diff --git a/Makefile b/Makefile
index aeabc6459acc..440c5b5c4f4b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 77
+SUBLEVEL = 78
 EXTRAVERSION =
 NAME = "People's Front"
 
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 51794c7fa6d5..185e552f1461 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1586,8 +1586,9 @@ config ARM_PATCH_IDIV
          code to do integer division.
 
 config AEABI
-       bool "Use the ARM EABI to compile the kernel" if !CPU_V7 && !CPU_V7M && 
!CPU_V6 && !CPU_V6K
-       default CPU_V7 || CPU_V7M || CPU_V6 || CPU_V6K
+       bool "Use the ARM EABI to compile the kernel" if !CPU_V7 && \
+               !CPU_V7M && !CPU_V6 && !CPU_V6K && !CC_IS_CLANG
+       default CPU_V7 || CPU_V7M || CPU_V6 || CPU_V6K || CC_IS_CLANG
        help
          This option allows for the kernel to be compiled using the latest
          ARM ABI (aka EABI).  This is only useful if you are using a user
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index 3232afb6fdc0..a9ee0d9dc740 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -216,7 +216,7 @@ static inline bool access_error(unsigned int fsr, struct 
vm_area_struct *vma)
 {
        unsigned int mask = VM_READ | VM_WRITE | VM_EXEC;
 
-       if (fsr & FSR_WRITE)
+       if ((fsr & FSR_WRITE) && !(fsr & FSR_CM))
                mask = VM_WRITE;
        if (fsr & FSR_LNX_PF)
                mask = VM_EXEC;
@@ -287,7 +287,7 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct 
pt_regs *regs)
 
        if (user_mode(regs))
                flags |= FAULT_FLAG_USER;
-       if (fsr & FSR_WRITE)
+       if ((fsr & FSR_WRITE) && !(fsr & FSR_CM))
                flags |= FAULT_FLAG_WRITE;
 
        /*
diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h
index c063708fa503..9ecc2097a87a 100644
--- a/arch/arm/mm/fault.h
+++ b/arch/arm/mm/fault.h
@@ -6,6 +6,7 @@
  * Fault status register encodings.  We steal bit 31 for our own purposes.
  */
 #define FSR_LNX_PF             (1 << 31)
+#define FSR_CM                 (1 << 13)
 #define FSR_WRITE              (1 << 11)
 #define FSR_FS4                        (1 << 10)
 #define FSR_FS3_0              (15)
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index f866870db749..0b94b674aa91 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -18,8 +18,9 @@
         (((pgoff)<<PAGE_SHIFT) & (SHMLBA-1)))
 
 /* gap between mmap and stack */
-#define MIN_GAP (128*1024*1024UL)
-#define MAX_GAP ((TASK_SIZE)/6*5)
+#define MIN_GAP                (128*1024*1024UL)
+#define MAX_GAP                ((STACK_TOP)/6*5)
+#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))
 
 static int mmap_is_legacy(struct rlimit *rlim_stack)
 {
@@ -35,13 +36,22 @@ static int mmap_is_legacy(struct rlimit *rlim_stack)
 static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack)
 {
        unsigned long gap = rlim_stack->rlim_cur;
+       unsigned long pad = stack_guard_gap;
+
+       /* Account for stack randomization if necessary */
+       if (current->flags & PF_RANDOMIZE)
+               pad += (STACK_RND_MASK << PAGE_SHIFT);
+
+       /* Values close to RLIM_INFINITY can overflow. */
+       if (gap + pad > gap)
+               gap += pad;
 
        if (gap < MIN_GAP)
                gap = MIN_GAP;
        else if (gap > MAX_GAP)
                gap = MAX_GAP;
 
-       return PAGE_ALIGN(TASK_SIZE - gap - rnd);
+       return PAGE_ALIGN(STACK_TOP - gap - rnd);
 }
 
 /*
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index e46a6a446cdd..70e560cf8ca0 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -1175,6 +1175,22 @@ void __init adjust_lowmem_bounds(void)
         */
        vmalloc_limit = (u64)(uintptr_t)vmalloc_min - PAGE_OFFSET + PHYS_OFFSET;
 
+       /*
+        * The first usable region must be PMD aligned. Mark its start
+        * as MEMBLOCK_NOMAP if it isn't
+        */
+       for_each_memblock(memory, reg) {
+               if (!memblock_is_nomap(reg)) {
+                       if (!IS_ALIGNED(reg->base, PMD_SIZE)) {
+                               phys_addr_t len;
+
+                               len = round_up(reg->base, PMD_SIZE) - reg->base;
+                               memblock_mark_nomap(reg->base, len);
+                       }
+                       break;
+               }
+       }
+
        for_each_memblock(memory, reg) {
                phys_addr_t block_start = reg->base;
                phys_addr_t block_end = reg->base + reg->size;
diff --git a/arch/arm64/include/asm/cmpxchg.h b/arch/arm64/include/asm/cmpxchg.h
index 3b0938281541..d8b01c7c9cd3 100644
--- a/arch/arm64/include/asm/cmpxchg.h
+++ b/arch/arm64/include/asm/cmpxchg.h
@@ -74,7 +74,7 @@ __XCHG_CASE( ,  ,  mb_8, dmb ish, nop,  , a, l, "memory")
 #undef __XCHG_CASE
 
 #define __XCHG_GEN(sfx)                                                        
\
-static inline unsigned long __xchg##sfx(unsigned long x,               \
+static __always_inline  unsigned long __xchg##sfx(unsigned long x,     \
                                        volatile void *ptr,             \
                                        int size)                       \
 {                                                                      \
@@ -116,7 +116,7 @@ __XCHG_GEN(_mb)
 #define xchg(...)              __xchg_wrapper( _mb, __VA_ARGS__)
 
 #define __CMPXCHG_GEN(sfx)                                             \
-static inline unsigned long __cmpxchg##sfx(volatile void *ptr,         \
+static __always_inline unsigned long __cmpxchg##sfx(volatile void *ptr,        
\
                                           unsigned long old,           \
                                           unsigned long new,           \
                                           int size)                    \
@@ -223,7 +223,7 @@ __CMPWAIT_CASE( ,  , 8);
 #undef __CMPWAIT_CASE
 
 #define __CMPWAIT_GEN(sfx)                                             \
-static inline void __cmpwait##sfx(volatile void *ptr,                  \
+static __always_inline void __cmpwait##sfx(volatile void *ptr,         \
                                  unsigned long val,                    \
                                  int size)                             \
 {                                                                      \
diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
index 842c8a5fcd53..157f2caa1351 100644
--- a/arch/arm64/mm/mmap.c
+++ b/arch/arm64/mm/mmap.c
@@ -65,7 +65,11 @@ unsigned long arch_mmap_rnd(void)
 static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack)
 {
        unsigned long gap = rlim_stack->rlim_cur;
-       unsigned long pad = (STACK_RND_MASK << PAGE_SHIFT) + stack_guard_gap;
+       unsigned long pad = stack_guard_gap;
+
+       /* Account for stack randomization if necessary */
+       if (current->flags & PF_RANDOMIZE)
+               pad += (STACK_RND_MASK << PAGE_SHIFT);
 
        /* Values close to RLIM_INFINITY can overflow. */
        if (gap + pad > gap)
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index 01df9ad62fb8..1bb9448777c5 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -688,6 +688,9 @@
 #define MIPS_CONF7_IAR         (_ULCAST_(1) << 10)
 #define MIPS_CONF7_AR          (_ULCAST_(1) << 16)
 
+/* Ingenic Config7 bits */
+#define MIPS_CONF7_BTB_LOOP_EN (_ULCAST_(1) << 4)
+
 /* Config7 Bits specific to MIPS Technologies. */
 
 /* Performance counters implemented Per TC */
@@ -2774,6 +2777,7 @@ __BUILD_SET_C0(status)
 __BUILD_SET_C0(cause)
 __BUILD_SET_C0(config)
 __BUILD_SET_C0(config5)
+__BUILD_SET_C0(config7)
 __BUILD_SET_C0(intcontrol)
 __BUILD_SET_C0(intctl)
 __BUILD_SET_C0(srsmap)
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index d535fc706a8b..25cd8737e7fe 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -1879,6 +1879,13 @@ static inline void cpu_probe_ingenic(struct cpuinfo_mips 
*c, unsigned int cpu)
                c->cputype = CPU_JZRISC;
                c->writecombine = _CACHE_UNCACHED_ACCELERATED;
                __cpu_name[cpu] = "Ingenic JZRISC";
+               /*
+                * The XBurst core by default attempts to avoid branch target
+                * buffer lookups by detecting & special casing loops. This
+                * feature will cause BogoMIPS and lpj calculate in error.
+                * Set cp0 config7 bit 4 to disable this feature.
+                */
+               set_c0_config7(MIPS_CONF7_BTB_LOOP_EN);
                break;
        default:
                panic("Unknown Ingenic Processor ID!");
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index 1b705fb2f10c..233033f99d8f 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -21,8 +21,9 @@ unsigned long shm_align_mask = PAGE_SIZE - 1; /* Sane caches 
*/
 EXPORT_SYMBOL(shm_align_mask);
 
 /* gap between mmap and stack */
-#define MIN_GAP (128*1024*1024UL)
-#define MAX_GAP ((TASK_SIZE)/6*5)
+#define MIN_GAP                (128*1024*1024UL)
+#define MAX_GAP                ((TASK_SIZE)/6*5)
+#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))
 
 static int mmap_is_legacy(struct rlimit *rlim_stack)
 {
@@ -38,6 +39,15 @@ static int mmap_is_legacy(struct rlimit *rlim_stack)
 static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack)
 {
        unsigned long gap = rlim_stack->rlim_cur;
+       unsigned long pad = stack_guard_gap;
+
+       /* Account for stack randomization if necessary */
+       if (current->flags & PF_RANDOMIZE)
+               pad += (STACK_RND_MASK << PAGE_SHIFT);
+
+       /* Values close to RLIM_INFINITY can overflow. */
+       if (gap + pad > gap)
+               gap += pad;
 
        if (gap < MIN_GAP)
                gap = MIN_GAP;
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 8c4fda52b91d..355f8eadb1cd 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -630,7 +630,7 @@ static __maybe_unused void build_convert_pte_to_entrylo(u32 
**p,
                return;
        }
 
-       if (cpu_has_rixi && _PAGE_NO_EXEC) {
+       if (cpu_has_rixi && !!_PAGE_NO_EXEC) {
                if (fill_includes_sw_bits) {
                        UASM_i_ROTR(p, reg, reg, ilog2(_PAGE_GLOBAL));
                } else {
diff --git a/arch/powerpc/include/asm/futex.h b/arch/powerpc/include/asm/futex.h
index 94542776a62d..2a7b01f97a56 100644
--- a/arch/powerpc/include/asm/futex.h
+++ b/arch/powerpc/include/asm/futex.h
@@ -59,8 +59,7 @@ static inline int arch_futex_atomic_op_inuser(int op, int 
oparg, int *oval,
 
        pagefault_enable();
 
-       if (!ret)
-               *oval = oldval;
+       *oval = oldval;
 
        return ret;
 }
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index 67619b4b3f96..110eba400de7 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -811,6 +811,10 @@ void eeh_handle_normal_event(struct eeh_pe *pe)
        pr_warn("EEH: This PCI device has failed %d times in the last hour and 
will be permanently disabled after %d failures.\n",
                pe->freeze_count, eeh_max_freezes);
 
+       eeh_for_each_pe(pe, tmp_pe)
+               eeh_pe_for_each_dev(tmp_pe, edev, tmp)
+                       edev->mode &= ~EEH_DEV_NO_HANDLER;
+
        /* Walk the various device drivers attached to this slot through
         * a reset sequence, giving each an opportunity to do what it needs
         * to accomplish the reset.  Each child gets a report of the
@@ -1004,7 +1008,8 @@ void eeh_handle_normal_event(struct eeh_pe *pe)
  */
 void eeh_handle_special_event(void)
 {
-       struct eeh_pe *pe, *phb_pe;
+       struct eeh_pe *pe, *phb_pe, *tmp_pe;
+       struct eeh_dev *edev, *tmp_edev;
        struct pci_bus *bus;
        struct pci_controller *hose;
        unsigned long flags;
@@ -1075,6 +1080,10 @@ void eeh_handle_special_event(void)
                                    (phb_pe->state & EEH_PE_RECOVERING))
                                        continue;
 
+                               eeh_for_each_pe(pe, tmp_pe)
+                                       eeh_pe_for_each_dev(tmp_pe, edev, 
tmp_edev)
+                                               edev->mode &= 
~EEH_DEV_NO_HANDLER;
+
                                /* Notify all devices to be down */
                                eeh_pe_state_clear(pe, EEH_PE_PRI_BUS);
                                eeh_set_channel_state(pe, 
pci_channel_io_perm_failure);
diff --git a/arch/powerpc/kernel/exceptions-64s.S 
b/arch/powerpc/kernel/exceptions-64s.S
index 06cc77813dbb..90af86f143a9 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -520,6 +520,10 @@ EXC_COMMON_BEGIN(machine_check_handle_early)
        RFI_TO_USER_OR_KERNEL
 9:
        /* Deliver the machine check to host kernel in V mode. */
+BEGIN_FTR_SECTION
+       ld      r10,ORIG_GPR3(r1)
+       mtspr   SPRN_CFAR,r10
+END_FTR_SECTION_IFSET(CPU_FTR_CFAR)
        MACHINE_CHECK_HANDLER_WINDUP
        b       machine_check_pSeries
 
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index 8afd146bc9c7..9e41a9de4323 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -875,15 +875,17 @@ static int rtas_cpu_state_change_mask(enum rtas_cpu_state 
state,
                return 0;
 
        for_each_cpu(cpu, cpus) {
+               struct device *dev = get_cpu_device(cpu);
+
                switch (state) {
                case DOWN:
-                       cpuret = cpu_down(cpu);
+                       cpuret = device_offline(dev);
                        break;
                case UP:
-                       cpuret = cpu_up(cpu);
+                       cpuret = device_online(dev);
                        break;
                }
-               if (cpuret) {
+               if (cpuret < 0) {
                        pr_debug("%s: cpu_%s for cpu#%d returned %d.\n",
                                        __func__,
                                        ((state == UP) ? "up" : "down"),
@@ -972,6 +974,8 @@ int rtas_ibm_suspend_me(u64 handle)
        data.token = rtas_token("ibm,suspend-me");
        data.complete = &done;
 
+       lock_device_hotplug();
+
        /* All present CPUs must be online */
        cpumask_andnot(offline_mask, cpu_present_mask, cpu_online_mask);
        cpuret = rtas_online_cpus_mask(offline_mask);
@@ -1003,6 +1007,7 @@ int rtas_ibm_suspend_me(u64 handle)
                                __func__);
 
 out:
+       unlock_device_hotplug();
        free_cpumask_var(offline_mask);
        return atomic_read(&data.error);
 }
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 02fe6d020174..d5f351f02c15 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -399,6 +399,7 @@ void system_reset_exception(struct pt_regs *regs)
        if (debugger(regs))
                goto out;
 
+       kmsg_dump(KMSG_DUMP_OOPS);
        /*
         * A system reset is a request to dump, so we always send
         * it through the crashdump code (if fadump or kdump are
diff --git a/arch/powerpc/platforms/powernv/pci-ioda-tce.c 
b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
index f5adb6b756f7..29e66d6e5763 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda-tce.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
@@ -36,7 +36,8 @@ static __be64 *pnv_alloc_tce_level(int nid, unsigned int 
shift)
        struct page *tce_mem = NULL;
        __be64 *addr;
 
-       tce_mem = alloc_pages_node(nid, GFP_KERNEL, shift - PAGE_SHIFT);
+       tce_mem = alloc_pages_node(nid, GFP_ATOMIC | __GFP_NOWARN,
+                       shift - PAGE_SHIFT);
        if (!tce_mem) {
                pr_err("Failed to allocate a TCE memory, level shift=%d\n",
                                shift);
@@ -161,6 +162,9 @@ void pnv_tce_free(struct iommu_table *tbl, long index, long 
npages)
 
                if (ptce)
                        *ptce = cpu_to_be64(0);
+               else
+                       /* Skip the rest of the level */
+                       i |= tbl->it_level_size - 1;
        }
 }
 
@@ -260,7 +264,6 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 
bus_offset,
        unsigned int table_shift = max_t(unsigned int, entries_shift + 3,
                        PAGE_SHIFT);
        const unsigned long tce_table_size = 1UL << table_shift;
-       unsigned int tmplevels = levels;
 
        if (!levels || (levels > POWERNV_IOMMU_MAX_LEVELS))
                return -EINVAL;
@@ -268,9 +271,6 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 
bus_offset,
        if (!is_power_of_2(window_size))
                return -EINVAL;
 
-       if (alloc_userspace_copy && (window_size > (1ULL << 32)))
-               tmplevels = 1;
-
        /* Adjust direct table size from window_size and levels */
        entries_shift = (entries_shift + levels - 1) / levels;
        level_shift = entries_shift + 3;
@@ -281,7 +281,7 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 
bus_offset,
 
        /* Allocate TCE table */
        addr = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift,
-                       tmplevels, tce_table_size, &offset, &total_allocated);
+                       1, tce_table_size, &offset, &total_allocated);
 
        /* addr==NULL means that the first level allocation failed */
        if (!addr)
@@ -292,18 +292,18 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 
bus_offset,
         * we did not allocate as much as we wanted,
         * release partially allocated table.
         */
-       if (tmplevels == levels && offset < tce_table_size)
+       if (levels == 1 && offset < tce_table_size)
                goto free_tces_exit;
 
        /* Allocate userspace view of the TCE table */
        if (alloc_userspace_copy) {
                offset = 0;
                uas = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift,
-                               tmplevels, tce_table_size, &offset,
+                               1, tce_table_size, &offset,
                                &total_allocated_uas);
                if (!uas)
                        goto free_tces_exit;
-               if (tmplevels == levels && (offset < tce_table_size ||
+               if (levels == 1 && (offset < tce_table_size ||
                                total_allocated_uas != total_allocated))
                        goto free_uas_exit;
        }
@@ -318,7 +318,7 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 
bus_offset,
 
        pr_debug("Created TCE table: ws=%08llx ts=%lx @%08llx base=%lx uas=%p 
levels=%d/%d\n",
                        window_size, tce_table_size, bus_offset, tbl->it_base,
-                       tbl->it_userspace, tmplevels, levels);
+                       tbl->it_userspace, 1, levels);
 
        return 0;
 
diff --git a/arch/powerpc/platforms/powernv/pci.h 
b/arch/powerpc/platforms/powernv/pci.h
index 8b37b28e3831..e302aa092d4f 100644
--- a/arch/powerpc/platforms/powernv/pci.h
+++ b/arch/powerpc/platforms/powernv/pci.h
@@ -243,7 +243,7 @@ extern void pnv_npu_release_ownership(struct pnv_ioda_pe 
*npe);
 extern int pnv_npu2_init(struct pnv_phb *phb);
 
 /* pci-ioda-tce.c */
-#define POWERNV_IOMMU_DEFAULT_LEVELS   1
+#define POWERNV_IOMMU_DEFAULT_LEVELS   2
 #define POWERNV_IOMMU_MAX_LEVELS       5
 
 extern int pnv_tce_build(struct iommu_table *tbl, long index, long npages,
diff --git a/arch/powerpc/platforms/pseries/mobility.c 
b/arch/powerpc/platforms/pseries/mobility.c
index 7b60fcf04dc4..e4ea71383383 100644
--- a/arch/powerpc/platforms/pseries/mobility.c
+++ b/arch/powerpc/platforms/pseries/mobility.c
@@ -12,6 +12,7 @@
 #include <linux/cpu.h>
 #include <linux/kernel.h>
 #include <linux/kobject.h>
+#include <linux/sched.h>
 #include <linux/smp.h>
 #include <linux/stat.h>
 #include <linux/completion.h>
@@ -209,7 +210,11 @@ static int update_dt_node(__be32 phandle, s32 scope)
 
