125 files changed, 919 insertions, 748 deletions

diff --git a/Documentation/admin-guide/pm/cpufreq.rst b/Documentation/admin-guide/pm/cpufreq.rst
index 47153e64dfb5..7eca9026a9ed 100644
--- a/Documentation/admin-guide/pm/cpufreq.rst
+++ b/Documentation/admin-guide/pm/cpufreq.rst
@@ -150,7 +150,7 @@ data structures necessary to handle the given policy and, possibly, to add
 a governor ``sysfs`` interface to it.  Next, the governor is started by
 invoking its ``->start()`` callback.
 
-That callback it expected to register per-CPU utilization update callbacks for
+That callback is expected to register per-CPU utilization update callbacks for
 all of the online CPUs belonging to the given policy with the CPU scheduler.
 The utilization update callbacks will be invoked by the CPU scheduler on
 important events, like task enqueue and dequeue, on every iteration of the
diff --git a/Documentation/cpu-freq/cpufreq-stats.txt b/Documentation/cpu-freq/cpufreq-stats.txt
index a873855c811d..14378cecb172 100644
--- a/Documentation/cpu-freq/cpufreq-stats.txt
+++ b/Documentation/cpu-freq/cpufreq-stats.txt
@@ -86,9 +86,11 @@ transitions.
 This will give a fine grained information about all the CPU frequency
 transitions. The cat output here is a two dimensional matrix, where an entry
 <i,j> (row i, column j) represents the count of number of transitions from 
-Freq_i to Freq_j. Freq_i is in descending order with increasing rows and 
-Freq_j is in descending order with increasing columns. The output here also 
-contains the actual freq values for each row and column for better readability.
+Freq_i to Freq_j. Freq_i rows and Freq_j columns follow the sorting order in
+which the driver has provided the frequency table initially to the cpufreq core
+and so can be sorted (ascending or descending) or unsorted.  The output here
+also contains the actual freq values for each row and column for better
+readability.
 
 If the transition table is bigger than PAGE_SIZE, reading this will
 return an -EFBIG error.
diff --git a/Documentation/devicetree/bindings/cpufreq/arm_big_little_dt.txt b/Documentation/devicetree/bindings/cpufreq/arm_big_little_dt.txt
deleted file mode 100644
index 2aa06ac0fac5..000000000000
--- a/Documentation/devicetree/bindings/cpufreq/arm_big_little_dt.txt
+++ /dev/null
@@ -1,65 +0,0 @@
-Generic ARM big LITTLE cpufreq driver's DT glue
------------------------------------------------
-
-This is DT specific glue layer for generic cpufreq driver for big LITTLE
-systems.
-
-Both required and optional properties listed below must be defined
-under node /cpus/cpu@x. Where x is the first cpu inside a cluster.
-
-FIXME: Cpus should boot in the order specified in DT and all cpus for a cluster
-must be present contiguously. Generic DT driver will check only node 'x' for
-cpu:x.
-
-Required properties:
-- operating-points: Refer to Documentation/devicetree/bindings/opp/opp.txt
-  for details
-
-Optional properties:
-- clock-latency: Specify the possible maximum transition latency for clock,
-  in unit of nanoseconds.
-
-Examples:
-
-cpus {
-        #address-cells = <1>;
-        #size-cells = <0>;
-
-        cpu@0 {
-                compatible = "arm,cortex-a15";
-                reg = <0>;
-                next-level-cache = <&L2>;
-                operating-points = <
-                        /* kHz    uV */
-                        792000  1100000
-                        396000  950000
-                        198000  850000
-                >;
-                clock-latency = <61036>; /* two CLK32 periods */
-        };
-
-        cpu@1 {
-                compatible = "arm,cortex-a15";
-                reg = <1>;
-                next-level-cache = <&L2>;
-        };
-
-        cpu@100 {
-                compatible = "arm,cortex-a7";
-                reg = <100>;
-                next-level-cache = <&L2>;
-                operating-points = <
-                        /* kHz    uV */
-                        792000  950000
-                        396000  750000
-                        198000  450000
-                >;
-                clock-latency = <61036>; /* two CLK32 periods */
-        };
-
-        cpu@101 {
-                compatible = "arm,cortex-a7";
-                reg = <101>;
-                next-level-cache = <&L2>;
-        };
-};
diff --git a/MAINTAINERS b/MAINTAINERS
index 0abecc528dac..6c3fbbb361f8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -11745,6 +11745,7 @@ F:	Documentation/devicetree/bindings/pinctrl/fsl,*
 PIN CONTROLLER - INTEL
 M:      Mika Westerberg <mika.westerberg@linux.intel.com>
 M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/intel.git
 S:      Maintained
 F:      drivers/pinctrl/intel/
 
diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
index 0d289240b6ca..775cac3c02bb 100644
--- a/arch/arm/include/asm/cputype.h
+++ b/arch/arm/include/asm/cputype.h
@@ -111,6 +111,7 @@
 #include <linux/kernel.h>
 
 extern unsigned int processor_id;
+struct proc_info_list *lookup_processor(u32 midr);
 
 #ifdef CONFIG_CPU_CP15
 #define read_cpuid(reg)                                                 \
diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h
index e25f4392e1b2..e1b6f280ab08 100644
--- a/arch/arm/include/asm/proc-fns.h
+++ b/arch/arm/include/asm/proc-fns.h
@@ -23,7 +23,7 @@ struct mm_struct;
 /*
  * Don't change this structure - ASM code relies on it.
  */
-extern struct processor {
+struct processor {
         /* MISC
          * get data abort address/flags
          */
@@ -79,9 +79,13 @@ extern struct processor {
         unsigned int suspend_size;
         void (*do_suspend)(void *);
         void (*do_resume)(void *);
-} processor;
+};
 
 #ifndef MULTI_CPU
+static inline void init_proc_vtable(const struct processor *p)
+{
+}
+
 extern void cpu_proc_init(void);
 extern void cpu_proc_fin(void);
 extern int cpu_do_idle(void);
@@ -98,17 +102,50 @@ extern void cpu_reset(unsigned long addr, bool hvc) __attribute__((noreturn));
 extern void cpu_do_suspend(void *);
 extern void cpu_do_resume(void *);
 #else
-#define cpu_proc_init                   processor._proc_init
-#define cpu_proc_fin                    processor._proc_fin
-#define cpu_reset                       processor.reset
-#define cpu_do_idle                     processor._do_idle
-#define cpu_dcache_clean_area           processor.dcache_clean_area
-#define cpu_set_pte_ext                 processor.set_pte_ext
-#define cpu_do_switch_mm                processor.switch_mm
 
-/* These three are private to arch/arm/kernel/suspend.c */
-#define cpu_do_suspend                  processor.do_suspend
-#define cpu_do_resume                   processor.do_resume
+extern struct processor processor;
+#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
+#include <linux/smp.h>
+/*
+ * This can't be a per-cpu variable because we need to access it before
+ * per-cpu has been initialised.  We have a couple of functions that are
+ * called in a pre-emptible context, and so can't use smp_processor_id()
+ * there, hence PROC_TABLE().  We insist in init_proc_vtable() that the
+ * function pointers for these are identical across all CPUs.
+ */
+extern struct processor *cpu_vtable[];
+#define PROC_VTABLE(f)                  cpu_vtable[smp_processor_id()]->f
+#define PROC_TABLE(f)                   cpu_vtable[0]->f
+static inline void init_proc_vtable(const struct processor *p)
+{
+        unsigned int cpu = smp_processor_id();
+        *cpu_vtable[cpu] = *p;
+        WARN_ON_ONCE(cpu_vtable[cpu]->dcache_clean_area !=
+                     cpu_vtable[0]->dcache_clean_area);
+        WARN_ON_ONCE(cpu_vtable[cpu]->set_pte_ext !=
+                     cpu_vtable[0]->set_pte_ext);
+}
+#else
+#define PROC_VTABLE(f)                  processor.f
+#define PROC_TABLE(f)                   processor.f
+static inline void init_proc_vtable(const struct processor *p)
+{
+        processor = *p;
+}
+#endif
+
+#define cpu_proc_init                   PROC_VTABLE(_proc_init)
+#define cpu_check_bugs                  PROC_VTABLE(check_bugs)
+#define cpu_proc_fin                    PROC_VTABLE(_proc_fin)
+#define cpu_reset                       PROC_VTABLE(reset)
+#define cpu_do_idle                     PROC_VTABLE(_do_idle)
+#define cpu_dcache_clean_area           PROC_TABLE(dcache_clean_area)
+#define cpu_set_pte_ext                 PROC_TABLE(set_pte_ext)
+#define cpu_do_switch_mm                PROC_VTABLE(switch_mm)
+
+/* These two are private to arch/arm/kernel/suspend.c */
+#define cpu_do_suspend                  PROC_VTABLE(do_suspend)
+#define cpu_do_resume                   PROC_VTABLE(do_resume)
 #endif
 
 extern void cpu_resume(void);
diff --git a/arch/arm/kernel/bugs.c b/arch/arm/kernel/bugs.c
index 7be511310191..d41d3598e5e5 100644
--- a/arch/arm/kernel/bugs.c
+++ b/arch/arm/kernel/bugs.c
@@ -6,8 +6,8 @@
 void check_other_bugs(void)
 {
 #ifdef MULTI_CPU
-        if (processor.check_bugs)
-                processor.check_bugs();
+        if (cpu_check_bugs)
+                cpu_check_bugs();
 #endif
 }
 
diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S
index 6e0375e7db05..997b02302c31 100644
--- a/arch/arm/kernel/head-common.S
+++ b/arch/arm/kernel/head-common.S
@@ -145,6 +145,9 @@ __mmap_switched_data:
 #endif
         .size   __mmap_switched_data, . - __mmap_switched_data
 
+        __FINIT
+        .text
+
 /*
  * This provides a C-API version of __lookup_processor_type
  */
@@ -156,9 +159,6 @@ ENTRY(lookup_processor_type)
         ldmfd   sp!, {r4 - r6, r9, pc}
 ENDPROC(lookup_processor_type)
 
-        __FINIT
-        .text
-
 /*
  * Read processor ID register (CP#15, CR0), and look up in the linker-built
  * supported processor list.  Note that we can't use the absolute addresses
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index ac7e08886863..375b13f7e780 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -114,6 +114,11 @@ EXPORT_SYMBOL(elf_hwcap2);
 
 #ifdef MULTI_CPU
 struct processor processor __ro_after_init;
+#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
+struct processor *cpu_vtable[NR_CPUS] = {
+        [0] = &processor,
+};
+#endif
 #endif
 #ifdef MULTI_TLB
 struct cpu_tlb_fns cpu_tlb __ro_after_init;
@@ -666,28 +671,33 @@ static void __init smp_build_mpidr_hash(void)
 }
 #endif
 
-static void __init setup_processor(void)
+/*
+ * locate processor in the list of supported processor types.  The linker
+ * builds this table for us from the entries in arch/arm/mm/proc-*.S
+ */
+struct proc_info_list *lookup_processor(u32 midr)
 {
-        struct proc_info_list *list;
+        struct proc_info_list *list = lookup_processor_type(midr);
 
-        /*
-         * locate processor in the list of supported processor
-         * types.  The linker builds this table for us from the
-         * entries in arch/arm/mm/proc-*.S
-         */
-        list = lookup_processor_type(read_cpuid_id());
         if (!list) {
-                pr_err("CPU configuration botched (ID %08x), unable to continue.\n",
-                       read_cpuid_id());
-                while (1);
+                pr_err("CPU%u: configuration botched (ID %08x), CPU halted\n",
+                       smp_processor_id(), midr);
+                while (1)
+                /* can't use cpu_relax() here as it may require MMU setup */;
         }
 
+        return list;
+}
+
+static void __init setup_processor(void)
+{
+        unsigned int midr = read_cpuid_id();
+        struct proc_info_list *list = lookup_processor(midr);
+
         cpu_name = list->cpu_name;
         __cpu_architecture = __get_cpu_architecture();
 
-#ifdef MULTI_CPU
-        processor = *list->proc;
-#endif
+        init_proc_vtable(list->proc);
 #ifdef MULTI_TLB
         cpu_tlb = *list->tlb;
 #endif
@@ -699,7 +709,7 @@ static void __init setup_processor(void)
 #endif
 
         pr_info("CPU: %s [%08x] revision %d (ARMv%s), cr=%08lx\n",
-                cpu_name, read_cpuid_id(), read_cpuid_id() & 15,
+                list->cpu_name, midr, midr & 15,
                 proc_arch[cpu_architecture()], get_cr());
 
         snprintf(init_utsname()->machine, __NEW_UTS_LEN + 1, "%s%c",
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 0978282d5fc2..12a6172263c0 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -42,6 +42,7 @@
 #include <asm/mmu_context.h>
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
+#include <asm/procinfo.h>
 #include <asm/processor.h>
 #include <asm/sections.h>
 #include <asm/tlbflush.h>
@@ -102,6 +103,30 @@ static unsigned long get_arch_pgd(pgd_t *pgd)
 #endif
 }
 
+#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
+static int secondary_biglittle_prepare(unsigned int cpu)
+{
+        if (!cpu_vtable[cpu])
+                cpu_vtable[cpu] = kzalloc(sizeof(*cpu_vtable[cpu]), GFP_KERNEL);
+
+        return cpu_vtable[cpu] ? 0 : -ENOMEM;
+}
+
+static void secondary_biglittle_init(void)
+{
+        init_proc_vtable(lookup_processor(read_cpuid_id())->proc);
+}
+#else
+static int secondary_biglittle_prepare(unsigned int cpu)
+{
+        return 0;
+}
+
+static void secondary_biglittle_init(void)
+{
+}
+#endif
+
 int __cpu_up(unsigned int cpu, struct task_struct *idle)
 {
         int ret;
@@ -109,6 +134,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
         if (!smp_ops.smp_boot_secondary)
                 return -ENOSYS;
 
+        ret = secondary_biglittle_prepare(cpu);
+        if (ret)
+                return ret;
+
         /*
          * We need to tell the secondary core where to find
          * its stack and the page tables.
@@ -359,6 +388,8 @@ asmlinkage void secondary_start_kernel(void)
         struct mm_struct *mm = &init_mm;
         unsigned int cpu;
 
+        secondary_biglittle_init();
+
         /*
          * The identity mapping is uncached (strongly ordered), so
          * switch away from it before attempting any exclusive accesses.
diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c
index 9500b6e27380..f86b72d1d59e 100644
--- a/arch/arm/mach-omap2/display.c
+++ b/arch/arm/mach-omap2/display.c
@@ -209,11 +209,61 @@ static int __init omapdss_init_fbdev(void)
 
         return 0;
 }
-#else
-static inline int omapdss_init_fbdev(void)
+
+static const char * const omapdss_compat_names[] __initconst = {
+        "ti,omap2-dss",
+        "ti,omap3-dss",
+        "ti,omap4-dss",
+        "ti,omap5-dss",
+        "ti,dra7-dss",
+};
+
+static struct device_node * __init omapdss_find_dss_of_node(void)
 {
-        return 0;
+        struct device_node *node;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(omapdss_compat_names); ++i) {
+                node = of_find_compatible_node(NULL, NULL,
+                        omapdss_compat_names[i]);
+                if (node)
+                        return node;
+        }
+
+        return NULL;
 }
+
+static int __init omapdss_init_of(void)
+{
+        int r;
+        struct device_node *node;
+        struct platform_device *pdev;
+
+        /* only create dss helper devices if dss is enabled in the .dts */
+
+        node = omapdss_find_dss_of_node();
+        if (!node)
+                return 0;
+
+        if (!of_device_is_available(node))
+                return 0;
+
+        pdev = of_find_device_by_node(node);
+
+        if (!pdev) {
+                pr_err("Unable to find DSS platform device\n");
+                return -ENODEV;
+        }
+
+        r = of_platform_populate(node, NULL, NULL, &pdev->dev);
+        if (r) {
+                pr_err("Unable to populate DSS submodule devices\n");
+                return r;
+        }
+
+        return omapdss_init_fbdev();
+}
+omap_device_initcall(omapdss_init_of);
 #endif /* CONFIG_FB_OMAP2 */
 
 static void dispc_disable_outputs(void)
@@ -361,58 +411,3 @@ int omap_dss_reset(struct omap_hwmod *oh)
 
         return r;
 }
-
-static const char * const omapdss_compat_names[] __initconst = {
-        "ti,omap2-dss",
-        "ti,omap3-dss",
-        "ti,omap4-dss",
-        "ti,omap5-dss",
-        "ti,dra7-dss",
-};
-
-static struct device_node * __init omapdss_find_dss_of_node(void)
-{
-        struct device_node *node;
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(omapdss_compat_names); ++i) {
-                node = of_find_compatible_node(NULL, NULL,
-                        omapdss_compat_names[i]);
-                if (node)
-                        return node;
-        }
-
-        return NULL;
-}
-
-static int __init omapdss_init_of(void)
-{
-        int r;
-        struct device_node *node;
-        struct platform_device *pdev;
-
-        /* only create dss helper devices if dss is enabled in the .dts */
-
-        node = omapdss_find_dss_of_node();
-        if (!node)
-                return 0;
-
-        if (!of_device_is_available(node))
-                return 0;
-
-        pdev = of_find_device_by_node(node);
-
-        if (!pdev) {
-                pr_err("Unable to find DSS platform device\n");
-                return -ENODEV;
-        }
-
-        r = of_platform_populate(node, NULL, NULL, &pdev->dev);
-        if (r) {
-                pr_err("Unable to populate DSS submodule devices\n");
-                return r;
-        }
-
-        return omapdss_init_fbdev();
-}
-omap_device_initcall(omapdss_init_of);
diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c
index 5544b82a2e7a..9a07916af8dd 100644
--- a/arch/arm/mm/proc-v7-bugs.c
+++ b/arch/arm/mm/proc-v7-bugs.c
@@ -52,8 +52,6 @@ static void cpu_v7_spectre_init(void)
         case ARM_CPU_PART_CORTEX_A17:
         case ARM_CPU_PART_CORTEX_A73:
         case ARM_CPU_PART_CORTEX_A75:
-                if (processor.switch_mm != cpu_v7_bpiall_switch_mm)
-                        goto bl_error;
                 per_cpu(harden_branch_predictor_fn, cpu) =
                         harden_branch_predictor_bpiall;
                 spectre_v2_method = "BPIALL";
@@ -61,8 +59,6 @@ static void cpu_v7_spectre_init(void)
 
         case ARM_CPU_PART_CORTEX_A15:
         case ARM_CPU_PART_BRAHMA_B15:
-                if (processor.switch_mm != cpu_v7_iciallu_switch_mm)
-                        goto bl_error;
                 per_cpu(harden_branch_predictor_fn, cpu) =
                         harden_branch_predictor_iciallu;
                 spectre_v2_method = "ICIALLU";
@@ -88,11 +84,9 @@ static void cpu_v7_spectre_init(void)
                                           ARM_SMCCC_ARCH_WORKAROUND_1, &res);
                         if ((int)res.a0 != 0)
                                 break;
-                        if (processor.switch_mm != cpu_v7_hvc_switch_mm && cpu)
-                                goto bl_error;
                         per_cpu(harden_branch_predictor_fn, cpu) =
                                 call_hvc_arch_workaround_1;
-                        processor.switch_mm = cpu_v7_hvc_switch_mm;
+                        cpu_do_switch_mm = cpu_v7_hvc_switch_mm;
                         spectre_v2_method = "hypervisor";
                         break;
 
@@ -101,11 +95,9 @@ static void cpu_v7_spectre_init(void)
                                           ARM_SMCCC_ARCH_WORKAROUND_1, &res);
                         if ((int)res.a0 != 0)
                                 break;
-                        if (processor.switch_mm != cpu_v7_smc_switch_mm && cpu)
-                                goto bl_error;
                         per_cpu(harden_branch_predictor_fn, cpu) =
                                 call_smc_arch_workaround_1;
-                        processor.switch_mm = cpu_v7_smc_switch_mm;
+                        cpu_do_switch_mm = cpu_v7_smc_switch_mm;
                         spectre_v2_method = "firmware";
                         break;
 
@@ -119,11 +111,6 @@ static void cpu_v7_spectre_init(void)
         if (spectre_v2_method)
                 pr_info("CPU%u: Spectre v2: using %s workaround\n",
                         smp_processor_id(), spectre_v2_method);
-        return;
-
-bl_error:
-        pr_err("CPU%u: Spectre v2: incorrect context switching function, system vulnerable\n",
-                cpu);
 }
 #else
 static void cpu_v7_spectre_init(void)
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index aff6e6eadc70..ee7b07938dd5 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -573,7 +573,7 @@ int vfp_preserve_user_clear_hwstate(struct user_vfp *ufp,
          */
         ufp_exc->fpexc = hwstate->fpexc;
         ufp_exc->fpinst = hwstate->fpinst;
-        ufp_exc->fpinst2 = ufp_exc->fpinst2;
+        ufp_exc->fpinst2 = hwstate->fpinst2;
 
