25 files changed, 225 insertions, 165 deletions

diff --git a/drivers/base/dma-coherent.c b/drivers/base/dma-coherent.c
index a39b2166b145..744f64f43454 100644
--- a/drivers/base/dma-coherent.c
+++ b/drivers/base/dma-coherent.c
@@ -348,16 +348,15 @@ static int rmem_dma_device_init(struct reserved_mem *rmem, struct device *dev)
         struct dma_coherent_mem *mem = rmem->priv;
         int ret;
 
-        if (!mem)
-                return -ENODEV;
-
-        ret = dma_init_coherent_memory(rmem->base, rmem->base, rmem->size,
-                                       DMA_MEMORY_EXCLUSIVE, &mem);
-
-        if (ret) {
-                pr_err("Reserved memory: failed to init DMA memory pool at %pa, size %ld MiB\n",
-                        &rmem->base, (unsigned long)rmem->size / SZ_1M);
-                return ret;
+        if (!mem) {
+                ret = dma_init_coherent_memory(rmem->base, rmem->base,
+                                               rmem->size,
+                                               DMA_MEMORY_EXCLUSIVE, &mem);
+                if (ret) {
+                        pr_err("Reserved memory: failed to init DMA memory pool at %pa, size %ld MiB\n",
+                                &rmem->base, (unsigned long)rmem->size / SZ_1M);
+                        return ret;
+                }
         }
         mem->use_dev_dma_pfn_offset = true;
         rmem->priv = mem;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
index 681b639f5133..0649dd43e780 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
@@ -183,7 +183,7 @@ static void uninitialize(struct kernel_queue *kq)
 {
         if (kq->queue->properties.type == KFD_QUEUE_TYPE_HIQ)
                 kq->mqd->destroy_mqd(kq->mqd,
-                                        NULL,
+                                        kq->queue->mqd,
                                         false,
                                         QUEUE_PREEMPT_DEFAULT_TIMEOUT_MS,
                                         kq->queue->pipe,
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
index 1cae95e2b13a..03bec765b03d 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
@@ -143,7 +143,6 @@ int pqm_create_queue(struct process_queue_manager *pqm,
         int num_queues = 0;
         struct queue *cur;
 
-        memset(&q_properties, 0, sizeof(struct queue_properties));
         memcpy(&q_properties, properties, sizeof(struct queue_properties));
         q = NULL;
         kq = NULL;
diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
index 730b8d9db187..6be5b53c3b27 100644
--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
@@ -14,6 +14,7 @@
 #include <linux/clk.h>
 #include <linux/component.h>
 #include <linux/iopoll.h>
+#include <linux/irq.h>
 #include <linux/mfd/syscon.h>
 #include <linux/of_device.h>
 #include <linux/of_gpio.h>
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index b1f7299600f0..e651a58c18cf 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -168,23 +168,19 @@ static struct drm_driver exynos_drm_driver = {
 static int exynos_drm_suspend(struct device *dev)
 {
         struct drm_device *drm_dev = dev_get_drvdata(dev);
-        struct drm_connector *connector;
-        struct drm_connector_list_iter conn_iter;
+        struct exynos_drm_private *private = drm_dev->dev_private;
 
         if (pm_runtime_suspended(dev) || !drm_dev)
                 return 0;
 
-        drm_connector_list_iter_begin(drm_dev, &conn_iter);
-        drm_for_each_connector_iter(connector, &conn_iter) {
-                int old_dpms = connector->dpms;
-
-                if (connector->funcs->dpms)
-                        connector->funcs->dpms(connector, DRM_MODE_DPMS_OFF);
-
-                /* Set the old mode back to the connector for resume */
-                connector->dpms = old_dpms;
+        drm_kms_helper_poll_disable(drm_dev);
+        exynos_drm_fbdev_suspend(drm_dev);
+        private->suspend_state = drm_atomic_helper_suspend(drm_dev);
+        if (IS_ERR(private->suspend_state)) {
+                exynos_drm_fbdev_resume(drm_dev);
+                drm_kms_helper_poll_enable(drm_dev);
+                return PTR_ERR(private->suspend_state);
         }
-        drm_connector_list_iter_end(&conn_iter);
 
         return 0;
 }
@@ -192,22 +188,14 @@ static int exynos_drm_suspend(struct device *dev)
 static int exynos_drm_resume(struct device *dev)
 {
         struct drm_device *drm_dev = dev_get_drvdata(dev);
-        struct drm_connector *connector;
-        struct drm_connector_list_iter conn_iter;
+        struct exynos_drm_private *private = drm_dev->dev_private;
 
         if (pm_runtime_suspended(dev) || !drm_dev)
                 return 0;
 