                                prop_data += vd;
                        }
+
+                       cond_resched();
                }
+
+               cond_resched();
        } while (rtas_rc == 1);
 
        of_node_put(dn);
@@ -318,8 +323,12 @@ int pseries_devicetree_update(s32 scope)
                                        add_dt_node(phandle, drc_index);
                                        break;
                                }
+
+                               cond_resched();
                        }
                }
+
+               cond_resched();
        } while (rc == 1);
 
        kfree(rtas_buf);
diff --git a/arch/powerpc/platforms/pseries/setup.c 
b/arch/powerpc/platforms/pseries/setup.c
index ba1791fd3234..67f49159ea70 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -325,6 +325,9 @@ static void pseries_lpar_idle(void)
         * low power mode by ceding processor to hypervisor
         */
 
+       if (!prep_irq_for_idle())
+               return;
+
        /* Indicate to hypervisor that we are idle. */
        get_lppaca()->idle = 1;
 
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index 74cfc1be04d6..bb5db7bfd853 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -2497,13 +2497,16 @@ static void dump_pacas(void)
 static void dump_one_xive(int cpu)
 {
        unsigned int hwid = get_hard_smp_processor_id(cpu);
+       bool hv = cpu_has_feature(CPU_FTR_HVMODE);
 
-       opal_xive_dump(XIVE_DUMP_TM_HYP, hwid);
-       opal_xive_dump(XIVE_DUMP_TM_POOL, hwid);
-       opal_xive_dump(XIVE_DUMP_TM_OS, hwid);
-       opal_xive_dump(XIVE_DUMP_TM_USER, hwid);
-       opal_xive_dump(XIVE_DUMP_VP, hwid);
-       opal_xive_dump(XIVE_DUMP_EMU_STATE, hwid);
+       if (hv) {
+               opal_xive_dump(XIVE_DUMP_TM_HYP, hwid);
+               opal_xive_dump(XIVE_DUMP_TM_POOL, hwid);
+               opal_xive_dump(XIVE_DUMP_TM_OS, hwid);
+               opal_xive_dump(XIVE_DUMP_TM_USER, hwid);
+               opal_xive_dump(XIVE_DUMP_VP, hwid);
+               opal_xive_dump(XIVE_DUMP_EMU_STATE, hwid);
+       }
 
        if (setjmp(bus_error_jmp) != 0) {
                catch_memory_errors = 0;
diff --git a/arch/s390/hypfs/inode.c b/arch/s390/hypfs/inode.c
index c681329fdeec..e4d17d9ea93d 100644
--- a/arch/s390/hypfs/inode.c
+++ b/arch/s390/hypfs/inode.c
@@ -269,7 +269,7 @@ static int hypfs_show_options(struct seq_file *s, struct 
dentry *root)
 static int hypfs_fill_super(struct super_block *sb, void *data, int silent)
 {
        struct inode *root_inode;
-       struct dentry *root_dentry;
+       struct dentry *root_dentry, *update_file;
        int rc = 0;
        struct hypfs_sb_info *sbi;
 
@@ -300,9 +300,10 @@ static int hypfs_fill_super(struct super_block *sb, void 
*data, int silent)
                rc = hypfs_diag_create_files(root_dentry);
        if (rc)
                return rc;
-       sbi->update_file = hypfs_create_update_file(root_dentry);
-       if (IS_ERR(sbi->update_file))
-               return PTR_ERR(sbi->update_file);
+       update_file = hypfs_create_update_file(root_dentry);
+       if (IS_ERR(update_file))
+               return PTR_ERR(update_file);
+       sbi->update_file = update_file;
        hypfs_update_update(sb);
        pr_info("Hypervisor filesystem mounted\n");
        return 0;
diff --git a/block/mq-deadline.c b/block/mq-deadline.c
index d5e21ce44d2c..69094d641062 100644
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -376,13 +376,6 @@ static struct request *__dd_dispatch_request(struct 
deadline_data *dd)
  * hardware queue, but we may return a request that is for a
  * different hardware queue. This is because mq-deadline has shared
  * state for all hardware queues, in terms of sorting, FIFOs, etc.
- *
- * For a zoned block device, __dd_dispatch_request() may return NULL
- * if all the queued write requests are directed at zones that are already
- * locked due to on-going write requests. In this case, make sure to mark
- * the queue as needing a restart to ensure that the queue is run again
- * and the pending writes dispatched once the target zones for the ongoing
- * write requests are unlocked in dd_finish_request().
  */
 static struct request *dd_dispatch_request(struct blk_mq_hw_ctx *hctx)
 {
@@ -391,9 +384,6 @@ static struct request *dd_dispatch_request(struct 
blk_mq_hw_ctx *hctx)
 
        spin_lock(&dd->lock);
        rq = __dd_dispatch_request(dd);
-       if (!rq && blk_queue_is_zoned(hctx->queue) &&
-           !list_empty(&dd->fifo_list[WRITE]))
-               blk_mq_sched_mark_restart_hctx(hctx);
        spin_unlock(&dd->lock);
 
        return rq;
@@ -559,6 +549,13 @@ static void dd_prepare_request(struct request *rq, struct 
bio *bio)
  * spinlock so that the zone is never unlocked while deadline_fifo_request()
  * or deadline_next_request() are executing. This function is called for
  * all requests, whether or not these requests complete successfully.
+ *
+ * For a zoned block device, __dd_dispatch_request() may have stopped
+ * dispatching requests if all the queued requests are write requests directed
+ * at zones that are already locked due to on-going write requests. To ensure
+ * write request dispatch progress in this case, mark the queue as needing a
+ * restart to ensure that the queue is run again after completion of the
+ * request and zones being unlocked.
  */
 static void dd_finish_request(struct request *rq)
 {
@@ -570,6 +567,12 @@ static void dd_finish_request(struct request *rq)
 
                spin_lock_irqsave(&dd->zone_lock, flags);
                blk_req_zone_write_unlock(rq);
+               if (!list_empty(&dd->fifo_list[WRITE])) {
+                       struct blk_mq_hw_ctx *hctx;
+
+                       hctx = blk_mq_map_queue(q, rq->mq_ctx->cpu);
+                       blk_mq_sched_mark_restart_hctx(hctx);
+               }
                spin_unlock_irqrestore(&dd->zone_lock, flags);
        }
 }
diff --git a/drivers/base/regmap/Kconfig b/drivers/base/regmap/Kconfig
index 6ad5ef48b61e..8cd2ac650b50 100644
--- a/drivers/base/regmap/Kconfig
+++ b/drivers/base/regmap/Kconfig
@@ -44,7 +44,7 @@ config REGMAP_IRQ
 
 config REGMAP_SOUNDWIRE
        tristate
-       depends on SOUNDWIRE_BUS
+       depends on SOUNDWIRE
 
 config REGMAP_SCCB
        tristate
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 6f1d25c1eb64..0bc344d22f01 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -2596,7 +2596,6 @@ static int pkt_new_dev(struct pktcdvd_device *pd, dev_t 
dev)
        if (ret)
                return ret;
        if (!blk_queue_scsi_passthrough(bdev_get_queue(bdev))) {
-               WARN_ONCE(true, "Attempt to register a non-SCSI queue\n");
                blkdev_put(bdev, FMODE_READ | FMODE_NDELAY);
                return -EINVAL;
        }
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 75e5006f395a..006d76525678 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -221,6 +221,9 @@ struct smi_info {
         */
        bool irq_enable_broken;
 
+       /* Is the driver in maintenance mode? */
+       bool in_maintenance_mode;
+
        /*
         * Did we get an attention that we did not handle?
         */
@@ -1013,11 +1016,20 @@ static int ipmi_thread(void *data)
                spin_unlock_irqrestore(&(smi_info->si_lock), flags);
                busy_wait = ipmi_thread_busy_wait(smi_result, smi_info,
                                                  &busy_until);
-               if (smi_result == SI_SM_CALL_WITHOUT_DELAY)
+               if (smi_result == SI_SM_CALL_WITHOUT_DELAY) {
                        ; /* do nothing */
-               else if (smi_result == SI_SM_CALL_WITH_DELAY && busy_wait)
-                       schedule();
-               else if (smi_result == SI_SM_IDLE) {
+               } else if (smi_result == SI_SM_CALL_WITH_DELAY && busy_wait) {
+                       /*
+                        * In maintenance mode we run as fast as
+                        * possible to allow firmware updates to
+                        * complete as fast as possible, but normally
+                        * don't bang on the scheduler.
+                        */
+                       if (smi_info->in_maintenance_mode)
+                               schedule();
+                       else
+                               usleep_range(100, 200);
+               } else if (smi_result == SI_SM_IDLE) {
                        if (atomic_read(&smi_info->need_watch)) {
                                schedule_timeout_interruptible(100);
                        } else {
@@ -1025,8 +1037,9 @@ static int ipmi_thread(void *data)
                                __set_current_state(TASK_INTERRUPTIBLE);
                                schedule();
                        }
-               } else
+               } else {
                        schedule_timeout_interruptible(1);
+               }
        }
        return 0;
 }
@@ -1201,6 +1214,7 @@ static void set_maintenance_mode(void *send_info, bool 
enable)
 
        if (!enable)
                atomic_set(&smi_info->req_events, 0);
+       smi_info->in_maintenance_mode = enable;
 }
 
 static void shutdown_smi(void *send_info);
diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index 46caadca916a..0b01eb7b14e5 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -187,12 +187,13 @@ static int tpm_class_shutdown(struct device *dev)
 {
        struct tpm_chip *chip = container_of(dev, struct tpm_chip, dev);
 
+       down_write(&chip->ops_sem);
        if (chip->flags & TPM_CHIP_FLAG_TPM2) {
-               down_write(&chip->ops_sem);
                tpm2_shutdown(chip, TPM2_SU_CLEAR);
                chip->ops = NULL;
-               up_write(&chip->ops_sem);
        }
+       chip->ops = NULL;
+       up_write(&chip->ops_sem);
 
        return 0;
 }
diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c
index 83a77a445538..177a60e5c6ec 100644
--- a/drivers/char/tpm/tpm-sysfs.c
+++ b/drivers/char/tpm/tpm-sysfs.c
@@ -39,7 +39,6 @@ static ssize_t pubek_show(struct device *dev, struct 
device_attribute *attr,
 {
        struct tpm_buf tpm_buf;
        struct tpm_readpubek_out *out;
-       ssize_t rc;
        int i;
        char *str = buf;
        struct tpm_chip *chip = to_tpm_chip(dev);
@@ -47,19 +46,18 @@ static ssize_t pubek_show(struct device *dev, struct 
device_attribute *attr,
 
        memset(&anti_replay, 0, sizeof(anti_replay));
 
-       rc = tpm_buf_init(&tpm_buf, TPM_TAG_RQU_COMMAND, TPM_ORD_READPUBEK);
-       if (rc)
-               return rc;
+       if (tpm_try_get_ops(chip))
+               return 0;
+
+       if (tpm_buf_init(&tpm_buf, TPM_TAG_RQU_COMMAND, TPM_ORD_READPUBEK))
+               goto out_ops;
 
        tpm_buf_append(&tpm_buf, anti_replay, sizeof(anti_replay));
 
-       rc = tpm_transmit_cmd(chip, NULL, tpm_buf.data, PAGE_SIZE,
+       if (tpm_transmit_cmd(chip, NULL, tpm_buf.data, PAGE_SIZE,
                              READ_PUBEK_RESULT_MIN_BODY_SIZE, 0,
-                             "attempting to read the PUBEK");
-       if (rc) {
-               tpm_buf_destroy(&tpm_buf);
-               return 0;
-       }
+                             "attempting to read the PUBEK"))
+               goto out_buf;
 
        out = (struct tpm_readpubek_out *)&tpm_buf.data[10];
        str +=
@@ -90,9 +88,11 @@ static ssize_t pubek_show(struct device *dev, struct 
device_attribute *attr,
                        str += sprintf(str, "\n");
        }
 
-       rc = str - buf;
+out_buf:
        tpm_buf_destroy(&tpm_buf);
-       return rc;
+out_ops:
+       tpm_put_ops(chip);
+       return str - buf;
 }
 static DEVICE_ATTR_RO(pubek);
 
@@ -106,12 +106,16 @@ static ssize_t pcrs_show(struct device *dev, struct 
device_attribute *attr,
        char *str = buf;
        struct tpm_chip *chip = to_tpm_chip(dev);
 
-       rc = tpm_getcap(chip, TPM_CAP_PROP_PCR, &cap,
-                       "attempting to determine the number of PCRS",
-                       sizeof(cap.num_pcrs));
-       if (rc)
+       if (tpm_try_get_ops(chip))
                return 0;
 
+       if (tpm_getcap(chip, TPM_CAP_PROP_PCR, &cap,
+                      "attempting to determine the number of PCRS",
+                      sizeof(cap.num_pcrs))) {
+               tpm_put_ops(chip);
+               return 0;
+       }
+
        num_pcrs = be32_to_cpu(cap.num_pcrs);
        for (i = 0; i < num_pcrs; i++) {
                rc = tpm_pcr_read_dev(chip, i, digest);
@@ -122,6 +126,7 @@ static ssize_t pcrs_show(struct device *dev, struct 
device_attribute *attr,
                        str += sprintf(str, "%02X ", digest[j]);
                str += sprintf(str, "\n");
        }
+       tpm_put_ops(chip);
        return str - buf;
 }
 static DEVICE_ATTR_RO(pcrs);
@@ -129,16 +134,21 @@ static DEVICE_ATTR_RO(pcrs);
 static ssize_t enabled_show(struct device *dev, struct device_attribute *attr,
                     char *buf)
 {
+       struct tpm_chip *chip = to_tpm_chip(dev);
+       ssize_t rc = 0;
        cap_t cap;
-       ssize_t rc;
 
-       rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_FLAG_PERM, &cap,
-                       "attempting to determine the permanent enabled state",
-                       sizeof(cap.perm_flags));
-       if (rc)
+       if (tpm_try_get_ops(chip))
                return 0;
 
+       if (tpm_getcap(chip, TPM_CAP_FLAG_PERM, &cap,
+                      "attempting to determine the permanent enabled state",
+                      sizeof(cap.perm_flags)))
+               goto out_ops;
+
        rc = sprintf(buf, "%d\n", !cap.perm_flags.disable);
+out_ops:
+       tpm_put_ops(chip);
        return rc;
 }
 static DEVICE_ATTR_RO(enabled);
@@ -146,16 +156,21 @@ static DEVICE_ATTR_RO(enabled);
 static ssize_t active_show(struct device *dev, struct device_attribute *attr,
                    char *buf)
 {
+       struct tpm_chip *chip = to_tpm_chip(dev);
+       ssize_t rc = 0;
        cap_t cap;
-       ssize_t rc;
 
-       rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_FLAG_PERM, &cap,
-                       "attempting to determine the permanent active state",
-                       sizeof(cap.perm_flags));
-       if (rc)
+       if (tpm_try_get_ops(chip))
                return 0;
 
+       if (tpm_getcap(chip, TPM_CAP_FLAG_PERM, &cap,
+                      "attempting to determine the permanent active state",
+                      sizeof(cap.perm_flags)))
+               goto out_ops;
+
        rc = sprintf(buf, "%d\n", !cap.perm_flags.deactivated);
+out_ops:
+       tpm_put_ops(chip);
        return rc;
 }
 static DEVICE_ATTR_RO(active);
@@ -163,16 +178,21 @@ static DEVICE_ATTR_RO(active);
 static ssize_t owned_show(struct device *dev, struct device_attribute *attr,
                          char *buf)
 {
+       struct tpm_chip *chip = to_tpm_chip(dev);
+       ssize_t rc = 0;
        cap_t cap;
-       ssize_t rc;
 
-       rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_PROP_OWNER, &cap,
-                       "attempting to determine the owner state",
-                       sizeof(cap.owned));
-       if (rc)
+       if (tpm_try_get_ops(chip))
                return 0;
 
+       if (tpm_getcap(to_tpm_chip(dev), TPM_CAP_PROP_OWNER, &cap,
+                      "attempting to determine the owner state",
+                      sizeof(cap.owned)))
+               goto out_ops;
+
        rc = sprintf(buf, "%d\n", cap.owned);
+out_ops:
+       tpm_put_ops(chip);
        return rc;
 }
 static DEVICE_ATTR_RO(owned);
@@ -180,16 +200,21 @@ static DEVICE_ATTR_RO(owned);
 static ssize_t temp_deactivated_show(struct device *dev,
                                     struct device_attribute *attr, char *buf)
 {
+       struct tpm_chip *chip = to_tpm_chip(dev);
+       ssize_t rc = 0;
        cap_t cap;
-       ssize_t rc;
 
-       rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_FLAG_VOL, &cap,
-                       "attempting to determine the temporary state",
-                       sizeof(cap.stclear_flags));
-       if (rc)
+       if (tpm_try_get_ops(chip))
                return 0;
 
+       if (tpm_getcap(to_tpm_chip(dev), TPM_CAP_FLAG_VOL, &cap,
+                      "attempting to determine the temporary state",
+                      sizeof(cap.stclear_flags)))
+               goto out_ops;
+
        rc = sprintf(buf, "%d\n", cap.stclear_flags.deactivated);
+out_ops:
+       tpm_put_ops(chip);
        return rc;
 }
 static DEVICE_ATTR_RO(temp_deactivated);
@@ -198,15 +223,18 @@ static ssize_t caps_show(struct device *dev, struct 
device_attribute *attr,
                         char *buf)
 {
        struct tpm_chip *chip = to_tpm_chip(dev);
-       cap_t cap;
-       ssize_t rc;
+       ssize_t rc = 0;
        char *str = buf;
+       cap_t cap;
 
-       rc = tpm_getcap(chip, TPM_CAP_PROP_MANUFACTURER, &cap,
-                       "attempting to determine the manufacturer",
-                       sizeof(cap.manufacturer_id));
-       if (rc)
+       if (tpm_try_get_ops(chip))
                return 0;
+
+       if (tpm_getcap(chip, TPM_CAP_PROP_MANUFACTURER, &cap,
+                      "attempting to determine the manufacturer",
+                      sizeof(cap.manufacturer_id)))
+               goto out_ops;
+
        str += sprintf(str, "Manufacturer: 0x%x\n",
                       be32_to_cpu(cap.manufacturer_id));
 
@@ -223,20 +251,22 @@ static ssize_t caps_show(struct device *dev, struct 
device_attribute *attr,
                               cap.tpm_version_1_2.revMinor);
        } else {
                /* Otherwise just use TPM_STRUCT_VER */
-               rc = tpm_getcap(chip, TPM_CAP_VERSION_1_1, &cap,
-                               "attempting to determine the 1.1 version",
-                               sizeof(cap.tpm_version));
-               if (rc)
-                       return 0;
+               if (tpm_getcap(chip, TPM_CAP_VERSION_1_1, &cap,
+                              "attempting to determine the 1.1 version",
+                              sizeof(cap.tpm_version)))
+                       goto out_ops;
+
                str += sprintf(str,
                               "TCG version: %d.%d\nFirmware version: %d.%d\n",
                               cap.tpm_version.Major,
                               cap.tpm_version.Minor,
                               cap.tpm_version.revMajor,
                               cap.tpm_version.revMinor);
-       }
-
-       return str - buf;
+}
+       rc = str - buf;
+out_ops:
+       tpm_put_ops(chip);
+       return rc;
 }
 static DEVICE_ATTR_RO(caps);
 
@@ -244,10 +274,12 @@ static ssize_t cancel_store(struct device *dev, struct 
device_attribute *attr,
                            const char *buf, size_t count)
 {
        struct tpm_chip *chip = to_tpm_chip(dev);
-       if (chip == NULL)
+
+       if (tpm_try_get_ops(chip))
                return 0;
 
        chip->ops->cancel(chip);
+       tpm_put_ops(chip);
        return count;
 }
 static DEVICE_ATTR_WO(cancel);
diff --git a/drivers/clk/actions/owl-common.c b/drivers/clk/actions/owl-common.c
index 61c1071b5180..e9be34b17f3f 100644
--- a/drivers/clk/actions/owl-common.c
+++ b/drivers/clk/actions/owl-common.c
@@ -67,16 +67,17 @@ int owl_clk_probe(struct device *dev, struct 
clk_hw_onecell_data *hw_clks)
        struct clk_hw *hw;
 
        for (i = 0; i < hw_clks->num; i++) {
+               const char *name;
 
                hw = hw_clks->hws[i];
-
                if (IS_ERR_OR_NULL(hw))
                        continue;
 
+               name = hw->init->name;
                ret = devm_clk_hw_register(dev, hw);
                if (ret) {
                        dev_err(dev, "Couldn't register clock %d - %s\n",
-                               i, hw->init->name);
+                               i, name);
                        return ret;
                }
        }
diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
index c813c27f2e58..2f97a843d6d6 100644
--- a/drivers/clk/at91/clk-main.c
+++ b/drivers/clk/at91/clk-main.c
@@ -27,6 +27,10 @@
 
