
+                         prot_mask);
+                scsi_host_set_prot(hisi_hba->shost, prot_mask);
+        }
        rc = scsi_add_host(shost, dev);
        if (rc)
                goto err_out_ha;
@@ -2519,12 +2525,6 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        if (rc)
                goto err_out_register_ha;
-        if (hisi_hba->prot_mask) {
-                dev_info(dev, "Registering for DIF/DIX prot_mask=0x%x\n",
-                         prot_mask);
-                scsi_host_set_prot(hisi_hba->shost, prot_mask);
-        }
        scsi_scan_host(shost);
        return 0;
diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
index 68b90c4f79a3..1727d0c71b12 100644
--- a/drivers/scsi/isci/init.c
+++ b/drivers/scsi/isci/init.c
@@ -576,6 +576,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id)
        shost->max_lun = ~0;
        shost->max_cmd_len = MAX_COMMAND_SIZE;
+        /* turn on DIF support */
+        scsi_host_set_prot(shost,
+                           SHOST_DIF_TYPE1_PROTECTION |
+                           SHOST_DIF_TYPE2_PROTECTION |
+                           SHOST_DIF_TYPE3_PROTECTION);
+        scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC);
        err = scsi_add_host(shost, &pdev->dev);
        if (err)
                goto err_shost;
@@ -663,13 +670,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                        goto err_host_alloc;
                }
                pci_info->hosts[i] = h;
-                /* turn on DIF support */
-                scsi_host_set_prot(to_shost(h),
-                                   SHOST_DIF_TYPE1_PROTECTION |
-                                   SHOST_DIF_TYPE2_PROTECTION |
-                                   SHOST_DIF_TYPE3_PROTECTION);
-                scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC);
        }
        err = isci_setup_interrupts(pdev);
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 12fd74761ae0..2242e9b3ca12 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -9407,6 +9407,7 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
                cmnd = CMD_XMIT_SEQUENCE64_CR;
                if (phba->link_flag & LS_LOOPBACK_MODE)
                        bf_set(wqe_xo, &wqe->xmit_sequence.wge_ctl, 1);
+                /* fall through */
        case CMD_XMIT_SEQUENCE64_CR:
                /* word3 iocb=io_tag32 wqe=reserved */
                wqe->xmit_sequence.rsvd3 = 0;
@@ -13528,6 +13529,7 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
        case FC_STATUS_RQ_BUF_LEN_EXCEEDED:
                lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                "2537 Receive Frame Truncated!!\n");
+                /* fall through */
        case FC_STATUS_RQ_SUCCESS:
                spin_lock_irqsave(&phba->hbalock, iflags);
                lpfc_sli4_rq_release(hrq, drq);
@@ -13937,7 +13939,7 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
        case FC_STATUS_RQ_BUF_LEN_EXCEEDED:
                lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                "6126 Receive Frame Truncated!!\n");
-                /* Drop thru */
+                /* fall through */
        case FC_STATUS_RQ_SUCCESS:
                spin_lock_irqsave(&phba->hbalock, iflags);
                lpfc_sli4_rq_release(hrq, drq);
@@ -14849,7 +14851,7 @@ lpfc_eq_create(struct lpfc_hba *phba, struct lpfc_queue *eq, uint32_t imax)
                                eq->entry_count);
                if (eq->entry_count < 256)
                        return -EINVAL;
-                /* otherwise default to smallest count (drop through) */
+                /* fall through - otherwise default to smallest count */
        case 256:
                bf_set(lpfc_eq_context_count, &eq_create->u.request.context,
                       LPFC_EQ_CNT_256);
@@ -14980,7 +14982,7 @@ lpfc_cq_create(struct lpfc_hba *phba, struct lpfc_queue *cq,
                               LPFC_CQ_CNT_WORD7);
                        break;
                }
-                /* Fall Thru */
+                /* fall through */
        default:
                lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                "0361 Unsupported CQ count: "
@@ -14991,7 +14993,7 @@ lpfc_cq_create(struct lpfc_hba *phba, struct lpfc_queue *cq,
                        status = -EINVAL;
                        goto out;
                }
-                /* otherwise default to smallest count (drop through) */
+                /* fall through - otherwise default to smallest count */
        case 256:
                bf_set(lpfc_cq_context_count, &cq_create->u.request.context,
                       LPFC_CQ_CNT_256);
@@ -15151,7 +15153,7 @@ lpfc_cq_create_set(struct lpfc_hba *phba, struct lpfc_queue **cqp,
                                               LPFC_CQ_CNT_WORD7);
                                        break;
                                }
-                                /* Fall Thru */
+                                /* fall through */
                        default:
                                lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                                "3118 Bad CQ count. (%d)\n",
@@ -15160,7 +15162,7 @@ lpfc_cq_create_set(struct lpfc_hba *phba, struct lpfc_queue **cqp,
                                        status = -EINVAL;
                                        goto out;
                                }
-                                /* otherwise default to smallest (drop thru) */
+                                /* fall through - otherwise default to smallest */
                        case 256:
                                bf_set(lpfc_mbx_cq_create_set_cqe_cnt,
                                       &cq_set->u.request, LPFC_CQ_CNT_256);
@@ -15432,7 +15434,7 @@ lpfc_mq_create(struct lpfc_hba *phba, struct lpfc_queue *mq,
                        status = -EINVAL;
                        goto out;
                }
-                /* otherwise default to smallest count (drop through) */
+                /* fall through - otherwise default to smallest count */
        case 16:
                bf_set(lpfc_mq_context_ring_size,
                       &mq_create_ext->u.request.context,
@@ -15851,7 +15853,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
                                status = -EINVAL;
                                goto out;
                        }
-                        /* otherwise default to smallest count (drop through) */
+                        /* fall through - otherwise default to smallest count */
                case 512:
                        bf_set(lpfc_rq_context_rqe_count,
                               &rq_create->u.request.context,
@@ -15988,7 +15990,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
                                status = -EINVAL;
                                goto out;
                        }
-                        /* otherwise default to smallest count (drop through) */
+                        /* fall through - otherwise default to smallest count */
                case 512:
                        bf_set(lpfc_rq_context_rqe_count,
                               &rq_create->u.request.context,
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 7eaa400f6328..fcbff83c0097 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -6236,7 +6236,7 @@ megasas_set_dma_mask(struct megasas_instance *instance)
                instance->consistent_mask_64bit = true;
        dev_info(&pdev->dev, "%s bit DMA mask and %s bit consistent mask\n",
-                 ((*pdev->dev.dma_mask == DMA_BIT_MASK(64)) ? "63" : "32"),
+                 ((*pdev->dev.dma_mask == DMA_BIT_MASK(63)) ? "63" : "32"),
                 (instance->consistent_mask_64bit ? "63" : "32"));
        return 0;
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index a9a25f0eaf6f..647f48a28f85 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -175,7 +175,8 @@ megasas_clear_intr_fusion(struct megasas_instance *instance)
        /*
         * Check if it is our interrupt
         */
-        status = readl(&regs->outbound_intr_status);
+        status = megasas_readl(instance,
+                               &regs->outbound_intr_status);
        if (status & 1) {
                writel(status, &regs->outbound_intr_status);
diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index 4c5a3d23e010..084f2fcced0a 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -657,7 +657,7 @@ static int pm8001_dev_found_notify(struct domain_device *dev)
                if (dev->dev_type == SAS_SATA_DEV) {
                        pm8001_device->attached_phy =
                                dev->rphy->identify.phy_identifier;
-                                flag = 1; /* directly sata*/
+                        flag = 1; /* directly sata */
                }
        } /*register this device to HBA*/
        PM8001_DISC_DBG(pm8001_ha, pm8001_printk("Found device\n"));
diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
index 4da660c1c431..6d6d6013e35b 100644
--- a/drivers/scsi/qedi/qedi_iscsi.c
+++ b/drivers/scsi/qedi/qedi_iscsi.c
@@ -953,6 +953,7 @@ static int qedi_ep_poll(struct iscsi_endpoint *ep, int timeout_ms)
        qedi_ep = ep->dd_data;
        if (qedi_ep->state == EP_STATE_IDLE ||
+            qedi_ep->state == EP_STATE_OFLDCONN_NONE ||
            qedi_ep->state == EP_STATE_OFLDCONN_FAILED)
                return -1;
@@ -1035,6 +1036,7 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
        switch (qedi_ep->state) {
        case EP_STATE_OFLDCONN_START:
+        case EP_STATE_OFLDCONN_NONE:
                goto ep_release_conn;
        case EP_STATE_OFLDCONN_FAILED:
                        break;
@@ -1225,6 +1227,7 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data)
        if (!is_valid_ether_addr(&path_data->mac_addr[0])) {
                QEDI_NOTICE(&qedi->dbg_ctx, "dst mac NOT VALID\n");
+                qedi_ep->state = EP_STATE_OFLDCONN_NONE;
                ret = -EIO;
                goto set_path_exit;
        }
diff --git a/drivers/scsi/qedi/qedi_iscsi.h b/drivers/scsi/qedi/qedi_iscsi.h
index 11260776212f..892d70d54553 100644
--- a/drivers/scsi/qedi/qedi_iscsi.h
+++ b/drivers/scsi/qedi/qedi_iscsi.h
@@ -59,6 +59,7 @@ enum {
        EP_STATE_OFLDCONN_FAILED        = 0x2000,
        EP_STATE_CONNECT_FAILED         = 0x4000,
        EP_STATE_DISCONN_TIMEDOUT       = 0x8000,
+        EP_STATE_OFLDCONN_NONE          = 0x10000,
 };
 struct qedi_conn;
diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c
index a414f51302b7..6856dfdfa473 100644
--- a/drivers/scsi/qla1280.c
+++ b/drivers/scsi/qla1280.c
@@ -4248,7 +4248,7 @@ qla1280_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
        ha->devnum = devnum;    /* specifies microcode load address */
 #ifdef QLA_64BIT_PTR
-        if (dma_set_mask(&ha->pdev->dev, DMA_BIT_MASK(64))) {
+        if (dma_set_mask_and_coherent(&ha->pdev->dev, DMA_BIT_MASK(64))) {
                if (dma_set_mask(&ha->pdev->dev, DMA_BIT_MASK(32))) {
                        printk(KERN_WARNING "scsi(%li): Unable to set a "
                               "suitable DMA mask - aborting\n", ha->host_no);
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 26b93c563f92..d1fc4958222a 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -4394,6 +4394,8 @@ typedef struct scsi_qla_host {
        uint16_t        n2n_id;
        struct list_head gpnid_list;
        struct fab_scan scan;
+        unsigned int irq_offset;
 } scsi_qla_host_t;
 struct qla27xx_image_status {
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 30d3090842f8..8507c43b918c 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3446,6 +3446,7 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
                            "Adjusted Max no of queues pairs: %d.\n", ha->max_qpairs);
                }
        }
+        vha->irq_offset = desc.pre_vectors;
        ha->msix_entries = kcalloc(ha->msix_count,
                                   sizeof(struct qla_msix_entry),
                                   GFP_KERNEL);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index ea69dafc9774..c6ef83d0d99b 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -6939,7 +6939,7 @@ static int qla2xxx_map_queues(struct Scsi_Host *shost)
        if (USER_CTRL_IRQ(vha->hw))
                rc = blk_mq_map_queues(qmap);
        else
-                rc = blk_mq_pci_map_queues(qmap, vha->hw->pdev, 0);
+                rc = blk_mq_pci_map_queues(qmap, vha->hw->pdev, vha->irq_offset);
        return rc;
 }
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index cfdfcda28072..a77bfb224248 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -7232,6 +7232,8 @@ static int qla4xxx_sysfs_ddb_tgt_create(struct scsi_qla_host *ha,
        rc = qla4xxx_copy_from_fwddb_param(fnode_sess, fnode_conn,
                                           fw_ddb_entry);
+        if (rc)
+                goto free_sess;
        ql4_printk(KERN_INFO, ha, "%s: sysfs entry %s created\n",
                   __func__, fnode_sess->dev.kobj.name);
diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c
index a2b4179bfdf7..7639df91b110 100644
--- a/drivers/scsi/scsi_pm.c
+++ b/drivers/scsi/scsi_pm.c
@@ -80,8 +80,22 @@ static int scsi_dev_type_resume(struct device *dev,
        if (err == 0) {
                pm_runtime_disable(dev);
-                pm_runtime_set_active(dev);
+                err = pm_runtime_set_active(dev);
                pm_runtime_enable(dev);
+                /*
+                 * Forcibly set runtime PM status of request queue to "active"
+                 * to make sure we can again get requests from the queue
+                 * (see also blk_pm_peek_request()).