-        drm_connector_list_iter_begin(drm_dev, &conn_iter);
-        drm_for_each_connector_iter(connector, &conn_iter) {
-                if (connector->funcs->dpms) {
-                        int dpms = connector->dpms;
-
-                        connector->dpms = DRM_MODE_DPMS_OFF;
-                        connector->funcs->dpms(connector, dpms);
-                }
-        }
-        drm_connector_list_iter_end(&conn_iter);
+        drm_atomic_helper_resume(drm_dev, private->suspend_state);
+        exynos_drm_fbdev_resume(drm_dev);
+        drm_kms_helper_poll_enable(drm_dev);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index cf131c2aa23e..f8bae4cb4823 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -202,6 +202,7 @@ struct drm_exynos_file_private {
  */
 struct exynos_drm_private {
         struct drm_fb_helper *fb_helper;
+        struct drm_atomic_state *suspend_state;
 
         struct device *dma_dev;
         void *mapping;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index c3a068409b48..dfb66ecf417b 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -18,6 +18,8 @@
 #include <drm/drm_crtc_helper.h>
 #include <drm/exynos_drm.h>
 
+#include <linux/console.h>
+
 #include "exynos_drm_drv.h"
 #include "exynos_drm_fb.h"
 #include "exynos_drm_fbdev.h"
@@ -285,3 +287,21 @@ void exynos_drm_output_poll_changed(struct drm_device *dev)
 
         drm_fb_helper_hotplug_event(fb_helper);
 }
+
+void exynos_drm_fbdev_suspend(struct drm_device *dev)
+{
+        struct exynos_drm_private *private = dev->dev_private;
+
+        console_lock();
+        drm_fb_helper_set_suspend(private->fb_helper, 1);
+        console_unlock();
+}
+
+void exynos_drm_fbdev_resume(struct drm_device *dev)
+{
+        struct exynos_drm_private *private = dev->dev_private;
+
+        console_lock();
+        drm_fb_helper_set_suspend(private->fb_helper, 0);
+        console_unlock();
+}
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.h b/drivers/gpu/drm/exynos/exynos_drm_fbdev.h
index 330eef87f718..645d1bb7f665 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.h
@@ -21,6 +21,8 @@ int exynos_drm_fbdev_init(struct drm_device *dev);
 void exynos_drm_fbdev_fini(struct drm_device *dev);
 void exynos_drm_fbdev_restore_mode(struct drm_device *dev);
 void exynos_drm_output_poll_changed(struct drm_device *dev);
+void exynos_drm_fbdev_suspend(struct drm_device *drm);
+void exynos_drm_fbdev_resume(struct drm_device *drm);
 
 #else
 
@@ -39,6 +41,14 @@ static inline void exynos_drm_fbdev_restore_mode(struct drm_device *dev)
 
 #define exynos_drm_output_poll_changed (NULL)
 
+static inline void exynos_drm_fbdev_suspend(struct drm_device *drm)
+{
+}
+
+static inline void exynos_drm_fbdev_resume(struct drm_device *drm)
+{
+}
+
 #endif
 
 #endif
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 214fa5e51963..0109ff40b1db 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -944,22 +944,27 @@ static bool hdmi_mode_fixup(struct drm_encoder *encoder,
         struct drm_device *dev = encoder->dev;
         struct drm_connector *connector;
         struct drm_display_mode *m;
+        struct drm_connector_list_iter conn_iter;
         int mode_ok;
 
         drm_mode_set_crtcinfo(adjusted_mode, 0);
 
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        drm_for_each_connector_iter(connector, &conn_iter) {
                 if (connector->encoder == encoder)
                         break;
         }
+        if (connector)
+                drm_connector_get(connector);
+        drm_connector_list_iter_end(&conn_iter);
 
-        if (connector->encoder != encoder)
+        if (!connector)
                 return true;
 
         mode_ok = hdmi_mode_valid(connector, adjusted_mode);
 
         if (mode_ok == MODE_OK)
-                return true;
+                goto cleanup;
 
         /*
          * Find the most suitable mode and copy it to adjusted_mode.
@@ -979,6 +984,9 @@ static bool hdmi_mode_fixup(struct drm_encoder *encoder,
                 }
         }
 