 #define MOR_KEY_MASK           (0xff << 16)
 
+#define clk_main_parent_select(s)      (((s) & \
+                                       (AT91_PMC_MOSCEN | \
+                                       AT91_PMC_OSCBYPASS)) ? 1 : 0)
+
 struct clk_main_osc {
        struct clk_hw hw;
        struct regmap *regmap;
@@ -119,7 +123,7 @@ static int clk_main_osc_is_prepared(struct clk_hw *hw)
 
        regmap_read(regmap, AT91_PMC_SR, &status);
 
-       return (status & AT91_PMC_MOSCS) && (tmp & AT91_PMC_MOSCEN);
+       return (status & AT91_PMC_MOSCS) && clk_main_parent_select(tmp);
 }
 
 static const struct clk_ops main_osc_ops = {
@@ -530,7 +534,7 @@ static u8 clk_sam9x5_main_get_parent(struct clk_hw *hw)
 
        regmap_read(clkmain->regmap, AT91_CKGR_MOR, &status);
 
-       return status & AT91_PMC_MOSCEN ? 1 : 0;
+       return clk_main_parent_select(status);
 }
 
 static const struct clk_ops sam9x5_main_ops = {
@@ -572,7 +576,7 @@ at91_clk_register_sam9x5_main(struct regmap *regmap,
        clkmain->hw.init = &init;
        clkmain->regmap = regmap;
        regmap_read(clkmain->regmap, AT91_CKGR_MOR, &status);
-       clkmain->parent = status & AT91_PMC_MOSCEN ? 1 : 0;
+       clkmain->parent = clk_main_parent_select(status);
 
        hw = &clkmain->hw;
        ret = clk_hw_register(NULL, &clkmain->hw);
diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
index 3a1812f65e5d..8abc5c8cb8b8 100644
--- a/drivers/clk/clk-qoriq.c
+++ b/drivers/clk/clk-qoriq.c
@@ -610,7 +610,7 @@ static const struct clockgen_chipinfo chipinfo[] = {
                .guts_compat = "fsl,qoriq-device-config-1.0",
                .init_periph = p5020_init_periph,
                .cmux_groups = {
-                       &p2041_cmux_grp1, &p2041_cmux_grp2
+                       &p5020_cmux_grp1, &p5020_cmux_grp2
                },
                .cmux_to_group = {
                        0, 1, -1
diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c
index 3bf11a620094..ada3e4aeb38f 100644
--- a/drivers/clk/qcom/gcc-sdm845.c
+++ b/drivers/clk/qcom/gcc-sdm845.c
@@ -647,7 +647,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
                .name = "gcc_sdcc2_apps_clk_src",
                .parent_names = gcc_parent_names_10,
                .num_parents = 5,
-               .ops = &clk_rcg2_ops,
+               .ops = &clk_rcg2_floor_ops,
        },
 };
 
@@ -671,7 +671,7 @@ static struct clk_rcg2 gcc_sdcc4_apps_clk_src = {
                .name = "gcc_sdcc4_apps_clk_src",
                .parent_names = gcc_parent_names_0,
                .num_parents = 4,
-               .ops = &clk_rcg2_ops,
+               .ops = &clk_rcg2_floor_ops,
        },
 };
 
diff --git a/drivers/clk/renesas/clk-mstp.c b/drivers/clk/renesas/clk-mstp.c
index e82adcb16a52..45d94fb9703d 100644
--- a/drivers/clk/renesas/clk-mstp.c
+++ b/drivers/clk/renesas/clk-mstp.c
@@ -341,7 +341,8 @@ void __init cpg_mstp_add_clk_domain(struct device_node *np)
                return;
 
        pd->name = np->name;
-       pd->flags = GENPD_FLAG_PM_CLK | GENPD_FLAG_ACTIVE_WAKEUP;
+       pd->flags = GENPD_FLAG_PM_CLK | GENPD_FLAG_ALWAYS_ON |
+                   GENPD_FLAG_ACTIVE_WAKEUP;
        pd->attach_dev = cpg_mstp_attach_dev;
        pd->detach_dev = cpg_mstp_detach_dev;
        pm_genpd_init(pd, &pm_domain_always_on_gov, false);
diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c 
b/drivers/clk/renesas/renesas-cpg-mssr.c
index 24485bee9b49..d7a2ad617369 100644
--- a/drivers/clk/renesas/renesas-cpg-mssr.c
+++ b/drivers/clk/renesas/renesas-cpg-mssr.c
@@ -514,7 +514,8 @@ static int __init cpg_mssr_add_clk_domain(struct device 
*dev,
 
        genpd = &pd->genpd;
        genpd->name = np->name;
-       genpd->flags = GENPD_FLAG_PM_CLK | GENPD_FLAG_ACTIVE_WAKEUP;
+       genpd->flags = GENPD_FLAG_PM_CLK | GENPD_FLAG_ALWAYS_ON |
+                      GENPD_FLAG_ACTIVE_WAKEUP;
        genpd->attach_dev = cpg_mssr_attach_dev;
        genpd->detach_dev = cpg_mssr_detach_dev;
        pm_genpd_init(genpd, &pm_domain_always_on_gov, false);
diff --git a/drivers/clk/sirf/clk-common.c b/drivers/clk/sirf/clk-common.c
index d8f9efa5129a..25351d6a55ba 100644
--- a/drivers/clk/sirf/clk-common.c
+++ b/drivers/clk/sirf/clk-common.c
@@ -298,9 +298,10 @@ static u8 dmn_clk_get_parent(struct clk_hw *hw)
 {
        struct clk_dmn *clk = to_dmnclk(hw);
        u32 cfg = clkc_readl(clk->regofs);
+       const char *name = clk_hw_get_name(hw);
 
        /* parent of io domain can only be pll3 */
-       if (strcmp(hw->init->name, "io") == 0)
+       if (strcmp(name, "io") == 0)
                return 4;
 
        WARN_ON((cfg & (BIT(3) - 1)) > 4);
@@ -312,9 +313,10 @@ static int dmn_clk_set_parent(struct clk_hw *hw, u8 parent)
 {
        struct clk_dmn *clk = to_dmnclk(hw);
        u32 cfg = clkc_readl(clk->regofs);
+       const char *name = clk_hw_get_name(hw);
 
        /* parent of io domain can only be pll3 */
-       if (strcmp(hw->init->name, "io") == 0)
+       if (strcmp(name, "io") == 0)
                return -EINVAL;
 
        cfg &= ~(BIT(3) - 1);
@@ -354,7 +356,8 @@ static long dmn_clk_round_rate(struct clk_hw *hw, unsigned 
long rate,
 {
        unsigned long fin;
        unsigned ratio, wait, hold;
-       unsigned bits = (strcmp(hw->init->name, "mem") == 0) ? 3 : 4;
+       const char *name = clk_hw_get_name(hw);
+       unsigned bits = (strcmp(name, "mem") == 0) ? 3 : 4;
 
        fin = *parent_rate;
        ratio = fin / rate;
@@ -376,7 +379,8 @@ static int dmn_clk_set_rate(struct clk_hw *hw, unsigned 
long rate,
        struct clk_dmn *clk = to_dmnclk(hw);
        unsigned long fin;
        unsigned ratio, wait, hold, reg;
-       unsigned bits = (strcmp(hw->init->name, "mem") == 0) ? 3 : 4;
+       const char *name = clk_hw_get_name(hw);
+       unsigned bits = (strcmp(name, "mem") == 0) ? 3 : 4;
 
        fin = parent_rate;
        ratio = fin / rate;
diff --git a/drivers/clk/sprd/common.c b/drivers/clk/sprd/common.c
index e038b0447206..8bdab1c3013b 100644
--- a/drivers/clk/sprd/common.c
+++ b/drivers/clk/sprd/common.c
@@ -71,16 +71,17 @@ int sprd_clk_probe(struct device *dev, struct 
clk_hw_onecell_data *clkhw)
        struct clk_hw *hw;
 
        for (i = 0; i < clkhw->num; i++) {
+               const char *name;
 
                hw = clkhw->hws[i];
-
                if (!hw)
                        continue;
 
+               name = hw->init->name;
                ret = devm_clk_hw_register(dev, hw);
                if (ret) {
                        dev_err(dev, "Couldn't register clock %d - %s\n",
-                               i, hw->init->name);
+                               i, name);
                        return ret;
                }
        }
diff --git a/drivers/clk/sprd/pll.c b/drivers/clk/sprd/pll.c
index 36b4402bf09e..640270f51aa5 100644
--- a/drivers/clk/sprd/pll.c
+++ b/drivers/clk/sprd/pll.c
@@ -136,6 +136,7 @@ static unsigned long _sprd_pll_recalc_rate(const struct 
sprd_pll *pll,
                                         k2 + refin * nint * CLK_PLL_1M;
        }
 
+       kfree(cfg);
        return rate;
 }
 
@@ -222,6 +223,7 @@ static int _sprd_pll_set_rate(const struct sprd_pll *pll,
        if (!ret)
                udelay(pll->udelay);
 
+       kfree(cfg);
        return ret;
 }
 
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c 
b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
index ac12f261f8ca..9e3f4088724b 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
@@ -499,6 +499,9 @@ static struct clk_hw_onecell_data sun8i_v3s_hw_clks = {
                [CLK_MMC1]              = &mmc1_clk.common.hw,
                [CLK_MMC1_SAMPLE]       = &mmc1_sample_clk.common.hw,
                [CLK_MMC1_OUTPUT]       = &mmc1_output_clk.common.hw,
+               [CLK_MMC2]              = &mmc2_clk.common.hw,
+               [CLK_MMC2_SAMPLE]       = &mmc2_sample_clk.common.hw,
+               [CLK_MMC2_OUTPUT]       = &mmc2_output_clk.common.hw,
                [CLK_CE]                = &ce_clk.common.hw,
                [CLK_SPI0]              = &spi0_clk.common.hw,
                [CLK_USB_PHY0]          = &usb_phy0_clk.common.hw,
diff --git a/drivers/clk/zte/clk-zx296718.c b/drivers/clk/zte/clk-zx296718.c
index 354dd508c516..8dfb8523b79d 100644
--- a/drivers/clk/zte/clk-zx296718.c
+++ b/drivers/clk/zte/clk-zx296718.c
@@ -567,6 +567,7 @@ static int __init top_clocks_init(struct device_node *np)
 {
        void __iomem *reg_base;
        int i, ret;
+       const char *name;
 
        reg_base = of_iomap(np, 0);
        if (!reg_base) {
@@ -576,11 +577,10 @@ static int __init top_clocks_init(struct device_node *np)
 
        for (i = 0; i < ARRAY_SIZE(zx296718_pll_clk); i++) {
                zx296718_pll_clk[i].reg_base += (uintptr_t)reg_base;
+               name = zx296718_pll_clk[i].hw.init->name;
                ret = clk_hw_register(NULL, &zx296718_pll_clk[i].hw);
-               if (ret) {
-                       pr_warn("top clk %s init error!\n",
-                               zx296718_pll_clk[i].hw.init->name);
-               }
+               if (ret)
+                       pr_warn("top clk %s init error!\n", name);
        }
 
        for (i = 0; i < ARRAY_SIZE(top_ffactor_clk); i++) {
@@ -588,11 +588,10 @@ static int __init top_clocks_init(struct device_node *np)
                        top_hw_onecell_data.hws[top_ffactor_clk[i].id] =
                                        &top_ffactor_clk[i].factor.hw;
 
+               name = top_ffactor_clk[i].factor.hw.init->name;
                ret = clk_hw_register(NULL, &top_ffactor_clk[i].factor.hw);
-               if (ret) {
-                       pr_warn("top clk %s init error!\n",
-                               top_ffactor_clk[i].factor.hw.init->name);
-               }
+               if (ret)
+                       pr_warn("top clk %s init error!\n", name);
        }
 
        for (i = 0; i < ARRAY_SIZE(top_mux_clk); i++) {
@@ -601,11 +600,10 @@ static int __init top_clocks_init(struct device_node *np)
                                        &top_mux_clk[i].mux.hw;
 
                top_mux_clk[i].mux.reg += (uintptr_t)reg_base;
+               name = top_mux_clk[i].mux.hw.init->name;
                ret = clk_hw_register(NULL, &top_mux_clk[i].mux.hw);
-               if (ret) {
-                       pr_warn("top clk %s init error!\n",
-                               top_mux_clk[i].mux.hw.init->name);
-               }
+               if (ret)
+                       pr_warn("top clk %s init error!\n", name);
        }
 
        for (i = 0; i < ARRAY_SIZE(top_gate_clk); i++) {
@@ -614,11 +612,10 @@ static int __init top_clocks_init(struct device_node *np)
                                        &top_gate_clk[i].gate.hw;
 
                top_gate_clk[i].gate.reg += (uintptr_t)reg_base;
+               name = top_gate_clk[i].gate.hw.init->name;
                ret = clk_hw_register(NULL, &top_gate_clk[i].gate.hw);
-               if (ret) {
-                       pr_warn("top clk %s init error!\n",
-                               top_gate_clk[i].gate.hw.init->name);
-               }
+               if (ret)
+                       pr_warn("top clk %s init error!\n", name);
        }
 
        for (i = 0; i < ARRAY_SIZE(top_div_clk); i++) {
@@ -627,11 +624,10 @@ static int __init top_clocks_init(struct device_node *np)
                                        &top_div_clk[i].div.hw;
 
                top_div_clk[i].div.reg += (uintptr_t)reg_base;
+               name = top_div_clk[i].div.hw.init->name;
                ret = clk_hw_register(NULL, &top_div_clk[i].div.hw);
-               if (ret) {
-                       pr_warn("top clk %s init error!\n",
-                               top_div_clk[i].div.hw.init->name);
-               }
+               if (ret)
+                       pr_warn("top clk %s init error!\n", name);
        }
 
        ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get,
@@ -757,6 +753,7 @@ static int __init lsp0_clocks_init(struct device_node *np)
 {
        void __iomem *reg_base;
        int i, ret;
+       const char *name;
 
        reg_base = of_iomap(np, 0);
        if (!reg_base) {
@@ -770,11 +767,10 @@ static int __init lsp0_clocks_init(struct device_node *np)
                                        &lsp0_mux_clk[i].mux.hw;
 
                lsp0_mux_clk[i].mux.reg += (uintptr_t)reg_base;
+               name = lsp0_mux_clk[i].mux.hw.init->name;
                ret = clk_hw_register(NULL, &lsp0_mux_clk[i].mux.hw);
-               if (ret) {
-                       pr_warn("lsp0 clk %s init error!\n",
-                               lsp0_mux_clk[i].mux.hw.init->name);
-               }
+               if (ret)
+                       pr_warn("lsp0 clk %s init error!\n", name);
        }
 
        for (i = 0; i < ARRAY_SIZE(lsp0_gate_clk); i++) {
@@ -783,11 +779,10 @@ static int __init lsp0_clocks_init(struct device_node *np)
                                        &lsp0_gate_clk[i].gate.hw;
 
                lsp0_gate_clk[i].gate.reg += (uintptr_t)reg_base;
+               name = lsp0_gate_clk[i].gate.hw.init->name;
                ret = clk_hw_register(NULL, &lsp0_gate_clk[i].gate.hw);
-               if (ret) {
-                       pr_warn("lsp0 clk %s init error!\n",
-                               lsp0_gate_clk[i].gate.hw.init->name);
-               }
+               if (ret)
+                       pr_warn("lsp0 clk %s init error!\n", name);
        }
 
        for (i = 0; i < ARRAY_SIZE(lsp0_div_clk); i++) {
@@ -796,11 +791,10 @@ static int __init lsp0_clocks_init(struct device_node *np)
                                        &lsp0_div_clk[i].div.hw;
 
                lsp0_div_clk[i].div.reg += (uintptr_t)reg_base;
+               name = lsp0_div_clk[i].div.hw.init->name;
                ret = clk_hw_register(NULL, &lsp0_div_clk[i].div.hw);
-               if (ret) {
-                       pr_warn("lsp0 clk %s init error!\n",
-                               lsp0_div_clk[i].div.hw.init->name);
-               }
+               if (ret)
+                       pr_warn("lsp0 clk %s init error!\n", name);
        }
 
        ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get,
@@ -865,6 +859,7 @@ static int __init lsp1_clocks_init(struct device_node *np)
 {
        void __iomem *reg_base;
        int i, ret;
+       const char *name;
 
        reg_base = of_iomap(np, 0);
        if (!reg_base) {
@@ -878,11 +873,10 @@ static int __init lsp1_clocks_init(struct device_node *np)
                                        &lsp0_mux_clk[i].mux.hw;
 
                lsp1_mux_clk[i].mux.reg += (uintptr_t)reg_base;
+               name = lsp1_mux_clk[i].mux.hw.init->name;
                ret = clk_hw_register(NULL, &lsp1_mux_clk[i].mux.hw);
-               if (ret) {
-                       pr_warn("lsp1 clk %s init error!\n",
-                               lsp1_mux_clk[i].mux.hw.init->name);
-               }
+               if (ret)
+                       pr_warn("lsp1 clk %s init error!\n", name);
        }
 
        for (i = 0; i < ARRAY_SIZE(lsp1_gate_clk); i++) {
@@ -891,11 +885,10 @@ static int __init lsp1_clocks_init(struct device_node *np)
                                        &lsp1_gate_clk[i].gate.hw;
 
                lsp1_gate_clk[i].gate.reg += (uintptr_t)reg_base;
+               name = lsp1_gate_clk[i].gate.hw.init->name;
                ret = clk_hw_register(NULL, &lsp1_gate_clk[i].gate.hw);
-               if (ret) {
-                       pr_warn("lsp1 clk %s init error!\n",
-                               lsp1_gate_clk[i].gate.hw.init->name);
-               }
+               if (ret)
+                       pr_warn("lsp1 clk %s init error!\n", name);
        }
 
        for (i = 0; i < ARRAY_SIZE(lsp1_div_clk); i++) {
@@ -904,11 +897,10 @@ static int __init lsp1_clocks_init(struct device_node *np)
                                        &lsp1_div_clk[i].div.hw;
 
                lsp1_div_clk[i].div.reg += (uintptr_t)reg_base;
+               name = lsp1_div_clk[i].div.hw.init->name;
                ret = clk_hw_register(NULL, &lsp1_div_clk[i].div.hw);
-               if (ret) {
-                       pr_warn("lsp1 clk %s init error!\n",
-                               lsp1_div_clk[i].div.hw.init->name);
-               }
+               if (ret)
+                       pr_warn("lsp1 clk %s init error!\n", name);
        }
 
        ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get,
@@ -982,6 +974,7 @@ static int __init audio_clocks_init(struct device_node *np)
 {
        void __iomem *reg_base;
        int i, ret;
+       const char *name;
 
        reg_base = of_iomap(np, 0);
        if (!reg_base) {
@@ -995,11 +988,10 @@ static int __init audio_clocks_init(struct device_node 
*np)
                                        &audio_mux_clk[i].mux.hw;
 
                audio_mux_clk[i].mux.reg += (uintptr_t)reg_base;
+               name = audio_mux_clk[i].mux.hw.init->name;
                ret = clk_hw_register(NULL, &audio_mux_clk[i].mux.hw);
-               if (ret) {
-                       pr_warn("audio clk %s init error!\n",
-                               audio_mux_clk[i].mux.hw.init->name);
-               }
+               if (ret)
+                       pr_warn("audio clk %s init error!\n", name);
        }
 
        for (i = 0; i < ARRAY_SIZE(audio_adiv_clk); i++) {
@@ -1008,11 +1000,10 @@ static int __init audio_clocks_init(struct device_node 
*np)
                                        &audio_adiv_clk[i].hw;
 
                audio_adiv_clk[i].reg_base += (uintptr_t)reg_base;
+               name = audio_adiv_clk[i].hw.init->name;
                ret = clk_hw_register(NULL, &audio_adiv_clk[i].hw);
-               if (ret) {
-                       pr_warn("audio clk %s init error!\n",
-                               audio_adiv_clk[i].hw.init->name);
-               }
+               if (ret)
+                       pr_warn("audio clk %s init error!\n", name);
        }
 
        for (i = 0; i < ARRAY_SIZE(audio_div_clk); i++) {
@@ -1021,11 +1012,10 @@ static int __init audio_clocks_init(struct device_node 
*np)
                                        &audio_div_clk[i].div.hw;
 
                audio_div_clk[i].div.reg += (uintptr_t)reg_base;
+               name = audio_div_clk[i].div.hw.init->name;
                ret = clk_hw_register(NULL, &audio_div_clk[i].div.hw);
-               if (ret) {
-                       pr_warn("audio clk %s init error!\n",
-                               audio_div_clk[i].div.hw.init->name);
-               }
+               if (ret)
+                       pr_warn("audio clk %s init error!\n", name);
        }
 
        for (i = 0; i < ARRAY_SIZE(audio_gate_clk); i++) {
@@ -1034,11 +1024,10 @@ static int __init audio_clocks_init(struct device_node 
*np)
                                        &audio_gate_clk[i].gate.hw;
 
                audio_gate_clk[i].gate.reg += (uintptr_t)reg_base;
+               name = audio_gate_clk[i].gate.hw.init->name;
                ret = clk_hw_register(NULL, &audio_gate_clk[i].gate.hw);
-               if (ret) {
-                       pr_warn("audio clk %s init error!\n",
-                               audio_gate_clk[i].gate.hw.init->name);
-               }
+               if (ret)
+                       pr_warn("audio clk %s init error!\n", name);
        }
 
        ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get,
diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c 
b/drivers/crypto/hisilicon/sec/sec_algs.c
index cdc4f9a171d9..db2983c51f1e 100644
--- a/drivers/crypto/hisilicon/sec/sec_algs.c
+++ b/drivers/crypto/hisilicon/sec/sec_algs.c
@@ -215,17 +215,18 @@ static void sec_free_hw_sgl(struct sec_hw_sgl *hw_sgl,
                            dma_addr_t psec_sgl, struct sec_dev_info *info)
 {
        struct sec_hw_sgl *sgl_current, *sgl_next;
+       dma_addr_t sgl_next_dma;
 
-       if (!hw_sgl)
-               return;
        sgl_current = hw_sgl;
-       while (sgl_current->next) {
+       while (sgl_current) {
                sgl_next = sgl_current->next;
-               dma_pool_free(info->hw_sgl_pool, sgl_current,
-                             sgl_current->next_sgl);
+               sgl_next_dma = sgl_current->next_sgl;
+
+               dma_pool_free(info->hw_sgl_pool, sgl_current, psec_sgl);
+
                sgl_current = sgl_next;
+               psec_sgl = sgl_next_dma;
        }
-       dma_pool_free(info->hw_sgl_pool, hw_sgl, psec_sgl);
 }
 
 static int sec_alg_skcipher_setkey(struct crypto_skcipher *tfm,
diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c
index 53c1d6d36a64..81ba4eb34890 100644
--- a/drivers/dma-buf/sw_sync.c
+++ b/drivers/dma-buf/sw_sync.c
@@ -141,17 +141,14 @@ static void timeline_fence_release(struct dma_fence 
*fence)
 {
        struct sync_pt *pt = dma_fence_to_sync_pt(fence);
        struct sync_timeline *parent = dma_fence_parent(fence);
+       unsigned long flags;
 
+       spin_lock_irqsave(fence->lock, flags);
        if (!list_empty(&pt->link)) {
-               unsigned long flags;
-
-               spin_lock_irqsave(fence->lock, flags);
-               if (!list_empty(&pt->link)) {
-                       list_del(&pt->link);
-                       rb_erase(&pt->node, &parent->pt_tree);
-               }
-               spin_unlock_irqrestore(fence->lock, flags);
+               list_del(&pt->link);
+               rb_erase(&pt->node, &parent->pt_tree);
        }
+       spin_unlock_irqrestore(fence->lock, flags);
 
        sync_timeline_put(parent);
        dma_fence_free(fence);
@@ -274,7 +271,8 @@ static struct sync_pt *sync_pt_create(struct sync_timeline 
*obj,
                                p = &parent->rb_left;
                        } else {
                                if (dma_fence_get_rcu(&other->base)) {
-                                       dma_fence_put(&pt->base);
+                                       sync_timeline_put(obj);
+                                       kfree(pt);
                                        pt = other;
                                        goto unlock;
                                }
diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
index c364ef94cc36..77c9f4d8668a 100644
--- a/drivers/gpu/drm/amd/amdgpu/si.c
+++ b/drivers/gpu/drm/amd/amdgpu/si.c
@@ -1813,7 +1813,7 @@ static void si_program_aspm(struct amdgpu_device *adev)
                        if (orig != data)
                                si_pif_phy1_wreg(adev,PB1_PIF_PWRDOWN_1, data);
 
-                       if ((adev->family != CHIP_OLAND) && (adev->family != 
CHIP_HAINAN)) {
+                       if ((adev->asic_type != CHIP_OLAND) && (adev->asic_type 
!= CHIP_HAINAN)) {
                                orig = data = 
si_pif_phy0_rreg(adev,PB0_PIF_PWRDOWN_0);
                                data &= ~PLL_RAMP_UP_TIME_0_MASK;
                                if (orig != data)
@@ -1862,14 +1862,14 @@ static void si_program_aspm(struct amdgpu_device *adev)
 
                        orig = data = si_pif_phy0_rreg(adev,PB0_PIF_CNTL);
                        data &= ~LS2_EXIT_TIME_MASK;
-                       if ((adev->family == CHIP_OLAND) || (adev->family == 
CHIP_HAINAN))
+                       if ((adev->asic_type == CHIP_OLAND) || (adev->asic_type 
== CHIP_HAINAN))
                                data |= LS2_EXIT_TIME(5);
                        if (orig != data)
                                si_pif_phy0_wreg(adev,PB0_PIF_CNTL, data);
 
                        orig = data = si_pif_phy1_rreg(adev,PB1_PIF_CNTL);
                        data &= ~LS2_EXIT_TIME_MASK;
-                       if ((adev->family == CHIP_OLAND) || (adev->family == 
CHIP_HAINAN))
+                       if ((adev->asic_type == CHIP_OLAND) || (adev->asic_type 
== CHIP_HAINAN))
                                data |= LS2_EXIT_TIME(5);
                        if (orig != data)
                                si_pif_phy1_wreg(adev,PB1_PIF_CNTL, data);
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c 
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index f4b89d1ea6f6..2b2efe443c36 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -1585,6 +1585,14 @@ void dc_set_power_state(
                dc_resource_state_construct(dc, dc->current_state);
 
                dc->hwss.init_hw(dc);
+
+#ifdef CONFIG_DRM_AMD_DC_DCN2_0
+               if (dc->hwss.init_sys_ctx != NULL &&
+                       dc->vm_pa_config.valid) {
+                       dc->hwss.init_sys_ctx(dc->hwseq, dc, &dc->vm_pa_config);
+               }
+#endif
+
                break;
        default:
 
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c 
b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
index f0d68aa7c8fc..d440b28ee43f 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -229,12 +229,10 @@ bool resource_construct(
                                DC_ERR("DC: failed to create audio!\n");
                                return false;
                        }
-
                        if (!aud->funcs->endpoint_valid(aud)) {
                                aud->funcs->destroy(&aud);
                                break;
                        }
-
                        pool->audios[i] = aud;
                        pool->audio_count++;
                }
@@ -1703,24 +1701,25 @@ static struct audio *find_first_free_audio(
                const struct resource_pool *pool,
                enum engine_id id)
 {
-       int i;
-       for (i = 0; i < pool->audio_count; i++) {
+       int i, available_audio_count;
+
+       available_audio_count = pool->audio_count;
+
+       for (i = 0; i < available_audio_count; i++) {
                if ((res_ctx->is_audio_acquired[i] == false) && 
(res_ctx->is_stream_enc_acquired[i] == true)) {
                        /*we have enough audio endpoint, find the matching 
inst*/
                        if (id != i)
                                continue;
-
                        return pool->audios[i];
                }
        }
 
-    /* use engine id to find free audio */
-       if ((id < pool->audio_count) && (res_ctx->is_audio_acquired[id] == 
false)) {
+       /* use engine id to find free audio */
+       if ((id < available_audio_count) && (res_ctx->is_audio_acquired[id] == 
false)) {
                return pool->audios[id];
        }
-
        /*not found the matching one, first come first serve*/
-       for (i = 0; i < pool->audio_count; i++) {
+       for (i = 0; i < available_audio_count; i++) {
                if (res_ctx->is_audio_acquired[i] == false) {
                        return pool->audios[i];
                }
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c 
b/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c
index 7f6d724686f1..abb559ce6408 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c
@@ -611,6 +611,8 @@ void dce_aud_az_configure(
 
        AZ_REG_WRITE(AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1,
                value);
+       DC_LOG_HW_AUDIO("\n\tAUDIO:az_configure: index: %u data, 0x%x, 
displayName %s: \n",
+               audio->inst, value, audio_info->display_name);
 
        /*
        *write the port ID:
@@ -922,7 +924,6 @@ static const struct audio_funcs funcs = {
        .az_configure = dce_aud_az_configure,
        .destroy = dce_aud_destroy,
 };
-
 void dce_aud_destroy(struct audio **audio)
 {
        struct dce_audio *aud = DCE_AUD(*audio);
@@ -953,7 +954,6 @@ struct audio *dce_audio_create(
        audio->regs = reg;
        audio->shifts = shifts;
        audio->masks = masks;
-
        return &audio->base;
 }
 
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c 
b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
index 5d95a997fd9f..f8904f73f57b 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
@@ -292,9 +292,10 @@ bool cm_helper_translate_curve_to_hw_format(
                seg_distr[7] = 4;
                seg_distr[8] = 4;
                seg_distr[9] = 4;
+               seg_distr[10] = 1;
 
                region_start = -10;
-               region_end = 0;
+               region_end = 1;
        }
 
        for (i = region_end - region_start; i < MAX_REGIONS_NUMBER ; i++)
diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c 
b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
index d68986cea132..84abf5d6f760 100644
--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
@@ -1040,16 +1040,17 @@ static int analogix_dp_commit(struct analogix_dp_device 
*dp)
        if (ret)
                return ret;
 
+       /* Check whether panel supports fast training */
+       ret = analogix_dp_fast_link_train_detection(dp);
+       if (ret)
+               dp->psr_enable = false;
+
        if (dp->psr_enable) {
                ret = analogix_dp_enable_sink_psr(dp);
                if (ret)
                        return ret;
        }
 
-       /* Check whether panel supports fast training */
-       ret =  analogix_dp_fast_link_train_detection(dp);
-       if (ret)
-               dp->psr_enable = false;
 
        return ret;
 }
diff --git a/drivers/gpu/drm/bridge/tc358767.c 
b/drivers/gpu/drm/bridge/tc358767.c
index aaca5248da07..d728b6cf6109 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -302,7 +302,7 @@ static ssize_t tc_aux_transfer(struct drm_dp_aux *aux,
                               struct drm_dp_aux_msg *msg)
 {
        struct tc_data *tc = aux_to_tc(aux);
-       size_t size = min_t(size_t, 8, msg->size);
+       size_t size = min_t(size_t, DP_AUX_MAX_PAYLOAD_BYTES - 1, msg->size);
        u8 request = msg->request & ~DP_AUX_I2C_MOT;
        u8 *buf = msg->buffer;
        u32 tmp = 0;
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/volt.c 
b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/volt.c
index 7143ea4611aa..33a9fb5ac558 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/volt.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/volt.c
@@ -96,6 +96,8 @@ nvbios_volt_parse(struct nvkm_bios *bios, u8 *ver, u8 *hdr, 
u8 *cnt, u8 *len,
                info->min     = min(info->base,
                                    info->base + info->step * info->vidmask);
                info->max     = nvbios_rd32(bios, volt + 0x0e);
+               if (!info->max)
+                       info->max = max(info->base, info->base + info->step * 
info->vidmask);
                break;
        case 0x50:
                info->min     = nvbios_rd32(bios, volt + 0x0a);
diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c 
b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
index 2c9c9722734f..9a2cb8aeab3a 100644
--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
@@ -400,7 +400,13 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c,
 
        /* Look up the DSI host.  It needs to probe before we do. */
        endpoint = of_graph_get_next_endpoint(dev->of_node, NULL);
+       if (!endpoint)
+               return -ENODEV;
+
        dsi_host_node = of_graph_get_remote_port_parent(endpoint);
+       if (!dsi_host_node)
+               goto error;
+
        host = of_find_mipi_dsi_host_by_node(dsi_host_node);
        of_node_put(dsi_host_node);
        if (!host) {
@@ -409,6 +415,9 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c,
        }
 
        info.node = of_graph_get_remote_port(endpoint);
+       if (!info.node)
+               goto error;
+
        of_node_put(endpoint);
 
        ts->dsi = mipi_dsi_device_register_full(host, &info);
@@ -429,6 +438,10 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c,
                return ret;
 
        return 0;
+
+error:
+       of_node_put(endpoint);
+       return -ENODEV;
 }
 
 static int rpi_touchscreen_remove(struct i2c_client *i2c)
diff --git a/drivers/gpu/drm/panel/panel-simple.c 
b/drivers/gpu/drm/panel/panel-simple.c
index 5fd94e206029..654fea2b4312 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -689,9 +689,9 @@ static const struct panel_desc auo_g133han01 = {
 static const struct display_timing auo_g185han01_timings = {
        .pixelclock = { 120000000, 144000000, 175000000 },
        .hactive = { 1920, 1920, 1920 },
-       .hfront_porch = { 18, 60, 74 },
-       .hback_porch = { 12, 44, 54 },
-       .hsync_len = { 10, 24, 32 },
+       .hfront_porch = { 36, 120, 148 },
+       .hback_porch = { 24, 88, 108 },
+       .hsync_len = { 20, 48, 64 },
        .vactive = { 1080, 1080, 1080 },
        .vfront_porch = { 6, 10, 40 },
        .vback_porch = { 2, 5, 20 },
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c 
b/drivers/gpu/drm/radeon/radeon_connectors.c
index 414642e5b7a3..de656f555383 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -751,7 +751,7 @@ static int radeon_connector_set_property(struct 
drm_connector *connector, struct
 
                radeon_encoder->output_csc = val;
 
-               if (connector->encoder->crtc) {
+               if (connector->encoder && connector->encoder->crtc) {
                        struct drm_crtc *crtc  = connector->encoder->crtc;
                        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
 
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c 
b/drivers/gpu/drm/radeon/radeon_drv.c
index 2a7977a23b31..25b5407c74b5 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -364,11 +364,19 @@ radeon_pci_remove(struct pci_dev *pdev)
 static void
 radeon_pci_shutdown(struct pci_dev *pdev)
 {
+       struct drm_device *ddev = pci_get_drvdata(pdev);
+
        /* if we are running in a VM, make sure the device
         * torn down properly on reboot/shutdown
         */
        if (radeon_device_is_virtual())
                radeon_pci_remove(pdev);
+
+       /* Some adapters need to be suspended before a
+       * shutdown occurs in order to prevent an error
+       * during kexec.
+       */
+       radeon_suspend_kms(ddev, true, true, false);
 }
 
 static int radeon_pmops_suspend(struct device *dev)
diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c
index 808d9fb627e9..477d0a27b9a5 100644
--- a/drivers/gpu/drm/stm/ltdc.c
+++ b/drivers/gpu/drm/stm/ltdc.c
@@ -19,6 +19,7 @@
 #include <drm/drm_crtc_helper.h>
 #include <drm/drm_fb_cma_helper.h>
 #include <drm/drm_gem_cma_helper.h>
+#include <drm/drm_gem_framebuffer_helper.h>
 #include <drm/drm_of.h>
 #include <drm/drm_bridge.h>
 #include <drm/drm_plane_helper.h>
@@ -825,6 +826,7 @@ static const struct drm_plane_funcs ltdc_plane_funcs = {
 };
 
 static const struct drm_plane_helper_funcs ltdc_plane_helper_funcs = {
+       .prepare_fb = drm_gem_fb_prepare_fb,
        .atomic_check = ltdc_plane_atomic_check,
        .atomic_update = ltdc_plane_atomic_update,
        .atomic_disable = ltdc_plane_atomic_disable,
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index 1cb41992aaa1..d0a81a03ddbd 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -57,7 +57,6 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and 
Command (\"Flag\")
 struct apple_sc {
        unsigned long quirks;
        unsigned int fn_on;
-       DECLARE_BITMAP(pressed_fn, KEY_CNT);
        DECLARE_BITMAP(pressed_numlock, KEY_CNT);
 };
 
@@ -184,6 +183,8 @@ static int hidinput_apple_event(struct hid_device *hid, 
struct input_dev *input,
 {
        struct apple_sc *asc = hid_get_drvdata(hid);
        const struct apple_key_translation *trans, *table;
+       bool do_translate;
+       u16 code = 0;
 
        if (usage->code == KEY_FN) {
                asc->fn_on = !!value;
@@ -192,8 +193,6 @@ static int hidinput_apple_event(struct hid_device *hid, 
struct input_dev *input,
        }
 
        if (fnmode) {
-               int do_translate;
-
                if (hid->product >= USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI &&
                                hid->product <= 
USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS)
                        table = macbookair_fn_keys;
@@ -205,25 +204,33 @@ static int hidinput_apple_event(struct hid_device *hid, 
struct input_dev *input,
                trans = apple_find_translation (table, usage->code);
 
                if (trans) {
-                       if (test_bit(usage->code, asc->pressed_fn))
-                               do_translate = 1;
-                       else if (trans->flags & APPLE_FLAG_FKEY)
-                               do_translate = (fnmode == 2 && asc->fn_on) ||
-                                       (fnmode == 1 && !asc->fn_on);
-                       else
-                               do_translate = asc->fn_on;
-
-                       if (do_translate) {
-                               if (value)
-                                       set_bit(usage->code, asc->pressed_fn);
-                               else
-                                       clear_bit(usage->code, asc->pressed_fn);
-
-                               input_event(input, usage->type, trans->to,
-                                               value);
-
-                               return 1;
+                       if (test_bit(trans->from, input->key))
+                               code = trans->from;
+                       else if (test_bit(trans->to, input->key))
+                               code = trans->to;
+
+                       if (!code) {
+                               if (trans->flags & APPLE_FLAG_FKEY) {
+                                       switch (fnmode) {
+                                       case 1:
+                                               do_translate = !asc->fn_on;
+                                               break;
+                                       case 2:
+                                               do_translate = asc->fn_on;
+                                               break;
+                                       default:
+                                               /* should never happen */
+                                               do_translate = false;
+                                       }
+                               } else {
+                                       do_translate = asc->fn_on;
+                               }
+
+                               code = do_translate ? trans->to : trans->from;
                        }
+
+                       input_event(input, usage->type, code, value);
+                       return 1;
                }
 
                if (asc->quirks & APPLE_NUMLOCK_EMULATION &&
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 5a2d5140c1f4..3038c975e417 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -91,7 +91,7 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
 }
 
 static int wacom_wac_pen_serial_enforce(struct hid_device *hdev,
-               struct hid_report *report, u8 *raw_data, int size)
+               struct hid_report *report, u8 *raw_data, int report_size)
 {
        struct wacom *wacom = hid_get_drvdata(hdev);
        struct wacom_wac *wacom_wac = &wacom->wacom_wac;
@@ -152,7 +152,8 @@ static int wacom_wac_pen_serial_enforce(struct hid_device 
*hdev,
        if (flush)
                wacom_wac_queue_flush(hdev, &wacom_wac->pen_fifo);
        else if (insert)
-               wacom_wac_queue_insert(hdev, &wacom_wac->pen_fifo, raw_data, 
size);
+               wacom_wac_queue_insert(hdev, &wacom_wac->pen_fifo,
+                                      raw_data, report_size);
 
        return insert && !flush;
 }
@@ -2147,7 +2148,7 @@ static void wacom_update_name(struct wacom *wacom, const 
char *suffix)
 {
        struct wacom_wac *wacom_wac = &wacom->wacom_wac;
        struct wacom_features *features = &wacom_wac->features;
-       char name[WACOM_NAME_MAX];
+       char name[WACOM_NAME_MAX - 20]; /* Leave some room for suffixes */
 
        /* Generic devices name unspecified */
        if ((features->type == HID_GENERIC) && !strcmp("Wacom HID", 
features->name)) {
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 6f5c838f9d47..1df037e7f0b4 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -255,7 +255,7 @@ static int wacom_dtu_irq(struct wacom_wac *wacom)
 
 static int wacom_dtus_irq(struct wacom_wac *wacom)
 {
-       char *data = wacom->data;
+       unsigned char *data = wacom->data;
        struct input_dev *input = wacom->pen_input;
        unsigned short prox, pressure = 0;
 