         /* Ensure that VFP is disabled. */
         vfp_flush_hwstate(thread);
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index 953e316521fc..f4fc1e0544b7 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -313,6 +313,7 @@ void __init setup_arch(char **cmdline_p)
         arm64_memblock_init();
 
         paging_init();
+        efi_apply_persistent_mem_reservations();
 
         acpi_table_upgrade();
 
diff --git a/arch/parisc/include/asm/spinlock.h b/arch/parisc/include/asm/spinlock.h
index 16aec9ba2580..8a63515f03bf 100644
--- a/arch/parisc/include/asm/spinlock.h
+++ b/arch/parisc/include/asm/spinlock.h
@@ -37,8 +37,8 @@ static inline void arch_spin_unlock(arch_spinlock_t *x)
         volatile unsigned int *a;
 
         a = __ldcw_align(x);
-        /* Release with ordered store. */
-        __asm__ __volatile__("stw,ma %0,0(%1)" : : "r"(1), "r"(a) : "memory");
+        mb();
+        *a = 1;
 }
 
 static inline int arch_spin_trylock(arch_spinlock_t *x)
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index 9505c317818d..a9bc90dc4ae7 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -640,7 +640,8 @@ cas_action:
         sub,<>  %r28, %r25, %r0
 2:      stw     %r24, 0(%r26)
         /* Free lock */
-        stw,ma  %r20, 0(%sr2,%r20)
+        sync
+        stw     %r20, 0(%sr2,%r20)
 #if ENABLE_LWS_DEBUG
         /* Clear thread register indicator */
         stw     %r0, 4(%sr2,%r20)
@@ -654,7 +655,8 @@ cas_action:
 3:              
         /* Error occurred on load or store */
         /* Free lock */
-        stw,ma  %r20, 0(%sr2,%r20)
+        sync
+        stw     %r20, 0(%sr2,%r20)
 #if ENABLE_LWS_DEBUG
         stw     %r0, 4(%sr2,%r20)
 #endif
@@ -855,7 +857,8 @@ cas2_action:
 
 cas2_end:
         /* Free lock */
-        stw,ma  %r20, 0(%sr2,%r20)
+        sync
+        stw     %r20, 0(%sr2,%r20)
         /* Enable interrupts */
         ssm     PSW_SM_I, %r0
         /* Return to userspace, set no error */
@@ -865,7 +868,8 @@ cas2_end:
 22:
         /* Error occurred on load or store */
         /* Free lock */
-        stw,ma  %r20, 0(%sr2,%r20)
+        sync
+        stw     %r20, 0(%sr2,%r20)
         ssm     PSW_SM_I, %r0
         ldo     1(%r0),%r28
         b       lws_exit
diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h
index 3ef40b703c4a..e746becd9d6f 100644
--- a/arch/powerpc/include/asm/io.h
+++ b/arch/powerpc/include/asm/io.h
@@ -268,19 +268,13 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,
  * their hooks, a bitfield is reserved for use by the platform near the
  * top of MMIO addresses (not PIO, those have to cope the hard way).
  *
- * This bit field is 12 bits and is at the top of the IO virtual
- * addresses PCI_IO_INDIRECT_TOKEN_MASK.
+ * The highest address in the kernel virtual space are:
  *
- * The kernel virtual space is thus:
+ *  d0003fffffffffff    # with Hash MMU
+ *  c00fffffffffffff    # with Radix MMU
  *
- *  0xD000000000000000          : vmalloc
- *  0xD000080000000000          : PCI PHB IO space
- *  0xD000080080000000          : ioremap
- *  0xD0000fffffffffff          : end of ioremap region
- *
- * Since the top 4 bits are reserved as the region ID, we use thus
- * the next 12 bits and keep 4 bits available for the future if the
- * virtual address space is ever to be extended.
+ * The top 4 bits are reserved as the region ID on hash, leaving us 8 bits
+ * that can be used for the field.
  *
  * The direct IO mapping operations will then mask off those bits
  * before doing the actual access, though that only happen when
@@ -292,8 +286,8 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,
  */
 
 #ifdef CONFIG_PPC_INDIRECT_MMIO
-#define PCI_IO_IND_TOKEN_MASK   0x0fff000000000000ul
-#define PCI_IO_IND_TOKEN_SHIFT  48
+#define PCI_IO_IND_TOKEN_SHIFT  52
+#define PCI_IO_IND_TOKEN_MASK   (0xfful << PCI_IO_IND_TOKEN_SHIFT)
 #define PCI_FIX_ADDR(addr)                                              \
         ((PCI_IO_ADDR)(((unsigned long)(addr)) & ~PCI_IO_IND_TOKEN_MASK))
 #define PCI_GET_ADDR_TOKEN(addr)                                        \
diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
index 6093bc8f74e5..a6e9e314c707 100644
--- a/arch/powerpc/include/asm/ppc-opcode.h
+++ b/arch/powerpc/include/asm/ppc-opcode.h
@@ -493,6 +493,8 @@
                                         __PPC_RS(t) | __PPC_RA0(a) | __PPC_RB(b))
 #define PPC_SLBFEE_DOT(t, b)    stringify_in_c(.long PPC_INST_SLBFEE | \
                                         __PPC_RT(t) | __PPC_RB(b))
+#define __PPC_SLBFEE_DOT(t, b)  stringify_in_c(.long PPC_INST_SLBFEE |  \
+                                               ___PPC_RT(t) | ___PPC_RB(b))
 #define PPC_ICBT(c,a,b)         stringify_in_c(.long PPC_INST_ICBT | \
                                        __PPC_CT(c) | __PPC_RA0(a) | __PPC_RB(b))
 /* PASemi instructions */
diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h
index f73886a1a7f5..0b8a735b6d85 100644
--- a/arch/powerpc/include/asm/ptrace.h
+++ b/arch/powerpc/include/asm/ptrace.h
@@ -54,6 +54,7 @@ struct pt_regs
 
 #ifdef CONFIG_PPC64
         unsigned long ppr;
+        unsigned long __pad;    /* Maintain 16 byte interrupt stack alignment */
 #endif
 };
 #endif
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 2a51e4cc8246..236c1151a3a7 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -636,6 +636,8 @@ static void *__init alloc_stack(unsigned long limit, int cpu)
 {
         unsigned long pa;
 
+        BUILD_BUG_ON(STACK_INT_FRAME_SIZE % 16);
+
         pa = memblock_alloc_base_nid(THREAD_SIZE, THREAD_SIZE, limit,
                                         early_cpu_to_node(cpu), MEMBLOCK_NONE);
         if (!pa) {
diff --git a/arch/powerpc/kvm/trace.h b/arch/powerpc/kvm/trace.h
index 491b0f715d6b..ea1d7c808319 100644
--- a/arch/powerpc/kvm/trace.h
+++ b/arch/powerpc/kvm/trace.h
@@ -6,8 +6,6 @@
 
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM kvm
-#define TRACE_INCLUDE_PATH .
-#define TRACE_INCLUDE_FILE trace
 
 /*
  * Tracepoint for guest mode entry.
@@ -120,4 +118,10 @@ TRACE_EVENT(kvm_check_requests,
 #endif /* _TRACE_KVM_H */
 
 /* This part must be outside protection */
+#undef TRACE_INCLUDE_PATH
+#undef TRACE_INCLUDE_FILE
+
+#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_FILE trace
+
 #include <trace/define_trace.h>
diff --git a/arch/powerpc/kvm/trace_booke.h b/arch/powerpc/kvm/trace_booke.h
index ac640e81fdc5..3837842986aa 100644
--- a/arch/powerpc/kvm/trace_booke.h
+++ b/arch/powerpc/kvm/trace_booke.h
@@ -6,8 +6,6 @@
 
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM kvm_booke
-#define TRACE_INCLUDE_PATH .
-#define TRACE_INCLUDE_FILE trace_booke
 
 #define kvm_trace_symbol_exit \
         {0, "CRITICAL"}, \
@@ -218,4 +216,11 @@ TRACE_EVENT(kvm_booke_queue_irqprio,
 #endif
 
 /* This part must be outside protection */
+
+#undef TRACE_INCLUDE_PATH
+#undef TRACE_INCLUDE_FILE
+
+#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_FILE trace_booke
+
 #include <trace/define_trace.h>
diff --git a/arch/powerpc/kvm/trace_hv.h b/arch/powerpc/kvm/trace_hv.h
index bcfe8a987f6a..8a1e3b0047f1 100644
--- a/arch/powerpc/kvm/trace_hv.h
+++ b/arch/powerpc/kvm/trace_hv.h
@@ -9,8 +9,6 @@
 
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM kvm_hv
-#define TRACE_INCLUDE_PATH .
-#define TRACE_INCLUDE_FILE trace_hv
 
 #define kvm_trace_symbol_hcall \
         {H_REMOVE,                      "H_REMOVE"}, \
@@ -497,4 +495,11 @@ TRACE_EVENT(kvmppc_run_vcpu_exit,
 #endif /* _TRACE_KVM_HV_H */
 
 /* This part must be outside protection */
+
+#undef TRACE_INCLUDE_PATH
+#undef TRACE_INCLUDE_FILE
+
+#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_FILE trace_hv
+
 #include <trace/define_trace.h>
diff --git a/arch/powerpc/kvm/trace_pr.h b/arch/powerpc/kvm/trace_pr.h
index 2f9a8829552b..46a46d328fbf 100644
--- a/arch/powerpc/kvm/trace_pr.h
+++ b/arch/powerpc/kvm/trace_pr.h
@@ -8,8 +8,6 @@
 
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM kvm_pr
-#define TRACE_INCLUDE_PATH .
-#define TRACE_INCLUDE_FILE trace_pr
 
 TRACE_EVENT(kvm_book3s_reenter,
         TP_PROTO(int r, struct kvm_vcpu *vcpu),
@@ -257,4 +255,11 @@ TRACE_EVENT(kvm_exit,
 #endif /* _TRACE_KVM_H */
 
 /* This part must be outside protection */
+
+#undef TRACE_INCLUDE_PATH
+#undef TRACE_INCLUDE_FILE
+
+#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_FILE trace_pr
+
 #include <trace/define_trace.h>
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 3a048e98a132..ce28ae5ca080 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -1178,7 +1178,7 @@ static long vphn_get_associativity(unsigned long cpu,
 
         switch (rc) {
         case H_FUNCTION:
-                printk(KERN_INFO
+                printk_once(KERN_INFO
                         "VPHN is not supported. Disabling polling...\n");
                 stop_topology_update();
                 break;
diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c
index c3fdf2969d9f..bc3914d54e26 100644
--- a/arch/powerpc/mm/slb.c
+++ b/arch/powerpc/mm/slb.c
@@ -19,6 +19,7 @@
 #include <asm/mmu.h>
 #include <asm/mmu_context.h>
 #include <asm/paca.h>
+#include <asm/ppc-opcode.h>
 #include <asm/cputable.h>
 #include <asm/cacheflush.h>
 #include <asm/smp.h>
@@ -58,27 +59,19 @@ static inline unsigned long mk_vsid_data(unsigned long ea, int ssize,
         return __mk_vsid_data(get_kernel_vsid(ea, ssize), ssize, flags);
 }
 
-static void assert_slb_exists(unsigned long ea)
+static void assert_slb_presence(bool present, unsigned long ea)
 {
 #ifdef CONFIG_DEBUG_VM
         unsigned long tmp;
 
         WARN_ON_ONCE(mfmsr() & MSR_EE);
 
-        asm volatile("slbfee. %0, %1" : "=r"(tmp) : "r"(ea) : "cr0");
-        WARN_ON(tmp == 0);
-#endif
-}
-
-static void assert_slb_notexists(unsigned long ea)
-{
-#ifdef CONFIG_DEBUG_VM
-        unsigned long tmp;
+        if (!cpu_has_feature(CPU_FTR_ARCH_206))
+                return;
 
-        WARN_ON_ONCE(mfmsr() & MSR_EE);
+        asm volatile(__PPC_SLBFEE_DOT(%0, %1) : "=r"(tmp) : "r"(ea) : "cr0");
 
-        asm volatile("slbfee. %0, %1" : "=r"(tmp) : "r"(ea) : "cr0");
-        WARN_ON(tmp != 0);
+        WARN_ON(present == (tmp == 0));
 #endif
 }
 
@@ -114,7 +107,7 @@ static inline void create_shadowed_slbe(unsigned long ea, int ssize,
          */
         slb_shadow_update(ea, ssize, flags, index);
 
-        assert_slb_notexists(ea);
+        assert_slb_presence(false, ea);
         asm volatile("slbmte  %0,%1" :
                      : "r" (mk_vsid_data(ea, ssize, flags)),
                        "r" (mk_esid_data(ea, ssize, index))
@@ -137,7 +130,7 @@ void __slb_restore_bolted_realmode(void)
                        "r" (be64_to_cpu(p->save_area[index].esid)));
         }
 
-        assert_slb_exists(local_paca->kstack);
+        assert_slb_presence(true, local_paca->kstack);
 }
 
 /*
@@ -185,7 +178,7 @@ void slb_flush_and_restore_bolted(void)
                      :: "r" (be64_to_cpu(p->save_area[KSTACK_INDEX].vsid)),
                         "r" (be64_to_cpu(p->save_area[KSTACK_INDEX].esid))
                      : "memory");
-        assert_slb_exists(get_paca()->kstack);
+        assert_slb_presence(true, get_paca()->kstack);
 
         get_paca()->slb_cache_ptr = 0;
 
@@ -443,9 +436,9 @@ void switch_slb(struct task_struct *tsk, struct mm_struct *mm)
                                 ea = (unsigned long)
                                         get_paca()->slb_cache[i] << SID_SHIFT;
                                 /*
-                                 * Could assert_slb_exists here, but hypervisor
-                                 * or machine check could have come in and
-                                 * removed the entry at this point.
+                                 * Could assert_slb_presence(true) here, but
+                                 * hypervisor or machine check could have come
+                                 * in and removed the entry at this point.
                                  */
 
                                 slbie_data = ea;
@@ -676,7 +669,7 @@ static long slb_insert_entry(unsigned long ea, unsigned long context,
          * User preloads should add isync afterwards in case the kernel
          * accesses user memory before it returns to userspace with rfid.
          */
-        assert_slb_notexists(ea);
+        assert_slb_presence(false, ea);
         asm volatile("slbmte %0, %1" : : "r" (vsid_data), "r" (esid_data));
 
         barrier();
@@ -715,7 +708,7 @@ static long slb_allocate_kernel(unsigned long ea, unsigned long id)
                         return -EFAULT;
 
                 if (ea < H_VMALLOC_END)
-                        flags = get_paca()->vmalloc_sllp;
+                        flags = local_paca->vmalloc_sllp;
                 else
                         flags = SLB_VSID_KERNEL | mmu_psize_defs[mmu_io_psize].sllp;
         } else {
diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c
index 6f60e0931922..75b935252981 100644
--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -102,63 +102,6 @@ struct pci_dev *pnv_pci_get_npu_dev(struct pci_dev *gpdev, int index)
 }
 EXPORT_SYMBOL(pnv_pci_get_npu_dev);
 
-#define NPU_DMA_OP_UNSUPPORTED()                                        \
-        dev_err_once(dev, "%s operation unsupported for NVLink devices\n", \
-                __func__)
-
-static void *dma_npu_alloc(struct device *dev, size_t size,
-                           dma_addr_t *dma_handle, gfp_t flag,
-                           unsigned long attrs)
-{
-        NPU_DMA_OP_UNSUPPORTED();
-        return NULL;
-}
-
-static void dma_npu_free(struct device *dev, size_t size,
-                         void *vaddr, dma_addr_t dma_handle,
-                         unsigned long attrs)
-{
-        NPU_DMA_OP_UNSUPPORTED();
-}
-
-static dma_addr_t dma_npu_map_page(struct device *dev, struct page *page,
-                                   unsigned long offset, size_t size,
-                                   enum dma_data_direction direction,
-                                   unsigned long attrs)
-{
-        NPU_DMA_OP_UNSUPPORTED();
-        return 0;
-}
-
-static int dma_npu_map_sg(struct device *dev, struct scatterlist *sglist,
-                          int nelems, enum dma_data_direction direction,
-                          unsigned long attrs)
-{
-        NPU_DMA_OP_UNSUPPORTED();
-        return 0;
-}
-
-static int dma_npu_dma_supported(struct device *dev, u64 mask)
-{
-        NPU_DMA_OP_UNSUPPORTED();
-        return 0;
-}
-
-static u64 dma_npu_get_required_mask(struct device *dev)
-{
-        NPU_DMA_OP_UNSUPPORTED();
-        return 0;
-}
-
-static const struct dma_map_ops dma_npu_ops = {
-        .map_page               = dma_npu_map_page,
-        .map_sg                 = dma_npu_map_sg,
-        .alloc                  = dma_npu_alloc,
-        .free                   = dma_npu_free,
-        .dma_supported          = dma_npu_dma_supported,
-        .get_required_mask      = dma_npu_get_required_mask,
-};
-
 /*
  * Returns the PE assoicated with the PCI device of the given
  * NPU. Returns the linked pci device if pci_dev != NULL.
@@ -270,10 +213,11 @@ static void pnv_npu_dma_set_32(struct pnv_ioda_pe *npe)
         rc = pnv_npu_set_window(npe, 0, gpe->table_group.tables[0]);
 
         /*
-         * We don't initialise npu_pe->tce32_table as we always use
-         * dma_npu_ops which are nops.
+         * NVLink devices use the same TCE table configuration as
+         * their parent device so drivers shouldn't be doing DMA
+         * operations directly on these devices.
          */
-        set_dma_ops(&npe->pdev->dev, &dma_npu_ops);
+        set_dma_ops(&npe->pdev->dev, NULL);
 }
 
 /*
diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
index d10146197533..4af153a182b0 100644
--- a/arch/riscv/Makefile
+++ b/arch/riscv/Makefile
@@ -77,4 +77,8 @@ core-y += arch/riscv/kernel/ arch/riscv/mm/
 
 libs-y += arch/riscv/lib/
 
+PHONY += vdso_install
+vdso_install:
+        $(Q)$(MAKE) $(build)=arch/riscv/kernel/vdso $@
+
 all: vmlinux
diff --git a/arch/riscv/configs/defconfig b/arch/riscv/configs/defconfig
index 07fa9ea75fea..ef4f15df9adf 100644
--- a/arch/riscv/configs/defconfig
+++ b/arch/riscv/configs/defconfig
@@ -76,4 +76,5 @@ CONFIG_NFS_V4_1=y
 CONFIG_NFS_V4_2=y
 CONFIG_ROOT_NFS=y
 CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_PRINTK_TIME=y
 # CONFIG_RCU_TRACE is not set
diff --git a/arch/riscv/include/asm/ptrace.h b/arch/riscv/include/asm/ptrace.h
index 2c5df945d43c..bbe1862e8f80 100644
--- a/arch/riscv/include/asm/ptrace.h
+++ b/arch/riscv/include/asm/ptrace.h
@@ -56,8 +56,8 @@ struct pt_regs {
         unsigned long sstatus;
         unsigned long sbadaddr;
         unsigned long scause;
-        /* a0 value before the syscall */
-        unsigned long orig_a0;
+        /* a0 value before the syscall */
+        unsigned long orig_a0;
 };
 
 #ifdef CONFIG_64BIT
diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
index 3303ed2cd419..7dd308129b40 100644
--- a/arch/riscv/kernel/module.c
+++ b/arch/riscv/kernel/module.c
@@ -21,7 +21,7 @@ static int apply_r_riscv_32_rela(struct module *me, u32 *location, Elf_Addr v)
 {
         if (v != (u32)v) {
                 pr_err("%s: value %016llx out of range for 32-bit field\n",
-                       me->name, v);
+                       me->name, (long long)v);
                 return -EINVAL;
         }
         *location = v;
@@ -102,7 +102,7 @@ static int apply_r_riscv_pcrel_hi20_rela(struct module *me, u32 *location,
         if (offset != (s32)offset) {
                 pr_err(
                   "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
-                  me->name, v, location);
+                  me->name, (long long)v, location);
                 return -EINVAL;
         }
 
@@ -144,7 +144,7 @@ static int apply_r_riscv_hi20_rela(struct module *me, u32 *location,
         if (IS_ENABLED(CMODEL_MEDLOW)) {
                 pr_err(
                   "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
-                  me->name, v, location);
+                  me->name, (long long)v, location);
                 return -EINVAL;
         }
 
@@ -188,7 +188,7 @@ static int apply_r_riscv_got_hi20_rela(struct module *me, u32 *location,
         } else {
                 pr_err(
                   "%s: can not generate the GOT entry for symbol = %016llx from PC = %p\n",
-                  me->name, v, location);
+                  me->name, (long long)v, location);
                 return -EINVAL;
         }
 