+cleanup:
+        drm_connector_put(connector);
+
         return true;
 }
 
diff --git a/drivers/gpu/drm/i915/gvt/cfg_space.c b/drivers/gpu/drm/i915/gvt/cfg_space.c
index 40af17ec6312..ff3154fe6588 100644
--- a/drivers/gpu/drm/i915/gvt/cfg_space.c
+++ b/drivers/gpu/drm/i915/gvt/cfg_space.c
@@ -197,78 +197,65 @@ static int emulate_pci_command_write(struct intel_vgpu *vgpu,
 static int emulate_pci_bar_write(struct intel_vgpu *vgpu, unsigned int offset,
         void *p_data, unsigned int bytes)
 {
-        unsigned int bar_index =
-                (rounddown(offset, 8) % PCI_BASE_ADDRESS_0) / 8;
         u32 new = *(u32 *)(p_data);
         bool lo = IS_ALIGNED(offset, 8);
         u64 size;
         int ret = 0;
         bool mmio_enabled =
                 vgpu_cfg_space(vgpu)[PCI_COMMAND] & PCI_COMMAND_MEMORY;
+        struct intel_vgpu_pci_bar *bars = vgpu->cfg_space.bar;
 
-        if (WARN_ON(bar_index >= INTEL_GVT_PCI_BAR_MAX))
-                return -EINVAL;
-
+        /*
+         * Power-up software can determine how much address
+         * space the device requires by writing a value of
+         * all 1's to the register and then reading the value
+         * back. The device will return 0's in all don't-care
+         * address bits.
+         */
         if (new == 0xffffffff) {
-                /*
-                 * Power-up software can determine how much address
-                 * space the device requires by writing a value of
-                 * all 1's to the register and then reading the value
-                 * back. The device will return 0's in all don't-care
-                 * address bits.
-                 */
-                size = vgpu->cfg_space.bar[bar_index].size;
-                if (lo) {
-                        new = rounddown(new, size);
-                } else {
-                        u32 val = vgpu_cfg_space(vgpu)[rounddown(offset, 8)];
-                        /* for 32bit mode bar it returns all-0 in upper 32
-                         * bit, for 64bit mode bar it will calculate the
-                         * size with lower 32bit and return the corresponding
-                         * value
+                switch (offset) {
+                case PCI_BASE_ADDRESS_0:
+                case PCI_BASE_ADDRESS_1:
+                        size = ~(bars[INTEL_GVT_PCI_BAR_GTTMMIO].size -1);
+                        intel_vgpu_write_pci_bar(vgpu, offset,
+                                                size >> (lo ? 0 : 32), lo);
+                        /*
+                         * Untrap the BAR, since guest hasn't configured a
+                         * valid GPA
                          */
-                        if (val & PCI_BASE_ADDRESS_MEM_TYPE_64)
-                                new &= (~(size-1)) >> 32;
-                        else
-                                new = 0;
-                }
-                /*
-                 * Unmapp & untrap the BAR, since guest hasn't configured a
-                 * valid GPA
-                 */
-                switch (bar_index) {
-                case INTEL_GVT_PCI_BAR_GTTMMIO:
                         ret = trap_gttmmio(vgpu, false);
                         break;
-                case INTEL_GVT_PCI_BAR_APERTURE:
+                case PCI_BASE_ADDRESS_2:
+                case PCI_BASE_ADDRESS_3:
+                        size = ~(bars[INTEL_GVT_PCI_BAR_APERTURE].size -1);
+                        intel_vgpu_write_pci_bar(vgpu, offset,
+                                                size >> (lo ? 0 : 32), lo);
                         ret = map_aperture(vgpu, false);
                         break;
+                default:
+                        /* Unimplemented BARs */
+                        intel_vgpu_write_pci_bar(vgpu, offset, 0x0, false);
                 }
-                intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
         } else {
-                /*
-                 * Unmapp & untrap the old BAR first, since guest has
-                 * re-configured the BAR
-                 */
-                switch (bar_index) {
-                case INTEL_GVT_PCI_BAR_GTTMMIO:
-                        ret = trap_gttmmio(vgpu, false);
+                switch (offset) {
+                case PCI_BASE_ADDRESS_0:
+                case PCI_BASE_ADDRESS_1:
+                        /*
+                         * Untrap the old BAR first, since guest has
+                         * re-configured the BAR
+                         */
+                        trap_gttmmio(vgpu, false);
+                        intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
+                        ret = trap_gttmmio(vgpu, mmio_enabled);
                         break;
-                case INTEL_GVT_PCI_BAR_APERTURE:
-                        ret = map_aperture(vgpu, false);
+                case PCI_BASE_ADDRESS_2:
+                case PCI_BASE_ADDRESS_3:
+                        map_aperture(vgpu, false);
+                        intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
+                        ret = map_aperture(vgpu, mmio_enabled);
                         break;
-                }
-                intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
-                /* Track the new BAR */
-                if (mmio_enabled) {
-                        switch (bar_index) {
-                        case INTEL_GVT_PCI_BAR_GTTMMIO:
-                                ret = trap_gttmmio(vgpu, true);
-                                break;
-                        case INTEL_GVT_PCI_BAR_APERTURE:
-                                ret = map_aperture(vgpu, true);
-                                break;
-                        }
+                default:
+                        intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
                 }
         }
         return ret;
@@ -299,10 +286,7 @@ int intel_vgpu_emulate_cfg_write(struct intel_vgpu *vgpu, unsigned int offset,
         }
 