+                 *
+                 * The resume hook will correct runtime PM status of the disk.
+                 */
+                if (!err && scsi_is_sdev_device(dev)) {
+                        struct scsi_device *sdev = to_scsi_device(dev);
+                        if (sdev->request_queue->dev)
+                                blk_set_runtime_active(sdev->request_queue);
+                }
        }
        return err;
@@ -140,16 +154,6 @@ static int scsi_bus_resume_common(struct device *dev,
        else
                fn = NULL;
-        /*
-         * Forcibly set runtime PM status of request queue to "active" to
-         * make sure we can again get requests from the queue (see also
-         * blk_pm_peek_request()).
-         *
-         * The resume hook will correct runtime PM status of the disk.
-         */
-        if (scsi_is_sdev_device(dev) && pm_runtime_suspended(dev))
-                blk_set_runtime_active(to_scsi_device(dev)->request_queue);
        if (fn) {
                async_schedule_domain(fn, dev, &scsi_sd_pm_domain);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index a1a44f52e0e8..b2da8a00ec33 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -206,6 +206,12 @@ cache_type_store(struct device *dev, struct device_attribute *attr,
        sp = buffer_data[0] & 0x80 ? 1 : 0;
        buffer_data[0] &= ~0x80;
+        /*
+         * Ensure WP, DPOFUA, and RESERVED fields are cleared in
+         * received mode parameter buffer before doing MODE SELECT.
+         */
+        data.device_specific = 0;
        if (scsi_mode_select(sdp, 1, sp, 8, buffer_data, len, SD_TIMEOUT,
                             SD_MAX_RETRIES, &data, &sshdr)) {
                if (scsi_sense_valid(&sshdr))
diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 7bde6c809442..f564af8949e8 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -323,7 +323,7 @@ static inline void pqi_device_remove_start(struct pqi_scsi_dev *device)
 static inline bool pqi_device_in_remove(struct pqi_ctrl_info *ctrl_info,
                                        struct pqi_scsi_dev *device)
 {
-        return device->in_remove & !ctrl_info->in_shutdown;
+        return device->in_remove && !ctrl_info->in_shutdown;
 }
 static inline void pqi_schedule_rescan_worker_with_delay(
diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h
index dd65fea07687..6d176815e6ce 100644
--- a/drivers/scsi/ufs/ufs.h
+++ b/drivers/scsi/ufs/ufs.h
@@ -195,7 +195,7 @@ enum ufs_desc_def_size {
        QUERY_DESC_CONFIGURATION_DEF_SIZE       = 0x90,
        QUERY_DESC_UNIT_DEF_SIZE                = 0x23,
        QUERY_DESC_INTERCONNECT_DEF_SIZE        = 0x06,
-        QUERY_DESC_GEOMETRY_DEF_SIZE            = 0x44,
+        QUERY_DESC_GEOMETRY_DEF_SIZE            = 0x48,
        QUERY_DESC_POWER_DEF_SIZE               = 0x62,
        QUERY_DESC_HEALTH_DEF_SIZE              = 0x25,
 };
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 9ba7671b84f8..71334aaf1447 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -8001,6 +8001,8 @@ out:
        trace_ufshcd_system_resume(dev_name(hba->dev), ret,
                ktime_to_us(ktime_sub(ktime_get(), start)),
                hba->curr_dev_pwr_mode, hba->uic_link_state);
+        if (!ret)
+                hba->is_sys_suspended = false;
        return ret;
 }
 EXPORT_SYMBOL(ufshcd_system_resume);
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 984941e036c8..bd15a564fe24 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -714,7 +714,7 @@ static int __init iscsi_target_init_module(void)
                        sizeof(struct iscsi_queue_req),
                        __alignof__(struct iscsi_queue_req), 0, NULL);
        if (!lio_qr_cache) {
-                pr_err("nable to kmem_cache_create() for"
+                pr_err("Unable to kmem_cache_create() for"
                                " lio_qr_cache\n");
                goto bitmap_out;
        }
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 1e6d24943565..c34c88ef3319 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -148,7 +148,7 @@ struct tcmu_dev {
        size_t ring_size;
        struct mutex cmdr_lock;
-        struct list_head cmdr_queue;
+        struct list_head qfull_queue;
        uint32_t dbi_max;
        uint32_t dbi_thresh;
@@ -159,6 +159,7 @@ struct tcmu_dev {
        struct timer_list cmd_timer;
        unsigned int cmd_time_out;
+        struct list_head inflight_queue;
        struct timer_list qfull_timer;
        int qfull_time_out;
@@ -179,7 +180,7 @@ struct tcmu_dev {
 struct tcmu_cmd {
        struct se_cmd *se_cmd;
        struct tcmu_dev *tcmu_dev;
-        struct list_head cmdr_queue_entry;
+        struct list_head queue_entry;
        uint16_t cmd_id;
@@ -192,6 +193,7 @@ struct tcmu_cmd {
        unsigned long deadline;
 #define TCMU_CMD_BIT_EXPIRED 0
+#define TCMU_CMD_BIT_INFLIGHT 1
        unsigned long flags;
 };
 /*
@@ -586,7 +588,7 @@ static struct tcmu_cmd *tcmu_alloc_cmd(struct se_cmd *se_cmd)
        if (!tcmu_cmd)
                return NULL;
-        INIT_LIST_HEAD(&tcmu_cmd->cmdr_queue_entry);
+        INIT_LIST_HEAD(&tcmu_cmd->queue_entry);
        tcmu_cmd->se_cmd = se_cmd;
        tcmu_cmd->tcmu_dev = udev;
@@ -915,11 +917,13 @@ setup_timer:
                return 0;
        tcmu_cmd->deadline = round_jiffies_up(jiffies + msecs_to_jiffies(tmo));
-        mod_timer(timer, tcmu_cmd->deadline);
+        if (!timer_pending(timer))
+                mod_timer(timer, tcmu_cmd->deadline);
        return 0;
 }
-static int add_to_cmdr_queue(struct tcmu_cmd *tcmu_cmd)
+static int add_to_qfull_queue(struct tcmu_cmd *tcmu_cmd)
 {
        struct tcmu_dev *udev = tcmu_cmd->tcmu_dev;
        unsigned int tmo;
@@ -942,7 +946,7 @@ static int add_to_cmdr_queue(struct tcmu_cmd *tcmu_cmd)
        if (ret)
                return ret;
-        list_add_tail(&tcmu_cmd->cmdr_queue_entry, &udev->cmdr_queue);
+        list_add_tail(&tcmu_cmd->queue_entry, &udev->qfull_queue);
        pr_debug("adding cmd %u on dev %s to ring space wait queue\n",
                 tcmu_cmd->cmd_id, udev->name);
        return 0;
@@ -999,7 +1003,7 @@ static int queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, sense_reason_t *scsi_err)
        base_command_size = tcmu_cmd_get_base_cmd_size(tcmu_cmd->dbi_cnt);
        command_size = tcmu_cmd_get_cmd_size(tcmu_cmd, base_command_size);
-        if (!list_empty(&udev->cmdr_queue))
+        if (!list_empty(&udev->qfull_queue))
                goto queue;
        mb = udev->mb_addr;
@@ -1096,13 +1100,16 @@ static int queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, sense_reason_t *scsi_err)
        UPDATE_HEAD(mb->cmd_head, command_size, udev->cmdr_size);
        tcmu_flush_dcache_range(mb, sizeof(*mb));
+        list_add_tail(&tcmu_cmd->queue_entry, &udev->inflight_queue);
+        set_bit(TCMU_CMD_BIT_INFLIGHT, &tcmu_cmd->flags);
        /* TODO: only if FLUSH and FUA? */
        uio_event_notify(&udev->uio_info);
        return 0;
 queue:
-        if (add_to_cmdr_queue(tcmu_cmd)) {
+        if (add_to_qfull_queue(tcmu_cmd)) {
                *scsi_err = TCM_OUT_OF_RESOURCES;
                return -1;
        }
@@ -1145,6 +1152,8 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
        if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags))
                goto out;
+        list_del_init(&cmd->queue_entry);
        tcmu_cmd_reset_dbi_cur(cmd);
        if (entry->hdr.uflags & TCMU_UFLAG_UNKNOWN_OP) {
@@ -1194,9 +1203,29 @@ out:
        tcmu_free_cmd(cmd);
 }
+static void tcmu_set_next_deadline(struct list_head *queue,
+                                   struct timer_list *timer)
+{
+        struct tcmu_cmd *tcmu_cmd, *tmp_cmd;
+        unsigned long deadline = 0;
+        list_for_each_entry_safe(tcmu_cmd, tmp_cmd, queue, queue_entry) {
+                if (!time_after(jiffies, tcmu_cmd->deadline)) {
+                        deadline = tcmu_cmd->deadline;
+                        break;
+                }
+        }
+        if (deadline)
+                mod_timer(timer, deadline);
+        else
+                del_timer(timer);
+}
 static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
 {
        struct tcmu_mailbox *mb;
+        struct tcmu_cmd *cmd;
        int handled = 0;
        if (test_bit(TCMU_DEV_BIT_BROKEN, &udev->flags)) {
@@ -1210,7 +1239,6 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
        while (udev->cmdr_last_cleaned != READ_ONCE(mb->cmd_tail)) {
                struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned;
-                struct tcmu_cmd *cmd;
                tcmu_flush_dcache_range(entry, sizeof(*entry));
@@ -1243,7 +1271,7 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
                /* no more pending commands */
                del_timer(&udev->cmd_timer);
-                if (list_empty(&udev->cmdr_queue)) {
+                if (list_empty(&udev->qfull_queue)) {
                        /*
                         * no more pending or waiting commands so try to
                         * reclaim blocks if needed.