@@ -212,7 +212,7 @@ static int apply_r_riscv_call_plt_rela(struct module *me, u32 *location,
                 } else {
                         pr_err(
                           "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
-                          me->name, v, location);
+                          me->name, (long long)v, location);
                         return -EINVAL;
                 }
         }
@@ -234,7 +234,7 @@ static int apply_r_riscv_call_rela(struct module *me, u32 *location,
         if (offset != fill_v) {
                 pr_err(
                   "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
-                  me->name, v, location);
+                  me->name, (long long)v, location);
                 return -EINVAL;
         }
 
diff --git a/arch/riscv/lib/Makefile b/arch/riscv/lib/Makefile
index 5739bd05d289..4e2e600f7d53 100644
--- a/arch/riscv/lib/Makefile
+++ b/arch/riscv/lib/Makefile
@@ -3,6 +3,6 @@ lib-y	+= memcpy.o
 lib-y   += memset.o
 lib-y   += uaccess.o
 
-lib-(CONFIG_64BIT) += tishift.o
+lib-$(CONFIG_64BIT) += tishift.o
 
 lib-$(CONFIG_32BIT) += udivdi3.o
diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h
index be9bfd9aa865..34a23016dd14 100644
--- a/arch/xtensa/include/asm/processor.h
+++ b/arch/xtensa/include/asm/processor.h
@@ -23,7 +23,11 @@
 # error Linux requires the Xtensa Windowed Registers Option.
 #endif
 
-#define ARCH_SLAB_MINALIGN      XCHAL_DATA_WIDTH
+/* Xtensa ABI requires stack alignment to be at least 16 */
+
+#define STACK_ALIGN (XCHAL_DATA_WIDTH > 16 ? XCHAL_DATA_WIDTH : 16)
+
+#define ARCH_SLAB_MINALIGN STACK_ALIGN
 
 /*
  * User space process size: 1 GB.
diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
index 2f76118ecf62..9053a5622d2c 100644
--- a/arch/xtensa/kernel/head.S
+++ b/arch/xtensa/kernel/head.S
@@ -88,9 +88,12 @@ _SetupMMU:
         initialize_mmu
 #if defined(CONFIG_MMU) && XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY
         rsr     a2, excsave1
-        movi    a3, 0x08000000
+        movi    a3, XCHAL_KSEG_PADDR
+        bltu    a2, a3, 1f
+        sub     a2, a2, a3
+        movi    a3, XCHAL_KSEG_SIZE
         bgeu    a2, a3, 1f
-        movi    a3, 0xd0000000
+        movi    a3, XCHAL_KSEG_CACHED_VADDR
         add     a2, a2, a3
         wsr     a2, excsave1
 1:
diff --git a/block/bio.c b/block/bio.c
index a50d59236b19..4f4d9884443b 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -605,6 +605,7 @@ void __bio_clone_fast(struct bio *bio, struct bio *bio_src)
         if (bio_flagged(bio_src, BIO_THROTTLED))
                 bio_set_flag(bio, BIO_THROTTLED);
         bio->bi_opf = bio_src->bi_opf;
+        bio->bi_ioprio = bio_src->bi_ioprio;
         bio->bi_write_hint = bio_src->bi_write_hint;
         bio->bi_iter = bio_src->bi_iter;
         bio->bi_io_vec = bio_src->bi_io_vec;
diff --git a/block/blk-core.c b/block/blk-core.c
index ce12515f9b9b..deb56932f8c4 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -798,9 +798,8 @@ void blk_cleanup_queue(struct request_queue *q)
          * dispatch may still be in-progress since we dispatch requests
          * from more than one contexts.
          *
-         * No need to quiesce queue if it isn't initialized yet since
-         * blk_freeze_queue() should be enough for cases of passthrough
-         * request.
+         * We rely on driver to deal with the race in case that queue
+         * initialization isn't done.
          */
         if (q->mq_ops && blk_queue_init_done(q))
                 blk_mq_quiesce_queue(q);
diff --git a/block/blk-lib.c b/block/blk-lib.c
index e8b3bb9bf375..5f2c429d4378 100644
--- a/block/blk-lib.c
+++ b/block/blk-lib.c
@@ -55,9 +55,11 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
                 return -EINVAL;
 
         while (nr_sects) {
-                unsigned int req_sects = min_t(unsigned int, nr_sects,
+                sector_t req_sects = min_t(sector_t, nr_sects,
                                 bio_allowed_max_sectors(q));
 
+                WARN_ON_ONCE((req_sects << 9) > UINT_MAX);
+
                 bio = blk_next_bio(bio, 0, gfp_mask);
                 bio->bi_iter.bi_sector = sector;
                 bio_set_dev(bio, bdev);
diff --git a/block/bounce.c b/block/bounce.c
index 36869afc258c..559c55bda040 100644
--- a/block/bounce.c
+++ b/block/bounce.c
@@ -248,6 +248,7 @@ static struct bio *bounce_clone_bio(struct bio *bio_src, gfp_t gfp_mask,
                 return NULL;
         bio->bi_disk            = bio_src->bi_disk;
         bio->bi_opf             = bio_src->bi_opf;
+        bio->bi_ioprio          = bio_src->bi_ioprio;
         bio->bi_write_hint      = bio_src->bi_write_hint;
         bio->bi_iter.bi_sector  = bio_src->bi_iter.bi_sector;
         bio->bi_iter.bi_size    = bio_src->bi_iter.bi_size;
diff --git a/crypto/crypto_user_base.c b/crypto/crypto_user_base.c
index e41f6cc33fff..784748dbb19f 100644
--- a/crypto/crypto_user_base.c
+++ b/crypto/crypto_user_base.c
@@ -84,7 +84,7 @@ static int crypto_report_cipher(struct sk_buff *skb, struct crypto_alg *alg)
 {
         struct crypto_report_cipher rcipher;
 
-        strlcpy(rcipher.type, "cipher", sizeof(rcipher.type));
+        strncpy(rcipher.type, "cipher", sizeof(rcipher.type));
 
         rcipher.blocksize = alg->cra_blocksize;
         rcipher.min_keysize = alg->cra_cipher.cia_min_keysize;
@@ -103,7 +103,7 @@ static int crypto_report_comp(struct sk_buff *skb, struct crypto_alg *alg)
 {
         struct crypto_report_comp rcomp;
 
-        strlcpy(rcomp.type, "compression", sizeof(rcomp.type));
+        strncpy(rcomp.type, "compression", sizeof(rcomp.type));
         if (nla_put(skb, CRYPTOCFGA_REPORT_COMPRESS,
                     sizeof(struct crypto_report_comp), &rcomp))
                 goto nla_put_failure;
@@ -117,7 +117,7 @@ static int crypto_report_acomp(struct sk_buff *skb, struct crypto_alg *alg)
 {
         struct crypto_report_acomp racomp;
 
-        strlcpy(racomp.type, "acomp", sizeof(racomp.type));
+        strncpy(racomp.type, "acomp", sizeof(racomp.type));
 
         if (nla_put(skb, CRYPTOCFGA_REPORT_ACOMP,
                     sizeof(struct crypto_report_acomp), &racomp))
@@ -132,7 +132,7 @@ static int crypto_report_akcipher(struct sk_buff *skb, struct crypto_alg *alg)
 {
         struct crypto_report_akcipher rakcipher;
 
-        strlcpy(rakcipher.type, "akcipher", sizeof(rakcipher.type));
+        strncpy(rakcipher.type, "akcipher", sizeof(rakcipher.type));
 
         if (nla_put(skb, CRYPTOCFGA_REPORT_AKCIPHER,
                     sizeof(struct crypto_report_akcipher), &rakcipher))
@@ -147,7 +147,7 @@ static int crypto_report_kpp(struct sk_buff *skb, struct crypto_alg *alg)
 {
         struct crypto_report_kpp rkpp;
 
-        strlcpy(rkpp.type, "kpp", sizeof(rkpp.type));
+        strncpy(rkpp.type, "kpp", sizeof(rkpp.type));
 
         if (nla_put(skb, CRYPTOCFGA_REPORT_KPP,
                     sizeof(struct crypto_report_kpp), &rkpp))
@@ -161,10 +161,10 @@ nla_put_failure:
 static int crypto_report_one(struct crypto_alg *alg,
                              struct crypto_user_alg *ualg, struct sk_buff *skb)
 {
-        strlcpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name));
-        strlcpy(ualg->cru_driver_name, alg->cra_driver_name,
+        strncpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name));
+        strncpy(ualg->cru_driver_name, alg->cra_driver_name,
                 sizeof(ualg->cru_driver_name));
-        strlcpy(ualg->cru_module_name, module_name(alg->cra_module),
+        strncpy(ualg->cru_module_name, module_name(alg->cra_module),
                 sizeof(ualg->cru_module_name));
 
         ualg->cru_type = 0;
@@ -177,7 +177,7 @@ static int crypto_report_one(struct crypto_alg *alg,
         if (alg->cra_flags & CRYPTO_ALG_LARVAL) {
                 struct crypto_report_larval rl;
 
-                strlcpy(rl.type, "larval", sizeof(rl.type));
+                strncpy(rl.type, "larval", sizeof(rl.type));
                 if (nla_put(skb, CRYPTOCFGA_REPORT_LARVAL,
                             sizeof(struct crypto_report_larval), &rl))
                         goto nla_put_failure;
diff --git a/crypto/crypto_user_stat.c b/crypto/crypto_user_stat.c
index 021ad06bbb62..1dfaa0ccd555 100644
--- a/crypto/crypto_user_stat.c
+++ b/crypto/crypto_user_stat.c
@@ -37,6 +37,8 @@ static int crypto_report_aead(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&raead, 0, sizeof(raead));
+
         strncpy(raead.type, "aead", sizeof(raead.type));
 
         v32 = atomic_read(&alg->encrypt_cnt);
@@ -65,6 +67,8 @@ static int crypto_report_cipher(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&rcipher, 0, sizeof(rcipher));
+
         strlcpy(rcipher.type, "cipher", sizeof(rcipher.type));
 
         v32 = atomic_read(&alg->encrypt_cnt);
@@ -93,6 +97,8 @@ static int crypto_report_comp(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&rcomp, 0, sizeof(rcomp));
+
         strlcpy(rcomp.type, "compression", sizeof(rcomp.type));
         v32 = atomic_read(&alg->compress_cnt);
         rcomp.stat_compress_cnt = v32;
@@ -120,6 +126,8 @@ static int crypto_report_acomp(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&racomp, 0, sizeof(racomp));
+
         strlcpy(racomp.type, "acomp", sizeof(racomp.type));
         v32 = atomic_read(&alg->compress_cnt);
         racomp.stat_compress_cnt = v32;
@@ -147,6 +155,8 @@ static int crypto_report_akcipher(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&rakcipher, 0, sizeof(rakcipher));
+
         strncpy(rakcipher.type, "akcipher", sizeof(rakcipher.type));
         v32 = atomic_read(&alg->encrypt_cnt);
         rakcipher.stat_encrypt_cnt = v32;
@@ -177,6 +187,8 @@ static int crypto_report_kpp(struct sk_buff *skb, struct crypto_alg *alg)
         struct crypto_stat rkpp;
         u32 v;
 
+        memset(&rkpp, 0, sizeof(rkpp));
+
         strlcpy(rkpp.type, "kpp", sizeof(rkpp.type));
 
         v = atomic_read(&alg->setsecret_cnt);
@@ -203,6 +215,8 @@ static int crypto_report_ahash(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&rhash, 0, sizeof(rhash));
+
         strncpy(rhash.type, "ahash", sizeof(rhash.type));
 
         v32 = atomic_read(&alg->hash_cnt);
@@ -227,6 +241,8 @@ static int crypto_report_shash(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&rhash, 0, sizeof(rhash));
+
         strncpy(rhash.type, "shash", sizeof(rhash.type));
 
         v32 = atomic_read(&alg->hash_cnt);
@@ -251,6 +267,8 @@ static int crypto_report_rng(struct sk_buff *skb, struct crypto_alg *alg)
         u64 v64;
         u32 v32;
 
+        memset(&rrng, 0, sizeof(rrng));
+
         strncpy(rrng.type, "rng", sizeof(rrng.type));
 
         v32 = atomic_read(&alg->generate_cnt);
@@ -275,6 +293,8 @@ static int crypto_reportstat_one(struct crypto_alg *alg,
                                  struct crypto_user_alg *ualg,
                                  struct sk_buff *skb)
 {
+        memset(ualg, 0, sizeof(*ualg));
+
         strlcpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name));
         strlcpy(ualg->cru_driver_name, alg->cra_driver_name,
                 sizeof(ualg->cru_driver_name));
@@ -291,6 +311,7 @@ static int crypto_reportstat_one(struct crypto_alg *alg,
         if (alg->cra_flags & CRYPTO_ALG_LARVAL) {
                 struct crypto_stat rl;
 
+                memset(&rl, 0, sizeof(rl));
                 strlcpy(rl.type, "larval", sizeof(rl.type));
                 if (nla_put(skb, CRYPTOCFGA_STAT_LARVAL,
                             sizeof(struct crypto_stat), &rl))
diff --git a/crypto/simd.c b/crypto/simd.c
index ea7240be3001..78e8d037ae2b 100644
--- a/crypto/simd.c
+++ b/crypto/simd.c
@@ -124,8 +124,9 @@ static int simd_skcipher_init(struct crypto_skcipher *tfm)
 
         ctx->cryptd_tfm = cryptd_tfm;
 
-        reqsize = sizeof(struct skcipher_request);
-        reqsize += crypto_skcipher_reqsize(&cryptd_tfm->base);
+        reqsize = crypto_skcipher_reqsize(cryptd_skcipher_child(cryptd_tfm));
+        reqsize = max(reqsize, crypto_skcipher_reqsize(&cryptd_tfm->base));
+        reqsize += sizeof(struct skcipher_request);
 
         crypto_skcipher_set_reqsize(tfm, reqsize);
 
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 8f3a444c6ea9..7cea769c37df 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -512,7 +512,7 @@ config CRC_PMIC_OPREGION
 
 config XPOWER_PMIC_OPREGION
         bool "ACPI operation region support for XPower AXP288 PMIC"
-        depends on MFD_AXP20X_I2C && IOSF_MBI
+        depends on MFD_AXP20X_I2C && IOSF_MBI=y
         help
           This config adds ACPI operation region support for XPower AXP288 PMIC.
 
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 6e594644cb1d..a7f5202a4815 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4553,7 +4553,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         /* These specific Samsung models/firmware-revs do not handle LPM well */
         { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, },
         { "SAMSUNG SSD PM830 mSATA *",  "CXM13D1Q", ATA_HORKAGE_NOLPM, },
-        { "SAMSUNG MZ7TD256HAFV-000L9", "DXT02L5Q", ATA_HORKAGE_NOLPM, },
+        { "SAMSUNG MZ7TD256HAFV-000L9", NULL,       ATA_HORKAGE_NOLPM, },
 
         /* devices that don't properly handle queued TRIM commands */
         { "Micron_M500IT_*",            "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index a8cfa011c284..fb23578e9a41 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4148,10 +4148,11 @@ static int __floppy_read_block_0(struct block_device *bdev, int drive)
         bio.bi_end_io = floppy_rb0_cb;
         bio_set_op_attrs(&bio, REQ_OP_READ, 0);
 
+        init_completion(&cbdata.complete);
+
         submit_bio(&bio);
         process_fd_request();
 
-        init_completion(&cbdata.complete);
         wait_for_completion(&cbdata.complete);
 
         __free_page(page);
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index 8cfee0ab804b..d8c3595e9023 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -160,8 +160,13 @@ static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index)
         /* Ensure the arm clock divider is what we expect */
         ret = clk_set_rate(clks[ARM].clk, new_freq * 1000);
         if (ret) {
+                int ret1;
+
                 dev_err(cpu_dev, "failed to set clock rate: %d\n", ret);
-                regulator_set_voltage_tol(arm_reg, volt_old, 0);
+                ret1 = regulator_set_voltage_tol(arm_reg, volt_old, 0);
+                if (ret1)
+                        dev_warn(cpu_dev,
+                                 "failed to restore vddarm voltage: %d\n", ret1);
                 return ret;
         }
 
diff --git a/drivers/cpuidle/cpuidle-arm.c b/drivers/cpuidle/cpuidle-arm.c
index 073557f433eb..3a407a3ef22b 100644
--- a/drivers/cpuidle/cpuidle-arm.c
+++ b/drivers/cpuidle/cpuidle-arm.c
@@ -82,7 +82,6 @@ static int __init arm_idle_init_cpu(int cpu)
 {
         int ret;
         struct cpuidle_driver *drv;
-        struct cpuidle_device *dev;
 
         drv = kmemdup(&arm_idle_driver, sizeof(*drv), GFP_KERNEL);
         if (!drv)
@@ -103,13 +102,6 @@ static int __init arm_idle_init_cpu(int cpu)
                 goto out_kfree_drv;
         }
 
-        ret = cpuidle_register_driver(drv);
-        if (ret) {
-                if (ret != -EBUSY)
-                        pr_err("Failed to register cpuidle driver\n");
-                goto out_kfree_drv;
-        }
-
         /*
          * Call arch CPU operations in order to initialize
          * idle states suspend back-end specific data
@@ -117,37 +109,21 @@ static int __init arm_idle_init_cpu(int cpu)
         ret = arm_cpuidle_init(cpu);
 
         /*
-         * Skip the cpuidle device initialization if the reported
+         * Allow the initialization to continue for other CPUs, if the reported
          * failure is a HW misconfiguration/breakage (-ENXIO).
          */
-        if (ret == -ENXIO)
-                return 0;
-
         if (ret) {
                 pr_err("CPU %d failed to init idle CPU ops\n", cpu);
-                goto out_unregister_drv;
-        }
-
-        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
-        if (!dev) {
-                ret = -ENOMEM;
-                goto out_unregister_drv;
+                ret = ret == -ENXIO ? 0 : ret;
+                goto out_kfree_drv;
         }
-        dev->cpu = cpu;
 
-        ret = cpuidle_register_device(dev);
-        if (ret) {
-                pr_err("Failed to register cpuidle device for CPU %d\n",
-                       cpu);
-                goto out_kfree_dev;
-        }
+        ret = cpuidle_register(drv, NULL);
+        if (ret)
+                goto out_kfree_drv;
 
         return 0;
 
-out_kfree_dev:
-        kfree(dev);
-out_unregister_drv:
-        cpuidle_unregister_driver(drv);
 out_kfree_drv:
         kfree(drv);
         return ret;
@@ -178,9 +154,7 @@ out_fail:
         while (--cpu >= 0) {
                 dev = per_cpu(cpuidle_devices, cpu);
                 drv = cpuidle_get_cpu_driver(dev);
-                cpuidle_unregister_device(dev);
-                cpuidle_unregister_driver(drv);
-                kfree(dev);
+                cpuidle_unregister(drv);
                 kfree(drv);
         }
 
diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c
index f7d6d690116e..cdc4f9a171d9 100644
--- a/drivers/crypto/hisilicon/sec/sec_algs.c
+++ b/drivers/crypto/hisilicon/sec/sec_algs.c
@@ -732,6 +732,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
         int *splits_in_nents;
         int *splits_out_nents = NULL;
         struct sec_request_el *el, *temp;
+        bool split = skreq->src != skreq->dst;
 
         mutex_init(&sec_req->lock);
         sec_req->req_base = &skreq->base;
@@ -750,7 +751,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
         if (ret)
                 goto err_free_split_sizes;
 
-        if (skreq->src != skreq->dst) {
+        if (split) {
                 sec_req->len_out = sg_nents(skreq->dst);
                 ret = sec_map_and_split_sg(skreq->dst, split_sizes, steps,
                                            &splits_out, &splits_out_nents,
@@ -785,8 +786,9 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
                                                split_sizes[i],
                                                skreq->src != skreq->dst,
                                                splits_in[i], splits_in_nents[i],
-                                               splits_out[i],
-                                               splits_out_nents[i], info);
+                                               split ? splits_out[i] : NULL,
+                                               split ? splits_out_nents[i] : 0,
+                                               info);
                 if (IS_ERR(el)) {
                         ret = PTR_ERR(el);
                         goto err_free_elements;
@@ -806,13 +808,6 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
          * more refined but this is unlikely to happen so no need.
          */
 
-        /* Cleanup - all elements in pointer arrays have been coppied */
-        kfree(splits_in_nents);
-        kfree(splits_in);
-        kfree(splits_out_nents);
-        kfree(splits_out);
-        kfree(split_sizes);
-
         /* Grab a big lock for a long time to avoid concurrency issues */
         mutex_lock(&queue->queuelock);
 