         switch (rounddown(offset, 4)) {
-        case PCI_BASE_ADDRESS_0:
-        case PCI_BASE_ADDRESS_1:
-        case PCI_BASE_ADDRESS_2:
-        case PCI_BASE_ADDRESS_3:
+        case PCI_BASE_ADDRESS_0 ... PCI_BASE_ADDRESS_5:
                 if (WARN_ON(!IS_ALIGNED(offset, 4)))
                         return -EINVAL;
                 return emulate_pci_bar_write(vgpu, offset, p_data, bytes);
@@ -344,7 +328,6 @@ void intel_vgpu_init_cfg_space(struct intel_vgpu *vgpu,
         struct intel_gvt *gvt = vgpu->gvt;
         const struct intel_gvt_device_info *info = &gvt->device_info;
         u16 *gmch_ctl;
-        int i;
 
         memcpy(vgpu_cfg_space(vgpu), gvt->firmware.cfg_space,
                info->cfg_space_size);
@@ -371,13 +354,13 @@ void intel_vgpu_init_cfg_space(struct intel_vgpu *vgpu,
          */
         memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_1, 0, 4);
         memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_3, 0, 4);
+        memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_4, 0, 8);
         memset(vgpu_cfg_space(vgpu) + INTEL_GVT_PCI_OPREGION, 0, 4);
 
-        for (i = 0; i < INTEL_GVT_MAX_BAR_NUM; i++) {
-                vgpu->cfg_space.bar[i].size = pci_resource_len(
-                                              gvt->dev_priv->drm.pdev, i * 2);
-                vgpu->cfg_space.bar[i].tracked = false;
-        }
+        vgpu->cfg_space.bar[INTEL_GVT_PCI_BAR_GTTMMIO].size =
+                                pci_resource_len(gvt->dev_priv->drm.pdev, 0);
+        vgpu->cfg_space.bar[INTEL_GVT_PCI_BAR_APERTURE].size =
+                                pci_resource_len(gvt->dev_priv->drm.pdev, 2);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index e21ce9c18b6e..b63893eeca73 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -839,7 +839,6 @@ static bool i915_get_crtc_scanoutpos(struct drm_device *dev, unsigned int pipe,
                                                                 pipe);
         int position;
         int vbl_start, vbl_end, hsync_start, htotal, vtotal;
-        bool in_vbl = true;
         unsigned long irqflags;
 
         if (WARN_ON(!mode->crtc_clock)) {
@@ -922,8 +921,6 @@ static bool i915_get_crtc_scanoutpos(struct drm_device *dev, unsigned int pipe,
 
         spin_unlock_irqrestore(&dev_priv->uncore.lock, irqflags);
 