@@ -576,7 +576,7 @@ static int wacom_intuos_pad(struct wacom_wac *wacom)
                strip2 = ((data[3] & 0x1f) << 8) | data[4];
        }
 
-       prox = (buttons & ~(~0 << nbuttons)) | (keys & ~(~0 << nkeys)) |
+       prox = (buttons & ~(~0U << nbuttons)) | (keys & ~(~0U << nkeys)) |
               (ring1 & 0x80) | (ring2 & 0x80) | strip1 | strip2;
 
        wacom_report_numbered_buttons(input, nbuttons, buttons);
diff --git a/drivers/i2c/busses/i2c-cht-wc.c b/drivers/i2c/busses/i2c-cht-wc.c
index c4d176f5ed79..f890af67f501 100644
--- a/drivers/i2c/busses/i2c-cht-wc.c
+++ b/drivers/i2c/busses/i2c-cht-wc.c
@@ -187,6 +187,51 @@ static const struct i2c_algorithm cht_wc_i2c_adap_algo = {
        .smbus_xfer = cht_wc_i2c_adap_smbus_xfer,
 };
 
+/*
+ * We are an i2c-adapter which itself is part of an i2c-client. This means that
+ * transfers done through us take adapter->bus_lock twice, once for our parent
+ * i2c-adapter and once to take our own bus_lock. Lockdep does not like this
+ * nested locking, to make lockdep happy in the case of busses with muxes, the
+ * i2c-core's i2c_adapter_lock_bus function calls:
+ * rt_mutex_lock_nested(&adapter->bus_lock, i2c_adapter_depth(adapter));
+ *
+ * But i2c_adapter_depth only works when the direct parent of the adapter is
+ * another adapter, as it is only meant for muxes. In our case there is an
+ * i2c-client and MFD instantiated platform_device in the parent->child chain
+ * between the 2 devices.
+ *
+ * So we override the default i2c_lock_operations and pass a hardcoded
+ * depth of 1 to rt_mutex_lock_nested, to make lockdep happy.
+ *
+ * Note that if there were to be a mux attached to our adapter, this would
+ * break things again since the i2c-mux code expects the root-adapter to have
+ * a locking depth of 0. But we always have only 1 client directly attached
+ * in the form of the Charger IC paired with the CHT Whiskey Cove PMIC.
+ */
+static void cht_wc_i2c_adap_lock_bus(struct i2c_adapter *adapter,
+                                unsigned int flags)
+{
+       rt_mutex_lock_nested(&adapter->bus_lock, 1);
+}
+
+static int cht_wc_i2c_adap_trylock_bus(struct i2c_adapter *adapter,
+                                  unsigned int flags)
+{
+       return rt_mutex_trylock(&adapter->bus_lock);
+}
+
+static void cht_wc_i2c_adap_unlock_bus(struct i2c_adapter *adapter,
+                                  unsigned int flags)
+{
+       rt_mutex_unlock(&adapter->bus_lock);
+}
+
+static const struct i2c_lock_operations cht_wc_i2c_adap_lock_ops = {
+       .lock_bus =    cht_wc_i2c_adap_lock_bus,
+       .trylock_bus = cht_wc_i2c_adap_trylock_bus,
+       .unlock_bus =  cht_wc_i2c_adap_unlock_bus,
+};
+
 /**** irqchip for the client connected to the extchgr i2c adapter ****/
 static void cht_wc_i2c_irq_lock(struct irq_data *data)
 {
@@ -295,6 +340,7 @@ static int cht_wc_i2c_adap_i2c_probe(struct platform_device 
*pdev)
        adap->adapter.owner = THIS_MODULE;
        adap->adapter.class = I2C_CLASS_HWMON;
        adap->adapter.algo = &cht_wc_i2c_adap_algo;
+       adap->adapter.lock_ops = &cht_wc_i2c_adap_lock_ops;
        strlcpy(adap->adapter.name, "PMIC I2C Adapter",
                sizeof(adap->adapter.name));
        adap->adapter.dev.parent = &pdev->dev;
diff --git a/drivers/mailbox/qcom-apcs-ipc-mailbox.c 
b/drivers/mailbox/qcom-apcs-ipc-mailbox.c
index 333ed4a9d4b8..5255dcb551a7 100644
--- a/drivers/mailbox/qcom-apcs-ipc-mailbox.c
+++ b/drivers/mailbox/qcom-apcs-ipc-mailbox.c
@@ -55,7 +55,6 @@ static const struct mbox_chan_ops qcom_apcs_ipc_ops = {
 
 static int qcom_apcs_ipc_probe(struct platform_device *pdev)
 {
-       struct device_node *np = pdev->dev.of_node;
        struct qcom_apcs_ipc *apcs;
        struct regmap *regmap;
        struct resource *res;
@@ -63,6 +62,11 @@ static int qcom_apcs_ipc_probe(struct platform_device *pdev)
        void __iomem *base;
        unsigned long i;
        int ret;
+       const struct of_device_id apcs_clk_match_table[] = {
+               { .compatible = "qcom,msm8916-apcs-kpss-global", },
+               { .compatible = "qcom,qcs404-apcs-apps-global", },
+               {}
+       };
 
        apcs = devm_kzalloc(&pdev->dev, sizeof(*apcs), GFP_KERNEL);
        if (!apcs)
@@ -97,7 +101,7 @@ static int qcom_apcs_ipc_probe(struct platform_device *pdev)
                return ret;
        }
 
-       if (of_device_is_compatible(np, "qcom,msm8916-apcs-kpss-global")) {
+       if (of_match_device(apcs_clk_match_table, &pdev->dev)) {
                apcs->clk = platform_device_register_data(&pdev->dev,
                                                          
"qcom-apcs-msm8916-clk",
                                                          -1, NULL, 0);
diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
index 0e5282fc1467..c37c8bb86068 100644
--- a/drivers/mfd/intel-lpss-pci.c
+++ b/drivers/mfd/intel-lpss-pci.c
@@ -39,6 +39,8 @@ static int intel_lpss_pci_probe(struct pci_dev *pdev,
        info->mem = &pdev->resource[0];
        info->irq = pdev->irq;
 
+       pdev->d3cold_delay = 0;
+
        /* Probably it is enough to set this for iDMA capable devices only */
        pci_set_master(pdev);
        pci_try_set_mwi(pdev);
diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c
index 35b767baf21f..c281c488a306 100644
--- a/drivers/net/dsa/rtl8366.c
+++ b/drivers/net/dsa/rtl8366.c
@@ -339,10 +339,12 @@ int rtl8366_vlan_prepare(struct dsa_switch *ds, int port,
                         const struct switchdev_obj_port_vlan *vlan)
 {
        struct realtek_smi *smi = ds->priv;
+       u16 vid;
        int ret;
 
-       if (!smi->ops->is_vlan_valid(smi, port))
-               return -EINVAL;
+       for (vid = vlan->vid_begin; vid < vlan->vid_end; vid++)
+               if (!smi->ops->is_vlan_valid(smi, vid))
+                       return -EINVAL;
 
        dev_info(smi->dev, "prepare VLANs %04x..%04x\n",
                 vlan->vid_begin, vlan->vid_end);
@@ -370,8 +372,9 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port,
        u16 vid;
        int ret;
 
-       if (!smi->ops->is_vlan_valid(smi, port))
-               return;
+       for (vid = vlan->vid_begin; vid < vlan->vid_end; vid++)
+               if (!smi->ops->is_vlan_valid(smi, vid))
+                       return;
 
        dev_info(smi->dev, "add VLAN on port %d, %s, %s\n",
                 port,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c 
b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
index 4bc211093c98..dba8a0c1eda3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
@@ -137,13 +137,12 @@ static int uldrx_handler(struct sge_rspq *q, const __be64 
*rsp,
 static int alloc_uld_rxqs(struct adapter *adap,
                          struct sge_uld_rxq_info *rxq_info, bool lro)
 {
-       struct sge *s = &adap->sge;
        unsigned int nq = rxq_info->nrxq + rxq_info->nciq;
+       int i, err, msi_idx, que_idx = 0, bmap_idx = 0;
        struct sge_ofld_rxq *q = rxq_info->uldrxq;
        unsigned short *ids = rxq_info->rspq_id;
-       unsigned int bmap_idx = 0;
+       struct sge *s = &adap->sge;
        unsigned int per_chan;
-       int i, err, msi_idx, que_idx = 0;
 
        per_chan = rxq_info->nrxq / adap->params.nports;
 
@@ -161,6 +160,10 @@ static int alloc_uld_rxqs(struct adapter *adap,
 
                if (msi_idx >= 0) {
                        bmap_idx = get_msix_idx_from_bmap(adap);
+                       if (bmap_idx < 0) {
+                               err = -ENOSPC;
+                               goto freeout;
+                       }
                        msi_idx = adap->msix_info_ulds[bmap_idx].idx;
                }
                err = t4_sge_alloc_rxq(adap, &q->rspq, false,
diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c 
b/drivers/net/ethernet/qlogic/qla3xxx.c
index 10b075bc5959..783ee6a32b5d 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -2788,6 +2788,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter 
*qdev)
                                netdev_err(qdev->ndev,
                                           "PCI mapping failed with error: 
%d\n",
                                           err);
+                               dev_kfree_skb_irq(skb);
                                ql_free_large_buffers(qdev);
                                return -ENOMEM;
                        }
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index d6916f787fce..5251c5f6f96e 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2634,14 +2634,18 @@ static struct hso_device *hso_create_bulk_serial_device(
                 */
                if (serial->tiocmget) {
                        tiocmget = serial->tiocmget;
+                       tiocmget->endp = hso_get_ep(interface,
+                                                   USB_ENDPOINT_XFER_INT,
+                                                   USB_DIR_IN);
+                       if (!tiocmget->endp) {
+                               dev_err(&interface->dev, "Failed to find INT IN 
ep\n");
+                               goto exit;
+                       }
+
                        tiocmget->urb = usb_alloc_urb(0, GFP_KERNEL);
                        if (tiocmget->urb) {
                                mutex_init(&tiocmget->mutex);
                                init_waitqueue_head(&tiocmget->waitq);
-                               tiocmget->endp = hso_get_ep(
-                                       interface,
-                                       USB_ENDPOINT_XFER_INT,
-                                       USB_DIR_IN);
                        } else
                                hso_free_tiomget(serial);
                }
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 51017c6bb3bc..6f517e673020 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1286,6 +1286,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x1e2d, 0x0082, 4)},    /* Cinterion PHxx,PXxx (2 
RmNet) */
        {QMI_FIXED_INTF(0x1e2d, 0x0082, 5)},    /* Cinterion PHxx,PXxx (2 
RmNet) */
        {QMI_FIXED_INTF(0x1e2d, 0x0083, 4)},    /* Cinterion PHxx,PXxx (1 RmNet 
+ USB Audio)*/
+       {QMI_QUIRK_SET_DTR(0x1e2d, 0x00b0, 4)}, /* Cinterion CLS8 */
        {QMI_FIXED_INTF(0x413c, 0x81a2, 8)},    /* Dell Wireless 5806 Gobi(TM) 
4G LTE Mobile Broadband Card */
        {QMI_FIXED_INTF(0x413c, 0x81a3, 8)},    /* Dell Wireless 5570 HSPA+ 
(42Mbps) Mobile Broadband Card */
        {QMI_FIXED_INTF(0x413c, 0x81a4, 8)},    /* Dell Wireless 5570e HSPA+ 
(42Mbps) Mobile Broadband Card */
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index a2a4c19bc95e..6b4675a9494b 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -890,9 +890,9 @@ static int xennet_set_skb_gso(struct sk_buff *skb,
        return 0;
 }
 
-static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
-                                 struct sk_buff *skb,
-                                 struct sk_buff_head *list)
+static int xennet_fill_frags(struct netfront_queue *queue,
+                            struct sk_buff *skb,
+                            struct sk_buff_head *list)
 {
        RING_IDX cons = queue->rx.rsp_cons;
        struct sk_buff *nskb;
@@ -911,7 +911,7 @@ static RING_IDX xennet_fill_frags(struct netfront_queue 
*queue,
                if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
                        queue->rx.rsp_cons = ++cons + skb_queue_len(list);
                        kfree_skb(nskb);
-                       return ~0U;
+                       return -ENOENT;
                }
 
                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
@@ -922,7 +922,9 @@ static RING_IDX xennet_fill_frags(struct netfront_queue 
*queue,
                kfree_skb(nskb);
        }
 
-       return cons;
+       queue->rx.rsp_cons = cons;
+
+       return 0;
 }
 
 static int checksum_setup(struct net_device *dev, struct sk_buff *skb)
@@ -1048,8 +1050,7 @@ static int xennet_poll(struct napi_struct *napi, int 
budget)
                skb->data_len = rx->status;
                skb->len += rx->status;
 
-               i = xennet_fill_frags(queue, skb, &tmpq);
-               if (unlikely(i == ~0U))
+               if (unlikely(xennet_fill_frags(queue, skb, &tmpq)))
                        goto err;
 
                if (rx->flags & XEN_NETRXF_csum_blank)
@@ -1059,7 +1060,7 @@ static int xennet_poll(struct napi_struct *napi, int 
budget)
 
                __skb_queue_tail(&rxq, skb);
 
-               queue->rx.rsp_cons = ++i;
+               i = ++queue->rx.rsp_cons;
                work_done++;
        }
 
diff --git a/drivers/pci/controller/dwc/pci-exynos.c 
b/drivers/pci/controller/dwc/pci-exynos.c
index cee5f2f590e2..14a6ba4067fb 100644
--- a/drivers/pci/controller/dwc/pci-exynos.c
+++ b/drivers/pci/controller/dwc/pci-exynos.c
@@ -465,7 +465,7 @@ static int __init exynos_pcie_probe(struct platform_device 
*pdev)
 
        ep->phy = devm_of_phy_get(dev, np, NULL);
        if (IS_ERR(ep->phy)) {
-               if (PTR_ERR(ep->phy) == -EPROBE_DEFER)
+               if (PTR_ERR(ep->phy) != -ENODEV)
                        return PTR_ERR(ep->phy);
 
                ep->phy = NULL;
diff --git a/drivers/pci/controller/dwc/pci-imx6.c 
b/drivers/pci/controller/dwc/pci-imx6.c
index 3826b444298c..3b2ceb566728 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -807,8 +807,8 @@ static int imx6_pcie_probe(struct platform_device *pdev)
 
        imx6_pcie->vpcie = devm_regulator_get_optional(&pdev->dev, "vpcie");
        if (IS_ERR(imx6_pcie->vpcie)) {
-               if (PTR_ERR(imx6_pcie->vpcie) == -EPROBE_DEFER)
-                       return -EPROBE_DEFER;
+               if (PTR_ERR(imx6_pcie->vpcie) != -ENODEV)
+                       return PTR_ERR(imx6_pcie->vpcie);
                imx6_pcie->vpcie = NULL;
        }
 
diff --git a/drivers/pci/controller/dwc/pcie-histb.c 
b/drivers/pci/controller/dwc/pcie-histb.c
index 7b32e619b959..a3489839a8fc 100644
--- a/drivers/pci/controller/dwc/pcie-histb.c
+++ b/drivers/pci/controller/dwc/pcie-histb.c
@@ -340,8 +340,8 @@ static int histb_pcie_probe(struct platform_device *pdev)
 
        hipcie->vpcie = devm_regulator_get_optional(dev, "vpcie");
        if (IS_ERR(hipcie->vpcie)) {
-               if (PTR_ERR(hipcie->vpcie) == -EPROBE_DEFER)
-                       return -EPROBE_DEFER;
+               if (PTR_ERR(hipcie->vpcie) != -ENODEV)
+                       return PTR_ERR(hipcie->vpcie);
                hipcie->vpcie = NULL;
        }
 
diff --git a/drivers/pci/controller/pci-tegra.c 
b/drivers/pci/controller/pci-tegra.c
index f4f53d092e00..976eaa9a9f26 100644
--- a/drivers/pci/controller/pci-tegra.c
+++ b/drivers/pci/controller/pci-tegra.c
@@ -1975,14 +1975,15 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
                err = of_pci_get_devfn(port);
                if (err < 0) {
                        dev_err(dev, "failed to parse address: %d\n", err);
-                       return err;
+                       goto err_node_put;
                }
 
                index = PCI_SLOT(err);
 
                if (index < 1 || index > soc->num_ports) {
                        dev_err(dev, "invalid port number: %d\n", index);
-                       return -EINVAL;
+                       err = -EINVAL;
+                       goto err_node_put;
                }
 
                index--;
@@ -1991,12 +1992,13 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
                if (err < 0) {
                        dev_err(dev, "failed to parse # of lanes: %d\n",
                                err);
-                       return err;
+                       goto err_node_put;
                }
 
                if (value > 16) {
                        dev_err(dev, "invalid # of lanes: %u\n", value);
-                       return -EINVAL;
+                       err = -EINVAL;
+                       goto err_node_put;
                }
 
                lanes |= value << (index << 3);
@@ -2010,13 +2012,15 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
                lane += value;
 
                rp = devm_kzalloc(dev, sizeof(*rp), GFP_KERNEL);
-               if (!rp)
-                       return -ENOMEM;
+               if (!rp) {
+                       err = -ENOMEM;
+                       goto err_node_put;
+               }
 
                err = of_address_to_resource(port, 0, &rp->regs);
                if (err < 0) {
                        dev_err(dev, "failed to parse address: %d\n", err);
-                       return err;
+                       goto err_node_put;
                }
 
                INIT_LIST_HEAD(&rp->list);
@@ -2043,6 +2047,10 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
                return err;
 
        return 0;
+
+err_node_put:
+       of_node_put(port);
+       return err;
 }
 
 /*
diff --git a/drivers/pci/controller/pcie-rockchip-host.c 
b/drivers/pci/controller/pcie-rockchip-host.c
index 1372d270764f..5ce8e6375687 100644
--- a/drivers/pci/controller/pcie-rockchip-host.c
+++ b/drivers/pci/controller/pcie-rockchip-host.c
@@ -608,29 +608,29 @@ static int rockchip_pcie_parse_host_dt(struct 
rockchip_pcie *rockchip)
 
        rockchip->vpcie12v = devm_regulator_get_optional(dev, "vpcie12v");
        if (IS_ERR(rockchip->vpcie12v)) {
-               if (PTR_ERR(rockchip->vpcie12v) == -EPROBE_DEFER)
-                       return -EPROBE_DEFER;
+               if (PTR_ERR(rockchip->vpcie12v) != -ENODEV)
+                       return PTR_ERR(rockchip->vpcie12v);
                dev_info(dev, "no vpcie12v regulator found\n");
        }
 
        rockchip->vpcie3v3 = devm_regulator_get_optional(dev, "vpcie3v3");
        if (IS_ERR(rockchip->vpcie3v3)) {
-               if (PTR_ERR(rockchip->vpcie3v3) == -EPROBE_DEFER)
-                       return -EPROBE_DEFER;
+               if (PTR_ERR(rockchip->vpcie3v3) != -ENODEV)
+                       return PTR_ERR(rockchip->vpcie3v3);
                dev_info(dev, "no vpcie3v3 regulator found\n");
        }
 
        rockchip->vpcie1v8 = devm_regulator_get_optional(dev, "vpcie1v8");
        if (IS_ERR(rockchip->vpcie1v8)) {
-               if (PTR_ERR(rockchip->vpcie1v8) == -EPROBE_DEFER)
-                       return -EPROBE_DEFER;
+               if (PTR_ERR(rockchip->vpcie1v8) != -ENODEV)
+                       return PTR_ERR(rockchip->vpcie1v8);
                dev_info(dev, "no vpcie1v8 regulator found\n");
        }
 
        rockchip->vpcie0v9 = devm_regulator_get_optional(dev, "vpcie0v9");
        if (IS_ERR(rockchip->vpcie0v9)) {
-               if (PTR_ERR(rockchip->vpcie0v9) == -EPROBE_DEFER)
-                       return -EPROBE_DEFER;
+               if (PTR_ERR(rockchip->vpcie0v9) != -ENODEV)
+                       return PTR_ERR(rockchip->vpcie0v9);
                dev_info(dev, "no vpcie0v9 regulator found\n");
        }
 
diff --git a/drivers/pci/hotplug/rpaphp_core.c 
b/drivers/pci/hotplug/rpaphp_core.c
index 857c358b727b..cc860c5f7d26 100644
--- a/drivers/pci/hotplug/rpaphp_core.c
+++ b/drivers/pci/hotplug/rpaphp_core.c
@@ -230,7 +230,7 @@ static int rpaphp_check_drc_props_v2(struct device_node 
*dn, char *drc_name,
        struct of_drc_info drc;
        const __be32 *value;
        char cell_drc_name[MAX_DRC_NAME_LEN];
-       int j, fndit;
+       int j;
 
        info = of_find_property(dn->parent, "ibm,drc-info", NULL);
        if (info == NULL)
@@ -245,17 +245,13 @@ static int rpaphp_check_drc_props_v2(struct device_node 
*dn, char *drc_name,
 