@@ -1252,6 +1280,8 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
                            tcmu_global_max_blocks)
                                schedule_delayed_work(&tcmu_unmap_work, 0);
                }
+        } else if (udev->cmd_time_out) {
+                tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer);
        }
        return handled;
@@ -1271,7 +1301,7 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
        if (!time_after(jiffies, cmd->deadline))
                return 0;
-        is_running = list_empty(&cmd->cmdr_queue_entry);
+        is_running = test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags);
        se_cmd = cmd->se_cmd;
        if (is_running) {
@@ -1288,12 +1318,11 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
                 */
                scsi_status = SAM_STAT_CHECK_CONDITION;
        } else {
-                list_del_init(&cmd->cmdr_queue_entry);
                idr_remove(&udev->commands, id);
                tcmu_free_cmd(cmd);
                scsi_status = SAM_STAT_TASK_SET_FULL;
        }
+        list_del_init(&cmd->queue_entry);
        pr_debug("Timing out cmd %u on dev %s that is %s.\n",
                 id, udev->name, is_running ? "inflight" : "queued");
@@ -1372,7 +1401,8 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
        INIT_LIST_HEAD(&udev->node);
        INIT_LIST_HEAD(&udev->timedout_entry);
-        INIT_LIST_HEAD(&udev->cmdr_queue);
+        INIT_LIST_HEAD(&udev->qfull_queue);
+        INIT_LIST_HEAD(&udev->inflight_queue);
        idr_init(&udev->commands);
        timer_setup(&udev->qfull_timer, tcmu_qfull_timedout, 0);
@@ -1383,7 +1413,7 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
        return &udev->se_dev;
 }
-static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
+static bool run_qfull_queue(struct tcmu_dev *udev, bool fail)
 {
        struct tcmu_cmd *tcmu_cmd, *tmp_cmd;
        LIST_HEAD(cmds);
@@ -1391,15 +1421,15 @@ static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
        sense_reason_t scsi_ret;
        int ret;
-        if (list_empty(&udev->cmdr_queue))
+        if (list_empty(&udev->qfull_queue))
                return true;
        pr_debug("running %s's cmdr queue forcefail %d\n", udev->name, fail);
-        list_splice_init(&udev->cmdr_queue, &cmds);
+        list_splice_init(&udev->qfull_queue, &cmds);
-        list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, cmdr_queue_entry) {
+        list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, queue_entry) {
-                list_del_init(&tcmu_cmd->cmdr_queue_entry);
+                list_del_init(&tcmu_cmd->queue_entry);
                pr_debug("removing cmd %u on dev %s from queue\n",
                         tcmu_cmd->cmd_id, udev->name);
@@ -1437,14 +1467,13 @@ static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
                         * cmd was requeued, so just put all cmds back in
                         * the queue
                         */
-                        list_splice_tail(&cmds, &udev->cmdr_queue);
+                        list_splice_tail(&cmds, &udev->qfull_queue);
                        drained = false;
-                        goto done;
+                        break;
                }
        }
-        if (list_empty(&udev->cmdr_queue))
-                del_timer(&udev->qfull_timer);
+        tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer);
-done:
        return drained;
 }
@@ -1454,7 +1483,7 @@ static int tcmu_irqcontrol(struct uio_info *info, s32 irq_on)
        mutex_lock(&udev->cmdr_lock);
        tcmu_handle_completions(udev);
-        run_cmdr_queue(udev, false);
+        run_qfull_queue(udev, false);
        mutex_unlock(&udev->cmdr_lock);
        return 0;
@@ -1982,7 +2011,7 @@ static void tcmu_block_dev(struct tcmu_dev *udev)
        /* complete IO that has executed successfully */
        tcmu_handle_completions(udev);
        /* fail IO waiting to be queued */
-        run_cmdr_queue(udev, true);
+        run_qfull_queue(udev, true);
 unlock:
        mutex_unlock(&udev->cmdr_lock);
@@ -1997,7 +2026,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
        mutex_lock(&udev->cmdr_lock);
        idr_for_each_entry(&udev->commands, cmd, i) {
-                if (!list_empty(&cmd->cmdr_queue_entry))
+                if (!test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags))
                        continue;
                pr_debug("removing cmd %u on dev %s from ring (is expired %d)\n",
@@ -2006,6 +2035,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
                idr_remove(&udev->commands, i);
                if (!test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
+                        list_del_init(&cmd->queue_entry);
                        if (err_level == 1) {
                                /*
                                 * Userspace was not able to start the
@@ -2666,6 +2696,10 @@ static void check_timedout_devices(void)
                mutex_lock(&udev->cmdr_lock);
                idr_for_each(&udev->commands, tcmu_check_expired_cmd, NULL);
+                tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer);
+                tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer);
                mutex_unlock(&udev->cmdr_lock);
                spin_lock_bh(&timed_out_udevs_lock);
diff --git a/drivers/thermal/intel/int340x_thermal/Kconfig b/drivers/thermal/intel/int340x_thermal/Kconfig
index 0582bd12a239..0ca908d12750 100644
--- a/drivers/thermal/intel/int340x_thermal/Kconfig
+++ b/drivers/thermal/intel/int340x_thermal/Kconfig
@@ -4,7 +4,7 @@
 config INT340X_THERMAL
        tristate "ACPI INT340X thermal drivers"
-        depends on X86 && ACPI
+        depends on X86 && ACPI && PCI
        select THERMAL_GOV_USER_SPACE
        select ACPI_THERMAL_REL
        select ACPI_FAN
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 8e10ab436d1f..344684f3e2e4 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1127,16 +1127,18 @@ vhost_scsi_send_tmf_reject(struct vhost_scsi *vs,
                           struct vhost_virtqueue *vq,
                           struct vhost_scsi_ctx *vc)
 {
-        struct virtio_scsi_ctrl_tmf_resp __user *resp;
        struct virtio_scsi_ctrl_tmf_resp rsp;
+        struct iov_iter iov_iter;
        int ret;
        pr_debug("%s\n", __func__);
        memset(&rsp, 0, sizeof(rsp));
        rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
-        resp = vq->iov[vc->out].iov_base;
-        ret = __copy_to_user(resp, &rsp, sizeof(rsp));
+        iov_iter_init(&iov_iter, READ, &vq->iov[vc->out], vc->in, sizeof(rsp));
-        if (!ret)
+        ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);
+        if (likely(ret == sizeof(rsp)))
                vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
        else
                pr_err("Faulted on virtio_scsi_ctrl_tmf_resp\n");
@@ -1147,16 +1149,18 @@ vhost_scsi_send_an_resp(struct vhost_scsi *vs,
                        struct vhost_virtqueue *vq,
                        struct vhost_scsi_ctx *vc)
 {
-        struct virtio_scsi_ctrl_an_resp __user *resp;
        struct virtio_scsi_ctrl_an_resp rsp;
+        struct iov_iter iov_iter;
        int ret;
        pr_debug("%s\n", __func__);
        memset(&rsp, 0, sizeof(rsp));   /* event_actual = 0 */
        rsp.response = VIRTIO_SCSI_S_OK;
-        resp = vq->iov[vc->out].iov_base;
-        ret = __copy_to_user(resp, &rsp, sizeof(rsp));
+        iov_iter_init(&iov_iter, READ, &vq->iov[vc->out], vc->in, sizeof(rsp));
-        if (!ret)
+        ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);
+        if (likely(ret == sizeof(rsp)))
                vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
        else
                pr_err("Faulted on virtio_scsi_ctrl_an_resp\n");
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index babbb32b9bf0..15a216cdd507 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1034,8 +1034,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
        int type, ret;
        ret = copy_from_iter(&type, sizeof(type), from);
-        if (ret != sizeof(type))
+        if (ret != sizeof(type)) {
+                ret = -EINVAL;
                goto done;
+        }
        switch (type) {
        case VHOST_IOTLB_MSG:
@@ -1054,8 +1056,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
        iov_iter_advance(from, offset);
        ret = copy_from_iter(&msg, sizeof(msg), from);
-        if (ret != sizeof(msg))
+        if (ret != sizeof(msg)) {
+                ret = -EINVAL;
                goto done;
+        }
        if (vhost_process_iotlb_msg(dev, &msg)) {
                ret = -EFAULT;
                goto done;
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 8976190b6c1f..bfa1360ec750 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -510,6 +510,13 @@ static int __init fb_console_setup(char *this_opt)
                        continue;
                }
 #endif
+                if (!strncmp(options, "logo-pos:", 9)) {
+                        options += 9;
+                        if (!strcmp(options, "center"))
+                                fb_center_logo = true;
+                        continue;
+                }
        }
        return 1;
 }
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 558ed2ed3124..cb43a2258c51 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -53,6 +53,9 @@ EXPORT_SYMBOL(registered_fb);
 int num_registered_fb __read_mostly;
 EXPORT_SYMBOL(num_registered_fb);
+bool fb_center_logo __read_mostly;
+EXPORT_SYMBOL(fb_center_logo);
 static struct fb_info *get_fb_info(unsigned int idx)
 {
        struct fb_info *fb_info;
@@ -506,8 +509,7 @@ static int fb_show_logo_line(struct fb_info *info, int rotate,
                fb_set_logo(info, logo, logo_new, fb_logo.depth);
        }
-#ifdef CONFIG_FB_LOGO_CENTER
+        if (fb_center_logo) {
-        {
                int xres = info->var.xres;
                int yres = info->var.yres;
@@ -520,11 +522,11 @@ static int fb_show_logo_line(struct fb_info *info, int rotate,
                        --n;
                image.dx = (xres - n * (logo->width + 8) - 8) / 2;
                image.dy = y ?: (yres - logo->height) / 2;
+        } else {
+                image.dx = 0;
+                image.dy = y;
        }
-#else
-        image.dx = 0;
-        image.dy = y;
-#endif
        image.width = logo->width;
        image.height = logo->height;
@@ -684,9 +686,8 @@ int fb_prepare_logo(struct fb_info *info, int rotate)
        }
        height = fb_logo.logo->height;
-#ifdef CONFIG_FB_LOGO_CENTER
+        if (fb_center_logo)
-        height += (yres - fb_logo.logo->height) / 2;
+                height += (yres - fb_logo.logo->height) / 2;
-#endif
        return fb_prepare_extra_logos(info, height, yres);
 }
diff --git a/drivers/video/fbdev/offb.c b/drivers/video/fbdev/offb.c
index 31f769d67195..057d3cdef92e 100644
--- a/drivers/video/fbdev/offb.c
+++ b/drivers/video/fbdev/offb.c
@@ -318,28 +318,28 @@ static void __iomem *offb_map_reg(struct device_node *np, int index,
 }
 static void offb_init_palette_hacks(struct fb_info *info, struct device_node *dp,
-                                    const char *name, unsigned long address)
+                                    unsigned long address)
 {
        struct offb_par *par = (struct offb_par *) info->par;
-        if (dp && !strncmp(name, "ATY,Rage128", 11)) {
+        if (of_node_name_prefix(dp, "ATY,Rage128")) {
                par->cmap_adr = offb_map_reg(dp, 2, 0, 0x1fff);
                if (par->cmap_adr)
                        par->cmap_type = cmap_r128;
-        } else if (dp && (!strncmp(name, "ATY,RageM3pA", 12)
+        } else if (of_node_name_prefix(dp, "ATY,RageM3pA") ||
-                          || !strncmp(name, "ATY,RageM3p12A", 14))) {
+                   of_node_name_prefix(dp, "ATY,RageM3p12A")) {
                par->cmap_adr = offb_map_reg(dp, 2, 0, 0x1fff);
                if (par->cmap_adr)
                        par->cmap_type = cmap_M3A;
-        } else if (dp && !strncmp(name, "ATY,RageM3pB", 12)) {
+        } else if (of_node_name_prefix(dp, "ATY,RageM3pB")) {
                par->cmap_adr = offb_map_reg(dp, 2, 0, 0x1fff);
                if (par->cmap_adr)
                        par->cmap_type = cmap_M3B;
-        } else if (dp && !strncmp(name, "ATY,Rage6", 9)) {
+        } else if (of_node_name_prefix(dp, "ATY,Rage6")) {
                par->cmap_adr = offb_map_reg(dp, 1, 0, 0x1fff);
                if (par->cmap_adr)
                        par->cmap_type = cmap_radeon;
-        } else if (!strncmp(name, "ATY,", 4)) {
+        } else if (of_node_name_prefix(dp, "ATY,")) {
                unsigned long base = address & 0xff000000UL;
                par->cmap_adr =
                        ioremap(base + 0x7ff000, 0x1000) + 0xcc0;
@@ -350,7 +350,7 @@ static void offb_init_palette_hacks(struct fb_info *info, struct device_node *dp
                par->cmap_adr = offb_map_reg(dp, 0, 0x6000, 0x1000);
                if (par->cmap_adr)
                        par->cmap_type = cmap_gxt2000;
-        } else if (dp && !strncmp(name, "vga,Display-", 12)) {
+        } else if (of_node_name_prefix(dp, "vga,Display-")) {
                /* Look for AVIVO initialized by SLOF */
                struct device_node *pciparent = of_get_parent(dp);
                const u32 *vid, *did;
@@ -438,7 +438,7 @@ static void __init offb_init_fb(const char *name,
        par->cmap_type = cmap_unknown;
        if (depth == 8)
-                offb_init_palette_hacks(info, dp, name, address);
+                offb_init_palette_hacks(info, dp, address);
        else
                fix->visual = FB_VISUAL_TRUECOLOR;
diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
index 53f93616c671..8e23160ec59f 100644
--- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
+++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
@@ -609,6 +609,8 @@ int omapfb_ioctl(struct fb_info *fbi, unsigned int cmd, unsigned long arg)
        int r = 0;
+        memset(&p, 0, sizeof(p));
        switch (cmd) {
        case OMAPFB_SYNC_GFX:
                DBG("ioctl SYNC_GFX\n");
diff --git a/drivers/video/logo/Kconfig b/drivers/video/logo/Kconfig
index 1e972c4e88b1..d1f6196c8b9a 100644
--- a/drivers/video/logo/Kconfig
+++ b/drivers/video/logo/Kconfig
@@ -10,15 +10,6 @@ menuconfig LOGO
 if LOGO
-config FB_LOGO_CENTER
-        bool "Center the logo"
-        depends on FB=y
-        help
-          When this option is selected, the bootup logo is centered both
-          horizontally and vertically. If more than one logo is displayed
-          due to multiple CPUs, the collected line of logos is centered
-          as a whole.
 config FB_LOGO_EXTRA
        bool
        depends on FB=y
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 728ecd1eea30..fb12fe205f86 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -61,6 +61,10 @@ enum virtio_balloon_vq {
        VIRTIO_BALLOON_VQ_MAX
 };
+enum virtio_balloon_config_read {
+        VIRTIO_BALLOON_CONFIG_READ_CMD_ID = 0,
+};
 struct virtio_balloon {
        struct virtio_device *vdev;
        struct virtqueue *inflate_vq, *deflate_vq, *stats_vq, *free_page_vq;
@@ -77,14 +81,20 @@ struct virtio_balloon {
        /* Prevent updating balloon when it is being canceled. */
        spinlock_t stop_update_lock;
        bool stop_update;
+        /* Bitmap to indicate if reading the related config fields are needed */
+        unsigned long config_read_bitmap;
        /* The list of allocated free pages, waiting to be given back to mm */
        struct list_head free_page_list;
        spinlock_t free_page_list_lock;
        /* The number of free page blocks on the above list */
        unsigned long num_free_page_blocks;
-        /* The cmd id received from host */
+        /*
-        u32 cmd_id_received;
+         * The cmd id received from host.