-        in_vbl = position >= vbl_start && position < vbl_end;
-
         /*
          * While in vblank, position will be negative
          * counting up towards 0 at vbl_end. And outside
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index f17275519484..00cd17c76fdc 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -14030,7 +14030,7 @@ static int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
 
                 if (mode_cmd->handles[i] != mode_cmd->handles[0]) {
                         DRM_DEBUG_KMS("bad plane %d handle\n", i);
-                        return -EINVAL;
+                        goto err;
                 }
 
                 stride_alignment = intel_fb_stride_alignment(fb, i);
diff --git a/drivers/gpu/drm/i915/intel_dsi.c b/drivers/gpu/drm/i915/intel_dsi.c
index f0c11aec5ea5..7442891762be 100644
--- a/drivers/gpu/drm/i915/intel_dsi.c
+++ b/drivers/gpu/drm/i915/intel_dsi.c
@@ -892,8 +892,6 @@ static void intel_dsi_disable(struct intel_encoder *encoder,
                               struct intel_crtc_state *old_crtc_state,
                               struct drm_connector_state *old_conn_state)
 {
-        struct drm_device *dev = encoder->base.dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_dsi *intel_dsi = enc_to_intel_dsi(&encoder->base);
         enum port port;
 
@@ -903,15 +901,6 @@ static void intel_dsi_disable(struct intel_encoder *encoder,
         intel_panel_disable_backlight(old_conn_state);
 
         /*
-         * Disable Device ready before the port shutdown in order
-         * to avoid split screen
-         */
-        if (IS_BROXTON(dev_priv)) {
-                for_each_dsi_port(port, intel_dsi->ports)
-                        I915_WRITE(MIPI_DEVICE_READY(port), 0);
-        }
-
-        /*
          * According to the spec we should send SHUTDOWN before
          * MIPI_SEQ_DISPLAY_OFF only for v3+ VBTs, but field testing
          * has shown that the v3 sequence works for v2 VBTs too
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index a17b1de7d7e0..3b1c5d783ee7 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -1699,6 +1699,8 @@ bxt_setup_backlight(struct intel_connector *connector, enum pipe unused)
         if (!panel->backlight.max)
                 return -ENODEV;
 
+        panel->backlight.min = get_backlight_min_vbt(connector);
+
         val = bxt_get_backlight(connector);
         val = intel_panel_compute_brightness(connector, val);
         panel->backlight.level = clamp(val, panel->backlight.min,
@@ -1735,6 +1737,8 @@ cnp_setup_backlight(struct intel_connector *connector, enum pipe unused)
         if (!panel->backlight.max)
                 return -ENODEV;
 
+        panel->backlight.min = get_backlight_min_vbt(connector);
+
         val = bxt_get_backlight(connector);
         val = intel_panel_compute_brightness(connector, val);
         panel->backlight.level = clamp(val, panel->backlight.min,
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 4188a4881148..076409455b60 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -811,6 +811,14 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
                         spin_unlock(&head->batch_head->batch_lock);
                         goto unlock_out;
                 }
+                /*
+                 * We must assign batch_head of this stripe within the
+                 * batch_lock, otherwise clear_batch_ready of batch head
+                 * stripe could clear BATCH_READY bit of this stripe and
+                 * this stripe->batch_head doesn't get assigned, which
+                 * could confuse clear_batch_ready for this stripe
+                 */
+                sh->batch_head = head->batch_head;
 
                 /*
                  * at this point, head's BATCH_READY could be cleared, but we
@@ -818,8 +826,6 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
                  */
                 list_add(&sh->batch_list, &head->batch_list);
                 spin_unlock(&head->batch_head->batch_lock);
-
-                sh->batch_head = head->batch_head;
         } else {
                 head->batch_head = head;
                 sh->batch_head = head->batch_head;
@@ -4599,7 +4605,8 @@ static void break_stripe_batch_list(struct stripe_head *head_sh,
 
                 set_mask_bits(&sh->state, ~(STRIPE_EXPAND_SYNC_FLAGS |
                                             (1 << STRIPE_PREREAD_ACTIVE) |
-                                            (1 << STRIPE_DEGRADED)),
+                                            (1 << STRIPE_DEGRADED) |
+                                            (1 << STRIPE_ON_UNPLUG_LIST)),
                               head_sh->state & (1 << STRIPE_INSYNC));
 
                 sh->check_state = head_sh->check_state;
diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
index affa7370ba82..74c663b1c0a7 100644
--- a/drivers/mmc/core/queue.c
+++ b/drivers/mmc/core/queue.c
@@ -242,6 +242,12 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
         if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask)
                 limit = (u64)dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
 
+        /*
+         * mmc_init_request() depends on card->bouncesz so it must be calculated
+         * before blk_init_allocated_queue() starts allocating requests.
+         */
+        card->bouncesz = mmc_queue_calc_bouncesz(host);
+
         mq->card = card;
         mq->queue = blk_alloc_queue(GFP_KERNEL);
         if (!mq->queue)
@@ -265,7 +271,6 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
         if (mmc_can_erase(card))
                 mmc_queue_setup_discard(mq->queue, card);
 