                /* Should now know end of current entry */
 
-               if (my_index > drc.last_drc_index)
-                       continue;
-
-               fndit = 1;
-               break;
+               /* Found it */
+               if (my_index <= drc.last_drc_index) {
+                       sprintf(cell_drc_name, "%s%d", drc.drc_name_prefix,
+                               my_index);
+                       break;
+               }
        }
-       /* Found it */
-
-       if (fndit)
-               sprintf(cell_drc_name, "%s%d", drc.drc_name_prefix, 
-                       my_index);
 
        if (((drc_name == NULL) ||
             (drc_name && !strcmp(drc_name, cell_drc_name))) &&
diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c 
b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
index 4edeb4cae72a..c4c70dc57dbe 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
@@ -198,8 +198,8 @@ static const unsigned int uart_rts_b_pins[] = { GPIODV_27 };
 
 static const unsigned int uart_tx_c_pins[]     = { GPIOY_13 };
 static const unsigned int uart_rx_c_pins[]     = { GPIOY_14 };
-static const unsigned int uart_cts_c_pins[]    = { GPIOX_11 };
-static const unsigned int uart_rts_c_pins[]    = { GPIOX_12 };
+static const unsigned int uart_cts_c_pins[]    = { GPIOY_11 };
+static const unsigned int uart_rts_c_pins[]    = { GPIOY_12 };
 
 static const unsigned int i2c_sck_a_pins[]     = { GPIODV_25 };
 static const unsigned int i2c_sda_a_pins[]     = { GPIODV_24 };
@@ -445,10 +445,10 @@ static struct meson_pmx_group meson_gxbb_periphs_groups[] 
= {
        GROUP(pwm_f_x,          3,      18),
 
        /* Bank Y */
-       GROUP(uart_cts_c,       1,      19),
-       GROUP(uart_rts_c,       1,      18),
-       GROUP(uart_tx_c,        1,      17),
-       GROUP(uart_rx_c,        1,      16),
+       GROUP(uart_cts_c,       1,      17),
+       GROUP(uart_rts_c,       1,      16),
+       GROUP(uart_tx_c,        1,      19),
+       GROUP(uart_rx_c,        1,      18),
        GROUP(pwm_a_y,          1,      21),
        GROUP(pwm_f_y,          1,      20),
        GROUP(i2s_out_ch23_y,   1,      5),
diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
index 1425c2874d40..cd7a5d95b499 100644
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -569,15 +569,25 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void 
*dev_id)
                            !(regval & BIT(INTERRUPT_MASK_OFF)))
                                continue;
                        irq = irq_find_mapping(gc->irq.domain, irqnr + i);
-                       generic_handle_irq(irq);
+                       if (irq != 0)
+                               generic_handle_irq(irq);
 
                        /* Clear interrupt.
                         * We must read the pin register again, in case the
                         * value was changed while executing
                         * generic_handle_irq() above.
+                        * If we didn't find a mapping for the interrupt,
+                        * disable it in order to avoid a system hang caused
+                        * by an interrupt storm.
                         */
                        raw_spin_lock_irqsave(&gpio_dev->lock, flags);
                        regval = readl(regs + i);
+                       if (irq == 0) {
+                               regval &= ~BIT(INTERRUPT_ENABLE_OFF);
+                               dev_dbg(&gpio_dev->pdev->dev,
+                                       "Disabling spurious GPIO IRQ %d\n",
+                                       irqnr + i);
+                       }
                        writel(regval, regs + i);
                        raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
                        ret = IRQ_HANDLED;
diff --git a/drivers/pinctrl/tegra/pinctrl-tegra.c 
b/drivers/pinctrl/tegra/pinctrl-tegra.c
index 1aba75897d14..26a3f1eb9c6b 100644
--- a/drivers/pinctrl/tegra/pinctrl-tegra.c
+++ b/drivers/pinctrl/tegra/pinctrl-tegra.c
@@ -40,7 +40,9 @@ static inline u32 pmx_readl(struct tegra_pmx *pmx, u32 bank, 
u32 reg)
 
 static inline void pmx_writel(struct tegra_pmx *pmx, u32 val, u32 bank, u32 
reg)
 {
-       writel(val, pmx->regs[bank] + reg);
+       writel_relaxed(val, pmx->regs[bank] + reg);
+       /* make sure pinmux register write completed */
+       pmx_readl(pmx, bank, reg);
 }
 
 static int tegra_pinctrl_get_groups_count(struct pinctrl_dev *pctldev)
diff --git a/drivers/rtc/rtc-pcf85363.c b/drivers/rtc/rtc-pcf85363.c
index c04a1edcd571..c3702684b342 100644
--- a/drivers/rtc/rtc-pcf85363.c
+++ b/drivers/rtc/rtc-pcf85363.c
@@ -169,7 +169,12 @@ static int pcf85363_rtc_set_time(struct device *dev, 
struct rtc_time *tm)
        buf[DT_YEARS] = bin2bcd(tm->tm_year % 100);
 
        ret = regmap_bulk_write(pcf85363->regmap, CTRL_STOP_EN,
-                               tmp, sizeof(tmp));
+                               tmp, 2);
+       if (ret)
+               return ret;
+
+       ret = regmap_bulk_write(pcf85363->regmap, DT_100THS,
+                               buf, sizeof(tmp) - 2);
        if (ret)
                return ret;
 
diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c
index b2483a749ac4..3cf011e12053 100644
--- a/drivers/rtc/rtc-snvs.c
+++ b/drivers/rtc/rtc-snvs.c
@@ -273,6 +273,10 @@ static int snvs_rtc_probe(struct platform_device *pdev)
        if (!data)
                return -ENOMEM;
 
+       data->rtc = devm_rtc_allocate_device(&pdev->dev);
+       if (IS_ERR(data->rtc))
+               return PTR_ERR(data->rtc);
+
        data->regmap = syscon_regmap_lookup_by_phandle(pdev->dev.of_node, 
"regmap");
 
        if (IS_ERR(data->regmap)) {
@@ -335,10 +339,9 @@ static int snvs_rtc_probe(struct platform_device *pdev)
                goto error_rtc_device_register;
        }
 
-       data->rtc = devm_rtc_device_register(&pdev->dev, pdev->name,
-                                       &snvs_rtc_ops, THIS_MODULE);
-       if (IS_ERR(data->rtc)) {
-               ret = PTR_ERR(data->rtc);
+       data->rtc->ops = &snvs_rtc_ops;
+       ret = rtc_register_device(data->rtc);
+       if (ret) {
                dev_err(&pdev->dev, "failed to register rtc: %d\n", ret);
                goto error_rtc_device_register;
        }
diff --git a/drivers/scsi/scsi_logging.c b/drivers/scsi/scsi_logging.c
index bd70339c1242..03d9855a6afd 100644
--- a/drivers/scsi/scsi_logging.c
+++ b/drivers/scsi/scsi_logging.c
@@ -16,57 +16,15 @@
 #include <scsi/scsi_eh.h>
 #include <scsi/scsi_dbg.h>
 
-#define SCSI_LOG_SPOOLSIZE 4096
-
-#if (SCSI_LOG_SPOOLSIZE / SCSI_LOG_BUFSIZE) > BITS_PER_LONG
-#warning SCSI logging bitmask too large
-#endif
-
-struct scsi_log_buf {
-       char buffer[SCSI_LOG_SPOOLSIZE];
-       unsigned long map;
-};
-
-static DEFINE_PER_CPU(struct scsi_log_buf, scsi_format_log);
-
 static char *scsi_log_reserve_buffer(size_t *len)
 {
-       struct scsi_log_buf *buf;
-       unsigned long map_bits = sizeof(buf->buffer) / SCSI_LOG_BUFSIZE;
-       unsigned long idx = 0;
-
-       preempt_disable();
-       buf = this_cpu_ptr(&scsi_format_log);
-       idx = find_first_zero_bit(&buf->map, map_bits);
-       if (likely(idx < map_bits)) {
-               while (test_and_set_bit(idx, &buf->map)) {
-                       idx = find_next_zero_bit(&buf->map, map_bits, idx);
-                       if (idx >= map_bits)
-                               break;
-               }
-       }
-       if (WARN_ON(idx >= map_bits)) {
-               preempt_enable();
-               return NULL;
-       }
-       *len = SCSI_LOG_BUFSIZE;
-       return buf->buffer + idx * SCSI_LOG_BUFSIZE;
+       *len = 128;
+       return kmalloc(*len, GFP_ATOMIC);
 }
 
 static void scsi_log_release_buffer(char *bufptr)
 {
-       struct scsi_log_buf *buf;
-       unsigned long idx;
-       int ret;
-
-       buf = this_cpu_ptr(&scsi_format_log);
-       if (bufptr >= buf->buffer &&
-           bufptr < buf->buffer + SCSI_LOG_SPOOLSIZE) {
-               idx = (bufptr - buf->buffer) / SCSI_LOG_BUFSIZE;
-               ret = test_and_clear_bit(idx, &buf->map);
-               WARN_ON(!ret);
-       }
-       preempt_enable();
+       kfree(bufptr);
 }
 
 static inline const char *scmd_name(const struct scsi_cmnd *scmd)
diff --git a/drivers/soundwire/Kconfig b/drivers/soundwire/Kconfig
index 19c8efb9a5ee..1ba1556f1987 100644
--- a/drivers/soundwire/Kconfig
+++ b/drivers/soundwire/Kconfig
@@ -3,8 +3,8 @@
 #
 
 menuconfig SOUNDWIRE
-       bool "SoundWire support"
-       ---help---
+       tristate "SoundWire support"
+       help
          SoundWire is a 2-Pin interface with data and clock line ratified
          by the MIPI Alliance. SoundWire is used for transporting data
          typically related to audio functions. SoundWire interface is
@@ -16,17 +16,12 @@ if SOUNDWIRE
 
 comment "SoundWire Devices"
 
-config SOUNDWIRE_BUS
-       tristate
-       select REGMAP_SOUNDWIRE
-
 config SOUNDWIRE_CADENCE
        tristate
 
 config SOUNDWIRE_INTEL
        tristate "Intel SoundWire Master driver"
        select SOUNDWIRE_CADENCE
-       select SOUNDWIRE_BUS
        depends on X86 && ACPI && SND_SOC
        ---help---
          SoundWire Intel Master driver.
diff --git a/drivers/soundwire/Makefile b/drivers/soundwire/Makefile
index 5817beaca0e1..1e2c00163142 100644
--- a/drivers/soundwire/Makefile
+++ b/drivers/soundwire/Makefile
@@ -4,7 +4,7 @@
 
 #Bus Objs
 soundwire-bus-objs := bus_type.o bus.o slave.o mipi_disco.o stream.o
-obj-$(CONFIG_SOUNDWIRE_BUS) += soundwire-bus.o
+obj-$(CONFIG_SOUNDWIRE) += soundwire-bus.o
 
 #Cadence Objs
 soundwire-cadence-objs := cadence_master.o
diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
index a6e2581ada70..29bc99c4a7b6 100644
--- a/drivers/soundwire/intel.c
+++ b/drivers/soundwire/intel.c
@@ -282,6 +282,16 @@ intel_pdi_get_ch_cap(struct sdw_intel *sdw, unsigned int 
pdi_num, bool pcm)
 
        if (pcm) {
                count = intel_readw(shim, SDW_SHIM_PCMSYCHC(link_id, pdi_num));
+
+               /*
+                * WORKAROUND: on all existing Intel controllers, pdi
+                * number 2 reports channel count as 1 even though it
+                * supports 8 channels. Performing hardcoding for pdi
+                * number 2.
+                */
+               if (pdi_num == 2)
+                       count = 7;
+
        } else {
                count = intel_readw(shim, SDW_SHIM_PDMSCAP(link_id));
                count = ((count & SDW_SHIM_PDMSCAP_CPSS) >>
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 6cf00d9f512b..a92c2868d902 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -373,11 +373,20 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev)
        pci_write_config_word(pdev, PCI_COMMAND, PCI_COMMAND_INTX_DISABLE);
 
        /*
-        * Try to reset the device.  The success of this is dependent on
-        * being able to lock the device, which is not always possible.
+        * Try to get the locks ourselves to prevent a deadlock. The
+        * success of this is dependent on being able to lock the device,
+        * which is not always possible.
+        * We can not use the "try" reset interface here, which will
+        * overwrite the previously restored configuration information.
         */
-       if (vdev->reset_works && !pci_try_reset_function(pdev))
-               vdev->needs_reset = false;
+       if (vdev->reset_works && pci_cfg_access_trylock(pdev)) {
+               if (device_trylock(&pdev->dev)) {
+                       if (!__pci_reset_function_locked(pdev))
+                               vdev->needs_reset = false;
+                       device_unlock(&pdev->dev);
+               }
+               pci_cfg_access_unlock(pdev);
+       }
 
        pci_restore_state(pdev);
 out:
diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index 6439231f2db2..da565f39c9b0 100644
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
@@ -433,7 +433,7 @@ static int ssd1307fb_init(struct ssd1307fb_par *par)
        if (ret < 0)
                return ret;
 
-       ret = ssd1307fb_write_cmd(par->client, 0x0);
+       ret = ssd1307fb_write_cmd(par->client, par->page_offset);
        if (ret < 0)
                return ret;
 
diff --git a/fs/9p/cache.c b/fs/9p/cache.c
index 9eb34701a566..a43a8d2436db 100644
--- a/fs/9p/cache.c
+++ b/fs/9p/cache.c
@@ -66,6 +66,8 @@ void v9fs_cache_session_get_cookie(struct v9fs_session_info 
*v9ses)
        if (!v9ses->cachetag) {
                if (v9fs_random_cachetag(v9ses) < 0) {
                        v9ses->fscache = NULL;
+                       kfree(v9ses->cachetag);
+                       v9ses->cachetag = NULL;
                        return;
                }
        }
diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
index e8e27cdc2f67..7edc8172c53a 100644
--- a/fs/ext4/block_validity.c
+++ b/fs/ext4/block_validity.c
@@ -38,6 +38,7 @@ int __init ext4_init_system_zone(void)
 
 void ext4_exit_system_zone(void)
 {
+       rcu_barrier();
        kmem_cache_destroy(ext4_system_zone_cachep);
 }
 
@@ -49,17 +50,26 @@ static inline int can_merge(struct ext4_system_zone *entry1,
        return 0;
 }
 
+static void release_system_zone(struct ext4_system_blocks *system_blks)
+{
+       struct ext4_system_zone *entry, *n;
+
+       rbtree_postorder_for_each_entry_safe(entry, n,
+                               &system_blks->root, node)
+               kmem_cache_free(ext4_system_zone_cachep, entry);
+}
+
 /*
  * Mark a range of blocks as belonging to the "system zone" --- that
  * is, filesystem metadata blocks which should never be used by
  * inodes.
  */
-static int add_system_zone(struct ext4_sb_info *sbi,
+static int add_system_zone(struct ext4_system_blocks *system_blks,
                           ext4_fsblk_t start_blk,
                           unsigned int count)
 {
        struct ext4_system_zone *new_entry = NULL, *entry;
-       struct rb_node **n = &sbi->system_blks.rb_node, *node;
+       struct rb_node **n = &system_blks->root.rb_node, *node;
        struct rb_node *parent = NULL, *new_node = NULL;
 
        while (*n) {
@@ -91,7 +101,7 @@ static int add_system_zone(struct ext4_sb_info *sbi,
                new_node = &new_entry->node;
 
                rb_link_node(new_node, parent, n);
-               rb_insert_color(new_node, &sbi->system_blks);
+               rb_insert_color(new_node, &system_blks->root);
        }
 
        /* Can we merge to the left? */
@@ -101,7 +111,7 @@ static int add_system_zone(struct ext4_sb_info *sbi,
                if (can_merge(entry, new_entry)) {
                        new_entry->start_blk = entry->start_blk;
                        new_entry->count += entry->count;
-                       rb_erase(node, &sbi->system_blks);
+                       rb_erase(node, &system_blks->root);
                        kmem_cache_free(ext4_system_zone_cachep, entry);
                }
        }
@@ -112,7 +122,7 @@ static int add_system_zone(struct ext4_sb_info *sbi,
                entry = rb_entry(node, struct ext4_system_zone, node);
                if (can_merge(new_entry, entry)) {
                        new_entry->count += entry->count;
-                       rb_erase(node, &sbi->system_blks);
+                       rb_erase(node, &system_blks->root);
                        kmem_cache_free(ext4_system_zone_cachep, entry);
                }
        }
@@ -126,7 +136,7 @@ static void debug_print_tree(struct ext4_sb_info *sbi)
        int first = 1;
 
        printk(KERN_INFO "System zones: ");
-       node = rb_first(&sbi->system_blks);
+       node = rb_first(&sbi->system_blks->root);
        while (node) {
                entry = rb_entry(node, struct ext4_system_zone, node);
                printk(KERN_CONT "%s%llu-%llu", first ? "" : ", ",
@@ -137,7 +147,47 @@ static void debug_print_tree(struct ext4_sb_info *sbi)
        printk(KERN_CONT "\n");
 }
 
-static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino)
+/*
+ * Returns 1 if the passed-in block region (start_blk,
+ * start_blk+count) is valid; 0 if some part of the block region
+ * overlaps with filesystem metadata blocks.
+ */
+static int ext4_data_block_valid_rcu(struct ext4_sb_info *sbi,
+                                    struct ext4_system_blocks *system_blks,
+                                    ext4_fsblk_t start_blk,
+                                    unsigned int count)
+{
+       struct ext4_system_zone *entry;
+       struct rb_node *n;
+
+       if ((start_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) ||
+           (start_blk + count < start_blk) ||
+           (start_blk + count > ext4_blocks_count(sbi->s_es))) {
+               sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
+               return 0;
+       }
+
+       if (system_blks == NULL)
+               return 1;
+
+       n = system_blks->root.rb_node;
+       while (n) {
+               entry = rb_entry(n, struct ext4_system_zone, node);
+               if (start_blk + count - 1 < entry->start_blk)
+                       n = n->rb_left;
+               else if (start_blk >= (entry->start_blk + entry->count))
+                       n = n->rb_right;
+               else {
+                       sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
+                       return 0;
+               }
+       }
+       return 1;
+}
+
+static int ext4_protect_reserved_inode(struct super_block *sb,
+                                      struct ext4_system_blocks *system_blks,
+                                      u32 ino)
 {
        struct inode *inode;
        struct ext4_sb_info *sbi = EXT4_SB(sb);
@@ -163,14 +213,15 @@ static int ext4_protect_reserved_inode(struct super_block 
*sb, u32 ino)
                if (n == 0) {
                        i++;
                } else {
-                       if (!ext4_data_block_valid(sbi, map.m_pblk, n)) {
+                       if (!ext4_data_block_valid_rcu(sbi, system_blks,
+                                               map.m_pblk, n)) {
                                ext4_error(sb, "blocks %llu-%llu from inode %u "
                                           "overlap system zone", map.m_pblk,
                                           map.m_pblk + map.m_len - 1, ino);
                                err = -EFSCORRUPTED;
                                break;
                        }
-                       err = add_system_zone(sbi, map.m_pblk, n);
+                       err = add_system_zone(system_blks, map.m_pblk, n);
                        if (err < 0)
                                break;
                        i += n;
@@ -180,93 +231,129 @@ static int ext4_protect_reserved_inode(struct 
super_block *sb, u32 ino)
        return err;
 }
 