+         * Read it via virtio_balloon_cmd_id_received to get the latest value
+         * sent from host.
+         */
+        u32 cmd_id_received_cache;
        /* The cmd id that is actively in use */
        __virtio32 cmd_id_active;
        /* Buffer to store the stop sign */
@@ -390,37 +400,31 @@ static unsigned long return_free_pages_to_mm(struct virtio_balloon *vb,
        return num_returned;
 }
+static void virtio_balloon_queue_free_page_work(struct virtio_balloon *vb)
+{
+        if (!virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT))
+                return;
+        /* No need to queue the work if the bit was already set. */
+        if (test_and_set_bit(VIRTIO_BALLOON_CONFIG_READ_CMD_ID,
+                             &vb->config_read_bitmap))
+                return;
+        queue_work(vb->balloon_wq, &vb->report_free_page_work);
+}
 static void virtballoon_changed(struct virtio_device *vdev)
 {
        struct virtio_balloon *vb = vdev->priv;
        unsigned long flags;
-        s64 diff = towards_target(vb);
-        if (diff) {
-                spin_lock_irqsave(&vb->stop_update_lock, flags);
-                if (!vb->stop_update)
-                        queue_work(system_freezable_wq,
-                                   &vb->update_balloon_size_work);
-                spin_unlock_irqrestore(&vb->stop_update_lock, flags);
-        }
-        if (virtio_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
+        spin_lock_irqsave(&vb->stop_update_lock, flags);
-                virtio_cread(vdev, struct virtio_balloon_config,
+        if (!vb->stop_update) {
-                             free_page_report_cmd_id, &vb->cmd_id_received);
+                queue_work(system_freezable_wq,
-                if (vb->cmd_id_received == VIRTIO_BALLOON_CMD_ID_DONE) {
+                           &vb->update_balloon_size_work);
-                        /* Pass ULONG_MAX to give back all the free pages */
+                virtio_balloon_queue_free_page_work(vb);
-                        return_free_pages_to_mm(vb, ULONG_MAX);
-                } else if (vb->cmd_id_received != VIRTIO_BALLOON_CMD_ID_STOP &&
-                           vb->cmd_id_received !=
-                           virtio32_to_cpu(vdev, vb->cmd_id_active)) {
-                        spin_lock_irqsave(&vb->stop_update_lock, flags);
-                        if (!vb->stop_update) {
-                                queue_work(vb->balloon_wq,
-                                           &vb->report_free_page_work);
-                        }
-                        spin_unlock_irqrestore(&vb->stop_update_lock, flags);
-                }
        }
+        spin_unlock_irqrestore(&vb->stop_update_lock, flags);
 }
 static void update_balloon_size(struct virtio_balloon *vb)
@@ -527,6 +531,17 @@ static int init_vqs(struct virtio_balloon *vb)
        return 0;
 }
+static u32 virtio_balloon_cmd_id_received(struct virtio_balloon *vb)
+{
+        if (test_and_clear_bit(VIRTIO_BALLOON_CONFIG_READ_CMD_ID,
+                               &vb->config_read_bitmap))
+                virtio_cread(vb->vdev, struct virtio_balloon_config,
+                             free_page_report_cmd_id,
+                             &vb->cmd_id_received_cache);
+        return vb->cmd_id_received_cache;
+}
 static int send_cmd_id_start(struct virtio_balloon *vb)
 {
        struct scatterlist sg;
@@ -537,7 +552,8 @@ static int send_cmd_id_start(struct virtio_balloon *vb)
        while (virtqueue_get_buf(vq, &unused))
                ;
-        vb->cmd_id_active = cpu_to_virtio32(vb->vdev, vb->cmd_id_received);
+        vb->cmd_id_active = virtio32_to_cpu(vb->vdev,
+                                        virtio_balloon_cmd_id_received(vb));
        sg_init_one(&sg, &vb->cmd_id_active, sizeof(vb->cmd_id_active));
        err = virtqueue_add_outbuf(vq, &sg, 1, &vb->cmd_id_active, GFP_KERNEL);
        if (!err)
@@ -620,7 +636,8 @@ static int send_free_pages(struct virtio_balloon *vb)
                 * stop the reporting.
                 */
                cmd_id_active = virtio32_to_cpu(vb->vdev, vb->cmd_id_active);
-                if (cmd_id_active != vb->cmd_id_received)
+                if (unlikely(cmd_id_active !=
+                             virtio_balloon_cmd_id_received(vb)))
                        break;
                /*
@@ -637,11 +654,9 @@ static int send_free_pages(struct virtio_balloon *vb)
        return 0;
 }
-static void report_free_page_func(struct work_struct *work)
+static void virtio_balloon_report_free_page(struct virtio_balloon *vb)
 {
        int err;
-        struct virtio_balloon *vb = container_of(work, struct virtio_balloon,
-                                                 report_free_page_work);
        struct device *dev = &vb->vdev->dev;
        /* Start by sending the received cmd id to host with an outbuf. */
@@ -659,6 +674,23 @@ static void report_free_page_func(struct work_struct *work)
                dev_err(dev, "Failed to send a stop id, err = %d\n", err);
 }
+static void report_free_page_func(struct work_struct *work)
+{
+        struct virtio_balloon *vb = container_of(work, struct virtio_balloon,
+                                                 report_free_page_work);
+        u32 cmd_id_received;
+        cmd_id_received = virtio_balloon_cmd_id_received(vb);
+        if (cmd_id_received == VIRTIO_BALLOON_CMD_ID_DONE) {
+                /* Pass ULONG_MAX to give back all the free pages */
+                return_free_pages_to_mm(vb, ULONG_MAX);
+        } else if (cmd_id_received != VIRTIO_BALLOON_CMD_ID_STOP &&
+                   cmd_id_received !=
+                   virtio32_to_cpu(vb->vdev, vb->cmd_id_active)) {
+                virtio_balloon_report_free_page(vb);
+        }
+}
 #ifdef CONFIG_BALLOON_COMPACTION
 /*
 * virtballoon_migratepage - perform the balloon page migration on behalf of
@@ -885,7 +917,7 @@ static int virtballoon_probe(struct virtio_device *vdev)
                        goto out_del_vqs;
                }
                INIT_WORK(&vb->report_free_page_work, report_free_page_func);
-                vb->cmd_id_received = VIRTIO_BALLOON_CMD_ID_STOP;
+                vb->cmd_id_received_cache = VIRTIO_BALLOON_CMD_ID_STOP;
                vb->cmd_id_active = cpu_to_virtio32(vb->vdev,
                                                  VIRTIO_BALLOON_CMD_ID_STOP);
                vb->cmd_id_stop = cpu_to_virtio32(vb->vdev,
diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
index 4cd9ea5c75be..d9dd0f789279 100644
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -468,7 +468,7 @@ static int vm_find_vqs(struct virtio_device *vdev, unsigned nvqs,
 {
        struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
        unsigned int irq = platform_get_irq(vm_dev->pdev, 0);
-        int i, err;
+        int i, err, queue_idx = 0;
        err = request_irq(irq, vm_interrupt, IRQF_SHARED,
                        dev_name(&vdev->dev), vm_dev);
@@ -476,7 +476,12 @@ static int vm_find_vqs(struct virtio_device *vdev, unsigned nvqs,
                return err;
        for (i = 0; i < nvqs; ++i) {
-                vqs[i] = vm_setup_vq(vdev, i, callbacks[i], names[i],
+                if (!names[i]) {
+                        vqs[i] = NULL;
+                        continue;
+                }
+                vqs[i] = vm_setup_vq(vdev, queue_idx++, callbacks[i], names[i],
                                     ctx ? ctx[i] : false);
                if (IS_ERR(vqs[i])) {
                        vm_del_vqs(vdev);
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index 465a6f5142cc..d0584c040c60 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -285,7 +285,7 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs,
 {
        struct virtio_pci_device *vp_dev = to_vp_device(vdev);
        u16 msix_vec;
-        int i, err, nvectors, allocated_vectors;
+        int i, err, nvectors, allocated_vectors, queue_idx = 0;
        vp_dev->vqs = kcalloc(nvqs, sizeof(*vp_dev->vqs), GFP_KERNEL);
        if (!vp_dev->vqs)
@@ -321,7 +321,7 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs,
                        msix_vec = allocated_vectors++;
                else
                        msix_vec = VP_MSIX_VQ_VECTOR;
-                vqs[i] = vp_setup_vq(vdev, i, callbacks[i], names[i],
+                vqs[i] = vp_setup_vq(vdev, queue_idx++, callbacks[i], names[i],
                                     ctx ? ctx[i] : false,
                                     msix_vec);
                if (IS_ERR(vqs[i])) {
@@ -356,7 +356,7 @@ static int vp_find_vqs_intx(struct virtio_device *vdev, unsigned nvqs,
                const char * const names[], const bool *ctx)
 {
        struct virtio_pci_device *vp_dev = to_vp_device(vdev);
-        int i, err;
+        int i, err, queue_idx = 0;
        vp_dev->vqs = kcalloc(nvqs, sizeof(*vp_dev->vqs), GFP_KERNEL);
        if (!vp_dev->vqs)
@@ -374,7 +374,7 @@ static int vp_find_vqs_intx(struct virtio_device *vdev, unsigned nvqs,
                        vqs[i] = NULL;
                        continue;
                }
-                vqs[i] = vp_setup_vq(vdev, i, callbacks[i], names[i],
+                vqs[i] = vp_setup_vq(vdev, queue_idx++, callbacks[i], names[i],
                                     ctx ? ctx[i] : false,
                                     VIRTIO_MSI_NO_VECTOR);
                if (IS_ERR(vqs[i])) {
diff --git a/drivers/watchdog/mt7621_wdt.c b/drivers/watchdog/mt7621_wdt.c
index 5c4a764717c4..81208cd3f4ec 100644
--- a/drivers/watchdog/mt7621_wdt.c
+++ b/drivers/watchdog/mt7621_wdt.c
@@ -17,6 +17,7 @@
 #include <linux/watchdog.h>
 #include <linux/moduleparam.h>
 #include <linux/platform_device.h>
+#include <linux/mod_devicetable.h>
 #include <asm/mach-ralink/ralink_regs.h>
diff --git a/drivers/watchdog/rt2880_wdt.c b/drivers/watchdog/rt2880_wdt.c
index 98967f0a7d10..db7c57d82cfd 100644
--- a/drivers/watchdog/rt2880_wdt.c
+++ b/drivers/watchdog/rt2880_wdt.c
@@ -18,6 +18,7 @@
 #include <linux/watchdog.h>
 #include <linux/moduleparam.h>
 #include <linux/platform_device.h>
+#include <linux/mod_devicetable.h>
 #include <asm/mach-ralink/ralink_regs.h>
diff --git a/drivers/watchdog/tqmx86_wdt.c b/drivers/watchdog/tqmx86_wdt.c
index 0d3a0fbbd7a5..52941207a12a 100644
--- a/drivers/watchdog/tqmx86_wdt.c
+++ b/drivers/watchdog/tqmx86_wdt.c
@@ -79,13 +79,13 @@ static int tqmx86_wdt_probe(struct platform_device *pdev)
                return -ENOMEM;
        res = platform_get_resource(pdev, IORESOURCE_IO, 0);
-        if (IS_ERR(res))
+        if (!res)
-                return PTR_ERR(res);
+                return -ENODEV;
        priv->io_base = devm_ioport_map(&pdev->dev, res->start,
                                        resource_size(res));
-        if (IS_ERR(priv->io_base))
+        if (!priv->io_base)
-                return PTR_ERR(priv->io_base);
+                return -ENOMEM;
        watchdog_set_drvdata(&priv->wdd, priv);
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 93194f3e7540..117e76b2f939 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -1650,7 +1650,7 @@ void xen_callback_vector(void)
                        xen_have_vector_callback = 0;
                        return;
                }
-                pr_info("Xen HVM callback vector for event delivery is enabled\n");
+                pr_info_once("Xen HVM callback vector for event delivery is enabled\n");
                alloc_intr_gate(HYPERVISOR_CALLBACK_VECTOR,
                                xen_hvm_callback_vector);
        }
diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
index 2e5d845b5091..7aa64d1b119c 100644
--- a/drivers/xen/pvcalls-back.c
+++ b/drivers/xen/pvcalls-back.c
@@ -160,9 +160,10 @@ static void pvcalls_conn_back_read(void *opaque)
        /* write the data, then modify the indexes */
        virt_wmb();
-        if (ret < 0)
+        if (ret < 0) {
+                atomic_set(&map->read, 0);
                intf->in_error = ret;
-        else
+        } else
                intf->in_prod = prod + ret;
        /* update the indexes, then notify the other end */