-        card->bouncesz = mmc_queue_calc_bouncesz(host);
         if (card->bouncesz) {
                 blk_queue_max_hw_sectors(mq->queue, card->bouncesz / 512);
                 blk_queue_max_segments(mq->queue, card->bouncesz / 512);
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index 02179ed2a40d..8c15637178ff 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -5,7 +5,7 @@
 comment "MMC/SD/SDIO Host Controller Drivers"
 
 config MMC_DEBUG
-        bool "MMC host drivers debugginG"
+        bool "MMC host drivers debugging"
         depends on MMC != n
         help
           This is an option for use by developers; most people should
diff --git a/drivers/mmc/host/cavium-thunderx.c b/drivers/mmc/host/cavium-thunderx.c
index b9cc95998799..eee08d81b242 100644
--- a/drivers/mmc/host/cavium-thunderx.c
+++ b/drivers/mmc/host/cavium-thunderx.c
@@ -7,6 +7,7 @@
  *
  * Copyright (C) 2016 Cavium Inc.
  */
+#include <linux/device.h>
 #include <linux/dma-mapping.h>
 #include <linux/interrupt.h>
 #include <linux/mmc/mmc.h>
@@ -149,8 +150,11 @@ error:
         for (i = 0; i < CAVIUM_MAX_MMC; i++) {
                 if (host->slot[i])
                         cvm_mmc_of_slot_remove(host->slot[i]);
-                if (host->slot_pdev[i])
+                if (host->slot_pdev[i]) {
+                        get_device(&host->slot_pdev[i]->dev);
                         of_platform_device_destroy(&host->slot_pdev[i]->dev, NULL);
+                        put_device(&host->slot_pdev[i]->dev);
+                }
         }
         clk_disable_unprepare(host->clk);
         return ret;
diff --git a/drivers/mtd/nand/lpc32xx_mlc.c b/drivers/mtd/nand/lpc32xx_mlc.c
index c3bb358ef01e..5796468db653 100644
--- a/drivers/mtd/nand/lpc32xx_mlc.c
+++ b/drivers/mtd/nand/lpc32xx_mlc.c
@@ -707,7 +707,7 @@ static int lpc32xx_nand_probe(struct platform_device *pdev)
         }
         res = clk_prepare_enable(host->clk);
         if (res)
-                goto err_exit1;
+                goto err_put_clk;
 
         nand_chip->cmd_ctrl = lpc32xx_nand_cmd_ctrl;
         nand_chip->dev_ready = lpc32xx_nand_device_ready;
@@ -814,6 +814,7 @@ err_exit3:
                 dma_release_channel(host->dma_chan);
 err_exit2:
         clk_disable_unprepare(host->clk);
+err_put_clk:
         clk_put(host->clk);
 err_exit1:
         lpc32xx_wp_enable(host);
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index bcc8cef1c615..12edaae17d81 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -2668,7 +2668,7 @@ static uint8_t *nand_fill_oob(struct mtd_info *mtd, uint8_t *oob, size_t len,
 static int nand_do_write_ops(struct mtd_info *mtd, loff_t to,
                              struct mtd_oob_ops *ops)
 {
-        int chipnr, realpage, page, blockmask, column;
+        int chipnr, realpage, page, column;
         struct nand_chip *chip = mtd_to_nand(mtd);
         uint32_t writelen = ops->len;
 
@@ -2704,7 +2704,6 @@ static int nand_do_write_ops(struct mtd_info *mtd, loff_t to,
 
         realpage = (int)(to >> chip->page_shift);
         page = realpage & chip->pagemask;
-        blockmask = (1 << (chip->phys_erase_shift - chip->page_shift)) - 1;
 
         /* Invalidate the page cache, when we write to the cached page */
         if (to <= ((loff_t)chip->pagebuf << chip->page_shift) &&
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index cf1d4a15e10a..19c000722cbc 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -1784,7 +1784,7 @@ spi_nor_set_pp_settings(struct spi_nor_pp_command *pp,
  * @nor:        pointer to a 'struct spi_nor'
  * @addr:       offset in the SFDP area to start reading data from
  * @len:        number of bytes to read
- * @buf:        buffer where the SFDP data are copied into
+ * @buf:        buffer where the SFDP data are copied into (dma-safe memory)
  *
  * Whatever the actual numbers of bytes for address and dummy cycles are
  * for (Fast) Read commands, the Read SFDP (5Ah) instruction is always
@@ -1829,6 +1829,36 @@ read_err:
         return ret;
 }
 