+static void ext4_destroy_system_zone(struct rcu_head *rcu)
+{
+       struct ext4_system_blocks *system_blks;
+
+       system_blks = container_of(rcu, struct ext4_system_blocks, rcu);
+       release_system_zone(system_blks);
+       kfree(system_blks);
+}
+
+/*
+ * Build system zone rbtree which is used for block validity checking.
+ *
+ * The update of system_blks pointer in this function is protected by
+ * sb->s_umount semaphore. However we have to be careful as we can be
+ * racing with ext4_data_block_valid() calls reading system_blks rbtree
+ * protected only by RCU. That's why we first build the rbtree and then
+ * swap it in place.
+ */
 int ext4_setup_system_zone(struct super_block *sb)
 {
        ext4_group_t ngroups = ext4_get_groups_count(sb);
        struct ext4_sb_info *sbi = EXT4_SB(sb);
+       struct ext4_system_blocks *system_blks;
        struct ext4_group_desc *gdp;
        ext4_group_t i;
        int flex_size = ext4_flex_bg_size(sbi);
        int ret;
 
        if (!test_opt(sb, BLOCK_VALIDITY)) {
-               if (sbi->system_blks.rb_node)
+               if (sbi->system_blks)
                        ext4_release_system_zone(sb);
                return 0;
        }
-       if (sbi->system_blks.rb_node)
+       if (sbi->system_blks)
                return 0;
 
+       system_blks = kzalloc(sizeof(*system_blks), GFP_KERNEL);
+       if (!system_blks)
+               return -ENOMEM;
+
        for (i=0; i < ngroups; i++) {
                if (ext4_bg_has_super(sb, i) &&
                    ((i < 5) || ((i % flex_size) == 0)))
-                       add_system_zone(sbi, ext4_group_first_block_no(sb, i),
+                       add_system_zone(system_blks,
+                                       ext4_group_first_block_no(sb, i),
                                        ext4_bg_num_gdb(sb, i) + 1);
                gdp = ext4_get_group_desc(sb, i, NULL);
-               ret = add_system_zone(sbi, ext4_block_bitmap(sb, gdp), 1);
+               ret = add_system_zone(system_blks,
+                               ext4_block_bitmap(sb, gdp), 1);
                if (ret)
-                       return ret;
-               ret = add_system_zone(sbi, ext4_inode_bitmap(sb, gdp), 1);
+                       goto err;
+               ret = add_system_zone(system_blks,
+                               ext4_inode_bitmap(sb, gdp), 1);
                if (ret)
-                       return ret;
-               ret = add_system_zone(sbi, ext4_inode_table(sb, gdp),
+                       goto err;
+               ret = add_system_zone(system_blks,
+                               ext4_inode_table(sb, gdp),
                                sbi->s_itb_per_group);
                if (ret)
-                       return ret;
+                       goto err;
        }
        if (ext4_has_feature_journal(sb) && sbi->s_es->s_journal_inum) {
-               ret = ext4_protect_reserved_inode(sb,
+               ret = ext4_protect_reserved_inode(sb, system_blks,
                                le32_to_cpu(sbi->s_es->s_journal_inum));
                if (ret)
-                       return ret;
+                       goto err;
        }
 
+       /*
+        * System blks rbtree complete, announce it once to prevent racing
+        * with ext4_data_block_valid() accessing the rbtree at the same
+        * time.
+        */
+       rcu_assign_pointer(sbi->system_blks, system_blks);
+
        if (test_opt(sb, DEBUG))
                debug_print_tree(sbi);
        return 0;
+err:
+       release_system_zone(system_blks);
+       kfree(system_blks);
+       return ret;
 }
 
-/* Called when the filesystem is unmounted */
+/*
+ * Called when the filesystem is unmounted or when remounting it with
+ * noblock_validity specified.
+ *
+ * The update of system_blks pointer in this function is protected by
+ * sb->s_umount semaphore. However we have to be careful as we can be
+ * racing with ext4_data_block_valid() calls reading system_blks rbtree
+ * protected only by RCU. So we first clear the system_blks pointer and
+ * then free the rbtree only after RCU grace period expires.
+ */
 void ext4_release_system_zone(struct super_block *sb)
 {
-       struct ext4_system_zone *entry, *n;
+       struct ext4_system_blocks *system_blks;
 
-       rbtree_postorder_for_each_entry_safe(entry, n,
-                       &EXT4_SB(sb)->system_blks, node)
-               kmem_cache_free(ext4_system_zone_cachep, entry);
+       system_blks = rcu_dereference_protected(EXT4_SB(sb)->system_blks,
+                                       lockdep_is_held(&sb->s_umount));
+       rcu_assign_pointer(EXT4_SB(sb)->system_blks, NULL);
 
-       EXT4_SB(sb)->system_blks = RB_ROOT;
+       if (system_blks)
+               call_rcu(&system_blks->rcu, ext4_destroy_system_zone);
 }
 
-/*
- * Returns 1 if the passed-in block region (start_blk,
- * start_blk+count) is valid; 0 if some part of the block region
- * overlaps with filesystem metadata blocks.
- */
 int ext4_data_block_valid(struct ext4_sb_info *sbi, ext4_fsblk_t start_blk,
                          unsigned int count)
 {
-       struct ext4_system_zone *entry;
-       struct rb_node *n = sbi->system_blks.rb_node;
+       struct ext4_system_blocks *system_blks;
+       int ret;
 
-       if ((start_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) ||
-           (start_blk + count < start_blk) ||
-           (start_blk + count > ext4_blocks_count(sbi->s_es))) {
-               sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
-               return 0;
-       }
-       while (n) {
-               entry = rb_entry(n, struct ext4_system_zone, node);
-               if (start_blk + count - 1 < entry->start_blk)
-                       n = n->rb_left;
-               else if (start_blk >= (entry->start_blk + entry->count))
-                       n = n->rb_right;
-               else {
-                       sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
-                       return 0;
-               }
-       }
-       return 1;
+       /*
+        * Lock the system zone to prevent it being released concurrently
+        * when doing a remount which inverse current "[no]block_validity"
+        * mount option.
+        */
+       rcu_read_lock();
+       system_blks = rcu_dereference(sbi->system_blks);
+       ret = ext4_data_block_valid_rcu(sbi, system_blks, start_blk,
+                                       count);
+       rcu_read_unlock();
+       return ret;
 }
 
 int ext4_check_blockref(const char *function, unsigned int line,
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 1ee51d3a978a..f8456a423c4e 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -194,6 +194,14 @@ struct ext4_map_blocks {
        unsigned int m_flags;
 };
 
+/*
+ * Block validity checking, system zone rbtree.
+ */
+struct ext4_system_blocks {
+       struct rb_root root;
+       struct rcu_head rcu;
+};
+
 /*
  * Flags for ext4_io_end->flags
  */
@@ -1409,7 +1417,7 @@ struct ext4_sb_info {
        int s_jquota_fmt;                       /* Format of quota to use */
 #endif
        unsigned int s_want_extra_isize; /* New inodes should reserve # bytes */
-       struct rb_root system_blks;
+       struct ext4_system_blocks __rcu *system_blks;
 
 #ifdef EXTENTS_STATS
        /* ext4 extents stats */
diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index 7f5f3699fc6c..de60c05c0ca1 100644
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -1097,8 +1097,11 @@ static int fat_zeroed_cluster(struct inode *dir, 
sector_t blknr, int nr_used,
                        err = -ENOMEM;
                        goto error;
                }
+               /* Avoid race with userspace read via bdev */
+               lock_buffer(bhs[n]);
                memset(bhs[n]->b_data, 0, sb->s_blocksize);
                set_buffer_uptodate(bhs[n]);
+               unlock_buffer(bhs[n]);
                mark_buffer_dirty_inode(bhs[n], dir);
 
                n++;
@@ -1155,6 +1158,8 @@ int fat_alloc_new_dir(struct inode *dir, struct 
timespec64 *ts)
        fat_time_unix2fat(sbi, ts, &time, &date, &time_cs);
 
        de = (struct msdos_dir_entry *)bhs[0]->b_data;
+       /* Avoid race with userspace read via bdev */
+       lock_buffer(bhs[0]);
        /* filling the new directory slots ("." and ".." entries) */
        memcpy(de[0].name, MSDOS_DOT, MSDOS_NAME);
        memcpy(de[1].name, MSDOS_DOTDOT, MSDOS_NAME);
@@ -1177,6 +1182,7 @@ int fat_alloc_new_dir(struct inode *dir, struct 
timespec64 *ts)
        de[0].size = de[1].size = 0;
        memset(de + 2, 0, sb->s_blocksize - 2 * sizeof(*de));
        set_buffer_uptodate(bhs[0]);
+       unlock_buffer(bhs[0]);
        mark_buffer_dirty_inode(bhs[0], dir);
 
        err = fat_zeroed_cluster(dir, blknr, 1, bhs, MAX_BUF_PER_PAGE);
@@ -1234,11 +1240,14 @@ static int fat_add_new_entries(struct inode *dir, void 
*slots, int nr_slots,
 
                        /* fill the directory entry */
                        copy = min(size, sb->s_blocksize);
+                       /* Avoid race with userspace read via bdev */
+                       lock_buffer(bhs[n]);
                        memcpy(bhs[n]->b_data, slots, copy);
-                       slots += copy;
-                       size -= copy;
                        set_buffer_uptodate(bhs[n]);
+                       unlock_buffer(bhs[n]);
                        mark_buffer_dirty_inode(bhs[n], dir);
+                       slots += copy;
+                       size -= copy;
                        if (!size)
                                break;
                        n++;
diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c
index f58c0cacc531..4c6c635bc8aa 100644
--- a/fs/fat/fatent.c
+++ b/fs/fat/fatent.c
@@ -390,8 +390,11 @@ static int fat_mirror_bhs(struct super_block *sb, struct 
buffer_head **bhs,
                                err = -ENOMEM;
                                goto error;
                        }
+                       /* Avoid race with userspace read via bdev */
+                       lock_buffer(c_bh);
                        memcpy(c_bh->b_data, bhs[n]->b_data, sb->s_blocksize);
                        set_buffer_uptodate(c_bh);
+                       unlock_buffer(c_bh);
                        mark_buffer_dirty_inode(c_bh, sbi->fat_inode);
                        if (sb->s_flags & SB_SYNCHRONOUS)
                                err = sync_dirty_buffer(c_bh);
diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
index 63d701cd1e2e..c8e9b7031d9a 100644
--- a/fs/ocfs2/dlm/dlmunlock.c
+++ b/fs/ocfs2/dlm/dlmunlock.c
@@ -105,7 +105,8 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt 
*dlm,
        enum dlm_status status;
        int actions = 0;
        int in_use;
-        u8 owner;
+       u8 owner;
+       int recovery_wait = 0;
 
        mlog(0, "master_node = %d, valblk = %d\n", master_node,
             flags & LKM_VALBLK);
@@ -208,9 +209,12 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt 
*dlm,
                }
                if (flags & LKM_CANCEL)
                        lock->cancel_pending = 0;
-               else
-                       lock->unlock_pending = 0;
-
+               else {
+                       if (!lock->unlock_pending)
+                               recovery_wait = 1;
+                       else
+                               lock->unlock_pending = 0;
+               }
        }
 
        /* get an extra ref on lock.  if we are just switching
@@ -244,6 +248,17 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt 
*dlm,
        spin_unlock(&res->spinlock);
        wake_up(&res->wq);
 
+       if (recovery_wait) {
+               spin_lock(&res->spinlock);
+               /* Unlock request will directly succeed after owner dies,
+                * and the lock is already removed from grant list. We have to
+                * wait for RECOVERING done or we miss the chance to purge it
+                * since the removement is much faster than RECOVERING proc.
+                */
+               __dlm_wait_on_lockres_flags(res, DLM_LOCK_RES_RECOVERING);
+               spin_unlock(&res->spinlock);
+       }
+
        /* let the caller's final dlm_lock_put handle the actual kfree */
        if (actions & DLM_UNLOCK_FREE_LOCK) {
                /* this should always be coupled with list removal */
diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
index 316c16463b20..015d74ee31a0 100644
--- a/fs/pstore/ram.c
+++ b/fs/pstore/ram.c
@@ -162,6 +162,7 @@ static int ramoops_read_kmsg_hdr(char *buffer, struct 
timespec64 *time,
        if (sscanf(buffer, RAMOOPS_KERNMSG_HDR "%lld.%lu-%c\n%n",
                   (time64_t *)&time->tv_sec, &time->tv_nsec, &data_type,
                   &header_length) == 3) {
+               time->tv_nsec *= 1000;
                if (data_type == 'C')
                        *compressed = true;
                else
@@ -169,6 +170,7 @@ static int ramoops_read_kmsg_hdr(char *buffer, struct 
timespec64 *time,
        } else if (sscanf(buffer, RAMOOPS_KERNMSG_HDR "%lld.%lu\n%n",
                          (time64_t *)&time->tv_sec, &time->tv_nsec,
                          &header_length) == 2) {
+               time->tv_nsec *= 1000;
                *compressed = false;
        } else {
                time->tv_sec = 0;
diff --git a/include/scsi/scsi_dbg.h b/include/scsi/scsi_dbg.h
index e03bd9d41fa8..7b196d234626 100644
--- a/include/scsi/scsi_dbg.h
+++ b/include/scsi/scsi_dbg.h
@@ -6,8 +6,6 @@ struct scsi_cmnd;
 struct scsi_device;
 struct scsi_sense_hdr;
 
-#define SCSI_LOG_BUFSIZE 128
-
 extern void scsi_print_command(struct scsi_cmnd *);
 extern size_t __scsi_format_command(char *, size_t,
                                   const unsigned char *, size_t);
diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index 815dcfa64743..0fe169c6afd8 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -1073,7 +1073,7 @@ TRACE_EVENT(rxrpc_recvmsg,
                             ),
 
            TP_fast_assign(
-                   __entry->call = call->debug_id;
+                   __entry->call = call ? call->debug_id : 0;
                    __entry->why = why;
                    __entry->seq = seq;
                    __entry->offset = offset;
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 118e3a8fc764..6e544e364821 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1454,19 +1454,25 @@ static int bpf_prog_load(union bpf_attr *attr)
        if (err)
                goto free_used_maps;
 
+       /* Upon success of bpf_prog_alloc_id(), the BPF prog is
+        * effectively publicly exposed. However, retrieving via
+        * bpf_prog_get_fd_by_id() will take another reference,
+        * therefore it cannot be gone underneath us.
+        *
+        * Only for the time /after/ successful bpf_prog_new_fd()
+        * and before returning to userspace, we might just hold
+        * one reference and any parallel close on that fd could
+        * rip everything out. Hence, below notifications must
+        * happen before bpf_prog_new_fd().
+        *
+        * Also, any failure handling from this point onwards must
+        * be using bpf_prog_put() given the program is exposed.
+        */
+       bpf_prog_kallsyms_add(prog);
+
        err = bpf_prog_new_fd(prog);
-       if (err < 0) {
-               /* failed to allocate fd.
-                * bpf_prog_put() is needed because the above
-                * bpf_prog_alloc_id() has published the prog
-                * to the userspace and the userspace may
-                * have refcnt-ed it through BPF_PROG_GET_FD_BY_ID.
-                */
+       if (err < 0)
                bpf_prog_put(prog);
-               return err;
-       }
-
-       bpf_prog_kallsyms_add(prog);
        return err;
 
 free_used_maps:
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index 23a83a4da38a..f50b90d0d1c2 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -301,6 +301,8 @@ static struct page *kimage_alloc_pages(gfp_t gfp_mask, 
unsigned int order)
 {
        struct page *pages;
 
+       if (fatal_signal_pending(current))
+               return NULL;
        pages = alloc_pages(gfp_mask & ~__GFP_ZERO, order);
        if (pages) {
                unsigned int count, i;
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index 722c27c40e5b..a1250ad591c1 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -1027,6 +1027,7 @@ int klp_module_coming(struct module *mod)
        pr_warn("patch '%s' failed for module '%s', refusing to load module 
'%s'\n",
                patch->mod->name, obj->mod->name, obj->mod->name);
        mod->klp_alive = false;
+       obj->mod = NULL;
        klp_cleanup_module_patches_limited(mod, patch);
        mutex_unlock(&klp_mutex);
 
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 3dea52f7be9c..46a910acce3f 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -570,7 +570,7 @@ config DEBUG_KMEMLEAK_EARLY_LOG_SIZE
        int "Maximum kmemleak early log entries"
        depends on DEBUG_KMEMLEAK
        range 200 40000
-       default 400
+       default 16000
        help
          Kmemleak must track all the memory allocations to avoid
          reporting false positives. Since memory may be allocated or
diff --git a/net/core/sock.c b/net/core/sock.c
index 9c32e8eb64da..f881eea1c4a4 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1563,8 +1563,6 @@ static void __sk_destruct(struct rcu_head *head)
                sk_filter_uncharge(sk, filter);
                RCU_INIT_POINTER(sk->sk_filter, NULL);
        }
-       if (rcu_access_pointer(sk->sk_reuseport_cb))
-               reuseport_detach_sock(sk);
 
        sock_disable_timestamp(sk, SK_FLAGS_TIMESTAMP);
 
@@ -1587,7 +1585,14 @@ static void __sk_destruct(struct rcu_head *head)
 
 void sk_destruct(struct sock *sk)
 {
-       if (sock_flag(sk, SOCK_RCU_FREE))
+       bool use_call_rcu = sock_flag(sk, SOCK_RCU_FREE);
+
+       if (rcu_access_pointer(sk->sk_reuseport_cb)) {
+               reuseport_detach_sock(sk);
+               use_call_rcu = true;
+       }
+
+       if (use_call_rcu)
                call_rcu(&sk->sk_rcu, __sk_destruct);
        else
                __sk_destruct(&sk->sk_rcu);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 3c734832bb7c..0b87558f265e 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1531,6 +1531,7 @@ static void erspan_setup(struct net_device *dev)
        struct ip_tunnel *t = netdev_priv(dev);
 
        ether_setup(dev);
+       dev->max_mtu = 0;
        dev->netdev_ops = &erspan_netdev_ops;
        dev->priv_flags &= ~IFF_TX_SKB_SHARING;
        dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 232581c140a0..7065d68086ab 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -908,16 +908,15 @@ void ip_rt_send_redirect(struct sk_buff *skb)
        if (peer->rate_tokens == 0 ||
            time_after(jiffies,
                       (peer->rate_last +
-                       (ip_rt_redirect_load << peer->rate_tokens)))) {
+                       (ip_rt_redirect_load << peer->n_redirects)))) {
                __be32 gw = rt_nexthop(rt, ip_hdr(skb)->daddr);
 
                icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
                peer->rate_last = jiffies;
-               ++peer->rate_tokens;
                ++peer->n_redirects;
 #ifdef CONFIG_IP_ROUTE_VERBOSE
                if (log_martians &&
-                   peer->rate_tokens == ip_rt_redirect_number)
+                   peer->n_redirects == ip_rt_redirect_number)
                        net_warn_ratelimited("host %pI4/if%d ignores redirects 
for %pI4 to %pI4\n",
                                             &ip_hdr(skb)->saddr, inet_iif(skb),
                                             &ip_hdr(skb)->daddr, &gw);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 2085fc0046de..aa59acc8ee0e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -775,6 +775,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 
*fl4,
        int is_udplite = IS_UDPLITE(sk);
        int offset = skb_transport_offset(skb);
        int len = skb->len - offset;
+       int datalen = len - sizeof(*uh);
        __wsum csum = 0;
 
        /*
@@ -808,10 +809,12 @@ static int udp_send_skb(struct sk_buff *skb, struct 
flowi4 *fl4,
                        return -EIO;
                }
 