@@ -827,13 +822,13 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
              (!queue->havesoftqueue ||
               kfifo_avail(&queue->softqueue) > steps)) ||
             !list_empty(&ctx->backlog)) {
+                ret = -EBUSY;
                 if ((skreq->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)) {
                         list_add_tail(&sec_req->backlog_head, &ctx->backlog);
                         mutex_unlock(&queue->queuelock);
-                        return -EBUSY;
+                        goto out;
                 }
 
-                ret = -EBUSY;
                 mutex_unlock(&queue->queuelock);
                 goto err_free_elements;
         }
@@ -842,7 +837,15 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
         if (ret)
                 goto err_free_elements;
 
-        return -EINPROGRESS;
+        ret = -EINPROGRESS;
+out:
+        /* Cleanup - all elements in pointer arrays have been copied */
+        kfree(splits_in_nents);
+        kfree(splits_in);
+        kfree(splits_out_nents);
+        kfree(splits_out);
+        kfree(split_sizes);
+        return ret;
 
 err_free_elements:
         list_for_each_entry_safe(el, temp, &sec_req->elements, head) {
@@ -854,7 +857,7 @@ err_free_elements:
                                  crypto_skcipher_ivsize(atfm),
                                  DMA_BIDIRECTIONAL);
 err_unmap_out_sg:
-        if (skreq->src != skreq->dst)
+        if (split)
                 sec_unmap_sg_on_err(skreq->dst, steps, splits_out,
                                     splits_out_nents, sec_req->len_out,
                                     info->dev);
diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c
index 388a929baf95..1a6a77df8a5e 100644
--- a/drivers/firmware/efi/arm-init.c
+++ b/drivers/firmware/efi/arm-init.c
@@ -265,6 +265,10 @@ void __init efi_init(void)
                                     (params.mmap & ~PAGE_MASK)));
 
         init_screen_info();
+
+        /* ARM does not permit early mappings to persist across paging_init() */
+        if (IS_ENABLED(CONFIG_ARM))
+                efi_memmap_unmap();
 }
 
 static int __init register_gop_device(void)
diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
index 922cfb813109..a00934d263c5 100644
--- a/drivers/firmware/efi/arm-runtime.c
+++ b/drivers/firmware/efi/arm-runtime.c
@@ -110,7 +110,7 @@ static int __init arm_enable_runtime_services(void)
 {
         u64 mapsize;
 
-        if (!efi_enabled(EFI_BOOT) || !efi_enabled(EFI_MEMMAP)) {
+        if (!efi_enabled(EFI_BOOT)) {
                 pr_info("EFI services will not be available.\n");
                 return 0;
         }
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 249eb70691b0..fad7c62cfc0e 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -592,7 +592,11 @@ int __init efi_config_parse_tables(void *config_tables, int count, int sz,
 
                 early_memunmap(tbl, sizeof(*tbl));
         }
+        return 0;
+}
 
+int __init efi_apply_persistent_mem_reservations(void)
+{
         if (efi.mem_reserve != EFI_INVALID_TABLE_ADDR) {
                 unsigned long prsv = efi.mem_reserve;
 
@@ -963,36 +967,43 @@ bool efi_is_table_address(unsigned long phys_addr)
 }
 
 static DEFINE_SPINLOCK(efi_mem_reserve_persistent_lock);
+static struct linux_efi_memreserve *efi_memreserve_root __ro_after_init;
 
 int efi_mem_reserve_persistent(phys_addr_t addr, u64 size)
 {
-        struct linux_efi_memreserve *rsv, *parent;
+        struct linux_efi_memreserve *rsv;
 
-        if (efi.mem_reserve == EFI_INVALID_TABLE_ADDR)
+        if (!efi_memreserve_root)
                 return -ENODEV;
 
-        rsv = kmalloc(sizeof(*rsv), GFP_KERNEL);
+        rsv = kmalloc(sizeof(*rsv), GFP_ATOMIC);
         if (!rsv)
                 return -ENOMEM;
 
-        parent = memremap(efi.mem_reserve, sizeof(*rsv), MEMREMAP_WB);
-        if (!parent) {
-                kfree(rsv);
-                return -ENOMEM;
-        }
-
         rsv->base = addr;
         rsv->size = size;
 
         spin_lock(&efi_mem_reserve_persistent_lock);
-        rsv->next = parent->next;
-        parent->next = __pa(rsv);
+        rsv->next = efi_memreserve_root->next;
+        efi_memreserve_root->next = __pa(rsv);
         spin_unlock(&efi_mem_reserve_persistent_lock);
 
-        memunmap(parent);
+        return 0;
+}
 
+static int __init efi_memreserve_root_init(void)
+{
+        if (efi.mem_reserve == EFI_INVALID_TABLE_ADDR)
+                return -ENODEV;
+
+        efi_memreserve_root = memremap(efi.mem_reserve,
+                                       sizeof(*efi_memreserve_root),
+                                       MEMREMAP_WB);
+        if (!efi_memreserve_root)
+                return -ENOMEM;
         return 0;
 }
+early_initcall(efi_memreserve_root_init);
 
 #ifdef CONFIG_KEXEC
 static int update_efi_random_seed(struct notifier_block *nb,
diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
index 30ac0c975f8a..3d36142cf812 100644
--- a/drivers/firmware/efi/libstub/arm-stub.c
+++ b/drivers/firmware/efi/libstub/arm-stub.c
@@ -75,6 +75,9 @@ void install_memreserve_table(efi_system_table_t *sys_table_arg)
         efi_guid_t memreserve_table_guid = LINUX_EFI_MEMRESERVE_TABLE_GUID;
         efi_status_t status;
 
+        if (IS_ENABLED(CONFIG_ARM))
+                return;
+
         status = efi_call_early(allocate_pool, EFI_LOADER_DATA, sizeof(*rsv),
                                 (void **)&rsv);
         if (status != EFI_SUCCESS) {
diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
index 8830fa601e45..0c0d2312f4a8 100644
--- a/drivers/firmware/efi/libstub/fdt.c
+++ b/drivers/firmware/efi/libstub/fdt.c
@@ -158,6 +158,10 @@ static efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt,
                         return efi_status;
                 }
         }
+
+        /* shrink the FDT back to its minimum size */
+        fdt_pack(fdt);
+
         return EFI_SUCCESS;
 
 fdt_set_fail:
diff --git a/drivers/firmware/efi/memmap.c b/drivers/firmware/efi/memmap.c
index fa2904fb841f..38b686c67b17 100644
--- a/drivers/firmware/efi/memmap.c
+++ b/drivers/firmware/efi/memmap.c
@@ -118,6 +118,9 @@ int __init efi_memmap_init_early(struct efi_memory_map_data *data)
 
 void __init efi_memmap_unmap(void)
 {
+        if (!efi_enabled(EFI_MEMMAP))
+                return;
+
         if (!efi.memmap.late) {
                 unsigned long size;
 
diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
index a19d845bdb06..8903b9ccfc2b 100644
--- a/drivers/firmware/efi/runtime-wrappers.c
+++ b/drivers/firmware/efi/runtime-wrappers.c
@@ -67,7 +67,7 @@ struct efi_runtime_work efi_rts_work;
         }                                                               \
                                                                         \
         init_completion(&efi_rts_work.efi_rts_comp);                    \
-        INIT_WORK_ONSTACK(&efi_rts_work.work, efi_call_rts);            \
+        INIT_WORK(&efi_rts_work.work, efi_call_rts);                    \
         efi_rts_work.arg1 = _arg1;                                      \
         efi_rts_work.arg2 = _arg2;                                      \
         efi_rts_work.arg3 = _arg3;                                      \
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 352b30409060..dad0e2342df9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -1632,13 +1632,6 @@ static int amdgpu_vm_update_ptes(struct amdgpu_pte_update_params *params,
                         continue;
                 }
 
-                /* First check if the entry is already handled */
-                if (cursor.pfn < frag_start) {
-                        cursor.entry->huge = true;
-                        amdgpu_vm_pt_next(adev, &cursor);
-                        continue;
-                }
-
                 /* If it isn't already handled it can't be a huge page */
                 if (cursor.entry->huge) {
                         /* Add the entry to the relocated list to update it. */
@@ -1701,8 +1694,17 @@ static int amdgpu_vm_update_ptes(struct amdgpu_pte_update_params *params,
                         }
                 } while (frag_start < entry_end);
 
-                if (frag >= shift)
+                if (amdgpu_vm_pt_descendant(adev, &cursor)) {
+                        /* Mark all child entries as huge */
+                        while (cursor.pfn < frag_start) {
+                                cursor.entry->huge = true;
+                                amdgpu_vm_pt_next(adev, &cursor);
+                        }
+
+                } else if (frag >= shift) {
+                        /* or just move on to the next on the same level. */
                         amdgpu_vm_pt_next(adev, &cursor);
+                }
         }
 
         return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c
index ceb7847b504f..bfa317ad20a9 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c
@@ -72,7 +72,7 @@ static void gfxhub_v1_0_init_system_aperture_regs(struct amdgpu_device *adev)
 
         /* Program the system aperture low logical page number. */
         WREG32_SOC15(GC, 0, mmMC_VM_SYSTEM_APERTURE_LOW_ADDR,
-                     min(adev->gmc.vram_start, adev->gmc.agp_start) >> 18);
+                     min(adev->gmc.fb_start, adev->gmc.agp_start) >> 18);
 
         if (adev->asic_type == CHIP_RAVEN && adev->rev_id >= 0x8)
                 /*
@@ -82,11 +82,11 @@ static void gfxhub_v1_0_init_system_aperture_regs(struct amdgpu_device *adev)
                  * to get rid of the VM fault and hardware hang.
                  */
                 WREG32_SOC15(GC, 0, mmMC_VM_SYSTEM_APERTURE_HIGH_ADDR,
-                             max((adev->gmc.vram_end >> 18) + 0x1,
+                             max((adev->gmc.fb_end >> 18) + 0x1,
                                  adev->gmc.agp_end >> 18));
         else
                 WREG32_SOC15(GC, 0, mmMC_VM_SYSTEM_APERTURE_HIGH_ADDR,
-                             max(adev->gmc.vram_end, adev->gmc.agp_end) >> 18);
+                             max(adev->gmc.fb_end, adev->gmc.agp_end) >> 18);
 
         /* Set default page address. */
         value = adev->vram_scratch.gpu_addr - adev->gmc.vram_start
diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
index fd23ba1226a5..a0db67adc34c 100644
--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
@@ -90,7 +90,7 @@ static void mmhub_v1_0_init_system_aperture_regs(struct amdgpu_device *adev)
 
         /* Program the system aperture low logical page number. */
         WREG32_SOC15(MMHUB, 0, mmMC_VM_SYSTEM_APERTURE_LOW_ADDR,
-                     min(adev->gmc.vram_start, adev->gmc.agp_start) >> 18);
+                     min(adev->gmc.fb_start, adev->gmc.agp_start) >> 18);
 
         if (adev->asic_type == CHIP_RAVEN && adev->rev_id >= 0x8)
                 /*
@@ -100,11 +100,11 @@ static void mmhub_v1_0_init_system_aperture_regs(struct amdgpu_device *adev)
                  * to get rid of the VM fault and hardware hang.
                  */
                 WREG32_SOC15(MMHUB, 0, mmMC_VM_SYSTEM_APERTURE_HIGH_ADDR,
-                             max((adev->gmc.vram_end >> 18) + 0x1,
+                             max((adev->gmc.fb_end >> 18) + 0x1,
                                  adev->gmc.agp_end >> 18));
         else
                 WREG32_SOC15(MMHUB, 0, mmMC_VM_SYSTEM_APERTURE_HIGH_ADDR,
-                             max(adev->gmc.vram_end, adev->gmc.agp_end) >> 18);
+                             max(adev->gmc.fb_end, adev->gmc.agp_end) >> 18);
 
         /* Set default page address. */
         value = adev->vram_scratch.gpu_addr - adev->gmc.vram_start +
diff --git a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
index a99f71797aa3..a0fda6f9252a 100644
--- a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
+++ b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
@@ -129,7 +129,7 @@ static int vega10_ih_irq_init(struct amdgpu_device *adev)
         else
                 wptr_off = adev->wb.gpu_addr + (adev->irq.ih.wptr_offs * 4);
         WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_LO, lower_32_bits(wptr_off));
-        WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_HI, upper_32_bits(wptr_off) & 0xFF);
+        WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_HI, upper_32_bits(wptr_off) & 0xFFFF);
 
         /* set rptr, wptr to 0 */
         WREG32_SOC15(OSSSYS, 0, mmIH_RB_RPTR, 0);
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
index 99a33c33a32c..101c09b212ad 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
@@ -713,20 +713,20 @@ int smu_set_watermarks_for_clocks_ranges(void *wt_table,
         for (i = 0; i < wm_with_clock_ranges->num_wm_dmif_sets; i++) {
                 table->WatermarkRow[1][i].MinClock =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_dcfclk_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_dcfclk_clk_in_khz /
+                        1000));
                 table->WatermarkRow[1][i].MaxClock =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_dcfclk_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_dcfclk_clk_in_khz /
+                        1000));
                 table->WatermarkRow[1][i].MinUclk =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_mem_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_mem_clk_in_khz /
+                        1000));
                 table->WatermarkRow[1][i].MaxUclk =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_mem_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_mem_clk_in_khz /
+                        1000));
                 table->WatermarkRow[1][i].WmSetting = (uint8_t)
                                 wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_set_id;
         }
@@ -734,20 +734,20 @@ int smu_set_watermarks_for_clocks_ranges(void *wt_table,
         for (i = 0; i < wm_with_clock_ranges->num_wm_mcif_sets; i++) {
                 table->WatermarkRow[0][i].MinClock =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_socclk_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_socclk_clk_in_khz /
+                        1000));
                 table->WatermarkRow[0][i].MaxClock =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_socclk_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_socclk_clk_in_khz /
+                        1000));
                 table->WatermarkRow[0][i].MinUclk =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_mem_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_mem_clk_in_khz /
+                        1000));
                 table->WatermarkRow[0][i].MaxUclk =
                         cpu_to_le16((uint16_t)
-                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_mem_clk_in_khz) /
-                        1000);
+                        (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_mem_clk_in_khz /
+                        1000));
                 table->WatermarkRow[0][i].WmSetting = (uint8_t)
                                 wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_set_id;
         }
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 5ff1d79b86c4..0e0df398222d 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1275,6 +1275,9 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
         mutex_lock(&mgr->lock);
         mstb = mgr->mst_primary;
 
+        if (!mstb)
+                goto out;
+
         for (i = 0; i < lct - 1; i++) {
                 int shift = (i % 2) ? 0 : 4;
                 int port_num = (rad[i / 2] >> shift) & 0xf;
diff --git a/drivers/gpu/drm/drm_fourcc.c b/drivers/gpu/drm/drm_fourcc.c
index 90a1c846fc25..8aaa5e86a979 100644
--- a/drivers/gpu/drm/drm_fourcc.c
+++ b/drivers/gpu/drm/drm_fourcc.c
@@ -97,9 +97,9 @@ EXPORT_SYMBOL(drm_mode_legacy_fb_format);
 
 /**
  * drm_driver_legacy_fb_format - compute drm fourcc code from legacy description
+ * @dev: DRM device
  * @bpp: bits per pixels
  * @depth: bit depth per pixel
- * @native: use host native byte order
  *
  * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
  * Unlike drm_mode_legacy_fb_format() this looks at the drivers mode_config,
diff --git a/drivers/gpu/drm/i915/intel_device_info.c b/drivers/gpu/drm/i915/intel_device_info.c
index 0ef0c6448d53..01fa98299bae 100644
--- a/drivers/gpu/drm/i915/intel_device_info.c
+++ b/drivers/gpu/drm/i915/intel_device_info.c
@@ -474,7 +474,7 @@ static void broadwell_sseu_info_init(struct drm_i915_private *dev_priv)
                         u8 eu_disabled_mask;
                         u32 n_disabled;
 
-                        if (!(sseu->subslice_mask[ss] & BIT(ss)))
+                        if (!(sseu->subslice_mask[s] & BIT(ss)))
                                 /* skip disabled subslice */
                                 continue;
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 23d8008a93bb..a54843fdeb2f 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4850,8 +4850,31 @@ static void cpt_verify_modeset(struct drm_device *dev, int pipe)
  * chroma samples for both of the luma samples, and thus we don't
  * actually get the expected MPEG2 chroma siting convention :(
  * The same behaviour is observed on pre-SKL platforms as well.
+ *
+ * Theory behind the formula (note that we ignore sub-pixel
+ * source coordinates):
+ * s = source sample position
+ * d = destination sample position
+ *
+ * Downscaling 4:1:
+ * -0.5
+ * | 0.0
+ * | |     1.5 (initial phase)
+ * | |     |
+ * v v     v
+ * | s | s | s | s |
+ * |       d       |
+ *
+ * Upscaling 1:4:
+ * -0.5
+ * | -0.375 (initial phase)
+ * | |     0.0
+ * | |     |
+ * v v     v
+ * |       s       |
+ * | d | d | d | d |
  */
-u16 skl_scaler_calc_phase(int sub, bool chroma_cosited)
+u16 skl_scaler_calc_phase(int sub, int scale, bool chroma_cosited)
 {
         int phase = -0x8000;
         u16 trip = 0;
@@ -4859,6 +4882,15 @@ u16 skl_scaler_calc_phase(int sub, bool chroma_cosited)
         if (chroma_cosited)
                 phase += (sub - 1) * 0x8000 / sub;
 
+        phase += scale / (2 * sub);
+
+        /*
+         * Hardware initial phase limited to [-0.5:1.5].
+         * Since the max hardware scale factor is 3.0, we
+         * should never actually excdeed 1.0 here.
+         */
+        WARN_ON(phase < -0x8000 || phase > 0x18000);
+
         if (phase < 0)
                 phase = 0x10000 + phase;
         else
@@ -5067,13 +5099,20 @@ static void skylake_pfit_enable(struct intel_crtc *crtc)
 
         if (crtc->config->pch_pfit.enabled) {
                 u16 uv_rgb_hphase, uv_rgb_vphase;
+                int pfit_w, pfit_h, hscale, vscale;
                 int id;
 
                 if (WARN_ON(crtc->config->scaler_state.scaler_id < 0))
                         return;
 
-                uv_rgb_hphase = skl_scaler_calc_phase(1, false);
-                uv_rgb_vphase = skl_scaler_calc_phase(1, false);
+                pfit_w = (crtc->config->pch_pfit.size >> 16) & 0xFFFF;
+                pfit_h = crtc->config->pch_pfit.size & 0xFFFF;
+
+                hscale = (crtc->config->pipe_src_w << 16) / pfit_w;
+                vscale = (crtc->config->pipe_src_h << 16) / pfit_h;
+
+                uv_rgb_hphase = skl_scaler_calc_phase(1, hscale, false);
+                uv_rgb_vphase = skl_scaler_calc_phase(1, vscale, false);
 
                 id = scaler_state->scaler_id;
                 I915_WRITE(SKL_PS_CTRL(pipe, id), PS_SCALER_EN |
diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
index 1b00f8ea145b..a911691dbd0f 100644
--- a/drivers/gpu/drm/i915/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/intel_dp_mst.c
@@ -452,6 +452,10 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo
         if (!intel_connector)
                 return NULL;
 
+        intel_connector->get_hw_state = intel_dp_mst_get_hw_state;
+        intel_connector->mst_port = intel_dp;
+        intel_connector->port = port;
+
         connector = &intel_connector->base;
         ret = drm_connector_init(dev, connector, &intel_dp_mst_connector_funcs,
                                  DRM_MODE_CONNECTOR_DisplayPort);
@@ -462,10 +466,6 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo
 
         drm_connector_helper_add(connector, &intel_dp_mst_connector_helper_funcs);
 
-        intel_connector->get_hw_state = intel_dp_mst_get_hw_state;
-        intel_connector->mst_port = intel_dp;
-        intel_connector->port = port;
-
         for_each_pipe(dev_priv, pipe) {
                 struct drm_encoder *enc =
                         &intel_dp->mst_encoders[pipe]->base.base;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index f8dc84b2d2d3..8b298e5f012d 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -1646,7 +1646,7 @@ void intel_mode_from_pipe_config(struct drm_display_mode *mode,
 void intel_crtc_arm_fifo_underrun(struct intel_crtc *crtc,
                                   struct intel_crtc_state *crtc_state);
 