        virt_wmb();
@@ -282,13 +283,11 @@ static int pvcalls_back_socket(struct xenbus_device *dev,
 static void pvcalls_sk_state_change(struct sock *sock)
 {
        struct sock_mapping *map = sock->sk_user_data;
-        struct pvcalls_data_intf *intf;
        if (map == NULL)
                return;
-        intf = map->ring;
+        atomic_inc(&map->read);
-        intf->in_error = -ENOTCONN;
        notify_remote_via_irq(map->irq);
 }
diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
index 77224d8f3e6f..8a249c95c193 100644
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -31,6 +31,12 @@
 #define PVCALLS_NR_RSP_PER_RING __CONST_RING_SIZE(xen_pvcalls, XEN_PAGE_SIZE)
 #define PVCALLS_FRONT_MAX_SPIN 5000
+static struct proto pvcalls_proto = {
+        .name   = "PVCalls",
+        .owner  = THIS_MODULE,
+        .obj_size = sizeof(struct sock),
+};
 struct pvcalls_bedata {
        struct xen_pvcalls_front_ring ring;
        grant_ref_t ref;
@@ -335,6 +341,42 @@ int pvcalls_front_socket(struct socket *sock)
        return ret;
 }
+static void free_active_ring(struct sock_mapping *map)
+{
+        if (!map->active.ring)
+                return;
+        free_pages((unsigned long)map->active.data.in,
+                        map->active.ring->ring_order);
+        free_page((unsigned long)map->active.ring);
+}
+static int alloc_active_ring(struct sock_mapping *map)
+{
+        void *bytes;
+        map->active.ring = (struct pvcalls_data_intf *)
+                get_zeroed_page(GFP_KERNEL);
+        if (!map->active.ring)
+                goto out;
+        map->active.ring->ring_order = PVCALLS_RING_ORDER;
+        bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+                                        PVCALLS_RING_ORDER);
+        if (!bytes)
+                goto out;
+        map->active.data.in = bytes;
+        map->active.data.out = bytes +
+                XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
+        return 0;
+out:
+        free_active_ring(map);
+        return -ENOMEM;
+}
 static int create_active(struct sock_mapping *map, int *evtchn)
 {
        void *bytes;
@@ -343,15 +385,7 @@ static int create_active(struct sock_mapping *map, int *evtchn)
        *evtchn = -1;
        init_waitqueue_head(&map->active.inflight_conn_req);
-        map->active.ring = (struct pvcalls_data_intf *)
+        bytes = map->active.data.in;
-                __get_free_page(GFP_KERNEL | __GFP_ZERO);
-        if (map->active.ring == NULL)
-                goto out_error;
-        map->active.ring->ring_order = PVCALLS_RING_ORDER;
-        bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
-                                        PVCALLS_RING_ORDER);
-        if (bytes == NULL)
-                goto out_error;
        for (i = 0; i < (1 << PVCALLS_RING_ORDER); i++)
                map->active.ring->ref[i] = gnttab_grant_foreign_access(
                        pvcalls_front_dev->otherend_id,
@@ -361,10 +395,6 @@ static int create_active(struct sock_mapping *map, int *evtchn)
                pvcalls_front_dev->otherend_id,
                pfn_to_gfn(virt_to_pfn((void *)map->active.ring)), 0);
-        map->active.data.in = bytes;
-        map->active.data.out = bytes +
-                XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
        ret = xenbus_alloc_evtchn(pvcalls_front_dev, evtchn);
        if (ret)
                goto out_error;
@@ -385,8 +415,6 @@ static int create_active(struct sock_mapping *map, int *evtchn)
 out_error:
        if (*evtchn >= 0)
                xenbus_free_evtchn(pvcalls_front_dev, *evtchn);
-        free_pages((unsigned long)map->active.data.in, PVCALLS_RING_ORDER);
-        free_page((unsigned long)map->active.ring);
        return ret;
 }
@@ -406,17 +434,24 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
                return PTR_ERR(map);
        bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
+        ret = alloc_active_ring(map);
+        if (ret < 0) {
+                pvcalls_exit_sock(sock);
+                return ret;
+        }
        spin_lock(&bedata->socket_lock);
        ret = get_request(bedata, &req_id);
        if (ret < 0) {
                spin_unlock(&bedata->socket_lock);
+                free_active_ring(map);
                pvcalls_exit_sock(sock);
                return ret;
        }
        ret = create_active(map, &evtchn);
        if (ret < 0) {
                spin_unlock(&bedata->socket_lock);
+                free_active_ring(map);
                pvcalls_exit_sock(sock);
                return ret;
        }
@@ -469,8 +504,10 @@ static int __write_ring(struct pvcalls_data_intf *intf,
        virt_mb();
        size = pvcalls_queued(prod, cons, array_size);
-        if (size >= array_size)
+        if (size > array_size)
                return -EINVAL;
+        if (size == array_size)
+                return 0;
        if (len > array_size - size)
                len = array_size - size;
@@ -560,15 +597,13 @@ static int __read_ring(struct pvcalls_data_intf *intf,
        error = intf->in_error;
        /* get pointers before reading from the ring */
        virt_rmb();
-        if (error < 0)
-                return error;
        size = pvcalls_queued(prod, cons, array_size);
        masked_prod = pvcalls_mask(prod, array_size);
        masked_cons = pvcalls_mask(cons, array_size);
        if (size == 0)
-                return 0;
+                return error ?: size;
        if (len > size)
                len = size;
@@ -780,25 +815,36 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                }
        }
-        spin_lock(&bedata->socket_lock);
+        map2 = kzalloc(sizeof(*map2), GFP_KERNEL);
-        ret = get_request(bedata, &req_id);
+        if (map2 == NULL) {
-        if (ret < 0) {
                clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                          (void *)&map->passive.flags);
-                spin_unlock(&bedata->socket_lock);
+                pvcalls_exit_sock(sock);
+                return -ENOMEM;
+        }
+        ret = alloc_active_ring(map2);
+        if (ret < 0) {
+                clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
+                                (void *)&map->passive.flags);
+                kfree(map2);
                pvcalls_exit_sock(sock);
                return ret;
        }
-        map2 = kzalloc(sizeof(*map2), GFP_ATOMIC);
+        spin_lock(&bedata->socket_lock);
-        if (map2 == NULL) {
+        ret = get_request(bedata, &req_id);
+        if (ret < 0) {
                clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                          (void *)&map->passive.flags);
                spin_unlock(&bedata->socket_lock);
+                free_active_ring(map2);
+                kfree(map2);
                pvcalls_exit_sock(sock);
-                return -ENOMEM;
+                return ret;
        }
        ret = create_active(map2, &evtchn);
        if (ret < 0) {
+                free_active_ring(map2);
                kfree(map2);
                clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                          (void *)&map->passive.flags);
@@ -839,7 +885,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
 received:
        map2->sock = newsock;
-        newsock->sk = kzalloc(sizeof(*newsock->sk), GFP_KERNEL);
+        newsock->sk = sk_alloc(sock_net(sock->sk), PF_INET, GFP_KERNEL, &pvcalls_proto, false);
        if (!newsock->sk) {
                bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
                map->passive.inflight_req_id = PVCALLS_INVALID_ID;
@@ -1032,8 +1078,8 @@ int pvcalls_front_release(struct socket *sock)
                spin_lock(&bedata->socket_lock);
                list_del(&map->list);
                spin_unlock(&bedata->socket_lock);
-                if (READ_ONCE(map->passive.inflight_req_id) !=
+                if (READ_ONCE(map->passive.inflight_req_id) != PVCALLS_INVALID_ID &&
-                    PVCALLS_INVALID_ID) {
+                        READ_ONCE(map->passive.inflight_req_id) != 0) {
                        pvcalls_front_free_map(bedata,
                                               map->passive.accept_map);
                }
diff --git a/fs/afs/flock.c b/fs/afs/flock.c
index 0568fd986821..e432bd27a2e7 100644
--- a/fs/afs/flock.c
+++ b/fs/afs/flock.c
@@ -208,7 +208,7 @@ again:
                /* The new front of the queue now owns the state variables. */
                next = list_entry(vnode->pending_locks.next,
                                  struct file_lock, fl_u.afs.link);
-                vnode->lock_key = afs_file_key(next->fl_file);
+                vnode->lock_key = key_get(afs_file_key(next->fl_file));
                vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
                vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
                goto again;
@@ -413,7 +413,7 @@ static void afs_dequeue_lock(struct afs_vnode *vnode, struct file_lock *fl)
        /* The new front of the queue now owns the state variables. */
        next = list_entry(vnode->pending_locks.next,
                          struct file_lock, fl_u.afs.link);
-        vnode->lock_key = afs_file_key(next->fl_file);
+        vnode->lock_key = key_get(afs_file_key(next->fl_file));
        vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
        vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
        afs_lock_may_be_available(vnode);
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index 6b17d3620414..1a4ce07fb406 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -414,7 +414,6 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
        } else if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) {
                valid = true;
        } else {
-                vnode->cb_s_break = vnode->cb_interest->server->cb_s_break;
                vnode->cb_v_break = vnode->volume->cb_v_break;
                valid = false;
        }
@@ -546,6 +545,8 @@ void afs_evict_inode(struct inode *inode)
 #endif
        afs_put_permits(rcu_access_pointer(vnode->permit_cache));
+        key_put(vnode->lock_key);
+        vnode->lock_key = NULL;
        _leave("");
 }
diff --git a/fs/afs/protocol_yfs.h b/fs/afs/protocol_yfs.h
index 07bc10f076aa..d443e2bfa094 100644
--- a/fs/afs/protocol_yfs.h
+++ b/fs/afs/protocol_yfs.h
@@ -161,3 +161,14 @@ struct yfs_xdr_YFSStoreVolumeStatus {
        struct yfs_xdr_u64      max_quota;
        struct yfs_xdr_u64      file_quota;
 } __packed;
+enum yfs_lock_type {
+        yfs_LockNone            = -1,
+        yfs_LockRead            = 0,
+        yfs_LockWrite           = 1,
+        yfs_LockExtend          = 2,
+        yfs_LockRelease         = 3,
+        yfs_LockMandatoryRead   = 0x100,
+        yfs_LockMandatoryWrite  = 0x101,
+        yfs_LockMandatoryExtend = 0x102,
+};
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index a7b44863d502..2c588f9bbbda 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -23,6 +23,7 @@ struct workqueue_struct *afs_async_calls;
 static void afs_wake_up_call_waiter(struct sock *, struct rxrpc_call *, unsigned long);
 static long afs_wait_for_call_to_complete(struct afs_call *, struct afs_addr_cursor *);
 static void afs_wake_up_async_call(struct sock *, struct rxrpc_call *, unsigned long);
+static void afs_delete_async_call(struct work_struct *);
 static void afs_process_async_call(struct work_struct *);
 static void afs_rx_new_call(struct sock *, struct rxrpc_call *, unsigned long);
 static void afs_rx_discard_new_call(struct rxrpc_call *, unsigned long);
@@ -203,20 +204,26 @@ void afs_put_call(struct afs_call *call)
        }
 }
+static struct afs_call *afs_get_call(struct afs_call *call,
+                                     enum afs_call_trace why)
+{
+        int u = atomic_inc_return(&call->usage);
+        trace_afs_call(call, why, u,
+                       atomic_read(&call->net->nr_outstanding_calls),
+                       __builtin_return_address(0));
+        return call;
+}
 /*
 * Queue the call for actual work.