+/**
+ * spi_nor_read_sfdp_dma_unsafe() - read Serial Flash Discoverable Parameters.
+ * @nor:        pointer to a 'struct spi_nor'
+ * @addr:       offset in the SFDP area to start reading data from
+ * @len:        number of bytes to read
+ * @buf:        buffer where the SFDP data are copied into
+ *
+ * Wrap spi_nor_read_sfdp() using a kmalloc'ed bounce buffer as @buf is now not
+ * guaranteed to be dma-safe.
+ *
+ * Return: -ENOMEM if kmalloc() fails, the return code of spi_nor_read_sfdp()
+ *          otherwise.
+ */
+static int spi_nor_read_sfdp_dma_unsafe(struct spi_nor *nor, u32 addr,
+                                        size_t len, void *buf)
+{
+        void *dma_safe_buf;
+        int ret;
+
+        dma_safe_buf = kmalloc(len, GFP_KERNEL);
+        if (!dma_safe_buf)
+                return -ENOMEM;
+
+        ret = spi_nor_read_sfdp(nor, addr, len, dma_safe_buf);
+        memcpy(buf, dma_safe_buf, len);
+        kfree(dma_safe_buf);
+
+        return ret;
+}
+
 struct sfdp_parameter_header {
         u8              id_lsb;
         u8              minor;
@@ -2101,7 +2131,7 @@ static int spi_nor_parse_bfpt(struct spi_nor *nor,
                     bfpt_header->length * sizeof(u32));
         addr = SFDP_PARAM_HEADER_PTP(bfpt_header);
         memset(&bfpt, 0, sizeof(bfpt));
-        err = spi_nor_read_sfdp(nor,  addr, len, &bfpt);
+        err = spi_nor_read_sfdp_dma_unsafe(nor,  addr, len, &bfpt);
         if (err < 0)
                 return err;
 
@@ -2127,6 +2157,15 @@ static int spi_nor_parse_bfpt(struct spi_nor *nor,
         params->size = bfpt.dwords[BFPT_DWORD(2)];
         if (params->size & BIT(31)) {
                 params->size &= ~BIT(31);
+
+                /*
+                 * Prevent overflows on params->size. Anyway, a NOR of 2^64
+                 * bits is unlikely to exist so this error probably means
+                 * the BFPT we are reading is corrupted/wrong.
+                 */
+                if (params->size > 63)
+                        return -EINVAL;
+
                 params->size = 1ULL << params->size;
         } else {
                 params->size++;
@@ -2243,7 +2282,7 @@ static int spi_nor_parse_sfdp(struct spi_nor *nor,
         int i, err;
 
         /* Get the SFDP header. */
-        err = spi_nor_read_sfdp(nor, 0, sizeof(header), &header);
+        err = spi_nor_read_sfdp_dma_unsafe(nor, 0, sizeof(header), &header);
         if (err < 0)
                 return err;
 
diff --git a/drivers/scsi/arm/acornscsi.c b/drivers/scsi/arm/acornscsi.c
index 690816f3c6af..421fe869a11e 100644
--- a/drivers/scsi/arm/acornscsi.c
+++ b/drivers/scsi/arm/acornscsi.c
@@ -2725,9 +2725,9 @@ int acornscsi_abort(struct scsi_cmnd *SCpnt)
  * Params   : SCpnt  - command causing reset
  * Returns  : one of SCSI_RESET_ macros
  */
-int acornscsi_host_reset(struct Scsi_Host *shpnt)
+int acornscsi_host_reset(struct scsi_cmnd *SCpnt)
 {
-        AS_Host *host = (AS_Host *)shpnt->hostdata;
+        AS_Host *host = (AS_Host *)SCpnt->device->host->hostdata;
         struct scsi_cmnd *SCptr;
     
     host->stats.resets += 1;
@@ -2741,7 +2741,7 @@ int acornscsi_host_reset(struct Scsi_Host *shpnt)
 