-u16 skl_scaler_calc_phase(int sub, bool chroma_center);
+u16 skl_scaler_calc_phase(int sub, int scale, bool chroma_center);
 int skl_update_scaler_crtc(struct intel_crtc_state *crtc_state);
 int skl_max_scale(const struct intel_crtc_state *crtc_state,
                   u32 pixel_format);
diff --git a/drivers/gpu/drm/i915/intel_hotplug.c b/drivers/gpu/drm/i915/intel_hotplug.c
index 648a13c6043c..9a8018130237 100644
--- a/drivers/gpu/drm/i915/intel_hotplug.c
+++ b/drivers/gpu/drm/i915/intel_hotplug.c
@@ -228,7 +228,9 @@ static void intel_hpd_irq_storm_reenable_work(struct work_struct *work)
                 drm_for_each_connector_iter(connector, &conn_iter) {
                         struct intel_connector *intel_connector = to_intel_connector(connector);
 
-                        if (intel_connector->encoder->hpd_pin == pin) {
+                        /* Don't check MST ports, they don't have pins */
+                        if (!intel_connector->mst_port &&
+                            intel_connector->encoder->hpd_pin == pin) {
                                 if (connector->polled != intel_connector->polled)
                                         DRM_DEBUG_DRIVER("Reenabling HPD on connector %s\n",
                                                          connector->name);
@@ -395,37 +397,54 @@ void intel_hpd_irq_handler(struct drm_i915_private *dev_priv,
         struct intel_encoder *encoder;
         bool storm_detected = false;
         bool queue_dig = false, queue_hp = false;
+        u32 long_hpd_pulse_mask = 0;
+        u32 short_hpd_pulse_mask = 0;
+        enum hpd_pin pin;
 
         if (!pin_mask)
                 return;
 
         spin_lock(&dev_priv->irq_lock);
+
+        /*
+         * Determine whether ->hpd_pulse() exists for each pin, and
+         * whether we have a short or a long pulse. This is needed
+         * as each pin may have up to two encoders (HDMI and DP) and
+         * only the one of them (DP) will have ->hpd_pulse().
+         */
         for_each_intel_encoder(&dev_priv->drm, encoder) {
-                enum hpd_pin pin = encoder->hpd_pin;
                 bool has_hpd_pulse = intel_encoder_has_hpd_pulse(encoder);
+                enum port port = encoder->port;
+                bool long_hpd;
 
+                pin = encoder->hpd_pin;
                 if (!(BIT(pin) & pin_mask))
                         continue;
 
-                if (has_hpd_pulse) {
-                        bool long_hpd = long_mask & BIT(pin);
-                        enum port port = encoder->port;
+                if (!has_hpd_pulse)
+                        continue;
 
-                        DRM_DEBUG_DRIVER("digital hpd port %c - %s\n", port_name(port),
-                                         long_hpd ? "long" : "short");
-                        /*
-                         * For long HPD pulses we want to have the digital queue happen,
-                         * but we still want HPD storm detection to function.
-                         */
-                        queue_dig = true;
-                        if (long_hpd) {
-                                dev_priv->hotplug.long_port_mask |= (1 << port);
-                        } else {
-                                /* for short HPD just trigger the digital queue */
-                                dev_priv->hotplug.short_port_mask |= (1 << port);
-                                continue;
-                        }
+                long_hpd = long_mask & BIT(pin);
+
+                DRM_DEBUG_DRIVER("digital hpd port %c - %s\n", port_name(port),
+                                 long_hpd ? "long" : "short");
+                queue_dig = true;
+
+                if (long_hpd) {
+                        long_hpd_pulse_mask |= BIT(pin);
+                        dev_priv->hotplug.long_port_mask |= BIT(port);
+                } else {
+                        short_hpd_pulse_mask |= BIT(pin);
+                        dev_priv->hotplug.short_port_mask |= BIT(port);
                 }
+        }
+
+        /* Now process each pin just once */
+        for_each_hpd_pin(pin) {
+                bool long_hpd;
+
+                if (!(BIT(pin) & pin_mask))
+                        continue;
 
                 if (dev_priv->hotplug.stats[pin].state == HPD_DISABLED) {
                         /*
@@ -442,11 +461,22 @@ void intel_hpd_irq_handler(struct drm_i915_private *dev_priv,
                 if (dev_priv->hotplug.stats[pin].state != HPD_ENABLED)
                         continue;
 
-                if (!has_hpd_pulse) {
+                /*
+                 * Delegate to ->hpd_pulse() if one of the encoders for this
+                 * pin has it, otherwise let the hotplug_work deal with this
+                 * pin directly.
+                 */
+                if (((short_hpd_pulse_mask | long_hpd_pulse_mask) & BIT(pin))) {
+                        long_hpd = long_hpd_pulse_mask & BIT(pin);
+                } else {
                         dev_priv->hotplug.event_bits |= BIT(pin);
+                        long_hpd = true;
                         queue_hp = true;
                 }
 
+                if (!long_hpd)
+                        continue;
+
                 if (intel_hpd_irq_storm_detect(dev_priv, pin)) {
                         dev_priv->hotplug.event_bits &= ~BIT(pin);
                         storm_detected = true;
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 43957bb37a42..37c94a54efcb 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -424,7 +424,8 @@ static u64 execlists_update_context(struct i915_request *rq)
 
         reg_state[CTX_RING_TAIL+1] = intel_ring_set_tail(rq->ring, rq->tail);
 
-        /* True 32b PPGTT with dynamic page allocation: update PDP
+        /*
+         * True 32b PPGTT with dynamic page allocation: update PDP
          * registers and point the unallocated PDPs to scratch page.
          * PML4 is allocated during ppgtt init, so this is not needed
          * in 48-bit mode.
@@ -432,6 +433,17 @@ static u64 execlists_update_context(struct i915_request *rq)
         if (ppgtt && !i915_vm_is_48bit(&ppgtt->vm))
                 execlists_update_context_pdps(ppgtt, reg_state);
 
+        /*
+         * Make sure the context image is complete before we submit it to HW.
+         *
+         * Ostensibly, writes (including the WCB) should be flushed prior to
+         * an uncached write such as our mmio register access, the empirical
+         * evidence (esp. on Braswell) suggests that the WC write into memory
+         * may not be visible to the HW prior to the completion of the UC
+         * register write and that we may begin execution from the context
+         * before its image is complete leading to invalid PD chasing.
+         */
+        wmb();
         return ce->lrc_desc;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index d0ef50bf930a..187bb0ceb4ac 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -91,6 +91,7 @@ static int
 gen4_render_ring_flush(struct i915_request *rq, u32 mode)
 {
         u32 cmd, *cs;
+        int i;
 
         /*
          * read/write caches:
@@ -127,12 +128,45 @@ gen4_render_ring_flush(struct i915_request *rq, u32 mode)
                         cmd |= MI_INVALIDATE_ISP;
         }
 
-        cs = intel_ring_begin(rq, 2);
+        i = 2;
+        if (mode & EMIT_INVALIDATE)
+                i += 20;
+
+        cs = intel_ring_begin(rq, i);
         if (IS_ERR(cs))
                 return PTR_ERR(cs);
 
         *cs++ = cmd;
-        *cs++ = MI_NOOP;
+
+        /*
+         * A random delay to let the CS invalidate take effect? Without this
+         * delay, the GPU relocation path fails as the CS does not see
+         * the updated contents. Just as important, if we apply the flushes
+         * to the EMIT_FLUSH branch (i.e. immediately after the relocation
+         * write and before the invalidate on the next batch), the relocations
+         * still fail. This implies that is a delay following invalidation
+         * that is required to reset the caches as opposed to a delay to
+         * ensure the memory is written.
+         */
+        if (mode & EMIT_INVALIDATE) {
+                *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE;
+                *cs++ = i915_ggtt_offset(rq->engine->scratch) |
+                        PIPE_CONTROL_GLOBAL_GTT;
+                *cs++ = 0;
+                *cs++ = 0;
+
+                for (i = 0; i < 12; i++)
+                        *cs++ = MI_FLUSH;
+
+                *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE;
+                *cs++ = i915_ggtt_offset(rq->engine->scratch) |
+                        PIPE_CONTROL_GLOBAL_GTT;
+                *cs++ = 0;
+                *cs++ = 0;
+        }
+
+        *cs++ = cmd;
+
         intel_ring_advance(rq, cs);
 
         return 0;
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index 0fdabce647ab..44e4491a4918 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -2749,6 +2749,12 @@ static const struct i915_power_well_desc icl_power_wells[] = {
                 },
         },
         {
+                .name = "DC off",
+                .domains = ICL_DISPLAY_DC_OFF_POWER_DOMAINS,
+                .ops = &gen9_dc_off_power_well_ops,
+                .id = DISP_PW_ID_NONE,
+        },
+        {
                 .name = "power well 2",
                 .domains = ICL_PW_2_POWER_DOMAINS,
                 .ops = &hsw_power_well_ops,
@@ -2760,12 +2766,6 @@ static const struct i915_power_well_desc icl_power_wells[] = {
                 },
         },
         {
-                .name = "DC off",
-                .domains = ICL_DISPLAY_DC_OFF_POWER_DOMAINS,
-                .ops = &gen9_dc_off_power_well_ops,
-                .id = DISP_PW_ID_NONE,
-        },
-        {
                 .name = "power well 3",
                 .domains = ICL_PW_3_POWER_DOMAINS,
                 .ops = &hsw_power_well_ops,
@@ -3176,8 +3176,7 @@ static u8 intel_dbuf_max_slices(struct drm_i915_private *dev_priv)
 void icl_dbuf_slices_update(struct drm_i915_private *dev_priv,
                             u8 req_slices)
 {
-        u8 hw_enabled_slices = dev_priv->wm.skl_hw.ddb.enabled_slices;
-        u32 val;
+        const u8 hw_enabled_slices = dev_priv->wm.skl_hw.ddb.enabled_slices;
         bool ret;
 
         if (req_slices > intel_dbuf_max_slices(dev_priv)) {
@@ -3188,7 +3187,6 @@ void icl_dbuf_slices_update(struct drm_i915_private *dev_priv,
         if (req_slices == hw_enabled_slices || req_slices == 0)
                 return;
 
-        val = I915_READ(DBUF_CTL_S2);
         if (req_slices > hw_enabled_slices)
                 ret = intel_dbuf_slice_set(dev_priv, DBUF_CTL_S2, true);
         else
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 5fd2f7bf3927..d3090a7537bb 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -302,13 +302,65 @@ skl_plane_max_stride(struct intel_plane *plane,
                 return min(8192 * cpp, 32768);
 }
 
+static void
+skl_program_scaler(struct intel_plane *plane,
+                   const struct intel_crtc_state *crtc_state,
+                   const struct intel_plane_state *plane_state)
+{
+        struct drm_i915_private *dev_priv = to_i915(plane->base.dev);
+        enum pipe pipe = plane->pipe;
+        int scaler_id = plane_state->scaler_id;
+        const struct intel_scaler *scaler =
+                &crtc_state->scaler_state.scalers[scaler_id];
+        int crtc_x = plane_state->base.dst.x1;
+        int crtc_y = plane_state->base.dst.y1;
+        uint32_t crtc_w = drm_rect_width(&plane_state->base.dst);
+        uint32_t crtc_h = drm_rect_height(&plane_state->base.dst);
+        u16 y_hphase, uv_rgb_hphase;
+        u16 y_vphase, uv_rgb_vphase;
+        int hscale, vscale;
+
+        hscale = drm_rect_calc_hscale(&plane_state->base.src,
+                                      &plane_state->base.dst,
+                                      0, INT_MAX);
+        vscale = drm_rect_calc_vscale(&plane_state->base.src,
+                                      &plane_state->base.dst,
+                                      0, INT_MAX);
+
+        /* TODO: handle sub-pixel coordinates */
+        if (plane_state->base.fb->format->format == DRM_FORMAT_NV12) {
+                y_hphase = skl_scaler_calc_phase(1, hscale, false);
+                y_vphase = skl_scaler_calc_phase(1, vscale, false);
+
+                /* MPEG2 chroma siting convention */
+                uv_rgb_hphase = skl_scaler_calc_phase(2, hscale, true);
+                uv_rgb_vphase = skl_scaler_calc_phase(2, vscale, false);
+        } else {
+                /* not used */
+                y_hphase = 0;
+                y_vphase = 0;
+
+                uv_rgb_hphase = skl_scaler_calc_phase(1, hscale, false);
+                uv_rgb_vphase = skl_scaler_calc_phase(1, vscale, false);
+        }
+
+        I915_WRITE_FW(SKL_PS_CTRL(pipe, scaler_id),
+                      PS_SCALER_EN | PS_PLANE_SEL(plane->id) | scaler->mode);
+        I915_WRITE_FW(SKL_PS_PWR_GATE(pipe, scaler_id), 0);
+        I915_WRITE_FW(SKL_PS_VPHASE(pipe, scaler_id),
+                      PS_Y_PHASE(y_vphase) | PS_UV_RGB_PHASE(uv_rgb_vphase));
+        I915_WRITE_FW(SKL_PS_HPHASE(pipe, scaler_id),
+                      PS_Y_PHASE(y_hphase) | PS_UV_RGB_PHASE(uv_rgb_hphase));
+        I915_WRITE_FW(SKL_PS_WIN_POS(pipe, scaler_id), (crtc_x << 16) | crtc_y);
+        I915_WRITE_FW(SKL_PS_WIN_SZ(pipe, scaler_id), (crtc_w << 16) | crtc_h);
+}
+
 void
 skl_update_plane(struct intel_plane *plane,
                  const struct intel_crtc_state *crtc_state,
                  const struct intel_plane_state *plane_state)
 {
         struct drm_i915_private *dev_priv = to_i915(plane->base.dev);
-        const struct drm_framebuffer *fb = plane_state->base.fb;
         enum plane_id plane_id = plane->id;
         enum pipe pipe = plane->pipe;
         u32 plane_ctl = plane_state->ctl;
@@ -318,8 +370,6 @@ skl_update_plane(struct intel_plane *plane,
         u32 aux_stride = skl_plane_stride(plane_state, 1);
         int crtc_x = plane_state->base.dst.x1;
         int crtc_y = plane_state->base.dst.y1;
-        uint32_t crtc_w = drm_rect_width(&plane_state->base.dst);
-        uint32_t crtc_h = drm_rect_height(&plane_state->base.dst);
         uint32_t x = plane_state->color_plane[0].x;
         uint32_t y = plane_state->color_plane[0].y;
         uint32_t src_w = drm_rect_width(&plane_state->base.src) >> 16;
@@ -329,8 +379,6 @@ skl_update_plane(struct intel_plane *plane,
         /* Sizes are 0 based */
         src_w--;
         src_h--;
-        crtc_w--;
-        crtc_h--;
 
         spin_lock_irqsave(&dev_priv->uncore.lock, irqflags);
 
@@ -353,41 +401,8 @@ skl_update_plane(struct intel_plane *plane,
                       (plane_state->color_plane[1].y << 16) |
                       plane_state->color_plane[1].x);
 
-        /* program plane scaler */
         if (plane_state->scaler_id >= 0) {
-                int scaler_id = plane_state->scaler_id;
-                const struct intel_scaler *scaler =
-                        &crtc_state->scaler_state.scalers[scaler_id];
-                u16 y_hphase, uv_rgb_hphase;
-                u16 y_vphase, uv_rgb_vphase;
-
-                /* TODO: handle sub-pixel coordinates */
-                if (fb->format->format == DRM_FORMAT_NV12) {
-                        y_hphase = skl_scaler_calc_phase(1, false);
-                        y_vphase = skl_scaler_calc_phase(1, false);
-
-                        /* MPEG2 chroma siting convention */
-                        uv_rgb_hphase = skl_scaler_calc_phase(2, true);
-                        uv_rgb_vphase = skl_scaler_calc_phase(2, false);
-                } else {
-                        /* not used */
-                        y_hphase = 0;
-                        y_vphase = 0;
-
-                        uv_rgb_hphase = skl_scaler_calc_phase(1, false);
-                        uv_rgb_vphase = skl_scaler_calc_phase(1, false);
-                }
-
-                I915_WRITE_FW(SKL_PS_CTRL(pipe, scaler_id),
-                              PS_SCALER_EN | PS_PLANE_SEL(plane_id) | scaler->mode);
-                I915_WRITE_FW(SKL_PS_PWR_GATE(pipe, scaler_id), 0);
-                I915_WRITE_FW(SKL_PS_VPHASE(pipe, scaler_id),
-                              PS_Y_PHASE(y_vphase) | PS_UV_RGB_PHASE(uv_rgb_vphase));
-                I915_WRITE_FW(SKL_PS_HPHASE(pipe, scaler_id),
-                              PS_Y_PHASE(y_hphase) | PS_UV_RGB_PHASE(uv_rgb_hphase));
-                I915_WRITE_FW(SKL_PS_WIN_POS(pipe, scaler_id), (crtc_x << 16) | crtc_y);
-                I915_WRITE_FW(SKL_PS_WIN_SZ(pipe, scaler_id),
-                              ((crtc_w + 1) << 16)|(crtc_h + 1));
+                skl_program_scaler(plane, crtc_state, plane_state);
 
                 I915_WRITE_FW(PLANE_POS(pipe, plane_id), 0);
         } else {
diff --git a/drivers/gpu/drm/meson/meson_venc.c b/drivers/gpu/drm/meson/meson_venc.c
index 514245e69b38..acbbad3e322c 100644
--- a/drivers/gpu/drm/meson/meson_venc.c
+++ b/drivers/gpu/drm/meson/meson_venc.c
@@ -854,6 +854,13 @@ void meson_venc_hdmi_mode_set(struct meson_drm *priv, int vic,
         unsigned int sof_lines;
         unsigned int vsync_lines;
 
+        /* Use VENCI for 480i and 576i and double HDMI pixels */
+        if (mode->flags & DRM_MODE_FLAG_DBLCLK) {
+                hdmi_repeat = true;
+                use_enci = true;
+                venc_hdmi_latency = 1;
+        }
+
         if (meson_venc_hdmi_supported_vic(vic)) {
                 vmode = meson_venc_hdmi_get_vic_vmode(vic);
                 if (!vmode) {
@@ -865,13 +872,7 @@ void meson_venc_hdmi_mode_set(struct meson_drm *priv, int vic,
         } else {
                 meson_venc_hdmi_get_dmt_vmode(mode, &vmode_dmt);
                 vmode = &vmode_dmt;
-        }
-
-        /* Use VENCI for 480i and 576i and double HDMI pixels */
-        if (mode->flags & DRM_MODE_FLAG_DBLCLK) {
-                hdmi_repeat = true;
-                use_enci = true;
-                venc_hdmi_latency = 1;
+                use_enci = false;
         }
 
         /* Repeat VENC pixels for 480/576i/p, 720p50/60 and 1080p50/60 */
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
index 394c129cfb3b..0a485c5b982e 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
@@ -5409,11 +5409,14 @@ static int dsi_probe(struct platform_device *pdev)
 
         /* DSI on OMAP3 doesn't have register DSI_GNQ, set number
          * of data to 3 by default */
-        if (dsi->data->quirks & DSI_QUIRK_GNQ)
+        if (dsi->data->quirks & DSI_QUIRK_GNQ) {
+                dsi_runtime_get(dsi);
                 /* NB_DATA_LANES */
                 dsi->num_lanes_supported = 1 + REG_GET(dsi, DSI_GNQ, 11, 9);
-        else
+                dsi_runtime_put(dsi);
+        } else {
                 dsi->num_lanes_supported = 3;
+        }
 
         r = dsi_init_output(dsi);
         if (r)
@@ -5426,15 +5429,19 @@ static int dsi_probe(struct platform_device *pdev)
         }
 
         r = of_platform_populate(dev->of_node, NULL, NULL, dev);
-        if (r)
+        if (r) {
                 DSSERR("Failed to populate DSI child devices: %d\n", r);
+                goto err_uninit_output;
+        }
 
         r = component_add(&pdev->dev, &dsi_component_ops);
         if (r)
-                goto err_uninit_output;
+                goto err_of_depopulate;
 
         return 0;
 
+err_of_depopulate:
+        of_platform_depopulate(dev);
 err_uninit_output:
         dsi_uninit_output(dsi);
 err_pm_disable:
@@ -5470,19 +5477,12 @@ static int dsi_runtime_suspend(struct device *dev)
         /* wait for current handler to finish before turning the DSI off */
         synchronize_irq(dsi->irq);
 
-        dispc_runtime_put(dsi->dss->dispc);
-
         return 0;
 }
 
 static int dsi_runtime_resume(struct device *dev)
 {
         struct dsi_data *dsi = dev_get_drvdata(dev);
-        int r;
-
-        r = dispc_runtime_get(dsi->dss->dispc);
-        if (r)
-                return r;
 
         dsi->is_enabled = true;
         /* ensure the irq handler sees the is_enabled value */
diff --git a/drivers/gpu/drm/omapdrm/dss/dss.c b/drivers/gpu/drm/omapdrm/dss/dss.c
index 1aaf260aa9b8..7553c7fc1c45 100644
--- a/drivers/gpu/drm/omapdrm/dss/dss.c
+++ b/drivers/gpu/drm/omapdrm/dss/dss.c
@@ -1484,16 +1484,23 @@ static int dss_probe(struct platform_device *pdev)
                                                    dss);
 