-               skb_shinfo(skb)->gso_size = cork->gso_size;
-               skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
-               skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(len - sizeof(uh),
-                                                        cork->gso_size);
+               if (datalen > cork->gso_size) {
+                       skb_shinfo(skb)->gso_size = cork->gso_size;
+                       skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
+                       skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(datalen,
+                                                                
cork->gso_size);
+               }
                goto csum_partial;
        }
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 49e2f6dac646..d2968a79abea 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -5678,13 +5678,20 @@ static void __ipv6_ifa_notify(int event, struct 
inet6_ifaddr *ifp)
        switch (event) {
        case RTM_NEWADDR:
                /*
-                * If the address was optimistic
-                * we inserted the route at the start of
-                * our DAD process, so we don't need
-                * to do it again
+                * If the address was optimistic we inserted the route at the
+                * start of our DAD process, so we don't need to do it again.
+                * If the device was taken down in the middle of the DAD
+                * cycle there is a race where we could get here without a
+                * host route, so nothing to insert. That will be fixed when
+                * the device is brought up.
                 */
-               if (!rcu_access_pointer(ifp->rt->fib6_node))
+               if (ifp->rt && !rcu_access_pointer(ifp->rt->fib6_node)) {
                        ip6_ins_rt(net, ifp->rt);
+               } else if (!ifp->rt && (ifp->idev->dev->flags & IFF_UP)) {
+                       pr_warn("BUG: Address %pI6c on device %s is missing its 
host route.\n",
+                               &ifp->addr, ifp->idev->dev->name);
+               }
+
                if (ifp->idev->cnf.forwarding)
                        addrconf_join_anycast(ifp);
                if (!ipv6_addr_any(&ifp->peer_addr))
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 6b74523fc1c4..2b6d43022383 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -220,6 +220,16 @@ static struct sk_buff *ip6_rcv_core(struct sk_buff *skb, 
struct net_device *dev,
        if (ipv6_addr_is_multicast(&hdr->saddr))
                goto err;
 
+       /* While RFC4291 is not explicit about v4mapped addresses
+        * in IPv6 headers, it seems clear linux dual-stack
+        * model can not deal properly with these.
+        * Security models could be fooled by ::ffff:127.0.0.1 for example.
+        *
+        * https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02
+        */
+       if (ipv6_addr_v4mapped(&hdr->saddr))
+               goto err;
+
        skb->transport_header = skb->network_header + sizeof(*hdr);
        IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 3a27c04ff62f..d1c59cb6dceb 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1047,6 +1047,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct 
flowi6 *fl6,
        __wsum csum = 0;
        int offset = skb_transport_offset(skb);
        int len = skb->len - offset;
+       int datalen = len - sizeof(*uh);
 
        /*
         * Create a UDP header
@@ -1079,8 +1080,12 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct 
flowi6 *fl6,
                        return -EIO;
                }
 
-               skb_shinfo(skb)->gso_size = cork->gso_size;
-               skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
+               if (datalen > cork->gso_size) {
+                       skb_shinfo(skb)->gso_size = cork->gso_size;
+                       skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
+                       skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(datalen,
+                                                                
cork->gso_size);
+               }
                goto csum_partial;
        }
 
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index ff254e8c0c44..e0a2cb8a029f 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -119,9 +119,14 @@ static int llcp_sock_bind(struct socket *sock, struct 
sockaddr *addr, int alen)
        llcp_sock->service_name = kmemdup(llcp_addr.service_name,
                                          llcp_sock->service_name_len,
                                          GFP_KERNEL);
-
+       if (!llcp_sock->service_name) {
+               ret = -ENOMEM;
+               goto put_dev;
+       }
        llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock);
        if (llcp_sock->ssap == LLCP_SAP_MAX) {
+               kfree(llcp_sock->service_name);
+               llcp_sock->service_name = NULL;
                ret = -EADDRINUSE;
                goto put_dev;
        }
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index 9f2875efb4ac..b3662264aa24 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -981,7 +981,8 @@ static int nfc_genl_dep_link_down(struct sk_buff *skb, 
struct genl_info *info)
        int rc;
        u32 idx;
 
-       if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
+       if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
+           !info->attrs[NFC_ATTR_TARGET_INDEX])
                return -EINVAL;
 
        idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
@@ -1029,7 +1030,8 @@ static int nfc_genl_llc_get_params(struct sk_buff *skb, 
struct genl_info *info)
        struct sk_buff *msg = NULL;
        u32 idx;
 
-       if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
+       if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
+           !info->attrs[NFC_ATTR_FIRMWARE_NAME])
                return -EINVAL;
 
        idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
diff --git a/net/rds/ib.c b/net/rds/ib.c
index eba75c1ba359..ba3379085c52 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -143,6 +143,9 @@ static void rds_ib_add_one(struct ib_device *device)
        refcount_set(&rds_ibdev->refcount, 1);
        INIT_WORK(&rds_ibdev->free_work, rds_ib_dev_free);
 
+       INIT_LIST_HEAD(&rds_ibdev->ipaddr_list);
+       INIT_LIST_HEAD(&rds_ibdev->conn_list);
+
        rds_ibdev->max_wrs = device->attrs.max_qp_wr;
        rds_ibdev->max_sge = min(device->attrs.max_send_sge, RDS_IB_MAX_SGE);
 
@@ -203,9 +206,6 @@ static void rds_ib_add_one(struct ib_device *device)
                device->name,
                rds_ibdev->use_fastreg ? "FRMR" : "FMR");
 
-       INIT_LIST_HEAD(&rds_ibdev->ipaddr_list);
-       INIT_LIST_HEAD(&rds_ibdev->conn_list);
-
        down_write(&rds_ib_devices_lock);
        list_add_tail_rcu(&rds_ibdev->list, &rds_ib_devices);
        up_write(&rds_ib_devices_lock);
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index f42025d53cfe..ebc3c8c7e666 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1132,6 +1132,32 @@ static const struct nla_policy cbq_policy[TCA_CBQ_MAX + 
1] = {
        [TCA_CBQ_POLICE]        = { .len = sizeof(struct tc_cbq_police) },
 };
 
+static int cbq_opt_parse(struct nlattr *tb[TCA_CBQ_MAX + 1],
+                        struct nlattr *opt,
+                        struct netlink_ext_ack *extack)
+{
+       int err;
+
+       if (!opt) {
+               NL_SET_ERR_MSG(extack, "CBQ options are required for this 
operation");
+               return -EINVAL;
+       }
+
+       err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy, extack);
+       if (err < 0)
+               return err;
+
+       if (tb[TCA_CBQ_WRROPT]) {
+               const struct tc_cbq_wrropt *wrr = nla_data(tb[TCA_CBQ_WRROPT]);
+
+               if (wrr->priority > TC_CBQ_MAXPRIO) {
+                       NL_SET_ERR_MSG(extack, "priority is bigger than 
TC_CBQ_MAXPRIO");
+                       err = -EINVAL;
+               }
+       }
+       return err;
+}
+
 static int cbq_init(struct Qdisc *sch, struct nlattr *opt,
                    struct netlink_ext_ack *extack)
 {
@@ -1144,12 +1170,7 @@ static int cbq_init(struct Qdisc *sch, struct nlattr 
*opt,
        hrtimer_init(&q->delay_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED);
        q->delay_timer.function = cbq_undelay;
 
-       if (!opt) {
-               NL_SET_ERR_MSG(extack, "CBQ options are required for this 
operation");
-               return -EINVAL;
-       }
-
-       err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy, extack);
+       err = cbq_opt_parse(tb, opt, extack);
        if (err < 0)
                return err;
 
@@ -1466,12 +1487,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 
parentid, struct nlattr **t
        struct cbq_class *parent;
        struct qdisc_rate_table *rtab = NULL;
 
-       if (!opt) {
-               NL_SET_ERR_MSG(extack, "Mandatory qdisc options missing");
-               return -EINVAL;
-       }
-
-       err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy, extack);
+       err = cbq_opt_parse(tb, opt, extack);
        if (err < 0)
                return err;
 
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 049714c57075..84c948c91914 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -357,6 +357,8 @@ static int dsmark_init(struct Qdisc *sch, struct nlattr 
*opt,
                goto errout;
 
        err = -EINVAL;
+       if (!tb[TCA_DSMARK_INDICES])
+               goto errout;
        indices = nla_get_u16(tb[TCA_DSMARK_INDICES]);
 
        if (hweight32(indices) != 1)
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 836727e363c4..6344aca4487b 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -161,6 +161,7 @@ struct tipc_link {
        struct {
                u16 len;
                u16 limit;
+               struct sk_buff *target_bskb;
        } backlog[5];
        u16 snd_nxt;
        u16 last_retransm;
@@ -846,6 +847,7 @@ static void link_prepare_wakeup(struct tipc_link *l)
 void tipc_link_reset(struct tipc_link *l)
 {
        struct sk_buff_head list;
+       u32 imp;
 
        __skb_queue_head_init(&list);
 
@@ -864,11 +866,10 @@ void tipc_link_reset(struct tipc_link *l)
        __skb_queue_purge(&l->transmq);
        __skb_queue_purge(&l->deferdq);
        __skb_queue_purge(&l->backlogq);
-       l->backlog[TIPC_LOW_IMPORTANCE].len = 0;
-       l->backlog[TIPC_MEDIUM_IMPORTANCE].len = 0;
-       l->backlog[TIPC_HIGH_IMPORTANCE].len = 0;
-       l->backlog[TIPC_CRITICAL_IMPORTANCE].len = 0;
-       l->backlog[TIPC_SYSTEM_IMPORTANCE].len = 0;
+       for (imp = 0; imp <= TIPC_SYSTEM_IMPORTANCE; imp++) {
+               l->backlog[imp].len = 0;
+               l->backlog[imp].target_bskb = NULL;
+       }
        kfree_skb(l->reasm_buf);
        kfree_skb(l->failover_reasm_skb);
        l->reasm_buf = NULL;
@@ -909,7 +910,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head 
*list,
        u16 bc_ack = l->bc_rcvlink->rcv_nxt - 1;
        struct sk_buff_head *transmq = &l->transmq;
        struct sk_buff_head *backlogq = &l->backlogq;
-       struct sk_buff *skb, *_skb, *bskb;
+       struct sk_buff *skb, *_skb, **tskb;
        int pkt_cnt = skb_queue_len(list);
        int rc = 0;
 
@@ -955,19 +956,21 @@ int tipc_link_xmit(struct tipc_link *l, struct 
sk_buff_head *list,
                        seqno++;
                        continue;
                }
-               if (tipc_msg_bundle(skb_peek_tail(backlogq), hdr, mtu)) {
+               tskb = &l->backlog[imp].target_bskb;
+               if (tipc_msg_bundle(*tskb, hdr, mtu)) {
                        kfree_skb(__skb_dequeue(list));
                        l->stats.sent_bundled++;
                        continue;
                }
-               if (tipc_msg_make_bundle(&bskb, hdr, mtu, l->addr)) {
+               if (tipc_msg_make_bundle(tskb, hdr, mtu, l->addr)) {
                        kfree_skb(__skb_dequeue(list));
-                       __skb_queue_tail(backlogq, bskb);
-                       l->backlog[msg_importance(buf_msg(bskb))].len++;
+                       __skb_queue_tail(backlogq, *tskb);
+                       l->backlog[imp].len++;
                        l->stats.sent_bundled++;
                        l->stats.sent_bundles++;
                        continue;
                }
+               l->backlog[imp].target_bskb = NULL;
                l->backlog[imp].len += skb_queue_len(list);
                skb_queue_splice_tail_init(list, backlogq);
        }
@@ -983,6 +986,7 @@ static void tipc_link_advance_backlog(struct tipc_link *l,
        u16 seqno = l->snd_nxt;
        u16 ack = l->rcv_nxt - 1;
        u16 bc_ack = l->bc_rcvlink->rcv_nxt - 1;
+       u32 imp;
 
        while (skb_queue_len(&l->transmq) < l->window) {
                skb = skb_peek(&l->backlogq);
@@ -993,7 +997,10 @@ static void tipc_link_advance_backlog(struct tipc_link *l,
                        break;
                __skb_dequeue(&l->backlogq);
                hdr = buf_msg(skb);
-               l->backlog[msg_importance(hdr)].len--;
+               imp = msg_importance(hdr);
+               l->backlog[imp].len--;
+               if (unlikely(skb == l->backlog[imp].target_bskb))
+                       l->backlog[imp].target_bskb = NULL;
                __skb_queue_tail(&l->transmq, skb);
                __skb_queue_tail(xmitq, _skb);
                TIPC_SKB_CB(skb)->ackers = l->ackers;
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index b61891054709..cbccf1791d3c 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -484,10 +484,7 @@ bool tipc_msg_make_bundle(struct sk_buff **skb,  struct 
tipc_msg *msg,
        bmsg = buf_msg(_skb);
        tipc_msg_init(msg_prevnode(msg), bmsg, MSG_BUNDLER, 0,
                      INT_H_SIZE, dnode);
-       if (msg_isdata(msg))
-               msg_set_importance(bmsg, TIPC_CRITICAL_IMPORTANCE);
-       else
-               msg_set_importance(bmsg, TIPC_SYSTEM_IMPORTANCE);
+       msg_set_importance(bmsg, msg_importance(msg));
        msg_set_seqno(bmsg, msg_seqno(msg));
        msg_set_ack(bmsg, msg_ack(msg));
        msg_set_bcast_ack(bmsg, msg_bcast_ack(msg));
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 2e30bf197583..2a4613b239e0 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -641,7 +641,7 @@ struct sock *__vsock_create(struct net *net,
 }
 EXPORT_SYMBOL_GPL(__vsock_create);
 
-static void __vsock_release(struct sock *sk)
+static void __vsock_release(struct sock *sk, int level)
 {
        if (sk) {
                struct sk_buff *skb;
@@ -651,9 +651,17 @@ static void __vsock_release(struct sock *sk)
                vsk = vsock_sk(sk);
                pending = NULL; /* Compiler warning. */
 
+               /* The release call is supposed to use lock_sock_nested()
+                * rather than lock_sock(), if a sock lock should be acquired.
+                */
                transport->release(vsk);
 
-               lock_sock(sk);
+               /* When "level" is SINGLE_DEPTH_NESTING, use the nested
+                * version to avoid the warning "possible recursive locking
+                * detected". When "level" is 0, lock_sock_nested(sk, level)
+                * is the same as lock_sock(sk).
+                */
+               lock_sock_nested(sk, level);
                sock_orphan(sk);
                sk->sk_shutdown = SHUTDOWN_MASK;
 
@@ -662,7 +670,7 @@ static void __vsock_release(struct sock *sk)
 
                /* Clean up any sockets that never were accepted. */
                while ((pending = vsock_dequeue_accept(sk)) != NULL) {
-                       __vsock_release(pending);
+                       __vsock_release(pending, SINGLE_DEPTH_NESTING);
                        sock_put(pending);
                }
 
@@ -711,7 +719,7 @@ EXPORT_SYMBOL_GPL(vsock_stream_has_space);
 
 static int vsock_release(struct socket *sock)
 {
-       __vsock_release(sock->sk);
+       __vsock_release(sock->sk, 0);
        sock->sk = NULL;
        sock->state = SS_FREE;
 
diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index 98f193fd5315..70350dc67366 100644
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -538,7 +538,7 @@ static void hvs_release(struct vsock_sock *vsk)
        struct sock *sk = sk_vsock(vsk);
        bool remove_sock;
 
-       lock_sock(sk);
+       lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
        remove_sock = hvs_close_lock_held(vsk);
        release_sock(sk);
        if (remove_sock)
diff --git a/net/vmw_vsock/virtio_transport_common.c 
b/net/vmw_vsock/virtio_transport_common.c
index e30f53728725..3c199f752fd3 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -791,7 +791,7 @@ void virtio_transport_release(struct vsock_sock *vsk)
        struct sock *sk = &vsk->sk;
        bool remove_sock = true;
 
-       lock_sock(sk);
+       lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
        if (sk->sk_type == SOCK_STREAM)
                remove_sock = virtio_transport_close(vsk);
 
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index 9a4c0ad46518..c071c356a963 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -469,7 +469,7 @@ char *smk_parse_smack(const char *string, int len)
        if (i == 0 || i >= SMK_LONGLABEL)
                return ERR_PTR(-EINVAL);
 
-       smack = kzalloc(i + 1, GFP_KERNEL);
+       smack = kzalloc(i + 1, GFP_NOFS);
        if (smack == NULL)
                return ERR_PTR(-ENOMEM);
 
@@ -504,7 +504,7 @@ int smk_netlbl_mls(int level, char *catset, struct 
netlbl_lsm_secattr *sap,
                        if ((m & *cp) == 0)
                                continue;
                        rc = netlbl_catmap_setbit(&sap->attr.mls.cat,
-                                                 cat, GFP_KERNEL);
+                                                 cat, GFP_NOFS);
                        if (rc < 0) {
                                netlbl_catmap_free(sap->attr.mls.cat);
                                return rc;
@@ -540,7 +540,7 @@ struct smack_known *smk_import_entry(const char *string, 
int len)
        if (skp != NULL)
                goto freeout;
 
-       skp = kzalloc(sizeof(*skp), GFP_KERNEL);
+       skp = kzalloc(sizeof(*skp), GFP_NOFS);
        if (skp == NULL) {
                skp = ERR_PTR(-ENOMEM);
                goto freeout;
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 017c47eb795e..221de4c755c3 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -270,7 +270,7 @@ static struct smack_known *smk_fetch(const char *name, 
struct inode *ip,
        if (!(ip->i_opflags & IOP_XATTR))
                return ERR_PTR(-EOPNOTSUPP);
 
-       buffer = kzalloc(SMK_LONGLABEL, GFP_KERNEL);
+       buffer = kzalloc(SMK_LONGLABEL, GFP_NOFS);
        if (buffer == NULL)
                return ERR_PTR(-ENOMEM);
 
@@ -947,7 +947,8 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm)
 
                if (rc != 0)
                        return rc;
-       } else if (bprm->unsafe)
+       }
+       if (bprm->unsafe & ~LSM_UNSAFE_PTRACE)
                return -EPERM;
 
        bsp->smk_task = isp->smk_task;
@@ -4005,6 +4006,8 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, 
struct sk_buff *skb)
                        skp = smack_ipv6host_label(&sadd);
                if (skp == NULL)
                        skp = smack_net_ambient;
+               if (skb == NULL)
+                       break;
 #ifdef CONFIG_AUDIT
                smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
                ad.a.u.net->family = family;
diff --git a/tools/testing/selftests/net/udpgso.c 
b/tools/testing/selftests/net/udpgso.c
index e279051bc631..270c17ab071e 100644
--- a/tools/testing/selftests/net/udpgso.c
+++ b/tools/testing/selftests/net/udpgso.c
@@ -90,12 +90,9 @@ struct testcase testcases_v4[] = {
                .tfail = true,
        },
        {
-               /* send a single MSS: will fail with GSO, because the segment
-                * logic in udp4_ufo_fragment demands a gso skb to be > MTU
-                */
+               /* send a single MSS: will fall back to no GSO */
                .tlen = CONST_MSS_V4,
                .gso_len = CONST_MSS_V4,
-               .tfail = true,
                .r_num_mss = 1,
        },
        {
@@ -140,10 +137,9 @@ struct testcase testcases_v4[] = {
                .tfail = true,
        },
        {
-               /* send a single 1B MSS: will fail, see single MSS above */
+               /* send a single 1B MSS: will fall back to no GSO */
                .tlen = 1,
                .gso_len = 1,
-               .tfail = true,
                .r_num_mss = 1,
        },
        {
@@ -197,12 +193,9 @@ struct testcase testcases_v6[] = {
                .tfail = true,
        },
        {
-               /* send a single MSS: will fail with GSO, because the segment
-                * logic in udp4_ufo_fragment demands a gso skb to be > MTU
-                */
+               /* send a single MSS: will fall back to no GSO */
                .tlen = CONST_MSS_V6,
                .gso_len = CONST_MSS_V6,
-               .tfail = true,
                .r_num_mss = 1,
        },
        {
@@ -247,10 +240,9 @@ struct testcase testcases_v6[] = {
                .tfail = true,
        },
        {
-               /* send a single 1B MSS: will fail, see single MSS above */
+               /* send a single 1B MSS: will fall back to no GSO */
                .tlen = 1,
                .gso_len = 1,
-               .tfail = true,
                .r_num_mss = 1,
        },
        {
diff --git a/usr/Makefile b/usr/Makefile
index 748f6a60bb1e..138c18cefb52 100644
--- a/usr/Makefile
+++ b/usr/Makefile
@@ -11,6 +11,9 @@ datafile_y = initramfs_data.cpio$(suffix_y)
 datafile_d_y = .$(datafile_y).d
 AFLAGS_initramfs_data.o += -DINITRAMFS_IMAGE="usr/$(datafile_y)"
 
+# clean rules do not have CONFIG_INITRAMFS_COMPRESSION.  So clean up after all
+# possible compression formats.
+clean-files += initramfs_data.cpio*
 
 # Generate builtin.o based on initramfs_data.o
 obj-$(CONFIG_BLK_DEV_INITRD) := initramfs_data.o

Reply via email to