 */
 static void afs_queue_call_work(struct afs_call *call)
 {
        if (call->type->work) {
-                int u = atomic_inc_return(&call->usage);
-                trace_afs_call(call, afs_call_trace_work, u,
-                               atomic_read(&call->net->nr_outstanding_calls),
-                               __builtin_return_address(0));
                INIT_WORK(&call->work, call->type->work);
+                afs_get_call(call, afs_call_trace_work);
                if (!queue_work(afs_wq, &call->work))
                        afs_put_call(call);
        }
@@ -398,6 +405,12 @@ long afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call,
                }
        }
+        /* If the call is going to be asynchronous, we need an extra ref for
+         * the call to hold itself so the caller need not hang on to its ref.
+         */
+        if (call->async)
+                afs_get_call(call, afs_call_trace_get);
        /* create a call */
        rxcall = rxrpc_kernel_begin_call(call->net->socket, srx, call->key,
                                         (unsigned long)call,
@@ -438,15 +451,17 @@ long afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call,
                        goto error_do_abort;
        }
-        /* at this point, an async call may no longer exist as it may have
+        /* Note that at this point, we may have received the reply or an abort
-         * already completed */
+         * - and an asynchronous call may already have completed.
-        if (call->async)
+         */
+        if (call->async) {
+                afs_put_call(call);
                return -EINPROGRESS;
+        }
        return afs_wait_for_call_to_complete(call, ac);
 error_do_abort:
-        call->state = AFS_CALL_COMPLETE;
        if (ret != -ECONNABORTED) {
                rxrpc_kernel_abort_call(call->net->socket, rxcall,
                                        RX_USER_ABORT, ret, "KSD");
@@ -463,8 +478,24 @@ error_do_abort:
 error_kill_call:
        if (call->type->done)
                call->type->done(call);
-        afs_put_call(call);
+        /* We need to dispose of the extra ref we grabbed for an async call.
+         * The call, however, might be queued on afs_async_calls and we need to
+         * make sure we don't get any more notifications that might requeue it.
+         */
+        if (call->rxcall) {
+                rxrpc_kernel_end_call(call->net->socket, call->rxcall);
+                call->rxcall = NULL;
+        }
+        if (call->async) {
+                if (cancel_work_sync(&call->async_work))
+                        afs_put_call(call);
+                afs_put_call(call);
+        }
        ac->error = ret;
+        call->state = AFS_CALL_COMPLETE;
+        afs_put_call(call);
        _leave(" = %d", ret);
        return ret;
 }
diff --git a/fs/afs/server_list.c b/fs/afs/server_list.c
index 95d0761cdb34..155dc14caef9 100644
--- a/fs/afs/server_list.c
+++ b/fs/afs/server_list.c
@@ -42,9 +42,7 @@ struct afs_server_list *afs_alloc_server_list(struct afs_cell *cell,
                if (vldb->fs_mask[i] & type_mask)
                        nr_servers++;
-        slist = kzalloc(sizeof(struct afs_server_list) +
+        slist = kzalloc(struct_size(slist, servers, nr_servers), GFP_KERNEL);
-                        sizeof(struct afs_server_entry) * nr_servers,
-                        GFP_KERNEL);
        if (!slist)
                goto error;
diff --git a/fs/afs/yfsclient.c b/fs/afs/yfsclient.c
index 12658c1363ae..5aa57929e8c2 100644
--- a/fs/afs/yfsclient.c
+++ b/fs/afs/yfsclient.c
@@ -803,7 +803,7 @@ int yfs_fs_create_file(struct afs_fs_cursor *fc,
        bp = xdr_encode_YFSFid(bp, &vnode->fid);
        bp = xdr_encode_string(bp, name, namesz);
        bp = xdr_encode_YFSStoreStatus_mode(bp, mode);
-        bp = xdr_encode_u32(bp, 0); /* ViceLockType */
+        bp = xdr_encode_u32(bp, yfs_LockNone); /* ViceLockType */
        yfs_check_req(call, bp);
        afs_use_fs_server(call, fc->cbi);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index c546cdce77e6..58a4c1217fa8 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -104,6 +104,20 @@ void invalidate_bdev(struct block_device *bdev)
 }
 EXPORT_SYMBOL(invalidate_bdev);
+static void set_init_blocksize(struct block_device *bdev)
+{
+        unsigned bsize = bdev_logical_block_size(bdev);
+        loff_t size = i_size_read(bdev->bd_inode);
+        while (bsize < PAGE_SIZE) {
+                if (size & bsize)
+                        break;
+                bsize <<= 1;
+        }
+        bdev->bd_block_size = bsize;
+        bdev->bd_inode->i_blkbits = blksize_bits(bsize);
+}
 int set_blocksize(struct block_device *bdev, int size)
 {
        /* Size must be a power of two, and between 512 and PAGE_SIZE */
@@ -1431,18 +1445,9 @@ EXPORT_SYMBOL(check_disk_change);
 void bd_set_size(struct block_device *bdev, loff_t size)
 {
-        unsigned bsize = bdev_logical_block_size(bdev);
        inode_lock(bdev->bd_inode);
        i_size_write(bdev->bd_inode, size);
        inode_unlock(bdev->bd_inode);
-        while (bsize < PAGE_SIZE) {
-                if (size & bsize)
-                        break;
-                bsize <<= 1;
-        }
-        bdev->bd_block_size = bsize;
-        bdev->bd_inode->i_blkbits = blksize_bits(bsize);
 }
 EXPORT_SYMBOL(bd_set_size);
@@ -1519,8 +1524,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                                }
                        }
-                        if (!ret)
+                        if (!ret) {
                                bd_set_size(bdev,(loff_t)get_capacity(disk)<<9);
+                                set_init_blocksize(bdev);
+                        }
                        /*
                         * If the device is invalidated, rescan partition
@@ -1555,6 +1562,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                                goto out_clear;
                        }
                        bd_set_size(bdev, (loff_t)bdev->bd_part->nr_sects << 9);
+                        set_init_blocksize(bdev);
                }
                if (bdev->bd_bdi == &noop_backing_dev_info)
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 0a68cf7032f5..7a2a2621f0d9 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -35,6 +35,7 @@
 struct btrfs_trans_handle;
 struct btrfs_transaction;
 struct btrfs_pending_snapshot;
+struct btrfs_delayed_ref_root;
 extern struct kmem_cache *btrfs_trans_handle_cachep;
 extern struct kmem_cache *btrfs_bit_radix_cachep;
 extern struct kmem_cache *btrfs_path_cachep;
@@ -786,6 +787,9 @@ enum {
         * main phase. The fs_info::balance_ctl is initialized.
         */
        BTRFS_FS_BALANCE_RUNNING,
+        /* Indicate that the cleaner thread is awake and doing something. */
+        BTRFS_FS_CLEANER_RUNNING,
 };
 struct btrfs_fs_info {
@@ -2661,6 +2665,9 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
                           unsigned long count);
 int btrfs_async_run_delayed_refs(struct btrfs_fs_info *fs_info,
                                 unsigned long count, u64 transid, int wait);
+void btrfs_cleanup_ref_head_accounting(struct btrfs_fs_info *fs_info,
+                                  struct btrfs_delayed_ref_root *delayed_refs,
+                                  struct btrfs_delayed_ref_head *head);
 int btrfs_lookup_data_extent(struct btrfs_fs_info *fs_info, u64 start, u64 len);
 int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans,
                             struct btrfs_fs_info *fs_info, u64 bytenr,
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 8da2f380d3c0..6a2a2a951705 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1682,6 +1682,8 @@ static int cleaner_kthread(void *arg)
        while (1) {
                again = 0;
+                set_bit(BTRFS_FS_CLEANER_RUNNING, &fs_info->flags);
                /* Make the cleaner go to sleep early. */
                if (btrfs_need_cleaner_sleep(fs_info))
                        goto sleep;
@@ -1728,6 +1730,7 @@ static int cleaner_kthread(void *arg)
                 */
                btrfs_delete_unused_bgs(fs_info);
 sleep:
+                clear_bit(BTRFS_FS_CLEANER_RUNNING, &fs_info->flags);
                if (kthread_should_park())
                        kthread_parkme();
                if (kthread_should_stop())
@@ -4201,6 +4204,14 @@ static void btrfs_destroy_all_ordered_extents(struct btrfs_fs_info *fs_info)
                spin_lock(&fs_info->ordered_root_lock);
        }
        spin_unlock(&fs_info->ordered_root_lock);
+        /*
+         * We need this here because if we've been flipped read-only we won't
+         * get sync() from the umount, so we need to make sure any ordered
+         * extents that haven't had their dirty pages IO start writeout yet
+         * actually get run and error out properly.
+         */
+        btrfs_wait_ordered_roots(fs_info, U64_MAX, 0, (u64)-1);
 }
 static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
@@ -4265,6 +4276,7 @@ static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
                if (pin_bytes)
                        btrfs_pin_extent(fs_info, head->bytenr,
                                         head->num_bytes, 1);
+                btrfs_cleanup_ref_head_accounting(fs_info, delayed_refs, head);
                btrfs_put_delayed_ref_head(head);
                cond_resched();
                spin_lock(&delayed_refs->lock);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index b15afeae16df..d81035b7ea7d 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2456,12 +2456,10 @@ static int run_and_cleanup_extent_op(struct btrfs_trans_handle *trans,
        return ret ? ret : 1;
 }
-static void cleanup_ref_head_accounting(struct btrfs_trans_handle *trans,
+void btrfs_cleanup_ref_head_accounting(struct btrfs_fs_info *fs_info,
-                                        struct btrfs_delayed_ref_head *head)
+                                  struct btrfs_delayed_ref_root *delayed_refs,
+                                  struct btrfs_delayed_ref_head *head)
 {
-        struct btrfs_fs_info *fs_info = trans->fs_info;
-        struct btrfs_delayed_ref_root *delayed_refs =
-                &trans->transaction->delayed_refs;
        int nr_items = 1;       /* Dropping this ref head update. */
        if (head->total_ref_mod < 0) {
@@ -2544,7 +2542,7 @@ static int cleanup_ref_head(struct btrfs_trans_handle *trans,
                }
        }
-        cleanup_ref_head_accounting(trans, head);
+        btrfs_cleanup_ref_head_accounting(fs_info, delayed_refs, head);
        trace_run_delayed_ref_head(fs_info, head, 0);
        btrfs_delayed_ref_unlock(head);
@@ -4954,6 +4952,15 @@ static void flush_space(struct btrfs_fs_info *fs_info,
                        ret = 0;
                break;
        case COMMIT_TRANS:
+                /*
+                 * If we have pending delayed iputs then we could free up a
+                 * bunch of pinned space, so make sure we run the iputs before
+                 * we do our pinned bytes check below.