         /* Add all the child devices as components. */
+        r = of_platform_populate(pdev->dev.of_node, NULL, NULL, &pdev->dev);
+        if (r)
+                goto err_uninit_debugfs;
+
         omapdss_gather_components(&pdev->dev);
 
         device_for_each_child(&pdev->dev, &match, dss_add_child_component);
 
         r = component_master_add_with_match(&pdev->dev, &dss_component_ops, match);
         if (r)
-                goto err_uninit_debugfs;
+                goto err_of_depopulate;
 
         return 0;
 
+err_of_depopulate:
+        of_platform_depopulate(&pdev->dev);
+
 err_uninit_debugfs:
         dss_debugfs_remove_file(dss->debugfs.clk);
         dss_debugfs_remove_file(dss->debugfs.dss);
@@ -1522,6 +1529,8 @@ static int dss_remove(struct platform_device *pdev)
 {
         struct dss_device *dss = platform_get_drvdata(pdev);
 
+        of_platform_depopulate(&pdev->dev);
+
         component_master_del(&pdev->dev, &dss_component_ops);
 
         dss_debugfs_remove_file(dss->debugfs.clk);
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4.c b/drivers/gpu/drm/omapdrm/dss/hdmi4.c
index cf6230eac31a..aabdda394c9c 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi4.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi4.c
@@ -635,10 +635,14 @@ static int hdmi4_bind(struct device *dev, struct device *master, void *data)
 
         hdmi->dss = dss;
 
-        r = hdmi_pll_init(dss, hdmi->pdev, &hdmi->pll, &hdmi->wp);
+        r = hdmi_runtime_get(hdmi);
         if (r)
                 return r;
 
+        r = hdmi_pll_init(dss, hdmi->pdev, &hdmi->pll, &hdmi->wp);
+        if (r)
+                goto err_runtime_put;
+
         r = hdmi4_cec_init(hdmi->pdev, &hdmi->core, &hdmi->wp);
         if (r)
                 goto err_pll_uninit;
@@ -652,12 +656,16 @@ static int hdmi4_bind(struct device *dev, struct device *master, void *data)
         hdmi->debugfs = dss_debugfs_create_file(dss, "hdmi", hdmi_dump_regs,
                                                hdmi);
 
+        hdmi_runtime_put(hdmi);
+
         return 0;
 
 err_cec_uninit:
         hdmi4_cec_uninit(&hdmi->core);
 err_pll_uninit:
         hdmi_pll_uninit(&hdmi->pll);
+err_runtime_put:
+        hdmi_runtime_put(hdmi);
         return r;
 }
 
@@ -833,32 +841,6 @@ static int hdmi4_remove(struct platform_device *pdev)
         return 0;
 }
 
-static int hdmi_runtime_suspend(struct device *dev)
-{
-        struct omap_hdmi *hdmi = dev_get_drvdata(dev);
-
-        dispc_runtime_put(hdmi->dss->dispc);
-
-        return 0;
-}
-
-static int hdmi_runtime_resume(struct device *dev)
-{
-        struct omap_hdmi *hdmi = dev_get_drvdata(dev);
-        int r;
-
-        r = dispc_runtime_get(hdmi->dss->dispc);
-        if (r < 0)
-                return r;
-
-        return 0;
-}
-
-static const struct dev_pm_ops hdmi_pm_ops = {
-        .runtime_suspend = hdmi_runtime_suspend,
-        .runtime_resume = hdmi_runtime_resume,
-};
-
 static const struct of_device_id hdmi_of_match[] = {
         { .compatible = "ti,omap4-hdmi", },
         {},
@@ -869,7 +851,6 @@ struct platform_driver omapdss_hdmi4hw_driver = {
         .remove         = hdmi4_remove,
         .driver         = {
                 .name   = "omapdss_hdmi",
-                .pm     = &hdmi_pm_ops,
                 .of_match_table = hdmi_of_match,
                 .suppress_bind_attrs = true,
         },
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi5.c b/drivers/gpu/drm/omapdrm/dss/hdmi5.c
index b0e4a7463f8c..9e8556f67a29 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi5.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi5.c
@@ -825,32 +825,6 @@ static int hdmi5_remove(struct platform_device *pdev)
         return 0;
 }
 
-static int hdmi_runtime_suspend(struct device *dev)
-{
-        struct omap_hdmi *hdmi = dev_get_drvdata(dev);
-
-        dispc_runtime_put(hdmi->dss->dispc);
-
-        return 0;
-}
-
-static int hdmi_runtime_resume(struct device *dev)
-{
-        struct omap_hdmi *hdmi = dev_get_drvdata(dev);
-        int r;
-
-        r = dispc_runtime_get(hdmi->dss->dispc);
-        if (r < 0)
-                return r;
-
-        return 0;
-}
-
-static const struct dev_pm_ops hdmi_pm_ops = {
-        .runtime_suspend = hdmi_runtime_suspend,
-        .runtime_resume = hdmi_runtime_resume,
-};
-
 static const struct of_device_id hdmi_of_match[] = {
         { .compatible = "ti,omap5-hdmi", },
         { .compatible = "ti,dra7-hdmi", },
@@ -862,7 +836,6 @@ struct platform_driver omapdss_hdmi5hw_driver = {
         .remove         = hdmi5_remove,
         .driver         = {
                 .name   = "omapdss_hdmi5",
-                .pm     = &hdmi_pm_ops,
                 .of_match_table = hdmi_of_match,
                 .suppress_bind_attrs = true,
         },
diff --git a/drivers/gpu/drm/omapdrm/dss/venc.c b/drivers/gpu/drm/omapdrm/dss/venc.c
index ff0b18c8e4ac..b5f52727f8b1 100644
--- a/drivers/gpu/drm/omapdrm/dss/venc.c
+++ b/drivers/gpu/drm/omapdrm/dss/venc.c
@@ -946,19 +946,12 @@ static int venc_runtime_suspend(struct device *dev)
         if (venc->tv_dac_clk)
                 clk_disable_unprepare(venc->tv_dac_clk);
 
-        dispc_runtime_put(venc->dss->dispc);
-
         return 0;
 }
 
 static int venc_runtime_resume(struct device *dev)
 {
         struct venc_device *venc = dev_get_drvdata(dev);
-        int r;
-
-        r = dispc_runtime_get(venc->dss->dispc);
-        if (r < 0)
-                return r;
 
         if (venc->tv_dac_clk)
                 clk_prepare_enable(venc->tv_dac_clk);
diff --git a/drivers/gpu/drm/omapdrm/omap_crtc.c b/drivers/gpu/drm/omapdrm/omap_crtc.c
index 62928ec0e7db..caffc547ef97 100644
--- a/drivers/gpu/drm/omapdrm/omap_crtc.c
+++ b/drivers/gpu/drm/omapdrm/omap_crtc.c
@@ -350,11 +350,14 @@ static void omap_crtc_arm_event(struct drm_crtc *crtc)
 static void omap_crtc_atomic_enable(struct drm_crtc *crtc,
                                     struct drm_crtc_state *old_state)
 {
+        struct omap_drm_private *priv = crtc->dev->dev_private;
         struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
         int ret;
 
         DBG("%s", omap_crtc->name);
 
+        priv->dispc_ops->runtime_get(priv->dispc);
+
         spin_lock_irq(&crtc->dev->event_lock);
         drm_crtc_vblank_on(crtc);
         ret = drm_crtc_vblank_get(crtc);
@@ -367,6 +370,7 @@ static void omap_crtc_atomic_enable(struct drm_crtc *crtc,
 static void omap_crtc_atomic_disable(struct drm_crtc *crtc,
                                      struct drm_crtc_state *old_state)
 {
+        struct omap_drm_private *priv = crtc->dev->dev_private;
         struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
 
         DBG("%s", omap_crtc->name);
@@ -379,6 +383,8 @@ static void omap_crtc_atomic_disable(struct drm_crtc *crtc,
         spin_unlock_irq(&crtc->dev->event_lock);
 
         drm_crtc_vblank_off(crtc);
+
+        priv->dispc_ops->runtime_put(priv->dispc);
 }
 
 static enum drm_mode_status omap_crtc_mode_valid(struct drm_crtc *crtc,
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 2a4aa6468579..921db6f80340 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -793,15 +793,10 @@ static void pci_acpi_setup(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
         struct acpi_device *adev = ACPI_COMPANION(dev);
-        int node;
 
         if (!adev)
                 return;
 
-        node = acpi_get_node(adev->handle);
-        if (node != NUMA_NO_NODE)
-                set_dev_node(dev, node);
-
         pci_acpi_optimize_delay(pci_dev, adev->handle);
 
         pci_acpi_add_pm_notifier(adev, pci_dev);
diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
index 4ceb06f8a33c..4edeb4cae72a 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
@@ -830,7 +830,7 @@ static struct meson_bank meson_gxbb_periphs_banks[] = {
 
 static struct meson_bank meson_gxbb_aobus_banks[] = {
         /*   name    first      last       irq    pullen  pull    dir     out     in  */
-        BANK("AO",   GPIOAO_0,  GPIOAO_13, 0, 13, 0,  0,  0, 16,  0,  0,  0, 16,  1,  0),
+        BANK("AO",   GPIOAO_0,  GPIOAO_13, 0, 13, 0,  16, 0, 0,   0,  0,  0, 16,  1,  0),
 };
 
 static struct meson_pinctrl_data meson_gxbb_periphs_pinctrl_data = {
diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
index 7dae1d7bf6b0..158f618f1695 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
@@ -807,7 +807,7 @@ static struct meson_bank meson_gxl_periphs_banks[] = {
 
 static struct meson_bank meson_gxl_aobus_banks[] = {
         /*   name    first      last      irq   pullen  pull    dir     out     in  */
-        BANK("AO",   GPIOAO_0,  GPIOAO_9, 0, 9, 0,  0,  0, 16,  0,  0,  0, 16,  1,  0),
+        BANK("AO",   GPIOAO_0,  GPIOAO_9, 0, 9, 0,  16, 0, 0,   0,  0,  0, 16,  1,  0),
 };
 
 static struct meson_pinctrl_data meson_gxl_periphs_pinctrl_data = {
diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
index f8b778a7d471..53d449076dee 100644
--- a/drivers/pinctrl/meson/pinctrl-meson.c
+++ b/drivers/pinctrl/meson/pinctrl-meson.c
@@ -192,7 +192,7 @@ static int meson_pinconf_set(struct pinctrl_dev *pcdev, unsigned int pin,
                         dev_dbg(pc->dev, "pin %u: disable bias\n", pin);
 
                         meson_calc_reg_and_bit(bank, pin, REG_PULL, &reg, &bit);
-                        ret = regmap_update_bits(pc->reg_pull, reg,
+                        ret = regmap_update_bits(pc->reg_pullen, reg,
                                                  BIT(bit), 0);
                         if (ret)
                                 return ret;
diff --git a/drivers/pinctrl/meson/pinctrl-meson8.c b/drivers/pinctrl/meson/pinctrl-meson8.c
index c6d79315218f..86466173114d 100644
--- a/drivers/pinctrl/meson/pinctrl-meson8.c
+++ b/drivers/pinctrl/meson/pinctrl-meson8.c
@@ -1053,7 +1053,7 @@ static struct meson_bank meson8_cbus_banks[] = {
 
 static struct meson_bank meson8_aobus_banks[] = {
         /*   name    first     last         irq    pullen  pull    dir     out     in  */
-        BANK("AO",   GPIOAO_0, GPIO_TEST_N, 0, 13, 0,  0,  0, 16,  0,  0,  0, 16,  1,  0),
+        BANK("AO",   GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 16,  0,  0,  0,  0,  0, 16,  1,  0),
 };
 
 static struct meson_pinctrl_data meson8_cbus_pinctrl_data = {
diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c
index bb2a30964fc6..647ad15d5c3c 100644
--- a/drivers/pinctrl/meson/pinctrl-meson8b.c
+++ b/drivers/pinctrl/meson/pinctrl-meson8b.c
@@ -906,7 +906,7 @@ static struct meson_bank meson8b_cbus_banks[] = {
 
 static struct meson_bank meson8b_aobus_banks[] = {
         /*   name    first     lastc        irq    pullen  pull    dir     out     in  */
-        BANK("AO",   GPIOAO_0, GPIO_TEST_N, 0, 13, 0,  0,  0, 16,  0,  0,  0, 16,  1,  0),
+        BANK("AO",   GPIOAO_0, GPIO_TEST_N, 0, 13, 0,  16, 0, 0,  0,  0,  0, 16,  1,  0),
 };
 
 static struct meson_pinctrl_data meson8b_cbus_pinctrl_data = {
diff --git a/drivers/rtc/hctosys.c b/drivers/rtc/hctosys.c
index e79f2a181ad2..b9ec4a16db1f 100644
--- a/drivers/rtc/hctosys.c
+++ b/drivers/rtc/hctosys.c
@@ -50,8 +50,10 @@ static int __init rtc_hctosys(void)
         tv64.tv_sec = rtc_tm_to_time64(&tm);
 
 #if BITS_PER_LONG == 32
-        if (tv64.tv_sec > INT_MAX)
+        if (tv64.tv_sec > INT_MAX) {
+                err = -ERANGE;
                 goto err_read;
+        }
 #endif
 
         err = do_settimeofday64(&tv64);
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index df0c5776d49b..a5a19ff10535 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -257,6 +257,7 @@ static int cmos_read_alarm(struct device *dev, struct rtc_wkalrm *t)
         struct cmos_rtc *cmos = dev_get_drvdata(dev);
         unsigned char   rtc_control;
 
+        /* This not only a rtc_op, but also called directly */
         if (!is_valid_irq(cmos->irq))
                 return -EIO;
 
@@ -452,6 +453,7 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t)
         unsigned char mon, mday, hrs, min, sec, rtc_control;
         int ret;
 
+        /* This not only a rtc_op, but also called directly */
         if (!is_valid_irq(cmos->irq))
                 return -EIO;
 
@@ -516,9 +518,6 @@ static int cmos_alarm_irq_enable(struct device *dev, unsigned int enabled)
         struct cmos_rtc *cmos = dev_get_drvdata(dev);
         unsigned long   flags;
 
-        if (!is_valid_irq(cmos->irq))
-                return -EINVAL;
-
         spin_lock_irqsave(&rtc_lock, flags);
 
         if (enabled)
@@ -579,6 +578,12 @@ static const struct rtc_class_ops cmos_rtc_ops = {
         .alarm_irq_enable       = cmos_alarm_irq_enable,
 };
 
+static const struct rtc_class_ops cmos_rtc_ops_no_alarm = {
+        .read_time              = cmos_read_time,
+        .set_time               = cmos_set_time,
+        .proc                   = cmos_procfs,
+};
+
 /*----------------------------------------------------------------*/
 
 /*
@@ -855,9 +860,12 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
                         dev_dbg(dev, "IRQ %d is already in use\n", rtc_irq);
                         goto cleanup1;
                 }
+
+                cmos_rtc.rtc->ops = &cmos_rtc_ops;
+        } else {
+                cmos_rtc.rtc->ops = &cmos_rtc_ops_no_alarm;
         }
 
-        cmos_rtc.rtc->ops = &cmos_rtc_ops;
         cmos_rtc.rtc->nvram_old_abi = true;
         retval = rtc_register_device(cmos_rtc.rtc);
         if (retval)
diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
index 9f99a0966550..7cb786d76e3c 100644
--- a/drivers/rtc/rtc-pcf2127.c
+++ b/drivers/rtc/rtc-pcf2127.c
@@ -303,6 +303,9 @@ static int pcf2127_i2c_gather_write(void *context,
         memcpy(buf + 1, val, val_size);
 
         ret = i2c_master_send(client, buf, val_size + 1);
+
+        kfree(buf);
+
         if (ret != val_size + 1)
                 return ret < 0 ? ret : -EIO;
 
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index f07444d30b21..640cd1b31a18 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -578,6 +578,7 @@ config SCSI_MYRB
 config SCSI_MYRS
         tristate "Mylex DAC960/DAC1100 PCI RAID Controller (SCSI Interface)"
         depends on PCI
+        depends on !CPU_BIG_ENDIAN || COMPILE_TEST
         select RAID_ATTRS
         help
           This driver adds support for the Mylex DAC960, AcceleRAID, and
diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
index 8429c855701f..01c23d27f290 100644
--- a/drivers/scsi/NCR5380.c
+++ b/drivers/scsi/NCR5380.c
@@ -1198,7 +1198,7 @@ static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd)
 
 out:
         if (!hostdata->selecting)
-                return NULL;
+                return false;
         hostdata->selecting = NULL;
         return ret;
 }
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
index f0e457e6884e..8df822a4a1bd 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
@@ -904,11 +904,9 @@ static void start_delivery_v1_hw(struct hisi_sas_dq *dq)
 {
         struct hisi_hba *hisi_hba = dq->hisi_hba;
         struct hisi_sas_slot *s, *s1, *s2 = NULL;
-        struct list_head *dq_list;
         int dlvry_queue = dq->id;
         int wp;
 
-        dq_list = &dq->list;
         list_for_each_entry_safe(s, s1, &dq->list, delivery) {
                 if (!s->ready)
                         break;
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
index cc36b6473e98..77a85ead483e 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
@@ -1670,11 +1670,9 @@ static void start_delivery_v2_hw(struct hisi_sas_dq *dq)
 {
         struct hisi_hba *hisi_hba = dq->hisi_hba;
         struct hisi_sas_slot *s, *s1, *s2 = NULL;
-        struct list_head *dq_list;
         int dlvry_queue = dq->id;
         int wp;
 
-        dq_list = &dq->list;
         list_for_each_entry_safe(s, s1, &dq->list, delivery) {
                 if (!s->ready)
                         break;
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index bd4ce38b98d2..a369450a1fa7 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -886,11 +886,9 @@ static void start_delivery_v3_hw(struct hisi_sas_dq *dq)
 {
         struct hisi_hba *hisi_hba = dq->hisi_hba;
         struct hisi_sas_slot *s, *s1, *s2 = NULL;
-        struct list_head *dq_list;
         int dlvry_queue = dq->id;
         int wp;
 
-        dq_list = &dq->list;
         list_for_each_entry_safe(s, s1, &dq->list, delivery) {
                 if (!s->ready)
                         break;
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 0c8005bb0f53..34d311a7dbef 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -698,6 +698,8 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size)
                 rport = lpfc_ndlp_get_nrport(ndlp);
                 if (rport)
                         nrport = rport->remoteport;
+                else
+                        nrport = NULL;
                 spin_unlock(&phba->hbalock);
                 if (!nrport)
                         continue;
diff --git a/drivers/scsi/myrb.c b/drivers/scsi/myrb.c
index aeb282f617c5..0642f2d0a3bb 100644
--- a/drivers/scsi/myrb.c
+++ b/drivers/scsi/myrb.c
@@ -1049,7 +1049,8 @@ static int myrb_get_hba_config(struct myrb_hba *cb)
                 enquiry2->fw.firmware_type = '0';
                 enquiry2->fw.turn_id = 0;
         }
-        sprintf(cb->fw_version, "%d.%02d-%c-%02d",
+        snprintf(cb->fw_version, sizeof(cb->fw_version),
+                "%d.%02d-%c-%02d",
                 enquiry2->fw.major_version,
                 enquiry2->fw.minor_version,
                 enquiry2->fw.firmware_type,
diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c
index 0264a2e2bc19..b8d54ef8cf6d 100644
--- a/drivers/scsi/myrs.c
+++ b/drivers/scsi/myrs.c
@@ -163,9 +163,12 @@ static unsigned char myrs_get_ctlr_info(struct myrs_hba *cs)
         dma_addr_t ctlr_info_addr;
         union myrs_sgl *sgl;
         unsigned char status;
-        struct myrs_ctlr_info old;
+        unsigned short ldev_present, ldev_critical, ldev_offline;
+
+        ldev_present = cs->ctlr_info->ldev_present;
+        ldev_critical = cs->ctlr_info->ldev_critical;
+        ldev_offline = cs->ctlr_info->ldev_offline;
 