         printk(KERN_WARNING "acornscsi_reset: ");
         print_sbic_status(asr, ssr, host->scsi.phase);
-        for (devidx = 0; devidx < 9; devidx ++) {
+        for (devidx = 0; devidx < 9; devidx++)
             acornscsi_dumplog(host, devidx);
     }
 #endif
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 3c6bc0081fcb..ba9d70f8a6a1 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3571,7 +3571,7 @@ fc_vport_sched_delete(struct work_struct *work)
 static enum blk_eh_timer_return
 fc_bsg_job_timeout(struct request *req)
 {
-        struct bsg_job *job = (void *) req->special;
+        struct bsg_job *job = blk_mq_rq_to_pdu(req);
         struct Scsi_Host *shost = fc_bsg_to_shost(job);
         struct fc_rport *rport = fc_bsg_to_rport(job);
         struct fc_internal *i = to_fc_internal(shost->transportt);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 11c1738c2100..fb9f8b5f4673 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2915,8 +2915,6 @@ static void sd_read_block_limits(struct scsi_disk *sdkp)
                                 sd_config_discard(sdkp, SD_LBP_WS16);
                         else if (sdkp->lbpws10)
                                 sd_config_discard(sdkp, SD_LBP_WS10);
-                        else if (sdkp->lbpu && sdkp->max_unmap_blocks)
-                                sd_config_discard(sdkp, SD_LBP_UNMAP);
                         else
                                 sd_config_discard(sdkp, SD_LBP_DISABLE);
                 }
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index cf0e71db9e51..0419c2298eab 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -828,6 +828,39 @@ static int max_sectors_bytes(struct request_queue *q)
         return max_sectors << 9;
 }
 
+static void
+sg_fill_request_table(Sg_fd *sfp, sg_req_info_t *rinfo)
+{
+        Sg_request *srp;
+        int val;
+        unsigned int ms;
+
+        val = 0;
+        list_for_each_entry(srp, &sfp->rq_list, entry) {
+                if (val > SG_MAX_QUEUE)
+                        break;
+                rinfo[val].req_state = srp->done + 1;
+                rinfo[val].problem =
+                        srp->header.masked_status &
+                        srp->header.host_status &
+                        srp->header.driver_status;
+                if (srp->done)
+                        rinfo[val].duration =
+                                srp->header.duration;
+                else {
+                        ms = jiffies_to_msecs(jiffies);
+                        rinfo[val].duration =
+                                (ms > srp->header.duration) ?
+                                (ms - srp->header.duration) : 0;
+                }
+                rinfo[val].orphan = srp->orphan;
+                rinfo[val].sg_io_owned = srp->sg_io_owned;
+                rinfo[val].pack_id = srp->header.pack_id;
+                rinfo[val].usr_ptr = srp->header.usr_ptr;
+                val++;
+        }
+}
+
 static long
 sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
 {
@@ -1012,38 +1045,13 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
                         return -EFAULT;
                 else {
                         sg_req_info_t *rinfo;
-                        unsigned int ms;
 
-                        rinfo = kmalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
-                                                                GFP_KERNEL);
+                        rinfo = kzalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
+                                        GFP_KERNEL);
                         if (!rinfo)
                                 return -ENOMEM;
                         read_lock_irqsave(&sfp->rq_list_lock, iflags);
-                        val = 0;
-                        list_for_each_entry(srp, &sfp->rq_list, entry) {
-                                if (val >= SG_MAX_QUEUE)
-                                        break;
-                                memset(&rinfo[val], 0, SZ_SG_REQ_INFO);
-                                rinfo[val].req_state = srp->done + 1;
-                                rinfo[val].problem =
-                                        srp->header.masked_status &
-                                        srp->header.host_status &
-                                        srp->header.driver_status;
-                                if (srp->done)
-                                        rinfo[val].duration =
-                                                srp->header.duration;
-                                else {
-                                        ms = jiffies_to_msecs(jiffies);
-                                        rinfo[val].duration =
-                                                (ms > srp->header.duration) ?
-                                                (ms - srp->header.duration) : 0;
-                                }
-                                rinfo[val].orphan = srp->orphan;
-                                rinfo[val].sg_io_owned = srp->sg_io_owned;
-                                rinfo[val].pack_id = srp->header.pack_id;
-                                rinfo[val].usr_ptr = srp->header.usr_ptr;
-                                val++;
-                        }
+                        sg_fill_request_table(sfp, rinfo);
                         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
                         result = __copy_to_user(p, rinfo,
                                                 SZ_SG_REQ_INFO * SG_MAX_QUEUE);