+                 */
+                mutex_lock(&fs_info->cleaner_delayed_iput_mutex);
+                btrfs_run_delayed_iputs(fs_info);
+                mutex_unlock(&fs_info->cleaner_delayed_iput_mutex);
                ret = may_commit_transaction(fs_info, space_info);
                break;
        default:
@@ -7188,7 +7195,7 @@ static noinline int check_ref_cleanup(struct btrfs_trans_handle *trans,
        if (head->must_insert_reserved)
                ret = 1;
-        cleanup_ref_head_accounting(trans, head);
+        btrfs_cleanup_ref_head_accounting(trans->fs_info, delayed_refs, head);
        mutex_unlock(&head->mutex);
        btrfs_put_delayed_ref_head(head);
        return ret;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 43eb4535319d..5c349667c761 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3129,9 +3129,6 @@ out:
        /* once for the tree */
        btrfs_put_ordered_extent(ordered_extent);
-        /* Try to release some metadata so we don't get an OOM but don't wait */
-        btrfs_btree_balance_dirty_nodelay(fs_info);
        return ret;
 }
@@ -3254,6 +3251,8 @@ void btrfs_add_delayed_iput(struct inode *inode)
        ASSERT(list_empty(&binode->delayed_iput));
        list_add_tail(&binode->delayed_iput, &fs_info->delayed_iputs);
        spin_unlock(&fs_info->delayed_iput_lock);
+        if (!test_bit(BTRFS_FS_CLEANER_RUNNING, &fs_info->flags))
+                wake_up_process(fs_info->cleaner_kthread);
 }
 void btrfs_run_delayed_iputs(struct btrfs_fs_info *fs_info)
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index 46d691ba04bc..45b2322e092d 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -133,15 +133,9 @@ static ssize_t nfs4_copy_file_range(struct file *file_in, loff_t pos_in,
                                    struct file *file_out, loff_t pos_out,
                                    size_t count, unsigned int flags)
 {
-        ssize_t ret;
        if (file_inode(file_in) == file_inode(file_out))
                return -EINVAL;
-retry:
+        return nfs42_proc_copy(file_in, pos_in, file_out, pos_out, count);
-        ret = nfs42_proc_copy(file_in, pos_in, file_out, pos_out, count);
-        if (ret == -EAGAIN)
-                goto retry;
-        return ret;
 }
 static loff_t nfs4_file_llseek(struct file *filep, loff_t offset, int whence)
diff --git a/include/dt-bindings/reset/amlogic,meson-axg-reset.h b/include/dt-bindings/reset/amlogic,meson-axg-reset.h
index ad6f55dabd6d..0f2e0fe45ca4 100644
--- a/include/dt-bindings/reset/amlogic,meson-axg-reset.h
+++ b/include/dt-bindings/reset/amlogic,meson-axg-reset.h
@@ -1,12 +1,11 @@
+/* SPDX-License-Identifier: GPL-2.0+ OR BSD-3-Clause */
 /*
- *
 * Copyright (c) 2016 BayLibre, SAS.
 * Author: Neil Armstrong <narmstrong@baylibre.com>
 *
 * Copyright (c) 2017 Amlogic, inc.
 * Author: Yixun Lan <yixun.lan@amlogic.com>
 *
- * SPDX-License-Identifier: (GPL-2.0+ OR BSD)
 */
 #ifndef _DT_BINDINGS_AMLOGIC_MESON_AXG_RESET_H
diff --git a/include/linux/bcma/bcma_soc.h b/include/linux/bcma/bcma_soc.h
index 7cca5f859a90..f3c43519baa7 100644
--- a/include/linux/bcma/bcma_soc.h
+++ b/include/linux/bcma/bcma_soc.h
@@ -6,6 +6,7 @@
 struct bcma_soc {
        struct bcma_bus bus;
+        struct device *dev;
 };
 int __init bcma_host_soc_register(struct bcma_soc *soc);
diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index 39f668d5066b..333a6695a918 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -3,9 +3,8 @@
 #error "Please don't include <linux/compiler-clang.h> directly, include <linux/compiler.h> instead."
 #endif
-/* Some compiler specific definitions are overwritten here
+/* Compiler specific definitions for Clang compiler */
- * for Clang compiler
- */
 #define uninitialized_var(x) x = *(&(x))
 /* same as gcc, this was present in clang-2.6 so we can assume it works
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index dd8268f5f5f0..e8579412ad21 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -58,10 +58,6 @@
        (typeof(ptr)) (__ptr + (off));                                  \
 })
-/* Make the optimizer believe the variable can be manipulated arbitrarily. */
-#define OPTIMIZER_HIDE_VAR(var)                                         \
-        __asm__ ("" : "=r" (var) : "0" (var))
 /*
 * A trick to suppress uninitialized variable warning without generating any
 * code
diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h
index 517bd14e1222..b17f3cd18334 100644
--- a/include/linux/compiler-intel.h
+++ b/include/linux/compiler-intel.h
@@ -5,9 +5,7 @@
 #ifdef __ECC
-/* Some compiler specific definitions are overwritten here
+/* Compiler specific definitions for Intel ECC compiler */
- * for Intel ECC compiler
- */
 #include <asm/intrinsics.h>
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index fc5004a4b07d..445348facea9 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -161,7 +161,9 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
 #endif
 #ifndef OPTIMIZER_HIDE_VAR
-#define OPTIMIZER_HIDE_VAR(var) barrier()
+/* Make the optimizer believe the variable can be manipulated arbitrarily. */
+#define OPTIMIZER_HIDE_VAR(var)                                         \
+        __asm__ ("" : "=r" (var) : "0" (var))
 #endif
 /* Not-quite-unique ID. */
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 7cdd31a69719..f52ef0ad6781 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -653,6 +653,7 @@ extern int fb_new_modelist(struct fb_info *info);
 extern struct fb_info *registered_fb[FB_MAX];
 extern int num_registered_fb;
+extern bool fb_center_logo;
 extern struct class *fb_class;
 #define for_each_registered_fb(i)               \
diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h
index 5440f11b0907..7315977b64da 100644
--- a/include/linux/libnvdimm.h
+++ b/include/linux/libnvdimm.h
@@ -160,6 +160,7 @@ static inline struct nd_blk_region_desc *to_blk_region_desc(
 }
 enum nvdimm_security_state {
+        NVDIMM_SECURITY_ERROR = -1,
        NVDIMM_SECURITY_DISABLED,
        NVDIMM_SECURITY_UNLOCKED,
        NVDIMM_SECURITY_LOCKED,
diff --git a/include/linux/of.h b/include/linux/of.h
index fe472e5195a9..e240992e5cb6 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -50,7 +50,6 @@ struct of_irq_controller;
 struct device_node {
        const char *name;
-        const char *type;
        phandle phandle;
        const char *full_name;
        struct fwnode_handle fwnode;
diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
index 32baf8e26735..987b6491b946 100644
--- a/include/linux/virtio_config.h
+++ b/include/linux/virtio_config.h
@@ -12,6 +12,11 @@ struct irq_affinity;
 /**
 * virtio_config_ops - operations for configuring a virtio device
+ * Note: Do not assume that a transport implements all of the operations
+ *       getting/setting a value as a simple read/write! Generally speaking,
+ *       any of @get/@set, @get_status/@set_status, or @get_features/
+ *       @finalize_features are NOT safe to be called from an atomic
+ *       context.
 * @get: read the value of a configuration field
 *      vdev: the virtio_device
 *      offset: the offset of the configuration field
@@ -22,7 +27,7 @@ struct irq_affinity;
 *      offset: the offset of the configuration field
 *      buf: the buffer to read the field value from.
 *      len: the length of the buffer
- * @generation: config generation counter
+ * @generation: config generation counter (optional)
 *      vdev: the virtio_device
 *      Returns the config generation counter
 * @get_status: read the status byte
@@ -48,17 +53,17 @@ struct irq_affinity;
 * @del_vqs: free virtqueues found by find_vqs().
 * @get_features: get the array of feature bits for this device.
 *      vdev: the virtio_device
- *      Returns the first 32 feature bits (all we currently need).
+ *      Returns the first 64 feature bits (all we currently need).
 * @finalize_features: confirm what device features we'll be using.
 *      vdev: the virtio_device
 *      This gives the final feature bits for the device: it can change
 *      the dev->feature bits if it wants.
 *      Returns 0 on success or error status
- * @bus_name: return the bus name associated with the device
+ * @bus_name: return the bus name associated with the device (optional)
 *      vdev: the virtio_device
 *      This returns a pointer to the bus name a la pci_name from which
 *      the caller can then copy.
- * @set_vq_affinity: set the affinity for a virtqueue.
+ * @set_vq_affinity: set the affinity for a virtqueue (optional).
 * @get_vq_affinity: get the affinity for a virtqueue (optional).