-        memcpy(&old, cs->ctlr_info, sizeof(struct myrs_ctlr_info));
         ctlr_info_addr = dma_map_single(&cs->pdev->dev, cs->ctlr_info,
                                         sizeof(struct myrs_ctlr_info),
                                         DMA_FROM_DEVICE);
@@ -198,9 +201,9 @@ static unsigned char myrs_get_ctlr_info(struct myrs_hba *cs)
                     cs->ctlr_info->rbld_active +
                     cs->ctlr_info->exp_active != 0)
                         cs->needs_update = true;
-                if (cs->ctlr_info->ldev_present != old.ldev_present ||
-                    cs->ctlr_info->ldev_critical != old.ldev_critical ||
-                    cs->ctlr_info->ldev_offline != old.ldev_offline)
+                if (cs->ctlr_info->ldev_present != ldev_present ||
+                    cs->ctlr_info->ldev_critical != ldev_critical ||
+                    cs->ctlr_info->ldev_offline != ldev_offline)
                         shost_printk(KERN_INFO, cs->host,
                                      "Logical drive count changes (%d/%d/%d)\n",
                                      cs->ctlr_info->ldev_critical,
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 6fe20c27acc1..eb59c796a795 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -4763,6 +4763,7 @@ qla2x00_alloc_fcport(scsi_qla_host_t *vha, gfp_t flags)
         fcport->loop_id = FC_NO_LOOP_ID;
         qla2x00_set_fcport_state(fcport, FCS_UNCONFIGURED);
         fcport->supported_classes = FC_COS_UNSPECIFIED;
+        fcport->fp_speed = PORT_SPEED_UNKNOWN;
 
         fcport->ct_desc.ct_sns = dma_alloc_coherent(&vha->hw->pdev->dev,
                 sizeof(struct ct_sns_pkt), &fcport->ct_desc.ct_sns_dma,
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 518f15141170..20c85eed1a75 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -67,7 +67,7 @@ module_param(ql2xplogiabsentdevice, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(ql2xplogiabsentdevice,
                 "Option to enable PLOGI to devices that are not present after "
                 "a Fabric scan.  This is needed for several broken switches. "
-                "Default is 0 - no PLOGI. 1 - perfom PLOGI.");
+                "Default is 0 - no PLOGI. 1 - perform PLOGI.");
 
 int ql2xloginretrycount = 0;
 module_param(ql2xloginretrycount, int, S_IRUGO);
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index c7fccbb8f554..fa6e0c3b3aa6 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -697,6 +697,12 @@ static bool scsi_end_request(struct request *req, blk_status_t error,
                  */
                 scsi_mq_uninit_cmd(cmd);
 
+                /*
+                 * queue is still alive, so grab the ref for preventing it
+                 * from being cleaned up during running queue.
+                 */
+                percpu_ref_get(&q->q_usage_counter);
+
                 __blk_mq_end_request(req, error);
 
                 if (scsi_target(sdev)->single_lun ||
@@ -704,6 +710,8 @@ static bool scsi_end_request(struct request *req, blk_status_t error,
                         kblockd_schedule_work(&sdev->requeue_work);
                 else
                         blk_mq_run_hw_queues(q, true);
+
+                percpu_ref_put(&q->q_usage_counter);
         } else {
                 unsigned long flags;
 
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 23d7cca36ff0..27db55b0ca7f 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -8099,13 +8099,6 @@ int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle)
                 err = -ENOMEM;
                 goto out_error;
         }
-
-        /*
-         * Do not use blk-mq at this time because blk-mq does not support
-         * runtime pm.
-         */
-        host->use_blk_mq = false;
-
         hba = shost_priv(host);
         hba->host = host;
         hba->dev = dev;
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index e31e4fc31aa1..2cfd61d62e97 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1778,7 +1778,7 @@ EXPORT_SYMBOL(target_submit_tmr);
 void transport_generic_request_failure(struct se_cmd *cmd,
                 sense_reason_t sense_reason)
 {
-        int ret = 0;
+        int ret = 0, post_ret;
 
         pr_debug("-----[ Storage Engine Exception; sense_reason %d\n",
                  sense_reason);
@@ -1790,7 +1790,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
         transport_complete_task_attr(cmd);
 
         if (cmd->transport_complete_callback)
-                cmd->transport_complete_callback(cmd, false, NULL);
+                cmd->transport_complete_callback(cmd, false, &post_ret);
 
         if (transport_check_aborted_status(cmd, 1))
                 return;
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index ae813e609932..a5e516a40e7a 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -165,9 +165,13 @@ static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background)
 
 static void fuse_drop_waiting(struct fuse_conn *fc)
 {
-        if (fc->connected) {
-                atomic_dec(&fc->num_waiting);
-        } else if (atomic_dec_and_test(&fc->num_waiting)) {
+        /*
+         * lockess check of fc->connected is okay, because atomic_dec_and_test()
+         * provides a memory barrier mached with the one in fuse_wait_aborted()
+         * to ensure no wake-up is missed.
+         */
+        if (atomic_dec_and_test(&fc->num_waiting) &&
+            !READ_ONCE(fc->connected)) {
                 /* wake up aborters */
                 wake_up_all(&fc->blocked_waitq);
         }
@@ -1768,8 +1772,10 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
         req->in.args[1].size = total_len;
 
         err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);
-        if (err)
+        if (err) {
                 fuse_retrieve_end(fc, req);
+                fuse_put_request(fc, req);
+        }
 
         return err;
 }
@@ -2219,6 +2225,8 @@ EXPORT_SYMBOL_GPL(fuse_abort_conn);
 
 void fuse_wait_aborted(struct fuse_conn *fc)
 {
+        /* matches implicit memory barrier in fuse_drop_waiting() */
+        smp_mb();
         wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0);
 }
 
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index cc2121b37bf5..b52f9baaa3e7 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2924,10 +2924,12 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
         }
 
         if (io->async) {
+                bool blocking = io->blocking;
+
                 fuse_aio_complete(io, ret < 0 ? ret : 0, -1);
 
                 /* we have a non-extending, async request, so return */
-                if (!io->blocking)
+                if (!blocking)
                         return -EIOCBQUEUED;
 
                 wait_for_completion(&wait);
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index a683d9b27d76..9a4a15d646eb 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -826,7 +826,7 @@ static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length,
         ret = gfs2_meta_inode_buffer(ip, &dibh);
         if (ret)
                 goto unlock;
-        iomap->private = dibh;
+        mp->mp_bh[0] = dibh;
 
         if (gfs2_is_stuffed(ip)) {
                 if (flags & IOMAP_WRITE) {
@@ -863,9 +863,6 @@ unstuff:
         len = lblock_stop - lblock + 1;
         iomap->length = len << inode->i_blkbits;
 
-        get_bh(dibh);
-        mp->mp_bh[0] = dibh;
-
         height = ip->i_height;
         while ((lblock + 1) * sdp->sd_sb.sb_bsize > sdp->sd_heightsize[height])
                 height++;
@@ -898,8 +895,6 @@ out:
         iomap->bdev = inode->i_sb->s_bdev;
 unlock:
         up_read(&ip->i_rw_mutex);
-        if (ret && dibh)
-                brelse(dibh);
         return ret;
 
 do_alloc:
@@ -980,9 +975,9 @@ static void gfs2_iomap_journaled_page_done(struct inode *inode, loff_t pos,
 
 static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
                                   loff_t length, unsigned flags,
-                                  struct iomap *iomap)
+                                  struct iomap *iomap,
+                                  struct metapath *mp)
 {
-        struct metapath mp = { .mp_aheight = 1, };
         struct gfs2_inode *ip = GFS2_I(inode);
         struct gfs2_sbd *sdp = GFS2_SB(inode);
         unsigned int data_blocks = 0, ind_blocks = 0, rblocks;
@@ -996,9 +991,9 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
         unstuff = gfs2_is_stuffed(ip) &&
                   pos + length > gfs2_max_stuffed_size(ip);
 
-        ret = gfs2_iomap_get(inode, pos, length, flags, iomap, &mp);
+        ret = gfs2_iomap_get(inode, pos, length, flags, iomap, mp);
         if (ret)
-                goto out_release;
+                goto out_unlock;
 
         alloc_required = unstuff || iomap->type == IOMAP_HOLE;
 
@@ -1013,7 +1008,7 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
 
                 ret = gfs2_quota_lock_check(ip, &ap);
                 if (ret)
-                        goto out_release;
+                        goto out_unlock;
 
                 ret = gfs2_inplace_reserve(ip, &ap);
                 if (ret)
@@ -1038,17 +1033,15 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
                 ret = gfs2_unstuff_dinode(ip, NULL);
                 if (ret)
                         goto out_trans_end;
-                release_metapath(&mp);
-                brelse(iomap->private);
-                iomap->private = NULL;
+                release_metapath(mp);
                 ret = gfs2_iomap_get(inode, iomap->offset, iomap->length,
-                                     flags, iomap, &mp);
+                                     flags, iomap, mp);
                 if (ret)
                         goto out_trans_end;
         }
 
         if (iomap->type == IOMAP_HOLE) {
-                ret = gfs2_iomap_alloc(inode, iomap, flags, &mp);
+                ret = gfs2_iomap_alloc(inode, iomap, flags, mp);
                 if (ret) {
                         gfs2_trans_end(sdp);
                         gfs2_inplace_release(ip);
@@ -1056,7 +1049,6 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
                         goto out_qunlock;
                 }
         }
-        release_metapath(&mp);
         if (!gfs2_is_stuffed(ip) && gfs2_is_jdata(ip))
                 iomap->page_done = gfs2_iomap_journaled_page_done;
         return 0;
@@ -1069,10 +1061,7 @@ out_trans_fail:
 out_qunlock:
         if (alloc_required)
                 gfs2_quota_unlock(ip);
-out_release:
-        if (iomap->private)
-                brelse(iomap->private);
-        release_metapath(&mp);
+out_unlock:
         gfs2_write_unlock(inode);
         return ret;
 }
@@ -1088,10 +1077,10 @@ static int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
 
         trace_gfs2_iomap_start(ip, pos, length, flags);
         if ((flags & IOMAP_WRITE) && !(flags & IOMAP_DIRECT)) {
-                ret = gfs2_iomap_begin_write(inode, pos, length, flags, iomap);
+                ret = gfs2_iomap_begin_write(inode, pos, length, flags, iomap, &mp);
         } else {
                 ret = gfs2_iomap_get(inode, pos, length, flags, iomap, &mp);
-                release_metapath(&mp);
+
                 /*
                  * Silently fall back to buffered I/O for stuffed files or if
                  * we've hot a hole (see gfs2_file_direct_write).
@@ -1100,6 +1089,11 @@ static int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
                     iomap->type != IOMAP_MAPPED)
                         ret = -ENOTBLK;
         }
+        if (!ret) {
+                get_bh(mp.mp_bh[0]);
+                iomap->private = mp.mp_bh[0];
+        }
+        release_metapath(&mp);
         trace_gfs2_iomap_end(ip, iomap, ret);
         return ret;
 }
@@ -1908,10 +1902,16 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)
                         if (ret < 0)
                                 goto out;
 
-                        /* issue read-ahead on metadata */
-                        if (mp.mp_aheight > 1) {
-                                for (; ret > 1; ret--) {
-                                        metapointer_range(&mp, mp.mp_aheight - ret,
+                        /* On the first pass, issue read-ahead on metadata. */
+                        if (mp.mp_aheight > 1 && strip_h == ip->i_height - 1) {
+                                unsigned int height = mp.mp_aheight - 1;
+
+                                /* No read-ahead for data blocks. */
+                                if (mp.mp_aheight - 1 == strip_h)
+                                        height--;
+
+                                for (; height >= mp.mp_aheight - ret; height--) {
+                                        metapointer_range(&mp, height,
                                                           start_list, start_aligned,
                                                           end_list, end_aligned,
                                                           &start, &end);
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index ffe3032b1043..b08a530433ad 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -733,6 +733,7 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
 
                 if (gl) {
                         glock_clear_object(gl, rgd);
+                        gfs2_rgrp_brelse(rgd);
                         gfs2_glock_put(gl);
                 }
 
@@ -1174,7 +1175,7 @@ static u32 count_unlinked(struct gfs2_rgrpd *rgd)
  * @rgd: the struct gfs2_rgrpd describing the RG to read in
  *
  * Read in all of a Resource Group's header and bitmap blocks.
- * Caller must eventually call gfs2_rgrp_relse() to free the bitmaps.
+ * Caller must eventually call gfs2_rgrp_brelse() to free the bitmaps.
  *
  * Returns: errno
  */
diff --git a/fs/namespace.c b/fs/namespace.c
index 74f64294a410..a7f91265ea67 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -695,9 +695,6 @@ static struct mountpoint *lookup_mountpoint(struct dentry *dentry)
 
         hlist_for_each_entry(mp, chain, m_hash) {
                 if (mp->m_dentry == dentry) {
-                        /* might be worth a WARN_ON() */
-                        if (d_unlinked(dentry))
-                                return ERR_PTR(-ENOENT);
                         mp->m_count++;
                         return mp;
                 }
@@ -711,6 +708,9 @@ static struct mountpoint *get_mountpoint(struct dentry *dentry)
         int ret;
 
         if (d_mountpoint(dentry)) {
+                /* might be worth a WARN_ON() */
+                if (d_unlinked(dentry))
+                        return ERR_PTR(-ENOENT);
 mountpoint:
                 read_seqlock_excl(&mount_lock);
                 mp = lookup_mountpoint(dentry);
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index fa515d5ea5ba..7b861bbc0b43 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -66,7 +66,7 @@ __be32 nfs4_callback_getattr(void *argp, void *resp,
 out_iput:
         rcu_read_unlock();
         trace_nfs4_cb_getattr(cps->clp, &args->fh, inode, -ntohl(res->status));
-        iput(inode);
+        nfs_iput_and_deactive(inode);
 out:
         dprintk("%s: exit with status = %d\n", __func__, ntohl(res->status));
         return res->status;
@@ -108,7 +108,7 @@ __be32 nfs4_callback_recall(void *argp, void *resp,
         }
         trace_nfs4_cb_recall(cps->clp, &args->fh, inode,
                         &args->stateid, -ntohl(res));
-        iput(inode);
+        nfs_iput_and_deactive(inode);
 out:
         dprintk("%s: exit with status = %d\n", __func__, ntohl(res));
         return res;
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 07b839560576..6ec2f78c1e19 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -850,16 +850,23 @@ nfs_delegation_find_inode_server(struct nfs_server *server,
                                  const struct nfs_fh *fhandle)
 {
         struct nfs_delegation *delegation;
-        struct inode *res = NULL;
+        struct inode *freeme, *res = NULL;
 
         list_for_each_entry_rcu(delegation, &server->delegations, super_list) {
                 spin_lock(&delegation->lock);
                 if (delegation->inode != NULL &&
                     nfs_compare_fh(fhandle, &NFS_I(delegation->inode)->fh) == 0) {
-                        res = igrab(delegation->inode);
+                        freeme = igrab(delegation->inode);
+                        if (freeme && nfs_sb_active(freeme->i_sb))
+                                res = freeme;
                         spin_unlock(&delegation->lock);
                         if (res != NULL)
                                 return res;
+                        if (freeme) {
+                                rcu_read_unlock();
+                                iput(freeme);
+                                rcu_read_lock();
+                        }
                         return ERR_PTR(-EAGAIN);
                 }
                 spin_unlock(&delegation->lock);
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 62ae0fd345ad..ffea57885394 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -2601,11 +2601,12 @@ static void nfs4_state_manager(struct nfs_client *clp)
                 nfs4_clear_state_manager_bit(clp);
                 /* Did we race with an attempt to give us more work? */
                 if (clp->cl_state == 0)
-                        break;
+                        return;
                 if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
-                        break;
-        } while (refcount_read(&clp->cl_count) > 1);
-        return;
+                        return;
+        } while (refcount_read(&clp->cl_count) > 1 && !signalled());
+        goto out_drain;
+
 out_error:
         if (strlen(section))
                 section_sep = ": ";
@@ -2613,6 +2614,7 @@ out_error:
                         " with error %d\n", section_sep, section,
                         clp->cl_hostname, -status);
         ssleep(1);
+out_drain:
         nfs4_end_drain_session(clp);
         nfs4_clear_state_manager_bit(clp);
 }
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index edff074d38c7..d505990dac7c 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1038,6 +1038,9 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 {
         __be32 status;
 
+        if (!cstate->save_fh.fh_dentry)
+                return nfserr_nofilehandle;
+
         status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->save_fh,
                                             src_stateid, RD_STATE, src, NULL);
         if (status) {
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index 5769cf3ff035..e08a6647267b 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -115,12 +115,12 @@ static bool fanotify_should_send_event(struct fsnotify_iter_info *iter_info,
                         continue;
                 mark = iter_info->marks[type];
                 /*
-                 * if the event is for a child and this inode doesn't care about
-                 * events on the child, don't send it!
+                 * If the event is for a child and this mark doesn't care about
+                 * events on a child, don't send it!
                  */
-                if (type == FSNOTIFY_OBJ_TYPE_INODE &&
-                    (event_mask & FS_EVENT_ON_CHILD) &&
-                    !(mark->mask & FS_EVENT_ON_CHILD))
+                if (event_mask & FS_EVENT_ON_CHILD &&
+                    (type != FSNOTIFY_OBJ_TYPE_INODE ||
+                     !(mark->mask & FS_EVENT_ON_CHILD)))
                         continue;
 
                 marks_mask |= mark->mask;
diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
index 2172ba516c61..d2c34900ae05 100644
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -167,9 +167,9 @@ int __fsnotify_parent(const struct path *path, struct dentry *dentry, __u32 mask
         parent = dget_parent(dentry);
         p_inode = parent->d_inode;
 
-        if (unlikely(!fsnotify_inode_watches_children(p_inode)))
+        if (unlikely(!fsnotify_inode_watches_children(p_inode))) {
                 __fsnotify_update_child_dentry_flags(p_inode);
-        else if (p_inode->i_fsnotify_mask & mask) {
+        } else if (p_inode->i_fsnotify_mask & mask & ALL_FSNOTIFY_EVENTS) {
                 struct name_snapshot name;
 
                 /* we are notifying a parent so come up with the new mask which
@@ -339,6 +339,9 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,
                 sb = mnt->mnt.mnt_sb;
                 mnt_or_sb_mask = mnt->mnt_fsnotify_mask | sb->s_fsnotify_mask;
         }
+        /* An event "on child" is not intended for a mount/sb mark */
+        if (mask & FS_EVENT_ON_CHILD)
+                mnt_or_sb_mask = 0;
 
         /*
          * Optimization: srcu_read_lock() has a memory barrier which can
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 845174e113ce..100ce4a4aff6 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1167,6 +1167,8 @@ static inline bool efi_enabled(int feature)
 extern void efi_reboot(enum reboot_mode reboot_mode, const char *__unused);
 
 extern bool efi_is_table_address(unsigned long phys_addr);
+
+extern int efi_apply_persistent_mem_reservations(void);
 #else
 static inline bool efi_enabled(int feature)
 {
@@ -1185,6 +1187,11 @@ static inline bool efi_is_table_address(unsigned long phys_addr)
 {
         return false;
 }
+
+static inline int efi_apply_persistent_mem_reservations(void)
+{
+        return 0;
+}
 #endif
 
 extern int efi_status_to_err(efi_status_t status);
diff --git a/include/trace/events/kyber.h b/include/trace/events/kyber.h
index a9834c37ac40..c0e7d24ca256 100644
--- a/include/trace/events/kyber.h
+++ b/include/trace/events/kyber.h
@@ -31,8 +31,8 @@ TRACE_EVENT(kyber_latency,
 
         TP_fast_assign(
                 __entry->dev            = disk_devt(dev_to_disk(kobj_to_dev(q->kobj.parent)));
-                strlcpy(__entry->domain, domain, DOMAIN_LEN);
-                strlcpy(__entry->type, type, DOMAIN_LEN);
+                strlcpy(__entry->domain, domain, sizeof(__entry->domain));
+                strlcpy(__entry->type, type, sizeof(__entry->type));
                 __entry->percentile     = percentile;
                 __entry->numerator      = numerator;
                 __entry->denominator    = denominator;
@@ -60,7 +60,7 @@ TRACE_EVENT(kyber_adjust,
 
         TP_fast_assign(
                 __entry->dev            = disk_devt(dev_to_disk(kobj_to_dev(q->kobj.parent)));
-                strlcpy(__entry->domain, domain, DOMAIN_LEN);
+                strlcpy(__entry->domain, domain, sizeof(__entry->domain));
                 __entry->depth          = depth;
         ),
 
@@ -82,7 +82,7 @@ TRACE_EVENT(kyber_throttled,
 
         TP_fast_assign(
                 __entry->dev            = disk_devt(dev_to_disk(kobj_to_dev(q->kobj.parent)));
-                strlcpy(__entry->domain, domain, DOMAIN_LEN);
+                strlcpy(__entry->domain, domain, sizeof(__entry->domain));
         ),
 
         TP_printk("%d,%d %s", MAJOR(__entry->dev), MINOR(__entry->dev),
diff --git a/kernel/debug/kdb/kdb_bt.c b/kernel/debug/kdb/kdb_bt.c
index 6ad4a9fcbd6f..7921ae4fca8d 100644
--- a/kernel/debug/kdb/kdb_bt.c
+++ b/kernel/debug/kdb/kdb_bt.c
@@ -179,14 +179,14 @@ kdb_bt(int argc, const char **argv)
                                 kdb_printf("no process for cpu %ld\n", cpu);
                                 return 0;
                         }
-                        sprintf(buf, "btt 0x%p\n", KDB_TSK(cpu));
+                        sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu));
                         kdb_parse(buf);
                         return 0;
                 }
                 kdb_printf("btc: cpu status: ");
                 kdb_parse("cpu\n");
                 for_each_online_cpu(cpu) {
-                        sprintf(buf, "btt 0x%p\n", KDB_TSK(cpu));
+                        sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu));
                         kdb_parse(buf);
                         touch_nmi_watchdog();
                 }
diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
index ed5d34925ad0..6a4b41484afe 100644
--- a/kernel/debug/kdb/kdb_io.c
+++ b/kernel/debug/kdb/kdb_io.c
@@ -216,7 +216,7 @@ static char *kdb_read(char *buffer, size_t bufsize)
         int count;
         int i;
         int diag, dtab_count;
-        int key;
+        int key, buf_size, ret;
 
 
         diag = kdbgetintenv("DTABCOUNT", &dtab_count);
@@ -336,9 +336,8 @@ poll_again:
                 else
                         p_tmp = tmpbuffer;
                 len = strlen(p_tmp);
-                count = kallsyms_symbol_complete(p_tmp,
-                                                 sizeof(tmpbuffer) -
-                                                 (p_tmp - tmpbuffer));
+                buf_size = sizeof(tmpbuffer) - (p_tmp - tmpbuffer);
+                count = kallsyms_symbol_complete(p_tmp, buf_size);
                 if (tab == 2 && count > 0) {
                         kdb_printf("\n%d symbols are found.", count);
                         if (count > dtab_count) {
@@ -350,9 +349,13 @@ poll_again:
                         }
                         kdb_printf("\n");
                         for (i = 0; i < count; i++) {
-                                if (WARN_ON(!kallsyms_symbol_next(p_tmp, i)))
+                                ret = kallsyms_symbol_next(p_tmp, i, buf_size);
+                                if (WARN_ON(!ret))
                                         break;
-                                kdb_printf("%s ", p_tmp);
+                                if (ret != -E2BIG)
+                                        kdb_printf("%s ", p_tmp);
+                                else
+                                        kdb_printf("%s... ", p_tmp);
                                 *(p_tmp + len) = '\0';
                         }
                         if (i >= dtab_count)
diff --git a/kernel/debug/kdb/kdb_keyboard.c b/kernel/debug/kdb/kdb_keyboard.c
index 118527aa60ea..750497b0003a 100644
--- a/kernel/debug/kdb/kdb_keyboard.c
+++ b/kernel/debug/kdb/kdb_keyboard.c
@@ -173,11 +173,11 @@ int kdb_get_kbd_char(void)
         case KT_LATIN:
                 if (isprint(keychar))
                         break;          /* printable characters */
-                /* drop through */
+                /* fall through */
         case KT_SPEC:
                 if (keychar == K_ENTER)
                         break;
-                /* drop through */
+                /* fall through */
         default:
                 return -1;      /* ignore unprintables */
         }
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index bb4fe4e1a601..d72b32c66f7d 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -1192,7 +1192,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,
         if (reason == KDB_REASON_DEBUG) {
                 /* special case below */
         } else {
-                kdb_printf("\nEntering kdb (current=0x%p, pid %d) ",
+                kdb_printf("\nEntering kdb (current=0x%px, pid %d) ",
                            kdb_current, kdb_current ? kdb_current->pid : 0);
 #if defined(CONFIG_SMP)
                 kdb_printf("on processor %d ", raw_smp_processor_id());
@@ -1208,7 +1208,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,
                  */
                 switch (db_result) {
                 case KDB_DB_BPT:
-                        kdb_printf("\nEntering kdb (0x%p, pid %d) ",
+                        kdb_printf("\nEntering kdb (0x%px, pid %d) ",
                                    kdb_current, kdb_current->pid);
 #if defined(CONFIG_SMP)
                         kdb_printf("on processor %d ", raw_smp_processor_id());
@@ -1493,6 +1493,7 @@ static void kdb_md_line(const char *fmtstr, unsigned long addr,
         char cbuf[32];
         char *c = cbuf;
         int i;
+        int j;
         unsigned long word;
 
         memset(cbuf, '\0', sizeof(cbuf));
@@ -1538,25 +1539,9 @@ static void kdb_md_line(const char *fmtstr, unsigned long addr,
                         wc.word = word;
 #define printable_char(c) \
         ({unsigned char __c = c; isascii(__c) && isprint(__c) ? __c : '.'; })
-                        switch (bytesperword) {
-                        case 8:
+                        for (j = 0; j < bytesperword; j++)
                                 *c++ = printable_char(*cp++);
-                                *c++ = printable_char(*cp++);
-                                *c++ = printable_char(*cp++);
-                                *c++ = printable_char(*cp++);
-                                addr += 4;
-                        case 4:
-                                *c++ = printable_char(*cp++);
-                                *c++ = printable_char(*cp++);
-                                addr += 2;
-                        case 2:
-                                *c++ = printable_char(*cp++);
-                                addr++;
-                        case 1:
-                                *c++ = printable_char(*cp++);
-                                addr++;
-                                break;
-                        }
+                        addr += bytesperword;
 #undef printable_char
                 }
         }
@@ -2048,7 +2033,7 @@ static int kdb_lsmod(int argc, const char **argv)
                 if (mod->state == MODULE_STATE_UNFORMED)
                         continue;
 
-                kdb_printf("%-20s%8u  0x%p ", mod->name,
+                kdb_printf("%-20s%8u  0x%px ", mod->name,
                            mod->core_layout.size, (void *)mod);
 #ifdef CONFIG_MODULE_UNLOAD
                 kdb_printf("%4d ", module_refcount(mod));
@@ -2059,7 +2044,7 @@ static int kdb_lsmod(int argc, const char **argv)
                         kdb_printf(" (Loading)");
                 else
                         kdb_printf(" (Live)");
-                kdb_printf(" 0x%p", mod->core_layout.base);
+                kdb_printf(" 0x%px", mod->core_layout.base);
 
 #ifdef CONFIG_MODULE_UNLOAD
                 {
@@ -2341,7 +2326,7 @@ void kdb_ps1(const struct task_struct *p)
                 return;
 
         cpu = kdb_process_cpu(p);
-        kdb_printf("0x%p %8d %8d  %d %4d   %c  0x%p %c%s\n",
+        kdb_printf("0x%px %8d %8d  %d %4d   %c  0x%px %c%s\n",
                    (void *)p, p->pid, p->parent->pid,
                    kdb_task_has_cpu(p), kdb_process_cpu(p),
                    kdb_task_state_char(p),
@@ -2354,7 +2339,7 @@ void kdb_ps1(const struct task_struct *p)
                 } else {
                         if (KDB_TSK(cpu) != p)
                                 kdb_printf("  Error: does not match running "
-                                   "process table (0x%p)\n", KDB_TSK(cpu));
+                                   "process table (0x%px)\n", KDB_TSK(cpu));
                 }
         }
 }
@@ -2687,7 +2672,7 @@ int kdb_register_flags(char *cmd,
         for_each_kdbcmd(kp, i) {
                 if (kp->cmd_name && (strcmp(kp->cmd_name, cmd) == 0)) {
                         kdb_printf("Duplicate kdb command registered: "
-                                "%s, func %p help %s\n", cmd, func, help);
+                                "%s, func %px help %s\n", cmd, func, help);
                         return 1;
                 }
         }
diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h
index 1e5a502ba4a7..2118d8258b7c 100644
--- a/kernel/debug/kdb/kdb_private.h
+++ b/kernel/debug/kdb/kdb_private.h
@@ -83,7 +83,7 @@ typedef struct __ksymtab {
                 unsigned long sym_start;
                 unsigned long sym_end;
                 } kdb_symtab_t;
-extern int kallsyms_symbol_next(char *prefix_name, int flag);
+extern int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size);
 extern int kallsyms_symbol_complete(char *prefix_name, int max_len);
 
 /* Exported Symbols for kernel loadable modules to use. */
diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c
index 990b3cc526c8..50bf9b119bad 100644
--- a/kernel/debug/kdb/kdb_support.c
+++ b/kernel/debug/kdb/kdb_support.c
@@ -40,7 +40,7 @@
 int kdbgetsymval(const char *symname, kdb_symtab_t *symtab)
 {
         if (KDB_DEBUG(AR))
-                kdb_printf("kdbgetsymval: symname=%s, symtab=%p\n", symname,
+                kdb_printf("kdbgetsymval: symname=%s, symtab=%px\n", symname,
                            symtab);
         memset(symtab, 0, sizeof(*symtab));
         symtab->sym_start = kallsyms_lookup_name(symname);
@@ -88,7 +88,7 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab)
         char *knt1 = NULL;
 
         if (KDB_DEBUG(AR))
-                kdb_printf("kdbnearsym: addr=0x%lx, symtab=%p\n", addr, symtab);
+                kdb_printf("kdbnearsym: addr=0x%lx, symtab=%px\n", addr, symtab);
         memset(symtab, 0, sizeof(*symtab));
 
         if (addr < 4096)
@@ -149,7 +149,7 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab)
                 symtab->mod_name = "kernel";
         if (KDB_DEBUG(AR))
                 kdb_printf("kdbnearsym: returns %d symtab->sym_start=0x%lx, "
-                   "symtab->mod_name=%p, symtab->sym_name=%p (%s)\n", ret,
+                   "symtab->mod_name=%px, symtab->sym_name=%px (%s)\n", ret,
                    symtab->sym_start, symtab->mod_name, symtab->sym_name,
                    symtab->sym_name);
 
@@ -221,11 +221,13 @@ int kallsyms_symbol_complete(char *prefix_name, int max_len)
  * Parameters:
  *      prefix_name     prefix of a symbol name to lookup
  *      flag    0 means search from the head, 1 means continue search.
+ *      buf_size        maximum length that can be written to prefix_name
+ *                      buffer
  * Returns:
  *      1 if a symbol matches the given prefix.
  *      0 if no string found
  */
-int kallsyms_symbol_next(char *prefix_name, int flag)
+int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size)
 {
         int prefix_len = strlen(prefix_name);
         static loff_t pos;
@@ -235,10 +237,8 @@ int kallsyms_symbol_next(char *prefix_name, int flag)
                 pos = 0;
 
         while ((name = kdb_walk_kallsyms(&pos))) {
-                if (strncmp(name, prefix_name, prefix_len) == 0) {
-                        strncpy(prefix_name, name, strlen(name)+1);
-                        return 1;
-                }
+                if (!strncmp(name, prefix_name, prefix_len))
+                        return strscpy(prefix_name, name, buf_size);
         }
         return 0;
 }
@@ -432,7 +432,7 @@ int kdb_getphysword(unsigned long *word, unsigned long addr, size_t size)
                                 *word = w8;
                         break;
                 }
-                /* drop through */
+                /* fall through */
         default:
                 diag = KDB_BADWIDTH;
                 kdb_printf("kdb_getphysword: bad width %ld\n", (long) size);
@@ -481,7 +481,7 @@ int kdb_getword(unsigned long *word, unsigned long addr, size_t size)
                                 *word = w8;
                         break;
                 }
-                /* drop through */
+                /* fall through */
         default:
                 diag = KDB_BADWIDTH;
                 kdb_printf("kdb_getword: bad width %ld\n", (long) size);
@@ -525,7 +525,7 @@ int kdb_putword(unsigned long addr, unsigned long word, size_t size)
                         diag = kdb_putarea(addr, w8);
                         break;
                 }
-                /* drop through */
+                /* fall through */
         default:
                 diag = KDB_BADWIDTH;
                 kdb_printf("kdb_putword: bad width %ld\n", (long) size);
@@ -887,13 +887,13 @@ void debug_kusage(void)
                    __func__, dah_first);
         if (dah_first) {
                 h_used = (struct debug_alloc_header *)debug_alloc_pool;
-                kdb_printf("%s: h_used %p size %d\n", __func__, h_used,
+                kdb_printf("%s: h_used %px size %d\n", __func__, h_used,
                            h_used->size);
         }
         do {
                 h_used = (struct debug_alloc_header *)
                           ((char *)h_free + dah_overhead + h_free->size);
-                kdb_printf("%s: h_used %p size %d caller %p\n",
+                kdb_printf("%s: h_used %px size %d caller %px\n",
                            __func__, h_used, h_used->size, h_used->caller);
                 h_free = (struct debug_alloc_header *)
                           (debug_alloc_pool + h_free->next);
@@ -902,7 +902,7 @@ void debug_kusage(void)
                   ((char *)h_free + dah_overhead + h_free->size);
         if ((char *)h_used - debug_alloc_pool !=
             sizeof(debug_alloc_pool_aligned))
-                kdb_printf("%s: h_used %p size %d caller %p\n",
+                kdb_printf("%s: h_used %px size %d caller %px\n",
                            __func__, h_used, h_used->size, h_used->caller);
 out:
         spin_unlock(&dap_lock);
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index d8831b988b1e..ab4a3be1542a 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -281,13 +281,7 @@ static bool generic_key_to_expire(struct rpc_cred *cred)
 {
         struct auth_cred *acred = &container_of(cred, struct generic_cred,
                                                 gc_base)->acred;
-        bool ret;
-
-        get_rpccred(cred);
-        ret = test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags);
-        put_rpccred(cred);
-
-        return ret;
+        return test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags);
 }
 
 static const struct rpc_credops generic_credops = {
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 30f970cdc7f6..5d3f252659f1 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1239,36 +1239,59 @@ gss_create(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
         return &gss_auth->rpc_auth;
 }
 
+static struct gss_cred *
+gss_dup_cred(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
+{
+        struct gss_cred *new;
+
+        /* Make a copy of the cred so that we can reference count it */
+        new = kzalloc(sizeof(*gss_cred), GFP_NOIO);
+        if (new) {
+                struct auth_cred acred = {
+                        .uid = gss_cred->gc_base.cr_uid,
+                };
+                struct gss_cl_ctx *ctx =
+                        rcu_dereference_protected(gss_cred->gc_ctx, 1);
+
+                rpcauth_init_cred(&new->gc_base, &acred,
+                                &gss_auth->rpc_auth,
+                                &gss_nullops);
+                new->gc_base.cr_flags = 1UL << RPCAUTH_CRED_UPTODATE;
+                new->gc_service = gss_cred->gc_service;
+                new->gc_principal = gss_cred->gc_principal;
+                kref_get(&gss_auth->kref);
+                rcu_assign_pointer(new->gc_ctx, ctx);
+                gss_get_ctx(ctx);
+        }
+        return new;
+}
+
 /*
- * gss_destroying_context will cause the RPCSEC_GSS to send a NULL RPC call
+ * gss_send_destroy_context will cause the RPCSEC_GSS to send a NULL RPC call
  * to the server with the GSS control procedure field set to
  * RPC_GSS_PROC_DESTROY. This should normally cause the server to release
  * all RPCSEC_GSS state associated with that context.
  */
-static int
-gss_destroying_context(struct rpc_cred *cred)
+static void
+gss_send_destroy_context(struct rpc_cred *cred)
 {
         struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
         struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth);
         struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1);
+        struct gss_cred *new;
         struct rpc_task *task;
 
-        if (test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) == 0)
-                return 0;
-
-        ctx->gc_proc = RPC_GSS_PROC_DESTROY;
-        cred->cr_ops = &gss_nullops;
-
-        /* Take a reference to ensure the cred will be destroyed either
-         * by the RPC call or by the put_rpccred() below */
-        get_rpccred(cred);
+        new = gss_dup_cred(gss_auth, gss_cred);
+        if (new) {
+                ctx->gc_proc = RPC_GSS_PROC_DESTROY;
 
-        task = rpc_call_null(gss_auth->client, cred, RPC_TASK_ASYNC|RPC_TASK_SOFT);
-        if (!IS_ERR(task))
-                rpc_put_task(task);
+                task = rpc_call_null(gss_auth->client, &new->gc_base,
+                                RPC_TASK_ASYNC|RPC_TASK_SOFT);
+                if (!IS_ERR(task))
+                        rpc_put_task(task);
 
-        put_rpccred(cred);
-        return 1;
+                put_rpccred(&new->gc_base);
+        }
 }
 
 /* gss_destroy_cred (and gss_free_ctx) are used to clean up after failure
@@ -1330,8 +1353,8 @@ static void
 gss_destroy_cred(struct rpc_cred *cred)
 {
 
-        if (gss_destroying_context(cred))
-                return;
+        if (test_and_clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0)
+                gss_send_destroy_context(cred);
         gss_destroy_nullcred(cred);
 }
 
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 2bbb8d38d2bf..f302c6eb8779 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -546,7 +546,7 @@ EXPORT_SYMBOL_GPL(xdr_commit_encode);
 static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr,
                 size_t nbytes)
 {
-        static __be32 *p;
+        __be32 *p;
         int space_left;
         int frag1bytes, frag2bytes;
 
@@ -673,11 +673,10 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
                 WARN_ON_ONCE(xdr->iov);
                 return;
         }
-        if (fraglen) {
+        if (fraglen)
                 xdr->end = head->iov_base + head->iov_len;
-                xdr->page_ptr--;
-        }
         /* (otherwise assume xdr->end is already set) */
+        xdr->page_ptr--;
         head->iov_len = len;
         buf->len = len;
         xdr->p = head->iov_base + head->iov_len;
diff --git a/security/integrity/digsig_asymmetric.c b/security/integrity/digsig_asymmetric.c
index 6dc075144508..d775e03fbbcc 100644
--- a/security/integrity/digsig_asymmetric.c
+++ b/security/integrity/digsig_asymmetric.c
@@ -106,6 +106,7 @@ int asymmetric_verify(struct key *keyring, const char *sig,
 
         pks.pkey_algo = "rsa";
         pks.hash_algo = hash_algo_name[hdr->hash_algo];
+        pks.encoding = "pkcs1";
         pks.digest = (u8 *)data;
         pks.digest_size = datalen;
         pks.s = hdr->sig;
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 7ce683259357..a67459eb62d5 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5318,6 +5318,9 @@ static int selinux_sctp_bind_connect(struct sock *sk, int optname,
         addr_buf = address;
 
         while (walk_size < addrlen) {
+                if (walk_size + sizeof(sa_family_t) > addrlen)
+                        return -EINVAL;
+
                 addr = addr_buf;
                 switch (addr->sa_family) {
                 case AF_UNSPEC:
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index 2fe459df3c85..b7efa2296969 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -245,9 +245,13 @@ int mls_context_to_sid(struct policydb *pol,
         char *rangep[2];
 
         if (!pol->mls_enabled) {
-                if ((def_sid != SECSID_NULL && oldc) || (*scontext) == '\0')
-                        return 0;
-                return -EINVAL;
+                /*
+                 * With no MLS, only return -EINVAL if there is a MLS field
+                 * and it did not come from an xattr.
+                 */
+                if (oldc && def_sid == SECSID_NULL)
+                        return -EINVAL;
+                return 0;
         }
 
         /*
diff --git a/tools/testing/selftests/powerpc/mm/wild_bctr.c b/tools/testing/selftests/powerpc/mm/wild_bctr.c
index 1b0e9e9a2ddc..f2fa101c5a6a 100644
--- a/tools/testing/selftests/powerpc/mm/wild_bctr.c
+++ b/tools/testing/selftests/powerpc/mm/wild_bctr.c
@@ -47,8 +47,9 @@ static int ok(void)
         return 0;
 }
 
-#define REG_POISON      0x5a5aUL
-#define POISONED_REG(n) ((REG_POISON << 48) | ((n) << 32) | (REG_POISON << 16) | (n))
+#define REG_POISON      0x5a5a
+#define POISONED_REG(n) ((((unsigned long)REG_POISON) << 48) | ((n) << 32) | \
+                         (((unsigned long)REG_POISON) << 16) | (n))
 
 static inline void poison_regs(void)
 {
@@ -105,6 +106,20 @@ static void dump_regs(void)
         }
 }
 
+#ifdef _CALL_AIXDESC
+struct opd {
+        unsigned long ip;
+        unsigned long toc;
+        unsigned long env;
+};
+static struct opd bad_opd = {
+        .ip = BAD_NIP,
+};
+#define BAD_FUNC (&bad_opd)
+#else
+#define BAD_FUNC BAD_NIP
+#endif
+
 int test_wild_bctr(void)
 {
         int (*func_ptr)(void);
@@ -133,7 +148,7 @@ int test_wild_bctr(void)
 
                 poison_regs();
 
-                func_ptr = (int (*)(void))BAD_NIP;
+                func_ptr = (int (*)(void))BAD_FUNC;
                 func_ptr();
 
                 FAIL_IF(1); /* we didn't segv? */