 */
 typedef void vq_callback_t(struct virtqueue *);
diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h
index 33d291888ba9..e3f005eae1f7 100644
--- a/include/trace/events/afs.h
+++ b/include/trace/events/afs.h
@@ -25,6 +25,7 @@
 enum afs_call_trace {
        afs_call_trace_alloc,
        afs_call_trace_free,
+        afs_call_trace_get,
        afs_call_trace_put,
        afs_call_trace_wake,
        afs_call_trace_work,
@@ -159,6 +160,7 @@ enum afs_file_error {
 #define afs_call_traces \
        EM(afs_call_trace_alloc,                "ALLOC") \
        EM(afs_call_trace_free,                 "FREE ") \
+        EM(afs_call_trace_get,                  "GET  ") \
        EM(afs_call_trace_put,                  "PUT  ") \
        EM(afs_call_trace_wake,                 "WAKE ") \
        E_(afs_call_trace_work,                 "WORK ")
diff --git a/include/uapi/rdma/vmw_pvrdma-abi.h b/include/uapi/rdma/vmw_pvrdma-abi.h
index d13fd490b66d..6e73f0274e41 100644
--- a/include/uapi/rdma/vmw_pvrdma-abi.h
+++ b/include/uapi/rdma/vmw_pvrdma-abi.h
@@ -78,6 +78,7 @@ enum pvrdma_wr_opcode {
        PVRDMA_WR_MASKED_ATOMIC_FETCH_AND_ADD,
        PVRDMA_WR_BIND_MW,
        PVRDMA_WR_REG_SIG_MR,
+        PVRDMA_WR_ERROR,
 };
 enum pvrdma_wc_status {
diff --git a/init/Kconfig b/init/Kconfig
index d47cb77a220e..513fa544a134 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1124,6 +1124,7 @@ config LD_DEAD_CODE_DATA_ELIMINATION
        bool "Dead code and data elimination (EXPERIMENTAL)"
        depends on HAVE_LD_DEAD_CODE_DATA_ELIMINATION
        depends on EXPERT
+        depends on !(FUNCTION_TRACER && CC_IS_GCC && GCC_VERSION < 40800)
        depends on $(cc-option,-ffunction-sections -fdata-sections)
        depends on $(ld-option,--gc-sections)
        help
diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
index d6361776dc5c..1fb6fd68b9c7 100644
--- a/kernel/dma/swiotlb.c
+++ b/kernel/dma/swiotlb.c
@@ -378,6 +378,8 @@ void __init swiotlb_exit(void)
                memblock_free_late(io_tlb_start,
                                   PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT));
        }
+        io_tlb_start = 0;
+        io_tlb_end = 0;
        io_tlb_nslabs = 0;
        max_segment = 0;
 }
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index d7f538847b84..e815781ed751 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -976,6 +976,9 @@ static int seccomp_notify_release(struct inode *inode, struct file *file)
        struct seccomp_filter *filter = file->private_data;
        struct seccomp_knotif *knotif;
+        if (!filter)
+                return 0;
        mutex_lock(&filter->notify_lock);
        /*
@@ -1300,6 +1303,7 @@ out:
 out_put_fd:
        if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
                if (ret < 0) {
+                        listener_f->private_data = NULL;
                        fput(listener_f);
                        put_unused_fd(listener);
                } else {
diff --git a/lib/int_sqrt.c b/lib/int_sqrt.c
index 14436f4ca6bd..30e0f9770f88 100644
--- a/lib/int_sqrt.c
+++ b/lib/int_sqrt.c
@@ -52,7 +52,7 @@ u32 int_sqrt64(u64 x)
        if (x <= ULONG_MAX)
                return int_sqrt((unsigned long) x);
-        m = 1ULL << (fls64(x) & ~1ULL);
+        m = 1ULL << ((fls64(x) - 1) & ~1ULL);
        while (m != 0) {
                b = y + m;
                y >>= 1;
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 1ff9768f5456..f3023bbc0b7f 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -41,6 +41,9 @@ static unsigned long number_cred_unused;
 static struct cred machine_cred = {
        .usage = ATOMIC_INIT(1),
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        .magic = CRED_MAGIC,
+#endif
 };
 /*
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index dc86713b32b6..1531b0219344 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1549,8 +1549,10 @@ gss_marshal(struct rpc_task *task, __be32 *p)
        cred_len = p++;
        spin_lock(&ctx->gc_seq_lock);
-        req->rq_seqno = ctx->gc_seq++;
+        req->rq_seqno = (ctx->gc_seq < MAXSEQ) ? ctx->gc_seq++ : MAXSEQ;
        spin_unlock(&ctx->gc_seq_lock);
+        if (req->rq_seqno == MAXSEQ)
+                goto out_expired;
        *p++ = htonl((u32) RPC_GSS_VERSION);
        *p++ = htonl((u32) ctx->gc_proc);
@@ -1572,14 +1574,18 @@ gss_marshal(struct rpc_task *task, __be32 *p)
        mic.data = (u8 *)(p + 1);
        maj_stat = gss_get_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
        if (maj_stat == GSS_S_CONTEXT_EXPIRED) {
-                clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
+                goto out_expired;
        } else if (maj_stat != 0) {
-                printk("gss_marshal: gss_get_mic FAILED (%d)\n", maj_stat);
+                pr_warn("gss_marshal: gss_get_mic FAILED (%d)\n", maj_stat);
+                task->tk_status = -EIO;
                goto out_put_ctx;
        }
        p = xdr_encode_opaque(p, NULL, mic.len);
        gss_put_ctx(ctx);
        return p;
+out_expired:
+        clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
+        task->tk_status = -EKEYEXPIRED;
 out_put_ctx:
        gss_put_ctx(ctx);
        return NULL;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 71d9599b5816..d7ec6132c046 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1739,14 +1739,10 @@ rpc_xdr_encode(struct rpc_task *task)
        xdr_buf_init(&req->rq_rcv_buf,
                     req->rq_rbuffer,
                     req->rq_rcvsize);
-        req->rq_bytes_sent = 0;
        p = rpc_encode_header(task);
-        if (p == NULL) {
+        if (p == NULL)
-                printk(KERN_INFO "RPC: couldn't encode RPC header, exit EIO\n");
-                rpc_exit(task, -EIO);
                return;
-        }
        encode = task->tk_msg.rpc_proc->p_encode;
        if (encode == NULL)
@@ -1771,10 +1767,17 @@ call_encode(struct rpc_task *task)
        /* Did the encode result in an error condition? */
        if (task->tk_status != 0) {
                /* Was the error nonfatal? */
-                if (task->tk_status == -EAGAIN || task->tk_status == -ENOMEM)
+                switch (task->tk_status) {
+                case -EAGAIN:
+                case -ENOMEM:
                        rpc_delay(task, HZ >> 4);
-                else
+                        break;
+                case -EKEYEXPIRED:
+                        task->tk_action = call_refresh;
+                        break;
+                default:
                        rpc_exit(task, task->tk_status);
+                }
                return;
        }
@@ -2336,7 +2339,8 @@ rpc_encode_header(struct rpc_task *task)
        *p++ = htonl(clnt->cl_vers);    /* program version */
        *p++ = htonl(task->tk_msg.rpc_proc->p_proc);    /* procedure */
        p = rpcauth_marshcred(task, p);
-        req->rq_slen = xdr_adjust_iovec(&req->rq_svec[0], p);
+        if (p)
+                req->rq_slen = xdr_adjust_iovec(&req->rq_svec[0], p);
        return p;
 }
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 73547d17d3c6..f1ec2110efeb 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1151,6 +1151,7 @@ xprt_request_enqueue_transmit(struct rpc_task *task)
        struct rpc_xprt *xprt = req->rq_xprt;
        if (xprt_request_need_enqueue_transmit(task, req)) {
+                req->rq_bytes_sent = 0;
                spin_lock(&xprt->queue_lock);
                /*
                 * Requests that carry congestion control credits are added
@@ -1177,7 +1178,7 @@ xprt_request_enqueue_transmit(struct rpc_task *task)
                                INIT_LIST_HEAD(&req->rq_xmit2);
                                goto out;
                        }
-                } else {
+                } else if (!req->rq_seqno) {
                        list_for_each_entry(pos, &xprt->xmit_queue, rq_xmit) {
                                if (pos->rq_task->tk_owner != task->tk_owner)
                                        continue;
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 7749a2bf6887..4994e75945b8 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -845,17 +845,13 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt)
        for (i = 0; i <= buf->rb_sc_last; i++) {
                sc = rpcrdma_sendctx_create(&r_xprt->rx_ia);
                if (!sc)
-                        goto out_destroy;
+                        return -ENOMEM;
                sc->sc_xprt = r_xprt;
                buf->rb_sc_ctxs[i] = sc;
        }
        return 0;
-out_destroy:
-        rpcrdma_sendctxs_destroy(buf);
-        return -ENOMEM;
 }
 /* The sendctx queue is not guaranteed to have a size that is a
@@ -1113,8 +1109,10 @@ rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)
                                                WQ_MEM_RECLAIM | WQ_HIGHPRI,
                                                0,
                        r_xprt->rx_xprt.address_strings[RPC_DISPLAY_ADDR]);
-        if (!buf->rb_completion_wq)
+        if (!buf->rb_completion_wq) {
+                rc = -ENOMEM;
                goto out;
+        }
        return 0;
 out:
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 13559e6a460b..7754aa3e434f 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -48,6 +48,7 @@
 #include <net/udp.h>
 #include <net/tcp.h>
 #include <linux/bvec.h>
+#include <linux/highmem.h>
 #include <linux/uio.h>
 #include <trace/events/sunrpc.h>
@@ -376,6 +377,26 @@ xs_read_discard(struct socket *sock, struct msghdr *msg, int flags,
        return sock_recvmsg(sock, msg, flags);
 }
+#if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE
+static void
+xs_flush_bvec(const struct bio_vec *bvec, size_t count, size_t seek)
+{
+        struct bvec_iter bi = {
+                .bi_size = count,
+        };
+        struct bio_vec bv;
+        bvec_iter_advance(bvec, &bi, seek & PAGE_MASK);
+        for_each_bvec(bv, bvec, bi, bi)
+                flush_dcache_page(bv.bv_page);
+}
+#else
+static inline void
+xs_flush_bvec(const struct bio_vec *bvec, size_t count, size_t seek)
+{
+}
+#endif
 static ssize_t
 xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
                struct xdr_buf *buf, size_t count, size_t seek, size_t *read)
@@ -409,6 +430,7 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
                                seek + buf->page_base);
                if (ret <= 0)
                        goto sock_err;
+                xs_flush_bvec(buf->bvec, ret, seek + buf->page_base);
                offset += ret - buf->page_base;
                if (offset == count || msg->msg_flags & (MSG_EOR|MSG_TRUNC))
                        goto out;
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index 525bff667a52..30816037036e 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -24,10 +24,6 @@ depfile = $(subst $(comma),_,$(dot-target).d)
 basetarget = $(basename $(notdir $@))
 ###
-# filename of first prerequisite with directory and extension stripped
-baseprereq = $(basename $(notdir $<))
-###
 # Escape single quote for use in echo statements
 escsq = $(subst $(squote),'\$(squote)',$1)
diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index c05ab001b54c..181973509a05 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -206,4 +206,4 @@ filechk_conf_cfg = $(CONFIG_SHELL) $<
 $(obj)/%conf-cfg: $(src)/%conf-cfg.sh FORCE
        $(call filechk,conf_cfg)
-clean-files += conf-cfg
+clean-files += *conf-cfg
diff --git a/security/security.c b/security/security.c
index f1b8d2587639..55bc49027ba9 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1027,6 +1027,13 @@ int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
 void security_cred_free(struct cred *cred)
 {
+        /*
+         * There is a failure case in prepare_creds() that
+         * may result in a call here with ->security being NULL.
+         */
+        if (unlikely(cred->security == NULL))
+                return;
        call_void_hook(cred_free, cred);
 }
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index a50d625e7946..c1c31e33657a 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -732,7 +732,8 @@ static int sens_destroy(void *key, void *datum, void *p)
        kfree(key);
        if (datum) {
                levdatum = datum;
-                ebitmap_destroy(&levdatum->level->cat);
+                if (levdatum->level)
+                        ebitmap_destroy(&levdatum->level->cat);
                kfree(levdatum->level);
        }
        kfree(datum);
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
index ffda91a4a1aa..02514fe558b4 100644
--- a/security/yama/yama_lsm.c
+++ b/security/yama/yama_lsm.c
@@ -368,7 +368,9 @@ static int yama_ptrace_access_check(struct task_struct *child,
                        break;
                case YAMA_SCOPE_RELATIONAL:
                        rcu_read_lock();
-                        if (!task_is_descendant(current, child) &&
+                        if (!pid_alive(child))
+                                rc = -EPERM;
+                        if (!rc && !task_is_descendant(current, child) &&
                            !ptracer_exception_found(current, child) &&
                            !ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))
                                rc = -EPERM;
diff --git a/tools/arch/powerpc/include/uapi/asm/perf_regs.h b/tools/arch/powerpc/include/uapi/asm/perf_regs.h
index ff91192407d1..f599064dd8dc 100644
--- a/tools/arch/powerpc/include/uapi/asm/perf_regs.h
+++ b/tools/arch/powerpc/include/uapi/asm/perf_regs.h
@@ -47,6 +47,7 @@ enum perf_event_powerpc_regs {
        PERF_REG_POWERPC_DAR,
        PERF_REG_POWERPC_DSISR,
        PERF_REG_POWERPC_SIER,
+        PERF_REG_POWERPC_MMCRA,
        PERF_REG_POWERPC_MAX,
 };
 #endif /* _UAPI_ASM_POWERPC_PERF_REGS_H */
diff --git a/tools/perf/arch/powerpc/include/perf_regs.h b/tools/perf/arch/powerpc/include/perf_regs.h
index 1076393e6f43..e18a3556f5e3 100644
--- a/tools/perf/arch/powerpc/include/perf_regs.h
+++ b/tools/perf/arch/powerpc/include/perf_regs.h
@@ -63,7 +63,8 @@ static const char *reg_names[] = {
        [PERF_REG_POWERPC_TRAP] = "trap",
        [PERF_REG_POWERPC_DAR] = "dar",
        [PERF_REG_POWERPC_DSISR] = "dsisr",
-        [PERF_REG_POWERPC_SIER] = "sier"
+        [PERF_REG_POWERPC_SIER] = "sier",
+        [PERF_REG_POWERPC_MMCRA] = "mmcra"
 };
 static inline const char *perf_reg_name(int id)
diff --git a/tools/perf/arch/powerpc/util/perf_regs.c b/tools/perf/arch/powerpc/util/perf_regs.c
index 07fcd977d93e..34d5134681d9 100644
--- a/tools/perf/arch/powerpc/util/perf_regs.c
+++ b/tools/perf/arch/powerpc/util/perf_regs.c
@@ -53,6 +53,7 @@ const struct sample_reg sample_reg_masks[] = {
        SMPL_REG(dar, PERF_REG_POWERPC_DAR),
        SMPL_REG(dsisr, PERF_REG_POWERPC_DSISR),
        SMPL_REG(sier, PERF_REG_POWERPC_SIER),
+        SMPL_REG(mmcra, PERF_REG_POWERPC_MMCRA),
        SMPL_REG_END
 };